src/sys/security/mac_partition, branch main FreeBSD source tree MAC: Rename mac_cred_create_swapper to mac_cred_create_kproc0 2025-12-04T19:52:59+00:00 John Baldwin jhb@FreeBSD.org 2025-12-04T19:52:59+00:00 61ffc1bf8c4288c18d0ef86877e2558fa7ae3e13 Reported by: markj Reviewed by: olce Differential Revision: https://reviews.freebsd.org/D54052 
Reported by:	markj
Reviewed by:	olce
Differential Revision:	https://reviews.freebsd.org/D54052
MAC: mac_policy.h: Declare common MAC sysctl and jail parameters' nodes 2024-12-16T14:42:28+00:00 Olivier Certner olce@FreeBSD.org 2024-07-04T14:08:20+00:00 db33c6f3ae9d1231087710068ee4ea5398aacca7 Do this only when the headers for these functionalities were included prior to this one. Indeed, if they need to be included, style(9) mandates they should have been so before this one. Remove the common MAC sysctl declaration from <security/mac/mac_internal.h>, as it is now redundant (all its includers also include <security/mac/mac_policy.h>). Remove local such declarations from all policies' files. Reviewed by: jamie Approved by: markj (mentor) MFC after: 5 days Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D46903 
Do this only when the headers for these functionalities were included
prior to this one.  Indeed, if they need to be included, style(9)
mandates they should have been so before this one.

Remove the common MAC sysctl declaration from
<security/mac/mac_internal.h>, as it is now redundant (all its includers
also include <security/mac/mac_policy.h>).

Remove local such declarations from all policies' files.

Reviewed by:    jamie
Approved by:    markj (mentor)
MFC after:      5 days
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D46903
sys: Remove $FreeBSD$: two-line .h pattern 2023-08-16T17:54:11+00:00 Warner Losh imp@FreeBSD.org 2023-08-16T17:54:11+00:00 95ee2897e98f5d444f26ed2334cc7c439f9c16c6 Remove /^\s*\*\n \*\s+\$FreeBSD\$$\n/ 
Remove /^\s*\*\n \*\s+\$FreeBSD\$$\n/
Mark more nodes as CTLFLAG_MPSAFE or CTLFLAG_NEEDGIANT (17 of many) 2020-02-26T14:26:36+00:00 Pawel Biernacki kaktus@FreeBSD.org 2020-02-26T14:26:36+00:00 7029da5c36f2d3cf6bb6c81bf551229f416399e8 r357614 added CTLFLAG_NEEDGIANT to make it easier to find nodes that are still not MPSAFE (or already are but aren’t properly marked). Use it in preparation for a general review of all nodes. This is non-functional change that adds annotations to SYSCTL_NODE and SYSCTL_PROC nodes using one of the soon-to-be-required flags. Mark all obvious cases as MPSAFE. All entries that haven't been marked as MPSAFE before are by default marked as NEEDGIANT Approved by: kib (mentor, blanket) Commented by: kib, gallatin, melifaro Differential Revision: https://reviews.freebsd.org/D23718 
r357614 added CTLFLAG_NEEDGIANT to make it easier to find nodes that are
still not MPSAFE (or already are but aren’t properly marked).
Use it in preparation for a general review of all nodes.

This is non-functional change that adds annotations to SYSCTL_NODE and
SYSCTL_PROC nodes using one of the soon-to-be-required flags.

