summaryrefslogtreecommitdiffstats
path: root/sys/security/mac
diff options
context:
space:
mode:
Diffstat (limited to 'sys/security/mac')
-rw-r--r--sys/security/mac/mac_framework.c32
-rw-r--r--sys/security/mac/mac_framework.h12
-rw-r--r--sys/security/mac/mac_internal.h32
-rw-r--r--sys/security/mac/mac_net.c32
-rw-r--r--sys/security/mac/mac_pipe.c32
-rw-r--r--sys/security/mac/mac_policy.h12
-rw-r--r--sys/security/mac/mac_process.c32
-rw-r--r--sys/security/mac/mac_syscalls.c32
-rw-r--r--sys/security/mac/mac_system.c32
-rw-r--r--sys/security/mac/mac_vfs.c32
10 files changed, 176 insertions, 104 deletions
diff --git a/sys/security/mac/mac_framework.c b/sys/security/mac/mac_framework.c
index 107b2d2..17dd122 100644
--- a/sys/security/mac/mac_framework.c
+++ b/sys/security/mac/mac_framework.c
@@ -1804,7 +1804,8 @@ mac_check_vnode_open(struct ucred *cred, struct vnode *vp, mode_t acc_mode)
}
int
-mac_check_vnode_poll(struct ucred *cred, struct vnode *vp)
+mac_check_vnode_poll(struct ucred *active_cred, struct ucred *file_cred,
+ struct vnode *vp)
{
int error;
@@ -1813,17 +1814,19 @@ mac_check_vnode_poll(struct ucred *cred, struct vnode *vp)
if (!mac_enforce_fs)
return (0);
- error = vn_refreshlabel(vp, cred);
+ error = vn_refreshlabel(vp, active_cred);
if (error)
return (error);
- MAC_CHECK(check_vnode_poll, cred, vp, &vp->v_label);
+ MAC_CHECK(check_vnode_poll, active_cred, file_cred, vp,
+ &vp->v_label);
return (error);
}
int
-mac_check_vnode_read(struct ucred *cred, struct vnode *vp)
+mac_check_vnode_read(struct ucred *active_cred, struct ucred *file_cred,
+ struct vnode *vp)
{
int error;
@@ -1832,11 +1835,12 @@ mac_check_vnode_read(struct ucred *cred, struct vnode *vp)
if (!mac_enforce_fs)
return (0);
- error = vn_refreshlabel(vp, cred);
+ error = vn_refreshlabel(vp, active_cred);
if (error)
return (error);
- MAC_CHECK(check_vnode_read, cred, vp, &vp->v_label);
+ MAC_CHECK(check_vnode_read, active_cred, file_cred, vp,
+ &vp->v_label);
return (error);
}
@@ -2076,7 +2080,8 @@ mac_check_vnode_setutimes(struct ucred *cred, struct vnode *vp,
}
int
-mac_check_vnode_stat(struct ucred *cred, struct vnode *vp)
+mac_check_vnode_stat(struct ucred *active_cred, struct ucred *file_cred,
+ struct vnode *vp)
{
int error;
@@ -2085,16 +2090,18 @@ mac_check_vnode_stat(struct ucred *cred, struct vnode *vp)
if (!mac_enforce_fs)
return (0);
- error = vn_refreshlabel(vp, cred);
+ error = vn_refreshlabel(vp, active_cred);
if (error)
return (error);
- MAC_CHECK(check_vnode_stat, cred, vp, &vp->v_label);
+ MAC_CHECK(check_vnode_stat, active_cred, file_cred, vp,
+ &vp->v_label);
return (error);
}
int
-mac_check_vnode_write(struct ucred *cred, struct vnode *vp)
+mac_check_vnode_write(struct ucred *active_cred, struct ucred *file_cred,
+ struct vnode *vp)
{
int error;
@@ -2103,11 +2110,12 @@ mac_check_vnode_write(struct ucred *cred, struct vnode *vp)
if (!mac_enforce_fs)
return (0);
- error = vn_refreshlabel(vp, cred);
+ error = vn_refreshlabel(vp, active_cred);
if (error)
