From owner-p4-projects@FreeBSD.ORG Fri Jul 9 17:31:49 2004 Return-Path: Delivered-To: p4-projects@freebsd.org Received: by hub.freebsd.org (Postfix, from userid 32767) id 6D2CD16A4DF; Fri, 9 Jul 2004 17:31:48 +0000 (GMT) Delivered-To: perforce@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id BBEF416A50E for ; Fri, 9 Jul 2004 17:31:46 +0000 (GMT) Received: from repoman.freebsd.org (repoman.freebsd.org [216.136.204.115]) by mx1.FreeBSD.org (Postfix) with ESMTP id ED9F543D3F for ; Fri, 9 Jul 2004 17:31:45 +0000 (GMT) (envelope-from bb+lists.freebsd.perforce@cyrus.watson.org) Received: from repoman.freebsd.org (localhost [127.0.0.1]) by repoman.freebsd.org (8.12.11/8.12.11) with ESMTP id i69HVjEE066020 for ; Fri, 9 Jul 2004 17:31:45 GMT (envelope-from bb+lists.freebsd.perforce@cyrus.watson.org) Received: (from perforce@localhost) by repoman.freebsd.org (8.12.11/8.12.11/Submit) id i69HVj1t066001 for perforce@freebsd.org; Fri, 9 Jul 2004 17:31:45 GMT (envelope-from bb+lists.freebsd.perforce@cyrus.watson.org) Date: Fri, 9 Jul 2004 17:31:45 GMT Message-Id: <200407091731.i69HVj1t066001@repoman.freebsd.org> X-Authentication-Warning: repoman.freebsd.org: perforce set sender to bb+lists.freebsd.perforce@cyrus.watson.org using -f From: Robert Watson To: Perforce Change Reviews Subject: PERFORCE change 56905 for review X-BeenThere: p4-projects@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: p4 projects tree changes List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 Jul 2004 17:31:49 -0000 http://perforce.freebsd.org/chv.cgi?CH=56905 Change 56905 by rwatson@rwatson_tislabs on 2004/07/09 17:31:05 Comment consistency and fleshing out. Affected files ... .. //depot/projects/trustedbsd/mac/sys/sys/mac_policy.h#211 edit Differences ... ==== //depot/projects/trustedbsd/mac/sys/sys/mac_policy.h#211 (text+ko) ==== @@ -83,9 +83,9 @@ void (*mpo_init)(struct mac_policy_conf *mpc); /* - * General policy-directed security system call so that policies - * may implement new services without reserving explicit - * system call numbers. + * General policy-directed security system call so that policies may + * implement new services without reserving explicit system call + * numbers. */ int (*mpo_syscall)(struct thread *td, int call, void *arg); @@ -231,7 +231,7 @@ struct label *pipelabel); /* - * Labeling event operations: System V IPC primitives + * Labeling event operations: System V IPC primitives. */ void (*mpo_create_ipc_msgmsg)(struct ucred *cred, struct msqid_kernel *msqkptr, @@ -563,6 +563,14 @@ struct label *label); }; +/* + * struct mac_policy_conf is the registration structure for policies, and is + * provided to the MAC Framework using MAC_POLICY_SET() to invoke a SYSINIT + * to register the policy. In general, the fields are immutable, with the + * exception of the "security field", run-time flags, and policy list entry, + * which are managed by the MAC Framework. Be careful when modifying this + * structure, as its layout is statically compiled into all policies. + */ struct mac_policy_conf { char *mpc_name; /* policy name */ char *mpc_fullname; /* policy full name */