summaryrefslogtreecommitdiffstats
path: root/sys/security
Commit message (Collapse)AuthorAgeFilesLines
* Teach the MAC policies which utilize mbuf labeling the new syncachecsjp2006-12-133-0/+75
| | | | | | entry points. Properly initialize the mbuf label based on the label we copy from the PCB. This fixes an LOR between the PCB and syncache code.
* Fix LOR between the syncache and inpcb locks when MAC is present in thecsjp2006-12-133-0/+68
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | kernel. This LOR snuck in with some of the recent syncache changes. To fix this, the inpcb handling was changed: - Hang a MAC label off the syncache object - When the syncache entry is initially created, we pickup the PCB lock is held because we extract information from it while initializing the syncache entry. While we do this, copy the MAC label associated with the PCB and use it for the syncache entry. - When the packet is transmitted, copy the label from the syncache entry to the mbuf so it can be processed by security policies which analyze mbuf labels. This change required that the MAC framework be extended to support the label copy operations from the PCB to the syncache entry, and then from the syncache entry to the mbuf. These functions really should be referencing the syncache structure instead of the label. However, due to some of the complexities associated with exposing this syncache structure we operate directly on it's label pointer. This should be OK since we aren't making any access control decisions within this code directly, we are merely allocating and copying label storage so we can properly initialize mbuf labels for any packets the syncache code might create. This also has a nice side effect of caching. Prior to this change, the PCB would be looked up/locked for each packet transmitted. Now the label is cached at the time the syncache entry is initialized. Submitted by: andre [1] Discussed with: rwatson [1] andre submitted the tcp_syncache.c changes
* Merge posix4/* into normal kernel hierarchy.trhodes2006-11-115-10/+5
| | | | | Reviewed by: glanced at by jhb Approved by: silence on -arch@ and -standards@
* Add stub entry point implementations of mpo_priv_check and mpo_priv_grant torwatson2006-11-061-0/+16
| | | | | | the mac_stub policy. Obtained from: TrustedBSD Project
* Sweep kernel replacing suser(9) calls with priv(9) calls, assigningrwatson2006-11-0611-21/+45
| | | | | | | | | | | | | specific privilege names to a broad range of privileges. These may require some future tweaking. Sponsored by: nCircle Network Security, Inc. Obtained from: TrustedBSD Project Discussed on: arch@ Reviewed (at least in part) by: mlaier, jmg, pjd, bde, ceri, Alex Lyashkov <umka at sevcity dot net>, Skip Ford <skip dot ford at verizon dot net>, Antoine Brodin <antoine dot brodin at laposte dot net>
* Add a new priv(9) kernel interface for checking the availability ofrwatson2006-11-063-0/+100
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | privilege for threads and credentials. Unlike the existing suser(9) interface, priv(9) exposes a named privilege identifier to the privilege checking code, allowing more complex policies regarding the granting of privilege to be expressed. Two interfaces are provided, replacing the existing suser(9) interface: suser(td) -> priv_check(td, priv) suser_cred(cred, flags) -> priv_check_cred(cred, priv, flags) A comprehensive list of currently available kernel privileges may be found in priv.h. New privileges are easily added as required, but the comments on adding privileges found in priv.h and priv(9) should be read before doing so. The new privilege interface exposed sufficient information to the privilege checking routine that it will now be possible for jail to determine whether a particular privilege is granted in the check routine, rather than relying on hints from the calling context via the SUSER_ALLOWJAIL flag. For now, the flag is maintained, but a new jail check function, prison_priv_check(), is exposed from kern_jail.c and used by the privilege check routine to determine