From owner-p4-projects Tue Nov 5 10:38: 9 2002 Delivered-To: p4-projects@freebsd.org Received: by hub.freebsd.org (Postfix, from userid 32767) id 1FE1F37B404; Tue, 5 Nov 2002 10:38:07 -0800 (PST) Delivered-To: perforce@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id C098237B401 for ; Tue, 5 Nov 2002 10:38:06 -0800 (PST) Received: from repoman.freebsd.org (repoman.freebsd.org [216.136.204.115]) by mx1.FreeBSD.org (Postfix) with ESMTP id 775AD43E3B for ; Tue, 5 Nov 2002 10:38:06 -0800 (PST) (envelope-from bb+lists.freebsd.perforce@cyrus.watson.org) Received: from repoman.freebsd.org (localhost [127.0.0.1]) by repoman.freebsd.org (8.12.6/8.12.6) with ESMTP id gA5IaJmV049369 for ; Tue, 5 Nov 2002 10:36:19 -0800 (PST) (envelope-from bb+lists.freebsd.perforce@cyrus.watson.org) Received: (from perforce@localhost) by repoman.freebsd.org (8.12.6/8.12.6/Submit) id gA5IaJJo049366 for perforce@freebsd.org; Tue, 5 Nov 2002 10:36:19 -0800 (PST) Date: Tue, 5 Nov 2002 10:36:19 -0800 (PST) Message-Id: <200211051836.gA5IaJJo049366@repoman.freebsd.org> X-Authentication-Warning: repoman.freebsd.org: perforce set sender to bb+lists.freebsd.perforce@cyrus.watson.org using -f From: Robert Watson Subject: PERFORCE change 20713 for review To: Perforce Change Reviews Sender: owner-p4-projects@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG http://perforce.freebsd.org/chv.cgi?CH=20713 Change 20713 by rwatson@rwatson_tislabs on 2002/11/05 10:36:00 Disallow partition label change at exec-time since we don't yet have machinery for that in place. Affected files ... .. //depot/projects/trustedbsd/mac/sys/security/mac_partition/mac_partition.c#21 edit Differences ... ==== //depot/projects/trustedbsd/mac/sys/security/mac_partition/mac_partition.c#21 (text+ko) ==== @@ -244,6 +244,24 @@ return (error ? ENOENT : 0); } +static int +mac_partition_check_vnode_exec(struct ucred *cred, struct vnode *vp, + struct label *label, struct image_params *imgp, struct label *execlabel) +{ + + if (execlabel != NULL) { + /* + * We currently don't permit labels to be changed at + * exec-time as part of the partition model, so disallow + * non-NULL partition label changes in execlabel. + */ + if (SLOT(execlabel) != 0) + return (EINVAL); + } + + return (0); +} + static struct mac_policy_ops mac_partition_ops = { .mpo_init = mac_partition_init, @@ -261,6 +279,7 @@ .mpo_check_proc_sched = mac_partition_check_proc_sched, .mpo_check_proc_signal = mac_partition_check_proc_signal, .mpo_check_socket_visible = mac_partition_check_socket_visible, + .mpo_check_vnode_exec = mac_partition_check_vnode_exec, }; MAC_POLICY_SET(&mac_partition_ops, trustedbsd_mac_partition, To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe p4-projects" in the body of the message