aboutsummaryrefslogtreecommitdiff
path: root/sys/security
Commit message (Collapse)AuthorAgeFilesLines
...
* Add an extra comment to the SDT probes definition. This allows us to getRui Paulo2010-08-222-13/+15
| | | | | | | | | | | | use '-' in probe names, matching the probe names in Solaris.[1] Add userland SDT probes definitions to sys/sdt.h. Sponsored by: The FreeBSD Foundation Discussed with: rwaston [1] Notes: svn path=/head/; revision=211616
* Add a case to make sure that internal audit records get convertedChristian S.J. Peron2010-05-041-0/+1
| | | | | | | | | to BSM format for lpathconf(2) events. MFC after: 2 weeks Notes: svn path=/head/; revision=207615
* Update device-labeling logic for Biba, LOMAC, and MLS to recognize new-styleRobert Watson2010-03-023-0/+3
| | | | | | | | | | pts devices when various policy ptys_equal flags are enabled. Submitted by: Estella Mystagic <estella at mystagic.com> MFC after: 1 week Notes: svn path=/head/; revision=204581
* Make sure we convert audit records that were produced as the result of theChristian S.J. Peron2010-01-311-0/+7
| | | | | | | closefrom(2) syscall. Notes: svn path=/head/; revision=203328
* Replace the static NGROUPS=NGROUPS_MAX+1=1024 with a dynamicBrooks Davis2010-01-121-2/+2
| | | | | | | | | | | kern.ngroups+1. kern.ngroups can range from NGROUPS_MAX=1023 to INT_MAX-1. Given that the Windows group limit is 1024, this range should be sufficient for most applications. MFC after: 1 month Notes: svn path=/head/; revision=202143
* Make mac_lomac(4) able to interpret NFSv4 access bits.Edward Tomasz Napierala2010-01-031-1/+1
| | | | | | | Reviewed by: rwatson Notes: svn path=/head/; revision=201438
* Having thrown the cat out of the house, add a necessary include.Poul-Henning Kamp2009-09-081-0/+1
| | | | Notes: svn path=/head/; revision=196971
* Revert previous commit and add myself to the list of people who shouldPoul-Henning Kamp2009-09-081-1/+0
| | | | | | | know better than to commit with a cat in the area. Notes: svn path=/head/; revision=196970
* Add necessary include.Poul-Henning Kamp2009-09-081-0/+1
| | | | Notes: svn path=/head/; revision=196969
* Correctly audit real gids following changes to the audit record argumentRobert Watson2009-08-121-1/+1
| | | | | | | | | interface. Approved by: re (kib) Notes: svn path=/head/; revision=196122
* Eliminate ARG_UPATH[12] arguments to AUDIT_ARG_UPATH() and insteadRobert Watson2009-07-293-89/+89
| | | | | | | | | | | | | | | provide specific macros, AUDIT_ARG_UPATH1() and AUDIT_ARG_UPATH2() to capture path information for audit records. This allows us to move the definitions of ARG_* out of the public audit header file, as they are an implementation detail of our current kernel-internal audit record, which may change. Approved by: re (kensmith) Obtained from: TrustedBSD Project MFC after: 1 month Notes: svn path=/head/; revision=195939
* Rework vnode argument auditing to follow the same structure, in orderRobert Watson2009-07-283-34/+50
| | | | | | | | | | | | | to avoid exposing ARG_ macros/flag values outside of the audit code in order to name which one of two possible vnodes will be audited for a system call. Approved by: re (kib) Obtained from: TrustedBSD Project MFC after: 1 month Notes: svn path=/head/; revision=195926
* Audit file descriptors passed to fooat(2) system calls, which are usedRobert Watson2009-07-286-83/+184
| | | | | | | | | | | | | | | | | | instead of the root/current working directory as the starting point for lookups. Up to two such descriptors can be audited. Add audit record BSM encoding for fooat(2). Note: due to an error in the OpenBSM 1.1p1 configuration file, a further change is required to that file in order to fix openat(2) auditing. Approved by: re (kib) Reviewed by: rdivacky (fooat(2) portions) Obtained from: TrustedBSD Project MFC after: 1 month Notes: svn path=/head/; revision=195925
* Import OpenBSM 1.1p1 from vendor branch to 8-CURRENT, populatingRobert Watson2009-07-172-8/+121
