summaryrefslogtreecommitdiffstats
path: root/sys/security
Commit message (Collapse)AuthorAgeFilesLines
* Slightly resort functions in file so that no forward function prototypesrwatson2006-12-291-49/+46
| | | | | | are required. Obtained from: TrustedBSD Project
* Re-add include of opt_mac.h in mac_framework.c, which was improperlyrwatson2006-12-291-0/+2
| | | | | removed from this file. It is required to pick up the definition of MAC_STATIC.
* Remove two XXX comments that no longer apply.rwatson2006-12-291-5/+0
| | | | Obtained from: TrustedBSD Project
* Use p_cansee() to check that a target process for an audit staterwatson2006-12-291-3/+9
| | | | | | | | | | manipulation is visible to the subject process. Remove XXX comments suggesting this. Convert one XXX on a difference from Darwin into a note: it's not a bug, it's a feature. Obtained from: TrustedBSD Project
* Add a witness sleep warning to canon_path(), which invokes vput() and hencerwatson2006-12-292-3/+3
| | | | | | | may perform an unbounded sleep. Remove an XXX comment suggesting that one be added. Obtained from: TrustedBSD Project
* Add missing include guards to mac_internal.h, update include guards inrwatson2006-12-282-3/+8
| | | | | | mac_policy.h following move to new location in src/sys/security/mac. Obtained from: TrustedBSD Project
* Update a number of comments:rwatson2006-12-284-23/+22
| | | | | | | | | | | | - Replace XXX with Note: in several cases where observations are made about future functionality rather than problems or bugs. - Remove an XXX comment about byte order and au_to_ip() -- IP headers must be submitted in network byte order. Add a comment to this effect. - Mention that we don't implement select/poll for /dev/audit. Obtained from: TrustedBSD Project
* Remove XXX comments about EA transaction support and provide a morerwatson2006-12-281-6/+11
| | | | | | | general and detailed comment on the topic of EA transactions and kernel warnings. Obtained from: TrustedBSD Project
* Remove an inaccurate comment I added regarding storage for mbuf tagrwatson2006-12-281-7/+0
| | | | | | labels: they are in fact stored in the tag directly. Obtained from: TrustedBSD Project
* In mac_inpcb_sosetlabel(), assert the socket lock rather than commentingrwatson2006-12-281-1/+1
| | | | | | that we should assert the socket lock. Obtained from: TrustedBSD Project
* Centralize definition of MAC_VERSION in mac_policy.h, as it defines therwatson2006-12-283-6/+19
| | | | | | | | | | kernel<->policy ABI version. Add a comment to the definition describing it and listing known versions. Modify MAC_POLICY_SET() to reference the current kernel version by name rather than by number. Staticize mac_late, which is used only in mac_framework.c. Obtained from: TrustedBSD Project
* Move mac_init_label() and mac_destroy_label() from mac_framework.c torwatson2006-12-282-29/+31
| | | | | | | mac_label.c, and use these instead of replicated code in the label zone constructor and destructor. Obtained from: TrustedBSD Project
* Trim unneeded includes.rwatson2006-12-282-48/+0
|
* Break contents of kern_mac.c out into two files following a repo-copy:rwatson2006-12-282-1209/+0
| | | | | | | | | | | mac_framework.c Contains basic MAC Framework functions, policy registration, sysinits, etc. mac_syscalls.c Contains implementations of various MAC system calls, including ENOSYS stubs when compiling without options MAC. Obtained from: TrustedBSD Project
* Update MAC Framework general comments, referencing various interfaces itrwatson2006-12-282-24/+80
| | | | | | | | | | | | | | consumes and implements, as well as the location of the framework and policy modules. Refactor MAC Framework versioning a bit so that the current ABI version can be exported via a read-only sysctl. Further update comments relating to locking/synchronization. Update copyright to take into account these and other recent changes. Obtained from: TrustedBSD Project
