summaryrefslogtreecommitdiffstats
path: root/src/privsep.h
Commit message (Collapse)AuthorAge
* Rename Master to ManagerRoy Marples2021-02-02
|
* eloop: Make the API more like native poll/kqueue/epollRoy Marples2021-02-02
| | | | | | | | | Just have the one callback, but return an abstracted event mask to work out if we can read/write have something else. Log diagnostics if the event mask is unexpected. While here add more logging if we fail to register an event to monitor.
* A belated welcome to 2021Roy Marples2021-01-31
|
* WhitespaceRoy Marples2021-01-27
|
* privsep: Allow logfile reopening in a chrootRoy Marples2020-10-30
| | | | | | Now that only the privileged actioneer does the actual logging we can safely reopen the file we are logging to. This also closes and re-opens the syslog connection.
* privsep: We need getsockopt as well as setsockopt on the link socketRoy Marples2020-10-03
| | | | | So we can report receive buffer size. Important for route(4) overflow so we can try and set a bigger buffer.
* privsep: allow CAP_SETSOCKOPT for route(4) fd.Roy Marples2020-10-02
| | | | | If FreeBSD ever implements RO_MISSFILTER it will need special rights to work over Capsium.
* privsep: sandbox the launcher processRoy Marples2020-09-20
|
* privsep: Log if the platform sandbox is unavailable or availableRoy Marples2020-09-20
| | | | This is kinda important.
* privsep: Add the SECCOMP BPF sandbox for LinuxRoy Marples2020-09-19
| | | | | Now we have capsicum, pledge and the POSIX resource limited sandboxes this was quite easy really.
* privsep: Fold capsicum and pledge entry points into ps_entersandboxRoy Marples2020-09-19
|
* privsep: dropprivs can be staticRoy Marples2020-09-06
|
* privsep: control proxy is no longer optionalRoy Marples2020-06-10
| | | | | | It's required for pledge. It *could* be optional for capsicum but I'd like to try and keep the sandboxing the same for now.
* privsep: For Linux and Solaris, set RLIMIT_NOFILES to neventsRoy Marples2020-06-09
| | | | | | | Because poll(2) returns EINVAL if nfds is higher. This really blows chunks, but it is what it is. An attacker could close a fd and open something else, but it's the best we can do.
* privsep: Implement a resource limited sandboxRoy Marples2020-06-09
| | | | | | | | | | | | | For systems without Capsicum or Pledge we can create a resource limited sandbox provided that either ppoll(2) or works with RLIMIT_NOFILES set to zero. As far as dhcpcd is concerned, that means Linux and Solaris won't work with this, but NetBSD and DragonFlyBSD will. To achieve this, a special control proxy process will be spawned just to accept new connections over the control socket because this *cannot* be limited by RLIMIT_NOFILES.
* privsep: Limit rights generically rather than Capsicum specifcRoy Marples2020-06-05
| | | | | | | | | You never know when another sandbox tech comes around. While here, add limits for every socket in the unpriviledged processes. Some were absent before. Also, note that RLIMIT_NOFILE breaks our control socket so temporary disable that.
* privsep: Remove pledges inet and dns from the master processRoy Marples2020-06-05
| | | | | | | | | Achieved by adding IPC to ignore interfaces names based on the interface group. This means every process just pledges stdio for IPC which the exception of the master process which also pledges route so it can access the routing table.
* privsep: Access the RDM monotic file via IPCRoy Marples2020-06-02
| | | | | As we can't get at it in the chroot. While here, harden the file.
* privsep: Allow dev plugins to workRoy Marples2020-05-24
| | | | | For udev at least, it requires a /var/run to be available in the chroot which is poor. As such, give it a full IPC.
* privsep: Allow Linux to work without needing any mountsRoy Marples2020-05-24
|
* privsep: Enable Capsicum for all processes.Roy Marples2020-05-19
| | | | | | | | | | | | | | | | | Except for the priviledged process. This is quite an in-depth change: * ARP is now one process per address * BPF flags are now returned via privsep * BPF write filters are locked when supported * The root process sends to the network The last step is done by opening RAW sockets and then sending a UDP header (where applicable) to avoid binding to an address which is already in use by the reader sockets. This is slightly wasteful for OS's without sandboxing but does have the very nice side effect of not needing a source address to unicast DHCPs replies from which makes the code smaller.
