PERFORCE change 69924 for review

Robert Watson rwatson at FreeBSD.org
Sat Jan 29 17:24:23 GMT 2005


http://perforce.freebsd.org/chv.cgi?CH=69924

Change 69924 by rwatson at rwatson_paprika on 2005/01/29 17:23:27

	MAC Framework entry points and stub policy implementations to
	allow MAC policies to instrument the various set*id() system calls.
	
	Submitted by:	Samy Al Bahra

Affected files ...

.. //depot/projects/trustedbsd/mac/sys/kern/kern_prot.c#44 edit
.. //depot/projects/trustedbsd/mac/sys/security/mac/mac_process.c#14 edit
.. //depot/projects/trustedbsd/mac/sys/security/mac_stub/mac_stub.c#24 edit
.. //depot/projects/trustedbsd/mac/sys/security/mac_test/mac_test.c#139 edit
.. //depot/projects/trustedbsd/mac/sys/sys/mac.h#264 edit
.. //depot/projects/trustedbsd/mac/sys/sys/mac_policy.h#221 edit

Differences ...

==== //depot/projects/trustedbsd/mac/sys/kern/kern_prot.c#44 (text+ko) ====

@@ -500,6 +500,12 @@
 	PROC_LOCK(p);
 	oldcred = p->p_ucred;
 
+#ifdef MAC
+	error = mac_check_proc_setuid(p, oldcred, uid);
+	if (error)
+		goto fail;
+#endif
+
 	/*
 	 * See if we have "permission" by POSIX 1003.1 rules.
 	 *
@@ -524,12 +530,8 @@
 #ifdef POSIX_APPENDIX_B_4_2_2	/* Use BSD-compat clause from B.4.2.2 */
 	    uid != oldcred->cr_uid &&		/* allow setuid(geteuid()) */
 #endif
-	    (error = suser_cred(oldcred, SUSER_ALLOWJAIL)) != 0) {
-		PROC_UNLOCK(p);
-		uifree(uip);
-		crfree(newcred);
-		return (error);
-	}
+	    (error = suser_cred(oldcred, SUSER_ALLOWJAIL)) != 0)
+		goto fail;
 
 	/*
 	 * Copy credentials so other references do not see our changes.
@@ -579,6 +581,12 @@
 	uifree(uip);
 	crfree(oldcred);
 	return (0);
+
+fail:
+	PROC_UNLOCK(p);
+	uifree(uip);
+	crfree(newcred);
+	return (error);
 }
 
 #ifndef _SYS_SYSPROTO_H_
@@ -604,14 +612,18 @@
 	euip = uifind(euid);
 	PROC_LOCK(p);
 	oldcred = p->p_ucred;
+
+#ifdef MAC
+	error = mac_check_proc_seteuid(p, oldcred, euid;
+	if (error)
+		goto fail;
+#endif
+
 	if (euid != oldcred->cr_ruid &&		/* allow seteuid(getuid()) */
 	    euid != oldcred->cr_svuid &&	/* allow seteuid(saved uid) */
-	    (error = suser_cred(oldcred, SUSER_ALLOWJAIL)) != 0) {
-		PROC_UNLOCK(p);
-		uifree(euip);
-		crfree(newcred);
-		return (error);
-	}
+	    (error = suser_cred(oldcred, SUSER_ALLOWJAIL)) != 0)
+		goto fail;
+
 	/*
 	 * Everything's okay, do it.  Copy credentials so other references do
 	 * not see our changes.
@@ -626,6 +638,12 @@
 	uifree(euip);
 	crfree(oldcred);
 	return (0);
+
+fail:
+	PROC_UNLOCK(p);
+	uifree(euip);
+	crfree(newcred);
+	return (error);
 }
 
 #ifndef _SYS_SYSPROTO_H_
@@ -650,6 +668,12 @@
 	PROC_LOCK(p);
 	oldcred = p->p_ucred;
 
