summaryrefslogtreecommitdiff
path: root/sys/kern
Commit message (Collapse)AuthorAgeFilesLines
* Make this driver play ball with devfs(5).Dima Dorfman2001-04-171-3/+19
| | | | | | | Reviewed by: brian Notes: svn path=/head/; revision=75633
* Add a sanity check on ucred refcount.Alfred Perlstein2001-04-171-0/+1
| | | | | | | Submitted by: Terry Lambert <terry@lambert.org> Notes: svn path=/head/; revision=75632
* Implement client side NFS locks.Alfred Perlstein2001-04-171-1/+1
| | | | | | | | Obtained from: BSD/os Import Ok'd by: mckusick, jkh, motd on builder.freebsd.org Notes: svn path=/head/; revision=75631
* Write a switch statement as less obscure if statements.Poul-Henning Kamp2001-04-171-18/+8
| | | | Notes: svn path=/head/; revision=75629
* Fix an old bug related to BETTER_CLOCK. Call forward_*clock if SMPJohn Baldwin2001-04-171-3/+3
| | | | | | | | | | | | and __i386__ are defined rather than if SMP and BETTER_CLOCK are defined. The removal of BETTER_CLOCK would have broken this except that kern_clock.c doesn't include <machine/smptests.h>, so it doesn't see the definition of BETTER_CLOCK, and forward_*clock aren't called, even on 4.x. This seems to fix the problem where a n-way SMP system would see 100 * n clk interrupts and 128 * n rtc interrupts. Notes: svn path=/head/; revision=75616
* This patch removes the VOP_BWRITE() vector.Poul-Henning Kamp2001-04-176-19/+12
| | | | | | | | | | | | | | | | VOP_BWRITE() was a hack which made it possible for NFS client side to use struct buf with non-bio backing. This patch takes a more general approach and adds a bp->b_op vector where more methods can be added. The success of this patch depends on bp->b_op being initialized all relevant places for some value of "relevant" which is not easy to determine. For now the buffers have grown a b_magic element which will make such issues a tiny bit easier to debug. Notes: svn path=/head/; revision=75580
* Add debugging option to always read/write cylinder groups as fullKirk McKusick2001-04-171-1/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | sized blocks. To enable this option, use: `sysctl -w debug.bigcgs=1'. Add debugging option to disable background writes of cylinder groups. To enable this option, use: `sysctl -w debug.dobkgrdwrite=0'. These debugging options should be tried on systems that are panicing with corrupted cylinder group maps to see if it makes the problem go away. The set of panics in question are: ffs_clusteralloc: map mismatch ffs_nodealloccg: map corrupted ffs_nodealloccg: block not in map ffs_alloccg: map corrupted ffs_alloccg: block not in map ffs_alloccgblk: cyl groups corrupted ffs_alloccgblk: can't find blk in cyl ffs_checkblk: partially free fragment The following panics are less likely to be related to this problem, but might be helped by these debugging options: ffs_valloc: dup alloc ffs_blkfree: freeing free block ffs_blkfree: freeing free frag ffs_vfree: freeing free inode If you try these options, please report whether they helped reduce your bitmap corruption panics to Kirk McKusick at <mckusick@mckusick.com> and to Matt Dillon <dillon@earth.backplane.com>. Notes: svn path=/head/; revision=75573
* In my first reading of POSIX.1e, I misinterpreted handling of theRobert Watson2001-04-173-135/+297
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ACL_USER_OBJ and ACL_GROUP_OBJ fields, believing that modification of the access ACL could be used by privileged processes to change file/directory ownership. In fact, this is incorrect; ACL_*_OBJ (+ ACL_MASK and ACL_OTHER) should have undefined ae_id fields; this commit attempts to correct that misunderstanding. o Modify arguments to vaccess_acl_posix1e() to accept the uid and gid associated with the vnode, as those can no longer be extracted from the ACL passed as an argument. Perform all comparisons against the passed arguments. This actually has the effect of simplifying a number of components of this call, as well as reducing the indent level, but now seperates handling of ACL_GROUP_OBJ from ACL_GROUP. o Modify acl_posix1e_check() to return EINVAL if the ae_id field of any of the ACL_{USER_OBJ,GROUP_OBJ,MASK,OTHER} entries is a value other than ACL_UNDEFINED_ID. As a temporary work-around to allow clean upgrades, set the ae_id field to ACL_UNDEFINED_ID before each check so that this cannot cause a failure in the short term (this work-around will be removed when the userland libraries and utilities are updated to take this change into account). o Modify ufs_sync_acl_from_inode() so that it forces