Skip site navigation (1)Skip section navigation (2)
Date:      Fri, 1 Apr 2005 19:17:18 GMT
From:      Andrew Reisse <areisse@FreeBSD.org>
To:        Perforce Change Reviews <perforce@freebsd.org>
Subject:   PERFORCE change 74303 for review
Message-ID:  <200504011917.j31JHIUI074082@repoman.freebsd.org>

next in thread | raw e-mail | index | archive | help
http://perforce.freebsd.org/chv.cgi?CH=74303

Change 74303 by areisse@areisse_ibook on 2005/04/01 19:16:38

	Bring over changes made in the dsep-20050331 drop.
	See the readme for the major changes.

Affected files ...

.. //depot/projects/trustedbsd/sedarwin7/README#2 integrate
.. //depot/projects/trustedbsd/sedarwin7/VERSION#2 integrate
.. //depot/projects/trustedbsd/sedarwin7/src/darwin/BootX/Makefile.preamble#2 integrate
.. //depot/projects/trustedbsd/sedarwin7/src/darwin/BootX/fcode-to-c.tproj/Makefile.preamble#2 integrate
.. //depot/projects/trustedbsd/sedarwin7/src/darwin/BootX/macho-to-xcoff.tproj/Makefile.preamble#2 integrate
.. //depot/projects/trustedbsd/sedarwin7/src/darwin/Makefile#2 integrate
.. //depot/projects/trustedbsd/sedarwin7/src/darwin/etc/Makefile#2 integrate
.. //depot/projects/trustedbsd/sedarwin7/src/darwin/file_cmds/Makefile#2 integrate
.. //depot/projects/trustedbsd/sedarwin7/src/darwin/file_cmds/ls/ls.c#2 integrate
.. //depot/projects/trustedbsd/sedarwin7/src/darwin/libmac/mac_get.c#2 integrate
.. //depot/projects/trustedbsd/sedarwin7/src/darwin/libmac/mac_set.c#2 integrate
.. //depot/projects/trustedbsd/sedarwin7/src/darwin/mac_cmds/Makefile#2 integrate
.. //depot/projects/trustedbsd/sedarwin7/src/darwin/mac_cmds/getfmac/Makefile#2 integrate
.. //depot/projects/trustedbsd/sedarwin7/src/darwin/mac_cmds/getpmac/Makefile#2 integrate
.. //depot/projects/trustedbsd/sedarwin7/src/darwin/mac_cmds/mexec/Makefile#2 integrate
.. //depot/projects/trustedbsd/sedarwin7/src/darwin/mac_cmds/setfsmac/Makefile#2 integrate
.. //depot/projects/trustedbsd/sedarwin7/src/darwin/mac_cmds/setfsmac/sysqueue.h#2 integrate
.. //depot/projects/trustedbsd/sedarwin7/src/darwin/mac_cmds/setpmac/Makefile#2 integrate
.. //depot/projects/trustedbsd/sedarwin7/src/darwin/mac_cmds/setpmac/setpmac.c#2 integrate
.. //depot/projects/trustedbsd/sedarwin7/src/darwin/mach_cmds/BootstrapDump.c#2 integrate
.. //depot/projects/trustedbsd/sedarwin7/src/darwin/mach_cmds/mgetpmac.c#2 integrate
.. //depot/projects/trustedbsd/sedarwin7/src/darwin/system_cmds/mach_init.tproj/Makefile#2 integrate
.. //depot/projects/trustedbsd/sedarwin7/src/darwin/system_cmds/mach_init.tproj/bootstrap.c#2 integrate
.. //depot/projects/trustedbsd/sedarwin7/src/darwin/xnu/bsd/kern/kern_descrip.c#2 integrate
.. //depot/projects/trustedbsd/sedarwin7/src/darwin/xnu/bsd/kern/posix_sem.c#2 integrate
.. //depot/projects/trustedbsd/sedarwin7/src/darwin/xnu/bsd/kern/posix_shm.c#2 integrate
.. //depot/projects/trustedbsd/sedarwin7/src/darwin/xnu/bsd/kern/sys_socket.c#2 integrate
.. //depot/projects/trustedbsd/sedarwin7/src/darwin/xnu/bsd/kern/uipc_mbuf.c#2 integrate
.. //depot/projects/trustedbsd/sedarwin7/src/darwin/xnu/bsd/kern/uipc_socket.c#2 integrate
.. //depot/projects/trustedbsd/sedarwin7/src/darwin/xnu/bsd/kern/uipc_socket2.c#2 integrate
.. //depot/projects/trustedbsd/sedarwin7/src/darwin/xnu/bsd/kern/uipc_syscalls.c#2 integrate
.. //depot/projects/trustedbsd/sedarwin7/src/darwin/xnu/bsd/kern/uipc_usrreq.c#2 integrate
.. //depot/projects/trustedbsd/sedarwin7/src/darwin/xnu/bsd/netinet/raw_ip.c#2 integrate
.. //depot/projects/trustedbsd/sedarwin7/src/darwin/xnu/bsd/netinet/tcp_input.c#2 integrate
