Aren
/
NetBSD
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Catch up with ktrace-lwp merge. 

While I'm here, stop using cur{lwp,proc}.
This commit is contained in:
elad 2005-12-12 16:26:33 +00:00
parent 3de4cab6f7
commit 6590e0e201
5 changed files with 55 additions and 55 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
sys/dev/verified_exec.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: verified_exec.c,v 1.29 2005/12/11 12:20:53 christos Exp $ */ /* $NetBSD: verified_exec.c,v 1.30 2005/12/12 16:26:33 elad Exp $ */
/*- /*-
* Copyright 2005 Elad Efrat <elad@bsd.org.il> * Copyright 2005 Elad Efrat <elad@bsd.org.il>
@ -31,9 +31,9 @@
#include <sys/cdefs.h> #include <sys/cdefs.h>
#if defined(__NetBSD__) #if defined(__NetBSD__)
__KERNEL_RCSID(0, "$NetBSD: verified_exec.c,v 1.29 2005/12/11 12:20:53 christos Exp $"); __KERNEL_RCSID(0, "$NetBSD: verified_exec.c,v 1.30 2005/12/12 16:26:33 elad Exp $");
#else #else
__RCSID("$Id: verified_exec.c,v 1.29 2005/12/11 12:20:53 christos Exp $\n$NetBSD: verified_exec.c,v 1.29 2005/12/11 12:20:53 christos Exp $"); __RCSID("$Id: verified_exec.c,v 1.30 2005/12/12 16:26:33 elad Exp $\n$NetBSD: verified_exec.c,v 1.30 2005/12/12 16:26:33 elad Exp $");
#endif #endif
#include <sys/param.h> #include <sys/param.h>
@ -145,7 +145,7 @@ veriexecopen(dev_t dev __unused, int flags __unused,
int int
veriexecclose(dev_t dev __unused, int flags __unused, veriexecclose(dev_t dev __unused, int flags __unused,
int fmt __unused, struct proc *p __unused) int fmt __unused, struct lwp *l __unused)
{ {
if (veriexec_dev_usage > 0) if (veriexec_dev_usage > 0)
veriexec_dev_usage--; veriexec_dev_usage--;
@ -172,7 +172,7 @@ veriexecioctl(dev_t dev __unused, u_long cmd, caddr_t data,
break; break;
case VERIEXEC_LOAD: case VERIEXEC_LOAD:
error = veriexec_load((struct veriexec_params *)data, p); error = veriexec_load((struct veriexec_params *)data, l);
break; break;
case VERIEXEC_DELETE: case VERIEXEC_DELETE:
@ -233,7 +233,7 @@ veriexec_newtable(struct veriexec_sizing_params *params)
} }
int int
veriexec_load(struct veriexec_params *params, struct proc *p) veriexec_load(struct veriexec_params *params, struct lwp *l)
{ {
struct veriexec_hashtbl *tbl; struct veriexec_hashtbl *tbl;
struct veriexec_hash_entry *hh; struct veriexec_hash_entry *hh;
@ -242,7 +242,7 @@ veriexec_load(struct veriexec_params *params, struct proc *p)
struct vattr va; struct vattr va;
int error; int error;
NDINIT(&nid, LOOKUP, FOLLOW, UIO_SYSSPACE, params->file, p); NDINIT(&nid, LOOKUP, FOLLOW, UIO_SYSSPACE, params->file, l);
error = namei(&nid); error = namei(&nid);
if (error) if (error)
return (error); return (error);
@ -256,7 +256,7 @@ veriexec_load(struct veriexec_params *params, struct proc *p)
} }
/* Get attributes for device and inode. */ /* Get attributes for device and inode. */
error = VOP_GETATTR(nid.ni_vp, &va, p->p_ucred, p); error = VOP_GETATTR(nid.ni_vp, &va, l->l_proc->p_ucred, l);
if (error) if (error)
return (error); return (error);

57
sys/kern/kern_verifiedexec.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: kern_verifiedexec.c,v 1.47 2005/12/08 22:41:45 yamt Exp $ */ /* $NetBSD: kern_verifiedexec.c,v 1.48 2005/12/12 16:26:33 elad Exp $ */
/*- /*-
* Copyright 2005 Elad Efrat <elad@bsd.org.il> * Copyright 2005 Elad Efrat <elad@bsd.org.il>
@ -30,7 +30,7 @@
*/ */
#include <sys/cdefs.h> #include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: kern_verifiedexec.c,v 1.47 2005/12/08 22:41:45 yamt Exp $"); __KERNEL_RCSID(0, "$NetBSD: kern_verifiedexec.c,v 1.48 2005/12/12 16:26:33 elad Exp $");
#include "opt_verified_exec.h" #include "opt_verified_exec.h"
@ -207,7 +207,7 @@ veriexec_find_ops(u_char *name)
* extracted from veriexec_hash_list according to the hash type. * extracted from veriexec_hash_list according to the hash type.
