d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

- Attempt to help declutter kern. sysctl by moving security out from

Browse Source 
beneath it.

Reviewed by: rwatson
This commit is contained in:
Andrew R. Reiter 2002-01-16 06:55:30 +00:00
parent 8af31e7b46
commit d0615c64a5
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=89414
8 changed files with 30 additions and 29 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
sbin/sysctl/sysctl.8
View File

@ -136,7 +136,7 @@ For a detailed description of these variable see
.Pp .Pp
The changeable column indicates whether a process with appropriate The changeable column indicates whether a process with appropriate
privilege can change the value. privilege can change the value.
.Bl -column kern.security.bsd.unprivileged_read_msgbuf integerxxx .Bl -column security.bsd.unprivileged_read_msgbuf integerxxx
.It Sy "Name Type Changeable .It Sy "Name Type Changeable
.It "kern.ostype string no .It "kern.ostype string no
.It "kern.osrelease string no .It "kern.osrelease string no
@ -165,10 +165,10 @@ privilege can change the value.
.It "kern.bootfile string yes .It "kern.bootfile string yes
.It "kern.corefile string yes .It "kern.corefile string yes
.It "kern.logsigexit integer yes .It "kern.logsigexit integer yes
.It "kern.security.bsd.suser_enabled integer yes .It "security.bsd.suser_enabled integer yes
.It "kern.security.bsd.see_other_uids integer yes .It "security.bsd.see_other_uids integer yes
.It "kern.security.bsd.unprivileged_proc_debug integer yes .It "security.bsd.unprivileged_proc_debug integer yes
.It "kern.security.bsd.unprivileged_read_msgbuf integer yes .It "security.bsd.unprivileged_read_msgbuf integer yes
.It "vm.loadavg struct no .It "vm.loadavg struct no
.It "hw.machine string no .It "hw.machine string no
.It "hw.model string no .It "hw.model string no

2
share/doc/papers/jail/mgt.ms
View File

@ -193,7 +193,7 @@ jails to set the hostname of the jail, which makes the status file less
useful from a management perspective if the contents of the jail are useful from a management perspective if the contents of the jail are
malicious. malicious.
To prevent a jail from changing its hostname, the To prevent a jail from changing its hostname, the
"kern.security.jail.set_hostname_allowed" sysctl may be set to 0 prior to "security.jail.set_hostname_allowed" sysctl may be set to 0 prior to
starting any jails. starting any jails.
.PP .PP
One aspect immediately observable in an environment with multiple jails One aspect immediately observable in an environment with multiple jails

4
sys/kern/kern_cap.c
View File

@ -61,9 +61,9 @@
static int capabilities_enabled = 0; static int capabilities_enabled = 0;
SYSCTL_NODE(_kern_security, OID_AUTO, capabilities, CTLFLAG_RW, 0, SYSCTL_NODE(_security, OID_AUTO, capabilities, CTLFLAG_RW, 0,
"POSIX.1e Capabilities"); "POSIX.1e Capabilities");
SYSCTL_INT(_kern_security_capabilities, OID_AUTO, enabled, CTLFLAG_RW, SYSCTL_INT(_security_capabilities, OID_AUTO, enabled, CTLFLAG_RW,
&capabilities_enabled, 0, "POSIX.1e Capabilities enabled"); &capabilities_enabled, 0, "POSIX.1e Capabilities enabled");
#endif #endif

10
sys/kern/kern_jail.c
View File

@ -28,24 +28,24 @@
MALLOC_DEFINE(M_PRISON, "prison", "Prison structures"); MALLOC_DEFINE(M_PRISON, "prison", "Prison structures");
SYSCTL_DECL(_kern_security); SYSCTL_DECL(_security);
SYSCTL_NODE(_kern_security, OID_AUTO, jail, CTLFLAG_RW, 0, SYSCTL_NODE(_security, OID_AUTO, jail, CTLFLAG_RW, 0,
"Jail rules"); "Jail rules");
mp_fixme("these variables need a lock") mp_fixme("these variables need a lock")
int jail_set_hostname_allowed = 1; int jail_set_hostname_allowed = 1;
SYSCTL_INT(_kern_security_jail, OID_AUTO, set_hostname_allowed, CTLFLAG_RW, SYSCTL_INT(_security_jail, OID_AUTO, set_hostname_allowed, CTLFLAG_RW,
&jail_set_hostname_allowed, 0, &jail_set_hostname_allowed, 0,
"Processes in jail can set their hostnames"); "Processes in jail can set their hostnames");
int jail_socket_unixiproute_only = 1; int jail_socket_unixiproute_only = 1;
SYSCTL_INT(_kern_security_jail, OID_AUTO, socket_unixiproute_only, CTLFLAG_RW, SYSCTL_INT(_security_jail, OID_AUTO, socket_unixiproute_only, CTLFLAG_RW,
&jail_socket_unixiproute_only, 0, &jail_socket_unixiproute_only, 0,
"Processes in jail are limited to creating UNIX/IPv4/route sockets only"); "Processes in jail are limited to creating UNIX/IPv4/route sockets only");
int jail_sysvipc_allowed = 0; int jail_sysvipc_allowed = 0;
SYSCTL_INT(_kern_security_jail, OID_AUTO, sysvipc_allowed, CTLFLAG_RW, SYSCTL_INT(_security_jail, OID_AUTO, sysvipc_allowed, CTLFLAG_RW,
&jail_sysvipc_allowed, 0, &jail_sysvipc_allowed, 0,
"Processes in jail can use System V IPC primitives"); "Processes in jail can use System V IPC primitives");