return (error);
- MAC_CHECK(check_vnode_write, cred, vp, &vp->v_label);
+ MAC_CHECK(check_vnode_write, active_cred, file_cred, vp,
+ &vp->v_label);
return (error);
}
diff --git a/sys/security/mac/mac_framework.h b/sys/security/mac/mac_framework.h
index 0696f3c..b413220 100644
--- a/sys/security/mac/mac_framework.h
+++ b/sys/security/mac/mac_framework.h
@@ -338,8 +338,10 @@ u_char mac_check_vnode_mmap_prot(struct ucred *cred, struct vnode *vp,
int newmapping);
int mac_check_vnode_open(struct ucred *cred, struct vnode *vp,
mode_t acc_mode);
-int mac_check_vnode_poll(struct ucred *cred, struct vnode *vp);
-int mac_check_vnode_read(struct ucred *cred, struct vnode *vp);
+int mac_check_vnode_poll(struct ucred *active_cred,
+ struct ucred *file_cred, struct vnode *vp);
+int mac_check_vnode_read(struct ucred *active_cred,
+ struct ucred *file_cred, struct vnode *vp);
int mac_check_vnode_readdir(struct ucred *cred, struct vnode *vp);
int mac_check_vnode_readlink(struct ucred *cred, struct vnode *vp);
int mac_check_vnode_rename_from(struct ucred *cred, struct vnode *dvp,
@@ -359,8 +361,10 @@ int mac_check_vnode_setowner(struct ucred *cred, struct vnode *vp,
uid_t uid, gid_t gid);
int mac_check_vnode_setutimes(struct ucred *cred, struct vnode *vp,
struct timespec atime, struct timespec mtime);
-int mac_check_vnode_stat(struct ucred *cred, struct vnode *vp);
-int mac_check_vnode_write(struct ucred *cred, struct vnode *vp);
+int mac_check_vnode_stat(struct ucred *active_cred,
+ struct ucred *file_cred, struct vnode *vp);
+int mac_check_vnode_write(struct ucred *active_cred,
+ struct ucred *file_cred, struct vnode *vp);
int mac_getsockopt_label_get(struct ucred *cred, struct socket *so,
struct mac *extmac);
int mac_getsockopt_peerlabel_get(struct ucred *cred, struct socket *so,
diff --git a/sys/security/mac/mac_internal.h b/sys/security/mac/mac_internal.h
index 107b2d2..17dd122 100644
--- a/sys/security/mac/mac_internal.h
+++ b/sys/security/mac/mac_internal.h
@@ -1804,7 +1804,8 @@ mac_check_vnode_open(struct ucred *cred, struct vnode *vp, mode_t acc_mode)
}
int
-mac_check_vnode_poll(struct ucred *cred, struct vnode *vp)
+mac_check_vnode_poll(struct ucred *active_cred, struct ucred *file_cred,
+ struct vnode *vp)
{
int error;
@@ -1813,17 +1814,19 @@ mac_check_vnode_poll(struct ucred *cred, struct vnode *vp)
if (!mac_enforce_fs)
return (0);
- error = vn_refreshlabel(vp, cred);
+ error = vn_refreshlabel(vp, active_cred);
if (error)
return (error);
- MAC_CHECK(check_vnode_poll, cred, vp, &vp->v_label);
+ MAC_CHECK(check_vnode_poll, active_cred, file_cred, vp,
+ &vp->v_label);
return (error);
}
int
-mac_check_vnode_read(struct ucred *cred, struct vnode *vp)
+mac_check_vnode_read(struct ucred *active_cred, struct ucred *file_cred,
+ struct vnode *vp)
{
int error;
@@ -1832,11 +1835,12 @@ mac_check_vnode_read(struct ucred *cred, struct vnode *vp)
if (!mac_enforce_fs)
return (0);
- error = vn_refreshlabel(vp, cred);
+ error = vn_refreshlabel(vp, active_cred);
if (error)
return (error);
