ugidfw_system.c revision 108376
1101099Srwatson/*- 2101099Srwatson * Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson 3101099Srwatson * Copyright (c) 2001, 2002 Networks Associates Technology, Inc. 4101099Srwatson * All rights reserved. 5101099Srwatson * 6101099Srwatson * This software was developed by Robert Watson for the TrustedBSD Project. 7101099Srwatson * 8106393Srwatson * This software was developed for the FreeBSD Project in part by Network 9106393Srwatson * Associates Laboratories, the Security Research Division of Network 10106393Srwatson * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), 11106393Srwatson * as part of the DARPA CHATS research program. 12101099Srwatson * 13101099Srwatson * Redistribution and use in source and binary forms, with or without 14101099Srwatson * modification, are permitted provided that the following conditions 15101099Srwatson * are met: 16101099Srwatson * 1. Redistributions of source code must retain the above copyright 17101099Srwatson * notice, this list of conditions and the following disclaimer. 18101099Srwatson * 2. Redistributions in binary form must reproduce the above copyright 19101099Srwatson * notice, this list of conditions and the following disclaimer in the 20101099Srwatson * documentation and/or other materials provided with the distribution. 21101099Srwatson * 22101099Srwatson * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 23101099Srwatson * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 24101099Srwatson * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 25101099Srwatson * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 26101099Srwatson * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 27101099Srwatson * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 28101099Srwatson * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 29101099Srwatson * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 30101099Srwatson * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 31101099Srwatson * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 32101099Srwatson * SUCH DAMAGE. 33101099Srwatson * 34101099Srwatson * $FreeBSD: head/sys/security/mac_bsdextended/mac_bsdextended.c 108376 2002-12-28 23:41:18Z rwatson $ 35101099Srwatson */ 36101099Srwatson/* 37101099Srwatson * Developed by the TrustedBSD Project. 38101099Srwatson * "BSD Extended" MAC policy, allowing the administrator to impose 39101099Srwatson * mandatory rules regarding users and some system objects. 40101099Srwatson * 41101099Srwatson * XXX: Much locking support required here. 42101099Srwatson */ 43101099Srwatson 44101099Srwatson#include <sys/types.h> 45101099Srwatson#include <sys/param.h> 46101099Srwatson#include <sys/acl.h> 47101099Srwatson#include <sys/conf.h> 48101099Srwatson#include <sys/kernel.h> 49101099Srwatson#include <sys/mac.h> 50101099Srwatson#include <sys/malloc.h> 51101099Srwatson#include <sys/mount.h> 52101099Srwatson#include <sys/proc.h> 53101099Srwatson#include <sys/systm.h> 54101099Srwatson#include <sys/sysproto.h> 55101099Srwatson#include <sys/sysent.h> 56101099Srwatson#include <sys/vnode.h> 57101099Srwatson#include <sys/file.h> 58101099Srwatson#include <sys/socket.h> 59101099Srwatson#include <sys/socketvar.h> 60101099Srwatson#include <sys/sysctl.h> 61101099Srwatson 62101099Srwatson#include <net/bpfdesc.h> 63101099Srwatson#include <net/if.h> 64101099Srwatson#include <net/if_types.h> 65101099Srwatson#include <net/if_var.h> 66101099Srwatson 67101099Srwatson#include <vm/vm.h> 68101099Srwatson 69101099Srwatson#include <sys/mac_policy.h> 70101099Srwatson 71101099Srwatson#include <security/mac_bsdextended/mac_bsdextended.h> 72101099Srwatson 73101099SrwatsonSYSCTL_DECL(_security_mac); 74101099Srwatson 75101099SrwatsonSYSCTL_NODE(_security_mac, OID_AUTO, bsdextended, CTLFLAG_RW, 0, 76101099Srwatson "TrustedBSD extended BSD MAC policy controls"); 77101099Srwatson 78101099Srwatsonstatic int mac_bsdextended_enabled = 1; 