d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Resort TrustedBSD MAC Framework policy entry point implementations and

Browse Source 
declarations to match the object, operation sort order in the framework
itself.

Obtained from:	TrustedBSD Project
This commit is contained in:
Robert Watson 2007-10-29 13:33:06 +00:00
parent e0cb3d9c5c
commit eb320b0ee7
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=173138
9 changed files with 5495 additions and 5435 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2518
sys/security/mac_biba/mac_biba.c
View File

File diff suppressed because it is too large Load Diff

4
sys/security/mac_bsdextended/mac_bsdextended.c
View File

@ -442,6 +442,10 @@ ugidfw_check_vp(struct ucred *cred, struct vnode *vp, int acc_mode)
return (ugidfw_check(cred, vp, &vap, acc_mode));
}
/*
* Object-specific entry point implementations are sorted alphabetically by
* object type and then by operation.
*/
static int
ugidfw_system_check_acct(struct ucred *cred, struct vnode *vp,
struct label *vplabel)

4
sys/security/mac_ifoff/mac_ifoff.c
View File

@ -117,6 +117,10 @@ ifnet_check_incoming(struct ifnet *ifp, int viabpf)
return (EPERM);
}
/*
* Object-specific entry point implementations are sorted alphabetically by
* object type and then by operation.
*/
static int
ifoff_bpfdesc_check_receive(struct bpf_d *d, struct label *dlabel,
struct ifnet *ifp, struct label *ifplabel)

1973
sys/security/mac_lomac/mac_lomac.c
View File

File diff suppressed because it is too large Load Diff

2161
sys/security/mac_mls/mac_mls.c
View File

File diff suppressed because it is too large Load Diff

164
sys/security/mac_partition/mac_partition.c
View File

@ -69,78 +69,6 @@ static int partition_slot;
#define SLOT(l) mac_label_get((l), partition_slot)
#define SLOT_SET(l, v) mac_label_set((l), partition_slot, (v))
static void
partition_init_label(struct label *label)
{
SLOT_SET(label, 0);
}
static void
partition_destroy_label(struct label *label)
{
SLOT_SET(label, 0);
}
static void
partition_copy_label(struct label *src, struct label *dest)
{
SLOT_SET(dest, SLOT(src));
}
static int
partition_externalize_label(struct label *label, char *element_name,
struct sbuf *sb, int *claimed)
{
if (strcmp(MAC_PARTITION_LABEL_NAME, element_name) != 0)
return (0);
(*claimed)++;
if (sbuf_printf(sb, "%jd", (intmax_t)SLOT(label)) == -1)
return (EINVAL);
else
return (0);
}
static int
partition_internalize_label(struct label *label, char *element_name,
char *element_data, int *claimed)
{
if (strcmp(MAC_PARTITION_LABEL_NAME, element_name) != 0)
return (0);
(*claimed)++;
SLOT_SET(label, strtol(element_data, NULL, 10));
return (0);
}
static void
partition_proc_create_swapper(struct ucred *cred)
{
SLOT_SET(cred->cr_label, 0);
}
static void
partition_proc_create_init(struct ucred *cred)
{
SLOT_SET(cred->cr_label, 0);
}
static void
partition_cred_relabel(struct ucred *cred, struct label *newlabel)
{
if (SLOT(newlabel) != 0)
SLOT_SET(cred->cr_label, SLOT(newlabel));
}
static int
label_on_label(struct label *subject, struct label *object)
{
@ -157,6 +85,10 @@ label_on_label(struct label *subject, struct label *object)
return (EPERM);
}
/*
* Object-specific entry points are sorted alphabetically by object type name
* and then by operation.
*/
static int
partition_cred_check_relabel(struct ucred *cred, struct label *newlabel)
{
@ -188,6 +120,64 @@ partition_cred_check_visible(struct ucred *cr1, struct ucred *cr2)
return (error == 0 ? 0 : ESRCH);
}
static void
partition_cred_copy_label(struct label *src, struct label *dest)
{
SLOT_SET(dest, SLOT(src));
}
static void
partition_cred_destroy_label(struct label *label)
{
SLOT_SET(label, 0);
}
static int
partition_cred_externalize_label(struct label *label, char *element_name,
struct sbuf *sb, int *claimed)
{
if (strcmp(MAC_PARTITION_LABEL_NAME, element_name) != 0)
return (0);
(*claimed)++;
if (sbuf_printf(sb, "%jd", (intmax_t)SLOT(label)) == -1)
return (EINVAL);
else
return (0);
}
static void
partition_cred_init_label(struct label *label)
{
SLOT_SET(label, 0);
}
static int
partition_cred_internalize_label(struct label *label, char *element_name,
char *element_data, int *claimed)
{
if (strcmp(MAC_PARTITION_LABEL_NAME, element_name) != 0)
return (0);
(*claimed)++;
SLOT_SET(label, strtol(element_data, NULL, 10));
return (0);
}
static void
partition_cred_relabel(struct ucred *cred, struct label *newlabel)
{
if (SLOT(newlabel) != 0)
SLOT_SET(cred->cr_label, SLOT(newlabel));
}
static int
partition_proc_check_debug(struct ucred *cred, struct proc *p)
{
@ -219,6 +209,20 @@ partition_proc_check_signal(struct ucred *cred, struct proc *p,
return (error ? ESRCH : 0);
}
static void
partition_proc_create_init(struct ucred *cred)
{
SLOT_SET(cred->cr_label, 0);
}
static void
partition_proc_create_swapper(struct ucred *cred)
{
SLOT_SET(cred->cr_label, 0);
}
static int
partition_socket_check_visible(struct ucred *cred, struct socket *so,
struct label *solabel)
@ -251,19 +255,19 @@ partition_vnode_check_exec(struct ucred *cred, struct vnode *vp,
static struct mac_policy_ops partition_ops =
{
.mpo_cred_init_label = partition_init_label,
.mpo_cred_destroy_label = partition_destroy_label,
.mpo_cred_copy_label = partition_copy_label,
.mpo_cred_externalize_label = partition_externalize_label,
.mpo_cred_internalize_label = partition_internalize_label,
.mpo_proc_create_swapper = partition_proc_create_swapper,
.mpo_proc_create_init = partition_proc_create_init,
.mpo_cred_relabel = partition_cred_relabel,
.mpo_cred_check_relabel = partition_cred_check_relabel,
.mpo_cred_check_visible = partition_cred_check_visible,
.mpo_cred_copy_label = partition_cred_copy_label,
.mpo_cred_destroy_label = partition_cred_destroy_label,
.mpo_cred_externalize_label = partition_cred_externalize_label,
.mpo_cred_init_label = partition_cred_init_label,
.mpo_cred_internalize_label = partition_cred_internalize_label,
.mpo_cred_relabel = partition_cred_relabel,
.mpo_proc_check_debug = partition_proc_check_debug,
.mpo_proc_check_sched = partition_proc_check_sched,
.mpo_proc_check_signal = partition_proc_check_signal,
.mpo_proc_create_init = partition_proc_create_init,
.mpo_proc_create_swapper = partition_proc_create_swapper,
.mpo_socket_check_visible = partition_socket_check_visible,
.mpo_vnode_check_exec = partition_vnode_check_exec,
};

