summaryrefslogtreecommitdiffstats
path: root/sys/kern/kern_prot.c
Commit message (Collapse)AuthorAgeFilesLines
* Merge first in a series of TrustedBSD MAC Framework KPI changesrwatson2007-10-241-18/+18
| | | | | | | | | | | | | | | | | | | | | | | from Mac OS X Leopard--rationalize naming for entry points to the following general forms: mac_<object>_<method/action> mac_<object>_check_<method/action> The previous naming scheme was inconsistent and mostly reversed from the new scheme. Also, make object types more consistent and remove spaces from object types that contain multiple parts ("posix_sem" -> "posixsem") to make mechanical parsing easier. Introduce a new "netinet" object type for certain IPv4/IPv6-related methods. Also simplify, slightly, some entry point names. All MAC policy modules will need to be recompiled, and modules not updates as part of this commit will need to be modified to conform to the new KPI. Sponsored by: SPARTA (original patches against Mac OS X) Obtained from: TrustedBSD Project, Apple Computer
* Eliminate now-unused SUSER_ALLOWJAIL arguments to priv_check_cred(); inrwatson2007-06-121-39/+20
| | | | | | | | | | | | | | | some cases, move to priv_check() if it was an operation on a thread and no other flags were present. Eliminate caller-side jail exception checking (also now-unused); jail privilege exception code now goes solely in kern_jail.c. We can't yet eliminate suser() due to some cases in the KAME code where a privilege check is performed and then used in many different deferred paths. Do, however, move those prototypes to priv.h. Reviewed by: csjp Obtained from: TrustedBSD Project
* Move per-process audit state from a pointer in the proc structure torwatson2007-06-071-0/+9
| | | | | | | | | | | embedded storage in struct ucred. This allows audit state to be cached with the thread, avoiding locking operations with each system call, and makes it available in asynchronous execution contexts, such as deep in the network stack or VFS. Reviewed by: csjp Approved by: re (kensmith) Obtained from: TrustedBSD Project
* Further system call comment cleanup:rwatson2007-03-051-6/+4
| | | | | | | | | | - Remove also "MP SAFE" after prior "MPSAFE" pass. (suggested by bde) - Remove extra blank lines in some cases. - Add extra blank lines in some cases. - Remove no-op comments consisting solely of the function name, the word "syscall", or the system call name. - Add punctuation. - Re-wrap some comments.
* Remove 'MPSAFE' annotations from the comments above most system calls: allrwatson2007-03-041-97/+3
| | | | | | | | system calls now enter without Giant held, and then in some cases, acquire Giant explicitly. Remove a number of other MPSAFE annotations in the credential code and tweak one or two other adjacent comments.
* Sort copyrights together.rwatson2007-01-081-2/+4
| | | | MFC after: 3 days
* Add a new priv(9) kernel interface for checking the availability ofrwatson2006-11-061-89/+58
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | privilege for threads and credentials. Unlike the existing suser(9) interface, priv(9) exposes a named privilege identifier to the privilege checking code, allowing more complex policies regarding the granting of privilege to be expressed. Two interfaces are provided, replacing the existing suser(9) interface: suser(td) -> priv_check(td, priv) suser_cred(cred, flags) -> priv_check_cred(cred, priv, flags) A comprehensive list of currently available kernel privileges may be found in priv.h. New privileges are easily added as required, but the comments on adding privileges found in priv.h and priv(9) should be read before doing so. The new privilege interface exposed sufficient information to the privilege checking routine that it will now be possible for jail to determine whether a particular privilege is granted in the check routine, rather than relying on hints from the calling context via the SUSER_ALLOWJAIL flag. For now, the flag is maintained, but a new jail check function, prison_priv_check(), is exposed from kern_jail.c and used by the privilege check routine to determine if the privilege is permitted in jail. As a result, a centralized list of privileges permitted in jail is now present in kern_jail.c. The MAC Framework is now also able to instrument privilege checks, both to deny privileges otherwise granted (mac_priv_check()), and to grant privileges otherwise denied (mac_priv_grant()), permitting MAC Policy modules to implement privilege models, as well as control a much broader range of system behavior in order to constrain processes running with root privilege. The suser() and suser_cred() functions remain implemented, now in terms of priv_check() and the PRIV_ROOT privilege, for use during the transition and possibly continuing use by third party kernel modules that have not been updated. The PRIV_DRIVER privilege exists to allow device drivers to check privilege without adopting a more specific privilege identifier. This change does not modify the actual security policy, rather, it modifies the interface for privilege checks so changes to the security policy become more feasible. Sponsored by: nCircle Network Security, Inc. Obtained from: TrustedBSD Project Discussed on: arch@ Reviewed (at least in part) by: mlaier, jmg, pjd, bde, ceri, Alex Lyashkov <umka at sevcity dot net>, Skip Ford <skip dot ford at verizon dot net>, Antoine Brodin <antoine dot brodin at laposte dot net>
* Complete break-out of sys/sys/mac.h into sys/security/mac/mac_framework.hrwatson2006-10-221-1/+1
| | | | | | | | | | | | | begun with a repo-copy of mac.h to mac_framework.h. sys/mac.h now contains the userspace and user<->kernel API and definitions, with all in-kernel interfaces moved to mac_framework.h, which is now included across most of the kernel instead. This change is the first step in a larger cleanup and sweep of MAC Framework interfaces in the kernel, and will not be MFC'd. Obtained from: TrustedBSD Project Sponsored by: SPARTA
* Declare security and security.bsd sysctl hierarchies in sysctl.h alongrwatson2006-09-171-3/+1
| | | | | | | | with other commonly used sysctl name spaces, rather than declaring them all over the place. MFC after: 1 month Sponsored by: nCircle Network Security, Inc.
