upstream/opnsense-src
1
0
Fork 0
mirror of https://github.com/opnsense/src.git synced 2026-06-13 18:50:31 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

Synch from TrustedBSD MAC tree:

Browse source 
- If a policy isn't registered when a policy module unloads, silently
  succeed.

- Hold the policy list lock across more of the validity tests to avoid
  races.

Obtained from:	TrustedBSD Project
Sponsored by:	DARPA, Network Associates Laboratories
This commit is contained in:
Robert Watson 2002-10-05 16:46:03 +00:00
parent 3bd6561289
commit ea599aa018
9 changed files with 225 additions and 27 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

28
sys/kern/kern_mac.c
View file

@ -928,16 +928,38 @@ static int
mac_policy_unregister(struct mac_policy_conf *mpc)
{
/*
* If we fail the load, we may get a request to unload. Check
* to see if we did the run-time registration, and if not,
* silently succeed.
*/
MAC_POLICY_LIST_LOCK();
if ((mpc->mpc_runtime_flags & MPC_RUNTIME_FLAG_REGISTERED) == 0) {
MAC_POLICY_LIST_UNLOCK();
return (0);
}
#if 0
/*
* Don't allow unloading modules with private data.
*/
if (mpc->mpc_field_off != NULL)
if (mpc->mpc_field_off != NULL) {
MAC_POLICY_LIST_UNLOCK();
return (EBUSY);
}
#endif
if ((mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_UNLOADOK) == 0)
/*
* Only allow the unload to proceed if the module is unloadable
* by its own definition.
*/
if ((mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_UNLOADOK) == 0) {
MAC_POLICY_LIST_UNLOCK();
return (EBUSY);
MAC_POLICY_LIST_LOCK();
}
/*
* Right now, we EBUSY if the list is in use. In the future,
* for reliability reasons, we might want to sleep and wakeup
* later to try again.
*/
if (mac_policy_list_busy > 0) {
MAC_POLICY_LIST_UNLOCK();
return (EBUSY);

28
sys/security/mac/mac_framework.c
View file

@ -928,16 +928,38 @@ static int
mac_policy_unregister(struct mac_policy_conf *mpc)
{
/*
* If we fail the load, we may get a request to unload. Check
* to see if we did the run-time registration, and if not,
* silently succeed.
*/
MAC_POLICY_LIST_LOCK();
if ((mpc->mpc_runtime_flags & MPC_RUNTIME_FLAG_REGISTERED) == 0) {
MAC_POLICY_LIST_UNLOCK();
return (0);
}
#if 0
/*
* Don't allow unloading modules with private data.
*/
if (mpc->mpc_field_off != NULL)
if (mpc->mpc_field_off != NULL) {
MAC_POLICY_LIST_UNLOCK();
return (EBUSY);
}
#endif
if ((mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_UNLOADOK) == 0)
/*
* Only allow the unload to proceed if the module is unloadable
* by its own definition.
*/
if ((mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_UNLOADOK) == 0) {
MAC_POLICY_LIST_UNLOCK();
return (EBUSY);
MAC_POLICY_LIST_LOCK();
}
/*
* Right now, we EBUSY if the list is in use. In the future,
* for reliability reasons, we might want to sleep and wakeup
* later to try again.
*/
if (mac_policy_list_busy > 0) {
MAC_POLICY_LIST_UNLOCK();
return (EBUSY);

28
sys/security/mac/mac_internal.h
View file

@ -928,16 +928,38 @@ static int
mac_policy_unregister(struct mac_policy_conf *mpc)
{
/*
* If we fail the load, we may get a request to unload. Check
* to see if we did the run-time registration, and if not,
* silently succeed.
*/
MAC_POLICY_LIST_LOCK();
if ((mpc->mpc_runtime_flags & MPC_RUNTIME_FLAG_REGISTERED) == 0) {
MAC_POLICY_LIST_UNLOCK();
return (0);
}
#if 0
/*
* Don't allow unloading modules with private data.
*/
if (mpc->mpc_field_off != NULL)
if (mpc->mpc_field_off != NULL) {
MAC_POLICY_LIST_UNLOCK();
return (EBUSY);
}
#endif
if ((mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_UNLOADOK) == 0)
/*
* Only allow the unload to proceed if the module is unloadable
* by its own definition.
*/
if ((mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_UNLOADOK) == 0) {
MAC_POLICY_LIST_UNLOCK();
return (EBUSY);
MAC_POLICY_LIST_LOCK();
}
/*
* Right now, we EBUSY if the list is in use. In the future,
* for reliability reasons, we might want to sleep and wakeup
* later to try again.
*/
if (mac_policy_list_busy > 0) {
MAC_POLICY_LIST_UNLOCK();
return (EBUSY);

