35 */
36/*
37 * Developed by the TrustedBSD Project.
38 * "BSD Extended" MAC policy, allowing the administrator to impose
39 * mandatory rules regarding users and some system objects.
40 *
41 * XXX: Much locking support required here.
42 */
43
44#include <sys/types.h>
45#include <sys/param.h>
46#include <sys/acl.h>
47#include <sys/conf.h>
48#include <sys/kernel.h>
49#include <sys/mac.h>
50#include <sys/malloc.h>
51#include <sys/mount.h>
52#include <sys/proc.h>
53#include <sys/systm.h>
54#include <sys/sysproto.h>
55#include <sys/sysent.h>
56#include <sys/vnode.h>
57#include <sys/file.h>
58#include <sys/socket.h>
59#include <sys/socketvar.h>
60#include <sys/sysctl.h>
61
62#include <net/bpfdesc.h>
63#include <net/if.h>
64#include <net/if_types.h>
65#include <net/if_var.h>
66
67#include <vm/vm.h>
68
69#include <sys/mac_policy.h>
70
71#include <security/mac_bsdextended/mac_bsdextended.h>
72
73SYSCTL_DECL(_security_mac);
74
75SYSCTL_NODE(_security_mac, OID_AUTO, bsdextended, CTLFLAG_RW, 0,
76 "TrustedBSD extended BSD MAC policy controls");
77
78static int mac_bsdextended_enabled = 1;
79SYSCTL_INT(_security_mac_bsdextended, OID_AUTO, enabled, CTLFLAG_RW,
80 &mac_bsdextended_enabled, 0, "Enforce extended BSD policy");
81TUNABLE_INT("security.mac.bsdextended.enabled", &mac_bsdextended_enabled);
82
83MALLOC_DEFINE(M_MACBSDEXTENDED, "mac_bsdextended", "BSD Extended MAC rule");
84
85#define MAC_BSDEXTENDED_MAXRULES 250
86static struct mac_bsdextended_rule *rules[MAC_BSDEXTENDED_MAXRULES];
87static int rule_count = 0;
88static int rule_slots = 0;
89
90SYSCTL_INT(_security_mac_bsdextended, OID_AUTO, rule_count, CTLFLAG_RD,
91 &rule_count, 0, "Number of defined rules\n");
92SYSCTL_INT(_security_mac_bsdextended, OID_AUTO, rule_slots, CTLFLAG_RD,
93 &rule_slots, 0, "Number of used rule slots\n");
94
95static int mac_bsdextended_debugging;
96SYSCTL_INT(_security_mac_bsdextended, OID_AUTO, debugging, CTLFLAG_RW,
97 &mac_bsdextended_debugging, 0, "Enable debugging on failure");
98
99static int
100mac_bsdextended_rule_valid(struct mac_bsdextended_rule *rule)
101{
102
103 if ((rule->mbr_subject.mbi_flags | MBI_BITS) != MBI_BITS)
104 return (EINVAL);
105
106 if ((rule->mbr_object.mbi_flags | MBI_BITS) != MBI_BITS)
107 return (EINVAL);
108
109 if ((rule->mbr_mode | VALLPERM) != VALLPERM)
110 return (EINVAL);
111
112 return (0);
113}
114
115static int
116sysctl_rule(SYSCTL_HANDLER_ARGS)
117{
118 struct mac_bsdextended_rule temprule, *ruleptr;
119 u_int namelen;
120 int error, index, *name;
121
122 name = (int *)arg1;
123 namelen = arg2;
124
125 /* printf("bsdextended sysctl handler (namelen %d)\n", namelen); */
126
127 if (namelen != 1)
128 return (EINVAL);
129
130 index = name[0];
131 if (index < 0 || index > rule_slots + 1)
132 return (ENOENT);
133 if (rule_slots >= MAC_BSDEXTENDED_MAXRULES)
134 return (ENOENT);
135
136 if (req->oldptr) {
137 if (rules[index] == NULL)
138 return (ENOENT);
139
140 error = SYSCTL_OUT(req, rules[index], sizeof(*rules[index]));
141 if (error)
142 return (error);
143 }
144
145 if (req->newptr) {
146 if (req->newlen == 0) {
147 /* printf("deletion\n"); */
148 ruleptr = rules[index];
149 if (ruleptr == NULL)
150 return (ENOENT);
151 rule_count--;
152 rules[index] = NULL;
153 FREE(ruleptr, M_MACBSDEXTENDED);
154 return(0);
155 }
156 error = SYSCTL_IN(req, &temprule, sizeof(temprule));
157 if (error)
158 return (error);
159
160 error = mac_bsdextended_rule_valid(&temprule);
161 if (error)
162 return (error);
163
164 if (rules[index] == NULL) {
165 /* printf("addition\n"); */
166 MALLOC(ruleptr, struct mac_bsdextended_rule *,
167 sizeof(*ruleptr), M_MACBSDEXTENDED, M_WAITOK |
168 M_ZERO);
169 *ruleptr = temprule;
170 rules[index] = ruleptr;
171 if (index+1 > rule_slots)
172 rule_slots = index+1;
173 rule_count++;
174 } else {
175 /* printf("replacement\n"); */
176 *rules[index] = temprule;
177 }
178 }
179
180 return (0);
181}
182
183SYSCTL_NODE(_security_mac_bsdextended, OID_AUTO, rules,
184 CTLFLAG_RW, sysctl_rule, "BSD extended MAC rules");
185
186static void
187mac_bsdextended_init(struct mac_policy_conf *mpc)
188{
189
190 /* Initialize ruleset lock. */
191 /* Register dynamic sysctl's for rules. */
192}
193
194static void
195mac_bsdextended_destroy(struct mac_policy_conf *mpc)
196{
197
198 /* Tear down sysctls. */
199 /* Destroy ruleset lock. */
200}
201
202static int
203mac_bsdextended_rulecheck(struct mac_bsdextended_rule *rule,
204 struct ucred *cred, uid_t object_uid, gid_t object_gid, int acc_mode)
205{
206 int match;
207
208 /*
209 * Is there a subject match?