+#ifdef MAC
+	error = mac_check_proc_setgid(p, oldcred, gid);
+	if (error)
+		goto fail;
+#endif
+
 	/*
 	 * See if we have "permission" by POSIX 1003.1 rules.
 	 *
@@ -668,11 +692,8 @@
 #ifdef POSIX_APPENDIX_B_4_2_2	/* Use BSD-compat clause from B.4.2.2 */
 	    gid != oldcred->cr_groups[0] && /* allow setgid(getegid()) */
 #endif
-	    (error = suser_cred(oldcred, SUSER_ALLOWJAIL)) != 0) {
-		PROC_UNLOCK(p);
-		crfree(newcred);
-		return (error);
-	}
+	    (error = suser_cred(oldcred, SUSER_ALLOWJAIL)) != 0)
+		goto fail;
 
 	crcopy(newcred, oldcred);
 #ifdef _POSIX_SAVED_IDS
@@ -718,6 +739,11 @@
 	PROC_UNLOCK(p);
 	crfree(oldcred);
 	return (0);
+
+fail:
+	PROC_UNLOCK(p);
+	crfree(newcred);
+	return (error);
 }
 
 #ifndef _SYS_SYSPROTO_H_
@@ -741,13 +767,18 @@
 	newcred = crget();
 	PROC_LOCK(p);
 	oldcred = p->p_ucred;
+
+#ifdef MAC
+	error = mac_check_proc_setegid(p, oldcred, egid);
+	if (error)
+		goto fail;
+#endif
+
 	if (egid != oldcred->cr_rgid &&		/* allow setegid(getgid()) */
 	    egid != oldcred->cr_svgid &&	/* allow setegid(saved gid) */
-	    (error = suser_cred(oldcred, SUSER_ALLOWJAIL)) != 0) {
-		PROC_UNLOCK(p);
-		crfree(newcred);
-		return (error);
-	}
+	    (error = suser_cred(oldcred, SUSER_ALLOWJAIL)) != 0)
+		goto fail;
+
 	crcopy(newcred, oldcred);
 	if (oldcred->cr_groups[0] != egid) {
 		change_egid(newcred, egid);
@@ -757,6 +788,11 @@
 	PROC_UNLOCK(p);
 	crfree(oldcred);
 	return (0);
+
+fail:
+	PROC_UNLOCK(p);
+	crfree(newcred);
+	return (error);
 }
 
 #ifndef _SYS_SYSPROTO_H_
@@ -789,14 +825,18 @@
 	newcred = crget();
 	PROC_LOCK(p);
 	oldcred = p->p_ucred;
+
+#ifdef MAC
+	error = mac_check_proc_setgroups(p, oldcred, ngrp,
+	    tempcred->cr_groups);
+	if (error)
+		goto fail;
+#endif
+
 	error = suser_cred(oldcred, SUSER_ALLOWJAIL);
-	if (error) {
-		PROC_UNLOCK(p);
-		crfree(newcred);
-		crfree(tempcred);
-		return (error);
-	}
-		
+	if (error)
+		goto fail;
+
 	/*
 	 * XXX A little bit lazy here.  We could test if anything has
 	 * changed before crcopy() and setting P_SUGID.
@@ -821,6 +861,12 @@
 	crfree(tempcred);
 	crfree(oldcred);
 	return (0);
+
+fail:
+	PROC_UNLOCK(p);
+	crfree(newcred);
+	crfree(tempcred);
+	return (error);
 }
 
