PERFORCE change 22718 for review

[Robert Watson]

http://perforce.freebsd.org/chv.cgi?CH=22718

Change 22718 by rwatson at rwatson_paprika on 2002/12/24 13:25:23

	Instrument and authorized swapoff event.

Affected files ...

.. //depot/projects/trustedbsd/mac/sys/kern/kern_mac.c#371 edit
.. //depot/projects/trustedbsd/mac/sys/security/mac_biba/mac_biba.c#193 edit
.. //depot/projects/trustedbsd/mac/sys/security/mac_none/mac_none.c#115 edit
.. //depot/projects/trustedbsd/mac/sys/security/mac_test/mac_test.c#91 edit
.. //depot/projects/trustedbsd/mac/sys/sys/mac.h#225 edit
.. //depot/projects/trustedbsd/mac/sys/sys/mac_policy.h#179 edit
.. //depot/projects/trustedbsd/mac/sys/vm/vm_swap.c#16 edit

Differences ...

==== //depot/projects/trustedbsd/mac/sys/kern/kern_mac.c#371 (text+ko) ====

@@ -2693,6 +2693,20 @@
 }
 
 int
+mac_check_system_swapoff(struct ucred *cred, struct vnode *vp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_system_swapoff");
+
+	if (!mac_enforce_system)
+		return (0);
+
+	MAC_CHECK(check_system_swapoff, cred, vp, &vp->v_label);
+	return (error);
+}
+
+int
 mac_check_system_sysctl(struct ucred *cred, int *name, u_int namelen,
     void *old, size_t *oldlenp, int inkernel, void *new, size_t newlen)
 {

==== //depot/projects/trustedbsd/mac/sys/security/mac_biba/mac_biba.c#193 (text+ko) ====

@@ -1959,6 +1959,26 @@
 }
 
 static int
+mac_biba_check_system_swapoff(struct ucred *cred, struct vnode *vp,
+    struct label *label)
+{
+	struct mac_biba *subj, *obj;
+	int error;
+
+	if (!mac_biba_enabled)
+		return (0);
+
+	subj = SLOT(&cred->cr_label);
+	obj = SLOT(label);
+
+	error = mac_biba_subject_privileged(subj);
+	if (error)
+		return (error);
+
+	return (0);
+}
+
+static int
 mac_biba_check_system_sysctl(struct ucred *cred, int *name, u_int namelen,
     void *old, size_t *oldlenp, int inkernel, void *new, size_t newlen)
 {
@@ -2691,6 +2711,7 @@
 	.mpo_check_system_acct = mac_biba_check_system_acct,
 	.mpo_check_system_settime = mac_biba_check_system_settime,
 	.mpo_check_system_swapon = mac_biba_check_system_swapon,
+	.mpo_check_system_swapoff = mac_biba_check_system_swapoff,
 	.mpo_check_system_sysctl = mac_biba_check_system_sysctl,
 	.mpo_check_vnode_access = mac_biba_check_vnode_open,
 	.mpo_check_vnode_chdir = mac_biba_check_vnode_chdir,

==== //depot/projects/trustedbsd/mac/sys/security/mac_none/mac_none.c#115 (text+ko) ====

@@ -700,6 +700,14 @@
 }
 
 static int
+mac_none_check_system_swapoff(struct ucred *cred, struct vnode *vp,
+    struct label *label)
+{
+
+	return (0);
+}
+
+static int
 mac_none_check_system_sysctl(struct ucred *cred, int *name, u_int namelen,
     void *old, size_t *oldlenp, int inkernel, void *new, size_t newlen)
 {
@@ -1066,6 +1074,7 @@
 	.mpo_check_system_reboot = mac_none_check_system_reboot,
 	.mpo_check_system_settime = mac_none_check_system_settime,
 	.mpo_check_system_swapon = mac_none_check_system_swapon,
+	.mpo_check_system_swapoff = mac_none_check_system_swapoff,
 	.mpo_check_system_sysctl = mac_none_check_system_sysctl,
 	.mpo_check_vnode_access = mac_none_check_vnode_access,
 	.mpo_check_vnode_chdir = mac_none_check_vnode_chdir,

==== //depot/projects/trustedbsd/mac/sys/security/mac_test/mac_test.c#91 (text+ko) ====

@@ -1096,6 +1096,14 @@
 }
 
 static int
+mac_test_check_system_swapoff(struct ucred *cred, struct vnode *vp,
+    struct label *label)
+{
+
+	return (0);
+}
+
+static int
 mac_test_check_system_sysctl(struct ucred *cred, int *name, u_int namelen,
     void *old, size_t *oldlenp, int inkernel, void *new, size_t newlen)
 {
@@ -1463,6 +1471,7 @@
 	.mpo_check_system_reboot = mac_test_check_system_reboot,
 	.mpo_check_system_settime = mac_test_check_system_settime,
 	.mpo_check_system_swapon = mac_test_check_system_swapon,
+	.mpo_check_system_swapoff = mac_test_check_system_swapoff,
 	.mpo_check_system_sysctl = mac_test_check_system_sysctl,
 	.mpo_check_vnode_access = mac_test_check_vnode_access,
 	.mpo_check_vnode_chdir = mac_test_check_vnode_chdir,

==== //depot/projects/trustedbsd/mac/sys/sys/mac.h#225 (text+ko) ====

@@ -270,6 +270,7 @@
 int	mac_check_system_reboot(struct ucred *cred, int howto);
 int	mac_check_system_settime(struct ucred *cred);
 int	mac_check_system_swapon(struct ucred *cred, struct vnode *vp);
+int	mac_check_system_swapoff(struct ucred *cred, struct vnode *vp);
 int	mac_check_system_sysctl(struct ucred *cred, int *name,
 	    u_int namelen, void *old, size_t *oldlenp, int inkernel,
 	    void *new, size_t newlen);

==== //depot/projects/trustedbsd/mac/sys/sys/mac_policy.h#179 (text+ko) ====

@@ -330,6 +330,8 @@
 	int	(*mpo_check_system_settime)(struct ucred *cred);
 	int	(*mpo_check_system_swapon)(struct ucred *cred,
 		    struct vnode *vp, struct label *label);
+	int	(*mpo_check_system_swapoff)(struct ucred *cred,
+		    struct vnode *vp, struct label *label);
 	int	(*mpo_check_system_sysctl)(struct ucred *cred, int *name,
 		    u_int namelen, void *old, size_t *oldlenp, int inkernel,
 		    void *new, size_t newlen);

==== //depot/projects/trustedbsd/mac/sys/vm/vm_swap.c#16 (text+ko) ====

@@ -422,6 +422,14 @@
 	error = EINVAL;
 	goto done;
 found:
+#ifdef MAC
+	(void) vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td);
+	error = mac_check_system_swapoff(td->td_ucred, vp);
+	(void) VOP_UNLOCK(vp, 0, td);
+	if (error != 0)
+		goto done;
+#endif
+	
 	nblks = sp->sw_nblks;
 
 	/*
To Unsubscribe: send mail to majordomo at trustedbsd.org
with "unsubscribe trustedbsd-cvs" in the body of the message