Deleted Added
sdiff udiff text old ( 168951 ) new ( 168954 )
full compact
mac_biba.c (168951) mac_biba.c (168954)
1/*-
2 * Copyright (c) 1999-2002, 2007 Robert N. M. Watson
3 * Copyright (c) 2001-2005 McAfee, Inc.
4 * All rights reserved.
5 *
6 * This software was developed by Robert Watson for the TrustedBSD Project.
7 *
8 * This software was developed for the FreeBSD Project in part by McAfee

--- 17 unchanged lines hidden (view full) ---

26 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32 * SUCH DAMAGE.
33 *
1/*-
2 * Copyright (c) 1999-2002, 2007 Robert N. M. Watson
3 * Copyright (c) 2001-2005 McAfee, Inc.
4 * All rights reserved.
5 *
6 * This software was developed by Robert Watson for the TrustedBSD Project.
7 *
8 * This software was developed for the FreeBSD Project in part by McAfee

--- 17 unchanged lines hidden (view full) ---

26 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32 * SUCH DAMAGE.
33 *
34 * $FreeBSD: head/sys/security/mac_biba/mac_biba.c 168951 2007-04-22 15:31:22Z rwatson $
34 * $FreeBSD: head/sys/security/mac_biba/mac_biba.c 168954 2007-04-22 16:18:10Z rwatson $
35 */
36
37/*
38 * Developed by the TrustedBSD Project.
39 *
40 * Biba fixed label mandatory integrity policy.
41 */
42

--- 781 unchanged lines hidden (view full) ---

824 source = SLOT(cred->cr_label);
825 dest = SLOT(delabel);
826
827 mac_biba_copy_effective(source, dest);
828}
829
830static void
831mac_biba_create_mount(struct ucred *cred, struct mount *mp,
35 */
36
37/*
38 * Developed by the TrustedBSD Project.
39 *
40 * Biba fixed label mandatory integrity policy.
41 */
42

--- 781 unchanged lines hidden (view full) ---

824 source = SLOT(cred->cr_label);
825 dest = SLOT(delabel);
826
827 mac_biba_copy_effective(source, dest);
828}
829
830static void
831mac_biba_create_mount(struct ucred *cred, struct mount *mp,
832 struct label *mntlabel, struct label *fslabel)
832 struct label *mntlabel)
833{
834 struct mac_biba *source, *dest;
835
836 source = SLOT(cred->cr_label);
837 dest = SLOT(mntlabel);
838 mac_biba_copy_effective(source, dest);
833{
834 struct mac_biba *source, *dest;
835
836 source = SLOT(cred->cr_label);
837 dest = SLOT(mntlabel);
838 mac_biba_copy_effective(source, dest);
839 dest = SLOT(fslabel);
840 mac_biba_copy_effective(source, dest);
841}
842
843static void
844mac_biba_relabel_vnode(struct ucred *cred, struct vnode *vp,
845 struct label *vnodelabel, struct label *label)
846{
847 struct mac_biba *source, *dest;
848

--- 12 unchanged lines hidden (view full) ---

861
862 source = SLOT(vnodelabel);
863 dest = SLOT(direntlabel);
864
865 mac_biba_copy(source, dest);
866}
867
868static void
839}
840
841static void
842mac_biba_relabel_vnode(struct ucred *cred, struct vnode *vp,
843 struct label *vnodelabel, struct label *label)
844{
845 struct mac_biba *source, *dest;
846

