From owner-cvs-all@FreeBSD.ORG Sat Aug 13 21:24:19 2005 Return-Path: X-Original-To: cvs-all@FreeBSD.org Delivered-To: cvs-all@FreeBSD.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 4587E16A41F; Sat, 13 Aug 2005 21:24:19 +0000 (GMT) (envelope-from rwatson@FreeBSD.org) Received: from repoman.freebsd.org (repoman.freebsd.org [216.136.204.115]) by mx1.FreeBSD.org (Postfix) with ESMTP id ED46543D45; Sat, 13 Aug 2005 21:24:18 +0000 (GMT) (envelope-from rwatson@FreeBSD.org) Received: from repoman.freebsd.org (localhost [127.0.0.1]) by repoman.freebsd.org (8.13.1/8.13.1) with ESMTP id j7DLOIDH080126; Sat, 13 Aug 2005 21:24:18 GMT (envelope-from rwatson@repoman.freebsd.org) Received: (from rwatson@localhost) by repoman.freebsd.org (8.13.1/8.13.1/Submit) id j7DLOIOg080125; Sat, 13 Aug 2005 21:24:18 GMT (envelope-from rwatson) Message-Id: <200508132124.j7DLOIOg080125@repoman.freebsd.org> From: Robert Watson Date: Sat, 13 Aug 2005 21:24:18 +0000 (UTC) To: src-committers@FreeBSD.org, cvs-src@FreeBSD.org, cvs-all@FreeBSD.org X-FreeBSD-CVS-Branch: RELENG_6 Cc: Subject: cvs commit: src/sys/cam/scsi scsi_target.c src/sys/coda coda_fbsd.c src/sys/dev/firewire firewirereg.h fwdev.c src/sys/dev/nmdm nmdm.c src/sys/dev/snp snp.c src/sys/dev/sound/pcm dsp.c mixer.c src/sys/dev/vkbd vkbd.c ... X-BeenThere: cvs-all@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: CVS commit messages for the entire tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 13 Aug 2005 21:24:19 -0000 rwatson 2005-08-13 21:24:18 UTC FreeBSD src repository Modified files: (Branch: RELENG_6) sys/cam/scsi scsi_target.c sys/coda coda_fbsd.c sys/dev/firewire firewirereg.h fwdev.c sys/dev/nmdm nmdm.c sys/dev/snp snp.c sys/dev/sound/pcm dsp.c mixer.c sys/dev/vkbd vkbd.c sys/fs/devfs devfs_devs.c devfs_vnops.c sys/kern kern_conf.c tty_pty.c tty_tty.c sys/net bpf.c if_tap.c if_tun.c sys/netsmb smb_dev.c sys/security/mac mac_vfs.c sys/security/mac_biba mac_biba.c sys/security/mac_lomac mac_lomac.c sys/security/mac_mls mac_mls.c sys/security/mac_stub mac_stub.c sys/security/mac_test mac_test.c sys/sys conf.h mac.h mac_policy.h Log: Merge two sets of changes relating to devfs device node cloning from HEAD to RELENG_6: changes to introduce a credentialed version of the clone event handler, and then changes to merge the regular and credentialed versions into a single interface (along with updates to existing consumers). With this merge, 6.x and 7.x are in sync. First batch merges devfs_devs.c:1.37, devfs_vnops.c:1.115, kern_conf.c:1.187, tty_pty.c:1.138, mac_vfs.c:1.109, mac_biba.c:1.36, mac_lomac.c:1.36, mac_mls.c:1.73, mac_stub.c:1.53, mac_test.c:1.61, conf.h:1.223, mac.h:1.68, mac_policy.h:1.67 from HEAD to RELENG_6: When devfs cloning takes place, provide access to the credential of the process that caused the clone event to take place for the device driver creating the device. This allows cloned device drivers to adapt the device node based on security aspects of the process, such as the uid, gid, and MAC label. - Add a cred reference to struct cdev, so that when a device node is instantiated as a vnode, the cloning credential can be exposed to MAC. - Add make_dev_cred(), a version of make_dev() that additionally accepts