jimzah/freebsd-src
1
0
Fork 0
mirror of https://github.com/freebsd/freebsd-src.git synced 2024-12-05 10:09:30 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

Push 'security.mac.debug_label_fallback' behind options MAC_DEBUG.

Browse Source 
Obtained from:	TrustedBSD Project
Sponsored by:	DARPA, NAI Labs
This commit is contained in:
Robert Watson 2002-10-01 03:24:20 +00:00
parent 7bf2a42fd5
commit 6be0c25e4e
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=104268
9 changed files with 126 additions and 90 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
sys/kern/kern_mac.c
View File

@ -97,16 +97,6 @@ SYSCTL_DECL(_security);
SYSCTL_NODE(_security, OID_AUTO, mac, CTLFLAG_RW, 0,
"TrustedBSD MAC policy controls");
SYSCTL_NODE(_security_mac, OID_AUTO, debug, CTLFLAG_RW, 0,
"TrustedBSD MAC debug info");
static int mac_debug_label_fallback = 0;
SYSCTL_INT(_security_mac_debug, OID_AUTO, label_fallback, CTLFLAG_RW,
&mac_debug_label_fallback, 0, "Filesystems should fall back to fs label"
"when label is corrupted.");
TUNABLE_INT("security.mac.debug_label_fallback",
&mac_debug_label_fallback);
#ifndef MAC_MAX_POLICIES
#define MAC_MAX_POLICIES 8
#endif
@ -177,6 +167,16 @@ SYSCTL_INT(_security_mac, OID_AUTO, mmap_revocation_via_cow, CTLFLAG_RW,
"copy-on-write semantics, or by removing all write access");
#ifdef MAC_DEBUG
SYSCTL_NODE(_security_mac, OID_AUTO, debug, CTLFLAG_RW, 0,
"TrustedBSD MAC debug info");
static int mac_debug_label_fallback = 0;
SYSCTL_INT(_security_mac_debug, OID_AUTO, label_fallback, CTLFLAG_RW,
&mac_debug_label_fallback, 0, "Filesystems should fall back to fs label"
"when label is corrupted.");
TUNABLE_INT("security.mac.debug_label_fallback",
&mac_debug_label_fallback);
static unsigned int nmacmbufs, nmaccreds, nmacifnets, nmacbpfdescs,
nmacsockets, nmacmounts, nmactemp, nmacvnodes, nmacdevfsdirents,
nmacipqs, nmacpipes;
@ -1082,14 +1082,18 @@ vop_stdrefreshlabel_ea(struct vop_refreshlabel_args *ap)
vp->v_mount->mnt_stat.f_mntonname);
if (VOP_GETATTR(vp, &va, curthread->td_ucred, curthread) == 0)
printf(" inum %ld", va.va_fileid);
#ifdef MAC_DEBUG
if (mac_debug_label_fallback) {
printf(", falling back.\n");
mac_update_vnode_from_mount(vp, vp->v_mount);
error = 0;
} else {
#endif
printf(".\n");
error = EPERM;
#ifdef MAC_DEBUG
}
#endif
}
return (error);

