summaryrefslogtreecommitdiffstats
path: root/sys/security
Commit message (Collapse)AuthorAgeFilesLines
* Update device-labeling logic for Biba, LOMAC, and MLS to recognize new-stylerwatson2010-03-023-0/+3
| | | | | | | pts devices when various policy ptys_equal flags are enabled. Submitted by: Estella Mystagic <estella at mystagic.com> MFC after: 1 week
* Make sure we convert audit records that were produced as the result of thecsjp2010-01-311-0/+7
| | | | closefrom(2) syscall.
* Replace the static NGROUPS=NGROUPS_MAX+1=1024 with a dynamicbrooks2010-01-121-2/+2
| | | | | | | | kern.ngroups+1. kern.ngroups can range from NGROUPS_MAX=1023 to INT_MAX-1. Given that the Windows group limit is 1024, this range should be sufficient for most applications. MFC after: 1 month
* Make mac_lomac(4) able to interpret NFSv4 access bits.trasz2010-01-031-1/+1
| | | | Reviewed by: rwatson
* Having thrown the cat out of the house, add a necessary include.phk2009-09-081-0/+1
|
* Revert previous commit and add myself to the list of people who shouldphk2009-09-081-1/+0
| | | | know better than to commit with a cat in the area.
* Add necessary include.phk2009-09-081-0/+1
|
* Correctly audit real gids following changes to the audit record argumentrwatson2009-08-121-1/+1
| | | | | | interface. Approved by: re (kib)
* Eliminate ARG_UPATH[12] arguments to AUDIT_ARG_UPATH() and insteadrwatson2009-07-293-89/+89
| | | | | | | | | | | | provide specific macros, AUDIT_ARG_UPATH1() and AUDIT_ARG_UPATH2() to capture path information for audit records. This allows us to move the definitions of ARG_* out of the public audit header file, as they are an implementation detail of our current kernel-internal audit record, which may change. Approved by: re (kensmith) Obtained from: TrustedBSD Project MFC after: 1 month
* Rework vnode argument auditing to follow the same structure, in orderrwatson2009-07-283-34/+50
| | | | | | | | | | to avoid exposing ARG_ macros/flag values outside of the audit code in order to name which one of two possible vnodes will be audited for a system call. Approved by: re (kib) Obtained from: TrustedBSD Project MFC after: 1 month
* Audit file descriptors passed to fooat(2) system calls, which are usedrwatson2009-07-286-83/+184
| | | | | | | | | | | | | | | instead of the root/current working directory as the starting point for lookups. Up to two such descriptors can be audited. Add audit record BSM encoding for fooat(2). Note: due to an error in the OpenBSM 1.1p1 configuration file, a further change is required to that file in order to fix openat(2) auditing. Approved by: re (kib) Reviewed by: rdivacky (fooat(2) portions) Obtained from: TrustedBSD Project MFC after: 1 month
* Import OpenBSM 1.1p1 from vendor branch to 8-CURRENT, populatingrwatson2009-07-172-8/+121
| | | | | | | | | | | | | | | | | contrib/openbsm and a subset also imported into sys/security/audit. This patch release addresses several minor issues: - Fixes to AUT_SOCKUNIX token parsing. - IPv6 support for au_to_me(3). - Improved robustness in the parsing of audit_control, especially long flags/naflags strings and whitespace in all fields. - Add missing conversion of a number of FreeBSD/Mac OS X errnos to/from BSM error number space. MFC after: 3 weeks Obtained from: TrustedBSD Project Sponsored by: Apple, Inc. Approved by: re (kib)
* Create audit records for AUE_POSIX_OPENPT, currently w/o arguments.rwatson2009-07-021-0/+1
| | | | Approved by: re (audit argument blanket)
* Fix comment misthink.rwatson2009-07-021-1/+1
| | | | | | Submitted by: b. f. <bf1783 at googlemail.com> Approved by: re (audit argument blanket) MFC after: 1 week
* Clean up a number of aspects of token generation from audit arguments torwatson2009-07-021-69/+55
| | | | | | | | | | | | | | | | system calls: - Centralize generation of argument tokens for VM addresses in a macro, ADDR_TOKEN(), and properly encode 64-bit addresses in 64-bit arguments. - Fix up argument numbers across a large number of syscalls so that they match the numeric argument into the system call. - Don't audit the address argument to ioctl(2) or ptrace(2), but do keep generating tokens for mmap(2), minherit(2), since they relate to passing object access across execve(2). Approved by: re (audit argument blanket) Obtained from: TrustedBSD Project MFC after: 1 week
* For access(2) and eaccess(2), audit the requested access mode.rwatson2009-07-011-2/+9
| | | | | Approved by: re (audit argument blanket) MFC after: 3 days
* Define missing audit argument macro AUDIT_ARG_SOCKET(), andrwatson2009-07-011-0/+6
| | | | | | | | capture the domain, type, and protocol arguments to socket(2) and socketpair(2). Approved by: re (audit argument blanket) MFC after: 3 days
* When auditing unmount(2), capture FSID arguments as regular text stringsrwatson2009-07-011-0/+8
