summaryrefslogtreecommitdiffstats
path: root/sys/security
Commit message (Collapse)AuthorAgeFilesLines
* Remove the NDEVFSINO and NDEVFSOVERFLOW options which no longer exists inphk2006-07-173-3/+0
| | | | | | DEVFS. Remove the opt_devfs.h file now that it is empty.
* Implement mpo_associate_nfsd_label entry point for the BIBA security policy,csjp2006-07-101-0/+13
| | | | | | | | | | | | we will initialize the label to biba/low for files that have been created through an NFS RPC. This is a safe default given the default nature of our NFS implementation, there is not a whole lot of data integrity there by default. This also fixes kernel panics associated with file creation over NFS while creating files on filesystems which have multilabel enabled with BIBA enabled. MFC after: 2 weeks Discussed with: rwatson
* Audit the remaining parameters to the extattr system calls. Generatewsalamon2006-07-061-0/+59
| | | | | | | the audit records for those calls. Obtained from: TrustedBSD Project Approved by: rwatson (mentor)
* Correct a number of problems that were previously commented on:rwatson2006-07-032-49/+40
| | | | | | | | | | | | | | - Correct audit_arg_socketaddr() argument name from so to sa. - Assert arguments are non-NULL to many argument capture functions rather than testing them. This may trip some bugs. - Assert the process lock is held when auditing process information. - Test currecord in several more places. - Test validity of more arguments with kasserts, such as flag values when auditing vnode information. Perforce change: 98825 Obtained from: TrustedBSD Project
* Make the size of the subject32_ex and process32_ex tokens depend onwsalamon2006-06-171-13/+25
| | | | | | | | | whether we have an IPv6 address. Write the term ID as 4 or 16 bytes depending on address type. This change matches the recent OpenBSM change, and what Solaris does. Obtained from: TrustedBSD Project Approved by: rwatson (mentor)
* Lock process when copying fields from process structure so as torwatson2006-06-081-3/+2
| | | | | | | | get a consistent snapshot, as well as get consistent values (i.e., that p_comm is properly nul-terminated). Perforce CID: 98824 Obtained from: TrustedBSD Project
* Prefer C to C++ comments per style(9).rwatson2006-06-081-1/+1
| | | | | Perforce CID: 98826 Obtained from: TrustedBSD Project
* Extract pointer value for mnt_stat from vp after the NULL check, notrwatson2006-06-061-1/+2
| | | | | | | before. Coverity ID: 134394 Found with: Coverity Prevent (tm)
* Remove use of Giant around vn_open() in audit trail setup.rwatson2006-06-051-15/+10
| | | | | Submitted by: jhb, wsalamon Obtained from: TrustedBSD Project
* When generating BSM tokens for mkfifo(), include mode argument.rwatson2006-06-051-1/+6
| | | | | Submitted by: wsalamon Obtained from: TrustedBSD Project
* When generating the process token, need to check whether therwatson2006-06-052-15/+14
| | | | | | | | | process was sucessfully audited. Otherwise, generate the PID token. This change covers the pid < 0 cases, and pid lookup failure cases. Submitted by: wsalamon Obtained from: TrustedBSD Project
* Consistently use audit_free() to free records, rather thanrwatson2006-06-051-2/+2
| | | | | | | directly invoking uma_zfree(). Perforce change: 96652 Obtained from: TrustedBSD Project
* Introduce support for per-audit pipe preselection independent from therwatson2006-06-056-66/+519
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | global audit trail configuration. This allows applications consuming audit trails to specify parameters for which audit records are of interest, including selecting records not required by the global trail. Allowing application interest specification without changing the global configuration allows intrusion detection systems to run without interfering with global auditing or each other (if multiple are present). To implement this: - Kernel audit records now carry a flag to indicate whether they have been selected by the global trail or by the audit pipe subsystem, set during record commit, so that this information is available after BSM conversion when delivering the BSM to the trail and audit pipes in the audit worker thread asynchronously. Preselection by either record target will cause the record to be kept. - Similar changes to preselection when the audit record is created when the system call is entering: consult both the global trail and pipes. - au_preselect() now accepts the class in order to avoid repeatedly looking up the mask for each preselection test. - Define a series of ioctls that allow applications to specify whether they want to track the global trail, or program their own preselection parameters: they may specify their own flags