Aren/NetBSD
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
6700cfccd6
NetBSD/etc
History
elad 6700cfccd6 Some Veriexec stuff that's been rotting in my tree for months. 
Bug fixes:
  - Fix crash reported by Scott Ellis on current-users@.

  - Fix race conditions in enforcing the Veriexec rename and remove
    policies. These are NOT security issues.

  - Fix memory leak in rename handling when overwriting a monitored
    file.

  - Fix table deletion logic.

  - Don't prevent query requests if not in learning mode.


KPI updates:
  - fileassoc_table_run() now takes a cookie to pass to the callback.

  - veriexec_table_add() was removed, it is now done internally. As a
    result, there's no longer a need for VERIEXEC_TABLESIZE.

  - veriexec_report() was removed, it is now internal.

  - Perform sanity checks on the entry type, and enforce default type
    in veriexec_file_add() rather than in veriexecctl.

  - Add veriexec_flush(), used to delete all Veriexec tables, and
    veriexec_dump(), used to fill an array with all Veriexec entries.


New features:
  - Add a '-k' flag to veriexecctl, to keep the filenames in the kernel
    database. This allows Veriexec to produce slightly more accurate
    logs under certain circumstances. In the future, this can be either
    replaced by vnode->pathname translation, or combined with it.

  - Add a VERIEXEC_DUMP ioctl, to dump the entire Veriexec database.
    This can be used to recover a database if the file was lost.
    Example usage:

        # veriexecctl dump > /etc/signatures

    Note that only entries with the filename kept (that is, were loaded
    with the '-k' flag) will be dumped.

    Idea from Brett Lymn.

  - Add a VERIEXEC_FLUSH ioctl, to delete all Veriexec entries. Sample
    usage:

        # veriexecctl flush

  - Add a 'veriexec_flags' rc(8) variable, and make its default have
    the '-k' flag. On systems using the default signatures file
    (generaetd from running 'veriexecgen' with no arguments), this will
    use additional 32kb of kernel memory on average.

  - Add a '-e' flag to veriexecctl, to evaluate the fingerprint during
    load. This is done automatically for files marked as 'untrusted'.


Misc. stuff:
  - The code for veriexecctl was massively simplified as a result of
    eliminating the need for VERIEXEC_TABLESIZE, and now uses a single
    pass of the signatures file, making the loading somewhat faster.

  - Lots of minor fixes found using the (still under development)
    Veriexec regression testsuite.

  - Some of the messages Veriexec prints were improved.

  - Various documentation fixes.


All relevant man-pages were updated to reflect the above changes.

