summaryrefslogtreecommitdiffstats
path: root/sys/kern/kern_mac.c
Commit message (Collapse)AuthorAgeFilesLines
* Centrally manage enforcement of {reboot,swapon,sysctl} using therwatson2002-10-271-13/+9
| | | | | | | mac_enforce_system toggle, rather than several separate toggles. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Implement mac_check_system_sysctl(), a MAC Framework entry point torwatson2002-10-271-0/+28
| | | | | | | | | | | | | | | permit MAC policies to augment the security protections on sysctl() operations. This is not really a wonderful entry point, as we only have access to the MIB of the target sysctl entry, rather than the more useful entry name, but this is sufficient for policies like Biba that wish to use their notions of privilege or integrity to prevent inappropriate sysctl modification. Affects MAC kernels only. Since SYSCTL_LOCK isn't in sysctl.h, just kern_sysctl.c, we can't assert the SYSCTL subsystem lockin the MAC Framework. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Hook up mac_check_system_reboot(), a MAC Framework entry point thatrwatson2002-10-271-0/+23
| | | | | | | | | permits MAC modules to augment system security decisions regarding the reboot() system call, if MAC is compiled into the kernel. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Merge from MAC tree: rename mac_check_vnode_swapon() torwatson2002-10-271-18/+18
| | | | | | | | | | | mac_check_system_swapon(), to reflect the fact that the primary object of this change is the running kernel as a whole, rather than just the vnode. We'll drop additional checks of this class into the same check namespace, including reboot(), sysctl(), et al. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Slightly change the semantics of vnode labels for MAC: rather thanrwatson2002-10-261-486/+90
| | | | | | | | | | | | | | | | | | | | | "refreshing" the label on the vnode before use, just get the label right from inception. For single-label file systems, set the label in the generic VFS getnewvnode() code; for multi-label file systems, leave the labeling up to the file system. With UFS1/2, this means reading the extended attribute during vfs_vget() as the inode is pulled off disk, rather than hitting the extended attributes frequently during operations later, improving performance. This also corrects sematics for shared vnode locks, which were not previously present in the system. This chances the cache coherrency properties WRT out-of-band access to label data, but in an acceptable form. With UFS1, there is a small race condition during automatic extended attribute start -- this is not present with UFS2, and occurs because EAs aren't available at vnode inception. We'll introduce a work around for this shortly. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Comment describing the semantics of mac_late.rwatson2002-10-251-1/+6
| | | | | | | Trim trailing whitespace. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Introduce MAC_CHECK_VNODE_SWAPON, which permits MAC policies torwatson2002-10-221-0/+22
| | | | | | | | | | | perform authorization checks during swapon() events; policies might choose to enforce protections based on the credential requesting the swap configuration, the target of the swap operation, or other factors such as internal policy state. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Missed in previous merge: export sizeof(struct oldmac) rather thanrwatson2002-10-221-1/+1
| | | | | | | sizeof(struct mac). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Support the new MAC user API in kernel: modify existing system callsrwatson2002-10-221-169/+917
| | | | | | | | | | | | to use a modified notion of 'struct mac', and flesh out the new variation system calls (almost identical to existing ones except that they permit a pid to be specified for process label retrieval, and don't follow symlinks). This generalizes the label API so that the framework is now almost entirely policy-agnostic. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Use if_printf(ifp, "blah") instead ofbrooks2002-10-211-2/+1
| | | | printf("%s%d: blah", ifp->if_name, ifp->if_xname).
