INTRO (9) NetBSD Kernel Developer's Manual INTRO (9) NAME ...

More documents

Recommendations

Info

SECMODEL_OVERLAY(9) NetBSD Kernel Developer’s Manual SECMODEL_OVERLAY(9)NAMEsecmodel_overlay —sample overlay security model implementationSYNOPSIS#include DESCRIPTIONsecmodel_overlay is a sample implementation for an overlay security model. It can be thought of as a“filter” for the underlying model it overlays, by default it is secmodel_bsd44(9), where developers oradministrators can implement custom policies using least intrusive code changes.FILES/usr/src/sys/secmodel/overlay/secmodel_overlay.cSEE ALSOkauth(9), secmodel(9), secmodel_bsd44(9)AUTHORSElad Efrat 〈elad@NetBSD.org〉NetBSD 3.0 September 15, 2006 1
SECMODEL_BSD44 (9) NetBSD Kernel Developer’s Manual SECMODEL_BSD44 (9)NAMEsecmodel_bsd44 —traditional NetBSD security model (based on 4.4BSD)DESCRIPTIONThe securelevel mechanism is intended to allow protecting the persistence of code and data on the system, orasubset thereof, from modification, even bythe super-user, byproviding convenient means of “lockingdown” a system to a degree suited to its environment.The super-user can raise the securelevel using sysctl(8), but only init(8) can lower it.secmodel_bsd44 provides four levels of securelevel, defined as follows:-1 Permanently insecure mode− Don’t raise the securelevel onboot0 Insecure mode− The init process (PID 1) may not be traced or accessed by ptrace(2) or procfs.− Immutable and append-only file flags may be changed− All devices may be read or written subject to their permissions1 Secure mode− All effects of securelevel 0− /dev/mem and /dev/kmem may not be written to− Raw disk devices of mounted file systems are read-only− Immutable and append-only file flags may not be removed− Kernel modules may not be loaded or unloaded− The net.inet.ip.sourceroute sysctl(8) variable may not be changed− Adding or removing sysctl(9) nodes is denied− The RTC offset may not be changed− Set-id coredump settings may not be altered− Attaching the IP-based kernel debugger, ipkdb(4), is not allowed− Device “pass-thru” requests that may be used to perform raw disk and/or memory access aredenied− iopl and ioperm calls are denied− Access to unmanaged memory is denied2 Highly secure mode− All effects of securelevel 1− Raw disk devices are always read-only whether mounted or not− New disks may not be mounted, and existing mounts may only be downgraded from read-write toread-only− The system clock may not be set backwards or close to overflow− Per-process coredump name may not be changed− Packet filtering and NAT rules may not be alteredHighly secure mode may seem Draconian, but is intended as a last line of defence should the superuseraccount be compromised. Its effects preclude circumvention of file flags by direct modification of a raw diskdevice, or erasure of a file system by means of newfs(8). Further, itcan limit the potential damage of acompromised “firewall” by prohibiting the modification of packet filter rules. Preventing the system clockfrom being set backwards aids in post-mortem