summaryrefslogtreecommitdiffstats
path: root/sys/security
Commit message (Collapse)AuthorAgeFilesLines
...
* Protect the event->class lookup database using an rwlock instead of arwatson2008-10-301-8/+15
| | | | | | | | mutex, as it's rarely changed but frequently accessed read-only from multiple threads, so a potentially significant source of contention. MFC after: 1 month Sponsored by: Apple, Inc.
* The V* flags passed using an accmode_t to the access() and open()rwatson2008-10-303-12/+26
| | | | | | | | access control checks in mac_bsdextended are not in the same namespace as the MBI_ flags used in ugidfw policies, so add an explicit conversion routine to get from one to the other. Obtained from: TrustedBSD Project
* Commit part of accmode_t changes that I missed in previous commit.trasz2008-10-281-1/+1
| | | | Approved by: rwatson (mentor)
* Break out strictly credential-related portions of mac_process.c into arwatson2008-10-282-141/+213
| | | | | | new file, mac_cred.c. Obtained from: TrustedBSD Project
* Introduce accmode_t. This is required for NFSv4 ACLs - it will be neccessarytrasz2008-10-2810-25/+37
| | | | | | | to add more V* constants, and the variables changed by this patch were often being assigned to mode_t variables, which is 16 bit. Approved by: rwatson (mentor)
* Rename mac_cred_mmapped_drop_perms(), which revokes access to virtualrwatson2008-10-284-20/+18
| | | | | | | | | | | memory mappings when the MAC label on a process changes, to mac_proc_vm_revoke(), It now also acquires its own credential reference directly from the affected process rather than accepting one passed by the the caller, simplifying the API and consumer code. Obtained from: TrustedBSD Project
* Rename three MAC entry points from _proc_ to _cred_ to reflect the factrwatson2008-10-289-201/+202
| | | | | | | that they operate directly on credentials: mac_proc_create_swapper(), mac_proc_create_init(), and mac_proc_associate_nfsd(). Update policies. Obtained from: TrustedBSD Project
* Extended comment on why we consider a partition relabel request of "0" torwatson2008-10-281-1/+7
| | | | | | | | be a no-op request, and why this might have to change if we want to allow leaving a partition someday. Obtained from: TrustedBSD Project MFC after: 3 days
* Rename label_on_label() to partition_check(), which is far morerwatson2008-10-281-7/+7
| | | | | | | suggestive as to its actual function. Obtained from: TrustedBSD Project MFC after: 3 days
* Improve alphabetical sort order of stub entry points.rwatson2008-10-281-32/+32
|
* When the mac_bsdextended policy is unloaded, free rule memory.rwatson2008-10-271-0/+5
| | | | | Obtained from: TrustedBSD Project MFC after: 3 days
* Add TrustedBSD credit to new ugidfw_internal.h file.rwatson2008-10-271-0/+2
|
* Break mac_bsdextended.c out into multiple .c files, with the base accessrwatson2008-10-274-1451/+149
| | | | | | | control logic and policy registration remaining in that file, and access control checks broken out into other files by class of check. Obtained from: TrustedBSD Project
* Copy mac_bsdextended.c to two object-specific files as a prototype for howrwatson2008-10-272-0/+1536
| | | | | | modularize MAC policy layout. Obtained from: TrustedBSD Project
* Implement MAC policy support for IPv6 fragment reassembly queues,rwatson2008-10-265-5/+275
| | | | | | modeled on IPv4 fragment reassembly queue support. Obtained from: TrustedBSD Project
* Add a MAC label, MAC Framework, and MAC policy entry points for IPv6rwatson2008-10-263-3/+129
| | | | | | | | | | | fragment reassembly queues. This allows policies to label reassembly queues, perform access control checks when matching fragments to a queue, update a queue label when fragments are matched, and label the resulting reassembled datagram. Obtained from: TrustedBSD Project
* Fix a number of style issues in the MALLOC / FREE commit. I've tried todes2008-10-231-1/+2
| | | | | be careful not to fix anything that was already broken; the NFSv4 code is particularly bad in this respect.
