summaryrefslogtreecommitdiff
path: root/sys/kern/kern_prot.c
Commit message (Collapse)AuthorAgeFilesLines
* Include file cleanup; mac.h and malloc.h at one point had orderingRobert Watson2002-08-011-1/+1
| | | | | | | | | relationship requirements, and no longer do. Reminded by: bde Notes: svn path=/head/; revision=101173
* Introduce support for Mandatory Access Control and extensibleRobert Watson2002-07-311-3/+21
| | | | | | | | | | | | | | | kernel access control. Implement inter-process access control entry points for the MAC framework. This permits policy modules to augment the decision making process for process and socket visibility, process debugging, re-scheduling, and signaling. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs Notes: svn path=/head/; revision=101003
* Introduce support for Mandatory Access Control and extensibleRobert Watson2002-07-311-0/+11
| | | | | | | | | | | | | | | | | kernel access control. Invoke the necessary MAC entry points to maintain labels on process credentials. In particular, invoke entry points for the initialization and destruction of struct ucred, the copying of struct ucred, and permit the initial labels to be set for both process 0 (parent of all kernel processes) and process 1 (parent of all user processes). Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs Notes: svn path=/head/; revision=101001
* Revert removal of cred_free_thread(): It is used to ensure that a thread'sJonathan Mini2002-07-111-0/+13
| | | | | | | | | | credentials are not improperly borrowed when the thread is not current in the kernel. Requested by: jhb, alfred Notes: svn path=/head/; revision=99753
* More caddr_t removal, make fo_ioctl take a void * instead of a caddr_t.Alfred Perlstein2002-06-291-20/+17
| | | | Notes: svn path=/head/; revision=99009
* Remove unused diagnostic function cread_free_thread().Jonathan Mini2002-06-241-13/+0
| | | | | | | Approved by: alfred Notes: svn path=/head/; revision=98727
* Squish the "could sleep with process lock" messages caused by callingAlfred Perlstein2002-06-191-14/+40
| | | | | | | | | | | | | | | | | | | | | | | uifind() with a proc lock held. change_ruid() and change_euid() have been modified to take a uidinfo structure which will be pre-allocated by callers, they will then call uihold() on the uidinfo structure so that the caller's logic is simplified. This allows one to call uifind() before locking the proc struct and thereby avoid a potential blocking allocation with the proc lock held. This may need revisiting, perhaps keeping a spare uidinfo allocated per process to handle this situation or re-examining if the proc lock needs to be held over the entire operation of changing real or effective user id. Submitted by: Don Lewis <dl-freebsd@catspoiler.org> Notes: svn path=/head/; revision=98417
* setsugid() touches p->p_flag so assert that the proc is locked.Alfred Perlstein2002-06-181-0/+2
| | | | Notes: svn path=/head/; revision=98403
* Change p_can{debug,see,sched,signal}()'s first argument to be a threadJohn Baldwin2002-05-191-60/+69
| | | | | | | | | | pointer instead of a proc pointer and require the process pointed to by the second argument to be locked. We now use the thread ucred reference for the credential checks in p_can*() as a result. p_canfoo() should now no longer need Giant. Notes: svn path=/head/; revision=96886
* As malloc(9) and free(9) are now Giant-free, remove the Giant lockSeigo Tanimura2002-05-031-16/+5
| | | | | | | across malloc(9) and free(9) of a pgrp or a session. Notes: svn path=/head/; revision=95973
* Push down Giant for setpgid(), setsid() and aio_daemon(). Giant protects onlySeigo Tanimura2002-04-201-11/+14
| | | | | | | malloc(9) and free(9). Notes: svn path=/head/; revision=95123
* - Lock proctree_lock instead of pgrpsess_lock.John Baldwin2002-04-161-35/+20
| | | | | | | - Simplify return logic of setsid() and setpgid(). Notes: svn path=/head/; revision=94859
* - Change the algorithms of the syscalls to modify process credentials toJohn Baldwin2002-04-131-83/+137
| | | | | | | | | | | | | | | allocate a blank cred first, lock the process, perform checks on the old process credential, copy the old process credential into the new blank credential, modify the new credential, update the process credential pointer, unlock the process, and cleanup rather than trying to allocate a new credential after performing the checks on the old credential. - Cleanup _setugid() a little bit. - setlogin() doesn't need Giant thanks to pgrp/session locking and td_ucred. Notes: svn path=/head/; revision=94619
