summaryrefslogtreecommitdiffstats
path: root/sys/kern/kern_prot.c
Commit message (Collapse)AuthorAgeFilesLines
...
* o introduce u_cansee(), which performs access control checks betweenrwatson2001-03-281-14/+26
| | | | | | | | | | two subject ucreds. Unlike p_cansee(), u_cansee() doesn't have process lock requirements, only valid ucred reference requirements, so is prefered as process locking improves. For now, back p_cansee() into u_cansee(), but eventually p_cansee() will go away. Reviewed by: jhb, tmm Obtained from: TrustedBSD Project
* Just use the proc lock to protect read accesses to p_pptr rather than thejhb2001-03-241-4/+4
| | | | more expensive proctree lock.
* o Move per-process jail pointer (p->pr_prison) to inside of the subjectrwatson2001-02-211-18/+29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | credential structure, ucred (cr->cr_prison). o Allow jail inheritence to be a function of credential inheritence. o Abstract prison structure reference counting behind pr_hold() and pr_free(), invoked by the similarly named credential reference management functions, removing this code from per-ABI fork/exit code. o Modify various jail() functions to use struct ucred arguments instead of struct proc arguments. o Introduce jailed() function to determine if a credential is jailed, rather than directly checking pointers all over the place. o Convert PRISON_CHECK() macro to prison_check() function. o Move jail() function prototypes to jail.h. o Emulate the P_JAILED flag in fill_kinfo_proc() and no longer set the flag in the process flags field itself. o Eliminate that "const" qualifier from suser/p_can/etc to reflect mutex use. Notes: o Some further cleanup of the linux/jail code is still required. o It's now possible to consider resolving some of the process vs credential based permission checking confusion in the socket code. o Mutex protection of struct prison is still not present, and is required to protect the reference count plus some fields in the structure. Reviewed by: freebsd-arch Obtained from: TrustedBSD Project
* o Fix spellign in a comment: s/referernce/reference/rwatson2001-02-141-1/+1
|
* Change and clean the mutex lock interface.bmilekic2001-02-091-7/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | mtx_enter(lock, type) becomes: mtx_lock(lock) for sleep locks (MTX_DEF-initialized locks) mtx_lock_spin(lock) for spin locks (MTX_SPIN-initialized) similarily, for releasing a lock, we now have: mtx_unlock(lock) for MTX_DEF and mtx_unlock_spin(lock) for MTX_SPIN. We change the caller interface for the two different types of locks because the semantics are entirely different for each case, and this makes it explicitly clear and, at the same time, it rids us of the extra `type' argument. The enter->lock and exit->unlock change has been made with the idea that we're "locking data" and not "entering locked code" in mind. Further, remove all additional "flags" previously passed to the lock acquire/release routines with the exception of two: MTX_QUIET and MTX_NOSWITCH The functionality of these flags is preserved and they can be passed to the lock/unlock routines by calling the corresponding wrappers: mtx_{lock, unlock}_flags(lock, flag(s)) and mtx_{lock, unlock}_spin_flags(lock, flag(s)) for MTX_DEF and MTX_SPIN locks, respectively. Re-inline some lock acq/rel code; in the sleep lock case, we only inline the _obtain_lock()s in order to ensure that the inlined code fits into a cache line. In the spin lock case, we inline recursion and actually only perform a function call if we need to spin. This change has been made with the idea that we generally tend to avoid spin locks and that also the spin locks that we do have and are heavily used (i.e. sched_lock) do recurse, and therefore in an effort to reduce function call overhead for some architectures (such as alpha), we inline recursion for this case. Create a new malloc type for the witness code and retire from using the M_DEV type. The new type is called M_WITNESS and is only declared if WITNESS is enabled. Begin cleaning up some machdep/mutex.h code - specifically updated the "optimized" inlined code in alpha/mutex.h and wrote MTX_LOCK_SPIN and MTX_UNLOCK_SPIN asm macros for the i386/mutex.h as we presently need those. Finally, caught up to the interface changes in all sys code. Contributors: jake, jhb, jasone (in no particular order)
* Fix typo: compatability -> compatibility.asmodai2001-02-061-3/+3
| | | | Compatability is not an existing english word.
