summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--sys/kern/kern_mac.c11
-rw-r--r--sys/kern/subr_trap.c6
-rw-r--r--sys/security/mac/mac_framework.c11
-rw-r--r--sys/security/mac/mac_framework.h2
-rw-r--r--sys/security/mac/mac_internal.h11
-rw-r--r--sys/security/mac/mac_net.c11
-rw-r--r--sys/security/mac/mac_pipe.c11
-rw-r--r--sys/security/mac/mac_policy.h2
-rw-r--r--sys/security/mac/mac_process.c11
-rw-r--r--sys/security/mac/mac_syscalls.c11
-rw-r--r--sys/security/mac/mac_system.c11
-rw-r--r--sys/security/mac/mac_vfs.c11
-rw-r--r--sys/sys/mac.h2
-rw-r--r--sys/sys/mac_policy.h2
14 files changed, 113 insertions, 0 deletions
diff --git a/sys/kern/kern_mac.c b/sys/kern/kern_mac.c
index cdbf726..2c07abe 100644
--- a/sys/kern/kern_mac.c
+++ b/sys/kern/kern_mac.c
@@ -652,6 +652,10 @@ mac_policy_register(struct mac_policy_conf *mpc)
mpc->mpc_ops->mpo_relabel_cred =
mpe->mpe_function;
break;
+ case MAC_THREAD_USERRET:
+ mpc->mpc_ops->mpo_thread_userret =
+ mpe->mpe_function;
+ break;
case MAC_CHECK_BPFDESC_RECEIVE:
mpc->mpc_ops->mpo_check_bpfdesc_receive =
mpe->mpe_function;
@@ -1581,6 +1585,13 @@ mac_create_proc1(struct ucred *cred)
MAC_PERFORM(create_proc1, cred);
}
+void
+mac_thread_userret(struct thread *td)
+{
+
+ MAC_PERFORM(thread_userret, td);
+}
+
/*
* When a new process is created, its label must be initialized. Generally,
* this involves inheritence from the parent process, modulo possible
diff --git a/sys/kern/subr_trap.c b/sys/kern/subr_trap.c
index 2ec3fb1..272714a 100644
--- a/sys/kern/subr_trap.c
+++ b/sys/kern/subr_trap.c
@@ -38,6 +38,7 @@
* $FreeBSD$
*/
+#include "opt_mac.h"
#ifdef __i386__
#include "opt_npx.h"
#endif
@@ -46,6 +47,7 @@
#include <sys/bus.h>
#include <sys/kernel.h>
#include <sys/lock.h>
+#include <sys/mac.h>
#include <sys/mutex.h>
#include <sys/proc.h>
#include <sys/kse.h>
@@ -88,6 +90,10 @@ userret(td, frame, oticks)
mtx_unlock(&Giant);
#endif
+#ifdef MAC
+ mac_thread_userret(td);
+#endif
+
/*
* XXX we cheat slightly on the locking here to avoid locking in
* the usual case. Setting td_priority here is essentially an
diff --git a/sys/security/mac/mac_framework.c b/sys/security/mac/mac_framework.c
index cdbf726..2c07abe 100644
--- a/sys/security/mac/mac_framework.c
+++ b/sys/security/mac/mac_framework.c
@@ -652,6 +652,10 @@ mac_policy_register(struct mac_policy_conf *mpc)
mpc->mpc_ops->mpo_relabel_cred =
mpe->mpe_function;
break;
+ case MAC_THREAD_USERRET:
+ mpc->mpc_ops->mpo_thread_userret =
+ mpe->mpe_function;
+ break;
case MAC_CHECK_BPFDESC_RECEIVE:
mpc->mpc_ops->mpo_check_bpfdesc_receive =
mpe->mpe_function;
@@ -1581,6 +1585,13 @@ mac_create_proc1(struct ucred *cred)
MAC_PERFORM(create_proc1, cred);
}
+void
+mac_thread_userret(struct thread *td)
+{
+
+ MAC_PERFORM(thread_userret, td);
+}
+
/*
* When a new process is created, its label must be initialized. Generally,
* this involves inheritence from the parent process, modulo possible
diff --git a/sys/security/mac/mac_framework.h b/sys/security/mac/mac_framework.h
index b413220..ebb65cb 100644
--- a/sys/security/mac/mac_framework.h
+++ b/sys/security/mac/mac_framework.h
@@ -200,6 +200,7 @@ struct proc;
struct sockaddr;
struct socket;
struct pipe;
+struct thread;
struct timespec;
struct ucred;
struct uio;