and naflags masks, similar to the global masks of the same name, as well as a set of per-auid masks. They also set a per-pipe mode specifying whether they track the global trail, or user their own -- the door is left open for future additional modes. A new ioctl is defined to allow a user process to flush the current audit pipe queue, which can be used after reprogramming pre-selection to make sure that only records of interest are received in future reads. - Audit pipe data structures are extended to hold the additional fields necessary to support preselection. By default, audit pipes track the global trail, so "praudit /dev/auditpipe" will track the global audit trail even though praudit doesn't program the audit pipe selection model. - Comment about the complexities of potentially adding partial read support to audit pipes. By using a set of ioctls, applications can select which records are of interest, and toggle the preselection mode. Obtained from: TrustedBSD Project
* Shorten audit record zone name.rwatson2006-06-051-1/+1
| | | | | Perforce change: 93598 Obtained from: TrustedBSD Project
* No longer unconditionally drain the audit record queue if there isrwatson2006-06-051-35/+5
| | | | | | | not an active audit trail: instead, continue to iterate through each record in case an audit pipe is interested. Obtained from: TrustedBSD Project
* Pull BSM conversion logic out of audit_record_write(), as well asrwatson2006-06-051-84/+48
| | | | | | | | | | | | knowledge of user vs. kernel audit records into audit_worker_process_record(). This largely confines vnode knowledge to audit_record_write(), but avoids that logic knowing about BSM as opposed to byte streams. This will allow us to improve our ability to support real-time audit stream processing by audit pipe consumers while auditing is disabled, but this support is not yet complete. Obtained from: TrustedBSD Project
* Assert audit mtx in audit_worker_drain().rwatson2006-06-051-11/+30
| | | | | | | | | Break out logic to call audit_record_write() and handle error conditions into audit_worker_process_record(). This will be the future home of some logic now present in audit_record_write() also. Obtained from: TrustedBSD Project
* Use struct kaudit_queue instead of a hand-crafted queue type forrwatson2006-06-051-1/+1
| | | | | | audit records in the audit_worker thread. Obtained from: TrustedBSD Project
* Rename audit_cv to audit_worker_cv, as it wakes up the auditrwatson2006-06-053-16/+14
| | | | | | | | | | worker. Rename audit_commit_cv to audit_watermark_cv, since it is there to wake up threads waiting on hitting the low watermark. Describe properly in comment. Obtained from: TrustedBSD Project
* Merge OpenBSM 1.0 alpha 6 changes for BSM token creation torwatson2006-06-052-69/+35
| | | | | | | | | | | src/sys/security/audit: - Clarify and clean up AUR_ types to match Solaris. - Clean up use of host vs. network byte order for IP addresses. - Remove combined user/kernel implementations of some token creation calls, such as au_to_file(), header calls, etc. Obtained from: TrustedBSD Project
* Check to see if the rootdir is the same as the current working directory.csjp2006-06-011-3/+11
| | | | | | | If it is, and the pathname was relative, do not separate the componenets with a '/' character. Obtained from: TrustedBSD Project
* Reconstitute struct mac_policy_ops by breaking out individual functionrwatson2006-04-261-296/+575
| | | | | | | | | | pointer prototypes from it into their own typedefs. No functional or ABI change. This allows policies to declare their own function prototypes based on a common definition from mac_policy.h rather than duplicating these definitions. Obtained from: SEDarwin, SPARTA MFC after: 1 month
* Add some new options to mac_bsdestended. We can now match on:dwmalone2006-04-232-35/+210
| | | | | | | | | | | | | | | | | | | | | | | subject: ranges of uid, ranges of gid, jail id objects: ranges of uid, ranges of gid, filesystem, object is suid, object is sgid, object matches subject uid/gid object type We can also negate individual conditions. The ruleset language is a superset of the previous language, so old rules should continue to work. These changes require a change to the API between libugidfw and the mac_bsdextended module. Add a version number, so we can tell if we're running mismatched versions. Update man pages to reflect changes, add extra test cases to test_ugidfw.c and add a shell script that checks that the the module seems to do what we expect. Suggestions from: rwatson, trhodes Reviewed by: trhodes MFC after: 2 months
* Introduce a new MAC entry point for label initialization of the NFS daemon'scsjp2006-04-063-0/+9
