1/*- 2 * Copyright (c) 1999-2002, 2007 Robert N. M. Watson 3 * Copyright (c) 2001-2005 Networks Associates Technology, Inc. 4 * Copyright (c) 2005 Tom Rhodes 5 * Copyright (c) 2006 SPARTA, Inc. 6 * All rights reserved. 7 * 8 * This software was developed by Robert Watson for the TrustedBSD Project. 9 * It was later enhanced by Tom Rhodes for the TrustedBSD Project. 10 * 11 * This software was developed for the FreeBSD Project in part by Network 12 * Associates Laboratories, the Security Research Division of Network 13 * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), 14 * as part of the DARPA CHATS research program. 15 * 16 * This software was enhanced by SPARTA ISSO under SPAWAR contract 17 * N66001-04-C-6019 ("SEFOS"). 18 * 19 * Redistribution and use in source and binary forms, with or without 20 * modification, are permitted provided that the following conditions 21 * are met: 22 * 1. Redistributions of source code must retain the above copyright 23 * notice, this list of conditions and the following disclaimer. 24 * 2. Redistributions in binary form must reproduce the above copyright 25 * notice, this list of conditions and the following disclaimer in the 26 * documentation and/or other materials provided with the distribution. 27 * 28 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 29 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 30 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 31 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 32 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 33 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 34 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 35 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 36 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 37 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 38 * SUCH DAMAGE. 39 *
|
40 * $FreeBSD: head/sys/security/mac_bsdextended/mac_bsdextended.c 172930 2007-10-24 19:04:04Z rwatson $
|
40 * $FreeBSD: head/sys/security/mac_bsdextended/mac_bsdextended.c 172955 2007-10-25 11:31:11Z rwatson $ |
41 */ 42 43/* 44 * Developed by the TrustedBSD Project. 45 * 46 * "BSD Extended" MAC policy, allowing the administrator to impose mandatory 47 * firewall-like rules regarding users and file system objects. 48 */ 49 50#include <sys/param.h> 51#include <sys/acl.h> 52#include <sys/kernel.h> 53#include <sys/jail.h> 54#include <sys/lock.h> 55#include <sys/malloc.h> 56#include <sys/module.h> 57#include <sys/mount.h> 58#include <sys/mutex.h> 59#include <sys/priv.h> 60#include <sys/systm.h> 61#include <sys/vnode.h> 62#include <sys/sysctl.h> 63#include <sys/syslog.h> 64 65#include <security/mac/mac_policy.h> 66#include <security/mac_bsdextended/mac_bsdextended.h> 67
|
68static struct mtx mac_bsdextended_mtx;
|
68static struct mtx ugidfw_mtx; |
69 70SYSCTL_DECL(_security_mac); 71 72SYSCTL_NODE(_security_mac, OID_AUTO, bsdextended, CTLFLAG_RW, 0, 73 "TrustedBSD extended BSD MAC policy controls"); 74
|
75static int mac_bsdextended_enabled = 1;
|
75static int ugidfw_enabled = 1; |
76SYSCTL_INT(_security_mac_bsdextended, OID_AUTO, enabled, CTLFLAG_RW,
|
77 &mac_bsdextended_enabled, 0, "Enforce extended BSD policy");
78TUNABLE_INT("security.mac.bsdextended.enabled", &mac_bsdextended_enabled);
|
77 &ugidfw_enabled, 0, "Enforce extended BSD policy"); 78TUNABLE_INT("security.mac.bsdextended.enabled", &ugidfw_enabled); |
79 80MALLOC_DEFINE(M_MACBSDEXTENDED, "mac_bsdextended", "BSD Extended MAC rule"); 81 82#define MAC_BSDEXTENDED_MAXRULES 250 83static struct mac_bsdextended_rule *rules[MAC_BSDEXTENDED_MAXRULES]; 84static int rule_count = 0; 85static int rule_slots = 0; 86static int rule_version = MB_VERSION; 87 88SYSCTL_INT(_security_mac_bsdextended, OID_AUTO, rule_count, CTLFLAG_RD, 89 &rule_count, 0, "Number of defined rules\n"); 90SYSCTL_INT(_security_mac_bsdextended, OID_AUTO, rule_slots, CTLFLAG_RD, 91 &rule_slots, 0, "Number of used rule slots\n"); 92SYSCTL_INT(_security_mac_bsdextended, OID_AUTO, rule_version, CTLFLAG_RD, 93 &rule_version, 0, "Version number for API\n"); 94 95/* 96 * This is just used for logging purposes, eventually we would like to log 97 * much more then failed requests. 98 */
