summaryrefslogtreecommitdiff
path: root/sys
diff options
context:
space:
mode:
authorelad <elad@NetBSD.org>2009-10-03 01:46:39 +0000
committerelad <elad@NetBSD.org>2009-10-03 01:46:39 +0000
commitcee5cd7dd4401977e4bdbfa687aa4804d130e709 (patch)
treeee2b3320300d826290f5967b5ccb64fa201ecb76 /sys
parent111de3833c910e3421698e61dee837d31b8bf6a1 (diff)
Move default network interface policy back to the subsystem.
Diffstat (limited to 'sys')
-rw-r--r--sys/net/if.c29
-rw-r--r--sys/secmodel/suser/secmodel_suser.c9
2 files changed, 29 insertions, 9 deletions
diff --git a/sys/net/if.c b/sys/net/if.c
index 062cc4542b2..4486f295ff7 100644
--- a/sys/net/if.c
+++ b/sys/net/if.c
@@ -1,4 +1,4 @@
-/* $NetBSD: if.c,v 1.238 2009/09/19 11:02:07 skrll Exp $ */
+/* $NetBSD: if.c,v 1.239 2009/10/03 01:46:39 elad Exp $ */
/*-
* Copyright (c) 1999, 2000, 2001, 2008 The NetBSD Foundation, Inc.
@@ -90,7 +90,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if.c,v 1.238 2009/09/19 11:02:07 skrll Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if.c,v 1.239 2009/10/03 01:46:39 elad Exp $");
#include "opt_inet.h"
@@ -166,6 +166,8 @@ static kmutex_t index_gen_mtx;
struct pfil_head if_pfil; /* packet filtering hook for interfaces */
#endif
+static kauth_listener_t if_listener;
+
static void if_detach_queues(struct ifnet *, struct ifqueue *);
static void sysctl_sndq_setup(struct sysctllog **, const char *,
struct ifaltq *);
@@ -173,6 +175,26 @@ static void sysctl_sndq_setup(struct sysctllog **, const char *,
static void sysctl_net_ifq_setup(struct sysctllog **, int, const char *,
int, const char *, int, struct ifqueue *);
+static int
+if_listener_cb(kauth_cred_t cred, kauth_action_t action, void *cookie,
+ void *arg0, void *arg1, void *arg2, void *arg3)
+{
+ int result;
+ enum kauth_network_req req;
+
+ result = KAUTH_RESULT_DEFER;
+ req = (enum kauth_network_req)arg1;
+
+ if (action != KAUTH_NETWORK_INTERFACE)
+ return result;
+
+ if ((req == KAUTH_REQ_NETWORK_INTERFACE_GET) ||
+ (req == KAUTH_REQ_NETWORK_INTERFACE_SET))
+ result = KAUTH_RESULT_ALLOW;
+
+ return result;
+}
+
/*
* Network interface utility routines.
*
@@ -195,6 +217,9 @@ ifinit(void)
callout_init(&if_slowtimo_ch, 0);
if_slowtimo(NULL);
+
+ if_listener = kauth_listen_scope(KAUTH_SCOPE_NETWORK,
+ if_listener_cb, NULL);
}
/*
diff --git a/sys/secmodel/suser/secmodel_suser.c b/sys/secmodel/suser/secmodel_suser.c
index 6ac9c2588f4..bff736280c7 100644
--- a/sys/secmodel/suser/secmodel_suser.c
+++ b/sys/secmodel/suser/secmodel_suser.c
@@ -1,4 +1,4 @@
-/* $NetBSD: secmodel_suser.c,v 1.19 2009/10/03 01:41:39 elad Exp $ */
+/* $NetBSD: secmodel_suser.c,v 1.20 2009/10/03 01:46:39 elad Exp $ */
/*-
* Copyright (c) 2006 Elad Efrat <elad@NetBSD.org>
* All rights reserved.
@@ -38,7 +38,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: secmodel_suser.c,v 1.19 2009/10/03 01:41:39 elad Exp $");
+__KERNEL_RCSID(0, "$NetBSD: secmodel_suser.c,v 1.20 2009/10/03 01:46:39 elad Exp $");
#include <sys/types.h>
#include <sys/param.h>
@@ -717,11 +717,6 @@ secmodel_suser_network_cb(kauth_cred_t cred, kauth_action_t action,
case KAUTH_NETWORK_INTERFACE:
switch (req) {
- case KAUTH_REQ_NETWORK_INTERFACE_GET:
- case KAUTH_REQ_NETWORK_INTERFACE_SET:
- result = KAUTH_RESULT_ALLOW;
- break;
-
case KAUTH_REQ_NETWORK_INTERFACE_GETPRIV:
case KAUTH_REQ_NETWORK_INTERFACE_SETPRIV:
if (isroot)