Remove residual blank line at start of MakefileThis is a residual of the $FreeBSD$ removal.MFC After: 3 days (though I'll just run the command on the branches)Sponsored by: Netflix
sys: Remove $FreeBSD$: one-line sh patternRemove /^\s*#[#!]?\s*\$FreeBSD\$.*$\n/
sys/modules: normalize .CURDIR-relative paths to SRCTOPThis simplifies make output/logicTested with: `cd sys/modules; make ALL_MODULES=` on amd64MFC after: 1 monthSponsored by: Dell EMC Isilon
mac_portacl.c no longer references vnode_if.h.
A cute yet small MAC policy that provides a simple ACL mechanism topermit users and groups to bind ports for TCP or UDP, and is intendedto be combined with the recently committed support fornet.in
A cute yet small MAC policy that provides a simple ACL mechanism topermit users and groups to bind ports for TCP or UDP, and is intendedto be combined with the recently committed support fornet.inet.ip.portrange.reservedhigh. The policy is twiddled usingsysctl(8). To use this module, you will need to compile in MACsupport, and probably set reservedhigh to 0, then twiddlesecurity.mac.portacl.rules to set things as desired. This policymodule only restricts ports explicitly bound using bind(), notimplicitly bound ports where the port number is selected by theIP stack. It appears to work properly in my local configuration,but needs more broad testing.A sample policy might be: # sysctl security.mac.portacl.rules="uid:425:tcp:80,uid:425:tcp:79"This permits uid 425 to bind TCP sockets to ports 79 and 80. Currentlyno distinction is made for incoming vs. outgoing ports with TCP,although that would probably be easy to add.Obtained from: TrustedBSD ProjectSponsored by: DARPA, Network Associates Laboratories
show more ...