diff options
author | rwatson <rwatson@FreeBSD.org> | 2005-04-16 18:33:13 +0000 |
---|---|---|
committer | rwatson <rwatson@FreeBSD.org> | 2005-04-16 18:33:13 +0000 |
commit | 76ab38319d170413a4377c4fb729cdebb1934243 (patch) | |
tree | c649e45d2e84743dc3268a704301d0a46f812fb5 /sys/security/mac | |
parent | 5851800a14b1af19b5d6ca241de8cc68deb7e95a (diff) | |
download | FreeBSD-src-76ab38319d170413a4377c4fb729cdebb1934243.zip FreeBSD-src-76ab38319d170413a4377c4fb729cdebb1934243.tar.gz |
In mac_get_fd(), remove unconditional acquisition of Giant around copying
of the socket label to thread-local storage, and replace it with
conditional acquisition based on debug.mpsafenet. Acquire the socket
lock around the copy operation.
In mac_set_fd(), replace the unconditional acquisition of Giant with
the conditional acquisition of Giant based on debug.mpsafenet. The socket
lock is acquired in mac_socket_label_set() so doesn't have to be
acquired here.
Obtained from: TrustedBSD Project
Sponsored by: SPAWAR, SPARTA
Diffstat (limited to 'sys/security/mac')
-rw-r--r-- | sys/security/mac/mac_framework.c | 16 | ||||
-rw-r--r-- | sys/security/mac/mac_syscalls.c | 16 |
2 files changed, 14 insertions, 18 deletions
diff --git a/sys/security/mac/mac_framework.c b/sys/security/mac/mac_framework.c index f44a380..0854109 100644 --- a/sys/security/mac/mac_framework.c +++ b/sys/security/mac/mac_framework.c @@ -1,7 +1,7 @@ /*- * Copyright (c) 1999-2002 Robert N. M. Watson * Copyright (c) 2001 Ilmar S. Habibulin - * Copyright (c) 2001-2004 Networks Associates Technology, Inc. + * Copyright (c) 2001-2005 Networks Associates Technology, Inc. * All rights reserved. * * This software was developed by Robert Watson and Ilmar Habibulin for the @@ -802,11 +802,11 @@ __mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap) case DTYPE_SOCKET: so = fp->f_data; intlabel = mac_socket_label_alloc(M_WAITOK); - mtx_lock(&Giant); /* Sockets */ - /* XXX: Socket lock here. */ + NET_LOCK_GIANT(); + SOCK_LOCK(so); mac_copy_socket_label(so->so_label, intlabel); - /* XXX: Socket unlock here. */ - mtx_unlock(&Giant); /* Sockets */ + SOCK_UNLOCK(so); + NET_UNLOCK_GIANT(); error = mac_externalize_socket_label(intlabel, elements, buffer, mac.m_buflen); mac_socket_label_free(intlabel); @@ -1012,12 +1012,10 @@ __mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap) error = mac_internalize_socket_label(intlabel, buffer); if (error == 0) { so = fp->f_data; - mtx_lock(&Giant); /* Sockets */ - /* XXX: Socket lock here. */ + NET_LOCK_GIANT(); error = mac_socket_label_set(td->td_ucred, so, intlabel); - /* XXX: Socket unlock here. */ - mtx_unlock(&Giant); /* Sockets */ + NET_UNLOCK_GIANT(); } mac_socket_label_free(intlabel); break; diff --git a/sys/security/mac/mac_syscalls.c b/sys/security/mac/mac_syscalls.c index f44a380..0854109 100644 --- a/sys/security/mac/mac_syscalls.c +++ b/sys/security/mac/mac_syscalls.c @@ -1,7 +1,7 @@ /*- * Copyright (c) 1999-2002 Robert N. M. Watson * Copyright (c) 2001 Ilmar S. Habibulin - * Copyright (c) 2001-2004 Networks Associates Technology, Inc. + * Copyright (c) 2001-2005 Networks Associates Technology, Inc. * All rights reserved. * * This software was developed by Robert Watson and Ilmar Habibulin for the @@ -802,11 +802,11 @@ __mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap) case DTYPE_SOCKET: so = fp->f_data; intlabel = mac_socket_label_alloc(M_WAITOK); - mtx_lock(&Giant); /* Sockets */ - /* XXX: Socket lock here. */ + NET_LOCK_GIANT(); + SOCK_LOCK(so); mac_copy_socket_label(so->so_label, intlabel); - /* XXX: Socket unlock here. */ - mtx_unlock(&Giant); /* Sockets */ + SOCK_UNLOCK(so); + NET_UNLOCK_GIANT(); error = mac_externalize_socket_label(intlabel, elements, buffer, mac.m_buflen); mac_socket_label_free(intlabel); @@ -1012,12 +1012,10 @@ __mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap) error = mac_internalize_socket_label(intlabel, buffer); if (error == 0) { so = fp->f_data; - mtx_lock(&Giant); /* Sockets */ - /* XXX: Socket lock here. */ + NET_LOCK_GIANT(); error = mac_socket_label_set(td->td_ucred, so, intlabel); - /* XXX: Socket unlock here. */ - mtx_unlock(&Giant); /* Sockets */ + NET_UNLOCK_GIANT(); } mac_socket_label_free(intlabel); break; |