* If MAC_MAX_POLICIES isn't defined, don't try to define it, just let therwatson2002-10-201-3/+1
| | | | | | | | compile fail. MAC_MAX_POLICIES should always be defined, or we have bigger problems at hand. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Make sure to clear the 'registered' flag for MAC policies when theyrwatson2002-10-191-0/+1
| | | | | | | | | unregister. Under some obscure (perhaps demented) circumstances, this can result in a panic if a policy is unregistered, and then someone foolishly unregisters it again. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Integrate mac_check_socket_send() and mac_check_socket_receive()rwatson2002-10-061-0/+34
| | | | | | | | | | checks from the MAC tree: allow policies to perform access control for the ability of a process to send and receive data via a socket. At some point, we might also pass in additional address information if an explicit address is requested on send. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Sync from MAC tree: break out the single mmap entry point intorwatson2002-10-061-18/+63
| | | | | | | | | | | | | | | | | | | seperate entry points for each occasion: mac_check_vnode_mmap() Check at initial mapping mac_check_vnode_mprotect() Check at mapping protection change mac_check_vnode_mmap_downgrade() Determine if a mapping downgrade should take place following subject relabel. Implement mmap() and mprotect() entry points for labeled vnode policies. These entry points are currently not hooked up to the VM system in the base tree. These changes improve the consistency of the access control interface and offer more flexibility regarding limiting access to vnode mmaping. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Modify label allocation semantics for sockets: pass in soalloc's mallocrwatson2002-10-051-13/+69
| | | | | | | | | | | flags so that we can call malloc with M_NOWAIT if necessary, avoiding potential sleeps while holding mutexes in the TCP syncache code. Similar to the existing support for mbuf label allocation: if we can't allocate all the necessary label store in each policy, we back out the label allocation and fail the socket creation. Sync from MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Integrate a devfs/MAC fix from the MAC tree: avoid a race condition duringrwatson2002-10-051-0/+13
| | | | | | | | | devfs VOP symlink creation by introducing a new entry point to determine the label of the devfs_dirent prior to allocation of a vnode for the symlink. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Merge support for mac_check_vnode_link(), a MAC framework/policy entryrwatson2002-10-051-0/+30
| | | | | | | | point that instruments the creation of hard links. Policy implementations to follow. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* While the MAC API has supported the ability to handle M_NOWAIT passedrwatson2002-10-051-3/+11
| | | | | | | | | | | | to mbuf label initialization, that functionality was never merged to the main tree. Go ahead and merge that functionality now. Note that this requires policy modules to accept the case where the label element may be destroyed even if init has not succeeded on it (in the event that policy failed the init). This will shortly also apply to sockets. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Rearrange object and label init/destroy functions to match therwatson2002-10-051-101/+101
| | | | | | | | | order used in mac_policy.h and elsewhere. Sort order is basically "by operation category", then "alphabetically by object". Sync to MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Sync to MAC tree: use 'flag' instead of 'how' for mac_init_mbuf();rwatson2002-10-051-3/+3
| | | | remove a slightly less than useful comment.
* Another big diff, little functional change: move label internalization,rwatson2002-10-051-65/+65
| | | | | | | | externalization, and cred label life cycle events to entirely above devfs and vnode events. Sync from MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Move all object label init/destroy routines to the head of therwatson2002-10-051-285/+285
| | | | | | | | entry points to better match the entry point ordering in mac_policy.h. Big diff, no functional change; merge from the MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Synch from TrustedBSD MAC tree:rwatson2002-10-051-3/+25
| | | | | | | | | | | - If a policy isn't registered when a policy module unloads, silently succeed. - Hold the policy list lock across more of the validity tests to avoid races. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Cosmetic line wrap synchronization.rwatson2002-10-051-2/+4
|
* Push the debugging obect label counters into security.mac.debug.countersrwatson2002-10-051-11/+16
| | | | | | | rather than directly under security.mac.debug. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Begin another merge from the TrustedBSD MAC branch:rwatson2002-10-051-68/+86
