mac_process.c revision 102103
1/*- 2 * Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson 3 * Copyright (c) 2001 Ilmar S. Habibulin 4 * Copyright (c) 2001, 2002 Networks Associates Technology, Inc. 5 * All rights reserved. 6 * 7 * This software was developed by Robert Watson and Ilmar Habibulin for the 8 * TrustedBSD Project. 9 * 10 * This software was developed for the FreeBSD Project in part by NAI Labs, 11 * the Security Research Division of Network Associates, Inc. under 12 * DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA 13 * CHATS research program. 14 * 15 * Redistribution and use in source and binary forms, with or without 16 * modification, are permitted provided that the following conditions 17 * are met: 18 * 1. Redistributions of source code must retain the above copyright 19 * notice, this list of conditions and the following disclaimer. 20 * 2. Redistributions in binary form must reproduce the above copyright 21 * notice, this list of conditions and the following disclaimer in the 22 * documentation and/or other materials provided with the distribution. 23 * 3. The names of the authors may not be used to endorse or promote 24 * products derived from this software without specific prior written 25 * permission. 26 * 27 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 28 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 29 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 30 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 31 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 32 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 33 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 34 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 35 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 36 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 37 * SUCH DAMAGE. 38 * 39 * $FreeBSD: head/sys/security/mac/mac_process.c 102103 2002-08-19 15:30:30Z rwatson $ 40 */ 41/* 42 * Developed by the TrustedBSD Project. 43 * 44 * Framework for extensible kernel access control. Kernel and userland 45 * interface to the framework, policy registration and composition. 46 */ 47 48#include "opt_mac.h" 49 50#include <sys/param.h> 51#include <sys/extattr.h> 52#include <sys/kernel.h> 53#include <sys/lock.h> 54#include <sys/mutex.h> 55#include <sys/sx.h> 56#include <sys/mac.h> 57#include <sys/module.h> 58#include <sys/proc.h> 59#include <sys/systm.h> 60#include <sys/sysproto.h> 61#include <sys/sysent.h> 62#include <sys/vnode.h> 63#include <sys/mount.h> 64#include <sys/file.h> 65#include <sys/namei.h> 66#include <sys/socket.h> 67#include <sys/pipe.h> 68#include <sys/socketvar.h> 69#include <sys/sx.h> 70#include <sys/sysctl.h> 71 72#include <vm/vm.h> 73#include <vm/pmap.h> 74#include <vm/vm_map.h> 75#include <vm/vm_object.h> 76 77#include <sys/mac_policy.h> 78 79#include <fs/devfs/devfs.h> 80 81#include <net/bpf.h> 82#include <net/bpfdesc.h> 83#include <net/if.h> 84#include <net/if_var.h> 85 86#include <netinet/in.h> 87#include <netinet/ip_var.h> 88 89#ifdef MAC 90 91/* 92 * Declare that the kernel provides MAC support, version 1. This permits 93 * modules to refuse to be loaded if the necessary support isn't present, 94 * even if it's pre-boot. 95 */ 96MODULE_VERSION(kernel_mac_support, 1); 97 98SYSCTL_DECL(_security); 99 100SYSCTL_NODE(_security, OID_AUTO, mac, CTLFLAG_RW, 0, 101 "TrustedBSD MAC policy controls"); 102SYSCTL_NODE(_security_mac, OID_AUTO, debug, CTLFLAG_RW, 0, 103 "TrustedBSD MAC debug info"); 104 105static int mac_debug_label_fallback = 0; 106SYSCTL_INT(_security_mac_debug, OID_AUTO, label_fallback, CTLFLAG_RW, 107 &mac_debug_label_fallback, 0, "Filesystems should fall back to fs label" 108 "when label is corrupted."); 109TUNABLE_INT("security.mac.debug_label_fallback", 110 &mac_debug_label_fallback); 111 112#ifndef MAC_MAX_POLICIES 113#define MAC_MAX_POLICIES 8 114#endif 115#if MAC_MAX_POLICIES > 32 116#error "MAC_MAX_POLICIES too large" 117#endif 118static unsigned int mac_max_policies = MAC_MAX_POLICIES; 119static unsigned int mac_policy_offsets_free = (1 << MAC_MAX_POLICIES) - 1; 120SYSCTL_UINT(_security_mac, OID_AUTO, max_policies, CTLFLAG_RD, 121 &mac_max_policies, 0, ""); 122 123static int mac_late = 0; 124 125static int mac_enforce_fs = 1; 126SYSCTL_INT(_security_mac, OID_AUTO, enforce_fs, CTLFLAG_RW, 127 &mac_enforce_fs, 0, "Enforce MAC policy on file system objects"); 128TUNABLE_INT("security.mac.enforce_fs", &mac_enforce_fs); 129 130static int mac_enforce_network = 1; 131SYSCTL_INT(_security_mac, OID_AUTO, enforce_network, CTLFLAG_RW, 132 &mac_enforce_network, 0, "Enforce MAC policy on network packets"); 133TUNABLE_INT("security.mac.enforce_network", &mac_enforce_network); 134 135static int mac_enforce_process = 1; 136SYSCTL_INT(_security_mac, OID_AUTO, enforce_process, CTLFLAG_RW, 137 &mac_enforce_process, 0, "Enforce MAC policy on inter-process operations"); 138TUNABLE_INT("security.mac.enforce_process", &mac_enforce_process); 139 140static int mac_enforce_socket = 1; 141SYSCTL_INT(_security_mac, OID_AUTO, enforce_socket, CTLFLAG_RW, 142 &mac_enforce_socket, 0, "Enforce MAC policy on socket operations"); 143TUNABLE_INT("security.mac.enforce_socket", &mac_enforce_socket); 144 145static int mac_enforce_pipe = 1; 146SYSCTL_INT(_security_mac, OID_AUTO, enforce_pipe, CTLFLAG_RW, 147 &mac_enforce_pipe, 0, "Enforce MAC policy on pipe operations"); 148 149static int mac_label_size = sizeof(struct mac); 150SYSCTL_INT(_security_mac, OID_AUTO, label_size, CTLFLAG_RD, 151 &mac_label_size, 0, "Pre-compiled MAC label size"); 152 153static int mac_cache_fslabel_in_vnode = 1; 154SYSCTL_INT(_security_mac, OID_AUTO, cache_fslabel_in_vnode, CTLFLAG_RW, 155 &mac_cache_fslabel_in_vnode, 0, "Cache mount fslabel in vnode"); 156TUNABLE_INT("security.mac.cache_fslabel_in_vnode", 157 &mac_cache_fslabel_in_vnode); 158 159static int mac_vnode_label_cache_hits = 0; 160SYSCTL_INT(_security_mac, OID_AUTO, vnode_label_cache_hits, CTLFLAG_RD, 161 &mac_vnode_label_cache_hits, 0, "Cache hits on vnode labels"); 162static int mac_vnode_label_cache_misses = 0; 163SYSCTL_INT(_security_mac, OID_AUTO, vnode_label_cache_misses, CTLFLAG_RD, 164 &mac_vnode_label_cache_misses, 0, "Cache misses on vnode labels"); 165static int mac_mmap_revocation_via_cow = 0; 166SYSCTL_INT(_security_mac, OID_AUTO, mmap_revocation_via_cow, CTLFLAG_RW, 167 &mac_mmap_revocation_via_cow, 0, "Revoke mmap access to files via " 168 "copy-on-write semantics, or by removing all write access"); 169 170#ifdef MAC_DEBUG 171static unsigned int nmacmbufs, nmaccreds, nmacifnets, nmacbpfdescs, 172 nmacsockets, nmacmounts, nmactemp, nmacvnodes, nmacdevfsdirents, 173 nmacipqs, nmacpipes; 174SYSCTL_UINT(_security_mac_debug, OID_AUTO, mbufs, CTLFLAG_RD, 175 &nmacmbufs, 0, "number of mbufs in use"); 176SYSCTL_UINT(_security_mac_debug, OID_AUTO, creds, CTLFLAG_RD, 177 &nmaccreds, 0, "number of ucreds in use"); 178SYSCTL_UINT(_security_mac_debug, OID_AUTO, ifnets, CTLFLAG_RD, 179 &nmacifnets, 0, "number of ifnets in use"); 180SYSCTL_UINT(_security_mac_debug, OID_AUTO, ipqs, CTLFLAG_RD, 181 &nmacipqs, 0, "number of ipqs in use"); 182SYSCTL_UINT(_security_mac_debug, OID_AUTO, bpfdescs, CTLFLAG_RD, 183 &nmacbpfdescs, 0, "number of bpfdescs in use"); 184SYSCTL_UINT(_security_mac_debug, OID_AUTO, sockets, CTLFLAG_RD, 185 &nmacsockets, 0, "number of sockets in use"); 186SYSCTL_UINT(_security_mac_debug, OID_AUTO, pipes, CTLFLAG_RD, 187 &nmacpipes, 0, "number of pipes in use"); 188SYSCTL_UINT(_security_mac_debug, OID_AUTO, mounts, CTLFLAG_RD, 189 &nmacmounts, 0, "number of mounts in use"); 190SYSCTL_UINT(_security_mac_debug, OID_AUTO, temp, CTLFLAG_RD, 191 &nmactemp, 0, "number of temporary labels in use"); 192SYSCTL_UINT(_security_mac_debug, OID_AUTO, vnodes, CTLFLAG_RD, 193 &nmacvnodes, 0, "number of vnodes in use"); 194SYSCTL_UINT(_security_mac_debug, OID_AUTO, devfsdirents, CTLFLAG_RD, 195 &nmacdevfsdirents, 0, "number of devfs dirents inuse"); 196#endif 197 198static int error_select(int error1, int error2); 199static int mac_externalize(struct label *label, struct mac *mac); 200static int mac_policy_register(struct mac_policy_conf *mpc); 201static int mac_policy_unregister(struct mac_policy_conf *mpc); 202 203static int mac_stdcreatevnode_ea(struct vnode *vp); 204static void mac_cred_mmapped_drop_perms(struct thread *td, 205 struct ucred *cred); 206static void mac_cred_mmapped_drop_perms_recurse(struct thread *td, 207 struct ucred *cred, struct vm_map *map); 208 209MALLOC_DEFINE(M_MACOPVEC, "macopvec", "MAC policy operation vector"); 210MALLOC_DEFINE(M_MACPIPELABEL, "macpipelabel", "MAC labels for pipes"); 211 212/* 213 * mac_policy_list_lock protects the consistency of 'mac_policy_list', 214 * the linked list of attached policy modules. Read-only consumers of 215 * the list must acquire a shared lock for the duration of their use; 216 * writers must acquire an exclusive lock. Note that for compound 217 * operations, locks should be held for the entire compound operation, 218 * and that this is not yet done for relabel requests. 219 */ 220static struct mtx mac_policy_list_lock; 221static LIST_HEAD(, mac_policy_conf) mac_policy_list; 222static int mac_policy_list_busy; 223#define MAC_POLICY_LIST_LOCKINIT() mtx_init(&mac_policy_list_lock, \ 224 "mac_policy_list_lock", NULL, MTX_DEF); 225#define MAC_POLICY_LIST_LOCK() mtx_lock(&mac_policy_list_lock); 226#define MAC_POLICY_LIST_UNLOCK() mtx_unlock(&mac_policy_list_lock); 227 228#define MAC_POLICY_LIST_BUSY() do { \ 229 MAC_POLICY_LIST_LOCK(); \ 230 mac_policy_list_busy++; \ 231 MAC_POLICY_LIST_UNLOCK(); \ 232} while (0) 233 234#define MAC_POLICY_LIST_UNBUSY() do { \ 235 MAC_POLICY_LIST_LOCK(); \ 236 mac_policy_list_busy--; \ 237 if (mac_policy_list_busy < 0) \ 238 panic("Extra mac_policy_list_busy--"); \ 239 MAC_POLICY_LIST_UNLOCK(); \ 240} while (0) 241 242/* 243 * MAC_CHECK performs the designated check by walking the policy 244 * module list and checking with each as to how it feels about the 245 * request. Note that it returns its value via 'error' in the scope 246 * of the caller. 