analysis and helps ensure the integrity of logs. Precisiontimekeeping is not affected because the clock may still be slowed.Normally, the system runs in securelevel 0while single-user and in securelevel 1while multi-user. Ifahigher securelevel isdesired while running multi-user, itcan be set using the securelevel keyword in thestartup script /etc/rc.conf, see rc.conf(5) for details. Lower securelevels require the kernel to becompiled with options INSECURE, causing it to always default to securelevel −1.NetBSD 3.0 November 21, 2007 1
Page 1 and 2:
INTRO(9) NetBSD Kernel Developer’
Page 3 and 4:
Page 5 and 6:
Page 7 and 8:
KASSERT(9) NetBSD Kernel Developer
Page 9 and 10:
RUN_ONCE (9) NetBSD Kernel Develope
Page 11 and 12:
ALTQ (9) NetBSD Kernel Developer’
Page 13 and 14:
Page 15 and 16:
Page 17 and 18:
Page 19 and 20:
ARP (9) NetBSD Kernel Developer’s
Page 21 and 22:
AUDIO (9) NetBSD Kernel Developer
Page 23 and 24:
Page 25 and 26:
Page 27:
AUTOCONF (9) NetBSD Kernel Develope
Page 31 and 32:
BCDTOBIN (9) NetBSD Kernel Develope
Page 33 and 34:
BCOPY (9) NetBSD Kernel Developer
Page 35 and 36:
BIOSCALL (9) NetBSD/i386 Kernel Dev
Page 37 and 38:
BITMASK_SNPRINTF (9) NetBSD Kernel
Page 39 and 40:
BLUETOOTH (9) NetBSD Kernel Develop
Page 41 and 42:
BLUETOOTH (9) NetBSD Kernel Develop
Page 43 and 44:
BUFFERCACHE (9) NetBSD Kernel Devel
Page 45 and 46:
BUFFERCACHE (9) NetBSD Kernel Devel
Page 47 and 48:
BUFQ (9) NetBSD Kernel Developer’
Page 49 and 50:
BUS_DMA (9) NetBSD Kernel Developer
Page 51 and 52:
Page 53 and 54:
Page 55 and 56:
Page 57 and 58:
BUS_SPACE(9) NetBSD Kernel Develope
Page 59 and 60:
Page 61 and 62:
Page 63 and 64:
Page 65 and 66:
Page 67 and 68:
Page 69 and 70:
Page 71 and 72:
Page 73 and 74:
Page 75 and 76:
BZERO(9) NetBSD Kernel Developer’
Page 77 and 78:
CALLOUT (9) NetBSD Kernel Developer
Page 79 and 80:
CARDBUS (9) NetBSD Kernel Developer
Page 81 and 82:
CARDBUS (9) NetBSD Kernel Developer
Page 83 and 84:
CNMAGIC (9) NetBSD Kernel Developer
Page 85 and 86:
CONDVAR(9) NetBSD Kernel Developer
Page 87 and 88:
CONDVAR(9) NetBSD Kernel Developer
Page 89 and 90:
CONFIG (9) NetBSD Kernel Developer
Page 91 and 92:
CONFIG (9) NetBSD Kernel Developer
Page 93 and 94:
CONS (9) NetBSD Kernel Developer’
Page 95 and 96:
COPY (9) NetBSD Kernel Developer’
Page 97 and 98:
CPU_CONFIGURE (9) NetBSD Kernel Dev
Page 99 and 100:
CPU_DUMPCONF (9) NetBSD Kernel Deve
Page 101 and 102:
CPU_INITCLOCKS (9) NetBSD Kernel De
Page 103 and 104:
CPU_NEED_RESCHED (9) NetBSD Kernel
Page 105 and 106:
CPU_REBOOT(9) NetBSD Kernel Develop
Page 107 and 108:
CPU_STARTUP (9) NetBSD Kernel Devel
Page 109 and 110:
CPU_SWITCHTO(9) NetBSD Kernel Devel
Page 111 and 112:
CSF (9) NetBSD Kernel Developer’s
Page 113 and 114:
CSF (9) NetBSD Kernel Developer’s
Page 115 and 116:
DDC (9) NetBSD Kernel Developer’s
Page 117 and 118:
DISK (9) NetBSD Kernel Developer’
Page 119 and 120:
Page 121 and 122:
Page 123 and 124:
DISKLABEL (9) NetBSD Kernel Develop
Page 125 and 126:
DMOVER (9) NetBSD Kernel Developer
Page 127 and 128:
Page 129 and 130:
Page 131 and 132:
DO_SETRESUID (9) NetBSD Kernel Deve
Page 133 and 134:
DOFILEREAD (9) NetBSD Kernel Develo
Page 135 and 136:
DOSHUTDOWNHOOKS (9) NetBSD Kernel D
Page 137 and 138:
DRIVER (9) NetBSD Kernel Developer
Page 139 and 140:
EDID (9) NetBSD Kernel Developer’
Page 141 and 142:
ERRNO (9) NetBSD Kernel Developer
Page 143 and 144:
ETHERSUBR (9) NetBSD Kernel Develop
Page 145 and 146:
EVCNT (9) NetBSD Kernel Developer
Page 147 and 148:
EVCNT (9) NetBSD Kernel Developer
Page 149 and 150:
EXTENT (9) NetBSD Kernel Developer
Page 151 and 152:
EXTENT (9) NetBSD Kernel Developer
Page 153 and 154:
FETCH (9) NetBSD Kernel Developer
Page 155 and 156:
FILE (9) NetBSD Kernel Developer’
Page 157 and 158:
FILEASSOC (9) NetBSD Kernel Develop
Page 159 and 160:
FILEASSOC (9) NetBSD Kernel Develop
Page 161 and 162:
FILEDESC (9) NetBSD Kernel Develope
Page 163 and 164:
FILEDESC (9) NetBSD Kernel Develope
Page 165 and 166:
FIRMLOAD (9) NetBSD Kernel Develope
Page 167 and 168:
FORK1 (9) NetBSD Kernel Developer
Page 169 and 170:
FSETOWN(9) NetBSD Kernel Developer
Page 171 and 172:
FSTRANS (9) NetBSD Kernel Developer
Page 173 and 174:
GETIOBUF (9) NetBSD Kernel Develope
Page 175 and 176:
HASH (9) NetBSD Kernel Developer’
Page 177 and 178:
HASHINIT (9) NetBSD Kernel Develope
Page 179 and 180:
HZ (9) NetBSD Kernel Developer’s
Page 181 and 182:
IEEE80211 (9) NetBSD Kernel Develop
Page 183 and 184:
IEEE80211_INPUT (9) NetBSD Kernel D
Page 185 and 186:
IEEE80211_NODE (9) NetBSD Kernel De
Page 187 and 188:
IEEE80211_NODE (9) NetBSD Kernel De
Page 189 and 190:
IEEE80211_OUTPUT (9) NetBSD Kernel
Page 191 and 192:
IEEE80211_RADIOTAP(9) NetBSD Kernel
Page 193 and 194:
IEEE80211_RADIOTAP(9) NetBSD Kernel
Page 195 and 196:
IIC (9) NetBSD Kernel Developer’s
Page 197 and 198:
IIC (9) NetBSD Kernel Developer’s
Page 199 and 200:
IN_CKSUM (9) NetBSD Kernel Develope
Page 201 and 202:
IN_GETIFA(9) NetBSD Kernel Develope
Page 203 and 204:
IOASIC (9) NetBSD Kernel Developer
Page 205 and 206:
IOASIC (9) NetBSD Kernel Developer
Page 207 and 208:
IOCTL (9) NetBSD Kernel Developer
Page 209 and 210:
IOCTL (9) NetBSD Kernel Developer
Page 211 and 212:
IPKDB (9) NetBSD Kernel Developer
Page 213 and 214:
ISA (9) NetBSD Kernel Developer’s
Page 215 and 216:
Page 217 and 218:
Page 219 and 220:
ISAPNP (9) NetBSD Kernel Developer
Page 221 and 222:
ISR_ADD (9) NetBSD/sun3 Kernel Deve
Page 223 and 224:
ITIMERFIX (9) NetBSD Kernel Develop
Page 225 and 226:
KAUTH (9) NetBSD Kernel Developer
Page 227 and 228:
Page 229 and 230:
Page 231 and 232:
Page 233 and 234:
Page 235 and 236:
Page 237 and 238:
Page 239 and 240:
KCOPY (9) NetBSD Kernel Developer
Page 241 and 242:
KFILTER_REGISTER (9) NetBSD Kernel
Page 243 and 244:
KMEM_FREE (9) NetBSD Kernel Develop
Page 245 and 246:
KNOTE (9) NetBSD Kernel Developer
Page 247 and 248:
KPREEMPT (9) NetBSD Kernel Develope
Page 249 and 250:
KPRINTF (9) NetBSD Kernel Developer
Page 251 and 252:
KTHREAD (9) NetBSD Kernel Developer
Page 253 and 254:
LINEDISC (9) NetBSD Kernel Develope
Page 255 and 256:
LOG (9) NetBSD Kernel Developer’s
Page 257 and 258:
LTSLEEP (9) NetBSD Kernel Developer
Page 259 and 260:
M_TAG (9) NetBSD Kernel Developer
Page 261 and 262:
MALLOC (9) NetBSD Kernel Developer
Page 263 and 264:
MALLOC (9) NetBSD Kernel Developer
Page 265 and 266:
MB (9) NetBSD Kernel Developer’s
Page 267 and 268:
MBUF (9) NetBSD Kernel Developer’
Page 269 and 270:
Page 271 and 272:
Page 273 and 274:
Page 275 and 276:
MCA (9) NetBSD Kernel Developer’s
Page 277 and 278:
MEMCMP (9) NetBSD Kernel Developer
Page 279 and 280:
MEMMOVE (9) NetBSD Kernel Developer
Page 281 and 282:
MEMORYALLOCATORS (9) NetBSD Kernel
Page 283 and 284:
MI_SWITCH (9) NetBSD Kernel Develop
Page 285 and 286:
MICROSEQ (9) NetBSD Kernel Develope
Page 287 and 288:
Page 289 and 290:
Page 291 and 292:
MICROTIME (9) NetBSD Kernel Develop
Page 293 and 294:
MSTOHZ (9) NetBSD Kernel Developer
Page 295 and 296:
MUTEX (9) NetBSD Kernel Developer
Page 297 and 298:
NAMECACHE (9) NetBSD Kernel Develop
Page 299 and 300:
NAMECACHE (9) NetBSD Kernel Develop
Page 301 and 302:
NAMEI (9) NetBSD Kernel Developer
Page 303 and 304:
NAMEI (9) NetBSD Kernel Developer
Page 305 and 306:
OPENCRYPTO(9) NetBSD Kernel Develop
Page 307 and 308:
Page 309 and 310:
Page 311 and 312:
OPTSTR (9) NetBSD Kernel Developer
Page 313 and 314:
PCI (9) NetBSD Kernel Developer’s
Page 315 and 316:
Page 317 and 318:
Page 319 and 320:
Page 321 and 322:
PCI_CONFIGURE_BUS (9) NetBSD Kernel
Page 323 and 324:
PCI_INTR (9) NetBSD Kernel Develope
Page 325 and 326:
PCKBPORT(9) NetBSD Kernel Developer
Page 327 and 328:
PCKBPORT(9) NetBSD Kernel Developer
Page 329 and 330:
PCMCIA (9) NetBSD Kernel Developer
Page 331 and 332:
Page 333 and 334:
Page 335 and 336:
PFIL (9) NetBSD Kernel Developer’
Page 337 and 338:
PHYSIO (9) NetBSD Kernel Developer
Page 339 and 340:
PMAP (9) NetBSD Kernel Developer’
Page 341 and 342:
Page 343 and 344:
Page 345 and 346:
Page 347 and 348:
Page 349 and 350:
Page 351 and 352:
PMC (9) NetBSD Kernel Developer’s
Page 353 and 354:
PMC (9) NetBSD Kernel Developer’s
Page 355 and 356:
PMF (9) NetBSD Kernel Developer’s
Page 357 and 358: PMF (9) NetBSD Kernel Developer’s
Page 359 and 360: POOL (9) NetBSD Kernel Developer’
Page 361 and 362: POOL (9) NetBSD Kernel Developer’
Page 363 and 364: POOL_CACHE (9) NetBSD Kernel Develo
Page 365 and 366: POWERHOOK_ESTABLISH (9) NetBSD Kern
Page 367 and 368: PPI (9) NetBSD Kernel Developer’s
Page 369 and 370: PREEMPT (9) NetBSD Kernel Developer
Page 371 and 372: PROP_COPYIN_IOCTL (9) NetBSD Kernel
Page 373 and 374: RADIO (9) NetBSD Kernel Developer
Page 375 and 376: RAS (9) NetBSD Kernel Developer’s
Page 377 and 378: RASOPS (9) NetBSD Kernel Developer
Page 379 and 380: RATECHECK (9) NetBSD Kernel Develop
Page 381 and 382: RESETTODR (9) NetBSD Kernel Develop
Page 383 and 384: RND (9) NetBSD Kernel Developer’s
Page 385 and 386: RSSADAPT (9) NetBSD Kernel Develope
Page 387 and 388: RSSADAPT (9) NetBSD Kernel Develope
Page 389 and 390: RT_TIMER (9) NetBSD Kernel Develope
Page 391 and 392: RWLOCK (9) NetBSD Kernel Developer
Page 393 and 394: SCHED_4BSD (9) NetBSD Kernel Develo
Page 395 and 396: SCSIPI (9) NetBSD Kernel Developer
