1 /*- 2 * Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson 3 * Copyright (c) 2001 Ilmar S. Habibulin 4 * Copyright (c) 2001, 2002 Networks Associates Technology, Inc. 5 * All rights reserved. 6 * 7 * This software was developed by Robert Watson and Ilmar Habibulin for the 8 * TrustedBSD Project. 9 * 10 * This software was developed for the FreeBSD Project in part by NAI Labs, 11 * the Security Research Division of Network Associates, Inc. under 12 * DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA 13 * CHATS research program. 14 * 15 * Redistribution and use in source and binary forms, with or without 16 * modification, are permitted provided that the following conditions 17 * are met: 18 * 1. Redistributions of source code must retain the above copyright 19 * notice, this list of conditions and the following disclaimer. 20 * 2. Redistributions in binary form must reproduce the above copyright 21 * notice, this list of conditions and the following disclaimer in the 22 * documentation and/or other materials provided with the distribution. 23 * 3. The names of the authors may not be used to endorse or promote 24 * products derived from this software without specific prior written 25 * permission. 26 * 27 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 28 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 29 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 30 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 31 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 32 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 33 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 34 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 35 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 36 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 37 * SUCH DAMAGE. 38 * 39 * $FreeBSD$ 40 */ 41 /* 42 * Developed by the TrustedBSD Project. 43 * 44 * Framework for extensible kernel access control. Kernel and userland 45 * interface to the framework, policy registration and composition. 46 */ 47 48 #include "opt_mac.h" 49 50 #include <sys/param.h> 51 #include <sys/extattr.h> 52 #include <sys/kernel.h> 53 #include <sys/lock.h> 54 #include <sys/malloc.h> 55 #include <sys/mutex.h> 56 #include <sys/mac.h> 57 #include <sys/module.h> 58 #include <sys/proc.h> 59 #include <sys/systm.h> 60 #include <sys/sysproto.h> 61 #include <sys/sysent.h> 62 #include <sys/vnode.h> 63 #include <sys/mount.h> 64 #include <sys/file.h> 65 #include <sys/namei.h> 66 #include <sys/socket.h> 67 #include <sys/pipe.h> 68 #include <sys/socketvar.h> 69 #include <sys/sysctl.h> 70 71 #include <vm/vm.h> 72 #include <vm/pmap.h> 73 #include <vm/vm_map.h> 74 #include <vm/vm_object.h> 75 76 #include <sys/mac_policy.h> 77 78 #include <fs/devfs/devfs.h> 79 80 #include <net/bpfdesc.h> 81 #include <net/if.h> 82 #include <net/if_var.h> 83 84 #include <netinet/in.h> 85 #include <netinet/ip_var.h> 86 87 #ifdef MAC 88 89 /* 90 * Declare that the kernel provides MAC support, version 1. This permits 91 * modules to refuse to be loaded if the necessary support isn't present, 92 * even if it's pre-boot. 93 */ 94 MODULE_VERSION(kernel_mac_support, 1); 95 96 SYSCTL_DECL(_security); 97 98 SYSCTL_NODE(_security, OID_AUTO, mac, CTLFLAG_RW, 0, 99 "TrustedBSD MAC policy controls"); 100 SYSCTL_NODE(_security_mac, OID_AUTO, debug, CTLFLAG_RW, 0, 101 "TrustedBSD MAC debug info"); 102 103 static int mac_debug_label_fallback = 0; 104 SYSCTL_INT(_security_mac_debug, OID_AUTO, label_fallback, CTLFLAG_RW, 105 &mac_debug_label_fallback, 0, "Filesystems should fall back to fs label" 106 "when label is corrupted."); 107 TUNABLE_INT("security.mac.debug_label_fallback", 108 &mac_debug_label_fallback); 109 110 #ifndef MAC_MAX_POLICIES 111 #define MAC_MAX_POLICIES 8 112 #endif 113 #if MAC_MAX_POLICIES > 32 114 #error "MAC_MAX_POLICIES too large" 115 #endif 116 static unsigned int mac_max_policies = MAC_MAX_POLICIES; 117 static unsigned int mac_policy_offsets_free = (1 << MAC_MAX_POLICIES) - 1; 118 SYSCTL_UINT(_security_mac, OID_AUTO, max_policies, CTLFLAG_RD, 119 &mac_max_policies, 0, ""); 120 121 static int mac_late = 0; 122 123 static int mac_enforce_fs = 1; 124 SYSCTL_INT(_security_mac, OID_AUTO, enforce_fs, CTLFLAG_RW, 125 &mac_enforce_fs, 0, "Enforce MAC policy on file system objects"); 126 TUNABLE_INT("security.mac.enforce_fs", &mac_enforce_fs); 127 128 static int mac_enforce_network = 1; 129 SYSCTL_INT(_security_mac, OID_AUTO, enforce_network, CTLFLAG_RW, 130 &mac_enforce_network, 0, "Enforce MAC policy on network packets"); 131 TUNABLE_INT("security.mac.enforce_network", &mac_enforce_network); 132 133 static int mac_enforce_pipe = 1; 134 SYSCTL_INT(_security_mac, OID_AUTO, enforce_pipe, CTLFLAG_RW, 135 &mac_enforce_pipe, 0, "Enforce MAC policy on pipe operations"); 136 137 static int mac_enforce_process = 1; 138 SYSCTL_INT(_security_mac, OID_AUTO, enforce_process, CTLFLAG_RW, 139 &mac_enforce_process, 0, "Enforce MAC policy on inter-process operations"); 140 TUNABLE_INT("security.mac.enforce_process", &mac_enforce_process); 141 142 static int mac_enforce_socket = 1; 143 SYSCTL_INT(_security_mac, OID_AUTO, enforce_socket, CTLFLAG_RW, 144 &mac_enforce_socket, 0, "Enforce MAC policy on socket operations"); 145 TUNABLE_INT("security.mac.enforce_socket", &mac_enforce_socket); 146 147 static int mac_enforce_vm = 1; 148 SYSCTL_INT(_security_mac, OID_AUTO, enforce_vm, CTLFLAG_RW, 149 &mac_enforce_vm, 0, "Enforce MAC policy on vm operations"); 150 151 static int mac_label_size = sizeof(struct mac); 152 SYSCTL_INT(_security_mac, OID_AUTO, label_size, CTLFLAG_RD, 153 &mac_label_size, 0, "Pre-compiled MAC label size"); 154 155 static int mac_cache_fslabel_in_vnode = 1; 156 SYSCTL_INT(_security_mac, OID_AUTO, cache_fslabel_in_vnode, CTLFLAG_RW, 157 &mac_cache_fslabel_in_vnode, 0, "Cache mount fslabel in vnode"); 158 TUNABLE_INT("security.mac.cache_fslabel_in_vnode", 159 &mac_cache_fslabel_in_vnode); 160 161 static int mac_vnode_label_cache_hits = 0; 162 SYSCTL_INT(_security_mac, OID_AUTO, vnode_label_cache_hits, CTLFLAG_RD, 163 &mac_vnode_label_cache_hits, 0, "Cache hits on vnode labels"); 164 static int mac_vnode_label_cache_misses = 0; 165 SYSCTL_INT(_security_mac, OID_AUTO, vnode_label_cache_misses, CTLFLAG_RD, 166 &mac_vnode_label_cache_misses, 0, "Cache misses on vnode labels"); 167 168 static int mac_mmap_revocation = 1; 169 SYSCTL_INT(_security_mac, OID_AUTO, mmap_revocation, CTLFLAG_RW, 170 &mac_mmap_revocation, 0, "Revoke mmap access to files on subject " 171 "relabel"); 172 static int mac_mmap_revocation_via_cow = 0; 173 SYSCTL_INT(_security_mac, OID_AUTO, mmap_revocation_via_cow, CTLFLAG_RW, 174 &mac_mmap_revocation_via_cow, 0, "Revoke mmap access to files via " 175 "copy-on-write semantics, or by removing all write access"); 176 177 #ifdef MAC_DEBUG 178 static unsigned int nmacmbufs, nmaccreds, nmacifnets, nmacbpfdescs, 179 nmacsockets, nmacmounts, nmactemp, nmacvnodes, nmacdevfsdirents, 180 nmacipqs, nmacpipes; 181 SYSCTL_UINT(_security_mac_debug, OID_AUTO, mbufs, CTLFLAG_RD, 182 &nmacmbufs, 0, "number of mbufs in use"); 183 SYSCTL_UINT(_security_mac_debug, OID_AUTO, creds, CTLFLAG_RD, 184 &nmaccreds, 0, "number of ucreds in use"); 185 SYSCTL_UINT(_security_mac_debug, OID_AUTO, ifnets, CTLFLAG_RD, 186 &nmacifnets, 0, "number of ifnets in use"); 187 SYSCTL_UINT(_security_mac_debug, OID_AUTO, ipqs, CTLFLAG_RD, 188 &nmacipqs, 0, "number of ipqs in use"); 189 SYSCTL_UINT(_security_mac_debug, OID_AUTO, bpfdescs, CTLFLAG_RD, 190 &nmacbpfdescs, 0, "number of bpfdescs in use"); 191 SYSCTL_UINT(_security_mac_debug, OID_AUTO, sockets, CTLFLAG_RD, 192 &nmacsockets, 0, "number of sockets in use"); 193 SYSCTL_UINT(_security_mac_debug, OID_AUTO, pipes, CTLFLAG_RD, 194 &nmacpipes, 0, "number of pipes in use"); 195 SYSCTL_UINT(_security_mac_debug, OID_AUTO, mounts, CTLFLAG_RD, 196 &nmacmounts, 0, "number of mounts in use"); 197 SYSCTL_UINT(_security_mac_debug, OID_AUTO, temp, CTLFLAG_RD, 198 &nmactemp, 0, "number of temporary labels in use"); 199 SYSCTL_UINT(_security_mac_debug, OID_AUTO, vnodes, CTLFLAG_RD, 200 &nmacvnodes, 0, "number of vnodes in use"); 201 SYSCTL_UINT(_security_mac_debug, OID_AUTO, devfsdirents, CTLFLAG_RD, 202 &nmacdevfsdirents, 0, "number of devfs dirents inuse"); 203 #endif 204 205 static int error_select(int error1, int error2); 206 static int mac_externalize(struct label *label, struct mac *mac); 207 static int mac_policy_register(struct mac_policy_conf *mpc); 208 static int mac_policy_unregister(struct mac_policy_conf *mpc); 209 210 static int mac_stdcreatevnode_ea(struct vnode *vp); 211 static void mac_cred_mmapped_drop_perms(struct thread *td, 212 struct ucred *cred); 213 static void mac_cred_mmapped_drop_perms_recurse(struct thread *td, 214 struct ucred *cred, struct vm_map *map); 215 216 MALLOC_DEFINE(M_MACOPVEC, "macopvec", "MAC policy operation vector"); 217 MALLOC_DEFINE(M_MACPIPELABEL, "macpipelabel", "MAC labels for pipes"); 218 219 /* 220 * mac_policy_list_lock protects the consistency of 'mac_policy_list', 221 * the linked list of attached policy modules. Read-only consumers of 222 * the list must acquire a shared lock for the duration of their use; 223 * writers must acquire an exclusive lock. Note that for compound 224 * operations, locks should be held for the entire compound operation, 225 * and that this is not yet done for relabel requests. 226 */ 227 static struct mtx mac_policy_list_lock; 228 static LIST_HEAD(, mac_policy_conf) mac_policy_list; 229 static int mac_policy_list_busy; 230 #define MAC_POLICY_LIST_LOCKINIT() mtx_init(&mac_policy_list_lock, \ 231 "mac_policy_list_lock", NULL, MTX_DEF); 232 #define MAC_POLICY_LIST_LOCK() mtx_lock(&mac_policy_list_lock); 233 #define MAC_POLICY_LIST_UNLOCK() mtx_unlock(&mac_policy_list_lock); 234 235 #define MAC_POLICY_LIST_BUSY() do { \ 236 MAC_POLICY_LIST_LOCK(); \ 237 mac_policy_list_busy++; \ 238 MAC_POLICY_LIST_UNLOCK(); \ 239 } while (0) 240 241 #define MAC_POLICY_LIST_UNBUSY() do { \ 242 MAC_POLICY_LIST_LOCK(); \ 243 mac_policy_list_busy--; \ 244 if (mac_policy_list_busy < 0) \ 245 panic("Extra mac_policy_list_busy--"); \ 246 MAC_POLICY_LIST_UNLOCK(); \ 247 } while (0) 248 249 /* 250 * MAC_CHECK performs the designated check by walking the policy 251 * module list and checking with each as to how it feels about the 252 * request. Note that it returns its value via 'error' in the scope 253 * of the caller. 254 */ 255 #define MAC_CHECK(check, args...) do { \ 256 struct mac_policy_conf *mpc; \ 257 \ 258 error = 0; \ 259 MAC_POLICY_LIST_BUSY(); \ 260 LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { \ 261 if (mpc->mpc_ops->mpo_ ## check != NULL) \ 262 error = error_select( \ 263 mpc->mpc_ops->mpo_ ## check (args), \ 264 error); \ 265 } \ 266 MAC_POLICY_LIST_UNBUSY(); \ 267 } while (0) 268 269 /* 270 * MAC_BOOLEAN performs the designated boolean composition by walking 271 * the module list, invoking each instance of the operation, and 272 * combining the results using the passed C operator. Note that it 273 * returns its value via 'result' in the scope of the caller, which 274 * should be initialized by the caller in a meaningful way to get 275 * a meaningful result. 