summaryrefslogtreecommitdiffstats
path: root/sys/kern
Commit message (Collapse)AuthorAgeFilesLines
* When prot is VM_PROT_NONE, call pmap_page_protect() directly rather thanalc2002-11-102-3/+3
| | | | | | | | | indirectly through vm_page_protect(). The one remaining page flag that is updated by vm_page_protect() is already being updated by our various pmap implementations. Note: A later commit will similarly change the VM_PROT_READ case and eliminate vm_page_protect().
* Fix instances of macros with improperly parenthasized arguments.alfred2002-11-091-1/+1
| | | | Verified by: md5
* Assign value of NULL to imgp->execlabel when imgp is initializedrwatson2002-11-081-0/+1
| | | | | | | | in the ELF code. Missed in earlier merge from the MAC tree. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* To reduce per-return overhead of userret(), call intorwatson2002-11-081-4/+7
| | | | | | | | | | | | | | | mac_thread_userret() only if PS_MACPEND is set in the process AST mask. This avoids the cost of the entry point in the common case, but requires policies interested in the userret event to set the flag (protected by the scheduler lock) if they do want the event. Since all the policies that we're working with which use mac_thread_userret() use the entry point only selectively to perform operations deferred for locking reasons, this maintains the desired semantics. Approved by: re Requested by: bde Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Add an explicit execlabel argument to exec-related MAC policy entryrwatson2002-11-081-3/+4
| | | | | | | | | points, rather than relying on policies to grub around in the image activator instance structure. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Move the definitions of the hw.physmem, hw.usermem and hw.availpagestmm2002-11-071-0/+26
| | | | | | | | | | | sysctls to MI code; this reduces code duplication and makes all of them available on sparc64, and the latter two on powerpc. The semantics by the i386 and pc98 hw.availpages is slightly changed: previously, holes between ranges of available pages would be included, while they are excluded now. The new behaviour should be more correct and brings i386 in line with the other architectures. Move physmem to vm/vm_init.c, where this variable is used in MI code.
* - Use %j to print intmax_t values.jhb2002-11-071-3/+4
| | | | - Cast more daddr_t values to intmax_t when printing to quiet warnings.
* Use %z to quiet a warning.jhb2002-11-071-1/+1
|
* - Fix a bunch of casts to long which were truncating off_t's.mux2002-11-071-17/+15
| | | | | | | - Remove the comments which were justifying this by the fact that we don't have %q in the kernel, this was probably right back in time, but we now have %q, and we even have better to print those types (%j).
* - Use a better definition for MNAMELEN which doesn't requiremux2002-11-071-1/+1
| | | | | | | to have one #ifdef per architecture. - Change a space to a tab after a nearby #define. Obtained from: bde
* Do a bit more work in the aio code to simulate the credential environmentrwatson2002-11-071-0/+7
| | | | | | | | | | | | | | | of the original AIO request: save and restore the active thread credential as well as using the file credential, since MAC (and some other bits of the system) rely on the thread credential instead of/as well as the file credential. In brief: cache td->td_ucred when the AIO operation is queued, temporarily set and restore the kernel thread credential, and release the credential when done. Similar to ktrace credential management. Reviewed by: alc Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Spotted a couple of places where the socket buffer's counters were beingkbyanc2002-11-052-0/+8
| | | | | | | manipulated directly (rather than using sballoc()/sbfree()); update them to tweak the new sb_ctl field too. Sponsored by: NTT Multimedia Communications Labs
* Fix filt_soread() to properly flag a kevent when a 0-byte datagram iskbyanc2002-11-051-1/+1
| | | | | | | received. Verified by: dougb, Manfred Antar <null@pozo.com> Sponsored by: NTT Multimedia Communications Labs
* Correct merge-o: disable the right execve() variation if !MACrwatson2002-11-051-4/+4
|
* Bring in two sets of changes:rwatson2002-11-052-14/+128
| | | | | | | | | | | | | | | | | | | | | | (1) Permit userland applications to request a change of label atomic with an execve() via mac_execve(). This is required for the SEBSD port of SELinux/FLASK. Attempts to invoke this without MAC compiled in result in ENOSYS, as with all other MAC system calls. Complexity, if desired, is present in policy modules, rather than the framework. (2) Permit policies to have access to both the label of the vnode being executed as well as the interpreter if it's a shell script or related UNIX nonsense. Because we can't hold both vnode locks at the same time, cache the interpreter label. SEBSD relies on this because it supports secure transitioning via shell script executables. Other policies might want to take both labels into account during an integrity or confidentiality decision at execve()-time. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Regen.rwatson2002-11-052-4/+4
