d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Additional comments regarding the interaction between the kernel privilege

Browse Source 
model and the MAC Framework.

Obtained from:	TrustedBSD Project
This commit is contained in:
Robert Watson 2006-12-20 23:15:27 +00:00
parent e678cce940
commit 23c3d46ae8
1 changed files with 18 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
sys/security/mac/mac_priv.c
View File

@ -43,6 +43,20 @@
#include <security/mac/mac_framework.h> #include <security/mac/mac_framework.h>
#include <security/mac/mac_internal.h> #include <security/mac/mac_internal.h>
/*
* The MAC Framework interacts with kernel privilege checks in two ways: it
* may restrict the granting of privilege to a subject, and it may grant
* additional privileges to the subject. Policies may implement none, one,
* or both of these entry points. Restriction of privilege by any policy
* always overrides granting of privilege by any policy or other privilege
* mechanism. See kern_priv.c:priv_check_cred() for details of the
* composition.
*/
/*
* Restrict access to a privilege for a credential. Return failure if any
* policy denies access.
*/
int int
mac_priv_check(struct ucred *cred, int priv) mac_priv_check(struct ucred *cred, int priv)
{ {
@ -53,6 +67,10 @@ mac_priv_check(struct ucred *cred, int priv)
return (error); return (error);
} }
/*
* Grant access to a privilege for a credential. Return success if any
* policy grants access.
*/
int int
mac_priv_grant(struct ucred *cred, int priv) mac_priv_grant(struct ucred *cred, int priv)
{ {