2
sys/kern/kern_mib.c
View File

@ -77,6 +77,8 @@ SYSCTL_NODE(, CTL_P1003_1B, p1003_1b, CTLFLAG_RW, 0,
SYSCTL_NODE(, OID_AUTO, compat, CTLFLAG_RW, 0, SYSCTL_NODE(, OID_AUTO, compat, CTLFLAG_RW, 0,
"Compatibility code"); "Compatibility code");
SYSCTL_NODE(, OID_AUTO, security, CTLFLAG_RW, 0,
"Security");
#ifdef REGRESSION #ifdef REGRESSION
SYSCTL_NODE(, OID_AUTO, regression, CTLFLAG_RW, 0, SYSCTL_NODE(, OID_AUTO, regression, CTLFLAG_RW, 0,
"Regression test MIB"); "Regression test MIB");

15
sys/kern/kern_prot.c
View File

@ -63,9 +63,8 @@
static MALLOC_DEFINE(M_CRED, "cred", "credentials"); static MALLOC_DEFINE(M_CRED, "cred", "credentials");
SYSCTL_NODE(_kern, OID_AUTO, security, CTLFLAG_RW, 0, SYSCTL_DECL(_security);
"Kernel security policy"); SYSCTL_NODE(_security, OID_AUTO, bsd, CTLFLAG_RW, 0,
SYSCTL_NODE(_kern_security, OID_AUTO, bsd, CTLFLAG_RW, 0,
"BSD security policy"); "BSD security policy");
#ifndef _SYS_SYSPROTO_H_ #ifndef _SYS_SYSPROTO_H_
@ -1190,7 +1189,7 @@ groupmember(gid, cred)
} }
/* /*
* `suser_enabled' (which can be set by the kern.security.suser_enabled * `suser_enabled' (which can be set by the security.suser_enabled
* sysctl) determines whether the system 'super-user' policy is in effect. * sysctl) determines whether the system 'super-user' policy is in effect.
* If it is nonzero, an effective uid of 0 connotes special privilege, * If it is nonzero, an effective uid of 0 connotes special privilege,
* overriding many mandatory and discretionary protections. If it is zero, * overriding many mandatory and discretionary protections. If it is zero,
@ -1200,9 +1199,9 @@ groupmember(gid, cred)
* consideration of the consequences. * consideration of the consequences.
*/ */
int suser_enabled = 1; int suser_enabled = 1;
SYSCTL_INT(_kern_security_bsd, OID_AUTO, suser_enabled, CTLFLAG_RW, SYSCTL_INT(_security_bsd, OID_AUTO, suser_enabled, CTLFLAG_RW,
&suser_enabled, 0, "processes with uid 0 have privilege"); &suser_enabled, 0, "processes with uid 0 have privilege");
TUNABLE_INT("kern.security.bsd.suser_enabled", &suser_enabled); TUNABLE_INT("security.bsd.suser_enabled", &suser_enabled);
/* /*
* Test whether the specified credentials imply "super-user" privilege. * Test whether the specified credentials imply "super-user" privilege.
@ -1312,7 +1311,7 @@ securelevel_ge(struct ucred *cr, int level)
* XXX: data declarations should be together near the beginning of the file. * XXX: data declarations should be together near the beginning of the file.
*/ */
static int see_other_uids = 1; static int see_other_uids = 1;
SYSCTL_INT(_kern_security_bsd, OID_AUTO, see_other_uids, CTLFLAG_RW, SYSCTL_INT(_security_bsd, OID_AUTO, see_other_uids, CTLFLAG_RW,
&see_other_uids, 0, &see_other_uids, 0,
"Unprivileged processes may see subjects/objects with different real uid"); "Unprivileged processes may see subjects/objects with different real uid");
@ -1491,7 +1490,7 @@ p_cansched(struct proc *p1, struct proc *p2)
* XXX: data declarations should be together near the beginning of the file. * XXX: data declarations should be together near the beginning of the file.
*/ */
static int unprivileged_proc_debug = 1; static int unprivileged_proc_debug = 1;
SYSCTL_INT(_kern_security_bsd, OID_AUTO, unprivileged_proc_debug, CTLFLAG_RW, SYSCTL_INT(_security_bsd, OID_AUTO, unprivileged_proc_debug, CTLFLAG_RW,
&unprivileged_proc_debug, 0, &unprivileged_proc_debug, 0,
"Unprivileged processes may use process debugging facilities"); "Unprivileged processes may use process debugging facilities");