24
sys/security/mac/mac_framework.c
View File

@ -97,16 +97,6 @@ SYSCTL_DECL(_security);
SYSCTL_NODE(_security, OID_AUTO, mac, CTLFLAG_RW, 0,
"TrustedBSD MAC policy controls");
SYSCTL_NODE(_security_mac, OID_AUTO, debug, CTLFLAG_RW, 0,
"TrustedBSD MAC debug info");
static int mac_debug_label_fallback = 0;
SYSCTL_INT(_security_mac_debug, OID_AUTO, label_fallback, CTLFLAG_RW,
&mac_debug_label_fallback, 0, "Filesystems should fall back to fs label"
"when label is corrupted.");
TUNABLE_INT("security.mac.debug_label_fallback",
&mac_debug_label_fallback);
#ifndef MAC_MAX_POLICIES
#define MAC_MAX_POLICIES 8
#endif
@ -177,6 +167,16 @@ SYSCTL_INT(_security_mac, OID_AUTO, mmap_revocation_via_cow, CTLFLAG_RW,
"copy-on-write semantics, or by removing all write access");
#ifdef MAC_DEBUG
SYSCTL_NODE(_security_mac, OID_AUTO, debug, CTLFLAG_RW, 0,
"TrustedBSD MAC debug info");
static int mac_debug_label_fallback = 0;
SYSCTL_INT(_security_mac_debug, OID_AUTO, label_fallback, CTLFLAG_RW,
&mac_debug_label_fallback, 0, "Filesystems should fall back to fs label"
"when label is corrupted.");
TUNABLE_INT("security.mac.debug_label_fallback",
&mac_debug_label_fallback);
static unsigned int nmacmbufs, nmaccreds, nmacifnets, nmacbpfdescs,
nmacsockets, nmacmounts, nmactemp, nmacvnodes, nmacdevfsdirents,
nmacipqs, nmacpipes;
@ -1082,14 +1082,18 @@ vop_stdrefreshlabel_ea(struct vop_refreshlabel_args *ap)
vp->v_mount->mnt_stat.f_mntonname);
if (VOP_GETATTR(vp, &va, curthread->td_ucred, curthread) == 0)
printf(" inum %ld", va.va_fileid);
#ifdef MAC_DEBUG
if (mac_debug_label_fallback) {
printf(", falling back.\n");
mac_update_vnode_from_mount(vp, vp->v_mount);
error = 0;
} else {
#endif
printf(".\n");
error = EPERM;
#ifdef MAC_DEBUG
}
#endif
}
return (error);

24
sys/security/mac/mac_internal.h
View File

@ -97,16 +97,6 @@ SYSCTL_DECL(_security);
SYSCTL_NODE(_security, OID_AUTO, mac, CTLFLAG_RW, 0,
"TrustedBSD MAC policy controls");
SYSCTL_NODE(_security_mac, OID_AUTO, debug, CTLFLAG_RW, 0,
"TrustedBSD MAC debug info");
static int mac_debug_label_fallback = 0;
SYSCTL_INT(_security_mac_debug, OID_AUTO, label_fallback, CTLFLAG_RW,
&mac_debug_label_fallback, 0, "Filesystems should fall back to fs label"
"when label is corrupted.");
TUNABLE_INT("security.mac.debug_label_fallback",
&mac_debug_label_fallback);
#ifndef MAC_MAX_POLICIES
#define MAC_MAX_POLICIES 8
#endif
@ -177,6 +167,16 @@ SYSCTL_INT(_security_mac, OID_AUTO, mmap_revocation_via_cow, CTLFLAG_RW,
"copy-on-write semantics, or by removing all write access");
#ifdef MAC_DEBUG
SYSCTL_NODE(_security_mac, OID_AUTO, debug, CTLFLAG_RW, 0,
"TrustedBSD MAC debug info");
static int mac_debug_label_fallback = 0;
SYSCTL_INT(_security_mac_debug, OID_AUTO, label_fallback, CTLFLAG_RW,
&mac_debug_label_fallback, 0, "Filesystems should fall back to fs label"
"when label is corrupted.");
TUNABLE_INT("security.mac.debug_label_fallback",
&mac_debug_label_fallback);
static unsigned int nmacmbufs, nmaccreds, nmacifnets, nmacbpfdescs,
nmacsockets, nmacmounts, nmactemp, nmacvnodes, nmacdevfsdirents,
nmacipqs, nmacpipes;
@ -1082,14 +1082,18 @@ vop_stdrefreshlabel_ea(struct vop_refreshlabel_args *ap)
vp->v_mount->mnt_stat.f_mntonname);
if (VOP_GETATTR(vp, &va, curthread->td_ucred, curthread) == 0)
printf(" inum %ld", va.va_fileid);
#ifdef MAC_DEBUG
if (mac_debug_label_fallback) {
printf(", falling back.\n");
mac_update_vnode_from_mount(vp, vp->v_mount);
error = 0;
} else {
#endif
printf(".\n");
error = EPERM;
#ifdef MAC_DEBUG
}
#endif
}
return (error);

