summaryrefslogtreecommitdiffstats
path: root/sys/security/mac_partition
Commit message (Collapse)AuthorAgeFilesLines
* Mark all SYSCTL_NODEs static that have no corresponding SYSCTL_DECLs.ed2011-11-071-1/+1
| | | | | | The SYSCTL_NODE macro defines a list that stores all child-elements of that node. If there's no SYSCTL_DECL macro anywhere else, there's no reason why it shouldn't be static.
* Rather than having MAC policies explicitly declare what object typesrwatson2009-01-101-1/+1
| | | | | | | | | | | | | | they label, derive that information implicitly from the set of label initializers in their policy operations set. This avoids a possible class of programmer errors, while retaining the structure that allows us to avoid allocating labels for objects that don't need them. As before, we regenerate a global mask of labeled objects each time a policy is loaded or unloaded, stored in mac_labeled. Discussed with: csjp Suggested by: Jacques Vidrine <nectar at apple.com> Obtained from: TrustedBSD Project Sponsored by: Apple, Inc.
* Rename three MAC entry points from _proc_ to _cred_ to reflect the factrwatson2008-10-281-17/+17
| | | | | | | that they operate directly on credentials: mac_proc_create_swapper(), mac_proc_create_init(), and mac_proc_associate_nfsd(). Update policies. Obtained from: TrustedBSD Project
* Extended comment on why we consider a partition relabel request of "0" torwatson2008-10-281-1/+7
| | | | | | | | be a no-op request, and why this might have to change if we want to allow leaving a partition someday. Obtained from: TrustedBSD Project MFC after: 3 days
* Rename label_on_label() to partition_check(), which is far morerwatson2008-10-281-7/+7
| | | | | | | suggestive as to its actual function. Obtained from: TrustedBSD Project MFC after: 3 days
* Add a mac_inpcb_check_visible implementation to all MAC policiesbz2008-10-171-0/+17
| | | | | | | that handle mac_socket_check_visible. Reviewed by: rwatson MFC after: 3 months (set timer; decide then)
* Use the label from the socket credential rather than thebz2008-10-171-1/+2
| | | | | | | | solabel which was not set by the mac_partition policy. Spotted by: rwatson Reviewed by: rwatson MFC after: 3 days
* Introduce two related changes to the TrustedBSD MAC Framework:rwatson2008-08-231-7/+26
| | | | | | | | | | | | | | | | | | | | | | | | | (1) Abstract interpreter vnode labeling in execve(2) and mac_execve(2) so that the general exec code isn't aware of the details of allocating, copying, and freeing labels, rather, simply passes in a void pointer to start and stop functions that will be used by the framework. This change will be MFC'd. (2) Introduce a new flags field to the MAC_POLICY_SET(9) interface allowing policies to declare which types of objects require label allocation, initialization, and destruction, and define a set of flags covering various supported object types (MPC_OBJECT_PROC, MPC_OBJECT_VNODE, MPC_OBJECT_INPCB, ...). This change reduces the overhead of compiling the MAC Framework into the kernel if policies aren't loaded, or if policies require labels on only a small number or even no object types. Each time a policy is loaded or unloaded, we recalculate a mask of labeled object types across all policies present in the system. Eliminate MAC_ALWAYS_LABEL_MBUF option as it is no longer required. MFC after: 1 week ((1) only) Reviewed by: csjp Obtained from: TrustedBSD Project Sponsored by: Apple, Inc.
