1/*
2 * Copyright (c) 2007 Pawel Jakub Dawidek <pjd@FreeBSD.org>
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 *    notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 *    notice, this list of conditions and the following disclaimer in the
12 *    documentation and/or other materials provided with the distribution.
13 *
14 * THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND
15 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
18 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
24 * SUCH DAMAGE.
25 */
26
27#include <sys/types.h>
28#include <sys/param.h>
29#include <sys/priv.h>
30#include <sys/vnode.h>
31#include <sys/mntent.h>
32#include <sys/mount.h>
33#include <sys/stat.h>
34#include <sys/jail.h>
35#include <sys/policy.h>
36#include <sys/zfs_vfsops.h>
37#include <sys/zfs_znode.h>
38
39
40int
41secpolicy_nfs(cred_t *cr)
42{
43
44	return (spl_priv_check_cred(cr, PRIV_NFS_DAEMON));
45}
46
47int
48secpolicy_zfs(cred_t *cr)
49{
50
51	return (spl_priv_check_cred(cr, PRIV_VFS_MOUNT));
52}
53
54int
55secpolicy_zfs_proc(cred_t *cr, proc_t *proc)
56{
57
58	return (spl_priv_check_cred(cr, PRIV_VFS_MOUNT));
59}
60
61int
62secpolicy_sys_config(cred_t *cr, int checkonly __unused)
63{
64
65	return (spl_priv_check_cred(cr, PRIV_ZFS_POOL_CONFIG));
66}
67
68int
69secpolicy_zinject(cred_t *cr)
70{
71
72	return (spl_priv_check_cred(cr, PRIV_ZFS_INJECT));
73}
74
75int
76secpolicy_fs_unmount(cred_t *cr, struct mount *vfsp __unused)
77{
78
79	return (spl_priv_check_cred(cr, PRIV_VFS_UNMOUNT));
80}
81
82int
83secpolicy_fs_owner(struct mount *mp, cred_t *cr)
84{
85
86	if (zfs_super_owner) {
87		if (cr->cr_uid == mp->mnt_cred->cr_uid &&
88		    cr->cr_prison == mp->mnt_cred->cr_prison) {
89			return (0);
90		}
91	}
92	return (EPERM);
93}
94
95/*
96 * This check is done in kern_link(), so we could just return 0 here.
97 */
98extern int hardlink_check_uid;
99int
100secpolicy_basic_link(vnode_t *vp, cred_t *cr)
101{
102
103	if (!hardlink_check_uid)
104		return (0);
105	if (secpolicy_fs_owner(vp->v_mount, cr) == 0)
106		return (0);
107	return (spl_priv_check_cred(cr, PRIV_VFS_LINK));
108}
109
110int
111secpolicy_vnode_stky_modify(cred_t *cr)
112{
113
114	return (EPERM);
115}
116
117int
118secpolicy_vnode_remove(vnode_t *vp, cred_t *cr)
119{
120
121	if (secpolicy_fs_owner(vp->v_mount, cr) == 0)
122		return (0);
123	return (spl_priv_check_cred(cr, PRIV_VFS_ADMIN));
124}
125
126int
127secpolicy_vnode_access(cred_t *cr, vnode_t *vp, uid_t owner, accmode_t accmode)
128{
129
130	if (secpolicy_fs_owner(vp->v_mount, cr) == 0)
131		return (0);
132
133	if ((accmode & VREAD) && spl_priv_check_cred(cr, PRIV_VFS_READ) != 0)
134		return (EACCES);
135	if ((accmode & VWRITE) &&
136	    spl_priv_check_cred(cr, PRIV_VFS_WRITE) != 0) {
137		return (EACCES);
138	}
139	if (accmode & VEXEC) {
140		if (vp->v_type == VDIR) {
141			if (spl_priv_check_cred(cr, PRIV_VFS_LOOKUP) != 0)
142				return (EACCES);
143		} else {
144			if (spl_priv_check_cred(cr, PRIV_VFS_EXEC) != 0)
145				return (EACCES);
146		}
147	}
148	return (0);
149}
150
151/*
152 * Like secpolicy_vnode_access() but we get the actual wanted mode and the
153 * current mode of the file, not the missing bits.