ACL_{USER_OBJ,GROUP_OBJ,MASK,OTHER} ae_id fields to ACL_UNDEFINED_ID when synchronizing the ACL from the inode. o Modify ufs_sync_inode_from_acl to not propagate uid and gid information to the inode from the ACL during ACL update. Also modify the masking of permission bits that may be set from ALLPERMS to (S_IRWXU|S_IRWXG|S_IRWXO), as ACLs currently do not carry none-ACCESSPERMS (S_ISUID, S_ISGID, S_ISTXT). o Modify ufs_getacl() so that when it emulates an access ACL from the inode, it initializes the ae_id fields to ACL_UNDEFINED_ID. o Clean up ufs_setacl() substantially since it is no longer possible to perform chown/chgrp operations using vop_setacl(), so all the access control for that can be eliminated. o Modify ufs_access() so that it passes owner uid and gid information into vaccess_acl_posix1e(). Pointed out by: jedger Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=75571
* Blow away the panic mutex in favor of using a single atomic_cmpset() on aJohn Baldwin2001-04-172-5/+9
| | | | | | | | | panic_cpu shared variable. I used a simple atomic operation here instead of a spin lock as it seemed to be excessive overhead. Also, this can avoid recursive panics if, for example, witness is broken. Notes: svn path=/head/; revision=75570
* Check to see if enroll() returns NULL in the witness initialization. ThisJohn Baldwin2001-04-171-0/+4
| | | | | | | | | | can happen if witness runs out of resources during initialization or if witness_skipspin is enabled. Sleuthing by: Peter Jeremy <peter.jeremy@alcatel.com.au> Notes: svn path=/head/; revision=75569
* Exit and re-enter the critical section while spinning for a spinlock soJohn Baldwin2001-04-172-0/+6
| | | | | | | that interrupts can come in while we are waiting for a lock. Notes: svn path=/head/; revision=75568
* Update to the 2001-04-02 version of the nanokernel code from Dave Mills.John Hay2001-04-161-22/+28
| | | | Notes: svn path=/head/; revision=75540
* Call strlen() once instead of twice.Brian Somers2001-04-141-2/+2
| | | | Notes: svn path=/head/; revision=75519
* o Since uid checks in p_cansignal() are now identical between P_SUGIDRobert Watson2001-04-131-28/+14
| | | | | | | | | | | | and non-P_SUGID cases, simplify p_cansignal() logic so that the P_SUGID masking of possible signals is independent from uid checks, removing redundant code and generally improving readability. Reviewed by: tmm Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=75480
* convert if/panic -> KASSERT, explain what triggered the assertionAlfred Perlstein2001-04-131-2/+4
| | | | Notes: svn path=/head/; revision=75472
* Generate useful error messages.Murray Stokely2001-04-131-4/+4
| | | | Notes: svn path=/head/; revision=75470
* Handle a rare but fatal race invoked sometimes when SIGSTOP isMark Murray2001-04-132-2/+2
| | | | | | | invoked. Notes: svn path=/head/; revision=75468
* - Add a comment at the start of the spin locks list.John Baldwin2001-04-131-1/+4
| | | | | | | - The alpha SMP code uses an "ap boot" spinlock as well. Notes: svn path=/head/; revision=75464
* o Disallow two "allow this" exceptions in p_cansignal() restrictingRobert Watson2001-04-131-5/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | the ability of unprivileged processes to deliver arbitrary signals to daemons temporarily taking on unprivileged effective credentials when P_SUGID is not set on the target process: Removed: (p1->p_cred->cr_ruid != ps->p_cred->cr_uid) (p1->p_ucred->cr_uid != ps->p_cred->cr_uid) o Replace two "allow this" exceptions in p_cansignal() restricting the ability of unprivileged processes to deliver arbitrary signals to daemons temporarily taking on unprivileged effective credentials when P_SUGID is set on the target process: Replaced: (p1->p_cred->p_ruid != p2->p_ucred->cr_uid) (p1->p_cred->cr_uid != p2->p_ucred->cr_uid) With: (p1->p_cred->p_ruid != p2->p_ucred->p_svuid) (p1->p_ucred->cr_uid != p2->p_ucred->p_svuid) o These changes have the effect of making the uid-based handling of both P_SUGID and non-P_SUGID signal delivery consistent, following these four general cases: p1's ruid equals p2's ruid p1's euid equals p2's ruid p1's ruid equals p2's svuid p1's euid equals p2's svuid The P_SUGID and non-P_SUGID cases can now be largely collapsed, and I'll commit this in a few days if no immediate problems are encountered with this set of changes. o These changes remove a number of warning cases identified by the proc_to_proc inter-process authorization regression test. o As these are new restrictions, we'll have to watch out carefully for possible side effects on running code: they seem reasonable to me, but it's possible this change might have to be backed out if problems are experienced. Submitted by: src/tools/regression/security/proc_to_proc/testuid Reviewed by: tmm Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=75457
