summaryrefslogtreecommitdiff
path: root/sys/security/mac/mac_framework.c
Commit message (Collapse)AuthorAgeFilesLines
* MFC r258622,258675: dtrace sdt: remove the ugly sname parameter ofAndriy Gapon2014-02-171-3/+3
| | | | | | | SDT_PROBE_DEFINE Notes: svn path=/stable/9/; revision=262057
* MFC r255971: Fix some typos that were causing probe argument types toAndriy Gapon2014-02-171-1/+1
| | | | | | | | | show up as unknown MFC slacker: markj Notes: svn path=/stable/9/; revision=262056
* MFC r255945:Konstantin Belousov2013-10-061-1/+2
| | | | | | | | Make the mac_policy_rm lock recursable, which allows reentrance into the mac framework. Notes: svn path=/stable/9/; revision=256075
* MFC r228430,228433: put sys/systm.h at its proper place or add it if missingAndriy Gapon2012-01-151-1/+1
| | | | Notes: svn path=/stable/9/; revision=230167
* sysctl(9) cleanup checkpoint: amd64 GENERIC builds cleanly.Matthew D Fleming2011-01-121-1/+1
| | | | | | | Commit the security directory. Notes: svn path=/head/; revision=217325
* Add an extra comment to the SDT probes definition. This allows us to getRui Paulo2010-08-221-3/+5
| | | | | | | | | | | | use '-' in probe names, matching the probe names in Solaris.[1] Add userland SDT probes definitions to sys/sdt.h. Sponsored by: The FreeBSD Foundation Discussed with: rwaston [1] Notes: svn path=/head/; revision=211616
* Mark MAC Framework sx and rm locks as NOWITNESS to suppress warnings thatRobert Watson2009-06-021-2/+2
| | | | | | | | | | | | might arise from WITNESS not understanding its locking protocol, which should be deadlock-free. Currently these warnings generally don't occur, but as object locking is pushed into policies for some object types, they would otherwise occur more often. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=193355
* Add internal 'mac_policy_count' counter to the MAC Framework, which is aRobert Watson2009-06-021-5/+11
| | | | | | | | | | | | | | | | | | | | | count of the number of registered policies. Rather than unconditionally locking sockets before passing them into MAC, lock them in the MAC entry points only if mac_policy_count is non-zero. This avoids locking overhead for a number of socket system calls when no policies are registered, eliminating measurable overhead for the MAC Framework for the socket subsystem when there are no active policies. Possibly socket locks should be acquired by policies if they are required for socket labels, which would further avoid locking overhead when there are policies but they don't require labeling of sockets, or possibly don't even implement socket controls. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=193332
* Make the rmlock(9) interface a bit more like the rwlock(9) interface:Robert Watson2009-05-291-1/+1
| | | | | | | | | | | | | | | | | - Add rm_init_flags() and accept extended options only for that variation. - Add a flags space specifically for rm_init_flags(), rather than borrowing the lock_init() flag space. - Define flag RM_RECURSE to use instead of LO_RECURSABLE. - Define flag RM_NOWITNESS to allow an rmlock to be exempt from WITNESS checking; this wasn't possible previously as rm_init() always passed LO_WITNESS when initializing an rmlock's struct lock. - Add RM_SYSINIT_FLAGS(). - Rename embedded mutex in rmlocks to make it more obvious what it is. - Update consumers. - Update man page. Notes: svn path=/head/; revision=193030
* Convert the MAC Framework from using rwlocks to rmlocks to stabilizeRobert Watson2009-05-271-11/+11
| | | | | | | | | framework registration for non-sleepable entry points. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=192881
* Rework MAC Framework synchronization in a number of ways in order toRobert Watson2009-03-141-111/+72