| | | | | | | | | | rather than as paths, which would lead to them being treated as relative pathnames and hence confusingly converted into absolute pathnames. Capture flags to unmount(2) via an argument token. Approved by: re (audit argument blanket) MFC after: 3 days
* Audit the file descriptor number passed to lseek(2).rwatson2009-07-011-1/+1
| | | | | Approved by: re (kib) MFC after: 3 days
* udit the 'options' argument to wait4(2).rwatson2009-07-011-0/+4
| | | | | Approved by: re (kib) MFC after: 3 days
* Dynamically allocate the gidset field in audit record.sson2009-06-293-2/+13
| | | | | | | | | This fixes a problem created by the recent change that allows a large number of groups per user. The gidset field in struct kaudit_record is now dynamically allocated to the size needed rather than statically (using NGROUPS). Approved by: re@ (kensmith, rwatson), gnn (mentor)
* Replace AUDIT_ARG() with variable argument macros with a set more morerwatson2009-06-272-15/+174
| | | | | | | | | | | | | | specific macros for each audit argument type. This makes it easier to follow call-graphs, especially for automated analysis tools (such as fxr). In MFC, we should leave the existing AUDIT_ARG() macros as they may be used by third-party kernel modules. Suggested by: brooks Approved by: re (kib) Obtained from: TrustedBSD Project MFC after: 1 week
* Implement global and per-uid accounting of the anonymous memory. Addkib2009-06-232-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | rlimit RLIMIT_SWAP that limits the amount of swap that may be reserved for the uid. The accounting information (charge) is associated with either map entry, or vm object backing the entry, assuming the object is the first one in the shadow chain and entry does not require COW. Charge is moved from entry to object on allocation of the object, e.g. during the mmap, assuming the object is allocated, or on the first page fault on the entry. It moves back to the entry on forks due to COW setup. The per-entry granularity of accounting makes the charge process fair for processes that change uid during lifetime, and decrements charge for proper uid when region is unmapped. The interface of vm_pager_allocate(9) is extended by adding struct ucred *, that is used to charge appropriate uid when allocation if performed by kernel, e.g. md(4). Several syscalls, among them is fork(2), may now return ENOMEM when global or per-uid limits are enforced. In collaboration with: pho Reviewed by: alc Approved by: re (kensmith)
* Chase the removal of PRIV_TTY_PRISON in the mac(9) modules.ed2009-06-202-2/+0
| | | | | Reported by: kib Pointy hat to: me
* Adapt vfs kqfilter to the shared vnode lock used by zfs write vop. Usekib2009-06-101-2/+1
| | | | | | | | | | | | | | | | | | | | | | | | | vnode interlock to protect the knote fields [1]. The locking assumes that shared vnode lock is held, thus we get exclusive access to knote either by exclusive vnode lock protection, or by shared vnode lock + vnode interlock. Do not use kl_locked() method to assert either lock ownership or the fact that curthread does not own the lock. For shared locks, ownership is not recorded, e.g. VOP_ISLOCKED can return LK_SHARED for the shared lock not owned by curthread, causing false positives in kqueue subsystem assertions about knlist lock. Remove kl_locked method from knlist lock vector, and add two separate assertion methods kl_assert_locked and kl_assert_unlocked, that are supposed to use proper asserts. Change knlist_init accordingly. Add convenience function knlist_init_mtx to reduce number of arguments for typical knlist initialization. Submitted by: jhb [1] Noted by: jhb [2] Reviewed by: jhb Tested by: rnoland
* Move "options MAC" from opt_mac.h to opt_global.h, as it's now in GENERICrwatson2009-06-051-2/+0
| | | | | | | | and used in a large number of files, but also because an increasing number of incorrect uses of MAC calls were sneaking in due to copy-and-paste of MAC-aware code without the associated opt_mac.h include. Discussed with: pjd
* Add one further check with mac_policy_count to an mbuf copying caserwatson2009-06-031-0/+3
| | | | | | | (limited to netatalk) to avoid MAC label lookup on both mbufs if no policies are registered. Obtained from: TrustedBSD Project
* Continue work to optimize performance of "options MAC" when no MAC policyrwatson2009-06-0310-94/+328
