xref: /freebsd/sys/security/mac/mac_cred.c (revision 63a938566d524836885917d95bd491aa4400b181)
1 /*-
2  * Copyright (c) 1999-2002, 2008-2009 Robert N. M. Watson
3  * Copyright (c) 2001 Ilmar S. Habibulin
4  * Copyright (c) 2001-2003 Networks Associates Technology, Inc.
5  * Copyright (c) 2005 Samy Al Bahra
6  * Copyright (c) 2006 SPARTA, Inc.
7  * Copyright (c) 2008 Apple Inc.
8  * All rights reserved.
9  *
10  * This software was developed by Robert Watson and Ilmar Habibulin for the
11  * TrustedBSD Project.
12  *
13  * This software was developed for the FreeBSD Project in part by Network
14  * Associates Laboratories, the Security Research Division of Network
15  * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"),
16  * as part of the DARPA CHATS research program.
17  *
18  * This software was enhanced by SPARTA ISSO under SPAWAR contract
19  * N66001-04-C-6019 ("SEFOS").
20  *
21  * This software was developed at the University of Cambridge Computer
22  * Laboratory with support from a grant from Google, Inc.
23  *
24  * Redistribution and use in source and binary forms, with or without
25  * modification, are permitted provided that the following conditions
26  * are met:
27  * 1. Redistributions of source code must retain the above copyright
28  *    notice, this list of conditions and the following disclaimer.
29  * 2. Redistributions in binary form must reproduce the above copyright
30  *    notice, this list of conditions and the following disclaimer in the
31  *    documentation and/or other materials provided with the distribution.
32  *
33  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
34  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
35  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
36  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
37  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
38  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
39  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
40  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
41  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
42  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
43  * SUCH DAMAGE.
44  */
45 
46 #include <sys/cdefs.h>
47 __FBSDID("$FreeBSD$");
48 
49 #include "opt_mac.h"
50 
51 #include <sys/param.h>
52 #include <sys/condvar.h>
53 #include <sys/imgact.h>
54 #include <sys/kernel.h>
55 #include <sys/lock.h>
56 #include <sys/malloc.h>
57 #include <sys/mutex.h>
58 #include <sys/mac.h>
59 #include <sys/proc.h>
60 #include <sys/sbuf.h>
61 #include <sys/sdt.h>
62 #include <sys/systm.h>
63 #include <sys/vnode.h>
64 #include <sys/mount.h>
65 #include <sys/file.h>
66 #include <sys/namei.h>
67 #include <sys/sysctl.h>
68 
69 #include <vm/vm.h>
70 #include <vm/pmap.h>
71 #include <vm/vm_map.h>
72 #include <vm/vm_object.h>
73 
74 #include <security/mac/mac_framework.h>
75 #include <security/mac/mac_internal.h>
76 #include <security/mac/mac_policy.h>
77 
78 struct label *
79 mac_cred_label_alloc(void)
80 {
81 	struct label *label;
82 
83 	label = mac_labelzone_alloc(M_WAITOK);
84 	MAC_POLICY_PERFORM(cred_init_label, label);
85 	return (label);
86 }
87 
88 void
89 mac_cred_init(struct ucred *cred)
90 {
91 
92 	if (mac_labeled & MPC_OBJECT_CRED)
93 		cred->cr_label = mac_cred_label_alloc();
94 	else
95 		cred->cr_label = NULL;
96 }
97 
98 void
99 mac_cred_label_free(struct label *label)
100 {
101 
102 	MAC_POLICY_PERFORM_NOSLEEP(cred_destroy_label, label);
103 	mac_labelzone_free(label);
104 }
105 
106 void
107 mac_cred_destroy(struct ucred *cred)
108 {
109 
110 	if (cred->cr_label != NULL) {
111 		mac_cred_label_free(cred->cr_label);
112 		cred->cr_label = NULL;
113 	}
114 }
115 
116 /*
117  * When a thread becomes an NFS server daemon, its credential may need to be
118  * updated to reflect this so that policies can recognize when file system
119  * operations originate from the network.
120  *
121  * At some point, it would be desirable if the credential used for each NFS
122  * RPC could be set based on the RPC context (i.e., source system, etc) to
123  * provide more fine-grained access control.
