d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Support file verification in MAC.

Browse Source 
* Add VCREAT flag to indicate when a new file is being created
* Add VVERIFY to indicate verification is required
* Both VCREAT and VVERIFY are only passed on the MAC method vnode_check_open
  and are removed from the accmode after
* Add O_VERIFY flag to rtld open of objects
* Add 'v' flag to __sflags to set O_VERIFY flag.

Submitted by:		Steve Kiernan <stevek@juniper.net>
Obtained from:		Juniper Networks, Inc.
GitHub Pull Request:	https://github.com/freebsd/freebsd/pull/27
Relnotes:		yes
This commit is contained in:
Craig Rodrigues 2015-04-22 01:54:25 +00:00
parent fff9fa1935
commit d5fec48956
5 changed files with 18 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
lib/libc/stdio/flags.c
View File

@ -97,6 +97,10 @@ __sflags(const char *mode, int *optr)
/* set close-on-exec */
o |= O_CLOEXEC;
break;
case 'v':
/* verify */
o |= O_VERIFY;
break;
default:
known = 0;
break;

4
libexec/rtld-elf/rtld.c
View File

@ -2165,7 +2165,7 @@ load_object(const char *name, int fd_u, const Obj_Entry *refobj, int flags)
* To avoid a race, we open the file and use fstat() rather than
* using stat().
*/
if ((fd = open(path, O_RDONLY | O_CLOEXEC)) == -1) {
if ((fd = open(path, O_RDONLY | O_CLOEXEC | O_VERIFY)) == -1) {
_rtld_error("Cannot open \"%s\"", path);
free(path);
return (NULL);
@ -2855,7 +2855,7 @@ search_library_pathfds(const char *name, const char *path, int *fdp)
dirfd = parse_libdir(fdstr);
if (dirfd < 0)
break;
fd = __sys_openat(dirfd, name, O_RDONLY | O_CLOEXEC);
fd = __sys_openat(dirfd, name, O_RDONLY | O_CLOEXEC | O_VERIFY);
if (fd >= 0) {
*fdp = fd;
len = strlen(fdstr) + strlen(name) + 3;

6
sys/kern/vfs_vnops.c
View File

@ -306,9 +306,15 @@ vn_open_vnode(struct vnode *vp, int fmode, struct ucred *cred,
if ((fmode & O_APPEND) && (fmode & FWRITE))
accmode |= VAPPEND;
#ifdef MAC
if (fmode & O_CREAT)
accmode |= VCREAT;
if (fmode & O_VERIFY)
accmode |= VVERIFY;
error = mac_vnode_check_open(cred, vp, accmode);
if (error)
return (error);
accmode &= ~(VCREAT | VVERIFY);
#endif
if ((fmode & O_CREAT) == 0) {
if (accmode & VWRITE) {

4
sys/sys/fcntl.h
View File

@ -129,6 +129,10 @@ typedef __pid_t pid_t;
#define O_CLOEXEC 0x00100000
#endif
#if __BSD_VISIBLE
#define O_VERIFY 0x00200000 /* open only after verification */
#endif
/*
* XXX missing O_DSYNC, O_RSYNC.
*/

2
sys/sys/vnode.h
View File

@ -336,6 +336,8 @@ struct vattr {
#define VWRITE_ACL 000040000000 /* change ACL and/or file mode */
#define VWRITE_OWNER 000100000000 /* change file owner */
#define VSYNCHRONIZE 000200000000 /* not used */
#define VCREAT 000400000000 /* creating new file */
#define VVERIFY 001000000000 /* verification required */
/*
* Permissions that were traditionally granted only to the file owner.