diff options
| author | elad <elad@NetBSD.org> | 2009-09-03 04:45:27 +0000 |
|---|---|---|
| committer | elad <elad@NetBSD.org> | 2009-09-03 04:45:27 +0000 |
| commit | a162140107dc5af89a74c20d9575dc2dfb34fa4f (patch) | |
| tree | e8cd9e20eef539a93eb389f1f66d3c7fc0bcd6c6 /sys/secmodel/securelevel | |
| parent | 0add6502d8a7515fbd38b7afc435f11340f7c59d (diff) | |
Implement the vnode scope and adapt tmpfs to use it.
Mailing list reference:
http://mail-index.netbsd.org/tech-kern/2009/07/04/msg005404.html
Diffstat (limited to 'sys/secmodel/securelevel')
| -rw-r--r-- | sys/secmodel/securelevel/secmodel_securelevel.c | 28 | ||||
| -rw-r--r-- | sys/secmodel/securelevel/securelevel.h | 4 |
2 files changed, 28 insertions, 4 deletions
diff --git a/sys/secmodel/securelevel/secmodel_securelevel.c b/sys/secmodel/securelevel/secmodel_securelevel.c index 9e34e498fcc..1b0b39b9548 100644 --- a/sys/secmodel/securelevel/secmodel_securelevel.c +++ b/sys/secmodel/securelevel/secmodel_securelevel.c @@ -1,4 +1,4 @@ -/* $NetBSD: secmodel_securelevel.c,v 1.12 2009/07/25 16:08:02 mbalmer Exp $ */ +/* $NetBSD: secmodel_securelevel.c,v 1.13 2009/09/03 04:45:28 elad Exp $ */ /*- * Copyright (c) 2006 Elad Efrat <elad@NetBSD.org> * All rights reserved. @@ -35,7 +35,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: secmodel_securelevel.c,v 1.12 2009/07/25 16:08:02 mbalmer Exp $"); +__KERNEL_RCSID(0, "$NetBSD: secmodel_securelevel.c,v 1.13 2009/09/03 04:45:28 elad Exp $"); #ifdef _KERNEL_OPT #include "opt_insecure.h" @@ -56,7 +56,8 @@ __KERNEL_RCSID(0, "$NetBSD: secmodel_securelevel.c,v 1.12 2009/07/25 16:08:02 mb static int securelevel; -static kauth_listener_t l_system, l_process, l_network, l_machdep, l_device; +static kauth_listener_t l_system, l_process, l_network, l_machdep, l_device, + l_vnode; /* * sysctl helper routine for securelevel. ensures that the value @@ -126,6 +127,8 @@ secmodel_securelevel_start(void) secmodel_securelevel_machdep_cb, NULL); l_device = kauth_listen_scope(KAUTH_SCOPE_DEVICE, secmodel_securelevel_device_cb, NULL); + l_vnode = kauth_listen_scope(KAUTH_SCOPE_VNODE, + secmodel_securelevel_vnode_cb, NULL); } #if defined(_LKM) @@ -137,6 +140,7 @@ secmodel_securelevel_stop(void) kauth_unlisten_scope(l_network); kauth_unlisten_scope(l_machdep); kauth_unlisten_scope(l_device); + kauth_unlisten_scope(l_vnode); } #endif /* _LKM */ @@ -545,3 +549,21 @@ secmodel_securelevel_device_cb(kauth_cred_t cred, return (result); } + +int +secmodel_securelevel_vnode_cb(kauth_cred_t cred, kauth_action_t action, + void *cookie, void *arg0, void *arg1, void *arg2, void *arg3) +{ + int result; + + result = KAUTH_RESULT_DEFER; + + if ((action & KAUTH_VNODE_WRITE_SYSFLAGS) && + (action & KAUTH_VNODE_HAS_SYSFLAGS)) { + if (securelevel > 0) + result = KAUTH_RESULT_DENY; + } + + return (result); +} + diff --git a/sys/secmodel/securelevel/securelevel.h b/sys/secmodel/securelevel/securelevel.h index f9f98f7f1fc..6b2b2de5f95 100644 --- a/sys/secmodel/securelevel/securelevel.h +++ b/sys/secmodel/securelevel/securelevel.h @@ -1,4 +1,4 @@ -/* $NetBSD: securelevel.h,v 1.1 2007/11/21 22:49:09 elad Exp $ */ +/* $NetBSD: securelevel.h,v 1.2 2009/09/03 04:45:28 elad Exp $ */ /*- * Copyright (c) 2006 Elad Efrat <elad@NetBSD.org> * All rights reserved. @@ -49,5 +49,7 @@ int secmodel_securelevel_machdep_cb(kauth_cred_t, kauth_action_t, void *, void *, void *, void *, void *); int secmodel_securelevel_device_cb(kauth_cred_t, kauth_action_t, void *, void *, void *, void *, void *); +int secmodel_securelevel_vnode_cb(kauth_cred_t, kauth_action_t, void *, + void *, void *, void *, void *); #endif /* !_SECMODEL_SECURELEVEL_SECURELEVEL_H_ */ |
