From owner-p4-projects  Tue Jan  7  5:28:28 2003
Delivered-To: p4-projects@freebsd.org
Received: by hub.freebsd.org (Postfix, from userid 32767)
	id 04C5637B405; Tue,  7 Jan 2003 05:28:27 -0800 (PST)
Delivered-To: perforce@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id A897637B401
	for <perforce@freebsd.org>; Tue,  7 Jan 2003 05:28:26 -0800 (PST)
Received: from repoman.freebsd.org (repoman.freebsd.org [216.136.204.115])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 6492D43F0A
	for <perforce@freebsd.org>; Tue,  7 Jan 2003 05:28:26 -0800 (PST)
	(envelope-from green@freebsd.org)
Received: from repoman.freebsd.org (localhost [127.0.0.1])
	by repoman.freebsd.org (8.12.6/8.12.6) with ESMTP id h07DSQfh065219
	for <perforce@freebsd.org>; Tue, 7 Jan 2003 05:28:26 -0800 (PST)
	(envelope-from green@freebsd.org)
Received: (from perforce@localhost)
	by repoman.freebsd.org (8.12.6/8.12.6/Submit) id h07DSPvb065216
	for perforce@freebsd.org; Tue, 7 Jan 2003 05:28:25 -0800 (PST)
Date: Tue, 7 Jan 2003 05:28:25 -0800 (PST)
Message-Id: <200301071328.h07DSPvb065216@repoman.freebsd.org>
X-Authentication-Warning: repoman.freebsd.org: perforce set sender to green@freebsd.org using -f
From: Brian Feldman <green@FreeBSD.org>
Subject: PERFORCE change 23337 for review
To: Perforce Change Reviews <perforce@freebsd.org>
Sender: owner-p4-projects@FreeBSD.ORG
Precedence: bulk
List-ID: <p4-projects.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20p4-projects>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20p4-projects>
X-Loop: FreeBSD.ORG

http://perforce.freebsd.org/chv.cgi?CH=23337

Change 23337 by green@green_laptop_2 on 2003/01/07 05:28:08

	Add a tunable (os-dependent, that is) to avc/avc.c which allows
	you to enable enforcement mode from the boot loader.

Affected files ...

.. //depot/projects/trustedbsd/mac/sys/security/sebsd/avc/avc.c#13 edit

Differences ...

==== //depot/projects/trustedbsd/mac/sys/security/sebsd/avc/avc.c#13 (text+ko) ====

@@ -235,6 +235,11 @@
 	if (!avc_audit_buffer)
 		panic("AVC:  unable to allocate audit buffer\n");
 	mtx_init(&avc_lock, "SEBSD AVC", NULL, MTX_DEF);
+	/* The fetch may or may not occur; if not, it doesn't change int *. */
+	avc_debug_always_allow = !avc_debug_always_allow;
+	TUNABLE_INT_FETCH("security.mac.sebsd.enforcing",
+	    &avc_debug_always_allow);
+	avc_debug_always_allow = !avc_debug_always_allow;
 }
 
 /* 

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe p4-projects" in the body of the message