summaryrefslogtreecommitdiffstats
path: root/sys/security
Commit message (Collapse)AuthorAgeFilesLines
* Prefer NULL to 0 when passing a NULL pointer.rwatson2002-08-202-2/+2
|
* Provide stub mpo_syscall() implementations for mac_none and mac_test.rwatson2002-08-203-0/+27
| | | | | Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Close a race in process label changing opened due to dropping therwatson2002-08-198-56/+80
| | | | | | | | | | proc locking when revoking access to mmaps. Instead, perform this later once we've changed the process label (hold onto a reference to the new cred so that we don't lose it when we release the process lock if another thread changes the credential). Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Pass active_cred and file_cred into the MAC framework explicitlyrwatson2002-08-1916-156/+229
| | | | | | | | | | | for mac_check_vnode_{poll,read,stat,write}(). Pass in fp->f_cred when calling these checks with a struct file available. Otherwise, pass NOCRED. All currently MAC policies use active_cred, but could now offer the cached credential semantic used for the base system security model. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Provide an implementation of mac_syscall() so that security modulesrwatson2002-08-1910-1/+318
| | | | | | | | | | | can offer new services without reserving system call numbers, or augmented versions of existing services. User code requests a target policy by name, and specifies the policy-specific API plus target. This is required in particular for our port of SELinux/FLASK to the MAC framework since it offers additional security services. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Break out mac_check_pipe_op() into component check entry points:rwatson2002-08-1915-97/+618
| | | | | | | | | | | mac_check_pipe_poll(), mac_check_pipe_read(), mac_check_pipe_stat(), and mac_check_pipe_write(). This is improves consistency with other access control entry points and permits security modules to only control the object methods that they are interested in, avoiding switch statements. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Break out mac_check_vnode_op() into three seperate checks:rwatson2002-08-1915-148/+678
| | | | | | | | | | mac_check_vnode_poll(), mac_check_vnode_read(), mac_check_vnode_write(). This improves the consistency with other existing vnode checks, and allows policies to avoid implementing switch statements to determine what operations they do and do not want to authorize. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Assert process locks in proces-related access control checks.rwatson2002-08-198-0/+48
| | | | | Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Add a missing vnode assertion for the exec() check.rwatson2002-08-198-0/+16
| | | | | Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Keep a copy of the credential used to mount filesystems around sophk2002-08-191-1/+1
| | | | | | | | | | | | | | | | | we can check and use it later on. Change the pieces of code which relied on mount->mnt_stat.f_owner to check which user mounted the filesystem. This became needed as the EA code needs to be able to allocate blocks for "system" EA users like ACLs. There seems to be some half-baked (probably only quarter- actually) notion that the superuser for a given filesystem is the user who mounted it, but this has far from been carried through. It is unclear if it should be. Sponsored by: DARPA & NAI Labs.
* Wrap maintenance of varios nmac{objectname} counters in MAC_DEBUG so werwatson2002-08-168-0/+368
| | | | | | | | can avoid the cost of a large number of atomic operations if we're not interested in the object count statistics. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Rename mac_check_socket_receive() to mac_check_socket_deliver() so thatrwatson2002-08-158-32/+32
| | | | | | | | we can use the names _receive() and _send() for the receive() and send() checks. Rename related constants, policy implementations, etc. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Rename mac_check_socket_receive() to mac_check_socket_deliver() so thatrwatson2002-08-158-80/+80
| | | | | | | | | | | | | we can use the names _receive() and _send() for the receive() and send() checks. Rename related constants, policy implementations, etc. PR: Submitted by: Reviewed by: Approved by: Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs MFC after:
* Sync to trustedbsd_mac tree: default to sigsegv rather than copy-on-writerwatson2002-08-158-8/+8
| | | | | | | | | during a label change resulting in an mmap removal. This is "fail stop" behavior, which is preferred, although it offers slightly less transparency. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Define 'struct label' in _label.h rather than mac.h, which will permitrwatson2002-08-131-18/+2
| | | | | | | | | | | | | us to reduce namespace pollution by doing a nested include of _label.h rather than mac.h. mac.h contains lots of baggage, whereas _label.h contains much less. A follow-up sweep to change nested inclusion will follow. The problem regarding exporting 'struct label' to userland due to excessive exporting of kernel structures to userland still needs to be resolved. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs Suggested by: bde
* Declare a module service "kernel_mac_support" when MAC support isrwatson2002-08-129-0/+65
| | | | | | | | | | | | | | | enabled and the kernel provides the MAC registration and entry point service. Declare a dependency on that module service for any MAC module registered using mac_policy.h. For now, hard code the version as 1, but once we've come up with a versioning policy, we'll move to a #define of some sort. In the mean time, this will prevent loading a MAC module when 'options MAC' isn't present, which (due to a bug in the kernel linker) can result if the MAC module is preloaded via loader.conf. This particular evil recommended by: peter Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI LAbs
