| 2197 | } |
| 2198 | |
| 2199 | static int |
| 2200 | lomac_system_check_sysctl(struct ucred *cred, struct sysctl_oid *oidp, |
| 2201 | void *arg1, int arg2, struct sysctl_req *req) |
| 2202 | { |
| 2203 | struct mac_lomac *subj; |
| 2204 | |
| 2205 | if (!lomac_enabled) |
| 2206 | return (0); |
| 2207 | |
| 2208 | subj = SLOT(cred->cr_label); |
| 2209 | |
| 2210 | /* |
| 2211 | * Treat sysctl variables without CTLFLAG_ANYBODY flag as lomac/high, |
| 2212 | * but also require privilege to change them. |
| 2213 | */ |
| 2214 | if (req->newptr != NULL && (oidp->oid_kind & CTLFLAG_ANYBODY) == 0) { |
| 2215 | #ifdef notdef |
| 2216 | if (!lomac_subject_dominate_high(subj)) |
| 2217 | return (EACCES); |
| 2218 | #endif |
| 2219 | |
| 2220 | if (lomac_subject_privileged(subj)) |
| 2221 | return (EPERM); |
| 2222 | } |
| 2223 | |
| 2224 | return (0); |
| 2225 | } |
| 2226 | |
| 2227 | static void |
| 2228 | lomac_thread_userret(struct thread *td) |
nothing calls this directly
no test coverage detected