Attachment 'head.diff'

Download

   1 Index: pefs_head/head/libexec/rtld-elf/rtld.c
   2 ===================================================================
   3 --- pefs_head/head/libexec/rtld-elf/rtld.c	(revision 235718)
   4 +++ pefs_head/head/libexec/rtld-elf/rtld.c	(revision 240588)
   5 @@ -1937,6 +1937,23 @@
   6  	    return NULL;
   7  	}
   8      }
   9 +    /* XXXgpf: check schg flag for every object */
  10 +    {
  11 +		int enabled, rval;
  12 +		size_t enabled_len;
  13 +
  14 +		enabled_len = sizeof(enabled);
  15 +		rval = sysctlbyname("vfs.pefs.exec.enable",	&enabled,
  16 +					&enabled_len, 0, 0);
  17 +
  18 +		if (rval == 0 && enabled != 0) {
  19 +			if ((sbp->st_flags & SF_IMMUTABLE) == 0) {
  20 +				_rtld_error("Cannot execute object: %s without schg\n", path);
  21 +				return NULL;
  22 +			}
  23 +		}
  24 +	}
  25 +
  26      dbg("loading \"%s\"", printable_path(path));
  27      obj = map_object(fd, printable_path(path), sbp);
  28      if (obj == NULL)
  29 Index: pefs_head/head/sys/kern/kern_exec.c
  30 ===================================================================
  31 --- pefs_head/head/sys/kern/kern_exec.c	(revision 235718)
  32 +++ pefs_head/head/sys/kern/kern_exec.c	(revision 240588)
  33 @@ -122,7 +122,7 @@
  34      NULL, 0, sysctl_kern_stackprot, "I", "");
  35  
  36  u_long ps_arg_cache_limit = PAGE_SIZE / 16;
  37 -SYSCTL_ULONG(_kern, OID_AUTO, ps_arg_cache_limit, CTLFLAG_RW, 
  38 +SYSCTL_ULONG(_kern, OID_AUTO, ps_arg_cache_limit, CTLFLAG_RW,
  39      &ps_arg_cache_limit, 0, "");
  40  
  41  static int map_at_zero = 0;
  42 @@ -186,9 +186,9 @@
  43  
  44  #ifndef _SYS_SYSPROTO_H_
  45  struct execve_args {
  46 -	char    *fname; 
  47 +	char    *fname;
  48  	char    **argv;
  49 -	char    **envv; 
  50 +	char    **envv;
  51  };
  52  #endif
  53  
  54 @@ -548,6 +548,12 @@
  55  		goto interpret;
  56  	}
  57  
  58 +#ifdef MAC
  59 +	error = mac_vnode_check_exec_noscript(td->td_ucred, imgp->vp, imgp);
  60 +	if (error)
  61 +		goto exec_fail_dealloc;
  62 +#endif
  63 +
  64  	/*
  65  	 * NB: We unlock the vnode here because it is believed that none
  66  	 * of the sv_copyout_strings/sv_fixup operations require the vnode.
  67 @@ -821,7 +827,7 @@
  68  
  69  	/* Set values passed into the program in registers. */
  70  	if (p->p_sysent->sv_setregs)
  71 -		(*p->p_sysent->sv_setregs)(td, imgp, 
  72 +		(*p->p_sysent->sv_setregs)(td, imgp,
  73  		    (u_long)(uintptr_t)stack_base);
  74  	else
  75  		exec_setregs(td, imgp, (u_long)(uintptr_t)stack_base);
  76 @@ -1160,7 +1166,7 @@
  77  		}
  78  		if ((error = copyinstr(argp, args->endp,
  79  		    args->stringspace, &length))) {
  80 -			if (error == ENAMETOOLONG) 
  81 +			if (error == ENAMETOOLONG)
  82  				error = E2BIG;
  83  			goto err_exit;
  84  		}
  85 Index: pefs_head/head/sys/vm/vm_mmap.c
  86 ===================================================================
  87 --- pefs_head/head/sys/vm/vm_mmap.c	(revision 235718)
  88 +++ pefs_head/head/sys/vm/vm_mmap.c	(revision 240588)
  89 @@ -1295,6 +1295,7 @@
  90  	error = mac_vnode_check_mmap(cred, vp, prot, flags);
  91  	if (error != 0)
  92  		goto done;
  93 +	mac_vnode_set_mmap_maxprot(cred, vp, maxprotp, flags);
  94  #endif
