HEADS UP: Kernel process authorization changes

[Robert Watson]

I just committed a fairly substantial set of modifications to the
inter-process authorization checking code in the FreeBSD 5.0-CURRENT tree.
On the whole, the semantics of the {before, after} code should be pretty
much identical; the differences should be documented in the commit
comment.  However, for the next week or two, I'd like people to be on the
lookout for unexpected changes in process interaction: i.e., commands that
used to work, that now get a permission denied, or interactions now
possible between processes (signalling, debugging, scheduling, ability to
see in /proc, process listings) that weren't before.  Hopefully the
extensive reviews caught all the bugs, however :-).

These infrastructure improvements make access control more consistent, as
well as centralizing it so that improvements (such as support for
capabilities, mandatory access control) can be made more easily.  It also
makes it easier to reason about the current implementation to determine
its correctness.

I'll be updating the TrustedBSD capability patches sometime in the next 48
hours so that they apply cleanly with these infrastructure improvements.

Commit message attached below for reference.  There was also a related
commit containing authorization improvements for file systems this
morning, but it was much smaller.  Those changes can be found largely in
vfs_subr.c, essentially rewriting vaccess() to reflect proper ordering of
discretionary and privileged access to files protected via UNIX-style
permissions.

Thanks,

  Robert N M Watson 

robert at fledge.watson.org              http://www.watson.org/~robert/
PGP key fingerprint: AF B5 5F FF A6 4A 79 37  ED 5F 55 E9 58 04 6A B1
TIS Labs at Network Associates, Safeport Network Services

---------- Forwarded message ----------
Date: Tue, 29 Aug 2000 21:49:10 -0700 (PDT)
From: Robert Watson <rwatson at FreeBSD.org>
To: cvs-committers at FreeBSD.org, cvs-all at FreeBSD.org
Subject: cvs commit: src/sys/kern kern_event.c kern_ktrace.c kern_proc.c         kern_prot.c kern_resource.c kern_sig.c sys_process.c         src/sys/miscfs/procfs procfs_dbregs.c procfs_fpregs.c procfs_mem.c         procfs_regs.c procfs_status.c procfs_vnops.c src/sys/sys proc.h

rwatson     2000/08/29 21:49:10 PDT

  Modified files:
    sys/kern             kern_event.c kern_ktrace.c kern_proc.c 
                         kern_prot.c kern_resource.c kern_sig.c 
                         sys_process.c 
    sys/miscfs/procfs    procfs_dbregs.c procfs_fpregs.c 
                         procfs_mem.c procfs_regs.c 
                         procfs_status.c procfs_vnops.c 
    sys/sys              proc.h 
  Log:
  o Centralize inter-process access control, introducing:
  
      int p_can(p1, p2, operation, privused)
  
    which allows specification of subject process, object process,
    inter-process operation, and an optional call-by-reference privused
    flag, allowing the caller to determine if privilege was required
    for the call to succeed.  This allows jail, kern.ps_showallprocs and
    regular credential-based interaction checks to occur in one block of
    code.  Possible operations are P_CAN_SEE, P_CAN_SCHED, P_CAN_KILL,
    and P_CAN_DEBUG.  p_can currently breaks out as a wrapper to a
    series of static function checks in kern_prot, which should not
    be invoked directly.
  
  o Commented out capabilities entries are included for some checks.
  
  o Update most inter-process authorization to make use of p_can() instead
    of manual checks, PRISON_CHECK(), P_TRESPASS(), and
    kern.ps_showallprocs.
  
  o Modify suser{,_xxx} to use const arguments, as it no longer modifies
    process flags due to the disabling of ASU.
  
  o Modify some checks/errors in procfs so that ENOENT is returned instead
    of ESRCH, further improving concealment of processes that should not
    be visible to other processes.  Also introduce new access checks to
    improve hiding of processes for procfs_lookup(), procfs_getattr(),
    procfs_readdir().  Correct a bug reported by bp concerning not
    handling the CREATE case in procfs_lookup().  Remove volatile flag in
    procfs that caused apparently spurious qualifier warnigns (approved by
    bde).
  
  o Add comment noting that ktrace() has not been updated, as its access
    control checks are different from ptrace(), whereas they should
    probably be the same.  Further discussion should happen on this topic.
  
  Reviewed by:	bde, green, phk, freebsd-security, others
  Approved by:	bde
  Obtained from:	TrustedBSD Project
  
  Revision  Changes    Path
  1.16      +2 -2      src/sys/kern/kern_event.c
  1.41      +3 -1      src/sys/kern/kern_ktrace.c
  1.72      +7 -7      src/sys/kern/kern_proc.c
  1.61      +144 -10   src/sys/kern/kern_prot.c
  1.60      +12 -11    src/sys/kern/kern_resource.c
  1.84      +2 -2      src/sys/kern/kern_sig.c
  1.52      +4 -12     src/sys/kern/sys_process.c
  1.5       +2 -2      src/sys/miscfs/procfs/procfs_dbregs.c
  1.12      +2 -2      src/sys/miscfs/procfs/procfs_fpregs.c
  1.47      +2 -2      src/sys/miscfs/procfs/procfs_mem.c
  1.11      +2 -2      src/sys/miscfs/procfs/procfs_regs.c
  1.21      +2 -2      src/sys/miscfs/procfs/procfs_status.c
  1.81      +34 -17    src/sys/miscfs/procfs/procfs_vnops.c
  1.109     +13 -4     src/sys/sys/proc.h



To Unsubscribe: send mail to majordomo at trustedbsd.org
with "unsubscribe trustedbsd-discuss" in the body of the message