|
99static int mac_bsdextended_logging;
|
99static int ugidfw_logging; |
100SYSCTL_INT(_security_mac_bsdextended, OID_AUTO, logging, CTLFLAG_RW,
|
101 &mac_bsdextended_logging, 0, "Log failed authorization requests");
|
101 &ugidfw_logging, 0, "Log failed authorization requests"); |
102 103/* 104 * This tunable is here for compatibility. It will allow the user to switch 105 * between the new mode (first rule matches) and the old functionality (all 106 * rules match). 107 */
|
108static int
109mac_bsdextended_firstmatch_enabled;
|
108static int ugidfw_firstmatch_enabled; |
109SYSCTL_INT(_security_mac_bsdextended, OID_AUTO, firstmatch_enabled,
|
111 CTLFLAG_RW, &mac_bsdextended_firstmatch_enabled, 1,
|
110 CTLFLAG_RW, &ugidfw_firstmatch_enabled, 1, |
111 "Disable/enable match first rule functionality"); 112 113static int
|
115mac_bsdextended_rule_valid(struct mac_bsdextended_rule *rule)
|
114ugidfw_rule_valid(struct mac_bsdextended_rule *rule) |
115{ 116 117 if ((rule->mbr_subject.mbs_flags | MBS_ALL_FLAGS) != MBS_ALL_FLAGS) 118 return (EINVAL); 119 if ((rule->mbr_subject.mbs_neg | MBS_ALL_FLAGS) != MBS_ALL_FLAGS) 120 return (EINVAL); 121 if ((rule->mbr_object.mbo_flags | MBO_ALL_FLAGS) != MBO_ALL_FLAGS) 122 return (EINVAL); 123 if ((rule->mbr_object.mbo_neg | MBO_ALL_FLAGS) != MBO_ALL_FLAGS) 124 return (EINVAL); 125 if ((rule->mbr_object.mbo_neg | MBO_TYPE_DEFINED) && 126 (rule->mbr_object.mbo_type | MBO_ALL_TYPE) != MBO_ALL_TYPE) 127 return (EINVAL); 128 if ((rule->mbr_mode | MBI_ALLPERM) != MBI_ALLPERM) 129 return (EINVAL); 130 return (0); 131} 132 133static int 134sysctl_rule(SYSCTL_HANDLER_ARGS) 135{ 136 struct mac_bsdextended_rule temprule, *ruleptr; 137 u_int namelen; 138 int error, index, *name; 139 140 error = 0; 141 name = (int *)arg1; 142 namelen = arg2; 143 if (namelen != 1) 144 return (EINVAL); 145 index = name[0]; 146 if (index >= MAC_BSDEXTENDED_MAXRULES) 147 return (ENOENT); 148 149 ruleptr = NULL; 150 if (req->newptr && req->newlen != 0) { 151 error = SYSCTL_IN(req, &temprule, sizeof(temprule)); 152 if (error) 153 return (error); 154 MALLOC(ruleptr, struct mac_bsdextended_rule *, 155 sizeof(*ruleptr), M_MACBSDEXTENDED, M_WAITOK | M_ZERO); 156 } 157
|
159 mtx_lock(&mac_bsdextended_mtx);
|
158 mtx_lock(&ugidfw_mtx); |
159 if (req->oldptr) { 160 if (index < 0 || index > rule_slots + 1) { 161 error = ENOENT; 162 goto out; 163 } 164 if (rules[index] == NULL) { 165 error = ENOENT; 166 goto out; 167 } 168 temprule = *rules[index]; 169 } 170 if (req->newptr && req->newlen == 0) { 171 KASSERT(ruleptr == NULL, ("sysctl_rule: ruleptr != NULL")); 172 ruleptr = rules[index]; 173 if (ruleptr == NULL) { 174 error = ENOENT; 175 goto out; 176 } 177 rule_count--; 178 rules[index] = NULL; 179 } else if (req->newptr) {
|
181 error = mac_bsdextended_rule_valid(&temprule);
|
180 error = ugidfw_rule_valid(&temprule); |
181 if (error) 182 goto out; 183 if (rules[index] == NULL) { 184 *ruleptr = temprule; 185 rules[index] = ruleptr; 186 ruleptr = NULL; 187 if (index + 1 > rule_slots) 188 rule_slots = index + 1; 189 rule_count++; 190 } else 191 *rules[index] = temprule; 192 } 193out:
|
195 mtx_unlock(&mac_bsdextended_mtx);
|
194 mtx_unlock(&ugidfw_mtx); |
195 if (ruleptr != NULL) 196 FREE(ruleptr, M_MACBSDEXTENDED); 197 if (req->oldptr && error == 0) 198 error = SYSCTL_OUT(req, &temprule, sizeof(temprule)); 199 return (error); 200} 201 202SYSCTL_NODE(_security_mac_bsdextended, OID_AUTO, rules, CTLFLAG_RW, 203 sysctl_rule, "BSD extended MAC rules"); 204 205static void
