39
40#include "opt_mac.h"
41
42#include <sys/param.h>
43#include <sys/kernel.h>
44#include <sys/lock.h>
45#include <sys/malloc.h>
46#include <sys/mutex.h>
47#include <sys/mac.h>
48#include <sys/sbuf.h>
49#include <sys/systm.h>
50#include <sys/mount.h>
51#include <sys/file.h>
52#include <sys/namei.h>
53#include <sys/socket.h>
54#include <sys/socketvar.h>
55#include <sys/sysctl.h>
56
57#include <sys/mac_policy.h>
58
59#include <net/bpfdesc.h>
60#include <net/if.h>
61#include <net/if_var.h>
62
63#include <netinet/in.h>
64#include <netinet/ip_var.h>
65
66#include <security/mac/mac_internal.h>
67
68static int mac_enforce_network = 1;
69SYSCTL_INT(_security_mac, OID_AUTO, enforce_network, CTLFLAG_RW,
70 &mac_enforce_network, 0, "Enforce MAC policy on network packets");
71TUNABLE_INT("security.mac.enforce_network", &mac_enforce_network);
72
73static int mac_enforce_socket = 1;
74SYSCTL_INT(_security_mac, OID_AUTO, enforce_socket, CTLFLAG_RW,
75 &mac_enforce_socket, 0, "Enforce MAC policy on socket operations");
76TUNABLE_INT("security.mac.enforce_socket", &mac_enforce_socket);
77
78#ifdef MAC_DEBUG
79static unsigned int nmacmbufs, nmacifnets, nmacbpfdescs, nmacsockets,
80 nmacipqs;
81
82SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, mbufs, CTLFLAG_RD,
83 &nmacmbufs, 0, "number of mbufs in use");
84SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, ifnets, CTLFLAG_RD,
85 &nmacifnets, 0, "number of ifnets in use");
86SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, ipqs, CTLFLAG_RD,
87 &nmacipqs, 0, "number of ipqs in use");
88SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, bpfdescs, CTLFLAG_RD,
89 &nmacbpfdescs, 0, "number of bpfdescs in use");
90SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, sockets, CTLFLAG_RD,
91 &nmacsockets, 0, "number of sockets in use");
92#endif
93
94static void mac_socket_label_free(struct label *label);
95
96
97static struct label *
98mbuf_to_label(struct mbuf *mbuf)
99{
100 struct m_tag *tag;
101 struct label *label;
102
103 tag = m_tag_find(mbuf, PACKET_TAG_MACLABEL, NULL);
104 label = (struct label *)(tag+1);
105
106 return (label);
107}
108
109static struct label *
110mac_bpfdesc_label_alloc(void)
111{
112 struct label *label;
113
114 label = mac_labelzone_alloc(M_WAITOK);
115 MAC_PERFORM(init_bpfdesc_label, label);
116 MAC_DEBUG_COUNTER_INC(&nmacbpfdescs);
117 return (label);
118}
119
120void
121mac_init_bpfdesc(struct bpf_d *bpf_d)
122{
123
124 bpf_d->bd_label = mac_bpfdesc_label_alloc();
125}
126
127static struct label *
128mac_ifnet_label_alloc(void)
129{
130 struct label *label;
131
132 label = mac_labelzone_alloc(M_WAITOK);
133 MAC_PERFORM(init_ifnet_label, label);
134 MAC_DEBUG_COUNTER_INC(&nmacifnets);
135 return (label);
136}
137
138void
139mac_init_ifnet(struct ifnet *ifp)
140{
141
142 ifp->if_label = mac_ifnet_label_alloc();
143}
144
145static struct label *
146mac_ipq_label_alloc(int flag)
147{
148 struct label *label;
149 int error;
150
151 label = mac_labelzone_alloc(flag);
152 if (label == NULL)
153 return (NULL);
154
155 MAC_CHECK(init_ipq_label, label, flag);
156 if (error) {
157 MAC_PERFORM(destroy_ipq_label, label);
158 mac_labelzone_free(label);
159 return (NULL);
160 }
161 MAC_DEBUG_COUNTER_INC(&nmacipqs);
162 return (label);
163}
164
165int
166mac_init_ipq(struct ipq *ipq, int flag)
167{
168
169 ipq->ipq_label = mac_ipq_label_alloc(flag);
170 if (ipq->ipq_label == NULL)
171 return (ENOMEM);
172 return (0);
173}
174
175int
176mac_init_mbuf_tag(struct m_tag *tag, int flag)
177{
178 struct label *label;
179 int error;
180
181 label = (struct label *) (tag + 1);
182 mac_init_label(label);
183
184 MAC_CHECK(init_mbuf_label, label, flag);
185 if (error) {
186 MAC_PERFORM(destroy_mbuf_label, label);
187 mac_destroy_label(label);
188 } else {
189 MAC_DEBUG_COUNTER_INC(&nmacmbufs);
190 }
191 return (error);
192}
193
194int
195mac_init_mbuf(struct mbuf *m, int flag)
196{
197 struct m_tag *tag;
198 int error;
199
200 M_ASSERTPKTHDR(m);
201
202#ifndef MAC_ALWAYS_LABEL_MBUF
203 /*
204 * If conditionally allocating mbuf labels, don't allocate unless
205 * they are required.
