summaryrefslogtreecommitdiffstats
path: root/sys/security
Commit message (Collapse)AuthorAgeFilesLines
* Do a lockless read of the audit pipe list before grabbing the audit piperwatson2009-01-061-0/+4
| | | | | | | | | lock in order to avoid the lock acquire hit if the pipe list is very likely empty. Obtained from: TrustedBSD Project MFC after: 3 weeks Sponsored by: Apple, Inc.
* In AUDIT_SYSCALL_EXIT(), invoke audit_syscall_exit() only if an auditrwatson2009-01-061-3/+3
| | | | | | | | | | record is active on the current thread--historically we may always have wanted to enter the audit code if auditing was enabled, but now we just commit the audit record so don't need to enter if there isn't one. Obtained from: TrustedBSD Project Sponsored by: Apple, Inc.
* Fix white space botch: use carriage returns rather than tabs.rwatson2008-12-311-1/+2
|
* Commit two files missed in previous commit: hook up audit_bsm_errno.crwatson2008-12-311-2/+4
| | | | | | | and adapt for kernel build environment. Obtained from: TrustedBSD Project Sponsored by: Apple, Inc.
* Call au_errno_to_bsm() on the errno value passed into au_to_return32()rwatson2008-12-311-1/+1
| | | | | | to convert local FreeBSD error numbers into BSM error numbers. Obtained from: TrustedBSD Project
* Merge OpenBSM alpha 4 from OpenBSM vendor branch to head, bothrwatson2008-12-312-77/+767
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | contrib/openbsm (svn merge) and src/sys/{bsm,security/audit} (manual merge). Add libauditd build parts and add to auditd's linkage; force libbsm to build before libauditd. OpenBSM history for imported revisions below for reference. MFC after: 1 month Sponsored by: Apple Inc. Obtained from: TrustedBSD Project OpenBSM 1.1 alpha 4 - With the addition of BSM error number mapping, we also need to map the local error number passed to audit_submit(3) to a BSM error number, rather than have the caller perform that conversion. - Reallocate user audit events to avoid collisions with Solaris; adopt a more formal allocation scheme, and add some events allocated in Solaris that will be of immediate use on other platforms. - Add an event for Calife. - Add au_strerror(3), which allows generating strings for BSM errors directly, rather than requiring applications to map to the local error space, which might not be able to entirely represent the BSM error number space. - Major auditd rewrite for launchd(8) support. Add libauditd library that is shared between launchd and auditd. - Add AUDIT_TRIGGER_INITIALIZE trigger (sent via 'audit -i') for (re)starting auditing under launchd(8) on Mac OS X. - Add 'current' symlink to active audit trail. - Add crash recovery of previous audit trail file when detected on audit startup that it has not been properly terminated. - Add the event AUE_audit_recovery to indicated when an audit trail file has been recovered from not being properly terminated. This event is stored in the new audit trail file and includes the path of recovered audit trail file. - Mac OS X and FreeBSD dependent code in auditd.c is separated into auditd_darwin.c and auditd_fbsd.c files. - Add an event for the posix_spawn(2) and fsgetpath(2) Mac OS X system calls. - For Mac OS X, we use ASL(3) instead of syslog(3) for logging. - Add support for NOTICE level logging. OpenBSM 1.1 alpha 3 - Add two new functions, au_bsm_to_errno() and au_errno_to_bsm(), to map between BSM error numbers (largely the Solaris definitions) and local errno(2) values for 32-bit and 64-bit return tokens. This is required as operating systems don't agree on some of the values of more recent error numbers. - Fix a bug how au_to_exec_args(3) and au_to_exec_env(3) calculates the total size for the token. This buge. - Deprecated Darwin constants, such as TRAILER_PAD_MAGIC, removed.
