Page MenuHomeFreeBSD
Differential D11357

security/zeronet: Update to 0.5.6
ClosedPublic
Actions

Authored by ultima on Jun 25 2017, 6:07 PM.
Tags
None
Referenced Files
Unknown Object (File)
Tue, Mar 18, 8:51 PM
Unknown Object (File)
Mar 4 2025, 12:43 PM
Unknown Object (File)
Feb 20 2025, 5:21 AM
Unknown Object (File)
Feb 18 2025, 7:04 PM
Unknown Object (File)
Feb 11 2025, 1:14 PM
Unknown Object (File)
Jan 29 2025, 4:59 PM
Unknown Object (File)
Nov 6 2024, 3:03 AM
Unknown Object (File)
Nov 1 2024, 9:41 PM
View All 54 Files
Subscribers
mat

Details

Reviewers
lifanov
matthew
Commits
rP444378: * Updated to 0.5.6
Summary
  • Updated to 0.5.6

Changelog: https://github.com/HelloZeroNet/ZeroNet/releases/tag/v0.5.6

PR\: 220123
Sumitted by\: Yuri Victorovich <yuri@rawbw.com> (maintainer)
Reviewed by\: lifanov (mentor), matthew (mentor)
Approved by\: lifanov (mentor), matthew (mentor)
Differential Revision\: https://reviews.freebsd.org/DXXXXX

Test Plan

portlint:
WARN: Makefile: possible use of absolute pathname "/var/db/zeronet".
WARN: Makefile: possible use of absolute pathname "/var/log/zeronet".
WARN: Makefile: for new port, make $FreeBSD$ tag in comment section empty, to make SVN happy.
0 fatal errors and 3 warnings found.
They are absolute pathnames, but I think they are fine.

poudriere:
103i386
103amd64
110i386
110amd64
12i386
12amd64

These are legitimate symbolic links.
Please disregard the warnings. -Yuri Victorovich
Also opened a bug report, about them. https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=220263

Diff Detail

Repository
rP FreeBSD ports repository
Lint
No Lint Coverage
Unit
No Test Coverage
Build Status
Buildable 10125
Build 10548: arc lint + arc unit

Event Timeline

ultima created this revision.Jun 25 2017, 6:07 PM
Herald added a subscriber: mat. · View Herald TranscriptJun 25 2017, 6:07 PM
Harbormaster completed remote builds in B10125: Diff 30070.Jun 25 2017, 6:07 PM
matthew accepted this revision.Jun 25 2017, 9:12 PM

Apart from the couple of absolute symlinks that the maintainer mentions, this looks fine:

====> Running Q/A tests (stage-qa)
Warning: Bad symlink '/usr/local/share/zeronet/log' pointing to an absolute pathname '/var/log/zeronet'
Warning: Bad symlink '/usr/local/share/zeronet/data' pointing to an absolute pathname '/var/db/zeronet'

However converting those to a relative path ../../../../var/log/zeronet seems a bit ... pedantic.

Apart from that,

lgtm

This revision is now accepted and ready to land.Jun 25 2017, 9:12 PM
lifanov accepted this revision.Jun 26 2017, 12:10 AM

The "/var/db" should be excluded from this test. Maybe instead we should test if a port puts anything in LOCALBASE/var (as, say, prosody does) and error on that.

Closed by commit rP444378: * Updated to 0.5.6 (authored by ultima). · Explain WhyJun 26 2017, 4:49 PM
This revision was automatically updated to reflect the committed changes.

Revision Contents
Changeset List

PathSize
security/
zeronet/
8 lines
6 lines
4 lines

Diff 30070

View Options

security/zeronet/Makefile

Show First 20 Lines • Show All 182 Lines • ▼ Show 20 Lines union {
} vop_args; } vop_args;
} args; } args;
}; };
static int vn_io_fault1(struct vnode *vp, struct uio *uio, static int vn_io_fault1(struct vnode *vp, struct uio *uio,
struct vn_io_fault_args *args, struct thread *td); struct vn_io_fault_args *args, struct thread *td);
int int
vn_open(struct nameidata *ndp, int *flagp, int cmode, struct file *fp) vn_open(struct nameidata *ndp, int *flagp, int cmode, struct file *fp)
kibUnsubmitted
Not Done
Inline Actions

Why do you need this?

