d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add a toggle to disable VM enforcement.

Browse Source 
Obtained from:	TrustedBSD Project
Sponsored by:	DARPA, NAI Labs
This commit is contained in:
rwatson 2002-09-18 02:02:08 +00:00
parent 22d6bef96d
commit 90f35dab01
9 changed files with 63 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
sys/kern/kern_mac.c
View File

@ -144,6 +144,10 @@ SYSCTL_INT(_security_mac, OID_AUTO, enforce_socket, CTLFLAG_RW,
&mac_enforce_socket, 0, "Enforce MAC policy on socket operations");
TUNABLE_INT("security.mac.enforce_socket", &mac_enforce_socket);
static int mac_enforce_vm = 1;
SYSCTL_INT(_security_mac, OID_AUTO, enforce_vm, CTLFLAG_RW,
&mac_enforce_vm, 0, "Enforce MAC policy on vm operations");
static int mac_label_size = sizeof(struct mac);
SYSCTL_INT(_security_mac, OID_AUTO, label_size, CTLFLAG_RD,
&mac_label_size, 0, "Pre-compiled MAC label size");
@ -1779,6 +1783,9 @@ mac_check_vnode_mmap_prot(struct ucred *cred, struct vnode *vp, int newmapping)
{
vm_prot_t result = VM_PROT_ALL;
if (!mac_enforce_vm)
return (result);
/*
* This should be some sort of MAC_BITWISE, maybe :)
*/

7
sys/security/mac/mac_framework.c
View File

@ -144,6 +144,10 @@ SYSCTL_INT(_security_mac, OID_AUTO, enforce_socket, CTLFLAG_RW,
&mac_enforce_socket, 0, "Enforce MAC policy on socket operations");
TUNABLE_INT("security.mac.enforce_socket", &mac_enforce_socket);
static int mac_enforce_vm = 1;
SYSCTL_INT(_security_mac, OID_AUTO, enforce_vm, CTLFLAG_RW,
&mac_enforce_vm, 0, "Enforce MAC policy on vm operations");
static int mac_label_size = sizeof(struct mac);
SYSCTL_INT(_security_mac, OID_AUTO, label_size, CTLFLAG_RD,
&mac_label_size, 0, "Pre-compiled MAC label size");
@ -1779,6 +1783,9 @@ mac_check_vnode_mmap_prot(struct ucred *cred, struct vnode *vp, int newmapping)
{
vm_prot_t result = VM_PROT_ALL;
if (!mac_enforce_vm)
return (result);
/*
* This should be some sort of MAC_BITWISE, maybe :)
*/

7
sys/security/mac/mac_internal.h
View File

@ -144,6 +144,10 @@ SYSCTL_INT(_security_mac, OID_AUTO, enforce_socket, CTLFLAG_RW,
&mac_enforce_socket, 0, "Enforce MAC policy on socket operations");
TUNABLE_INT("security.mac.enforce_socket", &mac_enforce_socket);
static int mac_enforce_vm = 1;
SYSCTL_INT(_security_mac, OID_AUTO, enforce_vm, CTLFLAG_RW,
&mac_enforce_vm, 0, "Enforce MAC policy on vm operations");
static int mac_label_size = sizeof(struct mac);
SYSCTL_INT(_security_mac, OID_AUTO, label_size, CTLFLAG_RD,
&mac_label_size, 0, "Pre-compiled MAC label size");
@ -1779,6 +1783,9 @@ mac_check_vnode_mmap_prot(struct ucred *cred, struct vnode *vp, int newmapping)
{
vm_prot_t result = VM_PROT_ALL;
if (!mac_enforce_vm)
return (result);
/*
* This should be some sort of MAC_BITWISE, maybe :)
*/

7
sys/security/mac/mac_net.c
View File

@ -144,6 +144,10 @@ SYSCTL_INT(_security_mac, OID_AUTO, enforce_socket, CTLFLAG_RW,
&mac_enforce_socket, 0, "Enforce MAC policy on socket operations");
TUNABLE_INT("security.mac.enforce_socket", &mac_enforce_socket);
static int mac_enforce_vm = 1;
SYSCTL_INT(_security_mac, OID_AUTO, enforce_vm, CTLFLAG_RW,
&mac_enforce_vm, 0, "Enforce MAC policy on vm operations");
static int mac_label_size = sizeof(struct mac);
SYSCTL_INT(_security_mac, OID_AUTO, label_size, CTLFLAG_RD,
&mac_label_size, 0, "Pre-compiled MAC label size");
@ -1779,6 +1783,9 @@ mac_check_vnode_mmap_prot(struct ucred *cred, struct vnode *vp, int newmapping)
{
vm_prot_t result = VM_PROT_ALL;
if (!mac_enforce_vm)
return (result);
/*
* This should be some sort of MAC_BITWISE, maybe :)
*/

