summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Introduce support for Mandatory Access Control and extensiblerwatson2002-07-311-0/+8
| | | | | | | | | | | | | | | kernel access control. When fragmenting an IP datagram, invoke an appropriate MAC entry point so that MAC labels may be copied (...) to the individual IP fragment mbufs by MAC policies. When IP options are inserted into an IP datagram when leaving a host, preserve the label if we need to reallocate the mbuf for alignment or size reasons. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Introduce support for Mandatory Access Control and extensiblerwatson2002-07-311-0/+17
| | | | | | | | | | | | | | | | kernel access control. Instrument the code managing IP fragment reassembly queues (struct ipq) to invoke appropriate MAC entry points to maintain a MAC label on each queue. Permit MAC policies to associate information with a queue based on the mbuf that caused it to be created, update that information based on further mbufs accepted by the queue, influence the decision making process by which mbufs are accepted to the queue, and set the label of the mbuf holding the reassembled datagram following reassembly completetion. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Fix an easy WARNS.markm2002-07-311-1/+1
|
* Fix some easy WARNS.markm2002-07-313-12/+12
|
* Give lint a small bit of help.markm2002-07-311-0/+2
|
* Introduce support for Mandatory Access Control and extensiblerwatson2002-07-311-0/+6
| | | | | | | | | | | kernel access control. When generating an IGMP message, invoke a MAC entry point to permit the MAC framework to label its mbuf appropriately for the target interface. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Introduce support for Mandatory Access Control and extensiblerwatson2002-07-311-0/+5
| | | | | | | | | | kernel access control. When generating an ARP query, invoke a MAC entry point to permit the MAC framework to label its mbuf appropriately for the interface. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* sort(1) and uniq(1).markm2002-07-311-42/+27
|
* Introduce support for Mandatory Access Control and extensiblerwatson2002-07-311-0/+6
| | | | | | | | | | | kernel access control. Invoke the MAC framework to label mbuf created using divert sockets. These labels may later be used for access control on delivery to another socket, or to an interface. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI LAbs
* Introduce support for Mandatory Access Control and extensiblerwatson2002-07-311-0/+21
| | | | | | | | | | | | | kernel access control. Instrument connect(), listen(), and bind() system calls to invoke MAC framework entry points to permit policies to authorize these requests. This can be useful for policies that want to limit the activity of processes involving particular types of IPC and network activity. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* FreeBSD has setkey in different location from NetBSD.ume2002-07-311-6/+15
| | | | Submitted by: Mike Makonnen <makonnen@pacbell.net>
* Introduce support for Mandatory Access Control and extensiblerwatson2002-07-311-0/+16
| | | | | | | | | | | | | | | | | kernel access control. Label mbufs received via kernel tunnel device interfaces by invoking appropriate MAC framework entry points. Perform access control checks on out-going mbufs delivered via tunnel interfaces by invoking appropriate MAC entry points: NOTE: Currently the label for a tunnel interface is not derived from the label of the process that opened the tunnel interface. It probably should be. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* These file are no longer used (moved to userland and/or merged intojake2002-07-315-689/+0
| | | | pmap.c).
* Introduce support for Mandatory Access Control and extensiblerwatson2002-07-311-0/+12
| | | | | | | | | | | | | | kernel access control. Label mbufs received via ethernet-based interfaces by invoking appropriate MAC framework entry points. Perform access control checks on out-going mbufs delivered via ethernet-based interfaces by invoking appropriate MAC entry points. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Introduce support for Mandatory Access Control and extensiblerwatson2002-07-311-0/+11
| | | | | | | | | | | | | kernel access control. Instrument the interface management code so that MAC labels are properly maintained on network interfaces (struct ifnet). In particular, invoke entry points when interfaces are created and removed. MAC policies may initialized the label interface based on a variety of factors, including the interface name. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* New release note: SA-02:32.bmah2002-07-312-0/+12
|
* Introduce support for Mandatory Access Control and extensiblerwatson2002-07-311-0/+6
| | | | | | | | | | kernel access control. When decompressing data from one mbuf into another mbuf, preserve the mbuf label by copying it to the new mbuf. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Introduce support for Mandatory Access Control and extensiblerwatson2002-07-311-2/+6
| | | | | | | | | | | | kernel access control. Invoke a MAC framework entry point to authorize reception of an incoming mbuf by the BPF descriptor, permitting MAC policies to limit the visibility of packets delivered to particular BPF descriptors. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Introduce support for Mandatory Access Control and extensiblerwatson2002-07-311-0/+12
| | | | | | | | | | | | | | kernel access control. Instrument BPF so that MAC labels are properly maintained on BPF descriptors. MAC framework entry points are invoked at BPF instantiation and allocation, permitting the MAC framework to derive the BPF descriptor label from the credential authorizing the device open. Also enter the MAC framework to label mbufs created using the BPF device. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Introduce support for Mandatory Access Control and extensiblerwatson2002-07-311-1/+31
| | | | | | | | | | | | | | | | | | | | kernel access control. Instrument UFS to support per-inode MAC labels. In particular, invoke MAC framework entry points for generically supporting the backing of MAC labels into extended attributes. This ends up introducing new vnode operation vector entries point at the MAC framework entry points, as well as some explicit entry point invocations for file and directory creation events so that the MAC framework can push labels to disk before the directory names become persistent (this will work better once EAs in UFS2 are hooked into soft updates). The generic EA MAC entry points support executing with the file system in either single label or multilabel operation, and will fall back to the mount label if multilabel is not specified at mount-time. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* These were repo-copied to have a .S extension.jake2002-07-316-4398/+0
|
* Add pathconf/fpathconf entries from POSIX.1e indicating support forrwatson2002-07-311-0/+11
| | | | | ACLs, Capabilities, Information Labels, and MAC Labels on the queried file system.