- MAC_CHECK(check_vnode_read, cred, vp, &vp->v_label);
+ MAC_CHECK(check_vnode_read, active_cred, file_cred, vp,
+ &vp->v_label);
return (error);
}
@@ -2076,7 +2080,8 @@ mac_check_vnode_setutimes(struct ucred *cred, struct vnode *vp,
}
int
-mac_check_vnode_stat(struct ucred *cred, struct vnode *vp)
+mac_check_vnode_stat(struct ucred *active_cred, struct ucred *file_cred,
+ struct vnode *vp)
{
int error;
@@ -2085,16 +2090,18 @@ mac_check_vnode_stat(struct ucred *cred, struct vnode *vp)
if (!mac_enforce_fs)
return (0);
- error = vn_refreshlabel(vp, cred);
+ error = vn_refreshlabel(vp, active_cred);
if (error)
return (error);
- MAC_CHECK(check_vnode_stat, cred, vp, &vp->v_label);
+ MAC_CHECK(check_vnode_stat, active_cred, file_cred, vp,
+ &vp->v_label);
return (error);
}
int
-mac_check_vnode_write(struct ucred *cred, struct vnode *vp)
+mac_check_vnode_write(struct ucred *active_cred, struct ucred *file_cred,
+ struct vnode *vp)
{
int error;
@@ -2103,11 +2110,12 @@ mac_check_vnode_write(struct ucred *cred, struct vnode *vp)
if (!mac_enforce_fs)
return (0);
- error = vn_refreshlabel(vp, cred);
+ error = vn_refreshlabel(vp, active_cred);
if (error)
return (error);
- MAC_CHECK(check_vnode_write, cred, vp, &vp->v_label);
+ MAC_CHECK(check_vnode_write, active_cred, file_cred, vp,
+ &vp->v_label);
return (error);
}
diff --git a/sys/security/mac/mac_net.c b/sys/security/mac/mac_net.c
index 107b2d2..17dd122 100644
--- a/sys/security/mac/mac_net.c
+++ b/sys/security/mac/mac_net.c
@@ -1804,7 +1804,8 @@ mac_check_vnode_open(struct ucred *cred, struct vnode *vp, mode_t acc_mode)
}
int
-mac_check_vnode_poll(struct ucred *cred, struct vnode *vp)
+mac_check_vnode_poll(struct ucred *active_cred, struct ucred *file_cred,
+ struct vnode *vp)
{
int error;
@@ -1813,17 +1814,19 @@ mac_check_vnode_poll(struct ucred *cred, struct vnode *vp)
if (!mac_enforce_fs)
return (0);
- error = vn_refreshlabel(vp, cred);
+ error = vn_refreshlabel(vp, active_cred);
if (error)
return (error);
- MAC_CHECK(check_vnode_poll, cred, vp, &vp->v_label);
+ MAC_CHECK(check_vnode_poll, active_cred, file_cred, vp,
+ &vp->v_label);
return (error);
}
int
-mac_check_vnode_read(struct ucred *cred, struct vnode *vp)
+mac_check_vnode_read(struct ucred *active_cred, struct ucred *file_cred,
+ struct vnode *vp)
{
int error;
@@ -1832,11 +1835,12 @@ mac_check_vnode_read(struct ucred *cred, struct vnode *vp)
if (!mac_enforce_fs)
return (0);
- error = vn_refreshlabel(vp, cred);
+ error = vn_refreshlabel(vp, active_cred);
if (error)
return (error);
- MAC_CHECK(check_vnode_read, cred, vp, &vp->v_label);
+ MAC_CHECK(check_vnode_read, active_cred, file_cred, vp,
+ &vp->v_label);
return (error);
}
@@ -2076,7 +2080,8 @@ mac_check_vnode_setutimes(struct ucred *cred, struct vnode *vp,
}
int
-mac_check_vnode_stat(struct ucred *cred, struct vnode *vp)
+mac_check_vnode_stat(struct ucred *active_cred, struct ucred *file_cred,
+ struct vnode *vp)
{
int error;
@@ -2085,16 +2090,18 @@ mac_check_vnode_stat(struct ucred *cred, struct vnode *vp)