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | improve performance: - Eliminate custom reference count and condition variable to monitor threads entering the framework, as this had both significant overhead and behaved badly in the face of contention. - Replace reference count with two locks: an rwlock and an sx lock, which will be read-acquired by threads entering the framework depending on whether a give policy entry point is permitted to sleep or not. - Replace previous mutex locking of the reference count for exclusive access with write acquiring of both the policy list sx and rw locks, which occurs only when policies are attached or detached. - Do a lockless read of the dynamic policy list head before acquiring any locks in order to reduce overhead when no dynamic policies are loaded; this a race we can afford to lose. - For every policy entry point invocation, decide whether sleeping is permitted, and if not, use a _NOSLEEP() variant of the composition macros, which will use the rwlock instead of the sxlock. In some cases, we decide which to use based on allocation flags passed to the MAC Framework entry point. As with the move to rwlocks/rmlocks in pfil, this may trigger witness warnings, but these should (generally) be false positives as all acquisition of the locks is for read with two very narrow exceptions for policy load/unload, and those code blocks should never acquire other locks. Sponsored by: Google, Inc. Obtained from: TrustedBSD Project Discussed with: csjp (idea, not specific patch) Notes: svn path=/head/; revision=189797
* Improve the consistency of MAC Framework and MAC policy entry pointRobert Watson2009-03-081-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | naming by renaming certain "proc" entry points to "cred" entry points, reflecting their manipulation of credentials. For some entry points, the process was passed into the framework but not into policies; in these cases, stop passing in the process since we don't need it. mac_proc_check_setaudit -> mac_cred_check_setaudit mac_proc_check_setaudit_addr -> mac_cred_check_setaudit_addr mac_proc_check_setauid -> mac_cred_check_setauid mac_proc_check_setegid -> mac_cred_check_setegid mac_proc_check_seteuid -> mac_cred_check_seteuid mac_proc_check_setgid -> mac_cred_check_setgid mac_proc_check_setgroups -> mac_cred_ceck_setgroups mac_proc_check_setregid -> mac_cred_check_setregid mac_proc_check_setresgid -> mac_cred_check_setresgid mac_proc_check_setresuid -> mac_cred_check_setresuid mac_proc_check_setreuid -> mac_cred_check_setreuid mac_proc_check_setuid -> mac_cred_check_setuid Obtained from: TrustedBSD Project Sponsored by: Google, Inc. Notes: svn path=/head/; revision=189529
* Add static DTrace probes for MAC Framework access control checks andRobert Watson2009-03-081-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | privilege grants so that dtrace can be more easily used to monitor the security decisions being generated by the MAC Framework following policy invocation. Successful access control checks will be reported by: mac_framework:kernel:<entrypoint>:mac_check_ok Failed access control checks will be reported by: mac_framework:kernel:<entrypoint>:mac_check_err Successful privilege grants will be reported by: mac_framework:kernel:priv_grant:mac_grant_ok Failed privilege grants will be reported by: mac_framework:kernel:priv_grant:mac_grant_err In all cases, the return value (always 0 for _ok, otherwise an errno for _err) will be reported via arg0 on the probe, and subsequent arguments will hold entrypoint-specific data, in a style similar to privilege tracing. Obtained from: TrustedBSD Project Sponsored by: Google, Inc. Notes: svn path=/head/; revision=189503
* Reduce the verbosity of SDT trace points for DTrace by defining severalRobert Watson2009-03-031-12/+3
| | | | | | | | | | | | | | wrapper macros that allow trace points and arguments to be declared using a single macro rather than several. This means a lot less repetition and vertical space for each trace point. Use these macros when defining privilege and MAC Framework trace points. Reviewed by: jb MFC after: 1 week Notes: svn path=/head/; revision=189311
* Begin to add SDT tracing of the MAC Framework: add policy modevent,Robert Watson2009-01-241-1/+24
| | | | | | | | | | | register, and unregister hooks that give access to the mac_policy_conf for the policy. Obtained from: TrustedBSD Project MFC after: 3 days Notes: svn path=/head/; revision=187666
* Rather than having MAC policies explicitly declare what object typesRobert Watson2009-01-101-7/+45
