aboutsummaryrefslogtreecommitdiff
path: root/sys/security
Commit message (Collapse)AuthorAgeFilesLines
* Rework the logic around quick checks for auditing that take place atRobert Watson2018-10-026-44/+103
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | system-call entry and whenever audit arguments or return values are captured: 1. Expose a single global, audit_syscalls_enabled, which controls whether the audit framework is entered, rather than exposing components of the policy -- e.g., if the trail is enabled, suspended, etc. 2. Introduce a new function audit_syscalls_enabled_update(), which is called to update audit_syscalls_enabled whenever an aspect of the policy changes, so that the value can be updated. 3. Remove a check of trail enablement/suspension from audit_new() -- at the point where this function has been entered, we believe that system-call auditing is already in force, or we wouldn't get here, so simply proceed to more expensive policy checks. 4. Use an audit-provided global, audit_dtrace_enabled, rather than a dtaudit-provided global, to provide policy indicating whether dtaudit would like system calls to be audited. 5. Do some minor cosmetic renaming to clarify what various variables are for. These changes collectively arrange it so that traditional audit (trail, pipes) or the DTrace audit provider can enable system-call probes without the other configured. Otherwise, dtaudit cannot capture system-call data without auditd(8) started. Reviewed by: gnn Sponsored by: DARPA, AFRL Approved by: re (gjb) Differential Revision: https://reviews.freebsd.org/D17348 Notes: svn path=/head/; revision=339085
* The kernel DTrace audit provider (dtaudit) relies on auditd(8) to loadRobert Watson2018-09-031-8/+83
| | | | | | | | | | | | | | | | | | | | /etc/security/audit_event to provide a list of audit event-number <-> name mappings. However, this occurs too late for anonymous tracing. With this change, adding 'audit_event_load="YES"' to /boot/loader.conf will cause the boot loader to preload the file, and then the kernel audit code will parse it to register an initial set of audit event-number <-> name mappings. Those mappings can later be updated by auditd(8) if the configuration file changes. Reviewed by: gnn, asomers, markj, allanjude Discussed with: jhb Approved by: re (kib) MFC after: 1 week Sponsored by: DARPA, AFRL Differential Revision: https://reviews.freebsd.org/D16589 Notes: svn path=/head/; revision=338443
* Require that MAC label buffers be able to store a non-empty string.Mark Johnston2018-08-011-1/+3
| | | | | | | | | | | | | | | The buffer size may be used to initialize an sbuf in MAC_POLICY_EXTERNALIZE, and without this constraint it's possible to trigger an assertion failure in the sbuf code. With INVARIANTS disabled, the first attempt to write to the sbuf will fail. Reported by: pho Reviewed by: delphij MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D16527 Notes: svn path=/head/; revision=337031
* fix incorrect operator in the AUDITPIPE_SET_QLIMIT bounds checkAndriy Gapon2018-07-231-1/+1
| | | | | | | | | | PR: 229983 Submitted by: Aniket Pandey <aniketp@iitk.ac.in> Reported by: Aniket Pandey <aniketp@iitk.ac.in> MFC after: 1 week Notes: svn path=/head/; revision=336641
* Fix audit of chflagsat, lgetfh, and setfibAlan Somers2018-07-221-0/+3
| | | | | | | | | | | | | | These syscalls were always supposed to have been auditted, but due to oversights never were. PR: 228374 Reported by: aniketp Reviewed by: aniketp MFC after: 2 weeks Differential Revision: https://reviews.freebsd.org/D16388 Notes: svn path=/head/; revision=336604
* Make it possible to run ntpd as a non-root user, add ntpd uid and gid.Ian Lepore2018-07-191-0/+77
