summaryrefslogtreecommitdiffstats
path: root/sys
Commit message (Collapse)AuthorAgeFilesLines
* Make the consumers of the linker_load_file() function usemux2002-08-024-10/+9
| | | | | | | | | | | | | linker_load_module() instead. This fixes a bug where the kernel was unable to properly locate and load a kernel module in vfs_mount() (and probably in the netgraph code as well since it was using the same function). This is because the linker_load_file() does not properly search the module path. Problem found by: peter Reviewed by: peter Thanks to: peter
* Introduce support for Mandatory Access Control and extensiblerwatson2002-08-021-0/+5
| | | | | | | | | | kernel access control. When generating nd6 output on an interface, label the packet appropriately. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* When preserving the IP header in extra mbuf in the IP forwardingrwatson2002-08-021-0/+7
| | | | | | | | case, also preserve the MAC label. Note that this mbuf allocation is fairly non-optimal, but not my fault. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Improve ordering of MAC entry points in mac_policy_op structure.rwatson2002-08-022-12/+12
| | | | | Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* o Convert two instances of vm_page_sleep_busy() into vm_page_sleep_if_busy()alc2002-08-021-6/+9
| | | | with appropriate page queue locking.
* Move a prototype to the least wrong place.phk2002-08-026-2/+4
| | | | Suggested by: bde
* ptvmmap does not exist on alpha.peter2002-08-021-1/+0
|
* Work to fix LINT build.rwatson2002-08-021-0/+1
| | | | Reported by: phk
* SYSINIT needs to be SI_SUB_PSEUDO. Add a printf to tell we are here.phk2002-08-021-1/+2
|
* typo.phk2002-08-021-1/+1
|
* Add the minimalist elan-mmcr device driver.phk2002-08-023-0/+87
| | | | | This driver allows a userland program to mmap the MMCR of the AMD Elan sc520 CPU.
* Modernise the cdevsw WRT to (unused) kqueue.markm2002-08-021-0/+2
|
* Calculate the correct physical block number for files that arescottl2002-08-021-4/+6
| | | | | | | | embedded into their file_entry descriptor. This is more for correctness, since these files cannot be bmap'ed/mmap'ed anyways. Enforce this restriction. Submitted by: tes@sgi.com
* Check for deleted files in udf_lookup(), not just udf_readdir().scottl2002-08-021-1/+6
| | | | Submitted by: tes@sgi.com
* o Lock page queue accesses in nwfs and smbfs.alc2002-08-023-1/+13
| | | | o Assert that the page queues lock is held in vm_page_deactivate().
* o Lock page queue accesses by vm_page_deactivate().alc2002-08-022-6/+30
|
* o Lock page queue accesses by vm_page_deactivate().alc2002-08-022-6/+30
|
* o Lock page queue accesses by vm_page_deactivate().alc2002-08-021-0/+2
|
* Introduce support for Mandatory Access Control and extensiblerwatson2002-08-021-0/+11
| | | | | | | | | | | kernel access control. Teach devfs how to respond to pathconf() _POSIX_MAC_PRESENT queries, allowing it to indicate to user processes that individual vnode labels are available. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Hook up devfs_pathconf() for specfs devfs nodes, not just regularrwatson2002-08-011-0/+1
| | | | | | | devfs nodes. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Demonstrate that MAC modules can also be linked statically asrwatson2002-08-011-0/+1
| | | | | | | | well as loaded as modules by hooking up mac_none if 'options MAC_NONE' is defined. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Introduce support for Mandatory Access Control and extensiblerwatson2002-08-015-3/+47
| | | | | | | | | | | | kernel access control. Invoke appropriate MAC entry points for a number of VFS-related operations in the Linux ABI module. In particular, handle uselib in a manner similar to open() (more work is probably needed here), as well as handle statfs(), and linux readdir()-like calls. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Sample loader.conf lines for various MAC modules.rwatson2002-08-011-0/+12
|
* Forgot to commit this.jake2002-08-011-2/+2
| | | | Spotted by: scottl
* Introduce support for Mandatory Access Control and extensiblerwatson2002-08-011-4/+29
| | | | | | | | | | | | kernel access control. Add MAC support for the UDP protocol. Invoke appropriate MAC entry points to label packets that are generated by local UDP sockets, and to authorize delivery of mbufs to local sockets both in the multicast/broadcast case and the unicast case. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Introduce support for Mandatory Access Control and extensiblerwatson2002-08-011-0/+12
