aboutsummaryrefslogtreecommitdiff
path: root/sys/kern/vfs_acl.c
Commit message (Collapse)AuthorAgeFilesLines
* Replace struct filedesc argument in getvnode with struct threadMateusz Guzik2015-06-161-4/+4
| | | | | | | This is is a step towards removal of spurious arguments. Notes: svn path=/head/; revision=284446
* Replace some calls to fuword() by fueword() with proper error checking.Konstantin Belousov2014-10-281-2/+6
| | | | | | | | | Sponsored by: The FreeBSD Foundation Tested by: pho MFC after: 3 weeks Notes: svn path=/head/; revision=273784
* Update kernel inclusions of capability.h to use capsicum.h instead; someRobert Watson2014-03-161-1/+1
| | | | | | | | | | | further refinement is required as some device drivers intended to be portable over FreeBSD versions rely on __FreeBSD_version to decide whether to include capability.h. MFC after: 3 weeks Notes: svn path=/head/; revision=263233
* Change the cap_rights_t type from uint64_t to a structure that we can extendPawel Jakub Dawidek2013-09-051-6/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | in the future in a backward compatible (API and ABI) way. The cap_rights_t represents capability rights. We used to use one bit to represent one right, but we are running out of spare bits. Currently the new structure provides place for 114 rights (so 50 more than the previous cap_rights_t), but it is possible to grow the structure to hold at least 285 rights, although we can make it even larger if 285 rights won't be enough. The structure definition looks like this: struct cap_rights { uint64_t cr_rights[CAP_RIGHTS_VERSION + 2]; }; The initial CAP_RIGHTS_VERSION is 0. The top two bits in the first element of the cr_rights[] array contain total number of elements in the array - 2. This means if those two bits are equal to 0, we have 2 array elements. The top two bits in all remaining array elements should be 0. The next five bits in all array elements contain array index. Only one bit is used and bit position in this five-bits range defines array index. This means there can be at most five array elements in the future. To define new right the CAPRIGHT() macro must be used. The macro takes two arguments - an array index and a bit to set, eg. #define CAP_PDKILL CAPRIGHT(1, 0x0000000000000800ULL) We still support aliases that combine few rights, but the rights have to belong to the same array element, eg: #define CAP_LOOKUP CAPRIGHT(0, 0x0000000000000400ULL) #define CAP_FCHMOD CAPRIGHT(0, 0x0000000000002000ULL) #define CAP_FCHMODAT (CAP_FCHMOD | CAP_LOOKUP) There is new API to manage the new cap_rights_t structure: cap_rights_t *cap_rights_init(cap_rights_t *rights, ...); void cap_rights_set(cap_rights_t *rights, ...); void cap_rights_clear(cap_rights_t *rights, ...); bool cap_rights_is_set(const cap_rights_t *rights, ...); bool cap_rights_is_valid(const cap_rights_t *rights); void cap_rights_merge(cap_rights_t *dst, const cap_rights_t *src); void cap_rights_remove(cap_rights_t *dst, const cap_rights_t *src); bool cap_rights_contains(const cap_rights_t *big, const cap_rights_t *little); Capability rights to the cap_rights_init(), cap_rights_set(), cap_rights_clear() and cap_rights_is_set() functions are provided by separating them with commas, eg: cap_rights_t rights; cap_rights_init(&rights, CAP_READ, CAP_WRITE, CAP_FSTAT); There is no need to terminate the list of rights, as those functions are actually macros that take care of the termination, eg: #define cap_rights_set(rights, ...) \ __cap_rights_set((rights), __VA_ARGS__, 0ULL) void __cap_rights_set(cap_rights_t *rights, ...); Thanks to using one bit as an array index we can assert in those functions that there are no two rights belonging to different array elements provided together. For example this is illegal and will be detected, because CAP_LOOKUP belongs to element 0 and CAP_PDKILL to element 1: cap_rights_init(&rights, CAP_LOOKUP | CAP_PDKILL); Providing several rights that belongs to the same array's element this way is correct, but is not advised. It should only be used for aliases definition. This commit also breaks compatibility with some existing Capsicum system calls, but I see no other way to do that. This should be fine as Capsicum is still experimental and this change is not going to 9.x. Sponsored by: The FreeBSD Foundation Notes: svn path=/head/; revision=255219