| | | | | | | | | | | | | | | credential: mac_associate_nfsd_label() This entry point can be utilized by various Mandatory Access Control policies so they can properly initialize the label of files which get created as a result of an NFS operation. This work will be useful for fixing kernel panics associated with accessing un-initialized or invalid vnode labels. The implementation of these entry points will come shortly. Obtained from: TrustedBSD Requested by: mdodd MFC after: 3 weeks
* Don't call vn_finished_write() if vn_start_write() failed.tegge2006-03-192-8/+12
|
* Merge Perforce change 93581 from TrustedBSD audit3 branch:rwatson2006-03-199-526/+541
| | | | | | Mega-style patch. Obtained from: TrustedBSD Project
* Merge Perforce changes 93512, 93514, 93515 from TrustedBSD audit3rwatson2006-03-193-495/+616
| | | | | | | | | | | | | | | | | | | | | | | | | | branch: Integrate audit.c to audit_worker.c, so as to migrate the worker thread implementation to its own .c file. Populate audit_worker.c using parts now removed from audit.c: - Move audit rotation global variables. - Move audit_record_write(), audit_worker_rotate(), audit_worker_drain(), audit_worker(), audit_rotate_vnode(). - Create audit_worker_init() from relevant parts of audit_init(), which now calls this routine. - Recreate audit_free(), which wraps uma_zfree() so that audit_record_zone can be static to audit.c. - Unstaticize various types and variables relating to the audit record queue so that audit_worker can get to them. We may want to wrap these in accessor methods at some point. - Move AUDIT_PRINTF() to audit_private.h. Addition of audit_worker.c to kernel configuration, missed in earlier submit. Obtained from: TrustedBSD Project
* Merge Perforce change 93570 from TrustedBSD audit3 branch:rwatson2006-03-191-0/+10
| | | | | | | Add audit pipe ioctls to query minimum and maximum audit queue lengths. Obtained from: TrustedBSD Project
* Merge Perforce change 93567 from TrustedBSD audit3 branch:rwatson2006-03-191-1/+1
| | | | | | | Bump default queue limit for audit pipes from 32 to 128, since 32 is pretty small. Obtained from: TrustedBSD Project
* Merge Perforce change 93568 from TrustedBSD audit3 branch:rwatson2006-03-192-6/+6
| | | | | | Normalize nested include guards. Obtained from: TrustedBSD Project
* Merge Perforce change 93506 from TrustedBSD audit3 branch:rwatson2006-03-192-2/+98
| | | | | | | | Add ioctls to audit pipes in order to allow querying of the current record queue state, setting of the queue limit, and querying of pipe statistics. Obtained from: TrustedBSD Project
* Merge perforce 93507:rwatson2006-03-181-2/+2
| | | | | | | Correct comment: this print is now from audit_record_write(), not audit_worker(). Obtained from: TrustedBSD Project
* Merge perforce change 93199:rwatson2006-03-184-7/+8
| | | | | | | | | | Change send_trigger() prototype to return an int, so that user space callers can tell if the message was successfully placed in the trigger queue. This isn't quite the same as it being successfully received, but is close enough that we can generate a more useful warning message in audit(8). Obtained from: TrustedBSD Project
* Create a mac_bsdextended_check_vp function that takes a cred, adwmalone2006-03-041-280/+43
| | | | | | | | | | | | | vnode and a mode and checks if a given access mode is permitted. This centralises the mac_bsdextended_enabled check and the GETATTR calls and makes the implementation of the mac policy methods simple. This should make it easier for us to match vnodes on more complex attributes than just uid and gid in the future, but for now there should be no functional change. Approved/Reviewed by: rwatson, trhodes MFC after: 1 month
* Count drops when the first of two pipe mallocs fails.rwatson2006-03-041-0/+1
| | | | Obtained from: TrustedBSD Project
* Update src/sys/security/audit for OpenBSM 1.0 alpha 5:rwatson2006-03-043-15/+6
| | | | | | | | | | | | | | | | | - Include audit_internal.h to get definition of internal audit record structures, as it's no longer in audit.h. Forward declare au_record in audit_private.h as not all audit_private.h consumers care about it. - Remove __APPLE__ compatibility bits that are subsumed by configure for user space. - Don't expose in6_addr internals (non-portable, but also cleaner looking). - Avoid nested include of audit.h in audit_private.h. Obtained from: TrustedBSD Project
* Eliminate a deadlock when creating snapshots. Blocking vn_start_write() musttegge2006-03-021-0/+3
| | | | | | be called without any vnode locks held. Remove calls to vn_start_write() and vn_finished_write() in vnode_pager_putpages() and add these calls before the vnode lock is obtained to most of the callers that don't already have them.