|
* Flesh out the definition of __mac_execve(): per earlier discussion,rwatson2002-11-051-1/+2
| | | | | | | | it's essentially execve() with an optional MAC label argument. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Assert that appropriate vnodes are locked in mac_execve_will_transition().rwatson2002-11-051-0/+8
| | | | | | | | Allow transitioning to be twiddled off using the process and fs enforcement flags, although at some point this should probably be its own flag. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Hook up the mac_will_execve_transition() and mac_execve_transition()rwatson2002-11-051-0/+15
| | | | | | | | | | | | | | | | | entrypoints, #ifdef MAC. The supporting logic already existed in kern_mac.c, so no change there. This permits MAC policies to cause a process label change as the result of executing a binary -- typically, as a result of executing a specially labeled binary. For example, the SEBSD port of SELinux/FLASK uses this functionality to implement TE type transitions on processes using transitioning binaries, in a manner similar to setuid. Policies not implementing a notion of transition (all the ones in the tree right now) require no changes, since the old label data is copied to the new label via mac_create_cred() even if a transition does occur. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Typo in comment: commmand -> commandkeramida2002-11-051-1/+1
| | | | Reviewed by: jhb
* Remove reference to struct execve_args from struct imgact, whichrwatson2002-11-053-19/+42
| | | | | | | | | | | | | | | | | describes an image activation instance. Instead, make use of the existing fname structure entry, and introduce two new entries, userspace_argv, and userspace_envv. With the addition of mac_execve(), this divorces the image structure from the specifics of the execve() system call, removes a redundant pointer, etc. No semantic change from current behavior, but it means that the structure doesn't depend on syscalls.master-generated includes. There seems to be some redundant initialization of imgact entries, which I have maintained, but which could probably use some cleaning up at some point. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Permit MAC policies to instrument the access control decisions forrwatson2002-11-042-0/+47
| | | | | | | | | | | system accounting configuration and for nfsd server thread attach. Policies might use this to protect the integrity or confidentiality of accounting data, limit the ability to turn on or off accounting, as well as to prevent inappropriately labeled threads from becoming nfs server threads. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Remove mac_cache_fslabel_in_vnode sysctl -- with the new VFS/MACrwatson2002-11-041-6/+0
| | | | | | | construction, labels are always cached. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* License clarification and wording changes: NAI has approved removal ofrwatson2002-11-041-7/+4
| | | | | clause three, and NAI Labs now goes by the name Network Associates Laboratories.
* Introduce mac_check_system_settime(), a MAC check allowing policies torwatson2002-11-032-0/+26
| | | | | | | augment the system policy for changing the system time. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Regen from yesterday's system call placeholder rename.rwatson2002-11-022-4/+4
|
* Catch up with the removal of the vm page buckets spin mutex.alc2002-11-021-1/+0
|
* Revert the change in revision 1.77 of kern/uipc_socket2.c. It is causingalc2002-11-023-3/+3
| | | | | | a panic because the socket's state isn't as expected by sofree(). Discussed with: dillon, fenner
* Update the st_size reported via stat(2) to accurately reflect the amountkbyanc2002-11-011-1/+1
| | | | | | | | of data available to read for non-TCP sockets. Reviewed by: -net, -arch Sponsored by: NTT Multimedia Communications Labs MFC after: 2 weeks
* Track the number of non-data chararacters stored in socket buffers so thatkbyanc2002-11-011-1/+1
| | | | | | | | | | | the data value returned by kevent()'s EVFILT_READ filter on non-TCP sockets accurately reflects the amount of data that can be read from the sockets by applications. PR: 30634 Reviewed by: -net, -arch Sponsored by: NTT Multimedia Communications Labs MFC after: 2 weeks
* Rename __execve_mac() to __mac_execve() for increased consistencyrwatson2002-11-011-1/+1
| | | | | | with other MAC system calls. Requested by: various (phk, gordont, jake, ...)
