summaryrefslogtreecommitdiffstats
path: root/sys/security
Commit message (Collapse)AuthorAgeFilesLines
* Add TrustedBSD credit to new ugidfw_internal.h file.rwatson2008-10-271-0/+2
|
* Break mac_bsdextended.c out into multiple .c files, with the base accessrwatson2008-10-274-1451/+149
| | | | | | | control logic and policy registration remaining in that file, and access control checks broken out into other files by class of check. Obtained from: TrustedBSD Project
* Copy mac_bsdextended.c to two object-specific files as a prototype for howrwatson2008-10-272-0/+1536
| | | | | | modularize MAC policy layout. Obtained from: TrustedBSD Project
* Implement MAC policy support for IPv6 fragment reassembly queues,rwatson2008-10-265-5/+275
| | | | | | modeled on IPv4 fragment reassembly queue support. Obtained from: TrustedBSD Project
* Add a MAC label, MAC Framework, and MAC policy entry points for IPv6rwatson2008-10-263-3/+129
| | | | | | | | | | | fragment reassembly queues. This allows policies to label reassembly queues, perform access control checks when matching fragments to a queue, update a queue label when fragments are matched, and label the resulting reassembled datagram. Obtained from: TrustedBSD Project
* Fix a number of style issues in the MALLOC / FREE commit. I've tried todes2008-10-231-1/+2
| | | | | be careful not to fix anything that was already broken; the NFSv4 code is particularly bad in this respect.
* Retire the MALLOC and FREE macros. They are an abomination unto style(9).des2008-10-232-4/+3
| | | | MFC after: 3 months
* Add a mac_inpcb_check_visible implementation to all MAC policiesbz2008-10-177-0/+111
| | | | | | | that handle mac_socket_check_visible. Reviewed by: rwatson MFC after: 3 months (set timer; decide then)
* Add mac_inpcb_check_visible MAC Framework entry point, which is similarbz2008-10-173-0/+16
| | | | | | | to mac_socket_check_visible but operates on the inpcb. Reviewed by: rwatson MFC after: 3 months (set timer, decide then)
* Use the label from the socket credential rather than thebz2008-10-171-1/+2
| | | | | | | | solabel which was not set by the mac_partition policy. Spotted by: rwatson Reviewed by: rwatson MFC after: 3 days
* Remove unit2minor() use from kernel code.ed2008-09-261-1/+1
| | | | | | | | | | | | | | | When I changed kern_conf.c three months ago I made device unit numbers equal to (unneeded) device minor numbers. We used to require bitshifting, because there were eight bits in the middle that were reserved for a device major number. Not very long after I turned dev2unit(), minor(), unit2minor() and minor2unit() into macro's. The unit2minor() and minor2unit() macro's were no-ops. We'd better not remove these four macro's from the kernel, because there is a lot of (external) code that may still depend on them. For now it's harmless to remove all invocations of unit2minor() and minor2unit(). Reviewed by: kib
* Remove the suser(9) interface from the kernel. It has been replaced fromattilio2008-09-171-8/+24
| | | | | | | | | | | | | | | | | years by the priv_check(9) interface and just very few places are left. Note that compatibility stub with older FreeBSD version (all above the 8 limit though) are left in order to reduce diffs against old versions. It is responsibility of the maintainers for any module, if they think it is the case, to axe out such cases. This patch breaks KPI so __FreeBSD_version will be bumped into a later commit. This patch needs to be credited 50-50 with rwatson@ as he found time to explain me how the priv_check() works in detail and to review patches. Tested by: Giovanni Trematerra <giovanni dot trematerra at gmail dot com> Reviewed by: rwatson
* Remove VSVTX, VSGID and VSUID. This should be a no-op,trasz2008-09-101-2/+3
| | | | | | as VSVTX == S_ISVTX, VSGID == S_ISGID and VSUID == S_ISUID. Approved by: rwatson (mentor)
* Unbreak the build.des2008-09-041-2/+2
| | | | Pointy hat to: kevlo
* If the process id specified is invalid, the system call returns ESRCHkevlo2008-09-041-10/+10
|
* Decontextualize the couplet VOP_GETATTR / VOP_SETATTR as the passed threadattilio2008-08-284-5/+4
| | | | | | was always curthread and totally unuseful. Tested by: Giovanni Trematerra <giovanni dot trematerra at gmail dot com>
* More fully audit fexecve(2) and its arguments.rwatson2008-08-251-0/+7
| | | | | Obtained from: TrustedBSD Project Sponsored by: Google, Inc.
