Date: Mon, 20 Oct 2003 18:15:31 -0700 (PDT) From: Robert Watson <rwatson@FreeBSD.org> To: Perforce Change Reviews <perforce@freebsd.org> Subject: PERFORCE change 40052 for review Message-ID: <200310210115.h9L1FVpL011880@repoman.freebsd.org>
next in thread | raw e-mail | index | archive | help
http://perforce.freebsd.org/chv.cgi?CH=40052 Change 40052 by rwatson@rwatson_tislabs on 2003/10/20 18:14:42 Move network-related MAC entry points and utility routines from kern_mac.c to mac_net.c. This includes mbufs, bpfs, ifnets, sockets, ipqs. Ideally, I'd like more granularity in the breakdown, but this is a first pass. Affected files ... .. //depot/projects/trustedbsd/mac/sys/conf/files#89 edit .. //depot/projects/trustedbsd/mac/sys/kern/kern_mac.c#417 edit .. //depot/projects/trustedbsd/mac/sys/security/mac/mac_net.c#2 edit Differences ... ==== //depot/projects/trustedbsd/mac/sys/conf/files#89 (text+ko) ==== @@ -1588,6 +1588,7 @@ posix4/p1003_1b.c standard posix4/posix4_mib.c standard kern/uipc_sem.c optional p1003_1b_semaphores +security/mac/mac_net.c optional mac security/mac/mac_pipe.c optional mac security/mac/mac_posix_sem.c optional mac security/mac/mac_system.c optional mac ==== //depot/projects/trustedbsd/mac/sys/kern/kern_mac.c#417 (text+ko) ==== @@ -141,21 +141,11 @@ &mac_enforce_fs, 0, "Enforce MAC policy on file system objects"); TUNABLE_INT("security.mac.enforce_fs", &mac_enforce_fs); -static int mac_enforce_network = 1; -SYSCTL_INT(_security_mac, OID_AUTO, enforce_network, CTLFLAG_RW, - &mac_enforce_network, 0, "Enforce MAC policy on network packets"); -TUNABLE_INT("security.mac.enforce_network", &mac_enforce_network); - static int mac_enforce_process = 1; SYSCTL_INT(_security_mac, OID_AUTO, enforce_process, CTLFLAG_RW, &mac_enforce_process, 0, "Enforce MAC policy on inter-process operations"); TUNABLE_INT("security.mac.enforce_process", &mac_enforce_process); -static int mac_enforce_socket = 1; -SYSCTL_INT(_security_mac, OID_AUTO, enforce_socket, CTLFLAG_RW, - &mac_enforce_socket, 0, "Enforce MAC policy on socket operations"); -TUNABLE_INT("security.mac.enforce_socket", &mac_enforce_socket); - static int mac_enforce_vm = 1; SYSCTL_INT(_security_mac, OID_AUTO, enforce_vm, CTLFLAG_RW, &mac_enforce_vm, 0, "Enforce MAC policy on vm operations"); @@ -185,22 +175,11 @@ SYSCTL_NODE(_security_mac_debug, OID_AUTO, counters, CTLFLAG_RW, 0, "TrustedBSD MAC object counters"); -static unsigned int nmacmbufs, nmaccreds, nmacifnets, nmacbpfdescs, - nmacsockets, nmacmounts, nmactemp, nmacvnodes, nmacdevfsdirents, - nmacipqs, nmacprocs; +static unsigned int nmaccreds, nmacmounts, nmactemp, nmacvnodes, + nmacdevfsdirents, nmacprocs; -SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, mbufs, CTLFLAG_RD, - &nmacmbufs, 0, "number of mbufs in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, creds, CTLFLAG_RD, &nmaccreds, 0, "number of ucreds in use"); -SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, ifnets, CTLFLAG_RD, - &nmacifnets, 0, "number of ifnets in use"); -SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, ipqs, CTLFLAG_RD, - &nmacipqs, 0, "number of ipqs in