Add a new MAC entry point, mac_thread_userret(td), which permits policy
modules to perform MAC-related events when a thread returns to user space. This is required for policies that have floating process labels, as it's not always possible to acquire the process lock at arbitrary points in the stack during system call processing; process labels might represent traditional authentication data, process history information, or other data. LOMAC will use this entry point to perform the process label update prior to the thread returning to userspace, when plugged into the MAC framework. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
This commit is contained in:
parent
b6fcb4fec3
commit
92dbb82a47
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=104338
@ -652,6 +652,10 @@ mac_policy_register(struct mac_policy_conf *mpc)
|
||||
mpc->mpc_ops->mpo_relabel_cred =
|
||||
mpe->mpe_function;
|
||||
break;
|
||||
case MAC_THREAD_USERRET:
|
||||
mpc->mpc_ops->mpo_thread_userret =
|
||||
mpe->mpe_function;
|
||||
break;
|
||||
case MAC_CHECK_BPFDESC_RECEIVE:
|
||||
mpc->mpc_ops->mpo_check_bpfdesc_receive =
|
||||
mpe->mpe_function;
|
||||
@ -1581,6 +1585,13 @@ mac_create_proc1(struct ucred *cred)
|
||||
MAC_PERFORM(create_proc1, cred);
|
||||
}
|
||||
|
||||
void
|
||||
mac_thread_userret(struct thread *td)
|
||||
{
|
||||
|
||||
MAC_PERFORM(thread_userret, td);
|
||||
}
|
||||
|
||||
/*
|
||||
* When a new process is created, its label must be initialized. Generally,
|
||||
* this involves inheritence from the parent process, modulo possible
|
||||
|
@ -38,6 +38,7 @@
|
||||
* $FreeBSD$
|
||||
*/
|
||||
|
||||
#include "opt_mac.h"
|
||||
#ifdef __i386__
|
||||
#include "opt_npx.h"
|
||||
#endif
|
||||
@ -46,6 +47,7 @@
|
||||
#include <sys/bus.h>
|
||||
#include <sys/kernel.h>
|
||||
#include <sys/lock.h>
|
||||
#include <sys/mac.h>
|
||||
#include <sys/mutex.h>
|
||||
#include <sys/proc.h>
|
||||
#include <sys/kse.h>
|
||||
@ -88,6 +90,10 @@ userret(td, frame, oticks)
|
||||
mtx_unlock(&Giant);
|
||||
#endif
|
||||
|
||||
#ifdef MAC
|
||||
mac_thread_userret(td);
|
||||
#endif
|
||||
|
||||
/*
|
||||
* XXX we cheat slightly on the locking here to avoid locking in
|
||||
* the usual case. Setting td_priority here is essentially an
|
||||
|
@ -652,6 +652,10 @@ mac_policy_register(struct mac_policy_conf *mpc)
|
||||
mpc->mpc_ops->mpo_relabel_cred =
|
||||
mpe->mpe_function;
|
||||
break;
|
||||
case MAC_THREAD_USERRET:
|
||||
mpc->mpc_ops->mpo_thread_userret =
|
||||
mpe->mpe_function;
|
||||
break;
|
||||
case MAC_CHECK_BPFDESC_RECEIVE:
|
||||
mpc->mpc_ops->mpo_check_bpfdesc_receive =
|
||||
mpe->mpe_function;
|
||||
@ -1581,6 +1585,13 @@ mac_create_proc1(struct ucred *cred)
|
||||
MAC_PERFORM(create_proc1, cred);
|
||||
}
|
||||
|
||||
void
|
||||
mac_thread_userret(struct thread *td)
|
||||
{
|
||||
|
||||
MAC_PERFORM(thread_userret, td);
|
||||
}
|
||||
|
||||
/*
|
||||
* When a new process is created, its label must be initialized. Generally,
|
||||
* this involves inheritence from the parent process, modulo possible
|
||||
|
@ -200,6 +200,7 @@ struct proc;
|
||||
struct sockaddr;
|
||||
struct socket;
|
||||
struct pipe;
|
||||
struct thread;
|
||||
