summaryrefslogtreecommitdiffstats
path: root/sys/security
Commit message (Collapse)AuthorAgeFilesLines
* In the MAC Framework implementation, file systems have two per-mountpointrwatson2007-04-227-115/+54
| | | | | | | | | | | | | labels: the mount label (label of the mountpoint) and the fs label (label of the file system). In practice, policies appear to only ever use one, and the distinction is not helpful. Combine mnt_mntlabel and mnt_fslabel into a single mnt_label, and eliminate extra machinery required to maintain the additional label. Update policies to reflect removal of extra entry points and label. Obtained from: TrustedBSD Project Sponsored by: SPARTA, Inc.
* Remove MAC Framework access control check entry points made redundant withrwatson2007-04-227-183/+387
| | | | | | | | | | | | | | | | | | the introduction of priv(9) and MAC Framework entry points for privilege checking/granting. These entry points exactly aligned with privileges and provided no additional security context: - mac_check_sysarch_ioperm() - mac_check_kld_unload() - mac_check_settime() - mac_check_system_nfsd() Add mpo_priv_check() implementations to Biba and LOMAC policies, which, for each privilege, determine if they can be granted to processes considered unprivileged by those two policies. These mostly, but not entirely, align with the set of privileges granted in jails. Obtained from: TrustedBSD Project
* Further MAC test policy cleanup and enhancement:rwatson2007-04-221-141/+478
| | | | | | | | | | | | | | | | | | | | | - Redistribute counter declarations to where they are used, rather than at the file header, so it's more clear where we do (and don't) have counters. - Add many more counters, one per policy entry point, so that many individual access controls and object life cycle events are tracked. - Perform counter increments for label destruction explicitly in entry point functions rather than in LABEL_DESTROY(). - Use LABEL_INIT() instead of SLOT_SET() directly in label init functions to be symmetric with destruction. - Align counter names more carefully with entry point names. - More constant and variable name normalization. Obtained from: TrustedBSD Project
* Perform overdue clean up mac_test policy:rwatson2007-04-221-719/+476
| | | | | | | | | | | | | | | | | | | | | | | | | - Add a more detailed comment describing the mac_test policy. - Add COUNTER_DECL() and COUNTER_INC() macros to declare and manage various test counters, reducing the verbosity of the test policy quite a bit. - Add LABEL_CHECK() macro to abbreviate normal validation of labels. Unlike the previous check macros, this checks for a NULL label and doesn't test NULL labels. This means that optionally passed labels will now be handled automatically, although in the case of optional credentials, NULL-checks are still required. - Add LABEL_DESTROY() macro to abbreviate the handling of label validation and tear-down. - Add LABEL_NOTFREE() macro to abbreviate check for non-free labels. - Normalize the names of counters, magic values. - Remove unused policy "enabled" flag. Obtained from: TrustedBSD Project
* Allow MAC policy modules to control access to audit configuration systemrwatson2007-04-2110-8/+446
| | | | | | | | | | | | | | | | calls. Add MAC Framework entry points and MAC policy entry points for audit(), auditctl(), auditon(), setaudit(), aud setauid(). MAC Framework entry points are only added for audit system calls where additional argument context may be useful for policy decision-making; other audit system calls without arguments may be controlled via the priv(9) entry points. Update various policy modules to implement audit-related checks, and in some cases, other missing system-related checks. Obtained from: TrustedBSD Project Sponsored by: SPARTA, Inc.