| | | | | | | | | | | | | | | | | | | | | | | | Code analysis and runtime analysis using truss(8) indicate that the only privileged operations performed by ntpd are adjusting system time, and (re-)binding to privileged UDP port 123. These changes add a new mac(4) policy module, mac_ntpd(4), which grants just those privileges to any process running with uid 123. This also adds a new user and group, ntpd:ntpd, (uid:gid 123:123), and makes them the owner of the /var/db/ntp directory, so that it can be used as a location where the non-privileged daemon can write files such as the driftfile, and any optional logfile or stats files. Because there are so many ways to configure ntpd, the question of how to configure it to run without root privs can be a bit complex, so that will be addressed in a separate commit. These changes are just what's required to grant the limited subset of privs to ntpd, and the small change to ntpd to prevent it from exiting with an error if running as non-root. Differential Revision: https://reviews.freebsd.org/D16281 Notes: svn path=/head/; revision=336525
* auditon(2): fix A_SETPOLICY with 64-bit valuesAlan Somers2018-07-151-1/+1
| | | | | | | | | | | | | | A_SETPOLICY is supposed to work with either 64 or 32-bit values, but due to a typo the 64-bit version has never worked correctly. Submitted by: aniketp Reviewed by: asomers, cem MFC after: 2 weeks Sponsored by: Google, Inc. (GSoC 2018) Differential Revision: https://reviews.freebsd.org/D16222 Notes: svn path=/head/; revision=336319
* Add mpo_vnode_check_setmode MAC method to MAC/veriexec.Stephen J. Kiernan2018-07-141-0/+33
| | | | | | | | | In the method, disallow changing SUID/SGID on verified files. Obtained from: Juniper Networks, Inc. Notes: svn path=/head/; revision=336289
* Fix a typo which could cause a build breakage when building with MAC/veriexecStephen J. Kiernan2018-07-142-2/+1
| | | | | | | | | enabled in the kernel config. Remove unused mac_veriexec_print_db prototype in internal header file. Notes: svn path=/head/; revision=336286
* Remove RIPEMD-160 fingerprint modules for veriexec, since it has veryStephen J. Kiernan2018-07-141-45/+0
| | | | | | | | | | little practical use and would not be recommended for anyone to use in a production environment. Reviewed by: sjg Notes: svn path=/head/; revision=336284
* Fix build breakage in veriexec for 32-bit architectures.Stephen J. Kiernan2018-06-202-23/+28
| | | | | | | | | | | fsid_t and ino_t are 64-bit entities, use uintmax_t typecast to ensure we can print it on 32-bit or 64-bit architectures by using the %ju format for prints. Obtained from: Juniper Networks, Inc. Notes: svn path=/head/; revision=335430
* MAC/veriexec implements a verified execution environment using the MACStephen J. Kiernan2018-06-2010-0/+2454
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | framework. The code is organized into a few distinct pieces: * The meta-data store (in veriexec_metadata.c) which maps a file system identifier, file identifier, and generation key tuple to veriexec meta-data record. * Fingerprint management (in veriexec_fingerprint.c) which deals with calculating the cryptographic hash for a file and verifying it. It also manages the loadable fingerprint modules. * MAC policy implementation (in mac_veriexec.c) which implements the following MAC methods: mpo_init Initializes the veriexec state, meta-data store, fingerprint modules, and registers mount and unmount EVENTHANDLERs mpo_syscall Implements the following per-policy system calls: MAC_VERIEXEC_CHECK_FD_SYSCALL Check a file descriptor to see if the referenced file has a valid fingerprint. MAC_VERIEXEC_CHECK_PATH_SYSCALL Check a path to see if the referenced file has a valid fingerprint. mpo_kld_check_load Check if loading a kld is allowed. This checks if the referenced vnode has a valid fingerprint. mpo_mount_destroy_label Clears the veriexec slot data in a mount point label. mpo_mount_init_label Initializes the veriexec slot data in a mount point label. The file system identifier is saved in the veriexec slot data. mpo_priv_check Check if a process is allowed to write to /dev/kmem and /dev/mem devices. If a process is flagged as trusted, it is allowed to write. mpo_proc_check_debug Check if a process is allowed to be debugged. If a process is not flagged with VERIEXEC_NOTRACE, then debugging is allowed. mpo_vnode_check_exec Check is an exectuable is allowed to run. If veriexec is not enforcing or the executable has a valid fingerprint, then it is allowed to run. NOTE: veriexec will complain about mismatched fingerprints if it is active, regardless of the state of the enforcement. mpo_vnode_check_open Check is a file is allowed to be opened. If verification was not requested, veriexec is not enforcing, or the file has a valid fingerprint, then veriexec will allow the file to be opened. mpo_vnode_copy_label Copies the veriexec slot data from one label to another. mpo_vnode_destroy_label Clears the veriexec slot data in a vnode label. mpo_vnode_init_label Initializes the veriexec slot data in a vnode label. The fingerprint status for the file is stored in the veriexec slot data. * Some sysctls, under security.mac.veriexec, for setting debug level, fetching the current state in a human-readable form, and dumping the fingerprint database are implemented. * The MAC policy implementation source file also contains some utility functions. * A set of fingerprint modules for the following cryptographic hash algorithms: RIPEMD-160, SHA1, SHA2-256, SHA2-384, SHA2-512 * Loadable module builds for MAC/veriexec and fingerprint modules. WARNING: Using veriexec with NFS (or other network-based) file systems is not recommended as one cannot guarantee the integrity of the files served, nor the uniqueness of file system identifiers which are used as key in the meta-data store. Reviewed by: ian, jtl Obtained from: Juniper Networks, Inc. Differential Revision: https://reviews.freebsd.org/D8554 Notes: svn path=/head/; revision=335399
* audit(4): fix the definition of ARG_TERMID_ADDRAlan Somers2018-06-131-1/+1
| | | | | | | | | | | | | | | | | Due to a copy/paste error in r168688, ARG_TERMID_ADDR has the same definition as ARG_SADDRUNIX. Fix it. The header change, while publicly visible, is guarded by #ifdef KERNEL, and I can't find any kmod ports that use it. So I'm not bumping __FreeBSD_version. PR: 228820 Submitted by: aniketp Sponsored by: Google, Inc. (GSoC 2018) Differential Revision: https://reviews.freebsd.org/D15702 Notes: svn path=/head/; revision=335060
* #include <bsm/audit.h> in security/audit/audit_ioctl.hAlan Somers2018-05-301-0/+2
| | | | | | | | | | | | | | | security/audit/audit_ioctl.h uses a type from bsm/audit.h, so needs to include it. And it needs to know the type's size, so it can't just forward-declare. PR: 228470 Submitted by: aniketp MFC after: 2 weeks Sponsored by: Google, Inc. (GSoC 2018) Differential Revision: https://reviews.freebsd.org/D15561 Notes: svn path=/head/; revision=334403
* Fix "Bad tailq" panic when auditing auditon(A_SETCLASS, ...)Alan Somers2018-05-281-1/+0
| | | | | | | | | | | | Due to an oversight in r195280, auditon(A_SETCLASS, ...) would cause a tailq element to get added to the tailq twice, resulting in a circular tailq. This panics when INVARIANTS are on. MFC after: 2 weeks Differential Revision: https://reviews.freebsd.org/D15381 Notes: svn path=/head/; revision=334296
* Use an accessor function to access ifr_data.Brooks Davis2018-03-301-2/+2
| | | | | | | | | | | | | | | | This fixes 32-bit compat (no ioctl command defintions are required as struct ifreq is the same size). This is believed to be sufficent to fully support ifconfig on 32-bit systems. Reviewed by: kib Obtained from: CheriBSD MFC after: 1 week Relnotes: yes Sponsored by: DARPA, AFRL Differential Revision: https://reviews.freebsd.org/D14900 Notes: svn path=/head/; revision=331797
* audit(4): fix a typo in a commentAlan Somers2018-03-171-1/+1
| | | | | | | no functional change Notes: svn path=/head/; revision=331105
