d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
f53afa40b9
freebsd-skq/sys/netinet
History
rwatson f51eaee62f - Combine kern.ps_showallprocs and kern.ipc.showallsockets into 
a single kern.security.seeotheruids_permitted, describes as:
  "Unprivileged processes may see subjects/objects with different real uid"
  NOTE: kern.ps_showallprocs exists in -STABLE, and therefore there is
  an API change.  kern.ipc.showallsockets does not.
- Check kern.security.seeotheruids_permitted in cr_cansee().
- Replace visibility calls to socheckuid() with cr_cansee() (retain
  the change to socheckuid() in ipfw, where it is used for rule-matching).
- Remove prison_unpcb() and make use of cr_cansee() against the UNIX
  domain socket credential instead of comparing root vnodes for the
  UDS and the process.  This allows multiple jails to share the same
  chroot() and not see each others UNIX domain sockets.
- Remove unused socheckproc().

Now that cr_cansee() is used universally for socket visibility, a variety
of policies are more consistently enforced, including uid-based
restrictions and jail-based restrictions.  This also better-supports
the introduction of additional MAC models.

Reviewed by:	ps, billf
Obtained from:	TrustedBSD Project
2001-10-09 21:40:30 +00:00
..
libalias mdoc(7) police: Use the new .In macro for #include statements. 2001-10-01 16:09:29 +00:00
accf_data.c Remove headers not needed. 2000-10-07 23:15:17 +00:00
accf_http.c Fix incorrect logic wouldn't disconnect incomming connections that had been 2001-01-03 19:50:23 +00:00
icmp6.h - Renumber KAME local ICMP types and NDP options numberes beacaues they 2001-06-21 07:08:43 +00:00
icmp_var.h Clean up RST ratelimiting. Previously, ratelimiting occured before tests 2001-02-11 07:39:51 +00:00
if_atm.c
if_atm.h
if_ether.c Add a hash table that contains the list of internet addresses, and use 2001-09-29 04:34:11 +00:00
if_ether.h
if_fddi.h
igmp_var.h Patches from Keiichi SHIMA <keiichi@iij.ad.jp> 2001-09-03 20:03:55 +00:00
igmp.c One caller of rip_input failed to be converted in the last commit. 2001-09-03 20:40:35 +00:00
igmp.h
in_cksum.c
in_gif.c KSE Milestone 2 2001-09-12 08:38:13 +00:00
in_gif.h Patches from Keiichi SHIMA <keiichi@iij.ad.jp> 2001-09-03 20:03:55 +00:00
in_hostcache.c Convert more malloc+bzero to malloc+M_ZERO. 2000-12-08 21:51:06 +00:00
in_hostcache.h
in_pcb.c Centralize satosin(), sintosa() and ifatoia() macros in <netinet/in.h> 2001-09-29 03:23:44 +00:00
in_pcb.h KSE Milestone 2 2001-09-12 08:38:13 +00:00
in_proto.c Patches from Keiichi SHIMA <keiichi@iij.ad.jp> 2001-09-03 20:03:55 +00:00
in_rmx.c Centralize satosin(), sintosa() and ifatoia() macros in <netinet/in.h> 2001-09-29 03:23:44 +00:00
in_systm.h
in_var.h Nuke unused (and incorrect) #define of INADDR_HMASK. 2001-09-29 14:59:20 +00:00
in.c in_ifinit apparently can be used to rewrite an ip address; recalculate 2001-10-01 18:07:08 +00:00
in.h Centralize satosin(), sintosa() and ifatoia() macros in <netinet/in.h> 2001-09-29 03:23:44 +00:00
