Page MenuHomeFreeBSD
Differential D20967 Diff 60510 sys/security/mac/mac_inet.c

Changeset View

Standalone View

View Options

sys/security/mac/mac_inet.c

Show First 20 Lines • Show All 102 Lines • ▼ Show 20 Lines if (mac_labeled & MPC_OBJECT_INPCB) {
inp->inp_label = mac_inpcb_label_alloc(flag); inp->inp_label = mac_inpcb_label_alloc(flag);
if (inp->inp_label == NULL) if (inp->inp_label == NULL)
return (ENOMEM); return (ENOMEM);
} else } else
inp->inp_label = NULL; inp->inp_label = NULL;
return (0); return (0);
} }
/* Check with rules in module if the IPv4 address is allowed. */
int
mac_inet_check_SIOCAIFADDR(struct ucred *cred, const struct in_addr *ia,
melifaroUnsubmitted
Done
Inline Actions

I'd suggest naming it something like mac_inet_check_add_addr() for the following reasons:

  1. there are 2 entry points for adding the addresses - it's ioctl and netlink & the code will be changed to call business logic from both, instead of netlink calling ioctl.
  2. SIOCAIFADDR is hardly readable and you have to have some domain knowledge of the ioctl code to understand what it actually means.
  3. it will be consistent with other function names
melifaro: I'd suggest naming it something like `mac_inet_check_add_addr()` for the following reasons: 1)…
struct ifnet *ifp)
{
int error;
MAC_POLICY_CHECK(ip4_check_jail, cred, ia, ifp);
return (error);
}
static struct label * static struct label *
mac_ipq_label_alloc(int flag) mac_ipq_label_alloc(int flag)
{ {
struct label *label; struct label *label;
int error; int error;
label = mac_labelzone_alloc(flag); label = mac_labelzone_alloc(flag);
if (label == NULL) if (label == NULL)
▲ Show 20 Lines • Show All 391 Lines • Show Last 20 Lines