*/ */
int int
veriexec_fp_calc(struct proc *p, struct vnode *vp, veriexec_fp_calc(struct lwp *l, struct vnode *vp,
struct veriexec_hash_entry *vhe, uint64_t size, u_char *fp) struct veriexec_hash_entry *vhe, uint64_t size, u_char *fp)
{ {
void *ctx, *page_ctx; void *ctx, *page_ctx;
@ -259,7 +259,7 @@ veriexec_fp_calc(struct proc *p, struct vnode *vp,
#else #else
0, 0,
#endif #endif
p->p_ucred, &resid, NULL); l->l_proc->p_ucred, &resid, NULL);
if (error) { if (error) {
if (do_perpage) { if (do_perpage) {
@ -403,7 +403,7 @@ veriexec_hashadd(struct veriexec_hashtbl *tbl, struct veriexec_hash_entry *e)
* vn_open(), 'flag' will be VERIEXEC_FILE. * vn_open(), 'flag' will be VERIEXEC_FILE.
*/ */
int int
veriexec_verify(struct proc *p, struct vnode *vp, struct vattr *va, veriexec_verify(struct lwp *l, struct vnode *vp, struct vattr *va,
const u_char *name, int flag, struct veriexec_hash_entry **ret) const u_char *name, int flag, struct veriexec_hash_entry **ret)
{ {
struct veriexec_hash_entry *vhe; struct veriexec_hash_entry *vhe;
@ -428,7 +428,7 @@ veriexec_verify(struct proc *p, struct vnode *vp, struct vattr *va,
/* Calculate fingerprint for on-disk file. */ /* Calculate fingerprint for on-disk file. */
digest = (u_char *) malloc(vhe->ops->hash_len, M_TEMP, digest = (u_char *) malloc(vhe->ops->hash_len, M_TEMP,
M_WAITOK); M_WAITOK);
error = veriexec_fp_calc(p, vp, vhe, va->va_size, digest); error = veriexec_fp_calc(l, vp, vhe, va->va_size, digest);
if (error) { if (error) {
veriexec_report("Fingerprint calculation error.", veriexec_report("Fingerprint calculation error.",
name, va, NULL, REPORT_NOVERBOSE, name, va, NULL, REPORT_NOVERBOSE,
@ -448,7 +448,7 @@ veriexec_verify(struct proc *p, struct vnode *vp, struct vattr *va,
} }
if (!(vhe->type & flag)) { if (!(vhe->type & flag)) {
veriexec_report("Incorrect access type.", name, va, p, veriexec_report("Incorrect access type.", name, va, l,
REPORT_NOVERBOSE, REPORT_ALARM, REPORT_NOVERBOSE, REPORT_ALARM,
REPORT_NOPANIC); REPORT_NOPANIC);
@ -461,7 +461,7 @@ out:
/* No entry in the veriexec tables. */ /* No entry in the veriexec tables. */
if (vhe == NULL) { if (vhe == NULL) {
veriexec_report("veriexec_verify: No entry.", name, va, veriexec_report("veriexec_verify: No entry.", name, va,
p, REPORT_VERBOSE, REPORT_NOALARM, REPORT_NOPANIC); l, REPORT_VERBOSE, REPORT_NOALARM, REPORT_NOPANIC);
/* Lockdown mode: Deny access to non-monitored files. */ /* Lockdown mode: Deny access to non-monitored files. */
if (veriexec_strict >= 3) if (veriexec_strict >= 3)