if (!mac_enforce_fs)
return (0);
- error = vn_refreshlabel(vp, cred);
+ error = vn_refreshlabel(vp, active_cred);
if (error)
return (error);
- MAC_CHECK(check_vnode_stat, cred, vp, &vp->v_label);
+ MAC_CHECK(check_vnode_stat, active_cred, file_cred, vp,
+ &vp->v_label);
return (error);
}
int
-mac_check_vnode_write(struct ucred *cred, struct vnode *vp)
+mac_check_vnode_write(struct ucred *active_cred, struct ucred *file_cred,
+ struct vnode *vp)
{
int error;
@@ -2103,11 +2110,12 @@ mac_check_vnode_write(struct ucred *cred, struct vnode *vp)
if (!mac_enforce_fs)
return (0);
- error = vn_refreshlabel(vp, cred);
+ error = vn_refreshlabel(vp, active_cred);
if (error)
return (error);
- MAC_CHECK(check_vnode_write, cred, vp, &vp->v_label);
+ MAC_CHECK(check_vnode_write, active_cred, file_cred, vp,
+ &vp->v_label);
return (error);
}
diff --git a/sys/security/mac/mac_pipe.c b/sys/security/mac/mac_pipe.c
index 107b2d2..17dd122 100644
--- a/sys/security/mac/mac_pipe.c
+++ b/sys/security/mac/mac_pipe.c
@@ -1804,7 +1804,8 @@ mac_check_vnode_open(struct ucred *cred, struct vnode *vp, mode_t acc_mode)
}
int
-mac_check_vnode_poll(struct ucred *cred, struct vnode *vp)
+mac_check_vnode_poll(struct ucred *active_cred, struct ucred *file_cred,
+ struct vnode *vp)
{
int error;
@@ -1813,17 +1814,19 @@ mac_check_vnode_poll(struct ucred *cred, struct vnode *vp)
if (!mac_enforce_fs)
return (0);
- error = vn_refreshlabel(vp, cred);
+ error = vn_refreshlabel(vp, active_cred);
if (error)
return (error);
- MAC_CHECK(check_vnode_poll, cred, vp, &vp->v_label);
+ MAC_CHECK(check_vnode_poll, active_cred, file_cred, vp,
+ &vp->v_label);
return (error);
}
int
-mac_check_vnode_read(struct ucred *cred, struct vnode *vp)
+mac_check_vnode_read(struct ucred *active_cred, struct ucred *file_cred,
+ struct vnode *vp)
{
int error;
@@ -1832,11 +1835,12 @@ mac_check_vnode_read(struct ucred *cred, struct vnode *vp)
if (!mac_enforce_fs)
return (0);
- error = vn_refreshlabel(vp, cred);
+ error = vn_refreshlabel(vp, active_cred);
if (error)
return (error);
- MAC_CHECK(check_vnode_read, cred, vp, &vp->v_label);
+ MAC_CHECK(check_vnode_read, active_cred, file_cred, vp,
+ &vp->v_label);
return (error);
}
@@ -2076,7 +2080,8 @@ mac_check_vnode_setutimes(struct ucred *cred, struct vnode *vp,
}
int
-mac_check_vnode_stat(struct ucred *cred, struct vnode *vp)
+mac_check_vnode_stat(struct ucred *active_cred, struct ucred *file_cred,
+ struct vnode *vp)
{
int error;
@@ -2085,16 +2090,18 @@ mac_check_vnode_stat(struct ucred *cred, struct vnode *vp)
if (!mac_enforce_fs)
return (0);
- error = vn_refreshlabel(vp, cred);
+ error = vn_refreshlabel(vp, active_cred);
if (error)
return (error);
- MAC_CHECK(check_vnode_stat, cred, vp, &vp->v_label);
+ MAC_CHECK(check_vnode_stat, active_cred, file_cred, vp,
+ &vp->v_label);
return (error);
}
int
-mac_check_vnode_write(struct ucred *cred, struct vnode *vp)
+mac_check_vnode_write(struct ucred *active_cred, struct ucred *file_cred,
+ struct vnode *vp)
