mac_lomac.c (173108) | mac_lomac.c (173138) |
---|---|
1/*- 2 * Copyright (c) 1999-2002, 2007 Robert N. M. Watson 3 * Copyright (c) 2001-2005 Networks Associates Technology, Inc. 4 * Copyright (c) 2006 SPARTA, Inc. 5 * All rights reserved. 6 * 7 * This software was developed by Robert Watson for the TrustedBSD Project. 8 * --- 21 unchanged lines hidden (view full) --- 30 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 31 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 32 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 33 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 34 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 35 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 36 * SUCH DAMAGE. 37 * | 1/*- 2 * Copyright (c) 1999-2002, 2007 Robert N. M. Watson 3 * Copyright (c) 2001-2005 Networks Associates Technology, Inc. 4 * Copyright (c) 2006 SPARTA, Inc. 5 * All rights reserved. 6 * 7 * This software was developed by Robert Watson for the TrustedBSD Project. 8 * --- 21 unchanged lines hidden (view full) --- 30 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 31 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 32 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 33 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 34 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 35 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 36 * SUCH DAMAGE. 37 * |
38 * $FreeBSD: head/sys/security/mac_lomac/mac_lomac.c 173108 2007-10-28 17:55:57Z rwatson $ | 38 * $FreeBSD: head/sys/security/mac_lomac/mac_lomac.c 173138 2007-10-29 13:33:06Z rwatson $ |
39 */ 40 41/* 42 * Developed by the TrustedBSD Project. 43 * 44 * Low-watermark floating label mandatory integrity policy. 45 */ 46 --- 579 unchanged lines hidden (view full) --- 626 SLOT_SET(label, lomac_alloc(flag)); 627 if (SLOT(label) == NULL) 628 return (ENOMEM); 629 630 return (0); 631} 632 633static void | 39 */ 40 41/* 42 * Developed by the TrustedBSD Project. 43 * 44 * Low-watermark floating label mandatory integrity policy. 45 */ 46 --- 579 unchanged lines hidden (view full) --- 626 SLOT_SET(label, lomac_alloc(flag)); 627 if (SLOT(label) == NULL) 628 return (ENOMEM); 629 630 return (0); 631} 632 633static void |
634lomac_proc_init_label(struct label *label) 635{ 636 637 PSLOT_SET(label, malloc(sizeof(struct mac_lomac_proc), M_LOMAC, 638 M_ZERO | M_WAITOK)); 639 mtx_init(&PSLOT(label)->mtx, "MAC/Lomac proc lock", NULL, MTX_DEF); 640} 641 642static void | |
643lomac_destroy_label(struct label *label) 644{ 645 646 lomac_free(SLOT(label)); 647 SLOT_SET(label, NULL); 648} 649 | 634lomac_destroy_label(struct label *label) 635{ 636 637 lomac_free(SLOT(label)); 638 SLOT_SET(label, NULL); 639} 640 |
650static void 651lomac_proc_destroy_label(struct label *label) 652{ 653 654 mtx_destroy(&PSLOT(label)->mtx); 655 FREE(PSLOT(label), M_LOMAC); 656 PSLOT_SET(label, NULL); 657} 658 | |
659static int 660lomac_element_to_string(struct sbuf *sb, struct mac_lomac_element *element) 661{ 662 663 switch (element->mle_type) { 664 case MAC_LOMAC_TYPE_HIGH: 665 return (sbuf_printf(sb, "high")); 666 --- 217 unchanged lines hidden (view full) --- 884static void 885lomac_copy_label(struct label *src, struct label *dest) 886{ 887 888 *SLOT(dest) = *SLOT(src); 889} 890 891/* | 641static int 642lomac_element_to_string(struct sbuf *sb, struct mac_lomac_element *element) 643{ 644 645 switch (element->mle_type) { 646 case MAC_LOMAC_TYPE_HIGH: 647 return (sbuf_printf(sb, "high")); 648 --- 217 unchanged lines hidden (view full) --- 866static void 867lomac_copy_label(struct label *src, struct label *dest) 868{ 869 870 *SLOT(dest) = *SLOT(src); 871} 872 873/* |
892 * Labeling event operations: file system objects, and things that look a lot 893 * like file system objects. | 874 * Object-specific entry point implementations are sorted alphabetically by 875 * object type name and then by operation. |
894 */ | 876 */ |
895static void 896lomac_devfs_create_device(struct ucred *cred, struct mount *mp, 897 struct cdev *dev, struct devfs_dirent *de, struct label *delabel) | 877static int 878lomac_bpfdesc_check_receive(struct bpf_d *d, struct label *dlabel, 879 struct ifnet *ifp, struct label *ifplabel) |
898{ | 880{ |
899 struct mac_lomac *ml; 900 int lomac_type; | 881 struct mac_lomac *a, *b; |
901 | 882 |
902 ml = SLOT(delabel); 903 if (strcmp(dev->si_name, "null") == 0 || 904 strcmp(dev->si_name, "zero") == 0 || 905 strcmp(dev->si_name, "random") == 0 || 906 strncmp(dev->si_name, "fd/", strlen("fd/")) == 0 || 907 strncmp(dev->si_name, "ttyv", strlen("ttyv")) == 0) 908 lomac_type = MAC_LOMAC_TYPE_EQUAL; 909 else if (ptys_equal && 910 (strncmp(dev->si_name, "ttyp", strlen("ttyp")) == 0 || 911 strncmp(dev->si_name, "ptyp", strlen("ptyp")) == 0)) 912 lomac_type = MAC_LOMAC_TYPE_EQUAL; 913 else 914 lomac_type = MAC_LOMAC_TYPE_HIGH; 915 lomac_set_single(ml, lomac_type, 0); 916} | 883 if (!lomac_enabled) 884 return (0); |
917 | 885 |
918static void 919lomac_devfs_create_directory(struct mount *mp, char *dirname, int dirnamelen, 920 struct devfs_dirent *de, struct label *delabel) 921{ 922 struct mac_lomac *ml; | 886 a = SLOT(dlabel); 887 b = SLOT(ifplabel); |
923 | 888 |
924 ml = SLOT(delabel); 925 lomac_set_single(ml, MAC_LOMAC_TYPE_HIGH, 0); | 889 if (lomac_equal_single(a, b)) 890 return (0); 891 return (EACCES); |
926} 927 928static void | 892} 893 894static void |
929lomac_devfs_create_symlink(struct ucred *cred, struct mount *mp, 930 struct devfs_dirent *dd, struct label *ddlabel, struct devfs_dirent *de, 931 struct label *delabel) | 895lomac_bpfdesc_create(struct ucred *cred, struct bpf_d *d, 896 struct label *dlabel) |
932{ 933 struct mac_lomac *source, *dest; 934 935 source = SLOT(cred->cr_label); | 897{ 898 struct mac_lomac *source, *dest; 899 900 source = SLOT(cred->cr_label); |
936 dest = SLOT(delabel); | 901 dest = SLOT(dlabel); |
937 938 lomac_copy_single(source, dest); 939} 940 941static void | 902 903 lomac_copy_single(source, dest); 904} 905 906static void |
942lomac_mount_create(struct ucred *cred, struct mount *mp, 943 struct label *mplabel) | 907lomac_bpfdesc_create_mbuf(struct bpf_d *d, struct label *dlabel, 908 struct mbuf *m, struct label *mlabel) |
944{ 945 struct mac_lomac *source, *dest; 946 | 909{ 910 struct mac_lomac *source, *dest; 911 |
947 source = SLOT(cred->cr_label); 948 dest = SLOT(mplabel); 949 lomac_copy_single(source, dest); 950} | 912 source = SLOT(dlabel); 913 dest = SLOT(mlabel); |
951 | 914 |
952static void 953lomac_vnode_relabel(struct ucred *cred, struct vnode *vp, 954 struct label *vplabel, struct label *newlabel) 955{ 956 struct mac_lomac *source, *dest; 957 958 source = SLOT(newlabel); 959 dest = SLOT(vplabel); 960 961 try_relabel(source, dest); 962} 963 964static void 965lomac_devfs_update(struct mount *mp, struct devfs_dirent *de, 966 struct label *delabel, struct vnode *vp, struct label *vplabel) 967{ 968 struct mac_lomac *source, *dest; 969 970 source = SLOT(vplabel); 971 dest = SLOT(delabel); 972 973 lomac_copy(source, dest); 974} 975 976static void 977lomac_devfs_vnode_associate(struct mount *mp, struct label *mplabel, 978 struct devfs_dirent *de, struct label *delabel, struct vnode *vp, 979 struct label *vplabel) 980{ 981 struct mac_lomac *source, *dest; 982 983 source = SLOT(delabel); 984 dest = SLOT(vplabel); 985 | |
986 lomac_copy_single(source, dest); 987} 988 989static int | 915 lomac_copy_single(source, dest); 916} 917 918static int |
990lomac_vnode_associate_extattr(struct mount *mp, struct label *mplabel, 991 struct vnode *vp, struct label *vplabel) | 919lomac_cred_check_relabel(struct ucred *cred, struct label *newlabel) |
992{ | 920{ |
993 struct mac_lomac ml_temp, *source, *dest; 994 int buflen, error; | 921 struct mac_lomac *subj, *new; 922 int error; |
995 | 923 |
996 source = SLOT(mplabel); 997 dest = SLOT(vplabel); | 924 subj = SLOT(cred->cr_label); 925 new = SLOT(newlabel); |
998 | 926 |
999 buflen = sizeof(ml_temp); 1000 bzero(&ml_temp, buflen); 1001 1002 error = vn_extattr_get(vp, IO_NODELOCKED, MAC_LOMAC_EXTATTR_NAMESPACE, 1003 MAC_LOMAC_EXTATTR_NAME, &buflen, (char *)&ml_temp, curthread); 1004 if (error == ENOATTR || error == EOPNOTSUPP) { 1005 /* Fall back to the mntlabel. */ 1006 lomac_copy_single(source, dest); 1007 return (0); 1008 } else if (error) | 927 /* 928 * If there is a LOMAC label update for the credential, it may be an 929 * update of the single, range, or both. 930 */ 931 error = lomac_atmostflags(new, MAC_LOMAC_FLAGS_BOTH); 932 if (error) |
1009 return (error); 1010 | 933 return (error); 934 |
1011 if (buflen != sizeof(ml_temp)) { 1012 if (buflen != sizeof(ml_temp) - sizeof(ml_temp.ml_auxsingle)) { 1013 printf("lomac_vnode_associate_extattr: bad size %d\n", 1014 buflen); | 935 /* 936 * If the LOMAC label is to be changed, authorize as appropriate. 937 */ 938 if (new->ml_flags & MAC_LOMAC_FLAGS_BOTH) { 939 /* 940 * Fill in the missing parts from the previous label. 941 */ 942 if ((new->ml_flags & MAC_LOMAC_FLAG_SINGLE) == 0) 943 lomac_copy_single(subj, new); 944 if ((new->ml_flags & MAC_LOMAC_FLAG_RANGE) == 0) 945 lomac_copy_range(subj, new); 946 947 /* 948 * To change the LOMAC range on a credential, the new range 949 * label must be in the current range. 950 */ 951 if (!lomac_range_in_range(new, subj)) |
1015 return (EPERM); | 952 return (EPERM); |
