summaryrefslogtreecommitdiffstats
path: root/sys/security/mac_biba
Commit message (Collapse)AuthorAgeFilesLines
* Back out M_* changes, per decision of the TRB.imp2003-02-191-1/+1
| | | | Approved by: trb
* Implement mpo_check_kld_load() and mpo_check_kld_unload() for the Bibarwatson2003-02-041-0/+39
| | | | | | | | | MAC policy. To load a KLD, require that the subject hold Biba privilege, and the the kernel module be marked as high integrity. To unload a KLD, require that the subject hold Biba privilege. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Place more stringent checks on process credential relabeling for the Bibarwatson2003-02-041-6/+10
| | | | | | | | | | | | | | and MLS policies: as we support both an effective (single) element and range (available) elements, require that the single be in the range if both the single and range are defined in the update. Remove comments suggesting that such a check might be a good idea. Don't introduce a similar check for network interfaces; due to different interpretations of the single and range elements, it's not clear that it's useful to do so. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Rename the variable 'grade' to 'type' in interface parsing andrwatson2003-02-041-7/+7
| | | | | | | | | | labeling for Biba. Rename the variable 'level' to 'type' in interface parsing and labeling for MLS. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Remove M_TRYWAIT/M_WAITOK/M_WAIT. Callers should use 0.alfred2003-01-211-1/+1
| | | | Merge M_NOWAIT/M_DONTWAIT into a single flag M_NOWAIT.
* Default policies to on: if you load them or compile them into yourrwatson2002-12-101-1/+1
| | | | | | | | | | kernel, you should expect them to do something, so now they do. This doesn't affect users who don't load or explicitly compile in the policies. Approved by: re (jhb) Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Remove dm_root entry from struct devfs_mount. It's never set, and isrwatson2002-12-091-8/+10
| | | | | | | | | | | | unused. Replace it with a dm_mount back-pointer to the struct mount that the devfs_mount is associated with. Export that pointer to MAC Framework entry points, where all current policies don't use the pointer. This permits the SEBSD port of SELinux's FLASK/TE to compile out-of-the-box on 5.0-CURRENT with full file system labeling support. Approved by: re (murray) Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Garbage collect mac_create_devfs_vnode() -- it hasn't been used sincerwatson2002-11-121-12/+0
| | | | | | | | we brought in the new cache and locking model for vnode labels. We now rely on mac_associate_devfs_vnode(). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Update MAC modules for changes in arguments for exec MAC policyrwatson2002-11-081-2/+16
| | | | | | | | entry points to include an explicit execlabel. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Update policy modules for changes in arguments associated with supportrwatson2002-11-051-1/+1
| | | | | for label access on the interpreter, not just the shell script. No policies currently present in the system rely on the new labels.
* Since neither the Biba policy nor the MLS policy make use ofrwatson2002-11-051-23/+0
| | | | | | | transitioning, remove their transition entry points. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Implement mpo_check_system_acct and mpo_check_system_settime() for Biba:rwatson2002-11-041-0/+46
| | | | | | | | | | require Biba privilege to configure either, and require that accounting files be high integrity. Note that this does allow implicit information flow from low to high integrity, but it also protects the integrity of accounting data. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Correct use of mac_biba_subject_privileged() in swapon() code.rwatson2002-11-041-2/+4
| | | | | Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* License and wording updates: NAI has authorized the removal of clauserwatson2002-11-042-14/+8
| | | | | three from their BSD-style license. Also, s/NAI Labs/Network Associates Laboratories/.