.. //depot/projects/trustedbsd/sedarwin7/src/darwin/xnu/bsd/netinet/tcp_output.c#2 integrate
.. //depot/projects/trustedbsd/sedarwin7/src/darwin/xnu/bsd/netinet/tcp_subr.c#2 integrate
.. //depot/projects/trustedbsd/sedarwin7/src/darwin/xnu/bsd/netinet6/esp_input.c#2 integrate
.. //depot/projects/trustedbsd/sedarwin7/src/darwin/xnu/bsd/netinet6/icmp6.c#2 integrate
.. //depot/projects/trustedbsd/sedarwin7/src/darwin/xnu/bsd/netinet6/ip6_output.c#2 integrate
.. //depot/projects/trustedbsd/sedarwin7/src/darwin/xnu/bsd/netinet6/ipsec.c#2 integrate
.. //depot/projects/trustedbsd/sedarwin7/src/darwin/xnu/bsd/netinet6/raw_ip6.c#2 integrate
.. //depot/projects/trustedbsd/sedarwin7/src/darwin/xnu/bsd/sys/Makefile#2 integrate
.. //depot/projects/trustedbsd/sedarwin7/src/darwin/xnu/bsd/sys/mac.h#2 integrate
.. //depot/projects/trustedbsd/sedarwin7/src/darwin/xnu/bsd/sys/mac_policy.h#2 integrate
.. //depot/projects/trustedbsd/sedarwin7/src/darwin/xnu/bsd/sys/mbuf.h#2 integrate
.. //depot/projects/trustedbsd/sedarwin7/src/darwin/xnu/bsd/sys/posix_sem.h#1 branch
.. //depot/projects/trustedbsd/sedarwin7/src/darwin/xnu/bsd/sys/posix_shm.h#1 branch
.. //depot/projects/trustedbsd/sedarwin7/src/darwin/xnu/bsd/sys/socket.h#2 integrate
.. //depot/projects/trustedbsd/sedarwin7/src/darwin/xnu/bsd/sys/socketvar.h#2 integrate
.. //depot/projects/trustedbsd/sedarwin7/src/darwin/xnu/bsd/sys/vnode.h#2 integrate
.. //depot/projects/trustedbsd/sedarwin7/src/darwin/xnu/bsd/vfs/vfs_vnops.c#2 integrate
.. //depot/projects/trustedbsd/sedarwin7/src/darwin/xnu/osfmk/ipc/ipc_right.c#2 integrate
.. //depot/projects/trustedbsd/sedarwin7/src/darwin/xnu/osfmk/mach/mac.h#2 integrate
.. //depot/projects/trustedbsd/sedarwin7/src/darwin/xnu/security/conf/files#2 integrate
.. //depot/projects/trustedbsd/sedarwin7/src/darwin/xnu/security/mac_base.c#2 integrate
.. //depot/projects/trustedbsd/sedarwin7/src/darwin/xnu/security/mac_internal.h#2 integrate
.. //depot/projects/trustedbsd/sedarwin7/src/darwin/xnu/security/mac_port.c#2 integrate
.. //depot/projects/trustedbsd/sedarwin7/src/darwin/xnu/security/mac_posix_sem.c#1 branch
.. //depot/projects/trustedbsd/sedarwin7/src/darwin/xnu/security/mac_posix_shm.c#1 branch
.. //depot/projects/trustedbsd/sedarwin7/src/darwin/xnu/security/mac_socket.c#1 branch
.. //depot/projects/trustedbsd/sedarwin7/src/darwin/xnu/security/mac_vfs.c#2 integrate
.. //depot/projects/trustedbsd/sedarwin7/src/mac_mls/mac_mls.c#2 integrate
.. //depot/projects/trustedbsd/sedarwin7/src/mac_stub/mac_stub.c#2 integrate
.. //depot/projects/trustedbsd/sedarwin7/src/mactest/mac_test.c#2 integrate
.. //depot/projects/trustedbsd/sedarwin7/src/sedarwin/Makefile#2 integrate
.. //depot/projects/trustedbsd/sedarwin7/src/sedarwin/libsedarwin/Makefile#2 integrate
.. //depot/projects/trustedbsd/sedarwin7/src/sedarwin/policy/Makefile#2 integrate
.. //depot/projects/trustedbsd/sedarwin7/src/sedarwin/programs/Makefile#2 integrate
.. //depot/projects/trustedbsd/sedarwin7/src/sedarwin/programs/checkpolicy/Makefile#2 integrate
.. //depot/projects/trustedbsd/sedarwin7/src/sedarwin/programs/loadpolicy/Makefile#2 integrate
.. //depot/projects/trustedbsd/sedarwin7/src/sedarwin/programs/newrole/Makefile#2 integrate
.. //depot/projects/trustedbsd/sedarwin7/src/sedarwin/programs/wslogin/Makefile#2 integrate
.. //depot/projects/trustedbsd/sedarwin7/src/stacktrace/commands/Makefile#2 integrate
.. //depot/projects/trustedbsd/sedarwin7/src/stacktrace/commands/save_trace/Makefile#2 integrate
.. //depot/projects/trustedbsd/sedarwin7/src/stacktrace/commands/sec_trace/Makefile#2 integrate

Differences ...

