1 /*-
2 * SPDX-License-Identifier: BSD-2-Clause
3 *
4 * Copyright (c) 2021-2022 Klara Systems
5 *
6 * This software was developed by Mitchell Horne <mhorne@FreeBSD.org>
7 * under sponsorship from Juniper Networks and Klara Systems.
8 *
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
11 * are met:
12 *
13 * 1. Redistributions of source code must retain the above copyright
14 * notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in the
17 * documentation and/or other materials provided with the distribution.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
20 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
21 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
22 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
23 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
24 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
25 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
26 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
27 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
28 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
29 */
30
31 #include <sys/param.h>
32 #include <sys/jail.h>
33 #include <sys/kdb.h>
34 #include <sys/module.h>
35 #include <sys/mount.h>
36 #include <sys/proc.h>
37 #include <sys/queue.h>
38 #include <sys/rman.h>
39 #include <sys/sysctl.h>
40
41 #include <net/vnet.h>
42
43 #include <ddb/ddb.h>
44 #include <ddb/db_command.h>
45
46 #include <security/mac/mac_policy.h>
47
48 /*
49 * This module provides a limited interface to the ddb(4) kernel debugger. The
50 * intent is to allow execution of useful debugging commands while disallowing
51 * the execution of commands which may be used to inspect/modify arbitrary
52 * system memory.
53 *
54 * Commands which are deterministic in their output or effect and that have
55 * been flagged with DB_CMD_MEMSAFE in their definition will be allowed.
56 *
57 * Other commands are valid within this context so long as there is some
58 * constraint placed on their input arguments. This applies to most 'show'
59 * commands which accept an arbitrary address. If the provided address can be
60 * validated as a real instance of the object (e.g. the 'show proc' address
61 * points to a real struct proc in the process list), then the command may be
62 * executed. This module defines several validation functions which are used to
63 * conditionally allow or block the execution of some commands. For these
64 * commands we define and apply the DB_CMD_VALIDATE flag.
65 *
66 * Any other commands not flagged with DM_CMD_MEMSAFE or DB_CMD_VALIDATE are
67 * considered unsafe for execution.
68 */
69
70 #define DB_CMD_VALIDATE DB_MAC1
71
72 typedef int db_validation_fn_t(db_expr_t addr, bool have_addr, db_expr_t count,
73 char *modif);
74
75 static db_validation_fn_t db_thread_valid;
76 static db_validation_fn_t db_show_ffs_valid;
77 static db_validation_fn_t db_show_prison_valid;
78 static db_validation_fn_t db_show_proc_valid;
79 static db_validation_fn_t db_show_rman_valid;
80 #ifdef VIMAGE
81 static db_validation_fn_t db_show_vnet_valid;
82 #endif
83
84 struct cmd_list_item {
85 const char *name;
86 db_validation_fn_t *validate_fn;
87 };
88
89 /* List of top-level ddb(4) commands which are allowed by this policy. */
90 static const struct cmd_list_item command_list[] = {
91 { "thread", db_thread_valid },
92 };
93
94 /* List of ddb(4) 'show' commands which are allowed by this policy. */
95 static const struct cmd_list_item show_command_list[] = {
96 { "ffs", db_show_ffs_valid },
97 { "prison", db_show_prison_valid },
98 { "proc", db_show_proc_valid },
99 { "rman", db_show_rman_valid },
100 { "thread", db_thread_valid },
