aboutsummaryrefslogtreecommitdiff
path: root/sys/security/mac/mac_framework.c
Commit message (Collapse)AuthorAgeFilesLines
* sys: Automated cleanup of cdefs and other formattingWarner Losh2023-11-271-1/+0
| | | | | | | | | | | | | | | | Apply the following automated changes to try to eliminate no-longer-needed sys/cdefs.h includes as well as now-empty blank lines in a row. Remove /^#if.*\n#endif.*\n#include\s+<sys/cdefs.h>.*\n/ Remove /\n+#include\s+<sys/cdefs.h>.*\n+#if.*\n#endif.*\n+/ Remove /\n+#if.*\n#endif.*\n+/ Remove /^#if.*\n#endif.*\n/ Remove /\n+#include\s+<sys/cdefs.h>\n#include\s+<sys/types.h>/ Remove /\n+#include\s+<sys/cdefs.h>\n#include\s+<sys/param.h>/ Remove /\n+#include\s+<sys/cdefs.h>\n#include\s+<sys/capsicum.h>/ Sponsored by: Netflix
* Remove gratuitous copyouts of unchanged struct mac.Brooks Davis2023-11-131-2/+1
| | | | | | | | | | | | | The get operations change the data pointed to by the structure, but do not update the contents of the struct. Mark the struct mac arguments of mac_[gs]etsockopt_*label() and mac_check_structmac_consistent() const to prevent this from changing in the future. Reviewed by: markj MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D14488
* sys: Remove $FreeBSD$: one-line .c patternWarner Losh2023-08-161-2/+0
| | | | Remove /^[\s*]*__FBSDID\("\$FreeBSD\$"\);?\s*\n/
* mac: Honor order when registering MAC modules.Steve Kiernan2023-04-181-22/+16
| | | | | | | | Ensure MAC modules are inserted in order that they are registered. Reviewed by: markj Obtained from: Juniper Networks, Inc. Differential Revision: https://reviews.freebsd.org/D39589
* mac: cheaper check for mac_pipe_check_readMateusz Guzik2022-08-171-0/+3
| | | | | Reviewed by: markj Differential Revision: https://reviews.freebsd.org/D36082
* mac: cheaper check for ifnet_create_mbuf and ifnet_check_transmitMateusz Guzik2021-06-291-0/+6
| | | | Sponsored by: Rubicon Communications, LLC ("Netgate")
* mac: cheaper check for mac_vnode_check_readlinkMateusz Guzik2021-01-081-0/+3
|
* cache: combine fast path enabled status into one flagMateusz Guzik2021-01-061-0/+3
| | | | Tested by: pho
* pipe: allow for lockless pipe_statMateusz Guzik2020-11-191-0/+6
| | | | | | | | | | | | | | | | | | pipes get stated all thet time and this avoidably contributed to contention. The pipe lock is only held to accomodate MAC and to check the type. Since normally there is no probe for pipe stat depessimize this by having the flag. The pipe_state field gets modified with locks held all the time and it's not feasible to convert them to use atomic store. Move the type flag away to a separate variable as a simple cleanup and to provide stable field to read. Use short for both fields to avoid growing the struct. While here short-circuit MAC for pipe_poll as well. Notes: svn path=/head/; revision=367833
* vfs: add a cheaper entry for mac_vnode_check_accessMateusz Guzik2020-08-051-0/+3
| | | | Notes: svn path=/head/; revision=363886
* vfs: elide MAC-induced locking on rename if there are no relevant hoooksMateusz Guzik2020-07-291-0/+3
| | | | Notes: svn path=/head/; revision=363668
* vfs: fix vn_poll performance with either MAC or AUDITMateusz Guzik2020-07-161-1/+12
| | | | | | | | | | | | | | | | | | | | The code would unconditionally lock the vnode to audit or call the mac hoook, even if neither want to do anything. Pre-check the state to avoid locking in the common case of nothing to do. Note this code should not be normally executed anyway as vnodes are always return ready. However, poll1/2 from will-it-scale use regular files for benchmarking, presumably to focus on the interface itself as the vnode handler is not supposed to do almost anything. This in particular fixes poll2 which passes 128 fds. $ ./poll2_processes -s 10 before: 134411 after: 271572 Notes: svn path=/head/; revision=363249
* mac_policy: Remove mac_policy_sxJason A. Harmening2020-04-041-8/+3
| | | | | | | | | | This lock was made unnecessary by the addition of mac_policy_rms in r356120. Reviewed by: mjg, kib Differential Revision: https://reviews.freebsd.org/D24283 Notes: svn path=/head/; revision=359628
* Mark more nodes as CTLFLAG_MPSAFE or CTLFLAG_NEEDGIANT (17 of many)Pawel Biernacki2020-02-261-1/+1
| | | | | | | | | | | | | | | | | | | r357614 added CTLFLAG_NEEDGIANT to make it easier to find nodes that are still not MPSAFE (or already are but aren’t properly marked). Use it in preparation for a general review of all nodes. This is non-functional change that adds annotations to SYSCTL_NODE and SYSCTL_PROC nodes using one of the soon-to-be-required flags. Mark all obvious cases as MPSAFE. All entries that haven't been marked as MPSAFE before are by default marked as NEEDGIANT Approved by: kib (mentor, blanket) Commented by: kib, gallatin, melifaro Differential Revision: https://reviews.freebsd.org/D23718 Notes: svn path=/head/; revision=358333
