| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
|
|
|
|
| |
Although groff_mdoc(7) gives another impression, this is the ordering
most widely used and also required by mdocml/mandoc.
Reviewed by: ru
Approved by: philip, ed (mentors)
|
|
|
|
|
|
|
|
|
| |
Similar to libexec/, do the same with lib/. Make WARNS=6 the norm and
lower it when needed.
I'm setting WARNS?=0 for secure/. It seems secure/ includes the
Makefile.inc provided by lib/. I'm not going to touch that directory.
Most of the code there is contributed anyway.
|
| |
|
|
|
|
|
|
|
|
| |
preparation for 8.0-RELEASE. Add the previous version of those
libraries to ObsoleteFiles.inc and bump __FreeBSD_Version.
Reviewed by: kib
Approved by: re (rwatson)
|
|
|
|
| |
Ok'd by: kan
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
subject: ranges of uid, ranges of gid, jail id
objects: ranges of uid, ranges of gid, filesystem,
object is suid, object is sgid, object matches subject uid/gid
object type
We can also negate individual conditions. The ruleset language is
a superset of the previous language, so old rules should continue
to work.
These changes require a change to the API between libugidfw and the
mac_bsdextended module. Add a version number, so we can tell if
we're running mismatched versions.
Update man pages to reflect changes, add extra test cases to
test_ugidfw.c and add a shell script that checks that the the
module seems to do what we expect.
Suggestions from: rwatson, trhodes
Reviewed by: trhodes
MFC after: 2 months
|
|
|
|
|
|
|
| |
been bumped since RELENG_5.
Reviewed by: ru
Approved by: re (not needed for commit check but in principle...)
|
| |
|
|
|
|
|
|
|
|
| |
check the password or group database before attempting to parse as an
integer, as is done for the first {uid,gid} in an identity phrase.
Obtained from: TrustedBSD Project
Sponsored by: SPAWAR, SPARTA
|
|
|
|
|
|
|
| |
<security/mac_bsdextended/mac_bsdextended.h> in order to include
<ugidfw.h>, so document that.
MFC after: 3 days
|
|
|
|
| |
MFC after: 1 week
|
|
|
|
|
|
| |
Submitted by: Wojciech A. Koszek
PR: bin/79292
MFC after: 1 week
|
|
|
|
|
|
|
| |
instead of using the V* permission flags from vnode.h. Remove include
of vnode.h.
Requested by: phk
|
| |
|
| |
|
| |
|
|
|
|
|
|
|
|
| |
the caller does not specify the rule number -- instead, the kernel
module is probed for the next available rule, which is then used.
Obtained from: TrustedBSD Project
Sponsored by: DARPA, McAfee Research
|
| |
|
|
|
|
| |
Submitted by: Attila Nagy <bra@fsn.hu>
|
|
|
|
| |
Sponsored by: DARPA, Network Associates Laboratories
|
| |
|
| |
|
|
|
|
| |
Pointed out by: jake
|
|
|
|
| |
Suggested by: mike
|
|
|
|
|
|
| |
NOMAN is no longer required when a man page is not yet present.
Submitted by: ru
|
|
kernel access control.
Provide a library to manage user file system firewall-like rules
supported by the mac_bsdextended.ko security model. The kernel
module exports the current rule set using sysctl, and this
library provides a front end that includes support for retrieving
and setting rules, as well as printing and parsing them.
Note: as with other userland components, this is a WIP. However,
when used in combination with the soon-to-be-committed ugidfw,
it can actually be quite useful in multi-user environments to
allow the administrator to limit inter-user file operations without
resorting to heavier weight labeled security policies.
Obtained form: TrustedBSD Project
Sponsored by: DARPA, NAI Labs
|