mac_sysv_msg.c revision 165427
1137817Srwatson/*- 2137817Srwatson * Copyright (c) 2003-2004 Networks Associates Technology, Inc. 3137817Srwatson * All rights reserved. 4137817Srwatson * 5137817Srwatson * This software was developed for the FreeBSD Project in part by Network 6137817Srwatson * Associates Laboratories, the Security Research Division of Network 7137817Srwatson * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), 8137817Srwatson * as part of the DARPA CHATS research program. 9137817Srwatson * 10137817Srwatson * Redistribution and use in source and binary forms, with or without 11137817Srwatson * modification, are permitted provided that the following conditions 12137817Srwatson * are met: 13137817Srwatson * 1. Redistributions of source code must retain the above copyright 14137817Srwatson * notice, this list of conditions and the following disclaimer. 15137817Srwatson * 2. Redistributions in binary form must reproduce the above copyright 16137817Srwatson * notice, this list of conditions and the following disclaimer in the 17137817Srwatson * documentation and/or other materials provided with the distribution. 18137817Srwatson * 19137817Srwatson * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 20137817Srwatson * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21137817Srwatson * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22137817Srwatson * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 23137817Srwatson * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24137817Srwatson * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25137817Srwatson * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26137817Srwatson * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27137817Srwatson * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28137817Srwatson * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29137817Srwatson * SUCH DAMAGE. 30137817Srwatson */ 31137817Srwatson 32137817Srwatson#include <sys/cdefs.h> 33137817Srwatson__FBSDID("$FreeBSD: head/sys/security/mac/mac_sysv_msg.c 165427 2006-12-20 23:17:34Z rwatson $"); 34137817Srwatson 35137817Srwatson#include "opt_mac.h" 36137817Srwatson 37137817Srwatson#include <sys/param.h> 38137817Srwatson#include <sys/kernel.h> 39137817Srwatson#include <sys/lock.h> 40137817Srwatson#include <sys/malloc.h> 41137817Srwatson#include <sys/mutex.h> 42137817Srwatson#include <sys/mac.h> 43137817Srwatson#include <sys/sbuf.h> 44137817Srwatson#include <sys/systm.h> 45137817Srwatson#include <sys/vnode.h> 46137817Srwatson#include <sys/mount.h> 47137817Srwatson#include <sys/file.h> 48137817Srwatson#include <sys/namei.h> 49137817Srwatson#include <sys/sysctl.h> 50137817Srwatson#include <sys/msg.h> 51137817Srwatson 52137817Srwatson#include <sys/mac_policy.h> 53137817Srwatson 54163606Srwatson#include <security/mac/mac_framework.h> 55137817Srwatson#include <security/mac/mac_internal.h> 56137817Srwatson 57137817Srwatsonstatic int mac_enforce_sysv_msg = 1; 58137817SrwatsonSYSCTL_INT(_security_mac, OID_AUTO, enforce_sysv_msg, CTLFLAG_RW, 59137817Srwatson &mac_enforce_sysv_msg, 0, 60137817Srwatson "Enforce MAC policy on System V IPC Message Queues"); 61137817SrwatsonTUNABLE_INT("security.mac.enforce_sysv_msg", &mac_enforce_sysv_msg); 