From 54e2c147b1af60baca194a4c785b2a68972eb3eb Mon Sep 17 00:00:00 2001 From: Robert Watson Date: Thu, 21 Aug 2003 14:34:54 +0000 Subject: [PATCH] Implementations of mpo_check_vnode_deleteextattr() and mpo_check_vnode_listextattr() for Biba, MLS, and BSD Extended. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories --- sys/security/mac_biba/mac_biba.c | 38 ++++++++++++++++++ .../mac_bsdextended/mac_bsdextended.c | 36 ++++++++++++++++- sys/security/mac_mls/mac_mls.c | 39 +++++++++++++++++++ 3 files changed, 112 insertions(+), 1 deletion(-) diff --git a/sys/security/mac_biba/mac_biba.c b/sys/security/mac_biba/mac_biba.c index afd5c7a5f855..a784ed79b039 100644 --- a/sys/security/mac_biba/mac_biba.c +++ b/sys/security/mac_biba/mac_biba.c @@ -2070,6 +2070,24 @@ mac_biba_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp, return (0); } +static int +mac_biba_check_vnode_deleteextattr(struct ucred *cred, struct vnode *vp, + struct label *label, int attrnamespace, const char *name) +{ + struct mac_biba *subj, *obj; + + if (!mac_biba_enabled) + return (0); + + subj = SLOT(&cred->cr_label); + obj = SLOT(label); + + if (!mac_biba_dominate_single(subj, obj)) + return (EACCES); + + return (0); +} + static int mac_biba_check_vnode_exec(struct ucred *cred, struct vnode *vp, struct label *label, struct image_params *imgp, @@ -2162,6 +2180,24 @@ mac_biba_check_vnode_link(struct ucred *cred, struct vnode *dvp, return (0); } +static int +mac_biba_check_vnode_listextattr(struct ucred *cred, struct vnode *vp, + struct label *label, int attrnamespace) +{ + struct mac_biba *subj, *obj; + + if (!mac_biba_enabled) + return (0); + + subj = SLOT(&cred->cr_label); + obj = SLOT(label); + + if (!mac_biba_dominate_single(obj, subj)) + return (EACCES); + + return (0); +} + static int mac_biba_check_vnode_lookup(struct ucred *cred, struct vnode *dvp, struct label *dlabel, struct componentname *cnp) @@ -2683,10 +2719,12 @@ static struct mac_policy_ops mac_biba_ops = .mpo_check_vnode_create = mac_biba_check_vnode_create, .mpo_check_vnode_delete = mac_biba_check_vnode_delete, .mpo_check_vnode_deleteacl = mac_biba_check_vnode_deleteacl, + .mpo_check_vnode_deleteextattr = mac_biba_check_vnode_deleteextattr, .mpo_check_vnode_exec = mac_biba_check_vnode_exec, .mpo_check_vnode_getacl = mac_biba_check_vnode_getacl, .mpo_check_vnode_getextattr = mac_biba_check_vnode_getextattr, .mpo_check_vnode_link = mac_biba_check_vnode_link, + .mpo_check_vnode_listextattr = mac_biba_check_vnode_listextattr, .mpo_check_vnode_lookup = mac_biba_check_vnode_lookup, .mpo_check_vnode_mmap = mac_biba_check_vnode_mmap, .mpo_check_vnode_mprotect = mac_biba_check_vnode_mmap, diff --git a/sys/security/mac_bsdextended/mac_bsdextended.c b/sys/security/mac_bsdextended/mac_bsdextended.c index 22a1492d7fde..940109a470cd 100644 --- a/sys/security/mac_bsdextended/mac_bsdextended.c +++ b/sys/security/mac_bsdextended/mac_bsdextended.c @@ -1,6 +1,6 @@ /*- * Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson - * Copyright (c) 2001, 2002 Networks Associates Technology, Inc. + * Copyright (c) 2001, 2002, 2003 Networks Associates Technology, Inc. * All rights reserved. * * This software was developed by Robert Watson for the TrustedBSD Project. @@ -417,6 +417,22 @@ mac_bsdextended_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp, return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VADMIN)); } +static int +mac_bsdextended_check_vnode_deleteextattr(struct ucred *cred, struct vnode *vp, + struct label *label, int attrnamespace, const char *name) +{ + struct vattr vap; + int error; + + if (!mac_bsdextended_enabled) + return (0); + + error = VOP_GETATTR(vp, &vap, cred, curthread); + if (error) + return (error); + return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VWRITE)); +} + static int mac_bsdextended_check_vnode_exec(struct ucred *cred, struct vnode *vp, struct label *label, struct image_params *imgp, @@ -494,6 +510,22 @@ mac_bsdextended_check_vnode_link(struct ucred *cred, struct vnode *dvp, return (0); } +static int +mac_bsdextended_check_vnode_listextattr(struct ucred *cred, struct vnode *vp, + struct label *label, int attrnamespace) +{ + struct vattr vap; + int error; + + if (!mac_bsdextended_enabled) + return (0); + + error = VOP_GETATTR(vp, &vap, cred, curthread); + if (error) + return (error); + return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VREAD)); +} + static int mac_bsdextended_check_vnode_lookup(struct ucred *cred, struct vnode *dvp, struct label *dlabel, struct componentname *cnp) @@ -752,10 +784,12 @@ static struct mac_policy_ops mac_bsdextended_ops = .mpo_check_vnode_create = mac_bsdextended_check_create_vnode, .mpo_check_vnode_delete = mac_bsdextended_check_vnode_delete, .mpo_check_vnode_deleteacl = mac_bsdextended_check_vnode_deleteacl, + .mpo_check_vnode_deleteextattr = mac_bsdextended_check_vnode_deleteextattr, .mpo_check_vnode_exec = mac_bsdextended_check_vnode_exec, .mpo_check_vnode_getacl = mac_bsdextended_check_vnode_getacl, .mpo_check_vnode_getextattr = mac_bsdextended_check_vnode_getextattr, .mpo_check_vnode_link = mac_bsdextended_check_vnode_link, + .mpo_check_vnode_listextattr = mac_bsdextended_check_vnode_listextattr, .mpo_check_vnode_lookup = mac_bsdextended_check_vnode_lookup, .mpo_check_vnode_open = mac_bsdextended_check_vnode_open, .mpo_check_vnode_readdir = mac_bsdextended_check_vnode_readdir, diff --git a/sys/security/mac_mls/mac_mls.c b/sys/security/mac_mls/mac_mls.c index 008a0dab6cbd..eb3c320d274a 100644 --- a/sys/security/mac_mls/mac_mls.c +++ b/sys/security/mac_mls/mac_mls.c @@ -1839,6 +1839,24 @@ mac_mls_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp, return (0); } +static int +mac_mls_check_vnode_deleteextattr(struct ucred *cred, struct vnode *vp, + struct label *label, int attrnamespace, const char *name) +{ + struct mac_mls *subj, *obj; + + if (!mac_mls_enabled) + return (0); + + subj = SLOT(&cred->cr_label); + obj = SLOT(label); + + if (!mac_mls_dominate_single(obj, subj)) + return (EACCES); + + return (0); +} + static int mac_mls_check_vnode_exec(struct ucred *cred, struct vnode *vp, struct label *label, struct image_params *imgp, @@ -1930,6 +1948,25 @@ mac_mls_check_vnode_link(struct ucred *cred, struct vnode *dvp, return (0); } +static int +mac_mls_check_vnode_listextattr(struct ucred *cred, struct vnode *vp, + struct label *label, int attrnamespace) +{ + + struct mac_mls *subj, *obj; + + if (!mac_mls_enabled) + return (0); + + subj = SLOT(&cred->cr_label); + obj = SLOT(label); + + if (!mac_mls_dominate_single(subj, obj)) + return (EACCES); + + return (0); +} + static int mac_mls_check_vnode_lookup(struct ucred *cred, struct vnode *dvp, struct label *dlabel, struct componentname *cnp) @@ -2445,10 +2482,12 @@ static struct mac_policy_ops mac_mls_ops = .mpo_check_vnode_create = mac_mls_check_vnode_create, .mpo_check_vnode_delete = mac_mls_check_vnode_delete, .mpo_check_vnode_deleteacl = mac_mls_check_vnode_deleteacl, + .mpo_check_vnode_deleteextattr = mac_mls_check_vnode_deleteextattr, .mpo_check_vnode_exec = mac_mls_check_vnode_exec, .mpo_check_vnode_getacl = mac_mls_check_vnode_getacl, .mpo_check_vnode_getextattr = mac_mls_check_vnode_getextattr, .mpo_check_vnode_link = mac_mls_check_vnode_link, + .mpo_check_vnode_listextattr = mac_mls_check_vnode_listextattr, .mpo_check_vnode_lookup = mac_mls_check_vnode_lookup, .mpo_check_vnode_mmap = mac_mls_check_vnode_mmap, .mpo_check_vnode_mprotect = mac_mls_check_vnode_mmap,