| mac_portacl.c (172930) | mac_portacl.c (172955) |
|---|---|
| 1/*- 2 * Copyright (c) 2003-2004 Networks Associates Technology, Inc. 3 * Copyright (c) 2006 SPARTA, Inc. 4 * All rights reserved. 5 * 6 * This software was developed for the FreeBSD Project by Network 7 * Associates Laboratories, the Security Research Division of Network 8 * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), --- 18 unchanged lines hidden (view full) --- 27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 33 * SUCH DAMAGE. 34 * | 1/*- 2 * Copyright (c) 2003-2004 Networks Associates Technology, Inc. 3 * Copyright (c) 2006 SPARTA, Inc. 4 * All rights reserved. 5 * 6 * This software was developed for the FreeBSD Project by Network 7 * Associates Laboratories, the Security Research Division of Network 8 * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), --- 18 unchanged lines hidden (view full) --- 27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 33 * SUCH DAMAGE. 34 * |
| 35 * $FreeBSD: head/sys/security/mac_portacl/mac_portacl.c 172930 2007-10-24 19:04:04Z rwatson $ | 35 * $FreeBSD: head/sys/security/mac_portacl/mac_portacl.c 172955 2007-10-25 11:31:11Z rwatson $ |
| 36 */ 37 38/* 39 * Developed by the TrustedBSD Project. 40 * 41 * Administratively limit access to local UDP/TCP ports for binding purposes. 42 * Intended to be combined with net.inet.ip.portrange.reservedhigh to allow 43 * specific uids and gids to bind specific ports for specific purposes, 44 * while not opening the door to any user replacing an "official" service 45 * while you're restarting it. This only affects ports explicitly bound by 46 * the user process (either for listen/outgoing socket for TCP, or send/ 47 * receive for UDP). This module will not limit ports bound implicitly for 48 * out-going connections where the process hasn't explicitly selected a port: 49 * these are automatically selected by the IP stack. 50 * | 36 */ 37 38/* 39 * Developed by the TrustedBSD Project. 40 * 41 * Administratively limit access to local UDP/TCP ports for binding purposes. 42 * Intended to be combined with net.inet.ip.portrange.reservedhigh to allow 43 * specific uids and gids to bind specific ports for specific purposes, 44 * while not opening the door to any user replacing an "official" service 45 * while you're restarting it. This only affects ports explicitly bound by 46 * the user process (either for listen/outgoing socket for TCP, or send/ 47 * receive for UDP). This module will not limit ports bound implicitly for 48 * out-going connections where the process hasn't explicitly selected a port: 49 * these are automatically selected by the IP stack. 50 * |
| 51 * To use this module, security.mac.enforce_socket must be enabled, and 52 * you will probably want to twiddle the net.inet sysctl listed above. 53 * Then use sysctl(8) to modify the rules string: | 51 * To use this module, security.mac.enforce_socket must be enabled, and you 52 * will probably want to twiddle the net.inet sysctl listed above. Then use 53 * sysctl(8) to modify the rules string: |
| 54 * 55 * # sysctl security.mac.portacl.rules="uid:425:tcp:80,uid:425:tcp:79" 56 * | 54 * 55 * # sysctl security.mac.portacl.rules="uid:425:tcp:80,uid:425:tcp:79" 56 * |
| 57 * This ruleset, for example, permits uid 425 to bind TCP ports 80 (http) 58 * and 79 (finger). User names and group names can't be used directly 59 * because the kernel only knows about uids and gids. | 57 * This ruleset, for example, permits uid 425 to bind TCP ports 80 (http) and 58 * 79 (finger). User names and group names can't be used directly because 59 * the kernel only knows about uids and gids. |