* - Axe a stale comment. We haven't allowed the ucred pointer passed toJohn Baldwin2002-04-031-9/+2
| | | | | | | | | | | securelevel_*() to be NULL for a while now. - Use KASSERT() instead of if (foo) panic(); to optimize the !INVARIANTS case. Submitted by: Martin Faxer <gmh003532@brfmasthugget.se> Notes: svn path=/head/; revision=93732
* Change the suser() API to take advantage of td_ucred as well as do aJohn Baldwin2002-04-011-53/+32
| | | | | | | | | | | | | | | general cleanup of the API. The entire API now consists of two functions similar to the pre-KSE API. The suser() function takes a thread pointer as its only argument. The td_ucred member of this thread must be valid so the only valid thread pointers are curthread and a few kernel threads such as thread0. The suser_cred() function takes a pointer to a struct ucred as its first argument and an integer flag as its second argument. The flag is currently only used for the PRISON_ROOT flag. Discussed on: smp@ Notes: svn path=/head/; revision=93593
* Whitespace only change: use ANSI function declarations instead of K&R.John Baldwin2002-04-011-130/+46
| | | | Notes: svn path=/head/; revision=93580
* Fix style bug in previous commit.John Baldwin2002-04-011-1/+1
| | | | Notes: svn path=/head/; revision=93557
* Compromise for critical*()/cpu_critical*() recommit. Cleanup the interruptMatthew Dillon2002-03-271-12/+11
| | | | | | | | | | | | | | | | | | | | | | disablement assumptions in kern_fork.c by adding another API call, cpu_critical_fork_exit(). Cleanup the td_savecrit field by moving it from MI to MD. Temporarily move cpu_critical*() from <arch>/include/cpufunc.h to <arch>/<arch>/critical.c (stage-2 will clean this up). Implement interrupt deferral for i386 that allows interrupts to remain enabled inside critical sections. This also fixes an IPI interlock bug, and requires uses of icu_lock to be enclosed in a true interrupt disablement. This is the stage-1 commit. Stage-2 will occur after stage-1 has stabilized, and will move cpu_critical*() into its own header file(s) + other things. This commit may break non-i386 architectures in trivial ways. This should be temporary. Reviewed by: core Approved by: core Notes: svn path=/head/; revision=93264
* Use td_ucred in several trivial syscalls and remove Giant locking asJohn Baldwin2002-03-221-32/+16
| | | | | | | appropriate. Notes: svn path=/head/; revision=92987
* Use explicit Giant locks and unlocks for rather than instrumented ones forJohn Baldwin2002-03-221-6/+5
| | | | | | | | | code that is still not safe. suser() reads p_ucred so it still needs Giant for the time being. This should allow kern.giant.proc to be set to 0 for the time being. Notes: svn path=/head/; revision=92985
* Merge from TrustedBSD MAC branch:Robert Watson2002-03-221-0/+23
| | | | | | | | | | | | | | | | | Move the network code from using cr_cansee() to check whether a socket is visible to a requesting credential to using a new function, cr_canseesocket(), which accepts a subject credential and object socket. Implement cr_canseesocket() so that it does a prison check, a uid check, and add a comment where shortly a MAC hook will go. This will allow MAC policies to seperately instrument the visibility of sockets from the visibility of processes. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs Notes: svn path=/head/; revision=92976
* Since cred never appears to be passed into the securelevel calls asRobert Watson2002-03-221-2/+2
| | | | | | | | | | | | | | | | | NULL, turn warning printf's into panic's, since this call has been restructured such that a NULL cred would result in a page fault anyway. There appears to be one case where NULL is explicitly passed in in the sysctl code, and this is believed to be in error, so will be modified. Securelevels now always require a credential context so that per-jail securelevels are properly implemented. Obtained from: TrustedBSD Project Sponsored by: NAI Labs Discussed with: bde Notes: svn path=/head/; revision=92951
* Break out the "see_other_uids" policy check from the variousRobert Watson2002-03-221-4/+28
