From owner-svn-src-head@freebsd.org Thu Aug 6 00:23:07 2020 Return-Path: Delivered-To: svn-src-head@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 010823ACE64; Thu, 6 Aug 2020 00:23:06 +0000 (UTC) (envelope-from mjg@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4BMTjQ669Wz4R3V; Thu, 6 Aug 2020 00:23:06 +0000 (UTC) (envelope-from mjg@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id B43DA1E91F; Thu, 6 Aug 2020 00:23:06 +0000 (UTC) (envelope-from mjg@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id 0760N6Cn065194; Thu, 6 Aug 2020 00:23:06 GMT (envelope-from mjg@FreeBSD.org) Received: (from mjg@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id 0760N6Nb065193; Thu, 6 Aug 2020 00:23:06 GMT (envelope-from mjg@FreeBSD.org) Message-Id: <202008060023.0760N6Nb065193@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: mjg set sender to mjg@FreeBSD.org using -f From: Mateusz Guzik Date: Thu, 6 Aug 2020 00:23:06 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r363935 - head/sys/security/mac X-SVN-Group: head X-SVN-Commit-Author: mjg X-SVN-Commit-Paths: head/sys/security/mac X-SVN-Commit-Revision: 363935 X-SVN-Commit-Repository: base MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-head@freebsd.org X-Mailman-Version: 2.1.33 Precedence: list List-Id: SVN commit messages for the src tree for head/-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 06 Aug 2020 00:23:07 -0000 Author: mjg Date: Thu Aug 6 00:23:06 2020 New Revision: 363935 URL: https://svnweb.freebsd.org/changeset/base/363935 Log: mac: even up all entry points to the same scheme - use a macro for checking whether the site is enabled - expand it to 0 if mac is not compiled in to begin with Modified: head/sys/security/mac/mac_framework.h Modified: head/sys/security/mac/mac_framework.h ============================================================================== --- head/sys/security/mac/mac_framework.h Wed Aug 5 22:09:57 2020 (r363934) +++ head/sys/security/mac/mac_framework.h Thu Aug 6 00:23:06 2020 (r363935) @@ -264,11 +264,12 @@ extern bool mac_priv_check_fp_flag; #else #define mac_priv_check_fp_flag 0 #endif +#define mac_priv_check_enabled() __predict_false(mac_priv_check_fp_flag) static inline int mac_priv_check(struct ucred *cred, int priv) { - if (__predict_false(mac_priv_check_fp_flag)) + if (mac_priv_check_enabled()) return (mac_priv_check_impl(cred, priv)); return (0); } @@ -279,11 +280,12 @@ extern bool mac_priv_grant_fp_flag; #else #define mac_priv_grant_fp_flag 0 #endif +#define mac_priv_grant_enabled() __predict_false(mac_priv_grant_fp_flag) static inline int mac_priv_grant(struct ucred *cred, int priv) { - if (__predict_false(mac_priv_grant_fp_flag)) + if (mac_priv_grant_enabled()) return (mac_priv_grant_impl(cred, priv)); return (EPERM); } @@ -441,7 +443,11 @@ int mac_vnode_check_listextattr(struct ucred *cred, st int mac_vnode_check_lookup_impl(struct ucred *cred, struct vnode *dvp, struct componentname *cnp); +#ifdef MAC extern bool mac_vnode_check_lookup_fp_flag; +#else +#define mac_vnode_check_lookup_fp_flag 0 +#endif #define mac_vnode_check_lookup_enabled() __predict_false(mac_vnode_check_lookup_fp_flag) static inline int mac_vnode_check_lookup(struct ucred *cred, struct vnode *dvp, @@ -456,28 +462,38 @@ mac_vnode_check_lookup(struct ucred *cred, struct vnod int mac_vnode_check_mmap_impl(struct ucred *cred, struct vnode *vp, int prot, int flags); +#ifdef MAC extern bool mac_vnode_check_mmap_fp_flag; +#else +#define mac_vnode_check_mmap_fp_flag 0 +#endif +#define mac_vnode_check_mmap_enabled() __predict_false(mac_vnode_check_mmap_fp_flag) static inline int mac_vnode_check_mmap(struct ucred *cred, struct vnode *vp, int prot, int flags) { mac_vnode_assert_locked(vp, "mac_vnode_check_mmap"); - if (__predict_false(mac_vnode_check_mmap_fp_flag)) + if (mac_vnode_check_mmap_enabled()) return (mac_vnode_check_mmap_impl(cred, vp, prot, flags)); return (0); } int mac_vnode_check_open_impl(struct ucred *cred, struct vnode *vp, accmode_t accmode); +#ifdef MAC extern bool mac_vnode_check_open_fp_flag; +#else +#define mac_vnode_check_open_fp_flag 0 +#endif +#define mac_vnode_check_open_enabled() __predict_false(mac_vnode_check_open_fp_flag) static inline int mac_vnode_check_open(struct ucred *cred, struct vnode *vp, accmode_t accmode) { mac_vnode_assert_locked(vp, "mac_vnode_check_open"); - if (__predict_false(mac_vnode_check_open_fp_flag)) + if (mac_vnode_check_open_enabled()) return (mac_vnode_check_open_impl(cred, vp, accmode)); return (0); } @@ -526,42 +542,57 @@ int mac_vnode_check_setutimes(struct ucred *cred, stru int mac_vnode_check_stat_impl(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp); +#ifdef MAC extern bool mac_vnode_check_stat_fp_flag; +#else +#define mac_vnode_check_stat_fp_flag 0 +#endif +#define mac_vnode_check_stat_enabled() __predict_false(mac_vnode_check_stat_fp_flag) static inline int mac_vnode_check_stat(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp) { mac_vnode_assert_locked(vp, "mac_vnode_check_stat"); - if (__predict_false(mac_vnode_check_stat_fp_flag)) + if (mac_vnode_check_stat_enabled()) return (mac_vnode_check_stat_impl(active_cred, file_cred, vp)); return (0); } int mac_vnode_check_read_impl(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp); +#ifdef MAC extern bool mac_vnode_check_read_fp_flag; +#else +#define mac_vnode_check_read_fp_flag 0 +#endif +#define mac_vnode_check_read_enabled() __predict_false(mac_vnode_check_read_fp_flag) static inline int mac_vnode_check_read(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp) { mac_vnode_assert_locked(vp, "mac_vnode_check_read"); - if (__predict_false(mac_vnode_check_read_fp_flag)) + if (mac_vnode_check_read_enabled()) return (mac_vnode_check_read_impl(active_cred, file_cred, vp)); return (0); } int mac_vnode_check_write_impl(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp); +#ifdef MAC extern bool mac_vnode_check_write_fp_flag; +#else +#define mac_vnode_check_write_fp_flag 0 +#endif +#define mac_vnode_check_write_enabled() __predict_false(mac_vnode_check_write_fp_flag) static inline int mac_vnode_check_write(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp) { mac_vnode_assert_locked(vp, "mac_vnode_check_write"); - if (__predict_false(mac_vnode_check_write_fp_flag)) + if (mac_vnode_check_write_enabled()) return (mac_vnode_check_write_impl(active_cred, file_cred, vp)); return (0); }