Un-staticize mac_cred_mmapped_drop_perms() so that it may be used

by policy modules making use of downgrades in the MAC AST event.  This
is required by the mac_lomac port of LOMAC to the MAC Framework.

Approved by:	re
Obtained from:	TrustedBSD Project
Sponsored by:	DARPA, Network Associates Laboratories

9 files changed, 9 insertions, 8 deletions

diff --git a/sys/security/mac/mac_framework.c b/sys/security/mac/mac_framework.c
index f9eb44e..10fe51d 100644
--- a/sys/security/mac/mac_framework.c
+++ b/sys/security/mac/mac_framework.c
@@ -1856,7 +1856,7 @@ mac_check_vnode_write(struct ucred *active_cred, struct ucred *file_cred,
  * memory space, and revoke access (in the least surprising ways we
  * know) when necessary.  The process lock is not held here.
  */
-static void
+void
 mac_cred_mmapped_drop_perms(struct thread *td, struct ucred *cred)
 {
 
diff --git a/sys/security/mac/mac_framework.h b/sys/security/mac/mac_framework.h
index 89c6efc..b03a172 100644
--- a/sys/security/mac/mac_framework.h
+++ b/sys/security/mac/mac_framework.h
@@ -335,6 +335,7 @@ int	mac_setsockopt_label_set(struct ucred *cred, struct socket *so,
 	    struct mac *extmac);
 int	mac_pipe_label_set(struct ucred *cred, struct pipe *pipe,
 	    struct label *label);
+void	mac_cred_mmapped_drop_perms(struct thread *td, struct ucred *cred);
 
 /*
  * Calls to help various file systems implement labeling functionality
diff --git a/sys/security/mac/mac_internal.h b/sys/security/mac/mac_internal.h
index f9eb44e..10fe51d 100644
--- a/sys/security/mac/mac_internal.h
+++ b/sys/security/mac/mac_internal.h
@@ -1856,7 +1856,7 @@ mac_check_vnode_write(struct ucred *active_cred, struct ucred *file_cred,
  * memory space, and revoke access (in the least surprising ways we
  * know) when necessary.  The process lock is not held here.
  */
-static void
+void
 mac_cred_mmapped_drop_perms(struct thread *td, struct ucred *cred)
 {
 
diff --git a/sys/security/mac/mac_net.c b/sys/security/mac/mac_net.c
index f9eb44e..10fe51d 100644
--- a/sys/security/mac/mac_net.c
+++ b/sys/security/mac/mac_net.c
@@ -1856,7 +1856,7 @@ mac_check_vnode_write(struct ucred *active_cred, struct ucred *file_cred,
  * memory space, and revoke access (in the least surprising ways we
  * know) when necessary.  The process lock is not held here.
  */
-static void
+void
 mac_cred_mmapped_drop_perms(struct thread *td, struct ucred *cred)
 {
 
diff --git a/sys/security/mac/mac_pipe.c b/sys/security/mac/mac_pipe.c
index f9eb44e..10fe51d 100644
--- a/sys/security/mac/mac_pipe.c
+++ b/sys/security/mac/mac_pipe.c
@@ -1856,7 +1856,7 @@ mac_check_vnode_write(struct ucred *active_cred, struct ucred *file_cred,
  * memory space, and revoke access (in the least surprising ways we
  * know) when necessary.  The process lock is not held here.
  */
-static void
+void
 mac_cred_mmapped_drop_perms(struct thread *td, struct ucred *cred)
 {
 
diff --git a/sys/security/mac/mac_process.c b/sys/security/mac/mac_process.c
index f9eb44e..10fe51d 100644
--- a/sys/security/mac/mac_process.c
+++ b/sys/security/mac/mac_process.c
@@ -1856,7 +1856,7 @@ mac_check_vnode_write(struct ucred *active_cred, struct ucred *file_cred,
  * memory space, and revoke access (in the least surprising ways we
  * know) when necessary.  The process lock is not held here.
  */
-static void
+void
 mac_cred_mmapped_drop_perms(struct thread *td, struct ucred *cred)
 {
 
diff --git a/sys/security/mac/mac_syscalls.c b/sys/security/mac/mac_syscalls.c
index f9eb44e..10fe51d 100644
--- a/sys/security/mac/mac_syscalls.c
+++ b/sys/security/mac/mac_syscalls.c
@@ -1856,7 +1856,7 @@ mac_check_vnode_write(struct ucred *active_cred, struct ucred *file_cred,
  * memory space, and revoke access (in the least surprising ways we
  * know) when necessary.  The process lock is not held here.
  */
-static void
+void
 mac_cred_mmapped_drop_perms(struct thread *td, struct ucred *cred)
 {
 
diff --git a/sys/security/mac/mac_system.c b/sys/security/mac/mac_system.c
index f9eb44e..10fe51d 100644
--- a/sys/security/mac/mac_system.c
+++ b/sys/security/mac/mac_system.c
@@ -1856,7 +1856,7 @@ mac_check_vnode_write(struct ucred *active_cred, struct ucred *file_cred,
  * memory space, and revoke access (in the least surprising ways we
  * know) when necessary.  The process lock is not held here.
  */
-static void
+void
 mac_cred_mmapped_drop_perms(struct thread *td, struct ucred *cred)
 {
 
diff --git a/sys/security/mac/mac_vfs.c b/sys/security/mac/mac_vfs.c
index f9eb44e..10fe51d 100644
--- a/sys/security/mac/mac_vfs.c
+++ b/sys/security/mac/mac_vfs.c
@@ -1856,7 +1856,7 @@ mac_check_vnode_write(struct ucred *active_cred, struct ucred *file_cred,
  * memory space, and revoke access (in the least surprising ways we
  * know) when necessary.  The process lock is not held here.
  */
-static void
+void
 mac_cred_mmapped_drop_perms(struct thread *td, struct ucred *cred)
 {