* Re-wrap comments following de-indentation.rwatson2006-12-231-13/+11
|
* Move src/sys/sys/mac_policy.h, the kernel interface between the MACrwatson2006-12-2225-43/+25
| | | | | | | | | | | Framework and security modules, to src/sys/security/mac/mac_policy.h, completing the removal of kernel-only MAC Framework include files from src/sys/sys. Update the MAC Framework and MAC policy modules. Delete the old mac_policy.h. Third party policy modules will need similar updating. Obtained from: TrustedBSD Project
* Minor style fixes.rwatson2006-12-214-20/+20
|
* Remove mac_enforce_subsystem debugging sysctls. Enforcement onrwatson2006-12-2114-397/+2
| | | | | | | | | | subsystems will be a property of policy modules, which may require access control check entry points to be invoked even when not actively enforcing (i.e., to track information flow without providing protection). Obtained from: TrustedBSD Project Suggested by: Christopher dot Vance at sparta dot com
* Comment LABEL_TO_SLOT() macro, including observing that we'd like to improverwatson2006-12-201-0/+8
| | | | | | | this policy API to avoid encoding struct label binary layout in policy modules. Obtained from: TrustedBSD Project
* Trim trailing white space, clean up comment line wrapping and formatting.rwatson2006-12-201-10/+21
| | | | | | Document mac_associate_nfsd_label(). Obtained from: TrustedBSD Project
* Trim trailing white space.rwatson2006-12-202-7/+7
|
* Document socket labeling model.rwatson2006-12-201-15/+27
| | | | | | Clean up comment white space and wrapping. Obtained from: TrustedBSD Project
* Clean up comment white space and line wrapping.rwatson2006-12-201-15/+14
|
* Additional comments regarding the interaction between the kernel privilegerwatson2006-12-201-0/+18
| | | | | | model and the MAC Framework. Obtained from: TrustedBSD Project
* Document that we could allocate the mbuf label as part of the tag ratherrwatson2006-12-201-8/+26
| | | | | | | | | | than from the slab, but don't. Document mac_mbuf_to_label(), mac_copy_mbuf_tag(). Clean up white space/wrapping for other comments. Obtained from: TrustedBSD Project
* Staticize and comment zone_label.rwatson2006-12-201-1/+7
| | | | Obtained from: TrustedBSD Project
* Clean up comments, trailing white space.rwatson2006-12-201-17/+27
| | | | | | Provide a comment describing MAC_EXTERNALIZE(). Obtained from: TrustedBSD Project
* Re-wrap comment at 77 character columns.rwatson2006-12-201-7/+7
|
* Comment and white space cleanup.rwatson2006-12-201-15/+17
| | | | | | | Exapnd comments on System V IPC labeling methods, which could use improved consistency with respect to other object types. Obtained from: TrustedBSD Project
* Externalize local stack copy of the ifnet label, rather than the copy onrwatson2006-12-201-2/+2
| | | | | | | | | | the ifnet itself. The stack copy has been made while holding the mutex protecting ifnet labels, so copying from the ifnet copy could result in an inconsistent version being copied out. Reported by: Todd.Miller@sparta.com Obtained from: TrustedBSD Project MFC after: 3 weeks
* Expand commenting on label slots, justification for the MAC Framework lockingrwatson2006-12-202-108/+158
| | | | | | | | model, interactions between locking and policy init/destroy methods. Rewrap some comments to 77 character line wrap. Obtained from: TrustedBSD Project
* Teach the MAC policies which utilize mbuf labeling the new syncachecsjp2006-12-133-0/+75
| | | | | | entry points. Properly initialize the mbuf label based on the label we copy from the PCB. This fixes an LOR between the PCB and syncache code.