62137817Srwatson 63137817Srwatsonstatic struct label * 64137817Srwatsonmac_sysv_msgmsg_label_alloc(void) 65137817Srwatson{ 66137817Srwatson struct label *label; 67137817Srwatson 68137817Srwatson label = mac_labelzone_alloc(M_WAITOK); 69137817Srwatson MAC_PERFORM(init_sysv_msgmsg_label, label); 70137817Srwatson return (label); 71137817Srwatson} 72137817Srwatson 73137817Srwatsonvoid 74137817Srwatsonmac_init_sysv_msgmsg(struct msg *msgptr) 75137817Srwatson{ 76137817Srwatson 77137817Srwatson msgptr->label = mac_sysv_msgmsg_label_alloc(); 78137817Srwatson} 79137817Srwatson 80137817Srwatsonstatic struct label * 81137817Srwatsonmac_sysv_msgqueue_label_alloc(void) 82137817Srwatson{ 83137817Srwatson struct label *label; 84137817Srwatson 85137817Srwatson label = mac_labelzone_alloc(M_WAITOK); 86137817Srwatson MAC_PERFORM(init_sysv_msgqueue_label, label); 87137817Srwatson return (label); 88137817Srwatson} 89137817Srwatson 90137817Srwatsonvoid 91137817Srwatsonmac_init_sysv_msgqueue(struct msqid_kernel *msqkptr) 92137817Srwatson{ 93137817Srwatson 94137817Srwatson msqkptr->label = mac_sysv_msgqueue_label_alloc(); 95137817Srwatson} 96137817Srwatson 97137817Srwatsonstatic void 98137817Srwatsonmac_sysv_msgmsg_label_free(struct label *label) 99137817Srwatson{ 100137817Srwatson 101137817Srwatson MAC_PERFORM(destroy_sysv_msgmsg_label, label); 102137817Srwatson mac_labelzone_free(label); 103137817Srwatson} 104137817Srwatson 105137817Srwatsonvoid 106137817Srwatsonmac_destroy_sysv_msgmsg(struct msg *msgptr) 107137817Srwatson{ 108137817Srwatson 109137817Srwatson mac_sysv_msgmsg_label_free(msgptr->label); 110137817Srwatson msgptr->label = NULL; 111137817Srwatson} 112137817Srwatson 113137817Srwatsonstatic void 114137817Srwatsonmac_sysv_msgqueue_label_free(struct label *label) 115137817Srwatson{ 116137817Srwatson 117137817Srwatson MAC_PERFORM(destroy_sysv_msgqueue_label, label); 118137817Srwatson mac_labelzone_free(label); 119137817Srwatson} 120137817Srwatson 121137817Srwatsonvoid 122137817Srwatsonmac_destroy_sysv_msgqueue(struct msqid_kernel *msqkptr) 123137817Srwatson{ 124137817Srwatson 125137817Srwatson mac_sysv_msgqueue_label_free(msqkptr->label); 126137817Srwatson msqkptr->label = NULL; 127137817Srwatson} 128137817Srwatson 129137817Srwatsonvoid 130165427Srwatsonmac_create_sysv_msgmsg(struct ucred *cred, struct msqid_kernel *msqkptr, 131137817Srwatson struct msg *msgptr) 132137817Srwatson{ 133165427Srwatson 134165427Srwatson MAC_PERFORM(create_sysv_msgmsg, cred, msqkptr, msqkptr->label, 135137817Srwatson msgptr, msgptr->label); 136137817Srwatson} 137137817Srwatson 138137817Srwatsonvoid 139137817Srwatsonmac_create_sysv_msgqueue(struct ucred *cred, struct msqid_kernel *msqkptr) 140137817Srwatson{ 141165427Srwatson 142137817Srwatson MAC_PERFORM(create_sysv_msgqueue, cred, msqkptr, msqkptr->label); 143137817Srwatson} 144137817Srwatson 145137817Srwatsonvoid 146137817Srwatsonmac_cleanup_sysv_msgmsg(struct msg *msgptr) 147137817Srwatson{ 148137817Srwatson 149137817Srwatson MAC_PERFORM(cleanup_sysv_msgmsg, msgptr->label); 150137817Srwatson} 151137817Srwatson 152137817Srwatsonvoid 153137817Srwatsonmac_cleanup_sysv_msgqueue(struct msqid_kernel *msqkptr) 154137817Srwatson{ 155165427Srwatson 