* Fix getsid() to use "=" instead of "==".ben2001-01-131-1/+1
| | | | Not objected to by: audit
* Protect proc.p_pptr and proc.p_children/p_sibling with thejake2000-12-231-1/+11
| | | | | | | | proctree_lock. linprocfs not locked pending response from informal maintainer. Reviewed by: jhb, -smp@
* make crfree into a function rather than a macro to avoid bloat because ofalfred2000-11-301-0/+14
| | | | | | the mutex aquire/release reorder struct ucred
* ucred system overhaul:alfred2000-11-271-8/+15
| | | | | | | | | | | | 1) mpsafe (protect the refcount with a mutex). 2) reduce duplicated code by removing the inlined crdup() from crcopy() and make crcopy() call crdup(). 3) use M_ZERO flag when allocating initial structs instead of calling bzero after allocation. 4) expand the size of the refcount from a u_short to an u_int, by using shorts we might have an overflow. Glanced at by: jake
* o Fix a mis-transcription of sef's -STABLE protection fixes--only rootrwatson2000-11-101-1/+1
| | | | | | | | | could debug processes after the commit that introduced the typo. Security is good, but security is not always the same as turning things off :-). PR: kern/22711 Obtained from: brooks@one-eyed-alien.net
* o Tighten up rules for which processes can't debug which other processesrwatson2000-10-301-2/+4
| | | | | | | | in the p_candebug() function. Synchronize with sef's CHECKIO() macro from the old procfs, which seems to be a good source of security checks. Obtained from: TrustedBSD Project
* Nuke a bit of dead code.truckman2000-10-291-5/+0
|
* unstaticize change_ruid() because it is needed by osf1_setuid()gallatin2000-10-261-3/+1
|
* Remove uidinfo hash table lookup and maintenance out of chgproccnt() andtruckman2000-09-051-20/+70
| | | | | | | | | | | | | | chgsbsize(), which are called rather frequently and may be called from an interrupt context in the case of chgsbsize(). Instead, do the hash table lookup and maintenance when credentials are changed, which is a lot less frequent. Add pointers to the uidinfo structures to the ucred and pcred structures for fast access. Pass a pointer to the credential to chgproccnt() and chgsbsize() instead of passing the uid. Add a reference count to the uidinfo structure and use it to decide when to free the structure rather than freeing the structure when the resource consumption drops to zero. Move the resource tracking code from kern_proc.c to kern_resource.c. Move some duplicate code sequences in kern_prot.c to separate helper functions. Change KASSERTs in this code to unconditional tests and calls to panic().
* o p_cansee() wasn't setting privused when suser() was required to overriderwatson2000-08-311-2/+7
| | | | | | | | kern.ps_showallprocs. Apparently got lost in the merge process from the capability patches. Now fixed. Submitted by: jdp Obtained from: TrustedBSD Project
* o Centralize inter-process access control, introducing:rwatson2000-08-301-9/+143
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | int p_can(p1, p2, operation, privused) which allows specification of subject process, object process, inter-process operation, and an optional call-by-reference privused flag, allowing the caller to determine if privilege was required for the call to succeed. This allows jail, kern.ps_showallprocs and regular credential-based interaction checks to occur in one block of code. Possible operations are P_CAN_SEE, P_CAN_SCHED, P_CAN_KILL, and P_CAN_DEBUG. p_can currently breaks out as a wrapper to a series of static function checks in kern_prot, which should not be invoked directly. o Commented out capabilities entries are included for some checks. o Update most inter-process authorization to make use of p_can() instead of manual checks, PRISON_CHECK(), P_TRESPASS(), and kern.ps_showallprocs. o Modify suser{,_xxx} to use const arguments, as it no longer modifies process flags due to the disabling of ASU. o Modify some checks/errors in procfs so that ENOENT is returned instead of ESRCH, further improving concealment of processes that should not be visible to other processes. Also introduce new access checks to improve hiding of processes for procfs_lookup(), procfs_getattr(), procfs_readdir(). Correct a bug reported by bp concerning not handling the CREATE case in procfs_lookup(). Remove volatile flag in procfs that caused apparently spurious qualifier warnigns (approved by bde). o Add comment noting that ktrace() has not been updated, as its access control checks are different from ptrace(), whereas they should probably be the same. Further discussion should happen on this topic. Reviewed by: bde, green, phk, freebsd-security, others Approved by: bde Obtained from: TrustedBSD Project
* o Disable flagging of ASU in suser_xxx() authorization check. For therwatson2000-08-301-2/+0