* mac_portacl(4): stop panicing INVARIANTS-enabled kernel by loading .koEugene Grosbein2018-02-251-0/+1
| | | | | | | | | | | when kernel already has options MAC_PORTACL. PR: 183817 Approved by: avg (mentor) MFC after: 1 week Notes: svn path=/head/; revision=329994
* Reduce duplication in __mac_*_(file|link)(2) implementation.Brooks Davis2018-02-151-97/+27
| | | | | | | | | | Reviewed by: rwatson Obtained from: CheriBSD Sponsored by: DARPA, AFRL Differential Revision: https://reviews.freebsd.org/D14175 Notes: svn path=/head/; revision=329336
* Do pass removing some write-only variables from the kernel.Alexander Kabaev2017-12-251-2/+0
| | | | | | | | | | | | This reduces noise when kernel is compiled by newer GCC versions, such as one used by external toolchain ports. Reviewed by: kib, andrew(sys/arm and sys/arm64), emaste(partial), erj(partial) Reviewed by: jhb (sys/dev/pci/* sys/kern/vfs_aio.c and sys/kern/kern_synch.c) Differential Revision: https://reviews.freebsd.org/D10385 Notes: svn path=/head/; revision=327173
* sys: further adoption of SPDX licensing ID tags.Pedro F. Giffuni2017-11-2013-1/+27
| | | | | | | | | | | | | | | | | Mainly focus on files that use BSD 3-Clause license. The Software Package Data Exchange (SPDX) group provides a specification to make it easier for automated tools to detect and summarize well known opensource licenses. We are gradually adopting the specification, noting that the tags are considered only advisory and do not, in any way, superceed or replace the license texts. Special thanks to Wind River for providing access to "The Duke of Highlander" tool: an older (2014) run over FreeBSD tree was useful as a starting point. Notes: svn path=/head/; revision=326023
* Sprinkle __read_frequently on few obvious places.Mateusz Guzik2017-09-061-1/+1
| | | | | | | | Note that some of annotated variables should probably change their types to something smaller, preferably bit-sized. Notes: svn path=/head/; revision=323236
* Correct bitwise test in mac_bsdextended ugidfw_rule_valid()Ed Maste2017-06-131-1/+1
| | | | | | | | | | | | | PR: 218039 CID: 1008934 Reported by: Coverity, PVS-Studio Reviewed by: kib MFC after: 1 week Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D10300 Notes: svn path=/head/; revision=319890
* Commit the 64-bit inode project.Konstantin Belousov2017-05-231-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Extend the ino_t, dev_t, nlink_t types to 64-bit ints. Modify struct dirent layout to add d_off, increase the size of d_fileno to 64-bits, increase the size of d_namlen to 16-bits, and change the required alignment. Increase struct statfs f_mntfromname[] and f_mntonname[] array length MNAMELEN to 1024. ABI breakage is mitigated by providing compatibility using versioned symbols, ingenious use of the existing padding in structures, and by employing other tricks. Unfortunately, not everything can be fixed, especially outside the base system. For instance, third-party APIs which pass struct stat around are broken in backward and forward incompatible ways. Kinfo sysctl MIBs ABI is changed in backward-compatible way, but there is no general mechanism to handle other sysctl MIBS which return structures where the layout has changed. It was considered that the breakage is either in the management interfaces, where we usually allow ABI slip, or is not important. Struct xvnode changed layout, no compat shims are provided. For struct xtty, dev_t tty device member was reduced to uint32_t. It was decided that keeping ABI compat in this case is more useful than reporting 64-bit dev_t, for the sake of pstat. Update note: strictly follow the instructions in UPDATING. Build and install the new kernel with COMPAT_FREEBSD11 option enabled, then reboot, and only then install new world. Credits: The 64-bit inode project, also known as ino64, started life many years ago as a project by Gleb Kurtsou (gleb). Kirk McKusick (mckusick) then picked up