156137817Srwatson MAC_PERFORM(cleanup_sysv_msgqueue, msqkptr->label); 157137817Srwatson} 158137817Srwatson 159137817Srwatsonint 160137817Srwatsonmac_check_sysv_msgmsq(struct ucred *cred, struct msg *msgptr, 161137817Srwatson struct msqid_kernel *msqkptr) 162137817Srwatson{ 163137817Srwatson int error; 164137817Srwatson 165137817Srwatson if (!mac_enforce_sysv_msg) 166137817Srwatson return (0); 167137817Srwatson 168137817Srwatson MAC_CHECK(check_sysv_msgmsq, cred, msgptr, msgptr->label, msqkptr, 169137817Srwatson msqkptr->label); 170137817Srwatson 171137817Srwatson return(error); 172137817Srwatson} 173137817Srwatson 174137817Srwatsonint 175137817Srwatsonmac_check_sysv_msgrcv(struct ucred *cred, struct msg *msgptr) 176137817Srwatson{ 177137817Srwatson int error; 178137817Srwatson 179137817Srwatson if (!mac_enforce_sysv_msg) 180137817Srwatson return (0); 181137817Srwatson 182137817Srwatson MAC_CHECK(check_sysv_msgrcv, cred, msgptr, msgptr->label); 183137817Srwatson 184137817Srwatson return(error); 185137817Srwatson} 186137817Srwatson 187137817Srwatsonint 188137817Srwatsonmac_check_sysv_msgrmid(struct ucred *cred, struct msg *msgptr) 189137817Srwatson{ 190137817Srwatson int error; 191137817Srwatson 192137817Srwatson if (!mac_enforce_sysv_msg) 193137817Srwatson return (0); 194137817Srwatson 195137817Srwatson MAC_CHECK(check_sysv_msgrmid, cred, msgptr, msgptr->label); 196137817Srwatson 197137817Srwatson return(error); 198137817Srwatson} 199137817Srwatson 200137817Srwatsonint 201137817Srwatsonmac_check_sysv_msqget(struct ucred *cred, struct msqid_kernel *msqkptr) 202137817Srwatson{ 203137817Srwatson int error; 204137817Srwatson 205137817Srwatson if (!mac_enforce_sysv_msg) 206137817Srwatson return (0); 207137817Srwatson 208137817Srwatson MAC_CHECK(check_sysv_msqget, cred, msqkptr, msqkptr->label); 209137817Srwatson 210137817Srwatson return(error); 211137817Srwatson} 212137817Srwatson 213137817Srwatsonint 214137817Srwatsonmac_check_sysv_msqsnd(struct ucred *cred, struct msqid_kernel *msqkptr) 215137817Srwatson{ 216137817Srwatson int error; 217137817Srwatson 218137817Srwatson if (!mac_enforce_sysv_msg) 219137817Srwatson return (0); 220137817Srwatson 221137817Srwatson MAC_CHECK(check_sysv_msqsnd, cred, msqkptr, msqkptr->label); 222137817Srwatson 223137817Srwatson return(error); 224137817Srwatson} 225137817Srwatson 226137817Srwatsonint 227137817Srwatsonmac_check_sysv_msqrcv(struct ucred *cred, struct msqid_kernel *msqkptr) 228137817Srwatson{ 229137817Srwatson int error; 230137817Srwatson 231137817Srwatson if (!mac_enforce_sysv_msg) 232137817Srwatson return (0); 233137817Srwatson 234137817Srwatson MAC_CHECK(check_sysv_msqrcv, cred, msqkptr, msqkptr->label); 235137817Srwatson 236137817Srwatson return(error); 237137817Srwatson} 238137817Srwatson 239137817Srwatsonint 240137817Srwatsonmac_check_sysv_msqctl(struct ucred *cred, struct msqid_kernel *msqkptr, 241137817Srwatson int cmd) 242137817Srwatson{ 243137817Srwatson int error; 244137817Srwatson 245137817Srwatson if (!mac_enforce_sysv_msg) 246137817Srwatson return (0); 247137817Srwatson 248137817Srwatson MAC_CHECK(check_sysv_msqctl, cred, msqkptr, msqkptr->label, cmd); 249137817Srwatson 250137817Srwatson return(error); 251137817Srwatson} 252