| | | | | | | | | | | | | | | | | they label, derive that information implicitly from the set of label initializers in their policy operations set. This avoids a possible class of programmer errors, while retaining the structure that allows us to avoid allocating labels for objects that don't need them. As before, we regenerate a global mask of labeled objects each time a policy is loaded or unloaded, stored in mac_labeled. Discussed with: csjp Suggested by: Jacques Vidrine <nectar at apple.com> Obtained from: TrustedBSD Project Sponsored by: Apple, Inc. Notes: svn path=/head/; revision=187016
* Introduce two related changes to the TrustedBSD MAC Framework:Robert Watson2008-08-231-29/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | (1) Abstract interpreter vnode labeling in execve(2) and mac_execve(2) so that the general exec code isn't aware of the details of allocating, copying, and freeing labels, rather, simply passes in a void pointer to start and stop functions that will be used by the framework. This change will be MFC'd. (2) Introduce a new flags field to the MAC_POLICY_SET(9) interface allowing policies to declare which types of objects require label allocation, initialization, and destruction, and define a set of flags covering various supported object types (MPC_OBJECT_PROC, MPC_OBJECT_VNODE, MPC_OBJECT_INPCB, ...). This change reduces the overhead of compiling the MAC Framework into the kernel if policies aren't loaded, or if policies require labels on only a small number or even no object types. Each time a policy is loaded or unloaded, we recalculate a mask of labeled object types across all policies present in the system. Eliminate MAC_ALWAYS_LABEL_MBUF option as it is no longer required. MFC after: 1 week ((1) only) Reviewed by: csjp Obtained from: TrustedBSD Project Sponsored by: Apple, Inc. Notes: svn path=/head/; revision=182063
* Remove conditional return of 1. For the MAC_STATIC case at this point inChristian S.J. Peron2007-01-011-3/+0
| | | | | | | | | | the code, one being returned is invariant. Discussed with: rwatson MFC after: 1 week Notes: svn path=/head/; revision=165714
* Only signal the CV indicating that the MAC Framework is available forRobert Watson2006-12-311-6/+23
| | | | | | | | | | | | | | | | | exclusive access if there is at least one thread waiting for it to become available. This may significantly reduce overhead by reducing the number of unnecessary wakeups issued whenever the framework becomes idle. Annotate that we still signal the CV more than necessary and should fix this. Obtained from: TrustedBSD Project Reviewed by: csjp Tested by: csjp Notes: svn path=/head/; revision=165708
* Slightly resort functions in file so that no forward function prototypesRobert Watson2006-12-291-49/+46
| | | | | | | | | are required. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=165646
* Re-add include of opt_mac.h in mac_framework.c, which was improperlyRobert Watson2006-12-291-0/+2
| | | | | | | | removed from this file. It is required to pick up the definition of MAC_STATIC. Notes: svn path=/head/; revision=165645
* Centralize definition of MAC_VERSION in mac_policy.h, as it defines theRobert Watson2006-12-281-4/+3
| | | | | | | | | | | | | kernel<->policy ABI version. Add a comment to the definition describing it and listing known versions. Modify MAC_POLICY_SET() to reference the current kernel version by name rather than by number. Staticize mac_late, which is used only in mac_framework.c. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=165595
* Move mac_init_label() and mac_destroy_label() from mac_framework.c toRobert Watson2006-12-281-19/+0
| | | | | | | | | | mac_label.c, and use these instead of replicated code in the label zone constructor and destructor. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=165593
* Trim unneeded includes.Robert Watson2006-12-281-28/+0
| | | | Notes: svn path=/head/; revision=165591
* Break contents of kern_mac.c out into two files following a repo-copy:Robert Watson2006-12-281-672/+0
| | | | | | | | | | | | | | mac_framework.c Contains basic MAC Framework functions, policy registration, sysinits, etc. mac_syscalls.c Contains implementations of various MAC system calls, including ENOSYS stubs when compiling without options MAC. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=165590
