1 /*-
2 * SPDX-License-Identifier: BSD-2-Clause
3 *
4 * Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson
5 * Copyright (c) 2002, 2003 Networks Associates Technology, Inc.
6 * All rights reserved.
7 *
8 * This software was developed by Robert Watson for the TrustedBSD Project.
9 *
10 * This software was developed for the FreeBSD Project in part by Network
11 * Associates Laboratories, the Security Research Division of Network
12 * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"),
13 * as part of the DARPA CHATS research program.
14 *
15 * Redistribution and use in source and binary forms, with or without
16 * modification, are permitted provided that the following conditions
17 * are met:
18 * 1. Redistributions of source code must retain the above copyright
19 * notice, this list of conditions and the following disclaimer.
20 * 2. Redistributions in binary form must reproduce the above copyright
21 * notice, this list of conditions and the following disclaimer in the
22 * documentation and/or other materials provided with the distribution.
23 *
24 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
25 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
26 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
27 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
28 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
29 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
30 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
31 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
32 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
33 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34 * SUCH DAMAGE.
35 */
36
37 #include <sys/types.h>
38 #include <sys/queue.h>
39 #include <sys/sysctl.h>
40
41 #include <dlfcn.h>
42 #include <errno.h>
43 #include <limits.h>
44 #include <stdio.h>
45 #include <stdlib.h>
46 #include <string.h>
47 #include <unistd.h>
48
49 #include <sys/mac.h>
50
51 static int internal_initialized;
52
53 /*
54 * Maintain a list of default label preparations for various object
55 * types. Each name will appear only once in the list.
56 *
57 * XXXMAC: Not thread-safe.
58 */
59 static LIST_HEAD(, label_default) label_default_head;
60 struct label_default {
61 char *ld_name;
62 char *ld_labels;
63 LIST_ENTRY(label_default) ld_entries;
64 };
65
66 static void
mac_destroy_labels(void)67 mac_destroy_labels(void)
68 {
69 struct label_default *ld;
70
71 while ((ld = LIST_FIRST(&label_default_head))) {
72 free(ld->ld_name);
73 free(ld->ld_labels);
74 LIST_REMOVE(ld, ld_entries);
75 free(ld);
76 }
77 }
78
79 static void
mac_destroy_internal(void)80 mac_destroy_internal(void)
81 {
82
83 mac_destroy_labels();
84
85 internal_initialized = 0;
86 }
87
88 static int
mac_add_type(const char * name,const char * labels)89 mac_add_type(const char *name, const char *labels)
90 {
91 struct label_default *ld, *ld_new;
92 char *name_dup, *labels_dup;
93
94 /*
95 * Speculatively allocate all the memory now to avoid allocating
96 * later when we will someday hold a mutex.
97 */
98 name_dup = strdup(name);
99 if (name_dup == NULL) {
100 errno = ENOMEM;
101 return (-1);
102 }
103 labels_dup = strdup(labels);
104 if (labels_dup == NULL) {
105 free(name_dup);
106 errno = ENOMEM;
107 return (-1);
108 }
109 ld_new = malloc(sizeof(*ld));
110 if (ld_new == NULL) {
111 free(name_dup);
112 free(labels_dup);
113 errno = ENOMEM;
114 return (-1);
115 }
116
117 /*
118 * If the type is already present, replace the current entry
119 * rather than add a new instance.
