Date: Sat, 8 Jul 2006 12:25:56 GMT From: Robert Watson <rwatson@FreeBSD.org> To: Perforce Change Reviews <perforce@freebsd.org> Subject: PERFORCE change 100985 for review Message-ID: <200607081225.k68CPuWi069413@repoman.freebsd.org>
next in thread | raw e-mail | index | archive | help
http://perforce.freebsd.org/chv.cgi?CH=100985 Change 100985 by rwatson@rwatson_zoo on 2006/07/08 12:25:00 Rename. Drop fslabel. Affected files ... .. //depot/projects/trustedbsd/mac2/sys/security/mac_biba/mac_biba.c#2 edit Differences ... ==== //depot/projects/trustedbsd/mac2/sys/security/mac_biba/mac_biba.c#2 (text+ko) ==== @@ -1,6 +1,7 @@ /*- * Copyright (c) 1999-2002 Robert N. M. Watson * Copyright (c) 2001-2005 McAfee, Inc. + * Copyright (c) 2006 SPARTA, Inc. * All rights reserved. * * This software was developed by Robert Watson for the TrustedBSD Project. @@ -10,6 +11,9 @@ * DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA * CHATS research program. * + * This software was enhanced by SPARTA ISSO under SPAWAR contract + * N66001-04-C-6019 ("SEFOS"). + * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: @@ -501,7 +505,7 @@ * Policy module operations. */ static void -mac_biba_init(struct mac_policy_conf *conf) +mac_biba_policy_init(struct mac_policy_conf *conf) { zone_biba = uma_zcreate("mac_biba", sizeof(struct mac_biba), NULL, @@ -786,7 +790,7 @@ * a lot like file system objects. */ static void -mac_biba_create_devfs_device(struct ucred *cred, struct mount *mp, +mac_biba_devfs_create_device(struct ucred *cred, struct mount *mp, struct cdev *dev, struct devfs_dirent *devfs_dirent, struct label *label) { struct mac_biba *mac_biba; @@ -808,7 +812,7 @@ } static void -mac_biba_create_devfs_directory(struct mount *mp, char *dirname, +mac_biba_devfs_create_directory(struct mount *mp, char *dirname, int dirnamelen, struct devfs_dirent *devfs_dirent, struct label *label) { struct mac_biba *mac_biba; @@ -818,7 +822,7 @@ } static void -mac_biba_create_devfs_symlink(struct ucred *cred, struct mount *mp, +mac_biba_devfs_create_symlink(struct ucred *cred, struct mount *mp, struct devfs_dirent *dd, struct label *ddlabel, struct devfs_dirent *de, struct label *delabel) { @@ -831,20 +835,18 @@ } static void -mac_biba_create_mount(struct ucred *cred, struct mount *mp, - struct label *mntlabel, struct label *fslabel) +mac_biba_mount_create(struct ucred *cred, struct mount *mp, + struct label *mntlabel) { struct mac_biba *source, *dest; source = SLOT(cred->cr_label); dest = SLOT(mntlabel); mac_biba_copy_effective(source, dest); - dest = SLOT(fslabel); - mac_biba_copy_effective(source, dest); } static void -mac_biba_relabel_vnode(struct ucred *cred, struct vnode *vp, +mac_biba_vnode_relabel(struct ucred *cred, struct vnode *vp, struct label *vnodelabel, struct label *label) { struct mac_biba *source, *dest; @@ -856,7 +858,7 @@ } static void -mac_biba_update_devfsdirent(struct mount *mp, +mac_biba_devfs_update(struct mount *mp, struct devfs_dirent *devfs_dirent, struct label *direntlabel, struct vnode *vp, struct label *vnodelabel) { @@ -869,7 +871,7 @@ } static void -mac_biba_associate_vnode_devfs(struct mount *mp, struct label *fslabel, +mac_biba_devfs_vnode_associate(struct mount *mp, struct label *mountlabel, struct devfs_dirent *de, struct label *delabel, struct vnode *vp, struct label *vlabel) { @@ -882,13 +884,13 @@ } static int -mac_biba_associate_vnode_extattr(struct