210 */
211 if (rule->mbr_subject.mbi_flags & MBI_UID_DEFINED) {
212 match = (rule->mbr_subject.mbi_uid == cred->cr_uid ||
213 rule->mbr_subject.mbi_uid == cred->cr_ruid ||
214 rule->mbr_subject.mbi_uid == cred->cr_svuid);
215
216 if (rule->mbr_subject.mbi_flags & MBI_NEGATED)
217 match = !match;
218
219 if (!match)
220 return (0);
221 }
222
223 if (rule->mbr_subject.mbi_flags & MBI_GID_DEFINED) {
224 match = (groupmember(rule->mbr_subject.mbi_gid, cred) ||
225 rule->mbr_subject.mbi_gid == cred->cr_rgid ||
226 rule->mbr_subject.mbi_gid == cred->cr_svgid);
227
228 if (rule->mbr_subject.mbi_flags & MBI_NEGATED)
229 match = !match;
230
231 if (!match)
232 return (0);
233 }
234
235 /*
236 * Is there an object match?
237 */
238 if (rule->mbr_object.mbi_flags & MBI_UID_DEFINED) {
239 match = (rule->mbr_object.mbi_uid == object_uid);
240
241 if (rule->mbr_object.mbi_flags & MBI_NEGATED)
242 match = !match;
243
244 if (!match)
245 return (0);
246 }
247
248 if (rule->mbr_object.mbi_flags & MBI_GID_DEFINED) {
249 match = (rule->mbr_object.mbi_gid == object_gid);
250
251 if (rule->mbr_object.mbi_flags & MBI_NEGATED)
252 match = !match;
253
254 if (!match)
255 return (0);
256 }
257
258 /*
259 * Is the access permitted?
260 */
261 if ((rule->mbr_mode & acc_mode) != acc_mode) {
262 if (mac_bsdextended_debugging)
263 printf("mac_bsdextended: %d:%d request %d on %d:%d"
264 " fails\n", cred->cr_ruid, cred->cr_rgid,
265 acc_mode, object_uid, object_gid);
266 return (EACCES);
267 }
268
269 return (0);
270}
271
272static int
273mac_bsdextended_check(struct ucred *cred, uid_t object_uid, gid_t object_gid,
274 int acc_mode)
275{
276 int error, i;
277
278 for (i = 0; i < rule_slots; i++) {
279 if (rules[i] == NULL)
280 continue;
281
282 /*
283 * Since we don't separately handle append, map append to
284 * write.
285 */
286 if (acc_mode & VAPPEND) {
287 acc_mode &= ~VAPPEND;
288 acc_mode |= VWRITE;
289 }
290
291 error = mac_bsdextended_rulecheck(rules[i], cred, object_uid,
292 object_gid, acc_mode);
293 if (error)
294 return (error);
295 }
296
297 return (0);
298}
299
300static int
301mac_bsdextended_check_system_swapon(struct ucred *cred, struct vnode *vp,
302 struct label *label)
303{
304 struct vattr vap;
305 int error;
306
307 if (!mac_bsdextended_enabled)
308 return (0);
309
310 error = VOP_GETATTR(vp, &vap, cred, curthread);
311 if (error)
312 return (error);
313 return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VWRITE));
314}
315
316static int
317mac_bsdextended_check_vnode_access(struct ucred *cred, struct vnode *vp,
318 struct label *label, int acc_mode)
319{
320 struct vattr vap;
321 int error;
322
323 if (!mac_bsdextended_enabled)
324 return (0);
325
326 error = VOP_GETATTR(vp, &vap, cred, curthread);
327 if (error)
328 return (error);
329 return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, acc_mode));
330}
331
332static int
333mac_bsdextended_check_vnode_chdir(struct ucred *cred, struct vnode *dvp,
334 struct label *dlabel)
335{
336 struct vattr vap;
337 int error;
338
339 if (!mac_bsdextended_enabled)
340 return (0);
341
342 error = VOP_GETATTR(dvp, &vap, cred, curthread);
343 if (error)
344 return (error);
345 return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VEXEC));
346}
347
348static int
349mac_bsdextended_check_vnode_chroot(struct ucred *cred, struct vnode *dvp,
350 struct label *dlabel)
351{
352 struct vattr vap;
353 int error;
354
355 if (!mac_bsdextended_enabled)
356 return (0);
357
358 error = VOP_GETATTR(dvp, &vap, cred, curthread);
359 if (error)
360 return (error);
361 return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VEXEC));
362}
363
364static int
365mac_bsdextended_check_create_vnode(struct ucred *cred, struct vnode *dvp,
366 struct label *dlabel, struct componentname *cnp, struct vattr *vap)
367{
368 struct vattr dvap;
369 int error;
370
371 if (!mac_bsdextended_enabled)
372 return (0);
373
374 error = VOP_GETATTR(dvp, &dvap, cred, curthread);
375 if (error)
376 return (error);
377 return (mac_bsdextended_check(cred, dvap.va_uid, dvap.va_gid, VWRITE));
378}
379
380static int
381mac_bsdextended_check_vnode_delete(struct ucred *cred, struct vnode *dvp,
382 struct label *dlabel, struct vnode *vp, struct label *label,
383 struct componentname *cnp)
384{
385 struct vattr vap;
386 int error;
387
388 if (!mac_bsdextended_enabled)
389 return (0);
390
391 error = VOP_GETATTR(dvp, &vap, cred, curthread);
392 if (error)
393 return (error);
394 error = mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VWRITE);
395 if (error)
396 return (error);
397
398 error = VOP_GETATTR(vp, &vap, cred, curthread);
399 if (error)
400 return (error);
401 return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VWRITE));
402}
403
404static int
405mac_bsdextended_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp,
406 struct label *label, acl_type_t type)
407{
408 struct vattr vap;
409 int error;
410
411 if (!mac_bsdextended_enabled)
412 return (0);
413
414 error = VOP_GETATTR(vp, &vap, cred, curthread);
415 if (error)
416 return (error);
417 return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VADMIN));
