summaryrefslogtreecommitdiffstats
path: root/sys
Commit message (Collapse)AuthorAgeFilesLines
...
* Make this compile with the debugging options switched on.joe2002-07-311-0/+7
|
* Wake up Joe! It would help if I included sys/sysctl.h.joe2002-07-311-0/+1
|
* Add a sysctl (debug.usb.uhub) for tweaking the uhub debug levels.joe2002-07-311-1/+3
|
* The Elan SC520 MMCR is actually 16bit wide, so u_char is inconvenient.phk2002-07-314-4/+4
|
* Get bored with hard coded debug level variables and introduce a debug.usbjoe2002-07-3120-17/+58
| | | | | | sysctl tree for tweaking them real-time. Reviewed by: iedowse
* Have the kern.file sysctl export xfiles rather than files. The truth isdes2002-07-311-25/+52
| | | | | | out there! Sponsored by: DARPA, NAI Labs
* Nit in previous commit: the correct sysctl type is "S,xvnode"des2002-07-311-1/+1
|
* Initialize v_cachedid to -1 in getnewvnode().des2002-07-311-42/+66
| | | | | | | Reintroduce the kern.vnode sysctl and make it export xvnodes rather than vnodes. Sponsored by: DARPA, NAI Labs
* Introduce struct xvnode, which will be used instead of struct vnode fordes2002-07-312-0/+39
| | | | | | | | sysctl purposes. Also add two fields to struct vnode, v_cachedfs and v_cachedid, which hold the vnode's device and file id and are filled in by vn_open_cred() and vn_stat(). Sponsored by: DARPA, NAI Labs
* Add struct xfile, which will be used instead of struct file for sysctldes2002-07-311-8/+32
| | | | | | purposes. Sponsored by: DARPA, NAI Labs
* It should be "ucom", not "usio".joe2002-07-311-1/+1
|
* Regenjoe2002-07-312-2/+37
|
* MFNetBSD: uvisor.c (1.14, 1.15)joe2002-07-312-9/+56
| | | | Add support for Palm (M500, M505, M125) and Sony devices (Clie 4.0 and 4.1).
* Remove trailing white spacesjoe2002-07-311-3/+9
| | | | Obtained from: NetBSD (1.16)
* Regenjoe2002-07-312-2/+23
|
* Add the HP ScanJet 2200C.joe2002-07-311-0/+1
|
* Enable the HP 2200C and Visioneer Scanport 3000 scanners, and removejoe2002-07-312-4/+7
| | | | | | some trailing spaces whilst I'm here. Obtained from: NetBSD.
* Add the Primax (Visioneer) 6200 scanner.joe2002-07-312-0/+2
| | | | Obtained from: OpenBSD (via NetBSD)
* o Lock page accesses by vm_page_io_start() with the page queues lock.alc2002-07-312-2/+6
| | | | o Assert that the page queues lock is held in vm_page_io_start().
* I forgot this bit of uglyness in the fsck_ffs cleanup.phk2002-07-311-0/+1
|
* Introduce support for Mandatory Access Control and extensiblerwatson2002-07-314-0/+29
| | | | | | | | | | | | | | | kernel access control. Invoke the necessary MAC entry points to maintain labels on sockets. In particular, invoke entry points during socket allocation and destruction, as well as creation by a process or during an accept-scenario (sonewconn). For UNIX domain sockets, also assign a peer label. As the socket code isn't locked down yet, locking interactions are not yet clear. Various protocol stack socket operations (such as peer label assignment for IPv4) will follow. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Note that the privilege indicating flag to vaccess() originally usedrwatson2002-07-311-1/+1
| | | | by the process accounting system is now deprecated.