* Fix LOR between the syncache and inpcb locks when MAC is present in thecsjp2006-12-133-0/+68
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | kernel. This LOR snuck in with some of the recent syncache changes. To fix this, the inpcb handling was changed: - Hang a MAC label off the syncache object - When the syncache entry is initially created, we pickup the PCB lock is held because we extract information from it while initializing the syncache entry. While we do this, copy the MAC label associated with the PCB and use it for the syncache entry. - When the packet is transmitted, copy the label from the syncache entry to the mbuf so it can be processed by security policies which analyze mbuf labels. This change required that the MAC framework be extended to support the label copy operations from the PCB to the syncache entry, and then from the syncache entry to the mbuf. These functions really should be referencing the syncache structure instead of the label. However, due to some of the complexities associated with exposing this syncache structure we operate directly on it's label pointer. This should be OK since we aren't making any access control decisions within this code directly, we are merely allocating and copying label storage so we can properly initialize mbuf labels for any packets the syncache code might create. This also has a nice side effect of caching. Prior to this change, the PCB would be looked up/locked for each packet transmitted. Now the label is cached at the time the syncache entry is initialized. Submitted by: andre [1] Discussed with: rwatson [1] andre submitted the tcp_syncache.c changes
* Merge posix4/* into normal kernel hierarchy.trhodes2006-11-115-10/+5
| | | | | Reviewed by: glanced at by jhb Approved by: silence on -arch@ and -standards@
* Add stub entry point implementations of mpo_priv_check and mpo_priv_grant torwatson2006-11-061-0/+16
| | | | | | the mac_stub policy. Obtained from: TrustedBSD Project
* Sweep kernel replacing suser(9) calls with priv(9) calls, assigningrwatson2006-11-0611-21/+45
| | | | | | | | | | | | | specific privilege names to a broad range of privileges. These may require some future tweaking. Sponsored by: nCircle Network Security, Inc. Obtained from: TrustedBSD Project Discussed on: arch@ Reviewed (at least in part) by: mlaier, jmg, pjd, bde, ceri, Alex Lyashkov <umka at sevcity dot net>, Skip Ford <skip dot ford at verizon dot net>, Antoine Brodin <antoine dot brodin at laposte dot net>
* Add a new priv(9) kernel interface for checking the availability ofrwatson2006-11-063-0/+100
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | privilege for threads and credentials. Unlike the existing suser(9) interface, priv(9) exposes a named privilege identifier to the privilege checking code, allowing more complex policies regarding the granting of privilege to be expressed. Two interfaces are provided, replacing the existing suser(9) interface: suser(td) -> priv_check(td, priv) suser_cred(cred, flags) -> priv_check_cred(cred, priv, flags) A comprehensive list of currently available kernel privileges may be found in priv.h. New privileges are easily added as required, but the comments on adding privileges found in priv.h and priv(9) should be read before doing so. The new privilege interface exposed sufficient information to the privilege checking routine that it will now be possible for jail to determine whether a particular privilege is granted in the check routine, rather than relying on hints from the calling context via the SUSER_ALLOWJAIL flag. For now, the flag is maintained, but a new jail check function, prison_priv_check(), is exposed from kern_jail.c and used by the privilege check routine to determine if the privilege is permitted in jail. As a result, a centralized list of privileges permitted in jail is now present in kern_jail.c. The MAC Framework is now also able to instrument privilege checks, both to deny privileges otherwise granted (mac_priv_check()), and to grant privileges otherwise denied (mac_priv_grant()), permitting MAC Policy modules to implement privilege models, as well as control a much broader range of system behavior in order to constrain processes running with root privilege. The suser() and suser_cred() functions remain implemented, now in terms of priv_check() and the PRIV_ROOT privilege, for use during the transition and possibly continuing use by third party kernel modules that have not been updated. The PRIV_DRIVER privilege exists to allow device drivers to check privilege without adopting a more specific privilege identifier. This change does not modify the actual security policy, rather, it modifies the interface for privilege checks so changes to the security policy become more feasible. Sponsored by: nCircle Network Security, Inc. Obtained from: TrustedBSD Project Discussed on: arch@ Reviewed (at least in part) by: mlaier, jmg, pjd, bde, ceri, Alex Lyashkov <umka at sevcity dot net>, Skip Ford <skip dot ford at verizon dot net>, Antoine Brodin <antoine dot brodin at laposte dot net>
