17bc82500SRobert Watson /*-
226ae2b86SRobert Watson * Copyright (c) 2002-2003 Networks Associates Technology, Inc.
330d239bcSRobert Watson * Copyright (c) 2006 SPARTA, Inc.
42087a58cSRobert Watson * Copyright (c) 2007, 2009 Robert N. M. Watson
57bc82500SRobert Watson * All rights reserved.
67bc82500SRobert Watson *
76201265bSRobert Watson * This software was developed for the FreeBSD Project in part by Network
86201265bSRobert Watson * Associates Laboratories, the Security Research Division of Network
96201265bSRobert Watson * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"),
106201265bSRobert Watson * as part of the DARPA CHATS research program.
117bc82500SRobert Watson *
12c14d15aeSRobert Watson * Portions of this software were developed by Robert Watson for the
13c14d15aeSRobert Watson * TrustedBSD Project.
14c14d15aeSRobert Watson *
1530d239bcSRobert Watson * This software was enhanced by SPARTA ISSO under SPAWAR contract
1630d239bcSRobert Watson * N66001-04-C-6019 ("SEFOS").
1730d239bcSRobert Watson *
182087a58cSRobert Watson * This software was developed at the University of Cambridge Computer
192087a58cSRobert Watson * Laboratory with support from a grant from Google, Inc.
202087a58cSRobert Watson *
217bc82500SRobert Watson * Redistribution and use in source and binary forms, with or without
227bc82500SRobert Watson * modification, are permitted provided that the following conditions
237bc82500SRobert Watson * are met:
247bc82500SRobert Watson * 1. Redistributions of source code must retain the above copyright
257bc82500SRobert Watson * notice, this list of conditions and the following disclaimer.
267bc82500SRobert Watson * 2. Redistributions in binary form must reproduce the above copyright
277bc82500SRobert Watson * notice, this list of conditions and the following disclaimer in the
287bc82500SRobert Watson * documentation and/or other materials provided with the distribution.
297bc82500SRobert Watson *
307bc82500SRobert Watson * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
317bc82500SRobert Watson * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
327bc82500SRobert Watson * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
337bc82500SRobert Watson * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
347bc82500SRobert Watson * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
357bc82500SRobert Watson * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
367bc82500SRobert Watson * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
377bc82500SRobert Watson * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
387bc82500SRobert Watson * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
397bc82500SRobert Watson * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
407bc82500SRobert Watson * SUCH DAMAGE.
417bc82500SRobert Watson */
42677b542eSDavid E. O'Brien
43c14d15aeSRobert Watson /*
44c14d15aeSRobert Watson * MAC Framework entry points relating to overall operation of system,
45c14d15aeSRobert Watson * including global services such as the kernel environment and loadable
46c14d15aeSRobert Watson * modules.
47c14d15aeSRobert Watson *
48c14d15aeSRobert Watson * System checks often align with existing privilege checks, but provide
49c14d15aeSRobert Watson * additional security context that may be relevant to policies, such as the
50c14d15aeSRobert Watson * specific object being operated on.
