summaryrefslogtreecommitdiffstats
path: root/sys/security/mac/mac_syscalls.c
Commit message (Collapse)AuthorAgeFilesLines
* cred: add proc_set_cred helpermjg2015-03-161-1/+1
| | | | | | | The goal here is to provide one place altering process credentials. This eases debugging and opens up posibilities to do additional work when such an action is performed.
* Update kernel inclusions of capability.h to use capsicum.h instead; somerwatson2014-03-161-1/+1
| | | | | | | | further refinement is required as some device drivers intended to be portable over FreeBSD versions rely on __FreeBSD_version to decide whether to include capability.h. MFC after: 3 weeks
* Change the cap_rights_t type from uint64_t to a structure that we can extendpjd2013-09-051-2/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | in the future in a backward compatible (API and ABI) way. The cap_rights_t represents capability rights. We used to use one bit to represent one right, but we are running out of spare bits. Currently the new structure provides place for 114 rights (so 50 more than the previous cap_rights_t), but it is possible to grow the structure to hold at least 285 rights, although we can make it even larger if 285 rights won't be enough. The structure definition looks like this: struct cap_rights { uint64_t cr_rights[CAP_RIGHTS_VERSION + 2]; }; The initial CAP_RIGHTS_VERSION is 0. The top two bits in the first element of the cr_rights[] array contain total number of elements in the array - 2. This means if those two bits are equal to 0, we have 2 array elements. The top two bits in all remaining array elements should be 0. The next five bits in all array elements contain array index. Only one bit is used and bit position in this five-bits range defines array index. This means there can be at most five array elements in the future. To define new right the CAPRIGHT() macro must be used. The macro takes two arguments - an array index and a bit to set, eg. #define CAP_PDKILL CAPRIGHT(1, 0x0000000000000800ULL) We still support aliases that combine few rights, but the rights have to belong to the same array element, eg: #define CAP_LOOKUP CAPRIGHT(0, 0x0000000000000400ULL) #define CAP_FCHMOD CAPRIGHT(0, 0x0000000000002000ULL) #define CAP_FCHMODAT (CAP_FCHMOD | CAP_LOOKUP) There is new API to manage the new cap_rights_t structure: cap_rights_t *cap_rights_init(cap_rights_t *rights, ...); void cap_rights_set(cap_rights_t *rights, ...); void cap_rights_clear(cap_rights_t *rights, ...); bool cap_rights_is_set(const cap_rights_t *rights, ...); bool cap_rights_is_valid(const cap_rights_t *rights); void cap_rights_merge(cap_rights_t *dst, const cap_rights_t *src); void cap_rights_remove(cap_rights_t *dst, const cap_rights_t *src); bool cap_rights_contains(const cap_rights_t *big, const cap_rights_t *little); Capability rights to the cap_rights_init(), cap_rights_set(), cap_rights_clear() and cap_rights_is_set() functions are provided by separating them with commas, eg: cap_rights_t rights; cap_rights_init(&rights, CAP_READ, CAP_WRITE, CAP_FSTAT); There is no need to terminate the list of rights, as those functions are actually macros that take care of the termination, eg: #define cap_rights_set(rights, ...) \ __cap_rights_set((rights), __VA_ARGS__, 0ULL) void __cap_rights_set(cap_rights_t *rights, ...); Thanks to using one bit as an array index we can assert in those functions that there are no two rights belonging to different array elements provided together. For example this is illegal and will be detected, because CAP_LOOKUP belongs to element 0 and CAP_PDKILL to element 1: cap_rights_init(&rights, CAP_LOOKUP | CAP_PDKILL); Providing several rights that belongs to the same array's element this way is correct, but is not advised. It should only be used for aliases definition. This commit also breaks compatibility with some existing Capsicum system calls, but I see no other way to do that. This should be fine as Capsicum is still experimental and this change is not going to 9.x. Sponsored by: The FreeBSD Foundation
* Remove the support for using non-mpsafe filesystem modules.kib2012-10-221-23/+10
| | | | | | | | | | | | In particular, do not lock Giant conditionally when calling into the filesystem module, remove the VFS_LOCK_GIANT() and related macros. Stop handling buffers belonging to non-mpsafe filesystems. The VFS_VERSION is bumped to indicate the interface change which does not result in the interface signatures changes. Conducted and reviewed by: attilio Tested by: pho
* When allocation of labels on files is implicitly disabled due to MACrwatson2012-04-081-14/+27
| | | | | | | | policy configuration, avoid leaking resources following failed calls to get and set MAC labels by file descriptor. Reported by: Mateusz Guzik <mjguzik at gmail.com> + clang scan-build MFC after: 3 days
* In order to maximize the re-usability of kernel code in user space thiskmacy2011-09-161-20/+20
| | | | | | | | | | | | | patch modifies makesyscalls.sh to prefix all of the non-compatibility calls (e.g. not linux_, freebsd32_) with sys_ and updates the kernel entry points and all places in the code that use them. It also fixes an additional name space collision between the kernel function psignal and the libc function of the same name by renaming the kernel psignal kern_psignal(). By introducing this change now we will ease future MFCs that change syscalls. Reviewed by: rwatson Approved by: re (bz)
