Add an explicit execlabel argument to exec-related MAC policy entry
points, rather than relying on policies to grub around in the image activator instance structure. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
This commit is contained in:
parent
4afbdabf50
commit
9fa3506ecd
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=106647
@ -1307,7 +1307,7 @@ mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp,
|
||||
return;
|
||||
|
||||
MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label,
|
||||
interpvnodelabel, imgp);
|
||||
interpvnodelabel, imgp, imgp->execlabel);
|
||||
}
|
||||
|
||||
int
|
||||
@ -1323,7 +1323,7 @@ mac_execve_will_transition(struct ucred *old, struct vnode *vp,
|
||||
|
||||
result = 0;
|
||||
MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label,
|
||||
interpvnodelabel, imgp);
|
||||
interpvnodelabel, imgp, imgp->execlabel);
|
||||
|
||||
return (result);
|
||||
}
|
||||
@ -1428,7 +1428,8 @@ mac_check_vnode_exec(struct ucred *cred, struct vnode *vp,
|
||||
if (!mac_enforce_process && !mac_enforce_fs)
|
||||
return (0);
|
||||
|
||||
MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label, imgp);
|
||||
MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label, imgp,
|
||||
imgp->execlabel);
|
||||
|
||||
return (error);
|
||||
}
|
||||
|
@ -1307,7 +1307,7 @@ mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp,
|
||||
return;
|
||||
|
||||
MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label,
|
||||
interpvnodelabel, imgp);
|
||||
interpvnodelabel, imgp, imgp->execlabel);
|
||||
}
|
||||
|
||||
int
|
||||
@ -1323,7 +1323,7 @@ mac_execve_will_transition(struct ucred *old, struct vnode *vp,
|
||||
|
||||
result = 0;
|
||||
MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label,
|
||||
interpvnodelabel, imgp);
|
||||
interpvnodelabel, imgp, imgp->execlabel);
|
||||
|
||||
return (result);
|
||||
}
|
||||
@ -1428,7 +1428,8 @@ mac_check_vnode_exec(struct ucred *cred, struct vnode *vp,
|
||||
if (!mac_enforce_process && !mac_enforce_fs)
|
||||
return (0);
|
||||
|
||||
MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label, imgp);
|
||||
MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label, imgp,
|
||||
imgp->execlabel);
|
||||
|
||||
return (error);
|
||||
}
|
||||
|
@ -1307,7 +1307,7 @@ mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp,
|
||||
return;
|
||||
|
||||
MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label,
|
||||
interpvnodelabel, imgp);
|
||||
interpvnodelabel, imgp, imgp->execlabel);
|
||||
}
|
||||
|
||||
int
|
||||
@ -1323,7 +1323,7 @@ mac_execve_will_transition(struct ucred *old, struct vnode *vp,
|
||||
|
||||
result = 0;
|
||||
MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label,
|
||||
interpvnodelabel, imgp);
|
||||
interpvnodelabel, imgp, imgp->execlabel);
|
||||
|
||||
return (result);
|
||||
}
|
||||
@ -1428,7 +1428,8 @@ mac_check_vnode_exec(struct ucred *cred, struct vnode *vp,
|
||||
if (!mac_enforce_process && !mac_enforce_fs)
|
||||
return (0);
|
||||
|
||||
MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label, imgp);
|
||||
MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label, imgp,
|
||||
imgp->execlabel);
|
||||
|
||||
return (error);
|
||||
}
|
||||
|
@ -1307,7 +1307,7 @@ mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp,
|
||||
return;
|
||||
|
||||
MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label,
|
||||
interpvnodelabel, imgp);
|
||||
interpvnodelabel, imgp, imgp->execlabel);
|
||||
}
|
||||
|
||||
int
|
||||
@ -1323,7 +1323,7 @@ mac_execve_will_transition(struct ucred *old, struct vnode *vp,
|
||||
|
||||
result = 0;
|
||||
MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label,
|
||||
interpvnodelabel, imgp);
|
||||
interpvnodelabel, imgp, imgp->execlabel);
|
||||
|
||||
return (result);
|
||||
}
|
||||
@ -1428,7 +1428,8 @@ mac_check_vnode_exec(struct ucred *cred, struct vnode *vp,
