Reimplement sysctls handling by MAC framework.

Now I believe it is done in the right way.

Removed some XXMAC cases, we now assume 'high' integrity level for all
sysctls, except those with CTLFLAG_ANYBODY flag set. No more magic.

Reviewed by:	rwatson
Approved by:	rwatson, scottl (mentor)
Tested with:	LINT (compilation), mac_biba(4) (functionality)

1 files changed, 5 insertions, 11 deletions

diff --git a/sys/security/mac_biba/mac_biba.c b/sys/security/mac_biba/mac_biba.c
index 63bea16..545ba43 100644
--- a/sys/security/mac_biba/mac_biba.c
+++ b/sys/security/mac_biba/mac_biba.c
@@ -1973,8 +1973,8 @@ mac_biba_check_system_swapoff(struct ucred *cred, struct vnode *vp,
 }
 
 static int
-mac_biba_check_system_sysctl(struct ucred *cred, int *name, u_int namelen,
-    void *old, size_t *oldlenp, int inkernel, void *new, size_t newlen)
+mac_biba_check_system_sysctl(struct ucred *cred, struct sysctl_oid *oidp,
+    void *arg1, int arg2, struct sysctl_req *req)
 {
 	struct mac_biba *subj;
 	int error;
@@ -1985,16 +1985,10 @@ mac_biba_check_system_sysctl(struct ucred *cred, int *name, u_int namelen,
 	subj = SLOT(cred->cr_label);
 
 	/*
-	 * In general, treat sysctl variables as biba/high, but also
-	 * require privilege to change them, since they are a
-	 * communications channel between grades.  Exempt MIB
-	 * queries from this due to undocmented sysctl magic.
-	 * XXXMAC: This probably requires some more review.
+	 * Treat sysctl variables without CTLFLAG_ANYBODY flag as
+	 * biba/high, but also require privilege to change them.
 	 */
-	if (new != NULL) {
-		if (namelen > 0 && name[0] == 0)
-			return (0);
-
+	if (req->newptr != NULL && (oidp->oid_kind & CTLFLAG_ANYBODY) == 0) {
 		if (!mac_biba_subject_dominate_high(subj))
 			return (EACCES);