Index: pefs_head/head/libexec/rtld-elf/rtld.c
===================================================================
--- pefs_head/head/libexec/rtld-elf/rtld.c	(revision 235718)
+++ pefs_head/head/libexec/rtld-elf/rtld.c	(revision 240588)
@@ -1937,6 +1937,23 @@
 	    return NULL;
 	}
     }
+    /* XXXgpf: check schg flag for every object */
+    {
+		int enabled, rval;
+		size_t enabled_len;
+
+		enabled_len = sizeof(enabled);
+		rval = sysctlbyname("vfs.pefs.exec.enable",	&enabled,
+					&enabled_len, 0, 0);
+
+		if (rval == 0 && enabled != 0) {
+			if ((sbp->st_flags & SF_IMMUTABLE) == 0) {
+				_rtld_error("Cannot execute object: %s without schg\n", path);
+				return NULL;
+			}
+		}
+	}
+
     dbg("loading \"%s\"", printable_path(path));
     obj = map_object(fd, printable_path(path), sbp);
     if (obj == NULL)
Index: pefs_head/head/sys/kern/kern_exec.c
===================================================================
--- pefs_head/head/sys/kern/kern_exec.c	(revision 235718)
+++ pefs_head/head/sys/kern/kern_exec.c	(revision 240588)
@@ -122,7 +122,7 @@
     NULL, 0, sysctl_kern_stackprot, "I", "");
 
 u_long ps_arg_cache_limit = PAGE_SIZE / 16;
-SYSCTL_ULONG(_kern, OID_AUTO, ps_arg_cache_limit, CTLFLAG_RW, 
+SYSCTL_ULONG(_kern, OID_AUTO, ps_arg_cache_limit, CTLFLAG_RW,
     &ps_arg_cache_limit, 0, "");
 
 static int map_at_zero = 0;
@@ -186,9 +186,9 @@
 
 #ifndef _SYS_SYSPROTO_H_
 struct execve_args {
-	char    *fname; 
+	char    *fname;
 	char    **argv;
-	char    **envv; 
+	char    **envv;
 };
 #endif
 
@@ -548,6 +548,12 @@
 		goto interpret;
 	}
 
+#ifdef MAC
+	error = mac_vnode_check_exec_noscript(td->td_ucred, imgp->vp, imgp);
+	if (error)
+		goto exec_fail_dealloc;
+#endif
+
 	/*
 	 * NB: We unlock the vnode here because it is believed that none
 	 * of the sv_copyout_strings/sv_fixup operations require the vnode.
@@ -821,7 +827,7 @@
 
 	/* Set values passed into the program in registers. */
 	if (p->p_sysent->sv_setregs)
-		(*p->p_sysent->sv_setregs)(td, imgp, 
+		(*p->p_sysent->sv_setregs)(td, imgp,
 		    (u_long)(uintptr_t)stack_base);
 	else
 		exec_setregs(td, imgp, (u_long)(uintptr_t)stack_base);
@@ -1160,7 +1166,7 @@
 		}
 		if ((error = copyinstr(argp, args->endp,
 		    args->stringspace, &length))) {
-			if (error == ENAMETOOLONG) 
+			if (error == ENAMETOOLONG)
 				error = E2BIG;
 			goto err_exit;
 		}
Index: pefs_head/head/sys/vm/vm_mmap.c
===================================================================
--- pefs_head/head/sys/vm/vm_mmap.c	(revision 235718)
+++ pefs_head/head/sys/vm/vm_mmap.c	(revision 240588)
@@ -1295,6 +1295,7 @@
 	error = mac_vnode_check_mmap(cred, vp, prot, flags);
 	if (error != 0)
 		goto done;
+	mac_vnode_set_mmap_maxprot(cred, vp, maxprotp, flags);
 #endif
 	if ((flags & MAP_SHARED) != 0) {
 		if ((va.va_flags & (SF_SNAPSHOT|IMMUTABLE|APPEND)) != 0) {
Index: pefs_head/head/sys/security/mac/mac_vfs.c
===================================================================
--- pefs_head/head/sys/security/mac/mac_vfs.c	(revision 235718)
+++ pefs_head/head/sys/security/mac/mac_vfs.c	(revision 240588)
@@ -489,6 +489,24 @@
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE3(vnode_check_exec_noscript, "struct ucred *",
+	"struct vnode *", "struct image_params *");
+
+int
+mac_vnode_check_exec_noscript(struct ucred *cred, struct vnode *vp,
+    struct image_params *imgp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_vnode_check_exec_noscript");
+
+	MAC_POLICY_CHECK(vnode_check_exec_noscript, cred, vp, vp->v_label, imgp,
+	    imgp->execlabel);
+	MAC_CHECK_PROBE3(vnode_check_exec_noscript, error, cred, vp, imgp);
+
+	return (error);
+}
+
 MAC_CHECK_PROBE_DEFINE3(vnode_check_getacl, "struct ucred *",
     "struct vnode *", "acl_type_t");
 
@@ -597,6 +615,17 @@
 }
 
 void
+mac_vnode_set_mmap_maxprot(struct ucred *cred, struct vnode *vp,
+	vm_prot_t *maxprotp, int flags)
+{
+
+	ASSERT_VOP_LOCKED(vp, "mac_vnode_set_mmap_maxprot");
+
+	MAC_POLICY_PERFORM(vnode_set_mmap_maxprot, cred, vp, vp->v_label,
+		maxprotp, flags);
+}
+
+void
 mac_vnode_check_mmap_downgrade(struct ucred *cred, struct vnode *vp,
     int *prot)
 {
Index: pefs_head/head/sys/security/mac/mac_framework.h
===================================================================
--- pefs_head/head/sys/security/mac/mac_framework.h	(revision 235718)
+++ pefs_head/head/sys/security/mac/mac_framework.h	(revision 240588)
@@ -91,6 +91,7 @@
 
