summaryrefslogtreecommitdiffstats
path: root/sys/security
Commit message (Collapse)AuthorAgeFilesLines
* Update copyright for NETA->McAfee.rwatson2005-01-301-5/+5
|
* Remove policy references to mpo_check_vnode_mprotect(), which isrwatson2005-01-265-54/+2
| | | | | | | | currently unimplemented. Update copyrights. Pointed out by: csjp
* Remove an obsoleted comment about struct versions.rwatson2005-01-231-1/+0
| | | | | MFC after: 3 days Pointed out by: trhodes
* Update mac_test for MAC Framework policy entry points System V IPCrwatson2005-01-221-0/+378
| | | | | | | | | objects (message queues, semaphores, shared memory), exercising and validating MAC labels on these objects. Submitted by: Dandekar Hrishikesh <rishi_dandekar at sbcglobal dot net> Obtained from: TrustedBSD Project Sponsored by: DARPA, SPAWAR, McAfee Research
* Update mac_stub for MAC Framework policy entry points System V IPCrwatson2005-01-221-5/+213
| | | | | | | | objects (message queues, semaphores, shared memory). Submitted by: Dandekar Hrishikesh <rishi_dandekar at sbcglobal dot net> Obtained from: TrustedBSD Project Sponsored by: DARPA, SPAWAR, McAfee Research
* Implement MLS confidentiality protection for System V IPC objectsrwatson2005-01-221-5/+391
| | | | | | | | (message queues, semaphores, shared memory). Submitted by: Dandekar Hrishikesh <rishi_dandekar at sbcglobal dot net> Obtained from: TrustedBSD Project Sponsored by: DARPA, SPAWAR, McAfee Research
* Implement Biba integrity protection for System V IPC objects (messagerwatson2005-01-221-5/+394
| | | | | | | | queues, semaphores, shared memory). Submitted by: Dandekar Hrishikesh <rishi_dandekar at sbcglobal dot net> Obtained from: TrustedBSD Project Sponsored by: DARPA, SPAWAR, McAfee Research
* Exempt the superuser from mac_seeotheruids checks.rwatson2005-01-031-0/+3
| | | | | | Submitted by: bkoenig at cs dot tu-berlin dot de PR: 72238 MFC after: 2 weeks
* Add a new sysctl/tunable to mac_portacl:rwatson2004-12-081-0/+23
| | | | | | | | | | | | | | security.mac.portacl.autoport_exempt This sysctl exempts to bind port '0' as long as IP_PORTRANGELOW hasn't been set on the socket. This is quite useful as it allows applications to use automatic binding without adding overly broad rules for the binding of port 0. This sysctl defaults to enabled. This is a slight variation on the patch submitted by the contributor. MFC after: 2 weeks Submitted by: Michal Mertl <mime at traveller dot cz>
* Switch from using an sx lock to a mutex for the mac_portacl rule chain:rwatson2004-12-061-26/+19
| | | | | | | | | | | | | | | | the sx lock was used previously because we might sleep allocating additional memory by using auto-extending sbufs. However, we no longer do this, instead retaining the user-submitted rule string, so mutexes can be used instead. Annotate the reason for not using the sbuf-related rule-to-string code with a comment. Switch to using TAILQ_CONCAT() instead of manual list copying, as it's O(1), reducing the rule replacement step under the mutex from O(2N) to O(2). Remove now uneeded vnode-related includes. MFC after: 2 weeks
* Implement MAC entry points relating to System V IPC, calling into therwatson2004-11-173-0/+592
| | | | | | | | | MAC policies to perform object life cycle operations and access control checks. Submitted by: Dandekar Hrishikesh <rishi_dandekar at sbcglobal dot net> Obtained from: TrustedBSD Project Sponsored by: DARPA, SPAWAR, McAfee Research
* Define new MAC framework and policy entry points for System V IPCrwatson2004-11-172-1/+129
| | | | | | | | | | | | | | | objects and operations: - System V IPC message, message queue, semaphore, and shared memory segment init, destroy, cleanup, create operations. - System V IPC message, message queue, seamphore, and shared memory segment access control entry points, including rights to attach, destroy, and manipulate these IPC objects. Submitted by: Dandekar Hrishikesh <rishi_dandekar at sbcglobal dot net> Obtained from: TrustedBSD Project Sponsored by: DARPA, SPAWAR, McAfee Research
* Bump MAC Framework version to 2 in preparation for the upcoming API/ABIrwatson2004-11-093-3/+3
| | | | | | changes associated with adding System V IPC support. This will prevent old modules from being used with the new kernel, and new modules from being used with the old kernel.
* Disable use of synchronization early in the boot by the MAC Framework;rwatson2004-10-302-0/+42
| | | | | | for modules linked into the kernel or loaded very early, panics will result otherwise, as the CV code it calls will panic due to its use of a mutex before it is initialized.