24
sys/security/mac/mac_net.c
View File

@ -97,16 +97,6 @@ SYSCTL_DECL(_security);
SYSCTL_NODE(_security, OID_AUTO, mac, CTLFLAG_RW, 0,
"TrustedBSD MAC policy controls");
SYSCTL_NODE(_security_mac, OID_AUTO, debug, CTLFLAG_RW, 0,
"TrustedBSD MAC debug info");
static int mac_debug_label_fallback = 0;
SYSCTL_INT(_security_mac_debug, OID_AUTO, label_fallback, CTLFLAG_RW,
&mac_debug_label_fallback, 0, "Filesystems should fall back to fs label"
"when label is corrupted.");
TUNABLE_INT("security.mac.debug_label_fallback",
&mac_debug_label_fallback);
#ifndef MAC_MAX_POLICIES
#define MAC_MAX_POLICIES 8
#endif
@ -177,6 +167,16 @@ SYSCTL_INT(_security_mac, OID_AUTO, mmap_revocation_via_cow, CTLFLAG_RW,
"copy-on-write semantics, or by removing all write access");
#ifdef MAC_DEBUG
SYSCTL_NODE(_security_mac, OID_AUTO, debug, CTLFLAG_RW, 0,
"TrustedBSD MAC debug info");
static int mac_debug_label_fallback = 0;
SYSCTL_INT(_security_mac_debug, OID_AUTO, label_fallback, CTLFLAG_RW,
&mac_debug_label_fallback, 0, "Filesystems should fall back to fs label"
"when label is corrupted.");
TUNABLE_INT("security.mac.debug_label_fallback",
&mac_debug_label_fallback);
static unsigned int nmacmbufs, nmaccreds, nmacifnets, nmacbpfdescs,
nmacsockets, nmacmounts, nmactemp, nmacvnodes, nmacdevfsdirents,
nmacipqs, nmacpipes;
@ -1082,14 +1082,18 @@ vop_stdrefreshlabel_ea(struct vop_refreshlabel_args *ap)
vp->v_mount->mnt_stat.f_mntonname);
if (VOP_GETATTR(vp, &va, curthread->td_ucred, curthread) == 0)
printf(" inum %ld", va.va_fileid);
#ifdef MAC_DEBUG
if (mac_debug_label_fallback) {
printf(", falling back.\n");
mac_update_vnode_from_mount(vp, vp->v_mount);
error = 0;
} else {
#endif
printf(".\n");
error = EPERM;
#ifdef MAC_DEBUG
}
#endif
}
return (error);

