summaryrefslogtreecommitdiffstats
path: root/sys/kern/kern_acct.c
Commit message (Collapse)AuthorAgeFilesLines
* Hold the proc lock across a wider range of fields that it protects.jhb2003-04-171-2/+2
|
* Trim some trailing whitespace.jhb2003-03-131-2/+2
|
* Remove the PL_SHAREMOD flag from struct plimit, which could have beentjr2003-02-201-2/+1
| | | | | | used to share resource limits between rfork threads, but never was. Removing it makes resource limit locking much simpler -- only the current process can change the contents of the structure that p_limit points to.
* unwrap lines made short enough by SCARGS removalalfred2002-12-141-2/+1
|
* remove syscallarg().alfred2002-12-141-1/+1
| | | | Suggested by: peter
* SCARGS removal take II.alfred2002-12-141-3/+3
|
* Backout removal SCARGS, the code freeze is only "selectively" over.alfred2002-12-131-3/+3
|
* Remove SCARGS.alfred2002-12-131-3/+3
| | | | Reviewed by: md5
* Don't hold acct_mtx over limcopy(), since it's unnecessary andfenner2002-11-261-6/+7
| | | | | | limcopy() can sleep. Approved by: re
* Typo in comment: commmand -> commandkeramida2002-11-051-1/+1
| | | | Reviewed by: jhb
* Permit MAC policies to instrument the access control decisions forrwatson2002-11-041-0/+16
| | | | | | | | | | | system accounting configuration and for nfsd server thread attach. Policies might use this to protect the integrity or confidentiality of accounting data, limit the ability to turn on or off accounting, as well as to prevent inappropriately labeled threads from becoming nfs server threads. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Make sure that the accounting credential is saved along with the vprwatson2002-10-051-0/+1
| | | | | | | when accounting is suspended--otherwise when accounting is restored, we may incorrectly assume the credential is valid. Panics experienced by: juli
* Don't call VOP_LEASE() while holding the accounting mutex.rwatson2002-09-181-1/+1
|
* - Fix two obvious locking bugs; 1) returning with lock held when it neededarr2002-09-121-3/+16
| | | | | | | to be dropped, 2) attempting to lock acct_mtx while already holding it. Sorry to those who experienced pain. - Added two comments referring to two areas in which acct_mtx is held over vnode operations that might sleep. Patch in the works for this.
* - Lock down the accounting code globals with a subsystem mutex.arr2002-09-111-5/+27
| | | | Reviewed by: jhb, mdodd
* In order to better support flexible and extensible access control,rwatson2002-08-151-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | make a series of modifications to the credential arguments relating to file read and write operations to cliarfy which credential is used for what: - Change fo_read() and fo_write() to accept "active_cred" instead of "cred", and change the semantics of consumers of fo_read() and fo_write() to pass the active credential of the thread requesting an operation rather than the cached file cred. The cached file cred is still available in fo_read() and fo_write() consumers via fp->f_cred. These changes largely in sys_generic.c. For each implementation of fo_read() and fo_write(), update cred usage to reflect this change and maintain current semantics: - badfo_readwrite() unchanged - kqueue_read/write() unchanged pipe_read/write() now authorize MAC using active_cred rather than td->td_ucred - soo_read/write() unchanged - vn_read/write() now authorize MAC using active_cred but VOP_READ/WRITE() with fp->f_cred Modify vn_rdwr() to accept two credential arguments instead of a single credential: active_cred and file_cred. Use active_cred for MAC authorization, and select a credential for use in VOP_READ/WRITE() based on whether file_cred is NULL or not. If file_cred is provided, authorize the VOP using that cred, otherwise the active credential, matching current semantics. Modify current vn_rdwr() consumers to pass a file_cred if used in the context of a struct file, and to always pass active_cred. When vn_rdwr() is used without a file_cred, pass NOCRED. These changes should maintain current semantics for read/write, but avoid a redundant passing of fp->f_cred, as well as making it more clear what the origin of each credential is in file descriptor read/write operations. Follow-up commits will make similar changes to other file descriptor operations, and modify the MAC framework to pass both credentials to MAC policy modules so they can implement either semantic for revocation. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Cache the credential provided during accton() for use in later accountingrwatson2002-08-071-5/+17
| | | | | | | | | | | | vnode operations. This permits the rights of the user (typically root) used to turn on accounting to be used when writing out accounting entries, rather than the credentials of the process generating the accounting record. This fixes accounting in a number of environments, including file systems that offer revocation support, MAC environments, some securelevel scenarios, and in some NFS environments. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Save flags returned by vn_open and use them when calling vn_close.johan2002-07-211-6/+11
| | | | | Reviewed by: bde Approved by: sheldonh (mentor)
* Open accounting file for appending, not general writing.johan2002-07-101-7/+8
| | | | | | | | | | This allows accton(1) to be used with an append-only file. PR: 7169 Reported by: Joao Carlos Mendes Luis <jonny@jonny.eng.br> Reviewed by: bde Approved by: sheldonh (mentor) MFC after: 2 weeks
* More s/file system/filesystem/gtrhodes2002-05-161-1/+1
|
* - Remove an early KSE diagnostic panic. The thread pointer here is alwaysjhb2002-04-091-4/+2
| | | | | | curthread. - We don't need Giant to do suser() checks now, so don't lock Giant until after the check.
