diff options
author | rwatson <rwatson@FreeBSD.org> | 2002-11-01 20:46:53 +0000 |
---|---|---|
committer | rwatson <rwatson@FreeBSD.org> | 2002-11-01 20:46:53 +0000 |
commit | 61ffc1b9bb50dc9c580972208b4348cee6d2ad63 (patch) | |
tree | 2efddbff8b3c159870d2afbb85c9b4a531dcf1fe /sys/kern/kern_environment.c | |
parent | 78a117472a62ba8826a9d70ed969f873f8d41715 (diff) | |
download | FreeBSD-src-61ffc1b9bb50dc9c580972208b4348cee6d2ad63.zip FreeBSD-src-61ffc1b9bb50dc9c580972208b4348cee6d2ad63.tar.gz |
Add MAC checks for various kenv() operations: dump, get, set, unset,
permitting MAC policies to limit access to the kernel environment.
Obtained from: TrustedBSD Project
Sponsored by: DARPA, Network Associates Laboratories
Diffstat (limited to 'sys/kern/kern_environment.c')
-rw-r--r-- | sys/kern/kern_environment.c | 24 |
1 files changed, 23 insertions, 1 deletions
diff --git a/sys/kern/kern_environment.c b/sys/kern/kern_environment.c index e4d308b..04f00c3 100644 --- a/sys/kern/kern_environment.c +++ b/sys/kern/kern_environment.c @@ -36,11 +36,14 @@ * the kernel. */ +#include "opt_mac.h" + #include <sys/types.h> #include <sys/param.h> #include <sys/proc.h> #include <sys/queue.h> #include <sys/lock.h> +#include <sys/mac.h> #include <sys/malloc.h> #include <sys/mutex.h> #include <sys/kernel.h> @@ -90,6 +93,11 @@ kenv(td, uap) error = 0; if (SCARG(uap, what) == KENV_DUMP) { +#ifdef MAC + error = mac_check_kenv_dump(td->td_ucred); + if (error) + return (error); +#endif len = 0; /* Return the size if called with a NULL buffer */ if (SCARG(uap, value) == NULL) { @@ -131,6 +139,11 @@ kenv(td, uap) switch (SCARG(uap, what)) { case KENV_GET: +#ifdef MAC + error = mac_check_kenv_get(td->td_ucred, name); + if (error) + goto done; +#endif value = getenv(name); if (value == NULL) { error = ENOENT; @@ -159,10 +172,19 @@ kenv(td, uap) free(value, M_TEMP); goto done; } - setenv(name, value); +#ifdef MAC + error = mac_check_kenv_set(td->td_ucred, name, value); + if (error == 0) +#endif + setenv(name, value); free(value, M_TEMP); break; case KENV_UNSET: +#ifdef MAC + error = mac_check_kenv_unset(td->td_ucred, name); + if (error) + goto done; +#endif error = unsetenv(name); if (error) error = ENOENT; |