* Make preparations for resurrecting shared/read locks on vm maps:alc2008-12-221-4/+2
| | | | | | | | | | | | | | | mac_proc_vm_revoke_recurse() requests a read lock on the vm map at the start but does not handle failure by vm_map_lock_upgrade() when it seeks to modify the vm map. At present, this works because all lock request on a vm map are implemented as exclusive locks. Thus, vm_map_lock_upgrade() is a no-op that always reports success. However, that is about to change, and proc_vm_revoke_recurse() will require substantial modifications to handle vm_map_lock_upgrade() failures. For the time being, I am changing mac_proc_vm_revoke_recurse() to request a write lock on the vm map at the start. Approved by: rwatson MFC after: 3 months
* Merge OpenBSM 1.1 alpha 2 from the OpenBSM vendor branch to head, bothrwatson2008-12-021-75/+137
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | contrib/openbsm (svn merge) and sys/{bsm,security/audit} (manual merge). - Add OpenBSM contrib tree to include paths for audit(8) and auditd(8). - Merge support for new tokens, fixes to existing token generation to audit_bsm_token.c. - Synchronize bsm includes and definitions. OpenBSM history for imported revisions below for reference. MFC after: 1 month Sponsored by: Apple Inc. Obtained from: TrustedBSD Project -- OpenBSM 1.1 alpha 2 - Include files in OpenBSM are now broken out into two parts: library builds required solely for user space, and system includes, which may also be required for use in the kernels of systems integrating OpenBSM. Submitted by Stacey Son. - Configure option --with-native-includes allows forcing the use of native include for system includes, rather than the versions bundled with OpenBSM. This is intended specifically for platforms that ship OpenBSM, have adapted versions of the system includes in a kernel source tree, and will use the OpenBSM build infrastructure with an unmodified OpenBSM distribution, allowing the customized system includes to be used with the OpenBSM build. Submitted by Stacey Son. - Various strcpy()'s/strcat()'s have been changed to strlcpy()'s/strlcat()'s or asprintf(). Added compat/strlcpy.h for Linux. - Remove compatibility defines for old Darwin token constant names; now only BSM token names are provided and used. - Add support for extended header tokens, which contain space for information on the host generating the record. - Add support for setting extended host information in the kernel, which is used for setting host information in extended header tokens. The audit_control file now supports a "host" parameter which can be used by auditd to set the information; if not present, the kernel parameters won't be set and auditd uses unextended headers for records that it generates. OpenBSM 1.1 alpha 1 - Add option to auditreduce(1) which allows users to invert sense of matching, such that BSM records that do not match, are selected. - Fix bug in audit_write() where we commit an incomplete record in the event there is an error writing the subject token. This was submitted by Diego Giagio. - Build support for Mac OS X 10.5.1 submitted by Eric Hall. - Fix a bug which resulted in host XML attributes not being arguments so that const strings can be passed as arguments to tokens. This patch was submitted by Xin LI. - Modify the -m option so users can select more then one audit event. - For Mac OS X, added Mach IPC support for audit trigger messages. - Fixed a bug in getacna() which resulted in a locking problem on Mac OS X. - Added LOG_PERROR flag to openlog when -d option is used with auditd. - AUE events added for Mac OS X Leopard system calls.
* Partially roll back a revision which changed the error code being returnedcsjp2008-11-301-1/+1
| | | | | | | | | | | | | | by getaudit(2). Some applications such has su, id will interpret E2BIG as requiring the use of getaudit_addr(2) to pull extended audit state (ip6) from the kernel. This change un-breaks the ABI when auditing has been activated on a system and the users are logged in via ip6. This is a RELENG_7_1 candidate. MFC after: 1 day Discussed with: rwatson