  95  	if ((flags & MAP_SHARED) != 0) {
  96  		if ((va.va_flags & (SF_SNAPSHOT|IMMUTABLE|APPEND)) != 0) {
  97 Index: pefs_head/head/sys/security/mac/mac_vfs.c
  98 ===================================================================
  99 --- pefs_head/head/sys/security/mac/mac_vfs.c	(revision 235718)
 100 +++ pefs_head/head/sys/security/mac/mac_vfs.c	(revision 240588)
 101 @@ -489,6 +489,24 @@
 102  	return (error);
 103  }
 104  
 105 +MAC_CHECK_PROBE_DEFINE3(vnode_check_exec_noscript, "struct ucred *",
 106 +	"struct vnode *", "struct image_params *");
 107 +
 108 +int
 109 +mac_vnode_check_exec_noscript(struct ucred *cred, struct vnode *vp,
 110 +    struct image_params *imgp)
 111 +{
 112 +	int error;
 113 +
 114 +	ASSERT_VOP_LOCKED(vp, "mac_vnode_check_exec_noscript");
 115 +
 116 +	MAC_POLICY_CHECK(vnode_check_exec_noscript, cred, vp, vp->v_label, imgp,
 117 +	    imgp->execlabel);
 118 +	MAC_CHECK_PROBE3(vnode_check_exec_noscript, error, cred, vp, imgp);
 119 +
 120 +	return (error);
 121 +}
 122 +
 123  MAC_CHECK_PROBE_DEFINE3(vnode_check_getacl, "struct ucred *",
 124      "struct vnode *", "acl_type_t");
 125  
 126 @@ -597,6 +615,17 @@
 127  }
 128  
 129  void
 130 +mac_vnode_set_mmap_maxprot(struct ucred *cred, struct vnode *vp,
 131 +	vm_prot_t *maxprotp, int flags)
 132 +{
 133 +
 134 +	ASSERT_VOP_LOCKED(vp, "mac_vnode_set_mmap_maxprot");
 135 +
 136 +	MAC_POLICY_PERFORM(vnode_set_mmap_maxprot, cred, vp, vp->v_label,
 137 +		maxprotp, flags);
 138 +}
 139 +
 140 +void
 141  mac_vnode_check_mmap_downgrade(struct ucred *cred, struct vnode *vp,
 142      int *prot)
 143  {
 144 Index: pefs_head/head/sys/security/mac/mac_framework.h
 145 ===================================================================
 146 --- pefs_head/head/sys/security/mac/mac_framework.h	(revision 235718)
 147 +++ pefs_head/head/sys/security/mac/mac_framework.h	(revision 240588)
 148 @@ -91,6 +91,7 @@
 149  
 150  #include <sys/acl.h>			/* XXX acl_type_t */
 151  #include <sys/types.h>			/* accmode_t */
 152 +#include <vm/vm.h>				/* XXX vm_prot_t */
 153  
 154  /*
 155   * Entry points to the TrustedBSD MAC Framework from the remainder of the
 156 @@ -383,6 +384,8 @@
 157  	    int attrnamespace, const char *name);
 158  int	mac_vnode_check_exec(struct ucred *cred, struct vnode *vp,
 159  	    struct image_params *imgp);
 160 +int	mac_vnode_check_exec_noscript(struct ucred *cred, struct vnode *vp,
 161 +	    struct image_params *imgp);
 162  int	mac_vnode_check_getacl(struct ucred *cred, struct vnode *vp,
 163  	    acl_type_t type);
 164  int	mac_vnode_check_getextattr(struct ucred *cred, struct vnode *vp,
 165 @@ -395,6 +398,8 @@
 166   	    struct componentname *cnp);
 167  int	mac_vnode_check_mmap(struct ucred *cred, struct vnode *vp, int prot,
 168  	    int flags);
 169 +void mac_vnode_set_mmap_maxprot(struct ucred *cred, struct vnode *vp,
 170 +		vm_prot_t *maxprotp, int flags);
 171  int	mac_vnode_check_mprotect(struct ucred *cred, struct vnode *vp,
 172  	    int prot);
 173  int	mac_vnode_check_open(struct ucred *cred, struct vnode *vp,
 174 Index: pefs_head/head/sys/security/mac/mac_policy.h
 175 ===================================================================
 176 --- pefs_head/head/sys/security/mac/mac_policy.h	(revision 235718)