418}
419
420static int
421mac_bsdextended_check_vnode_exec(struct ucred *cred, struct vnode *vp,
422 struct label *label, struct image_params *imgp,
423 struct label *execlabel)
424{
425 struct vattr vap;
426 int error;
427
428 if (!mac_bsdextended_enabled)
429 return (0);
430
431 error = VOP_GETATTR(vp, &vap, cred, curthread);
432 if (error)
433 return (error);
434 return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid,
435 VREAD|VEXEC));
436}
437
438static int
439mac_bsdextended_check_vnode_getacl(struct ucred *cred, struct vnode *vp,
440 struct label *label, acl_type_t type)
441{
442 struct vattr vap;
443 int error;
444
445 if (!mac_bsdextended_enabled)
446 return (0);
447
448 error = VOP_GETATTR(vp, &vap, cred, curthread);
449 if (error)
450 return (error);
451 return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VSTAT));
452}
453
454static int
455mac_bsdextended_check_vnode_getextattr(struct ucred *cred, struct vnode *vp,
456 struct label *label, int attrnamespace, const char *name, struct uio *uio)
457{
458 struct vattr vap;
459 int error;
460
461 if (!mac_bsdextended_enabled)
462 return (0);
463
464 error = VOP_GETATTR(vp, &vap, cred, curthread);
465 if (error)
466 return (error);
467 return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VREAD));
468}
469
470static int
471mac_bsdextended_check_vnode_link(struct ucred *cred, struct vnode *dvp,
472 struct label *dlabel, struct vnode *vp, struct label *label,
473 struct componentname *cnp)
474{
475 struct vattr vap;
476 int error;
477
478 if (!mac_bsdextended_enabled)
479 return (0);
480
481 error = VOP_GETATTR(dvp, &vap, cred, curthread);
482 if (error)
483 return (error);
484 error = mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VWRITE);
485 if (error)
486 return (error);
487
488 error = VOP_GETATTR(vp, &vap, cred, curthread);
489 if (error)
490 return (error);
491 error = mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VWRITE);
492 if (error)
493 return (error);
494 return (0);
495}
496
497static int
498mac_bsdextended_check_vnode_lookup(struct ucred *cred, struct vnode *dvp,
499 struct label *dlabel, struct componentname *cnp)
500{
501 struct vattr vap;
502 int error;
503
504 if (!mac_bsdextended_enabled)
505 return (0);
506
507 error = VOP_GETATTR(dvp, &vap, cred, curthread);
508 if (error)
509 return (error);
510 return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VEXEC));
511}
512
513static int
514mac_bsdextended_check_vnode_open(struct ucred *cred, struct vnode *vp,
515 struct label *filelabel, int acc_mode)
516{
517 struct vattr vap;
518 int error;
519
520 if (!mac_bsdextended_enabled)
521 return (0);
522
523 error = VOP_GETATTR(vp, &vap, cred, curthread);
524 if (error)
525 return (error);
526 return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, acc_mode));
527}
528
529static int
530mac_bsdextended_check_vnode_readdir(struct ucred *cred, struct vnode *dvp,
531 struct label *dlabel)
532{
533 struct vattr vap;
534 int error;
535
536 if (!mac_bsdextended_enabled)
537 return (0);
538
539 error = VOP_GETATTR(dvp, &vap, cred, curthread);
540 if (error)
541 return (error);
542 return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VREAD));
543}
544
545static int
546mac_bsdextended_check_vnode_readdlink(struct ucred *cred, struct vnode *vp,
547 struct label *label)
548{
549 struct vattr vap;
550 int error;
551
552 if (!mac_bsdextended_enabled)
553 return (0);
554
555 error = VOP_GETATTR(vp, &vap, cred, curthread);
556 if (error)
557 return (error);
558 return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VREAD));
559}
560
561static int
562mac_bsdextended_check_vnode_rename_from(struct ucred *cred, struct vnode *dvp,
563 struct label *dlabel, struct vnode *vp, struct label *label,
564 struct componentname *cnp)
565{
566 struct vattr vap;
567 int error;
568
569 if (!mac_bsdextended_enabled)
570 return (0);
571
572 error = VOP_GETATTR(dvp, &vap, cred, curthread);
573 if (error)
574 return (error);
575 error = mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VWRITE);
576 if (error)
577 return (error);
578 error = VOP_GETATTR(vp, &vap, cred, curthread);
579 if (error)
580 return (error);
581 error = mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VWRITE);
582
583 return (error);
584}
585
586static int
587mac_bsdextended_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp,
588 struct label *dlabel, struct vnode *vp, struct label *label, int samedir,
589 struct componentname *cnp)
590{
591 struct vattr vap;
592 int error;
593
594 if (!mac_bsdextended_enabled)
595 return (0);
596
597 error = VOP_GETATTR(dvp, &vap, cred, curthread);
598 if (error)
599 return (error);
600 error = mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VWRITE);
601 if (error)
602 return (error);
603
604 if (vp != NULL) {
605 error = VOP_GETATTR(vp, &vap, cred, curthread);
606 if (error)
607 return (error);
608 error = mac_bsdextended_check(cred, vap.va_uid, vap.va_gid,
609 VWRITE);
610 }
611
612 return (error);
613}
614
615static int
616mac_bsdextended_check_vnode_revoke(struct ucred *cred, struct vnode *vp,
