summaryrefslogtreecommitdiffstats
path: root/sys/security/mac_mls
Commit message (Collapse)AuthorAgeFilesLines
...
* Slightly change the semantics of vnode labels for MAC: rather thanrwatson2002-10-261-61/+98
| | | | | | | | | | | | | | | | | | | | | "refreshing" the label on the vnode before use, just get the label right from inception. For single-label file systems, set the label in the generic VFS getnewvnode() code; for multi-label file systems, leave the labeling up to the file system. With UFS1/2, this means reading the extended attribute during vfs_vget() as the inode is pulled off disk, rather than hitting the extended attributes frequently during operations later, improving performance. This also corrects sematics for shared vnode locks, which were not previously present in the system. This chances the cache coherrency properties WRT out-of-band access to label data, but in an acceptable form. With UFS1, there is a small race condition during automatic extended attribute start -- this is not present with UFS2, and occurs because EAs aren't available at vnode inception. We'll introduce a work around for this shortly. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Style fix: space between 'switch' and '('.rwatson2002-10-221-1/+1
|
* s/mls/biba/ in a copy+paste error for a printf.rwatson2002-10-221-1/+1
|
* Adapt MAC policies for the new user API changes; teach policies howrwatson2002-10-222-17/+292
| | | | | | | | | | to parse their own label elements (some cleanup to occur here in the future to use the newly added kernel strsep()). Policies now entirely encapsulate their notion of label in the policy module. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Introduce mac_biba_copy() and mac_mls_copy(), which conditionallyrwatson2002-10-211-8/+24
| | | | | | | | | | | copy elements of one Biba or MLS label to another based on the flags on the source label element. Use this instead of mac_{biba,mls}_{single,range}() to simplify the existing code, as well as support partial label updates (we don't update if none is requested). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Add compartment support to Biba and MLS policies. The logic of therwatson2002-10-212-16/+68
| | | | | | | | | | | | | policies remains the same: subjects and objects are labeled for integrity or sensitivity, and a dominance operator determines whether or not subject/object accesses are permitted to limit inappropriate information flow. Compartments are a non-hierarchal component to the label, so add a bitfield to the label element for each, and a set check as part of the dominance operator. This permits the implementation of "need to know" elements of MLS. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* More in the way of minor consistency improvements: trim 'mac_mls_'rwatson2002-10-211-8/+7
| | | | | | | from another variable to line this up with mac_biba.c Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Demote sockets to single-label objects rather than maintaining arwatson2002-10-211-16/+0
| | | | | | | | | | range on them, leaving process credentials as the only kernel objects with label ranges in the Biba and MLS policies. We weren't using the range in any access control decisions, so this lets us garbage collect effectively unused code. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* White space nit the crept in during merge.rwatson2002-10-211-1/+1
|
* Since the Biba and MLS access checks are identical to the open checks,rwatson2002-10-211-12/+1
| | | | | | | | | collapse the two cases more cleanly: rather than wrapping an access check around open, simply provide the open implementation for the access vector entry. No functional change. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Cleanup of relabel authorization checks -- almost identical logic,rwatson2002-10-211-60/+204
| | | | | | | | we just break out some of the tests better. Minor change in that we now better support incremental update of labels. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Add a twiddle to create PTY's with a biba/equal or mls/equal labelrwatson2002-10-211-0/+9
| | | | | | | | | instead of the default biba/high, mls/low, making it easier to use ptys with these policies. This isn't the final solution, but does help. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Sync from MAC tree: break out the single mmap entry point intorwatson2002-10-061-22/+32
| | | | | | | | | | | | | | | | | | | seperate entry points for each occasion: mac_check_vnode_mmap() Check at initial mapping mac_check_vnode_mprotect() Check at mapping protection change mac_check_vnode_mmap_downgrade() Determine if a mapping downgrade should take place following subject relabel. Implement mmap() and mprotect() entry points for labeled vnode policies. These entry points are currently not hooked up to the VM system in the base tree. These changes improve the consistency of the access control interface and offer more flexibility regarding limiting access to vnode mmaping. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Modify label allocation semantics for sockets: pass in soalloc's mallocrwatson2002-10-051-2/+2
| | | | | | | | | | | flags so that we can call malloc with M_NOWAIT if necessary, avoiding potential sleeps while holding mutexes in the TCP syncache code. Similar to the existing support for mbuf label allocation: if we can't allocate all the necessary label store in each policy, we back out the label allocation and fail the socket creation. Sync from MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Implement mac_create_devfs_symlink() for policies that interact withrwatson2002-10-051-0/+14
| | | | | | | vnode labels. Sync from MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Merge implementation of mpo_check_vnode_link() for various appropriaterwatson2002-10-051-0/+25
| | | | | | | file-system aware MAC policies. Sync to MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Begin another merge from the TrustedBSD MAC branch:rwatson2002-10-051-205/+58
| | | | | | | | | | | | | | | | | | | | | - Change mpo_init_foo(obj, label) and mpo_destroy_foo(obj, label) policy entry points to mpo_init_foo_label(label) and mpo_destroy_foo_label(label). This will permit the use of the same entry points for holding temporary type-specific label during internalization and externalization, as well as for caching purposes. - Because of this, break out mpo_{init,destroy}_socket() and mpo_{init,destroy}_mount() into seperate entry points for socket main/peer labels and mount main/fs labels. - Since the prototype for label initialization is the same across almost all entry points, implement these entry points using common implementations for Biba, MLS, and Test, reducing the number of almost identical looking functions. This simplifies policy implementation, as well as preparing us for the merge of the new flexible userland API for managing labels on objects. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Trim trailing whitespace from the ends of lines.rwatson2002-09-211-10/+10
|
* Continue cleanup and sync of mac_biba and mac_mls policies to therwatson2002-09-211-13/+0
| | | | | | | | | TrustedBSD MAC Perforce tree. Remove unused functions mac_biba_equal_range and mac_mls_equal_range, which determined if the ranges in two range-enabled labels were equal. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* As INVARIANTS isn't supported for code that loads only as a kernelrwatson2002-09-211-2/+2
| | | | | | | | | module and is not linked into the base system, two KASSERT's rotted. Fix them by fixing variable names. It would be really nice if opt_global.h was used when building modules as part of a buildkernel. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Include <sys/malloc.h> instead of depending on namespace pollution 2bde2002-09-101-0/+1
| | | | layers deep in <sys/proc.h> or <sys/vnode.h>.
