1 /*- 2 * Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson 3 * Copyright (c) 2001 Ilmar S. Habibulin 4 * Copyright (c) 2001, 2002 Networks Associates Technology, Inc. 5 * All rights reserved. 6 * 7 * This software was developed by Robert Watson and Ilmar Habibulin for the 8 * TrustedBSD Project. 9 * 10 * This software was developed for the FreeBSD Project in part by Network 11 * Associates Laboratories, the Security Research Division of Network 12 * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), 13 * as part of the DARPA CHATS research program. 14 * 15 * Redistribution and use in source and binary forms, with or without 16 * modification, are permitted provided that the following conditions 17 * are met: 18 * 1. Redistributions of source code must retain the above copyright 19 * notice, this list of conditions and the following disclaimer. 20 * 2. Redistributions in binary form must reproduce the above copyright 21 * notice, this list of conditions and the following disclaimer in the 22 * documentation and/or other materials provided with the distribution. 23 * 24 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 25 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 26 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 27 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 28 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 29 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 30 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 31 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 32 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 33 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 34 * SUCH DAMAGE. 35 * 36 * $FreeBSD$ 37 */ 38 /* 39 * Developed by the TrustedBSD Project. 40 * 41 * Framework for extensible kernel access control. Kernel and userland 42 * interface to the framework, policy registration and composition. 43 */ 44 45 #include "opt_mac.h" 46 #include "opt_devfs.h" 47 48 #include <sys/param.h> 49 #include <sys/extattr.h> 50 #include <sys/kernel.h> 51 #include <sys/lock.h> 52 #include <sys/malloc.h> 53 #include <sys/mutex.h> 54 #include <sys/mac.h> 55 #include <sys/module.h> 56 #include <sys/proc.h> 57 #include <sys/systm.h> 58 #include <sys/sysproto.h> 59 #include <sys/sysent.h> 60 #include <sys/vnode.h> 61 #include <sys/mount.h> 62 #include <sys/file.h> 63 #include <sys/namei.h> 64 #include <sys/socket.h> 65 #include <sys/pipe.h> 66 #include <sys/socketvar.h> 67 #include <sys/sysctl.h> 68 69 #include <vm/vm.h> 70 #include <vm/pmap.h> 71 #include <vm/vm_map.h> 72 #include <vm/vm_object.h> 73 74 #include <sys/mac_policy.h> 75 76 #include <fs/devfs/devfs.h> 77 78 #include <net/bpfdesc.h> 79 #include <net/if.h> 80 #include <net/if_var.h> 81 82 #include <netinet/in.h> 83 #include <netinet/ip_var.h> 84 85 #ifdef MAC 86 87 /* 88 * Declare that the kernel provides MAC support, version 1. This permits 89 * modules to refuse to be loaded if the necessary support isn't present, 90 * even if it's pre-boot. 91 */ 92 MODULE_VERSION(kernel_mac_support, 1); 93 94 SYSCTL_DECL(_security); 95 96 SYSCTL_NODE(_security, OID_AUTO, mac, CTLFLAG_RW, 0, 97 "TrustedBSD MAC policy controls"); 98 99 #if MAC_MAX_POLICIES > 32 100 #error "MAC_MAX_POLICIES too large" 101 #endif 102 103 static unsigned int mac_max_policies = MAC_MAX_POLICIES; 104 static unsigned int mac_policy_offsets_free = (1 << MAC_MAX_POLICIES) - 1; 105 SYSCTL_UINT(_security_mac, OID_AUTO, max_policies, CTLFLAG_RD, 106 &mac_max_policies, 0, ""); 107 108 /* 109 * Has the kernel started generating labeled objects yet? All read/write 110 * access to this variable is serialized during the boot process. Following 111 * the end of serialization, we don't update this flag; no locking. 112 */ 113 static int mac_late = 0; 114 115 /* 116 * Warn about EA transactions only the first time they happen. 117 * Weak coherency, no locking. 