d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add mac_check_vnode_deleteextattr() and mac_check_vnode_listextattr():

Browse Source 
explicit access control checks to delete and list extended attributes
on a vnode, rather than implicitly combining with the setextattr and
getextattr checks.  This reflects EA API changes in the kernel made
recently, including the move to explicit VOP's for both of these
operations.

Obtained from:	TrustedBSD PRoject
Sponsored by:	DARPA, Network Associates Laboratories
This commit is contained in:
Robert Watson 2003-08-21 13:53:01 +00:00
parent 7e711d0d8d
commit c096756c00
15 changed files with 312 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
sys/kern/kern_mac.c
View File

@ -1613,6 +1613,22 @@ mac_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp,
return (error);
}
int
mac_check_vnode_deleteextattr(struct ucred *cred, struct vnode *vp,
int attrnamespace, const char *name)
{
int error;
ASSERT_VOP_LOCKED(vp, "mac_check_vnode_deleteextattr");
if (!mac_enforce_fs)
return (0);
MAC_CHECK(check_vnode_deleteextattr, cred, vp, &vp->v_label,
attrnamespace, name);
return (error);
}
int
mac_check_vnode_exec(struct ucred *cred, struct vnode *vp,
struct image_params *imgp)
@ -1677,6 +1693,22 @@ mac_check_vnode_link(struct ucred *cred, struct vnode *dvp,
return (error);
}
int
mac_check_vnode_listextattr(struct ucred *cred, struct vnode *vp,
int attrnamespace)
{
int error;
ASSERT_VOP_LOCKED(vp, "mac_check_vnode_listextattr");
if (!mac_enforce_fs)
return (0);
MAC_CHECK(check_vnode_listextattr, cred, vp, &vp->v_label,
attrnamespace);
return (error);
}
int
mac_check_vnode_lookup(struct ucred *cred, struct vnode *dvp,
struct componentname *cnp)

7
sys/kern/vfs_extattr.c
View File

@ -4270,8 +4270,8 @@ extattr_delete_vp(struct vnode *vp, int attrnamespace, const char *attrname,
vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td);
#ifdef MAC
error = mac_check_vnode_setextattr(td->td_ucred, vp, attrnamespace,
attrname, NULL);
error = mac_check_vnode_deleteextattr(td->td_ucred, vp, attrnamespace,
attrname);
if (error)
goto done;
#endif
@ -4418,8 +4418,7 @@ extattr_list_vp(struct vnode *vp, int attrnamespace, void *data,
sizep = &size;
#ifdef MAC
error = mac_check_vnode_getextattr(td->td_ucred, vp, attrnamespace,
"", &auio);
error = mac_check_vnode_listextattr(td->td_ucred, vp, attrnamespace);
if (error)
goto done;
#endif

7
sys/kern/vfs_syscalls.c
View File

@ -4270,8 +4270,8 @@ extattr_delete_vp(struct vnode *vp, int attrnamespace, const char *attrname,
vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td);
#ifdef MAC
error = mac_check_vnode_setextattr(td->td_ucred, vp, attrnamespace,
attrname, NULL);
error = mac_check_vnode_deleteextattr(td->td_ucred, vp, attrnamespace,
attrname);
if (error)
goto done;
#endif
@ -4418,8 +4418,7 @@ extattr_list_vp(struct vnode *vp, int attrnamespace, void *data,
sizep = &size;
#ifdef MAC
error = mac_check_vnode_getextattr(td->td_ucred, vp, attrnamespace,
"", &auio);
error = mac_check_vnode_listextattr(td->td_ucred, vp, attrnamespace);
if (error)
goto done;
#endif

32
sys/security/mac/mac_framework.c
View File

@ -1613,6 +1613,22 @@ mac_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp,
return (error);
}
int
mac_check_vnode_deleteextattr(struct ucred *cred, struct vnode *vp,
int attrnamespace, const char *name)
{
int error;
ASSERT_VOP_LOCKED(vp, "mac_check_vnode_deleteextattr");
if (!mac_enforce_fs)
return (0);
MAC_CHECK(check_vnode_deleteextattr, cred, vp, &vp->v_label,
attrnamespace, name);
return (error);
}
int
mac_check_vnode_exec(struct ucred *cred, struct vnode *vp,
struct image_params *imgp)
@ -1677,6 +1693,22 @@ mac_check_vnode_link(struct ucred *cred, struct vnode *dvp,
return (error);
}
int
mac_check_vnode_listextattr(struct ucred *cred, struct vnode *vp,
int attrnamespace)
{
int error;
ASSERT_VOP_LOCKED(vp, "mac_check_vnode_listextattr");
if (!mac_enforce_fs)
return (0);
MAC_CHECK(check_vnode_listextattr, cred, vp, &vp->v_label,
attrnamespace);
return (error);
}
int
mac_check_vnode_lookup(struct ucred *cred, struct vnode *dvp,
struct componentname *cnp)

