From a557af222b70694470f63e2a0f1bf58c9dcc73fd Mon Sep 17 00:00:00 2001 From: Robert Watson Date: Tue, 18 Nov 2003 00:39:07 +0000 Subject: Introduce a MAC label reference in 'struct inpcb', which caches the MAC label referenced from 'struct socket' in the IPv4 and IPv6-based protocols. This permits MAC labels to be checked during network delivery operations without dereferencing inp->inp_socket to get to so->so_label, which will eventually avoid our having to grab the socket lock during delivery at the network layer. This change introduces 'struct inpcb' as a labeled object to the MAC Framework, along with the normal circus of entry points: initialization, creation from socket, destruction, as well as a delivery access control check. For most policies, the inpcb label will simply be a cache of the socket label, so a new protocol switch method is introduced, pr_sosetlabel() to notify protocols that the socket layer label has been updated so that the cache can be updated while holding appropriate locks. Most protocols implement this using pru_sosetlabel_null(), but IPv4/IPv6 protocols using inpcbs use the the worker function in_pcbsosetlabel(), which calls into the MAC Framework to perform a cache update. Biba, LOMAC, and MLS implement these entry points, as do the stub policy, and test policy. Reviewed by: sam, bms Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories --- sys/security/mac_ifoff/mac_ifoff.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) (limited to 'sys/security/mac_ifoff') diff --git a/sys/security/mac_ifoff/mac_ifoff.c b/sys/security/mac_ifoff/mac_ifoff.c index 19bbc79b3330..c3337d4a04d2 100644 --- a/sys/security/mac_ifoff/mac_ifoff.c +++ b/sys/security/mac_ifoff/mac_ifoff.c @@ -142,6 +142,18 @@ mac_ifoff_check_ifnet_transmit(struct ifnet *ifnet, struct label *ifnetlabel, return (check_ifnet_outgoing(ifnet)); } +static int +mac_ifoff_check_inpcb_deliver(struct inpcb *inp, struct label *inplabel, + struct mbuf *m, struct label *mlabel) +{ + + M_ASSERTPKTHDR(m); + if (m->m_pkthdr.rcvif != NULL) + return (check_ifnet_incoming(m->m_pkthdr.rcvif, 0)); + + return (0); +} + static int mac_ifoff_check_socket_deliver(struct socket *so, struct label *socketlabel, struct mbuf *m, struct label *mbuflabel) @@ -158,6 +170,7 @@ static struct mac_policy_ops mac_ifoff_ops = { .mpo_check_bpfdesc_receive = mac_ifoff_check_bpfdesc_receive, .mpo_check_ifnet_transmit = mac_ifoff_check_ifnet_transmit, + .mpo_check_inpcb_deliver = mac_ifoff_check_inpcb_deliver, .mpo_check_socket_deliver = mac_ifoff_check_socket_deliver, }; -- cgit v1.2.3