Changeset View
Changeset View
Standalone View
Standalone View
sys/security/mac/mac_process.c
| Show First 20 Lines • Show All 246 Lines • ▼ Show 20 Lines | default: | ||||
| return ("---"); | return ("---"); | ||||
| } | } | ||||
| } | } | ||||
| static void | static void | ||||
| mac_proc_vm_revoke_recurse(struct thread *td, struct ucred *cred, | mac_proc_vm_revoke_recurse(struct thread *td, struct ucred *cred, | ||||
| struct vm_map *map) | struct vm_map *map) | ||||
| { | { | ||||
| vm_map_entry_t vme; | vm_map_entry_t prev, vme; | ||||
| int result; | int result; | ||||
| vm_prot_t revokeperms; | vm_prot_t revokeperms; | ||||
| vm_object_t backing_object, object; | vm_object_t backing_object, object; | ||||
| vm_ooffset_t offset; | vm_ooffset_t offset; | ||||
| struct vnode *vp; | struct vnode *vp; | ||||
| struct mount *mp; | struct mount *mp; | ||||
| if (!mac_mmap_revocation) | if (!mac_mmap_revocation) | ||||
| return; | return; | ||||
| vm_map_lock(map); | vm_map_lock(map); | ||||
| for (vme = map->header.next; vme != &map->header; vme = vme->next) { | for (prev = &map->header; (vme = prev->next) != &map->header; | ||||
| prev = vme) { | |||||
| if (vme->eflags & MAP_ENTRY_IS_SUB_MAP) { | if (vme->eflags & MAP_ENTRY_IS_SUB_MAP) { | ||||
| mac_proc_vm_revoke_recurse(td, cred, | mac_proc_vm_revoke_recurse(td, cred, | ||||
| vme->object.sub_map); | vme->object.sub_map); | ||||
| continue; | continue; | ||||
| } | } | ||||
| /* | /* | ||||
| * Skip over entries that obviously are not shared. | * Skip over entries that obviously are not shared. | ||||
| */ | */ | ||||
| ▲ Show 20 Lines • Show All 82 Lines • ▼ Show 20 Lines | if ((vme->protection & revokeperms) == 0) { | ||||
| vme->protection &= ~VM_PROT_EXECUTE; | vme->protection &= ~VM_PROT_EXECUTE; | ||||
| } | } | ||||
| if (revokeperms & VM_PROT_READ) { | if (revokeperms & VM_PROT_READ) { | ||||
| vme->max_protection = 0; | vme->max_protection = 0; | ||||
| vme->protection = 0; | vme->protection = 0; | ||||
| } | } | ||||
| pmap_protect(map->pmap, vme->start, vme->end, | pmap_protect(map->pmap, vme->start, vme->end, | ||||
| vme->protection & ~revokeperms); | vme->protection & ~revokeperms); | ||||
| vm_map_try_merge_entries(map, vme->prev, vme); | vm_map_try_merge_entries(map, prev, vme); | ||||
| } | } | ||||
| } | } | ||||
| vm_map_unlock(map); | vm_map_unlock(map); | ||||
| } | } | ||||
| MAC_CHECK_PROBE_DEFINE2(proc_check_debug, "struct ucred *", "struct proc *"); | MAC_CHECK_PROBE_DEFINE2(proc_check_debug, "struct ucred *", "struct proc *"); | ||||
| int | int | ||||
| ▲ Show 20 Lines • Show All 57 Lines • Show Last 20 Lines | |||||