#
1.38 |
|
28-Dec-2023 |
hannken |
Initialize mutex fileassoc_global.lock.
|
Revision tags: thorpej-ifq-base thorpej-altq-separation-base
|
#
1.37 |
|
02-Aug-2023 |
riastradh |
fileassoc(9): Fast paths to skip global locks when not in use.
PR kern/57552
|
Revision tags: netbsd-10-0-RC1 netbsd-10-base bouyer-sunxi-drm-base netbsd-9-3-RELEASE thorpej-i2c-spi-conf2-base thorpej-futex2-base thorpej-cfargs2-base cjep_sun2x-base1 cjep_sun2x-base cjep_staticlib_x-base1 netbsd-9-2-RELEASE cjep_staticlib_x-base thorpej-i2c-spi-conf-base thorpej-cfargs-base thorpej-futex-base netbsd-9-1-RELEASE bouyer-xenpvh-base2 phil-wifi-20200421 bouyer-xenpvh-base1 phil-wifi-20200411 bouyer-xenpvh-base is-mlppp-base phil-wifi-20200406 netbsd-8-2-RELEASE ad-namecache-base3 netbsd-9-0-RELEASE netbsd-9-0-RC2 ad-namecache-base2 ad-namecache-base1 ad-namecache-base netbsd-9-0-RC1 phil-wifi-20191119 netbsd-9-base phil-wifi-20190609 netbsd-8-1-RELEASE netbsd-8-1-RC1 isaki-audio2-base pgoyette-compat-merge-20190127 pgoyette-compat-20190127 pgoyette-compat-20190118 pgoyette-compat-1226 pgoyette-compat-1126 pgoyette-compat-1020 pgoyette-compat-0930 pgoyette-compat-0906 netbsd-7-2-RELEASE pgoyette-compat-0728 netbsd-8-0-RELEASE phil-wifi-base pgoyette-compat-0625 netbsd-8-0-RC2 pgoyette-compat-0521 pgoyette-compat-0502 pgoyette-compat-0422 netbsd-8-0-RC1 pgoyette-compat-0415 pgoyette-compat-0407 pgoyette-compat-0330 pgoyette-compat-0322 pgoyette-compat-0315 netbsd-7-1-2-RELEASE pgoyette-compat-base netbsd-7-1-1-RELEASE tls-maxphys-base-20171202 matt-nb8-mediatek-base nick-nhusb-base-20170825 perseant-stdc-iso10646-base netbsd-8-base prg-localcount2-base3 prg-localcount2-base2 prg-localcount2-base1 prg-localcount2-base pgoyette-localcount-20170426 bouyer-socketcan-base1 jdolecek-ncq-base pgoyette-localcount-20170320 netbsd-7-1-RELEASE netbsd-7-1-RC2 nick-nhusb-base-20170204 netbsd-7-nhusb-base-20170116 bouyer-socketcan-base pgoyette-localcount-20170107 netbsd-7-1-RC1 nick-nhusb-base-20161204 pgoyette-localcount-20161104 netbsd-7-0-2-RELEASE nick-nhusb-base-20161004 localcount-20160914 netbsd-7-nhusb-base pgoyette-localcount-20160806 pgoyette-localcount-20160726 pgoyette-localcount-base nick-nhusb-base-20160907 nick-nhusb-base-20160529 netbsd-7-0-1-RELEASE nick-nhusb-base-20160422 nick-nhusb-base-20160319 nick-nhusb-base-20151226 netbsd-7-0-RELEASE nick-nhusb-base-20150921 netbsd-7-0-RC3 netbsd-7-0-RC2 netbsd-7-0-RC1 nick-nhusb-base-20150606 nick-nhusb-base-20150406 nick-nhusb-base netbsd-7-base tls-earlyentropy-base tls-maxphys-base
|
#
1.36 |
|
10-Jul-2014 |
christos |
table can't be NULL here.
