Deleted Added
sdiff udiff text old ( 168933 ) new ( 168954 )
full compact
mac_mls.c (168933) mac_mls.c (168954)
1/*-
2 * Copyright (c) 1999-2002 Robert N. M. Watson
3 * Copyright (c) 2001-2005 McAfee, Inc.
4 * All rights reserved.
5 *
6 * This software was developed by Robert Watson for the TrustedBSD Project.
7 *
8 * This software was developed for the FreeBSD Project in part by McAfee

--- 17 unchanged lines hidden (view full) ---

26 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32 * SUCH DAMAGE.
33 *
1/*-
2 * Copyright (c) 1999-2002 Robert N. M. Watson
3 * Copyright (c) 2001-2005 McAfee, Inc.
4 * All rights reserved.
5 *
6 * This software was developed by Robert Watson for the TrustedBSD Project.
7 *
8 * This software was developed for the FreeBSD Project in part by McAfee

--- 17 unchanged lines hidden (view full) ---

26 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32 * SUCH DAMAGE.
33 *
34 * $FreeBSD: head/sys/security/mac_mls/mac_mls.c 168933 2007-04-21 22:08:48Z rwatson $
34 * $FreeBSD: head/sys/security/mac_mls/mac_mls.c 168954 2007-04-22 16:18:10Z rwatson $
35 */
36
37/*
38 * Developed by the TrustedBSD Project.
39 * MLS fixed label mandatory confidentiality policy.
40 */
41
42#include <sys/types.h>

--- 745 unchanged lines hidden (view full) ---

788 source = SLOT(cred->cr_label);
789 dest = SLOT(delabel);
790
791 mac_mls_copy_effective(source, dest);
792}
793
794static void
795mac_mls_create_mount(struct ucred *cred, struct mount *mp,
35 */
36
37/*
38 * Developed by the TrustedBSD Project.
39 * MLS fixed label mandatory confidentiality policy.
40 */
41
42#include <sys/types.h>

--- 745 unchanged lines hidden (view full) ---

788 source = SLOT(cred->cr_label);
789 dest = SLOT(delabel);
790
791 mac_mls_copy_effective(source, dest);
792}
793
794static void
795mac_mls_create_mount(struct ucred *cred, struct mount *mp,
796 struct label *mntlabel, struct label *fslabel)
796 struct label *mntlabel)
797{
798 struct mac_mls *source, *dest;
799
800 source = SLOT(cred->cr_label);
801 dest = SLOT(mntlabel);
802 mac_mls_copy_effective(source, dest);
797{
798 struct mac_mls *source, *dest;
799
800 source = SLOT(cred->cr_label);
801 dest = SLOT(mntlabel);
802 mac_mls_copy_effective(source, dest);
803 dest = SLOT(fslabel);
804 mac_mls_copy_effective(source, dest);
805}
806
807static void
808mac_mls_relabel_vnode(struct ucred *cred, struct vnode *vp,
809 struct label *vnodelabel, struct label *label)
810{
811 struct mac_mls *source, *dest;
812

--- 12 unchanged lines hidden (view full) ---

825
826 source = SLOT(vnodelabel);
827 dest = SLOT(direntlabel);
828
829 mac_mls_copy_effective(source, dest);
830}
831
832static void
803}
804
805static void
806mac_mls_relabel_vnode(struct ucred *cred, struct vnode *vp,
807 struct label *vnodelabel, struct label *label)
808{
809 struct mac_mls *source, *dest;
810

