mac_portacl.c revision 112128 
1/*-
2 * Copyright (c) 2003 Networks Associates Technology, Inc.
3 * All rights reserved.
4 *
5 * This software was developed for the FreeBSD Project by Network
6 * Associates Laboratories, the Security Research Division of Network
7 * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"),
8 * as part of the DARPA CHATS research program.
9 *
10 * Redistribution and use in source and binary forms, with or without
11 * modification, are permitted provided that the following conditions
12 * are met:
13 * 1. Redistributions of source code must retain the above copyright
14 *    notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 *    notice, this list of conditions and the following disclaimer in the
17 *    documentation and/or other materials provided with the distribution.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29 * SUCH DAMAGE.
30 *
31 * $FreeBSD: head/sys/security/mac_portacl/mac_portacl.c 112128 2003-03-12 02:55:20Z kan $
32 */
33
34/*
35 * Developed by the TrustedBSD Project.
36 *
37 * Administratively limit access to local UDP/TCP ports for binding purposes.
38 * Intended to be combined with net.inet.ip.portrange.reservedhigh to allow
39 * specific uids and gids to bind specific ports for specific purposes,
40 * while not opening the door to any user replacing an "official" service
41 * while you're restarting it.  This only affects ports explicitly bound by
42 * the user process (either for listen/outgoing socket for TCP, or send/
43 * receive for UDP).  This module will not limit ports bound implicitly for
44 * out-going connections where the process hasn't explicitly selected a port:
45 * these are automatically selected by the IP stack.
46 *
47 * To use this module, security.mac.enforce_socket must be enabled, and
48 * you will probably want to twiddle the net.inet sysctl listed above.
49 * Then use sysctl(8) to modify the rules string:
50 *
51 * # sysctl security.mac.portacl.rules="uid:425:tcp:80,uid:425:tcp:79"
52 *
53 * This ruleset, for example, permits uid 425 to bind TCP ports 80 (http)
54 * and 79 (finger).  User names and group names can't be used directly
55 * because the kernel only knows about uids and gids.
56 */
57
58#include <sys/types.h>
59#include <sys/param.h>
60#include <sys/conf.h>
61#include <sys/domain.h>
62#include <sys/kernel.h>
63#include <sys/libkern.h>
64#include <sys/mac.h>
65#include <sys/malloc.h>
66#include <sys/mount.h>
67#include <sys/proc.h>
68#include <sys/protosw.h>
69#include <sys/queue.h>
70#include <sys/systm.h>
71#include <sys/sysproto.h>
72#include <sys/sysent.h>
73#include <sys/vnode.h>
74#include <sys/file.h>
75#include <sys/sbuf.h>
76#include <sys/socket.h>
77#include <sys/socketvar.h>
78#include <sys/stdint.h>
79#include <sys/sx.h>
80#include <sys/sysctl.h>
81
82#include <netinet/in.h>
83
84#include <vm/vm.h>
85
86#include <sys/mac_policy.h>
87
88SYSCTL_DECL(_security_mac);
89
90SYSCTL_NODE(_security_mac, OID_AUTO, portacl, CTLFLAG_RW, 0,
91    "TrustedBSD mac_portacl policy controls");
92
93static int	mac_portacl_enabled = 1;
94SYSCTL_INT(_security_mac_portacl, OID_AUTO, enabled, CTLFLAG_RW,
95    &mac_portacl_enabled, 0, "Enforce portacl policy");
96TUNABLE_INT("security.mac.portacl.enabled", &mac_portacl_enabled);
97
98static int	mac_portacl_suser_exempt = 1;
99SYSCTL_INT(_security_mac_portacl, OID_AUTO, suser_exempt, CTLFLAG_RW,
100    &mac_portacl_suser_exempt, 0, "Privilege permits binding of any port");
101TUNABLE_INT("security.mac.portacl.suser_exempt",
102    &mac_portacl_suser_exempt);
103
104static int	mac_portacl_port_high = 1023;
105SYSCTL_INT(_security_mac_portacl, OID_AUTO, port_high, CTLFLAG_RW,
106    &mac_portacl_port_high, 0, "Highest port to enforce for");
107TUNABLE_INT("security.mac.portacl.port_high", &mac_portacl_port_high);
108
109MALLOC_DEFINE(M_PORTACL, "portacl rule", "Rules for mac_portacl");
110
111#define	MAC_RULE_STRING_LEN	1024
112
113#define	RULE_GID	1
114#define	RULE_UID	2
115#define	RULE_PROTO_TCP	1
116#define	RULE_PROTO_UDP	2
117struct rule {
118	id_t			r_id;
119	int			r_idtype;
120	u_int16_t		r_port;
121	int			r_protocol;
122
123	TAILQ_ENTRY(rule)	r_entries;
124};
125
126#define	GID_STRING	"gid"
127#define	TCP_STRING	"tcp"
128#define	UID_STRING	"uid"
129#define	UDP_STRING	"udp"
130
131/*
132 * Text format for the rule string is that a rule consists of a
133 * comma-seperated list of elements.  Each element is in the form
134 * idtype:id:protocol:portnumber, and constitutes granting of permission
135 * for the specified binding.
