From owner-p4-projects@FreeBSD.ORG Thu Aug 21 18:02:21 2008 Return-Path: Delivered-To: p4-projects@freebsd.org Received: by hub.freebsd.org (Postfix, from userid 32767) id 981221065671; Thu, 21 Aug 2008 18:02:21 +0000 (UTC) Delivered-To: perforce@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 5D94F106566B for ; Thu, 21 Aug 2008 18:02:21 +0000 (UTC) (envelope-from bb+lists.freebsd.perforce@cyrus.watson.org) Received: from repoman.freebsd.org (repoman.freebsd.org [IPv6:2001:4f8:fff6::29]) by mx1.freebsd.org (Postfix) with ESMTP id 481E08FC24 for ; Thu, 21 Aug 2008 18:02:21 +0000 (UTC) (envelope-from bb+lists.freebsd.perforce@cyrus.watson.org) Received: from repoman.freebsd.org (localhost [127.0.0.1]) by repoman.freebsd.org (8.14.2/8.14.2) with ESMTP id m7LI2LpL074356 for ; Thu, 21 Aug 2008 18:02:21 GMT (envelope-from bb+lists.freebsd.perforce@cyrus.watson.org) Received: (from perforce@localhost) by repoman.freebsd.org (8.14.2/8.14.1/Submit) id m7LI2LXS074354 for perforce@freebsd.org; Thu, 21 Aug 2008 18:02:21 GMT (envelope-from bb+lists.freebsd.perforce@cyrus.watson.org) Date: Thu, 21 Aug 2008 18:02:21 GMT Message-Id: <200808211802.m7LI2LXS074354@repoman.freebsd.org> X-Authentication-Warning: repoman.freebsd.org: perforce set sender to bb+lists.freebsd.perforce@cyrus.watson.org using -f From: Robert Watson To: Perforce Change Reviews Cc: Subject: PERFORCE change 148019 for review X-BeenThere: p4-projects@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: p4 projects tree changes List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 21 Aug 2008 18:02:22 -0000 http://perforce.freebsd.org/chv.cgi?CH=148019 Change 148019 by rwatson@rwatson_freebsd_capabilities on 2008/08/21 18:01:42 Allow building a kernel without options CAPABILITIES by providing some no-op stubs. Affected files ... .. //depot/projects/trustedbsd/capabilities/src/sys/conf/files#8 edit .. //depot/projects/trustedbsd/capabilities/src/sys/kern/sys_capability.c#17 edit Differences ... ==== //depot/projects/trustedbsd/capabilities/src/sys/conf/files#8 (text+ko) ==== @@ -1650,7 +1650,7 @@ kern/subr_turnstile.c standard kern/subr_unit.c standard kern/subr_witness.c optional witness -kern/sys_capability.c optional capabilities +kern/sys_capability.c standard kern/sys_generic.c standard kern/sys_pipe.c standard kern/sys_process.c standard ==== //depot/projects/trustedbsd/capabilities/src/sys/kern/sys_capability.c#17 (text+ko) ==== @@ -40,8 +40,10 @@ * XXXRW: See the global TODO for things that need to be done. */ +#include "opt_capabilities.h" + #include -__FBSDID("$P4: //depot/projects/trustedbsd/capabilities/src/sys/kern/sys_capability.c#16 $"); +__FBSDID("$P4: //depot/projects/trustedbsd/capabilities/src/sys/kern/sys_capability.c#17 $"); #include #include @@ -52,11 +54,14 @@ #include #include #include +#include #include #include #include +#ifdef CAPABILITIES + /* * struct capability describes a capability, and is hung off of its struct * file f_data field. cap_file and cap_rightss are static once hooked up, as @@ -111,6 +116,14 @@ static uma_zone_t capability_zone; +/* + * We don't currently have any MIB entries for sysctls, but we do expose + * security.capabilities so that it's easy to tell if options CAPABILITIES is + * compiled into the kernel. + */ +SYSCTL_NODE(_security, OID_AUTO, capabilities, CTLFLAG_RW, 0, + "TrustedBSD Capabilities controls"); + static void capability_init(void *dummy __unused) { @@ -383,3 +396,50 @@ panic("capability_stat"); } + +#else /* !CAPABILITIES */ + +/* + * Stub Capability functions for when options CAPABILITIES isn't compiled + * into the kernel. + */ +int +cap_fextract(struct file *fp_cap, cap_rights_t rights, struct file **fpp) +{ + + KASSERT(fp_cap->f_type != DTYPE_CAPABILITY, + ("cap_fextract: saw capability")); + + *fpp = fp_cap; + return (0); +} + +int +cap_enter(struct thread *td, struct cap_enter_args *uap) +{ + + return (ENOSYS); +} + +int +cap_getmode(struct thread *td, struct cap_getmode_args *uap) +{ + + return (ENOSYS); +} + +int +cap_new(struct thread *td, struct cap_new_args *uap) +{ + + return (ENOSYS); +} + +int +cap_getrights(struct thread *td, struct cap_getrights_args *uap) +{ + + return (ENOSYS); +} + +#endif /* CAPABILITIES */