8512d82ea0
Ensure veriexec opens the file before doing any read operations. When the MAC_VERIEXEC_CHECK_PATH_SYSCALL syscall is requested, veriexec needs to open the file before calling mac_veriexec_check_vp. This is to ensure any set up is done by the file system. Most file systems do not explicitly need an open, but some (e.g. virtfs) require initialization of access tokens (file identifiers, etc.) before doing any read or write operations. The evaluate_fingerprint() function needs to ensure it has an open file for reading in order to evaluate the fingerprint. The ideal solution is to have a hook after the VOP_OPEN call in vn_open. For now, we open the file for reading, envaluate the fingerprint, and close the file. While this leaves a potential hole that could possibly be taken advantage of by a dedicated aversary, this code path is not typically visited often in our use cases, as we primarily encounter verified mounts and not individual files. This should be considered a temporary workaround until discussions about the post-open hook have concluded and the hook becomes available. Add MAC_VERIEXEC_GET_PARAMS_PATH_SYSCALL and MAC_VERIEXEC_GET_PARAMS_PID_SYSCALL to mac_veriexec_syscall so we can fetch and check label contents in an unconstrained manner. Add a check for PRIV_VERIEXEC_CONTROL to do ioctl on /dev/veriexec Make it clear that trusted process cannot be debugged. Attempts to debug a trusted process already fail, but the failure path is very obscure. Add an explicit check for VERIEXEC_TRUSTED in mac_veriexec_proc_check_debug. We need mac_veriexec_priv_check to not block PRIV_KMEM_WRITE if mac_priv_gant() says it is ok. Reviewed by: sjg Obtained from: Juniper Networks, Inc. |
||
|---|---|---|
| .. | ||
| amd64 | ||
| arm | ||
| arm64 | ||
| bsm | ||
| cam | ||
| cddl | ||
| compat | ||
| conf | ||
| contrib | ||
| crypto | ||
| ddb | ||
| dev | ||
| dts | ||
| fs | ||
| gdb | ||
| geom | ||
| gnu | ||
| i386 | ||
| isa | ||
| kern | ||
| kgssapi | ||
| libkern | ||
| modules | ||
| net | ||
| net80211 | ||
| netgraph | ||
| netinet | ||
| netinet6 | ||
| netipsec | ||
| netlink | ||
| netpfil | ||
| netsmb | ||
| nfs | ||
| nfsclient | ||
| nfsserver | ||
| nlm | ||
| ofed | ||
| opencrypto | ||
| powerpc | ||
| riscv | ||
| rpc | ||
| security | ||
| sys | ||
| teken | ||
| tests | ||
| tools | ||
| ufs | ||
| vm | ||
| x86 | ||
| xdr | ||
| xen | ||
| Makefile | ||
| README.md | ||
FreeBSD Kernel Source:
This directory contains the source files and build glue that make up the FreeBSD kernel and its modules, including both original and contributed software.
Kernel configuration files are located in the conf/ subdirectory of each
architecture. GENERIC is the configuration used in release builds. NOTES
contains documentation of all possible entries. LINT is a compile-only
configuration used to maximize build coverage and detect regressions.
Source Roadmap:
| Directory | Description |
|---|---|
| amd64 | AMD64 (64-bit x86) architecture support |
| arm | 32-bit ARM architecture support |
| arm64 | 64-bit ARM (AArch64) architecture support |
| cam | Common Access Method storage subsystem - cam(4) and ctl(4) |
| cddl | CDDL-licensed optional sources such as DTrace |
| conf | kernel build glue |
| compat | Linux compatibility layer, FreeBSD 32-bit compatibility |
| contrib | 3rd-party imported software such as OpenZFS |
| crypto | crypto drivers |
| ddb | interactive kernel debugger - ddb(4) |
| fs | most filesystems, excluding UFS, NFS, and ZFS |
| dev | device drivers and other arch independent code |
| gdb | kernel remote GDB stub - gdb(4) |
| geom | GEOM framework - geom(4) |
| i386 | i386 (32-bit x86) architecture support |
| kern | main part of the kernel |
| libkern | libc-like and other support functions for kernel use |
| modules | kernel module infrastructure |
| net | core networking code |
| net80211 | wireless networking (IEEE 802.11) - net80211(4) |
| netgraph | graph-based networking subsystem - netgraph(4) |
| netinet | IPv4 protocol implementation - inet(4) |
| netinet6 | IPv6 protocol implementation - inet6(4) |
| netipsec | IPsec protocol implementation - ipsec(4) |
| netpfil | packet filters - ipfw(4), pf(4), and ipfilter(4) |
| opencrypto | OpenCrypto framework - crypto(7) |
| powerpc | PowerPC/POWER (32 and 64-bit) architecture support |
| riscv | 64-bit RISC-V architecture support |
| security | security facilities - audit(4) and mac(4) |
| sys | kernel headers |
| tests | kernel unit tests |
| ufs | Unix File System - ffs(7) |
| vm | virtual memory system |
| x86 | code shared by AMD64 and i386 architectures |