aboutsummaryrefslogtreecommitdiff
path: root/sys/security/mac
Commit message (Collapse)AuthorAgeFilesLines
* kern: mac: add a prison_cleanup entry pointKyle Evans2026-02-142-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The MAC framework provides a lot of useful functionality that can be configured per-jail without requiring the use of labels. Having another entry point that we invoke just for general prison cleanup rather than freeing the label is useful to allow a module that can otherwise work off of a series of MAC entry points + sysctls for configuration to free its per-jail configuration without having to bring in osd(9). One such example in the wild is HardenedBSD's secadm, but some of my own personal use had wanted it as well- it was simply overlooked in the final version because my first policy made more sense with labels. On that note, it's expected that prison_cleanup and prison_destroy_label will effectively be mutually exclusive -- the former only used when a label isn't needed, the latter when it is. Note that prison_cleanup isn't perfectly symmetrical w.r.t. prison_created: the latter takes a label as well, because it's called later in jail setup and a better point for propagation than when the label is created. As discussed with olce@, we may want to later revisit the notion that struct labels get passed around explicitly along with the referenced object and consider stripping them from all entry points in favor of an object -> label accessor or something. __FreeBSD_version bumped to force a rebuild of MAC policies. Reviewed by: olce Differential Revision: https://reviews.freebsd.org/D54833
* jail(3): fix common usage after mac.label supportKyle Evans2026-01-201-6/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Nobody else's mac.conf(5) has any entries for jails, so they get a trivial ENOENT and we fail before we can fetch any jail parameters. Most notably, this breaks `jls -s` / `jls -n` if you do not have any loaded policy that applies jail labels. Add an entry that works for everyone, and hardcode that as an ENOENT fallback in libjail to provide a smoother transition. This is probably not harmful to leave in long-term, since mac.conf(5) will override it. This unearthed one additional issue, in that mac_get_prison() in the MAC framework handled the no-label-policies bit wrong. We don't want to break jail utilities enumerating jail parameters automatically, so we must ingest the label in all cases -- we can still use it as a small optimization to avoid trying to copy out any label. We will break things if a non-optional element is specified in the copied in label, but that's expected. The APIs dedicated to jaildescs remain unphased, since they won't be used in the same way. Fixes: db3b39f063d9f05 ("libjail: extend struct handlers [...]") Fixes: bd55cbb50c58876 ("kern: add a mac.label jail parameter") Reported by: jlduran (on behalf of Jenkins) Reviewed by: jlduran Differential Revision: https://reviews.freebsd.org/D54786
* kern: add a mac.label jail parameterKyle Evans2026-01-162-0/+164
| | | | | | | | | Have it take a `struct mac` and we'll paper over the difference for jail(8)/jls(8) in libjail(3). The mac_syscalls.h model is taken from mac_set_proc_*() that were previously done. Reviewed by: olce Differential Revision: https://reviews.freebsd.org/D53958
* kern: mac: pull mac_label_copyin_string outKyle Evans2026-01-161-18/+30
| | | | | | | | | | | | A future commit to the area will further our jail integration and add a use for this: the struct mac itself was already copied in as part of vfs_buildopts(), so we only need to copyin the strings. We add an explicit flag argument because the jail operation will need to do it while holding the prison lock. Reviewed by: olce Differential Revision: https://reviews.freebsd.org/D53957
* mac_set_fd(3): add support for jail descriptorsKyle Evans2026-01-164-2/+78
| | | | | | | | | We'll still add an old-fashioned jail param to configure jail MAC labels, but for testing it's really easy to grab a jaildesc and use that. Reviewed by: jamie, olce Differential Revision: https://reviews.freebsd.org/D53956