For rw it was needed due to the vn_io_fault() structure, for vn_deallocate() it is pointless complication.

kib: Why do you need this? For rw it was needed due to the vn_io_fault() structure, for…
{ {
struct thread *td = ndp->ni_cnd.cn_thread; struct thread *td = ndp->ni_cnd.cn_thread;
return (vn_open_cred(ndp, flagp, cmode, 0, td->td_ucred, fp)); return (vn_open_cred(ndp, flagp, cmode, 0, td->td_ucred, fp));
} }
static uint64_t static uint64_t
open2nameif(int fmode, u_int vn_open_flags) open2nameif(int fmode, u_int vn_open_flags)
▲ Show 20 Lines • Show All 3,260 Lines • ▼ Show 20 Lines#endif
return (error); return (error);
} }
static int static int
vn_deallocate_impl(struct vnode *vp, off_t *offset, off_t *length, int flags, vn_deallocate_impl(struct vnode *vp, off_t *offset, off_t *length, int flags,
int ioflag, struct ucred *active_cred, struct ucred *file_cred) int ioflag, struct ucred *active_cred, struct ucred *file_cred)
{ {
struct ucred *cred;
struct mount *mp; struct mount *mp;
void *rl_cookie; void *rl_cookie;
off_t off, len; off_t off, len;
int error; int error;
#ifdef AUDIT #ifdef AUDIT
bool audited_vnode1 = false; bool audited_vnode1 = false;
#endif #endif
Show All 27 Lines#ifdef AUDIT
} }
#endif #endif
#ifdef MAC #ifdef MAC
if ((ioflag & IO_NOMACCHECK) == 0) if ((ioflag & IO_NOMACCHECK) == 0)
error = mac_vnode_check_write(active_cred, file_cred, error = mac_vnode_check_write(active_cred, file_cred,
vp); vp);
#endif #endif
if (error == 0) if (error == 0) {
if (file_cred != NULL)
cred = file_cred;
else
cred = active_cred;
error = VOP_DEALLOCATE(vp, &off, &len, flags, ioflag, error = VOP_DEALLOCATE(vp, &off, &len, flags, ioflag,
active_cred); cred);
}
if ((ioflag & IO_NODELOCKED) == 0) { if ((ioflag & IO_NODELOCKED) == 0) {
VOP_UNLOCK(vp); VOP_UNLOCK(vp);
if (mp != NULL) { if (mp != NULL) {
vn_finished_write(mp); vn_finished_write(mp);
mp = NULL; mp = NULL;
} }
} }
if (error == 0 && len != 0) if (error == 0 && len != 0)
maybe_yield(); maybe_yield();
} }
out: out:
if (rl_cookie != NULL) if (rl_cookie != NULL)
vn_rangelock_unlock(vp, rl_cookie); vn_rangelock_unlock(vp, rl_cookie);
*offset = off; *offset = off;
*length = len; *length = len;
return (error); return (error);
} }
int int
vn_deallocate(struct vnode *vp, off_t *offset, off_t *length, int flags, vn_deallocate(struct vnode *vp, off_t *offset, off_t *length, int flags,
kibUnsubmitted
Not Done
Inline Actions

When I talked about commenting the use, I mean that it should explain that function is supposed to be used in the situations where the op is not triggered by a user request. In other words, currthread->td_ucred == active_cred is generally not the right credentials to account the operation to.

Your line above just repeats the code.

kib: When I talked about commenting the use, I mean that it should explain that function is supposed…
int ioflag, struct ucred *active_cred, struct ucred *file_cred) int ioflag, struct ucred *active_cred, struct ucred *file_cred)
{ {
if (*offset < 0 || *length <= 0 || *length > OFF_MAX - *offset || if (*offset < 0 || *length <= 0 || *length > OFF_MAX - *offset ||
flags != 0) flags != 0)
return (EINVAL); return (EINVAL);
if (vp->v_type != VREG) if (vp->v_type != VREG)
return (ENODEV); return (ENODEV);
return (vn_deallocate_impl(vp, offset, length, flags, ioflag, return (vn_deallocate_impl(vp, offset, length, flags, ioflag,
active_cred, file_cred)); active_cred, file_cred));
} }
kibUnsubmitted
Done
Inline Actions

cred = file_cred != NOCRED ? file_cred : active_cred;

