diff options
-rw-r--r-- | sys/kern/kern_mac.c | 7 | ||||
-rw-r--r-- | sys/security/mac/mac_framework.c | 7 | ||||
-rw-r--r-- | sys/security/mac/mac_internal.h | 7 | ||||
-rw-r--r-- | sys/security/mac/mac_net.c | 7 | ||||
-rw-r--r-- | sys/security/mac/mac_pipe.c | 7 | ||||
-rw-r--r-- | sys/security/mac/mac_process.c | 7 | ||||
-rw-r--r-- | sys/security/mac/mac_syscalls.c | 7 | ||||
-rw-r--r-- | sys/security/mac/mac_system.c | 7 | ||||
-rw-r--r-- | sys/security/mac/mac_vfs.c | 7 |
9 files changed, 54 insertions, 9 deletions
diff --git a/sys/kern/kern_mac.c b/sys/kern/kern_mac.c index 29e5157..78bc485 100644 --- a/sys/kern/kern_mac.c +++ b/sys/kern/kern_mac.c @@ -108,6 +108,11 @@ static unsigned int mac_policy_offsets_free = (1 << MAC_MAX_POLICIES) - 1; SYSCTL_UINT(_security_mac, OID_AUTO, max_policies, CTLFLAG_RD, &mac_max_policies, 0, ""); +/* + * Has the kernel started generating labeled objects yet? All read/write + * access to this variable is serialized during the boot process. Following + * the end of serialization, we don't update this flag; no locking. + */ static int mac_late = 0; static int mac_enforce_fs = 1; @@ -2614,7 +2619,7 @@ mac_check_vnode_swapon(struct ucred *cred, struct vnode *vp) ASSERT_VOP_LOCKED(vp, "mac_check_vnode_swapon"); - if (!mac_enforce_fs) + if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); diff --git a/sys/security/mac/mac_framework.c b/sys/security/mac/mac_framework.c index 29e5157..78bc485 100644 --- a/sys/security/mac/mac_framework.c +++ b/sys/security/mac/mac_framework.c @@ -108,6 +108,11 @@ static unsigned int mac_policy_offsets_free = (1 << MAC_MAX_POLICIES) - 1; SYSCTL_UINT(_security_mac, OID_AUTO, max_policies, CTLFLAG_RD, &mac_max_policies, 0, ""); +/* + * Has the kernel started generating labeled objects yet? All read/write + * access to this variable is serialized during the boot process. Following + * the end of serialization, we don't update this flag; no locking. + */ static int mac_late = 0; static int mac_enforce_fs = 1; @@ -2614,7 +2619,7 @@ mac_check_vnode_swapon(struct ucred *cred, struct vnode *vp) ASSERT_VOP_LOCKED(vp, "mac_check_vnode_swapon"); - if (!mac_enforce_fs) + if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); diff --git a/sys/security/mac/mac_internal.h b/sys/security/mac/mac_internal.h index 29e5157..78bc485 100644 --- a/sys/security/mac/mac_internal.h +++ b/sys/security/mac/mac_internal.h @@ -108,6 +108,11 @@ static unsigned int mac_policy_offsets_free = (1 << MAC_MAX_POLICIES) - 1; SYSCTL_UINT(_security_mac, OID_AUTO, max_policies, CTLFLAG_RD, &mac_max_policies, 0, ""); +/* + * Has the kernel started generating labeled objects yet? All read/write + * access to this variable is serialized during the boot process. Following + * the end of serialization, we don't update this flag; no locking. + */ static int mac_late = 0; static int mac_enforce_fs = 1; @@ -2614,7 +2619,7 @@ mac_check_vnode_swapon(struct ucred *cred, struct vnode *vp) ASSERT_VOP_LOCKED(vp, "mac_check_vnode_swapon"); - if (!mac_enforce_fs) + if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); diff --git a/sys/security/mac/mac_net.c b/sys/security/mac/mac_net.c index 29e5157..78bc485 100644 --- a/sys/security/mac/mac_net.c +++ b/sys/security/mac/mac_net.c @@ -108,6 +108,11 @@ static unsigned int mac_policy_offsets_free = (1 << MAC_MAX_POLICIES) - 1; SYSCTL_UINT(_security_mac, OID_AUTO, max_policies, CTLFLAG_RD, &mac_max_policies, 0, ""); +/* + * Has the kernel started generating labeled objects yet? All read/write + * access to this variable is serialized during the boot process. Following + * the end of serialization, we don't update this flag; no locking. + */ static int mac_late = 0; static int mac_enforce_fs = 1; @@ -2614,7 +2619,7 @@ mac_check_vnode_swapon(struct ucred *cred, struct vnode *vp) ASSERT_VOP_LOCKED(vp, "mac_check_vnode_swapon"); - if (!mac_enforce_fs) + if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); diff --git a/sys/security/mac/mac_pipe.c b/sys/security/mac/mac_pipe.c index 29e5157..78bc485 100644 --- a/sys/security/mac/mac_pipe.c +++ b/sys/security/mac/mac_pipe.c @@ -108,6 +108,11 @@ static unsigned int mac_policy_offsets_free = (1 << MAC_MAX_POLICIES) - 1; SYSCTL_UINT(_security_mac, OID_AUTO, max_policies, CTLFLAG_RD, &mac_max_policies, 0, ""); +/* + * Has the kernel started generating labeled objects yet? All read/write + * access to this variable is serialized during the boot process. Following + * the end of serialization, we don't update this flag; no locking. + */ static int mac_late = 0; static int mac_enforce_fs = 1; @@ -2614,7 +2619,7 @@ mac_check_vnode_swapon(struct ucred *cred, struct vnode *vp) ASSERT_VOP_LOCKED(vp, "mac_check_vnode_swapon"); - if (!mac_enforce_fs) + if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); diff --git a/sys/security/mac/mac_process.c b/sys/security/mac/mac_process.c index 29e5157..78bc485 100644 --- a/sys/security/mac/mac_process.c +++ b/sys/security/mac/mac_process.c @@ -108,6 +108,11 @@ static unsigned int mac_policy_offsets_free = (1 << MAC_MAX_POLICIES) - 1; SYSCTL_UINT(_security_mac, OID_AUTO, max_policies, CTLFLAG_RD, &mac_max_policies, 0, ""); +/* + * Has the kernel started generating labeled objects yet? All read/write + * access to this variable is serialized during the boot process. Following + * the end of serialization, we don't update this flag; no locking. + */ static int mac_late = 0; static int mac_enforce_fs = 1; @@ -2614,7 +2619,7 @@ mac_check_vnode_swapon(struct ucred *cred, struct vnode *vp) ASSERT_VOP_LOCKED(vp, "mac_check_vnode_swapon"); - if (!mac_enforce_fs) + if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); diff --git a/sys/security/mac/mac_syscalls.c b/sys/security/mac/mac_syscalls.c index 29e5157..78bc485 100644 --- a/sys/security/mac/mac_syscalls.c +++ b/sys/security/mac/mac_syscalls.c @@ -108,6 +108,11 @@ static unsigned int mac_policy_offsets_free = (1 << MAC_MAX_POLICIES) - 1; SYSCTL_UINT(_security_mac, OID_AUTO, max_policies, CTLFLAG_RD, &mac_max_policies, 0, ""); +/* + * Has the kernel started generating labeled objects yet? All read/write + * access to this variable is serialized during the boot process. Following + * the end of serialization, we don't update this flag; no locking. + */ static int mac_late = 0; static int mac_enforce_fs = 1; @@ -2614,7 +2619,7 @@ mac_check_vnode_swapon(struct ucred *cred, struct vnode *vp) ASSERT_VOP_LOCKED(vp, "mac_check_vnode_swapon"); - if (!mac_enforce_fs) + if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); diff --git a/sys/security/mac/mac_system.c b/sys/security/mac/mac_system.c index 29e5157..78bc485 100644 --- a/sys/security/mac/mac_system.c +++ b/sys/security/mac/mac_system.c @@ -108,6 +108,11 @@ static unsigned int mac_policy_offsets_free = (1 << MAC_MAX_POLICIES) - 1; SYSCTL_UINT(_security_mac, OID_AUTO, max_policies, CTLFLAG_RD, &mac_max_policies, 0, ""); +/* + * Has the kernel started generating labeled objects yet? All read/write + * access to this variable is serialized during the boot process. Following + * the end of serialization, we don't update this flag; no locking. + */ static int mac_late = 0; static int mac_enforce_fs = 1; @@ -2614,7 +2619,7 @@ mac_check_vnode_swapon(struct ucred *cred, struct vnode *vp) ASSERT_VOP_LOCKED(vp, "mac_check_vnode_swapon"); - if (!mac_enforce_fs) + if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); diff --git a/sys/security/mac/mac_vfs.c b/sys/security/mac/mac_vfs.c index 29e5157..78bc485 100644 --- a/sys/security/mac/mac_vfs.c +++ b/sys/security/mac/mac_vfs.c @@ -108,6 +108,11 @@ static unsigned int mac_policy_offsets_free = (1 << MAC_MAX_POLICIES) - 1; SYSCTL_UINT(_security_mac, OID_AUTO, max_policies, CTLFLAG_RD, &mac_max_policies, 0, ""); +/* + * Has the kernel started generating labeled objects yet? All read/write + * access to this variable is serialized during the boot process. Following + * the end of serialization, we don't update this flag; no locking. + */ static int mac_late = 0; static int mac_enforce_fs = 1; @@ -2614,7 +2619,7 @@ mac_check_vnode_swapon(struct ucred *cred, struct vnode *vp) ASSERT_VOP_LOCKED(vp, "mac_check_vnode_swapon"); - if (!mac_enforce_fs) + if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); |