aboutsummaryrefslogtreecommitdiff
path: root/sys/security/mac
Commit message (Collapse)AuthorAgeFilesLines
...
* vfs: elide MAC-induced locking on rename if there are no relevant hoooksMateusz Guzik2020-07-292-0/+7
| | | | Notes: svn path=/head/; revision=363668
* vfs: add the infrastructure for lockless lookupMateusz Guzik2020-07-251-1/+2
| | | | | | | | | Reviewed by: kib Tested by: pho (in a patchset) Differential Revision: https://reviews.freebsd.org/D25577 Notes: svn path=/head/; revision=363518
* vfs: fix vn_poll performance with either MAC or AUDITMateusz Guzik2020-07-162-1/+16
| | | | | | | | | | | | | | | | | | | | The code would unconditionally lock the vnode to audit or call the mac hoook, even if neither want to do anything. Pre-check the state to avoid locking in the common case of nothing to do. Note this code should not be normally executed anyway as vnodes are always return ready. However, poll1/2 from will-it-scale use regular files for benchmarking, presumably to focus on the interface itself as the vnode handler is not supposed to do almost anything. This in particular fixes poll2 which passes 128 fds. $ ./poll2_processes -s 10 before: 134411 after: 271572 Notes: svn path=/head/; revision=363249
* vfs: fix MAC/AUDIT mismatch in vn_pollMateusz Guzik2020-07-161-0/+10
| | | | | | | Auditing would not be performed without MAC compiled in. Notes: svn path=/head/; revision=363247
* mac_policy: Remove mac_policy_sxJason A. Harmening2020-04-041-8/+3
| | | | | | | | | | This lock was made unnecessary by the addition of mac_policy_rms in r356120. Reviewed by: mjg, kib Differential Revision: https://reviews.freebsd.org/D24283 Notes: svn path=/head/; revision=359628
* Mark more nodes as CTLFLAG_MPSAFE or CTLFLAG_NEEDGIANT (17 of many)Pawel Biernacki2020-02-261-1/+1
| | | | | | | | | | | | | | | | | | | r357614 added CTLFLAG_NEEDGIANT to make it easier to find nodes that are still not MPSAFE (or already are but aren’t properly marked). Use it in preparation for a general review of all nodes. This is non-functional change that adds annotations to SYSCTL_NODE and SYSCTL_PROC nodes using one of the soon-to-be-required flags. Mark all obvious cases as MPSAFE. All entries that haven't been marked as MPSAFE before are by default marked as NEEDGIANT Approved by: kib (mentor, blanket) Commented by: kib, gallatin, melifaro Differential Revision: https://reviews.freebsd.org/D23718 Notes: svn path=/head/; revision=358333
* vfs: use mac fastpath for lookup, open, read, write, mmapMateusz Guzik2020-02-133-15/+124
| | | | Notes: svn path=/head/; revision=357889
* mac: implement fast path for checksMateusz Guzik2020-02-133-4/+118
| | | | | | | | | | | | | | | | All checking routines walk a linked list of all modules in order to determine if given hook is installed. This became a significant problem after mac_ntpd started being loaded by default. Implement a way perform checks for select hooks by testing a boolean. Use it for priv_check and priv_grant, which are constantly called from priv_check. The real fix would use hotpatching, but the above provides a way to know when to do it. Notes: svn path=/head/; revision=357887
* vfs: drop the mostly unused flags argument from VOP_UNLOCKMateusz Guzik2020-01-032-4/+4
| | | | | | | | | | | Filesystems which want to use it in limited capacity can employ the VOP_UNLOCK_FLAGS macro. Reviewed by: kib (previous version) Differential Revision: https://reviews.freebsd.org/D21427 Notes: svn path=/head/; revision=356337
* mac: use a sleepable rmlock instead of an sx lockMateusz Guzik2019-12-271-2/+6
| | | | | | | | | | | | | | If any non-static modules are loaded (and mac_ntpd tends to be), the lock is taken all the time al over the kernel. On platforms like arm64 this results in an avoidable significant performance degradation. Since write-locking is almost never needed, use a primitive optimized towards read-locking. Sample result of building the kernel on tmpfs 11 times: stock 11142.80s user 6704.44s system 4924% cpu 6:02.42 total patched 11118.95s user 2374.94s system 4547% cpu 4:56.71 total Notes: svn path=/head/; revision=356120