4
sys/security/mac/mac_framework.h
View File

@ -279,6 +279,8 @@ int mac_check_vnode_delete(struct ucred *cred, struct vnode *dvp,
struct vnode *vp, struct componentname *cnp);
int mac_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp,
acl_type_t type);
int mac_check_vnode_deleteextattr(struct ucred *cred, struct vnode *vp,
int attrnamespace, const char *name);
int mac_check_vnode_exec(struct ucred *cred, struct vnode *vp,
struct image_params *imgp);
int mac_check_vnode_getacl(struct ucred *cred, struct vnode *vp,
@ -287,6 +289,8 @@ int mac_check_vnode_getextattr(struct ucred *cred, struct vnode *vp,
int attrnamespace, const char *name, struct uio *uio);
int mac_check_vnode_link(struct ucred *cred, struct vnode *dvp,
struct vnode *vp, struct componentname *cnp);
int mac_check_vnode_listextattr(struct ucred *cred, struct vnode *vp,
int attrnamespace);
int mac_check_vnode_lookup(struct ucred *cred, struct vnode *dvp,
struct componentname *cnp);
int mac_check_vnode_mmap(struct ucred *cred, struct vnode *vp,

32
sys/security/mac/mac_internal.h
View File

@ -1613,6 +1613,22 @@ mac_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp,
return (error);
}
int
mac_check_vnode_deleteextattr(struct ucred *cred, struct vnode *vp,
int attrnamespace, const char *name)
{
int error;
ASSERT_VOP_LOCKED(vp, "mac_check_vnode_deleteextattr");
if (!mac_enforce_fs)
return (0);
MAC_CHECK(check_vnode_deleteextattr, cred, vp, &vp->v_label,
attrnamespace, name);
return (error);
}
int
mac_check_vnode_exec(struct ucred *cred, struct vnode *vp,
struct image_params *imgp)
@ -1677,6 +1693,22 @@ mac_check_vnode_link(struct ucred *cred, struct vnode *dvp,
return (error);
}
int
mac_check_vnode_listextattr(struct ucred *cred, struct vnode *vp,
int attrnamespace)
{
int error;
ASSERT_VOP_LOCKED(vp, "mac_check_vnode_listextattr");
if (!mac_enforce_fs)
return (0);
MAC_CHECK(check_vnode_listextattr, cred, vp, &vp->v_label,
attrnamespace);
return (error);
}
int
mac_check_vnode_lookup(struct ucred *cred, struct vnode *dvp,
struct componentname *cnp)

32
sys/security/mac/mac_net.c
View File

@ -1613,6 +1613,22 @@ mac_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp,
return (error);
}
int
mac_check_vnode_deleteextattr(struct ucred *cred, struct vnode *vp,
int attrnamespace, const char *name)
{
int error;
ASSERT_VOP_LOCKED(vp, "mac_check_vnode_deleteextattr");
if (!mac_enforce_fs)
return (0);
MAC_CHECK(check_vnode_deleteextattr, cred, vp, &vp->v_label,
attrnamespace, name);
return (error);
}
int
mac_check_vnode_exec(struct ucred *cred, struct vnode *vp,
struct image_params *imgp)
@ -1677,6 +1693,22 @@ mac_check_vnode_link(struct ucred *cred, struct vnode *dvp,
return (error);
}
int
mac_check_vnode_listextattr(struct ucred *cred, struct vnode *vp,
int attrnamespace)
{
int error;
ASSERT_VOP_LOCKED(vp, "mac_check_vnode_listextattr");
if (!mac_enforce_fs)
return (0);
MAC_CHECK(check_vnode_listextattr, cred, vp, &vp->v_label,
attrnamespace);
return (error);
}
int
mac_check_vnode_lookup(struct ucred *cred, struct vnode *dvp,
struct componentname *cnp)

