aboutsummaryrefslogtreecommitdiff
path: root/sys/security/mac/mac_framework.h
Commit message (Collapse)AuthorAgeFilesLines
* pipe: allow for lockless pipe_statMateusz Guzik2020-11-191-2/+23
| | | | | | | | | | | | | | | | | | pipes get stated all thet time and this avoidably contributed to contention. The pipe lock is only held to accomodate MAC and to check the type. Since normally there is no probe for pipe stat depessimize this by having the flag. The pipe_state field gets modified with locks held all the time and it's not feasible to convert them to use atomic store. Move the type flag away to a separate variable as a simple cleanup and to provide stable field to read. Use short for both fields to avoid growing the struct. While here short-circuit MAC for pipe_poll as well. Notes: svn path=/head/; revision=367833
* mac_framework.h: fix build with DEBUG_VFS_LOCKS and !MACAndriy Gapon2020-09-031-1/+1
| | | | | | | | | | | | | | | I have such a custom kernel configuration and its build failed with: linking kernel.full ld: error: undefined symbol: mac_vnode_assert_locked >>> referenced by mac_framework.h:556 (/usr/devel/git/apu2c4/sys/security/mac/mac_framework.h:556) >>> tmpfs_vnops.o:(mac_vnode_check_stat) >>> referenced by mac_framework.h:556 (/usr/devel/git/apu2c4/sys/security/mac/mac_framework.h:556) >>> vfs_default.o:(mac_vnode_check_stat) >>> referenced by mac_framework.h:556 (/usr/devel/git/apu2c4/sys/security/mac/mac_framework.h:556) >>> ufs_vnops.o:(mac_vnode_check_stat) Notes: svn path=/head/; revision=365308
* mac: even up all entry points to the same schemeMateusz Guzik2020-08-061-7/+38
| | | | | | | | - use a macro for checking whether the site is enabled - expand it to 0 if mac is not compiled in to begin with Notes: svn path=/head/; revision=363935
* vfs: add a cheaper entry for mac_vnode_check_accessMateusz Guzik2020-08-051-1/+13
| | | | Notes: svn path=/head/; revision=363886
* Fix tinderbox build after r363714Mateusz Guzik2020-07-301-0/+8
| | | | Notes: svn path=/head/; revision=363716
* vfs: elide MAC-induced locking on rename if there are no relevant hoooksMateusz Guzik2020-07-291-0/+4
| | | | Notes: svn path=/head/; revision=363668
* vfs: add the infrastructure for lockless lookupMateusz Guzik2020-07-251-1/+2
| | | | | | | | | Reviewed by: kib Tested by: pho (in a patchset) Differential Revision: https://reviews.freebsd.org/D25577 Notes: svn path=/head/; revision=363518
* vfs: fix vn_poll performance with either MAC or AUDITMateusz Guzik2020-07-161-0/+4
| | | | | | | | | | | | | | | | | | | | The code would unconditionally lock the vnode to audit or call the mac hoook, even if neither want to do anything. Pre-check the state to avoid locking in the common case of nothing to do. Note this code should not be normally executed anyway as vnodes are always return ready. However, poll1/2 from will-it-scale use regular files for benchmarking, presumably to focus on the interface itself as the vnode handler is not supposed to do almost anything. This in particular fixes poll2 which passes 128 fds. $ ./poll2_processes -s 10 before: 134411 after: 271572 Notes: svn path=/head/; revision=363249
* vfs: fix MAC/AUDIT mismatch in vn_pollMateusz Guzik2020-07-161-0/+10
| | | | | | | Auditing would not be performed without MAC compiled in. Notes: svn path=/head/; revision=363247
* vfs: use mac fastpath for lookup, open, read, write, mmapMateusz Guzik2020-02-131-9/+89
| | | | Notes: svn path=/head/; revision=357889
* mac: implement fast path for checksMateusz Guzik2020-02-131-2/+21
| | | | | | | | | | | | | | | | All checking routines walk a linked list of all modules in order to determine if given hook is installed. This became a significant problem after mac_ntpd started being loaded by default. Implement a way perform checks for select hooks by testing a boolean. Use it for priv_check and priv_grant, which are constantly called from priv_check. The real fix would use hotpatching, but the above provides a way to know when to do it. Notes: svn path=/head/; revision=357887
* Remove AppleTalk support.Gleb Smirnoff2014-03-141-2/+0
| | | | | | | | | | | | | AppleTalk was a network transport protocol for Apple Macintosh devices in 80s and then 90s. Starting with Mac OS X in 2000 the AppleTalk was a legacy protocol and primary networking protocol is TCP/IP. The last Mac OS X release to support AppleTalk happened in 2009. The same year routing equipment vendors (namely Cisco) end their support. Thus, AppleTalk won't be supported in FreeBSD 11.0-RELEASE. Notes: svn path=/head/; revision=263152