24
sys/security/mac/mac_pipe.c
View File

@ -97,16 +97,6 @@ SYSCTL_DECL(_security);
SYSCTL_NODE(_security, OID_AUTO, mac, CTLFLAG_RW, 0,
"TrustedBSD MAC policy controls");
SYSCTL_NODE(_security_mac, OID_AUTO, debug, CTLFLAG_RW, 0,
"TrustedBSD MAC debug info");
static int mac_debug_label_fallback = 0;
SYSCTL_INT(_security_mac_debug, OID_AUTO, label_fallback, CTLFLAG_RW,
&mac_debug_label_fallback, 0, "Filesystems should fall back to fs label"
"when label is corrupted.");
TUNABLE_INT("security.mac.debug_label_fallback",
&mac_debug_label_fallback);
#ifndef MAC_MAX_POLICIES
#define MAC_MAX_POLICIES 8
#endif
@ -177,6 +167,16 @@ SYSCTL_INT(_security_mac, OID_AUTO, mmap_revocation_via_cow, CTLFLAG_RW,
"copy-on-write semantics, or by removing all write access");
#ifdef MAC_DEBUG
SYSCTL_NODE(_security_mac, OID_AUTO, debug, CTLFLAG_RW, 0,
"TrustedBSD MAC debug info");
static int mac_debug_label_fallback = 0;
SYSCTL_INT(_security_mac_debug, OID_AUTO, label_fallback, CTLFLAG_RW,
&mac_debug_label_fallback, 0, "Filesystems should fall back to fs label"
"when label is corrupted.");
TUNABLE_INT("security.mac.debug_label_fallback",
&mac_debug_label_fallback);
static unsigned int nmacmbufs, nmaccreds, nmacifnets, nmacbpfdescs,
nmacsockets, nmacmounts, nmactemp, nmacvnodes, nmacdevfsdirents,
nmacipqs, nmacpipes;
@ -1082,14 +1082,18 @@ vop_stdrefreshlabel_ea(struct vop_refreshlabel_args *ap)
vp->v_mount->mnt_stat.f_mntonname);
if (VOP_GETATTR(vp, &va, curthread->td_ucred, curthread) == 0)
printf(" inum %ld", va.va_fileid);
#ifdef MAC_DEBUG
if (mac_debug_label_fallback) {
printf(", falling back.\n");
mac_update_vnode_from_mount(vp, vp->v_mount);
error = 0;
} else {
#endif
printf(".\n");
error = EPERM;
#ifdef MAC_DEBUG
}
#endif
}
return (error);

24
sys/security/mac/mac_process.c
View File

@ -97,16 +97,6 @@ SYSCTL_DECL(_security);
SYSCTL_NODE(_security, OID_AUTO, mac, CTLFLAG_RW, 0,
"TrustedBSD MAC policy controls");
SYSCTL_NODE(_security_mac, OID_AUTO, debug, CTLFLAG_RW, 0,
"TrustedBSD MAC debug info");
static int mac_debug_label_fallback = 0;
SYSCTL_INT(_security_mac_debug, OID_AUTO, label_fallback, CTLFLAG_RW,
&mac_debug_label_fallback, 0, "Filesystems should fall back to fs label"
"when label is corrupted.");
TUNABLE_INT("security.mac.debug_label_fallback",
&mac_debug_label_fallback);
#ifndef MAC_MAX_POLICIES
#define MAC_MAX_POLICIES 8
#endif
@ -177,6 +167,16 @@ SYSCTL_INT(_security_mac, OID_AUTO, mmap_revocation_via_cow, CTLFLAG_RW,
"copy-on-write semantics, or by removing all write access");
#ifdef MAC_DEBUG
SYSCTL_NODE(_security_mac, OID_AUTO, debug, CTLFLAG_RW, 0,
"TrustedBSD MAC debug info");
static int mac_debug_label_fallback = 0;
SYSCTL_INT(_security_mac_debug, OID_AUTO, label_fallback, CTLFLAG_RW,
&mac_debug_label_fallback, 0, "Filesystems should fall back to fs label"
"when label is corrupted.");
TUNABLE_INT("security.mac.debug_label_fallback",
&mac_debug_label_fallback);
static unsigned int nmacmbufs, nmaccreds, nmacifnets, nmacbpfdescs,
nmacsockets, nmacmounts, nmactemp, nmacvnodes, nmacdevfsdirents,
nmacipqs, nmacpipes;
@ -1082,14 +1082,18 @@ vop_stdrefreshlabel_ea(struct vop_refreshlabel_args *ap)
vp->v_mount->mnt_stat.f_mntonname);
if (VOP_GETATTR(vp, &va, curthread->td_ucred, curthread) == 0)
printf(" inum %ld", va.va_fileid);
#ifdef MAC_DEBUG
if (mac_debug_label_fallback) {
printf(", falling back.\n");
mac_update_vnode_from_mount(vp, vp->v_mount);
error = 0;
} else {
#endif
printf(".\n");
error = EPERM;
#ifdef MAC_DEBUG
}
#endif
}
return (error);

