summaryrefslogtreecommitdiff
path: root/sys/kern/kern_prot.c
Commit message (Collapse)AuthorAgeFilesLines
* Change crsetgroups_locked() (called by crsetgroups()) to sort theBrooks Davis2009-06-201-10/+45
| | | | | | | | | supplemental groups using insertion sort. Use this property in groupmember() to let us use a binary search instead of the previous linear search. Notes: svn path=/head/; revision=194556
* Rework the credential code to support larger values of NGROUPS andBrooks Davis2009-06-191-35/+135
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | NGROUPS_MAX, eliminate ABI dependencies on them, and raise the to 1024 and 1023 respectively. (Previously they were equal, but under a close reading of POSIX, NGROUPS_MAX was defined to be too large by 1 since it is the number of supplemental groups, not total number of groups.) The bulk of the change consists of converting the struct ucred member cr_groups from a static array to a pointer. Do the equivalent in kinfo_proc. Introduce new interfaces crcopysafe() and crsetgroups() for duplicating a process credential before modifying it and for setting group lists respectively. Both interfaces take care for the details of allocating groups array. crsetgroups() takes care of truncating the group list to the current maximum (NGROUPS) if necessary. In the future, crsetgroups() may be responsible for insuring invariants such as sorting the supplemental groups to allow groupmember() to be implemented as a binary search. Because we can not change struct xucred without breaking application ABIs, we leave it alone and introduce a new XU_NGROUPS value which is always 16 and is to be used or NGRPS as appropriate for things such as NFS which need to use no more than 16 groups. When feasible, truncate the group list rather than generating an error. Minor changes: - Reduce the number of hand rolled versions of groupmember(). - Do not assign to both cr_gid and cr_groups[0]. - Modify ipfw to cache ucreds instead of part of their contents since they are immutable once referenced by more than one entity. Submitted by: Isilon Systems (initial implementation) X-MFC after: never PR: bin/113398 kern/133867 Notes: svn path=/head/; revision=194498
* Move "options MAC" from opt_mac.h to opt_global.h, as it's now in GENERICRobert Watson2009-06-051-1/+0
| | | | | | | | | | | and used in a large number of files, but also because an increasing number of incorrect uses of MAC calls were sneaking in due to copy-and-paste of MAC-aware code without the associated opt_mac.h include. Discussed with: pjd Notes: svn path=/head/; revision=193511
* Add internal 'mac_policy_count' counter to the MAC Framework, which is aRobert Watson2009-06-021-2/+0
| | | | | | | | | | | | | | | | | | | | | count of the number of registered policies. Rather than unconditionally locking sockets before passing them into MAC, lock them in the MAC entry points only if mac_policy_count is non-zero. This avoids locking overhead for a number of socket system calls when no policies are registered, eliminating measurable overhead for the MAC Framework for the socket subsystem when there are no active policies. Possibly socket locks should be acquired by policies if they are required for socket labels, which would further avoid locking overhead when there are policies but they don't require labeling of sockets, or possibly don't even implement socket controls. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=193332
* Introduce an interm userland-kernel API for creating vnets andMarko Zec2009-05-311-1/+5
| | | | | | | | | | | | | | | | | | | | | | | | | assigning ifnets from one vnet to another. Deletion of vnets is not yet supported. The interface is implemented as an ioctl extension so that no syscalls had to be introduced. This should be acceptable given that the new interface will be used for a short / interim period only, until the new jail management framwork gains the capability of managing vnets. This method for managing vimages / vnets has been in use for the past 7 years without any observable issues. The userland tool to be used in conjunction with the interim API can be found in p4: //depot/projects/vimage-commit2/src/usr.sbin/vimage/... and will most probably never get commited to svn. While here, bump copyright notices in kern_vimage.c and vimage.h to cover work done in year 2009. Approved by: julian (mentor) Discussed with: bz, rwatson Notes: svn path=/head/; revision=193166
* Add hierarchical jails. A jail may further virtualize its environmentJamie Gritton2009-05-271-19/+10
