From owner-p4-projects Tue Nov 5 8:34:15 2002 Delivered-To: p4-projects@freebsd.org Received: by hub.freebsd.org (Postfix, from userid 32767) id BC0AF37B404; Tue, 5 Nov 2002 08:34:10 -0800 (PST) Delivered-To: perforce@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 3855037B401 for ; Tue, 5 Nov 2002 08:34:10 -0800 (PST) Received: from repoman.freebsd.org (repoman.freebsd.org [216.136.204.115]) by mx1.FreeBSD.org (Postfix) with ESMTP id D693B43E77 for ; Tue, 5 Nov 2002 08:34:09 -0800 (PST) (envelope-from bb+lists.freebsd.perforce@cyrus.watson.org) Received: from repoman.freebsd.org (localhost [127.0.0.1]) by repoman.freebsd.org (8.12.6/8.12.6) with ESMTP id gA5GWNmV035265 for ; Tue, 5 Nov 2002 08:32:23 -0800 (PST) (envelope-from bb+lists.freebsd.perforce@cyrus.watson.org) Received: (from perforce@localhost) by repoman.freebsd.org (8.12.6/8.12.6/Submit) id gA5GWNdQ035261 for perforce@freebsd.org; Tue, 5 Nov 2002 08:32:23 -0800 (PST) Date: Tue, 5 Nov 2002 08:32:23 -0800 (PST) Message-Id: <200211051632.gA5GWNdQ035261@repoman.freebsd.org> X-Authentication-Warning: repoman.freebsd.org: perforce set sender to bb+lists.freebsd.perforce@cyrus.watson.org using -f From: Robert Watson Subject: PERFORCE change 20693 for review To: Perforce Change Reviews Sender: owner-p4-projects@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG http://perforce.freebsd.org/chv.cgi?CH=20693 Change 20693 by rwatson@rwatson_tislabs on 2002/11/05 08:31:28 Improve focus on consistent alphabetization and sorting. Affected files ... .. //depot/projects/trustedbsd/mac/sys/kern/kern_mac.c#349 edit .. //depot/projects/trustedbsd/mac/sys/sys/imgact.h#17 edit .. //depot/projects/trustedbsd/mac/sys/sys/mac.h#210 edit Differences ... ==== //depot/projects/trustedbsd/mac/sys/kern/kern_mac.c#349 (text+ko) ==== @@ -1275,7 +1275,51 @@ return (error); } +int +mac_execve_enter(struct image_params *imgp, struct mac *mac_p, + struct label *execlabelstorage) +{ + struct mac mac; + char *buffer; + int error; + + if (mac_p == NULL) + return (0); + + error = copyin(mac_p, &mac, sizeof(mac)); + if (error) + return (error); + + error = mac_check_structmac_consistent(&mac); + if (error) + return (error); + + buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK); + error = copyinstr(mac.m_string, buffer, mac.m_buflen, NULL); + if (error) { + free(buffer, M_MACTEMP); + return (error); + } + + mac_init_cred_label(execlabelstorage); + error = mac_internalize_cred_label(execlabelstorage, buffer); + free(buffer, M_MACTEMP); + if (error) { + mac_destroy_cred_label(execlabelstorage); + return (error); + } + imgp->execlabel = execlabelstorage; + return (0); +} + void +mac_execve_exit(struct image_params *imgp) +{ + if (imgp->execlabel != NULL) + mac_destroy_cred_label(imgp->execlabel); +} + +void mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp, struct label *shelllabel, struct image_params *imgp) { @@ -1295,7 +1339,7 @@ { int result; - ASSERT_VOP_LOCKED(vp, "mac_execve_transition"); + ASSERT_VOP_LOCKED(vp, "mac_execve_will_transition"); if (!mac_enforce_process && !mac_enforce_fs) return (0); @@ -3495,50 +3539,6 @@ return (error); } -int -mac_execve_enter(struct image_params *imgp, struct mac *mac_p, - struct label *execlabelstorage) -{ - struct mac mac; - char *buffer; - int error; - - if (mac_p == NULL) - return (0); - - error = copyin(mac_p, &mac, sizeof(mac)); - if (error) - return (error); - - error = mac_check_structmac_consistent(&mac); - if (error) - return (error); - - buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK); - error = copyinstr(mac.m_string, buffer, mac.m_buflen, NULL); - if (error) { - free(buffer, M_MACTEMP); - return (error); - } - - mac_init_cred_label(execlabelstorage); - error = mac_internalize_cred_label(execlabelstorage, buffer); - free(buffer, M_MACTEMP); - if (error) { - mac_destroy_cred_label(execlabelstorage); - return (error); - } - imgp->execlabel = execlabelstorage; - return (0); -} - -void -mac_execve_exit(struct image_params *imgp) -{ - if (imgp->execlabel != NULL) - mac_destroy_cred_label(imgp->execlabel); -} - SYSINIT(mac, SI_SUB_MAC, SI_ORDER_FIRST, mac_init, NULL); SYSINIT(mac_late, SI_SUB_MAC_LATE, SI_ORDER_FIRST, mac_late_init, NULL); ==== //depot/projects/trustedbsd/mac/sys/sys/imgact.h#17 (text+ko) ==== @@ -38,10 +38,10 @@ #define MAXSHELLCMDLEN 128 +struct label; struct sysentvec; struct thread; struct vm_object; -struct label; struct image_params { struct proc *proc; /* our process struct */ ==== //depot/projects/trustedbsd/mac/sys/sys/mac.h#210 (text+ko) ==== @@ -221,13 +221,13 @@ * Labeling event operations: processes. */ void mac_create_cred(struct ucred *cred_parent, struct ucred *cred_child); +int mac_execve_enter(struct image_params *imgp, struct mac *mac_p, + struct label *execlabel); void mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp, struct label *shelllabel, struct image_params *imgp); int mac_execve_will_transition(struct ucred *old, struct vnode *vp, struct label *shelllabel, struct image_params *imgp); -int mac_execve_enter(struct image_params *imgp, struct mac *mac_p, - struct label *execlabel); void mac_execve_exit(struct image_params *imgp); void mac_create_proc0(struct ucred *cred); void mac_create_proc1(struct ucred *cred); To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe p4-projects" in the body of the message