PERFORCE change 107690 for review

[Todd Miller]

http://perforce.freebsd.org/chv.cgi?CH=107690

Change 107690 by millert at millert_macbook on 2006/10/11 17:25:46

	Update from bugzilla.

Affected files ...

.. //depot/projects/trustedbsd/sedarwin8/ERRATA#3 edit

Differences ...

==== //depot/projects/trustedbsd/sedarwin8/ERRATA#3 (text+ko) ====

@@ -43,3 +43,20 @@
      to get/set this label.  Security server methods that return a
      label handle or text label can use the port label for access
      control.
+
+316: vn_rdwr_64() calls mac_vnode_check_{read,write} (). In the case of 
+     Apple Double Extended Attributes the VNODE may not be labeled,
+     causing problems with policies that expect a valid label.  The 
+     current work around involves a new ioflag (IO_NOAUTH) which bypasses
+     MAC checks. MAC mediation in vn_rdwr_64() needs to be evaluated.
+
+317: The framework uses the VL_LABELED flag to indicate that a vnode has 
+     been labeled by the framework/policy. This flag is set regardless of 
+     the success/failure of label association/creation. If a policy provides
+     consistency checking for xattr backed labels and fails to provide a valid
+     label, the vnode will not have a valid label.  Policy and framework 
+     interactions when bad labels is read from the file system needs to be 
+     reviewed.
+
+321: Additional documentation is needed in mac_policy.h to specify if an 
+     entrypoint may sleep.