PERFORCE change 20138 for review

[Robert Watson]

http://perforce.freebsd.org/chv.cgi?CH=20138

Change 20138 by rwatson at rwatson_tislabs on 2002/10/25 10:57:25

	Take a pass at integrating recent Biba changes into LOMAC.
	Probably not quite perfect.

Affected files ...

.. //depot/projects/trustedbsd/mac/sys/security/mac_lomac/mac_lomac.c#19 edit

Differences ...

==== //depot/projects/trustedbsd/mac/sys/security/mac_lomac/mac_lomac.c#19 (text+ko) ====

@@ -286,12 +286,12 @@
 }
 
 static int
-mac_lomac_subject_equal_ok(struct mac_lomac *mac_lomac)
+mac_lomac_subject_privileged(struct mac_lomac *mac_lomac)
 {
 
 	KASSERT((mac_lomac->ml_flags & MAC_LOMAC_FLAGS_BOTH) ==
 	    MAC_LOMAC_FLAGS_BOTH,
-	    ("mac_lomac_subject_equal_ok: subject doesn't have both labels"));
+	    ("mac_lomac_subject_privileged: subject doesn't have both labels"));
 
 	/* If the single is EQUAL, it's ok. */
 	if (mac_lomac->ml_single.mle_type == MAC_LOMAC_TYPE_EQUAL)
@@ -312,11 +312,12 @@
 }
 
 static int
-mac_lomac_privileged(struct mac_lomac *mac_lomac)
+mac_lomac_high_single(struct mac_lomac *mac_lomac)
 {
-
-	/* Equate the notion of "equal" with privilege. */
-	return (mac_lomac_subject_equal_ok(mac_lomac));
+	KASSERT((mac_lomac->ml_flags & MAC_LOMAC_FLAG_SINGLE) != 0,
+	    ("mac_lomac_high_single: mac_lomac not single"));
+ 
+	return (mac_lomac->ml_single.mle_type == MAC_LOMAC_TYPE_HIGH);
 }
 
 static int
@@ -1467,7 +1468,7 @@
 		 * their label.
 		 */
 		if (mac_lomac_contains_equal(new)) {
-			error = mac_lomac_subject_equal_ok(subj);
+			error = mac_lomac_subject_privileged(subj);
 			if (error)
 				return (error);
 		}
@@ -1519,6 +1520,13 @@
 		return (error);
 
 	/*
+	 * Relabling network interfaces requires LOMAC privilege.
+	 */
+	error = mac_lomac_subject_privileged(subj);
+	if (error)
+		return (error);
+
+	/*
 	 * If the LOMAC label is to be changed, authorize as appropriate.
 	 */
 	if (new->ml_flags & MAC_LOMAC_FLAGS_BOTH) {
@@ -1628,7 +1636,7 @@
 		 * subject must have appropriate privilege.
 		 */
 		if (mac_lomac_contains_equal(new)) {
-			error = mac_lomac_subject_equal_ok(subj);
+			error = mac_lomac_subject_privileged(subj);
 			if (error)
 				return (error);
 		}
@@ -1772,7 +1780,7 @@
 		 * the subject must have appropriate privilege.
 		 */
 		if (mac_lomac_contains_equal(new)) {
-			error = mac_lomac_subject_equal_ok(subj);
+			error = mac_lomac_subject_privileged(subj);
 			if (error)
 				return (error);
 		}
@@ -1812,11 +1820,20 @@
 	subj = SLOT(&cred->cr_label);
 
 	/*
-	 * Permit sysctl modification only if Biba-privileged; permit
-	 * read by any process.
+	 * In general, treat sysctl variables as lomac/high, but also
+	 * require privilege to change them, since they are a
+	 * communications channel between grades.  Exempt MIB
+	 * queries from this due to undocmented sysctl magic.
+	 * XXXMAC: This probably requires some more review.
 	 */
 	if (new != NULL) {
-		if (!mac_lomac_privileged(subj))
+		if (namelen > 0 && name[0] == 0)
+			return (0);
+
+		if (!mac_lomac_subject_dominate_high(subj))
+			return (EACCES);
+
+		if (!mac_lomac_subject_privileged(subj))
 			return (EPERM);
 	}
 
@@ -2065,7 +2082,7 @@
 		 * the subject must have appropriate privilege.
 		 */
 		if (mac_lomac_contains_equal(new)) {
-			error = mac_lomac_subject_equal_ok(subj);
+			error = mac_lomac_subject_privileged(subj);
 			if (error)
 				return (error);
 		}
@@ -2265,7 +2282,10 @@
 	subj = SLOT(&cred->cr_label);
 	obj = SLOT(label);
 
-	if (!mac_lomac_dominate_single(subj, obj))
+	if (!mac_lomac_subject_privileged(subj))
+		return (EPERM);
+
+	if (!mac_lomac_high_single(obj))
 		return (EACCES);
 
 	return (0);
To Unsubscribe: send mail to majordomo at trustedbsd.org
with "unsubscribe trustedbsd-cvs" in the body of the message