ugidfw_vnode.c revision 184467 
1/*-
2 * Copyright (c) 1999-2002, 2007-2008 Robert N. M. Watson
3 * Copyright (c) 2001-2005 Networks Associates Technology, Inc.
4 * Copyright (c) 2005 Tom Rhodes
5 * Copyright (c) 2006 SPARTA, Inc.
6 * All rights reserved.
7 *
8 * This software was developed by Robert Watson for the TrustedBSD Project.
9 * It was later enhanced by Tom Rhodes for the TrustedBSD Project.
10 *
11 * This software was developed for the FreeBSD Project in part by Network
12 * Associates Laboratories, the Security Research Division of Network
13 * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"),
14 * as part of the DARPA CHATS research program.
15 *
16 * This software was enhanced by SPARTA ISSO under SPAWAR contract
17 * N66001-04-C-6019 ("SEFOS").
18 *
19 * Redistribution and use in source and binary forms, with or without
20 * modification, are permitted provided that the following conditions
21 * are met:
22 * 1. Redistributions of source code must retain the above copyright
23 *    notice, this list of conditions and the following disclaimer.
24 * 2. Redistributions in binary form must reproduce the above copyright
25 *    notice, this list of conditions and the following disclaimer in the
26 *    documentation and/or other materials provided with the distribution.
27 *
28 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
29 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
30 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
31 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
32 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
33 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
34 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
35 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
36 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
37 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
38 * SUCH DAMAGE.
39 *
40 * $FreeBSD: head/sys/security/mac_bsdextended/ugidfw_vnode.c 184467 2008-10-30 10:13:53Z rwatson $
41 */
42
43#include <sys/param.h>
44#include <sys/acl.h>
45#include <sys/kernel.h>
46#include <sys/jail.h>
47#include <sys/lock.h>
48#include <sys/malloc.h>
49#include <sys/module.h>
50#include <sys/mount.h>
51#include <sys/mutex.h>
52#include <sys/priv.h>
53#include <sys/systm.h>
54#include <sys/vnode.h>
55#include <sys/sysctl.h>
56#include <sys/syslog.h>
57#include <sys/stat.h>
58
59#include <security/mac/mac_policy.h>
60#include <security/mac_bsdextended/mac_bsdextended.h>
61#include <security/mac_bsdextended/ugidfw_internal.h>
62
63int
64ugidfw_vnode_check_access(struct ucred *cred, struct vnode *vp,
65    struct label *vplabel, accmode_t accmode)
66{
67
68	return (ugidfw_check_vp(cred, vp, ugidfw_accmode2mbi(accmode)));
69}
70
71int
72ugidfw_vnode_check_chdir(struct ucred *cred, struct vnode *dvp,
73    struct label *dvplabel)
74{
75
76	return (ugidfw_check_vp(cred, dvp, MBI_EXEC));
77}
78
79int
80ugidfw_vnode_check_chroot(struct ucred *cred, struct vnode *dvp,
81    struct label *dvplabel)
82{
83
84	return (ugidfw_check_vp(cred, dvp, MBI_EXEC));
85}
86
87int
88ugidfw_check_create_vnode(struct ucred *cred, struct vnode *dvp,
89    struct label *dvplabel, struct componentname *cnp, struct vattr *vap)
90{
91
92	return (ugidfw_check_vp(cred, dvp, MBI_WRITE));
93}
94
95int
96ugidfw_vnode_check_deleteacl(struct ucred *cred, struct vnode *vp,
97    struct label *vplabel, acl_type_t type)
98{
99
100	return (ugidfw_check_vp(cred, vp, MBI_ADMIN));
101}
102
103int
104ugidfw_vnode_check_deleteextattr(struct ucred *cred, struct vnode *vp,
105    struct label *vplabel, int attrnamespace, const char *name)
106{
107
108	return (ugidfw_check_vp(cred, vp, MBI_WRITE));
109}
110
111int
112ugidfw_vnode_check_exec(struct ucred *cred, struct vnode *vp,
113    struct label *vplabel, struct image_params *imgp,
114    struct label *execlabel)
115{
116
117	return (ugidfw_check_vp(cred, vp, MBI_READ|MBI_EXEC));
118}
119
120int
121ugidfw_vnode_check_getacl(struct ucred *cred, struct vnode *vp,
122    struct label *vplabel, acl_type_t type)
123{
124
125	return (ugidfw_check_vp(cred, vp, MBI_STAT));
126}
127
128int
129ugidfw_vnode_check_getextattr(struct ucred *cred, struct vnode *vp,