1016 } 1017 bzero(&ml_temp.ml_auxsingle, sizeof(ml_temp.ml_auxsingle)); 1018 buflen = sizeof(ml_temp); 1019 (void)vn_extattr_set(vp, IO_NODELOCKED, 1020 MAC_LOMAC_EXTATTR_NAMESPACE, MAC_LOMAC_EXTATTR_NAME, 1021 buflen, (char *)&ml_temp, curthread); 1022 } 1023 if (lomac_valid(&ml_temp) != 0) { 1024 printf("lomac_vnode_associate_extattr: invalid\n"); 1025 return (EPERM); 1026 } 1027 if ((ml_temp.ml_flags & MAC_LOMAC_FLAGS_BOTH) != 1028 MAC_LOMAC_FLAG_SINGLE) { 1029 printf("lomac_vnode_associate_extattr: not single\n"); 1030 return (EPERM); 1031 } | |
1032 | 953 |
1033 lomac_copy_single(&ml_temp, dest); 1034 return (0); 1035} | 954 /* 955 * To change the LOMAC single label on a credential, the new 956 * single label must be in the new range. Implicitly from 957 * the previous check, the new single is in the old range. 958 */ 959 if (!lomac_single_in_range(new, new)) 960 return (EPERM); |
1036 | 961 |
1037static void 1038lomac_vnode_associate_singlelabel(struct mount *mp, struct label *mplabel, 1039 struct vnode *vp, struct label *vplabel) 1040{ 1041 struct mac_lomac *source, *dest; | 962 /* 963 * To have EQUAL in any component of the new credential LOMAC 964 * label, the subject must already have EQUAL in their label. 965 */ 966 if (lomac_contains_equal(new)) { 967 error = lomac_subject_privileged(subj); 968 if (error) 969 return (error); 970 } |
1042 | 971 |
1043 source = SLOT(mplabel); 1044 dest = SLOT(vplabel); 1045 1046 lomac_copy_single(source, dest); 1047} 1048 1049static int 1050lomac_vnode_create_extattr(struct ucred *cred, struct mount *mp, 1051 struct label *mplabel, struct vnode *dvp, struct label *dvplabel, 1052 struct vnode *vp, struct label *vplabel, struct componentname *cnp) 1053{ 1054 struct mac_lomac *source, *dest, *dir, temp; 1055 size_t buflen; 1056 int error; 1057 1058 buflen = sizeof(temp); 1059 bzero(&temp, buflen); 1060 1061 source = SLOT(cred->cr_label); 1062 dest = SLOT(vplabel); 1063 dir = SLOT(dvplabel); 1064 if (dir->ml_flags & MAC_LOMAC_FLAG_AUX) { 1065 lomac_copy_auxsingle(dir, &temp); 1066 lomac_set_single(&temp, dir->ml_auxsingle.mle_type, 1067 dir->ml_auxsingle.mle_grade); 1068 } else { 1069 lomac_copy_single(source, &temp); | 972 /* 973 * XXXMAC: Additional consistency tests regarding the single 974 * and range of the new label might be performed here. 975 */ |
1070 } 1071 | 976 } 977 |
1072 error = vn_extattr_set(vp, IO_NODELOCKED, MAC_LOMAC_EXTATTR_NAMESPACE, 1073 MAC_LOMAC_EXTATTR_NAME, buflen, (char *)&temp, curthread); 1074 if (error == 0) 1075 lomac_copy(&temp, dest); 1076 return (error); | 978 return (0); |
1077} 1078 1079static int | 979} 980 981static int |
1080lomac_vnode_setlabel_extattr(struct ucred *cred, struct vnode *vp, 1081 struct label *vplabel, struct label *intlabel) | 982lomac_cred_check_visible(struct ucred *cr1, struct ucred *cr2) |
1082{ | 983{ |
1083 struct mac_lomac *source, temp; 1084 size_t buflen; 1085 int error; | 984 struct mac_lomac *subj, *obj; |
1086 | 985 |
1087 buflen = sizeof(temp); 1088 bzero(&temp, buflen); 1089 1090 source = SLOT(intlabel); 1091 if ((source->ml_flags & MAC_LOMAC_FLAG_SINGLE) == 0) | 986 if (!lomac_enabled) |
1092 return (0); 1093 | 987 return (0); 988 |
1094 lomac_copy_single(source, &temp); 1095 error = vn_extattr_set(vp, IO_NODELOCKED, MAC_LOMAC_EXTATTR_NAMESPACE, 1096 MAC_LOMAC_EXTATTR_NAME, buflen, (char *)&temp, curthread); 1097 return (error); 1098} | 989 subj = SLOT(cr1->cr_label); 990 obj = SLOT(cr2->cr_label); |
1099 | 991 |
1100/* 1101 * Labeling event operations: IPC object. 1102 */ | 992 /* XXX: range */ 993 if (!lomac_dominate_single(obj, subj)) 994 return (ESRCH); 995 996 return (0); 997} |
1103static void | 998static void |
1104lomac_inpcb_create(struct socket *so, struct label *solabel, 1105 struct inpcb *inp, struct label *inplabel) | 999lomac_cred_relabel(struct ucred *cred, struct label *newlabel) |
1106{ 1107 struct mac_lomac *source, *dest; 1108 | 1000{ 1001 struct mac_lomac *source, *dest; 1002 |
1109 source = SLOT(solabel); 1110 dest = SLOT(inplabel); | 1003 source = SLOT(newlabel); 1004 dest = SLOT(cred->cr_label); |
1111 | 1005 |
1112 lomac_copy_single(source, dest); | 1006 try_relabel(source, dest); |
1113} 1114 1115static void | 1007} 1008 1009static void |
1116lomac_socket_create_mbuf(struct socket *so, struct label *solabel, 1117 struct mbuf *m, struct label *mlabel) | 1010lomac_devfs_create_device(struct ucred *cred, struct mount *mp, 1011 struct cdev *dev, struct devfs_dirent *de, struct label *delabel) |
1118{ | 1012{ |
1119 struct mac_lomac *source, *dest; | 1013 struct mac_lomac *ml; 1014 int lomac_type; |
1120 | 1015 |
1121 source = SLOT(solabel); 1122 dest = SLOT(mlabel); 1123 1124 lomac_copy_single(source, dest); | 1016 ml = SLOT(delabel); 1017 if (strcmp(dev->si_name, "null") == 0 || 1018 strcmp(dev->si_name, "zero") == 0 || 1019 strcmp(dev->si_name, "random") == 0 || 1020 strncmp(dev->si_name, "fd/", strlen("fd/")) == 0 || 1021 strncmp(dev->si_name, "ttyv", strlen("ttyv")) == 0) 1022 lomac_type = MAC_LOMAC_TYPE_EQUAL; 1023 else if (ptys_equal && 1024 (strncmp(dev->si_name, "ttyp", strlen("ttyp")) == 0 || 1025 strncmp(dev->si_name, "ptyp", strlen("ptyp")) == 0)) 1026 lomac_type = MAC_LOMAC_TYPE_EQUAL; 1027 else 1028 lomac_type = MAC_LOMAC_TYPE_HIGH; 1029 lomac_set_single(ml, lomac_type, 0); |
1125} 1126 1127static void | 1030} 1031 1032static void |
1128lomac_socket_create(struct ucred *cred, struct socket *so, 1129 struct label *solabel) | 1033lomac_devfs_create_directory(struct mount *mp, char *dirname, int dirnamelen, 1034 struct devfs_dirent *de, struct label *delabel) |
1130{ | 1035{ |
1131 struct mac_lomac *source, *dest; | 1036 struct mac_lomac *ml; |
1132 | 1037 |
1133 source = SLOT(cred->cr_label); 1134 dest = SLOT(solabel); 1135 1136 lomac_copy_single(source, dest); | 1038 ml = SLOT(delabel); 1039 lomac_set_single(ml, MAC_LOMAC_TYPE_HIGH, 0); |
1137} 1138 1139static void | 1040} 1041 1042static void |
1140lomac_pipe_create(struct ucred *cred, struct pipepair *pp, 1141 struct label *pplabel) | 1043lomac_devfs_create_symlink(struct ucred *cred, struct mount *mp, 1044 struct devfs_dirent *dd, struct label *ddlabel, struct devfs_dirent *de, 1045 struct label *delabel) |
1142{ 1143 struct mac_lomac *source, *dest; 1144 1145 source = SLOT(cred->cr_label); | 1046{ 1047 struct mac_lomac *source, *dest; 1048 1049 source = SLOT(cred->cr_label); |
1146 dest = SLOT(pplabel); | 1050 dest = SLOT(delabel); |
1147 1148 lomac_copy_single(source, dest); 1149} 1150 1151static void | 1051 1052 lomac_copy_single(source, dest); 1053} 1054 1055static void |
1152lomac_socket_newconn(struct socket *oldso, struct label *oldsolabel, 1153 struct socket *newso, struct label *newsolabel) | 1056lomac_devfs_update(struct mount *mp, struct devfs_dirent *de, 1057 struct label *delabel, struct vnode *vp, struct label *vplabel) |
1154{ 1155 struct mac_lomac *source, *dest; 1156 | 1058{ 1059 struct mac_lomac *source, *dest; 1060 |
1157 source = SLOT(oldsolabel); 1158 dest = SLOT(newsolabel); | 1061 source = SLOT(vplabel); 1062 dest = SLOT(delabel); |
1159 | 1063 |
1160 lomac_copy_single(source, dest); | 1064 lomac_copy(source, dest); |
1161} 1162 1163static void | 1065} 1066 1067static void |
1164lomac_socket_relabel(struct ucred *cred, struct socket *so, 1165 struct label *solabel, struct label *newlabel) | 1068lomac_devfs_vnode_associate(struct mount *mp, struct label *mplabel, 1069 struct devfs_dirent *de, struct label *delabel, struct vnode *vp, 1070 struct label *vplabel) |
1166{ 1167 struct mac_lomac *source, *dest; 1168 | 1071{ 1072 struct mac_lomac *source, *dest; 1073 |
1169 source = SLOT(newlabel); 1170 dest = SLOT(solabel); | 1074 source = SLOT(delabel); 1075 dest = SLOT(vplabel); |
1171 | 1076 |
1172 try_relabel(source, dest); | 1077 lomac_copy_single(source, dest); |
1173} 1174 | 1078} 1079 |
1175static void 1176lomac_pipe_relabel(struct ucred *cred, struct pipepair *pp, 1177 struct label *pplabel, struct label *newlabel) | 1080static int 1081lomac_ifnet_check_relabel(struct ucred *cred, struct ifnet *ifp, 1082 struct label *ifplabel, struct label *newlabel) |
1178{ | 1083{ |
1179 struct mac_lomac *source, *dest; | 1084 struct mac_lomac *subj, *new; 1085 int error; |
1180 | 1086 |
1181 source = SLOT(newlabel); 1182 dest = SLOT(pplabel); | 1087 subj = SLOT(cred->cr_label); 1088 new = SLOT(newlabel); |
1183 | 1089 |
1184 try_relabel(source, dest); 1185} | 1090 /* 1091 * If there is a LOMAC label update for the interface, it may be an 1092 * update of the single, range, or both. 1093 */ 1094 error = lomac_atmostflags(new, MAC_LOMAC_FLAGS_BOTH); 1095 if (error) 1096 return (error); |
1186 | 1097 |
1187static void 1188lomac_socketpeer_set_from_mbuf(struct mbuf *m, struct label *mlabel, 1189 struct socket *so, struct label *sopeerlabel) 1190{ 1191 struct mac_lomac *source, *dest; | 1098 /* 1099 * Relabling network interfaces requires LOMAC privilege. 1100 */ 1101 error = lomac_subject_privileged(subj); 1102 if (error) 1103 return (error); |
1192 | 1104 |
1193 source = SLOT(mlabel); 1194 dest = SLOT(sopeerlabel); | 1105 /* 1106 * If the LOMAC label is to be changed, authorize as appropriate. 1107 */ 1108 if (new->ml_flags & MAC_LOMAC_FLAGS_BOTH) { 1109 /* 1110 * Fill in the missing parts from the previous label. 1111 */ 1112 if ((new->ml_flags & MAC_LOMAC_FLAG_SINGLE) == 0) 1113 lomac_copy_single(subj, new); 1114 if ((new->ml_flags & MAC_LOMAC_FLAG_RANGE) == 0) 1115 lomac_copy_range(subj, new); |
1195 | 1116 |
1196 lomac_copy_single(source, dest); 1197} | 1117 /* 1118 * Rely on the traditional superuser status for the LOMAC 1119 * interface relabel requirements. XXXMAC: This will go 1120 * away. 1121 * 1122 * XXXRW: This is also redundant to a higher layer check. 1123 */ 1124 error = priv_check_cred(cred, PRIV_NET_SETIFMAC, 0); 1125 if (error) 1126 return (EPERM); |