32
sys/security/mac/mac_pipe.c
View File

@ -1613,6 +1613,22 @@ mac_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp,
return (error);
}
int
mac_check_vnode_deleteextattr(struct ucred *cred, struct vnode *vp,
int attrnamespace, const char *name)
{
int error;
ASSERT_VOP_LOCKED(vp, "mac_check_vnode_deleteextattr");
if (!mac_enforce_fs)
return (0);
MAC_CHECK(check_vnode_deleteextattr, cred, vp, &vp->v_label,
attrnamespace, name);
return (error);
}
int
mac_check_vnode_exec(struct ucred *cred, struct vnode *vp,
struct image_params *imgp)
@ -1677,6 +1693,22 @@ mac_check_vnode_link(struct ucred *cred, struct vnode *dvp,
return (error);
}
int
mac_check_vnode_listextattr(struct ucred *cred, struct vnode *vp,
int attrnamespace)
{
int error;
ASSERT_VOP_LOCKED(vp, "mac_check_vnode_listextattr");
if (!mac_enforce_fs)
return (0);
MAC_CHECK(check_vnode_listextattr, cred, vp, &vp->v_label,
attrnamespace);
return (error);
}
int
mac_check_vnode_lookup(struct ucred *cred, struct vnode *dvp,
struct componentname *cnp)

5
sys/security/mac/mac_policy.h
View File

@ -359,6 +359,9 @@ struct mac_policy_ops {
struct componentname *cnp);
int (*mpo_check_vnode_deleteacl)(struct ucred *cred,
struct vnode *vp, struct label *label, acl_type_t type);
int (*mpo_check_vnode_deleteextattr)(struct ucred *cred,
struct vnode *vp, struct label *label, int attrnamespace,
const char *name);
int (*mpo_check_vnode_exec)(struct ucred *cred, struct vnode *vp,
struct label *label, struct image_params *imgp,
struct label *execlabel);
@ -370,6 +373,8 @@ struct mac_policy_ops {
int (*mpo_check_vnode_link)(struct ucred *cred, struct vnode *dvp,
struct label *dlabel, struct vnode *vp,
struct label *label, struct componentname *cnp);
int (*mpo_check_vnode_listextattr)(struct ucred *cred,
struct vnode *vp, struct label *label, int attrnamespace);
int (*mpo_check_vnode_lookup)(struct ucred *cred,
struct vnode *dvp, struct label *dlabel,
struct componentname *cnp);

32
sys/security/mac/mac_process.c
View File

@ -1613,6 +1613,22 @@ mac_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp,
return (error);
}
int
mac_check_vnode_deleteextattr(struct ucred *cred, struct vnode *vp,
int attrnamespace, const char *name)
{
int error;
ASSERT_VOP_LOCKED(vp, "mac_check_vnode_deleteextattr");
if (!mac_enforce_fs)
return (0);
MAC_CHECK(check_vnode_deleteextattr, cred, vp, &vp->v_label,
attrnamespace, name);
return (error);
}
int
mac_check_vnode_exec(struct ucred *cred, struct vnode *vp,
struct image_params *imgp)
@ -1677,6 +1693,22 @@ mac_check_vnode_link(struct ucred *cred, struct vnode *dvp,
return (error);
}
int
mac_check_vnode_listextattr(struct ucred *cred, struct vnode *vp,
int attrnamespace)
{
int error;
ASSERT_VOP_LOCKED(vp, "mac_check_vnode_listextattr");
if (!mac_enforce_fs)
return (0);
MAC_CHECK(check_vnode_listextattr, cred, vp, &vp->v_label,
attrnamespace);
return (error);
}
int
mac_check_vnode_lookup(struct ucred *cred, struct vnode *dvp,
struct componentname *cnp)

32
sys/security/mac/mac_syscalls.c
View File

@ -1613,6 +1613,22 @@ mac_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp,
return (error);
}
int
mac_check_vnode_deleteextattr(struct ucred *cred, struct vnode *vp,
int attrnamespace, const char *name)
{
int error;
ASSERT_VOP_LOCKED(vp, "mac_check_vnode_deleteextattr");
if (!mac_enforce_fs)
return (0);
MAC_CHECK(check_vnode_deleteextattr, cred, vp, &vp->v_label,
attrnamespace, name);
return (error);
}
int
mac_check_vnode_exec(struct ucred *cred, struct vnode *vp,
struct image_params *imgp)
@ -1677,6 +1693,22 @@ mac_check_vnode_link(struct ucred *cred, struct vnode *dvp,
return (error);
}
int
mac_check_vnode_listextattr(struct ucred *cred, struct vnode *vp,
int attrnamespace)
{
int error;
ASSERT_VOP_LOCKED(vp, "mac_check_vnode_listextattr");
if (!mac_enforce_fs)
return (0);
MAC_CHECK(check_vnode_listextattr, cred, vp, &vp->v_label,
attrnamespace);
return (error);
}
int
mac_check_vnode_lookup(struct ucred *cred, struct vnode *dvp,
struct componentname *cnp)

