summaryrefslogtreecommitdiffstats
path: root/sys/security/audit/audit_bsm_klib.c
Commit message (Collapse)AuthorAgeFilesLines
* Change various routines that are responsible for transforming auditrwatson2009-02-081-4/+4
| | | | | | | | event IDs based on arguments to return au_event_t rather than int. Obtained from: TrustedBSD Project Sponsored by: Apple, Inc. MFC after: 1 week
* Don't lock the vnode around calls to vn_fullpath().jhb2008-11-041-16/+3
| | | | Reviewed by: csjp, rwatson
* Protect the event->class lookup database using an rwlock instead of arwatson2008-10-301-8/+15
| | | | | | | | mutex, as it's rarely changed but frequently accessed read-only from multiple threads, so a potentially significant source of contention. MFC after: 1 month Sponsored by: Apple, Inc.
* Use sbuf_putc instead of sbuf_cat. This makes more sense, since we arecsjp2008-08-241-1/+1
| | | | | | appending a single character to the buffer. MFC after: 2 weeks
* Currently, BSM audit pathname token generation for chrooted or jailedcsjp2008-07-311-55/+93
| | | | | | | | | | | | | | | | | | | | | | | | | processes are not producing absolute pathname tokens. It is required that audited pathnames are generated relative to the global root mount point. This modification changes our implementation of audit_canon_path(9) and introduces a new function: vn_fullpath_global(9) which performs a vnode -> pathname translation relative to the global mount point based on the contents of the name cache. Much like vn_fullpath, vn_fullpath_global is a wrapper function which called vn_fullpath1. Further, the string parsing routines have been converted to use the sbuf(9) framework. This change also removes the conditional acquisition of Giant, since the vn_fullpath1 method will not dip into file system dependent code. The vnode locking was modified to use vhold()/vdrop() instead the vref() and vrele(). This will modify the hold count instead of modifying the user count. This makes more sense since it's the kernel that requires the reference to the vnode. This also makes sure that the vnode does not get recycled we hold the reference to it. [1] Discussed with: rwatson Reviewed by: kib [1] MFC after: 2 weeks
* Further synchronization of copyrights, licenses, white space, etc fromrwatson2008-07-311-2/+2
| | | | | | | Apple and from the OpenBSM vendor tree. Obtained from: Apple Inc., TrustedBSD Project MFC after: 3 days
* Minor white space tweak.rwatson2008-07-231-1/+1
| | | | | Obtained from: Apple Inc. MFC after: 3 days
* Use #define<tab> rather than #define<space>.rwatson2008-07-221-1/+1
| | | | | Obtained from: Apple Inc. MFC after: 3 days
* In preparation to sync Apple and FreeBSD versions of security audit,rwatson2008-07-221-2/+2
| | | | | | | | pick up the Apple Computer -> Apple change in their copyright and license templates. Obtained from: Apple Inc. MFC after: 3 days
* Use __FBSDID() for $FreeBSD$ IDs in the audit code.rwatson2008-04-131-2/+3
| | | | MFC after: 3 days
* Add audit_prefixes to two more globally visible functions in the Auditrwatson2008-03-011-2/+2
| | | | | | implementation. MFC after: 1 month
* Rename several audit functions in the global kernel symbol namespace torwatson2008-02-251-4/+4
| | | | | | | | | | have audit_ on the front: - canon_path -> audit_canon_path - msgctl_to_event -> audit_msgctl_to_event - semctl_to_event -> audit_semctl_to_event MFC after: 1 month
* vn_lock() is currently only used with the 'curthread' passed as argument.attilio2008-01-101-1/+1
| | | | | | | | | | | | | | | | Remove this argument and pass curthread directly to underlying VOP_LOCK1() VFS method. This modify makes the code cleaner and in particular remove an annoying dependence helping next lockmgr() cleanup. KPI results, obviously, changed. Manpage and FreeBSD_version will be updated through further commits. As a side note, would be valuable to say that next commits will address a similar cleanup about VFS methods, in particular vop_lock1 and vop_unlock. Tested by: Diego Sardina <siarodx at gmail dot com>, Andrea Di Pasquale <whyx dot it at gmail dot com>
* Replace use of AU_NULL with 0 when no audit classes are in use; thisrwatson2007-10-291-2/+2
| | | | | | | | supports the removal of hard-coded audit class constants in OpenBSM 1.0. All audit classes are now dynamically configured via the audit_class database. Obtained from: TrustedBSD Project
* Clean up audit comments--formatting, spelling, etc.rwatson2007-06-011-7/+6
|
