Date: Thu, 30 Jan 2003 08:40:17 -0800 (PST) From: Brian Feldman <green@FreeBSD.org> To: Perforce Change Reviews <perforce@freebsd.org> Subject: PERFORCE change 24442 for review Message-ID: <200301301640.h0UGeHwb082804@repoman.freebsd.org>
next in thread | raw e-mail | index | archive | help
http://perforce.freebsd.org/chv.cgi?CH=24442 Change 24442 by green@green_laptop_2 on 2003/01/30 08:39:58 * Make libsebsd depend on libpam (it does, when shared). * Implement security_compute_av() for SEBSD's "discretionary" usage. Affected files ... .. //depot/projects/trustedbsd/sebsd/lib/libsebsd/Makefile#2 edit .. //depot/projects/trustedbsd/sebsd/lib/libsebsd/sebsd.h#2 edit .. //depot/projects/trustedbsd/sebsd/lib/libsebsd/security_compute_av.c#1 add .. //depot/projects/trustedbsd/sebsd/lib/libsebsd/string_to_security_class.c#1 add .. //depot/projects/trustedbsd/sebsd/sys/security/sebsd/sebsd_syscalls.h#2 edit .. //depot/projects/trustedbsd/sebsd/sys/security/sebsd/sebsd_sysctl.c#2 edit Differences ... ==== //depot/projects/trustedbsd/sebsd/lib/libsebsd/Makefile#2 (text+ko) ==== @@ -8,10 +8,13 @@ LIB= sebsd CFLAGS+= -I${.CURDIR}/../../sys/security/sebsd CFLAGS+=-I${.CURDIR}/../../sys +LDADD+= -L${.OBJDIR}/../libpam/libpam ${MINUSLPAM} +DPADD+= ${LIBPAM} NOMAN= SRCS= system.c security_get_user_contexts.c get_ordered_context_list.c \ - getseccontext.c query_user_context.c security_change_context.c + getseccontext.c query_user_context.c security_change_context.c \ + string_to_security_class.c security_compute_av.c INCS= sebsd_context.h sebsd_ss.h sebsd_proc.h sebsd_fs.h sebsd.h \ sebsd_syscalls.h flask_types.h ==== //depot/projects/trustedbsd/sebsd/lib/libsebsd/sebsd.h#2 (text+ko) ==== @@ -56,6 +56,7 @@ char **default_context); int query_user_context(pam_handle_t *pamh, char **ordered_context_list, size_t length, char **retcontext); +security_class_t string_to_security_class(const char *s); int sebsd_avc_toggle(void); int sebsd_enabled(void); @@ -66,5 +67,7 @@ char ***retcontexts, size_t *ncontexts); int security_change_context(const char *domain, const char *ocontext, security_class_t oclass, char **newcontext); +int security_compute_av(struct security_query *query, + struct security_response *response); #endif /* _SEBSD_H */ ==== //depot/projects/trustedbsd/sebsd/sys/security/sebsd/sebsd_syscalls.h#2 (text+ko) ==== @@ -12,8 +12,8 @@ /* Structure definitions for compute_av call */ struct security_query { - security_id_t ssid; - security_id_t tsid; + char *scontext; + char *tcontext; security_class_t tclass; access_vector_t requested; }; ==== //depot/projects/trustedbsd/sebsd/sys/security/sebsd/sebsd_sysctl.c#2 (text+ko) ==== @@ -47,6 +47,7 @@ #include <security/sebsd/ss/security.h> #include <security/sebsd/ss/sidtab.h> +#include <security/sebsd/sebsd_syscalls.h> #include <security/sebsd/avc/avc.h> /* @@ -233,6 +234,60 @@ return (error); } +/* + * Sysctl handler for security.mac.sebsd.compute_av + * Compute access vectors given input "scontext\0tcontext\0",tclass,av + */ +static int +sysctl_compute_av(SYSCTL_HANDLER_ARGS) +{ + struct security_response resp; + security_id_t sid, tsid; + security_class_t tclass; + access_vector_t av; + char *scontext, *tcontext; + int error; + + if (req->newlen < 4 + sizeof(tclass) + sizeof(av)) + return (EINVAL); + if (req->newlen > 512) /* arbitrary */ + return (ENAMETOOLONG); + scontext = sebsd_malloc(req->newlen, M_SEBSD_SS, M_WAITOK); + error = SYSCTL_IN(req, scontext, req->newlen); + if (error) + goto out; + if (scontext[req->newlen - (1 + sizeof(tclass) + sizeof(av))] != '\0') { + error = EINVAL; + goto out; + } + tcontext = &scontext[strlen(scontext) + 1]; + if (tcontext >= &scontext[req->newlen - (1 + sizeof(tclass) + + sizeof(av))]) { + error = EINVAL; + goto out; + } + bcopy(&tcontext[strlen(tcontext) + 1], &tclass, sizeof(tclass)); + bcopy(&tcontext[strlen(tcontext) + 1 + sizeof(tclass)], &av, + sizeof(av)); + /* + * XXX We need POLICY_RDLOCK here, but it's not exported! + */ + error = security_context_to_sid(scontext, strlen(scontext) + 1, &sid); + if (error) + goto out; + error = security_context_to_sid(tcontext, strlen(tcontext) + 1, &tsid); + if (error) + goto out; + error = security_compute_av(sid, tsid, tclass, av, &resp.allowed, + &resp.decided, &resp.auditallow, &resp.auditdeny, &resp.seqno); + if (error) + goto out; + error = SYSCTL_OUT(req, &resp, sizeof(resp)); +out: + sebsd_free(scontext, M_SEBSD_SS); + return (error); +} + SYSCTL_DECL(_security_mac); SYSCTL_NODE(_security_mac, OID_AUTO, sebsd, CTLFLAG_RW, 0, "Security Enhanced BSD policy controls"); @@ -249,5 +304,8 @@ SYSCTL_PROC(_security_mac_sebsd, OID_AUTO, change_sid, CTLTYPE_STRING | CTLFLAG_RW | CTLFLAG_ANYBODY, NULL, 0, sysctl_change_sid, "A", "SEBSD (tty) SID relabel to perform along with transition"); +SYSCTL_PROC(_security_mac_sebsd, OID_AUTO, compute_av, CTLTYPE_STRING | + CTLFLAG_RW | CTLFLAG_ANYBODY, NULL, 0, sysctl_compute_av, "A", + "SEBSD access vector decision query"); SYSCTL_PROC(_security_mac_sebsd, OID_AUTO, enforcing, CTLTYPE_INT | CTLFLAG_RW, NULL, 0, sysctl_sebsd_enforcing, "I", "SEBSD avc enforcement"); To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe p4-projects" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200301301640.h0UGeHwb082804>