* /%x/%s/ -- mismerged DEBUGGER() printf() format stirng from therwatson2004-10-231-1/+1
| | | | | | TrustedBSD branch. Submitted by: bde
* Expand comments on various sections of the MAC Framework Policy API,rwatson2004-10-221-4/+15
| | | | | | | | | as well as document the properties of the mac_policy_conf structure. Warn about the ABI risks in changing the structure without careful consideration. Obtained from: TrustedBSD Project Sponsored by: SPAWAR
* Replace direct reference to kdb_enter() with a DEBUGGER() macro thatrwatson2004-10-221-28/+34
| | | | | | | will call printf() if KDB isn't compiled into the kernel. Obtained from: TrustedBSD Project Sponsored by: SPAWAR
* Minor white space synchronization and line wrapping.rwatson2004-10-222-1/+3
|
* In the MAC label zone destructor, assert that the label is onlyrwatson2004-10-221-1/+3
| | | | destroyed in an initialized state.
* Remove extern declaration of mac_enforce_sysv, as it's not present inrwatson2004-10-221-1/+0
| | | | the CVS version of the MAC Framework.
* Bump copyright dates for NETA on these files.rwatson2004-10-212-2/+2
|
* Modify mac_bsdextended policy so that it defines its own vnode accessrwatson2004-10-212-33/+74
| | | | | | | | | | | right bits rather than piggy-backing on the V* rights defined in vnode.h. The mac_bsdextended bits are given the same values as the V* bits to make the new kernel module binary compatible with the old version of libugidfw that uses V* bits. This avoids leaking kernel API/ABI to user management tools, and in particular should remove the need for libugidfw to include vnode.h. Requested by: phk
* Remove the debugging tunable, it was not being used.trhodes2004-09-101-10/+1
| | | | | | Enable first match by default.[1] We should: rwatson [1]
* Allow mac_bsdextended(4) to log failed attempts to syslog's AUTHPRIVtrhodes2004-08-211-5/+19
| | | | | | | | facility. This is disabled by default but may be turned on by using the mac_bsdextended_logging sysctl. Reviewed by: re (jhb) Approved by: re (jhb)
* Give the mac_bsdextended(4) policy the ability to match and apply on a firsttrhodes2004-08-211-2/+21
| | | | | | | | | | rule only in place of all rules match. This is similar to how ipfw(8) works. Provide a sysctl, mac_bsdextended_firstmatch_enabled, to enable this feature. Reviewed by: re (jhb) Aprroved by: re (jhb)
* * Add a "how" argument to uma_zone constructors and initialization functionsgreen2004-08-021-3/+4
| | | | | | | | | | | | | | | | | so that they know whether the allocation is supposed to be able to sleep or not. * Allow uma_zone constructors and initialation functions to return either success or error. Almost all of the ones in the tree currently return success unconditionally, but mbuf is a notable exception: the packet zone constructor wants to be able to fail if it cannot suballocate an mbuf cluster, and the mbuf allocators want to be able to fail in general in a MAC kernel if the MAC mbuf initializer fails. This fixes the panics people are seeing when they run out of memory for mbuf clusters. * Allow debug.nosleepwithlocks on WITNESS to be disabled, without changing the default. Both bmilekic and jeff have reviewed the changes made to make failable zone allocations work.
* Introduce SLOT_SET macro and use it in place of casts as lvalues.kan2004-07-283-12/+16
|
* Allow an effective uid of root to bypass mac_bsdextended rules; the MACrwatson2004-07-231-0/+3
| | | | | | | Framework can restrict the root user, but this policy is not intended to support that. Stylish Swiss footwear provided for: trhodes
* Rename Biba and MLS _single label elements to _effective, which morerwatson2004-07-164-353/+353
| | | | | | | | | accurately represents the intention of the 'single' label element in Biba and MLS labels. It also approximates the use of 'effective' in traditional UNIX credentials, and avoids confusion with 'singlelabel' in the context of file systems. Inspired by: trhodes
* Do a pass over all modules in the kernel and make them return EOPNOTSUPPphk2004-07-152-0/+2
| | | | | | | | for unknown events. A number of modules return EINVAL in this instance, and I have left those alone for now and instead taught MOD_QUIESCE to accept this as "didn't do anything".
* Update for the KDB framework:marcel2004-07-101-28/+29
| | | | o Call kdb_enter() instead of Debugger().
* Introduce a temporary mutex, mac_ifnet_mtx, to lock MAC labels onrwatson2004-06-247-0/+53
| | | | | | | | | | | | | | | | | | network interfaces. This global mutex will protect all ifnet labels. Acquire the mutex across various MAC activities on interfaces, such as security checks, propagating interface labels to mbufs generated from the interface, retrieving and setting the interface label. Introduce mpo_copy_ifnet_label MAC policy entry point to copy the value of an interface label from one label to another. Use this to avoid performing a label externalize while holding mac_ifnet_mtx; copy the label to a temporary ifnet label and then externalize that. Implement mpo_copy_ifnet_label for various MAC policies that implement interface labeling using generic label copying routines. Obtained from: TrustedBSD Project Sponsored by: DARPA, McAfee Research
* Do the dreaded s/dev_t/struct cdev */phk2004-06-168-8/+9
| | | | Bump __FreeBSD_version accordingly.
