summaryrefslogtreecommitdiffstats
path: root/sys/security
Commit message (Collapse)AuthorAgeFilesLines
* Rework the lifetime management of the kernel implementation of POSIXjhb2008-06-277-42/+136
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | semaphores. Specifically, semaphores are now represented as new file descriptor type that is set to close on exec. This removes the need for all of the manual process reference counting (and fork, exec, and exit event handlers) as the normal file descriptor operations handle all of that for us nicely. It is also suggested as one possible implementation in the spec and at least one other OS (OS X) uses this approach. Some bugs that were fixed as a result include: - References to a named semaphore whose name is removed still work after the sem_unlink() operation. Prior to this patch, if a semaphore's name was removed, valid handles from sem_open() would get EINVAL errors from sem_getvalue(), sem_post(), etc. This fixes that. - Unnamed semaphores created with sem_init() were not cleaned up when a process exited or exec'd. They were only cleaned up if the process did an explicit sem_destroy(). This could result in a leak of semaphore objects that could never be cleaned up. - On the other hand, if another process guessed the id (kernel pointer to 'struct ksem' of an unnamed semaphore (created via sem_init)) and had write access to the semaphore based on UID/GID checks, then that other process could manipulate the semaphore via sem_destroy(), sem_post(), sem_wait(), etc. - As part of the permission check (UID/GID), the umask of the proces creating the semaphore was not honored. Thus if your umask denied group read/write access but the explicit mode in the sem_init() call allowed it, the semaphore would be readable/writable by other users in the same group, for example. This includes access via the previous bug. - If the module refused to unload because there were active semaphores, then it might have deregistered one or more of the semaphore system calls before it noticed that there was a problem. I'm not sure if this actually happened as the order that modules are discovered by the kernel linker depends on how the actual .ko file is linked. One can make the order deterministic by using a single module with a mod_event handler that explicitly registers syscalls (and deregisters during unload after any checks). This also fixes a race where even if the sem_module unloaded first it would have destroyed locks that the syscalls might be trying to access if they are still executing when they are unloaded. XXX: By the way, deregistering system calls doesn't do any blocking to drain any threads from the calls. - Some minor fixes to errno values on error. For example, sem_init() isn't documented to return ENFILE or EMFILE if we run out of semaphores the way that sem_open() can. Instead, it should return ENOSPC in that case. Other changes: - Kernel semaphores now use a hash table to manage the namespace of named semaphores nearly in a similar fashion to the POSIX shared memory object file descriptors. Kernel semaphores can now also have names longer than 14 chars (up to MAXPATHLEN) and can include subdirectories in their pathname. - The UID/GID permission checks for access to a named semaphore are now done via vaccess() rather than a home-rolled set of checks. - Now that kernel semaphores have an associated file object, the various MAC checks for POSIX semaphores accept both a file credential and an active credential. There is also a new posixsem_check_stat() since it is possible to fstat() a semaphore file descriptor. - A small set of regression tests (using the ksem API directly) is present in src/tools/regression/posixsem. Reported by: kris (1) Tested by: kris Reviewed by: rwatson (lightly) MFC after: 1 month
* Add missing counter increments for posix shm checks.jhb2008-06-261-0/+5
|
* Remove the posixsem_check_destroy() MAC check. It is semantically identicaljhb2008-06-237-39/+0
| | | | | | | to doing a MAC check for close(), but no other types of close() (including close(2) and ksem_close(2)) have MAC checks. Discussed with: rwatson
