summaryrefslogtreecommitdiffstats
path: root/sys/security
Commit message (Collapse)AuthorAgeFilesLines
* Normalize a significant number of kernel malloc type names:rwatson2005-10-312-2/+2
| | | | | | | | | | | | | | | | | | | - Prefer '_' to ' ', as it results in more easily parsed results in memory monitoring tools such as vmstat. - Remove punctuation that is incompatible with using memory type names as file names, such as '/' characters. - Disambiguate some collisions by adding subsystem prefixes to some memory types. - Generally prefer lower case to upper case. - If the same type is defined in multiple architecture directories, attempt to use the same name in additional cases. Not all instances were caught in this change, so more work is required to finish this conversion. Similar changes are required for UMA zone names.
* Lock object while we iterate through it's backing objects.csjp2005-10-091-6/+7
| | | | Discussed with: alc
* Use the correct object's backing_object_offset while calculating offsets.csjp2005-10-041-1/+4
| | | | | | | | While we are here, add a note that we need to lock the object before walking the backing object list. Pointed out by: alc Discussed with: rwatson
* Standard Giant push down operations for the Mandatory Access Control (MAC)csjp2005-10-042-68/+54
| | | | | | | | | | | | | | | | | | | | | | framework. This makes Giant protection around MAC operations which inter- act with VFS conditional, based on the MPSAFE status of the file system. Affected the following syscalls: o __mac_get_fd o __mac_get_file o __mac_get_link o __mac_set_fd o __mac_set_file o __mac_set_link -Drop Giant all together in __mac_set_proc because the mac_cred_mmapped_drop_perms_recurse routine no longer requires it. -Move conditional Giant aquisitions to after label allocation routines. -Move the conditional release of Giant to before label de-allocation routines. Discussed with: rwatson
* Conditionally pickup Giant in mac_cred_mmapped_drop_perms_recurse socsjp2005-10-041-2/+6
| | | | | | | we can drop it all together in __mac_set_proc. Reviewed by: alc Discussed with: rwatson
* Complete removal of mac_create_root_mount/mpo_create_root_mount MACrwatson2005-10-022-3/+0
| | | | | | | | interfaces. Obtained from: TrustedBSD Project Submitted by: Chris Vance <Christopher dot Vance at SPARTA dot com> MFC after: 3 days
* Allow the root user to be aware of other credentials by virtuetrhodes2005-09-301-2/+12
| | | | | | of privilege. Submitted by: rwatson
* Add #include <sys/sx.h>, devfs is going to require this shortly.phk2005-09-197-0/+7
|
* Remove mac_create_root_mount() and mpo_create_root_mount(), whichrwatson2005-09-196-69/+0
| | | | | | | | | | | | | | | | | provided access to the root file system before the start of the init process. This was used briefly by SEBSD before it knew about preloading data in the loader, and using that method to gain access to data earlier results in fewer inconsistencies in the approach. Policy modules still have access to the root file system creation event through the mac_create_mount() entry point. Removed now, and will be removed from RELENG_6, in order to gain third party policy dependencies on the entry point for the lifetime of the 6.x branch. MFC after: 3 days Submitted by: Chris Vance <Christopher dot Vance at SPARTA dot com> Sponsored by: SPARTA
* Insert a series of place-holder function pointers in mac_policy.h forrwatson2005-08-081-0/+25
| | | | | | | | | | | | | | | entry points that will be inserted over the life-time of the 6.x branch, including for: - New struct file labeling (void * already added to struct file), events, access control checks. - Additional struct mount access control checks, internalization/ externalization. - mac_check_cap() - System call enter/exit check and event. - Socket and vnode ioctl entry points. MFC after: 3 days
