src/sys/security, branch releng/12.4

mac_veriexec: Fix a typo in a source code comment

2022-03-30T16:41:07Z

- s/seach/search/ (cherry picked from commit 1920133d8fb77004c2d312f8b141e653d9a29e91)

mac_veriexec_fingerprint_check_vnode: v_writecount > 0 means active writers

2020-08-29T16:27:21Z

v_writecount can actually be < 0 for text, so check for v_writecount > 0 MFC of r362125 Reviewed by: stevek

MFC r361313:

2020-05-28T17:08:39Z

Deduplicate fsid comparisons Comparing fsid_t objects requires internal knowledge of the fsid structure and yet this is duplicated across a number of places in the code. Simplify by creating a fsidcmp function (macro). Reviewed by: mjg, rmacklem Approved by: mav (mentor) Sponsored by: iXsystems, Inc. Differential Revision: https://reviews.freebsd.org/D24749

MFC r343111,343113-343115 (by mckusick):

2020-01-30T16:11:19Z

Create new EINTEGRITY error with message "Integrity check failed". An integrity check such as a check-hash or a cross-correlation failed. The integrity error falls between EINVAL that identifies errors in parameters to a system call and EIO that identifies errors with the underlying storage media. EINTEGRITY is typically raised by intermediate kernel layers such as a filesystem or an in-kernel GEOM subsystem when they detect inconsistencies. Uses include allowing the mount(8) command to return a different exit value to automate the running of fsck(8) during a system boot. These changes make no use of the new error, they just add it. Later commits will be made for the use of the new error number and it will be added to additional manual pages as appropriate. Approved by: mckusick

MFC r345830: Create kernel module to parse Veriexec manifest based on envs

2019-04-26T11:12:51Z

Submitted by: Kornel Duleba Obtained from: Semihalf Sponsored by: Stormshield

Rework the logic around quick checks for auditing that take place at

2018-10-02T15:58:17Z

system-call entry and whenever audit arguments or return values are captured: 1. Expose a single global, audit_syscalls_enabled, which controls whether the audit framework is entered, rather than exposing components of the policy -- e.g., if the trail is enabled, suspended, etc. 2. Introduce a new function audit_syscalls_enabled_update(), which is called to update audit_syscalls_enabled whenever an aspect of the policy changes, so that the value can be updated. 3. Remove a check of trail enablement/suspension from audit_new() -- at the point where this function has been entered, we believe that system-call auditing is already in force, or we wouldn't get here, so simply proceed to more expensive policy checks. 4. Use an audit-provided global, audit_dtrace_enabled, rather than a dtaudit-provided global, to provide policy indicating whether dtaudit would like system calls to be audited. 5. Do some minor cosmetic renaming to clarify what various variables are for. These changes collectively arrange it so that traditional audit (trail, pipes) or the DTrace audit provider can enable system-call probes without the other configured. Otherwise, dtaudit cannot capture system-call data without auditd(8) started. Reviewed by: gnn Sponsored by: DARPA, AFRL Approved by: re (gjb) Differential Revision: https://reviews.freebsd.org/D17348

The kernel DTrace audit provider (dtaudit) relies on auditd(8) to load

2018-09-03T14:26:43Z

/etc/security/audit_event to provide a list of audit event-number <-> name mappings. However, this occurs too late for anonymous tracing. With this change, adding 'audit_event_load="YES"' to /boot/loader.conf will cause the boot loader to preload the file, and then the kernel audit code will parse it to register an initial set of audit event-number <-> name mappings. Those mappings can later be updated by auditd(8) if the configuration file changes. Reviewed by: gnn, asomers, markj, allanjude Discussed with: jhb Approved by: re (kib) MFC after: 1 week Sponsored by: DARPA, AFRL Differential Revision: https://reviews.freebsd.org/D16589

Require that MAC label buffers be able to store a non-empty string.

2018-08-01T03:46:07Z

The buffer size may be used to initialize an sbuf in MAC_POLICY_EXTERNALIZE, and without this constraint it's possible to trigger an assertion failure in the sbuf code. With INVARIANTS disabled, the first attempt to write to the sbuf will fail. Reported by: pho Reviewed by: delphij MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D16527

fix incorrect operator in the AUDITPIPE_SET_QLIMIT bounds check

2018-07-23T16:56:49Z

PR: 229983 Submitted by: Aniket Pandey Reported by: Aniket Pandey MFC after: 1 week

Fix audit of chflagsat, lgetfh, and setfib

2018-07-22T14:11:52Z

These syscalls were always supposed to have been auditted, but due to oversights never were. PR: 228374 Reported by: aniketp Reviewed by: aniketp MFC after: 2 weeks Differential Revision: https://reviews.freebsd.org/D16388