From 0c07041d1ad846095046277ebffd940ef9b8b52b Mon Sep 17 00:00:00 2001 From: Murray Stokely Date: Wed, 4 May 2005 15:24:18 +0000 Subject: [PATCH] Index three more chapters. --- .../books/arch-handbook/jail/chapter.sgml | 25 +++++++++++++++++ .../books/arch-handbook/kobj/chapter.sgml | 17 +++++++++++ .../books/arch-handbook/locking/chapter.sgml | 28 ++++++++++++++++++- 3 files changed, 69 insertions(+), 1 deletion(-) diff --git a/en_US.ISO8859-1/books/arch-handbook/jail/chapter.sgml b/en_US.ISO8859-1/books/arch-handbook/jail/chapter.sgml index d683f25909..63368253a0 100644 --- a/en_US.ISO8859-1/books/arch-handbook/jail/chapter.sgml +++ b/en_US.ISO8859-1/books/arch-handbook/jail/chapter.sgml @@ -20,6 +20,10 @@ The Jail Subsystem + security + Jail + root + On most UNIX systems, root has omnipotent power. This promotes insecurity. If an attacker were to gain root on a system, he would have every function at his fingertips. In FreeBSD there are @@ -58,6 +62,9 @@ Userland code + Jail + userland program + The source for the user-land jail is located in /usr/src/usr.sbin/jail, consisting of one file, jail.c. The program takes these @@ -144,6 +151,9 @@ i = execv(argv[4], argv + 4); Kernel Space + Jail + kernel architecture + We will now be looking at the file /usr/src/sys/kern/kern_jail.c. This is the file where the jail system call, appropriate sysctls, and @@ -152,6 +162,8 @@ i = execv(argv[4], argv + 4); sysctls + sysctl + In kern_jail.c, the following sysctls are defined: @@ -243,6 +255,8 @@ struct prison { if (error) goto bail; + chroot + Finally, the jail system call chroots the path specified. The chroot function is given two arguments. The first is p, which represents the calling process, the second @@ -331,6 +345,8 @@ if (p2->p_prison) { SysV IPC + System V IPC + System V IPC is based on messages. Processes can send each other these messages which tell them how to act. The functions which deal with messages are: msgsys, @@ -372,6 +388,7 @@ if (p2->p_prison) { if (!jail.sysvipc.allowed && p->p_prison != NULL) return (ENOSYS); + semaphores Semaphore system calls allow processes to synchronize execution by doing a set of operations atomically on a set of semaphores. Basically semaphores provide another way for @@ -404,6 +421,7 @@ if (!jail.sysvipc.allowed && p->p_prison != NULL) id. + shared memory System V IPC allows for processes to share memory. Processes can communicate directly with each other by sharing parts of their virtual address space and then reading @@ -437,6 +455,7 @@ if (!jail.sysvipc.allowed && p->p_prison != NULL) Sockets + sockets Jail treats the &man.socket.2; system call and related lower-level socket functions in a special manner. In order to determine whether a certain socket is allowed to be created, @@ -466,6 +485,9 @@ register struct protosw *prp; Berkeley Packet Filter + Berkeley Packet Filter + data link layer + The Berkeley Packet Filter provides a raw interface to data link layers in a protocol independent fashion. The function bpfopen() opens an Ethernet @@ -486,6 +508,8 @@ static int bpfopen(dev, flags, fmt, p) Protocols + protocols + There are certain protocols which are very common, such as TCP, UDP, IP and ICMP. IP and ICMP are on the same level: the network layer 2. There are certain precautions which are @@ -574,6 +598,7 @@ int prison_ip(struct proc *p, int flag, u_int32_t *ip) { Filesystem + filesystem Even root users within the jail are not allowed to set any file flags, such as immutable, append, and no unlink flags, if the securelevel is greater than 0. diff --git a/en_US.ISO8859-1/books/arch-handbook/kobj/chapter.sgml b/en_US.ISO8859-1/books/arch-handbook/kobj/chapter.sgml index b2ef1f689b..ab80c62fbb 100644 --- a/en_US.ISO8859-1/books/arch-handbook/kobj/chapter.sgml +++ b/en_US.ISO8859-1/books/arch-handbook/kobj/chapter.sgml @@ -7,6 +7,9 @@ Kernel Objects + Kernel Objects + Object-Oriented + binary compatibility Kernel Objects, or Kobj provides an object-oriented C programming system for the kernel. As such the data being operated on carries the description of how to operate @@ -17,6 +20,11 @@ Terminology + object + method + class + interface + Object @@ -116,6 +124,9 @@ KOBJMETHOD(NAME, FUNC) Creating an interface template + Kernel Objects + interface + The first step in using Kobj is to create an Interface. Creating the interface involves creating a template that the script @@ -204,6 +215,9 @@ src/sys/kern/device_if.m Creating a Class + Kernel Objects + class + The second step in using Kobj is to create a class. A class consists of a name, a table of methods, and the size of objects if Kobj's object handling facilities are used. To @@ -235,6 +249,9 @@ kobj_method_t foomethods[] = { Creating an Object + Kernel Objects + object + The third step in using Kobj involves how to define the object. Kobj object creation routines assume that Kobj data is at the head of an object. If this in not appropriate you will diff --git a/en_US.ISO8859-1/books/arch-handbook/locking/chapter.sgml b/en_US.ISO8859-1/books/arch-handbook/locking/chapter.sgml index 50eb1677cf..8a9b6d938d 100644 --- a/en_US.ISO8859-1/books/arch-handbook/locking/chapter.sgml +++ b/en_US.ISO8859-1/books/arch-handbook/locking/chapter.sgml @@ -8,11 +8,17 @@ Locking Notes + SMP Next Generation Project This chapter is maintained by the FreeBSD SMP Next Generation Project. Please direct any comments or suggestions to its &a.smp;. + locking + multi-processing + mutexes + lockmgr + atomic operations This document outlines the locking used in the FreeBSD kernel to permit effective multi-processing within the kernel. Locking can be achieved via several means. Data structures can be @@ -109,7 +115,19 @@ Mutex List - + + locks + sched_lock + + locks + vm86pcb_lock + + locks + Giant + + locks + callout_lock + @@ -260,9 +278,15 @@ These locks provide basic reader-writer type functionality and may be held by a sleeping process. Currently they are backed by &man.lockmgr.9;. + locks + shared exclusive
Shared Exclusive Lock List + locks + allproc_lock + locks + proctree_lock @@ -298,6 +322,8 @@ Atomically Protected Variables + atomically protected variables + An atomically protected variable is a special variable that is not protected by an explicit lock. Instead, all data accesses to the variables use special atomic operations as