276 */ 277 #define MAC_BOOLEAN(operation, composition, args...) do { \ 278 struct mac_policy_conf *mpc; \ 279 \ 280 MAC_POLICY_LIST_BUSY(); \ 281 LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { \ 282 if (mpc->mpc_ops->mpo_ ## operation != NULL) \ 283 result = result composition \ 284 mpc->mpc_ops->mpo_ ## operation (args); \ 285 } \ 286 MAC_POLICY_LIST_UNBUSY(); \ 287 } while (0) 288 289 /* 290 * MAC_PERFORM performs the designated operation by walking the policy 291 * module list and invoking that operation for each policy. 292 */ 293 #define MAC_PERFORM(operation, args...) do { \ 294 struct mac_policy_conf *mpc; \ 295 \ 296 MAC_POLICY_LIST_BUSY(); \ 297 LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { \ 298 if (mpc->mpc_ops->mpo_ ## operation != NULL) \ 299 mpc->mpc_ops->mpo_ ## operation (args); \ 300 } \ 301 MAC_POLICY_LIST_UNBUSY(); \ 302 } while (0) 303 304 /* 305 * Initialize the MAC subsystem, including appropriate SMP locks. 306 */ 307 static void 308 mac_init(void) 309 { 310 311 LIST_INIT(&mac_policy_list); 312 MAC_POLICY_LIST_LOCKINIT(); 313 } 314 315 /* 316 * For the purposes of modules that want to know if they were loaded 317 * "early", set the mac_late flag once we've processed modules either 318 * linked into the kernel, or loaded before the kernel startup. 319 */ 320 static void 321 mac_late_init(void) 322 { 323 324 mac_late = 1; 325 } 326 327 /* 328 * Allow MAC policy modules to register during boot, etc. 329 */ 330 int 331 mac_policy_modevent(module_t mod, int type, void *data) 332 { 333 struct mac_policy_conf *mpc; 334 int error; 335 336 error = 0; 337 mpc = (struct mac_policy_conf *) data; 338 339 switch (type) { 340 case MOD_LOAD: 341 if (mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_NOTLATE && 342 mac_late) { 343 printf("mac_policy_modevent: can't load %s policy " 344 "after booting\n", mpc->mpc_name); 345 error = EBUSY; 346 break; 347 } 348 error = mac_policy_register(mpc); 349 break; 350 case MOD_UNLOAD: 351 /* Don't unregister the module if it was never registered. */ 352 if ((mpc->mpc_runtime_flags & MPC_RUNTIME_FLAG_REGISTERED) 353 != 0) 354 error = mac_policy_unregister(mpc); 355 else 356 error = 0; 357 break; 358 default: 359 break; 360 } 361 362 return (error); 363 } 364 365 static int 366 mac_policy_register(struct mac_policy_conf *mpc) 367 { 368 struct mac_policy_conf *tmpc; 369 struct mac_policy_op_entry *mpe; 370 int slot; 371 372 MALLOC(mpc->mpc_ops, struct mac_policy_ops *, sizeof(*mpc->mpc_ops), 373 M_MACOPVEC, M_WAITOK | M_ZERO); 374 for (mpe = mpc->mpc_entries; mpe->mpe_constant != MAC_OP_LAST; mpe++) { 375 switch (mpe->mpe_constant) { 376 case MAC_OP_LAST: 377 /* 378 * Doesn't actually happen, but this allows checking 379 * that all enumerated values are handled. 380 */ 381 break; 382 case MAC_DESTROY: 383 mpc->mpc_ops->mpo_destroy = 384 mpe->mpe_function; 385 break; 386 case MAC_INIT: 387 mpc->mpc_ops->mpo_init = 388 mpe->mpe_function; 389 break; 390 case MAC_SYSCALL: 391 mpc->mpc_ops->mpo_syscall = 392 mpe->mpe_function; 393 break; 394 case MAC_INIT_BPFDESC: 395 mpc->mpc_ops->mpo_init_bpfdesc = 396 mpe->mpe_function; 397 break; 398 case MAC_INIT_CRED: 399 mpc->mpc_ops->mpo_init_cred = 400 mpe->mpe_function; 401 break; 402 case MAC_INIT_DEVFSDIRENT: 403 mpc->mpc_ops->mpo_init_devfsdirent = 404 mpe->mpe_function; 405 break; 406 case MAC_INIT_IFNET: 407 mpc->mpc_ops->mpo_init_ifnet = 408 mpe->mpe_function; 409 break; 410 case MAC_INIT_IPQ: 411 mpc->mpc_ops->mpo_init_ipq = 412 mpe->mpe_function; 413 break; 414 case MAC_INIT_MBUF: 415 mpc->mpc_ops->mpo_init_mbuf = 416 mpe->mpe_function; 417 break; 418 case MAC_INIT_MOUNT: 419 mpc->mpc_ops->mpo_init_mount = 420 mpe->mpe_function; 421 break; 422 case MAC_INIT_PIPE: 423 mpc->mpc_ops->mpo_init_pipe = 424 mpe->mpe_function; 425 break; 426 case MAC_INIT_SOCKET: 427 mpc->mpc_ops->mpo_init_socket = 428 mpe->mpe_function; 429 break; 430 case MAC_INIT_TEMP: 431 mpc->mpc_ops->mpo_init_temp = 432 mpe->mpe_function; 433 break; 434 case MAC_INIT_VNODE: 435 mpc->mpc_ops->mpo_init_vnode = 436 mpe->mpe_function; 437 break; 438 case MAC_DESTROY_BPFDESC: 439 mpc->mpc_ops->mpo_destroy_bpfdesc = 440 mpe->mpe_function; 441 break; 442 case MAC_DESTROY_CRED: 443 mpc->mpc_ops->mpo_destroy_cred = 444 mpe->mpe_function; 445 break; 446 case MAC_DESTROY_DEVFSDIRENT: 447 mpc->mpc_ops->mpo_destroy_devfsdirent = 448 mpe->mpe_function; 449 break; 450 case MAC_DESTROY_IFNET: 451 mpc->mpc_ops->mpo_destroy_ifnet = 452 mpe->mpe_function; 453 break; 454 case MAC_DESTROY_IPQ: 455 mpc->mpc_ops->mpo_destroy_ipq = 456 mpe->mpe_function; 457 break; 458 case MAC_DESTROY_MBUF: 459 mpc->mpc_ops->mpo_destroy_mbuf = 460 mpe->mpe_function; 461 break; 462 case MAC_DESTROY_MOUNT: 463 mpc->mpc_ops->mpo_destroy_mount = 464 mpe->mpe_function; 465 break; 466 case MAC_DESTROY_PIPE: 467 mpc->mpc_ops->mpo_destroy_pipe = 468 mpe->mpe_function; 469 break; 470 case MAC_DESTROY_SOCKET: 471 mpc->mpc_ops->mpo_destroy_socket = 472 mpe->mpe_function; 473 break; 474 case MAC_DESTROY_TEMP: 475 mpc->mpc_ops->mpo_destroy_temp = 476 mpe->mpe_function; 477 break; 478 case MAC_DESTROY_VNODE: 479 mpc->mpc_ops->mpo_destroy_vnode = 480 mpe->mpe_function; 481 break; 482 case MAC_EXTERNALIZE: 483 mpc->mpc_ops->mpo_externalize = 484 mpe->mpe_function; 485 break; 486 case MAC_INTERNALIZE: 487 mpc->mpc_ops->mpo_internalize = 488 mpe->mpe_function; 489 break; 490 case MAC_CREATE_DEVFS_DEVICE: 491 mpc->mpc_ops->mpo_create_devfs_device = 492 mpe->mpe_function; 493 break; 494 case MAC_CREATE_DEVFS_DIRECTORY: 495 mpc->mpc_ops->mpo_create_devfs_directory = 496 mpe->mpe_function; 497 break; 498 case MAC_CREATE_DEVFS_VNODE: 499 mpc->mpc_ops->mpo_create_devfs_vnode = 500 mpe->mpe_function; 501 break; 502 case MAC_STDCREATEVNODE_EA: 503 mpc->mpc_ops->mpo_stdcreatevnode_ea = 504 mpe->mpe_function; 505 break; 506 case MAC_CREATE_VNODE: 507 mpc->mpc_ops->mpo_create_vnode = 508 mpe->mpe_function; 509 break; 510 case MAC_CREATE_MOUNT: 511 mpc->mpc_ops->mpo_create_mount = 512 mpe->mpe_function; 513 break; 514 case MAC_CREATE_ROOT_MOUNT: 515 mpc->mpc_ops->mpo_create_root_mount = 516 mpe->mpe_function; 517 break; 518 case MAC_RELABEL_VNODE: 519 mpc->mpc_ops->mpo_relabel_vnode = 520 mpe->mpe_function; 521 break; 522 case MAC_UPDATE_DEVFSDIRENT: 523 mpc->mpc_ops->mpo_update_devfsdirent = 524 mpe->mpe_function; 525 break; 526 case MAC_UPDATE_PROCFSVNODE: 527 mpc->mpc_ops->mpo_update_procfsvnode = 528 mpe->mpe_function; 529 break; 530 case MAC_UPDATE_VNODE_FROM_EXTATTR: 531 mpc->mpc_ops->mpo_update_vnode_from_extattr = 532 mpe->mpe_function; 533 break; 534 case MAC_UPDATE_VNODE_FROM_EXTERNALIZED: 535 mpc->mpc_ops->mpo_update_vnode_from_externalized = 536 mpe->mpe_function; 537 break; 538 case MAC_UPDATE_VNODE_FROM_MOUNT: 539 mpc->mpc_ops->mpo_update_vnode_from_mount = 540 mpe->mpe_function; 541 break; 542 case MAC_CREATE_MBUF_FROM_SOCKET: 543 mpc->mpc_ops->mpo_create_mbuf_from_socket = 544 mpe->mpe_function; 545 break; 546 case MAC_CREATE_PIPE: 547 mpc->mpc_ops->mpo_create_pipe = 548 mpe->mpe_function; 549 break; 550 case MAC_CREATE_SOCKET: 551 mpc->mpc_ops->mpo_create_socket = 552 mpe->mpe_function; 553 break; 554 case MAC_CREATE_SOCKET_FROM_SOCKET: 555 mpc->mpc_ops->mpo_create_socket_from_socket = 556 mpe->mpe_function; 557 break; 558 case MAC_RELABEL_PIPE: 559 mpc->mpc_ops->mpo_relabel_pipe = 560 mpe->mpe_function; 561 break; 562 case MAC_RELABEL_SOCKET: 563 mpc->mpc_ops->mpo_relabel_socket = 564 mpe->mpe_function; 565 break; 566 case MAC_SET_SOCKET_PEER_FROM_MBUF: 567 mpc->mpc_ops->mpo_set_socket_peer_from_mbuf = 568 mpe->mpe_function; 569 break; 570 case MAC_SET_SOCKET_PEER_FROM_SOCKET: 571 mpc->mpc_ops->mpo_set_socket_peer_from_socket = 572 mpe->mpe_function; 573 break; 574 case MAC_CREATE_BPFDESC: 575 mpc->mpc_ops->mpo_create_bpfdesc = 576 mpe->mpe_function; 577 break; 578 case MAC_CREATE_DATAGRAM_FROM_IPQ: 579 mpc->mpc_ops->mpo_create_datagram_from_ipq = 580 mpe->mpe_function; 581 break; 582 case MAC_CREATE_FRAGMENT: 583 mpc->mpc_ops->mpo_create_fragment = 584 mpe->mpe_function; 585 break; 586 case MAC_CREATE_IFNET: 587 mpc->mpc_ops->mpo_create_ifnet = 588 mpe->mpe_function; 589 break; 590 case MAC_CREATE_IPQ: 591 mpc->mpc_ops->mpo_create_ipq = 592 mpe->mpe_function; 593 break; 594 case MAC_CREATE_MBUF_FROM_MBUF: 595 mpc->mpc_ops->mpo_create_mbuf_from_mbuf = 596 mpe->mpe_function; 597 break; 598 case MAC_CREATE_MBUF_LINKLAYER: 599 mpc->mpc_ops->mpo_create_mbuf_linklayer = 600 mpe->mpe_function; 601 break; 602 case MAC_CREATE_MBUF_FROM_BPFDESC: 603 mpc->mpc_ops->mpo_create_mbuf_from_bpfdesc = 604 mpe->mpe_function; 605 break; 606 case MAC_CREATE_MBUF_FROM_IFNET: 607 mpc->mpc_ops->mpo_create_mbuf_from_ifnet = 608 mpe->mpe_function; 609 break; 610 case MAC_CREATE_MBUF_MULTICAST_ENCAP: 611 mpc->mpc_ops->mpo_create_mbuf_multicast_encap = 612 mpe->mpe_function; 613 break; 614 case MAC_CREATE_MBUF_NETLAYER: 615 mpc->mpc_ops->mpo_create_mbuf_netlayer = 616 mpe->mpe_function; 617 break; 618 case MAC_FRAGMENT_MATCH: 619 mpc->mpc_ops->mpo_fragment_match = 620 mpe->mpe_function; 621 break; 622 case MAC_RELABEL_IFNET: 623 mpc->mpc_ops->mpo_relabel_ifnet = 624 mpe->mpe_function; 625 break; 626 case MAC_UPDATE_IPQ: 627 mpc->mpc_ops->mpo_update_ipq = 628 mpe->mpe_function; 629 break; 630 case MAC_CREATE_CRED: 631 mpc->mpc_ops->mpo_create_cred = 632 mpe->mpe_function; 633 break; 634 case MAC_EXECVE_TRANSITION: 635 mpc->mpc_ops->mpo_execve_transition = 636 mpe->mpe_function; 637 break; 638 case MAC_EXECVE_WILL_TRANSITION: 639 mpc->mpc_ops->mpo_execve_will_transition = 640 mpe->mpe_function; 641 break; 642 case MAC_CREATE_PROC0: 643 mpc->mpc_ops->mpo_create_proc0 = mpe->mpe_function; 644 break; 645 case MAC_CREATE_PROC1: 646 mpc->mpc_ops->mpo_create_proc1 = mpe->mpe_function; 647 break; 648 case MAC_RELABEL_CRED: 649 mpc->mpc_ops->mpo_relabel_cred = 650 mpe->mpe_function; 651 break; 652 case MAC_CHECK_BPFDESC_RECEIVE: 653 mpc->mpc_ops->mpo_check_bpfdesc_receive = 654 mpe->mpe_function; 655 break; 656 case MAC_CHECK_CRED_RELABEL: 657 mpc->mpc_ops->mpo_check_cred_relabel = 658 mpe->mpe_function; 659 break; 660 case MAC_CHECK_CRED_VISIBLE: 661 mpc->mpc_ops->mpo_check_cred_visible = 662 mpe->mpe_function; 663 break; 664 case MAC_CHECK_IFNET_RELABEL: 665 mpc->mpc_ops->mpo_check_ifnet_relabel = 666 mpe->mpe_function; 667 break; 668 case MAC_CHECK_IFNET_TRANSMIT: 669 mpc->mpc_ops->mpo_check_ifnet_transmit = 670 mpe->mpe_function; 671 break; 672 case MAC_CHECK_MOUNT_STAT: 673 mpc->mpc_ops->mpo_check_mount_stat = 674 mpe->mpe_function; 675 break; 676 case MAC_CHECK_PIPE_IOCTL: 677 mpc->mpc_ops->mpo_check_pipe_ioctl = 678 mpe->mpe_function; 679 break; 680 case MAC_CHECK_PIPE_POLL: 681 mpc->mpc_ops->mpo_check_pipe_poll = 682 mpe->mpe_function; 683 break; 684 case MAC_CHECK_PIPE_READ: 685 mpc->mpc_ops->mpo_check_pipe_read = 686 mpe->mpe_function; 687 break; 688 case MAC_CHECK_PIPE_RELABEL: 689 mpc->mpc_ops->mpo_check_pipe_relabel = 690 mpe->mpe_function; 691 break; 692 case MAC_CHECK_PIPE_STAT: 693 mpc->mpc_ops->mpo_check_pipe_stat = 694 mpe->mpe_function; 695 break; 696 case MAC_CHECK_PIPE_WRITE: 697 mpc->mpc_ops->mpo_check_pipe_write = 698 mpe->mpe_function; 699 break; 700 case MAC_CHECK_PROC_DEBUG: 701 mpc->mpc_ops->mpo_check_proc_debug = 702 mpe->mpe_function; 703 break; 704 case MAC_CHECK_PROC_SCHED: 705 mpc->mpc_ops->mpo_check_proc_sched = 706 mpe->mpe_function; 707 break; 708 case MAC_CHECK_PROC_SIGNAL: 709 mpc->mpc_ops->mpo_check_proc_signal = 710 mpe->mpe_function; 711 break; 712 case MAC_CHECK_SOCKET_BIND: 713 mpc->mpc_ops->mpo_check_socket_bind = 714 mpe->mpe_function; 715 break; 716 case MAC_CHECK_SOCKET_CONNECT: 717 mpc->mpc_ops->mpo_check_socket_connect = 718 mpe->mpe_function; 719 break; 720 case MAC_CHECK_SOCKET_DELIVER: 721 mpc->mpc_ops->mpo_check_socket_deliver = 722 mpe->mpe_function; 723 break; 724 case MAC_CHECK_SOCKET_LISTEN: 725 mpc->mpc_ops->mpo_check_socket_listen = 726 mpe->mpe_function; 727 break; 728 case MAC_CHECK_SOCKET_RELABEL: 729 mpc->mpc_ops->mpo_check_socket_relabel = 730 mpe->mpe_function; 731 break; 732 case MAC_CHECK_SOCKET_VISIBLE: 733 mpc->mpc_ops->mpo_check_socket_visible = 734 mpe->mpe_function; 735 break; 736 case MAC_CHECK_VNODE_ACCESS: 737 mpc->mpc_ops->mpo_check_vnode_access = 738 mpe->mpe_function; 739 break; 740 case MAC_CHECK_VNODE_CHDIR: 741 mpc->mpc_ops->mpo_check_vnode_chdir = 742 mpe->mpe_function; 743 break; 744 case MAC_CHECK_VNODE_CHROOT: 745 mpc->mpc_ops->mpo_check_vnode_chroot = 746 mpe->mpe_function; 747 break; 748 case MAC_CHECK_VNODE_CREATE: 749 mpc->mpc_ops->mpo_check_vnode_create = 750 mpe->mpe_function; 751 break; 752 case MAC_CHECK_VNODE_DELETE: 753 mpc->mpc_ops->mpo_check_vnode_delete = 754 mpe->mpe_function; 755 break; 756 case MAC_CHECK_VNODE_DELETEACL: 757 mpc->mpc_ops->mpo_check_vnode_deleteacl = 758 mpe->mpe_function; 759 break; 760 case MAC_CHECK_VNODE_EXEC: 761 mpc->mpc_ops->mpo_check_vnode_exec = 762 mpe->mpe_function; 763 break; 764 case MAC_CHECK_VNODE_GETACL: 765 mpc->mpc_ops->mpo_check_vnode_getacl = 766 mpe->mpe_function; 767 break; 768 case MAC_CHECK_VNODE_GETEXTATTR: 769 mpc->mpc_ops->mpo_check_vnode_getextattr = 770 mpe->mpe_function; 771 break; 772 case MAC_CHECK_VNODE_LOOKUP: 773 mpc->mpc_ops->mpo_check_vnode_lookup = 774 mpe->mpe_function; 775 break; 776 case MAC_CHECK_VNODE_MMAP_PERMS: 777 mpc->mpc_ops->mpo_check_vnode_mmap_perms = 778 mpe->mpe_function; 779 break; 780 case MAC_CHECK_VNODE_OPEN: 781 mpc->mpc_ops->mpo_check_vnode_open = 782 mpe->mpe_function; 783 break; 784 case MAC_CHECK_VNODE_POLL: 785 mpc->mpc_ops->mpo_check_vnode_poll = 786 mpe->mpe_function; 787 break; 788 case MAC_CHECK_VNODE_READ: 789 mpc->mpc_ops->mpo_check_vnode_read = 790 mpe->mpe_function; 791 break; 792 case MAC_CHECK_VNODE_READDIR: 793 mpc->mpc_ops->mpo_check_vnode_readdir = 794 mpe->mpe_function; 795 break; 796 case MAC_CHECK_VNODE_READLINK: 797 mpc->mpc_ops->mpo_check_vnode_readlink = 798 mpe->mpe_function; 799 break; 800 case MAC_CHECK_VNODE_RELABEL: 801 mpc->mpc_ops->mpo_check_vnode_relabel = 802 mpe->mpe_function; 803 break; 804 case MAC_CHECK_VNODE_RENAME_FROM: 805 mpc->mpc_ops->mpo_check_vnode_rename_from = 806 mpe->mpe_function; 807 break; 808 case MAC_CHECK_VNODE_RENAME_TO: 809 mpc->mpc_ops->mpo_check_vnode_rename_to = 810 mpe->mpe_function; 811 break; 812 case MAC_CHECK_VNODE_REVOKE: 813 mpc->mpc_ops->mpo_check_vnode_revoke = 814 mpe->mpe_function; 815 break; 816 case MAC_CHECK_VNODE_SETACL: 817 mpc->mpc_ops->mpo_check_vnode_setacl = 818 mpe->mpe_function; 819 break; 820 case MAC_CHECK_VNODE_SETEXTATTR: 821 mpc->mpc_ops->mpo_check_vnode_setextattr = 822 mpe->mpe_function; 823 break; 824 case MAC_CHECK_VNODE_SETFLAGS: 825 mpc->mpc_ops->mpo_check_vnode_setflags = 826 mpe->mpe_function; 827 break; 828 case MAC_CHECK_VNODE_SETMODE: 829 mpc->mpc_ops->mpo_check_vnode_setmode = 830 mpe->mpe_function; 831 break; 832 case MAC_CHECK_VNODE_SETOWNER: 833 mpc->mpc_ops->mpo_check_vnode_setowner = 834 mpe->mpe_function; 835 break; 836 case MAC_CHECK_VNODE_SETUTIMES: 837 mpc->mpc_ops->mpo_check_vnode_setutimes = 838 mpe->mpe_function; 839 break; 840 case MAC_CHECK_VNODE_STAT: 841 mpc->mpc_ops->mpo_check_vnode_stat = 842 mpe->mpe_function; 843 break; 844 case MAC_CHECK_VNODE_WRITE: 845 mpc->mpc_ops->mpo_check_vnode_write = 846 mpe->mpe_function; 847 break; 848 /* 849 default: 850 printf("MAC policy `%s': unknown operation %d\n", 851 mpc->mpc_name, mpe->mpe_constant); 852 return (EINVAL); 853 */ 854 } 855 } 856 MAC_POLICY_LIST_LOCK(); 857 if (mac_policy_list_busy > 0) { 858 MAC_POLICY_LIST_UNLOCK(); 859 FREE(mpc->mpc_ops, M_MACOPVEC); 860 mpc->mpc_ops = NULL; 861 return (EBUSY); 862 } 863 LIST_FOREACH(tmpc, &mac_policy_list, mpc_list) { 864 if (strcmp(tmpc->mpc_name, mpc->mpc_name) == 0) { 865 MAC_POLICY_LIST_UNLOCK(); 866 FREE(mpc->mpc_ops, M_MACOPVEC); 867 mpc->mpc_ops = NULL; 868 return (EEXIST); 869 } 870 } 871 if (mpc->mpc_field_off != NULL) { 872 slot = ffs(mac_policy_offsets_free); 873 if (slot == 0) { 874 MAC_POLICY_LIST_UNLOCK(); 875 FREE(mpc->mpc_ops, M_MACOPVEC); 876 mpc->mpc_ops = NULL; 877 return (ENOMEM); 878 } 879 slot--; 880 mac_policy_offsets_free &= ~(1 << slot); 881 *mpc->mpc_field_off = slot; 882 } 883 mpc->mpc_runtime_flags |= MPC_RUNTIME_FLAG_REGISTERED; 884 LIST_INSERT_HEAD(&mac_policy_list, mpc, mpc_list); 885 886 /* Per-policy initialization. */ 887 if (mpc->mpc_ops->mpo_init != NULL) 888 (*(mpc->mpc_ops->mpo_init))(mpc); 889 MAC_POLICY_LIST_UNLOCK(); 890 891 printf("Security policy loaded: %s (%s)\n", mpc->mpc_fullname, 892 mpc->mpc_name); 893 894 return (0); 895 } 896 897 static int 898 mac_policy_unregister(struct mac_policy_conf *mpc) 899 { 900 901 #if 0 902 /* 903 * Don't allow unloading modules with private data. 904 */ 905 if (mpc->mpc_field_off != NULL) 906 return (EBUSY); 907 #endif 908 if ((mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_UNLOADOK) == 0) 909 return (EBUSY); 910 MAC_POLICY_LIST_LOCK(); 911 if (mac_policy_list_busy > 0) { 912 MAC_POLICY_LIST_UNLOCK(); 913 return (EBUSY); 914 } 915 if (mpc->mpc_ops->mpo_destroy != NULL) 916 (*(mpc->mpc_ops->mpo_destroy))(mpc); 917 918 LIST_REMOVE(mpc, mpc_list); 919 MAC_POLICY_LIST_UNLOCK(); 920 921 FREE(mpc->mpc_ops, M_MACOPVEC); 922 mpc->mpc_ops = NULL; 923 924 printf("Security policy unload: %s (%s)\n", mpc->mpc_fullname, 925 mpc->mpc_name); 926 927 return (0); 928 } 929 930 /* 931 * Define an error value precedence, and given two arguments, selects the 932 * value with the higher precedence. 933 */ 934 static int 935 error_select(int error1, int error2) 936 { 937 938 /* Certain decision-making errors take top priority. */ 939 if (error1 == EDEADLK || error2 == EDEADLK) 940 return (EDEADLK); 941 942 /* Invalid arguments should be reported where possible. */ 943 if (error1 == EINVAL || error2 == EINVAL) 944 return (EINVAL); 945 946 /* Precedence goes to "visibility", with both process and file. */ 947 if (error1 == ESRCH || error2 == ESRCH) 948 return (ESRCH); 949 950 if (error1 == ENOENT || error2 == ENOENT) 951 return (ENOENT); 952 953 /* Precedence goes to DAC/MAC protections. */ 954 if (error1 == EACCES || error2 == EACCES) 955 return (EACCES); 956 957 /* Precedence goes to privilege. */ 958 if (error1 == EPERM || error2 == EPERM) 959 return (EPERM); 960 961 /* Precedence goes to error over success; otherwise, arbitrary. */ 962 if (error1 != 0) 963 return (error1); 964 return (error2); 965 } 966 967 void 968 mac_update_devfsdirent(struct devfs_dirent *de, struct vnode *vp) 969 { 970 971 MAC_PERFORM(update_devfsdirent, de, &de->de_label, vp, &vp->v_label); 972 } 973 974 void 975 mac_update_procfsvnode(struct vnode *vp, struct ucred *cred) 976 { 977 978 MAC_PERFORM(update_procfsvnode, vp, &vp->v_label, cred); 979 } 980 981 /* 982 * Support callout for policies that manage their own externalization 983 * using extended attributes. 984 */ 985 static int 986 mac_update_vnode_from_extattr(struct vnode *vp, struct mount *mp) 987 { 988 int error; 989 990 MAC_CHECK(update_vnode_from_extattr, vp, &vp->v_label, mp, 991 &mp->mnt_fslabel); 992 993 return (error); 994 } 995 996 /* 997 * Given an externalized mac label, internalize it and stamp it on a 998 * vnode. 999 */ 1000 static int 1001 mac_update_vnode_from_externalized(struct vnode *vp, struct mac *extmac) 1002 { 1003 int error; 1004 1005 MAC_CHECK(update_vnode_from_externalized, vp, &vp->v_label, extmac); 1006 1007 return (error); 1008 } 1009 1010 /* 1011 * Call out to individual policies to update the label in a vnode from 1012 * the mountpoint. 1013 */ 1014 void 1015 mac_update_vnode_from_mount(struct vnode *vp, struct mount *mp) 1016 { 1017 1018 MAC_PERFORM(update_vnode_from_mount, vp, &vp->v_label, mp, 1019 &mp->mnt_fslabel); 1020 1021 ASSERT_VOP_LOCKED(vp, "mac_update_vnode_from_mount"); 1022 if (mac_cache_fslabel_in_vnode) 1023 vp->v_vflag |= VV_CACHEDLABEL; 1024 } 1025 1026 /* 1027 * Implementation of VOP_REFRESHLABEL() that relies on extended attributes 1028 * to store label data. Can be referenced by filesystems supporting 1029 * extended attributes. 1030 */ 1031 int 1032 vop_stdrefreshlabel_ea(struct vop_refreshlabel_args *ap) 1033 { 1034 struct vnode *vp = ap->a_vp; 1035 struct mac extmac; 1036 int buflen, error; 1037 1038 ASSERT_VOP_LOCKED(vp, "vop_stdrefreshlabel_ea"); 1039 1040 /* 1041 * Call out to external policies first. Order doesn't really 1042 * matter, as long as failure of one assures failure of all. 1043 */ 1044 error = mac_update_vnode_from_extattr(vp, vp->v_mount); 1045 if (error) 1046 return (error); 1047 1048 buflen = sizeof(extmac); 1049 error = vn_extattr_get(vp, IO_NODELOCKED, 1050 FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME, &buflen, 1051 (char *)&extmac, curthread); 1052 switch (error) { 1053 case 0: 1054 /* Got it */ 1055 break; 1056 1057 case ENOATTR: 1058 /* 1059 * Use the label from the mount point. 1060 */ 1061 mac_update_vnode_from_mount(vp, vp->v_mount); 1062 return (0); 1063 1064 case EOPNOTSUPP: 1065 default: 1066 /* Fail horribly. */ 1067 return (error); 1068 } 1069 1070 if (buflen != sizeof(extmac)) 1071 error = EPERM; /* Fail very closed. */ 1072 if (error == 0) 1073 error = mac_update_vnode_from_externalized(vp, &extmac); 1074 if (error == 0) 1075 vp->v_vflag |= VV_CACHEDLABEL; 1076 else { 1077 struct vattr va; 1078 1079 printf("Corrupted label on %s", 1080 vp->v_mount->mnt_stat.f_mntonname); 1081 if (VOP_GETATTR(vp, &va, curthread->td_ucred, curthread) == 0) 1082 printf(" inum %ld", va.va_fileid); 1083 if (mac_debug_label_fallback) { 1084 printf(", falling back.