206 */
207 if (!mac_labelmbufs)
208 return (0);
209#endif
210 tag = m_tag_get(PACKET_TAG_MACLABEL, sizeof(struct label),
211 flag);
212 if (tag == NULL)
213 return (ENOMEM);
214 error = mac_init_mbuf_tag(tag, flag);
215 if (error) {
216 m_tag_free(tag);
217 return (error);
218 }
219 m_tag_prepend(m, tag);
220 return (0);
221}
222
223static struct label *
224mac_socket_label_alloc(int flag)
225{
226 struct label *label;
227 int error;
228
229 label = mac_labelzone_alloc(flag);
230 if (label == NULL)
231 return (NULL);
232
233 MAC_CHECK(init_socket_label, label, flag);
234 if (error) {
235 MAC_PERFORM(destroy_socket_label, label);
236 mac_labelzone_free(label);
237 return (NULL);
238 }
239 MAC_DEBUG_COUNTER_INC(&nmacsockets);
240 return (label);
241}
242
243static struct label *
244mac_socket_peer_label_alloc(int flag)
245{
246 struct label *label;
247 int error;
248
249 label = mac_labelzone_alloc(flag);
250 if (label == NULL)
251 return (NULL);
252
253 MAC_CHECK(init_socket_peer_label, label, flag);
254 if (error) {
255 MAC_PERFORM(destroy_socket_peer_label, label);
256 mac_labelzone_free(label);
257 return (NULL);
258 }
259 MAC_DEBUG_COUNTER_INC(&nmacsockets);
260 return (label);
261}
262
263int
264mac_init_socket(struct socket *so, int flag)
265{
266
267 so->so_label = mac_socket_label_alloc(flag);
268 if (so->so_label == NULL)
269 return (ENOMEM);
270 so->so_peerlabel = mac_socket_peer_label_alloc(flag);
271 if (so->so_peerlabel == NULL) {
272 mac_socket_label_free(so->so_label);
273 so->so_label = NULL;
274 return (ENOMEM);
275 }
276 return (0);
277}
278
279static void
280mac_bpfdesc_label_free(struct label *label)
281{
282
283 MAC_PERFORM(destroy_bpfdesc_label, label);
284 mac_labelzone_free(label);
285 MAC_DEBUG_COUNTER_DEC(&nmacbpfdescs);
286}
287
288void
289mac_destroy_bpfdesc(struct bpf_d *bpf_d)
290{
291
292 mac_bpfdesc_label_free(bpf_d->bd_label);
293 bpf_d->bd_label = NULL;
294}
295
296static void
297mac_ifnet_label_free(struct label *label)
298{
299
300 MAC_PERFORM(destroy_ifnet_label, label);
301 mac_labelzone_free(label);
302 MAC_DEBUG_COUNTER_DEC(&nmacifnets);
303}
304
305void
306mac_destroy_ifnet(struct ifnet *ifp)
307{
308
309 mac_ifnet_label_free(ifp->if_label);
310 ifp->if_label = NULL;
311}
312
313static void
314mac_ipq_label_free(struct label *label)
315{
316
317 MAC_PERFORM(destroy_ipq_label, label);
318 mac_labelzone_free(label);
319 MAC_DEBUG_COUNTER_DEC(&nmacipqs);
320}
321
322void
323mac_destroy_ipq(struct ipq *ipq)
324{
325
326 mac_ipq_label_free(ipq->ipq_label);
327 ipq->ipq_label = NULL;
328}
329
330void
331mac_destroy_mbuf_tag(struct m_tag *tag)
332{
333 struct label *label;
334
335 label = (struct label *)(tag+1);
336
337 MAC_PERFORM(destroy_mbuf_label, label);
338 mac_destroy_label(label);
339 MAC_DEBUG_COUNTER_DEC(&nmacmbufs);
340}
341
342static void
343mac_socket_label_free(struct label *label)
344{
345
346 MAC_PERFORM(destroy_socket_label, label);
347 mac_labelzone_free(label);
348 MAC_DEBUG_COUNTER_DEC(&nmacsockets);
349}
350
351static void
352mac_socket_peer_label_free(struct label *label)
353{
354
355 MAC_PERFORM(destroy_socket_peer_label, label);
356 mac_labelzone_free(label);
357 MAC_DEBUG_COUNTER_DEC(&nmacsockets);
358}
359
360void
361mac_destroy_socket(struct socket *socket)
362{
363
364 mac_socket_label_free(socket->so_label);
365 socket->so_label = NULL;
366 mac_socket_peer_label_free(socket->so_peerlabel);
367 socket->so_peerlabel = NULL;
368}
369
370void
371mac_copy_mbuf_tag(struct m_tag *src, struct m_tag *dest)
372{
373 struct label *src_label, *dest_label;
374
375 src_label = (struct label *)(src+1);
376 dest_label = (struct label *)(dest+1);
377
378 /*
379 * mac_init_mbuf_tag() is called on the target tag in
380 * m_tag_copy(), so we don't need to call it here.
381 */
382 MAC_PERFORM(copy_mbuf_label, src_label, dest_label);
383}
384
385static int
386mac_externalize_ifnet_label(struct label *label, char *elements,
387 char *outbuf, size_t outbuflen)
388{
389 int error;
390
391 MAC_EXTERNALIZE(ifnet, label, elements, outbuf, outbuflen);
392
393 return (error);
394}
395
396static int
397mac_externalize_socket_label(struct label *label, char *elements,
398 char *outbuf, size_t outbuflen)
399{
400 int error;
401
402 MAC_EXTERNALIZE(socket, label, elements, outbuf, outbuflen);
403
404 return (error);
405}
406
407static int
408mac_externalize_socket_peer_label(struct label *label, char *elements,
409 char *outbuf, size_t outbuflen)
410{
411 int error;
412
413 MAC_EXTERNALIZE(socket_peer, label, elements, outbuf, outbuflen);
414
415 return (error);
416}
417
418static int
419mac_internalize_ifnet_label(struct label *label, char *string)
420{
421 int error;
422
423 MAC_INTERNALIZE(ifnet, label, string);
424
425 return (error);
426}
427
428static int
429mac_internalize_socket_label(struct label *label, char *string)
430{
431 int error;