==== //depot/projects/trustedbsd/sedarwin7/README#2 (text+ko) ====

@@ -46,7 +46,35 @@
     - Enhancements to the BootX boot loader and XNU kernel extension
       linker to support the loading of policy KEXTs earlier in the
       boot sequence.
+    - Modifications to mach_init to help bootstrap the mac_mls policy;
+      this is only a temporary measure until the login modifications
+      are complete.
+
+
+New Features in the 20050331 release
+====================================
+
+    - Support labelling and access control for Posix IPC (semaphores
+      and shared memory). This includes support for Posix IPC in mls and
+      stub policies.
+
+    - Modifications to the Darwin kernel to assign labels to
+      sockets and other supporting IPv4 data structures, and the
+      addition of access control checks to socket-related operations.
+      Extensions to the MAC Framework to permit policy modules to
+      implement these entry points.
+
+    - Build improvements to convert all remaining BSD Makefiles to GNU
+      Makefiles.  The build is further isolated; it no longer builds
+      and installs BootX tools in the user's home directory.  The
+      mach_init program was added to the installation.
 
+    - Modified Darwin kernel with additional experimental labeling and
+      access control for Mach IPC.  Prototype modifications to the MLS
+      policy to control information flow via Mach IPC.
+
+    - Additional maturing in VFS security; in particular, vn_read,
+      vn_write, and vn_rdwr access controls were changed.
 
 New Features in Drop 5
 ======================

==== //depot/projects/trustedbsd/sedarwin7/VERSION#2 (text+ko) ====

@@ -1,6 +1,4 @@
-Code Drop 5
-December 17, 2004
+Code Drop dsep-20050331
+March 31, 2005
 
-src		@1501
-docs		@1501
-testbed		@1501
+src		@1896

==== //depot/projects/trustedbsd/sedarwin7/src/darwin/BootX/Makefile.preamble#2 (text+ko) ====

@@ -1,3 +1,4 @@
+include ../../Makeconfig
 INCLUDED_ARCHS = ppc
 OTHER_RECURSIVE_VARIABLES += INCLUDED_ARCHS
 
@@ -139,4 +140,4 @@
 # Change this definition to install projects somewhere other than the
 # standard locations.  NEXT_ROOT defaults to "C:/Apple" on Windows systems
 # and "" on other systems.
-DSTROOT = $(HOME)
+DSTROOT = $(DARWIN_ROOT)

==== //depot/projects/trustedbsd/sedarwin7/src/darwin/BootX/fcode-to-c.tproj/Makefile.preamble#2 (text+ko) ====

@@ -1,3 +1,4 @@
+include ../../../Makeconfig
 ###############################################################################
 #  Makefile.preamble
 #  Copyright 1997, Apple Computer, Inc.
@@ -134,4 +135,4 @@
 # Change this definition to install projects somewhere other than the
 # standard locations.  NEXT_ROOT defaults to "C:/Apple" on Windows systems
 # and "" on other systems.
-DSTROOT = $(HOME)
+DSTROOT = $(DARWIN_ROOT)

==== //depot/projects/trustedbsd/sedarwin7/src/darwin/BootX/macho-to-xcoff.tproj/Makefile.preamble#2 (text+ko) ====

@@ -1,3 +1,4 @@
+include ../../../Makeconfig
 ###############################################################################
 #  Makefile.preamble
 #  Copyright 1997, Apple Computer, Inc.
@@ -134,4 +135,4 @@
 # Change this definition to install projects somewhere other than the
 # standard locations.  NEXT_ROOT defaults to "C:/Apple" on Windows systems
 # and "" on other systems.
-DSTROOT = $(HOME)
+DSTROOT = $(DARWIN_ROOT)

==== //depot/projects/trustedbsd/sedarwin7/src/darwin/Makefile#2 (text+ko) ====

@@ -10,12 +10,13 @@
 	cd libextattr && gnumake
 	cd libmac && gnumake
 	cd adv_cmds/ps.tproj && gnumake
-	cd etc && bsdmake
+	cd etc && gnumake
 	cd extattr_cmds && make
-	cd mac_cmds && bsdmake
-	cd file_cmds && bsdmake
+	cd mac_cmds && gnumake
+	cd file_cmds && gnumake
 	cd mach_cmds && gnumake
 	cd top && make
+	cd system_cmds/mach_init.tproj && gnumake
 
 #	bootstrap_cmds
 
@@ -28,12 +29,13 @@
 	cd libextattr && gnumake install
 	cd libmac && gnumake install
 	cd adv_cmds/ps.tproj && gnumake install
-	cd etc && bsdmake install
+	cd etc && gnumake install
 	cd extattr_cmds && make install
-	cd mac_cmds && bsdmake install
-	cd file_cmds && bsdmake install
+	cd mac_cmds && gnumake install
+	cd file_cmds && gnumake install
 	cd mach_cmds && gnumake install
 	cd top && make install
+	cd system_cmds/mach_init.tproj && gnumake install
 
 clean:
 	rm -rf xnu/BUILD
@@ -45,12 +47,13 @@
 	cd libextattr && gnumake clean
 	cd libmac && gnumake clean
 	cd adv_cmds/ps.tproj && gnumake clean
-	cd etc && bsdmake clean
+	cd etc && gnumake clean
 	cd extattr_cmds && make clean
-	cd mac_cmds && bsdmake clean
-	cd file_cmds && bsdmake clean
+	cd mac_cmds && gnumake clean
+	cd file_cmds && gnumake clean
 	cd mach_cmds && gnumake clean
 	cd top && make clean
+	cd system_cmds/mach_init.tproj && gnumake clean
 
