summaryrefslogtreecommitdiffstats
path: root/sys/fs/procfs/procfs_vnops.c
Commit message (Collapse)AuthorAgeFilesLines
* Pseudofsize procfs(5).des2001-12-041-1023/+0
|
* Correctly unlock the target process if /proc/$foo/mem is open()ed bygreen2001-11-061-1/+1
| | | | | | | another process which cannot p_candebug() it. The bug was introduced in rev. 1.100. Approved by: des
* No, you may not /* FALLTHROUGH */. Not only will you return an incorrectdes2001-10-221-1/+1
| | | | | | | result, but you'd corrupt the kernel malloc() arena if it weren't for a small but life-saving optimization in ioctl(). MFC after: 1 week
* In procfs_readdir(), when the directory being read was a process directory,des2001-10-071-1/+3
| | | | | | | | | | | the target process was being held locked during the uiomove() call. If the process calling readdir() was the same as the target process (for instance 'ls /proc/curproc/'), and uiomove() caused a page fault, the result would be a proc lock recursion. I have no idea how long this has been broken - possibly ever since pfind() was changed to lock the process it returns. Also replace the one and only call to procfs_findtextvp() with a direct test of td->td_proc->p_textvp.
* KSE Milestone 2julian2001-09-121-21/+25
| | | | | | | | | | | | | | Note ALL MODULES MUST BE RECOMPILED make the kernel aware that there are smaller units of scheduling than the process. (but only allow one thread per process at this time). This is functionally equivalent to teh previousl -current except that there is a thread associated with each process. Sorry john! (your next MFC will be a doosie!) Reviewed by: peter@freebsd.org, dillon@freebsd.org X-MFC after: ha ha ha ha
* Collapse a Pmem case in with the other debugging files case for procfs,rwatson2001-08-031-5/+2
| | | | | | | | as there are now "unusual" protection properties to Pmem that differ from the other files. While I'm at it, introduce proc locking for the other files, which was previously present only in the Pmem case. Obtained from: TrustedBSD Project
* Prior to support for almost all ps activity via sysctl, ps used procfs,rwatson2001-08-031-6/+5
| | | | | | | | | | | | | | | | | | | | and so special-casing was introduced to provide extra procfs privilege to the kmem group. With the advent of non-setgid kmem ps, this code is no longer required, and in fact, can is potentially harmful as it allocates privilege to a gid that is increasingly less meaningful. Knowledge of specific gid's in kernel is also generally bad precedent, as the kernel security policy doesn't distinguish gid's specifically, only uid 0. This commit removes reference to kmem in procfs, both in terms of access control decisions, and the applying of gid kmem to the /proc/*/mem file, simplifying the associated code considerably. Processes are still permitted to access the mem file based on the debugging policy, so ps -e still works fine for normal processes and use. Reviewed by: tmm Obtained from: TrustedBSD Project
* o Replace calls to p_can(..., P_CAN_xxx) with calls to p_canxxx().rwatson2001-07-051-9/+9
| | | | | | | | | | | | | | | | | | | | | The p_can(...) construct was a premature (and, it turns out, awkward) abstraction. The individual calls to p_canxxx() better reflect differences between the inter-process authorization checks, such as differing checks based on the type of signal. This has a side effect of improving code readability. o Replace direct credential authorization checks in ktrace() with invocation of p_candebug(), while maintaining the special case check of KTR_ROOT. This allows ktrace() to "play more nicely" with new mandatory access control schemes, as well as making its authorization checks consistent with other "debugging class" checks. o Eliminate "privused" construct for p_can*() calls which allowed the caller to determine if privilege was required for successful evaluation of the access control check. This primitive is currently unused, and as such, serves only to complicate the API. Approved by: ({procfs,linprocfs} changes) des Obtained from: TrustedBSD Project
* o Merge contents of struct pcred into struct ucred. Specifically, add therwatson2001-05-251-3/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | real uid, saved uid, real gid, and saved gid to ucred, as well as the pcred->pc_uidinfo, which was associated with the real uid, only rename it to cr_ruidinfo so as not to conflict with cr_uidinfo, which corresponds to the effective uid. o Remove p_cred from struct proc; add p_ucred to struct proc, replacing original macro that pointed. p->p_ucred to p->p_cred->pc_ucred. o Universally update code so that it makes use of ucred instead of pcred, p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo, cr_{r,sv}{u,g}id instead of p_*, etc. o Remove pcred0 and its initialization from init_main.c; initialize cr_ruidinfo there. o Restruction many credential modification chunks to always crdup while we figure out locking and optimizations; generally speaking, this means moving to a structure