Aren/NetBSD
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add requests indicating access to unmanaged memory for arm, pc532, powerpc,

Browse Source 
sh3, sh5, and vax, and use them instead of KAUTH_GENERIC_ISSUSER.

Update documentation and example secmodel code.
This commit is contained in:
elad 2006-12-22 11:13:21 +00:00
parent e42e4bd92a
commit 3d11477c94
10 changed files with 264 additions and 37 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

69
share/examples/secmodel/secmodel_example.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: secmodel_example.c,v 1.8 2006/12/14 11:45:08 elad Exp $ */
/* $NetBSD: secmodel_example.c,v 1.9 2006/12/22 11:13:21 elad Exp $ */
/*
* This file is placed in the public domain.
@ -13,7 +13,7 @@
*/
#include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: secmodel_example.c,v 1.8 2006/12/14 11:45:08 elad Exp $");
__KERNEL_RCSID(0, "$NetBSD: secmodel_example.c,v 1.9 2006/12/22 11:13:21 elad Exp $");
#include <sys/types.h>
#include <sys/param.h>
@ -341,19 +341,78 @@ secmodel_example_machdep_cb(kauth_cred_t cred, kauth_action_t action,
void *cookie, void *arg0, void *arg1, void *arg2, void *arg3)
{
int result;
enum kauth_machdep_req req;
result = KAUTH_RESULT_DENY;
req = (enum kauth_machdep_req)arg0;
switch (action) {
case KAUTH_MACHDEP_ALPHA:
switch ((u_long)arg0) {
switch (req) {
case KAUTH_REQ_MACHDEP_ALPHA_UNMANAGEDMEM:
default:
result = KAUTH_RESULT_DEFER;
break;
}
break;
case KAUTH_MACHDEP_ARM:
switch (req) {
case KAUTH_REQ_MACHDEP_ARM_UNMANAGEDMEM:
default:
result = KAUTH_RESULT_DEFER;
break;
}
break;
case KAUTH_MACHDEP_PC532:
switch (req) {
case KAUTH_REQ_MACHDEP_PC532_UNMANAGEDMEM:
default:
result = KAUTH_RESULT_DEFER;
break;
}
break;
case KAUTH_MACHDEP_POWERPC:
switch (req) {
case KAUTH_REQ_MACHDEP_POWERPC_UNMANAGEDMEM:
default:
result = KAUTH_RESULT_DEFER;
break;
}
break;
case KAUTH_MACHDEP_SH3:
switch (req) {
case KAUTH_REQ_MACHDEP_SH3_UNMANAGEDMEM:
default:
result = KAUTH_RESULT_DEFER;
break;
}
break;
case KAUTH_MACHDEP_SH5:
switch (req) {
case KAUTH_REQ_MACHDEP_SH5_UNMANAGEDMEM:
default:
result = KAUTH_RESULT_DEFER;
break;
}
break;
case KAUTH_MACHDEP_VAX:
switch (req) {
case KAUTH_REQ_MACHDEP_VAX_UNMANAGEDMEM:
default:
result = KAUTH_RESULT_DEFER;
break;
}
break;
case KAUTH_MACHDEP_X86:
switch ((u_long)arg0) {
switch (req) {
case KAUTH_REQ_MACHDEP_X86_IOPL:
case KAUTH_REQ_MACHDEP_X86_IOPERM:
case KAUTH_REQ_MACHDEP_X86_MTRR_SET:
@ -366,7 +425,7 @@ secmodel_example_machdep_cb(kauth_cred_t cred, kauth_action_t action,
break;
case KAUTH_MACHDEP_X86_64:
switch ((u_long)arg0) {
switch (req) {
case KAUTH_REQ_MACHDPE_X86_64_MTRR_GET:
default:
result = KAUTH_RESULT_DEFER;