* If a "hole" opens up in the ruleset (i.e.: remove 5), do not returntrhodes2005-07-281-5/+2
| | | | | | | unknown error. Instead, just return error. Submitted by: avatar Tested by: trhodes
* Remove duplicate initialization of mpo_create_stub pointer.rwatson2005-07-211-1/+0
| | | | | | PR: 83779 Submitted by: Wojciech A. Koszek <dunstan at freebsd dot czest dot pl> MFC after: 3 days
* Bump the module versions of the MAC Framework and MAC policy modulesrwatson2005-07-143-3/+11
| | | | | | | from 2 (6.x) to 3 (7.x) to allow for future changes in the MAC policy module ABI in 7.x. Obtained from: TrustedBSD Project
* When devfs cloning takes place, provide access to the credential of therwatson2005-07-148-15/+27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | process that caused the clone event to take place for the device driver creating the device. This allows cloned device drivers to adapt the device node based on security aspects of the process, such as the uid, gid, and MAC label. - Add a cred reference to struct cdev, so that when a device node is instantiated as a vnode, the cloning credential can be exposed to MAC. - Add make_dev_cred(), a version of make_dev() that additionally accepts the credential to stick in the struct cdev. Implement it and make_dev() in terms of a back-end make_dev_credv(). - Add a new event handler, dev_clone_cred, which can be registered to receive the credential instead of dev_clone, if desired. - Modify the MAC entry point mac_create_devfs_device() to accept an optional credential pointer (may be NULL), so that MAC policies can inspect and act on the label or other elements of the credential when initializing the skeleton device protections. - Modify tty_pty.c to register clone_dev_cred and invoke make_dev_cred(), so that the pty clone credential is exposed to the MAC Framework. While currently primarily focussed on MAC policies, this change is also a prerequisite for changes to allow ptys to be instantiated with the UID of the process looking up the pty. This requires further changes to the pty driver -- in particular, to immediately recycle pty nodes on last close so that the credential-related state can be recreated on next lookup. Submitted by: Andrew Reisse <andrew.reisse@sparta.com> Obtained from: TrustedBSD Project Sponsored by: SPAWAR, SPARTA MFC after: 1 week MFC note: Merge to 6.x, but not 5.x for ABI reasons
* Eliminate MAC entry point mac_create_mbuf_from_mbuf(), which isrwatson2005-07-058-102/+12
| | | | | | | | | | | redundant with respect to existing mbuf copy label routines. Expose a new mac_copy_mbuf() routine at the top end of the Framework and use that; use the existing mpo_copy_mbuf_label() routine on the bottom end. Obtained from: TrustedBSD Project Sponsored by: SPARTA, SPAWAR Approved by: re (scottl)
* Add MAC Framework and MAC policy entry point mac_check_socket_create(),rwatson2005-07-054-0/+40
| | | | | | | | | | | which is invoked from socket() and socketpair(), permitting MAC policy modules to control the creation of sockets by domain, type, and protocol. Obtained from: TrustedBSD Project Sponsored by: SPARTA, SPAWAR Approved by: re (scottl) Requested by: SCC
* Correct grammar error in commentcsjp2005-06-101-1/+1
| | | | MFC after: 3 days
* Gratuitous renaming of four System V Semaphore MAC Framework entryrwatson2005-06-077-56/+56
| | | | | | | | | | | | | | | points to convert _sema() to _sem() for consistency purposes with respect to the other semaphore-related entry points: mac_init_sysv_sema() -> mac_init_sysv_sem() mac_destroy_sysv_sem() -> mac_destroy_sysv_sem() mac_create_sysv_sema() -> mac_create_sysv_sem() mac_cleanup_sysv_sema() -> mac_cleanup_sysv_sem() Congruent changes are made to the policy interface to support this. Obtained from: TrustedBSD Project Sponsored by: SPAWAR, SPARTA
