summaryrefslogtreecommitdiff
path: root/sys/security/mac/mac_internal.h
Commit message (Collapse)AuthorAgeFilesLines
* security: clean up empty lines in .c and .h filesMateusz Guzik2020-09-011-1/+0
| | | | Notes: svn path=/head/; revision=365083
* When MAC is enabled and a policy module is loaded, don't unconditionallyRobert Watson2019-05-031-3/+19
| | | | | | | | | | | | | | | | | | lock mac_ifnet_mtx, which protects labels on struct ifnet, unless at least one policy is actively using labels on ifnets. This avoids a global mutex acquire in certain fast paths -- most noticeably ifnet transmit. This was previously invisible by default, as no MAC policies were loaded by default, but recently became visible due to mac_ntpd being enabled by default. gallatin@ reports a reduction in PPS overhead from 300% to 2.2% with this change. We will want to explore further MAC Framework optimisation to reduce overhead further, but this brings things more back into the world of the sane. MFC after: 3 days Notes: svn path=/head/; revision=347058
* mac: reduce pessimization of sdt probe handlingMateusz Guzik2018-12-191-12/+16
| | | | | | | | | | | Prior to the change the code would branch on return value and then check if probes are enabled. Since vast majority of the time they are not, this is clearly wasteful. Check probes first. Sponsored by: The FreeBSD Foundation Notes: svn path=/head/; revision=342247
* Fix style issues around existing SDT probes.Mark Johnston2015-12-161-16/+16
| | | | | | | | | | | | - Use SDT_PROBE<N>() instead of SDT_PROBE(). This has no functional effect at the moment, but will be needed for some future changes. - Don't hardcode the module component of the probe identifier. This is set automatically by the SDT framework. MFC after: 1 week Notes: svn path=/head/; revision=292384
* dtrace sdt: remove the ugly sname parameter of SDT_PROBE_DEFINEAndriy Gapon2013-11-261-24/+24
| | | | | | | | | | | In its stead use the Solaris / illumos approach of emulating '-' (dash) in probe names with '__' (two consecutive underscores). Reviewed by: markj MFC after: 3 weeks Notes: svn path=/head/; revision=258622
* Fix some typos that were causing probe argument types to show up as unknown.Mark Johnston2013-10-011-1/+1
| | | | | | | | | Reviewed by: rwatson (mac provider) Approved by: re (glebius) MFC after: 1 week Notes: svn path=/head/; revision=255971
* Add an extra comment to the SDT probes definition. This allows us to getRui Paulo2010-08-221-10/+10
| | | | | | | | | | | | use '-' in probe names, matching the probe names in Solaris.[1] Add userland SDT probes definitions to sys/sdt.h. Sponsored by: The FreeBSD Foundation Discussed with: rwaston [1] Notes: svn path=/head/; revision=211616
* Add internal 'mac_policy_count' counter to the MAC Framework, which is aRobert Watson2009-06-021-0/+1
| | | | | | | | | | | | | | | | | | | | | count of the number of registered policies. Rather than unconditionally locking sockets before passing them into MAC, lock them in the MAC entry points only if mac_policy_count is non-zero. This avoids locking overhead for a number of socket system calls when no policies are registered, eliminating measurable overhead for the MAC Framework for the socket subsystem when there are no active policies. Possibly socket locks should be acquired by policies if they are required for socket labels, which would further avoid locking overhead when there are policies but they don't require labeling of sockets, or possibly don't even implement socket controls. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=193332
* Convert the MAC Framework from using rwlocks to rmlocks to stabilizeRobert Watson2009-05-271-10/+21
| | | | | | | | | framework registration for non-sleepable entry points. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=192881
* Rename MAC Framework-internal macros used to invoke policy entry points:Robert Watson2009-05-011-32/+32
| | | | | | | | | | | | | | | | | | | | | MAC_BOOLEAN -> MAC_POLICY_BOOLEAN MAC_BOOLEAN_NOSLEEP -> MAC_POLICY_BOOLEANN_NOSLEEP MAC_CHECK -> MAC_POLICY_CHECK MAC_CHECK_NOSLEEP -> MAC_POLICY_CHECK_NOSLEEP MAC_EXTERNALIZE -> MAC_POLICY_EXTERNALIZE MAC_GRANT -> MAC_POLICY_GRANT MAC_GRANT_NOSLEEP -> MAC_POLICY_GRANT_NOSLEEP MAC_INTERNALIZE -> MAC_POLICY_INTERNALIZE MAC_PERFORM -> MAC_POLICY_PERFORM_CHECK MAC_PERFORM_NOSLEEP -> MAC_POLICY_PERFORM_NOSLEEP This frees up those macro names for use in wrapping calls into the MAC Framework from the remainder of the kernel. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=191731
