summaryrefslogtreecommitdiffstats
path: root/sys/kern/subr_acl_posix1e.c
Commit message (Collapse)AuthorAgeFilesLines
* Sweep kernel replacing suser(9) calls with priv(9) calls, assigningrwatson2006-11-061-42/+49
| | | | | | | | | | | | | specific privilege names to a broad range of privileges. These may require some future tweaking. Sponsored by: nCircle Network Security, Inc. Obtained from: TrustedBSD Project Discussed on: arch@ Reviewed (at least in part) by: mlaier, jmg, pjd, bde, ceri, Alex Lyashkov <umka at sevcity dot net>, Skip Ford <skip dot ford at verizon dot net>, Antoine Brodin <antoine dot brodin at laposte dot net>
* Update and reformat comments for POSIX.1e ACL utility routines.rwatson2006-07-231-48/+55
|
* Move POSIX.1e-specific utility routines from kern_acl.c torwatson2006-07-061-416/+5
| | | | | | | | | subr_acl_posix1e.c, leaving kern_acl.c containing only ACL system calls and utility routines common across ACL types. Add subr_acl_posix1e.c to the build. Obtained from: TrustedBSD Project
* Implement new world order in VFS locking for ACLs. This will remove thecsjp2005-09-171-44/+45
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | unconditional acquisition of Giant for ACL related operations. If the file system is set as being MP safe and debug.mpsafevfs is 1, do not pickup giant. For any operations which require namei(9) lookups: __acl_get_file __acl_get_link __acl_set_file __acl_set_link __acl_delete_file __acl_delete_link __acl_aclcheck_file __acl_aclcheck_link -Set the MPSAFE flag in NDINIT -Initialize vfslocked variable using the NDHASGIANT macro For functions which operate on fds, make sure the operations are locked: __acl_get_fd __acl_set_fd __acl_delete_fd __acl_aclcheck_fd -Initialize vfslocked using VFS_LOCK_GIANT before we manipulate the vnode Discussed with: jeff
* Convert the primary ACL allocator from malloc(9) to using a UMA zone instead.csjp2005-09-061-1/+13
| | | | | | | | Also introduce an aclinit function which will be used to create the UMA zone for use by file systems at system start up. MFC after: 1 month Discussed with: rwatson
* Rename suser_cred()'s PRISON_ROOT flag to SUSER_ALLOWJAIL. This iscperciva2004-07-261-6/+6
| | | | | | | | | | | somewhat clearer, but more importantly allows for a consistent naming scheme for suser_cred flags. The old name is still defined, but will be removed in a few days (unless I hear any complaints...) Discussed with: rwatson, scottl Requested by: jhb
* Update my personal copyrights and NETA copyrights in the kernelrwatson2004-02-221-1/+1
| | | | | | | | to use the "year1-year3" format, as opposed to "year1, year2, year3". This seems to make lawyers more happy, but also prevents the lines from getting excessively long as the years start to add up. Suggested by: imp
* Move more ACL logic from the UFS code (ufs_acl.c) to the central POSIX.1erwatson2003-08-041-1/+84
| | | | | | | | | | | | | | | | | | support routines in kern_acl.c: - Define ACL_OVERRIDE_MASK and ACL_PRESERVE_MASK centrally in acl.h: the mode bits that are (and aren't) stored in the ACL. - Add acl_posix1e_acl_to_mode(): given a POSIX.1e extended ACL, generate a compatibility mode (only the bits supported by the POSIX.1e ACL). - acl_posix1e_newfilemode(): Given a requested creation mode and default ACL, calculate the mode for the new file system object (only the bits supported by the POSIX.1e ACL). PR: 50148 Reported by: Ritz, Bruno <bruno_ritz@gmx.ch> Obtained from: TrustedBSD Project
* Add a f_vnode field to struct file.phk2003-06-221-4/+4
| | | | | | | | | | | | Several of the subtypes have an associated vnode which is used for stuff like the f*() functions. By giving the vnode a speparate field, a number of checks for the specific subtype can be replaced simply with a check for f_vnode != NULL, and we can later free f_data up to subtype specific use. At this point in time, f_data still points to the vnode, so any code I might have overlooked will still work.
