ugidfw_system.c (170689) | ugidfw_system.c (171253) |
---|---|
1/*- | 1/*- |
2 * Copyright (c) 2005 Tom Rhodes | |
3 * Copyright (c) 1999-2002, 2007 Robert N. M. Watson 4 * Copyright (c) 2001-2005 Networks Associates Technology, Inc. | 2 * Copyright (c) 1999-2002, 2007 Robert N. M. Watson 3 * Copyright (c) 2001-2005 Networks Associates Technology, Inc. |
4 * Copyright (c) 2005 Tom Rhodes |
|
5 * All rights reserved. 6 * 7 * This software was developed by Robert Watson for the TrustedBSD Project. 8 * It was later enhanced by Tom Rhodes for the TrustedBSD Project. 9 * 10 * This software was developed for the FreeBSD Project in part by Network 11 * Associates Laboratories, the Security Research Division of Network 12 * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), --- 15 unchanged lines hidden (view full) --- 28 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 29 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 30 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 31 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 32 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 33 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 34 * SUCH DAMAGE. 35 * | 5 * All rights reserved. 6 * 7 * This software was developed by Robert Watson for the TrustedBSD Project. 8 * It was later enhanced by Tom Rhodes for the TrustedBSD Project. 9 * 10 * This software was developed for the FreeBSD Project in part by Network 11 * Associates Laboratories, the Security Research Division of Network 12 * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), --- 15 unchanged lines hidden (view full) --- 28 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 29 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 30 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 31 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 32 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 33 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 34 * SUCH DAMAGE. 35 * |
36 * $FreeBSD: head/sys/security/mac_bsdextended/mac_bsdextended.c 170689 2007-06-13 22:42:43Z rwatson $ | 36 * $FreeBSD: head/sys/security/mac_bsdextended/mac_bsdextended.c 171253 2007-07-05 13:16:04Z rwatson $ |
37 */ 38 39/* 40 * Developed by the TrustedBSD Project. | 37 */ 38 39/* 40 * Developed by the TrustedBSD Project. |
41 * "BSD Extended" MAC policy, allowing the administrator to impose 42 * mandatory rules regarding users and some system objects. | 41 * 42 * "BSD Extended" MAC policy, allowing the administrator to impose mandatory 43 * firewall-like rules regarding users and file system objects. |
43 */ 44 45#include <sys/param.h> 46#include <sys/acl.h> 47#include <sys/kernel.h> 48#include <sys/jail.h> 49#include <sys/lock.h> 50#include <sys/malloc.h> --- 32 unchanged lines hidden (view full) --- 83SYSCTL_INT(_security_mac_bsdextended, OID_AUTO, rule_count, CTLFLAG_RD, 84 &rule_count, 0, "Number of defined rules\n"); 85SYSCTL_INT(_security_mac_bsdextended, OID_AUTO, rule_slots, CTLFLAG_RD, 86 &rule_slots, 0, "Number of used rule slots\n"); 87SYSCTL_INT(_security_mac_bsdextended, OID_AUTO, rule_version, CTLFLAG_RD, 88 &rule_version, 0, "Version number for API\n"); 89 90/* | 44 */ 45 46#include <sys/param.h> 47#include <sys/acl.h> 48#include <sys/kernel.h> 49#include <sys/jail.h> 50#include <sys/lock.h> 51#include <sys/malloc.h> --- 32 unchanged lines hidden (view full) --- 84SYSCTL_INT(_security_mac_bsdextended, OID_AUTO, rule_count, CTLFLAG_RD, 85 &rule_count, 0, "Number of defined rules\n"); 86SYSCTL_INT(_security_mac_bsdextended, OID_AUTO, rule_slots, CTLFLAG_RD, 87 &rule_slots, 0, "Number of used rule slots\n"); 88SYSCTL_INT(_security_mac_bsdextended, OID_AUTO, rule_version, CTLFLAG_RD, 89 &rule_version, 0, "Version number for API\n"); 90 91/* |