51c14d15aeSRobert Watson */
52c14d15aeSRobert Watson
53677b542eSDavid E. O'Brien #include <sys/cdefs.h>
547bc82500SRobert Watson #include "opt_mac.h"
55f9d0d524SRobert Watson
567bc82500SRobert Watson #include <sys/param.h>
5795fab37eSRobert Watson #include <sys/kernel.h>
5895fab37eSRobert Watson #include <sys/lock.h>
59b656366bSBruce Evans #include <sys/malloc.h>
605dba30f1SPoul-Henning Kamp #include <sys/module.h>
6195fab37eSRobert Watson #include <sys/mutex.h>
622087a58cSRobert Watson #include <sys/sdt.h>
6395fab37eSRobert Watson #include <sys/systm.h>
6495fab37eSRobert Watson #include <sys/vnode.h>
6595fab37eSRobert Watson #include <sys/sysctl.h>
6695fab37eSRobert Watson
67aed55708SRobert Watson #include <security/mac/mac_framework.h>
686bd11732SRobert Watson #include <security/mac/mac_internal.h>
690efd6615SRobert Watson #include <security/mac/mac_policy.h>
7095fab37eSRobert Watson
712087a58cSRobert Watson MAC_CHECK_PROBE_DEFINE1(kenv_check_dump, "struct ucred *");
722087a58cSRobert Watson
7395fab37eSRobert Watson int
mac_kenv_check_dump(struct ucred * cred)7430d239bcSRobert Watson mac_kenv_check_dump(struct ucred *cred)
75e686e5aeSRobert Watson {
76e686e5aeSRobert Watson int error;
77e686e5aeSRobert Watson
78fa765671SRobert Watson MAC_POLICY_CHECK_NOSLEEP(kenv_check_dump, cred);
792087a58cSRobert Watson MAC_CHECK_PROBE1(kenv_check_dump, error, cred);
80e686e5aeSRobert Watson
81e686e5aeSRobert Watson return (error);
82e686e5aeSRobert Watson }
83e686e5aeSRobert Watson
842087a58cSRobert Watson MAC_CHECK_PROBE_DEFINE2(kenv_check_get, "struct ucred *", "char *");
852087a58cSRobert Watson
86e686e5aeSRobert Watson int
mac_kenv_check_get(struct ucred * cred,char * name)8730d239bcSRobert Watson mac_kenv_check_get(struct ucred *cred, char *name)
88e686e5aeSRobert Watson {
89e686e5aeSRobert Watson int error;
90e686e5aeSRobert Watson
91fa765671SRobert Watson MAC_POLICY_CHECK_NOSLEEP(kenv_check_get, cred, name);
922087a58cSRobert Watson MAC_CHECK_PROBE2(kenv_check_get, error, cred, name);
93e686e5aeSRobert Watson
94e686e5aeSRobert Watson return (error);
95e686e5aeSRobert Watson }
96e686e5aeSRobert Watson
972087a58cSRobert Watson MAC_CHECK_PROBE_DEFINE3(kenv_check_set, "struct ucred *", "char *",
982087a58cSRobert Watson "char *");
992087a58cSRobert Watson
100e686e5aeSRobert Watson int
mac_kenv_check_set(struct ucred * cred,char * name,char * value)10130d239bcSRobert Watson mac_kenv_check_set(struct ucred *cred, char *name, char *value)
102e686e5aeSRobert Watson {
103e686e5aeSRobert Watson int error;
104e686e5aeSRobert Watson
105fa765671SRobert Watson MAC_POLICY_CHECK_NOSLEEP(kenv_check_set, cred, name, value);
1062087a58cSRobert Watson MAC_CHECK_PROBE3(kenv_check_set, error, cred, name, value);
107e686e5aeSRobert Watson
108e686e5aeSRobert Watson return (error);
109e686e5aeSRobert Watson }
110e686e5aeSRobert Watson
1112087a58cSRobert Watson MAC_CHECK_PROBE_DEFINE2(kenv_check_unset, "struct ucred *", "char *");
1122087a58cSRobert Watson
113e686e5aeSRobert Watson int
mac_kenv_check_unset(struct ucred * cred,char * name)11430d239bcSRobert Watson mac_kenv_check_unset(struct ucred *cred, char *name)