* Implement read(2)/write(2) and neccessary lseek(2) for posix shmfd.Konstantin Belousov2013-08-211-0/+4
| | | | | | | | | | | | | | | | Add MAC framework entries for posix shm read and write. Do not allow implicit extension of the underlying memory segment past the limit set by ftruncate(2) by either of the syscalls. Read and write returns short i/o, lseek(2) fails with EINVAL when resulting offset does not fit into the limit. Discussed with: alc Tested by: pho Sponsored by: The FreeBSD Foundation Notes: svn path=/head/; revision=254603
* Correct several issues in the integration of POSIX shared memory objectsRobert Watson2011-09-021-2/+4
| | | | | | | | | | | | | | | | | | | | | | | | | and the new setmode and setowner fileops in FreeBSD 9.0: - Add new MAC Framework entry point mac_posixshm_check_create() to allow MAC policies to authorise shared memory use. Provide a stub policy and test policy templates. - Add missing Biba and MLS implementations of mac_posixshm_check_setmode() and mac_posixshm_check_setowner(). - Add 'accmode' argument to mac_posixshm_check_open() -- unlike the mac_posixsem_check_open() entry point it was modeled on, the access mode is required as shared memory access can be read-only as well as writable; this isn't true of POSIX semaphores. - Implement full range of POSIX shared memory entry points for Biba and MLS. Sponsored by: Google Inc. Obtained from: TrustedBSD Project Approved by: re (kib) Notes: svn path=/head/; revision=225344
* Add the fo_chown and fo_chmod methods to struct fileops and use themKonstantin Belousov2011-08-161-0/+8
| | | | | | | | | | | | | to implement fchown(2) and fchmod(2) support for several file types that previously lacked it. Add MAC entries for chown/chmod done on posix shared memory and (old) in-kernel posix semaphores. Based on the submission by: glebius Reviewed by: rwatson Approved by: re (bz) Notes: svn path=/head/; revision=224914
* Remove 'uio' argument from MAC Framework and MAC policy entry points forRobert Watson2009-03-081-3/+2
| | | | | | | | | | | | extended attribute get/set; in the case of get an uninitialized user buffer was passed before the EA was retrieved, making it of relatively little use; the latter was simply unused by any policies. Obtained from: TrustedBSD Project Sponsored by: Google, Inc. Notes: svn path=/head/; revision=189533
* Improve the consistency of MAC Framework and MAC policy entry pointRobert Watson2009-03-081-23/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | naming by renaming certain "proc" entry points to "cred" entry points, reflecting their manipulation of credentials. For some entry points, the process was passed into the framework but not into policies; in these cases, stop passing in the process since we don't need it. mac_proc_check_setaudit -> mac_cred_check_setaudit mac_proc_check_setaudit_addr -> mac_cred_check_setaudit_addr mac_proc_check_setauid -> mac_cred_check_setauid mac_proc_check_setegid -> mac_cred_check_setegid mac_proc_check_seteuid -> mac_cred_check_seteuid mac_proc_check_setgid -> mac_cred_check_setgid mac_proc_check_setgroups -> mac_cred_ceck_setgroups mac_proc_check_setregid -> mac_cred_check_setregid mac_proc_check_setresgid -> mac_cred_check_setresgid mac_proc_check_setresuid -> mac_cred_check_setresuid mac_proc_check_setreuid -> mac_cred_check_setreuid mac_proc_check_setuid -> mac_cred_check_setuid Obtained from: TrustedBSD Project Sponsored by: Google, Inc. Notes: svn path=/head/; revision=189529
* Introduce accmode_t. This is required for NFSv4 ACLs - it will be neccessaryEdward Tomasz Napierala2008-10-281-2/+3
| | | | | | | | | | to add more V* constants, and the variables changed by this patch were often being assigned to mode_t variables, which is 16 bit. Approved by: rwatson (mentor) Notes: svn path=/head/; revision=184413
* Rename mac_cred_mmapped_drop_perms(), which revokes access to virtualRobert Watson2008-10-281-2/+1
| | | | | | | | | | | | | | memory mappings when the MAC label on a process changes, to mac_proc_vm_revoke(), It now also acquires its own credential reference directly from the affected process rather than accepting one passed by the the caller, simplifying the API and consumer code. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=184412
* Rename three MAC entry points from _proc_ to _cred_ to reflect the factRobert Watson2008-10-281-3/+3
| | | | | | | | | | that they operate directly on credentials: mac_proc_create_swapper(), mac_proc_create_init(), and mac_proc_associate_nfsd(). Update policies. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=184407