@@ -293,6 +294,7 @@ void mac_execve_transition(struct ucred *old, struct ucred *new,
int mac_execve_will_transition(struct ucred *old, struct vnode *vp);
void mac_create_proc0(struct ucred *cred);
void mac_create_proc1(struct ucred *cred);
+void mac_thread_userret(struct thread *td);
/* Access control checks. */
int mac_check_bpfdesc_receive(struct bpf_d *bpf_d, struct ifnet *ifnet);
diff --git a/sys/security/mac/mac_internal.h b/sys/security/mac/mac_internal.h
index cdbf726..2c07abe 100644
--- a/sys/security/mac/mac_internal.h
+++ b/sys/security/mac/mac_internal.h
@@ -652,6 +652,10 @@ mac_policy_register(struct mac_policy_conf *mpc)
mpc->mpc_ops->mpo_relabel_cred =
mpe->mpe_function;
break;
+ case MAC_THREAD_USERRET:
+ mpc->mpc_ops->mpo_thread_userret =
+ mpe->mpe_function;
+ break;
case MAC_CHECK_BPFDESC_RECEIVE:
mpc->mpc_ops->mpo_check_bpfdesc_receive =
mpe->mpe_function;
@@ -1581,6 +1585,13 @@ mac_create_proc1(struct ucred *cred)
MAC_PERFORM(create_proc1, cred);
}
+void
+mac_thread_userret(struct thread *td)
+{
+
+ MAC_PERFORM(thread_userret, td);
+}
+
/*
* When a new process is created, its label must be initialized. Generally,
* this involves inheritence from the parent process, modulo possible
diff --git a/sys/security/mac/mac_net.c b/sys/security/mac/mac_net.c
index cdbf726..2c07abe 100644
--- a/sys/security/mac/mac_net.c
+++ b/sys/security/mac/mac_net.c
@@ -652,6 +652,10 @@ mac_policy_register(struct mac_policy_conf *mpc)
mpc->mpc_ops->mpo_relabel_cred =
mpe->mpe_function;
break;
+ case MAC_THREAD_USERRET:
+ mpc->mpc_ops->mpo_thread_userret =
+ mpe->mpe_function;
+ break;
case MAC_CHECK_BPFDESC_RECEIVE:
mpc->mpc_ops->mpo_check_bpfdesc_receive =
mpe->mpe_function;
@@ -1581,6 +1585,13 @@ mac_create_proc1(struct ucred *cred)
MAC_PERFORM(create_proc1, cred);
}
+void
+mac_thread_userret(struct thread *td)
+{
+
+ MAC_PERFORM(thread_userret, td);
+}
+
/*
* When a new process is created, its label must be initialized. Generally,
* this involves inheritence from the parent process, modulo possible
diff --git a/sys/security/mac/mac_pipe.c b/sys/security/mac/mac_pipe.c
index cdbf726..2c07abe 100644
--- a/sys/security/mac/mac_pipe.c
+++ b/sys/security/mac/mac_pipe.c
@@ -652,6 +652,10 @@ mac_policy_register(struct mac_policy_conf *mpc)
mpc->mpc_ops->mpo_relabel_cred =
mpe->mpe_function;
break;
+ case MAC_THREAD_USERRET:
+ mpc->mpc_ops->mpo_thread_userret =
+ mpe->mpe_function;
+ break;
case MAC_CHECK_BPFDESC_RECEIVE:
mpc->mpc_ops->mpo_check_bpfdesc_receive =
mpe->mpe_function;
@@ -1581,6 +1585,13 @@ mac_create_proc1(struct ucred *cred)
MAC_PERFORM(create_proc1, cred);
}
+void
+mac_thread_userret(struct thread *td)
+{
+
+ MAC_PERFORM(thread_userret, td);
+}
+
/*
* When a new process is created, its label must be initialized. Generally,
* this involves inheritence from the parent process, modulo possible
diff --git a/sys/security/mac/mac_policy.h b/sys/security/mac/mac_policy.h
index c3f2046..52fee33 100644
--- a/sys/security/mac/mac_policy.h
+++ b/sys/security/mac/mac_policy.h
@@ -220,6 +220,7 @@ struct mac_policy_ops {
void (*mpo_create_proc1)(struct ucred *cred);
void (*mpo_relabel_cred)(struct ucred *cred,
struct label *newlabel);
+ void (*mpo_thread_userret)(struct thread *thread);
/*
* Access control checks.
