d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Introduce support for Mandatory Access Control and extensible kernel

Browse Source 
access control.

Label process credentials, permitting security information to be
maintained at the granularity of processes and cached credential
objects.  cr_label follows the semantics of other entries in struct
ucred: when a credential is exclusively referenced, it may be
modified.  Otherwise, it must be treated as immutable.  As with
other interesting entries in struct ucred, failing to use the
documented credential management APIs (such as crcopy, crdup, ...)
can result in data corruption or incorrect behavior.

Obtained from:	TrustedBSD Project
Sponsored by:	DARPA, NAI Labs
This commit is contained in:
Robert Watson 2002-07-30 22:28:28 +00:00
parent 3b2e600940
commit fae89e29b1
1 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
sys/sys/ucred.h
View File

@ -37,6 +37,14 @@
#ifndef _SYS_UCRED_H_
#define _SYS_UCRED_H_
/*
* XXXMAC: Recursively include mac.h due to an API assumption that it
* it is sufficient to include types.h and ucred.h to have a defined
* struct ucred. This should be changed so that struct ucred is not
* exported to userland via _KERNEL.
*/
#include <sys/mac.h>
/*
* Credentials.
*
@ -56,7 +64,8 @@ struct ucred {
struct uidinfo *cr_uidinfo; /* per euid resource consumption */
struct uidinfo *cr_ruidinfo; /* per ruid resource consumption */
struct prison *cr_prison; /* jail(4) */
#define cr_endcopy cr_mtxp
#define cr_endcopy cr_label
struct label cr_label; /* MAC label */
struct mtx *cr_mtxp; /* protect refcount */
};
#define NOCRED ((struct ucred *)0) /* no credential available */