* Add a MAC label, MAC Framework, and MAC policy entry points for IPv6Robert Watson2008-10-261-1/+9
| | | | | | | | | | | | | | fragment reassembly queues. This allows policies to label reassembly queues, perform access control checks when matching fragments to a queue, update a queue label when fragments are matched, and label the resulting reassembled datagram. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=184307
* Add mac_inpcb_check_visible MAC Framework entry point, which is similarBjoern A. Zeeb2008-10-171-0/+1
| | | | | | | | | | to mac_socket_check_visible but operates on the inpcb. Reviewed by: rwatson MFC after: 3 months (set timer, decide then) Notes: svn path=/head/; revision=183973
* Introduce two related changes to the TrustedBSD MAC Framework:Robert Watson2008-08-231-6/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | (1) Abstract interpreter vnode labeling in execve(2) and mac_execve(2) so that the general exec code isn't aware of the details of allocating, copying, and freeing labels, rather, simply passes in a void pointer to start and stop functions that will be used by the framework. This change will be MFC'd. (2) Introduce a new flags field to the MAC_POLICY_SET(9) interface allowing policies to declare which types of objects require label allocation, initialization, and destruction, and define a set of flags covering various supported object types (MPC_OBJECT_PROC, MPC_OBJECT_VNODE, MPC_OBJECT_INPCB, ...). This change reduces the overhead of compiling the MAC Framework into the kernel if policies aren't loaded, or if policies require labels on only a small number or even no object types. Each time a policy is loaded or unloaded, we recalculate a mask of labeled object types across all policies present in the system. Eliminate MAC_ALWAYS_LABEL_MBUF option as it is no longer required. MFC after: 1 week ((1) only) Reviewed by: csjp Obtained from: TrustedBSD Project Sponsored by: Apple, Inc. Notes: svn path=/head/; revision=182063
* Rework the lifetime management of the kernel implementation of POSIXJohn Baldwin2008-06-271-3/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | semaphores. Specifically, semaphores are now represented as new file descriptor type that is set to close on exec. This removes the need for all of the manual process reference counting (and fork, exec, and exit event handlers) as the normal file descriptor operations handle all of that for us nicely. It is also suggested as one possible implementation in the spec and at least one other OS (OS X) uses this approach. Some bugs that were fixed as a result include: - References to a named semaphore whose name is removed still work after the sem_unlink() operation. Prior to this patch, if a semaphore's name was removed, valid handles from sem_open() would get EINVAL errors from sem_getvalue(), sem_post(), etc. This fixes that. - Unnamed semaphores created with sem_init() were not cleaned up when a process exited or exec'd. They were only cleaned up if the process did an explicit sem_destroy(). This could result in a leak of semaphore objects that could never be cleaned up. - On the other hand, if another process guessed the id (kernel pointer to 'struct ksem' of an unnamed semaphore (created via sem_init)) and had write access to the semaphore based on UID/GID checks, then that other process could manipulate the semaphore via sem_destroy(), sem_post(), sem_wait(), etc. - As part of the permission check (UID/GID), the umask of the proces creating the semaphore was not honored. Thus if your umask denied group read/write access but the explicit mode in the sem_init() call allowed it, the semaphore would be readable/writable by other users in the same group, for example. This includes access via the previous bug. - If the module refused to unload because there were active semaphores, then it might have deregistered one or more of the semaphore system calls before it noticed that there was a problem. I'm not sure if this actually happened as the order that modules are discovered by the kernel linker depends on how the actual .ko file is linked. One can make the order deterministic by using a single module with a mod_event handler that explicitly registers syscalls (and deregisters during unload after any checks). This also fixes a race where even if the sem_module unloaded first it would have destroyed locks that the syscalls might be trying to access if they are still executing when they are unloaded. XXX: By the way, deregistering system calls doesn't do any blocking to drain any threads