diff options
| author | rwatson <rwatson@FreeBSD.org> | 2006-12-21 09:51:34 +0000 |
|---|---|---|
| committer | rwatson <rwatson@FreeBSD.org> | 2006-12-21 09:51:34 +0000 |
| commit | 6fa1425be4ba1838fbf0b757c9cbbb6c0da6811f (patch) | |
| tree | 0e00125c1e53f64a611961efffaf3188df3fc0d6 /sys/security/mac/mac_sysv_sem.c | |
| parent | 24b8c057ed5ff8edf963e31c6cd9eaf0514469b2 (diff) | |
| download | FreeBSD-src-6fa1425be4ba1838fbf0b757c9cbbb6c0da6811f.zip FreeBSD-src-6fa1425be4ba1838fbf0b757c9cbbb6c0da6811f.tar.gz | |
Remove mac_enforce_subsystem debugging sysctls. Enforcement on
subsystems will be a property of policy modules, which may require
access control check entry points to be invoked even when not actively
enforcing (i.e., to track information flow without providing
protection).
Obtained from: TrustedBSD Project
Suggested by: Christopher dot Vance at sparta dot com
Diffstat (limited to 'sys/security/mac/mac_sysv_sem.c')
| -rw-r--r-- | sys/security/mac/mac_sysv_sem.c | 14 |
1 files changed, 0 insertions, 14 deletions
diff --git a/sys/security/mac/mac_sysv_sem.c b/sys/security/mac/mac_sysv_sem.c index aae6788..80778c3 100644 --- a/sys/security/mac/mac_sysv_sem.c +++ b/sys/security/mac/mac_sysv_sem.c @@ -54,11 +54,6 @@ __FBSDID("$FreeBSD$"); #include <security/mac/mac_framework.h> #include <security/mac/mac_internal.h> -static int mac_enforce_sysv_sem = 1; -SYSCTL_INT(_security_mac, OID_AUTO, enforce_sysv_sem, CTLFLAG_RW, - &mac_enforce_sysv_sem, 0, "Enforce MAC policy on System V IPC Semaphores"); -TUNABLE_INT("security.mac.enforce_sysv", &mac_enforce_sysv_sem); - static struct label * mac_sysv_sem_label_alloc(void) { @@ -112,9 +107,6 @@ mac_check_sysv_semctl(struct ucred *cred, struct semid_kernel *semakptr, { int error; - if (!mac_enforce_sysv_sem) - return (0); - MAC_CHECK(check_sysv_semctl, cred, semakptr, semakptr->label, cmd); return(error); @@ -125,9 +117,6 @@ mac_check_sysv_semget(struct ucred *cred, struct semid_kernel *semakptr) { int error; - if (!mac_enforce_sysv_sem) - return (0); - MAC_CHECK(check_sysv_semget, cred, semakptr, semakptr->label); return(error); @@ -139,9 +128,6 @@ mac_check_sysv_semop(struct ucred *cred, struct semid_kernel *semakptr, { int error; - if (!mac_enforce_sysv_sem) - return (0); - MAC_CHECK(check_sysv_semop, cred, semakptr, semakptr->label, accesstype); |
