mac_process.c (104524) | mac_process.c (104527) |
---|---|
1/*- 2 * Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson 3 * Copyright (c) 2001 Ilmar S. Habibulin 4 * Copyright (c) 2001, 2002 Networks Associates Technology, Inc. 5 * All rights reserved. 6 * 7 * This software was developed by Robert Watson and Ilmar Habibulin for the 8 * TrustedBSD Project. --- 22 unchanged lines hidden (view full) --- 31 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 32 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 33 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 34 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 35 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 36 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 37 * SUCH DAMAGE. 38 * | 1/*- 2 * Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson 3 * Copyright (c) 2001 Ilmar S. Habibulin 4 * Copyright (c) 2001, 2002 Networks Associates Technology, Inc. 5 * All rights reserved. 6 * 7 * This software was developed by Robert Watson and Ilmar Habibulin for the 8 * TrustedBSD Project. --- 22 unchanged lines hidden (view full) --- 31 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 32 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 33 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 34 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 35 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 36 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 37 * SUCH DAMAGE. 38 * |
39 * $FreeBSD: head/sys/security/mac/mac_process.c 104524 2002-10-05 17:18:43Z rwatson $ | 39 * $FreeBSD: head/sys/security/mac/mac_process.c 104527 2002-10-05 17:38:45Z rwatson $ |
40 */ 41/* 42 * Developed by the TrustedBSD Project. 43 * 44 * Framework for extensible kernel access control. Kernel and userland 45 * interface to the framework, policy registration and composition. 46 */ 47 --- 990 unchanged lines hidden (view full) --- 1038static void 1039mac_init_structmac(struct mac *mac) 1040{ 1041 1042 bzero(mac, sizeof(*mac)); 1043 mac->m_macflags = MAC_FLAG_INITIALIZED; 1044} 1045 | 40 */ 41/* 42 * Developed by the TrustedBSD Project. 43 * 44 * Framework for extensible kernel access control. Kernel and userland 45 * interface to the framework, policy registration and composition. 46 */ 47 --- 990 unchanged lines hidden (view full) --- 1038static void 1039mac_init_structmac(struct mac *mac) 1040{ 1041 1042 bzero(mac, sizeof(*mac)); 1043 mac->m_macflags = MAC_FLAG_INITIALIZED; 1044} 1045 |
1046int 1047mac_init_mbuf(struct mbuf *m, int flag) 1048{ 1049 KASSERT(m->m_flags & M_PKTHDR, ("mac_init_mbuf on non-header mbuf")); 1050 1051 mac_init_label(&m->m_pkthdr.label); 1052 1053 MAC_PERFORM(init_mbuf_label, &m->m_pkthdr.label, flag); 1054#ifdef MAC_DEBUG 1055 atomic_add_int(&nmacmbufs, 1); 1056#endif 1057 return (0); 1058} 1059 | |
1060void | 1046void |
1061mac_destroy_mbuf(struct mbuf *m) | 1047mac_init_bpfdesc(struct bpf_d *bpf_d) |
1062{ 1063 | 1048{ 1049 |