154 */
155int
156secpolicy_vnode_access2(cred_t *cr, vnode_t *vp, uid_t owner,
157    accmode_t curmode, accmode_t wantmode)
158{
159	accmode_t mode;
160
161	mode = ~curmode & wantmode;
162
163	if (mode == 0)
164		return (0);
165
166	return (secpolicy_vnode_access(cr, vp, owner, mode));
167}
168
169int
170secpolicy_vnode_any_access(cred_t *cr, vnode_t *vp, uid_t owner)
171{
172	static int privs[] = {
173	    PRIV_VFS_ADMIN,
174	    PRIV_VFS_READ,
175	    PRIV_VFS_WRITE,
176	    PRIV_VFS_EXEC,
177	    PRIV_VFS_LOOKUP
178	};
179	int i;
180
181	if (secpolicy_fs_owner(vp->v_mount, cr) == 0)
182		return (0);
183
184	/* Same as secpolicy_vnode_setdac */
185	if (owner == cr->cr_uid)
186		return (0);
187
188	for (i = 0; i < sizeof (privs)/sizeof (int); i++) {
189		int priv;
190
191		switch (priv = privs[i]) {
192		case PRIV_VFS_EXEC:
193			if (vp->v_type == VDIR)
194				continue;
195			break;
196		case PRIV_VFS_LOOKUP:
197			if (vp->v_type != VDIR)
198				continue;
199			break;
200		}
201		if (spl_priv_check_cred(cr, priv) == 0)
202			return (0);
203	}
204	return (EPERM);
205}
206
207int
208secpolicy_vnode_setdac(vnode_t *vp, cred_t *cr, uid_t owner)
209{
210
211	if (owner == cr->cr_uid)
212		return (0);
213	if (secpolicy_fs_owner(vp->v_mount, cr) == 0)
214		return (0);
215	return (spl_priv_check_cred(cr, PRIV_VFS_ADMIN));
216}
217
218int
219secpolicy_vnode_setattr(cred_t *cr, vnode_t *vp, struct vattr *vap,
220    const struct vattr *ovap, int flags,
221    int unlocked_access(void *, int, cred_t *), void *node)
222{
223	int mask = vap->va_mask;
224	int error;
225
226	if (mask & AT_SIZE) {
227		if (vp->v_type == VDIR)
228			return (EISDIR);
229		error = unlocked_access(node, VWRITE, cr);
230		if (error)
231			return (error);
232	}
233	if (mask & AT_MODE) {
234		/*
235		 * If not the owner of the file then check privilege
236		 * for two things: the privilege to set the mode at all
237		 * and, if we're setting setuid, we also need permissions
238		 * to add the set-uid bit, if we're not the owner.
239		 * In the specific case of creating a set-uid root
240		 * file, we need even more permissions.
241		 */
242		error = secpolicy_vnode_setdac(vp, cr, ovap->va_uid);
243		if (error)
244			return (error);
245		error = secpolicy_setid_setsticky_clear(vp, vap, ovap, cr);
246		if (error)
247			return (error);
248	} else {
249		vap->va_mode = ovap->va_mode;
250	}
251	if (mask & (AT_UID | AT_GID)) {
252		error = secpolicy_vnode_setdac(vp, cr, ovap->va_uid);
253		if (error)
254			return (error);
255
256		/*
257		 * To change the owner of a file, or change the group of
258		 * a file to a group of which we are not a member, the
259		 * caller must have privilege.
260		 */
261		if (((mask & AT_UID) && vap->va_uid != ovap->va_uid) ||
262		    ((mask & AT_GID) && vap->va_gid != ovap->va_gid &&
263		    !groupmember(vap->va_gid, cr))) {
264			if (secpolicy_fs_owner(vp->v_mount, cr) != 0) {
265				error = spl_priv_check_cred(cr, PRIV_VFS_CHOWN);
266				if (error)
267					return (error);
268			}
269		}
270
271		if (((mask & AT_UID) && vap->va_uid != ovap->va_uid) ||
272		    ((mask & AT_GID) && vap->va_gid != ovap->va_gid)) {
273			secpolicy_setid_clear(vap, vp, cr);
274		}
275	}
276	if (mask & (AT_ATIME | AT_MTIME)) {
277		/*
278		 * From utimes(2):
279		 * If times is NULL, ... The caller must be the owner of
280		 * the file, have permission to write the file, or be the
281		 * super-user.
282		 * If times is non-NULL, ... The caller must be the owner of
283		 * the file or be the super-user.
