Introduce mac_check_system_settime(), a MAC check allowing policies to

augment the system policy for changing the system time.

Obtained from:	TrustedBSD Project
Sponsored by:	DARPA, Network Associates Laboratories

1 files changed, 13 insertions, 0 deletions

diff --git a/sys/kern/kern_mac.c b/sys/kern/kern_mac.c
index f4cfa8ab2fc1..ff5c43a71f17 100644
--- a/sys/kern/kern_mac.c
+++ b/sys/kern/kern_mac.c
@@ -2492,6 +2492,19 @@ mac_check_system_reboot(struct ucred *cred, int howto)
 }
 
 int
+mac_check_system_settime(struct ucred *cred)
+{
+	int error;
+
+	if (!mac_enforce_system)
+		return (0);
+
+	MAC_CHECK(check_system_settime, cred);
+
+	return (error);
+}
+
+int
 mac_check_system_swapon(struct ucred *cred, struct vnode *vp)
 {
 	int error;