PERFORCE change 106058 for review
rwatson at FreeBSD.org
Wed Sep 13 07:07:44 PDT 2006
Change 106058 by rwatson at rwatson_peppercorn on 2006/09/13 14:07:12
Annotate that there's some functional duplication between the MAC
system checks and privilege checks, so we might want to do some
Affected files ...
.. //depot/projects/trustedbsd/priv/sys/security/mac/mac_system.c#3 edit
==== //depot/projects/trustedbsd/priv/sys/security/mac/mac_system.c#3 (text+ko) ====
@@ -59,6 +59,12 @@
&mac_enforce_system, 0, "Enforce MAC policy on system operations");
+ * XXXRW: Some of these checks now duplicate privilege checks. However,
+ * others provide additional security context that may be useful to policies.
+ * We need to review these and remove ones that are pure duplicates.
mac_check_kenv_dump(struct ucred *cred)
More information about the trustedbsd-cvs