247 */ 248#define MAC_CHECK(check, args...) do { \ 249 struct mac_policy_conf *mpc; \ 250 \ 251 error = 0; \ 252 MAC_POLICY_LIST_BUSY(); \ 253 LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { \ 254 if (mpc->mpc_ops->mpo_ ## check != NULL) \ 255 error = error_select( \ 256 mpc->mpc_ops->mpo_ ## check (args), \ 257 error); \ 258 } \ 259 MAC_POLICY_LIST_UNBUSY(); \ 260} while (0) 261 262/* 263 * MAC_BOOLEAN performs the designated boolean composition by walking 264 * the module list, invoking each instance of the operation, and 265 * combining the results using the passed C operator. Note that it 266 * returns its value via 'result' in the scope of the caller, which 267 * should be initialized by the caller in a meaningful way to get 268 * a meaningful result. 269 */ 270#define MAC_BOOLEAN(operation, composition, args...) do { \ 271 struct mac_policy_conf *mpc; \ 272 \ 273 MAC_POLICY_LIST_BUSY(); \ 274 LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { \ 275 if (mpc->mpc_ops->mpo_ ## operation != NULL) \ 276 result = result composition \ 277 mpc->mpc_ops->mpo_ ## operation (args); \ 278 } \ 279 MAC_POLICY_LIST_UNBUSY(); \ 280} while (0) 281 282/* 283 * MAC_PERFORM performs the designated operation by walking the policy 284 * module list and invoking that operation for each policy. 285 */ 286#define MAC_PERFORM(operation, args...) do { \ 287 struct mac_policy_conf *mpc; \ 288 \ 289 MAC_POLICY_LIST_BUSY(); \ 290 LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { \ 291 if (mpc->mpc_ops->mpo_ ## operation != NULL) \ 292 mpc->mpc_ops->mpo_ ## operation (args); \ 293 } \ 294 MAC_POLICY_LIST_UNBUSY(); \ 295} while (0) 296 297/* 298 * Initialize the MAC subsystem, including appropriate SMP locks. 299 */ 300static void 301mac_init(void) 302{ 303 304 LIST_INIT(&mac_policy_list); 305 MAC_POLICY_LIST_LOCKINIT(); 306} 307 308/* 309 * For the purposes of modules that want to know if they were loaded 310 * "early", set the mac_late flag once we've processed modules either 311 * linked into the kernel, or loaded before the kernel startup. 312 */ 313static void 314mac_late_init(void) 315{ 316 317 mac_late = 1; 318} 319 320/* 321 * Allow MAC policy modules to register during boot, etc. 322 */ 323int 324mac_policy_modevent(module_t mod, int type, void *data) 325{ 326 struct mac_policy_conf *mpc; 327 int error; 328 329 error = 0; 330 mpc = (struct mac_policy_conf *) data; 331 332 switch (type) { 333 case MOD_LOAD: 334 if (mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_NOTLATE && 335 mac_late) { 336 printf("mac_policy_modevent: can't load %s policy " 337 "after booting\n", mpc->mpc_name); 338 error = EBUSY; 339 break; 340 } 341 error = mac_policy_register(mpc); 342 break; 343 case MOD_UNLOAD: 344 /* Don't unregister the module if it was never registered. */ 345 if ((mpc->mpc_runtime_flags & MPC_RUNTIME_FLAG_REGISTERED) 346 != 0) 347 error = mac_policy_unregister(mpc); 348 else 349 error = 0; 350 break; 351 default: 352 break; 353 } 354 355 return (error); 356} 357 358static int 359mac_policy_register(struct mac_policy_conf *mpc) 360{ 361 struct mac_policy_conf *tmpc; 362 struct mac_policy_ops *ops; 363 struct mac_policy_op_entry *mpe; 364 int slot; 365 366 MALLOC(mpc->mpc_ops, struct mac_policy_ops *, sizeof(*ops), M_MACOPVEC, 367 M_WAITOK | M_ZERO); 368 for (mpe = mpc->mpc_entries; mpe->mpe_constant != MAC_OP_LAST; mpe++) { 369 switch (mpe->mpe_constant) { 370 case MAC_OP_LAST: 371 /* 372 * Doesn't actually happen, but this allows checking 373 * that all enumerated values are handled. 374 */ 375 break; 376 case MAC_DESTROY: 377 mpc->mpc_ops->mpo_destroy = 378 mpe->mpe_function; 379 break; 380 case MAC_INIT: 381 mpc->mpc_ops->mpo_init = 382 mpe->mpe_function; 383 break; 384 case MAC_INIT_BPFDESC: 385 mpc->mpc_ops->mpo_init_bpfdesc = 386 mpe->mpe_function; 387 break; 388 case MAC_INIT_CRED: 389 mpc->mpc_ops->mpo_init_cred = 390 mpe->mpe_function; 391 break; 392 case MAC_INIT_DEVFSDIRENT: 393 mpc->mpc_ops->mpo_init_devfsdirent = 394 mpe->mpe_function; 395 break; 396 case MAC_INIT_IFNET: 397 mpc->mpc_ops->mpo_init_ifnet = 398 mpe->mpe_function; 399 break; 400 case MAC_INIT_IPQ: 401 mpc->mpc_ops->mpo_init_ipq = 402 mpe->mpe_function; 403 break; 404 case MAC_INIT_MBUF: 405 mpc->mpc_ops->mpo_init_mbuf = 406 mpe->mpe_function; 407 break; 408 case MAC_INIT_MOUNT: 409 mpc->mpc_ops->mpo_init_mount = 410 mpe->mpe_function; 411 break; 412 case MAC_INIT_PIPE: 413 mpc->mpc_ops->mpo_init_pipe = 414 mpe->mpe_function; 415 break; 416 case MAC_INIT_SOCKET: 417 mpc->mpc_ops->mpo_init_socket = 418 mpe->mpe_function; 419 break; 420 case MAC_INIT_TEMP: 421 mpc->mpc_ops->mpo_init_temp = 422 mpe->mpe_function; 423 break; 424 case MAC_INIT_VNODE: 425 mpc->mpc_ops->mpo_init_vnode = 426 mpe->mpe_function; 427 break; 428 case MAC_DESTROY_BPFDESC: 429 mpc->mpc_ops->mpo_destroy_bpfdesc = 430 mpe->mpe_function; 431 break; 432 case MAC_DESTROY_CRED: 433 mpc->mpc_ops->mpo_destroy_cred = 434 mpe->mpe_function; 435 break; 436 case MAC_DESTROY_DEVFSDIRENT: 437 mpc->mpc_ops->mpo_destroy_devfsdirent = 438 mpe->mpe_function; 439 break; 440 case MAC_DESTROY_IFNET: 441 mpc->mpc_ops->mpo_destroy_ifnet = 442 mpe->mpe_function; 443 break; 444 case MAC_DESTROY_IPQ: 445 mpc->mpc_ops->mpo_destroy_ipq = 446 mpe->mpe_function; 447 break; 448 case MAC_DESTROY_MBUF: 449 mpc->mpc_ops->mpo_destroy_mbuf = 450 mpe->mpe_function; 451 break; 452 case MAC_DESTROY_MOUNT: 453 mpc->mpc_ops->mpo_destroy_mount = 454 mpe->mpe_function; 455 break; 456 case MAC_DESTROY_PIPE: 457 mpc->mpc_ops->mpo_destroy_pipe = 458 mpe->mpe_function; 459 break; 460 case MAC_DESTROY_SOCKET: 461 mpc->mpc_ops->mpo_destroy_socket = 462 mpe->mpe_function; 463 break; 464 case MAC_DESTROY_TEMP: 465 mpc->mpc_ops->mpo_destroy_temp = 466 mpe->mpe_function; 467 break; 468 case MAC_DESTROY_VNODE: 469 mpc->mpc_ops->mpo_destroy_vnode = 470 mpe->mpe_function; 471 break; 472 case MAC_EXTERNALIZE: 473 mpc->mpc_ops->mpo_externalize = 474 mpe->mpe_function; 475 break; 476 case MAC_INTERNALIZE: 477 mpc->mpc_ops->mpo_internalize = 478 mpe->mpe_function; 479 break; 480 case MAC_CREATE_DEVFS_DEVICE: 481 mpc->mpc_ops->mpo_create_devfs_device = 482 mpe->mpe_function; 483 break; 484 case MAC_CREATE_DEVFS_DIRECTORY: 485 mpc->mpc_ops->mpo_create_devfs_directory = 486 mpe->mpe_function; 487 break; 488 case MAC_CREATE_DEVFS_VNODE: 489 mpc->mpc_ops->mpo_create_devfs_vnode = 490 mpe->mpe_function; 491 break; 492 case MAC_STDCREATEVNODE_EA: 493 mpc->mpc_ops->mpo_stdcreatevnode_ea = 494 mpe->mpe_function; 495 break; 496 case MAC_CREATE_VNODE: 497 mpc->mpc_ops->mpo_create_vnode = 498 mpe->mpe_function; 499 break; 500 case MAC_CREATE_MOUNT: 501 mpc->mpc_ops->mpo_create_mount = 502 mpe->mpe_function; 503 break; 504 case MAC_CREATE_ROOT_MOUNT: 505 mpc->mpc_ops->mpo_create_root_mount = 506 mpe->mpe_function; 507 break; 508 case MAC_RELABEL_VNODE: 509 mpc->mpc_ops->mpo_relabel_vnode = 510 mpe->mpe_function; 511 break; 512 case MAC_UPDATE_DEVFSDIRENT: 513 mpc->mpc_ops->mpo_update_devfsdirent = 514 mpe->mpe_function; 515 break; 516 case MAC_UPDATE_PROCFSVNODE: 517 mpc->mpc_ops->mpo_update_procfsvnode = 518 mpe->mpe_function; 519 break; 520 case MAC_UPDATE_VNODE_FROM_EXTATTR: 521 mpc->mpc_ops->mpo_update_vnode_from_extattr = 522 mpe->mpe_function; 523 break; 524 case MAC_UPDATE_VNODE_FROM_EXTERNALIZED: 525 mpc->mpc_ops->mpo_update_vnode_from_externalized = 526 mpe->mpe_function; 527 break; 528 case MAC_UPDATE_VNODE_FROM_MOUNT: 529 mpc->mpc_ops->mpo_update_vnode_from_mount = 530 mpe->mpe_function; 531 break; 532 case MAC_CREATE_MBUF_FROM_SOCKET: 533 mpc->mpc_ops->mpo_create_mbuf_from_socket = 534 mpe->mpe_function; 535 break; 536 case MAC_CREATE_PIPE: 537 mpc->mpc_ops->mpo_create_pipe = 538 mpe->mpe_function; 539 break; 540 case MAC_CREATE_SOCKET: 541 mpc->mpc_ops->mpo_create_socket = 542 mpe->mpe_function; 543 break; 544 case MAC_CREATE_SOCKET_FROM_SOCKET: 545 mpc->mpc_ops->mpo_create_socket_from_socket = 546 mpe->mpe_function; 547 break; 548 case MAC_RELABEL_PIPE: 549 mpc->mpc_ops->mpo_relabel_pipe = 550 mpe->mpe_function; 551 break; 552 case MAC_RELABEL_SOCKET: 553 mpc->mpc_ops->mpo_relabel_socket = 554 mpe->mpe_function; 555 break; 556 case MAC_SET_SOCKET_PEER_FROM_MBUF: 557 mpc->mpc_ops->mpo_set_socket_peer_from_mbuf = 558 mpe->mpe_function; 559 break; 560 case MAC_SET_SOCKET_PEER_FROM_SOCKET: 561 mpc->mpc_ops->mpo_set_socket_peer_from_socket = 562 mpe->mpe_function; 563 break; 564 case MAC_CREATE_BPFDESC: 565 mpc->mpc_ops->mpo_create_bpfdesc = 566 mpe->mpe_function; 567 break; 568 case MAC_CREATE_DATAGRAM_FROM_IPQ: 569 mpc->mpc_ops->mpo_create_datagram_from_ipq = 570 mpe->mpe_function; 571 break; 572 case MAC_CREATE_FRAGMENT: 573 mpc->mpc_ops->mpo_create_fragment = 574 mpe->mpe_function; 575 break; 576 case MAC_CREATE_IFNET: 577 mpc->mpc_ops->mpo_create_ifnet = 578 mpe->mpe_function; 579 break; 580 case MAC_CREATE_IPQ: 581 mpc->mpc_ops->mpo_create_ipq = 582 mpe->mpe_function; 583 break; 584 case MAC_CREATE_MBUF_FROM_MBUF: 585 mpc->mpc_ops->mpo_create_mbuf_from_mbuf = 586 mpe->mpe_function; 587 break; 588 case MAC_CREATE_MBUF_LINKLAYER: 589 mpc->mpc_ops->mpo_create_mbuf_linklayer = 590 mpe->mpe_function; 591 break; 592 case MAC_CREATE_MBUF_FROM_BPFDESC: 593 mpc->mpc_ops->mpo_create_mbuf_from_bpfdesc = 594 mpe->mpe_function; 595 break; 596 case MAC_CREATE_MBUF_FROM_IFNET: 597 mpc->mpc_ops->mpo_create_mbuf_from_ifnet = 598 mpe->mpe_function; 599 break; 600 case MAC_CREATE_MBUF_MULTICAST_ENCAP: 601 mpc->mpc_ops->mpo_create_mbuf_multicast_encap = 602 mpe->mpe_function; 603 break; 604 case MAC_CREATE_MBUF_NETLAYER: 605 mpc->mpc_ops->mpo_create_mbuf_netlayer = 606 mpe->mpe_function; 607 break; 608 case MAC_FRAGMENT_MATCH: 609 mpc->mpc_ops->mpo_fragment_match = 610 mpe->mpe_function; 611 break; 612 case MAC_RELABEL_IFNET: 613 mpc->mpc_ops->mpo_relabel_ifnet = 614 mpe->mpe_function; 615 break; 616 case MAC_UPDATE_IPQ: 617 mpc->mpc_ops->mpo_update_ipq = 618 mpe->mpe_function; 619 break; 620 case MAC_CREATE_CRED: 621 mpc->mpc_ops->mpo_create_cred = 622 mpe->mpe_function; 623 break; 624 case MAC_EXECVE_TRANSITION: 625 mpc->mpc_ops->mpo_execve_transition = 626 mpe->mpe_function; 627 break; 628 case MAC_EXECVE_WILL_TRANSITION: 629 mpc->mpc_ops->mpo_execve_will_transition = 630 mpe->mpe_function; 631 break; 632 case MAC_CREATE_PROC0: 633 mpc->mpc_ops->mpo_create_proc0 = mpe->mpe_function; 634 break; 635 case MAC_CREATE_PROC1: 636 mpc->mpc_ops->mpo_create_proc1 = mpe->mpe_function; 637 break; 638 case MAC_RELABEL_CRED: 639 mpc->mpc_ops->mpo_relabel_cred = 640 mpe->mpe_function; 641 break; 642 case MAC_CHECK_BPFDESC_RECEIVE: 643 mpc->mpc_ops->mpo_check_bpfdesc_receive = 