| | | | | | | | | | | | | | | | method-based inter-process security checks. To do this, introduce a new cr_seeotheruids(u1, u2) function, which encapsulates the "see_other_uids" logic. Call out to this policy following the jail security check for all of {debug,sched,see,signal} inter-process checks. This more consistently enforces the check, and makes the check easy to modify. Eventually, it may be that this check should become a MAC policy, loaded via a module. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs Notes: svn path=/head/; revision=92923
* - Push down Giant into crfree() in the case that we actually free a ucred.John Baldwin2002-03-201-0/+15
| | | | | | | | | - Add a cred_free_thread() function (conditional on DIAGNOSTICS) that drops a per-thread ucred reference to be used in debugging code when leaving the kernel. Notes: svn path=/head/; revision=92823
* Stop abusing the pgrpsess_lock.Seigo Tanimura2002-03-111-2/+0
| | | | Notes: svn path=/head/; revision=92069
* Temporarily lock Giant while we update td_ucred. The proc lock doesn'tJohn Baldwin2002-02-271-6/+6
| | | | | | | | | | | | | fully protect p_ucred yet so Giant is needed until all the p_ucred locking is done. This is the original reason td_ucred was not used immediately after its addition. Unfortunately, not using td_ucred is not enough to avoid problems. Since p_ucred could be stale, we could actually be dereferencing a stale pointer to dink with the refcount, so we really need Giant to avoid foot-shooting. This allows td_ucred to be safely used as well. Notes: svn path=/head/; revision=91405
* Return ESRCH if the target process is not inferior to the curproc.Seigo Tanimura2002-02-271-0/+2
| | | | | | | Spotted by: HIROSHI OOTA <oota@LSi.nec.co.jp> Notes: svn path=/head/; revision=91371
* Introduce a version field to `struct xucred' in place of one of theDima Dorfman2002-02-271-0/+16
| | | | | | | | | | | | | | | spares (the size of the field was changed from u_short to u_int to reflect what it really ends up being). Accordingly, change users of xucred to set and check this field as appropriate. In the kernel, this is being done inside the new cru2x() routine which takes a `struct ucred' and fills out a `struct xucred' according to the former. This also has the pleasant sideaffect of removing some duplicate code. Reviewed by: rwatson Notes: svn path=/head/; revision=91354
* Lock struct pgrp, session and sigio.Seigo Tanimura2002-02-231-38/+124
| | | | | | | | | | | | | | | | | | | | | | | | | | | | New locks are: - pgrpsess_lock which locks the whole pgrps and sessions, - pg_mtx which protects the pgrp members, and - s_mtx which protects the session members. Please refer to sys/proc.h for the coverage of these locks. Changes on the pgrp/session interface: - pgfind() needs the pgrpsess_lock held. - The caller of enterpgrp() is responsible to allocate a new pgrp and session. - Call enterthispgrp() in order to enter an existing pgrp. - pgsignal() requires a pgrp lock held. Reviewed by: jhb, alfred Tested on: cvsup.jp.FreeBSD.org (which is a quad-CPU machine running -current) Notes: svn path=/head/; revision=91140
* replace the embedded cr_mtx in the ucred structure with cr_mtxp (a mutexMatthew Dillon2002-02-171-9/+11
| | | | | | | | pointer), and use the mutex pool routines. This greatly reduces the size of the ucred structure. Notes: svn path=/head/; revision=90756
* If the credential on an incoming thread is correct, don't botherJulian Elischer2002-02-171-0/+21
| | | | | | | | | | | reaquiring it. In the same vein, don't bother dropping the thread cred when goinf ot userland. We are guaranteed to nned it when we come back, (which we are guaranteed to do). Reviewed by: jhb@freebsd.org, bde@freebsd.org (slightly different version) Notes: svn path=/head/; revision=90748
* - Attempt to help declutter kern. sysctl by moving security out fromAndrew R. Reiter2002-01-161-8/+7
| | | | | | | | | beneath it. Reviewed by: rwatson Notes: svn path=/head/; revision=89414
* - Push much of the logic for p_cansignal() behind cr_cansignal, whichRobert Watson2002-01-061-30/+45