{
int error;
@@ -2103,11 +2110,12 @@ mac_check_vnode_write(struct ucred *cred, struct vnode *vp)
if (!mac_enforce_fs)
return (0);
- error = vn_refreshlabel(vp, cred);
+ error = vn_refreshlabel(vp, active_cred);
if (error)
return (error);
- MAC_CHECK(check_vnode_write, cred, vp, &vp->v_label);
+ MAC_CHECK(check_vnode_write, active_cred, file_cred, vp,
+ &vp->v_label);
return (error);
}
diff --git a/sys/security/mac/mac_policy.h b/sys/security/mac/mac_policy.h
index d0065aa..c3f2046 100644
--- a/sys/security/mac/mac_policy.h
+++ b/sys/security/mac/mac_policy.h
@@ -301,9 +301,11 @@ struct mac_policy_ops {
struct vnode *vp, struct label *label, int newmapping);
int (*mpo_check_vnode_open)(struct ucred *cred, struct vnode *vp,
struct label *label, mode_t acc_mode);
- int (*mpo_check_vnode_poll)(struct ucred *cred, struct vnode *vp,
+ int (*mpo_check_vnode_poll)(struct ucred *active_cred,
+ struct ucred *file_cred, struct vnode *vp,
struct label *label);
- int (*mpo_check_vnode_read)(struct ucred *cred, struct vnode *vp,
+ int (*mpo_check_vnode_read)(struct ucred *active_cred,
+ struct ucred *file_cred, struct vnode *vp,
struct label *label);
int (*mpo_check_vnode_readdir)(struct ucred *cred,
struct vnode *dvp, struct label *dlabel);
@@ -337,9 +339,11 @@ struct mac_policy_ops {
int (*mpo_check_vnode_setutimes)(struct ucred *cred,
struct vnode *vp, struct label *label,
struct timespec atime, struct timespec mtime);
- int (*mpo_check_vnode_stat)(struct ucred *cred, struct vnode *vp,
+ int (*mpo_check_vnode_stat)(struct ucred *active_cred,
+ struct ucred *file_cred, struct vnode *vp,
struct label *label);
- int (*mpo_check_vnode_write)(struct ucred *cred, struct vnode *vp,
+ int (*mpo_check_vnode_write)(struct ucred *active_cred,
+ struct ucred *file_cred, struct vnode *vp,
struct label *label);
};
diff --git a/sys/security/mac/mac_process.c b/sys/security/mac/mac_process.c
index 107b2d2..17dd122 100644
--- a/sys/security/mac/mac_process.c
+++ b/sys/security/mac/mac_process.c
@@ -1804,7 +1804,8 @@ mac_check_vnode_open(struct ucred *cred, struct vnode *vp, mode_t acc_mode)
}
int
-mac_check_vnode_poll(struct ucred *cred, struct vnode *vp)
+mac_check_vnode_poll(struct ucred *active_cred, struct ucred *file_cred,
+ struct vnode *vp)
{
int error;
@@ -1813,17 +1814,19 @@ mac_check_vnode_poll(struct ucred *cred, struct vnode *vp)
if (!mac_enforce_fs)
return (0);
- error = vn_refreshlabel(vp, cred);
+ error = vn_refreshlabel(vp, active_cred);
if (error)
return (error);
- MAC_CHECK(check_vnode_poll, cred, vp, &vp->v_label);
+ MAC_CHECK(check_vnode_poll, active_cred, file_cred, vp,
+ &vp->v_label);
return (error);
}
int
-mac_check_vnode_read(struct ucred *cred, struct vnode *vp)
+mac_check_vnode_read(struct ucred *active_cred, struct ucred *file_cred,
+ struct vnode *vp)
{
int error;
@@ -1832,11 +1835,12 @@ mac_check_vnode_read(struct ucred *cred, struct vnode *vp)
if (!mac_enforce_fs)
return (0);
- error = vn_refreshlabel(vp, cred);
+ error = vn_refreshlabel(vp, active_cred);