* BPF: Set write filters where supportedRoy Marples2020-05-15
| | | | | While here make Capsicum and Pledge more granular so we can easily Pledge the BPF BOOTP process but not the ARP one.
* privsep: Add a generic wrapper for getifaddrs(3)Roy Marples2020-05-13
| | | | | | | | Although this is only for Capsicum, the getifaddrs interface is quite portable although not POSIX. With this final change, the Master process can now enter Capsicum Capabilites Mode and this completes the Capsicum integration.
* privsep: Handle all file IO in the Priviledged ActioneerRoy Marples2020-05-12
| | | | | | | | | | This allows us to move the database directory back into the root of the filesystem. While here, harden the files by denying any user read access to them. As part of this change, init the DUID from any machine data and cache the default DHCP vendor field before dropping priviledges as we may lose access to this later.
* privsep: Implement pledge(2) support as found on OpenBSDRoy Marples2020-05-10
|
* privsep: Add function for indirect ioctlRoy Marples2020-05-10
|
* privsep: Enable capsicum for network facing processesRoy Marples2020-05-07
| | | | | | | All fd's in network facing processes are fully limited. Capability mode is only enabled for BPF processes because it's too restrictive otherwise - the reasons are noted in the commit.
* spelling: Correct both privilege and separationRoy Marples2020-02-10
| | | | Found by Arfrever.
* privsep: copy configuration file into chrootRoy Marples2020-01-21
| | | | | | Only if it has changed. Saves having to maintian it outside of dhcpcdm in a script or something.
* privsep: chroot the master processRoy Marples2020-01-21
| | | | | | | This means that the privileged actioneer process needs to cleanup sockets and pidfile. It also has some reliance on how dhcpcd is started to create a decent chroot area AND copy the configuration file to it.
* Implement Anonymity Profiles for DHCP Clients, RFC 7844Roy Marples2020-01-15
| | | | | | | | | | | | | | This works by randomising the hardware address when carrier is down and using this to construct a DUID LL which is used over any saved DUID. IAID is defaulted to zero and hostname + FQDN are disabled. Then every possible option is masked out except for essential ones. It's possible to request options *after* anonymous option which will enable it. This is RFC compliant and allows 100% flexability in letting the user decide what, if any, details leek out. This is disabled by default. Only works on NetBSD, other OS coming shortly.
* privsep: Delay control startup after starting privsepRoy Marples2020-01-09
| | | | | | This means we don't need to close it for other processes. Add ps_init so that we can change directory permissions before starting privsep itself.
* privsep: sa_family_t can be a different sizeRoy Marples2020-01-09
|
* privsep: Pad structs out so there are no uninited memory issuesRoy Marples2020-01-08
| | | | Add #ifdef'd out debug code for them as well.
* Welcome to 2020!Roy Marples2020-01-03
|
* privsep: Enable ARP BPF filtering for interesting addressesRoy Marples2019-12-10
| | | | | This brings parity with non privsep features. Aside from the lack of Solaris support, but that's another day.
* WhitespaceRoy Marples2019-11-29
|
* privsep: Add support for priviledge separationRoy Marples2019-11-28
Not enabled by default - enable with ./configure --enable-privsep Requires a user added to the system - default _dhcpcd Several processes will be spawned off the main state engine: a privileged actioneer and a generic network proxy. Only the privileged actioneer process will retain root permissions. When required, the privileged actioneer will also spawn BPF listeners for BOOTP (DHCP) and ARP. The BOOTP BPF listener should be a short lived process. On kernels with RFC 5227 support, the ARP BPF listener will only be used for ARPing and announcing a preferred address and will also be a short lived process. When not running in master mode, an address listener will be spawned for each address (with the exception of RA dervived addresses) dhcpcd cares about. TODO: * Solaris support. * ARP BPF address filtering.
generated by cgit v1.2.3 (git 2.25.1) at 2021-03-13 23:14:02 +0000