88
share/man/man9/kauth.9
View File

@ -1,4 +1,4 @@
.\" $NetBSD: kauth.9,v 1.39 2006/12/19 09:58:34 elad Exp $
.\" $NetBSD: kauth.9,v 1.40 2006/12/22 11:13:21 elad Exp $
.\"
.\" Copyright (c) 2005, 2006 Elad Efrat <elad@NetBSD.org>
.\" All rights reserved.
@ -28,7 +28,7 @@
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
.Dd December 19, 2006
.Dd December 22, 2006
.Dt KAUTH 9
.Os
.Sh NAME
@ -510,7 +510,9 @@ always indicates the machine for the request.
Below is the list of available request hierarchy.
.Bl -tag
.It Dv KAUTH_MACHDEP_ALPHA
The request is alpha specific.
The request is
.Em alpha
specific.
.Pp
Available requests as
.Ar req
@ -519,8 +521,82 @@ are:
.It Dv KAUTH_REQ_MACHDEP_ALPHA_UNMANAGEDMEM
Access to unmanaged memory requested.
.El
.It Dv KAUTH_MACHDEP_ARM
The request is
.Em arm
specific.
.Pp
Available requests as
.Ar req
are:
.Bl -tag
.It Dv KAUTH_REQ_MACHDEP_ARM_UNMANAGEDMEM
Access to unmanaged memory requested.
.El
.It Dv KAUTH_MACHDEP_PC532
The request is
.Em pc532
specific.
.Pp
Available requests as
.Ar req
are:
.Bl -tag
.It Dv KAUTH_REQ_MACHDEP_PC532_UNMANAGEDMEM
Access to unmanaged memory requested.
.El
.It Dv KAUTH_MACHDEP_POWERPC
The request is
.Em powerpc
specific.
.Pp
Available requests as
.Ar req
are:
.Bl -tag
.It Dv KAUTH_REQ_MACHDEP_POWERPC_UNMANAGEDMEM
Access to unmanaged memory requested.
.El
.It Dv KAUTH_MACHDEP_SH3
The request is
.Em sh3
specific.
.Pp
Available requests as
.Ar req
are:
.Bl -tag
.It Dv KAUTH_REQ_MACHDEP_SH3_UNMANAGEDMEM
Access to unmanaged memory requested.
.El
.It Dv KAUTH_MACHDEP_SH5
The request is
.Em sh5
specific.
.Pp
Available requests as
.Ar req
are:
.Bl -tag
.It Dv KAUTH_REQ_MACHDEP_SH5_UNMANAGEDMEM
Access to unmanaged memory requested.
.El
.It Dv KAUTH_MACHDEP_VAX
The request is
.Em vax
specific.
.Pp
Available requests as
.Ar req
are:
.Bl -tag
.It Dv KAUTH_REQ_MACHDEP_VAX_UNMANAGEDMEM
Access to unmanaged memory requested.
.El
.It Dv KAUTH_MACHDEP_X86
The request is x86 specific.
The request is
.Em x86
specific.
.Pp
Available requests as
.Ar req
@ -536,7 +612,9 @@ Checks if the MTRR can be set.
Access to unmanaged memory requested.
.El
.It Dv KAUTH_MACHDEP_X86_64
The request is x86-64 specific.
The request is
.Em x86-64
specific.
.Pp
Available requests as
.Ar arg1

9
sys/arch/arm/arm32/mem.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: mem.c,v 1.15 2006/07/25 18:43:15 elad Exp $ */
/* $NetBSD: mem.c,v 1.16 2006/12/22 11:13:21 elad Exp $ */
/*
* Copyright (c) 1982, 1986, 1990, 1993
@ -75,7 +75,7 @@
#include "opt_compat_netbsd.h"
#include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: mem.c,v 1.15 2006/07/25 18:43:15 elad Exp $");
__KERNEL_RCSID(0, "$NetBSD: mem.c,v 1.16 2006/12/22 11:13:21 elad Exp $");
#include <sys/param.h>
#include <sys/conf.h>
@ -219,8 +219,9 @@ mmmmap(dev, off, prot)
/* minor device 0 is physical memory */
if (off >= ctob(physmem) && kauth_authorize_generic(l->l_cred,
KAUTH_GENERIC_ISSUSER, &l->l_acflag) != 0)
if (off >= ctob(physmem) && kauth_authorize_machdep(l->l_cred,
KAUTH_MACHDEP_ARM, KAUTH_REQ_MACHDEP_ARM_UNMANAGEDMEM, NULL,
NULL, NULL) != 0)
return -1;
return arm_btop(off);
}

