diff options
author | Robert Watson <rwatson@FreeBSD.org> | 2008-08-23 15:26:36 +0000 |
---|---|---|
committer | Robert Watson <rwatson@FreeBSD.org> | 2008-08-23 15:26:36 +0000 |
commit | 6356dba0b403daa023dec24559ab1f8e602e4f14 (patch) | |
tree | 5219c0b4d17dd1dcbcb5fda367c1905a0929ee2b /sys/security/mac/mac_posix_shm.c | |
parent | 99448af81e4572b5f1d892bdf81cfbe37c518e7f (diff) |
Introduce two related changes to the TrustedBSD MAC Framework:
(1) Abstract interpreter vnode labeling in execve(2) and mac_execve(2)
so that the general exec code isn't aware of the details of
allocating, copying, and freeing labels, rather, simply passes in
a void pointer to start and stop functions that will be used by
the framework. This change will be MFC'd.
(2) Introduce a new flags field to the MAC_POLICY_SET(9) interface
allowing policies to declare which types of objects require label
allocation, initialization, and destruction, and define a set of
flags covering various supported object types (MPC_OBJECT_PROC,
MPC_OBJECT_VNODE, MPC_OBJECT_INPCB, ...). This change reduces the
overhead of compiling the MAC Framework into the kernel if policies
aren't loaded, or if policies require labels on only a small number
or even no object types. Each time a policy is loaded or unloaded,
we recalculate a mask of labeled object types across all policies
present in the system. Eliminate MAC_ALWAYS_LABEL_MBUF option as it
is no longer required.
MFC after: 1 week ((1) only)
Reviewed by: csjp
Obtained from: TrustedBSD Project
Sponsored by: Apple, Inc.
Notes
Notes:
svn path=/head/; revision=182063
Diffstat (limited to 'sys/security/mac/mac_posix_shm.c')
-rw-r--r-- | sys/security/mac/mac_posix_shm.c | 11 |
1 files changed, 8 insertions, 3 deletions
diff --git a/sys/security/mac/mac_posix_shm.c b/sys/security/mac/mac_posix_shm.c index b9da7b3d1ce3..97587ad52133 100644 --- a/sys/security/mac/mac_posix_shm.c +++ b/sys/security/mac/mac_posix_shm.c @@ -63,7 +63,10 @@ void mac_posixshm_init(struct shmfd *shmfd) { - shmfd->shm_label = mac_posixshm_label_alloc(); + if (mac_labeled & MPC_OBJECT_POSIXSHM) + shmfd->shm_label = mac_posixshm_label_alloc(); + else + shmfd->shm_label = NULL; } static void @@ -78,8 +81,10 @@ void mac_posixshm_destroy(struct shmfd *shmfd) { - mac_posixshm_label_free(shmfd->shm_label); - shmfd->shm_label = NULL; + if (shmfd->shm_label != NULL) { + mac_posixshm_label_free(shmfd->shm_label); + shmfd->shm_label = NULL; + } } void |