aboutsummaryrefslogtreecommitdiff
path: root/sys/security/mac
Commit message (Collapse)AuthorAgeFilesLines
* Merge r263233 from HEAD to stable/10:Robert Watson2015-03-191-1/+1
| | | | | | | | | | | | Update kernel inclusions of capability.h to use capsicum.h instead; some further refinement is required as some device drivers intended to be portable over FreeBSD versions rely on __FreeBSD_version to decide whether to include capability.h. Sponsored by: Google, Inc. Notes: svn path=/stable/10/; revision=280258
* MFC r259885:Bjoern A. Zeeb2014-08-161-2/+1
| | | | | | | | As constantly reported during kernel compilation, m_buflen is unsigned so can never be < 0. Remove the expression, which can never be true. Notes: svn path=/stable/10/; revision=270045
* MFC r258622: dtrace sdt: remove the ugly sname parameter of SDT_PROBE_DEFINEAndriy Gapon2014-01-172-27/+27
| | | | Notes: svn path=/stable/10/; revision=260817
* Fix some typos that were causing probe argument types to show up as unknown.Mark Johnston2013-10-014-4/+4
| | | | | | | | | Reviewed by: rwatson (mac provider) Approved by: re (glebius) MFC after: 1 week Notes: svn path=/head/; revision=255971
* Make the mac_policy_rm lock recursable, which allows reentrance intoKonstantin Belousov2013-09-291-1/+2
| | | | | | | | | | | | | | the mac framework. It is needed when priv_check_cred(9) is called from the mac callback, e.g. in the mac_portacl(4). Reported by: az Reviewed by: rwatson Sponsored by: The FreeBSD Foundation MFC after: 1 week Approved by: re (gjb) Notes: svn path=/head/; revision=255945
* Change the cap_rights_t type from uint64_t to a structure that we can extendPawel Jakub Dawidek2013-09-051-2/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | in the future in a backward compatible (API and ABI) way. The cap_rights_t represents capability rights. We used to use one bit to represent one right, but we are running out of spare bits. Currently the new structure provides place for 114 rights (so 50 more than the previous cap_rights_t), but it is possible to grow the structure to hold at least 285 rights, although we can make it even larger if 285 rights won't be enough. The structure definition looks like this: struct cap_rights { uint64_t cr_rights[CAP_RIGHTS_VERSION + 2]; }; The initial CAP_RIGHTS_VERSION is 0. The top two bits in the first element of the cr_rights[] array contain total number of elements in the array - 2. This means if those two bits are equal to 0, we have 2 array elements. The top two bits in all remaining array elements should be 0. The next five bits in all array elements contain array index. Only one bit is used and bit position in this five-bits range defines array index. This means there can be at most five array elements in the future. To define new right the CAPRIGHT() macro must be used. The macro takes two arguments - an array index and a bit to set, eg. #define CAP_PDKILL CAPRIGHT(1, 0x0000000000000800ULL) We still support aliases that combine few rights, but the rights have to belong to the same array element, eg: #define CAP_LOOKUP CAPRIGHT(0, 0x0000000000000400ULL) #define CAP_FCHMOD CAPRIGHT(0, 0x0000000000002000ULL) #define CAP_FCHMODAT (CAP_FCHMOD | CAP_LOOKUP) There is new API to manage the new cap_rights_t structure: cap_rights_t *cap_rights_init(cap_rights_t *rights, ...); void cap_rights_set(cap_rights_t *rights, ...); void cap_rights_clear(cap_rights_t *rights, ...); bool cap_rights_is_set(const cap_rights_t *rights, ...); bool cap_rights_is_valid(const cap_rights_t *rights); void cap_rights_merge(cap_rights_t *dst, const cap_rights_t *src); void cap_rights_remove(cap_rights_t *dst, const cap_rights_t *src); bool cap_rights_contains(const cap_rights_t *big, const cap_rights_t *little); Capability rights to the cap_rights_init(), cap_rights_set(), cap_rights_clear() and cap_rights_is_set() functions are provided by separating them with commas, eg: cap_rights_t rights; cap_rights_init(&rights, CAP_READ, CAP_WRITE, CAP_FSTAT); There is no need to terminate the list of rights, as those functions are actually macros that take care of the termination, eg: #define cap_rights_set(rights, ...) \ __cap_rights_set((rights), __VA_ARGS__, 0ULL) void __cap_rights_set(cap_rights_t *rights, ...); Thanks to using one bit as an array index we can assert in those functions that there are no two rights belonging to different array elements provided together. For example this is illegal and will be detected, because CAP_LOOKUP belongs to element 0 and CAP_PDKILL to element 1: cap_rights_init(&rights, CAP_LOOKUP | CAP_PDKILL); Providing several rights that belongs to the same array's element this way is correct, but is not advised. It should only be used for aliases definition. This commit also breaks compatibility with some existing Capsicum system calls, but I see no other way to do that. This should be fine as Capsicum is still experimental and this change is not going to 9.x. Sponsored by: The FreeBSD Foundation Notes: svn path=/head/; revision=255219
