The Design and Implementation of the FreeBSD Operating System, Second Edition
Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]

FreeBSD/Linux Kernel Cross Reference
sys/security/mac/mac_process.c

Version: -  FREEBSD  -  FREEBSD-13-STABLE  -  FREEBSD-13-0  -  FREEBSD-12-STABLE  -  FREEBSD-12-0  -  FREEBSD-11-STABLE  -  FREEBSD-11-0  -  FREEBSD-10-STABLE  -  FREEBSD-10-0  -  FREEBSD-9-STABLE  -  FREEBSD-9-0  -  FREEBSD-8-STABLE  -  FREEBSD-8-0  -  FREEBSD-7-STABLE  -  FREEBSD-7-0  -  FREEBSD-6-STABLE  -  FREEBSD-6-0  -  FREEBSD-5-STABLE  -  FREEBSD-5-0  -  FREEBSD-4-STABLE  -  FREEBSD-3-STABLE  -  FREEBSD22  -  l41  -  OPENBSD  -  linux-2.6  -  MK84  -  PLAN9  -  xnu-8792 
SearchContext: -  none  -  3  -  10 

    1 /*-
    2  * Copyright (c) 1999-2002 Robert N. M. Watson
    3  * Copyright (c) 2001 Ilmar S. Habibulin
    4  * Copyright (c) 2001-2003 Networks Associates Technology, Inc.
    5  * Copyright (c) 2005 Samy Al Bahra
    6  * All rights reserved.
    7  *
    8  * This software was developed by Robert Watson and Ilmar Habibulin for the
    9  * TrustedBSD Project.
   10  *
   11  * This software was developed for the FreeBSD Project in part by Network
   12  * Associates Laboratories, the Security Research Division of Network
   13  * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"),
   14  * as part of the DARPA CHATS research program.
   15  *
   16  * Redistribution and use in source and binary forms, with or without
   17  * modification, are permitted provided that the following conditions
   18  * are met:
   19  * 1. Redistributions of source code must retain the above copyright
   20  *    notice, this list of conditions and the following disclaimer.
   21  * 2. Redistributions in binary form must reproduce the above copyright
   22  *    notice, this list of conditions and the following disclaimer in the
   23  *    documentation and/or other materials provided with the distribution.
   24  *
   25  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
   26  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
   27  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
   28  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
   29  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
   30  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
   31  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
   32  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
   33  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
   34  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
   35  * SUCH DAMAGE.
   36  */
   37 
   38 #include <sys/cdefs.h>
   39 __FBSDID("$FreeBSD$");
   40 
   41 #include "opt_mac.h"
   42 
   43 #include <sys/param.h>
   44 #include <sys/condvar.h>
   45 #include <sys/imgact.h>
   46 #include <sys/kernel.h>
   47 #include <sys/lock.h>
   48 #include <sys/malloc.h>
   49 #include <sys/mutex.h>
   50 #include <sys/mac.h>
   51 #include <sys/proc.h>
   52 #include <sys/sbuf.h>
   53 #include <sys/systm.h>
   54 #include <sys/vnode.h>
   55 #include <sys/mount.h>
   56 #include <sys/file.h>
   57 #include <sys/namei.h>
   58 #include <sys/sysctl.h>
   59 
   60 #include <vm/vm.h>
   61 #include <vm/pmap.h>
   62 #include <vm/vm_map.h>
   63 #include <vm/vm_object.h>
   64 
   65 #include <sys/mac_policy.h>
   66 
   67 #include <security/mac/mac_internal.h>
   68 
   69 int     mac_enforce_process = 1;
   70 SYSCTL_INT(_security_mac, OID_AUTO, enforce_process, CTLFLAG_RW,
   71     &mac_enforce_process, 0, "Enforce MAC policy on inter-process operations");
   72 TUNABLE_INT("security.mac.enforce_process", &mac_enforce_process);
   73 
   74 int     mac_enforce_vm = 1;
   75 SYSCTL_INT(_security_mac, OID_AUTO, enforce_vm, CTLFLAG_RW,
