Add a new MAC entry point, mac_thread_userret(td), which permits policy

modules to perform MAC-related events when a thread returns to user
space.  This is required for policies that have floating process labels,
as it's not always possible to acquire the process lock at arbitrary
points in the stack during system call processing; process labels might
represent traditional authentication data, process history information,
or other data.

LOMAC will use this entry point to perform the process label update
prior to the thread returning to userspace, when plugged into the MAC
framework.

Obtained from:	TrustedBSD Project
Sponsored by:	DARPA, Network Associates Laboratories

1 files changed, 2 insertions, 0 deletions

diff --git a/sys/security/mac/mac_framework.h b/sys/security/mac/mac_framework.h
index b413220..ebb65cb 100644
--- a/sys/security/mac/mac_framework.h
+++ b/sys/security/mac/mac_framework.h
@@ -200,6 +200,7 @@ struct proc;
 struct sockaddr;
 struct socket;
 struct pipe;
+struct thread;
 struct timespec;
 struct ucred;
 struct uio;
@@ -293,6 +294,7 @@ void	mac_execve_transition(struct ucred *old, struct ucred *new,
 int	mac_execve_will_transition(struct ucred *old, struct vnode *vp);
 void	mac_create_proc0(struct ucred *cred);
 void	mac_create_proc1(struct ucred *cred);
+void	mac_thread_userret(struct thread *td);
 
 /* Access control checks. */
 int	mac_check_bpfdesc_receive(struct bpf_d *bpf_d, struct ifnet *ifnet);