@@ -419,6 +420,7 @@ enum mac_op_constant {
MAC_CREATE_PROC0,
MAC_CREATE_PROC1,
MAC_RELABEL_CRED,
+ MAC_THREAD_USERRET,
MAC_CHECK_BPFDESC_RECEIVE,
MAC_CHECK_CRED_RELABEL,
MAC_CHECK_CRED_VISIBLE,
diff --git a/sys/security/mac/mac_process.c b/sys/security/mac/mac_process.c
index cdbf726..2c07abe 100644
--- a/sys/security/mac/mac_process.c
+++ b/sys/security/mac/mac_process.c
@@ -652,6 +652,10 @@ mac_policy_register(struct mac_policy_conf *mpc)
mpc->mpc_ops->mpo_relabel_cred =
mpe->mpe_function;
break;
+ case MAC_THREAD_USERRET:
+ mpc->mpc_ops->mpo_thread_userret =
+ mpe->mpe_function;
+ break;
case MAC_CHECK_BPFDESC_RECEIVE:
mpc->mpc_ops->mpo_check_bpfdesc_receive =
mpe->mpe_function;
@@ -1581,6 +1585,13 @@ mac_create_proc1(struct ucred *cred)
MAC_PERFORM(create_proc1, cred);
}
+void
+mac_thread_userret(struct thread *td)
+{
+
+ MAC_PERFORM(thread_userret, td);
+}
+
/*
* When a new process is created, its label must be initialized. Generally,
* this involves inheritence from the parent process, modulo possible
diff --git a/sys/security/mac/mac_syscalls.c b/sys/security/mac/mac_syscalls.c
index cdbf726..2c07abe 100644
--- a/sys/security/mac/mac_syscalls.c
+++ b/sys/security/mac/mac_syscalls.c
@@ -652,6 +652,10 @@ mac_policy_register(struct mac_policy_conf *mpc)
mpc->mpc_ops->mpo_relabel_cred =
mpe->mpe_function;
break;
+ case MAC_THREAD_USERRET:
+ mpc->mpc_ops->mpo_thread_userret =
+ mpe->mpe_function;
+ break;
case MAC_CHECK_BPFDESC_RECEIVE:
mpc->mpc_ops->mpo_check_bpfdesc_receive =
mpe->mpe_function;
@@ -1581,6 +1585,13 @@ mac_create_proc1(struct ucred *cred)
MAC_PERFORM(create_proc1, cred);
}
+void
+mac_thread_userret(struct thread *td)
+{
+
+ MAC_PERFORM(thread_userret, td);
+}
+
/*
* When a new process is created, its label must be initialized. Generally,
* this involves inheritence from the parent process, modulo possible
diff --git a/sys/security/mac/mac_system.c b/sys/security/mac/mac_system.c
index cdbf726..2c07abe 100644
--- a/sys/security/mac/mac_system.c
+++ b/sys/security/mac/mac_system.c
@@ -652,6 +652,10 @@ mac_policy_register(struct mac_policy_conf *mpc)
mpc->mpc_ops->mpo_relabel_cred =
mpe->mpe_function;
break;
+ case MAC_THREAD_USERRET:
+ mpc->mpc_ops->mpo_thread_userret =
+ mpe->mpe_function;
+ break;
case MAC_CHECK_BPFDESC_RECEIVE:
mpc->mpc_ops->mpo_check_bpfdesc_receive =
mpe->mpe_function;