--- 12 unchanged lines hidden (view full) ---

859
860 source = SLOT(vnodelabel);
861 dest = SLOT(direntlabel);
862
863 mac_biba_copy(source, dest);
864}
865
866static void
869mac_biba_associate_vnode_devfs(struct mount *mp, struct label *fslabel,
867mac_biba_associate_vnode_devfs(struct mount *mp, struct label *mntlabel,
870 struct devfs_dirent *de, struct label *delabel, struct vnode *vp,
871 struct label *vlabel)
872{
873 struct mac_biba *source, *dest;
874
875 source = SLOT(delabel);
876 dest = SLOT(vlabel);
877
878 mac_biba_copy_effective(source, dest);
879}
880
881static int
868 struct devfs_dirent *de, struct label *delabel, struct vnode *vp,
869 struct label *vlabel)
870{
871 struct mac_biba *source, *dest;
872
873 source = SLOT(delabel);
874 dest = SLOT(vlabel);
875
876 mac_biba_copy_effective(source, dest);
877}
878
879static int
882mac_biba_associate_vnode_extattr(struct mount *mp, struct label *fslabel,
880mac_biba_associate_vnode_extattr(struct mount *mp, struct label *mntlabel,
883 struct vnode *vp, struct label *vlabel)
884{
885 struct mac_biba temp, *source, *dest;
886 int buflen, error;
887
881 struct vnode *vp, struct label *vlabel)
882{
883 struct mac_biba temp, *source, *dest;
884 int buflen, error;
885
888 source = SLOT(fslabel);
886 source = SLOT(mntlabel);
889 dest = SLOT(vlabel);
890
891 buflen = sizeof(temp);
892 bzero(&temp, buflen);
893
894 error = vn_extattr_get(vp, IO_NODELOCKED, MAC_BIBA_EXTATTR_NAMESPACE,
895 MAC_BIBA_EXTATTR_NAME, &buflen, (char *) &temp, curthread);
896 if (error == ENOATTR || error == EOPNOTSUPP) {
887 dest = SLOT(vlabel);
888
889 buflen = sizeof(temp);
890 bzero(&temp, buflen);
891
892 error = vn_extattr_get(vp, IO_NODELOCKED, MAC_BIBA_EXTATTR_NAMESPACE,
893 MAC_BIBA_EXTATTR_NAME, &buflen, (char *) &temp, curthread);
894 if (error == ENOATTR || error == EOPNOTSUPP) {
897 /* Fall back to the fslabel. */
895 /* Fall back to the mntlabel. */
898 mac_biba_copy_effective(source, dest);
899 return (0);
900 } else if (error)
901 return (error);
902
903 if (buflen != sizeof(temp)) {
904 printf("mac_biba_associate_vnode_extattr: bad size %d\n",
905 buflen);

--- 9 unchanged lines hidden (view full) ---

915 }
916
917 mac_biba_copy_effective(&temp, dest);
918 return (0);
919}
920
921static void
922mac_biba_associate_vnode_singlelabel(struct mount *mp,
896 mac_biba_copy_effective(source, dest);
897 return (0);
898 } else if (error)
899 return (error);
900
901 if (buflen != sizeof(temp)) {
902 printf("mac_biba_associate_vnode_extattr: bad size %d\n",
903 buflen);

--- 9 unchanged lines hidden (view full) ---

913 }
914
915 mac_biba_copy_effective(&temp, dest);
916 return (0);
917}
918
919static void
920mac_biba_associate_vnode_singlelabel(struct mount *mp,
923 struct label *fslabel, struct vnode *vp, struct label *vlabel)
921 struct label *mntlabel, struct vnode *vp, struct label *vlabel)
924{
925 struct mac_biba *source, *dest;
926
922{
923 struct mac_biba *source, *dest;
924
927 source = SLOT(fslabel);
925 source = SLOT(mntlabel);
928 dest = SLOT(vlabel);
929
930 mac_biba_copy_effective(source, dest);
931}
932
933static int
934mac_biba_create_vnode_extattr(struct ucred *cred, struct mount *mp,
926 dest = SLOT(vlabel);
927
928 mac_biba_copy_effective(source, dest);
929}
930
931static int
932mac_biba_create_vnode_extattr(struct ucred *cred, struct mount *mp,
935 struct label *fslabel, struct vnode *dvp, struct label *dlabel,
933 struct label *mntlabel, struct vnode *dvp, struct label *dlabel,
936 struct vnode *vp, struct label *vlabel, struct componentname *cnp)
937{
938 struct mac_biba *source, *dest, temp;
939 size_t buflen;
940 int error;
941
942 buflen = sizeof(temp);
943 bzero(&temp, buflen);

--- 2309 unchanged lines hidden (view full) ---

3253 .mpo_init_syncache_label = mac_biba_init_label_waitcheck,
3254 .mpo_init_sysv_msgmsg_label = mac_biba_init_label,
3255 .mpo_init_sysv_msgqueue_label = mac_biba_init_label,
3256 .mpo_init_sysv_sem_label = mac_biba_init_label,
3257 .mpo_init_sysv_shm_label = mac_biba_init_label,
3258 .mpo_init_ipq_label = mac_biba_init_label_waitcheck,
3259 .mpo_init_mbuf_label = mac_biba_init_label_waitcheck,
3260 .mpo_init_mount_label = mac_biba_init_label,
934 struct vnode *vp, struct label *vlabel, struct componentname *cnp)
935{
936 struct mac_biba *source, *dest, temp;
937 size_t buflen;
938 int error;
939
940 buflen = sizeof(temp);
941 bzero(&temp, buflen);