136 */
137
138static struct sx			rule_sx;
139static TAILQ_HEAD(rulehead, rule)	rule_head;
140static char				rule_string[MAC_RULE_STRING_LEN];
141
142static void
143toast_rules(struct rulehead *head)
144{
145	struct rule *rule;
146	int i;
147
148	i = 0;
149	for (rule = TAILQ_FIRST(head);
150	     rule != NULL;
151	     rule = TAILQ_NEXT(rule, r_entries))
152		i++;
153
154	while ((rule = TAILQ_FIRST(head)) != NULL) {
155		TAILQ_REMOVE(head, rule, r_entries);
156		free(rule, M_PORTACL);
157	}
158}
159
160/*
161 * Note that there is an inherent race condition in the unload of modules
162 * and access via sysctl.
163 */
164static void
165destroy(struct mac_policy_conf *mpc)
166{
167
168	sx_destroy(&rule_sx);
169	toast_rules(&rule_head);
170}
171
172static void
173init(struct mac_policy_conf *mpc)
174{
175
176	sx_init(&rule_sx, "rule_sx");
177	TAILQ_INIT(&rule_head);
178}
179
180/*
181 * Note: parsing routines are destructive on the passed string.
182 */
183static int
184parse_rule_element(char *element, struct rule **rule)
185{
186	char *idtype, *id, *protocol, *portnumber, *p;
187	struct rule *new;
188	int error;
189
190	error = 0;
191	new = malloc(sizeof(*new), M_PORTACL, M_ZERO | M_WAITOK);
192
193	idtype = strsep(&element, ":");
194	if (idtype == NULL) {
195		error = EINVAL;
196		goto out;
197	}
198	id = strsep(&element, ":");
199	if (id == NULL) {
200		error = EINVAL;
201		goto out;
202	}
203	new->r_id = strtol(id, &p, 10);
204	if (*p != '\0') {
205		error = EINVAL;
206		goto out;
207	}
208	if (strcmp(idtype, UID_STRING) == 0)
209		new->r_idtype = RULE_UID;
210	else if (strcmp(idtype, GID_STRING) == 0)
211		new->r_idtype = RULE_GID;
212	else {
213		error = EINVAL;
214		goto out;
215	}
216	protocol = strsep(&element, ":");
217	if (protocol == NULL) {
218		error = EINVAL;
219		goto out;
220	}
221	if (strcmp(protocol, TCP_STRING) == 0)
222		new->r_protocol = RULE_PROTO_TCP;
223	else if (strcmp(protocol, UDP_STRING) == 0)
224		new->r_protocol = RULE_PROTO_UDP;
225	else {
226		error = EINVAL;
227		goto out;
228	}
229	portnumber = element;
230	if (portnumber == NULL) {
231		error = EINVAL;
232		goto out;
233	}
234	new->r_port = strtol(portnumber, &p, 10);
235	if (*p != '\0') {
236		error = EINVAL;
237		goto out;
238	}
239
240out:
241	if (error != 0) {
242		free(new, M_PORTACL);
243		*rule = NULL;
244	} else
245		*rule = new;
246	return (error);
247}
248
249static int
250parse_rules(char *string, struct rulehead *head)
251{
252	struct rule *new;
253	char *element;
254	int error;
255
256	error = 0;
257	while ((element = strsep(&string, ",")) != NULL) {
258		if (strlen(element) == 0)
259			continue;
260		error = parse_rule_element(element, &new);