kib: `cred = file_cred != NOCRED ? file_cred : active_cred;`
static int static int
vn_fspacectl(struct file *fp, int cmd, off_t *offset, off_t *length, int flags, vn_fspacectl(struct file *fp, int cmd, off_t *offset, off_t *length, int flags,
struct ucred *active_cred, struct thread *td) struct ucred *active_cred, struct thread *td)
{ {
int error; int error;
struct vnode *vp; struct vnode *vp;
int ioflag; int ioflag;
vp = fp->f_vnode; vp = fp->f_vnode;
if (cmd != SPACECTL_DEALLOC || *offset < 0 || *length <= 0 || if (cmd != SPACECTL_DEALLOC || *offset < 0 || *length <= 0 ||
*length > OFF_MAX - *offset || flags != 0) *length > OFF_MAX - *offset || flags != 0)
return (EINVAL); return (EINVAL);
if (vp->v_type != VREG) if (vp->v_type != VREG)
return (ENODEV); return (ENODEV);
ioflag = get_write_ioflag(fp); ioflag = get_write_ioflag(fp);
switch (cmd) { switch (cmd) {
case SPACECTL_DEALLOC: case SPACECTL_DEALLOC:
error = vn_deallocate_impl(vp, offset, length, flags, ioflag, error = vn_deallocate_impl(vp, offset, length, flags, ioflag,
active_cred, fp->f_cred); active_cred, fp->f_cred);
kibUnsubmitted
Not Done
Inline Actions

why passing fp->f_cred there at all?
from_fops is ugly and arguably not needed.
vn_deallocate() needs explanation about active_cre/file_cred in a comment, nobody would read man page for this (or in both)

kib: why passing fp->f_cred there at all? from_fops is ugly and arguably not needed. vn_deallocate()…
khngAuthorUnsubmitted
Not Done
Inline Actions

The fp->f_cred was there to for mac_vnode_check_write's policy checking (although all the policy modules in base so far are not taking f_cred into consideration at all).

khng: The fp->f_cred was there to for mac_vnode_check_write's policy checking (although all the…
khngAuthorUnsubmitted
Done
Inline Actions

A mental note to myself: Though mac_vnode_check_write()'s file_cred is not inspected by in base policy module, it is possibly used by outside world to implement capability semantic.

khng: A mental note to myself: Though mac_vnode_check_write()'s file_cred is not inspected by in base…
break; break;
default: default:
panic("vn_fspacectl: unknown cmd %d", cmd); panic("vn_fspacectl: unknown cmd %d", cmd);
} }
return (error); return (error);
} }
▲ Show 20 Lines • Show All 101 Lines • Show Last 20 Lines
View Options

security/zeronet/distinfo

Show First 20 Lines • Show All 182 Lines • ▼ Show 20 Lines union {
} vop_args; } vop_args;
} args; } args;
}; };
static int vn_io_fault1(struct vnode *vp, struct uio *uio, static int vn_io_fault1(struct vnode *vp, struct uio *uio,
struct vn_io_fault_args *args, struct thread *td); struct vn_io_fault_args *args, struct thread *td);
int int
vn_open(struct nameidata *ndp, int *flagp, int cmode, struct file *fp) vn_open(struct nameidata *ndp, int *flagp, int cmode, struct file *fp)
kibUnsubmitted
Not Done
Inline Actions

Why do you need this?

For rw it was needed due to the vn_io_fault() structure, for vn_deallocate() it is pointless complication.