* kern: mac: add various jail MAC hooksKyle Evans2026-01-163-0/+124
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This adds the following hooks: - mpo_prison_check_attach: check for subject capability to attach to a given jail - mpo_prison_check_create: check for subject capability to create a jail with the given option set - mpo_prison_check_get: check for subject capability to fetch the given parameters for a jail - mpo_prison_check_set: check for subject capability to set the given parameters for a jail - mpo_prison_check_remove: check for subject capability to remove the jail check_get wouldn't typically be a privileged operation, but is included to give MAC policies a wider range of capabilities at a relatively low cost. We also add two more for the purpose of label propagation: - mpo_prison_created: surface the creation of a jail so that one can do propagation to, e.g., the root vnode or any mounts - mpo_prison_attached: attach an existing process to the jail so that one can propagate the jail label to the process, as appropriate. It is unclear if this is preferred vs. having separate associate entry points for each type of object we might associate. That would split these up like so: - prison_created -> prison_associate_vnode - prison_attached -> prison_associate_proc Some sample policy ideas that should be feasible to implement with this set of hooks, in case it's inspiring: - mac_bomb: policy that allows a poudriere user to construct jails without root privilege, given a restricted set of jail parameters. Slap a warning label on it. - mac_capsule: policy that realizes the capsule idea that I pitched[0] on -jail@ to create jails that are effectively immutable once sealed, using these hooks and a label. Perhaps a silly idea, but a downstream could consider a scenario where it can implement special jail enumeration using a MAC policy and a cooperating application that specifies non-parameter options to filter the results. [0] https://lists.freebsd.org/archives/freebsd-jail/2025-September/000550.html Reviewed by: olce (slightly earlier version) Differential Revision: https://reviews.freebsd.org/D53954
* mac: add macros for 5-argument SDT probesKyle Evans2026-01-161-5/+13
| | | | | | | | | | A last-minute change to the jail MAC entry points in D53954 is going to pass the jail_[gs]et(2) flags to mac_prison_check_[gs]et() so that a policy can, e.g., reject or allow a change if the intent is to immediately attach, or disallow some fetching of dying jails. Reviewed by: markj Differential Revision: https://reviews.freebsd.org/D54658
* kern: mac: add a MAC label to struct prisonKyle Evans2026-01-165-0/+180
| | | | | Reviewed by: olce Differential Revision: https://reviews.freebsd.org/D53953
* MAC: Rename mac_cred_create_swapper to mac_cred_create_kproc0John Baldwin2025-12-043-5/+5
| | | | | | Reported by: markj Reviewed by: olce Differential Revision: https://reviews.freebsd.org/D54052
* MAC: Use the current thread's user ABI to determine the layout of struct macJohn Baldwin2025-11-242-28/+6
| | | | | | | | | | This removes mac_label_copyin32() as mac_label_copyin() can now handle both native and 32-bit struct mac objects. Reviewed by: olce, brooks Obtained from: CheriBSD Sponsored by: AFRL, DARPA Differential Revision: https://reviews.freebsd.org/D53755
* MAC: Use proper prototype for SYSINIT functionsZhenlei Huang2025-10-131-2/+2
| | | | MFC after: 1 week
* mac: Remove uses of DEBUG_VFS_LOCKSMark Johnston2025-08-032-2/+2
| | | | | | | | | We can assert that a vnode lock is held whenever INVARIANTS is configured. Reviewed by: kib MFC after: 2 weeks Differential Revision: https://reviews.freebsd.org/D51698
* New setcred() system call and associated MAC hooksOlivier Certner2024-12-163-2/+61