* vfs: use mac fastpath for lookup, open, read, write, mmapMateusz Guzik2020-02-131-0/+18
| | | | Notes: svn path=/head/; revision=357889
* mac: implement fast path for checksMateusz Guzik2020-02-131-0/+95
| | | | | | | | | | | | | | | | All checking routines walk a linked list of all modules in order to determine if given hook is installed. This became a significant problem after mac_ntpd started being loaded by default. Implement a way perform checks for select hooks by testing a boolean. Use it for priv_check and priv_grant, which are constantly called from priv_check. The real fix would use hotpatching, but the above provides a way to know when to do it. Notes: svn path=/head/; revision=357887
* mac: use a sleepable rmlock instead of an sx lockMateusz Guzik2019-12-271-2/+6
| | | | | | | | | | | | | | If any non-static modules are loaded (and mac_ntpd tends to be), the lock is taken all the time al over the kernel. On platforms like arm64 this results in an avoidable significant performance degradation. Since write-locking is almost never needed, use a primitive optimized towards read-locking. Sample result of building the kernel on tmpfs 11 times: stock 11142.80s user 6704.44s system 4924% cpu 6:02.42 total patched 11118.95s user 2374.94s system 4547% cpu 4:56.71 total Notes: svn path=/head/; revision=356120
* Require that MAC label buffers be able to store a non-empty string.Mark Johnston2018-08-011-1/+3
| | | | | | | | | | | | | | | The buffer size may be used to initialize an sbuf in MAC_POLICY_EXTERNALIZE, and without this constraint it's possible to trigger an assertion failure in the sbuf code. With INVARIANTS disabled, the first attempt to write to the sbuf will fail. Reported by: pho Reviewed by: delphij MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D16527 Notes: svn path=/head/; revision=337031
* sys/security: minor spelling fixes.Pedro F. Giffuni2016-05-061-1/+1
| | | | | | | No functional change. Notes: svn path=/head/; revision=299187
* Fix style issues around existing SDT probes.Mark Johnston2015-12-161-6/+6
| | | | | | | | | | | | - Use SDT_PROBE<N>() instead of SDT_PROBE(). This has no functional effect at the moment, but will be needed for some future changes. - Don't hardcode the module component of the probe identifier. This is set automatically by the SDT framework. MFC after: 1 week Notes: svn path=/head/; revision=292384
* As constantly reported during kernel compilation, m_buflen is unsigned soBjoern A. Zeeb2013-12-251-2/+1
| | | | | | | | | can never be < 0. Remove the expression, which can never be true. MFC after: 1 week Notes: svn path=/head/; revision=259885
* dtrace sdt: remove the ugly sname parameter of SDT_PROBE_DEFINEAndriy Gapon2013-11-261-3/+3
| | | | | | | | | | | In its stead use the Solaris / illumos approach of emulating '-' (dash) in probe names with '__' (two consecutive underscores). Reviewed by: markj MFC after: 3 weeks Notes: svn path=/head/; revision=258622
* - For kernel compiled only with KDTRACE_HOOKS and not any lock debuggingAttilio Rao2013-11-251-1/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | option, unbreak the lock tracing release semantic by embedding calls to LOCKSTAT_PROFILE_RELEASE_LOCK() direclty in the inlined version of the releasing functions for mutex, rwlock and sxlock. Failing to do so skips the lockstat_probe_func invokation for unlocking. - As part of the LOCKSTAT support is inlined in mutex operation, for kernel compiled without lock debugging options, potentially every consumer must be compiled including opt_kdtrace.h. Fix this by moving KDTRACE_HOOKS into opt_global.h and remove the dependency by opt_kdtrace.h for all files, as now only KDTRACE_FRAMES is linked there and it is only used as a compile-time stub [0]. [0] immediately shows some new bug as DTRACE-derived support for debug in sfxge is broken and it was never really tested. As it was not including correctly opt_kdtrace.h before it was never enabled so it was kept broken for a while. Fix this by using a protection stub, leaving sfxge driver authors the responsibility for fixing it appropriately [1]. Sponsored by: EMC / Isilon storage division Discussed with: rstone [0] Reported by: rstone [1] Discussed with: philip Notes: svn path=/head/; revision=258541
* Fix some typos that were causing probe argument types to show up as unknown.Mark Johnston2013-10-011-1/+1
| | | | | | | | | Reviewed by: rwatson (mac provider) Approved by: re (glebius) MFC after: 1 week Notes: svn path=/head/; revision=255971