Binary compatibility with existing veriexecctl binaries is maintained.
2007-05-15 19:47:43 +00:00
..
bluetooth Supprot Bluetooth HCI UART (H4) driver and daemon. 2007-02-20 16:53:20 +00:00
defaults Some Veriexec stuff that's been rotting in my tree for months. 2007-05-15 19:47:43 +00:00
etc.acorn26 remove ad-hok list of pty's from port tty files, and auto-generate it so 2004-06-20 21:30:26 +00:00
etc.acorn32 Fix MAKEDEV on shark: Move ses(4) devices from MI code (MAKEDEV.tmpl) to 2007-01-15 23:35:11 +00:00
etc.algor Fix MAKEDEV on shark: Move ses(4) devices from MI code (MAKEDEV.tmpl) to 2007-01-15 23:35:11 +00:00
etc.alpha Fix MAKEDEV on shark: Move ses(4) devices from MI code (MAKEDEV.tmpl) to 2007-01-15 23:35:11 +00:00
etc.amd64 For the benefit of modern hardware, enable ACPI by default in INSTALL and 2007-03-06 21:47:45 +00:00
etc.amiga Fix MAKEDEV on shark: Move ses(4) devices from MI code (MAKEDEV.tmpl) to 2007-01-15 23:35:11 +00:00
etc.amigappc don't build any kernels, for now 2006-01-14 23:05:28 +00:00
etc.arc Fix MAKEDEV on shark: Move ses(4) devices from MI code (MAKEDEV.tmpl) to 2007-01-15 23:35:11 +00:00
etc.atari Fix MAKEDEV on shark: Move ses(4) devices from MI code (MAKEDEV.tmpl) to 2007-01-15 23:35:11 +00:00
etc.bebox Fix MAKEDEV on shark: Move ses(4) devices from MI code (MAKEDEV.tmpl) to 2007-01-15 23:35:11 +00:00
etc.cats As requested in PR port-cats/30460 add support for GENERIC.ABLE kernel to 2005-08-07 00:21:38 +00:00
etc.cesfic remove ad-hok list of pty's from port tty files, and auto-generate it so 2004-06-20 21:30:26 +00:00
etc.cobalt Create /dev/pci0. 2007-03-04 10:36:00 +00:00
etc.dreamcast Only make bpf, not bpfN 2004-12-02 16:44:28 +00:00
etc.evbarm Add CP3100 and CP3100_INSTALL to kernel/build sets. 2006-11-09 00:34:49 +00:00
etc.evbmips Fix MAKEDEV on shark: Move ses(4) devices from MI code (MAKEDEV.tmpl) to 2007-01-15 23:35:11 +00:00
etc.evbppc Fix MAKEDEV on shark: Move ses(4) devices from MI code (MAKEDEV.tmpl) to 2007-01-15 23:35:11 +00:00
etc.evbsh3 Only make bpf, not bpfN 2004-12-02 16:44:28 +00:00
etc.ews4800mips Install bootloader binaries into ${RELEASEDIR} for netboot. 2006-01-09 01:36:29 +00:00
etc.hp300 Fix MAKEDEV on shark: Move ses(4) devices from MI code (MAKEDEV.tmpl) to 2007-01-15 23:35:11 +00:00
etc.hp700 Fix MAKEDEV on shark: Move ses(4) devices from MI code (MAKEDEV.tmpl) to 2007-01-15 23:35:11 +00:00
etc.hpcarm Fix MAKEDEV on shark: Move ses(4) devices from MI code (MAKEDEV.tmpl) to 2007-01-15 23:35:11 +00:00
etc.hpcmips Fix MAKEDEV on shark: Move ses(4) devices from MI code (MAKEDEV.tmpl) to 2007-01-15 23:35:11 +00:00
etc.hpcsh Spell "baud" correctly. 2006-04-06 22:31:11 +00:00
etc.i386 For the benefit of modern hardware, enable ACPI by default in INSTALL and 2007-03-06 21:47:45 +00:00
etc.ibmnws Fix MAKEDEV on shark: Move ses(4) devices from MI code (MAKEDEV.tmpl) to 2007-01-15 23:35:11 +00:00
etc.iyonix Don't declare ptys in tty's. None of the other ports do this. 2004-11-08 19:59:07 +00:00
etc.landisk Add an INSTALL kernel for landisk and enable building it. 2007-05-02 08:02:00 +00:00
etc.luna68k remove ad-hok list of pty's from port tty files, and auto-generate it so 2004-06-20 21:30:26 +00:00
etc.mac68k Make iso-image do nothing for all but mac68k, which still 2007-03-06 21:59:40 +00:00
etc.macppc Fix MAKEDEV on shark: Move ses(4) devices from MI code (MAKEDEV.tmpl) to 2007-01-15 23:35:11 +00:00