617 struct label *label)
618{
619 struct vattr vap;
620 int error;
621
622 if (!mac_bsdextended_enabled)
623 return (0);
624
625 error = VOP_GETATTR(vp, &vap, cred, curthread);
626 if (error)
627 return (error);
628 return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VADMIN));
629}
630
631static int
632mac_bsdextended_check_setacl_vnode(struct ucred *cred, struct vnode *vp,
633 struct label *label, acl_type_t type, struct acl *acl)
634{
635 struct vattr vap;
636 int error;
637
638 if (!mac_bsdextended_enabled)
639 return (0);
640
641 error = VOP_GETATTR(vp, &vap, cred, curthread);
642 if (error)
643 return (error);
644 return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VADMIN));
645}
646
647static int
648mac_bsdextended_check_vnode_setextattr(struct ucred *cred, struct vnode *vp,
649 struct label *label, int attrnamespace, const char *name, struct uio *uio)
650{
651 struct vattr vap;
652 int error;
653
654 if (!mac_bsdextended_enabled)
655 return (0);
656
657 error = VOP_GETATTR(vp, &vap, cred, curthread);
658 if (error)
659 return (error);
660 return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VWRITE));
661}
662
663static int
664mac_bsdextended_check_vnode_setflags(struct ucred *cred, struct vnode *vp,
665 struct label *label, u_long flags)
666{
667 struct vattr vap;
668 int error;
669
670 if (!mac_bsdextended_enabled)
671 return (0);
672
673 error = VOP_GETATTR(vp, &vap, cred, curthread);
674 if (error)
675 return (error);
676 return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VADMIN));
677}
678
679static int
680mac_bsdextended_check_vnode_setmode(struct ucred *cred, struct vnode *vp,
681 struct label *label, mode_t mode)
682{
683 struct vattr vap;
684 int error;
685
686 if (!mac_bsdextended_enabled)
687 return (0);
688
689 error = VOP_GETATTR(vp, &vap, cred, curthread);
690 if (error)
691 return (error);
692 return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VADMIN));
693}
694
695static int
696mac_bsdextended_check_vnode_setowner(struct ucred *cred, struct vnode *vp,
697 struct label *label, uid_t uid, gid_t gid)
698{
699 struct vattr vap;
700 int error;
701
702 if (!mac_bsdextended_enabled)
703 return (0);
704
705 error = VOP_GETATTR(vp, &vap, cred, curthread);
706 if (error)
707 return (error);
708 return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VADMIN));
709}
710
711static int
712mac_bsdextended_check_vnode_setutimes(struct ucred *cred, struct vnode *vp,
713 struct label *label, struct timespec atime, struct timespec utime)
714{
715 struct vattr vap;
716 int error;
717
718 if (!mac_bsdextended_enabled)
719 return (0);
720
721 error = VOP_GETATTR(vp, &vap, cred, curthread);
722 if (error)
723 return (error);
724 return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VADMIN));
725}
726
727static int
728mac_bsdextended_check_vnode_stat(struct ucred *active_cred,
729 struct ucred *file_cred, struct vnode *vp, struct label *label)
730{
731 struct vattr vap;
732 int error;
733
734 if (!mac_bsdextended_enabled)
735 return (0);
736
737 error = VOP_GETATTR(vp, &vap, active_cred, curthread);
738 if (error)
739 return (error);
740 return (mac_bsdextended_check(active_cred, vap.va_uid, vap.va_gid,
741 VSTAT));
742}
743
744static struct mac_policy_ops mac_bsdextended_ops =
745{
746 .mpo_destroy = mac_bsdextended_destroy,
747 .mpo_init = mac_bsdextended_init,
748 .mpo_check_system_swapon = mac_bsdextended_check_system_swapon,
749 .mpo_check_vnode_access = mac_bsdextended_check_vnode_access,
750 .mpo_check_vnode_chdir = mac_bsdextended_check_vnode_chdir,
751 .mpo_check_vnode_chroot = mac_bsdextended_check_vnode_chroot,
752 .mpo_check_vnode_create = mac_bsdextended_check_create_vnode,
753 .mpo_check_vnode_delete = mac_bsdextended_check_vnode_delete,
754 .mpo_check_vnode_deleteacl = mac_bsdextended_check_vnode_deleteacl,
755 .mpo_check_vnode_exec = mac_bsdextended_check_vnode_exec,
756 .mpo_check_vnode_getacl = mac_bsdextended_check_vnode_getacl,
757 .mpo_check_vnode_getextattr = mac_bsdextended_check_vnode_getextattr,
758 .mpo_check_vnode_link = mac_bsdextended_check_vnode_link,
759 .mpo_check_vnode_lookup = mac_bsdextended_check_vnode_lookup,
760 .mpo_check_vnode_open = mac_bsdextended_check_vnode_open,
761 .mpo_check_vnode_readdir = mac_bsdextended_check_vnode_readdir,
762 .mpo_check_vnode_readlink = mac_bsdextended_check_vnode_readdlink,
763 .mpo_check_vnode_rename_from = mac_bsdextended_check_vnode_rename_from,
764 .mpo_check_vnode_rename_to = mac_bsdextended_check_vnode_rename_to,
765 .mpo_check_vnode_revoke = mac_bsdextended_check_vnode_revoke,
766 .mpo_check_vnode_setacl = mac_bsdextended_check_setacl_vnode,
767 .mpo_check_vnode_setextattr = mac_bsdextended_check_vnode_setextattr,
768 .mpo_check_vnode_setflags = mac_bsdextended_check_vnode_setflags,
769 .mpo_check_vnode_setmode = mac_bsdextended_check_vnode_setmode,
770 .mpo_check_vnode_setowner = mac_bsdextended_check_vnode_setowner,
771 .mpo_check_vnode_setutimes = mac_bsdextended_check_vnode_setutimes,
772 .mpo_check_vnode_stat = mac_bsdextended_check_vnode_stat,
773};
774
| 35 */
36/*
37 * Developed by the TrustedBSD Project.