1198 | 1127 |
1199/* 1200 * Labeling event operations: network objects. 1201 */ 1202static void 1203lomac_socketpeer_set_from_socket(struct socket *oldso, 1204 struct label *oldsolabel, struct socket *newso, 1205 struct label *newsopeerlabel) 1206{ 1207 struct mac_lomac *source, *dest; | 1128 /* 1129 * XXXMAC: Additional consistency tests regarding the single 1130 * and the range of the new label might be performed here. 1131 */ 1132 } |
1208 | 1133 |
1209 source = SLOT(oldsolabel); 1210 dest = SLOT(newsopeerlabel); 1211 1212 lomac_copy_single(source, dest); | 1134 return (0); |
1213} 1214 | 1135} 1136 |
1215static void 1216lomac_bpfdesc_create(struct ucred *cred, struct bpf_d *d, 1217 struct label *dlabel) | 1137static int 1138lomac_ifnet_check_transmit(struct ifnet *ifp, struct label *ifplabel, 1139 struct mbuf *m, struct label *mlabel) |
1218{ | 1140{ |
1219 struct mac_lomac *source, *dest; | 1141 struct mac_lomac *p, *i; |
1220 | 1142 |
1221 source = SLOT(cred->cr_label); 1222 dest = SLOT(dlabel); | 1143 if (!lomac_enabled) 1144 return (0); |
1223 | 1145 |
1224 lomac_copy_single(source, dest); | 1146 p = SLOT(mlabel); 1147 i = SLOT(ifplabel); 1148 1149 return (lomac_single_in_range(p, i) ? 0 : EACCES); |
1225} 1226 1227static void 1228lomac_ifnet_create(struct ifnet *ifp, struct label *ifplabel) 1229{ 1230 char tifname[IFNAMSIZ], *p, *q; 1231 char tiflist[sizeof(trusted_interfaces)]; 1232 struct mac_lomac *dest; --- 45 unchanged lines hidden (view full) --- 1278 } 1279 } 1280set: 1281 lomac_set_single(dest, grade, 0); 1282 lomac_set_range(dest, grade, 0, grade, 0); 1283} 1284 1285static void | 1150} 1151 1152static void 1153lomac_ifnet_create(struct ifnet *ifp, struct label *ifplabel) 1154{ 1155 char tifname[IFNAMSIZ], *p, *q; 1156 char tiflist[sizeof(trusted_interfaces)]; 1157 struct mac_lomac *dest; --- 45 unchanged lines hidden (view full) --- 1203 } 1204 } 1205set: 1206 lomac_set_single(dest, grade, 0); 1207 lomac_set_range(dest, grade, 0, grade, 0); 1208} 1209 1210static void |
1286lomac_ipq_create(struct mbuf *m, struct label *mlabel, struct ipq *ipq, 1287 struct label *ipqlabel) | 1211lomac_ifnet_create_mbuf(struct ifnet *ifp, struct label *ifplabel, 1212 struct mbuf *m, struct label *mlabel) |
1288{ 1289 struct mac_lomac *source, *dest; 1290 | 1213{ 1214 struct mac_lomac *source, *dest; 1215 |
1291 source = SLOT(mlabel); 1292 dest = SLOT(ipqlabel); | 1216 source = SLOT(ifplabel); 1217 dest = SLOT(mlabel); |
1293 1294 lomac_copy_single(source, dest); 1295} 1296 1297static void | 1218 1219 lomac_copy_single(source, dest); 1220} 1221 1222static void |
1298lomac_ipq_reassemble(struct ipq *ipq, struct label *ipqlabel, 1299 struct mbuf *m, struct label *mlabel) | 1223lomac_ifnet_relabel(struct ucred *cred, struct ifnet *ifp, 1224 struct label *ifplabel, struct label *newlabel) |
1300{ 1301 struct mac_lomac *source, *dest; 1302 | 1225{ 1226 struct mac_lomac *source, *dest; 1227 |
1303 source = SLOT(ipqlabel); 1304 dest = SLOT(mlabel); | 1228 source = SLOT(newlabel); 1229 dest = SLOT(ifplabel); |
1305 | 1230 |
1306 /* Just use the head, since we require them all to match. */ 1307 lomac_copy_single(source, dest); | 1231 try_relabel(source, dest); |
1308} 1309 | 1232} 1233 |
1234static int 1235lomac_inpcb_check_deliver(struct inpcb *inp, struct label *inplabel, 1236 struct mbuf *m, struct label *mlabel) 1237{ 1238 struct mac_lomac *p, *i; 1239 1240 if (!lomac_enabled) 1241 return (0); 1242 1243 p = SLOT(mlabel); 1244 i = SLOT(inplabel); 1245 1246 return (lomac_equal_single(p, i) ? 0 : EACCES); 1247} 1248 |
|
1310static void | 1249static void |
1311lomac_netinet_fragment(struct mbuf *m, struct label *mlabel, 1312 struct mbuf *frag, struct label *fraglabel) | 1250lomac_inpcb_create(struct socket *so, struct label *solabel, 1251 struct inpcb *inp, struct label *inplabel) |
1313{ 1314 struct mac_lomac *source, *dest; 1315 | 1252{ 1253 struct mac_lomac *source, *dest; 1254 |
1316 source = SLOT(mlabel); 1317 dest = SLOT(fraglabel); | 1255 source = SLOT(solabel); 1256 dest = SLOT(inplabel); |
1318 1319 lomac_copy_single(source, dest); 1320} 1321 1322static void 1323lomac_inpcb_create_mbuf(struct inpcb *inp, struct label *inplabel, 1324 struct mbuf *m, struct label *mlabel) 1325{ 1326 struct mac_lomac *source, *dest; 1327 1328 source = SLOT(inplabel); 1329 dest = SLOT(mlabel); 1330 1331 lomac_copy_single(source, dest); 1332} 1333 1334static void | 1257 1258 lomac_copy_single(source, dest); 1259} 1260 1261static void 1262lomac_inpcb_create_mbuf(struct inpcb *inp, struct label *inplabel, 1263 struct mbuf *m, struct label *mlabel) 1264{ 1265 struct mac_lomac *source, *dest; 1266 1267 source = SLOT(inplabel); 1268 dest = SLOT(mlabel); 1269 1270 lomac_copy_single(source, dest); 1271} 1272 1273static void |
1335lomac_bpfdesc_create_mbuf(struct bpf_d *d, struct label *dlabel, 1336 struct mbuf *m, struct label *mlabel) | 1274lomac_inpcb_sosetlabel(struct socket *so, struct label *solabel, 1275 struct inpcb *inp, struct label *inplabel) |
1337{ 1338 struct mac_lomac *source, *dest; 1339 | 1276{ 1277 struct mac_lomac *source, *dest; 1278 |
1340 source = SLOT(dlabel); 1341 dest = SLOT(mlabel); | 1279 source = SLOT(solabel); 1280 dest = SLOT(inplabel); |
1342 1343 lomac_copy_single(source, dest); 1344} 1345 1346static void | 1281 1282 lomac_copy_single(source, dest); 1283} 1284 1285static void |
1347lomac_ifnet_create_mbuf(struct ifnet *ifp, struct label *ifplabel, 1348 struct mbuf *m, struct label *mlabel) | 1286lomac_ipq_create(struct mbuf *m, struct label *mlabel, struct ipq *ipq, 1287 struct label *ipqlabel) |
1349{ 1350 struct mac_lomac *source, *dest; 1351 | 1288{ 1289 struct mac_lomac *source, *dest; 1290 |
1352 source = SLOT(ifplabel); 1353 dest = SLOT(mlabel); | 1291 source = SLOT(mlabel); 1292 dest = SLOT(ipqlabel); |
1354 1355 lomac_copy_single(source, dest); 1356} 1357 1358static int 1359lomac_ipq_match(struct mbuf *m, struct label *mlabel, struct ipq *ipq, 1360 struct label *ipqlabel) 1361{ 1362 struct mac_lomac *a, *b; 1363 1364 a = SLOT(ipqlabel); 1365 b = SLOT(mlabel); 1366 1367 return (lomac_equal_single(a, b)); 1368} 1369 1370static void | 1293 1294 lomac_copy_single(source, dest); 1295} 1296 1297static int 1298lomac_ipq_match(struct mbuf *m, struct label *mlabel, struct ipq *ipq, 1299 struct label *ipqlabel) 1300{ 1301 struct mac_lomac *a, *b; 1302 1303 a = SLOT(ipqlabel); 1304 b = SLOT(mlabel); 1305 1306 return (lomac_equal_single(a, b)); 1307} 1308 1309static void |
1371lomac_ifnet_relabel(struct ucred *cred, struct ifnet *ifp, 1372 struct label *ifplabel, struct label *newlabel) | 1310lomac_ipq_reassemble(struct ipq *ipq, struct label *ipqlabel, 1311 struct mbuf *m, struct label *mlabel) |
1373{ 1374 struct mac_lomac *source, *dest; 1375 | 1312{ 1313 struct mac_lomac *source, *dest; 1314 |
1376 source = SLOT(newlabel); 1377 dest = SLOT(ifplabel); | 1315 source = SLOT(ipqlabel); 1316 dest = SLOT(mlabel); |
1378 | 1317 |
1379 try_relabel(source, dest); | 1318 /* Just use the head, since we require them all to match. */ 1319 lomac_copy_single(source, dest); |
1380} 1381 1382static void 1383lomac_ipq_update(struct mbuf *m, struct label *mlabel, struct ipq *ipq, 1384 struct label *ipqlabel) 1385{ 1386 1387 /* NOOP: we only accept matching labels, so no need to update */ 1388} 1389 | 1320} 1321 1322static void 1323lomac_ipq_update(struct mbuf *m, struct label *mlabel, struct ipq *ipq, 1324 struct label *ipqlabel) 1325{ 1326 1327 /* NOOP: we only accept matching labels, so no need to update */ 1328} 1329 |
1390static void 1391lomac_inpcb_sosetlabel(struct socket *so, struct label *solabel, 1392 struct inpcb *inp, struct label *inplabel) | 1330static int 1331lomac_kld_check_load(struct ucred *cred, struct vnode *vp, 1332 struct label *vplabel) |
1393{ | 1333{ |
1394 struct mac_lomac *source, *dest; | 1334 struct mac_lomac *subj, *obj; |
1395 | 1335 |
1396 source = SLOT(solabel); 1397 dest = SLOT(inplabel); | 1336 if (!lomac_enabled) 1337 return (0); |
1398 | 1338 |
1399 lomac_copy_single(source, dest); 1400} | 1339 subj = SLOT(cred->cr_label); 1340 obj = SLOT(vplabel); |
1401 | 1341 |
1402static void 1403lomac_syncache_create(struct label *label, struct inpcb *inp) 1404{ 1405 struct mac_lomac *source, *dest; | 1342 if (lomac_subject_privileged(subj)) 1343 return (EPERM); |
1406 | 1344 |
1407 source = SLOT(inp->inp_label); 1408 dest = SLOT(label); 1409 lomac_copy(source, dest); | 1345 if (!lomac_high_single(obj)) 1346 return (EACCES); 1347 1348 return (0); |
1410} 1411 1412static void | 1349} 1350 1351static void |
1413lomac_syncache_create_mbuf(struct label *sc_label, struct mbuf *m, 1414 struct label *mlabel) | 1352lomac_mount_create(struct ucred *cred, struct mount *mp, 1353 struct label *mplabel) |
1415{ 1416 struct mac_lomac *source, *dest; 1417 | 1354{ 1355 struct mac_lomac *source, *dest; 1356 |
1418 source = SLOT(sc_label); 1419 dest = SLOT(mlabel); 1420 lomac_copy(source, dest); | 1357 source = SLOT(cred->cr_label); 1358 dest = SLOT(mplabel); 1359 lomac_copy_single(source, dest); |
