summaryrefslogtreecommitdiffstats
path: root/sys/security
Commit message (Collapse)AuthorAgeFilesLines
* Exempt the superuser from mac_seeotheruids checks.rwatson2005-01-031-0/+3
| | | | | | Submitted by: bkoenig at cs dot tu-berlin dot de PR: 72238 MFC after: 2 weeks
* Add a new sysctl/tunable to mac_portacl:rwatson2004-12-081-0/+23
| | | | | | | | | | | | | | security.mac.portacl.autoport_exempt This sysctl exempts to bind port '0' as long as IP_PORTRANGELOW hasn't been set on the socket. This is quite useful as it allows applications to use automatic binding without adding overly broad rules for the binding of port 0. This sysctl defaults to enabled. This is a slight variation on the patch submitted by the contributor. MFC after: 2 weeks Submitted by: Michal Mertl <mime at traveller dot cz>
* Switch from using an sx lock to a mutex for the mac_portacl rule chain:rwatson2004-12-061-26/+19
| | | | | | | | | | | | | | | | the sx lock was used previously because we might sleep allocating additional memory by using auto-extending sbufs. However, we no longer do this, instead retaining the user-submitted rule string, so mutexes can be used instead. Annotate the reason for not using the sbuf-related rule-to-string code with a comment. Switch to using TAILQ_CONCAT() instead of manual list copying, as it's O(1), reducing the rule replacement step under the mutex from O(2N) to O(2). Remove now uneeded vnode-related includes. MFC after: 2 weeks
* Implement MAC entry points relating to System V IPC, calling into therwatson2004-11-173-0/+592
| | | | | | | | | MAC policies to perform object life cycle operations and access control checks. Submitted by: Dandekar Hrishikesh <rishi_dandekar at sbcglobal dot net> Obtained from: TrustedBSD Project Sponsored by: DARPA, SPAWAR, McAfee Research
* Define new MAC framework and policy entry points for System V IPCrwatson2004-11-172-1/+129
| | | | | | | | | | | | | | | objects and operations: - System V IPC message, message queue, semaphore, and shared memory segment init, destroy, cleanup, create operations. - System V IPC message, message queue, seamphore, and shared memory segment access control entry points, including rights to attach, destroy, and manipulate these IPC objects. Submitted by: Dandekar Hrishikesh <rishi_dandekar at sbcglobal dot net> Obtained from: TrustedBSD Project Sponsored by: DARPA, SPAWAR, McAfee Research
* Bump MAC Framework version to 2 in preparation for the upcoming API/ABIrwatson2004-11-093-3/+3
| | | | | | changes associated with adding System V IPC support. This will prevent old modules from being used with the new kernel, and new modules from being used with the old kernel.
* Disable use of synchronization early in the boot by the MAC Framework;rwatson2004-10-302-0/+42
| | | | | | for modules linked into the kernel or loaded very early, panics will result otherwise, as the CV code it calls will panic due to its use of a mutex before it is initialized.
* /%x/%s/ -- mismerged DEBUGGER() printf() format stirng from therwatson2004-10-231-1/+1
| | | | | | TrustedBSD branch. Submitted by: bde
* Expand comments on various sections of the MAC Framework Policy API,rwatson2004-10-221-4/+15
| | | | | | | | | as well as document the properties of the mac_policy_conf structure. Warn about the ABI risks in changing the structure without careful consideration. Obtained from: TrustedBSD Project Sponsored by: SPAWAR
* Replace direct reference to kdb_enter() with a DEBUGGER() macro thatrwatson2004-10-221-28/+34
| | | | | | | will call printf() if KDB isn't compiled into the kernel. Obtained from: TrustedBSD Project Sponsored by: SPAWAR
* Minor white space synchronization and line wrapping.rwatson2004-10-222-1/+3
|
* In the MAC label zone destructor, assert that the label is onlyrwatson2004-10-221-1/+3
| | | | destroyed in an initialized state.
* Remove extern declaration of mac_enforce_sysv, as it's not present inrwatson2004-10-221-1/+0
| | | | the CVS version of the MAC Framework.