| | | | | | | | | | | | | | | | | | | | contrib/openbsm and a subset also imported into sys/security/audit. This patch release addresses several minor issues: - Fixes to AUT_SOCKUNIX token parsing. - IPv6 support for au_to_me(3). - Improved robustness in the parsing of audit_control, especially long flags/naflags strings and whitespace in all fields. - Add missing conversion of a number of FreeBSD/Mac OS X errnos to/from BSM error number space. MFC after: 3 weeks Obtained from: TrustedBSD Project Sponsored by: Apple, Inc. Approved by: re (kib) Notes: svn path=/head/; revision=195740
* Create audit records for AUE_POSIX_OPENPT, currently w/o arguments.Robert Watson2009-07-021-0/+1
| | | | | | | Approved by: re (audit argument blanket) Notes: svn path=/head/; revision=195291
* Fix comment misthink.Robert Watson2009-07-021-1/+1
| | | | | | | | | Submitted by: b. f. <bf1783 at googlemail.com> Approved by: re (audit argument blanket) MFC after: 1 week Notes: svn path=/head/; revision=195282
* Clean up a number of aspects of token generation from audit arguments toRobert Watson2009-07-021-69/+55
| | | | | | | | | | | | | | | | | | | system calls: - Centralize generation of argument tokens for VM addresses in a macro, ADDR_TOKEN(), and properly encode 64-bit addresses in 64-bit arguments. - Fix up argument numbers across a large number of syscalls so that they match the numeric argument into the system call. - Don't audit the address argument to ioctl(2) or ptrace(2), but do keep generating tokens for mmap(2), minherit(2), since they relate to passing object access across execve(2). Approved by: re (audit argument blanket) Obtained from: TrustedBSD Project MFC after: 1 week Notes: svn path=/head/; revision=195280
* For access(2) and eaccess(2), audit the requested access mode.Robert Watson2009-07-011-2/+9
| | | | | | | | Approved by: re (audit argument blanket) MFC after: 3 days Notes: svn path=/head/; revision=195267
* Define missing audit argument macro AUDIT_ARG_SOCKET(), andRobert Watson2009-07-011-0/+6
| | | | | | | | | | | capture the domain, type, and protocol arguments to socket(2) and socketpair(2). Approved by: re (audit argument blanket) MFC after: 3 days Notes: svn path=/head/; revision=195252
* When auditing unmount(2), capture FSID arguments as regular text stringsRobert Watson2009-07-011-0/+8
| | | | | | | | | | | | | rather than as paths, which would lead to them being treated as relative pathnames and hence confusingly converted into absolute pathnames. Capture flags to unmount(2) via an argument token. Approved by: re (audit argument blanket) MFC after: 3 days Notes: svn path=/head/; revision=195247
* Audit the file descriptor number passed to lseek(2).Robert Watson2009-07-011-1/+1
| | | | | | | | Approved by: re (kib) MFC after: 3 days Notes: svn path=/head/; revision=195242
* udit the 'options' argument to wait4(2).Robert Watson2009-07-011-0/+4
| | | | | | | | Approved by: re (kib) MFC after: 3 days Notes: svn path=/head/; revision=195235
* Dynamically allocate the gidset field in audit record.Stacey Son2009-06-293-2/+13
| | | | | | | | | | | | This fixes a problem created by the recent change that allows a large number of groups per user. The gidset field in struct kaudit_record is now dynamically allocated to the size needed rather than statically (using NGROUPS). Approved by: re@ (kensmith, rwatson), gnn (mentor) Notes: svn path=/head/; revision=195177
* Replace AUDIT_ARG() with variable argument macros with a set more moreRobert Watson2009-06-272-15/+174
| | | | | | | | | | | | | | | | | specific macros for each audit argument type. This makes it easier to follow call-graphs, especially for automated analysis tools (such as fxr). In MFC, we should leave the existing AUDIT_ARG() macros as they may be used by third-party kernel modules. Suggested by: brooks Approved by: re (kib) Obtained from: TrustedBSD Project MFC after: 1 week Notes: svn path=/head/; revision=195104
