d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add an explicit execlabel argument to exec-related MAC policy entry

Browse Source 
points, rather than relying on policies to grub around in the
image activator instance structure.

Approved by:	re
Obtained from:	TrustedBSD Project
Sponsored by:	DARPA, Network Associates Laboratories
This commit is contained in:
Robert Watson 2002-11-08 18:04:00 +00:00
parent 4afbdabf50
commit 9fa3506ecd
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=106647
11 changed files with 44 additions and 33 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
sys/kern/kern_mac.c
View File

@ -1307,7 +1307,7 @@ mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp,
return;
MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label,
interpvnodelabel, imgp);
interpvnodelabel, imgp, imgp->execlabel);
}
int
@ -1323,7 +1323,7 @@ mac_execve_will_transition(struct ucred *old, struct vnode *vp,
result = 0;
MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label,
interpvnodelabel, imgp);
interpvnodelabel, imgp, imgp->execlabel);
return (result);
}
@ -1428,7 +1428,8 @@ mac_check_vnode_exec(struct ucred *cred, struct vnode *vp,
if (!mac_enforce_process && !mac_enforce_fs)
return (0);
MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label, imgp);
MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label, imgp,
imgp->execlabel);
return (error);
}

7
sys/security/mac/mac_framework.c
View File

@ -1307,7 +1307,7 @@ mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp,
return;
MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label,
interpvnodelabel, imgp);
interpvnodelabel, imgp, imgp->execlabel);
}
int
@ -1323,7 +1323,7 @@ mac_execve_will_transition(struct ucred *old, struct vnode *vp,
result = 0;
MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label,
interpvnodelabel, imgp);
interpvnodelabel, imgp, imgp->execlabel);
return (result);
}
@ -1428,7 +1428,8 @@ mac_check_vnode_exec(struct ucred *cred, struct vnode *vp,
if (!mac_enforce_process && !mac_enforce_fs)
return (0);
MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label, imgp);
MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label, imgp,
imgp->execlabel);
return (error);
}

7
sys/security/mac/mac_internal.h
View File

@ -1307,7 +1307,7 @@ mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp,
return;
MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label,
interpvnodelabel, imgp);
interpvnodelabel, imgp, imgp->execlabel);
}
int
@ -1323,7 +1323,7 @@ mac_execve_will_transition(struct ucred *old, struct vnode *vp,
result = 0;
MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label,
interpvnodelabel, imgp);
interpvnodelabel, imgp, imgp->execlabel);
return (result);
}
@ -1428,7 +1428,8 @@ mac_check_vnode_exec(struct ucred *cred, struct vnode *vp,
if (!mac_enforce_process && !mac_enforce_fs)
return (0);
MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label, imgp);
MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label, imgp,
imgp->execlabel);
return (error);
}

7
sys/security/mac/mac_net.c
View File

@ -1307,7 +1307,7 @@ mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp,
return;
MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label,
interpvnodelabel, imgp);
interpvnodelabel, imgp, imgp->execlabel);
}
int
@ -1323,7 +1323,7 @@ mac_execve_will_transition(struct ucred *old, struct vnode *vp,
result = 0;
MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label,
interpvnodelabel, imgp);
interpvnodelabel, imgp, imgp->execlabel);
return (result);
}
@ -1428,7 +1428,8 @@ mac_check_vnode_exec(struct ucred *cred, struct vnode *vp,
if (!mac_enforce_process && !mac_enforce_fs)
return (0);
MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label, imgp);
MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label, imgp,
imgp->execlabel);
return (error);
}

7
sys/security/mac/mac_pipe.c
View File

@ -1307,7 +1307,7 @@ mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp,
return;
MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label,
interpvnodelabel, imgp);
interpvnodelabel, imgp, imgp->execlabel);
}
int
@ -1323,7 +1323,7 @@ mac_execve_will_transition(struct ucred *old, struct vnode *vp,
result = 0;
MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label,
interpvnodelabel, imgp);
interpvnodelabel, imgp, imgp->execlabel);
return (result);
}
@ -1428,7 +1428,8 @@ mac_check_vnode_exec(struct ucred *cred, struct vnode *vp,
if (!mac_enforce_process && !mac_enforce_fs)
return (0);
MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label, imgp);
MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label, imgp,
imgp->execlabel);
return (error);
}

7
sys/security/mac/mac_policy.h
View File

@ -244,11 +244,11 @@ struct mac_policy_ops {
void (*mpo_execve_transition)(struct ucred *old, struct ucred *new,
struct vnode *vp, struct label *vnodelabel,
struct label *interpvnodelabel,
struct image_params *imgp);
struct image_params *imgp, struct label *execlabel);
int (*mpo_execve_will_transition)(struct ucred *old,
struct vnode *vp, struct label *vnodelabel,
struct label *interpvnodelabel,
struct image_params *imgp);
struct image_params *imgp, struct label *execlabel);
void (*mpo_create_proc0)(struct ucred *cred);
void (*mpo_create_proc1)(struct ucred *cred);
void (*mpo_relabel_cred)(struct ucred *cred,
@ -342,7 +342,8 @@ struct mac_policy_ops {
int (*mpo_check_vnode_deleteacl)(struct ucred *cred,
struct vnode *vp, struct label *label, acl_type_t type);
int (*mpo_check_vnode_exec)(struct ucred *cred, struct vnode *vp,
struct label *label, struct image_params *imgp);
struct label *label, struct image_params *imgp,
struct label *execlabel);
int (*mpo_check_vnode_getacl)(struct ucred *cred,
struct vnode *vp, struct label *label, acl_type_t type);
int (*mpo_check_vnode_getextattr)(struct ucred *cred,

