[src/netbsd-3]: src/sys/sys Pull up revision 1.139 (requested by elad in tick...

[tron <tron%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/e036a4e810c7
branches:  netbsd-3
changeset: 576375:e036a4e810c7
user:      tron <tron%NetBSD.org@localhost>
date:      Sat Jul 02 15:51:41 2005 +0000

description:
Pull up revision 1.139 (requested by elad in ticket #487):
More veriexec changes:
- Better organize strict level. Now we have 4 levels:
- Level 0, learning mode: Warnings only about anything that might've
resulted in 'access denied' or similar in a higher strict level.
- Level 1, IDS mode:
- Deny access on fingerprint mismatch.
- Deny modification of veriexec tables.
- Level 2, IPS mode:
- All implications of strict level 1.
- Deny write access to monitored files.
- Prevent removal of monitored files.
- Enforce access type - 'direct', 'indirect', or 'file'.
- Level 3, lockdown mode:
- All implications of strict level 2.
- Prevent creation of new files.
- Deny access to non-monitored files.
- Update sysctl(3) man-page with above. (date bumped too :)
- Remove FINGERPRINT_INDIRECT from possible fp_status values; it's no
longer needed.
- Simplify veriexec_removechk() in light of new strict level policies.
- Eliminate use of 'securelevel'; veriexec now behaves according to
its strict level only.

diffstat:

 sys/sys/vnode.h |  8 +++-----
 1 files changed, 3 insertions(+), 5 deletions(-)

diffs (22 lines):

diff -r 2ce401aabf05 -r e036a4e810c7 sys/sys/vnode.h
--- a/sys/sys/vnode.h   Sat Jul 02 15:51:33 2005 +0000
+++ b/sys/sys/vnode.h   Sat Jul 02 15:51:41 2005 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: vnode.h,v 1.134.2.2 2005/07/02 15:46:53 tron Exp $     */
+/*     $NetBSD: vnode.h,v 1.134.2.3 2005/07/02 15:51:41 tron Exp $     */
 
 /*
  * Copyright (c) 1989, 1993
@@ -187,10 +187,8 @@
 #ifdef VERIFIED_EXEC
 #define FINGERPRINT_NOTEVAL  0  /* fingerprint has not been evaluated */
 #define FINGERPRINT_VALID    1  /* fingerprint evaluated and matches list */
-#define FINGERPRINT_INDIRECT 2  /* fingerprint eval'd/matched but only
-                                   indirect execs allowed */
-#define FINGERPRINT_NOMATCH  3  /* fingerprint evaluated but does not match */
-#define FINGERPRINT_NOENTRY  4  /* fingerprint evaluated but no list entry */
+#define FINGERPRINT_NOMATCH  2  /* fingerprint evaluated but does not match */
+#define FINGERPRINT_NOENTRY  3  /* fingerprint evaluated but no list entry */
 #endif
 
 /*