3 * All rights reserved.
4 *
5 * This software was developed for the FreeBSD Project in part by Network
6 * Associates Laboratories, the Security Research Division of Network
7 * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"),
8 * as part of the DARPA CHATS research program.
9 *
10 * Redistribution and use in source and binary forms, with or without
11 * modification, are permitted provided that the following conditions
12 * are met:
13 * 1. Redistributions of source code must retain the above copyright
14 * notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in the
17 * documentation and/or other materials provided with the distribution.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29 * SUCH DAMAGE.
30 */
31
32#include <sys/cdefs.h>
| 3 * All rights reserved.
4 *
5 * This software was developed for the FreeBSD Project in part by Network
6 * Associates Laboratories, the Security Research Division of Network
7 * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"),
8 * as part of the DARPA CHATS research program.
9 *
10 * Redistribution and use in source and binary forms, with or without
11 * modification, are permitted provided that the following conditions
12 * are met:
13 * 1. Redistributions of source code must retain the above copyright
14 * notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in the
17 * documentation and/or other materials provided with the distribution.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29 * SUCH DAMAGE.
30 */
31
32#include <sys/cdefs.h>
|
34
35#include "opt_mac.h"
36
37#include <sys/param.h>
38#include <sys/kernel.h>
39#include <sys/lock.h>
40#include <sys/malloc.h>
41#include <sys/module.h>
42#include <sys/mutex.h>
43#include <sys/sbuf.h>
44#include <sys/systm.h>
45#include <sys/vnode.h>
46#include <sys/pipe.h>
47#include <sys/sysctl.h>
48
49#include <security/mac/mac_framework.h>
50#include <security/mac/mac_internal.h>
51#include <security/mac/mac_policy.h>
52
53struct label *
54mac_pipe_label_alloc(void)
55{
56 struct label *label;
57
58 label = mac_labelzone_alloc(M_WAITOK);
59 MAC_PERFORM(init_pipe_label, label);
60 return (label);
61}
62
63void
64mac_init_pipe(struct pipepair *pp)
65{
66
67 pp->pp_label = mac_pipe_label_alloc();
68}
69
70void
71mac_pipe_label_free(struct label *label)
72{
73
74 MAC_PERFORM(destroy_pipe_label, label);
75 mac_labelzone_free(label);
76}
77
78void
79mac_destroy_pipe(struct pipepair *pp)
80{
81
82 mac_pipe_label_free(pp->pp_label);
83 pp->pp_label = NULL;
84}
85
86void
87mac_copy_pipe_label(struct label *src, struct label *dest)
88{
89
90 MAC_PERFORM(copy_pipe_label, src, dest);
91}
92
93int
94mac_externalize_pipe_label(struct label *label, char *elements,
95 char *outbuf, size_t outbuflen)
96{
97 int error;
98
99 MAC_EXTERNALIZE(pipe, label, elements, outbuf, outbuflen);
100
101 return (error);
102}
103
104int
105mac_internalize_pipe_label(struct label *label, char *string)
106{
107 int error;
108
109 MAC_INTERNALIZE(pipe, label, string);
110
111 return (error);
112}
113
114void
115mac_create_pipe(struct ucred *cred, struct pipepair *pp)
116{
117
118 MAC_PERFORM(create_pipe, cred, pp, pp->pp_label);
119}
120
121static void
122mac_relabel_pipe(struct ucred *cred, struct pipepair *pp,
123 struct label *newlabel)
124{
125
126 MAC_PERFORM(relabel_pipe, cred, pp, pp->pp_label, newlabel);
127}
128
129int
130mac_check_pipe_ioctl(struct ucred *cred, struct pipepair *pp,
131 unsigned long cmd, void *data)
132{
133 int error;
134
135 mtx_assert(&pp->pp_mtx, MA_OWNED);
136
137 MAC_CHECK(check_pipe_ioctl, cred, pp, pp->pp_label, cmd, data);
138
139 return (error);
140}
141
142int
143mac_check_pipe_poll(struct ucred *cred, struct pipepair *pp)
144{
145 int error;
146
147 mtx_assert(&pp->pp_mtx, MA_OWNED);
148
149 MAC_CHECK(check_pipe_poll, cred, pp, pp->pp_label);
150
151 return (error);
152}
153
154int
155mac_check_pipe_read(struct ucred *cred, struct pipepair *pp)
156{
157 int error;
158
159 mtx_assert(&pp->pp_mtx, MA_OWNED);
160
161 MAC_CHECK(check_pipe_read, cred, pp, pp->pp_label);
162
163 return (error);
164}
165
166static int
167mac_check_pipe_relabel(struct ucred *cred, struct pipepair *pp,
168 struct label *newlabel)
169{
170 int error;
171
172 mtx_assert(&pp->pp_mtx, MA_OWNED);
173
174 MAC_CHECK(check_pipe_relabel, cred, pp, pp->pp_label, newlabel);
175
176 return (error);
177}
178
179int
