summaryrefslogtreecommitdiffstats
path: root/sys/kern/kern_sysctl.c
Commit message (Collapse)AuthorAgeFilesLines
...
* In userland_sysctl(), call useracc() with the actual newlen value to berwatson2007-09-021-1/+1
| | | | | | | | | | | | | used, rather than the one passed via 'req', which may not reflect a rewrite. This call to useracc() is redundant to validation performed by later copyin()/copyout() calls, so there isn't a security issue here, but this could technically lead to excessive validation of addresses if the length in newlen is shorter than req.newlen. Approved by: re (kensmith) Reviewed by: jhb Submitted by: Constantine A. Murenin <cnst+freebsd@bugmail.mojo.ru> Sponsored by: Google Summer of Code 2007
* Eliminate now-unused SUSER_ALLOWJAIL arguments to priv_check_cred(); inrwatson2007-06-121-2/+1
| | | | | | | | | | | | | | | some cases, move to priv_check() if it was an operation on a thread and no other flags were present. Eliminate caller-side jail exception checking (also now-unused); jail privilege exception code now goes solely in kern_jail.c. We can't yet eliminate suser() due to some cases in the KAME code where a privilege check is performed and then used in many different deferred paths. Do, however, move those prototypes to priv.h. Reviewed by: csjp Obtained from: TrustedBSD Project
* Add a function for exporting 64 bit types.dwmalone2007-06-041-0/+25
|
* Further system call comment cleanup:rwatson2007-03-051-2/+1
| | | | | | | | | | - Remove also "MP SAFE" after prior "MPSAFE" pass. (suggested by bde) - Remove extra blank lines in some cases. - Add extra blank lines in some cases. - Remove no-op comments consisting solely of the function name, the word "syscall", or the system call name. - Add punctuation. - Re-wrap some comments.
* Remove 'MPSAFE' annotations from the comments above most system calls: allrwatson2007-03-041-6/+0
| | | | | | | | system calls now enter without Giant held, and then in some cases, acquire Giant explicitly. Remove a number of other MPSAFE annotations in the credential code and tweak one or two other adjacent comments.
* Sweep kernel replacing suser(9) calls with priv(9) calls, assigningrwatson2006-11-061-6/+5
| | | | | | | | | | | | | specific privilege names to a broad range of privileges. These may require some future tweaking. Sponsored by: nCircle Network Security, Inc. Obtained from: TrustedBSD Project Discussed on: arch@ Reviewed (at least in part) by: mlaier, jmg, pjd, bde, ceri, Alex Lyashkov <umka at sevcity dot net>, Skip Ford <skip dot ford at verizon dot net>, Antoine Brodin <antoine dot brodin at laposte dot net>
* Complete break-out of sys/sys/mac.h into sys/security/mac/mac_framework.hrwatson2006-10-221-1/+3
| | | | | | | | | | | | | begun with a repo-copy of mac.h to mac_framework.h. sys/mac.h now contains the userspace and user<->kernel API and definitions, with all in-kernel interfaces moved to mac_framework.h, which is now included across most of the kernel instead. This change is the first step in a larger cleanup and sweep of MAC Framework interfaces in the kernel, and will not be MFC'd. Obtained from: TrustedBSD Project Sponsored by: SPARTA
* Kill an XXX remark that has been untrue since rev. 1.150 of this file.yar2006-06-161-4/+0
|
* Make sysctl_msec_to_ticks(SYSCTL_HANDLER_ARGS) generally available insteadandre2006-02-161-0/+26
| | | | | | | of being private to tcp_timer.c. Sponsored by: TCP/IP Optimization Fundraise 2005 MFC after: 3 days
* Touch all the pages wired by sysctl_wire_old_buffer() to avoid PTEtruckman2006-01-251-1/+12
| | | | | | | | | | | | modified bit emulation traps on Alpha while holding locks in the sysctl handler. A better solution would be to pass a hint to the Alpha pmap code to tell mark these pages as modified when they as they are being wired, but that appears to be more difficult to implement. Suggested by: jhb MFC after: 3 days
* Drop in a WITNESS_WARN into SYSCTL_IN to make sure that we arecsjp2005-08-081-0/+2
| | | | | | | | | not holding any non-sleep-able-locks locks when copyin is called. This gets executed un-conditionally since we have no function to wire the buffer in this direction. Pointed out by: truckman MFC after: 1 week
* Check to see if we wired the user-supplied buffers in SYSCTL_OUT, ifcsjp2005-08-081-1/+6
| | | | | | | | | | | | the buffer has not been wired and we are holding any non-sleep-able locks, drop a witness warning. If the buffer has not been wired, it is possible that the writing of the data can sleep, especially if the page is not in memory. This can result in a number of different locking issues, including dead locks. MFC after: 1 week Discussed with: rwatson Reviewed by: jhb
* Make another bunch of SYSCTL_NODEs staticphk2005-02-101-4/+4
|
* Add a missing prefix to a struct field for consistency.phk2005-02-071-7/+7
|
* Be consistent and always use form 'return (value);' instead of 'return value;'.pjd2004-12-311-15/+15
| | | | | We had (before this change) 84 lines where it was style(9)-clean and 15 lines where it was not.