mount *mp, struct label *fslabel, +mac_biba_vnode_associate_extattr(struct mount *mp, struct label *mountlabel, struct vnode *vp, struct label *vlabel) { struct mac_biba temp, *source, *dest; int buflen, error; - source = SLOT(fslabel); + source = SLOT(mountlabel); dest = SLOT(vlabel); buflen = sizeof(temp); @@ -897,7 +899,7 @@ error = vn_extattr_get(vp, IO_NODELOCKED, MAC_BIBA_EXTATTR_NAMESPACE, MAC_BIBA_EXTATTR_NAME, &buflen, (char *) &temp, curthread); if (error == ENOATTR || error == EOPNOTSUPP) { - /* Fall back to the fslabel. */ + /* Fall back to the mountlabel. */ mac_biba_copy_effective(source, dest); return (0); } else if (error) @@ -922,20 +924,20 @@ } static void -mac_biba_associate_vnode_singlelabel(struct mount *mp, - struct label *fslabel, struct vnode *vp, struct label *vlabel) +mac_biba_vnode_associate_singlelabel(struct mount *mp, + struct label *mountlabel, struct vnode *vp, struct label *vlabel) { struct mac_biba *source, *dest; - source = SLOT(fslabel); + source = SLOT(mountlabel); dest = SLOT(vlabel); mac_biba_copy_effective(source, dest); } static int -mac_biba_create_vnode_extattr(struct ucred *cred, struct mount *mp, - struct label *fslabel, struct vnode *dvp, struct label *dlabel, +mac_biba_vnode_create_extattr(struct ucred *cred, struct mount *mp, + struct label *mountlabel, struct vnode *dvp, struct label *dlabel, struct vnode *vp, struct label *vlabel, struct componentname *cnp) { struct mac_biba *source, *dest, temp; @@ -957,7 +959,7 @@ } static int -mac_biba_setlabel_vnode_extattr(struct ucred *cred, struct vnode *vp, +mac_biba_vnode_setlabel_extattr(struct ucred *cred, struct vnode *vp, struct label *vlabel, struct label *intlabel) { struct mac_biba *source, temp; @@ -982,7 +984,7 @@ * Labeling event operations: IPC object. */ static void -mac_biba_create_inpcb_from_socket(struct socket *so, struct label *solabel, +mac_biba_inpcb_create(struct socket *so, struct label *solabel, struct inpcb *inp, struct label *inplabel) { struct mac_biba *source, *dest; @@ -994,7 +996,7 @@ } static void -mac_biba_create_mbuf_from_socket(struct socket *so, struct label *socketlabel, +mac_biba_socket_create_mbuf(struct socket *so, struct label *socketlabel, struct mbuf *m, struct label *mbuflabel) { struct mac_biba *source, *dest; @@ -1006,7 +1008,7 @@ } static void -mac_biba_create_socket(struct ucred *cred, struct socket *socket, +mac_biba_socket_create(struct ucred *cred, struct socket *socket, struct label *socketlabel) { struct mac_biba *source, *dest; @@ -1018,7 +1020,7 @@ } static void -mac_biba_create_pipe(struct ucred *cred, struct pipepair *pp, +mac_biba_pipe_create(struct ucred *cred, struct pipepair *pp, struct label *pipelabel) { struct mac_biba *source, *dest; @@ -1030,7 +1032,7 @@ } static void -mac_biba_create_posix_sem(struct ucred *cred, struct ksem *ksemptr, +mac_biba_posix_sem_create(struct ucred *cred, struct ksem *ksemptr, struct label *ks_label) { struct mac_biba *source, *dest; @@ -1042,9 +1044,8 @@ } static void -mac_biba_create_socket_from_socket(struct socket *oldsocket, - struct label *oldsocketlabel, struct socket *newsocket, - struct label *newsocketlabel) +mac_biba_socket_accept(struct socket *oldsocket, struct label *oldsocketlabel, + struct socket *newsocket, struct label *newsocketlabel) { struct mac_biba *source, *dest; @@ -1055,7 +1056,7 @@ } static void -mac_biba_relabel_socket(struct