xref: /freebsd/lib/libc/posix1e/mac.c (revision b61a573019428cbdc38ed03be9ecd2482011ea66)
1 /*-
2  * SPDX-License-Identifier: BSD-2-Clause
3  *
4  * Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson
5  * Copyright (c) 2002, 2003 Networks Associates Technology, Inc.
6  * All rights reserved.
7  *
8  * This software was developed by Robert Watson for the TrustedBSD Project.
9  *
10  * This software was developed for the FreeBSD Project in part by Network
11  * Associates Laboratories, the Security Research Division of Network
12  * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"),
13  * as part of the DARPA CHATS research program.
14  *
15  * Redistribution and use in source and binary forms, with or without
16  * modification, are permitted provided that the following conditions
17  * are met:
18  * 1. Redistributions of source code must retain the above copyright
19  *    notice, this list of conditions and the following disclaimer.
20  * 2. Redistributions in binary form must reproduce the above copyright
21  *    notice, this list of conditions and the following disclaimer in the
22  *    documentation and/or other materials provided with the distribution.
23  *
24  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
25  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
26  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
27  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
28  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
29  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
30  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
31  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
32  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
33  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34  * SUCH DAMAGE.
35  */
36 
37 #include <sys/cdefs.h>
38 __FBSDID("$FreeBSD$");
39 
40 #include <sys/types.h>
41 #include <sys/queue.h>
42 #include <sys/sysctl.h>
43 
44 #include <dlfcn.h>
45 #include <errno.h>
46 #include <limits.h>
47 #include <stdio.h>
48 #include <stdlib.h>
49 #include <string.h>
50 #include <unistd.h>
51 
52 #include <sys/mac.h>
53 
54 static int	internal_initialized;
55 
56 /*
57  * Maintain a list of default label preparations for various object
58  * types.  Each name will appear only once in the list.
59  *
60  * XXXMAC: Not thread-safe.
61  */
62 static LIST_HEAD(, label_default) label_default_head;
63 struct label_default {
64 	char				*ld_name;
65 	char				*ld_labels;
66 	LIST_ENTRY(label_default)	 ld_entries;
67 };
68 
69 static void
70 mac_destroy_labels(void)
71 {
72 	struct label_default *ld;
73 
74 	while ((ld = LIST_FIRST(&label_default_head))) {
75 		free(ld->ld_name);
76 		free(ld->ld_labels);
77 		LIST_REMOVE(ld, ld_entries);
78 		free(ld);
79 	}
80 }
81 
82 static void
83 mac_destroy_internal(void)
84 {
85 
86 	mac_destroy_labels();
87 
88 	internal_initialized = 0;
89 }
90 
91 static int
92 mac_add_type(const char *name, const char *labels)
93 {
94 	struct label_default *ld, *ld_new;
95 	char *name_dup, *labels_dup;
96 
97 	/*
98 	 * Speculatively allocate all the memory now to avoid allocating
99 	 * later when we will someday hold a mutex.
100 	 */
101 	name_dup = strdup(name);
102 	if (name_dup == NULL) {
103 		errno = ENOMEM;
104 		return (-1);
105 	}
106 	labels_dup = strdup(labels);
107 	if (labels_dup == NULL) {
108 		free(name_dup);
109 		errno = ENOMEM;
110 		return (-1);
111 	}
112 	ld_new = malloc(sizeof(*ld));
113 	if (ld_new == NULL) {
114 		free(name_dup);
115 		free(labels_dup);
116 		errno = ENOMEM;
117 		return (-1);
118 	}
119 
120 	/*
121 	 * If the type is already present, replace the current entry
122 	 * rather than add a new instance.