* Bump copyright dates for NETA on these files.rwatson2004-10-212-2/+2
|
* Modify mac_bsdextended policy so that it defines its own vnode accessrwatson2004-10-212-33/+74
| | | | | | | | | | | right bits rather than piggy-backing on the V* rights defined in vnode.h. The mac_bsdextended bits are given the same values as the V* bits to make the new kernel module binary compatible with the old version of libugidfw that uses V* bits. This avoids leaking kernel API/ABI to user management tools, and in particular should remove the need for libugidfw to include vnode.h. Requested by: phk
* Remove the debugging tunable, it was not being used.trhodes2004-09-101-10/+1
| | | | | | Enable first match by default.[1] We should: rwatson [1]
* Allow mac_bsdextended(4) to log failed attempts to syslog's AUTHPRIVtrhodes2004-08-211-5/+19
| | | | | | | | facility. This is disabled by default but may be turned on by using the mac_bsdextended_logging sysctl. Reviewed by: re (jhb) Approved by: re (jhb)
* Give the mac_bsdextended(4) policy the ability to match and apply on a firsttrhodes2004-08-211-2/+21
| | | | | | | | | | rule only in place of all rules match. This is similar to how ipfw(8) works. Provide a sysctl, mac_bsdextended_firstmatch_enabled, to enable this feature. Reviewed by: re (jhb) Aprroved by: re (jhb)
* * Add a "how" argument to uma_zone constructors and initialization functionsgreen2004-08-021-3/+4
| | | | | | | | | | | | | | | | | so that they know whether the allocation is supposed to be able to sleep or not. * Allow uma_zone constructors and initialation functions to return either success or error. Almost all of the ones in the tree currently return success unconditionally, but mbuf is a notable exception: the packet zone constructor wants to be able to fail if it cannot suballocate an mbuf cluster, and the mbuf allocators want to be able to fail in general in a MAC kernel if the MAC mbuf initializer fails. This fixes the panics people are seeing when they run out of memory for mbuf clusters. * Allow debug.nosleepwithlocks on WITNESS to be disabled, without changing the default. Both bmilekic and jeff have reviewed the changes made to make failable zone allocations work.
* Introduce SLOT_SET macro and use it in place of casts as lvalues.kan2004-07-283-12/+16
|
* Allow an effective uid of root to bypass mac_bsdextended rules; the MACrwatson2004-07-231-0/+3
| | | | | | | Framework can restrict the root user, but this policy is not intended to support that. Stylish Swiss footwear provided for: trhodes
* Rename Biba and MLS _single label elements to _effective, which morerwatson2004-07-164-353/+353
| | | | | | | | | accurately represents the intention of the 'single' label element in Biba and MLS labels. It also approximates the use of 'effective' in traditional UNIX credentials, and avoids confusion with 'singlelabel' in the context of file systems. Inspired by: trhodes
* Do a pass over all modules in the kernel and make them return EOPNOTSUPPphk2004-07-152-0/+2
| | | | | | | | for unknown events. A number of modules return EINVAL in this instance, and I have left those alone for now and instead taught MOD_QUIESCE to accept this as "didn't do anything".
* Update for the KDB framework:marcel2004-07-101-28/+29
| | | | o Call kdb_enter() instead of Debugger().
* Introduce a temporary mutex, mac_ifnet_mtx, to lock MAC labels onrwatson2004-06-247-0/+53
| | | | | | | | | | | | | | | | | | network interfaces. This global mutex will protect all ifnet labels. Acquire the mutex across various MAC activities on interfaces, such as security checks, propagating interface labels to mbufs generated from the interface, retrieving and setting the interface label. Introduce mpo_copy_ifnet_label MAC policy entry point to copy the value of an interface label from one label to another. Use this to avoid performing a label externalize while holding mac_ifnet_mtx; copy the label to a temporary ifnet label and then externalize that. Implement mpo_copy_ifnet_label for various MAC policies that implement interface labeling using generic label copying routines. Obtained from: TrustedBSD Project Sponsored by: DARPA, McAfee Research
* Do the dreaded s/dev_t/struct cdev */phk2004-06-168-8/+9
| | | | Bump __FreeBSD_version accordingly.
* Socket MAC labels so_label and so_peerlabel are now protected byrwatson2004-06-131-8/+57
| | | | | | | | | | | | | SOCK_LOCK(so): - Hold socket lock over calls to MAC entry points reading or manipulating socket labels. - Assert socket lock in MAC entry point implementations. - When externalizing the socket label, first make a thread-local copy while holding the socket lock, then release the socket lock to externalize to userspace.