| | | | | | | | | | | | | | | | | | | authorized based on a subject credential rather than a subject process. This will permit the same logic to be reused in situations where only the credential generating the signal is available, such as in the delivery of SIGIO. - Because of two clauses, the automatic success against curproc, and the session semantics for SIGCONT, not all logic can be pushed into cr_cansignal(), but those cases should not apply for most other consumers of cr_cansignal(). - This brings the base system inter-process authorization code more into line with the MAC implementation. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs Notes: svn path=/head/; revision=88943
* o A few more minor whitespace and other style fixes.Robert Watson2001-12-061-6/+7
| | | | | | | Submitted by: bde Notes: svn path=/head/; revision=87466
* o Remove unnecessary inclusion of opt_global.h.Robert Watson2001-12-061-1/+0
| | | | | | | Submitted by: bde Notes: svn path=/head/; revision=87465
* o Make kern.security.bsd.suser_enabled TUNABLE.Robert Watson2001-12-051-0/+1
| | | | | | | Requested by: green Notes: svn path=/head/; revision=87412
* o Update an instance of 'unprivileged_procdebug_permitted' missedRobert Watson2001-12-031-6/+6
| | | | | | | | in the previous commit: the comment should also call it 'unprivileged_proc_debug'. Notes: svn path=/head/; revision=87280
* o Introduce pr_mtx into struct prison, providing protection for theRobert Watson2001-12-031-2/+8
| | | | | | | | | | | | | | | | | | | | | mutable contents of struct prison (hostname, securelevel, refcount, pr_linux, ...) o Generally introduce mtx_lock()/mtx_unlock() calls throughout kern/ so as to enforce these protections, in particular, in kern_mib.c protection sysctl access to the hostname and securelevel, as well as kern_prot.c access to the securelevel for access control purposes. o Rewrite linux emulator abstractions for accessing per-jail linux mib entries (osname, osrelease, osversion) so that they don't return a pointer to the text in the struct linux_prison, rather, a copy to an array passed into the calls. Likewise, update linprocfs to use these primitives. o Update in_pcb.c to always use prison_getip() rather than directly accessing struct prison. Reviewed by: jhb Notes: svn path=/head/; revision=87275
* o Uniformly copy uap arguments into local variables before grabbingRobert Watson2001-12-021-3/+1
| | | | | | | giant, and make whitespace more consistent around giant-frobbing. Notes: svn path=/head/; revision=87220
* o Remove KSE race in setuid() in which oldcred was preserved before giantRobert Watson2001-12-021-1/+1
| | | | | | | | was grabbed. This was introduced in 1.101 when the giant pushdown for kern_prot.c was originally performed. Notes: svn path=/head/; revision=87219
* o General style, formatting, etc, improvements:Robert Watson2001-12-021-167/+107
| | | | | | | | | | | | | | | - uid's -> uids - whitespace improvements, linewrap improvements - reorder copyright more appropriately - remove redundant MP SAFE comments, add one "NOT MPSAFE?" for setgroups(), which seems to be the sole un-changed system call in the file. - clean up securelevel_g?() functions, improve comments. Largely submitted by: bde Notes: svn path=/head/; revision=87218
* o Further sysctl name simplification, generally stripping 'permitted',Robert Watson2001-11-301-9/+9
| | | | | | | | | | | using '_'s more consistently. Discussed with: bde, jhb Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs Notes: svn path=/head/; revision=87144
* o Move current inhabitants of kern.security to kern.security.bsd, soRobert Watson2001-11-301-14/+16
| | | | | | | | | | | | that new models can inhabit kern.security.<modelname>. o While I'm there, shorten somewhat excessive variable names, and clean things up a little. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs Notes: svn path=/head/; revision=87138
* Clean up breakage in inferior() I introduced in 1.92 of kern_proc.c:John Baldwin2001-11-121-0/+3
| | | | | | | | | | | | | - Restore inferior() to being iterative rather than recursive. - Assert that the proctree_lock is held in inferior() and change the one caller to get a shared lock of it. This also ensures that we hold the lock after performing the check so the check can't be made invalid out from under us after the check but before we act on it. Requested by: bde Notes: svn path=/head/; revision=86304
* o Introduce group subset test, which limits the ability of a process toRobert Watson2001-11-021-8/+36