|
||||
if (!mac_enforce_process && !mac_enforce_fs)
|
||||
return (0);
|
||||
|
||||
MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label, imgp);
|
||||
MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label, imgp,
|
||||
imgp->execlabel);
|
||||
|
||||
return (error);
|
||||
}
|
||||
|
@ -1307,7 +1307,7 @@ mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp,
|
||||
return;
|
||||
|
||||
MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label,
|
||||
interpvnodelabel, imgp);
|
||||
interpvnodelabel, imgp, imgp->execlabel);
|
||||
}
|
||||
|
||||
int
|
||||
@ -1323,7 +1323,7 @@ mac_execve_will_transition(struct ucred *old, struct vnode *vp,
|
||||
|
||||
result = 0;
|
||||
MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label,
|
||||
interpvnodelabel, imgp);
|
||||
interpvnodelabel, imgp, imgp->execlabel);
|
||||
|
||||
return (result);
|
||||
}
|
||||
@ -1428,7 +1428,8 @@ mac_check_vnode_exec(struct ucred *cred, struct vnode *vp,
|
||||
if (!mac_enforce_process && !mac_enforce_fs)
|
||||
return (0);
|
||||
|
||||
MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label, imgp);
|
||||
MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label, imgp,
|
||||
imgp->execlabel);
|
||||
|
||||
return (error);
|
||||
}
|
||||
|
@ -244,11 +244,11 @@ struct mac_policy_ops {
|
||||
void (*mpo_execve_transition)(struct ucred *old, struct ucred *new,
|
||||
struct vnode *vp, struct label *vnodelabel,
|
||||
struct label *interpvnodelabel,
|
||||
struct image_params *imgp);
|
||||
struct image_params *imgp, struct label *execlabel);
|
||||
int (*mpo_execve_will_transition)(struct ucred *old,
|
||||
struct vnode *vp, struct label *vnodelabel,
|
||||
struct label *interpvnodelabel,
|
||||
struct image_params *imgp);
|
||||
struct image_params *imgp, struct label *execlabel);
|
||||
void (*mpo_create_proc0)(struct ucred *cred);
|
||||
void (*mpo_create_proc1)(struct ucred *cred);
|
||||
void (*mpo_relabel_cred)(struct ucred *cred,
|
||||
@ -342,7 +342,8 @@ struct mac_policy_ops {
|
||||
int (*mpo_check_vnode_deleteacl)(struct ucred *cred,
|
||||
struct vnode *vp, struct label *label, acl_type_t type);
|
||||
int (*mpo_check_vnode_exec)(struct ucred *cred, struct vnode *vp,
|
||||
struct label *label, struct image_params *imgp);
|
||||
struct label *label, struct image_params *imgp,
|
||||
struct label *execlabel);
|
||||
int (*mpo_check_vnode_getacl)(struct ucred *cred,
|
||||
struct vnode *vp, struct label *label, acl_type_t type);
|
||||
int (*mpo_check_vnode_getextattr)(struct ucred *cred,
|
||||
|
@ -1307,7 +1307,7 @@ mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp,
|
||||
return;
|
||||
|
||||
MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label,
|
||||
interpvnodelabel, imgp);
|
||||
interpvnodelabel, imgp, imgp->execlabel);
|
||||
}
|
||||
|
||||
int
|
||||
@ -1323,7 +1323,7 @@ mac_execve_will_transition(struct ucred *old, struct vnode *vp,
|
||||
|
||||
result = 0;
|
||||
MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label,
|
||||
interpvnodelabel, imgp);
|
||||
interpvnodelabel, imgp, imgp->execlabel);
|
||||
|
||||
return (result);
|
||||
}
|
||||
@ -1428,7 +1428,8 @@ mac_check_vnode_exec(struct ucred *cred, struct vnode *vp,
|
||||
if (!mac_enforce_process && !mac_enforce_fs)
|
||||
return (0);
|
||||
|
||||
MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label, imgp);
|
||||
MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label, imgp,
|
||||
imgp->execlabel);
|
||||
|
||||
return (error);
|
||||
}
|
||||
|
@ -1307,7 +1307,7 @@ mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp,
|
||||
return;
|
||||
|
||||
MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label,
|
||||
interpvnodelabel, imgp);
|
||||
interpvnodelabel, imgp, imgp->execlabel);
|
||||
}
|
||||
|
||||
int
|
||||
@ -1323,7 +1323,7 @@ mac_execve_will_transition(struct ucred *old, struct vnode *vp,
