mac_sysv_msg.c revision 137817
1139749Simp/*- 284059Swpaul * Copyright (c) 2003-2004 Networks Associates Technology, Inc. 384059Swpaul * All rights reserved. 484059Swpaul * 584059Swpaul * This software was developed for the FreeBSD Project in part by Network 684059Swpaul * Associates Laboratories, the Security Research Division of Network 784059Swpaul * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), 884059Swpaul * as part of the DARPA CHATS research program. 984059Swpaul * 1084059Swpaul * Redistribution and use in source and binary forms, with or without 1184059Swpaul * modification, are permitted provided that the following conditions 1284059Swpaul * are met: 1384059Swpaul * 1. Redistributions of source code must retain the above copyright 1484059Swpaul * notice, this list of conditions and the following disclaimer. 1584059Swpaul * 2. Redistributions in binary form must reproduce the above copyright 1684059Swpaul * notice, this list of conditions and the following disclaimer in the 1784059Swpaul * documentation and/or other materials provided with the distribution. 1884059Swpaul * 1984059Swpaul * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 2084059Swpaul * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 2184059Swpaul * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 2284059Swpaul * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 2384059Swpaul * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 2484059Swpaul * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 2584059Swpaul * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 2684059Swpaul * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 2784059Swpaul * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 2884059Swpaul * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 2984059Swpaul * SUCH DAMAGE. 3084059Swpaul */ 3184059Swpaul 3284059Swpaul#include <sys/cdefs.h> 3384059Swpaul__FBSDID("$FreeBSD: head/sys/security/mac/mac_sysv_msg.c 137817 2004-11-17 13:14:24Z rwatson $"); 3484059Swpaul 3584059Swpaul#include "opt_mac.h" 3684059Swpaul 3784059Swpaul#include <sys/param.h> 3884059Swpaul#include <sys/kernel.h> 3984059Swpaul#include <sys/lock.h> 4084059Swpaul#include <sys/malloc.h> 4184059Swpaul#include <sys/mutex.h> 4284059Swpaul#include <sys/mac.h> 4384059Swpaul#include <sys/sbuf.h> 4484059Swpaul#include <sys/systm.h> 4584059Swpaul#include <sys/vnode.h> 4684059Swpaul#include <sys/mount.h> 4784059Swpaul#include <sys/file.h> 4884059Swpaul#include <sys/namei.h> 4984059Swpaul#include <sys/sysctl.h> 5084059Swpaul#include <sys/msg.h> 5184059Swpaul 5284059Swpaul#include <sys/mac_policy.h> 5384059Swpaul 5484059Swpaul#include <security/mac/mac_internal.h> 5584059Swpaul 5684059Swpaulstatic int mac_enforce_sysv_msg = 1; 5784059SwpaulSYSCTL_INT(_security_mac, OID_AUTO, enforce_sysv_msg, CTLFLAG_RW, 5884059Swpaul &mac_enforce_sysv_msg, 0, 5984059Swpaul "Enforce MAC policy on System V IPC Message Queues"); 6084059SwpaulTUNABLE_INT("security.mac.enforce_sysv_msg", &mac_enforce_sysv_msg); 6184059Swpaul 6284059Swpaul#ifdef MAC_DEBUG 6384059Swpaulstatic unsigned int nmacipcmsgs, nmacipcmsqs; 6484059SwpaulSYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, ipc_msgs, CTLFLAG_RD, 