261		if (error)
262			goto out;
263		TAILQ_INSERT_TAIL(head, new, r_entries);
264	}
265out:
266	if (error != 0)
267		toast_rules(head);
268	return (error);
269}
270
271#if 0
272static void
273rule_printf(struct sbuf *sb, struct rule *rule)
274{
275	const char *idtype, *protocol;
276
277	switch(rule->r_idtype) {
278	case RULE_GID:
279		idtype = GID_STRING;
280		break;
281	case RULE_UID:
282		idtype = UID_STRING;
283		break;
284	default:
285		panic("rule_printf: unknown idtype (%d)\n", rule->r_idtype);
286	}
287
288	switch (rule->r_protocol) {
289	case RULE_PROTO_TCP:
290		protocol = TCP_STRING;
291		break;
292	case RULE_PROTO_UDP:
293		protocol = UDP_STRING;
294		break;
295	default:
296		panic("rule_printf: unknown protocol (%d)\n",
297		    rule->r_protocol);
298	}
299	sbuf_printf(sb, "%s:%jd:%s:%d", idtype, (intmax_t)rule->r_id,
300	    protocol, rule->r_port);
301}
302
303static char *
304rules_to_string(void)
305{
306	struct rule *rule;
307	struct sbuf *sb;
308	int needcomma;
309	char *temp;
310
311	sb = sbuf_new(NULL, NULL, 0, SBUF_AUTOEXTEND);
312	needcomma = 0;
313	sx_slock(&rule_sx);
314	for (rule = TAILQ_FIRST(&rule_head); rule != NULL;
315	    rule = TAILQ_NEXT(rule, r_entries)) {
316		if (!needcomma)
317			needcomma = 1;
318		else
319			sbuf_printf(sb, ",");
320		rule_printf(sb, rule);
321	}
322	sx_sunlock(&rule_sx);
323	sbuf_finish(sb);
324	temp = strdup(sbuf_data(sb), M_PORTACL);
325	sbuf_delete(sb);
326	return (temp);
327}
328#endif
329
330/*
331 * Note: due to races, there is not a single serializable order
332 * between parallel calls to the sysctl.
333 */
334static int
335sysctl_rules(SYSCTL_HANDLER_ARGS)
336{
337	char *string, *copy_string, *new_string;
338	struct rulehead head, save_head;
339	struct rule *rule;
340	int error;
341
342	new_string = NULL;
343	if (req->newptr == NULL) {
344		new_string = malloc(MAC_RULE_STRING_LEN, M_PORTACL,
345		    M_WAITOK | M_ZERO);
346		strcpy(new_string, rule_string);
347		string = new_string;
348	} else
349		string = rule_string;
350
351	error = sysctl_handle_string(oidp, string, MAC_RULE_STRING_LEN, req);
352	if (error)
353		goto out;
354
355	if (req->newptr != NULL) {
356		copy_string = strdup(string, M_PORTACL);
357		TAILQ_INIT(&head);
358		error = parse_rules(copy_string, &head);
359		free(copy_string, M_PORTACL);
360		if (error)
361			goto out;
362
363		TAILQ_INIT(&save_head);
364		sx_xlock(&rule_sx);
365		/*
366		 * XXX: Unfortunately, TAILQ doesn't yet have a supported
367		 * assignment operator to copy one queue to another, due
368	 	 * to a self-referential pointer in the tailq header.
369		 * For now, do it the old-fashioned way.
