upstream/opnsense-src
1
0
Fork 0
mirror of https://github.com/opnsense/src.git synced 2026-06-09 08:43:19 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

Abstract the label checking and setting logic from

Browse source 
mac_setsockopt_label() into mac_socket_label_set(); make it non-static
so that it can be invoked from kern_mac.c for mac_set_fd().

Obtained from:	TrustedBSD Project
Sponsored by:	DARPA, Network Associates Laboratories
This commit is contained in:
Robert Watson 2003-11-16 20:01:50 +00:00
parent 0196273b2d
commit c9ea2dcf62
2 changed files with 24 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
sys/security/mac/mac_internal.h
View file

@ -121,6 +121,9 @@ int mac_externalize_pipe_label(struct label *label, char *elements,
char *outbuf, size_t outbuflen);
int mac_internalize_pipe_label(struct label *label, char *string);
int mac_socket_label_set(struct ucred *cred, struct socket *so,
struct label *label);
int mac_externalize_vnode_label(struct label *label, char *elements,
char *outbuf, size_t outbuflen);
int mac_internalize_vnode_label(struct label *label, char *string);

34
sys/security/mac/mac_net.c
View file

@ -885,6 +885,20 @@ mac_ioctl_ifnet_set(struct ucred *cred, struct ifreq *ifr,
return (0);
}
int
mac_socket_label_set(struct ucred *cred, struct socket *so,
struct label *label)
{
int error;
error = mac_check_socket_relabel(cred, so, label);
if (error)
return (error);
mac_relabel_socket(cred, so, label);
return (0);
}
int
mac_setsockopt_label(struct ucred *cred, struct socket *so, struct mac *mac)
{
@ -906,21 +920,15 @@ mac_setsockopt_label(struct ucred *cred, struct socket *so, struct mac *mac)
intlabel = mac_socket_label_alloc(M_WAITOK);
error = mac_internalize_socket_label(intlabel, buffer);
free(buffer, M_MACTEMP);
if (error) {
mac_socket_label_free(intlabel);
return (error);
}
mac_check_socket_relabel(cred, so, intlabel);
if (error) {
mac_socket_label_free(intlabel);
return (error);
}
mac_relabel_socket(cred, so, intlabel);
if (error)
goto out;
/* XXX: Socket lock here. */
error = mac_socket_label_set(cred, so, intlabel);
/* XXX: Socket unlock here. */
out:
mac_socket_label_free(intlabel);
return (0);
return (error);
}
int