Mark all obvious cases as MPSAFE.  All entries that haven't been marked
as MPSAFE before are by default marked as NEEDGIANT

Approved by:	kib (mentor, blanket)
Commented by:	kib, gallatin, melifaro
Differential Revision:	https://reviews.freebsd.org/D23718
Remove unused argument to priv_check_cred. 2018-12-11T19:32:16+00:00 Mateusz Guzik mjg@FreeBSD.org 2018-12-11T19:32:16+00:00 cc426dd31990b8b50b210efc450e404596548ca1 Patch mostly generated with cocinnelle: @@ expression E1,E2; @@ - priv_check_cred(E1,E2,0) + priv_check_cred(E1,E2) Sponsored by: The FreeBSD Foundation 
Patch mostly generated with cocinnelle:

@@
expression E1,E2;
@@

- priv_check_cred(E1,E2,0)
+ priv_check_cred(E1,E2)

Sponsored by:	The FreeBSD Foundation
Mark all SYSCTL_NODEs static that have no corresponding SYSCTL_DECLs. 2011-11-07T15:43:11+00:00 Ed Schouten ed@FreeBSD.org 2011-11-07T15:43:11+00:00 6472ac3d8a86336899b6cfb789a4cd9897e3fab5 The SYSCTL_NODE macro defines a list that stores all child-elements of that node. If there's no SYSCTL_DECL macro anywhere else, there's no reason why it shouldn't be static. 
The SYSCTL_NODE macro defines a list that stores all child-elements of
that node. If there's no SYSCTL_DECL macro anywhere else, there's no
reason why it shouldn't be static.
Rather than having MAC policies explicitly declare what object types 2009-01-10T10:58:41+00:00 Robert Watson rwatson@FreeBSD.org 2009-01-10T10:58:41+00:00 9162f64b58d01ec01481d60b6cdc06ffd8e8c7fc they label, derive that information implicitly from the set of label initializers in their policy operations set. This avoids a possible class of programmer errors, while retaining the structure that allows us to avoid allocating labels for objects that don't need them. As before, we regenerate a global mask of labeled objects each time a policy is loaded or unloaded, stored in mac_labeled. Discussed with: csjp Suggested by: Jacques Vidrine <nectar at apple.com> Obtained from: TrustedBSD Project Sponsored by: Apple, Inc. 
they label, derive that information implicitly from the set of label
initializers in their policy operations set.  This avoids a possible
class of programmer errors, while retaining the structure that
allows us to avoid allocating labels for objects that don't need
them.  As before, we regenerate a global mask of labeled objects
each time a policy is loaded or unloaded, stored in mac_labeled.

Discussed with:   csjp
Suggested by:     Jacques Vidrine <nectar at apple.com>
Obtained from:    TrustedBSD Project
Sponsored by:     Apple, Inc.
Rename three MAC entry points from _proc_ to _cred_ to reflect the fact 2008-10-28T11:33:06+00:00 Robert Watson rwatson@FreeBSD.org 2008-10-28T11:33:06+00:00 212ab0cfb38a01878cc1bd44eeb4e6fcab384d5d that they operate directly on credentials: mac_proc_create_swapper(), mac_proc_create_init(), and mac_proc_associate_nfsd(). Update policies. Obtained from: TrustedBSD Project 
that they operate directly on credentials: mac_proc_create_swapper(),
mac_proc_create_init(), and mac_proc_associate_nfsd().  Update policies.

Obtained from:	TrustedBSD Project
Extended comment on why we consider a partition relabel request of "0" to 2008-10-28T09:16:34+00:00 Robert Watson rwatson@FreeBSD.org 2008-10-28T09:16:34+00:00 048e2d5899f83f4be08153c785ccf646ebd68314 be a no-op request, and why this might have to change if we want to allow leaving a partition someday. Obtained from: TrustedBSD Project MFC after: 3 days 
be a no-op request, and why this might have to change if we want to allow
leaving a partition someday.

Obtained from:	TrustedBSD Project
MFC after:	3 days
Rename label_on_label() to partition_check(), which is far more 2008-10-28T09:12:13+00:00 Robert Watson rwatson@FreeBSD.org 2008-10-28T09:12:13+00:00 6c6c03be2ddb04c54e455122799923deaefa4114 suggestive as to its actual function. Obtained from: TrustedBSD Project MFC after: 3 days 
suggestive as to its actual function.

Obtained from:	TrustedBSD Project
MFC after:	3 days