24
sys/security/mac/mac_syscalls.c
View File

@ -97,16 +97,6 @@ SYSCTL_DECL(_security);
SYSCTL_NODE(_security, OID_AUTO, mac, CTLFLAG_RW, 0,
"TrustedBSD MAC policy controls");
SYSCTL_NODE(_security_mac, OID_AUTO, debug, CTLFLAG_RW, 0,
"TrustedBSD MAC debug info");
static int mac_debug_label_fallback = 0;
SYSCTL_INT(_security_mac_debug, OID_AUTO, label_fallback, CTLFLAG_RW,
&mac_debug_label_fallback, 0, "Filesystems should fall back to fs label"
"when label is corrupted.");
TUNABLE_INT("security.mac.debug_label_fallback",
&mac_debug_label_fallback);
#ifndef MAC_MAX_POLICIES
#define MAC_MAX_POLICIES 8
#endif
@ -177,6 +167,16 @@ SYSCTL_INT(_security_mac, OID_AUTO, mmap_revocation_via_cow, CTLFLAG_RW,
"copy-on-write semantics, or by removing all write access");
#ifdef MAC_DEBUG
SYSCTL_NODE(_security_mac, OID_AUTO, debug, CTLFLAG_RW, 0,
"TrustedBSD MAC debug info");
static int mac_debug_label_fallback = 0;
SYSCTL_INT(_security_mac_debug, OID_AUTO, label_fallback, CTLFLAG_RW,
&mac_debug_label_fallback, 0, "Filesystems should fall back to fs label"
"when label is corrupted.");
TUNABLE_INT("security.mac.debug_label_fallback",
&mac_debug_label_fallback);
static unsigned int nmacmbufs, nmaccreds, nmacifnets, nmacbpfdescs,
nmacsockets, nmacmounts, nmactemp, nmacvnodes, nmacdevfsdirents,
nmacipqs, nmacpipes;
@ -1082,14 +1082,18 @@ vop_stdrefreshlabel_ea(struct vop_refreshlabel_args *ap)
vp->v_mount->mnt_stat.f_mntonname);
if (VOP_GETATTR(vp, &va, curthread->td_ucred, curthread) == 0)
printf(" inum %ld", va.va_fileid);
#ifdef MAC_DEBUG
if (mac_debug_label_fallback) {
printf(", falling back.\n");
mac_update_vnode_from_mount(vp, vp->v_mount);
error = 0;
} else {
#endif
printf(".\n");
error = EPERM;
#ifdef MAC_DEBUG
}
#endif
}
return (error);