* Implement read(2)/write(2) and neccessary lseek(2) for posix shmfd.Konstantin Belousov2013-08-213-0/+46
| | | | | | | | | | | | | | | | Add MAC framework entries for posix shm read and write. Do not allow implicit extension of the underlying memory segment past the limit set by ftruncate(2) by either of the syscalls. Read and write returns short i/o, lseek(2) fails with EINVAL when resulting offset does not fit into the limit. Discussed with: alc Tested by: pho Sponsored by: The FreeBSD Foundation Notes: svn path=/head/; revision=254603
* Relax the vm object locking in mac_proc_vm_revoke_recurse(). A read lockAlan Cox2013-06-041-4/+4
| | | | | | | | | suffices in one place. Sponsored by: EMC / Isilon Storage Division Notes: svn path=/head/; revision=251391
* Switch the vm_object mutex to be a rwlock. This will enable in theAttilio Rao2013-03-091-7/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | future further optimizations where the vm_object lock will be held in read mode most of the time the page cache resident pool of pages are accessed for reading purposes. The change is mostly mechanical but few notes are reported: * The KPI changes as follow: - VM_OBJECT_LOCK() -> VM_OBJECT_WLOCK() - VM_OBJECT_TRYLOCK() -> VM_OBJECT_TRYWLOCK() - VM_OBJECT_UNLOCK() -> VM_OBJECT_WUNLOCK() - VM_OBJECT_LOCK_ASSERT(MA_OWNED) -> VM_OBJECT_ASSERT_WLOCKED() (in order to avoid visibility of implementation details) - The read-mode operations are added: VM_OBJECT_RLOCK(), VM_OBJECT_TRYRLOCK(), VM_OBJECT_RUNLOCK(), VM_OBJECT_ASSERT_RLOCKED(), VM_OBJECT_ASSERT_LOCKED() * The vm/vm_pager.h namespace pollution avoidance (forcing requiring sys/mutex.h in consumers directly to cater its inlining functions using VM_OBJECT_LOCK()) imposes that all the vm/vm_pager.h consumers now must include also sys/rwlock.h. * zfs requires a quite convoluted fix to include FreeBSD rwlocks into the compat layer because the name clash between FreeBSD and solaris versions must be avoided. At this purpose zfs redefines the vm_object locking functions directly, isolating the FreeBSD components in specific compat stubs. The KPI results heavilly broken by this commit. Thirdy part ports must be updated accordingly (I can think off-hand of VirtualBox, for example). Sponsored by: EMC / Isilon storage division Reviewed by: jeff Reviewed by: pjd (ZFS specific review) Discussed with: alc Tested by: pho Notes: svn path=/head/; revision=248084
* Remove the support for using non-mpsafe filesystem modules.Konstantin Belousov2012-10-222-29/+12
| | | | | | | | | | | | | | | In particular, do not lock Giant conditionally when calling into the filesystem module, remove the VFS_LOCK_GIANT() and related macros. Stop handling buffers belonging to non-mpsafe filesystems. The VFS_VERSION is bumped to indicate the interface change which does not result in the interface signatures changes. Conducted and reviewed by: attilio Tested by: pho Notes: svn path=/head/; revision=241896
* When allocation of labels on files is implicitly disabled due to MACRobert Watson2012-04-081-14/+27
| | | | | | | | | | | policy configuration, avoid leaking resources following failed calls to get and set MAC labels by file descriptor. Reported by: Mateusz Guzik <mjguzik at gmail.com> + clang scan-build MFC after: 3 days Notes: svn path=/head/; revision=234032