* Remove $P4$ that snuck into CVS from Perforce.rwatson2007-04-171-1/+0
|
* Merge OpenBSM 1.0 alpha 14 changes to src/sys/security/audit:rwatson2007-04-161-13/+184
| | | | | | | | - au_to_attr64(), au_to_process64(), au_to_subject64(), au_to_subject64_ex(), au_to_zonename(), au_to_header64_tm(). - Extended address token fixes. Obtained from: TrustedBSD Project
* Fix the handling of IPv6 addresses for subject and process BSM auditcsjp2007-04-137-33/+104
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | tokens. Currently, we do not support the set{get}audit_addr(2) system calls which allows processes like sshd to set extended or ip6 information for subject tokens. The approach that was taken was to change the process audit state slightly to use an extended terminal ID in the kernel. This allows us to store both IPv4 IPv6 addresses. In the case that an IPv4 address is in use, we convert the terminal ID from an struct auditinfo_addr to a struct auditinfo. If getaudit(2) is called when the subject is bound to an ip6 address, we return E2BIG. - Change the internal audit record to store an extended terminal ID - Introduce ARG_TERMID_ADDR - Change the kaudit <-> BSM conversion process so that we are using the appropriate subject token. If the address associated with the subject is IPv4, we use the standard subject32 token. If the subject has an IPv6 address associated with them, we use an extended subject32 token. - Fix a couple of endian issues where we do a couple of byte swaps when we shouldn't be. IP addresses are already in the correct byte order, so reading the ip6 address 4 bytes at a time and swapping them results in in-correct address data. It should be noted that the same issue was found in the openbsm library and it has been changed there too on the vendor branch - Change A_GETPINFO to use the appropriate structures - Implement A_GETPINFO_ADDR which basically does what A_GETPINFO does, but can also handle ip6 addresses - Adjust get{set}audit(2) syscalls to convert the data auditinfo <-> auditinfo_addr - Fully implement set{get}audit_addr(2) NOTE: This adds the ability for processes to correctly set extended subject information. The appropriate userspace utilities still need to be updated. MFC after: 1 month Reviewed by: rwatson Obtained from: TrustedBSD
* Replace custom file descriptor array sleep lock constructed using a mutexrwatson2007-04-041-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | and flags with an sxlock. This leads to a significant and measurable performance improvement as a result of access to shared locking for frequent lookup operations, reduced general overhead, and reduced overhead in the event of contention. All of these are imported for threaded applications where simultaneous access to a shared file descriptor array occurs frequently. Kris has reported 2x-4x transaction rate improvements on 8-core MySQL benchmarks; smaller improvements can be expected for many workloads as a result of reduced overhead. - Generally eliminate the distinction between "fast" and regular acquisisition of the filedesc lock; the plan is that they will now all be fast. Change all locking instances to either shared or exclusive locks. - Correct a bug (pointed out by kib) in fdfree() where previously msleep() was called without the mutex held; sx_sleep() is now always called with the sxlock held exclusively. - Universally hold the struct file lock over changes to struct file, rather than the filedesc lock or no lock. Always update the f_ops field last. A further memory barrier is required here in the future (discussed with jhb). - Improve locking and reference management in linux_at(), which fails to properly acquire vnode references before using vnode pointers. Annotate improper use of vn_fullpath(), which will be replaced at a future date. In fcntl(), we conservatively acquire an exclusive lock, even though in some cases a shared lock may be sufficient, which should be revisited. The dropping of the filedesc lock in fdgrowtable() is no longer required as the sxlock can be held over the sleep operation; we should consider removing that (pointed out by attilio). Tested by: kris Discussed with: jhb, kris, attilio, jeff
* Remove 'MPSAFE' annotations from the comments above most system calls: allrwatson2007-03-043-47/+0
| | | | | | | | system calls now enter without Giant held, and then in some cases, acquire Giant explicitly. Remove a number of other MPSAFE annotations in the credential code and tweak one or two other adjacent comments.
* More unnecessary include reduction.rwatson2007-02-237-90/+12
|
* Remove many unneeded includes, update copyright.rwatson2007-02-231-29/+2
|
* Remove empty entry point functions (init, destroy, syscall) fromrwatson2007-02-232-32/+0
| | | | policies that don't need them.
* mac_none sample policy has nothing to enforce, so remove sysctls.rwatson2007-02-231-9/+0
| | | | mac_stub acts as a template policy and holds sample sysctls.
* Update auditing of socket information for the inpcb new world order:rwatson2007-02-201-6/+4
| | | | | so_pcb will always be non-NULL, and lock the inpcb while non-atomically accessing address data.
* Move mapping of MBI_APPEND to MBI_WRITE from inside the rule loop inrwatson2007-02-201-9/+8
| | | | | | | mac_bsdextended_check() to before the loop, as it needs to happen only once. MFC after: 1 week
* Do allow bypass of mac_seeotheruids in jail in order to be consistentrwatson2007-02-191-1/+2
| | | | | with other uses of PRIV_SEEOTHERUIDS. This will automatically be scoped to the jail by the jail policy.
