Date: Sat, 8 Jul 2006 11:16:55 GMT From: Robert Watson <rwatson@FreeBSD.org> To: Perforce Change Reviews <perforce@freebsd.org> Subject: PERFORCE change 100978 for review Message-ID: <200607081116.k68BGtaT026193@repoman.freebsd.org>
next in thread | raw e-mail | index | archive | help
http://perforce.freebsd.org/chv.cgi?CH=100978 Change 100978 by rwatson@rwatson_zoo on 2006/07/08 11:15:56 More notes. Affected files ... .. //depot/projects/trustedbsd/mac2/mac2_notes.txt#3 edit Differences ... ==== //depot/projects/trustedbsd/mac2/mac2_notes.txt#3 (text+ko) ==== @@ -10,7 +10,8 @@ (removing '_from_', etc), and make things much more legible and consistent. -- Add a new subsystem class netinet to hold netinet-related methods. +- Add a new subsystem class _netinet_ to hold netinet-related methods. + Added a pseudo-class, _policy_ for policy-related events (init, destroy). - Resort entry points in mac_framework.h, mac_policy.h by object rather than method. This significantly improves readability. @@ -18,6 +19,11 @@ - Split mac.h into mac.h and mac_framework.h, breaking out user and kernel APIs into separate kernel include files. +- Remove mount_fs label, which has generally gone unused. + +- Rename all devfs entry points to be mac_devfs_foo() rather than having + some be mac_devfsdirent_foo(). + Planned changes: - Accessor methods for slot data based on functions, in order to avoid @@ -56,3 +62,7 @@ are only used for objects requested by the policy. I.e., policies can request only a cred label slot, etc. This could then be used to key memory allocation overhead on more objects. + +- Move from just init/destroy to also attach/detach methods for the policy, + so that memory allocation can be performed without the mac policy lock + held.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200607081116.k68BGtaT026193>