| | | | | | | | | | | | time being, the ASU accounting flag will no longer be available, but may be reinstituted in the future once authorization have been redone. As it is, the kernel went through contortions in access control to avoid calling suser, which always set the flag. This will also allow suser to accept const struct *{cred, proc} arguments. Reviewed by: bde, green, phk, freebsd-security, others Approved by: bde Obtained from: TrustedBSD Project
* fix races in the uidinfo subsystem, several problems existed:alfred2000-06-221-6/+6
| | | | | | | | | | | | | | | | | | | | | | | | 1) while allocating a uidinfo struct malloc is called with M_WAITOK, it's possible that while asleep another process by the same user could have woken up earlier and inserted an entry into the uid hash table. Having redundant entries causes inconsistancies that we can't handle. fix: do a non-waiting malloc, and if that fails then do a blocking malloc, after waking up check that no one else has inserted an entry for us already. 2) Because many checks for sbsize were done as "test then set" in a non atomic manner it was possible to exceed the limits put up via races. fix: instead of querying the count then setting, we just attempt to set the count and leave it up to the function to return success or failure. 3) The uidinfo code was inlining and repeating, lookups and insertions and deletions needed to be in their own functions for clarity. Reviewed by: green
* o bde suggested moving the SYSCTL from kern_mib to the more appropriaterwatson2000-06-051-0/+6
| | | | | | | | kern_prot, which cleans up some namespace issues o Don't need a special handler to limit un-setting, as suser is used to protect suser_permitted, making it one-way by definition. Suggested by: bde
* o Introduce kern.suser_permitted, a sysctl that disables the suser_xxx()rwatson2000-06-051-0/+2
| | | | | | | | | | | | | | | returning anything but EPERM. o suser is enabled by default; once disabled, cannot be reenabled o To be used in alternative security models where uid0 does not connote additional privileges o Should be noted that uid0 still has some additional powers as it owns many important files and executables, so suffers from the same fundamental security flaws as securelevels. This is fixed with MAC integrity protection code (in progress) o Not safe for consumption unless you are *really* sure you don't want things like shutdown to work, et al :-) Obtained from: TrustedBSD Project
* Make issetugid return correctly. It was returning -1 withpeter2000-05-091-2/+1
| | | | | | errno == 1 if it was set?id! Submitted by: Valentin Nechayev <netch@segfault.kiev.ua>
* Make the sigprocmask() and geteuid() system calls MP SAFE. Expanddillon2000-04-021-6/+9
| | | | | | | commentary for copyin/copyout to indicate that they are MP SAFE as well. Reviewed by: msmith
* Commit major SMP cleanups and move the BGL (big giant lock) in thedillon2000-03-281-1/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | syscall path inward. A system call may select whether it needs the MP lock or not (the default being that it does need it). A great deal of conditional SMP code for various deadended experiments has been removed. 'cil' and 'cml' have been removed entirely, and the locking around the cpl has been removed. The conditional separately-locked fast-interrupt code has been removed, meaning that interrupts must hold the CPL now (but they pretty much had to anyway). Another reason for doing this is that the original separate-lock for interrupts just doesn't apply to the interrupt thread mechanism being contemplated. Modifications to the cpl may now ONLY occur while holding the MP lock. For example, if an otherwise MP safe syscall needs to mess with the cpl, it must hold the MP lock for the duration and must (as usual) save/restore the cpl in a nested fashion. This is precursor work for the real meat coming later: avoiding having to hold the MP lock for common syscalls and I/O's and interrupt threads. It is expected that the spl mechanisms and new interrupt threading mechanisms will be able to run in tandem, allowing a slow piecemeal transition to occur. This patch should result in a moderate performance improvement due to the considerable amount of code that has been removed from the critical path, especially the simplification of the spl*() calls. The real performance gains will come later. Approved by: jkh Reviewed by: current, bde (exception.s) Some work taken from: luoqi's patch
* Implement setres[ug]id() and getres[ug]id(). This has been sitting inpeter2000-01-161-0/+158
| | | | | | | my tree for ages (~2 years) waiting for an excuse to commit it. Now Linux has implemented it and it seems that Staroffice (when using the linux_base6.1 port's libc) calls this in the linux emulator and dies in setup. The Linux emulator can call these now.
