splnet() surrounding in6_control1()

[Elad Efrat]

Hi,

In in6_control() there seems to be an splnet() surrounding the call to
in6_control1().

Without going into debate whether or not splnet() around the entire
function is necessary, at the very least it prevents me from using
real kauth(9) calls.

Therefore, I would like to
- add a switch statement in in6_control(), where we currently issue
the kauth(9) call, and perform the call only for the cases where
in6_control1() checks for the "privileged" variable

- modify in6_control1() to not take a "privileged" variable anymore,
and instead place a comment ("/* Privileged, see in6_control(). */" or
something) where the variable used to be checked

Are there any objections to such a change?

Thanks,

-e.

--
Posted automagically by a mail2news gateway at muc.de e.V.
Please direct questions, flames, donations, etc. to news-***@muc.de

[David Young]

Post by Elad Efrat
Hi,
In in6_control() there seems to be an splnet() surrounding the call to
in6_control1().
Without going into debate whether or not splnet() around the entire
function is necessary, at the very least it prevents me from using
real kauth(9) calls.
Therefore, I would like to
- add a switch statement in in6_control(), where we currently issue
the kauth(9) call, and perform the call only for the cases where
in6_control1() checks for the "privileged" variable
- modify in6_control1() to not take a "privileged" variable anymore,
and instead place a comment ("/* Privileged, see in6_control(). */" or
something) where the variable used to be checked
Are there any objections to such a change?

Do not make this change without sending a patch for review. Provide at
least 72 hours for review before committing.

Dave

[Elad Efrat]

Post by David Young
Do not make this change without sending a patch for review. Provide at
least 72 hours for review before committing.

Sure, attached.

Thanks,

-e.

[Elad Efrat]

Sorry, but this:

+ case SIOCAIFADDR_IN6:
+ if (l == NULL && kauth_authorize_generic(l->l_cred,
+ KAUTH_GENERIC_ISSUSER, NULL))
+ return EPERM;
+ break;
+ }

should have || instead.

Of course, the whole l == NULL check is ridiculous.

-e.

--
Posted automagically by a mail2news gateway at muc.de e.V.
Please direct questions, flames, donations, etc. to news-***@muc.de