if (error)
return (error);
- MAC_CHECK(check_vnode_read, cred, vp, &vp->v_label);
+ MAC_CHECK(check_vnode_read, active_cred, file_cred, vp,
+ &vp->v_label);
return (error);
}
@@ -2076,7 +2080,8 @@ mac_check_vnode_setutimes(struct ucred *cred, struct vnode *vp,
}
int
-mac_check_vnode_stat(struct ucred *cred, struct vnode *vp)
+mac_check_vnode_stat(struct ucred *active_cred, struct ucred *file_cred,
+ struct vnode *vp)
{
int error;
@@ -2085,16 +2090,18 @@ mac_check_vnode_stat(struct ucred *cred, struct vnode *vp)
if (!mac_enforce_fs)
return (0);
- error = vn_refreshlabel(vp, cred);
+ error = vn_refreshlabel(vp, active_cred);
if (error)
return (error);
- MAC_CHECK(check_vnode_stat, cred, vp, &vp->v_label);
+ MAC_CHECK(check_vnode_stat, active_cred, file_cred, vp,
+ &vp->v_label);
return (error);
}
int
-mac_check_vnode_write(struct ucred *cred, struct vnode *vp)
+mac_check_vnode_write(struct ucred *active_cred, struct ucred *file_cred,
+ struct vnode *vp)
{
int error;
@@ -2103,11 +2110,12 @@ mac_check_vnode_write(struct ucred *cred, struct vnode *vp)
if (!mac_enforce_fs)
return (0);
- error = vn_refreshlabel(vp, cred);
+ error = vn_refreshlabel(vp, active_cred);
if (error)
return (error);
- MAC_CHECK(check_vnode_write, cred, vp, &vp->v_label);
+ MAC_CHECK(check_vnode_write, active_cred, file_cred, vp,
+ &vp->v_label);
return (error);
}
diff --git a/sys/security/mac/mac_syscalls.c b/sys/security/mac/mac_syscalls.c
index 107b2d2..17dd122 100644
--- a/sys/security/mac/mac_syscalls.c
+++ b/sys/security/mac/mac_syscalls.c
@@ -1804,7 +1804,8 @@ mac_check_vnode_open(struct ucred *cred, struct vnode *vp, mode_t acc_mode)
}
int
-mac_check_vnode_poll(struct ucred *cred, struct vnode *vp)
+mac_check_vnode_poll(struct ucred *active_cred, struct ucred *file_cred,
+ struct vnode *vp)
{
int error;
@@ -1813,17 +1814,19 @@ mac_check_vnode_poll(struct ucred *cred, struct vnode *vp)
if (!mac_enforce_fs)
return (0);
- error = vn_refreshlabel(vp, cred);
+ error = vn_refreshlabel(vp, active_cred);
if (error)
return (error);
- MAC_CHECK(check_vnode_poll, cred, vp, &vp->v_label);
+ MAC_CHECK(check_vnode_poll, active_cred, file_cred, vp,
+ &vp->v_label);
return (error);
}
int
-mac_check_vnode_read(struct ucred *cred, struct vnode *vp)
+mac_check_vnode_read(struct ucred *active_cred, struct ucred *file_cred,
+ struct vnode *vp)
{
int error;
@@ -1832,11 +1835,12 @@ mac_check_vnode_read(struct ucred *cred, struct vnode *vp)
if (!mac_enforce_fs)
return (0);
- error = vn_refreshlabel(vp, cred);
+ error = vn_refreshlabel(vp, active_cred);
if (error)
return (error);
- MAC_CHECK(check_vnode_read, cred, vp, &vp->v_label);
+ MAC_CHECK(check_vnode_read, active_cred, file_cred, vp,
+ &vp->v_label);
return (error);
}
@@ -2076,7 +2080,8 @@ mac_check_vnode_setutimes(struct ucred *cred, struct vnode *vp,
}
int
-mac_check_vnode_stat(struct ucred *cred, struct vnode *vp)
+mac_check_vnode_stat(struct ucred *active_cred, struct ucred *file_cred,
+ struct vnode *vp)
{
int error;