 #ifndef DARWIN_ROOT
 #    $(error DARWIN_ROOT is not defined in Makeconfig)

==== //depot/projects/trustedbsd/sedarwin7/src/darwin/etc/Makefile#2 (text+ko) ====

@@ -1,11 +1,13 @@
 include ../../Makeconfig
 
 ETCFILES= mac.conf
+INSTALL= install
+
+all:
 
 install:
-	cd ${.CURDIR}; \
+	cd ${CURDIR}; \
 		${INSTALL} -o ${BINOWN} -g ${BINGRP} -m 644 \
 		$(ETCFILES) ${DESTDIR}/private/etc; 
 
-
-.include <bsd.prog.mk>
+clean:

==== //depot/projects/trustedbsd/sedarwin7/src/darwin/file_cmds/Makefile#2 (text+ko) ====

@@ -1,7 +1,13 @@
 include ../../Makeconfig
 
-SUBDIR= ls
+.PHONY: install
+
+all:
+	cd ls && gnumake
+
+install:
+	cd ls && gnumake install
 
-MAKE=gnumake
+clean:
+	cd ls && gnumake clean
 
-.include <bsd.subdir.mk>

==== //depot/projects/trustedbsd/sedarwin7/src/darwin/file_cmds/ls/ls.c#2 (text+ko) ====

@@ -593,7 +593,6 @@
 				if (f_flags) {
 					np->flags = &np->data[ulen + glen + 2];
 					(void)strcpy(np->flags, flags);
-					free(flags);
 				}
 				if (f_label) {
 					np->label = &np->data[ulen + glen + 2

==== //depot/projects/trustedbsd/sedarwin7/src/darwin/libmac/mac_get.c#2 (text+ko) ====

@@ -33,6 +33,7 @@
 
 #include <sys/syscall.h>
 #include <sys/types.h>
+#include <sys/socket.h>
 #include <sys/mac.h>
 #include <errno.h>
 
@@ -40,7 +41,7 @@
 mac_get_fd(int fd, struct mac *label)
 {
 
-	return (ENOSYS);
+	return (syscall(SYS___mac_get_fd, fd, label));
 }
 
 int
@@ -70,3 +71,12 @@
 
 	return (syscall(SYS___mac_get_proc, label));
 }
+
+int
+mac_get_peer(int fd, struct mac *label)
+{
+	socklen_t len;
+
+	len = sizeof(*label);
+	return (getsockopt(fd, SOL_SOCKET, SO_PEERLABEL, label, &len));
+}

==== //depot/projects/trustedbsd/sedarwin7/src/darwin/libmac/mac_set.c#2 (text+ko) ====

@@ -40,7 +40,7 @@
 mac_set_fd(int fd, struct mac *label)
 {
 
-	return (ENOSYS);
+	return (syscall(SYS___mac_set_fd, fd, label));
 }
 
 int

==== //depot/projects/trustedbsd/sedarwin7/src/darwin/mac_cmds/Makefile#2 (text+ko) ====

@@ -1,9 +1,22 @@
 include ../../Makeconfig
 
-SUBDIR= getfmac \
-	getpmac \
-	mexec \
-	setfsmac \
-	setpmac
+all:
+	cd getfmac && gnumake
+	cd getpmac && gnumake
+	cd mexec && gnumake
+	cd setfsmac && gnumake
+	cd setpmac && gnumake
+
+install:
+	cd getfmac && gnumake install
+	cd getpmac && gnumake install
+	cd mexec && gnumake install
+	cd setfsmac && gnumake install
+	cd setpmac && gnumake install
 
-.include <bsd.subdir.mk>+clean:
+	cd getfmac && gnumake clean
+	cd getpmac && gnumake clean
+	cd mexec && gnumake clean
+	cd setfsmac && gnumake clean
+	cd setpmac && gnumake clean

==== //depot/projects/trustedbsd/sedarwin7/src/darwin/mac_cmds/getfmac/Makefile#2 (text+ko) ====

@@ -3,7 +3,19 @@
 PROG= getfmac
 MAN8= getfmac.8
 
+OBJS= getfmac.o
+
 CFLAGS+= $(DARWIN_HDRS)
 LDADD+= $(LIBMAC)
 
-.include <bsd.prog.mk>
+all: $(PROG)
+
+$(PROG): $(OBJS)
+	$(CC) $(CFLAGS) -o $@ $^ $(LDADD)
+
+install: $(PROG)
+	install -m 555 $(PROG) $(DESTDIR)/usr/bin
+	install -m 444 $(MAN8) $(DESTDIR)/usr/share/man/man8
+
+clean:
+	rm -f $(OBJS) $(PROG)

==== //depot/projects/trustedbsd/sedarwin7/src/darwin/mac_cmds/getpmac/Makefile#2 (text+ko) ====

@@ -3,7 +3,19 @@
 PROG= getpmac
 MAN8= getpmac.8
 
+OBJS= getpmac.o
+
 CFLAGS+= $(DARWIN_HDRS)
 LDADD+= $(LIBMAC)
 
-.include <bsd.prog.mk>
+all: $(PROG)
+
+$(PROG): $(OBJS)
+	$(CC) $(CFLAGS) -o $@ $^ $(LDADD)
+
+install: $(PROG)
+	install -m 555 $(PROG) $(DESTDIR)/usr/bin
+	install -m 444 $(MAN8) $(DESTDIR)/usr/share/man/man8
+
+clean:
+	rm -f $(PROG) $(OBJS)