644 mpe->mpe_function; 645 break; 646 case MAC_CHECK_CRED_RELABEL: 647 mpc->mpc_ops->mpo_check_cred_relabel = 648 mpe->mpe_function; 649 break; 650 case MAC_CHECK_CRED_VISIBLE: 651 mpc->mpc_ops->mpo_check_cred_visible = 652 mpe->mpe_function; 653 break; 654 case MAC_CHECK_IFNET_RELABEL: 655 mpc->mpc_ops->mpo_check_ifnet_relabel = 656 mpe->mpe_function; 657 break; 658 case MAC_CHECK_IFNET_TRANSMIT: 659 mpc->mpc_ops->mpo_check_ifnet_transmit = 660 mpe->mpe_function; 661 break; 662 case MAC_CHECK_MOUNT_STAT: 663 mpc->mpc_ops->mpo_check_mount_stat = 664 mpe->mpe_function; 665 break; 666 case MAC_CHECK_PIPE_IOCTL: 667 mpc->mpc_ops->mpo_check_pipe_ioctl = 668 mpe->mpe_function; 669 break; 670 case MAC_CHECK_PIPE_OP: 671 mpc->mpc_ops->mpo_check_pipe_op = 672 mpe->mpe_function; 673 break; 674 case MAC_CHECK_PIPE_RELABEL: 675 mpc->mpc_ops->mpo_check_pipe_relabel = 676 mpe->mpe_function; 677 break; 678 case MAC_CHECK_PROC_DEBUG: 679 mpc->mpc_ops->mpo_check_proc_debug = 680 mpe->mpe_function; 681 break; 682 case MAC_CHECK_PROC_SCHED: 683 mpc->mpc_ops->mpo_check_proc_sched = 684 mpe->mpe_function; 685 break; 686 case MAC_CHECK_PROC_SIGNAL: 687 mpc->mpc_ops->mpo_check_proc_signal = 688 mpe->mpe_function; 689 break; 690 case MAC_CHECK_SOCKET_BIND: 691 mpc->mpc_ops->mpo_check_socket_bind = 692 mpe->mpe_function; 693 break; 694 case MAC_CHECK_SOCKET_CONNECT: 695 mpc->mpc_ops->mpo_check_socket_connect = 696 mpe->mpe_function; 697 break; 698 case MAC_CHECK_SOCKET_DELIVER: 699 mpc->mpc_ops->mpo_check_socket_deliver = 700 mpe->mpe_function; 701 break; 702 case MAC_CHECK_SOCKET_LISTEN: 703 mpc->mpc_ops->mpo_check_socket_listen = 704 mpe->mpe_function; 705 break; 706 case MAC_CHECK_SOCKET_RELABEL: 707 mpc->mpc_ops->mpo_check_socket_relabel = 708 mpe->mpe_function; 709 break; 710 case MAC_CHECK_SOCKET_VISIBLE: 711 mpc->mpc_ops->mpo_check_socket_visible = 712 mpe->mpe_function; 713 break; 714 case MAC_CHECK_VNODE_ACCESS: 715 mpc->mpc_ops->mpo_check_vnode_access = 716 mpe->mpe_function; 717 break; 718 case MAC_CHECK_VNODE_CHDIR: 719 mpc->mpc_ops->mpo_check_vnode_chdir = 720 mpe->mpe_function; 721 break; 722 case MAC_CHECK_VNODE_CHROOT: 723 mpc->mpc_ops->mpo_check_vnode_chroot = 724 mpe->mpe_function; 725 break; 726 case MAC_CHECK_VNODE_CREATE: 727 mpc->mpc_ops->mpo_check_vnode_create = 728 mpe->mpe_function; 729 break; 730 case MAC_CHECK_VNODE_DELETE: 731 mpc->mpc_ops->mpo_check_vnode_delete = 732 mpe->mpe_function; 733 break; 734 case MAC_CHECK_VNODE_DELETEACL: 735 mpc->mpc_ops->mpo_check_vnode_deleteacl = 736 mpe->mpe_function; 737 break; 738 case MAC_CHECK_VNODE_EXEC: 739 mpc->mpc_ops->mpo_check_vnode_exec = 740 mpe->mpe_function; 741 break; 742 case MAC_CHECK_VNODE_GETACL: 743 mpc->mpc_ops->mpo_check_vnode_getacl = 744 mpe->mpe_function; 745 break; 746 case MAC_CHECK_VNODE_GETEXTATTR: 747 mpc->mpc_ops->mpo_check_vnode_getextattr = 748 mpe->mpe_function; 749 break; 750 case MAC_CHECK_VNODE_LOOKUP: 751 mpc->mpc_ops->mpo_check_vnode_lookup = 752 mpe->mpe_function; 753 break; 754 case MAC_CHECK_VNODE_MMAP_PERMS: 755 mpc->mpc_ops->mpo_check_vnode_mmap_perms = 756 mpe->mpe_function; 757 break; 758 case MAC_CHECK_VNODE_OP: 759 mpc->mpc_ops->mpo_check_vnode_op = 760 mpe->mpe_function; 761 break; 762 case MAC_CHECK_VNODE_OPEN: 763 mpc->mpc_ops->mpo_check_vnode_open = 764 mpe->mpe_function; 765 break; 766 case MAC_CHECK_VNODE_READDIR: 767 mpc->mpc_ops->mpo_check_vnode_readdir = 768 mpe->mpe_function; 769 break; 770 case MAC_CHECK_VNODE_READLINK: 771 mpc->mpc_ops->mpo_check_vnode_readlink = 772 mpe->mpe_function; 773 break; 774 case MAC_CHECK_VNODE_RELABEL: 775 mpc->mpc_ops->mpo_check_vnode_relabel = 776 mpe->mpe_function; 777 break; 778 case MAC_CHECK_VNODE_RENAME_FROM: 779 mpc->mpc_ops->mpo_check_vnode_rename_from = 780 mpe->mpe_function; 781 break; 782 case MAC_CHECK_VNODE_RENAME_TO: 783 mpc->mpc_ops->mpo_check_vnode_rename_to = 784 mpe->mpe_function; 785 break; 786 case MAC_CHECK_VNODE_REVOKE: 787 mpc->mpc_ops->mpo_check_vnode_revoke = 788 mpe->mpe_function; 789 break; 790 case MAC_CHECK_VNODE_SETACL: 791 mpc->mpc_ops->mpo_check_vnode_setacl = 792 mpe->mpe_function; 793 break; 794 case MAC_CHECK_VNODE_SETEXTATTR: 795 mpc->mpc_ops->mpo_check_vnode_setextattr = 796 mpe->mpe_function; 797 break; 798 case MAC_CHECK_VNODE_SETFLAGS: 799 mpc->mpc_ops->mpo_check_vnode_setflags = 800 mpe->mpe_function; 801 break; 802 case MAC_CHECK_VNODE_SETMODE: 803 mpc->mpc_ops->mpo_check_vnode_setmode = 804 mpe->mpe_function; 805 break; 806 case MAC_CHECK_VNODE_SETOWNER: 807 mpc->mpc_ops->mpo_check_vnode_setowner = 808 mpe->mpe_function; 809 break; 810 case MAC_CHECK_VNODE_SETUTIMES: 811 mpc->mpc_ops->mpo_check_vnode_setutimes = 812 mpe->mpe_function; 813 break; 814 case MAC_CHECK_VNODE_STAT: 815 mpc->mpc_ops->mpo_check_vnode_stat = 816 mpe->mpe_function; 817 break; 818/* 819 default: 820 printf("MAC policy `%s': unknown operation %d\n", 821 mpc->mpc_name, mpe->mpe_constant); 822 return (EINVAL); 823*/ 824 } 825 } 826 MAC_POLICY_LIST_LOCK(); 827 if (mac_policy_list_busy > 0) { 828 MAC_POLICY_LIST_UNLOCK(); 829 FREE(mpc->mpc_ops, M_MACOPVEC); 830 mpc->mpc_ops = NULL; 831 return (EBUSY); 832 } 833 LIST_FOREACH(tmpc, &mac_policy_list, mpc_list) { 834 if (strcmp(tmpc->mpc_name, mpc->mpc_name) == 0) { 835 MAC_POLICY_LIST_UNLOCK(); 836 FREE(mpc->mpc_ops, M_MACOPVEC); 837 mpc->mpc_ops = NULL; 838 return (EEXIST); 839 } 840 } 841 if (mpc->mpc_field_off != NULL) { 842 slot = ffs(mac_policy_offsets_free); 843 if (slot == 0) { 844 MAC_POLICY_LIST_UNLOCK(); 845 FREE(mpc->mpc_ops, M_MACOPVEC); 846 mpc->mpc_ops = NULL; 847 return (ENOMEM); 848 } 849 slot--; 850 mac_policy_offsets_free &= ~(1 << slot); 851 *mpc->mpc_field_off = slot; 852 } 853 mpc->mpc_runtime_flags |= MPC_RUNTIME_FLAG_REGISTERED; 854 LIST_INSERT_HEAD(&mac_policy_list, mpc, mpc_list); 855 856 /* Per-policy initialization. */ 857 if (mpc->mpc_ops->mpo_init != NULL) 858 (*(mpc->mpc_ops->mpo_init))(mpc); 859 MAC_POLICY_LIST_UNLOCK(); 860 861 printf("Security policy loaded: %s (%s)\n", mpc->mpc_fullname, 862 mpc->mpc_name); 863 864 return (0); 865} 866 867static int 868mac_policy_unregister(struct mac_policy_conf *mpc) 869{ 870 871#if 0 872 /* 873 * Don't allow unloading modules with private data. 874 */ 875 if (mpc->mpc_field_off != NULL) 876 return (EBUSY); 877#endif 878 if ((mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_UNLOADOK) == 0) 879 return (EBUSY); 880 MAC_POLICY_LIST_LOCK(); 881 if (mac_policy_list_busy > 0) { 882 MAC_POLICY_LIST_UNLOCK(); 883 return (EBUSY); 884 } 885 if (mpc->mpc_ops->mpo_destroy != NULL) 886 (*(mpc->mpc_ops->mpo_destroy))(mpc); 887 888 LIST_REMOVE(mpc, mpc_list); 889 MAC_POLICY_LIST_UNLOCK(); 890 891 FREE(mpc->mpc_ops, M_MACOPVEC); 892 mpc->mpc_ops = NULL; 893 894 printf("Security policy unload: %s (%s)\n", mpc->mpc_fullname, 895 mpc->mpc_name); 896 897 return (0); 898} 899 900/* 901 * Define an error value precedence, and given two arguments, selects the 902 * value with the higher precedence. 903 */ 904static int 905error_select(int error1, int error2) 906{ 907 908 /* Certain decision-making errors take top priority. */ 909 if (error1 == EDEADLK || error2 == EDEADLK) 910 return (EDEADLK); 911 912 /* Invalid arguments should be reported where possible. */ 913 if (error1 == EINVAL || error2 == EINVAL) 914 return (EINVAL); 915 916 /* Precedence goes to "visibility", with both process and file. */ 917 if (error1 == ESRCH || error2 == ESRCH) 918 return (ESRCH); 919 920 if (error1 == ENOENT || error2 == ENOENT) 921 return (ENOENT); 922 923 /* Precedence goes to DAC/MAC protections. */ 924 if (error1 == EACCES || error2 == EACCES) 925 return (EACCES); 926 927 /* Precedence goes to privilege. */ 928 if (error1 == EPERM || error2 == EPERM) 929 return (EPERM); 930 931 /* Precedence goes to error over success; otherwise, arbitrary. */ 932 if (error1 != 0) 933 return (error1); 934 return (error2); 935} 936 937void 938mac_update_devfsdirent(struct devfs_dirent *de, struct vnode *vp) 939{ 940 941 MAC_PERFORM(update_devfsdirent, de, &de->de_label, vp, &vp->v_label); 942} 943 944void 945mac_update_procfsvnode(struct vnode *vp, struct ucred *cred) 946{ 947 948 MAC_PERFORM(update_procfsvnode, vp, &vp->v_label, cred); 949} 950 951/* 952 * Support callout for policies that manage their own externalization 953 * using extended attributes. 954 */ 955static int 956mac_update_vnode_from_extattr(struct vnode *vp, struct mount *mp) 957{ 958 int error; 959 960 MAC_CHECK(update_vnode_from_extattr, vp, &vp->v_label, mp, 961 &mp->mnt_fslabel); 962 963 return (error); 964} 965 966/* 967 * Given an externalized mac label, internalize it and stamp it on a 968 * vnode. 969 */ 970static int 971mac_update_vnode_from_externalized(struct vnode *vp, struct mac *extmac) 972{ 973 int error; 974 975 MAC_CHECK(update_vnode_from_externalized, vp, &vp->v_label, extmac); 976 977 return (error); 978} 979 980/* 981 * Call out to individual policies to update the label in a vnode from 982 * the mountpoint. 983 */ 984void 985mac_update_vnode_from_mount(struct vnode *vp, struct mount *mp) 986{ 987 988 MAC_PERFORM(update_vnode_from_mount, vp, &vp->v_label, mp, 989 &mp->mnt_fslabel); 990 991 ASSERT_VOP_LOCKED(vp, "mac_update_vnode_from_mount"); 992 if (mac_cache_fslabel_in_vnode) 993 vp->v_vflag |= VV_CACHEDLABEL; 994} 995 996/* 997 * Implementation of VOP_REFRESHLABEL() that relies on extended attributes 998 * to store label data. Can be referenced by filesystems supporting 999 * extended attributes. 1000 */ 1001int 1002vop_stdrefreshlabel_ea(struct vop_refreshlabel_args *ap) 1003{ 1004 struct vnode *vp = ap->a_vp; 1005 struct mac extmac; 1006 int buflen, error; 1007 1008 ASSERT_VOP_LOCKED(vp, "vop_stdrefreshlabel_ea"); 1009 1010 /* 1011 * Call out to external policies first. Order doesn't really 1012 * matter, as long as failure of one assures failure of all. 1013 */ 1014 error = mac_update_vnode_from_extattr(vp, vp->v_mount); 1015 if (error) 1016 return (error); 1017 1018 buflen = sizeof(extmac); 1019 error = vn_extattr_get(vp, IO_NODELOCKED, 1020 FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME, &buflen, 1021 (char *)&extmac, curthread); 1022 switch (error) { 1023 case 0: 1024 /* Got it */ 1025 break; 1026 1027 case ENOATTR: 1028 /* 1029 * Use the label from the mount point. 