22
sys/security/mac_seeotheruids/mac_seeotheruids.c
View File

@ -126,15 +126,7 @@ seeotheruids_check(struct ucred *cr1, struct ucred *cr2)
}
static int
seeotheruids_cred_check_visible(struct ucred *cr1, struct ucred *cr2)
{
return (seeotheruids_check(cr1, cr2));
}
static int
seeotheruids_proc_check_signal(struct ucred *cred, struct proc *p,
int signum)
seeotheruids_proc_check_debug(struct ucred *cred, struct proc *p)
{
return (seeotheruids_check(cred, p->p_ucred));
@ -148,12 +140,20 @@ seeotheruids_proc_check_sched(struct ucred *cred, struct proc *p)
}
static int
seeotheruids_proc_check_debug(struct ucred *cred, struct proc *p)
seeotheruids_proc_check_signal(struct ucred *cred, struct proc *p,
int signum)
{
return (seeotheruids_check(cred, p->p_ucred));
}
static int
seeotheruids_cred_check_visible(struct ucred *cr1, struct ucred *cr2)
{
return (seeotheruids_check(cr1, cr2));
}
static int
seeotheruids_socket_check_visible(struct ucred *cred, struct socket *so,
struct label *solabel)
@ -164,10 +164,10 @@ seeotheruids_socket_check_visible(struct ucred *cred, struct socket *so,
static struct mac_policy_ops seeotheruids_ops =
{
.mpo_cred_check_visible = seeotheruids_cred_check_visible,
.mpo_proc_check_debug = seeotheruids_proc_check_debug,
.mpo_proc_check_sched = seeotheruids_proc_check_sched,
.mpo_proc_check_signal = seeotheruids_proc_check_signal,
.mpo_cred_check_visible = seeotheruids_cred_check_visible,
.mpo_socket_check_visible = seeotheruids_socket_check_visible,
};

1335
sys/security/mac_stub/mac_stub.c
View File

File diff suppressed because it is too large Load Diff

2749
sys/security/mac_test/mac_test.c
View File

File diff suppressed because it is too large Load Diff