   76     &mac_enforce_vm, 0, "Enforce MAC policy on vm operations");
   77 TUNABLE_INT("security.mac.enforce_vm", &mac_enforce_vm);
   78 
   79 static int      mac_mmap_revocation = 1;
   80 SYSCTL_INT(_security_mac, OID_AUTO, mmap_revocation, CTLFLAG_RW,
   81     &mac_mmap_revocation, 0, "Revoke mmap access to files on subject "
   82     "relabel");
   83 
   84 static int      mac_mmap_revocation_via_cow = 0;
   85 SYSCTL_INT(_security_mac, OID_AUTO, mmap_revocation_via_cow, CTLFLAG_RW,
   86     &mac_mmap_revocation_via_cow, 0, "Revoke mmap access to files via "
   87     "copy-on-write semantics, or by removing all write access");
   88 
   89 static int      mac_enforce_suid = 1;
   90 SYSCTL_INT(_security_mac, OID_AUTO, enforce_suid, CTLFLAG_RW,
   91     &mac_enforce_suid, 0, "Enforce MAC policy on suid/sgid operations");
   92 TUNABLE_INT("security.mac.enforce_suid", &mac_enforce_suid);
   93 
   94 #ifdef MAC_DEBUG
   95 static unsigned int nmaccreds, nmacprocs;
   96 SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, creds, CTLFLAG_RD,
   97     &nmaccreds, 0, "number of ucreds in use");
   98 SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, procs, CTLFLAG_RD,
   99     &nmacprocs, 0, "number of procs in use");
  100 #endif
  101 
  102 static void     mac_cred_mmapped_drop_perms_recurse(struct thread *td,
  103                     struct ucred *cred, struct vm_map *map);
  104 
  105 struct label *
  106 mac_cred_label_alloc(void)
  107 {
  108         struct label *label;
  109 
  110         label = mac_labelzone_alloc(M_WAITOK);
  111         MAC_PERFORM(init_cred_label, label);
  112         MAC_DEBUG_COUNTER_INC(&nmaccreds);
  113         return (label);
  114 }
  115 
  116 void
  117 mac_init_cred(struct ucred *cred)
  118 {
  119 
  120         cred->cr_label = mac_cred_label_alloc();
  121 }
  122 
  123 static struct label *
  124 mac_proc_label_alloc(void)
  125 {
  126         struct label *label;
  127 
  128         label = mac_labelzone_alloc(M_WAITOK);
  129         MAC_PERFORM(init_proc_label, label);
  130         MAC_DEBUG_COUNTER_INC(&nmacprocs);
  131         return (label);
  132 }
  133 
  134 void
  135 mac_init_proc(struct proc *p)
  136 {
  137 
  138         p->p_label = mac_proc_label_alloc();
  139 }
  140 
  141 void
  142 mac_cred_label_free(struct label *label)
  143 {
  144 
  145         MAC_PERFORM(destroy_cred_label, label);
  146         mac_labelzone_free(label);
  147         MAC_DEBUG_COUNTER_DEC(&nmaccreds);
  148 }
  149 
  150 void
  151 mac_destroy_cred(struct ucred *cred)
  152 {
  153 
  154         mac_cred_label_free(cred->cr_label);
  155         cred->cr_label = NULL;
  156 }
  157 
  158 static void
  159 mac_proc_label_free(struct label *label)
  160 {
  161 
  162         MAC_PERFORM(destroy_proc_label, label);
  163         mac_labelzone_free(label);
  164         MAC_DEBUG_COUNTER_DEC(&nmacprocs);
  165 }
  166 
  167 void
  168 mac_destroy_proc(struct proc *p)
  169 {
  170 
  171         mac_proc_label_free(p->p_label);
  172         p->p_label = NULL;
  173 }
  174 
  175 int
  176 mac_externalize_cred_label(struct label *label, char *elements,
  177     char *outbuf, size_t outbuflen)
  178 {
  179         int error;
  180 
  181         MAC_EXTERNALIZE(cred, label, elements, outbuf, outbuflen);
  182 
  183         return (error);
  184 }
  185 
  186 int
  187 mac_internalize_cred_label(struct label *label, char *string)
  188 {
  189         int error;
  190 
  191         MAC_INTERNALIZE(cred, label, string);
  192 
  193         return (error);
  194 }
  195 
  196 /*
  197  * Initialize MAC label for the first kernel process, from which other
  198  * kernel processes and threads are spawned.
