summaryrefslogtreecommitdiffstats
path: root/sys
Commit message (Collapse)AuthorAgeFilesLines
* Introduce support for Mandatory Access Control and extensiblerwatson2002-07-311-0/+8
| | | | | | | | | | | | | | | kernel access control. When fragmenting an IP datagram, invoke an appropriate MAC entry point so that MAC labels may be copied (...) to the individual IP fragment mbufs by MAC policies. When IP options are inserted into an IP datagram when leaving a host, preserve the label if we need to reallocate the mbuf for alignment or size reasons. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Introduce support for Mandatory Access Control and extensiblerwatson2002-07-311-0/+17
| | | | | | | | | | | | | | | | kernel access control. Instrument the code managing IP fragment reassembly queues (struct ipq) to invoke appropriate MAC entry points to maintain a MAC label on each queue. Permit MAC policies to associate information with a queue based on the mbuf that caused it to be created, update that information based on further mbufs accepted by the queue, influence the decision making process by which mbufs are accepted to the queue, and set the label of the mbuf holding the reassembled datagram following reassembly completetion. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Introduce support for Mandatory Access Control and extensiblerwatson2002-07-311-0/+6
| | | | | | | | | | | kernel access control. When generating an IGMP message, invoke a MAC entry point to permit the MAC framework to label its mbuf appropriately for the target interface. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Introduce support for Mandatory Access Control and extensiblerwatson2002-07-311-0/+5
| | | | | | | | | | kernel access control. When generating an ARP query, invoke a MAC entry point to permit the MAC framework to label its mbuf appropriately for the interface. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Introduce support for Mandatory Access Control and extensiblerwatson2002-07-311-0/+6
| | | | | | | | | | | kernel access control. Invoke the MAC framework to label mbuf created using divert sockets. These labels may later be used for access control on delivery to another socket, or to an interface. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI LAbs
* Introduce support for Mandatory Access Control and extensiblerwatson2002-07-311-0/+21
| | | | | | | | | | | | | kernel access control. Instrument connect(), listen(), and bind() system calls to invoke MAC framework entry points to permit policies to authorize these requests. This can be useful for policies that want to limit the activity of processes involving particular types of IPC and network activity. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Introduce support for Mandatory Access Control and extensiblerwatson2002-07-311-0/+16
| | | | | | | | | | | | | | | | | kernel access control. Label mbufs received via kernel tunnel device interfaces by invoking appropriate MAC framework entry points. Perform access control checks on out-going mbufs delivered via tunnel interfaces by invoking appropriate MAC entry points: NOTE: Currently the label for a tunnel interface is not derived from the label of the process that opened the tunnel interface. It probably should be. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* These file are no longer used (moved to userland and/or merged intojake2002-07-315-689/+0
| | | | pmap.c).
* Introduce support for Mandatory Access Control and extensiblerwatson2002-07-311-0/+12
| | | | | | | | | | | | | | kernel access control. Label mbufs received via ethernet-based interfaces by invoking appropriate MAC framework entry points. Perform access control checks on out-going mbufs delivered via ethernet-based interfaces by invoking appropriate MAC entry points. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Introduce support for Mandatory Access Control and extensiblerwatson2002-07-311-0/+11
| | | | | | | | | | | | | kernel access control. Instrument the interface management code so that MAC labels are properly maintained on network interfaces (struct ifnet). In particular, invoke entry points when interfaces are created and removed. MAC policies may initialized the label interface based on a variety of factors, including the interface name. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Introduce support for Mandatory Access Control and extensiblerwatson2002-07-311-0/+6
| | | | | | | | | | kernel access control. When decompressing data from one mbuf into another mbuf, preserve the mbuf label by copying it to the new mbuf. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Introduce support for Mandatory Access Control and extensiblerwatson2002-07-311-2/+6
| | | | | | | | | | | | kernel access control. Invoke a MAC framework entry point to authorize reception of an incoming mbuf by the BPF descriptor, permitting MAC policies to limit the visibility of packets delivered to particular BPF descriptors. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Introduce support for Mandatory Access Control and extensiblerwatson2002-07-311-0/+12
| | | | | | | | | | | | | | kernel access control. Instrument BPF so that MAC labels are properly maintained on BPF descriptors. MAC framework entry points are invoked at BPF instantiation and allocation, permitting the MAC framework to derive the BPF descriptor label from the credential authorizing the device open. Also enter the MAC framework to label mbufs created using the BPF device. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Introduce support for Mandatory Access Control and extensiblerwatson2002-07-311-1/+31
| | | | | | | | | | | | | | | | | | | | kernel access control. Instrument UFS to support per-inode MAC labels. In particular, invoke MAC framework entry points for generically supporting the backing of MAC labels into extended attributes. This ends up introducing new vnode operation vector entries point at the MAC framework entry points, as well as some explicit entry point invocations for file and directory creation events so that the MAC framework can push labels to disk before the directory names become persistent (this will work better once EAs in UFS2 are hooked into soft updates). The generic EA MAC entry points support executing with the file system in either single label or multilabel operation, and will fall back to the mount label if multilabel is not specified at mount-time. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* These were repo-copied to have a .S extension.jake2002-07-316-4398/+0
|
* Add pathconf/fpathconf entries from POSIX.1e indicating support forrwatson2002-07-311-0/+11
| | | | | ACLs, Capabilities, Information Labels, and MAC Labels on the queried file system.
