summaryrefslogtreecommitdiffstats
path: root/sys/security/mac/mac_framework.h
diff options
context:
space:
mode:
authorrwatson <rwatson@FreeBSD.org>2007-04-22 15:31:22 +0000
committerrwatson <rwatson@FreeBSD.org>2007-04-22 15:31:22 +0000
commitd1196975a07260e588b5270931563e7fe7d7e672 (patch)
tree1c8d3b15d3ba425f41f9ad0bc9e628b32aba6083 /sys/security/mac/mac_framework.h
parentdb8dcec8015c6fbc747411dcd0f933d6e0a5f81e (diff)
downloadFreeBSD-src-d1196975a07260e588b5270931563e7fe7d7e672.zip
FreeBSD-src-d1196975a07260e588b5270931563e7fe7d7e672.tar.gz
Remove MAC Framework access control check entry points made redundant with
the introduction of priv(9) and MAC Framework entry points for privilege checking/granting. These entry points exactly aligned with privileges and provided no additional security context: - mac_check_sysarch_ioperm() - mac_check_kld_unload() - mac_check_settime() - mac_check_system_nfsd() Add mpo_priv_check() implementations to Biba and LOMAC policies, which, for each privilege, determine if they can be granted to processes considered unprivileged by those two policies. These mostly, but not entirely, align with the set of privileges granted in jails. Obtained from: TrustedBSD Project
Diffstat (limited to 'sys/security/mac/mac_framework.h')
-rw-r--r--sys/security/mac/mac_framework.h4
1 files changed, 0 insertions, 4 deletions
diff --git a/sys/security/mac/mac_framework.h b/sys/security/mac/mac_framework.h
index f127456..98b04c0 100644
--- a/sys/security/mac/mac_framework.h
+++ b/sys/security/mac/mac_framework.h
@@ -282,7 +282,6 @@ int mac_check_kenv_set(struct ucred *cred, char *name, char *value);
int mac_check_kenv_unset(struct ucred *cred, char *name);
int mac_check_kld_load(struct ucred *cred, struct vnode *vp);
int mac_check_kld_stat(struct ucred *cred);
-int mac_check_kld_unload(struct ucred *cred);
int mac_check_mount_stat(struct ucred *cred, struct mount *mp);
int mac_check_pipe_ioctl(struct ucred *cred, struct pipepair *pp,
unsigned long cmd, void *data);
@@ -335,14 +334,11 @@ int mac_check_socket_receive(struct ucred *cred, struct socket *so);
int mac_check_socket_send(struct ucred *cred, struct socket *so);
int mac_check_socket_stat(struct ucred *cred, struct socket *so);
int mac_check_socket_visible(struct ucred *cred, struct socket *so);
-int mac_check_sysarch_ioperm(struct ucred *cred);
int mac_check_system_acct(struct ucred *cred, struct vnode *vp);
int mac_check_system_audit(struct ucred *cred, void *record, int length);
int mac_check_system_auditctl(struct ucred *cred, struct vnode *vp);
int mac_check_system_auditon(struct ucred *cred, int cmd);
-int mac_check_system_nfsd(struct ucred *cred);
int mac_check_system_reboot(struct ucred *cred, int howto);
-int mac_check_system_settime(struct ucred *cred);
int mac_check_system_swapon(struct ucred *cred, struct vnode *vp);
int mac_check_system_swapoff(struct ucred *cred, struct vnode *vp);
int mac_check_system_sysctl(struct ucred *cred, struct sysctl_oid *oidp,
OpenPOWER on IntegriCloud