summaryrefslogtreecommitdiffstats
path: root/sys/compat
Commit message (Collapse)AuthorAgeFilesLines
...
* Make similar changes to fo_stat() and fo_poll() as made earlier torwatson2002-08-161-6/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | fo_read() and fo_write(): explicitly use the cred argument to fo_poll() as "active_cred" using the passed file descriptor's f_cred reference to provide access to the file credential. Add an active_cred argument to fo_stat() so that implementers have access to the active credential as well as the file credential. Generally modify callers of fo_stat() to pass in td->td_ucred rather than fp->f_cred, which was redundantly provided via the fp argument. This set of modifications also permits threads to perform these operations on behalf of another thread without modifying their credential. Trickle this change down into fo_stat/poll() implementations: - badfo_poll(), badfo_stat(): modify/add arguments. - kqueue_poll(), kqueue_stat(): modify arguments. - pipe_poll(), pipe_stat(): modify/add arguments, pass active_cred to MAC checks rather than td->td_ucred. - soo_poll(), soo_stat(): modify/add arguments, pass fp->f_cred rather than cred to pru_sopoll() to maintain current semantics. - sopoll(): moidfy arguments. - vn_poll(), vn_statfile(): modify/add arguments, pass new arguments to vn_stat(). Pass active_cred to MAC and fp->f_cred to VOP_POLL() to maintian current semantics. - vn_close(): rename cred to file_cred to reflect reality while I'm here. - vn_stat(): Add active_cred and file_cred arguments to vn_stat() and consumers so that this distinction is maintained at the VFS as well as 'struct file' layer. Pass active_cred instead of td->td_ucred to MAC and to VOP_GETATTR() to maintain current semantics. - fifofs: modify the creation of a "filetemp" so that the file credential is properly initialized and can be used in the socket code if desired. Pass ap->a_td->td_ucred as the active credential to soo_poll(). If we teach the vnop interface about the distinction between file and active credentials, we would use the active credential here. Note that current inconsistent passing of active_cred vs. file_cred to VOP's is maintained. It's not clear why GETATTR would be authorized using active_cred while POLL would be authorized using file_cred at the file system level. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* In order to better support flexible and extensible access control,rwatson2002-08-151-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | make a series of modifications to the credential arguments relating to file read and write operations to cliarfy which credential is used for what: - Change fo_read() and fo_write() to accept "active_cred" instead of "cred", and change the semantics of consumers of fo_read() and fo_write() to pass the active credential of the thread requesting an operation rather than the cached file cred. The cached file cred is still available in fo_read() and fo_write() consumers via fp->f_cred. These changes largely in sys_generic.c. For each implementation of fo_read() and fo_write(), update cred usage to reflect this change and maintain current semantics: - badfo_readwrite() unchanged - kqueue_read/write() unchanged pipe_read/write() now authorize MAC using active_cred rather than td->td_ucred - soo_read/write() unchanged - vn_read/write() now authorize MAC using active_cred but VOP_READ/WRITE() with fp->f_cred Modify vn_rdwr() to accept two credential arguments instead of a single credential: active_cred and file_cred. Use active_cred for MAC authorization, and select a credential for use in VOP_READ/WRITE() based on whether file_cred is NULL or not. If file_cred is provided, authorize the VOP using that cred, otherwise the active credential, matching current semantics. Modify current vn_rdwr() consumers to pass a file_cred if used in the context of a struct file, and to always pass active_cred. When vn_rdwr() is used without a file_cred, pass NOCRED. These changes should maintain current semantics for read/write, but avoid a redundant passing of fp->f_cred, as well as making it more clear what the origin of each credential is in file descriptor read/write operations. Follow-up commits will make similar changes to other file descriptor operations, and modify the MAC framework to pass both credentials to MAC policy modules so they can implement either semantic for revocation. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* On MAC check failure for readdir, use 'goto out' to use the common exitrwatson2002-08-151-1/+1
| | | | | | | | handling, rather than returning directly to prevent leaking of vnode reference/lock. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* - Add the missing td argument to vn_lock that I missed in my last commit.jeff2002-08-131-1/+1
|
* - Hold the vnode lock throughout execve.jeff2002-08-132-18/+23
| | | | | - Set VV_TEXT in the top level execve code. - Fixup the image activators to deal with the newly locked vnode.