* Use __FBSDID().obrien2003-06-111-2/+3
|
* Bow to the whining masses and change a union back into void *. Retaindillon2003-01-131-7/+4
| | | | | removal of unnecessary casts and throw in some minor cleanups to see if anyone complains, just for the hell of it.
* Change struct file f_data to un_data, a union of the correct structdillon2003-01-121-5/+4
| | | | | | | | | | pointer types, and remove a huge number of casts from code using it. Change struct xfile xf_data to xun_data (ABI is still compatible). If we need to add a #define for f_data and xf_data we can, but I don't think it will be necessary. There are no operational changes in this commit.
* When compiling the kernel do not implicitly include filedesc.h from proc.h,alfred2003-01-011-0/+1
| | | | | | this was causing filedesc work to be very painful. In order to make this work split out sigio definitions to thier own header (sigio.h) which is included from proc.h for the time being.
* Implement new ACL system calls which do not follow symbolic links:rwatson2002-12-291-1/+89
| | | | | | | | | __acl_get_link(), __acl_set_link(), acl_delete_link(), and __acl_aclcheck_link(), with almost identical implementations to the existing __acl_*_file() variants on these calls. Update copyright. Obtained from: TrustedBSD Project
* unwrap lines made short enough by SCARGS removalalfred2002-12-141-6/+3
|
* SCARGS removal take II.alfred2002-12-141-19/+19
|
* Backout removal SCARGS, the code freeze is only "selectively" over.alfred2002-12-131-19/+19
|
* Remove SCARGS.alfred2002-12-131-19/+19
| | | | Reviewed by: md5
* Introduce support for Mandatory Access Control and extensiblerwatson2002-08-011-1/+28
| | | | | | | | | | kernel access control. Instrument the kernel ACL retrieval and modification system calls to invoke MAC framework entry points to authorize these operations. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Teach discretionary access control methods for files about VAPPENDrwatson2002-07-221-13/+13
| | | | | | | and VALLPERM. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Fix a bug that prevented the deletion of non-default ACLs from beingrwatson2002-06-271-1/+1
| | | | | | | | passed down the VFS stack. While I'm here, replace a '0' with a 'NULL' to make the code more readable. Sponsored by: DARPA, NAI Labs Obtained from: TrustedBSD Project
* A bit of whitespace magic.rwatson2002-06-271-5/+5
|
* opt_cap.c no longer neededrwatson2002-06-131-2/+0
|
* More s/file system/filesystem/gtrhodes2002-05-161-2/+2
|
* Change the suser() API to take advantage of td_ucred as well as do ajhb2002-04-011-1/+1
| | | | | | | | | | | | general cleanup of the API. The entire API now consists of two functions similar to the pre-KSE API. The suser() function takes a thread pointer as its only argument. The td_ucred member of this thread must be valid so the only valid thread pointers are curthread and a few kernel threads such as thread0. The suser_cred() function takes a pointer to a struct ucred as its first argument and an integer flag as its second argument. The flag is currently only used for the PRISON_ROOT flag. Discussed on: smp@
* Fix a gcc-3.1+ warning.peter2002-03-191-0/+3
| | | | | | | | | | | warning: deprecated use of label at end of compound statement ie: you cannot do this anymore: switch(foo) { .... default: }
* Simple p_ucred -> td_ucred changes to start using the per-thread ucredjhb2002-02-271-9/+7
| | | | reference.
* o Scatter vn_start_write() and vn_finished_write() through ACL code sorwatson2002-02-041-3/+10
| | | | | | | that it interacts properly with snapshotting. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Note that Kirk apparently missed adding vn_start_write() and friendsrwatson2002-02-041-0/+3
| | | | | to kern_acl.c when he added snapshotting. This will need to be added at some point.
* SMP Lock struct file, filedesc and the global file list.alfred2002-01-131-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Seigo Tanimura (tanimura) posted the initial delta. I've polished it quite a bit reducing the need for locking and adapting it for KSE. Locks: 1 mutex in each filedesc protects all the fields. protects "struct file" initialization, while a struct file is being changed from &badfileops -> &pipeops or something the filedesc should be locked. 1 mutex in each struct file protects the refcount fields. doesn't protect anything else. the flags used for garbage collection have been moved to f_gcflag which was the FILLER short, this doesn't need locking because the garbage collection is a single threaded container. could likely be made to use a pool mutex. 1 sx lock for the global filelist. struct file * fhold(struct file *fp); /* increments reference count on a file */ struct file * fhold_locked(struct file *fp); /* like fhold but expects file to locked */ struct file * ffind_hold(struct thread *, int fd); /* finds the struct file in thread, adds one reference and returns it unlocked */ struct file * ffind_lock(struct thread *, int fd); /* ffind_hold, but returns file locked */ I still have to smp-safe the fget cruft, I'll get to that asap.