1421} 1422 1423static void 1424lomac_netatalk_aarp_send(struct ifnet *ifp, struct label *ifplabel, 1425 struct mbuf *m, struct label *mlabel) 1426{ 1427 struct mac_lomac *dest; 1428 --- 32 unchanged lines hidden (view full) --- 1461 1462 dest = SLOT(mlabel); 1463 1464 /* XXX: where is the label for the firewall really comming from? */ 1465 lomac_set_single(dest, MAC_LOMAC_TYPE_EQUAL, 0); 1466} 1467 1468static void | 1360} 1361 1362static void 1363lomac_netatalk_aarp_send(struct ifnet *ifp, struct label *ifplabel, 1364 struct mbuf *m, struct label *mlabel) 1365{ 1366 struct mac_lomac *dest; 1367 --- 32 unchanged lines hidden (view full) --- 1400 1401 dest = SLOT(mlabel); 1402 1403 /* XXX: where is the label for the firewall really comming from? */ 1404 lomac_set_single(dest, MAC_LOMAC_TYPE_EQUAL, 0); 1405} 1406 1407static void |
1408lomac_netinet_fragment(struct mbuf *m, struct label *mlabel, 1409 struct mbuf *frag, struct label *fraglabel) 1410{ 1411 struct mac_lomac *source, *dest; 1412 1413 source = SLOT(mlabel); 1414 dest = SLOT(fraglabel); 1415 1416 lomac_copy_single(source, dest); 1417} 1418 1419static void |
|
1469lomac_netinet_icmp_reply(struct mbuf *mrecv, struct label *mrecvlabel, 1470 struct mbuf *msend, struct label *msendlabel) 1471{ 1472 struct mac_lomac *source, *dest; 1473 1474 source = SLOT(mrecvlabel); 1475 dest = SLOT(msendlabel); 1476 --- 17 unchanged lines hidden (view full) --- 1494{ 1495 struct mac_lomac *dest; 1496 1497 dest = SLOT(mlabel); 1498 1499 lomac_set_single(dest, MAC_LOMAC_TYPE_EQUAL, 0); 1500} 1501 | 1420lomac_netinet_icmp_reply(struct mbuf *mrecv, struct label *mrecvlabel, 1421 struct mbuf *msend, struct label *msendlabel) 1422{ 1423 struct mac_lomac *source, *dest; 1424 1425 source = SLOT(mrecvlabel); 1426 dest = SLOT(msendlabel); 1427 --- 17 unchanged lines hidden (view full) --- 1445{ 1446 struct mac_lomac *dest; 1447 1448 dest = SLOT(mlabel); 1449 1450 lomac_set_single(dest, MAC_LOMAC_TYPE_EQUAL, 0); 1451} 1452 |
1502/* 1503 * Labeling event operations: processes. 1504 */ 1505static void 1506lomac_vnode_execve_transition(struct ucred *old, struct ucred *new, 1507 struct vnode *vp, struct label *vplabel, struct label *interpvplabel, 1508 struct image_params *imgp, struct label *execlabel) 1509{ 1510 struct mac_lomac *source, *dest, *obj, *robj; 1511 1512 source = SLOT(old->cr_label); 1513 dest = SLOT(new->cr_label); 1514 obj = SLOT(vplabel); 1515 robj = interpvplabel != NULL ? SLOT(interpvplabel) : obj; 1516 1517 lomac_copy(source, dest); 1518 /* 1519 * If there's an auxiliary label on the real object, respect it and 1520 * assume that this level should be assumed immediately if a higher 1521 * level is currently in place. 1522 */ 1523 if (robj->ml_flags & MAC_LOMAC_FLAG_AUX && 1524 !lomac_dominate_element(&robj->ml_auxsingle, &dest->ml_single) 1525 && lomac_auxsingle_in_range(robj, dest)) 1526 lomac_set_single(dest, robj->ml_auxsingle.mle_type, 1527 robj->ml_auxsingle.mle_grade); 1528 /* 1529 * Restructuring to use the execve transitioning mechanism instead of 1530 * the normal demotion mechanism here would be difficult, so just 1531 * copy the label over and perform standard demotion. This is also 1532 * non-optimal because it will result in the intermediate label "new" 1533 * being created and immediately recycled. 1534 */ 1535 if (lomac_enabled && revocation_enabled && 1536 !lomac_dominate_single(obj, source)) 1537 (void)maybe_demote(source, obj, "executing", "file", vp); 1538} 1539 | |
1540static int | 1453static int |
1541lomac_vnode_execve_will_transition(struct ucred *old, struct vnode *vp, 1542 struct label *vplabel, struct label *interpvplabel, 1543 struct image_params *imgp, struct label *execlabel) 1544{ 1545 struct mac_lomac *subj, *obj, *robj; 1546 1547 if (!lomac_enabled || !revocation_enabled) 1548 return (0); 1549 1550 subj = SLOT(old->cr_label); 1551 obj = SLOT(vplabel); 1552 robj = interpvplabel != NULL ? SLOT(interpvplabel) : obj; 1553 1554 return ((robj->ml_flags & MAC_LOMAC_FLAG_AUX && 1555 !lomac_dominate_element(&robj->ml_auxsingle, &subj->ml_single) 1556 && lomac_auxsingle_in_range(robj, subj)) || 1557 !lomac_dominate_single(obj, subj)); 1558} 1559 1560static void 1561lomac_proc_create_swapper(struct ucred *cred) 1562{ 1563 struct mac_lomac *dest; 1564 1565 dest = SLOT(cred->cr_label); 1566 1567 lomac_set_single(dest, MAC_LOMAC_TYPE_EQUAL, 0); 1568 lomac_set_range(dest, MAC_LOMAC_TYPE_LOW, 0, MAC_LOMAC_TYPE_HIGH, 0); 1569} 1570 1571static void 1572lomac_proc_create_init(struct ucred *cred) 1573{ 1574 struct mac_lomac *dest; 1575 1576 dest = SLOT(cred->cr_label); 1577 1578 lomac_set_single(dest, MAC_LOMAC_TYPE_HIGH, 0); 1579 lomac_set_range(dest, MAC_LOMAC_TYPE_LOW, 0, MAC_LOMAC_TYPE_HIGH, 0); 1580} 1581 1582static void 1583lomac_cred_relabel(struct ucred *cred, struct label *newlabel) 1584{ 1585 struct mac_lomac *source, *dest; 1586 1587 source = SLOT(newlabel); 1588 dest = SLOT(cred->cr_label); 1589 1590 try_relabel(source, dest); 1591} 1592 1593/* 1594 * Access control checks. 1595 */ 1596static int 1597lomac_bpfdesc_check_receive(struct bpf_d *d, struct label *dlabel, 1598 struct ifnet *ifp, struct label *ifplabel) 1599{ 1600 struct mac_lomac *a, *b; 1601 1602 if (!lomac_enabled) 1603 return (0); 1604 1605 a = SLOT(dlabel); 1606 b = SLOT(ifplabel); 1607 1608 if (lomac_equal_single(a, b)) 1609 return (0); 1610 return (EACCES); 1611} 1612 1613static int 1614lomac_cred_check_relabel(struct ucred *cred, struct label *newlabel) 1615{ 1616 struct mac_lomac *subj, *new; 1617 int error; 1618 1619 subj = SLOT(cred->cr_label); 1620 new = SLOT(newlabel); 1621 1622 /* 1623 * If there is a LOMAC label update for the credential, it may be an 1624 * update of the single, range, or both. 1625 */ 1626 error = lomac_atmostflags(new, MAC_LOMAC_FLAGS_BOTH); 1627 if (error) 1628 return (error); 1629 1630 /* 1631 * If the LOMAC label is to be changed, authorize as appropriate. 1632 */ 1633 if (new->ml_flags & MAC_LOMAC_FLAGS_BOTH) { 1634 /* 1635 * Fill in the missing parts from the previous label. 1636 */ 1637 if ((new->ml_flags & MAC_LOMAC_FLAG_SINGLE) == 0) 1638 lomac_copy_single(subj, new); 1639 if ((new->ml_flags & MAC_LOMAC_FLAG_RANGE) == 0) 1640 lomac_copy_range(subj, new); 1641 1642 /* 1643 * To change the LOMAC range on a credential, the new range 1644 * label must be in the current range. 1645 */ 1646 if (!lomac_range_in_range(new, subj)) 1647 return (EPERM); 1648 1649 /* 1650 * To change the LOMAC single label on a credential, the new 1651 * single label must be in the new range. Implicitly from 1652 * the previous check, the new single is in the old range. 1653 */ 1654 if (!lomac_single_in_range(new, new)) 1655 return (EPERM); 1656 1657 /* 1658 * To have EQUAL in any component of the new credential LOMAC 1659 * label, the subject must already have EQUAL in their label. 1660 */ 1661 if (lomac_contains_equal(new)) { 1662 error = lomac_subject_privileged(subj); 1663 if (error) 1664 return (error); 1665 } 1666 1667 /* 1668 * XXXMAC: Additional consistency tests regarding the single 1669 * and range of the new label might be performed here. 1670 */ 1671 } 1672 1673 return (0); 1674} 1675 1676static int 1677lomac_cred_check_visible(struct ucred *cr1, struct ucred *cr2) 1678{ 1679 struct mac_lomac *subj, *obj; 1680 1681 if (!lomac_enabled) 1682 return (0); 1683 1684 subj = SLOT(cr1->cr_label); 1685 obj = SLOT(cr2->cr_label); 1686 1687 /* XXX: range */ 1688 if (!lomac_dominate_single(obj, subj)) 1689 return (ESRCH); 1690 1691 return (0); 1692} 1693 1694static int 1695lomac_ifnet_check_relabel(struct ucred *cred, struct ifnet *ifp, 1696 struct label *ifplabel, struct label *newlabel) 1697{ 1698 struct mac_lomac *subj, *new; 1699 int error; 1700 1701 subj = SLOT(cred->cr_label); 1702 new = SLOT(newlabel); 1703 1704 /* 1705 * If there is a LOMAC label update for the interface, it may be an 1706 * update of the single, range, or both. 1707 */ 1708 error = lomac_atmostflags(new, MAC_LOMAC_FLAGS_BOTH); 1709 if (error) 1710 return (error); 1711 1712 /* 1713 * Relabling network interfaces requires LOMAC privilege. 1714 */ 1715 error = lomac_subject_privileged(subj); 1716 if (error) 1717 return (error); 1718 1719 /* 1720 * If the LOMAC label is to be changed, authorize as appropriate. 1721 */ 1722 if (new->ml_flags & MAC_LOMAC_FLAGS_BOTH) { 1723 /* 1724 * Fill in the missing parts from the previous label. 1725 */ 1726 if ((new->ml_flags & MAC_LOMAC_FLAG_SINGLE) == 0) 1727 lomac_copy_single(subj, new); 1728 if ((new->ml_flags & MAC_LOMAC_FLAG_RANGE) == 0) 1729 lomac_copy_range(subj, new); 1730 1731 /* 1732 * Rely on the traditional superuser status for the LOMAC 1733 * interface relabel requirements. XXXMAC: This will go 1734 * away. 1735 * 1736 * XXXRW: This is also redundant to a higher layer check. 1737 */ 1738 error = priv_check_cred(cred, PRIV_NET_SETIFMAC, 0); 1739 if (error) 1740 return (EPERM); 1741 1742 /* 1743 * XXXMAC: Additional consistency tests regarding the single 1744 * and the range of the new label might be performed here. 1745 */ 1746 } 1747 1748 return (0); 1749} 1750 1751static int 1752lomac_ifnet_check_transmit(struct ifnet *ifp, struct label *ifplabel, 1753 struct mbuf *m, struct label *mlabel) 1754{ 1755 struct mac_lomac *p, *i; 1756 1757 if (!lomac_enabled) 1758 return (0); 1759 1760 p = SLOT(mlabel); 1761 i = SLOT(ifplabel); 1762 1763 return (lomac_single_in_range(p, i) ? 0 : EACCES); 1764} 1765 1766static int 1767lomac_inpcb_check_deliver(struct inpcb *inp, struct label *inplabel, 1768 struct mbuf *m, struct label *mlabel) 1769{ 1770 struct mac_lomac *p, *i; 1771 1772 if (!lomac_enabled) 1773 return (0); 1774 1775 p = SLOT(mlabel); 1776 i = SLOT(inplabel); 1777 1778 return (lomac_equal_single(p, i) ? 0 : EACCES); 1779} 1780 1781static int 1782lomac_kld_check_load(struct ucred *cred, struct vnode *vp, 1783 struct label *vplabel) 1784{ 1785 struct mac_lomac *subj, *obj; 1786 1787 if (!lomac_enabled) 1788 return (0); 1789 1790 subj = SLOT(cred->cr_label); 1791 obj = SLOT(vplabel); 1792 1793 if (lomac_subject_privileged(subj)) 1794 return (EPERM); 1795 1796 if (!lomac_high_single(obj)) 1797 return (EACCES); 1798 1799 return (0); 1800} 1801 1802static int | |
