PERFORCE change 106058 for review

[Robert Watson]

http://perforce.freebsd.org/chv.cgi?CH=106058

Change 106058 by rwatson at rwatson_peppercorn on 2006/09/13 14:07:12

	Annotate that there's some functional duplication between the MAC
	system checks and privilege checks, so we might want to do some
	pruning.

Affected files ...

.. //depot/projects/trustedbsd/priv/sys/security/mac/mac_system.c#3 edit

Differences ...

==== //depot/projects/trustedbsd/priv/sys/security/mac/mac_system.c#3 (text+ko) ====

@@ -59,6 +59,12 @@
     &mac_enforce_system, 0, "Enforce MAC policy on system operations");
 TUNABLE_INT("security.mac.enforce_system", &mac_enforce_system);
 
+/*
+ * XXXRW: Some of these checks now duplicate privilege checks.  However,
+ * others provide additional security context that may be useful to policies.
+ * We need to review these and remove ones that are pure duplicates.
+ */
+
 int
 mac_check_kenv_dump(struct ucred *cred)
 {