src/sys/security, branch releng/10.3

MFC r294137:

2016-01-23T07:35:29+00:00

Do not panic when the filesystem which carries the audit files, is unmounted
and audit is active.  Do not write to the suspended fs.

MFH: r292522

2016-01-04T16:51:56+00:00

Merge from contrib/openbsm to bring the kernel audit bits up to date with OpenBSM 1.2 alpha 4:

- remove $P4$
- fix a comment

Merge r263233 from HEAD to stable/10:

2015-03-19T13:37:36+00:00

  Update kernel inclusions of capability.h to use capsicum.h instead; some
  further refinement is required as some device drivers intended to be
  portable over FreeBSD versions rely on __FreeBSD_version to decide whether
  to include capability.h.

Sponsored by:	Google, Inc.

MFC r259885:

2014-08-16T13:11:59+00:00

 As constantly reported during kernel compilation, m_buflen is unsigned so
 can never be < 0.  Remove the expression, which can never be true.

MFC r263458:

2014-03-31T02:24:29+00:00

audit: plug FILEDESC_LOCK leak in audit_canon_path.

MFC r258622: dtrace sdt: remove the ugly sname parameter of SDT_PROBE_DEFINE

2014-01-17T10:58:59+00:00

MFC 259014: There is no sysctl with the MIB { CTL_KERN, KERN_MAXID }.

2013-12-26T16:57:36+00:00

Fix some typos that were causing probe argument types to show up as unknown.

2013-10-01T15:40:27+00:00

Reviewed by:	rwatson (mac provider)
Approved by:	re (glebius)
MFC after:	1 week

Make the mac_policy_rm lock recursable, which allows reentrance into

2013-09-29T20:21:34+00:00

the mac framework.  It is needed when priv_check_cred(9) is called from
the mac callback, e.g. in the mac_portacl(4).

Reported by:	az
Reviewed by:	rwatson
Sponsored by:	The FreeBSD Foundation
MFC after:	1 week
Approved by:	re (gjb)

- Use make_dev_credf(MAKEDEV_REF) instead of the race-prone make_dev()+

2013-09-07T13:45:44+00:00

dev_ref() in the clone handlers that still use it.
- Don't set SI_CHEAPCLONE flag, it's not used anywhere neither in devfs
(for anything real)

Reviewed by:	kib