==== //depot/projects/trustedbsd/sedarwin7/src/darwin/mac_cmds/mexec/Makefile#2 (text+ko) ====

@@ -3,7 +3,18 @@
 PROG= mexec
 NOMAN=
 
+OBJS= mexec.o
+
 CFLAGS+= $(DARWIN_HDRS)
 LDADD+= $(LIBMAC)
 
-.include <bsd.prog.mk>
+all: $(PROG)
+
+$(PROG): $(OBJS)
+	$(CC) $(CFLAGS) -o $@ $^ $(LDADD)
+
+install: $(PROG)
+	install -m 555 $(PROG) $(DESTDIR)/usr/bin
+
+clean:
+	rm -f $(PROG) $(OBJS)

==== //depot/projects/trustedbsd/sedarwin7/src/darwin/mac_cmds/setfsmac/Makefile#2 (text+ko) ====

@@ -3,8 +3,22 @@
 PROG= setfsmac
 MAN8= setfsmac.8 setfmac.8
 
+OBJS= setfsmac.o
+
 CFLAGS+= $(DARWIN_HDRS)
 LDADD+= $(LIBMAC)
-LINKS+= $(BINDIR)/setfsmac $(BINDIR)/setfmac
+LINKS+= $(DESTDIR)/usr/bin/setfsmac $(DESTDIR)/usr/bin/setfmac
+
+all: $(PROG)
+
+$(PROG): $(OBJS)
+	$(CC) $(CFLAGS) -o $@ $^ $(LDADD)
+
+install: $(PROG)
+	install -m 555 $(PROG) $(DESTDIR)/usr/bin
+	ln -f $(LINKS)
+	install -m 444 $(MAN8) $(DESTDIR)/usr/share/man/man8
+
+clean:
+	rm -f $(PROG) $(OBJS)
 
-.include <bsd.prog.mk>

==== //depot/projects/trustedbsd/sedarwin7/src/darwin/mac_cmds/setfsmac/sysqueue.h#2 (text+ko) ====

@@ -34,8 +34,8 @@
  * $FreeBSD: src/sys/sys/queue.h,v 1.54 2002/08/05 05:18:43 alfred Exp $
  */
 
-#ifndef _SYS_QUEUE_H_
-#define	_SYS_QUEUE_H_
+#ifndef _SYSQUEUE_H_
+#define	_SYSQUEUE_H_
 
 #include <sys/cdefs.h>
 
@@ -526,4 +526,4 @@
 
 #endif /* _KERNEL */
 
-#endif /* !_SYS_QUEUE_H_ */
+#endif /* _SYSQUEUE_H_ */

==== //depot/projects/trustedbsd/sedarwin7/src/darwin/mac_cmds/setpmac/Makefile#2 (text+ko) ====

@@ -3,7 +3,19 @@
 PROG= setpmac
 MAN8= setpmac.8
 
+OBJS= setpmac.o
+
 CFLAGS+= $(DARWIN_HDRS)
 LDADD+= $(LIBMAC)
 
-.include <bsd.prog.mk>
+all: $(PROG)
+
+$(PROG): $(OBJS)
+	$(CC) $(CFLAGS) -o $@ $^ $(LDADD)
+
+install: $(PROG)
+	install -m 555 $(PROG) $(DESTDIR)/usr/bin
+	install -m 444 $(MAN8) $(DESTDIR)/usr/share/man/man8
+
+clean:
+	rm -f $(PROG) $(OBJS)

==== //depot/projects/trustedbsd/sedarwin7/src/darwin/mac_cmds/setpmac/setpmac.c#2 (text+ko) ====

@@ -62,7 +62,7 @@
 	int error;
 
 
-	if (argc < 3)
+	if (argc < 2)
 		usage();
 
 	error = mac_from_text(&label, argv[1]);

==== //depot/projects/trustedbsd/sedarwin7/src/darwin/mach_cmds/BootstrapDump.c#2 (text+ko) ====

@@ -70,7 +70,7 @@
     fprintf(stderr, "%s: Usage: BootstrapPortDump [ pid ]\n", gProgramName);
 }
 
-static const char *policies = "sebsd,ipctrace";
+static const char *policies = "?sebsd,?ipctrace,?mls";
 
 int main (int argc, const char * argv[]) 
 {

==== //depot/projects/trustedbsd/sedarwin7/src/darwin/mach_cmds/mgetpmac.c#2 (text+ko) ====

@@ -42,7 +42,7 @@
 {
 	mach_port_t tp;
 	char label[512];
-	char *policies = "sebsd";
+	char *policies = "?sebsd,?ipctrace,?mls";
 
 	if (argc > 1)
 		task_for_pid(mach_task_self(), strtol(argv[1], NULL, 10), &tp);

==== //depot/projects/trustedbsd/sedarwin7/src/darwin/system_cmds/mach_init.tproj/Makefile#2 (text+ko) ====

@@ -7,6 +7,8 @@
 # and Makefile.postamble (both optional), and Makefile will include them.
 #
 
