void mac_cred_label_destroy(kauth_cred_t cred) { mac_cred_label_free(cred->cr_label); cred->cr_label = NULL; }
void mac_execve_exit(struct image_params *imgp) { if (imgp->execlabel != NULL) { mac_cred_label_free(imgp->execlabel); imgp->execlabel = NULL; } }
void mac_cred_destroy(struct ucred *cred) { if (cred->cr_label != NULL) { mac_cred_label_free(cred->cr_label); cred->cr_label = NULL; } }
int mac_execve_enter(user_addr_t mac_p, struct image_params *imgp) { struct user_mac mac; struct label *execlabel; char *buffer; int error; size_t ulen; if (mac_p == USER_ADDR_NULL) return (0); if (IS_64BIT_PROCESS(current_proc())) { struct user64_mac mac64; error = copyin(mac_p, &mac64, sizeof(mac64)); mac.m_buflen = mac64.m_buflen; mac.m_string = mac64.m_string; } else { struct user32_mac mac32; error = copyin(mac_p, &mac32, sizeof(mac32)); mac.m_buflen = mac32.m_buflen; mac.m_string = mac32.m_string; } if (error) return (error); error = mac_check_structmac_consistent(&mac); if (error) return (error); execlabel = mac_cred_label_alloc(); MALLOC(buffer, char *, mac.m_buflen, M_MACTEMP, M_WAITOK); error = copyinstr(CAST_USER_ADDR_T(mac.m_string), buffer, mac.m_buflen, &ulen); if (error) goto out; AUDIT_ARG(mac_string, buffer); error = mac_cred_label_internalize(execlabel, buffer); out: if (error) { mac_cred_label_free(execlabel); execlabel = NULL; } imgp->ip_execlabelp = execlabel; FREE(buffer, M_MACTEMP); return (error); }
int mac_execve_enter(struct image_params *imgp, struct mac *mac_p) { struct label *label; struct mac mac; char *buffer; int error; if (mac_p == NULL) return (0); if (!(mac_labeled & MPC_OBJECT_CRED)) return (EINVAL); error = copyin(mac_p, &mac, sizeof(mac)); if (error) return (error); error = mac_check_structmac_consistent(&mac); if (error) return (error); buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK); error = copyinstr(mac.m_string, buffer, mac.m_buflen, NULL); if (error) { free(buffer, M_MACTEMP); return (error); } label = mac_cred_label_alloc(); error = mac_cred_internalize_label(label, buffer); free(buffer, M_MACTEMP); if (error) { mac_cred_label_free(label); return (error); } imgp->execlabel = label; return (0); }