|
207mac_bsdextended_init(struct mac_policy_conf *mpc)
|
206ugidfw_init(struct mac_policy_conf *mpc) |
207{ 208
|
210 mtx_init(&mac_bsdextended_mtx, "mac_bsdextended lock", NULL, MTX_DEF);
|
209 mtx_init(&ugidfw_mtx, "mac_bsdextended lock", NULL, MTX_DEF); |
210} 211 212static void
|
214mac_bsdextended_destroy(struct mac_policy_conf *mpc)
|
213ugidfw_destroy(struct mac_policy_conf *mpc) |
214{ 215
|
217 mtx_destroy(&mac_bsdextended_mtx);
|
216 mtx_destroy(&ugidfw_mtx); |
217} 218 219static int
|
221mac_bsdextended_rulecheck(struct mac_bsdextended_rule *rule,
|
220ugidfw_rulecheck(struct mac_bsdextended_rule *rule, |
221 struct ucred *cred, struct vnode *vp, struct vattr *vap, int acc_mode) 222{ 223 int match; 224 int i; 225 226 /* 227 * Is there a subject match? 228 */
|
230 mtx_assert(&mac_bsdextended_mtx, MA_OWNED);
|
229 mtx_assert(&ugidfw_mtx, MA_OWNED); |
230 if (rule->mbr_subject.mbs_flags & MBS_UID_DEFINED) { 231 match = ((cred->cr_uid <= rule->mbr_subject.mbs_uid_max && 232 cred->cr_uid >= rule->mbr_subject.mbs_uid_min) || 233 (cred->cr_ruid <= rule->mbr_subject.mbs_uid_max && 234 cred->cr_ruid >= rule->mbr_subject.mbs_uid_min) || 235 (cred->cr_svuid <= rule->mbr_subject.mbs_uid_max && 236 cred->cr_svuid >= rule->mbr_subject.mbs_uid_min)); 237 if (rule->mbr_subject.mbs_neg & MBS_UID_DEFINED) 238 match = !match; 239 if (!match) 240 return (0); 241 } 242 243 if (rule->mbr_subject.mbs_flags & MBS_GID_DEFINED) { 244 match = ((cred->cr_rgid <= rule->mbr_subject.mbs_gid_max && 245 cred->cr_rgid >= rule->mbr_subject.mbs_gid_min) || 246 (cred->cr_svgid <= rule->mbr_subject.mbs_gid_max && 247 cred->cr_svgid >= rule->mbr_subject.mbs_gid_min)); 248 if (!match) { 249 for (i = 0; i < cred->cr_ngroups; i++) { 250 if (cred->cr_groups[i] 251 <= rule->mbr_subject.mbs_gid_max && 252 cred->cr_groups[i] 253 >= rule->mbr_subject.mbs_gid_min) { 254 match = 1; 255 break; 256 } 257 } 258 } 259 if (rule->mbr_subject.mbs_neg & MBS_GID_DEFINED) 260 match = !match; 261 if (!match) 262 return (0); 263 } 264 265 if (rule->mbr_subject.mbs_flags & MBS_PRISON_DEFINED) { 266 match = (cred->cr_prison != NULL && 267 cred->cr_prison->pr_id == rule->mbr_subject.mbs_prison); 268 if (rule->mbr_subject.mbs_neg & MBS_PRISON_DEFINED) 269 match = !match; 270 if (!match) 271 return (0); 272 } 273 274 /* 275 * Is there an object match? 276 */ 277 if (rule->mbr_object.mbo_flags & MBO_UID_DEFINED) { 278 match = (vap->va_uid <= rule->mbr_object.mbo_uid_max && 279 vap->va_uid >= rule->mbr_object.mbo_uid_min); 280 if (rule->mbr_object.mbo_neg & MBO_UID_DEFINED) 281 match = !match; 282 if (!match) 283 return (0); 284 } 285 286 if (rule->mbr_object.mbo_flags & MBO_GID_DEFINED) { 287 match = (vap->va_gid <= rule->mbr_object.mbo_gid_max && 288 vap->va_gid >= rule->mbr_object.mbo_gid_min); 289 if (rule->mbr_object.mbo_neg & MBO_GID_DEFINED) 290 match = !match; 291 if (!match) 292 return (0); 293 } 294 295 if (rule->mbr_object.mbo_flags & MBO_FSID_DEFINED) { 296 match = (bcmp(&(vp->v_mount->mnt_stat.f_fsid), 297 &(rule->mbr_object.mbo_fsid), 298 sizeof(rule->mbr_object.mbo_fsid)) == 0); 299 if (rule->mbr_object.mbo_neg & MBO_FSID_DEFINED) 300 match = !match; 301 if (!match) 302 return (0); 303 } 304 305 if (rule->mbr_object.mbo_flags & MBO_SUID) { 306 match = (vap->va_mode & VSUID); 307 if (rule->mbr_object.mbo_neg & MBO_SUID) 308 match = !match; 309 if (!match) 310 return (0); 311 } 312 313 if (rule->mbr_object.mbo_flags & MBO_SGID) { 314 match = (vap->va_mode & VSGID); 315 if (rule->mbr_object.mbo_neg & MBO_SGID) 316 match = !match; 317 if (!match) 318 return (0); 319 } 320 321 if (rule->mbr_object.mbo_flags & MBO_UID_SUBJECT) { 322 match = (vap->va_uid == cred->cr_uid || 323 vap->va_uid == cred->cr_ruid || 324 vap->va_uid == cred->cr_svuid); 325 if (rule->mbr_object.mbo_neg & MBO_UID_SUBJECT) 