* The TrustedBSD MAC Framework named struct ipq instances 'ipq', which is therwatson2008-06-138-74/+73
| | | | | | | | | | | same as the global variable defined in ip_input.c. Instead, adopt the name 'q' as found in about 1/2 of uses in ip_input.c, preventing a collision on the name. This is non-harmful, but means that search and replace on the global works less well (as in the virtualization work), as well as indexing tools. MFC after: 1 week Reported by: julian
* Don't enforce unique device minor number policy anymore.ed2008-06-111-1/+1
| | | | | | | | | | | | | | | | | | | | | | | Except for the case where we use the cloner library (clone_create() and friends), there is no reason to enforce a unique device minor number policy. There are various drivers in the source tree that allocate unr pools and such to provide minor numbers, without using them themselves. Because we still need to support unique device minor numbers for the cloner library, introduce a new flag called D_NEEDMINOR. All cdevsw's that are used in combination with the cloner library should be marked with this flag to make the cloning work. This means drivers can now freely use si_drv0 to store their own flags and state, making it effectively the same as si_drv1 and si_drv2. We still keep the minor() and dev2unit() routines around to make drivers happy. The NTFS code also used the minor number in its hash table. We should not do this anymore. If the si_drv0 field would be changed, it would no longer end up in the same list. Approved by: philip (mentor)
* When the file-system containing the audit log file is running low onsimon2008-06-101-1/+3
| | | | | | | disk space a warning is printed. Make this warning a bit more informative. Approved by: rwatson
* Add an XXX comment regarding a bug I introduced when modifying the behaviorrwatson2008-06-031-0/+3
| | | | | of audit log vnode rotation: on shutdown, we may not properly drain all pending records, which could lead to lost records during system shutdown.
* Plug a memory leak which can occur when multiple MAC policies are loadedcsjp2008-05-271-0/+4
| | | | | | | | which label mbufs. This leak can occur if one policy successfully allocates label storage and subsequent allocations from other policies fail. Spotted by: rwatson MFC after: 1 week
* Don't use LK_DRAIN before calling VOP_FSYNC() in the two furtherrwatson2008-05-211-2/+2
| | | | | | | | panic cases for audit trail failure -- this doesn't contribute anything, and might arguably be wrong. MFC after: 1 week Requested by: attilio
* Don't use LK_DRAIN before calling VOP_FSYNC() in the panic case forrwatson2008-05-211-1/+1
| | | | | | | | audit trail failure -- this doesn't contribute anything, and might arguably be wrong. MFC after: 1 week Requested by: attilio
* When testing whether to enter the audit argument gathering code, ratherrwatson2008-05-061-1/+1
| | | | | | | | | | than checking whether audit is enabled globally, instead check whether the current thread has an audit record. This avoids entering the audit code to collect argument data if auditing is enabled but the current system call is not of interest to audit. MFC after: 1 week Sponsored by: Apple, Inc.
* Fix include guard spelling.rwatson2008-04-271-1/+1
| | | | | MFC after: 3 days Submitted by: diego
* Use logic or, not binary or, when deciding whether or not a system callrwatson2008-04-241-1/+1
| | | | | | | | exit requires entering the audit code. The result is much the same, but they mean different things. MFC afer: 3 days Submitted by: Diego Giagio <dgiagio at gmail dot com>
* When auditing state from an IPv4 or IPv6 socket, use read locks on therwatson2008-04-191-2/+2
| | | | | | inpcb rather than write locks. MFC after: 3 months
* When propagating a MAC label from an inpcb to an mbuf, allow read andrwatson2008-04-191-1/+1
| | | | | | write locks on the inpcb, not just write locks. MFC after: 3 months
* Convert pcbinfo and inpcb mutexes to rwlocks, and modify macros torwatson2008-04-172-5/+5