* Second-to-last commit implementing Capsicum capabilities in the FreeBSDrwatson2011-08-111-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | kernel for FreeBSD 9.0: Add a new capability mask argument to fget(9) and friends, allowing system call code to declare what capabilities are required when an integer file descriptor is converted into an in-kernel struct file *. With options CAPABILITIES compiled into the kernel, this enforces capability protection; without, this change is effectively a no-op. Some cases require special handling, such as mmap(2), which must preserve information about the maximum rights at the time of mapping in the memory map so that they can later be enforced in mprotect(2) -- this is done by narrowing the rights in the existing max_protection field used for similar purposes with file permissions. In namei(9), we assert that the code is not reached from within capability mode, as we're not yet ready to enforce namespace capabilities there. This will follow in a later commit. Update two capability names: CAP_EVENT and CAP_KEVENT become CAP_POST_KEVENT and CAP_POLL_KEVENT to more accurately indicate what they represent. Approved by: re (bz) Submitted by: jonathan Sponsored by: Google Inc
* - Add a FEATURE for capsicum (security_capabilities).netchild2011-03-041-1/+1
| | | | | | - Rename mac FEATURE to security_mac. Discussed with: rwatson
* Add some FEATURE macros for various features (AUDIT/CAM/IPC/KTR/MAC/NFS/NTP/netchild2011-02-251-0/+3
| | | | | | | | | | | | | PMC/SYSV/...). No FreeBSD version bump, the userland application to query the features will be committed last and can serve as an indication of the availablility if needed. Sponsored by: Google Summer of Code 2010 Submitted by: kibab Reviewed by: arch@ (parts by rwatson, trasz, jhb) X-MFC after: to be determined in last commit with code from this project
* Rework MAC Framework synchronization in a number of ways in order torwatson2009-03-141-4/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | improve performance: - Eliminate custom reference count and condition variable to monitor threads entering the framework, as this had both significant overhead and behaved badly in the face of contention. - Replace reference count with two locks: an rwlock and an sx lock, which will be read-acquired by threads entering the framework depending on whether a give policy entry point is permitted to sleep or not. - Replace previous mutex locking of the reference count for exclusive access with write acquiring of both the policy list sx and rw locks, which occurs only when policies are attached or detached. - Do a lockless read of the dynamic policy list head before acquiring any locks in order to reduce overhead when no dynamic policies are loaded; this a race we can afford to lose. - For every policy entry point invocation, decide whether sleeping is permitted, and if not, use a _NOSLEEP() variant of the composition macros, which will use the rwlock instead of the sxlock. In some cases, we decide which to use based on allocation flags passed to the MAC Framework entry point. As with the move to rwlocks/rmlocks in pfil, this may trigger witness warnings, but these should (generally) be false positives as all acquisition of the locks is for read with two very narrow exceptions for policy load/unload, and those code blocks should never acquire other locks. Sponsored by: Google, Inc. Obtained from: TrustedBSD Project Discussed with: csjp (idea, not specific patch)
* Rename mac_cred_mmapped_drop_perms(), which revokes access to virtualrwatson2008-10-281-9/+1
| | | | | | | | | | | memory mappings when the MAC label on a process changes, to mac_proc_vm_revoke(), It now also acquires its own credential reference directly from the affected process rather than accepting one passed by the the caller, simplifying the API and consumer code. Obtained from: TrustedBSD Project
* Introduce two related changes to the TrustedBSD MAC Framework:rwatson2008-08-231-0/+28
| | | | | | | | | | | | | | | | | | | | | | | | | (1) Abstract interpreter vnode labeling in execve(2) and mac_execve(2) so that the general exec code isn't aware of the details of allocating, copying, and freeing labels, rather, simply passes in a void pointer to start and stop functions that will be used by the framework. This change will be MFC'd. (2) Introduce a new flags field to the MAC_POLICY_SET(9) interface allowing policies to declare which types of objects require label allocation, initialization, and destruction, and define a set of flags covering various supported object types (MPC_OBJECT_PROC, MPC_OBJECT_VNODE, MPC_OBJECT_INPCB, ...). This change reduces the overhead of compiling the MAC Framework into the kernel if policies aren't loaded, or if policies require labels on only a small number or even no object types. Each time a policy is loaded or unloaded, we recalculate a mask of labeled object types across all policies present in the system. Eliminate MAC_ALWAYS_LABEL_MBUF option as it is no longer required. MFC after: 1 week ((1) only) Reviewed by: csjp Obtained from: TrustedBSD Project Sponsored by: Apple, Inc.
