From owner-cvs-src@FreeBSD.ORG Sun Apr 23 17:06:19 2006 Return-Path: X-Original-To: cvs-src@FreeBSD.org Delivered-To: cvs-src@FreeBSD.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 3DA7D16A400; Sun, 23 Apr 2006 17:06:19 +0000 (UTC) (envelope-from dwmalone@FreeBSD.org) Received: from repoman.freebsd.org (repoman.freebsd.org [216.136.204.115]) by mx1.FreeBSD.org (Postfix) with ESMTP id F27FF43D53; Sun, 23 Apr 2006 17:06:18 +0000 (GMT) (envelope-from dwmalone@FreeBSD.org) Received: from repoman.freebsd.org (localhost [127.0.0.1]) by repoman.freebsd.org (8.13.1/8.13.1) with ESMTP id k3NH6If6038016; Sun, 23 Apr 2006 17:06:18 GMT (envelope-from dwmalone@repoman.freebsd.org) Received: (from dwmalone@localhost) by repoman.freebsd.org (8.13.1/8.13.1/Submit) id k3NH6I95038014; Sun, 23 Apr 2006 17:06:18 GMT (envelope-from dwmalone) Message-Id: <200604231706.k3NH6I95038014@repoman.freebsd.org> From: David Malone Date: Sun, 23 Apr 2006 17:06:18 +0000 (UTC) To: src-committers@FreeBSD.org, cvs-src@FreeBSD.org, cvs-all@FreeBSD.org X-FreeBSD-CVS-Branch: HEAD Cc: Subject: cvs commit: src/lib/libugidfw libugidfw.3 ugidfw.c ugidfw.h src/sys/security/mac_bsdextended mac_bsdextended.c mac_bsdextended.h src/tools/regression/mac/mac_bsdextended test_matches.sh test_ugidfw.c src/usr.sbin/ugidfw ugidfw.8 ugidfw.c X-BeenThere: cvs-src@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: CVS commit messages for the src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 23 Apr 2006 17:06:19 -0000 dwmalone 2006-04-23 17:06:18 UTC FreeBSD src repository Modified files: lib/libugidfw libugidfw.3 ugidfw.c ugidfw.h sys/security/mac_bsdextended mac_bsdextended.c mac_bsdextended.h tools/regression/mac/mac_bsdextended test_ugidfw.c usr.sbin/ugidfw ugidfw.8 ugidfw.c Added files: tools/regression/mac/mac_bsdextended test_matches.sh Log: Add some new options to mac_bsdestended. We can now match on: subject: ranges of uid, ranges of gid, jail id objects: ranges of uid, ranges of gid, filesystem, object is suid, object is sgid, object matches subject uid/gid object type We can also negate individual conditions. The ruleset language is a superset of the previous language, so old rules should continue to work. These changes require a change to the API between libugidfw and the mac_bsdextended module. Add a version number, so we can tell if we're running mismatched versions. Update man pages to reflect changes, add extra test cases to test_ugidfw.c and add a shell script that checks that the the module seems to do what we expect. Suggestions from: rwatson, trhodes Reviewed by: trhodes MFC after: 2 months Revision Changes Path 1.8 +0 -10 src/lib/libugidfw/libugidfw.3 1.11 +729 -167 src/lib/libugidfw/ugidfw.c 1.5 +0 -3 src/lib/libugidfw/ugidfw.h 1.29 +158 -25 src/sys/security/mac_bsdextended/mac_bsdextended.c 1.6 +52 -10 src/sys/security/mac_bsdextended/mac_bsdextended.h 1.1 +167 -0 src/tools/regression/mac/mac_bsdextended/test_matches.sh (new) 1.3 +50 -8 src/tools/regression/mac/mac_bsdextended/test_ugidfw.c 1.9 +195 -44 src/usr.sbin/ugidfw/ugidfw.8 1.6 +1 -0 src/usr.sbin/ugidfw/ugidfw.c