from the calls. - Some minor fixes to errno values on error. For example, sem_init() isn't documented to return ENFILE or EMFILE if we run out of semaphores the way that sem_open() can. Instead, it should return ENOSPC in that case. Other changes: - Kernel semaphores now use a hash table to manage the namespace of named semaphores nearly in a similar fashion to the POSIX shared memory object file descriptors. Kernel semaphores can now also have names longer than 14 chars (up to MAXPATHLEN) and can include subdirectories in their pathname. - The UID/GID permission checks for access to a named semaphore are now done via vaccess() rather than a home-rolled set of checks. - Now that kernel semaphores have an associated file object, the various MAC checks for POSIX semaphores accept both a file credential and an active credential. There is also a new posixsem_check_stat() since it is possible to fstat() a semaphore file descriptor. - A small set of regression tests (using the ksem API directly) is present in src/tools/regression/posixsem. Reported by: kris (1) Tested by: kris Reviewed by: rwatson (lightly) MFC after: 1 month Notes: svn path=/head/; revision=180059
* Remove the posixsem_check_destroy() MAC check. It is semantically identicalJohn Baldwin2008-06-231-1/+0
| | | | | | | | | | to doing a MAC check for close(), but no other types of close() (including close(2) and ksem_close(2)) have MAC checks. Discussed with: rwatson Notes: svn path=/head/; revision=179963
* The TrustedBSD MAC Framework named struct ipq instances 'ipq', which is theRobert Watson2008-06-131-6/+6
| | | | | | | | | | | | | | same as the global variable defined in ip_input.c. Instead, adopt the name 'q' as found in about 1/2 of uses in ip_input.c, preventing a collision on the name. This is non-harmful, but means that search and replace on the global works less well (as in the virtualization work), as well as indexing tools. MFC after: 1 week Reported by: julian Notes: svn path=/head/; revision=179781
* Make naming of include guards for MAC Framework include files moreRobert Watson2008-04-131-3/+3
| | | | | | | | | consistent with other kernel include guards (don't start with _SYS). MFC after: 3 days Notes: svn path=/head/; revision=178184
* Add a new file descriptor type for IPC shared memory objects and use it toJohn Baldwin2008-01-081-0/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | implement shm_open(2) and shm_unlink(2) in the kernel: - Each shared memory file descriptor is associated with a swap-backed vm object which provides the backing store. Each descriptor starts off with a size of zero, but the size can be altered via ftruncate(2). The shared memory file descriptors also support fstat(2). read(2), write(2), ioctl(2), select(2), poll(2), and kevent(2) are not supported on shared memory file descriptors. - shm_open(2) and shm_unlink(2) are now implemented as system calls that manage shared memory file descriptors. The virtual namespace that maps pathnames to shared memory file descriptors is implemented as a hash table where the hash key is generated via the 32-bit Fowler/Noll/Vo hash of the pathname. - As an extension, the constant 'SHM_ANON' may be specified in place of the path argument to shm_open(2). In this case, an unnamed shared memory file descriptor will be created similar to the IPC_PRIVATE key for shmget(2). Note that the shared memory object can still be shared among processes by sharing the file descriptor via fork(2) or sendmsg(2), but it is unnamed. This effectively serves to implement the getmemfd() idea bandied about the lists several times over the years. - The backing store for shared memory file descriptors are garbage collected when they are not referenced by any open file descriptors or the shm_open(2) virtual namespace. Submitted by: dillon, peter (previous versions) Submitted by: rwatson (I based this on his version) Reviewed by: alc (suggested converting getmemfd() to shm_open()) Notes: svn path=/head/; revision=175164
* Garbage collect mac_mbuf_create_multicast_encap TrustedBSD MAC FrameworkRobert Watson2007-10-281-2/+0
| | | | | | | | | | | entry point, which is no longer required now that we don't support old-style multicast tunnels. This removes the last mbuf object class entry point that isn't init/copy/destroy. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=173108
* Continue to move from generic network entry points in the TrustedBSD MACRobert Watson2007-10-281-2/+3