struct timespec;
|
||||
struct ucred;
|
||||
struct uio;
|
||||
@ -293,6 +294,7 @@ void mac_execve_transition(struct ucred *old, struct ucred *new,
|
||||
int mac_execve_will_transition(struct ucred *old, struct vnode *vp);
|
||||
void mac_create_proc0(struct ucred *cred);
|
||||
void mac_create_proc1(struct ucred *cred);
|
||||
void mac_thread_userret(struct thread *td);
|
||||
|
||||
/* Access control checks. */
|
||||
int mac_check_bpfdesc_receive(struct bpf_d *bpf_d, struct ifnet *ifnet);
|
||||
|
@ -652,6 +652,10 @@ mac_policy_register(struct mac_policy_conf *mpc)
|
||||
mpc->mpc_ops->mpo_relabel_cred =
|
||||
mpe->mpe_function;
|
||||
break;
|
||||
case MAC_THREAD_USERRET:
|
||||
mpc->mpc_ops->mpo_thread_userret =
|
||||
mpe->mpe_function;
|
||||
break;
|
||||
case MAC_CHECK_BPFDESC_RECEIVE:
|
||||
mpc->mpc_ops->mpo_check_bpfdesc_receive =
|
||||
mpe->mpe_function;
|
||||
@ -1581,6 +1585,13 @@ mac_create_proc1(struct ucred *cred)
|
||||
MAC_PERFORM(create_proc1, cred);
|
||||
}
|
||||
|
||||
void
|
||||
mac_thread_userret(struct thread *td)
|
||||
{
|
||||
|
||||
MAC_PERFORM(thread_userret, td);
|
||||
}
|
||||
|
||||
/*
|
||||
* When a new process is created, its label must be initialized. Generally,
|
||||
* this involves inheritence from the parent process, modulo possible
|
||||
|
@ -652,6 +652,10 @@ mac_policy_register(struct mac_policy_conf *mpc)
|
||||
mpc->mpc_ops->mpo_relabel_cred =
|
||||
mpe->mpe_function;
|
||||
break;
|
||||
case MAC_THREAD_USERRET:
|
||||
mpc->mpc_ops->mpo_thread_userret =
|
||||
mpe->mpe_function;
|
||||
break;
|
||||
case MAC_CHECK_BPFDESC_RECEIVE:
|
||||
mpc->mpc_ops->mpo_check_bpfdesc_receive =
|
||||
mpe->mpe_function;
|
||||
@ -1581,6 +1585,13 @@ mac_create_proc1(struct ucred *cred)
|
||||
MAC_PERFORM(create_proc1, cred);
|
||||
}
|
||||
|
||||
void
|
||||
mac_thread_userret(struct thread *td)
|
||||
{
|
||||
|
||||
MAC_PERFORM(thread_userret, td);
|
||||
}
|
||||
|
||||
/*
|
||||
* When a new process is created, its label must be initialized. Generally,
|
||||
* this involves inheritence from the parent process, modulo possible
|
||||
|
@ -652,6 +652,10 @@ mac_policy_register(struct mac_policy_conf *mpc)
|
||||
mpc->mpc_ops->mpo_relabel_cred =
|
||||
mpe->mpe_function;
|
||||
break;
|
||||
case MAC_THREAD_USERRET:
|
||||
mpc->mpc_ops->mpo_thread_userret =
|
||||
mpe->mpe_function;
|
||||
break;
|
||||
case MAC_CHECK_BPFDESC_RECEIVE:
|
||||
mpc->mpc_ops->mpo_check_bpfdesc_receive =
|
||||
mpe->mpe_function;
|
||||
@ -1581,6 +1585,13 @@ mac_create_proc1(struct ucred *cred)
|
||||
MAC_PERFORM(create_proc1, cred);
|
||||
}
|
||||
|
||||
void
|
||||
mac_thread_userret(struct thread *td)
|
||||
{
|
||||
|
||||
MAC_PERFORM(thread_userret, td);
|
||||
}
|
||||
|
||||
/*
|
||||
* When a new process is created, its label must be initialized. Generally,
|
||||
* this involves inheritence from the parent process, modulo possible
|
||||
|
@ -220,6 +220,7 @@ struct mac_policy_ops {
|
||||
void (*mpo_create_proc1)(struct ucred *cred);
|
||||
void (*mpo_relabel_cred)(struct ucred *cred,
|
||||
struct label *newlabel);
|
||||
void (*mpo_thread_userret)(struct thread *thread);
|
||||
|
||||
/*
|
||||
* Access control checks.