* Add MAC checks for various kenv() operations: dump, get, set, unset,rwatson2002-11-012-1/+75
| | | | | | | permitting MAC policies to limit access to the kernel environment. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Introduce malloc_last_fail() which returns the number of seconds sincephk2002-11-011-0/+16
| | | | | | | | | malloc(9) failed last time. This is intended to help code adjust memory usage to the current circumstances. A typical use could be: if (malloc_last_fail() < 60) reduce_cache_by_one();
* Introduce a "time_uptime" global variable which holds the time since bootphk2002-11-011-0/+2
| | | | in seconds.
* KSE-enabled processes only.davidxu2002-10-312-2/+8
|
* Move to C99 sparse structure initialization for the mac_policy_opsrwatson2002-10-301-583/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | structure definition, rather than using an operation vector we translate into the structure. Originally, we used a vector for two reasons: (1) We wanted to define the structure sparsely, which wasn't supported by the C compiler for structures. For a policy with five entry points, you don't want to have to stick in a few hundred NULL function pointers. (2) We thought it would improve ABI compatibility allowing modules to work with kernels that had a superset of the entry points defined in the module, even if the kernel had changed its entry point set. Both of these no longer apply: (1) C99 gives us a way to sparsely define a static structure. (2) The ABI problems existed anyway, due to enumeration numbers, argument changes, and semantic mismatches. Since the going rule for FreeBSD is that you really need your modules to pretty closely match your kernel, it's not worth the complexity. This submit eliminates the operation vector, dynamic allocation of the operation structure, copying of the vector to the structure, and redoes the vectors in each policy to direct structure definitions. One enourmous benefit of this change is that we now get decent type checking on policy entry point implementation arguments. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* While 'mode_t' seemed like a good idea for the access mode argument forrwatson2002-10-301-3/+3
| | | | | | | | | MAC access() and open() checks, the argument actually has an int type where it becomes available. Switch to using 'int' for the mode argument throughout the MAC Framework and policy modules. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Check NULL thread mailbox pointer.davidxu2002-10-302-0/+4
|
* Style fixes.davidxu2002-10-302-20/+20
|
* Don't forget to set syscall result.davidxu2002-10-302-0/+4
|
* Add an actual implementation of kse_thr_interrupt()davidxu2002-10-303-4/+54
|
* Minor comment typo fix.rwatson2002-10-291-1/+1
| | | | Submitted by: Wayne Morrison <tewok@tislabs.com>
* The syscall names are string constants, so make them consts.dwmalone2002-10-292-3/+3
|
* Trim extraneous #else and #endif MAC comments per style(9).rwatson2002-10-282-9/+9
|
* An inappropriate ASSERT slipped in during the recent merge of therwatson2002-10-281-2/+0
| | | | reboot checking; remove.
* Close a race window in kse_create(): signal delivered after SIGPENDING calldavidxu2002-10-282-8/+4
| | | | but before we call kse_link().
* Fix a case in kern_rename() where a vn_finished_write() call wasiedowse2002-10-272-4/+4
| | | | | | | | missed. This bug has been present since the vn_start_write() and vn_finished_write() calls were first added in revision 1.159. When the case is triggered, any attempts to create snapshots on the filesystem will deadlock and also prevent further write activity on that filesystem.
* Change the way support for asynchronous I/O is indicated to applicationswollman2002-10-275-3/+40
| | | | | | | | | | to conform to 1003.1-2001. Make it possible for applications to actually tell whether or not asynchronous I/O is supported. Since FreeBSD's aio implementation works on all descriptor types, don't call down into file or vnode ops when [f]pathconf() is asked about _PC_ASYNC_IO; this avoids the need for every file and vnode op to know about it.
* Centrally manage enforcement of {reboot,swapon,sysctl} using therwatson2002-10-271-13/+9
| | | | | | | mac_enforce_system toggle, rather than several separate toggles. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Implement mac_check_system_sysctl(), a MAC Framework entry point torwatson2002-10-272-0/+39
| | | | | | | | | | | | | | | permit MAC policies to augment the security protections on sysctl() operations. This is not really a wonderful entry point, as we only have access to the MIB of the target sysctl entry, rather than the more useful entry name, but this is sufficient for policies like Biba that wish to use their notions of privilege or integrity to prevent inappropriate sysctl modification. Affects MAC kernels only. Since SYSCTL_LOCK isn't in sysctl.h, just kern_sysctl.c, we can't assert the SYSCTL subsystem lockin the MAC Framework. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
OpenPOWER on IntegriCloud