1803lomac_pipe_check_ioctl(struct ucred *cred, struct pipepair *pp, 1804 struct label *pplabel, unsigned long cmd, void /* caddr_t */ *data) 1805{ 1806 1807 if (!lomac_enabled) 1808 return (0); 1809 1810 /* XXX: This will be implemented soon... */ --- 83 unchanged lines hidden (view full) --- 1894 obj = SLOT(pplabel); 1895 1896 if (!lomac_subject_dominate(subj, obj)) 1897 return (EACCES); 1898 1899 return (0); 1900} 1901 | 1454lomac_pipe_check_ioctl(struct ucred *cred, struct pipepair *pp, 1455 struct label *pplabel, unsigned long cmd, void /* caddr_t */ *data) 1456{ 1457 1458 if (!lomac_enabled) 1459 return (0); 1460 1461 /* XXX: This will be implemented soon... */ --- 83 unchanged lines hidden (view full) --- 1545 obj = SLOT(pplabel); 1546 1547 if (!lomac_subject_dominate(subj, obj)) 1548 return (EACCES); 1549 1550 return (0); 1551} 1552 |
1902static int 1903lomac_proc_check_debug(struct ucred *cred, struct proc *p) | 1553static void 1554lomac_pipe_create(struct ucred *cred, struct pipepair *pp, 1555 struct label *pplabel) |
1904{ | 1556{ |
1905 struct mac_lomac *subj, *obj; | 1557 struct mac_lomac *source, *dest; |
1906 | 1558 |
1907 if (!lomac_enabled) 1908 return (0); | 1559 source = SLOT(cred->cr_label); 1560 dest = SLOT(pplabel); |
1909 | 1561 |
1910 subj = SLOT(cred->cr_label); 1911 obj = SLOT(p->p_ucred->cr_label); 1912 1913 /* XXX: range checks */ 1914 if (!lomac_dominate_single(obj, subj)) 1915 return (ESRCH); 1916 if (!lomac_subject_dominate(subj, obj)) 1917 return (EACCES); 1918 1919 return (0); | 1562 lomac_copy_single(source, dest); |
1920} 1921 | 1563} 1564 |
1922static int 1923lomac_proc_check_sched(struct ucred *cred, struct proc *p) | 1565static void 1566lomac_pipe_relabel(struct ucred *cred, struct pipepair *pp, 1567 struct label *pplabel, struct label *newlabel) |
1924{ | 1568{ |
1925 struct mac_lomac *subj, *obj; | 1569 struct mac_lomac *source, *dest; |
1926 | 1570 |
1927 if (!lomac_enabled) 1928 return (0); | 1571 source = SLOT(newlabel); 1572 dest = SLOT(pplabel); |
1929 | 1573 |
1930 subj = SLOT(cred->cr_label); 1931 obj = SLOT(p->p_ucred->cr_label); 1932 1933 /* XXX: range checks */ 1934 if (!lomac_dominate_single(obj, subj)) 1935 return (ESRCH); 1936 if (!lomac_subject_dominate(subj, obj)) 1937 return (EACCES); 1938 1939 return (0); | 1574 try_relabel(source, dest); |
1940} 1941 | 1575} 1576 |
1942static int 1943lomac_proc_check_signal(struct ucred *cred, struct proc *p, int signum) 1944{ 1945 struct mac_lomac *subj, *obj; 1946 1947 if (!lomac_enabled) 1948 return (0); 1949 1950 subj = SLOT(cred->cr_label); 1951 obj = SLOT(p->p_ucred->cr_label); 1952 1953 /* XXX: range checks */ 1954 if (!lomac_dominate_single(obj, subj)) 1955 return (ESRCH); 1956 if (!lomac_subject_dominate(subj, obj)) 1957 return (EACCES); 1958 1959 return (0); 1960} 1961 1962static int 1963lomac_socket_check_deliver(struct socket *so, struct label *solabel, 1964 struct mbuf *m, struct label *mlabel) 1965{ 1966 struct mac_lomac *p, *s; 1967 1968 if (!lomac_enabled) 1969 return (0); 1970 1971 p = SLOT(mlabel); 1972 s = SLOT(solabel); 1973 1974 return (lomac_equal_single(p, s) ? 0 : EACCES); 1975} 1976 1977static int 1978lomac_socket_check_relabel(struct ucred *cred, struct socket *so, 1979 struct label *solabel, struct label *newlabel) 1980{ 1981 struct mac_lomac *subj, *obj, *new; 1982 int error; 1983 1984 new = SLOT(newlabel); 1985 subj = SLOT(cred->cr_label); 1986 obj = SLOT(solabel); 1987 1988 /* 1989 * If there is a LOMAC label update for the socket, it may be an 1990 * update of single. 1991 */ 1992 error = lomac_atmostflags(new, MAC_LOMAC_FLAG_SINGLE); 1993 if (error) 1994 return (error); 1995 1996 /* 1997 * To relabel a socket, the old socket single must be in the subject 1998 * range. 1999 */ 2000 if (!lomac_single_in_range(obj, subj)) 2001 return (EPERM); 2002 2003 /* 2004 * If the LOMAC label is to be changed, authorize as appropriate. 2005 */ 2006 if (new->ml_flags & MAC_LOMAC_FLAG_SINGLE) { 2007 /* 2008 * To relabel a socket, the new socket single must be in the 2009 * subject range. 2010 */ 2011 if (!lomac_single_in_range(new, subj)) 2012 return (EPERM); 2013 2014 /* 2015 * To change the LOMAC label on the socket to contain EQUAL, 2016 * the subject must have appropriate privilege. 2017 */ 2018 if (lomac_contains_equal(new)) { 2019 error = lomac_subject_privileged(subj); 2020 if (error) 2021 return (error); 2022 } 2023 } 2024 2025 return (0); 2026} 2027 2028static int 2029lomac_socket_check_visible(struct ucred *cred, struct socket *so, 2030 struct label *solabel) 2031{ 2032 struct mac_lomac *subj, *obj; 2033 2034 if (!lomac_enabled) 2035 return (0); 2036 2037 subj = SLOT(cred->cr_label); 2038 obj = SLOT(solabel); 2039 2040 if (!lomac_dominate_single(obj, subj)) 2041 return (ENOENT); 2042 2043 return (0); 2044} 2045 | |
2046/* 2047 * Some system privileges are allowed regardless of integrity grade; others 2048 * are allowed only when running with privilege with respect to the LOMAC 2049 * policy as they might otherwise allow bypassing of the integrity policy. 2050 */ 2051static int 2052lomac_priv_check(struct ucred *cred, int priv) 2053{ --- 173 unchanged lines hidden (view full) --- 2227 subj = SLOT(cred->cr_label); 2228 error = lomac_subject_privileged(subj); 2229 if (error) 2230 return (error); 2231 } 2232 return (0); 2233} 2234 | 1577/* 1578 * Some system privileges are allowed regardless of integrity grade; others 1579 * are allowed only when running with privilege with respect to the LOMAC 1580 * policy as they might otherwise allow bypassing of the integrity policy. 1581 */ 1582static int 1583lomac_priv_check(struct ucred *cred, int priv) 1584{ --- 173 unchanged lines hidden (view full) --- 1758 subj = SLOT(cred->cr_label); 1759 error = lomac_subject_privileged(subj); 1760 if (error) 1761 return (error); 1762 } 1763 return (0); 1764} 1765 |
1766static int 1767lomac_proc_check_debug(struct ucred *cred, struct proc *p) 1768{ 1769 struct mac_lomac *subj, *obj; |
|
2235 | 1770 |
1771 if (!lomac_enabled) 1772 return (0); 1773 1774 subj = SLOT(cred->cr_label); 1775 obj = SLOT(p->p_ucred->cr_label); 1776 1777 /* XXX: range checks */ 1778 if (!lomac_dominate_single(obj, subj)) 1779 return (ESRCH); 1780 if (!lomac_subject_dominate(subj, obj)) 1781 return (EACCES); 1782 1783 return (0); 1784} 1785 |
|
2236static int | 1786static int |
1787lomac_proc_check_sched(struct ucred *cred, struct proc *p) 1788{ 1789 struct mac_lomac *subj, *obj; 1790 1791 if (!lomac_enabled) 1792 return (0); 1793 1794 subj = SLOT(cred->cr_label); 1795 obj = SLOT(p->p_ucred->cr_label); 1796 1797 /* XXX: range checks */ 1798 if (!lomac_dominate_single(obj, subj)) 1799 return (ESRCH); 1800 if (!lomac_subject_dominate(subj, obj)) 1801 return (EACCES); 1802 1803 return (0); 1804} 1805 1806static int 1807lomac_proc_check_signal(struct ucred *cred, struct proc *p, int signum) 1808{ 1809 struct mac_lomac *subj, *obj; 1810 1811 if (!lomac_enabled) 1812 return (0); 1813 1814 subj = SLOT(cred->cr_label); 1815 obj = SLOT(p->p_ucred->cr_label); 1816 1817 /* XXX: range checks */ 1818 if (!lomac_dominate_single(obj, subj)) 1819 return (ESRCH); 1820 if (!lomac_subject_dominate(subj, obj)) 1821 return (EACCES); 1822 1823 return (0); 1824} 1825 1826static void 1827lomac_proc_create_init(struct ucred *cred) 1828{ 1829 struct mac_lomac *dest; 1830 1831 dest = SLOT(cred->cr_label); 1832 1833 lomac_set_single(dest, MAC_LOMAC_TYPE_HIGH, 0); 1834 lomac_set_range(dest, MAC_LOMAC_TYPE_LOW, 0, MAC_LOMAC_TYPE_HIGH, 0); 1835} 1836 1837static void 1838lomac_proc_create_swapper(struct ucred *cred) 1839{ 1840 struct mac_lomac *dest; 1841 1842 dest = SLOT(cred->cr_label); 1843 1844 lomac_set_single(dest, MAC_LOMAC_TYPE_EQUAL, 0); 1845 lomac_set_range(dest, MAC_LOMAC_TYPE_LOW, 0, MAC_LOMAC_TYPE_HIGH, 0); 1846} 1847 1848static void 1849lomac_proc_destroy_label(struct label *label) 1850{ 1851 1852 mtx_destroy(&PSLOT(label)->mtx); 1853 FREE(PSLOT(label), M_LOMAC); 1854 PSLOT_SET(label, NULL); 1855} 1856 1857static void 1858lomac_proc_init_label(struct label *label) 1859{ 1860 1861 PSLOT_SET(label, malloc(sizeof(struct mac_lomac_proc), M_LOMAC, 1862 M_ZERO | M_WAITOK)); 1863 mtx_init(&PSLOT(label)->mtx, "MAC/Lomac proc lock", NULL, MTX_DEF); 1864} 1865 1866static int 1867lomac_socket_check_deliver(struct socket *so, struct label *solabel, 1868 struct mbuf *m, struct label *mlabel) 1869{ 1870 struct mac_lomac *p, *s; 1871 1872 if (!lomac_enabled) 1873 return (0); 1874 1875 p = SLOT(mlabel); 1876 s = SLOT(solabel); 1877 1878 return (lomac_equal_single(p, s) ? 0 : EACCES); 1879} 1880 1881static int 1882lomac_socket_check_relabel(struct ucred *cred, struct socket *so, 1883 struct label *solabel, struct label *newlabel) 1884{ 1885 struct mac_lomac *subj, *obj, *new; 1886 int error; 1887 1888 new = SLOT(newlabel); 1889 subj = SLOT(cred->cr_label); 1890 obj = SLOT(solabel); 1891 1892 /* 1893 * If there is a LOMAC label update for the socket, it may be an 1894 * update of single. 1895 */ 1896 error = lomac_atmostflags(new, MAC_LOMAC_FLAG_SINGLE); 1897 if (error) 1898 return (error); 1899 1900 /* 1901 * To relabel a socket, the old socket single must be in the subject 1902 * range. 