| | | | | | | | | | | | | | | | | | | | | | | | | by creating a child jail, which is visible to that jail and to any parent jails. Child jails may be restricted more than their parents, but never less. Jail names reflect this hierarchy, being MIB-style dot-separated strings. Every thread now points to a jail, the default being prison0, which contains information about the physical system. Prison0's root directory is the same as rootvnode; its hostname is the same as the global hostname, and its securelevel replaces the global securelevel. Note that the variable "securelevel" has actually gone away, which should not cause any problems for code that properly uses securelevel_gt() and securelevel_ge(). Some jail-related permissions that were kept in global variables and set via sysctls are now per-jail settings. The sysctls still exist for backward compatibility, used only by the now-deprecated jail(2) system call. Approved by: bz (mentor) Notes: svn path=/head/; revision=192895
* Introduce a new virtualization container, provisionally named vprocg, to holdMarko Zec2009-05-081-0/+10
| | | | | | | | | | | | | | | | | | | | | | | | | virtualized instances of hostname and domainname, as well as a new top-level virtualization struct vimage, which holds pointers to struct vnet and struct vprocg. Struct vprocg is likely to become replaced in the near future with a new jail management API import. As a consequence of this change, change struct ucred to point to a struct vimage, instead of directly pointing to a vnet. Merge vnet / vimage / ucred refcounting infrastructure from p4 / vimage branch. Permit kldload / kldunload operations to be executed only from the default vimage context. This change should have no functional impact on nooptions VIMAGE kernel builds. Reviewed by: bz Approved by: julian (mentor) Notes: svn path=/head/; revision=191915
* Improve the consistency of MAC Framework and MAC policy entry pointRobert Watson2009-03-081-9/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | naming by renaming certain "proc" entry points to "cred" entry points, reflecting their manipulation of credentials. For some entry points, the process was passed into the framework but not into policies; in these cases, stop passing in the process since we don't need it. mac_proc_check_setaudit -> mac_cred_check_setaudit mac_proc_check_setaudit_addr -> mac_cred_check_setaudit_addr mac_proc_check_setauid -> mac_cred_check_setauid mac_proc_check_setegid -> mac_cred_check_setegid mac_proc_check_seteuid -> mac_cred_check_seteuid mac_proc_check_setgid -> mac_cred_check_setgid mac_proc_check_setgroups -> mac_cred_ceck_setgroups mac_proc_check_setregid -> mac_cred_check_setregid mac_proc_check_setresgid -> mac_cred_check_setresgid mac_proc_check_setresuid -> mac_cred_check_setresuid mac_proc_check_setreuid -> mac_cred_check_setreuid mac_proc_check_setuid -> mac_cred_check_setuid Obtained from: TrustedBSD Project Sponsored by: Google, Inc. Notes: svn path=/head/; revision=189529
* The userland_sysctl() function retries sysctl_root() until returnedKonstantin Belousov2008-12-121-1/+1
| | | | | | | | | | | | | | | | | | | | | | error is not EAGAIN. Several sysctls that inspect another process use p_candebug() for checking access right for the curproc. p_candebug() returns EAGAIN for some reasons, in particular, for the process doing exec() now. If execing process tries to lock Giant, we get a livelock, because sysctl handlers are covered by Giant, and often do not sleep. Break the livelock by dropping Giant and allowing other threads to execute in the EAGAIN loop. Also, do not return EAGAIN from p_candebug() when process is executing, use more appropriate EBUSY error [1]. Reported and tested by: pho Suggested by: rwatson [1] Reviewed by: rwatson, des MFC after: 1 week Notes: svn path=/head/; revision=185983
* Retire the MALLOC and FREE macros. They are an abomination unto style(9).Dag-Erling Smørgrav2008-10-231-8/+8
| | | | | | | MFC after: 3 months Notes: svn path=/head/; revision=184205
* Add cr_canseeinpcb() doing checks using the cached socketBjoern A. Zeeb2008-10-171-0/+35
| | | | | | | | | | | | | credentials from inp_cred which is also available after the socket is gone. Switch cr_canseesocket consumers to cr_canseeinpcb. This removes an extra acquisition of the socket lock. Reviewed by: rwatson MFC after: 3 months (set timer; decide then) Notes: svn path=/head/; revision=183982
* Merge first in a series of TrustedBSD MAC Framework KPI changesRobert Watson2007-10-241-18/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | from Mac OS X Leopard--rationalize naming for entry points to the following general forms: mac_<object>_<method/action> mac_<object>_check_<method/action> The previous naming scheme was inconsistent and mostly reversed from the new scheme. Also, make object types more consistent and remove spaces from object types that contain multiple parts ("posix_sem" -> "posixsem") to make mechanical parsing easier. Introduce a new "netinet" object type for certain IPv4/IPv6-related methods. Also simplify, slightly, some entry point names. All MAC policy modules will need to be recompiled, and modules not updates as part of this commit will need to be modified to conform to the new KPI. Sponsored by: SPARTA (original patches against Mac OS X) Obtained from: TrustedBSD Project, Apple Computer Notes: svn path=/head/; revision=172930
