From owner-p4-projects Tue Dec 24 13:26: 5 2002 Delivered-To: p4-projects@freebsd.org Received: by hub.freebsd.org (Postfix, from userid 32767) id 887FB37B405; Tue, 24 Dec 2002 13:26:00 -0800 (PST) Delivered-To: perforce@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 1F8BD37B401 for ; Tue, 24 Dec 2002 13:26:00 -0800 (PST) Received: from repoman.freebsd.org (repoman.freebsd.org [216.136.204.115]) by mx1.FreeBSD.org (Postfix) with ESMTP id B223743EC2 for ; Tue, 24 Dec 2002 13:25:59 -0800 (PST) (envelope-from bb+lists.freebsd.perforce@cyrus.watson.org) Received: from repoman.freebsd.org (localhost [127.0.0.1]) by repoman.freebsd.org (8.12.6/8.12.6) with ESMTP id gBOLPxfh083460 for ; Tue, 24 Dec 2002 13:25:59 -0800 (PST) (envelope-from bb+lists.freebsd.perforce@cyrus.watson.org) Received: (from perforce@localhost) by repoman.freebsd.org (8.12.6/8.12.6/Submit) id gBOLPxEb083457 for perforce@freebsd.org; Tue, 24 Dec 2002 13:25:59 -0800 (PST) Date: Tue, 24 Dec 2002 13:25:59 -0800 (PST) Message-Id: <200212242125.gBOLPxEb083457@repoman.freebsd.org> X-Authentication-Warning: repoman.freebsd.org: perforce set sender to bb+lists.freebsd.perforce@cyrus.watson.org using -f From: Robert Watson Subject: PERFORCE change 22718 for review To: Perforce Change Reviews Sender: owner-p4-projects@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG http://perforce.freebsd.org/chv.cgi?CH=22718 Change 22718 by rwatson@rwatson_paprika on 2002/12/24 13:25:23 Instrument and authorized swapoff event. Affected files ... .. //depot/projects/trustedbsd/mac/sys/kern/kern_mac.c#371 edit .. //depot/projects/trustedbsd/mac/sys/security/mac_biba/mac_biba.c#193 edit .. //depot/projects/trustedbsd/mac/sys/security/mac_none/mac_none.c#115 edit .. //depot/projects/trustedbsd/mac/sys/security/mac_test/mac_test.c#91 edit .. //depot/projects/trustedbsd/mac/sys/sys/mac.h#225 edit .. //depot/projects/trustedbsd/mac/sys/sys/mac_policy.h#179 edit .. //depot/projects/trustedbsd/mac/sys/vm/vm_swap.c#16 edit Differences ... ==== //depot/projects/trustedbsd/mac/sys/kern/kern_mac.c#371 (text+ko) ==== @@ -2693,6 +2693,20 @@ } int +mac_check_system_swapoff(struct ucred *cred, struct vnode *vp) +{ + int error; + + ASSERT_VOP_LOCKED(vp, "mac_check_system_swapoff"); + + if (!mac_enforce_system) + return (0); + + MAC_CHECK(check_system_swapoff, cred, vp, &vp->v_label); + return (error); +} + +int mac_check_system_sysctl(struct ucred *cred, int *name, u_int namelen, void *old, size_t *oldlenp, int inkernel, void *new, size_t newlen) { ==== //depot/projects/trustedbsd/mac/sys/security/mac_biba/mac_biba.c#193 (text+ko) ==== @@ -1959,6 +1959,26 @@ } static int +mac_biba_check_system_swapoff(struct ucred *cred, struct vnode *vp, + struct label *label) +{ + struct mac_biba *subj, *obj; + int error; + + if (!mac_biba_enabled) + return (0); + + subj = SLOT(&cred->cr_label); + obj = SLOT(label); + + error = mac_biba_subject_privileged(subj); + if (error) + return (error); + + return (0); +} + +static int mac_biba_check_system_sysctl(struct ucred *cred, int *name, u_int namelen, void *old, size_t *oldlenp, int inkernel, void *new, size_t newlen) { @@ -2691,6 +2711,7 @@ .mpo_check_system_acct = mac_biba_check_system_acct, .mpo_check_system_settime = mac_biba_check_system_settime, .mpo_check_system_swapon = mac_biba_check_system_swapon, + .mpo_check_system_swapoff = mac_biba_check_system_swapoff, .mpo_check_system_sysctl = mac_biba_check_system_sysctl, .mpo_check_vnode_access = mac_biba_check_vnode_open, .mpo_check_vnode_chdir = mac_biba_check_vnode_chdir, ==== //depot/projects/trustedbsd/mac/sys/security/mac_none/mac_none.c#115 (text+ko) ==== @@ -700,6 +700,14 @@ } static int +mac_none_check_system_swapoff(struct ucred *cred, struct vnode *vp, + struct label *label) +{ + + return (0); +} + +static int mac_none_check_system_sysctl(struct ucred *cred, int *name, u_int namelen, void *old, size_t *oldlenp, int inkernel, void *new, size_t newlen) { @@ -1066,6 +1074,7 @@ .mpo_check_system_reboot = mac_none_check_system_reboot, .mpo_check_system_settime = mac_none_check_system_settime, .mpo_check_system_swapon = mac_none_check_system_swapon, + .mpo_check_system_swapoff = mac_none_check_system_swapoff, .mpo_check_system_sysctl = mac_none_check_system_sysctl, .mpo_check_vnode_access = mac_none_check_vnode_access, .mpo_check_vnode_chdir = mac_none_check_vnode_chdir, ==== //depot/projects/trustedbsd/mac/sys/security/mac_test/mac_test.c#91 (text+ko) ==== @@ -1096,6 +1096,14 @@ } static int +mac_test_check_system_swapoff(struct ucred *cred, struct vnode *vp, + struct label *label) +{ + + return (0); +} + +static int mac_test_check_system_sysctl(struct ucred *cred, int *name, u_int namelen, void *old, size_t *oldlenp, int inkernel, void *new, size_t newlen) { @@ -1463,6 +1471,7 @@ .mpo_check_system_reboot = mac_test_check_system_reboot, .mpo_check_system_settime = mac_test_check_system_settime, .mpo_check_system_swapon = mac_test_check_system_swapon, + .mpo_check_system_swapoff = mac_test_check_system_swapoff, .mpo_check_system_sysctl = mac_test_check_system_sysctl, .mpo_check_vnode_access = mac_test_check_vnode_access, .mpo_check_vnode_chdir = mac_test_check_vnode_chdir, ==== //depot/projects/trustedbsd/mac/sys/sys/mac.h#225 (text+ko) ==== @@ -270,6 +270,7 @@ int mac_check_system_reboot(struct ucred *cred, int howto); int mac_check_system_settime(struct ucred *cred); int mac_check_system_swapon(struct ucred *cred, struct vnode *vp); +int mac_check_system_swapoff(struct ucred *cred, struct vnode *vp); int mac_check_system_sysctl(struct ucred *cred, int *name, u_int namelen, void *old, size_t *oldlenp, int inkernel, void *new, size_t newlen); ==== //depot/projects/trustedbsd/mac/sys/sys/mac_policy.h#179 (text+ko) ==== @@ -330,6 +330,8 @@ int (*mpo_check_system_settime)(struct ucred *cred); int (*mpo_check_system_swapon)(struct ucred *cred, struct vnode *vp, struct label *label); + int (*mpo_check_system_swapoff)(struct ucred *cred, + struct vnode *vp, struct label *label); int (*mpo_check_system_sysctl)(struct ucred *cred, int *name, u_int namelen, void *old, size_t *oldlenp, int inkernel, void *new, size_t newlen); ==== //depot/projects/trustedbsd/mac/sys/vm/vm_swap.c#16 (text+ko) ==== @@ -422,6 +422,14 @@ error = EINVAL; goto done; found: +#ifdef MAC + (void) vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); + error = mac_check_system_swapoff(td->td_ucred, vp); + (void) VOP_UNLOCK(vp, 0, td); + if (error != 0) + goto done; +#endif + nblks = sp->sw_nblks; /* To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe p4-projects" in the body of the message