* Introduce support for Mandatory Access Control and extensiblerwatson2002-07-311-0/+8
| | | | | | | | | | | | | kernel access control. Invoke the necessary MAC entry points to maintain labels on vnodes. In particular, initialize the label when the vnode is allocated or reused, and destroy the label when the vnode is going to be released, or reused. Wow, an object where there really is exactly one place where it's allocated, and one other where it's freed. Amazing. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Introduce support for Mandatory Access Control and extensiblerwatson2002-07-311-0/+14
| | | | | | | | | | | | | | | kernel access control. Invoke additional MAC entry points when an mbuf packet header is copied to another mbuf: release the old label if any, reinitialize the new header, and ask the MAC framework to copy the header label data. Note that this requires a potential allocation operation, but m_copy_pkthdr() is not permitted to fail, so we must block. Since we now use interrupt threads, this is possible, but not desirable. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Introduce support for Mandatory Access Control and extensiblerwatson2002-07-311-1/+22
| | | | | | | | | | | | | | | | kernel access control. Invoke the necessary MAC entry points to maintain labels on header mbufs. In particular, invoke entry points during the two mbuf header allocation cases, and the mbuf freeing case. Pass the "how" argument at allocation time to the MAC framework so that it can determine if it is permitted to block (as with policy modules), and permit the initialization entry point to fail if it needs to allocate memory but is not permitted to, failing the mbuf allocation. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Introduce support for Mandatory Access Control and extensiblerwatson2002-07-312-0/+46
| | | | | | | | | | | | | kernel access control. Implement MAC framework access control entry points relating to operations on mountpoints. Currently, this consists only of access control on mountpoint listing using the various statfs() variations. In the future, it might also be desirable to implement checks on mount() and unmount(). Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Introduce support for Mandatory Access Control and extensiblerwatson2002-07-312-1/+36
| | | | | | | | | | | | | | | kernel access control. Invoke the necessary MAC entry points to maintain labels on mount structures. In particular, invoke entry points for intialization and destruction in various scenarios (root, non-root). Also introduce an entry point in the boot procedure following the mount of the root file system, but prior to the start of the userland init process to permit policies to perform further initialization. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Introduce support for Mandatory Access Control and extensiblerwatson2002-07-311-3/+21
| | | | | | | | | | | | kernel access control. Implement inter-process access control entry points for the MAC framework. This permits policy modules to augment the decision making process for process and socket visibility, process debugging, re-scheduling, and signaling. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Fix a problem with sendfile() syscall by always doing I/O via bread() insemenu2002-07-311-13/+28
| | | | | | | | ntfs_read(). This guarantee that requested cache pages will be valid if UIO_NOCOPY specifed. PR: bin/34072, bin/36189 MFC after: 1 week
* Introduce support for Mandatory Access Control and extensiblerwatson2002-07-312-0/+19
| | | | | | | | | | | | | | kernel access control. Invoke the necessary MAC entry points to maintain labels on process credentials. In particular, invoke entry points for the initialization and destruction of struct ucred, the copying of struct ucred, and permit the initial labels to be set for both process 0 (parent of all kernel processes) and process 1 (parent of all user processes). Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Regen.rwatson2002-07-315-11/+11
|
* Reduce the memory footprint of MAC in the base system by halvingrwatson2002-07-312-2/+2
| | | | | | | | | | the number of policy slots to 4. (Having run a quick errand, time to start on phase 2 of the MAC integration) Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Regenjoe2002-07-302-2/+9
|
* Add support for a couple of network adapters; the 3Com 3C460B andjoe2002-07-302-0/+3
| | | | | | the Belkin USB2LAN. Obtained from: NetBSD
* Remove some strange code that allocates memory and then immediatelyiedowse2002-07-301-26/+2
| | | | | | | | frees it again. The idea was to perform M_WAITOK allocations in a process context to reduce the risk of later interrupt-context M_NOWAIT allocations failing, but in fact this code can be called from contexts where it is not desirable to sleep (e.g. if_start routines), so it causes lots of witness "could sleep" warnings.
* Introduce support for Mandatory Access Control and extensiblerwatson2002-07-301-0/+1
| | | | | | | | | | | kernel access control. Label devfs directory entries, permitting labels to be maintained on device nodes in devfs instances persistently despite vnode recycling. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Introduce support for Mandatory Access Control and extensiblerwatson2002-07-301-0/+1
| | | | | | | | | | | | | | kernel access control. Label IP fragment reassembly queues, permitting security features to be maintained on those objects. ipq_label will be used to manage the reassembly of fragments into IP datagrams using security properties. This permits policies to deny the reassembly of fragments, as well as influence the resulting label of a datagram following reassembly. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Introduce support for Mandatory Access Control and extensiblerwatson2002-07-301-0/+2
| | | | | | | | | | | | | kernel access control. Label network interface structures, permitting security features to be maintained on those objects. if_label will be used to authorize data flow using the network interface. if_label will be protected using the same synchronization primitives as other mutable entries in struct ifnet. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Introduce support for Mandatory Access Control and extensiblerwatson2002-07-301-0/+2
| | | | | | | | | | | | | kernel access control. Label BPF descriptor objects, permitting security features to be maintained on those objects. bd_label will be used to authorize data flow from network interfaces to user processes. BPF labels are protected using the same synchronization model as other mutable data in the BPF descriptor. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Introduce support for Mandatory Access Control and extensiblerwatson2002-07-301-6/+8
| | | | | | | | | | | kernel access control. Replace 'void *' with 'struct mac *' now that mac.h is in the base tree. The current POSIX.1e-derived userland MAC interface is schedule for replacement, but will act as a functional placeholder until the replacement is done. These system calls allow userland processes to get and set labels on both the current process, as well as file system objects and file descriptor backed objects.
