Merge from head

- MFC from head@196987

Merge r196123 from head to stable/8:

Update posix1e-related man pages, especially as relates to MAC, to more
accurately reflect the last ten years of work.

Approved by: re (kib)

Update posix1e-related man pages, especially as relates to MAC, to more
accurately reflect the last ten years of work.

Approved by: re (kib)

- MFC @196061

Add missing MLINKS for acl_{get,set}_link_fd(3).

Approved by: re (kib)

- MFC

Add NFSv4 ACL support to libc.

This adds the following functions to the acl(3) API: acl_add_flag_np,
acl_clear_flags_np, acl_create_entry_np, acl_delete_entry_np,
acl_delete_flag_np, acl_get_extende

Add NFSv4 ACL support to libc.

This adds the following functions to the acl(3) API: acl_add_flag_np,
acl_clear_flags_np, acl_create_entry_np, acl_delete_entry_np,
acl_delete_flag_np, acl_get_extended_np, acl_get_flag_np, acl_get_flagset_np,
acl_set_extended_np, acl_set_flagset_np, acl_to_text_np, acl_is_trivial_np,
acl_strip_np, acl_get_brand_np. Most of them are similar to what Darwin
does. There are no backward-incompatible changes.

Approved by: rwatson@

show more ...

Merge from HEAD

Make 'struct acl' larger, as required to support NFSv4 ACLs. Provide
compatibility interfaces in both kernel and libc.

Reviewed by: rwatson

Following repo-copy of mac_is_present_np.3 to mac_is_present.3, remove
old file, update references, etc. The C function is already named
mac_is_present().

Obtained from: TrustedBSD Project

Add each directory's symbol map file to SYM_MAPS.

Missed rwatson's redundancy

Add reference to mac_get_link() in man page, which was omitted when
mac_get_link() and mac_set_link() were added.

Add a man page for the mac.conf MAC library configuration file.

Obtained from: TrustedBSD Project
Sponsored by: DARPA, Network Associates Laboratories

o Document mac_prepare() and associated functions
o Link mac_get_pid.3 to mac_get.3
o Update SEE ALSO to refer to mac_prepare, and added missing references
o Remove clause #3 on my work
o Update mac_

o Document mac_prepare() and associated functions
o Link mac_get_pid.3 to mac_get.3
o Update SEE ALSO to refer to mac_prepare, and added missing references
o Remove clause #3 on my work
o Update mac_get.3 for the updated MAC API

Sponsored by: DARPA, Network Associates Laboratories
Obtained from: TrustedBSD Project

show more ...

libc_r wasn't so tied to libc for 22 months.

Hook up the userland wrapper for __mac_execve().

Obtained from: TrustedBSD Project
Sponsored by: DARPA, Network Associates Laboratories

Reflect MAC kernel/user API changes into the libc MAC implementation.
This removes a lot of complexity, since we basically just reserve
space on a retrieval of a label, and pass around strings. Two

Reflect MAC kernel/user API changes into the libc MAC implementation.
This removes a lot of complexity, since we basically just reserve
space on a retrieval of a label, and pass around strings. Two new
elements: (1) consumers of the API must now declare what label
elements they are interested in retrieving, or (2) rely on the default
provided in a new configuration file, mac.conf.

Approved by: re
Obtained from: TrustedBSD Project
Sponsored by: DARPA, Network Associates Laboratories

show more ...

Unhook the per-policy parsing/printing MAC modules in libc to prepare
to bring in the new MAC label management API. With the new API
revision, we have only policy-agnostic code in libc and the base

Unhook the per-policy parsing/printing MAC modules in libc to prepare
to bring in the new MAC label management API. With the new API
revision, we have only policy-agnostic code in libc and the base
kernel.

Obtained from: TrustedBSD Project
Sponsored by: DARPA, Network Associates Laboratories

show more ...

Introduce support for Mandatory Access Control and extensible
kernel access control.

Extensions to libc to provide basic MAC label manipulation facilities
for userland. These interface will be repl

Introduce support for Mandatory Access Control and extensible
kernel access control.

Extensions to libc to provide basic MAC label manipulation facilities
for userland. These interface will be replaced in the next month
or two with more flexible interfaces, but provide sufficient support
to allow use of the Biba and MLS policies for user applications.

libc_r wrappers to follow.

Obtained from: TrustedBSD Project
Sponsored by: DARPA, NAI Labs

show more ...

No POSIX.1e capabilities in the main tree yet.

o Reflect repo-copy of extattr.[c3] from libutil to libc, moving
extattr namespace routines to the libc/posix1e directory. While
the extattr calls are not strictly POSIX.1e, POSIX.1e wasn't
st

o Reflect repo-copy of extattr.[c3] from libutil to libc, moving
extattr namespace routines to the libc/posix1e directory. While
the extattr calls are not strictly POSIX.1e, POSIX.1e wasn't
strictly ever approved, so I think that's OK.

Obtained from: TrustedBSD Project

show more ...

o Attach cap_cmp.c and cap_copy.c to the build.
o Attach cap_copy_ext.3 and cap_copy_int.3 to the install, and link
cap_size.3 to cap_copy_ext.3.

Submitted by: tmm
Obtained from: TrustedBSD Proje

o Attach cap_cmp.c and cap_copy.c to the build.
o Attach cap_copy_ext.3 and cap_copy_int.3 to the install, and link
cap_size.3 to cap_copy_ext.3.

Submitted by: tmm
Obtained from: TrustedBSD Project

show more ...

o Separate acl_t into internal and external representations as
required by POSIX.1e. This maintains the current 'struct acl'
in the kernel while providing the generic external acl_t
interface

o Separate acl_t into internal and external representations as
required by POSIX.1e. This maintains the current 'struct acl'
in the kernel while providing the generic external acl_t
interface required to complete the ACL editing library.
o Add the acl_get_entry() function.
o Convert the existing ACL utilities, getfacl and setfacl, to
fully make use of the ACL editing library.

Obtained from: TrustedBSD Project

show more ...