* - Replace v_flag with v_iflag and v_vflagjeff2002-08-0413-55/+72
| | | | | | | | | | | | | | | - v_vflag is protected by the vnode lock and is used when synchronization with VOP calls is needed. - v_iflag is protected by interlock and is used for dealing with vnode management issues. These flags include X/O LOCK, FREE, DOOMED, etc. - All accesses to v_iflag and v_vflag have either been locked or marked with mp_fixme's. - Many ASSERT_VOP_LOCKED calls have been added where the locking was not clear. - Many functions in vfs_subr.c were restructured to provide for stronger locking. Idea stolen from: BSD/OS
* Improve ordering of MAC entry points in mac_policy_op structure.rwatson2002-08-021-6/+6
| | | | | Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Include file cleanup; mac.h and malloc.h at one point had orderingrwatson2002-08-018-0/+8
| | | | | | relationship requirements, and no longer do. Reminded by: bde
* Change macop_t to const, use macop_t in MAC policy entry point definitionrwatson2002-08-011-2/+2
| | | | | | | | structure. This prevents a boatload of warnings in the MAC modules, so we can hook them up to the build. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Introduce support for Mandatory Access Control and extensiblerwatson2002-07-3111-0/+9207
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | kernel access control. Provide implementations of some sample operating system security policy extensions. These are not yet hooked up to the build as other infrastructure is still being committed. Most of these work fairly well and are in daily use in our development and (limited) production environments. Some are not yet in their final form, and a number of the labeled policies waste a lot of kernel memory and will be fixed over the next month or so to be more conservative. They do give good examples of the flexibility of the MAC framework for implementing a variety of security policies. mac_biba: Implementation of fixed-label Biba integrity policy, similar to those found in a number of commercial trusted operating systems. All subjects and objects are assigned integrity levels, and information flow is controlled based on a read-up, write-down policy. Currently, purely hierarchal. mac_bsdextended: Implementation of a "file system firewall", which allows the administrator to specify a series of rules limiting access by users and groups to objects owned by other users and groups. This policy is unlabeled, relying on existing system security labeling (file permissions/ownership, process credentials). mac_ifoff: Secure interface silencing. Special-purpose module to limit inappropriate out-going network traffic for silent monitoring scenarios. Prevents the various network stacks from generating any output despite an interface being live for reception. mac_mls: Implementation of fixed-label Multi-Level Security confidentiality policy, similar to those found in a number of commercial trusted operating systems. All subjects and objects are assigned confidentiality levels, and information flow is controlled based on a write-up, read-down policy. Currently, purely hiearchal, although non-hierarchal support is in the works. mac_none: Policy module implementing all MAC policy entry points with empty stubs. A good place to start if you want all the prototypes types in for you, and don't mind a bit of pruning. Can be loaded, but has no access control impact. Useful also for performance measurements. mac_seeotheruids: Policy module implementing a security service similar to security.bsd.seeotheruids, only a slightly more detailed policy involving exceptions for members of specific groups, etc. This policy is unlabeled, relying on existing system security labeling (process credentials). mac_test: Policy module implementing basic sanity tests for label handling. Attempts to ensure that labels are not freed multiple times, etc, etc. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Reduce the memory footprint of MAC in the base system by halvingrwatson2002-07-311-1/+1
| | | | | | | | | | the number of policy slots to 4. (Having run a quick errand, time to start on phase 2 of the MAC integration) Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Begin committing support for Mandatory Access Control and extensiblerwatson2002-07-308-0/+24128
| | | | | | | | | | | | | | | | | | | | kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Begin committing support for Mandatory Access Control and extensiblerwatson2002-07-302-0/+898
| | | | | | | | | | | | | | | | | | | | | kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. Include files to declare MAC userland interface (mac.h), MAC subsystem entry points (mac.h), and MAC policy entry points (mac_policy.h). These files define the interface between the kernel and the MAC framework, and between the MAC framework and each registered policy module. These APIs and ABIs may not be assumed to be stable until following FreeBSD 5.1-RELEASE. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Stubs for the TrustedBSD MAC system calls to permit TrustedBSD MACrwatson2002-07-308-0/+744
| | | | | | | | userland code to operate on kernel's from the main tree. Not much in this file yet. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Get rid of warnings, there's no need to do preprocessor concatination ofalfred2002-06-011-2/+2
| | | | things with commas and equal signs.
