d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Declare a module service "kernel_mac_support" when MAC support is

Browse Source 
enabled and the kernel provides the MAC registration and entry point
service.  Declare a dependency on that module service for any
MAC module registered using mac_policy.h.  For now, hard code the
version as 1, but once we've come up with a versioning policy, we'll
move to a #define of some sort.  In the mean time, this will prevent
loading a MAC module when 'options MAC' isn't present, which (due to
a bug in the kernel linker) can result if the MAC module is preloaded
via loader.conf.

This particular evil recommended by:	peter
Obtained from:	TrustedBSD Project
Sponsored by:	DARPA, NAI LAbs
This commit is contained in:
Robert Watson 2002-08-12 02:00:21 +00:00
parent 62c0c26325
commit 7ba28492c5
11 changed files with 74 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
sys/kern/kern_mac.c
View File

@ -54,6 +54,7 @@
#include <sys/mutex.h>
#include <sys/sx.h>
#include <sys/mac.h>
#include <sys/module.h>
#include <sys/proc.h>
#include <sys/systm.h>
#include <sys/sysproto.h>
@ -87,6 +88,13 @@
#ifdef MAC
/*
* Declare that the kernel provides MAC support, version 1. This permits
* modules to refuse to be loaded if the necessary support isn't present,
* even if it's pre-boot.
*/
MODULE_VERSION(kernel_mac_support, 1);
SYSCTL_DECL(_security);
SYSCTL_NODE(_security, OID_AUTO, mac, CTLFLAG_RW, 0,

8
sys/security/mac/mac_framework.c
View File

@ -54,6 +54,7 @@
#include <sys/mutex.h>
#include <sys/sx.h>
#include <sys/mac.h>
#include <sys/module.h>
#include <sys/proc.h>
#include <sys/systm.h>
#include <sys/sysproto.h>
@ -87,6 +88,13 @@
#ifdef MAC
/*
* Declare that the kernel provides MAC support, version 1. This permits
* modules to refuse to be loaded if the necessary support isn't present,
* even if it's pre-boot.
*/
MODULE_VERSION(kernel_mac_support, 1);
SYSCTL_DECL(_security);
SYSCTL_NODE(_security, OID_AUTO, mac, CTLFLAG_RW, 0,

8
sys/security/mac/mac_internal.h
View File

@ -54,6 +54,7 @@
#include <sys/mutex.h>
#include <sys/sx.h>
#include <sys/mac.h>
#include <sys/module.h>
#include <sys/proc.h>
#include <sys/systm.h>
#include <sys/sysproto.h>
@ -87,6 +88,13 @@
#ifdef MAC
/*
* Declare that the kernel provides MAC support, version 1. This permits
* modules to refuse to be loaded if the necessary support isn't present,
* even if it's pre-boot.
*/
MODULE_VERSION(kernel_mac_support, 1);
SYSCTL_DECL(_security);
SYSCTL_NODE(_security, OID_AUTO, mac, CTLFLAG_RW, 0,

8
sys/security/mac/mac_net.c
View File

@ -54,6 +54,7 @@
#include <sys/mutex.h>
#include <sys/sx.h>
#include <sys/mac.h>
#include <sys/module.h>
#include <sys/proc.h>
#include <sys/systm.h>
#include <sys/sysproto.h>
@ -87,6 +88,13 @@
#ifdef MAC
/*
* Declare that the kernel provides MAC support, version 1. This permits
* modules to refuse to be loaded if the necessary support isn't present,
* even if it's pre-boot.
*/
MODULE_VERSION(kernel_mac_support, 1);
SYSCTL_DECL(_security);
SYSCTL_NODE(_security, OID_AUTO, mac, CTLFLAG_RW, 0,

8
sys/security/mac/mac_pipe.c
View File

@ -54,6 +54,7 @@
#include <sys/mutex.h>
#include <sys/sx.h>
#include <sys/mac.h>
#include <sys/module.h>
#include <sys/proc.h>
#include <sys/systm.h>
#include <sys/sysproto.h>
@ -87,6 +88,13 @@
#ifdef MAC
/*
* Declare that the kernel provides MAC support, version 1. This permits
* modules to refuse to be loaded if the necessary support isn't present,
* even if it's pre-boot.
*/
MODULE_VERSION(kernel_mac_support, 1);
SYSCTL_DECL(_security);
SYSCTL_NODE(_security, OID_AUTO, mac, CTLFLAG_RW, 0,