* Change the type of ar_arg_sockaddr from struct sockaddr to structcsjp2006-11-062-3/+2
| | | | | | | | | | | | | | | | | sockaddr_storage. This structure is defined in RFC 2553 and is a more semantically correct structure for holding IP and IP6 sockaddr information. struct sockaddr is not big enough to hold all the required information for IP6, resulting in truncated addresses et al when auditing IP6 sockaddr information. We also need to assume that the sa->sa_len has been validated before the call to audit_arg_sockaddr() is made, otherwise it could result in a buffer overflow. This is being done to accommodate auditing of network related arguments (like connect, bind et al) that will be added soon. Discussed with: rwatson Obtained from: TrustedBSD Project MFC after: 2 weeks
* Forward declare struct cdev, since arguments of this type are used inrwatson2006-10-301-0/+1
| | | | | | function prototypes. Obtained from: TrustedBSD Project
* Remove extra _MAC_ from #ifdef guard.rwatson2006-10-251-1/+1
|
* Complete break-out of sys/sys/mac.h into sys/security/mac/mac_framework.hrwatson2006-10-2217-76/+32
| | | | | | | | | | | | | begun with a repo-copy of mac.h to mac_framework.h. sys/mac.h now contains the userspace and user<->kernel API and definitions, with all in-kernel interfaces moved to mac_framework.h, which is now included across most of the kernel instead. This change is the first step in a larger cleanup and sweep of MAC Framework interfaces in the kernel, and will not be MFC'd. Obtained from: TrustedBSD Project Sponsored by: SPARTA
* Do allow jailed superuser to override the port ACL.rwatson2006-10-101-1/+1
| | | | | MFC after: 3 days Submitted by: Michal Mertl <mime at traveller dot cz>
* Mark the audit system calls as being un-implemented in jails. Currently we docsjp2006-10-101-0/+19
| | | | | | | | | | | | | | | | | | | | | not trust jails enough to execute audit related system calls. An example of this is with su(1), or login(1) within prisons. So, if the syscall request comes from a jail return ENOSYS. This will cause these utilities to operate as if audit is not present in the kernel. Looking forward, this problem will be remedied by allowing non privileged users to maintain and their own audit streams, but the details on exactly how this will be implemented needs to be worked out. This change should fix situations when options AUDIT has been compiled into the kernel, and utilities like su(1), or login(1) fail due to audit system call failures within jails. This is a RELENG_6 candidate. Reported by: Christian Brueffer Discussed with: rwatson MFC after: 3 days
* Add BSM conversion switch entries for a number of system calls, manyrwatson2006-10-031-7/+43
| | | | | | | | administrative, to prevent console warnings and enable basic event auditing (generally without arguments). MFC after: 3 days Obtained from: TrustedBSD Project
* Trim some no longer XXX comments.rwatson2006-10-021-22/+5
| | | | | | | Remove some commented out debugging printfs. MFC after: 3 days Obtained from: TrustedBSD Project
* Audit path argument when changing audit trails.rwatson2006-10-021-3/+4
| | | | | | | | Call NDFREE(), which while not currently strictly necessary, isn't a bad idea. MFC after: 3 days Obtained from: TrustedBSD Project
* Rework the way errors are handled with respect to how audit records arerwatson2006-09-241-100/+145
| | | | | | | | | | | | | | | | | | | | | | | | written to the audit trail file: - audit_record_write() now returns void, and all file system specific error handling occurs inside this function. This pushes error handling complexity out of the record demux routine that hands off to both the trail and audit pipes, and makes trail behavior more consistent with pipes as a record destination. - Rate limit kernel printfs associated with running low on space. Rate limit audit triggers for low space. Rate limit printfs for fail stop events. Rate limit audit worker write error printfs. - Document in detail the types of limits and space checks we perform, and combine common cases. This improves the audit subsystems tolerance to low space conditions by avoiding toasting the console with printfs are waking up the audit daemon continuously. MFC after: 3 days Obtained from: TrustedBSD Project
* Merge OpenBSM 1.0 alpha 11 changes into src/sys/bsm and src/sys/security;rwatson2006-09-211-1/+1
| | | | | | primarily, add new event identifiers and update trigger names. Obtained from: TrustedBSD Project
* Remove MAC_DEBUG label counters, which were used to debug leaks andrwatson2006-09-2013-161/+0
| | | | | | | | | other problems while labels were first being added to various kernel objects. They have outlived their usefulness. MFC after: 1 month Suggested by: Christopher dot Vance at SPARTA dot com Obtained from: TrustedBSD Project
OpenPOWER on IntegriCloud