d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Enforce MAC policies for the locally implemented vnode services in

Browse Source 
SVR4 emulation relating to readdir() and fd_revoke().  All other
services appear to be implemented by simply wrapping existing
FreeBSD native system call implementations, so don't require local
instrumentation in the emulator module.

Obtained from:	TrustedBSD Project
Sponsored by:	DARPA, NAI Labs
This commit is contained in:
Robert Watson 2002-08-12 01:42:21 +00:00
parent d6b71299d2
commit 7d834ce78d
2 changed files with 28 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
sys/compat/svr4/svr4_fcntl.c
View File

@ -30,12 +30,16 @@
*
* $FreeBSD$
*/
#include "opt_mac.h"
#include <sys/param.h>
#include <sys/systm.h>
#include <sys/file.h>
#include <sys/filedesc.h>
/*#include <sys/ioctl.h>*/
#include <sys/lock.h>
#include <sys/mac.h>
#include <sys/mount.h>
#include <sys/mutex.h>
#include <sys/namei.h>
@ -260,6 +264,14 @@ fd_revoke(td, fd)
goto out;
}
#ifdef MAC
vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td);
error = mac_check_vnode_revoke(td->td_ucred, vp);
VOP_UNLOCK(vp, 0, td);
if (error)
goto out;
#endif
if ((error = VOP_GETATTR(vp, &vattr, td->td_ucred, td)) != 0)
goto out;

16
sys/compat/svr4/svr4_misc.c
View File

@ -35,6 +35,8 @@
* handled here.
*/
#include "opt_mac.h"
#include <sys/param.h>
#include <sys/systm.h>
#include <sys/dirent.h>
@ -43,6 +45,7 @@
#include <sys/jail.h>
#include <sys/kernel.h>
#include <sys/lock.h>
#include <sys/mac.h>
#include <sys/malloc.h>
#include <sys/file.h> /* Must come after sys/malloc.h */
#include <sys/mman.h>
@ -310,6 +313,12 @@ svr4_sys_getdents64(td, uap)
cookies = NULL;
}
#ifdef MAC
error = mac_check_vnode_readdir(td->td_ucred, vp);
if (error)
return (error);
#endif
error = VOP_READDIR(vp, &auio, fp->f_cred, &eofflag,
&ncookies, &cookies);
if (error) {
@ -462,6 +471,13 @@ svr4_sys_getdents(td, uap)
auio.uio_td = td;
auio.uio_resid = buflen;
auio.uio_offset = off;
#ifdef MAC
error = mac_check_vnode_readdir(td->td_ucred, vp);
if (error)
goto out;
#endif
/*
* First we read into the malloc'ed buffer, then
* we massage it into user space, one record at a time.