diff options
author | bz <bz@FreeBSD.org> | 2008-10-17 15:11:12 +0000 |
---|---|---|
committer | bz <bz@FreeBSD.org> | 2008-10-17 15:11:12 +0000 |
commit | def7b5012b9e97fc0afd28665bac7195bc3c151c (patch) | |
tree | e36de3f0025fae6733ec800ba092329a7347db0b /sys/security/mac_mls | |
parent | 7d341cf135006831850a3a4ac06fdc4742920a83 (diff) | |
download | FreeBSD-src-def7b5012b9e97fc0afd28665bac7195bc3c151c.zip FreeBSD-src-def7b5012b9e97fc0afd28665bac7195bc3c151c.tar.gz |
Add a mac_inpcb_check_visible implementation to all MAC policies
that handle mac_socket_check_visible.
Reviewed by: rwatson
MFC after: 3 months (set timer; decide then)
Diffstat (limited to 'sys/security/mac_mls')
-rw-r--r-- | sys/security/mac_mls/mac_mls.c | 19 |
1 files changed, 19 insertions, 0 deletions
diff --git a/sys/security/mac_mls/mac_mls.c b/sys/security/mac_mls/mac_mls.c index 597628f..af8d276 100644 --- a/sys/security/mac_mls/mac_mls.c +++ b/sys/security/mac_mls/mac_mls.c @@ -1033,6 +1033,24 @@ mls_inpcb_check_deliver(struct inpcb *inp, struct label *inplabel, return (mls_equal_effective(p, i) ? 0 : EACCES); } +static int +mls_inpcb_check_visible(struct ucred *cred, struct inpcb *inp, + struct label *inplabel) +{ + struct mac_mls *subj, *obj; + + if (!mls_enabled) + return (0); + + subj = SLOT(cred->cr_label); + obj = SLOT(inplabel); + + if (!mls_dominate_effective(subj, obj)) + return (ENOENT); + + return (0); +} + static void mls_inpcb_create(struct socket *so, struct label *solabel, struct inpcb *inp, struct label *inplabel) @@ -2923,6 +2941,7 @@ static struct mac_policy_ops mls_ops = .mpo_ifnet_relabel = mls_ifnet_relabel, .mpo_inpcb_check_deliver = mls_inpcb_check_deliver, + .mpo_inpcb_check_visible = mls_inpcb_check_visible, .mpo_inpcb_create = mls_inpcb_create, .mpo_inpcb_create_mbuf = mls_inpcb_create_mbuf, .mpo_inpcb_destroy_label = mls_destroy_label, |