* MFp4:bz2008-11-291-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bring in updated jail support from bz_jail branch. This enhances the current jail implementation to permit multiple addresses per jail. In addtion to IPv4, IPv6 is supported as well. Due to updated checks it is even possible to have jails without an IP address at all, which basically gives one a chroot with restricted process view, no networking,.. SCTP support was updated and supports IPv6 in jails as well. Cpuset support permits jails to be bound to specific processor sets after creation. Jails can have an unrestricted (no duplicate protection, etc.) name in addition to the hostname. The jail name cannot be changed from within a jail and is considered to be used for management purposes or as audit-token in the future. DDB 'show jails' command was added to aid debugging. Proper compat support permits 32bit jail binaries to be used on 64bit systems to manage jails. Also backward compatibility was preserved where possible: for jail v1 syscalls, as well as with user space management utilities. Both jail as well as prison version were updated for the new features. A gap was intentionally left as the intermediate versions had been used by various patches floating around the last years. Bump __FreeBSD_version for the afore mentioned and in kernel changes. Special thanks to: - Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches and Olivier Houchard (cognet) for initial single-IPv6 patches. - Jeff Roberson (jeff) and Randall Stewart (rrs) for their help, ideas and review on cpuset and SCTP support. - Robert Watson (rwatson) for lots and lots of help, discussions, suggestions and review of most of the patch at various stages. - John Baldwin (jhb) for his help. - Simon L. Nielsen (simon) as early adopter testing changes on cluster machines as well as all the testers and people who provided feedback the last months on freebsd-jail and other channels. - My employer, CK Software GmbH, for the support so I could work on this. Reviewed by: (see above) MFC after: 3 months (this is just so that I get the mail) X-MFC Before: 7.2-RELEASE if possible
* Regularize /* FALLTHROUGH */ comments in the BSM event type switch, andrwatson2008-11-251-6/+10
| | | | | | | add one that was missing. MFC after: 3 weeks Coverity ID: 3960
* When repeatedly accessing a thread credential, cache the credentialrwatson2008-11-143-42/+48
| | | | | | | | | | | | | pointer in a local thread. While this is unlikely to significantly improve performance given modern compiler behavior, it makes the code more readable and reduces diffs to the Mac OS X version of the same code (which stores things in creds in the same way, but where the cred for a thread is reached quite differently). Discussed with: sson MFC after: 1 month Sponsored by: Apple Inc. Obtained from: TrustedBSD Project
* The audit queue limit variables are size_t, so use size_t for the auditrwatson2008-11-132-4/+4
| | | | | | | | | queue length variables as well, avoiding storing the limit in a larger type than the length. Submitted by: sson Sponsored by: Apple Inc. MFC after: 1 week
* Move audit-internal function definitions for getting and setting auditrwatson2008-11-112-2/+6
| | | | kinfo state to audit_private.h.
* Minor style tweaks and change lock name string to use _'s and not spacesrwatson2008-11-111-1/+4
| | | | to improve parseability.
* Add support for extended header BSM tokens. Currently we use thecsjp2008-11-116-4/+119
| | | | | | | | | | | | | | | | | | | | | | regular header tokens. The extended header tokens contain an IP or IPv6 address which makes it possible to identify which host an audit record came from when audit records are centralized. If the host information has not been specified, the system will default to the old style headers. Otherwise, audit records that are created as a result of system calls will contain host information. This implemented has been designed to be consistent with the Solaris implementation. Host information is set/retrieved using the A_GETKAUDIT and A_SETKAUDIT auditon(2) commands. These commands require that a pointer to a auditinfo_addr_t object is passed. Currently only IP and IPv6 address families are supported. The users pace bits associated with this change will follow in an openbsm import. Reviewed by: rwatson, (sson, wsalamon (older version)) MFC after: 1 month
* Wrap sx locking of the audit worker sleep lock in macros, update comments.rwatson2008-11-101-24/+31
| | | | | MFC after: 2 months Sponsored by: Apple, Inc.
* Use shared vnode locks for auditing vnode arguments as auditing onlyjhb2008-11-041-2/+2
| | | | | | does a VOP_GETATTR() which does not require an exclusive lock. Reviewed by: csjp, rwatson
* Don't lock the vnode around calls to vn_fullpath().jhb2008-11-041-16/+3
| | | | Reviewed by: csjp, rwatson
* Update introductory comment for audit pipes.rwatson2008-11-021-4/+4
| | | | | MFC after: 2 months Sponsored by: Apple, Inc.
* Remove stale comment about filtering in audit pipe ioctl routine: we dorwatson2008-11-021-3/+0
| | | | | | | | support filtering now, although we may want to make it more interesting in the future. MFC after: 2 months Sponsored by: Apple, Inc.
* Add comment for per-pipe stats.rwatson2008-11-011-0/+3
| | | | | MFC after: 2 months Sponsored by: Apple, Inc.
