1168933Srwatson/*- 2189503Srwatson * Copyright (c) 1999-2002, 2009 Robert N. M. Watson 3168933Srwatson * Copyright (c) 2001 Ilmar S. Habibulin 4168933Srwatson * Copyright (c) 2001-2004 Networks Associates Technology, Inc. 5172930Srwatson * Copyright (c) 2006 SPARTA, Inc. 6168933Srwatson * 7168933Srwatson * This software was developed by Robert Watson and Ilmar Habibulin for the 8168933Srwatson * TrustedBSD Project. 9168933Srwatson * 10168933Srwatson * This software was developed for the FreeBSD Project in part by Network 11168933Srwatson * Associates Laboratories, the Security Research Division of Network 12168933Srwatson * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), 13168933Srwatson * as part of the DARPA CHATS research program. 14168933Srwatson * 15172930Srwatson * This software was enhanced by SPARTA ISSO under SPAWAR contract 16172930Srwatson * N66001-04-C-6019 ("SEFOS"). 17172930Srwatson * 18189503Srwatson * This software was developed at the University of Cambridge Computer 19189503Srwatson * Laboratory with support from a grant from Google, Inc. 20189503Srwatson * 21168933Srwatson * Redistribution and use in source and binary forms, with or without 22168933Srwatson * modification, are permitted provided that the following conditions 23168933Srwatson * are met: 24168933Srwatson * 1. Redistributions of source code must retain the above copyright 25168933Srwatson * notice, this list of conditions and the following disclaimer. 26168933Srwatson * 2. Redistributions in binary form must reproduce the above copyright 27168933Srwatson * notice, this list of conditions and the following disclaimer in the 28168933Srwatson * documentation and/or other materials provided with the distribution. 29168933Srwatson * 30168933Srwatson * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 31168933Srwatson * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 32168933Srwatson * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 33168933Srwatson * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 34168933Srwatson * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 35168933Srwatson * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 36168933Srwatson * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 37168933Srwatson * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 38168933Srwatson * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 39168933Srwatson * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 40168933Srwatson * SUCH DAMAGE. 41168933Srwatson */ 42168933Srwatson 43187667Srwatson#include <sys/cdefs.h> 44187667Srwatson__FBSDID("$FreeBSD$"); 45187667Srwatson 46189503Srwatson#include "opt_kdtrace.h" 47189503Srwatson 48168933Srwatson#include <sys/param.h> 49189503Srwatson#include <sys/kernel.h> 50168933Srwatson#include <sys/module.h> 51189503Srwatson#include <sys/queue.h> 52189503Srwatson#include <sys/sdt.h> 53168933Srwatson#include <sys/vnode.h> 54168933Srwatson 55168933Srwatson#include <security/audit/audit.h> 56168933Srwatson 57168933Srwatson#include <security/mac/mac_framework.h> 58168933Srwatson#include <security/mac/mac_internal.h> 59168933Srwatson#include <security/mac/mac_policy.h> 60168933Srwatson 61189529SrwatsonMAC_CHECK_PROBE_DEFINE2(cred_check_setaudit, "struct ucred *", 62189503Srwatson "struct auditinfo *"); 63189503Srwatson 64168933Srwatsonint 65189529Srwatsonmac_cred_check_setaudit(struct ucred *cred, struct auditinfo *ai) 66168933Srwatson{ 67168933Srwatson int error; 68168933Srwatson 69191731Srwatson MAC_POLICY_CHECK_NOSLEEP(cred_check_setaudit, cred, ai); 70189529Srwatson MAC_CHECK_PROBE2(cred_check_setaudit, error, cred, ai); 71168933Srwatson 72168933Srwatson return (error); 73168933Srwatson} 74168933Srwatson 75189529SrwatsonMAC_CHECK_PROBE_DEFINE2(cred_check_setaudit_addr, "struct ucred *", 76189503Srwatson "struct auditinfo_addr *"); 77189503Srwatson 78168933Srwatsonint 79189529Srwatsonmac_cred_check_setaudit_addr(struct ucred *cred, struct auditinfo_addr *aia) 80171047Srwatson{ 81171047Srwatson int error; 82171047Srwatson 83191731Srwatson MAC_POLICY_CHECK_NOSLEEP(cred_check_setaudit_addr, cred, aia); 84189529Srwatson MAC_CHECK_PROBE2(cred_check_setaudit_addr, error, cred, aia); 85171047Srwatson 86171047Srwatson return (error); 87171047Srwatson} 88171047Srwatson 89189529SrwatsonMAC_CHECK_PROBE_DEFINE2(cred_check_setauid, "struct ucred *", "uid_t"); 90189503Srwatson 91171047Srwatsonint 92189529Srwatsonmac_cred_check_setauid(struct ucred *cred, uid_t auid) 93168933Srwatson{ 94168933Srwatson int error; 95168933Srwatson 96191731Srwatson MAC_POLICY_CHECK_NOSLEEP(cred_check_setauid, cred, auid); 97189529Srwatson MAC_CHECK_PROBE2(cred_check_setauid, error, cred, auid); 98168933Srwatson 99168933Srwatson return (error); 100168933Srwatson} 101168933Srwatson 102189503SrwatsonMAC_CHECK_PROBE_DEFINE3(system_check_audit, "struct ucred *", "void *", 103189503Srwatson "int"); 104189503Srwatson 105168933Srwatsonint 106172930Srwatsonmac_system_check_audit(struct ucred *cred, void *record, int length) 107168933Srwatson{ 108168933Srwatson int error; 109168933Srwatson 110191731Srwatson MAC_POLICY_CHECK_NOSLEEP(system_check_audit, cred, record, length); 111189503Srwatson MAC_CHECK_PROBE3(system_check_audit, error, cred, record, length); 112168933Srwatson 113168933Srwatson return (error); 114168933Srwatson} 115168933Srwatson 116189503SrwatsonMAC_CHECK_PROBE_DEFINE2(system_check_auditctl, "struct ucred *", 117189503Srwatson "struct vnode *"); 118189503Srwatson 119168933Srwatsonint 120172930Srwatsonmac_system_check_auditctl(struct ucred *cred, struct vnode *vp) 121168933Srwatson{ 122168933Srwatson int error; 123168933Srwatson struct label *vl; 124168933Srwatson 125172930Srwatson ASSERT_VOP_LOCKED(vp, "mac_system_check_auditctl"); 126168933Srwatson 127168933Srwatson vl = (vp != NULL) ? vp->v_label : NULL; 128191731Srwatson MAC_POLICY_CHECK(system_check_auditctl, cred, vp, vl); 129189503Srwatson MAC_CHECK_PROBE2(system_check_auditctl, error, cred, vp); 130168933Srwatson 131168933Srwatson return (error); 132168933Srwatson} 133168933Srwatson 134189503SrwatsonMAC_CHECK_PROBE_DEFINE2(system_check_auditon, "struct ucred *", "int"); 135189503Srwatson 136168933Srwatsonint 137172930Srwatsonmac_system_check_auditon(struct ucred *cred, int cmd) 138168933Srwatson{ 139168933Srwatson int error; 140168933Srwatson 141191731Srwatson MAC_POLICY_CHECK_NOSLEEP(system_check_auditon, cred, cmd); 142189503Srwatson MAC_CHECK_PROBE2(system_check_auditon, error, cred, cmd); 143168933Srwatson 144168933Srwatson return (error); 145168933Srwatson} 146