* Change the suser() API to take advantage of td_ucred as well as do ajhb2002-04-011-1/+1
| | | | | | | | | | | | general cleanup of the API. The entire API now consists of two functions similar to the pre-KSE API. The suser() function takes a thread pointer as its only argument. The td_ucred member of this thread must be valid so the only valid thread pointers are curthread and a few kernel threads such as thread0. The suser_cred() function takes a pointer to a struct ucred as its first argument and an integer flag as its second argument. The flag is currently only used for the PRISON_ROOT flag. Discussed on: smp@
* Remove __P.alfred2002-03-191-2/+2
|
* Simple p_ucred -> td_ucred changes to start using the per-thread ucredjhb2002-02-271-4/+4
| | | | reference.
* Lock struct pgrp, session and sigio.tanimura2002-02-231-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | New locks are: - pgrpsess_lock which locks the whole pgrps and sessions, - pg_mtx which protects the pgrp members, and - s_mtx which protects the session members. Please refer to sys/proc.h for the coverage of these locks. Changes on the pgrp/session interface: - pgfind() needs the pgrpsess_lock held. - The caller of enterpgrp() is responsible to allocate a new pgrp and session. - Call enterthispgrp() in order to enter an existing pgrp. - pgsignal() requires a pgrp lock held. Reviewed by: jhb, alfred Tested on: cvsup.jp.FreeBSD.org (which is a quad-CPU machine running -current)
* o Move suser() calls in kern/ to using suser_xxx() with an explicitrwatson2001-11-011-1/+1
| | | | | | | | | credential selection, rather than reference via a thread or process pointer. This is part of a gradual migration to suser() accepting a struct ucred instead of a struct proc, simplifying the reference and locking semantics of suser(). Obtained from: TrustedBSD Project
* KSE Milestone 2julian2001-09-121-16/+17
| | | | | | | | | | | | | | Note ALL MODULES MUST BE RECOMPILED make the kernel aware that there are smaller units of scheduling than the process. (but only allow one thread per process at this time). This is functionally equivalent to teh previousl -current except that there is a thread associated with each process. Sorry john! (your next MFC will be a doosie!) Reviewed by: peter@freebsd.org, dillon@freebsd.org X-MFC after: ha ha ha ha
* Pushdown Giant for acct(), kqueue(), kevent(), execve(), fork(),dillon2001-09-011-4/+11
| | | | vfork(), rfork(), jail().