91 * This is just used for logging purposes, eventually we would like 92 * to log much more then failed requests. | 92 * This is just used for logging purposes, eventually we would like to log 93 * much more then failed requests. |
93 */ 94static int mac_bsdextended_logging; 95SYSCTL_INT(_security_mac_bsdextended, OID_AUTO, logging, CTLFLAG_RW, 96 &mac_bsdextended_logging, 0, "Log failed authorization requests"); 97 98/* | 94 */ 95static int mac_bsdextended_logging; 96SYSCTL_INT(_security_mac_bsdextended, OID_AUTO, logging, CTLFLAG_RW, 97 &mac_bsdextended_logging, 0, "Log failed authorization requests"); 98 99/* |
99 * This tunable is here for compatibility. It will allow the user 100 * to switch between the new mode (first rule matches) and the old 101 * functionality (all rules match). | 100 * This tunable is here for compatibility. It will allow the user to switch 101 * between the new mode (first rule matches) and the old functionality (all 102 * rules match). |
102 */ 103static int 104mac_bsdextended_firstmatch_enabled; 105SYSCTL_INT(_security_mac_bsdextended, OID_AUTO, firstmatch_enabled, | 103 */ 104static int 105mac_bsdextended_firstmatch_enabled; 106SYSCTL_INT(_security_mac_bsdextended, OID_AUTO, firstmatch_enabled, |
106 CTLFLAG_RW, &mac_bsdextended_firstmatch_enabled, 1, 107 "Disable/enable match first rule functionality"); | 107 CTLFLAG_RW, &mac_bsdextended_firstmatch_enabled, 1, 108 "Disable/enable match first rule functionality"); |
108 109static int 110mac_bsdextended_rule_valid(struct mac_bsdextended_rule *rule) 111{ 112 113 if ((rule->mbr_subject.mbs_flags | MBS_ALL_FLAGS) != MBS_ALL_FLAGS) 114 return (EINVAL); | 109 110static int 111mac_bsdextended_rule_valid(struct mac_bsdextended_rule *rule) 112{ 113 114 if ((rule->mbr_subject.mbs_flags | MBS_ALL_FLAGS) != MBS_ALL_FLAGS) 115 return (EINVAL); |
115 | |
116 if ((rule->mbr_subject.mbs_neg | MBS_ALL_FLAGS) != MBS_ALL_FLAGS) 117 return (EINVAL); | 116 if ((rule->mbr_subject.mbs_neg | MBS_ALL_FLAGS) != MBS_ALL_FLAGS) 117 return (EINVAL); |
118 | |
119 if ((rule->mbr_object.mbo_flags | MBO_ALL_FLAGS) != MBO_ALL_FLAGS) 120 return (EINVAL); | 118 if ((rule->mbr_object.mbo_flags | MBO_ALL_FLAGS) != MBO_ALL_FLAGS) 119 return (EINVAL); |
121 | |
122 if ((rule->mbr_object.mbo_neg | MBO_ALL_FLAGS) != MBO_ALL_FLAGS) 123 return (EINVAL); | 120 if ((rule->mbr_object.mbo_neg | MBO_ALL_FLAGS) != MBO_ALL_FLAGS) 121 return (EINVAL); |
124 | |
125 if ((rule->mbr_object.mbo_neg | MBO_TYPE_DEFINED) && 126 (rule->mbr_object.mbo_type | MBO_ALL_TYPE) != MBO_ALL_TYPE) 127 return (EINVAL); | 122 if ((rule->mbr_object.mbo_neg | MBO_TYPE_DEFINED) && 123 (rule->mbr_object.mbo_type | MBO_ALL_TYPE) != MBO_ALL_TYPE) 124 return (EINVAL); |
128 | |
129 if ((rule->mbr_mode | MBI_ALLPERM) != MBI_ALLPERM) 130 return (EINVAL); | 125 if ((rule->mbr_mode | MBI_ALLPERM) != MBI_ALLPERM) 126 return (EINVAL); |
131 | |
