1/*-
2 * Copyright (c) 1999-2002, 2007-2008 Robert N. M. Watson
3 * Copyright (c) 2001-2005 Networks Associates Technology, Inc.
4 * Copyright (c) 2005 Tom Rhodes
5 * Copyright (c) 2006 SPARTA, Inc.
6 * All rights reserved.
7 *
8 * This software was developed by Robert Watson for the TrustedBSD Project.
9 * It was later enhanced by Tom Rhodes for the TrustedBSD Project.
10 *
11 * This software was developed for the FreeBSD Project in part by Network
12 * Associates Laboratories, the Security Research Division of Network
13 * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"),
14 * as part of the DARPA CHATS research program.
15 *
16 * This software was enhanced by SPARTA ISSO under SPAWAR contract
17 * N66001-04-C-6019 ("SEFOS").
18 *
19 * Redistribution and use in source and binary forms, with or without
20 * modification, are permitted provided that the following conditions
21 * are met:
22 * 1. Redistributions of source code must retain the above copyright
23 * notice, this list of conditions and the following disclaimer.
24 * 2. Redistributions in binary form must reproduce the above copyright
25 * notice, this list of conditions and the following disclaimer in the
26 * documentation and/or other materials provided with the distribution.
27 *
28 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
29 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
30 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
31 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
32 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
33 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
34 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
35 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
36 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
37 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
38 * SUCH DAMAGE.
39 *
40 * $FreeBSD: head/sys/security/mac_bsdextended/ugidfw_vnode.c 184467 2008-10-30 10:13:53Z rwatson $
41 */
42
43#include <sys/param.h>
44#include <sys/acl.h>
45#include <sys/kernel.h>
46#include <sys/jail.h>
47#include <sys/lock.h>
48#include <sys/malloc.h>
49#include <sys/module.h>
50#include <sys/mount.h>
51#include <sys/mutex.h>
52#include <sys/priv.h>
53#include <sys/systm.h>
54#include <sys/vnode.h>
55#include <sys/sysctl.h>
56#include <sys/syslog.h>
57#include <sys/stat.h>
58
59#include <security/mac/mac_policy.h>
60#include <security/mac_bsdextended/mac_bsdextended.h>
61#include <security/mac_bsdextended/ugidfw_internal.h>
62
63int
64ugidfw_vnode_check_access(struct ucred *cred, struct vnode *vp,
65 struct label *vplabel, accmode_t accmode)
66{
67
68 return (ugidfw_check_vp(cred, vp, ugidfw_accmode2mbi(accmode)));
69}
70
71int
72ugidfw_vnode_check_chdir(struct ucred *cred, struct vnode *dvp,
73 struct label *dvplabel)
74{
75
76 return (ugidfw_check_vp(cred, dvp, MBI_EXEC));
77}
78
79int
80ugidfw_vnode_check_chroot(struct ucred *cred, struct vnode *dvp,
81 struct label *dvplabel)
82{
83
84 return (ugidfw_check_vp(cred, dvp, MBI_EXEC));
85}
86
87int
88ugidfw_check_create_vnode(struct ucred *cred, struct vnode *dvp,
89 struct label *dvplabel, struct componentname *cnp, struct vattr *vap)
90{
91
92 return (ugidfw_check_vp(cred, dvp, MBI_WRITE));
93}
94
95int
96ugidfw_vnode_check_deleteacl(struct ucred *cred, struct vnode *vp,
97 struct label *vplabel, acl_type_t type)
98{
99
100 return (ugidfw_check_vp(cred, vp, MBI_ADMIN));
101}
102
103int
104ugidfw_vnode_check_deleteextattr(struct ucred *cred, struct vnode *vp,
105 struct label *vplabel, int attrnamespace, const char *name)
106{
107
108 return (ugidfw_check_vp(cred, vp, MBI_WRITE));
109}
110
111int
112ugidfw_vnode_check_exec(struct ucred *cred, struct vnode *vp,
113 struct label *vplabel, struct image_params *imgp,
114 struct label *execlabel)
115{
116
117 return (ugidfw_check_vp(cred, vp, MBI_READ|MBI_EXEC));
118}
119
120int
121ugidfw_vnode_check_getacl(struct ucred *cred, struct vnode *vp,
122 struct label *vplabel, acl_type_t type)
123{
124
125 return (ugidfw_check_vp(cred, vp, MBI_STAT));
126}
127
128int
129ugidfw_vnode_check_getextattr(struct ucred *cred, struct vnode *vp,