* Replace custom file descriptor array sleep lock constructed using a mutexrwatson2007-04-041-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | and flags with an sxlock. This leads to a significant and measurable performance improvement as a result of access to shared locking for frequent lookup operations, reduced general overhead, and reduced overhead in the event of contention. All of these are imported for threaded applications where simultaneous access to a shared file descriptor array occurs frequently. Kris has reported 2x-4x transaction rate improvements on 8-core MySQL benchmarks; smaller improvements can be expected for many workloads as a result of reduced overhead. - Generally eliminate the distinction between "fast" and regular acquisisition of the filedesc lock; the plan is that they will now all be fast. Change all locking instances to either shared or exclusive locks. - Correct a bug (pointed out by kib) in fdfree() where previously msleep() was called without the mutex held; sx_sleep() is now always called with the sxlock held exclusively. - Universally hold the struct file lock over changes to struct file, rather than the filedesc lock or no lock. Always update the f_ops field last. A further memory barrier is required here in the future (discussed with jhb). - Improve locking and reference management in linux_at(), which fails to properly acquire vnode references before using vnode pointers. Annotate improper use of vn_fullpath(), which will be replaced at a future date. In fcntl(), we conservatively acquire an exclusive lock, even though in some cases a shared lock may be sufficient, which should be revisited. The dropping of the filedesc lock in fdgrowtable() is no longer required as the sxlock can be held over the sleep operation; we should consider removing that (pointed out by attilio). Tested by: kris Discussed with: jhb, kris, attilio, jeff
* Add a witness sleep warning to canon_path(), which invokes vput() and hencerwatson2006-12-291-0/+3
| | | | | | | may perform an unbounded sleep. Remove an XXX comment suggesting that one be added. Obtained from: TrustedBSD Project
* Introduce support for per-audit pipe preselection independent from therwatson2006-06-051-6/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | global audit trail configuration. This allows applications consuming audit trails to specify parameters for which audit records are of interest, including selecting records not required by the global trail. Allowing application interest specification without changing the global configuration allows intrusion detection systems to run without interfering with global auditing or each other (if multiple are present). To implement this: - Kernel audit records now carry a flag to indicate whether they have been selected by the global trail or by the audit pipe subsystem, set during record commit, so that this information is available after BSM conversion when delivering the BSM to the trail and audit pipes in the audit worker thread asynchronously. Preselection by either record target will cause the record to be kept. - Similar changes to preselection when the audit record is created when the system call is entering: consult both the global trail and pipes. - au_preselect() now accepts the class in order to avoid repeatedly looking up the mask for each preselection test. - Define a series of ioctls that allow applications to specify whether they want to track the global trail, or program their own preselection parameters: they may specify their own flags and naflags masks, similar to the global masks of the same name, as well as a set of per-auid masks. They also set a per-pipe mode specifying whether they track the global trail, or user their own -- the door is left open for future additional modes. A new ioctl is defined to allow a user process to flush the current audit pipe queue, which can be used after reprogramming pre-selection to make sure that only records of interest are received in future reads. - Audit pipe data structures are extended to hold the additional fields necessary to support preselection. By default, audit pipes track the global trail, so "praudit /dev/auditpipe" will track the global audit trail even though praudit doesn't program the audit pipe selection model. - Comment about the complexities of potentially adding partial read support to audit pipes. By using a set of ioctls, applications can select which records are of interest, and toggle the preselection mode. Obtained from: TrustedBSD Project
* Check to see if the rootdir is the same as the current working directory.csjp2006-06-011-3/+11
| | | | | | | If it is, and the pathname was relative, do not separate the componenets with a '/' character. Obtained from: TrustedBSD Project
* Merge Perforce change 93581 from TrustedBSD audit3 branch:rwatson2006-03-191-41/+43
| | | | | | Mega-style patch. Obtained from: TrustedBSD Project
* Import kernel audit framework:rwatson2006-02-011-0/+538
- Management of audit state on processes. - Audit system calls to configure process and system audit state. - Reliable audit record queue implementation, audit_worker kernel thread to asynchronously store records on disk. - Audit event argument. - Internal audit data structure -> BSM audit trail conversion library. - Audit event pre-selection. - Audit pseudo-device permitting kernel->user upcalls to notify auditd of kernel audit events. Much work by: wsalamon Obtained from: TrustedBSD Project, Apple Computer, Inc.
OpenPOWER on IntegriCloud