summaryrefslogtreecommitdiffstats
path: root/sys/security/mac/mac_inet.c
Commit message (Collapse)AuthorAgeFilesLines
* Add mac_inpcb_check_visible MAC Framework entry point, which is similarbz2008-10-171-0/+12
| | | | | | | to mac_socket_check_visible but operates on the inpcb. Reviewed by: rwatson MFC after: 3 months (set timer, decide then)
* Introduce two related changes to the TrustedBSD MAC Framework:rwatson2008-08-231-28/+46
| | | | | | | | | | | | | | | | | | | | | | | | | (1) Abstract interpreter vnode labeling in execve(2) and mac_execve(2) so that the general exec code isn't aware of the details of allocating, copying, and freeing labels, rather, simply passes in a void pointer to start and stop functions that will be used by the framework. This change will be MFC'd. (2) Introduce a new flags field to the MAC_POLICY_SET(9) interface allowing policies to declare which types of objects require label allocation, initialization, and destruction, and define a set of flags covering various supported object types (MPC_OBJECT_PROC, MPC_OBJECT_VNODE, MPC_OBJECT_INPCB, ...). This change reduces the overhead of compiling the MAC Framework into the kernel if policies aren't loaded, or if policies require labels on only a small number or even no object types. Each time a policy is loaded or unloaded, we recalculate a mask of labeled object types across all policies present in the system. Eliminate MAC_ALWAYS_LABEL_MBUF option as it is no longer required. MFC after: 1 week ((1) only) Reviewed by: csjp Obtained from: TrustedBSD Project Sponsored by: Apple, Inc.
* The TrustedBSD MAC Framework named struct ipq instances 'ipq', which is therwatson2008-06-131-14/+14
| | | | | | | | | | | same as the global variable defined in ip_input.c. Instead, adopt the name 'q' as found in about 1/2 of uses in ip_input.c, preventing a collision on the name. This is non-harmful, but means that search and replace on the global works less well (as in the virtualization work), as well as indexing tools. MFC after: 1 week Reported by: julian
* Plug a memory leak which can occur when multiple MAC policies are loadedcsjp2008-05-271-0/+4
| | | | | | | | which label mbufs. This leak can occur if one policy successfully allocates label storage and subsequent allocations from other policies fail. Spotted by: rwatson MFC after: 1 week
* When propagating a MAC label from an inpcb to an mbuf, allow read andrwatson2008-04-191-1/+1
| | | | | | write locks on the inpcb, not just write locks. MFC after: 3 months
* Convert pcbinfo and inpcb mutexes to rwlocks, and modify macros torwatson2008-04-171-3/+3
| | | | | | | | | | | | | | | explicitly select write locking for all use of the inpcb mutex. Update some pcbinfo lock assertions to assert locked rather than write-locked, although in practice almost all uses of the pcbinfo rwlock main exclusive, and all instances of inpcb lock acquisition are exclusive. This change should introduce (ideally) little functional change. However, it lays the groundwork for significantly increased parallelism in the TCP/IP code. MFC after: 3 months Tested by: kris (superset of committered patch)
* Continue to move from generic network entry points in the TrustedBSD MACrwatson2007-10-281-2/+29