118 */ 119 static int ea_warn_once = 0; 120 121 static int mac_enforce_fs = 1; 122 SYSCTL_INT(_security_mac, OID_AUTO, enforce_fs, CTLFLAG_RW, 123 &mac_enforce_fs, 0, "Enforce MAC policy on file system objects"); 124 TUNABLE_INT("security.mac.enforce_fs", &mac_enforce_fs); 125 126 static int mac_enforce_network = 1; 127 SYSCTL_INT(_security_mac, OID_AUTO, enforce_network, CTLFLAG_RW, 128 &mac_enforce_network, 0, "Enforce MAC policy on network packets"); 129 TUNABLE_INT("security.mac.enforce_network", &mac_enforce_network); 130 131 static int mac_enforce_pipe = 1; 132 SYSCTL_INT(_security_mac, OID_AUTO, enforce_pipe, CTLFLAG_RW, 133 &mac_enforce_pipe, 0, "Enforce MAC policy on pipe operations"); 134 TUNABLE_INT("security.mac.enforce_pipe", &mac_enforce_pipe); 135 136 static int mac_enforce_process = 1; 137 SYSCTL_INT(_security_mac, OID_AUTO, enforce_process, CTLFLAG_RW, 138 &mac_enforce_process, 0, "Enforce MAC policy on inter-process operations"); 139 TUNABLE_INT("security.mac.enforce_process", &mac_enforce_process); 140 141 static int mac_enforce_socket = 1; 142 SYSCTL_INT(_security_mac, OID_AUTO, enforce_socket, CTLFLAG_RW, 143 &mac_enforce_socket, 0, "Enforce MAC policy on socket operations"); 144 TUNABLE_INT("security.mac.enforce_socket", &mac_enforce_socket); 145 146 static int mac_enforce_system = 1; 147 SYSCTL_INT(_security_mac, OID_AUTO, enforce_system, CTLFLAG_RW, 148 &mac_enforce_system, 0, "Enforce MAC policy on system operations"); 149 TUNABLE_INT("security.mac.enforce_system", &mac_enforce_system); 150 151 static int mac_enforce_vm = 1; 152 SYSCTL_INT(_security_mac, OID_AUTO, enforce_vm, CTLFLAG_RW, 153 &mac_enforce_vm, 0, "Enforce MAC policy on vm operations"); 154 TUNABLE_INT("security.mac.enforce_vm", &mac_enforce_vm); 155 156 static int mac_cache_fslabel_in_vnode = 1; 157 SYSCTL_INT(_security_mac, OID_AUTO, cache_fslabel_in_vnode, CTLFLAG_RW, 158 &mac_cache_fslabel_in_vnode, 0, "Cache mount fslabel in vnode"); 159 TUNABLE_INT("security.mac.cache_fslabel_in_vnode", 160 &mac_cache_fslabel_in_vnode); 161 162 static int mac_mmap_revocation = 1; 163 SYSCTL_INT(_security_mac, OID_AUTO, mmap_revocation, CTLFLAG_RW, 164 &mac_mmap_revocation, 0, "Revoke mmap access to files on subject " 165 "relabel"); 166 static int mac_mmap_revocation_via_cow = 0; 167 SYSCTL_INT(_security_mac, OID_AUTO, mmap_revocation_via_cow, CTLFLAG_RW, 168 &mac_mmap_revocation_via_cow, 0, "Revoke mmap access to files via " 169 "copy-on-write semantics, or by removing all write access"); 170 171 #ifdef MAC_DEBUG 172 SYSCTL_NODE(_security_mac, OID_AUTO, debug, CTLFLAG_RW, 0, 173 "TrustedBSD MAC debug info"); 174 175 static int mac_debug_label_fallback = 0; 176 SYSCTL_INT(_security_mac_debug, OID_AUTO, label_fallback, CTLFLAG_RW, 177 &mac_debug_label_fallback, 0, "Filesystems should fall back to fs label" 178 "when label is corrupted."); 179 TUNABLE_INT("security.mac.debug_label_fallback", 180 &mac_debug_label_fallback); 181 182 SYSCTL_NODE(_security_mac_debug, OID_AUTO, counters, CTLFLAG_RW, 0, 183 "TrustedBSD MAC object counters"); 184 185 static unsigned int nmacmbufs, nmaccreds, nmacifnets, nmacbpfdescs, 186 nmacsockets, nmacmounts, nmactemp, nmacvnodes, nmacdevfsdirents, 187 nmacipqs, nmacpipes; 188 189 SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, mbufs, CTLFLAG_RD, 190 &nmacmbufs, 0, "number of mbufs in use"); 191 SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, creds, CTLFLAG_RD, 192 &nmaccreds, 0, "number of ucreds in use"); 193 SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, ifnets, CTLFLAG_RD, 194 &nmacifnets, 0, "number of ifnets in use"); 195 SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, ipqs, CTLFLAG_RD, 196 &nmacipqs, 0, "number of ipqs in use"); 197 SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, bpfdescs, CTLFLAG_RD, 198 &nmacbpfdescs, 0, "number of bpfdescs in use"); 