326 match = !match; 327 if (!match) 328 return (0); 329 } 330 331 if (rule->mbr_object.mbo_flags & MBO_GID_SUBJECT) { 332 match = (groupmember(vap->va_gid, cred) || 333 vap->va_gid == cred->cr_rgid || 334 vap->va_gid == cred->cr_svgid); 335 if (rule->mbr_object.mbo_neg & MBO_GID_SUBJECT) 336 match = !match; 337 if (!match) 338 return (0); 339 } 340 341 if (rule->mbr_object.mbo_flags & MBO_TYPE_DEFINED) { 342 switch (vap->va_type) { 343 case VREG: 344 match = (rule->mbr_object.mbo_type & MBO_TYPE_REG); 345 break; 346 case VDIR: 347 match = (rule->mbr_object.mbo_type & MBO_TYPE_DIR); 348 break; 349 case VBLK: 350 match = (rule->mbr_object.mbo_type & MBO_TYPE_BLK); 351 break; 352 case VCHR: 353 match = (rule->mbr_object.mbo_type & MBO_TYPE_CHR); 354 break; 355 case VLNK: 356 match = (rule->mbr_object.mbo_type & MBO_TYPE_LNK); 357 break; 358 case VSOCK: 359 match = (rule->mbr_object.mbo_type & MBO_TYPE_SOCK); 360 break; 361 case VFIFO: 362 match = (rule->mbr_object.mbo_type & MBO_TYPE_FIFO); 363 break; 364 default: 365 match = 0; 366 } 367 if (rule->mbr_object.mbo_neg & MBO_TYPE_DEFINED) 368 match = !match; 369 if (!match) 370 return (0); 371 } 372 373 /* 374 * Is the access permitted? 375 */ 376 if ((rule->mbr_mode & acc_mode) != acc_mode) {
|
378 if (mac_bsdextended_logging)
|
377 if (ugidfw_logging) |
378 log(LOG_AUTHPRIV, "mac_bsdextended: %d:%d request %d" 379 " on %d:%d failed. \n", cred->cr_ruid, 380 cred->cr_rgid, acc_mode, vap->va_uid, 381 vap->va_gid); 382 return (EACCES); 383 } 384 385 /* 386 * If the rule matched, permits access, and first match is enabled, 387 * return success. 388 */
|
390 if (mac_bsdextended_firstmatch_enabled)
|
389 if (ugidfw_firstmatch_enabled) |
390 return (EJUSTRETURN); 391 else 392 return (0); 393} 394 395static int
|
397mac_bsdextended_check(struct ucred *cred, struct vnode *vp, struct vattr *vap,
|
396ugidfw_check(struct ucred *cred, struct vnode *vp, struct vattr *vap, |
397 int acc_mode) 398{ 399 int error, i; 400 401 /* 402 * XXXRW: More specific privilege selection needed. 403 */ 404 if (suser_cred(cred, 0) == 0) 405 return (0); 406 407 /* 408 * Since we do not separately handle append, map append to write. 409 */ 410 if (acc_mode & MBI_APPEND) { 411 acc_mode &= ~MBI_APPEND; 412 acc_mode |= MBI_WRITE; 413 }
|
415 mtx_lock(&mac_bsdextended_mtx);
|
414 mtx_lock(&ugidfw_mtx); |
415 for (i = 0; i < rule_slots; i++) { 416 if (rules[i] == NULL) 417 continue;
|
419 error = mac_bsdextended_rulecheck(rules[i], cred,
|
418 error = ugidfw_rulecheck(rules[i], cred, |
419 vp, vap, acc_mode); 420 if (error == EJUSTRETURN) 421 break; 422 if (error) {
|
424 mtx_unlock(&mac_bsdextended_mtx);
|
423 mtx_unlock(&ugidfw_mtx); |
424 return (error); 425 } 426 }
|
428 mtx_unlock(&mac_bsdextended_mtx);
|
427 mtx_unlock(&ugidfw_mtx); |
428 return (0); 429} 430 431static int
|
433mac_bsdextended_check_vp(struct ucred *cred, struct vnode *vp, int acc_mode)
|
432ugidfw_check_vp(struct ucred *cred, struct vnode *vp, int acc_mode) |
433{ 434 int error; 435 struct vattr vap; 436
|
438 if (!mac_bsdextended_enabled)
|
437 if (!ugidfw_enabled) |
438 return (0); 439 error = VOP_GETATTR(vp, &vap, cred, curthread); 440 if (error) 441 return (error);
|
443 return (mac_bsdextended_check(cred, vp, &vap, acc_mode));
|
442 return (ugidfw_check(cred, vp, &vap, acc_mode)); |
443} 444 445static int
|
447mac_bsdextended_system_check_acct(struct ucred *cred, struct vnode *vp,
|
446ugidfw_system_check_acct(struct ucred *cred, struct vnode *vp, |
447 struct label *vplabel) 448{ 449
|
451 return (mac_bsdextended_check_vp(cred, vp, MBI_WRITE));
|
450 return (ugidfw_check_vp(cred, vp, MBI_WRITE)); |
451} 452 453static int
|
455mac_bsdextended_system_check_auditctl(struct ucred *cred, struct vnode *vp,
|
454ugidfw_system_check_auditctl(struct ucred *cred, struct vnode *vp, |