115e686e5aeSRobert Watson {
116e686e5aeSRobert Watson int error;
117e686e5aeSRobert Watson
118fa765671SRobert Watson MAC_POLICY_CHECK_NOSLEEP(kenv_check_unset, cred, name);
1192087a58cSRobert Watson MAC_CHECK_PROBE2(kenv_check_unset, error, cred, name);
120e686e5aeSRobert Watson
121e686e5aeSRobert Watson return (error);
122e686e5aeSRobert Watson }
123e686e5aeSRobert Watson
1242087a58cSRobert Watson MAC_CHECK_PROBE_DEFINE2(kld_check_load, "struct ucred *", "struct vnode *");
1252087a58cSRobert Watson
126e686e5aeSRobert Watson int
mac_kld_check_load(struct ucred * cred,struct vnode * vp)12730d239bcSRobert Watson mac_kld_check_load(struct ucred *cred, struct vnode *vp)
128a3df768bSRobert Watson {
129a3df768bSRobert Watson int error;
130a3df768bSRobert Watson
13130d239bcSRobert Watson ASSERT_VOP_LOCKED(vp, "mac_kld_check_load");
132a3df768bSRobert Watson
133fa765671SRobert Watson MAC_POLICY_CHECK(kld_check_load, cred, vp, vp->v_label);
1342087a58cSRobert Watson MAC_CHECK_PROBE2(kld_check_load, error, cred, vp);
135a3df768bSRobert Watson
136a3df768bSRobert Watson return (error);
137a3df768bSRobert Watson }
138a3df768bSRobert Watson
1392087a58cSRobert Watson MAC_CHECK_PROBE_DEFINE1(kld_check_stat, "struct ucred *");
1402087a58cSRobert Watson
141a3df768bSRobert Watson int
mac_kld_check_stat(struct ucred * cred)14230d239bcSRobert Watson mac_kld_check_stat(struct ucred *cred)
143a3df768bSRobert Watson {
144a3df768bSRobert Watson int error;
145a3df768bSRobert Watson
146fa765671SRobert Watson MAC_POLICY_CHECK_NOSLEEP(kld_check_stat, cred);
1472087a58cSRobert Watson MAC_CHECK_PROBE1(kld_check_stat, error, cred);
148a3df768bSRobert Watson
149a3df768bSRobert Watson return (error);
150a3df768bSRobert Watson }
151a3df768bSRobert Watson
1522087a58cSRobert Watson MAC_CHECK_PROBE_DEFINE2(system_check_acct, "struct ucred *",
1532087a58cSRobert Watson "struct vnode *");
1542087a58cSRobert Watson
155a3df768bSRobert Watson int
mac_system_check_acct(struct ucred * cred,struct vnode * vp)15630d239bcSRobert Watson mac_system_check_acct(struct ucred *cred, struct vnode *vp)
157e5e820fdSRobert Watson {
158e5e820fdSRobert Watson int error;
159e5e820fdSRobert Watson
160e5e820fdSRobert Watson if (vp != NULL) {
16130d239bcSRobert Watson ASSERT_VOP_LOCKED(vp, "mac_system_check_acct");
162e5e820fdSRobert Watson }
163e5e820fdSRobert Watson
164fa765671SRobert Watson MAC_POLICY_CHECK(system_check_acct, cred, vp,
165eca8a663SRobert Watson vp != NULL ? vp->v_label : NULL);
1662087a58cSRobert Watson MAC_CHECK_PROBE2(system_check_acct, error, cred, vp);
167e5e820fdSRobert Watson
168e5e820fdSRobert Watson return (error);
169e5e820fdSRobert Watson }
170e5e820fdSRobert Watson
1712087a58cSRobert Watson MAC_CHECK_PROBE_DEFINE2(system_check_reboot, "struct ucred *", "int");
1722087a58cSRobert Watson
173e5e820fdSRobert Watson int
mac_system_check_reboot(struct ucred * cred,int howto)17430d239bcSRobert Watson mac_system_check_reboot(struct ucred *cred, int howto)
175a2ecb9b7SRobert Watson {
176a2ecb9b7SRobert Watson int error;
177a2ecb9b7SRobert Watson