* Implement global and per-uid accounting of the anonymous memory. AddKonstantin Belousov2009-06-232-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | rlimit RLIMIT_SWAP that limits the amount of swap that may be reserved for the uid. The accounting information (charge) is associated with either map entry, or vm object backing the entry, assuming the object is the first one in the shadow chain and entry does not require COW. Charge is moved from entry to object on allocation of the object, e.g. during the mmap, assuming the object is allocated, or on the first page fault on the entry. It moves back to the entry on forks due to COW setup. The per-entry granularity of accounting makes the charge process fair for processes that change uid during lifetime, and decrements charge for proper uid when region is unmapped. The interface of vm_pager_allocate(9) is extended by adding struct ucred *, that is used to charge appropriate uid when allocation if performed by kernel, e.g. md(4). Several syscalls, among them is fork(2), may now return ENOMEM when global or per-uid limits are enforced. In collaboration with: pho Reviewed by: alc Approved by: re (kensmith) Notes: svn path=/head/; revision=194766
* Chase the removal of PRIV_TTY_PRISON in the mac(9) modules.Ed Schouten2009-06-202-2/+0
| | | | | | | | Reported by: kib Pointy hat to: me Notes: svn path=/head/; revision=194534
* Adapt vfs kqfilter to the shared vnode lock used by zfs write vop. UseKonstantin Belousov2009-06-101-2/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | vnode interlock to protect the knote fields [1]. The locking assumes that shared vnode lock is held, thus we get exclusive access to knote either by exclusive vnode lock protection, or by shared vnode lock + vnode interlock. Do not use kl_locked() method to assert either lock ownership or the fact that curthread does not own the lock. For shared locks, ownership is not recorded, e.g. VOP_ISLOCKED can return LK_SHARED for the shared lock not owned by curthread, causing false positives in kqueue subsystem assertions about knlist lock. Remove kl_locked method from knlist lock vector, and add two separate assertion methods kl_assert_locked and kl_assert_unlocked, that are supposed to use proper asserts. Change knlist_init accordingly. Add convenience function knlist_init_mtx to reduce number of arguments for typical knlist initialization. Submitted by: jhb [1] Noted by: jhb [2] Reviewed by: jhb Tested by: rnoland Notes: svn path=/head/; revision=193951
* Move "options MAC" from opt_mac.h to opt_global.h, as it's now in GENERICRobert Watson2009-06-051-2/+0
| | | | | | | | | | | and used in a large number of files, but also because an increasing number of incorrect uses of MAC calls were sneaking in due to copy-and-paste of MAC-aware code without the associated opt_mac.h include. Discussed with: pjd Notes: svn path=/head/; revision=193511
* Add one further check with mac_policy_count to an mbuf copying caseRobert Watson2009-06-031-0/+3
| | | | | | | | | | (limited to netatalk) to avoid MAC label lookup on both mbufs if no policies are registered. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=193393
* Continue work to optimize performance of "options MAC" when no MAC policyRobert Watson2009-06-0310-94/+328
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | modules are loaded by avoiding mbuf label lookups when policies aren't loaded, pushing further socket locking into MAC policy modules, and avoiding locking MAC ifnet locks when no policies are loaded: - Check mac_policies_count before looking for mbuf MAC label m_tags in MAC Framework entry points. We will still pay label lookup costs if MAC policies are present but don't require labels (typically a single mbuf header field read, but perhaps further indirection if IPSEC or other m_tag consumers are in use). - Further push socket locking for socket-related access control checks and events into MAC policies from the MAC Framework, so that sockets are only locked if a policy specifically requires a lock to protect a label. This resolves lock order issues during sonewconn() and also in local domain socket cross-connect where multiple socket locks could not be held at once for the purposes of propagatig MAC labels across multiple sockets. Eliminate mac_policy_count check in some entry points where it no longer avoids locking. - Add mac_policy_count checking in some entry points relating to network interfaces that otherwise lock a global MAC ifnet lock used to protect ifnet labels. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=193391