* *.s -> *.S.jake2002-07-312-11/+11
|
* Introduce support for Mandatory Access Control and extensiblerwatson2002-07-313-0/+90
| | | | | | | | | | | | | | | | kernel access control. Instrument devfs to support per-dirent MAC labels. In particular, invoke MAC framework when devfs directory entries are instantiated due to make_dev() and related calls, and invoke the MAC framework when vnodes are instantiated from these directory entries. Implement vop_setlabel() for devfs, which pushes the label update into the devfs directory entry for semi-persistant store. This permits the MAC framework to assign labels to devices and directories as they are instantiated, and export access control information via devfs vnodes. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Moved the rule for locore.o from kern.post.mk to Makefile.$ARCH.jake2002-07-318-3/+21
|
* Replace the FOO_DEBUG definitions with USB_DEBUG, and switch thejoe2002-07-3123-174/+110
| | | | | | debugging levels to off by default. Now that debug levels can be tweaked by sysctl we don't need to go through hoops to get the different usb parts to produce debug data.
* Make this compile with the debugging options switched on.joe2002-07-311-0/+7
|
* Wake up Joe! It would help if I included sys/sysctl.h.joe2002-07-311-0/+1
|
* Add a sysctl (debug.usb.uhub) for tweaking the uhub debug levels.joe2002-07-311-1/+3
|
* The Elan SC520 MMCR is actually 16bit wide, so u_char is inconvenient.phk2002-07-314-4/+4
|
* Get bored with hard coded debug level variables and introduce a debug.usbjoe2002-07-3120-17/+58
| | | | | | sysctl tree for tweaking them real-time. Reviewed by: iedowse
* Have the kern.file sysctl export xfiles rather than files. The truth isdes2002-07-311-25/+52
| | | | | | out there! Sponsored by: DARPA, NAI Labs
* Nit in previous commit: the correct sysctl type is "S,xvnode"des2002-07-311-1/+1
|
* Initialize v_cachedid to -1 in getnewvnode().des2002-07-311-42/+66
| | | | | | | Reintroduce the kern.vnode sysctl and make it export xvnodes rather than vnodes. Sponsored by: DARPA, NAI Labs
* Introduce struct xvnode, which will be used instead of struct vnode fordes2002-07-312-0/+39
| | | | | | | | sysctl purposes. Also add two fields to struct vnode, v_cachedfs and v_cachedid, which hold the vnode's device and file id and are filled in by vn_open_cred() and vn_stat(). Sponsored by: DARPA, NAI Labs
* Add struct xfile, which will be used instead of struct file for sysctldes2002-07-311-8/+32
| | | | | | purposes. Sponsored by: DARPA, NAI Labs
* It should be "ucom", not "usio".joe2002-07-311-1/+1
|
* Regenjoe2002-07-312-2/+37
|
* MFNetBSD: uvisor.c (1.14, 1.15)joe2002-07-312-9/+56
| | | | Add support for Palm (M500, M505, M125) and Sony devices (Clie 4.0 and 4.1).
* Remove trailing white spacesjoe2002-07-311-3/+9
| | | | Obtained from: NetBSD (1.16)
* Regenjoe2002-07-312-2/+23
|
* Add the HP ScanJet 2200C.joe2002-07-311-0/+1
|
* Enable the HP 2200C and Visioneer Scanport 3000 scanners, and removejoe2002-07-312-4/+7
| | | | | | some trailing spaces whilst I'm here. Obtained from: NetBSD.
