summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Typo fix.mux2002-08-191-1/+1
| | | | Reviewed by: tmm
* style(9) nit.mux2002-08-191-1/+1
|
* Use the __BUS_ACCESSOR macro for PCIB_ACCESSOR instead ofmux2002-08-191-14/+2
| | | | | | reimplementing it. Reviewed by: tmm
* Sort unsorted prototypesache2002-08-191-1/+1
|
* When login tries to do the chmod/chflags on a read only file system,imp2002-08-191-3/+12
| | | | | | | | | | | | | | | | | | | it complains that it can't do it because the filesystem is readonly. Assume that when the user has a readonly /dev that they don't care if login can't change the permissions/flags. While this does break a few things like msgs, we'll assume that the user setting up the read only system knows what they are doing. All this change does is to stop the complaint when the file system is read only. It also adds comments as to why EROFS and EOPNOTSUPP are ignored. This allows one to have a read-only / w/o a /dev MFS and have a relatively warning-free existence. /etc/rc still complains when it can't chown/chflags/chmod things, but that's easy to ignore/tweak. Reviewed by: roberto, phk Sponsored by: Timing Solutions
* Activate (uncomment) wcwidth() and wcswidth() now implementedache2002-08-191-3/+0
|
* Implement wcswidth()ache2002-08-192-2/+66
|
* Stop trying to align malloc()ed memory. Rely on malloc() instead, just likesemenu2002-08-192-25/+18
| | | | others.
* Use modern-style arguments declarationache2002-08-191-2/+1
|
* Close a race in process label changing opened due to dropping therwatson2002-08-199-63/+90
| | | | | | | | | | proc locking when revoking access to mmaps. Instead, perform this later once we've changed the process label (hold onto a reference to the new cred so that we don't lose it when we release the process lock if another thread changes the credential). Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Do not reset card in epic_freebsd_attach() as reset is done insemenu2002-08-191-7/+0
| | | | epic_common_attach().
* Write null wide-character as L'\0' like in other placesache2002-08-191-1/+1
|
* Regen.rwatson2002-08-195-6/+6
|
* mac_syscall is now implemented, switch to MSTD.rwatson2002-08-191-1/+1
| | | | | Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Enclose IPv6 addresses in brackets when they are displayed printable with ajmallett2002-08-193-7/+15
| | | | | | | | TCP/UDP port seperated by a colon. This is for the log_in_vain facility. Pointed out by: Edward J. M. Brocklesby Reviewed by: ume MFC after: 2 weeks
* Fix a couple of bogus return values in previous commit.brooks2002-08-191-3/+2
| | | | | Submitted by: "Vladimir B. " Grebenschikov <vova@sw.ru> Pointy hat to: brooks
* Pass active_cred and file_cred into the MAC framework explicitlyrwatson2002-08-1924-196/+302
| | | | | | | | | | | for mac_check_vnode_{poll,read,stat,write}(). Pass in fp->f_cred when calling these checks with a struct file available. Otherwise, pass NOCRED. All currently MAC policies use active_cred, but could now offer the cached credential semantic used for the base system security model. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Fix buffer length.sos2002-08-191-1/+1
| | | | PR: 41063
* Fix typo.sos2002-08-191-1/+1
|
* According to SUSv2, always return 0 for null wide-character codeache2002-08-191-1/+6
|
* Provide an implementation of mac_syscall() so that security modulesrwatson2002-08-1913-2/+370
| | | | | | | | | | | can offer new services without reserving system call numbers, or augmented versions of existing services. User code requests a target policy by name, and specifies the policy-specific API plus target. This is required in particular for our port of SELinux/FLASK to the MAC framework since it offers additional security services. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Update manpage to reflect reality:gordon2002-08-191-9/+9
| | | | | | xntpd -> ntpd single_mountd_enable -> mountd_enable portmap -> rpcbind
* Clean up a comment talking about C strings, which are terminated with thejmallett2002-08-191-4/+4
| | | | ASCII NUL character (0, or '\0' in C).
* s/trailing NULL/trailing NUL/jmallett2002-08-192-2/+2
|
* New release note: SA-02:38.bmah2002-08-192-0/+14
|
* Break out mac_check_pipe_op() into component check entry points:rwatson2002-08-1919-122/+684
| | | | | | | | | | | mac_check_pipe_poll(), mac_check_pipe_read(), mac_check_pipe_stat(), and mac_check_pipe_write(). This is improves consistency with other access control entry points and permits security modules to only control the object methods that they are interested in, avoiding switch statements. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Don't read the PCI config space during mii operations. Instead save whetherambrisko2002-08-192-3/+9
| | | | | | | | | or not we have to limit the PHY detection in the softc structure. Then just check the flag. Suggested by: jdp Reviewed by: jdp MFC after: 3 days
* Break out mac_check_vnode_op() into three seperate checks:rwatson2002-08-1923-189/+764
| | | | | | | | | | mac_check_vnode_poll(), mac_check_vnode_read(), mac_check_vnode_write(). This improves the consistency with other existing vnode checks, and allows policies to avoid implementing switch statements to determine what operations they do and do not want to authorize. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Add a new `-H' modifier, which when combined with `-p' or `-P' allows to dumpsobomax2002-08-192-14/+38
| | | | full console history.
