From owner-p4-projects@FreeBSD.ORG Tue Jul 24 09:05:01 2007 Return-Path: Delivered-To: p4-projects@freebsd.org Received: by hub.freebsd.org (Postfix, from userid 32767) id E2A4316A41F; Tue, 24 Jul 2007 09:05:00 +0000 (UTC) Delivered-To: perforce@FreeBSD.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id B721F16A418 for ; Tue, 24 Jul 2007 09:05:00 +0000 (UTC) (envelope-from zhouzhouyi@FreeBSD.org) Received: from repoman.freebsd.org (repoman.freebsd.org [IPv6:2001:4f8:fff6::29]) by mx1.freebsd.org (Postfix) with ESMTP id 94EF313C45E for ; Tue, 24 Jul 2007 09:05:00 +0000 (UTC) (envelope-from zhouzhouyi@FreeBSD.org) Received: from repoman.freebsd.org (localhost [127.0.0.1]) by repoman.freebsd.org (8.14.1/8.14.1) with ESMTP id l6O950k0013292 for ; Tue, 24 Jul 2007 09:05:00 GMT (envelope-from zhouzhouyi@FreeBSD.org) Received: (from perforce@localhost) by repoman.freebsd.org (8.14.1/8.14.1/Submit) id l6O950rM013279 for perforce@freebsd.org; Tue, 24 Jul 2007 09:05:00 GMT (envelope-from zhouzhouyi@FreeBSD.org) Date: Tue, 24 Jul 2007 09:05:00 GMT Message-Id: <200707240905.l6O950rM013279@repoman.freebsd.org> X-Authentication-Warning: repoman.freebsd.org: perforce set sender to zhouzhouyi@FreeBSD.org using -f From: Zhouyi ZHOU To: Perforce Change Reviews Cc: Subject: PERFORCE change 124002 for review X-BeenThere: p4-projects@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: p4 projects tree changes List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 24 Jul 2007 09:05:01 -0000 http://perforce.freebsd.org/chv.cgi?CH=124002 Change 124002 by zhouzhouyi@zhouzhouyi_mactest on 2007/07/24 09:04:59 Information leak by means of mount Affected files ... .. //depot/projects/soc2007/zhouzhouyi_mactest_soc/regression/mactest/tests/link/01.t#3 edit Differences ... ==== //depot/projects/soc2007/zhouzhouyi_mactest_soc/regression/mactest/tests/link/01.t#3 (text+ko) ==== @@ -16,10 +16,10 @@ sysctl ${i}=0 done - echo "1..5" + echo "1..10" n0=`namegenshort` n1=`namegen` - n2=`namegen` + n2=`namegenshort` mac_mls_support=`sysctl -n security.mac.mls.enabled 2>/dev/null` mac_biba_support=`sysctl -n security.mac.biba.enabled 2>/dev/null` @@ -40,22 +40,52 @@ #case 1: mkdir mactestexpect "" 0 -m "mls/low(low-high)" -f ${mactest_conf} mkdir ${n0} 0755 -#case 2: mdconfig - mactestexpect "" "[0-9]*" -m "mls/7(low-high)" -f ${mactest_conf} system mdconfig -a -n -t malloc -s 1m +#case 2: mdconfig, couldn't open /dev/mdctl, BLP prevents write down + echo -n "pid = -2 mac_test_check_vnode_open#VREAD VWRITE:" > ${mactest_conf} + echo "biba/high(low-high),mls/7(low-high) biba/high,mls/low" >> ${mactest_conf} + mactestexpect "*Permission.denied" "" -m "mls/7(low-high)" -f ${mactest_conf} system mdconfig -a -n -t malloc -s 1m + +#case 3: mdconfig, successfully open /dev/mdctl + echo -n "pid = -2 mac_test_check_vnode_open#VREAD VWRITE:" > ${mactest_conf} + echo "biba/high(low-high),mls/low(low-high) biba/high,mls/low" >> ${mactest_conf} + mactestexpect "" "*" -m "mls/low(low-high)" -f ${mactest_conf} system mdconfig -a -n -t malloc -s 1m mdnum=${ret} -#case 3: newfs - mactestexpect "" "*" -m "mls/7(low-high)" -f ${mactest_conf} system newfs -i 1 /dev/md${mdnum} + +#case 4: newfs, fail for writing, BLP prevents write down + echo -n "pid = -2 mac_test_check_vnode_open#VREAD VWRITE:" > ${mactest_conf} + echo "biba/high(low-high),mls/7(low-high) biba/high,mls/low" >> ${mactest_conf} + mactestexpect "*failed.to.open.disk.for.writing" "*" -m "mls/7(low-high)" -f ${mactest_conf} system newfs -i 1 /dev/md${mdnum} + +#case 5: newfs, success + echo -n "pid = -2 mac_test_check_vnode_open#VREAD VWRITE:" > ${mactest_conf} + echo "biba/high(low-high),mls/low(low-high) biba/high,mls/low" >> ${mactest_conf} + mactestexpect "" "*" -m "mls/low(low-high)" -f ${mactest_conf} system newfs -i 1 /dev/md${mdnum} -#case 4: mount -# echo ${mdnum} +#case 6: mount + rm ${mactest_conf} + touch ${mactest_conf} mactestexpect "" "" -m "mls/7(low-high)" -f ${mactest_conf} system mount /dev/md${mdnum} ${n0} - umount ${n0} + +#case 7: touch + mactestexpect "" "" -m "mls/7(low-high)" -f ${mactest_conf} system touch ${n0}/${n1} + +#case 8: umount + mactestexpect "" "" -m "mls/7(low-high)" -f ${mactest_conf} system umount ${n0} + +#case 9: remount with low label + mkdir ${n2} + mactestexpect "" "" -m "mls/low(low-high)" -f ${mactest_conf} system mount /dev/md${mdnum} ${n2} +# umount ${n0} +#case 10: lookup the previous touched file + mactestexpect "" ${n1} -m "mls/low(low-high)" -f ${mactest_conf} system ls ${n2} + umount ${n2} #cleanup: t=`sysctl security.mac.mls.enabled=0` echo "disabling mac/mls!" rm -fr ${n0} + rm -fr ${n2} rm ${mactest_conf} fi