| | | | | | | | | | | | | | | | | | | | | | | | | | | modules are loaded by avoiding mbuf label lookups when policies aren't loaded, pushing further socket locking into MAC policy modules, and avoiding locking MAC ifnet locks when no policies are loaded: - Check mac_policies_count before looking for mbuf MAC label m_tags in MAC Framework entry points. We will still pay label lookup costs if MAC policies are present but don't require labels (typically a single mbuf header field read, but perhaps further indirection if IPSEC or other m_tag consumers are in use). - Further push socket locking for socket-related access control checks and events into MAC policies from the MAC Framework, so that sockets are only locked if a policy specifically requires a lock to protect a label. This resolves lock order issues during sonewconn() and also in local domain socket cross-connect where multiple socket locks could not be held at once for the purposes of propagatig MAC labels across multiple sockets. Eliminate mac_policy_count check in some entry points where it no longer avoids locking. - Add mac_policy_count checking in some entry points relating to network interfaces that otherwise lock a global MAC ifnet lock used to protect ifnet labels. Obtained from: TrustedBSD Project
* By default, label all network interfaces as biba/equal on attach. Thisrwatson2009-06-031-1/+1
| | | | | | | | makes it easier for first-time users to configure and work with biba as remote acess is still allowed. Effectively, this means that, by default, only local security properties, not distributed ones, are enforced. Obtained from: TrustedBSD Project
* Mark MAC Framework sx and rm locks as NOWITNESS to suppress warnings thatrwatson2009-06-021-2/+2
| | | | | | | | | might arise from WITNESS not understanding its locking protocol, which should be deadlock-free. Currently these warnings generally don't occur, but as object locking is pushed into policies for some object types, they would otherwise occur more often. Obtained from: TrustedBSD Project
* Add internal 'mac_policy_count' counter to the MAC Framework, which is arwatson2009-06-023-22/+70
| | | | | | | | | | | | | | | | | | count of the number of registered policies. Rather than unconditionally locking sockets before passing them into MAC, lock them in the MAC entry points only if mac_policy_count is non-zero. This avoids locking overhead for a number of socket system calls when no policies are registered, eliminating measurable overhead for the MAC Framework for the socket subsystem when there are no active policies. Possibly socket locks should be acquired by policies if they are required for socket labels, which would further avoid locking overhead when there are policies but they don't require labeling of sockets, or possibly don't even implement socket controls. Obtained from: TrustedBSD Project
* Make the rmlock(9) interface a bit more like the rwlock(9) interface:rwatson2009-05-291-1/+1
| | | | | | | | | | | | | | - Add rm_init_flags() and accept extended options only for that variation. - Add a flags space specifically for rm_init_flags(), rather than borrowing the lock_init() flag space. - Define flag RM_RECURSE to use instead of LO_RECURSABLE. - Define flag RM_NOWITNESS to allow an rmlock to be exempt from WITNESS checking; this wasn't possible previously as rm_init() always passed LO_WITNESS when initializing an rmlock's struct lock. - Add RM_SYSINIT_FLAGS(). - Rename embedded mutex in rmlocks to make it more obvious what it is. - Update consumers. - Update man page.
* Add hierarchical jails. A jail may further virtualize its environmentjamie2009-05-271-2/+2
| | | | | | | | | | | | | | | | | | | | | | by creating a child jail, which is visible to that jail and to any parent jails. Child jails may be restricted more than their parents, but never less. Jail names reflect this hierarchy, being MIB-style dot-separated strings. Every thread now points to a jail, the default being prison0, which contains information about the physical system. Prison0's root directory is the same as rootvnode; its hostname is the same as the global hostname, and its securelevel replaces the global securelevel. Note that the variable "securelevel" has actually gone away, which should not cause any problems for code that properly uses securelevel_gt() and securelevel_ge(). Some jail-related permissions that were kept in global variables and set via sysctls are now per-jail settings. The sysctls still exist for backward compatibility, used only by the now-deprecated jail(2) system call. Approved by: bz (mentor)
* Convert the MAC Framework from using rwlocks to rmlocks to stabilizerwatson2009-05-272-21/+32
| | | | | | framework registration for non-sleepable entry points. Obtained from: TrustedBSD Project
* Remove the thread argument from the FSD (File-System Dependent) parts ofattilio2009-05-111-1/+1
| | | | | | | | | | | | | | | | | the VFS. Now all the VFS_* functions and relating parts don't want the context as long as it always refers to curthread. In some points, in particular when dealing with VOPs and functions living in the same namespace (eg. vflush) which still need to be converted, pass curthread explicitly in order to retain the old behaviour. Such loose ends will be fixed ASAP. While here fix a bug: now, UFS_EXTATTR can be compiled alone without the UFS_EXTATTR_AUTOSTART option. VFS KPI is heavilly changed by this commit so thirdy parts modules needs to be recompiled. Bump __FreeBSD_version in order to signal such situation.