* Don't dereference null pointer should acl_alloc() be passed M_NOWAITEdward Tomasz Napierala2013-08-091-0/+3
| | | | | | | | | | and allocation failed. Nothing in the tree passed M_NOWAIT. Obtained from: mjg MFC after: 1 month Notes: svn path=/head/; revision=254135
* Prezero the acl structure which is to be copied to usermode, to avoidSergey Kandaurov2013-02-061-1/+1
| | | | | | | | | | | leakage of the previous content of padding and unitialized fields. Reported by: Ilia Noskov <noskov@nic.ru> Reviewed by: kib MFC after: 1 week Notes: svn path=/head/; revision=246412
* Remove the support for using non-mpsafe filesystem modules.Konstantin Belousov2012-10-221-44/+20
| | | | | | | | | | | | | | | In particular, do not lock Giant conditionally when calling into the filesystem module, remove the VFS_LOCK_GIANT() and related macros. Stop handling buffers belonging to non-mpsafe filesystems. The VFS_VERSION is bumped to indicate the interface change which does not result in the interface signatures changes. Conducted and reviewed by: attilio Tested by: pho Notes: svn path=/head/; revision=241896
* In order to maximize the re-usability of kernel code in user space thisKip Macy2011-09-161-12/+12
| | | | | | | | | | | | | | | | patch modifies makesyscalls.sh to prefix all of the non-compatibility calls (e.g. not linux_, freebsd32_) with sys_ and updates the kernel entry points and all places in the code that use them. It also fixes an additional name space collision between the kernel function psignal and the libc function of the same name by renaming the kernel psignal kern_psignal(). By introducing this change now we will ease future MFCs that change syscalls. Reviewed by: rwatson Approved by: re (bz) Notes: svn path=/head/; revision=225617
* Second-to-last commit implementing Capsicum capabilities in the FreeBSDRobert Watson2011-08-111-4/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | kernel for FreeBSD 9.0: Add a new capability mask argument to fget(9) and friends, allowing system call code to declare what capabilities are required when an integer file descriptor is converted into an in-kernel struct file *. With options CAPABILITIES compiled into the kernel, this enforces capability protection; without, this change is effectively a no-op. Some cases require special handling, such as mmap(2), which must preserve information about the maximum rights at the time of mapping in the memory map so that they can later be enforced in mprotect(2) -- this is done by narrowing the rights in the existing max_protection field used for similar purposes with file permissions. In namei(9), we assert that the code is not reached from within capability mode, as we're not yet ready to enforce namespace capabilities there. This will follow in a later commit. Update two capability names: CAP_EVENT and CAP_KEVENT become CAP_POST_KEVENT and CAP_POLL_KEVENT to more accurately indicate what they represent. Approved by: re (bz) Submitted by: jonathan Sponsored by: Google Inc Notes: svn path=/head/; revision=224778
* The 'acl_cnt' field is unsigned; no point in checking if it's >= 0.Edward Tomasz Napierala2010-06-031-1/+1
| | | | | | | | Found with: Coverity Prevent CID: 3688 Notes: svn path=/head/; revision=208781
* Add change that was somehow missed in r192586. It could manifest byEdward Tomasz Napierala2009-12-031-2/+3
| | | | | | | | incorrectly returning EINVAL from acl_valid(3) for applications linked against pre-8.0 libc. Notes: svn path=/head/; revision=200058
* Fix build.Edward Tomasz Napierala2009-11-041-1/+1
| | | | | | | Submitted by: Andrius Morkūnas <hinokind at gmail.com> Notes: svn path=/head/; revision=198877
* Style fixes.Edward Tomasz Napierala2009-11-041-7/+7
| | | | Notes: svn path=/head/; revision=198875
* Fix NFSv4 ACLs on sparc64. Turns out that fuword(9) fetches 64 bitsEdward Tomasz Napierala2009-10-051-1/+1
| | | | | | | | | | | | instead of sizeof(int), and on sparc64 that resulted in fetching wrong value for acl_maxcnt, which in turn caused __acl_get_link(2) to fail with EINVAL. PR: sparc64/139304 Submitted by: Dmitry Afanasiev <KOT at MATPOCKuH.Ru> Notes: svn path=/head/; revision=197789
* Move "options MAC" from opt_mac.h to opt_global.h, as it's now in GENERICRobert Watson2009-06-051-2/+0