* Introduce MAC Framework and MAC Policy entry points to label and controlrwatson2005-05-047-0/+462
| | | | | | | | | | | | | | | | | | | | | | access to POSIX Semaphores: mac_init_posix_sem() Initialize label for POSIX semaphore mac_create_posix_sem() Create POSIX semaphore mac_destroy_posix_sem() Destroy POSIX semaphore mac_check_posix_sem_destroy() Check whether semaphore may be destroyed mac_check_posix_sem_getvalue() Check whether semaphore may be queried mac_check_possix_sem_open() Check whether semaphore may be opened mac_check_posix_sem_post() Check whether semaphore may be posted to mac_check_posix_sem_unlink() Check whether semaphore may be unlinked mac_check_posix_sem_wait() Check whether may wait on semaphore Update Biba, MLS, Stub, and Test policies to implement these entry points. For information flow policies, most semaphore operations are effectively read/write. Submitted by: Dandekar Hrishikesh <rishi_dandekar at sbcglobal dot net> Sponsored by: DARPA, McAfee, SPARTA Obtained from: TrustedBSD Project
* Get the directory structure correct in a comment.trhodes2005-04-222-2/+4
| | | | Submitted by: Samy Al Bahra
* Add locking support to mac_bsdextended:trhodes2005-04-221-37/+67
| | | | | | | | - Introduce a global mutex, mac_bsdextended_mtx, to protect the rule array and hold this mutex over use and modification of the rule array and rules. - Re-order and clean up sysctl_rule so that copyin/copyout/update happen in the right order (suggested by: jhb done by rwatson).
* Introduce p_canwait() and MAC Framework and MAC Policy entry pointsrwatson2005-04-185-0/+37
| | | | | | | | | | | | | | | mac_check_proc_wait(), which control the ability to wait4() specific processes. This permits MAC policies to limit information flow from children that have changed label, although has to be handled carefully due to common programming expectations regarding the behavior of wait4(). The cr_seeotheruids() check in p_canwait() is #if 0'd for this reason. The mac_stub and mac_test policies are updated to reflect these new entry points. Sponsored by: SPAWAR, SPARTA Obtained from: TrustedBSD Project
* Introduce three additional MAC Framework and MAC Policy entry points torwatson2005-04-165-8/+166
| | | | | | | | | | | | | | | | | | | | control socket poll() (select()), fstat(), and accept() operations, required for some policies: poll() mac_check_socket_poll() fstat() mac_check_socket_stat() accept() mac_check_socket_accept() Update mac_stub and mac_test policies to be aware of these entry points. While here, add missing entry point implementations for: mac_stub.c stub_check_socket_receive() mac_stub.c stub_check_socket_send() mac_test.c mac_test_check_socket_send() mac_test.c mac_test_check_socket_visible() Obtained from: TrustedBSD Project Sponsored by: SPAWAR, SPARTA
* In mac_get_fd(), remove unconditional acquisition of Giant around copyingrwatson2005-04-162-18/+14
| | | | | | | | | | | | | | of the socket label to thread-local storage, and replace it with conditional acquisition based on debug.mpsafenet. Acquire the socket lock around the copy operation. In mac_set_fd(), replace the unconditional acquisition of Giant with the conditional acquisition of Giant based on debug.mpsafenet. The socket lock is acquired in mac_socket_label_set() so doesn't have to be acquired here. Obtained from: TrustedBSD Project Sponsored by: SPAWAR, SPARTA
* Introduce new MAC Framework and MAC Policy entry points to control the userwatson2005-04-165-0/+337
| | | | | | | | | | | | | | | | | | | | | | of system calls to manipulate elements of the process credential, including: setuid() mac_check_proc_setuid() seteuid() mac_check_proc_seteuid() setgid() mac_check_proc_setgid() setegid() mac_check_proc_setegid() setgroups() mac_check_proc_setgroups() setreuid() mac_check_proc_setreuid() setregid() mac_check_proc_setregid() setresuid() mac_check_proc_setresuid() setresgid() mac_check_rpoc_setresgid() MAC checks are performed before other existing security checks; both current credential and intended modifications are passed as arguments to the entry points. The mac_test and mac_stub policies are updated. Submitted by: Samy Al Bahra <samy@kerneled.org> Obtained from: TrustedBSD Project