28
sys/security/mac/mac_net.c
View file

@ -928,16 +928,38 @@ static int
mac_policy_unregister(struct mac_policy_conf *mpc)
{
/*
* If we fail the load, we may get a request to unload. Check
* to see if we did the run-time registration, and if not,
* silently succeed.
*/
MAC_POLICY_LIST_LOCK();
if ((mpc->mpc_runtime_flags & MPC_RUNTIME_FLAG_REGISTERED) == 0) {
MAC_POLICY_LIST_UNLOCK();
return (0);
}
#if 0
/*
* Don't allow unloading modules with private data.
*/
if (mpc->mpc_field_off != NULL)
if (mpc->mpc_field_off != NULL) {
MAC_POLICY_LIST_UNLOCK();
return (EBUSY);
}
#endif
if ((mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_UNLOADOK) == 0)
/*
* Only allow the unload to proceed if the module is unloadable
* by its own definition.
*/
if ((mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_UNLOADOK) == 0) {
MAC_POLICY_LIST_UNLOCK();
return (EBUSY);
MAC_POLICY_LIST_LOCK();
}
/*
* Right now, we EBUSY if the list is in use. In the future,
* for reliability reasons, we might want to sleep and wakeup
* later to try again.
*/
if (mac_policy_list_busy > 0) {
MAC_POLICY_LIST_UNLOCK();
return (EBUSY);

28
sys/security/mac/mac_pipe.c
View file

@ -928,16 +928,38 @@ static int
mac_policy_unregister(struct mac_policy_conf *mpc)
{
/*
* If we fail the load, we may get a request to unload. Check
* to see if we did the run-time registration, and if not,
* silently succeed.
*/
MAC_POLICY_LIST_LOCK();
if ((mpc->mpc_runtime_flags & MPC_RUNTIME_FLAG_REGISTERED) == 0) {
MAC_POLICY_LIST_UNLOCK();
return (0);
}
#if 0
/*
* Don't allow unloading modules with private data.
*/
if (mpc->mpc_field_off != NULL)
if (mpc->mpc_field_off != NULL) {
MAC_POLICY_LIST_UNLOCK();
return (EBUSY);
}
#endif
if ((mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_UNLOADOK) == 0)
/*
* Only allow the unload to proceed if the module is unloadable
* by its own definition.
*/
if ((mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_UNLOADOK) == 0) {
MAC_POLICY_LIST_UNLOCK();
return (EBUSY);
MAC_POLICY_LIST_LOCK();
}
/*
* Right now, we EBUSY if the list is in use. In the future,
* for reliability reasons, we might want to sleep and wakeup
* later to try again.
*/
if (mac_policy_list_busy > 0) {
MAC_POLICY_LIST_UNLOCK();
return (EBUSY);

28
sys/security/mac/mac_process.c
View file

@ -928,16 +928,38 @@ static int
mac_policy_unregister(struct mac_policy_conf *mpc)
{
/*
* If we fail the load, we may get a request to unload. Check
* to see if we did the run-time registration, and if not,
* silently succeed.
*/
MAC_POLICY_LIST_LOCK();
if ((mpc->mpc_runtime_flags & MPC_RUNTIME_FLAG_REGISTERED) == 0) {
MAC_POLICY_LIST_UNLOCK();
return (0);
}
#if 0
/*
* Don't allow unloading modules with private data.
*/
if (mpc->mpc_field_off != NULL)
if (mpc->mpc_field_off != NULL) {
MAC_POLICY_LIST_UNLOCK();
return (EBUSY);
}
#endif
if ((mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_UNLOADOK) == 0)
/*
* Only allow the unload to proceed if the module is unloadable
* by its own definition.
*/
if ((mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_UNLOADOK) == 0) {
MAC_POLICY_LIST_UNLOCK();
return (EBUSY);
MAC_POLICY_LIST_LOCK();
}
/*
* Right now, we EBUSY if the list is in use. In the future,
* for reliability reasons, we might want to sleep and wakeup
* later to try again.
*/
if (mac_policy_list_busy > 0) {
MAC_POLICY_LIST_UNLOCK();
return (EBUSY);