7
sys/security/mac/mac_process.c
View File

@ -1307,7 +1307,7 @@ mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp,
return;
MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label,
interpvnodelabel, imgp);
interpvnodelabel, imgp, imgp->execlabel);
}
int
@ -1323,7 +1323,7 @@ mac_execve_will_transition(struct ucred *old, struct vnode *vp,
result = 0;
MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label,
interpvnodelabel, imgp);
interpvnodelabel, imgp, imgp->execlabel);
return (result);
}
@ -1428,7 +1428,8 @@ mac_check_vnode_exec(struct ucred *cred, struct vnode *vp,
if (!mac_enforce_process && !mac_enforce_fs)
return (0);
MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label, imgp);
MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label, imgp,
imgp->execlabel);
return (error);
}

7
sys/security/mac/mac_syscalls.c
View File

@ -1307,7 +1307,7 @@ mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp,
return;
MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label,
interpvnodelabel, imgp);
interpvnodelabel, imgp, imgp->execlabel);
}
int
@ -1323,7 +1323,7 @@ mac_execve_will_transition(struct ucred *old, struct vnode *vp,
result = 0;
MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label,
interpvnodelabel, imgp);
interpvnodelabel, imgp, imgp->execlabel);
return (result);
}
@ -1428,7 +1428,8 @@ mac_check_vnode_exec(struct ucred *cred, struct vnode *vp,
if (!mac_enforce_process && !mac_enforce_fs)
return (0);
MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label, imgp);
MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label, imgp,
imgp->execlabel);
return (error);
}

7
sys/security/mac/mac_system.c
View File

@ -1307,7 +1307,7 @@ mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp,
return;
MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label,
interpvnodelabel, imgp);
interpvnodelabel, imgp, imgp->execlabel);
}
int
@ -1323,7 +1323,7 @@ mac_execve_will_transition(struct ucred *old, struct vnode *vp,
result = 0;
MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label,
interpvnodelabel, imgp);
interpvnodelabel, imgp, imgp->execlabel);
return (result);
}
@ -1428,7 +1428,8 @@ mac_check_vnode_exec(struct ucred *cred, struct vnode *vp,
if (!mac_enforce_process && !mac_enforce_fs)
return (0);
MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label, imgp);
MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label, imgp,
imgp->execlabel);
return (error);
}

7
sys/security/mac/mac_vfs.c
View File

@ -1307,7 +1307,7 @@ mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp,
return;
MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label,
interpvnodelabel, imgp);
interpvnodelabel, imgp, imgp->execlabel);
}
int
@ -1323,7 +1323,7 @@ mac_execve_will_transition(struct ucred *old, struct vnode *vp,
result = 0;
MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label,
interpvnodelabel, imgp);
interpvnodelabel, imgp, imgp->execlabel);
return (result);
}
@ -1428,7 +1428,8 @@ mac_check_vnode_exec(struct ucred *cred, struct vnode *vp,
if (!mac_enforce_process && !mac_enforce_fs)
return (0);
MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label, imgp);
MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label, imgp,
imgp->execlabel);
return (error);
}

7
sys/sys/mac_policy.h
View File

@ -244,11 +244,11 @@ struct mac_policy_ops {
void (*mpo_execve_transition)(struct ucred *old, struct ucred *new,
struct vnode *vp, struct label *vnodelabel,
struct label *interpvnodelabel,
struct image_params *imgp);
struct image_params *imgp, struct label *execlabel);
int (*mpo_execve_will_transition)(struct ucred *old,
struct vnode *vp, struct label *vnodelabel,
struct label *interpvnodelabel,
struct image_params *imgp);
struct image_params *imgp, struct label *execlabel);
void (*mpo_create_proc0)(struct ucred *cred);
void (*mpo_create_proc1)(struct ucred *cred);
void (*mpo_relabel_cred)(struct ucred *cred,
@ -342,7 +342,8 @@ struct mac_policy_ops {
int (*mpo_check_vnode_deleteacl)(struct ucred *cred,
struct vnode *vp, struct label *label, acl_type_t type);
int (*mpo_check_vnode_exec)(struct ucred *cred, struct vnode *vp,
struct label *label, struct image_params *imgp);
struct label *label, struct image_params *imgp,
struct label *execlabel);
int (*mpo_check_vnode_getacl)(struct ucred *cred,
struct vnode *vp, struct label *label, acl_type_t type);
int (*mpo_check_vnode_getextattr)(struct ucred *cred,