* Add stub AUE_EACCESS entry.rwatson2006-02-111-0/+1
| | | | Obtained from: TrustedBSD Project
* Initialize user process audit ID to AU_DEFAUDITID so that init andrwatson2006-02-111-0/+1
| | | | | | its pre-authentication children are covered by naflags. Obtained from: TrustedBSD Project
* Acquire vnode lock around call to VOP_GETATTR() in audit_record_write().rwatson2006-02-071-0/+2
| | | | | | | | In the future, we may want to acquire the lock early in the function and hold it across calls to vn_rdwr(), etc, to avoid multiple acquires. Spotted by: kris (bugmagnet) Obtained from: TrustedBSD Project
* Fix queue drop logic when the queue overflows: decrement queue length.rwatson2006-02-071-0/+1
| | | | Obtained from: TrustedBSD Project
* Add support for audit pipe special devices, which allow user spacerwatson2006-02-063-0/+550
| | | | | | | | | | | | | applications to insert a "tee" in the live audit event stream. Records are inserted into a per-clone queue so that user processes can pull discreet records out of the queue. Unlike delivery to disk, audit pipes are "lossy", dropping records in low memory conditions or when the process falls behind real-time events. This mechanism is appropriate for use by live monitoring systems, host-based intrusion detection, etc, and avoids applications having to dig through active on-disk trails that are owned by the audit daemon. Obtained from: TrustedBSD Project
* Manage audit record memory with the slab allocator, turningrwatson2006-02-061-100/+85
| | | | | | | | | | | | | initialization routines into a ctor, tear-down to a dtor, cleaning up, etc. This will allow audit records to be allocated from per-cpu caches. On recent FreeBSD, dropping the audit_mtx around freeing to UMA is no longer required (at one point it was possible to acquire Giant on that path), so a mutex-free thread-local drain is no longer required. Obtained from: TrustedBSD Project
* When GC'ing a thread, assert that it has no active audit record.rwatson2006-02-052-0/+11
| | | | | | | | This should not happen, but with this assert, brueffer and I would not have spent 45 minutes trying to figure out why he wasn't seeing audit records with the audit version in CVS. Obtained from: TrustedBSD Project
* Cast pointers to (uintptr_t) before down-casting to (int). This avoidsrwatson2006-02-041-7/+8
| | | | | | | | | | an incompatible conversion from a 64-bit pointer to a 32-bit integer on 64-bit platforms. We will investigate whether Solaris uses a 64-bit token here, or a new record here, in order to avoid truncating user pointers that are 64-bit. However, in the mean time, truncation is fine as these are rarely/never used fields in audit records. Obtained from: TrustedBSD Project
* Fix INVARIANTS build on amd64; (unsigned unsigned long) != u_int64_t.rwatson2006-02-031-2/+2
| | | | Submitted by: mlaier
* Remove user.h include in audit.h, it is unneeded, and also can causerwatson2006-02-031-1/+0
| | | | build problems for other components that include audit.h.
* Add new fields to process-related data structures:rwatson2006-02-022-0/+11
| | | | | | | | | | | | | | | | - td_ar to struct thread, which holds the in-progress audit record during a system call. - p_au to struct proc, which holds per-process audit state, such as the audit identifier, audit terminal, and process audit masks. In the earlier implementation, td_ar was added to the zero'd section of struct thread. In order to facilitate merging to RELENG_6, it has been moved to the end of the data structure, requiring explicit initalization in the thread constructor. Much help from: wsalamon Obtained from: TrustedBSD Project
* Import kernel audit framework:rwatson2006-02-019-0/+6228
| | | | | | | | | | | | | | | - Management of audit state on processes. - Audit system calls to configure process and system audit state. - Reliable audit record queue implementation, audit_worker kernel thread to asynchronously store records on disk. - Audit event argument. - Internal audit data structure -> BSM audit trail conversion library. - Audit event pre-selection. - Audit pseudo-device permitting kernel->user upcalls to notify auditd of kernel audit events. Much work by: wsalamon Obtained from: TrustedBSD Project, Apple Computer, Inc.
* Fix potential overrun of static stack allocated array which storescsjp2006-01-151-1/+1
| | | | | | | | the rules. If an array is N elements large, we can only access elements 0..(N-1). MFC after: 1 week Found with: Coverity Prevent(tm)
OpenPOWER on IntegriCloud