git: ddad09993fdd - stable/15 - MAC/do: Allocate only one default configuration

The branch stable/15 has been updated by olce:

URL: https://cgit.FreeBSD.org/src/commit/?id=ddad09993fdd606d65611afac7fc987339401e80

commit ddad09993fdd606d65611afac7fc987339401e80
Author:     Olivier Certner <olce@FreeBSD.org>
AuthorDate: 2026-04-29 13:12:10 +0000
Commit:     Olivier Certner <olce@FreeBSD.org>
CommitDate: 2026-06-29 19:23:52 +0000

    MAC/do: Allocate only one default configuration
    
    When mac_do(4) is loaded, all jails get the same default configuration
    (disabled, with only one allowed executable path: '/usr/bin/mdo').
    Share it between all jails instead of creating a separate copy for each.
    
    Reviewed by:    bapt
    Fixes:          9818224174c4 ("MAC/do: Executable paths feature (GSoC 2025's final state)")
    MFC after:      1 month
    Sponsored by:   The FreeBSD Foundation
    Pull Request:   https://ron-dev.freebsd.org/FreeBSD/src/pulls/38
    
    (cherry picked from commit 31ef4ee2e3570b8f438b9b3fb09b3d87c87419ff)
---
 sys/security/mac_do/mac_do.c | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/sys/security/mac_do/mac_do.c b/sys/security/mac_do/mac_do.c
index f796e1b5cf76..4ba545ec5a19 100644
--- a/sys/security/mac_do/mac_do.c
+++ b/sys/security/mac_do/mac_do.c
@@ -1360,21 +1360,19 @@ set_conf(struct prison *const pr, struct conf *const conf)
 		drop_conf(old_conf);
 }
 
-/*
- * Assigns the default configuration to a jail.
- */
-static void
-set_default_conf(struct prison *const pr)
+static struct conf *
+new_default_conf(void)
 {
-	struct conf *const conf = new_conf();
+	const char *const mdo_path = "/usr/bin/mdo";
+	struct conf *conf = new_conf();
 
-	strlcpy(conf->exec_paths.exec_paths_str, "/usr/bin/mdo",
+	strlcpy(conf->exec_paths.exec_paths_str, mdo_path,
 	    MAX_EXEC_PATHS_SIZE);
-	strlcpy(conf->exec_paths.exec_paths[0], "/usr/bin/mdo", PATH_MAX);
+	strlcpy(conf->exec_paths.exec_paths[0], mdo_path,
+	    PATH_MAX);
 	conf->exec_paths.exec_path_count = 1;
 
-	set_conf(pr, conf);
-	drop_conf(conf);
+	return (conf);
 }
 
 static void
@@ -2523,14 +2521,16 @@ mac_do_setcred_exit(void)
 static void
 mac_do_init(struct mac_policy_conf *mpc)
 {
+	struct conf *const default_conf = new_default_conf();
 	struct prison *pr;
 
 	osd_jail_slot = osd_jail_register(dealloc_jail_osd, osd_methods);
-	set_default_conf(&prison0);
+	set_conf(&prison0, default_conf);
 	sx_slock(&allprison_lock);
 	TAILQ_FOREACH(pr, &allprison, pr_list)
-	    set_default_conf(pr);
+	    set_conf(pr, default_conf);
 	sx_sunlock(&allprison_lock);
+	drop_conf(default_conf);
 
 	osd_thread_slot = osd_thread_register(dealloc_thread_osd);
 }