101 #ifdef VIMAGE
102 { "vnet", db_show_vnet_valid },
103 #endif
104 };
105
106 static int
db_thread_valid(db_expr_t addr,bool have_addr,db_expr_t count,char * modif)107 db_thread_valid(db_expr_t addr, bool have_addr, db_expr_t count, char *modif)
108 {
109 struct thread *thr;
110 lwpid_t tid;
111
112 /* Default will show the current proc. */
113 if (!have_addr)
114 return (0);
115
116 /* Validate the provided addr OR tid against the thread list. */
117 tid = db_hex2dec(addr);
118 for (thr = kdb_thr_first(); thr != NULL; thr = kdb_thr_next(thr)) {
119 if ((void *)thr == (void *)addr || tid == thr->td_tid)
120 return (0);
121 }
122
123 return (EACCES);
124 }
125
126 static int
db_show_ffs_valid(db_expr_t addr,bool have_addr,db_expr_t count,char * modif)127 db_show_ffs_valid(db_expr_t addr, bool have_addr, db_expr_t count, char *modif)
128 {
129 struct mount *mp;
130
131 /* No addr will show all mounts. */
132 if (!have_addr)
133 return (0);
134
135 TAILQ_FOREACH(mp, &mountlist, mnt_list)
136 if ((void *)mp == (void *)addr)
137 return (0);
138
139 return (EACCES);
140 }
141
142 static int
db_show_prison_valid(db_expr_t addr,bool have_addr,db_expr_t count,char * modif)143 db_show_prison_valid(db_expr_t addr, bool have_addr, db_expr_t count,
144 char *modif)
145 {
146 struct prison *pr;
147 int pr_id;
148
149 if (!have_addr || addr == 0)
150 return (0);
151
152 /* prison can match by pointer address or ID. */
153 pr_id = (int)addr;
154 TAILQ_FOREACH(pr, &allprison, pr_list)
155 if (pr->pr_id == pr_id || (void *)pr == (void *)addr)
156 return (0);
157
158 return (EACCES);
159 }
160
161 static int
db_show_proc_valid(db_expr_t addr,bool have_addr,db_expr_t count,char * modif)162 db_show_proc_valid(db_expr_t addr, bool have_addr, db_expr_t count,
163 char *modif)
164 {
165 struct proc *p;
166 int i;
167
168 /* Default will show the current proc. */
169 if (!have_addr)
170 return (0);
171
172 for (i = 0; i <= pidhash; i++) {
173 LIST_FOREACH(p, &pidhashtbl[i], p_hash) {
174 if ((void *)p == (void *)addr)
175 return (0);
176 }
177 }
178
179 return (EACCES);
180 }
181
182 static int
db_show_rman_valid(db_expr_t addr,bool have_addr,db_expr_t count,char * modif)183 db_show_rman_valid(db_expr_t addr, bool have_addr, db_expr_t count, char *modif)
184 {
185 struct rman *rm;
186
187 TAILQ_FOREACH(rm, &rman_head, rm_link) {
188 if ((void *)rm == (void *)addr)
189 return (0);
190 }
191
192 return (EACCES);
193 }
194
195 #ifdef VIMAGE
196 static int
db_show_vnet_valid(db_expr_t addr,bool have_addr,db_expr_t count,char * modif)197 db_show_vnet_valid(db_expr_t addr, bool have_addr, db_expr_t count, char *modif)
198 {
199 VNET_ITERATOR_DECL(vnet);
200
201 if (!have_addr)
202 return (0);
203
204 VNET_FOREACH(vnet) {
205 if ((void *)vnet == (void *)addr)
206 return (0);
207 }
208
209 return (EACCES);
210 }
211 #endif
212
213 static int
command_match(struct db_command * cmd,struct cmd_list_item item)214 command_match(struct db_command *cmd, struct cmd_list_item item)
215 {
216 db_validation_fn_t *vfn;
217 int n;
218
219 n = strcmp(cmd->name, item.name);
220 if (n != 0)
221 return (n);
222
223 /* Got an exact match. Update the command struct */
224 vfn = item.validate_fn;
225 if (vfn != NULL) {
226 cmd->flag |= DB_CMD_VALIDATE;
227 cmd->mac_priv = vfn;
228 }
229 return (0);
230 }
231
232 static void
mac_ddb_init(struct mac_policy_conf * conf)233 mac_ddb_init(struct mac_policy_conf *conf)
234 {
235 struct db_command *cmd, *prev;
236 int i, n;
237
238 /* The command lists are sorted lexographically, as are our arrays. */
239
240 /* Register basic commands. */
241 for (i = 0, cmd = prev = NULL; i < nitems(command_list); i++) {