4
sys/kern/subr_prf.c
View File

@ -819,10 +819,10 @@ msgbufinit(void *ptr, size_t size)
oldp = msgbufp; oldp = msgbufp;
} }
SYSCTL_DECL(_kern_security_bsd); SYSCTL_DECL(_security_bsd);
static int unprivileged_read_msgbuf = 1; static int unprivileged_read_msgbuf = 1;
SYSCTL_INT(_kern_security_bsd, OID_AUTO, unprivileged_read_msgbuf, SYSCTL_INT(_security_bsd, OID_AUTO, unprivileged_read_msgbuf,
CTLFLAG_RW, &unprivileged_read_msgbuf, 0, CTLFLAG_RW, &unprivileged_read_msgbuf, 0,
"Unprivileged processes may read the kernel message buffer"); "Unprivileged processes may read the kernel message buffer");

12
usr.sbin/jail/jail.8
View File

@ -233,7 +233,7 @@ script from within the jail.
.Pp .Pp
NOTE: If you plan to allow untrusted users to have root access inside the NOTE: If you plan to allow untrusted users to have root access inside the
jail, you may wish to consider setting the jail, you may wish to consider setting the
.Va kern.security.jail.set_hostname_allowed .Va security.jail.set_hostname_allowed
to 0. to 0.
Please see the management reasons why this is a good idea. Please see the management reasons why this is a good idea.
If you do decide to set this variable, If you do decide to set this variable,
@ -311,14 +311,14 @@ default, modified from within the jail, so the
status entry is unreliable by default. status entry is unreliable by default.
To disable the setting of the hostname To disable the setting of the hostname
from within a jail, set the from within a jail, set the
.Va kern.security.jail.set_hostname_allowed .Va security.jail.set_hostname_allowed
sysctl variable in the host environment to 0, which will affect all jails. sysctl variable in the host environment to 0, which will affect all jails.
You can have this sysctl set on each boot using You can have this sysctl set on each boot using
.Xr sysctl.conf 5 . .Xr sysctl.conf 5 .
Just add the following line to Just add the following line to
.Pa /etc/sysctl.conf : .Pa /etc/sysctl.conf :
.Pp .Pp
.Dl kern.security.jail.set_hostname_allowed=0 .Dl security.jail.set_hostname_allowed=0
.Pp .Pp
In a future version of In a future version of
.Fx , .Fx ,
@ -332,7 +332,7 @@ MIB variables.
Currently, these variables affect all jails on the system, although in Currently, these variables affect all jails on the system, although in
the future this functionality may be finer grained. the future this functionality may be finer grained.
.Bl -tag -width XXX .Bl -tag -width XXX
.It Va kern.security.jail.set_hostname_allowed .It Va security.jail.set_hostname_allowed
This MIB entry determines whether or not processes within a jail are This MIB entry determines whether or not processes within a jail are
allowed to change their hostname via allowed to change their hostname via
.Xr hostname 1 .Xr hostname 1
@ -344,7 +344,7 @@ information in
.Pa /proc . .Pa /proc .
As such, this should be disabled in environments where privileged access to As such, this should be disabled in environments where privileged access to
jails is given out to untrusted parties. jails is given out to untrusted parties.
.It Va kern.security.jail.socket_unixiproute_only .It Va security.jail.socket_unixiproute_only
The jail functionality binds an IPv4 address to each jail, and limits The jail functionality binds an IPv4 address to each jail, and limits
access to other network addresses in the IPv4 space that may be available access to other network addresses in the IPv4 space that may be available
in the host environment. in the host environment.
@ -361,7 +361,7 @@ domain sockets,
IPv4 addresses, and routing sockets. IPv4 addresses, and routing sockets.
To enable access to other domains, this MIB variable may be set to To enable access to other domains, this MIB variable may be set to
0. 0.
.It Va kern.security.jail.sysvipc_allowed .It Va security.jail.sysvipc_allowed
This MIB entry determines whether or not processes within a jail have access This MIB entry determines whether or not processes within a jail have access
to System V IPC primitives. to System V IPC primitives.
In the current jail implementation, System V primitives share a single In the current jail implementation, System V primitives share a single