PERFORCE change 100978 for review

[Robert Watson]

http://perforce.freebsd.org/chv.cgi?CH=100978

Change 100978 by rwatson at rwatson_zoo on 2006/07/08 11:15:56

	More notes.

Affected files ...

.. //depot/projects/trustedbsd/mac2/mac2_notes.txt#3 edit

Differences ...

==== //depot/projects/trustedbsd/mac2/mac2_notes.txt#3 (text+ko) ====

@@ -10,7 +10,8 @@
   (removing '_from_', etc), and make things much more legible and
   consistent.
 
-- Add a new subsystem class netinet to hold netinet-related methods.
+- Add a new subsystem class _netinet_ to hold netinet-related methods.
+  Added a pseudo-class, _policy_ for policy-related events (init, destroy).
 
 - Resort entry points in mac_framework.h, mac_policy.h by object rather
   than method.  This significantly improves readability.
@@ -18,6 +19,11 @@
 - Split mac.h into mac.h and mac_framework.h, breaking out user and kernel
   APIs into separate kernel include files.
 
+- Remove mount_fs label, which has generally gone unused.
+
+- Rename all devfs entry points to be mac_devfs_foo() rather than having
+  some be mac_devfsdirent_foo().
+
 Planned changes:
 
 - Accessor methods for slot data based on functions, in order to avoid
@@ -56,3 +62,7 @@
   are only used for objects requested by the policy.  I.e., policies can
   request only a cred label slot, etc.  This could then be used to key
   memory allocation overhead on more objects.
+
+- Move from just init/destroy to also attach/detach methods for the policy,
+  so that memory allocation can be performed without the mac policy lock
+  held.