* Add kern_setgroups() and kern_getgroups() and use them to implementjhb2006-07-061-25/+42
| | | | | | | | | ibcs2_[gs]etgroups() rather than using the stackgap. This also makes ibcs2_[gs]etgroups() MPSAFE. Also, it cleans up one bit of weirdness in the old setgroups() where it allocated an entire credential just so it had a place to copy the group list into. Now setgroups just allocates a NGROUPS_MAX array on the stack that it copies into and then passes to kern_setgroups().
* Audit the arguments (user/group IDs) for the system calls that set these IDs.wsalamon2006-02-061-0/+17
| | | | | Obtained from: TrustedBSD Project Approved by: rwatson (mentor)
* Use the refcount API to manage the reference count for user credentialsjhb2005-09-271-16/+6
| | | | | | rather than using pool mutexes. Tested on: i386, alpha, sparc64
* Introduce p_canwait() and MAC Framework and MAC Policy entry pointsrwatson2005-04-181-0/+31
| | | | | | | | | | | | | | | mac_check_proc_wait(), which control the ability to wait4() specific processes. This permits MAC policies to limit information flow from children that have changed label, although has to be handled carefully due to common programming expectations regarding the behavior of wait4(). The cr_seeotheruids() check in p_canwait() is #if 0'd for this reason. The mac_stub and mac_test policies are updated to reflect these new entry points. Sponsored by: SPAWAR, SPARTA Obtained from: TrustedBSD Project
* Introduce new MAC Framework and MAC Policy entry points to control the userwatson2005-04-161-53/+137
| | | | | | | | | | | | | | | | | | | | | | of system calls to manipulate elements of the process credential, including: setuid() mac_check_proc_setuid() seteuid() mac_check_proc_seteuid() setgid() mac_check_proc_setgid() setegid() mac_check_proc_setegid() setgroups() mac_check_proc_setgroups() setreuid() mac_check_proc_setreuid() setregid() mac_check_proc_setregid() setresuid() mac_check_proc_setresuid() setresgid() mac_check_rpoc_setresgid() MAC checks are performed before other existing security checks; both current credential and intended modifications are passed as arguments to the entry points. The mac_test and mac_stub policies are updated. Submitted by: Samy Al Bahra <samy@kerneled.org> Obtained from: TrustedBSD Project
* Impose the upper limit on signals that are allowed between kernel threadssobomax2005-03-181-2/+2
| | | | | | | in set[ug]id program for compatibility with Linux. Linuxthreads uses 4 signals from SIGRTMIN to SIGRTMIN+3. Pointed out by: rwatson
* Linuxthreads uses not only signal 32 but several signals >= 32.sobomax2005-03-181-5/+5
| | | | | PR: kern/72922 Submitted by: Andriy Gapon <avg@icyb.net.ua>
* In linux emulation layer try to detect attempt to use linux_clone() tosobomax2005-03-031-0/+12
| | | | | | | | | | | | | | | | | | | | | | create kernel threads and call rfork(2) with RFTHREAD flag set in this case, which puts parent and child into the same threading group. As a result all threads that belong to the same program end up in the same threading group. This is similar to what linuxthreads port does, though in this case we don't have a luxury of having access to the source code and there is no definite way to differentiate linux_clone() called for threading purposes from other uses, so that we have to resort to heuristics. Allow SIGTHR to be delivered between all processes in the same threading group previously it has been blocked for s[ug]id processes. This also should improve locking of the same file descriptor from different threads in programs running under linux compat layer. PR: kern/72922 Reported by: Andriy Gapon <avg@icyb.net.ua> Idea suggested by: rwatson
* Backout addition of SIGTHR into the list of signals allowed to be deliveredsobomax2005-02-131-1/+0
| | | | | | to the suid/sugid process, since apparently it has security implications. Suggested by: rwatson
* Backout previous change (disabling of security checks for signals deliveredsobomax2005-02-131-4/+5