* Enforce MAC policies for the locally implemented vnode services inrwatson2002-08-122-0/+28
| | | | | | | | | | SVR4 emulation relating to readdir() and fd_revoke(). All other services appear to be implemented by simply wrapping existing FreeBSD native system call implementations, so don't require local instrumentation in the emulator module. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Another fix that wasn't pulled in from the MAC branch: therwatson2002-08-121-1/+2
| | | | | | | | struct mount is not cached as *mp at this point, so use vp->v_mount directly, following the check that it's non-NULL. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Fix missing parens in MAC readdir() check. This fix was in the MACrwatson2002-08-121-1/+1
| | | | | | | branch, but apparently didn't get moved over when it was made. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* - Replace v_flag with v_iflag and v_vflagjeff2002-08-044-4/+7
| | | | | | | | | | | | | | | - v_vflag is protected by the vnode lock and is used when synchronization with VOP calls is needed. - v_iflag is protected by interlock and is used for dealing with vnode management issues. These flags include X/O LOCK, FREE, DOOMED, etc. - All accesses to v_iflag and v_vflag have either been locked or marked with mp_fixme's. - Many ASSERT_VOP_LOCKED calls have been added where the locking was not clear. - Many functions in vfs_subr.c were restructured to provide for stronger locking. Idea stolen from: BSD/OS
* Introduce support for Mandatory Access Control and extensiblerwatson2002-08-014-2/+45
| | | | | | | | | | | | kernel access control. Invoke appropriate MAC entry points for a number of VFS-related operations in the Linux ABI module. In particular, handle uselib in a manner similar to open() (more work is probably needed here), as well as handle statfs(), and linux readdir()-like calls. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Regeneratepeter2002-07-203-1596/+311
|
* Infrastructure tweaks to allow having both an Elf32 and an Elf64 executablepeter2002-07-209-335/+2332
| | | | | | | | | | | | | | | handler in the kernel at the same time. Also, allow for the exec_new_vmspace() code to build a different sized vmspace depending on the executable environment. This is a big help for execing i386 binaries on ia64. The ELF exec code grows the ability to map partial pages when there is a page size difference, eg: emulating 4K pages on 8K or 16K hardware pages. Flesh out the i386 emulation support for ia64. At this point, the only binary that I know of that fails is cvsup, because the cvsup runtime tries to execute code in pages not marked executable. Obtained from: dfr (mostly, many tweaks from me).
* Move the switch statement labels for the explicit 64-bitrobert2002-07-091-3/+3
| | | | | | | | command arguments into the correct function, linux_fcntl64(), and thus out of the scope of a compilation for the alpha platform. Requested by: obrien
* Enable emulation of the F_GETLK64, F_SETLK64, and F_SETLKW64robert2002-07-091-0/+3
| | | | lock commands arguments to linux_fcntl64().
* The comment marked with XXX was right: emulate SVR4 forrobert2002-07-091-1/+1
| | | | | | ELF binaries branded with ELFOSABI_SYSV, this is reported to work and brandelf(1) puts this type into files if "SVR4" was specified.
* Part 1 of KSE-IIIjulian2002-06-292-22/+48
| | | | | | | | | | | | | The ability to schedule multiple threads per process (one one cpu) by making ALL system calls optionally asynchronous. to come: ia64 and power-pc patches, patches for gdb, test program (in tools) Reviewed by: Almost everyone who counts (at various times, peter, jhb, matt, alfred, mini, bernd, and a cast of thousands) NOTE: this is still Beta code, and contains lots of debugging stuff. expect slight instability in signals..
* - Remove the Giant acquisition from linux_socket_ioctl() as it was reallyarr2002-06-261-11/+2
| | | | | | | | there to protect fdrop() (which in turn can call vrele()), however, fdrop_locked() grabs Giant for us, so we do not have to. Reviewed by: jhb Inspired by: alc
* Add a comment about how we should use vn_open() here instead of directlyrwatson2002-06-141-0/+4
| | | | | invoking VOP_OPEN(). This would reduce code redundancy with the rest of the kernel, and also is required for MAC to work properly.