1064 MAC_PERFORM(destroy_mbuf_label, &m->m_pkthdr.label); 1065 mac_destroy_label(&m->m_pkthdr.label); | 1050 mac_init_label(&bpf_d->bd_label); 1051 MAC_PERFORM(init_bpfdesc_label, &bpf_d->bd_label); |
1066#ifdef MAC_DEBUG | 1052#ifdef MAC_DEBUG |
1067 atomic_subtract_int(&nmacmbufs, 1); | 1053 atomic_add_int(&nmacbpfdescs, 1); |
1068#endif 1069} 1070 1071void 1072mac_init_cred(struct ucred *cr) 1073{ 1074 1075 mac_init_label(&cr->cr_label); 1076 MAC_PERFORM(init_cred_label, &cr->cr_label); 1077#ifdef MAC_DEBUG 1078 atomic_add_int(&nmaccreds, 1); 1079#endif 1080} 1081 1082void | 1054#endif 1055} 1056 1057void 1058mac_init_cred(struct ucred *cr) 1059{ 1060 1061 mac_init_label(&cr->cr_label); 1062 MAC_PERFORM(init_cred_label, &cr->cr_label); 1063#ifdef MAC_DEBUG 1064 atomic_add_int(&nmaccreds, 1); 1065#endif 1066} 1067 1068void |
1083mac_destroy_cred(struct ucred *cr) | 1069mac_init_devfsdirent(struct devfs_dirent *de) |
1084{ 1085 | 1070{ 1071 |
1086 MAC_PERFORM(destroy_cred_label, &cr->cr_label); 1087 mac_destroy_label(&cr->cr_label); | 1072 mac_init_label(&de->de_label); 1073 MAC_PERFORM(init_devfsdirent_label, &de->de_label); |
1088#ifdef MAC_DEBUG | 1074#ifdef MAC_DEBUG |
1089 atomic_subtract_int(&nmaccreds, 1); | 1075 atomic_add_int(&nmacdevfsdirents, 1); |
1090#endif 1091} 1092 1093void 1094mac_init_ifnet(struct ifnet *ifp) 1095{ 1096 1097 mac_init_label(&ifp->if_label); 1098 MAC_PERFORM(init_ifnet_label, &ifp->if_label); 1099#ifdef MAC_DEBUG 1100 atomic_add_int(&nmacifnets, 1); 1101#endif 1102} 1103 1104void | 1076#endif 1077} 1078 1079void 1080mac_init_ifnet(struct ifnet *ifp) 1081{ 1082 1083 mac_init_label(&ifp->if_label); 1084 MAC_PERFORM(init_ifnet_label, &ifp->if_label); 1085#ifdef MAC_DEBUG 1086 atomic_add_int(&nmacifnets, 1); 1087#endif 1088} 1089 1090void |
1105mac_destroy_ifnet(struct ifnet *ifp) | 1091mac_init_ipq(struct ipq *ipq) |
1106{ 1107 | 1092{ 1093 |
1108 MAC_PERFORM(destroy_ifnet_label, &ifp->if_label); 1109 mac_destroy_label(&ifp->if_label); | 1094 mac_init_label(&ipq->ipq_label); 1095 MAC_PERFORM(init_ipq_label, &ipq->ipq_label); |
1110#ifdef MAC_DEBUG | 1096#ifdef MAC_DEBUG |
1111 atomic_subtract_int(&nmacifnets, 1); | 1097 atomic_add_int(&nmacipqs, 1); |
1112#endif 1113} 1114 | 1098#endif 1099} 1100 |
1101int 1102mac_init_mbuf(struct mbuf *m, int flag) 1103{ 1104 KASSERT(m->m_flags & M_PKTHDR, ("mac_init_mbuf on non-header mbuf")); 1105 1106 mac_init_label(&m->m_pkthdr.label); 1107 1108 MAC_PERFORM(init_mbuf_label, &m->m_pkthdr.label, flag); 1109#ifdef MAC_DEBUG 1110 atomic_add_int(&nmacmbufs, 1); 1111#endif 1112 return (0); 1113} 1114 |
|
1115void | 1115void |
1116mac_init_ipq(struct ipq *ipq) | 1116mac_init_mount(struct mount *mp) |
1117{ 1118 | 1117{ 1118 |
1119 mac_init_label(&ipq->ipq_label); 1120 MAC_PERFORM(init_ipq_label, &ipq->ipq_label); | 1119 mac_init_label(&mp->mnt_mntlabel); 1120 mac_init_label(&mp->mnt_fslabel); 1121 MAC_PERFORM(init_mount_label, &mp->mnt_mntlabel); 1122 MAC_PERFORM(init_mount_fs_label, &mp->mnt_fslabel); |
1121#ifdef MAC_DEBUG | 1123#ifdef MAC_DEBUG |