132 return (0); 133} 134 135static int 136sysctl_rule(SYSCTL_HANDLER_ARGS) 137{ 138 struct mac_bsdextended_rule temprule, *ruleptr; 139 u_int namelen; 140 int error, index, *name; 141 142 error = 0; 143 name = (int *)arg1; 144 namelen = arg2; | 127 return (0); 128} 129 130static int 131sysctl_rule(SYSCTL_HANDLER_ARGS) 132{ 133 struct mac_bsdextended_rule temprule, *ruleptr; 134 u_int namelen; 135 int error, index, *name; 136 137 error = 0; 138 name = (int *)arg1; 139 namelen = arg2; |
145 146 /* printf("bsdextended sysctl handler (namelen %d)\n", namelen); */ 147 | |
148 if (namelen != 1) 149 return (EINVAL); | 140 if (namelen != 1) 141 return (EINVAL); |
150 | |
151 index = name[0]; 152 if (index >= MAC_BSDEXTENDED_MAXRULES) 153 return (ENOENT); 154 155 ruleptr = NULL; 156 if (req->newptr && req->newlen != 0) { 157 error = SYSCTL_IN(req, &temprule, sizeof(temprule)); 158 if (error) 159 return (error); 160 MALLOC(ruleptr, struct mac_bsdextended_rule *, 161 sizeof(*ruleptr), M_MACBSDEXTENDED, M_WAITOK | M_ZERO); 162 } 163 164 mtx_lock(&mac_bsdextended_mtx); | 142 index = name[0]; 143 if (index >= MAC_BSDEXTENDED_MAXRULES) 144 return (ENOENT); 145 146 ruleptr = NULL; 147 if (req->newptr && req->newlen != 0) { 148 error = SYSCTL_IN(req, &temprule, sizeof(temprule)); 149 if (error) 150 return (error); 151 MALLOC(ruleptr, struct mac_bsdextended_rule *, 152 sizeof(*ruleptr), M_MACBSDEXTENDED, M_WAITOK | M_ZERO); 153 } 154 155 mtx_lock(&mac_bsdextended_mtx); |
165 | |
166 if (req->oldptr) { 167 if (index < 0 || index > rule_slots + 1) { 168 error = ENOENT; 169 goto out; 170 } 171 if (rules[index] == NULL) { 172 error = ENOENT; 173 goto out; 174 } 175 temprule = *rules[index]; 176 } | 156 if (req->oldptr) { 157 if (index < 0 || index > rule_slots + 1) { 158 error = ENOENT; 159 goto out; 160 } 161 if (rules[index] == NULL) { 162 error = ENOENT; 163 goto out; 164 } 165 temprule = *rules[index]; 166 } |
177 | |
178 if (req->newptr && req->newlen == 0) { | 167 if (req->newptr && req->newlen == 0) { |
179 /* printf("deletion\n"); */ | |
180 KASSERT(ruleptr == NULL, ("sysctl_rule: ruleptr != NULL")); 181 ruleptr = rules[index]; 182 if (ruleptr == NULL) { 183 error = ENOENT; 184 goto out; 185 } 186 rule_count--; 187 rules[index] = NULL; 188 } else if (req->newptr) { 189 error = mac_bsdextended_rule_valid(&temprule); 190 if (error) 191 goto out; | 168 KASSERT(ruleptr == NULL, ("sysctl_rule: ruleptr != NULL")); 169 ruleptr = rules[index]; 170 if (ruleptr == NULL) { 171 error = ENOENT; 172 goto out; 173 } 174 rule_count--; 175 rules[index] = NULL; 176 } else if (req->newptr) { 177 error = mac_bsdextended_rule_valid(&temprule); 178 if (error) 179 goto out; |
192 | |
193 if (rules[index] == NULL) { | 180 if (rules[index] == NULL) { |
194 /* printf("addition\n"); */ | |
195 *ruleptr = temprule; 196 rules[index] = ruleptr; 197 ruleptr = NULL; 198 if (index + 1 > rule_slots) 199 rule_slots = index + 1; 200 rule_count++; | 181 *ruleptr = temprule; 182 rules[index] = ruleptr; 183 ruleptr = NULL; 184 if (index + 1 > rule_slots) 185 rule_slots = index + 1; 186 rule_count++; |
201 } else { 202 /* printf("replacement\n"); */ | 187 } else |
203 *rules[index] = temprule; | 188 *rules[index] = temprule; |
204 } | |
205 } | 189 } |
206 | |
207out: 208 mtx_unlock(&mac_bsdextended_mtx); 209 if (ruleptr != NULL) 210 FREE(ruleptr, M_MACBSDEXTENDED); 211 if (req->oldptr && error == 0) 212 error = SYSCTL_OUT(req, &temprule, sizeof(temprule)); | 190out: 191 mtx_unlock(&mac_bsdextended_mtx); 192 if (ruleptr != NULL) 193 FREE(ruleptr, M_MACBSDEXTENDED); 194 if (req->oldptr && error == 0) 195 error = SYSCTL_OUT(req, &temprule, sizeof(temprule)); |