1903 */ 1904 if (!lomac_single_in_range(obj, subj)) 1905 return (EPERM); 1906 1907 /* 1908 * If the LOMAC label is to be changed, authorize as appropriate. 1909 */ 1910 if (new->ml_flags & MAC_LOMAC_FLAG_SINGLE) { 1911 /* 1912 * To relabel a socket, the new socket single must be in the 1913 * subject range. 1914 */ 1915 if (!lomac_single_in_range(new, subj)) 1916 return (EPERM); 1917 1918 /* 1919 * To change the LOMAC label on the socket to contain EQUAL, 1920 * the subject must have appropriate privilege. 1921 */ 1922 if (lomac_contains_equal(new)) { 1923 error = lomac_subject_privileged(subj); 1924 if (error) 1925 return (error); 1926 } 1927 } 1928 1929 return (0); 1930} 1931 1932static int 1933lomac_socket_check_visible(struct ucred *cred, struct socket *so, 1934 struct label *solabel) 1935{ 1936 struct mac_lomac *subj, *obj; 1937 1938 if (!lomac_enabled) 1939 return (0); 1940 1941 subj = SLOT(cred->cr_label); 1942 obj = SLOT(solabel); 1943 1944 if (!lomac_dominate_single(obj, subj)) 1945 return (ENOENT); 1946 1947 return (0); 1948} 1949 1950static void 1951lomac_socket_create(struct ucred *cred, struct socket *so, 1952 struct label *solabel) 1953{ 1954 struct mac_lomac *source, *dest; 1955 1956 source = SLOT(cred->cr_label); 1957 dest = SLOT(solabel); 1958 1959 lomac_copy_single(source, dest); 1960} 1961 1962static void 1963lomac_socket_create_mbuf(struct socket *so, struct label *solabel, 1964 struct mbuf *m, struct label *mlabel) 1965{ 1966 struct mac_lomac *source, *dest; 1967 1968 source = SLOT(solabel); 1969 dest = SLOT(mlabel); 1970 1971 lomac_copy_single(source, dest); 1972} 1973 1974static void 1975lomac_socket_newconn(struct socket *oldso, struct label *oldsolabel, 1976 struct socket *newso, struct label *newsolabel) 1977{ 1978 struct mac_lomac *source, *dest; 1979 1980 source = SLOT(oldsolabel); 1981 dest = SLOT(newsolabel); 1982 1983 lomac_copy_single(source, dest); 1984} 1985 1986static void 1987lomac_socket_relabel(struct ucred *cred, struct socket *so, 1988 struct label *solabel, struct label *newlabel) 1989{ 1990 struct mac_lomac *source, *dest; 1991 1992 source = SLOT(newlabel); 1993 dest = SLOT(solabel); 1994 1995 try_relabel(source, dest); 1996} 1997 1998static void 1999lomac_socketpeer_set_from_mbuf(struct mbuf *m, struct label *mlabel, 2000 struct socket *so, struct label *sopeerlabel) 2001{ 2002 struct mac_lomac *source, *dest; 2003 2004 source = SLOT(mlabel); 2005 dest = SLOT(sopeerlabel); 2006 2007 lomac_copy_single(source, dest); 2008} 2009 2010static void 2011lomac_socketpeer_set_from_socket(struct socket *oldso, 2012 struct label *oldsolabel, struct socket *newso, 2013 struct label *newsopeerlabel) 2014{ 2015 struct mac_lomac *source, *dest; 2016 2017 source = SLOT(oldsolabel); 2018 dest = SLOT(newsopeerlabel); 2019 2020 lomac_copy_single(source, dest); 2021} 2022 2023static void 2024lomac_syncache_create(struct label *label, struct inpcb *inp) 2025{ 2026 struct mac_lomac *source, *dest; 2027 2028 source = SLOT(inp->inp_label); 2029 dest = SLOT(label); 2030 lomac_copy(source, dest); 2031} 2032 2033static void 2034lomac_syncache_create_mbuf(struct label *sc_label, struct mbuf *m, 2035 struct label *mlabel) 2036{ 2037 struct mac_lomac *source, *dest; 2038 2039 source = SLOT(sc_label); 2040 dest = SLOT(mlabel); 2041 lomac_copy(source, dest); 2042} 2043 2044static int |
|
2237lomac_system_check_acct(struct ucred *cred, struct vnode *vp, 2238 struct label *vplabel) 2239{ 2240 struct mac_lomac *subj, *obj; 2241 2242 if (!lomac_enabled) 2243 return (0); 2244 --- 91 unchanged lines hidden (view full) --- 2336 2337 if (lomac_subject_privileged(subj)) 2338 return (EPERM); 2339 } 2340 2341 return (0); 2342} 2343 | 2045lomac_system_check_acct(struct ucred *cred, struct vnode *vp, 2046 struct label *vplabel) 2047{ 2048 struct mac_lomac *subj, *obj; 2049 2050 if (!lomac_enabled) 2051 return (0); 2052 --- 91 unchanged lines hidden (view full) --- 2144 2145 if (lomac_subject_privileged(subj)) 2146 return (EPERM); 2147 } 2148 2149 return (0); 2150} 2151 |
2152static void 2153lomac_thread_userret(struct thread *td) 2154{ 2155 struct proc *p = td->td_proc; 2156 struct mac_lomac_proc *subj = PSLOT(p->p_label); 2157 struct ucred *newcred, *oldcred; 2158 int dodrop; 2159 2160 mtx_lock(&subj->mtx); 2161 if (subj->mac_lomac.ml_flags & MAC_LOMAC_FLAG_UPDATE) { 2162 dodrop = 0; 2163 mtx_unlock(&subj->mtx); 2164 newcred = crget(); 2165 /* 2166 * Prevent a lock order reversal in 2167 * mac_cred_mmapped_drop_perms; ideally, the other user of 2168 * subj->mtx wouldn't be holding Giant. 2169 */ 2170 mtx_lock(&Giant); 2171 PROC_LOCK(p); 2172 mtx_lock(&subj->mtx); 2173 /* 2174 * Check if we lost the race while allocating the cred. 2175 */ 2176 if ((subj->mac_lomac.ml_flags & MAC_LOMAC_FLAG_UPDATE) == 0) { 2177 crfree(newcred); 2178 goto out; 2179 } 2180 oldcred = p->p_ucred; 2181 crcopy(newcred, oldcred); 2182 crhold(newcred); 2183 lomac_copy(&subj->mac_lomac, SLOT(newcred->cr_label)); 2184 p->p_ucred = newcred; 2185 crfree(oldcred); 2186 dodrop = 1; 2187 out: 2188 mtx_unlock(&subj->mtx); 2189 PROC_UNLOCK(p); 2190 if (dodrop) 2191 mac_cred_mmapped_drop_perms(curthread, newcred); 2192 mtx_unlock(&Giant); 2193 } else { 2194 mtx_unlock(&subj->mtx); 2195 } 2196} 2197 |
|
2344static int | 2198static int |
2199lomac_vnode_associate_extattr(struct mount *mp, struct label *mplabel, 2200 struct vnode *vp, struct label *vplabel) 2201{ 2202 struct mac_lomac ml_temp, *source, *dest; 2203 int buflen, error; 2204 2205 source = SLOT(mplabel); 2206 dest = SLOT(vplabel); 2207 2208 buflen = sizeof(ml_temp); 2209 bzero(&ml_temp, buflen); 2210 2211 error = vn_extattr_get(vp, IO_NODELOCKED, MAC_LOMAC_EXTATTR_NAMESPACE, 2212 MAC_LOMAC_EXTATTR_NAME, &buflen, (char *)&ml_temp, curthread); 2213 if (error == ENOATTR || error == EOPNOTSUPP) { 2214 /* Fall back to the mntlabel. */ 2215 lomac_copy_single(source, dest); 2216 return (0); 2217 } else if (error) 2218 return (error); 2219 2220 if (buflen != sizeof(ml_temp)) { 2221 if (buflen != sizeof(ml_temp) - sizeof(ml_temp.ml_auxsingle)) { 2222 printf("lomac_vnode_associate_extattr: bad size %d\n", 2223 buflen); 2224 return (EPERM); 2225 } 2226 bzero(&ml_temp.ml_auxsingle, sizeof(ml_temp.ml_auxsingle)); 2227 buflen = sizeof(ml_temp); 2228 (void)vn_extattr_set(vp, IO_NODELOCKED, 2229 MAC_LOMAC_EXTATTR_NAMESPACE, MAC_LOMAC_EXTATTR_NAME, 2230 buflen, (char *)&ml_temp, curthread); 2231 } 2232 if (lomac_valid(&ml_temp) != 0) { 2233 printf("lomac_vnode_associate_extattr: invalid\n"); 2234 return (EPERM); 2235 } 2236 if ((ml_temp.ml_flags & MAC_LOMAC_FLAGS_BOTH) != 2237 MAC_LOMAC_FLAG_SINGLE) { 2238 printf("lomac_vnode_associate_extattr: not single\n"); 2239 return (EPERM); 2240 } 2241 2242 lomac_copy_single(&ml_temp, dest); 2243 return (0); 2244} 2245 2246static void 2247lomac_vnode_associate_singlelabel(struct mount *mp, struct label *mplabel, 2248 struct vnode *vp, struct label *vplabel) 2249{ 2250 struct mac_lomac *source, *dest; 2251 2252 source = SLOT(mplabel); 2253 dest = SLOT(vplabel); 2254 2255 lomac_copy_single(source, dest); 2256} 2257 2258static int |
|
2345lomac_vnode_check_create(struct ucred *cred, struct vnode *dvp, 2346 struct label *dvplabel, struct componentname *cnp, struct vattr *vap) 2347{ 2348 struct mac_lomac *subj, *obj; 2349 2350 if (!lomac_enabled) 2351 return (0); 2352 --- 430 unchanged lines hidden (view full) --- 2783 obj = SLOT(vplabel); 2784 2785 if (!lomac_subject_dominate(subj, obj)) 2786 return (EACCES); 2787 2788 return (0); 2789} 2790 | 2259lomac_vnode_check_create(struct ucred *cred, struct vnode *dvp, 2260 struct label *dvplabel, struct componentname *cnp, struct vattr *vap) 2261{ 2262 struct mac_lomac *subj, *obj; 2263 2264 if (!lomac_enabled) 2265 return (0); 2266 --- 430 unchanged lines hidden (view full) --- 2697 obj = SLOT(vplabel); 2698 2699 if (!lomac_subject_dominate(subj, obj)) 2700 return (EACCES); 2701 2702 return (0); 2703} 2704 |
2791static void 2792lomac_thread_userret(struct thread *td) | 2705static int 2706lomac_vnode_create_extattr(struct ucred *cred, struct mount *mp, 2707 struct label *mplabel, struct vnode *dvp, struct label *dvplabel, 2708 struct vnode *vp, struct label *vplabel, struct componentname *cnp) |
2793{ | 2709{ |
2794 struct proc *p = td->td_proc; 2795 struct mac_lomac_proc *subj = PSLOT(p->p_label); 2796 struct ucred *newcred, *oldcred; 2797 int dodrop; | 2710 struct mac_lomac *source, *dest, *dir, temp; 2711 size_t buflen; 2712 int error; |
2798 | 2713 |
2799 mtx_lock(&subj->mtx); 2800 if (subj->mac_lomac.ml_flags & MAC_LOMAC_FLAG_UPDATE) { 2801 dodrop = 0; 2802 mtx_unlock(&subj->mtx); 2803 newcred = crget(); 2804 /* 2805 * Prevent a lock order reversal in 2806 * mac_cred_mmapped_drop_perms; ideally, the other user of 2807 * subj->mtx wouldn't be holding Giant. 2808 */ 2809 mtx_lock(&Giant); 2810 PROC_LOCK(p); 2811 mtx_lock(&subj->mtx); 2812 /* 2813 * Check if we lost the race while allocating the cred. 2814 */ 2815 if ((subj->mac_lomac.ml_flags & MAC_LOMAC_FLAG_UPDATE) == 0) { 2816 crfree(newcred); 2817 goto out; 2818 } 2819 oldcred = p->p_ucred; 2820 crcopy(newcred, oldcred); 2821 crhold(newcred); 2822 lomac_copy(&subj->mac_lomac, SLOT(newcred->cr_label)); 2823 p->p_ucred = newcred; 2824 crfree(oldcred); 2825 dodrop = 1; 2826 out: 2827 mtx_unlock(&subj->mtx); 2828 PROC_UNLOCK(p); 2829 if (dodrop) 2830 mac_cred_mmapped_drop_perms(curthread, newcred); 2831 mtx_unlock(&Giant); | 2714 buflen = sizeof(temp); 2715 bzero(&temp, buflen); 2716 2717 source = SLOT(cred->cr_label); 2718 dest = SLOT(vplabel); 2719 dir = SLOT(dvplabel); 2720 if (dir->ml_flags & MAC_LOMAC_FLAG_AUX) { 2721 lomac_copy_auxsingle(dir, &temp); 2722 lomac_set_single(&temp, dir->ml_auxsingle.mle_type, 2723 dir->ml_auxsingle.mle_grade); |