199 SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, sockets, CTLFLAG_RD, 200 &nmacsockets, 0, "number of sockets in use"); 201 SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, pipes, CTLFLAG_RD, 202 &nmacpipes, 0, "number of pipes in use"); 203 SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, mounts, CTLFLAG_RD, 204 &nmacmounts, 0, "number of mounts in use"); 205 SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, temp, CTLFLAG_RD, 206 &nmactemp, 0, "number of temporary labels in use"); 207 SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, vnodes, CTLFLAG_RD, 208 &nmacvnodes, 0, "number of vnodes in use"); 209 SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, devfsdirents, CTLFLAG_RD, 210 &nmacdevfsdirents, 0, "number of devfs dirents inuse"); 211 #endif 212 213 static int error_select(int error1, int error2); 214 static int mac_policy_register(struct mac_policy_conf *mpc); 215 static int mac_policy_unregister(struct mac_policy_conf *mpc); 216 217 static void mac_check_vnode_mmap_downgrade(struct ucred *cred, 218 struct vnode *vp, int *prot); 219 static void mac_cred_mmapped_drop_perms_recurse(struct thread *td, 220 struct ucred *cred, struct vm_map *map); 221 222 static void mac_destroy_socket_label(struct label *label); 223 224 static int mac_setlabel_vnode_extattr(struct ucred *cred, 225 struct vnode *vp, struct label *intlabel); 226 227 228 MALLOC_DEFINE(M_MACOPVEC, "macopvec", "MAC policy operation vector"); 229 MALLOC_DEFINE(M_MACPIPELABEL, "macpipelabel", "MAC labels for pipes"); 230 MALLOC_DEFINE(M_MACTEMP, "mactemp", "MAC temporary label storage"); 231 232 /* 233 * mac_policy_list_lock protects the consistency of 'mac_policy_list', 234 * the linked list of attached policy modules. Read-only consumers of 235 * the list must acquire a shared lock for the duration of their use; 236 * writers must acquire an exclusive lock. Note that for compound 237 * operations, locks should be held for the entire compound operation, 238 * and that this is not yet done for relabel requests. 239 */ 240 static struct mtx mac_policy_list_lock; 241 static LIST_HEAD(, mac_policy_conf) mac_policy_list; 242 static int mac_policy_list_busy; 243 #define MAC_POLICY_LIST_LOCKINIT() mtx_init(&mac_policy_list_lock, \ 244 "mac_policy_list_lock", NULL, MTX_DEF); 245 #define MAC_POLICY_LIST_LOCK() mtx_lock(&mac_policy_list_lock); 246 #define MAC_POLICY_LIST_UNLOCK() mtx_unlock(&mac_policy_list_lock); 247 248 #define MAC_POLICY_LIST_BUSY() do { \ 249 MAC_POLICY_LIST_LOCK(); \ 250 mac_policy_list_busy++; \ 251 MAC_POLICY_LIST_UNLOCK(); \ 252 } while (0) 253 254 #define MAC_POLICY_LIST_UNBUSY() do { \ 255 MAC_POLICY_LIST_LOCK(); \ 256 mac_policy_list_busy--; \ 257 if (mac_policy_list_busy < 0) \ 258 panic("Extra mac_policy_list_busy--"); \ 259 MAC_POLICY_LIST_UNLOCK(); \ 260 } while (0) 261 262 /* 263 * MAC_CHECK performs the designated check by walking the policy 264 * module list and checking with each as to how it feels about the 265 * request. Note that it returns its value via 'error' in the scope 266 * of the caller. 267 */ 268 #define MAC_CHECK(check, args...) do { \ 269 struct mac_policy_conf *mpc; \ 270 \ 271 error = 0; \ 272 MAC_POLICY_LIST_BUSY(); \ 273 LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { \ 274 if (mpc->mpc_ops->mpo_ ## check != NULL) \ 275 error = error_select( \ 276 mpc->mpc_ops->mpo_ ## check (args), \ 277 error); \ 278 } \ 279 MAC_POLICY_LIST_UNBUSY(); \ 280 } while (0) 281 282 /* 283 * MAC_BOOLEAN performs the designated boolean composition by walking 284 * the module list, invoking each instance of the operation, and 285 * combining the results using the passed C operator. Note that it 286 * returns its value via 'result' in the scope of the caller, which 287 * should be initialized by the caller in a meaningful way to get 288 * a meaningful result. 