aboutsummaryrefslogtreecommitdiff
path: root/sys/security/mac
Commit message (Collapse)AuthorAgeFilesLines
...
* Add an extra comment to the SDT probes definition. This allows us to getRui Paulo2010-08-222-13/+15
| | | | | | | | | | | | use '-' in probe names, matching the probe names in Solaris.[1] Add userland SDT probes definitions to sys/sdt.h. Sponsored by: The FreeBSD Foundation Discussed with: rwaston [1] Notes: svn path=/head/; revision=211616
* Add one further check with mac_policy_count to an mbuf copying caseRobert Watson2009-06-031-0/+3
| | | | | | | | | | (limited to netatalk) to avoid MAC label lookup on both mbufs if no policies are registered. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=193393
* Continue work to optimize performance of "options MAC" when no MAC policyRobert Watson2009-06-035-63/+92
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | modules are loaded by avoiding mbuf label lookups when policies aren't loaded, pushing further socket locking into MAC policy modules, and avoiding locking MAC ifnet locks when no policies are loaded: - Check mac_policies_count before looking for mbuf MAC label m_tags in MAC Framework entry points. We will still pay label lookup costs if MAC policies are present but don't require labels (typically a single mbuf header field read, but perhaps further indirection if IPSEC or other m_tag consumers are in use). - Further push socket locking for socket-related access control checks and events into MAC policies from the MAC Framework, so that sockets are only locked if a policy specifically requires a lock to protect a label. This resolves lock order issues during sonewconn() and also in local domain socket cross-connect where multiple socket locks could not be held at once for the purposes of propagatig MAC labels across multiple sockets. Eliminate mac_policy_count check in some entry points where it no longer avoids locking. - Add mac_policy_count checking in some entry points relating to network interfaces that otherwise lock a global MAC ifnet lock used to protect ifnet labels. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=193391
* Mark MAC Framework sx and rm locks as NOWITNESS to suppress warnings thatRobert Watson2009-06-021-2/+2
| | | | | | | | | | | | might arise from WITNESS not understanding its locking protocol, which should be deadlock-free. Currently these warnings generally don't occur, but as object locking is pushed into policies for some object types, they would otherwise occur more often. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=193355
* Add internal 'mac_policy_count' counter to the MAC Framework, which is aRobert Watson2009-06-023-22/+70
| | | | | | | | | | | | | | | | | | | | | count of the number of registered policies. Rather than unconditionally locking sockets before passing them into MAC, lock them in the MAC entry points only if mac_policy_count is non-zero. This avoids locking overhead for a number of socket system calls when no policies are registered, eliminating measurable overhead for the MAC Framework for the socket subsystem when there are no active policies. Possibly socket locks should be acquired by policies if they are required for socket labels, which would further avoid locking overhead when there are policies but they don't require labeling of sockets, or possibly don't even implement socket controls. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=193332
* Make the rmlock(9) interface a bit more like the rwlock(9) interface:Robert Watson2009-05-291-1/+1
| | | | | | | | | | | | | | | | | - Add rm_init_flags() and accept extended options only for that variation. - Add a flags space specifically for rm_init_flags(), rather than borrowing the lock_init() flag space. - Define flag RM_RECURSE to use instead of LO_RECURSABLE. - Define flag RM_NOWITNESS to allow an rmlock to be exempt from WITNESS checking; this wasn't possible previously as rm_init() always passed LO_WITNESS when initializing an rmlock's struct lock. - Add RM_SYSINIT_FLAGS(). - Rename embedded mutex in rmlocks to make it more obvious what it is. - Update consumers. - Update man page. Notes: svn path=/head/; revision=193030
* Convert the MAC Framework from using rwlocks to rmlocks to stabilizeRobert Watson2009-05-272-21/+32
| | | | | | | | | framework registration for non-sleepable entry points. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=192881