* Add the support for the AT_FDCWD and fd-relative name lookups to thekib2008-03-311-0/+1
| | | | | | | | | namei(9). Based on the submission by rdivacky, sponsored by Google Summer of Code 2007 Reviewed by: rwatson, rdivacky Tested by: pho
* VOP_LOCK1() (and so VOP_LOCK()) and VOP_UNLOCK() are only used inattilio2008-01-131-2/+2
| | | | | | | | | | | conjuction with 'thread' argument passing which is always curthread. Remove the unuseful extra-argument and pass explicitly curthread to lower layer functions, when necessary. KPI results broken by this change, which should affect several ports, so version bumping and manpage update will be further committed. Tested by: kris, pho, Diego Sardina <siarodx at gmail dot com>
* vn_lock() is currently only used with the 'curthread' passed as argument.attilio2008-01-101-2/+2
| | | | | | | | | | | | | | | | Remove this argument and pass curthread directly to underlying VOP_LOCK1() VFS method. This modify makes the code cleaner and in particular remove an annoying dependence helping next lockmgr() cleanup. KPI results, obviously, changed. Manpage and FreeBSD_version will be updated through further commits. As a side note, would be valuable to say that next commits will address a similar cleanup about VFS methods, in particular vop_lock1 and vop_unlock. Tested by: Diego Sardina <siarodx at gmail dot com>, Andrea Di Pasquale <whyx dot it at gmail dot com>
* Merge first in a series of TrustedBSD MAC Framework KPI changesrwatson2007-10-241-20/+20
| | | | | | | | | | | | | | | | | | | | | | | from Mac OS X Leopard--rationalize naming for entry points to the following general forms: mac_<object>_<method/action> mac_<object>_check_<method/action> The previous naming scheme was inconsistent and mostly reversed from the new scheme. Also, make object types more consistent and remove spaces from object types that contain multiple parts ("posix_sem" -> "posixsem") to make mechanical parsing easier. Introduce a new "netinet" object type for certain IPv4/IPv6-related methods. Also simplify, slightly, some entry point names. All MAC policy modules will need to be recompiled, and modules not updates as part of this commit will need to be modified to conform to the new KPI. Sponsored by: SPARTA (original patches against Mac OS X) Obtained from: TrustedBSD Project, Apple Computer
* Remove the now-unused NET_{LOCK,UNLOCK,ASSERT}_GIANT() macros, whichrwatson2007-08-061-4/+0
| | | | | | | | | | | | | | | previously conditionally acquired Giant based on debug.mpsafenet. As that has now been removed, they are no longer required. Removing them significantly simplifies error-handling in the socket layer, eliminated quite a bit of unwinding of locking in error cases. While here clean up the now unneeded opt_net.h, which previously was used for the NET_WITH_GIANT kernel option. Clean up some related gotos for consistency. Reviewed by: bz, csjp Tested by: kris Approved by: re (kensmith)
* Remove 'MPSAFE' annotations from the comments above most system calls: allrwatson2007-03-041-30/+0
| | | | | | | | system calls now enter without Giant held, and then in some cases, acquire Giant explicitly. Remove a number of other MPSAFE annotations in the credential code and tweak one or two other adjacent comments.