1122 atomic_add_int(&nmacipqs, 1); | 1124 atomic_add_int(&nmacmounts, 1); |
1123#endif 1124} 1125 1126void | 1125#endif 1126} 1127 1128void |
1127mac_destroy_ipq(struct ipq *ipq) | 1129mac_init_pipe(struct pipe *pipe) |
1128{ | 1130{ |
1131 struct label *label; |
|
1129 | 1132 |
1130 MAC_PERFORM(destroy_ipq_label, &ipq->ipq_label); 1131 mac_destroy_label(&ipq->ipq_label); | 1133 label = malloc(sizeof(struct label), M_MACPIPELABEL, M_ZERO|M_WAITOK); 1134 mac_init_label(label); 1135 pipe->pipe_label = label; 1136 pipe->pipe_peer->pipe_label = label; 1137 MAC_PERFORM(init_pipe_label, pipe->pipe_label); |
1132#ifdef MAC_DEBUG | 1138#ifdef MAC_DEBUG |
1133 atomic_subtract_int(&nmacipqs, 1); | 1139 atomic_add_int(&nmacpipes, 1); |
1134#endif 1135} 1136 1137void 1138mac_init_socket(struct socket *socket) 1139{ 1140 1141 mac_init_label(&socket->so_label); 1142 mac_init_label(&socket->so_peerlabel); 1143 MAC_PERFORM(init_socket_label, &socket->so_label); 1144 MAC_PERFORM(init_socket_peer_label, &socket->so_peerlabel); 1145#ifdef MAC_DEBUG 1146 atomic_add_int(&nmacsockets, 1); 1147#endif 1148} 1149 | 1140#endif 1141} 1142 1143void 1144mac_init_socket(struct socket *socket) 1145{ 1146 1147 mac_init_label(&socket->so_label); 1148 mac_init_label(&socket->so_peerlabel); 1149 MAC_PERFORM(init_socket_label, &socket->so_label); 1150 MAC_PERFORM(init_socket_peer_label, &socket->so_peerlabel); 1151#ifdef MAC_DEBUG 1152 atomic_add_int(&nmacsockets, 1); 1153#endif 1154} 1155 |
1150void 1151mac_destroy_socket(struct socket *socket) | 1156static void 1157mac_init_temp(struct label *label) |
1152{ 1153 | 1158{ 1159 |
1154 MAC_PERFORM(destroy_socket_label, &socket->so_label); 1155 MAC_PERFORM(destroy_socket_peer_label, &socket->so_peerlabel); 1156 mac_destroy_label(&socket->so_label); 1157 mac_destroy_label(&socket->so_peerlabel); | 1160 mac_init_label(label); 1161 MAC_PERFORM(init_temp_label, label); |
1158#ifdef MAC_DEBUG | 1162#ifdef MAC_DEBUG |
1159 atomic_subtract_int(&nmacsockets, 1); | 1163 atomic_add_int(&nmactemp, 1); |
1160#endif 1161} 1162 1163void | 1164#endif 1165} 1166 1167void |
1164mac_init_pipe(struct pipe *pipe) | 1168mac_init_vnode(struct vnode *vp) |
1165{ | 1169{ |
1166 struct label *label; | |
1167 | 1170 |
1168 label = malloc(sizeof(struct label), M_MACPIPELABEL, M_ZERO|M_WAITOK); 1169 mac_init_label(label); 1170 pipe->pipe_label = label; 1171 pipe->pipe_peer->pipe_label = label; 1172 MAC_PERFORM(init_pipe_label, pipe->pipe_label); | 1171 mac_init_label(&vp->v_label); 1172 MAC_PERFORM(init_vnode_label, &vp->v_label); |
1173#ifdef MAC_DEBUG | 1173#ifdef MAC_DEBUG |
1174 atomic_add_int(&nmacpipes, 1); | 1174 atomic_add_int(&nmacvnodes, 1); |
1175#endif 1176} 1177 1178void | 1175#endif 1176} 1177 1178void |
1179mac_destroy_pipe(struct pipe *pipe) | 1179mac_destroy_bpfdesc(struct bpf_d *bpf_d) |
1180{ 1181 | 1180{ 1181 |
1182 MAC_PERFORM(destroy_pipe_label, pipe->pipe_label); 1183 mac_destroy_label(pipe->pipe_label); 1184 free(pipe->pipe_label, M_MACPIPELABEL); | 1182 MAC_PERFORM(destroy_bpfdesc_label, &bpf_d->bd_label); 1183 mac_destroy_label(&bpf_d->bd_label); |