* Handle the case where we truss an SUGID program -- in particular, we needsef2000-01-101-1/+1
| | | | | | | | to wake up any processes waiting via PIOCWAIT on process exit, and truss needs to be more aware that a process may actually disappear while it's waiting. Reviewed by: Paul Saab <ps@yahoo-inc.com>
* truss /usr/bin/suphk2000-01-031-2/+2
| | | | | | | | | | | | | | | | login (or not if root) then exit the shell truss will get stuct in tsleep I dont know if this is correct, but it fixes the problem and according to the commends in pioctl.h, PF_ISUGID is set when we want to ignore UID changes. The code is checking for when PF_ISUGID is not set and since it never is set, we always ignore UID changes. Submitted by: Paul Saab <ps@yahoo-inc.com>
* Introduce the new functionphk1999-11-211-0/+25
| | | | | | | | | | | | | | p_trespass(struct proc *p1, struct proc *p2) which returns zero or an errno depending on the legality of p1 trespassing on p2. Replace kern_sig.c:CANSIGNAL() with call to p_trespass() and one extra signal related check. Replace procfs.h:CHECKIO() macros with calls to p_trespass(). Only show command lines to process which can trespass on the target process.
* Trim unused options (or #ifdef for undoc options).peter1999-10-111-1/+0
| | | | Submitted by: phk
* $Id$ -> $FreeBSD$peter1999-08-281-1/+1
|
* This Implements the mumbled about "Jail" feature.phk1999-04-281-19/+27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is a seriously beefed up chroot kind of thing. The process is jailed along the same lines as a chroot does it, but with additional tough restrictions imposed on what the superuser can do. For all I know, it is safe to hand over the root bit inside a prison to the customer living in that prison, this is what it was developed for in fact: "real virtual servers". Each prison has an ip number associated with it, which all IP communications will be coerced to use and each prison has its own hostname. Needless to say, you need more RAM this way, but the advantage is that each customer can run their own particular version of apache and not stomp on the toes of their neighbors. It generally does what one would expect, but setting up a jail still takes a little knowledge. A few notes: I have no scripts for setting up a jail, don't ask me for them. The IP number should be an alias on one of the interfaces. mount a /proc in each jail, it will make ps more useable. /proc/<pid>/status tells the hostname of the prison for jailed processes. Quotas are only sensible if you have a mountpoint per prison. There are no privisions for stopping resource-hogging. Some "#ifdef INET" and similar may be missing (send patches!) If somebody wants to take it from here and develop it into more of a "virtual machine" they should be most welcome! Tools, comments, patches & documentation most welcome. Have fun... Sponsored by: http://www.rndassociates.com/ Run for almost a year by: http://www.servetheweb.com/
* Change suser_xxx() to suser() where it applies.phk1999-04-271-10/+10
|
* Suser() simplification:phk1999-04-271-12/+19
| | | | | | | | | | | | | | | | | | | 1: s/suser/suser_xxx/ 2: Add new function: suser(struct proc *), prototyped in <sys/proc.h>. 3: s/suser_xxx(\([a-zA-Z0-9_]*\)->p_ucred, \&\1->p_acflag)/suser(\1)/ The remaining suser_xxx() calls will be scrutinized and dealt with later. There may be some unneeded #include <sys/cred.h>, but they are left as an exercise for Bruce. More changes to the suser() API will come along with the "jail" code.
* Fix warnings in preparation for adding -Wall -Wcast-qual to thedillon1999-01-281-9/+9
| | | | kernel compile
* getpgid() and getsid() were doing a comparision rather than an assignment,truckman1998-12-131-5/+11
| | | | | which is fortunate, because otherwise another bug would allow them to be used to stomp on the syscall return value of another process.