* - Improve BPF locking model.Alexander V. Chernikov2012-04-061-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | Interface locks and descriptor locks are converted from mutex(9) to rwlock(9). This greately improves performance: in most common case we need to acquire 1 reader lock instead of 2 mutexes. - Remove filter(descriptor) (reader) lock in bpf_mtap[2] This was suggested by glebius@. We protect filter by requesting interface writer lock on filter change. - Cover struct bpf_if under BPF_INTERNAL define. This permits including bpf.h without including rwlock stuff. However, this is is temporary solution, struct bpf_if should be made opaque for any external caller. Found by: Dmitrij Tejblum <tejblum@yandex-team.ru> Sponsored by: Yandex LLC Reviewed by: glebius (previous version) Reviewed by: silence on -net@ Approved by: (mentor) MFC after: 3 weeks Notes: svn path=/head/; revision=233937
* Revert the approach for skipping lockstat_probe_func call when doingAttilio Rao2011-12-121-1/+0
| | | | | | | | | | | | | | | | lock_success/lock_failure, introduced in r228424, by directly skipping in dtrace_probe. This mainly helps in avoiding namespace pollution and thus lockstat.h dependency by systm.h. As an added bonus, this also helps in MFC case. Reviewed by: avg MFC after: 3 months (or never) X-MFC: r228424 Notes: svn path=/head/; revision=228448
* put sys/systm.h at its proper place or add it if missingAndriy Gapon2011-12-122-1/+2
| | | | | | | | | | Reported by: lstewart, tinderbox Pointyhat to: avg, attilio MFC after: 1 week MFC with: r228430 Notes: svn path=/head/; revision=228433
* In order to maximize the re-usability of kernel code in user space thisKip Macy2011-09-161-20/+20
| | | | | | | | | | | | | | | | patch modifies makesyscalls.sh to prefix all of the non-compatibility calls (e.g. not linux_, freebsd32_) with sys_ and updates the kernel entry points and all places in the code that use them. It also fixes an additional name space collision between the kernel function psignal and the libc function of the same name by renaming the kernel psignal kern_psignal(). By introducing this change now we will ease future MFCs that change syscalls. Reviewed by: rwatson Approved by: re (bz) Notes: svn path=/head/; revision=225617
* Correct several issues in the integration of POSIX shared memory objectsRobert Watson2011-09-023-10/+31
| | | | | | | | | | | | | | | | | | | | | | | | | and the new setmode and setowner fileops in FreeBSD 9.0: - Add new MAC Framework entry point mac_posixshm_check_create() to allow MAC policies to authorise shared memory use. Provide a stub policy and test policy templates. - Add missing Biba and MLS implementations of mac_posixshm_check_setmode() and mac_posixshm_check_setowner(). - Add 'accmode' argument to mac_posixshm_check_open() -- unlike the mac_posixsem_check_open() entry point it was modeled on, the access mode is required as shared memory access can be read-only as well as writable; this isn't true of POSIX semaphores. - Implement full range of POSIX shared memory entry points for Biba and MLS. Sponsored by: Google Inc. Obtained from: TrustedBSD Project Approved by: re (kib) Notes: svn path=/head/; revision=225344
* Add the fo_chown and fo_chmod methods to struct fileops and use themKonstantin Belousov2011-08-164-0/+88
| | | | | | | | | | | | | to implement fchown(2) and fchmod(2) support for several file types that previously lacked it. Add MAC entries for chown/chmod done on posix shared memory and (old) in-kernel posix semaphores. Based on the submission by: glebius Reviewed by: rwatson Approved by: re (bz) Notes: svn path=/head/; revision=224914
* Second-to-last commit implementing Capsicum capabilities in the FreeBSDRobert Watson2011-08-111-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | kernel for FreeBSD 9.0: Add a new capability mask argument to fget(9) and friends, allowing system call code to declare what capabilities are required when an integer file descriptor is converted into an in-kernel struct file *. With options CAPABILITIES compiled into the kernel, this enforces capability protection; without, this change is effectively a no-op. Some cases require special handling, such as mmap(2), which must preserve information about the maximum rights at the time of mapping in the memory map so that they can later be enforced in mprotect(2) -- this is done by narrowing the rights in the existing max_protection field used for similar purposes with file permissions. In namei(9), we assert that the code is not reached from within capability mode, as we're not yet ready to enforce namespace capabilities there. This will follow in a later commit. Update two capability names: CAP_EVENT and CAP_KEVENT become CAP_POST_KEVENT and CAP_POLL_KEVENT to more accurately indicate what they represent. Approved by: re (bz) Submitted by: jonathan Sponsored by: Google Inc Notes: svn path=/head/; revision=224778
