| Commit message (Collapse) | Author | Age | Files | Lines |
... | |
|
|
|
| |
with appropriate page queue locking.
|
|
|
|
| |
Suggested by: bde
|
| |
|
|
|
|
| |
Reported by: phk
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
TARGET_ARCH and TARGET. This is problematic when one has the =
(unconditional) type of assigment for CPUTYPE in /etc/make.conf.
(This would override what was set on the command line to "make
buildworld".)
Add a (horrible) kludge to Makefile.inc1 to check the type of
assignment for CPUTYPE (only for those who attempts to set it to
a different value). Fix an example make.conf. Fix the kernel's
build-tools target (aicasm only at the moment) to catch up with
bsd.cpu.mk,v 1.15 (BOOTSTRAPPING replaced with NO_CPU_CFLAGS in
Makefile.inc1's BMAKE).
Reviewed by: jhb
|
|
|
|
|
|
| |
Previous delta (rev.1.34) was a subject of:
MFC after: 1 week
|
|
|
|
| |
extracted with correct permissions.
|
| |
|
|
|
|
| |
the environment.
|
| |
|
|
|
|
|
| |
This driver allows a userland program to mmap the MMCR of the AMD
Elan sc520 CPU.
|
|
|
|
|
|
| |
Add a DPADD line for ${LIBUGIDFW} for ugidfw.
Submitted by: ru
|
|
|
|
|
| |
return(NULL) for upward compatibility with more LC_* categories may be
implemented in future.
|
|
|
|
|
|
| |
NOMAN is no longer required when a man page is not yet present.
Submitted by: ru
|
|
|
|
|
|
| |
above, as it should be.
Submitted by: Olivier Houchard <cognet@ci0.org>
|
|
|
|
|
|
|
| |
to stop GCC emitting warnings about increased alignment requirements
which broke the build for sparc64.
Approved by: des
|
| |
|
|
|
|
| |
system.
|
| |
|
|
|
|
| |
prevent its building.
|
| |
|
|
|
|
|
|
|
|
|
|
| |
kernel access control.
Provide ugidfw, a utility to manage the ruleset provided by
mac_bsdextended. Similar to ipfw, only for uids/gids and files.
Obtained from: TrustedBSD Project
Sponsored by: DARPA, NAI Labs
|
|
|
|
|
| |
Obtained from: TrustedBSD Project
Sponsored by: DARPA, NAI Labs
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
kernel access control.
Provide a library to manage user file system firewall-like rules
supported by the mac_bsdextended.ko security model. The kernel
module exports the current rule set using sysctl, and this
library provides a front end that includes support for retrieving
and setting rules, as well as printing and parsing them.
Note: as with other userland components, this is a WIP. However,
when used in combination with the soon-to-be-committed ugidfw,
it can actually be quite useful in multi-user environments to
allow the administrator to limit inter-user file operations without
resorting to heavier weight labeled security policies.
Obtained form: TrustedBSD Project
Sponsored by: DARPA, NAI Labs
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
kernel access control.
Teach mount(8) to understand the MNT_MULTILABEL flag, which is used
to determine whether a file system operates with individual per-vnode
labels, or treats the entire file system as a single object with a
single (mount) label. The behavior here will probably evolve some
now that nmount(2) is available and can more flexibly support mount
options.
Obtained from: TrustedBSD Project
Sponsored by: DARPA, NAI Labs
|
|
|
|
|
|
|
| |
install.
Obtained from: TrustedBSD Project
Sponsored by: DARPA, NAI Labs
|
|
|
|
|
|
|
|
| |
embedded into their file_entry descriptor. This is more for
correctness, since these files cannot be bmap'ed/mmap'ed anyways.
Enforce this restriction.
Submitted by: tes@sgi.com
|
|
|
|
| |
Submitted by: tes@sgi.com
|
|
|
|
| |
o Assert that the page queues lock is held in vm_page_deactivate().
|
| |
|
| |
|
| |
|
|
|
|
|
|
|
|
|
|
|
| |
kernel access control.
Teach devfs how to respond to pathconf() _POSIX_MAC_PRESENT queries,
allowing it to indicate to user processes that individual vnode labels
are available.
Obtained from: TrustedBSD Project
Sponsored by: DARPA, NAI Labs
|
|
|
|
|
|
| |
Replace strnpy + ='\0' with strlcpy
MFC after: 1 day
|
|
|
|
|
|
|
|
|
| |
kernel access control.
Create directories for per-policy include files.
Obtained from: TrustedBSD Project
Sponsored by: DARPA, NAI Labs
|
|
|
|
|
|
|
| |
devfs nodes.
Obtained from: TrustedBSD Project
Sponsored by: DARPA, NAI Labs
|
|
|
|
|
|
|
|
| |
well as loaded as modules by hooking up mac_none if
'options MAC_NONE' is defined.
Obtained from: TrustedBSD Project
Sponsored by: DARPA, NAI Labs
|
|
|
|
|
|
|
|
|
|
|
|
| |
kernel access control.
Invoke appropriate MAC entry points for a number of VFS-related
operations in the Linux ABI module. In particular, handle uselib
in a manner similar to open() (more work is probably needed here),
as well as handle statfs(), and linux readdir()-like calls.
Obtained from: TrustedBSD Project
Sponsored by: DARPA, NAI Labs
|
| |
|
|
|
|
| |
Spotted by: scottl
|
|
|
|
|
|
|
|
|
|
|
|
| |
kernel access control.
Add MAC support for the UDP protocol. Invoke appropriate MAC entry
points to label packets that are generated by local UDP sockets,
and to authorize delivery of mbufs to local sockets both in the
multicast/broadcast case and the unicast case.
Obtained from: TrustedBSD Project
Sponsored by: DARPA, NAI Labs
|
|
|
|
|
|
|
|
|
|
|
|
| |
kernel access control.
Introduce two ioctls, SIOCGIFMAC, SIOCSIFMAC, which permit user
processes to manage the MAC labels on network interfaces. Note
that this is part of the user process API/ABI that will be revised
prior to 5.0-RELEASE.
Obtained from: TrustedBSD Project
Sponsored by: DARPA, NAI Labs
|
|
|
|
|
|
|
|
|
|
|
|
| |
kernel access control.
Add MAC support for if_ppp. Label packets as they are removed from
the raw PPP mbuf queue. Preserve the mbuf MAC label across various
PPP data-munging and reconstitution operations. Perform access
control checks on mbufs to be transmitted via the interface.
Obtained from: TrustedBSD Project
Sponsored by: DARPA, NAI Labs
|
|
|
|
|
|
|
|
|
|
|
| |
kernel access control.
Label packets generated by the gif virtual interface.
Perform access control on packets delivered to gif virtual interfaces.
Obtained from: TrustedBSD Project
Sponsored by: DARPA, NAI Labs
|
|
|
|
|
|
|
|
|
|
| |
kernel access control.
Invoke appropriate MAC framework entry points to authorize readdir()
operations in the native ABI.
Obtained from: TrustedBSD Project
Sponsored by: DARPA, NAI Labs
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
| |
Make idle process state more consistant.
Add an assert on thread state.
Clean up idleproc/mi_switch() interaction.
Use a local instead of referencing curthread 7 times in a row
(I've been told curthread can be expensive on some architectures)
Remove some commented out code.
Add a little commented out code (completion coming soon)
Reviewed by: jhb@freebsd.org
|
|
|
|
| |
instead when invoking VOP_POLL().
|
|
|
|
| |
o Assert that the page queues lock is held in vm_page_io_finish().
|
|
|
|
|
|
| |
relationship requirements, and no longer do.
Reminded by: bde
|