* Trim unneeded includes.rwatson2006-12-281-20/+0
|
* Break contents of kern_mac.c out into two files following a repo-copy:rwatson2006-12-281-537/+0
| | | | | | | | | | | mac_framework.c Contains basic MAC Framework functions, policy registration, sysinits, etc. mac_syscalls.c Contains implementations of various MAC system calls, including ENOSYS stubs when compiling without options MAC. Obtained from: TrustedBSD Project
* Update MAC Framework general comments, referencing various interfaces itrwatson2006-12-281-12/+40
| | | | | | | | | | | | | | consumes and implements, as well as the location of the framework and policy modules. Refactor MAC Framework versioning a bit so that the current ABI version can be exported via a read-only sysctl. Further update comments relating to locking/synchronization. Update copyright to take into account these and other recent changes. Obtained from: TrustedBSD Project
* Move src/sys/sys/mac_policy.h, the kernel interface between the MACrwatson2006-12-221-2/+1
| | | | | | | | | | | Framework and security modules, to src/sys/security/mac/mac_policy.h, completing the removal of kernel-only MAC Framework include files from src/sys/sys. Update the MAC Framework and MAC policy modules. Delete the old mac_policy.h. Third party policy modules will need similar updating. Obtained from: TrustedBSD Project
* Remove mac_enforce_subsystem debugging sysctls. Enforcement onrwatson2006-12-211-3/+1
| | | | | | | | | | subsystems will be a property of policy modules, which may require access control check entry points to be invoked even when not actively enforcing (i.e., to track information flow without providing protection). Obtained from: TrustedBSD Project Suggested by: Christopher dot Vance at sparta dot com
* Expand commenting on label slots, justification for the MAC Framework lockingrwatson2006-12-201-54/+79
| | | | | | | | model, interactions between locking and policy init/destroy methods. Rewrap some comments to 77 character line wrap. Obtained from: TrustedBSD Project
* Complete break-out of sys/sys/mac.h into sys/security/mac/mac_framework.hrwatson2006-10-221-1/+2
| | | | | | | | | | | | | begun with a repo-copy of mac.h to mac_framework.h. sys/mac.h now contains the userspace and user<->kernel API and definitions, with all in-kernel interfaces moved to mac_framework.h, which is now included across most of the kernel instead. This change is the first step in a larger cleanup and sweep of MAC Framework interfaces in the kernel, and will not be MFC'd. Obtained from: TrustedBSD Project Sponsored by: SPARTA
* Remove MAC_DEBUG label counters, which were used to debug leaks andrwatson2006-09-201-11/+0
| | | | | | | | | other problems while labels were first being added to various kernel objects. They have outlived their usefulness. MFC after: 1 month Suggested by: Christopher dot Vance at SPARTA dot com Obtained from: TrustedBSD Project
* Remove the NDEVFSINO and NDEVFSOVERFLOW options which no longer exists inphk2006-07-171-1/+0
| | | | | | DEVFS. Remove the opt_devfs.h file now that it is empty.
* Don't call vn_finished_write() if vn_start_write() failed.tegge2006-03-191-4/+6
|
* Standard Giant push down operations for the Mandatory Access Control (MAC)csjp2005-10-041-34/+27
| | | | | | | | | | | | | | | | | | | | | | framework. This makes Giant protection around MAC operations which inter- act with VFS conditional, based on the MPSAFE status of the file system. Affected the following syscalls: o __mac_get_fd o __mac_get_file o __mac_get_link o __mac_set_fd o __mac_set_file o __mac_set_link -Drop Giant all together in __mac_set_proc because the mac_cred_mmapped_drop_perms_recurse routine no longer requires it. -Move conditional Giant aquisitions to after label allocation routines. -Move the conditional release of Giant to before label de-allocation routines. Discussed with: rwatson
* Bump the module versions of the MAC Framework and MAC policy modulesrwatson2005-07-141-1/+5
| | | | | | | from 2 (6.x) to 3 (7.x) to allow for future changes in the MAC policy module ABI in 7.x. Obtained from: TrustedBSD Project
* Get the directory structure correct in a comment.trhodes2005-04-221-1/+2
| | | | Submitted by: Samy Al Bahra
* In mac_get_fd(), remove unconditional acquisition of Giant around copyingrwatson2005-04-161-9/+7
| | | | | | | | | | | | | | of the socket label to thread-local storage, and replace it with conditional acquisition based on debug.mpsafenet. Acquire the socket lock around the copy operation. In mac_set_fd(), replace the unconditional acquisition of Giant with the conditional acquisition of Giant based on debug.mpsafenet. The socket lock is acquired in mac_socket_label_set() so doesn't have to be acquired here. Obtained from: TrustedBSD Project Sponsored by: SPAWAR, SPARTA
* Bump MAC Framework version to 2 in preparation for the upcoming API/ABIrwatson2004-11-091-1/+1
| | | | | | changes associated with adding System V IPC support. This will prevent old modules from being used with the new kernel, and new modules from being used with the old kernel.