| 60 */ 61 62#include <sys/param.h> 63#include <sys/domain.h> 64#include <sys/kernel.h> 65#include <sys/lock.h> 66#include <sys/malloc.h> 67#include <sys/module.h> --- 13 unchanged lines hidden (view full) --- 81 82#include <security/mac/mac_policy.h> 83 84SYSCTL_DECL(_security_mac); 85 86SYSCTL_NODE(_security_mac, OID_AUTO, portacl, CTLFLAG_RW, 0, 87 "TrustedBSD mac_portacl policy controls"); 88 | 60 */ 61 62#include <sys/param.h> 63#include <sys/domain.h> 64#include <sys/kernel.h> 65#include <sys/lock.h> 66#include <sys/malloc.h> 67#include <sys/module.h> --- 13 unchanged lines hidden (view full) --- 81 82#include <security/mac/mac_policy.h> 83 84SYSCTL_DECL(_security_mac); 85 86SYSCTL_NODE(_security_mac, OID_AUTO, portacl, CTLFLAG_RW, 0, 87 "TrustedBSD mac_portacl policy controls"); 88 |
| 89static int mac_portacl_enabled = 1; | 89static int portacl_enabled = 1; |
| 90SYSCTL_INT(_security_mac_portacl, OID_AUTO, enabled, CTLFLAG_RW, | 90SYSCTL_INT(_security_mac_portacl, OID_AUTO, enabled, CTLFLAG_RW, |
| 91 &mac_portacl_enabled, 0, "Enforce portacl policy"); 92TUNABLE_INT("security.mac.portacl.enabled", &mac_portacl_enabled); | 91 &portacl_enabled, 0, "Enforce portacl policy"); 92TUNABLE_INT("security.mac.portacl.enabled", &portacl_enabled); |
| 93 | 93 |
| 94static int mac_portacl_suser_exempt = 1; | 94static int portacl_suser_exempt = 1; |
| 95SYSCTL_INT(_security_mac_portacl, OID_AUTO, suser_exempt, CTLFLAG_RW, | 95SYSCTL_INT(_security_mac_portacl, OID_AUTO, suser_exempt, CTLFLAG_RW, |
| 96 &mac_portacl_suser_exempt, 0, "Privilege permits binding of any port"); | 96 &portacl_suser_exempt, 0, "Privilege permits binding of any port"); |
| 97TUNABLE_INT("security.mac.portacl.suser_exempt", | 97TUNABLE_INT("security.mac.portacl.suser_exempt", |
| 98 &mac_portacl_suser_exempt); | 98 &portacl_suser_exempt); |
| 99 | 99 |
| 100static int mac_portacl_autoport_exempt = 1; | 100static int portacl_autoport_exempt = 1; |
| 101SYSCTL_INT(_security_mac_portacl, OID_AUTO, autoport_exempt, CTLFLAG_RW, | 101SYSCTL_INT(_security_mac_portacl, OID_AUTO, autoport_exempt, CTLFLAG_RW, |
| 102 &mac_portacl_autoport_exempt, 0, "Allow automatic allocation through " | 102 &portacl_autoport_exempt, 0, "Allow automatic allocation through " |
| 103 "binding port 0 if not IP_PORTRANGELOW"); 104TUNABLE_INT("security.mac.portacl.autoport_exempt", | 103 "binding port 0 if not IP_PORTRANGELOW"); 104TUNABLE_INT("security.mac.portacl.autoport_exempt", |
| 105 &mac_portacl_autoport_exempt); | 105 &portacl_autoport_exempt); |
| 106 | 106 |
| 107static int mac_portacl_port_high = 1023; | 107static int portacl_port_high = 1023; |
| 108SYSCTL_INT(_security_mac_portacl, OID_AUTO, port_high, CTLFLAG_RW, | 108SYSCTL_INT(_security_mac_portacl, OID_AUTO, port_high, CTLFLAG_RW, |
| 109 &mac_portacl_port_high, 0, "Highest port to enforce for"); 110TUNABLE_INT("security.mac.portacl.port_high", &mac_portacl_port_high); | 109 &portacl_port_high, 0, "Highest port to enforce for"); 110TUNABLE_INT("security.mac.portacl.port_high", &portacl_port_high); |
| 111 | 111 |
| 112MALLOC_DEFINE(M_PORTACL, "mac_portacl_rule", "Rules for mac_portacl"); | 112MALLOC_DEFINE(M_PORTACL, "portacl_rule", "Rules for mac_portacl"); |
| 113 114#define MAC_RULE_STRING_LEN 1024 115 116#define RULE_GID 1 117#define RULE_UID 2 118#define RULE_PROTO_TCP 1 119#define RULE_PROTO_UDP 2 120struct rule { --- 263 unchanged lines hidden (view full) --- 384 struct rule *rule; 385 int error; 386 387#if 0 388 printf("Check requested for euid %d, family %d, type %d, port %d\n", 389 cred->cr_uid, family, type, port); 390#endif 391 | 113 114#define MAC_RULE_STRING_LEN 1024 115 116#define RULE_GID 1 117#define RULE_UID 2 118#define RULE_PROTO_TCP 1 119#define RULE_PROTO_UDP 2 120struct rule { --- 263 unchanged lines hidden (view full) --- 384 struct rule *rule; 385 int error; 386 387#if 0 388 printf("Check requested for euid %d, family %d, type %d, port %d\n", 389 cred->cr_uid, family, type, port); 390#endif 391 |
| 392 if (port > mac_portacl_port_high) | 392 if (port > portacl_port_high) |