1030 */ 1031 mac_update_vnode_from_mount(vp, vp->v_mount); 1032 return (0); 1033 1034 case EOPNOTSUPP: 1035 default: 1036 /* Fail horribly. */ 1037 return (error); 1038 } 1039 1040 if (buflen != sizeof(extmac)) 1041 error = EPERM; /* Fail very closed. */ 1042 if (error == 0) 1043 error = mac_update_vnode_from_externalized(vp, &extmac); 1044 if (error == 0) 1045 vp->v_vflag |= VV_CACHEDLABEL; 1046 else { 1047 struct vattr va; 1048 1049 printf("Corrupted label on %s", 1050 vp->v_mount->mnt_stat.f_mntonname); 1051 if (VOP_GETATTR(vp, &va, curthread->td_ucred, curthread) == 0) 1052 printf(" inum %ld", va.va_fileid); 1053 if (mac_debug_label_fallback) { 1054 printf(", falling back.\n"); 1055 mac_update_vnode_from_mount(vp, vp->v_mount); 1056 error = 0; 1057 } else { 1058 printf(".\n"); 1059 error = EPERM; 1060 } 1061 } 1062 1063 return (error); 1064} 1065 1066/* 1067 * Make sure the vnode label is up-to-date. If EOPNOTSUPP, then we handle 1068 * the labeling activity outselves. Filesystems should be careful not 1069 * to change their minds regarding whether they support vop_refreshlabel() 1070 * for a vnode or not. Don't cache the vnode here, allow the file 1071 * system code to determine if it's safe to cache. If we update from 1072 * the mount, don't cache since a change to the mount label should affect 1073 * all vnodes. 1074 */ 1075static int 1076vn_refreshlabel(struct vnode *vp, struct ucred *cred) 1077{ 1078 int error; 1079 1080 ASSERT_VOP_LOCKED(vp, "vn_refreshlabel"); 1081 1082 if (vp->v_mount == NULL) { 1083/* 1084 Eventually, we probably want to special-case refreshing 1085 of deadfs vnodes, and if there's a lock-free race somewhere, 1086 that case might be handled here. 1087 1088 mac_update_vnode_deadfs(vp); 1089 return (0); 1090 */ 1091 /* printf("vn_refreshlabel: null v_mount\n"); */ 1092 if (vp->v_tag != VT_NON) 1093 printf( 1094 "vn_refreshlabel: null v_mount with non-VT_NON\n"); 1095 return (EBADF); 1096 } 1097 1098 if (vp->v_vflag & VV_CACHEDLABEL) { 1099 mac_vnode_label_cache_hits++; 1100 return (0); 1101 } else 1102 mac_vnode_label_cache_misses++; 1103 1104 if ((vp->v_mount->mnt_flag & MNT_MULTILABEL) == 0) { 1105 mac_update_vnode_from_mount(vp, vp->v_mount); 1106 return (0); 1107 } 1108 1109 error = VOP_REFRESHLABEL(vp, cred, curthread); 1110 switch (error) { 1111 case EOPNOTSUPP: 1112 /* 1113 * If labels are not supported on this vnode, fall back to 1114 * the label in the mount and propagate it to the vnode. 1115 * There should probably be some sort of policy/flag/decision 1116 * about doing this. 1117 */ 1118 mac_update_vnode_from_mount(vp, vp->v_mount); 1119 error = 0; 1120 default: 1121 return (error); 1122 } 1123} 1124 1125/* 1126 * Helper function for file systems using the vop_std*_ea() calls. This 1127 * function must be called after EA service is available for the vnode, 1128 * but before it's hooked up to the namespace so that the node persists 1129 * if there's a crash, or before it can be accessed. On successful 1130 * commit of the label to disk (etc), do cache the label. 1131 */ 1132int 1133vop_stdcreatevnode_ea(struct vnode *dvp, struct vnode *tvp, struct ucred *cred) 1134{ 1135 struct mac extmac; 1136 int error; 1137 1138 ASSERT_VOP_LOCKED(tvp, "vop_stdcreatevnode_ea"); 1139 if ((dvp->v_mount->mnt_flag & MNT_MULTILABEL) == 0) { 1140 mac_update_vnode_from_mount(tvp, tvp->v_mount); 1141 } else { 1142 error = vn_refreshlabel(dvp, cred); 1143 if (error) 1144 return (error); 1145 1146 /* 1147 * Stick the label in the vnode. Then try to write to 1148 * disk. If we fail, return a failure to abort the 1149 * create operation. Really, this failure shouldn't 1150 * happen except in fairly unusual circumstances (out 1151 * of disk, etc). 1152 */ 1153 mac_create_vnode(cred, dvp, tvp); 1154 1155 error = mac_stdcreatevnode_ea(tvp); 1156 if (error) 1157 return (error); 1158 1159 /* 1160 * XXX: Eventually this will go away and all policies will 1161 * directly manage their extended attributes. 1162 */ 1163 error = mac_externalize(&tvp->v_label, &extmac); 1164 if (error) 1165 return (error); 1166 1167 error = vn_extattr_set(tvp, IO_NODELOCKED, 1168 FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME, 1169 sizeof(extmac), (char *)&extmac, curthread); 1170 if (error == 0) 1171 tvp->v_vflag |= VV_CACHEDLABEL; 1172 else { 1173#if 0 1174 /* 1175 * In theory, we could have fall-back behavior here. 1176 * It would probably be incorrect. 1177 */ 1178#endif 1179 return (error); 1180 } 1181 } 1182 1183 return (0); 1184} 1185 1186void 1187mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp) 1188{ 1189 int error; 1190 1191 ASSERT_VOP_LOCKED(vp, "mac_execve_transition"); 1192 1193 error = vn_refreshlabel(vp, old); 1194 if (error) { 1195 printf("mac_execve_transition: vn_refreshlabel returned %d\n", 1196 error); 1197 printf("mac_execve_transition: using old vnode label\n"); 1198 } 1199 1200 MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label); 1201} 1202 1203int 1204mac_execve_will_transition(struct ucred *old, struct vnode *vp) 1205{ 1206 int error, result; 1207 1208 error = vn_refreshlabel(vp, old); 1209 if (error) 1210 return (error); 1211 1212 result = 0; 1213 MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label); 1214 1215 return (result); 1216} 1217 1218static void 1219mac_init_label(struct label *label) 1220{ 1221 1222 bzero(label, sizeof(*label)); 1223 label->l_flags = MAC_FLAG_INITIALIZED; 1224} 1225 1226static void 1227mac_init_structmac(struct mac *mac) 1228{ 1229 1230 bzero(mac, sizeof(*mac)); 1231 mac->m_macflags = MAC_FLAG_INITIALIZED; 1232} 1233 1234static void 1235mac_destroy_label(struct label *label) 1236{ 1237 1238 KASSERT(label->l_flags & MAC_FLAG_INITIALIZED, 1239 ("destroying uninitialized label")); 1240 1241 bzero(label, sizeof(*label)); 1242 /* implicit: label->l_flags &= ~MAC_FLAG_INITIALIZED; */ 1243} 1244 1245int 1246mac_init_mbuf(struct mbuf *m, int how) 1247{ 1248 KASSERT(m->m_flags & M_PKTHDR, ("mac_init_mbuf on non-header mbuf")); 1249 1250 /* "how" is one of M_(TRY|DONT)WAIT */ 1251 mac_init_label(&m->m_pkthdr.label); 1252 MAC_PERFORM(init_mbuf, m, how, &m->m_pkthdr.label); 1253#ifdef MAC_DEBUG 1254 atomic_add_int(&nmacmbufs, 1); 1255#endif 1256 return (0); 1257} 1258 1259void 1260mac_destroy_mbuf(struct mbuf *m) 1261{ 1262 1263 MAC_PERFORM(destroy_mbuf, m, &m->m_pkthdr.label); 1264 mac_destroy_label(&m->m_pkthdr.label); 1265#ifdef MAC_DEBUG 1266 atomic_subtract_int(&nmacmbufs, 1); 1267#endif 1268} 1269 1270void 1271mac_init_cred(struct ucred *cr) 1272{ 1273 1274 mac_init_label(&cr->cr_label); 1275 MAC_PERFORM(init_cred, cr, &cr->cr_label); 1276#ifdef MAC_DEBUG 1277 atomic_add_int(&nmaccreds, 1); 1278#endif 1279} 1280 1281void 1282mac_destroy_cred(struct ucred *cr) 1283{ 1284 1285 MAC_PERFORM(destroy_cred, cr, &cr->cr_label); 1286 mac_destroy_label(&cr->cr_label); 1287#ifdef MAC_DEBUG 1288 atomic_subtract_int(&nmaccreds, 1); 1289#endif 1290} 1291 1292void 1293mac_init_ifnet(struct ifnet *ifp) 1294{ 1295 1296 mac_init_label(&ifp->if_label); 1297 MAC_PERFORM(init_ifnet, ifp, &ifp->if_label); 1298#ifdef MAC_DEBUG 1299 atomic_add_int(&nmacifnets, 1); 1300#endif 1301} 1302 1303void 1304mac_destroy_ifnet(struct ifnet *ifp) 1305{ 1306 1307 MAC_PERFORM(destroy_ifnet, ifp, &ifp->if_label); 1308 mac_destroy_label(&ifp->if_label); 1309#ifdef MAC_DEBUG 1310 atomic_subtract_int(&nmacifnets, 1); 1311#endif 1312} 1313 1314void 1315mac_init_ipq(struct ipq *ipq) 1316{ 1317 1318 mac_init_label(&ipq->ipq_label); 1319 MAC_PERFORM(init_ipq, ipq, &ipq->ipq_label); 1320#ifdef MAC_DEBUG 1321 atomic_add_int(&nmacipqs, 1); 1322#endif 1323} 1324 1325void 1326mac_destroy_ipq(struct ipq *ipq) 1327{ 1328 1329 MAC_PERFORM(destroy_ipq, ipq, &ipq->ipq_label); 1330 mac_destroy_label(&ipq->ipq_label); 1331#ifdef MAC_DEBUG 1332 atomic_subtract_int(&nmacipqs, 1); 1333#endif 1334} 1335 1336void 1337mac_init_socket(struct socket *socket) 1338{ 1339 1340 mac_init_label(&socket->so_label); 1341 mac_init_label(&socket->so_peerlabel); 1342 MAC_PERFORM(init_socket, socket, &socket->so_label, 1343 &socket->so_peerlabel); 1344#ifdef MAC_DEBUG 1345 atomic_add_int(&nmacsockets, 1); 1346#endif 1347} 1348 1349void 1350mac_destroy_socket(struct socket *socket) 1351{ 1352 1353 MAC_PERFORM(destroy_socket, socket, &socket->so_label, 1354 &socket->so_peerlabel); 1355 mac_destroy_label(&socket->so_label); 1356 mac_destroy_label(&socket->so_peerlabel); 1357#ifdef MAC_DEBUG 1358 atomic_subtract_int(&nmacsockets, 1); 1359#endif 1360} 1361 1362void 1363mac_init_pipe(struct pipe *pipe) 1364{ 1365 struct label *label; 1366 1367 label = malloc(sizeof(struct label), M_MACPIPELABEL, M_ZERO|M_WAITOK); 1368 mac_init_label(label); 1369 pipe->pipe_label = label; 1370 pipe->pipe_peer->pipe_label = label; 1371 MAC_PERFORM(init_pipe, pipe, pipe->pipe_label); 1372#ifdef MAC_DEBUG 1373 atomic_add_int(&nmacpipes, 1); 1374#endif 1375} 1376 1377void 1378mac_destroy_pipe(struct pipe *pipe) 1379{ 1380 1381 MAC_PERFORM(destroy_pipe, pipe, pipe->pipe_label); 1382 mac_destroy_label(pipe->pipe_label); 1383 free(pipe->pipe_label, M_MACPIPELABEL); 1384#ifdef MAC_DEBUG 1385 atomic_subtract_int(&nmacpipes, 1); 1386#endif 1387} 1388 1389void 1390mac_init_bpfdesc(struct bpf_d *bpf_d) 1391{ 1392 1393 mac_init_label(&bpf_d->bd_label); 1394 MAC_PERFORM(init_bpfdesc, bpf_d, &bpf_d->bd_label); 1395#ifdef MAC_DEBUG 1396 atomic_add_int(&nmacbpfdescs, 1); 1397#endif 1398} 1399 1400void 1401mac_destroy_bpfdesc(struct bpf_d *bpf_d) 1402{ 1403 1404 MAC_PERFORM(destroy_bpfdesc, bpf_d, &bpf_d->bd_label); 1405 mac_destroy_label(&bpf_d->bd_label); 1406#ifdef MAC_DEBUG 1407 atomic_subtract_int(&nmacbpfdescs, 1); 1408#endif 1409} 1410 1411void 1412mac_init_mount(struct mount *mp) 1413{ 1414 1415 mac_init_label(&mp->mnt_mntlabel); 1416 mac_init_label(&mp->mnt_fslabel); 1417 MAC_PERFORM(init_mount, mp, &mp->mnt_mntlabel, &mp->mnt_fslabel); 1418#ifdef MAC_DEBUG 1419 atomic_add_int(&nmacmounts, 1); 1420#endif 1421} 1422 1423void 1424mac_destroy_mount(struct mount *mp) 1425{ 1426 1427 MAC_PERFORM(destroy_mount, mp, &mp->mnt_mntlabel, &mp->mnt_fslabel); 1428 mac_destroy_label(&mp->mnt_fslabel); 1429 mac_destroy_label(&mp->mnt_mntlabel); 1430#ifdef MAC_DEBUG 1431 atomic_subtract_int(&nmacmounts, 1); 1432#endif 1433} 1434 1435static void 1436mac_init_temp(struct label *label) 1437{ 1438 1439 mac_init_label(label); 1440 MAC_PERFORM(init_temp, label); 1441#ifdef MAC_DEBUG 1442 atomic_add_int(&nmactemp, 1); 1443#endif 1444} 1445 