* Use ERANGE instead of EOVERFLOW selected in r182059, this seems morerwatson2008-08-241-1/+1
| | | | | | | | | appropriate even if Solaris doesn't document it (E2BIG) or use it (EOVERFLOW). Submitted by: nectar at apple dot com Sponsored by: Apple, Inc. MFC after: 3 days
* Use sbuf_putc instead of sbuf_cat. This makes more sense, since we arecsjp2008-08-241-1/+1
| | | | | | appending a single character to the buffer. MFC after: 2 weeks
* Introduce two related changes to the TrustedBSD MAC Framework:rwatson2008-08-2327-161/+456
| | | | | | | | | | | | | | | | | | | | | | | | | (1) Abstract interpreter vnode labeling in execve(2) and mac_execve(2) so that the general exec code isn't aware of the details of allocating, copying, and freeing labels, rather, simply passes in a void pointer to start and stop functions that will be used by the framework. This change will be MFC'd. (2) Introduce a new flags field to the MAC_POLICY_SET(9) interface allowing policies to declare which types of objects require label allocation, initialization, and destruction, and define a set of flags covering various supported object types (MPC_OBJECT_PROC, MPC_OBJECT_VNODE, MPC_OBJECT_INPCB, ...). This change reduces the overhead of compiling the MAC Framework into the kernel if policies aren't loaded, or if policies require labels on only a small number or even no object types. Each time a policy is loaded or unloaded, we recalculate a mask of labeled object types across all policies present in the system. Eliminate MAC_ALWAYS_LABEL_MBUF option as it is no longer required. MFC after: 1 week ((1) only) Reviewed by: csjp Obtained from: TrustedBSD Project Sponsored by: Apple, Inc.
* When getaudit(2) is unable to fit the terminal IPv6 address into therwatson2008-08-231-1/+1
| | | | | | | | | | | space provided by its argument structure, return EOVERFLOW instead of E2BIG. The latter is documented in Solaris's man page, but the former is implemented. In either case, the caller should use getaudit_addr(2) to return the IPv6 address. Submitted by: sson Obtained from: Apple, Inc. MFC after: 3 days
* Make sure we check the preselection masks present for all audit pipes.csjp2008-08-111-1/+2
| | | | | | | | It is possible that the audit pipe(s) have different preselection configs then the global preselection mask. Spotted by: Vincenzo Iozzo MFC after: 2 weeks
* Add sbuf_new_auto as a shortcut for the very common case of creating ades2008-08-091-1/+1
| | | | | | | completely dynamic sbuf. Obtained from: Varnish MFC after: 2 weeks
* Minor style tweaks.rwatson2008-08-023-24/+15
|
* Rename mac_partition_enabled to partition_enabled to synchronize withrwatson2008-08-021-3/+3
| | | | | | | other policies that similarly now avoid the additional mac_ prefix on variables. MFC after: soon
* In mac_bsdextended's auditctl and acct policy access control checks,rwatson2008-07-311-11/+8
| | | | | | | | | | | | | | return success if the passed vnode pointer is NULL (rather than panicking). This can occur if either audit or accounting are disabled while the policy is running. Since the swapoff control has no real relevance to this policy, which is concerned about intent to write rather than water under the bridge, remove it. PR: kern/126100 Reported by: Alan Amesbury <amesbury at umn dot edu> MFC after: 3 days
* Currently, BSM audit pathname token generation for chrooted or jailedcsjp2008-07-311-55/+93
| | | | | | | | | | | | | | | | | | | | | | | | | processes are not producing absolute pathname tokens. It is required that audited pathnames are generated relative to the global root mount point. This modification changes our implementation of audit_canon_path(9) and introduces a new function: vn_fullpath_global(9) which performs a vnode -> pathname translation relative to the global mount point based on the contents of the name cache. Much like vn_fullpath, vn_fullpath_global is a wrapper function which called vn_fullpath1. Further, the string parsing routines have been converted to use the sbuf(9) framework. This change also removes the conditional acquisition of Giant, since the vn_fullpath1 method will not dip into file system dependent code. The vnode locking was modified to use vhold()/vdrop() instead the vref() and vrele(). This will modify the hold count instead of modifying the user count. This makes more sense since it's the kernel that requires the reference to the vnode. This also makes sure that the vnode does not get recycled we hold the reference to it. [1] Discussed with: rwatson Reviewed by: kib [1] MFC after: 2 weeks