* Disable use of synchronization early in the boot by the MAC Framework;rwatson2004-10-301-0/+21
| | | | | | for modules linked into the kernel or loaded very early, panics will result otherwise, as the CV code it calls will panic due to its use of a mutex before it is initialized.
* Do a pass over all modules in the kernel and make them return EOPNOTSUPPphk2004-07-151-0/+1
| | | | | | | | for unknown events. A number of modules return EINVAL in this instance, and I have left those alone for now and instead taught MOD_QUIESCE to accept this as "didn't do anything".
* Add /* !MAC */ to final #endif.rwatson2004-05-031-1/+1
|
* Bump copyright date for NETA to 2004.rwatson2004-05-031-1/+1
|
* Add MAC_STATIC, a kernel option that disables internal MAC Frameworkrwatson2004-05-031-0/+25
| | | | | | | | | | synchronization protecting against dynamic load and unload of MAC policies, and instead simply blocks load and unload. In a static configuration, this allows you to avoid the synchronization costs associated with introducing dynamicism. Obtained from: TrustedBSD Project Sponsored by: DARPA, McAfee Research
* Update my personal copyrights and NETA copyrights in the kernelrwatson2004-02-221-2/+2
| | | | | | | | to use the "year1-year3" format, as opposed to "year1, year2, year3". This seems to make lawyers more happy, but also prevents the lines from getting excessively long as the years start to add up. Suggested by: imp
* Coalesce pipe allocations and frees. Previously, the pipe coderwatson2004-02-011-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | would allocate two 'struct pipe's from the pipe zone, and malloc a mutex. - Create a new "struct pipepair" object holding the two 'struct pipe' instances, struct mutex, and struct label reference. Pipe structures now have a back-pointer to the pipe pair, and a 'pipe_present' flag to indicate whether the half has been closed. - Perform mutex init/destroy in zone init/destroy, avoiding reallocating the mutex for each pipe. Perform most pipe structure setup in zone constructor. - VM memory mappings for pageable buffers are still done outside of the UMA zone. - Change MAC API to speak 'struct pipepair' instead of 'struct pipe', update many policies. MAC labels are also handled outside of the UMA zone for now. Label-only policy modules don't have to be recompiled, but if a module is recompiled, its pipe entry points will need to be updated. If a module actually reached into the pipe structures (unlikely), that would also need to be modified. These changes substantially simplify failure handling in the pipe code as there are many fewer possible failure modes. On half-close, pipes no longer free the 'struct pipe' for the closed half until a full-close takes place. However, VM mapped buffers are still released on half-close. Some code refactoring is now possible to clean up some of the back references, etc; this patch attempts not to change the structure of most of the pipe implementation, only allocation/free code paths, so as to avoid introducing bugs (hopefully). This cuts about 8%-9% off the cost of sequential pipe allocation and free in system call tests on UP and SMP in my micro-benchmarks. May or may not make a difference in macro-benchmarks, but doing less work is good. Reviewed by: juli, tjr Testing help: dwhite, fenestro, scottl, et al
* Implement sockets support for __mac_get_fd() and __mac_set_fd()rwatson2003-11-161-0/+30
| | | | | | | | | | | | | | | | | | | | | | | | | | system calls, and prefer these calls over getsockopt()/setsockopt() for ABI reasons. When addressing UNIX domain sockets, these calls retrieve and modify the socket label, not the label of the rendezvous vnode. - Create mac_copy_socket_label() entry point based on mac_copy_pipe_label() entry point, intended to copy the socket label into temporary storage that doesn't require a socket lock to be held (currently Giant). - Implement mac_copy_socket_label() for various policies. - Expose socket label allocation, free, internalize, externalize entry points as non-static from mac_net.c. - Use mac_socket_label_set() in __mac_set_fd(). MAC-aware applications may now use mac_get_fd(), mac_set_fd(), and mac_get_peer() to retrieve and set various socket labels without directly invoking the getsockopt() interface. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Mark __mac_get_pid() as MPSAFE in the comment, as it runs withoutrwatson2003-11-121-37/+15