| | | | | | | | | | | | | | Framework by moving from mac_mbuf_create_netlayer() to more specific entry points for specific network services: - mac_netinet_firewall_reply() to be used when replying to in-bound TCP segments in pf and ipfw (etc). - Rename mac_netinet_icmp_reply() to mac_netinet_icmp_replyinplace() and add mac_netinet_icmp_reply(), reflecting that in some cases we overwrite a label in place, but in others we apply the label to a new mbuf. Obtained from: TrustedBSD Project
* Move towards more explicit support for various network protocol stacksrwatson2007-10-281-1/+25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | in the TrustedBSD MAC Framework: - Add mac_atalk.c and add explicit entry point mac_netatalk_aarp_send() for AARP packet labeling, rather than using a generic link layer entry point. - Add mac_inet6.c and add explicit entry point mac_netinet6_nd6_send() for ND6 packet labeling, rather than using a generic link layer entry point. - Add expliict entry point mac_netinet_arp_send() for ARP packet labeling, and mac_netinet_igmp_send() for IGMP packet labeling, rather than using a generic link layer entry point. - Remove previous genering link layer entry point, mac_mbuf_create_linklayer() as it is no longer used. - Add implementations of new entry points to various policies, largely by replicating the existing link layer entry point for them; remove old link layer entry point implementation. - Make MAC_IFNET_LOCK(), MAC_IFNET_UNLOCK(), and mac_ifnet_mtx global to the MAC Framework rather than static to mac_net.c as it is now needed outside of mac_net.c. Obtained from: TrustedBSD Project
* Rename 'mac_mbuf_create_from_firewall' to 'mac_netinet_firewall_send' asrwatson2007-10-261-2/+2
| | | | | | | | | | we move towards netinet as a pseudo-object for the MAC Framework. Rename 'mac_create_mbuf_linklayer' to 'mac_mbuf_create_linklayer' to reflect general object-first ordering preference. Sponsored by: SPARTA (original patches against Mac OS X) Obtained from: TrustedBSD Project, Apple Computer
* Normalize TCP syncache-related MAC Framework entry points to match mostrwatson2007-10-251-8/+8
| | | | | | | other entry points in the form mac_<object>_method(). Discussed with: csjp Obtained from: TrustedBSD Project
* Merge first in a series of TrustedBSD MAC Framework KPI changesrwatson2007-10-241-33/+36
| | | | | | | | | | | | | | | | | | | | | | | from Mac OS X Leopard--rationalize naming for entry points to the following general forms: mac_<object>_<method/action> mac_<object>_check_<method/action> The previous naming scheme was inconsistent and mostly reversed from the new scheme. Also, make object types more consistent and remove spaces from object types that contain multiple parts ("posix_sem" -> "posixsem") to make mechanical parsing easier. Introduce a new "netinet" object type for certain IPv4/IPv6-related methods. Also simplify, slightly, some entry point names. All MAC policy modules will need to be recompiled, and modules not updates as part of this commit will need to be modified to conform to the new KPI. Sponsored by: SPARTA (original patches against Mac OS X) Obtained from: TrustedBSD Project, Apple Computer
* Normalize variable naming in the MAC Framework by adopting the normalrwatson2007-04-221-23/+21
| | | | | | | | | variable name conventions for arguments passed into the framework -- for example, name network interfaces 'ifp', sockets 'so', mounts 'mp', mbufs 'm', processes 'p', etc, wherever possible. Previously there was significant variation in this regard. Normalize copyright lists to ranges where sensible.