432
433 MAC_INTERNALIZE(socket, label, string);
434
435 return (error);
436}
437
438void
439mac_create_ifnet(struct ifnet *ifnet)
440{
441
442 MAC_PERFORM(create_ifnet, ifnet, ifnet->if_label);
443}
444
445void
446mac_create_bpfdesc(struct ucred *cred, struct bpf_d *bpf_d)
447{
448
449 MAC_PERFORM(create_bpfdesc, cred, bpf_d, bpf_d->bd_label);
450}
451
452void
453mac_create_socket(struct ucred *cred, struct socket *socket)
454{
455
456 MAC_PERFORM(create_socket, cred, socket, socket->so_label);
457}
458
459void
460mac_create_socket_from_socket(struct socket *oldsocket,
461 struct socket *newsocket)
462{
463
464 MAC_PERFORM(create_socket_from_socket, oldsocket, oldsocket->so_label,
465 newsocket, newsocket->so_label);
466}
467
468static void
469mac_relabel_socket(struct ucred *cred, struct socket *socket,
470 struct label *newlabel)
471{
472
473 MAC_PERFORM(relabel_socket, cred, socket, socket->so_label, newlabel);
474}
475
476void
477mac_set_socket_peer_from_mbuf(struct mbuf *mbuf, struct socket *socket)
478{
479 struct label *label;
480
481 label = mbuf_to_label(mbuf);
482
483 MAC_PERFORM(set_socket_peer_from_mbuf, mbuf, label, socket,
484 socket->so_peerlabel);
485}
486
487void
488mac_set_socket_peer_from_socket(struct socket *oldsocket,
489 struct socket *newsocket)
490{
491
492 MAC_PERFORM(set_socket_peer_from_socket, oldsocket,
493 oldsocket->so_label, newsocket, newsocket->so_peerlabel);
494}
495
496void
497mac_create_datagram_from_ipq(struct ipq *ipq, struct mbuf *datagram)
498{
499 struct label *label;
500
501 label = mbuf_to_label(datagram);
502
503 MAC_PERFORM(create_datagram_from_ipq, ipq, ipq->ipq_label,
504 datagram, label);
505}
506
507void
508mac_create_fragment(struct mbuf *datagram, struct mbuf *fragment)
509{
510 struct label *datagramlabel, *fragmentlabel;
511
512 datagramlabel = mbuf_to_label(datagram);
513 fragmentlabel = mbuf_to_label(fragment);
514
515 MAC_PERFORM(create_fragment, datagram, datagramlabel, fragment,
516 fragmentlabel);
517}
518
519void
520mac_create_ipq(struct mbuf *fragment, struct ipq *ipq)
521{
522 struct label *label;
523
524 label = mbuf_to_label(fragment);
525
526 MAC_PERFORM(create_ipq, fragment, label, ipq, ipq->ipq_label);
527}
528
529void
530mac_create_mbuf_from_mbuf(struct mbuf *oldmbuf, struct mbuf *newmbuf)
531{
532 struct label *oldmbuflabel, *newmbuflabel;
533
534 oldmbuflabel = mbuf_to_label(oldmbuf);
535 newmbuflabel = mbuf_to_label(newmbuf);
536
537 MAC_PERFORM(create_mbuf_from_mbuf, oldmbuf, oldmbuflabel, newmbuf,
538 newmbuflabel);
539}
540
541void
542mac_create_mbuf_from_bpfdesc(struct bpf_d *bpf_d, struct mbuf *mbuf)
543{
544 struct label *label;
545
546 label = mbuf_to_label(mbuf);
547
548 MAC_PERFORM(create_mbuf_from_bpfdesc, bpf_d, bpf_d->bd_label, mbuf,
549 label);
550}
551
552void
553mac_create_mbuf_linklayer(struct ifnet *ifnet, struct mbuf *mbuf)
554{
555 struct label *label;
556
557 label = mbuf_to_label(mbuf);
558
559 MAC_PERFORM(create_mbuf_linklayer, ifnet, ifnet->if_label, mbuf,
560 label);
561}
562
563void
564mac_create_mbuf_from_ifnet(struct ifnet *ifnet, struct mbuf *mbuf)
565{
566 struct label *label;
567
568 label = mbuf_to_label(mbuf);
569
570 MAC_PERFORM(create_mbuf_from_ifnet, ifnet, ifnet->if_label, mbuf,
571 label);
572}
573
574void
575mac_create_mbuf_multicast_encap(struct mbuf *oldmbuf, struct ifnet *ifnet,
576 struct mbuf *newmbuf)
577{
578 struct label *oldmbuflabel, *newmbuflabel;
579
580 oldmbuflabel = mbuf_to_label(oldmbuf);
581 newmbuflabel = mbuf_to_label(newmbuf);
582
583 MAC_PERFORM(create_mbuf_multicast_encap, oldmbuf, oldmbuflabel,
584 ifnet, ifnet->if_label, newmbuf, newmbuflabel);
585}
586
587void
588mac_create_mbuf_netlayer(struct mbuf *oldmbuf, struct mbuf *newmbuf)
589{
590 struct label *oldmbuflabel, *newmbuflabel;
591
592 oldmbuflabel = mbuf_to_label(oldmbuf);
593 newmbuflabel = mbuf_to_label(newmbuf);
594
595 MAC_PERFORM(create_mbuf_netlayer, oldmbuf, oldmbuflabel, newmbuf,
596 newmbuflabel);
597}
598
599int
600mac_fragment_match(struct mbuf *fragment, struct ipq *ipq)
601{
602 struct label *label;
603 int result;
604
605 label = mbuf_to_label(fragment);
606
607 result = 1;
608 MAC_BOOLEAN(fragment_match, &&, fragment, label, ipq,
609 ipq->ipq_label);
610
611 return (result);
612}
613
614void
615mac_reflect_mbuf_icmp(struct mbuf *m)
616{
617 struct label *label;
618
619 label = mbuf_to_label(m);
620
621 MAC_PERFORM(reflect_mbuf_icmp, m, label);
622}
623void
624mac_reflect_mbuf_tcp(struct mbuf *m)
625{
626 struct label *label;
627
628 label = mbuf_to_label(m);
629
630 MAC_PERFORM(reflect_mbuf_tcp, m, label);
631}
632
633void
634mac_update_ipq(struct mbuf *fragment, struct ipq *ipq)
635{
636 struct label *label;
637
638 label = mbuf_to_label(fragment);
639
640 MAC_PERFORM(update_ipq, fragment, label, ipq, ipq->ipq_label);
641}
642
643void