289 */ 290 #define MAC_BOOLEAN(operation, composition, args...) do { \ 291 struct mac_policy_conf *mpc; \ 292 \ 293 MAC_POLICY_LIST_BUSY(); \ 294 LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { \ 295 if (mpc->mpc_ops->mpo_ ## operation != NULL) \ 296 result = result composition \ 297 mpc->mpc_ops->mpo_ ## operation (args); \ 298 } \ 299 MAC_POLICY_LIST_UNBUSY(); \ 300 } while (0) 301 302 #define MAC_EXTERNALIZE(type, label, elementlist, outbuf, \ 303 outbuflen) do { \ 304 char *curptr, *curptr_start, *element_name, *element_temp; \ 305 size_t left, left_start, len; \ 306 int claimed, first, first_start, ignorenotfound; \ 307 \ 308 error = 0; \ 309 element_temp = elementlist; \ 310 curptr = outbuf; \ 311 curptr[0] = '\0'; \ 312 left = outbuflen; \ 313 first = 1; \ 314 while ((element_name = strsep(&element_temp, ",")) != NULL) { \ 315 curptr_start = curptr; \ 316 left_start = left; \ 317 first_start = first; \ 318 if (element_name[0] == '?') { \ 319 element_name++; \ 320 ignorenotfound = 1; \ 321 } else \ 322 ignorenotfound = 0; \ 323 claimed = 0; \ 324 if (first) { \ 325 len = snprintf(curptr, left, "%s/", \ 326 element_name); \ 327 first = 0; \ 328 } else \ 329 len = snprintf(curptr, left, ",%s/", \ 330 element_name); \ 331 if (len >= left) { \ 332 error = EINVAL; /* XXXMAC: E2BIG */ \ 333 break; \ 334 } \ 335 curptr += len; \ 336 left -= len; \ 337 \ 338 MAC_CHECK(externalize_ ## type, label, element_name, \ 339 curptr, left, &len, &claimed); \ 340 if (error) \ 341 break; \ 342 if (claimed == 1) { \ 343 if (len >= outbuflen) { \ 344 error = EINVAL; /* XXXMAC: E2BIG */ \ 345 break; \ 346 } \ 347 curptr += len; \ 348 left -= len; \ 349 } else if (claimed == 0 && ignorenotfound) { \ 350 /* \ 351 * Revert addition of the label element \ 352 * name. \ 353 */ \ 354 curptr = curptr_start; \ 355 *curptr = '\0'; \ 356 left = left_start; \ 357 first = first_start; \ 358 } else { \ 359 error = EINVAL; /* XXXMAC: ENOLABEL */ \ 360 break; \ 361 } \ 362 } \ 363 } while (0) 364 365 #define MAC_INTERNALIZE(type, label, instring) do { \ 366 char *element, *element_name, *element_data; \ 367 int claimed; \ 368 \ 369 error = 0; \ 370 element = instring; \ 371 while ((element_name = strsep(&element, ",")) != NULL) { \ 372 element_data = element_name; \ 373 element_name = strsep(&element_data, "/"); \ 374 if (element_data == NULL) { \ 375 error = EINVAL; \ 376 break; \ 377 } \ 378 claimed = 0; \ 379 MAC_CHECK(internalize_ ## type, label, element_name, \ 380 element_data, &claimed); \ 381 if (error) \ 382 break; \ 383 if (claimed != 1) { \ 384 /* XXXMAC: Another error here? */ \ 385 error = EINVAL; \ 386 break; \ 387 } \ 388 } \ 389 } while (0) 390 391 /* 392 * MAC_PERFORM performs the designated operation by walking the policy 393 * module list and invoking that operation for each policy. 394 */ 395 #define MAC_PERFORM(operation, args...) do { \ 396 struct mac_policy_conf *mpc; \ 397 \ 398 MAC_POLICY_LIST_BUSY(); \ 399 LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { \ 400 if (mpc->mpc_ops->mpo_ ## operation != NULL) \ 401 mpc->mpc_ops->mpo_ ## operation (args); \ 402 } \ 403 MAC_POLICY_LIST_UNBUSY(); \ 404 } while (0) 405 406 /* 407 * Initialize the MAC subsystem, including appropriate SMP locks. 408 */ 409 static void 410 mac_init(void) 411 { 412 413 LIST_INIT(&mac_policy_list); 414 MAC_POLICY_LIST_LOCKINIT(); 415 } 416 417 /* 418 * For the purposes of modules that want to know if they were loaded 419 * "early", set the mac_late flag once we've processed modules either 420 * linked into the kernel, or loaded before the kernel startup. 