diff options
author | rwatson <rwatson@FreeBSD.org> | 2009-01-10 10:58:41 +0000 |
---|---|---|
committer | rwatson <rwatson@FreeBSD.org> | 2009-01-10 10:58:41 +0000 |
commit | 5743072acfd292c98911ffb9ccbb0889d58912a6 (patch) | |
tree | a09d92856c004db2e7784d8452b80357e3fc5d22 /sys/security/mac_stub | |
parent | aeaccdebe1a1d60a30f576f94448e6d0bb078a93 (diff) | |
download | FreeBSD-src-5743072acfd292c98911ffb9ccbb0889d58912a6.zip FreeBSD-src-5743072acfd292c98911ffb9ccbb0889d58912a6.tar.gz |
Rather than having MAC policies explicitly declare what object types
they label, derive that information implicitly from the set of label
initializers in their policy operations set. This avoids a possible
class of programmer errors, while retaining the structure that
allows us to avoid allocating labels for objects that don't need
them. As before, we regenerate a global mask of labeled objects
each time a policy is loaded or unloaded, stored in mac_labeled.
Discussed with: csjp
Suggested by: Jacques Vidrine <nectar at apple.com>
Obtained from: TrustedBSD Project
Sponsored by: Apple, Inc.
Diffstat (limited to 'sys/security/mac_stub')
-rw-r--r-- | sys/security/mac_stub/mac_stub.c | 23 |
1 files changed, 1 insertions, 22 deletions
diff --git a/sys/security/mac_stub/mac_stub.c b/sys/security/mac_stub/mac_stub.c index 63de30f..23228a7 100644 --- a/sys/security/mac_stub/mac_stub.c +++ b/sys/security/mac_stub/mac_stub.c @@ -1800,26 +1800,5 @@ static struct mac_policy_ops stub_ops = .mpo_vnode_setlabel_extattr = stub_vnode_setlabel_extattr, }; -#define STUB_OBJECTS (MPC_OBJECT_CRED | \ - /* XXX: MPC_OBJECT_PROC | */ \ - MPC_OBJECT_VNODE | \ - MPC_OBJECT_INPCB | \ - MPC_OBJECT_SOCKET | \ - MPC_OBJECT_DEVFS | \ - MPC_OBJECT_MBUF | \ - MPC_OBJECT_IPQ | \ - MPC_OBJECT_IP6Q | \ - MPC_OBJECT_IFNET | \ - MPC_OBJECT_BPFDESC | \ - MPC_OBJECT_PIPE | \ - MPC_OBJECT_MOUNT | \ - MPC_OBJECT_POSIXSEM | \ - MPC_OBJECT_POSIXSHM | \ - MPC_OBJECT_SYSVMSG | \ - MPC_OBJECT_SYSVMSQ | \ - MPC_OBJECT_SYSVSEM | \ - MPC_OBJECT_SYSVSHM | \ - MPC_OBJECT_SYNCACHE) - MAC_POLICY_SET(&stub_ops, mac_stub, "TrustedBSD MAC/Stub", - MPC_LOADTIME_FLAG_UNLOADOK, NULL, STUB_OBJECTS); + MPC_LOADTIME_FLAG_UNLOADOK, NULL); |