src/sys/security/mac_none, branch releng/7.0FreeBSD source treehttps://cgit-dev.freebsd.org/src/atom?h=releng%2F7.02007-02-23T11:21:26ZRemove many unneeded includes, update copyright.2007-02-23T11:21:26ZRobert Watsonrwatson@FreeBSD.org2007-02-23T11:21:26Zurn:sha1:68cb8659050380e1245328796e2783f030c94974mac_none sample policy has nothing to enforce, so remove sysctls.2007-02-23T11:08:45ZRobert Watsonrwatson@FreeBSD.org2007-02-23T11:08:45Zurn:sha1:faf00eecd408174b3c8fef0d5b4ef3fa167f13ca
mac_stub acts as a template policy and holds sample sysctls.
Continue 7-CURRENT MAC Framework rearrangement and cleanup:2007-02-06T10:59:23ZRobert Watsonrwatson@FreeBSD.org2007-02-06T10:59:23Zurn:sha1:c96ae1968a6ab7056427a739bce81bf07447c2d4
Don't perform a nested include of _label.h in mac.h, as mac.h now
describes only the user API to MAC, and _label.h defines the in-kernel
representation of MAC labels.
Remove mac.h includes from policies and MAC framework components that do
not use userspace MAC API definitions.
Add _KERNEL inclusion checks to mac_internal.h and mac_policy.h, as these
are kernel-only include files
Obtained from: TrustedBSD Project
Move src/sys/sys/mac_policy.h, the kernel interface between the MAC2006-12-22T23:34:47ZRobert Watsonrwatson@FreeBSD.org2006-12-22T23:34:47Zurn:sha1:0efd6615cd5f39b67cec82a7034e655f3b5801e3
Framework and security modules, to src/sys/security/mac/mac_policy.h,
completing the removal of kernel-only MAC Framework include files from
src/sys/sys. Update the MAC Framework and MAC policy modules. Delete
the old mac_policy.h.
Third party policy modules will need similar updating.
Obtained from: TrustedBSD Project
Add #include <sys/sx.h>, devfs is going to require this shortly.2005-09-19T18:52:51ZPoul-Henning Kampphk@FreeBSD.org2005-09-19T18:52:51Zurn:sha1:3642298923e528d795e3a30ec165d2b469e28b40Update my personal copyrights and NETA copyrights in the kernel2004-02-22T00:33:12ZRobert Watsonrwatson@FreeBSD.org2004-02-22T00:33:12Zurn:sha1:f6a4109212fd8fbabc731f07b2dd5c7e07fbec33
to use the "year1-year3" format, as opposed to "year1, year2, year3".
This seems to make lawyers more happy, but also prevents the
lines from getting excessively long as the years start to add up.
Suggested by: imp
mac_none is now the null policy, not a stub policy, so remove the2003-08-21T16:19:17ZRobert Watsonrwatson@FreeBSD.org2003-08-21T16:19:17Zurn:sha1:0164a4992a536ad96a70dbf8338a68f2917d1ed0
stubs. Add a pointer to mac_stub, which is now the stub policy.
Obtained from: TrustedBSD Project
Sponsored by: DARPA, Network Associates Laboratories
Redesign the externalization APIs from the MAC Framework to2003-06-23T01:26:34ZRobert Watsonrwatson@FreeBSD.org2003-06-23T01:26:34Zurn:sha1:f51e58036ebe3a3e75527325e659d7ba02b129ed
the MAC policy modules to improve robustness against C string
bugs and vulnerabilities. Following these revisions, all
string construction of labels for export to userspace (or
elsewhere) is performed using the sbuf API, which prevents
the consumer from having to perform laborious and intricate
pointer and buffer checks. This substantially simplifies
the externalization logic, both at the MAC Framework level,
and in individual policies; this becomes especially useful
when policies export more complex label data, such as with
compartments in Biba and MLS.
Bundled in here are some other minor fixes associated with
externalization: including avoiding malloc while holding the
process mutex in mac_lomac, and hence avoid a failure mode
when printing labels during a downgrade operation due to
the removal of the M_NOWAIT case.
This has been running in the MAC development tree for about
three weeks without problems.
Obtained from: TrustedBSD Project
Sponsored by: DARPA, Network Associates Laboratories
Trim "trustedbsd_" from the front of the policy module "short names";2003-03-27T19:26:39ZRobert Watsonrwatson@FreeBSD.org2003-03-27T19:26:39Zurn:sha1:78183ac2d2669c86a73f9acc38050ce09295a1a7
the vendor is only included in the long name currently, reducing
verbosity when modules are registered and unregistered.
Obtained from: TrustedBSD Project
Sponsored by: DARPA, Network Associates Laboratories
Modify the mac_init_ipq() MAC Framework entry point to accept an2003-03-26T15:12:03ZRobert Watsonrwatson@FreeBSD.org2003-03-26T15:12:03Zurn:sha1:5e7ce4785f43ef1e01c5a85bc10c9ddba60076d7
additional flags argument to indicate blocking disposition, and
pass in M_NOWAIT from the IP reassembly code to indicate that
blocking is not OK when labeling a new IP fragment reassembly
queue. This should eliminate some of the WITNESS warnings that
have started popping up since fine-grained IP stack locking
started going in; if memory allocation fails, the creation of
the fragment queue will be aborted.
Obtained from: TrustedBSD Project
Sponsored by: DARPA, Network Associates Laboratories