124  */
125 void
126 mac_cred_associate_nfsd(struct ucred *cred)
127 {
128 
129 	MAC_POLICY_PERFORM_NOSLEEP(cred_associate_nfsd, cred);
130 }
131 
132 /*
133  * Initialize MAC label for the first kernel process, from which other kernel
134  * processes and threads are spawned.
135  */
136 void
137 mac_cred_create_swapper(struct ucred *cred)
138 {
139 
140 	MAC_POLICY_PERFORM_NOSLEEP(cred_create_swapper, cred);
141 }
142 
143 /*
144  * Initialize MAC label for the first userland process, from which other
145  * userland processes and threads are spawned.
146  */
147 void
148 mac_cred_create_init(struct ucred *cred)
149 {
150 
151 	MAC_POLICY_PERFORM_NOSLEEP(cred_create_init, cred);
152 }
153 
154 int
155 mac_cred_externalize_label(struct label *label, char *elements,
156     char *outbuf, size_t outbuflen)
157 {
158 	int error;
159 
160 	MAC_POLICY_EXTERNALIZE(cred, label, elements, outbuf, outbuflen);
161 
162 	return (error);
163 }
164 
165 int
166 mac_cred_internalize_label(struct label *label, char *string)
167 {
168 	int error;
169 
170 	MAC_POLICY_INTERNALIZE(cred, label, string);
171 
172 	return (error);
173 }
174 
175 /*
176  * When a new process is created, its label must be initialized.  Generally,
177  * this involves inheritance from the parent process, modulo possible deltas.
178  * This function allows that processing to take place.
179  */
180 void
181 mac_cred_copy(struct ucred *src, struct ucred *dest)
182 {
183 
184 	MAC_POLICY_PERFORM_NOSLEEP(cred_copy_label, src->cr_label,
185 	    dest->cr_label);
186 }
187 
188 /*
189  * When the subject's label changes, it may require revocation of privilege
190  * to mapped objects.  This can't be done on-the-fly later with a unified
191  * buffer cache.
192  */
193 void
194 mac_cred_relabel(struct ucred *cred, struct label *newlabel)
195 {
196 
197 	MAC_POLICY_PERFORM_NOSLEEP(cred_relabel, cred, newlabel);
198 }
199 
200 MAC_CHECK_PROBE_DEFINE2(cred_check_relabel, "struct ucred *",
201     "struct label *");
202 
203 int
204 mac_cred_check_relabel(struct ucred *cred, struct label *newlabel)
205 {
206 	int error;
207 
208 	MAC_POLICY_CHECK_NOSLEEP(cred_check_relabel, cred, newlabel);
209 	MAC_CHECK_PROBE2(cred_check_relabel, error, cred, newlabel);
210 
211 	return (error);
212 }
213 
214 MAC_CHECK_PROBE_DEFINE2(cred_check_setuid, "struct ucred *", "uid_t");
215 
216 int
217 mac_cred_check_setuid(struct ucred *cred, uid_t uid)
218 {
219 	int error;
220 
221 	MAC_POLICY_CHECK_NOSLEEP(cred_check_setuid, cred, uid);
222 	MAC_CHECK_PROBE2(cred_check_setuid, error, cred, uid);
223 
224 	return (error);
225 }
226 
227 MAC_CHECK_PROBE_DEFINE2(cred_check_seteuid, "struct ucred *", "uid_t");
228 
229 int
230 mac_cred_check_seteuid(struct ucred *cred, uid_t euid)
231 {
232 	int error;
233 
234 	MAC_POLICY_CHECK_NOSLEEP(cred_check_seteuid, cred, euid);
235 	MAC_CHECK_PROBE2(cred_check_seteuid, error, cred, euid);
236 
237 	return (error);
238 }
239 
240 MAC_CHECK_PROBE_DEFINE2(cred_check_setgid, "struct ucred *", "gid_t");
