upstream/opnsense-src
1
0
Fork 0
mirror of https://github.com/opnsense/src.git synced 2026-05-28 04:12:45 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

sysctls which should be restricted when securelevel is raised should also

Browse source 
be restricted when veriexec is enforced.

Add mpo_system_check_sysctl method to mac_veriexec which does this.

Obtained from:	Juniper Networks, Inc.
MFC after:	1 week
This commit is contained in:
Stephen J. Kiernan 2019-05-17 18:09:48 +00:00
parent 3d53cd0fbb
commit ed377cf415
1 changed files with 20 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

22
sys/security/mac_veriexec/mac_veriexec.c
View file

@ -1,7 +1,7 @@
/* /*
* $FreeBSD$ * $FreeBSD$
* *
* Copyright (c) 2011, 2012, 2013, 2015, 2016, Juniper Networks, Inc. * Copyright (c) 2011, 2012, 2013, 2015, 2016, 2019 Juniper Networks, Inc.
* All rights reserved. * All rights reserved.
* *
* Redistribution and use in source and binary forms, with or without * Redistribution and use in source and binary forms, with or without
@ -424,6 +424,23 @@ mac_veriexec_priv_check(struct ucred *cred, int priv)
return (0); return (0);
} }
static int
mac_veriexec_sysctl_check(struct ucred *cred, struct sysctl_oid *oidp,
void *arg1, int arg2, struct sysctl_req *req)
{
struct sysctl_oid *oid;
/* If we are not enforcing veriexec, nothing for us to check */
if ((mac_veriexec_state & VERIEXEC_STATE_ENFORCE) == 0)
return (0);
oid = oidp;
if (oid->oid_kind & CTLFLAG_SECURE) {
return (EPERM); /* XXX call mac_veriexec_priv_check? */
}
return 0;
}
/** /**
* @internal * @internal
* @brief A program is being executed and needs to be validated. * @brief A program is being executed and needs to be validated.
@ -700,12 +717,13 @@ cleanup_file:
static struct mac_policy_ops mac_veriexec_ops = static struct mac_policy_ops mac_veriexec_ops =
{ {
.mpo_init = mac_veriexec_init, .mpo_init = mac_veriexec_init,
.mpo_syscall = mac_veriexec_syscall,
.mpo_kld_check_load = mac_veriexec_kld_check_load, .mpo_kld_check_load = mac_veriexec_kld_check_load,
.mpo_mount_destroy_label = mac_veriexec_mount_destroy_label, .mpo_mount_destroy_label = mac_veriexec_mount_destroy_label,
.mpo_mount_init_label = mac_veriexec_mount_init_label, .mpo_mount_init_label = mac_veriexec_mount_init_label,
.mpo_priv_check = mac_veriexec_priv_check, .mpo_priv_check = mac_veriexec_priv_check,
.mpo_proc_check_debug = mac_veriexec_proc_check_debug, .mpo_proc_check_debug = mac_veriexec_proc_check_debug,
.mpo_syscall = mac_veriexec_syscall,
.mpo_system_check_sysctl = mac_veriexec_sysctl_check,
.mpo_vnode_check_exec = mac_veriexec_vnode_check_exec, .mpo_vnode_check_exec = mac_veriexec_vnode_check_exec,
.mpo_vnode_check_open = mac_veriexec_vnode_check_open, .mpo_vnode_check_open = mac_veriexec_vnode_check_open,
.mpo_vnode_check_setmode = mac_veriexec_vnode_check_setmode, .mpo_vnode_check_setmode = mac_veriexec_vnode_check_setmode,