| | | | | | | | | | | | | | | | | | | | | | debug another process based on their respective {effective,additional, saved,real} gid's. p1 is only permitted to debug p2 if its effective gids (egid + additional groups) are a strict superset of the gids of p2. This implements properly the security test previously incorrectly implemented in kern_ktrace.c, and is consistent with the kernel security policy (although might be slightly confusing for those more familiar with the userland policy). o Restructure p_candebug() logic so that various results are generated comparing uids, gids, credential changes, and then composed in a single check before testing for privilege. These tests encapsulate the "BSD" inter-process debugging policy. Other non-BSD checks remain seperate. Additional comments are added. Submitted by: tmm, rwatson Obtained from: TrustedBSD Project Reviewed by: petef, tmm, rwatson Notes: svn path=/head/; revision=85895
* o Add a comment to p_candebug() noting that the P_INEXEC check shouldRobert Watson2001-11-021-1/+6
| | | | | | | | | | | | | | | really be moved elsewhere: p_candebug() encapsulates the security policy decision, whereas the P_INEXEC check has to do with "correctness" regarding race conditions, rather than security policy. Example: even if no security protections were enforced (the "uids are advisory" model), removing P_INEXEC could result in incorrect operation due to races on credential evaluation and modification during execve(). Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=85880
* o Capabilities cap_check() interface revised to remove _xxx, so renameRobert Watson2001-11-021-1/+1
| | | | | | | | | in p_cansched(). Also, replace '0' with 'NULL' for the ucred * pointer. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=85874
* Add a P_INEXEC flag that indicates that the process has called execve() andDag-Erling Smørgrav2001-10-271-0/+4
| | | | | | | | | | | it has not yet returned. Use this flag to deny debugging requests while the process is execve()ing, and close once and for all any race conditions that might occur between execve() and various debugging interfaces. Reviewed by: jhb, rwatson Notes: svn path=/head/; revision=85598
* Add mtx_lock_giant() and mtx_unlock_giant() wrappers for sysctl managementMatthew Dillon2001-10-261-6/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | of Giant during the Giant unwinding phase, and start work on instrumenting Giant for the file and proc mutexes. These wrappers allow developers to turn on and off Giant around various subsystems. DEVELOPERS SHOULD NEVER TURN OFF GIANT AROUND A SUBSYSTEM JUST BECAUSE THE SYSCTL EXISTS! General developers should only considering turning on Giant for a subsystem whos default is off (to help track down bugs). Only developers working on particular subsystems who know what they are doing should consider turning off Giant. These wrappers will greatly improve our ability to unwind Giant and test the kernel on a (mostly) subsystem by subsystem basis. They allow Giant unwinding developers (GUDs) to emplace appropriate subsystem and structural mutexes in the main tree and then request that the larger community test the work by turning off Giant around the subsystem(s), without the larger community having to mess around with patches. These wrappers also allow GUDs to boot into a (more likely to be) working system in the midst of their unwinding work and to test that work under more controlled circumstances. There is a master sysctl, kern.giant.all, which defaults to 0 (off). If turned on it overrides *ALL* other kern.giant sysctls and forces Giant to be turned on for all wrapped subsystems. If turned off then Giant around individual subsystems are controlled by various other kern.giant.XXX sysctls. Code which overlaps multiple subsystems must have all related subsystem Giant sysctls turned off in order to run without Giant. Notes: svn path=/head/; revision=85564
* Change the kernel's ucred API as follows:John Baldwin2001-10-111-22/+29
| | | | | | | | | | | - crhold() returns a reference to the ucred whose refcount it bumps. - crcopy() now simply copies the credentials from one credential to another and has no return value. - a new crshared() primitive is added which returns true if a ucred's refcount is > 1 and false (0) otherwise. Notes: svn path=/head/; revision=84827
generated by cgit v1.2.3 (git 2.25.1) at 2025-12-08 22:07:32 +0000