diff options
author | rwatson <rwatson@FreeBSD.org> | 2002-11-03 02:39:42 +0000 |
---|---|---|
committer | rwatson <rwatson@FreeBSD.org> | 2002-11-03 02:39:42 +0000 |
commit | 7537530ad867a2a7e001d6becf47c25f0d0d0b2b (patch) | |
tree | 13c3b22f9d0fec4fd6fd7b545bd326917f19839c /sys/security | |
parent | c9f86b731d744756f510247ea7f52517bc88c0c1 (diff) | |
download | FreeBSD-src-7537530ad867a2a7e001d6becf47c25f0d0d0b2b.zip FreeBSD-src-7537530ad867a2a7e001d6becf47c25f0d0d0b2b.tar.gz |
Introduce mac_check_system_settime(), a MAC check allowing policies to
augment the system policy for changing the system time.
Obtained from: TrustedBSD Project
Sponsored by: DARPA, Network Associates Laboratories
Diffstat (limited to 'sys/security')
-rw-r--r-- | sys/security/mac/mac_framework.c | 13 | ||||
-rw-r--r-- | sys/security/mac/mac_framework.h | 1 | ||||
-rw-r--r-- | sys/security/mac/mac_internal.h | 13 | ||||
-rw-r--r-- | sys/security/mac/mac_net.c | 13 | ||||
-rw-r--r-- | sys/security/mac/mac_pipe.c | 13 | ||||
-rw-r--r-- | sys/security/mac/mac_policy.h | 1 | ||||
-rw-r--r-- | sys/security/mac/mac_process.c | 13 | ||||
-rw-r--r-- | sys/security/mac/mac_syscalls.c | 13 | ||||
-rw-r--r-- | sys/security/mac/mac_system.c | 13 | ||||
-rw-r--r-- | sys/security/mac/mac_vfs.c | 13 |
10 files changed, 106 insertions, 0 deletions
diff --git a/sys/security/mac/mac_framework.c b/sys/security/mac/mac_framework.c index f4cfa8a..ff5c43a 100644 --- a/sys/security/mac/mac_framework.c +++ b/sys/security/mac/mac_framework.c @@ -2492,6 +2492,19 @@ mac_check_system_reboot(struct ucred *cred, int howto) } int +mac_check_system_settime(struct ucred *cred) +{ + int error; + + if (!mac_enforce_system) + return (0); + + MAC_CHECK(check_system_settime, cred); + + return (error); +} + +int mac_check_system_swapon(struct ucred *cred, struct vnode *vp) { int error; diff --git a/sys/security/mac/mac_framework.h b/sys/security/mac/mac_framework.h index e50aaa7..efa811d 100644 --- a/sys/security/mac/mac_framework.h +++ b/sys/security/mac/mac_framework.h @@ -255,6 +255,7 @@ int mac_check_socket_receive(struct ucred *cred, struct socket *so); int mac_check_socket_send(struct ucred *cred, struct socket *so); int mac_check_socket_visible(struct ucred *cred, struct socket *so); int mac_check_system_reboot(struct ucred *cred, int howto); +int mac_check_system_settime(struct ucred *cred); int mac_check_system_swapon(struct ucred *cred, struct vnode *vp); int mac_check_system_sysctl(struct ucred *cred, int *name, u_int namelen, void *old, size_t *oldlenp, int inkernel, diff --git a/sys/security/mac/mac_internal.h b/sys/security/mac/mac_internal.h index f4cfa8a..ff5c43a 100644 --- a/sys/security/mac/mac_internal.h +++ b/sys/security/mac/mac_internal.h @@ -2492,6 +2492,19 @@ mac_check_system_reboot(struct ucred *cred, int howto) } int +mac_check_system_settime(struct ucred *cred) +{ + int error; + + if (!mac_enforce_system) + return (0); + + MAC_CHECK(check_system_settime, cred); + + return (error); +} + +int mac_check_system_swapon(struct ucred *cred, struct vnode *vp) { int error; diff --git a/sys/security/mac/mac_net.c b/sys/security/mac/mac_net.c index f4cfa8a..ff5c43a 100644 --- a/sys/security/mac/mac_net.c +++ b/sys/security/mac/mac_net.c @@ -2492,6 +2492,19 @@ mac_check_system_reboot(struct ucred *cred, int howto) } int +mac_check_system_settime(struct ucred *cred) +{ + int error; + + if (!mac_enforce_system) + return (0); + + MAC_CHECK(check_system_settime, cred); + + return (error); +} + +int mac_check_system_swapon(struct ucred *cred, struct vnode *vp) { int error; diff --git a/sys/security/mac/mac_pipe.c b/sys/security/mac/mac_pipe.c index f4cfa8a..ff5c43a 100644 --- a/sys/security/mac/mac_pipe.c +++ b/sys/security/mac/mac_pipe.c @@ -2492,6 +2492,19 @@ mac_check_system_reboot(struct ucred *cred, int howto) } int +mac_check_system_settime(struct ucred *cred) +{ + int error; + + if (!mac_enforce_system) + return (0); + + MAC_CHECK(check_system_settime, cred); + + return (error); +} + +int mac_check_system_swapon(struct ucred *cred, struct vnode *vp) { int error; diff --git a/sys/security/mac/mac_policy.h b/sys/security/mac/mac_policy.h index 7be466f..2ea7afe 100644 --- a/sys/security/mac/mac_policy.h +++ b/sys/security/mac/mac_policy.h @@ -316,6 +316,7 @@ struct mac_policy_ops { int (*mpo_check_socket_visible)(struct ucred *cred, struct socket *so, struct label *socketlabel); int (*mpo_check_system_reboot)(struct ucred *cred, int howto); + int (*mpo_check_system_settime)(struct ucred *cred); int (*mpo_check_system_swapon)(struct ucred *cred, struct vnode *vp, struct label *label); int (*mpo_check_system_sysctl)(struct ucred *cred, int *name, diff --git a/sys/security/mac/mac_process.c b/sys/security/mac/mac_process.c index f4cfa8a..ff5c43a 100644 --- a/sys/security/mac/mac_process.c +++ b/sys/security/mac/mac_process.c @@ -2492,6 +2492,19 @@ mac_check_system_reboot(struct ucred *cred, int howto) } int +mac_check_system_settime(struct ucred *cred) +{ + int error; + + if (!mac_enforce_system) + return (0); + + MAC_CHECK(check_system_settime, cred); + + return (error); +} + +int mac_check_system_swapon(struct ucred *cred, struct vnode *vp) { int error; diff --git a/sys/security/mac/mac_syscalls.c b/sys/security/mac/mac_syscalls.c index f4cfa8a..ff5c43a 100644 --- a/sys/security/mac/mac_syscalls.c +++ b/sys/security/mac/mac_syscalls.c @@ -2492,6 +2492,19 @@ mac_check_system_reboot(struct ucred *cred, int howto) } int +mac_check_system_settime(struct ucred *cred) +{ + int error; + + if (!mac_enforce_system) + return (0); + + MAC_CHECK(check_system_settime, cred); + + return (error); +} + +int mac_check_system_swapon(struct ucred *cred, struct vnode *vp) { int error; diff --git a/sys/security/mac/mac_system.c b/sys/security/mac/mac_system.c index f4cfa8a..ff5c43a 100644 --- a/sys/security/mac/mac_system.c +++ b/sys/security/mac/mac_system.c @@ -2492,6 +2492,19 @@ mac_check_system_reboot(struct ucred *cred, int howto) } int +mac_check_system_settime(struct ucred *cred) +{ + int error; + + if (!mac_enforce_system) + return (0); + + MAC_CHECK(check_system_settime, cred); + + return (error); +} + +int mac_check_system_swapon(struct ucred *cred, struct vnode *vp) { int error; diff --git a/sys/security/mac/mac_vfs.c b/sys/security/mac/mac_vfs.c index f4cfa8a..ff5c43a 100644 --- a/sys/security/mac/mac_vfs.c +++ b/sys/security/mac/mac_vfs.c @@ -2492,6 +2492,19 @@ mac_check_system_reboot(struct ucred *cred, int howto) } int +mac_check_system_settime(struct ucred *cred) +{ + int error; + + if (!mac_enforce_system) + return (0); + + MAC_CHECK(check_system_settime, cred); + + return (error); +} + +int mac_check_system_swapon(struct ucred *cred, struct vnode *vp) { int error; |