180mac_check_pipe_stat(struct ucred *cred, struct pipepair *pp)
181{
182 int error;
183
184 mtx_assert(&pp->pp_mtx, MA_OWNED);
185
186 MAC_CHECK(check_pipe_stat, cred, pp, pp->pp_label);
187
188 return (error);
189}
190
191int
192mac_check_pipe_write(struct ucred *cred, struct pipepair *pp)
193{
194 int error;
195
196 mtx_assert(&pp->pp_mtx, MA_OWNED);
197
198 MAC_CHECK(check_pipe_write, cred, pp, pp->pp_label);
199
200 return (error);
201}
202
203int
204mac_pipe_label_set(struct ucred *cred, struct pipepair *pp,
205 struct label *label)
206{
207 int error;
208
209 mtx_assert(&pp->pp_mtx, MA_OWNED);
210
211 error = mac_check_pipe_relabel(cred, pp, label);
212 if (error)
213 return (error);
214
215 mac_relabel_pipe(cred, pp, label);
216
217 return (0);
218}
| 34
35#include "opt_mac.h"
36
37#include <sys/param.h>
38#include <sys/kernel.h>
39#include <sys/lock.h>
40#include <sys/malloc.h>
41#include <sys/module.h>
42#include <sys/mutex.h>
43#include <sys/sbuf.h>
44#include <sys/systm.h>
45#include <sys/vnode.h>
46#include <sys/pipe.h>
47#include <sys/sysctl.h>
48
49#include <security/mac/mac_framework.h>
50#include <security/mac/mac_internal.h>
51#include <security/mac/mac_policy.h>
52
53struct label *
54mac_pipe_label_alloc(void)
55{
56 struct label *label;
57
58 label = mac_labelzone_alloc(M_WAITOK);
59 MAC_PERFORM(init_pipe_label, label);
60 return (label);
61}
62
63void
64mac_init_pipe(struct pipepair *pp)
65{
66
67 pp->pp_label = mac_pipe_label_alloc();
68}
69
70void
71mac_pipe_label_free(struct label *label)
72{
73
74 MAC_PERFORM(destroy_pipe_label, label);
75 mac_labelzone_free(label);
76}
77
78void
79mac_destroy_pipe(struct pipepair *pp)
80{
81
82 mac_pipe_label_free(pp->pp_label);
83 pp->pp_label = NULL;
84}
85
86void
87mac_copy_pipe_label(struct label *src, struct label *dest)
88{
89
90 MAC_PERFORM(copy_pipe_label, src, dest);
91}
92
93int
94mac_externalize_pipe_label(struct label *label, char *elements,
95 char *outbuf, size_t outbuflen)
96{
97 int error;
98
99 MAC_EXTERNALIZE(pipe, label, elements, outbuf, outbuflen);
100
101 return (error);
102}
103
104int
105mac_internalize_pipe_label(struct label *label, char *string)
106{
107 int error;
108
109 MAC_INTERNALIZE(pipe, label, string);
110
111 return (error);
112}
113
114void
115mac_create_pipe(struct ucred *cred, struct pipepair *pp)
116{
117
118 MAC_PERFORM(create_pipe, cred, pp, pp->pp_label);
119}
120
121static void
122mac_relabel_pipe(struct ucred *cred, struct pipepair *pp,
123 struct label *newlabel)
124{
125
126 MAC_PERFORM(relabel_pipe, cred, pp, pp->pp_label, newlabel);
127}
128
129int
130mac_check_pipe_ioctl(struct ucred *cred, struct pipepair *pp,
131 unsigned long cmd, void *data)
132{
133 int error;
134
135 mtx_assert(&pp->pp_mtx, MA_OWNED);
136
137 MAC_CHECK(check_pipe_ioctl, cred, pp, pp->pp_label, cmd, data);
138
139 return (error);
140}
141
142int
143mac_check_pipe_poll(struct ucred *cred, struct pipepair *pp)
144{
145 int error;
146
147 mtx_assert(&pp->pp_mtx, MA_OWNED);
148
149 MAC_CHECK(check_pipe_poll, cred, pp, pp->pp_label);
150
151 return (error);
152}
153
154int
155mac_check_pipe_read(struct ucred *cred, struct pipepair *pp)
156{
157 int error;
158
159 mtx_assert(&pp->pp_mtx, MA_OWNED);
160
161 MAC_CHECK(check_pipe_read, cred, pp, pp->pp_label);
162
163 return (error);
164}
165
166static int
167mac_check_pipe_relabel(struct ucred *cred, struct pipepair *pp,
168 struct label *newlabel)
169{
170 int error;
171
172 mtx_assert(&pp->pp_mtx, MA_OWNED);
173
174 MAC_CHECK(check_pipe_relabel, cred, pp, pp->pp_label, newlabel);
175
176 return (error);
177}
178
179int
180mac_check_pipe_stat(struct ucred *cred, struct pipepair *pp)
181{
182 int error;
183
184 mtx_assert(&pp->pp_mtx, MA_OWNED);
185
186 MAC_CHECK(check_pipe_stat, cred, pp, pp->pp_label);
187
188 return (error);
189}
190
191int
192mac_check_pipe_write(struct ucred *cred, struct pipepair *pp)
193{
194 int error;
195
196 mtx_assert(&pp->pp_mtx, MA_OWNED);
197
198 MAC_CHECK(check_pipe_write, cred, pp, pp->pp_label);
199
200 return (error);
201}
202
203int
204mac_pipe_label_set(struct ucred *cred, struct pipepair *pp,
205 struct label *label)
206{
207 int error;
208
209 mtx_assert(&pp->pp_mtx, MA_OWNED);
210
211 error = mac_check_pipe_relabel(cred, pp, label);
212 if (error)
213 return (error);
214
215 mac_relabel_pipe(cred, pp, label);
216
217 return (0);
218}
|