* o Disable two "allow this" exceptions in p_cansched()m retricting theRobert Watson2001-04-121-1/+4
| | | | | | | | | | | | | | | | | | | | | ability of unprivileged processes to modify the scheduling properties of daemons temporarily taking on unprivileged effective credentials. These cases (p1->p_cred->p_ruid == p2->p_ucred->cr_uid) and (p1->p_ucred->cr_uid == p2->p_ucred->cr_uid), respectively permitting a subject process to influence the scheduling of a daemon if the subject process has the same real uid or effective uid as the daemon's effective uid. This removes a number of the warning cases identified by the proc_to_proc iner-process authorization regression test. o As these are new restrictions, we'll have to watch out carefully for possible side effects on running code: they seem reasonable to me, but it's possible this change might have to be backed out if problems are experienced. Reported by: src/tools/regression/security/proc_to_proc/testuid Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=75453
* o Make kqueue's filt_procattach() function use the error value returnedRobert Watson2001-04-121-2/+3
| | | | | | | | | | | | by p_can(...P_CAN_SEE), rather than returning EACCES directly. This brings the error code used here into line with similar arrangements elsewhere, and prevents the leakage of pid usage information. Reviewed by: jlemon Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=75451
* o Limit process information leakage by introducing a p_can(...P_CAN_SEE...)Robert Watson2001-04-121-0/+2
| | | | | | | | | in rtprio()'s RTP_LOOKIP implementation. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=75450
* o Reduce information leakage into jails by adding invocations ofRobert Watson2001-04-121-0/+9
| | | | | | | | | | | | p_can(...P_CAN_SEE...) to getpgid(), getsid(), and setpgid(), blocking these operations on processes that should not be visible by the requesting process. Required to reduce information leakage in MAC environments. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=75448
* o Replace p_cankill() with p_cansignal(), remove wrappage of p_can()Robert Watson2001-04-122-42/+74
| | | | | | | | | | | | | | | | | | | | | from signal authorization checking. o p_cansignal() takes three arguments: subject process, object process, and signal number, unlike p_cankill(), which only took into account the processes and not the signal number, improving the abstraction such that CANSIGNAL() from kern_sig.c can now also be eliminated; previously CANSIGNAL() special-cased the handling of SIGCONT based on process session. privused is now deprecated. o The new p_cansignal() further limits the set of signals that may be delivered to processes with P_SUGID set, and restructures the access control check to allow it to be extended more easily. o These changes take into account work done by the OpenBSD Project, as well as by Robert Watson and Thomas Moestl on the TrustedBSD Project. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=75437
* o Regenerated following introduction of __setugid() system call forRobert Watson2001-04-112-2/+4
| | | | | | | | | "options REGRESSION". Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=75427
* o Introduce a new system call, __setsugid(), which allows a process toRobert Watson2001-04-112-0/+24
| | | | | | | | | | | | | | | | | | | | toggle the P_SUGID bit explicitly, rather than relying on it being set implicitly by other protection and credential logic. This feature is introduced to support inter-process authorization regression testing by simplifying userland credential management allowing the easy isolation and reproduction of authorization events with specific security contexts. This feature is enabled only by "options REGRESSION" and is not intended to be used by applications. While the feature is not known to introduce security vulnerabilities, it does allow processes to enter previously inaccessible parts of the credential state machine, and is therefore disabled by default. It may not constitute a risk, and therefore in the future pending further analysis (and appropriate need) may become a published interface. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=75426
* Stick proc0 in the PID hash table.John Baldwin2001-04-111-0/+1