if the privilege is permitted in jail. As a result, a centralized list of privileges permitted in jail is now present in kern_jail.c. The MAC Framework is now also able to instrument privilege checks, both to deny privileges otherwise granted (mac_priv_check()), and to grant privileges otherwise denied (mac_priv_grant()), permitting MAC Policy modules to implement privilege models, as well as control a much broader range of system behavior in order to constrain processes running with root privilege. The suser() and suser_cred() functions remain implemented, now in terms of priv_check() and the PRIV_ROOT privilege, for use during the transition and possibly continuing use by third party kernel modules that have not been updated. The PRIV_DRIVER privilege exists to allow device drivers to check privilege without adopting a more specific privilege identifier. This change does not modify the actual security policy, rather, it modifies the interface for privilege checks so changes to the security policy become more feasible. Sponsored by: nCircle Network Security, Inc. Obtained from: TrustedBSD Project Discussed on: arch@ Reviewed (at least in part) by: mlaier, jmg, pjd, bde, ceri, Alex Lyashkov <umka at sevcity dot net>, Skip Ford <skip dot ford at verizon dot net>, Antoine Brodin <antoine dot brodin at laposte dot net>
* Change the type of ar_arg_sockaddr from struct sockaddr to structcsjp2006-11-062-3/+2
| | | | | | | | | | | | | | | | | sockaddr_storage. This structure is defined in RFC 2553 and is a more semantically correct structure for holding IP and IP6 sockaddr information. struct sockaddr is not big enough to hold all the required information for IP6, resulting in truncated addresses et al when auditing IP6 sockaddr information. We also need to assume that the sa->sa_len has been validated before the call to audit_arg_sockaddr() is made, otherwise it could result in a buffer overflow. This is being done to accommodate auditing of network related arguments (like connect, bind et al) that will be added soon. Discussed with: rwatson Obtained from: TrustedBSD Project MFC after: 2 weeks
* Forward declare struct cdev, since arguments of this type are used inrwatson2006-10-301-0/+1
| | | | | | function prototypes. Obtained from: TrustedBSD Project
* Remove extra _MAC_ from #ifdef guard.rwatson2006-10-251-1/+1
|
* Complete break-out of sys/sys/mac.h into sys/security/mac/mac_framework.hrwatson2006-10-2217-76/+32
| | | | | | | | | | | | | begun with a repo-copy of mac.h to mac_framework.h. sys/mac.h now contains the userspace and user<->kernel API and definitions, with all in-kernel interfaces moved to mac_framework.h, which is now included across most of the kernel instead. This change is the first step in a larger cleanup and sweep of MAC Framework interfaces in the kernel, and will not be MFC'd. Obtained from: TrustedBSD Project Sponsored by: SPARTA
* Do allow jailed superuser to override the port ACL.rwatson2006-10-101-1/+1
| | | | | MFC after: 3 days Submitted by: Michal Mertl <mime at traveller dot cz>
* Mark the audit system calls as being un-implemented in jails. Currently we docsjp2006-10-101-0/+19
| | | | | | | | | | | | | | | | | | | | | not trust jails enough to execute audit related system calls. An example of this is with su(1), or login(1) within prisons. So, if the syscall request comes from a jail return ENOSYS. This will cause these utilities to operate as if audit is not present in the kernel. Looking forward, this problem will be remedied by allowing non privileged users to maintain and their own audit streams, but the details on exactly how this will be implemented needs to be worked out. This change should fix situations when options AUDIT has been compiled into the kernel, and utilities like su(1), or login(1) fail due to audit system call failures within jails. This is a RELENG_6 candidate. Reported by: Christian Brueffer Discussed with: rwatson MFC after: 3 days
* Add BSM conversion switch entries for a number of system calls, manyrwatson2006-10-031-7/+43
