From 8db1bd7411a1a4c2f4b01d0a822a5ec62d2f9251 Mon Sep 17 00:00:00 2001 From: csjp Date: Sat, 31 Dec 2005 05:06:59 +0000 Subject: Introduce a new sysctl variable: security.mac.biba.interfaces_equal If non-zero, all network interfaces be created with the label: biba/equal(equal-equal) This is useful where programs which initialize network interfaces do not have any labeling support. This includes dhclient and ppp. A long term solution is to add labeling support into dhclient(8) and ppp(8), and remove this variable. It should be noted that this behavior is different then setting the: security.mac.biba.trust_all_interfaces sysctl variable, as this will create interfaces with a biba/high label. Lower integrity processes are not able to write to the interface in this event. The security.mac.biba.interfaces_equal will override trust_all_interfaces. The security.mac.biba.interfaces_equal variable will be set to zero or disabled by default. MFC after: 2 weeks --- sys/security/mac_biba/mac_biba.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/sys/security/mac_biba/mac_biba.c b/sys/security/mac_biba/mac_biba.c index 6735c25..6d6c8fd 100644 --- a/sys/security/mac_biba/mac_biba.c +++ b/sys/security/mac_biba/mac_biba.c @@ -124,6 +124,11 @@ SYSCTL_INT(_security_mac_biba, OID_AUTO, ptys_equal, CTLFLAG_RW, &ptys_equal, 0, "Label pty devices as biba/equal on create"); TUNABLE_INT("security.mac.biba.ptys_equal", &ptys_equal); +static int interfaces_equal; +SYSCTL_INT(_security_mac_biba, OID_AUTO, interfaces_equal, CTLFLAG_RW, + &interfaces_equal, 0, "Label network interfaces as biba/equal on create"); +TUNABLE_INT("security.mac.biba.interfaces_equal", &interfaces_equal); + static int revocation_enabled = 0; SYSCTL_INT(_security_mac_biba, OID_AUTO, revocation_enabled, CTLFLAG_RW, &revocation_enabled, 0, "Revoke access to objects on relabel"); @@ -1176,7 +1181,7 @@ mac_biba_create_ifnet(struct ifnet *ifnet, struct label *ifnetlabel) dest = SLOT(ifnetlabel); - if (ifnet->if_type == IFT_LOOP) { + if (ifnet->if_type == IFT_LOOP || interfaces_equal != 0) { type = MAC_BIBA_TYPE_EQUAL; goto set; } -- cgit v1.1