@ -513,7 +513,7 @@ out:
*/ */
int int
veriexec_page_verify(struct veriexec_hash_entry *vhe, struct vattr *va, veriexec_page_verify(struct veriexec_hash_entry *vhe, struct vattr *va,
struct vm_page *pg, size_t idx) struct vm_page *pg, size_t idx, struct lwp *l)
{ {
void *ctx; void *ctx;
u_char *fp; u_char *fp;
@ -556,7 +556,6 @@ veriexec_page_verify(struct veriexec_hash_entry *vhe, struct vattr *va,
error = veriexec_fp_cmp(vhe->ops, page_fp, fp); error = veriexec_fp_cmp(vhe->ops, page_fp, fp);
if (error) { if (error) {
struct proc *p;
const char *msg; const char *msg;
if (veriexec_strict > 0) { if (veriexec_strict > 0) {
@ -566,8 +565,7 @@ veriexec_page_verify(struct veriexec_hash_entry *vhe, struct vattr *va,
error = 0; error = 0;
} }
p = curlwp->l_proc; veriexec_report(msg, "[page_in]", va, l, REPORT_NOVERBOSE,
veriexec_report(msg, "[page_in]", va, p, REPORT_NOVERBOSE,
REPORT_ALARM, REPORT_NOPANIC); REPORT_ALARM, REPORT_NOPANIC);
if (error) { if (error) {
@ -576,10 +574,10 @@ veriexec_page_verify(struct veriexec_hash_entry *vhe, struct vattr *va,
KSI_INIT(&ksi); KSI_INIT(&ksi);
ksi.ksi_signo = SIGKILL; ksi.ksi_signo = SIGKILL;
ksi.ksi_code = SI_NOINFO; ksi.ksi_code = SI_NOINFO;
ksi.ksi_pid = p->p_pid; ksi.ksi_pid = l->l_proc->p_pid;
ksi.ksi_uid = 0; ksi.ksi_uid = 0;
kpsignal(p, &ksi, NULL); kpsignal(l->l_proc, &ksi, NULL);
} }
} }
@ -594,14 +592,14 @@ bad:
* Veriexec remove policy code. * Veriexec remove policy code.
*/ */
int int
veriexec_removechk(struct proc *p, struct vnode *vp, const char *pathbuf) veriexec_removechk(struct lwp *l, struct vnode *vp, const char *pathbuf)
{ {
struct veriexec_hashtbl *tbl; struct veriexec_hashtbl *tbl;
struct veriexec_hash_entry *vhe; struct veriexec_hash_entry *vhe;
struct vattr va; struct vattr va;
int error; int error;
error = VOP_GETATTR(vp, &va, p->p_ucred, p); error = VOP_GETATTR(vp, &va, l->l_proc->p_ucred, l);
if (error) if (error)
return (error); return (error);
@ -614,7 +612,7 @@ veriexec_removechk(struct proc *p, struct vnode *vp, const char *pathbuf)
return (0); return (0);
} }
veriexec_report("Remove request.", pathbuf, &va, p, veriexec_report("Remove request.", pathbuf, &va, l,
REPORT_NOVERBOSE, REPORT_ALARM, REPORT_NOPANIC); REPORT_NOVERBOSE, REPORT_ALARM, REPORT_NOPANIC);
/* IPS mode: Deny removal of monitored files. */ /* IPS mode: Deny removal of monitored files. */
@ -644,15 +642,14 @@ veriexec_removechk(struct proc *p, struct vnode *vp, const char *pathbuf)
* Veriexe rename policy. * Veriexe rename policy.