| | | | | | | | | | | and used in a large number of files, but also because an increasing number of incorrect uses of MAC calls were sneaking in due to copy-and-paste of MAC-aware code without the associated opt_mac.h include. Discussed with: pjd Notes: svn path=/head/; revision=193511
* Make 'struct acl' larger, as required to support NFSv4 ACLs. ProvideEdward Tomasz Napierala2009-05-221-7/+140
| | | | | | | | | compatibility interfaces in both kernel and libc. Reviewed by: rwatson Notes: svn path=/head/; revision=192586
* When allocating 'struct acl' instances, use malloc(9) instead of uma(9).Edward Tomasz Napierala2009-04-191-15/+3
| | | | | | | | | | This struct will get much bigger soon, and we don't want to waste too much memory on UMA caches. Reviewed by: rwatson Notes: svn path=/head/; revision=191266
* Use acl_alloc() and acl_free() instead of using uma(9) directly.Edward Tomasz Napierala2009-04-181-15/+40
| | | | | | | | | This will make switching to malloc(9) easier; also, it would be neccessary to add these routines if/when we implement variable-size ACLs. Notes: svn path=/head/; revision=191249
* Remove VOP_LEASE and supporting functions. This hasn't been used sinceRobert Watson2009-04-101-3/+0
| | | | | | | | | | | | | | | | | the removal of NQNFS, but was left in in case it was required for NFSv4. Since our new NFSv4 client and server can't use it for their requirements, GC the old mechanism, as well as other unused lease- related code and interfaces. Due to its impact on kernel programming and binary interfaces, this change should not be MFC'd. Proposed by: jeff Reviewed by: jeff Discussed with: rmacklem, zach loafman @ isilon Notes: svn path=/head/; revision=190888
* Add the support for the AT_FDCWD and fd-relative name lookups to theKonstantin Belousov2008-03-311-0/+1
| | | | | | | | | | | | namei(9). Based on the submission by rdivacky, sponsored by Google Summer of Code 2007 Reviewed by: rwatson, rdivacky Tested by: pho Notes: svn path=/head/; revision=177785
* In keeping with style(9)'s recommendations on macros, use a ';'Robert Watson2008-03-161-1/+1
| | | | | | | | | | | | after each SYSINIT() macro invocation. This makes a number of lightweight C parsers much happier with the FreeBSD kernel source, including cflow's prcc and lxr. MFC after: 1 month Discussed with: imp, rink Notes: svn path=/head/; revision=177253
* VOP_LOCK1() (and so VOP_LOCK()) and VOP_UNLOCK() are only used inAttilio Rao2008-01-131-3/+3
| | | | | | | | | | | | | | conjuction with 'thread' argument passing which is always curthread. Remove the unuseful extra-argument and pass explicitly curthread to lower layer functions, when necessary. KPI results broken by this change, which should affect several ports, so version bumping and manpage update will be further committed. Tested by: kris, pho, Diego Sardina <siarodx at gmail dot com> Notes: svn path=/head/; revision=175294
* vn_lock() is currently only used with the 'curthread' passed as argument.Attilio Rao2008-01-101-3/+3
| | | | | | | | | | | | | | | | | | | Remove this argument and pass curthread directly to underlying VOP_LOCK1() VFS method. This modify makes the code cleaner and in particular remove an annoying dependence helping next lockmgr() cleanup. KPI results, obviously, changed. Manpage and FreeBSD_version will be updated through further commits. As a side note, would be valuable to say that next commits will address a similar cleanup about VFS methods, in particular vop_lock1 and vop_unlock. Tested by: Diego Sardina <siarodx at gmail dot com>, Andrea Di Pasquale <whyx dot it at gmail dot com> Notes: svn path=/head/; revision=175202
* Merge first in a series of TrustedBSD MAC Framework KPI changesRobert Watson2007-10-241-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | from Mac OS X Leopard--rationalize naming for entry points to the following general forms: mac_<object>_<method/action> mac_<object>_check_<method/action> The previous naming scheme was inconsistent and mostly reversed from the new scheme. Also, make object types more consistent and remove spaces from object types that contain multiple parts ("posix_sem" -> "posixsem") to make mechanical parsing easier. Introduce a new "netinet" object type for certain IPv4/IPv6-related methods. Also simplify, slightly, some entry point names. All MAC policy modules will need to be recompiled, and modules not updates as part of this commit will need to be modified to conform to the new KPI. Sponsored by: SPARTA (original patches against Mac OS X) Obtained from: TrustedBSD Project, Apple Computer Notes: svn path=/head/; revision=172930