 #ifndef _SYS_SYSPROTO_H_
@@ -849,17 +895,20 @@
 	ruip = uifind(ruid);
 	PROC_LOCK(p);
 	oldcred = p->p_ucred;
+
+#ifdef MAC
+	error = mac_check_proc_setreuid(p, oldcred, ruid, euid);
+	if (error)
+		goto fail;
+#endif
+
 	if (((ruid != (uid_t)-1 && ruid != oldcred->cr_ruid &&
 	      ruid != oldcred->cr_svuid) ||
 	     (euid != (uid_t)-1 && euid != oldcred->cr_uid &&
 	      euid != oldcred->cr_ruid && euid != oldcred->cr_svuid)) &&
-	    (error = suser_cred(oldcred, SUSER_ALLOWJAIL)) != 0) {
-		PROC_UNLOCK(p);
-		uifree(ruip);
-		uifree(euip);
-		crfree(newcred);
-		return (error);
-	}
+	    (error = suser_cred(oldcred, SUSER_ALLOWJAIL)) != 0)
+		goto fail;
+
 	crcopy(newcred, oldcred);
 	if (euid != (uid_t)-1 && oldcred->cr_uid != euid) {
 		change_euid(newcred, euip);
@@ -880,6 +929,13 @@
 	uifree(euip);
 	crfree(oldcred);
 	return (0);
+
+fail:
+	PROC_UNLOCK(p);
+	uifree(ruip);
+	uifree(euip);
+	crfree(newcred);
+	return (error);
 }
 
 #ifndef _SYS_SYSPROTO_H_
@@ -905,15 +961,19 @@
 	newcred = crget();
 	PROC_LOCK(p);
 	oldcred = p->p_ucred;
+
+#ifdef MAC
+	error = mac_check_proc_setregid(p, oldcred, rgid, egid);
+	if (error)
+		goto fail;
+#endif
+
 	if (((rgid != (gid_t)-1 && rgid != oldcred->cr_rgid &&
 	    rgid != oldcred->cr_svgid) ||
 	     (egid != (gid_t)-1 && egid != oldcred->cr_groups[0] &&
 	     egid != oldcred->cr_rgid && egid != oldcred->cr_svgid)) &&
-	    (error = suser_cred(oldcred, SUSER_ALLOWJAIL)) != 0) {
-		PROC_UNLOCK(p);
-		crfree(newcred);
-		return (error);
-	}
+	    (error = suser_cred(oldcred, SUSER_ALLOWJAIL)) != 0)
+		goto fail;
 
 	crcopy(newcred, oldcred);
 	if (egid != (gid_t)-1 && oldcred->cr_groups[0] != egid) {
@@ -933,6 +993,11 @@
 	PROC_UNLOCK(p);
 	crfree(oldcred);
 	return (0);
+
+fail:
+	PROC_UNLOCK(p);
+	crfree(newcred);
+	return (error);
 }
 
 /*
@@ -968,6 +1033,13 @@
 	ruip = uifind(ruid);
 	PROC_LOCK(p);
 	oldcred = p->p_ucred;
+
+#ifdef MAC
+	error = mac_check_proc_setresuid(p, oldcred, ruid, euid, suid);
+	if (error)
+		goto fail;
+#endif
+
 	if (((ruid != (uid_t)-1 && ruid != oldcred->cr_ruid &&
 	     ruid != oldcred->cr_svuid &&
 	      ruid != oldcred->cr_uid) ||
@@ -977,13 +1049,8 @@
 	     (suid != (uid_t)-1 && suid != oldcred->cr_ruid &&
 	    suid != oldcred->cr_svuid &&
 	      suid != oldcred->cr_uid)) &&
-	    (error = suser_cred(oldcred, SUSER_ALLOWJAIL)) != 0) {
-		PROC_UNLOCK(p);
-		uifree(ruip);
-		uifree(euip);
-		crfree(newcred);
-		return (error);
-	}
+	    (error = suser_cred(oldcred, SUSER_ALLOWJAIL)) != 0)
+		goto fail;
 
 	crcopy(newcred, oldcred);
 	if (euid != (uid_t)-1 && oldcred->cr_uid != euid) {
@@ -1004,6 +1071,14 @@
 	uifree(euip);
 	crfree(oldcred);
 	return (0);
+
+fail:
+	PROC_UNLOCK(p);
+	uifree(ruip);
+	uifree(euip);
+	crfree(newcred);
+	return (error);
+
 }
 
