summaryrefslogtreecommitdiff
path: root/sys/secmodel
AgeCommit message (Collapse)Author
2023-04-22secmodel_extensions: Split vfs part into separate .c file.riastradh
This way we can provide weak rumpkern stubs that don't require rumpvfs for things that are relevant to vfs, but if you do link rumpvfs then you get the same logic in secmodel extensions.
2023-01-05wg(4): Allow non-root to retrieve information other than the privatejakllsch
key and the peer preshared key. Add kauth(9) enums for wg(4) and add use them in suser secmodel. Refines fix for PR 57161.
2023-01-05more strip(4) removal, this time in kauth(9)jakllsch
2022-03-29isroot should be bool...christos
2022-03-28secmodel: fix grammar in description of hardlink_check_gidrillig
2022-03-27Implement restrictions for adding hard links to fileschristos
2021-12-07s/dissallow/disallow/andvar
2020-12-05Remove unnecessary inclusion of <sys/timevar.h>.thorpej
2020-09-08Add IP_BINDANY, IPV6_BINDANY which can be used to bind to any address inchristos
order to implement transparent proxies.
2020-08-10Clean up _LKM --> _MODULE leftovers.rin
Note that _KERNEL is always defined for modules.
2020-05-28Accept ioctl(RNDADDDATA) estimates at securelevel 1 (but not 2).riastradh
securelevel=1 is supposed to be a reasonable default for normal computers. This got in the way of ever getting entropy from a seed on a machine with no HWRNG -- e.g., from another machine, or by making the executive decision that what has been sampled is good enough and issuing `head -c 32 < /dev/urandom > /dev/random'.
2020-05-16Make it clear that only KAUTH_MACHDEP_SVS_DISABLE is deprecated.alnsn
2020-05-11KAUTH_MACHDEP_SVS_DISABLE is deprecated.alnsn
sysctl machdep.svs.enabled can't be changed anymore at runtime because it's now a boot option.
2020-03-16Use the module subsystem's ability to process SYSCTL_SETUP() entries topgoyette
automate installation of sysctl nodes. Note that there are still a number of device and pseudo-device modules that create entries tied to individual device units, rather than to the module itself. These are not changed.
2020-02-21Explicitly cast pointers to uintptr_t before casting to enums. They arejoerg
not necessarily the same size. Don't cast pointers to bool, check for NULL instead.
2020-02-14Provide necessary forward declarations or includes.riastradh
2019-04-10Add the NVMM_CTL ioctl, always privileged regardless of the permissions ofmaxv
/dev/nvmm. We'll use it to provide a way for an admin to control the registered VMs in the kernel. Add an associated wrapper in libnvmm.
2018-10-05Provide a sysctl kern.expose_address to expose kernel addresses inchristos
sysctl structure returns for non-root. Defaults to off. Turning it on will restore sockstat/fstat and friends for regular users.
2018-09-04Introduce KAUTH_REQ_PROCESS_CANSEE_KPTR, and use it in the already-existingmaxv
modstat code. No real functional change.
2018-08-25Add KAUTH_REQ_PROCESS_CANSEE_EPROC, and use it for the kern.proc node.maxv
Same permission as before, so no functional change.
2018-07-15Retire ipkdb entirely. The option was removed from the config filesmaxv
yesterday. ok kamil christos
2018-07-13Remove KAUTH_MACHDEP_X86PMC, now unused.maxv
2018-04-26Add KAUTH_MACHDEP_SVS_DISABLE and add support to secmodel_securelevel(9).alnsn
Disabling SVS is denied at securelevel 1 and above.
2018-04-08Add new sysctl(3) entry: security.models.extensions.user_set_dbregskamil
Model this new sysctl(3) entry after "user_set_cpu_affinity" in the same level of sysctl(3) switches. Allow to read unconditionally Debug Registers (no change here). This is convenient as even if a user of a debugger does not use hardware assisted watchpoints/breakpoints, a debugger can still prompt these values to store in an internal cache with context of registers. Reading them should have no security concerns. Add a paranoid MI switch that prohibits by default setting these registers by a regular user (non-superuser). Make this switch disabled by default. There are enough reserved bits out there to allow using them unconditionally on hardened hosts. Features shipped with Debug Registers are optional features in debuggers. There is no reduction in elementary functionality. Reviewed by <christos> Sponsored by <The NetBSD Foundation>
2017-06-14Make the PMC syscalls privileged.maxv
2015-12-12secmodel_extensions_system_cb() is not mount-specific, even thoughmaxv
KAUTH_SYSTEM_MOUNT happens to be the only option handled here. Put everything into a swith(action). No functional change.
2015-08-17Add kernel code to support intrctl(8).knakahara
2014-11-04Do not release secmodels_lock when it is not held.maxv
Sent on tech-kern@, ok lars@
2014-02-25Ensure that the top level sysctl nodes (kern, vfs, net, ...) exist beforepooka
the sysctl link sets are processed, and remove redundancy. Shaves >13kB off of an amd64 GENERIC, not to mention >1k duplicate lines of code.
2013-02-28Make the callback deal with embryonic connections which do not havemartin
credentials yet. Fixes PR kern/47598.
2013-01-28Re-instate backwards compatible security.models.bsd44.{curtain,securelevel}.jym
They were mistakenly removed when curtain and securelevel moved to secmodel_extensions(9). Reported by tls@ on tech-security@. XXX will ask for pull-up for -6.