\n"); 1085 mac_update_vnode_from_mount(vp, vp->v_mount); 1086 error = 0; 1087 } else { 1088 printf(".\n"); 1089 error = EPERM; 1090 } 1091 } 1092 1093 return (error); 1094 } 1095 1096 /* 1097 * Make sure the vnode label is up-to-date. If EOPNOTSUPP, then we handle 1098 * the labeling activity outselves. Filesystems should be careful not 1099 * to change their minds regarding whether they support vop_refreshlabel() 1100 * for a vnode or not. Don't cache the vnode here, allow the file 1101 * system code to determine if it's safe to cache. If we update from 1102 * the mount, don't cache since a change to the mount label should affect 1103 * all vnodes. 1104 */ 1105 static int 1106 vn_refreshlabel(struct vnode *vp, struct ucred *cred) 1107 { 1108 int error; 1109 1110 ASSERT_VOP_LOCKED(vp, "vn_refreshlabel"); 1111 1112 if (vp->v_mount == NULL) { 1113 /* 1114 Eventually, we probably want to special-case refreshing 1115 of deadfs vnodes, and if there's a lock-free race somewhere, 1116 that case might be handled here. 1117 1118 mac_update_vnode_deadfs(vp); 1119 return (0); 1120 */ 1121 /* printf("vn_refreshlabel: null v_mount\n"); */ 1122 if (vp->v_type != VNON) 1123 printf( 1124 "vn_refreshlabel: null v_mount with non-VNON\n"); 1125 return (EBADF); 1126 } 1127 1128 if (vp->v_vflag & VV_CACHEDLABEL) { 1129 mac_vnode_label_cache_hits++; 1130 return (0); 1131 } else 1132 mac_vnode_label_cache_misses++; 1133 1134 if ((vp->v_mount->mnt_flag & MNT_MULTILABEL) == 0) { 1135 mac_update_vnode_from_mount(vp, vp->v_mount); 1136 return (0); 1137 } 1138 1139 error = VOP_REFRESHLABEL(vp, cred, curthread); 1140 switch (error) { 1141 case EOPNOTSUPP: 1142 /* 1143 * If labels are not supported on this vnode, fall back to 1144 * the label in the mount and propagate it to the vnode. 1145 * There should probably be some sort of policy/flag/decision 1146 * about doing this. 1147 */ 1148 mac_update_vnode_from_mount(vp, vp->v_mount); 1149 error = 0; 1150 default: 1151 return (error); 1152 } 1153 } 1154 1155 /* 1156 * Helper function for file systems using the vop_std*_ea() calls. This 1157 * function must be called after EA service is available for the vnode, 1158 * but before it's hooked up to the namespace so that the node persists 1159 * if there's a crash, or before it can be accessed. On successful 1160 * commit of the label to disk (etc), do cache the label. 1161 */ 1162 int 1163 vop_stdcreatevnode_ea(struct vnode *dvp, struct vnode *tvp, struct ucred *cred) 1164 { 1165 struct mac extmac; 1166 int error; 1167 1168 ASSERT_VOP_LOCKED(tvp, "vop_stdcreatevnode_ea"); 1169 if ((dvp->v_mount->mnt_flag & MNT_MULTILABEL) == 0) { 1170 mac_update_vnode_from_mount(tvp, tvp->v_mount); 1171 } else { 1172 error = vn_refreshlabel(dvp, cred); 1173 if (error) 1174 return (error); 1175 1176 /* 1177 * Stick the label in the vnode. Then try to write to 1178 * disk. If we fail, return a failure to abort the 1179 * create operation. Really, this failure shouldn't 1180 * happen except in fairly unusual circumstances (out 1181 * of disk, etc). 1182 */ 1183 mac_create_vnode(cred, dvp, tvp); 1184 1185 error = mac_stdcreatevnode_ea(tvp); 1186 if (error) 1187 return (error); 1188 1189 /* 1190 * XXX: Eventually this will go away and all policies will 1191 * directly manage their extended attributes. 1192 */ 1193 error = mac_externalize(&tvp->v_label, &extmac); 1194 if (error) 1195 return (error); 1196 1197 error = vn_extattr_set(tvp, IO_NODELOCKED, 1198 FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME, 1199 sizeof(extmac), (char *)&extmac, curthread); 1200 if (error == 0) 1201 tvp->v_vflag |= VV_CACHEDLABEL; 1202 else { 1203 #if 0 1204 /* 1205 * In theory, we could have fall-back behavior here. 1206 * It would probably be incorrect. 1207 */ 1208 #endif 1209 return (error); 1210 } 1211 } 1212 1213 return (0); 1214 } 1215 1216 void 1217 mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp) 1218 { 1219 int error; 1220 1221 ASSERT_VOP_LOCKED(vp, "mac_execve_transition"); 1222 1223 error = vn_refreshlabel(vp, old); 1224 if (error) { 1225 printf("mac_execve_transition: vn_refreshlabel returned %d\n", 1226 error); 1227 printf("mac_execve_transition: using old vnode label\n"); 1228 } 1229 1230 MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label); 1231 } 1232 1233 int 1234 mac_execve_will_transition(struct ucred *old, struct vnode *vp) 1235 { 1236 int error, result; 1237 1238 error = vn_refreshlabel(vp, old); 1239 if (error) 1240 return (error); 1241 1242 result = 0; 1243 MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label); 1244 1245 return (result); 1246 } 1247 1248 static void 1249 mac_init_label(struct label *label) 1250 { 1251 1252 bzero(label, sizeof(*label)); 1253 label->l_flags = MAC_FLAG_INITIALIZED; 1254 } 1255 1256 static void 1257 mac_init_structmac(struct mac *mac) 1258 { 1259 1260 bzero(mac, sizeof(*mac)); 1261 mac->m_macflags = MAC_FLAG_INITIALIZED; 1262 } 1263 1264 static void 1265 mac_destroy_label(struct label *label) 1266 { 1267 1268 KASSERT(label->l_flags & MAC_FLAG_INITIALIZED, 1269 ("destroying uninitialized label")); 1270 1271 bzero(label, sizeof(*label)); 1272 /* implicit: label->l_flags &= ~MAC_FLAG_INITIALIZED; */ 1273 } 1274 1275 int 1276 mac_init_mbuf(struct mbuf *m, int how) 1277 { 1278 KASSERT(m->m_flags & M_PKTHDR, ("mac_init_mbuf on non-header mbuf")); 1279 1280 /* "how" is one of M_(TRY|DONT)WAIT */ 1281 mac_init_label(&m->m_pkthdr.label); 1282 MAC_PERFORM(init_mbuf, m, how, &m->m_pkthdr.label); 1283 #ifdef MAC_DEBUG 1284 atomic_add_int(&nmacmbufs, 1); 1285 #endif 1286 return (0); 1287 } 1288 1289 void 1290 mac_destroy_mbuf(struct mbuf *m) 1291 { 1292 1293 MAC_PERFORM(destroy_mbuf, m, &m->m_pkthdr.label); 1294 mac_destroy_label(&m->m_pkthdr.label); 1295 #ifdef MAC_DEBUG 1296 atomic_subtract_int(&nmacmbufs, 1); 1297 #endif 1298 } 1299 1300 void 1301 mac_init_cred(struct ucred *cr) 1302 { 1303 1304 mac_init_label(&cr->cr_label); 1305 MAC_PERFORM(init_cred, cr, &cr->cr_label); 1306 #ifdef MAC_DEBUG 1307 atomic_add_int(&nmaccreds, 1); 1308 #endif 1309 } 1310 1311 void 1312 mac_destroy_cred(struct ucred *cr) 1313 { 1314 1315 MAC_PERFORM(destroy_cred, cr, &cr->cr_label); 1316 mac_destroy_label(&cr->cr_label); 1317 #ifdef MAC_DEBUG 1318 atomic_subtract_int(&nmaccreds, 1); 1319 #endif 1320 } 1321 1322 void 1323 mac_init_ifnet(struct ifnet *ifp) 1324 { 1325 1326 mac_init_label(&ifp->if_label); 1327 MAC_PERFORM(init_ifnet, ifp, &ifp->if_label); 1328 #ifdef MAC_DEBUG 1329 atomic_add_int(&nmacifnets, 1); 1330 #endif 1331 } 1332 1333 void 1334 mac_destroy_ifnet(struct ifnet *ifp) 1335 { 1336 1337 MAC_PERFORM(destroy_ifnet, ifp, &ifp->if_label); 1338 mac_destroy_label(&ifp->if_label); 1339 #ifdef MAC_DEBUG 1340 atomic_subtract_int(&nmacifnets, 1); 1341 #endif 1342 } 1343 1344 void 1345 mac_init_ipq(struct ipq *ipq) 1346 { 1347 1348 mac_init_label(&ipq->ipq_label); 1349 MAC_PERFORM(init_ipq, ipq, &ipq->ipq_label); 1350 #ifdef MAC_DEBUG 1351 atomic_add_int(&nmacipqs, 1); 1352 #endif 1353 } 1354 1355 void 1356 mac_destroy_ipq(struct ipq *ipq) 1357 { 1358 1359 MAC_PERFORM(destroy_ipq, ipq, &ipq->ipq_label); 1360 mac_destroy_label(&ipq->ipq_label); 1361 #ifdef MAC_DEBUG 1362 atomic_subtract_int(&nmacipqs, 1); 1363 #endif 1364 } 1365 1366 void 1367 mac_init_socket(struct socket *socket) 1368 { 1369 1370 mac_init_label(&socket->so_label); 1371 mac_init_label(&socket->so_peerlabel); 1372 MAC_PERFORM(init_socket, socket, &socket->so_label, 1373 &socket->so_peerlabel); 1374 #ifdef MAC_DEBUG 1375 atomic_add_int(&nmacsockets, 1); 1376 #endif 1377 } 1378 1379 void 1380 mac_destroy_socket(struct socket *socket) 1381 { 1382 1383 MAC_PERFORM(destroy_socket, socket, &socket->so_label, 1384 &socket->so_peerlabel); 1385 mac_destroy_label(&socket->so_label); 1386 mac_destroy_label(&socket->so_peerlabel); 1387 #ifdef MAC_DEBUG 1388 atomic_subtract_int(&nmacsockets, 1); 1389 #endif 1390 } 1391 1392 void 1393 mac_init_pipe(struct pipe *pipe) 1394 { 1395 struct label *label; 1396 1397 label = malloc(sizeof(struct label), M_MACPIPELABEL, M_ZERO|M_WAITOK); 1398 mac_init_label(label); 1399 pipe->pipe_label = label; 1400 pipe->pipe_peer->pipe_label = label; 1401 MAC_PERFORM(init_pipe, pipe, pipe->pipe_label); 1402 #ifdef MAC_DEBUG 1403 atomic_add_int(&nmacpipes, 1); 1404 #endif 1405 } 1406 1407 void 1408 mac_destroy_pipe(struct pipe *pipe) 1409 { 1410 1411 MAC_PERFORM(destroy_pipe, pipe, pipe->pipe_label); 1412 mac_destroy_label(pipe->pipe_label); 1413 free(pipe->pipe_label, M_MACPIPELABEL); 1414 #ifdef MAC_DEBUG 1415 atomic_subtract_int(&nmacpipes, 1); 1416 #endif 1417 } 1418 1419 void 1420 mac_init_bpfdesc(struct bpf_d *bpf_d) 1421 { 1422 1423 mac_init_label(&bpf_d->bd_label); 1424 MAC_PERFORM(init_bpfdesc, bpf_d, &bpf_d->bd_label); 1425 #ifdef MAC_DEBUG 1426 atomic_add_int(&nmacbpfdescs, 1); 1427 #endif 1428 } 1429 1430 void 1431 mac_destroy_bpfdesc(struct bpf_d *bpf_d) 1432 { 1433 1434 MAC_PERFORM(destroy_bpfdesc, bpf_d, &bpf_d->bd_label); 1435 mac_destroy_label(&bpf_d->bd_label); 1436 #ifdef MAC_DEBUG 1437 atomic_subtract_int(&nmacbpfdescs, 1); 1438 #endif 1439 } 1440 1441 void 1442 mac_init_mount(struct mount *mp) 1443 { 1444 1445 mac_init_label(&mp->mnt_mntlabel); 1446 mac_init_label(&mp->mnt_fslabel); 1447 MAC_PERFORM(init_mount, mp, &mp->mnt_mntlabel, &mp->mnt_fslabel); 1448 #ifdef MAC_DEBUG 1449 atomic_add_int(&nmacmounts, 1); 1450 #endif 1451 } 1452 1453 void 1454 mac_destroy_mount(struct mount *mp) 1455 { 1456 1457 MAC_PERFORM(destroy_mount, mp, &mp->mnt_mntlabel, &mp->mnt_fslabel); 1458 mac_destroy_label(&mp->mnt_fslabel); 1459 mac_destroy_label(&mp->mnt_mntlabel); 1460 #ifdef MAC_DEBUG 1461 atomic_subtract_int(&nmacmounts, 1); 1462 #endif 1463 } 1464 1465 static void 1466 mac_init_temp(struct label *label) 1467 { 1468 1469 mac_init_label(label); 1470 MAC_PERFORM(init_temp, label); 1471 #ifdef MAC_DEBUG 1472 atomic_add_int(&nmactemp, 1); 1473 #endif 1474 } 1475 1476 static void 1477 mac_destroy_temp(struct label *label) 1478 { 1479 1480 MAC_PERFORM(destroy_temp, label); 1481 mac_destroy_label(label); 1482 #ifdef MAC_DEBUG 1483 atomic_subtract_int(&nmactemp, 1); 1484 #endif 1485 } 1486 1487 void 1488 mac_init_vnode(struct vnode *vp) 1489 { 1490 1491 mac_init_label(&vp->v_label); 1492 MAC_PERFORM(init_vnode, vp, &vp->v_label); 1493 #ifdef MAC_DEBUG 1494 atomic_add_int(&nmacvnodes, 1); 1495 #endif 1496 } 1497 1498 void 1499 mac_destroy_vnode(struct vnode *vp) 1500 { 1501 1502 MAC_PERFORM(destroy_vnode, vp, &vp->v_label); 1503 mac_destroy_label(&vp->v_label); 1504 #ifdef MAC_DEBUG 1505 atomic_subtract_int(&nmacvnodes, 1); 1506 #endif 1507 } 1508 1509 void 1510 mac_init_devfsdirent(struct devfs_dirent *de) 1511 { 1512 1513 mac_init_label(&de->de_label); 1514 MAC_PERFORM(init_devfsdirent, de, &de->de_label); 1515 #ifdef MAC_DEBUG 1516 atomic_add_int(&nmacdevfsdirents, 1); 1517 #endif 1518 } 1519 1520 void 1521 mac_destroy_devfsdirent(struct devfs_dirent *de) 1522 { 1523 1524 MAC_PERFORM(destroy_devfsdirent, de, &de->de_label); 1525 mac_destroy_label(&de->de_label); 1526 #ifdef MAC_DEBUG 1527 atomic_subtract_int(&nmacdevfsdirents, 1); 1528 #endif 1529 } 1530 1531 static int 1532 mac_externalize(struct label *label, struct mac *mac) 1533 { 1534 int error; 1535 1536 mac_init_structmac(mac); 1537 MAC_CHECK(externalize, label, mac); 1538 1539 return (error); 1540 } 1541 1542 static int 1543 mac_internalize(struct label *label, struct mac *mac) 1544 { 1545 int error; 1546 1547 mac_init_temp(label); 1548 MAC_CHECK(internalize, label, mac); 1549 if (error) 1550 mac_destroy_temp(label); 1551 1552 return (error); 1553 } 1554 1555 /* 1556 * Initialize MAC label for the first kernel process, from which other 1557 * kernel processes and threads are spawned. 