* Retire the MALLOC and FREE macros. They are an abomination unto style(9).des2008-10-232-4/+3
| | | | MFC after: 3 months
* Add a mac_inpcb_check_visible implementation to all MAC policiesbz2008-10-177-0/+111
| | | | | | | that handle mac_socket_check_visible. Reviewed by: rwatson MFC after: 3 months (set timer; decide then)
* Add mac_inpcb_check_visible MAC Framework entry point, which is similarbz2008-10-173-0/+16
| | | | | | | to mac_socket_check_visible but operates on the inpcb. Reviewed by: rwatson MFC after: 3 months (set timer, decide then)
* Use the label from the socket credential rather than thebz2008-10-171-1/+2
| | | | | | | | solabel which was not set by the mac_partition policy. Spotted by: rwatson Reviewed by: rwatson MFC after: 3 days
* Remove unit2minor() use from kernel code.ed2008-09-261-1/+1
| | | | | | | | | | | | | | | When I changed kern_conf.c three months ago I made device unit numbers equal to (unneeded) device minor numbers. We used to require bitshifting, because there were eight bits in the middle that were reserved for a device major number. Not very long after I turned dev2unit(), minor(), unit2minor() and minor2unit() into macro's. The unit2minor() and minor2unit() macro's were no-ops. We'd better not remove these four macro's from the kernel, because there is a lot of (external) code that may still depend on them. For now it's harmless to remove all invocations of unit2minor() and minor2unit(). Reviewed by: kib
* Remove the suser(9) interface from the kernel. It has been replaced fromattilio2008-09-171-8/+24
| | | | | | | | | | | | | | | | | years by the priv_check(9) interface and just very few places are left. Note that compatibility stub with older FreeBSD version (all above the 8 limit though) are left in order to reduce diffs against old versions. It is responsibility of the maintainers for any module, if they think it is the case, to axe out such cases. This patch breaks KPI so __FreeBSD_version will be bumped into a later commit. This patch needs to be credited 50-50 with rwatson@ as he found time to explain me how the priv_check() works in detail and to review patches. Tested by: Giovanni Trematerra <giovanni dot trematerra at gmail dot com> Reviewed by: rwatson
* Remove VSVTX, VSGID and VSUID. This should be a no-op,trasz2008-09-101-2/+3
| | | | | | as VSVTX == S_ISVTX, VSGID == S_ISGID and VSUID == S_ISUID. Approved by: rwatson (mentor)
* Unbreak the build.des2008-09-041-2/+2
| | | | Pointy hat to: kevlo
* If the process id specified is invalid, the system call returns ESRCHkevlo2008-09-041-10/+10
|
* Decontextualize the couplet VOP_GETATTR / VOP_SETATTR as the passed threadattilio2008-08-284-5/+4
| | | | | | was always curthread and totally unuseful. Tested by: Giovanni Trematerra <giovanni dot trematerra at gmail dot com>
* More fully audit fexecve(2) and its arguments.rwatson2008-08-251-0/+7
| | | | | Obtained from: TrustedBSD Project Sponsored by: Google, Inc.
* Use ERANGE instead of EOVERFLOW selected in r182059, this seems morerwatson2008-08-241-1/+1
| | | | | | | | | appropriate even if Solaris doesn't document it (E2BIG) or use it (EOVERFLOW). Submitted by: nectar at apple dot com Sponsored by: Apple, Inc. MFC after: 3 days
* Use sbuf_putc instead of sbuf_cat. This makes more sense, since we arecsjp2008-08-241-1/+1
| | | | | | appending a single character to the buffer. MFC after: 2 weeks
* Introduce two related changes to the TrustedBSD MAC Framework:rwatson2008-08-2327-161/+456
| | | | | | | | | | | | | | | | | | | | | | | | | (1) Abstract interpreter vnode labeling in execve(2) and mac_execve(2) so that the general exec code isn't aware of the details of allocating, copying, and freeing labels, rather, simply passes in a void pointer to start and stop functions that will be used by the framework. This change will be MFC'd. (2) Introduce a new flags field to the MAC_POLICY_SET(9) interface allowing policies to declare which types of objects require label allocation, initialization, and destruction, and define a set of flags covering various supported object types (MPC_OBJECT_PROC, MPC_OBJECT_VNODE, MPC_OBJECT_INPCB, ...). This change reduces the overhead of compiling the MAC Framework into the kernel if policies aren't loaded, or if policies require labels on only a small number or even no object types. Each time a policy is loaded or unloaded, we recalculate a mask of labeled object types across all policies present in the system. Eliminate MAC_ALWAYS_LABEL_MBUF option as it is no longer required. MFC after: 1 week ((1) only) Reviewed by: csjp Obtained from: TrustedBSD Project Sponsored by: Apple, Inc.