+include ../../../Makeconfig
+
 NAME = mach_init
 
 PROJECTVERSION = 2.8
@@ -26,7 +28,8 @@
 NEXTSTEP_INSTALLDIR = /sbin
 WINDOWS_INSTALLDIR = /sbin
 PDO_UNIX_INSTALLDIR = /sbin
-LIBS = 
+OTHER_CFLAGS= -I$(EXPORT_HDRS)/bsd -I$(EXPORT_HDRS)/osfmk -I$(EXPORT_HDRS)
+LIBS = $(LIBMAC)
 DEBUG_LIBS = $(LIBS)
 PROF_LIBS = $(LIBS)
 
@@ -36,7 +39,7 @@
 PDO_UNIX_PB_CFLAGS = -DMACH_USER_API
 
 
-NEXTSTEP_BUILD_OUTPUT_DIR = /tmp/$(USER)/BUILD
+NEXTSTEP_BUILD_OUTPUT_DIR = 
 
 NEXTSTEP_OBJCPLUS_COMPILER = /usr/bin/cc
 WINDOWS_OBJCPLUS_COMPILER = $(DEVDIR)/gcc

==== //depot/projects/trustedbsd/sedarwin7/src/darwin/system_cmds/mach_init.tproj/bootstrap.c#2 (text+ko) ====

@@ -43,6 +43,7 @@
 #include <mach/host_info.h>
 #include <mach/mach_host.h>
 #include <mach/exception.h>
+#include <sys/mac.h>
 
 #import <sys/ioctl.h>
 #import <sys/types.h>
@@ -254,6 +255,10 @@
 				ioctl(fd, TIOCNOTTY, 0);
 				close(fd);
 			}
+
+			mac_t mac;
+			if (!mac_from_text(&mac, "mls/low(low-high)"))
+				mac_set_proc(mac);
 			
 			/* pass our arguments on to init */
 			argv[0] = INIT_PATH;
@@ -813,6 +818,10 @@
 	sigemptyset(&mask);
 	(void) sigprocmask(SIG_SETMASK, &mask, (sigset_t *)NULL);
 
+	mac_t mac;
+	if (!mac_from_text(&mac, "mls/low(low-high)"))
+		mac_set_proc(mac);
+
 	execv(argv[0], argv);
 	unix_fatal("Disabled server %x bootstrap %x: \"%s\": exec()",
 			   serverp->port,

==== //depot/projects/trustedbsd/sedarwin7/src/darwin/xnu/bsd/kern/kern_descrip.c#2 (text+ko) ====

@@ -257,6 +257,12 @@
 		return (EBADF);
 	pop = &fdp->fd_ofileflags[fd];
 
+#ifdef MAC
+	error = mac_check_fcntl(p->p_ucred, fdp, uap->cmd, uap->arg);
+	if (error)
+		return (error);
+#endif 
+
 	switch (uap->cmd) {
 
 	case F_DUPFD:
@@ -733,7 +739,7 @@
 		break;
 
 	case DTYPE_PSXSHM:
-		error = pshm_stat((void *)fp->f_data, &ub);
+		error = pshm_stat((void *)fp->f_data, &ub, p);
 		break;
 
 	case DTYPE_KQUEUE:

==== //depot/projects/trustedbsd/sedarwin7/src/darwin/xnu/bsd/kern/posix_sem.c#2 (text+ko) ====

@@ -61,30 +61,8 @@
 #include <kern/task.h>
 #include <kern/clock.h>
 #include <mach/kern_return.h>
-
-#define	PSEMNAMLEN	31	/* maximum name segment length we bother with */
-
-struct pseminfo {
-	unsigned int	psem_flags;
-	unsigned int	psem_usecount;
-	mode_t		psem_mode;
-	uid_t		psem_uid;
-	gid_t		psem_gid;
-	char		psem_name[PSEMNAMLEN + 1];	/* segment name */
-	void *		psem_semobject;
-	struct proc *	sem_proc;
-};
-#define PSEMINFO_NULL (struct pseminfo *)0
+#include <sys/posix_sem.h>
 
-#define	PSEM_NONE	1
-#define	PSEM_DEFINED	2
-#define	PSEM_ALLOCATED	4
-#define	PSEM_MAPPED	8
-#define	PSEM_INUSE	0x10
-#define	PSEM_REMOVED	0x20
-#define	PSEM_INCREATE	0x40
-#define	PSEM_INDELETE	0x80
-
 struct	psemcache {
 	LIST_ENTRY(psemcache) psem_hash;	/* hash chain */
 	struct	pseminfo *pseminfo;		/* vnode the name refers to */
@@ -424,6 +402,15 @@
 		pinfo->psem_flags &= ~PSEM_DEFINED;
 		pinfo->psem_flags |= PSEM_ALLOCATED;
 		pinfo->sem_proc = p;
+#ifdef MAC
+		mac_init_posix_sem(pinfo);
+
+		error = mac_check_posix_sem_create(p->p_ucred, nameptr);
+		if (error)
+			goto bad2;
+
+		mac_create_posix_sem(p->p_ucred, pinfo, nameptr);
+#endif
 	} else {
 		/* semaphore should exist as it is without  O_CREAT */
 		if (!incache) {
@@ -433,7 +420,11 @@
 		if( pinfo->psem_flags & PSEM_INDELETE) {
 			error = ENOENT;
 			goto bad1;
-		}	
+		}
+#ifdef MAC	
+		if (error = mac_check_posix_sem_open(p->p_ucred, pinfo))
+			goto bad1;
+#endif
 		if (error = psem_access(pinfo, fmode, p->p_ucred, p))
 			goto bad1;
 	}
@@ -469,8 +460,12 @@
 	goto bad1;
 bad2:
 	_FREE(pnode, M_SHM);
-	if (pinfo_alloc)
+	if (pinfo_alloc) {
+#ifdef MAC
+		mac_destroy_posix_sem(pinfo);
+#endif
 		_FREE(pinfo, M_SHM);
+	}
 bad1:
 	fdrelse(p, indx);
 	ffree(nfp);
@@ -602,6 +597,11 @@
 		goto bad;
 	} else
 		incache = 1;
+#ifdef MAC
+	error = mac_check_posix_sem_unlink(p->p_ucred, pinfo, nameptr);
+	if (error)
+		goto bad;
+#endif
 	if (error = psem_access(pinfo, pinfo->psem_mode, p->p_ucred, p))
 		goto bad;
 
