diff options
| author | kib <kib@FreeBSD.org> | 2013-08-21 17:45:00 +0000 |
|---|---|---|
| committer | kib <kib@FreeBSD.org> | 2013-08-21 17:45:00 +0000 |
| commit | d11c4f9c32bf7f78b6ca5f9fc02e869111dbe680 (patch) | |
| tree | d04455df948dc71b9ece838e75596e329c610c9d /sys/security/mac_biba | |
| parent | 6a459eb27c6a215b645e8673b5275f94003510a4 (diff) | |
| download | FreeBSD-src-d11c4f9c32bf7f78b6ca5f9fc02e869111dbe680.zip FreeBSD-src-d11c4f9c32bf7f78b6ca5f9fc02e869111dbe680.tar.gz | |
Implement read(2)/write(2) and neccessary lseek(2) for posix shmfd.
Add MAC framework entries for posix shm read and write.
Do not allow implicit extension of the underlying memory segment past
the limit set by ftruncate(2) by either of the syscalls. Read and
write returns short i/o, lseek(2) fails with EINVAL when resulting
offset does not fit into the limit.
Discussed with: alc
Tested by: pho
Sponsored by: The FreeBSD Foundation
Diffstat (limited to 'sys/security/mac_biba')
| -rw-r--r-- | sys/security/mac_biba/mac_biba.c | 38 |
1 files changed, 38 insertions, 0 deletions
diff --git a/sys/security/mac_biba/mac_biba.c b/sys/security/mac_biba/mac_biba.c index aa37fc7..4216fea 100644 --- a/sys/security/mac_biba/mac_biba.c +++ b/sys/security/mac_biba/mac_biba.c @@ -1759,6 +1759,24 @@ biba_posixshm_check_open(struct ucred *cred, struct shmfd *shmfd, } static int +biba_posixshm_check_read(struct ucred *active_cred, struct ucred *file_cred, + struct shmfd *vp, struct label *shmlabel) +{ + struct mac_biba *subj, *obj; + + if (!biba_enabled || !revocation_enabled) + return (0); + + subj = SLOT(active_cred->cr_label); + obj = SLOT(shmlabel); + + if (!biba_dominate_effective(obj, subj)) + return (EACCES); + + return (0); +} + +static int biba_posixshm_check_setmode(struct ucred *cred, struct shmfd *shmfd, struct label *shmlabel, mode_t mode) { @@ -1848,6 +1866,24 @@ biba_posixshm_check_unlink(struct ucred *cred, struct shmfd *shmfd, return (0); } +static int +biba_posixshm_check_write(struct ucred *active_cred, struct ucred *file_cred, + struct shmfd *vp, struct label *shmlabel) +{ + struct mac_biba *subj, *obj; + + if (!biba_enabled || !revocation_enabled) + return (0); + + subj = SLOT(active_cred->cr_label); + obj = SLOT(shmlabel); + + if (!biba_dominate_effective(obj, subj)) + return (EACCES); + + return (0); +} + static void biba_posixshm_create(struct ucred *cred, struct shmfd *shmfd, struct label *shmlabel) @@ -3657,11 +3693,13 @@ static struct mac_policy_ops mac_biba_ops = .mpo_posixshm_check_mmap = biba_posixshm_check_mmap, .mpo_posixshm_check_open = biba_posixshm_check_open, + .mpo_posixshm_check_read = biba_posixshm_check_read, .mpo_posixshm_check_setmode = biba_posixshm_check_setmode, .mpo_posixshm_check_setowner = biba_posixshm_check_setowner, .mpo_posixshm_check_stat = biba_posixshm_check_stat, .mpo_posixshm_check_truncate = biba_posixshm_check_truncate, .mpo_posixshm_check_unlink = biba_posixshm_check_unlink, + .mpo_posixshm_check_write = biba_posixshm_check_write, .mpo_posixshm_create = biba_posixshm_create, .mpo_posixshm_destroy_label = biba_destroy_label, .mpo_posixshm_init_label = biba_init_label, |