* Fix some warnings on 64 bit architectures. The vn_extattr_get()mux2002-11-021-2/+1
| | | | | | | | | | | function takes an int * parameter, not a size_t * parameter. Arguably, it should rather take a size_t *, but that would require changing the uio_resid field of struct uio to be a size_t instead of an int, which I don't want to do that close to 5.0-RELEASE. Reviewed by: rwatson
* Move to C99 sparse structure initialization for the mac_policy_opsrwatson2002-10-301-264/+133
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | structure definition, rather than using an operation vector we translate into the structure. Originally, we used a vector for two reasons: (1) We wanted to define the structure sparsely, which wasn't supported by the C compiler for structures. For a policy with five entry points, you don't want to have to stick in a few hundred NULL function pointers. (2) We thought it would improve ABI compatibility allowing modules to work with kernels that had a superset of the entry points defined in the module, even if the kernel had changed its entry point set. Both of these no longer apply: (1) C99 gives us a way to sparsely define a static structure. (2) The ABI problems existed anyway, due to enumeration numbers, argument changes, and semantic mismatches. Since the going rule for FreeBSD is that you really need your modules to pretty closely match your kernel, it's not worth the complexity. This submit eliminates the operation vector, dynamic allocation of the operation structure, copying of the vector to the structure, and redoes the vectors in each policy to direct structure definitions. One enourmous benefit of this change is that we now get decent type checking on policy entry point implementation arguments. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Various minor type, prototype tweaks -- clean up cruft due to lack ofrwatson2002-10-301-4/+4
| | | | | | | type checking on entry points (to be introduced shortly). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* While 'mode_t' seemed like a good idea for the access mode argument forrwatson2002-10-301-1/+1
| | | | | | | | | MAC access() and open() checks, the argument actually has an int type where it becomes available. Switch to using 'int' for the mode argument throughout the MAC Framework and policy modules. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Try again to fix the KASSERT.rwatson2002-10-301-1/+1
|
* Fix a KASSERT bug that showed up only in the LINT build, not therwatson2002-10-301-1/+1
| | | | | | module build, so I missed it in the merge. Pointed out by: sam
* Implement Biba policy entry points for mac_check_system_swapon()rwatson2002-10-291-0/+59
| | | | | | | | | | | and mac_check_system_sysctl(), providing additional integrity protections relating to swap target device selection and system management via sysctl(). Require Biba privilege for both; also require that the target of swap operations be a high integrity object, since swap data is high integrity. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Asssociates Laboratories
* Require Biba privilege to relabel a network interface.rwatson2002-10-291-0/+7
| | | | | Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Remove all reference to 'struct oldmac', since it's no longer requiredrwatson2002-10-281-0/+27
| | | | | | | | | | with the new VFS/EA semantics in the MAC framework. Move the per-policy structures out to per-policy include files, removing all policy-specific defines and structures out of the base framework includes and implementation, making mac_biba and mac_mls entirely self-contained. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Add a return type for mac_biba_high_single(), apparently lost in anrwatson2002-10-281-0/+1
| | | | earlier merge. It's a 'static int'.
* Rename mac_biba_subject_equal_ok() to mac_biba_subject_privileged()rwatson2002-10-281-6/+6
| | | | | | | to evolve the notion of Biba privilege a bit. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Zero the trusted_interface buffer before starting parsing.rwatson2002-10-281-0/+6
| | | | | | | | Print a warning if a requested interface name is longer than IFNAMSIZ. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Slightly change the semantics of vnode labels for MAC: rather thanrwatson2002-10-261-61/+120
| | | | | | | | | | | | | | | | | | | | | "refreshing" the label on the vnode before use, just get the label right from inception. For single-label file systems, set the label in the generic VFS getnewvnode() code; for multi-label file systems, leave the labeling up to the file system. With UFS1/2, this means reading the extended attribute during vfs_vget() as the inode is pulled off disk, rather than hitting the extended attributes frequently during operations later, improving performance. This also corrects sematics for shared vnode locks, which were not previously present in the system. This chances the cache coherrency properties WRT out-of-band access to label data, but in an acceptable form. With UFS1, there is a small race condition during automatic extended attribute start -- this is not present with UFS2, and occurs because EAs aren't available at vnode inception. We'll introduce a work around for this shortly. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Style fix: space between 'switch' and '('.rwatson2002-10-221-1/+1
|
* Don't enforce MAC Biba policy for socket visibility if Biba is notrwatson2002-10-221-0/+3
| | | | | | | explicitly enabled. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Adapt MAC policies for the new user API changes; teach policies howrwatson2002-10-222-16/+290
| | | | | | | | | | to parse their own label elements (some cleanup to occur here in the future to use the newly added kernel strsep()). Policies now entirely encapsulate their notion of label in the policy module. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Introduce mac_biba_copy() and mac_mls_copy(), which conditionallyrwatson2002-10-211-9/+25
| | | | | | | | | | | copy elements of one Biba or MLS label to another based on the flags on the source label element. Use this instead of mac_{biba,mls}_{single,range}() to simplify the existing code, as well as support partial label updates (we don't update if none is requested). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Add compartment support to Biba and MLS policies. The logic of therwatson2002-10-212-16/+68