  199  */
  200 void
  201 mac_create_proc0(struct ucred *cred)
  202 {
  203 
  204         MAC_PERFORM(create_proc0, cred);
  205 }
  206 
  207 /*
  208  * Initialize MAC label for the first userland process, from which other
  209  * userland processes and threads are spawned.
  210  */
  211 void
  212 mac_create_proc1(struct ucred *cred)
  213 {
  214 
  215         MAC_PERFORM(create_proc1, cred);
  216 }
  217 
  218 void
  219 mac_thread_userret(struct thread *td)
  220 {
  221 
  222         MAC_PERFORM(thread_userret, td);
  223 }
  224 
  225 /*
  226  * When a new process is created, its label must be initialized.  Generally,
  227  * this involves inheritence from the parent process, modulo possible
  228  * deltas.  This function allows that processing to take place.
  229  */
  230 void
  231 mac_copy_cred(struct ucred *src, struct ucred *dest)
  232 {
  233 
  234         MAC_PERFORM(copy_cred_label, src->cr_label, dest->cr_label);
  235 }
  236 
  237 int
  238 mac_execve_enter(struct image_params *imgp, struct mac *mac_p)
  239 {
  240         struct label *label;
  241         struct mac mac;
  242         char *buffer;
  243         int error;
  244 
  245         if (mac_p == NULL)
  246                 return (0);
  247 
  248         error = copyin(mac_p, &mac, sizeof(mac));
  249         if (error)
  250                 return (error);
  251 
  252         error = mac_check_structmac_consistent(&mac);
  253         if (error)
  254                 return (error);
  255 
  256         buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK);
  257         error = copyinstr(mac.m_string, buffer, mac.m_buflen, NULL);
  258         if (error) {
  259                 free(buffer, M_MACTEMP);
  260                 return (error);
  261         }
  262 
  263         label = mac_cred_label_alloc();
  264         error = mac_internalize_cred_label(label, buffer);
  265         free(buffer, M_MACTEMP);
  266         if (error) {
  267                 mac_cred_label_free(label);
  268                 return (error);
  269         }
  270         imgp->execlabel = label;
  271         return (0);
  272 }
  273 
  274 void
  275 mac_execve_exit(struct image_params *imgp)
  276 {
  277         if (imgp->execlabel != NULL) {
  278                 mac_cred_label_free(imgp->execlabel);
  279                 imgp->execlabel = NULL;
  280         }
  281 }
  282 
  283 /*
  284  * When relabeling a process, call out to the policies for the maximum
  285  * permission allowed for each object type we know about in its
  286  * memory space, and revoke access (in the least surprising ways we
  287  * know) when necessary.  The process lock is not held here.
  288  */
  289 void
  290 mac_cred_mmapped_drop_perms(struct thread *td, struct ucred *cred)
  291 {
  292 
  293         /* XXX freeze all other threads */
  294         mac_cred_mmapped_drop_perms_recurse(td, cred,
  295             &td->td_proc->p_vmspace->vm_map);
  296         /* XXX allow other threads to continue */
  297 }
  298 
  299 static __inline const char *
  300 prot2str(vm_prot_t prot)
  301 {
  302 
  303         switch (prot & VM_PROT_ALL) {
  304         case VM_PROT_READ:
  305                 return ("r--");
  306         case VM_PROT_READ | VM_PROT_WRITE:
  307                 return ("rw-");
  308         case VM_PROT_READ | VM_PROT_EXECUTE:
  309                 return ("r-x");
  310         case VM_PROT_READ | VM_PROT_WRITE | VM_PROT_EXECUTE:
  311                 return ("rwx");
  312         case VM_PROT_WRITE:
  313                 return ("-w-");
  314         case VM_PROT_EXECUTE:
  315                 return ("--x");
  316         case VM_PROT_WRITE | VM_PROT_EXECUTE:
  317                 return ("-wx");
  318         default:
  319                 return ("---");
  320         }
  321 }
  322 
  323 static void
  324 mac_cred_mmapped_drop_perms_recurse(struct thread *td, struct ucred *cred,
  325     struct vm_map *map)
  326 {
  327         struct vm_map_entry *vme;
  328         int vfslocked, result;
  329         vm_prot_t revokeperms;
  330         vm_object_t backing_object, object;
  331         vm_ooffset_t offset;
  332         struct vnode *vp;
  333         struct mount *mp;
  334 
  335         if (!mac_mmap_revocation)
  336                 return;
  337 
  338         vm_map_lock_read(map);
  339         for (vme = map->header.next; vme != &map->header; vme = vme->next) {
  340                 if (vme->eflags & MAP_ENTRY_IS_SUB_MAP) {
  341                         mac_cred_mmapped_drop_perms_recurse(td, cred,
  342                             vme->object.sub_map);
  343                         continue;
  344                 }
  345                 /*
  346                  * Skip over entries that obviously are not shared.