* Eliminate now-unused SUSER_ALLOWJAIL arguments to priv_check_cred(); inRobert Watson2007-06-121-39/+20
| | | | | | | | | | | | | | | | | | some cases, move to priv_check() if it was an operation on a thread and no other flags were present. Eliminate caller-side jail exception checking (also now-unused); jail privilege exception code now goes solely in kern_jail.c. We can't yet eliminate suser() due to some cases in the KAME code where a privilege check is performed and then used in many different deferred paths. Do, however, move those prototypes to priv.h. Reviewed by: csjp Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=170587
* Move per-process audit state from a pointer in the proc structure toRobert Watson2007-06-071-0/+9
| | | | | | | | | | | | | | embedded storage in struct ucred. This allows audit state to be cached with the thread, avoiding locking operations with each system call, and makes it available in asynchronous execution contexts, such as deep in the network stack or VFS. Reviewed by: csjp Approved by: re (kensmith) Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=170407
* Further system call comment cleanup:Robert Watson2007-03-051-6/+4
| | | | | | | | | | | | | - Remove also "MP SAFE" after prior "MPSAFE" pass. (suggested by bde) - Remove extra blank lines in some cases. - Add extra blank lines in some cases. - Remove no-op comments consisting solely of the function name, the word "syscall", or the system call name. - Add punctuation. - Re-wrap some comments. Notes: svn path=/head/; revision=167232
* Remove 'MPSAFE' annotations from the comments above most system calls: allRobert Watson2007-03-041-97/+3
| | | | | | | | | | | system calls now enter without Giant held, and then in some cases, acquire Giant explicitly. Remove a number of other MPSAFE annotations in the credential code and tweak one or two other adjacent comments. Notes: svn path=/head/; revision=167211
* Sort copyrights together.Robert Watson2007-01-081-2/+4
| | | | | | | MFC after: 3 days Notes: svn path=/head/; revision=165897
* Add a new priv(9) kernel interface for checking the availability ofRobert Watson2006-11-061-89/+58
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | privilege for threads and credentials. Unlike the existing suser(9) interface, priv(9) exposes a named privilege identifier to the privilege checking code, allowing more complex policies regarding the granting of privilege to be expressed. Two interfaces are provided, replacing the existing suser(9) interface: suser(td) -> priv_check(td, priv) suser_cred(cred, flags) -> priv_check_cred(cred, priv, flags) A comprehensive list of currently available kernel privileges may be found in priv.h. New privileges are easily added as required, but the comments on adding privileges found in priv.h and priv(9) should be read before doing so. The new privilege interface exposed sufficient information to the privilege checking routine that it will now be possible for jail to determine whether a particular privilege is granted in the check routine, rather than relying on hints from the calling context via the SUSER_ALLOWJAIL flag. For now, the flag is maintained, but a new jail check function, prison_priv_check(), is exposed from kern_jail.c and used by the privilege check routine to determine if the privilege is permitted in jail. As a result, a centralized list of privileges permitted in jail is now present in kern_jail.c. The MAC Framework is now also able to instrument privilege checks, both to deny privileges otherwise granted (mac_priv_check()), and to grant privileges otherwise denied (mac_priv_grant()), permitting MAC Policy modules to implement privilege models, as well as control a much broader range of system behavior in order to constrain processes running with root privilege. The suser() and suser_cred() functions remain implemented, now in terms of priv_check() and the PRIV_ROOT privilege, for use during the transition and possibly continuing use by third party kernel modules that have not been updated. The PRIV_DRIVER privilege exists to allow device drivers to check privilege without adopting a more specific privilege identifier. This change does not modify the actual security policy, rather, it modifies the interface for privilege checks so changes to the security policy become more feasible. Sponsored by: nCircle Network Security, Inc. Obtained from: TrustedBSD Project Discussed on: arch@ Reviewed (at least in part) by: mlaier, jmg, pjd, bde, ceri, Alex Lyashkov <umka at sevcity dot net>, Skip Ford <skip dot ford at verizon dot net>, Antoine Brodin <antoine dot brodin at laposte dot net> Notes: svn path=/head/; revision=164032
