Page MenuHomeFreeBSD
Differential D53956

mac_set_fd(3): add support for jail descriptors
ClosedPublic
Actions

Authored by kevans on Nov 27 2025, 6:37 PM.
Tags
None
Referenced Files
Unknown Object (File)
Sun, May 17, 2:11 PM
Unknown Object (File)
Thu, May 14, 9:12 AM
Unknown Object (File)
Thu, May 14, 9:09 AM
Unknown Object (File)
Thu, May 14, 9:09 AM
Unknown Object (File)
Wed, May 13, 10:44 PM
Unknown Object (File)
Wed, May 13, 10:30 PM
Unknown Object (File)
Wed, May 13, 10:25 PM
Unknown Object (File)
Mon, May 11, 3:41 PM
View All 46 Files
Subscribers
imp

Details

Reviewers
csjp
olce
jamie
Group Reviewers
Jails
Commits
rG31c2728185d1: mac_set_fd(3): add support for jail descriptors
Summary

We'll still add an old-fashioned jail param to configure jail MAC
labels, but for testing it's really easy to grab a jaildesc and use
that.

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

kevans created this revision.Nov 27 2025, 6:37 PM
Herald added a subscriber: imp. · View Herald TranscriptNov 27 2025, 6:37 PM
kevans requested review of this revision.Nov 27 2025, 6:37 PM
Harbormaster completed remote builds in B68895: Diff 167198.Nov 27 2025, 6:37 PM
kevans added a parent revision: D53955: jaildesc: add an accessor for the struct prison in a jaildesc.Nov 27 2025, 6:37 PM
kevans added a child revision: D53957: kern: mac: pull mac_label_copyin_string out.
jamie accepted this revision.Dec 2 2025, 4:17 AM
This revision is now accepted and ready to land.Dec 2 2025, 4:17 AM
kevans mentioned this in D53954: [RFC] kern: mac: add various jail MAC hooks.Dec 19 2025, 4:05 AM
olce accepted this revision.Dec 20 2025, 6:54 PM

There is an alloc/free mismatch, see inline comment. Else seems good.

sys/security/mac/mac_syscalls.c
591–592
kevans marked an inline comment as done.Dec 23 2025, 12:20 AM
Closed by commit rG31c2728185d1: mac_set_fd(3): add support for jail descriptors (authored by kevans). · Explain WhyJan 16 2026, 12:24 AM
This revision was automatically updated to reflect the committed changes.
kevans added a commit: rG31c2728185d1: mac_set_fd(3): add support for jail descriptors.

Revision Contents
Changeset List

PathSize
sys/
security/
mac/
5 lines
3 lines
28 lines
44 lines
mac_stub/
1 line
mac_test/
11 lines

Diff 169820

View Options

sys/security/mac/mac_internal.h

Loading...
View Options

sys/security/mac/mac_policy.h

Loading...
View Options

sys/security/mac/mac_prison.c

Loading...
View Options

sys/security/mac/mac_syscalls.c

Loading...
View Options

sys/security/mac_stub/mac_stub.c

Loading...
View Options

sys/security/mac_test/mac_test.c

Loading...