Date: Tue, 1 Mar 2005 14:13:56 GMT From: Robert Watson <rwatson@FreeBSD.org> To: Perforce Change Reviews <perforce@freebsd.org> Subject: PERFORCE change 72238 for review Message-ID: <200503011413.j21EDu54056555@repoman.freebsd.org>
next in thread | raw e-mail | index | archive | help
http://perforce.freebsd.org/chv.cgi?CH=72238 Change 72238 by rwatson@rwatson_paprika on 2005/03/01 14:13:19 Don't perform an access control check on POSIX semaphore close, as applications generally won't be able to handle the failure, nor does the closing of a semaphore represent a communications channel. Affected files ... .. //depot/projects/trustedbsd/mac/sys/kern/uipc_sem.c#21 edit .. //depot/projects/trustedbsd/mac/sys/security/mac/mac_posix_sem.c#11 edit .. //depot/projects/trustedbsd/mac/sys/security/mac_biba/mac_biba.c#250 edit .. //depot/projects/trustedbsd/mac/sys/security/mac_lomac/mac_lomac.c#90 edit .. //depot/projects/trustedbsd/mac/sys/security/mac_mls/mac_mls.c#203 edit .. //depot/projects/trustedbsd/mac/sys/security/mac_stub/mac_stub.c#27 edit .. //depot/projects/trustedbsd/mac/sys/security/mac_test/mac_test.c#142 edit .. //depot/projects/trustedbsd/mac/sys/sys/mac.h#267 edit .. //depot/projects/trustedbsd/mac/sys/sys/mac_policy.h#224 edit Differences ... ==== //depot/projects/trustedbsd/mac/sys/kern/uipc_sem.c#21 (text+ko) ==== @@ -688,13 +688,6 @@ /* this is not a valid operation for unnamed sems */ error = EINVAL; if (ks != NULL && ks->ks_name != NULL) { -#ifdef MAC - if ((error = mac_check_posix_sem_close(td->td_ucred, ks))) { - DP(("MAC Framework: mac_check_posix_sem_close access \ - denied\n")); - goto err_close; - } -#endif if ((error = sem_leave(td->td_proc, ks))) goto err_close; if (ks->ks_unlinked && LIST_EMPTY(&ks->ks_users)) ==== //depot/projects/trustedbsd/mac/sys/security/mac/mac_posix_sem.c#11 (text+ko) ==== @@ -102,19 +102,6 @@ } int -mac_check_posix_sem_close(struct ucred *cred, struct ksem *ksemptr) -{ - int error; - - if (!mac_enforce_posix_sem) - return (0); - - MAC_CHECK(check_posix_sem_close, cred, ksemptr, ksemptr->ks_label); - - return(error); -} - -int mac_check_posix_sem_destroy(struct ucred *cred, struct ksem *ksemptr) { int error; ==== //depot/projects/trustedbsd/mac/sys/security/mac_biba/mac_biba.c#250 (text+ko) ==== @@ -3274,7 +3274,6 @@ .mpo_check_pipe_relabel = mac_biba_check_pipe_relabel, .mpo_check_pipe_stat = mac_biba_check_pipe_stat, .mpo_check_pipe_write = mac_biba_check_pipe_write, - .mpo_check_posix_sem_close = mac_biba_check_posix_sem_write, .mpo_check_posix_sem_destroy = mac_biba_check_posix_sem_write, .mpo_check_posix_sem_getvalue = mac_biba_check_posix_sem_rdonly, .mpo_check_posix_sem_open = mac_biba_check_posix_sem_write, ==== //depot/projects/trustedbsd/mac/sys/security/mac_lomac/mac_lomac.c#90 (text+ko) ==== @@ -3204,7 +3204,6 @@ .mpo_check_pipe_read = mac_lomac_check_pipe_read, .mpo_check_pipe_relabel = mac_lomac_check_pipe_relabel, .mpo_check_pipe_write = mac_lomac_check_pipe_write, - .mpo_check_posix_sem_close = mac_lomac_check_posix_sem_write, .mpo_check_posix_sem_destroy = mac_lomac_check_posix_sem_write, .mpo_check_posix_sem_getvalue = mac_lomac_check_posix_sem_rdonly, .mpo_check_posix_sem_open = mac_lomac_check_posix_sem_write, ==== //depot/projects/trustedbsd/mac/sys/security/mac_mls/mac_mls.c#203 (text+ko) ==== @@ -3053,7 +3053,6 @@ .mpo_check_pipe_relabel = mac_mls_check_pipe_relabel, .mpo_check_pipe_stat = mac_mls_check_pipe_stat, .mpo_check_pipe_write = mac_mls_check_pipe_write, - .mpo_check_posix_sem_close = mac_mls_check_posix_sem_write, .mpo_check_posix_sem_destroy = mac_mls_check_posix_sem_write, .mpo_check_posix_sem_getvalue = mac_mls_check_posix_sem_rdonly, .mpo_check_posix_sem_open = mac_mls_check_posix_sem_write, ==== //depot/projects/trustedbsd/mac/sys/security/mac_stub/mac_stub.c#27 (text+ko) ==== @@ -840,14 +840,6 @@ } static int -stub_check_posix_sem_close(struct ucred *cred, struct ksem *ksemptr, - struct label *ks_label) -{ - - return (0); -} - -static int stub_check_posix_sem_destroy(struct ucred *cred, struct ksem *ksemptr, struct label *ks_label) { @@ -1499,7 +1491,6 @@ .mpo_check_pipe_relabel = stub_check_pipe_relabel, .mpo_check_pipe_stat = stub_check_pipe_stat, .mpo_check_pipe_write = stub_check_pipe_write, - .mpo_check_posix_sem_close = stub_check_posix_sem_close, .mpo_check_posix_sem_destroy = stub_check_posix_sem_destroy, .mpo_check_posix_sem_getvalue = stub_check_posix_sem_getvalue, .mpo_check_posix_sem_open = stub_check_posix_sem_open, ==== //depot/projects/trustedbsd/mac/sys/security/mac_test/mac_test.c#142 (text+ko) ==== @@ -2543,7 +2543,6 @@ .mpo_check_pipe_relabel = mac_test_check_pipe_relabel, .mpo_check_pipe_stat = mac_test_check_pipe_stat, .mpo_check_pipe_write = mac_test_check_pipe_write, - .mpo_check_posix_sem_close = mac_test_check_posix_sem, .mpo_check_posix_sem_destroy = mac_test_check_posix_sem, .mpo_check_posix_sem_getvalue = mac_test_check_posix_sem, .mpo_check_posix_sem_open = mac_test_check_posix_sem, ==== //depot/projects/trustedbsd/mac/sys/sys/mac.h#267 (text+ko) ==== @@ -340,7 +340,6 @@ int mac_check_pipe_read(struct ucred *cred, struct pipepair *pp); int mac_check_pipe_stat(struct ucred *cred, struct pipepair *pp); int mac_check_pipe_write(struct ucred *cred, struct pipepair *pp); -int mac_check_posix_sem_close(struct ucred *cred, struct ksem *ksemptr); int mac_check_posix_sem_destroy(struct ucred *cred, struct ksem *ksemptr); int mac_check_posix_sem_getvalue(struct ucred *cred,struct ksem *ksemptr); int mac_check_posix_sem_open(struct ucred *cred, struct ksem *ksemptr); ==== //depot/projects/trustedbsd/mac/sys/sys/mac_policy.h#224 (text+ko) ==== @@ -417,8 +417,6 @@ struct pipepair *pp, struct label *pipelabel); int (*mpo_check_pipe_write)(struct ucred *cred, struct pipepair *pp, struct label *pipelabel); - int (*mpo_check_posix_sem_close)(struct ucred *cred, - struct ksem *ksemptr, struct label *ks_label); int (*mpo_check_posix_sem_destroy)(struct ucred *cred, struct ksem *ksemptr, struct label *ks_label); int (*mpo_check_posix_sem_getvalue)(struct ucred *cred,
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200503011413.j21EDu54056555>