421 */ 422 static void 423 mac_late_init(void) 424 { 425 426 mac_late = 1; 427 } 428 429 /* 430 * Allow MAC policy modules to register during boot, etc. 431 */ 432 int 433 mac_policy_modevent(module_t mod, int type, void *data) 434 { 435 struct mac_policy_conf *mpc; 436 int error; 437 438 error = 0; 439 mpc = (struct mac_policy_conf *) data; 440 441 switch (type) { 442 case MOD_LOAD: 443 if (mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_NOTLATE && 444 mac_late) { 445 printf("mac_policy_modevent: can't load %s policy " 446 "after booting\n", mpc->mpc_name); 447 error = EBUSY; 448 break; 449 } 450 error = mac_policy_register(mpc); 451 break; 452 case MOD_UNLOAD: 453 /* Don't unregister the module if it was never registered. */ 454 if ((mpc->mpc_runtime_flags & MPC_RUNTIME_FLAG_REGISTERED) 455 != 0) 456 error = mac_policy_unregister(mpc); 457 else 458 error = 0; 459 break; 460 default: 461 break; 462 } 463 464 return (error); 465 } 466 467 static int 468 mac_policy_register(struct mac_policy_conf *mpc) 469 { 470 struct mac_policy_conf *tmpc; 471 int slot; 472 473 MAC_POLICY_LIST_LOCK(); 474 if (mac_policy_list_busy > 0) { 475 MAC_POLICY_LIST_UNLOCK(); 476 return (EBUSY); 477 } 478 LIST_FOREACH(tmpc, &mac_policy_list, mpc_list) { 479 if (strcmp(tmpc->mpc_name, mpc->mpc_name) == 0) { 480 MAC_POLICY_LIST_UNLOCK(); 481 return (EEXIST); 482 } 483 } 484 if (mpc->mpc_field_off != NULL) { 485 slot = ffs(mac_policy_offsets_free); 486 if (slot == 0) { 487 MAC_POLICY_LIST_UNLOCK(); 488 return (ENOMEM); 489 } 490 slot--; 491 mac_policy_offsets_free &= ~(1 << slot); 492 *mpc->mpc_field_off = slot; 493 } 494 mpc->mpc_runtime_flags |= MPC_RUNTIME_FLAG_REGISTERED; 495 LIST_INSERT_HEAD(&mac_policy_list, mpc, mpc_list); 496 497 /* Per-policy initialization. */ 498 if (mpc->mpc_ops->mpo_init != NULL) 499 (*(mpc->mpc_ops->mpo_init))(mpc); 500 MAC_POLICY_LIST_UNLOCK(); 501 502 printf("Security policy loaded: %s (%s)\n", mpc->mpc_fullname, 503 mpc->mpc_name); 504 505 return (0); 506 } 507 508 static int 509 mac_policy_unregister(struct mac_policy_conf *mpc) 510 { 511 512 /* 513 * If we fail the load, we may get a request to unload. Check 514 * to see if we did the run-time registration, and if not, 515 * silently succeed. 516 */ 517 MAC_POLICY_LIST_LOCK(); 518 if ((mpc->mpc_runtime_flags & MPC_RUNTIME_FLAG_REGISTERED) == 0) { 519 MAC_POLICY_LIST_UNLOCK(); 520 return (0); 521 } 522 #if 0 523 /* 524 * Don't allow unloading modules with private data. 525 */ 526 if (mpc->mpc_field_off != NULL) { 527 MAC_POLICY_LIST_UNLOCK(); 528 return (EBUSY); 529 } 530 #endif 531 /* 532 * Only allow the unload to proceed if the module is unloadable 533 * by its own definition. 534 */ 535 if ((mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_UNLOADOK) == 0) { 536 MAC_POLICY_LIST_UNLOCK(); 537 return (EBUSY); 538 } 539 /* 540 * Right now, we EBUSY if the list is in use. In the future, 541 * for reliability reasons, we might want to sleep and wakeup 542 * later to try again. 543 */ 544 if (mac_policy_list_busy > 0) { 545 MAC_POLICY_LIST_UNLOCK(); 546 return (EBUSY); 547 } 548 if (mpc->mpc_ops->mpo_destroy != NULL) 549 (*(mpc->mpc_ops->mpo_destroy))(mpc); 550 551 LIST_REMOVE(mpc, mpc_list); 552 MAC_POLICY_LIST_UNLOCK(); 553 554 mpc->mpc_runtime_flags &= ~MPC_RUNTIME_FLAG_REGISTERED; 555 556 printf("Security policy unload: %s (%s)\n", mpc->mpc_fullname, 557 mpc->mpc_name); 558 559 return (0); 560 } 561 562 /* 563 * Define an error value precedence, and given two arguments, selects the 564 * value with the higher precedence. 565 */ 566 static int 567 error_select(int error1, int error2) 568 { 569 570 /* Certain decision-making errors take top priority. */ 571 if (error1 == EDEADLK || error2 == EDEADLK) 572 return (EDEADLK); 573 574 /* Invalid arguments should be reported where possible. */ 575 if (error1 == EINVAL || error2 == EINVAL) 576 return (EINVAL); 577 578 /* Precedence goes to "visibility", with both process and file. */ 579 if (error1 == ESRCH || error2 == ESRCH) 580 return (ESRCH); 581 582 if (error1 == ENOENT || error2 == ENOENT) 583 return (ENOENT); 584 585 /* Precedence goes to DAC/MAC protections. */ 586 if (error1 == EACCES || error2 == EACCES) 587 return (EACCES); 588 589 /* Precedence goes to privilege. */ 590 if (error1 == EPERM || error2 == EPERM) 591 return (EPERM); 592 593 /* Precedence goes to error over success; otherwise, arbitrary. */ 594 if (error1 != 0) 595 return (error1); 596 return (error2); 597 } 598 599 static void 600 mac_init_label(struct label *label) 601 { 602 603 bzero(label, sizeof(*label)); 604 label->l_flags = MAC_FLAG_INITIALIZED; 605 } 606 607 static void 608 mac_destroy_label(struct label *label) 609 { 610 611 KASSERT(label->l_flags & MAC_FLAG_INITIALIZED, 612 ("destroying uninitialized label")); 613 614 bzero(label, sizeof(*label)); 615 /* implicit: label->l_flags &= ~MAC_FLAG_INITIALIZED; */ 616 } 617 618 void 619 mac_init_bpfdesc(struct bpf_d *bpf_d) 620 { 621 622 mac_init_label(&bpf_d->bd_label); 623 MAC_PERFORM(init_bpfdesc_label, &bpf_d->bd_label); 624 #ifdef MAC_DEBUG 625 atomic_add_int(&nmacbpfdescs, 1); 626 #endif 627 } 628 629 static void 630 mac_init_cred_label(struct label *label) 631 { 632 633 mac_init_label(label); 634 MAC_PERFORM(init_cred_label, label); 635 #ifdef MAC_DEBUG 636 atomic_add_int(&nmaccreds, 1); 637 #endif 638 } 639 640 void 641 mac_init_cred(struct ucred *cred) 642 { 643 644 mac_init_cred_label(&cred->cr_label); 645 } 646 647 void 648 mac_init_devfsdirent(struct devfs_dirent *de) 649 { 650 651 mac_init_label(&de->de_label); 652 MAC_PERFORM(init_devfsdirent_label, &de->de_label); 653 #ifdef MAC_DEBUG 654 atomic_add_int(&nmacdevfsdirents, 1); 655 #endif 656 } 657 658 static void 659 mac_init_ifnet_label(struct label *label) 660 { 661 662 mac_init_label(label); 663 MAC_PERFORM(init_ifnet_label, label); 664 #ifdef MAC_DEBUG 665 atomic_add_int(&nmacifnets, 1); 666 #endif 667 } 668 669 void 670 mac_init_ifnet(struct ifnet *ifp) 671 { 672 673 mac_init_ifnet_label(&ifp->if_label); 674 } 675 676 void 677 mac_init_ipq(struct ipq *ipq) 678 { 679 680 mac_init_label(&ipq->ipq_label); 681 MAC_PERFORM(init_ipq_label, &ipq->ipq_label); 682 #ifdef MAC_DEBUG 683 atomic_add_int(&nmacipqs, 1); 684 #endif 685 } 686 687 int 688 mac_init_mbuf(struct mbuf *m, int flag) 689 { 690 int error; 691 692 KASSERT(m->m_flags & M_PKTHDR, ("mac_init_mbuf on non-header mbuf")); 693 694 mac_init_label(&m->m_pkthdr.label); 695 696 MAC_CHECK(init_mbuf_label, &m->m_pkthdr.label, flag); 697 if (error) { 698 MAC_PERFORM(destroy_mbuf_label, &m->m_pkthdr.label); 699 mac_destroy_label(&m->m_pkthdr.label); 700 } 701 702 #ifdef MAC_DEBUG 703 if (error == 0) 704 atomic_add_int(&nmacmbufs, 1); 705 #endif 706 return (error); 707 } 708 709 void 710 mac_init_mount(struct mount *mp) 711 { 712 713 mac_init_label(&mp->mnt_mntlabel); 714 mac_init_label(&mp->mnt_fslabel); 715 MAC_PERFORM(init_mount_label, &mp->mnt_mntlabel); 716 MAC_PERFORM(init_mount_fs_label, &mp->mnt_fslabel); 717 #ifdef MAC_DEBUG 718 atomic_add_int(&nmacmounts, 1); 719 #endif 720 } 721 722 static void 723 mac_init_pipe_label(struct label *label) 724 { 725 726 mac_init_label(label); 727 MAC_PERFORM(init_pipe_label, label); 728 #ifdef MAC_DEBUG 729 atomic_add_int(&nmacpipes, 1); 730 #endif 731 } 732 733 void 734 mac_init_pipe(struct pipe *pipe) 735 { 736 struct label *label; 737 738 label = malloc(sizeof(struct label), M_MACPIPELABEL, M_ZERO|M_WAITOK); 739 pipe->pipe_label = label; 740 pipe->pipe_peer->pipe_label = label; 741 mac_init_pipe_label(label); 742 } 743 744 static int 745 mac_init_socket_label(struct label *label, int flag) 746 { 747 int error; 748 749 mac_init_label(label); 750 751 MAC_CHECK(init_socket_label, label, flag); 752 if (error) { 753 MAC_PERFORM(destroy_socket_label, label); 754 mac_destroy_label(label); 755 } 756 757 #ifdef MAC_DEBUG 758 if (error == 0) 759 atomic_add_int(&nmacsockets, 1); 760 #endif 761 762 return (error); 763 } 764 765 static int 766 mac_init_socket_peer_label(struct label *label, int flag) 767 { 768 int error; 769 770 mac_init_label(label); 