like this: newcred = crdup(oldcred); ... p->p_ucred = newcred; crfree(oldcred); It's not race-free, but better than nothing. There are also races in sys_process.c, all inter-process authorization, fork, exec, and exit. o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid; remove comments indicating that the old arrangement was a problem. o Restructure exec1() a little to use newcred/oldcred arrangement, and use improved uid management primitives. o Clean up exit1() so as to do less work in credential cleanup due to pcred removal. o Clean up fork1() so as to do less work in credential cleanup and allocation. o Clean up ktrcanset() to take into account changes, and move to using suser_xxx() instead of performing a direct uid==0 comparision. o Improve commenting in various kern_prot.c credential modification calls to better document current behavior. In a couple of places, current behavior is a little questionable and we need to check POSIX.1 to make sure it's "right". More commenting work still remains to be done. o Update credential management calls, such as crfree(), to take into account new ruidinfo reference. o Modify or add the following uid and gid helper routines: change_euid() change_egid() change_ruid() change_rgid() change_svuid() change_svgid() In each case, the call now acts on a credential not a process, and as such no longer requires more complicated process locking/etc. They now assume the caller will do any necessary allocation of an exclusive credential reference. Each is commented to document its reference requirements. o CANSIGIO() is simplified to require only credentials, not processes and pcreds. o Remove lots of (p_pcred==NULL) checks. o Add an XXX to authorization code in nfs_lock.c, since it's questionable, and needs to be considered carefully. o Simplify posix4 authorization code to require only credentials, not processes and pcreds. Note that this authorization, as well as CANSIGIO(), needs to be updated to use the p_cansignal() and p_cansched() centralized authorization routines, as they currently do not take into account some desirable restrictions that are handled by the centralized routines, as well as being inconsistent with other similar authorization instances. o Update libkvm to take these changes into account. Obtained from: TrustedBSD Project Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit
* - FDESC, FIFO, NULL, PORTAL, PROC, UMAP and UNION fileru2001-05-231-1/+1
| | | | | | | | | | | | | | | systems were repo-copied from sys/miscfs to sys/fs. - Renamed the following file systems and their modules: fdesc -> fdescfs, portal -> portalfs, union -> unionfs. - Renamed corresponding kernel options: FDESC -> FDESCFS, PORTAL -> PORTALFS, UNION -> UNIONFS. - Install header files for the above file systems. - Removed bogus -I${.CURDIR}/../../sys CFLAGS from userland Makefiles.
* GC prototype for procfs_bmap() missed during a previous commit.jhb2001-05-111-1/+0
|
* Undo part of the tangle of having sys/lock.h and sys/mutex.h included inmarkm2001-05-011-8/+13
| | | | | | | | | | | other "system" header files. Also help the deprecation of lockmgr.h by making it a sub-include of sys/lock.h and removing sys/lockmgr.h form kernel .c files. Sort sys/*.h includes where possible in affected files. OK'ed by: bde (with reservations)
* Add a vop_stdbmap(), and make it part of the default vop vector.phk2001-04-291-31/+0
| | | | | | Make 7 filesystems which don't really know about VOP_BMAP rely on the default vector, rather than more or less complete local vop_nopbmap() implementations.
* Revert consequences of changes to mount.h, part 2.grog2001-04-291-2/+0
| | | | Requested by: bde
* Change the pfind() and zpfind() functions to lock the process that theyjhb2001-04-241-38/+43
| | | | | | find before releasing the allproc lock and returning. Reviewed by: -smp, dfr, jake
* Correct #includes to work with fixed sys/mount.h.grog2001-04-231-0/+2
|
* Convert the allproc and proctree locks from lockmgr locks to sx locks.jhb2001-03-281-2/+3
|
* Proc locking identical to that of linprocfs' vnops except that we hold thejhb2001-03-071-18/+59
| | | | proc lock while calling psignal.
* Mechanical change to use <sys/queue.h> macro API instead ofphk2001-02-041-1/+1
| | | | | | | fondling implementation details. Created with: sed(1) Reviewed by: md5(1)
* Use macro API to <sys/queue.h>phk2000-12-311-4/+4
|
* - Change the allproc_lock to use a macro, ALLPROC_LOCK(how), insteadjake2000-12-131-1/+4
| | | | | | | | of explicit calls to lockmgr. Also provides macros for the flags pased to specify shared, exclusive or release which map to the lockmgr flags. This is so that the use of lockmgr can be easily replaced with optimized reader-writer locks. - Add some locking that I missed the first time.
* return correct type for process directory entries, DT_DIR not DT_REGalfred2000-10-051-1/+1
|
* Remove a comment that has been not only obsolete but patently wrong for thedes2000-09-041-8/+0
| | | | last 31 revisions (almost three years).