* Instead of looking up a predecessor or successor to the current mapDoug Moore2019-11-201-4/+5
| | | | | | | | | | | | entry, when that entry has been seen already, keep the already-looked-up value in a variable and use that instead of looking it up again. Approved by: alc, markj (earlier version), kib (earlier version) Differential Revision: https://reviews.freebsd.org/D22348 Notes: svn path=/head/; revision=354895
* Define wrapper functions vm_map_entry_{succ,pred} to act as wrappersDoug Moore2019-11-131-1/+2
| | | | | | | | | | | | | | | around entry->{next,prev} when those are used for ordered list traversal, and use those wrapper functions everywhere. Where the next field is used for maintaining a stack of deferred operations, #define defer_next to make that different usage clearer, and then use the 'right' pointer instead of 'next' for that purpose. Approved by: markj Tested by: pho (as part of a larger patch) Differential Revision: https://reviews.freebsd.org/D22347 Notes: svn path=/head/; revision=354684
* Define macro VM_MAP_ENTRY_FOREACH for enumerating the entries in a vm_map.Doug Moore2019-10-081-1/+1
| | | | | | | | | | | | | | | | | In case the implementation ever changes from using a chain of next pointers, then changing the macro definition will be necessary, but changing all the files that iterate over vm_map entries will not. Drop a counter in vm_object.c that would have an effect only if the vm_map entry count was wrong. Discussed with: alc Reviewed by: markj Tested by: pho (earlier version) Differential Revision: https://reviews.freebsd.org/D21882 Notes: svn path=/head/; revision=353298
* vm_map_simplify_entry considers merging an entry with its twoDoug Moore2019-08-251-1/+1
| | | | | | | | | | | | | | | | | neighbors, and is used in a way so that if entries a and b cannot be merged, we consider them twice, first not-merging a with its successor b, and then not-merging b with its predecessor a. This change replaces vm_map_simplify_entry with vm_map_try_merge_entries, which compares two adjacent entries only, and uses it to avoid duplicated merge-checks. Tested by: pho Reviewed by: alc Approved by: markj (implicit) Differential Revision: https://reviews.freebsd.org/D20814 Notes: svn path=/head/; revision=351476
* When MAC is enabled and a policy module is loaded, don't unconditionallyRobert Watson2019-05-033-26/+51
| | | | | | | | | | | | | | | | | | lock mac_ifnet_mtx, which protects labels on struct ifnet, unless at least one policy is actively using labels on ifnets. This avoids a global mutex acquire in certain fast paths -- most noticeably ifnet transmit. This was previously invisible by default, as no MAC policies were loaded by default, but recently became visible due to mac_ntpd being enabled by default. gallatin@ reports a reduction in PPS overhead from 300% to 2.2% with this change. We will want to explore further MAC Framework optimisation to reduce overhead further, but this brings things more back into the world of the sane. MFC after: 3 days Notes: svn path=/head/; revision=347058
* mac: reduce pessimization of sdt probe handlingMateusz Guzik2018-12-191-12/+16
| | | | | | | | | | | Prior to the change the code would branch on return value and then check if probes are enabled. Since vast majority of the time they are not, this is clearly wasteful. Check probes first. Sponsored by: The FreeBSD Foundation Notes: svn path=/head/; revision=342247
* Remove unused argument to priv_check_cred.Mateusz Guzik2018-12-111-1/+1
| | | | | | | | | | | | | | | | Patch mostly generated with cocinnelle: @@ expression E1,E2; @@ - priv_check_cred(E1,E2,0) + priv_check_cred(E1,E2) Sponsored by: The FreeBSD Foundation Notes: svn path=/head/; revision=341827