--- 12 unchanged lines hidden (view full) ---

823
824 source = SLOT(vnodelabel);
825 dest = SLOT(direntlabel);
826
827 mac_mls_copy_effective(source, dest);
828}
829
830static void
833mac_mls_associate_vnode_devfs(struct mount *mp, struct label *fslabel,
831mac_mls_associate_vnode_devfs(struct mount *mp, struct label *mntlabel,
834 struct devfs_dirent *de, struct label *delabel, struct vnode *vp,
835 struct label *vlabel)
836{
837 struct mac_mls *source, *dest;
838
839 source = SLOT(delabel);
840 dest = SLOT(vlabel);
841
842 mac_mls_copy_effective(source, dest);
843}
844
845static int
832 struct devfs_dirent *de, struct label *delabel, struct vnode *vp,
833 struct label *vlabel)
834{
835 struct mac_mls *source, *dest;
836
837 source = SLOT(delabel);
838 dest = SLOT(vlabel);
839
840 mac_mls_copy_effective(source, dest);
841}
842
843static int
846mac_mls_associate_vnode_extattr(struct mount *mp, struct label *fslabel,
844mac_mls_associate_vnode_extattr(struct mount *mp, struct label *mntlabel,
847 struct vnode *vp, struct label *vlabel)
848{
849 struct mac_mls temp, *source, *dest;
850 int buflen, error;
851
845 struct vnode *vp, struct label *vlabel)
846{
847 struct mac_mls temp, *source, *dest;
848 int buflen, error;
849
852 source = SLOT(fslabel);
850 source = SLOT(mntlabel);
853 dest = SLOT(vlabel);
854
855 buflen = sizeof(temp);
856 bzero(&temp, buflen);
857
858 error = vn_extattr_get(vp, IO_NODELOCKED, MAC_MLS_EXTATTR_NAMESPACE,
859 MAC_MLS_EXTATTR_NAME, &buflen, (char *) &temp, curthread);
860 if (error == ENOATTR || error == EOPNOTSUPP) {
851 dest = SLOT(vlabel);
852
853 buflen = sizeof(temp);
854 bzero(&temp, buflen);
855
856 error = vn_extattr_get(vp, IO_NODELOCKED, MAC_MLS_EXTATTR_NAMESPACE,
857 MAC_MLS_EXTATTR_NAME, &buflen, (char *) &temp, curthread);
858 if (error == ENOATTR || error == EOPNOTSUPP) {
861 /* Fall back to the fslabel. */
859 /* Fall back to the mntlabel. */
862 mac_mls_copy_effective(source, dest);
863 return (0);
864 } else if (error)
865 return (error);
866
867 if (buflen != sizeof(temp)) {
868 printf("mac_mls_associate_vnode_extattr: bad size %d\n",
869 buflen);

--- 9 unchanged lines hidden (view full) ---

879 }
880
881 mac_mls_copy_effective(&temp, dest);
882 return (0);
883}
884
885static void
886mac_mls_associate_vnode_singlelabel(struct mount *mp,
860 mac_mls_copy_effective(source, dest);
861 return (0);
862 } else if (error)
863 return (error);
864
865 if (buflen != sizeof(temp)) {
866 printf("mac_mls_associate_vnode_extattr: bad size %d\n",
867 buflen);

--- 9 unchanged lines hidden (view full) ---

877 }
878
879 mac_mls_copy_effective(&temp, dest);
880 return (0);
881}
882
883static void
884mac_mls_associate_vnode_singlelabel(struct mount *mp,
887 struct label *fslabel, struct vnode *vp, struct label *vlabel)
885 struct label *mntlabel, struct vnode *vp, struct label *vlabel)
888{
889 struct mac_mls *source, *dest;
890
886{
887 struct mac_mls *source, *dest;
888
891 source = SLOT(fslabel);
889 source = SLOT(mntlabel);
892 dest = SLOT(vlabel);
893
894 mac_mls_copy_effective(source, dest);
895}
896
897static int
898mac_mls_create_vnode_extattr(struct ucred *cred, struct mount *mp,
890 dest = SLOT(vlabel);
891
892 mac_mls_copy_effective(source, dest);
893}
894
895static int
896mac_mls_create_vnode_extattr(struct ucred *cred, struct mount *mp,
899 struct label *fslabel, struct vnode *dvp, struct label *dlabel,
897 struct label *mntlabel, struct vnode *dvp, struct label *dlabel,
900 struct vnode *vp, struct label *vlabel, struct componentname *cnp)
901{
902 struct mac_mls *source, *dest, temp;
903 size_t buflen;
904 int error;
905
906 buflen = sizeof(temp);
907 bzero(&temp, buflen);

--- 1969 unchanged lines hidden (view full) ---

2877 .mpo_init_syncache_label = mac_mls_init_label_waitcheck,
2878 .mpo_init_sysv_msgmsg_label = mac_mls_init_label,
2879 .mpo_init_sysv_msgqueue_label = mac_mls_init_label,
2880 .mpo_init_sysv_sem_label = mac_mls_init_label,
2881 .mpo_init_sysv_shm_label = mac_mls_init_label,
2882 .mpo_init_ipq_label = mac_mls_init_label_waitcheck,
2883 .mpo_init_mbuf_label = mac_mls_init_label_waitcheck,
2884 .mpo_init_mount_label = mac_mls_init_label,
898 struct vnode *vp, struct label *vlabel, struct componentname *cnp)
899{
900 struct mac_mls *source, *dest, temp;
901 size_t buflen;
902 int error;
903
904 buflen = sizeof(temp);
905 bzero(&temp, buflen);

