diff options
author | rwatson <rwatson@FreeBSD.org> | 2008-08-23 15:26:36 +0000 |
---|---|---|
committer | rwatson <rwatson@FreeBSD.org> | 2008-08-23 15:26:36 +0000 |
commit | 78a117e6fa3ea5484baa385417846432dcafd758 (patch) | |
tree | 5219c0b4d17dd1dcbcb5fda367c1905a0929ee2b /sys/security/mac/mac_internal.h | |
parent | 36dc0db8e1fa12d3f6a38164a5fb1ae82fc45eba (diff) | |
download | FreeBSD-src-78a117e6fa3ea5484baa385417846432dcafd758.zip FreeBSD-src-78a117e6fa3ea5484baa385417846432dcafd758.tar.gz |
Introduce two related changes to the TrustedBSD MAC Framework:
(1) Abstract interpreter vnode labeling in execve(2) and mac_execve(2)
so that the general exec code isn't aware of the details of
allocating, copying, and freeing labels, rather, simply passes in
a void pointer to start and stop functions that will be used by
the framework. This change will be MFC'd.
(2) Introduce a new flags field to the MAC_POLICY_SET(9) interface
allowing policies to declare which types of objects require label
allocation, initialization, and destruction, and define a set of
flags covering various supported object types (MPC_OBJECT_PROC,
MPC_OBJECT_VNODE, MPC_OBJECT_INPCB, ...). This change reduces the
overhead of compiling the MAC Framework into the kernel if policies
aren't loaded, or if policies require labels on only a small number
or even no object types. Each time a policy is loaded or unloaded,
we recalculate a mask of labeled object types across all policies
present in the system. Eliminate MAC_ALWAYS_LABEL_MBUF option as it
is no longer required.
MFC after: 1 week ((1) only)
Reviewed by: csjp
Obtained from: TrustedBSD Project
Sponsored by: Apple, Inc.
Diffstat (limited to 'sys/security/mac/mac_internal.h')
-rw-r--r-- | sys/security/mac/mac_internal.h | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/sys/security/mac/mac_internal.h b/sys/security/mac/mac_internal.h index 9df8774..23da90a 100644 --- a/sys/security/mac/mac_internal.h +++ b/sys/security/mac/mac_internal.h @@ -88,9 +88,7 @@ struct label { */ extern struct mac_policy_list_head mac_policy_list; extern struct mac_policy_list_head mac_static_policy_list; -#ifndef MAC_ALWAYS_LABEL_MBUF -extern int mac_labelmbufs; -#endif +extern uint64_t mac_labeled; extern struct mtx mac_ifnet_mtx; /* @@ -121,10 +119,14 @@ int mac_allocate_slot(void); * MAC Framework per-object type functions. It's not yet clear how the * namespaces, etc, should work for these, so for now, sort by object type. */ +struct label *mac_cred_label_alloc(void); +void mac_cred_label_free(struct label *label); struct label *mac_pipe_label_alloc(void); void mac_pipe_label_free(struct label *label); struct label *mac_socket_label_alloc(int flag); void mac_socket_label_free(struct label *label); +struct label *mac_vnode_label_alloc(void); +void mac_vnode_label_free(struct label *label); int mac_cred_check_relabel(struct ucred *cred, struct label *newlabel); int mac_cred_externalize_label(struct label *label, char *elements, |