* o Simplify if/then clause equating ESRCH with ENOENT when hiding a processrwatson2000-09-011-5/+2
| | | | Submitted by: des
* o Make procfs use vaccess() for procfs_access() DAC and super-user checks,rwatson2000-09-011-28/+4
| | | | | | | rather than implementing its own {uid,gid,other} checks against vnode mode. Similar change to linprocfs currently under review. Obtained from: TrustedBSD Project
* o Centralize inter-process access control, introducing:rwatson2000-08-301-16/+33
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | int p_can(p1, p2, operation, privused) which allows specification of subject process, object process, inter-process operation, and an optional call-by-reference privused flag, allowing the caller to determine if privilege was required for the call to succeed. This allows jail, kern.ps_showallprocs and regular credential-based interaction checks to occur in one block of code. Possible operations are P_CAN_SEE, P_CAN_SCHED, P_CAN_KILL, and P_CAN_DEBUG. p_can currently breaks out as a wrapper to a series of static function checks in kern_prot, which should not be invoked directly. o Commented out capabilities entries are included for some checks. o Update most inter-process authorization to make use of p_can() instead of manual checks, PRISON_CHECK(), P_TRESPASS(), and kern.ps_showallprocs. o Modify suser{,_xxx} to use const arguments, as it no longer modifies process flags due to the disabling of ASU. o Modify some checks/errors in procfs so that ENOENT is returned instead of ESRCH, further improving concealment of processes that should not be visible to other processes. Also introduce new access checks to improve hiding of processes for procfs_lookup(), procfs_getattr(), procfs_readdir(). Correct a bug reported by bp concerning not handling the CREATE case in procfs_lookup(). Remove volatile flag in procfs that caused apparently spurious qualifier warnigns (approved by bde). o Add comment noting that ktrace() has not been updated, as its access control checks are different from ptrace(), whereas they should probably be the same. Further discussion should happen on this topic. Reviewed by: bde, green, phk, freebsd-security, others Approved by: bde Obtained from: TrustedBSD Project
* Introduce vop_stdinactive() and make it the default if no vop_inactivephk2000-08-181-24/+0
| | | | | | is declared. Sort and prune a few vop_op[].
* Move procfs_fullpath() to vfs_cache.c, with a rename to textvp_fullpath().green2000-04-261-2/+2
| | | | | | | | | | There's no excuse to have code in synthetic filestores that allows direct references to the textvp anymore. Feature requested by: msmith Feature agreed to by: warner Move requested by: phk Move agreed to by: bde
* Quiet an unused variable warning by commenting out a variable declarationgreen2000-04-221-1/+1
| | | | that goes with a commented out statement.
* Welcome back our old friend from procfs, "file"!green2000-04-221-19/+50
|
* Introduce NDFREE (and remove VOP_ABORTOP)eivind1999-12-151-21/+0
|
* Introduce the new functionphk1999-11-211-2/+2
| | | | | | | | | | | | | | p_trespass(struct proc *p1, struct proc *p2) which returns zero or an errno depending on the legality of p1 trespassing on p2. Replace kern_sig.c:CANSIGNAL() with call to p_trespass() and one extra signal related check. Replace procfs.h:CHECKIO() macros with calls to p_trespass(). Only show command lines to process which can trespass on the target process.
* The function `procfs_getattr()' in procfs doesn't set the value ofphk1999-11-171-0/+2
| | | | | | | | vap->va_fsid, so we cannot get valid information about procfs. Submitted by: SAWADA Mizuki miz@pa.aix.or.jp Reviewed by: phk PR: 1654
* Make an incredibly stupid change because Warner threatened to do it andsef1999-11-071-1/+0
| | | | | | | | | | | | | | | | | | | continue doing it despite objections by me (the principal author). Note that this doesn't fix the real problem -- the real problem is generally bad setup by ignorant users, and education is the right way to fix it. So while this doesn't actually solve the prolem mentioned in the complaint (since it's still possible to do it via other methods, although they mostly involve a bit more complicity), and there are better methods to do this, nobody was willing or able to provide me with a real world example that couldn't be worked around using the existing permissions and group mechanism. And therefore, security by removing features is the method of the day. I only had three applications that used it, in any event. One of them would have made debugging easier, but I still haven't finished it, and won't now, so it doesn't really matter.
* $Id$ -> $FreeBSD$peter1999-08-281-1/+1
|
* Allow jailed proccesses to open non-process vnodes like the root of the fs.phk1999-07-091-2/+2
|
* Implement support for hardware debug registers on the i386.jlemon1999-07-091-1/+7
| | | | Submitted by: Brian Dean <brdean@unx.sas.com>
* Eliminate the bogus procfs private almost struct dirent structure.phk1999-06-131-23/+24
| | | | | Spotted by: Lars Hamren Reviewed by: bde
* Make the type and map files claim 0 bytes size. Tar doesn't get confusedphk1999-05-041-13/+10
| | | | | | now, but doesn't store any data eiter. I wonder if we shouldn't claim to be fifos instead...