* Update MAC Framework general comments, referencing various interfaces itRobert Watson2006-12-281-12/+40
| | | | | | | | | | | | | | | | | consumes and implements, as well as the location of the framework and policy modules. Refactor MAC Framework versioning a bit so that the current ABI version can be exported via a read-only sysctl. Further update comments relating to locking/synchronization. Update copyright to take into account these and other recent changes. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=165586
* Move src/sys/sys/mac_policy.h, the kernel interface between the MACRobert Watson2006-12-221-2/+1
| | | | | | | | | | | | | | Framework and security modules, to src/sys/security/mac/mac_policy.h, completing the removal of kernel-only MAC Framework include files from src/sys/sys. Update the MAC Framework and MAC policy modules. Delete the old mac_policy.h. Third party policy modules will need similar updating. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=165469
* Remove mac_enforce_subsystem debugging sysctls. Enforcement onRobert Watson2006-12-211-3/+1
| | | | | | | | | | | | | subsystems will be a property of policy modules, which may require access control check entry points to be invoked even when not actively enforcing (i.e., to track information flow without providing protection). Obtained from: TrustedBSD Project Suggested by: Christopher dot Vance at sparta dot com Notes: svn path=/head/; revision=165433
* Expand commenting on label slots, justification for the MAC Framework lockingRobert Watson2006-12-201-54/+79
| | | | | | | | | | | model, interactions between locking and policy init/destroy methods. Rewrap some comments to 77 character line wrap. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=165411
* Complete break-out of sys/sys/mac.h into sys/security/mac/mac_framework.hRobert Watson2006-10-221-1/+2
| | | | | | | | | | | | | | | | begun with a repo-copy of mac.h to mac_framework.h. sys/mac.h now contains the userspace and user<->kernel API and definitions, with all in-kernel interfaces moved to mac_framework.h, which is now included across most of the kernel instead. This change is the first step in a larger cleanup and sweep of MAC Framework interfaces in the kernel, and will not be MFC'd. Obtained from: TrustedBSD Project Sponsored by: SPARTA Notes: svn path=/head/; revision=163606
* Remove MAC_DEBUG label counters, which were used to debug leaks andRobert Watson2006-09-201-11/+0
| | | | | | | | | | | | other problems while labels were first being added to various kernel objects. They have outlived their usefulness. MFC after: 1 month Suggested by: Christopher dot Vance at SPARTA dot com Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=162467
* Remove the NDEVFSINO and NDEVFSOVERFLOW options which no longer exists inPoul-Henning Kamp2006-07-171-1/+0
| | | | | | | | | DEVFS. Remove the opt_devfs.h file now that it is empty. Notes: svn path=/head/; revision=160425
* Don't call vn_finished_write() if vn_start_write() failed.Tor Egge2006-03-191-4/+6
| | | | Notes: svn path=/head/; revision=156893
* Standard Giant push down operations for the Mandatory Access Control (MAC)Christian S.J. Peron2005-10-041-34/+27
| | | | | | | | | | | | | | | | | | | | | | | | | framework. This makes Giant protection around MAC operations which inter- act with VFS conditional, based on the MPSAFE status of the file system. Affected the following syscalls: o __mac_get_fd o __mac_get_file o __mac_get_link o __mac_set_fd o __mac_set_file o __mac_set_link -Drop Giant all together in __mac_set_proc because the mac_cred_mmapped_drop_perms_recurse routine no longer requires it. -Move conditional Giant aquisitions to after label allocation routines. -Move the conditional release of Giant to before label de-allocation routines. Discussed with: rwatson Notes: svn path=/head/; revision=150914
* Bump the module versions of the MAC Framework and MAC policy modulesRobert Watson2005-07-141-1/+5
| | | | | | | | | | from 2 (6.x) to 3 (7.x) to allow for future changes in the MAC policy module ABI in 7.x. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=147983
* Get the directory structure correct in a comment.Tom Rhodes2005-04-221-1/+2
| | | | | | | Submitted by: Samy Al Bahra Notes: svn path=/head/; revision=145414