* Require that MAC label buffers be able to store a non-empty string.Mark Johnston2018-08-011-1/+3
| | | | | | | | | | | | | | | The buffer size may be used to initialize an sbuf in MAC_POLICY_EXTERNALIZE, and without this constraint it's possible to trigger an assertion failure in the sbuf code. With INVARIANTS disabled, the first attempt to write to the sbuf will fail. Reported by: pho Reviewed by: delphij MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D16527 Notes: svn path=/head/; revision=337031
* Use an accessor function to access ifr_data.Brooks Davis2018-03-301-2/+2
| | | | | | | | | | | | | | | | This fixes 32-bit compat (no ioctl command defintions are required as struct ifreq is the same size). This is believed to be sufficent to fully support ifconfig on 32-bit systems. Reviewed by: kib Obtained from: CheriBSD MFC after: 1 week Relnotes: yes Sponsored by: DARPA, AFRL Differential Revision: https://reviews.freebsd.org/D14900 Notes: svn path=/head/; revision=331797
* Reduce duplication in __mac_*_(file|link)(2) implementation.Brooks Davis2018-02-151-97/+27
| | | | | | | | | | Reviewed by: rwatson Obtained from: CheriBSD Sponsored by: DARPA, AFRL Differential Revision: https://reviews.freebsd.org/D14175 Notes: svn path=/head/; revision=329336
* Do pass removing some write-only variables from the kernel.Alexander Kabaev2017-12-251-2/+0
| | | | | | | | | | | | This reduces noise when kernel is compiled by newer GCC versions, such as one used by external toolchain ports. Reviewed by: kib, andrew(sys/arm and sys/arm64), emaste(partial), erj(partial) Reviewed by: jhb (sys/dev/pci/* sys/kern/vfs_aio.c and sys/kern/kern_synch.c) Differential Revision: https://reviews.freebsd.org/D10385 Notes: svn path=/head/; revision=327173
* Fix improper use of "its".Bryan Drewery2016-11-081-1/+1
| | | | | | | Sponsored by: Dell EMC Isilon Notes: svn path=/head/; revision=308457
* sys/security: minor spelling fixes.Pedro F. Giffuni2016-05-062-2/+2
| | | | | | | No functional change. Notes: svn path=/head/; revision=299187
* Fix style issues around existing SDT probes.Mark Johnston2015-12-162-22/+22
| | | | | | | | | | | | - Use SDT_PROBE<N>() instead of SDT_PROBE(). This has no functional effect at the moment, but will be needed for some future changes. - Don't hardcode the module component of the probe identifier. This is set automatically by the SDT framework. MFC after: 1 week Notes: svn path=/head/; revision=292384
* cred: add proc_set_cred helperMateusz Guzik2015-03-161-1/+1
| | | | | | | | | | The goal here is to provide one place altering process credentials. This eases debugging and opens up posibilities to do additional work when such an action is performed. Notes: svn path=/head/; revision=280130
* Update kernel inclusions of capability.h to use capsicum.h instead; someRobert Watson2014-03-161-1/+1
| | | | | | | | | | | further refinement is required as some device drivers intended to be portable over FreeBSD versions rely on __FreeBSD_version to decide whether to include capability.h. MFC after: 3 weeks Notes: svn path=/head/; revision=263233
* Remove AppleTalk support.Gleb Smirnoff2014-03-143-81/+0
| | | | | | | | | | | | | AppleTalk was a network transport protocol for Apple Macintosh devices in 80s and then 90s. Starting with Mac OS X in 2000 the AppleTalk was a legacy protocol and primary networking protocol is TCP/IP. The last Mac OS X release to support AppleTalk happened in 2009. The same year routing equipment vendors (namely Cisco) end their support. Thus, AppleTalk won't be supported in FreeBSD 11.0-RELEASE. Notes: svn path=/head/; revision=263152
* As constantly reported during kernel compilation, m_buflen is unsigned soBjoern A. Zeeb2013-12-251-2/+1
| | | | | | | | | can never be < 0. Remove the expression, which can never be true. MFC after: 1 week Notes: svn path=/head/; revision=259885