 /*
@@ -1036,6 +1111,13 @@
 	newcred = crget();
 	PROC_LOCK(p);
 	oldcred = p->p_ucred;
+
+#ifdef MAC
+	error = mac_check_proc_setresgid(p, oldcred, rgid, egid, sgid);
+	if (error)
+		goto fail;
+#endif
+
 	if (((rgid != (gid_t)-1 && rgid != oldcred->cr_rgid &&
 	      rgid != oldcred->cr_svgid &&
 	      rgid != oldcred->cr_groups[0]) ||
@@ -1045,11 +1127,8 @@
 	     (sgid != (gid_t)-1 && sgid != oldcred->cr_rgid &&
 	      sgid != oldcred->cr_svgid &&
 	      sgid != oldcred->cr_groups[0])) &&
-	    (error = suser_cred(oldcred, SUSER_ALLOWJAIL)) != 0) {
-		PROC_UNLOCK(p);
-		crfree(newcred);
-		return (error);
-	}
+	    (error = suser_cred(oldcred, SUSER_ALLOWJAIL)) != 0)
+		goto fail;
 
 	crcopy(newcred, oldcred);
 	if (egid != (gid_t)-1 && oldcred->cr_groups[0] != egid) {
@@ -1068,6 +1147,11 @@
 	PROC_UNLOCK(p);
 	crfree(oldcred);
 	return (0);
+
+fail:
+	PROC_UNLOCK(p);
+	crfree(newcred);
+	return (error);
 }
 
 #ifndef _SYS_SYSPROTO_H_

==== //depot/projects/trustedbsd/mac/sys/security/mac/mac_process.c#14 (text+ko) ====

@@ -2,6 +2,7 @@
  * Copyright (c) 1999-2002 Robert N. M. Watson
  * Copyright (c) 2001 Ilmar S. Habibulin
  * Copyright (c) 2001-2003 Networks Associates Technology, Inc.
+ * Copyright (c) 2005 Samy Al Bahra
  * All rights reserved.
  *
  * This software was developed by Robert Watson and Ilmar Habibulin for the
@@ -85,6 +86,11 @@
     &mac_mmap_revocation_via_cow, 0, "Revoke mmap access to files via "
     "copy-on-write semantics, or by removing all write access");
 
+static int	mac_enforce_suid = 1;
+SYSCTL_INT(_security_mac, OID_AUTO, enforce_suid, CTLFLAW_RW,
+    &mac_enforce_suid, 0, "Enforce MAC policy on suid/sgid operations");
+TUNABLE_INT("security.mac.enforce_suid", &mac_enforce_suid);
+
 #ifdef MAC_DEBUG
 static unsigned int nmaccreds, nmacprocs;
 SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, creds, CTLFLAG_RD,
@@ -515,6 +521,137 @@
 }
 