|
Revision tags: netbsd-6-0-6-RELEASE netbsd-6-1-5-RELEASE yamt-pagecache-base9 netbsd-6-1-4-RELEASE netbsd-6-0-5-RELEASE riastradh-xf86-video-intel-2-7-1-pre-2-21-15 riastradh-drm2-base3 netbsd-6-1-3-RELEASE netbsd-6-0-4-RELEASE netbsd-6-1-2-RELEASE netbsd-6-0-3-RELEASE rmind-smpnet-nbase netbsd-6-1-1-RELEASE riastradh-drm2-base2 riastradh-drm2-base1 riastradh-drm2-base rmind-smpnet-base netbsd-6-0-2-RELEASE netbsd-6-1-RELEASE netbsd-6-1-RC4 netbsd-6-1-RC3 agc-symver-base netbsd-6-1-RC2 netbsd-6-1-RC1 yamt-pagecache-base8 netbsd-6-0-1-RELEASE yamt-pagecache-base7 matt-nb6-plus-nbase yamt-pagecache-base6 netbsd-6-0-RELEASE netbsd-6-0-RC2 matt-nb6-plus-base netbsd-6-0-RC1 jmcneill-usbmp-base10 yamt-pagecache-base5 jmcneill-usbmp-base9 yamt-pagecache-base4 jmcneill-usbmp-base8 jmcneill-usbmp-base7 jmcneill-usbmp-base6 jmcneill-usbmp-base5 jmcneill-usbmp-base4 jmcneill-usbmp-base3 jmcneill-usbmp-base2 netbsd-6-base
|
#
1.35 |
|
22-Jan-2012 |
rmind |
branches: 1.35.6; 1.35.20; fileassoc_file_delete: pre-check whether fileassoc was used and thus avoid acquiring kernel-lock, which damages sys_unlink() performance.
|
Revision tags: jmcneill-usbmp-pre-base2 jmcneill-usbmp-base jmcneill-audiomp3-base yamt-pagecache-base3 yamt-pagecache-base2 yamt-pagecache-base rmind-uvmplock-nbase cherry-xenmp-base bouyer-quota2-nbase bouyer-quota2-base jruoho-x86intr-base matt-mips64-premerge-20101231 uebayasi-xip-base4 uebayasi-xip-base3 yamt-nfs-mp-base11 uebayasi-xip-base2 yamt-nfs-mp-base10 uebayasi-xip-base1 rmind-uvmplock-base yamt-nfs-mp-base9 uebayasi-xip-base
|
#
1.34 |
|
25-Dec-2009 |
elad |
branches: 1.34.12; 1.34.16; Oops - unintentional locking bit that's not yet ready.
|
#
1.33 |
|
25-Dec-2009 |
elad |
This subsystem had leftovers from the time it was part of Veriexec, and then from when I first implemented it as "metahook."
Cleanup a lot of the mess by unifying variable names, add struct member prefixes, adjust comments, etc.
No functional change intended.
|
#
1.32 |
|
25-Dec-2009 |
elad |
No need for these prototypes here.