213 | |
214 return (error); 215} 216 | 196 return (error); 197} 198 |
217SYSCTL_NODE(_security_mac_bsdextended, OID_AUTO, rules, 218 CTLFLAG_RW, sysctl_rule, "BSD extended MAC rules"); | 199SYSCTL_NODE(_security_mac_bsdextended, OID_AUTO, rules, CTLFLAG_RW, 200 sysctl_rule, "BSD extended MAC rules"); |
219 220static void 221mac_bsdextended_init(struct mac_policy_conf *mpc) 222{ 223 | 201 202static void 203mac_bsdextended_init(struct mac_policy_conf *mpc) 204{ 205 |
224 /* Initialize ruleset lock. */ | |
225 mtx_init(&mac_bsdextended_mtx, "mac_bsdextended lock", NULL, MTX_DEF); | 206 mtx_init(&mac_bsdextended_mtx, "mac_bsdextended lock", NULL, MTX_DEF); |
226 227 /* Register dynamic sysctl's for rules. */ | |
228} 229 230static void 231mac_bsdextended_destroy(struct mac_policy_conf *mpc) 232{ 233 | 207} 208 209static void 210mac_bsdextended_destroy(struct mac_policy_conf *mpc) 211{ 212 |
234 /* Destroy ruleset lock. */ | |
235 mtx_destroy(&mac_bsdextended_mtx); | 213 mtx_destroy(&mac_bsdextended_mtx); |
236 237 /* Tear down sysctls. */ | |
238} 239 240static int 241mac_bsdextended_rulecheck(struct mac_bsdextended_rule *rule, 242 struct ucred *cred, struct vnode *vp, struct vattr *vap, int acc_mode) 243{ 244 int match; 245 int i; --- 4 unchanged lines hidden (view full) --- 250 mtx_assert(&mac_bsdextended_mtx, MA_OWNED); 251 if (rule->mbr_subject.mbs_flags & MBS_UID_DEFINED) { 252 match = ((cred->cr_uid <= rule->mbr_subject.mbs_uid_max && 253 cred->cr_uid >= rule->mbr_subject.mbs_uid_min) || 254 (cred->cr_ruid <= rule->mbr_subject.mbs_uid_max && 255 cred->cr_ruid >= rule->mbr_subject.mbs_uid_min) || 256 (cred->cr_svuid <= rule->mbr_subject.mbs_uid_max && 257 cred->cr_svuid >= rule->mbr_subject.mbs_uid_min)); | 214} 215 216static int 217mac_bsdextended_rulecheck(struct mac_bsdextended_rule *rule, 218 struct ucred *cred, struct vnode *vp, struct vattr *vap, int acc_mode) 219{ 220 int match; 221 int i; --- 4 unchanged lines hidden (view full) --- 226 mtx_assert(&mac_bsdextended_mtx, MA_OWNED); 227 if (rule->mbr_subject.mbs_flags & MBS_UID_DEFINED) { 228 match = ((cred->cr_uid <= rule->mbr_subject.mbs_uid_max && 229 cred->cr_uid >= rule->mbr_subject.mbs_uid_min) || 230 (cred->cr_ruid <= rule->mbr_subject.mbs_uid_max && 231 cred->cr_ruid >= rule->mbr_subject.mbs_uid_min) || 232 (cred->cr_svuid <= rule->mbr_subject.mbs_uid_max && 233 cred->cr_svuid >= rule->mbr_subject.mbs_uid_min)); |
258 | |
259 if (rule->mbr_subject.mbs_neg & MBS_UID_DEFINED) 260 match = !match; | 234 if (rule->mbr_subject.mbs_neg & MBS_UID_DEFINED) 235 match = !match; |
261 | |
262 if (!match) 263 return (0); 264 } 265 266 if (rule->mbr_subject.mbs_flags & MBS_GID_DEFINED) { 267 match = ((cred->cr_rgid <= rule->mbr_subject.mbs_gid_max && 268 cred->cr_rgid >= rule->mbr_subject.mbs_gid_min) || 269 (cred->cr_svgid <= rule->mbr_subject.mbs_gid_max && 270 cred->cr_svgid >= rule->mbr_subject.mbs_gid_min)); | 236 if (!match) 237 return (0); 238 } 239 240 if (rule->mbr_subject.mbs_flags & MBS_GID_DEFINED) { 241 match = ((cred->cr_rgid <= rule->mbr_subject.mbs_gid_max && 242 cred->cr_rgid >= rule->mbr_subject.mbs_gid_min) || 243 (cred->cr_svgid <= rule->mbr_subject.mbs_gid_max && 244 cred->cr_svgid >= rule->mbr_subject.mbs_gid_min)); |
271 | |
272 if (!match) { | 245 if (!match) { |
273 for (i = 0; i < cred->cr_ngroups; i++) | 246 for (i = 0; i < cred->cr_ngroups; i++) { |