* Rename MAC Framework-internal macros used to invoke policy entry points:rwatson2009-05-0118-304/+339
| | | | | | | | | | | | | | | | | | MAC_BOOLEAN -> MAC_POLICY_BOOLEAN MAC_BOOLEAN_NOSLEEP -> MAC_POLICY_BOOLEANN_NOSLEEP MAC_CHECK -> MAC_POLICY_CHECK MAC_CHECK_NOSLEEP -> MAC_POLICY_CHECK_NOSLEEP MAC_EXTERNALIZE -> MAC_POLICY_EXTERNALIZE MAC_GRANT -> MAC_POLICY_GRANT MAC_GRANT_NOSLEEP -> MAC_POLICY_GRANT_NOSLEEP MAC_INTERNALIZE -> MAC_POLICY_INTERNALIZE MAC_PERFORM -> MAC_POLICY_PERFORM_CHECK MAC_PERFORM_NOSLEEP -> MAC_POLICY_PERFORM_NOSLEEP This frees up those macro names for use in wrapping calls into the MAC Framework from the remainder of the kernel. Obtained from: TrustedBSD Project
* Temporarily relax the constraints on argument size checking for A_GETCOND;rwatson2009-04-191-12/+6
| | | | | | | login(1) isn't quite ready for them yet on 64-bit systems as it continues to use the conventions of the old version of the API. Reported by: stas, Jakub Lach <jakub_lach at mailplus.pl>
* Merge OpenBSM 1.1 changes to the FreeBSD 8.x kernel:rwatson2009-04-197-44/+225
| | | | | | | | | | | | | | | | - Add and use mapping of fcntl(2) commands to new BSM constant space. - Adopt (int) rather than (long) arguments to a number of auditon(2) commands, as has happened in Solaris, and add compatibility code to handle the old comments. Note that BSM_PF_IEEE80211 is partially but not fully removed, as the userspace OpenBSM 1.1alpha5 code still depends on it. Once userspace is updated, I'll GCC the kernel constant. MFC after: 2 weeks Sponsored by: Apple, Inc. Obtained from: TrustedBSD Project Portions submitted by: sson
* Merge new kernel files from OpenBSM 1.1: audit_fcntl.h andrwatson2009-04-161-0/+290
| | | | | | | | | | audit_bsm_fcntl.c contain utility routines to map local fcntl commands into BSM constants. Adaptation to the FreeBSD kernel environment will follow in a future commit. Sponsored by: Apple, Inc. Obtained from: TrustedBSD Project MFC after: 2 weeks
* Remove D_NEEDGIANT from audit pipes. I'm actually not sure why this wasrwatson2009-04-161-1/+1
| | | | | | | here, but isn't needed. MFC after: 2 weeks Sponsored by: Apple, Inc.