120 */
121 for (ld = LIST_FIRST(&label_default_head); ld != NULL;
122 ld = LIST_NEXT(ld, ld_entries)) {
123 if (strcmp(name, ld->ld_name) == 0)
124 break;
125 }
126
127 if (ld != NULL) {
128 free(ld->ld_labels);
129 ld->ld_labels = labels_dup;
130 labels_dup = NULL;
131 } else {
132 ld = ld_new;
133 ld->ld_name = name_dup;
134 ld->ld_labels = labels_dup;
135
136 ld_new = NULL;
137 name_dup = NULL;
138 labels_dup = NULL;
139
140 LIST_INSERT_HEAD(&label_default_head, ld, ld_entries);
141 }
142
143 if (name_dup != NULL)
144 free(name_dup);
145 if (labels_dup != NULL)
146 free(labels_dup);
147 if (ld_new != NULL)
148 free(ld_new);
149
150 return (0);
151 }
152
153 static char *
next_token(char ** string)154 next_token(char **string)
155 {
156 char *token;
157
158 token = strsep(string, " \t");
159 while (token != NULL && *token == '\0')
160 token = strsep(string, " \t");
161
162 return (token);
163 }
164
165 static int
mac_init_internal(int ignore_errors)166 mac_init_internal(int ignore_errors)
167 {
168 const char *filename;
169 char line[LINE_MAX];
170 FILE *file;
171 int error;
172
173 error = 0;
174
175 LIST_INIT(&label_default_head);
176
177 filename = secure_getenv("MAC_CONFFILE");
178 if (filename == NULL)
179 filename = MAC_CONFFILE;
180 file = fopen(filename, "re");
181 if (file == NULL)
182 return (0);
183
184 while (fgets(line, LINE_MAX, file)) {
185 char *comment, *parse, *statement;
186
187 if (line[strlen(line)-1] == '\n')
188 line[strlen(line)-1] = '\0';
189 else {
190 if (ignore_errors)
191 continue;
192 fclose(file);
193 error = EINVAL;
194 goto just_return;
195 }
196
197 /* Remove any comment. */
198 comment = line;
199 parse = strsep(&comment, "#");
200
201 /* Blank lines OK. */
202 statement = next_token(&parse);
203 if (statement == NULL)
204 continue;
205
206 if (strcmp(statement, "default_labels") == 0) {
207 char *name, *labels;
208
209 name = next_token(&parse);
210 labels = next_token(&parse);
211 if (name == NULL || labels == NULL ||
212 next_token(&parse) != NULL) {
213 if (ignore_errors)
214 continue;
215 error = EINVAL;
216 fclose(file);
217 goto just_return;
218 }
219
220 if (mac_add_type(name, labels) == -1) {
221 if (ignore_errors)
222 continue;
223 fclose(file);
224 goto just_return;
225 }
226 } else if (strcmp(statement, "default_ifnet_labels") == 0 ||
227 strcmp(statement, "default_file_labels") == 0 ||
228 strcmp(statement, "default_process_labels") == 0) {
229 char *labels, *type;
230
231 if (strcmp(statement, "default_ifnet_labels") == 0)
232 type = "ifnet";
233 else if (strcmp(statement, "default_file_labels") == 0)
234 type = "file";
235 else if (strcmp(statement, "default_process_labels") ==
236 0)
237 type = "process";
238
239 labels = next_token(&parse);
240 if (labels == NULL || next_token(&parse) != NULL) {
241 if (ignore_errors)
242 continue;
243 error = EINVAL;
244 fclose(file);
245 goto just_return;
246 }
247
248 if (mac_add_type(type, labels) == -1) {
249 if (ignore_errors)
250 continue;
251 fclose(file);
252 goto just_return;
253 }
254 } else {
255 if (ignore_errors)
256 continue;
257 fclose(file);
258 error = EINVAL;
259 goto just_return;
260 }
261 }
262
263 fclose(file);
264
265 internal_initialized = 1;
266
267 just_return:
268 if (error != 0)
269 mac_destroy_internal();
270 return (error);
271 }
272
273 static int
mac_maybe_init_internal(void)274 mac_maybe_init_internal(void)
275 {
276
277 if (!internal_initialized)
278 return (mac_init_internal(1));
279 else
280 return (0);
281 }
282
283 int
mac_reload(void)284 mac_reload(void)
285 {
286
287 if (internal_initialized)
288 mac_destroy_internal();
289 return (mac_init_internal(0));
