 @@ -1,14 +1,14 @@
-/*	$NetBSD: kern_ktrace.c,v 1.149 2009/08/05 19:53:42 dsl Exp $	*/
+/*	$NetBSD: kern_ktrace.c,v 1.150 2009/10/02 21:47:35 elad Exp $	*/
 /*-
  * Copyright (c) 2006, 2007, 2008 The NetBSD Foundation, Inc.
  * All rights reserved.
+ *
  * This code is derived from software contributed to The NetBSD Foundation
  * by Andrew Doran.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
 @@ -51,27 +51,27 @@
  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
+ *
  *	@(#)kern_ktrace.c	8.5 (Berkeley) 5/14/95
  */
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: kern_ktrace.c,v 1.149 2009/08/05 19:53:42 dsl Exp $");
+__KERNEL_RCSID(0, "$NetBSD: kern_ktrace.c,v 1.150 2009/10/02 21:47:35 elad Exp $");
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/proc.h>
 #include <sys/file.h>
 #include <sys/namei.h>
 #include <sys/vnode.h>
 #include <sys/kernel.h>
 #include <sys/kthread.h>
 #include <sys/ktrace.h>
 #include <sys/kmem.h>
 #include <sys/syslog.h>
 #include <sys/filedesc.h>
 @@ -169,26 +169,28 @@ static int	ktrderefall(struct ktr_desc *
  * Patchable variables.
  */
 int ktd_maxentry = KTD_MAXENTRY;	/* max # of entry in the queue */
 int ktd_timeout = KTD_TIMEOUT;		/* timeout in seconds */
 int ktd_delayqcnt = KTD_DELAYQCNT;	/* # of entry allowed to delay */
 int ktd_wakedelay = KTD_WAKEDELAY;	/* delay of wakeup in *ms* */
 int ktd_intrwakdl = KTD_INTRWAKDL;	/* ditto, but when interactive */
 kmutex_t ktrace_lock;
 int ktrace_on;
 static TAILQ_HEAD(, ktr_desc) ktdq = TAILQ_HEAD_INITIALIZER(ktdq);
 static pool_cache_t kte_cache;
 static kauth_listener_t ktrace_listener;
 static void
 ktd_wakeup(struct ktr_desc *ktd)
+{
 	callout_stop(&ktd->ktd_wakch);
 	cv_signal(&ktd->ktd_cv);
+}
 static void
 ktd_callout(void *arg)
+{
 	mutex_enter(&ktrace_lock);
 @@ -227,36 +229,72 @@ ktrenter(lwp_t *l)
 	if ((l->l_pflag & LP_KTRACTIVE) != 0)
 		return 1;
 	l->l_pflag |= LP_KTRACTIVE;
 	return 0;
+}
 static inline void
 ktrexit(lwp_t *l)
+{
 	l->l_pflag &= ~LP_KTRACTIVE;
+}
 static int
 ktrace_listener_cb(kauth_cred_t cred, kauth_action_t action, void *cookie,
     void *arg0, void *arg1, void *arg2, void *arg3)
+{
 	struct proc *p;
 	int result;
 	enum kauth_process_req req;
 	result = KAUTH_RESULT_DEFER;
 	p = arg0;
 	if (action != KAUTH_PROCESS_KTRACE)
 		return result;
 	req = (enum kauth_process_req)(unsigned long)arg1;
 	/* Privileged; secmodel should handle these. */
 	if (req == KAUTH_REQ_PROCESS_KTRACE_PERSISTENT)
 		return result;
 	if ((p->p_traceflag & KTRFAC_PERSISTENT) ||
 	    (p->p_flag & PK_SUGID))
 		return result;
 	if (kauth_cred_geteuid(cred) == kauth_cred_getuid(p->p_cred) &&
 	    kauth_cred_getuid(cred) == kauth_cred_getsvuid(p->p_cred) &&
 	    kauth_cred_getgid(cred) == kauth_cred_getgid(p->p_cred) &&
 	    kauth_cred_getgid(cred) == kauth_cred_getsvgid(p->p_cred))
 		result = KAUTH_RESULT_ALLOW;
 	return result;
+}
 /*
  * Initialise the ktrace system.