| | | | | | | | | | | Giant and is also MPSAFE. Push Giant further down into __mac_get_fd() and __mac_set_fd(), grabbing it only for constrained regions dealing with VFS, and dropping it entirely for operations related to labeling of pipes. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Modify the MAC Framework so that instead of embedding a (struct label)rwatson2003-11-121-62/+57
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | in various kernel objects to represent security data, we embed a (struct label *) pointer, which now references labels allocated using a UMA zone (mac_label.c). This allows the size and shape of struct label to be varied without changing the size and shape of these kernel objects, which become part of the frozen ABI with 5-STABLE. This opens the door for boot-time selection of the number of label slots, and hence changes to the bound on the number of simultaneous labeled policies at boot-time instead of compile-time. This also makes it easier to embed label references in new objects as required for locking/caching with fine-grained network stack locking, such as inpcb structures. This change also moves us further in the direction of hiding the structure of kernel objects from MAC policy modules, not to mention dramatically reducing the number of '&' symbols appearing in both the MAC Framework and MAC policy modules, and improving readability. While this results in minimal performance change with MAC enabled, it will observably shrink the size of a number of critical kernel data structures for the !MAC case, and should have a small (but measurable) performance benefit (i.e., struct vnode, struct socket) do to memory conservation and reduced cost of zeroing memory. NOTE: Users of MAC must recompile their kernel and all MAC modules as a result of this change. Because this is an API change, third party MAC modules will also need to be updated to make less use of the '&' symbol. Suggestions from: bmilekic Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Whitespace sync to MAC branch, expand comment at the head of the file.rwatson2003-11-111-3/+9
|
* Remove the flags argument from mac_externalize_*_label(), as it's notrwatson2003-11-061-6/+6
| | | | | | | passed into policies or used internally to the MAC Framework. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* mac_Finish break-out of kern_mac.c into parts:rwatson2003-10-221-2756/+5
| | | | | | | | | | | | | | | | | | | | | | | Include src/sys/security/mac/mac_internal.h in kern_mac.c. Remove redundant defines from the include: SYSCTL_DECL(), debug macros, composition macros. Unstaticize various bits now exposed to the remainder of the kernel: mac_init_label(), mac_destroy_label(). Remove all the functions now implemented in mac_process/mac_vfs/mac_net/ mac_pipe. Also remove debug counters, sysctls exporting debug counters, enforcement flags, sysctls exporting enforcement flags. Leave module declaration, sysctl nodes, mactemp malloc type, system calls. This should conclude MAC/LINT/NOTES breakage from the break-out process, but I'm running builds now to make sure I caught everything. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Variable cleanup following break-out of kern_mac.c into sys/security/mac:rwatson2003-10-221-16/+10
| | | | | | | | | | | | Unstaticize mac_late. Remove ea_warn_once, now in mac_vfs.c. Unstaticisize mac_policy_list, mac_static_policy_list, use struct mac_policy_list_head instead of LIST_HEAD() directly. Unstaticize and un-inline MAC policy locking functions so they can be referenced from mac_*.c. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Rename error_select() to mac_error_select(), and unstaticize so itrwatson2003-10-221-5/+4
| | | | | | | can be used from src/sys/security/mac/mac_*.c. Obtained from: TrustedBSD Project Sponosred by: DARPA, Network Associates Laboratories
* If the struct mac copied into the kernel has a negative length, returnrwatson2003-09-291-1/+2
| | | | | EINVAL rather than failing the following malloc due to the value being too large.
* Fix a mac_policy_list reference to be a mac_static_policy_listrwatson2003-08-261-1/+1
| | | | | | | | reference: this fixes mac_syscall() for static policies when using optimized locking. Obtained from: TrustedBSD Project Sponosred by: DARPA, Network Associates Laboratories
OpenPOWER on IntegriCloud