@@ -1581,6 +1585,13 @@ mac_create_proc1(struct ucred *cred)
MAC_PERFORM(create_proc1, cred);
}
+void
+mac_thread_userret(struct thread *td)
+{
+
+ MAC_PERFORM(thread_userret, td);
+}
+
/*
* When a new process is created, its label must be initialized. Generally,
* this involves inheritence from the parent process, modulo possible
diff --git a/sys/security/mac/mac_vfs.c b/sys/security/mac/mac_vfs.c
index cdbf726..2c07abe 100644
--- a/sys/security/mac/mac_vfs.c
+++ b/sys/security/mac/mac_vfs.c
@@ -652,6 +652,10 @@ mac_policy_register(struct mac_policy_conf *mpc)
mpc->mpc_ops->mpo_relabel_cred =
mpe->mpe_function;
break;
+ case MAC_THREAD_USERRET:
+ mpc->mpc_ops->mpo_thread_userret =
+ mpe->mpe_function;
+ break;
case MAC_CHECK_BPFDESC_RECEIVE:
mpc->mpc_ops->mpo_check_bpfdesc_receive =
mpe->mpe_function;
@@ -1581,6 +1585,13 @@ mac_create_proc1(struct ucred *cred)
MAC_PERFORM(create_proc1, cred);
}
+void
+mac_thread_userret(struct thread *td)
+{
+
+ MAC_PERFORM(thread_userret, td);
+}
+
/*
* When a new process is created, its label must be initialized. Generally,
* this involves inheritence from the parent process, modulo possible
diff --git a/sys/sys/mac.h b/sys/sys/mac.h
index b413220..ebb65cb 100644
--- a/sys/sys/mac.h
+++ b/sys/sys/mac.h
@@ -200,6 +200,7 @@ struct proc;
struct sockaddr;
struct socket;
struct pipe;
+struct thread;
struct timespec;
struct ucred;
struct uio;
@@ -293,6 +294,7 @@ void mac_execve_transition(struct ucred *old, struct ucred *new,
int mac_execve_will_transition(struct ucred *old, struct vnode *vp);
void mac_create_proc0(struct ucred *cred);
void mac_create_proc1(struct ucred *cred);
+void mac_thread_userret(struct thread *td);
/* Access control checks. */
int mac_check_bpfdesc_receive(struct bpf_d *bpf_d, struct ifnet *ifnet);
diff --git a/sys/sys/mac_policy.h b/sys/sys/mac_policy.h
index c3f2046..52fee33 100644
--- a/sys/sys/mac_policy.h
+++ b/sys/sys/mac_policy.h
@@ -220,6 +220,7 @@ struct mac_policy_ops {
void (*mpo_create_proc1)(struct ucred *cred);
void (*mpo_relabel_cred)(struct ucred *cred,
struct label *newlabel);
+ void (*mpo_thread_userret)(struct thread *thread);
/*
* Access control checks.
@@ -419,6 +420,7 @@ enum mac_op_constant {
MAC_CREATE_PROC0,
MAC_CREATE_PROC1,
MAC_RELABEL_CRED,
+ MAC_THREAD_USERRET,
MAC_CHECK_BPFDESC_RECEIVE,
MAC_CHECK_CRED_RELABEL,
MAC_CHECK_CRED_VISIBLE,
OpenPOWER on IntegriCloud