| 393 return (0); 394 395 error = EPERM; 396 mtx_lock(&rule_mtx); 397 for (rule = TAILQ_FIRST(&rule_head); 398 rule != NULL; 399 rule = TAILQ_NEXT(rule, r_entries)) { 400 if (type == SOCK_DGRAM && rule->r_protocol != RULE_PROTO_UDP) --- 16 unchanged lines hidden (view full) --- 417 break; 418 } 419 } else 420 panic("rules_check: unknown rule type %d", 421 rule->r_idtype); 422 } 423 mtx_unlock(&rule_mtx); 424 | 393 return (0); 394 395 error = EPERM; 396 mtx_lock(&rule_mtx); 397 for (rule = TAILQ_FIRST(&rule_head); 398 rule != NULL; 399 rule = TAILQ_NEXT(rule, r_entries)) { 400 if (type == SOCK_DGRAM && rule->r_protocol != RULE_PROTO_UDP) --- 16 unchanged lines hidden (view full) --- 417 break; 418 } 419 } else 420 panic("rules_check: unknown rule type %d", 421 rule->r_idtype); 422 } 423 mtx_unlock(&rule_mtx); 424 |
| 425 if (error != 0 && mac_portacl_suser_exempt != 0) | 425 if (error != 0 && portacl_suser_exempt != 0) |
| 426 error = priv_check_cred(cred, PRIV_NETINET_RESERVEDPORT, 0); 427 428 return (error); 429} 430 431/* 432 * Note, this only limits the ability to explicitly bind a port, it 433 * doesn't limit implicitly bound ports for outgoing connections where --- 4 unchanged lines hidden (view full) --- 438 struct label *solabel, struct sockaddr *sa) 439{ 440 struct sockaddr_in *sin; 441 struct inpcb *inp; 442 int family, type; 443 u_int16_t port; 444 445 /* Only run if we are enabled. */ | 426 error = priv_check_cred(cred, PRIV_NETINET_RESERVEDPORT, 0); 427 428 return (error); 429} 430 431/* 432 * Note, this only limits the ability to explicitly bind a port, it 433 * doesn't limit implicitly bound ports for outgoing connections where --- 4 unchanged lines hidden (view full) --- 438 struct label *solabel, struct sockaddr *sa) 439{ 440 struct sockaddr_in *sin; 441 struct inpcb *inp; 442 int family, type; 443 u_int16_t port; 444 445 /* Only run if we are enabled. */ |
| 446 if (mac_portacl_enabled == 0) | 446 if (portacl_enabled == 0) |
| 447 return (0); 448 449 /* Only interested in IPv4 and IPv6 sockets. */ 450 if (so->so_proto->pr_domain->dom_family != PF_INET && 451 so->so_proto->pr_domain->dom_family != PF_INET6) 452 return (0); 453 454 /* Currently, we don't attempt to deal with SOCK_RAW, etc. */ --- 13 unchanged lines hidden (view full) --- 468 /* 469 * Sockets are frequently bound with a specific IP address but a port 470 * number of '0' to request automatic port allocation. This is often 471 * desirable as long as IP_PORTRANGELOW isn't set, which might permit 472 * automatic allocation of a "privileged" port. The autoport exempt 473 * flag exempts port 0 allocation from rule checking as long as a low 474 * port isn't required. 475 */ | 447 return (0); 448 449 /* Only interested in IPv4 and IPv6 sockets. */ 450 if (so->so_proto->pr_domain->dom_family != PF_INET && 451 so->so_proto->pr_domain->dom_family != PF_INET6) 452 return (0); 453 454 /* Currently, we don't attempt to deal with SOCK_RAW, etc. */ --- 13 unchanged lines hidden (view full) --- 468 /* 469 * Sockets are frequently bound with a specific IP address but a port 470 * number of '0' to request automatic port allocation. This is often 471 * desirable as long as IP_PORTRANGELOW isn't set, which might permit 472 * automatic allocation of a "privileged" port. The autoport exempt 473 * flag exempts port 0 allocation from rule checking as long as a low 474 * port isn't required. 475 */ |
| 476 if (mac_portacl_autoport_exempt && port == 0) { | 476 if (portacl_autoport_exempt && port == 0) { |
| 477 inp = sotoinpcb(so); 478 if ((inp->inp_flags & INP_LOWPORT) == 0) 479 return (0); 480 } 481 482 return (rules_check(cred, family, type, port)); 483} 484 | 477 inp = sotoinpcb(so); 478 if ((inp->inp_flags & INP_LOWPORT) == 0) 479 return (0); 480 } 481 482 return (rules_check(cred, family, type, port)); 483} 484 |
| 485static struct mac_policy_ops mac_portacl_ops = | 485static struct mac_policy_ops portacl_ops = |
| 486{ 487 .mpo_destroy = destroy, 488 .mpo_init = init, 489 .mpo_socket_check_bind = socket_check_bind, 490}; 491 | 486{ 487 .mpo_destroy = destroy, 488 .mpo_init = init, 489 .mpo_socket_check_bind = socket_check_bind, 490}; 491 |
| 492MAC_POLICY_SET(&mac_portacl_ops, trustedbsd_mac_portacl, 493 "TrustedBSD MAC/portacl", MPC_LOADTIME_FLAG_UNLOADOK, NULL); | 492MAC_POLICY_SET(&portacl_ops, mac_portacl, "TrustedBSD MAC/portacl", 493 MPC_LOADTIME_FLAG_UNLOADOK, NULL); |