summaryrefslogtreecommitdiff
path: root/sys/secmodel/suser
AgeCommit message (Collapse)Author
2020-09-08Add IP_BINDANY, IPV6_BINDANY which can be used to bind to any address inchristos
order to implement transparent proxies.
2020-05-16Make it clear that only KAUTH_MACHDEP_SVS_DISABLE is deprecated.alnsn
2020-05-11KAUTH_MACHDEP_SVS_DISABLE is deprecated.alnsn
sysctl machdep.svs.enabled can't be changed anymore at runtime because it's now a boot option.
2020-03-16Use the module subsystem's ability to process SYSCTL_SETUP() entries topgoyette
automate installation of sysctl nodes. Note that there are still a number of device and pseudo-device modules that create entries tied to individual device units, rather than to the module itself. These are not changed.
2020-02-21Explicitly cast pointers to uintptr_t before casting to enums. They arejoerg
not necessarily the same size. Don't cast pointers to bool, check for NULL instead.
2019-04-10Add the NVMM_CTL ioctl, always privileged regardless of the permissions ofmaxv
/dev/nvmm. We'll use it to provide a way for an admin to control the registered VMs in the kernel. Add an associated wrapper in libnvmm.
2018-10-05Provide a sysctl kern.expose_address to expose kernel addresses inchristos
sysctl structure returns for non-root. Defaults to off. Turning it on will restore sockstat/fstat and friends for regular users.
2018-09-04Introduce KAUTH_REQ_PROCESS_CANSEE_KPTR, and use it in the already-existingmaxv
modstat code. No real functional change.
2018-08-25Add KAUTH_REQ_PROCESS_CANSEE_EPROC, and use it for the kern.proc node.maxv
Same permission as before, so no functional change.
2018-07-15Retire ipkdb entirely. The option was removed from the config filesmaxv
yesterday. ok kamil christos
2018-07-13Remove KAUTH_MACHDEP_X86PMC, now unused.maxv
2018-04-26Add KAUTH_MACHDEP_SVS_DISABLE and add support to secmodel_securelevel(9).alnsn
Disabling SVS is denied at securelevel 1 and above.
2017-06-14Make the PMC syscalls privileged.maxv
2015-08-17Add kernel code to support intrctl(8).knakahara
2014-02-25Ensure that the top level sysctl nodes (kern, vfs, net, ...) exist beforepooka
the sysctl link sets are processed, and remove redundancy. Shaves >13kB off of an amd64 GENERIC, not to mention >1k duplicate lines of code.
2012-11-13kill some -Wunused-but-set-variable warningspooka
2012-03-13Replace the remaining KAUTH_GENERIC_ISSUSER authorization calls withelad
something meaningful. All relevant documentation has been updated or written. Most of these changes were brought up in the following messages: http://mail-index.netbsd.org/tech-kern/2012/01/18/msg012490.html http://mail-index.netbsd.org/tech-kern/2012/01/19/msg012502.html http://mail-index.netbsd.org/tech-kern/2012/02/17/msg012728.html Thanks to christos, manu, njoly, and jmmv for input. Huge thanks to pgoyette for spinning these changes through some build cycles and ATF.
2012-01-17fix secmodel implementation of CPU_UCODE.cegger
ok wiz@ for the manpages ok elad@
2012-01-13Support CPU microcode loading via cpuctl(8).cegger
Implemented and enabled via CPU_UCODE kernel config option for x86 and Xen Dom0. Tested on different AMD machines with different CPU families. ok wiz@ for the manpages ok releng@ ok core@ via releng@
2011-12-04Implement the register/deregister/evaluation API for secmodel(9). Itjym
allows registration of callbacks that can be used later for cross-secmodel "safe" communication. When a secmodel wishes to know a property maintained by another secmodel, it has to submit a request to it so the other secmodel can proceed to evaluating the request. This is done through the secmodel_eval(9) call; example: bool isroot; error = secmodel_eval("org.netbsd.secmodel.suser", "is-root", cred, &isroot); if (error == 0 && !isroot) result = KAUTH_RESULT_DENY; This one asks the suser module if the credentials are assumed to be root when evaluated by suser module. If the module is present, it will respond. If absent, the call will return an error. Args and command are arbitrarily defined; it's up to the secmodel(9) to document what it expects. Typical example is securelevel testing: when someone wants to know whether securelevel is raised above a certain level or not, the caller has to request this property to the secmodel_securelevel(9) module. Given that securelevel module may be absent from system's context (thus making access to the global "securelevel" variable impossible or unsafe), this API can cope with this absence and return an error. We are using secmodel_eval(9) to implement a secmodel_extensions(9) module, which plugs with the bsd44, suser and securelevel secmodels to provide the logic behind curtain, usermount and user_set_cpu_affinity modes, without adding hooks to traditional secmodels. This solves a real issue with the current secmodel(9) code, as usermount or user_set_cpu_affinity are not really tied to secmodel_suser(9). The secmodel_eval(9) is also used to restrict security.models settings when securelevel is above 0, through the "is-securelevel-above" evaluation: - curtain can be enabled any time, but cannot be disabled if securelevel is above 0. - usermount/user_set_cpu_affinity can be disabled any time, but cannot be enabled if securelevel is above 0. Regarding sysctl(7) entries: curtain and usermount are now found under security.models.extensions tree. The security.curtain and vfs.generic.usermount are still accessible for backwards compat. Documentation is incoming, I am proof-reading my writings. Written by elad@, reviewed and tested (anita test + interact for rights tests) by me. ok elad@. See also http://mail-index.netbsd.org/tech-security/2011/11/29/msg000422.html XXX might consider va0 mapping too. XXX Having a secmodel(9) specific printf (like aprint_*) for reporting secmodel(9) errors might be a good idea, but I am not sure on how to design such a function right now.