* o Since kern_acl.c uses #ifdef CAPABILITIES to controlrwatson2001-11-021-0/+2
| | | | | | capability-specific semantics, #include "opt_cap.h". Obtained from: TrustedBSD Project
* o Update copyright dates.rwatson2001-11-011-0/+2
| | | | | | | o Add reference to TrustedBSD Project in license header. o Update dated comments, including comment in extattr.h claiming that no file systems support extended attributes. o Improve comment consistency.
* o Update copyright dates.rwatson2001-10-271-1/+1
| | | | Obtained from: TrustedBSD Project
* o Improve style(9) compliance following KSE modifications. In particular,rwatson2001-10-271-18/+19
| | | | | | | | | strip the space from '( struct thread *...', wrap long lines. o Remove an unneeded comment on the topic of no lock being required as part of the NDINIT() in __acl_get_file(), as it's really not required there. Obtained from: TrustedBSD Project
* KSE Milestone 2julian2001-09-121-44/+44
| | | | | | | | | | | | | | Note ALL MODULES MUST BE RECOMPILED make the kernel aware that there are smaller units of scheduling than the process. (but only allow one thread per process at this time). This is functionally equivalent to teh previousl -current except that there is a thread associated with each process. Sorry john! (your next MFC will be a doosie!) Reviewed by: peter@freebsd.org, dillon@freebsd.org X-MFC after: ha ha ha ha
* In the case of ACL_OTHER and undefined ACL entry id's, setjedgar2001-09-011-2/+2
| | | | | | ae_id to ACL_UNDEFINED_ID instead of 0. Reviewed by: rwatson
* Giant Pushdown ACL syscalls:dillon2001-09-011-31/+71
| | | | | | __acl_get_file, __acl_set_file, __acl_get_fd, __acl_set_fd, __acl_delete_file, __acl_delete_fd, __acl_aclcheck_file, __acl_aclcheck_fd
* o Clarify comments in vaccess_acl_posix1e() ACL evaluation routine sorwatson2001-08-241-19/+23
| | | | | | as to improve readability and accuracy. Obtained from: TrustedBSD Project
* o As part of the move to not maintaining copies of the vnode owning uidrwatson2001-04-291-1/+1
| | | | | | | | | | | | | | | | and gid in the ACL, vaccess_acl_posix1e() was changed to accept explicit file_uid and file_gid as arguments. However, in making the change, I explicitly checked file_gid against cr->cr_groups[0], rather than using groupmember, resulting in ACL_GROUP_OBJ entries being compared to the caller's effective gid only, not the remainder of its groups. This was recently corrected for the version of the group call without privilege, but the second test (when privilege is added) was missed. This change replaces an additiona cr->cr_groups[0] check with groupmember(). Pointed out by: jedgar Reviewed by: jedgar Obtained from: TrustedBSD Project
* Fix a bug introduced in the last commit: vaccess_acl_posix1 only checkedtmm2001-04-231-1/+1
| | | | | | | the file gid gainst the egid of the accessing process for the ACL_GROUP_OBJ case, and ignored supplementary groups. Approved by: rwatson
* In my first reading of POSIX.1e, I misinterpreted handling of therwatson2001-04-171-45/+99
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ACL_USER_OBJ and ACL_GROUP_OBJ fields, believing that modification of the access ACL could be used by privileged processes to change file/directory ownership. In fact, this is incorrect; ACL_*_OBJ (+ ACL_MASK and ACL_OTHER) should have undefined ae_id fields; this commit attempts to correct that misunderstanding. o Modify arguments to vaccess_acl_posix1e() to accept the uid and gid associated with the vnode, as those can no longer be extracted from the ACL passed as an argument. Perform all comparisons against the passed arguments. This actually has the effect of simplifying a number of components of this call, as well as reducing the indent level, but now seperates handling of ACL_GROUP_OBJ from ACL_GROUP. o Modify acl_posix1e_check() to return EINVAL