* - Add a FEATURE for capsicum (security_capabilities).Alexander Leidinger2011-03-041-1/+1
| | | | | | | | | - Rename mac FEATURE to security_mac. Discussed with: rwatson Notes: svn path=/head/; revision=219258
* Add some FEATURE macros for various features (AUDIT/CAM/IPC/KTR/MAC/NFS/NTP/Alexander Leidinger2011-02-251-0/+3
| | | | | | | | | | | | | | | | PMC/SYSV/...). No FreeBSD version bump, the userland application to query the features will be committed last and can serve as an indication of the availablility if needed. Sponsored by: Google Summer of Code 2010 Submitted by: kibab Reviewed by: arch@ (parts by rwatson, trasz, jhb) X-MFC after: to be determined in last commit with code from this project Notes: svn path=/head/; revision=219028
* Unless "cnt" exceeds MAX_COMMIT_COUNT, nfsrv_commit() and nfsvno_fsync() areAlan Cox2011-02-051-5/+2
| | | | | | | | | | | | | | incorrectly calling vm_object_page_clean(). They are passing the length of the range rather than the ending offset of the range. Perform the OFF_TO_IDX() conversion in vm_object_page_clean() rather than the callers. Reviewed by: kib MFC after: 3 weeks Notes: svn path=/head/; revision=218345
* sysctl(9) cleanup checkpoint: amd64 GENERIC builds cleanly.Matthew D Fleming2011-01-121-1/+1
| | | | | | | Commit the security directory. Notes: svn path=/head/; revision=217325
* Add missing DTrace probe invocation to mac_vnode_check_open; the probeRobert Watson2010-10-231-0/+2
| | | | | | | | | | was declared, but never used. MFC after: 3 days Sponsored by: Google, Inc. Notes: svn path=/head/; revision=214249
* Add an extra comment to the SDT probes definition. This allows us to getRui Paulo2010-08-222-13/+15
| | | | | | | | | | | | use '-' in probe names, matching the probe names in Solaris.[1] Add userland SDT probes definitions to sys/sdt.h. Sponsored by: The FreeBSD Foundation Discussed with: rwaston [1] Notes: svn path=/head/; revision=211616
* Add one further check with mac_policy_count to an mbuf copying caseRobert Watson2009-06-031-0/+3
| | | | | | | | | | (limited to netatalk) to avoid MAC label lookup on both mbufs if no policies are registered. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=193393
* Continue work to optimize performance of "options MAC" when no MAC policyRobert Watson2009-06-035-63/+92
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | modules are loaded by avoiding mbuf label lookups when policies aren't loaded, pushing further socket locking into MAC policy modules, and avoiding locking MAC ifnet locks when no policies are loaded: - Check mac_policies_count before looking for mbuf MAC label m_tags in MAC Framework entry points. We will still pay label lookup costs if MAC policies are present but don't require labels (typically a single mbuf header field read, but perhaps further indirection if IPSEC or other m_tag consumers are in use). - Further push socket locking for socket-related access control checks and events into MAC policies from the MAC Framework, so that sockets are only locked if a policy specifically requires a lock to protect a label. This resolves lock order issues during sonewconn() and also in local domain socket cross-connect where multiple socket locks could not be held at once for the purposes of propagatig MAC labels across multiple sockets. Eliminate mac_policy_count check in some entry points where it no longer avoids locking. - Add mac_policy_count checking in some entry points relating to network interfaces that otherwise lock a global MAC ifnet lock used to protect ifnet labels. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=193391
* Mark MAC Framework sx and rm locks as NOWITNESS to suppress warnings thatRobert Watson2009-06-021-2/+2
| | | | | | | | | | | | might arise from WITNESS not understanding its locking protocol, which should be deadlock-free. Currently these warnings generally don't occur, but as object locking is pushed into policies for some object types, they would otherwise occur more often. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=193355
* Add internal 'mac_policy_count' counter to the MAC Framework, which is aRobert Watson2009-06-023-22/+70