644mac_create_mbuf_from_socket(struct socket *socket, struct mbuf *mbuf)
645{
646 struct label *label;
647
648 label = mbuf_to_label(mbuf);
649
650 MAC_PERFORM(create_mbuf_from_socket, socket, socket->so_label, mbuf,
651 label);
652}
653
654int
655mac_check_bpfdesc_receive(struct bpf_d *bpf_d, struct ifnet *ifnet)
656{
657 int error;
658
659 if (!mac_enforce_network)
660 return (0);
661
662 MAC_CHECK(check_bpfdesc_receive, bpf_d, bpf_d->bd_label, ifnet,
663 ifnet->if_label);
664
665 return (error);
666}
667
668int
669mac_check_ifnet_transmit(struct ifnet *ifnet, struct mbuf *mbuf)
670{
671 struct label *label;
672 int error;
673
674 M_ASSERTPKTHDR(mbuf);
675
676 if (!mac_enforce_network)
677 return (0);
678
679 label = mbuf_to_label(mbuf);
680
681 MAC_CHECK(check_ifnet_transmit, ifnet, ifnet->if_label, mbuf,
682 label);
683
684 return (error);
685}
686
687int
688mac_check_socket_bind(struct ucred *ucred, struct socket *socket,
689 struct sockaddr *sockaddr)
690{
691 int error;
692
693 if (!mac_enforce_socket)
694 return (0);
695
696 MAC_CHECK(check_socket_bind, ucred, socket, socket->so_label,
697 sockaddr);
698
699 return (error);
700}
701
702int
703mac_check_socket_connect(struct ucred *cred, struct socket *socket,
704 struct sockaddr *sockaddr)
705{
706 int error;
707
708 if (!mac_enforce_socket)
709 return (0);
710
711 MAC_CHECK(check_socket_connect, cred, socket, socket->so_label,
712 sockaddr);
713
714 return (error);
715}
716
717int
718mac_check_socket_deliver(struct socket *socket, struct mbuf *mbuf)
719{
720 struct label *label;
721 int error;
722
723 if (!mac_enforce_socket)
724 return (0);
725
726 label = mbuf_to_label(mbuf);
727
728 MAC_CHECK(check_socket_deliver, socket, socket->so_label, mbuf,
729 label);
730
731 return (error);
732}
733
734int
735mac_check_socket_listen(struct ucred *cred, struct socket *socket)
736{
737 int error;
738
739 if (!mac_enforce_socket)
740 return (0);
741
742 MAC_CHECK(check_socket_listen, cred, socket, socket->so_label);
743 return (error);
744}
745
746int
747mac_check_socket_receive(struct ucred *cred, struct socket *so)
748{
749 int error;
750
751 if (!mac_enforce_socket)
752 return (0);
753
754 MAC_CHECK(check_socket_receive, cred, so, so->so_label);
755
756 return (error);
757}
758
759static int
760mac_check_socket_relabel(struct ucred *cred, struct socket *socket,
761 struct label *newlabel)
762{
763 int error;
764
765 MAC_CHECK(check_socket_relabel, cred, socket, socket->so_label,
766 newlabel);
767
768 return (error);
769}
770
771int
772mac_check_socket_send(struct ucred *cred, struct socket *so)
773{
774 int error;
775
776 if (!mac_enforce_socket)
777 return (0);
778
779 MAC_CHECK(check_socket_send, cred, so, so->so_label);
780
781 return (error);
782}
783
784int
785mac_check_socket_visible(struct ucred *cred, struct socket *socket)
786{
787 int error;
788
789 if (!mac_enforce_socket)
790 return (0);
791
792 MAC_CHECK(check_socket_visible, cred, socket, socket->so_label);
793
794 return (error);
795}
796
797int
798mac_ioctl_ifnet_get(struct ucred *cred, struct ifreq *ifr,
799 struct ifnet *ifnet)
800{
801 char *elements, *buffer;
802 struct mac mac;
803 int error;
804
805 error = copyin(ifr->ifr_ifru.ifru_data, &mac, sizeof(mac));
806 if (error)
807 return (error);
808
809 error = mac_check_structmac_consistent(&mac);
810 if (error)
811 return (error);
812
813 elements = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK);
814 error = copyinstr(mac.m_string, elements, mac.m_buflen, NULL);
815 if (error) {
816 free(elements, M_MACTEMP);
817 return (error);
818 }
819
820 buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK | M_ZERO);
821 error = mac_externalize_ifnet_label(ifnet->if_label, elements,
822 buffer, mac.m_buflen);
823 if (error == 0)
824 error = copyout(buffer, mac.m_string, strlen(buffer)+1);
825
826 free(buffer, M_MACTEMP);
827 free(elements, M_MACTEMP);
828
829 return (error);
830}
831
832int
833mac_ioctl_ifnet_set(struct ucred *cred, struct ifreq *ifr,
834 struct ifnet *ifnet)
835{
836 struct label *intlabel;
837 struct mac mac;
838 char *buffer;
839 int error;
840
841 error = copyin(ifr->ifr_ifru.ifru_data, &mac, sizeof(mac));
842 if (error)
843 return (error);
844
845 error = mac_check_structmac_consistent(&mac);
846 if (error)
847 return (error);
848
849 buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK);
850 error = copyinstr(mac.m_string, buffer, mac.m_buflen, NULL);
851 if (error) {
852 free(buffer, M_MACTEMP);
853 return (error);
854 }
855
856 intlabel = mac_ifnet_label_alloc();
857 error = mac_internalize_ifnet_label(intlabel, buffer);
858 free(buffer, M_MACTEMP);
859 if (error) {
860 mac_ifnet_label_free(intlabel);
861 return (error);
862 }
863
864 /*
865 * XXX: Note that this is a redundant privilege check, since
866 * policies impose this check themselves if required by the
867 * policy. Eventually, this should go away.
