Date: Tue, 5 Nov 2002 10:33:14 -0800 (PST) From: Robert Watson <rwatson@FreeBSD.org> To: Perforce Change Reviews <perforce@freebsd.org> Subject: PERFORCE change 20711 for review Message-ID: <200211051833.gA5IXEoA049131@repoman.freebsd.org>
next in thread | raw e-mail | index | archive | help
http://perforce.freebsd.org/chv.cgi?CH=20711 Change 20711 by rwatson@rwatson_tislabs on 2002/11/05 10:32:56 Disallow changing labels at mac_exec()-time using MLS, since the machinery isn't in place yet. Affected files ... .. //depot/projects/trustedbsd/mac/sys/security/mac_mls/mac_mls.c#144 edit Differences ... ==== //depot/projects/trustedbsd/mac/sys/security/mac_mls/mac_mls.c#144 (text+ko) ==== @@ -1884,7 +1884,20 @@ struct label *label, struct image_params *imgp, struct label *execlabel) { - struct mac_mls *subj, *obj; + struct mac_mls *subj, *obj, *exec; + int error; + + if (execlabel != NULL) { + /* + * We currently don't permit labels to be changed at + * exec-time as part of MLS, so disallow non-NULL + * MLS label elements in the execlabel. + */ + exec = SLOT(execlabel); + error = mls_atmostflags(exec, 0); + if (error) + return (error); + } if (!mac_mls_enabled) return (0); To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe p4-projects" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200211051833.gA5IXEoA049131>