diff options
| author | rwatson <rwatson@FreeBSD.org> | 2002-10-22 15:53:43 +0000 |
|---|---|---|
| committer | rwatson <rwatson@FreeBSD.org> | 2002-10-22 15:53:43 +0000 |
| commit | e40371a8f9cbd7883a102e631ee83a6209a1ca2c (patch) | |
| tree | 6a24bba13df50f300ec31a1b71f9ed5936c155b5 /sys/kern/kern_mac.c | |
| parent | 9fe777b3e6a5fa095c6007e603d653ddba3817cd (diff) | |
| download | FreeBSD-src-e40371a8f9cbd7883a102e631ee83a6209a1ca2c.zip FreeBSD-src-e40371a8f9cbd7883a102e631ee83a6209a1ca2c.tar.gz | |
Introduce MAC_CHECK_VNODE_SWAPON, which permits MAC policies to
perform authorization checks during swapon() events; policies
might choose to enforce protections based on the credential
requesting the swap configuration, the target of the swap operation,
or other factors such as internal policy state.
Approved by: re
Obtained from: TrustedBSD Project
Sponsored by: DARPA, Network Associates Laboratories
Diffstat (limited to 'sys/kern/kern_mac.c')
| -rw-r--r-- | sys/kern/kern_mac.c | 22 |
1 files changed, 22 insertions, 0 deletions
diff --git a/sys/kern/kern_mac.c b/sys/kern/kern_mac.c index f80dfd6..29e5157 100644 --- a/sys/kern/kern_mac.c +++ b/sys/kern/kern_mac.c @@ -1026,6 +1026,10 @@ mac_policy_register(struct mac_policy_conf *mpc) mpc->mpc_ops->mpo_check_vnode_stat = mpe->mpe_function; break; + case MAC_CHECK_VNODE_SWAPON: + mpc->mpc_ops->mpo_check_vnode_swapon = + mpe->mpe_function; + break; case MAC_CHECK_VNODE_WRITE: mpc->mpc_ops->mpo_check_vnode_write = mpe->mpe_function; @@ -2604,6 +2608,24 @@ mac_check_vnode_stat(struct ucred *active_cred, struct ucred *file_cred, } int +mac_check_vnode_swapon(struct ucred *cred, struct vnode *vp) +{ + int error; + + ASSERT_VOP_LOCKED(vp, "mac_check_vnode_swapon"); + + if (!mac_enforce_fs) + return (0); + + error = vn_refreshlabel(vp, cred); + if (error) + return (error); + + MAC_CHECK(check_vnode_swapon, cred, vp, &vp->v_label); + return (error); +} + +int mac_check_vnode_write(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp) { |