| | | | | | | | | | | | kernel access control. Introduce two ioctls, SIOCGIFMAC, SIOCSIFMAC, which permit user processes to manage the MAC labels on network interfaces. Note that this is part of the user process API/ABI that will be revised prior to 5.0-RELEASE. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Introduce support for Mandatory Access Control and extensiblerwatson2002-08-011-0/+17
| | | | | | | | | | | | kernel access control. Add MAC support for if_ppp. Label packets as they are removed from the raw PPP mbuf queue. Preserve the mbuf MAC label across various PPP data-munging and reconstitution operations. Perform access control checks on mbufs to be transmitted via the interface. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Introduce support for Mandatory Access Control and extensiblerwatson2002-08-011-1/+12
| | | | | | | | | | | kernel access control. Label packets generated by the gif virtual interface. Perform access control on packets delivered to gif virtual interfaces. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Introduce support for Mandatory Access Control and extensiblerwatson2002-08-012-2/+28
| | | | | | | | | | kernel access control. Invoke appropriate MAC framework entry points to authorize readdir() operations in the native ABI. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Fix a comment.julian2002-08-012-2/+2
|
* Slight cleanup of some comments/whitespace.julian2002-08-014-25/+55
| | | | | | | | | | | | Make idle process state more consistant. Add an assert on thread state. Clean up idleproc/mi_switch() interaction. Use a local instead of referencing curthread 7 times in a row (I've been told curthread can be expensive on some architectures) Remove some commented out code. Add a little commented out code (completion coming soon) Reviewed by: jhb@freebsd.org
* Since we have the struct file data pointer cached in vp, use thatrwatson2002-08-011-1/+1
| | | | instead when invoking VOP_POLL().
* o Acquire the page queues lock before calling vm_page_io_finish().alc2002-08-012-3/+6
| | | | o Assert that the page queues lock is held in vm_page_io_finish().
* Include file cleanup; mac.h and malloc.h at one point had orderingrwatson2002-08-0120-10/+20
| | | | | | relationship requirements, and no longer do. Reminded by: bde
* Introduce support for Mandatory Access Control and extensiblerwatson2002-08-019-0/+85
| | | | | | | | | | | | | | | | | | | | kernel access control. Hook up various policy modules to the kernel build. Note that a number of these modules require futher entry point commits in the remainder of the kernel to become fully functional, but enough of the pieces are in place to allow experimentation. Note also that it would be desirable to not build the mac_*.ko modules if 'options MAC' is not defined in the kernel configuration, because the resulting modules are not useful without the kernel option. There doesn't appear to be precedent for a way to do this -- for example, we allow ipfw.ko to be built even if 'options NETINET' isn't defined. Suggests welcomed on the "best" way to do this. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Change macop_t to const, use macop_t in MAC policy entry point definitionrwatson2002-08-012-4/+4
| | | | | | | | structure. This prevents a boatload of warnings in the MAC modules, so we can hook them up to the build. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Introduce support for Mandatory Access Control and extensiblerwatson2002-08-011-4/+39
| | | | | | | | | | | | | | | | | kernel access control Invoke appropriate MAC framework entry points to authorize a number of vnode operations, including read, write, stat, poll. This permits MAC policies to revoke access to files following label changes, and to limit information spread about the file to user processes. Note: currently the file cached credential is used for some of these authorization check. We will need to expand some of the MAC entry point APIs to permit multiple creds to be passed to the access control check to allow diverse policy behavior. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Fix the link to the Handbookblackend2002-08-016-6/+6
|
* Introduce support for Mandatory Access Control and extensiblerwatson2002-08-011-11/+21