| | | | | | | | | | | | | | | | | | | | | count of the number of registered policies. Rather than unconditionally locking sockets before passing them into MAC, lock them in the MAC entry points only if mac_policy_count is non-zero. This avoids locking overhead for a number of socket system calls when no policies are registered, eliminating measurable overhead for the MAC Framework for the socket subsystem when there are no active policies. Possibly socket locks should be acquired by policies if they are required for socket labels, which would further avoid locking overhead when there are policies but they don't require labeling of sockets, or possibly don't even implement socket controls. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=193332
* Make the rmlock(9) interface a bit more like the rwlock(9) interface:Robert Watson2009-05-291-1/+1
| | | | | | | | | | | | | | | | | - Add rm_init_flags() and accept extended options only for that variation. - Add a flags space specifically for rm_init_flags(), rather than borrowing the lock_init() flag space. - Define flag RM_RECURSE to use instead of LO_RECURSABLE. - Define flag RM_NOWITNESS to allow an rmlock to be exempt from WITNESS checking; this wasn't possible previously as rm_init() always passed LO_WITNESS when initializing an rmlock's struct lock. - Add RM_SYSINIT_FLAGS(). - Rename embedded mutex in rmlocks to make it more obvious what it is. - Update consumers. - Update man page. Notes: svn path=/head/; revision=193030
* Convert the MAC Framework from using rwlocks to rmlocks to stabilizeRobert Watson2009-05-272-21/+32
| | | | | | | | | framework registration for non-sleepable entry points. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=192881
* Rename MAC Framework-internal macros used to invoke policy entry points:Robert Watson2009-05-0118-304/+339
| | | | | | | | | | | | | | | | | | | | | MAC_BOOLEAN -> MAC_POLICY_BOOLEAN MAC_BOOLEAN_NOSLEEP -> MAC_POLICY_BOOLEANN_NOSLEEP MAC_CHECK -> MAC_POLICY_CHECK MAC_CHECK_NOSLEEP -> MAC_POLICY_CHECK_NOSLEEP MAC_EXTERNALIZE -> MAC_POLICY_EXTERNALIZE MAC_GRANT -> MAC_POLICY_GRANT MAC_GRANT_NOSLEEP -> MAC_POLICY_GRANT_NOSLEEP MAC_INTERNALIZE -> MAC_POLICY_INTERNALIZE MAC_PERFORM -> MAC_POLICY_PERFORM_CHECK MAC_PERFORM_NOSLEEP -> MAC_POLICY_PERFORM_NOSLEEP This frees up those macro names for use in wrapping calls into the MAC Framework from the remainder of the kernel. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=191731
* Rework MAC Framework synchronization in a number of ways in order toRobert Watson2009-03-1420-326/+409
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | improve performance: - Eliminate custom reference count and condition variable to monitor threads entering the framework, as this had both significant overhead and behaved badly in the face of contention. - Replace reference count with two locks: an rwlock and an sx lock, which will be read-acquired by threads entering the framework depending on whether a give policy entry point is permitted to sleep or not. - Replace previous mutex locking of the reference count for exclusive access with write acquiring of both the policy list sx and rw locks, which occurs only when policies are attached or detached. - Do a lockless read of the dynamic policy list head before acquiring any locks in order to reduce overhead when no dynamic policies are loaded; this a race we can afford to lose. - For every policy entry point invocation, decide whether sleeping is permitted, and if not, use a _NOSLEEP() variant of the composition macros, which will use the rwlock instead of the sxlock. In some cases, we decide which to use based on allocation flags passed to the MAC Framework entry point. As with the move to rwlocks/rmlocks in pfil, this may trigger witness warnings, but these should (generally) be false positives as all acquisition of the locks is for read with two very narrow exceptions for policy load/unload, and those code blocks should never acquire other locks. Sponsored by: Google, Inc. Obtained from: TrustedBSD Project Discussed with: csjp (idea, not specific patch) Notes: svn path=/head/; revision=189797
* Remove 'uio' argument from MAC Framework and MAC policy entry points forRobert Watson2009-03-083-10/+8
| | | | | | | | | | | | extended attribute get/set; in the case of get an uninitialized user buffer was passed before the EA was retrieved, making it of relatively little use; the latter was simply unused by any policies. Obtained from: TrustedBSD Project Sponsored by: Google, Inc. Notes: svn path=/head/; revision=189533
