summaryrefslogtreecommitdiff
path: root/sys/secmodel/securelevel/secmodel_securelevel.c
diff options
context:
space:
mode:
authortls <tls@NetBSD.org>2011-11-23 10:47:48 +0000
committertls <tls@NetBSD.org>2011-11-23 10:47:48 +0000
commit10a243e2d2c09917c7265ba5f68bd639d2f8efcd (patch)
tree41ed342b4e34a10af837da66338ac0a970562b14 /sys/secmodel/securelevel/secmodel_securelevel.c
parent6005d6624db60e54143b23963aadce58a9e422b9 (diff)
Load entropy at system boot (only works at securelevel < 1); save
at system shutdown. Disable with random_seed=NO in rc.conf if desired. Goes to some trouble to never load or save to network filesystems. Entropy should really be loaded by the boot loader but I am still sorting out how to pass it to the kernel.
Diffstat (limited to 'sys/secmodel/securelevel/secmodel_securelevel.c')
-rw-r--r--sys/secmodel/securelevel/secmodel_securelevel.c9
1 files changed, 7 insertions, 2 deletions
diff --git a/sys/secmodel/securelevel/secmodel_securelevel.c b/sys/secmodel/securelevel/secmodel_securelevel.c
index 47d38f51f4f..9d372350112 100644
--- a/sys/secmodel/securelevel/secmodel_securelevel.c
+++ b/sys/secmodel/securelevel/secmodel_securelevel.c
@@ -1,4 +1,4 @@
-/* $NetBSD: secmodel_securelevel.c,v 1.20 2009/10/07 01:06:57 elad Exp $ */
+/* $NetBSD: secmodel_securelevel.c,v 1.21 2011/11/23 10:47:48 tls Exp $ */
/*-
* Copyright (c) 2006 Elad Efrat <elad@NetBSD.org>
* All rights reserved.
@@ -35,7 +35,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: secmodel_securelevel.c,v 1.20 2009/10/07 01:06:57 elad Exp $");
+__KERNEL_RCSID(0, "$NetBSD: secmodel_securelevel.c,v 1.21 2011/11/23 10:47:48 tls Exp $");
#ifdef _KERNEL_OPT
#include "opt_insecure.h"
@@ -553,6 +553,11 @@ secmodel_securelevel_device_cb(kauth_cred_t cred, kauth_action_t action,
result = KAUTH_RESULT_DENY;
break;
+ case KAUTH_DEVICE_RND_ADDDATA_ESTIMATE:
+ if (securelevel > 0)
+ result = KAUTH_RESULT_DENY;
+ break;
+
default:
break;
}