868 */
869 error = suser_cred(cred, 0);
870 if (error) {
871 mac_ifnet_label_free(intlabel);
872 return (error);
873 }
874
875 MAC_CHECK(check_ifnet_relabel, cred, ifnet, ifnet->if_label,
876 intlabel);
877 if (error) {
878 mac_ifnet_label_free(intlabel);
879 return (error);
880 }
881
882 MAC_PERFORM(relabel_ifnet, cred, ifnet, ifnet->if_label, intlabel);
883
884 mac_ifnet_label_free(intlabel);
885 return (0);
886}
887
888int
| 39
40#include "opt_mac.h"
41
42#include <sys/param.h>
43#include <sys/kernel.h>
44#include <sys/lock.h>
45#include <sys/malloc.h>
46#include <sys/mutex.h>
47#include <sys/mac.h>
48#include <sys/sbuf.h>
49#include <sys/systm.h>
50#include <sys/mount.h>
51#include <sys/file.h>
52#include <sys/namei.h>
53#include <sys/socket.h>
54#include <sys/socketvar.h>
55#include <sys/sysctl.h>
56
57#include <sys/mac_policy.h>
58
59#include <net/bpfdesc.h>
60#include <net/if.h>
61#include <net/if_var.h>
62
63#include <netinet/in.h>
64#include <netinet/ip_var.h>
65
66#include <security/mac/mac_internal.h>
67
68static int mac_enforce_network = 1;
69SYSCTL_INT(_security_mac, OID_AUTO, enforce_network, CTLFLAG_RW,
70 &mac_enforce_network, 0, "Enforce MAC policy on network packets");
71TUNABLE_INT("security.mac.enforce_network", &mac_enforce_network);
72
73static int mac_enforce_socket = 1;
74SYSCTL_INT(_security_mac, OID_AUTO, enforce_socket, CTLFLAG_RW,
75 &mac_enforce_socket, 0, "Enforce MAC policy on socket operations");
76TUNABLE_INT("security.mac.enforce_socket", &mac_enforce_socket);
77
78#ifdef MAC_DEBUG
79static unsigned int nmacmbufs, nmacifnets, nmacbpfdescs, nmacsockets,
80 nmacipqs;
81
82SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, mbufs, CTLFLAG_RD,
83 &nmacmbufs, 0, "number of mbufs in use");
84SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, ifnets, CTLFLAG_RD,
85 &nmacifnets, 0, "number of ifnets in use");
86SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, ipqs, CTLFLAG_RD,
87 &nmacipqs, 0, "number of ipqs in use");
88SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, bpfdescs, CTLFLAG_RD,
89 &nmacbpfdescs, 0, "number of bpfdescs in use");
90SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, sockets, CTLFLAG_RD,
91 &nmacsockets, 0, "number of sockets in use");
92#endif
93
94static void mac_socket_label_free(struct label *label);
95
96
97static struct label *
98mbuf_to_label(struct mbuf *mbuf)
99{
100 struct m_tag *tag;
101 struct label *label;
102
103 tag = m_tag_find(mbuf, PACKET_TAG_MACLABEL, NULL);
104 label = (struct label *)(tag+1);
105
106 return (label);
107}
108
109static struct label *
110mac_bpfdesc_label_alloc(void)
111{
112 struct label *label;
113
114 label = mac_labelzone_alloc(M_WAITOK);
115 MAC_PERFORM(init_bpfdesc_label, label);
116 MAC_DEBUG_COUNTER_INC(&nmacbpfdescs);
117 return (label);
118}
119
120void
121mac_init_bpfdesc(struct bpf_d *bpf_d)
122{
123
124 bpf_d->bd_label = mac_bpfdesc_label_alloc();
125}
126
127static struct label *
128mac_ifnet_label_alloc(void)
129{
130 struct label *label;
131
132 label = mac_labelzone_alloc(M_WAITOK);
133 MAC_PERFORM(init_ifnet_label, label);
134 MAC_DEBUG_COUNTER_INC(&nmacifnets);
135 return (label);
136}
137
138void
139mac_init_ifnet(struct ifnet *ifp)
140{
141
142 ifp->if_label = mac_ifnet_label_alloc();
143}
144
145static struct label *
146mac_ipq_label_alloc(int flag)
147{
148 struct label *label;
149 int error;
150
151 label = mac_labelzone_alloc(flag);
152 if (label == NULL)
153 return (NULL);
154
155 MAC_CHECK(init_ipq_label, label, flag);
156 if (error) {
157 MAC_PERFORM(destroy_ipq_label, label);
158 mac_labelzone_free(label);
159 return (NULL);
160 }
161 MAC_DEBUG_COUNTER_INC(&nmacipqs);
162 return (label);
163}
164
165int
166mac_init_ipq(struct ipq *ipq, int flag)
167{
168
169 ipq->ipq_label = mac_ipq_label_alloc(flag);
170 if (ipq->ipq_label == NULL)
171 return (ENOMEM);
172 return (0);
173}
174
175int
176mac_init_mbuf_tag(struct m_tag *tag, int flag)
177{
178 struct label *label;
179 int error;
180
181 label = (struct label *) (tag + 1);
182 mac_init_label(label);
183
184 MAC_CHECK(init_mbuf_label, label, flag);
185 if (error) {
186 MAC_PERFORM(destroy_mbuf_label, label);
187 mac_destroy_label(label);
188 } else {
189 MAC_DEBUG_COUNTER_INC(&nmacmbufs);
190 }
191 return (error);
192}
193
194int
195mac_init_mbuf(struct mbuf *m, int flag)
196{
197 struct m_tag *tag;
198 int error;
199
200 M_ASSERTPKTHDR(m);
201
202#ifndef MAC_ALWAYS_LABEL_MBUF
203 /*
204 * If conditionally allocating mbuf labels, don't allocate unless
205 * they are required.