79101099SrwatsonSYSCTL_INT(_security_mac_bsdextended, OID_AUTO, enabled, CTLFLAG_RW, 80101099Srwatson &mac_bsdextended_enabled, 0, "Enforce extended BSD policy"); 81101099SrwatsonTUNABLE_INT("security.mac.bsdextended.enabled", &mac_bsdextended_enabled); 82101099Srwatson 83101099SrwatsonMALLOC_DEFINE(M_MACBSDEXTENDED, "mac_bsdextended", "BSD Extended MAC rule"); 84101099Srwatson 85101099Srwatson#define MAC_BSDEXTENDED_MAXRULES 250 86101099Srwatsonstatic struct mac_bsdextended_rule *rules[MAC_BSDEXTENDED_MAXRULES]; 87101099Srwatsonstatic int rule_count = 0; 88101099Srwatsonstatic int rule_slots = 0; 89101099Srwatson 90101099SrwatsonSYSCTL_INT(_security_mac_bsdextended, OID_AUTO, rule_count, CTLFLAG_RD, 91101099Srwatson &rule_count, 0, "Number of defined rules\n"); 92101099SrwatsonSYSCTL_INT(_security_mac_bsdextended, OID_AUTO, rule_slots, CTLFLAG_RD, 93101099Srwatson &rule_slots, 0, "Number of used rule slots\n"); 94101099Srwatson 95101099Srwatsonstatic int mac_bsdextended_debugging; 96101099SrwatsonSYSCTL_INT(_security_mac_bsdextended, OID_AUTO, debugging, CTLFLAG_RW, 97101099Srwatson &mac_bsdextended_debugging, 0, "Enable debugging on failure"); 98101099Srwatson 99101099Srwatsonstatic int 100101099Srwatsonmac_bsdextended_rule_valid(struct mac_bsdextended_rule *rule) 101101099Srwatson{ 102101099Srwatson 103101099Srwatson if ((rule->mbr_subject.mbi_flags | MBI_BITS) != MBI_BITS) 104101099Srwatson return (EINVAL); 105101099Srwatson 106101099Srwatson if ((rule->mbr_object.mbi_flags | MBI_BITS) != MBI_BITS) 107101099Srwatson return (EINVAL); 108101099Srwatson 109101099Srwatson if ((rule->mbr_mode | VALLPERM) != VALLPERM) 110101099Srwatson return (EINVAL); 111101099Srwatson 112101099Srwatson return (0); 113101099Srwatson} 114101099Srwatson 115101099Srwatsonstatic int 116101099Srwatsonsysctl_rule(SYSCTL_HANDLER_ARGS) 117101099Srwatson{ 118101099Srwatson struct mac_bsdextended_rule temprule, *ruleptr; 119101099Srwatson u_int namelen; 120101099Srwatson int error, index, *name; 121101099Srwatson 122101099Srwatson name = (int *)arg1; 123101099Srwatson namelen = arg2; 124101099Srwatson 125101099Srwatson /* printf("bsdextended sysctl handler (namelen %d)\n", namelen); */ 126101099Srwatson 127101099Srwatson if (namelen != 1) 128101099Srwatson return (EINVAL); 129101099Srwatson 130101099Srwatson index = name[0]; 131101099Srwatson if (index < 0 || index > rule_slots + 1) 132101099Srwatson return (ENOENT); 133101099Srwatson if (rule_slots >= MAC_BSDEXTENDED_MAXRULES) 134101099Srwatson return (ENOENT); 135101099Srwatson 136101099Srwatson if (req->oldptr) { 137101099Srwatson if (rules[index] == NULL) 138101099Srwatson return (ENOENT); 139101099Srwatson 140101099Srwatson error = SYSCTL_OUT(req, rules[index], sizeof(*rules[index])); 141101099Srwatson if (error) 142101099Srwatson return (error); 143101099Srwatson } 144101099Srwatson 145101099Srwatson if (req->newptr) { 146101099Srwatson if (req->newlen == 0) { 147101099Srwatson /* printf("deletion\n"); */ 148101099Srwatson ruleptr = rules[index]; 149101099Srwatson if (ruleptr == NULL) 150101099Srwatson return (ENOENT); 151101099Srwatson rule_count--; 152101099Srwatson rules[index] = NULL; 153101099Srwatson FREE(ruleptr, M_MACBSDEXTENDED); 154101099Srwatson return(0); 155101099Srwatson } 156101099Srwatson error = SYSCTL_IN(req, &temprule, sizeof(temprule)); 157101099Srwatson if (error) 158101099Srwatson return (error); 159101099Srwatson 160101099Srwatson error = mac_bsdextended_rule_valid(&temprule); 161101099Srwatson if (error) 162101099Srwatson return (error); 163101099Srwatson 164101099Srwatson if (rules[index] == NULL) { 165101099Srwatson /* printf("addition\n"); */ 166101099Srwatson MALLOC(ruleptr, struct mac_bsdextended_rule *, 167101099Srwatson sizeof(*ruleptr), M_MACBSDEXTENDED, M_WAITOK | 168101099Srwatson M_ZERO); 169101099Srwatson *ruleptr = temprule; 170101099Srwatson rules[index] = ruleptr; 171101099Srwatson if (index+1 > rule_slots) 172101099Srwatson rule_slots = index+1; 173101099Srwatson rule_count++; 174101099Srwatson } else { 175101099Srwatson /* printf("replacement\n"); */ 176101099Srwatson *rules[index] = temprule; 177101099Srwatson } 178101099Srwatson } 179101099Srwatson 180101099Srwatson return (0); 181101099Srwatson} 182101099Srwatson 183101099SrwatsonSYSCTL_NODE(_security_mac_bsdextended, OID_AUTO, rules, 184101099Srwatson CTLFLAG_RW, sysctl_rule, "BSD extended MAC rules"); 185101099Srwatson 186101099Srwatsonstatic void 187101099Srwatsonmac_bsdextended_init(struct mac_policy_conf *mpc) 188101099Srwatson{ 189101099Srwatson 190101099Srwatson /* Initialize ruleset lock. */ 191101099Srwatson /* Register dynamic sysctl's for rules. */ 192101099Srwatson} 193101099Srwatson 194101099Srwatsonstatic void 195101099Srwatsonmac_bsdextended_destroy(struct mac_policy_conf *mpc) 196101099Srwatson{ 197101099Srwatson 198101099Srwatson /* Tear down sysctls. */ 199101099Srwatson /* Destroy ruleset lock. */ 200101099Srwatson} 201101099Srwatson 202101099Srwatsonstatic int 203101099Srwatsonmac_bsdextended_rulecheck(struct mac_bsdextended_rule *rule, 204106212Srwatson struct ucred *cred, uid_t object_uid, gid_t object_gid, int acc_mode) 205101099Srwatson{ 206101099Srwatson int match; 207101099Srwatson 208101099Srwatson /* 209101099Srwatson * Is there a subject match? 210101099Srwatson */ 211101099Srwatson if (rule->mbr_subject.mbi_flags & MBI_UID_DEFINED) { 212101099Srwatson match = (rule->mbr_subject.mbi_uid == cred->cr_uid || 213101099Srwatson rule->mbr_subject.mbi_uid == cred->cr_ruid || 214101099Srwatson rule->mbr_subject.mbi_uid == cred->cr_svuid); 215101099Srwatson 216101099Srwatson if (rule->mbr_subject.mbi_flags & MBI_NEGATED) 217101099Srwatson match = !match; 218101099Srwatson 219101099Srwatson if (!match) 220101099Srwatson return (0); 221101099Srwatson } 222101099Srwatson 223101099Srwatson if (rule->mbr_subject.mbi_flags & MBI_GID_DEFINED) { 224101099Srwatson match = (groupmember(rule->mbr_subject.mbi_gid, cred) || 225101099Srwatson rule->mbr_subject.mbi_gid == cred->cr_rgid || 226101099Srwatson rule->mbr_subject.mbi_gid == cred->cr_svgid); 227101099Srwatson 228101099Srwatson if (rule->mbr_subject.mbi_flags & MBI_NEGATED) 229101099Srwatson match = !match; 230101099Srwatson 231101099Srwatson if (!match) 232101099Srwatson return (0); 233101099Srwatson } 234101099Srwatson 235101099Srwatson /* 236101099Srwatson * Is there an object match? 237101099Srwatson */ 238101099Srwatson if (rule->mbr_object.mbi_flags & MBI_UID_DEFINED) { 239101099Srwatson match = (rule->mbr_object.mbi_uid == object_uid); 240101099Srwatson 241101099Srwatson if (rule->mbr_object.mbi_flags & MBI_NEGATED) 242101099Srwatson match = !match; 243101099Srwatson 244101099Srwatson if (!match) 245101099Srwatson return (0); 246101099Srwatson } 247101099Srwatson 248101099Srwatson if (rule->mbr_object.mbi_flags & MBI_GID_DEFINED) { 249101099Srwatson match = (rule->mbr_object.mbi_gid == object_gid); 250101099Srwatson 251101099Srwatson if (rule->mbr_object.mbi_flags & MBI_NEGATED) 252101099Srwatson match = !match; 253101099Srwatson 254101099Srwatson if (!match) 255101099Srwatson return (0); 256101099Srwatson } 257101099Srwatson 258101099Srwatson /* 259101099Srwatson * Is the access permitted? 260101099Srwatson */ 261101099Srwatson if ((rule->mbr_mode & acc_mode) != acc_mode) { 262101099Srwatson if (mac_bsdextended_debugging) 263101099Srwatson printf("mac_bsdextended: %d:%d request %d on %d:%d" 264101099Srwatson " fails\n", cred->cr_ruid, cred->cr_rgid, 265101099Srwatson acc_mode, object_uid, object_gid); 266101099Srwatson return (EACCES); 267101099Srwatson } 268101099Srwatson 269101099Srwatson return (0); 270101099Srwatson} 271101099Srwatson 272101099Srwatsonstatic int 273101099Srwatsonmac_bsdextended_check(struct ucred *cred, uid_t object_uid, gid_t object_gid, 274106212Srwatson int acc_mode) 275101099Srwatson{ 276101099Srwatson int error, i; 277101099Srwatson 278101099Srwatson for (i = 0; i < rule_slots; i++) { 279101099Srwatson if (rules[i] == NULL) 280101099Srwatson continue; 281101099Srwatson 282108376Srwatson /* 283108376Srwatson * Since we don't separately handle append, map append to 284108376Srwatson * write. 