d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Implement mpo_check_system_acct and mpo_check_system_settime() for Biba:

Browse Source 
require Biba privilege to configure either, and require that accounting
files be high integrity.  Note that this does allow implicit information
flow from low to high integrity, but it also protects the integrity
of accounting data.

Obtained from:	TrustedBSD Project
Sponsored by:	DARPA, Network Associates Laboratories
This commit is contained in:
Robert Watson 2002-11-04 17:50:52 +00:00
parent e2b57789f8
commit 743d9c6a2d
1 changed files with 46 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

46
sys/security/mac_biba/mac_biba.c
View File

@ -1866,6 +1866,50 @@ mac_biba_check_socket_visible(struct ucred *cred, struct socket *socket,
return (0);
}
static int
mac_biba_check_system_acct(struct ucred *cred, struct vnode *vp,
struct label *label)
{
struct mac_biba *subj, *obj;
int error;
if (!mac_biba_enabled)
return (0);
subj = SLOT(&cred->cr_label);
error = mac_biba_subject_privileged(subj);
if (error)
return (error);
if (label == NULL)
return (0);
obj = SLOT(label);
if (!mac_biba_high_single(obj))
return (EACCES);
return (0);
}
static int
mac_biba_check_system_settime(struct ucred *cred)
{
struct mac_biba *subj;
int error;
if (!mac_biba_enabled)
return (0);
subj = SLOT(&cred->cr_label);
error = mac_biba_subject_privileged(subj);
if (error)
return (error);
return (0);
}
static int
mac_biba_check_system_swapon(struct ucred *cred, struct vnode *vp,
struct label *label)
@ -2606,6 +2650,8 @@ static struct mac_policy_ops mac_biba_ops =
.mpo_check_socket_deliver = mac_biba_check_socket_deliver,
.mpo_check_socket_relabel = mac_biba_check_socket_relabel,
.mpo_check_socket_visible = mac_biba_check_socket_visible,
.mpo_check_system_acct = mac_biba_check_system_acct,
.mpo_check_system_settime = mac_biba_check_system_settime,
.mpo_check_system_swapon = mac_biba_check_system_swapon,
.mpo_check_system_sysctl = mac_biba_check_system_sysctl,
.mpo_check_vnode_access = mac_biba_check_vnode_open,