From e40371a8f9cbd7883a102e631ee83a6209a1ca2c Mon Sep 17 00:00:00 2001 From: rwatson Date: Tue, 22 Oct 2002 15:53:43 +0000 Subject: Introduce MAC_CHECK_VNODE_SWAPON, which permits MAC policies to perform authorization checks during swapon() events; policies might choose to enforce protections based on the credential requesting the swap configuration, the target of the swap operation, or other factors such as internal policy state. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories --- sys/kern/kern_mac.c | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) (limited to 'sys/kern/kern_mac.c') diff --git a/sys/kern/kern_mac.c b/sys/kern/kern_mac.c index f80dfd6..29e5157 100644 --- a/sys/kern/kern_mac.c +++ b/sys/kern/kern_mac.c @@ -1026,6 +1026,10 @@ mac_policy_register(struct mac_policy_conf *mpc) mpc->mpc_ops->mpo_check_vnode_stat = mpe->mpe_function; break; + case MAC_CHECK_VNODE_SWAPON: + mpc->mpc_ops->mpo_check_vnode_swapon = + mpe->mpe_function; + break; case MAC_CHECK_VNODE_WRITE: mpc->mpc_ops->mpo_check_vnode_write = mpe->mpe_function; @@ -2604,6 +2608,24 @@ mac_check_vnode_stat(struct ucred *active_cred, struct ucred *file_cred, } int +mac_check_vnode_swapon(struct ucred *cred, struct vnode *vp) +{ + int error; + + ASSERT_VOP_LOCKED(vp, "mac_check_vnode_swapon"); + + if (!mac_enforce_fs) + return (0); + + error = vn_refreshlabel(vp, cred); + if (error) + return (error); + + MAC_CHECK(check_vnode_swapon, cred, vp, &vp->v_label); + return (error); +} + +int mac_check_vnode_write(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp) { -- cgit v1.1