* Rename mac_partition_enabled to partition_enabled to synchronize withrwatson2008-08-021-3/+3
| | | | | | | other policies that similarly now avoid the additional mac_ prefix on variables. MFC after: soon
* Resort TrustedBSD MAC Framework policy entry point implementations andrwatson2007-10-291-77/+81
| | | | | | | declarations to match the object, operation sort order in the framework itself. Obtained from: TrustedBSD Project
* Consistently name functions for mac_<policy> as <policy>_whatever ratherrwatson2007-10-251-35/+36
| | | | | | | | | | | than mac_<policy>_whatever, as this shortens the names and makes the code a bit easier to read. When dealing with label structures, name variables 'mb', 'ml', 'mm rather than the longer 'mac_biba', 'mac_lomac', and 'mac_mls', likewise making the code a little easier to read. Obtained from: TrustedBSD Project
* Merge first in a series of TrustedBSD MAC Framework KPI changesrwatson2007-10-241-25/+29
| | | | | | | | | | | | | | | | | | | | | | | from Mac OS X Leopard--rationalize naming for entry points to the following general forms: mac_<object>_<method/action> mac_<object>_check_<method/action> The previous naming scheme was inconsistent and mostly reversed from the new scheme. Also, make object types more consistent and remove spaces from object types that contain multiple parts ("posix_sem" -> "posixsem") to make mechanical parsing easier. Introduce a new "netinet" object type for certain IPv4/IPv6-related methods. Also simplify, slightly, some entry point names. All MAC policy modules will need to be recompiled, and modules not updates as part of this commit will need to be modified to conform to the new KPI. Sponsored by: SPARTA (original patches against Mac OS X) Obtained from: TrustedBSD Project, Apple Computer
* Apply variable name normalization to MAC policies: adopt global conventionsrwatson2007-04-231-12/+13
| | | | | | for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
* More unnecessary include reduction.rwatson2007-02-231-19/+1
|
* Remove empty entry point functions (init, destroy, syscall) fromrwatson2007-02-231-7/+0
| | | | policies that don't need them.
* Print intptr_t values by first casting to intmax_t and then printing withrwatson2007-02-061-1/+1
| | | | | | | %jd, as intptr_t may not be int-sized. Assistance from: jhb Spotted by: Mr Tinderbox
* Introduce accessor functions mac_label_get() and mac_label_set() to replacerwatson2007-02-061-10/+11
| | | | | | | | | | | | | | | | | | | LABEL_TO_SLOT() macro used by policy modules to query and set label data in struct label. Instead of using a union, store an intptr_t, simplifying the API. Update policies: in most cases this required only small tweaks to current wrapper macros. In two cases, a single wrapper macros had to be split into separate get and set macros. Move struct label definition from _label.h to mac_internal.h and remove _label.h. With this change, policies may now treat struct label * as opaque, allowing us to change the layout of struct label without breaking the policy module ABI. For example, we could make the maximum number of policies with labels modifiable at boot-time rather than just at compile-time. Obtained from: TrustedBSD Project
* Continue 7-CURRENT MAC Framework rearrangement and cleanup:rwatson2007-02-061-1/+0
| | | | | | | | | | | | | | Don't perform a nested include of _label.h in mac.h, as mac.h now describes only the user API to MAC, and _label.h defines the in-kernel representation of MAC labels. Remove mac.h includes from policies and MAC framework components that do not use userspace MAC API definitions. Add _KERNEL inclusion checks to mac_internal.h and mac_policy.h, as these are kernel-only include files Obtained from: TrustedBSD Project
* Move src/sys/sys/mac_policy.h, the kernel interface between the MACrwatson2006-12-221-2/+1
| | | | | | | | | | | Framework and security modules, to src/sys/security/mac/mac_policy.h, completing the removal of kernel-only MAC Framework include files from src/sys/sys. Update the MAC Framework and MAC policy modules. Delete the old mac_policy.h. Third party policy modules will need similar updating. Obtained from: TrustedBSD Project
* Sweep kernel replacing suser(9) calls with priv(9) calls, assigningrwatson2006-11-061-1/+2
| | | | | | | | | | | | | specific privilege names to a broad range of privileges. These may require some future tweaking. Sponsored by: nCircle Network Security, Inc. Obtained from: TrustedBSD Project Discussed on: arch@ Reviewed (at least in part) by: mlaier, jmg, pjd, bde, ceri, Alex Lyashkov <umka at sevcity dot net>, Skip Ford <skip dot ford at verizon dot net>, Antoine Brodin <antoine dot brodin at laposte dot net>
* Add #include <sys/sx.h>, devfs is going to require this shortly.phk2005-09-191-0/+1
|
* Update my personal copyrights and NETA copyrights in the kernelrwatson2004-02-222-4/+4
| | | | | | | | to use the "year1-year3" format, as opposed to "year1, year2, year3". This seems to make lawyers more happy, but also prevents the lines from getting excessively long as the years start to add up. Suggested by: imp
* Rename mac_create_cred() MAC Framework entry point to mac_copy_cred(),rwatson2003-12-061-8/+8