* Move the 'debug' sysctl tree under options SYSCTL_DEBUG. It generatesrwatson2004-10-271-0/+2
| | | | | | an inordinate amount of synchronous console output that is fairly undesirable on slower serial console. It's easily hit by accident when frobbing other sysctls late at night.
* Add missing zero flag arguments to calls to userland_sysctl()phk2004-10-121-7/+7
|
* Put on my peril sensitive sunglasses and add a flags field to the internalpeter2004-10-111-10/+28
| | | | | | | | | | | | | | | | sysctl routines and state. Add some code to use it for signalling the need to downconvert a data structure to 32 bits on a 64 bit OS when requested by a 32 bit app. I tried to do this in a generic abi wrapper that intercepted the sysctl oid's, or looked up the format string etc, but it was a real can of worms that turned into a fragile mess before I even got it partially working. With this, we can now run 'sysctl -a' on a 32 bit sysctl binary and have it not abort. Things like netstat, ps, etc have a long way to go. This also fixes a bug in the kern.ps_strings and kern.usrstack hacks. These do matter very much because they are used by libc_r and other things.
* Avoid casts as lvalues.kan2004-07-281-3/+3
|
* Rename suser_cred()'s PRISON_ROOT flag to SUSER_ALLOWJAIL. This iscperciva2004-07-261-1/+1
| | | | | | | | | | | somewhat clearer, but more importantly allows for a consistent naming scheme for suser_cred flags. The old name is still defined, but will be removed in a few days (unless I hear any complaints...) Discussed with: rwatson, scottl Requested by: jhb
* Make sysctl_wire_old_buffer() respect ENOMEM from vslock() by markinggreen2004-06-111-2/+5
| | | | | | | the valid length as 0. This prevents vsunlock() from removing a system wire from memory that was not successfully wired (by us). Submitted by: tegge
* Remove advertising clause from University of California Regent's license,imp2004-04-051-4/+0
| | | | | | per letter dated July 22, 1999. Approved by: core
* Rename the wiredlen member of struct sysctl_req to validlen and alwaystruckman2004-03-161-14/+16
| | | | | | | | | | | | set it to avoid the need for a bunch of code that tests whether or not the lock member is set to REQ_WIRED in order to determine which length member should be used. Fix another bug in the oldlen return value code. Fix a potential wired memory leak if a sysctl handler uses sysctl_wire_old_buffer() and returns an EAGAIN error to trigger a retry.
* Don't bother calling vslock() and vsunlock() if oldlen is zero.truckman2004-03-161-7/+9
| | | | | | | | | | | | If vslock() returns ENOMEM, sysctl_wire_old_buffer() should set wiredlen to zero and return zero (success) so that the handler will operate according to sysctl(3): The size of the buffer is given by the location specified by oldlenp before the call, and that location gives the amount of data copied after a successful call and after a call that returns with the error code ENOMEM. The handler will return an ENOMEM error because the zero length buffer will overflow.