| | | | | | | | | | | | | | | explicitly select write locking for all use of the inpcb mutex. Update some pcbinfo lock assertions to assert locked rather than write-locked, although in practice almost all uses of the pcbinfo rwlock main exclusive, and all instances of inpcb lock acquisition are exclusive. This change should introduce (ideally) little functional change. However, it lays the groundwork for significantly increased parallelism in the TCP/IP code. MFC after: 3 months Tested by: kris (superset of committered patch)
* Use __FBSDID() for $FreeBSD$ IDs in the audit code.rwatson2008-04-139-18/+27
| | | | MFC after: 3 days
* Make naming of include guards for MAC Framework include files morerwatson2008-04-133-9/+9
| | | | | | consistent with other kernel include guards (don't start with _SYS). MFC after: 3 days
* Add the support for the AT_FDCWD and fd-relative name lookups to thekib2008-03-311-0/+1
| | | | | | | | | namei(9). Based on the submission by rdivacky, sponsored by Google Summer of Code 2007 Reviewed by: rwatson, rdivacky Tested by: pho
* In keeping with style(9)'s recommendations on macros, use a ';'rwatson2008-03-161-1/+1
| | | | | | | | | after each SYSINIT() macro invocation. This makes a number of lightweight C parsers much happier with the FreeBSD kernel source, including cflow's prcc and lxr. MFC after: 1 month Discussed with: imp, rink
* Remove XXX to remind me to check the free space calculation, which to myrwatson2008-03-101-3/+0
| | | | | | eyes appears right following a check. MFC after: 3 days
* Change auditon(2) so that if somebody supplies an invalid command, itcsjp2008-03-061-0/+3
| | | | | | | | returns EINVAL. Right now we return 0 or success for invalid commands, which could be quite problematic in certain conditions. MFC after: 1 week Discussed with: rwatson
* Rather than copying out the full audit trigger record, which includesrwatson2008-03-021-1/+1
| | | | | | | | a queue entry field, just copy out the unsigned int that is the trigger message. In practice, auditd always requested sizeof(unsigned int), so the extra bytes were ignored, but copying them out was not the intent. MFC after: 1 month
* Add audit_prefixes to two more globally visible functions in the Auditrwatson2008-03-013-7/+7
| | | | | | implementation. MFC after: 1 month
* Rename globally exposed symbol send_trigger() to audit_send_trigger().rwatson2008-03-014-6/+7
| | | | MFC after: 1 month
* Replace somewhat awkward audit trail rotation scheme, which involved therwatson2008-02-271-156/+91
| | | | | | | | | | | global audit mutex and condition variables, with an sx lock which protects the trail vnode and credential while in use, and is acquired by the system call code when rotating the trail. Previously, a "message" would be sent to the kernel audit worker, which did the rotation, but the new code is simpler and (hopefully) less error-prone. Obtained from: TrustedBSD Project MFC after: 1 month
* Rename several audit functions in the global kernel symbol namespace torwatson2008-02-255-11/+11
| | | | | | | | | | have audit_ on the front: - canon_path -> audit_canon_path - msgctl_to_event -> audit_msgctl_to_event - semctl_to_event -> audit_semctl_to_event MFC after: 1 month
* Make sure that the termid type is initialized to AU_IPv4 by default.csjp2008-01-281-0/+2
| | | | | | | | | | | | | | This makes sure that process tokens credentials with un-initialized audit contexts are handled correctly. Currently, when invariants are enabled, this change fixes a panic by ensuring that we have a valid termid family. Also, this fixes token generation for process tokens making sure that userspace is always getting a valid token. This is consistent with what Solaris does when an audit context is un-initialized. Obtained from: TrustedBSD Project MFC after: 1 week
* Properly return the error from mls_subject_privileged() in the ifnetrwatson2008-01-281-3/+1