1558 */ 1559 void 1560 mac_create_proc0(struct ucred *cred) 1561 { 1562 1563 MAC_PERFORM(create_proc0, cred); 1564 } 1565 1566 /* 1567 * Initialize MAC label for the first userland process, from which other 1568 * userland processes and threads are spawned. 1569 */ 1570 void 1571 mac_create_proc1(struct ucred *cred) 1572 { 1573 1574 MAC_PERFORM(create_proc1, cred); 1575 } 1576 1577 /* 1578 * When a new process is created, its label must be initialized. Generally, 1579 * this involves inheritence from the parent process, modulo possible 1580 * deltas. This function allows that processing to take place. 1581 */ 1582 void 1583 mac_create_cred(struct ucred *parent_cred, struct ucred *child_cred) 1584 { 1585 1586 MAC_PERFORM(create_cred, parent_cred, child_cred); 1587 } 1588 1589 int 1590 mac_check_vnode_access(struct ucred *cred, struct vnode *vp, int flags) 1591 { 1592 int error; 1593 1594 ASSERT_VOP_LOCKED(vp, "mac_check_vnode_access"); 1595 1596 if (!mac_enforce_fs) 1597 return (0); 1598 1599 error = vn_refreshlabel(vp, cred); 1600 if (error) 1601 return (error); 1602 1603 MAC_CHECK(check_vnode_access, cred, vp, &vp->v_label, flags); 1604 return (error); 1605 } 1606 1607 int 1608 mac_check_vnode_chdir(struct ucred *cred, struct vnode *dvp) 1609 { 1610 int error; 1611 1612 ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_chdir"); 1613 1614 if (!mac_enforce_fs) 1615 return (0); 1616 1617 error = vn_refreshlabel(dvp, cred); 1618 if (error) 1619 return (error); 1620 1621 MAC_CHECK(check_vnode_chdir, cred, dvp, &dvp->v_label); 1622 return (error); 1623 } 1624 1625 int 1626 mac_check_vnode_chroot(struct ucred *cred, struct vnode *dvp) 1627 { 1628 int error; 1629 1630 ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_chroot"); 1631 1632 if (!mac_enforce_fs) 1633 return (0); 1634 1635 error = vn_refreshlabel(dvp, cred); 1636 if (error) 1637 return (error); 1638 1639 MAC_CHECK(check_vnode_chroot, cred, dvp, &dvp->v_label); 1640 return (error); 1641 } 1642 1643 int 1644 mac_check_vnode_create(struct ucred *cred, struct vnode *dvp, 1645 struct componentname *cnp, struct vattr *vap) 1646 { 1647 int error; 1648 1649 ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_create"); 1650 1651 if (!mac_enforce_fs) 1652 return (0); 1653 1654 error = vn_refreshlabel(dvp, cred); 1655 if (error) 1656 return (error); 1657 1658 MAC_CHECK(check_vnode_create, cred, dvp, &dvp->v_label, cnp, vap); 1659 return (error); 1660 } 1661 1662 int 1663 mac_check_vnode_delete(struct ucred *cred, struct vnode *dvp, struct vnode *vp, 1664 struct componentname *cnp) 1665 { 1666 int error; 1667 1668 ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_delete"); 1669 ASSERT_VOP_LOCKED(vp, "mac_check_vnode_delete"); 1670 1671 if (!mac_enforce_fs) 1672 return (0); 1673 1674 error = vn_refreshlabel(dvp, cred); 1675 if (error) 1676 return (error); 1677 error = vn_refreshlabel(vp, cred); 1678 if (error) 1679 return (error); 1680 1681 MAC_CHECK(check_vnode_delete, cred, dvp, &dvp->v_label, vp, 1682 &vp->v_label, cnp); 1683 return (error); 1684 } 1685 1686 int 1687 mac_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp, 1688 acl_type_t type) 1689 { 1690 int error; 1691 1692 ASSERT_VOP_LOCKED(vp, "mac_check_vnode_deleteacl"); 1693 1694 if (!mac_enforce_fs) 1695 return (0); 1696 1697 error = vn_refreshlabel(vp, cred); 1698 if (error) 1699 return (error); 1700 1701 MAC_CHECK(check_vnode_deleteacl, cred, vp, &vp->v_label, type); 1702 return (error); 1703 } 1704 1705 int 1706 mac_check_vnode_exec(struct ucred *cred, struct vnode *vp) 1707 { 1708 int error; 1709 1710 ASSERT_VOP_LOCKED(vp, "mac_check_vnode_exec"); 1711 1712 if (!mac_enforce_process && !mac_enforce_fs) 1713 return (0); 1714 1715 error = vn_refreshlabel(vp, cred); 1716 if (error) 1717 return (error); 1718 MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label); 1719 1720 return (error); 1721 } 1722 1723 int 1724 mac_check_vnode_getacl(struct ucred *cred, struct vnode *vp, acl_type_t type) 1725 { 1726 int error; 1727 1728 ASSERT_VOP_LOCKED(vp, "mac_check_vnode_getacl"); 1729 1730 if (!mac_enforce_fs) 1731 return (0); 1732 1733 error = vn_refreshlabel(vp, cred); 1734 if (error) 1735 return (error); 1736 1737 MAC_CHECK(check_vnode_getacl, cred, vp, &vp->v_label, type); 1738 return (error); 1739 } 1740 1741 int 1742 mac_check_vnode_getextattr(struct ucred *cred, struct vnode *vp, 1743 int attrnamespace, const char *name, struct uio *uio) 1744 { 1745 int error; 1746 1747 ASSERT_VOP_LOCKED(vp, "mac_check_vnode_getextattr"); 1748 1749 if (!mac_enforce_fs) 1750 return (0); 1751 1752 error = vn_refreshlabel(vp, cred); 1753 if (error) 1754 return (error); 1755 1756 MAC_CHECK(check_vnode_getextattr, cred, vp, &vp->v_label, 1757 attrnamespace, name, uio); 1758 return (error); 1759 } 1760 1761 int 1762 mac_check_vnode_lookup(struct ucred *cred, struct vnode *dvp, 1763 struct componentname *cnp) 1764 { 1765 int error; 1766 1767 ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_lookup"); 1768 1769 if (!mac_enforce_fs) 1770 return (0); 1771 1772 error = vn_refreshlabel(dvp, cred); 1773 if (error) 1774 return (error); 1775 1776 MAC_CHECK(check_vnode_lookup, cred, dvp, &dvp->v_label, cnp); 1777 return (error); 1778 } 1779 1780 vm_prot_t 1781 mac_check_vnode_mmap_prot(struct ucred *cred, struct vnode *vp, int newmapping) 1782 { 1783 vm_prot_t result = VM_PROT_ALL; 1784 1785 if (!mac_enforce_vm) 1786 return (result); 1787 1788 /* 1789 * This should be some sort of MAC_BITWISE, maybe :) 1790 */ 1791 ASSERT_VOP_LOCKED(vp, "mac_check_vnode_mmap_perms"); 1792 MAC_BOOLEAN(check_vnode_mmap_perms, &, cred, vp, &vp->v_label, 1793 newmapping); 1794 return (result); 1795 } 1796 1797 int 1798 mac_check_vnode_open(struct ucred *cred, struct vnode *vp, mode_t acc_mode) 1799 { 1800 int error; 1801 1802 ASSERT_VOP_LOCKED(vp, "mac_check_vnode_open"); 1803 1804 if (!mac_enforce_fs) 1805 return (0); 1806 1807 error = vn_refreshlabel(vp, cred); 1808 if (error) 1809 return (error); 1810 1811 MAC_CHECK(check_vnode_open, cred, vp, &vp->v_label, acc_mode); 1812 return (error); 1813 } 1814 1815 int 1816 mac_check_vnode_poll(struct ucred *active_cred, struct ucred *file_cred, 1817 struct vnode *vp) 1818 { 1819 int error; 1820 1821 ASSERT_VOP_LOCKED(vp, "mac_check_vnode_poll"); 1822 1823 if (!mac_enforce_fs) 1824 return (0); 1825 1826 error = vn_refreshlabel(vp, active_cred); 1827 if (error) 1828 return (error); 1829 1830 MAC_CHECK(check_vnode_poll, active_cred, file_cred, vp, 1831 &vp->v_label); 1832 1833 return (error); 1834 } 1835 1836 int 1837 mac_check_vnode_read(struct ucred *active_cred, struct ucred *file_cred, 1838 struct vnode *vp) 1839 { 1840 int error; 1841 1842 ASSERT_VOP_LOCKED(vp, "mac_check_vnode_read"); 1843 1844 if (!mac_enforce_fs) 1845 return (0); 1846 1847 error = vn_refreshlabel(vp, active_cred); 1848 if (error) 1849 return (error); 1850 1851 MAC_CHECK(check_vnode_read, active_cred, file_cred, vp, 1852 &vp->v_label); 1853 1854 return (error); 1855 } 1856 1857 int 1858 mac_check_vnode_readdir(struct ucred *cred, struct vnode *dvp) 1859 { 1860 int error; 1861 1862 ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_readdir"); 1863 1864 if (!mac_enforce_fs) 1865 return (0); 1866 1867 error = vn_refreshlabel(dvp, cred); 1868 if (error) 1869 return (error); 1870 1871 MAC_CHECK(check_vnode_readdir, cred, dvp, &dvp->v_label); 1872 return (error); 1873 } 1874 1875 int 1876 mac_check_vnode_readlink(struct ucred *cred, struct vnode *vp) 1877 { 1878 int error; 1879 1880 ASSERT_VOP_LOCKED(vp, "mac_check_vnode_readlink"); 1881 1882 if (!mac_enforce_fs) 1883 return (0); 1884 1885 error = vn_refreshlabel(vp, cred); 1886 if (error) 1887 return (error); 1888 1889 MAC_CHECK(check_vnode_readlink, cred, vp, &vp->v_label); 1890 return (error); 1891 } 1892 1893 static int 1894 mac_check_vnode_relabel(struct ucred *cred, struct vnode *vp, 1895 struct label *newlabel) 1896 { 1897 int error; 1898 1899 ASSERT_VOP_LOCKED(vp, "mac_check_vnode_relabel"); 1900 1901 error = vn_refreshlabel(vp, cred); 1902 if (error) 1903 return (error); 1904 1905 MAC_CHECK(check_vnode_relabel, cred, vp, &vp->v_label, newlabel); 1906 1907 return (error); 1908 } 1909 1910 int 1911 mac_check_vnode_rename_from(struct ucred *cred, struct vnode *dvp, 1912 struct vnode *vp, struct componentname *cnp) 1913 { 1914 int error; 1915 1916 ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_rename_from"); 1917 ASSERT_VOP_LOCKED(vp, "mac_check_vnode_rename_from"); 1918 1919 if (!mac_enforce_fs) 1920 return (0); 1921 1922 error = vn_refreshlabel(dvp, cred); 1923 if (error) 1924 return (error); 1925 error = vn_refreshlabel(vp, cred); 1926 if (error) 1927 return (error); 1928 1929 MAC_CHECK(check_vnode_rename_from, cred, dvp, &dvp->v_label, vp, 1930 &vp->v_label, cnp); 1931 return (error); 1932 } 1933 1934 int 1935 mac_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp, 1936 struct vnode *vp, int samedir, struct componentname *cnp) 1937 { 1938 int error; 1939 1940 ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_rename_to"); 1941 ASSERT_VOP_LOCKED(vp, "mac_check_vnode_rename_to"); 1942 1943 if (!mac_enforce_fs) 1944 return (0); 1945 1946 error = vn_refreshlabel(dvp, cred); 1947 if (error) 1948 return (error); 1949 if (vp != NULL) { 1950 error = vn_refreshlabel(vp, cred); 1951 if (error) 1952 return (error); 1953 } 1954 MAC_CHECK(check_vnode_rename_to, cred, dvp, &dvp->v_label, vp, 1955 vp != NULL ? &vp->v_label : NULL, samedir, cnp); 1956 return (error); 1957 } 1958 1959 int 1960 mac_check_vnode_revoke(struct ucred *cred, struct vnode *vp) 1961 { 1962 int error; 1963 1964 ASSERT_VOP_LOCKED(vp, "mac_check_vnode_revoke"); 1965 1966 if (!mac_enforce_fs) 1967 return (0); 1968 1969 error = vn_refreshlabel(vp, cred); 1970 if (error) 1971 return (error); 1972 1973 MAC_CHECK(check_vnode_revoke, cred, vp, &vp->v_label); 1974 return (error); 1975 } 1976 1977 int 1978 mac_check_vnode_setacl(struct ucred *cred, struct vnode *vp, acl_type_t type, 1979 struct acl *acl) 1980 { 1981 int error; 1982 1983 ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setacl"); 