summaryrefslogtreecommitdiff
path: root/sys/secmodel
diff options
context:
space:
mode:
authorelad <elad@NetBSD.org>2006-12-29 18:34:28 +0000
committerelad <elad@NetBSD.org>2006-12-29 18:34:28 +0000
commit4798cd2cab86ec633917ea231d4130dd4f08cfc4 (patch)
tree8f9fa15c8b1a37daffc62d1180edfc09d9d43dec /sys/secmodel
parenta220cee1c37b6fbc0e8a495753eb8301dcb7b40d (diff)
Support device scope.
Diffstat (limited to 'sys/secmodel')
-rw-r--r--sys/secmodel/overlay/overlay.h4
-rw-r--r--sys/secmodel/overlay/secmodel_overlay.c41
2 files changed, 42 insertions, 3 deletions
diff --git a/sys/secmodel/overlay/overlay.h b/sys/secmodel/overlay/overlay.h
index f784ef07824..183c6da9be9 100644
--- a/sys/secmodel/overlay/overlay.h
+++ b/sys/secmodel/overlay/overlay.h
@@ -1,4 +1,4 @@
-/* $NetBSD: overlay.h,v 1.1 2006/09/08 20:58:57 elad Exp $ */
+/* $NetBSD: overlay.h,v 1.2 2006/12/29 18:34:28 elad Exp $ */
/*-
* Copyright (c) 2006 Elad Efrat <elad@NetBSD.org>
* All rights reserved.
@@ -45,5 +45,7 @@ int secmodel_overlay_network_cb(kauth_cred_t, kauth_action_t, void *,
void *, void *, void *, void *);
int secmodel_overlay_machdep_cb(kauth_cred_t, kauth_action_t, void *,
void *, void *, void *, void *);
+int secmodel_overlay_device_cb(kauth_cred_t, kauth_action_t, void *,
+ void *, void *, void *, void *);
#endif /* !_SECMODEL_OVERLAY_OVERLAY_H_ */
diff --git a/sys/secmodel/overlay/secmodel_overlay.c b/sys/secmodel/overlay/secmodel_overlay.c
index 06213b13d54..46153186120 100644
--- a/sys/secmodel/overlay/secmodel_overlay.c
+++ b/sys/secmodel/overlay/secmodel_overlay.c
@@ -1,4 +1,4 @@
-/* $NetBSD: secmodel_overlay.c,v 1.3 2006/09/17 14:27:40 elad Exp $ */
+/* $NetBSD: secmodel_overlay.c,v 1.4 2006/12/29 18:34:28 elad Exp $ */
/*-
* Copyright (c) 2006 Elad Efrat <elad@NetBSD.org>
* All rights reserved.
@@ -30,7 +30,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: secmodel_overlay.c,v 1.3 2006/09/17 14:27:40 elad Exp $");
+__KERNEL_RCSID(0, "$NetBSD: secmodel_overlay.c,v 1.4 2006/12/29 18:34:28 elad Exp $");
#include <sys/types.h>
#include <sys/param.h>
@@ -53,12 +53,14 @@ __KERNEL_RCSID(0, "$NetBSD: secmodel_overlay.c,v 1.3 2006/09/17 14:27:40 elad Ex
#define OVERLAY_ISCOPE_PROCESS "org.netbsd.kauth.overlay.process"
#define OVERLAY_ISCOPE_NETWORK "org.netbsd.kauth.overlay.network"
#define OVERLAY_ISCOPE_MACHDEP "org.netbsd.kauth.overlay.machdep"
+#define OVERLAY_ISCOPE_DEVICE "org.netbsd.kauth.overlay.device"
static kauth_scope_t secmodel_overlay_iscope_generic;
static kauth_scope_t secmodel_overlay_iscope_system;
static kauth_scope_t secmodel_overlay_iscope_process;
static kauth_scope_t secmodel_overlay_iscope_network;
static kauth_scope_t secmodel_overlay_iscope_machdep;
+static kauth_scope_t secmodel_overlay_iscope_device;
extern int secmodel_bsd44_curtain;
@@ -81,6 +83,8 @@ secmodel_overlay_init(void)
OVERLAY_ISCOPE_NETWORK, NULL, NULL);
secmodel_overlay_iscope_machdep = kauth_register_scope(
OVERLAY_ISCOPE_MACHDEP, NULL, NULL);
+ secmodel_overlay_iscope_device = kauth_register_scope(
+ OVERLAY_ISCOPE_DEVICE, NULL, NULL);
/*
* Register fall-back listeners, from bsd44, to each internal
@@ -109,6 +113,11 @@ secmodel_overlay_init(void)
kauth_listen_scope(OVERLAY_ISCOPE_MACHDEP,
secmodel_bsd44_securelevel_machdep_cb, NULL);
+ kauth_listen_scope(OVERLAY_ISCOPE_DEVICE,
+ secmodel_bsd44_suser_device_cb, NULL);
+ kauth_listen_scope(OVERLAY_ISCOPE_DEVICE,
+ secmodel_bsd44_securelevel_device_cb, NULL);
+
secmodel_bsd44_init();
}
@@ -176,6 +185,8 @@ secmodel_start(void)
secmodel_overlay_network_cb, NULL);
kauth_listen_scope(KAUTH_SCOPE_MACHDEP,
secmodel_overlay_machdep_cb, NULL);
+ kauth_listen_scope(KAUTH_SCOPE_DEVICE,
+ secmodel_overlay_device_cb, NULL);
}
/*
@@ -307,3 +318,29 @@ secmodel_overlay_machdep_cb(kauth_cred_t cred, kauth_action_t action,
return (result);
}
+
+/*
+ * Overlay listener for the device scope.
+ */
+int
+secmodel_overlay_device_cb(kauth_cred_t cred, kauth_action_t action,
+ void *cookie, void *arg0, void *arg1, void *arg2, void *arg3)
+{
+ int result;
+
+ result = KAUTH_RESULT_DEFER;
+
+ switch (action) {
+ default:
+ result = KAUTH_RESULT_DEFER;
+ break;
+ }
+
+ if (result == KAUTH_RESULT_DEFER) {
+ result = kauth_authorize_action(
+ secmodel_overlay_iscope_device, cred, action,
+ arg0, arg1, arg2, arg3);
+ }
+
+ return (result);
+}