if the ae_id field of any of the ACL_{USER_OBJ,GROUP_OBJ,MASK,OTHER} entries is a value other than ACL_UNDEFINED_ID. As a temporary work-around to allow clean upgrades, set the ae_id field to ACL_UNDEFINED_ID before each check so that this cannot cause a failure in the short term (this work-around will be removed when the userland libraries and utilities are updated to take this change into account). o Modify ufs_sync_acl_from_inode() so that it forces ACL_{USER_OBJ,GROUP_OBJ,MASK,OTHER} ae_id fields to ACL_UNDEFINED_ID when synchronizing the ACL from the inode. o Modify ufs_sync_inode_from_acl to not propagate uid and gid information to the inode from the ACL during ACL update. Also modify the masking of permission bits that may be set from ALLPERMS to (S_IRWXU|S_IRWXG|S_IRWXO), as ACLs currently do not carry none-ACCESSPERMS (S_ISUID, S_ISGID, S_ISTXT). o Modify ufs_getacl() so that when it emulates an access ACL from the inode, it initializes the ae_id fields to ACL_UNDEFINED_ID. o Clean up ufs_setacl() substantially since it is no longer possible to perform chown/chgrp operations using vop_setacl(), so all the access control for that can be eliminated. o Modify ufs_access() so that it passes owner uid and gid information into vaccess_acl_posix1e(). Pointed out by: jedger Obtained from: TrustedBSD Project
* Correct the following defines to match the POSIX.1e spec:jedgar2001-04-111-36/+36
| | | | | | | | ACL_PERM_EXEC -> ACL_EXECUTE ACL_PERM_READ -> ACL_READ ACL_PERM_WRITE -> ACL_WRITE Obtained from: TrustedBSD
* o Introduce filesystem-independent POSIX.1e ACL utility routines torwatson2001-03-061-5/+440
| | | | | | | | | | | | | | | | | | | | | | | | support implementations of ACLs in file systems. Introduce the following new functions: vaccess_acl_posix1e() vaccess() that accepts an ACL acl_posix1e_mode_to_perm() Convert mode bits to ACL rights acl_posix1e_mode_to_entry() Build ACL entry from mode/uid/gid acl_posix1e_perms_to_mode() Generate file mode from ACL acl_posix1e_check() Syntax verification for ACL These functions allow a file system to rely on central ACL evaluation and syntax checking, as well as providing useful utilities to allow ACL-based file systems to generate mode/owner/etc information to return via VOP_GETATTR(), and to support file systems that split their ACL information over their existing inode storage (mode, uid, gid) and extended ACL into extended attributes (additional users, groups, ACL mask). o Add prototypes for exported functions to sys/acl.h, sys/vnode.h Reviewed by: trustedbsd-discuss, freebsd-arch Obtained from: TrustedBSD Project
* Back out proc locking to protect p_ucred for obtaining additionaljhb2001-01-271-32/+8
| | | | references along with the actual obtaining of additional references.
* Proc locking.jhb2001-01-241-8/+32
|
* Staticize some malloc M_ instances.phk2000-12-081-1/+1
|
* o Change locking rules for VOP_GETACL() to indicate that vnode locksrwatson2000-09-211-1/+4
| | | | | | | | | | must be held when retrieving ACLs from vnodes. This is required for EA-based UFS ACL implementations. o Update vacl_get_acl() so that it does appropriate vnode locking. o Remove static from M_ACL malloc define so that it is accessible for consumers of ACLs other than in kern_acl.c Obtained from: TrustedBSD Project
* Remove unneeded #include <vm/vm_zone.h>phk2000-04-301-1/+0
| | | | Generated by: src/tools/tools/kerninclude
* Fix bde'isms in acl/extattr syscall interface, renaming syscalls torwatson2000-01-191-20/+16
| | | | | | prettier (?) names, adding some const's around here, et al. Reviewed by: bde
* Second pass commit to introduce new ACL and Extended Attribute systemrwatson1999-12-191-0/+281
calls, vnops, vfsops, both in /kern, and to individual file systems that require a vfsop_ array entry. Reviewed by: eivind
OpenPOWER on IntegriCloud