  347                  */
  348                 if (vme->eflags & (MAP_ENTRY_COW | MAP_ENTRY_NOSYNC) ||
  349                     !vme->max_protection)
  350                         continue;
  351                 /*
  352                  * Drill down to the deepest backing object.
  353                  */
  354                 offset = vme->offset;
  355                 object = vme->object.vm_object;
  356                 if (object == NULL)
  357                         continue;
  358                 VM_OBJECT_LOCK(object);
  359                 while ((backing_object = object->backing_object) != NULL) {
  360                         VM_OBJECT_LOCK(backing_object);
  361                         offset += object->backing_object_offset;
  362                         VM_OBJECT_UNLOCK(object);
  363                         object = backing_object;
  364                 }
  365                 VM_OBJECT_UNLOCK(object);
  366                 /*
  367                  * At the moment, vm_maps and objects aren't considered
  368                  * by the MAC system, so only things with backing by a
  369                  * normal object (read: vnodes) are checked.
  370                  */
  371                 if (object->type != OBJT_VNODE)
  372                         continue;
  373                 vp = (struct vnode *)object->handle;
  374                 vfslocked = VFS_LOCK_GIANT(vp->v_mount);
  375                 vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td);
  376                 result = vme->max_protection;
  377                 mac_check_vnode_mmap_downgrade(cred, vp, &result);
  378                 VOP_UNLOCK(vp, 0, td);
  379                 /*
  380                  * Find out what maximum protection we may be allowing
  381                  * now but a policy needs to get removed.
  382                  */
  383                 revokeperms = vme->max_protection & ~result;
  384                 if (!revokeperms) {
  385                         VFS_UNLOCK_GIANT(vfslocked);
  386                         continue;
  387                 }
  388                 printf("pid %ld: revoking %s perms from %#lx:%ld "
  389                     "(max %s/cur %s)\n", (long)td->td_proc->p_pid,
  390                     prot2str(revokeperms), (u_long)vme->start,
  391                     (long)(vme->end - vme->start),
  392                     prot2str(vme->max_protection), prot2str(vme->protection));
  393                 vm_map_lock_upgrade(map);
  394                 /*
  395                  * This is the really simple case: if a map has more
  396                  * max_protection than is allowed, but it's not being
  397                  * actually used (that is, the current protection is
  398                  * still allowed), we can just wipe it out and do
  399                  * nothing more.
  400                  */
  401                 if ((vme->protection & revokeperms) == 0) {
  402                         vme->max_protection -= revokeperms;
  403                 } else {
  404                         if (revokeperms & VM_PROT_WRITE) {
  405                                 /*
  406                                  * In the more complicated case, flush out all
  407                                  * pending changes to the object then turn it
  408                                  * copy-on-write.
  409                                  */
  410                                 vm_object_reference(object);
  411                                 (void) vn_start_write(vp, &mp, V_WAIT);
  412                                 vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td);
  413                                 VM_OBJECT_LOCK(object);
  414                                 vm_object_page_clean(object,
  415                                     OFF_TO_IDX(offset),
  416                                     OFF_TO_IDX(offset + vme->end - vme->start +
  417                                         PAGE_MASK),
  418                                     OBJPC_SYNC);
  419                                 VM_OBJECT_UNLOCK(object);
  420                                 VOP_UNLOCK(vp, 0, td);
  421                                 vn_finished_write(mp);
  422                                 vm_object_deallocate(object);
  423                                 /*
  424                                  * Why bother if there's no read permissions
  425                                  * anymore?  For the rest, we need to leave
  426                                  * the write permissions on for COW, or
  427                                  * remove them entirely if configured to.
