A string loader tunable requires setting the len parameter to a nonzero
value, typically the size of the string, to have the flag CTLFLAG_TUN
work correctly [1] [2].

Without this fix security.mac.{biba,lomac}.trusted_interfaces would
have no effect at all.

[1] 3da1cf1e88f8 Extend the meaning of the CTLFLAG_TUN flag to automatically ...
[2] 6a3287f889b0 Fix regression issue after r267961. Handle special string case ...

Reviewed by:	olce, kib
Fixes:		af3b2549c4ba Pull in r267961 and r267973 again ...
MFC after:	3 days
Differential Revision:	https://reviews.freebsd.org/D48898

(cherry picked from commit 7d4c0fac8c7db9c5741ba98a8b3ce3c43feb1cf4)
(cherry picked from commit 04f360b782205c799b9302ba8bd810f7a303017f)

syscallenter() has a slow path to handle syscall auditing and dtrace
syscall tracing.  It uses AUDIT_SYSCALL_ENTER() to check whether to take
the slow path, but this macro also has side effects: it writes the audit
log entry.  When systrace (dtrace syscall tracing) is enabled, this
would get short-circuited, and we end up not writing audit log entries.

Introduce a pure macro to check whether auditing is enabled, use it in
syscallenter() instead of AUDIT_SYSCALL_ENTER().

Reviewed by:	kib
Reported by:	Joe Duin <jd@firexfly.com>
Fixes:		2f7292437d0c ("Merge audit and systrace checks")
MFC after:	3 days
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D48448

(cherry picked from commit f78fe930854cac6eed55859b45e0a7b5d87189d6)

Do this only when the headers for these functionalities were included
prior to this one.  Indeed, if they need to be included, style(9)
mandates they should have been so before this one.

Remove the common MAC sysctl declaration from
<security/mac/mac_internal.h>, as it is now redundant (all its includers
also include <security/mac/mac_policy.h>).

Remove local such declarations from all policies' files.

Reviewed by:    jamie
Approved by:    markj (mentor)
MFC after:      5 days
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D46903

(cherry picked from commit db33c6f3ae9d1231087710068ee4ea5398aacca7)

The original changes in 'sys/security/mac_grantbylabel/mac_grantbylabel.c' were
removed as MAC/grantbylabel has not been MFCed.

To be used by MAC/do.

Reviewed by:    jamie
Approved by:    markj (mentor)
MFC after:      5 days
Relnotes:       yes
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D46899

(cherry picked from commit 5041b20503dbb442cc9ebd0a6e4db26905102c72)

No functional change.

Reviewed by:    jamie
Approved by:    markj (mentor)
MFC after:      5 days
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D46898

(cherry picked from commit 90678c892d7b3a90339b7fc19fde16c64fe3cb70)

sysctl(8) prints a newline after the description; the description should
not end with one itself.

Sponsored by:	The FreeBSD Foundation

(cherry picked from commit 6b62e00da4ad0624fce5e6f0b5b39a6f44c8ba60)
(cherry picked from commit 28092a8bc72e969d3736ff064ad3f1ca7d80ce0b)

sys_setgroups() (and sys_getgroups()) was changed in commit "kern: fail
getgroup and setgroup with negative int" (4bc2174a1b48) to take the
number of groups as an 'int' (for sys_getgroups(), POSIX mandates this
change; for sys_setgroups(), which it does not standardize, it's
arguably for consistency).

All our internal APIs related to groups on 'struct ucred', as well as
related members on the latter, treat that number as an 'int' as well
(and not a 'u_int').

Consequently, to avoid surprises, change kern_setgroups() to behave the
same, and fix audit_arg_groupset() accordingly.  With that change,
everything is handled with signed integers internally.

Update sanity checks accordingly.

Reviewed by:    mhorne
Approved by:    markj (mentor)
MFC after:      3 days
Differential Revision:  https://reviews.freebsd.org/D46912

(cherry picked from commit abd39811cd7e4bb928da503f4a5c79364ac8d0f5)

Approved by:    markj (mentor)

so_peerlabel can only be used when the socket is not listening.

Reviewed by:		markj
Sponsored by:		Netflix, Inc.
Differential Revision:	https://reviews.freebsd.org/D46755

(cherry picked from commit 2fb778fab893b4a8a86ecfa20acf2e23bb2cdae8)

Whenever mac_syncache_init() returns an error, ensure that
*label = NULL. This simplifies the error handling by the caller.

Reviewed by:		rscheff
Sponsored by:		Netflix, Inc.
Differential Revision:	https://reviews.freebsd.org/D46701

(cherry picked from commit 3f2792166aeed4baf07d351bcb12a9d196c443eb)

Use priv_check_cred() with a new privilege (PRIV_SEEJAILPROC) instead of
explicitly testing for UID 0 (the former has been the rule for almost 20
years).

As a consequence, cr_canseejailproc() now abides by the
'security.bsd.suser_enabled' sysctl and MAC policies.

Update the MAC policies Biba and LOMAC, and prison_priv_check() so that
they don't deny this privilege.  This preserves the existing behavior
(the 'root' user is not restricted, even when jailed, unless
'security.bsd.suser_enabled' is not 0) and is consistent with what is
done for the related policies/privileges (PRIV_SEEOTHERGIDS,
PRIV_SEEOTHERUIDS).

Reviewed by:            emaste (earlier version), mhorne
Sponsored by:           Kumacom SAS
Differential Revision:  https://reviews.freebsd.org/D40626

(cherry picked from commit 7974ca1cdbee949f5e453eea112be265b425c407)

Approved by:    markj (mentor)