38 * "BSD Extended" MAC policy, allowing the administrator to impose
39 * mandatory rules regarding users and some system objects.
40 *
41 * XXX: Much locking support required here.
42 */
43
44#include <sys/types.h>
45#include <sys/param.h>
46#include <sys/acl.h>
47#include <sys/conf.h>
48#include <sys/kernel.h>
49#include <sys/mac.h>
50#include <sys/malloc.h>
51#include <sys/mount.h>
52#include <sys/proc.h>
53#include <sys/systm.h>
54#include <sys/sysproto.h>
55#include <sys/sysent.h>
56#include <sys/vnode.h>
57#include <sys/file.h>
58#include <sys/socket.h>
59#include <sys/socketvar.h>
60#include <sys/sysctl.h>
61
62#include <net/bpfdesc.h>
63#include <net/if.h>
64#include <net/if_types.h>
65#include <net/if_var.h>
66
67#include <vm/vm.h>
68
69#include <sys/mac_policy.h>
70
71#include <security/mac_bsdextended/mac_bsdextended.h>
72
73SYSCTL_DECL(_security_mac);
74
75SYSCTL_NODE(_security_mac, OID_AUTO, bsdextended, CTLFLAG_RW, 0,
76 "TrustedBSD extended BSD MAC policy controls");
77
78static int mac_bsdextended_enabled = 1;
79SYSCTL_INT(_security_mac_bsdextended, OID_AUTO, enabled, CTLFLAG_RW,
80 &mac_bsdextended_enabled, 0, "Enforce extended BSD policy");
81TUNABLE_INT("security.mac.bsdextended.enabled", &mac_bsdextended_enabled);
82
83MALLOC_DEFINE(M_MACBSDEXTENDED, "mac_bsdextended", "BSD Extended MAC rule");
84
85#define MAC_BSDEXTENDED_MAXRULES 250
86static struct mac_bsdextended_rule *rules[MAC_BSDEXTENDED_MAXRULES];
87static int rule_count = 0;
88static int rule_slots = 0;
89
90SYSCTL_INT(_security_mac_bsdextended, OID_AUTO, rule_count, CTLFLAG_RD,
91 &rule_count, 0, "Number of defined rules\n");
92SYSCTL_INT(_security_mac_bsdextended, OID_AUTO, rule_slots, CTLFLAG_RD,
93 &rule_slots, 0, "Number of used rule slots\n");
94
95static int mac_bsdextended_debugging;
96SYSCTL_INT(_security_mac_bsdextended, OID_AUTO, debugging, CTLFLAG_RW,
97 &mac_bsdextended_debugging, 0, "Enable debugging on failure");
98
99static int
100mac_bsdextended_rule_valid(struct mac_bsdextended_rule *rule)
101{
102
103 if ((rule->mbr_subject.mbi_flags | MBI_BITS) != MBI_BITS)
104 return (EINVAL);
105
106 if ((rule->mbr_object.mbi_flags | MBI_BITS) != MBI_BITS)
107 return (EINVAL);
108
109 if ((rule->mbr_mode | VALLPERM) != VALLPERM)
110 return (EINVAL);
111
112 return (0);
113}
114
115static int
116sysctl_rule(SYSCTL_HANDLER_ARGS)
117{
118 struct mac_bsdextended_rule temprule, *ruleptr;
119 u_int namelen;
120 int error, index, *name;
121
122 name = (int *)arg1;
123 namelen = arg2;
124
125 /* printf("bsdextended sysctl handler (namelen %d)\n", namelen); */
126
127 if (namelen != 1)
128 return (EINVAL);
129
130 index = name[0];
131 if (index < 0 || index > rule_slots + 1)
132 return (ENOENT);
133 if (rule_slots >= MAC_BSDEXTENDED_MAXRULES)
134 return (ENOENT);
135
136 if (req->oldptr) {
137 if (rules[index] == NULL)
138 return (ENOENT);
139
140 error = SYSCTL_OUT(req, rules[index], sizeof(*rules[index]));
141 if (error)
142 return (error);
143 }
144
145 if (req->newptr) {
146 if (req->newlen == 0) {
147 /* printf("deletion\n"); */
148 ruleptr = rules[index];
149 if (ruleptr == NULL)
150 return (ENOENT);
151 rule_count--;
152 rules[index] = NULL;
153 FREE(ruleptr, M_MACBSDEXTENDED);
154 return(0);
155 }
156 error = SYSCTL_IN(req, &temprule, sizeof(temprule));
157 if (error)
158 return (error);
159
160 error = mac_bsdextended_rule_valid(&temprule);
161 if (error)
162 return (error);
163
164 if (rules[index] == NULL) {
165 /* printf("addition\n"); */
166 MALLOC(ruleptr, struct mac_bsdextended_rule *,
167 sizeof(*ruleptr), M_MACBSDEXTENDED, M_WAITOK |
168 M_ZERO);
169 *ruleptr = temprule;
170 rules[index] = ruleptr;
171 if (index+1 > rule_slots)
172 rule_slots = index+1;
173 rule_count++;
174 } else {
175 /* printf("replacement\n"); */
176 *rules[index] = temprule;
177 }
178 }
179
180 return (0);
181}
182
183SYSCTL_NODE(_security_mac_bsdextended, OID_AUTO, rules,
184 CTLFLAG_RW, sysctl_rule, "BSD extended MAC rules");
185
186static void
187mac_bsdextended_init(struct mac_policy_conf *mpc)
188{
189
190 /* Initialize ruleset lock. */
191 /* Register dynamic sysctl's for rules. */
192}
193
194static void
195mac_bsdextended_destroy(struct mac_policy_conf *mpc)
196{
197
198 /* Tear down sysctls. */
199 /* Destroy ruleset lock. */
200}
201
202static int
203mac_bsdextended_rulecheck(struct mac_bsdextended_rule *rule,
204 struct ucred *cred, uid_t object_uid, gid_t object_gid, int acc_mode)
205{
206 int match;
207
208 /*
209 * Is there a subject match?