ucred *cred, struct socket *socket, +mac_biba_socket_relabel(struct ucred *cred, struct socket *socket, struct label *socketlabel, struct label *newlabel) { struct mac_biba *source, *dest; @@ -1067,7 +1068,7 @@ } static void -mac_biba_relabel_pipe(struct ucred *cred, struct pipepair *pp, +mac_biba_pipe_relabel(struct ucred *cred, struct pipepair *pp, struct label *pipelabel, struct label *newlabel) { struct mac_biba *source, *dest; @@ -1079,7 +1080,7 @@ } static void -mac_biba_set_socket_peer_from_mbuf(struct mbuf *mbuf, struct label *mbuflabel, +mac_biba_socket_peer_set_from_mbuf(struct mbuf *mbuf, struct label *mbuflabel, struct socket *socket, struct label *socketpeerlabel) { struct mac_biba *source, *dest; @@ -1095,7 +1096,7 @@ */ static void -mac_biba_create_sysv_msgmsg(struct ucred *cred, struct msqid_kernel *msqkptr, +mac_biba_sysvmsg_create(struct ucred *cred, struct msqid_kernel *msqkptr, struct label *msqlabel, struct msg *msgptr, struct label *msglabel) { struct mac_biba *source, *dest; @@ -1108,8 +1109,8 @@ } static void -mac_biba_create_sysv_msgqueue(struct ucred *cred, - struct msqid_kernel *msqkptr, struct label *msqlabel) +mac_biba_sysvmsq_create(struct ucred *cred, struct msqid_kernel *msqkptr, + struct label *msqlabel) { struct mac_biba *source, *dest; @@ -1120,7 +1121,7 @@ } static void -mac_biba_create_sysv_sem(struct ucred *cred, struct semid_kernel *semakptr, +mac_biba_sysvsem_create(struct ucred *cred, struct semid_kernel *semakptr, struct label *semalabel) { struct mac_biba *source, *dest; @@ -1132,7 +1133,7 @@ } static void -mac_biba_create_sysv_shm(struct ucred *cred, struct shmid_kernel *shmsegptr, +mac_biba_sysvshm_create(struct ucred *cred, struct shmid_kernel *shmsegptr, struct label *shmlabel) { struct mac_biba *source, *dest; @@ -1147,7 +1148,7 @@ * Labeling event operations: network objects. */ static void -mac_biba_set_socket_peer_from_socket(struct socket *oldsocket, +mac_biba_socket_peer_set_from_socket(struct socket *oldsocket, struct label *oldsocketlabel, struct socket *newsocket, struct label *newsocketpeerlabel) { @@ -1160,7 +1161,7 @@ } static void -mac_biba_create_bpfdesc(struct ucred *cred, struct bpf_d *bpf_d, +mac_biba_bpfdesc_create(struct ucred *cred, struct bpf_d *bpf_d, struct label *bpflabel) { struct mac_biba *source, *dest; @@ -1172,7 +1173,7 @@ } static void -mac_biba_create_ifnet(struct ifnet *ifnet, struct label *ifnetlabel) +mac_biba_ifnet_create(struct ifnet *ifnet, struct label *ifnetlabel) { char tifname[IFNAMSIZ], *p, *q; char tiflist[sizeof(trusted_interfaces)]; @@ -1229,7 +1230,7 @@ } static void -mac_biba_create_ipq(struct mbuf *fragment, struct label *fragmentlabel, +mac_biba_ipq_create(struct mbuf *fragment, struct label *fragmentlabel, struct ipq *ipq, struct label *ipqlabel) { struct mac_biba *source, *dest; @@ -1241,7 +1242,7 @@ } static void -mac_biba_create_datagram_from_ipq(struct ipq *ipq, struct label *ipqlabel, +mac_biba_ipq_reassemble(struct ipq *ipq, struct label *ipqlabel, struct mbuf *datagram, struct label *datagramlabel) { struct mac_biba *source, *dest; @@ -1254,7 +1255,7 @@ } static void -mac_biba_create_fragment(struct mbuf *datagram, struct label *datagramlabel, +mac_biba_netinet_fragment(struct mbuf *datagram, struct label *datagramlabel, struct mbuf *fragment, struct label *fragmentlabel) { struct mac_biba *source, *dest; @@ -1266,7 +1267,7 @@ } static void -mac_biba_create_mbuf_from_inpcb(struct inpcb *inp, struct label *inplabel, +mac_biba_inpcb_create_mbuf(struct inpcb *inp, struct label *inplabel, struct mbuf *m, struct label *mlabel) { struct mac_biba *source, *dest; @@ -1278,7 +1279,7 @@ } static void -mac_biba_create_mbuf_linklayer(struct ifnet *ifnet, struct label *ifnetlabel, +mac_biba_mbuf_create_linklayer(struct ifnet *ifnet, struct label *ifnetlabel, struct mbuf *mbuf, struct label *mbuflabel) { struct mac_biba *dest; @@ -1289,7 +1290,7 @@ } static void -mac_biba_create_mbuf_from_bpfdesc(struct bpf_d *bpf_d, struct label *bpflabel, +mac_biba_bpfdesc_create_mbuf(struct bpf_d *bpf_d, struct label *bpflabel, struct mbuf *mbuf, struct label *mbuflabel) { struct mac_biba *source, *dest; @@ -1301,7 +1302,7 @@ } static void -mac_biba_create_mbuf_from_ifnet(struct ifnet *ifnet, struct label *ifnetlabel, +mac_biba_ifnet_create_mbuf(struct ifnet *ifnet, struct label *ifnetlabel, struct mbuf *m, struct label *mbuflabel) { struct mac_biba *source, *dest; @@ -1313,7 +1314,7 @@ } static void -mac_biba_create_mbuf_multicast_encap(struct mbuf *oldmbuf, +mac_biba_mbuf_create_multicast_encap(struct mbuf *oldmbuf, struct label *oldmbuflabel, struct ifnet *ifnet, struct label *ifnetlabel, struct mbuf *newmbuf, struct label *newmbuflabel) { @@ -1326,8 +1327,9 @@ } static void -mac_biba_create_mbuf_netlayer(struct mbuf *oldmbuf, struct label *oldmbuflabel, - struct mbuf *newmbuf, struct label *newmbuflabel) +mac_biba_mbuf_create_netlayer(struct mbuf *oldmbuf, + struct label *oldmbuflabel, struct mbuf *newmbuf, + struct label *newmbuflabel) { struct mac_biba *source, *dest; @@ -1338,7 +1340,7 @@ } static int -mac_biba_fragment_match(struct mbuf *fragment, struct label *fragmentlabel, +mac_biba_ipq_match(struct mbuf *fragment, struct label *fragmentlabel, struct ipq *ipq, struct label *ipqlabel) { struct mac_biba *a, *b; @@ -1350,7 +1352,7 @@ } static void -mac_biba_relabel_ifnet(struct ucred *cred, struct ifnet *ifnet, +mac_biba_ifnet_relabel(struct ucred *cred, struct ifnet *ifnet, struct label *ifnetlabel, struct label *newlabel) { struct mac_biba *source, *dest; @@ -1362,7 +1364,7 @@ } static void -mac_biba_update_ipq(struct mbuf *fragment, struct label *fragmentlabel, +mac_biba_ipq_update(struct mbuf *fragment, struct label *fragmentlabel, struct ipq *ipq, struct label *ipqlabel) { @@ -1385,7 +1387,7 @@ * Labeling event operations: processes. */ static void -mac_biba_create_proc0(struct ucred *cred) +mac_biba_proc_create_swapper(struct ucred *cred) { struct mac_biba *dest; @@ -1397,7 +1399,7 @@ } static void -mac_biba_create_proc1(struct ucred *cred) +mac_biba_proc_create_init(struct ucred *cred) { struct mac_biba *dest; @@ -1409,7 +1411,7 @@ } static void -mac_biba_relabel_cred(struct ucred *cred, struct label *newlabel) +mac_biba_cred_relabel(struct ucred *cred, struct label *newlabel) { struct mac_biba *source, *dest; @@ -1423,28 +1425,28 @@ * Label cleanup/flush operations */ static void -mac_biba_cleanup_sysv_msgmsg(struct label *msglabel) +mac_biba_sysvmsg_cleanup(struct label *msglabel) { bzero(SLOT(msglabel), sizeof(struct mac_biba)); } static void -mac_biba_cleanup_sysv_msgqueue(struct label *msqlabel) +mac_biba_sysvmsq_cleanup(struct label *msqlabel) { bzero(SLOT(msqlabel), sizeof(struct mac_biba)); } static void -mac_biba_cleanup_sysv_sem(struct label *semalabel) +mac_biba_sysvsem_cleanup(struct label *semalabel) { bzero(SLOT(semalabel), sizeof(struct mac_biba)); } static void -mac_biba_cleanup_sysv_shm(struct label *shmlabel) +mac_biba_sysvshm_cleanup(struct label *shmlabel) { bzero(SLOT(shmlabel), sizeof(struct mac_biba)); } @@ -1453,7 +1455,7 @@ * Access control checks. */ static int -mac_biba_check_bpfdesc_receive(struct bpf_d *bpf_d, struct label *bpflabel, +mac_biba_bpfdesc_check_receive(struct bpf_d *bpf_d, struct label *bpflabel, struct ifnet *ifnet, struct label *ifnetlabel) { struct mac_biba *a, *b; @@ -1470,7 +1472,7 @@ } static int -mac_biba_check_cred_relabel(struct ucred *cred, struct label *newlabel) +mac_biba_cred_check_relabel(struct ucred *cred, struct label *newlabel) { struct mac_biba *subj, *new; int error; @@ -1532,7 +1534,7 @@ } static int -mac_biba_check_cred_visible(struct ucred *u1, struct ucred *u2) +mac_biba_cred_check_visible(struct ucred *u1, struct ucred *u2) { struct mac_biba *subj, *obj; @@ -1550,7 +1552,7 @@ } static int -mac_biba_check_ifnet_relabel(struct ucred *cred, struct ifnet *ifnet, +mac_biba_ifnet_check_relabel(struct ucred *cred, struct ifnet *ifnet, struct label *ifnetlabel, struct label *newlabel) { struct mac_biba *subj, *new; @@ -1578,7 +1580,7 @@ } static int -mac_biba_check_ifnet_transmit(struct ifnet *ifnet, struct label *ifnetlabel, +mac_biba_ifnet_check_transmit(struct ifnet *ifnet, struct label *ifnetlabel, struct mbuf *m, struct label *mbuflabel) { struct mac_biba *p, *i; @@ -1593,7 +1595,7 @@ } static int -mac_biba_check_inpcb_deliver(struct inpcb *inp, struct label *inplabel, +mac_biba_inpcb_check_deliver(struct inpcb *inp, struct label *inplabel, struct mbuf *m, struct label *mlabel) { struct mac_biba *p, *i; @@ -1608,7 +1610,7 @@ } static int -mac_biba_check_sysv_msgrcv(struct ucred *cred, struct msg *msgptr, +mac_biba_sysvmsq_check_msgrcv(struct ucred *cred, struct msg *msgptr, struct label *msglabel) { struct mac_biba *subj, *obj; @@ -1626,7 +1628,7 @@ } static int -mac_biba_check_sysv_msgrmid(struct ucred *cred, struct msg *msgptr, +mac_biba_sysvmsq_check_msgrmid(struct ucred *cred, struct msg *msgptr, struct label *msglabel) { struct mac_biba *subj, *obj; @@ -1644,8 +1646,8 @@ } static int -mac_biba_check_sysv_msqget(struct ucred *cred, struct msqid_kernel *msqkptr, - struct label *msqklabel) +mac_biba_sysvmsq_check_msqget(struct ucred *cred, + struct msqid_kernel *msqkptr, struct label *msqklabel) { struct mac_biba *subj, *obj; @@ -1662,8 +1664,8 @@ } static int -mac_biba_check_sysv_msqsnd(struct ucred *cred, struct msqid_kernel *msqkptr, - struct label *msqklabel) +mac_biba_sysvmsq_check_msqsnd(struct ucred *cred, + struct msqid_kernel *msqkptr, struct label *msqklabel) { struct mac_biba *subj, *obj; @@ -1680,8 +1682,8 @@ } static int -mac_biba_check_sysv_msqrcv(struct ucred *cred, struct msqid_kernel *msqkptr, - struct label *msqklabel) +mac_biba_sysvmsq_check_msqrcv(struct ucred *cred, + struct msqid_kernel *msqkptr, struct label *msqklabel) { struct mac_biba *subj, *obj; @@ -1699,8 +1701,8 @@ static int -mac_biba_check_sysv_msqctl(struct ucred *cred, struct msqid_kernel *msqkptr, - struct label *msqklabel, int cmd) +mac_biba_sysvmsq_check_msqctl(struct ucred *cred, + struct msqid_kernel *msqkptr, struct label *msqklabel, int cmd) { struct mac_biba *subj, *obj; @@ -1730,8 +1732,8 @@ } static int -mac_biba_check_sysv_semctl(struct