* dtrace sdt: remove the ugly sname parameter of SDT_PROBE_DEFINEAndriy Gapon2013-11-262-27/+27
| | | | | | | | | | | In its stead use the Solaris / illumos approach of emulating '-' (dash) in probe names with '__' (two consecutive underscores). Reviewed by: markj MFC after: 3 weeks Notes: svn path=/head/; revision=258622
* - For kernel compiled only with KDTRACE_HOOKS and not any lock debuggingAttilio Rao2013-11-2516-17/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | option, unbreak the lock tracing release semantic by embedding calls to LOCKSTAT_PROFILE_RELEASE_LOCK() direclty in the inlined version of the releasing functions for mutex, rwlock and sxlock. Failing to do so skips the lockstat_probe_func invokation for unlocking. - As part of the LOCKSTAT support is inlined in mutex operation, for kernel compiled without lock debugging options, potentially every consumer must be compiled including opt_kdtrace.h. Fix this by moving KDTRACE_HOOKS into opt_global.h and remove the dependency by opt_kdtrace.h for all files, as now only KDTRACE_FRAMES is linked there and it is only used as a compile-time stub [0]. [0] immediately shows some new bug as DTRACE-derived support for debug in sfxge is broken and it was never really tested. As it was not including correctly opt_kdtrace.h before it was never enabled so it was kept broken for a while. Fix this by using a protection stub, leaving sfxge driver authors the responsibility for fixing it appropriately [1]. Sponsored by: EMC / Isilon storage division Discussed with: rstone [0] Reported by: rstone [1] Discussed with: philip Notes: svn path=/head/; revision=258541
* Fix some typos that were causing probe argument types to show up as unknown.Mark Johnston2013-10-014-4/+4
| | | | | | | | | Reviewed by: rwatson (mac provider) Approved by: re (glebius) MFC after: 1 week Notes: svn path=/head/; revision=255971
* Make the mac_policy_rm lock recursable, which allows reentrance intoKonstantin Belousov2013-09-291-1/+2
| | | | | | | | | | | | | | the mac framework. It is needed when priv_check_cred(9) is called from the mac callback, e.g. in the mac_portacl(4). Reported by: az Reviewed by: rwatson Sponsored by: The FreeBSD Foundation MFC after: 1 week Approved by: re (gjb) Notes: svn path=/head/; revision=255945
* Change the cap_rights_t type from uint64_t to a structure that we can extendPawel Jakub Dawidek2013-09-051-2/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | in the future in a backward compatible (API and ABI) way. The cap_rights_t represents capability rights. We used to use one bit to represent one right, but we are running out of spare bits. Currently the new structure provides place for 114 rights (so 50 more than the previous cap_rights_t), but it is possible to grow the structure to hold at least 285 rights, although we can make it even larger if 285 rights won't be enough. The structure definition looks like this: struct cap_rights { uint64_t cr_rights[CAP_RIGHTS_VERSION + 2]; }; The initial CAP_RIGHTS_VERSION is 0. The top two bits in the first element of the cr_rights[] array contain total number of elements in the array - 2. This means if those two bits are equal to 0, we have 2 array elements. The top two bits in all remaining array elements should be 0. The next five bits in all array elements contain array index. Only one bit is used and bit position in this five-bits range defines array index. This means there can be at most five array elements in the future. To define new right the CAPRIGHT() macro must be used. The macro takes two arguments - an array index and a bit to set, eg. #define CAP_PDKILL CAPRIGHT(1, 0x0000000000000800ULL) We still support aliases that combine few rights, but the rights have to belong to the same array element, eg: #define CAP_LOOKUP CAPRIGHT(0, 0x0000000000000400ULL) #define CAP_FCHMOD CAPRIGHT(0, 0x0000000000002000ULL) #define CAP_FCHMODAT (CAP_FCHMOD | CAP_LOOKUP) There is new API to manage the new cap_rights_t structure: cap_rights_t *cap_rights_init(cap_rights_t *rights, ...); void cap_rights_set(cap_rights_t *rights, ...); void cap_rights_clear(cap_rights_t *rights, ...); bool cap_rights_is_set(const cap_rights_t *rights, ...); bool cap_rights_is_valid(const cap_rights_t *rights); void cap_rights_merge(cap_rights_t *dst, const cap_rights_t *src); void cap_rights_remove(cap_rights_t *dst, const cap_rights_t *src); bool cap_rights_contains(const cap_rights_t *big, const cap_rights_t *little); Capability rights to the cap_rights_init(), cap_rights_set(), cap_rights_clear() and cap_rights_is_set() functions are provided by separating them with commas, eg: cap_rights_t rights; cap_rights_init(&rights, CAP_READ, CAP_WRITE, CAP_FSTAT); There is no need to terminate the list of rights, as those functions are actually macros that take care of the termination, eg: #define cap_rights_set(rights, ...) \ __cap_rights_set((rights), __VA_ARGS__, 0ULL) void __cap_rights_set(cap_rights_t *rights, ...); Thanks to using one bit as an array index we can assert in those functions that there are no two rights belonging to different array elements provided together. For example this is illegal and will be detected, because CAP_LOOKUP belongs to element 0 and CAP_PDKILL to element 1: cap_rights_init(&rights, CAP_LOOKUP | CAP_PDKILL); Providing several rights that belongs to the same array's element this way is correct, but is not advised. It should only be used for aliases definition. This commit also breaks compatibility with some existing Capsicum system calls, but I see no other way to do that. This should be fine as Capsicum is still experimental and this change is not going to 9.x. Sponsored by: The FreeBSD Foundation Notes: svn path=/head/; revision=255219
* Implement read(2)/write(2) and neccessary lseek(2) for posix shmfd.Konstantin Belousov2013-08-213-0/+46
| | | | | | | | | | | | | | | | Add MAC framework entries for posix shm read and write. Do not allow implicit extension of the underlying memory segment past the limit set by ftruncate(2) by either of the syscalls. Read and write returns short i/o, lseek(2) fails with EINVAL when resulting offset does not fit into the limit. Discussed with: alc Tested by: pho Sponsored by: The FreeBSD Foundation Notes: svn path=/head/; revision=254603
* Relax the vm object locking in mac_proc_vm_revoke_recurse(). A read lockAlan Cox2013-06-041-4/+4
| | | | | | | | | suffices in one place. Sponsored by: EMC / Isilon Storage Division Notes: svn path=/head/; revision=251391
* Switch the vm_object mutex to be a rwlock. This will enable in theAttilio Rao2013-03-091-7/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | future further optimizations where the vm_object lock will be held in read mode most of the time the page cache resident pool of pages are accessed for reading purposes. The change is mostly mechanical but few notes are reported: * The KPI changes as follow: - VM_OBJECT_LOCK() -> VM_OBJECT_WLOCK() - VM_OBJECT_TRYLOCK() -> VM_OBJECT_TRYWLOCK() - VM_OBJECT_UNLOCK() -> VM_OBJECT_WUNLOCK() - VM_OBJECT_LOCK_ASSERT(MA_OWNED) -> VM_OBJECT_ASSERT_WLOCKED() (in order to avoid visibility of implementation details) - The read-mode operations are added: VM_OBJECT_RLOCK(), VM_OBJECT_TRYRLOCK(), VM_OBJECT_RUNLOCK(), VM_OBJECT_ASSERT_RLOCKED(), VM_OBJECT_ASSERT_LOCKED() * The vm/vm_pager.h namespace pollution avoidance (forcing requiring sys/mutex.h in consumers directly to cater its inlining functions using VM_OBJECT_LOCK()) imposes that all the vm/vm_pager.h consumers now must include also sys/rwlock.h. * zfs requires a quite convoluted fix to include FreeBSD rwlocks into the compat layer because the name clash between FreeBSD and solaris versions must be avoided. At this purpose zfs redefines the vm_object locking functions directly, isolating the FreeBSD components in specific compat stubs. The KPI results heavilly broken by this commit. Thirdy part ports must be updated accordingly (I can think off-hand of VirtualBox, for example). Sponsored by: EMC / Isilon storage division Reviewed by: jeff Reviewed by: pjd (ZFS specific review) Discussed with: alc Tested by: pho Notes: svn path=/head/; revision=248084