* add missing #include <sys/module.h>phk2004-05-302-0/+2
|
* Remove dead code. (This loop counted the number of rules, but the countcperciva2004-05-151-7/+0
| | | | | | | was never used.) Reported by: pjd Approved by: rwatson
* Improve consistency of include file guards in src/sys/sys by terminatingrwatson2004-05-102-6/+6
| | | | | | them with '_', as well as beginning with '_'. Observed by: bde
* If the mbuf pointer passed to mac_mbuf_to_label() is NULL, or the tagrwatson2004-05-031-1/+4
| | | | | | | | | | | lookup for the label tag fails, return NULL rather than something close to NULL. This scenario occurs if mbuf header labeling is optional and a policy requiring labeling is loaded, resulting in some mbufs having labels and others not. Previously, 0x14 would be returned because the NULL from m_tag_find() was not treated specially. Obtained from: TrustedBSD Project Sponsored by: DARPA, McAfee Research
* Add /* !MAC */ to final #endif.rwatson2004-05-032-2/+2
|
* Update copyright.rwatson2004-05-031-1/+1
|
* When performing label assertions on an mbuf header label in mac_test,rwatson2004-05-031-2/+3
| | | | | | | | | | test the label pointer for NULL before testing the label slot for permitted values. When loading mac_test dynamically with conditional mbuf labels, the label pointer may be NULL if the mbuf was instantiated while labels were not required on mbufs by any policy. Obtained from: TrustedBSD Project Sponsored by: DARPA, McAfee Research
* Bump copyright date for NETA to 2004.rwatson2004-05-032-2/+2
|
* Add MAC_STATIC, a kernel option that disables internal MAC Frameworkrwatson2004-05-032-0/+50
| | | | | | | | | | synchronization protecting against dynamic load and unload of MAC policies, and instead simply blocks load and unload. In a static configuration, this allows you to avoid the synchronization costs associated with introducing dynamicism. Obtained from: TrustedBSD Project Sponsored by: DARPA, McAfee Research
* Define BPFD_LOCK_ASSERT() to assert the BPF descriptor lock.rwatson2004-02-291-0/+4
| | | | | | | | Assert the BPF descriptor lock in the MAC calls referencing live BPF descriptors. Obtained from: TrustedBSD Project Sponsored by: DARPA, McAfee Research
* Forward declare struct proc, struct sockaddr, and struct thread, whichrwatson2004-02-261-0/+3
| | | | | | | are employed in entry points later in the same include file. Obtained from: TrustedBSD Project Sponsored by: DARPA, Air Force Research Laboratory, McAfee Research
* Forward declare struct bpf_d, struct ifnet, struct image_params, andrwatson2004-02-261-1/+5
| | | | | | | | | struct vattr in mac_policy.h. This permits policies not implementing entry points using these types to compile without including include files with these types. Obtained from: TrustedBSD Project Sponsored by: DARPA, Air Force Research Laboratory
* Move inet and inet6 related MAC Framework entry points from mac_net.crwatson2004-02-264-655/+807
| | | | | | | | | | | | | | to a new mac_inet.c. This code is now conditionally compiled based on inet support being compiled into the kernel. Move socket related MAC Framework entry points from mac_net.c to a new mac_socket.c. To do this, some additional _enforce MIB variables are now non-static. In addition, mbuf_to_label() is now mac_mbuf_to_label() and non-static. Obtained from: TrustedBSD Project Sponsored by: DARPA, McAfee Research
* Reimplement sysctls handling by MAC framework.pjd2004-02-227-36/+26
| | | | | | | | | | | Now I believe it is done in the right way. Removed some XXMAC cases, we now assume 'high' integrity level for all sysctls, except those with CTLFLAG_ANYBODY flag set. No more magic. Reviewed by: rwatson Approved by: rwatson, scottl (mentor) Tested with: LINT (compilation), mac_biba(4) (functionality)
* Update my personal copyrights and NETA copyrights in the kernelrwatson2004-02-2223-46/+46
| | | | | | | | to use the "year1-year3" format, as opposed to "year1, year2, year3". This seems to make lawyers more happy, but also prevents the lines from getting excessively long as the years start to add up. Suggested by: imp
* Commit file missed in last pass: MAC api uses 'struct pipepair', notrwatson2004-02-011-8/+8
| | | | 'struct pipe' now.