| | | | | | | | | | | | | | | | | | | | | - Change mpo_init_foo(obj, label) and mpo_destroy_foo(obj, label) policy entry points to mpo_init_foo_label(label) and mpo_destroy_foo_label(label). This will permit the use of the same entry points for holding temporary type-specific label during internalization and externalization, as well as for caching purposes. - Because of this, break out mpo_{init,destroy}_socket() and mpo_{init,destroy}_mount() into seperate entry points for socket main/peer labels and mount main/fs labels. - Since the prototype for label initialization is the same across almost all entry points, implement these entry points using common implementations for Biba, MLS, and Test, reducing the number of almost identical looking functions. This simplifies policy implementation, as well as preparing us for the merge of the new flexible userland API for managing labels on objects. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Add a new MAC entry point, mac_thread_userret(td), which permits policyrwatson2002-10-021-0/+11
| | | | | | | | | | | | | | | | modules to perform MAC-related events when a thread returns to user space. This is required for policies that have floating process labels, as it's not always possible to acquire the process lock at arbitrary points in the stack during system call processing; process labels might represent traditional authentication data, process history information, or other data. LOMAC will use this entry point to perform the process label update prior to the thread returning to userspace, when plugged into the MAC framework. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Remember to include "opt_devfs.h" so we get any relevant changesphk2002-10-011-0/+1
| | | | | | to NDEVFSINO before we include devfs.h. Spotted by: FlexeLint
* Improve locking of pipe mutexes in the context of MAC:rwatson2002-10-011-0/+34
| | | | | | | | | | | | | | | | | | | | | | | | | (1) Where previously the pipe mutex was selectively grabbed during pipe_ioctl(), now always grab it and then release if if not needed. This protects the call to mac_check_pipe_ioctl() to make sure the label remains consistent. (Note: it looks like sigio locking may be incorrect for fgetown() since we call it not-by-reference and sigio locking assumes call by reference). (2) In pipe_stat(), lock the pipe if MAC is compiled in so that the call to mac_check_pipe_stat() gets a locked pipe to protect label consistency. We still release the lock before returning actual stat() data, risking inconsistency, but apparently our pipe locking model accepts that risk. (3) In various pipe MAC authorization checks, assert that the pipe lock is held. (4) Grab the lock when performing a pipe relabel operation, and assert it a little deeper in the stack. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Push 'security.mac.debug_label_fallback' behind options MAC_DEBUG.rwatson2002-10-011-10/+14
| | | | | Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Add tunables for the existing sysctl twiddles for pipe and vmrwatson2002-09-301-0/+2
| | | | | | | enforcement so they can be disabled prior to kernel start. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Remove un-needed stack variable 'ops'.rwatson2002-09-181-3/+2
| | | | | Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Add a toggle to disable VM enforcement.rwatson2002-09-181-0/+7
| | | | | Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* At the cost of seeming a little gauche, make use of more traditionalrwatson2002-09-181-4/+4
| | | | | | | alphabetization for mac_enforce_pipe sysctl. Obtained from: TrustedBSD Project Sponsored by: DAPRA, NAI Labs
* Remove all use of vnode->v_tag, replacing with appropriate substitutes.njl2002-09-141-4/+4
| | | | | | | | | | | | v_tag is now const char * and should only be used for debugging. Additionally: 1. All users of VT_NTS now check vfsconf->vf_type VFCF_NETWORK 2. The user of VT_PROCFS now checks for the new flag VV_PROCDEP, which is propagated by pseudofs to all child vnodes if the fs sets PFS_PROCDEP. Suggested by: phk Reviewed by: bde, rwatson (earlier version)
* Add security.mac.mmap_revocation, a flag indicating whether werwatson2002-09-091-0/+8
| | | | | | | should revoke access to memory maps on a process label change. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Minor code sync to MAC tree: push Giant locking up fromrwatson2002-09-091-2/+2
| | | | | | | mac_cred_mmapped_drop_perms() to the caller. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Include <sys/malloc.h> instead of depending on namespace pollution 2bde2002-09-051-6/+5
| | | | | | | | | layers deep in <sys/proc.h> or <sys/vnode.h>. Removed unused includes. Fixed some printf format errors (1 fatal on i386's; 1 fatal on alphas; 1 not fatal on any supported machine).