use"); -SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, bpfdescs, CTLFLAG_RD, - &nmacbpfdescs, 0, "number of bpfdescs in use"); -SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, sockets, CTLFLAG_RD, - &nmacsockets, 0, "number of sockets in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, procs, CTLFLAG_RD, &nmacprocs, 0, "number of procs in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, mounts, CTLFLAG_RD, @@ -221,8 +200,6 @@ static void mac_cred_mmapped_drop_perms_recurse(struct thread *td, struct ucred *cred, struct vm_map *map); -static void mac_destroy_socket_label(struct label *label); - static int mac_setlabel_vnode_extattr(struct ucred *cred, struct vnode *vp, struct label *intlabel); @@ -602,18 +579,6 @@ return (error2); } -static struct label * -mbuf_to_label(struct mbuf *mbuf) -{ - struct m_tag *tag; - struct label *label; - - tag = m_tag_find(mbuf, PACKET_TAG_MACLABEL, NULL); - label = (struct label *)(tag+1); - - return (label); -} - void mac_init_label(struct label *label) { @@ -633,15 +598,6 @@ /* implicit: label->l_flags &= ~MAC_FLAG_INITIALIZED; */ } -void -mac_init_bpfdesc(struct bpf_d *bpf_d) -{ - - mac_init_label(&bpf_d->bd_label); - MAC_PERFORM(init_bpfdesc_label, &bpf_d->bd_label); - MAC_DEBUG_COUNTER_INC(&nmacbpfdescs); -} - static void mac_init_cred_label(struct label *label) { @@ -667,87 +623,6 @@ MAC_DEBUG_COUNTER_INC(&nmacdevfsdirents); } -static void -mac_init_ifnet_label(struct label *label) -{ - - mac_init_label(label); - MAC_PERFORM(init_ifnet_label, label); - MAC_DEBUG_COUNTER_INC(&nmacifnets); -} - -void -mac_init_ifnet(struct ifnet *ifp) -{ - - mac_init_ifnet_label(&ifp->if_label); -} - -int -mac_init_ipq(struct ipq *ipq, int flag) -{ - int error; - - mac_init_label(&ipq->ipq_label); - - MAC_CHECK(init_ipq_label, &ipq->ipq_label, flag); - if (error) { - MAC_PERFORM(destroy_ipq_label, &ipq->ipq_label); - mac_destroy_label(&ipq->ipq_label); - } else { - MAC_DEBUG_COUNTER_INC(&nmacipqs); - } - return (error); -} - -int -mac_init_mbuf_tag(struct m_tag *tag, int flag) -{ - struct label *label; - int error; - - label = (struct label *) (tag + 1); - mac_init_label(label); - - MAC_CHECK(init_mbuf_label, label, flag); - if (error) { - MAC_PERFORM(destroy_mbuf_label, label); - mac_destroy_label(label); - } else { - MAC_DEBUG_COUNTER_INC(&nmacmbufs); - } - return (error); -} - -int -mac_init_mbuf(struct mbuf *m, int flag) -{ - struct m_tag *tag; - int error; - - M_ASSERTPKTHDR(m); - -#ifndef MAC_ALWAYS_LABEL_MBUF - /* - * If conditionally allocating mbuf labels, don't allocate unless - * they are required. - */ - if (!mac_labelmbufs) - return (0); -#endif - tag = m_tag_get(PACKET_TAG_MACLABEL, sizeof(struct label), - flag); - if (tag == NULL) - return (ENOMEM); - error = mac_init_mbuf_tag(tag, flag); - if (error) { - m_tag_free(tag); - return (error); - } - m_tag_prepend(m, tag); - return (0); -} - void mac_init_mount(struct mount *mp) { @@ -768,56 +643,6 @@ MAC_DEBUG_COUNTER_INC(&nmacprocs); } -static int -mac_init_socket_label(struct label *label, int flag) -{ - int error; - - mac_init_label(label); - - MAC_CHECK(init_socket_label, label, flag); - if (error) { - MAC_PERFORM(destroy_socket_label, label); - mac_destroy_label(label); - } else { - MAC_DEBUG_COUNTER_INC(&nmacsockets); - } - - return (error); -} - -static int -mac_init_socket_peer_label(struct label *label, int flag) -{ - int error; - - mac_init_label(label); - - MAC_CHECK(init_socket_peer_label, label, flag); - if (error) { - MAC_PERFORM(destroy_socket_label, label); - mac_destroy_label(label); - } - - return (error); -} - -int -mac_init_socket(struct socket *socket, int flag) -{ - int error; - - error = mac_init_socket_label(&socket->so_label, flag); - if (error) - return (error); - - error = mac_init_socket_peer_label(&socket->so_peerlabel, flag); - if (error) - mac_destroy_socket_label(&socket->so_label); - - return (error); -} - void mac_init_vnode_label(struct label *label) { @@ -834,15 +659,6 @@ mac_init_vnode_label(&vp->v_label); } -void -mac_destroy_bpfdesc(struct bpf_d *bpf_d) -{ - - MAC_PERFORM(destroy_bpfdesc_label, &bpf_d->bd_label); - mac_destroy_label(&bpf_d->bd_label); - MAC_DEBUG_COUNTER_DEC(&nmacbpfdescs); -} - static void mac_destroy_cred_label(struct label *label) { @@ -868,44 +684,7 @@ MAC_DEBUG_COUNTER_DEC(&nmacdevfsdirents); } -static void -mac_destroy_ifnet_label(struct label *label) -{ - - MAC_PERFORM(destroy_ifnet_label, label); - mac_destroy_label(label); - MAC_DEBUG_COUNTER_DEC(&nmacifnets); -} - -void -mac_destroy_ifnet(struct ifnet *ifp) -{ - - mac_destroy_ifnet_label(&ifp->if_label); -} - void -mac_destroy_ipq(struct ipq *ipq) -{ - - MAC_PERFORM(destroy_ipq_label, &ipq->ipq_label); - mac_destroy_label(&ipq->ipq_label); - MAC_DEBUG_COUNTER_DEC(&nmacipqs); -} - -void -mac_destroy_mbuf_tag(struct m_tag *tag) -{ - struct label *label; - - label = (struct label *)(tag+1); - - MAC_PERFORM(destroy_mbuf_label, label); - mac_destroy_label(label); - MAC_DEBUG_COUNTER_DEC(&nmacmbufs); -} - -void mac_destroy_mount(struct mount *mp) { @@ -925,31 +704,6 @@ MAC_DEBUG_COUNTER_DEC(&nmacprocs); } -static void -mac_destroy_socket_label(struct label *label) -{ - - MAC_PERFORM(destroy_socket_label, label); - mac_destroy_label(label); - MAC_DEBUG_COUNTER_DEC(&nmacsockets); -} - -static void -mac_destroy_socket_peer_label(struct label *label) -{ - - MAC_PERFORM(destroy_socket_peer_label, label); - mac_destroy_label(label); -} - -void -mac_destroy_socket(struct socket *socket) -{ - - mac_destroy_socket_label(&socket->so_label); - mac_destroy_socket_peer_label(&socket->so_peerlabel); -} - void mac_destroy_vnode_label(struct label *label) { @@ -967,21 +721,6 @@ } void -mac_copy_mbuf_tag(struct m_tag *src, struct m_tag *dest) -{ - struct label *src_label, *dest_label; - - src_label = (struct label *)(src+1); - dest_label = (struct label *)(dest+1); - - /* - * mac_init_mbuf_tag() is called on the target tag in - * m_tag_copy(), so we don't need to call it here. - */ - MAC_PERFORM(copy_mbuf_label, src_label, dest_label); -} - -void mac_copy_vnode_label(struct label *src, struct label *dest) { @@ -1011,39 +750,6 @@ } static int -mac_externalize_ifnet_label(struct label *label, char *elements, - char *outbuf, size_t outbuflen, int flags) -{ - int