284		 */
285		error = secpolicy_vnode_setdac(vp, cr, ovap->va_uid);
286		if (error && (vap->va_vaflags & VA_UTIMES_NULL))
287			error = unlocked_access(node, VWRITE, cr);
288		if (error)
289			return (error);
290	}
291	return (0);
292}
293
294int
295secpolicy_vnode_create_gid(cred_t *cr)
296{
297
298	return (EPERM);
299}
300
301int
302secpolicy_vnode_setids_setgids(vnode_t *vp, cred_t *cr, gid_t gid)
303{
304
305	if (groupmember(gid, cr))
306		return (0);
307	if (secpolicy_fs_owner(vp->v_mount, cr) == 0)
308		return (0);
309	return (spl_priv_check_cred(cr, PRIV_VFS_SETGID));
310}
311
312int
313secpolicy_vnode_setid_retain(znode_t *zp, cred_t *cr,
314    boolean_t issuidroot __unused)
315{
316
317	if (secpolicy_fs_owner(ZTOV(zp)->v_mount, cr) == 0)
318		return (0);
319	return (spl_priv_check_cred(cr, PRIV_VFS_RETAINSUGID));
320}
321
322void
323secpolicy_setid_clear(struct vattr *vap, vnode_t *vp, cred_t *cr)
324{
325
326	if (secpolicy_fs_owner(vp->v_mount, cr) == 0)
327		return;
328
329	if ((vap->va_mode & (S_ISUID | S_ISGID)) != 0) {
330		if (spl_priv_check_cred(cr, PRIV_VFS_RETAINSUGID)) {
331			vap->va_mask |= AT_MODE;
332			vap->va_mode &= ~(S_ISUID|S_ISGID);
333		}
334	}
335}
336
337int
338secpolicy_setid_setsticky_clear(vnode_t *vp, struct vattr *vap,
339    const struct vattr *ovap, cred_t *cr)
340{
341	int error;
342
343	if (secpolicy_fs_owner(vp->v_mount, cr) == 0)
344		return (0);
345
346	/*
347	 * Privileged processes may set the sticky bit on non-directories,
348	 * as well as set the setgid bit on a file with a group that the process
349	 * is not a member of. Both of these are allowed in jail(8).
350	 */
351	if (vp->v_type != VDIR && (vap->va_mode & S_ISTXT)) {
352		if (spl_priv_check_cred(cr, PRIV_VFS_STICKYFILE))
353			return (EFTYPE);
354	}
355	/*
356	 * Check for privilege if attempting to set the
357	 * group-id bit.
358	 */
359	if ((vap->va_mode & S_ISGID) != 0) {
360		error = secpolicy_vnode_setids_setgids(vp, cr, ovap->va_gid);
361		if (error)
362			return (error);
363	}
364	/*
365	 * Deny setting setuid if we are not the file owner.
366	 */
367	if ((vap->va_mode & S_ISUID) && ovap->va_uid != cr->cr_uid) {
368		error = spl_priv_check_cred(cr, PRIV_VFS_ADMIN);
369		if (error)
370			return (error);
371	}
372	return (0);
373}
374
375int
376secpolicy_fs_mount(cred_t *cr, vnode_t *mvp, struct mount *vfsp)
377{
378
379	return (spl_priv_check_cred(cr, PRIV_VFS_MOUNT));
380}
381
382int
383secpolicy_vnode_owner(vnode_t *vp, cred_t *cr, uid_t owner)
384{
385
386	if (owner == cr->cr_uid)
387		return (0);
388	if (secpolicy_fs_owner(vp->v_mount, cr) == 0)
389		return (0);
390
391	/* XXX: vfs_suser()? */
392	return (spl_priv_check_cred(cr, PRIV_VFS_MOUNT_OWNER));
393}
394
395int
396secpolicy_vnode_chown(vnode_t *vp, cred_t *cr, uid_t owner)
397{
398
399	if (secpolicy_fs_owner(vp->v_mount, cr) == 0)
400		return (0);
401	return (spl_priv_check_cred(cr, PRIV_VFS_CHOWN));
402}
403
404void
405secpolicy_fs_mount_clearopts(cred_t *cr, struct mount *vfsp)
406{
407
408	if (spl_priv_check_cred(cr, PRIV_VFS_MOUNT_NONUSER) != 0) {
409		MNT_ILOCK(vfsp);
410		vfsp->vfs_flag |= VFS_NOSETUID | MNT_USER;
411		vfs_clearmntopt(vfsp, MNTOPT_SETUID);
412		vfs_setmntopt(vfsp, MNTOPT_NOSETUID, NULL, 0);
413		MNT_IUNLOCK(vfsp);
414	}
415}
416
417/*
418 * Check privileges for setting xvattr attributes
419 */
420int
421secpolicy_xvattr(vnode_t *vp, xvattr_t *xvap, uid_t owner, cred_t *cr,
422    vtype_t vtype)
423{
424
425	if (secpolicy_fs_owner(vp->v_mount, cr) == 0)
426		return (0);
427	return (spl_priv_check_cred(cr, PRIV_VFS_SYSFLAGS));
428}
429
430int
431secpolicy_smb(cred_t *cr)
432{
433
434	return (spl_priv_check_cred(cr, PRIV_NETSMB));
435}
436