210 */
211 if (rule->mbr_subject.mbi_flags & MBI_UID_DEFINED) {
212 match = (rule->mbr_subject.mbi_uid == cred->cr_uid ||
213 rule->mbr_subject.mbi_uid == cred->cr_ruid ||
214 rule->mbr_subject.mbi_uid == cred->cr_svuid);
215
216 if (rule->mbr_subject.mbi_flags & MBI_NEGATED)
217 match = !match;
218
219 if (!match)
220 return (0);
221 }
222
223 if (rule->mbr_subject.mbi_flags & MBI_GID_DEFINED) {
224 match = (groupmember(rule->mbr_subject.mbi_gid, cred) ||
225 rule->mbr_subject.mbi_gid == cred->cr_rgid ||
226 rule->mbr_subject.mbi_gid == cred->cr_svgid);
227
228 if (rule->mbr_subject.mbi_flags & MBI_NEGATED)
229 match = !match;
230
231 if (!match)
232 return (0);
233 }
234
235 /*
236 * Is there an object match?
237 */
238 if (rule->mbr_object.mbi_flags & MBI_UID_DEFINED) {
239 match = (rule->mbr_object.mbi_uid == object_uid);
240
241 if (rule->mbr_object.mbi_flags & MBI_NEGATED)
242 match = !match;
243
244 if (!match)
245 return (0);
246 }
247
248 if (rule->mbr_object.mbi_flags & MBI_GID_DEFINED) {
249 match = (rule->mbr_object.mbi_gid == object_gid);
250
251 if (rule->mbr_object.mbi_flags & MBI_NEGATED)
252 match = !match;
253
254 if (!match)
255 return (0);
256 }
257
258 /*
259 * Is the access permitted?
260 */
261 if ((rule->mbr_mode & acc_mode) != acc_mode) {
262 if (mac_bsdextended_debugging)
263 printf("mac_bsdextended: %d:%d request %d on %d:%d"
264 " fails\n", cred->cr_ruid, cred->cr_rgid,
265 acc_mode, object_uid, object_gid);
266 return (EACCES);
267 }
268
269 return (0);
270}
271
272static int
273mac_bsdextended_check(struct ucred *cred, uid_t object_uid, gid_t object_gid,
274 int acc_mode)
275{
276 int error, i;
277
278 for (i = 0; i < rule_slots; i++) {
279 if (rules[i] == NULL)
280 continue;
281
282 /*
283 * Since we don't separately handle append, map append to
284 * write.
285 */
286 if (acc_mode & VAPPEND) {
287 acc_mode &= ~VAPPEND;
288 acc_mode |= VWRITE;
289 }
290
291 error = mac_bsdextended_rulecheck(rules[i], cred, object_uid,
292 object_gid, acc_mode);
293 if (error)
294 return (error);
295 }
296
297 return (0);
298}
299
300static int
301mac_bsdextended_check_system_swapon(struct ucred *cred, struct vnode *vp,
302 struct label *label)
303{
304 struct vattr vap;
305 int error;
306
307 if (!mac_bsdextended_enabled)
308 return (0);
309
310 error = VOP_GETATTR(vp, &vap, cred, curthread);
311 if (error)
312 return (error);
313 return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VWRITE));
314}
315
316static int
317mac_bsdextended_check_vnode_access(struct ucred *cred, struct vnode *vp,
318 struct label *label, int acc_mode)
319{
320 struct vattr vap;
321 int error;
322
323 if (!mac_bsdextended_enabled)
324 return (0);
325
326 error = VOP_GETATTR(vp, &vap, cred, curthread);
327 if (error)
328 return (error);
329 return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, acc_mode));
330}
331
332static int
333mac_bsdextended_check_vnode_chdir(struct ucred *cred, struct vnode *dvp,
334 struct label *dlabel)
335{
336 struct vattr vap;
337 int error;
338
339 if (!mac_bsdextended_enabled)
340 return (0);
341
342 error = VOP_GETATTR(dvp, &vap, cred, curthread);
343 if (error)
344 return (error);
345 return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VEXEC));
346}
347
348static int
349mac_bsdextended_check_vnode_chroot(struct ucred *cred, struct vnode *dvp,
350 struct label *dlabel)
351{
352 struct vattr vap;
353 int error;
354
355 if (!mac_bsdextended_enabled)
356 return (0);
357
358 error = VOP_GETATTR(dvp, &vap, cred, curthread);
359 if (error)
360 return (error);
361 return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VEXEC));
362}
363
364static int
365mac_bsdextended_check_create_vnode(struct ucred *cred, struct vnode *dvp,
366 struct label *dlabel, struct componentname *cnp, struct vattr *vap)
367{
368 struct vattr dvap;
369 int error;
370
371 if (!mac_bsdextended_enabled)
372 return (0);
373
374 error = VOP_GETATTR(dvp, &dvap, cred, curthread);
375 if (error)
376 return (error);
377 return (mac_bsdextended_check(cred, dvap.va_uid, dvap.va_gid, VWRITE));
378}
379
380static int
381mac_bsdextended_check_vnode_delete(struct ucred *cred, struct vnode *dvp,
382 struct label *dlabel, struct vnode *vp, struct label *label,
383 struct componentname *cnp)
384{
385 struct vattr vap;
386 int error;
387
388 if (!mac_bsdextended_enabled)
389 return (0);
390
391 error = VOP_GETATTR(dvp, &vap, cred, curthread);
392 if (error)
393 return (error);
394 error = mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VWRITE);
395 if (error)
396 return (error);
397
398 error = VOP_GETATTR(vp, &vap, cred, curthread);
399 if (error)
400 return (error);
401 return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VWRITE));
402}
403
404static int
405mac_bsdextended_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp,
406 struct label *label, acl_type_t type)
407{
408 struct vattr vap;
409 int error;
410
411 if (!mac_bsdextended_enabled)
412 return (0);
413
414 error = VOP_GETATTR(vp, &vap, cred, curthread);
415 if (error)
416 return (error);
417 return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VADMIN));