* Move MAC check_vnode_mmap entry point out from being exclusive tocsjp2005-04-148-12/+16
| | | | | | | | | | | | | | | | | | | | MAP_SHARED so that the entry point gets executed un-conditionally. This may be useful for security policies which want to perform access control checks around run-time linking. -add the mmap(2) flags argument to the check_vnode_mmap entry point so that we can make access control decisions based on the type of mapped object. -update any dependent API around this parameter addition such as function prototype modifications, entry point parameter additions and the inclusion of sys/mman.h header file. -Change the MLS, BIBA and LOMAC security policies so that subject domination routines are not executed unless the type of mapping is shared. This is done to maintain compatibility between the old vm_mmap_vnode(9) and these policies. Reviewed by: rwatson MFC after: 1 month
* Remove an accidental clearing of the new label pointer on a system Vrwatson2005-02-241-1/+0
| | | | | | message queue, which was introduced during the merge process. Submitted by: Andrew Reisse <areisse at nailabs dot com>
* Synchronize HEAD copyright/license with RELENG_5 copyright/license:rwatson2005-02-131-5/+5
| | | | McAfee instead of NETA.
* Update copyright for NETA->McAfee.rwatson2005-01-301-5/+5
|
* Remove policy references to mpo_check_vnode_mprotect(), which isrwatson2005-01-265-54/+2
| | | | | | | | currently unimplemented. Update copyrights. Pointed out by: csjp
* Remove an obsoleted comment about struct versions.rwatson2005-01-231-1/+0
| | | | | MFC after: 3 days Pointed out by: trhodes
* Update mac_test for MAC Framework policy entry points System V IPCrwatson2005-01-221-0/+378
| | | | | | | | | objects (message queues, semaphores, shared memory), exercising and validating MAC labels on these objects. Submitted by: Dandekar Hrishikesh <rishi_dandekar at sbcglobal dot net> Obtained from: TrustedBSD Project Sponsored by: DARPA, SPAWAR, McAfee Research
* Update mac_stub for MAC Framework policy entry points System V IPCrwatson2005-01-221-5/+213
| | | | | | | | objects (message queues, semaphores, shared memory). Submitted by: Dandekar Hrishikesh <rishi_dandekar at sbcglobal dot net> Obtained from: TrustedBSD Project Sponsored by: DARPA, SPAWAR, McAfee Research
* Implement MLS confidentiality protection for System V IPC objectsrwatson2005-01-221-5/+391
| | | | | | | | (message queues, semaphores, shared memory). Submitted by: Dandekar Hrishikesh <rishi_dandekar at sbcglobal dot net> Obtained from: TrustedBSD Project Sponsored by: DARPA, SPAWAR, McAfee Research
* Implement Biba integrity protection for System V IPC objects (messagerwatson2005-01-221-5/+394
| | | | | | | | queues, semaphores, shared memory). Submitted by: Dandekar Hrishikesh <rishi_dandekar at sbcglobal dot net> Obtained from: TrustedBSD Project Sponsored by: DARPA, SPAWAR, McAfee Research
* Exempt the superuser from mac_seeotheruids checks.rwatson2005-01-031-0/+3
| | | | | | Submitted by: bkoenig at cs dot tu-berlin dot de PR: 72238 MFC after: 2 weeks
* Add a new sysctl/tunable to mac_portacl:rwatson2004-12-081-0/+23
| | | | | | | | | | | | | | security.mac.portacl.autoport_exempt This sysctl exempts to bind port '0' as long as IP_PORTRANGELOW hasn't been set on the socket. This is quite useful as it allows applications to use automatic binding without adding overly broad rules for the binding of port 0. This sysctl defaults to enabled. This is a slight variation on the patch submitted by the contributor. MFC after: 2 weeks Submitted by: Michal Mertl <mime at traveller dot cz>