| | | | | | in emulation layers), since it appears to be too broad. Requested by: rwatson
* Split out kill(2) syscall service routine into user-level and kernel part, thesobomax2005-02-131-5/+4
| | | | | | | | | | | | | | | | | former is callable from user space and the latter from the kernel one. Make kernel version take additional argument which tells if the respective call should check for additional restrictions for sending signals to suid/sugid applications or not. Make all emulation layers using non-checked version, since signal numbers in emulation layers can have different meaning that in native mode and such protection can cause misbehaviour. As a result remove LIBTHR from the signals allowed to be delivered to a suid/sugid application. Requested (sorta) by: rwatson MFC after: 2 weeks
* Add SIGTHR (32) into list of signals permitted to be delivered to thesobomax2005-02-111-0/+1
| | | | | | | | | | | | | | | suid application. The problem is that Linux applications using old Linux threads (pre-NPTL) use signal 32 (linux SIGRTMIN) for communication between thread-processes. If such an linux application is installed suid or sgid and security.bsd.conservative_signals=1 (default), then permission will be denied to send such a signal and the application will freeze. I believe the same will be true for native applications that use libthr, since libthr uses SIGTHR for implementing conditional variables. PR: 72922 Submitted by: Andriy Gapon <avg@icyb.net.ua> MFC after: 2 weeks
* Style cleanup: with removal of mutex operations, we can also removerwatson2005-01-231-4/+2
| | | | | | {}'s from securelevel_gt() and securelevel_ge(). MFC after: 1 week
* When reading pr_securelevel from a prison, perform a lockless read,rwatson2005-01-231-4/+0
| | | | | | | as it's an integer read operation and the resulting slight race is acceptable. MFC after: 1 week
* /* -> /*- for copyright notices, minor format tweaks as necessaryimp2005-01-061-1/+1
|
* Remove sched_free_thread() which was only usedjulian2004-08-311-13/+0
| | | | | | | | in diagnostics. It has outlived its usefulness and has started causing panics for people who turn on DIAGNOSTIC, in what is otherwise good code. MFC after: 2 days
* Rename suser_cred()'s PRISON_ROOT flag to SUSER_ALLOWJAIL. This iscperciva2004-07-261-21/+21
| | | | | | | | | | | somewhat clearer, but more importantly allows for a consistent naming scheme for suser_cred flags. The old name is still defined, but will be removed in a few days (unless I hear any complaints...) Discussed with: rwatson, scottl Requested by: jhb
* In setpgid(), since td is passed in as a system call argument, use itrwatson2004-07-231-1/+1
| | | | in preference to curthread, which costs slightly more.
* suser() accepts a thread argument; as suser() dereferences td_ucred, arwatson2004-07-221-0/+12
| | | | | | | | | thread-local pointer, in practice that thread needs to be curthread. If we're running with INVARIANTS, generate a warning if not. If we have KDB compiled in, generate a stack trace. This doesn't fire at all in my local test environment, but could be irritating if it fires frequently for someone, so there will be motivation to fix things quickly when it does.
* Add a SUSER_RUID flag to suser_cred. This flag indicates that we want tocperciva2004-07-161-3/+2
| | | | | | | check if the *real* user is the superuser (vs. the normal behaviour, which checks the effective user). Reviewed by: rwatson
* Socket MAC labels so_label and so_peerlabel are now protected byrwatson2004-06-131-0/+2
| | | | | | | | | | | | | SOCK_LOCK(so): - Hold socket lock over calls to MAC entry points reading or manipulating socket labels. - Assert socket lock in MAC entry point implementations. - When externalizing the socket label, first make a thread-local copy while holding the socket lock, then release the socket lock to externalize to userspace.
* Deorbit COMPAT_SUNOS.phk2004-06-111-3/+3
| | | | | We inherited this from the sparc32 port of BSD4.4-Lite1. We have neither a sparc32 port nor a SunOS4.x compatibility desire these days.
