PERFORCE change 20479 for review

[Robert Watson]

http://perforce.freebsd.org/chv.cgi?CH=20479

Change 20479 by rwatson at rwatson_tislabs on 2002/10/31 08:05:34

	Implement time setting protection for mac_biba, mac_none, and
	mac_test.

Affected files ...

.. //depot/projects/trustedbsd/mac/sys/security/mac_biba/mac_biba.c#175 edit
.. //depot/projects/trustedbsd/mac/sys/security/mac_none/mac_none.c#99 edit
.. //depot/projects/trustedbsd/mac/sys/security/mac_test/mac_test.c#75 edit

Differences ...

==== //depot/projects/trustedbsd/mac/sys/security/mac_biba/mac_biba.c#175 (text+ko) ====

@@ -1895,6 +1895,23 @@
 
 	return (0);
 }
+
+static int
+mac_biba_check_system_settime(struct ucred *cred)
+{
+	struct mac_biba *subj;
+
+	if (!mac_biba_enabled)
+		return (0);
+
+	subj = SLOT(&cred->cr_label);
+
+	if (!mac_biba_subject_privileged(subj))
+		return (EPERM);
+
+	return (0);
+}
+
 static int
 mac_biba_check_system_swapon(struct ucred *cred, struct vnode *vp,
     struct label *label)
@@ -2634,6 +2651,7 @@
 	.mpo_check_socket_relabel = mac_biba_check_socket_relabel,
 	.mpo_check_socket_visible = mac_biba_check_socket_visible,
 	.mpo_check_system_acct = mac_biba_check_system_acct,
+	.mpo_check_system_settime = mac_biba_check_system_settime,
 	.mpo_check_system_swapon = mac_biba_check_system_swapon,
 	.mpo_check_system_sysctl = mac_biba_check_system_sysctl,
 	.mpo_check_vnode_access = mac_biba_check_vnode_open,

==== //depot/projects/trustedbsd/mac/sys/security/mac_none/mac_none.c#99 (text+ko) ====

@@ -668,6 +668,13 @@
 }
 
 static int
+mac_none_check_system_settime(struct ucred *cred)
+{
+
+	return (0);
+}
+
+static int
 mac_none_check_system_swapon(struct ucred *cred, struct vnode *vp,
     struct label *label)
 {
@@ -1037,6 +1044,7 @@
 	.mpo_check_socket_visible = mac_none_check_socket_visible,
 	.mpo_check_system_acct = mac_none_check_system_acct,
 	.mpo_check_system_reboot = mac_none_check_system_reboot,
+	.mpo_check_system_settime = mac_none_check_system_settime,
 	.mpo_check_system_swapon = mac_none_check_system_swapon,
 	.mpo_check_system_sysctl = mac_none_check_system_sysctl,
 	.mpo_check_vnode_access = mac_none_check_vnode_access,

==== //depot/projects/trustedbsd/mac/sys/security/mac_test/mac_test.c#75 (text+ko) ====

@@ -1064,6 +1064,13 @@
 }
 
 static int
+mac_test_check_system_settime(struct ucred *cred)
+{
+
+	return (0);
+}
+
+static int
 mac_test_check_system_swapon(struct ucred *cred, struct vnode *vp,
     struct label *label)
 {
@@ -1434,6 +1441,7 @@
 	.mpo_check_socket_visible = mac_test_check_socket_visible,
 	.mpo_check_system_acct = mac_test_check_system_acct,
 	.mpo_check_system_reboot = mac_test_check_system_reboot,
+	.mpo_check_system_settime = mac_test_check_system_settime,
 	.mpo_check_system_swapon = mac_test_check_system_swapon,
 	.mpo_check_system_sysctl = mac_test_check_system_sysctl,
 	.mpo_check_vnode_access = mac_test_check_vnode_access,
To Unsubscribe: send mail to majordomo at trustedbsd.org
with "unsubscribe trustedbsd-cvs" in the body of the message