* Rework MAC Framework synchronization in a number of ways in order toRobert Watson2009-03-141-19/+80
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | improve performance: - Eliminate custom reference count and condition variable to monitor threads entering the framework, as this had both significant overhead and behaved badly in the face of contention. - Replace reference count with two locks: an rwlock and an sx lock, which will be read-acquired by threads entering the framework depending on whether a give policy entry point is permitted to sleep or not. - Replace previous mutex locking of the reference count for exclusive access with write acquiring of both the policy list sx and rw locks, which occurs only when policies are attached or detached. - Do a lockless read of the dynamic policy list head before acquiring any locks in order to reduce overhead when no dynamic policies are loaded; this a race we can afford to lose. - For every policy entry point invocation, decide whether sleeping is permitted, and if not, use a _NOSLEEP() variant of the composition macros, which will use the rwlock instead of the sxlock. In some cases, we decide which to use based on allocation flags passed to the MAC Framework entry point. As with the move to rwlocks/rmlocks in pfil, this may trigger witness warnings, but these should (generally) be false positives as all acquisition of the locks is for read with two very narrow exceptions for policy load/unload, and those code blocks should never acquire other locks. Sponsored by: Google, Inc. Obtained from: TrustedBSD Project Discussed with: csjp (idea, not specific patch) Notes: svn path=/head/; revision=189797
* Add static DTrace probes for MAC Framework access control checks andRobert Watson2009-03-081-1/+70
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | privilege grants so that dtrace can be more easily used to monitor the security decisions being generated by the MAC Framework following policy invocation. Successful access control checks will be reported by: mac_framework:kernel:<entrypoint>:mac_check_ok Failed access control checks will be reported by: mac_framework:kernel:<entrypoint>:mac_check_err Successful privilege grants will be reported by: mac_framework:kernel:priv_grant:mac_grant_ok Failed privilege grants will be reported by: mac_framework:kernel:priv_grant:mac_grant_err In all cases, the return value (always 0 for _ok, otherwise an errno for _err) will be reported via arg0 on the probe, and subsequent arguments will hold entrypoint-specific data, in a style similar to privilege tracing. Obtained from: TrustedBSD Project Sponsored by: Google, Inc. Notes: svn path=/head/; revision=189503
* Rather than having MAC policies explicitly declare what object typesRobert Watson2009-01-101-0/+29
| | | | | | | | | | | | | | | | | they label, derive that information implicitly from the set of label initializers in their policy operations set. This avoids a possible class of programmer errors, while retaining the structure that allows us to avoid allocating labels for objects that don't need them. As before, we regenerate a global mask of labeled objects each time a policy is loaded or unloaded, stored in mac_labeled. Discussed with: csjp Suggested by: Jacques Vidrine <nectar at apple.com> Obtained from: TrustedBSD Project Sponsored by: Apple, Inc. Notes: svn path=/head/; revision=187016
* Introduce two related changes to the TrustedBSD MAC Framework:Robert Watson2008-08-231-3/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | (1) Abstract interpreter vnode labeling in execve(2) and mac_execve(2) so that the general exec code isn't aware of the details of allocating, copying, and freeing labels, rather, simply passes in a void pointer to start and stop functions that will be used by the framework. This change will be MFC'd. (2) Introduce a new flags field to the MAC_POLICY_SET(9) interface allowing policies to declare which types of objects require label allocation, initialization, and destruction, and define a set of flags covering various supported object types (MPC_OBJECT_PROC, MPC_OBJECT_VNODE, MPC_OBJECT_INPCB, ...). This change reduces the overhead of compiling the MAC Framework into the kernel if policies aren't loaded, or if policies require labels on only a small number or even no object types. Each time a policy is loaded or unloaded, we recalculate a mask of labeled object types across all policies present in the system. Eliminate MAC_ALWAYS_LABEL_MBUF option as it is no longer required. MFC after: 1 week ((1) only) Reviewed by: csjp Obtained from: TrustedBSD Project Sponsored by: Apple, Inc. Notes: svn path=/head/; revision=182063