* In mac_get_fd(), remove unconditional acquisition of Giant around copyingRobert Watson2005-04-161-9/+7
| | | | | | | | | | | | | | | | | of the socket label to thread-local storage, and replace it with conditional acquisition based on debug.mpsafenet. Acquire the socket lock around the copy operation. In mac_set_fd(), replace the unconditional acquisition of Giant with the conditional acquisition of Giant based on debug.mpsafenet. The socket lock is acquired in mac_socket_label_set() so doesn't have to be acquired here. Obtained from: TrustedBSD Project Sponsored by: SPAWAR, SPARTA Notes: svn path=/head/; revision=145160
* Bump MAC Framework version to 2 in preparation for the upcoming API/ABIRobert Watson2004-11-091-1/+1
| | | | | | | | | changes associated with adding System V IPC support. This will prevent old modules from being used with the new kernel, and new modules from being used with the old kernel. Notes: svn path=/head/; revision=137454
* Disable use of synchronization early in the boot by the MAC Framework;Robert Watson2004-10-301-0/+21
| | | | | | | | | for modules linked into the kernel or loaded very early, panics will result otherwise, as the CV code it calls will panic due to its use of a mutex before it is initialized. Notes: svn path=/head/; revision=137072
* Do a pass over all modules in the kernel and make them return EOPNOTSUPPPoul-Henning Kamp2004-07-151-0/+1
| | | | | | | | | | | for unknown events. A number of modules return EINVAL in this instance, and I have left those alone for now and instead taught MOD_QUIESCE to accept this as "didn't do anything". Notes: svn path=/head/; revision=132199
* Add /* !MAC */ to final #endif.Robert Watson2004-05-031-1/+1
| | | | Notes: svn path=/head/; revision=128901
* Bump copyright date for NETA to 2004.Robert Watson2004-05-031-1/+1
| | | | Notes: svn path=/head/; revision=128886
* Add MAC_STATIC, a kernel option that disables internal MAC FrameworkRobert Watson2004-05-031-0/+25
| | | | | | | | | | | | | synchronization protecting against dynamic load and unload of MAC policies, and instead simply blocks load and unload. In a static configuration, this allows you to avoid the synchronization costs associated with introducing dynamicism. Obtained from: TrustedBSD Project Sponsored by: DARPA, McAfee Research Notes: svn path=/head/; revision=128885
* Update my personal copyrights and NETA copyrights in the kernelRobert Watson2004-02-221-2/+2
| | | | | | | | | | | to use the "year1-year3" format, as opposed to "year1, year2, year3". This seems to make lawyers more happy, but also prevents the lines from getting excessively long as the years start to add up. Suggested by: imp Notes: svn path=/head/; revision=126097
* Coalesce pipe allocations and frees. Previously, the pipe codeRobert Watson2004-02-011-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | would allocate two 'struct pipe's from the pipe zone, and malloc a mutex. - Create a new "struct pipepair" object holding the two 'struct pipe' instances, struct mutex, and struct label reference. Pipe structures now have a back-pointer to the pipe pair, and a 'pipe_present' flag to indicate whether the half has been closed. - Perform mutex init/destroy in zone init/destroy, avoiding reallocating the mutex for each pipe. Perform most pipe structure setup in zone constructor. - VM memory mappings for pageable buffers are still done outside of the UMA zone. - Change MAC API to speak 'struct pipepair' instead of 'struct pipe', update many policies. MAC labels are also handled outside of the UMA zone for now. Label-only policy modules don't have to be recompiled, but if a module is recompiled, its pipe entry points will need to be updated. If a module actually reached into the pipe structures (unlikely), that would also need to be modified. These changes substantially simplify failure handling in the pipe code as there are many fewer possible failure modes. On half-close, pipes no longer free the 'struct pipe' for the closed half until a full-close takes place. However, VM mapped buffers are still released on half-close. Some code refactoring is now possible to clean up some of the back references, etc; this patch attempts not to change the structure of most of the pipe implementation, only allocation/free code paths, so as to avoid introducing bugs (hopefully). This cuts about 8%-9% off the cost of sequential pipe allocation and free in system call tests on UP and SMP in my micro-benchmarks. May or may not make a difference in macro-benchmarks, but doing less work is good. Reviewed by: juli, tjr Testing help: dwhite, fenestro, scottl, et al Notes: svn path=/head/; revision=125293