* Rename MAC Framework-internal macros used to invoke policy entry points:Robert Watson2009-05-0118-304/+339
| | | | | | | | | | | | | | | | | | | | | MAC_BOOLEAN -> MAC_POLICY_BOOLEAN MAC_BOOLEAN_NOSLEEP -> MAC_POLICY_BOOLEANN_NOSLEEP MAC_CHECK -> MAC_POLICY_CHECK MAC_CHECK_NOSLEEP -> MAC_POLICY_CHECK_NOSLEEP MAC_EXTERNALIZE -> MAC_POLICY_EXTERNALIZE MAC_GRANT -> MAC_POLICY_GRANT MAC_GRANT_NOSLEEP -> MAC_POLICY_GRANT_NOSLEEP MAC_INTERNALIZE -> MAC_POLICY_INTERNALIZE MAC_PERFORM -> MAC_POLICY_PERFORM_CHECK MAC_PERFORM_NOSLEEP -> MAC_POLICY_PERFORM_NOSLEEP This frees up those macro names for use in wrapping calls into the MAC Framework from the remainder of the kernel. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=191731
* Rework MAC Framework synchronization in a number of ways in order toRobert Watson2009-03-1420-326/+409
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | improve performance: - Eliminate custom reference count and condition variable to monitor threads entering the framework, as this had both significant overhead and behaved badly in the face of contention. - Replace reference count with two locks: an rwlock and an sx lock, which will be read-acquired by threads entering the framework depending on whether a give policy entry point is permitted to sleep or not. - Replace previous mutex locking of the reference count for exclusive access with write acquiring of both the policy list sx and rw locks, which occurs only when policies are attached or detached. - Do a lockless read of the dynamic policy list head before acquiring any locks in order to reduce overhead when no dynamic policies are loaded; this a race we can afford to lose. - For every policy entry point invocation, decide whether sleeping is permitted, and if not, use a _NOSLEEP() variant of the composition macros, which will use the rwlock instead of the sxlock. In some cases, we decide which to use based on allocation flags passed to the MAC Framework entry point. As with the move to rwlocks/rmlocks in pfil, this may trigger witness warnings, but these should (generally) be false positives as all acquisition of the locks is for read with two very narrow exceptions for policy load/unload, and those code blocks should never acquire other locks. Sponsored by: Google, Inc. Obtained from: TrustedBSD Project Discussed with: csjp (idea, not specific patch) Notes: svn path=/head/; revision=189797
* Remove 'uio' argument from MAC Framework and MAC policy entry points forRobert Watson2009-03-083-10/+8
| | | | | | | | | | | | extended attribute get/set; in the case of get an uninitialized user buffer was passed before the EA was retrieved, making it of relatively little use; the latter was simply unused by any policies. Obtained from: TrustedBSD Project Sponsored by: Google, Inc. Notes: svn path=/head/; revision=189533
* Rename 'ucred' argument to mac_socket_check_bind() to 'cred' to matchRobert Watson2009-03-081-3/+3
| | | | | | | | | | other use of the same variable type. Obtained from: TrustedBSD Project Sponsored by: Google, Inc. Notes: svn path=/head/; revision=189532
* Improve the consistency of MAC Framework and MAC policy entry pointRobert Watson2009-03-086-215/+196
| | | | | | | | | | | | | | | | | | | | | | | | | | naming by renaming certain "proc" entry points to "cred" entry points, reflecting their manipulation of credentials. For some entry points, the process was passed into the framework but not into policies; in these cases, stop passing in the process since we don't need it. mac_proc_check_setaudit -> mac_cred_check_setaudit mac_proc_check_setaudit_addr -> mac_cred_check_setaudit_addr mac_proc_check_setauid -> mac_cred_check_setauid mac_proc_check_setegid -> mac_cred_check_setegid mac_proc_check_seteuid -> mac_cred_check_seteuid mac_proc_check_setgid -> mac_cred_check_setgid mac_proc_check_setgroups -> mac_cred_ceck_setgroups mac_proc_check_setregid -> mac_cred_check_setregid mac_proc_check_setresgid -> mac_cred_check_setresgid mac_proc_check_setresuid -> mac_cred_check_setresuid mac_proc_check_setreuid -> mac_cred_check_setreuid mac_proc_check_setuid -> mac_cred_check_setuid Obtained from: TrustedBSD Project Sponsored by: Google, Inc. Notes: svn path=/head/; revision=189529
* Add static DTrace probes for MAC Framework access control checks andRobert Watson2009-03-0817-14/+660
