From owner-svn-src-all@FreeBSD.ORG Tue Dec 29 13:55:16 2009 Return-Path: Delivered-To: svn-src-all@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 41788106568D; Tue, 29 Dec 2009 13:55:16 +0000 (UTC) (envelope-from rwatson@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:4f8:fff6::2c]) by mx1.freebsd.org (Postfix) with ESMTP id 308F18FC19; Tue, 29 Dec 2009 13:55:16 +0000 (UTC) Received: from svn.freebsd.org (localhost [127.0.0.1]) by svn.freebsd.org (8.14.3/8.14.3) with ESMTP id nBTDtGfs026145; Tue, 29 Dec 2009 13:55:16 GMT (envelope-from rwatson@svn.freebsd.org) Received: (from rwatson@localhost) by svn.freebsd.org (8.14.3/8.14.3/Submit) id nBTDtGVl026143; Tue, 29 Dec 2009 13:55:16 GMT (envelope-from rwatson@svn.freebsd.org) Message-Id: <200912291355.nBTDtGVl026143@svn.freebsd.org> From: Robert Watson Date: Tue, 29 Dec 2009 13:55:16 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-7@freebsd.org X-SVN-Group: stable-7 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Cc: Subject: svn commit: r201197 - stable/7/sys/kern X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 29 Dec 2009 13:55:16 -0000 Author: rwatson Date: Tue Dec 29 13:55:15 2009 New Revision: 201197 URL: http://svn.freebsd.org/changeset/base/201197 Log: Merge r189063 from head to stable/7: Add static tracing for privilege checking: priv:kernel:priv_check:priv_ok fires for granted privileges priv:kernel:priv_check:priv_err fires for denied privileges The first argument is the requested privilege number. The naming convention is a little different from the OpenSolaris equivilent because we can't have '-' in probefunc names, and our privilege namespace is different. Requested by: bz Modified: stable/7/sys/kern/kern_priv.c Directory Properties: stable/7/sys/ (props changed) stable/7/sys/cddl/contrib/opensolaris/ (props changed) stable/7/sys/contrib/dev/acpica/ (props changed) stable/7/sys/contrib/pf/ (props changed) Modified: stable/7/sys/kern/kern_priv.c ============================================================================== --- stable/7/sys/kern/kern_priv.c Tue Dec 29 13:35:18 2009 (r201196) +++ stable/7/sys/kern/kern_priv.c Tue Dec 29 13:55:15 2009 (r201197) @@ -1,5 +1,6 @@ /*- * Copyright (c) 2006 nCircle Network Security, Inc. + * Copyright (c) 2009 Robert N. M. Watson * All rights reserved. * * This software was developed by Robert N. M. Watson for the TrustedBSD @@ -27,6 +28,7 @@ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ +#include "opt_kdtrace.h" #include "opt_mac.h" #include @@ -37,6 +39,7 @@ __FBSDID("$FreeBSD$"); #include #include #include +#include #include #include @@ -57,6 +60,14 @@ SYSCTL_INT(_security_bsd, OID_AUTO, suse &suser_enabled, 0, "processes with uid 0 have privilege"); TUNABLE_INT("security.bsd.suser_enabled", &suser_enabled); +SDT_PROVIDER_DEFINE(priv); + +SDT_PROBE_DEFINE(priv, kernel, priv_check, priv_ok); +SDT_PROBE_ARGTYPE(priv, kernel, priv_check, priv_ok, 0, "int"); + +SDT_PROBE_DEFINE(priv, kernel, priv_check, priv_err); +SDT_PROBE_ARGTYPE(priv, kernel, priv_check, priv_err, 0, "int"); + /* * Check a credential for privilege. Lots of good reasons to deny privilege; * only a few to grant it. @@ -76,7 +87,7 @@ priv_check_cred(struct ucred *cred, int #ifdef MAC error = mac_priv_check(cred, priv); if (error) - return (error); + goto out; #endif /* @@ -85,7 +96,7 @@ priv_check_cred(struct ucred *cred, int */ error = prison_priv_check(cred, priv); if (error) - return (error); + goto out; /* * Having determined if privilege is restricted by various policies, @@ -103,13 +114,17 @@ priv_check_cred(struct ucred *cred, int case PRIV_MAXFILES: case PRIV_MAXPROC: case PRIV_PROC_LIMIT: - if (cred->cr_ruid == 0) - return (0); + if (cred->cr_ruid == 0) { + error = 0; + goto out; + } break; default: - if (cred->cr_uid == 0) - return (0); + if (cred->cr_uid == 0) { + error = 0; + goto out; + } break; } } @@ -119,10 +134,26 @@ priv_check_cred(struct ucred *cred, int * privilege. */ #ifdef MAC - if (mac_priv_grant(cred, priv) == 0) - return (0); + if (mac_priv_grant(cred, priv) == 0) { + error = 0; + goto out; + } #endif - return (EPERM); + + /* + * The default is deny, so if no policies have granted it, reject + * with a privilege error here. + */ + error = EPERM; +out: + if (error) { + SDT_PROBE(priv, kernel, priv_check, priv_err, priv, 0, 0, 0, + 0); + } else { + SDT_PROBE(priv, kernel, priv_check, priv_ok, priv, 0, 0, 0, + 0); + } + return (error); } int