1446static void 1447mac_destroy_temp(struct label *label) 1448{ 1449 1450 MAC_PERFORM(destroy_temp, label); 1451 mac_destroy_label(label); 1452#ifdef MAC_DEBUG 1453 atomic_subtract_int(&nmactemp, 1); 1454#endif 1455} 1456 1457void 1458mac_init_vnode(struct vnode *vp) 1459{ 1460 1461 mac_init_label(&vp->v_label); 1462 MAC_PERFORM(init_vnode, vp, &vp->v_label); 1463#ifdef MAC_DEBUG 1464 atomic_add_int(&nmacvnodes, 1); 1465#endif 1466} 1467 1468void 1469mac_destroy_vnode(struct vnode *vp) 1470{ 1471 1472 MAC_PERFORM(destroy_vnode, vp, &vp->v_label); 1473 mac_destroy_label(&vp->v_label); 1474#ifdef MAC_DEBUG 1475 atomic_subtract_int(&nmacvnodes, 1); 1476#endif 1477} 1478 1479void 1480mac_init_devfsdirent(struct devfs_dirent *de) 1481{ 1482 1483 mac_init_label(&de->de_label); 1484 MAC_PERFORM(init_devfsdirent, de, &de->de_label); 1485#ifdef MAC_DEBUG 1486 atomic_add_int(&nmacdevfsdirents, 1); 1487#endif 1488} 1489 1490void 1491mac_destroy_devfsdirent(struct devfs_dirent *de) 1492{ 1493 1494 MAC_PERFORM(destroy_devfsdirent, de, &de->de_label); 1495 mac_destroy_label(&de->de_label); 1496#ifdef MAC_DEBUG 1497 atomic_subtract_int(&nmacdevfsdirents, 1); 1498#endif 1499} 1500 1501static int 1502mac_externalize(struct label *label, struct mac *mac) 1503{ 1504 int error; 1505 1506 mac_init_structmac(mac); 1507 MAC_CHECK(externalize, label, mac); 1508 1509 return (error); 1510} 1511 1512static int 1513mac_internalize(struct label *label, struct mac *mac) 1514{ 1515 int error; 1516 1517 mac_init_temp(label); 1518 MAC_CHECK(internalize, label, mac); 1519 if (error) 1520 mac_destroy_temp(label); 1521 1522 return (error); 1523} 1524 1525/* 1526 * Initialize MAC label for the first kernel process, from which other 1527 * kernel processes and threads are spawned. 1528 */ 1529void 1530mac_create_proc0(struct ucred *cred) 1531{ 1532 1533 MAC_PERFORM(create_proc0, cred); 1534} 1535 1536/* 1537 * Initialize MAC label for the first userland process, from which other 1538 * userland processes and threads are spawned. 1539 */ 1540void 1541mac_create_proc1(struct ucred *cred) 1542{ 1543 1544 MAC_PERFORM(create_proc1, cred); 1545} 1546 1547/* 1548 * When a new process is created, its label must be initialized. Generally, 1549 * this involves inheritence from the parent process, modulo possible 1550 * deltas. This function allows that processing to take place. 1551 */ 1552void 1553mac_create_cred(struct ucred *parent_cred, struct ucred *child_cred) 1554{ 1555 1556 MAC_PERFORM(create_cred, parent_cred, child_cred); 1557} 1558 1559int 1560mac_check_vnode_access(struct ucred *cred, struct vnode *vp, int flags) 1561{ 1562 int error; 1563 1564 ASSERT_VOP_LOCKED(vp, "mac_check_vnode_access"); 1565 1566 if (!mac_enforce_fs) 1567 return (0); 1568 1569 error = vn_refreshlabel(vp, cred); 1570 if (error) 1571 return (error); 1572 1573 MAC_CHECK(check_vnode_access, cred, vp, &vp->v_label, flags); 1574 return (error); 1575} 1576 1577int 1578mac_check_vnode_chdir(struct ucred *cred, struct vnode *dvp) 1579{ 1580 int error; 1581 1582 ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_chdir"); 1583 1584 if (!mac_enforce_fs) 1585 return (0); 1586 1587 error = vn_refreshlabel(dvp, cred); 1588 if (error) 1589 return (error); 1590 1591 MAC_CHECK(check_vnode_chdir, cred, dvp, &dvp->v_label); 1592 return (error); 1593} 1594 1595int 1596mac_check_vnode_chroot(struct ucred *cred, struct vnode *dvp) 1597{ 1598 int error; 1599 1600 ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_chroot"); 1601 1602 if (!mac_enforce_fs) 1603 return (0); 1604 1605 error = vn_refreshlabel(dvp, cred); 1606 if (error) 1607 return (error); 1608 1609 MAC_CHECK(check_vnode_chroot, cred, dvp, &dvp->v_label); 1610 return (error); 1611} 1612 1613int 1614mac_check_vnode_create(struct ucred *cred, struct vnode *dvp, 1615 struct componentname *cnp, struct vattr *vap) 1616{ 1617 int error; 1618 1619 ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_create"); 1620 1621 if (!mac_enforce_fs) 1622 return (0); 1623 1624 error = vn_refreshlabel(dvp, cred); 1625 if (error) 1626 return (error); 1627 1628 MAC_CHECK(check_vnode_create, cred, dvp, &dvp->v_label, cnp, vap); 1629 return (error); 1630} 1631 1632int 1633mac_check_vnode_delete(struct ucred *cred, struct vnode *dvp, struct vnode *vp, 1634 struct componentname *cnp) 1635{ 1636 int error; 1637 1638 ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_delete"); 1639 ASSERT_VOP_LOCKED(vp, "mac_check_vnode_delete"); 1640 1641 if (!mac_enforce_fs) 1642 return (0); 1643 1644 error = vn_refreshlabel(dvp, cred); 1645 if (error) 1646 return (error); 1647 error = vn_refreshlabel(vp, cred); 1648 if (error) 1649 return (error); 1650 1651 MAC_CHECK(check_vnode_delete, cred, dvp, &dvp->v_label, vp, 1652 &vp->v_label, cnp); 1653 return (error); 1654} 1655 1656int 1657mac_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp, 1658 acl_type_t type) 1659{ 1660 int error; 1661 1662 ASSERT_VOP_LOCKED(vp, "mac_check_vnode_deleteacl"); 1663 1664 if (!mac_enforce_fs) 1665 return (0); 1666 1667 error = vn_refreshlabel(vp, cred); 1668 if (error) 1669 return (error); 1670 1671 MAC_CHECK(check_vnode_deleteacl, cred, vp, &vp->v_label, type); 1672 return (error); 1673} 1674 1675int 1676mac_check_vnode_exec(struct ucred *cred, struct vnode *vp) 1677{ 1678 int error; 1679 1680 ASSERT_VOP_LOCKED(vp, "mac_check_vnode_exec"); 1681 1682 if (!mac_enforce_process && !mac_enforce_fs) 1683 return (0); 1684 1685 error = vn_refreshlabel(vp, cred); 1686 if (error) 1687 return (error); 1688 MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label); 1689 1690 return (error); 1691} 1692 1693int 1694mac_check_vnode_getacl(struct ucred *cred, struct vnode *vp, acl_type_t type) 1695{ 1696 int error; 1697 1698 ASSERT_VOP_LOCKED(vp, "mac_check_vnode_getacl"); 1699 1700 if (!mac_enforce_fs) 1701 return (0); 1702 1703 error = vn_refreshlabel(vp, cred); 1704 if (error) 1705 return (error); 1706 1707 MAC_CHECK(check_vnode_getacl, cred, vp, &vp->v_label, type); 1708 return (error); 1709} 1710 1711int 1712mac_check_vnode_getextattr(struct ucred *cred, struct vnode *vp, 1713 int attrnamespace, const char *name, struct uio *uio) 1714{ 1715 int error; 1716 1717 ASSERT_VOP_LOCKED(vp, "mac_check_vnode_getextattr"); 1718 1719 if (!mac_enforce_fs) 1720 return (0); 1721 1722 error = vn_refreshlabel(vp, cred); 1723 if (error) 1724 return (error); 1725 1726 MAC_CHECK(check_vnode_getextattr, cred, vp, &vp->v_label, 1727 attrnamespace, name, uio); 1728 return (error); 1729} 1730 1731int 1732mac_check_vnode_lookup(struct ucred *cred, struct vnode *dvp, 1733 struct componentname *cnp) 1734{ 1735 int error; 1736 1737 ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_lookup"); 1738 1739 if (!mac_enforce_fs) 1740 return (0); 1741 1742 error = vn_refreshlabel(dvp, cred); 1743 if (error) 1744 return (error); 1745 1746 MAC_CHECK(check_vnode_lookup, cred, dvp, &dvp->v_label, cnp); 1747 return (error); 1748} 1749 1750vm_prot_t 1751mac_check_vnode_mmap_prot(struct ucred *cred, struct vnode *vp, int newmapping) 1752{ 1753 vm_prot_t result = VM_PROT_ALL; 1754 1755 /* 1756 * This should be some sort of MAC_BITWISE, maybe :) 1757 */ 1758 ASSERT_VOP_LOCKED(vp, "mac_check_vnode_mmap_perms"); 1759 MAC_BOOLEAN(check_vnode_mmap_perms, &, cred, vp, &vp->v_label, 1760 newmapping); 1761 return (result); 1762} 1763 1764int 1765mac_check_vnode_op(struct ucred *cred, struct vnode *vp, int op) 1766{ 1767 int error; 1768 1769 if (!mac_enforce_fs) 1770 return (0); 1771 1772 ASSERT_VOP_LOCKED(vp, "mac_check_vnode_op"); 1773 1774 error = vn_refreshlabel(vp, cred); 1775 if (error) 1776 return (error); 1777 1778 MAC_CHECK(check_vnode_op, cred, vp, &vp->v_label, op); 1779 1780 return (error); 1781} 1782 1783int 1784mac_check_vnode_open(struct ucred *cred, struct vnode *vp, mode_t acc_mode) 1785{ 1786 int error; 1787 1788 ASSERT_VOP_LOCKED(vp, "mac_check_vnode_open"); 1789 1790 if (!mac_enforce_fs) 1791 return (0); 1792 1793 error = vn_refreshlabel(vp, cred); 1794 if (error) 1795 return (error); 1796 1797 MAC_CHECK(check_vnode_open, cred, vp, &vp->v_label, acc_mode); 1798 return (error); 1799} 1800 1801int 1802mac_check_vnode_readdir(struct ucred *cred, struct vnode *dvp) 1803{ 1804 int error; 1805 1806 ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_readdir"); 1807 1808 if (!mac_enforce_fs) 1809 return (0); 1810 1811 error = vn_refreshlabel(dvp, cred); 1812 if (error) 1813 return (error); 1814 1815 MAC_CHECK(check_vnode_readdir, cred, dvp, &dvp->v_label); 1816 return (error); 1817} 1818 1819int 1820mac_check_vnode_readlink(struct ucred *cred, struct vnode *vp) 1821{ 1822 int error; 1823 1824 ASSERT_VOP_LOCKED(vp, "mac_check_vnode_readlink"); 1825 1826 if (!mac_enforce_fs) 1827 return (0); 1828 1829 error = vn_refreshlabel(vp, cred); 1830 if (error) 1831 return (error); 1832 1833 MAC_CHECK(check_vnode_readlink, cred, vp, &vp->v_label); 1834 return (error); 1835} 1836 1837static int 1838mac_check_vnode_relabel(struct ucred *cred, struct vnode *vp, 1839 struct label *newlabel) 1840{ 1841 int error; 1842 1843 ASSERT_VOP_LOCKED(vp, "mac_check_vnode_relabel"); 1844 1845 error = vn_refreshlabel(vp, cred); 1846 if (error) 1847 return (error); 1848 1849 MAC_CHECK(check_vnode_relabel, cred, vp, &vp->v_label, newlabel); 1850 1851 return (error); 1852} 1853 1854int 1855mac_check_vnode_rename_from(struct ucred *cred, struct vnode *dvp, 1856 struct vnode *vp, struct componentname *cnp) 1857{ 1858 int error; 1859 1860 ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_rename_from"); 1861 ASSERT_VOP_LOCKED(vp, "mac_check_vnode_rename_from"); 1862 1863 if (!mac_enforce_fs) 1864 return (0); 1865 1866 error = vn_refreshlabel(dvp, cred); 1867 if (error) 1868 return (error); 1869 error = vn_refreshlabel(vp, cred); 1870 if (error) 1871 return (error); 1872 1873 MAC_CHECK(check_vnode_rename_from, cred, dvp, &dvp->v_label, vp, 1874 &vp->v_label, cnp); 1875 return (error); 1876} 1877 1878int 1879mac_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp, 1880 struct vnode *vp, int samedir, struct componentname *cnp) 1881{ 1882 int error; 1883 1884 ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_rename_to"); 1885 ASSERT_VOP_LOCKED(vp, "mac_check_vnode_rename_to"); 1886 1887 if (!mac_enforce_fs) 1888 return (0); 1889 1890 error = vn_refreshlabel(dvp, cred); 1891 if (error) 1892 return (error); 1893 if (vp != NULL) { 1894 error = vn_refreshlabel(vp, cred); 1895 if (error) 1896 return (error); 1897 } 1898 MAC_CHECK(check_vnode_rename_to, cred, dvp, &dvp->v_label, vp, 1899 vp != NULL ? &vp->v_label : NULL, samedir, cnp); 1900 return (error); 1901} 1902 1903int 1904mac_check_vnode_revoke(struct ucred *cred, struct vnode *vp) 1905{ 1906 int error; 1907 1908 ASSERT_VOP_LOCKED(vp, "mac_check_vnode_revoke"); 1909 1910 if (!mac_enforce_fs) 1911 return (0); 1912 1913 error = vn_refreshlabel(vp, cred); 1914 if (error) 1915 return (error); 1916 1917 MAC_CHECK(check_vnode_revoke, cred, vp, &vp->v_label); 1918 return (error); 1919} 1920 1921int 1922mac_check_vnode_setacl(struct ucred *cred, struct vnode *vp, acl_type_t type, 1923 struct acl *acl) 1924{ 1925 int error; 1926 1927 ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setacl"); 1928 1929 if (!mac_enforce_fs) 1930 return (0); 1931 1932 error = vn_refreshlabel(vp, cred); 1933 if (error) 1934 return (error); 1935 1936 MAC_CHECK(check_vnode_setacl, cred, vp, &vp->v_label, type, acl); 1937 return (error); 1938} 1939 1940int 1941mac_check_vnode_setextattr(struct ucred *cred, struct vnode *vp, 1942 int attrnamespace, const char *name, struct uio *uio) 1943{ 1944 int error; 1945 1946 ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setextattr"); 1947 1948 if (!mac_enforce_fs) 1949 return (0); 1950 1951 error = vn_refreshlabel(vp, cred); 1952 if (error) 1953 return (error); 1954 1955 MAC_CHECK(check_vnode_setextattr, cred, vp, &vp->v_label, 1956 attrnamespace, name, uio); 1957 return (error); 1958} 1959 1960int 1961mac_check_vnode_setflags(struct ucred *cred, struct vnode *vp, u_long flags) 1962{ 1963 int error; 1964 1965 ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setflags"); 1966 1967 if (!mac_enforce_fs) 1968 return (0); 1969 1970 error = vn_refreshlabel(vp, cred); 1971 if (error) 1972 return (error); 1973 1974 MAC_CHECK(check_vnode_setflags, cred, vp, &vp->v_label, flags); 1975 return (error); 1976} 1977 1978int 1979mac_check_vnode_setmode(struct ucred *cred, struct vnode *vp, mode_t mode) 1980{ 1981 int error; 1982 1983 ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setmode"); 1984 1985 if (!mac_enforce_fs) 1986 return (0); 1987 1988 error = vn_refreshlabel(vp, cred); 1989 if (error) 1990 return (error); 1991 1992 MAC_CHECK(check_vnode_setmode, cred, vp, &vp->v_label, mode); 1993 return (error); 1994} 1995 1996int 1997mac_check_vnode_setowner(struct ucred *cred, struct vnode *vp, uid_t uid, 1998 gid_t gid) 1999{ 2000 int error; 2001 2002 ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setowner"); 2003 2004 if (!mac_enforce_fs) 2005 return (0); 2006 2007 error = vn_refreshlabel(vp, cred); 2008 if (error) 2009 return (error); 2010 2011 MAC_CHECK(check_vnode_setowner, cred, vp, &vp->v_label, uid, gid); 2012 return (error); 2013} 2014 2015int 2016mac_check_vnode_setutimes(struct ucred *cred, struct vnode *vp, 2017 struct timespec atime, struct timespec mtime) 2018{ 2019 int error; 2020 2021 ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setutimes"); 2022 2023 if (!mac_enforce_fs) 2024 return (0); 2025 2026 error = vn_refreshlabel(vp, cred); 2027 if (error) 2028 return (error); 2029 2030 MAC_CHECK(check_vnode_setutimes, cred, vp, &vp->v_label, atime, 2031 mtime); 2032 return (error); 2033} 2034 2035int 2036mac_check_vnode_stat(struct ucred *cred, struct vnode *vp) 2037{ 2038 int error; 2039 2040 ASSERT_VOP_LOCKED(vp, "mac_check_vnode_stat"); 2041 2042 if (!mac_enforce_fs) 2043 return (0); 2044 2045 error = vn_refreshlabel(vp, cred); 2046 if (error) 2047 return (error); 2048 2049 MAC_CHECK(check_vnode_stat, cred, vp, &vp->v_label); 2050 return (error); 2051} 2052 2053/* 2054 * When relabeling a process, call out to the policies for the maximum 2055 * permission allowed for each object type we know about in its 2056 * memory space, and revoke access (in the least surprising ways we 2057 * know) when necessary. The process lock is not held here. 2058 */ 2059static void 2060mac_cred_mmapped_drop_perms(struct thread *td, struct ucred *cred) 2061{ 2062 2063 /* XXX freeze all other threads */ 2064 mtx_lock(&Giant); 2065 mac_cred_mmapped_drop_perms_recurse(td, cred, 2066 &td->td_proc->p_vmspace->vm_map); 2067 mtx_unlock(&Giant); 2068 /* XXX allow other threads to continue */ 2069} 2070 2071static __inline const char * 2072prot2str(vm_prot_t prot) 2073{ 2074 2075 switch (prot & VM_PROT_ALL) { 2076 case VM_PROT_READ: 2077 return ("r--"); 2078 case VM_PROT_READ | VM_PROT_WRITE: 2079 return ("rw-"); 2080 case VM_PROT_READ | VM_PROT_EXECUTE: 2081 return ("r-x"); 2082 case VM_PROT_READ | VM_PROT_WRITE | VM_PROT_EXECUTE: 2083 return ("rwx"); 2084 case VM_PROT_WRITE: 2085 return ("-w-"); 2086 case VM_PROT_EXECUTE: 2087 return ("--x"); 2088 case VM_PROT_WRITE | VM_PROT_EXECUTE: 2089 return ("-wx"); 2090 default: 2091 return ("---"); 2092 } 2093} 2094 2095static void 2096mac_cred_mmapped_drop_perms_recurse(struct thread *td, struct ucred *cred, 2097 struct vm_map *map) 2098{ 2099 struct vm_map_entry *vme; 2100 vm_prot_t result, revokeperms; 2101 vm_object_t object; 2102 vm_ooffset_t offset; 2103 struct vnode *vp; 2104 2105 vm_map_lock_read(map); 2106 for (vme = map->header.next; vme != &map->header; vme = vme->next) { 2107 if (vme->eflags & MAP_ENTRY_IS_SUB_MAP) { 2108 mac_cred_mmapped_drop_perms_recurse(td, cred, 2109 vme->object.sub_map); 2110 continue; 2111 } 2112 /* 2113 * Skip over entries that obviously are not shared. 2114 */ 2115 if (vme->eflags & (MAP_ENTRY_COW | MAP_ENTRY_NOSYNC) || 2116 !vme->max_protection) 2117 continue; 2118 /* 2119 * Drill down to the deepest backing object. 2120 */ 2121 offset = vme->offset; 2122 object = vme->object.vm_object; 2123 if (object == NULL) 2124 continue; 2125 while (object->backing_object != NULL) { 2126 object = object->backing_object; 2127 offset += object->backing_object_offset; 2128 } 2129 /* 2130 * At the moment, vm_maps and objects aren't considered 2131 * by the MAC system, so only things with backing by a 2132 * normal object (read: vnodes) are checked. 2133 */ 2134 if (object->type != OBJT_VNODE) 2135 continue; 2136 vp = (struct vnode *)object->handle; 2137 vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); 2138 result = mac_check_vnode_mmap_prot(cred, vp, 0); 2139 VOP_UNLOCK(vp, 0, td); 2140 /* 2141 * Find out what maximum protection we may be allowing 2142 * now but a policy needs to get removed. 2143 */ 2144 revokeperms = vme->max_protection & ~result; 2145 if (!revokeperms) 2146 continue; 2147 printf("pid %d: revoking %s perms from %#lx:%d " 2148 "(max %s/cur %s)\n", td->td_proc->p_pid, 2149 prot2str(revokeperms), vme->start, vme->end - vme->start, 2150 prot2str(vme->max_protection), prot2str(vme->protection)); 2151 vm_map_lock_upgrade(map); 2152 /* 2153 * This is the really simple case: if a map has more 2154 * max_protection than is allowed, but it's not being 2155 * actually used (that is, the current protection is 2156 * still allowed), we can just wipe it out and do 2157 * nothing more. 2158 */ 2159 if ((vme->protection & revokeperms) == 0) { 2160 vme->max_protection -= revokeperms; 2161 } else { 2162 if (revokeperms & VM_PROT_WRITE) { 2163 /* 2164 * In the more complicated case, flush out all 2165 * pending changes to the object then turn it 2166 * copy-on-write. 2167 */ 2168 vm_object_reference(object); 2169 vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); 2170 vm_object_page_clean(object, 2171 OFF_TO_IDX(offset), 2172 OFF_TO_IDX(offset + vme->end - vme->start + 2173 PAGE_MASK), 2174 OBJPC_SYNC); 2175 VOP_UNLOCK(vp, 0, td); 2176 vm_object_deallocate(object); 2177 /* 2178 * Why bother if there's no read permissions 2179 * anymore? For the rest, we need to leave 2180 * the write permissions on for COW, or 2181 * remove them entirely if configured to. 2182 */ 2183 if (!mac_mmap_revocation_via_cow) { 2184 vme->max_protection &= ~VM_PROT_WRITE; 2185 vme->protection &= ~VM_PROT_WRITE; 2186 } if ((revokeperms & VM_PROT_READ) == 0) 2187 vme->eflags |= MAP_ENTRY_COW | 2188 MAP_ENTRY_NEEDS_COPY; 2189 } 2190 if (revokeperms & VM_PROT_EXECUTE) { 2191 vme->max_protection &= ~VM_PROT_EXECUTE; 2192 vme->protection &= ~VM_PROT_EXECUTE; 2193 } 2194 if (revokeperms & VM_PROT_READ) { 2195 vme->max_protection = 0; 2196 vme->protection = 0; 2197 } 2198 pmap_protect(map->pmap, vme->start, vme->end, 2199 vme->protection & ~revokeperms); 2200 vm_map_simplify_entry(map, vme); 2201 } 2202 vm_map_lock_downgrade(map); 2203 } 2204 vm_map_unlock_read(map); 2205} 2206 2207/* 2208 * When the subject's label changes, it may require revocation of privilege 2209 * to mapped objects. This can't be done on-the-fly later with a unified 2210 * buffer cache. 2211 */ 2212static void 2213mac_relabel_cred(struct ucred *cred, struct label *newlabel) 2214{ 2215 2216 MAC_PERFORM(relabel_cred, cred, newlabel); 2217 mac_cred_mmapped_drop_perms(curthread, cred); 2218} 2219 2220void 2221mac_relabel_vnode(struct ucred *cred, struct vnode *vp, struct label *newlabel) 2222{ 2223 2224 MAC_PERFORM(relabel_vnode, cred, vp, &vp->v_label, newlabel); 2225} 2226 2227void 2228mac_create_ifnet(struct ifnet *ifnet) 2229{ 2230 2231 MAC_PERFORM(create_ifnet, ifnet, &ifnet->if_label); 2232} 2233 2234void 2235mac_create_bpfdesc(struct ucred *cred, struct bpf_d *bpf_d) 2236{ 2237 2238 MAC_PERFORM(create_bpfdesc, cred, bpf_d, &bpf_d->bd_label); 2239} 2240 2241void 2242mac_create_socket(struct ucred *cred, struct socket *socket) 2243{ 2244 2245 MAC_PERFORM(create_socket, cred, socket, &socket->so_label); 2246} 2247 2248void 2249mac_create_pipe(struct ucred *cred, struct pipe *pipe) 2250{ 2251 2252 MAC_PERFORM(create_pipe, cred, pipe, pipe->pipe_label); 2253} 2254 2255void 2256mac_create_socket_from_socket(struct socket *oldsocket, 2257 struct socket *newsocket) 2258{ 2259 2260 MAC_PERFORM(create_socket_from_socket, oldsocket, &oldsocket->so_label, 2261 newsocket, &newsocket->so_label); 2262} 2263 2264static void 2265mac_relabel_socket(struct ucred *cred, struct socket *socket, 2266 struct label *newlabel) 2267{ 2268 2269 MAC_PERFORM(relabel_socket, cred, socket, &socket->so_label, newlabel); 2270} 2271 2272static void 2273mac_relabel_pipe(struct ucred *cred, struct pipe *pipe, struct label *newlabel) 2274{ 2275 2276 MAC_PERFORM(relabel_pipe, cred, pipe, pipe->pipe_label, newlabel); 2277} 2278 2279void 