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | privilege grants so that dtrace can be more easily used to monitor the security decisions being generated by the MAC Framework following policy invocation. Successful access control checks will be reported by: mac_framework:kernel:<entrypoint>:mac_check_ok Failed access control checks will be reported by: mac_framework:kernel:<entrypoint>:mac_check_err Successful privilege grants will be reported by: mac_framework:kernel:priv_grant:mac_grant_ok Failed privilege grants will be reported by: mac_framework:kernel:priv_grant:mac_grant_err In all cases, the return value (always 0 for _ok, otherwise an errno for _err) will be reported via arg0 on the probe, and subsequent arguments will hold entrypoint-specific data, in a style similar to privilege tracing. Obtained from: TrustedBSD Project Sponsored by: Google, Inc. Notes: svn path=/head/; revision=189503
* Reduce the verbosity of SDT trace points for DTrace by defining severalRobert Watson2009-03-031-12/+3
| | | | | | | | | | | | | | wrapper macros that allow trace points and arguments to be declared using a single macro rather than several. This means a lot less repetition and vertical space for each trace point. Use these macros when defining privilege and MAC Framework trace points. Reviewed by: jb MFC after: 1 week Notes: svn path=/head/; revision=189311
* Use vm_map_entry_t instead of explicit struct vm_map_entry *.Konstantin Belousov2009-02-241-1/+1
| | | | | | | Reviewed by: alc Notes: svn path=/head/; revision=189013
* Use __FBSDID() for $FreeBSD$ version strings in .c files.Robert Watson2009-01-242-4/+6
| | | | | | | | Obtained from: TrustedBSD Project MFC after: 3 days Notes: svn path=/head/; revision=187667
* Begin to add SDT tracing of the MAC Framework: add policy modevent,Robert Watson2009-01-241-1/+24
| | | | | | | | | | | register, and unregister hooks that give access to the mac_policy_conf for the policy. Obtained from: TrustedBSD Project MFC after: 3 days Notes: svn path=/head/; revision=187666
* Rather than having MAC policies explicitly declare what object typesRobert Watson2009-01-103-37/+77
| | | | | | | | | | | | | | | | | they label, derive that information implicitly from the set of label initializers in their policy operations set. This avoids a possible class of programmer errors, while retaining the structure that allows us to avoid allocating labels for objects that don't need them. As before, we regenerate a global mask of labeled objects each time a policy is loaded or unloaded, stored in mac_labeled. Discussed with: csjp Suggested by: Jacques Vidrine <nectar at apple.com> Obtained from: TrustedBSD Project Sponsored by: Apple, Inc. Notes: svn path=/head/; revision=187016
* Use MPC_OBJECT_IP6Q to indicate labeling of struct ip6q rather thanRobert Watson2009-01-101-1/+1
| | | | | | | | | | MPC_OBJECT_IPQ; it was already defined, just not used. Obtained from: TrustedBSD Project Sponsored by: Apple, Inc. Notes: svn path=/head/; revision=187014
* Make preparations for resurrecting shared/read locks on vm maps:Alan Cox2008-12-221-4/+2
| | | | | | | | | | | | | | | | | | mac_proc_vm_revoke_recurse() requests a read lock on the vm map at the start but does not handle failure by vm_map_lock_upgrade() when it seeks to modify the vm map. At present, this works because all lock request on a vm map are implemented as exclusive locks. Thus, vm_map_lock_upgrade() is a no-op that always reports success. However, that is about to change, and proc_vm_revoke_recurse() will require substantial modifications to handle vm_map_lock_upgrade() failures. For the time being, I am changing mac_proc_vm_revoke_recurse() to request a write lock on the vm map at the start. Approved by: rwatson MFC after: 3 months Notes: svn path=/head/; revision=186397
* Break out strictly credential-related portions of mac_process.c into aRobert Watson2008-10-282-141/+213
| | | | | | | | | new file, mac_cred.c. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=184425
* Introduce accmode_t. This is required for NFSv4 ACLs - it will be neccessaryEdward Tomasz Napierala2008-10-283-8/+12
| | | | | | | | | | to add more V* constants, and the variables changed by this patch were often being assigned to mode_t variables, which is 16 bit. Approved by: rwatson (mentor) Notes: svn path=/head/; revision=184413
* Rename mac_cred_mmapped_drop_perms(), which revokes access to virtualRobert Watson2008-10-283-16/+14