* Coalesce pipe allocations and frees. Previously, the pipe coderwatson2004-02-019-93/+95
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | would allocate two 'struct pipe's from the pipe zone, and malloc a mutex. - Create a new "struct pipepair" object holding the two 'struct pipe' instances, struct mutex, and struct label reference. Pipe structures now have a back-pointer to the pipe pair, and a 'pipe_present' flag to indicate whether the half has been closed. - Perform mutex init/destroy in zone init/destroy, avoiding reallocating the mutex for each pipe. Perform most pipe structure setup in zone constructor. - VM memory mappings for pageable buffers are still done outside of the UMA zone. - Change MAC API to speak 'struct pipepair' instead of 'struct pipe', update many policies. MAC labels are also handled outside of the UMA zone for now. Label-only policy modules don't have to be recompiled, but if a module is recompiled, its pipe entry points will need to be updated. If a module actually reached into the pipe structures (unlikely), that would also need to be modified. These changes substantially simplify failure handling in the pipe code as there are many fewer possible failure modes. On half-close, pipes no longer free the 'struct pipe' for the closed half until a full-close takes place. However, VM mapped buffers are still released on half-close. Some code refactoring is now possible to clean up some of the back references, etc; this patch attempts not to change the structure of most of the pipe implementation, only allocation/free code paths, so as to avoid introducing bugs (hopefully). This cuts about 8%-9% off the cost of sequential pipe allocation and free in system call tests on UP and SMP in my micro-benchmarks. May or may not make a difference in macro-benchmarks, but doing less work is good. Reviewed by: juli, tjr Testing help: dwhite, fenestro, scottl, et al
* Pay attention to mac_portacl_enabled.rwatson2004-01-201-1/+5
| | | | Submitted by: simon
* Switch TCP over to using the inpcb label when responding in timedrwatson2003-12-178-0/+72
| | | | | | | | | | | | | | | | wait, rather than the socket label. This avoids reaching up to the socket layer during connection close, which requires locking changes. To do this, introduce MAC Framework entry point mac_create_mbuf_from_inpcb(), which is called from tcp_twrespond() instead of calling mac_create_mbuf_from_socket() or mac_create_mbuf_netlayer(). Introduce MAC Policy entry point mpo_create_mbuf_from_inpcb(), and implementations for various policies, which generally just copy label data from the inpcb to the mbuf. Assert the inpcb lock in the entry point since we require consistency for the inpcb label reference. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* interpvnodelabel can be NULL in mac_test_execve_transition(). Thisrwatson2003-12-101-1/+3
| | | | | | | | | | only turned up when running mac_test side by side with a transitioning policy such as SEBSD. Make the NULL testing match mac_test_execve_will_transition(), which already tested the vnode label pointer for NULL. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Rename mac_create_cred() MAC Framework entry point to mac_copy_cred(),rwatson2003-12-069-68/+26
| | | | | | | | | | | | | and the mpo_create_cred() MAC policy entry point to mpo_copy_cred_label(). This is more consistent with similar entry points for creation and label copying, as mac_create_cred() was called from crdup() as opposed to during process creation. For a number of policies, this removes the requirement for special handling when copying credential labels, and improves consistency. Approved by: re (scottl) Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Use UMA zone allocator for Biba and MLS labels rather than MALLOC(9).rwatson2003-11-182-12/+12
| | | | | Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Introduce a MAC label reference in 'struct inpcb', which cachesrwatson2003-11-189-1/+362
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | the MAC label referenced from 'struct socket' in the IPv4 and IPv6-based protocols. This permits MAC labels to be checked during network delivery operations without dereferencing inp->inp_socket to get to so->so_label, which will eventually avoid our having to grab the socket lock during delivery at the network layer. This change introduces 'struct inpcb' as a labeled object to the MAC Framework, along with the normal circus of entry points: initialization, creation from socket, destruction, as well as a delivery access control check. For most policies, the inpcb label will simply be a cache of the socket label, so a new protocol switch method is introduced, pr_sosetlabel() to notify protocols that the socket layer label has been updated so that the cache can be updated while holding appropriate locks. Most protocols implement this using pru_sosetlabel_null(), but IPv4/IPv6 protocols using inpcbs use the the worker function in_pcbsosetlabel(), which calls into the MAC Framework to perform a cache update. Biba, LOMAC, and MLS implement these entry points, as do the stub policy, and test policy. Reviewed by: sam, bms Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
OpenPOWER on IntegriCloud