1984 1985 if (!mac_enforce_fs) 1986 return (0); 1987 1988 error = vn_refreshlabel(vp, cred); 1989 if (error) 1990 return (error); 1991 1992 MAC_CHECK(check_vnode_setacl, cred, vp, &vp->v_label, type, acl); 1993 return (error); 1994 } 1995 1996 int 1997 mac_check_vnode_setextattr(struct ucred *cred, struct vnode *vp, 1998 int attrnamespace, const char *name, struct uio *uio) 1999 { 2000 int error; 2001 2002 ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setextattr"); 2003 2004 if (!mac_enforce_fs) 2005 return (0); 2006 2007 error = vn_refreshlabel(vp, cred); 2008 if (error) 2009 return (error); 2010 2011 MAC_CHECK(check_vnode_setextattr, cred, vp, &vp->v_label, 2012 attrnamespace, name, uio); 2013 return (error); 2014 } 2015 2016 int 2017 mac_check_vnode_setflags(struct ucred *cred, struct vnode *vp, u_long flags) 2018 { 2019 int error; 2020 2021 ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setflags"); 2022 2023 if (!mac_enforce_fs) 2024 return (0); 2025 2026 error = vn_refreshlabel(vp, cred); 2027 if (error) 2028 return (error); 2029 2030 MAC_CHECK(check_vnode_setflags, cred, vp, &vp->v_label, flags); 2031 return (error); 2032 } 2033 2034 int 2035 mac_check_vnode_setmode(struct ucred *cred, struct vnode *vp, mode_t mode) 2036 { 2037 int error; 2038 2039 ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setmode"); 2040 2041 if (!mac_enforce_fs) 2042 return (0); 2043 2044 error = vn_refreshlabel(vp, cred); 2045 if (error) 2046 return (error); 2047 2048 MAC_CHECK(check_vnode_setmode, cred, vp, &vp->v_label, mode); 2049 return (error); 2050 } 2051 2052 int 2053 mac_check_vnode_setowner(struct ucred *cred, struct vnode *vp, uid_t uid, 2054 gid_t gid) 2055 { 2056 int error; 2057 2058 ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setowner"); 2059 2060 if (!mac_enforce_fs) 2061 return (0); 2062 2063 error = vn_refreshlabel(vp, cred); 2064 if (error) 2065 return (error); 2066 2067 MAC_CHECK(check_vnode_setowner, cred, vp, &vp->v_label, uid, gid); 2068 return (error); 2069 } 2070 2071 int 2072 mac_check_vnode_setutimes(struct ucred *cred, struct vnode *vp, 2073 struct timespec atime, struct timespec mtime) 2074 { 2075 int error; 2076 2077 ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setutimes"); 2078 2079 if (!mac_enforce_fs) 2080 return (0); 2081 2082 error = vn_refreshlabel(vp, cred); 2083 if (error) 2084 return (error); 2085 2086 MAC_CHECK(check_vnode_setutimes, cred, vp, &vp->v_label, atime, 2087 mtime); 2088 return (error); 2089 } 2090 2091 int 2092 mac_check_vnode_stat(struct ucred *active_cred, struct ucred *file_cred, 2093 struct vnode *vp) 2094 { 2095 int error; 2096 2097 ASSERT_VOP_LOCKED(vp, "mac_check_vnode_stat"); 2098 2099 if (!mac_enforce_fs) 2100 return (0); 2101 2102 error = vn_refreshlabel(vp, active_cred); 2103 if (error) 2104 return (error); 2105 2106 MAC_CHECK(check_vnode_stat, active_cred, file_cred, vp, 2107 &vp->v_label); 2108 return (error); 2109 } 2110 2111 int 2112 mac_check_vnode_write(struct ucred *active_cred, struct ucred *file_cred, 2113 struct vnode *vp) 2114 { 2115 int error; 2116 2117 ASSERT_VOP_LOCKED(vp, "mac_check_vnode_write"); 2118 2119 if (!mac_enforce_fs) 2120 return (0); 2121 2122 error = vn_refreshlabel(vp, active_cred); 2123 if (error) 2124 return (error); 2125 2126 MAC_CHECK(check_vnode_write, active_cred, file_cred, vp, 2127 &vp->v_label); 2128 2129 return (error); 2130 } 2131 2132 /* 2133 * When relabeling a process, call out to the policies for the maximum 2134 * permission allowed for each object type we know about in its 2135 * memory space, and revoke access (in the least surprising ways we 2136 * know) when necessary. The process lock is not held here. 2137 */ 2138 static void 2139 mac_cred_mmapped_drop_perms(struct thread *td, struct ucred *cred) 2140 { 2141 2142 /* XXX freeze all other threads */ 2143 mac_cred_mmapped_drop_perms_recurse(td, cred, 2144 &td->td_proc->p_vmspace->vm_map); 2145 /* XXX allow other threads to continue */ 2146 } 2147 2148 static __inline const char * 2149 prot2str(vm_prot_t prot) 2150 { 2151 2152 switch (prot & VM_PROT_ALL) { 2153 case VM_PROT_READ: 2154 return ("r--"); 2155 case VM_PROT_READ | VM_PROT_WRITE: 2156 return ("rw-"); 2157 case VM_PROT_READ | VM_PROT_EXECUTE: 2158 return ("r-x"); 2159 case VM_PROT_READ | VM_PROT_WRITE | VM_PROT_EXECUTE: 2160 return ("rwx"); 2161 case VM_PROT_WRITE: 2162 return ("-w-"); 2163 case VM_PROT_EXECUTE: 2164 return ("--x"); 2165 case VM_PROT_WRITE | VM_PROT_EXECUTE: 2166 return ("-wx"); 2167 default: 2168 return ("---"); 2169 } 2170 } 2171 2172 static void 2173 mac_cred_mmapped_drop_perms_recurse(struct thread *td, struct ucred *cred, 2174 struct vm_map *map) 2175 { 2176 struct vm_map_entry *vme; 2177 vm_prot_t result, revokeperms; 2178 vm_object_t object; 2179 vm_ooffset_t offset; 2180 struct vnode *vp; 2181 2182 if (!mac_mmap_revocation) 2183 return; 2184 2185 vm_map_lock_read(map); 2186 for (vme = map->header.next; vme != &map->header; vme = vme->next) { 2187 if (vme->eflags & MAP_ENTRY_IS_SUB_MAP) { 2188 mac_cred_mmapped_drop_perms_recurse(td, cred, 2189 vme->object.sub_map); 2190 continue; 2191 } 2192 /* 2193 * Skip over entries that obviously are not shared. 2194 */ 2195 if (vme->eflags & (MAP_ENTRY_COW | MAP_ENTRY_NOSYNC) || 2196 !vme->max_protection) 2197 continue; 2198 /* 2199 * Drill down to the deepest backing object. 2200 */ 2201 offset = vme->offset; 2202 object = vme->object.vm_object; 2203 if (object == NULL) 2204 continue; 2205 while (object->backing_object != NULL) { 2206 object = object->backing_object; 2207 offset += object->backing_object_offset; 2208 } 2209 /* 2210 * At the moment, vm_maps and objects aren't considered 2211 * by the MAC system, so only things with backing by a 2212 * normal object (read: vnodes) are checked. 2213 */ 2214 if (object->type != OBJT_VNODE) 2215 continue; 2216 vp = (struct vnode *)object->handle; 2217 vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); 2218 result = mac_check_vnode_mmap_prot(cred, vp, 0); 2219 VOP_UNLOCK(vp, 0, td); 2220 /* 2221 * Find out what maximum protection we may be allowing 2222 * now but a policy needs to get removed. 2223 */ 2224 revokeperms = vme->max_protection & ~result; 2225 if (!revokeperms) 2226 continue; 2227 printf("pid %ld: revoking %s perms from %#lx:%ld " 2228 "(max %s/cur %s)\n", (long)td->td_proc->p_pid, 2229 prot2str(revokeperms), (u_long)vme->start, 2230 (long)(vme->end - vme->start), 2231 prot2str(vme->max_protection), prot2str(vme->protection)); 2232 vm_map_lock_upgrade(map); 2233 /* 2234 * This is the really simple case: if a map has more 2235 * max_protection than is allowed, but it's not being 2236 * actually used (that is, the current protection is 2237 * still allowed), we can just wipe it out and do 2238 * nothing more. 2239 */ 2240 if ((vme->protection & revokeperms) == 0) { 2241 vme->max_protection -= revokeperms; 2242 } else { 2243 if (revokeperms & VM_PROT_WRITE) { 2244 /* 2245 * In the more complicated case, flush out all 2246 * pending changes to the object then turn it 2247 * copy-on-write. 2248 */ 2249 vm_object_reference(object); 2250 vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); 2251 vm_object_page_clean(object, 2252 OFF_TO_IDX(offset), 2253 OFF_TO_IDX(offset + vme->end - vme->start + 2254 PAGE_MASK), 2255 OBJPC_SYNC); 2256 VOP_UNLOCK(vp, 0, td); 2257 vm_object_deallocate(object); 2258 /* 2259 * Why bother if there's no read permissions 2260 * anymore? For the rest, we need to leave 2261 * the write permissions on for COW, or 2262 * remove them entirely if configured to. 2263 */ 2264 if (!mac_mmap_revocation_via_cow) { 2265 vme->max_protection &= ~VM_PROT_WRITE; 2266 vme->protection &= ~VM_PROT_WRITE; 2267 } if ((revokeperms & VM_PROT_READ) == 0) 2268 vme->eflags |= MAP_ENTRY_COW | 2269 MAP_ENTRY_NEEDS_COPY; 2270 } 2271 if (revokeperms & VM_PROT_EXECUTE) { 2272 vme->max_protection &= ~VM_PROT_EXECUTE; 2273 vme->protection &= ~VM_PROT_EXECUTE; 2274 } 2275 if (revokeperms & VM_PROT_READ) { 2276 vme->max_protection = 0; 2277 vme->protection = 0; 2278 } 2279 pmap_protect(map->pmap, vme->start, vme->end, 2280 vme->protection & ~revokeperms); 2281 vm_map_simplify_entry(map, vme); 2282 } 2283 vm_map_lock_downgrade(map); 2284 } 2285 vm_map_unlock_read(map); 2286 } 2287 2288 /* 2289 * When the subject's label changes, it may require revocation of privilege 2290 * to mapped objects. This can't be done on-the-fly later with a unified 2291 * buffer cache. 2292 */ 2293 static void 2294 mac_relabel_cred(struct ucred *cred, struct label *newlabel) 2295 { 2296 2297 MAC_PERFORM(relabel_cred, cred, newlabel); 2298 } 2299 2300 void 2301 mac_relabel_vnode(struct ucred *cred, struct vnode *vp, struct label *newlabel) 2302 { 2303 2304 MAC_PERFORM(relabel_vnode, cred, vp, &vp->v_label, newlabel); 2305 } 2306 2307 void 2308 mac_create_ifnet(struct ifnet *ifnet) 2309 { 2310 2311 MAC_PERFORM(create_ifnet, ifnet, &ifnet->if_label); 2312 } 2313 2314 void 2315 mac_create_bpfdesc(struct ucred *cred, struct bpf_d *bpf_d) 2316 { 2317 2318 MAC_PERFORM(create_bpfdesc, cred, bpf_d, &bpf_d->bd_label); 2319 } 2320 2321 void 2322 mac_create_socket(struct ucred *cred, struct socket *socket) 2323 { 2324 2325 MAC_PERFORM(create_socket, cred, socket, &socket->so_label); 2326 } 2327 2328 void 2329 mac_create_pipe(struct ucred *cred, struct pipe *pipe) 2330 { 2331 2332 MAC_PERFORM(create_pipe, cred, pipe, pipe->pipe_label); 2333 } 2334 2335 void 2336 mac_create_socket_from_socket(struct socket *oldsocket, 2337 struct socket *newsocket) 2338 { 2339 2340 MAC_PERFORM(create_socket_from_socket, oldsocket, &oldsocket->so_label, 2341 newsocket, &newsocket->so_label); 2342 } 2343 2344 static void 2345 mac_relabel_socket(struct ucred *cred, struct socket *socket, 2346 struct label *newlabel) 2347 { 2348 2349 MAC_PERFORM(relabel_socket, cred, socket, &socket->so_label, newlabel); 2350 } 2351 2352 static void 2353 mac_relabel_pipe(struct ucred *cred, struct pipe *pipe, struct label *newlabel) 2354 { 2355 2356 MAC_PERFORM(relabel_pipe, cred, pipe, pipe->pipe_label, newlabel); 2357 } 2358 2359 void 2360 mac_set_socket_peer_from_mbuf(struct mbuf *mbuf, struct socket *socket) 2361 { 2362 2363 MAC_PERFORM(set_socket_peer_from_mbuf, mbuf, &mbuf->m_pkthdr.label, 2364 socket, &socket->so_peerlabel); 2365 } 2366 2367 void 2368 mac_set_socket_peer_from_socket(struct socket *oldsocket, 2369 struct socket *newsocket) 2370 { 2371 2372 MAC_PERFORM(set_socket_peer_from_socket, oldsocket, 2373 &oldsocket->so_label, newsocket, &newsocket->so_peerlabel); 2374 } 2375 2376 void 2377 mac_create_datagram_from_ipq(struct ipq *ipq, struct mbuf *datagram) 2378 { 2379 2380 MAC_PERFORM(create_datagram_from_ipq, ipq, &ipq->ipq_label, 2381 datagram, &datagram->m_pkthdr.label); 2382 } 2383 2384 void 2385 mac_create_fragment(struct mbuf *datagram, struct mbuf *fragment) 2386 { 2387 2388 