xref: /freebsd/sys/kern/kern_priv.c (revision 5c52a79884070364bfc920fb8e492cfac61ec72f)
1 /*-
2  * Copyright (c) 2006 nCircle Network Security, Inc.
3  * All rights reserved.
4  *
5  * This software was developed by Robert N. M. Watson for the TrustedBSD
6  * Project under contract to nCircle Network Security, Inc.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR, NCIRCLE NETWORK SECURITY,
21  * INC., OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
22  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
23  * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
24  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
25  * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
26  * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
27  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
28  */
29 
30 #include "opt_mac.h"
31 
32 #include <sys/cdefs.h>
33 __FBSDID("$FreeBSD$");
34 
35 #include <sys/param.h>
36 #include <sys/jail.h>
37 #include <sys/kernel.h>
38 #include <sys/priv.h>
39 #include <sys/proc.h>
40 #include <sys/sysctl.h>
41 #include <sys/systm.h>
42 
43 #include <security/mac/mac_framework.h>
44 
45 /*
46  * `suser_enabled' (which can be set by the security.bsd.suser_enabled
47  * sysctl) determines whether the system 'super-user' policy is in effect.  If
48  * it is nonzero, an effective uid of 0 connotes special privilege,
49  * overriding many mandatory and discretionary protections.  If it is zero,
50  * uid 0 is offered no special privilege in the kernel security policy.
51  * Setting it to zero may seriously impact the functionality of many existing
52  * userland programs, and should not be done without careful consideration of
53  * the consequences.
54  */
55 static int	suser_enabled = 1;
56 SYSCTL_INT(_security_bsd, OID_AUTO, suser_enabled, CTLFLAG_RW,
57     &suser_enabled, 0, "processes with uid 0 have privilege");
58 TUNABLE_INT("security.bsd.suser_enabled", &suser_enabled);
59 
60 /*
61  * Check a credential for privilege.  Lots of good reasons to deny privilege;
62  * only a few to grant it.
63  */
64 int
65 priv_check_cred(struct ucred *cred, int priv, int flags)
66 {
67 	int error;
68 
69 	KASSERT(PRIV_VALID(priv), ("priv_check_cred: invalid privilege %d",
70 	    priv));
71 
72 	/*
73 	 * We first evaluate policies that may deny the granting of
74 	 * privilege unilaterally.
75 	 */
76 #ifdef MAC
77 	error = mac_priv_check(cred, priv);
78 	if (error)
79 		return (error);
80 #endif
81 
82 	/*
83 	 * Jail policy will restrict certain privileges that may otherwise be
84 	 * be granted.
85 	 */
86 	error = prison_priv_check(cred, priv);
87 	if (error)
88 		return (error);
89 
90 	/*
91 	 * Having determined if privilege is restricted by various policies,
92 	 * now determine if privilege is granted.  At this point, any policy
93 	 * may grant privilege.  For now, we allow short-circuit boolean
94 	 * evaluation, so may not call all policies.  Perhaps we should.
95 	 *
96 	 * Superuser policy grants privilege based on the effective (or in
97 	 * the case of specific privileges, real) uid being 0.  We allow the
98 	 * superuser policy to be globally disabled, although this is
99 	 * currenty of limited utility.
100 	 */
101 	if (suser_enabled) {
102 		switch (priv) {
103 		case PRIV_MAXFILES:
104 		case PRIV_MAXPROC:
105 		case PRIV_PROC_LIMIT:
106 			if (cred->cr_ruid == 0)
107 				return (0);
108 			break;
109 
110 		default:
111 			if (cred->cr_uid == 0)
112 				return (0);
113 			break;
114 		}
115 	}
116 
117 	/*
118 	 * Now check with MAC, if enabled, to see if a policy module grants
119 	 * privilege.
120 	 */
121 #ifdef MAC
122 	if (mac_priv_grant(cred, priv) == 0)
123 		return (0);
124 #endif
125 	return (EPERM);
126 }
127 
128 int
129 priv_check(struct thread *td, int priv)
130 {
131 
132 	KASSERT(td == curthread, ("priv_check: td != curthread"));
133 
134 	return (priv_check_cred(td->td_ucred, priv, 0));
135 }
136