* We only allow a partial read of the first record in an audit piperwatson2008-11-011-15/+28
| | | | | | | | | | | | | | | | | | record queue, so move the offset field from the per-record audit_pipe_entry structure to the audit_pipe structure. Now that we support reading more than one record at a time, add a new summary field to audit_pipe, ap_qbyteslen, which tracks the total number of bytes present in a pipe, and return that (minus the current offset) via FIONREAD and kqueue's data variable for the pending byte count rather than the number of bytes remaining in only the first record. Add a number of asserts to confirm that these counts and offsets following the expected rules. MFC after: 2 months Sponsored by: Apple, Inc.
* Allow a single read(2) system call on an audit pipe to retrieve data fromrwatson2008-11-011-40/+32
| | | | | | | more than one audit record at a time in order to improve efficiency. MFC after: 2 months Sponsored by: Apple, Inc.
* Since there is no longer the opportunity for record truncation, justrwatson2008-10-311-2/+1
| | | | | | | return 0 if the truncation counter is queried on an audit pipe. MFC after: 2 months Sponsored by: Apple, Inc.
* Historically, /dev/auditpipe has allows only whole records to be read viarwatson2008-10-311-58/+86
| | | | | | | | | | | | | | | | | | | | | read(2), which meant that records longer than the buffer passed to read(2) were dropped. Instead take the approach of allowing partial reads to be continued across multiple system calls more in the style of streaming character device. This means retaining a record on the per-pipe queue in a partially read state, so maintain a current offset into the record. Keep the record on the queue during a read, so add a new lock, ap_sx, to serialize removal of records from the queue by either read(2) or ioctl(2) requesting a pipe flush. Modify the kqueue handler to return bytes left in the current record rather than simply the size of the current record. It is now possible to use praudit, which used the standard FILE * buffer sizes, to track much larger record sizes from /dev/auditpipe, such as very long command lines to execve(2). MFC after: 2 months Sponsored by: Apple, Inc.
* When we drop an audit record going to and audit pipe because the auditrwatson2008-10-301-13/+9
| | | | | | | | | | | pipe has overflowed, drop the newest, rather than oldest, record. This makes overflow drop behavior consistent with memory allocation failure leading to drop, avoids touching the consumer end of the queue from a producer, and lowers the CPU overhead of dropping a record by dropping before memory allocation and copying. Obtained from: Apple, Inc. MFC after: 2 months
* Break out single audit_pipe_mtx into two types of locks: a global rwlockrwatson2008-10-301-83/+127
| | | | | | | | | | | | | | | | | | protecting the list of audit pipes, and a per-pipe mutex protecting the queue. Likewise, replace the single global condition variable used to signal delivery of a record to one or more pipes, and add a per-pipe condition variable to avoid spurious wakeups when event subscriptions differ across multiple pipes. This slightly increases the cost of delivering to audit pipes, but should reduce lock contention in the presence of multiple readers as only the per-pipe lock is required to read from a pipe, as well as avoid overheading when different pipes are used in different ways. MFC after: 2 months Sponsored by: Apple, Inc.
* Protect the event->class lookup database using an rwlock instead of arwatson2008-10-301-8/+15
| | | | | | | | mutex, as it's rarely changed but frequently accessed read-only from multiple threads, so a potentially significant source of contention. MFC after: 1 month Sponsored by: Apple, Inc.