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This new system call allows to set all necessary credentials of a process in one go: Effective, real and saved UIDs, effective, real and saved GIDs, supplementary groups and the MAC label. Its advantage over standard credential-setting system calls (such as setuid(), seteuid(), etc.) is that it enables MAC modules, such as MAC/do, to restrict the set of credentials some process may gain in a fine-grained manner. Traditionally, credential changes rely on setuid binaries that call multiple credential system calls and in a specific order (setuid() must be last, so as to remain root for all other credential-setting calls, which would otherwise fail with insufficient privileges). This piecewise approach causes the process to transiently hold credentials that are neither the original nor the final ones. For the kernel to enforce that only certain transitions of credentials are allowed, either these possibly non-compliant transient states have to disappear (by setting all relevant attributes in one go), or the kernel must delay setting or checking the new credentials. Delaying setting credentials could be done, e.g., by having some mode where the standard system calls contribute to building new credentials but without committing them. It could be started and ended by a special system call. Delaying checking could mean that, e.g., the kernel only verifies the credentials transition at the next non-credential-setting system call (we just mention this possibility for completeness, but are certainly not endorsing it). We chose the simpler approach of a new system call, as we don't expect the set of credentials one can set to change often. It has the advantages that the traditional system calls' code doesn't have to be changed and that we can establish a special MAC protocol for it, by having some cleanup function called just before returning (this is a requirement for MAC/do), without disturbing the existing ones. The mac_cred_check_setcred() hook is passed the flags received by setcred() (including the version) and both the old and new kernel's 'struct ucred' instead of 'struct setcred' as this should simplify evolving existing hooks as the 'struct setcred' structure evolves. The mac_cred_setcred_enter() and mac_cred_setcred_exit() hooks are always called by pairs around potential calls to mac_cred_check_setcred(). They allow MAC modules to allocate/free data they may need in their mac_cred_check_setcred() hook, as the latter is called under the current process' lock, rendering sleepable allocations impossible. MAC/do is going to leverage these in a subsequent commit. A scheme where mac_cred_check_setcred() could return ERESTART was considered but is incompatible with proper composition of MAC modules. While here, add missing includes and declarations for standalone inclusion of <sys/ucred.h> both from kernel and userspace (for the latter, it has been working thanks to <bsm/audit.h> already including <sys/types.h>). Reviewed by: brooks Approved by: markj (mentor) Relnotes: yes Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D47618
* MAC: syscalls: mac_label_copyin(): 32-bit compatibilityOlivier Certner2024-12-162-6/+51
| | | | | | | | | | | Needed by the upcoming setcred() system call. More generally, is a step on the way to support 32-bit compatibility for MAC-related system calls. Reviewed by: brooks Approved by: markj (mentor) MFC after: 2 weeks Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D47878
* MAC: syscalls: Split mac_set_proc() into reusable piecesOlivier Certner2024-12-162-20/+128
| | | | | | | | | | | | This is in preparation for enabling the new setcred() system call to set a process' MAC label. No functional change (intended). MFC after: 2 weeks Approved by: markj (mentor) Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D46905
* MAC: syscalls: Factor out common label copy-in codeOlivier Certner2024-12-161-118/+83
| | | | | | | | | | Besides simplifying existing code, this will later enable the new setcred() system call to copy MAC labels. MFC after: 2 weeks Approved by: markj (mentor) Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D46904
* MAC: mac_policy.h: Declare common MAC sysctl and jail parameters' nodesOlivier Certner2024-12-162-7/+15
