cvs commit: src/sys/kern kern_jail.c kern_priv.c kern_prot.c src/sys/security/mac mac_framework.h mac_internal.h mac_priv.c src/sys/sys jail.h priv.h systm.h src/sys/conf files src/share/man/man9 Makefile priv.9 suser.9

[Robert Watson]

rwatson     2006-11-06 13:37:19 UTC

  FreeBSD src repository

  Modified files:
    sys/kern             kern_jail.c kern_prot.c 
    sys/security/mac     mac_framework.h mac_internal.h 
    sys/sys              jail.h systm.h 
    sys/conf             files 
    share/man/man9       Makefile suser.9 
  Added files:
    sys/kern             kern_priv.c 
    sys/security/mac     mac_priv.c 
    sys/sys              priv.h 
    share/man/man9       priv.9 
  Log:
  Add a new priv(9) kernel interface for checking the availability of
  privilege for threads and credentials.  Unlike the existing suser(9)
  interface, priv(9) exposes a named privilege identifier to the privilege
  checking code, allowing more complex policies regarding the granting of
  privilege to be expressed.  Two interfaces are provided, replacing the
  existing suser(9) interface:
  
  suser(td)                 ->   priv_check(td, priv)
  suser_cred(cred, flags)   ->   priv_check_cred(cred, priv, flags)
  
  A comprehensive list of currently available kernel privileges may be
  found in priv.h.  New privileges are easily added as required, but the
  comments on adding privileges found in priv.h and priv(9) should be read
  before doing so.
  
  The new privilege interface exposed sufficient information to the
  privilege checking routine that it will now be possible for jail to
  determine whether a particular privilege is granted in the check routine,
  rather than relying on hints from the calling context via the
  SUSER_ALLOWJAIL flag.  For now, the flag is maintained, but a new jail
  check function, prison_priv_check(), is exposed from kern_jail.c and used
  by the privilege check routine to determine if the privilege is permitted
  in jail.  As a result, a centralized list of privileges permitted in jail
  is now present in kern_jail.c.
  
  The MAC Framework is now also able to instrument privilege checks, both
  to deny privileges otherwise granted (mac_priv_check()), and to grant
  privileges otherwise denied (mac_priv_grant()), permitting MAC Policy
  modules to implement privilege models, as well as control a much broader
  range of system behavior in order to constrain processes running with
  root privilege.
  
  The suser() and suser_cred() functions remain implemented, now in terms
  of priv_check() and the PRIV_ROOT privilege, for use during the transition
  and possibly continuing use by third party kernel modules that have not
  been updated.  The PRIV_DRIVER privilege exists to allow device drivers to
  check privilege without adopting a more specific privilege identifier.
  
  This change does not modify the actual security policy, rather, it
  modifies the interface for privilege checks so changes to the security
  policy become more feasible.
  
  Sponsored by:           nCircle Network Security, Inc.
  Obtained from:          TrustedBSD Project
  Discussed on:           arch@
  Reviewed (at least in part) by: mlaier, jmg, pjd, bde, ceri,
                          Alex Lyashkov <umka at sevcity dot net>,
                          Skip Ford <skip dot ford at verizon dot net>,
                          Antoine Brodin <antoine dot brodin at laposte dot net>
  
  Revision  Changes    Path
  1.283     +1 -0      src/share/man/man9/Makefile
  1.1       +115 -0    src/share/man/man9/priv.9 (new)
  1.30      +8 -1      src/share/man/man9/suser.9
  1.1160    +2 -0      src/sys/conf/files
  1.54      +168 -1    src/sys/kern/kern_jail.c
  1.1       +154 -0    src/sys/kern/kern_priv.c (new)
  1.206     +58 -89    src/sys/kern/kern_prot.c
  1.75      +2 -0      src/sys/security/mac/mac_framework.h
  1.115     +34 -0     src/sys/security/mac/mac_internal.h
  1.1       +64 -0     src/sys/security/mac/mac_priv.c (new)
  1.27      +1 -0      src/sys/sys/jail.h
  1.1       +457 -0    src/sys/sys/priv.h (new)
  1.246     +1 -1      src/sys/sys/systm.h