* The V* flags passed using an accmode_t to the access() and open()rwatson2008-10-303-12/+26
| | | | | | | | access control checks in mac_bsdextended are not in the same namespace as the MBI_ flags used in ugidfw policies, so add an explicit conversion routine to get from one to the other. Obtained from: TrustedBSD Project
* Commit part of accmode_t changes that I missed in previous commit.trasz2008-10-281-1/+1
| | | | Approved by: rwatson (mentor)
* Break out strictly credential-related portions of mac_process.c into arwatson2008-10-282-141/+213
| | | | | | new file, mac_cred.c. Obtained from: TrustedBSD Project
* Introduce accmode_t. This is required for NFSv4 ACLs - it will be neccessarytrasz2008-10-2810-25/+37
| | | | | | | to add more V* constants, and the variables changed by this patch were often being assigned to mode_t variables, which is 16 bit. Approved by: rwatson (mentor)
* Rename mac_cred_mmapped_drop_perms(), which revokes access to virtualrwatson2008-10-284-20/+18
| | | | | | | | | | | memory mappings when the MAC label on a process changes, to mac_proc_vm_revoke(), It now also acquires its own credential reference directly from the affected process rather than accepting one passed by the the caller, simplifying the API and consumer code. Obtained from: TrustedBSD Project
* Rename three MAC entry points from _proc_ to _cred_ to reflect the factrwatson2008-10-289-201/+202
| | | | | | | that they operate directly on credentials: mac_proc_create_swapper(), mac_proc_create_init(), and mac_proc_associate_nfsd(). Update policies. Obtained from: TrustedBSD Project
* Extended comment on why we consider a partition relabel request of "0" torwatson2008-10-281-1/+7
| | | | | | | | be a no-op request, and why this might have to change if we want to allow leaving a partition someday. Obtained from: TrustedBSD Project MFC after: 3 days
* Rename label_on_label() to partition_check(), which is far morerwatson2008-10-281-7/+7
| | | | | | | suggestive as to its actual function. Obtained from: TrustedBSD Project MFC after: 3 days
* Improve alphabetical sort order of stub entry points.rwatson2008-10-281-32/+32
|
* When the mac_bsdextended policy is unloaded, free rule memory.rwatson2008-10-271-0/+5
| | | | | Obtained from: TrustedBSD Project MFC after: 3 days
* Add TrustedBSD credit to new ugidfw_internal.h file.rwatson2008-10-271-0/+2
|
* Break mac_bsdextended.c out into multiple .c files, with the base accessrwatson2008-10-274-1451/+149
| | | | | | | control logic and policy registration remaining in that file, and access control checks broken out into other files by class of check. Obtained from: TrustedBSD Project
* Copy mac_bsdextended.c to two object-specific files as a prototype for howrwatson2008-10-272-0/+1536
| | | | | | modularize MAC policy layout. Obtained from: TrustedBSD Project
* Implement MAC policy support for IPv6 fragment reassembly queues,rwatson2008-10-265-5/+275
| | | | | | modeled on IPv4 fragment reassembly queue support. Obtained from: TrustedBSD Project
* Add a MAC label, MAC Framework, and MAC policy entry points for IPv6rwatson2008-10-263-3/+129
| | | | | | | | | | | fragment reassembly queues. This allows policies to label reassembly queues, perform access control checks when matching fragments to a queue, update a queue label when fragments are matched, and label the resulting reassembled datagram. Obtained from: TrustedBSD Project
* Fix a number of style issues in the MALLOC / FREE commit. I've tried todes2008-10-231-1/+2
| | | | | be careful not to fix anything that was already broken; the NFSv4 code is particularly bad in this respect.
* Retire the MALLOC and FREE macros. They are an abomination unto style(9).des2008-10-232-4/+3
| | | | MFC after: 3 months
* Add a mac_inpcb_check_visible implementation to all MAC policiesbz2008-10-177-0/+111
| | | | | | | that handle mac_socket_check_visible. Reviewed by: rwatson MFC after: 3 months (set timer; decide then)
* Add mac_inpcb_check_visible MAC Framework entry point, which is similarbz2008-10-173-0/+16
| | | | | | | to mac_socket_check_visible but operates on the inpcb. Reviewed by: rwatson MFC after: 3 months (set timer, decide then)
* Use the label from the socket credential rather than thebz2008-10-171-1/+2
| | | | | | | | solabel which was not set by the mac_partition policy. Spotted by: rwatson Reviewed by: rwatson MFC after: 3 days
* Remove unit2minor() use from kernel code.ed2008-09-261-1/+1
| | | | | | | | | | | | | | | When I changed kern_conf.c three months ago I made device unit numbers equal to (unneeded) device minor numbers. We used to require bitshifting, because there were eight bits in the middle that were reserved for a device major number. Not very long after I turned dev2unit(), minor(), unit2minor() and minor2unit() into macro's. The unit2minor() and minor2unit() macro's were no-ops. We'd better not remove these four macro's from the kernel, because there is a lot of (external) code that may still depend on them. For now it's harmless to remove all invocations of unit2minor() and minor2unit(). Reviewed by: kib
OpenPOWER on IntegriCloud