| | | | | | | | | | | | | | | | | | Do this only when the headers for these functionalities were included prior to this one. Indeed, if they need to be included, style(9) mandates they should have been so before this one. Remove the common MAC sysctl declaration from <security/mac/mac_internal.h>, as it is now redundant (all its includers also include <security/mac/mac_policy.h>). Remove local such declarations from all policies' files. Reviewed by: jamie Approved by: markj (mentor) MFC after: 5 days Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D46903
* MAC: Define a common 'mac' node for MAC's jail parametersOlivier Certner2024-12-161-0/+6
| | | | | | | | | | | To be used by MAC/do. Reviewed by: jamie Approved by: markj (mentor) MFC after: 5 days Relnotes: yes Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D46899
* MAC: 'kernel_mac_support' module: Make an outdated comment more genericOlivier Certner2024-12-161-1/+1
| | | | | | | | | | No functional change. Reviewed by: jamie Approved by: markj (mentor) MFC after: 5 days Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D46898
* MAC: improve handling of listening socketsMichael Tuexen2024-09-262-6/+14
| | | | | | | | | so_peerlabel can only be used when the socket is not listening. Reviewed by: markj MFC after: 1 week Sponsored by: Netflix, Inc. Differential Revision: https://reviews.freebsd.org/D46755
* MAC: improve consistency in error handlingMichael Tuexen2024-09-261-0/+1
| | | | | | | | | | Whenever mac_syncache_init() returns an error, ensure that *label = NULL. This simplifies the error handling by the caller. Reviewed by: rscheff MFC after: 1 week Sponsored by: Netflix, Inc. Differential Revision: https://reviews.freebsd.org/D46701
* sys: Automated cleanup of cdefs and other formattingWarner Losh2023-11-272-2/+0
| | | | | | | | | | | | | | | | Apply the following automated changes to try to eliminate no-longer-needed sys/cdefs.h includes as well as now-empty blank lines in a row. Remove /^#if.*\n#endif.*\n#include\s+<sys/cdefs.h>.*\n/ Remove /\n+#include\s+<sys/cdefs.h>.*\n+#if.*\n#endif.*\n+/ Remove /\n+#if.*\n#endif.*\n+/ Remove /^#if.*\n#endif.*\n/ Remove /\n+#include\s+<sys/cdefs.h>\n#include\s+<sys/types.h>/ Remove /\n+#include\s+<sys/cdefs.h>\n#include\s+<sys/param.h>/ Remove /\n+#include\s+<sys/cdefs.h>\n#include\s+<sys/capsicum.h>/ Sponsored by: Netflix
* Remove gratuitous copyouts of unchanged struct mac.Brooks Davis2023-11-134-9/+10
| | | | | | | | | | | | | The get operations change the data pointed to by the structure, but do not update the contents of the struct. Mark the struct mac arguments of mac_[gs]etsockopt_*label() and mac_check_structmac_consistent() const to prevent this from changing in the future. Reviewed by: markj MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D14488
* sys: Remove $FreeBSD$: one-line .c patternWarner Losh2023-08-1619-38/+0
| | | | Remove /^[\s*]*__FBSDID\("\$FreeBSD\$"\);?\s*\n/
* sys: Remove $FreeBSD$: two-line .h patternWarner Losh2023-08-163-6/+0
| | | | Remove /^\s*\*\n \*\s+\$FreeBSD\$$\n/
* mac_ipacl: new MAC policy module to limit jail/vnet IP configurationShivank Garg2023-07-264-0/+43
| | | | | | | | | | | | | The mac_ipacl policy module enables fine-grained control over IP address configuration within VNET jails from the base system. It allows the root user to define rules governing IP addresses for jails and their interfaces using the sysctl interface. Requested by: multiple Sponsored by: Google, Inc. (GSoC 2019) MFC after: 2 months Reviewed by: bz, dch (both earlier versions) Differential Revision: https://reviews.freebsd.org/D20967
* mac: Honor order when registering MAC modules.Steve Kiernan2023-04-181-22/+16
| | | | | | | | Ensure MAC modules are inserted in order that they are registered. Reviewed by: markj Obtained from: Juniper Networks, Inc. Differential Revision: https://reviews.freebsd.org/D39589