| | | | | | | | | | | | | | | | | Framework by moving from mac_mbuf_create_netlayer() to more specific entry points for specific network services: - mac_netinet_firewall_reply() to be used when replying to in-bound TCP segments in pf and ipfw (etc). - Rename mac_netinet_icmp_reply() to mac_netinet_icmp_replyinplace() and add mac_netinet_icmp_reply(), reflecting that in some cases we overwrite a label in place, but in others we apply the label to a new mbuf. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=173102
* Move towards more explicit support for various network protocol stacksRobert Watson2007-10-281-2/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | in the TrustedBSD MAC Framework: - Add mac_atalk.c and add explicit entry point mac_netatalk_aarp_send() for AARP packet labeling, rather than using a generic link layer entry point. - Add mac_inet6.c and add explicit entry point mac_netinet6_nd6_send() for ND6 packet labeling, rather than using a generic link layer entry point. - Add expliict entry point mac_netinet_arp_send() for ARP packet labeling, and mac_netinet_igmp_send() for IGMP packet labeling, rather than using a generic link layer entry point. - Remove previous genering link layer entry point, mac_mbuf_create_linklayer() as it is no longer used. - Add implementations of new entry points to various policies, largely by replicating the existing link layer entry point for them; remove old link layer entry point implementation. - Make MAC_IFNET_LOCK(), MAC_IFNET_UNLOCK(), and mac_ifnet_mtx global to the MAC Framework rather than static to mac_net.c as it is now needed outside of mac_net.c. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=173095
* Update comment following MAC Framework entry point renaming andRobert Watson2007-10-261-1/+6
| | | | | | | | | reorganization. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=173042
* Rename 'mac_mbuf_create_from_firewall' to 'mac_netinet_firewall_send' asRobert Watson2007-10-261-2/+2
| | | | | | | | | | | | | we move towards netinet as a pseudo-object for the MAC Framework. Rename 'mac_create_mbuf_linklayer' to 'mac_mbuf_create_linklayer' to reflect general object-first ordering preference. Sponsored by: SPARTA (original patches against Mac OS X) Obtained from: TrustedBSD Project, Apple Computer Notes: svn path=/head/; revision=173018
* Sort entry points in mac_framework.h and mac_policy.h alphabetically byRobert Watson2007-10-251-190/+175
| | | | | | | | | | | | primary object type, and then by secondarily by method name. This sorts entry points relating to particular objects, such as pipes, sockets, and vnodes together. Sponsored by: SPARTA (original patches against Mac OS X) Obtained from: TrustedBSD Project, Apple Computer Notes: svn path=/head/; revision=172990
* Normalize TCP syncache-related MAC Framework entry points to match mostRobert Watson2007-10-251-4/+4
| | | | | | | | | | other entry points in the form mac_<object>_method(). Discussed with: csjp Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=172970
* Rename mac_associate_nfsd_label() to mac_proc_associate_nfsd(), and moveRobert Watson2007-10-251-1/+1
| | | | | | | | | | | | from mac_vfs.c to mac_process.c to join other functions that setup up process labels for specific purposes. Unlike the two proc create calls, this call is intended to run after creation when a process registers as the NFS daemon, so remains an _associate_ call.. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=172957
* Further MAC Framework cleanup: normalize some local variable names andRobert Watson2007-10-251-2/+2
| | | | | | | | | clean up some comments. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=172953
* Merge first in a series of TrustedBSD MAC Framework KPI changesRobert Watson2007-10-241-193/+192
| | | | | | | | | | | | | | | | | | | | | | | | | | from Mac OS X Leopard--rationalize naming for entry points to the following general forms: mac_<object>_<method/action> mac_<object>_check_<method/action> The previous naming scheme was inconsistent and mostly reversed from the new scheme. Also, make object types more consistent and remove spaces from object types that contain multiple parts ("posix_sem" -> "posixsem") to make mechanical parsing easier. Introduce a new "netinet" object type for certain IPv4/IPv6-related methods. Also simplify, slightly, some entry point names. All MAC policy modules will need to be recompiled, and modules not updates as part of this commit will need to be modified to conform to the new KPI. Sponsored by: SPARTA (original patches against Mac OS X) Obtained from: TrustedBSD Project, Apple Computer Notes: svn path=/head/; revision=172930
