src/sys/security/mac_mls, branch releng/7.0

Merge mac_framework.h:1.85, mac_policy.h:1.95, mac_posix_sem.c:1.10,

2007-11-06T14:46:59Z

mac_biba.c:1.108, mac_mls.c:1.89, mac_stub.c:1.69, mac_test.c:1.79 from HEAD to RELENG_7: Canonicalize naming of local variables for struct ksem and associated labels to 'ks' and 'kslabel' to reflect the convention in posix_sem.c. Obtained from: TrustedBSD Project Approved by: re (kensmith)

Rename mac_check_vnode_delete() MAC Framework and MAC Policy entry

2007-09-10T00:00:18Z

point to mac_check_vnode_unlink(), reflecting UNIX naming conventions. This is the first of several commits to synchronize the MAC Framework in FreeBSD 7.0 with the MAC Framework as it will appear in Mac OS X Leopard. Reveiwed by: csjp, Samy Bahra Submitted by: Jacques Vidrine Obtained from: Apple Computer, Inc. Sponsored by: SPARTA, SPAWAR Approved by: re (bmah)

When checking labels during a vnode link operation in MLS, use the file

2007-07-23T13:28:54Z

vnode label for a check rather than the directory vnode label a second time. MFC after: 3 days Submitted by: Zhouyi ZHOU Reviewed by: csjp Sponsored by: Google Summer of Code 2007 Approved by: re (bmah)

Rename macdevfsdirent() to macdevfs() to synchronize with SEDarwin,

2007-04-23T13:36:54Z

where similar data structures exist to support devfs and the MAC Framework, but are named differently. Obtained from: TrustedBSD Project Sponsored by: SPARTA, Inc.

Apply variable name normalization to MAC policies: adopt global conventions

2007-04-23T13:15:23Z

for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project

In the MAC Framework implementation, file systems have two per-mountpoint

2007-04-22T16:18:10Z

labels: the mount label (label of the mountpoint) and the fs label (label of the file system). In practice, policies appear to only ever use one, and the distinction is not helpful. Combine mnt_mntlabel and mnt_fslabel into a single mnt_label, and eliminate extra machinery required to maintain the additional label. Update policies to reflect removal of extra entry points and label. Obtained from: TrustedBSD Project Sponsored by: SPARTA, Inc.

Allow MAC policy modules to control access to audit configuration system

2007-04-21T22:08:48Z

calls. Add MAC Framework entry points and MAC policy entry points for audit(), auditctl(), auditon(), setaudit(), aud setauid(). MAC Framework entry points are only added for audit system calls where additional argument context may be useful for policy decision-making; other audit system calls without arguments may be controlled via the priv(9) entry points. Update various policy modules to implement audit-related checks, and in some cases, other missing system-related checks. Obtained from: TrustedBSD Project Sponsored by: SPARTA, Inc.

Introduce accessor functions mac_label_get() and mac_label_set() to replace

2007-02-06T14:19:25Z

LABEL_TO_SLOT() macro used by policy modules to query and set label data in struct label. Instead of using a union, store an intptr_t, simplifying the API. Update policies: in most cases this required only small tweaks to current wrapper macros. In two cases, a single wrapper macros had to be split into separate get and set macros. Move struct label definition from _label.h to mac_internal.h and remove _label.h. With this change, policies may now treat struct label * as opaque, allowing us to change the layout of struct label without breaking the policy module ABI. For example, we could make the maximum number of policies with labels modifiable at boot-time rather than just at compile-time. Obtained from: TrustedBSD Project

Continue 7-CURRENT MAC Framework rearrangement and cleanup:

2007-02-06T10:59:23Z

Don't perform a nested include of _label.h in mac.h, as mac.h now describes only the user API to MAC, and _label.h defines the in-kernel representation of MAC labels. Remove mac.h includes from policies and MAC framework components that do not use userspace MAC API definitions. Add _KERNEL inclusion checks to mac_internal.h and mac_policy.h, as these are kernel-only include files Obtained from: TrustedBSD Project

Move src/sys/sys/mac_policy.h, the kernel interface between the MAC

2006-12-22T23:34:47Z

Framework and security modules, to src/sys/security/mac/mac_policy.h, completing the removal of kernel-only MAC Framework include files from src/sys/sys. Update the MAC Framework and MAC policy modules. Delete the old mac_policy.h. Third party policy modules will need similar updating. Obtained from: TrustedBSD Project