error; - - MAC_EXTERNALIZE(ifnet_label, label, elements, outbuf, outbuflen); - - return (error); -} - -static int -mac_externalize_socket_label(struct label *label, char *elements, - char *outbuf, size_t outbuflen, int flags) -{ - int error; - - MAC_EXTERNALIZE(socket_label, label, elements, outbuf, outbuflen); - - return (error); -} - -static int -mac_externalize_socket_peer_label(struct label *label, char *elements, - char *outbuf, size_t outbuflen, int flags) -{ - int error; - - MAC_EXTERNALIZE(socket_peer_label, label, elements, outbuf, outbuflen); - - return (error); -} - -static int mac_externalize_vnode_label(struct label *label, char *elements, char *outbuf, size_t outbuflen, int flags) { @@ -1065,26 +771,6 @@ } static int -mac_internalize_ifnet_label(struct label *label, char *string) -{ - int error; - - MAC_INTERNALIZE(ifnet_label, label, string); - - return (error); -} - -static int -mac_internalize_socket_label(struct label *label, char *string) -{ - int error; - - MAC_INTERNALIZE(socket_label, label, string); - - return (error); -} - -static int mac_internalize_vnode_label(struct label *label, char *string) { int error; @@ -2004,241 +1690,6 @@ } void -mac_create_ifnet(struct ifnet *ifnet) -{ - - MAC_PERFORM(create_ifnet, ifnet, &ifnet->if_label); -} - -void -mac_create_bpfdesc(struct ucred *cred, struct bpf_d *bpf_d) -{ - - MAC_PERFORM(create_bpfdesc, cred, bpf_d, &bpf_d->bd_label); -} - -void -mac_create_socket(struct ucred *cred, struct socket *socket) -{ - - MAC_PERFORM(create_socket, cred, socket, &socket->so_label); -} - -void -mac_create_socket_from_socket(struct socket *oldsocket, - struct socket *newsocket) -{ - - MAC_PERFORM(create_socket_from_socket, oldsocket, &oldsocket->so_label, - newsocket, &newsocket->so_label); -} - -static void -mac_relabel_socket(struct ucred *cred, struct socket *socket, - struct label *newlabel) -{ - - MAC_PERFORM(relabel_socket, cred, socket, &socket->so_label, newlabel); -} - -void -mac_set_socket_peer_from_mbuf(struct mbuf *mbuf, struct socket *socket) -{ - struct label *label; - - label = mbuf_to_label(mbuf); - - MAC_PERFORM(set_socket_peer_from_mbuf, mbuf, label, socket, - &socket->so_peerlabel); -} - -void -mac_set_socket_peer_from_socket(struct socket *oldsocket, - struct socket *newsocket) -{ - - MAC_PERFORM(set_socket_peer_from_socket, oldsocket, - &oldsocket->so_label, newsocket, &newsocket->so_peerlabel); -} - -void -mac_create_datagram_from_ipq(struct ipq *ipq, struct mbuf *datagram) -{ - struct label *label; - - label = mbuf_to_label(datagram); - - MAC_PERFORM(create_datagram_from_ipq, ipq, &ipq->ipq_label, - datagram, label); -} - -void -mac_create_fragment(struct mbuf *datagram, struct mbuf *fragment) -{ - struct label *datagramlabel, *fragmentlabel; - - datagramlabel = mbuf_to_label(datagram); - fragmentlabel = mbuf_to_label(fragment); - - MAC_PERFORM(create_fragment, datagram, datagramlabel, fragment, - fragmentlabel); -} - -void -mac_create_ipq(struct mbuf *fragment, struct ipq *ipq) -{ - struct label *label; - - label = mbuf_to_label(fragment); - - MAC_PERFORM(create_ipq, fragment, label, ipq, &ipq->ipq_label); -} - -void -mac_create_mbuf_from_mbuf(struct