370		 */
371		while ((rule = TAILQ_FIRST(&rule_head)) != NULL) {
372			TAILQ_REMOVE(&rule_head, rule, r_entries);
373			TAILQ_INSERT_HEAD(&save_head, rule, r_entries);
374		}
375		while ((rule = TAILQ_FIRST(&head)) != NULL) {
376			TAILQ_REMOVE(&head, rule, r_entries);
377			TAILQ_INSERT_HEAD(&rule_head, rule, r_entries);
378		}
379		strcpy(rule_string, string);
380		sx_xunlock(&rule_sx);
381		toast_rules(&save_head);
382	}
383out:
384	if (new_string != NULL)
385		free(new_string, M_PORTACL);
386	return (error);
387}
388
389SYSCTL_PROC(_security_mac_portacl, OID_AUTO, rules,
390       CTLTYPE_STRING|CTLFLAG_RW, 0, 0, sysctl_rules, "A", "Rules");
391
392static int
393rules_check(struct ucred *cred, int family, int type, u_int16_t port)
394{
395	struct rule *rule;
396	int error;
397
398#if 0
399	printf("Check requested for euid %d, family %d, type %d, port %d\n",
400	    cred->cr_uid, family, type, port);
401#endif
402
403	if (port > mac_portacl_port_high)
404		return (0);
405
406	error = EPERM;
407	sx_slock(&rule_sx);
408	for (rule = TAILQ_FIRST(&rule_head);
409	    rule != NULL;
410	    rule = TAILQ_NEXT(rule, r_entries)) {
411		if (type == SOCK_DGRAM && rule->r_protocol != RULE_PROTO_UDP)
412			continue;
413		if (type == SOCK_STREAM && rule->r_protocol != RULE_PROTO_TCP)
414			continue;
415		if (port != rule->r_port)
416			continue;
417		if (rule->r_idtype == RULE_UID) {
418			if (cred->cr_uid == rule->r_id) {
419				error = 0;
420				break;
421			}
422		} else if (rule->r_idtype == RULE_GID) {
423			if (cred->cr_gid == rule->r_id) {
424				error = 0;
425				break;
426			} else if (groupmember(rule->r_id, cred)) {
427				error = 0;
428				break;
429			}
430		} else
431			panic("rules_check: unknown rule type %d",
432			    rule->r_idtype);
433	}
434	sx_sunlock(&rule_sx);
435
436	if (error != 0 && mac_portacl_suser_exempt != 0)
437		error = suser_cred(cred, 0);
438
439	return (error);
440}
441
442/*
443 * Note, this only limits the ability to explicitly bind a port, it
444 * doesn't limit implicitly bound ports for outgoing connections where
445 * the source port is left up to the IP stack to determine automatically.
446 */
447static int
448check_socket_bind(struct ucred *cred, struct socket *so,
449    struct label *socketlabel, struct sockaddr *sockaddr)
450{
451	struct sockaddr_in *sin;
452	int family, type;
453	u_int16_t port;
454
455	/* Only interested in IPv4 and IPv6 sockets. */
456	if (so->so_proto->pr_domain->dom_family != PF_INET &&
457	    so->so_proto->pr_domain->dom_family != PF_INET6)
458		return (0);
459
460	/* Currently, we don't attempt to deal with SOCK_RAW, etc. */
461	if (so->so_type != SOCK_DGRAM &&
462	    so->so_type != SOCK_STREAM)
463		return (0);
464
465	/* Reject addresses we don't understand; fail closed. */
466	if (sockaddr->sa_family != AF_INET &&
467	    sockaddr->sa_family != AF_INET6)
468		return (EINVAL);
469
470	family = so->so_proto->pr_domain->dom_family;
471	type = so->so_type;
472	sin = (struct sockaddr_in *) sockaddr;
473	port = ntohs(sin->sin_port);
474
475	return (rules_check(cred, family, type, port));
476}
477
478static struct mac_policy_ops mac_portacl_ops =
479{
480	.mpo_destroy = destroy,
481	.mpo_init = init,
482	.mpo_check_socket_bind = check_socket_bind,
483};
484
485MAC_POLICY_SET(&mac_portacl_ops, trustedbsd_mac_portacl,
486    "TrustedBSD MAC/portacl", MPC_LOADTIME_FLAG_UNLOADOK, NULL);
487