* catch up with ktrace changes, KTRPOINT takes a 'struct thread' notalfred2002-06-111-2/+2
| | | | 'struct proc' now.
* Catch up to changes in ktrace API.jhb2002-06-071-2/+2
|
* Fix typo in the BSD copyright: s/withough/without/schweikh2002-06-029-9/+9
| | | | | Spotted and suggested by: des MFC after: 3 weeks
* Back out my lats commit of locking down a socket, it conflicts with hsu's work.tanimura2002-05-312-23/+10
| | | | Requested by: hsu
* correct commented out preprocessor test for i386 to __i386__alfred2002-05-301-1/+1
|
* Fixed a printf format error. It was old and should have been detected bybde2002-05-251-1/+1
| | | | gcc-2.9x, but somehow wasn't fixed already.
* Lock down a socket, milestone 1.tanimura2002-05-202-10/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | o Add a mutex (sb_mtx) to struct sockbuf. This protects the data in a socket buffer. The mutex in the receive buffer also protects the data in struct socket. o Determine the lock strategy for each members in struct socket. o Lock down the following members: - so_count - so_options - so_linger - so_state o Remove *_locked() socket APIs. Make the following socket APIs touching the members above now require a locked socket: - sodisconnect() - soisconnected() - soisconnecting() - soisdisconnected() - soisdisconnecting() - sofree() - soref() - sorele() - sorwakeup() - sotryfree() - sowakeup() - sowwakeup() Reviewed by: alfred
* Change p_can{debug,see,sched,signal}()'s first argument to be a threadjhb2002-05-191-1/+1
| | | | | | | pointer instead of a proc pointer and require the process pointed to by the second argument to be locked. We now use the thread ucred reference for the credential checks in p_can*() as a result. p_canfoo() should now no longer need Giant.
* In msgrcv(), set msgtyp correctly. Hardwiring 0 as the message typemarcel2002-05-181-1/+1
| | | | | | | | | | yields incorrect behaviour. The hardwiring was present in the very first commit that implemented msgrcv() (revision 1.4) and hasn't been changed since. The native implementation was complete at that time, so there doesn't seem to be a reason for the hardwiring from a technical point of view. Submitted by: Reinier Bezuidenhout <rbezuide@yahoo.com>
* sysctl -w -> sysctldd2002-05-111-2/+2
|
* Zap some stale unused headers, including one machine/psl.h (which ispeter2002-05-011-6/+0
| | | | a stub on alpha). Compile tested on alpha and x86.
* Add an XXX: linux_uselib() should be using vn_open() rather than invokingrwatson2002-04-201-0/+4
| | | | | | | | | | | VOP_OPEN() and doing lots of manual checking. This would further centralize use of the name functions, and once the MAC code is integrated, meaning few extraneous MAC checks scattered all over the place. I don't have time to fix this now, but want to make sure it doesn't get forgotten. Anyone interested in fixing this should feel free. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* - Lock proctree_lock instead of pgrpsess_lock.jhb2002-04-161-1/+1
| | | | - Exclusively lock proctree_lock while calling leavepgrp().
* Rework logic of syscalls that modify process credentials as described injhb2002-04-132-25/+39
| | | | rev 1.152 of sys/kern/kern_prot.c.
* - p_cansee() needs the target process locked.jhb2002-04-131-17/+15
| | | | - We need the proc lock held for more of procfs_doprocstatus().
* Use proc lock to protect p_ucred pointer while we deference it to read ajhb2002-04-111-0/+4
| | | | few values.
* Use td_ucred in a few spots.jhb2002-04-111-3/+3
|
* Initial support for executing IA-32 binaries. This will not compiledfr2002-04-106-0/+2839
| | | | | | | | | without a few patches for the rest of the kernel to allow the image activator to override exec_copyout_strings and setregs. None of the syscall argument translation has been done. Possibly, this translation layer can be shared with any platform that wants to support running ILP32 binaries on an LP64 host (e.g. sparc32 binaries?)