 #include <sys/acl.h>			/* XXX acl_type_t */
 #include <sys/types.h>			/* accmode_t */
+#include <vm/vm.h>				/* XXX vm_prot_t */
 
 /*
  * Entry points to the TrustedBSD MAC Framework from the remainder of the
@@ -383,6 +384,8 @@
 	    int attrnamespace, const char *name);
 int	mac_vnode_check_exec(struct ucred *cred, struct vnode *vp,
 	    struct image_params *imgp);
+int	mac_vnode_check_exec_noscript(struct ucred *cred, struct vnode *vp,
+	    struct image_params *imgp);
 int	mac_vnode_check_getacl(struct ucred *cred, struct vnode *vp,
 	    acl_type_t type);
 int	mac_vnode_check_getextattr(struct ucred *cred, struct vnode *vp,
@@ -395,6 +398,8 @@
  	    struct componentname *cnp);
 int	mac_vnode_check_mmap(struct ucred *cred, struct vnode *vp, int prot,
 	    int flags);
+void mac_vnode_set_mmap_maxprot(struct ucred *cred, struct vnode *vp,
+		vm_prot_t *maxprotp, int flags);
 int	mac_vnode_check_mprotect(struct ucred *cred, struct vnode *vp,
 	    int prot);
 int	mac_vnode_check_open(struct ucred *cred, struct vnode *vp,
Index: pefs_head/head/sys/security/mac/mac_policy.h
===================================================================
--- pefs_head/head/sys/security/mac/mac_policy.h	(revision 235718)
+++ pefs_head/head/sys/security/mac/mac_policy.h	(revision 240588)
@@ -65,6 +65,7 @@
  */
 #include <sys/acl.h>	/* XXX acl_type_t */
 #include <sys/types.h>	/* XXX accmode_t */
+#include <vm/vm.h>		/* XXX vm_prot_t */
 
 struct acl;
 struct auditinfo;
@@ -566,6 +567,9 @@
 typedef int	(*mpo_vnode_check_exec_t)(struct ucred *cred,
 		    struct vnode *vp, struct label *vplabel,
 		    struct image_params *imgp, struct label *execlabel);
+typedef int	(*mpo_vnode_check_exec_noscript_t)(struct ucred *cred,
+		    struct vnode *vp, struct label *vplabel,
+		    struct image_params *imgp, struct label *execlabel);
 typedef int	(*mpo_vnode_check_getacl_t)(struct ucred *cred,
 		    struct vnode *vp, struct label *vplabel,
 		    acl_type_t type);
@@ -585,6 +589,9 @@
 typedef int	(*mpo_vnode_check_mmap_t)(struct ucred *cred,
 		    struct vnode *vp, struct label *label, int prot,
 		    int flags);
+typedef void	(*mpo_vnode_set_mmap_maxprot_t)(struct ucred *cred,
+		    struct vnode *vp, struct label *label, vm_prot_t *maxprotp,
+		    int flags);
 typedef void	(*mpo_vnode_check_mmap_downgrade_t)(struct ucred *cred,
 		    struct vnode *vp, struct label *vplabel, int *prot);
 typedef int	(*mpo_vnode_check_mprotect_t)(struct ucred *cred,
@@ -922,12 +929,14 @@
 	mpo_vnode_check_deleteacl_t		mpo_vnode_check_deleteacl;
 	mpo_vnode_check_deleteextattr_t		mpo_vnode_check_deleteextattr;
 	mpo_vnode_check_exec_t			mpo_vnode_check_exec;
+	mpo_vnode_check_exec_noscript_t		mpo_vnode_check_exec_noscript;
 	mpo_vnode_check_getacl_t		mpo_vnode_check_getacl;
 	mpo_vnode_check_getextattr_t		mpo_vnode_check_getextattr;
 	mpo_vnode_check_link_t			mpo_vnode_check_link;
 	mpo_vnode_check_listextattr_t		mpo_vnode_check_listextattr;
 	mpo_vnode_check_lookup_t		mpo_vnode_check_lookup;
 	mpo_vnode_check_mmap_t			mpo_vnode_check_mmap;
+	mpo_vnode_set_mmap_maxprot_t	mpo_vnode_set_mmap_maxprot;
 	mpo_vnode_check_mmap_downgrade_t	mpo_vnode_check_mmap_downgrade;
 	mpo_vnode_check_mprotect_t		mpo_vnode_check_mprotect;
 	mpo_vnode_check_open_t			mpo_vnode_check_open;
Index: pefs_head/head/sys/sys/mount.h
===================================================================
--- pefs_head/head/sys/sys/mount.h	(revision 235718)
+++ pefs_head/head/sys/sys/mount.h	(revision 240588)
@@ -27,7 +27,7 @@
  * SUCH DAMAGE.
  *
  *	@(#)mount.h	8.21 (Berkeley) 5/20/95
- * $FreeBSD$
+ * $FreeBSD: soc2012/gpf/pefs_head/head/sys/sys/mount.h 234765 2012-04-20 06:50:44Z mckusick $
  */
 
 #ifndef _SYS_MOUNT_H_

Property changes on: pefs_head/head/sys/sys/mount.h
___________________________________________________________________
Deleted: svn:keywords
## -1 +0,0 ##
-FreeBSD=%H
\ No newline at end of property