@@ -686,6 +686,11 @@
 			!= PSEM_ALLOCATED) {
 		return(EINVAL);
 	}
+#ifdef MAC
+	error = mac_check_posix_sem_wait(p->p_ucred, pinfo);
+	if (error)
+		return (error);
+#endif
 
 	kret = semaphore_wait(pinfo->psem_semobject);
 	switch (kret) {
@@ -733,6 +738,11 @@
 			!= PSEM_ALLOCATED) {
 		return(EINVAL);
 	}
+#ifdef MAC
+	error = mac_check_posix_sem_wait(p->p_ucred, pinfo);
+	if (error)
+		return (error);
+#endif
 
 	wait_time.tv_sec = 0;
 	wait_time.tv_nsec = 0;
@@ -783,6 +793,11 @@
 			!= PSEM_ALLOCATED) {
 		return(EINVAL);
 	}
+#ifdef MAC
+	error = mac_check_posix_sem_post(p->p_ucred, pinfo);
+	if (error)
+		return (error);
+#endif
 
 	kret = semaphore_signal(pinfo->psem_semobject);
 	switch (kret) {
@@ -890,6 +905,10 @@
 
 	kret = semaphore_destroy(kernel_task, pinfo->psem_semobject);
 
+#ifdef MAC
+	mac_destroy_posix_sem(pinfo);
+#endif
+
 	switch (kret) {
 	case KERN_INVALID_ADDRESS:
 	case KERN_PROTECTION_FAILURE:

==== //depot/projects/trustedbsd/sedarwin7/src/darwin/xnu/bsd/kern/posix_shm.c#2 (text+ko) ====

@@ -60,36 +60,8 @@
 #include <mach/vm_inherit.h>
 #include <mach/kern_return.h>
 #include <mach/memory_object_control.h>
-
-
-#define	PSHMNAMLEN	31	/* maximum name segment length we bother with */
-
-struct pshminfo {
-	unsigned int	pshm_flags;
-	unsigned int	pshm_usecount;
-	off_t		pshm_length;
-	mode_t		pshm_mode;
-	uid_t		pshm_uid;
-	gid_t		pshm_gid;
-	char		pshm_name[PSHMNAMLEN + 1];	/* segment name */
-	void *		pshm_memobject;
-#if DIAGNOSTIC
-	unsigned int 	pshm_readcount;
-	unsigned int 	pshm_writecount;
-	struct proc *	pshm_proc;
-#endif /* DIAGNOSTIC */
-};
-#define PSHMINFO_NULL (struct pshminfo *)0
+#include <sys/posix_shm.h>
 
-#define	PSHM_NONE	1
-#define	PSHM_DEFINED	2
-#define	PSHM_ALLOCATED	4
-#define	PSHM_MAPPED	8
-#define	PSHM_INUSE	0x10
-#define	PSHM_REMOVED	0x20
-#define	PSHM_INCREATE	0x40
-#define	PSHM_INDELETE	0x80
-
 struct	pshmcache {
 	LIST_ENTRY(pshmcache) pshm_hash;	/* hash chain */
 	struct	pshminfo *pshminfo;		/* vnode the name refers to */
@@ -417,12 +389,25 @@
                     pinfo->pshm_mode = cmode;
                     pinfo->pshm_uid = p->p_ucred->cr_uid;
                     pinfo->pshm_gid = p->p_ucred->cr_gid;
+#ifdef MAC
+		    mac_init_posix_shm(pinfo);
+
+		    error = mac_check_posix_shm_create(p->p_ucred, nameptr);
+		    if (error)
+			goto bad2;
+
+		    mac_create_posix_shm(p->p_ucred, pinfo, nameptr);
+#endif
                 } else {
                     /*  already exists */
                         if( pinfo->pshm_flags & PSHM_INDELETE) {
                             error = ENOENT;
                             goto bad1;
                         }	
+#ifdef MAC	
+			if (error = mac_check_posix_shm_open(p->p_ucred, pinfo))
+				goto bad1;
+#endif
                         if (error = pshm_access(pinfo, fmode, p->p_ucred, p))
                             goto bad1;
                 }
@@ -436,6 +421,10 @@
 			error = ENOENT;
 			goto bad1;
 		}	
+#ifdef MAC	
+		if (error = mac_check_posix_shm_open(p->p_ucred, pinfo))
+			goto bad1;
+#endif
 		if (error = pshm_access(pinfo, fmode, p->p_ucred, p))
 			goto bad1;
 	}
@@ -472,8 +461,12 @@
 	_FREE(pnode, M_SHM);
 		