* Make the mac_policy_rm lock recursable, which allows reentrance intoKonstantin Belousov2013-09-291-1/+2
| | | | | | | | | | | | | | the mac framework. It is needed when priv_check_cred(9) is called from the mac callback, e.g. in the mac_portacl(4). Reported by: az Reviewed by: rwatson Sponsored by: The FreeBSD Foundation MFC after: 1 week Approved by: re (gjb) Notes: svn path=/head/; revision=255945
* put sys/systm.h at its proper place or add it if missingAndriy Gapon2011-12-121-1/+1
| | | | | | | | | | Reported by: lstewart, tinderbox Pointyhat to: avg, attilio MFC after: 1 week MFC with: r228430 Notes: svn path=/head/; revision=228433
* sysctl(9) cleanup checkpoint: amd64 GENERIC builds cleanly.Matthew D Fleming2011-01-121-1/+1
| | | | | | | Commit the security directory. Notes: svn path=/head/; revision=217325
* Add an extra comment to the SDT probes definition. This allows us to getRui Paulo2010-08-221-3/+5
| | | | | | | | | | | | use '-' in probe names, matching the probe names in Solaris.[1] Add userland SDT probes definitions to sys/sdt.h. Sponsored by: The FreeBSD Foundation Discussed with: rwaston [1] Notes: svn path=/head/; revision=211616
* Mark MAC Framework sx and rm locks as NOWITNESS to suppress warnings thatRobert Watson2009-06-021-2/+2
| | | | | | | | | | | | might arise from WITNESS not understanding its locking protocol, which should be deadlock-free. Currently these warnings generally don't occur, but as object locking is pushed into policies for some object types, they would otherwise occur more often. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=193355
* Add internal 'mac_policy_count' counter to the MAC Framework, which is aRobert Watson2009-06-021-5/+11
| | | | | | | | | | | | | | | | | | | | | count of the number of registered policies. Rather than unconditionally locking sockets before passing them into MAC, lock them in the MAC entry points only if mac_policy_count is non-zero. This avoids locking overhead for a number of socket system calls when no policies are registered, eliminating measurable overhead for the MAC Framework for the socket subsystem when there are no active policies. Possibly socket locks should be acquired by policies if they are required for socket labels, which would further avoid locking overhead when there are policies but they don't require labeling of sockets, or possibly don't even implement socket controls. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=193332
* Make the rmlock(9) interface a bit more like the rwlock(9) interface:Robert Watson2009-05-291-1/+1
| | | | | | | | | | | | | | | | | - Add rm_init_flags() and accept extended options only for that variation. - Add a flags space specifically for rm_init_flags(), rather than borrowing the lock_init() flag space. - Define flag RM_RECURSE to use instead of LO_RECURSABLE. - Define flag RM_NOWITNESS to allow an rmlock to be exempt from WITNESS checking; this wasn't possible previously as rm_init() always passed LO_WITNESS when initializing an rmlock's struct lock. - Add RM_SYSINIT_FLAGS(). - Rename embedded mutex in rmlocks to make it more obvious what it is. - Update consumers. - Update man page. Notes: svn path=/head/; revision=193030
* Convert the MAC Framework from using rwlocks to rmlocks to stabilizeRobert Watson2009-05-271-11/+11
| | | | | | | | | framework registration for non-sleepable entry points. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=192881
* Rework MAC Framework synchronization in a number of ways in order toRobert Watson2009-03-141-112/+73
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | improve performance: - Eliminate custom reference count and condition variable to monitor threads entering the framework, as this had both significant overhead and behaved badly in the face of contention. - Replace reference count with two locks: an rwlock and an sx lock, which will be read-acquired by threads entering the framework depending on whether a give policy entry point is permitted to sleep or not. - Replace previous mutex locking of the reference count for exclusive access with write acquiring of both the policy list sx and rw locks, which occurs only when policies are attached or detached. - Do a lockless read of the dynamic policy list head before acquiring any locks in order to reduce overhead when no dynamic policies are loaded; this a race we can afford to lose. - For every policy entry point invocation, decide whether sleeping is permitted, and if not, use a _NOSLEEP() variant of the composition macros, which will use the rwlock instead of the sxlock. In some cases, we decide which to use based on allocation flags passed to the MAC Framework entry point. As with the move to rwlocks/rmlocks in pfil, this may trigger witness warnings, but these should (generally) be false positives as all acquisition of the locks is for read with two very narrow exceptions for policy load/unload, and those code blocks should never acquire other locks. Sponsored by: Google, Inc. Obtained from: TrustedBSD Project Discussed with: csjp (idea, not specific patch) Notes: svn path=/head/; revision=189797