* o Reduce gratuitous whitespace difference from Darwin.rwatson2001-08-291-1/+0
|
* o Merge contents of struct pcred into struct ucred. Specifically, add therwatson2001-05-251-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | real uid, saved uid, real gid, and saved gid to ucred, as well as the pcred->pc_uidinfo, which was associated with the real uid, only rename it to cr_ruidinfo so as not to conflict with cr_uidinfo, which corresponds to the effective uid. o Remove p_cred from struct proc; add p_ucred to struct proc, replacing original macro that pointed. p->p_ucred to p->p_cred->pc_ucred. o Universally update code so that it makes use of ucred instead of pcred, p->p_ucred instead of p->p_pcred, cr_ruidinfo instead of p_uidinfo, cr_{r,sv}{u,g}id instead of p_*, etc. o Remove pcred0 and its initialization from init_main.c; initialize cr_ruidinfo there. o Restruction many credential modification chunks to always crdup while we figure out locking and optimizations; generally speaking, this means moving to a structure like this: newcred = crdup(oldcred); ... p->p_ucred = newcred; crfree(oldcred); It's not race-free, but better than nothing. There are also races in sys_process.c, all inter-process authorization, fork, exec, and exit. o Remove sigio->sio_ruid since sigio->sio_ucred now contains the ruid; remove comments indicating that the old arrangement was a problem. o Restructure exec1() a little to use newcred/oldcred arrangement, and use improved uid management primitives. o Clean up exit1() so as to do less work in credential cleanup due to pcred removal. o Clean up fork1() so as to do less work in credential cleanup and allocation. o Clean up ktrcanset() to take into account changes, and move to using suser_xxx() instead of performing a direct uid==0 comparision. o Improve commenting in various kern_prot.c credential modification calls to better document current behavior. In a couple of places, current behavior is a little questionable and we need to check POSIX.1 to make sure it's "right". More commenting work still remains to be done. o Update credential management calls, such as crfree(), to take into account new ruidinfo reference. o Modify or add the following uid and gid helper routines: change_euid() change_egid() change_ruid() change_rgid() change_svuid() change_svgid() In each case, the call now acts on a credential not a process, and as such no longer requires more complicated process locking/etc. They now assume the caller will do any necessary allocation of an exclusive credential reference. Each is commented to document its reference requirements. o CANSIGIO() is simplified to require only credentials, not processes and pcreds. o Remove lots of (p_pcred==NULL) checks. o Add an XXX to authorization code in nfs_lock.c, since it's questionable, and needs to be considered carefully. o Simplify posix4 authorization code to require only credentials, not processes and pcreds. Note that this authorization, as well as CANSIGIO(), needs to be updated to use the p_cansignal() and p_cansched() centralized authorization routines, as they currently do not take into account some desirable restrictions that are handled by the centralized routines, as well as being inconsistent with other similar authorization instances. o Update libkvm to take these changes into account. Obtained from: TrustedBSD Project Reviewed by: green, bde, jhb, freebsd-arch, freebsd-audit
* Undo part of the tangle of having sys/lock.h and sys/mutex.h included inmarkm2001-05-011-0/+2
| | | | | | | | | | | other "system" header files. Also help the deprecation of lockmgr.h by making it a sub-include of sys/lock.h and removing sys/lockmgr.h form kernel .c files. Sort sys/*.h includes where possible in affected files. OK'ed by: bde (with reservations)
* Revert consequences of changes to mount.h, part 2.grog2001-04-291-2/+0
| | | | Requested by: bde
* Correct #includes to work with fixed sys/mount.h.grog2001-04-231-0/+2
|
* Change and clean the mutex lock interface.bmilekic2001-02-091-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | mtx_enter(lock, type) becomes: mtx_lock(lock) for sleep locks (MTX_DEF-initialized locks) mtx_lock_spin(lock) for spin locks (MTX_SPIN-initialized) similarily, for releasing a lock, we now have: mtx_unlock(lock) for MTX_DEF and mtx_unlock_spin(lock) for MTX_SPIN. We change the caller interface for the two different types of locks because the semantics are entirely different for each case, and this makes it explicitly clear and, at the same time, it rids us of the extra `type' argument. The enter->lock and exit->unlock change has been made with the idea that we're "locking data" and not "entering locked code" in mind. Further, remove all additional "flags" previously passed to the lock acquire/release routines with the exception of two: MTX_QUIET and MTX_NOSWITCH The functionality of these flags is preserved and they can be passed to the lock/unlock routines by calling the corresponding wrappers: mtx_{lock, unlock}_flags(lock, flag(s)) and mtx_{lock, unlock}_spin_flags(lock, flag(s)) for MTX_DEF and MTX_SPIN locks, respectively. Re-inline some lock acq/rel code; in the sleep lock case, we only inline the _obtain_lock()s in order to ensure that the inlined code fits into a cache line. In the spin lock case, we inline recursion and actually only perform a function call if we need to spin. This change has been made with the idea that we generally tend to avoid spin locks and that also the spin locks that we do have and are heavily used (i.e. sched_lock) do recurse, and therefore in an effort to reduce function call overhead for some architectures (such as alpha), we inline recursion for this case. Create a new malloc type for the witness code and retire from using the M_DEV type. The new type is called M_WITNESS and is only declared if WITNESS is enabled. Begin cleaning up some machdep/mutex.h code - specifically updated the "optimized" inlined code in alpha/mutex.h and wrote MTX_LOCK_SPIN and MTX_UNLOCK_SPIN asm macros for the i386/mutex.h as we presently need those. Finally, caught up to the interface changes in all sys code. Contributors: jake, jhb, jasone (in no particular order)
* Back out proc locking to protect p_ucred for obtaining additionaljhb2001-01-271-25/+7
| | | | references along with the actual obtaining of additional references.