| | | | | | | | | | | | | | | relabel check for MLS rather than returning 0 directly. This problem didn't result in a vulnerability currently as the central implementation of ifnet relabeling also checks for UNIX privilege, and we currently don't guarantee containment for the root user in mac_mls, but we should be using the MLS definition of privilege as well as the UNIX definition in anticipation of supporting root containment at some point. MFC after: 3 days Submitted by: Zhouyi Zhou <zhouzhouyi at gmail dot com> Sponsored by: Google SoC 2007
* Fix gratuitous whitespace bugcsjp2008-01-181-1/+2
| | | | | MFC after: 1 week Obtained from: TrustedBSD Project
* Add a case for AUE_LISTEN. This removes the following console error message:csjp2008-01-181-0/+1
| | | | | | | | | | "BSM conversion requested for unknown event 43140" It should be noted that we need to audit the fd argument for this system call. Obtained from: TrustedBSD Project MFC after: 1 week
* VOP_LOCK1() (and so VOP_LOCK()) and VOP_UNLOCK() are only used inattilio2008-01-135-15/+15
| | | | | | | | | | | conjuction with 'thread' argument passing which is always curthread. Remove the unuseful extra-argument and pass explicitly curthread to lower layer functions, when necessary. KPI results broken by this change, which should affect several ports, so version bumping and manpage update will be further committed. Tested by: kris, pho, Diego Sardina <siarodx at gmail dot com>
* vn_lock() is currently only used with the 'curthread' passed as argument.attilio2008-01-105-8/+8
| | | | | | | | | | | | | | | | Remove this argument and pass curthread directly to underlying VOP_LOCK1() VFS method. This modify makes the code cleaner and in particular remove an annoying dependence helping next lockmgr() cleanup. KPI results, obviously, changed. Manpage and FreeBSD_version will be updated through further commits. As a side note, would be valuable to say that next commits will address a similar cleanup about VFS methods, in particular vop_lock1 and vop_unlock. Tested by: Diego Sardina <siarodx at gmail dot com>, Andrea Di Pasquale <whyx dot it at gmail dot com>
* Add a new file descriptor type for IPC shared memory objects and use it tojhb2008-01-085-0/+339
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | implement shm_open(2) and shm_unlink(2) in the kernel: - Each shared memory file descriptor is associated with a swap-backed vm object which provides the backing store. Each descriptor starts off with a size of zero, but the size can be altered via ftruncate(2). The shared memory file descriptors also support fstat(2). read(2), write(2), ioctl(2), select(2), poll(2), and kevent(2) are not supported on shared memory file descriptors. - shm_open(2) and shm_unlink(2) are now implemented as system calls that manage shared memory file descriptors. The virtual namespace that maps pathnames to shared memory file descriptors is implemented as a hash table where the hash key is generated via the 32-bit Fowler/Noll/Vo hash of the pathname. - As an extension, the constant 'SHM_ANON' may be specified in place of the path argument to shm_open(2). In this case, an unnamed shared memory file descriptor will be created similar to the IPC_PRIVATE key for shmget(2). Note that the shared memory object can still be shared among processes by sharing the file descriptor via fork(2) or sendmsg(2), but it is unnamed. This effectively serves to implement the getmemfd() idea bandied about the lists several times over the years. - The backing store for shared memory file descriptors are garbage collected when they are not referenced by any open file descriptors or the shm_open(2) virtual namespace. Submitted by: dillon, peter (previous versions) Submitted by: rwatson (I based this on his version) Reviewed by: alc (suggested converting getmemfd() to shm_open())
* Add a new 'why' argument to kdb_enter(), and a set of constants to userwatson2007-12-251-1/+1
| | | | | | | | | for that argument. This will allow DDB to detect the broad category of reason why the debugger has been entered, which it can use for the purposes of deciding which DDB script to run. Assign approximate why values to all current consumers of the kdb_enter() interface.