* Switch from using an sx lock to a mutex for the mac_portacl rule chain:rwatson2004-12-061-26/+19
| | | | | | | | | | | | | | | | the sx lock was used previously because we might sleep allocating additional memory by using auto-extending sbufs. However, we no longer do this, instead retaining the user-submitted rule string, so mutexes can be used instead. Annotate the reason for not using the sbuf-related rule-to-string code with a comment. Switch to using TAILQ_CONCAT() instead of manual list copying, as it's O(1), reducing the rule replacement step under the mutex from O(2N) to O(2). Remove now uneeded vnode-related includes. MFC after: 2 weeks
* Implement MAC entry points relating to System V IPC, calling into therwatson2004-11-173-0/+592
| | | | | | | | | MAC policies to perform object life cycle operations and access control checks. Submitted by: Dandekar Hrishikesh <rishi_dandekar at sbcglobal dot net> Obtained from: TrustedBSD Project Sponsored by: DARPA, SPAWAR, McAfee Research
* Define new MAC framework and policy entry points for System V IPCrwatson2004-11-172-1/+129
| | | | | | | | | | | | | | | objects and operations: - System V IPC message, message queue, semaphore, and shared memory segment init, destroy, cleanup, create operations. - System V IPC message, message queue, seamphore, and shared memory segment access control entry points, including rights to attach, destroy, and manipulate these IPC objects. Submitted by: Dandekar Hrishikesh <rishi_dandekar at sbcglobal dot net> Obtained from: TrustedBSD Project Sponsored by: DARPA, SPAWAR, McAfee Research
* Bump MAC Framework version to 2 in preparation for the upcoming API/ABIrwatson2004-11-093-3/+3
| | | | | | changes associated with adding System V IPC support. This will prevent old modules from being used with the new kernel, and new modules from being used with the old kernel.
* Disable use of synchronization early in the boot by the MAC Framework;rwatson2004-10-302-0/+42
| | | | | | for modules linked into the kernel or loaded very early, panics will result otherwise, as the CV code it calls will panic due to its use of a mutex before it is initialized.
* /%x/%s/ -- mismerged DEBUGGER() printf() format stirng from therwatson2004-10-231-1/+1
| | | | | | TrustedBSD branch. Submitted by: bde
* Expand comments on various sections of the MAC Framework Policy API,rwatson2004-10-221-4/+15
| | | | | | | | | as well as document the properties of the mac_policy_conf structure. Warn about the ABI risks in changing the structure without careful consideration. Obtained from: TrustedBSD Project Sponsored by: SPAWAR
* Replace direct reference to kdb_enter() with a DEBUGGER() macro thatrwatson2004-10-221-28/+34
| | | | | | | will call printf() if KDB isn't compiled into the kernel. Obtained from: TrustedBSD Project Sponsored by: SPAWAR
* Minor white space synchronization and line wrapping.rwatson2004-10-222-1/+3
|
* In the MAC label zone destructor, assert that the label is onlyrwatson2004-10-221-1/+3
| | | | destroyed in an initialized state.
* Remove extern declaration of mac_enforce_sysv, as it's not present inrwatson2004-10-221-1/+0
| | | | the CVS version of the MAC Framework.
* Bump copyright dates for NETA on these files.rwatson2004-10-212-2/+2
|
* Modify mac_bsdextended policy so that it defines its own vnode accessrwatson2004-10-212-33/+74
| | | | | | | | | | | right bits rather than piggy-backing on the V* rights defined in vnode.h. The mac_bsdextended bits are given the same values as the V* bits to make the new kernel module binary compatible with the old version of libugidfw that uses V* bits. This avoids leaking kernel API/ABI to user management tools, and in particular should remove the need for libugidfw to include vnode.h. Requested by: phk
OpenPOWER on IntegriCloud