Lines Matching +full:mac +full:-
1 /*-
2 * Copyright (c) 1999-2002, 2006, 2009 Robert N. M. Watson
4 * Copyright (c) 2001-2005 Networks Associates Technology, Inc.
5 * Copyright (c) 2005-2006 SPARTA, Inc.
14 * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"),
18 * N66001-04-C-6019 ("SEFOS").
56 #include <sys/mac.h>
69 #include <security/mac/mac_framework.h>
70 #include <security/mac/mac_internal.h>
71 #include <security/mac/mac_policy.h>
72 #include <security/mac/mac_syscalls.h>
74 #ifdef MAC
79 struct mac *mac_p, int follow);
81 struct mac *mac_p, int follow);
91 * Copyin a 'struct mac', including the string pointed to by 'm_string'.
93 * On success (0 returned), fills '*mac', whose associated storage must be freed
95 * if not NULL is filled with the userspace address for 'u_mac->m_string'.
98 mac_label_copyin_impl(const void *const u_mac, struct mac *const mac, in mac_label_copyin_impl() argument
112 CP(mac32, *mac, m_buflen); in mac_label_copyin_impl()
113 PTRIN_CP(mac32, *mac, m_string); in mac_label_copyin_impl()
117 error = copyin(u_mac, mac, sizeof(*mac)); in mac_label_copyin_impl()
122 error = mac_check_structmac_consistent(mac); in mac_label_copyin_impl()
127 buffer = malloc(mac->m_buflen, M_MACTEMP, M_WAITOK); in mac_label_copyin_impl()
128 error = copyinstr(mac->m_string, buffer, mac->m_buflen, NULL); in mac_label_copyin_impl()
136 *u_string = mac->m_string; in mac_label_copyin_impl()
137 mac->m_string = buffer; in mac_label_copyin_impl()
142 mac_label_copyin(const struct mac *const u_mac, struct mac *const mac, in mac_label_copyin() argument
145 return (mac_label_copyin_impl(u_mac, mac, u_string, false)); in mac_label_copyin()
149 free_copied_label(const struct mac *const mac) in free_copied_label() argument
151 free(mac->m_string, M_MACTEMP); in free_copied_label()
157 struct mac *const mac, char **const u_string) in mac_label_copyin32() argument
159 return (mac_label_copyin_impl(u_mac, mac, u_string, true)); in mac_label_copyin32()
167 struct mac mac; in sys___mac_get_pid() local
172 error = mac_label_copyin(uap->mac_p, &mac, &u_buffer); in sys___mac_get_pid()
176 tproc = pfind(uap->pid); in sys___mac_get_pid()
185 tcred = crhold(tproc->p_ucred); in sys___mac_get_pid()
190 buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK | M_ZERO); in sys___mac_get_pid()
191 error = mac_cred_externalize_label(tcred->cr_label, mac.m_string, in sys___mac_get_pid()
192 buffer, mac.m_buflen); in sys___mac_get_pid()
199 free_copied_label(&mac); in sys___mac_get_pid()
207 struct mac mac; in sys___mac_get_proc() local
210 error = mac_label_copyin(uap->mac_p, &mac, &u_buffer); in sys___mac_get_proc()
214 buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK | M_ZERO); in sys___mac_get_proc()
215 error = mac_cred_externalize_label(td->td_ucred->cr_label, in sys___mac_get_proc()
216 mac.m_string, buffer, mac.m_buflen); in sys___mac_get_proc()
221 free_copied_label(&mac); in sys___mac_get_proc()
231 * is not set in case of error, and is set to a non-NULL value on success.
234 mac_set_proc_prepare(struct thread *const td, const struct mac *const mac, in mac_set_proc_prepare() argument
240 PROC_LOCK_ASSERT(td->td_proc, MA_NOTOWNED); in mac_set_proc_prepare()
246 error = mac_cred_internalize_label(intlabel, mac->m_string); in mac_set_proc_prepare()
257 * Actually sets the MAC label on 'newcred'.
265 * error occured under the process lock that obsoletes setting the MAC label).