130 struct label *vplabel, int attrnamespace, const char *name,
131 struct uio *uio)
132{
133
134 return (ugidfw_check_vp(cred, vp, MBI_READ));
135}
136
137int
138ugidfw_vnode_check_link(struct ucred *cred, struct vnode *dvp,
139 struct label *dvplabel, struct vnode *vp, struct label *label,
140 struct componentname *cnp)
141{
142 int error;
143
144 error = ugidfw_check_vp(cred, dvp, MBI_WRITE);
145 if (error)
146 return (error);
147 error = ugidfw_check_vp(cred, vp, MBI_WRITE);
148 if (error)
149 return (error);
150 return (0);
151}
152
153int
154ugidfw_vnode_check_listextattr(struct ucred *cred, struct vnode *vp,
155 struct label *vplabel, int attrnamespace)
156{
157
158 return (ugidfw_check_vp(cred, vp, MBI_READ));
159}
160
161int
162ugidfw_vnode_check_lookup(struct ucred *cred, struct vnode *dvp,
163 struct label *dvplabel, struct componentname *cnp)
164{
165
166 return (ugidfw_check_vp(cred, dvp, MBI_EXEC));
167}
168
169int
170ugidfw_vnode_check_open(struct ucred *cred, struct vnode *vp,
171 struct label *vplabel, accmode_t accmode)
172{
173
174 return (ugidfw_check_vp(cred, vp, ugidfw_accmode2mbi(accmode)));
175}
176
177int
178ugidfw_vnode_check_readdir(struct ucred *cred, struct vnode *dvp,
179 struct label *dvplabel)
180{
181
182 return (ugidfw_check_vp(cred, dvp, MBI_READ));
183}
184
185int
186ugidfw_vnode_check_readdlink(struct ucred *cred, struct vnode *vp,
187 struct label *vplabel)
188{
189
190 return (ugidfw_check_vp(cred, vp, MBI_READ));
191}
192
193int
194ugidfw_vnode_check_rename_from(struct ucred *cred, struct vnode *dvp,
195 struct label *dvplabel, struct vnode *vp, struct label *vplabel,
196 struct componentname *cnp)
197{
198 int error;
199
200 error = ugidfw_check_vp(cred, dvp, MBI_WRITE);
201 if (error)
202 return (error);
203 return (ugidfw_check_vp(cred, vp, MBI_WRITE));
204}
205
206int
207ugidfw_vnode_check_rename_to(struct ucred *cred, struct vnode *dvp,
208 struct label *dvplabel, struct vnode *vp, struct label *vplabel,
209 int samedir, struct componentname *cnp)
210{
211 int error;
212
213 error = ugidfw_check_vp(cred, dvp, MBI_WRITE);
214 if (error)
215 return (error);
216 if (vp != NULL)
217 error = ugidfw_check_vp(cred, vp, MBI_WRITE);
218 return (error);
219}
220
221int
222ugidfw_vnode_check_revoke(struct ucred *cred, struct vnode *vp,
223 struct label *vplabel)
224{
225
226 return (ugidfw_check_vp(cred, vp, MBI_ADMIN));
227}
228
229int
230ugidfw_check_setacl_vnode(struct ucred *cred, struct vnode *vp,
231 struct label *vplabel, acl_type_t type, struct acl *acl)
232{
233
234 return (ugidfw_check_vp(cred, vp, MBI_ADMIN));
235}
236
237int
238ugidfw_vnode_check_setextattr(struct ucred *cred, struct vnode *vp,
239 struct label *vplabel, int attrnamespace, const char *name,
240 struct uio *uio)
241{
242
243 return (ugidfw_check_vp(cred, vp, MBI_WRITE));
244}
245
246int
247ugidfw_vnode_check_setflags(struct ucred *cred, struct vnode *vp,
248 struct label *vplabel, u_long flags)
249{
250
251 return (ugidfw_check_vp(cred, vp, MBI_ADMIN));
252}
253
254int
255ugidfw_vnode_check_setmode(struct ucred *cred, struct vnode *vp,
256 struct label *vplabel, mode_t mode)
257{
258
259 return (ugidfw_check_vp(cred, vp, MBI_ADMIN));
260}
261
262int
263ugidfw_vnode_check_setowner(struct ucred *cred, struct vnode *vp,
264 struct label *vplabel, uid_t uid, gid_t gid)
265{
266
267 return (ugidfw_check_vp(cred, vp, MBI_ADMIN));
268}
269
270int
271ugidfw_vnode_check_setutimes(struct ucred *cred, struct vnode *vp,
272 struct label *vplabel, struct timespec atime, struct timespec utime)
273{
274
275 return (ugidfw_check_vp(cred, vp, MBI_ADMIN));
276}
277
278int
279ugidfw_vnode_check_stat(struct ucred *active_cred,
280 struct ucred *file_cred, struct vnode *vp, struct label *vplabel)
281{
282
283 return (ugidfw_check_vp(active_cred, vp, MBI_STAT));
284}
285
286int
287ugidfw_vnode_check_unlink(struct ucred *cred, struct vnode *dvp,
288 struct label *dvplabel, struct vnode *vp, struct label *vplabel,
289 struct componentname *cnp)
290{
291 int error;
292
293 error = ugidfw_check_vp(cred, dvp, MBI_WRITE);
294 if (error)
295 return (error);
296 return (ugidfw_check_vp(cred, vp, MBI_WRITE));
297}