summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--sys/kern/kern_mac.c7
-rw-r--r--sys/security/mac/mac_framework.c7
-rw-r--r--sys/security/mac/mac_internal.h7
-rw-r--r--sys/security/mac/mac_net.c7
-rw-r--r--sys/security/mac/mac_pipe.c7
-rw-r--r--sys/security/mac/mac_process.c7
-rw-r--r--sys/security/mac/mac_syscalls.c7
-rw-r--r--sys/security/mac/mac_system.c7
-rw-r--r--sys/security/mac/mac_vfs.c7
9 files changed, 54 insertions, 9 deletions
diff --git a/sys/kern/kern_mac.c b/sys/kern/kern_mac.c
index 29e5157..78bc485 100644
--- a/sys/kern/kern_mac.c
+++ b/sys/kern/kern_mac.c
@@ -108,6 +108,11 @@ static unsigned int mac_policy_offsets_free = (1 << MAC_MAX_POLICIES) - 1;
SYSCTL_UINT(_security_mac, OID_AUTO, max_policies, CTLFLAG_RD,
&mac_max_policies, 0, "");
+/*
+ * Has the kernel started generating labeled objects yet? All read/write
+ * access to this variable is serialized during the boot process. Following
+ * the end of serialization, we don't update this flag; no locking.
+ */
static int mac_late = 0;
static int mac_enforce_fs = 1;
@@ -2614,7 +2619,7 @@ mac_check_vnode_swapon(struct ucred *cred, struct vnode *vp)
ASSERT_VOP_LOCKED(vp, "mac_check_vnode_swapon");
- if (!mac_enforce_fs)
+ if (!mac_enforce_fs)
return (0);
error = vn_refreshlabel(vp, cred);
diff --git a/sys/security/mac/mac_framework.c b/sys/security/mac/mac_framework.c
index 29e5157..78bc485 100644
--- a/sys/security/mac/mac_framework.c
+++ b/sys/security/mac/mac_framework.c
@@ -108,6 +108,11 @@ static unsigned int mac_policy_offsets_free = (1 << MAC_MAX_POLICIES) - 1;
SYSCTL_UINT(_security_mac, OID_AUTO, max_policies, CTLFLAG_RD,
&mac_max_policies, 0, "");
+/*
+ * Has the kernel started generating labeled objects yet? All read/write
+ * access to this variable is serialized during the boot process. Following
+ * the end of serialization, we don't update this flag; no locking.
+ */
static int mac_late = 0;
static int mac_enforce_fs = 1;
@@ -2614,7 +2619,7 @@ mac_check_vnode_swapon(struct ucred *cred, struct vnode *vp)
ASSERT_VOP_LOCKED(vp, "mac_check_vnode_swapon");
- if (!mac_enforce_fs)
+ if (!mac_enforce_fs)
return (0);
error = vn_refreshlabel(vp, cred);
diff --git a/sys/security/mac/mac_internal.h b/sys/security/mac/mac_internal.h
index 29e5157..78bc485 100644
--- a/sys/security/mac/mac_internal.h
+++ b/sys/security/mac/mac_internal.h
@@ -108,6 +108,11 @@ static unsigned int mac_policy_offsets_free = (1 << MAC_MAX_POLICIES) - 1;
SYSCTL_UINT(_security_mac, OID_AUTO, max_policies, CTLFLAG_RD,
&mac_max_policies, 0, "");
+/*
+ * Has the kernel started generating labeled objects yet? All read/write
+ * access to this variable is serialized during the boot process. Following
+ * the end of serialization, we don't update this flag; no locking.
+ */
static int mac_late = 0;
static int mac_enforce_fs = 1;
@@ -2614,7 +2619,7 @@ mac_check_vnode_swapon(struct ucred *cred, struct vnode *vp)
ASSERT_VOP_LOCKED(vp, "mac_check_vnode_swapon");
- if (!mac_enforce_fs)
+ if (!mac_enforce_fs)
return (0);
error = vn_refreshlabel(vp, cred);
diff --git a/sys/security/mac/mac_net.c b/sys/security/mac/mac_net.c
index 29e5157..78bc485 100644
--- a/sys/security/mac/mac_net.c
+++ b/sys/security/mac/mac_net.c
@@ -108,6 +108,11 @@ static unsigned int mac_policy_offsets_free = (1 << MAC_MAX_POLICIES) - 1;
SYSCTL_UINT(_security_mac, OID_AUTO, max_policies, CTLFLAG_RD,
&mac_max_policies, 0, "");
+/*
+ * Has the kernel started generating labeled objects yet? All read/write
+ * access to this variable is serialized during the boot process. Following
+ * the end of serialization, we don't update this flag; no locking.
+ */
static int mac_late = 0;
static int mac_enforce_fs = 1;
@@ -2614,7 +2619,7 @@ mac_check_vnode_swapon(struct ucred *cred, struct vnode *vp)
ASSERT_VOP_LOCKED(vp, "mac_check_vnode_swapon");
- if (!mac_enforce_fs)
+ if (!mac_enforce_fs)
return (0);
error = vn_refreshlabel(vp, cred);
diff --git a/sys/security/mac/mac_pipe.c b/sys/security/mac/mac_pipe.c
index 29e5157..78bc485 100644
--- a/sys/security/mac/mac_pipe.c
+++ b/sys/security/mac/mac_pipe.c
@@ -108,6 +108,11 @@ static unsigned int mac_policy_offsets_free = (1 << MAC_MAX_POLICIES) - 1;
SYSCTL_UINT(_security_mac, OID_AUTO, max_policies, CTLFLAG_RD,
&mac_max_policies, 0, "");
+/*
+ * Has the kernel started generating labeled objects yet? All read/write
+ * access to this variable is serialized during the boot process. Following
+ * the end of serialization, we don't update this flag; no locking.