123 	 */
124 	for (ld = LIST_FIRST(&label_default_head); ld != NULL;
125 	    ld = LIST_NEXT(ld, ld_entries)) {
126 		if (strcmp(name, ld->ld_name) == 0)
127 			break;
128 	}
129 
130 	if (ld != NULL) {
131 		free(ld->ld_labels);
132 		ld->ld_labels = labels_dup;
133 		labels_dup = NULL;
134 	} else {
135 		ld = ld_new;
136 		ld->ld_name = name_dup;
137 		ld->ld_labels = labels_dup;
138 
139 		ld_new = NULL;
140 		name_dup = NULL;
141 		labels_dup = NULL;
142 
143 		LIST_INSERT_HEAD(&label_default_head, ld, ld_entries);
144 	}
145 
146 	if (name_dup != NULL)
147 		free(name_dup);
148 	if (labels_dup != NULL)
149 		free(labels_dup);
150 	if (ld_new != NULL)
151 		free(ld_new);
152 
153 	return (0);
154 }
155 
156 static char *
157 next_token(char **string)
158 {
159 	char *token;
160 
161 	token = strsep(string, " \t");
162 	while (token != NULL && *token == '\0')
163 		token = strsep(string, " \t");
164 
165 	return (token);
166 }
167 
168 static int
169 mac_init_internal(int ignore_errors)
170 {
171 	const char *filename;
172 	char line[LINE_MAX];
173 	FILE *file;
174 	int error;
175 
176 	error = 0;
177 
178 	LIST_INIT(&label_default_head);
179 
180 	filename = secure_getenv("MAC_CONFFILE");
181 	if (filename == NULL)
182 		filename = MAC_CONFFILE;
183 	file = fopen(filename, "re");
184 	if (file == NULL)
185 		return (0);
186 
187 	while (fgets(line, LINE_MAX, file)) {
188 		char *comment, *parse, *statement;
189 
190 		if (line[strlen(line)-1] == '\n')
191 			line[strlen(line)-1] = '\0';
192 		else {
193 			if (ignore_errors)
194 				continue;
195 			fclose(file);
196 			error = EINVAL;
197 			goto just_return;
198 		}
199 
200 		/* Remove any comment. */
201 		comment = line;
202 		parse = strsep(&comment, "#");
203 
204 		/* Blank lines OK. */
205 		statement = next_token(&parse);
206 		if (statement == NULL)
207 			continue;
208 
209 		if (strcmp(statement, "default_labels") == 0) {
210 			char *name, *labels;
211 
212 			name = next_token(&parse);
213 			labels = next_token(&parse);
214 			if (name == NULL || labels == NULL ||
215 			    next_token(&parse) != NULL) {
216 				if (ignore_errors)
217 					continue;
218 				error = EINVAL;
219 				fclose(file);
220 				goto just_return;
221 			}
222 
223 			if (mac_add_type(name, labels) == -1) {
224 				if (ignore_errors)
225 					continue;
226 				fclose(file);
227 				goto just_return;
228 			}
229 		} else if (strcmp(statement, "default_ifnet_labels") == 0 ||
230 		    strcmp(statement, "default_file_labels") == 0 ||
231 		    strcmp(statement, "default_process_labels") == 0) {
232 			char *labels, *type;
233 
234 			if (strcmp(statement, "default_ifnet_labels") == 0)
235 				type = "ifnet";
236 			else if (strcmp(statement, "default_file_labels") == 0)
237 				type = "file";
238 			else if (strcmp(statement, "default_process_labels") ==
239 			    0)
240 				type = "process";
241 
242 			labels = next_token(&parse);
243 			if (labels == NULL || next_token(&parse) != NULL) {
244 				if (ignore_errors)
245 					continue;
246 				error = EINVAL;
247 				fclose(file);
248 				goto just_return;
249 			}
250 
251 			if (mac_add_type(type, labels) == -1) {
252 				if (ignore_errors)
253 					continue;
254 				fclose(file);
255 				goto just_return;
256 			}
257 		} else {
258 			if (ignore_errors)
259 				continue;
260 			fclose(file);
261 			error = EINVAL;
262 			goto just_return;
263 		}
264 	}
265 
266 	fclose(file);
267 
268 	internal_initialized = 1;
269 
270 just_return:
271 	if (error != 0)
272 		mac_destroy_internal();
273 	return (error);
274 }
275 
276 static int
277 mac_maybe_init_internal(void)