242 LIST_FOREACH_FROM(cmd, &db_cmd_table, next) {
243 n = command_match(cmd, command_list[i]);
244 if (n == 0) {
245 /* Got an exact match. */
246 prev = cmd;
247 break;
248 } else if (n > 0) {
249 /* Desired command is not registered. */
250 break;
251 }
252 }
253
254 /* Next search begins at the previous match. */
255 cmd = prev;
256 }
257
258 /* Register 'show' commands which require validation. */
259 for (i = 0, cmd = prev = NULL; i < nitems(show_command_list); i++) {
260 LIST_FOREACH_FROM(cmd, &db_show_table, next) {
261 n = command_match(cmd, show_command_list[i]);
262 if (n == 0) {
263 /* Got an exact match. */
264 prev = cmd;
265 break;
266 } else if (n > 0) {
267 /* Desired command is not registered. */
268 break;
269 }
270 }
271
272 /* Next search begins at the previous match. */
273 cmd = prev;
274 }
275
276 #ifdef INVARIANTS
277 /* Verify the lists are sorted correctly. */
278 const char *a, *b;
279
280 for (i = 0; i < nitems(command_list) - 1; i++) {
281 a = command_list[i].name;
282 b = command_list[i + 1].name;
283 if (strcmp(a, b) > 0)
284 panic("%s: command_list[] not alphabetical: %s,%s",
285 __func__, a, b);
286 }
287 for (i = 0; i < nitems(show_command_list) - 1; i++) {
288 a = show_command_list[i].name;
289 b = show_command_list[i + 1].name;
290 if (strcmp(a, b) > 0)
291 panic("%s: show_command_list[] not alphabetical: %s,%s",
292 __func__, a, b);
293 }
294 #endif
295 }
296
297 static int
mac_ddb_command_register(struct db_command_table * table,struct db_command * cmd)298 mac_ddb_command_register(struct db_command_table *table,
299 struct db_command *cmd)
300 {
301 int i, n;
302
303 if ((cmd->flag & DB_CMD_MEMSAFE) != 0)
304 return (0);
305
306 /* For other commands, search the allow-lists. */
307 if (table == &db_show_table) {
308 for (i = 0; i < nitems(show_command_list); i++) {
309 n = command_match(cmd, show_command_list[i]);
310 if (n == 0)
311 /* Got an exact match. */
312 return (0);
313 else if (n > 0)
314 /* Command is not in the policy list. */
315 break;
316 }
317 } else if (table == &db_cmd_table) {
318 for (i = 0; i < nitems(command_list); i++) {
319 n = command_match(cmd, command_list[i]);
320 if (n == 0)
321 /* Got an exact match. */
322 return (0);
323 else if (n > 0)
324 /* Command is not in the policy list. */
325 break;
326 }
327 }
328
329 /* The command will not be registered. */
330 return (EACCES);
331 }
332
333 static int
mac_ddb_command_exec(struct db_command * cmd,db_expr_t addr,bool have_addr,db_expr_t count,char * modif)334 mac_ddb_command_exec(struct db_command *cmd, db_expr_t addr,
335 bool have_addr, db_expr_t count, char *modif)
336 {
337 db_validation_fn_t *vfn = cmd->mac_priv;
338
339 /* Validate the command and args based on policy. */
340 if ((cmd->flag & DB_CMD_VALIDATE) != 0) {
341 MPASS(vfn != NULL);
342 if (vfn(addr, have_addr, count, modif) == 0)
343 return (0);
344 } else if ((cmd->flag & DB_CMD_MEMSAFE) != 0)
345 return (0);
346
347 return (EACCES);
348 }
349
350 static int
mac_ddb_check_backend(struct kdb_dbbe * be)351 mac_ddb_check_backend(struct kdb_dbbe *be)
352 {
353
354 /* Only allow DDB backend to execute. */
355 if (strcmp(be->dbbe_name, "ddb") == 0)
356 return (0);
357
358 return (EACCES);
359 }
360
361 /*
362 * Register functions with MAC Framework policy entry points.
363 */
364 static struct mac_policy_ops mac_ddb_ops =
365 {
366 .mpo_init = mac_ddb_init,
367
368 .mpo_ddb_command_register = mac_ddb_command_register,
369 .mpo_ddb_command_exec = mac_ddb_command_exec,
370
371 .mpo_kdb_check_backend = mac_ddb_check_backend,
372 };
373 MAC_POLICY_SET(&mac_ddb_ops, mac_ddb, "MAC/DDB", 0, NULL);
374