* Remove the support for using non-mpsafe filesystem modules.Konstantin Belousov2012-10-222-29/+12
| | | | | | | | | | | | | | | In particular, do not lock Giant conditionally when calling into the filesystem module, remove the VFS_LOCK_GIANT() and related macros. Stop handling buffers belonging to non-mpsafe filesystems. The VFS_VERSION is bumped to indicate the interface change which does not result in the interface signatures changes. Conducted and reviewed by: attilio Tested by: pho Notes: svn path=/head/; revision=241896
* When allocation of labels on files is implicitly disabled due to MACRobert Watson2012-04-081-14/+27
| | | | | | | | | | | policy configuration, avoid leaking resources following failed calls to get and set MAC labels by file descriptor. Reported by: Mateusz Guzik <mjguzik at gmail.com> + clang scan-build MFC after: 3 days Notes: svn path=/head/; revision=234032
* - Improve BPF locking model.Alexander V. Chernikov2012-04-061-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | Interface locks and descriptor locks are converted from mutex(9) to rwlock(9). This greately improves performance: in most common case we need to acquire 1 reader lock instead of 2 mutexes. - Remove filter(descriptor) (reader) lock in bpf_mtap[2] This was suggested by glebius@. We protect filter by requesting interface writer lock on filter change. - Cover struct bpf_if under BPF_INTERNAL define. This permits including bpf.h without including rwlock stuff. However, this is is temporary solution, struct bpf_if should be made opaque for any external caller. Found by: Dmitrij Tejblum <tejblum@yandex-team.ru> Sponsored by: Yandex LLC Reviewed by: glebius (previous version) Reviewed by: silence on -net@ Approved by: (mentor) MFC after: 3 weeks Notes: svn path=/head/; revision=233937
* Revert the approach for skipping lockstat_probe_func call when doingAttilio Rao2011-12-121-1/+0
| | | | | | | | | | | | | | | | lock_success/lock_failure, introduced in r228424, by directly skipping in dtrace_probe. This mainly helps in avoiding namespace pollution and thus lockstat.h dependency by systm.h. As an added bonus, this also helps in MFC case. Reviewed by: avg MFC after: 3 months (or never) X-MFC: r228424 Notes: svn path=/head/; revision=228448
* put sys/systm.h at its proper place or add it if missingAndriy Gapon2011-12-122-1/+2
| | | | | | | | | | Reported by: lstewart, tinderbox Pointyhat to: avg, attilio MFC after: 1 week MFC with: r228430 Notes: svn path=/head/; revision=228433
* In order to maximize the re-usability of kernel code in user space thisKip Macy2011-09-161-20/+20
| | | | | | | | | | | | | | | | patch modifies makesyscalls.sh to prefix all of the non-compatibility calls (e.g. not linux_, freebsd32_) with sys_ and updates the kernel entry points and all places in the code that use them. It also fixes an additional name space collision between the kernel function psignal and the libc function of the same name by renaming the kernel psignal kern_psignal(). By introducing this change now we will ease future MFCs that change syscalls. Reviewed by: rwatson Approved by: re (bz) Notes: svn path=/head/; revision=225617
* Correct several issues in the integration of POSIX shared memory objectsRobert Watson2011-09-023-10/+31