272 struct proc *const p = td->td_proc; in mac_set_proc_core()
278 error = mac_cred_check_relabel(p->p_ucred, intlabel); in mac_set_proc_core()
299 PROC_LOCK_ASSERT(td->td_proc, MA_NOTOWNED); in mac_set_proc_finish()
311 struct proc *const p = td->td_proc; in sys___mac_set_proc()
312 struct mac mac; in sys___mac_set_proc() local
315 error = mac_label_copyin(uap->mac_p, &mac, NULL); in sys___mac_set_proc()
319 error = mac_set_proc_prepare(td, &mac, &intlabel); in sys___mac_set_proc()
326 oldcred = p->p_ucred; in sys___mac_set_proc()
344 free_copied_label(&mac); in sys___mac_set_proc()
354 struct mac mac; in sys___mac_get_fd() local
361 error = mac_label_copyin(uap->mac_p, &mac, &u_buffer); in sys___mac_get_fd()
365 buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK | M_ZERO); in sys___mac_get_fd()
366 error = fget(td, uap->fd, cap_rights_init_one(&rights, CAP_MAC_GET), in sys___mac_get_fd()
371 switch (fp->f_type) { in sys___mac_get_fd()
378 vp = fp->f_vnode; in sys___mac_get_fd()
381 mac_vnode_copy_label(vp->v_label, intlabel); in sys___mac_get_fd()
383 error = mac_vnode_externalize_label(intlabel, mac.m_string, in sys___mac_get_fd()
384 buffer, mac.m_buflen); in sys___mac_get_fd()
393 pipe = fp->f_data; in sys___mac_get_fd()
396 mac_pipe_copy_label(pipe->pipe_pair->pp_label, intlabel); in sys___mac_get_fd()
398 error = mac_pipe_externalize_label(intlabel, mac.m_string, in sys___mac_get_fd()
399 buffer, mac.m_buflen); in sys___mac_get_fd()
408 so = fp->f_data; in sys___mac_get_fd()
411 mac_socket_copy_label(so->so_label, intlabel); in sys___mac_get_fd()
413 error = mac_socket_externalize_label(intlabel, mac.m_string, in sys___mac_get_fd()
414 buffer, mac.m_buflen); in sys___mac_get_fd()
427 free_copied_label(&mac); in sys___mac_get_fd()
435 return (kern___mac_get_path(td, uap->path_p, uap->mac_p, FOLLOW)); in sys___mac_get_file()
442 return (kern___mac_get_path(td, uap->path_p, uap->mac_p, NOFOLLOW)); in sys___mac_get_link()
446 kern___mac_get_path(struct thread *td, const char *path_p, struct mac *mac_p, in kern___mac_get_path()
452 struct mac mac; in kern___mac_get_path() local
458 error = mac_label_copyin(mac_p, &mac, &u_buffer); in kern___mac_get_path()
462 buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK | M_ZERO); in kern___mac_get_path()
469 mac_vnode_copy_label(nd.ni_vp->v_label, intlabel); in kern___mac_get_path()
470 error = mac_vnode_externalize_label(intlabel, mac.m_string, buffer, in kern___mac_get_path()
471 mac.m_buflen); in kern___mac_get_path()
481 free_copied_label(&mac); in kern___mac_get_path()
495 struct mac mac; in sys___mac_set_fd() local
499 error = mac_label_copyin(uap->mac_p, &mac, NULL); in sys___mac_set_fd()
503 error = fget(td, uap->fd, cap_rights_init_one(&rights, CAP_MAC_SET), in sys___mac_set_fd()
508 switch (fp->f_type) { in sys___mac_set_fd()
516 error = mac_vnode_internalize_label(intlabel, mac.m_string); in sys___mac_set_fd()
521 vp = fp->f_vnode; in sys___mac_set_fd()
528 error = vn_setlabel(vp, intlabel, td->td_ucred); in sys___mac_set_fd()
540 error = mac_pipe_internalize_label(intlabel, mac.m_string); in sys___mac_set_fd()
542 pipe = fp->f_data; in sys___mac_set_fd()
544 error = mac_pipe_label_set(td->td_ucred, in sys___mac_set_fd()
545 pipe->pipe_pair, intlabel); in sys___mac_set_fd()
557 error = mac_socket_internalize_label(intlabel, mac.m_string); in sys___mac_set_fd()
559 so = fp->f_data; in sys___mac_set_fd()
560 error = mac_socket_label_set(td->td_ucred, so, in sys___mac_set_fd()
572 free_copied_label(&mac); in sys___mac_set_fd()
580 return (kern___mac_set_path(td, uap->path_p, uap->mac_p, FOLLOW)); in sys___mac_set_file()
587 return (kern___mac_set_path(td, uap->path_p, uap->mac_p, NOFOLLOW)); in sys___mac_set_link()
591 kern___mac_set_path(struct thread *td, const char *path_p, struct mac *mac_p, in kern___mac_set_path()
597 struct mac mac; in kern___mac_set_path() local
603 error = mac_label_copyin(mac_p, &mac, NULL); in kern___mac_set_path()
608 error = mac_vnode_internalize_label(intlabel, mac.m_string); in kern___mac_set_path()
609 free_copied_label(&mac); in kern___mac_set_path()
619 td->td_ucred); in kern___mac_set_path()
637 error = copyinstr(uap->policy, target, sizeof(target), NULL); in sys_mac_syscall()
643 if (strcmp(mpc->mpc_name, target) == 0 && in sys_mac_syscall()
644 mpc->mpc_ops->mpo_syscall != NULL) { in sys_mac_syscall()
645 error = mpc->mpc_ops->mpo_syscall(td, in sys_mac_syscall()
646 uap->call, uap->arg); in sys_mac_syscall()
654 if (strcmp(mpc->mpc_name, target) == 0 && in sys_mac_syscall()
655 mpc->mpc_ops->mpo_syscall != NULL) { in sys_mac_syscall()
656 error = mpc->mpc_ops->mpo_syscall(td, in sys_mac_syscall()
657 uap->call, uap->arg); in sys_mac_syscall()
667 #else /* !MAC */
739 #endif /* !MAC */