9
sys/arch/pc532/pc532/mem.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: mem.c,v 1.41 2006/07/23 22:06:06 ad Exp $ */
/* $NetBSD: mem.c,v 1.42 2006/12/22 11:13:21 elad Exp $ */
/*
* Copyright (c) 1982, 1986, 1990, 1993
@ -77,7 +77,7 @@
*/
#include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: mem.c,v 1.41 2006/07/23 22:06:06 ad Exp $");
__KERNEL_RCSID(0, "$NetBSD: mem.c,v 1.42 2006/12/22 11:13:21 elad Exp $");
#include <sys/param.h>
#include <sys/conf.h>
@ -209,8 +209,9 @@ mmmmap(dev_t dev, off_t off, int prot)
if (minor(dev) != DEV_MEM)
return (-1);
if ((u_int)off > ctob(physmem) && kauth_authorize_generic(l->l_cred,
KAUTH_GENERIC_ISSUSER, &l->l_acflag) != 0)
if ((u_int)off > ctob(physmem) && kauth_authorize_machdep(l->l_cred,
KAUTH_MACHDEP_PC532, KAUTH_REQ_MACHDEP_PC532_UNMANAGEDMEM, NULL,
NULL, NULL) != 0)
return (-1);
return (ns532_btop((u_int)off));
}

9
sys/arch/powerpc/powerpc/mem.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: mem.c,v 1.25 2006/10/30 17:52:12 garbled Exp $ */
/* $NetBSD: mem.c,v 1.26 2006/12/22 11:13:21 elad Exp $ */
/*
* Copyright (c) 1982, 1986, 1990, 1993
@ -77,7 +77,7 @@
*/
#include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: mem.c,v 1.25 2006/10/30 17:52:12 garbled Exp $");
__KERNEL_RCSID(0, "$NetBSD: mem.c,v 1.26 2006/12/22 11:13:21 elad Exp $");
#include <sys/param.h>
#include <sys/conf.h>
@ -167,8 +167,9 @@ mmmmap(dev_t dev, off_t off, int prot)
if (minor(dev) != DEV_MEM)
return (-1);
if (atop(off) >= physmem && kauth_authorize_generic(l->l_cred,
KAUTH_GENERIC_ISSUSER, &l->l_acflag) != 0)
if (atop(off) >= physmem && kauth_authorize_machdep(l->l_cred,
KAUTH_MACHDEP_POWERPC, KAUTH_REQ_MACHDEP_POWERPC_UNMANAGEDMEM,
NULL, NULL, NULL) != 0)
return (-1);
return (trunc_page((paddr_t)off));
}

9
sys/arch/sh3/sh3/mem.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: mem.c,v 1.21 2006/07/23 22:06:07 ad Exp $ */
/* $NetBSD: mem.c,v 1.22 2006/12/22 11:13:21 elad Exp $ */
/*
* Copyright (c) 2002 The NetBSD Foundation, Inc.
@ -80,7 +80,7 @@
*/
#include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: mem.c,v 1.21 2006/07/23 22:06:07 ad Exp $");
__KERNEL_RCSID(0, "$NetBSD: mem.c,v 1.22 2006/12/22 11:13:21 elad Exp $");
#include <sys/param.h>
#include <sys/systm.h>
@ -193,8 +193,9 @@ mmmmap(dev_t dev, off_t off, int prot)
if (minor(dev) != DEV_MEM)
return (-1);
if (!__mm_mem_addr(off) && kauth_authorize_generic(l->l_cred,
KAUTH_GENERIC_ISSUSER, &l->l_acflag) != 0)
if (!__mm_mem_addr(off) && kauth_authorize_machdep(l->l_cred,
KAUTH_MACHDEP_SH3, KAUTH_REQ_MACHDEP_SH3_UNMANAGEDMEM, NULL,
NULL, NULL) != 0)
return (-1);
return (sh3_btop((paddr_t)off));
}