24
sys/security/mac/mac_system.c
View File

@ -97,16 +97,6 @@ SYSCTL_DECL(_security);
SYSCTL_NODE(_security, OID_AUTO, mac, CTLFLAG_RW, 0,
"TrustedBSD MAC policy controls");
SYSCTL_NODE(_security_mac, OID_AUTO, debug, CTLFLAG_RW, 0,
"TrustedBSD MAC debug info");
static int mac_debug_label_fallback = 0;
SYSCTL_INT(_security_mac_debug, OID_AUTO, label_fallback, CTLFLAG_RW,
&mac_debug_label_fallback, 0, "Filesystems should fall back to fs label"
"when label is corrupted.");
TUNABLE_INT("security.mac.debug_label_fallback",
&mac_debug_label_fallback);
#ifndef MAC_MAX_POLICIES
#define MAC_MAX_POLICIES 8
#endif
@ -177,6 +167,16 @@ SYSCTL_INT(_security_mac, OID_AUTO, mmap_revocation_via_cow, CTLFLAG_RW,
"copy-on-write semantics, or by removing all write access");
#ifdef MAC_DEBUG
SYSCTL_NODE(_security_mac, OID_AUTO, debug, CTLFLAG_RW, 0,
"TrustedBSD MAC debug info");
static int mac_debug_label_fallback = 0;
SYSCTL_INT(_security_mac_debug, OID_AUTO, label_fallback, CTLFLAG_RW,
&mac_debug_label_fallback, 0, "Filesystems should fall back to fs label"
"when label is corrupted.");
TUNABLE_INT("security.mac.debug_label_fallback",
&mac_debug_label_fallback);
static unsigned int nmacmbufs, nmaccreds, nmacifnets, nmacbpfdescs,
nmacsockets, nmacmounts, nmactemp, nmacvnodes, nmacdevfsdirents,
nmacipqs, nmacpipes;
@ -1082,14 +1082,18 @@ vop_stdrefreshlabel_ea(struct vop_refreshlabel_args *ap)
vp->v_mount->mnt_stat.f_mntonname);
if (VOP_GETATTR(vp, &va, curthread->td_ucred, curthread) == 0)
printf(" inum %ld", va.va_fileid);
#ifdef MAC_DEBUG
if (mac_debug_label_fallback) {
printf(", falling back.\n");
mac_update_vnode_from_mount(vp, vp->v_mount);
error = 0;
} else {
#endif
printf(".\n");
error = EPERM;
#ifdef MAC_DEBUG
}
#endif
}
return (error);

24
sys/security/mac/mac_vfs.c
View File

@ -97,16 +97,6 @@ SYSCTL_DECL(_security);
SYSCTL_NODE(_security, OID_AUTO, mac, CTLFLAG_RW, 0,
"TrustedBSD MAC policy controls");
SYSCTL_NODE(_security_mac, OID_AUTO, debug, CTLFLAG_RW, 0,
"TrustedBSD MAC debug info");
static int mac_debug_label_fallback = 0;
SYSCTL_INT(_security_mac_debug, OID_AUTO, label_fallback, CTLFLAG_RW,
&mac_debug_label_fallback, 0, "Filesystems should fall back to fs label"
"when label is corrupted.");
TUNABLE_INT("security.mac.debug_label_fallback",
&mac_debug_label_fallback);
#ifndef MAC_MAX_POLICIES
#define MAC_MAX_POLICIES 8
#endif
@ -177,6 +167,16 @@ SYSCTL_INT(_security_mac, OID_AUTO, mmap_revocation_via_cow, CTLFLAG_RW,
"copy-on-write semantics, or by removing all write access");
#ifdef MAC_DEBUG
SYSCTL_NODE(_security_mac, OID_AUTO, debug, CTLFLAG_RW, 0,
"TrustedBSD MAC debug info");
static int mac_debug_label_fallback = 0;
SYSCTL_INT(_security_mac_debug, OID_AUTO, label_fallback, CTLFLAG_RW,
&mac_debug_label_fallback, 0, "Filesystems should fall back to fs label"
"when label is corrupted.");
TUNABLE_INT("security.mac.debug_label_fallback",
&mac_debug_label_fallback);
static unsigned int nmacmbufs, nmaccreds, nmacifnets, nmacbpfdescs,
nmacsockets, nmacmounts, nmactemp, nmacvnodes, nmacdevfsdirents,
nmacipqs, nmacpipes;
@ -1082,14 +1082,18 @@ vop_stdrefreshlabel_ea(struct vop_refreshlabel_args *ap)
vp->v_mount->mnt_stat.f_mntonname);
if (VOP_GETATTR(vp, &va, curthread->td_ucred, curthread) == 0)
printf(" inum %ld", va.va_fileid);
#ifdef MAC_DEBUG
if (mac_debug_label_fallback) {
printf(", falling back.\n");
mac_update_vnode_from_mount(vp, vp->v_mount);
error = 0;
} else {
#endif
printf(".\n");
error = EPERM;
#ifdef MAC_DEBUG
}
#endif
}
return (error);