* By default, label all network interfaces as biba/equal on attach. ThisRobert Watson2009-06-031-1/+1
| | | | | | | | | | | makes it easier for first-time users to configure and work with biba as remote acess is still allowed. Effectively, this means that, by default, only local security properties, not distributed ones, are enforced. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=193371
* Mark MAC Framework sx and rm locks as NOWITNESS to suppress warnings thatRobert Watson2009-06-021-2/+2
| | | | | | | | | | | | might arise from WITNESS not understanding its locking protocol, which should be deadlock-free. Currently these warnings generally don't occur, but as object locking is pushed into policies for some object types, they would otherwise occur more often. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=193355
* Add internal 'mac_policy_count' counter to the MAC Framework, which is aRobert Watson2009-06-023-22/+70
| | | | | | | | | | | | | | | | | | | | | count of the number of registered policies. Rather than unconditionally locking sockets before passing them into MAC, lock them in the MAC entry points only if mac_policy_count is non-zero. This avoids locking overhead for a number of socket system calls when no policies are registered, eliminating measurable overhead for the MAC Framework for the socket subsystem when there are no active policies. Possibly socket locks should be acquired by policies if they are required for socket labels, which would further avoid locking overhead when there are policies but they don't require labeling of sockets, or possibly don't even implement socket controls. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=193332
* Make the rmlock(9) interface a bit more like the rwlock(9) interface:Robert Watson2009-05-291-1/+1
| | | | | | | | | | | | | | | | | - Add rm_init_flags() and accept extended options only for that variation. - Add a flags space specifically for rm_init_flags(), rather than borrowing the lock_init() flag space. - Define flag RM_RECURSE to use instead of LO_RECURSABLE. - Define flag RM_NOWITNESS to allow an rmlock to be exempt from WITNESS checking; this wasn't possible previously as rm_init() always passed LO_WITNESS when initializing an rmlock's struct lock. - Add RM_SYSINIT_FLAGS(). - Rename embedded mutex in rmlocks to make it more obvious what it is. - Update consumers. - Update man page. Notes: svn path=/head/; revision=193030
* Add hierarchical jails. A jail may further virtualize its environmentJamie Gritton2009-05-271-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | by creating a child jail, which is visible to that jail and to any parent jails. Child jails may be restricted more than their parents, but never less. Jail names reflect this hierarchy, being MIB-style dot-separated strings. Every thread now points to a jail, the default being prison0, which contains information about the physical system. Prison0's root directory is the same as rootvnode; its hostname is the same as the global hostname, and its securelevel replaces the global securelevel. Note that the variable "securelevel" has actually gone away, which should not cause any problems for code that properly uses securelevel_gt() and securelevel_ge(). Some jail-related permissions that were kept in global variables and set via sysctls are now per-jail settings. The sysctls still exist for backward compatibility, used only by the now-deprecated jail(2) system call. Approved by: bz (mentor) Notes: svn path=/head/; revision=192895
* Convert the MAC Framework from using rwlocks to rmlocks to stabilizeRobert Watson2009-05-272-21/+32
| | | | | | | | | framework registration for non-sleepable entry points. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=192881