*/ */
int int
veriexec_renamechk(struct vnode *vp, const char *from, const char *to) veriexec_renamechk(struct vnode *vp, const char *from, const char *to,
struct lwp *l)
{ {
struct proc *p;
struct veriexec_hash_entry *vhe; struct veriexec_hash_entry *vhe;
struct vattr va; struct vattr va;
int error; int error;
p = curlwp->l_proc; error = VOP_GETATTR(vp, &va, l->l_proc->p_ucred, l);
error = VOP_GETATTR(vp, &va, p->p_ucred, p);
if (error) if (error)
return (error); return (error);
@ -661,11 +658,11 @@ veriexec_renamechk(struct vnode *vp, const char *from, const char *to)
"of \"%s\" [%ld:%llu] to \"%s\", uid=%u, pid=%u: " "of \"%s\" [%ld:%llu] to \"%s\", uid=%u, pid=%u: "
"Lockdown mode.\n", from, va.va_fsid, "Lockdown mode.\n", from, va.va_fsid,
(unsigned long long)va.va_fileid, (unsigned long long)va.va_fileid,
to, p->p_ucred->cr_uid, p->p_pid); to, l->l_proc->p_ucred->cr_uid, l->l_proc->p_pid);
return (EPERM); return (EPERM);
} }
vhe = veriexec_lookup((dev_t)va.va_fsid, (ino_t)va.va_fileid); vhe = veriexec_lookup(va.va_fsid, va.va_fileid);
if (vhe != NULL) { if (vhe != NULL) {
if (veriexec_strict >= 2) { if (veriexec_strict >= 2) {
printf("Veriexec: veriexec_renamechk: Preventing " printf("Veriexec: veriexec_renamechk: Preventing "
@ -673,14 +670,15 @@ veriexec_renamechk(struct vnode *vp, const char *from, const char *to)
"uid=%u, pid=%u: IPS mode, file " "uid=%u, pid=%u: IPS mode, file "
"monitored.\n", from, va.va_fsid, "monitored.\n", from, va.va_fsid,
(unsigned long long)va.va_fileid, (unsigned long long)va.va_fileid,
to, p->p_ucred->cr_uid, p->p_pid); to, l->l_proc->p_ucred->cr_uid,
l->l_proc->p_pid);
return (EPERM); return (EPERM);
} }
printf("Veriexec: veriexec_rename: Monitored file \"%s\" " printf("Veriexec: veriexec_rename: Monitored file \"%s\" "
"[%ld:%llu] renamed to \"%s\", uid=%u, pid=%u.\n", "[%ld:%llu] renamed to \"%s\", uid=%u, pid=%u.\n",
from, va.va_fsid, (unsigned long long)va.va_fileid, to, from, va.va_fsid, (unsigned long long)va.va_fileid, to,
p->p_ucred->cr_uid, p->p_pid); l->l_proc->p_ucred->cr_uid, l->l_proc->p_pid);
} }
return (0); return (0);
@ -698,7 +696,7 @@ veriexec_renamechk(struct vnode *vp, const char *from, const char *to)
*/ */
void void
veriexec_report(const u_char *msg, const u_char *filename, veriexec_report(const u_char *msg, const u_char *filename,
struct vattr *va, struct proc *p, int verbose, int alarm, struct vattr *va, struct lwp *l, int verbose, int alarm,
int die) int die)
{ {
void (*f)(const char *, ...); void (*f)(const char *, ...);
@ -712,14 +710,15 @@ veriexec_report(const u_char *msg, const u_char *filename,
f = (void (*)(const char *, ...)) printf; f = (void (*)(const char *, ...)) printf;
if (!verbose || (verbose <= veriexec_verbose)) { if (!verbose || (verbose <= veriexec_verbose)) {
if (!alarm || p == NULL) if (!alarm || l == NULL)
f("veriexec: %s [%s, %ld:%" PRIu64 "%s", msg, filename, f("veriexec: %s [%s, %ld:%" PRIu64 "%s", msg, filename,
va->va_fsid, va->va_fileid, va->va_fsid, va->va_fileid,
die ? "]" : "]\n"); die ? "]" : "]\n");
else else
