src-test/sys/security/mac_veriexec, branch main

security: clean up empty lines in .c and .h files

2020-09-01T21:26:00Z

mac_veriexec_fingerprint_check_vnode: v_writecount > 0 means active writers

2020-06-12T21:51:20Z

v_writecount can actually be < 0 for text, so check for v_writecount > 0 Reviewed by: stevek MFC after: 1 week

Mark more nodes as CTLFLAG_MPSAFE or CTLFLAG_NEEDGIANT (17 of many)

2020-02-26T14:26:36Z

r357614 added CTLFLAG_NEEDGIANT to make it easier to find nodes that are still not MPSAFE (or already are but aren’t properly marked). Use it in preparation for a general review of all nodes. This is non-functional change that adds annotations to SYSCTL_NODE and SYSCTL_PROC nodes using one of the soon-to-be-required flags. Mark all obvious cases as MPSAFE. All entries that haven't been marked as MPSAFE before are by default marked as NEEDGIANT Approved by: kib (mentor, blanket) Commented by: kib, gallatin, melifaro Differential Revision: https://reviews.freebsd.org/D23718

vfs: eliminate v_tag from struct vnode

2020-01-07T04:29:34Z

There was only one consumer and it was using it incorrectly. It is given an equivalent hack. Reviewed by: jeff Differential Revision: https://reviews.freebsd.org/D23037

vfs: drop the mostly unused flags argument from VOP_UNLOCK

2020-01-03T22:29:58Z

Filesystems which want to use it in limited capacity can employ the VOP_UNLOCK_FLAGS macro. Reviewed by: kib (previous version) Differential Revision: https://reviews.freebsd.org/D21427

Add a new ioctl for the larger params struct that includes the label.

2019-05-17T19:27:07Z

We need to make the find_veriexec_file() function available publicly, so rename it to mac_veriexec_metadata_find_file_info() and make it non-static. Bump the version of the veriexec device interface so user space will know the labelized version of fingerprint loading is available. Approved by: sjg Obtained from: Juniper Networks, Inc. Differential Revision: https://reviews.freebsd.org/D20295

Obtain a shared lock instead of exclusive in the MAC/veriexec

2019-05-17T18:13:43Z

MAC_VERIEXEC_CHECK_PATH_SYSCALL per-MAC policy system call. When we are checking the status of the fingerprint on a vnode using the per-MAC-policy syscall, we do not need an exclusive lock on the vnode. Even if there is more than one thread requesting the status at the same time, the worst we can end up doing is processing the file more than once. This can potentially be improved in the future with offloading the fingerprint evaluation to a separate thread and blocking until the update completes. But for now the race is acceptable. Obtained from: Juniper Networks, Inc. MFC after: 1 week

sysctls which should be restricted when securelevel is raised should also

2019-05-17T18:09:48Z

be restricted when veriexec is enforced. Add mpo_system_check_sysctl method to mac_veriexec which does this. Obtained from: Juniper Networks, Inc. MFC after: 1 week

Fix format strings for some debug messages that could have arguments that

2019-05-17T18:06:24Z

are different types across architectures by using %ju and typecasting to uintmax_t, where appropriate. Obtained from: Juniper Networks, Inc. MFC after: 1 week

Ensure we have obtained a lock on the process before calling

2019-05-17T17:50:01Z

mac_veriexec_get_executable_flags(). Only try locking/unlocking if the caller has not already acquired the process lock. Obtained from: Juniper Networks, Inc. MFC after: 1 week