285108376Srwatson */ 286108376Srwatson if (acc_mode & VAPPEND) { 287108376Srwatson acc_mode &= ~VAPPEND; 288108376Srwatson acc_mode |= VWRITE; 289108376Srwatson } 290108376Srwatson 291101099Srwatson error = mac_bsdextended_rulecheck(rules[i], cred, object_uid, 292101099Srwatson object_gid, acc_mode); 293101099Srwatson if (error) 294101099Srwatson return (error); 295101099Srwatson } 296101099Srwatson 297101099Srwatson return (0); 298101099Srwatson} 299101099Srwatson 300101099Srwatsonstatic int 301101099Srwatsonmac_bsdextended_check_vnode_access(struct ucred *cred, struct vnode *vp, 302106212Srwatson struct label *label, int acc_mode) 303101099Srwatson{ 304101099Srwatson struct vattr vap; 305101099Srwatson int error; 306101099Srwatson 307101099Srwatson if (!mac_bsdextended_enabled) 308101099Srwatson return (0); 309101099Srwatson 310101099Srwatson error = VOP_GETATTR(vp, &vap, cred, curthread); 311101099Srwatson if (error) 312101099Srwatson return (error); 313106212Srwatson return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, acc_mode)); 314101099Srwatson} 315101099Srwatson 316101099Srwatsonstatic int 317101099Srwatsonmac_bsdextended_check_vnode_chdir(struct ucred *cred, struct vnode *dvp, 318101099Srwatson struct label *dlabel) 319101099Srwatson{ 320101099Srwatson struct vattr vap; 321101099Srwatson int error; 322101099Srwatson 323101099Srwatson if (!mac_bsdextended_enabled) 324101099Srwatson return (0); 325101099Srwatson 326101099Srwatson error = VOP_GETATTR(dvp, &vap, cred, curthread); 327101099Srwatson if (error) 328101099Srwatson return (error); 329101099Srwatson return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VEXEC)); 330101099Srwatson} 331101099Srwatson 332101099Srwatsonstatic int 333101099Srwatsonmac_bsdextended_check_vnode_chroot(struct ucred *cred, struct vnode *dvp, 334101099Srwatson struct label *dlabel) 335101099Srwatson{ 336101099Srwatson struct vattr vap; 337101099Srwatson int error; 338101099Srwatson 339101099Srwatson if (!mac_bsdextended_enabled) 340101099Srwatson return (0); 341101099Srwatson 342101099Srwatson error = VOP_GETATTR(dvp, &vap, cred, curthread); 343101099Srwatson if (error) 344101099Srwatson return (error); 345101099Srwatson return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VEXEC)); 346101099Srwatson} 347101099Srwatson 348101099Srwatsonstatic int 349101099Srwatsonmac_bsdextended_check_create_vnode(struct ucred *cred, struct vnode *dvp, 350101099Srwatson struct label *dlabel, struct componentname *cnp, struct vattr *vap) 351101099Srwatson{ 352101099Srwatson struct vattr dvap; 353101099Srwatson int error; 354101099Srwatson 355101099Srwatson if (!mac_bsdextended_enabled) 356101099Srwatson return (0); 357101099Srwatson 358101099Srwatson error = VOP_GETATTR(dvp, &dvap, cred, curthread); 359101099Srwatson if (error) 360101099Srwatson return (error); 361101099Srwatson return (mac_bsdextended_check(cred, dvap.va_uid, dvap.va_gid, VWRITE)); 362101099Srwatson} 363101099Srwatson 364101099Srwatsonstatic int 365101099Srwatsonmac_bsdextended_check_vnode_delete(struct ucred *cred, struct vnode *dvp, 366101099Srwatson struct label *dlabel, struct vnode *vp, struct label *label, 367101099Srwatson struct componentname *cnp) 368101099Srwatson{ 369101099Srwatson struct vattr vap; 370101099Srwatson int error; 371101099Srwatson 372101099Srwatson if (!mac_bsdextended_enabled) 373101099Srwatson return (0); 374101099Srwatson 375101099Srwatson error = VOP_GETATTR(dvp, &vap, cred, curthread); 376101099Srwatson if (error) 377101099Srwatson return (error); 378101099Srwatson error = mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VWRITE); 379101099Srwatson if (error) 380101099Srwatson return (error); 381101099Srwatson 382101099Srwatson error = VOP_GETATTR(vp, &vap, cred, curthread); 383101099Srwatson if (error) 384101099Srwatson return (error); 