* Get rid of VSTAT and replace it with VSTAT_PERMS, which is somewhattrasz2009-03-293-6/+6
| | | | | | better defined. Approved by: rwatson (mentor)
* - Correct logic in if statement - we want to allocate temporary bufferpjd2009-03-141-1/+3
| | | | | | | | | | when someone is passing new rules, not when he only want to read them. Because of this bug, even if the given rules were incorrect, they ended up in rule_string. - Add missing protection for rule_string when coping it. Reviewed by: rwatson MFC after: 1 week
* Rework MAC Framework synchronization in a number of ways in order torwatson2009-03-1420-327/+410
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | improve performance: - Eliminate custom reference count and condition variable to monitor threads entering the framework, as this had both significant overhead and behaved badly in the face of contention. - Replace reference count with two locks: an rwlock and an sx lock, which will be read-acquired by threads entering the framework depending on whether a give policy entry point is permitted to sleep or not. - Replace previous mutex locking of the reference count for exclusive access with write acquiring of both the policy list sx and rw locks, which occurs only when policies are attached or detached. - Do a lockless read of the dynamic policy list head before acquiring any locks in order to reduce overhead when no dynamic policies are loaded; this a race we can afford to lose. - For every policy entry point invocation, decide whether sleeping is permitted, and if not, use a _NOSLEEP() variant of the composition macros, which will use the rwlock instead of the sxlock. In some cases, we decide which to use based on allocation flags passed to the MAC Framework entry point. As with the move to rwlocks/rmlocks in pfil, this may trigger witness warnings, but these should (generally) be false positives as all acquisition of the locks is for read with two very narrow exceptions for policy load/unload, and those code blocks should never acquire other locks. Sponsored by: Google, Inc. Obtained from: TrustedBSD Project Discussed with: csjp (idea, not specific patch)
* Mark the bsdextended rules sysctl as being mpsafe.csjp2009-03-091-2/+2
| | | | Discussed with: rwatson
* Add a new thread-private flag, TDP_AUDITREC, to indicate whether orrwatson2009-03-093-5/+15
| | | | | | | | | | | | | not there is an audit record hung off of td_ar on the current thread. Test this flag instead of td_ar when auditing syscall arguments or checking for an audit record to commit on syscall return. Under these circumstances, td_pflags is much more likely to be in the cache (especially if there is no auditing of the current system call), so this should help reduce cache misses in the system call return path. MFC after: 1 week Reported by: kris Obtained from: TrustedBSD Project
* Remove 'uio' argument from MAC Framework and MAC policy entry points forrwatson2009-03-0810-36/+21
| | | | | | | | | extended attribute get/set; in the case of get an uninitialized user buffer was passed before the EA was retrieved, making it of relatively little use; the latter was simply unused by any policies. Obtained from: TrustedBSD Project Sponsored by: Google, Inc.
* Rename 'ucred' argument to mac_socket_check_bind() to 'cred' to matchrwatson2009-03-081-3/+3
| | | | | | | other use of the same variable type. Obtained from: TrustedBSD Project Sponsored by: Google, Inc.
* Improve the consistency of MAC Framework and MAC policy entry pointrwatson2009-03-089-467/+454
| | | | | | | | | | | | | | | | | | | | | | | naming by renaming certain "proc" entry points to "cred" entry points, reflecting their manipulation of credentials. For some entry points, the process was passed into the framework but not into policies; in these cases, stop passing in the process since we don't need it. mac_proc_check_setaudit -> mac_cred_check_setaudit mac_proc_check_setaudit_addr -> mac_cred_check_setaudit_addr mac_proc_check_setauid -> mac_cred_check_setauid mac_proc_check_setegid -> mac_cred_check_setegid mac_proc_check_seteuid -> mac_cred_check_seteuid mac_proc_check_setgid -> mac_cred_check_setgid mac_proc_check_setgroups -> mac_cred_ceck_setgroups mac_proc_check_setregid -> mac_cred_check_setregid mac_proc_check_setresgid -> mac_cred_check_setresgid mac_proc_check_setresuid -> mac_cred_check_setresuid mac_proc_check_setreuid -> mac_cred_check_setreuid mac_proc_check_setuid -> mac_cred_check_setuid Obtained from: TrustedBSD Project Sponsored by: Google, Inc.
* Add static DTrace probes for MAC Framework access control checks andrwatson2009-03-0817-14/+660
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | privilege grants so that dtrace can be more easily used to monitor the security decisions being generated by the MAC Framework following policy invocation. Successful access control checks will be reported by: mac_framework:kernel:<entrypoint>:mac_check_ok Failed access control checks will be reported by: mac_framework:kernel:<entrypoint>:mac_check_err Successful privilege grants will be reported by: mac_framework:kernel:priv_grant:mac_grant_ok Failed privilege grants will be reported by: mac_framework:kernel:priv_grant:mac_grant_err In all cases, the return value (always 0 for _ok, otherwise an errno for _err) will be reported via arg0 on the probe, and subsequent arguments will hold entrypoint-specific data, in a style similar to privilege tracing. Obtained from: TrustedBSD Project Sponsored by: Google, Inc.
* Reduce the verbosity of SDT trace points for DTrace by defining severalrwatson2009-03-031-12/+3
| | | | | | | | | | | wrapper macros that allow trace points and arguments to be declared using a single macro rather than several. This means a lot less repetition and vertical space for each trace point. Use these macros when defining privilege and MAC Framework trace points. Reviewed by: jb MFC after: 1 week
OpenPOWER on IntegriCloud