32
sys/security/mac/mac_system.c
View File

@ -1613,6 +1613,22 @@ mac_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp,
return (error);
}
int
mac_check_vnode_deleteextattr(struct ucred *cred, struct vnode *vp,
int attrnamespace, const char *name)
{
int error;
ASSERT_VOP_LOCKED(vp, "mac_check_vnode_deleteextattr");
if (!mac_enforce_fs)
return (0);
MAC_CHECK(check_vnode_deleteextattr, cred, vp, &vp->v_label,
attrnamespace, name);
return (error);
}
int
mac_check_vnode_exec(struct ucred *cred, struct vnode *vp,
struct image_params *imgp)
@ -1677,6 +1693,22 @@ mac_check_vnode_link(struct ucred *cred, struct vnode *dvp,
return (error);
}
int
mac_check_vnode_listextattr(struct ucred *cred, struct vnode *vp,
int attrnamespace)
{
int error;
ASSERT_VOP_LOCKED(vp, "mac_check_vnode_listextattr");
if (!mac_enforce_fs)
return (0);
MAC_CHECK(check_vnode_listextattr, cred, vp, &vp->v_label,
attrnamespace);
return (error);
}
int
mac_check_vnode_lookup(struct ucred *cred, struct vnode *dvp,
struct componentname *cnp)

32
sys/security/mac/mac_vfs.c
View File

@ -1613,6 +1613,22 @@ mac_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp,
return (error);
}
int
mac_check_vnode_deleteextattr(struct ucred *cred, struct vnode *vp,
int attrnamespace, const char *name)
{
int error;
ASSERT_VOP_LOCKED(vp, "mac_check_vnode_deleteextattr");
if (!mac_enforce_fs)
return (0);
MAC_CHECK(check_vnode_deleteextattr, cred, vp, &vp->v_label,
attrnamespace, name);
return (error);
}
int
mac_check_vnode_exec(struct ucred *cred, struct vnode *vp,
struct image_params *imgp)
@ -1677,6 +1693,22 @@ mac_check_vnode_link(struct ucred *cred, struct vnode *dvp,
return (error);
}
int
mac_check_vnode_listextattr(struct ucred *cred, struct vnode *vp,
int attrnamespace)
{
int error;
ASSERT_VOP_LOCKED(vp, "mac_check_vnode_listextattr");
if (!mac_enforce_fs)
return (0);
MAC_CHECK(check_vnode_listextattr, cred, vp, &vp->v_label,
attrnamespace);
return (error);
}
int
mac_check_vnode_lookup(struct ucred *cred, struct vnode *dvp,
struct componentname *cnp)

4
sys/sys/mac.h
View File

@ -279,6 +279,8 @@ int mac_check_vnode_delete(struct ucred *cred, struct vnode *dvp,
struct vnode *vp, struct componentname *cnp);
int mac_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp,
acl_type_t type);
int mac_check_vnode_deleteextattr(struct ucred *cred, struct vnode *vp,
int attrnamespace, const char *name);
int mac_check_vnode_exec(struct ucred *cred, struct vnode *vp,
struct image_params *imgp);
int mac_check_vnode_getacl(struct ucred *cred, struct vnode *vp,
@ -287,6 +289,8 @@ int mac_check_vnode_getextattr(struct ucred *cred, struct vnode *vp,
int attrnamespace, const char *name, struct uio *uio);
int mac_check_vnode_link(struct ucred *cred, struct vnode *dvp,
struct vnode *vp, struct componentname *cnp);
int mac_check_vnode_listextattr(struct ucred *cred, struct vnode *vp,
int attrnamespace);
int mac_check_vnode_lookup(struct ucred *cred, struct vnode *dvp,
struct componentname *cnp);
int mac_check_vnode_mmap(struct ucred *cred, struct vnode *vp,

5
sys/sys/mac_policy.h
View File

@ -359,6 +359,9 @@ struct mac_policy_ops {
struct componentname *cnp);
int (*mpo_check_vnode_deleteacl)(struct ucred *cred,
struct vnode *vp, struct label *label, acl_type_t type);
int (*mpo_check_vnode_deleteextattr)(struct ucred *cred,
struct vnode *vp, struct label *label, int attrnamespace,
const char *name);
int (*mpo_check_vnode_exec)(struct ucred *cred, struct vnode *vp,
struct label *label, struct image_params *imgp,
struct label *execlabel);
@ -370,6 +373,8 @@ struct mac_policy_ops {
int (*mpo_check_vnode_link)(struct ucred *cred, struct vnode *dvp,
struct label *dlabel, struct vnode *vp,
struct label *label, struct componentname *cnp);
int (*mpo_check_vnode_listextattr)(struct ucred *cred,
struct vnode *vp, struct label *label, int attrnamespace);
int (*mpo_check_vnode_lookup)(struct ucred *cred,
struct vnode *dvp, struct label *dlabel,
struct componentname *cnp);