* Add the Primax (Visioneer) 6200 scanner.joe2002-07-312-0/+2
| | | | Obtained from: OpenBSD (via NetBSD)
* o Lock page accesses by vm_page_io_start() with the page queues lock.alc2002-07-312-2/+6
| | | | o Assert that the page queues lock is held in vm_page_io_start().
* I forgot this bit of uglyness in the fsck_ffs cleanup.phk2002-07-311-0/+1
|
* Introduce support for Mandatory Access Control and extensiblerwatson2002-07-314-0/+29
| | | | | | | | | | | | | | | kernel access control. Invoke the necessary MAC entry points to maintain labels on sockets. In particular, invoke entry points during socket allocation and destruction, as well as creation by a process or during an accept-scenario (sonewconn). For UNIX domain sockets, also assign a peer label. As the socket code isn't locked down yet, locking interactions are not yet clear. Various protocol stack socket operations (such as peer label assignment for IPv4) will follow. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Note that the privilege indicating flag to vaccess() originally usedrwatson2002-07-311-1/+1
| | | | by the process accounting system is now deprecated.
* Introduce support for Mandatory Access Control and extensiblerwatson2002-07-311-0/+8
| | | | | | | | | | | | | kernel access control. Invoke the necessary MAC entry points to maintain labels on vnodes. In particular, initialize the label when the vnode is allocated or reused, and destroy the label when the vnode is going to be released, or reused. Wow, an object where there really is exactly one place where it's allocated, and one other where it's freed. Amazing. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Introduce support for Mandatory Access Control and extensiblerwatson2002-07-311-0/+14
| | | | | | | | | | | | | | | kernel access control. Invoke additional MAC entry points when an mbuf packet header is copied to another mbuf: release the old label if any, reinitialize the new header, and ask the MAC framework to copy the header label data. Note that this requires a potential allocation operation, but m_copy_pkthdr() is not permitted to fail, so we must block. Since we now use interrupt threads, this is possible, but not desirable. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Introduce support for Mandatory Access Control and extensiblerwatson2002-07-311-1/+22
| | | | | | | | | | | | | | | | kernel access control. Invoke the necessary MAC entry points to maintain labels on header mbufs. In particular, invoke entry points during the two mbuf header allocation cases, and the mbuf freeing case. Pass the "how" argument at allocation time to the MAC framework so that it can determine if it is permitted to block (as with policy modules), and permit the initialization entry point to fail if it needs to allocate memory but is not permitted to, failing the mbuf allocation. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Introduce support for Mandatory Access Control and extensiblerwatson2002-07-312-0/+46
| | | | | | | | | | | | | kernel access control. Implement MAC framework access control entry points relating to operations on mountpoints. Currently, this consists only of access control on mountpoint listing using the various statfs() variations. In the future, it might also be desirable to implement checks on mount() and unmount(). Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Introduce support for Mandatory Access Control and extensiblerwatson2002-07-312-1/+36
| | | | | | | | | | | | | | | kernel access control. Invoke the necessary MAC entry points to maintain labels on mount structures. In particular, invoke entry points for intialization and destruction in various scenarios (root, non-root). Also introduce an entry point in the boot procedure following the mount of the root file system, but prior to the start of the userland init process to permit policies to perform further initialization. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Introduce support for Mandatory Access Control and extensiblerwatson2002-07-311-3/+21
| | | | | | | | | | | | kernel access control. Implement inter-process access control entry points for the MAC framework. This permits policy modules to augment the decision making process for process and socket visibility, process debugging, re-scheduling, and signaling. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Fix a problem with sendfile() syscall by always doing I/O via bread() insemenu2002-07-311-13/+28
| | | | | | | | ntfs_read(). This guarantee that requested cache pages will be valid if UIO_NOCOPY specifed. PR: bin/34072, bin/36189 MFC after: 1 week
* Introduce support for Mandatory Access Control and extensiblerwatson2002-07-312-0/+19
| | | | | | | | | | | | | | kernel access control. Invoke the necessary MAC entry points to maintain labels on process credentials. In particular, invoke entry points for the initialization and destruction of struct ucred, the copying of struct ucred, and permit the initial labels to be set for both process 0 (parent of all kernel processes) and process 1 (parent of all user processes). Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
OpenPOWER on IntegriCloud