kib: Why do you need this? For rw it was needed due to the vn_io_fault() structure, for…
{ {
struct thread *td = ndp->ni_cnd.cn_thread; struct thread *td = ndp->ni_cnd.cn_thread;
return (vn_open_cred(ndp, flagp, cmode, 0, td->td_ucred, fp)); return (vn_open_cred(ndp, flagp, cmode, 0, td->td_ucred, fp));
} }
static uint64_t static uint64_t
open2nameif(int fmode, u_int vn_open_flags) open2nameif(int fmode, u_int vn_open_flags)
▲ Show 20 Lines • Show All 3,260 Lines • ▼ Show 20 Lines#endif
return (error); return (error);
} }
static int static int
vn_deallocate_impl(struct vnode *vp, off_t *offset, off_t *length, int flags, vn_deallocate_impl(struct vnode *vp, off_t *offset, off_t *length, int flags,
int ioflag, struct ucred *active_cred, struct ucred *file_cred) int ioflag, struct ucred *active_cred, struct ucred *file_cred)
{ {
struct ucred *cred;
struct mount *mp; struct mount *mp;
void *rl_cookie; void *rl_cookie;
off_t off, len; off_t off, len;
int error; int error;
#ifdef AUDIT #ifdef AUDIT
bool audited_vnode1 = false; bool audited_vnode1 = false;
#endif #endif
Show All 27 Lines#ifdef AUDIT
} }
#endif #endif
#ifdef MAC #ifdef MAC
if ((ioflag & IO_NOMACCHECK) == 0) if ((ioflag & IO_NOMACCHECK) == 0)
error = mac_vnode_check_write(active_cred, file_cred, error = mac_vnode_check_write(active_cred, file_cred,
vp); vp);
#endif #endif
if (error == 0) if (error == 0) {
if (file_cred != NULL)
cred = file_cred;
else
cred = active_cred;
error = VOP_DEALLOCATE(vp, &off, &len, flags, ioflag, error = VOP_DEALLOCATE(vp, &off, &len, flags, ioflag,
active_cred); cred);
}
if ((ioflag & IO_NODELOCKED) == 0) { if ((ioflag & IO_NODELOCKED) == 0) {
VOP_UNLOCK(vp); VOP_UNLOCK(vp);
if (mp != NULL) { if (mp != NULL) {
vn_finished_write(mp); vn_finished_write(mp);
mp = NULL; mp = NULL;
} }
} }
if (error == 0 && len != 0) if (error == 0 && len != 0)
maybe_yield(); maybe_yield();
} }
out: out:
if (rl_cookie != NULL) if (rl_cookie != NULL)
vn_rangelock_unlock(vp, rl_cookie); vn_rangelock_unlock(vp, rl_cookie);
*offset = off; *offset = off;
*length = len; *length = len;
return (error); return (error);
} }
int int
vn_deallocate(struct vnode *vp, off_t *offset, off_t *length, int flags, vn_deallocate(struct vnode *vp, off_t *offset, off_t *length, int flags,
kibUnsubmitted
Not Done
Inline Actions

When I talked about commenting the use, I mean that it should explain that function is supposed to be used in the situations where the op is not triggered by a user request. In other words, currthread->td_ucred == active_cred is generally not the right credentials to account the operation to.

Your line above just repeats the code.

kib: When I talked about commenting the use, I mean that it should explain that function is supposed…
int ioflag, struct ucred *active_cred, struct ucred *file_cred) int ioflag, struct ucred *active_cred, struct ucred *file_cred)
{ {
if (*offset < 0 || *length <= 0 || *length > OFF_MAX - *offset || if (*offset < 0 || *length <= 0 || *length > OFF_MAX - *offset ||
flags != 0) flags != 0)
return (EINVAL); return (EINVAL);
if (vp->v_type != VREG) if (vp->v_type != VREG)
return (ENODEV); return (ENODEV);
return (vn_deallocate_impl(vp, offset, length, flags, ioflag, return (vn_deallocate_impl(vp, offset, length, flags, ioflag,
active_cred, file_cred)); active_cred, file_cred));
} }
kibUnsubmitted
Done
Inline Actions

cred = file_cred != NOCRED ? file_cred : active_cred;

kib: `cred = file_cred != NOCRED ? file_cred : active_cred;`
static int static int
vn_fspacectl(struct file *fp, int cmd, off_t *offset, off_t *length, int flags, vn_fspacectl(struct file *fp, int cmd, off_t *offset, off_t *length, int flags,
struct ucred *active_cred, struct thread *td) struct ucred *active_cred, struct thread *td)
{ {
int error; int error;
struct vnode *vp; struct vnode *vp;
int ioflag; int ioflag;
vp = fp->f_vnode; vp = fp->f_vnode;
if (cmd != SPACECTL_DEALLOC || *offset < 0 || *length <= 0 || if (cmd != SPACECTL_DEALLOC || *offset < 0 || *length <= 0 ||
*length > OFF_MAX - *offset || flags != 0) *length > OFF_MAX - *offset || flags != 0)
return (EINVAL); return (EINVAL);
if (vp->v_type != VREG) if (vp->v_type != VREG)
return (ENODEV); return (ENODEV);
ioflag = get_write_ioflag(fp); ioflag = get_write_ioflag(fp);
switch (cmd) { switch (cmd) {
case SPACECTL_DEALLOC: case SPACECTL_DEALLOC:
error = vn_deallocate_impl(vp, offset, length, flags, ioflag, error = vn_deallocate_impl(vp, offset, length, flags, ioflag,
active_cred, fp->f_cred); active_cred, fp->f_cred);
kibUnsubmitted
Not Done
Inline Actions

why passing fp->f_cred there at all?
from_fops is ugly and arguably not needed.
vn_deallocate() needs explanation about active_cre/file_cred in a comment, nobody would read man page for this (or in both)

kib: why passing fp->f_cred there at all? from_fops is ugly and arguably not needed. vn_deallocate()…
khngAuthorUnsubmitted
Not Done
Inline Actions

