d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Implement mpo_check_kld_load() and mpo_check_kld_unload() for the Biba

Browse Source 
MAC policy.  To load a KLD, require that the subject hold Biba privilege,
and the the kernel module be marked as high integrity.  To unload a
KLD, require that the subject hold Biba privilege.

Obtained from:	TrustedBSD Project
Sponsored by:	DARPA, Network Associates Laboratories
This commit is contained in:
rwatson 2003-02-04 22:38:33 +00:00
parent 20dc835a01
commit 5cdf9cb3f3
1 changed files with 39 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

39
sys/security/mac_biba/mac_biba.c
View File

@ -1542,6 +1542,43 @@ mac_biba_check_ifnet_transmit(struct ifnet *ifnet, struct label *ifnetlabel,
return (mac_biba_single_in_range(p, i) ? 0 : EACCES);
}
static int
mac_biba_check_kld_load(struct ucred *cred, struct vnode *vp,
struct label *label)
{
struct mac_biba *subj, *obj;
int error;
if (!mac_biba_enabled)
return (0);
subj = SLOT(&cred->cr_label);
error = mac_biba_subject_privileged(subj);
if (error)
return (error);
obj = SLOT(label);
if (!mac_biba_high_single(obj))
return (EACCES);
return (0);
}
static int
mac_biba_check_kld_unload(struct ucred *cred)
{
struct mac_biba *subj;
if (!mac_biba_enabled)
return (0);
subj = SLOT(&cred->cr_label);
return (mac_biba_subject_privileged(subj));
}
static int
mac_biba_check_mount_stat(struct ucred *cred, struct mount *mp,
struct label *mntlabel)
@ -2622,6 +2659,8 @@ static struct mac_policy_ops mac_biba_ops =
.mpo_check_cred_visible = mac_biba_check_cred_visible,
.mpo_check_ifnet_relabel = mac_biba_check_ifnet_relabel,
.mpo_check_ifnet_transmit = mac_biba_check_ifnet_transmit,
.mpo_check_kld_load = mac_biba_check_kld_load,
.mpo_check_kld_unload = mac_biba_check_kld_unload,
.mpo_check_mount_stat = mac_biba_check_mount_stat,
.mpo_check_pipe_ioctl = mac_biba_check_pipe_ioctl,
.mpo_check_pipe_poll = mac_biba_check_pipe_poll,