[src/netbsd-3]: src/sys/kern Pull up revision 1.11 (requested by elad in tick...

[tron <tron%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/293adc2a1dce
branches:  netbsd-3
changeset: 576118:293adc2a1dce
user:      tron <tron%NetBSD.org@localhost>
date:      Fri Jun 10 14:59:55 2005 +0000

description:
Pull up revision 1.11 (requested by elad in ticket #389):
Remove bogus DIAGNOSTIC check and panic.

diffstat:

 sys/kern/kern_verifiedexec.c |  16 +++-------------
 1 files changed, 3 insertions(+), 13 deletions(-)

diffs (44 lines):

diff -r a54704119379 -r 293adc2a1dce sys/kern/kern_verifiedexec.c
--- a/sys/kern/kern_verifiedexec.c      Fri Jun 10 14:59:35 2005 +0000
+++ b/sys/kern/kern_verifiedexec.c      Fri Jun 10 14:59:55 2005 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: kern_verifiedexec.c,v 1.9.2.1 2005/06/10 14:47:17 tron Exp $   */
+/*     $NetBSD: kern_verifiedexec.c,v 1.9.2.2 2005/06/10 14:59:55 tron Exp $   */
 
 /*-
  * Copyright 2005 Elad Efrat <elad%bsd.org.il@localhost>
@@ -30,7 +30,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: kern_verifiedexec.c,v 1.9.2.1 2005/06/10 14:47:17 tron Exp $");
+__KERNEL_RCSID(0, "$NetBSD: kern_verifiedexec.c,v 1.9.2.2 2005/06/10 14:59:55 tron Exp $");
 
 #include <sys/param.h>
 #include <sys/mount.h>
@@ -479,7 +479,7 @@
        case FINGERPRINT_VALID:
        case FINGERPRINT_INDIRECT:
        case FINGERPRINT_NOMATCH:
-               if (securelevel >= 2) {
+               if ((securelevel >= 2) || security_veriexec_strict) {
                        printf("Veriexec: Denying unlink request for %s "
                               "from uid=%u: File in fingerprint tables. "
                               "(pid=%u, dev=%ld, inode=%lu)\n", pathbuf,
@@ -488,16 +488,6 @@
 
                        error = EPERM;
                } else {
-#ifdef DIAGNOSTIC
-                       /* XXX: Print more details? */
-                       vhe = veriexec_lookup(va.va_fsid, va.va_fileid);
-                       if (vhe == NULL) {
-                               panic("Veriexec: Inconsistency! "
-                                     "File has post-evaluation status, "
-                                     "but not in lists. Report a bug.");
-                       }
-#endif /* DIAGNOSTIC */
-
                        if (security_veriexec_verbose) {
                                printf("Veriexec: veriexec_removechk: Removing"
                                       " entry from Veriexec table. (file=%s, "