f("veriexec: %s [%s, %ld:%" PRIu64 ", pid=%u, uid=%u, " f("veriexec: %s [%s, %ld:%" PRIu64 ", pid=%u, uid=%u, "
"gid=%u%s", msg, filename, va->va_fsid, "gid=%u%s", msg, filename, va->va_fsid,
va->va_fileid, p->p_pid, p->p_cred->p_ruid, va->va_fileid, l->l_proc->p_pid,
p->p_cred->p_rgid, die ? "]" : "]\n"); l->l_proc->p_cred->p_ruid,
l->l_proc->p_cred->p_rgid, die ? "]" : "]\n");
} }
} }

8
sys/kern/vfs_syscalls.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: vfs_syscalls.c,v 1.234 2005/12/11 12:24:30 christos Exp $ */ /* $NetBSD: vfs_syscalls.c,v 1.235 2005/12/12 16:26:33 elad Exp $ */
/* /*
* Copyright (c) 1989, 1993 * Copyright (c) 1989, 1993
@ -37,7 +37,7 @@
*/ */
#include <sys/cdefs.h> #include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: vfs_syscalls.c,v 1.234 2005/12/11 12:24:30 christos Exp $"); __KERNEL_RCSID(0, "$NetBSD: vfs_syscalls.c,v 1.235 2005/12/12 16:26:33 elad Exp $");
#include "opt_compat_netbsd.h" #include "opt_compat_netbsd.h"
#include "opt_compat_43.h" #include "opt_compat_43.h"
@ -1793,7 +1793,7 @@ restart:
#ifdef VERIFIED_EXEC #ifdef VERIFIED_EXEC
/* Handle remove requests for veriexec entries. */ /* Handle remove requests for veriexec entries. */
if ((error = veriexec_removechk(p, vp, nd.ni_dirp)) != 0) { if ((error = veriexec_removechk(l, vp, nd.ni_dirp)) != 0) {
VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd); VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
if (nd.ni_dvp == vp) if (nd.ni_dvp == vp)
vrele(nd.ni_dvp); vrele(nd.ni_dvp);
@ -3120,7 +3120,7 @@ rename_files(const char *from, const char *to, struct lwp *l, int retain)
#ifdef VERIFIED_EXEC #ifdef VERIFIED_EXEC
if (!error) if (!error)
error = veriexec_renamechk(fvp, fromnd.ni_dirp, tond.ni_dirp); error = veriexec_renamechk(fvp, fromnd.ni_dirp, tond.ni_dirp, l);
#endif /* VERIFIED_EXEC */ #endif /* VERIFIED_EXEC */
out: out:

6
sys/kern/vfs_vnops.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: vfs_vnops.c,v 1.101 2005/12/11 12:24:30 christos Exp $ */ /* $NetBSD: vfs_vnops.c,v 1.102 2005/12/12 16:26:33 elad Exp $ */
/* /*
* Copyright (c) 1982, 1986, 1989, 1993 * Copyright (c) 1982, 1986, 1989, 1993
@ -37,7 +37,7 @@
*/ */
#include <sys/cdefs.h> #include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: vfs_vnops.c,v 1.101 2005/12/11 12:24:30 christos Exp $"); __KERNEL_RCSID(0, "$NetBSD: vfs_vnops.c,v 1.102 2005/12/12 16:26:33 elad Exp $");
#include "opt_verified_exec.h" #include "opt_verified_exec.h"
@ -228,7 +228,7 @@ restart:
#ifdef VERIFIED_EXEC #ifdef VERIFIED_EXEC
if (vhe != NULL) { if (vhe != NULL) {
veriexec_report("Write access request.", veriexec_report("Write access request.",
pathbuf, &va, p, pathbuf, &va, l,
REPORT_NOVERBOSE, REPORT_NOVERBOSE,
REPORT_ALARM, REPORT_ALARM,
REPORT_NOPANIC); REPORT_NOPANIC);

23
sys/sys/verified_exec.h
View File

@ -1,4 +1,4 @@
/* $NetBSD: verified_exec.h,v 1.26 2005/12/12 15:00:51 elad Exp $ */ /* $NetBSD: verified_exec.h,v 1.27 2005/12/12 16:26:34 elad Exp $ */
/*- /*-
* Copyright 2005 Elad Efrat <elad@bsd.org.il> * Copyright 2005 Elad Efrat <elad@bsd.org.il>
@ -79,9 +79,9 @@ struct veriexec_delete_params {
