From 2197ab2d9342ec86dee8d80f036f78a3fced3ff7 Mon Sep 17 00:00:00 2001 From: rwatson Date: Wed, 4 May 2005 10:39:15 +0000 Subject: Introduce MAC Framework and MAC Policy entry points to label and control access to POSIX Semaphores: mac_init_posix_sem() Initialize label for POSIX semaphore mac_create_posix_sem() Create POSIX semaphore mac_destroy_posix_sem() Destroy POSIX semaphore mac_check_posix_sem_destroy() Check whether semaphore may be destroyed mac_check_posix_sem_getvalue() Check whether semaphore may be queried mac_check_possix_sem_open() Check whether semaphore may be opened mac_check_posix_sem_post() Check whether semaphore may be posted to mac_check_posix_sem_unlink() Check whether semaphore may be unlinked mac_check_posix_sem_wait() Check whether may wait on semaphore Update Biba, MLS, Stub, and Test policies to implement these entry points. For information flow policies, most semaphore operations are effectively read/write. Submitted by: Dandekar Hrishikesh Sponsored by: DARPA, McAfee, SPARTA Obtained from: TrustedBSD Project --- sys/sys/mac.h | 15 +++++++++++++++ 1 file changed, 15 insertions(+) (limited to 'sys/sys/mac.h') diff --git a/sys/sys/mac.h b/sys/sys/mac.h index 8e5037a..38c85ff 100644 --- a/sys/sys/mac.h +++ b/sys/sys/mac.h @@ -116,6 +116,7 @@ struct inpcb; struct image_params; struct inpcb; struct ipq; +struct ksem; struct m_tag; struct mbuf; struct mount; @@ -155,6 +156,7 @@ void mac_init_sysv_shm(struct shmid_kernel*); int mac_init_ipq(struct ipq *, int flag); int mac_init_socket(struct socket *, int flag); void mac_init_pipe(struct pipepair *); +void mac_init_posix_sem(struct ksem *); int mac_init_mbuf(struct mbuf *mbuf, int flag); int mac_init_mbuf_tag(struct m_tag *, int flag); void mac_init_mount(struct mount *); @@ -174,6 +176,7 @@ void mac_destroy_sysv_shm(struct shmid_kernel *); void mac_destroy_ipq(struct ipq *); void mac_destroy_socket(struct socket *); void mac_destroy_pipe(struct pipepair *); +void mac_destroy_posix_sem(struct ksem *); void mac_destroy_proc(struct proc *); void mac_destroy_mbuf_tag(struct m_tag *); void mac_destroy_mount(struct mount *); @@ -233,6 +236,12 @@ void mac_create_sysv_shm(struct ucred *cred, struct shmid_kernel *shmsegptr); /* + * Labeling event operations: POSIX (global/inter-process) semaphores. + */ +void mac_create_posix_sem(struct ucred *cred, struct ksem *ksemptr); + + +/* * Labeling event operations: network objects. */ void mac_create_bpfdesc(struct ucred *cred, struct bpf_d *bpf_d); @@ -329,6 +338,12 @@ int mac_check_pipe_poll(struct ucred *cred, struct pipepair *pp); int mac_check_pipe_read(struct ucred *cred, struct pipepair *pp); int mac_check_pipe_stat(struct ucred *cred, struct pipepair *pp); int mac_check_pipe_write(struct ucred *cred, struct pipepair *pp); +int mac_check_posix_sem_destroy(struct ucred *cred, struct ksem *ksemptr); +int mac_check_posix_sem_getvalue(struct ucred *cred,struct ksem *ksemptr); +int mac_check_posix_sem_open(struct ucred *cred, struct ksem *ksemptr); +int mac_check_posix_sem_post(struct ucred *cred, struct ksem *ksemptr); +int mac_check_posix_sem_unlink(struct ucred *cred, struct ksem *ksemptr); +int mac_check_posix_sem_wait(struct ucred *cred, struct ksem *ksemptr); int mac_check_proc_debug(struct ucred *cred, struct proc *proc); int mac_check_proc_sched(struct ucred *cred, struct proc *proc); int mac_check_proc_setuid(struct proc *proc, struct ucred *cred, -- cgit v1.1