7
sys/security/mac/mac_pipe.c
View File

@ -144,6 +144,10 @@ SYSCTL_INT(_security_mac, OID_AUTO, enforce_socket, CTLFLAG_RW,
&mac_enforce_socket, 0, "Enforce MAC policy on socket operations");
TUNABLE_INT("security.mac.enforce_socket", &mac_enforce_socket);
static int mac_enforce_vm = 1;
SYSCTL_INT(_security_mac, OID_AUTO, enforce_vm, CTLFLAG_RW,
&mac_enforce_vm, 0, "Enforce MAC policy on vm operations");
static int mac_label_size = sizeof(struct mac);
SYSCTL_INT(_security_mac, OID_AUTO, label_size, CTLFLAG_RD,
&mac_label_size, 0, "Pre-compiled MAC label size");
@ -1779,6 +1783,9 @@ mac_check_vnode_mmap_prot(struct ucred *cred, struct vnode *vp, int newmapping)
{
vm_prot_t result = VM_PROT_ALL;
if (!mac_enforce_vm)
return (result);
/*
* This should be some sort of MAC_BITWISE, maybe :)
*/

7
sys/security/mac/mac_process.c
View File

@ -144,6 +144,10 @@ SYSCTL_INT(_security_mac, OID_AUTO, enforce_socket, CTLFLAG_RW,
&mac_enforce_socket, 0, "Enforce MAC policy on socket operations");
TUNABLE_INT("security.mac.enforce_socket", &mac_enforce_socket);
static int mac_enforce_vm = 1;
SYSCTL_INT(_security_mac, OID_AUTO, enforce_vm, CTLFLAG_RW,
&mac_enforce_vm, 0, "Enforce MAC policy on vm operations");
static int mac_label_size = sizeof(struct mac);
SYSCTL_INT(_security_mac, OID_AUTO, label_size, CTLFLAG_RD,
&mac_label_size, 0, "Pre-compiled MAC label size");
@ -1779,6 +1783,9 @@ mac_check_vnode_mmap_prot(struct ucred *cred, struct vnode *vp, int newmapping)
{
vm_prot_t result = VM_PROT_ALL;
if (!mac_enforce_vm)
return (result);
/*
* This should be some sort of MAC_BITWISE, maybe :)
*/

7
sys/security/mac/mac_syscalls.c
View File

@ -144,6 +144,10 @@ SYSCTL_INT(_security_mac, OID_AUTO, enforce_socket, CTLFLAG_RW,
&mac_enforce_socket, 0, "Enforce MAC policy on socket operations");
TUNABLE_INT("security.mac.enforce_socket", &mac_enforce_socket);
static int mac_enforce_vm = 1;
SYSCTL_INT(_security_mac, OID_AUTO, enforce_vm, CTLFLAG_RW,
&mac_enforce_vm, 0, "Enforce MAC policy on vm operations");
static int mac_label_size = sizeof(struct mac);
SYSCTL_INT(_security_mac, OID_AUTO, label_size, CTLFLAG_RD,
&mac_label_size, 0, "Pre-compiled MAC label size");
@ -1779,6 +1783,9 @@ mac_check_vnode_mmap_prot(struct ucred *cred, struct vnode *vp, int newmapping)
{
vm_prot_t result = VM_PROT_ALL;
if (!mac_enforce_vm)
return (result);
/*
* This should be some sort of MAC_BITWISE, maybe :)
*/

7
sys/security/mac/mac_system.c
View File

@ -144,6 +144,10 @@ SYSCTL_INT(_security_mac, OID_AUTO, enforce_socket, CTLFLAG_RW,
&mac_enforce_socket, 0, "Enforce MAC policy on socket operations");
TUNABLE_INT("security.mac.enforce_socket", &mac_enforce_socket);
static int mac_enforce_vm = 1;
SYSCTL_INT(_security_mac, OID_AUTO, enforce_vm, CTLFLAG_RW,
&mac_enforce_vm, 0, "Enforce MAC policy on vm operations");
static int mac_label_size = sizeof(struct mac);
SYSCTL_INT(_security_mac, OID_AUTO, label_size, CTLFLAG_RD,
&mac_label_size, 0, "Pre-compiled MAC label size");
@ -1779,6 +1783,9 @@ mac_check_vnode_mmap_prot(struct ucred *cred, struct vnode *vp, int newmapping)
{
vm_prot_t result = VM_PROT_ALL;
if (!mac_enforce_vm)
return (result);
/*
* This should be some sort of MAC_BITWISE, maybe :)
*/

7
sys/security/mac/mac_vfs.c
View File

@ -144,6 +144,10 @@ SYSCTL_INT(_security_mac, OID_AUTO, enforce_socket, CTLFLAG_RW,
&mac_enforce_socket, 0, "Enforce MAC policy on socket operations");
TUNABLE_INT("security.mac.enforce_socket", &mac_enforce_socket);
static int mac_enforce_vm = 1;
SYSCTL_INT(_security_mac, OID_AUTO, enforce_vm, CTLFLAG_RW,
&mac_enforce_vm, 0, "Enforce MAC policy on vm operations");
static int mac_label_size = sizeof(struct mac);
SYSCTL_INT(_security_mac, OID_AUTO, label_size, CTLFLAG_RD,
&mac_label_size, 0, "Pre-compiled MAC label size");
@ -1779,6 +1783,9 @@ mac_check_vnode_mmap_prot(struct ucred *cred, struct vnode *vp, int newmapping)
{
vm_prot_t result = VM_PROT_ALL;
if (!mac_enforce_vm)
return (result);
/*
* This should be some sort of MAC_BITWISE, maybe :)
*/