From owner-p4-projects@FreeBSD.ORG  Fri May  9 00:52:02 2008
Return-Path: <owner-p4-projects@FreeBSD.ORG>
Delivered-To: p4-projects@freebsd.org
Received: by hub.freebsd.org (Postfix, from userid 32767)
	id E578D106566C; Fri,  9 May 2008 00:52:01 +0000 (UTC)
Delivered-To: perforce@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id A7C6D106564A
	for <perforce@freebsd.org>; Fri,  9 May 2008 00:52:01 +0000 (UTC)
	(envelope-from wsalamon@computer.org)
Received: from repoman.freebsd.org (repoman.freebsd.org
	[IPv6:2001:4f8:fff6::29])
	by mx1.freebsd.org (Postfix) with ESMTP id 964D38FC17
	for <perforce@freebsd.org>; Fri,  9 May 2008 00:52:01 +0000 (UTC)
	(envelope-from wsalamon@computer.org)
Received: from repoman.freebsd.org (localhost [127.0.0.1])
	by repoman.freebsd.org (8.14.1/8.14.1) with ESMTP id m490q1IB024914
	for <perforce@freebsd.org>; Fri, 9 May 2008 00:52:01 GMT
	(envelope-from wsalamon@computer.org)
Received: (from perforce@localhost)
	by repoman.freebsd.org (8.14.1/8.14.1/Submit) id m490q16u024912
	for perforce@freebsd.org; Fri, 9 May 2008 00:52:01 GMT
	(envelope-from wsalamon@computer.org)
Date: Fri, 9 May 2008 00:52:01 GMT
Message-Id: <200805090052.m490q16u024912@repoman.freebsd.org>
X-Authentication-Warning: repoman.freebsd.org: perforce set sender to
	wsalamon@computer.org using -f
From: Wayne Salamon <wsalamon@FreeBSD.org>
To: Perforce Change Reviews <perforce@freebsd.org>
Cc: 
Subject: PERFORCE change 141347 for review
X-BeenThere: p4-projects@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: p4 projects tree changes <p4-projects.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/p4-projects>,
	<mailto:p4-projects-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/p4-projects>
List-Post: <mailto:p4-projects@freebsd.org>
List-Help: <mailto:p4-projects-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/p4-projects>,
	<mailto:p4-projects-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 09 May 2008 00:52:02 -0000

http://perforce.freebsd.org/chv.cgi?CH=141347

Change 141347 by wsalamon@vh2 on 2008/05/09 00:52:00

	Add/move some defines needed for MAC/Audit interplay.

Affected files ...

.. //depot/projects/trustedbsd/audit_mac/src/sys/security/audit/audit.h#5 edit
.. //depot/projects/trustedbsd/audit_mac/src/sys/security/mac/mac_policy.h#5 edit

Differences ...

==== //depot/projects/trustedbsd/audit_mac/src/sys/security/audit/audit.h#5 (text) ====

@@ -184,10 +184,6 @@
 void	 audit_thread_free(struct thread *td);
 
 #ifdef MAC
-/* 
- * Arbitrary limit on how much data will be logged by the audit entry points.
- */
-#define MAC_AUDIT_DATA_LIMIT	1024
 
 /*
  * audit_mac_data() is the MAC Framework's entry point to the audit subsystem.

==== //depot/projects/trustedbsd/audit_mac/src/sys/security/mac/mac_policy.h#5 (text+ko) ====

@@ -60,6 +60,7 @@
  * alphabetically.
  */
 #include <sys/acl.h>	/* XXX acl_type_t */
+#include <bsm/audit.h>	/* au_event_t */
 
 struct acl;
 struct auditinfo;
@@ -113,6 +114,20 @@
 typedef void	(*mpo_placeholder_t)(void);
 
 /*
+ * Arbitrary limit on how much data can be logged by the audit entry points.
+ */
+#define	MAC_AUDIT_DATA_LIMIT	1024
+
+/*
+ * Values returned by mac_audit_{pre,post}select. To combine the responses
+ * of the security policies into a single decision,
+ * mac_audit_{pre,post}select() choose the greatest value returned.
+ */
+#define	MAC_AUDIT_DEFAULT	0	/* use system behavior */
+#define	MAC_AUDIT_NO		1	/* force not auditing this event */
+#define	MAC_AUDIT_YES		2	/* force auditing this event */
+
+/*
  * Operations sorted alphabetically by primary object type and then method.
  */
 typedef int	(*mpo_audit_check_preselect_t)(struct ucred *cred,