|
||||
@ -419,6 +420,7 @@ enum mac_op_constant {
|
||||
MAC_CREATE_PROC0,
|
||||
MAC_CREATE_PROC1,
|
||||
MAC_RELABEL_CRED,
|
||||
MAC_THREAD_USERRET,
|
||||
MAC_CHECK_BPFDESC_RECEIVE,
|
||||
MAC_CHECK_CRED_RELABEL,
|
||||
MAC_CHECK_CRED_VISIBLE,
|
||||
|
@ -652,6 +652,10 @@ mac_policy_register(struct mac_policy_conf *mpc)
|
||||
mpc->mpc_ops->mpo_relabel_cred =
|
||||
mpe->mpe_function;
|
||||
break;
|
||||
case MAC_THREAD_USERRET:
|
||||
mpc->mpc_ops->mpo_thread_userret =
|
||||
mpe->mpe_function;
|
||||
break;
|
||||
case MAC_CHECK_BPFDESC_RECEIVE:
|
||||
mpc->mpc_ops->mpo_check_bpfdesc_receive =
|
||||
mpe->mpe_function;
|
||||
@ -1581,6 +1585,13 @@ mac_create_proc1(struct ucred *cred)
|
||||
MAC_PERFORM(create_proc1, cred);
|
||||
}
|
||||
|
||||
void
|
||||
mac_thread_userret(struct thread *td)
|
||||
{
|
||||
|
||||
MAC_PERFORM(thread_userret, td);
|
||||
}
|
||||
|
||||
/*
|
||||
* When a new process is created, its label must be initialized. Generally,
|
||||
* this involves inheritence from the parent process, modulo possible
|
||||
|
@ -652,6 +652,10 @@ mac_policy_register(struct mac_policy_conf *mpc)
|
||||
mpc->mpc_ops->mpo_relabel_cred =
|
||||
mpe->mpe_function;
|
||||
break;
|
||||
case MAC_THREAD_USERRET:
|
||||
mpc->mpc_ops->mpo_thread_userret =
|
||||
mpe->mpe_function;
|
||||
break;
|
||||
case MAC_CHECK_BPFDESC_RECEIVE:
|
||||
mpc->mpc_ops->mpo_check_bpfdesc_receive =
|
||||
mpe->mpe_function;
|
||||
@ -1581,6 +1585,13 @@ mac_create_proc1(struct ucred *cred)
|
||||
MAC_PERFORM(create_proc1, cred);
|
||||
}
|
||||
|
||||
void
|
||||
mac_thread_userret(struct thread *td)
|
||||
{
|
||||
|
||||
MAC_PERFORM(thread_userret, td);
|
||||
}
|
||||
|
||||
/*
|
||||
* When a new process is created, its label must be initialized. Generally,
|
||||
* this involves inheritence from the parent process, modulo possible
|
||||
|
@ -652,6 +652,10 @@ mac_policy_register(struct mac_policy_conf *mpc)
|
||||
mpc->mpc_ops->mpo_relabel_cred =
|
||||
mpe->mpe_function;
|
||||
break;
|
||||
case MAC_THREAD_USERRET:
|
||||
mpc->mpc_ops->mpo_thread_userret =
|
||||
mpe->mpe_function;
|
||||
break;
|
||||
case MAC_CHECK_BPFDESC_RECEIVE:
|
||||
mpc->mpc_ops->mpo_check_bpfdesc_receive =
|
||||
mpe->mpe_function;
|
||||
@ -1581,6 +1585,13 @@ mac_create_proc1(struct ucred *cred)
|
||||
MAC_PERFORM(create_proc1, cred);