@@ -2085,16 +2090,18 @@ mac_check_vnode_stat(struct ucred *cred, struct vnode *vp)
if (!mac_enforce_fs)
return (0);
- error = vn_refreshlabel(vp, cred);
+ error = vn_refreshlabel(vp, active_cred);
if (error)
return (error);
- MAC_CHECK(check_vnode_stat, cred, vp, &vp->v_label);
+ MAC_CHECK(check_vnode_stat, active_cred, file_cred, vp,
+ &vp->v_label);
return (error);
}
int
-mac_check_vnode_write(struct ucred *cred, struct vnode *vp)
+mac_check_vnode_write(struct ucred *active_cred, struct ucred *file_cred,
+ struct vnode *vp)
{
int error;
@@ -2103,11 +2110,12 @@ mac_check_vnode_write(struct ucred *cred, struct vnode *vp)
if (!mac_enforce_fs)
return (0);
- error = vn_refreshlabel(vp, cred);
+ error = vn_refreshlabel(vp, active_cred);
if (error)
return (error);
- MAC_CHECK(check_vnode_write, cred, vp, &vp->v_label);
+ MAC_CHECK(check_vnode_write, active_cred, file_cred, vp,
+ &vp->v_label);
return (error);
}
diff --git a/sys/security/mac/mac_system.c b/sys/security/mac/mac_system.c
index 107b2d2..17dd122 100644
--- a/sys/security/mac/mac_system.c
+++ b/sys/security/mac/mac_system.c
@@ -1804,7 +1804,8 @@ mac_check_vnode_open(struct ucred *cred, struct vnode *vp, mode_t acc_mode)
}
int
-mac_check_vnode_poll(struct ucred *cred, struct vnode *vp)
+mac_check_vnode_poll(struct ucred *active_cred, struct ucred *file_cred,
+ struct vnode *vp)
{
int error;
@@ -1813,17 +1814,19 @@ mac_check_vnode_poll(struct ucred *cred, struct vnode *vp)
if (!mac_enforce_fs)
return (0);
- error = vn_refreshlabel(vp, cred);
+ error = vn_refreshlabel(vp, active_cred);
if (error)
return (error);
- MAC_CHECK(check_vnode_poll, cred, vp, &vp->v_label);
+ MAC_CHECK(check_vnode_poll, active_cred, file_cred, vp,
+ &vp->v_label);
return (error);
}
int
-mac_check_vnode_read(struct ucred *cred, struct vnode *vp)
+mac_check_vnode_read(struct ucred *active_cred, struct ucred *file_cred,
+ struct vnode *vp)
{
int error;
@@ -1832,11 +1835,12 @@ mac_check_vnode_read(struct ucred *cred, struct vnode *vp)
if (!mac_enforce_fs)
return (0);
- error = vn_refreshlabel(vp, cred);
+ error = vn_refreshlabel(vp, active_cred);
if (error)
return (error);
- MAC_CHECK(check_vnode_read, cred, vp, &vp->v_label);
+ MAC_CHECK(check_vnode_read, active_cred, file_cred, vp,
+ &vp->v_label);
return (error);
}
@@ -2076,7 +2080,8 @@ mac_check_vnode_setutimes(struct ucred *cred, struct vnode *vp,
}
int
-mac_check_vnode_stat(struct ucred *cred, struct vnode *vp)
+mac_check_vnode_stat(struct ucred *active_cred, struct ucred *file_cred,
+ struct vnode *vp)
{
int error;
@@ -2085,16 +2090,18 @@ mac_check_vnode_stat(struct ucred *cred, struct vnode *vp)
if (!mac_enforce_fs)
return (0);
- error = vn_refreshlabel(vp, cred);
+ error = vn_refreshlabel(vp, active_cred);
if (error)
return (error);
- MAC_CHECK(check_vnode_stat, cred, vp, &vp->v_label);
+ MAC_CHECK(check_vnode_stat, active_cred, file_cred, vp,
+ &vp->v_label);
return (error);
}
int
-mac_check_vnode_write(struct ucred *cred, struct vnode *vp)
