src/sys/security, branch releng/7.0

MFC revision 1.23

2008-02-05T14:36:41Z

Make sure we handle listen() and eliminate console messages for unknown event types. Approved by: re@ (kensmith)

Merge mac_posix_sem.c:1.12 from HEAD to RELENG_7:

2007-12-21T14:32:04Z

Fix a MAC label leak for POSIX semaphores, in which per-policy labels would be properly disposed of, but the global label structure for the semaphore wouldn't be freed. Reported by: tanyong , zhouzhouyi Approved by: re (kensmith)

Merge mac_framework.h:1.85, mac_policy.h:1.95, mac_posix_sem.c:1.10,

2007-11-06T14:46:59Z

mac_biba.c:1.108, mac_mls.c:1.89, mac_stub.c:1.69, mac_test.c:1.79 from HEAD to RELENG_7: Canonicalize naming of local variables for struct ksem and associated labels to 'ks' and 'kslabel' to reflect the convention in posix_sem.c. Obtained from: TrustedBSD Project Approved by: re (kensmith)

MFC revision 1.13

2007-11-04T16:44:48Z

Make sure we are incrementing read counters Approved by: re@ (kensmith)

Merge audit.c:1.35, audit_bsm_klib.c:1.8 from HEAD to RELENG_7:

2007-11-02T09:53:32Z

Replace use of AU_NULL with 0 when no audit classes are in use; this supports the removal of hard-coded audit class constants in OpenBSM 1.0. All audit classes are now dynamically configured via the audit_class database. Obtained from: TrustedBSD Project Approved by: re (kensmith)

MFC revision 1.21, use extended process tokens by default

2007-11-01T19:03:03Z

Approved by: re@ (kensmith)

MFC audit_pipe.c revision 1.12

2007-10-20T15:11:00Z

Approved by: re@ (kensmith)

- Move all of the PS_ flags into either p_flag or td_flags.

2007-09-17T05:31:39Z

- p_sflag was mostly protected by PROC_LOCK rather than the PROC_SLOCK or previously the sched_lock. These bugs have existed for some time. - Allow swapout to try each thread in a process individually and then swapin the whole process if any of these fail. This allows us to move most scheduler related swap flags into td_flags. - Keep ki_sflag for backwards compat but change all in source tools to use the new and more correct location of P_INMEM. Reported by: pho Reviewed by: attilio, kib Approved by: re (kensmith)

Rename mac_check_vnode_delete() MAC Framework and MAC Policy entry

2007-09-10T00:00:18Z

point to mac_check_vnode_unlink(), reflecting UNIX naming conventions. This is the first of several commits to synchronize the MAC Framework in FreeBSD 7.0 with the MAC Framework as it will appear in Mac OS X Leopard. Reveiwed by: csjp, Samy Bahra Submitted by: Jacques Vidrine Obtained from: Apple Computer, Inc. Sponsored by: SPARTA, SPAWAR Approved by: re (bmah)

Remove the now-unused NET_{LOCK,UNLOCK,ASSERT}_GIANT() macros, which

2007-08-06T14:26:03Z

previously conditionally acquired Giant based on debug.mpsafenet. As that has now been removed, they are no longer required. Removing them significantly simplifies error-handling in the socket layer, eliminated quite a bit of unwinding of locking in error cases. While here clean up the now unneeded opt_net.h, which previously was used for the NET_WITH_GIANT kernel option. Clean up some related gotos for consistency. Reviewed by: bz, csjp Tested by: kris Approved by: re (kensmith)