130    struct label *vplabel, int attrnamespace, const char *name,
131    struct uio *uio)
132{
133
134	return (ugidfw_check_vp(cred, vp, MBI_READ));
135}
136
137int
138ugidfw_vnode_check_link(struct ucred *cred, struct vnode *dvp,
139    struct label *dvplabel, struct vnode *vp, struct label *label,
140    struct componentname *cnp)
141{
142	int error;
143
144	error = ugidfw_check_vp(cred, dvp, MBI_WRITE);
145	if (error)
146		return (error);
147	error = ugidfw_check_vp(cred, vp, MBI_WRITE);
148	if (error)
149		return (error);
150	return (0);
151}
152
153int
154ugidfw_vnode_check_listextattr(struct ucred *cred, struct vnode *vp,
155    struct label *vplabel, int attrnamespace)
156{
157
158	return (ugidfw_check_vp(cred, vp, MBI_READ));
159}
160
161int
162ugidfw_vnode_check_lookup(struct ucred *cred, struct vnode *dvp,
163    struct label *dvplabel, struct componentname *cnp)
164{
165
166	return (ugidfw_check_vp(cred, dvp, MBI_EXEC));
167}
168
169int
170ugidfw_vnode_check_open(struct ucred *cred, struct vnode *vp,
171    struct label *vplabel, accmode_t accmode)
172{
173
174	return (ugidfw_check_vp(cred, vp, ugidfw_accmode2mbi(accmode)));
175}
176
177int
178ugidfw_vnode_check_readdir(struct ucred *cred, struct vnode *dvp,
179    struct label *dvplabel)
180{
181
182	return (ugidfw_check_vp(cred, dvp, MBI_READ));
183}
184
185int
186ugidfw_vnode_check_readdlink(struct ucred *cred, struct vnode *vp,
187    struct label *vplabel)
188{
189
190	return (ugidfw_check_vp(cred, vp, MBI_READ));
191}
192
193int
194ugidfw_vnode_check_rename_from(struct ucred *cred, struct vnode *dvp,
195    struct label *dvplabel, struct vnode *vp, struct label *vplabel,
196    struct componentname *cnp)
197{
198	int error;
199
200	error = ugidfw_check_vp(cred, dvp, MBI_WRITE);
201	if (error)
202		return (error);
203	return (ugidfw_check_vp(cred, vp, MBI_WRITE));
204}
205
206int
207ugidfw_vnode_check_rename_to(struct ucred *cred, struct vnode *dvp,
208    struct label *dvplabel, struct vnode *vp, struct label *vplabel,
209    int samedir, struct componentname *cnp)
210{
211	int error;
212
213	error = ugidfw_check_vp(cred, dvp, MBI_WRITE);
214	if (error)
215		return (error);
216	if (vp != NULL)
217		error = ugidfw_check_vp(cred, vp, MBI_WRITE);
218	return (error);
219}
220
221int
222ugidfw_vnode_check_revoke(struct ucred *cred, struct vnode *vp,
223    struct label *vplabel)
224{
225
226	return (ugidfw_check_vp(cred, vp, MBI_ADMIN));
227}
228
229int
230ugidfw_check_setacl_vnode(struct ucred *cred, struct vnode *vp,
231    struct label *vplabel, acl_type_t type, struct acl *acl)
232{
233
234	return (ugidfw_check_vp(cred, vp, MBI_ADMIN));
235}
236
237int
238ugidfw_vnode_check_setextattr(struct ucred *cred, struct vnode *vp,
239    struct label *vplabel, int attrnamespace, const char *name,
240    struct uio *uio)
241{
242
243	return (ugidfw_check_vp(cred, vp, MBI_WRITE));
244}
245
246int
247ugidfw_vnode_check_setflags(struct ucred *cred, struct vnode *vp,
248    struct label *vplabel, u_long flags)
249{
250
251	return (ugidfw_check_vp(cred, vp, MBI_ADMIN));
252}
253
254int
255ugidfw_vnode_check_setmode(struct ucred *cred, struct vnode *vp,
256    struct label *vplabel, mode_t mode)
257{
258
259	return (ugidfw_check_vp(cred, vp, MBI_ADMIN));
260}
261
262int
263ugidfw_vnode_check_setowner(struct ucred *cred, struct vnode *vp,
264    struct label *vplabel, uid_t uid, gid_t gid)
265{
266
267	return (ugidfw_check_vp(cred, vp, MBI_ADMIN));
268}
269
270int
271ugidfw_vnode_check_setutimes(struct ucred *cred, struct vnode *vp,
272    struct label *vplabel, struct timespec atime, struct timespec utime)
273{
274
275	return (ugidfw_check_vp(cred, vp, MBI_ADMIN));
276}
277
278int
279ugidfw_vnode_check_stat(struct ucred *active_cred,
280    struct ucred *file_cred, struct vnode *vp, struct label *vplabel)
281{
282
283	return (ugidfw_check_vp(active_cred, vp, MBI_STAT));
284}
285
286int
287ugidfw_vnode_check_unlink(struct ucred *cred, struct vnode *dvp,
288    struct label *dvplabel, struct vnode *vp, struct label *vplabel,
289    struct componentname *cnp)
290{
291	int error;
292
293	error = ugidfw_check_vp(cred, dvp, MBI_WRITE);
294	if (error)
295		return (error);
296	return (ugidfw_check_vp(cred, vp, MBI_WRITE));
297}
298