the credential to stick in the struct cdev. Implement it and make_dev() in terms of a back-end make_dev_credv(). - Add a new event handler, dev_clone_cred, which can be registered to receive the credential instead of dev_clone, if desired. - Modify the MAC entry point mac_create_devfs_device() to accept an optional credential pointer (may be NULL), so that MAC policies can inspect and act on the label or other elements of the credential when initializing the skeleton device protections. - Modify tty_pty.c to register clone_dev_cred and invoke make_dev_cred(), so that the pty clone credential is exposed to the MAC Framework. While currently primarily focussed on MAC policies, this change is also a prerequisite for changes to allow ptys to be instantiated with the UID of the process looking up the pty. This requires further changes to the pty driver -- in particular, to immediately recycle pty nodes on last close so that the credential-related state can be recreated on next lookup. Submitted by: Andrew Reisse Obtained from: TrustedBSD Project Sponsored by: SPAWAR, SPARTA Second batch merges scsi_target.c:1.68, coda_fbsd.c:1.43, firewirereg.h:1.38, fwdev.c:1.47, nmdm.c:1.36, snp.c:1.100, dsp.c:1.82, mixer.c:1.45, vkbd.c:1.9, devfs_vnops.c:1.117, tty_pty.c:1.139, tty_tty.c:1.57, bpf.c:1.156, if_tap.c:1.56, if_tun.c:1.153, smb_dev.c:1.28, conf.h:1.224 from HEAD to RELENG_6: Merge the dev_clone and dev_clone_cred event handlers into a single event handler, dev_clone, which accepts a credential argument. Implementors of the event can ignore it if they're not interested, and most do. This avoids having multiple event handler types and fall-back/precedence logic in devfs. This changes the kernel API for /dev cloning, and may affect third party packages containg cloning kernel modules. Requested by: phk These changes modifies the kernel device driver API for device cloning, and might require minor modifications to third party device drivers that make use of devfs cloning. It will not be merged to RELENG_5. Approved by: re (scottl) Revision Changes Path 1.67.2.1 +4 -3 src/sys/cam/scsi/scsi_target.c 1.42.2.1 +4 -3 src/sys/coda/coda_fbsd.c 1.37.2.1 +1 -1 src/sys/dev/firewire/firewirereg.h 1.46.2.1 +2 -1 src/sys/dev/firewire/fwdev.c 1.35.2.1 +2 -1 src/sys/dev/nmdm/nmdm.c 1.99.2.1 +3 -2 src/sys/dev/snp/snp.c 1.80.2.1 +2 -1 src/sys/dev/sound/pcm/dsp.c 1.43.2.1 +2 -1 src/sys/dev/sound/pcm/mixer.c 1.7.2.2 +4 -2 src/sys/dev/vkbd/vkbd.c 1.36.2.1 +2 -1 src/sys/fs/devfs/devfs_devs.c 1.114.2.2 +2 -1 src/sys/fs/devfs/devfs_vnops.c 1.186.2.1 +40 -5 src/sys/kern/kern_conf.c 1.137.2.1 +7 -6 src/sys/kern/tty_pty.c 1.56.2.1 +2 -1 src/sys/kern/tty_tty.c 1.153.2.2 +3 -2 src/sys/net/bpf.c 1.55.2.1 +4 -2 src/sys/net/if_tap.c 1.152.2.1 +4 -2 src/sys/net/if_tun.c 1.27.2.1 +2 -1 src/sys/netsmb/smb_dev.c 1.108.2.1 +7 -2 src/sys/security/mac/mac_vfs.c 1.87.2.1 +2 -2 src/sys/security/mac_biba/mac_biba.c 1.35.2.1 +2 -2 src/sys/security/mac_lomac/mac_lomac.c 1.72.2.1 +2 -2 src/sys/security/mac_mls/mac_mls.c 1.52.2.2 +2 -2 src/sys/security/mac_stub/mac_stub.c 1.60.2.1 +5 -2 src/sys/security/mac_test/mac_test.c 1.222.2.1 +6 -1 src/sys/sys/conf.h 1.67.2.1 +2 -2 src/sys/sys/mac.h 1.66.2.1 +5 -1 src/sys/sys/mac_policy.h