--- 2309 unchanged lines hidden (view full) ---

3251 .mpo_init_syncache_label = mac_biba_init_label_waitcheck,
3252 .mpo_init_sysv_msgmsg_label = mac_biba_init_label,
3253 .mpo_init_sysv_msgqueue_label = mac_biba_init_label,
3254 .mpo_init_sysv_sem_label = mac_biba_init_label,
3255 .mpo_init_sysv_shm_label = mac_biba_init_label,
3256 .mpo_init_ipq_label = mac_biba_init_label_waitcheck,
3257 .mpo_init_mbuf_label = mac_biba_init_label_waitcheck,
3258 .mpo_init_mount_label = mac_biba_init_label,
3261 .mpo_init_mount_fs_label = mac_biba_init_label,
3262 .mpo_init_pipe_label = mac_biba_init_label,
3263 .mpo_init_posix_sem_label = mac_biba_init_label,
3264 .mpo_init_socket_label = mac_biba_init_label_waitcheck,
3265 .mpo_init_socket_peer_label = mac_biba_init_label_waitcheck,
3266 .mpo_init_syncache_from_inpcb = mac_biba_init_syncache_from_inpcb,
3267 .mpo_init_vnode_label = mac_biba_init_label,
3268 .mpo_destroy_bpfdesc_label = mac_biba_destroy_label,
3269 .mpo_destroy_cred_label = mac_biba_destroy_label,
3270 .mpo_destroy_devfsdirent_label = mac_biba_destroy_label,
3271 .mpo_destroy_ifnet_label = mac_biba_destroy_label,
3272 .mpo_destroy_inpcb_label = mac_biba_destroy_label,
3273 .mpo_destroy_syncache_label = mac_biba_destroy_label,
3274 .mpo_destroy_sysv_msgmsg_label = mac_biba_destroy_label,
3275 .mpo_destroy_sysv_msgqueue_label = mac_biba_destroy_label,
3276 .mpo_destroy_sysv_sem_label = mac_biba_destroy_label,
3277 .mpo_destroy_sysv_shm_label = mac_biba_destroy_label,
3278 .mpo_destroy_ipq_label = mac_biba_destroy_label,
3279 .mpo_destroy_mbuf_label = mac_biba_destroy_label,
3280 .mpo_destroy_mount_label = mac_biba_destroy_label,
3259 .mpo_init_pipe_label = mac_biba_init_label,
3260 .mpo_init_posix_sem_label = mac_biba_init_label,
3261 .mpo_init_socket_label = mac_biba_init_label_waitcheck,
3262 .mpo_init_socket_peer_label = mac_biba_init_label_waitcheck,
3263 .mpo_init_syncache_from_inpcb = mac_biba_init_syncache_from_inpcb,
3264 .mpo_init_vnode_label = mac_biba_init_label,
3265 .mpo_destroy_bpfdesc_label = mac_biba_destroy_label,
3266 .mpo_destroy_cred_label = mac_biba_destroy_label,
3267 .mpo_destroy_devfsdirent_label = mac_biba_destroy_label,
3268 .mpo_destroy_ifnet_label = mac_biba_destroy_label,
3269 .mpo_destroy_inpcb_label = mac_biba_destroy_label,
3270 .mpo_destroy_syncache_label = mac_biba_destroy_label,
3271 .mpo_destroy_sysv_msgmsg_label = mac_biba_destroy_label,
3272 .mpo_destroy_sysv_msgqueue_label = mac_biba_destroy_label,
3273 .mpo_destroy_sysv_sem_label = mac_biba_destroy_label,
3274 .mpo_destroy_sysv_shm_label = mac_biba_destroy_label,
3275 .mpo_destroy_ipq_label = mac_biba_destroy_label,
3276 .mpo_destroy_mbuf_label = mac_biba_destroy_label,
3277 .mpo_destroy_mount_label = mac_biba_destroy_label,
3281 .mpo_destroy_mount_fs_label = mac_biba_destroy_label,
3282 .mpo_destroy_pipe_label = mac_biba_destroy_label,
3283 .mpo_destroy_posix_sem_label = mac_biba_destroy_label,
3284 .mpo_destroy_socket_label = mac_biba_destroy_label,
3285 .mpo_destroy_socket_peer_label = mac_biba_destroy_label,
3286 .mpo_destroy_vnode_label = mac_biba_destroy_label,
3287 .mpo_copy_cred_label = mac_biba_copy_label,
3288 .mpo_copy_ifnet_label = mac_biba_copy_label,
3289 .mpo_copy_mbuf_label = mac_biba_copy_label,

--- 144 unchanged lines hidden --- 		3278 .mpo_destroy_pipe_label = mac_biba_destroy_label,
3279 .mpo_destroy_posix_sem_label = mac_biba_destroy_label,
3280 .mpo_destroy_socket_label = mac_biba_destroy_label,
3281 .mpo_destroy_socket_peer_label = mac_biba_destroy_label,
3282 .mpo_destroy_vnode_label = mac_biba_destroy_label,
3283 .mpo_copy_cred_label = mac_biba_copy_label,
3284 .mpo_copy_ifnet_label = mac_biba_copy_label,
3285 .mpo_copy_mbuf_label = mac_biba_copy_label,

--- 144 unchanged lines hidden ---