| | | | | | | | | | | | | | kernel access control. Restructure the vn_open_cred() access control checks to invoke the MAC entry point for open authorization. Note that MAC can reject open requests where existing DAC code skips the open authorization check due to O_CREAT. However, the failure mode here is the same as other failure modes following creation, wherein an empty file may be left behind. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Introduce support for Mandatory Access Control and extensiblerwatson2002-08-012-20/+190
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | kernel access control. Invoke appropriate MAC entry points to authorize the following operations: truncate on open() (write) access() (access) readlink() (readlink) chflags(), lchflags(), fchflags() (setflag) chmod(), fchmod(), lchmod() (setmode) chown(), fchown(), lchown() (setowner) utimes(), lutimes(), futimes() (setutimes) truncate(), ftrunfcate() (write) revoke() (revoke) fhopen() (open) truncate on fhopen() (write) extattr_set_fd, extattr_set_file() (setextattr) extattr_get_fd, extattr_get_file() (getextattr) extattr_delete_fd(), extattr_delete_file() (setextattr) These entry points permit MAC policies to enforce a variety of protections on vnodes. More vnode checks to come, especially in non-native ABIs. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Introduce support for Mandatory Access Control and extensiblerwatson2002-08-011-0/+9
| | | | | | | | | | | | | kernel access control. Invoke an appropriate MAC entry point to authorize execution of a file by a process. The check is placed slightly differently than it appears in the trustedbsd_mac tree so that it prevents a little more information leakage about the target of the execve() operation. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Move the MAC label init/destroy stuff to more appropriate places so thatbmilekic2002-08-011-10/+20
| | | | | | the inits/destroys are done without the cache locks held even in the persistent-lock calls. I may be cheating a little by using the MAC "already initialized" flag for now.
* Revert previous revision which accidentally snuck in with another commit.jhb2002-08-011-1/+1
| | | | It just removed a comment that doesn't make sense to me personally.
* Revert previous revision which was accidentally committed and has not beenjhb2002-08-011-11/+9
| | | | tested yet.
* If we fail to write to a vnode during a ktrace write, then we drop alljhb2002-08-014-13/+18
| | | | | | | | | other references to that vnode as a trace vnode in other processes as well as in any pending requests on the todo list. Thus, it is possible for a ktrace request structure to have a NULL ktr_vp when it is destroyed in ktr_freerequest(). We shouldn't call vrele() on the vnode in that case. Reported by: bde
* Fix a bug about stack manipulation at ACPI wakeup.iwasaki2002-08-012-0/+2
| | | | | | | This should avoid kernel panic on kernel compiled w/o NO_CPU_COPTFLAGS. Suggested by: optimized code by -mcpu=pentiumpro
* Don't set the IFF_PROMISC bit when in hostap mode like the previousimp2002-08-011-17/+15
| | | | | | commit bogusly did. Instead, don't set PROMSIC in the hardware if we're in hostap mode. This matches more closely what openbsd did as well.
* Document the undocumented assumption that at least one of the PCBrwatson2002-08-012-0/+4
| | | | | | | | | pointer and incoming mbuf pointer will be non-NULL in tcp_respond(). This is relied on by the MAC code for correctness, as well as existing code. Obtained from: TrustedBSD PRoject Sponsored by: DARPA, NAI Labs
* Introduce support for Mandatory Access Control and extensiblerwatson2002-08-011-0/+5
| | | | | | | | | | | | | kernel access control. Add support for labeling most out-going ICMP messages using an appropriate MAC entry point. Currently, we do not explicitly label packet reflect (timestamp, echo request) ICMP events, implicitly using the originating packet label since the mbuf is reused. This will be made explicit at some point. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Introduce support for Mandatory Access Control and extensiblerwatson2002-08-012-0/+24
| | | | | | | | | | kernel access control. Instrument chdir() and chroot()-related system calls to invoke appropriate MAC entry points to authorize the two operations. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
OpenPOWER on IntegriCloud