PERFORCE change 79092 for review

[Andrew Reisse]

http://perforce.freebsd.org/chv.cgi?CH=79092

Change 79092 by areisse at areisse_ibook on 2005/06/28 19:11:25

	Sedarwin policy:
	-checkpolicy needs to be told to use version 17
	-sebsd_migscs (mach msgid->security class mapping table) should
	 be installed with the policy (To have it loaded by the kernel,
	 use OF variable load_sebsd_migscs=sebsd_migscs)
	-Add a simple use of the automated mach message access checks.
	 Use boolean "lookups" to enable or disable the prboot command.

Affected files ...

.. //depot/projects/trustedbsd/sedarwin7/src/sedarwin/policy/Makefile#4 edit
.. //depot/projects/trustedbsd/sedarwin7/src/sedarwin/policy/rules#3 edit

Differences ...

==== //depot/projects/trustedbsd/sedarwin7/src/sedarwin/policy/Makefile#4 (text+ko) ====

@@ -15,7 +15,7 @@
 	cat $(INPUTS) > policy.conf
 
 $(POLICY): policy.conf
-	../programs/checkpolicy/checkpolicy -o $(POLICY) policy.conf
+	../programs/checkpolicy/checkpolicy -c 17 -o $(POLICY) policy.conf
 
 rules.m4: rules
 	m4 -Imacros -s rules > rules.m4
@@ -35,16 +35,17 @@
 
 install:
 	$(INSTALL) -o ${BINOWN} -g ${BINGRP} -m 644 ${POLICY} ${DESTDIR}
+	$(INSTALL) -o ${BINOWN} -g ${BINGRP} -m 644 sebsd_migscs ${DESTDIR}
 	$(INSTALL) -o ${BINOWN} -g ${BINGRP} -m 700 ${SCRIPTS} ${DESTDIR}/private/etc/sedarwin
 	(cd $(CURDIR)/..; tar -cf - policy) | (cd $(DESTDIR)/private/etc/sedarwin/; tar -xf -)
 	cp -f Makefile.install $(DESTDIR)/private/etc/sedarwin/policy/Makefile
 
-
 # Mig security classes and access vectors
 
 DEFS = $(DARWIN_ROOT)/system_cmds/mach_init.tproj/bootstrap.defs
 
 mig_msgids: $(DEFS)
+	echo > $@
 	for i in $(DEFS); do $(MIG) -user /dev/null -server /dev/null -header /dev/null -sheader /dev/null -flasksc `basename $$i .defs`.flask $$i; cat `basename $$i .defs`.flask >> $@; done
 
 mig_access_vectors: mig_msgids
@@ -55,4 +56,4 @@
 	grep '^class' $< > $@
 
 sebsd_migscs: flask/security_classes mig_msgids
-	cat flask/security_classes mig_msgids | perl migscs.pl+	cat flask/security_classes mig_msgids | perl migscs.pl

==== //depot/projects/trustedbsd/sedarwin7/src/sedarwin/policy/rules#3 (text+ko) ====

@@ -121,6 +121,7 @@
 allow domain2 self:mach_task set_special_port;
 allow domain2 self:mi_bootstrap { bootstrap_look_up };
 allow domain2 root_t:dir { search getattr read };
+allow domain2 self:process getsched;
 allow kernel_d domain2:mach_port { send make_send copy_send };
 
 allow domain2 file:{file lnk_file sock_file fifo_file} {create_file_perms execute };
@@ -175,6 +176,7 @@
 #type_change loginwindow_d loginwindow_d:mach_names user_names_t; #XXX
 allow init_d init_d:mach_port relabelfrom;
 allow init_d boot_names_t:mach_port relabelto;
+allow init_d {loginwindow_d windowserver_d}:mach_port relabelto;
 allow init_d user_names_t:mach_port { copy_send relabelto };
 
 allow_mach_ipc(systemstarter_d,unlabeled_t);
@@ -309,3 +311,8 @@
 user_sys_access(user_d,user_names_t);
 user_sys_access(protected_d,user_names_t);
 user_sys_access(user_secret_d,user_names_t); # can't use other names types yet
+
+bool lookups false;
+if (lookups) {
+allow user_d {init_d systemstarter_d loginwindow_d user_d}:mi_bootstrap bootstrap_info;
+}
To Unsubscribe: send mail to majordomo at trustedbsd.org
with "unsubscribe trustedbsd-cvs" in the body of the message