| | | | | | | | | | | | | | | | | | | | | | | | | and the new setmode and setowner fileops in FreeBSD 9.0: - Add new MAC Framework entry point mac_posixshm_check_create() to allow MAC policies to authorise shared memory use. Provide a stub policy and test policy templates. - Add missing Biba and MLS implementations of mac_posixshm_check_setmode() and mac_posixshm_check_setowner(). - Add 'accmode' argument to mac_posixshm_check_open() -- unlike the mac_posixsem_check_open() entry point it was modeled on, the access mode is required as shared memory access can be read-only as well as writable; this isn't true of POSIX semaphores. - Implement full range of POSIX shared memory entry points for Biba and MLS. Sponsored by: Google Inc. Obtained from: TrustedBSD Project Approved by: re (kib) Notes: svn path=/head/; revision=225344
* Add the fo_chown and fo_chmod methods to struct fileops and use themKonstantin Belousov2011-08-164-0/+88
| | | | | | | | | | | | | to implement fchown(2) and fchmod(2) support for several file types that previously lacked it. Add MAC entries for chown/chmod done on posix shared memory and (old) in-kernel posix semaphores. Based on the submission by: glebius Reviewed by: rwatson Approved by: re (bz) Notes: svn path=/head/; revision=224914
* Second-to-last commit implementing Capsicum capabilities in the FreeBSDRobert Watson2011-08-111-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | kernel for FreeBSD 9.0: Add a new capability mask argument to fget(9) and friends, allowing system call code to declare what capabilities are required when an integer file descriptor is converted into an in-kernel struct file *. With options CAPABILITIES compiled into the kernel, this enforces capability protection; without, this change is effectively a no-op. Some cases require special handling, such as mmap(2), which must preserve information about the maximum rights at the time of mapping in the memory map so that they can later be enforced in mprotect(2) -- this is done by narrowing the rights in the existing max_protection field used for similar purposes with file permissions. In namei(9), we assert that the code is not reached from within capability mode, as we're not yet ready to enforce namespace capabilities there. This will follow in a later commit. Update two capability names: CAP_EVENT and CAP_KEVENT become CAP_POST_KEVENT and CAP_POLL_KEVENT to more accurately indicate what they represent. Approved by: re (bz) Submitted by: jonathan Sponsored by: Google Inc Notes: svn path=/head/; revision=224778
* - Add a FEATURE for capsicum (security_capabilities).Alexander Leidinger2011-03-041-1/+1
| | | | | | | | | - Rename mac FEATURE to security_mac. Discussed with: rwatson Notes: svn path=/head/; revision=219258
* Add some FEATURE macros for various features (AUDIT/CAM/IPC/KTR/MAC/NFS/NTP/Alexander Leidinger2011-02-251-0/+3
| | | | | | | | | | | | | | | | PMC/SYSV/...). No FreeBSD version bump, the userland application to query the features will be committed last and can serve as an indication of the availablility if needed. Sponsored by: Google Summer of Code 2010 Submitted by: kibab Reviewed by: arch@ (parts by rwatson, trasz, jhb) X-MFC after: to be determined in last commit with code from this project Notes: svn path=/head/; revision=219028
* Unless "cnt" exceeds MAX_COMMIT_COUNT, nfsrv_commit() and nfsvno_fsync() areAlan Cox2011-02-051-5/+2
| | | | | | | | | | | | | | incorrectly calling vm_object_page_clean(). They are passing the length of the range rather than the ending offset of the range. Perform the OFF_TO_IDX() conversion in vm_object_page_clean() rather than the callers. Reviewed by: kib MFC after: 3 weeks Notes: svn path=/head/; revision=218345
* sysctl(9) cleanup checkpoint: amd64 GENERIC builds cleanly.Matthew D Fleming2011-01-121-1/+1
| | | | | | | Commit the security directory. Notes: svn path=/head/; revision=217325
* Add missing DTrace probe invocation to mac_vnode_check_open; the probeRobert Watson2010-10-231-0/+2
| | | | | | | | | | was declared, but never used. MFC after: 3 days Sponsored by: Google, Inc. Notes: svn path=/head/; revision=214249
generated by cgit v1.3 (git 2.53.0) at 2026-04-07 17:06:35 +0000