* Remove the thread argument from the FSD (File-System Dependent) parts ofAttilio Rao2009-05-111-1/+1
| | | | | | | | | | | | | | | | | | | | the VFS. Now all the VFS_* functions and relating parts don't want the context as long as it always refers to curthread. In some points, in particular when dealing with VOPs and functions living in the same namespace (eg. vflush) which still need to be converted, pass curthread explicitly in order to retain the old behaviour. Such loose ends will be fixed ASAP. While here fix a bug: now, UFS_EXTATTR can be compiled alone without the UFS_EXTATTR_AUTOSTART option. VFS KPI is heavilly changed by this commit so thirdy parts modules needs to be recompiled. Bump __FreeBSD_version in order to signal such situation. Notes: svn path=/head/; revision=191990
* Rename MAC Framework-internal macros used to invoke policy entry points:Robert Watson2009-05-0118-304/+339
| | | | | | | | | | | | | | | | | | | | | MAC_BOOLEAN -> MAC_POLICY_BOOLEAN MAC_BOOLEAN_NOSLEEP -> MAC_POLICY_BOOLEANN_NOSLEEP MAC_CHECK -> MAC_POLICY_CHECK MAC_CHECK_NOSLEEP -> MAC_POLICY_CHECK_NOSLEEP MAC_EXTERNALIZE -> MAC_POLICY_EXTERNALIZE MAC_GRANT -> MAC_POLICY_GRANT MAC_GRANT_NOSLEEP -> MAC_POLICY_GRANT_NOSLEEP MAC_INTERNALIZE -> MAC_POLICY_INTERNALIZE MAC_PERFORM -> MAC_POLICY_PERFORM_CHECK MAC_PERFORM_NOSLEEP -> MAC_POLICY_PERFORM_NOSLEEP This frees up those macro names for use in wrapping calls into the MAC Framework from the remainder of the kernel. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=191731
* Temporarily relax the constraints on argument size checking for A_GETCOND;Robert Watson2009-04-191-12/+6
| | | | | | | | | | login(1) isn't quite ready for them yet on 64-bit systems as it continues to use the conventions of the old version of the API. Reported by: stas, Jakub Lach <jakub_lach at mailplus.pl> Notes: svn path=/head/; revision=191296
* Merge OpenBSM 1.1 changes to the FreeBSD 8.x kernel:Robert Watson2009-04-197-44/+225
| | | | | | | | | | | | | | | | | | | - Add and use mapping of fcntl(2) commands to new BSM constant space. - Adopt (int) rather than (long) arguments to a number of auditon(2) commands, as has happened in Solaris, and add compatibility code to handle the old comments. Note that BSM_PF_IEEE80211 is partially but not fully removed, as the userspace OpenBSM 1.1alpha5 code still depends on it. Once userspace is updated, I'll GCC the kernel constant. MFC after: 2 weeks Sponsored by: Apple, Inc. Obtained from: TrustedBSD Project Portions submitted by: sson Notes: svn path=/head/; revision=191270
* Merge new kernel files from OpenBSM 1.1: audit_fcntl.h andRobert Watson2009-04-161-0/+290
| | | | | | | | | | | | | audit_bsm_fcntl.c contain utility routines to map local fcntl commands into BSM constants. Adaptation to the FreeBSD kernel environment will follow in a future commit. Sponsored by: Apple, Inc. Obtained from: TrustedBSD Project MFC after: 2 weeks Notes: svn path=/head/; revision=191147
* Remove D_NEEDGIANT from audit pipes. I'm actually not sure why this wasRobert Watson2009-04-161-1/+1
| | | | | | | | | | here, but isn't needed. MFC after: 2 weeks Sponsored by: Apple, Inc. Notes: svn path=/head/; revision=191143
* Get rid of VSTAT and replace it with VSTAT_PERMS, which is somewhatEdward Tomasz Napierala2009-03-293-6/+6
| | | | | | | | | better defined. Approved by: rwatson (mentor) Notes: svn path=/head/; revision=190524
* - Correct logic in if statement - we want to allocate temporary bufferPawel Jakub Dawidek2009-03-141-1/+3
| | | | | | | | | | | | | when someone is passing new rules, not when he only want to read them. Because of this bug, even if the given rules were incorrect, they ended up in rule_string. - Add missing protection for rule_string when coping it. Reviewed by: rwatson MFC after: 1 week Notes: svn path=/head/; revision=189830
* Rework MAC Framework synchronization in a number of ways in order toRobert Watson2009-03-1420-327/+410