241 
242 int
243 mac_cred_check_setgid(struct ucred *cred, gid_t gid)
244 {
245 	int error;
246 
247 	MAC_POLICY_CHECK_NOSLEEP(cred_check_setgid, cred, gid);
248 	MAC_CHECK_PROBE2(cred_check_setgid, error, cred, gid);
249 
250 	return (error);
251 }
252 
253 MAC_CHECK_PROBE_DEFINE2(cred_check_setegid, "struct ucred *", "gid_t");
254 
255 int
256 mac_cred_check_setegid(struct ucred *cred, gid_t egid)
257 {
258 	int error;
259 
260 	MAC_POLICY_CHECK_NOSLEEP(cred_check_setegid, cred, egid);
261 	MAC_CHECK_PROBE2(cred_check_setegid, error, cred, egid);
262 
263 	return (error);
264 }
265 
266 MAC_CHECK_PROBE_DEFINE3(cred_check_setgroups, "struct ucred *", "int",
267     "gid_t *");
268 
269 int
270 mac_cred_check_setgroups(struct ucred *cred, int ngroups, gid_t *gidset)
271 {
272 	int error;
273 
274 	MAC_POLICY_CHECK_NOSLEEP(cred_check_setgroups, cred, ngroups, gidset);
275 	MAC_CHECK_PROBE3(cred_check_setgroups, error, cred, ngroups, gidset);
276 
277 	return (error);
278 }
279 
280 MAC_CHECK_PROBE_DEFINE3(cred_check_setreuid, "struct ucred *", "uid_t",
281     "uid_t");
282 
283 int
284 mac_cred_check_setreuid(struct ucred *cred, uid_t ruid, uid_t euid)
285 {
286 	int error;
287 
288 	MAC_POLICY_CHECK_NOSLEEP(cred_check_setreuid, cred, ruid, euid);
289 	MAC_CHECK_PROBE3(cred_check_setreuid, error, cred, ruid, euid);
290 
291 	return (error);
292 }
293 
294 MAC_CHECK_PROBE_DEFINE3(cred_check_setregid, "struct ucred *", "gid_t",
295     "gid_t");
296 
297 int
298 mac_cred_check_setregid(struct ucred *cred, gid_t rgid, gid_t egid)
299 {
300 	int error;
301 
302 	MAC_POLICY_CHECK_NOSLEEP(cred_check_setregid, cred, rgid, egid);
303 	MAC_CHECK_PROBE3(cred_check_setregid, error, cred, rgid, egid);
304 
305 	return (error);
306 }
307 
308 MAC_CHECK_PROBE_DEFINE4(cred_check_setresuid, "struct ucred *", "uid_t",
309     "uid_t", "uid_t");
310 
311 int
312 mac_cred_check_setresuid(struct ucred *cred, uid_t ruid, uid_t euid,
313     uid_t suid)
314 {
315 	int error;
316 
317 	MAC_POLICY_CHECK_NOSLEEP(cred_check_setresuid, cred, ruid, euid, suid);
318 	MAC_CHECK_PROBE4(cred_check_setresuid, error, cred, ruid, euid,
319 	    suid);
320 
321 	return (error);
322 }
323 
324 MAC_CHECK_PROBE_DEFINE4(cred_check_setresgid, "struct ucred *", "gid_t",
325     "gid_t", "gid_t");
326 
327 int
328 mac_cred_check_setresgid(struct ucred *cred, gid_t rgid, gid_t egid,
329     gid_t sgid)
330 {
331 	int error;
332 
333 	MAC_POLICY_CHECK_NOSLEEP(cred_check_setresgid, cred, rgid, egid, sgid);
334 	MAC_CHECK_PROBE4(cred_check_setresgid, error, cred, rgid, egid,
335 	    sgid);
336 
337 	return (error);
338 }
339 
340 MAC_CHECK_PROBE_DEFINE2(cred_check_visible, "struct ucred *",
341     "struct ucred *");
342 
343 int
344 mac_cred_check_visible(struct ucred *cr1, struct ucred *cr2)
345 {
346 	int error;
347 
348 	MAC_POLICY_CHECK_NOSLEEP(cred_check_visible, cr1, cr2);
349 	MAC_CHECK_PROBE2(cred_check_visible, error, cr1, cr2);
350 
351 	return (error);
352 }
353