* When getaudit(2) is unable to fit the terminal IPv6 address into therwatson2008-08-231-1/+1
| | | | | | | | | | | space provided by its argument structure, return EOVERFLOW instead of E2BIG. The latter is documented in Solaris's man page, but the former is implemented. In either case, the caller should use getaudit_addr(2) to return the IPv6 address. Submitted by: sson Obtained from: Apple, Inc. MFC after: 3 days
* Make sure we check the preselection masks present for all audit pipes.csjp2008-08-111-1/+2
| | | | | | | | It is possible that the audit pipe(s) have different preselection configs then the global preselection mask. Spotted by: Vincenzo Iozzo MFC after: 2 weeks
* Add sbuf_new_auto as a shortcut for the very common case of creating ades2008-08-091-1/+1
| | | | | | | completely dynamic sbuf. Obtained from: Varnish MFC after: 2 weeks
* Minor style tweaks.rwatson2008-08-023-24/+15
|
* Rename mac_partition_enabled to partition_enabled to synchronize withrwatson2008-08-021-3/+3
| | | | | | | other policies that similarly now avoid the additional mac_ prefix on variables. MFC after: soon
* In mac_bsdextended's auditctl and acct policy access control checks,rwatson2008-07-311-11/+8
| | | | | | | | | | | | | | return success if the passed vnode pointer is NULL (rather than panicking). This can occur if either audit or accounting are disabled while the policy is running. Since the swapoff control has no real relevance to this policy, which is concerned about intent to write rather than water under the bridge, remove it. PR: kern/126100 Reported by: Alan Amesbury <amesbury at umn dot edu> MFC after: 3 days
* Currently, BSM audit pathname token generation for chrooted or jailedcsjp2008-07-311-55/+93
| | | | | | | | | | | | | | | | | | | | | | | | | processes are not producing absolute pathname tokens. It is required that audited pathnames are generated relative to the global root mount point. This modification changes our implementation of audit_canon_path(9) and introduces a new function: vn_fullpath_global(9) which performs a vnode -> pathname translation relative to the global mount point based on the contents of the name cache. Much like vn_fullpath, vn_fullpath_global is a wrapper function which called vn_fullpath1. Further, the string parsing routines have been converted to use the sbuf(9) framework. This change also removes the conditional acquisition of Giant, since the vn_fullpath1 method will not dip into file system dependent code. The vnode locking was modified to use vhold()/vdrop() instead the vref() and vrele(). This will modify the hold count instead of modifying the user count. This makes more sense since it's the kernel that requires the reference to the vnode. This also makes sure that the vnode does not get recycled we hold the reference to it. [1] Discussed with: rwatson Reviewed by: kib [1] MFC after: 2 weeks
* Further synchronization of copyrights, licenses, white space, etc fromrwatson2008-07-319-11/+10
| | | | | | | Apple and from the OpenBSM vendor tree. Obtained from: Apple Inc., TrustedBSD Project MFC after: 3 days
* Minor white space tweak.rwatson2008-07-231-1/+1
| | | | | Obtained from: Apple Inc. MFC after: 3 days
* If an AUE_SYSCTL_NONADMIN audit event is selected, generate a recordrwatson2008-07-221-0/+1
| | | | | | | with equivilent content to AUE_SYSCTL. Obtained from: Apple Inc. MFC after: 3 days
* Further minor style fixes to audit.rwatson2008-07-221-5/+10
| | | | | Obtained from: Apple Inc. MFC after: 3 days
* Remove unneeded \ at the end of a macro.rwatson2008-07-221-1/+1
| | | | | Obtained from: Apple Inc. MFC after: 3 days
* Further minor white space tweaks.rwatson2008-07-221-2/+2
| | | | | Obtained from: Apple Inc. MFC after: 3 days
* Generally avoid <space><tab> as a white space anomoly.rwatson2008-07-225-18/+18
| | | | | Obtained from: Apple Inc. MFC after: 3 days
* Use #define<tab> rather than #define<space>.rwatson2008-07-222-9/+9
| | | | | Obtained from: Apple Inc. MFC after: 3 days
* Comment fix.rwatson2008-07-221-1/+1
| | | | | Obtained from: Apple Inc. MFC after: 3 days
* Comment typo fix.rwatson2008-07-221-1/+1
| | | | | Obtained from: Apple Inc. MFC after: 3 days
* Minor white space synchronization to Apple version of security audit.rwatson2008-07-221-4/+4
| | | | | Obtained from: Apple Inc. MFC after: 3 days
* In preparation to sync Apple and FreeBSD versions of security audit,rwatson2008-07-229-18/+18
| | | | | | | | pick up the Apple Computer -> Apple change in their copyright and license templates. Obtained from: Apple Inc. MFC after: 3 days
OpenPOWER on IntegriCloud