* *.s -> *.S.jake2002-07-312-11/+11
|
* Introduce support for Mandatory Access Control and extensiblerwatson2002-07-313-0/+90
| | | | | | | | | | | | | | | | kernel access control. Instrument devfs to support per-dirent MAC labels. In particular, invoke MAC framework when devfs directory entries are instantiated due to make_dev() and related calls, and invoke the MAC framework when vnodes are instantiated from these directory entries. Implement vop_setlabel() for devfs, which pushes the label update into the devfs directory entry for semi-persistant store. This permits the MAC framework to assign labels to devices and directories as they are instantiated, and export access control information via devfs vnodes. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Sort headers to reduce diffs between branches.nectar2002-07-311-1/+1
|
* include file of SASLv1 was changed to /usr/local/include/sasl1.ume2002-07-311-1/+1
|
* Moved the rule for locore.o from kern.post.mk to Makefile.$ARCH.jake2002-07-318-3/+21
|
* some dolt forgot to add in an include for <limits.h>darrenr2002-07-311-0/+1
|
* Replace the FOO_DEBUG definitions with USB_DEBUG, and switch thejoe2002-07-3123-174/+110
| | | | | | debugging levels to off by default. Now that debug levels can be tweaked by sysctl we don't need to go through hoops to get the different usb parts to produce debug data.
* Make this compile with the debugging options switched on.joe2002-07-311-0/+7
|
* Wake up Joe! It would help if I included sys/sysctl.h.joe2002-07-311-0/+1
|
* Add a sysctl (debug.usb.uhub) for tweaking the uhub debug levels.joe2002-07-311-1/+3
|
* The Elan SC520 MMCR is actually 16bit wide, so u_char is inconvenient.phk2002-07-314-4/+4
|
* Get bored with hard coded debug level variables and introduce a debug.usbjoe2002-07-3120-17/+58
| | | | | | sysctl tree for tweaking them real-time. Reviewed by: iedowse
* Patch to fix bounds checking/overflow.darrenr2002-07-311-3/+4
| | | | Obtained from: OpenBSD
* Use struct xfile, not struct file.des2002-07-312-26/+22
|
* Rewrite sockstat(1) in C.des2002-07-314-257/+596
| | | | Sponsored by: DARPA, NAI Labs
* Have the kern.file sysctl export xfiles rather than files. The truth isdes2002-07-311-25/+52
| | | | | | out there! Sponsored by: DARPA, NAI Labs
* Nit in previous commit: the correct sysctl type is "S,xvnode"des2002-07-311-1/+1
|
* Initialize v_cachedid to -1 in getnewvnode().des2002-07-311-42/+66
| | | | | | | Reintroduce the kern.vnode sysctl and make it export xvnodes rather than vnodes. Sponsored by: DARPA, NAI Labs
* Introduce struct xvnode, which will be used instead of struct vnode fordes2002-07-312-0/+39
| | | | | | | | sysctl purposes. Also add two fields to struct vnode, v_cachedfs and v_cachedid, which hold the vnode's device and file id and are filled in by vn_open_cred() and vn_stat(). Sponsored by: DARPA, NAI Labs
* Add struct xfile, which will be used instead of struct file for sysctldes2002-07-311-8/+32
| | | | | | purposes. Sponsored by: DARPA, NAI Labs
* Fix a bunch of format string warnings which brokemux2002-07-316-35/+43
| | | | | | the sparc64 build. Tested on: sparc64, i386
* Deny the SIZE command on large files when in ASCII mode.yar2002-07-311-0/+6
| | | | | | | | This eliminates an opportunity for DoS attack. Pointed out by: maxim Inspired by: lukemftpd, OpenBSD MFC after: 2 weeks
* It should be "ucom", not "usio".joe2002-07-311-1/+1
|
* Regenjoe2002-07-312-2/+37
|
* Correct URL to the Handbookblackend2002-07-311-1/+1
| | | | MFC after: 1 week
* MFNetBSD: uvisor.c (1.14, 1.15)joe2002-07-312-9/+56
| | | | Add support for Palm (M500, M505, M125) and Sony devices (Clie 4.0 and 4.1).
* Correct URL to the FAQblackend2002-07-311-1/+1
| | | | MFC after: 1 week
* Correct a few grammar bogons.schweikh2002-07-311-5/+4
| | | | MFC after: 3 days
OpenPOWER on IntegriCloud