* Replay minor system call comment cleanup applied to kern_acl.c in a raceRobert Watson2007-03-051-2/+2
| | | | | | | with repo-copy of kern_acl.c to vfs_acl.c. Notes: svn path=/head/; revision=167234
* Remove 'MPSAFE' annotations from the comments above most system calls: allRobert Watson2007-03-041-27/+3
| | | | | | | | | | | system calls now enter without Giant held, and then in some cases, acquire Giant explicitly. Remove a number of other MPSAFE annotations in the credential code and tweak one or two other adjacent comments. Notes: svn path=/head/; revision=167211
* Re-wrap comments to wider margins now that they have been relocated fromRobert Watson2007-01-121-9/+7
| | | | | | | within functions. Notes: svn path=/head/; revision=165983
* Complete break-out of sys/sys/mac.h into sys/security/mac/mac_framework.hRobert Watson2006-10-221-1/+2
| | | | | | | | | | | | | | | | begun with a repo-copy of mac.h to mac_framework.h. sys/mac.h now contains the userspace and user<->kernel API and definitions, with all in-kernel interfaces moved to mac_framework.h, which is now included across most of the kernel instead. This change is the first step in a larger cleanup and sweep of MAC Framework interfaces in the kernel, and will not be MFC'd. Obtained from: TrustedBSD Project Sponsored by: SPARTA Notes: svn path=/head/; revision=163606
* Move POSIX.1e-specific utility routines from kern_acl.c toRobert Watson2006-07-061-584/+4
| | | | | | | | | | | | subr_acl_posix1e.c, leaving kern_acl.c containing only ACL system calls and utility routines common across ACL types. Add subr_acl_posix1e.c to the build. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=160146
* Implement new world order in VFS locking for ACLs. This will remove theChristian S.J. Peron2005-09-171-44/+45
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | unconditional acquisition of Giant for ACL related operations. If the file system is set as being MP safe and debug.mpsafevfs is 1, do not pickup giant. For any operations which require namei(9) lookups: __acl_get_file __acl_get_link __acl_set_file __acl_set_link __acl_delete_file __acl_delete_link __acl_aclcheck_file __acl_aclcheck_link -Set the MPSAFE flag in NDINIT -Initialize vfslocked variable using the NDHASGIANT macro For functions which operate on fds, make sure the operations are locked: __acl_get_fd __acl_set_fd __acl_delete_fd __acl_aclcheck_fd -Initialize vfslocked using VFS_LOCK_GIANT before we manipulate the vnode Discussed with: jeff Notes: svn path=/head/; revision=150262
* Convert the primary ACL allocator from malloc(9) to using a UMA zone instead.Christian S.J. Peron2005-09-061-1/+13
| | | | | | | | | | | Also introduce an aclinit function which will be used to create the UMA zone for use by file systems at system start up. MFC after: 1 month Discussed with: rwatson Notes: svn path=/head/; revision=149811
* Rename suser_cred()'s PRISON_ROOT flag to SUSER_ALLOWJAIL. This isColin Percival2004-07-261-6/+6
| | | | | | | | | | | | | | somewhat clearer, but more importantly allows for a consistent naming scheme for suser_cred flags. The old name is still defined, but will be removed in a few days (unless I hear any complaints...) Discussed with: rwatson, scottl Requested by: jhb Notes: svn path=/head/; revision=132653
* Update my personal copyrights and NETA copyrights in the kernelRobert Watson2004-02-221-1/+1
| | | | | | | | | | | to use the "year1-year3" format, as opposed to "year1, year2, year3". This seems to make lawyers more happy, but also prevents the lines from getting excessively long as the years start to add up. Suggested by: imp Notes: svn path=/head/; revision=126097
* Move more ACL logic from the UFS code (ufs_acl.c) to the central POSIX.1eRobert Watson2003-08-041-1/+84