1185#ifdef MAC_DEBUG | 1184#ifdef MAC_DEBUG |
1186 atomic_subtract_int(&nmacpipes, 1); | 1185 atomic_subtract_int(&nmacbpfdescs, 1); |
1187#endif 1188} 1189 1190void | 1186#endif 1187} 1188 1189void |
1191mac_init_bpfdesc(struct bpf_d *bpf_d) | 1190mac_destroy_cred(struct ucred *cr) |
1192{ 1193 | 1191{ 1192 |
1194 mac_init_label(&bpf_d->bd_label); 1195 MAC_PERFORM(init_bpfdesc_label, &bpf_d->bd_label); | 1193 MAC_PERFORM(destroy_cred_label, &cr->cr_label); 1194 mac_destroy_label(&cr->cr_label); |
1196#ifdef MAC_DEBUG | 1195#ifdef MAC_DEBUG |
1197 atomic_add_int(&nmacbpfdescs, 1); | 1196 atomic_subtract_int(&nmaccreds, 1); |
1198#endif 1199} 1200 1201void | 1197#endif 1198} 1199 1200void |
1202mac_destroy_bpfdesc(struct bpf_d *bpf_d) | 1201mac_destroy_devfsdirent(struct devfs_dirent *de) |
1203{ 1204 | 1202{ 1203 |
1205 MAC_PERFORM(destroy_bpfdesc_label, &bpf_d->bd_label); 1206 mac_destroy_label(&bpf_d->bd_label); | 1204 MAC_PERFORM(destroy_devfsdirent_label, &de->de_label); 1205 mac_destroy_label(&de->de_label); |
1207#ifdef MAC_DEBUG | 1206#ifdef MAC_DEBUG |
1208 atomic_subtract_int(&nmacbpfdescs, 1); | 1207 atomic_subtract_int(&nmacdevfsdirents, 1); |
1209#endif 1210} 1211 1212void | 1208#endif 1209} 1210 1211void |
1213mac_init_mount(struct mount *mp) | 1212mac_destroy_ifnet(struct ifnet *ifp) |
1214{ 1215 | 1213{ 1214 |
1216 mac_init_label(&mp->mnt_mntlabel); 1217 mac_init_label(&mp->mnt_fslabel); 1218 MAC_PERFORM(init_mount_label, &mp->mnt_mntlabel); 1219 MAC_PERFORM(init_mount_fs_label, &mp->mnt_fslabel); | 1215 MAC_PERFORM(destroy_ifnet_label, &ifp->if_label); 1216 mac_destroy_label(&ifp->if_label); |
1220#ifdef MAC_DEBUG | 1217#ifdef MAC_DEBUG |
1221 atomic_add_int(&nmacmounts, 1); | 1218 atomic_subtract_int(&nmacifnets, 1); |
1222#endif 1223} 1224 1225void | 1219#endif 1220} 1221 1222void |
1226mac_destroy_mount(struct mount *mp) | 1223mac_destroy_ipq(struct ipq *ipq) |
1227{ 1228 | 1224{ 1225 |
1229 MAC_PERFORM(destroy_mount_label, &mp->mnt_mntlabel); 1230 MAC_PERFORM(destroy_mount_fs_label, &mp->mnt_fslabel); 1231 mac_destroy_label(&mp->mnt_fslabel); 1232 mac_destroy_label(&mp->mnt_mntlabel); | 1226 MAC_PERFORM(destroy_ipq_label, &ipq->ipq_label); 1227 mac_destroy_label(&ipq->ipq_label); |
1233#ifdef MAC_DEBUG | 1228#ifdef MAC_DEBUG |
1234 atomic_subtract_int(&nmacmounts, 1); | 1229 atomic_subtract_int(&nmacipqs, 1); |
1235#endif 1236} 1237 | 1230#endif 1231} 1232 |
1238static void 1239mac_init_temp(struct label *label) | 1233void 1234mac_destroy_mbuf(struct mbuf *m) |
1240{ 1241 | 1235{ 1236 |
1242 mac_init_label(label); 1243 MAC_PERFORM(init_temp_label, label); | 1237 MAC_PERFORM(destroy_mbuf_label, &m->m_pkthdr.label); 1238 mac_destroy_label(&m->m_pkthdr.label); |
1244#ifdef MAC_DEBUG | 1239#ifdef MAC_DEBUG |
1245 atomic_add_int(&nmactemp, 1); | 1240 atomic_subtract_int(&nmacmbufs, 1); |
1246#endif 1247} 1248 | 1241#endif 1242} 1243 |