* Rename 'ucred' argument to mac_socket_check_bind() to 'cred' to matchRobert Watson2009-03-081-3/+3
| | | | | | | | | | other use of the same variable type. Obtained from: TrustedBSD Project Sponsored by: Google, Inc. Notes: svn path=/head/; revision=189532
* Improve the consistency of MAC Framework and MAC policy entry pointRobert Watson2009-03-086-215/+196
| | | | | | | | | | | | | | | | | | | | | | | | | | naming by renaming certain "proc" entry points to "cred" entry points, reflecting their manipulation of credentials. For some entry points, the process was passed into the framework but not into policies; in these cases, stop passing in the process since we don't need it. mac_proc_check_setaudit -> mac_cred_check_setaudit mac_proc_check_setaudit_addr -> mac_cred_check_setaudit_addr mac_proc_check_setauid -> mac_cred_check_setauid mac_proc_check_setegid -> mac_cred_check_setegid mac_proc_check_seteuid -> mac_cred_check_seteuid mac_proc_check_setgid -> mac_cred_check_setgid mac_proc_check_setgroups -> mac_cred_ceck_setgroups mac_proc_check_setregid -> mac_cred_check_setregid mac_proc_check_setresgid -> mac_cred_check_setresgid mac_proc_check_setresuid -> mac_cred_check_setresuid mac_proc_check_setreuid -> mac_cred_check_setreuid mac_proc_check_setuid -> mac_cred_check_setuid Obtained from: TrustedBSD Project Sponsored by: Google, Inc. Notes: svn path=/head/; revision=189529
* Add static DTrace probes for MAC Framework access control checks andRobert Watson2009-03-0817-14/+660
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | privilege grants so that dtrace can be more easily used to monitor the security decisions being generated by the MAC Framework following policy invocation. Successful access control checks will be reported by: mac_framework:kernel:<entrypoint>:mac_check_ok Failed access control checks will be reported by: mac_framework:kernel:<entrypoint>:mac_check_err Successful privilege grants will be reported by: mac_framework:kernel:priv_grant:mac_grant_ok Failed privilege grants will be reported by: mac_framework:kernel:priv_grant:mac_grant_err In all cases, the return value (always 0 for _ok, otherwise an errno for _err) will be reported via arg0 on the probe, and subsequent arguments will hold entrypoint-specific data, in a style similar to privilege tracing. Obtained from: TrustedBSD Project Sponsored by: Google, Inc. Notes: svn path=/head/; revision=189503
* Reduce the verbosity of SDT trace points for DTrace by defining severalRobert Watson2009-03-031-12/+3
| | | | | | | | | | | | | | wrapper macros that allow trace points and arguments to be declared using a single macro rather than several. This means a lot less repetition and vertical space for each trace point. Use these macros when defining privilege and MAC Framework trace points. Reviewed by: jb MFC after: 1 week Notes: svn path=/head/; revision=189311
* Use vm_map_entry_t instead of explicit struct vm_map_entry *.Konstantin Belousov2009-02-241-1/+1
| | | | | | | Reviewed by: alc Notes: svn path=/head/; revision=189013
* Use __FBSDID() for $FreeBSD$ version strings in .c files.Robert Watson2009-01-242-4/+6
| | | | | | | | Obtained from: TrustedBSD Project MFC after: 3 days Notes: svn path=/head/; revision=187667
* Begin to add SDT tracing of the MAC Framework: add policy modevent,Robert Watson2009-01-241-1/+24
| | | | | | | | | | | register, and unregister hooks that give access to the mac_policy_conf for the policy. Obtained from: TrustedBSD Project MFC after: 3 days Notes: svn path=/head/; revision=187666
* Rather than having MAC policies explicitly declare what object typesRobert Watson2009-01-103-37/+77
| | | | | | | | | | | | | | | | | they label, derive that information implicitly from the set of label initializers in their policy operations set. This avoids a possible class of programmer errors, while retaining the structure that allows us to avoid allocating labels for objects that don't need them. As before, we regenerate a global mask of labeled objects each time a policy is loaded or unloaded, stored in mac_labeled. Discussed with: csjp Suggested by: Jacques Vidrine <nectar at apple.com> Obtained from: TrustedBSD Project Sponsored by: Apple, Inc. Notes: svn path=/head/; revision=187016
* Use MPC_OBJECT_IP6Q to indicate labeling of struct ip6q rather thanRobert Watson2009-01-101-1/+1