| | | | | | | | | | | | | | memory mappings when the MAC label on a process changes, to mac_proc_vm_revoke(), It now also acquires its own credential reference directly from the affected process rather than accepting one passed by the the caller, simplifying the API and consumer code. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=184412
* Rename three MAC entry points from _proc_ to _cred_ to reflect the factRobert Watson2008-10-283-43/+43
| | | | | | | | | | that they operate directly on credentials: mac_proc_create_swapper(), mac_proc_create_init(), and mac_proc_associate_nfsd(). Update policies. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=184407
* Add a MAC label, MAC Framework, and MAC policy entry points for IPv6Robert Watson2008-10-263-3/+129
| | | | | | | | | | | | | | fragment reassembly queues. This allows policies to label reassembly queues, perform access control checks when matching fragments to a queue, update a queue label when fragments are matched, and label the resulting reassembled datagram. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=184307
* Add mac_inpcb_check_visible MAC Framework entry point, which is similarBjoern A. Zeeb2008-10-173-0/+16
| | | | | | | | | | to mac_socket_check_visible but operates on the inpcb. Reviewed by: rwatson MFC after: 3 months (set timer, decide then) Notes: svn path=/head/; revision=183973
* Introduce two related changes to the TrustedBSD MAC Framework:Robert Watson2008-08-2316-144/+318
| | | | | | | | | | | | | | | | | | | | | | | | | | | | (1) Abstract interpreter vnode labeling in execve(2) and mac_execve(2) so that the general exec code isn't aware of the details of allocating, copying, and freeing labels, rather, simply passes in a void pointer to start and stop functions that will be used by the framework. This change will be MFC'd. (2) Introduce a new flags field to the MAC_POLICY_SET(9) interface allowing policies to declare which types of objects require label allocation, initialization, and destruction, and define a set of flags covering various supported object types (MPC_OBJECT_PROC, MPC_OBJECT_VNODE, MPC_OBJECT_INPCB, ...). This change reduces the overhead of compiling the MAC Framework into the kernel if policies aren't loaded, or if policies require labels on only a small number or even no object types. Each time a policy is loaded or unloaded, we recalculate a mask of labeled object types across all policies present in the system. Eliminate MAC_ALWAYS_LABEL_MBUF option as it is no longer required. MFC after: 1 week ((1) only) Reviewed by: csjp Obtained from: TrustedBSD Project Sponsored by: Apple, Inc. Notes: svn path=/head/; revision=182063
* Rework the lifetime management of the kernel implementation of POSIXJohn Baldwin2008-06-273-15/+45
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | semaphores. Specifically, semaphores are now represented as new file descriptor type that is set to close on exec. This removes the need for all of the manual process reference counting (and fork, exec, and exit event handlers) as the normal file descriptor operations handle all of that for us nicely. It is also suggested as one possible implementation in the spec and at least one other OS (OS X) uses this approach. Some bugs that were fixed as a result include: - References to a named semaphore whose name is removed still work after the sem_unlink() operation. Prior to this patch, if a semaphore's name was removed, valid handles from sem_open() would get EINVAL errors from sem_getvalue(), sem_post(), etc. This fixes that. - Unnamed semaphores created with sem_init() were not cleaned up when a process exited or exec'd. They were only cleaned up if the process did an explicit sem_destroy(). This could result in a leak of semaphore objects that could never be cleaned up. - On the other hand, if another process guessed the id (kernel pointer to 'struct ksem' of an unnamed semaphore (created via sem_init)) and had write access to the semaphore based on UID/GID checks, then that other process could manipulate the semaphore via sem_destroy(), sem_post(), sem_wait(), etc. - As part of the permission check (UID/GID), the umask of the proces creating the semaphore was not honored. Thus if your umask denied group read/write access but the explicit mode in the sem_init() call allowed it, the semaphore would be readable/writable by other users in the same group, for example. This includes access via the previous bug. - If the module refused to unload because there were active semaphores, then it might have deregistered one or more of the semaphore