  428                                  */
  429                                 if (!mac_mmap_revocation_via_cow) {
  430                                         vme->max_protection &= ~VM_PROT_WRITE;
  431                                         vme->protection &= ~VM_PROT_WRITE;
  432                                 } if ((revokeperms & VM_PROT_READ) == 0)
  433                                         vme->eflags |= MAP_ENTRY_COW |
  434                                             MAP_ENTRY_NEEDS_COPY;
  435                         }
  436                         if (revokeperms & VM_PROT_EXECUTE) {
  437                                 vme->max_protection &= ~VM_PROT_EXECUTE;
  438                                 vme->protection &= ~VM_PROT_EXECUTE;
  439                         }
  440                         if (revokeperms & VM_PROT_READ) {
  441                                 vme->max_protection = 0;
  442                                 vme->protection = 0;
  443                         }
  444                         pmap_protect(map->pmap, vme->start, vme->end,
  445                             vme->protection & ~revokeperms);
  446                         vm_map_simplify_entry(map, vme);
  447                 }
  448                 vm_map_lock_downgrade(map);
  449                 VFS_UNLOCK_GIANT(vfslocked);
  450         }
  451         vm_map_unlock_read(map);
  452 }
  453 
  454 /*
  455  * When the subject's label changes, it may require revocation of privilege
  456  * to mapped objects.  This can't be done on-the-fly later with a unified
  457  * buffer cache.
  458  */
  459 void
  460 mac_relabel_cred(struct ucred *cred, struct label *newlabel)
  461 {
  462 
  463         MAC_PERFORM(relabel_cred, cred, newlabel);
  464 }
  465 
  466 int
  467 mac_check_cred_relabel(struct ucred *cred, struct label *newlabel)
  468 {
  469         int error;
  470 
  471         MAC_CHECK(check_cred_relabel, cred, newlabel);
  472 
  473         return (error);
  474 }
  475 
  476 int
  477 mac_check_cred_visible(struct ucred *u1, struct ucred *u2)
  478 {
  479         int error;
  480 
  481         if (!mac_enforce_process)
  482                 return (0);
  483 
  484         MAC_CHECK(check_cred_visible, u1, u2);
  485 
  486         return (error);
  487 }
  488 
  489 int
  490 mac_check_proc_debug(struct ucred *cred, struct proc *proc)
  491 {
  492         int error;
  493 
  494         PROC_LOCK_ASSERT(proc, MA_OWNED);
  495 
  496         if (!mac_enforce_process)
  497                 return (0);
  498 
  499         MAC_CHECK(check_proc_debug, cred, proc);
  500 
  501         return (error);
  502 }
  503 
  504 int
  505 mac_check_proc_sched(struct ucred *cred, struct proc *proc)
  506 {
  507         int error;
  508 
  509         PROC_LOCK_ASSERT(proc, MA_OWNED);
  510 
  511         if (!mac_enforce_process)
  512                 return (0);
  513 
  514         MAC_CHECK(check_proc_sched, cred, proc);
  515 
  516         return (error);
  517 }
  518 
  519 int
  520 mac_check_proc_signal(struct ucred *cred, struct proc *proc, int signum)
  521 {
  522         int error;
  523 
  524         PROC_LOCK_ASSERT(proc, MA_OWNED);
  525 
  526         if (!mac_enforce_process)
  527                 return (0);
  528 
  529         MAC_CHECK(check_proc_signal, cred, proc, signum);
  530 
  531         return (error);
  532 }
  533 
  534 int
  535 mac_check_proc_setuid(struct proc *proc, struct ucred *cred, uid_t uid)
  536 {
  537         int error;
  538 
  539         PROC_LOCK_ASSERT(proc, MA_OWNED);
  540 
  541         if (!mac_enforce_suid)
  542                 return (0);
  543 
  544         MAC_CHECK(check_proc_setuid, cred, uid);
