src/sys/security/mac_bsdextended, branch main

MAC/bsdextended: Restore matching subjects' effective GID

2025-09-17T12:16:03Z

Fixes: be1f7435ef218b1d ("kern: start tracking cr_gid outside of cr_groups[]") MFC after: 5 days MFC to: stable/15 Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D52270

MAC: mac_policy.h: Declare common MAC sysctl and jail parameters' nodes

2024-12-16T14:42:28Z

Do this only when the headers for these functionalities were included prior to this one. Indeed, if they need to be included, style(9) mandates they should have been so before this one. Remove the common MAC sysctl declaration from , as it is now redundant (all its includers also include ). Remove local such declarations from all policies' files. Reviewed by: jamie Approved by: markj (mentor) MFC after: 5 days Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D46903

mac_bsdextended: Remove \n from sysctl descriptions

2024-11-21T15:26:40Z

sysctl(8) prints a newline after the description; the description should not end with one itself. Sponsored by: The FreeBSD Foundation

sys: Remove $FreeBSD$: two-line .h pattern

2023-08-16T17:54:11Z

Remove /^\s*\*\n \*\s+\$FreeBSD\$$\n/

Deduplicate fsid comparisons

2020-05-21T01:55:35Z

Comparing fsid_t objects requires internal knowledge of the fsid structure and yet this is duplicated across a number of places in the code. Simplify by creating a fsidcmp function (macro). Reviewed by: mjg, rmacklem Approved by: mav (mentor) MFC after: 1 week Sponsored by: iXsystems, Inc. Differential Revision: https://reviews.freebsd.org/D24749

Mark more nodes as CTLFLAG_MPSAFE or CTLFLAG_NEEDGIANT (17 of many)

2020-02-26T14:26:36Z

r357614 added CTLFLAG_NEEDGIANT to make it easier to find nodes that are still not MPSAFE (or already are but aren’t properly marked). Use it in preparation for a general review of all nodes. This is non-functional change that adds annotations to SYSCTL_NODE and SYSCTL_PROC nodes using one of the soon-to-be-required flags. Mark all obvious cases as MPSAFE. All entries that haven't been marked as MPSAFE before are by default marked as NEEDGIANT Approved by: kib (mentor, blanket) Commented by: kib, gallatin, melifaro Differential Revision: https://reviews.freebsd.org/D23718

Remove unused argument to priv_check_cred.

2018-12-11T19:32:16Z

Patch mostly generated with cocinnelle: @@ expression E1,E2; @@ - priv_check_cred(E1,E2,0) + priv_check_cred(E1,E2) Sponsored by: The FreeBSD Foundation

Correct bitwise test in mac_bsdextended ugidfw_rule_valid()

2017-06-13T01:17:58Z

PR: 218039 CID: 1008934 Reported by: Coverity, PVS-Studio Reviewed by: kib MFC after: 1 week Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D10300

Pull in r267961 and r267973 again. Fix for issues reported will follow.

2014-06-28T03:56:17Z

Revert r267961, r267973:

2014-06-27T22:05:21Z

These changes prevent sysctl(8) from returning proper output, such as: 1) no output from sysctl(8) 2) erroneously returning ENOMEM with tools like truss(1) or uname(1) truss: can not get etype: Cannot allocate memory