| | | | Notes: svn path=/head/; revision=75423
* Rename the IPI API from smp_ipi_* to ipi_* since the smp_ prefix is justJohn Baldwin2001-04-111-14/+14
| | | | | | | | | "redundant noise" and to match the IPI constant namespace (IPI_*). Requested by: bde Notes: svn path=/head/; revision=75421
* Correct the following defines to match the POSIX.1e spec:Chris D. Faulhaber2001-04-113-108/+108
| | | | | | | | | | | ACL_PERM_EXEC -> ACL_EXECUTE ACL_PERM_READ -> ACL_READ ACL_PERM_WRITE -> ACL_WRITE Obtained from: TrustedBSD Notes: svn path=/head/; revision=75404
* Create debug.hashstat.[raw]nchash and debug.hashstat.[raw]nfsnode toPeter Wemm2001-04-111-0/+80
| | | | | | | | | | | | | | enable easy access to the hash chain stats. The raw prefixed versions dump an integer array to userland with the chain lengths. This cheats and calls it an array of 'struct int' rather than 'int' or sysctl -a faithfully dumps out the 128K array on an average machine. The non-raw versions return 4 integers: count, number of chains used, maximum chain length, and percentage utilization (fixed point, multiplied by 100). The raw forms are more useful for analyzing the hash distribution, while the other form can be read easily by humans and stats loggers. Notes: svn path=/head/; revision=75402
* Remove the BETTER_CLOCK #ifdef's. The code is on by default and is hereJohn Baldwin2001-04-101-14/+4
| | | | | | | | | to stay for the foreseeable future. OK'd by: peter (the idea) Notes: svn path=/head/; revision=75393
* Add an MI API for sending IPI's. I used the same API present on the alphaJohn Baldwin2001-04-101-12/+55
| | | | | | | | | | | because: - it used a better namespace (smp_ipi_* rather than *_ipi), - it used better constant names for the IPI's (IPI_* rather than X*_OFFSET), and - this API also somewhat exists for both alpha and ia64 already. Notes: svn path=/head/; revision=75392
* Import kernel part of SMB/CIFS requester.Boris Popov2001-04-101-0/+285
| | | | | | | | | | | Add smbfs(CIFS) filesystem. Userland part will be in the ports tree for a while. Obtained from: smbfs-1.3.7-dev package. Notes: svn path=/head/; revision=75374
* Avoid endless recursion on panic.Boris Popov2001-04-101-2/+6
| | | | | | | Reviewed by: jhb Notes: svn path=/head/; revision=75364
* Maintain a reference count on the witness struct. When the referenceJohn Baldwin2001-04-091-0/+15
| | | | | | | | | | | | | count drops to 0 in witness_destroy, set the w_name and w_file pointers to point to the string "(dead)" and the w_line field to 0. This way, if a mutex of a given name is used only in a module, then as long as all mutexes in the module are destroyed when the module is unloaded, witness will not maintain stale references to the mutex's name in the module's data section causing a panic later on when the w_name or w_file field's are examined. Notes: svn path=/head/; revision=75362
* Remove a stale file.Nick Hibma2001-04-091-455/+0
| | | | Notes: svn path=/head/; revision=75333
* Fix a precedence bug. ! has higher precedence than &.Jake Burkholder2001-04-081-1/+1
| | | | Notes: svn path=/head/; revision=75304
* Use getopt instead of a home grown oneNick Hibma2001-04-072-167/+139
| | | | | | | Submitted by: DES Notes: svn path=/head/; revision=75297
* - Split out the functionality of displaying the contents of a single lockJohn Baldwin2001-04-061-21/+52
| | | | | | | | | | | list into a public witness_list_locks() function. Call this function twice in witness_list() instead of using an evil goto. - Adjust the 'show locks' command to take an optional parameter which specifies the pid of a process to list the locks of. By default the locks held by the current process are displayed. Notes: svn path=/head/; revision=75273
* - Change the msleep()s to condition variables.Bosko Milekic2001-04-031-21/+21
| | | | | | | | | | | The mbuf and mcluster free lists now each "own" a condition variable, m_starved. - Clean up minor indentention issues in sys/mbuf.h caused by previous commit. Notes: svn path=/head/; revision=75112
* Use only one mutex for the entire mbuf subsystem.Alfred Perlstein2001-04-031-44/+47
