dg_settuple(2) DG/UX B2 Security R4.12MU02 dg_settuple(2)
NAME
dgsettuple - set the mandatory access control (MAC) range tuple of
an object
SYNOPSIS
#include <sys/types.h>
#include <sys/dgtparms.h>
#include <sys/mac.h>
int dgsettuple(targtype, targ, tuple, tuplesize, texttuple,
texttuplesize)
int targtype;
const void *targ;
mactuplestructt *tuple;
int tuplesize;
char *texttuple;
int texttuplesize;
where:
targtype A token that identifies the type of object whose MAC
range tuple is set. The available tokens are defined
in sys/dgtparms.h as follows:
TPROC The object is an existing process on the
system.
TFILE The object is a file identified by a
pathname.
TFD The object is a file, socket or pipe
identified by a descriptor.
TMSG The object is a message queue identified by
a message queue identifier.
TSHM The object is a shared memory segment
identified by a shared memory segment
identifier.
TSEM The object is a semaphore identified by a
semaphore set identifier.
targ The address of the identifier of the object whose MAC
range tuple is to be set. The targtype parameter
values are defined in sys/tparms.h. The value of
targtype determines the type of entity that targ
points to as follows:
TPROC targ points to a process id (type pidt).
TFILE targ points to a pathname string.
TFD targ points to a file, socket or pipe
descriptor.
TMSG targ points to a message queue identifier.
TSHM targ points to shared memory segment
identifier.
TSEM targ points to a semaphore set identifier.
tuple The address of a mactuplestructt that contains the
valid MAC range tuple being set on the object.
rangesize An integer containing the size in bytes of the MAC
tuple structure.
textrange Currently unused. This should be a NULL pointer.
textrangesize Currently unused. This should be zero.
DESCRIPTION
The dgsettuple system call sets the MAC range tuple on the object
identified by targtype and targ, from the mactuplestructt
structure pointed to by tuple.
Note that if the target of dgsettuple is not a directory, then any
MAC label on the target will be removed.
ACCESS CONTROL
To set the MAC range tuple of an object, a process must have MAC
read/write access to the object and must have MAC write access to the
entire range tuple being set. In addition to this, the process must
have appropriate privilege.
For systems supporting the DG/UX Capability Option, appropriate
privilege is defined as having one or more specific capabilities
enabled in the effective capability set of the calling process. See
capdefaults(5) for the default capability for this system call. On
systems without the DG/UX Capability Option, appropriate privilege
means that the process has an effective UID of root. See the
appropriateprivilege(5) man page for more information.
When setting a MAC range tuple on a process, the new MAC range tuple
must include the MAC label of the process, and can be no larger than
the existing MAC range tuple on the process.
RETURN VALUE
0 Successful completion.
-1 An error occurred. errno is set to indicate the error.
ERRORS
Errno may be set to one of the following error codes:
EPERM The caller does not have appropriate privilege.
EACCES The caller does not have the required access rights to
the object.
ENOENT The object does not exist.
ENAMETOOLONG A component of the pathname pointed at by targ exceeds
the length limit for filenames.
EFAULT The tuple parameter specified as area of memory not
accessible to the calling process.
ENOMEM The operating system was unable to allocate sufficient
internal memory to process the system call.
EINVAL Invalid parameter passed.
EOPNOTSUPP This operation is not supported on the targtype or
object passed.
ENOSYS MAC is not configured on the system.
SEE ALSO
gettuple(1), settuple(1M), dggettuple(2), dgsettmpomac(2),
dggetomac(2), dgsetomac(2), capdefaults(5), macdef(5).
NOTES
Setting a MAC range tuple with an empty range in the Virus Prevention
region on a process will likely deny the process any further access
to the filesystem, including system executables.
Licensed material--property of copyright holder(s)