206 */
207 if (!mac_labelmbufs)
208 return (0);
209#endif
210 tag = m_tag_get(PACKET_TAG_MACLABEL, sizeof(struct label),
211 flag);
212 if (tag == NULL)
213 return (ENOMEM);
214 error = mac_init_mbuf_tag(tag, flag);
215 if (error) {
216 m_tag_free(tag);
217 return (error);
218 }
219 m_tag_prepend(m, tag);
220 return (0);
221}
222
223static struct label *
224mac_socket_label_alloc(int flag)
225{
226 struct label *label;
227 int error;
228
229 label = mac_labelzone_alloc(flag);
230 if (label == NULL)
231 return (NULL);
232
233 MAC_CHECK(init_socket_label, label, flag);
234 if (error) {
235 MAC_PERFORM(destroy_socket_label, label);
236 mac_labelzone_free(label);
237 return (NULL);
238 }
239 MAC_DEBUG_COUNTER_INC(&nmacsockets);
240 return (label);
241}
242
243static struct label *
244mac_socket_peer_label_alloc(int flag)
245{
246 struct label *label;
247 int error;
248
249 label = mac_labelzone_alloc(flag);
250 if (label == NULL)
251 return (NULL);
252
253 MAC_CHECK(init_socket_peer_label, label, flag);
254 if (error) {
255 MAC_PERFORM(destroy_socket_peer_label, label);
256 mac_labelzone_free(label);
257 return (NULL);
258 }
259 MAC_DEBUG_COUNTER_INC(&nmacsockets);
260 return (label);
261}
262
263int
264mac_init_socket(struct socket *so, int flag)
265{
266
267 so->so_label = mac_socket_label_alloc(flag);
268 if (so->so_label == NULL)
269 return (ENOMEM);
270 so->so_peerlabel = mac_socket_peer_label_alloc(flag);
271 if (so->so_peerlabel == NULL) {
272 mac_socket_label_free(so->so_label);
273 so->so_label = NULL;
274 return (ENOMEM);
275 }
276 return (0);
277}
278
279static void
280mac_bpfdesc_label_free(struct label *label)
281{
282
283 MAC_PERFORM(destroy_bpfdesc_label, label);
284 mac_labelzone_free(label);
285 MAC_DEBUG_COUNTER_DEC(&nmacbpfdescs);
286}
287
288void
289mac_destroy_bpfdesc(struct bpf_d *bpf_d)
290{
291
292 mac_bpfdesc_label_free(bpf_d->bd_label);
293 bpf_d->bd_label = NULL;
294}
295
296static void
297mac_ifnet_label_free(struct label *label)
298{
299
300 MAC_PERFORM(destroy_ifnet_label, label);
301 mac_labelzone_free(label);
302 MAC_DEBUG_COUNTER_DEC(&nmacifnets);
303}
304
305void
306mac_destroy_ifnet(struct ifnet *ifp)
307{
308
309 mac_ifnet_label_free(ifp->if_label);
310 ifp->if_label = NULL;
311}
312
313static void
314mac_ipq_label_free(struct label *label)
315{
316
317 MAC_PERFORM(destroy_ipq_label, label);
318 mac_labelzone_free(label);
319 MAC_DEBUG_COUNTER_DEC(&nmacipqs);
320}
321
322void
323mac_destroy_ipq(struct ipq *ipq)
324{
325
326 mac_ipq_label_free(ipq->ipq_label);
327 ipq->ipq_label = NULL;
328}
329
330void
331mac_destroy_mbuf_tag(struct m_tag *tag)
332{
333 struct label *label;
334
335 label = (struct label *)(tag+1);
336
337 MAC_PERFORM(destroy_mbuf_label, label);
338 mac_destroy_label(label);
339 MAC_DEBUG_COUNTER_DEC(&nmacmbufs);
340}
341
342static void
343mac_socket_label_free(struct label *label)
344{
345
346 MAC_PERFORM(destroy_socket_label, label);
347 mac_labelzone_free(label);
348 MAC_DEBUG_COUNTER_DEC(&nmacsockets);
349}
350
351static void
352mac_socket_peer_label_free(struct label *label)
353{
354
355 MAC_PERFORM(destroy_socket_peer_label, label);
356 mac_labelzone_free(label);
357 MAC_DEBUG_COUNTER_DEC(&nmacsockets);
358}
359
360void
361mac_destroy_socket(struct socket *socket)
362{
363
364 mac_socket_label_free(socket->so_label);
365 socket->so_label = NULL;
366 mac_socket_peer_label_free(socket->so_peerlabel);
367 socket->so_peerlabel = NULL;
368}
369
370void
371mac_copy_mbuf_tag(struct m_tag *src, struct m_tag *dest)
372{
373 struct label *src_label, *dest_label;
374
375 src_label = (struct label *)(src+1);
376 dest_label = (struct label *)(dest+1);
377
378 /*
379 * mac_init_mbuf_tag() is called on the target tag in
380 * m_tag_copy(), so we don't need to call it here.
381 */
382 MAC_PERFORM(copy_mbuf_label, src_label, dest_label);
383}
384
385static int
386mac_externalize_ifnet_label(struct label *label, char *elements,
387 char *outbuf, size_t outbuflen)
388{
389 int error;
390
391 MAC_EXTERNALIZE(ifnet, label, elements, outbuf, outbuflen);
392
393 return (error);
394}
395
396static int
397mac_externalize_socket_label(struct label *label, char *elements,
398 char *outbuf, size_t outbuflen)
399{
400 int error;
401
402 MAC_EXTERNALIZE(socket, label, elements, outbuf, outbuflen);
403
404 return (error);
405}
406
407static int
408mac_externalize_socket_peer_label(struct label *label, char *elements,
409 char *outbuf, size_t outbuflen)
410{
411 int error;
412
413 MAC_EXTERNALIZE(socket_peer, label, elements, outbuf, outbuflen);
414
415 return (error);
416}
417
418static int
419mac_internalize_ifnet_label(struct label *label, char *string)
420{
421 int error;
422
423 MAC_INTERNALIZE(ifnet, label, string);
424
425 return (error);
426}
427
428static int
429mac_internalize_socket_label(struct label *label, char *string)
430{
431 int error;
432
433 MAC_INTERNALIZE(socket, label, string);
434
435 return (error);
436}
437
438void
439mac_create_ifnet(struct ifnet *ifnet)
440{
441