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | improve performance: - Eliminate custom reference count and condition variable to monitor threads entering the framework, as this had both significant overhead and behaved badly in the face of contention. - Replace reference count with two locks: an rwlock and an sx lock, which will be read-acquired by threads entering the framework depending on whether a give policy entry point is permitted to sleep or not. - Replace previous mutex locking of the reference count for exclusive access with write acquiring of both the policy list sx and rw locks, which occurs only when policies are attached or detached. - Do a lockless read of the dynamic policy list head before acquiring any locks in order to reduce overhead when no dynamic policies are loaded; this a race we can afford to lose. - For every policy entry point invocation, decide whether sleeping is permitted, and if not, use a _NOSLEEP() variant of the composition macros, which will use the rwlock instead of the sxlock. In some cases, we decide which to use based on allocation flags passed to the MAC Framework entry point. As with the move to rwlocks/rmlocks in pfil, this may trigger witness warnings, but these should (generally) be false positives as all acquisition of the locks is for read with two very narrow exceptions for policy load/unload, and those code blocks should never acquire other locks. Sponsored by: Google, Inc. Obtained from: TrustedBSD Project Discussed with: csjp (idea, not specific patch) Notes: svn path=/head/; revision=189797
* Mark the bsdextended rules sysctl as being mpsafe.Christian S.J. Peron2009-03-091-2/+2
| | | | | | | Discussed with: rwatson Notes: svn path=/head/; revision=189590
* Add a new thread-private flag, TDP_AUDITREC, to indicate whether orRobert Watson2009-03-093-5/+15
| | | | | | | | | | | | | | | | not there is an audit record hung off of td_ar on the current thread. Test this flag instead of td_ar when auditing syscall arguments or checking for an audit record to commit on syscall return. Under these circumstances, td_pflags is much more likely to be in the cache (especially if there is no auditing of the current system call), so this should help reduce cache misses in the system call return path. MFC after: 1 week Reported by: kris Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=189570
* Remove 'uio' argument from MAC Framework and MAC policy entry points forRobert Watson2009-03-0810-36/+21
| | | | | | | | | | | | extended attribute get/set; in the case of get an uninitialized user buffer was passed before the EA was retrieved, making it of relatively little use; the latter was simply unused by any policies. Obtained from: TrustedBSD Project Sponsored by: Google, Inc. Notes: svn path=/head/; revision=189533
* Rename 'ucred' argument to mac_socket_check_bind() to 'cred' to matchRobert Watson2009-03-081-3/+3
| | | | | | | | | | other use of the same variable type. Obtained from: TrustedBSD Project Sponsored by: Google, Inc. Notes: svn path=/head/; revision=189532
* Improve the consistency of MAC Framework and MAC policy entry pointRobert Watson2009-03-089-467/+454
| | | | | | | | | | | | | | | | | | | | | | | | | | naming by renaming certain "proc" entry points to "cred" entry points, reflecting their manipulation of credentials. For some entry points, the process was passed into the framework but not into policies; in these cases, stop passing in the process since we don't need it. mac_proc_check_setaudit -> mac_cred_check_setaudit mac_proc_check_setaudit_addr -> mac_cred_check_setaudit_addr mac_proc_check_setauid -> mac_cred_check_setauid mac_proc_check_setegid -> mac_cred_check_setegid mac_proc_check_seteuid -> mac_cred_check_seteuid mac_proc_check_setgid -> mac_cred_check_setgid mac_proc_check_setgroups -> mac_cred_ceck_setgroups mac_proc_check_setregid -> mac_cred_check_setregid mac_proc_check_setresgid -> mac_cred_check_setresgid mac_proc_check_setresuid -> mac_cred_check_setresuid mac_proc_check_setreuid -> mac_cred_check_setreuid mac_proc_check_setuid -> mac_cred_check_setuid Obtained from: TrustedBSD Project Sponsored by: Google, Inc. Notes: svn path=/head/; revision=189529
generated by cgit v1.2.3 (git 2.25.1) at 2024-10-19 05:35:58 +0000