274 if (cred->cr_groups[i] 275 <= rule->mbr_subject.mbs_gid_max && 276 cred->cr_groups[i] 277 >= rule->mbr_subject.mbs_gid_min) { 278 match = 1; 279 break; 280 } | 247 if (cred->cr_groups[i] 248 <= rule->mbr_subject.mbs_gid_max && 249 cred->cr_groups[i] 250 >= rule->mbr_subject.mbs_gid_min) { 251 match = 1; 252 break; 253 } |
254 } |
|
281 } | 255 } |
282 | |
283 if (rule->mbr_subject.mbs_neg & MBS_GID_DEFINED) 284 match = !match; | 256 if (rule->mbr_subject.mbs_neg & MBS_GID_DEFINED) 257 match = !match; |
285 | |
286 if (!match) 287 return (0); 288 } 289 290 if (rule->mbr_subject.mbs_flags & MBS_PRISON_DEFINED) { 291 match = (cred->cr_prison != NULL && 292 cred->cr_prison->pr_id == rule->mbr_subject.mbs_prison); | 258 if (!match) 259 return (0); 260 } 261 262 if (rule->mbr_subject.mbs_flags & MBS_PRISON_DEFINED) { 263 match = (cred->cr_prison != NULL && 264 cred->cr_prison->pr_id == rule->mbr_subject.mbs_prison); |
293 | |
294 if (rule->mbr_subject.mbs_neg & MBS_PRISON_DEFINED) 295 match = !match; | 265 if (rule->mbr_subject.mbs_neg & MBS_PRISON_DEFINED) 266 match = !match; |
296 | |
297 if (!match) 298 return (0); 299 } 300 301 /* 302 * Is there an object match? 303 */ 304 if (rule->mbr_object.mbo_flags & MBO_UID_DEFINED) { 305 match = (vap->va_uid <= rule->mbr_object.mbo_uid_max && 306 vap->va_uid >= rule->mbr_object.mbo_uid_min); | 267 if (!match) 268 return (0); 269 } 270 271 /* 272 * Is there an object match? 273 */ 274 if (rule->mbr_object.mbo_flags & MBO_UID_DEFINED) { 275 match = (vap->va_uid <= rule->mbr_object.mbo_uid_max && 276 vap->va_uid >= rule->mbr_object.mbo_uid_min); |
307 | |
308 if (rule->mbr_object.mbo_neg & MBO_UID_DEFINED) 309 match = !match; | 277 if (rule->mbr_object.mbo_neg & MBO_UID_DEFINED) 278 match = !match; |
310 | |
311 if (!match) 312 return (0); 313 } 314 315 if (rule->mbr_object.mbo_flags & MBO_GID_DEFINED) { 316 match = (vap->va_gid <= rule->mbr_object.mbo_gid_max && 317 vap->va_gid >= rule->mbr_object.mbo_gid_min); | 279 if (!match) 280 return (0); 281 } 282 283 if (rule->mbr_object.mbo_flags & MBO_GID_DEFINED) { 284 match = (vap->va_gid <= rule->mbr_object.mbo_gid_max && 285 vap->va_gid >= rule->mbr_object.mbo_gid_min); |
318 | |
319 if (rule->mbr_object.mbo_neg & MBO_GID_DEFINED) 320 match = !match; | 286 if (rule->mbr_object.mbo_neg & MBO_GID_DEFINED) 287 match = !match; |
321 | |
322 if (!match) 323 return (0); 324 } 325 326 if (rule->mbr_object.mbo_flags & MBO_FSID_DEFINED) { 327 match = (bcmp(&(vp->v_mount->mnt_stat.f_fsid), 328 &(rule->mbr_object.mbo_fsid), 329 sizeof(rule->mbr_object.mbo_fsid)) == 0); | 288 if (!match) 289 return (0); 290 } 291 292 if (rule->mbr_object.mbo_flags & MBO_FSID_DEFINED) { 293 match = (bcmp(&(vp->v_mount->mnt_stat.f_fsid), 294 &(rule->mbr_object.mbo_fsid), 295 sizeof(rule->mbr_object.mbo_fsid)) == 0); |
330 | |
331 if (rule->mbr_object.mbo_neg & MBO_FSID_DEFINED) 332 match = !match; | 296 if (rule->mbr_object.mbo_neg & MBO_FSID_DEFINED) 297 match = !match; |
333 | |
334 if (!match) | 298 if (!match) |
335 return 0; | 299 return (0); |
336 } 337 338 if (rule->mbr_object.mbo_flags & MBO_SUID) { 339 match = (vap->va_mode & VSUID); | 300 } 301 302 if (rule->mbr_object.mbo_flags & MBO_SUID) { 303 match = (vap->va_mode & VSUID); |
340 | |
341 if (rule->mbr_object.mbo_neg & MBO_SUID) 342 match = !match; | 304 if (rule->mbr_object.mbo_neg & MBO_SUID) 305 match = !match; |
343 | |
344 if (!match) | 306 if (!match) |
