Hook up mac_check_system_reboot(), a MAC Framework entry point that

permits MAC modules to augment system security decisions regarding
the reboot() system call, if MAC is compiled into the kernel.

Approved by:	re
Obtained from:	TrustedBSD Project
Sponsored by:	DARPA, Network Associates Laboratories

1 files changed, 23 insertions, 0 deletions

diff --git a/sys/kern/kern_mac.c b/sys/kern/kern_mac.c
index b757be6..00ecd04 100644
--- a/sys/kern/kern_mac.c
+++ b/sys/kern/kern_mac.c
@@ -141,6 +141,11 @@ SYSCTL_INT(_security_mac, OID_AUTO, enforce_process, CTLFLAG_RW,
     &mac_enforce_process, 0, "Enforce MAC policy on inter-process operations");
 TUNABLE_INT("security.mac.enforce_process", &mac_enforce_process);
 
+static int	mac_enforce_reboot = 1;
+SYSCTL_INT(_security_mac, OID_AUTO, enforce_reboot, CTLFLAG_RW,
+    &mac_enforce_reboot, 0, "Enforce MAC policy for reboot operations");
+TUNABLE_INT("security.mac.enforce_reboot", &mac_enforce_reboot);
+
 static int	mac_enforce_socket = 1;
 SYSCTL_INT(_security_mac, OID_AUTO, enforce_socket, CTLFLAG_RW,
     &mac_enforce_socket, 0, "Enforce MAC policy on socket operations");
@@ -899,6 +904,10 @@ mac_policy_register(struct mac_policy_conf *mpc)
 			mpc->mpc_ops->mpo_check_socket_visible =
 			    mpe->mpe_function;
 			break;
+		case MAC_CHECK_SYSTEM_REBOOT:
+			mpc->mpc_ops->mpo_check_system_reboot =
+			    mpe->mpe_function;
+			break;
 		case MAC_CHECK_SYSTEM_SWAPON:
 			mpc->mpc_ops->mpo_check_system_swapon =
 			    mpe->mpe_function;
@@ -2997,6 +3006,20 @@ mac_check_socket_visible(struct ucred *cred, struct socket *socket)
 }
 
 int
+mac_check_system_reboot(struct ucred *cred, int howto)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_system_reboot");
+
+	if (!mac_enforce_reboot)
+		return (0);
+
+	MAC_CHECK(check_system_reboot, cred, howto);
+	return (error);
+}
+
+int
 mac_check_system_swapon(struct ucred *cred, struct vnode *vp)
 {
 	int error;