* Change "audit_pipe_preselect" to "audit_pipe_presel" to make it printwkoszek2007-12-251-1/+1
| | | | | | with proper alignment in ddb(4) and vmstat(8). Reviewed by: rwatson@
* Fix a MAC label leak for POSIX semaphores, in which per-policy labelsrwatson2007-12-171-0/+1
| | | | | | | | | would be properly disposed of, but the global label structure for the semaphore wouldn't be freed. MFC after: 3 days Reported by: tanyong <tanyong at ercist dot iscas dot ac dot cn>, zhouzhouyi
* Explicitly initialize 'ret' to 0'. It lets one to build tmpfs from thewkoszek2007-12-041-0/+2
| | | | | | latest source tree with older compiler--gcc3. Approved by: cognet (mentor)
* Implement per-object type consistency checks for labels passed torwatson2007-10-301-20/+65
| | | | | | 'internalize' operations rather than using a single common check. Obtained from: TrustedBSD Project
* Replace use of AU_NULL with 0 when no audit classes are in use; thisrwatson2007-10-292-4/+4
| | | | | | | | supports the removal of hard-coded audit class constants in OpenBSM 1.0. All audit classes are now dynamically configured via the audit_class database. Obtained from: TrustedBSD Project
* Canonicalize names of local variables.rwatson2007-10-291-66/+66
| | | | | | Add some missing label checks in mac_test. Obtained from: TrustedBSD Project
* Resort TrustedBSD MAC Framework policy entry point implementations andrwatson2007-10-299-4684/+4744
| | | | | | | declarations to match the object, operation sort order in the framework itself. Obtained from: TrustedBSD Project
* Add missing mac_test labeling and sleep checks for the syncache.rwatson2007-10-281-0/+48
| | | | | Discussed with: csjp Obtained from: TrustedBSD Project
* Garbage collect mac_mbuf_create_multicast_encap TrustedBSD MAC Frameworkrwatson2007-10-288-87/+0
| | | | | | | | entry point, which is no longer required now that we don't support old-style multicast tunnels. This removes the last mbuf object class entry point that isn't init/copy/destroy. Obtained from: TrustedBSD Project
* Continue to move from generic network entry points in the TrustedBSD MACrwatson2007-10-289-86/+155
| | | | | | | | | | | | | | Framework by moving from mac_mbuf_create_netlayer() to more specific entry points for specific network services: - mac_netinet_firewall_reply() to be used when replying to in-bound TCP segments in pf and ipfw (etc). - Rename mac_netinet_icmp_reply() to mac_netinet_icmp_replyinplace() and add mac_netinet_icmp_reply(), reflecting that in some cases we overwrite a label in place, but in others we apply the label to a new mbuf. Obtained from: TrustedBSD Project
* Move towards more explicit support for various network protocol stacksrwatson2007-10-2812-82/+414
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | in the TrustedBSD MAC Framework: - Add mac_atalk.c and add explicit entry point mac_netatalk_aarp_send() for AARP packet labeling, rather than using a generic link layer entry point. - Add mac_inet6.c and add explicit entry point mac_netinet6_nd6_send() for ND6 packet labeling, rather than using a generic link layer entry point. - Add expliict entry point mac_netinet_arp_send() for ARP packet labeling, and mac_netinet_igmp_send() for IGMP packet labeling, rather than using a generic link layer entry point. - Remove previous genering link layer entry point, mac_mbuf_create_linklayer() as it is no longer used. - Add implementations of new entry points to various policies, largely by replicating the existing link layer entry point for them; remove old link layer entry point implementation. - Make MAC_IFNET_LOCK(), MAC_IFNET_UNLOCK(), and mac_ifnet_mtx global to the MAC Framework rather than static to mac_net.c as it is now needed outside of mac_net.c. Obtained from: TrustedBSD Project
* Perform explicit label type checks for externalize entry points, rather thanrwatson2007-10-281-10/+70
| | | | | | a generic initialized test. Obtained from: TrustedBSD Project
* Make sure we are incrementing the read count for each audit pipe read.csjp2007-10-271-0/+1
| | | | MFC after: 1 week
* Give each posixsem MAC Framework entry point its own counter and test caserwatson2007-10-271-9/+74
| | | | | | | in the mac_test policy, rather than sharing a single function for all of the access control checks. Obtained from: TrustedBSD Project
* Update comment following MAC Framework entry point renaming andrwatson2007-10-261-1/+6
| | | | | | reorganization. Obtained from: TrustedBSD Project
OpenPOWER on IntegriCloud