385101099Srwatson return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VWRITE)); 386101099Srwatson} 387101099Srwatson 388101099Srwatsonstatic int 389101099Srwatsonmac_bsdextended_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp, 390101099Srwatson struct label *label, acl_type_t type) 391101099Srwatson{ 392101099Srwatson struct vattr vap; 393101099Srwatson int error; 394101099Srwatson 395101099Srwatson if (!mac_bsdextended_enabled) 396101099Srwatson return (0); 397101099Srwatson 398101099Srwatson error = VOP_GETATTR(vp, &vap, cred, curthread); 399101099Srwatson if (error) 400101099Srwatson return (error); 401101099Srwatson return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VADMIN)); 402101099Srwatson} 403101099Srwatson 404101099Srwatsonstatic int 405101099Srwatsonmac_bsdextended_check_vnode_exec(struct ucred *cred, struct vnode *vp, 406106648Srwatson struct label *label, struct image_params *imgp, 407106648Srwatson struct label *execlabel) 408101099Srwatson{ 409101099Srwatson struct vattr vap; 410101099Srwatson int error; 411101099Srwatson 412101099Srwatson if (!mac_bsdextended_enabled) 413101099Srwatson return (0); 414101099Srwatson 415101099Srwatson error = VOP_GETATTR(vp, &vap, cred, curthread); 416101099Srwatson if (error) 417101099Srwatson return (error); 418101099Srwatson return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, 419101099Srwatson VREAD|VEXEC)); 420101099Srwatson} 421101099Srwatson 422101099Srwatsonstatic int 423101099Srwatsonmac_bsdextended_check_vnode_getacl(struct ucred *cred, struct vnode *vp, 424101099Srwatson struct label *label, acl_type_t type) 425101099Srwatson{ 426101099Srwatson struct vattr vap; 427101099Srwatson int error; 428101099Srwatson 429101099Srwatson if (!mac_bsdextended_enabled) 430101099Srwatson return (0); 431101099Srwatson 432101099Srwatson error = VOP_GETATTR(vp, &vap, cred, curthread); 433101099Srwatson if (error) 434101099Srwatson return (error); 435101099Srwatson return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VSTAT)); 436101099Srwatson} 437101099Srwatson 438101099Srwatsonstatic int 439101099Srwatsonmac_bsdextended_check_vnode_getextattr(struct ucred *cred, struct vnode *vp, 440101099Srwatson struct label *label, int attrnamespace, const char *name, struct uio *uio) 441101099Srwatson{ 442101099Srwatson struct vattr vap; 443101099Srwatson int error; 444101099Srwatson 445101099Srwatson if (!mac_bsdextended_enabled) 446101099Srwatson return (0); 447101099Srwatson 448101099Srwatson error = VOP_GETATTR(vp, &vap, cred, curthread); 449101099Srwatson if (error) 450101099Srwatson return (error); 451101099Srwatson return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VREAD)); 452101099Srwatson} 453101099Srwatson 454101099Srwatsonstatic int 455104530Srwatsonmac_bsdextended_check_vnode_link(struct ucred *cred, struct vnode *dvp, 456104530Srwatson struct label *dlabel, struct vnode *vp, struct label *label, 457104530Srwatson struct componentname *cnp) 458104530Srwatson{ 459104530Srwatson struct vattr vap; 460104530Srwatson int error; 461104530Srwatson 462104530Srwatson if (!mac_bsdextended_enabled) 463104530Srwatson return (0); 464104530Srwatson 465104530Srwatson error = VOP_GETATTR(dvp, &vap, cred, curthread); 466104530Srwatson if (error) 467104530Srwatson return (error); 468104530Srwatson error = mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VWRITE); 469106214Srwatson if (error) 470106214Srwatson return (error); 471104530Srwatson 472104530Srwatson error = VOP_GETATTR(vp, &vap, cred, curthread); 473104530Srwatson if (error) 474104530Srwatson return (error); 475104530Srwatson error = mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VWRITE); 476104530Srwatson if (error) 477104530Srwatson return (error); 478104530Srwatson return (0); 479104530Srwatson} 480104530Srwatson 481104530Srwatsonstatic int 482101099Srwatsonmac_bsdextended_check_vnode_lookup(struct ucred *cred, struct vnode *dvp, 483101099Srwatson struct label *dlabel, struct