Date: Tue, 5 Nov 2002 10:36:19 -0800 (PST) From: Robert Watson <rwatson@FreeBSD.org> To: Perforce Change Reviews <perforce@freebsd.org> Subject: PERFORCE change 20713 for review Message-ID: <200211051836.gA5IaJJo049366@repoman.freebsd.org>
next in thread | raw e-mail | index | archive | help
http://perforce.freebsd.org/chv.cgi?CH=20713 Change 20713 by rwatson@rwatson_tislabs on 2002/11/05 10:36:00 Disallow partition label change at exec-time since we don't yet have machinery for that in place. Affected files ... .. //depot/projects/trustedbsd/mac/sys/security/mac_partition/mac_partition.c#21 edit Differences ... ==== //depot/projects/trustedbsd/mac/sys/security/mac_partition/mac_partition.c#21 (text+ko) ==== @@ -244,6 +244,24 @@ return (error ? ENOENT : 0); } +static int +mac_partition_check_vnode_exec(struct ucred *cred, struct vnode *vp, + struct label *label, struct image_params *imgp, struct label *execlabel) +{ + + if (execlabel != NULL) { + /* + * We currently don't permit labels to be changed at + * exec-time as part of the partition model, so disallow + * non-NULL partition label changes in execlabel. + */ + if (SLOT(execlabel) != 0) + return (EINVAL); + } + + return (0); +} + static struct mac_policy_ops mac_partition_ops = { .mpo_init = mac_partition_init, @@ -261,6 +279,7 @@ .mpo_check_proc_sched = mac_partition_check_proc_sched, .mpo_check_proc_signal = mac_partition_check_proc_signal, .mpo_check_socket_visible = mac_partition_check_socket_visible, + .mpo_check_vnode_exec = mac_partition_check_vnode_exec, }; MAC_POLICY_SET(&mac_partition_ops, trustedbsd_mac_partition, To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe p4-projects" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200211051836.gA5IaJJo049366>