| | | | | | | | administrative, to prevent console warnings and enable basic event auditing (generally without arguments). MFC after: 3 days Obtained from: TrustedBSD Project
* Trim some no longer XXX comments.rwatson2006-10-021-22/+5
| | | | | | | Remove some commented out debugging printfs. MFC after: 3 days Obtained from: TrustedBSD Project
* Audit path argument when changing audit trails.rwatson2006-10-021-3/+4
| | | | | | | | Call NDFREE(), which while not currently strictly necessary, isn't a bad idea. MFC after: 3 days Obtained from: TrustedBSD Project
* Rework the way errors are handled with respect to how audit records arerwatson2006-09-241-100/+145
| | | | | | | | | | | | | | | | | | | | | | | | written to the audit trail file: - audit_record_write() now returns void, and all file system specific error handling occurs inside this function. This pushes error handling complexity out of the record demux routine that hands off to both the trail and audit pipes, and makes trail behavior more consistent with pipes as a record destination. - Rate limit kernel printfs associated with running low on space. Rate limit audit triggers for low space. Rate limit printfs for fail stop events. Rate limit audit worker write error printfs. - Document in detail the types of limits and space checks we perform, and combine common cases. This improves the audit subsystems tolerance to low space conditions by avoiding toasting the console with printfs are waking up the audit daemon continuously. MFC after: 3 days Obtained from: TrustedBSD Project
* Merge OpenBSM 1.0 alpha 11 changes into src/sys/bsm and src/sys/security;rwatson2006-09-211-1/+1
| | | | | | primarily, add new event identifiers and update trigger names. Obtained from: TrustedBSD Project
* Remove MAC_DEBUG label counters, which were used to debug leaks andrwatson2006-09-2013-161/+0
| | | | | | | | | other problems while labels were first being added to various kernel objects. They have outlived their usefulness. MFC after: 1 month Suggested by: Christopher dot Vance at SPARTA dot com Obtained from: TrustedBSD Project
* Rather than allocating all buffer memory for the completed BSM recordrwatson2006-09-201-19/+17
| | | | | | | | | | | | | | | when allocating the record in the first place, allocate the final buffer when closing the BSM record. At that point, more size information is available, so a sufficiently large buffer can be allocated. This allows the kernel to generate audit records in excess of MAXAUDITDATA bytes, but is consistent with Solaris's behavior. This only comes up when auditing command line arguments, in which case we presume the administrator really does want the data as they have specified the policy flag to gather them. Obtained from: TrustedBSD Project MFC after: 3 days
* Add missing white space in au_to_exec_{args,env}().rwatson2006-09-201-0/+2
| | | | MFC after: 3 days
* Make sure that lutimes(2) gets processed and converted into a BSM record.csjp2006-09-181-0/+1
| | | | | Submitted by: rwatson MFC after: 1 day
* Declare security and security.bsd sysctl hierarchies in sysctl.h alongrwatson2006-09-171-1/+0
| | | | | | | | with other commonly used sysctl name spaces, rather than declaring them all over the place. MFC after: 1 month Sponsored by: nCircle Network Security, Inc.
* Correct a slight regression which was introduced with the implementation ofcsjp2006-09-174-5/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | audit pipes. If the kernel record was not selected for the trail or the pipe, any user supplied record attached to it would be tossed away, resulting in otherwise selected events being lost. - Introduce two new masks: AR_PRESELECT_USER_TRAIL AR_PRESELECT_USER_PIPE, currently we have AR_PRESELECT_TRAIL and AR_PRESELECT_PIPE, which tells the audit worker that we are interested in the kernel record, with the additional masks we can determine if either the pipe or trail is interested in seeing the kernel or user record. - In audit(2), we unconditionally set the AR_PRESELECT_USER_TRAIL and AR_PRESELECT_USER_PIPE masks under the assumption that userspace has done the preselection [1]. Currently, there is work being done that allows the kernel to parse and preselect user supplied records, so in the future preselection could occur in either layer. But there is still a few details to work out here. [1] At some point we need to teach au_preselect(3) about the interests of all the individual audit pipes. This is a RELENG_6 candidate. Reviewed by: rwatson Obtained from: TrustedBSD Project MFC after: 1 week