| | | | | | | | | | | | | | | | | | | | | support routines in kern_acl.c: - Define ACL_OVERRIDE_MASK and ACL_PRESERVE_MASK centrally in acl.h: the mode bits that are (and aren't) stored in the ACL. - Add acl_posix1e_acl_to_mode(): given a POSIX.1e extended ACL, generate a compatibility mode (only the bits supported by the POSIX.1e ACL). - acl_posix1e_newfilemode(): Given a requested creation mode and default ACL, calculate the mode for the new file system object (only the bits supported by the POSIX.1e ACL). PR: 50148 Reported by: Ritz, Bruno <bruno_ritz@gmx.ch> Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=118407
* Add a f_vnode field to struct file.Poul-Henning Kamp2003-06-221-4/+4
| | | | | | | | | | | | | | | Several of the subtypes have an associated vnode which is used for stuff like the f*() functions. By giving the vnode a speparate field, a number of checks for the specific subtype can be replaced simply with a check for f_vnode != NULL, and we can later free f_data up to subtype specific use. At this point in time, f_data still points to the vnode, so any code I might have overlooked will still work. Notes: svn path=/head/; revision=116678
* Use __FBSDID().David E. O'Brien2003-06-111-2/+3
| | | | Notes: svn path=/head/; revision=116182
* Bow to the whining masses and change a union back into void *. RetainMatthew Dillon2003-01-131-7/+4
| | | | | | | | removal of unnecessary casts and throw in some minor cleanups to see if anyone complains, just for the hell of it. Notes: svn path=/head/; revision=109153
* Change struct file f_data to un_data, a union of the correct structMatthew Dillon2003-01-121-5/+4
| | | | | | | | | | | | | pointer types, and remove a huge number of casts from code using it. Change struct xfile xf_data to xun_data (ABI is still compatible). If we need to add a #define for f_data and xf_data we can, but I don't think it will be necessary. There are no operational changes in this commit. Notes: svn path=/head/; revision=109123
* When compiling the kernel do not implicitly include filedesc.h from proc.h,Alfred Perlstein2003-01-011-0/+1
| | | | | | | | | this was causing filedesc work to be very painful. In order to make this work split out sigio definitions to thier own header (sigio.h) which is included from proc.h for the time being. Notes: svn path=/head/; revision=108524
* Implement new ACL system calls which do not follow symbolic links:Robert Watson2002-12-291-1/+89
| | | | | | | | | | | | __acl_get_link(), __acl_set_link(), acl_delete_link(), and __acl_aclcheck_link(), with almost identical implementations to the existing __acl_*_file() variants on these calls. Update copyright. Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=108407
* unwrap lines made short enough by SCARGS removalAlfred Perlstein2002-12-141-6/+3
| | | | Notes: svn path=/head/; revision=107855
* SCARGS removal take II.Alfred Perlstein2002-12-141-19/+19
| | | | Notes: svn path=/head/; revision=107849
* Backout removal SCARGS, the code freeze is only "selectively" over.Alfred Perlstein2002-12-131-19/+19
| | | | Notes: svn path=/head/; revision=107839
* Remove SCARGS.Alfred Perlstein2002-12-131-19/+19
| | | | | | | Reviewed by: md5 Notes: svn path=/head/; revision=107838
* Introduce support for Mandatory Access Control and extensibleRobert Watson2002-08-011-1/+28
| | | | | | | | | | | | | kernel access control. Instrument the kernel ACL retrieval and modification system calls to invoke MAC framework entry points to authorize these operations. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs Notes: svn path=/head/; revision=101122
* Teach discretionary access control methods for files about VAPPENDRobert Watson2002-07-221-13/+13
| | | | | | | | | | and VALLPERM. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs Notes: svn path=/head/; revision=100481
* Fix a bug that prevented the deletion of non-default ACLs from beingRobert Watson2002-06-271-1/+1
| | | | | | | | | | | passed down the VFS stack. While I'm here, replace a '0' with a 'NULL' to make the code more readable. Sponsored by: DARPA, NAI Labs Obtained from: TrustedBSD Project Notes: svn path=/head/; revision=98928
* A bit of whitespace magic.Robert Watson2002-06-271-5/+5
| | | | Notes: svn path=/head/; revision=98927
* opt_cap.c no longer neededRobert Watson2002-06-131-2/+0
| | | | Notes: svn path=/head/; revision=98192
* More s/file system/filesystem/gTom Rhodes2002-05-161-2/+2
| | | | Notes: svn path=/head/; revision=96755
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-28 08:13:28 +0000