From owner-p4-projects@FreeBSD.ORG Mon Jan 22 16:11:59 2007 Return-Path: X-Original-To: p4-projects@freebsd.org Delivered-To: p4-projects@freebsd.org Received: by hub.freebsd.org (Postfix, from userid 32767) id 3130016A40E; Mon, 22 Jan 2007 16:11:59 +0000 (UTC) X-Original-To: perforce@freebsd.org Delivered-To: perforce@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 0990216A404 for ; Mon, 22 Jan 2007 16:11:59 +0000 (UTC) (envelope-from millert@freebsd.org) Received: from repoman.freebsd.org (repoman.freebsd.org [69.147.83.41]) by mx1.freebsd.org (Postfix) with ESMTP id EC85713C45A for ; Mon, 22 Jan 2007 16:11:58 +0000 (UTC) (envelope-from millert@freebsd.org) Received: from repoman.freebsd.org (localhost [127.0.0.1]) by repoman.freebsd.org (8.13.6/8.13.6) with ESMTP id l0MGBwHb028798 for ; Mon, 22 Jan 2007 16:11:58 GMT (envelope-from millert@freebsd.org) Received: (from perforce@localhost) by repoman.freebsd.org (8.13.6/8.13.4/Submit) id l0MGBwKc028794 for perforce@freebsd.org; Mon, 22 Jan 2007 16:11:58 GMT (envelope-from millert@freebsd.org) Date: Mon, 22 Jan 2007 16:11:58 GMT Message-Id: <200701221611.l0MGBwKc028794@repoman.freebsd.org> X-Authentication-Warning: repoman.freebsd.org: perforce set sender to millert@freebsd.org using -f From: Todd Miller To: Perforce Change Reviews Cc: Subject: PERFORCE change 113353 for review X-BeenThere: p4-projects@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: p4 projects tree changes List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 22 Jan 2007 16:11:59 -0000 http://perforce.freebsd.org/chv.cgi?CH=113353 Change 113353 by millert@millert_macbook on 2007/01/22 16:11:12 Change 2nd param to mac_execve_enter() from a label pointer to an imgp. This means mac_execve_enter() must allocate ip_execlabelp itself, moving some MAC-specific code into mac_process.c where it belongs. Affected files ... .. //depot/projects/trustedbsd/sedarwin8/darwin/xnu/bsd/kern/kern_exec.c#8 edit .. //depot/projects/trustedbsd/sedarwin8/darwin/xnu/security/mac_framework.h#36 edit .. //depot/projects/trustedbsd/sedarwin8/darwin/xnu/security/mac_process.c#14 edit Differences ... ==== //depot/projects/trustedbsd/sedarwin8/darwin/xnu/bsd/kern/kern_exec.c#8 (text+ko) ==== @@ -894,12 +894,9 @@ #ifdef MAC if (uap->mac_p != USER_ADDR_NULL) { - imgp->ip_execlabelp = mac_cred_label_alloc(); - error = mac_execve_enter(uap->mac_p, imgp->ip_execlabelp); - if (error) { - mac_cred_label_free(imgp->ip_execlabelp); + error = mac_execve_enter(uap->mac_p, imgp); + if (error) return (error); - } } #endif ==== //depot/projects/trustedbsd/sedarwin8/darwin/xnu/security/mac_framework.h#36 (text+ko) ==== @@ -130,7 +130,7 @@ void mac_devfs_label_init(struct devnode *de); void mac_devfs_label_update(struct mount *mp, struct devnode *de, struct vnode *vp); -int mac_execve_enter(user_addr_t mac_p, struct label *execlabel); +int mac_execve_enter(user_addr_t mac_p, struct image_params *imgp); int mac_file_check_change_offset(struct ucred *cred, struct fileglob *fg); int mac_file_check_create(struct ucred *cred); int mac_file_check_dup(struct ucred *cred, struct fileglob *fg, int newfd); ==== //depot/projects/trustedbsd/sedarwin8/darwin/xnu/security/mac_process.c#14 (text+ko) ==== @@ -44,6 +44,7 @@ #include #include #include +#include #include @@ -186,9 +187,10 @@ } int -mac_execve_enter(user_addr_t mac_p, struct label *execlabelstorage) +mac_execve_enter(user_addr_t mac_p, struct image_params *imgp) { struct mac mac; + struct label *execlabel; char *buffer; int error; size_t ulen; @@ -204,15 +206,20 @@ if (error) return (error); + execlabel = mac_cred_label_alloc(); MALLOC(buffer, char *, mac.m_buflen, M_MACTEMP, M_WAITOK); error = copyinstr(CAST_USER_ADDR_T(mac.m_string), buffer, mac.m_buflen, &ulen); + if (error) + goto out; + AUDIT_ARG(mac_string, buffer); + + error = mac_cred_label_internalize(execlabel, buffer); +out: if (error) { - FREE(buffer, M_MACTEMP); - return (error); + mac_cred_label_free(execlabel); + execlabel = NULL; } - AUDIT_ARG(mac_string, buffer); - - error = mac_cred_label_internalize(execlabelstorage, buffer); + imgp->ip_execlabelp = execlabel; FREE(buffer, M_MACTEMP); return (error); }