* Further synchronization of copyrights, licenses, white space, etc fromrwatson2008-07-319-11/+10
| | | | | | | Apple and from the OpenBSM vendor tree. Obtained from: Apple Inc., TrustedBSD Project MFC after: 3 days
* Minor white space tweak.rwatson2008-07-231-1/+1
| | | | | Obtained from: Apple Inc. MFC after: 3 days
* If an AUE_SYSCTL_NONADMIN audit event is selected, generate a recordrwatson2008-07-221-0/+1
| | | | | | | with equivilent content to AUE_SYSCTL. Obtained from: Apple Inc. MFC after: 3 days
* Further minor style fixes to audit.rwatson2008-07-221-5/+10
| | | | | Obtained from: Apple Inc. MFC after: 3 days
* Remove unneeded \ at the end of a macro.rwatson2008-07-221-1/+1
| | | | | Obtained from: Apple Inc. MFC after: 3 days
* Further minor white space tweaks.rwatson2008-07-221-2/+2
| | | | | Obtained from: Apple Inc. MFC after: 3 days
* Generally avoid <space><tab> as a white space anomoly.rwatson2008-07-225-18/+18
| | | | | Obtained from: Apple Inc. MFC after: 3 days
* Use #define<tab> rather than #define<space>.rwatson2008-07-222-9/+9
| | | | | Obtained from: Apple Inc. MFC after: 3 days
* Comment fix.rwatson2008-07-221-1/+1
| | | | | Obtained from: Apple Inc. MFC after: 3 days
* Comment typo fix.rwatson2008-07-221-1/+1
| | | | | Obtained from: Apple Inc. MFC after: 3 days
* Minor white space synchronization to Apple version of security audit.rwatson2008-07-221-4/+4
| | | | | Obtained from: Apple Inc. MFC after: 3 days
* In preparation to sync Apple and FreeBSD versions of security audit,rwatson2008-07-229-18/+18
| | | | | | | | pick up the Apple Computer -> Apple change in their copyright and license templates. Obtained from: Apple Inc. MFC after: 3 days
* Use unsigned int when iterating over groupsets in audit_arg_groupset().rwatson2008-07-221-1/+1
| | | | | Obtained from: Apple Inc. MFC after: 3 days
* Rework the lifetime management of the kernel implementation of POSIXjhb2008-06-277-42/+136
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | semaphores. Specifically, semaphores are now represented as new file descriptor type that is set to close on exec. This removes the need for all of the manual process reference counting (and fork, exec, and exit event handlers) as the normal file descriptor operations handle all of that for us nicely. It is also suggested as one possible implementation in the spec and at least one other OS (OS X) uses this approach. Some bugs that were fixed as a result include: - References to a named semaphore whose name is removed still work after the sem_unlink() operation. Prior to this patch, if a semaphore's name was removed, valid handles from sem_open() would get EINVAL errors from sem_getvalue(), sem_post(), etc. This fixes that. - Unnamed semaphores created with sem_init() were not cleaned up when a process exited or exec'd. They were only cleaned up if the process did an explicit sem_destroy(). This could result in a leak of semaphore objects that could never be cleaned up. - On the other hand, if another process guessed the id (kernel pointer to 'struct ksem' of an unnamed semaphore (created via sem_init)) and had write access to the semaphore based on UID/GID checks, then that other process could manipulate the semaphore via sem_destroy(), sem_post(), sem_wait(), etc. - As part of the permission check (UID/GID), the umask of the proces creating the semaphore was not honored. Thus if your umask denied group read/write access but the explicit mode in the sem_init() call allowed it, the semaphore would be readable/writable by other users in the same group, for example. This includes access via the previous bug. - If the module refused to unload because there were active semaphores, then it might have deregistered one or more of the semaphore system calls before it noticed that there was a problem. I'm not sure if this actually happened as the order that modules are discovered by the kernel linker depends on how the actual .ko file is linked. One can make the order deterministic by using a single module with a mod_event handler that explicitly registers syscalls (and deregisters during unload after any checks). This also fixes a race where even if the sem_module unloaded first it would have destroyed locks that the syscalls might be trying to