* Add AUE_SYSARCH to the list of audit events during BSM conversion to preventrwatson2006-09-171-0/+1
| | | | | | | a console warning. Eventually, we will capture more arguments for sysarch. Obtained from: TrustedBSD Project MFC after: 3 days
* Introduce a new entry point, mac_create_mbuf_from_firewall. This entry pointcsjp2006-09-126-0/+50
| | | | | | | | | | | | | | | | | | | | | | exists to allow the mandatory access control policy to properly initialize mbufs generated by the firewall. An example where this might happen is keep alive packets, or ICMP error packets in response to other packets. This takes care of kernel panics associated with un-initialize mbuf labels when the firewall generates packets. [1] I modified this patch from it's original version, the initial patch introduced a number of entry points which were programmatically equivalent. So I introduced only one. Instead, we should leverage mac_create_mbuf_netlayer() which is used for similar situations, an example being icmp_error() This will minimize the impact associated with the MFC Submitted by: mlaier [1] MFC after: 1 week This is a RELENG_6 candidate
* Add struct msg to the forwarded declared data structures in mac_policy.h.rwatson2006-09-091-0/+1
| | | | Obtained from: TrustedBSD Project
* Add a BSM conversion switch case for AUE_GETCWD, so that a consolerwatson2006-09-091-0/+3
| | | | | | | warning isn't generated when __getcwd() is invoked. MFC after: 3 days Obtained from: TrustedBSD Project
* Small style cleanup.rwatson2006-09-091-3/+2
| | | | MFC after: 3 days
* White space cleanup, no functional change.rwatson2006-09-041-53/+53
|
* Audit the argv and env vectors passed in on exec:wsalamon2006-09-017-10/+139
| | | | | | | | | | | | Add the argument auditing functions for argv and env. Add kernel-specific versions of the tokenizer functions for the arg and env represented as a char array. Implement the AUDIT_ARGV and AUDIT_ARGE audit policy commands to enable/disable argv/env auditing. Call the argument auditing from the exec system calls. Obtained from: TrustedBSD Project Approved by: rwatson (mentor)
* Fix panic associated with file creation via RPC/NFS when the MLS policycsjp2006-08-261-0/+12
| | | | | | | | is loaded. This problem stems from the fact that the policy is not properly initializing the mac label associated with the NFS daemon. Obtained from: TrustedBSD Project Discussed with: rwatson
* Allow the user process to query the kernel's notion of a maximumrwatson2006-08-262-0/+6
| | | | | | | | | audit record size at run-time, which can be used by the user process to size the user space buffer it reads into from the audit pipe. Perforce change: 105098 Obtained from: TrustedBSD Project
* Update kernel OpenBSM parts, especially src/sys/bsm, for the OpenBSMrwatson2006-08-262-3/+4
| | | | | | | 1.0 alpha 9 import. See the OpenBSM import commit message for a detailed summary of changes. Obtained from: TrustedBSD Project
* Remove $P4$ from this file; other then temporarily P4-local work inrwatson2006-08-251-1/+0
| | | | | | | progress the kernel audit code in CVS is considered authoritative. This will ease $P4$-related merging issues during the CVS loopback. Obtained from: TrustedBSD Project
* Add kqueue support to audit pipe pseudo-devices.rwatson2006-08-241-0/+84
| | | | Obtained from: TrustedBSD Project
* Make mpo_associate_nfsd_label() return void, not int, to matchrwatson2006-08-062-3/+2
| | | | | | mac_associate_nfsd_label(). Head nod: csjp
* Remove the NDEVFSINO and NDEVFSOVERFLOW options which no longer exists inphk2006-07-173-3/+0
| | | | | | DEVFS. Remove the opt_devfs.h file now that it is empty.