1
sys/security/mac/mac_policy.h
View File

@ -481,6 +481,7 @@ struct mac_policy_conf {
mac_policy_modevent, \
&mpname##_mac_policy_conf \
}; \
MODULE_DEPEND(mpname, kernel_mac_support, 1, 1, 1); \
DECLARE_MODULE(mpname, mpname##_mod, SI_SUB_MAC_POLICY, \
SI_ORDER_MIDDLE)

8
sys/security/mac/mac_process.c
View File

@ -54,6 +54,7 @@
#include <sys/mutex.h>
#include <sys/sx.h>
#include <sys/mac.h>
#include <sys/module.h>
#include <sys/proc.h>
#include <sys/systm.h>
#include <sys/sysproto.h>
@ -87,6 +88,13 @@
#ifdef MAC
/*
* Declare that the kernel provides MAC support, version 1. This permits
* modules to refuse to be loaded if the necessary support isn't present,
* even if it's pre-boot.
*/
MODULE_VERSION(kernel_mac_support, 1);
SYSCTL_DECL(_security);
SYSCTL_NODE(_security, OID_AUTO, mac, CTLFLAG_RW, 0,

8
sys/security/mac/mac_syscalls.c
View File

@ -54,6 +54,7 @@
#include <sys/mutex.h>
#include <sys/sx.h>
#include <sys/mac.h>
#include <sys/module.h>
#include <sys/proc.h>
#include <sys/systm.h>
#include <sys/sysproto.h>
@ -87,6 +88,13 @@
#ifdef MAC
/*
* Declare that the kernel provides MAC support, version 1. This permits
* modules to refuse to be loaded if the necessary support isn't present,
* even if it's pre-boot.
*/
MODULE_VERSION(kernel_mac_support, 1);
SYSCTL_DECL(_security);
SYSCTL_NODE(_security, OID_AUTO, mac, CTLFLAG_RW, 0,

8
sys/security/mac/mac_system.c
View File

@ -54,6 +54,7 @@
#include <sys/mutex.h>
#include <sys/sx.h>
#include <sys/mac.h>
#include <sys/module.h>
#include <sys/proc.h>
#include <sys/systm.h>
#include <sys/sysproto.h>
@ -87,6 +88,13 @@
#ifdef MAC
/*
* Declare that the kernel provides MAC support, version 1. This permits
* modules to refuse to be loaded if the necessary support isn't present,
* even if it's pre-boot.
*/
MODULE_VERSION(kernel_mac_support, 1);
SYSCTL_DECL(_security);
SYSCTL_NODE(_security, OID_AUTO, mac, CTLFLAG_RW, 0,

8
sys/security/mac/mac_vfs.c
View File

@ -54,6 +54,7 @@
#include <sys/mutex.h>
#include <sys/sx.h>
#include <sys/mac.h>
#include <sys/module.h>
#include <sys/proc.h>
#include <sys/systm.h>
#include <sys/sysproto.h>
@ -87,6 +88,13 @@
#ifdef MAC
/*
* Declare that the kernel provides MAC support, version 1. This permits
* modules to refuse to be loaded if the necessary support isn't present,
* even if it's pre-boot.
*/
MODULE_VERSION(kernel_mac_support, 1);
SYSCTL_DECL(_security);
SYSCTL_NODE(_security, OID_AUTO, mac, CTLFLAG_RW, 0,

1
sys/sys/mac_policy.h
View File

@ -481,6 +481,7 @@ struct mac_policy_conf {
mac_policy_modevent, \
&mpname##_mac_policy_conf \
}; \
MODULE_DEPEND(mpname, kernel_mac_support, 1, 1, 1); \
DECLARE_MODULE(mpname, mpname##_mod, SI_SUB_MAC_POLICY, \
SI_ORDER_MIDDLE)