 bad2:
-	if (pinfo_alloc)
+	if (pinfo_alloc) {
+#ifdef MAC
+		mac_destroy_posix_shm(pinfo);
+#endif
 		_FREE(pinfo, M_SHM);
+	}
 bad1:
 	fdrelse(p, indx);
 	ffree(nfp);
@@ -515,6 +508,13 @@
 	}
 
 	size = round_page_64(length);
+
+#ifdef MAC
+	int error = mac_check_posix_shm_truncate(p->p_ucred, pinfo, size);
+	if (error)
+		return(error);
+#endif
+
 	kret = vm_allocate(current_map(), &user_addr, size, TRUE);
 	if (kret != KERN_SUCCESS) 
 		goto out;
@@ -547,15 +547,22 @@
 }
 
 int
-pshm_stat(pnode, sb)
+pshm_stat(pnode, sb, p)
 struct pshmnode *pnode;
 struct stat *sb;
+struct proc *p;
 {
 	struct pshminfo *pinfo;
 	
 	if ((pinfo = pnode->pinfo) == PSHMINFO_NULL)
 		return(EINVAL);
 
+#ifdef MAC
+	int error = mac_check_posix_shm_stat(p->p_ucred, pinfo);
+	if (error)
+		return(error);
+#endif
+
 	bzero(sb, sizeof(struct stat)); 
 	sb->st_mode = pinfo->pshm_mode;
 	sb->st_uid = pinfo->pshm_uid;
@@ -663,7 +670,12 @@
 		return(EINVAL);
 	}
 
-	
+#ifdef MAC
+	int error = mac_check_posix_shm_mmap(p->p_ucred, pinfo, prot, flags);
+	if (error)
+		return(error);
+#endif
+
 	user_map = current_map();
 
 	if ((flags & MAP_FIXED) == 0) {
@@ -794,6 +806,12 @@
 		return (EINVAL);
 	}
 
+#ifdef MAC
+	error = mac_check_posix_shm_unlink(p->p_ucred, pinfo, nameptr);
+	if (error)
+		goto bad;
+#endif
+
 	if (pinfo->pshm_flags & PSHM_INDELETE) {
 		error = 0;
 		goto bad;
@@ -849,6 +867,9 @@
 	pinfo->pshm_usecount--;
 
  	if ((pinfo->pshm_flags & PSHM_REMOVED) && !pinfo->pshm_usecount) {
+#ifdef MAC
+		mac_destroy_posix_shm(pinfo);
+#endif
 		_FREE(pinfo,M_SHM);
 	}
 	_FREE(pnode, M_SHM);

==== //depot/projects/trustedbsd/sedarwin7/src/darwin/xnu/bsd/kern/sys_socket.c#2 (text+ko) ====

@@ -104,6 +104,9 @@
 			       struct mbuf **controlp, int *flagsp));
 
 
+#ifdef MAC
+	int error;
+#endif 
 	thread_funnel_switch(KERNEL_FUNNEL, NETWORK_FUNNEL);
 
         if ((so = (struct socket *)fp->f_data) == NULL) {
@@ -112,6 +115,13 @@
                 return (EBADF);
         }
 
+#ifdef MAC
+	error = mac_check_socket_receive(p->p_ucred, so);
+	if (error) {
+		thread_funnel_switch(NETWORK_FUNNEL, KERNEL_FUNNEL);
+		return (error);
+	}
+#endif
 	fsoreceive = so->so_proto->pr_usrreqs->pru_soreceive;
 	if (fsoreceive != soreceive)
 	{	kp = sotokextcb(so);
@@ -144,6 +154,9 @@
 				struct mbuf *control, int flags));
 	struct kextcb *kp;
 	int           stat;
+#ifdef MAC
+	int error;
+#endif
 
 	thread_funnel_switch(KERNEL_FUNNEL, NETWORK_FUNNEL);
 
@@ -153,6 +166,13 @@
                 return (EBADF);
         }
 
+#ifdef MAC
+	error = mac_check_socket_send(p->p_ucred, so);
+	if (error) {
+		thread_funnel_switch(NETWORK_FUNNEL, KERNEL_FUNNEL);
+		return (error);
+	}
+#endif
 	fsosend = so->so_proto->pr_usrreqs->pru_sosend;
 	if (fsosend != sosend)
 	{	kp = sotokextcb(so);
@@ -398,12 +418,25 @@
 	register struct stat *ub;
 {
 	int stat;
+#ifdef MAC
+	struct proc *p;
+#endif
 
 	/*
 	 * DANGER: by the time we get the network funnel the socket 
 	 * may have been closed
 	 */
+#ifdef MAC
+	p = current_proc();
+#endif
 	thread_funnel_switch(KERNEL_FUNNEL, NETWORK_FUNNEL);
+#ifdef MAC
+	stat = mac_check_socket_stat(p->p_ucred, so);

>>> TRUNCATED FOR MAIL (1000 lines) <<<



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200504011917.j31JHIUI074082>