Robert Watson d26dd2d99e When devfs cloning takes place, provide access to the credential of the ... process that caused the clone event to take place for the device driver creating the device. This allows cloned device drivers to adapt the device node based on security aspects of the process, such as the uid, gid, and MAC label. - Add a cred reference to struct cdev, so that when a device node is instantiated as a vnode, the cloning credential can be exposed to MAC. - Add make_dev_cred(), a version of make_dev() that additionally accepts the credential to stick in the struct cdev. Implement it and make_dev() in terms of a back-end make_dev_credv(). - Add a new event handler, dev_clone_cred, which can be registered to receive the credential instead of dev_clone, if desired. - Modify the MAC entry point mac_create_devfs_device() to accept an optional credential pointer (may be NULL), so that MAC policies can inspect and act on the label or other elements of the credential when initializing the skeleton device protections. - Modify tty_pty.c to register clone_dev_cred and invoke make_dev_cred(), so that the pty clone credential is exposed to the MAC Framework. While currently primarily focussed on MAC policies, this change is also a prerequisite for changes to allow ptys to be instantiated with the UID of the process looking up the pty. This requires further changes to the pty driver -- in particular, to immediately recycle pty nodes on last close so that the credential-related state can be recreated on next lookup. Submitted by: Andrew Reisse <andrew.reisse@sparta.com> Obtained from: TrustedBSD Project Sponsored by: SPAWAR, SPARTA MFC after: 1 week MFC note: Merge to 6.x, but not 5.x for ABI reasons		2005-07-14 10:22:09 +00:00
..
mac_framework.c	Get the directory structure correct in a comment.	2005-04-22 19:09:12 +00:00
mac_framework.h	When devfs cloning takes place, provide access to the credential of the	2005-07-14 10:22:09 +00:00
mac_inet.c	Move inet and inet6 related MAC Framework entry points from mac_net.c	2004-02-26 03:51:04 +00:00
mac_internal.h	Remove extern declaration of mac_enforce_sysv, as it's not present in	2004-10-22 11:07:18 +00:00
mac_label.c	In the MAC label zone destructor, assert that the label is only	2004-10-22 11:08:52 +00:00
mac_net.c	Eliminate MAC entry point mac_create_mbuf_from_mbuf(), which is	2005-07-05 23:39:51 +00:00
mac_pipe.c	add missing #include <sys/module.h>	2004-05-30 20:27:19 +00:00
mac_policy.h	When devfs cloning takes place, provide access to the credential of the	2005-07-14 10:22:09 +00:00
mac_posix_sem.c	Introduce MAC Framework and MAC Policy entry points to label and control	2005-05-04 10:39:15 +00:00
mac_process.c	Introduce p_canwait() and MAC Framework and MAC Policy entry points	2005-04-18 13:36:57 +00:00
mac_socket.c	Add MAC Framework and MAC policy entry point mac_check_socket_create(),	2005-07-05 22:49:10 +00:00
mac_syscalls.c	Get the directory structure correct in a comment.	2005-04-22 19:09:12 +00:00
mac_system.c	Correct grammar error in comment	2005-06-10 04:44:38 +00:00
mac_sysv_msg.c	Remove an accidental clearing of the new label pointer on a system V	2005-02-24 16:08:41 +00:00
mac_sysv_sem.c	Gratuitous renaming of four System V Semaphore MAC Framework entry	2005-06-07 05:03:28 +00:00
mac_sysv_shm.c	Implement MAC entry points relating to System V IPC, calling into the	2004-11-17 13:14:24 +00:00
mac_vfs.c	When devfs cloning takes place, provide access to the credential of the	2005-07-14 10:22:09 +00:00