The fp->f_cred was there to for mac_vnode_check_write's policy checking (although all the policy modules in base so far are not taking f_cred into consideration at all).

khng: The fp->f_cred was there to for mac_vnode_check_write's policy checking (although all the…
khngAuthorUnsubmitted
Done
Inline Actions

A mental note to myself: Though mac_vnode_check_write()'s file_cred is not inspected by in base policy module, it is possibly used by outside world to implement capability semantic.

khng: A mental note to myself: Though mac_vnode_check_write()'s file_cred is not inspected by in base…
break; break;
default: default:
panic("vn_fspacectl: unknown cmd %d", cmd); panic("vn_fspacectl: unknown cmd %d", cmd);
} }
return (error); return (error);
} }
▲ Show 20 Lines • Show All 101 Lines • Show Last 20 Lines
View Options

security/zeronet/pkg-plist

Show First 20 Lines • Show All 182 Lines • ▼ Show 20 Lines union {
} vop_args; } vop_args;
} args; } args;
}; };
static int vn_io_fault1(struct vnode *vp, struct uio *uio, static int vn_io_fault1(struct vnode *vp, struct uio *uio,
struct vn_io_fault_args *args, struct thread *td); struct vn_io_fault_args *args, struct thread *td);
int int
vn_open(struct nameidata *ndp, int *flagp, int cmode, struct file *fp) vn_open(struct nameidata *ndp, int *flagp, int cmode, struct file *fp)
kibUnsubmitted
Not Done
Inline Actions

Why do you need this?

For rw it was needed due to the vn_io_fault() structure, for vn_deallocate() it is pointless complication.

kib: Why do you need this? For rw it was needed due to the vn_io_fault() structure, for…
{ {
struct thread *td = ndp->ni_cnd.cn_thread; struct thread *td = ndp->ni_cnd.cn_thread;
return (vn_open_cred(ndp, flagp, cmode, 0, td->td_ucred, fp)); return (vn_open_cred(ndp, flagp, cmode, 0, td->td_ucred, fp));
} }
static uint64_t static uint64_t
open2nameif(int fmode, u_int vn_open_flags) open2nameif(int fmode, u_int vn_open_flags)
▲ Show 20 Lines • Show All 3,260 Lines • ▼ Show 20 Lines#endif
return (error); return (error);
} }
static int static int
vn_deallocate_impl(struct vnode *vp, off_t *offset, off_t *length, int flags, vn_deallocate_impl(struct vnode *vp, off_t *offset, off_t *length, int flags,
int ioflag, struct ucred *active_cred, struct ucred *file_cred) int ioflag, struct ucred *active_cred, struct ucred *file_cred)
{ {
struct ucred *cred;
struct mount *mp; struct mount *mp;
void *rl_cookie; void *rl_cookie;
off_t off, len; off_t off, len;
int error; int error;
#ifdef AUDIT #ifdef AUDIT
bool audited_vnode1 = false; bool audited_vnode1 = false;
#endif #endif
Show All 27 Lines#ifdef AUDIT
} }
#endif #endif
#ifdef MAC #ifdef MAC
if ((ioflag & IO_NOMACCHECK) == 0) if ((ioflag & IO_NOMACCHECK) == 0)
error = mac_vnode_check_write(active_cred, file_cred, error = mac_vnode_check_write(active_cred, file_cred,
vp); vp);
#endif #endif
if (error == 0) if (error == 0) {
if (file_cred != NULL)
cred = file_cred;
else
cred = active_cred;
error = VOP_DEALLOCATE(vp, &off, &len, flags, ioflag, error = VOP_DEALLOCATE(vp, &off, &len, flags, ioflag,
active_cred); cred);
}
if ((ioflag & IO_NODELOCKED) == 0) { if ((ioflag & IO_NODELOCKED) == 0) {
VOP_UNLOCK(vp); VOP_UNLOCK(vp);
if (mp != NULL) { if (mp != NULL) {
vn_finished_write(mp); vn_finished_write(mp);
mp = NULL; mp = NULL;
} }
} }
if (error == 0 && len != 0) if (error == 0 && len != 0)
maybe_yield(); maybe_yield();
} }
out: out:
if (rl_cookie != NULL) if (rl_cookie != NULL)
vn_rangelock_unlock(vp, rl_cookie); vn_rangelock_unlock(vp, rl_cookie);
*offset = off; *offset = off;
*length = len; *length = len;
return (error); return (error);
} }
int int
vn_deallocate(struct vnode *vp, off_t *offset, off_t *length, int flags, vn_deallocate(struct vnode *vp, off_t *offset, off_t *length, int flags,
kibUnsubmitted
Not Done
Inline Actions