* Complete break-out of sys/sys/mac.h into sys/security/mac/mac_framework.hRobert Watson2006-10-221-1/+1
| | | | | | | | | | | | | | | | begun with a repo-copy of mac.h to mac_framework.h. sys/mac.h now contains the userspace and user<->kernel API and definitions, with all in-kernel interfaces moved to mac_framework.h, which is now included across most of the kernel instead. This change is the first step in a larger cleanup and sweep of MAC Framework interfaces in the kernel, and will not be MFC'd. Obtained from: TrustedBSD Project Sponsored by: SPARTA Notes: svn path=/head/; revision=163606
* Declare security and security.bsd sysctl hierarchies in sysctl.h alongRobert Watson2006-09-171-3/+1
| | | | | | | | | | | with other commonly used sysctl name spaces, rather than declaring them all over the place. MFC after: 1 month Sponsored by: nCircle Network Security, Inc. Notes: svn path=/head/; revision=162383
* Add kern_setgroups() and kern_getgroups() and use them to implementJohn Baldwin2006-07-061-25/+42
| | | | | | | | | | | | ibcs2_[gs]etgroups() rather than using the stackgap. This also makes ibcs2_[gs]etgroups() MPSAFE. Also, it cleans up one bit of weirdness in the old setgroups() where it allocated an entire credential just so it had a place to copy the group list into. Now setgroups just allocates a NGROUPS_MAX array on the stack that it copies into and then passes to kern_setgroups(). Notes: svn path=/head/; revision=160139
* Audit the arguments (user/group IDs) for the system calls that set these IDs.Wayne Salamon2006-02-061-0/+17
| | | | | | | | Obtained from: TrustedBSD Project Approved by: rwatson (mentor) Notes: svn path=/head/; revision=155370
* Use the refcount API to manage the reference count for user credentialsJohn Baldwin2005-09-271-16/+6
| | | | | | | | | rather than using pool mutexes. Tested on: i386, alpha, sparc64 Notes: svn path=/head/; revision=150634
* Introduce p_canwait() and MAC Framework and MAC Policy entry pointsRobert Watson2005-04-181-0/+31
| | | | | | | | | | | | | | | | | | mac_check_proc_wait(), which control the ability to wait4() specific processes. This permits MAC policies to limit information flow from children that have changed label, although has to be handled carefully due to common programming expectations regarding the behavior of wait4(). The cr_seeotheruids() check in p_canwait() is #if 0'd for this reason. The mac_stub and mac_test policies are updated to reflect these new entry points. Sponsored by: SPAWAR, SPARTA Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=145234
* Introduce new MAC Framework and MAC Policy entry points to control the useRobert Watson2005-04-161-53/+137
| | | | | | | | | | | | | | | | | | | | | | | | | of system calls to manipulate elements of the process credential, including: setuid() mac_check_proc_setuid() seteuid() mac_check_proc_seteuid() setgid() mac_check_proc_setgid() setegid() mac_check_proc_setegid() setgroups() mac_check_proc_setgroups() setreuid() mac_check_proc_setreuid() setregid() mac_check_proc_setregid() setresuid() mac_check_proc_setresuid() setresgid() mac_check_rpoc_setresgid() MAC checks are performed before other existing security checks; both current credential and intended modifications are passed as arguments to the entry points. The mac_test and mac_stub policies are updated. Submitted by: Samy Al Bahra <samy@kerneled.org> Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=145147
* Impose the upper limit on signals that are allowed between kernel threadsMaxim Sobolev2005-03-181-2/+2
| | | | | | | | | | in set[ug]id program for compatibility with Linux. Linuxthreads uses 4 signals from SIGRTMIN to SIGRTMIN+3. Pointed out by: rwatson Notes: svn path=/head/; revision=143805
* Linuxthreads uses not only signal 32 but several signals >= 32.Maxim Sobolev2005-03-181-5/+5
| | | | | | | | PR: kern/72922 Submitted by: Andriy Gapon <avg@icyb.net.ua> Notes: svn path=/head/; revision=143800
* In linux emulation layer try to detect attempt to use linux_clone() toMaxim Sobolev2005-03-031-0/+12