#ifdef _KERNEL #ifdef _KERNEL
void veriexecattach(struct device *, struct device *, void *); void veriexecattach(struct device *, struct device *, void *);
int veriexecopen(dev_t, int, int, struct proc *); int veriexecopen(dev_t, int, int, struct lwp *);
int veriexecclose(dev_t, int, int, struct proc *); int veriexecclose(dev_t, int, int, struct lwp *);
int veriexecioctl(dev_t, u_long, caddr_t, int, struct proc *); int veriexecioctl(dev_t, u_long, caddr_t, int, struct lwp *);
/* defined in kern_verifiedexec.c */ /* defined in kern_verifiedexec.c */
extern char *veriexec_fp_names; extern char *veriexec_fp_names;
@ -184,23 +184,24 @@ LIST_HEAD(, veriexec_hashtbl) veriexec_tables;
int veriexec_add_fp_ops(struct veriexec_fp_ops *); int veriexec_add_fp_ops(struct veriexec_fp_ops *);
void veriexec_init_fp_ops(void); void veriexec_init_fp_ops(void);
struct veriexec_fp_ops *veriexec_find_ops(u_char *name); struct veriexec_fp_ops *veriexec_find_ops(u_char *name);
int veriexec_fp_calc(struct proc *, struct vnode *, int veriexec_fp_calc(struct lwp *, struct vnode *,
struct veriexec_hash_entry *, uint64_t, u_char *); struct veriexec_hash_entry *, uint64_t, u_char *);
int veriexec_fp_cmp(struct veriexec_fp_ops *, u_char *, u_char *); int veriexec_fp_cmp(struct veriexec_fp_ops *, u_char *, u_char *);
struct veriexec_hashtbl *veriexec_tblfind(dev_t); struct veriexec_hashtbl *veriexec_tblfind(dev_t);
struct veriexec_hash_entry *veriexec_lookup(dev_t, ino_t); struct veriexec_hash_entry *veriexec_lookup(dev_t, ino_t);
int veriexec_hashadd(struct veriexec_hashtbl *, struct veriexec_hash_entry *); int veriexec_hashadd(struct veriexec_hashtbl *, struct veriexec_hash_entry *);
int veriexec_verify(struct proc *, struct vnode *, struct vattr *, int veriexec_verify(struct lwp *, struct vnode *, struct vattr *,
const u_char *, int, struct veriexec_hash_entry **); const u_char *, int, struct veriexec_hash_entry **);
int veriexec_page_verify(struct veriexec_hash_entry *, struct vattr *, int veriexec_page_verify(struct veriexec_hash_entry *, struct vattr *,
struct vm_page *, size_t); struct vm_page *, size_t, struct lwp *);
int veriexec_removechk(struct proc *, struct vnode *, const char *); int veriexec_removechk(struct lwp *, struct vnode *, const char *);
int veriexec_renamechk(struct vnode *, const char *, const char *); int veriexec_renamechk(struct vnode *, const char *, const char *,
struct lwp *);
void veriexec_init_fp_ops(void); void veriexec_init_fp_ops(void);
void veriexec_report(const u_char *, const u_char *, struct vattr *, void veriexec_report(const u_char *, const u_char *, struct vattr *,
struct proc *, int, int, int); struct lwp *, int, int, int);
int veriexec_newtable(struct veriexec_sizing_params *); int veriexec_newtable(struct veriexec_sizing_params *);
int veriexec_load(struct veriexec_params *, struct proc *); int veriexec_load(struct veriexec_params *, struct lwp *);
int veriexec_delete(struct veriexec_delete_params *); int veriexec_delete(struct veriexec_delete_params *);
#endif /* _KERNEL */ #endif /* _KERNEL */