ucred *cred, struct semid_kernel *semakptr, - struct label *semaklabel, int cmd) +mac_biba_sysvsem_check_semctl(struct ucred *cred, + struct semid_kernel *semakptr, struct label *semaklabel, int cmd) { struct mac_biba *subj, *obj; @@ -1769,8 +1771,8 @@ static int -mac_biba_check_sysv_semget(struct ucred *cred, struct semid_kernel *semakptr, - struct label *semaklabel) +mac_biba_sysvsem_check_semget(struct ucred *cred, + struct semid_kernel *semakptr, struct label *semaklabel) { struct mac_biba *subj, *obj; @@ -1788,8 +1790,9 @@ static int -mac_biba_check_sysv_semop(struct ucred *cred, struct semid_kernel *semakptr, - struct label *semaklabel, size_t accesstype) +mac_biba_sysvsem_check_semop(struct ucred *cred, + struct semid_kernel *semakptr, struct label *semaklabel, + size_t accesstype) { struct mac_biba *subj, *obj; @@ -1811,8 +1814,8 @@ } static int -mac_biba_check_sysv_shmat(struct ucred *cred, struct shmid_kernel *shmsegptr, - struct label *shmseglabel, int shmflg) +mac_biba_sysvshm_check_shmat(struct ucred *cred, + struct shmid_kernel *shmsegptr, struct label *shmseglabel, int shmflg) { struct mac_biba *subj, *obj; @@ -1833,8 +1836,8 @@ } static int -mac_biba_check_sysv_shmctl(struct ucred *cred, struct shmid_kernel *shmsegptr, - struct label *shmseglabel, int cmd) +mac_biba_sysvshm_check_shmctl(struct ucred *cred, + struct shmid_kernel *shmsegptr, struct label *shmseglabel, int cmd) { struct mac_biba *subj, *obj; @@ -1865,8 +1868,8 @@ } static int -mac_biba_check_sysv_shmget(struct ucred *cred, struct shmid_kernel *shmsegptr, - struct label *shmseglabel, int shmflg) +mac_biba_sysvshm_check_shmget(struct ucred *cred, + struct shmid_kernel *shmsegptr, struct label *shmseglabel, int shmflg) { struct mac_biba *subj, *obj; @@ -1883,7 +1886,7 @@ } static int -mac_biba_check_kld_load(struct ucred *cred, struct vnode *vp, +mac_biba_kld_check_load(struct ucred *cred, struct vnode *vp, struct label *label) { struct mac_biba *subj, *obj; @@ -1907,7 +1910,7 @@ static int -mac_biba_check_kld_unload(struct ucred *cred) +mac_biba_kld_check_unload(struct ucred *cred) { struct mac_biba *subj; @@ -1920,7 +1923,7 @@ } static int -mac_biba_check_mount_stat(struct ucred *cred, struct mount *mp, +mac_biba_mount_check_stat(struct ucred *cred, struct mount *mp, struct label *mntlabel) { struct mac_biba *subj, *obj; @@ -1938,7 +1941,7 @@ } static int -mac_biba_check_pipe_ioctl(struct ucred *cred, struct pipepair *pp, +mac_biba_pipe_check_ioctl(struct ucred *cred, struct pipepair *pp, struct label *pipelabel, unsigned long cmd, void /* caddr_t */ *data) { @@ -1951,7 +1954,7 @@ } static int -mac_biba_check_pipe_poll(struct ucred *cred, struct pipepair *pp, +mac_biba_pipe_check_poll(struct ucred *cred, struct pipepair *pp, struct label *pipelabel) { struct mac_biba *subj, *obj; @@ -1969,7 +1972,7 @@ } static int -mac_biba_check_pipe_read(struct ucred *cred, struct pipepair *pp, +mac_biba_pipe_check_read(struct ucred *cred, struct pipepair *pp, struct label *pipelabel) { struct mac_biba *subj, *obj; @@ -1987,7 +1990,7 @@ } static int -mac_biba_check_pipe_relabel(struct ucred *cred, struct pipepair *pp, +mac_biba_pipe_check_relabel(struct ucred *cred, struct pipepair *pp, struct label *pipelabel, struct label *newlabel) { struct mac_biba *subj, *obj, *new; @@ -2038,7 +2041,7 @@ } static int -mac_biba_check_pipe_stat(struct ucred *cred, struct pipepair *pp, +mac_biba_pipe_check_stat(struct ucred *cred, struct pipepair *pp, struct label *pipelabel) { struct mac_biba *subj, *obj; @@ -2056,7 +2059,7 @@ } static int -mac_biba_check_pipe_write(struct ucred *cred, struct pipepair *pp, +mac_biba_pipe_check_write(struct ucred *cred, struct pipepair *pp, struct label *pipelabel) { struct mac_biba *subj, *obj; @@ -2074,7 +2077,7 @@ } static int -mac_biba_check_posix_sem_write(struct ucred *cred, struct ksem *ksemptr, +mac_biba_posix_sem_check_write(struct ucred *cred, struct ksem *ksemptr, struct label *ks_label) { struct mac_biba *subj, *obj; @@ -2092,7 +2095,7 @@ } static int -mac_biba_check_posix_sem_rdonly(struct ucred *cred, struct ksem *ksemptr, +mac_biba_posix_sem_check_rdonly(struct ucred *cred, struct ksem *ksemptr, struct label *ks_label) { struct mac_biba *subj, *obj; @@ -2110,7 +2113,7 @@ } static int -mac_biba_check_proc_debug(struct ucred *cred, struct proc *proc) +mac_biba_proc_check_debug(struct ucred *cred, struct proc *proc) { struct mac_biba *subj, *obj; @@ -2130,7 +2133,7 @@ } static int -mac_biba_check_proc_sched(struct ucred *cred, struct proc *proc) +mac_biba_proc_check_sched(struct ucred *cred, struct proc *proc) { struct mac_biba *subj, *obj; @@ -2150,7 +2153,7 @@ } static int -mac_biba_check_proc_signal(struct ucred *cred, struct proc *proc, int signum) +mac_biba_proc_check_signal(struct ucred *cred, struct proc *proc, int signum) { struct mac_biba *subj, *obj; @@ -2170,7 +2173,7 @@ } static int -mac_biba_check_socket_deliver(struct socket *so, struct label *socketlabel, +mac_biba_socket_check_deliver(struct socket *so, struct label *socketlabel, struct mbuf *m, struct label *mbuflabel) { struct mac_biba *p, *s; @@ -2185,7 +2188,7 @@ } static int -mac_biba_check_socket_relabel(struct ucred *cred, struct socket *so, +mac_biba_socket_check_relabel(struct ucred *cred, struct socket *so, struct label *socketlabel, struct label *newlabel) { struct mac_biba *subj, *obj, *new; @@ -2236,7 +2239,7 @@ } static int -mac_biba_check_socket_visible(struct ucred *cred, struct socket *socket, +mac_biba_socket_check_visible(struct ucred *cred, struct socket *socket, struct label *socketlabel) { struct mac_biba *subj, *obj; @@ -2254,7 +2257,7 @@ } static int -mac_biba_check_sysarch_ioperm(struct ucred *cred) +mac_biba_system_check_ioperm(struct ucred *cred) { struct mac_biba *subj; int error; @@ -2272,7 +2275,7 @@ } static int -mac_biba_check_system_acct(struct ucred *cred, struct vnode *vp, +mac_biba_system_check_acct(struct ucred *cred, struct vnode *vp, struct label *label) { struct mac_biba *subj, *obj; @@ -2298,7 +2301,7 @@ } static int -mac_biba_check_system_settime(struct ucred *cred) +mac_biba_system_check_settime(struct ucred *cred) { struct mac_biba *subj; int error; @@ -2316,7 +2319,7 @@ } static int -mac_biba_check_system_swapon(struct ucred *cred, struct vnode *vp, +mac_biba_system_check_swapon(struct ucred *cred, struct vnode *vp, struct label *label) { struct mac_biba *subj, *obj; @@ -2339,7 +2342,7 @@ } static int -mac_biba_check_system_swapoff(struct ucred *cred, struct vnode *vp, +mac_biba_system_check_swapoff(struct ucred *cred, struct vnode *vp, struct label *label) { struct mac_biba *subj, *obj; @@ -2359,7 +2362,7 @@ } static int -mac_biba_check_system_sysctl(struct ucred *cred, struct sysctl_oid *oidp, +mac_biba_system_check_sysctl(struct ucred *cred, struct sysctl_oid *oidp, void *arg1, int arg2, struct sysctl_req *req) { struct mac_biba *subj; @@ -2387,7 +2390,7 @@ } static int -mac_biba_check_vnode_chdir(struct ucred *cred, struct vnode *dvp, +mac_biba_vnode_check_chdir(struct ucred *cred, struct vnode *dvp, struct label *dlabel) { struct mac_biba *subj, *obj; @@ -2405,7 +2408,7 @@ } static int -mac_biba_check_vnode_chroot(struct ucred *cred, struct vnode *dvp, +mac_biba_vnode_check_chroot(struct ucred *cred, struct vnode *dvp, struct label *dlabel) { struct mac_biba *subj, *obj; @@ -2423,7 +2426,7 @@ } static int -mac_biba_check_vnode_create(struct ucred *cred, struct vnode *dvp, +mac_biba_vnode_check_create(struct ucred *cred, struct vnode *dvp, struct label *dlabel, struct componentname *cnp, struct vattr *vap) { struct mac_biba *subj, *obj; @@ -2441,31 +2444,7 @@ } static int -mac_biba_check_vnode_delete(struct ucred *cred, struct vnode *dvp, - struct label *dlabel, struct vnode *vp, struct label *label, - struct componentname *cnp) -{ - struct mac_biba *subj, *obj; - - if (!mac_biba_enabled) - return (0); - - subj = SLOT(cred->cr_label); - obj = SLOT(dlabel); - - if (!mac_biba_dominate_effective(subj, obj)) - return (EACCES); - - obj = SLOT(label); - - if (!mac_biba_dominate_effective(subj, obj)) - return (EACCES); - - return (0); -} - -static int -mac_biba_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp, +mac_biba_vnode_check_deleteacl(struct ucred *cred, struct vnode *vp, struct label *label, acl_type_t type) { struct mac_biba *subj, *obj; @@ -2483,7 +2462,7 @@ } static int -mac_biba_check_vnode_deleteextattr(struct ucred *cred, struct vnode *vp, +mac_biba_vnode_check_deleteextattr(struct ucred *cred, struct vnode *vp, struct label *label, int attrnamespace, const char *name) { struct mac_biba *subj, *obj; @@ -2501,7 +2480,7 @@ } static int -mac_biba_check_vnode_exec(struct ucred *cred, struct vnode *vp, +mac_biba_vnode_check_exec(struct ucred *cred, struct vnode *vp, struct label *label, struct image_params *imgp, struct label *execlabel) { @@ -2533,7 +2512,7 @@ } static int -mac_biba_check_vnode_getacl(struct ucred *cred, struct vnode *vp, +mac_biba_vnode_check_getacl(struct ucred *cred, struct vnode *vp, struct label *label, acl_type_t type) { struct mac_biba *subj, *obj; @@ -2551,7 +2530,7 @@ } static int -mac_biba_check_vnode_getextattr(struct ucred *cred, struct vnode *vp, +mac_biba_vnode_check_getextattr(struct ucred *cred, struct vnode *vp, struct label *label, int attrnamespace, const char *name, struct uio *uio) { struct mac_biba *subj, *obj; @@ -2569,7 +2548,7 @@ } static int -mac_biba_check_vnode_link(struct ucred *cred, struct vnode *dvp, +mac_biba_vnode_check_link(struct ucred *cred, struct vnode *dvp, struct label *dlabel, struct vnode *vp, struct label *label, struct componentname *cnp) { @@ -2593,7 +2572,7 @@ } static int -mac_biba_check_vnode_listextattr(struct ucred *cred, struct vnode *vp, +mac_biba_vnode_check_listextattr(struct ucred *cred, struct vnode *vp, struct label *label, int attrnamespace) { struct mac_biba *subj, *obj; @@ -2611,7 +2590,7 @@ } static int -mac_biba_check_vnode_lookup(struct ucred *cred, struct vnode *dvp, +mac_biba_vnode_check_lookup(struct ucred *cred, struct vnode *dvp, struct label *dlabel, struct componentname *cnp) { >>> TRUNCATED FOR MAIL (1000 lines) <<<
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200607081225.k68CPuWi069413>