diff options
| author | elad <elad@NetBSD.org> | 2009-10-03 01:46:39 +0000 |
|---|---|---|
| committer | elad <elad@NetBSD.org> | 2009-10-03 01:46:39 +0000 |
| commit | cee5cd7dd4401977e4bdbfa687aa4804d130e709 (patch) | |
| tree | ee2b3320300d826290f5967b5ccb64fa201ecb76 /sys | |
| parent | 111de3833c910e3421698e61dee837d31b8bf6a1 (diff) | |
Move default network interface policy back to the subsystem.
Diffstat (limited to 'sys')
| -rw-r--r-- | sys/net/if.c | 29 | ||||
| -rw-r--r-- | sys/secmodel/suser/secmodel_suser.c | 9 |
2 files changed, 29 insertions, 9 deletions
diff --git a/sys/net/if.c b/sys/net/if.c index 062cc4542b2..4486f295ff7 100644 --- a/sys/net/if.c +++ b/sys/net/if.c @@ -1,4 +1,4 @@ -/* $NetBSD: if.c,v 1.238 2009/09/19 11:02:07 skrll Exp $ */ +/* $NetBSD: if.c,v 1.239 2009/10/03 01:46:39 elad Exp $ */ /*- * Copyright (c) 1999, 2000, 2001, 2008 The NetBSD Foundation, Inc. @@ -90,7 +90,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: if.c,v 1.238 2009/09/19 11:02:07 skrll Exp $"); +__KERNEL_RCSID(0, "$NetBSD: if.c,v 1.239 2009/10/03 01:46:39 elad Exp $"); #include "opt_inet.h" @@ -166,6 +166,8 @@ static kmutex_t index_gen_mtx; struct pfil_head if_pfil; /* packet filtering hook for interfaces */ #endif +static kauth_listener_t if_listener; + static void if_detach_queues(struct ifnet *, struct ifqueue *); static void sysctl_sndq_setup(struct sysctllog **, const char *, struct ifaltq *); @@ -173,6 +175,26 @@ static void sysctl_sndq_setup(struct sysctllog **, const char *, static void sysctl_net_ifq_setup(struct sysctllog **, int, const char *, int, const char *, int, struct ifqueue *); +static int +if_listener_cb(kauth_cred_t cred, kauth_action_t action, void *cookie, + void *arg0, void *arg1, void *arg2, void *arg3) +{ + int result; + enum kauth_network_req req; + + result = KAUTH_RESULT_DEFER; + req = (enum kauth_network_req)arg1; + + if (action != KAUTH_NETWORK_INTERFACE) + return result; + + if ((req == KAUTH_REQ_NETWORK_INTERFACE_GET) || + (req == KAUTH_REQ_NETWORK_INTERFACE_SET)) + result = KAUTH_RESULT_ALLOW; + + return result; +} + /* * Network interface utility routines. * @@ -195,6 +217,9 @@ ifinit(void) callout_init(&if_slowtimo_ch, 0); if_slowtimo(NULL); + + if_listener = kauth_listen_scope(KAUTH_SCOPE_NETWORK, + if_listener_cb, NULL); } /* diff --git a/sys/secmodel/suser/secmodel_suser.c b/sys/secmodel/suser/secmodel_suser.c index 6ac9c2588f4..bff736280c7 100644 --- a/sys/secmodel/suser/secmodel_suser.c +++ b/sys/secmodel/suser/secmodel_suser.c @@ -1,4 +1,4 @@ -/* $NetBSD: secmodel_suser.c,v 1.19 2009/10/03 01:41:39 elad Exp $ */ +/* $NetBSD: secmodel_suser.c,v 1.20 2009/10/03 01:46:39 elad Exp $ */ /*- * Copyright (c) 2006 Elad Efrat <elad@NetBSD.org> * All rights reserved. @@ -38,7 +38,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: secmodel_suser.c,v 1.19 2009/10/03 01:41:39 elad Exp $"); +__KERNEL_RCSID(0, "$NetBSD: secmodel_suser.c,v 1.20 2009/10/03 01:46:39 elad Exp $"); #include <sys/types.h> #include <sys/param.h> @@ -717,11 +717,6 @@ secmodel_suser_network_cb(kauth_cred_t cred, kauth_action_t action, case KAUTH_NETWORK_INTERFACE: switch (req) { - case KAUTH_REQ_NETWORK_INTERFACE_GET: - case KAUTH_REQ_NETWORK_INTERFACE_SET: - result = KAUTH_RESULT_ALLOW; - break; - case KAUTH_REQ_NETWORK_INTERFACE_GETPRIV: case KAUTH_REQ_NETWORK_INTERFACE_SETPRIV: if (isroot) |