418}
419
420static int
421mac_bsdextended_check_vnode_exec(struct ucred *cred, struct vnode *vp,
422 struct label *label, struct image_params *imgp,
423 struct label *execlabel)
424{
425 struct vattr vap;
426 int error;
427
428 if (!mac_bsdextended_enabled)
429 return (0);
430
431 error = VOP_GETATTR(vp, &vap, cred, curthread);
432 if (error)
433 return (error);
434 return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid,
435 VREAD|VEXEC));
436}
437
438static int
439mac_bsdextended_check_vnode_getacl(struct ucred *cred, struct vnode *vp,
440 struct label *label, acl_type_t type)
441{
442 struct vattr vap;
443 int error;
444
445 if (!mac_bsdextended_enabled)
446 return (0);
447
448 error = VOP_GETATTR(vp, &vap, cred, curthread);
449 if (error)
450 return (error);
451 return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VSTAT));
452}
453
454static int
455mac_bsdextended_check_vnode_getextattr(struct ucred *cred, struct vnode *vp,
456 struct label *label, int attrnamespace, const char *name, struct uio *uio)
457{
458 struct vattr vap;
459 int error;
460
461 if (!mac_bsdextended_enabled)
462 return (0);
463
464 error = VOP_GETATTR(vp, &vap, cred, curthread);
465 if (error)
466 return (error);
467 return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VREAD));
468}
469
470static int
471mac_bsdextended_check_vnode_link(struct ucred *cred, struct vnode *dvp,
472 struct label *dlabel, struct vnode *vp, struct label *label,
473 struct componentname *cnp)
474{
475 struct vattr vap;
476 int error;
477
478 if (!mac_bsdextended_enabled)
479 return (0);
480
481 error = VOP_GETATTR(dvp, &vap, cred, curthread);
482 if (error)
483 return (error);
484 error = mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VWRITE);
485 if (error)
486 return (error);
487
488 error = VOP_GETATTR(vp, &vap, cred, curthread);
489 if (error)
490 return (error);
491 error = mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VWRITE);
492 if (error)
493 return (error);
494 return (0);
495}
496
497static int
498mac_bsdextended_check_vnode_lookup(struct ucred *cred, struct vnode *dvp,
499 struct label *dlabel, struct componentname *cnp)
500{
501 struct vattr vap;
502 int error;
503
504 if (!mac_bsdextended_enabled)
505 return (0);
506
507 error = VOP_GETATTR(dvp, &vap, cred, curthread);
508 if (error)
509 return (error);
510 return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VEXEC));
511}
512
513static int
514mac_bsdextended_check_vnode_open(struct ucred *cred, struct vnode *vp,
515 struct label *filelabel, int acc_mode)
516{
517 struct vattr vap;
518 int error;
519
520 if (!mac_bsdextended_enabled)
521 return (0);
522
523 error = VOP_GETATTR(vp, &vap, cred, curthread);
524 if (error)
525 return (error);
526 return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, acc_mode));
527}
528
529static int
530mac_bsdextended_check_vnode_readdir(struct ucred *cred, struct vnode *dvp,
531 struct label *dlabel)
532{
533 struct vattr vap;
534 int error;
535
536 if (!mac_bsdextended_enabled)
537 return (0);
538
539 error = VOP_GETATTR(dvp, &vap, cred, curthread);
540 if (error)
541 return (error);
542 return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VREAD));
543}
544
545static int
546mac_bsdextended_check_vnode_readdlink(struct ucred *cred, struct vnode *vp,
547 struct label *label)
548{
549 struct vattr vap;
550 int error;
551
552 if (!mac_bsdextended_enabled)
553 return (0);
554
555 error = VOP_GETATTR(vp, &vap, cred, curthread);
556 if (error)
557 return (error);
558 return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VREAD));
559}
560
561static int
562mac_bsdextended_check_vnode_rename_from(struct ucred *cred, struct vnode *dvp,
563 struct label *dlabel, struct vnode *vp, struct label *label,
564 struct componentname *cnp)
565{
566 struct vattr vap;
567 int error;
568
569 if (!mac_bsdextended_enabled)
570 return (0);
571
572 error = VOP_GETATTR(dvp, &vap, cred, curthread);
573 if (error)
574 return (error);
575 error = mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VWRITE);
576 if (error)
577 return (error);
578 error = VOP_GETATTR(vp, &vap, cred, curthread);
579 if (error)
580 return (error);
581 error = mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VWRITE);
582
583 return (error);
584}
585
586static int
587mac_bsdextended_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp,
588 struct label *dlabel, struct vnode *vp, struct label *label, int samedir,
589 struct componentname *cnp)
590{
591 struct vattr vap;
592 int error;
593
594 if (!mac_bsdextended_enabled)
595 return (0);
596
597 error = VOP_GETATTR(dvp, &vap, cred, curthread);
598 if (error)
599 return (error);
600 error = mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VWRITE);
601 if (error)
602 return (error);
603
604 if (vp != NULL) {
605 error = VOP_GETATTR(vp, &vap, cred, curthread);
606 if (error)
607 return (error);
608 error = mac_bsdextended_check(cred, vap.va_uid, vap.va_gid,
609 VWRITE);
610 }
611
612 return (error);
613}
614
615static int
616mac_bsdextended_check_vnode_revoke(struct ucred *cred, struct vnode *vp,