* Make naming of include guards for MAC Framework include files moreRobert Watson2008-04-131-3/+3
| | | | | | | | | consistent with other kernel include guards (don't start with _SYS). MFC after: 3 days Notes: svn path=/head/; revision=178184
* Move towards more explicit support for various network protocol stacksRobert Watson2007-10-281-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | in the TrustedBSD MAC Framework: - Add mac_atalk.c and add explicit entry point mac_netatalk_aarp_send() for AARP packet labeling, rather than using a generic link layer entry point. - Add mac_inet6.c and add explicit entry point mac_netinet6_nd6_send() for ND6 packet labeling, rather than using a generic link layer entry point. - Add expliict entry point mac_netinet_arp_send() for ARP packet labeling, and mac_netinet_igmp_send() for IGMP packet labeling, rather than using a generic link layer entry point. - Remove previous genering link layer entry point, mac_mbuf_create_linklayer() as it is no longer used. - Add implementations of new entry points to various policies, largely by replicating the existing link layer entry point for them; remove old link layer entry point implementation. - Make MAC_IFNET_LOCK(), MAC_IFNET_UNLOCK(), and mac_ifnet_mtx global to the MAC Framework rather than static to mac_net.c as it is now needed outside of mac_net.c. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=173095
* Merge first in a series of TrustedBSD MAC Framework KPI changesRobert Watson2007-10-241-15/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | from Mac OS X Leopard--rationalize naming for entry points to the following general forms: mac_<object>_<method/action> mac_<object>_check_<method/action> The previous naming scheme was inconsistent and mostly reversed from the new scheme. Also, make object types more consistent and remove spaces from object types that contain multiple parts ("posix_sem" -> "posixsem") to make mechanical parsing easier. Introduce a new "netinet" object type for certain IPv4/IPv6-related methods. Also simplify, slightly, some entry point names. All MAC policy modules will need to be recompiled, and modules not updates as part of this commit will need to be modified to conform to the new KPI. Sponsored by: SPARTA (original patches against Mac OS X) Obtained from: TrustedBSD Project, Apple Computer Notes: svn path=/head/; revision=172930
* Introduce accessor functions mac_label_get() and mac_label_set() to replaceRobert Watson2007-02-061-1/+18
| | | | | | | | | | | | | | | | | | | | | | LABEL_TO_SLOT() macro used by policy modules to query and set label data in struct label. Instead of using a union, store an intptr_t, simplifying the API. Update policies: in most cases this required only small tweaks to current wrapper macros. In two cases, a single wrapper macros had to be split into separate get and set macros. Move struct label definition from _label.h to mac_internal.h and remove _label.h. With this change, policies may now treat struct label * as opaque, allowing us to change the layout of struct label without breaking the policy module ABI. For example, we could make the maximum number of policies with labels modifiable at boot-time rather than just at compile-time. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=166533
* Continue 7-CURRENT MAC Framework rearrangement and cleanup:Robert Watson2007-02-061-0/+4
| | | | | | | | | | | | | | | | | Don't perform a nested include of _label.h in mac.h, as mac.h now describes only the user API to MAC, and _label.h defines the in-kernel representation of MAC labels. Remove mac.h includes from policies and MAC framework components that do not use userspace MAC API definitions. Add _KERNEL inclusion checks to mac_internal.h and mac_policy.h, as these are kernel-only include files Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=166531
* Add missing include guards to mac_internal.h, update include guards inRobert Watson2006-12-281-0/+5
| | | | | | | | | mac_policy.h following move to new location in src/sys/security/mac. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=165607