+mac_check_vnode_write(struct ucred *active_cred, struct ucred *file_cred,
+ struct vnode *vp)
{
int error;
@@ -2103,11 +2110,12 @@ mac_check_vnode_write(struct ucred *cred, struct vnode *vp)
if (!mac_enforce_fs)
return (0);
- error = vn_refreshlabel(vp, cred);
+ error = vn_refreshlabel(vp, active_cred);
if (error)
return (error);
- MAC_CHECK(check_vnode_write, cred, vp, &vp->v_label);
+ MAC_CHECK(check_vnode_write, active_cred, file_cred, vp,
+ &vp->v_label);
return (error);
}
diff --git a/sys/security/mac/mac_vfs.c b/sys/security/mac/mac_vfs.c
index 107b2d2..17dd122 100644
--- a/sys/security/mac/mac_vfs.c
+++ b/sys/security/mac/mac_vfs.c
@@ -1804,7 +1804,8 @@ mac_check_vnode_open(struct ucred *cred, struct vnode *vp, mode_t acc_mode)
}
int
-mac_check_vnode_poll(struct ucred *cred, struct vnode *vp)
+mac_check_vnode_poll(struct ucred *active_cred, struct ucred *file_cred,
+ struct vnode *vp)
{
int error;
@@ -1813,17 +1814,19 @@ mac_check_vnode_poll(struct ucred *cred, struct vnode *vp)
if (!mac_enforce_fs)
return (0);
- error = vn_refreshlabel(vp, cred);
+ error = vn_refreshlabel(vp, active_cred);
if (error)
return (error);
- MAC_CHECK(check_vnode_poll, cred, vp, &vp->v_label);
+ MAC_CHECK(check_vnode_poll, active_cred, file_cred, vp,
+ &vp->v_label);
return (error);
}
int
-mac_check_vnode_read(struct ucred *cred, struct vnode *vp)
+mac_check_vnode_read(struct ucred *active_cred, struct ucred *file_cred,
+ struct vnode *vp)
{
int error;
@@ -1832,11 +1835,12 @@ mac_check_vnode_read(struct ucred *cred, struct vnode *vp)
if (!mac_enforce_fs)
return (0);
- error = vn_refreshlabel(vp, cred);
+ error = vn_refreshlabel(vp, active_cred);
if (error)
return (error);
- MAC_CHECK(check_vnode_read, cred, vp, &vp->v_label);
+ MAC_CHECK(check_vnode_read, active_cred, file_cred, vp,
+ &vp->v_label);
return (error);
}
@@ -2076,7 +2080,8 @@ mac_check_vnode_setutimes(struct ucred *cred, struct vnode *vp,
}
int
-mac_check_vnode_stat(struct ucred *cred, struct vnode *vp)
+mac_check_vnode_stat(struct ucred *active_cred, struct ucred *file_cred,
+ struct vnode *vp)
{
int error;
@@ -2085,16 +2090,18 @@ mac_check_vnode_stat(struct ucred *cred, struct vnode *vp)
if (!mac_enforce_fs)
return (0);
- error = vn_refreshlabel(vp, cred);
+ error = vn_refreshlabel(vp, active_cred);
if (error)
return (error);
- MAC_CHECK(check_vnode_stat, cred, vp, &vp->v_label);
+ MAC_CHECK(check_vnode_stat, active_cred, file_cred, vp,
+ &vp->v_label);
return (error);
}
int
-mac_check_vnode_write(struct ucred *cred, struct vnode *vp)
+mac_check_vnode_write(struct ucred *active_cred, struct ucred *file_cred,
+ struct vnode *vp)
{
int error;
@@ -2103,11 +2110,12 @@ mac_check_vnode_write(struct ucred *cred, struct vnode *vp)
if (!mac_enforce_fs)
return (0);
- error = vn_refreshlabel(vp, cred);
+ error = vn_refreshlabel(vp, active_cred);
if (error)
return (error);
- MAC_CHECK(check_vnode_write, cred, vp, &vp->v_label);
+ MAC_CHECK(check_vnode_write, active_cred, file_cred, vp,
+ &vp->v_label);
return (error);
}
OpenPOWER on IntegriCloud