* Socket MAC labels so_label and so_peerlabel are now protected byrwatson2004-06-131-8/+57
| | | | | | | | | | | | | SOCK_LOCK(so): - Hold socket lock over calls to MAC entry points reading or manipulating socket labels. - Assert socket lock in MAC entry point implementations. - When externalizing the socket label, first make a thread-local copy while holding the socket lock, then release the socket lock to externalize to userspace.
* add missing #include <sys/module.h>phk2004-05-302-0/+2
|
* Remove dead code. (This loop counted the number of rules, but the countcperciva2004-05-151-7/+0
| | | | | | | was never used.) Reported by: pjd Approved by: rwatson
* Improve consistency of include file guards in src/sys/sys by terminatingrwatson2004-05-102-6/+6
| | | | | | them with '_', as well as beginning with '_'. Observed by: bde
* If the mbuf pointer passed to mac_mbuf_to_label() is NULL, or the tagrwatson2004-05-031-1/+4
| | | | | | | | | | | lookup for the label tag fails, return NULL rather than something close to NULL. This scenario occurs if mbuf header labeling is optional and a policy requiring labeling is loaded, resulting in some mbufs having labels and others not. Previously, 0x14 would be returned because the NULL from m_tag_find() was not treated specially. Obtained from: TrustedBSD Project Sponsored by: DARPA, McAfee Research
* Add /* !MAC */ to final #endif.rwatson2004-05-032-2/+2
|
* Update copyright.rwatson2004-05-031-1/+1
|
* When performing label assertions on an mbuf header label in mac_test,rwatson2004-05-031-2/+3
| | | | | | | | | | test the label pointer for NULL before testing the label slot for permitted values. When loading mac_test dynamically with conditional mbuf labels, the label pointer may be NULL if the mbuf was instantiated while labels were not required on mbufs by any policy. Obtained from: TrustedBSD Project Sponsored by: DARPA, McAfee Research
* Bump copyright date for NETA to 2004.rwatson2004-05-032-2/+2
|
* Add MAC_STATIC, a kernel option that disables internal MAC Frameworkrwatson2004-05-032-0/+50
| | | | | | | | | | synchronization protecting against dynamic load and unload of MAC policies, and instead simply blocks load and unload. In a static configuration, this allows you to avoid the synchronization costs associated with introducing dynamicism. Obtained from: TrustedBSD Project Sponsored by: DARPA, McAfee Research
* Define BPFD_LOCK_ASSERT() to assert the BPF descriptor lock.rwatson2004-02-291-0/+4
| | | | | | | | Assert the BPF descriptor lock in the MAC calls referencing live BPF descriptors. Obtained from: TrustedBSD Project Sponsored by: DARPA, McAfee Research
* Forward declare struct proc, struct sockaddr, and struct thread, whichrwatson2004-02-261-0/+3
| | | | | | | are employed in entry points later in the same include file. Obtained from: TrustedBSD Project Sponsored by: DARPA, Air Force Research Laboratory, McAfee Research
* Forward declare struct bpf_d, struct ifnet, struct image_params, andrwatson2004-02-261-1/+5
| | | | | | | | | struct vattr in mac_policy.h. This permits policies not implementing entry points using these types to compile without including include files with these types. Obtained from: TrustedBSD Project Sponsored by: DARPA, Air Force Research Laboratory
* Move inet and inet6 related MAC Framework entry points from mac_net.crwatson2004-02-264-655/+807
| | | | | | | | | | | | | | to a new mac_inet.c. This code is now conditionally compiled based on inet support being compiled into the kernel. Move socket related MAC Framework entry points from mac_net.c to a new mac_socket.c. To do this, some additional _enforce MIB variables are now non-static. In addition, mbuf_to_label() is now mac_mbuf_to_label() and non-static. Obtained from: TrustedBSD Project Sponsored by: DARPA, McAfee Research
* Reimplement sysctls handling by MAC framework.pjd2004-02-227-36/+26
| | | | | | | | | | | Now I believe it is done in the right way. Removed some XXMAC cases, we now assume 'high' integrity level for all sysctls, except those with CTLFLAG_ANYBODY flag set. No more magic. Reviewed by: rwatson Approved by: rwatson, scottl (mentor) Tested with: LINT (compilation), mac_biba(4) (functionality)
* Update my personal copyrights and NETA copyrights in the kernelrwatson2004-02-2223-46/+46
| | | | | | | | to use the "year1-year3" format, as opposed to "year1, year2, year3". This seems to make lawyers more happy, but also prevents the lines from getting excessively long as the years start to add up. Suggested by: imp
* Commit file missed in last pass: MAC api uses 'struct pipepair', notrwatson2004-02-011-8/+8
| | | | 'struct pipe' now.
OpenPOWER on IntegriCloud