* Centralize definition of MAC_VERSION in mac_policy.h, as it defines theRobert Watson2006-12-281-1/+0
| | | | | | | | | | | | | kernel<->policy ABI version. Add a comment to the definition describing it and listing known versions. Modify MAC_POLICY_SET() to reference the current kernel version by name rather than by number. Staticize mac_late, which is used only in mac_framework.c. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=165595
* Remove mac_enforce_subsystem debugging sysctls. Enforcement onRobert Watson2006-12-211-4/+0
| | | | | | | | | | | | | subsystems will be a property of policy modules, which may require access control check entry points to be invoked even when not actively enforcing (i.e., to track information flow without providing protection). Obtained from: TrustedBSD Project Suggested by: Christopher dot Vance at sparta dot com Notes: svn path=/head/; revision=165433
* Clean up comments, trailing white space.Robert Watson2006-12-201-17/+27
| | | | | | | | | Provide a comment describing MAC_EXTERNALIZE(). Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=165421
* Add a new priv(9) kernel interface for checking the availability ofRobert Watson2006-11-061-0/+34
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | privilege for threads and credentials. Unlike the existing suser(9) interface, priv(9) exposes a named privilege identifier to the privilege checking code, allowing more complex policies regarding the granting of privilege to be expressed. Two interfaces are provided, replacing the existing suser(9) interface: suser(td) -> priv_check(td, priv) suser_cred(cred, flags) -> priv_check_cred(cred, priv, flags) A comprehensive list of currently available kernel privileges may be found in priv.h. New privileges are easily added as required, but the comments on adding privileges found in priv.h and priv(9) should be read before doing so. The new privilege interface exposed sufficient information to the privilege checking routine that it will now be possible for jail to determine whether a particular privilege is granted in the check routine, rather than relying on hints from the calling context via the SUSER_ALLOWJAIL flag. For now, the flag is maintained, but a new jail check function, prison_priv_check(), is exposed from kern_jail.c and used by the privilege check routine to determine if the privilege is permitted in jail. As a result, a centralized list of privileges permitted in jail is now present in kern_jail.c. The MAC Framework is now also able to instrument privilege checks, both to deny privileges otherwise granted (mac_priv_check()), and to grant privileges otherwise denied (mac_priv_grant()), permitting MAC Policy modules to implement privilege models, as well as control a much broader range of system behavior in order to constrain processes running with root privilege. The suser() and suser_cred() functions remain implemented, now in terms of priv_check() and the PRIV_ROOT privilege, for use during the transition and possibly continuing use by third party kernel modules that have not been updated. The PRIV_DRIVER privilege exists to allow device drivers to check privilege without adopting a more specific privilege identifier. This change does not modify the actual security policy, rather, it modifies the interface for privilege checks so changes to the security policy become more feasible. Sponsored by: nCircle Network Security, Inc. Obtained from: TrustedBSD Project Discussed on: arch@ Reviewed (at least in part) by: mlaier, jmg, pjd, bde, ceri, Alex Lyashkov <umka at sevcity dot net>, Skip Ford <skip dot ford at verizon dot net>, Antoine Brodin <antoine dot brodin at laposte dot net> Notes: svn path=/head/; revision=164032
* Remove MAC_DEBUG label counters, which were used to debug leaks andRobert Watson2006-09-201-16/+0
| | | | | | | | | | | | other problems while labels were first being added to various kernel objects. They have outlived their usefulness. MFC after: 1 month Suggested by: Christopher dot Vance at SPARTA dot com Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=162467
* Declare security and security.bsd sysctl hierarchies in sysctl.h alongRobert Watson2006-09-171-1/+0
| | | | | | | | | | | with other commonly used sysctl name spaces, rather than declaring them all over the place. MFC after: 1 month Sponsored by: nCircle Network Security, Inc. Notes: svn path=/head/; revision=162383