9
sys/arch/sh5/sh5/mem.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: mem.c,v 1.12 2006/07/23 22:06:07 ad Exp $ */
/* $NetBSD: mem.c,v 1.13 2006/12/22 11:13:21 elad Exp $ */
/*
* Copyright (c) 1982, 1986, 1990, 1993
@ -74,7 +74,7 @@
#include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: mem.c,v 1.12 2006/07/23 22:06:07 ad Exp $");
__KERNEL_RCSID(0, "$NetBSD: mem.c,v 1.13 2006/12/22 11:13:21 elad Exp $");
#include <sys/param.h>
#include <sys/conf.h>
@ -215,8 +215,9 @@ mmmmap(dev, off, prot)
/* minor device 0 is physical memory */
if (off >= ctob(physmem) && kauth_authorize_generic(l->l_cred,
KAUTH_GENERIC_ISSUSER, &l->l_acflag) != 0)
if (off >= ctob(physmem) && kauth_authorize_machdep(l->l_cred,
KAUTH_MACHDEP_SH5, KAUTH_REQ_MACHDEP_SH5_UNMANAGEDMEM, NULL, NULL,
NULL) != 0)
return -1;
return sh5_btop(off);
}

9
sys/arch/vax/vax/mem.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: mem.c,v 1.32 2006/07/23 22:06:08 ad Exp $ */
/* $NetBSD: mem.c,v 1.33 2006/12/22 11:13:21 elad Exp $ */
/*
* Copyright (c) 1982, 1986, 1990, 1993
@ -77,7 +77,7 @@
*/
#include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: mem.c,v 1.32 2006/07/23 22:06:08 ad Exp $");
__KERNEL_RCSID(0, "$NetBSD: mem.c,v 1.33 2006/12/22 11:13:21 elad Exp $");
#include <sys/param.h>
#include <sys/conf.h>
@ -200,8 +200,9 @@ mmmmap(dev_t dev, off_t off, int prot)
if (minor(dev) != DEV_MEM)
return (-1);
if ((u_int)off > ctob(physmem) && kauth_authorize_generic(l->l_cred,
KAUTH_GENERIC_ISSUSER, &l->l_acflag) != 0)
if ((u_int)off > ctob(physmem) && kauth_authorize_machdep(l->l_cred,
KAUTH_MACHDEP_VAX, KAUTH_REQ_MACHDEP_VAX_UNMANAGEDMEM, NULL, NULL,
NULL) != 0)
return (-1);
return (btop((u_int)off));
}