and updated the patch, and acted as a flag-waver. Feedback, suggestions, and discussions were carried by Ed Maste (emaste), John Baldwin (jhb), Jilles Tjoelker (jilles), and Rick Macklem (rmacklem). Kris Moore (kris) performed an initial ports investigation followed by an exp-run by Antoine Brodin (antoine). Essential and all-embracing testing was done by Peter Holm (pho). The heavy lifting of coordinating all these efforts and bringing the project to completion were done by Konstantin Belousov (kib). Sponsored by: The FreeBSD Foundation (emaste, kib) Differential revision: https://reviews.freebsd.org/D10439 Notes: svn path=/head/; revision=318736
* Break audit_bsm_klib.c into two files: one (audit_bsm_klib.c)Robert Watson2017-04-032-271/+330
| | | | | | | | | | | | | | | | retaining various utility functions used during BSM generation, and a second (audit_bsm_db.c) that contains the various in-kernel databases supporting various audit activities (the class and event-name tables). (No functional change is intended.) Obtained from: TrustedBSD Project MFC after: 3 weeks Sponsored by: DARPA, AFRL Notes: svn path=/head/; revision=316450
* Correct macro names and signatures for !AUDIT versions of canonicalRobert Watson2017-03-311-2/+2
| | | | | | | | | | | path auditing. Obtained from: TrustedBSD Project MFC after: 3 weeks Sponsored by: DARPA, AFRL Notes: svn path=/head/; revision=316333
* Audit arguments to POSIX message queues, semaphores, and shared memory.Robert Watson2017-03-312-0/+56
| | | | | | | | | | | | | | This requires minor changes to the audit framework to allow capturing paths that are not filesystem paths (i.e., will not be canonicalised relative to the process current working directory and/or filesystem root). Obtained from: TrustedBSD Project MFC after: 3 weeks Sponsored by: DARPA, AFRL Notes: svn path=/head/; revision=316332
* Audit arguments to System V IPC system calls implementing sempahores,Robert Watson2017-03-301-0/+30
| | | | | | | | | | | message queues, and shared memory. Obtained from: TrustedBSD Project MFC after: 3 weeks Sponsored by: DARPA, AFRL Notes: svn path=/head/; revision=316308
* Various BSM generation improvements when auditing AUE_ACCEPT,Robert Watson2017-03-301-6/+68
| | | | | | | | | | | | | | AUE_PROCCTL, AUE_SENDFILE, AUE_ACL_*, and AUE_POSIX_FALLOCATE. Audit AUE_SHMUNLINK path in the path token rather than as a text string, and AUE_SHMOPEN flags as an integer token rather than a System V IPC address token. Obtained from: TrustedBSD Project MFC after: 3 weeks Sponsored by: DARPA, AFRL Notes: svn path=/head/; revision=316305
* Don't ifdef KDTRACE_HOOKS struct, variable, and function prototypeRobert Watson2017-03-301-8/+0
| | | | | | | | | | | | | | | definitions for the DTrace audit provider, so that the dtaudit module can compile in the absence of kernel DTrace support. This doesn't really make run-time sense (since the binary dependencies for the module won't be present), but it allows the dtaudit module to compile successfully regardless of the kernel configuration. MFC after: 3 weeks Sponsored by: DARPA, AFRL Reported by: kib Notes: svn path=/head/; revision=316271
* When handling msgsys(2), semsys(2), and shmsys(2) multiplex system calls,Robert Watson2017-03-295-3/+118
| | | | | | | | | | | | map the 'which' argument into a suitable audit event identifier for the specific operation requested. Obtained from: TrustedBSD Project MFC after: 3 weeks Sponsored by: DARPA, AFRL Notes: svn path=/head/; revision=316185
* Add an experimental DTrace audit provider, which allows users of DTrace toRobert Watson2017-03-295-15/+700