* Continue 7-CURRENT MAC Framework rearrangement and cleanup:rwatson2007-02-061-1/+0
| | | | | | | | | | | | | | Don't perform a nested include of _label.h in mac.h, as mac.h now describes only the user API to MAC, and _label.h defines the in-kernel representation of MAC labels. Remove mac.h includes from policies and MAC framework components that do not use userspace MAC API definitions. Add _KERNEL inclusion checks to mac_internal.h and mac_policy.h, as these are kernel-only include files Obtained from: TrustedBSD Project
* In mac_inpcb_sosetlabel(), assert the socket lock rather than commentingrwatson2006-12-281-1/+1
| | | | | | that we should assert the socket lock. Obtained from: TrustedBSD Project
* Move src/sys/sys/mac_policy.h, the kernel interface between the MACrwatson2006-12-221-2/+1
| | | | | | | | | | | Framework and security modules, to src/sys/security/mac/mac_policy.h, completing the removal of kernel-only MAC Framework include files from src/sys/sys. Update the MAC Framework and MAC policy modules. Delete the old mac_policy.h. Third party policy modules will need similar updating. Obtained from: TrustedBSD Project
* Remove mac_enforce_subsystem debugging sysctls. Enforcement onrwatson2006-12-211-3/+0
| | | | | | | | | | subsystems will be a property of policy modules, which may require access control check entry points to be invoked even when not actively enforcing (i.e., to track information flow without providing protection). Obtained from: TrustedBSD Project Suggested by: Christopher dot Vance at sparta dot com
* Re-wrap comment at 77 character columns.rwatson2006-12-201-7/+7
|
* Fix LOR between the syncache and inpcb locks when MAC is present in thecsjp2006-12-131-0/+54
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | kernel. This LOR snuck in with some of the recent syncache changes. To fix this, the inpcb handling was changed: - Hang a MAC label off the syncache object - When the syncache entry is initially created, we pickup the PCB lock is held because we extract information from it while initializing the syncache entry. While we do this, copy the MAC label associated with the PCB and use it for the syncache entry. - When the packet is transmitted, copy the label from the syncache entry to the mbuf so it can be processed by security policies which analyze mbuf labels. This change required that the MAC framework be extended to support the label copy operations from the PCB to the syncache entry, and then from the syncache entry to the mbuf. These functions really should be referencing the syncache structure instead of the label. However, due to some of the complexities associated with exposing this syncache structure we operate directly on it's label pointer. This should be OK since we aren't making any access control decisions within this code directly, we are merely allocating and copying label storage so we can properly initialize mbuf labels for any packets the syncache code might create. This also has a nice side effect of caching. Prior to this change, the PCB would be looked up/locked for each packet transmitted. Now the label is cached at the time the syncache entry is initialized. Submitted by: andre [1] Discussed with: rwatson [1] andre submitted the tcp_syncache.c changes
* Complete break-out of sys/sys/mac.h into sys/security/mac/mac_framework.hrwatson2006-10-221-0/+1
| | | | | | | | | | | | | begun with a repo-copy of mac.h to mac_framework.h. sys/mac.h now contains the userspace and user<->kernel API and definitions, with all in-kernel interfaces moved to mac_framework.h, which is now included across most of the kernel instead. This change is the first step in a larger cleanup and sweep of MAC Framework interfaces in the kernel, and will not be MFC'd. Obtained from: TrustedBSD Project Sponsored by: SPARTA
* Remove MAC_DEBUG label counters, which were used to debug leaks andrwatson2006-09-201-13/+0
| | | | | | | | | other problems while labels were first being added to various kernel objects. They have outlived their usefulness. MFC after: 1 month Suggested by: Christopher dot Vance at SPARTA dot com Obtained from: TrustedBSD Project
* Introduce a new entry point, mac_create_mbuf_from_firewall. This entry pointcsjp2006-09-121-0/+10
| | | | | | | | | | | | | | | | | | | | | | exists to allow the mandatory access control policy to properly initialize mbufs generated by the firewall. An example where this might happen is keep alive packets, or ICMP error packets in response to other packets. This takes care of kernel panics associated with un-initialize mbuf labels when the firewall generates packets. [1] I modified this patch from it's original version, the initial patch introduced a number of entry points which were programmatically equivalent. So I introduced only one. Instead, we should leverage mac_create_mbuf_netlayer() which is used for similar situations, an example being icmp_error() This will minimize the impact associated with the MFC Submitted by: mlaier [1] MFC after: 1 week This is a RELENG_6 candidate
* Move inet and inet6 related MAC Framework entry points from mac_net.crwatson2004-02-261-0/+292
to a new mac_inet.c. This code is now conditionally compiled based on inet support being compiled into the kernel. Move socket related MAC Framework entry points from mac_net.c to a new mac_socket.c. To do this, some additional _enforce MIB variables are now non-static. In addition, mbuf_to_label() is now mac_mbuf_to_label() and non-static. Obtained from: TrustedBSD Project Sponsored by: DARPA, McAfee Research
OpenPOWER on IntegriCloud