diff options
author | rwatson <rwatson@FreeBSD.org> | 2005-04-18 13:36:57 +0000 |
---|---|---|
committer | rwatson <rwatson@FreeBSD.org> | 2005-04-18 13:36:57 +0000 |
commit | 75030e30f64232f9490b244e2925b347d7bf669c (patch) | |
tree | edb79f235bf4b33075b9d7e39ce462e142125e48 /sys/sys/mac.h | |
parent | 8694c5f46241d5fb117c7feed17f9896b6f9e730 (diff) | |
download | FreeBSD-src-75030e30f64232f9490b244e2925b347d7bf669c.zip FreeBSD-src-75030e30f64232f9490b244e2925b347d7bf669c.tar.gz |
Introduce p_canwait() and MAC Framework and MAC Policy entry points
mac_check_proc_wait(), which control the ability to wait4() specific
processes. This permits MAC policies to limit information flow from
children that have changed label, although has to be handled carefully
due to common programming expectations regarding the behavior of
wait4(). The cr_seeotheruids() check in p_canwait() is #if 0'd for
this reason.
The mac_stub and mac_test policies are updated to reflect these new
entry points.
Sponsored by: SPAWAR, SPARTA
Obtained from: TrustedBSD Project
Diffstat (limited to 'sys/sys/mac.h')
-rw-r--r-- | sys/sys/mac.h | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/sys/sys/mac.h b/sys/sys/mac.h index f72733d..8e5037a 100644 --- a/sys/sys/mac.h +++ b/sys/sys/mac.h @@ -351,6 +351,7 @@ int mac_check_proc_setresgid(struct proc *proc, struct ucred *cred, gid_t rgid, gid_t egid, gid_t sgid); int mac_check_proc_signal(struct ucred *cred, struct proc *proc, int signum); +int mac_check_proc_wait(struct ucred *cred, struct proc *proc); int mac_check_socket_accept(struct ucred *cred, struct socket *so); int mac_check_socket_bind(struct ucred *cred, struct socket *so, struct sockaddr *sockaddr); |