* 1. Allow information about current history size be retrieved using ioctl(2);sobomax2002-08-192-5/+47
| | | | | 2. modify screen dumpung routine, so that in addition to visible area, it allows to grab any portion of history buffer as well.
* Cater for ich4 quirks.orion2002-08-192-9/+29
| | | | | Reported by: Jacob Rhoden Tested by: Jacob Rhoden, mp
* Assert process locks in proces-related access control checks.rwatson2002-08-199-0/+54
| | | | | Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Add a missing vnode assertion for the exec() check.rwatson2002-08-199-0/+18
| | | | | Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Previous deltas (promisc mode) were a subject of:sobomax2002-08-190-0/+0
| | | | MFC after: 1 week
* Implement user-setable promiscuous mode (a new `promisc' flag for ifconfig(8)).sobomax2002-08-195-4/+22
| | | | | | | | | Also, for all interfaces in this mode pass all ethernet frames to upper layer, even those not addressed to our own MAC, which allows packets encapsulated in those frames be processed with packet filters (ipfw(8) et al). Emphatically requested by: Anton Turygin <pa3op@ukr-link.net> Valuable suggestions by: fenner
* One more (hopefully the last one) step in cleaning up the syntax,luigi2002-08-192-61/+102
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | following Julian's good suggestion: since you can specify any match pattern as an option, rules now have the following format: [<proto> from <src> to <dst>] [options] i.e. the first part is now entirely optional (and left there just for compatibility with ipfw1 rulesets). Add a "-c" flag to show/list rules in the compact form (i.e. without the "ip from any to any" part) when possible. The default is to include it so that scripts processing ipfw's canonical output will still work. Note that as part of this cleanup (and to remove ambiguity), MAC fields now can only be specified in the options part. Update the manpage to reflect the syntax. Clarify the behaviour when a match is attempted on fields which are not present in the packet, e.g. port numbers on non TCP/UDP packets, and the "not" operator is specified. E.g. ipfw add allow not src-port 80 will match also ICMP packets because they do not have port numbers, so "src-port 80" will fail and "not src-port 80" will succeed. For such cases it is advised to insert further options to prevent undesired results (e.g. in the case above, "ipfw add allow proto tcp not src-port 80"). We definitely need to rewrite the parser using lex and yacc!
* Forced commit to correct a PR number in the previous commit. It is bin/40177.maxim2002-08-190-0/+0
| | | | Pointed out by: obrien
* Move internal defines from ctype.h hereache2002-08-191-0/+4
|
* Fix last-minute typo which breaks the world.sobomax2002-08-191-1/+1
| | | | Submitted by: many
* Move internal defines from here to libc/locale/wcwidth.cache2002-08-192-6/+0
|
* Properly define SWIDTH1, add autowidth (was SWIDTH1)ache2002-08-192-2/+4
|
* mdoc(7) police: fixed the document date.ru2002-08-191-1/+1
| | | | Submitted by: iedowse
* First snapshot of UFS2 EA support.phk2002-08-191-7/+228
| | | | Sponsored by: DARPA & NAI Labs.
* Remove the SIS_LOCK/SIS_UNLOCK from sis_attach(). It makes WITNESSphk2002-08-191-3/+0
| | | | barf and there seem to be little room for contention during attach.
* Keep a copy of the credential used to mount filesystems around sophk2002-08-193-4/+9
| | | | | | | | | | | | | | | | | we can check and use it later on. Change the pieces of code which relied on mount->mnt_stat.f_owner to check which user mounted the filesystem. This became needed as the EA code needs to be able to allocate blocks for "system" EA users like ACLs. There seems to be some half-baked (probably only quarter- actually) notion that the superuser for a given filesystem is the user who mounted it, but this has far from been carried through. It is unclear if it should be. Sponsored by: DARPA & NAI Labs.
* Major cleanup of the parser and printing routines in an attempt toluigi2002-08-192-209/+375
| | | | | | | | | | | | | | | | | | | render the syntax less ambiguous. Now rules can be in one of these two forms <action> <protocol> from <src> to <dst> [options] <action> MAC dst-mac src-mac mac-type [options] however you can now specify MAC and IP header fields as options e.g. ipfw add allow all from any to any mac-type arp ipfw add allow all from any to any { dst-ip me or src-ip me } which makes complex expressions a lot easier to write and parse. The "all from any to any" part is there just for backward compatibility. Manpage updated accordingly.
* Raise limit for port lists to 30 entries/ranges.luigi2002-08-191-6/+4
| | | | | Remove a duplicate "logging" message, and identify the firewall as ipfw2 in the boot message.
* Leave room for a trailing NUL not a NULL, that's not an ASCII character.jmallett2002-08-192-2/+2
|
* Remove local prototypes for main().jmallett2002-08-1916-20/+0
|
* Add a unary -not operator ala -false and !, for sake of completeness.jmallett2002-08-192-0/+2
| | | | | Obtained from: OpenDarwin MFC after: 1 week
OpenPOWER on IntegriCloud