Skip site navigation (1)Skip section navigation (2)
Date:      Wed, 13 Sep 2006 14:07:39 GMT
From:      Robert Watson <rwatson@FreeBSD.org>
To:        Perforce Change Reviews <perforce@freebsd.org>
Subject:   PERFORCE change 106058 for review
Message-ID:  <200609131407.k8DE7d7i005897@repoman.freebsd.org>

next in thread | raw e-mail | index | archive | help
http://perforce.freebsd.org/chv.cgi?CH=106058

Change 106058 by rwatson@rwatson_peppercorn on 2006/09/13 14:07:12

	Annotate that there's some functional duplication between the MAC
	system checks and privilege checks, so we might want to do some
	pruning.

Affected files ...

.. //depot/projects/trustedbsd/priv/sys/security/mac/mac_system.c#3 edit

Differences ...

==== //depot/projects/trustedbsd/priv/sys/security/mac/mac_system.c#3 (text+ko) ====

@@ -59,6 +59,12 @@
     &mac_enforce_system, 0, "Enforce MAC policy on system operations");
 TUNABLE_INT("security.mac.enforce_system", &mac_enforce_system);
 
+/*
+ * XXXRW: Some of these checks now duplicate privilege checks.  However,
+ * others provide additional security context that may be useful to policies.
+ * We need to review these and remove ones that are pure duplicates.
+ */
+
 int
 mac_check_kenv_dump(struct ucred *cred)
 {



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200609131407.k8DE7d7i005897>