1249static void 1250mac_destroy_temp(struct label *label) | 1244void 1245mac_destroy_mount(struct mount *mp) |
1251{ 1252 | 1246{ 1247 |
1253 MAC_PERFORM(destroy_temp_label, label); 1254 mac_destroy_label(label); | 1248 MAC_PERFORM(destroy_mount_label, &mp->mnt_mntlabel); 1249 MAC_PERFORM(destroy_mount_fs_label, &mp->mnt_fslabel); 1250 mac_destroy_label(&mp->mnt_fslabel); 1251 mac_destroy_label(&mp->mnt_mntlabel); |
1255#ifdef MAC_DEBUG | 1252#ifdef MAC_DEBUG |
1256 atomic_subtract_int(&nmactemp, 1); | 1253 atomic_subtract_int(&nmacmounts, 1); |
1257#endif 1258} 1259 1260void | 1254#endif 1255} 1256 1257void |
1261mac_init_vnode(struct vnode *vp) | 1258mac_destroy_pipe(struct pipe *pipe) |
1262{ 1263 | 1259{ 1260 |
1264 mac_init_label(&vp->v_label); 1265 MAC_PERFORM(init_vnode_label, &vp->v_label); | 1261 MAC_PERFORM(destroy_pipe_label, pipe->pipe_label); 1262 mac_destroy_label(pipe->pipe_label); 1263 free(pipe->pipe_label, M_MACPIPELABEL); |
1266#ifdef MAC_DEBUG | 1264#ifdef MAC_DEBUG |
1267 atomic_add_int(&nmacvnodes, 1); | 1265 atomic_subtract_int(&nmacpipes, 1); |
1268#endif 1269} 1270 1271void | 1266#endif 1267} 1268 1269void |
1272mac_destroy_vnode(struct vnode *vp) | 1270mac_destroy_socket(struct socket *socket) |
1273{ 1274 | 1271{ 1272 |
1275 MAC_PERFORM(destroy_vnode_label, &vp->v_label); 1276 mac_destroy_label(&vp->v_label); | 1273 MAC_PERFORM(destroy_socket_label, &socket->so_label); 1274 MAC_PERFORM(destroy_socket_peer_label, &socket->so_peerlabel); 1275 mac_destroy_label(&socket->so_label); 1276 mac_destroy_label(&socket->so_peerlabel); |
1277#ifdef MAC_DEBUG | 1277#ifdef MAC_DEBUG |
1278 atomic_subtract_int(&nmacvnodes, 1); | 1278 atomic_subtract_int(&nmacsockets, 1); |
1279#endif 1280} 1281 | 1279#endif 1280} 1281 |
1282void 1283mac_init_devfsdirent(struct devfs_dirent *de) | 1282static void 1283mac_destroy_temp(struct label *label) |
1284{ 1285 | 1284{ 1285 |
1286 mac_init_label(&de->de_label); 1287 MAC_PERFORM(init_devfsdirent_label, &de->de_label); | 1286 MAC_PERFORM(destroy_temp_label, label); 1287 mac_destroy_label(label); |
1288#ifdef MAC_DEBUG | 1288#ifdef MAC_DEBUG |
1289 atomic_add_int(&nmacdevfsdirents, 1); | 1289 atomic_subtract_int(&nmactemp, 1); |
1290#endif 1291} 1292 1293void | 1290#endif 1291} 1292 1293void |
1294mac_destroy_devfsdirent(struct devfs_dirent *de) | 1294mac_destroy_vnode(struct vnode *vp) |
1295{ 1296 | 1295{ 1296 |
1297 MAC_PERFORM(destroy_devfsdirent_label, &de->de_label); 1298 mac_destroy_label(&de->de_label); | 1297 MAC_PERFORM(destroy_vnode_label, &vp->v_label); 1298 mac_destroy_label(&vp->v_label); |
1299#ifdef MAC_DEBUG | 1299#ifdef MAC_DEBUG |
1300 atomic_subtract_int(&nmacdevfsdirents, 1); | 1300 atomic_subtract_int(&nmacvnodes, 1); |
1301#endif 1302} 1303 1304static int 1305mac_externalize(struct label *label, struct mac *mac) 1306{ 1307 int error; 1308 --- 2116 unchanged lines hidden --- | 1301#endif 1302} 1303 1304static int 1305mac_externalize(struct label *label, struct mac *mac) 1306{ 1307 int error; 1308 --- 2116 unchanged lines hidden --- |