* In mac_biba_check_system_swapoff(), don't extract the object label sincerwatson2007-02-101-2/+1
| | | | | | | it isn't used in the access control decision. This became visible to Coverity with the change to a function call retrieving label values. Coverity CID: 1723
* Print intptr_t values by first casting to intmax_t and then printing withrwatson2007-02-061-1/+1
| | | | | | | %jd, as intptr_t may not be int-sized. Assistance from: jhb Spotted by: Mr Tinderbox
* Introduce accessor functions mac_label_get() and mac_label_set() to replacerwatson2007-02-069-69/+107
| | | | | | | | | | | | | | | | | | | LABEL_TO_SLOT() macro used by policy modules to query and set label data in struct label. Instead of using a union, store an intptr_t, simplifying the API. Update policies: in most cases this required only small tweaks to current wrapper macros. In two cases, a single wrapper macros had to be split into separate get and set macros. Move struct label definition from _label.h to mac_internal.h and remove _label.h. With this change, policies may now treat struct label * as opaque, allowing us to change the layout of struct label without breaking the policy module ABI. For example, we could make the maximum number of policies with labels modifiable at boot-time rather than just at compile-time. Obtained from: TrustedBSD Project
* Continue 7-CURRENT MAC Framework rearrangement and cleanup:rwatson2007-02-0621-19/+10
| | | | | | | | | | | | | | Don't perform a nested include of _label.h in mac.h, as mac.h now describes only the user API to MAC, and _label.h defines the in-kernel representation of MAC labels. Remove mac.h includes from policies and MAC framework components that do not use userspace MAC API definitions. Add _KERNEL inclusion checks to mac_internal.h and mac_policy.h, as these are kernel-only include files Obtained from: TrustedBSD Project
* When returning early from audit_arg_file() due to so->so_pcb being NULLrwatson2007-01-061-2/+3
| | | | | | | (due to an early reset or the like), remember to unlock the socket lock. This will not occur in 7-CURRENT, but could in theory occur in 6-STABLE. MFC after: 1 week
* Teach the stub policy about some of the more recent entry points that havecsjp2007-01-011-0/+57
| | | | | | | | | | | | | | | | | | | been introduced to the MAC framework: mpo_associate_nfsd_label mpo_create_mbuf_from_firewall mpo_check_system_nfsd mpo_check_vnode_mmap_downgrade mpo_check_vnode_mprotect mpo_init_syncache_label mpo_destroy_syncache_label mpo_init_syncache_from_inpcb mpo_create_mbuf_from_syncache MFC after: 2 weeks [1] [1] The syncache related entry points will NOT be MFCed as the changes in the syncache subsystem are not present in RELENG_6 yet.
* Remove conditional return of 1. For the MAC_STATIC case at this point incsjp2007-01-011-3/+0
| | | | | | | the code, one being returned is invariant. Discussed with: rwatson MFC after: 1 week
* Only signal the CV indicating that the MAC Framework is available forrwatson2006-12-311-6/+23
| | | | | | | | | | | | | | exclusive access if there is at least one thread waiting for it to become available. This may significantly reduce overhead by reducing the number of unnecessary wakeups issued whenever the framework becomes idle. Annotate that we still signal the CV more than necessary and should fix this. Obtained from: TrustedBSD Project Reviewed by: csjp Tested by: csjp
* Slightly resort functions in file so that no forward function prototypesrwatson2006-12-291-49/+46
| | | | | | are required. Obtained from: TrustedBSD Project
* Re-add include of opt_mac.h in mac_framework.c, which was improperlyrwatson2006-12-291-0/+2
| | | | | removed from this file. It is required to pick up the definition of MAC_STATIC.