* Introduce support for Mandatory Access Control and extensible kernelrwatson2002-07-301-0/+3
| | | | | | | | | | | | | | | access control. Label socket IPC objects, permitting security features to be maintained at the granularity of the socket. Two labels are stored for each socket: the label of the socket itself, and a cached peer label permitting interogation of the remote endpoint. Since socket locking is not yet present in the base tree, these objects are not locked, but are assumed to follow the same semantics as other modifiable entries in the socket structure. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Introduce support for Mandatory Access Control and extensiblerwatson2002-07-301-0/+2
| | | | | | | | | | | | | kernel access control. Label pipe IPC objects, permitting security information to be maintained at the granularity of the pipe object. The label is shared between the two pipe endpoints in the style of the pipe mutex, and is maintained using similar conventions. The label is protected by the pipe mutex. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Fix path to other files.<arch> files.imp2002-07-301-2/+2
| | | | | | Fix disordering of libkern/crc32.c entry. MFC after: 1 day
* Introduce support for Mandatory Access Control and extensible kernelrwatson2002-07-301-1/+10
| | | | | | | | | | | | | | | | access control. Label process credentials, permitting security information to be maintained at the granularity of processes and cached credential objects. cr_label follows the semantics of other entries in struct ucred: when a credential is exclusively referenced, it may be modified. Otherwise, it must be treated as immutable. As with other interesting entries in struct ucred, failing to use the documented credential management APIs (such as crcopy, crdup, ...) can result in data corruption or incorrect behavior. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Begin committing support for Mandatory Access Control and extensiblerwatson2002-07-301-0/+3
| | | | | | | | | | | | | | | | | | | | kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. Label file system mount points, permitting security information to be maintained at the granularity of the file system. Two labels are currently maintained: a security label for the mount itself, and a default label for objects in the file system (in particular, for file systems not supporting per-vnode labeling directly). Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Begin committing support for Mandatory Access Control and extensiblerwatson2002-07-301-0/+19
| | | | | | | | | | | | | | | | | | | | | | | | | kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the operating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. Introduce two node vnode operations required to support MAC. First, VOP_REFRESHLABEL(), which will be invoked by callers requiring that vp->v_label be sufficiently "fresh" for access control purposes. Second, VOP_SETLABEL(), which be invoked by callers requiring that the passed label contents be updated. The file system is responsible for updating v_label if appropriate in coordination with the MAC framework, as well as committing to disk. File systems that are not MAC-aware need not implement these VOPs, as the MAC framework will default to maintaining a single label for all vnodes based on the label on the file system mount point. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Begin committing support for Mandatory Access Control and extensiblerwatson2002-07-301-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. Label vnodes, permitting security information to maintained at the granularity of the individual file, directory (et al). This data is protected by the vnode lock and may be read only when holding a shared lock, or modified only when holding an exclusive lock. Label information may be considered either the primary copy, or a cached copy. Individual file systems or kernel services may use the VCACHEDLABEL flag for accounting purposes to determine which it is. New VOPs will be introduced to refresh this label on demand, or to set the label value. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Begin committing support for Mandatory Access Control and extensiblerwatson2002-07-301-0/+7
| | | | | | | | | | | | | | | | | | | | kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. Label mbuf's with packet header data, permitting in-flight datagrams to be labeled in the TrustedBSD MAC implementation. Add a questionable recursive #include of sys/mac.h to maintain the current API for applications and kernel code including mbuf.h to get 'struct mbuf' definition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Call bpf_mtap() on output, to catch outgoing packets for e.g. tcpdump .fenner2002-07-301-1/+5
|
* Begin committing support for Mandatory Access Control and extensiblerwatson2002-07-309-0/+27144
| | | | | | | | | | | | | | | | | | | | kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
OpenPOWER on IntegriCloud