* Remove extern declaration of mac_enforce_sysv, as it's not present inRobert Watson2004-10-221-1/+0
| | | | | | | the CVS version of the MAC Framework. Notes: svn path=/head/; revision=136772
* Move inet and inet6 related MAC Framework entry points from mac_net.cRobert Watson2004-02-261-1/+5
| | | | | | | | | | | | | | | | | to a new mac_inet.c. This code is now conditionally compiled based on inet support being compiled into the kernel. Move socket related MAC Framework entry points from mac_net.c to a new mac_socket.c. To do this, some additional _enforce MIB variables are now non-static. In addition, mbuf_to_label() is now mac_mbuf_to_label() and non-static. Obtained from: TrustedBSD Project Sponsored by: DARPA, McAfee Research Notes: svn path=/head/; revision=126262
* Update my personal copyrights and NETA copyrights in the kernelRobert Watson2004-02-221-2/+2
| | | | | | | | | | | to use the "year1-year3" format, as opposed to "year1, year2, year3". This seems to make lawyers more happy, but also prevents the lines from getting excessively long as the years start to add up. Suggested by: imp Notes: svn path=/head/; revision=126097
* Implement sockets support for __mac_get_fd() and __mac_set_fd()Robert Watson2003-11-161-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | system calls, and prefer these calls over getsockopt()/setsockopt() for ABI reasons. When addressing UNIX domain sockets, these calls retrieve and modify the socket label, not the label of the rendezvous vnode. - Create mac_copy_socket_label() entry point based on mac_copy_pipe_label() entry point, intended to copy the socket label into temporary storage that doesn't require a socket lock to be held (currently Giant). - Implement mac_copy_socket_label() for various policies. - Expose socket label allocation, free, internalize, externalize entry points as non-static from mac_net.c. - Use mac_socket_label_set() in __mac_set_fd(). MAC-aware applications may now use mac_get_fd(), mac_set_fd(), and mac_get_peer() to retrieve and set various socket labels without directly invoking the getsockopt() interface. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories Notes: svn path=/head/; revision=122820
* Abstract the label checking and setting logic fromRobert Watson2003-11-161-0/+3
| | | | | | | | | | | mac_setsockopt_label() into mac_socket_label_set(); make it non-static so that it can be invoked from kern_mac.c for mac_set_fd(). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories Notes: svn path=/head/; revision=122809
* Reduced prequisites by only using MALLOC_DECLARE() if it is defined.Bruce Evans2003-11-141-0/+4
| | | | | | | | | | | This fixes a dependency of mac_label.c on namespace pollution in <vm/uma.h>. Similarly for SYSCTL_DECL() although I had no problems with it. This probably makes some includes of <sys/sysctl.h> bogus. Notes: svn path=/head/; revision=122705
* Modify the MAC Framework so that instead of embedding a (struct label)Robert Watson2003-11-121-5/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | in various kernel objects to represent security data, we embed a (struct label *) pointer, which now references labels allocated using a UMA zone (mac_label.c). This allows the size and shape of struct label to be varied without changing the size and shape of these kernel objects, which become part of the frozen ABI with 5-STABLE. This opens the door for boot-time selection of the number of label slots, and hence changes to the bound on the number of simultaneous labeled policies at boot-time instead of compile-time. This also makes it easier to embed label references in new objects as required for locking/caching with fine-grained network stack locking, such as inpcb structures. This change also moves us further in the direction of hiding the structure of kernel objects from MAC policy modules, not to mention dramatically reducing the number of '&' symbols appearing in both the MAC Framework and MAC policy modules, and improving readability. While this results in minimal performance change with MAC enabled, it will observably shrink the size of a number of critical kernel data structures for the !MAC case, and should have a small (but measurable) performance benefit (i.e., struct vnode, struct socket) do to memory conservation and reduced cost of zeroing memory. NOTE: Users of MAC must recompile their kernel and all MAC modules as a result of this change. Because this is an API change, third party MAC modules will also need to be updated to make less use of the '&' symbol. Suggestions from: bmilekic Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories Notes: svn path=/head/; revision=122524