* add #include <sys/kernel.h> where it's needed by MALLOC_DEFINE()peter1998-11-101-1/+2
|
* If the session leader dies, s_leader is set to NULL and getsid() maytruckman1998-11-091-2/+2
| | | | | | | | | | | | | | | | | | | | | | dereference a NULL pointer, causing a panic. Instead of following s_leader to find the session id, store it in the session structure. Jukka found the following info: BTW - I just found what I have been looking for. Std 1003.1 Part 1: SYSTEM API [C LANGUAGE] section 2.2.2.80 states quite explicitly... Session lifetime: The period between when a session is created and the end of lifetime of all the process groups that remain as members of the session. So, this quite clearly tells that while there is any single process in any process group which is a member of the session, the session remains as an independent entity. Reviewed by: peter Submitted by: "Jukka A. Ukkonen" <jau@jau.tmt.tele.fi>
* 64bit fixes: use size_t not u_int for sizes.dfr1998-06-101-2/+2
|
* Clear the p_stops field on change of user/group id, unless the correctsef1997-12-201-16/+26
| | | | | | | | | flag is set in the p_pfsflags field. This, essentially, prevents an SUID proram from hanging after being traced. (E.g., "truss /usr/bin/rlogin" would fail, but leave rlogin in a stopevent state.) Yet another case where procctl is (hopefully ;)) no longer needed in the general case. Reviewed by: bde (thanks bruce :))
* Make COMPAT_43 and COMPAT_SUNOS new-style options.eivind1997-12-161-1/+3
|
* Move the "retval" (3rd) parameter from all syscall functions and putphk1997-11-061-60/+38
| | | | | | | | | | | | it in struct proc instead. This fixes a boatload of compiler warning, and removes a lot of cruft from the sources. I have not removed the /*ARGSUSED*/, they will require some looking at. libkvm, ps and other userland struct proc frobbing programs will need recompiled.
* Killed non-sensical call to splimp/splx in crfree().dg1997-10-171-5/+1
|
* Last major round (Unless Bruce thinks of somthing :-) of malloc changes.phk1997-10-121-1/+3
| | | | | | | | Distribute all but the most fundamental malloc types. This time I also remembered the trick to making things static: Put "static" in front of them. A couple of finer points by: bde
* Implement XPG/SYSV-style getpgid()/getsid() syscalls. getpgid() uses thepeter1997-08-191-1/+50
| | | | | | same syscall number as NetBSD/OpenBSD. The getpgid() came from NetBSD (I think) originally, but it's basically cut/paste/edit from the other simple get*() syscalls.
* Removed unused #includes.bde1997-08-021-4/+1
|
* Don't incorrectly set P_SUGID in setre[ug]id() for no reason, as noticedpeter1997-04-021-5/+9
| | | | | | | by bde. Don't return EPERM in setre[ug]id() just because the caller passes in the current effective id in the second arg (ie: no change), as suggested by ache.
* Implement code for an OpenBSD-style issetuigid().peter1997-03-311-1/+26
| | | | | | | | | | | | | | | | This is valueable for library code which needs to be able to find out whether the current process is or *was* set[ug]id at some point in the past, and may have a "tainted" execution environment. This is especially a problem with the trend to immediately revoke privs at startup and regain them for critical sections. One problem with this is that if a cracker is able to compromise the program while it's still got a saved id, the cracker can direct the program to regain the privs. Another problem is that the user may be able to affect the program in some other way (eg: setting resolver host aliases) and the library code needs to know when it should disable these sorts of features. Reviewed by: ache Inspired by: OpenBSD (but with a different implementation)
* Do not set the P_SUGID flag in seteuid()/setegid() if nothing has changed.peter1997-03-311-11/+20
| | | | | | (for supporting issetugid()) Reviewed by: ache (as was the previous commit, rev 1.29)
* Do not set the P_SUGID flag in seteuid()/setegid() if nothing has changed.peter1997-03-311-9/+15
| | | | (for supporting issetugid())
* Fully implement the clause in Appendix B.4.2.2 from Posix 1003.1peter1997-03-311-31/+132
| | | | | | | | | | | | | | | that allows traditional BSD setuid/setgid behavior. The only visible difference should be that a non-root setuid program (eg: inn's "rnews" program) that is setuid to news, can completely "become" uid news. (ie: setuid(geteuid()) This was allowed in traditional 4.2/4.3BSD and is now "blessed" by Posix as a special case of "appropriate privilige". Also, be much more careful with the P_SUGID flag so that we can use it for issetugid() - only set it if something changed. Reviewed by: ache
OpenPOWER on IntegriCloud