76
sys/secmodel/bsd44/secmodel_bsd44_suser.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: secmodel_bsd44_suser.c,v 1.19 2006/12/19 10:07:00 elad Exp $ */
/* $NetBSD: secmodel_bsd44_suser.c,v 1.20 2006/12/22 11:13:22 elad Exp $ */
/*-
* Copyright (c) 2006 Elad Efrat <elad@NetBSD.org>
* All rights reserved.
@ -41,7 +41,7 @@
*/
#include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: secmodel_bsd44_suser.c,v 1.19 2006/12/19 10:07:00 elad Exp $");
__KERNEL_RCSID(0, "$NetBSD: secmodel_bsd44_suser.c,v 1.20 2006/12/22 11:13:22 elad Exp $");
#include <sys/types.h>
#include <sys/param.h>
@ -535,6 +535,78 @@ secmodel_bsd44_suser_machdep_cb(kauth_cred_t cred, kauth_action_t action,
req = (enum kauth_machdep_req)arg0;
switch (action) {
case KAUTH_MACHDEP_ARM:
switch (req) {
case KAUTH_REQ_MACHDEP_ARM_UNMANAGEDMEM:
if (isroot)
result = KAUTH_RESULT_ALLOW;
break;
default:
result = KAUTH_RESULT_DEFER;
break;
}
break;
case KAUTH_MACHDEP_PC532:
switch (req) {
case KAUTH_REQ_MACHDEP_PC532_UNMANAGEDMEM:
if (isroot)
result = KAUTH_RESULT_ALLOW;
break;
default:
result = KAUTH_RESULT_DEFER;
break;
}
break;
case KAUTH_MACHDEP_POWERPC:
switch (req) {
case KAUTH_REQ_MACHDEP_POWERPC_UNMANAGEDMEM:
if (isroot)
result = KAUTH_RESULT_ALLOW;
break;
default:
result = KAUTH_RESULT_DEFER;
break;
}
break;
case KAUTH_MACHDEP_SH3:
switch (req) {
case KAUTH_REQ_MACHDEP_SH3_UNMANAGEDMEM:
if (isroot)
result = KAUTH_RESULT_ALLOW;
break;
default:
result = KAUTH_RESULT_DEFER;
break;
}
break;
case KAUTH_MACHDEP_SH5:
switch (req) {
case KAUTH_REQ_MACHDEP_SH5_UNMANAGEDMEM:
if (isroot)
result = KAUTH_RESULT_ALLOW;
break;
default:
result = KAUTH_RESULT_DEFER;
break;
}
break;
case KAUTH_MACHDEP_VAX:
switch (req) {
case KAUTH_REQ_MACHDEP_VAX_UNMANAGEDMEM:
if (isroot)
result = KAUTH_RESULT_ALLOW;
break;
default:
result = KAUTH_RESULT_DEFER;
break;
}
break;
case KAUTH_MACHDEP_X86:
switch (req) {
case KAUTH_REQ_MACHDEP_X86_IOPL:

14
sys/sys/kauth.h
View File

@ -1,4 +1,4 @@
/* $NetBSD: kauth.h,v 1.27 2006/12/19 09:58:35 elad Exp $ */
/* $NetBSD: kauth.h,v 1.28 2006/12/22 11:13:22 elad Exp $ */
/*-
* Copyright (c) 2005, 2006 Elad Efrat <elad@NetBSD.org>
@ -187,6 +187,12 @@ enum kauth_network_req {
*/
enum {
KAUTH_MACHDEP_ALPHA=1,
KAUTH_MACHDEP_ARM,
KAUTH_MACHDEP_PC532,
KAUTH_MACHDEP_POWERPC,
KAUTH_MACHDEP_SH3,
KAUTH_MACHDEP_SH5,
KAUTH_MACHDEP_VAX,
KAUTH_MACHDEP_X86,
KAUTH_MACHDEP_X86_64
};
@ -196,6 +202,12 @@ enum {
*/
enum kauth_machdep_req {
KAUTH_REQ_MACHDEP_ALPHA_UNMANAGEDMEM=1,
KAUTH_REQ_MACHDEP_ARM_UNMANAGEDMEM,
KAUTH_REQ_MACHDEP_PC532_UNMANAGEDMEM,
KAUTH_REQ_MACHDEP_POWERPC_UNMANAGEDMEM,
KAUTH_REQ_MACHDEP_SH3_UNMANAGEDMEM,
KAUTH_REQ_MACHDEP_SH5_UNMANAGEDMEM,
KAUTH_REQ_MACHDEP_VAX_UNMANAGEDMEM,
KAUTH_REQ_MACHDEP_X86_64_MTRR_GET, /* ridiculous. */
KAUTH_REQ_MACHDEP_X86_IOPERM,
KAUTH_REQ_MACHDEP_X86_IOPL,