442 MAC_PERFORM(create_ifnet, ifnet, ifnet->if_label);
443}
444
445void
446mac_create_bpfdesc(struct ucred *cred, struct bpf_d *bpf_d)
447{
448
449 MAC_PERFORM(create_bpfdesc, cred, bpf_d, bpf_d->bd_label);
450}
451
452void
453mac_create_socket(struct ucred *cred, struct socket *socket)
454{
455
456 MAC_PERFORM(create_socket, cred, socket, socket->so_label);
457}
458
459void
460mac_create_socket_from_socket(struct socket *oldsocket,
461 struct socket *newsocket)
462{
463
464 MAC_PERFORM(create_socket_from_socket, oldsocket, oldsocket->so_label,
465 newsocket, newsocket->so_label);
466}
467
468static void
469mac_relabel_socket(struct ucred *cred, struct socket *socket,
470 struct label *newlabel)
471{
472
473 MAC_PERFORM(relabel_socket, cred, socket, socket->so_label, newlabel);
474}
475
476void
477mac_set_socket_peer_from_mbuf(struct mbuf *mbuf, struct socket *socket)
478{
479 struct label *label;
480
481 label = mbuf_to_label(mbuf);
482
483 MAC_PERFORM(set_socket_peer_from_mbuf, mbuf, label, socket,
484 socket->so_peerlabel);
485}
486
487void
488mac_set_socket_peer_from_socket(struct socket *oldsocket,
489 struct socket *newsocket)
490{
491
492 MAC_PERFORM(set_socket_peer_from_socket, oldsocket,
493 oldsocket->so_label, newsocket, newsocket->so_peerlabel);
494}
495
496void
497mac_create_datagram_from_ipq(struct ipq *ipq, struct mbuf *datagram)
498{
499 struct label *label;
500
501 label = mbuf_to_label(datagram);
502
503 MAC_PERFORM(create_datagram_from_ipq, ipq, ipq->ipq_label,
504 datagram, label);
505}
506
507void
508mac_create_fragment(struct mbuf *datagram, struct mbuf *fragment)
509{
510 struct label *datagramlabel, *fragmentlabel;
511
512 datagramlabel = mbuf_to_label(datagram);
513 fragmentlabel = mbuf_to_label(fragment);
514
515 MAC_PERFORM(create_fragment, datagram, datagramlabel, fragment,
516 fragmentlabel);
517}
518
519void
520mac_create_ipq(struct mbuf *fragment, struct ipq *ipq)
521{
522 struct label *label;
523
524 label = mbuf_to_label(fragment);
525
526 MAC_PERFORM(create_ipq, fragment, label, ipq, ipq->ipq_label);
527}
528
529void
530mac_create_mbuf_from_mbuf(struct mbuf *oldmbuf, struct mbuf *newmbuf)
531{
532 struct label *oldmbuflabel, *newmbuflabel;
533
534 oldmbuflabel = mbuf_to_label(oldmbuf);
535 newmbuflabel = mbuf_to_label(newmbuf);
536
537 MAC_PERFORM(create_mbuf_from_mbuf, oldmbuf, oldmbuflabel, newmbuf,
538 newmbuflabel);
539}
540
541void
542mac_create_mbuf_from_bpfdesc(struct bpf_d *bpf_d, struct mbuf *mbuf)
543{
544 struct label *label;
545
546 label = mbuf_to_label(mbuf);
547
548 MAC_PERFORM(create_mbuf_from_bpfdesc, bpf_d, bpf_d->bd_label, mbuf,
549 label);
550}
551
552void
553mac_create_mbuf_linklayer(struct ifnet *ifnet, struct mbuf *mbuf)
554{
555 struct label *label;
556
557 label = mbuf_to_label(mbuf);
558
559 MAC_PERFORM(create_mbuf_linklayer, ifnet, ifnet->if_label, mbuf,
560 label);
561}
562
563void
564mac_create_mbuf_from_ifnet(struct ifnet *ifnet, struct mbuf *mbuf)
565{
566 struct label *label;
567
568 label = mbuf_to_label(mbuf);
569
570 MAC_PERFORM(create_mbuf_from_ifnet, ifnet, ifnet->if_label, mbuf,
571 label);
572}
573
574void
575mac_create_mbuf_multicast_encap(struct mbuf *oldmbuf, struct ifnet *ifnet,
576 struct mbuf *newmbuf)
577{
578 struct label *oldmbuflabel, *newmbuflabel;
579
580 oldmbuflabel = mbuf_to_label(oldmbuf);
581 newmbuflabel = mbuf_to_label(newmbuf);
582
583 MAC_PERFORM(create_mbuf_multicast_encap, oldmbuf, oldmbuflabel,
584 ifnet, ifnet->if_label, newmbuf, newmbuflabel);
585}
586
587void
588mac_create_mbuf_netlayer(struct mbuf *oldmbuf, struct mbuf *newmbuf)
589{
590 struct label *oldmbuflabel, *newmbuflabel;
591
592 oldmbuflabel = mbuf_to_label(oldmbuf);
593 newmbuflabel = mbuf_to_label(newmbuf);
594
595 MAC_PERFORM(create_mbuf_netlayer, oldmbuf, oldmbuflabel, newmbuf,
596 newmbuflabel);
597}
598
599int
600mac_fragment_match(struct mbuf *fragment, struct ipq *ipq)
601{
602 struct label *label;
603 int result;
604
605 label = mbuf_to_label(fragment);
606
607 result = 1;
608 MAC_BOOLEAN(fragment_match, &&, fragment, label, ipq,
609 ipq->ipq_label);
610
611 return (result);
612}
613
614void
615mac_reflect_mbuf_icmp(struct mbuf *m)
616{
617 struct label *label;
618
619 label = mbuf_to_label(m);
620
621 MAC_PERFORM(reflect_mbuf_icmp, m, label);
622}
623void
624mac_reflect_mbuf_tcp(struct mbuf *m)
625{
626 struct label *label;
627
628 label = mbuf_to_label(m);
629
630 MAC_PERFORM(reflect_mbuf_tcp, m, label);
631}
632
633void
634mac_update_ipq(struct mbuf *fragment, struct ipq *ipq)
635{
636 struct label *label;
637
638 label = mbuf_to_label(fragment);
639
640 MAC_PERFORM(update_ipq, fragment, label, ipq, ipq->ipq_label);
641}
642
643void
644mac_create_mbuf_from_socket(struct socket *socket, struct mbuf *mbuf)
645{
646 struct label *label;
647
648 label = mbuf_to_label(mbuf);
649
650 MAC_PERFORM(create_mbuf_from_socket, socket, socket->so_label, mbuf,
651 label);
652}
653
654int
655mac_check_bpfdesc_receive(struct bpf_d *bpf_d, struct ifnet *ifnet)
656{