* Back out my lats commit of locking down a socket, it conflicts with hsu's work.tanimura2002-05-312-57/+16
| | | | Requested by: hsu
* Check for defined(__i386__) instead of just defined(i386) since the compileralfred2002-05-301-1/+1
| | | | will be updated to only define(__i386__) for ANSI cleanliness.
* Lock down a socket, milestone 1.tanimura2002-05-202-16/+57
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | o Add a mutex (sb_mtx) to struct sockbuf. This protects the data in a socket buffer. The mutex in the receive buffer also protects the data in struct socket. o Determine the lock strategy for each members in struct socket. o Lock down the following members: - so_count - so_options - so_linger - so_state o Remove *_locked() socket APIs. Make the following socket APIs touching the members above now require a locked socket: - sodisconnect() - soisconnected() - soisconnecting() - soisdisconnected() - soisdisconnecting() - sofree() - soref() - sorele() - sorwakeup() - sotryfree() - sowakeup() - sowwakeup() Reviewed by: alfred
* Change p_can{debug,see,sched,signal}()'s first argument to be a threadjhb2002-05-191-4/+2
| | | | | | | pointer instead of a proc pointer and require the process pointed to by the second argument to be locked. We now use the thread ucred reference for the credential checks in p_can*() as a result. p_canfoo() should now no longer need Giant.
* More s/file system/filesystem/gtrhodes2002-05-162-4/+4
|
* Use the proc lock to protect p_ucred while we read a few items from it.jhb2002-04-111-3/+10
|
* Change the suser() API to take advantage of td_ucred as well as do ajhb2002-04-012-3/+3
| | | | | | | | | | | | general cleanup of the API. The entire API now consists of two functions similar to the pre-KSE API. The suser() function takes a thread pointer as its only argument. The td_ucred member of this thread must be valid so the only valid thread pointers are curthread and a few kernel threads such as thread0. The suser_cred() function takes a pointer to a struct ucred as its first argument and an integer flag as its second argument. The flag is currently only used for the PRISON_ROOT flag. Discussed on: smp@
* DBA update: pick the right DBA for various LOMAC copyrights.rwatson2002-03-1327-27/+27
|
* Simple p_ucred -> td_ucred changes to start using the per-thread ucredjhb2002-02-273-6/+5
| | | | reference.
* Introduce a version field to `struct xucred' in place of one of thedd2002-02-271-5/+1
| | | | | | | | | | | | spares (the size of the field was changed from u_short to u_int to reflect what it really ends up being). Accordingly, change users of xucred to set and check this field as appropriate. In the kernel, this is being done inside the new cru2x() routine which takes a `struct ucred' and fills out a `struct xucred' according to the former. This also has the pleasant sideaffect of removing some duplicate code. Reviewed by: rwatson
* Part I: Update extended attribute API and ABI:rwatson2002-02-101-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | o Modify the system call syntax for extattr_{get,set}_{fd,file}() so as not to use the scatter gather API (which appeared not to be used by any consumers, and be less portable), rather, accepts 'data' and 'nbytes' in the style of other simple read/write interfaces. This changes the API and ABI. o Modify system call semantics so that extattr_get_{fd,file}() return a size_t. When performing a read, the number of bytes read will be returned, unless the data pointer is NULL, in which case the number of bytes of data are returned. This changes the API only. o Modify the VOP_GETEXTATTR() vnode operation to accept a *size_t argument so as to return the size, if desirable. If set to NULL, the size will not be returned. o Update various filesystems (pseodofs, ufs) to DTRT. These changes should make extended attributes more useful and more portable. More commits to rebuild the system call files, as well as update userland utilities to follow. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Replace a few more lines of code orphaned by MFREE going away.mjacob2002-02-071-2/+2
| | | | MFC after: 1 day
* Pre-KSE/M3 commit.julian2002-02-071-1/+1
| | | | | | | | | | this is a low-functionality change that changes the kernel to access the main thread of a process via the linked list of threads rather than assuming that it is embedded in the process. It IS still embeded there but remove all teh code that assumes that in preparation for the next commit which will actually move it out. Reviewed by: peter@freebsd.org, gallatin@cs.duke.edu, benno rice,
* s/sonewconn3/sonewconn/ forgotten by the modifier.green2001-12-261-1/+1
|
* Split out NAI Labs license and BSD license to prevent the accidentalgreen2001-12-032-9/+80
| | | | violation of either.
* Return a POSIX-compliant error for write(2) failure.green2001-11-281-1/+1
|
* Import LOMAC preliminary release 2.0.0 in src/sys/security. These files maygreen2001-11-1927-0/+6714
be modified and do not have to remain on the vendor branch. http://opensource.nailabs.com/lomac/index.html Sponsored by: DARPA, NAI Labs (CBOSS project)
OpenPOWER on IntegriCloud