Date: Mon, 23 Sep 2002 18:39:51 -0700 (PDT) From: Robert Watson <rwatson@FreeBSD.org> To: Perforce Change Reviews <perforce@freebsd.org> Subject: PERFORCE change 18032 for review Message-ID: <200209240139.g8O1dp81048025@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
http://people.freebsd.org/~peter/p4db/chv.cgi?CH=18032 Change 18032 by rwatson@rwatson_tislabs on 2002/09/23 18:39:45 Minor hacks to better support ttys until openpty() does things better: add tunable/sysctl twiddles to set the labels on ptys to biba/equal and/or mls/equal when they are instantiated. This is not the right long term solution since it doesn't properly handle pty reuse. Affected files ... .. //depot/projects/trustedbsd/mac/sys/security/mac_biba/mac_biba.c#111 edit .. //depot/projects/trustedbsd/mac/sys/security/mac_mls/mac_mls.c#93 edit Differences ... ==== //depot/projects/trustedbsd/mac/sys/security/mac_biba/mac_biba.c#111 (text+ko) ==== @@ -101,6 +101,11 @@ TUNABLE_STR("security.mac.biba.trusted_interfaces", trusted_interfaces, sizeof(trusted_interfaces)); +static int mac_biba_ptys_equal = 0; +SYSCTL_INT(_security_mac_biba, OID_AUTO, ptys_equal, CTLFLAG_RW, + &mac_biba_ptys_equal, 0, "Label pty devices as biba/equal on create"); +TUNABLE_INT("security.mac.biba.ptys_equal", &mac_biba_ptys_equal); + static int mac_biba_revocation_enabled = 0; SYSCTL_INT(_security_mac_biba, OID_AUTO, revocation_enabled, CTLFLAG_RW, &mac_biba_revocation_enabled, 0, "Revoke access to objects on relabel"); @@ -568,6 +573,10 @@ strcmp(dev->si_name, "random") == 0 || strncmp(dev->si_name, "fd/", strlen("fd/")) == 0) biba_type = MAC_BIBA_TYPE_EQUAL; + else if (mac_biba_ptys_equal && + (strncmp(dev->si_name, "ttyp", strlen("ttyp")) == 0 || + strncmp(dev->si_name, "ptyp", strlen("ptyp")) == 0)) + biba_type = MAC_BIBA_TYPE_EQUAL; else biba_type = MAC_BIBA_TYPE_HIGH; mac_biba_set_single(mac_biba, biba_type, 0); ==== //depot/projects/trustedbsd/mac/sys/security/mac_mls/mac_mls.c#93 (text+ko) ==== @@ -90,6 +90,11 @@ SYSCTL_INT(_security_mac_mls, OID_AUTO, destroyed_not_inited, CTLFLAG_RD, &destroyed_not_inited, 0, "Count of labels destroyed but not inited"); +static int mac_mls_ptys_equal = 0; +SYSCTL_INT(_security_mac_mls, OID_AUTO, ptys_equal, CTLFLAG_RW, + &mac_mls_ptys_equal, 0, "Label pty devices as mls/equal on create"); +TUNABLE_INT("security.mac.mls.ptys_equal", &mac_mls_ptys_equal); + static int mac_mls_revocation_enabled = 0; SYSCTL_INT(_security_mac_mls, OID_AUTO, revocation_enabled, CTLFLAG_RW, &mac_mls_revocation_enabled, 0, "Revoke access to objects on relabel"); @@ -559,6 +564,10 @@ else if (strcmp(dev->si_name, "kmem") == 0 || strcmp(dev->si_name, "mem") == 0) mls_type = MAC_MLS_TYPE_HIGH; + else if (mac_mls_ptys_equal && + (strncmp(dev->si_name, "ttyp", strlen("ttyp")) == 0 || + strncmp(dev->si_name, "ptyp", strlen("ptyp")) == 0)) + mls_type = MAC_MLS_TYPE_EQUAL; else mls_type = MAC_MLS_TYPE_LOW; mac_mls_set_single(mac_mls, mls_type, 0); To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe p4-projects" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200209240139.g8O1dp81048025>