455 struct label *vplabel) 456{ 457
|
459 return (mac_bsdextended_check_vp(cred, vp, MBI_WRITE));
|
458 return (ugidfw_check_vp(cred, vp, MBI_WRITE)); |
459} 460 461static int
|
463mac_bsdextended_system_check_swapoff(struct ucred *cred, struct vnode *vp,
|
462ugidfw_system_check_swapoff(struct ucred *cred, struct vnode *vp, |
463 struct label *vplabel) 464{ 465
|
467 return (mac_bsdextended_check_vp(cred, vp, MBI_WRITE));
|
466 return (ugidfw_check_vp(cred, vp, MBI_WRITE)); |
467} 468 469static int
|
471mac_bsdextended_system_check_swapon(struct ucred *cred, struct vnode *vp,
|
470ugidfw_system_check_swapon(struct ucred *cred, struct vnode *vp, |
471 struct label *vplabel) 472{ 473
|
475 return (mac_bsdextended_check_vp(cred, vp, MBI_WRITE));
|
474 return (ugidfw_check_vp(cred, vp, MBI_WRITE)); |
475} 476 477static int
|
479mac_bsdextended_vnode_check_access(struct ucred *cred, struct vnode *vp,
|
478ugidfw_vnode_check_access(struct ucred *cred, struct vnode *vp, |
479 struct label *vplabel, int acc_mode) 480{ 481
|
483 return (mac_bsdextended_check_vp(cred, vp, acc_mode));
|
482 return (ugidfw_check_vp(cred, vp, acc_mode)); |
483} 484 485static int
|
487mac_bsdextended_vnode_check_chdir(struct ucred *cred, struct vnode *dvp,
|
486ugidfw_vnode_check_chdir(struct ucred *cred, struct vnode *dvp, |
487 struct label *dvplabel) 488{ 489
|
491 return (mac_bsdextended_check_vp(cred, dvp, MBI_EXEC));
|
490 return (ugidfw_check_vp(cred, dvp, MBI_EXEC)); |
491} 492 493static int
|
495mac_bsdextended_vnode_check_chroot(struct ucred *cred, struct vnode *dvp,
|
494ugidfw_vnode_check_chroot(struct ucred *cred, struct vnode *dvp, |
495 struct label *dvplabel) 496{ 497
|
499 return (mac_bsdextended_check_vp(cred, dvp, MBI_EXEC));
|
498 return (ugidfw_check_vp(cred, dvp, MBI_EXEC)); |
499} 500 501static int
|
503mac_bsdextended_check_create_vnode(struct ucred *cred, struct vnode *dvp,
|
502ugidfw_check_create_vnode(struct ucred *cred, struct vnode *dvp, |
503 struct label *dvplabel, struct componentname *cnp, struct vattr *vap) 504{ 505
|
507 return (mac_bsdextended_check_vp(cred, dvp, MBI_WRITE));
|
506 return (ugidfw_check_vp(cred, dvp, MBI_WRITE)); |
507} 508 509static int
|
511mac_bsdextended_vnode_check_deleteacl(struct ucred *cred, struct vnode *vp,
|
510ugidfw_vnode_check_deleteacl(struct ucred *cred, struct vnode *vp, |
511 struct label *vplabel, acl_type_t type) 512{ 513
|
515 return (mac_bsdextended_check_vp(cred, vp, MBI_ADMIN));
|
514 return (ugidfw_check_vp(cred, vp, MBI_ADMIN)); |
515} 516 517static int
|
519mac_bsdextended_vnode_check_deleteextattr(struct ucred *cred,
520 struct vnode *vp, struct label *vplabel, int attrnamespace,
521 const char *name)
|
518ugidfw_vnode_check_deleteextattr(struct ucred *cred, struct vnode *vp, 519 struct label *vplabel, int attrnamespace, const char *name) |
520{ 521
|
524 return (mac_bsdextended_check_vp(cred, vp, MBI_WRITE));
|
522 return (ugidfw_check_vp(cred, vp, MBI_WRITE)); |
523} 524 525static int
|
528mac_bsdextended_vnode_check_exec(struct ucred *cred, struct vnode *vp,
|
526ugidfw_vnode_check_exec(struct ucred *cred, struct vnode *vp, |
527 struct label *vplabel, struct image_params *imgp, 528 struct label *execlabel) 529{ 530
|
533 return (mac_bsdextended_check_vp(cred, vp, MBI_READ|MBI_EXEC));
|
531 return (ugidfw_check_vp(cred, vp, MBI_READ|MBI_EXEC)); |
532} 533 534static int
|
537mac_bsdextended_vnode_check_getacl(struct ucred *cred, struct vnode *vp,
|
535ugidfw_vnode_check_getacl(struct ucred *cred, struct vnode *vp, |
536 struct label *vplabel, acl_type_t type) 537{ 538
|
541 return (mac_bsdextended_check_vp(cred, vp, MBI_STAT));
|
539 return (ugidfw_check_vp(cred, vp, MBI_STAT)); |
540} 541 542static int
|
545mac_bsdextended_vnode_check_getextattr(struct ucred *cred, struct vnode *vp,
|
543ugidfw_vnode_check_getextattr(struct ucred *cred, struct vnode *vp, |