2280mac_set_socket_peer_from_mbuf(struct mbuf *mbuf, struct socket *socket) 2281{ 2282 2283 MAC_PERFORM(set_socket_peer_from_mbuf, mbuf, &mbuf->m_pkthdr.label, 2284 socket, &socket->so_peerlabel); 2285} 2286 2287void 2288mac_set_socket_peer_from_socket(struct socket *oldsocket, 2289 struct socket *newsocket) 2290{ 2291 2292 MAC_PERFORM(set_socket_peer_from_socket, oldsocket, 2293 &oldsocket->so_label, newsocket, &newsocket->so_peerlabel); 2294} 2295 2296void 2297mac_create_datagram_from_ipq(struct ipq *ipq, struct mbuf *datagram) 2298{ 2299 2300 MAC_PERFORM(create_datagram_from_ipq, ipq, &ipq->ipq_label, 2301 datagram, &datagram->m_pkthdr.label); 2302} 2303 2304void 2305mac_create_fragment(struct mbuf *datagram, struct mbuf *fragment) 2306{ 2307 2308 MAC_PERFORM(create_fragment, datagram, &datagram->m_pkthdr.label, 2309 fragment, &fragment->m_pkthdr.label); 2310} 2311 2312void 2313mac_create_ipq(struct mbuf *fragment, struct ipq *ipq) 2314{ 2315 2316 MAC_PERFORM(create_ipq, fragment, &fragment->m_pkthdr.label, ipq, 2317 &ipq->ipq_label); 2318} 2319 2320void 2321mac_create_mbuf_from_mbuf(struct mbuf *oldmbuf, struct mbuf *newmbuf) 2322{ 2323 2324 MAC_PERFORM(create_mbuf_from_mbuf, oldmbuf, &oldmbuf->m_pkthdr.label, 2325 newmbuf, &newmbuf->m_pkthdr.label); 2326} 2327 2328void 2329mac_create_mbuf_from_bpfdesc(struct bpf_d *bpf_d, struct mbuf *mbuf) 2330{ 2331 2332 MAC_PERFORM(create_mbuf_from_bpfdesc, bpf_d, &bpf_d->bd_label, mbuf, 2333 &mbuf->m_pkthdr.label); 2334} 2335 2336void 2337mac_create_mbuf_linklayer(struct ifnet *ifnet, struct mbuf *mbuf) 2338{ 2339 2340 MAC_PERFORM(create_mbuf_linklayer, ifnet, &ifnet->if_label, mbuf, 2341 &mbuf->m_pkthdr.label); 2342} 2343 2344void 2345mac_create_mbuf_from_ifnet(struct ifnet *ifnet, struct mbuf *mbuf) 2346{ 2347 2348 MAC_PERFORM(create_mbuf_from_ifnet, ifnet, &ifnet->if_label, mbuf, 2349 &mbuf->m_pkthdr.label); 2350} 2351 2352void 2353mac_create_mbuf_multicast_encap(struct mbuf *oldmbuf, struct ifnet *ifnet, 2354 struct mbuf *newmbuf) 2355{ 2356 2357 MAC_PERFORM(create_mbuf_multicast_encap, oldmbuf, 2358 &oldmbuf->m_pkthdr.label, ifnet, &ifnet->if_label, newmbuf, 2359 &newmbuf->m_pkthdr.label); 2360} 2361 2362void 2363mac_create_mbuf_netlayer(struct mbuf *oldmbuf, struct mbuf *newmbuf) 2364{ 2365 2366 MAC_PERFORM(create_mbuf_netlayer, oldmbuf, &oldmbuf->m_pkthdr.label, 2367 newmbuf, &newmbuf->m_pkthdr.label); 2368} 2369 2370int 2371mac_fragment_match(struct mbuf *fragment, struct ipq *ipq) 2372{ 2373 int result; 2374 2375 result = 1; 2376 MAC_BOOLEAN(fragment_match, &&, fragment, &fragment->m_pkthdr.label, 2377 ipq, &ipq->ipq_label); 2378 2379 return (result); 2380} 2381 2382void 2383mac_update_ipq(struct mbuf *fragment, struct ipq *ipq) 2384{ 2385 2386 MAC_PERFORM(update_ipq, fragment, &fragment->m_pkthdr.label, ipq, 2387 &ipq->ipq_label); 2388} 2389 2390void 2391mac_create_mbuf_from_socket(struct socket *socket, struct mbuf *mbuf) 2392{ 2393 2394 MAC_PERFORM(create_mbuf_from_socket, socket, &socket->so_label, mbuf, 2395 &mbuf->m_pkthdr.label); 2396} 2397 2398void 2399mac_create_mount(struct ucred *cred, struct mount *mp) 2400{ 2401 2402 MAC_PERFORM(create_mount, cred, mp, &mp->mnt_mntlabel, 2403 &mp->mnt_fslabel); 2404} 2405 2406void 2407mac_create_root_mount(struct ucred *cred, struct mount *mp) 2408{ 2409 2410 MAC_PERFORM(create_root_mount, cred, mp, &mp->mnt_mntlabel, 2411 &mp->mnt_fslabel); 2412} 2413 2414int 2415mac_check_bpfdesc_receive(struct bpf_d *bpf_d, struct ifnet *ifnet) 2416{ 2417 int error; 2418 2419 if (!mac_enforce_network) 2420 return (0); 2421 2422 MAC_CHECK(check_bpfdesc_receive, bpf_d, &bpf_d->bd_label, ifnet, 2423 &ifnet->if_label); 2424 2425 return (error); 2426} 2427 2428static int 2429mac_check_cred_relabel(struct ucred *cred, struct label *newlabel) 2430{ 2431 int error; 2432 2433 MAC_CHECK(check_cred_relabel, cred, newlabel); 2434 2435 return (error); 2436} 2437 2438int 2439mac_check_cred_visible(struct ucred *u1, struct ucred *u2) 2440{ 2441 int error; 2442 2443 if (!mac_enforce_process) 2444 return (0); 2445 2446 MAC_CHECK(check_cred_visible, u1, u2); 2447 2448 return (error); 2449} 2450 2451int 2452mac_check_ifnet_transmit(struct ifnet *ifnet, struct mbuf *mbuf) 2453{ 2454 int error; 2455 2456 if (!mac_enforce_network) 2457 return (0); 2458 2459 KASSERT(mbuf->m_flags & M_PKTHDR, ("packet has no pkthdr")); 2460 if (!(mbuf->m_pkthdr.label.l_flags & MAC_FLAG_INITIALIZED)) 2461 printf("%s%d: not initialized\n", ifnet->if_name, 2462 ifnet->if_unit); 2463 2464 MAC_CHECK(check_ifnet_transmit, ifnet, &ifnet->if_label, mbuf, 2465 &mbuf->m_pkthdr.label); 2466 2467 return (error); 2468} 2469 2470int 2471mac_check_mount_stat(struct ucred *cred, struct mount *mount) 2472{ 2473 int error; 2474 2475 if (!mac_enforce_fs) 2476 return (0); 2477 2478 MAC_CHECK(check_mount_stat, cred, mount, &mount->mnt_mntlabel); 2479 2480 return (error); 2481} 2482 2483int 2484mac_check_pipe_ioctl(struct ucred *cred, struct pipe *pipe, unsigned long cmd, 2485 void *data) 2486{ 2487 int error; 2488 2489 MAC_CHECK(check_pipe_ioctl, cred, pipe, pipe->pipe_label, cmd, data); 2490 2491 return (error); 2492} 2493 2494int 2495mac_check_pipe_op(struct ucred *cred, struct pipe *pipe, int op) 2496{ 2497 int error; 2498 2499 MAC_CHECK(check_pipe_op, cred, pipe, pipe->pipe_label, op); 2500 2501 return (error); 2502} 2503 2504static int 2505mac_check_pipe_relabel(struct ucred *cred, struct pipe *pipe, 2506 struct label *newlabel) 2507{ 2508 int error; 2509 2510 MAC_CHECK(check_pipe_relabel, cred, pipe, pipe->pipe_label, newlabel); 2511 2512 return (error); 2513} 2514 2515int 2516mac_check_proc_debug(struct ucred *cred, struct proc *proc) 2517{ 2518 int error; 2519 2520 PROC_LOCK_ASSERT(proc, MA_OWNED); 2521 2522 if (!mac_enforce_process) 2523 return (0); 2524 2525 MAC_CHECK(check_proc_debug, cred, proc); 2526 2527 return (error); 2528} 2529 2530int 2531mac_check_proc_sched(struct ucred *cred, struct proc *proc) 2532{ 2533 int error; 2534 2535 PROC_LOCK_ASSERT(proc, MA_OWNED); 2536 2537 if (!mac_enforce_process) 2538 return (0); 2539 2540 MAC_CHECK(check_proc_sched, cred, proc); 2541 2542 return (error); 2543} 2544 2545int 2546mac_check_proc_signal(struct ucred *cred, struct proc *proc, int signum) 2547{ 2548 int error; 2549 2550 PROC_LOCK_ASSERT(proc, MA_OWNED); 2551 2552 if (!mac_enforce_process) 2553 return (0); 2554 2555 MAC_CHECK(check_proc_signal, cred, proc, signum); 2556 2557 return (error); 2558} 2559 2560int 2561mac_check_socket_bind(struct ucred *ucred, struct socket *socket, 2562 struct sockaddr *sockaddr) 2563{ 2564 int error; 2565 2566 if (!mac_enforce_socket) 2567 return (0); 2568 2569 MAC_CHECK(check_socket_bind, ucred, socket, &socket->so_label, 2570 sockaddr); 2571 2572 return (error); 2573} 2574 2575int 2576mac_check_socket_connect(struct ucred *cred, struct socket *socket, 2577 struct sockaddr *sockaddr) 2578{ 2579 int error; 2580 2581 if (!mac_enforce_socket) 2582 return (0); 2583 2584 MAC_CHECK(check_socket_connect, cred, socket, &socket->so_label, 2585 sockaddr); 2586 2587 return (error); 2588} 2589 2590int 2591mac_check_socket_deliver(struct socket *socket, struct mbuf *mbuf) 2592{ 2593 int error; 2594 2595 if (!mac_enforce_socket) 2596 return (0); 2597 2598 MAC_CHECK(check_socket_deliver, socket, &socket->so_label, mbuf, 2599 &mbuf->m_pkthdr.label); 2600 2601 return (error); 2602} 2603 2604int 2605mac_check_socket_listen(struct ucred *cred, struct socket *socket) 2606{ 2607 int error; 2608 2609 if (!mac_enforce_socket) 2610 return (0); 2611 2612 MAC_CHECK(check_socket_listen, cred, socket, &socket->so_label); 2613 return (error); 2614} 2615 2616static int 2617mac_check_socket_relabel(struct ucred *cred, struct socket *socket, 2618 struct label *newlabel) 2619{ 2620 int error; 2621 2622 MAC_CHECK(check_socket_relabel, cred, socket, &socket->so_label, 2623 newlabel); 2624 2625 return (error); 2626} 2627 2628int 2629mac_check_socket_visible(struct ucred *cred, struct socket *socket) 2630{ 2631 int error; 2632 2633 if (!mac_enforce_socket) 2634 return (0); 2635 2636 MAC_CHECK(check_socket_visible, cred, socket, &socket->so_label); 2637 2638 return (error); 2639} 2640 2641int 2642mac_ioctl_ifnet_get(struct ucred *cred, struct ifreq *ifr, 2643 struct ifnet *ifnet) 2644{ 2645 struct mac label; 2646 int error; 2647 2648 error = mac_externalize(&ifnet->if_label, &label); 2649 if (error) 2650 return (error); 2651 2652 return (copyout(&label, ifr->ifr_ifru.ifru_data, sizeof(label))); 2653} 2654 2655int 2656mac_ioctl_ifnet_set(struct ucred *cred, struct ifreq *ifr, 2657 struct ifnet *ifnet) 2658{ 2659 struct mac newlabel; 2660 struct label intlabel; 2661 int error; 2662 2663 error = copyin(ifr->ifr_ifru.ifru_data, &newlabel, sizeof(newlabel)); 2664 if (error) 2665 return (error); 2666 2667 error = mac_internalize(&intlabel, &newlabel); 2668 if (error) 2669 return (error); 2670 2671 /* 2672 * XXX: Note that this is a redundant privilege check, since 2673 * policies impose this check themselves if required by the 2674 * policy. Eventually, this should go away. 2675 */ 2676 error = suser_cred(cred, 0); 2677 if (error) 2678 goto out; 2679 2680 MAC_CHECK(check_ifnet_relabel, cred, ifnet, &ifnet->if_label, 2681 &intlabel); 2682 if (error) 2683 goto out; 2684 2685 MAC_PERFORM(relabel_ifnet, cred, ifnet, &ifnet->if_label, &intlabel); 2686 2687out: 2688 mac_destroy_temp(&intlabel); 2689 return (error); 2690} 2691 2692void 2693mac_create_devfs_vnode(struct devfs_dirent *de, struct vnode *vp) 2694{ 2695 2696 MAC_PERFORM(create_devfs_vnode, de, &de->de_label, vp, &vp->v_label); 2697} 2698 2699void 2700mac_create_devfs_device(dev_t dev, struct devfs_dirent *de) 2701{ 2702 2703 MAC_PERFORM(create_devfs_device, dev, de, &de->de_label); 2704} 2705 2706static int 2707mac_stdcreatevnode_ea(struct vnode *vp) 2708{ 2709 int error; 2710 2711 MAC_CHECK(stdcreatevnode_ea, vp, &vp->v_label); 2712 2713 return (error); 2714} 2715 2716void 2717mac_create_devfs_directory(char *dirname, int dirnamelen, 2718 struct devfs_dirent *de) 2719{ 2720 2721 MAC_PERFORM(create_devfs_directory, dirname, dirnamelen, de, 2722 &de->de_label); 2723} 2724 2725/* 2726 * When a new vnode is created, this call will initialize its label. 