28
sys/security/mac/mac_syscalls.c
View file

@ -928,16 +928,38 @@ static int
mac_policy_unregister(struct mac_policy_conf *mpc)
{
/*
* If we fail the load, we may get a request to unload. Check
* to see if we did the run-time registration, and if not,
* silently succeed.
*/
MAC_POLICY_LIST_LOCK();
if ((mpc->mpc_runtime_flags & MPC_RUNTIME_FLAG_REGISTERED) == 0) {
MAC_POLICY_LIST_UNLOCK();
return (0);
}
#if 0
/*
* Don't allow unloading modules with private data.
*/
if (mpc->mpc_field_off != NULL)
if (mpc->mpc_field_off != NULL) {
MAC_POLICY_LIST_UNLOCK();
return (EBUSY);
}
#endif
if ((mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_UNLOADOK) == 0)
/*
* Only allow the unload to proceed if the module is unloadable
* by its own definition.
*/
if ((mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_UNLOADOK) == 0) {
MAC_POLICY_LIST_UNLOCK();
return (EBUSY);
MAC_POLICY_LIST_LOCK();
}
/*
* Right now, we EBUSY if the list is in use. In the future,
* for reliability reasons, we might want to sleep and wakeup
* later to try again.
*/
if (mac_policy_list_busy > 0) {
MAC_POLICY_LIST_UNLOCK();
return (EBUSY);

28
sys/security/mac/mac_system.c
View file

@ -928,16 +928,38 @@ static int
mac_policy_unregister(struct mac_policy_conf *mpc)
{
/*
* If we fail the load, we may get a request to unload. Check
* to see if we did the run-time registration, and if not,
* silently succeed.
*/
MAC_POLICY_LIST_LOCK();
if ((mpc->mpc_runtime_flags & MPC_RUNTIME_FLAG_REGISTERED) == 0) {
MAC_POLICY_LIST_UNLOCK();
return (0);
}
#if 0
/*
* Don't allow unloading modules with private data.
*/
if (mpc->mpc_field_off != NULL)
if (mpc->mpc_field_off != NULL) {
MAC_POLICY_LIST_UNLOCK();
return (EBUSY);
}
#endif
if ((mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_UNLOADOK) == 0)
/*
* Only allow the unload to proceed if the module is unloadable
* by its own definition.
*/
if ((mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_UNLOADOK) == 0) {
MAC_POLICY_LIST_UNLOCK();
return (EBUSY);
MAC_POLICY_LIST_LOCK();
}
/*
* Right now, we EBUSY if the list is in use. In the future,
* for reliability reasons, we might want to sleep and wakeup
* later to try again.
*/
if (mac_policy_list_busy > 0) {
MAC_POLICY_LIST_UNLOCK();
return (EBUSY);

28
sys/security/mac/mac_vfs.c
View file

@ -928,16 +928,38 @@ static int
mac_policy_unregister(struct mac_policy_conf *mpc)
{
/*
* If we fail the load, we may get a request to unload. Check
* to see if we did the run-time registration, and if not,
* silently succeed.
*/
MAC_POLICY_LIST_LOCK();
if ((mpc->mpc_runtime_flags & MPC_RUNTIME_FLAG_REGISTERED) == 0) {
MAC_POLICY_LIST_UNLOCK();
return (0);
}
#if 0
/*
* Don't allow unloading modules with private data.
*/
if (mpc->mpc_field_off != NULL)
if (mpc->mpc_field_off != NULL) {
MAC_POLICY_LIST_UNLOCK();
return (EBUSY);
}
#endif
if ((mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_UNLOADOK) == 0)
/*
* Only allow the unload to proceed if the module is unloadable
* by its own definition.
*/
if ((mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_UNLOADOK) == 0) {
MAC_POLICY_LIST_UNLOCK();
return (EBUSY);
MAC_POLICY_LIST_LOCK();
}
/*
* Right now, we EBUSY if the list is in use. In the future,
* for reliability reasons, we might want to sleep and wakeup
* later to try again.
*/
if (mac_policy_list_busy > 0) {
MAC_POLICY_LIST_UNLOCK();
return (EBUSY);