| | | | | | | | | | MPC_OBJECT_IPQ; it was already defined, just not used. Obtained from: TrustedBSD Project Sponsored by: Apple, Inc. Notes: svn path=/head/; revision=187014
* Make preparations for resurrecting shared/read locks on vm maps:Alan Cox2008-12-221-4/+2
| | | | | | | | | | | | | | | | | | mac_proc_vm_revoke_recurse() requests a read lock on the vm map at the start but does not handle failure by vm_map_lock_upgrade() when it seeks to modify the vm map. At present, this works because all lock request on a vm map are implemented as exclusive locks. Thus, vm_map_lock_upgrade() is a no-op that always reports success. However, that is about to change, and proc_vm_revoke_recurse() will require substantial modifications to handle vm_map_lock_upgrade() failures. For the time being, I am changing mac_proc_vm_revoke_recurse() to request a write lock on the vm map at the start. Approved by: rwatson MFC after: 3 months Notes: svn path=/head/; revision=186397
* Break out strictly credential-related portions of mac_process.c into aRobert Watson2008-10-282-141/+213
| | | | | | | | | new file, mac_cred.c. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=184425
* Introduce accmode_t. This is required for NFSv4 ACLs - it will be neccessaryEdward Tomasz Napierala2008-10-283-8/+12
| | | | | | | | | | to add more V* constants, and the variables changed by this patch were often being assigned to mode_t variables, which is 16 bit. Approved by: rwatson (mentor) Notes: svn path=/head/; revision=184413
* Rename mac_cred_mmapped_drop_perms(), which revokes access to virtualRobert Watson2008-10-283-16/+14
| | | | | | | | | | | | | | memory mappings when the MAC label on a process changes, to mac_proc_vm_revoke(), It now also acquires its own credential reference directly from the affected process rather than accepting one passed by the the caller, simplifying the API and consumer code. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=184412
* Rename three MAC entry points from _proc_ to _cred_ to reflect the factRobert Watson2008-10-283-43/+43
| | | | | | | | | | that they operate directly on credentials: mac_proc_create_swapper(), mac_proc_create_init(), and mac_proc_associate_nfsd(). Update policies. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=184407
* Add a MAC label, MAC Framework, and MAC policy entry points for IPv6Robert Watson2008-10-263-3/+129
| | | | | | | | | | | | | | fragment reassembly queues. This allows policies to label reassembly queues, perform access control checks when matching fragments to a queue, update a queue label when fragments are matched, and label the resulting reassembled datagram. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=184307
* Add mac_inpcb_check_visible MAC Framework entry point, which is similarBjoern A. Zeeb2008-10-173-0/+16
| | | | | | | | | | to mac_socket_check_visible but operates on the inpcb. Reviewed by: rwatson MFC after: 3 months (set timer, decide then) Notes: svn path=/head/; revision=183973
* Introduce two related changes to the TrustedBSD MAC Framework:Robert Watson2008-08-2316-144/+318
| | | | | | | | | | | | | | | | | | | | | | | | | | | | (1) Abstract interpreter vnode labeling in execve(2) and mac_execve(2) so that the general exec code isn't aware of the details of allocating, copying, and freeing labels, rather, simply passes in a void pointer to start and stop functions that will be used by the framework. This change will be MFC'd. (2) Introduce a new flags field to the MAC_POLICY_SET(9) interface allowing policies to declare which types of objects require label allocation, initialization, and destruction, and define a set of flags covering various supported object types (MPC_OBJECT_PROC, MPC_OBJECT_VNODE, MPC_OBJECT_INPCB, ...). This change reduces the overhead of compiling the MAC Framework into the kernel if policies aren't loaded, or if policies require labels on only a small number or even no object types. Each time a policy is loaded or unloaded, we recalculate a mask of labeled object types across all policies present in the system. Eliminate MAC_ALWAYS_LABEL_MBUF option as it is no longer required. MFC after: 1 week ((1) only) Reviewed by: csjp Obtained from: TrustedBSD Project Sponsored by: Apple, Inc. Notes: svn path=/head/; revision=182063
generated by cgit v1.3 (git 2.53.0) at 2026-05-29 21:19:21 +0000