Proposition about new object.

[Pawel Jakub Dawidek]

Hello.

Maybe my proposition is weird, but please, think it over.

How about to treat syscall as object in MAC?
We just need to modify syscall() function in trap.c:

	[...]
	#ifdef MAC
		error = mac_check_syscall_befor(td, args);
		if (error != 0)
			goto somewhere;
	#endif

	error = (*callp->sy_call)(td, args);

	#ifdef MAC
		error = mac_check_syscall_after(td, args, error);
		if (error != 0)
			goto somewhere;
	#endif
	[...]


This will give as unlimited possbilities. We could monitor, modify
syscall arguments, return values or even disallow selected users to
call selected syscalls.

There are many places that this could be used. For example, we got
bug in some syscall - argument type is int, but we don't check
in syscall if it isn't less than 0 as it shouldn't be. So fast workaround
for this problem is to put somewhere kld module that will check this
argument befor syscall is called. Not always we are able to rebuild kernel
and reboot machine immediately.

What is Your opinion about this proposition?

-- 
Pawel Jakub Dawidek
UNIX Systems Administrator
http://garage.freebsd.pl
Am I Evil? Yes, I Am.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 305 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/trustedbsd-discuss/attachments/20021221/d1085db6/attachment.bin