| | | | | | | | | | | | | | | | | | | | | | | | | create kernel threads and call rfork(2) with RFTHREAD flag set in this case, which puts parent and child into the same threading group. As a result all threads that belong to the same program end up in the same threading group. This is similar to what linuxthreads port does, though in this case we don't have a luxury of having access to the source code and there is no definite way to differentiate linux_clone() called for threading purposes from other uses, so that we have to resort to heuristics. Allow SIGTHR to be delivered between all processes in the same threading group previously it has been blocked for s[ug]id processes. This also should improve locking of the same file descriptor from different threads in programs running under linux compat layer. PR: kern/72922 Reported by: Andriy Gapon <avg@icyb.net.ua> Idea suggested by: rwatson Notes: svn path=/head/; revision=143108
* Backout addition of SIGTHR into the list of signals allowed to be deliveredMaxim Sobolev2005-02-131-1/+0
| | | | | | | | | to the suid/sugid process, since apparently it has security implications. Suggested by: rwatson Notes: svn path=/head/; revision=141816
* Backout previous change (disabling of security checks for signals deliveredMaxim Sobolev2005-02-131-4/+5
| | | | | | | | | in emulation layers), since it appears to be too broad. Requested by: rwatson Notes: svn path=/head/; revision=141815
* Split out kill(2) syscall service routine into user-level and kernel part, theMaxim Sobolev2005-02-131-5/+4
| | | | | | | | | | | | | | | | | | | | former is callable from user space and the latter from the kernel one. Make kernel version take additional argument which tells if the respective call should check for additional restrictions for sending signals to suid/sugid applications or not. Make all emulation layers using non-checked version, since signal numbers in emulation layers can have different meaning that in native mode and such protection can cause misbehaviour. As a result remove LIBTHR from the signals allowed to be delivered to a suid/sugid application. Requested (sorta) by: rwatson MFC after: 2 weeks Notes: svn path=/head/; revision=141812
* Add SIGTHR (32) into list of signals permitted to be delivered to theMaxim Sobolev2005-02-111-0/+1
| | | | | | | | | | | | | | | | | | suid application. The problem is that Linux applications using old Linux threads (pre-NPTL) use signal 32 (linux SIGRTMIN) for communication between thread-processes. If such an linux application is installed suid or sgid and security.bsd.conservative_signals=1 (default), then permission will be denied to send such a signal and the application will freeze. I believe the same will be true for native applications that use libthr, since libthr uses SIGTHR for implementing conditional variables. PR: 72922 Submitted by: Andriy Gapon <avg@icyb.net.ua> MFC after: 2 weeks Notes: svn path=/head/; revision=141693
* Style cleanup: with removal of mutex operations, we can also removeRobert Watson2005-01-231-4/+2
| | | | | | | | | {}'s from securelevel_gt() and securelevel_ge(). MFC after: 1 week Notes: svn path=/head/; revision=140678
* When reading pr_securelevel from a prison, perform a lockless read,Robert Watson2005-01-231-4/+0
| | | | | | | | | | as it's an integer read operation and the resulting slight race is acceptable. MFC after: 1 week Notes: svn path=/head/; revision=140677
* /* -> /*- for copyright notices, minor format tweaks as necessaryWarner Losh2005-01-061-1/+1
| | | | Notes: svn path=/head/; revision=139804
* Remove sched_free_thread() which was only usedJulian Elischer2004-08-311-13/+0
| | | | | | | | | | | in diagnostics. It has outlived its usefulness and has started causing panics for people who turn on DIAGNOSTIC, in what is otherwise good code. MFC after: 2 days Notes: svn path=/head/; revision=134568
* Rename suser_cred()'s PRISON_ROOT flag to SUSER_ALLOWJAIL. This isColin Percival2004-07-261-21/+21
| | | | | | | | | | | | | | somewhat clearer, but more importantly allows for a consistent naming scheme for suser_cred flags. The old name is still defined, but will be removed in a few days (unless I hear any complaints...) Discussed with: rwatson, scottl Requested by: jhb Notes: svn path=/head/; revision=132653
* In setpgid(), since td is passed in as a system call argument, use itRobert Watson2004-07-231-1/+1
| | | | | | | in preference to curthread, which costs slightly more. Notes: svn path=/head/; revision=132568
* suser() accepts a thread argument; as suser() dereferences td_ucred, aRobert Watson2004-07-221-0/+12
| | | | | | | | | | | | thread-local pointer, in practice that thread needs to be curthread. If we're running with INVARIANTS, generate a warning if not. If we have KDB compiled in, generate a stack trace. This doesn't fire at all in my local test environment, but could be irritating if it fires frequently for someone, so there will be motivation to fix things quickly when it does. Notes: svn path=/head/; revision=132548