657 int error;
658
659 if (!mac_enforce_network)
660 return (0);
661
662 MAC_CHECK(check_bpfdesc_receive, bpf_d, bpf_d->bd_label, ifnet,
663 ifnet->if_label);
664
665 return (error);
666}
667
668int
669mac_check_ifnet_transmit(struct ifnet *ifnet, struct mbuf *mbuf)
670{
671 struct label *label;
672 int error;
673
674 M_ASSERTPKTHDR(mbuf);
675
676 if (!mac_enforce_network)
677 return (0);
678
679 label = mbuf_to_label(mbuf);
680
681 MAC_CHECK(check_ifnet_transmit, ifnet, ifnet->if_label, mbuf,
682 label);
683
684 return (error);
685}
686
687int
688mac_check_socket_bind(struct ucred *ucred, struct socket *socket,
689 struct sockaddr *sockaddr)
690{
691 int error;
692
693 if (!mac_enforce_socket)
694 return (0);
695
696 MAC_CHECK(check_socket_bind, ucred, socket, socket->so_label,
697 sockaddr);
698
699 return (error);
700}
701
702int
703mac_check_socket_connect(struct ucred *cred, struct socket *socket,
704 struct sockaddr *sockaddr)
705{
706 int error;
707
708 if (!mac_enforce_socket)
709 return (0);
710
711 MAC_CHECK(check_socket_connect, cred, socket, socket->so_label,
712 sockaddr);
713
714 return (error);
715}
716
717int
718mac_check_socket_deliver(struct socket *socket, struct mbuf *mbuf)
719{
720 struct label *label;
721 int error;
722
723 if (!mac_enforce_socket)
724 return (0);
725
726 label = mbuf_to_label(mbuf);
727
728 MAC_CHECK(check_socket_deliver, socket, socket->so_label, mbuf,
729 label);
730
731 return (error);
732}
733
734int
735mac_check_socket_listen(struct ucred *cred, struct socket *socket)
736{
737 int error;
738
739 if (!mac_enforce_socket)
740 return (0);
741
742 MAC_CHECK(check_socket_listen, cred, socket, socket->so_label);
743 return (error);
744}
745
746int
747mac_check_socket_receive(struct ucred *cred, struct socket *so)
748{
749 int error;
750
751 if (!mac_enforce_socket)
752 return (0);
753
754 MAC_CHECK(check_socket_receive, cred, so, so->so_label);
755
756 return (error);
757}
758
759static int
760mac_check_socket_relabel(struct ucred *cred, struct socket *socket,
761 struct label *newlabel)
762{
763 int error;
764
765 MAC_CHECK(check_socket_relabel, cred, socket, socket->so_label,
766 newlabel);
767
768 return (error);
769}
770
771int
772mac_check_socket_send(struct ucred *cred, struct socket *so)
773{
774 int error;
775
776 if (!mac_enforce_socket)
777 return (0);
778
779 MAC_CHECK(check_socket_send, cred, so, so->so_label);
780
781 return (error);
782}
783
784int
785mac_check_socket_visible(struct ucred *cred, struct socket *socket)
786{
787 int error;
788
789 if (!mac_enforce_socket)
790 return (0);
791
792 MAC_CHECK(check_socket_visible, cred, socket, socket->so_label);
793
794 return (error);
795}
796
797int
798mac_ioctl_ifnet_get(struct ucred *cred, struct ifreq *ifr,
799 struct ifnet *ifnet)
800{
801 char *elements, *buffer;
802 struct mac mac;
803 int error;
804
805 error = copyin(ifr->ifr_ifru.ifru_data, &mac, sizeof(mac));
806 if (error)
807 return (error);
808
809 error = mac_check_structmac_consistent(&mac);
810 if (error)
811 return (error);
812
813 elements = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK);
814 error = copyinstr(mac.m_string, elements, mac.m_buflen, NULL);
815 if (error) {
816 free(elements, M_MACTEMP);
817 return (error);
818 }
819
820 buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK | M_ZERO);
821 error = mac_externalize_ifnet_label(ifnet->if_label, elements,
822 buffer, mac.m_buflen);
823 if (error == 0)
824 error = copyout(buffer, mac.m_string, strlen(buffer)+1);
825
826 free(buffer, M_MACTEMP);
827 free(elements, M_MACTEMP);
828
829 return (error);
830}
831
832int
833mac_ioctl_ifnet_set(struct ucred *cred, struct ifreq *ifr,
834 struct ifnet *ifnet)
835{
836 struct label *intlabel;
837 struct mac mac;
838 char *buffer;
839 int error;
840
841 error = copyin(ifr->ifr_ifru.ifru_data, &mac, sizeof(mac));
842 if (error)
843 return (error);
844
845 error = mac_check_structmac_consistent(&mac);
846 if (error)
847 return (error);
848
849 buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK);
850 error = copyinstr(mac.m_string, buffer, mac.m_buflen, NULL);
851 if (error) {
852 free(buffer, M_MACTEMP);
853 return (error);
854 }
855
856 intlabel = mac_ifnet_label_alloc();
857 error = mac_internalize_ifnet_label(intlabel, buffer);
858 free(buffer, M_MACTEMP);
859 if (error) {
860 mac_ifnet_label_free(intlabel);
861 return (error);
862 }
863
864 /*
865 * XXX: Note that this is a redundant privilege check, since
866 * policies impose this check themselves if required by the
867 * policy. Eventually, this should go away.
868 */
869 error = suser_cred(cred, 0);
870 if (error) {
871 mac_ifnet_label_free(intlabel);
872 return (error);
873 }
874
875 MAC_CHECK(check_ifnet_relabel, cred, ifnet, ifnet->if_label,
876 intlabel);
877 if (error) {
878 mac_ifnet_label_free(intlabel);
879 return (error);
880 }
881
882 MAC_PERFORM(relabel_ifnet, cred, ifnet, ifnet->if_label, intlabel);
883
884 mac_ifnet_label_free(intlabel);
885 return (0);
886}
887
888int
|