  545         return (error);
  546 }
  547 
  548 int
  549 mac_check_proc_seteuid(struct proc *proc, struct ucred *cred, uid_t euid)
  550 {
  551         int error;
  552 
  553         PROC_LOCK_ASSERT(proc, MA_OWNED);
  554 
  555         if (!mac_enforce_suid)
  556                 return (0);
  557 
  558         MAC_CHECK(check_proc_seteuid, cred, euid);
  559         return (error);
  560 }
  561 
  562 int
  563 mac_check_proc_setgid(struct proc *proc, struct ucred *cred, gid_t gid)
  564 {
  565         int error;
  566 
  567         PROC_LOCK_ASSERT(proc, MA_OWNED);
  568 
  569         if (!mac_enforce_suid)
  570                 return (0);
  571 
  572         MAC_CHECK(check_proc_setgid, cred, gid);
  573         return (error);
  574 }
  575 
  576 int
  577 mac_check_proc_setegid(struct proc *proc, struct ucred *cred, gid_t egid)
  578 {
  579         int error;
  580 
  581         PROC_LOCK_ASSERT(proc, MA_OWNED);
  582 
  583         if (!mac_enforce_suid)
  584                 return (0);
  585 
  586         MAC_CHECK(check_proc_setegid, cred, egid);
  587         return (error);
  588 }
  589 
  590 int
  591 mac_check_proc_setgroups(struct proc *proc, struct ucred *cred,
  592         int ngroups, gid_t *gidset)
  593 {
  594         int error;
  595 
  596         PROC_LOCK_ASSERT(proc, MA_OWNED);
  597 
  598         if (!mac_enforce_suid)
  599                 return (0);
  600 
  601         MAC_CHECK(check_proc_setgroups, cred, ngroups, gidset);
  602         return (error);
  603 }
  604 
  605 int
  606 mac_check_proc_setreuid(struct proc *proc, struct ucred *cred, uid_t ruid,
  607         uid_t euid)
  608 {
  609         int error;
  610 
  611         PROC_LOCK_ASSERT(proc, MA_OWNED);
  612 
  613         if (!mac_enforce_suid)
  614                 return (0);
  615 
  616         MAC_CHECK(check_proc_setreuid, cred, ruid, euid);
  617         return (error);
  618 }
  619 
  620 int
  621 mac_check_proc_setregid(struct proc *proc, struct ucred *cred, gid_t rgid,
  622         gid_t egid)
  623 {
  624         int error;
  625 
  626         PROC_LOCK_ASSERT(proc, MA_OWNED);
  627 
  628         if (!mac_enforce_suid)
  629                 return (0);
  630 
  631         MAC_CHECK(check_proc_setregid, cred, rgid, egid);
  632         return (error);
  633 }
  634 
  635 int
  636 mac_check_proc_setresuid(struct proc *proc, struct ucred *cred, uid_t ruid,
  637         uid_t euid, uid_t suid)
  638 {
  639         int error;
  640 
  641         PROC_LOCK_ASSERT(proc, MA_OWNED);
  642 
  643         if (!mac_enforce_suid)
  644                 return (0);
  645 
  646         MAC_CHECK(check_proc_setresuid, cred, ruid, euid, suid);
  647         return (error);
  648 }
  649 
  650 int
  651 mac_check_proc_setresgid(struct proc *proc, struct ucred *cred, gid_t rgid,
  652         gid_t egid, gid_t sgid)
  653 {
  654         int error;
  655 
  656         PROC_LOCK_ASSERT(proc, MA_OWNED);
  657 
  658         if (!mac_enforce_suid)
  659                 return (0);
  660 
  661         MAC_CHECK(check_proc_setresgid, cred, rgid, egid, sgid);
  662         return (error);
  663 }
  664 
  665 int
  666 mac_check_proc_wait(struct ucred *cred, struct proc *proc)
  667 {
  668         int error;
  669 
  670         PROC_LOCK_ASSERT(proc, MA_OWNED);
  671 
  672         if (!mac_enforce_process)
  673                 return (0);
  674 
  675         MAC_CHECK(check_proc_wait, cred, proc);
  676 
  677         return (error);
  678 }

Cache object: 4471473dd88bfe8a5367fdc886e6973a


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]


This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.