* Re-insert TUNABLE() export of MAC Biba and MAC MLS module 'enabled'rwatson2002-09-051-0/+1
| | | | | | | sysctls. Apparently lost during some or another merge. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Pass active_cred and file_cred into the MAC framework explicitlyrwatson2002-08-191-12/+12
| | | | | | | | | | | for mac_check_vnode_{poll,read,stat,write}(). Pass in fp->f_cred when calling these checks with a struct file available. Otherwise, pass NOCRED. All currently MAC policies use active_cred, but could now offer the cached credential semantic used for the base system security model. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Break out mac_check_pipe_op() into component check entry points:rwatson2002-08-191-18/+66
| | | | | | | | | | | mac_check_pipe_poll(), mac_check_pipe_read(), mac_check_pipe_stat(), and mac_check_pipe_write(). This is improves consistency with other access control entry points and permits security modules to only control the object methods that they are interested in, avoiding switch statements. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Break out mac_check_vnode_op() into three seperate checks:rwatson2002-08-191-32/+60
| | | | | | | | | | mac_check_vnode_poll(), mac_check_vnode_read(), mac_check_vnode_write(). This improves the consistency with other existing vnode checks, and allows policies to avoid implementing switch statements to determine what operations they do and do not want to authorize. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Rename mac_check_socket_receive() to mac_check_socket_deliver() so thatrwatson2002-08-151-3/+3
| | | | | | | | we can use the names _receive() and _send() for the receive() and send() checks. Rename related constants, policy implementations, etc. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Introduce support for Mandatory Access Control and extensiblerwatson2002-07-312-0/+2238
kernel access control. Provide implementations of some sample operating system security policy extensions. These are not yet hooked up to the build as other infrastructure is still being committed. Most of these work fairly well and are in daily use in our development and (limited) production environments. Some are not yet in their final form, and a number of the labeled policies waste a lot of kernel memory and will be fixed over the next month or so to be more conservative. They do give good examples of the flexibility of the MAC framework for implementing a variety of security policies. mac_biba: Implementation of fixed-label Biba integrity policy, similar to those found in a number of commercial trusted operating systems. All subjects and objects are assigned integrity levels, and information flow is controlled based on a read-up, write-down policy. Currently, purely hierarchal. mac_bsdextended: Implementation of a "file system firewall", which allows the administrator to specify a series of rules limiting access by users and groups to objects owned by other users and groups. This policy is unlabeled, relying on existing system security labeling (file permissions/ownership, process credentials). mac_ifoff: Secure interface silencing. Special-purpose module to limit inappropriate out-going network traffic for silent monitoring scenarios. Prevents the various network stacks from generating any output despite an interface being live for reception. mac_mls: Implementation of fixed-label Multi-Level Security confidentiality policy, similar to those found in a number of commercial trusted operating systems. All subjects and objects are assigned confidentiality levels, and information flow is controlled based on a write-up, read-down policy. Currently, purely hiearchal, although non-hierarchal support is in the works. mac_none: Policy module implementing all MAC policy entry points with empty stubs. A good place to start if you want all the prototypes types in for you, and don't mind a bit of pruning. Can be loaded, but has no access control impact. Useful also for performance measurements. mac_seeotheruids: Policy module implementing a security service similar to security.bsd.seeotheruids, only a slightly more detailed policy involving exceptions for members of specific groups, etc. This policy is unlabeled, relying on existing system security labeling (process credentials). mac_test: Policy module implementing basic sanity tests for label handling. Attempts to ensure that labels are not freed multiple times, etc, etc. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
OpenPOWER on IntegriCloud