|
||||
}
|
||||
|
||||
void
|
||||
mac_thread_userret(struct thread *td)
|
||||
{
|
||||
|
||||
MAC_PERFORM(thread_userret, td);
|
||||
}
|
||||
|
||||
/*
|
||||
* When a new process is created, its label must be initialized. Generally,
|
||||
* this involves inheritence from the parent process, modulo possible
|
||||
|
@ -652,6 +652,10 @@ mac_policy_register(struct mac_policy_conf *mpc)
|
||||
mpc->mpc_ops->mpo_relabel_cred =
|
||||
mpe->mpe_function;
|
||||
break;
|
||||
case MAC_THREAD_USERRET:
|
||||
mpc->mpc_ops->mpo_thread_userret =
|
||||
mpe->mpe_function;
|
||||
break;
|
||||
case MAC_CHECK_BPFDESC_RECEIVE:
|
||||
mpc->mpc_ops->mpo_check_bpfdesc_receive =
|
||||
mpe->mpe_function;
|
||||
@ -1581,6 +1585,13 @@ mac_create_proc1(struct ucred *cred)
|
||||
MAC_PERFORM(create_proc1, cred);
|
||||
}
|
||||
|
||||
void
|
||||
mac_thread_userret(struct thread *td)
|
||||
{
|
||||
|
||||
MAC_PERFORM(thread_userret, td);
|
||||
}
|
||||
|
||||
/*
|
||||
* When a new process is created, its label must be initialized. Generally,
|
||||
* this involves inheritence from the parent process, modulo possible
|
||||
|
@ -200,6 +200,7 @@ struct proc;
|
||||
struct sockaddr;
|
||||
struct socket;
|
||||
struct pipe;
|
||||
struct thread;
|
||||
struct timespec;
|
||||
struct ucred;
|
||||
struct uio;
|
||||
@ -293,6 +294,7 @@ void mac_execve_transition(struct ucred *old, struct ucred *new,
|
||||
int mac_execve_will_transition(struct ucred *old, struct vnode *vp);
|
||||
void mac_create_proc0(struct ucred *cred);
|
||||
void mac_create_proc1(struct ucred *cred);
|
||||
void mac_thread_userret(struct thread *td);
|
||||
|
||||
/* Access control checks. */
|
||||
int mac_check_bpfdesc_receive(struct bpf_d *bpf_d, struct ifnet *ifnet);
|
||||
|
@ -220,6 +220,7 @@ struct mac_policy_ops {
|
||||
void (*mpo_create_proc1)(struct ucred *cred);
|
||||
void (*mpo_relabel_cred)(struct ucred *cred,
|
||||
struct label *newlabel);
|
||||
void (*mpo_thread_userret)(struct thread *thread);
|
||||
|
||||
/*
|
||||
* Access control checks.
|
||||
@ -419,6 +420,7 @@ enum mac_op_constant {
|
||||
MAC_CREATE_PROC0,
|
||||
MAC_CREATE_PROC1,
|
||||
MAC_RELABEL_CRED,
|
||||
MAC_THREAD_USERRET,
|
||||
MAC_CHECK_BPFDESC_RECEIVE,
|
||||
MAC_CHECK_CRED_RELABEL,
|
||||
MAC_CHECK_CRED_VISIBLE,
|
||||
|
Loading…
Reference in New Issue
Block a user