| 2394 | } |
| 2395 | |
| 2396 | static int |
| 2397 | lomac_vnode_check_mmap(struct ucred *cred, struct vnode *vp, |
| 2398 | struct label *vplabel, int prot, int flags) |
| 2399 | { |
| 2400 | struct mac_lomac *subj, *obj; |
| 2401 | |
| 2402 | /* |
| 2403 | * Rely on the use of open()-time protections to handle |
| 2404 | * non-revocation cases. |
| 2405 | */ |
| 2406 | if (!lomac_enabled) |
| 2407 | return (0); |
| 2408 | |
| 2409 | subj = SLOT(cred->cr_label); |
| 2410 | obj = SLOT(vplabel); |
| 2411 | |
| 2412 | if (((prot & VM_PROT_WRITE) != 0) && ((flags & MAP_SHARED) != 0)) { |
| 2413 | if (!lomac_subject_dominate(subj, obj)) |
| 2414 | return (EACCES); |
| 2415 | } |
| 2416 | if (prot & (VM_PROT_READ | VM_PROT_EXECUTE)) { |
| 2417 | if (!lomac_dominate_single(obj, subj)) |
| 2418 | return (maybe_demote(subj, obj, "mapping", "file", vp)); |
| 2419 | } |
| 2420 | |
| 2421 | return (0); |
| 2422 | } |
| 2423 | |
| 2424 | static void |
| 2425 | lomac_vnode_check_mmap_downgrade(struct ucred *cred, struct vnode *vp, |
nothing calls this directly
no test coverage detected