2832 } else { | 2724 } else { |
2833 mtx_unlock(&subj->mtx); | 2725 lomac_copy_single(source, &temp); |
2834 } | 2726 } |
2727 2728 error = vn_extattr_set(vp, IO_NODELOCKED, MAC_LOMAC_EXTATTR_NAMESPACE, 2729 MAC_LOMAC_EXTATTR_NAME, buflen, (char *)&temp, curthread); 2730 if (error == 0) 2731 lomac_copy(&temp, dest); 2732 return (error); |
|
2835} 2836 | 2733} 2734 |
2735static void 2736lomac_vnode_execve_transition(struct ucred *old, struct ucred *new, 2737 struct vnode *vp, struct label *vplabel, struct label *interpvplabel, 2738 struct image_params *imgp, struct label *execlabel) 2739{ 2740 struct mac_lomac *source, *dest, *obj, *robj; 2741 2742 source = SLOT(old->cr_label); 2743 dest = SLOT(new->cr_label); 2744 obj = SLOT(vplabel); 2745 robj = interpvplabel != NULL ? SLOT(interpvplabel) : obj; 2746 2747 lomac_copy(source, dest); 2748 /* 2749 * If there's an auxiliary label on the real object, respect it and 2750 * assume that this level should be assumed immediately if a higher 2751 * level is currently in place. 2752 */ 2753 if (robj->ml_flags & MAC_LOMAC_FLAG_AUX && 2754 !lomac_dominate_element(&robj->ml_auxsingle, &dest->ml_single) 2755 && lomac_auxsingle_in_range(robj, dest)) 2756 lomac_set_single(dest, robj->ml_auxsingle.mle_type, 2757 robj->ml_auxsingle.mle_grade); 2758 /* 2759 * Restructuring to use the execve transitioning mechanism instead of 2760 * the normal demotion mechanism here would be difficult, so just 2761 * copy the label over and perform standard demotion. This is also 2762 * non-optimal because it will result in the intermediate label "new" 2763 * being created and immediately recycled. 2764 */ 2765 if (lomac_enabled && revocation_enabled && 2766 !lomac_dominate_single(obj, source)) 2767 (void)maybe_demote(source, obj, "executing", "file", vp); 2768} 2769 2770static int 2771lomac_vnode_execve_will_transition(struct ucred *old, struct vnode *vp, 2772 struct label *vplabel, struct label *interpvplabel, 2773 struct image_params *imgp, struct label *execlabel) 2774{ 2775 struct mac_lomac *subj, *obj, *robj; 2776 2777 if (!lomac_enabled || !revocation_enabled) 2778 return (0); 2779 2780 subj = SLOT(old->cr_label); 2781 obj = SLOT(vplabel); 2782 robj = interpvplabel != NULL ? SLOT(interpvplabel) : obj; 2783 2784 return ((robj->ml_flags & MAC_LOMAC_FLAG_AUX && 2785 !lomac_dominate_element(&robj->ml_auxsingle, &subj->ml_single) 2786 && lomac_auxsingle_in_range(robj, subj)) || 2787 !lomac_dominate_single(obj, subj)); 2788} 2789 2790static void 2791lomac_vnode_relabel(struct ucred *cred, struct vnode *vp, 2792 struct label *vplabel, struct label *newlabel) 2793{ 2794 struct mac_lomac *source, *dest; 2795 2796 source = SLOT(newlabel); 2797 dest = SLOT(vplabel); 2798 2799 try_relabel(source, dest); 2800} 2801 2802static int 2803lomac_vnode_setlabel_extattr(struct ucred *cred, struct vnode *vp, 2804 struct label *vplabel, struct label *intlabel) 2805{ 2806 struct mac_lomac *source, temp; 2807 size_t buflen; 2808 int error; 2809 2810 buflen = sizeof(temp); 2811 bzero(&temp, buflen); 2812 2813 source = SLOT(intlabel); 2814 if ((source->ml_flags & MAC_LOMAC_FLAG_SINGLE) == 0) 2815 return (0); 2816 2817 lomac_copy_single(source, &temp); 2818 error = vn_extattr_set(vp, IO_NODELOCKED, MAC_LOMAC_EXTATTR_NAMESPACE, 2819 MAC_LOMAC_EXTATTR_NAME, buflen, (char *)&temp, curthread); 2820 return (error); 2821} 2822 |
|
2837static struct mac_policy_ops lomac_ops = 2838{ 2839 .mpo_init = lomac_init, | 2823static struct mac_policy_ops lomac_ops = 2824{ 2825 .mpo_init = lomac_init, |
2840 .mpo_bpfdesc_init_label = lomac_init_label, 2841 .mpo_cred_init_label = lomac_init_label, 2842 .mpo_devfs_init_label = lomac_init_label, 2843 .mpo_ifnet_init_label = lomac_init_label, 2844 .mpo_syncache_init_label = lomac_init_label_waitcheck, 2845 .mpo_inpcb_init_label = lomac_init_label_waitcheck, 2846 .mpo_ipq_init_label = lomac_init_label_waitcheck, 2847 .mpo_mbuf_init_label = lomac_init_label_waitcheck, 2848 .mpo_mount_init_label = lomac_init_label, 2849 .mpo_pipe_init_label = lomac_init_label, 2850 .mpo_proc_init_label = lomac_proc_init_label, 2851 .mpo_socket_init_label = lomac_init_label_waitcheck, 2852 .mpo_socketpeer_init_label = lomac_init_label_waitcheck, 2853 .mpo_vnode_init_label = lomac_init_label, 2854 .mpo_syncache_create = lomac_syncache_create, | 2826 2827 .mpo_bpfdesc_check_receive = lomac_bpfdesc_check_receive, 2828 .mpo_bpfdesc_create = lomac_bpfdesc_create, 2829 .mpo_bpfdesc_create_mbuf = lomac_bpfdesc_create_mbuf, |
2855 .mpo_bpfdesc_destroy_label = lomac_destroy_label, | 2830 .mpo_bpfdesc_destroy_label = lomac_destroy_label, |
2856 .mpo_cred_destroy_label = lomac_destroy_label, 2857 .mpo_devfs_destroy_label = lomac_destroy_label, 2858 .mpo_ifnet_destroy_label = lomac_destroy_label, 2859 .mpo_inpcb_destroy_label = lomac_destroy_label, 2860 .mpo_ipq_destroy_label = lomac_destroy_label, 2861 .mpo_mbuf_destroy_label = lomac_destroy_label, 2862 .mpo_mount_destroy_label = lomac_destroy_label, 2863 .mpo_pipe_destroy_label = lomac_destroy_label, 2864 .mpo_proc_destroy_label = lomac_proc_destroy_label, 2865 .mpo_syncache_destroy_label = lomac_destroy_label, 2866 .mpo_socket_destroy_label = lomac_destroy_label, 2867 .mpo_socketpeer_destroy_label = lomac_destroy_label, 2868 .mpo_vnode_destroy_label = lomac_destroy_label, | 2831 .mpo_bpfdesc_init_label = lomac_init_label, 2832 2833 .mpo_cred_check_relabel = lomac_cred_check_relabel, 2834 .mpo_cred_check_visible = lomac_cred_check_visible, |
2869 .mpo_cred_copy_label = lomac_copy_label, | 2835 .mpo_cred_copy_label = lomac_copy_label, |
2870 .mpo_ifnet_copy_label = lomac_copy_label, 2871 .mpo_mbuf_copy_label = lomac_copy_label, 2872 .mpo_pipe_copy_label = lomac_copy_label, 2873 .mpo_socket_copy_label = lomac_copy_label, 2874 .mpo_vnode_copy_label = lomac_copy_label, | 2836 .mpo_cred_destroy_label = lomac_destroy_label, |
2875 .mpo_cred_externalize_label = lomac_externalize_label, | 2837 .mpo_cred_externalize_label = lomac_externalize_label, |
2876 .mpo_ifnet_externalize_label = lomac_externalize_label, 2877 .mpo_pipe_externalize_label = lomac_externalize_label, 2878 .mpo_socket_externalize_label = lomac_externalize_label, 2879 .mpo_socketpeer_externalize_label = lomac_externalize_label, 2880 .mpo_vnode_externalize_label = lomac_externalize_label, | 2838 .mpo_cred_init_label = lomac_init_label, |
2881 .mpo_cred_internalize_label = lomac_internalize_label, | 2839 .mpo_cred_internalize_label = lomac_internalize_label, |
2882 .mpo_ifnet_internalize_label = lomac_internalize_label, 2883 .mpo_pipe_internalize_label = lomac_internalize_label, 2884 .mpo_socket_internalize_label = lomac_internalize_label, 2885 .mpo_vnode_internalize_label = lomac_internalize_label, | 2840 .mpo_cred_relabel = lomac_cred_relabel, 2841 |
2886 .mpo_devfs_create_device = lomac_devfs_create_device, 2887 .mpo_devfs_create_directory = lomac_devfs_create_directory, 2888 .mpo_devfs_create_symlink = lomac_devfs_create_symlink, | 2842 .mpo_devfs_create_device = lomac_devfs_create_device, 2843 .mpo_devfs_create_directory = lomac_devfs_create_directory, 2844 .mpo_devfs_create_symlink = lomac_devfs_create_symlink, |
2889 .mpo_mount_create = lomac_mount_create, 2890 .mpo_vnode_relabel = lomac_vnode_relabel, | 2845 .mpo_devfs_destroy_label = lomac_destroy_label, 2846 .mpo_devfs_init_label = lomac_init_label, |
2891 .mpo_devfs_update = lomac_devfs_update, 2892 .mpo_devfs_vnode_associate = lomac_devfs_vnode_associate, | 2847 .mpo_devfs_update = lomac_devfs_update, 2848 .mpo_devfs_vnode_associate = lomac_devfs_vnode_associate, |
2893 .mpo_vnode_associate_extattr = lomac_vnode_associate_extattr, 2894 .mpo_vnode_associate_singlelabel = lomac_vnode_associate_singlelabel, 2895 .mpo_vnode_create_extattr = lomac_vnode_create_extattr, 2896 .mpo_vnode_setlabel_extattr = lomac_vnode_setlabel_extattr, 2897 .mpo_socket_create_mbuf = lomac_socket_create_mbuf, 2898 .mpo_syncache_create_mbuf = lomac_syncache_create_mbuf, 2899 .mpo_pipe_create = lomac_pipe_create, 2900 .mpo_socket_create = lomac_socket_create, 2901 .mpo_socket_newconn = lomac_socket_newconn, 2902 .mpo_pipe_relabel = lomac_pipe_relabel, 2903 .mpo_socket_relabel = lomac_socket_relabel, 2904 .mpo_socketpeer_set_from_mbuf = lomac_socketpeer_set_from_mbuf, 2905 .mpo_socketpeer_set_from_socket = lomac_socketpeer_set_from_socket, 2906 .mpo_bpfdesc_create = lomac_bpfdesc_create, 2907 .mpo_ipq_reassemble = lomac_ipq_reassemble, 2908 .mpo_netinet_fragment = lomac_netinet_fragment, | 2849 2850 .mpo_ifnet_check_relabel = lomac_ifnet_check_relabel, 2851 .mpo_ifnet_check_transmit = lomac_ifnet_check_transmit, 2852 .mpo_ifnet_copy_label = lomac_copy_label, |
2909 .mpo_ifnet_create = lomac_ifnet_create, | 2853 .mpo_ifnet_create = lomac_ifnet_create, |
2854 .mpo_ifnet_create_mbuf = lomac_ifnet_create_mbuf, 2855 .mpo_ifnet_destroy_label = lomac_destroy_label, 2856 .mpo_ifnet_externalize_label = lomac_externalize_label, 2857 .mpo_ifnet_init_label = lomac_init_label, 2858 .mpo_ifnet_internalize_label = lomac_internalize_label, 2859 .mpo_ifnet_relabel = lomac_ifnet_relabel, 2860 2861 .mpo_syncache_create = lomac_syncache_create, 2862 .mpo_syncache_destroy_label = lomac_destroy_label, 2863 .mpo_syncache_init_label = lomac_init_label_waitcheck, 2864 2865 .mpo_inpcb_check_deliver = lomac_inpcb_check_deliver, |