* Canonicalize naming of local variables for struct ksem and associatedRobert Watson2007-10-211-7/+7
| | | | | | | | | | labels to 'ks' and 'kslabel' to reflect the convention in posix_sem.c. MFC after: 3 days Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=172850
* Rename mac_check_vnode_delete() MAC Framework and MAC Policy entryRobert Watson2007-09-101-2/+2
| | | | | | | | | | | | | | | | | point to mac_check_vnode_unlink(), reflecting UNIX naming conventions. This is the first of several commits to synchronize the MAC Framework in FreeBSD 7.0 with the MAC Framework as it will appear in Mac OS X Leopard. Reveiwed by: csjp, Samy Bahra <sbahra at gwu dot edu> Submitted by: Jacques Vidrine <nectar at apple dot com> Obtained from: Apple Computer, Inc. Sponsored by: SPARTA, SPAWAR Approved by: re (bmah) Notes: svn path=/head/; revision=172107
* Add a new MAC framework and policy entry point,Robert Watson2007-06-261-0/+3
| | | | | | | | | | | | mpo_check_proc_setaudit_addr to be used when controlling use of setaudit_addr(), rather than mpo_check_proc_setaudit(), which takes a different argument type. Reviewed by: csjp Approved by: re (kensmith) Notes: svn path=/head/; revision=171047
* Rename mac*devfsdirent*() to mac*devfs*() to synchronize with SEDarwin,Robert Watson2007-04-231-3/+3
| | | | | | | | | | | where similar data structures exist to support devfs and the MAC Framework, but are named differently. Obtained from: TrustedBSD Project Sponsored by: SPARTA, Inc. Notes: svn path=/head/; revision=168977
* Normalize variable naming in the MAC Framework by adopting the normalRobert Watson2007-04-221-60/+59
| | | | | | | | | | | | variable name conventions for arguments passed into the framework -- for example, name network interfaces 'ifp', sockets 'so', mounts 'mp', mbufs 'm', processes 'p', etc, wherever possible. Previously there was significant variation in this regard. Normalize copyright lists to ranges where sensible. Notes: svn path=/head/; revision=168955
* Remove MAC Framework access control check entry points made redundant withRobert Watson2007-04-221-4/+0
| | | | | | | | | | | | | | | | | | | | | the introduction of priv(9) and MAC Framework entry points for privilege checking/granting. These entry points exactly aligned with privileges and provided no additional security context: - mac_check_sysarch_ioperm() - mac_check_kld_unload() - mac_check_settime() - mac_check_system_nfsd() Add mpo_priv_check() implementations to Biba and LOMAC policies, which, for each privilege, determine if they can be granted to processes considered unprivileged by those two policies. These mostly, but not entirely, align with the set of privileges granted in jails. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=168951
* Allow MAC policy modules to control access to audit configuration systemRobert Watson2007-04-211-0/+6
| | | | | | | | | | | | | | | | | | | calls. Add MAC Framework entry points and MAC policy entry points for audit(), auditctl(), auditon(), setaudit(), aud setauid(). MAC Framework entry points are only added for audit system calls where additional argument context may be useful for policy decision-making; other audit system calls without arguments may be controlled via the priv(9) entry points. Update various policy modules to implement audit-related checks, and in some cases, other missing system-related checks. Obtained from: TrustedBSD Project Sponsored by: SPARTA, Inc. Notes: svn path=/head/; revision=168933
* Introduce accessor functions mac_label_get() and mac_label_set() to replaceRobert Watson2007-02-061-2/+1
| | | | | | | | | | | | | | | | | | | | | | LABEL_TO_SLOT() macro used by policy modules to query and set label data in struct label. Instead of using a union, store an intptr_t, simplifying the API. Update policies: in most cases this required only small tweaks to current wrapper macros. In two cases, a single wrapper macros had to be split into separate get and set macros. Move struct label definition from _label.h to mac_internal.h and remove _label.h. With this change, policies may now treat struct label * as opaque, allowing us to change the layout of struct label without breaking the policy module ABI. For example, we could make the maximum number of policies with labels modifiable at boot-time rather than just at compile-time. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=166533
* Comment and white space cleanup.Robert Watson2006-12-201-15/+17
| | | | | | | | | | Exapnd comments on System V IPC labeling methods, which could use improved consistency with respect to other object types. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=165414