|
||||
|
||||
result = 0;
|
||||
MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label,
|
||||
interpvnodelabel, imgp);
|
||||
interpvnodelabel, imgp, imgp->execlabel);
|
||||
|
||||
return (result);
|
||||
}
|
||||
@ -1428,7 +1428,8 @@ mac_check_vnode_exec(struct ucred *cred, struct vnode *vp,
|
||||
if (!mac_enforce_process && !mac_enforce_fs)
|
||||
return (0);
|
||||
|
||||
MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label, imgp);
|
||||
MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label, imgp,
|
||||
imgp->execlabel);
|
||||
|
||||
return (error);
|
||||
}
|
||||
|
@ -1307,7 +1307,7 @@ mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp,
|
||||
return;
|
||||
|
||||
MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label,
|
||||
interpvnodelabel, imgp);
|
||||
interpvnodelabel, imgp, imgp->execlabel);
|
||||
}
|
||||
|
||||
int
|
||||
@ -1323,7 +1323,7 @@ mac_execve_will_transition(struct ucred *old, struct vnode *vp,
|
||||
|
||||
result = 0;
|
||||
MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label,
|
||||
interpvnodelabel, imgp);
|
||||
interpvnodelabel, imgp, imgp->execlabel);
|
||||
|
||||
return (result);
|
||||
}
|
||||
@ -1428,7 +1428,8 @@ mac_check_vnode_exec(struct ucred *cred, struct vnode *vp,
|
||||
if (!mac_enforce_process && !mac_enforce_fs)
|
||||
return (0);
|
||||
|
||||
MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label, imgp);
|
||||
MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label, imgp,
|
||||
imgp->execlabel);
|
||||
|
||||
return (error);
|
||||
}
|
||||
|
@ -1307,7 +1307,7 @@ mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp,
|
||||
return;
|
||||
|
||||
MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label,
|
||||
interpvnodelabel, imgp);
|
||||
interpvnodelabel, imgp, imgp->execlabel);
|
||||
}
|
||||
|
||||
int
|
||||
@ -1323,7 +1323,7 @@ mac_execve_will_transition(struct ucred *old, struct vnode *vp,
|
||||
|
||||
result = 0;
|
||||
MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label,
|
||||
interpvnodelabel, imgp);
|
||||
interpvnodelabel, imgp, imgp->execlabel);
|
||||
|
||||
return (result);
|
||||
}
|
||||
@ -1428,7 +1428,8 @@ mac_check_vnode_exec(struct ucred *cred, struct vnode *vp,
|
||||
if (!mac_enforce_process && !mac_enforce_fs)
|
||||
return (0);
|
||||
|
||||
MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label, imgp);
|
||||
MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label, imgp,
|
||||
imgp->execlabel);
|
||||
|
||||
return (error);
|
||||
}
|
||||
|
@ -244,11 +244,11 @@ struct mac_policy_ops {
|
||||
void (*mpo_execve_transition)(struct ucred *old, struct ucred *new,
|
||||
struct vnode *vp, struct label *vnodelabel,
|
||||
struct label *interpvnodelabel,
|
||||
struct image_params *imgp);
|
||||
struct image_params *imgp, struct label *execlabel);
|
||||
int (*mpo_execve_will_transition)(struct ucred *old,
|
||||
struct vnode *vp, struct label *vnodelabel,
|
||||
struct label *interpvnodelabel,
|
||||
struct image_params *imgp);
|
||||
struct image_params *imgp, struct label *execlabel);
|
||||
void (*mpo_create_proc0)(struct ucred *cred);
|
||||
void (*mpo_create_proc1)(struct ucred *cred);
|
||||
void (*mpo_relabel_cred)(struct ucred *cred,
|
||||
@ -342,7 +342,8 @@ struct mac_policy_ops {
|
||||
int (*mpo_check_vnode_deleteacl)(struct ucred *cred,
|
||||
struct vnode *vp, struct label *label, acl_type_t type);
|
||||
int (*mpo_check_vnode_exec)(struct ucred *cred, struct vnode *vp,
|
||||
struct label *label, struct image_params *imgp);
|
||||
struct label *label, struct image_params *imgp,
|
||||
struct label *execlabel);
|
||||
int (*mpo_check_vnode_getacl)(struct ucred *cred,
|
||||
struct vnode *vp, struct label *label, acl_type_t type);
|
||||
int (*mpo_check_vnode_getextattr)(struct ucred *cred,
|
||||
|
Loading…
Reference in New Issue
Block a user