access if they are still executing when they are unloaded. XXX: By the way, deregistering system calls doesn't do any blocking to drain any threads from the calls. - Some minor fixes to errno values on error. For example, sem_init() isn't documented to return ENFILE or EMFILE if we run out of semaphores the way that sem_open() can. Instead, it should return ENOSPC in that case. Other changes: - Kernel semaphores now use a hash table to manage the namespace of named semaphores nearly in a similar fashion to the POSIX shared memory object file descriptors. Kernel semaphores can now also have names longer than 14 chars (up to MAXPATHLEN) and can include subdirectories in their pathname. - The UID/GID permission checks for access to a named semaphore are now done via vaccess() rather than a home-rolled set of checks. - Now that kernel semaphores have an associated file object, the various MAC checks for POSIX semaphores accept both a file credential and an active credential. There is also a new posixsem_check_stat() since it is possible to fstat() a semaphore file descriptor. - A small set of regression tests (using the ksem API directly) is present in src/tools/regression/posixsem. Reported by: kris (1) Tested by: kris Reviewed by: rwatson (lightly) MFC after: 1 month
* Add missing counter increments for posix shm checks.jhb2008-06-261-0/+5
|
* Remove the posixsem_check_destroy() MAC check. It is semantically identicaljhb2008-06-237-39/+0
| | | | | | | to doing a MAC check for close(), but no other types of close() (including close(2) and ksem_close(2)) have MAC checks. Discussed with: rwatson
* The TrustedBSD MAC Framework named struct ipq instances 'ipq', which is therwatson2008-06-138-74/+73
| | | | | | | | | | | same as the global variable defined in ip_input.c. Instead, adopt the name 'q' as found in about 1/2 of uses in ip_input.c, preventing a collision on the name. This is non-harmful, but means that search and replace on the global works less well (as in the virtualization work), as well as indexing tools. MFC after: 1 week Reported by: julian
* Don't enforce unique device minor number policy anymore.ed2008-06-111-1/+1
| | | | | | | | | | | | | | | | | | | | | | | Except for the case where we use the cloner library (clone_create() and friends), there is no reason to enforce a unique device minor number policy. There are various drivers in the source tree that allocate unr pools and such to provide minor numbers, without using them themselves. Because we still need to support unique device minor numbers for the cloner library, introduce a new flag called D_NEEDMINOR. All cdevsw's that are used in combination with the cloner library should be marked with this flag to make the cloning work. This means drivers can now freely use si_drv0 to store their own flags and state, making it effectively the same as si_drv1 and si_drv2. We still keep the minor() and dev2unit() routines around to make drivers happy. The NTFS code also used the minor number in its hash table. We should not do this anymore. If the si_drv0 field would be changed, it would no longer end up in the same list. Approved by: philip (mentor)
* When the file-system containing the audit log file is running low onsimon2008-06-101-1/+3
| | | | | | | disk space a warning is printed. Make this warning a bit more informative. Approved by: rwatson
* Add an XXX comment regarding a bug I introduced when modifying the behaviorrwatson2008-06-031-0/+3
| | | | | of audit log vnode rotation: on shutdown, we may not properly drain all pending records, which could lead to lost records during system shutdown.
* Plug a memory leak which can occur when multiple MAC policies are loadedcsjp2008-05-271-0/+4
| | | | | | | | which label mbufs. This leak can occur if one policy successfully allocates label storage and subsequent allocations from other policies fail. Spotted by: rwatson MFC after: 1 week
* Don't use LK_DRAIN before calling VOP_FSYNC() in the two furtherrwatson2008-05-211-2/+2
| | | | | | | | panic cases for audit trail failure -- this doesn't contribute anything, and might arguably be wrong. MFC after: 1 week Requested by: attilio
* Don't use LK_DRAIN before calling VOP_FSYNC() in the panic case forrwatson2008-05-211-1/+1
| | | | | | | | audit trail failure -- this doesn't contribute anything, and might arguably be wrong. MFC after: 1 week Requested by: attilio
OpenPOWER on IntegriCloud