--- 1969 unchanged lines hidden (view full) ---

2875 .mpo_init_syncache_label = mac_mls_init_label_waitcheck,
2876 .mpo_init_sysv_msgmsg_label = mac_mls_init_label,
2877 .mpo_init_sysv_msgqueue_label = mac_mls_init_label,
2878 .mpo_init_sysv_sem_label = mac_mls_init_label,
2879 .mpo_init_sysv_shm_label = mac_mls_init_label,
2880 .mpo_init_ipq_label = mac_mls_init_label_waitcheck,
2881 .mpo_init_mbuf_label = mac_mls_init_label_waitcheck,
2882 .mpo_init_mount_label = mac_mls_init_label,
2885 .mpo_init_mount_fs_label = mac_mls_init_label,
2886 .mpo_init_pipe_label = mac_mls_init_label,
2887 .mpo_init_posix_sem_label = mac_mls_init_label,
2888 .mpo_init_socket_label = mac_mls_init_label_waitcheck,
2889 .mpo_init_socket_peer_label = mac_mls_init_label_waitcheck,
2890 .mpo_init_vnode_label = mac_mls_init_label,
2891 .mpo_destroy_bpfdesc_label = mac_mls_destroy_label,
2892 .mpo_destroy_cred_label = mac_mls_destroy_label,
2893 .mpo_destroy_devfsdirent_label = mac_mls_destroy_label,
2894 .mpo_destroy_ifnet_label = mac_mls_destroy_label,
2895 .mpo_destroy_inpcb_label = mac_mls_destroy_label,
2896 .mpo_destroy_syncache_label = mac_mls_destroy_label,
2897 .mpo_destroy_sysv_msgmsg_label = mac_mls_destroy_label,
2898 .mpo_destroy_sysv_msgqueue_label = mac_mls_destroy_label,
2899 .mpo_destroy_sysv_sem_label = mac_mls_destroy_label,
2900 .mpo_destroy_sysv_shm_label = mac_mls_destroy_label,
2901 .mpo_destroy_ipq_label = mac_mls_destroy_label,
2902 .mpo_destroy_mbuf_label = mac_mls_destroy_label,
2903 .mpo_destroy_mount_label = mac_mls_destroy_label,
2883 .mpo_init_pipe_label = mac_mls_init_label,
2884 .mpo_init_posix_sem_label = mac_mls_init_label,
2885 .mpo_init_socket_label = mac_mls_init_label_waitcheck,
2886 .mpo_init_socket_peer_label = mac_mls_init_label_waitcheck,
2887 .mpo_init_vnode_label = mac_mls_init_label,
2888 .mpo_destroy_bpfdesc_label = mac_mls_destroy_label,
2889 .mpo_destroy_cred_label = mac_mls_destroy_label,
2890 .mpo_destroy_devfsdirent_label = mac_mls_destroy_label,
2891 .mpo_destroy_ifnet_label = mac_mls_destroy_label,
2892 .mpo_destroy_inpcb_label = mac_mls_destroy_label,
2893 .mpo_destroy_syncache_label = mac_mls_destroy_label,
2894 .mpo_destroy_sysv_msgmsg_label = mac_mls_destroy_label,
2895 .mpo_destroy_sysv_msgqueue_label = mac_mls_destroy_label,
2896 .mpo_destroy_sysv_sem_label = mac_mls_destroy_label,
2897 .mpo_destroy_sysv_shm_label = mac_mls_destroy_label,
2898 .mpo_destroy_ipq_label = mac_mls_destroy_label,
2899 .mpo_destroy_mbuf_label = mac_mls_destroy_label,
2900 .mpo_destroy_mount_label = mac_mls_destroy_label,
2904 .mpo_destroy_mount_fs_label = mac_mls_destroy_label,
2905 .mpo_destroy_pipe_label = mac_mls_destroy_label,
2906 .mpo_destroy_posix_sem_label = mac_mls_destroy_label,
2907 .mpo_destroy_socket_label = mac_mls_destroy_label,
2908 .mpo_destroy_socket_peer_label = mac_mls_destroy_label,
2909 .mpo_destroy_vnode_label = mac_mls_destroy_label,
2910 .mpo_copy_cred_label = mac_mls_copy_label,
2911 .mpo_copy_ifnet_label = mac_mls_copy_label,
2912 .mpo_copy_mbuf_label = mac_mls_copy_label,

--- 140 unchanged lines hidden --- 		2901 .mpo_destroy_pipe_label = mac_mls_destroy_label,
2902 .mpo_destroy_posix_sem_label = mac_mls_destroy_label,
2903 .mpo_destroy_socket_label = mac_mls_destroy_label,
2904 .mpo_destroy_socket_peer_label = mac_mls_destroy_label,
2905 .mpo_destroy_vnode_label = mac_mls_destroy_label,
2906 .mpo_copy_cred_label = mac_mls_copy_label,
2907 .mpo_copy_ifnet_label = mac_mls_copy_label,
2908 .mpo_copy_mbuf_label = mac_mls_copy_label,

--- 140 unchanged lines hidden ---