617 struct label *label)
618{
619 struct vattr vap;
620 int error;
621
622 if (!mac_bsdextended_enabled)
623 return (0);
624
625 error = VOP_GETATTR(vp, &vap, cred, curthread);
626 if (error)
627 return (error);
628 return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VADMIN));
629}
630
631static int
632mac_bsdextended_check_setacl_vnode(struct ucred *cred, struct vnode *vp,
633 struct label *label, acl_type_t type, struct acl *acl)
634{
635 struct vattr vap;
636 int error;
637
638 if (!mac_bsdextended_enabled)
639 return (0);
640
641 error = VOP_GETATTR(vp, &vap, cred, curthread);
642 if (error)
643 return (error);
644 return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VADMIN));
645}
646
647static int
648mac_bsdextended_check_vnode_setextattr(struct ucred *cred, struct vnode *vp,
649 struct label *label, int attrnamespace, const char *name, struct uio *uio)
650{
651 struct vattr vap;
652 int error;
653
654 if (!mac_bsdextended_enabled)
655 return (0);
656
657 error = VOP_GETATTR(vp, &vap, cred, curthread);
658 if (error)
659 return (error);
660 return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VWRITE));
661}
662
663static int
664mac_bsdextended_check_vnode_setflags(struct ucred *cred, struct vnode *vp,
665 struct label *label, u_long flags)
666{
667 struct vattr vap;
668 int error;
669
670 if (!mac_bsdextended_enabled)
671 return (0);
672
673 error = VOP_GETATTR(vp, &vap, cred, curthread);
674 if (error)
675 return (error);
676 return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VADMIN));
677}
678
679static int
680mac_bsdextended_check_vnode_setmode(struct ucred *cred, struct vnode *vp,
681 struct label *label, mode_t mode)
682{
683 struct vattr vap;
684 int error;
685
686 if (!mac_bsdextended_enabled)
687 return (0);
688
689 error = VOP_GETATTR(vp, &vap, cred, curthread);
690 if (error)
691 return (error);
692 return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VADMIN));
693}
694
695static int
696mac_bsdextended_check_vnode_setowner(struct ucred *cred, struct vnode *vp,
697 struct label *label, uid_t uid, gid_t gid)
698{
699 struct vattr vap;
700 int error;
701
702 if (!mac_bsdextended_enabled)
703 return (0);
704
705 error = VOP_GETATTR(vp, &vap, cred, curthread);
706 if (error)
707 return (error);
708 return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VADMIN));
709}
710
711static int
712mac_bsdextended_check_vnode_setutimes(struct ucred *cred, struct vnode *vp,
713 struct label *label, struct timespec atime, struct timespec utime)
714{
715 struct vattr vap;
716 int error;
717
718 if (!mac_bsdextended_enabled)
719 return (0);
720
721 error = VOP_GETATTR(vp, &vap, cred, curthread);
722 if (error)
723 return (error);
724 return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VADMIN));
725}
726
727static int
728mac_bsdextended_check_vnode_stat(struct ucred *active_cred,
729 struct ucred *file_cred, struct vnode *vp, struct label *label)
730{
731 struct vattr vap;
732 int error;
733
734 if (!mac_bsdextended_enabled)
735 return (0);
736
737 error = VOP_GETATTR(vp, &vap, active_cred, curthread);
738 if (error)
739 return (error);
740 return (mac_bsdextended_check(active_cred, vap.va_uid, vap.va_gid,
741 VSTAT));
742}
743
744static struct mac_policy_ops mac_bsdextended_ops =
745{
746 .mpo_destroy = mac_bsdextended_destroy,
747 .mpo_init = mac_bsdextended_init,
748 .mpo_check_system_swapon = mac_bsdextended_check_system_swapon,
749 .mpo_check_vnode_access = mac_bsdextended_check_vnode_access,
750 .mpo_check_vnode_chdir = mac_bsdextended_check_vnode_chdir,
751 .mpo_check_vnode_chroot = mac_bsdextended_check_vnode_chroot,
752 .mpo_check_vnode_create = mac_bsdextended_check_create_vnode,
753 .mpo_check_vnode_delete = mac_bsdextended_check_vnode_delete,
754 .mpo_check_vnode_deleteacl = mac_bsdextended_check_vnode_deleteacl,
755 .mpo_check_vnode_exec = mac_bsdextended_check_vnode_exec,
756 .mpo_check_vnode_getacl = mac_bsdextended_check_vnode_getacl,
757 .mpo_check_vnode_getextattr = mac_bsdextended_check_vnode_getextattr,
758 .mpo_check_vnode_link = mac_bsdextended_check_vnode_link,
759 .mpo_check_vnode_lookup = mac_bsdextended_check_vnode_lookup,
760 .mpo_check_vnode_open = mac_bsdextended_check_vnode_open,
761 .mpo_check_vnode_readdir = mac_bsdextended_check_vnode_readdir,
762 .mpo_check_vnode_readlink = mac_bsdextended_check_vnode_readdlink,
763 .mpo_check_vnode_rename_from = mac_bsdextended_check_vnode_rename_from,
764 .mpo_check_vnode_rename_to = mac_bsdextended_check_vnode_rename_to,
765 .mpo_check_vnode_revoke = mac_bsdextended_check_vnode_revoke,
766 .mpo_check_vnode_setacl = mac_bsdextended_check_setacl_vnode,
767 .mpo_check_vnode_setextattr = mac_bsdextended_check_vnode_setextattr,
768 .mpo_check_vnode_setflags = mac_bsdextended_check_vnode_setflags,
769 .mpo_check_vnode_setmode = mac_bsdextended_check_vnode_setmode,
770 .mpo_check_vnode_setowner = mac_bsdextended_check_vnode_setowner,
771 .mpo_check_vnode_setutimes = mac_bsdextended_check_vnode_setutimes,
772 .mpo_check_vnode_stat = mac_bsdextended_check_vnode_stat,
773};
774
|