|
Revision tags: netbsd-5-2-3-RELEASE netbsd-5-1-5-RELEASE netbsd-5-2-2-RELEASE netbsd-5-1-4-RELEASE netbsd-5-2-1-RELEASE netbsd-5-1-3-RELEASE netbsd-5-2-RELEASE netbsd-5-2-RC1 netbsd-5-1-2-RELEASE netbsd-5-1-1-RELEASE matt-nb5-mips64-premerge-20101231 matt-nb5-pq3-base netbsd-5-1-RELEASE netbsd-5-1-RC4 matt-nb5-mips64-k15 netbsd-5-1-RC3 netbsd-5-1-RC2 netbsd-5-1-RC1 netbsd-5-0-2-RELEASE matt-nb5-mips64-premerge-20091211 matt-premerge-20091211 yamt-nfs-mp-base8 matt-nb5-mips64-u2-k2-k4-k7-k8-k9 matt-nb4-mips64-k7-u2a-k9b matt-nb5-mips64-u1-k1-k5 yamt-nfs-mp-base7 netbsd-5-0-1-RELEASE jymxensuspend-base yamt-nfs-mp-base6 yamt-nfs-mp-base5 yamt-nfs-mp-base4 jym-xensuspend-nbase yamt-nfs-mp-base3 nick-hppapmap-base4 nick-hppapmap-base3 netbsd-5-0-RELEASE netbsd-5-0-RC4 netbsd-5-0-RC3 nick-hppapmap-base2 netbsd-5-0-RC2 jym-xensuspend-base netbsd-5-0-RC1 haad-dm-base2 haad-nbase2 ad-audiomp2-base netbsd-5-base nick-hppapmap-base matt-mips64-base2 haad-dm-base1 wrstuden-revivesa-base-4 wrstuden-revivesa-base-3 wrstuden-revivesa-base-2 haad-dm-base wrstuden-revivesa-base-1 simonb-wapbl-nbase yamt-pf42-base4 simonb-wapbl-base yamt-pf42-base3 hpcarm-cleanup-nbase yamt-pf42-base2 yamt-nfs-mp-base2 wrstuden-revivesa-base mjf-devfs2-base
|
#
1.31 |
|
05-May-2008 |
ad |
- Convert hashinit() to use kmem_alloc(). The hash tables can be large and it's better to not have them in kmem_map. - Convert a couple of minor items along the way to kmem_alloc(). - Fix some memory leaks.
|
Revision tags: yamt-pf42-baseX yamt-nfs-mp-base yamt-pf42-base ad-socklock-base1 yamt-lazymbuf-base15 yamt-lazymbuf-base14 keiichi-mipv6-nbase nick-net80211-sync-base keiichi-mipv6-base bouyer-xeni386-nbase bouyer-xeni386-base matt-armv6-nbase mjf-devfs-base matt-armv6-base hpcarm-cleanup-base
|
#
1.30 |
|
02-Jan-2008 |
ad |
branches: 1.30.6; 1.30.8; 1.30.10; Merge vmlocking2 to head.
|
Revision tags: nick-csl-alignment-base5 matt-armv6-prevmlocking vmlocking2-base3 yamt-kmem-base3 cube-autoconf-base yamt-kmem-base2 yamt-kmem-base vmlocking2-base2 reinoud-bufcleanup-nbase vmlocking2-base1 jmcneill-base bouyer-xenamd64-base2 vmlocking-nbase yamt-x86pmap-base4 bouyer-xenamd64-base yamt-x86pmap-base3 yamt-x86pmap-base2 yamt-x86pmap-base matt-mips64-base jmcneill-pm-base nick-csl-alignment-base yamt-idlelwp-base8 reinoud-bufcleanup-base mjf-ufs-trans-base vmlocking-base
|
#
1.29 |
|
15-May-2007 |
elad |
branches: 1.29.8; 1.29.14; 1.29.16; 1.29.20; Some Veriexec stuff that's been rotting in my tree for months.
Bug fixes: - Fix crash reported by Scott Ellis on current-users@.
- Fix race conditions in enforcing the Veriexec rename and remove policies. These are NOT security issues.
- Fix memory leak in rename handling when overwriting a monitored file.
- Fix table deletion logic.
- Don't prevent query requests if not in learning mode.
KPI updates: - fileassoc_table_run() now takes a cookie to pass to the callback.
- veriexec_table_add() was removed, it is now done internally. As a result, there's no longer a need for VERIEXEC_TABLESIZE.
- veriexec_report() was removed, it is now internal.
- Perform sanity checks on the entry type, and enforce default type in veriexec_file_add() rather than in veriexecctl.
- Add veriexec_flush(), used to delete all Veriexec tables, and veriexec_dump(), used to fill an array with all Veriexec entries.
New features: - Add a '-k' flag to veriexecctl, to keep the filenames in the kernel database. This allows Veriexec to produce slightly more accurate logs under certain circumstances. In the future, this can be either replaced by vnode->pathname translation, or combined with it.
- Add a VERIEXEC_DUMP ioctl, to dump the entire Veriexec database. This can be used to recover a database if the file was lost. Example usage:
# veriexecctl dump > /etc/signatures
Note that only entries with the filename kept (that is, were loaded with the '-k' flag) will be dumped.
