PERFORCE change 21131 for review

[Robert Watson]

http://perforce.freebsd.org/chv.cgi?CH=21131

Change 21131 by rwatson at rwatson_paprika on 2002/11/16 20:27:56

	Key kld enforcemnt off of mac_enforce_kld rather than
	mac_enforce_system.

Affected files ...

.. //depot/projects/trustedbsd/mac/sys/kern/kern_mac.c#365 edit

Differences ...

==== //depot/projects/trustedbsd/mac/sys/kern/kern_mac.c#365 (text+ko) ====

@@ -125,6 +125,11 @@
     &mac_enforce_fs, 0, "Enforce MAC policy on file system objects");
 TUNABLE_INT("security.mac.enforce_fs", &mac_enforce_fs);
 
+static int	mac_enforce_kld = 1;
+SYSCTL_INT(_security_mac, OID_AUTO, enforce_kld, CTLFLAG_RW,
+    &mac_enforce_kld, 0, "Enforce MAC policy on kld operations");
+TUNABLE_INT("security.mac.enforce_kld", &mac_enforce_kld);
+
 static int	mac_enforce_network = 1;
 SYSCTL_INT(_security_mac, OID_AUTO, enforce_network, CTLFLAG_RW,
     &mac_enforce_network, 0, "Enforce MAC policy on network packets");
@@ -2323,7 +2328,7 @@
 
 	ASSERT_VOP_LOCKED(vp, "mac_check_kld_load");
 
-	if (!mac_enforce_system)
+	if (!mac_enforce_kld)
 		return (0);
 
 	MAC_CHECK(check_kld_load, cred, vp, &vp->v_label);
@@ -2336,7 +2341,7 @@
 {
 	int error;
 
-	if (!mac_enforce_system)
+	if (!mac_enforce_kld)
 		return (0);
 
 	MAC_CHECK(check_kld_stat, cred);
@@ -2349,7 +2354,7 @@
 {
 	int error;
 
-	if (!mac_enforce_system)
+	if (!mac_enforce_kld)
 		return (0);
 
 	MAC_CHECK(check_kld_unload, cred);
To Unsubscribe: send mail to majordomo at trustedbsd.org
with "unsubscribe trustedbsd-cvs" in the body of the message