system calls before it noticed that there was a problem. I'm not sure if this actually happened as the order that modules are discovered by the kernel linker depends on how the actual .ko file is linked. One can make the order deterministic by using a single module with a mod_event handler that explicitly registers syscalls (and deregisters during unload after any checks). This also fixes a race where even if the sem_module unloaded first it would have destroyed locks that the syscalls might be trying to access if they are still executing when they are unloaded. XXX: By the way, deregistering system calls doesn't do any blocking to drain any threads from the calls. - Some minor fixes to errno values on error. For example, sem_init() isn't documented to return ENFILE or EMFILE if we run out of semaphores the way that sem_open() can. Instead, it should return ENOSPC in that case. Other changes: - Kernel semaphores now use a hash table to manage the namespace of named semaphores nearly in a similar fashion to the POSIX shared memory object file descriptors. Kernel semaphores can now also have names longer than 14 chars (up to MAXPATHLEN) and can include subdirectories in their pathname. - The UID/GID permission checks for access to a named semaphore are now done via vaccess() rather than a home-rolled set of checks. - Now that kernel semaphores have an associated file object, the various MAC checks for POSIX semaphores accept both a file credential and an active credential. There is also a new posixsem_check_stat() since it is possible to fstat() a semaphore file descriptor. - A small set of regression tests (using the ksem API directly) is present in src/tools/regression/posixsem. Reported by: kris (1) Tested by: kris Reviewed by: rwatson (lightly) MFC after: 1 month Notes: svn path=/head/; revision=180059
* Remove the posixsem_check_destroy() MAC check. It is semantically identicalJohn Baldwin2008-06-233-14/+0
| | | | | | | | | | to doing a MAC check for close(), but no other types of close() (including close(2) and ksem_close(2)) have MAC checks. Discussed with: rwatson Notes: svn path=/head/; revision=179963
* The TrustedBSD MAC Framework named struct ipq instances 'ipq', which is theRobert Watson2008-06-133-26/+25
| | | | | | | | | | | | | | same as the global variable defined in ip_input.c. Instead, adopt the name 'q' as found in about 1/2 of uses in ip_input.c, preventing a collision on the name. This is non-harmful, but means that search and replace on the global works less well (as in the virtualization work), as well as indexing tools. MFC after: 1 week Reported by: julian Notes: svn path=/head/; revision=179781
* Plug a memory leak which can occur when multiple MAC policies are loadedChristian S.J. Peron2008-05-271-0/+4
| | | | | | | | | | | which label mbufs. This leak can occur if one policy successfully allocates label storage and subsequent allocations from other policies fail. Spotted by: rwatson MFC after: 1 week Notes: svn path=/head/; revision=179359
* When propagating a MAC label from an inpcb to an mbuf, allow read andRobert Watson2008-04-191-1/+1
| | | | | | | | | write locks on the inpcb, not just write locks. MFC after: 3 months Notes: svn path=/head/; revision=178321
* Convert pcbinfo and inpcb mutexes to rwlocks, and modify macros toRobert Watson2008-04-171-3/+3
| | | | | | | | | | | | | | | | | | explicitly select write locking for all use of the inpcb mutex. Update some pcbinfo lock assertions to assert locked rather than write-locked, although in practice almost all uses of the pcbinfo rwlock main exclusive, and all instances of inpcb lock acquisition are exclusive. This change should introduce (ideally) little functional change. However, it lays the groundwork for significantly increased parallelism in the TCP/IP code. MFC after: 3 months Tested by: kris (superset of committered patch) Notes: svn path=/head/; revision=178285
* Make naming of include guards for MAC Framework include files moreRobert Watson2008-04-133-9/+9
| | | | | | | | | consistent with other kernel include guards (don't start with _SYS). MFC after: 3 days Notes: svn path=/head/; revision=178184
* Add the support for the AT_FDCWD and fd-relative name lookups to theKonstantin Belousov2008-03-311-0/+1
| | | | | | | | | | | | namei(9). Based on the submission by rdivacky, sponsored by Google Summer of Code 2007 Reviewed by: rwatson, rdivacky Tested by: pho Notes: svn path=/head/; revision=177785