* Improve the consistency of MAC Framework and MAC policy entry pointRobert Watson2009-03-081-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | naming by renaming certain "proc" entry points to "cred" entry points, reflecting their manipulation of credentials. For some entry points, the process was passed into the framework but not into policies; in these cases, stop passing in the process since we don't need it. mac_proc_check_setaudit -> mac_cred_check_setaudit mac_proc_check_setaudit_addr -> mac_cred_check_setaudit_addr mac_proc_check_setauid -> mac_cred_check_setauid mac_proc_check_setegid -> mac_cred_check_setegid mac_proc_check_seteuid -> mac_cred_check_seteuid mac_proc_check_setgid -> mac_cred_check_setgid mac_proc_check_setgroups -> mac_cred_ceck_setgroups mac_proc_check_setregid -> mac_cred_check_setregid mac_proc_check_setresgid -> mac_cred_check_setresgid mac_proc_check_setresuid -> mac_cred_check_setresuid mac_proc_check_setreuid -> mac_cred_check_setreuid mac_proc_check_setuid -> mac_cred_check_setuid Obtained from: TrustedBSD Project Sponsored by: Google, Inc. Notes: svn path=/head/; revision=189529
* Add static DTrace probes for MAC Framework access control checks andRobert Watson2009-03-081-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | privilege grants so that dtrace can be more easily used to monitor the security decisions being generated by the MAC Framework following policy invocation. Successful access control checks will be reported by: mac_framework:kernel:<entrypoint>:mac_check_ok Failed access control checks will be reported by: mac_framework:kernel:<entrypoint>:mac_check_err Successful privilege grants will be reported by: mac_framework:kernel:priv_grant:mac_grant_ok Failed privilege grants will be reported by: mac_framework:kernel:priv_grant:mac_grant_err In all cases, the return value (always 0 for _ok, otherwise an errno for _err) will be reported via arg0 on the probe, and subsequent arguments will hold entrypoint-specific data, in a style similar to privilege tracing. Obtained from: TrustedBSD Project Sponsored by: Google, Inc. Notes: svn path=/head/; revision=189503
* Reduce the verbosity of SDT trace points for DTrace by defining severalRobert Watson2009-03-031-12/+3
| | | | | | | | | | | | | | wrapper macros that allow trace points and arguments to be declared using a single macro rather than several. This means a lot less repetition and vertical space for each trace point. Use these macros when defining privilege and MAC Framework trace points. Reviewed by: jb MFC after: 1 week Notes: svn path=/head/; revision=189311
* Begin to add SDT tracing of the MAC Framework: add policy modevent,Robert Watson2009-01-241-1/+24
| | | | | | | | | | | register, and unregister hooks that give access to the mac_policy_conf for the policy. Obtained from: TrustedBSD Project MFC after: 3 days Notes: svn path=/head/; revision=187666
* Rather than having MAC policies explicitly declare what object typesRobert Watson2009-01-101-7/+45
| | | | | | | | | | | | | | | | | they label, derive that information implicitly from the set of label initializers in their policy operations set. This avoids a possible class of programmer errors, while retaining the structure that allows us to avoid allocating labels for objects that don't need them. As before, we regenerate a global mask of labeled objects each time a policy is loaded or unloaded, stored in mac_labeled. Discussed with: csjp Suggested by: Jacques Vidrine <nectar at apple.com> Obtained from: TrustedBSD Project Sponsored by: Apple, Inc. Notes: svn path=/head/; revision=187016