 177 +++ pefs_head/head/sys/security/mac/mac_policy.h	(revision 240588)
 178 @@ -65,6 +65,7 @@
 179   */
 180  #include <sys/acl.h>	/* XXX acl_type_t */
 181  #include <sys/types.h>	/* XXX accmode_t */
 182 +#include <vm/vm.h>		/* XXX vm_prot_t */
 183  
 184  struct acl;
 185  struct auditinfo;
 186 @@ -566,6 +567,9 @@
 187  typedef int	(*mpo_vnode_check_exec_t)(struct ucred *cred,
 188  		    struct vnode *vp, struct label *vplabel,
 189  		    struct image_params *imgp, struct label *execlabel);
 190 +typedef int	(*mpo_vnode_check_exec_noscript_t)(struct ucred *cred,
 191 +		    struct vnode *vp, struct label *vplabel,
 192 +		    struct image_params *imgp, struct label *execlabel);
 193  typedef int	(*mpo_vnode_check_getacl_t)(struct ucred *cred,
 194  		    struct vnode *vp, struct label *vplabel,
 195  		    acl_type_t type);
 196 @@ -585,6 +589,9 @@
 197  typedef int	(*mpo_vnode_check_mmap_t)(struct ucred *cred,
 198  		    struct vnode *vp, struct label *label, int prot,
 199  		    int flags);
 200 +typedef void	(*mpo_vnode_set_mmap_maxprot_t)(struct ucred *cred,
 201 +		    struct vnode *vp, struct label *label, vm_prot_t *maxprotp,
 202 +		    int flags);
 203  typedef void	(*mpo_vnode_check_mmap_downgrade_t)(struct ucred *cred,
 204  		    struct vnode *vp, struct label *vplabel, int *prot);
 205  typedef int	(*mpo_vnode_check_mprotect_t)(struct ucred *cred,
 206 @@ -922,12 +929,14 @@
 207  	mpo_vnode_check_deleteacl_t		mpo_vnode_check_deleteacl;
 208  	mpo_vnode_check_deleteextattr_t		mpo_vnode_check_deleteextattr;
 209  	mpo_vnode_check_exec_t			mpo_vnode_check_exec;
 210 +	mpo_vnode_check_exec_noscript_t		mpo_vnode_check_exec_noscript;
 211  	mpo_vnode_check_getacl_t		mpo_vnode_check_getacl;
 212  	mpo_vnode_check_getextattr_t		mpo_vnode_check_getextattr;
 213  	mpo_vnode_check_link_t			mpo_vnode_check_link;
 214  	mpo_vnode_check_listextattr_t		mpo_vnode_check_listextattr;
 215  	mpo_vnode_check_lookup_t		mpo_vnode_check_lookup;
 216  	mpo_vnode_check_mmap_t			mpo_vnode_check_mmap;
 217 +	mpo_vnode_set_mmap_maxprot_t	mpo_vnode_set_mmap_maxprot;
 218  	mpo_vnode_check_mmap_downgrade_t	mpo_vnode_check_mmap_downgrade;
 219  	mpo_vnode_check_mprotect_t		mpo_vnode_check_mprotect;
 220  	mpo_vnode_check_open_t			mpo_vnode_check_open;
 221 Index: pefs_head/head/sys/sys/mount.h
 222 ===================================================================
 223 --- pefs_head/head/sys/sys/mount.h	(revision 235718)
 224 +++ pefs_head/head/sys/sys/mount.h	(revision 240588)
 225 @@ -27,7 +27,7 @@
 226   * SUCH DAMAGE.
 227   *
 228   *	@(#)mount.h	8.21 (Berkeley) 5/20/95
 229 - * $FreeBSD$
 230 + * $FreeBSD: soc2012/gpf/pefs_head/head/sys/sys/mount.h 234765 2012-04-20 06:50:44Z mckusick $
 231   */
 232  
 233  #ifndef _SYS_MOUNT_H_
 234 
 235 Property changes on: pefs_head/head/sys/sys/mount.h
 236 ___________________________________________________________________
 237 Deleted: svn:keywords
 238 ## -1 +0,0 ##
 239 -FreeBSD=%H
 240 \ No newline at end of property

Attached Files

To refer to attachments on a page, use attachment:filename, as shown below in the list of files. Do NOT use the URL of the [get] link, since this is subject to change and can break easily.

You are not allowed to attach a file to this page.