mbuf *oldmbuf, struct mbuf *newmbuf) -{ - struct label *oldmbuflabel, *newmbuflabel; - - oldmbuflabel = mbuf_to_label(oldmbuf); - newmbuflabel = mbuf_to_label(newmbuf); - - MAC_PERFORM(create_mbuf_from_mbuf, oldmbuf, oldmbuflabel, newmbuf, - newmbuflabel); -} - -void -mac_create_mbuf_from_bpfdesc(struct bpf_d *bpf_d, struct mbuf *mbuf) -{ - struct label *label; - - label = mbuf_to_label(mbuf); - - MAC_PERFORM(create_mbuf_from_bpfdesc, bpf_d, &bpf_d->bd_label, mbuf, - label); -} - -void -mac_create_mbuf_linklayer(struct ifnet *ifnet, struct mbuf *mbuf) -{ - struct label *label; - - label = mbuf_to_label(mbuf); - - MAC_PERFORM(create_mbuf_linklayer, ifnet, &ifnet->if_label, mbuf, - label); -} - -void -mac_create_mbuf_from_ifnet(struct ifnet *ifnet, struct mbuf *mbuf) -{ - struct label *label; - - label = mbuf_to_label(mbuf); - - MAC_PERFORM(create_mbuf_from_ifnet, ifnet, &ifnet->if_label, mbuf, - label); -} - -void -mac_create_mbuf_multicast_encap(struct mbuf *oldmbuf, struct ifnet *ifnet, - struct mbuf *newmbuf) -{ - struct label *oldmbuflabel, *newmbuflabel; - - oldmbuflabel = mbuf_to_label(oldmbuf); - newmbuflabel = mbuf_to_label(newmbuf); - - MAC_PERFORM(create_mbuf_multicast_encap, oldmbuf, oldmbuflabel, - ifnet, &ifnet->if_label, newmbuf, newmbuflabel); -} - -void -mac_create_mbuf_netlayer(struct mbuf *oldmbuf, struct mbuf *newmbuf) -{ - struct label *oldmbuflabel, *newmbuflabel; - - oldmbuflabel = mbuf_to_label(oldmbuf); - newmbuflabel = mbuf_to_label(newmbuf); - - MAC_PERFORM(create_mbuf_netlayer, oldmbuf, oldmbuflabel, newmbuf, - newmbuflabel); -} - -int -mac_fragment_match(struct mbuf *fragment, struct ipq *ipq) -{ - struct label *label; - int result; - - label = mbuf_to_label(fragment); - - result = 1; - MAC_BOOLEAN(fragment_match, &&, fragment, label, ipq, - &ipq->ipq_label); - - return (result); -} - -void -mac_reflect_mbuf_icmp(struct mbuf *m) -{ - struct label *label; - - label = mbuf_to_label(m); - - MAC_PERFORM(reflect_mbuf_icmp, m, label); -} -void -mac_reflect_mbuf_tcp(struct mbuf *m) -{ - struct label *label; - - label = mbuf_to_label(m); - - MAC_PERFORM(reflect_mbuf_tcp, m, label); -} - -void -mac_update_ipq(struct mbuf *fragment, struct ipq *ipq) -{ - struct label *label; - - label = mbuf_to_label(fragment); - - MAC_PERFORM(update_ipq, fragment, label, ipq, &ipq->ipq_label); -} - -int -mac_update_mbuf_from_cipso(struct mbuf *m, char *cp, int *code) -{ - struct label *label, *ifnetlabel; - int error; - - label = mbuf_to_label(m); - - if (m->m_pkthdr.rcvif != NULL) - ifnetlabel = &m->m_pkthdr.rcvif->if_label; - else - ifnetlabel = NULL; - - MAC_CHECK(update_mbuf_from_cipso, m, label, m->m_pkthdr.rcvif, - ifnetlabel, cp, code); - - return (error); -} - -void -mac_create_mbuf_from_socket(struct socket *socket, struct mbuf *mbuf) -{ - struct label *label; - - label = mbuf_to_label(mbuf); - - MAC_PERFORM(create_mbuf_from_socket, socket, &socket->so_label, mbuf, - label); -} - -void mac_create_mount(struct ucred *cred, struct mount *mp) { @@ -2254,20 +1705,6 @@ &mp->mnt_fslabel); } -int -mac_check_bpfdesc_receive(struct bpf_d *bpf_d, struct ifnet *ifnet) -{ - int