2012-11-13kill some -Wunused-but-set-variable warningspooka
2012-06-27KNF fix. spaces vs. tabcheusov
2012-03-13Replace the remaining KAUTH_GENERIC_ISSUSER authorization calls withelad
something meaningful. All relevant documentation has been updated or written. Most of these changes were brought up in the following messages: http://mail-index.netbsd.org/tech-kern/2012/01/18/msg012490.html http://mail-index.netbsd.org/tech-kern/2012/01/19/msg012502.html http://mail-index.netbsd.org/tech-kern/2012/02/17/msg012728.html Thanks to christos, manu, njoly, and jmmv for input. Huge thanks to pgoyette for spinning these changes through some build cycles and ATF.
2012-01-17fix secmodel implementation of CPU_UCODE.cegger
ok wiz@ for the manpages ok elad@
2012-01-13Support CPU microcode loading via cpuctl(8).cegger
Implemented and enabled via CPU_UCODE kernel config option for x86 and Xen Dom0. Tested on different AMD machines with different CPU families. ok wiz@ for the manpages ok releng@ ok core@ via releng@
2011-12-08build fix for keylock secmodel(9).jym
2011-12-05secmodel_eval(9) may want to access securelevel before it is setjym
to the right value, so init it first before registering secmodel(9).
2011-12-04When user_set_cpu_affinity is non-zero, only allow users to modifyjym
the CPU affinity of the LWPs they own.
2011-12-04Implement the register/deregister/evaluation API for secmodel(9). Itjym
allows registration of callbacks that can be used later for cross-secmodel "safe" communication. When a secmodel wishes to know a property maintained by another secmodel, it has to submit a request to it so the other secmodel can proceed to evaluating the request. This is done through the secmodel_eval(9) call; example: bool isroot; error = secmodel_eval("org.netbsd.secmodel.suser", "is-root", cred, &isroot); if (error == 0 && !isroot) result = KAUTH_RESULT_DENY; This one asks the suser module if the credentials are assumed to be root when evaluated by suser module. If the module is present, it will respond. If absent, the call will return an error. Args and command are arbitrarily defined; it's up to the secmodel(9) to document what it expects. Typical example is securelevel testing: when someone wants to know whether securelevel is raised above a certain level or not, the caller has to request this property to the secmodel_securelevel(9) module. Given that securelevel module may be absent from system's context (thus making access to the global "securelevel" variable impossible or unsafe), this API can cope with this absence and return an error. We are using secmodel_eval(9) to implement a secmodel_extensions(9) module, which plugs with the bsd44, suser and securelevel secmodels to provide the logic behind curtain, usermount and user_set_cpu_affinity modes, without adding hooks to traditional secmodels. This solves a real issue with the current secmodel(9) code, as usermount or user_set_cpu_affinity are not really tied to secmodel_suser(9). The secmodel_eval(9) is also used to restrict security.models settings when securelevel is above 0, through the "is-securelevel-above" evaluation: - curtain can be enabled any time, but cannot be disabled if securelevel is above 0. - usermount/user_set_cpu_affinity can be disabled any time, but cannot be enabled if securelevel is above 0. Regarding sysctl(7) entries: curtain and usermount are now found under security.models.extensions tree. The security.curtain and vfs.generic.usermount are still accessible for backwards compat. Documentation is incoming, I am proof-reading my writings. Written by elad@, reviewed and tested (anita test + interact for rights tests) by me. ok elad@. See also http://mail-index.netbsd.org/tech-security/2011/11/29/msg000422.html XXX might consider va0 mapping too. XXX Having a secmodel(9) specific printf (like aprint_*) for reporting secmodel(9) errors might be a good idea, but I am not sure on how to design such a function right now.
2011-11-28The secmodel(9)s init, start and stop routines are managed by eachjym
secmodel module(7), so there is no point in calling suser/securelevel routines from bsd44. This leads to unwanted cross-secmodel dependencies. Do not call secmodel_bsd44_init() from secmodel_overlay_init(). Doing so resets all curtain/securelevel values, which is not really needed when loading an overlay filter. Remove the secmodel_register/deregister comments, they will be implemented differently in an upcoming patch. ok elad@ (via private mail).
2011-11-28Whitespace fixes.jym
2011-11-23Load entropy at system boot (only works at securelevel < 1); savetls
at system shutdown. Disable with random_seed=NO in rc.conf if desired. Goes to some trouble to never load or save to network filesystems. Entropy should really be loaded by the boot loader but I am still sorting out how to pass it to the kernel.
2009-12-29Use the socket credentials, now that we have them, instead of uidinfo.elad
2009-12-24Rename KAUTH_GENERIC_CANSEE to KAUTH_GENERIC_UNUSED1 and remove handling forelad
the former. (I'll remove it from the header next time a kernel version bump happens.)
2009-11-18Fixed security.models.suser.curtain to deny when uid does not match.stacktic
OK pooka@
2009-11-14- Move kauth_init() a little bit higher.elad
- Add spec_init() to authorize special device actions (and passthru too for the time being). Move policy out of secmodel_suser.
2009-10-19buildfix: define integer before use. i386 ALL kernel builds againcegger
2009-10-07Extract usermount policy to its own routine.elad
2009-10-07Compare against initproc, not pid 1, to check if it's init (unify).elad