* Trim trailing whitespace.Robert Watson2003-11-071-2/+2
| | | | Notes: svn path=/head/; revision=122202
* Remove the flags argument from mac_externalize_*_label(), as it's notRobert Watson2003-11-061-3/+3
| | | | | | | | | | passed into policies or used internally to the MAC Framework. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories Notes: svn path=/head/; revision=122159
* Make MAC_EXTERNALIZE() and MAC_INTERNALIZE() simply take the objectRobert Watson2003-10-251-4/+4
| | | | | | | | | | | | type, rather than "object_label" as the first argument. This reduces complexity a little for the consumer, and also makes it easier for use to rename the underlying entry points in struct mac_policy_obj. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories Notes: svn path=/head/; revision=121507
* Sort type declarations together.Robert Watson2003-10-251-6/+1
| | | | | | | | | | Remove an excess carriage return. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories Notes: svn path=/head/; revision=121490
* The following shared types/constants/interfaces/... are requiredRobert Watson2003-10-221-3761/+75
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | in mac_internal.h: Sysctl tree declarations. Policy list structure definition. Policy list variables (static, dynamic). mac_late flag. Enforcement flags for process, vm, which have checks in multiple files. mac_labelmbufs variable to drive conditional mbuf labeling. M_MACTEMP malloc type. Debugging counter macros. MAC Framework infrastructure primitives, including policy locking primitives, kernel label initialization/destruction, userland label consistency checks, policy slot allocation. Per-object interfaces for objects that are internalized and externalized using system calls that will remain centrally defined: credentials, pipes, vnodes. MAC policy composition macros: MAC_CHECK, MAC_BOOLEAN, MAC_EXTERNALIZE, MAC_INTERNALIZE, MAC_PERFORM. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories Notes: svn path=/head/; revision=121352
* If the struct mac copied into the kernel has a negative length, returnRobert Watson2003-09-291-1/+2
| | | | | | | | EINVAL rather than failing the following malloc due to the value being too large. Notes: svn path=/head/; revision=120582
* Fix a mac_policy_list reference to be a mac_static_policy_listRobert Watson2003-08-261-1/+1
| | | | | | | | | | | reference: this fixes mac_syscall() for static policies when using optimized locking. Obtained from: TrustedBSD Project Sponosred by: DARPA, Network Associates Laboratories Notes: svn path=/head/; revision=119494
* Introduce two new MAC Framework and MAC policy entry points:Robert Watson2003-08-211-0/+19
| | | | | | | | | | | | | | | | | mac_reflect_mbuf_icmp() mac_reflect_mbuf_tcp() These entry points permit MAC policies to do "update in place" changes to the labels on ICMP and TCP mbuf headers when an ICMP or TCP response is generated to a packet outside of the context of an existing socket. For example, in respond to a ping or a RST packet to a SYN on a closed port. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories Notes: svn path=/head/; revision=119244
* Add mac_check_vnode_deleteextattr() and mac_check_vnode_listextattr():Robert Watson2003-08-211-0/+32
| | | | | | | | | | | | | | explicit access control checks to delete and list extended attributes on a vnode, rather than implicitly combining with the setextattr and getextattr checks. This reflects EA API changes in the kernel made recently, including the move to explicit VOP's for both of these operations. Obtained from: TrustedBSD PRoject Sponsored by: DARPA, Network Associates Laboratories Notes: svn path=/head/; revision=119198
* Remove about 40 lines of #ifdef/#endif by using new macrosRobert Watson2003-08-201-70/+31
| | | | | | | | | | | | MAC_DEBUG_COUNTER_INC() and MAC_DEBUG_COUNTER_DEC() to maintain debugging counter values rather than #ifdef'ing the atomic operations to MAC_DEBUG. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories Notes: svn path=/head/; revision=119184
* Attempt to simplify #ifdef logic for MAC_ALWAYS_LABEL_MBUF.Robert Watson2003-08-011-28/+18
| | | | | | | | Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories Notes: svn path=/head/; revision=118308