* - Proc locking.jhb2001-01-241-7/+27
| | | | - Protect calcru() with sched_lock.
* Use callout_reset instead of timeout(9). Most callouts are staticallyjake2000-11-271-6/+5
| | | | | | allocated, 2 have been added to struct proc for setitimer and sleep. Reviewed by: jhb, jlemon
* Move the truncation code out of vn_open and into the open system callmckusick2000-07-041-2/+3
| | | | | | | | | | after the acquisition of any advisory locks. This fix corrects a case in which a process tries to open a file with a non-blocking exclusive lock. Even if it fails to get the lock it would still truncate the file even though its open failed. With this change, the truncation is done only after the lock is successfully acquired. Obtained from: BSD/OS
* Add sysctl descriptions to a few sysctls. Simply "documentation".nbm2000-06-261-3/+3
| | | | | PR: kern/8015 Submitted by: Stefan Eggers <seggers@semyam.dinoco.de>
* Remove unneeded #include <vm/vm_zone.h>phk2000-04-301-1/+0
| | | | Generated by: src/tools/tools/kerninclude
* Introduce NDFREE (and remove VOP_ABORTOP)eivind1999-12-151-0/+3
|
* $Id$ -> $FreeBSD$peter1999-08-281-1/+1
|
* Fix a dev_t/udev_t issue with accounting. lastcomm now shows thephk1999-07-101-3/+3
| | | | | | | right tty again. Submitted by: "D. Rock" <rock@dead-end.net> Reviewed by: phk
* Suser() simplification:phk1999-04-271-2/+2
| | | | | | | | | | | | | | | | | | | 1: s/suser/suser_xxx/ 2: Add new function: suser(struct proc *), prototyped in <sys/proc.h>. 3: s/suser_xxx(\([a-zA-Z0-9_]*\)->p_ucred, \&\1->p_acflag)/suser(\1)/ The remaining suser_xxx() calls will be scrutinized and dealt with later. There may be some unneeded #include <sys/cred.h>, but they are left as an exercise for Bruce. More changes to the suser() API will come along with the "jail" code.
* Moved limit frobbing (and the resulting limcopy()) that occurs fordg1998-06-051-2/+12
| | | | | | accounting to the accounting function so that this isn't needlessly done for some process exits. Reviewed by: bde,phk
* Move the "retval" (3rd) parameter from all syscall functions and putphk1997-11-061-3/+2
| | | | | | | | | | | | it in struct proc instead. This fixes a boatload of compiler warning, and removes a lot of cruft from the sources. I have not removed the /*ARGSUSED*/, they will require some looking at. libkvm, ps and other userland struct proc frobbing programs will need recompiled.
* init_main.c subr_autoconf.c:gibbs1997-09-211-3/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add support for "interrupt driven configuration hooks". A component of the kernel can register a hook, most likely during auto-configuration, and receive a callback once interrupt services are available. This callback will occur before the root and dump devices are configured, so the configuration task can affect the selection of those two devices or complete any tasks that need to be performed prior to launching init. System boot is posponed so long as a hook is registered. The hook owner is responsible for removing the hook once their task is complete or the system boot can continue. kern_acct.c kern_clock.c kern_exit.c kern_synch.c kern_time.c: Change the interface and implementation for the kernel callout service. The new implemntaion is based on the work of Adam M. Costello and George Varghese, published in a technical report entitled "Redesigning the BSD Callout and Timer Facilities". The interface used in FreeBSD is a little different than the one outlined in the paper. The new function prototypes are: struct callout_handle timeout(void (*func)(void *), void *arg, int ticks); void untimeout(void (*func)(void *), void *arg, struct callout_handle handle); If a client wishes to remove a timeout, it must store the callout_handle returned by timeout and pass it to untimeout. The new implementation gives 0(1) insert and removal of callouts making this interface scale well even for applications that keep 100s of callouts outstanding. See the updated timeout.9 man page for more details.
* Removed unused #includes.bde1997-09-021-2/+1
|
* Don't include <sys/ioctl.h> in the kernel. Stage 1: don't includebde1997-03-241-2/+1
| | | | | it when it is not used. In most cases, the reasons for including it went away when the special ioctl headers became self-sufficient.
* Don't #include <sys/fcntl.h> in <sys/file.h> if KERNEL is defined.bde1997-03-231-2/+2
| | | | | Fixed everything that depended on getting fcntl.h stuff from the wrong place. Most things don't depend on file.h stuff at all.
OpenPOWER on IntegriCloud