etc.mipsco Fix MAKEDEV on shark: Move ses(4) devices from MI code (MAKEDEV.tmpl) to 2007-01-15 23:35:11 +00:00
etc.mmeye Fix MAKEDEV on shark: Move ses(4) devices from MI code (MAKEDEV.tmpl) to 2007-01-15 23:35:11 +00:00
etc.mvme68k Fix MAKEDEV on shark: Move ses(4) devices from MI code (MAKEDEV.tmpl) to 2007-01-15 23:35:11 +00:00
etc.mvmeppc Fix MAKEDEV on shark: Move ses(4) devices from MI code (MAKEDEV.tmpl) to 2007-01-15 23:35:11 +00:00
etc.netwinder remove ad-hok list of pty's from port tty files, and auto-generate it so 2004-06-20 21:30:26 +00:00
etc.news68k Do ${MAKESUMS} for install floppies. 2006-01-22 14:42:34 +00:00
etc.newsmips Do ${MAKESUMS} for install floppies. 2006-01-22 14:42:34 +00:00
etc.next68k Fix MAKEDEV on shark: Move ses(4) devices from MI code (MAKEDEV.tmpl) to 2007-01-15 23:35:11 +00:00
etc.ofppc Fix MAKEDEV on shark: Move ses(4) devices from MI code (MAKEDEV.tmpl) to 2007-01-15 23:35:11 +00:00
etc.pc532 Fix MAKEDEV on shark: Move ses(4) devices from MI code (MAKEDEV.tmpl) to 2007-01-15 23:35:11 +00:00
etc.playstation2 remove ad-hok list of pty's from port tty files, and auto-generate it so 2004-06-20 21:30:26 +00:00
etc.pmax Remove 'makedev mouse'. 2006-09-06 11:09:58 +00:00
etc.pmppc Fix MAKEDEV on shark: Move ses(4) devices from MI code (MAKEDEV.tmpl) to 2007-01-15 23:35:11 +00:00
etc.prep Create /dev/residual on prep 2007-03-21 04:26:07 +00:00
etc.sandpoint Fix MAKEDEV on shark: Move ses(4) devices from MI code (MAKEDEV.tmpl) to 2007-01-15 23:35:11 +00:00
etc.sbmips Only make bpf, not bpfN 2004-12-02 16:44:28 +00:00
etc.sgimips Recent versions of mkisofs (I've tested starting with cdrtools-2.01.01a20) 2007-03-16 21:12:17 +00:00
etc.shark Convert shark's installation kernel image (netbsd-INSTALL) to a.out format 2007-03-10 17:57:41 +00:00
etc.sparc Fix MAKEDEV on shark: Move ses(4) devices from MI code (MAKEDEV.tmpl) to 2007-01-15 23:35:11 +00:00
etc.sparc64 Fix MAKEDEV on shark: Move ses(4) devices from MI code (MAKEDEV.tmpl) to 2007-01-15 23:35:11 +00:00
etc.sun2 remove ad-hok list of pty's from port tty files, and auto-generate it so 2004-06-20 21:30:26 +00:00
etc.sun3 remove ad-hok list of pty's from port tty files, and auto-generate it so 2004-06-20 21:30:26 +00:00
etc.vax Replace hexprint with a version that is much faster for values > 15. 2007-03-09 19:16:47 +00:00
etc.x68k Fix MAKEDEV on shark: Move ses(4) devices from MI code (MAKEDEV.tmpl) to 2007-01-15 23:35:11 +00:00
etc.zaurus Fix MAKEDEV on shark: Move ses(4) devices from MI code (MAKEDEV.tmpl) to 2007-01-15 23:35:11 +00:00
iscsi add support for MKISCSI=no. 2006-06-24 05:14:01 +00:00
mtree Move .db files for services and netgroup to /var/db per gimpy's request. 2007-05-10 17:45:50 +00:00
namedb Move "named.conf" example configuration to "/etc" because that is where 2005-08-30 10:58:33 +00:00
pam.d Fix spelling/typo. 2007-02-10 19:40:10 +00:00
powerd fix a couple of comments 2006-09-27 01:41:45 +00:00
rc.d Some Veriexec stuff that's been rotting in my tree for months. 2007-05-15 19:47:43 +00:00
root Factor out common settings from /root/.shrc and /etc/skel/.shrc to a 2006-09-14 13:01:31 +00:00
skel Factor out common settings from /root/.shrc and /etc/skel/.shrc to a 2006-09-14 13:01:31 +00:00
ssh Remove key for "tgm.netbsd.org". The machine was put out of service when 2006-09-26 21:57:06 +00:00
aliases remove some more smmsp for sendmail. 2006-05-30 02:10:01 +00:00
