Date: Wed, 13 Sep 2006 14:07:39 GMT From: Robert Watson <rwatson@FreeBSD.org> To: Perforce Change Reviews <perforce@freebsd.org> Subject: PERFORCE change 106058 for review Message-ID: <200609131407.k8DE7d7i005897@repoman.freebsd.org>
next in thread | raw e-mail | index | archive | help
http://perforce.freebsd.org/chv.cgi?CH=106058 Change 106058 by rwatson@rwatson_peppercorn on 2006/09/13 14:07:12 Annotate that there's some functional duplication between the MAC system checks and privilege checks, so we might want to do some pruning. Affected files ... .. //depot/projects/trustedbsd/priv/sys/security/mac/mac_system.c#3 edit Differences ... ==== //depot/projects/trustedbsd/priv/sys/security/mac/mac_system.c#3 (text+ko) ==== @@ -59,6 +59,12 @@ &mac_enforce_system, 0, "Enforce MAC policy on system operations"); TUNABLE_INT("security.mac.enforce_system", &mac_enforce_system); +/* + * XXXRW: Some of these checks now duplicate privilege checks. However, + * others provide additional security context that may be useful to policies. + * We need to review these and remove ones that are pure duplicates. + */ + int mac_check_kenv_dump(struct ucred *cred) {
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200609131407.k8DE7d7i005897>