PERFORCE change 20009 for review

[Robert Watson]

http://perforce.freebsd.org/chv.cgi?CH=20009

Change 20009 by rwatson at rwatson_tislabs on 2002/10/23 18:38:02

	Require that target swap devices by high integrity, since they
	will contain potentially high integrity data.
	
	Require Biba privilege to set the swap device.

Affected files ...

.. //depot/projects/trustedbsd/mac/sys/security/mac_biba/mac_biba.c#156 edit

Differences ...

==== //depot/projects/trustedbsd/mac/sys/security/mac_biba/mac_biba.c#156 (text+ko) ====

@@ -333,6 +333,16 @@
 }
 
 static int
+mac_biba_high_single(struct mac_biba *mac_biba)
+{
+
+	KASSERT((mac_biba->mb_flags & MAC_BIBA_FLAG_SINGLE) != 0,
+	    ("mac_biba_equal_single: mac_biba not single"));
+
+        return (mac_biba->mb_single.mbe_type == MAC_BIBA_TYPE_HIGH);
+}
+
+static int
 mac_biba_valid(struct mac_biba *mac_biba)
 {
 
@@ -2455,8 +2465,10 @@
 	subj = SLOT(&cred->cr_label);
 	obj = SLOT(label);
 
-	if (!mac_biba_dominate_single(subj, obj) ||
-	    !mac_biba_dominate_single(obj, subj))
+	if (!mac_biba_privileged(subj))
+		return (EPERM);
+
+	if (!mac_biba_high_single(obj))
 		return (EACCES);
 
 	return (0);
To Unsubscribe: send mail to majordomo at trustedbsd.org
with "unsubscribe trustedbsd-cvs" in the body of the message