src/sys/security/mac, branch release/9.3.0

MFC r258622,258675: dtrace sdt: remove the ugly sname parameter of

2014-02-17T13:58:50Z

SDT_PROBE_DEFINE

MFC r255971: Fix some typos that were causing probe argument types to

2014-02-17T13:53:01Z

show up as unknown MFC slacker: markj

MFC r255945:

2013-10-06T05:53:29Z

Make the mac_policy_rm lock recursable, which allows reentrance into the mac framework.

Merge

2013-03-02T15:11:20Z

* r233937 - Improve BPF locking model * r233938 - Improve performace for writer-only BPF users * r233946 - Fix build * r235744 - Fix (new) panic on attaching to non-existent interface * r235745 - Fix old panic when BPF consumer attaches to destroying interface * r235746 - Call bpf_jitter() before acquiring BPF global lock * r235747 - Make most BPF ioctls() SMP-safe. * r236231 - Fix BPF_JITTER code broken by r235746. * r236251 - Fix shim for BIOCSETF to drop all packets buffered on the descriptor. * r236261 - Save the previous filter right before we set new one. * r236262 - Fix style(9) nits, reduce unnecessary type castings. * r236559 - Fix panic introduced by r235745 * r236806 - Fix typo introduced in r236559. r233937 - Improve BPF locking model. Interface locks and descriptor locks are converted from mutex(9) to rwlock(9). This greately improves performance: in most common case we need to acquire 1 reader lock instead of 2 mutexes. - Remove filter(descriptor) (reader) lock in bpf_mtap[2] This was suggested by glebius@. We protect filter by requesting interface writer lock on filter change. - Cover struct bpf_if under BPF_INTERNAL define. This permits including bpf.h without including rwlock stuff. However, this is is temporary solution, struct bpf_if should be made opaque for any external caller. r233938 - Improve performace for writer-only BPF users. Linux and Solaris (at least OpenSolaris) has PF_PACKET socket families to send raw ethernet frames. The only FreeBSD interface that can be used to send raw frames is BPF. As a result, many programs like cdpd, lldpd, various dhcp stuff uses BPF only to send data. This leads us to the situation when software like cdpd, being run on high-traffic-volume interface significantly reduces overall performance since we have to acquire additional locks for every packet. Here we add sysctl that changes BPF behavior in the following way: If program came and opens BPF socket without explicitly specifyin read filter we assume it to be write-only and add it to special writer-only per-interface list. This makes bpf_peers_present() return 0, so no additional overhead is introduced. After filter is supplied, descriptor is added to original per-interface list permitting packets to be captured. Unfortunately, pcap_open_live() sets catch-all filter itself for the purpose of setting snap length. Fortunately, most programs explicitly sets (event catch-all) filter after that. tcpdump(1) is a good example. So a bit hackis approach is taken: we upgrade description only after second BIOCSETF is received. Sysctl is named net.bpf.optimize_writers and is turned off by default. - While here, document all sysctl variables in bpf.4 r233946 Fix build broken by r233938. r235744 Fix panic on attaching to non-existent interface (introduced by r233937, pointed by hrs@) Fix panic on tcpdump being attached to interface being removed (introduced by r233937, pointed by hrs@ and adrian@) Protect most of bpf_setf() by BPF global lock Add several forgotten assertions (thanks to adrian@) Document current locking model inside bpf.c Document EVENTHANDLER(9) usage inside BPF. r235745 Fix old panic when BPF consumer attaches to destroying interface. 'flags' field is added to the end of bpf_if structure. Currently the only flag is BPFIF_FLAG_DYING which is set on bpf detach and checked by bpf_attachd() Problem can be easily triggered on SMP stable/[89] by the following command (sort of): 'while true; do ifconfig vlan222 create vlan 222 vlandev em0 up ; \ tcpdump -pi vlan222 & ; ifconfig vlan222 destroy ; done' Fix possible use-after-free when BPF detaches itself from interface, freeing bpf_bif memory, while interface is still UP and there can be routes via this interface. Freeing is now delayed till ifnet_departure_event is received via eventhandler(9) api. Convert bpfd rwlock back to mutex due lack of performance gain (currently checking if packet matches filter is done without holding bpfd lock and we have to acquire write lock if packet matches) r235746 Call bpf_jitter() before acquiring BPF global lock due to malloc() being used inside bpf_jitter. Eliminate bpf_buffer_alloc() and allocate BPF buffers on descriptor creation and BIOCSBLEN ioctl. This permits us not to allocate buffers inside bpf_attachd() which is protected by global lock. r235747 Make most BPF ioctls() SMP-safe. r236559 Fix panic introduced by r235745. Panic occurs after first packet traverse renamed interface. Add several comments on locking r236231 Fix BPF_JITTER code broken by r235746. r236251 Fix 32-bit shim for BIOCSETF to drop all packets buffered on the descriptor and reset statistics as it should. r236261 - Save the previous filter right before we set new one. - Reduce duplicate code and make it little easier to read. r236262 Fix style(9) nits, reduce unnecessary type castings, etc., for bpf_setf(). r236806 Fix typo introduced in r236559.

Merge r234032 from head to stable/9:

2012-07-09T08:42:54Z

When allocation of labels on files is implicitly disabled due to MAC policy configuration, avoid leaking resources following failed calls to get and set MAC labels by file descriptor. Reported by: Mateusz Guzik + clang scan-build Approved by: re (kib)

MFC r228424,228448: panic: add a switch and infrastructure for stopping

2012-05-13T17:01:32Z

other CPUs in SMP case

MFC r228430,228433: put sys/systm.h at its proper place or add it if missing

2012-01-15T21:58:51Z

In order to maximize the re-usability of kernel code in user space this

2011-09-16T13:58:51Z

patch modifies makesyscalls.sh to prefix all of the non-compatibility calls (e.g. not linux_, freebsd32_) with sys_ and updates the kernel entry points and all places in the code that use them. It also fixes an additional name space collision between the kernel function psignal and the libc function of the same name by renaming the kernel psignal kern_psignal(). By introducing this change now we will ease future MFCs that change syscalls. Reviewed by: rwatson Approved by: re (bz)

Correct several issues in the integration of POSIX shared memory objects

2011-09-02T17:40:39Z

and the new setmode and setowner fileops in FreeBSD 9.0: - Add new MAC Framework entry point mac_posixshm_check_create() to allow MAC policies to authorise shared memory use. Provide a stub policy and test policy templates. - Add missing Biba and MLS implementations of mac_posixshm_check_setmode() and mac_posixshm_check_setowner(). - Add 'accmode' argument to mac_posixshm_check_open() -- unlike the mac_posixsem_check_open() entry point it was modeled on, the access mode is required as shared memory access can be read-only as well as writable; this isn't true of POSIX semaphores. - Implement full range of POSIX shared memory entry points for Biba and MLS. Sponsored by: Google Inc. Obtained from: TrustedBSD Project Approved by: re (kib)

Add the fo_chown and fo_chmod methods to struct fileops and use them

2011-08-16T20:07:47Z

to implement fchown(2) and fchmod(2) support for several file types that previously lacked it. Add MAC entries for chown/chmod done on posix shared memory and (old) in-kernel posix semaphores. Based on the submission by: glebius Reviewed by: rwatson Approved by: re (bz)