summaryrefslogtreecommitdiffstats
path: root/sys/kern/sys_capability.c
Commit message (Collapse)AuthorAgeFilesLines
* Remove redundant parenthesis.pjd2013-02-171-1/+1
|
* Style: move opt_*.h includes in the proper place.pjd2012-06-101-3/+3
| | | | MFC after: 1 month
* Allways call fdrop().pho2012-03-121-5/+3
|
* Revisit the capability failure trace points. The initial implementationdes2011-10-181-2/+8
| | | | | | | | only logged instances where an operation on a file descriptor required capabilities which the file descriptor did not have. By adding a type enum to struct ktr_cap_fail, we can catch other types of capability failures as well, such as disallowed system calls or attempts to wrap a file descriptor with more capabilities than it had to begin with.
* Add a new trace point, KTRFAC_CAPFAIL, which traces capability checkdes2011-10-111-1/+9
| | | | failures. It is included in the default set for ktrace(1) and kdump(1).
* In order to maximize the re-usability of kernel code in user space thiskmacy2011-09-161-8/+8
| | | | | | | | | | | | | patch modifies makesyscalls.sh to prefix all of the non-compatibility calls (e.g. not linux_, freebsd32_) with sys_ and updates the kernel entry points and all places in the code that use them. It also fixes an additional name space collision between the kernel function psignal and the libc function of the same name by renaming the kernel psignal kern_psignal(). By introducing this change now we will ease future MFCs that change syscalls. Reviewed by: rwatson Approved by: re (bz)
* Add the fo_chown and fo_chmod methods to struct fileops and use themkib2011-08-161-0/+22
| | | | | | | | | | to implement fchown(2) and fchmod(2) support for several file types that previously lacked it. Add MAC entries for chown/chmod done on posix shared memory and (old) in-kernel posix semaphores. Based on the submission by: glebius Reviewed by: rwatson Approved by: re (bz)
* Update use of the FEATURE() macro in sys_capability.c to reflect the moverwatson2011-08-131-1/+3
| | | | | | to two different kernel options for capability mode vs. capabilities. Approved by: re (bz)
* Now that capability support has been committed, update and expand therwatson2011-08-131-3/+17
| | | | | | comment at the type of sys_capability.c to describe its new contents. Approved by: re (xxx)
* Allow Capsicum capabilities to delegate constrainedjonathan2011-08-131-9/+9
| | | | | | | | | | | | | | | | | access to file system subtrees to sandboxed processes. - Use of absolute paths and '..' are limited in capability mode. - Use of absolute paths and '..' are limited when looking up relative to a capability. - When a name lookup is performed, identify what operation is to be performed (such as CAP_MKDIR) as well as check for CAP_LOOKUP. With these constraints, openat() and friends are now safe in capability mode, and can then be used by code such as the capability-mode runtime linker. Approved by: re (bz), mentor (rwatson) Sponsored by: Google Inc
* Second-to-last commit implementing Capsicum capabilities in the FreeBSDrwatson2011-08-111-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | kernel for FreeBSD 9.0: Add a new capability mask argument to fget(9) and friends, allowing system call code to declare what capabilities are required when an integer file descriptor is converted into an in-kernel struct file *. With options CAPABILITIES compiled into the kernel, this enforces capability protection; without, this change is effectively a no-op. Some cases require special handling, such as mmap(2), which must preserve information about the maximum rights at the time of mapping in the memory map so that they can later be enforced in mprotect(2) -- this is done by narrowing the rights in the existing max_protection field used for similar purposes with file permissions. In namei(9), we assert that the code is not reached from within capability mode, as we're not yet ready to enforce namespace capabilities there. This will follow in a later commit. Update two capability names: CAP_EVENT and CAP_KEVENT become CAP_POST_KEVENT and CAP_POLL_KEVENT to more accurately indicate what they represent. Approved by: re (bz) Submitted by: jonathan Sponsored by: Google Inc
* Turn on AUDIT_ARG_RIGHTS() for cap_new(2).jonathan2011-07-221-2/+0
| | | | | | | | Now that the code is in place to audit capability method rights, start using it to audit the 'rights' argument to cap_new(2). Approved by: re (kib), mentor (rwatson) Sponsored by: Google Inc
* Add cap_new() and cap_getrights() system calls.jonathan2011-07-151-0/+67
| | | | | | | | | Implement two previously-reserved Capsicum system calls: - cap_new() creates a capability to wrap an existing file descriptor - cap_getrights() queries the rights mask of a capability. Approved by: mentor (rwatson), re (Capsicum blanket) Sponsored by: Google Inc
* Add implementation for capabilities.jonathan2011-07-151-4/+214
| | | | | | | | | | | | | | Code to actually implement Capsicum capabilities, including fileops and kern_capwrap(), which creates a capability to wrap an existing file descriptor. We also modify kern_close() and closef() to handle capabilities. Finally, remove cap_filelist from struct capability, since we don't actually need it. Approved by: mentor (rwatson), re (Capsicum blanket) Sponsored by: Google Inc
* Add kernel functions to unwrap capabilities.jonathan2011-07-041-0/+122
| | | | | | | | | | | | | | | cap_funwrap() and cap_funwrap_mmap() unwrap capabilities, exposing the underlying object. Attempting to unwrap a capability with an inadequate rights mask (e.g. calling cap_funwrap(fp, CAP_WRITE | CAP_MMAP, &result) on a capability whose rights mask is CAP_READ | CAP_MMAP) will result in ENOTCAPABLE. Unwrapping a non-capability is effectively a no-op. These functions will be used by Capsicum-aware versions of _fget(), etc. Approved by: mentor (rwatson), re (Capsicum blanket) Sponsored by: Google Inc
* We may split today's CAPABILITIES into CAPABILITY_MODE (which hasjonathan2011-06-291-4/+4
| | | | | | | | | | | | | to do with global namespaces) and CAPABILITIES (which has to do with constraining file descriptors). Just in case, and because it's a better name anyway, let's move CAPABILITIES out of the way. Also, change opt_capabilities.h to opt_capsicum.h; for now, this will only hold CAPABILITY_MODE, but it will probably also hold the new CAPABILITIES (implying constrained file descriptors) in the future. Approved by: rwatson Sponsored by: Google UK Ltd
* Remove redundant Capsicum sysctl.jonathan2011-06-251-7/+0
| | | | | | Since we're now declaring FEATURE(security_capabilities), there's no need for an explicit SYSCTL_NODE. Approved by: rwatson
* - Add a FEATURE for capsicum (security_capabilities).netchild2011-03-041-0/+2
| | | | | | - Rename mac FEATURE to security_mac. Discussed with: rwatson
* Add initial support for Capsicum's Capability Mode to the FreeBSD kernel,rwatson2011-03-011-0/+123
compiled conditionally on options CAPABILITIES: Add a new credential flag, CRED_FLAG_CAPMODE, which indicates that a subject (typically a process) is in capability mode. Add two new system calls, cap_enter(2) and cap_getmode(2), which allow setting and querying (but never clearing) the flag. Export the capability mode flag via process information sysctls. Sponsored by: Google, Inc. Reviewed by: anderson Discussed with: benl, kris, pjd Obtained from: Capsicum Project MFC after: 3 months
OpenPOWER on IntegriCloud