When I talked about commenting the use, I mean that it should explain that function is supposed to be used in the situations where the op is not triggered by a user request. In other words, currthread->td_ucred == active_cred is generally not the right credentials to account the operation to.

Your line above just repeats the code.

kib: When I talked about commenting the use, I mean that it should explain that function is supposed…
int ioflag, struct ucred *active_cred, struct ucred *file_cred) int ioflag, struct ucred *active_cred, struct ucred *file_cred)
{ {
if (*offset < 0 || *length <= 0 || *length > OFF_MAX - *offset || if (*offset < 0 || *length <= 0 || *length > OFF_MAX - *offset ||
flags != 0) flags != 0)
return (EINVAL); return (EINVAL);
if (vp->v_type != VREG) if (vp->v_type != VREG)
return (ENODEV); return (ENODEV);
return (vn_deallocate_impl(vp, offset, length, flags, ioflag, return (vn_deallocate_impl(vp, offset, length, flags, ioflag,
active_cred, file_cred)); active_cred, file_cred));
} }
kibUnsubmitted
Done
Inline Actions

cred = file_cred != NOCRED ? file_cred : active_cred;

kib: `cred = file_cred != NOCRED ? file_cred : active_cred;`
static int static int
vn_fspacectl(struct file *fp, int cmd, off_t *offset, off_t *length, int flags, vn_fspacectl(struct file *fp, int cmd, off_t *offset, off_t *length, int flags,
struct ucred *active_cred, struct thread *td) struct ucred *active_cred, struct thread *td)
{ {
int error; int error;
struct vnode *vp; struct vnode *vp;
int ioflag; int ioflag;
vp = fp->f_vnode; vp = fp->f_vnode;
if (cmd != SPACECTL_DEALLOC || *offset < 0 || *length <= 0 || if (cmd != SPACECTL_DEALLOC || *offset < 0 || *length <= 0 ||
*length > OFF_MAX - *offset || flags != 0) *length > OFF_MAX - *offset || flags != 0)
return (EINVAL); return (EINVAL);
if (vp->v_type != VREG) if (vp->v_type != VREG)
return (ENODEV); return (ENODEV);
ioflag = get_write_ioflag(fp); ioflag = get_write_ioflag(fp);
switch (cmd) { switch (cmd) {
case SPACECTL_DEALLOC: case SPACECTL_DEALLOC:
error = vn_deallocate_impl(vp, offset, length, flags, ioflag, error = vn_deallocate_impl(vp, offset, length, flags, ioflag,
active_cred, fp->f_cred); active_cred, fp->f_cred);
kibUnsubmitted
Not Done
Inline Actions

why passing fp->f_cred there at all?
from_fops is ugly and arguably not needed.
vn_deallocate() needs explanation about active_cre/file_cred in a comment, nobody would read man page for this (or in both)

kib: why passing fp->f_cred there at all? from_fops is ugly and arguably not needed. vn_deallocate()…
khngAuthorUnsubmitted
Not Done
Inline Actions

The fp->f_cred was there to for mac_vnode_check_write's policy checking (although all the policy modules in base so far are not taking f_cred into consideration at all).

khng: The fp->f_cred was there to for mac_vnode_check_write's policy checking (although all the…
khngAuthorUnsubmitted
Done
Inline Actions

A mental note to myself: Though mac_vnode_check_write()'s file_cred is not inspected by in base policy module, it is possibly used by outside world to implement capability semantic.

khng: A mental note to myself: Though mac_vnode_check_write()'s file_cred is not inspected by in base…
break; break;
default: default:
panic("vn_fspacectl: unknown cmd %d", cmd); panic("vn_fspacectl: unknown cmd %d", cmd);
} }
return (error); return (error);
} }
▲ Show 20 Lines • Show All 101 Lines • Show Last 20 Lines