278 {
279 
280 	if (!internal_initialized)
281 		return (mac_init_internal(1));
282 	else
283 		return (0);
284 }
285 
286 int
287 mac_reload(void)
288 {
289 
290 	if (internal_initialized)
291 		mac_destroy_internal();
292 	return (mac_init_internal(0));
293 }
294 
295 int
296 mac_free(struct mac *mac)
297 {
298 
299 	if (mac->m_string != NULL)
300 		free(mac->m_string);
301 	free(mac);
302 
303 	return (0);
304 }
305 
306 int
307 mac_from_text(struct mac **mac, const char *text)
308 {
309 
310 	*mac = (struct mac *) malloc(sizeof(**mac));
311 	if (*mac == NULL)
312 		return (ENOMEM);
313 
314 	(*mac)->m_string = strdup(text);
315 	if ((*mac)->m_string == NULL) {
316 		free(*mac);
317 		*mac = NULL;
318 		return (ENOMEM);
319 	}
320 
321 	(*mac)->m_buflen = strlen((*mac)->m_string)+1;
322 
323 	return (0);
324 }
325 
326 int
327 mac_to_text(struct mac *mac, char **text)
328 {
329 
330 	*text = strdup(mac->m_string);
331 	if (*text == NULL)
332 		return (ENOMEM);
333 	return (0);
334 }
335 
336 int
337 mac_prepare(struct mac **mac, const char *elements)
338 {
339 
340 	if (strlen(elements) >= MAC_MAX_LABEL_BUF_LEN)
341 		return (EINVAL);
342 
343 	*mac = (struct mac *) malloc(sizeof(**mac));
344 	if (*mac == NULL)
345 		return (ENOMEM);
346 
347 	(*mac)->m_string = malloc(MAC_MAX_LABEL_BUF_LEN);
348 	if ((*mac)->m_string == NULL) {
349 		free(*mac);
350 		*mac = NULL;
351 		return (ENOMEM);
352 	}
353 
354 	strcpy((*mac)->m_string, elements);
355 	(*mac)->m_buflen = MAC_MAX_LABEL_BUF_LEN;
356 
357 	return (0);
358 }
359 
360 int
361 mac_prepare_type(struct mac **mac, const char *name)
362 {
363 	struct label_default *ld;
364 	int error;
365 
366 	error = mac_maybe_init_internal();
367 	if (error != 0)
368 		return (error);
369 
370 	for (ld = LIST_FIRST(&label_default_head); ld != NULL;
371 	    ld = LIST_NEXT(ld, ld_entries)) {
372 		if (strcmp(name, ld->ld_name) == 0)
373 			return (mac_prepare(mac, ld->ld_labels));
374 	}
375 
376 	errno = ENOENT;
377 	return (-1);		/* XXXMAC: ENOLABEL */
378 }
379 
380 int
381 mac_prepare_ifnet_label(struct mac **mac)
382 {
383 
384 	return (mac_prepare_type(mac, "ifnet"));
385 }
386 
387 int
388 mac_prepare_file_label(struct mac **mac)
389 {
390 
391 	return (mac_prepare_type(mac, "file"));
392 }
393 
394 int
395 mac_prepare_packet_label(struct mac **mac)
396 {
397 
398 	return (mac_prepare_type(mac, "packet"));
399 }
400 
401 int
402 mac_prepare_process_label(struct mac **mac)
403 {
404 
405 	return (mac_prepare_type(mac, "process"));
406 }
407 
408 /*
409  * Simply test whether the TrustedBSD/MAC MIB tree is present; if so,
410  * return 1 to indicate that the system has MAC enabled overall or for
411  * a given policy.
412  */
413 int
414 mac_is_present(const char *policyname)
415 {
416 	int mib[5];
417 	size_t siz;
418 	char *mibname;
419 	int error;
420 
421 	if (policyname != NULL) {
422 		if (policyname[strcspn(policyname, ".=")] != '\0') {
423 			errno = EINVAL;
424 			return (-1);
425 		}
426 		mibname = malloc(sizeof("security.mac.") - 1 +
427 		    strlen(policyname) + sizeof(".enabled"));
428 		if (mibname == NULL)
429 			return (-1);
430 		strcpy(mibname, "security.mac.");
431 		strcat(mibname, policyname);
432 		strcat(mibname, ".enabled");
433 		siz = 5;
434 		error = sysctlnametomib(mibname, mib, &siz);
435 		free(mibname);
436 	} else {
437 		siz = 3;
438 		error = sysctlnametomib("security.mac", mib, &siz);
439 	}
440 	if (error == -1) {
441 		switch (errno) {
442 		case ENOTDIR:
443 		case ENOENT:
444 			return (0);
445 		default:
446 			return (error);
447 		}
448 	}
449 	return (1);
450 }
451