771 772 MAC_CHECK(init_socket_peer_label, label, flag); 773 if (error) { 774 MAC_PERFORM(destroy_socket_label, label); 775 mac_destroy_label(label); 776 } 777 778 return (error); 779 } 780 781 int 782 mac_init_socket(struct socket *socket, int flag) 783 { 784 int error; 785 786 error = mac_init_socket_label(&socket->so_label, flag); 787 if (error) 788 return (error); 789 790 error = mac_init_socket_peer_label(&socket->so_peerlabel, flag); 791 if (error) 792 mac_destroy_socket_label(&socket->so_label); 793 794 return (error); 795 } 796 797 void 798 mac_init_vnode_label(struct label *label) 799 { 800 801 mac_init_label(label); 802 MAC_PERFORM(init_vnode_label, label); 803 #ifdef MAC_DEBUG 804 atomic_add_int(&nmacvnodes, 1); 805 #endif 806 } 807 808 void 809 mac_init_vnode(struct vnode *vp) 810 { 811 812 mac_init_vnode_label(&vp->v_label); 813 } 814 815 void 816 mac_destroy_bpfdesc(struct bpf_d *bpf_d) 817 { 818 819 MAC_PERFORM(destroy_bpfdesc_label, &bpf_d->bd_label); 820 mac_destroy_label(&bpf_d->bd_label); 821 #ifdef MAC_DEBUG 822 atomic_subtract_int(&nmacbpfdescs, 1); 823 #endif 824 } 825 826 static void 827 mac_destroy_cred_label(struct label *label) 828 { 829 830 MAC_PERFORM(destroy_cred_label, label); 831 mac_destroy_label(label); 832 #ifdef MAC_DEBUG 833 atomic_subtract_int(&nmaccreds, 1); 834 #endif 835 } 836 837 void 838 mac_destroy_cred(struct ucred *cred) 839 { 840 841 mac_destroy_cred_label(&cred->cr_label); 842 } 843 844 void 845 mac_destroy_devfsdirent(struct devfs_dirent *de) 846 { 847 848 MAC_PERFORM(destroy_devfsdirent_label, &de->de_label); 849 mac_destroy_label(&de->de_label); 850 #ifdef MAC_DEBUG 851 atomic_subtract_int(&nmacdevfsdirents, 1); 852 #endif 853 } 854 855 static void 856 mac_destroy_ifnet_label(struct label *label) 857 { 858 859 MAC_PERFORM(destroy_ifnet_label, label); 860 mac_destroy_label(label); 861 #ifdef MAC_DEBUG 862 atomic_subtract_int(&nmacifnets, 1); 863 #endif 864 } 865 866 void 867 mac_destroy_ifnet(struct ifnet *ifp) 868 { 869 870 mac_destroy_ifnet_label(&ifp->if_label); 871 } 872 873 void 874 mac_destroy_ipq(struct ipq *ipq) 875 { 876 877 MAC_PERFORM(destroy_ipq_label, &ipq->ipq_label); 878 mac_destroy_label(&ipq->ipq_label); 879 #ifdef MAC_DEBUG 880 atomic_subtract_int(&nmacipqs, 1); 881 #endif 882 } 883 884 void 885 mac_destroy_mbuf(struct mbuf *m) 886 { 887 888 MAC_PERFORM(destroy_mbuf_label, &m->m_pkthdr.label); 889 mac_destroy_label(&m->m_pkthdr.label); 890 #ifdef MAC_DEBUG 891 atomic_subtract_int(&nmacmbufs, 1); 892 #endif 893 } 894 895 void 896 mac_destroy_mount(struct mount *mp) 897 { 898 899 MAC_PERFORM(destroy_mount_label, &mp->mnt_mntlabel); 900 MAC_PERFORM(destroy_mount_fs_label, &mp->mnt_fslabel); 901 mac_destroy_label(&mp->mnt_fslabel); 902 mac_destroy_label(&mp->mnt_mntlabel); 903 #ifdef MAC_DEBUG 904 atomic_subtract_int(&nmacmounts, 1); 905 #endif 906 } 907 908 static void 909 mac_destroy_pipe_label(struct label *label) 910 { 911 912 MAC_PERFORM(destroy_pipe_label, label); 913 mac_destroy_label(label); 914 #ifdef MAC_DEBUG 915 atomic_subtract_int(&nmacpipes, 1); 916 #endif 917 } 918 919 void 920 mac_destroy_pipe(struct pipe *pipe) 921 { 922 923 mac_destroy_pipe_label(pipe->pipe_label); 924 free(pipe->pipe_label, M_MACPIPELABEL); 925 } 926 927 static void 928 mac_destroy_socket_label(struct label *label) 929 { 930 931 MAC_PERFORM(destroy_socket_label, label); 932 mac_destroy_label(label); 933 #ifdef MAC_DEBUG 934 atomic_subtract_int(&nmacsockets, 1); 935 #endif 936 } 937 938 static void 939 mac_destroy_socket_peer_label(struct label *label) 940 { 941 942 MAC_PERFORM(destroy_socket_peer_label, label); 943 mac_destroy_label(label); 944 } 945 946 void 947 mac_destroy_socket(struct socket *socket) 948 { 949 950 mac_destroy_socket_label(&socket->so_label); 951 mac_destroy_socket_peer_label(&socket->so_peerlabel); 952 } 953 954 void 955 mac_destroy_vnode_label(struct