2727 */ 2728void 2729mac_create_vnode(struct ucred *cred, struct vnode *parent, 2730 struct vnode *child) 2731{ 2732 int error; 2733 2734 ASSERT_VOP_LOCKED(parent, "mac_create_vnode"); 2735 ASSERT_VOP_LOCKED(child, "mac_create_vnode"); 2736 2737 error = vn_refreshlabel(parent, cred); 2738 if (error) { 2739 printf("mac_create_vnode: vn_refreshlabel returned %d\n", 2740 error); 2741 printf("mac_create_vnode: using old vnode label\n"); 2742 } 2743 2744 MAC_PERFORM(create_vnode, cred, parent, &parent->v_label, child, 2745 &child->v_label); 2746} 2747 2748int 2749mac_setsockopt_label_set(struct ucred *cred, struct socket *so, 2750 struct mac *extmac) 2751{ 2752 struct label intlabel; 2753 int error; 2754 2755 error = mac_internalize(&intlabel, extmac); 2756 if (error) 2757 return (error); 2758 2759 mac_check_socket_relabel(cred, so, &intlabel); 2760 if (error) { 2761 mac_destroy_temp(&intlabel); 2762 return (error); 2763 } 2764 2765 mac_relabel_socket(cred, so, &intlabel); 2766 2767 mac_destroy_temp(&intlabel); 2768 return (0); 2769} 2770 2771int 2772mac_pipe_label_set(struct ucred *cred, struct pipe *pipe, struct label *label) 2773{ 2774 int error; 2775 2776 error = mac_check_pipe_relabel(cred, pipe, label); 2777 if (error) 2778 return (error); 2779 2780 mac_relabel_pipe(cred, pipe, label); 2781 2782 return (0); 2783} 2784 2785int 2786mac_getsockopt_label_get(struct ucred *cred, struct socket *so, 2787 struct mac *extmac) 2788{ 2789 2790 return (mac_externalize(&so->so_label, extmac)); 2791} 2792 2793int 2794mac_getsockopt_peerlabel_get(struct ucred *cred, struct socket *so, 2795 struct mac *extmac) 2796{ 2797 2798 return (mac_externalize(&so->so_peerlabel, extmac)); 2799} 2800 2801/* 2802 * Implementation of VOP_SETLABEL() that relies on extended attributes 2803 * to store label data. Can be referenced by filesystems supporting 2804 * extended attributes. 2805 */ 2806int 2807vop_stdsetlabel_ea(struct vop_setlabel_args *ap) 2808{ 2809 struct vnode *vp = ap->a_vp; 2810 struct label *intlabel = ap->a_label; 2811 struct mac extmac; 2812 int error; 2813 2814 ASSERT_VOP_LOCKED(vp, "vop_stdsetlabel_ea"); 2815 2816 /* 2817 * XXX: Eventually call out to EA check/set calls here. 2818 * Be particularly careful to avoid race conditions, 2819 * consistency problems, and stability problems when 2820 * dealing with multiple EAs. In particular, we require 2821 * the ability to write multiple EAs on the same file in 2822 * a single transaction, which the current EA interface 2823 * does not provide. 2824 */ 2825 2826 error = mac_externalize(intlabel, &extmac); 2827 if (error) 2828 return (error); 2829 2830 error = vn_extattr_set(vp, IO_NODELOCKED, 2831 FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME, 2832 sizeof(extmac), (char *)&extmac, curthread); 2833 if (error) 2834 return (error); 2835 2836 mac_relabel_vnode(ap->a_cred, vp, intlabel); 2837 2838 vp->v_vflag |= VV_CACHEDLABEL; 2839 2840 return (0); 2841} 2842 2843static int 2844vn_setlabel(struct vnode *vp, struct label *intlabel, struct ucred *cred) 2845{ 2846 int error; 2847 2848 if (vp->v_mount == NULL) { 2849 /* printf("vn_setlabel: null v_mount\n"); */ 2850 if (vp->v_tag != VT_NON) 2851 printf("vn_setlabel: null v_mount with non-VT_NON\n"); 2852 return (EBADF); 2853 } 2854 2855 if ((vp->v_mount->mnt_flag & MNT_MULTILABEL) == 0) 2856 return (EOPNOTSUPP); 2857 2858 /* 2859 * Multi-phase commit. First check the policies to confirm the 2860 * change is OK. Then commit via the filesystem. Finally, 2861 * update the actual vnode label. Question: maybe the filesystem 2862 * should update the vnode at the end as part of VOP_SETLABEL()? 2863 */ 2864 error = mac_check_vnode_relabel(cred, vp, intlabel); 2865 if (error) 2866 return (error); 2867 2868 /* 2869 * VADMIN provides the opportunity for the filesystem to make 2870 * decisions about who is and is not able to modify labels 2871 * and protections on files. This might not be right. We can't 2872 * assume VOP_SETLABEL() will do it, because we might implement 2873 * that as part of vop_stdsetlabel_ea(). 2874 */ 2875 error = VOP_ACCESS(vp, VADMIN, cred, curthread); 2876 if (error) 2877 return (error); 2878 2879 error = VOP_SETLABEL(vp, intlabel, cred, curthread); 2880 if (error) 2881 return (error); 2882 2883 return (0); 2884} 2885 2886/* 2887 * MPSAFE 2888 */ 2889int 2890__mac_get_proc(struct thread *td, struct __mac_get_proc_args *uap) 2891{ 2892 struct mac extmac; 2893 int error; 2894 2895 error = mac_externalize(&td->td_ucred->cr_label, &extmac); 2896 if (error == 0) 2897 error = copyout(&extmac, SCARG(uap, mac_p), sizeof(extmac)); 2898 2899 return (error); 2900} 2901 2902/* 2903 * MPSAFE 2904 * 2905 * XXX: Needs to be re-written for proc locking. 2906 */ 2907int 2908__mac_set_proc(struct thread *td, struct __mac_set_proc_args *uap) 2909{ 2910 struct ucred *newcred, *oldcred; 2911 struct proc *p; 2912 struct mac extmac; 2913 struct label intlabel; 2914 int error; 2915 2916 error = copyin(SCARG(uap, mac_p), &extmac, sizeof(extmac)); 2917 if (error) 2918 return (error); 2919 2920 error = mac_internalize(&intlabel, &extmac); 2921 if (error) 2922 return (error); 2923 2924 newcred = crget(); 2925 2926 p = td->td_proc; 2927 PROC_LOCK(p); 2928 oldcred = p->p_ucred; 2929 2930 error = mac_check_cred_relabel(oldcred, &intlabel); 2931 if (error) { 2932 PROC_UNLOCK(p); 2933 mac_destroy_temp(&intlabel); 2934 crfree(newcred); 2935 return (error); 2936 } 2937 2938 setsugid(p); 2939 crcopy(newcred, oldcred); 2940 PROC_UNLOCK(p); 2941 mac_relabel_cred(newcred, &intlabel); 2942 2943 PROC_LOCK(p); 2944 p->p_ucred = newcred; 2945 PROC_UNLOCK(p); 2946 crfree(oldcred); 2947 mac_destroy_temp(&intlabel); 2948 return (0); 2949} 2950 2951/* 2952 * MPSAFE 2953 */ 2954int 2955__mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap) 2956{ 2957 struct file *fp; 2958 struct mac extmac; 2959 struct vnode *vp; 2960 struct pipe *pipe; 2961 int error; 2962 2963 mtx_lock(&Giant); 2964 2965 error = fget(td, SCARG(uap, fd), &fp); 2966 if (error) 2967 goto out; 2968 2969 switch (fp->f_type) { 2970 case DTYPE_FIFO: 2971 case DTYPE_VNODE: 2972 vp = (struct vnode *)fp->f_data; 2973 2974 vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); 2975 error = vn_refreshlabel(vp, td->td_ucred); 2976 if (error == 0) 2977 error = mac_externalize(&vp->v_label, &extmac); 2978 VOP_UNLOCK(vp, 0, td); 2979 break; 2980 case DTYPE_PIPE: 2981 pipe = (struct pipe *)fp->f_data; 2982 error = mac_externalize(pipe->pipe_label, &extmac); 2983 break; 2984 default: 2985 error = EINVAL; 2986 } 2987 2988 if (error == 0) 2989 error = copyout(&extmac, SCARG(uap, mac_p), sizeof(extmac)); 2990 2991 fdrop(fp, td); 2992 2993out: 2994 mtx_unlock(&Giant); 2995 return (error); 2996} 2997 2998/* 2999 * MPSAFE 3000 */ 3001int 3002__mac_get_file(struct thread *td, struct __mac_get_file_args *uap) 3003{ 3004 struct nameidata nd; 3005 struct mac extmac; 3006 int error; 3007 3008 mtx_lock(&Giant); 3009 NDINIT(&nd, LOOKUP, LOCKLEAF | FOLLOW, UIO_USERSPACE, 3010 SCARG(uap, path_p), td); 3011 error = namei(&nd); 3012 if (error) 3013 goto out; 3014 3015 error = vn_refreshlabel(nd.ni_vp, td->td_ucred); 3016 if (error == 0) 3017 error = mac_externalize(&nd.ni_vp->v_label, &extmac); 3018 NDFREE(&nd, 0); 3019 if (error) 3020 goto out; 3021 3022 error = copyout(&extmac, SCARG(uap, mac_p), sizeof(extmac)); 3023 3024out: 3025 mtx_unlock(&Giant); 3026 return (error); 3027} 3028 3029/* 3030 * MPSAFE 3031 */ 3032int 3033__mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap) 3034{ 3035 struct file *fp; 3036 struct mac extmac; 3037 struct label intlabel; 3038 struct mount *mp; 3039 struct vnode *vp; 3040 struct pipe *pipe; 3041 int error; 3042 3043 mtx_lock(&Giant); 3044 error = fget(td, SCARG(uap, fd), &fp); 3045 if (error) 3046 goto out1; 3047 3048 error = copyin(SCARG(uap, mac_p), &extmac, sizeof(extmac)); 3049 if (error) 3050 goto out2; 3051 3052 error = mac_internalize(&intlabel, &extmac); 3053 if (error) 3054 goto out2; 3055 3056 switch (fp->f_type) { 3057 case DTYPE_FIFO: 3058 case DTYPE_VNODE: 3059 vp = (struct vnode *)fp->f_data; 3060 error = vn_start_write(vp, &mp, V_WAIT | PCATCH); 3061 if (error != 0) 3062 break; 3063 3064 vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); 3065 error = vn_setlabel(vp, &intlabel, td->td_ucred); 3066 VOP_UNLOCK(vp, 0, td); 3067 vn_finished_write(mp); 3068 mac_destroy_temp(&intlabel); 3069 break; 3070 case DTYPE_PIPE: 3071 pipe = (struct pipe *)fp->f_data; 3072 error = mac_pipe_label_set(td->td_ucred, pipe, &intlabel); 3073 break; 3074 default: 3075 error = EINVAL; 3076 } 3077 3078out2: 3079 fdrop(fp, td); 3080out1: 3081 mtx_unlock(&Giant); 3082 return (error); 3083} 3084 3085/* 3086 * MPSAFE 3087 */ 3088int 3089__mac_set_file(struct thread *td, struct __mac_set_file_args *uap) 3090{ 3091 struct nameidata nd; 3092 struct mac extmac; 3093 struct label intlabel; 3094 struct mount *mp; 3095 int error; 3096 3097 mtx_lock(&Giant); 3098 3099 error = copyin(SCARG(uap, mac_p), &extmac, sizeof(extmac)); 3100 if (error) 3101 goto out; 3102 3103 error = mac_internalize(&intlabel, &extmac); 3104 if (error) 3105 goto out; 3106 3107 NDINIT(&nd, LOOKUP, LOCKLEAF | FOLLOW, UIO_USERSPACE, 3108 SCARG(uap, path_p), td); 3109 error = namei(&nd); 3110 if (error) 3111 goto out2; 3112 error = vn_start_write(nd.ni_vp, &mp, V_WAIT | PCATCH); 3113 if (error) 3114 goto out2; 3115 3116 error = vn_setlabel(nd.ni_vp, &intlabel, td->td_ucred); 3117 3118 vn_finished_write(mp); 3119out2: 3120 mac_destroy_temp(&intlabel); 3121 NDFREE(&nd, 0); 3122out: 3123 mtx_unlock(&Giant); 3124 return (error); 3125} 3126 3127SYSINIT(mac, SI_SUB_MAC, SI_ORDER_FIRST, mac_init, NULL); 3128SYSINIT(mac_late, SI_SUB_MAC_LATE, SI_ORDER_FIRST, mac_late_init, NULL); 3129 3130#else /* !MAC */ 3131 3132int 3133__mac_get_proc(struct thread *td, struct __mac_get_proc_args *uap) 3134{ 3135 3136 return (ENOSYS); 3137} 3138 3139int 3140__mac_set_proc(struct thread *td, struct __mac_set_proc_args *uap) 3141{ 3142 3143 return (ENOSYS); 3144} 3145 3146int 3147__mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap) 3148{ 3149 3150 return (ENOSYS); 3151} 3152 3153int 3154__mac_get_file(struct thread *td, struct __mac_get_file_args *uap) 3155{ 3156 3157 return (ENOSYS); 3158} 3159 3160int 3161__mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap) 3162{ 3163 3164 return (ENOSYS); 3165} 3166 3167int 3168__mac_set_file(struct thread *td, struct __mac_set_file_args *uap) 3169{ 3170 3171 return (ENOSYS); 3172} 3173 3174#endif /* !MAC */ 3175