* VOP_LOCK1() (and so VOP_LOCK()) and VOP_UNLOCK() are only used inAttilio Rao2008-01-132-4/+4
| | | | | | | | | | | | | | conjuction with 'thread' argument passing which is always curthread. Remove the unuseful extra-argument and pass explicitly curthread to lower layer functions, when necessary. KPI results broken by this change, which should affect several ports, so version bumping and manpage update will be further committed. Tested by: kris, pho, Diego Sardina <siarodx at gmail dot com> Notes: svn path=/head/; revision=175294
* vn_lock() is currently only used with the 'curthread' passed as argument.Attilio Rao2008-01-102-4/+4
| | | | | | | | | | | | | | | | | | | Remove this argument and pass curthread directly to underlying VOP_LOCK1() VFS method. This modify makes the code cleaner and in particular remove an annoying dependence helping next lockmgr() cleanup. KPI results, obviously, changed. Manpage and FreeBSD_version will be updated through further commits. As a side note, would be valuable to say that next commits will address a similar cleanup about VFS methods, in particular vop_lock1 and vop_unlock. Tested by: Diego Sardina <siarodx at gmail dot com>, Andrea Di Pasquale <whyx dot it at gmail dot com> Notes: svn path=/head/; revision=175202
* Add a new file descriptor type for IPC shared memory objects and use it toJohn Baldwin2008-01-083-0/+187
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | implement shm_open(2) and shm_unlink(2) in the kernel: - Each shared memory file descriptor is associated with a swap-backed vm object which provides the backing store. Each descriptor starts off with a size of zero, but the size can be altered via ftruncate(2). The shared memory file descriptors also support fstat(2). read(2), write(2), ioctl(2), select(2), poll(2), and kevent(2) are not supported on shared memory file descriptors. - shm_open(2) and shm_unlink(2) are now implemented as system calls that manage shared memory file descriptors. The virtual namespace that maps pathnames to shared memory file descriptors is implemented as a hash table where the hash key is generated via the 32-bit Fowler/Noll/Vo hash of the pathname. - As an extension, the constant 'SHM_ANON' may be specified in place of the path argument to shm_open(2). In this case, an unnamed shared memory file descriptor will be created similar to the IPC_PRIVATE key for shmget(2). Note that the shared memory object can still be shared among processes by sharing the file descriptor via fork(2) or sendmsg(2), but it is unnamed. This effectively serves to implement the getmemfd() idea bandied about the lists several times over the years. - The backing store for shared memory file descriptors are garbage collected when they are not referenced by any open file descriptors or the shm_open(2) virtual namespace. Submitted by: dillon, peter (previous versions) Submitted by: rwatson (I based this on his version) Reviewed by: alc (suggested converting getmemfd() to shm_open()) Notes: svn path=/head/; revision=175164
* Fix a MAC label leak for POSIX semaphores, in which per-policy labelsRobert Watson2007-12-171-0/+1
| | | | | | | | | | | | would be properly disposed of, but the global label structure for the semaphore wouldn't be freed. MFC after: 3 days Reported by: tanyong <tanyong at ercist dot iscas dot ac dot cn>, zhouzhouyi Notes: svn path=/head/; revision=174718
* Garbage collect mac_mbuf_create_multicast_encap TrustedBSD MAC FrameworkRobert Watson2007-10-283-22/+0
| | | | | | | | | | | entry point, which is no longer required now that we don't support old-style multicast tunnels. This removes the last mbuf object class entry point that isn't init/copy/destroy. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=173108
* Continue to move from generic network entry points in the TrustedBSD MACRobert Watson2007-10-284-20/+41
| | | | | | | | | | | | | | | | | Framework by moving from mac_mbuf_create_netlayer() to more specific entry points for specific network services: - mac_netinet_firewall_reply() to be used when replying to in-bound TCP segments in pf and ipfw (etc). - Rename mac_netinet_icmp_reply() to mac_netinet_icmp_replyinplace() and add mac_netinet_icmp_reply(), reflecting that in some cases we overwrite a label in place, but in others we apply the label to a new mbuf. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=173102
* Move towards more explicit support for various network protocol stacksRobert Watson2007-10-287-23/+188