6584059Swpaul &nmacipcmsgs, 0, "number of sysv ipc messages inuse"); 6684059SwpaulSYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, ipc_msqs, CTLFLAG_RD, 6784059Swpaul &nmacipcmsqs, 0, "number of sysv ipc message queue identifiers inuse"); 6884059Swpaul#endif 6984059Swpaul 7084059Swpaulstatic struct label * 7184059Swpaulmac_sysv_msgmsg_label_alloc(void) 7284059Swpaul{ 7384059Swpaul struct label *label; 7484059Swpaul 75110367Sps label = mac_labelzone_alloc(M_WAITOK); 76110367Sps MAC_PERFORM(init_sysv_msgmsg_label, label); 7784059Swpaul MAC_DEBUG_COUNTER_INC(&nmacipcmsgs); 7884059Swpaul return (label); 7984059Swpaul} 8084059Swpaul 8184059Swpaulvoid 8284059Swpaulmac_init_sysv_msgmsg(struct msg *msgptr) 8384059Swpaul{ 8484059Swpaul 8584059Swpaul msgptr->label = mac_sysv_msgmsg_label_alloc(); 8684059Swpaul} 8784059Swpaul 8884059Swpaulstatic struct label * 8984059Swpaulmac_sysv_msgqueue_label_alloc(void) 9084059Swpaul{ 9184059Swpaul struct label *label; 9284059Swpaul 9384059Swpaul label = mac_labelzone_alloc(M_WAITOK); 9484059Swpaul MAC_PERFORM(init_sysv_msgqueue_label, label); 9584059Swpaul MAC_DEBUG_COUNTER_INC(&nmacipcmsqs); 9684059Swpaul return (label); 9784059Swpaul} 9884059Swpaul 9984059Swpaulvoid 10084059Swpaulmac_init_sysv_msgqueue(struct msqid_kernel *msqkptr) 10184059Swpaul{ 10284059Swpaul 10384059Swpaul msqkptr->label = mac_sysv_msgqueue_label_alloc(); 10484059Swpaul msqkptr->label = NULL; 10584059Swpaul} 10684059Swpaul 10784059Swpaulstatic void 10884059Swpaulmac_sysv_msgmsg_label_free(struct label *label) 10984059Swpaul{ 11084059Swpaul 11184059Swpaul MAC_PERFORM(destroy_sysv_msgmsg_label, label); 11284059Swpaul mac_labelzone_free(label); 11384059Swpaul MAC_DEBUG_COUNTER_DEC(&nmacipcmsgs); 11484059Swpaul} 11584059Swpaul 11684059Swpaulvoid 11784059Swpaulmac_destroy_sysv_msgmsg(struct msg *msgptr) 11884059Swpaul{ 11984059Swpaul 12084059Swpaul mac_sysv_msgmsg_label_free(msgptr->label); 12184059Swpaul msgptr->label = NULL; 12284059Swpaul} 12384059Swpaul 12484059Swpaulstatic void 12584059Swpaulmac_sysv_msgqueue_label_free(struct label *label) 12684059Swpaul{ 12784059Swpaul 12884059Swpaul MAC_PERFORM(destroy_sysv_msgqueue_label, label); 12984059Swpaul mac_labelzone_free(label); 13084059Swpaul MAC_DEBUG_COUNTER_DEC(&nmacipcmsqs); 13184059Swpaul} 13284059Swpaul 13384059Swpaulvoid 13484059Swpaulmac_destroy_sysv_msgqueue(struct msqid_kernel *msqkptr) 13584059Swpaul{ 13684059Swpaul 13784059Swpaul mac_sysv_msgqueue_label_free(msqkptr->label); 13884059Swpaul msqkptr->label = NULL; 13984059Swpaul} 14084059Swpaul 14184059Swpaulvoid 14284059Swpaulmac_create_sysv_msgmsg(struct ucred *cred, struct msqid_kernel *msqkptr, 14384059Swpaul struct msg *msgptr) 14484059Swpaul{ 14584059Swpaul 14684059Swpaul MAC_PERFORM(create_sysv_msgmsg, cred, msqkptr, msqkptr->label, 14784059Swpaul msgptr, msgptr->label); 14884059Swpaul} 14984059Swpaul 15084059Swpaulvoid 15184059Swpaulmac_create_sysv_msgqueue(struct ucred *cred, struct msqid_kernel *msqkptr) 15284059Swpaul{ 15384059Swpaul 15484059Swpaul MAC_PERFORM(create_sysv_msgqueue, cred, msqkptr, msqkptr->label); 15584059Swpaul} 15684059Swpaul 15784059Swpaulvoid 15884059Swpaulmac_cleanup_sysv_msgmsg(struct