| | | | | | | | | | | | | and the mpo_create_cred() MAC policy entry point to mpo_copy_cred_label(). This is more consistent with similar entry points for creation and label copying, as mac_create_cred() was called from crdup() as opposed to during process creation. For a number of policies, this removes the requirement for special handling when copying credential labels, and improves consistency. Approved by: re (scottl) Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Modify the MAC Framework so that instead of embedding a (struct label)rwatson2003-11-121-9/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | in various kernel objects to represent security data, we embed a (struct label *) pointer, which now references labels allocated using a UMA zone (mac_label.c). This allows the size and shape of struct label to be varied without changing the size and shape of these kernel objects, which become part of the frozen ABI with 5-STABLE. This opens the door for boot-time selection of the number of label slots, and hence changes to the bound on the number of simultaneous labeled policies at boot-time instead of compile-time. This also makes it easier to embed label references in new objects as required for locking/caching with fine-grained network stack locking, such as inpcb structures. This change also moves us further in the direction of hiding the structure of kernel objects from MAC policy modules, not to mention dramatically reducing the number of '&' symbols appearing in both the MAC Framework and MAC policy modules, and improving readability. While this results in minimal performance change with MAC enabled, it will observably shrink the size of a number of critical kernel data structures for the !MAC case, and should have a small (but measurable) performance benefit (i.e., struct vnode, struct socket) do to memory conservation and reduced cost of zeroing memory. NOTE: Users of MAC must recompile their kernel and all MAC modules as a result of this change. Because this is an API change, third party MAC modules will also need to be updated to make less use of the '&' symbol. Suggestions from: bmilekic Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Redesign the externalization APIs from the MAC Framework torwatson2003-06-231-3/+7
| | | | | | | | | | | | | | | | | | | | | | | | | the MAC policy modules to improve robustness against C string bugs and vulnerabilities. Following these revisions, all string construction of labels for export to userspace (or elsewhere) is performed using the sbuf API, which prevents the consumer from having to perform laborious and intricate pointer and buffer checks. This substantially simplifies the externalization logic, both at the MAC Framework level, and in individual policies; this becomes especially useful when policies export more complex label data, such as with compartments in Biba and MLS. Bundled in here are some other minor fixes associated with externalization: including avoiding malloc while holding the process mutex in mac_lomac, and hence avoid a failure mode when printing labels during a downgrade operation due to the removal of the M_NOWAIT case. This has been running in the MAC development tree for about three weeks without problems. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Trim "trustedbsd_" from the front of the policy module "short names";rwatson2003-03-271-2/+2
| | | | | | | | the vendor is only included in the long name currently, reducing verbosity when modules are registered and unregistered. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Update MAC modules for changes in arguments for exec MAC policyrwatson2002-11-081-0/+19
| | | | | | | | entry points to include an explicit execlabel. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* License and wording updates: NAI has authorized the removal of clauserwatson2002-11-042-14/+8
| | | | | three from their BSD-style license. Also, s/NAI Labs/Network Associates Laboratories/.
* Change privilege model for mac_partition such that BSD superuser can changerwatson2002-11-031-6/+4
| | | | | | | | the partition once a partition has been set. This is required for correct operation of sendmail between partitions. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Move to C99 sparse structure initialization for the mac_policy_opsrwatson2002-10-301-33/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | structure definition, rather than using an operation vector we translate into the structure. Originally, we used a vector for two reasons: (1) We wanted to define the structure sparsely, which wasn't supported by the C compiler for structures. For a policy with five entry points, you don't want to have to stick in a few hundred NULL function pointers. (2) We thought it would improve ABI compatibility allowing modules to work with kernels that had a superset of the entry points defined in the module, even if the kernel had changed its entry point set. Both of these no longer apply: (1) C99 gives us a way to sparsely define a static structure. (2) The ABI problems existed anyway, due to enumeration numbers, argument changes, and semantic mismatches. Since the going rule for FreeBSD is that you really need your modules to pretty closely match your kernel, it's not worth the complexity. This submit eliminates the operation vector, dynamic allocation of the operation structure, copying of the vector to the structure, and redoes the vectors in each policy to direct structure definitions. One enourmous benefit of this change is that we now get decent type checking on policy entry point implementation arguments. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Provide a simple sample labeled access control policy, mac_partition.rwatson2002-10-232-0/+337
This policy can be loaded dynamically, and assigns each process a partition number, as well as permitting processes to operate outside the partition. Processes contained in a partition can only "see" processes inside the same partition, so it's a little like jail. The partition of a user can be set using the label mechanisms in login.conf. This sample policy is a good starting point for developers wanting to learn about how to produce labeled policies, as it labels only one kernel object, the process credential. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
OpenPOWER on IntegriCloud