345 return 0; | 307 return (0); |
346 } 347 348 if (rule->mbr_object.mbo_flags & MBO_SGID) { 349 match = (vap->va_mode & VSGID); | 308 } 309 310 if (rule->mbr_object.mbo_flags & MBO_SGID) { 311 match = (vap->va_mode & VSGID); |
350 | |
351 if (rule->mbr_object.mbo_neg & MBO_SGID) 352 match = !match; | 312 if (rule->mbr_object.mbo_neg & MBO_SGID) 313 match = !match; |
353 | |
354 if (!match) | 314 if (!match) |
355 return 0; | 315 return (0); |
356 } 357 358 if (rule->mbr_object.mbo_flags & MBO_UID_SUBJECT) { 359 match = (vap->va_uid == cred->cr_uid || 360 vap->va_uid == cred->cr_ruid || 361 vap->va_uid == cred->cr_svuid); | 316 } 317 318 if (rule->mbr_object.mbo_flags & MBO_UID_SUBJECT) { 319 match = (vap->va_uid == cred->cr_uid || 320 vap->va_uid == cred->cr_ruid || 321 vap->va_uid == cred->cr_svuid); |
362 | |
363 if (rule->mbr_object.mbo_neg & MBO_UID_SUBJECT) 364 match = !match; | 322 if (rule->mbr_object.mbo_neg & MBO_UID_SUBJECT) 323 match = !match; |
365 | |
366 if (!match) | 324 if (!match) |
367 return 0; | 325 return (0); |
368 } 369 370 if (rule->mbr_object.mbo_flags & MBO_GID_SUBJECT) { 371 match = (groupmember(vap->va_gid, cred) || 372 vap->va_gid == cred->cr_rgid || 373 vap->va_gid == cred->cr_svgid); | 326 } 327 328 if (rule->mbr_object.mbo_flags & MBO_GID_SUBJECT) { 329 match = (groupmember(vap->va_gid, cred) || 330 vap->va_gid == cred->cr_rgid || 331 vap->va_gid == cred->cr_svgid); |
374 | |
375 if (rule->mbr_object.mbo_neg & MBO_GID_SUBJECT) 376 match = !match; | 332 if (rule->mbr_object.mbo_neg & MBO_GID_SUBJECT) 333 match = !match; |
377 | |
378 if (!match) | 334 if (!match) |
379 return 0; | 335 return (0); |
380 } 381 382 if (rule->mbr_object.mbo_flags & MBO_TYPE_DEFINED) { 383 switch (vap->va_type) { 384 case VREG: 385 match = (rule->mbr_object.mbo_type & MBO_TYPE_REG); 386 break; 387 case VDIR: --- 12 unchanged lines hidden (view full) --- 400 match = (rule->mbr_object.mbo_type & MBO_TYPE_SOCK); 401 break; 402 case VFIFO: 403 match = (rule->mbr_object.mbo_type & MBO_TYPE_FIFO); 404 break; 405 default: 406 match = 0; 407 } | 336 } 337 338 if (rule->mbr_object.mbo_flags & MBO_TYPE_DEFINED) { 339 switch (vap->va_type) { 340 case VREG: 341 match = (rule->mbr_object.mbo_type & MBO_TYPE_REG); 342 break; 343 case VDIR: --- 12 unchanged lines hidden (view full) --- 356 match = (rule->mbr_object.mbo_type & MBO_TYPE_SOCK); 357 break; 358 case VFIFO: 359 match = (rule->mbr_object.mbo_type & MBO_TYPE_FIFO); 360 break; 361 default: 362 match = 0; 363 } |
408 | |
409 if (rule->mbr_object.mbo_neg & MBO_TYPE_DEFINED) 410 match = !match; | 364 if (rule->mbr_object.mbo_neg & MBO_TYPE_DEFINED) 365 match = !match; |
411 | |
412 if (!match) | 366 if (!match) |
413 return 0; | 367 return (0); |
414 } 415 416 /* 417 * Is the access permitted? 418 */ 419 if ((rule->mbr_mode & acc_mode) != acc_mode) { 420 if (mac_bsdextended_logging) 421 log(LOG_AUTHPRIV, "mac_bsdextended: %d:%d request %d" 422 " on %d:%d failed. \n", cred->cr_ruid, | 368 } 369 370 /* 371 * Is the access permitted? 372 */ 373 if ((rule->mbr_mode & acc_mode) != acc_mode) { 374 if (mac_bsdextended_logging) 375 log(LOG_AUTHPRIV, "mac_bsdextended: %d:%d request %d" 376 " on %d:%d failed. \n", cred->cr_ruid, |
423 cred->cr_rgid, acc_mode, vap->va_uid, vap->va_gid); 424 return (EACCES); /* Matching rule denies access */ | 377 cred->cr_rgid, acc_mode, vap->va_uid, 378 vap->va_gid); 379 return (EACCES); |