* Remove two XXX comments that no longer apply.rwatson2006-12-291-5/+0
| | | | Obtained from: TrustedBSD Project
* Use p_cansee() to check that a target process for an audit staterwatson2006-12-291-3/+9
| | | | | | | | | | manipulation is visible to the subject process. Remove XXX comments suggesting this. Convert one XXX on a difference from Darwin into a note: it's not a bug, it's a feature. Obtained from: TrustedBSD Project
* Add a witness sleep warning to canon_path(), which invokes vput() and hencerwatson2006-12-292-3/+3
| | | | | | | may perform an unbounded sleep. Remove an XXX comment suggesting that one be added. Obtained from: TrustedBSD Project
* Add missing include guards to mac_internal.h, update include guards inrwatson2006-12-282-3/+8
| | | | | | mac_policy.h following move to new location in src/sys/security/mac. Obtained from: TrustedBSD Project
* Update a number of comments:rwatson2006-12-284-23/+22
| | | | | | | | | | | | - Replace XXX with Note: in several cases where observations are made about future functionality rather than problems or bugs. - Remove an XXX comment about byte order and au_to_ip() -- IP headers must be submitted in network byte order. Add a comment to this effect. - Mention that we don't implement select/poll for /dev/audit. Obtained from: TrustedBSD Project
* Remove XXX comments about EA transaction support and provide a morerwatson2006-12-281-6/+11
| | | | | | | general and detailed comment on the topic of EA transactions and kernel warnings. Obtained from: TrustedBSD Project
* Remove an inaccurate comment I added regarding storage for mbuf tagrwatson2006-12-281-7/+0
| | | | | | labels: they are in fact stored in the tag directly. Obtained from: TrustedBSD Project
* In mac_inpcb_sosetlabel(), assert the socket lock rather than commentingrwatson2006-12-281-1/+1
| | | | | | that we should assert the socket lock. Obtained from: TrustedBSD Project
* Centralize definition of MAC_VERSION in mac_policy.h, as it defines therwatson2006-12-283-6/+19
| | | | | | | | | | kernel<->policy ABI version. Add a comment to the definition describing it and listing known versions. Modify MAC_POLICY_SET() to reference the current kernel version by name rather than by number. Staticize mac_late, which is used only in mac_framework.c. Obtained from: TrustedBSD Project
* Move mac_init_label() and mac_destroy_label() from mac_framework.c torwatson2006-12-282-29/+31
| | | | | | | mac_label.c, and use these instead of replicated code in the label zone constructor and destructor. Obtained from: TrustedBSD Project
* Trim unneeded includes.rwatson2006-12-282-48/+0
|
* Break contents of kern_mac.c out into two files following a repo-copy:rwatson2006-12-282-1209/+0
| | | | | | | | | | | mac_framework.c Contains basic MAC Framework functions, policy registration, sysinits, etc. mac_syscalls.c Contains implementations of various MAC system calls, including ENOSYS stubs when compiling without options MAC. Obtained from: TrustedBSD Project
* Update MAC Framework general comments, referencing various interfaces itrwatson2006-12-282-24/+80
| | | | | | | | | | | | | | consumes and implements, as well as the location of the framework and policy modules. Refactor MAC Framework versioning a bit so that the current ABI version can be exported via a read-only sysctl. Further update comments relating to locking/synchronization. Update copyright to take into account these and other recent changes. Obtained from: TrustedBSD Project
* Re-wrap comments following de-indentation.rwatson2006-12-231-13/+11
|
* Move src/sys/sys/mac_policy.h, the kernel interface between the MACrwatson2006-12-2225-43/+25
| | | | | | | | | | | Framework and security modules, to src/sys/security/mac/mac_policy.h, completing the removal of kernel-only MAC Framework include files from src/sys/sys. Update the MAC Framework and MAC policy modules. Delete the old mac_policy.h. Third party policy modules will need similar updating. Obtained from: TrustedBSD Project
* Minor style fixes.rwatson2006-12-214-20/+20
|
* Remove mac_enforce_subsystem debugging sysctls. Enforcement onrwatson2006-12-2114-397/+2
| | | | | | | | | | subsystems will be a property of policy modules, which may require access control check entry points to be invoked even when not actively enforcing (i.e., to track information flow without providing protection). Obtained from: TrustedBSD Project Suggested by: Christopher dot Vance at sparta dot com
* Comment LABEL_TO_SLOT() macro, including observing that we'd like to improverwatson2006-12-201-0/+8
| | | | | | | this policy API to avoid encoding struct label binary layout in policy modules. Obtained from: TrustedBSD Project
* Trim trailing white space, clean up comment line wrapping and formatting.rwatson2006-12-201-10/+21
| | | | | | Document mac_associate_nfsd_label(). Obtained from: TrustedBSD Project
* Trim trailing white space.rwatson2006-12-202-7/+7
|
* Document socket labeling model.rwatson2006-12-201-15/+27
| | | | | | Clean up comment white space and wrapping. Obtained from: TrustedBSD Project
* Clean up comment white space and line wrapping.rwatson2006-12-201-15/+14
|
* Additional comments regarding the interaction between the kernel privilegerwatson2006-12-201-0/+18
| | | | | | model and the MAC Framework. Obtained from: TrustedBSD Project
OpenPOWER on IntegriCloud