From owner-p4-projects  Mon Nov  4 11:37:29 2002
Delivered-To: p4-projects@freebsd.org
Received: by hub.freebsd.org (Postfix, from userid 32767)
	id 02B5B37B404; Mon,  4 Nov 2002 11:37:26 -0800 (PST)
Delivered-To: perforce@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id A698237B401
	for <perforce@freebsd.org>; Mon,  4 Nov 2002 11:37:25 -0800 (PST)
Received: from repoman.freebsd.org (repoman.freebsd.org [216.136.204.115])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 6187343E3B
	for <perforce@freebsd.org>; Mon,  4 Nov 2002 11:37:25 -0800 (PST)
	(envelope-from green@freebsd.org)
Received: from repoman.freebsd.org (localhost [127.0.0.1])
	by repoman.freebsd.org (8.12.6/8.12.6) with ESMTP id gA4JZhmV024173
	for <perforce@freebsd.org>; Mon, 4 Nov 2002 11:35:43 -0800 (PST)
	(envelope-from green@freebsd.org)
Received: (from perforce@localhost)
	by repoman.freebsd.org (8.12.6/8.12.6/Submit) id gA4JZhDa024170
	for perforce@freebsd.org; Mon, 4 Nov 2002 11:35:43 -0800 (PST)
Date: Mon, 4 Nov 2002 11:35:43 -0800 (PST)
Message-Id: <200211041935.gA4JZhDa024170@repoman.freebsd.org>
X-Authentication-Warning: repoman.freebsd.org: perforce set sender to green@freebsd.org using -f
From: Brian Feldman <green@FreeBSD.org>
Subject: PERFORCE change 20657 for review
To: Perforce Change Reviews <perforce@freebsd.org>
Sender: owner-p4-projects@FreeBSD.ORG
Precedence: bulk
List-ID: <p4-projects.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20p4-projects>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20p4-projects>
X-Loop: FreeBSD.ORG

http://perforce.freebsd.org/chv.cgi?CH=20657

Change 20657 by green@green_laptop_2 on 2002/11/04 11:34:53

	Be resilient to relabel operations on mac_lomac objects by
	always blanking the destination and copying the old label,
	but only if the new label "appears" internalized.

Affected files ...

.. //depot/projects/trustedbsd/mac/sys/security/mac_lomac/mac_lomac.c#33 edit

Differences ...

==== //depot/projects/trustedbsd/mac/sys/security/mac_lomac/mac_lomac.c#33 (text+ko) ====

@@ -577,6 +577,21 @@
 }
 
 /*
+ * Relabel "to" to "from" only if "from" is a valid label (contains
+ * at least a single), as for a relabel operation which may or may
+ * not involve a relevant label.
+ */
+void
+try_relabel(struct mac_lomac *from, struct mac_lomac *to)
+{
+
+	if (from->ml_flags & MAC_LOMAC_FLAG_SINGLE) {
+		bzero(to, sizeof(*to));
+		mac_lomac_copy(from, to);
+	}
+}
+
+/*
  * Policy module operations.
  */
 static void
@@ -1010,8 +1025,7 @@
 	source = SLOT(label);
 	dest = SLOT(vnodelabel);
 
-	bzero(dest, sizeof(*dest));
-	mac_lomac_copy(source, dest);
+	try_relabel(source, dest);
 }
 
 static void
@@ -1211,7 +1225,7 @@
 	source = SLOT(newlabel);
 	dest = SLOT(socketlabel);
 
-	mac_lomac_copy(source, dest);
+	try_relabel(source, dest);
 }
 
 static void
@@ -1223,7 +1237,7 @@
 	source = SLOT(newlabel);
 	dest = SLOT(pipelabel);
 
-	mac_lomac_copy(source, dest);
+	try_relabel(source, dest);
 }
 
 static void
@@ -1465,7 +1479,7 @@
 	source = SLOT(newlabel);
 	dest = SLOT(ifnetlabel);
 
-	mac_lomac_copy(source, dest);
+	try_relabel(source, dest);
 }
 
 static void
@@ -1579,7 +1593,7 @@
 	source = SLOT(newlabel);
 	dest = SLOT(&cred->cr_label);
 
-	mac_lomac_copy(source, dest);
+	try_relabel(source, dest);
 }
 
 /*

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe p4-projects" in the body of the message