544 struct label *vplabel, int attrnamespace, const char *name, 545 struct uio *uio) 546{ 547
|
550 return (mac_bsdextended_check_vp(cred, vp, MBI_READ));
|
548 return (ugidfw_check_vp(cred, vp, MBI_READ)); |
549} 550 551static int
|
554mac_bsdextended_vnode_check_link(struct ucred *cred, struct vnode *dvp,
|
552ugidfw_vnode_check_link(struct ucred *cred, struct vnode *dvp, |
553 struct label *dvplabel, struct vnode *vp, struct label *label, 554 struct componentname *cnp) 555{ 556 int error; 557
|
560 error = mac_bsdextended_check_vp(cred, dvp, MBI_WRITE);
|
558 error = ugidfw_check_vp(cred, dvp, MBI_WRITE); |
559 if (error) 560 return (error);
|
563 error = mac_bsdextended_check_vp(cred, vp, MBI_WRITE);
|
561 error = ugidfw_check_vp(cred, vp, MBI_WRITE); |
562 if (error) 563 return (error); 564 return (0); 565} 566 567static int
|
570mac_bsdextended_vnode_check_listextattr(struct ucred *cred, struct vnode *vp,
|
568ugidfw_vnode_check_listextattr(struct ucred *cred, struct vnode *vp, |
569 struct label *vplabel, int attrnamespace) 570{ 571
|
574 return (mac_bsdextended_check_vp(cred, vp, MBI_READ));
|
572 return (ugidfw_check_vp(cred, vp, MBI_READ)); |
573} 574 575static int
|
578mac_bsdextended_vnode_check_lookup(struct ucred *cred, struct vnode *dvp,
|
576ugidfw_vnode_check_lookup(struct ucred *cred, struct vnode *dvp, |
577 struct label *dvplabel, struct componentname *cnp) 578{ 579
|
582 return (mac_bsdextended_check_vp(cred, dvp, MBI_EXEC));
|
580 return (ugidfw_check_vp(cred, dvp, MBI_EXEC)); |
581} 582 583static int
|
586mac_bsdextended_vnode_check_open(struct ucred *cred, struct vnode *vp,
|
584ugidfw_vnode_check_open(struct ucred *cred, struct vnode *vp, |
585 struct label *vplabel, int acc_mode) 586{ 587
|
590 return (mac_bsdextended_check_vp(cred, vp, acc_mode));
|
588 return (ugidfw_check_vp(cred, vp, acc_mode)); |
589} 590 591static int
|
594mac_bsdextended_vnode_check_readdir(struct ucred *cred, struct vnode *dvp,
|
592ugidfw_vnode_check_readdir(struct ucred *cred, struct vnode *dvp, |
593 struct label *dvplabel) 594{ 595
|
598 return (mac_bsdextended_check_vp(cred, dvp, MBI_READ));
|
596 return (ugidfw_check_vp(cred, dvp, MBI_READ)); |
597} 598 599static int
|
602mac_bsdextended_vnode_check_readdlink(struct ucred *cred, struct vnode *vp,
|
600ugidfw_vnode_check_readdlink(struct ucred *cred, struct vnode *vp, |
601 struct label *vplabel) 602{ 603
|
606 return (mac_bsdextended_check_vp(cred, vp, MBI_READ));
|
604 return (ugidfw_check_vp(cred, vp, MBI_READ)); |
605} 606 607static int
|
610mac_bsdextended_vnode_check_rename_from(struct ucred *cred, struct vnode *dvp,
|
608ugidfw_vnode_check_rename_from(struct ucred *cred, struct vnode *dvp, |
609 struct label *dvplabel, struct vnode *vp, struct label *vplabel, 610 struct componentname *cnp) 611{ 612 int error; 613
|
616 error = mac_bsdextended_check_vp(cred, dvp, MBI_WRITE);
|
614 error = ugidfw_check_vp(cred, dvp, MBI_WRITE); |
615 if (error) 616 return (error);
|
619 return (mac_bsdextended_check_vp(cred, vp, MBI_WRITE));
|
617 return (ugidfw_check_vp(cred, vp, MBI_WRITE)); |
618} 619 620static int
|
623mac_bsdextended_vnode_check_rename_to(struct ucred *cred, struct vnode *dvp,
|
621ugidfw_vnode_check_rename_to(struct ucred *cred, struct vnode *dvp, |
622 struct label *dvplabel, struct vnode *vp, struct label *vplabel, 623 int samedir, struct componentname *cnp) 624{ 625 int error; 626
|
629 error = mac_bsdextended_check_vp(cred, dvp, MBI_WRITE);
|
627 error = ugidfw_check_vp(cred, dvp, MBI_WRITE); |
628 if (error) 629 return (error); 630 if (vp != NULL)
|
633 error = mac_bsdextended_check_vp(cred, vp, MBI_WRITE);
|
631 error = ugidfw_check_vp(cred, vp, MBI_WRITE); |
632 return (error); 633} 634 635static int
|
638mac_bsdextended_vnode_check_revoke(struct ucred *cred, struct vnode *vp,
