Date: Thu, 15 Nov 2007 12:51:29 -0800 From: "Christopher Davis" <loafier@FreeBSD.org> To: freebsd-hackers@freebsd.org Cc: dexterclarke@safe-mail.net, Pawel Jakub Dawidek <pjd@freebsd.org>, trustedbsd-discuss@freebsd.org Subject: Re: A TrustedBSD "voluntary sandbox" policy. Message-ID: <c44ca55f0711151251k49dd8786yb534aad253e41c46@mail.gmail.com> In-Reply-To: <20071108172345.GE25224@garage.freebsd.pl> References: <N1-_PYrd0nIeB@Safe-mail.net> <20071108172345.GE25224@garage.freebsd.pl>
next in thread | previous in thread | raw e-mail | index | archive | help
On Nov 8, 2007 9:23 AM, Pawel Jakub Dawidek <pjd@freebsd.org> wrote: > First problem is that it is hard to operate on file paths. MAC passes a > locked vnode to you and you cannot go from there to a file name easly. > You could do it by comparsion: call VOP_GETATTR(9) on the given vnode, > do the same for /etc/passwd and others and compare their inodes and > file system ids. Performance hit may be significant for complex > policies. > > You can register yourself for process_exit, process_fork and > process_exec in-kernel events and do your cleanups from your event > handler. Take a look at EVENTHANDLER(9). > > -- > Pawel Jakub Dawidek http://www.wheel.pl > pjd@FreeBSD.org http://www.FreeBSD.org > FreeBSD committer Am I Evil? Yes, I Am! > Couldn't you use stat() syscall on the paths from the userland utility that parses the rules, collect the mount point or mount id and the inode from the stat struct, then have the MAC policy module match that data with the file id and mount id available from the vnode? -- Christopher Davis
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?c44ca55f0711151251k49dd8786yb534aad253e41c46>