* kdb: Modify securelevel policyMark Johnston2023-03-302-0/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | Currently, sysctls which enable KDB in some way are flagged with CTLFLAG_SECURE, meaning that you can't modify them if securelevel > 0. This is so that KDB cannot be used to lower a running system's securelevel, see commit 3d7618d8bf0b7. However, the newer mac_ddb(4) restricts DDB operations which could be abused to lower securelevel while retaining some ability to gather useful debugging information. To enable the use of KDB (specifically, DDB) on systems with a raised securelevel, change the KDB sysctl policy: rather than relying on CTLFLAG_SECURE, add a check of the current securelevel to kdb_trap(). If the securelevel is raised, only pass control to the backend if MAC specifically grants access; otherwise simply check to see if mac_ddb vetoes the request, as before. Add a new secure sysctl, debug.kdb.enter_securelevel, to override this behaviour. That is, the sysctl lets one enter a KDB backend even with a raised securelevel, so long as it is set before the securelevel is raised. Reviewed by: mhorne, stevek MFC after: 1 month Sponsored by: Juniper Networks Sponsored by: Klara, Inc. Differential Revision: https://reviews.freebsd.org/D37122
* IfAPI: Add if_get/setmaclabel() and use it.Justin Hibbits2023-01-313-18/+18
| | | | | | | | | Summary: Port the MAC modules to use the IfAPI APIs as part of this. Sponsored by: Juniper Networks, Inc. Reviewed by: glebius Differential Revision: https://reviews.freebsd.org/D38197
* vfs: stop using NDFREEMateusz Guzik2022-12-191-3/+4
| | | | | | | It provides nothing but a branchfest and next to no consumers want it anyway. Tested by: pho
* Bump MAC_VERSION to 5Allan Jude2022-10-071-1/+2
| | | | | | | | 2449b9e5fe565be757a4b29093fd1c9c6ffcf3c9 introduced API changes that require ensuring that loadable MAC modules use the matching API. Sponsored by: Juniper Networks, Inc. Sponsored by: Klara, Inc.
* vfs: introduce V_PCATCH to stop abusing PCATCHMateusz Guzik2022-09-171-2/+2
|
* protosw: refactor protosw and domain static declaration and loadGleb Smirnoff2022-08-171-2/+2
| | | | | | | | | | | | | | | | | | | o Assert that every protosw has pr_attach. Now this structure is only for socket protocols declarations and nothing else. o Merge struct pr_usrreqs into struct protosw. This was suggested in 1996 by wollman@ (see 7b187005d18ef), and later reiterated in 2006 by rwatson@ (see 6fbb9cf860dcd). o Make struct domain hold a variable sized array of protosw pointers. For most protocols these pointers are initialized statically. Those domains that may have loadable protocols have spacers. IPv4 and IPv6 have 8 spacers each (andre@ dff3237ee54ea). o For inetsw and inet6sw leave a comment noting that many protosw entries very likely are dead code. o Refactor pf_proto_[un]register() into protosw_[un]register(). o Isolate pr_*_notsupp() methods into uipc_domain.c Reviewed by: melifaro Differential revision: https://reviews.freebsd.org/D36232
* mac: cheaper check for mac_pipe_check_readMateusz Guzik2022-08-173-2/+20
| | | | | Reviewed by: markj Differential Revision: https://reviews.freebsd.org/D36082
* mac: s/0/false/ in macros denoting probe enablementMateusz Guzik2022-08-111-14/+14
| | | | No functional changes.
* mac: kdb/ddb framework hooksMitchell Horne2022-07-183-0/+96
| | | | | | | | | | | | | | | | Add three simple hooks to the debugger allowing for a loaded MAC policy to intervene if desired: 1. Before invoking the kdb backend 2. Before ddb command registration 3. Before ddb command execution We extend struct db_command with a private pointer and two flag bits reserved for policy use. Reviewed by: markj Sponsored by: Juniper Networks, Inc. Sponsored by: Klara, Inc. Differential Revision: https://reviews.freebsd.org/D35370
* sysent: Get rid of bogus sys/sysent.h include.Dmitry Chagin2022-05-281-1/+0
| | | | | | Where appropriate hide sysent.h under proper condition. MFC after: 2 weeks
* vfs: remove the unused thread argument from NDINIT*Mateusz Guzik2021-11-251-2/+2
| | | | | | See b4a58fbf640409a1 ("vfs: remove cn_thread") Bump __FreeBSD_version to 1400043.