  */
 void
 ktrinit(void)
+{
 	mutex_init(&ktrace_lock, MUTEX_DEFAULT, IPL_NONE);
 	kte_cache = pool_cache_init(sizeof(struct ktrace_entry), 0, 0, 0,
 	    "ktrace", &pool_allocator_nointr, IPL_NONE, NULL, NULL, NULL);
 	ktrace_listener = kauth_listen_scope(KAUTH_SCOPE_PROCESS,
 	    ktrace_listener_cb, NULL);
+}
 /*
  * Release a reference.  Called with ktrace_lock held.
  */
 void
 ktdrel(struct ktr_desc *ktd)
+{
 	KASSERT(mutex_owned(&ktrace_lock));
 	KDASSERT(ktd->ktd_ref != 0);
 	KASSERT(ktd->ktd_ref > 0);

 @@ -1,14 +1,14 @@
-/* $NetBSD: secmodel_suser.c,v 1.1 2009/10/02 18:50:13 elad Exp $ */
+/* $NetBSD: secmodel_suser.c,v 1.2 2009/10/02 21:47:35 elad Exp $ */
 /*-
  * Copyright (c) 2006 Elad Efrat <elad@NetBSD.org>
  * All rights reserved.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  * 3. The name of the author may not be used to endorse or promote products
 @@ -28,27 +28,27 @@
 /*
  * This file contains kauth(9) listeners needed to implement the traditional
  * NetBSD superuser access restrictions.
+ *
  * There are two main resources a request can be issued to: user-owned and
  * system owned. For the first, traditional Unix access checks are done, as
  * well as superuser checks. If needed, the request context is examined before
  * a decision is made. For the latter, usually only superuser checks are done
  * as normal users are not allowed to access system resources.
  */
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: secmodel_suser.c,v 1.1 2009/10/02 18:50:13 elad Exp $");
+__KERNEL_RCSID(0, "$NetBSD: secmodel_suser.c,v 1.2 2009/10/02 21:47:35 elad Exp $");
 #include <sys/types.h>
 #include <sys/param.h>
 #include <sys/kauth.h>
 #include <sys/acct.h>
 #include <sys/mutex.h>
 #include <sys/ktrace.h>
 #include <sys/mount.h>
 #include <sys/pset.h>
 #include <sys/socketvar.h>
 #include <sys/sysctl.h>
 #include <sys/tty.h>
 @@ -614,53 +614,31 @@ secmodel_suser_process_cb(kauth_cred_t c
 				break;
 			else
 				result = KAUTH_RESULT_ALLOW;
 			break;
 		default:
 			break;
+		}
 		break;
+		}
-	case KAUTH_PROCESS_KTRACE: {
+	case KAUTH_PROCESS_KTRACE:
-		enum kauth_process_req req;
+		if (isroot)
 		req = (enum kauth_process_req)(unsigned long)arg1;
 		if (isroot) {
 			result = KAUTH_RESULT_ALLOW;
 			break;
 		} else if (req == KAUTH_REQ_PROCESS_KTRACE_PERSISTENT) {
 			break;
 		if ((p->p_traceflag & KTRFAC_PERSISTENT) ||
 		    (p->p_flag & PK_SUGID)) {
 			break;
 		if (kauth_cred_geteuid(cred) == kauth_cred_getuid(p->p_cred) &&
 		    kauth_cred_getuid(cred) == kauth_cred_getsvuid(p->p_cred) &&
 		    kauth_cred_getgid(cred) == kauth_cred_getgid(p->p_cred) &&
 		    kauth_cred_getgid(cred) == kauth_cred_getsvgid(p->p_cred)) {
 			result = KAUTH_RESULT_ALLOW;
 			break;
 		break;
 	case KAUTH_PROCESS_PROCFS: {
 		enum kauth_process_req req = (enum kauth_process_req)arg2;
 		struct pfsnode *pfs = arg1;
 		if (isroot) {
 			result = KAUTH_RESULT_ALLOW;
 			break;
+		}
 		if (req == KAUTH_REQ_PROCESS_PROCFS_CTL) {
 			break;
+		}