425 } 426 427 /* 428 * If the rule matched, permits access, and first match is enabled, 429 * return success. 430 */ 431 if (mac_bsdextended_firstmatch_enabled) 432 return (EJUSTRETURN); 433 else | 380 } 381 382 /* 383 * If the rule matched, permits access, and first match is enabled, 384 * return success. 385 */ 386 if (mac_bsdextended_firstmatch_enabled) 387 return (EJUSTRETURN); 388 else |
434 return(0); | 389 return (0); |
435} 436 437static int 438mac_bsdextended_check(struct ucred *cred, struct vnode *vp, struct vattr *vap, 439 int acc_mode) 440{ 441 int error, i; 442 443 /* | 390} 391 392static int 393mac_bsdextended_check(struct ucred *cred, struct vnode *vp, struct vattr *vap, 394 int acc_mode) 395{ 396 int error, i; 397 398 /* |
444 * XXXRW: More specific privilege selection needed? | 399 * XXXRW: More specific privilege selection needed. |
445 */ 446 if (suser_cred(cred, 0) == 0) 447 return (0); 448 449 /* 450 * Since we do not separately handle append, map append to write. 451 */ 452 if (acc_mode & MBI_APPEND) { 453 acc_mode &= ~MBI_APPEND; 454 acc_mode |= MBI_WRITE; 455 } | 400 */ 401 if (suser_cred(cred, 0) == 0) 402 return (0); 403 404 /* 405 * Since we do not separately handle append, map append to write. 406 */ 407 if (acc_mode & MBI_APPEND) { 408 acc_mode &= ~MBI_APPEND; 409 acc_mode |= MBI_WRITE; 410 } |
456 | |
457 mtx_lock(&mac_bsdextended_mtx); 458 for (i = 0; i < rule_slots; i++) { 459 if (rules[i] == NULL) 460 continue; | 411 mtx_lock(&mac_bsdextended_mtx); 412 for (i = 0; i < rule_slots; i++) { 413 if (rules[i] == NULL) 414 continue; |
461 | |
462 error = mac_bsdextended_rulecheck(rules[i], cred, 463 vp, vap, acc_mode); 464 if (error == EJUSTRETURN) 465 break; 466 if (error) { 467 mtx_unlock(&mac_bsdextended_mtx); 468 return (error); 469 } --- 5 unchanged lines hidden (view full) --- 475static int 476mac_bsdextended_check_vp(struct ucred *cred, struct vnode *vp, int acc_mode) 477{ 478 int error; 479 struct vattr vap; 480 481 if (!mac_bsdextended_enabled) 482 return (0); | 415 error = mac_bsdextended_rulecheck(rules[i], cred, 416 vp, vap, acc_mode); 417 if (error == EJUSTRETURN) 418 break; 419 if (error) { 420 mtx_unlock(&mac_bsdextended_mtx); 421 return (error); 422 } --- 5 unchanged lines hidden (view full) --- 428static int 429mac_bsdextended_check_vp(struct ucred *cred, struct vnode *vp, int acc_mode) 430{ 431 int error; 432 struct vattr vap; 433 434 if (!mac_bsdextended_enabled) 435 return (0); |
483 | |
484 error = VOP_GETATTR(vp, &vap, cred, curthread); 485 if (error) 486 return (error); | 436 error = VOP_GETATTR(vp, &vap, cred, curthread); 437 if (error) 438 return (error); |
487 | |
488 return (mac_bsdextended_check(cred, vp, &vap, acc_mode)); 489} 490 491static int 492mac_bsdextended_check_system_acct(struct ucred *cred, struct vnode *vp, 493 struct label *vplabel) 494{ 495 --- 61 unchanged lines hidden (view full) --- 557 struct label *dvplabel, struct vnode *vp, struct label *vplabel, 558 struct componentname *cnp) 559{ 560 int error; 561 562 error = mac_bsdextended_check_vp(cred, dvp, MBI_WRITE); 563 if (error) 564 return (error); | 439 return (mac_bsdextended_check(cred, vp, &vap, acc_mode)); 440} 441 442static int 443mac_bsdextended_check_system_acct(struct ucred *cred, struct vnode *vp, 444 struct label *vplabel) 445{ 446 --- 61 unchanged lines hidden (view full) --- 508 struct label *dvplabel, struct vnode *vp, struct label *vplabel, 509 struct componentname *cnp) 510{ 511 int error; 512 513 error = mac_bsdextended_check_vp(cred, dvp, MBI_WRITE); 514 if (error) 515 return (error); |
