MFC r335921:

Allow jail names (not just IDs) to be specified for: cpuset(1), ipfw(8),
sockstat(1), ugidfw(8)
These are the last of the jail-aware userland utilities that didn't work
with names.

PR: 229266
Differential Revision: D16047

Revert r330897:

This was intended to be a non-functional change. It wasn't. The commit
message was thus wrong. In addition it broke arm, and merged crypto
related code.

Revert with prejudice.

This revert skips files touched in r316370 since that commit was since
MFCed. This revert also skips files that require $FreeBSD$ property
changes.

Thank you to those who helped me get out of this mess including but not
limited to gonzo, kevans, rgrimes.

Requested by: gjb (re)

Partial merge of the SPDX changes

These changes are incomplete but are making it difficult
to determine what other changes can/should be merged.

No objections from: pfg

MFC r324928,r324929:

r324928:

Remove dead stores

The return value of various snprintf calls was stored in `len` and not used
in many functions.

r324929:

Clean up trailing whitespace

Copy head@r302406 to stable/11 as part of the 11.0-RELEASE cycle.
Prune svn:mergeinfo from the new branch, as nothing has been merged
here.

Additional commits post-branch will follow.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

Fix 'ugidfw remove' after r284251 incorrectly changed it.

The sysctl_rule() node removes entries when given a newptr and newlen == 0.

Set some internal helpers as static and initialize few variables to silence
CLANG WARNINGS.
BUMP SHLIB_MAJOR version as the ABI potentially changed.

Also run an 'exp run' to double check if any external project are using
those functions. Thanks antoine@.

PR: 200807
Differential Revision: D2775
Reviewed by: kib, ngie

Remove unnecessary variable and fix the usage of sysctl(3).

Differential Revision: D2733
Reviewed by: ngie, kib

Remove unused variables and silence clang warnings.

Differential Revision: D2686
Reviewed by: rodrigc

Quiet clang warnings by using string literal format strings.

Remove an unused variable.

Add some new options to mac_bsdestended. We can now match on:

subject: ranges of uid, ranges of gid, jail id
objects: ranges of uid, ranges of gid, filesystem,
object is suid, object is sgid, object matches subject uid/gid
object type

We can also negate individual conditions. The ruleset language is
a superset of the previous language, so old rules should continue
to work.

These changes require a change to the API between libugidfw and the
mac_bsdextended module. Add a version number, so we can tell if
we're running mismatched versions.

Update man pages to reflect changes, add extra test cases to
test_ugidfw.c and add a shell script that checks that the the
module seems to do what we expect.

Suggestions from: rwatson, trhodes
Reviewed by: trhodes
MFC after: 2 months

Fix two typos in comments.

When parsing the second {uid,gid} in an identity phrase for ugidfw,
check the password or group database before attempting to parse as an
integer, as is done for the first {uid,gid} in an identity phrase.

Obtained from: TrustedBSD Project
Sponsored by: SPAWAR, SPARTA

Properly return rule number.

Submitted by: Wojciech A. Koszek
PR: bin/79292
MFC after: 1 week

Modify libugidfw(3) to use MBI_* permission flags from mac_bsdextended.h
instead of using the V* permission flags from vnode.h. Remove include
of vnode.h.

Requested by: phk

Fixed misspellings of 0 as NULL.

Add bsde_add_rule(), which is similar to bsde_set_rule() except that
the caller does not specify the rule number -- instead, the kernel
module is probed for the next available rule, which is then used.

Obtained from: TrustedBSD Project
Sponsored by: DARPA, McAfee Research

License and blurb update authorized by Network Associates.

Use size_t instead of int for len variables passed in/out of sysctl.

Pointed out by: jake

Use "ugidfw.h" rather than <ugidfw.h> so that mkdep can find it.

Suggested by: mike

Introduce support for Mandatory Access Control and extensible
kernel access control.

Provide a library to manage user file system firewall-like rules
supported by the mac_bsdextended.ko security model. The kernel
module exports the current rule set using sysctl, and this
library provides a front end that includes support for retrieving
and setting rules, as well as printing and parsing them.

Note: as with other userland components, this is a WIP. However,
when used in combination with the soon-to-be-committed ugidfw,
it can actually be quite useful in multi-user environments to
allow the administrator to limit inter-user file operations without
resorting to heavier weight labeled security policies.

Obtained form: TrustedBSD Project
Sponsored by: DARPA, NAI Labs