From owner-trustedbsd-cvs@FreeBSD.ORG Tue Aug 15 17:53:25 2006 Return-Path: X-Original-To: trustedbsd-cvs@freebsd.org Delivered-To: trustedbsd-cvs@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id E4B0E16A4F4 for ; Tue, 15 Aug 2006 17:53:25 +0000 (UTC) (envelope-from owner-perforce@freebsd.org) Received: from cyrus.watson.org (cyrus.watson.org [209.31.154.42]) by mx1.FreeBSD.org (Postfix) with ESMTP id 9E82043DAA for ; Tue, 15 Aug 2006 17:52:56 +0000 (GMT) (envelope-from owner-perforce@freebsd.org) Received: from mx2.freebsd.org (mx2.freebsd.org [216.136.204.119]) by cyrus.watson.org (Postfix) with ESMTP id E3FBF46D48 for ; Tue, 15 Aug 2006 13:52:13 -0400 (EDT) Received: from hub.freebsd.org (hub.freebsd.org [216.136.204.18]) by mx2.freebsd.org (Postfix) with ESMTP id EC37972AF6; Tue, 15 Aug 2006 17:51:59 +0000 (GMT) (envelope-from owner-perforce@freebsd.org) Received: by hub.freebsd.org (Postfix, from userid 32767) id CE79216A647; Tue, 15 Aug 2006 17:51:52 +0000 (UTC) X-Original-To: perforce@freebsd.org Delivered-To: perforce@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 82D3F16A641 for ; Tue, 15 Aug 2006 17:51:52 +0000 (UTC) (envelope-from millert@freebsd.org) Received: from repoman.freebsd.org (repoman.freebsd.org [216.136.204.115]) by mx1.FreeBSD.org (Postfix) with ESMTP id 2069043DE9 for ; Tue, 15 Aug 2006 17:51:35 +0000 (GMT) (envelope-from millert@freebsd.org) Received: from repoman.freebsd.org (localhost [127.0.0.1]) by repoman.freebsd.org (8.13.6/8.13.6) with ESMTP id k7FHpVvp036229 for ; Tue, 15 Aug 2006 17:51:31 GMT (envelope-from millert@freebsd.org) Received: (from perforce@localhost) by repoman.freebsd.org (8.13.6/8.13.4/Submit) id k7FHpVqb036226 for perforce@freebsd.org; Tue, 15 Aug 2006 17:51:31 GMT (envelope-from millert@freebsd.org) Date: Tue, 15 Aug 2006 17:51:31 GMT Message-Id: <200608151751.k7FHpVqb036226@repoman.freebsd.org> X-Authentication-Warning: repoman.freebsd.org: perforce set sender to millert@freebsd.org using -f From: Todd Miller To: Perforce Change Reviews Cc: Subject: PERFORCE change 104073 for review X-BeenThere: trustedbsd-cvs@FreeBSD.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: TrustedBSD CVS and Perforce commit message list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 15 Aug 2006 17:53:26 -0000 http://perforce.freebsd.org/chv.cgi?CH=104073 Change 104073 by millert@millert_macbook on 2006/08/15 17:51:17 Fall back on fslabel if the label in the exattr is invalid. Affected files ... .. //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/sedarwin/sebsd.c#3 edit Differences ... ==== //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/sedarwin/sebsd.c#3 (text+ko) ==== @@ -671,6 +671,7 @@ struct vnode *vp, struct label *vlabel) { struct vnode_security_struct *vsec; + struct mount_fs_security_struct *fssec; /* * TBD: static buffers aren't a good idea, and SELinux contexts * aren't restricted in length. @@ -684,32 +685,37 @@ error = mac_vnop_getxattr(vp, SEBSD_MAC_EXTATTR_NAME, context, sizeof(context), &context_len); - if (error == ENOATTR || error == ENOTSUP || error == EPERM) { - /* XXX - use fslabel sid instead */ - vsec->sid = SECINITSID_UNLABELED; /* Use the default label */ - - goto dosclass; - } if (error) { + if (error == ENOATTR || error == ENOTSUP || error == EPERM) + goto dosclass; printf("%s: ERROR %d returned by mac_vnop_getxattr()\n", __func__, error); - return (error); /* Fail closed */ + return (error); /* Fail closed */ } if (p == NULL || vp == NULL || vp->v_op == NULL || - vp->v_tag != VT_HFS || vp->v_data == NULL) + vp->v_tag != VT_HFS || vp->v_data == NULL) { + error = EINVAL; goto dosclass; + } error = security_context_to_sid(context, context_len, &vsec->sid); - if (error) { + if (error) printf("%s: ERROR mapping context to sid: %.*s\n", __func__, context_len, context); - return (0); /* TBD bad, bad, bad */ - } dosclass: vsec->sclass = vnode_type_to_security_class(vp->v_type); + /* Fall back to the filesystem label on error */ + if (error) { + if (fslabel) { + fssec = SLOT(fslabel); + vsec->sid = fssec->sid; + } else + vsec->sid = SECINITSID_UNLABELED; + } + return (0); } @@ -746,10 +752,13 @@ __func__, context_len, context); } - /* Fall back on the filesystem label on error */ + /* Fall back to the filesystem label on error */ if (error) { - fssec = SLOT(fslabel); - vsec->sid = fssec->sid; + if (fslabel) { + fssec = SLOT(fslabel); + vsec->sid = fssec->sid; + } else + vsec->sid = SECINITSID_UNLABELED; } }