|
636ugidfw_vnode_check_revoke(struct ucred *cred, struct vnode *vp, |
637 struct label *vplabel) 638{ 639
|
642 return (mac_bsdextended_check_vp(cred, vp, MBI_ADMIN));
|
640 return (ugidfw_check_vp(cred, vp, MBI_ADMIN)); |
641} 642 643static int
|
646mac_bsdextended_check_setacl_vnode(struct ucred *cred, struct vnode *vp,
|
644ugidfw_check_setacl_vnode(struct ucred *cred, struct vnode *vp, |
645 struct label *vplabel, acl_type_t type, struct acl *acl) 646{ 647
|
650 return (mac_bsdextended_check_vp(cred, vp, MBI_ADMIN));
|
648 return (ugidfw_check_vp(cred, vp, MBI_ADMIN)); |
649} 650 651static int
|
654mac_bsdextended_vnode_check_setextattr(struct ucred *cred, struct vnode *vp,
|
652ugidfw_vnode_check_setextattr(struct ucred *cred, struct vnode *vp, |
653 struct label *vplabel, int attrnamespace, const char *name, 654 struct uio *uio) 655{ 656
|
659 return (mac_bsdextended_check_vp(cred, vp, MBI_WRITE));
|
657 return (ugidfw_check_vp(cred, vp, MBI_WRITE)); |
658} 659 660static int
|
663mac_bsdextended_vnode_check_setflags(struct ucred *cred, struct vnode *vp,
|
661ugidfw_vnode_check_setflags(struct ucred *cred, struct vnode *vp, |
662 struct label *vplabel, u_long flags) 663{ 664
|
667 return (mac_bsdextended_check_vp(cred, vp, MBI_ADMIN));
|
665 return (ugidfw_check_vp(cred, vp, MBI_ADMIN)); |
666} 667 668static int
|
671mac_bsdextended_vnode_check_setmode(struct ucred *cred, struct vnode *vp,
|
669ugidfw_vnode_check_setmode(struct ucred *cred, struct vnode *vp, |
670 struct label *vplabel, mode_t mode) 671{ 672
|
675 return (mac_bsdextended_check_vp(cred, vp, MBI_ADMIN));
|
673 return (ugidfw_check_vp(cred, vp, MBI_ADMIN)); |
674} 675 676static int
|
679mac_bsdextended_vnode_check_setowner(struct ucred *cred, struct vnode *vp,
|
677ugidfw_vnode_check_setowner(struct ucred *cred, struct vnode *vp, |
678 struct label *vplabel, uid_t uid, gid_t gid) 679{ 680
|
683 return (mac_bsdextended_check_vp(cred, vp, MBI_ADMIN));
|
681 return (ugidfw_check_vp(cred, vp, MBI_ADMIN)); |
682} 683 684static int
|
687mac_bsdextended_vnode_check_setutimes(struct ucred *cred, struct vnode *vp,
|
685ugidfw_vnode_check_setutimes(struct ucred *cred, struct vnode *vp, |
686 struct label *vplabel, struct timespec atime, struct timespec utime) 687{ 688
|
691 return (mac_bsdextended_check_vp(cred, vp, MBI_ADMIN));
|
689 return (ugidfw_check_vp(cred, vp, MBI_ADMIN)); |
690} 691 692static int
|
695mac_bsdextended_vnode_check_stat(struct ucred *active_cred,
|
693ugidfw_vnode_check_stat(struct ucred *active_cred, |
694 struct ucred *file_cred, struct vnode *vp, struct label *vplabel) 695{ 696
|
699 return (mac_bsdextended_check_vp(active_cred, vp, MBI_STAT));
|
697 return (ugidfw_check_vp(active_cred, vp, MBI_STAT)); |
698} 699 700static int
|
703mac_bsdextended_vnode_check_unlink(struct ucred *cred, struct vnode *dvp,
|
701ugidfw_vnode_check_unlink(struct ucred *cred, struct vnode *dvp, |
702 struct label *dvplabel, struct vnode *vp, struct label *vplabel, 703 struct componentname *cnp) 704{ 705 int error; 706
|
709 error = mac_bsdextended_check_vp(cred, dvp, MBI_WRITE);
|
707 error = ugidfw_check_vp(cred, dvp, MBI_WRITE); |
708 if (error) 709 return (error);
|
712 return (mac_bsdextended_check_vp(cred, vp, MBI_WRITE));
|
710 return (ugidfw_check_vp(cred, vp, MBI_WRITE)); |
711} 712
|
715static struct mac_policy_ops mac_bsdextended_ops =
|
713static struct mac_policy_ops ugidfw_ops = |
714{
|
717 .mpo_destroy = mac_bsdextended_destroy,
718 .mpo_init = mac_bsdextended_init,
719 .mpo_system_check_acct = mac_bsdextended_system_check_acct,
720 .mpo_system_check_auditctl = mac_bsdextended_system_check_auditctl,
721 .mpo_system_check_swapoff = mac_bsdextended_system_check_swapoff,
722 .mpo_system_check_swapon = mac_bsdextended_system_check_swapon,
723 .mpo_vnode_check_access = mac_bsdextended_vnode_check_access,