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | in the TrustedBSD MAC Framework: - Add mac_atalk.c and add explicit entry point mac_netatalk_aarp_send() for AARP packet labeling, rather than using a generic link layer entry point. - Add mac_inet6.c and add explicit entry point mac_netinet6_nd6_send() for ND6 packet labeling, rather than using a generic link layer entry point. - Add expliict entry point mac_netinet_arp_send() for ARP packet labeling, and mac_netinet_igmp_send() for IGMP packet labeling, rather than using a generic link layer entry point. - Remove previous genering link layer entry point, mac_mbuf_create_linklayer() as it is no longer used. - Add implementations of new entry points to various policies, largely by replicating the existing link layer entry point for them; remove old link layer entry point implementation. - Make MAC_IFNET_LOCK(), MAC_IFNET_UNLOCK(), and mac_ifnet_mtx global to the MAC Framework rather than static to mac_net.c as it is now needed outside of mac_net.c. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=173095
* Update comment following MAC Framework entry point renaming andRobert Watson2007-10-261-1/+6
| | | | | | | | | reorganization. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=173042
* Rename 'mac_mbuf_create_from_firewall' to 'mac_netinet_firewall_send' asRobert Watson2007-10-264-11/+11
| | | | | | | | | | | | | we move towards netinet as a pseudo-object for the MAC Framework. Rename 'mac_create_mbuf_linklayer' to 'mac_mbuf_create_linklayer' to reflect general object-first ordering preference. Sponsored by: SPARTA (original patches against Mac OS X) Obtained from: TrustedBSD Project, Apple Computer Notes: svn path=/head/; revision=173018
* Sort entry points in mac_framework.h and mac_policy.h alphabetically byRobert Watson2007-10-252-629/+574
| | | | | | | | | | | | primary object type, and then by secondarily by method name. This sorts entry points relating to particular objects, such as pipes, sockets, and vnodes together. Sponsored by: SPARTA (original patches against Mac OS X) Obtained from: TrustedBSD Project, Apple Computer Notes: svn path=/head/; revision=172990
* Normalize TCP syncache-related MAC Framework entry points to match mostRobert Watson2007-10-253-20/+20
| | | | | | | | | | other entry points in the form mac_<object>_method(). Discussed with: csjp Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=172970
* Rename mac_associate_nfsd_label() to mac_proc_associate_nfsd(), and moveRobert Watson2007-10-254-19/+19
| | | | | | | | | | | | from mac_vfs.c to mac_process.c to join other functions that setup up process labels for specific purposes. Unlike the two proc create calls, this call is intended to run after creation when a process registers as the NFS daemon, so remains an _associate_ call.. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=172957
* Further MAC Framework cleanup: normalize some local variable names andRobert Watson2007-10-253-21/+22
| | | | | | | | | clean up some comments. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=172953
* Merge first in a series of TrustedBSD MAC Framework KPI changesRobert Watson2007-10-2416-1150/+1193
| | | | | | | | | | | | | | | | | | | | | | | | | | from Mac OS X Leopard--rationalize naming for entry points to the following general forms: mac_<object>_<method/action> mac_<object>_check_<method/action> The previous naming scheme was inconsistent and mostly reversed from the new scheme. Also, make object types more consistent and remove spaces from object types that contain multiple parts ("posix_sem" -> "posixsem") to make mechanical parsing easier. Introduce a new "netinet" object type for certain IPv4/IPv6-related methods. Also simplify, slightly, some entry point names. All MAC policy modules will need to be recompiled, and modules not updates as part of this commit will need to be modified to conform to the new KPI. Sponsored by: SPARTA (original patches against Mac OS X) Obtained from: TrustedBSD Project, Apple Computer Notes: svn path=/head/; revision=172930
* Bump MAC_VERSION to 4 and add an 8.x line in the version table. Version 4Robert Watson2007-10-231-1/+2
| | | | | | | | | | will include significant synchronization to the Mac OS X Leopard version of the MAC Framework. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=172905
generated by cgit v1.3 (git 2.53.0) at 2026-04-08 11:48:08 +0000