* Implement mpo_associate_nfsd_label entry point for the BIBA security policy,csjp2006-07-101-0/+13
| | | | | | | | | | | | we will initialize the label to biba/low for files that have been created through an NFS RPC. This is a safe default given the default nature of our NFS implementation, there is not a whole lot of data integrity there by default. This also fixes kernel panics associated with file creation over NFS while creating files on filesystems which have multilabel enabled with BIBA enabled. MFC after: 2 weeks Discussed with: rwatson
* Audit the remaining parameters to the extattr system calls. Generatewsalamon2006-07-061-0/+59
| | | | | | | the audit records for those calls. Obtained from: TrustedBSD Project Approved by: rwatson (mentor)
* Correct a number of problems that were previously commented on:rwatson2006-07-032-49/+40
| | | | | | | | | | | | | | - Correct audit_arg_socketaddr() argument name from so to sa. - Assert arguments are non-NULL to many argument capture functions rather than testing them. This may trip some bugs. - Assert the process lock is held when auditing process information. - Test currecord in several more places. - Test validity of more arguments with kasserts, such as flag values when auditing vnode information. Perforce change: 98825 Obtained from: TrustedBSD Project
* Make the size of the subject32_ex and process32_ex tokens depend onwsalamon2006-06-171-13/+25
| | | | | | | | | whether we have an IPv6 address. Write the term ID as 4 or 16 bytes depending on address type. This change matches the recent OpenBSM change, and what Solaris does. Obtained from: TrustedBSD Project Approved by: rwatson (mentor)
* Lock process when copying fields from process structure so as torwatson2006-06-081-3/+2
| | | | | | | | get a consistent snapshot, as well as get consistent values (i.e., that p_comm is properly nul-terminated). Perforce CID: 98824 Obtained from: TrustedBSD Project
* Prefer C to C++ comments per style(9).rwatson2006-06-081-1/+1
| | | | | Perforce CID: 98826 Obtained from: TrustedBSD Project
* Extract pointer value for mnt_stat from vp after the NULL check, notrwatson2006-06-061-1/+2
| | | | | | | before. Coverity ID: 134394 Found with: Coverity Prevent (tm)
* Remove use of Giant around vn_open() in audit trail setup.rwatson2006-06-051-15/+10
| | | | | Submitted by: jhb, wsalamon Obtained from: TrustedBSD Project
* When generating BSM tokens for mkfifo(), include mode argument.rwatson2006-06-051-1/+6
| | | | | Submitted by: wsalamon Obtained from: TrustedBSD Project
* When generating the process token, need to check whether therwatson2006-06-052-15/+14
| | | | | | | | | process was sucessfully audited. Otherwise, generate the PID token. This change covers the pid < 0 cases, and pid lookup failure cases. Submitted by: wsalamon Obtained from: TrustedBSD Project
* Consistently use audit_free() to free records, rather thanrwatson2006-06-051-2/+2
| | | | | | | directly invoking uma_zfree(). Perforce change: 96652 Obtained from: TrustedBSD Project
* Introduce support for per-audit pipe preselection independent from therwatson2006-06-056-66/+519
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | global audit trail configuration. This allows applications consuming audit trails to specify parameters for which audit records are of interest, including selecting records not required by the global trail. Allowing application interest specification without changing the global configuration allows intrusion detection systems to run without interfering with global auditing or each other (if multiple are present). To implement this: - Kernel audit records now carry a flag to indicate whether they have been selected by the global trail or by the audit pipe subsystem, set during record commit, so that this information is available after BSM conversion when delivering the BSM to the trail and audit pipes in the audit worker thread asynchronously. Preselection by either record target will cause the record to be kept. - Similar changes to preselection when the audit record is created when the system call is entering: consult both the global trail and pipes. - au_preselect() now accepts the class in order to avoid repeatedly looking up the mask for each preselection test. - Define a series of ioctls that allow applications to specify whether they want to track the global trail, or program their own preselection parameters: they may specify their own flags and naflags masks, similar to the global masks of the same name, as well as a set of per-auid masks. They also set a per-pipe mode specifying whether they track the global trail, or user their own -- the door is left open for future additional modes. A new ioctl is defined to allow a user process to flush the current audit pipe queue, which can be used after reprogramming pre-selection to make sure that only records of interest are received in future reads. - Audit pipe data structures are extended to hold the additional fields necessary to support preselection. By default, audit pipes track the global trail, so "praudit /dev/auditpipe" will track the global audit trail even though praudit doesn't program the audit pipe selection model. - Comment about the complexities of potentially adding partial read support to audit pipes. By using a set of ioctls, applications can select which records are of interest, and toggle the preselection mode. Obtained from: TrustedBSD Project
* Shorten audit record zone name.rwatson2006-06-051-1/+1
| | | | | Perforce change: 93598 Obtained from: TrustedBSD Project
OpenPOWER on IntegriCloud