565 | |
566 return (mac_bsdextended_check_vp(cred, vp, MBI_WRITE)); 567} 568 569static int 570mac_bsdextended_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp, 571 struct label *vplabel, acl_type_t type) 572{ 573 --- 40 unchanged lines hidden (view full) --- 614 struct label *dvplabel, struct vnode *vp, struct label *label, 615 struct componentname *cnp) 616{ 617 int error; 618 619 error = mac_bsdextended_check_vp(cred, dvp, MBI_WRITE); 620 if (error) 621 return (error); | 516 return (mac_bsdextended_check_vp(cred, vp, MBI_WRITE)); 517} 518 519static int 520mac_bsdextended_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp, 521 struct label *vplabel, acl_type_t type) 522{ 523 --- 40 unchanged lines hidden (view full) --- 564 struct label *dvplabel, struct vnode *vp, struct label *label, 565 struct componentname *cnp) 566{ 567 int error; 568 569 error = mac_bsdextended_check_vp(cred, dvp, MBI_WRITE); 570 if (error) 571 return (error); |
622 | |
623 error = mac_bsdextended_check_vp(cred, vp, MBI_WRITE); 624 if (error) 625 return (error); 626 return (0); 627} 628 629static int 630mac_bsdextended_check_vnode_listextattr(struct ucred *cred, struct vnode *vp, --- 40 unchanged lines hidden (view full) --- 671 struct label *dvplabel, struct vnode *vp, struct label *vplabel, 672 struct componentname *cnp) 673{ 674 int error; 675 676 error = mac_bsdextended_check_vp(cred, dvp, MBI_WRITE); 677 if (error) 678 return (error); | 572 error = mac_bsdextended_check_vp(cred, vp, MBI_WRITE); 573 if (error) 574 return (error); 575 return (0); 576} 577 578static int 579mac_bsdextended_check_vnode_listextattr(struct ucred *cred, struct vnode *vp, --- 40 unchanged lines hidden (view full) --- 620 struct label *dvplabel, struct vnode *vp, struct label *vplabel, 621 struct componentname *cnp) 622{ 623 int error; 624 625 error = mac_bsdextended_check_vp(cred, dvp, MBI_WRITE); 626 if (error) 627 return (error); |
679 error = mac_bsdextended_check_vp(cred, vp, MBI_WRITE); 680 681 return (error); | 628 return (mac_bsdextended_check_vp(cred, vp, MBI_WRITE)); |
682} 683 684static int 685mac_bsdextended_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp, 686 struct label *dvplabel, struct vnode *vp, struct label *vplabel, 687 int samedir, struct componentname *cnp) 688{ 689 int error; 690 691 error = mac_bsdextended_check_vp(cred, dvp, MBI_WRITE); 692 if (error) 693 return (error); | 629} 630 631static int 632mac_bsdextended_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp, 633 struct label *dvplabel, struct vnode *vp, struct label *vplabel, 634 int samedir, struct componentname *cnp) 635{ 636 int error; 637 638 error = mac_bsdextended_check_vp(cred, dvp, MBI_WRITE); 639 if (error) 640 return (error); |
694 | |
695 if (vp != NULL) 696 error = mac_bsdextended_check_vp(cred, vp, MBI_WRITE); | 641 if (vp != NULL) 642 error = mac_bsdextended_check_vp(cred, vp, MBI_WRITE); |
697 | |
698 return (error); 699} 700 701static int 702mac_bsdextended_check_vnode_revoke(struct ucred *cred, struct vnode *vp, 703 struct label *vplabel) 704{ 705 --- 98 unchanged lines hidden --- | 643 return (error); 644} 645 646static int 647mac_bsdextended_check_vnode_revoke(struct ucred *cred, struct vnode *vp, 648 struct label *vplabel) 649{ 650 --- 98 unchanged lines hidden --- |