ip6.h Sync with recent KAME. 2001-06-11 12:39:29 +00:00
ip_divert.c KSE Milestone 2 2001-09-12 08:38:13 +00:00
ip_dummynet.c Make it so dummynet and bridge can be loaded as modules. 2001-10-05 05:45:27 +00:00
ip_dummynet.h Make it so dummynet and bridge can be loaded as modules. 2001-10-05 05:45:27 +00:00
ip_ecn.c Sync with recent KAME. 2001-06-11 12:39:29 +00:00
ip_ecn.h Sync with recent KAME. 2001-06-11 12:39:29 +00:00
ip_encap.c Remove some un-needed code that was accidentally included in 2001-09-07 07:24:28 +00:00
ip_encap.h Patches from KAME to remove usage of Varargs in existing 2001-09-07 07:19:12 +00:00
ip_flow.c Bring in fix from NetBSD's revision 1.16: 2001-06-26 09:00:50 +00:00
ip_flow.h
ip_fw.c Only allow users to see their own socket connections if 2001-10-05 07:06:32 +00:00
ip_fw.h Two main changes here: 2001-09-27 23:44:27 +00:00
ip_icmp.c Add a hash table that contains the list of internet addresses, and use 2001-09-29 04:34:11 +00:00
ip_icmp.h Patches from Keiichi SHIMA <keiichi@iij.ad.jp> 2001-09-03 20:03:55 +00:00
ip_id.c Add ``options RANDOM_IP_ID'' which randomizes the ID field of IP packets. 2001-06-01 10:02:28 +00:00
ip_input.c Make it so dummynet and bridge can be loaded as modules. 2001-10-05 05:45:27 +00:00
ip_mroute.c Fixed comment: ipip_input -> mroute_encapcheck. 2001-09-20 07:59:45 +00:00
ip_mroute.h Somewhat modernize ip_mroute.c: 2001-07-25 20:15:49 +00:00
ip_output.c Make it so dummynet and bridge can be loaded as modules. 2001-10-05 05:45:27 +00:00
ip_var.h Patches from Keiichi SHIMA <keiichi@iij.ad.jp> 2001-09-03 20:03:55 +00:00
ip.h
ipprotosw.h KSE Milestone 2 2001-09-12 08:38:13 +00:00
raw_ip.c - Combine kern.ps_showallprocs and kern.ipc.showallsockets into 2001-10-09 21:40:30 +00:00
tcp_debug.c sync with kame tree as of july00. tons of bug fixes/improvements. 2000-07-04 16:35:15 +00:00
tcp_debug.h
tcp_fsm.h
tcp_input.c KSE Milestone 2 2001-09-12 08:38:13 +00:00
tcp_output.c Add a flag TF_LASTIDLE, that forces a previously idle connection 2001-10-05 21:33:38 +00:00
tcp_reass.c KSE Milestone 2 2001-09-12 08:38:13 +00:00
tcp_seq.h Much delayed but now present: RFC 1948 style sequence numbers 2001-08-22 00:58:16 +00:00
tcp_subr.c - Combine kern.ps_showallprocs and kern.ipc.showallsockets into 2001-10-09 21:40:30 +00:00
tcp_timer.c Much delayed but now present: RFC 1948 style sequence numbers 2001-08-22 00:58:16 +00:00
tcp_timer.h
tcp_timewait.c - Combine kern.ps_showallprocs and kern.ipc.showallsockets into 2001-10-09 21:40:30 +00:00
tcp_usrreq.c KSE Milestone 2 2001-09-12 08:38:13 +00:00
tcp_var.h Add a flag TF_LASTIDLE, that forces a previously idle connection 2001-10-05 21:33:38 +00:00
tcp.h o Minor style(9)ism to make consistent with -STABLE 2001-01-09 18:26:17 +00:00
tcpip.h Remove struct full_tcpiphdr{}. 2001-02-26 20:10:16 +00:00
udp_usrreq.c - Combine kern.ps_showallprocs and kern.ipc.showallsockets into 2001-10-09 21:40:30 +00:00
udp_var.h Patches from Keiichi SHIMA <keiichi@iij.ad.jp> 2001-09-03 20:03:55 +00:00
udp.h