 int
+mac_check_proc_setuid(struct proc *proc, struct ucred *cred, uid_t uid)
+{
+	int error;
+
+	PROC_LOCK_ASSERT(proc, MA_OWNED);
+
+	if (!mac_enforce_suid)
+		return (0);
+
+	MAC_CHECK(check_proc_setuid, cred, uid);
+	return (error);
+}
+
+int
+mac_check_proc_seteuid(struct proc *proc, struct ucred *cred, uid_t euid)
+{
+	int error;
+
+	PROC_LOCK_ASSERT(proc, MA_OWNED);
+
+	if (!mac_enforce_suid)
+		return (0);
+
+	MAC_CHECK(check_proc_seteuid, cred, euid);
+	return (error);
+}
+
+int
+mac_check_proc_setgid(struct proc *proc, struct ucred *cred, gid_t gid)
+{
+	int error;
+
+	PROC_LOCK_ASSERT(proc, MA_OWNED);
+
+	if (!mac_enforce_suid)
+		return (0);
+
+	MAC_CHECK(check_proc_setgid, cred, gid);
+	return (error);
+}
+
+int
+mac_check_proc_setegid(struct proc *proc, struct ucred *cred, gid_t egid)
+{
+	int error;
+
+	PROC_LOCK_ASSERT(proc, MA_OWNED);
+
+	if (!mac_enforce_suid)
+		return (0);
+
+	MAC_CHECK(check_proc_setegid, cred, egid);
+	return (error);
+}
+
+int
+mac_check_proc_setgroups(struct proc *proc, struct ucred *cred,
+	int ngroups, gid_t *gidset)
+{
+	int error;
+
+	PROC_LOCK_ASSERT(proc, MA_OWNED);
+
+	if (!mac_enforce_suid)
+		return (0);
+
+	MAC_CHECK(check_proc_setgroups, cred, ngroups, gidset);
+	return (error);
+}
+
+int
+mac_check_proc_setreuid(struct proc *proc, struct ucred *cred, uid_t ruid,
+	uid_t euid)
+{
+	int error;
+
+	PROC_LOCK_ASSERT(proc, MA_OWNED);
+
+	if (!mac_enforce_suid)
+		return (0);
+
+	MAC_CHECK(check_proc_setreuid, cred, ruid, euid);
+	return (error);
+}
+
+int
+mac_check_proc_setregid(struct proc *proc, struct ucred *cred, gid_t rgid,
+	gid_t egid)
+{
+	int error;
+
+	PROC_LOCK_ASSERT(proc, MA_OWNED);
+
+	if (!mac_enforce_suid)
+		return (0);
+
+	MAC_CHECK(check_proc_setregid, cred, rgid, egid);
+	return (error);
+}
+
+int
+mac_check_proc_setresuid(struct proc *proc, struct ucred *cred, uid_t ruid,
+	uid_t euid, uid_t suid)
+{
+	int error;
+
+	PROC_LOCK_ASSERT(proc, MA_OWNED);
+
+	if (!mac_enforce_suid)
+		return (0);
+
+	MAC_CHECK(check_proc_setresuid, cred, ruid, euid, suid);
+	return (error);
+}
+
+int
+mac_check_proc_setresgid(struct proc *proc, struct ucred *cred, gid_t rgid,
+	gid_t egid, gid_t sgid)
+{
+	int error;
+
+	PROC_LOCK_ASSERT(proc, MA_OWNED);
+
+	if (!mac_enforce_suid)
+		return (0);
+
+	MAC_CHECK(check_proc_setresgid, cred, rgid, egid, sgid);
+	return (error);
+}
+
+int
 mac_check_proc_wait(struct ucred *cred, struct proc *proc)
 {
 	int error;

==== //depot/projects/trustedbsd/mac/sys/security/mac_stub/mac_stub.c#24 (text+ko) ====

@@ -924,6 +924,72 @@
 }
 
 static int
+stub_check_proc_setuid(struct ucred *cred, uid_t uid)
+{
+
+	return (0);
+}
+
+static int
+stub_check_proc_seteuid(struct ucred *cred, uid_t euid)
+{
+
+	return (0);
+}
+
+static int
+stub_check_proc_setgid(struct ucred *cred, gid_t gid)
+{
+
+	return (0);
+}
+
+static int
+stub_check_proc_setegid(struct ucred *cred, gid_t egid)
+{
+
+	return (0);
+}
+
+static int
+stub_check_proc_setgroups(struct ucred *cred, int ngroups,
+	gid_t *gidset)
+{
+
+	return (0);
+}
+
+static int
+stub_check_proc_setreuid(struct ucred *cred, uid_t ruid, uid_t euid)
+{
+
+	return (0);
+}
+
+static int
+stub_check_proc_setregid(struct ucred *cred, gid_t rgid, gid_t egid)
+{
+
+	return (0);
+}
+
+static int
+stub_check_proc_setresuid(struct ucred *cred, uid_t ruid, uid_t euid,
+	uid_t suid)
+{
+
+	return (0);
+}
+
+static int
+stub_check_proc_setresgid(struct ucred *cred, gid_t rgid, gid_t egid,
+	gid_t sgid)
+{
+
+	return (0);
+}
+
+static int
 stub_check_socket_bind(struct ucred *cred, struct socket *socket,
     struct label *socketlabel, struct sockaddr *sockaddr)
 {
@@ -1442,6 +1508,15 @@
 	.mpo_check_posix_sem_wait = stub_check_posix_sem_wait,
 	.mpo_check_proc_debug = stub_check_proc_debug,
 	.mpo_check_proc_sched = stub_check_proc_sched,
+	.mpo_check_proc_setuid = stub_check_proc_setuid,
+	.mpo_check_proc_seteuid = stub_check_proc_seteuid,
+	.mpo_check_proc_setgid = stub_check_proc_setgid,
+	.mpo_check_proc_setegid = stub_check_proc_setegid,
+	.mpo_check_proc_setgroups = stub_check_proc_setgroups,
+	.mpo_check_proc_setreuid = stub_check_proc_setreuid,
+	.mpo_check_proc_setregid = stub_check_proc_setregid,
+	.mpo_check_proc_setresuid = stub_check_proc_setresuid,
+	.mpo_check_proc_setresgid = stub_check_proc_setresgid,
 	.mpo_check_proc_signal = stub_check_proc_signal,
 	.mpo_check_proc_wait = stub_check_proc_wait,
 	.mpo_check_socket_bind = stub_check_socket_bind,