* Add a SUSER_RUID flag to suser_cred. This flag indicates that we want toColin Percival2004-07-161-3/+2
| | | | | | | | | | check if the *real* user is the superuser (vs. the normal behaviour, which checks the effective user). Reviewed by: rwatson Notes: svn path=/head/; revision=132255
* Socket MAC labels so_label and so_peerlabel are now protected byRobert Watson2004-06-131-0/+2
| | | | | | | | | | | | | | | | SOCK_LOCK(so): - Hold socket lock over calls to MAC entry points reading or manipulating socket labels. - Assert socket lock in MAC entry point implementations. - When externalizing the socket label, first make a thread-local copy while holding the socket lock, then release the socket lock to externalize to userspace. Notes: svn path=/head/; revision=130398
* Deorbit COMPAT_SUNOS.Poul-Henning Kamp2004-06-111-3/+3
| | | | | | | | We inherited this from the sparc32 port of BSD4.4-Lite1. We have neither a sparc32 port nor a SunOS4.x compatibility desire these days. Notes: svn path=/head/; revision=130344
* Remove advertising clause from University of California Regent's license,Warner Losh2004-04-051-4/+0
| | | | | | | | | per letter dated July 22, 1999. Approved by: core Notes: svn path=/head/; revision=127911
* Don't grab Giant in crfree(), since prison_free() no longer requires it.Robert Watson2004-01-231-3/+1
| | | | | | | | | | | | | | | | | The uidinfo code appears to be MPSAFE, and is referenced without Giant elsewhere. While this grab of Giant was only made in fairly rare circumstances (actually GC'ing on refcount==0), grabbing Giant here potentially introduces lock order issues with any locks held by the caller. So this probably won't help performance much unless you change credentials a lot in an application, and leave a lot of file descriptors and cached credentials around. However, it simplifies locking down consumers of the credential interfaces. Bumped into by: sam Appeased: tjr Notes: svn path=/head/; revision=124884
* Rename mac_create_cred() MAC Framework entry point to mac_copy_cred(),Robert Watson2003-12-061-1/+1
| | | | | | | | | | | | | | | | and the mpo_create_cred() MAC policy entry point to mpo_copy_cred_label(). This is more consistent with similar entry points for creation and label copying, as mac_create_cred() was called from crdup() as opposed to during process creation. For a number of policies, this removes the requirement for special handling when copying credential labels, and improves consistency. Approved by: re (scottl) Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories Notes: svn path=/head/; revision=123173
* Add a sysctl, security.bsd.see_other_gids, similar in semanticsRobert Watson2003-11-171-2/+51
| | | | | | | | | | to see_other_uids but with the logical conversion. This is based on (but not identical to) the patch submitted by Samy Al Bahra. Submitted by: Samy Al Bahra <samy@kerneled.com> Notes: svn path=/head/; revision=122869
* Writes to p_flag in __setugid() no longer need Giant.John Baldwin2003-10-231-4/+0
| | | | Notes: svn path=/head/; revision=121444
* Add a new sysctl, security.bsd.conservative_signals, to disableRobert Watson2003-09-141-1/+16
| | | | | | | | | | | | | | | special signal-delivery protections for setugid processes. In the event that a system is relying on "unusual" signal delivery to processes that change their credentials, this can be used to work around application problems. Also, add SIGALRM to the set of signals permitted to be delivered to setugid processes by unprivileged subjects. Reported by: Joe Greco <jgreco@ns.sol.net> Notes: svn path=/head/; revision=120052
* Extend the mutex pool implementation to permit the creation and use ofDon Lewis2003-07-131-1/+1
| | | | | | | | | | | | | | | | | | | multiple mutex pools with different options and sizes. Mutex pools can be created with either the default sleep mutexes or with spin mutexes. A dynamically created mutex pool can now be destroyed if it is no longer needed. Create two pools by default, one that matches the existing pool that uses the MTX_NOWITNESS option that should be used for building higher level locks, and a new pool with witness checking enabled. Modify the users of the existing mutex pool to use the appropriate pool in the new implementation. Reviewed by: jhb Notes: svn path=/head/; revision=117494
* In setpgrp(), don't assume a pgrp won't exist if the provided pgid is the sameOlivier Houchard2003-07-041-12/+13
| | | | | | | | | | as the target process' pid, it may exist if the process forked before leaving the pgrp. Thix fixes a panic that happens when calling setpgid to make a process re-enter the pgrp with the same pgid as its pid if the pgrp still exists. Notes: svn path=/head/; revision=117214
generated by cgit v1.2.3 (git 2.25.1) at 2025-12-08 20:27:05 +0000