290 }
291
292 int
mac_free(struct mac * mac)293 mac_free(struct mac *mac)
294 {
295
296 if (mac->m_string != NULL)
297 free(mac->m_string);
298 free(mac);
299
300 return (0);
301 }
302
303 int
mac_from_text(struct mac ** mac,const char * text)304 mac_from_text(struct mac **mac, const char *text)
305 {
306
307 *mac = (struct mac *) malloc(sizeof(**mac));
308 if (*mac == NULL)
309 return (ENOMEM);
310
311 (*mac)->m_string = strdup(text);
312 if ((*mac)->m_string == NULL) {
313 free(*mac);
314 *mac = NULL;
315 return (ENOMEM);
316 }
317
318 (*mac)->m_buflen = strlen((*mac)->m_string)+1;
319
320 return (0);
321 }
322
323 int
mac_to_text(struct mac * mac,char ** text)324 mac_to_text(struct mac *mac, char **text)
325 {
326
327 *text = strdup(mac->m_string);
328 if (*text == NULL)
329 return (ENOMEM);
330 return (0);
331 }
332
333 int
mac_prepare(struct mac ** mac,const char * elements)334 mac_prepare(struct mac **mac, const char *elements)
335 {
336
337 if (strlen(elements) >= MAC_MAX_LABEL_BUF_LEN)
338 return (EINVAL);
339
340 *mac = (struct mac *) malloc(sizeof(**mac));
341 if (*mac == NULL)
342 return (ENOMEM);
343
344 (*mac)->m_string = malloc(MAC_MAX_LABEL_BUF_LEN);
345 if ((*mac)->m_string == NULL) {
346 free(*mac);
347 *mac = NULL;
348 return (ENOMEM);
349 }
350
351 strcpy((*mac)->m_string, elements);
352 (*mac)->m_buflen = MAC_MAX_LABEL_BUF_LEN;
353
354 return (0);
355 }
356
357 int
mac_prepare_type(struct mac ** mac,const char * name)358 mac_prepare_type(struct mac **mac, const char *name)
359 {
360 struct label_default *ld;
361 int error;
362
363 error = mac_maybe_init_internal();
364 if (error != 0)
365 return (error);
366
367 for (ld = LIST_FIRST(&label_default_head); ld != NULL;
368 ld = LIST_NEXT(ld, ld_entries)) {
369 if (strcmp(name, ld->ld_name) == 0)
370 return (mac_prepare(mac, ld->ld_labels));
371 }
372
373 errno = ENOENT;
374 return (-1); /* XXXMAC: ENOLABEL */
375 }
376
377 int
mac_prepare_ifnet_label(struct mac ** mac)378 mac_prepare_ifnet_label(struct mac **mac)
379 {
380
381 return (mac_prepare_type(mac, "ifnet"));
382 }
383
384 int
mac_prepare_file_label(struct mac ** mac)385 mac_prepare_file_label(struct mac **mac)
386 {
387
388 return (mac_prepare_type(mac, "file"));
389 }
390
391 int
mac_prepare_packet_label(struct mac ** mac)392 mac_prepare_packet_label(struct mac **mac)
393 {
394
395 return (mac_prepare_type(mac, "packet"));
396 }
397
398 int
mac_prepare_process_label(struct mac ** mac)399 mac_prepare_process_label(struct mac **mac)
400 {
401
402 return (mac_prepare_type(mac, "process"));
403 }
404
405 /*
406 * Simply test whether the TrustedBSD/MAC MIB tree is present; if so,
407 * return 1 to indicate that the system has MAC enabled overall or for
408 * a given policy.
409 */
410 int
mac_is_present(const char * policyname)411 mac_is_present(const char *policyname)
412 {
413 int mib[5];
414 size_t siz;
415 char *mibname;
416 int error;
417
418 if (policyname != NULL) {
419 if (policyname[strcspn(policyname, ".=")] != '\0') {
420 errno = EINVAL;
421 return (-1);
422 }
423 mibname = malloc(sizeof("security.mac.") - 1 +
424 strlen(policyname) + sizeof(".enabled"));
425 if (mibname == NULL)
426 return (-1);
427 strcpy(mibname, "security.mac.");
428 strcat(mibname, policyname);
429 strcat(mibname, ".enabled");
430 siz = 5;
431 error = sysctlnametomib(mibname, mib, &siz);
432 free(mibname);
433 } else {
434 siz = 3;
435 error = sysctlnametomib("security.mac", mib, &siz);
436 }
437 if (error == -1) {
438 switch (errno) {
439 case ENOTDIR:
440 case ENOENT:
441 return (0);
442 default:
443 return (error);
444 }
445 }
446 return (1);
447 }
448