==== //depot/projects/trustedbsd/mac/sys/security/mac_test/mac_test.c#139 (text+ko) ====

@@ -1796,6 +1796,90 @@
 }
 
 static int
+mac_test_check_proc_setuid(struct ucred *cred, uid_t uid)
+{
+
+	ASSERT_CRED_LABEL(cred->cr_label);
+
+	return (0);
+}
+
+static int
+mac_test_check_proc_seteuid(struct ucred *cred, uid_t euid)
+{
+
+	ASSERT_CRED_LABEL(cred->cr_label);
+
+	return (0);
+}
+
+static int
+mac_test_check_proc_setgid(struct ucred *cred, gid_t gid)
+{
+
+	ASSERT_CRED_LABEL(cred->cr_label);
+
+	return (0);
+}
+
+static int
+mac_test_check_proc_setegid(struct ucred *cred, gid_t egid)
+{
+
+	ASSERT_CRED_LABEL(cred->cr_label);
+
+	return (0);
+}
+
+static int
+mac_test_check_proc_setgroups(struct ucred *cred, int ngroups,
+	gid_t *gidset)
+{
+
+	ASSERT_CRED_LABEL(cred->cr_label);
+
+	return (0);
+}
+
+static int
+mac_test_check_proc_setreuid(struct ucred *cred, uid_t ruid, uid_t euid)
+{
+
+	ASSERT_CRED_LABEL(cred->cr_label);
+
+	return (0);
+}
+
+static int
+mac_test_check_proc_setregid(struct ucred *cred, gid_t rgid, gid_t egid)
+{
+
+	ASSERT_CRED_LABEL(cred->cr_label);
+
+	return (0);
+}
+
+static int
+mac_test_check_proc_setresuid(struct ucred *cred, uid_t ruid, uid_t euid,
+	uid_t suid)
+{
+
+	ASSERT_CRED_LABEL(cred->cr_label);
+
+	return (0);
+}
+
+static int
+mac_test_check_proc_setresgid(struct ucred *cred, gid_t rgid, gid_t egid,
+	gid_t sgid)
+{
+
+	ASSERT_CRED_LABEL(cred->cr_label);
+
+	return (0);
+}
+
+static int
 mac_test_check_socket_bind(struct ucred *cred, struct socket *socket,
     struct label *socketlabel, struct sockaddr *sockaddr)
 {
@@ -2468,6 +2552,15 @@
 	.mpo_check_posix_sem_wait = mac_test_check_posix_ksem,
 	.mpo_check_proc_debug = mac_test_check_proc_debug,
 	.mpo_check_proc_sched = mac_test_check_proc_sched,
+	.mpo_check_proc_setuid = mac_test_check_proc_setuid,
+	.mpo_check_proc_seteuid = mac_test_check_proc_seteuid,
+	.mpo_check_proc_setgid = mac_test_check_proc_setgid,
+	.mpo_check_proc_setegid = mac_test_check_proc_setegid,
+	.mpo_check_proc_setgroups = mac_test_check_proc_setgroups,
+	.mpo_check_proc_setreuid = mac_test_check_proc_setreuid,
+	.mpo_check_proc_setregid = mac_test_check_proc_setregid,
+	.mpo_check_proc_setresuid = mac_test_check_proc_setresuid,
+	.mpo_check_proc_setresgid = mac_test_check_proc_setresgid,
 	.mpo_check_proc_signal = mac_test_check_proc_signal,
 	.mpo_check_proc_wait = mac_test_check_proc_wait,
 	.mpo_check_socket_bind = mac_test_check_socket_bind,