* mac: cheaper check for ifnet_create_mbuf and ifnet_check_transmitMateusz Guzik2021-06-293-10/+40
| | | | Sponsored by: Rubicon Communications, LLC ("Netgate")
* tcp_input/syncache: acquire only read lock on PCB for SYN,!ACK packetsGleb Smirnoff2021-04-121-1/+1
| | | | | | | | | | | | | | | | | | When packet is a SYN packet, we don't need to modify any existing PCB. Normally SYN arrives on a listening socket, we either create a syncache entry or generate syncookie, but we don't modify anything with the listening socket or associated PCB. Thus create a new PCB lookup mode - rlock if listening. This removes the primary contention point under SYN flood - the listening socket PCB. Sidenote: when SYN arrives on a synchronized connection, we still don't need write access to PCB to send a challenge ACK or just to drop. There is only one exclusion - tcptw recycling. However, existing entanglement of tcp_input + stacks doesn't allow to make this change small. Consider this patch as first approach to the problem. Reviewed by: rrs Differential revision: https://reviews.freebsd.org/D29576
* Add a comment on why the call to mac_vnode_relabel() might be in the wrongRobert Watson2021-02-271-3/+12
| | | | | | place -- in the VOP rather than vn_setexttr() -- and that it is for historic reasons. We might wish to relocate it in due course, but this way at least we document the asymmetry.
* Convert remaining cap_rights_init users to cap_rights_init_oneMateusz Guzik2021-01-121-2/+4
| | | | | | | | | | | | | semantic patch: @@ expression rights, r; @@ - cap_rights_init(&rights, r) + cap_rights_init_one(&rights, r)
* mac: cheaper check for mac_vnode_check_readlinkMateusz Guzik2021-01-083-2/+20
|
* cache: combine fast path enabled status into one flagMateusz Guzik2021-01-061-0/+3
| | | | Tested by: pho
* pipe: allow for lockless pipe_statMateusz Guzik2020-11-193-3/+30
| | | | | | | | | | | | | | | | | | pipes get stated all thet time and this avoidably contributed to contention. The pipe lock is only held to accomodate MAC and to check the type. Since normally there is no probe for pipe stat depessimize this by having the flag. The pipe_state field gets modified with locks held all the time and it's not feasible to convert them to use atomic store. Move the type flag away to a separate variable as a simple cleanup and to provide stable field to read. Use short for both fields to avoid growing the struct. While here short-circuit MAC for pipe_poll as well. Notes: svn path=/head/; revision=367833
* mac_framework.h: fix build with DEBUG_VFS_LOCKS and !MACAndriy Gapon2020-09-031-1/+1
| | | | | | | | | | | | | | | I have such a custom kernel configuration and its build failed with: linking kernel.full ld: error: undefined symbol: mac_vnode_assert_locked >>> referenced by mac_framework.h:556 (/usr/devel/git/apu2c4/sys/security/mac/mac_framework.h:556) >>> tmpfs_vnops.o:(mac_vnode_check_stat) >>> referenced by mac_framework.h:556 (/usr/devel/git/apu2c4/sys/security/mac/mac_framework.h:556) >>> vfs_default.o:(mac_vnode_check_stat) >>> referenced by mac_framework.h:556 (/usr/devel/git/apu2c4/sys/security/mac/mac_framework.h:556) >>> ufs_vnops.o:(mac_vnode_check_stat) Notes: svn path=/head/; revision=365308
* security: clean up empty lines in .c and .h filesMateusz Guzik2020-09-013-3/+1
| | | | Notes: svn path=/head/; revision=365083
* mac: even up all entry points to the same schemeMateusz Guzik2020-08-061-7/+38
| | | | | | | | - use a macro for checking whether the site is enabled - expand it to 0 if mac is not compiled in to begin with Notes: svn path=/head/; revision=363935
* vfs: add a cheaper entry for mac_vnode_check_accessMateusz Guzik2020-08-053-2/+17
| | | | Notes: svn path=/head/; revision=363886
* Fix tinderbox build after r363714Mateusz Guzik2020-07-301-0/+8
| | | | Notes: svn path=/head/; revision=363716
generated by cgit v1.3 (git 2.53.0) at 2026-03-13 05:11:40 +0000