* Remove advertising clause from University of California Regent's license,imp2004-04-051-4/+0
| | | | | | per letter dated July 22, 1999. Approved by: core
* Don't grab Giant in crfree(), since prison_free() no longer requires it.rwatson2004-01-231-3/+1
| | | | | | | | | | | | | | The uidinfo code appears to be MPSAFE, and is referenced without Giant elsewhere. While this grab of Giant was only made in fairly rare circumstances (actually GC'ing on refcount==0), grabbing Giant here potentially introduces lock order issues with any locks held by the caller. So this probably won't help performance much unless you change credentials a lot in an application, and leave a lot of file descriptors and cached credentials around. However, it simplifies locking down consumers of the credential interfaces. Bumped into by: sam Appeased: tjr
* Rename mac_create_cred() MAC Framework entry point to mac_copy_cred(),rwatson2003-12-061-1/+1
| | | | | | | | | | | | | and the mpo_create_cred() MAC policy entry point to mpo_copy_cred_label(). This is more consistent with similar entry points for creation and label copying, as mac_create_cred() was called from crdup() as opposed to during process creation. For a number of policies, this removes the requirement for special handling when copying credential labels, and improves consistency. Approved by: re (scottl) Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Add a sysctl, security.bsd.see_other_gids, similar in semanticsrwatson2003-11-171-2/+51
| | | | | | | to see_other_uids but with the logical conversion. This is based on (but not identical to) the patch submitted by Samy Al Bahra. Submitted by: Samy Al Bahra <samy@kerneled.com>
* Writes to p_flag in __setugid() no longer need Giant.jhb2003-10-231-4/+0
|
* Add a new sysctl, security.bsd.conservative_signals, to disablerwatson2003-09-141-1/+16
| | | | | | | | | | | | special signal-delivery protections for setugid processes. In the event that a system is relying on "unusual" signal delivery to processes that change their credentials, this can be used to work around application problems. Also, add SIGALRM to the set of signals permitted to be delivered to setugid processes by unprivileged subjects. Reported by: Joe Greco <jgreco@ns.sol.net>
* Extend the mutex pool implementation to permit the creation and use oftruckman2003-07-131-1/+1
| | | | | | | | | | | | | | | | multiple mutex pools with different options and sizes. Mutex pools can be created with either the default sleep mutexes or with spin mutexes. A dynamically created mutex pool can now be destroyed if it is no longer needed. Create two pools by default, one that matches the existing pool that uses the MTX_NOWITNESS option that should be used for building higher level locks, and a new pool with witness checking enabled. Modify the users of the existing mutex pool to use the appropriate pool in the new implementation. Reviewed by: jhb
* In setpgrp(), don't assume a pgrp won't exist if the provided pgid is the samecognet2003-07-041-12/+13
| | | | | | | as the target process' pid, it may exist if the process forked before leaving the pgrp. Thix fixes a panic that happens when calling setpgid to make a process re-enter the pgrp with the same pgid as its pid if the pgrp still exists.
* At this point targp will always be NULL, so remove the useless if.cognet2003-06-251-2/+0
|
* Various cr*() calls believed to be MPSAFE, since the uidinforwatson2003-06-151-0/+8
| | | | code is locked down.
* Use __FBSDID().obrien2003-06-111-1/+3
|
* The issetugid() function is MPSAFE.jhb2003-06-091-1/+1
|
* Remove Giant from the setuid(), seteuid(), setgid(), setegid(),jhb2003-05-011-30/+0
| | | | | setgroups(), setreuid(), setregid(), setresuid(), and setresgid() syscalls as well as the cred_update_thread() function.
* Remove Giant from getpgid() and getsid() and tweak the logic to morejhb2003-04-251-30/+28
| | | | closely match that of 4.x.
* Back out M_* changes, per decision of the TRB.imp2003-02-191-4/+4
| | | | Approved by: trb
* Remove mtx_lock_giant from functions which are mp-safe.jake2003-02-101-9/+0
|
* Remove M_TRYWAIT/M_WAITOK/M_WAIT. Callers should use 0.alfred2003-01-211-4/+4
| | | | Merge M_NOWAIT/M_DONTWAIT into a single flag M_NOWAIT.
* Include file cleanup; mac.h and malloc.h at one point had orderingrwatson2002-08-011-1/+1
| | | | | | relationship requirements, and no longer do. Reminded by: bde
* Introduce support for Mandatory Access Control and extensiblerwatson2002-07-311-3/+21
| | | | | | | | | | | | kernel access control. Implement inter-process access control entry points for the MAC framework. This permits policy modules to augment the decision making process for process and socket visibility, process debugging, re-scheduling, and signaling. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
OpenPOWER on IntegriCloud