* Introduce two related changes to the TrustedBSD MAC Framework:Robert Watson2008-08-231-29/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | (1) Abstract interpreter vnode labeling in execve(2) and mac_execve(2) so that the general exec code isn't aware of the details of allocating, copying, and freeing labels, rather, simply passes in a void pointer to start and stop functions that will be used by the framework. This change will be MFC'd. (2) Introduce a new flags field to the MAC_POLICY_SET(9) interface allowing policies to declare which types of objects require label allocation, initialization, and destruction, and define a set of flags covering various supported object types (MPC_OBJECT_PROC, MPC_OBJECT_VNODE, MPC_OBJECT_INPCB, ...). This change reduces the overhead of compiling the MAC Framework into the kernel if policies aren't loaded, or if policies require labels on only a small number or even no object types. Each time a policy is loaded or unloaded, we recalculate a mask of labeled object types across all policies present in the system. Eliminate MAC_ALWAYS_LABEL_MBUF option as it is no longer required. MFC after: 1 week ((1) only) Reviewed by: csjp Obtained from: TrustedBSD Project Sponsored by: Apple, Inc. Notes: svn path=/head/; revision=182063
* Remove conditional return of 1. For the MAC_STATIC case at this point inChristian S.J. Peron2007-01-011-3/+0
| | | | | | | | | | the code, one being returned is invariant. Discussed with: rwatson MFC after: 1 week Notes: svn path=/head/; revision=165714
* Only signal the CV indicating that the MAC Framework is available forRobert Watson2006-12-311-6/+23
| | | | | | | | | | | | | | | | | exclusive access if there is at least one thread waiting for it to become available. This may significantly reduce overhead by reducing the number of unnecessary wakeups issued whenever the framework becomes idle. Annotate that we still signal the CV more than necessary and should fix this. Obtained from: TrustedBSD Project Reviewed by: csjp Tested by: csjp Notes: svn path=/head/; revision=165708
* Slightly resort functions in file so that no forward function prototypesRobert Watson2006-12-291-49/+46
| | | | | | | | | are required. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=165646
* Re-add include of opt_mac.h in mac_framework.c, which was improperlyRobert Watson2006-12-291-0/+2
| | | | | | | | removed from this file. It is required to pick up the definition of MAC_STATIC. Notes: svn path=/head/; revision=165645
* Centralize definition of MAC_VERSION in mac_policy.h, as it defines theRobert Watson2006-12-281-4/+3
| | | | | | | | | | | | | kernel<->policy ABI version. Add a comment to the definition describing it and listing known versions. Modify MAC_POLICY_SET() to reference the current kernel version by name rather than by number. Staticize mac_late, which is used only in mac_framework.c. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=165595
* Move mac_init_label() and mac_destroy_label() from mac_framework.c toRobert Watson2006-12-281-19/+0
| | | | | | | | | | mac_label.c, and use these instead of replicated code in the label zone constructor and destructor. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=165593
* Trim unneeded includes.Robert Watson2006-12-281-28/+0
| | | | Notes: svn path=/head/; revision=165591
* Break contents of kern_mac.c out into two files following a repo-copy:Robert Watson2006-12-281-672/+0
| | | | | | | | | | | | | | mac_framework.c Contains basic MAC Framework functions, policy registration, sysinits, etc. mac_syscalls.c Contains implementations of various MAC system calls, including ENOSYS stubs when compiling without options MAC. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=165590
* Update MAC Framework general comments, referencing various interfaces itRobert Watson2006-12-281-12/+40
| | | | | | | | | | | | | | | | | consumes and implements, as well as the location of the framework and policy modules. Refactor MAC Framework versioning a bit so that the current ABI version can be exported via a read-only sysctl. Further update comments relating to locking/synchronization. Update copyright to take into account these and other recent changes. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=165586
* Move src/sys/sys/mac_policy.h, the kernel interface between the MACRobert Watson2006-12-221-2/+1
| | | | | | | | | | | | | | Framework and security modules, to src/sys/security/mac/mac_policy.h, completing the removal of kernel-only MAC Framework include files from src/sys/sys. Update the MAC Framework and MAC policy modules. Delete the old mac_policy.h. Third party policy modules will need similar updating. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=165469
* Remove mac_enforce_subsystem debugging sysctls. Enforcement onRobert Watson2006-12-211-3/+1
| | | | | | | | | | | | | subsystems will be a property of policy modules, which may require access control check entry points to be invoked even when not actively enforcing (i.e., to track information flow without providing protection). Obtained from: TrustedBSD Project Suggested by: Christopher dot Vance at sparta dot com Notes: svn path=/head/; revision=165433
generated by cgit v1.2.3 (git 2.25.1) at 2024-10-14 20:26:29 +0000