componentname *cnp) 484101099Srwatson{ 485101099Srwatson struct vattr vap; 486101099Srwatson int error; 487101099Srwatson 488101099Srwatson if (!mac_bsdextended_enabled) 489101099Srwatson return (0); 490101099Srwatson 491101099Srwatson error = VOP_GETATTR(dvp, &vap, cred, curthread); 492101099Srwatson if (error) 493101099Srwatson return (error); 494101099Srwatson return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VEXEC)); 495101099Srwatson} 496101099Srwatson 497101099Srwatsonstatic int 498101099Srwatsonmac_bsdextended_check_vnode_open(struct ucred *cred, struct vnode *vp, 499106212Srwatson struct label *filelabel, int acc_mode) 500101099Srwatson{ 501101099Srwatson struct vattr vap; 502101099Srwatson int error; 503101099Srwatson 504101099Srwatson if (!mac_bsdextended_enabled) 505101099Srwatson return (0); 506101099Srwatson 507101099Srwatson error = VOP_GETATTR(vp, &vap, cred, curthread); 508101099Srwatson if (error) 509101099Srwatson return (error); 510101099Srwatson return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, acc_mode)); 511101099Srwatson} 512101099Srwatson 513101099Srwatsonstatic int 514101099Srwatsonmac_bsdextended_check_vnode_readdir(struct ucred *cred, struct vnode *dvp, 515101099Srwatson struct label *dlabel) 516101099Srwatson{ 517101099Srwatson struct vattr vap; 518101099Srwatson int error; 519101099Srwatson 520101099Srwatson if (!mac_bsdextended_enabled) 521101099Srwatson return (0); 522101099Srwatson 523101099Srwatson error = VOP_GETATTR(dvp, &vap, cred, curthread); 524101099Srwatson if (error) 525101099Srwatson return (error); 526101099Srwatson return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VREAD)); 527101099Srwatson} 528101099Srwatson 529101099Srwatsonstatic int 530101099Srwatsonmac_bsdextended_check_vnode_readdlink(struct ucred *cred, struct vnode *vp, 531101099Srwatson struct label *label) 532101099Srwatson{ 533101099Srwatson struct vattr vap; 534101099Srwatson int error; 535101099Srwatson 536101099Srwatson if (!mac_bsdextended_enabled) 537101099Srwatson return (0); 538101099Srwatson 539101099Srwatson error = VOP_GETATTR(vp, &vap, cred, curthread); 540101099Srwatson if (error) 541101099Srwatson return (error); 542101099Srwatson return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VREAD)); 543101099Srwatson} 544101099Srwatson 545101099Srwatsonstatic int 546101099Srwatsonmac_bsdextended_check_vnode_rename_from(struct ucred *cred, struct vnode *dvp, 547101099Srwatson struct label *dlabel, struct vnode *vp, struct label *label, 548101099Srwatson struct componentname *cnp) 549101099Srwatson{ 550101099Srwatson struct vattr vap; 551101099Srwatson int error; 552101099Srwatson 553101099Srwatson if (!mac_bsdextended_enabled) 554101099Srwatson return (0); 555101099Srwatson 556101099Srwatson error = VOP_GETATTR(dvp, &vap, cred, curthread); 557101099Srwatson if (error) 558101099Srwatson return (error); 559101099Srwatson error = mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VWRITE); 560101099Srwatson if (error) 561101099Srwatson return (error); 562101099Srwatson error = VOP_GETATTR(vp, &vap, cred, curthread); 563101099Srwatson if (error) 564101099Srwatson return (error); 565101099Srwatson error = mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VWRITE); 566101099Srwatson 567101099Srwatson return (error); 568101099Srwatson} 569101099Srwatson 570101099Srwatsonstatic int 571101099Srwatsonmac_bsdextended_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp, 572101099Srwatson struct label *dlabel, struct vnode *vp, struct label *label, int samedir, 573101099Srwatson struct componentname *cnp) 574101099Srwatson{ 575101099Srwatson struct vattr vap; 576101099Srwatson int error; 577101099Srwatson 578101099Srwatson if (!mac_bsdextended_enabled) 579101099Srwatson return (0); 580101099Srwatson 581101099Srwatson error = VOP_GETATTR(dvp, &vap, cred, curthread); 582101099Srwatson if (error) 583101099Srwatson return (error); 584101099Srwatson error = mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VWRITE); 