* - Change fill_kinfo_proc() to require that the process is locked when itjhb2002-04-092-4/+7
| | | | | | | | | | | | | | is called. - Change sysctl_out_proc() to require that the process is locked when it is called and to drop the lock before it returns. If this proves too complex we can change sysctl_out_proc() to simply acquire the lock at the very end and have the calling code drop the lock right after it returns. - Lock the process we are going to export before the p_cansee() in the loop in sysctl_kern_proc() and hold the lock until we call sysctl_out_proc(). - Don't call p_cansee() on the process about to be exported twice in the aforementioned loop.
* Moved signal handling and rescheduling from userret() to ast() so thatbde2002-04-042-0/+5
| | | | | | | | | | | they aren't in the usual path of execution for syscalls and traps. The main complication for this is that we have to set flags to control ast() everywhere that changes the signal mask. Avoid locking in userret() in most of the remaining cases. Submitted by: luoqi (first part only, long ago, reorganized by me) Reminded by: dillon
* Change the suser() API to take advantage of td_ucred as well as do ajhb2002-04-015-6/+6
| | | | | | | | | | | | general cleanup of the API. The entire API now consists of two functions similar to the pre-KSE API. The suser() function takes a thread pointer as its only argument. The td_ucred member of this thread must be valid so the only valid thread pointers are curthread and a few kernel threads such as thread0. The suser_cred() function takes a pointer to a struct ucred as its first argument and an integer flag as its second argument. The flag is currently only used for the PRISON_ROOT flag. Discussed on: smp@
* Protect proc struct (p_args and p_comm) when doing procfs IO that pullsalfred2002-03-291-11/+17
| | | | | | data from it. Submitted by: Jonathan Mini <mini@haikugeek.com>
* Make the reference counting of 'struct pargs' SMP safe.alfred2002-03-271-2/+1
| | | | | | | | | There is still some locations where the PROC lock should be held in order to prevent inconsistent views from outside (like the proc->p_fd fix for kern/vfs_syscalls.c:checkdirs()) that can be fixed later. Submitted by: Jonathan Mini <mini@haikugeek.com>
* Fixed some style bugs in the removal of __P(()). Tabs before "__P(("bde2002-03-241-6/+6
| | | | were not removed.
* Remove references to vm_zone.h and switch over to the new uma API.jeff2002-03-204-5/+2
|
* Remove __P.alfred2002-03-2026-280/+274
|
* Simple p_ucred -> td_ucred changes to start using the per-thread ucredjhb2002-02-279-23/+22
| | | | reference.
* Use the updated getcredhostname() function.robert2002-02-272-5/+2
|
* - Use the new getcredhostname function in the SVR4 uname system call.robert2002-02-271-2/+3
| | | | | | - Remove spurious empty line. Reviewed by: phk
* Use the getcredhostname function to fill the hostname intorobert2002-02-271-1/+3
| | | | | | | | the linux_newuname_args structure. This should fix the case of jailed linux processes not using the jail's hostname. PR: 35336 Reviewed by: phk
* remove "discards qualifier" erro by not potentially writing tojulian2002-02-261-2/+5
| | | | a const *.
* Lock struct pgrp, session and sigio.tanimura2002-02-233-3/+12
| | | | | | | | | | | | | | | | | | | | | | | | | New locks are: - pgrpsess_lock which locks the whole pgrps and sessions, - pg_mtx which protects the pgrp members, and - s_mtx which protects the session members. Please refer to sys/proc.h for the coverage of these locks. Changes on the pgrp/session interface: - pgfind() needs the pgrpsess_lock held. - The caller of enterpgrp() is responsible to allocate a new pgrp and session. - Call enterthispgrp() in order to enter an existing pgrp. - pgsignal() requires a pgrp lock held. Reviewed by: jhb, alfred Tested on: cvsup.jp.FreeBSD.org (which is a quad-CPU machine running -current)
OpenPOWER on IntegriCloud