* Close a race in process label changing opened due to dropping therwatson2002-08-191-7/+10
| | | | | | | | | | proc locking when revoking access to mmaps. Instead, perform this later once we've changed the process label (hold onto a reference to the new cred so that we don't lose it when we release the process lock if another thread changes the credential). Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Pass active_cred and file_cred into the MAC framework explicitlyrwatson2002-08-191-12/+20
| | | | | | | | | | | for mac_check_vnode_{poll,read,stat,write}(). Pass in fp->f_cred when calling these checks with a struct file available. Otherwise, pass NOCRED. All currently MAC policies use active_cred, but could now offer the cached credential semantic used for the base system security model. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Provide an implementation of mac_syscall() so that security modulesrwatson2002-08-191-0/+38
| | | | | | | | | | | can offer new services without reserving system call numbers, or augmented versions of existing services. User code requests a target policy by name, and specifies the policy-specific API plus target. This is required in particular for our port of SELinux/FLASK to the MAC framework since it offers additional security services. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Break out mac_check_pipe_op() into component check entry points:rwatson2002-08-191-4/+46
| | | | | | | | | | | mac_check_pipe_poll(), mac_check_pipe_read(), mac_check_pipe_stat(), and mac_check_pipe_write(). This is improves consistency with other access control entry points and permits security modules to only control the object methods that they are interested in, avoiding switch statements. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Break out mac_check_vnode_op() into three seperate checks:rwatson2002-08-191-10/+57
| | | | | | | | | | mac_check_vnode_poll(), mac_check_vnode_read(), mac_check_vnode_write(). This improves the consistency with other existing vnode checks, and allows policies to avoid implementing switch statements to determine what operations they do and do not want to authorize. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Assert process locks in proces-related access control checks.rwatson2002-08-191-0/+6
| | | | | Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Add a missing vnode assertion for the exec() check.rwatson2002-08-191-0/+2
| | | | | Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Wrap maintenance of varios nmac{objectname} counters in MAC_DEBUG so werwatson2002-08-161-0/+46
| | | | | | | | can avoid the cost of a large number of atomic operations if we're not interested in the object count statistics. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Rename mac_check_socket_receive() to mac_check_socket_deliver() so thatrwatson2002-08-151-10/+10
| | | | | | | | | | | | | we can use the names _receive() and _send() for the receive() and send() checks. Rename related constants, policy implementations, etc. PR: Submitted by: Reviewed by: Approved by: Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs MFC after:
* Sync to trustedbsd_mac tree: default to sigsegv rather than copy-on-writerwatson2002-08-151-1/+1
| | | | | | | | | during a label change resulting in an mmap removal. This is "fail stop" behavior, which is preferred, although it offers slightly less transparency. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Declare a module service "kernel_mac_support" when MAC support isrwatson2002-08-121-0/+8
| | | | | | | | | | | | | | | enabled and the kernel provides the MAC registration and entry point service. Declare a dependency on that module service for any MAC module registered using mac_policy.h. For now, hard code the version as 1, but once we've come up with a versioning policy, we'll move to a #define of some sort. In the mean time, this will prevent loading a MAC module when 'options MAC' isn't present, which (due to a bug in the kernel linker) can result if the MAC module is preloaded via loader.conf. This particular evil recommended by: peter Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI LAbs
* - Replace v_flag with v_iflag and v_vflagjeff2002-08-041-5/+7
| | | | | | | | | | | | | | | - v_vflag is protected by the vnode lock and is used when synchronization with VOP calls is needed. - v_iflag is protected by interlock and is used for dealing with vnode management issues. These flags include X/O LOCK, FREE, DOOMED, etc. - All accesses to v_iflag and v_vflag have either been locked or marked with mp_fixme's. - Many ASSERT_VOP_LOCKED calls have been added where the locking was not clear. - Many functions in vfs_subr.c were restructured to provide for stronger locking. Idea stolen from: BSD/OS
OpenPOWER on IntegriCloud