Idea from Brett Lymn.
- Add a VERIEXEC_FLUSH ioctl, to delete all Veriexec entries. Sample usage:
# veriexecctl flush
- Add a 'veriexec_flags' rc(8) variable, and make its default have the '-k' flag. On systems using the default signatures file (generaetd from running 'veriexecgen' with no arguments), this will use additional 32kb of kernel memory on average.
- Add a '-e' flag to veriexecctl, to evaluate the fingerprint during load. This is done automatically for files marked as 'untrusted'.
Misc. stuff: - The code for veriexecctl was massively simplified as a result of eliminating the need for VERIEXEC_TABLESIZE, and now uses a single pass of the signatures file, making the loading somewhat faster.
- Lots of minor fixes found using the (still under development) Veriexec regression testsuite.
- Some of the messages Veriexec prints were improved.
- Various documentation fixes.
All relevant man-pages were updated to reflect the above changes.
Binary compatibility with existing veriexecctl binaries is maintained.
|
Revision tags: thorpej-atomic-base
|
#
1.28 |
|
05-Apr-2007 |
rmind |
Revert the latest changes back to 1.25 rev.
|
#
1.27 |
|
04-Apr-2007 |
rmind |
Fix tbl, which was misstyped as tlb.
|
#
1.26 |
|
03-Apr-2007 |
rmind |
fileassoc_file_delete: Handle an error case of fileassoc_table_lookup(). CID: 4431
|
#
1.25 |
|
09-Mar-2007 |
yamt |
branches: 1.25.2; 1.25.4; fileassoc_table_lookup: call fileassoc_init if it has not been done yet. fixes crashes sys_unlink when there are no users of fileassoc.
|
Revision tags: ad-audiomp-base post-newlock2-merge newlock2-nbase newlock2-base
|
#
1.24 |
|
08-Feb-2007 |
elad |
branches: 1.24.2; remove empty line
|
#
1.23 |
|
07-Feb-2007 |
elad |
- Properly autocreate tables, - Properly track number of used slots in the table, - Track number of "assocs" per entry.
|
#
1.22 |
|
06-Feb-2007 |
elad |
PR/35253: YAMAMOTO Takashi: fileassoc hash size problem
fileassoc_table_add() was removed from the KPI and made internal. From now fileassoc(9) will manage the optimal table size internally.
Input from and okay yamt@.
|
#
1.21 |
|
26-Jan-2007 |
elad |
Add missing specificdata_key_delete() in fileassoc_deregister().
|
#
1.20 |
|
25-Jan-2007 |
elad |
Update comment: device -> mount. No functional change.
|
#
1.19 |
|
09-Jan-2007 |
elad |
Remove advertising clause from all of my stuff.
|
#
1.18 |
|
26-Dec-2006 |
elad |
branches: 1.18.2; Fix a comment. No functional change.
|
#
1.17 |
|
23-Dec-2006 |
yamt |
- remove the fileassoc "tabledata" functionality. use mountspecific instead. - make pax_segvguard_cb static.
tested and ok'ed by elad.
|
Revision tags: yamt-splraiseipl-base5 yamt-splraiseipl-base4
|
#
1.16 |
|
14-Dec-2006 |
yamt |
- just associate fileassoc "table" to struct mount. because the latter is always available during the lifetime of the former, there is little point to use another global list to keep track of them. it also allows to remove an #ifdef FILEASSOC.
- avoid some operations (memory allocation and VOP) in fileassoc_file_lookup, when fileassoc table is not used.
ok'ed by elad.
|
#
1.15 |
|
12-Dec-2006 |
yamt |
make fileassoc_tables static.
|
#
1.14 |
|
11-Dec-2006 |
yamt |
- remove a static configuration, FILEASSOC_NHOOKS. do it dynamically instead. - make fileassoc_t a pointer and remove FILEASSOC_INVAL. - clean up kern_fileassoc.c. unify duplicated code. - unexport fileassoc_init using RUN_ONCE(9). - plug memory leaks in fileassoc_file_delete and fileassoc_table_delete. - always call callbacks, regardless of the value of the associated data.