==== //depot/projects/trustedbsd/mac/sys/sys/mac.h#264 (text+ko) ====

@@ -350,6 +350,24 @@
 int	mac_check_posix_sem_wait(struct ucred *cred, struct ksem *ksemptr);
 int	mac_check_proc_debug(struct ucred *cred, struct proc *proc);
 int	mac_check_proc_sched(struct ucred *cred, struct proc *proc);
+int	mac_check_proc_setuid(struct proc *proc,  struct ucred *cred,
+	    uid_t uid);
+int	mac_check_proc_seteuid(struct proc *proc, struct ucred *cred,
+	    uid_t euid);
+int	mac_check_proc_setgid(struct proc *proc, struct ucred *cred,
+	    gid_t gid);
+int	mac_check_proc_setegid(struct proc *proc, struct ucred *cred,
+	    gid_t egid);
+int	mac_check_proc_setgroups(struct proc *proc, struct ucred *cred,
+	    int ngroups, gid_t *gidset);
+int	mac_check_proc_setreuid(struct proc *proc, struct ucred *cred,
+	    uid_t ruid, uid_t euid);
+int	mac_check_proc_setregid(struct proc *proc, struct ucred *cred,
+	    gid_t rgid, gid_t egid);
+int	mac_check_proc_setresuid(struct proc *proc, struct ucred *cred,
+	    uid_t ruid, uid_t euid, uid_t suid);
+int	mac_check_proc_setresgid(struct proc *proc, struct ucred *cred,
+	    gid_t rgid, gid_t egid, gid_t sgid);
 int	mac_check_proc_signal(struct ucred *cred, struct proc *proc,
 	    int signum);
 int	mac_check_proc_wait(struct ucred *cred, struct proc *proc);

==== //depot/projects/trustedbsd/mac/sys/sys/mac_policy.h#221 (text+ko) ====

@@ -435,6 +435,20 @@
 		    struct proc *proc);
 	int	(*mpo_check_proc_sched)(struct ucred *cred,
 		    struct proc *proc);
+	int	(*mpo_check_proc_setuid)(struct ucred *cred, uid_t uid);
+	int	(*mpo_check_proc_seteuid)(struct ucred *cred, uid_t euid);
+	int	(*mpo_check_proc_setgid)(struct ucred *cred, gid_t gid);
+	int	(*mpo_check_proc_setegid)(struct ucred *cred, gid_t egid);
+	int	(*mpo_check_proc_setgroups)(struct ucred *cred, int ngroups,
+		    gid_t *gidset);
+	int	(*mpo_check_proc_setreuid)(struct ucred *cred, uid_t ruid,
+		    uid_t euid);
+	int	(*mpo_check_proc_setregid)(struct ucred *cred, gid_t rgid,
+		    gid_t egid);
+	int	(*mpo_check_proc_setresuid)(struct ucred *cred, uid_t ruid,
+		    uid_t euid, uid_t suid);
+	int	(*mpo_check_proc_setresgid)(struct ucred *cred, gid_t rgid,
+		    gid_t egid, gid_t sgid);
 	int	(*mpo_check_proc_signal)(struct ucred *cred,
 		    struct proc *proc, int signum);
 	int	(*mpo_check_proc_wait)(struct ucred *cred,
To Unsubscribe: send mail to majordomo at trustedbsd.org
with "unsubscribe trustedbsd-cvs" in the body of the message



More information about the trustedbsd-cvs mailing list