178fa765671SRobert Watson MAC_POLICY_CHECK_NOSLEEP(system_check_reboot, cred, howto);
1792087a58cSRobert Watson MAC_CHECK_PROBE2(system_check_reboot, error, cred, howto);
1809e913ebdSRobert Watson
181a2ecb9b7SRobert Watson return (error);
182a2ecb9b7SRobert Watson }
183a2ecb9b7SRobert Watson
1842087a58cSRobert Watson MAC_CHECK_PROBE_DEFINE2(system_check_swapon, "struct ucred *",
1852087a58cSRobert Watson "struct vnode *");
1862087a58cSRobert Watson
187a2ecb9b7SRobert Watson int
mac_system_check_swapon(struct ucred * cred,struct vnode * vp)18830d239bcSRobert Watson mac_system_check_swapon(struct ucred *cred, struct vnode *vp)
18903ce2c0cSRobert Watson {
19003ce2c0cSRobert Watson int error;
19103ce2c0cSRobert Watson
19230d239bcSRobert Watson ASSERT_VOP_LOCKED(vp, "mac_system_check_swapon");
19303ce2c0cSRobert Watson
194fa765671SRobert Watson MAC_POLICY_CHECK(system_check_swapon, cred, vp, vp->v_label);
1952087a58cSRobert Watson MAC_CHECK_PROBE2(system_check_swapon, error, cred, vp);
1962087a58cSRobert Watson
19703ce2c0cSRobert Watson return (error);
19803ce2c0cSRobert Watson }
19903ce2c0cSRobert Watson
2002087a58cSRobert Watson MAC_CHECK_PROBE_DEFINE2(system_check_swapoff, "struct ucred *",
2012087a58cSRobert Watson "struct vnode *");
2022087a58cSRobert Watson
20303ce2c0cSRobert Watson int
mac_system_check_swapoff(struct ucred * cred,struct vnode * vp)20430d239bcSRobert Watson mac_system_check_swapoff(struct ucred *cred, struct vnode *vp)
2051b2c2ab2SRobert Watson {
2061b2c2ab2SRobert Watson int error;
2071b2c2ab2SRobert Watson
20830d239bcSRobert Watson ASSERT_VOP_LOCKED(vp, "mac_system_check_swapoff");
2091b2c2ab2SRobert Watson
210fa765671SRobert Watson MAC_POLICY_CHECK(system_check_swapoff, cred, vp, vp->v_label);
2112087a58cSRobert Watson MAC_CHECK_PROBE2(system_check_swapoff, error, cred, vp);
2122087a58cSRobert Watson
2131b2c2ab2SRobert Watson return (error);
2141b2c2ab2SRobert Watson }
2151b2c2ab2SRobert Watson
2162087a58cSRobert Watson MAC_CHECK_PROBE_DEFINE3(system_check_sysctl, "struct ucred *",
2172087a58cSRobert Watson "struct sysctl_oid *", "struct sysctl_req *");
2182087a58cSRobert Watson
2191b2c2ab2SRobert Watson int
mac_system_check_sysctl(struct ucred * cred,struct sysctl_oid * oidp,void * arg1,int arg2,struct sysctl_req * req)22030d239bcSRobert Watson mac_system_check_sysctl(struct ucred *cred, struct sysctl_oid *oidp,
221c14d15aeSRobert Watson void *arg1, int arg2, struct sysctl_req *req)
222d3fc69eeSRobert Watson {
223d3fc69eeSRobert Watson int error;
224d3fc69eeSRobert Watson
225d3fc69eeSRobert Watson /*
226578994bbSChristian S.J. Peron * XXXMAC: We would very much like to assert the SYSCTL_LOCK here,
227d3fc69eeSRobert Watson * but since it's not exported from kern_sysctl.c, we can't.
228d3fc69eeSRobert Watson */
229fa765671SRobert Watson MAC_POLICY_CHECK_NOSLEEP(system_check_sysctl, cred, oidp, arg1, arg2,
230fa765671SRobert Watson req);
2312087a58cSRobert Watson MAC_CHECK_PROBE3(system_check_sysctl, error, cred, oidp, req);
232d3fc69eeSRobert Watson
233d3fc69eeSRobert Watson return (error);
234d3fc69eeSRobert Watson }
235