error; - - if (!mac_enforce_network) - return (0); - - MAC_CHECK(check_bpfdesc_receive, bpf_d, &bpf_d->bd_label, ifnet, - &ifnet->if_label); - - return (error); -} - static int mac_check_cred_relabel(struct ucred *cred, struct label *newlabel) { @@ -2292,25 +1729,6 @@ } int -mac_check_ifnet_transmit(struct ifnet *ifnet, struct mbuf *mbuf) -{ - struct label *label; - int error; - - M_ASSERTPKTHDR(mbuf); - - if (!mac_enforce_network) - return (0); - - label = mbuf_to_label(mbuf); - - MAC_CHECK(check_ifnet_transmit, ifnet, &ifnet->if_label, mbuf, - label); - - return (error); -} - -int mac_check_mount_stat(struct ucred *cred, struct mount *mount) { int error; @@ -2383,207 +1801,6 @@ return (error); } -int -mac_check_socket_bind(struct ucred *ucred, struct socket *socket, - struct sockaddr *sockaddr) -{ - int error; - - if (!mac_enforce_socket) - return (0); - - MAC_CHECK(check_socket_bind, ucred, socket, &socket->so_label, - sockaddr); - - return (error); -} - -int -mac_check_socket_connect(struct ucred *cred, struct socket *socket, - struct sockaddr *sockaddr) -{ - int error; - - if (!mac_enforce_socket) - return (0); - - MAC_CHECK(check_socket_connect, cred, socket, &socket->so_label, - sockaddr); - - return (error); -} - -int -mac_check_socket_deliver(struct socket *socket, struct mbuf *mbuf) -{ - struct label *label; - int error; - - if (!mac_enforce_socket) - return (0); - - label = mbuf_to_label(mbuf); - - MAC_CHECK(check_socket_deliver, socket, &socket->so_label, mbuf, - label); - - return (error); -} - -int -mac_check_socket_listen(struct ucred *cred, struct socket *socket) -{ - int error; - - if (!mac_enforce_socket) - return (0); - - MAC_CHECK(check_socket_listen, cred, socket, &socket->so_label); - return (error); -} - -int -mac_check_socket_receive(struct ucred *cred, struct socket *so) -{ - int error; - - if (!mac_enforce_socket) - return (0); - - MAC_CHECK(check_socket_receive, cred, so, &so->so_label); - - return (error); -} - -static int -mac_check_socket_relabel(struct ucred *cred, struct socket *socket, - struct label *newlabel) -{ - int error; - - MAC_CHECK(check_socket_relabel, cred, socket, &socket->so_label, - newlabel); - - return (error); -} - -int -mac_check_socket_send(struct ucred *cred, struct socket *so) -{ - int error; - - if (!mac_enforce_socket) - return (0); - - MAC_CHECK(check_socket_send, cred, so, &so->so_label); - - return (error); -} - -int -mac_check_socket_visible(struct ucred *cred, struct socket *socket) -{ - int error; - - if (!mac_enforce_socket) - return (0); - - MAC_CHECK(check_socket_visible, cred, socket, &socket->so_label); - - return (error); -} - -int -mac_ioctl_ifnet_get(struct ucred *cred, struct ifreq *ifr, - struct ifnet *ifnet) -{ - char *elements, *buffer; - struct mac mac; - int error; - - error = copyin(ifr->ifr_ifru.ifru_data, &mac, sizeof(mac)); - if (error) - return (error); - - error = mac_check_structmac_consistent(&mac); - if (error) - return (error); - - elements = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK); - error = copyinstr(mac.m_string, elements, mac.m_buflen, NULL); - if (error) { - free(elements, M_MACTEMP); - return (error); - } - - buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK | M_ZERO); - error = mac_externalize_ifnet_label(&ifnet->if_label, elements, - buffer, mac.m_buflen, M_WAITOK); - if (error == 0) - error = copyout(buffer, mac.m_string, strlen(buffer)+1); - - free(buffer, M_MACTEMP); - free(elements, M_MACTEMP); - - return (error); -} - -int -mac_ioctl_ifnet_set(struct ucred *cred, struct ifreq *ifr, - struct ifnet *ifnet) -{ - struct label intlabel; - struct mac mac; - char *buffer; - int error; - - error = copyin(ifr->ifr_ifru.ifru_data, &mac, sizeof(mac)); - if (error) - return (error); - - error = mac_check_structmac_consistent(&mac); - if (error) - return (error); - - buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK); - error = copyinstr(mac.m_string, buffer, mac.m_buflen, NULL); - if (error) { - free(buffer, M_MACTEMP); - return (error); - } - - mac_init_ifnet_label(&intlabel); - error = mac_internalize_ifnet_label(&intlabel, buffer); - free(buffer, M_MACTEMP); - if (error) { - mac_destroy_ifnet_label(&intlabel); - return (error); - } - - /* - * XXX: Note that this is a redundant privilege check, since - * policies impose this check themselves if required by the - * policy. Eventually, this should go away. - */ - error = suser_cred(cred, 0); - if (error) { - mac_destroy_ifnet_label(&intlabel); - return (error); - } - - MAC_CHECK(check_ifnet_relabel, cred, ifnet, &ifnet->if_label, - &intlabel); - if (error) { - mac_destroy_ifnet_label(&intlabel); - return (error); - } - - MAC_PERFORM(relabel_ifnet, cred, ifnet, &ifnet->if_label, &intlabel); - - mac_destroy_ifnet_label(&intlabel); - return (0); -} - void mac_create_devfs_device(struct mount *mp, dev_t dev, struct devfs_dirent *de, const char *fullpath) @@ -2611,105 +1828,6 @@ &de->de_label, fullpath); } -int -mac_setsockopt_label_set(struct ucred *cred, struct socket *so, - struct mac *mac) -{ - struct label intlabel; - char *buffer; - int error; - - error = mac_check_structmac_consistent(mac); - if (error) - return (error); - - buffer = malloc(mac->m_buflen, M_MACTEMP, M_WAITOK); - error = copyinstr(mac->m_string, buffer, mac->m_buflen, NULL); - if (error) { - free(buffer, M_MACTEMP); - return (error); - } - - mac_init_socket_label(&intlabel, M_WAITOK); - error = mac_internalize_socket_label(&intlabel, buffer); - free(buffer, M_MACTEMP); - if (error) { - mac_destroy_socket_label(&intlabel); - return (error); - } - - mac_check_socket_relabel(cred, so, &intlabel); - if (error) { - mac_destroy_socket_label(&intlabel); - return (error); - } - - mac_relabel_socket(cred, so, &intlabel); - - mac_destroy_socket_label(&intlabel); - return (0); -} - -int -mac_getsockopt_label_get(struct ucred *cred, struct socket *so, - struct mac *mac) -{ - char *buffer, *elements; - int error; - - error = mac_check_structmac_consistent(mac); - if (error) - return (error); - - elements = malloc(mac->m_buflen, M_MACTEMP, M_WAITOK); - error = copyinstr(mac->m_string, elements, mac->m_buflen, NULL); - if (error) { >>> TRUNCATED FOR MAIL (1000 lines) <<<
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200310210115.h9L1FVpL011880>