2011-11-23Load entropy at system boot (only works at securelevel < 1); savetls
at system shutdown. Disable with random_seed=NO in rc.conf if desired. Goes to some trouble to never load or save to network filesystems. Entropy should really be loaded by the boot loader but I am still sorting out how to pass it to the kernel.
2009-12-29Use the socket credentials, now that we have them, instead of uidinfo.elad
2009-12-24Rename KAUTH_GENERIC_CANSEE to KAUTH_GENERIC_UNUSED1 and remove handling forelad
the former. (I'll remove it from the header next time a kernel version bump happens.)
2009-11-18Fixed security.models.suser.curtain to deny when uid does not match.stacktic
OK pooka@
2009-11-14- Move kauth_init() a little bit higher.elad
- Add spec_init() to authorize special device actions (and passthru too for the time being). Move policy out of secmodel_suser.
2009-10-07Extract usermount policy to its own routine.elad
2009-10-06Add a (weak aliased) machdep_init() as a place to do machdep initializationelad
that can't happen as early as the other init functions as called from cpu_startup() -- for example, register kauth(9) listeners. Put unprivileged policy in the x86 code; used by i386, amd64, and xen.
2009-10-06Allow root to do things that the subsystem allows as well (unify).elad
This is important in the case someone manages to load the suser secmodel and remove subsystem specific listeners; without this change they would have ended up with a root user that can only do privileged operations.
2009-10-05- Add usermount_common_policy() that implements some common (everythingelad
but access control) user mounting policies: enforced MNT_NOSUID and MNT_NODEV, no MNT_EXPORT, MNT_EXEC propagation. This can be useful for secmodels that are interested in simply adding finer grained user mount support. - Add a mount subsystem listener for KAUTH_REQ_SYSTEM_MOUNT_GET.
2009-10-03Move KAUTH_NETWORK_BIND::KAUTH_REQ_NETWORK_BIND_PORT policy back to theelad
subsystem (or close to it). Note: Revisit KAUTH_REQ_NETWORK_BIND_PRIVPORT.
2009-10-03Move policies for KAUTH_PROCESS_{CANSEE,CORENAME,STOPFLAG,FORK} back toelad
the subsystem. Note: Consider killing the signal listener and sticking KAUTH_PROCESS_SIGNAL here as well.
2009-10-03One less include.elad
2009-10-03Make this file a little bit smaller by collapsing cases.elad
2009-10-03Move clockctl policy exception back to the subsystem.elad
2009-10-03secmodel_bsd44_curtain -> secmodel_suser_curtain (static).elad
2009-10-03Move default network interface policy back to the subsystem.elad
2009-10-03Finish moving socket policy to the subsystem.elad
2009-10-03Move sched policy back to the subsystem.elad
2009-10-03Move firewall/NAT policy back to respective subsystems (pf, ipf).elad
Note: the ipf code contains a lot of ifdefs, some of them for NetBSD versions that are no longer maintained. It won't make the code more readable, but we should consider removing them.
2009-10-03Move kevent policy back to the subsystem.elad
2009-10-03Put module loading policy back in the subsystem.elad
Revisit: consider moving kauth_init() above module_init() in main().
2009-10-02Put the tty opening policy back in the subsystem.elad
Remove include we don't need from the secmodel code.
2009-10-02Move some of the socket policy back to the subsystem.elad
Remove include we don't need in the secmodel code.
2009-10-02Put signal delivery policy back in the subsystem.elad
2009-10-02Remove includes we don't need.elad
2009-10-02Move routing socket security policy back to the subsystem.elad
2009-10-02- Squeeze function declarations where possible,elad
- KAUTH_RESULT_DEFER is the default (set at the beginning of each listener) and as such does not need to be set explicitly in the switches.
2009-10-02Put procfs policy back in the subsystem.elad
2009-10-02Stick nice policy in its own subsystem and call the listener "resource"elad
rather than "rlimit"...
2009-10-02Move rlimit policy back to the subsystem.elad
For this we needed proc_uidmatch() exposed, which makes a lot of sense, so put it back in sys_process.c for use in other places as well.