| | | | | | | | | | | | | policies remains the same: subjects and objects are labeled for integrity or sensitivity, and a dominance operator determines whether or not subject/object accesses are permitted to limit inappropriate information flow. Compartments are a non-hierarchal component to the label, so add a bitfield to the label element for each, and a set check as part of the dominance operator. This permits the implementation of "need to know" elements of MLS. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Demote sockets to single-label objects rather than maintaining arwatson2002-10-211-16/+0
| | | | | | | | | | range on them, leaving process credentials as the only kernel objects with label ranges in the Biba and MLS policies. We weren't using the range in any access control decisions, so this lets us garbage collect effectively unused code. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Synchonize variable spelling with the MAC tree: we shortened some ofrwatson2002-10-211-9/+8
| | | | | | | the names. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Since the Biba and MLS access checks are identical to the open checks,rwatson2002-10-211-12/+1
| | | | | | | | | collapse the two cases more cleanly: rather than wrapping an access check around open, simply provide the open implementation for the access vector entry. No functional change. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Cleanup of relabel authorization checks -- almost identical logic,rwatson2002-10-211-56/+205
| | | | | | | | we just break out some of the tests better. Minor change in that we now better support incremental update of labels. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Add a twiddle to create PTY's with a biba/equal or mls/equal labelrwatson2002-10-211-0/+9
| | | | | | | | | instead of the default biba/high, mls/low, making it easier to use ptys with these policies. This isn't the final solution, but does help. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Trim accidentally introduced trailing whitespace.rwatson2002-10-061-1/+1
|
* Sync from MAC tree: break out the single mmap entry point intorwatson2002-10-061-22/+32
| | | | | | | | | | | | | | | | | | | seperate entry points for each occasion: mac_check_vnode_mmap() Check at initial mapping mac_check_vnode_mprotect() Check at mapping protection change mac_check_vnode_mmap_downgrade() Determine if a mapping downgrade should take place following subject relabel. Implement mmap() and mprotect() entry points for labeled vnode policies. These entry points are currently not hooked up to the VM system in the base tree. These changes improve the consistency of the access control interface and offer more flexibility regarding limiting access to vnode mmaping. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Modify label allocation semantics for sockets: pass in soalloc's mallocrwatson2002-10-051-2/+2
| | | | | | | | | | | flags so that we can call malloc with M_NOWAIT if necessary, avoiding potential sleeps while holding mutexes in the TCP syncache code. Similar to the existing support for mbuf label allocation: if we can't allocate all the necessary label store in each policy, we back out the label allocation and fail the socket creation. Sync from MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Implement mac_create_devfs_symlink() for policies that interact withrwatson2002-10-051-0/+14
| | | | | | | vnode labels. Sync from MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Merge implementation of mpo_check_vnode_link() for various appropriaterwatson2002-10-051-0/+26
| | | | | | | file-system aware MAC policies. Sync to MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Begin another merge from the TrustedBSD MAC branch:rwatson2002-10-051-205/+58
| | | | | | | | | | | | | | | | | | | | | - Change mpo_init_foo(obj, label) and mpo_destroy_foo(obj, label) policy entry points to mpo_init_foo_label(label) and mpo_destroy_foo_label(label). This will permit the use of the same entry points for holding temporary type-specific label during internalization and externalization, as well as for caching purposes. - Because of this, break out mpo_{init,destroy}_socket() and mpo_{init,destroy}_mount() into seperate entry points for socket main/peer labels and mount main/fs labels. - Since the prototype for label initialization is the same across almost all entry points, implement these entry points using common implementations for Biba, MLS, and Test, reducing the number of almost identical looking functions. This simplifies policy implementation, as well as preparing us for the merge of the new flexible userland API for managing labels on objects. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Remove another missed trailing space.rwatson2002-09-211-1/+1
|
* Trim trailing whitespace from the ends of lines.rwatson2002-09-211-13/+13
|
* Continue cleanup and sync of mac_biba and mac_mls policies to therwatson2002-09-211-13/+0
| | | | | | | | | TrustedBSD MAC Perforce tree. Remove unused functions mac_biba_equal_range and mac_mls_equal_range, which determined if the ranges in two range-enabled labels were equal. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Remove mac_biba_high_single() check for interface renaming: we nowrwatson2002-09-211-12/+0
| | | | | | | | use the notion that a subject range of (low-high) connotes Biba privilege rather than a single of high. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* As INVARIANTS isn't supported for code that loads only as a kernelrwatson2002-09-211-2/+2
| | | | | | | | | module and is not linked into the base system, two KASSERT's rotted. Fix them by fixing variable names. It would be really nice if opt_global.h was used when building modules as part of a buildkernel. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Include <sys/malloc.h> instead of depending on namespace pollution 2bde2002-09-101-0/+1
| | | | layers deep in <sys/proc.h> or <sys/vnode.h>.
* Re-insert TUNABLE() export of MAC Biba and MAC MLS module 'enabled'rwatson2002-09-051-0/+1
| | | | | | | sysctls. Apparently lost during some or another merge. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
OpenPOWER on IntegriCloud