* Redesign the externalization APIs from the MAC Framework toRobert Watson2003-06-231-40/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | the MAC policy modules to improve robustness against C string bugs and vulnerabilities. Following these revisions, all string construction of labels for export to userspace (or elsewhere) is performed using the sbuf API, which prevents the consumer from having to perform laborious and intricate pointer and buffer checks. This substantially simplifies the externalization logic, both at the MAC Framework level, and in individual policies; this becomes especially useful when policies export more complex label data, such as with compartments in Biba and MLS. Bundled in here are some other minor fixes associated with externalization: including avoiding malloc while holding the process mutex in mac_lomac, and hence avoid a failure mode when printing labels during a downgrade operation due to the removal of the M_NOWAIT case. This has been running in the MAC development tree for about three weeks without problems. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories Notes: svn path=/head/; revision=116701
* Add a f_vnode field to struct file.Poul-Henning Kamp2003-06-221-2/+2
| | | | | | | | | | | | | | | Several of the subtypes have an associated vnode which is used for stuff like the f*() functions. By giving the vnode a speparate field, a number of checks for the specific subtype can be replaced simply with a check for f_vnode != NULL, and we can later free f_data up to subtype specific use. At this point in time, f_data still points to the vnode, so any code I might have overlooked will still work. Notes: svn path=/head/; revision=116678
* Use __FBSDID().David E. O'Brien2003-06-111-4/+4
| | | | Notes: svn path=/head/; revision=116182
* Rename MAC_MAX_POLICIES to MAC_MAX_SLOTS, since the variables andRobert Watson2003-05-081-8/+8
| | | | | | | | | | | | | | | constants in question refer to the number of label slots, not the maximum number of policies that may be loaded. This should reduce confusion regarding an element in the MAC sysctl MIB, as well as make it more clear what the affect of changing the compile-time constants is. Approved by: re (jhb) Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories Notes: svn path=/head/; revision=114846
* Clean up locking for the MAC Framework:Robert Watson2003-05-071-78/+180
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | (1) Accept that we're now going to use mutexes, so don't attempt to avoid treating them as mutexes. This cleans up locking accessor function names some. (2) Rename variables to _mtx, _cv, _count, simplifying the naming. (3) Add a new form of the _busy() primitive that conditionally makes the list busy: if there are entries on the list, bump the busy count. If there are no entries, don't bump the busy count. Return a boolean indicating whether or not the busy count was bumped. (4) Break mac_policy_list into two lists: one with the same name holding dynamic policies, and a new list, mac_static_policy_list, which holds policies loaded before mac_late and without the unload flag set. The static list may be accessed without holding the busy count, since it can't change at run-time. (5) In general, prefer making the list busy conditionally, meaning we pay only one mutex lock per entry point if all modules are on the static list, rather than two (since we don't have to lower the busy count when we're done with the framework). For systems running just Biba or MLS, this will halve the mutex accesses in the network stack, and may offer a substantial performance benefits. (6) Lay the groundwork for a dynamic-free kernel option which eliminates all locking associated with dynamically loaded or unloaded policies, for pre-configured systems requiring maximum performance but less run-time flexibility. These changes have been running for a few weeks on MAC development branch systems. Approved by: re (jhb) Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories Notes: svn path=/head/; revision=114806
* - Acquire the vm_object's lock when performing vm_object_page_clean().Alan Cox2003-04-241-0/+2
| | | | | | | | | - Add a parameter to vm_pageout_flush() that tells vm_pageout_flush() whether its caller has locked the vm_object. (This is a temporary measure to bootstrap vm_object locking.) Notes: svn path=/head/; revision=113955
generated by cgit v1.2.3 (git 2.25.1) at 2025-10-19 10:27:23 +0000