MAC_PERFORM(create_fragment, datagram, &datagram->m_pkthdr.label, 2389 fragment, &fragment->m_pkthdr.label); 2390 } 2391 2392 void 2393 mac_create_ipq(struct mbuf *fragment, struct ipq *ipq) 2394 { 2395 2396 MAC_PERFORM(create_ipq, fragment, &fragment->m_pkthdr.label, ipq, 2397 &ipq->ipq_label); 2398 } 2399 2400 void 2401 mac_create_mbuf_from_mbuf(struct mbuf *oldmbuf, struct mbuf *newmbuf) 2402 { 2403 2404 MAC_PERFORM(create_mbuf_from_mbuf, oldmbuf, &oldmbuf->m_pkthdr.label, 2405 newmbuf, &newmbuf->m_pkthdr.label); 2406 } 2407 2408 void 2409 mac_create_mbuf_from_bpfdesc(struct bpf_d *bpf_d, struct mbuf *mbuf) 2410 { 2411 2412 MAC_PERFORM(create_mbuf_from_bpfdesc, bpf_d, &bpf_d->bd_label, mbuf, 2413 &mbuf->m_pkthdr.label); 2414 } 2415 2416 void 2417 mac_create_mbuf_linklayer(struct ifnet *ifnet, struct mbuf *mbuf) 2418 { 2419 2420 MAC_PERFORM(create_mbuf_linklayer, ifnet, &ifnet->if_label, mbuf, 2421 &mbuf->m_pkthdr.label); 2422 } 2423 2424 void 2425 mac_create_mbuf_from_ifnet(struct ifnet *ifnet, struct mbuf *mbuf) 2426 { 2427 2428 MAC_PERFORM(create_mbuf_from_ifnet, ifnet, &ifnet->if_label, mbuf, 2429 &mbuf->m_pkthdr.label); 2430 } 2431 2432 void 2433 mac_create_mbuf_multicast_encap(struct mbuf *oldmbuf, struct ifnet *ifnet, 2434 struct mbuf *newmbuf) 2435 { 2436 2437 MAC_PERFORM(create_mbuf_multicast_encap, oldmbuf, 2438 &oldmbuf->m_pkthdr.label, ifnet, &ifnet->if_label, newmbuf, 2439 &newmbuf->m_pkthdr.label); 2440 } 2441 2442 void 2443 mac_create_mbuf_netlayer(struct mbuf *oldmbuf, struct mbuf *newmbuf) 2444 { 2445 2446 MAC_PERFORM(create_mbuf_netlayer, oldmbuf, &oldmbuf->m_pkthdr.label, 2447 newmbuf, &newmbuf->m_pkthdr.label); 2448 } 2449 2450 int 2451 mac_fragment_match(struct mbuf *fragment, struct ipq *ipq) 2452 { 2453 int result; 2454 2455 result = 1; 2456 MAC_BOOLEAN(fragment_match, &&, fragment, &fragment->m_pkthdr.label, 2457 ipq, &ipq->ipq_label); 2458 2459 return (result); 2460 } 2461 2462 void 2463 mac_update_ipq(struct mbuf *fragment, struct ipq *ipq) 2464 { 2465 2466 MAC_PERFORM(update_ipq, fragment, &fragment->m_pkthdr.label, ipq, 2467 &ipq->ipq_label); 2468 } 2469 2470 void 2471 mac_create_mbuf_from_socket(struct socket *socket, struct mbuf *mbuf) 2472 { 2473 2474 MAC_PERFORM(create_mbuf_from_socket, socket, &socket->so_label, mbuf, 2475 &mbuf->m_pkthdr.label); 2476 } 2477 2478 void 2479 mac_create_mount(struct ucred *cred, struct mount *mp) 2480 { 2481 2482 MAC_PERFORM(create_mount, cred, mp, &mp->mnt_mntlabel, 2483 &mp->mnt_fslabel); 2484 } 2485 2486 void 2487 mac_create_root_mount(struct ucred *cred, struct mount *mp) 2488 { 2489 2490 MAC_PERFORM(create_root_mount, cred, mp, &mp->mnt_mntlabel, 2491 &mp->mnt_fslabel); 2492 } 2493 2494 int 2495 mac_check_bpfdesc_receive(struct bpf_d *bpf_d, struct ifnet *ifnet) 2496 { 2497 int error; 2498 2499 if (!mac_enforce_network) 2500 return (0); 2501 2502 MAC_CHECK(check_bpfdesc_receive, bpf_d, &bpf_d->bd_label, ifnet, 2503 &ifnet->if_label); 2504 2505 return (error); 2506 } 2507 2508 static int 2509 mac_check_cred_relabel(struct ucred *cred, struct label *newlabel) 2510 { 2511 int error; 2512 2513 MAC_CHECK(check_cred_relabel, cred, newlabel); 2514 2515 return (error); 2516 } 2517 2518 int 2519 mac_check_cred_visible(struct ucred *u1, struct ucred *u2) 2520 { 2521 int error; 2522 2523 if (!mac_enforce_process) 2524 return (0); 2525 2526 MAC_CHECK(check_cred_visible, u1, u2); 2527 2528 return (error); 2529 } 2530 2531 int 2532 mac_check_ifnet_transmit(struct ifnet *ifnet, struct mbuf *mbuf) 2533 { 2534 int error; 2535 2536 if (!mac_enforce_network) 2537 return (0); 2538 2539 KASSERT(mbuf->m_flags & M_PKTHDR, ("packet has no pkthdr")); 2540 if (!(mbuf->m_pkthdr.label.l_flags & MAC_FLAG_INITIALIZED)) 2541 printf("%s%d: not initialized\n", ifnet->if_name, 2542 ifnet->if_unit); 2543 2544 MAC_CHECK(check_ifnet_transmit, ifnet, &ifnet->if_label, mbuf, 2545 &mbuf->m_pkthdr.label); 2546 2547 return (error); 2548 } 2549 2550 int 2551 mac_check_mount_stat(struct ucred *cred, struct mount *mount) 2552 { 2553 int error; 2554 2555 if (!mac_enforce_fs) 2556 return (0); 2557 2558 MAC_CHECK(check_mount_stat, cred, mount, &mount->mnt_mntlabel); 2559 2560 return (error); 2561 } 2562 2563 int 2564 mac_check_pipe_ioctl(struct ucred *cred, struct pipe *pipe, unsigned long cmd, 2565 void *data) 2566 { 2567 int error; 2568 2569 MAC_CHECK(check_pipe_ioctl, cred, pipe, pipe->pipe_label, cmd, data); 2570 2571 return (error); 2572 } 2573 2574 int 2575 mac_check_pipe_poll(struct ucred *cred, struct pipe *pipe) 2576 { 2577 int error; 2578 2579 MAC_CHECK(check_pipe_poll, cred, pipe, pipe->pipe_label); 2580 2581 return (error); 2582 } 2583 2584 int 2585 mac_check_pipe_read(struct ucred *cred, struct pipe *pipe) 2586 { 2587 int error; 2588 2589 MAC_CHECK(check_pipe_read, cred, pipe, pipe->pipe_label); 2590 2591 return (error); 2592 } 2593 2594 static int 2595 mac_check_pipe_relabel(struct ucred *cred, struct pipe *pipe, 2596 struct label *newlabel) 2597 { 2598 int error; 2599 2600 MAC_CHECK(check_pipe_relabel, cred, pipe, pipe->pipe_label, newlabel); 2601 2602 return (error); 2603 } 2604 2605 int 2606 mac_check_pipe_stat(struct ucred *cred, struct pipe *pipe) 2607 { 2608 int error; 2609 2610 MAC_CHECK(check_pipe_stat, cred, pipe, pipe->pipe_label); 2611 2612 return (error); 2613 } 2614 2615 int 2616 mac_check_pipe_write(struct ucred *cred, struct pipe *pipe) 2617 { 2618 int error; 2619 2620 MAC_CHECK(check_pipe_write, cred, pipe, pipe->pipe_label); 2621 2622 return (error); 2623 } 2624 2625 int 2626 mac_check_proc_debug(struct ucred *cred, struct proc *proc) 2627 { 2628 int error; 2629 2630 PROC_LOCK_ASSERT(proc, MA_OWNED); 2631 2632 if (!mac_enforce_process) 2633 return (0); 2634 2635 MAC_CHECK(check_proc_debug, cred, proc); 2636 2637 return (error); 2638 } 2639 2640 int 2641 mac_check_proc_sched(struct ucred *cred, struct proc *proc) 2642 { 2643 int error; 2644 2645 PROC_LOCK_ASSERT(proc, MA_OWNED); 2646 2647 if (!mac_enforce_process) 2648 return (0); 2649 2650 MAC_CHECK(check_proc_sched, cred, proc); 2651 2652 return (error); 2653 } 2654 2655 int 2656 mac_check_proc_signal(struct ucred *cred, struct proc *proc, int signum) 2657 { 2658 int error; 2659 2660 PROC_LOCK_ASSERT(proc, MA_OWNED); 2661 2662 if (!mac_enforce_process) 2663 return (0); 2664 2665 MAC_CHECK(check_proc_signal, cred, proc, signum); 2666 2667 return (error); 2668 } 2669 2670 int 2671 mac_check_socket_bind(struct ucred *ucred, struct socket *socket, 2672 struct sockaddr *sockaddr) 2673 { 2674 int error; 2675 2676 if (!mac_enforce_socket) 2677 return (0); 2678 2679 MAC_CHECK(check_socket_bind, ucred, socket, &socket->so_label, 2680 sockaddr); 2681 2682 return (error); 2683 } 2684 2685 int 2686 mac_check_socket_connect(struct ucred *cred, struct socket *socket, 2687 struct sockaddr *sockaddr) 2688 { 2689 int error; 2690 2691 if (!mac_enforce_socket) 2692 return (0); 2693 2694 MAC_CHECK(check_socket_connect, cred, socket, &socket->so_label, 2695 sockaddr); 2696 2697 return (error); 2698 } 2699 2700 int 2701 mac_check_socket_deliver(struct socket *socket, struct mbuf *mbuf) 2702 { 2703 int error; 2704 2705 if (!mac_enforce_socket) 2706 return (0); 2707 2708 MAC_CHECK(check_socket_deliver, socket, &socket->so_label, mbuf, 2709 &mbuf->m_pkthdr.label); 2710 2711 return (error); 2712 } 2713 2714 int 2715 mac_check_socket_listen(struct ucred *cred, struct socket *socket) 2716 { 2717 int error; 2718 2719 if (!mac_enforce_socket) 2720 return (0); 2721 2722 MAC_CHECK(check_socket_listen, cred, socket, &socket->so_label); 2723 return (error); 2724 } 2725 2726 static int 2727 mac_check_socket_relabel(struct ucred *cred, struct socket *socket, 2728 struct label *newlabel) 2729 { 2730 int error; 2731 2732 MAC_CHECK(check_socket_relabel, cred, socket, &socket->so_label, 2733 newlabel); 2734 2735 return (error); 2736 } 2737 2738 int 2739 mac_check_socket_visible(struct ucred *cred, struct socket *socket) 2740 { 2741 int error; 2742 2743 if (!mac_enforce_socket) 2744 return (0); 2745 2746 MAC_CHECK(check_socket_visible, cred, socket, &socket->so_label); 2747 2748 return (error); 2749 } 2750 2751 int 2752 mac_ioctl_ifnet_get(struct ucred *cred, struct ifreq *ifr, 2753 struct ifnet *ifnet) 2754 { 2755 struct mac label; 2756 int error; 2757 2758 error = mac_externalize(&ifnet->if_label, &label); 2759 if (error) 2760 return (error); 2761 2762 return (copyout(&label, ifr->ifr_ifru.ifru_data, sizeof(label))); 2763 } 2764 2765 int 2766 mac_ioctl_ifnet_set(struct ucred *cred, struct ifreq *ifr, 2767 struct ifnet *ifnet) 2768 { 2769 struct mac newlabel; 2770 struct label intlabel; 2771 int error; 2772 2773 error = copyin(ifr->ifr_ifru.ifru_data, &newlabel, sizeof(newlabel)); 2774 if (error) 2775 return (error); 2776 2777 error = mac_internalize(&intlabel, &newlabel); 2778 if (error) 2779 return (error); 2780 2781 /* 2782 * XXX: Note that this is a redundant privilege check, since 2783 * policies impose this check themselves if required by the 2784 * policy. Eventually, this should go away. 2785 */ 2786 error = suser_cred(cred, 0); 2787 if (error) 2788 goto out; 2789 2790 MAC_CHECK(check_ifnet_relabel, cred, ifnet, &ifnet->if_label, 2791 &intlabel); 2792 if (error) 2793 goto out; 2794 2795 MAC_PERFORM(relabel_ifnet, cred, ifnet, &ifnet->if_label, &intlabel); 2796 2797 out: 2798 mac_destroy_temp(&intlabel); 2799 return (error); 2800 } 2801 2802 void 2803 mac_create_devfs_vnode(struct devfs_dirent *de, struct vnode *vp) 2804 { 2805 2806 MAC_PERFORM(create_devfs_vnode, de, &de->de_label, vp, &vp->v_label); 2807 } 2808 2809 void 2810 mac_create_devfs_device(dev_t dev, struct devfs_dirent *de) 2811 { 2812 2813 MAC_PERFORM(create_devfs_device, dev, de, &de->de_label); 2814 } 2815 2816 static int 2817 mac_stdcreatevnode_ea(struct vnode *vp) 2818 { 2819 int error; 2820 2821 MAC_CHECK(stdcreatevnode_ea, vp, &vp->v_label); 2822 2823 return (error); 2824 } 2825 2826 void 2827 mac_create_devfs_directory(char *dirname, int dirnamelen, 2828 struct devfs_dirent *de) 2829 { 2830 2831 MAC_PERFORM(create_devfs_directory, dirname, dirnamelen, de, 2832 &de->de_label); 2833 } 2834 2835 /* 2836 * When a new vnode is created, this call will initialize its label. 