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Don't use atomic operations for the stats updating, instead protect the counts with the mbuf mutex. Most twiddling of the stats was done right before or after releasing a mutex. By doing this we reduce the number of locked ops needed as well as allow a sysctl to gain a consitant view of the entire stats structure. In the future... This will allow us to chain common mbuf operations that would normally need to aquire/release 2 or 3 of the locks to build an mbuf with a cluster or external data attached into a single op requiring only one lock. Simplify the per-cpu locks that are planned. There's also some if (1) code that should check if the "how" operation specifies blocking/non-blocking behavior, we _could_ make it so that we hold onto the mutex through calls into kmem_alloc when non-blocking requests are made, but for safety reasons we currently drop and reaquire the mutex around the calls. Also, note that calling kmem_alloc is rare and only happens during a shortage so drop/re-getting the mutex will not be a common occurance. Remove some #define's that seemed to obfuscate the code to me. Remove an extranious comment. Remove an XXX, including mutex.h isn't a crime. Reviewed by: bmilekic Notes: svn path=/head/; revision=75105
* Change stop() to require the sched_lock as well as p's process lock toJohn Baldwin2001-04-031-6/+8
| | | | | | | | | avoid silly lock contention on sched_lock since in 2 out of the 3 places that we call stop(), we get sched_lock right after calling it and we were locking sched_lock inside of stop() anyways. Notes: svn path=/head/; revision=75104
* - Move the second stop() of process 'p' in issignal() to be after we sendJohn Baldwin2001-04-021-3/+2
| | | | | | | | | | | | | | | SIGCHLD to our parent process. Otherwise, we could block while obtaining the process lock for our parent process and switch out while we were in SSTOP. Even worse, when we try to resume from the mutex being blocked on our p_stat will be SRUN, not SSTOP. - Fix a comment above stop() to indicate that it requires that the proc lock be held, not a proctree lock. Reported by: markm Sleuthing by: jake Notes: svn path=/head/; revision=75091
* o Part two of introduction of extattr_{delete,get,set}_fd() system calls,Robert Watson2001-03-312-2/+8
| | | | | | | | | regenerate necessary automatically-generated code. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=75039
* o Introduce extattr_{delete,get,set}_fd() to allow extended attributeRobert Watson2001-03-313-148/+434
| | | | | | | | | | | | | | | | operations on file descriptors, which complement the existing set of calls, extattr_{delete,get,set}_file() which act on paths. In doing so, restructure the system call implementation such that the two sets of functions share most of the relevant code, rather than duplicating it. This pushes the vnode locking into the shared code, but keeps the copying in of some arguments in the system call code. Allowing access via file descriptors reduces the opportunity for race conditions when managing extended attributes. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=75038
* o Restructure privilege check associated with process visibility forRobert Watson2001-03-291-3/+1
| | | | | | | | | | | | ps_showallprocs such that if superuser is present to override process hiding, the search falls through [to success]. When additional restrictions are placed on process visibility, such as MAC, new clauses will be placed above the return(0). Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=75005
* o introduce u_cansee(), which performs access control checks betweenRobert Watson2001-03-281-14/+26
| | | | | | | | | | | | | two subject ucreds. Unlike p_cansee(), u_cansee() doesn't have process lock requirements, only valid ucred reference requirements, so is prefered as process locking improves. For now, back p_cansee() into u_cansee(), but eventually p_cansee() will go away. Reviewed by: jhb, tmm Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=74956
* Close a race condition where if we were obtaining a sleep lock and no spinJohn Baldwin2001-03-281-1/+14
| | | | | | | | | | | locks were held, we could be preempted and switch CPU's in between the time that we set a variable to the list of spin locks on our CPU and the time that we checked that variable to ensure no spinlocks were held while grabbing a sleep lock. Losing the race resulted in checking some other CPU's spin lock list and bogusly panicing. Notes: svn path=/head/; revision=74944
* - s/mutexes/locks/g in appropriate comments.John Baldwin2001-03-281-4/+4
| | | | | | | | - Rename the 'show mutexes' ddb command to 'show locks' since it shows a list of all the lock objects held by the current process. Notes: svn path=/head/; revision=74930
* Convert the allproc and proctree locks from lockmgr locks to sx locks.John Baldwin2001-03-2813-73/+85
| | | | Notes: svn path=/head/; revision=74927
generated by cgit v1.2.3 (git 2.25.1) at 2025-11-29 23:39:59 +0000