* Revert to the original vslock() and vsunlock() API with the followingtruckman2004-03-151-6/+3
| | | | | | | | | exceptions: Retain the recently added vslock() error return. The type of the len argument should be size_t, not u_int. Suggested by: bde
* Undo the merger of mlock()/vslock and munlock()/vsunlock() and thetruckman2004-03-051-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | introduction of kern_mlock() and kern_munlock() in src/sys/kern/kern_sysctl.c 1.150 src/sys/vm/vm_extern.h 1.69 src/sys/vm/vm_glue.c 1.190 src/sys/vm/vm_mmap.c 1.179 because different resource limits are appropriate for transient and "permanent" page wiring requests. Retain the kern_mlock() and kern_munlock() API in the revived vslock() and vsunlock() functions. Combine the best parts of each of the original sets of implementations with further code cleanup. Make the mclock() and vslock() implementations as similar as possible. Retain the RLIMIT_MEMLOCK check in mlock(). Move the most strigent test, which can return EAGAIN, last so that requests that have no hope of ever being satisfied will not be retried unnecessarily. Disable the test that can return EAGAIN in the vslock() implementation because it will cause the sysctl code to wedge. Tested by: Cy Schubert <Cy.Schubert AT komquats.com>
* Add sysctl_move_oid() which reparents an existing OID.des2004-02-271-0/+20
|
* Split the mlock() kernel code into two parts, mlock(), which unpackstruckman2004-02-261-19/+32
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | the syscall arguments and does the suser() permission check, and kern_mlock(), which does the resource limit checking and calls vm_map_wire(). Split munlock() in a similar way. Enable the RLIMIT_MEMLOCK checking code in kern_mlock(). Replace calls to vslock() and vsunlock() in the sysctl code with calls to kern_mlock() and kern_munlock() so that the sysctl code will obey the wired memory limits. Nuke the vslock() and vsunlock() implementations, which are no longer used. Add a member to struct sysctl_req to track the amount of memory that is wired to handle the request. Modify sysctl_wire_old_buffer() to return an error if its call to kern_mlock() fails. Only wire the minimum of the length specified in the sysctl request and the length specified in its argument list. It is recommended that sysctl handlers that use sysctl_wire_old_buffer() should specify reasonable estimates for the amount of data they want to return so that only the minimum amount of memory is wired no matter what length has been specified by the request. Modify the callers of sysctl_wire_old_buffer() to look for the error return. Modify sysctl_old_user to obey the wired buffer length and clean up its implementation. Reviewed by: bms
* Reimplement sysctls handling by MAC framework.pjd2004-02-221-15/+15
| | | | | | | | | | | Now I believe it is done in the right way. Removed some XXMAC cases, we now assume 'high' integrity level for all sysctls, except those with CTLFLAG_ANYBODY flag set. No more magic. Reviewed by: rwatson Approved by: rwatson, scottl (mentor) Tested with: LINT (compilation), mac_biba(4) (functionality)
* Bring back sysctl_wire_old_buffer(). Fix a bug in sysctl_handle_opaque()bms2003-10-051-13/+13
| | | | | | whereby the pointers would not get reset on a retried SYSCTL_OUT() call. Noticed by: bde
* Fix a security problem in sysctl() the long way round.bms2003-10-051-18/+14
| | | | | | | | | | | | | | Use pre-emption detection to avoid the need for wiring a userland buffer when copying opaque data structures. sysctl_wire_old_buffer() is now a no-op. Other consumers of this API should use pre-emption detection to notice update collisions. vslock() and vsunlock() should no longer be called by any code and should be retired in subsequent commits. Discussed with: pete, phk MFC after: 1 week
* Fold the vslock() and vsunlock() calls in this file with #if 0's; they willbms2003-10-051-1/+8
| | | | | | | | go away in due course. Involuntary pre-emption means that we can't count on wiring of pages alone for consistency when performing a SYSCTL_OUT() bigger than PAGE_SIZE. Discussed with: pete, phk
* Remove magic numbers surrounding locking state in the sysctl module, andbms2003-10-051-8/+9
| | | | replace them with more meaningful defines.
* Use __FBSDID().obrien2003-06-111-1/+3
|
* When loading a module that contains a sysctl which is already compiledmux2003-05-291-1/+24
| | | | | | | | | | in the kernel, the sysctl_register() call would fail, as expected. However, when unloading this module again, the kernel would then panic in sysctl_unregister(). Print a message error instead. Submitted by: Nicolai Petri <nicolai@catpipe.net> Reviewed by: imp Approved by: re@ (jhb)
* Use a shorter and less redundant name for the sysctl tree lock.jhb2003-03-111-1/+1
|
* Replace calls to WITNESS_SLEEP() and witness_list() with equivalent callsjhb2003-03-041-1/+2
| | | | to WITNESS_WARN().