724 .mpo_vnode_check_chdir = mac_bsdextended_vnode_check_chdir,
725 .mpo_vnode_check_chroot = mac_bsdextended_vnode_check_chroot,
726 .mpo_vnode_check_create = mac_bsdextended_check_create_vnode,
727 .mpo_vnode_check_deleteacl = mac_bsdextended_vnode_check_deleteacl,
728 .mpo_vnode_check_deleteextattr = mac_bsdextended_vnode_check_deleteextattr,
729 .mpo_vnode_check_exec = mac_bsdextended_vnode_check_exec,
730 .mpo_vnode_check_getacl = mac_bsdextended_vnode_check_getacl,
731 .mpo_vnode_check_getextattr = mac_bsdextended_vnode_check_getextattr,
732 .mpo_vnode_check_link = mac_bsdextended_vnode_check_link,
733 .mpo_vnode_check_listextattr = mac_bsdextended_vnode_check_listextattr,
734 .mpo_vnode_check_lookup = mac_bsdextended_vnode_check_lookup,
735 .mpo_vnode_check_open = mac_bsdextended_vnode_check_open,
736 .mpo_vnode_check_readdir = mac_bsdextended_vnode_check_readdir,
737 .mpo_vnode_check_readlink = mac_bsdextended_vnode_check_readdlink,
738 .mpo_vnode_check_rename_from = mac_bsdextended_vnode_check_rename_from,
739 .mpo_vnode_check_rename_to = mac_bsdextended_vnode_check_rename_to,
740 .mpo_vnode_check_revoke = mac_bsdextended_vnode_check_revoke,
741 .mpo_vnode_check_setacl = mac_bsdextended_check_setacl_vnode,
742 .mpo_vnode_check_setextattr = mac_bsdextended_vnode_check_setextattr,
743 .mpo_vnode_check_setflags = mac_bsdextended_vnode_check_setflags,
744 .mpo_vnode_check_setmode = mac_bsdextended_vnode_check_setmode,
745 .mpo_vnode_check_setowner = mac_bsdextended_vnode_check_setowner,
746 .mpo_vnode_check_setutimes = mac_bsdextended_vnode_check_setutimes,
747 .mpo_vnode_check_stat = mac_bsdextended_vnode_check_stat,
748 .mpo_vnode_check_unlink = mac_bsdextended_vnode_check_unlink,
|
715 .mpo_destroy = ugidfw_destroy, 716 .mpo_init = ugidfw_init, 717 .mpo_system_check_acct = ugidfw_system_check_acct, 718 .mpo_system_check_auditctl = ugidfw_system_check_auditctl, 719 .mpo_system_check_swapoff = ugidfw_system_check_swapoff, 720 .mpo_system_check_swapon = ugidfw_system_check_swapon, 721 .mpo_vnode_check_access = ugidfw_vnode_check_access, 722 .mpo_vnode_check_chdir = ugidfw_vnode_check_chdir, 723 .mpo_vnode_check_chroot = ugidfw_vnode_check_chroot, 724 .mpo_vnode_check_create = ugidfw_check_create_vnode, 725 .mpo_vnode_check_deleteacl = ugidfw_vnode_check_deleteacl, 726 .mpo_vnode_check_deleteextattr = ugidfw_vnode_check_deleteextattr, 727 .mpo_vnode_check_exec = ugidfw_vnode_check_exec, 728 .mpo_vnode_check_getacl = ugidfw_vnode_check_getacl, 729 .mpo_vnode_check_getextattr = ugidfw_vnode_check_getextattr, 730 .mpo_vnode_check_link = ugidfw_vnode_check_link, 731 .mpo_vnode_check_listextattr = ugidfw_vnode_check_listextattr, 732 .mpo_vnode_check_lookup = ugidfw_vnode_check_lookup, 733 .mpo_vnode_check_open = ugidfw_vnode_check_open, 734 .mpo_vnode_check_readdir = ugidfw_vnode_check_readdir, 735 .mpo_vnode_check_readlink = ugidfw_vnode_check_readdlink, 736 .mpo_vnode_check_rename_from = ugidfw_vnode_check_rename_from, 737 .mpo_vnode_check_rename_to = ugidfw_vnode_check_rename_to, 738 .mpo_vnode_check_revoke = ugidfw_vnode_check_revoke, 739 .mpo_vnode_check_setacl = ugidfw_check_setacl_vnode, 740 .mpo_vnode_check_setextattr = ugidfw_vnode_check_setextattr, 741 .mpo_vnode_check_setflags = ugidfw_vnode_check_setflags, 742 .mpo_vnode_check_setmode = ugidfw_vnode_check_setmode, 743 .mpo_vnode_check_setowner = ugidfw_vnode_check_setowner, 744 .mpo_vnode_check_setutimes = ugidfw_vnode_check_setutimes, 745 .mpo_vnode_check_stat = ugidfw_vnode_check_stat, 746 .mpo_vnode_check_unlink = ugidfw_vnode_check_unlink, |
747}; 748
|
751MAC_POLICY_SET(&mac_bsdextended_ops, mac_bsdextended,
752 "TrustedBSD MAC/BSD Extended", MPC_LOADTIME_FLAG_UNLOADOK, NULL);
|
749MAC_POLICY_SET(&ugidfw_ops, mac_bsdextended, "TrustedBSD MAC/BSD Extended", 750 MPC_LOADTIME_FLAG_UNLOADOK, NULL); |
|