+ */
static int mac_late = 0;
static int mac_enforce_fs = 1;
@@ -2614,7 +2619,7 @@ mac_check_vnode_swapon(struct ucred *cred, struct vnode *vp)
ASSERT_VOP_LOCKED(vp, "mac_check_vnode_swapon");
- if (!mac_enforce_fs)
+ if (!mac_enforce_fs)
return (0);
error = vn_refreshlabel(vp, cred);
diff --git a/sys/security/mac/mac_process.c b/sys/security/mac/mac_process.c
index 29e5157..78bc485 100644
--- a/sys/security/mac/mac_process.c
+++ b/sys/security/mac/mac_process.c
@@ -108,6 +108,11 @@ static unsigned int mac_policy_offsets_free = (1 << MAC_MAX_POLICIES) - 1;
SYSCTL_UINT(_security_mac, OID_AUTO, max_policies, CTLFLAG_RD,
&mac_max_policies, 0, "");
+/*
+ * Has the kernel started generating labeled objects yet? All read/write
+ * access to this variable is serialized during the boot process. Following
+ * the end of serialization, we don't update this flag; no locking.
+ */
static int mac_late = 0;
static int mac_enforce_fs = 1;
@@ -2614,7 +2619,7 @@ mac_check_vnode_swapon(struct ucred *cred, struct vnode *vp)
ASSERT_VOP_LOCKED(vp, "mac_check_vnode_swapon");
- if (!mac_enforce_fs)
+ if (!mac_enforce_fs)
return (0);
error = vn_refreshlabel(vp, cred);
diff --git a/sys/security/mac/mac_syscalls.c b/sys/security/mac/mac_syscalls.c
index 29e5157..78bc485 100644
--- a/sys/security/mac/mac_syscalls.c
+++ b/sys/security/mac/mac_syscalls.c
@@ -108,6 +108,11 @@ static unsigned int mac_policy_offsets_free = (1 << MAC_MAX_POLICIES) - 1;
SYSCTL_UINT(_security_mac, OID_AUTO, max_policies, CTLFLAG_RD,
&mac_max_policies, 0, "");
+/*
+ * Has the kernel started generating labeled objects yet? All read/write
+ * access to this variable is serialized during the boot process. Following
+ * the end of serialization, we don't update this flag; no locking.
+ */
static int mac_late = 0;
static int mac_enforce_fs = 1;
@@ -2614,7 +2619,7 @@ mac_check_vnode_swapon(struct ucred *cred, struct vnode *vp)
ASSERT_VOP_LOCKED(vp, "mac_check_vnode_swapon");
- if (!mac_enforce_fs)
+ if (!mac_enforce_fs)
return (0);
error = vn_refreshlabel(vp, cred);
diff --git a/sys/security/mac/mac_system.c b/sys/security/mac/mac_system.c
index 29e5157..78bc485 100644
--- a/sys/security/mac/mac_system.c
+++ b/sys/security/mac/mac_system.c
@@ -108,6 +108,11 @@ static unsigned int mac_policy_offsets_free = (1 << MAC_MAX_POLICIES) - 1;
SYSCTL_UINT(_security_mac, OID_AUTO, max_policies, CTLFLAG_RD,
&mac_max_policies, 0, "");
+/*
+ * Has the kernel started generating labeled objects yet? All read/write
+ * access to this variable is serialized during the boot process. Following
+ * the end of serialization, we don't update this flag; no locking.
+ */
static int mac_late = 0;
static int mac_enforce_fs = 1;
@@ -2614,7 +2619,7 @@ mac_check_vnode_swapon(struct ucred *cred, struct vnode *vp)
ASSERT_VOP_LOCKED(vp, "mac_check_vnode_swapon");
- if (!mac_enforce_fs)
+ if (!mac_enforce_fs)
return (0);
error = vn_refreshlabel(vp, cred);
diff --git a/sys/security/mac/mac_vfs.c b/sys/security/mac/mac_vfs.c
index 29e5157..78bc485 100644
--- a/sys/security/mac/mac_vfs.c
+++ b/sys/security/mac/mac_vfs.c
@@ -108,6 +108,11 @@ static unsigned int mac_policy_offsets_free = (1 << MAC_MAX_POLICIES) - 1;
SYSCTL_UINT(_security_mac, OID_AUTO, max_policies, CTLFLAG_RD,
&mac_max_policies, 0, "");
+/*
+ * Has the kernel started generating labeled objects yet? All read/write
+ * access to this variable is serialized during the boot process. Following
+ * the end of serialization, we don't update this flag; no locking.
+ */
static int mac_late = 0;
static int mac_enforce_fs = 1;
@@ -2614,7 +2619,7 @@ mac_check_vnode_swapon(struct ucred *cred, struct vnode *vp)
ASSERT_VOP_LOCKED(vp, "mac_check_vnode_swapon");
- if (!mac_enforce_fs)
+ if (!mac_enforce_fs)
return (0);
error = vn_refreshlabel(vp, cred);
OpenPOWER on IntegriCloud