585101099Srwatson if (error) 586101099Srwatson return (error); 587101099Srwatson 588101099Srwatson if (vp != NULL) { 589101099Srwatson error = VOP_GETATTR(vp, &vap, cred, curthread); 590101099Srwatson if (error) 591101099Srwatson return (error); 592101099Srwatson error = mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, 593101099Srwatson VWRITE); 594101099Srwatson } 595101099Srwatson 596101099Srwatson return (error); 597101099Srwatson} 598101099Srwatson 599101099Srwatsonstatic int 600101099Srwatsonmac_bsdextended_check_vnode_revoke(struct ucred *cred, struct vnode *vp, 601101099Srwatson struct label *label) 602101099Srwatson{ 603101099Srwatson struct vattr vap; 604101099Srwatson int error; 605101099Srwatson 606101099Srwatson if (!mac_bsdextended_enabled) 607101099Srwatson return (0); 608101099Srwatson 609101099Srwatson error = VOP_GETATTR(vp, &vap, cred, curthread); 610101099Srwatson if (error) 611101099Srwatson return (error); 612101099Srwatson return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VADMIN)); 613101099Srwatson} 614101099Srwatson 615101099Srwatsonstatic int 616101099Srwatsonmac_bsdextended_check_setacl_vnode(struct ucred *cred, struct vnode *vp, 617101099Srwatson struct label *label, acl_type_t type, struct acl *acl) 618101099Srwatson{ 619101099Srwatson struct vattr vap; 620101099Srwatson int error; 621101099Srwatson 622101099Srwatson if (!mac_bsdextended_enabled) 623101099Srwatson return (0); 624101099Srwatson 625101099Srwatson error = VOP_GETATTR(vp, &vap, cred, curthread); 626101099Srwatson if (error) 627101099Srwatson return (error); 628101099Srwatson return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VADMIN)); 629101099Srwatson} 630101099Srwatson 631101099Srwatsonstatic int 632101099Srwatsonmac_bsdextended_check_vnode_setextattr(struct ucred *cred, struct vnode *vp, 633101099Srwatson struct label *label, int attrnamespace, const char *name, struct uio *uio) 634101099Srwatson{ 635101099Srwatson struct vattr vap; 636101099Srwatson int error; 637101099Srwatson 638101099Srwatson if (!mac_bsdextended_enabled) 639101099Srwatson return (0); 640101099Srwatson 641101099Srwatson error = VOP_GETATTR(vp, &vap, cred, curthread); 642101099Srwatson if (error) 643101099Srwatson return (error); 644101099Srwatson return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VWRITE)); 645101099Srwatson} 646101099Srwatson 647101099Srwatsonstatic int 648101099Srwatsonmac_bsdextended_check_vnode_setflags(struct ucred *cred, struct vnode *vp, 649101099Srwatson struct label *label, u_long flags) 650101099Srwatson{ 651101099Srwatson struct vattr vap; 652101099Srwatson int error; 653101099Srwatson 654101099Srwatson if (!mac_bsdextended_enabled) 655101099Srwatson return (0); 656101099Srwatson 657101099Srwatson error = VOP_GETATTR(vp, &vap, cred, curthread); 658101099Srwatson if (error) 659101099Srwatson return (error); 660101099Srwatson return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VADMIN)); 661101099Srwatson} 662101099Srwatson 663101099Srwatsonstatic int 664101099Srwatsonmac_bsdextended_check_vnode_setmode(struct ucred *cred, struct vnode *vp, 665101099Srwatson struct label *label, mode_t mode) 666101099Srwatson{ 667101099Srwatson struct vattr vap; 668101099Srwatson int error; 669101099Srwatson 670101099Srwatson if (!mac_bsdextended_enabled) 671101099Srwatson return (0); 672101099Srwatson 673101099Srwatson error = VOP_GETATTR(vp, &vap, cred, curthread); 674101099Srwatson if (error) 675101099Srwatson return (error); 676101099Srwatson return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VADMIN)); 677101099Srwatson} 678101099Srwatson 679101099Srwatsonstatic int 680101099Srwatsonmac_bsdextended_check_vnode_setowner(struct ucred *cred, struct vnode *vp, 681101099Srwatson struct label *label, uid_t uid, gid_t gid) 682101099Srwatson{ 683101099Srwatson struct vattr vap; 684101099Srwatson int error; 685101099Srwatson 686101099Srwatson if (!mac_bsdextended_enabled) 