* Don't panic when enumerating SYSCTL_NODE() nodes without any childrenrwatson2003-02-221-1/+2
| | | | | | nodes. Submitted by: green, Hiten Pandya <hiten@unixdaemons.com>
* Back out M_* changes, per decision of the TRB.imp2003-02-191-8/+8
| | | | Approved by: trb
* Remove M_TRYWAIT/M_WAITOK/M_WAIT. Callers should use 0.alfred2003-01-211-8/+8
| | | | Merge M_NOWAIT/M_DONTWAIT into a single flag M_NOWAIT.
* Introduce the ability to flag a sysctl for operation at secure level 2 or 3dillon2003-01-141-2/+3
| | | | | | | | | | | | in addition to secure level 1. The mask supports up to a secure level of 8 but only add defines through CTLFLAG_SECURE3 for now. As per the missif in the log entry for 1.11 of ip_fw2.c which added the secure flag to the IPFW sysctl's in the first place, change the secure level requirement from 1 to 3 now that we have support for it. Reviewed by: imp With Design Suggestions by: imp
* Fix kernel build.mux2003-01-111-1/+1
| | | | Pointy hats to: dillon, Hiten Pandya <hiten@unixdaemons.com>
* Implement mac_check_system_sysctl(), a MAC Framework entry point torwatson2002-10-271-0/+11
| | | | | | | | | | | | | | | permit MAC policies to augment the security protections on sysctl() operations. This is not really a wonderful entry point, as we only have access to the MIB of the target sysctl entry, rather than the more useful entry name, but this is sufficient for policies like Biba that wish to use their notions of privilege or integrity to prevent inappropriate sysctl modification. Affects MAC kernels only. Since SYSCTL_LOCK isn't in sysctl.h, just kern_sysctl.c, we can't assert the SYSCTL subsystem lockin the MAC Framework. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Fix a style nit.mux2002-10-261-1/+1
|
* Use strlcpy() instead of strncpy() to copy NUL terminated stringsrobert2002-10-171-2/+3
| | | | for safety and consistency.
* Be consistent about "static" functions: if the function is markedphk2002-09-281-1/+1
| | | | | | static in its prototype, mark it static at the definition too. Inspired by: FlexeLint warning #512
* Introduce a new sysctl flag, CTLFLAG_SKIP, which will causemux2002-08-101-0/+3
| | | | | | | | | | sysctl_sysctl_next() to skip this sysctl. The sysctl is still available, but doesn't appear in a "sysctl -a". This is especially useful when you want to deprecate a sysctl, and add a warning into it to warn users that they are using an old interface. Without this flag, the warning would get echoed when running "sysctl -a" (which happens at boot).
* Don't automagically call vslock() from SYSCTL_OUT(). Instead, complaintruckman2002-08-061-4/+2
| | | | | | | about calls to SYSCTL_OUT() made with locks held if the buffer has not been pre-wired. SYSCTL_OUT() should not be called while holding locks, but if this is not possible, the buffer should be wired by calling sysctl_wire_old_buffer() before grabbing any locks.
* Make a temporary copy of the output data in the generic sysctl handlerstruckman2002-07-281-6/+45
| | | | | | | | | | | | | | | | | | | so that the data is less likely to be inconsistent if SYSCTL_OUT() blocks. If the data is large, wire the output buffer instead. This is somewhat less than optimal, since the handler could skip the copy if it knew that the data was static. If the data is dynamic, we are still not guaranteed to get a consistent copy since another processor could change the data while the copy is in progress because the data is not locked. This problem could be solved if the generic handlers had the ability to grab the proper lock before the copy and release it afterwards. This may duplicate work done in other sysctl handlers in the kernel which also copy the data, possibly while a lock is held, before calling they call a generic handler to output the data. These handlers should probably call SYSCTL_OUT() directly.
* Provide a way for sysctl handlers to pre-wire their output buffer beforetruckman2002-07-221-0/+17
| | | | | they grab a lock so that they don't block in SYSCTL_OUT() with the lock being held.
OpenPOWER on IntegriCloud