diff options
| author | rwatson <rwatson@FreeBSD.org> | 2008-10-28 09:16:34 +0000 |
|---|---|---|
| committer | rwatson <rwatson@FreeBSD.org> | 2008-10-28 09:16:34 +0000 |
| commit | 4d410d139bf17c0573aa38279836a39fd20fbec1 (patch) | |
| tree | 8707b13ff01ebb7516d58fc2a2dce8ec078fd950 | |
| parent | fde7dde17456f0e60cecc36078bf69322816859e (diff) | |
| download | FreeBSD-src-4d410d139bf17c0573aa38279836a39fd20fbec1.zip FreeBSD-src-4d410d139bf17c0573aa38279836a39fd20fbec1.tar.gz | |
Extended comment on why we consider a partition relabel request of "0" to
be a no-op request, and why this might have to change if we want to allow
leaving a partition someday.
Obtained from: TrustedBSD Project
MFC after: 3 days
| -rw-r--r-- | sys/security/mac_partition/mac_partition.c | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/sys/security/mac_partition/mac_partition.c b/sys/security/mac_partition/mac_partition.c index d684ea9c..425a188 100644 --- a/sys/security/mac_partition/mac_partition.c +++ b/sys/security/mac_partition/mac_partition.c @@ -114,7 +114,13 @@ partition_cred_check_relabel(struct ucred *cred, struct label *newlabel) error = 0; - /* Treat "0" as a no-op request. */ + /* + * Treat "0" as a no-op request because it reflects an unset + * partition label. If we ever want to support switching back to an + * unpartitioned state for a process, we'll need to differentiate the + * "not in a partition" and "no partition defined during internalize" + * conditions. + */ if (SLOT(newlabel) != 0) { /* * Require BSD privilege in order to change the partition. |