* Fix LOR between the syncache and inpcb locks when MAC is present in theChristian S.J. Peron2006-12-131-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | kernel. This LOR snuck in with some of the recent syncache changes. To fix this, the inpcb handling was changed: - Hang a MAC label off the syncache object - When the syncache entry is initially created, we pickup the PCB lock is held because we extract information from it while initializing the syncache entry. While we do this, copy the MAC label associated with the PCB and use it for the syncache entry. - When the packet is transmitted, copy the label from the syncache entry to the mbuf so it can be processed by security policies which analyze mbuf labels. This change required that the MAC framework be extended to support the label copy operations from the PCB to the syncache entry, and then from the syncache entry to the mbuf. These functions really should be referencing the syncache structure instead of the label. However, due to some of the complexities associated with exposing this syncache structure we operate directly on it's label pointer. This should be OK since we aren't making any access control decisions within this code directly, we are merely allocating and copying label storage so we can properly initialize mbuf labels for any packets the syncache code might create. This also has a nice side effect of caching. Prior to this change, the PCB would be looked up/locked for each packet transmitted. Now the label is cached at the time the syncache entry is initialized. Submitted by: andre [1] Discussed with: rwatson [1] andre submitted the tcp_syncache.c changes Notes: svn path=/head/; revision=165149
* Add a new priv(9) kernel interface for checking the availability ofRobert Watson2006-11-061-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | privilege for threads and credentials. Unlike the existing suser(9) interface, priv(9) exposes a named privilege identifier to the privilege checking code, allowing more complex policies regarding the granting of privilege to be expressed. Two interfaces are provided, replacing the existing suser(9) interface: suser(td) -> priv_check(td, priv) suser_cred(cred, flags) -> priv_check_cred(cred, priv, flags) A comprehensive list of currently available kernel privileges may be found in priv.h. New privileges are easily added as required, but the comments on adding privileges found in priv.h and priv(9) should be read before doing so. The new privilege interface exposed sufficient information to the privilege checking routine that it will now be possible for jail to determine whether a particular privilege is granted in the check routine, rather than relying on hints from the calling context via the SUSER_ALLOWJAIL flag. For now, the flag is maintained, but a new jail check function, prison_priv_check(), is exposed from kern_jail.c and used by the privilege check routine to determine if the privilege is permitted in jail. As a result, a centralized list of privileges permitted in jail is now present in kern_jail.c. The MAC Framework is now also able to instrument privilege checks, both to deny privileges otherwise granted (mac_priv_check()), and to grant privileges otherwise denied (mac_priv_grant()), permitting MAC Policy modules to implement privilege models, as well as control a much broader range of system behavior in order to constrain processes running with root privilege. The suser() and suser_cred() functions remain implemented, now in terms of priv_check() and the PRIV_ROOT privilege, for use during the transition and possibly continuing use by third party kernel modules that have not been updated. The PRIV_DRIVER privilege exists to allow device drivers to check privilege without adopting a more specific privilege identifier. This change does not modify the actual security policy, rather, it modifies the interface for privilege checks so changes to the security policy become more feasible. Sponsored by: nCircle Network Security, Inc. Obtained from: TrustedBSD Project Discussed on: arch@ Reviewed (at least in part) by: mlaier, jmg, pjd, bde, ceri, Alex Lyashkov <umka at sevcity dot net>, Skip Ford <skip dot ford at verizon dot net>, Antoine Brodin <antoine dot brodin at laposte dot net> Notes: svn path=/head/; revision=164032
* Remove extra _MAC_ from #ifdef guard.Robert Watson2006-10-251-1/+1
| | | | Notes: svn path=/head/; revision=163686
generated by cgit v1.3 (git 2.53.0) at 2026-07-31 16:01:05 +0000