msg *msgptr) 15984059Swpaul{ 16084059Swpaul 16184059Swpaul MAC_PERFORM(cleanup_sysv_msgmsg, msgptr->label); 16284059Swpaul} 16384059Swpaul 16484059Swpaulvoid 16584059Swpaulmac_cleanup_sysv_msgqueue(struct msqid_kernel *msqkptr) 16684059Swpaul{ 16784059Swpaul 16884059Swpaul MAC_PERFORM(cleanup_sysv_msgqueue, msqkptr->label); 16984059Swpaul} 17084059Swpaul 17184059Swpaulint 172135772Spsmac_check_sysv_msgmsq(struct ucred *cred, struct msg *msgptr, 173135772Sps struct msqid_kernel *msqkptr) 174135772Sps{ 175135772Sps int error; 17684059Swpaul 17784059Swpaul if (!mac_enforce_sysv_msg) 17884059Swpaul return (0); 17984059Swpaul 18084059Swpaul MAC_CHECK(check_sysv_msgmsq, cred, msgptr, msgptr->label, msqkptr, 18184059Swpaul msqkptr->label); 18284059Swpaul 18384059Swpaul return(error); 18484059Swpaul} 18584059Swpaul 18684059Swpaulint 18784059Swpaulmac_check_sysv_msgrcv(struct ucred *cred, struct msg *msgptr) 18884059Swpaul{ 18984059Swpaul int error; 19084059Swpaul 19184059Swpaul if (!mac_enforce_sysv_msg) 19284059Swpaul return (0); 19384059Swpaul 19484059Swpaul MAC_CHECK(check_sysv_msgrcv, cred, msgptr, msgptr->label); 19584059Swpaul 19684059Swpaul return(error); 19784059Swpaul} 19884059Swpaul 19984059Swpaulint 20084059Swpaulmac_check_sysv_msgrmid(struct ucred *cred, struct msg *msgptr) 20184059Swpaul{ 20284059Swpaul int error; 20384059Swpaul 20484059Swpaul if (!mac_enforce_sysv_msg) 20584059Swpaul return (0); 20684059Swpaul 20784059Swpaul MAC_CHECK(check_sysv_msgrmid, cred, msgptr, msgptr->label); 20884059Swpaul 20984059Swpaul return(error); 210153437Syongari} 211153437Syongari 212153437Syongariint 213153437Syongarimac_check_sysv_msqget(struct ucred *cred, struct msqid_kernel *msqkptr) 214153437Syongari{ 215153437Syongari int error; 216153437Syongari 217153437Syongari if (!mac_enforce_sysv_msg) 218153437Syongari return (0); 219153437Syongari 22084059Swpaul MAC_CHECK(check_sysv_msqget, cred, msqkptr, msqkptr->label); 221153437Syongari 222153437Syongari return(error); 223153437Syongari} 22484059Swpaul 225114813Spsint 226114813Spsmac_check_sysv_msqsnd(struct ucred *cred, struct msqid_kernel *msqkptr) 227114813Sps{ 228114813Sps int error; 229114813Sps 230114813Sps if (!mac_enforce_sysv_msg) 231114813Sps return (0); 232114813Sps 233114813Sps MAC_CHECK(check_sysv_msqsnd, cred, msqkptr, msqkptr->label); 234114813Sps 235114813Sps return(error); 236114813Sps} 237114813Sps 238114813Spsint 239114813Spsmac_check_sysv_msqrcv(struct ucred *cred, struct msqid_kernel *msqkptr) 240114813Sps{ 241114813Sps int error; 242117659Swpaul 243117659Swpaul if (!mac_enforce_sysv_msg) 244117659Swpaul return (0); 245117659Swpaul 246135772Sps MAC_CHECK(check_sysv_msqrcv, cred, msqkptr, msqkptr->label); 247135772Sps 248146413Sps return(error); 24984059Swpaul} 25093751Swpaul 251114615Spsint 252114615Spsmac_check_sysv_msqctl(struct ucred *cred, struct msqid_kernel *msqkptr, 253114615Sps int cmd) 254114615Sps{ 255114615Sps int error; 256117659Swpaul 257135772Sps if (!mac_enforce_sysv_msg) 258146413Sps return (0); 259152452Sglebius 26093751Swpaul MAC_CHECK(check_sysv_msqctl, cred, msqkptr, msqkptr->label, cmd); 261114813Sps 262114813Sps return(error); 263114813Sps} 264114813Sps