* Add a new "file" to procfs: "rlimit" which shows the resource limits forphk1999-04-301-1/+3
| | | | | | | | the process. PR: 11342 Submitted by: Adrian Chadd adrian@freebsd.org Reviewed by: phk
* This Implements the mumbled about "Jail" feature.phk1999-04-281-1/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is a seriously beefed up chroot kind of thing. The process is jailed along the same lines as a chroot does it, but with additional tough restrictions imposed on what the superuser can do. For all I know, it is safe to hand over the root bit inside a prison to the customer living in that prison, this is what it was developed for in fact: "real virtual servers". Each prison has an ip number associated with it, which all IP communications will be coerced to use and each prison has its own hostname. Needless to say, you need more RAM this way, but the advantage is that each customer can run their own particular version of apache and not stomp on the toes of their neighbors. It generally does what one would expect, but setting up a jail still takes a little knowledge. A few notes: I have no scripts for setting up a jail, don't ask me for them. The IP number should be an alias on one of the interfaces. mount a /proc in each jail, it will make ps more useable. /proc/<pid>/status tells the hostname of the prison for jailed processes. Quotas are only sensible if you have a mountpoint per prison. There are no privisions for stopping resource-hogging. Some "#ifdef INET" and similar may be missing (send patches!) If somebody wants to take it from here and develop it into more of a "virtual machine" they should be most welcome! Tools, comments, patches & documentation most welcome. Have fun... Sponsored by: http://www.rndassociates.com/ Run for almost a year by: http://www.servetheweb.com/
* Suser() simplification:phk1999-04-271-3/+3
| | | | | | | | | | | | | | | | | | | 1: s/suser/suser_xxx/ 2: Add new function: suser(struct proc *), prototyped in <sys/proc.h>. 3: s/suser_xxx(\([a-zA-Z0-9_]*\)->p_ucred, \&\1->p_acflag)/suser(\1)/ The remaining suser_xxx() calls will be scrutinized and dealt with later. There may be some unneeded #include <sys/cred.h>, but they are left as an exercise for Bruce. More changes to the suser() API will come along with the "jail" code.
* Fix warnings in preparation for adding -Wall -Wcast-qual to thedillon1999-01-271-6/+6
| | | | kernel compile
* A partial implementation of the procfs cmdline pseudo-file. Thispeter1999-01-051-1/+3
| | | | | | | | is enough to satisfy things like StarOffice. This is a hack, but doing it properly would be a LOT of work, and would require extensive grovelling around in the user address space to find the argv[]. Obtained from: Mostly from Andrzej Bialecki <abial@nask.pl>.
* Examine all occurrences of sprintf(), strcat(), and str[n]cpy()archie1998-12-041-3/+3
| | | | | | | | | | | | | | for possible buffer overflow problems. Replaced most sprintf()'s with snprintf(); for others cases, added terminating NUL bytes where appropriate, replaced constants like "16" with sizeof(), etc. These changes include several bug fixes, but most changes are for maintainability's sake. Any instance where it wasn't "immediately obvious" that a buffer overflow could not occur was made safer. Reviewed by: Bruce Evans <bde@zeta.org.au> Reviewed by: Matthew Dillon <dillon@apollo.backplane.com> Reviewed by: Mike Spengler <mks@networkcs.com>
* Fixed printf format errors.bde1998-07-111-3/+3
|
* Remove "not hungly" panics. Cookies now used by the linux and ibcs2dt1998-06-251-10/+3
| | | | | | | emulators. The emulators assume that filesystem may just ignore cookies, and handle this case correctly. So we just ignore cookies. Also sync *_readdir "prototypes" with reality.
* Avoid a 64-bit division in procfs_readdir(). Fixed related overflows.bde1998-06-141-10/+6
| | | | | | | | | | | | Check args using the same expression as in fdesc and kernfs. The check was actually already correct, modulo overflow. It could be tightened up to either allow huge (aligned) offsets, treating them as EOF, or disallow all offsets beyond EOF. Didn't fix invalid address calculation &foo[i] where i may be out of bounds. Didn't fix shooting of foot using a private unportable dirent struct.
* Don't silently accept attempts to change flags where they are notpeter1998-06-101-1/+5
| | | | supported.
* Disallow reading the current kernel stack. Only the user structure andtegge1998-05-191-2/+2
| | | | | the current registers should be accessible. Reviewed by: David Greenman <dg@root.com>
OpenPOWER on IntegriCloud