* Implement sockets support for __mac_get_fd() and __mac_set_fd()Robert Watson2003-11-161-0/+30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | system calls, and prefer these calls over getsockopt()/setsockopt() for ABI reasons. When addressing UNIX domain sockets, these calls retrieve and modify the socket label, not the label of the rendezvous vnode. - Create mac_copy_socket_label() entry point based on mac_copy_pipe_label() entry point, intended to copy the socket label into temporary storage that doesn't require a socket lock to be held (currently Giant). - Implement mac_copy_socket_label() for various policies. - Expose socket label allocation, free, internalize, externalize entry points as non-static from mac_net.c. - Use mac_socket_label_set() in __mac_set_fd(). MAC-aware applications may now use mac_get_fd(), mac_set_fd(), and mac_get_peer() to retrieve and set various socket labels without directly invoking the getsockopt() interface. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories Notes: svn path=/head/; revision=122820
* Mark __mac_get_pid() as MPSAFE in the comment, as it runs withoutRobert Watson2003-11-121-37/+15
| | | | | | | | | | | | | | Giant and is also MPSAFE. Push Giant further down into __mac_get_fd() and __mac_set_fd(), grabbing it only for constrained regions dealing with VFS, and dropping it entirely for operations related to labeling of pipes. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories Notes: svn path=/head/; revision=122584
* Modify the MAC Framework so that instead of embedding a (struct label)Robert Watson2003-11-121-62/+57
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | in various kernel objects to represent security data, we embed a (struct label *) pointer, which now references labels allocated using a UMA zone (mac_label.c). This allows the size and shape of struct label to be varied without changing the size and shape of these kernel objects, which become part of the frozen ABI with 5-STABLE. This opens the door for boot-time selection of the number of label slots, and hence changes to the bound on the number of simultaneous labeled policies at boot-time instead of compile-time. This also makes it easier to embed label references in new objects as required for locking/caching with fine-grained network stack locking, such as inpcb structures. This change also moves us further in the direction of hiding the structure of kernel objects from MAC policy modules, not to mention dramatically reducing the number of '&' symbols appearing in both the MAC Framework and MAC policy modules, and improving readability. While this results in minimal performance change with MAC enabled, it will observably shrink the size of a number of critical kernel data structures for the !MAC case, and should have a small (but measurable) performance benefit (i.e., struct vnode, struct socket) do to memory conservation and reduced cost of zeroing memory. NOTE: Users of MAC must recompile their kernel and all MAC modules as a result of this change. Because this is an API change, third party MAC modules will also need to be updated to make less use of the '&' symbol. Suggestions from: bmilekic Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories Notes: svn path=/head/; revision=122524
* Whitespace sync to MAC branch, expand comment at the head of the file.Robert Watson2003-11-111-3/+9
| | | | Notes: svn path=/head/; revision=122454
* Remove the flags argument from mac_externalize_*_label(), as it's notRobert Watson2003-11-061-6/+6
| | | | | | | | | | passed into policies or used internally to the MAC Framework. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories Notes: svn path=/head/; revision=122159
generated by cgit v1.3 (git 2.53.0) at 2026-04-17 10:48:59 +0000