diff options
| author | rodrigc <rodrigc@FreeBSD.org> | 2015-04-22 01:54:25 +0000 |
|---|---|---|
| committer | rodrigc <rodrigc@FreeBSD.org> | 2015-04-22 01:54:25 +0000 |
| commit | b5fb244c277f505abc33458d438abec0b0820b9b (patch) | |
| tree | 4a4ce32d78747f0a082c75528f944a46aa0fc6e7 /sys | |
| parent | a303879bce8d790548f97ecf342fcb6629ee5f2b (diff) | |
| download | FreeBSD-src-b5fb244c277f505abc33458d438abec0b0820b9b.zip FreeBSD-src-b5fb244c277f505abc33458d438abec0b0820b9b.tar.gz | |
Support file verification in MAC.
* Add VCREAT flag to indicate when a new file is being created
* Add VVERIFY to indicate verification is required
* Both VCREAT and VVERIFY are only passed on the MAC method vnode_check_open
and are removed from the accmode after
* Add O_VERIFY flag to rtld open of objects
* Add 'v' flag to __sflags to set O_VERIFY flag.
Submitted by: Steve Kiernan <stevek@juniper.net>
Obtained from: Juniper Networks, Inc.
GitHub Pull Request: https://github.com/freebsd/freebsd/pull/27
Relnotes: yes
Diffstat (limited to 'sys')
| -rw-r--r-- | sys/kern/vfs_vnops.c | 6 | ||||
| -rw-r--r-- | sys/sys/fcntl.h | 4 | ||||
| -rw-r--r-- | sys/sys/vnode.h | 2 |
3 files changed, 12 insertions, 0 deletions
diff --git a/sys/kern/vfs_vnops.c b/sys/kern/vfs_vnops.c index ed4ad4d..01d448e 100644 --- a/sys/kern/vfs_vnops.c +++ b/sys/kern/vfs_vnops.c @@ -306,9 +306,15 @@ vn_open_vnode(struct vnode *vp, int fmode, struct ucred *cred, if ((fmode & O_APPEND) && (fmode & FWRITE)) accmode |= VAPPEND; #ifdef MAC + if (fmode & O_CREAT) + accmode |= VCREAT; + if (fmode & O_VERIFY) + accmode |= VVERIFY; error = mac_vnode_check_open(cred, vp, accmode); if (error) return (error); + + accmode &= ~(VCREAT | VVERIFY); #endif if ((fmode & O_CREAT) == 0) { if (accmode & VWRITE) { diff --git a/sys/sys/fcntl.h b/sys/sys/fcntl.h index 85db07f..5793229 100644 --- a/sys/sys/fcntl.h +++ b/sys/sys/fcntl.h @@ -129,6 +129,10 @@ typedef __pid_t pid_t; #define O_CLOEXEC 0x00100000 #endif +#if __BSD_VISIBLE +#define O_VERIFY 0x00200000 /* open only after verification */ +#endif + /* * XXX missing O_DSYNC, O_RSYNC. */ diff --git a/sys/sys/vnode.h b/sys/sys/vnode.h index e1f912e..d70aa57 100644 --- a/sys/sys/vnode.h +++ b/sys/sys/vnode.h @@ -336,6 +336,8 @@ struct vattr { #define VWRITE_ACL 000040000000 /* change ACL and/or file mode */ #define VWRITE_OWNER 000100000000 /* change file owner */ #define VSYNCHRONIZE 000200000000 /* not used */ +#define VCREAT 000400000000 /* creating new file */ +#define VVERIFY 001000000000 /* verification required */ /* * Permissions that were traditionally granted only to the file owner. |