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | instrument security event auditing rather than relying on conventional BSM trail files or audit pipes: - Add a set of per-event 'commit' probes, which provide access to particular auditable events at the time of commit in system-call return. These probes gain access to audit data via the in-kernel audit_record data structure, providing convenient access to system-call arguments and return values in a single probe. - Add a set of per-event 'bsm' probes, which provide access to particular auditable events at the time of BSM record generation in the audit worker thread. These probes have access to the in-kernel audit_record data structure and BSM representation as would be written to a trail file or audit pipe -- i.e., asynchronously in the audit worker thread. DTrace probe arguments consist of the name of the audit event (to support future mechanisms of instrumenting multiple events via a single probe -- e.g., using classes), a pointer to the in-kernel audit record, and an optional pointer to the BSM data and its length. For human convenience, upper-case audit event names (AUE_...) are converted to lower case in DTrace. DTrace scripts can now cause additional audit-based data to be collected on system calls, and inspect internal and BSM representations of the data. They do not affect data captured in the audit trail or audit pipes configured in the system. auditd(8) must be configured and running in order to provide a database of event information, as well as other audit configuration parameters (e.g., to capture command-line arguments or environmental variables) for the provider to operate. Reviewed by: gnn, jonathan, markj Sponsored by: DARPA, AFRL MFC after: 3 weeks Differential Revision: https://reviews.freebsd.org/D10149 Notes: svn path=/head/; revision=316176
* Introduce an audit event identifier -> audit event name mappingRobert Watson2017-03-274-1/+216
| | | | | | | | | | | | | | | | | | database in the kernel audit implementation, similar the exist class mapping database. This will be used by the DTrace audit provider to map audit event identifiers originating in the system-call table back into strings for the purposes of setting probe names. The database is initialised and maintained by auditd(8), which reads values in from the audit_events configuration file, and then manages them using the A_GETEVENT and A_SETEVENT auditon(2) operations. Obtained from: TrustedBSD Project Sponsored by: DARPA, AFRL MFC after: 3 weeks Notes: svn path=/head/; revision=316018
* Extend comment describing path canonicalisation in audit.Robert Watson2017-03-271-1/+2
| | | | | | | | | Sponsored by: DARPA, AFRL Obtained from: TrustedBSD Project MFC after: 3 days Notes: svn path=/head/; revision=316015
* Audit 'fd' and 'cmd' arguments to fcntl(2), and when generating BSM,Robert Watson2016-11-221-4/+1
| | | | | | | | | | | | always audit the file-descriptor number and vnode information for all fnctl(2) commands, not just locking-related ones. This was likely an oversight in the original adaptation of this code from XNU. MFC after: 3 days Sponsored by: DARPA, AFRL Notes: svn path=/head/; revision=308947
* Fix improper use of "its".Bryan Drewery2016-11-081-1/+1
| | | | | | | Sponsored by: Dell EMC Isilon Notes: svn path=/head/; revision=308457
* Don't check aq64_minfree which is unsigned for negative values.John Baldwin2016-09-081-2/+2
| | | | | | | | | | This fixes a tautological comparison warning. Reviewed by: rwatson Differential Revision: https://reviews.freebsd.org/D7682 Notes: svn path=/head/; revision=305625
* Audit the accepted (or rejected) username argument to setlogin(2).Robert Watson2016-08-202-2/+8
| | | | | | | | | | | | | (NB: This was likely a mismerge from XNU in audit support, where the text argument to setlogin(2) is captured -- but as a text token, whereas this change uses the dedicated login-name field in struct audit_record.) MFC after: 2 weeks Sponsored by: DARPA, AFRL Notes: svn path=/head/; revision=304544
* Add AUE_WAIT6 handling to the BSM conversion switch statement, reusingRobert Watson2016-07-111-0/+1
| | | | | | | | | | the BSM encoding used for AUE_WAIT4. MFC after: 3 days Sponsored by: DARPA, AFRL Notes: svn path=/head/; revision=302564