Page 401 and 402: SECMODEL (9) NetBSD Kernel Develope
Page 407: SECMODEL_BSD44 (9) NetBSD Kernel De
Page 411 and 412: SELECT (9) NetBSD Kernel Developer
Page 413 and 414: SHUTDOWNHOOK_ESTABLISH (9) NetBSD K
Page 415 and 416: SIGNAL (9) NetBSD Kernel Developer
Page 421 and 422: SOFTINT (9) NetBSD Kernel Developer
Page 423 and 424: SPL (9) NetBSD Kernel Developer’s
Page 425 and 426: SPLRAISEIPL (9) NetBSD Kernel Devel
Page 427 and 428: SUSPENDSCHED (9) NetBSD Kernel Deve
Page 429 and 430: SYSCTL (9) NetBSD Kernel Developer
Page 435 and 436: SYSMON_ENVSYS (9) NetBSD Kernel Dev
Page 441 and 442: TC (9) NetBSD Kernel Developer’s
Page 443 and 444: TC (9) NetBSD Kernel Developer’s
Page 445 and 446: TIME_SECOND (9) NetBSD Kernel Devel
Page 447 and 448: TODR (9) NetBSD Kernel Developer’
Page 449 and 450: UCOM (9) NetBSD Kernel Developer’
Page 451 and 452: UCOM (9) NetBSD Kernel Developer’
Page 453 and 454: UIOMOVE (9) NetBSD Kernel Developer
Page 455 and 456: USBDI (9) NetBSD Kernel Developer
Page 457 and 458: USBDI (9) NetBSD Kernel Developer
Page 459 and 460:
UVM (9) NetBSD Kernel Developer’s
Page 461 and 462:
Page 463 and 464:
Page 465 and 466:
Page 467 and 468:
Page 469 and 470:
Page 471 and 472:
VATTR (9) NetBSD Kernel Developer
Page 473 and 474:
VCONS (9) NetBSD Kernel Developer
Page 475 and 476:
VERIEXEC (9) NetBSD Kernel Develope
Page 477 and 478:
VERIEXEC (9) NetBSD Kernel Develope
Page 479 and 480:
VFS_HOOKS (9) NetBSD Kernel Develop
Page 481 and 482:
VFSOPS (9) NetBSD Kernel Developer
Page 483 and 484:
VFSOPS (9) NetBSD Kernel Developer
Page 485 and 486:
VFSSUBR (9) NetBSD Kernel Developer
Page 487 and 488:
VME (9) NetBSD Kernel Developer’s
Page 489 and 490:
VME (9) NetBSD Kernel Developer’s
Page 491 and 492:
VMEM (9) NetBSD Kernel Developer’
Page 493 and 494:
VMEM_CREATE (9) NetBSD Kernel Devel
Page 495 and 496:
VMEM_FREE (9) NetBSD Kernel Develop
Page 497 and 498:
VMEM_XFREE (9) NetBSD Kernel Develo
Page 499 and 500:
VNFILEOPS (9) NetBSD Kernel Develop
Page 501 and 502:
VNODE (9) NetBSD Kernel Developer
Page 503 and 504:
Page 505 and 506:
Page 507 and 508:
Page 509 and 510:
VNODEOPS (9) NetBSD Kernel Develope
Page 511 and 512:
Page 513 and 514:
Page 515 and 516:
Page 517 and 518:
Page 519 and 520:
Page 521 and 522:
Page 523 and 524:
VNSUBR (9) NetBSD Kernel Developer
Page 525 and 526:
WDC (9) NetBSD Kernel Developer’s
Page 527 and 528:
WDC (9) NetBSD Kernel Developer’s
Page 529 and 530:
WORKQUEUE (9) NetBSD Kernel Develop
Page 531 and 532:
WORKQUEUE_DESTROY (9) NetBSD Kernel
Page 533 and 534:
WSCONS (9) NetBSD Kernel Developer
Page 535 and 536:
WSDISPLAY(9) NetBSD Kernel Develope
Page 537 and 538:
WSDISPLAY(9) NetBSD Kernel Develope
Page 539 and 540:
WSFONT (9) NetBSD Kernel Developer
Page 541 and 542:
WSFONT (9) NetBSD Kernel Developer
Page 543 and 544:
WSKBD (9) NetBSD Kernel Developer
Page 545 and 546:
WSKBD (9) NetBSD Kernel Developer
Page 547 and 548:
WSMOUSE (9) NetBSD Kernel Developer
show all

INTRO (9) NetBSD Kernel Developer's Manual INTRO (9) NAME ...

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?