ok'ed by elad.
|
Revision tags: yamt-splraiseipl-base3
|
#
1.13 |
|
08-Dec-2006 |
yamt |
don't expose FILEASSOC_NHOOKS.
|
Revision tags: netbsd-4-0-1-RELEASE wrstuden-fixsa-newbase wrstuden-fixsa-base-1 netbsd-4-0-RELEASE netbsd-4-0-RC5 matt-nb4-arm-base netbsd-4-0-RC4 netbsd-4-0-RC3 netbsd-4-0-RC2 netbsd-4-0-RC1 wrstuden-fixsa-base netbsd-4-base
|
#
1.12 |
|
20-Nov-2006 |
elad |
compare pointer against null, not zero
|
#
1.11 |
|
27-Oct-2006 |
elad |
Don't leak handle.
|
Revision tags: yamt-splraiseipl-base2 yamt-splraiseipl-base yamt-pdpolicy-base9 rpaulo-netinet-merge-pcb-base
|
#
1.10 |
|
08-Sep-2006 |
blymn |
branches: 1.10.2; 1.10.4; * Correct hashing macro so it uses FHANDLE_SIZE() * Stop fhandle memory leaks and use the correct fhandle dealloc routine (thanks to Elad for these fixes) * Remove include of kmem.h, it is not required.
|
#
1.9 |
|
06-Sep-2006 |
blymn |
branches: 1.9.2; * Remove "hinted" interface * Modify fileassoc internals to use fhandle_t instead of fileid
|
Revision tags: yamt-pdpolicy-base8
|
#
1.8 |
|
20-Aug-2006 |
blymn |
Add functions to the fileassoc interface to allow a "hint" to be provided instead of performing an implicit VOP_GETATTR() when adding/looking up fileassoc entries.
|
#
1.7 |
|
13-Aug-2006 |
xtraeme |
Add __KERNEL_RCSID()
|
#
1.6 |
|
11-Aug-2006 |
christos |
Pretending to be Elad's keyboard:
fileassoc.diff adds a fileassoc_table_run() routine that allows you to pass a callback to be called with every entry on a given mount.
veriexec.diff adds some raw device access policies: if raw disk is opened at strict level 1, all fingerprints on this disk will be invalidated as a safety measure. level 2 will not allow opening disk for raw writing if we monitor it, and prevent raw writes to memory. level 3 will not allow opening any disk for raw writing.
both update all relevant documentation.
veriexec concept is okay blymn@.
|
Revision tags: abandoned-netbsd-4-base yamt-pdpolicy-base7
|
#
1.5 |
|
23-Jul-2006 |
ad |
branches: 1.5.2; 1.5.4; Use the LWP cached credentials where sane.
|
#
1.4 |
|
20-Jul-2006 |
cube |
Fix an obvious overlook (struct fileassoc_hook is not defined in fileassoc.h anymore). I could say "please compile-test", but then, I'm not doing it either for that commit.
|
#
1.3 |
|
16-Jul-2006 |
elad |
expose less api; prompted by yamt@.
|
#
1.2 |
|
15-Jul-2006 |
elad |
dont use magic numbers.
|
#
1.1 |
|
14-Jul-2006 |
elad |
okay, since there was no way to divide this to two commits, here it goes..
introduce fileassoc(9), a kernel interface for associating meta-data with files using in-kernel memory. this is very similar to what we had in veriexec till now, only abstracted so it can be used more easily by more consumers.
this also prompted the redesign of the interface, making it work on vnodes and mounts and not directly on devices and inodes. internally, we still use file-id but that's gonna change soon... the interface will remain consistent.
as a result, veriexec went under some heavy changes to conform to the new interface. since we no longer use device numbers to identify file-systems, the veriexec sysctl stuff changed too: kern.veriexec.count.dev_N is now kern.veriexec.tableN.* where 'N' is NOT the device number but rather a way to distinguish several mounts.
also worth noting is the plugging of unmount/delete operations wrt/fileassoc and veriexec.
tons of input from yamt@, wrstuden@, martin@, and christos@.
|