bootptab
changelist
crontab
csh.cshrc
csh.login
csh.logout
daily Make the daily script immune to changes of the current working directory 2006-12-17 23:24:09 +00:00
daily.conf
disktab
dm.conf
floppytab
ftpchroot
ftpusers remove some more smmsp for sendmail. 2006-05-30 02:10:01 +00:00
gettytab Remove the sp#9600 from the entry for Pc|Pc console. 2006-01-08 22:23:46 +00:00
group For sdpd(8), change default user/group from nobody/nobody to _sdpd/_sdpd 2007-03-18 15:53:54 +00:00
hosts add a dotted alias for localhost so that sendmail doesn't pause on startup 2004-08-29 13:26:17 +00:00
hosts.equiv
hosts.lpd
inetd.conf goodbye uucp 2006-11-12 01:20:00 +00:00
lkm.conf
locate.conf
login.conf Add an commented out login.conf with a simple example based on OpenBSD. 2007-02-04 14:43:03 +00:00
mailer.conf Remove send-mail again; /usr/bin/mail no longer uses it. 2006-06-15 13:09:24 +00:00
MAKEDEV.awk Remove support for NetBSD/{,evb}sh5. 2007-04-08 09:35:21 +00:00
MAKEDEV.local Remove MAKEDEV.subr. This removes the risk of third party scripts (or 2007-03-03 06:36:00 +00:00
MAKEDEV.tmpl Make './MAKEDEV local' work as expected, whether we are counting 2007-03-21 23:07:00 +00:00
Makefile Sync ISO target directory and name with distrib/common/Makefile.bootcd: 2007-04-11 20:46:09 +00:00
man.conf Remove sendmail (approved by core) 2006-05-30 00:40:22 +00:00
master.passwd For sdpd(8), change default user/group from nobody/nobody to _sdpd/_sdpd 2007-03-18 15:53:54 +00:00
minfree
mkttys remove ad-hok list of pty's from port tty files, and auto-generate it so 2004-06-20 21:30:26 +00:00
monthly Avoid the output "Running xxx.local" if the "xxx.local" script 2004-04-09 17:35:21 +00:00
monthly.conf
motd
motd.beta Minor english nits. 2006-09-06 14:59:15 +00:00
motd.current Minor english nits. 2006-09-06 14:59:15 +00:00
motd.rc Minor english nits. 2006-09-06 14:59:15 +00:00
motd.stable Minor english nits. 2006-09-06 14:59:15 +00:00
mrouted.conf
named.conf disable recursion by attackers (yes, attackers do use recursion to perform DoS). 2006-03-23 13:50:44 +00:00
netconfig
networks
newsyslog.conf Remove last traces of /var/log/aculog 2006-09-18 22:39:37 +00:00
nsswitch.conf
ntp.conf Fix typo/mispelling in comment. 2007-02-10 19:36:56 +00:00
passwd.conf
phones
printcap PR/33434: Jukka Salmi: wrong lp spool directory name in default printcap 2006-10-08 15:28:49 +00:00
profile
protocols add rcsid 2007-05-15 17:13:16 +00:00
rbootd.conf
rc
rc.conf
rc.lkm modload(8) already obtain the value of the machdep.booted_kernel sysctl 2005-03-04 21:11:23 +00:00
rc.local
rc.shutdown
rc.subr * Add a stop_boot() function in rc.subr, to terminate a multi-user boot 2007-04-06 14:20:08 +00:00
remote
rpc
security PR/36058 -- fix check for group/other writable home directories from 2007-03-27 08:37:58 +00:00
security.conf
services iana-generated services file using: http://www.sethwklein.net/projects/iana-etc/ 2007-05-08 20:38:37 +00:00
shells
shrc /etc/shrc is used by both sh and ksh, but ksh doesn't support 2006-10-07 22:50:51 +00:00
sysctl.conf
syslog.conf There is really just no point in having every root login get spamming with 2004-07-23 03:45:42 +00:00
weekly Remove unused references to "clean_uucp" variable. (Code was already 2007-02-15 23:04:10 +00:00
weekly.conf
wscons.conf Provide yet more functionality to wscons.conf's "setvar" (see 2007-04-02 12:42:42 +00:00