* Implement AUE_PREAD and AUE_PWRITE BSM conversion support, eliminatingRobert Watson2016-06-131-0/+2
| | | | | | | | | | | | | console warnings when pread(2) and pwrite(2) are used with full system-call auditing enabled. We audit the same file-descriptor data for these calls as we do read(2) and write(2). Approved by: re (kib) MFC after: 3 days Sponsored by: DARPA, AFRL Notes: svn path=/head/; revision=301867
* sys/security: minor spelling fixes.Pedro F. Giffuni2016-05-067-7/+7
| | | | | | | No functional change. Notes: svn path=/head/; revision=299187
* sys: use our nitems() macro when param.h is available.Pedro F. Giffuni2016-04-212-4/+2
| | | | | | | | | This should cover all the remaining cases in the kernel. Discussed in: freebsd-current Notes: svn path=/head/; revision=298431
* Remove slightly used const values that can be replaced with nitems().Pedro F. Giffuni2016-04-212-7/+4
| | | | | | | Suggested by: jhb Notes: svn path=/head/; revision=298411
* audit(8): leave unsigned comparison for last.Pedro F. Giffuni2016-04-081-2/+2
| | | | | | | | | | | | | aq64_minfree is unsigned so comparing to find out if it is less than zero is a nonsense. Move the comparison to the last position as we don't want to spend time if any of the others triggers first. hile it would be tempting to just remove it, it may be important to keep it for portability with platforms where may be signed(?) or in case we may want to change it in the future. Notes: svn path=/head/; revision=297694
* Busy the mount point which is the owner of the audit vnode, aroundKonstantin Belousov2016-01-161-15/+45
| | | | | | | | | | | | | | | | | | | audit_record_write(). This is important so that VFS_STATFS() is not done on the NULL or freed mp and the check for free space is consistent with the vnode used for write. Add vn_start_write() braces around VOP_FSYNC() calls on the audit vnode. Move repeated code to fsync vnode and panic to the helper audit_worker_sync_vp(). Reviewed by: rwatson Tested by: pho Sponsored by: The FreeBSD Foundation MFC after: 1 week Notes: svn path=/head/; revision=294137
* Move the funsetown(9) call from audit_pipe_close() to cdevprivKonstantin Belousov2016-01-131-25/+4
| | | | | | | | | | | | | | | | | | | destructor. As result, close method becomes trivial and removed. Final cdevsw close method might be called without file context (e.g. in vn_open_vnode() if the vnode is reclaimed meantime), which leaves ap_sigio registered for notification, despite cdevpriv destructor frees the memory later. Call destructor instead of doing a cleanup inline, for devfs_set_cdevpriv() failure in open. This adds missed funsetown(9) call and locks ap to satisfy audit_pipe_free() invariants. Reported and tested by: pho (previous version) Sponsored by: The FreeBSD Foundation MFC after: 1 week Notes: svn path=/head/; revision=293826
* Merge from contrib/openbsm to bring the kernel audit bits up to date with ↵Christian Brueffer2015-12-205-10/+0
| | | | | | | | | | OpenBSM 1.2 alpha 4: - remove $P4$ - fix a comment Notes: svn path=/head/; revision=292522
* Fix style issues around existing SDT probes.Mark Johnston2015-12-162-22/+22
| | | | | | | | | | | | - Use SDT_PROBE<N>() instead of SDT_PROBE(). This has no functional effect at the moment, but will be needed for some future changes. - Don't hardcode the module component of the probe identifier. This is set automatically by the SDT framework. MFC after: 1 week Notes: svn path=/head/; revision=292384
* fd: make 'rights' a manadatory argument to fget* functionsMateusz Guzik2015-07-051-1/+3
| | | | Notes: svn path=/head/; revision=285172
* Replace struct filedesc argument in getvnode with struct threadMateusz Guzik2015-06-161-1/+1
| | | | | | | This is is a step towards removal of spurious arguments. Notes: svn path=/head/; revision=284446
generated by cgit v1.3 (git 2.53.0) at 2026-04-17 21:29:17 +0000