687101099Srwatson return (0); 688101099Srwatson 689101099Srwatson error = VOP_GETATTR(vp, &vap, cred, curthread); 690101099Srwatson if (error) 691101099Srwatson return (error); 692101099Srwatson return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VADMIN)); 693101099Srwatson} 694101099Srwatson 695101099Srwatsonstatic int 696101099Srwatsonmac_bsdextended_check_vnode_setutimes(struct ucred *cred, struct vnode *vp, 697101099Srwatson struct label *label, struct timespec atime, struct timespec utime) 698101099Srwatson{ 699101099Srwatson struct vattr vap; 700101099Srwatson int error; 701101099Srwatson 702101099Srwatson if (!mac_bsdextended_enabled) 703101099Srwatson return (0); 704101099Srwatson 705101099Srwatson error = VOP_GETATTR(vp, &vap, cred, curthread); 706101099Srwatson if (error) 707101099Srwatson return (error); 708101099Srwatson return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VADMIN)); 709101099Srwatson} 710101099Srwatson 711101099Srwatsonstatic int 712102129Srwatsonmac_bsdextended_check_vnode_stat(struct ucred *active_cred, 713102129Srwatson struct ucred *file_cred, struct vnode *vp, struct label *label) 714101099Srwatson{ 715101099Srwatson struct vattr vap; 716101099Srwatson int error; 717101099Srwatson 718101099Srwatson if (!mac_bsdextended_enabled) 719101099Srwatson return (0); 720101099Srwatson 721102129Srwatson error = VOP_GETATTR(vp, &vap, active_cred, curthread); 722101099Srwatson if (error) 723101099Srwatson return (error); 724102129Srwatson return (mac_bsdextended_check(active_cred, vap.va_uid, vap.va_gid, 725102129Srwatson VSTAT)); 726101099Srwatson} 727101099Srwatson 728106217Srwatsonstatic struct mac_policy_ops mac_bsdextended_ops = 729101099Srwatson{ 730106217Srwatson .mpo_destroy = mac_bsdextended_destroy, 731106217Srwatson .mpo_init = mac_bsdextended_init, 732106217Srwatson .mpo_check_vnode_access = mac_bsdextended_check_vnode_access, 733106217Srwatson .mpo_check_vnode_chdir = mac_bsdextended_check_vnode_chdir, 734106217Srwatson .mpo_check_vnode_chroot = mac_bsdextended_check_vnode_chroot, 735106217Srwatson .mpo_check_vnode_create = mac_bsdextended_check_create_vnode, 736106217Srwatson .mpo_check_vnode_delete = mac_bsdextended_check_vnode_delete, 737106217Srwatson .mpo_check_vnode_deleteacl = mac_bsdextended_check_vnode_deleteacl, 738106217Srwatson .mpo_check_vnode_exec = mac_bsdextended_check_vnode_exec, 739106217Srwatson .mpo_check_vnode_getacl = mac_bsdextended_check_vnode_getacl, 740106217Srwatson .mpo_check_vnode_getextattr = mac_bsdextended_check_vnode_getextattr, 741106217Srwatson .mpo_check_vnode_link = mac_bsdextended_check_vnode_link, 742106217Srwatson .mpo_check_vnode_lookup = mac_bsdextended_check_vnode_lookup, 743106217Srwatson .mpo_check_vnode_open = mac_bsdextended_check_vnode_open, 744106217Srwatson .mpo_check_vnode_readdir = mac_bsdextended_check_vnode_readdir, 745106217Srwatson .mpo_check_vnode_readlink = mac_bsdextended_check_vnode_readdlink, 746106217Srwatson .mpo_check_vnode_rename_from = mac_bsdextended_check_vnode_rename_from, 747106217Srwatson .mpo_check_vnode_rename_to = mac_bsdextended_check_vnode_rename_to, 748106217Srwatson .mpo_check_vnode_revoke = mac_bsdextended_check_vnode_revoke, 749106217Srwatson .mpo_check_vnode_setacl = mac_bsdextended_check_setacl_vnode, 750106217Srwatson .mpo_check_vnode_setextattr = mac_bsdextended_check_vnode_setextattr, 751106217Srwatson .mpo_check_vnode_setflags = mac_bsdextended_check_vnode_setflags, 752106217Srwatson .mpo_check_vnode_setmode = mac_bsdextended_check_vnode_setmode, 753106217Srwatson .mpo_check_vnode_setowner = mac_bsdextended_check_vnode_setowner, 754106217Srwatson .mpo_check_vnode_setutimes = mac_bsdextended_check_vnode_setutimes, 755106217Srwatson .mpo_check_vnode_stat = mac_bsdextended_check_vnode_stat, 756101099Srwatson}; 757101099Srwatson 758106217SrwatsonMAC_POLICY_SET(&mac_bsdextended_ops, trustedbsd_mac_bsdextended, 759101099Srwatson "TrustedBSD MAC/BSD Extended", MPC_LOADTIME_FLAG_UNLOADOK, NULL); 760