2837 */ 2838 void 2839 mac_create_vnode(struct ucred *cred, struct vnode *parent, 2840 struct vnode *child) 2841 { 2842 int error; 2843 2844 ASSERT_VOP_LOCKED(parent, "mac_create_vnode"); 2845 ASSERT_VOP_LOCKED(child, "mac_create_vnode"); 2846 2847 error = vn_refreshlabel(parent, cred); 2848 if (error) { 2849 printf("mac_create_vnode: vn_refreshlabel returned %d\n", 2850 error); 2851 printf("mac_create_vnode: using old vnode label\n"); 2852 } 2853 2854 MAC_PERFORM(create_vnode, cred, parent, &parent->v_label, child, 2855 &child->v_label); 2856 } 2857 2858 int 2859 mac_setsockopt_label_set(struct ucred *cred, struct socket *so, 2860 struct mac *extmac) 2861 { 2862 struct label intlabel; 2863 int error; 2864 2865 error = mac_internalize(&intlabel, extmac); 2866 if (error) 2867 return (error); 2868 2869 mac_check_socket_relabel(cred, so, &intlabel); 2870 if (error) { 2871 mac_destroy_temp(&intlabel); 2872 return (error); 2873 } 2874 2875 mac_relabel_socket(cred, so, &intlabel); 2876 2877 mac_destroy_temp(&intlabel); 2878 return (0); 2879 } 2880 2881 int 2882 mac_pipe_label_set(struct ucred *cred, struct pipe *pipe, struct label *label) 2883 { 2884 int error; 2885 2886 error = mac_check_pipe_relabel(cred, pipe, label); 2887 if (error) 2888 return (error); 2889 2890 mac_relabel_pipe(cred, pipe, label); 2891 2892 return (0); 2893 } 2894 2895 int 2896 mac_getsockopt_label_get(struct ucred *cred, struct socket *so, 2897 struct mac *extmac) 2898 { 2899 2900 return (mac_externalize(&so->so_label, extmac)); 2901 } 2902 2903 int 2904 mac_getsockopt_peerlabel_get(struct ucred *cred, struct socket *so, 2905 struct mac *extmac) 2906 { 2907 2908 return (mac_externalize(&so->so_peerlabel, extmac)); 2909 } 2910 2911 /* 2912 * Implementation of VOP_SETLABEL() that relies on extended attributes 2913 * to store label data. Can be referenced by filesystems supporting 2914 * extended attributes. 2915 */ 2916 int 2917 vop_stdsetlabel_ea(struct vop_setlabel_args *ap) 2918 { 2919 struct vnode *vp = ap->a_vp; 2920 struct label *intlabel = ap->a_label; 2921 struct mac extmac; 2922 int error; 2923 2924 ASSERT_VOP_LOCKED(vp, "vop_stdsetlabel_ea"); 2925 2926 /* 2927 * XXX: Eventually call out to EA check/set calls here. 2928 * Be particularly careful to avoid race conditions, 2929 * consistency problems, and stability problems when 2930 * dealing with multiple EAs. In particular, we require 2931 * the ability to write multiple EAs on the same file in 2932 * a single transaction, which the current EA interface 2933 * does not provide. 2934 */ 2935 2936 error = mac_externalize(intlabel, &extmac); 2937 if (error) 2938 return (error); 2939 2940 error = vn_extattr_set(vp, IO_NODELOCKED, 2941 FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME, 2942 sizeof(extmac), (char *)&extmac, curthread); 2943 if (error) 2944 return (error); 2945 2946 mac_relabel_vnode(ap->a_cred, vp, intlabel); 2947 2948 vp->v_vflag |= VV_CACHEDLABEL; 2949 2950 return (0); 2951 } 2952 2953 static int 2954 vn_setlabel(struct vnode *vp, struct label *intlabel, struct ucred *cred) 2955 { 2956 int error; 2957 2958 if (vp->v_mount == NULL) { 2959 /* printf("vn_setlabel: null v_mount\n"); */ 2960 if (vp->v_type != VNON) 2961 printf("vn_setlabel: null v_mount with non-VNON\n"); 2962 return (EBADF); 2963 } 2964 2965 if ((vp->v_mount->mnt_flag & MNT_MULTILABEL) == 0) 2966 return (EOPNOTSUPP); 2967 2968 /* 2969 * Multi-phase commit. First check the policies to confirm the 2970 * change is OK. Then commit via the filesystem. Finally, 2971 * update the actual vnode label. Question: maybe the filesystem 2972 * should update the vnode at the end as part of VOP_SETLABEL()? 2973 */ 2974 error = mac_check_vnode_relabel(cred, vp, intlabel); 2975 if (error) 2976 return (error); 2977 2978 /* 2979 * VADMIN provides the opportunity for the filesystem to make 2980 * decisions about who is and is not able to modify labels 2981 * and protections on files. This might not be right. We can't 2982 * assume VOP_SETLABEL() will do it, because we might implement 2983 * that as part of vop_stdsetlabel_ea(). 2984 */ 2985 error = VOP_ACCESS(vp, VADMIN, cred, curthread); 2986 if (error) 2987 return (error); 2988 2989 error = VOP_SETLABEL(vp, intlabel, cred, curthread); 2990 if (error) 2991 return (error); 2992 2993 return (0); 2994 } 2995 2996 /* 2997 * MPSAFE 2998 */ 2999 int 3000 __mac_get_proc(struct thread *td, struct __mac_get_proc_args *uap) 3001 { 3002 struct mac extmac; 3003 int error; 3004 3005 error = mac_externalize(&td->td_ucred->cr_label, &extmac); 3006 if (error == 0) 3007 error = copyout(&extmac, SCARG(uap, mac_p), sizeof(extmac)); 3008 3009 return (error); 3010 } 3011 3012 /* 3013 * MPSAFE 3014 */ 3015 int 3016 __mac_set_proc(struct thread *td, struct __mac_set_proc_args *uap) 3017 { 3018 struct ucred *newcred, *oldcred; 3019 struct proc *p; 3020 struct mac extmac; 3021 struct label intlabel; 3022 int error; 3023 3024 error = copyin(SCARG(uap, mac_p), &extmac, sizeof(extmac)); 3025 if (error) 3026 return (error); 3027 3028 error = mac_internalize(&intlabel, &extmac); 3029 if (error) 3030 return (error); 3031 3032 newcred = crget(); 3033 3034 p = td->td_proc; 3035 PROC_LOCK(p); 3036 oldcred = p->p_ucred; 3037 3038 error = mac_check_cred_relabel(oldcred, &intlabel); 3039 if (error) { 3040 PROC_UNLOCK(p); 3041 mac_destroy_temp(&intlabel); 3042 crfree(newcred); 3043 return (error); 3044 } 3045 3046 setsugid(p); 3047 crcopy(newcred, oldcred); 3048 mac_relabel_cred(newcred, &intlabel); 3049 p->p_ucred = newcred; 3050 3051 /* 3052 * Grab additional reference for use while revoking mmaps, prior 3053 * to releasing the proc lock and sharing the cred. 3054 */ 3055 crhold(newcred); 3056 PROC_UNLOCK(p); 3057 3058 mtx_lock(&Giant); 3059 mac_cred_mmapped_drop_perms(td, newcred); 3060 mtx_unlock(&Giant); 3061 3062 crfree(newcred); /* Free revocation reference. */ 3063 crfree(oldcred); 3064 mac_destroy_temp(&intlabel); 3065 return (0); 3066 } 3067 3068 /* 3069 * MPSAFE 3070 */ 3071 int 3072 __mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap) 3073 { 3074 struct file *fp; 3075 struct mac extmac; 3076 struct vnode *vp; 3077 struct pipe *pipe; 3078 int error; 3079 3080 mtx_lock(&Giant); 3081 3082 error = fget(td, SCARG(uap, fd), &fp); 3083 if (error) 3084 goto out; 3085 3086 switch (fp->f_type) { 3087 case DTYPE_FIFO: 3088 case DTYPE_VNODE: 3089 vp = (struct vnode *)fp->f_data; 3090 3091 vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); 3092 error = vn_refreshlabel(vp, td->td_ucred); 3093 if (error == 0) 3094 error = mac_externalize(&vp->v_label, &extmac); 3095 VOP_UNLOCK(vp, 0, td); 3096 break; 3097 case DTYPE_PIPE: 3098 pipe = (struct pipe *)fp->f_data; 3099 error = mac_externalize(pipe->pipe_label, &extmac); 3100 break; 3101 default: 3102 error = EINVAL; 3103 } 3104 3105 if (error == 0) 3106 error = copyout(&extmac, SCARG(uap, mac_p), sizeof(extmac)); 3107 3108 fdrop(fp, td); 3109 3110 out: 3111 mtx_unlock(&Giant); 3112 return (error); 3113 } 3114 3115 /* 3116 * MPSAFE 3117 */ 3118 int 3119 __mac_get_file(struct thread *td, struct __mac_get_file_args *uap) 3120 { 3121 struct nameidata nd; 3122 struct mac extmac; 3123 int error; 3124 3125 mtx_lock(&Giant); 3126 NDINIT(&nd, LOOKUP, LOCKLEAF | FOLLOW, UIO_USERSPACE, 3127 SCARG(uap, path_p), td); 3128 error = namei(&nd); 3129 if (error) 3130 goto out; 3131 3132 error = vn_refreshlabel(nd.ni_vp, td->td_ucred); 3133 if (error == 0) 3134 error = mac_externalize(&nd.ni_vp->v_label, &extmac); 3135 NDFREE(&nd, 0); 3136 if (error) 3137 goto out; 3138 3139 error = copyout(&extmac, SCARG(uap, mac_p), sizeof(extmac)); 3140 3141 out: 3142 mtx_unlock(&Giant); 3143 return (error); 3144 } 3145 3146 /* 3147 * MPSAFE 3148 */ 3149 int 3150 __mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap) 3151 { 3152 struct file *fp; 3153 struct mac extmac; 3154 struct label intlabel; 3155 struct mount *mp; 3156 struct vnode *vp; 3157 struct pipe *pipe; 3158 int error; 3159 3160 mtx_lock(&Giant); 3161 error = fget(td, SCARG(uap, fd), &fp); 3162 if (error) 3163 goto out1; 3164 3165 error = copyin(SCARG(uap, mac_p), &extmac, sizeof(extmac)); 3166 if (error) 3167 goto out2; 3168 3169 error = mac_internalize(&intlabel, &extmac); 3170 if (error) 3171 goto out2; 3172 3173 switch (fp->f_type) { 3174 case DTYPE_FIFO: 3175 case DTYPE_VNODE: 3176 vp = (struct vnode *)fp->f_data; 3177 error = vn_start_write(vp, &mp, V_WAIT | PCATCH); 3178 if (error != 0) 3179 break; 3180 3181 vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); 3182 error = vn_setlabel(vp, &intlabel, td->td_ucred); 3183 VOP_UNLOCK(vp, 0, td); 3184 vn_finished_write(mp); 3185 mac_destroy_temp(&intlabel); 3186 break; 3187 case DTYPE_PIPE: 3188 pipe = (struct pipe *)fp->f_data; 3189 error = mac_pipe_label_set(td->td_ucred, pipe, &intlabel); 3190 break; 3191 default: 3192 error = EINVAL; 3193 } 3194 3195 out2: 3196 fdrop(fp, td); 3197 out1: 3198 mtx_unlock(&Giant); 3199 return (error); 3200 } 3201 3202 /* 3203 * MPSAFE 3204 */ 3205 int 3206 __mac_set_file(struct thread *td, struct __mac_set_file_args *uap) 3207 { 3208 struct nameidata nd; 3209 struct mac extmac; 3210 struct label intlabel; 3211 struct mount *mp; 3212 int error; 3213 3214 mtx_lock(&Giant); 3215 3216 error = copyin(SCARG(uap, mac_p), &extmac, sizeof(extmac)); 3217 if (error) 3218 goto out; 3219 3220 error = mac_internalize(&intlabel, &extmac); 3221 if (error) 3222 goto out; 3223 3224 NDINIT(&nd, LOOKUP, LOCKLEAF | FOLLOW, UIO_USERSPACE, 3225 SCARG(uap, path_p), td); 3226 error = namei(&nd); 3227 if (error) 3228 goto out2; 3229 error = vn_start_write(nd.ni_vp, &mp, V_WAIT | PCATCH); 3230 if (error) 3231 goto out2; 3232 3233 error = vn_setlabel(nd.ni_vp, &intlabel, td->td_ucred); 3234 3235 vn_finished_write(mp); 3236 out2: 3237 mac_destroy_temp(&intlabel); 3238 NDFREE(&nd, 0); 3239 out: 3240 mtx_unlock(&Giant); 3241 return (error); 3242 } 3243 3244 int 3245 mac_syscall(struct thread *td, struct mac_syscall_args *uap) 3246 { 3247 struct mac_policy_conf *mpc; 3248 char target[MAC_MAX_POLICY_NAME]; 3249 int error; 3250 3251 error = copyinstr(SCARG(uap, policy), target, sizeof(target), NULL); 3252 if (error) 3253 return (error); 3254 3255 error = ENOSYS; 3256 MAC_POLICY_LIST_BUSY(); 3257 LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { 3258 if (strcmp(mpc->mpc_name, target) == 0 && 3259 mpc->mpc_ops->mpo_syscall != NULL) { 3260 error = mpc->mpc_ops->mpo_syscall(td, 3261 SCARG(uap, call), SCARG(uap, arg)); 3262 goto out; 3263 } 3264 } 3265 3266 out: 3267 MAC_POLICY_LIST_UNBUSY(); 3268 return (error); 3269 } 3270 3271 SYSINIT(mac, SI_SUB_MAC, SI_ORDER_FIRST, mac_init, NULL); 3272 SYSINIT(mac_late, SI_SUB_MAC_LATE, SI_ORDER_FIRST, mac_late_init, NULL); 3273 3274 #else /* !MAC */ 3275 3276 int 3277 __mac_get_proc(struct thread *td, struct __mac_get_proc_args *uap) 3278 { 3279 3280 return (ENOSYS); 3281 } 3282 3283 int 3284 __mac_set_proc(struct thread *td, struct __mac_set_proc_args *uap) 3285 { 3286 3287 return (ENOSYS); 3288 } 3289 3290 int 3291 __mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap) 3292 { 3293 3294 return (ENOSYS); 3295 } 3296 3297 int 3298 __mac_get_file(struct thread *td, struct __mac_get_file_args *uap) 3299 { 3300 3301 return (ENOSYS); 3302 } 3303 3304 int 3305 __mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap) 3306 { 3307 3308 return (ENOSYS); 3309 } 3310 3311 int 3312 __mac_set_file(struct thread *td, struct __mac_set_file_args *uap) 3313 { 3314 3315 return (ENOSYS); 3316 } 3317 3318 int 3319 mac_syscall(struct thread *td, struct mac_syscall_args *uap) 3320 { 3321 3322 return (ENOSYS); 3323 } 3324 3325 #endif /* !MAC */ 3326