|
2910 .mpo_inpcb_create = lomac_inpcb_create, | 2866 .mpo_inpcb_create = lomac_inpcb_create, |
2911 .mpo_ipq_create = lomac_ipq_create, | |
2912 .mpo_inpcb_create_mbuf = lomac_inpcb_create_mbuf, | 2867 .mpo_inpcb_create_mbuf = lomac_inpcb_create_mbuf, |
2913 .mpo_bpfdesc_create_mbuf = lomac_bpfdesc_create_mbuf, 2914 .mpo_ifnet_create_mbuf = lomac_ifnet_create_mbuf, | 2868 .mpo_inpcb_destroy_label = lomac_destroy_label, 2869 .mpo_inpcb_init_label = lomac_init_label_waitcheck, 2870 .mpo_inpcb_sosetlabel = lomac_inpcb_sosetlabel, 2871 2872 .mpo_ipq_create = lomac_ipq_create, 2873 .mpo_ipq_destroy_label = lomac_destroy_label, 2874 .mpo_ipq_init_label = lomac_init_label_waitcheck, |
2915 .mpo_ipq_match = lomac_ipq_match, | 2875 .mpo_ipq_match = lomac_ipq_match, |
2916 .mpo_ifnet_relabel = lomac_ifnet_relabel, | 2876 .mpo_ipq_reassemble = lomac_ipq_reassemble, |
2917 .mpo_ipq_update = lomac_ipq_update, | 2877 .mpo_ipq_update = lomac_ipq_update, |
2918 .mpo_inpcb_sosetlabel = lomac_inpcb_sosetlabel, 2919 .mpo_vnode_execve_transition = lomac_vnode_execve_transition, 2920 .mpo_vnode_execve_will_transition = 2921 lomac_vnode_execve_will_transition, 2922 .mpo_proc_create_swapper = lomac_proc_create_swapper, 2923 .mpo_proc_create_init = lomac_proc_create_init, 2924 .mpo_cred_relabel = lomac_cred_relabel, 2925 .mpo_bpfdesc_check_receive = lomac_bpfdesc_check_receive, 2926 .mpo_cred_check_relabel = lomac_cred_check_relabel, 2927 .mpo_cred_check_visible = lomac_cred_check_visible, 2928 .mpo_ifnet_check_relabel = lomac_ifnet_check_relabel, 2929 .mpo_ifnet_check_transmit = lomac_ifnet_check_transmit, 2930 .mpo_inpcb_check_deliver = lomac_inpcb_check_deliver, | 2878 |
2931 .mpo_kld_check_load = lomac_kld_check_load, | 2879 .mpo_kld_check_load = lomac_kld_check_load, |
2880 2881 .mpo_mbuf_copy_label = lomac_copy_label, 2882 .mpo_mbuf_destroy_label = lomac_destroy_label, 2883 .mpo_mbuf_init_label = lomac_init_label_waitcheck, 2884 2885 .mpo_mount_create = lomac_mount_create, 2886 .mpo_mount_destroy_label = lomac_destroy_label, 2887 .mpo_mount_init_label = lomac_init_label, 2888 2889 .mpo_netatalk_aarp_send = lomac_netatalk_aarp_send, 2890 2891 .mpo_netinet_arp_send = lomac_netinet_arp_send, 2892 .mpo_netinet_firewall_reply = lomac_netinet_firewall_reply, 2893 .mpo_netinet_firewall_send = lomac_netinet_firewall_send, 2894 .mpo_netinet_fragment = lomac_netinet_fragment, 2895 .mpo_netinet_icmp_reply = lomac_netinet_icmp_reply, 2896 .mpo_netinet_igmp_send = lomac_netinet_igmp_send, 2897 2898 .mpo_netinet6_nd6_send = lomac_netinet6_nd6_send, 2899 |
|
2932 .mpo_pipe_check_ioctl = lomac_pipe_check_ioctl, 2933 .mpo_pipe_check_read = lomac_pipe_check_read, 2934 .mpo_pipe_check_relabel = lomac_pipe_check_relabel, 2935 .mpo_pipe_check_write = lomac_pipe_check_write, | 2900 .mpo_pipe_check_ioctl = lomac_pipe_check_ioctl, 2901 .mpo_pipe_check_read = lomac_pipe_check_read, 2902 .mpo_pipe_check_relabel = lomac_pipe_check_relabel, 2903 .mpo_pipe_check_write = lomac_pipe_check_write, |
2904 .mpo_pipe_copy_label = lomac_copy_label, 2905 .mpo_pipe_create = lomac_pipe_create, 2906 .mpo_pipe_destroy_label = lomac_destroy_label, 2907 .mpo_pipe_externalize_label = lomac_externalize_label, 2908 .mpo_pipe_init_label = lomac_init_label, 2909 .mpo_pipe_internalize_label = lomac_internalize_label, 2910 .mpo_pipe_relabel = lomac_pipe_relabel, 2911 2912 .mpo_priv_check = lomac_priv_check, 2913 |
|
2936 .mpo_proc_check_debug = lomac_proc_check_debug, 2937 .mpo_proc_check_sched = lomac_proc_check_sched, 2938 .mpo_proc_check_signal = lomac_proc_check_signal, | 2914 .mpo_proc_check_debug = lomac_proc_check_debug, 2915 .mpo_proc_check_sched = lomac_proc_check_sched, 2916 .mpo_proc_check_signal = lomac_proc_check_signal, |
2917 .mpo_proc_create_swapper = lomac_proc_create_swapper, 2918 .mpo_proc_create_init = lomac_proc_create_init, 2919 .mpo_proc_destroy_label = lomac_proc_destroy_label, 2920 .mpo_proc_init_label = lomac_proc_init_label, 2921 |
|
2939 .mpo_socket_check_deliver = lomac_socket_check_deliver, 2940 .mpo_socket_check_relabel = lomac_socket_check_relabel, 2941 .mpo_socket_check_visible = lomac_socket_check_visible, | 2922 .mpo_socket_check_deliver = lomac_socket_check_deliver, 2923 .mpo_socket_check_relabel = lomac_socket_check_relabel, 2924 .mpo_socket_check_visible = lomac_socket_check_visible, |
2925 .mpo_socket_copy_label = lomac_copy_label, 2926 .mpo_socket_create = lomac_socket_create, 2927 .mpo_socket_create_mbuf = lomac_socket_create_mbuf, 2928 .mpo_socket_destroy_label = lomac_destroy_label, 2929 .mpo_socket_externalize_label = lomac_externalize_label, 2930 .mpo_socket_init_label = lomac_init_label_waitcheck, 2931 .mpo_socket_internalize_label = lomac_internalize_label, 2932 .mpo_socket_newconn = lomac_socket_newconn, 2933 .mpo_socket_relabel = lomac_socket_relabel, 2934 2935 .mpo_socketpeer_destroy_label = lomac_destroy_label, 2936 .mpo_socketpeer_externalize_label = lomac_externalize_label, 2937 .mpo_socketpeer_init_label = lomac_init_label_waitcheck, 2938 .mpo_socketpeer_set_from_mbuf = lomac_socketpeer_set_from_mbuf, 2939 .mpo_socketpeer_set_from_socket = lomac_socketpeer_set_from_socket, 2940 2941 .mpo_syncache_create_mbuf = lomac_syncache_create_mbuf, 2942 |
|
2942 .mpo_system_check_acct = lomac_system_check_acct, 2943 .mpo_system_check_auditctl = lomac_system_check_auditctl, 2944 .mpo_system_check_swapoff = lomac_system_check_swapoff, 2945 .mpo_system_check_swapon = lomac_system_check_swapon, 2946 .mpo_system_check_sysctl = lomac_system_check_sysctl, | 2943 .mpo_system_check_acct = lomac_system_check_acct, 2944 .mpo_system_check_auditctl = lomac_system_check_auditctl, 2945 .mpo_system_check_swapoff = lomac_system_check_swapoff, 2946 .mpo_system_check_swapon = lomac_system_check_swapon, 2947 .mpo_system_check_sysctl = lomac_system_check_sysctl, |
2948 2949 .mpo_thread_userret = lomac_thread_userret, 2950 2951 .mpo_vnode_associate_extattr = lomac_vnode_associate_extattr, 2952 .mpo_vnode_associate_singlelabel = lomac_vnode_associate_singlelabel, |
|
2947 .mpo_vnode_check_access = lomac_vnode_check_open, 2948 .mpo_vnode_check_create = lomac_vnode_check_create, 2949 .mpo_vnode_check_deleteacl = lomac_vnode_check_deleteacl, 2950 .mpo_vnode_check_link = lomac_vnode_check_link, 2951 .mpo_vnode_check_mmap = lomac_vnode_check_mmap, 2952 .mpo_vnode_check_mmap_downgrade = lomac_vnode_check_mmap_downgrade, 2953 .mpo_vnode_check_open = lomac_vnode_check_open, 2954 .mpo_vnode_check_read = lomac_vnode_check_read, --- 4 unchanged lines hidden (view full) --- 2959 .mpo_vnode_check_setacl = lomac_vnode_check_setacl, 2960 .mpo_vnode_check_setextattr = lomac_vnode_check_setextattr, 2961 .mpo_vnode_check_setflags = lomac_vnode_check_setflags, 2962 .mpo_vnode_check_setmode = lomac_vnode_check_setmode, 2963 .mpo_vnode_check_setowner = lomac_vnode_check_setowner, 2964 .mpo_vnode_check_setutimes = lomac_vnode_check_setutimes, 2965 .mpo_vnode_check_unlink = lomac_vnode_check_unlink, 2966 .mpo_vnode_check_write = lomac_vnode_check_write, | 2953 .mpo_vnode_check_access = lomac_vnode_check_open, 2954 .mpo_vnode_check_create = lomac_vnode_check_create, 2955 .mpo_vnode_check_deleteacl = lomac_vnode_check_deleteacl, 2956 .mpo_vnode_check_link = lomac_vnode_check_link, 2957 .mpo_vnode_check_mmap = lomac_vnode_check_mmap, 2958 .mpo_vnode_check_mmap_downgrade = lomac_vnode_check_mmap_downgrade, 2959 .mpo_vnode_check_open = lomac_vnode_check_open, 2960 .mpo_vnode_check_read = lomac_vnode_check_read, --- 4 unchanged lines hidden (view full) --- 2965 .mpo_vnode_check_setacl = lomac_vnode_check_setacl, 2966 .mpo_vnode_check_setextattr = lomac_vnode_check_setextattr, 2967 .mpo_vnode_check_setflags = lomac_vnode_check_setflags, 2968 .mpo_vnode_check_setmode = lomac_vnode_check_setmode, 2969 .mpo_vnode_check_setowner = lomac_vnode_check_setowner, 2970 .mpo_vnode_check_setutimes = lomac_vnode_check_setutimes, 2971 .mpo_vnode_check_unlink = lomac_vnode_check_unlink, 2972 .mpo_vnode_check_write = lomac_vnode_check_write, |
2967 .mpo_thread_userret = lomac_thread_userret, 2968 .mpo_netatalk_aarp_send = lomac_netatalk_aarp_send, 2969 .mpo_netinet_arp_send = lomac_netinet_arp_send, 2970 .mpo_netinet_firewall_reply = lomac_netinet_firewall_reply, 2971 .mpo_netinet_firewall_send = lomac_netinet_firewall_send, 2972 .mpo_netinet_icmp_reply = lomac_netinet_icmp_reply, 2973 .mpo_netinet_igmp_send = lomac_netinet_igmp_send, 2974 .mpo_netinet6_nd6_send = lomac_netinet6_nd6_send, 2975 .mpo_priv_check = lomac_priv_check, | 2973 .mpo_vnode_copy_label = lomac_copy_label, 2974 .mpo_vnode_create_extattr = lomac_vnode_create_extattr, 2975 .mpo_vnode_destroy_label = lomac_destroy_label, 2976 .mpo_vnode_execve_transition = lomac_vnode_execve_transition, 2977 .mpo_vnode_execve_will_transition = lomac_vnode_execve_will_transition, 2978 .mpo_vnode_externalize_label = lomac_externalize_label, 2979 .mpo_vnode_init_label = lomac_init_label, 2980 .mpo_vnode_internalize_label = lomac_internalize_label, 2981 .mpo_vnode_relabel = lomac_vnode_relabel, 2982 .mpo_vnode_setlabel_extattr = lomac_vnode_setlabel_extattr, |
2976}; 2977 2978MAC_POLICY_SET(&lomac_ops, mac_lomac, "TrustedBSD MAC/LOMAC", 2979 MPC_LOADTIME_FLAG_NOTLATE | MPC_LOADTIME_FLAG_LABELMBUFS, &lomac_slot); | 2983}; 2984 2985MAC_POLICY_SET(&lomac_ops, mac_lomac, "TrustedBSD MAC/LOMAC", 2986 MPC_LOADTIME_FLAG_NOTLATE | MPC_LOADTIME_FLAG_LABELMBUFS, &lomac_slot); |