label *label) 956 { 957 958 MAC_PERFORM(destroy_vnode_label, label); 959 mac_destroy_label(label); 960 #ifdef MAC_DEBUG 961 atomic_subtract_int(&nmacvnodes, 1); 962 #endif 963 } 964 965 void 966 mac_destroy_vnode(struct vnode *vp) 967 { 968 969 mac_destroy_vnode_label(&vp->v_label); 970 } 971 972 static void 973 mac_copy_pipe_label(struct label *src, struct label *dest) 974 { 975 976 MAC_PERFORM(copy_pipe_label, src, dest); 977 } 978 979 void 980 mac_copy_vnode_label(struct label *src, struct label *dest) 981 { 982 983 MAC_PERFORM(copy_vnode_label, src, dest); 984 } 985 986 static int 987 mac_check_structmac_consistent(struct mac *mac) 988 { 989 990 if (mac->m_buflen > MAC_MAX_LABEL_BUF_LEN) 991 return (EINVAL); 992 993 return (0); 994 } 995 996 static int 997 mac_externalize_cred_label(struct label *label, char *elements, 998 char *outbuf, size_t outbuflen, int flags) 999 { 1000 int error; 1001 1002 MAC_EXTERNALIZE(cred_label, label, elements, outbuf, outbuflen); 1003 1004 return (error); 1005 } 1006 1007 static int 1008 mac_externalize_ifnet_label(struct label *label, char *elements, 1009 char *outbuf, size_t outbuflen, int flags) 1010 { 1011 int error; 1012 1013 MAC_EXTERNALIZE(ifnet_label, label, elements, outbuf, outbuflen); 1014 1015 return (error); 1016 } 1017 1018 static int 1019 mac_externalize_pipe_label(struct label *label, char *elements, 1020 char *outbuf, size_t outbuflen, int flags) 1021 { 1022 int error; 1023 1024 MAC_EXTERNALIZE(pipe_label, label, elements, outbuf, outbuflen); 1025 1026 return (error); 1027 } 1028 1029 static int 1030 mac_externalize_socket_label(struct label *label, char *elements, 1031 char *outbuf, size_t outbuflen, int flags) 1032 { 1033 int error; 1034 1035 MAC_EXTERNALIZE(socket_label, label, elements, outbuf, outbuflen); 1036 1037 return (error); 1038 } 1039 1040 static int 1041 mac_externalize_socket_peer_label(struct label *label, char *elements, 1042 char *outbuf, size_t outbuflen, int flags) 1043 { 1044 int error; 1045 1046 MAC_EXTERNALIZE(socket_peer_label, label, elements, outbuf, outbuflen); 1047 1048 return (error); 1049 } 1050 1051 static int 1052 mac_externalize_vnode_label(struct label *label, char *elements, 1053 char *outbuf, size_t outbuflen, int flags) 1054 { 1055 int error; 1056 1057 MAC_EXTERNALIZE(vnode_label, label, elements, outbuf, outbuflen); 1058 1059 return (error); 1060 } 1061 1062 static int 1063 mac_internalize_cred_label(struct label *label, char *string) 1064 { 1065 int error; 1066 1067 MAC_INTERNALIZE(cred_label, label, string); 1068 1069 return (error); 1070 } 1071 1072 static int 1073 mac_internalize_ifnet_label(struct label *label, char *string) 1074 { 1075 int error; 1076 1077 MAC_INTERNALIZE(ifnet_label, label, string); 1078 1079 return (error); 1080 } 1081 1082 static int 1083 mac_internalize_pipe_label(struct label *label, char *string) 1084 { 1085 int error; 1086 1087 MAC_INTERNALIZE(pipe_label, label, string); 1088 1089 return (error); 1090 } 1091 1092 static int 1093 mac_internalize_socket_label(struct label *label, char *string) 1094 { 1095 int error; 1096 1097 MAC_INTERNALIZE(socket_label, label, string); 1098 1099 return (error); 1100 } 1101 1102 static int 1103 mac_internalize_vnode_label(struct label *label, char *string) 1104 { 1105 int error; 1106 1107 MAC_INTERNALIZE(vnode_label, label, string); 1108 1109 return (error); 1110 } 1111 1112 /* 1113 * Initialize MAC label for the first kernel process, from which other 1114 * kernel processes and threads are spawned. 1115 */ 1116 void 1117 mac_create_proc0(struct ucred *cred) 1118 { 1119 1120 MAC_PERFORM(create_proc0, cred); 1121 } 1122 1123 /* 1124 * Initialize MAC label for the first userland process, from which other 1125 * userland processes and threads are spawned. 1126 */ 1127 void 1128 mac_create_proc1(struct ucred *cred) 1129 { 1130 1131 MAC_PERFORM(create_proc1, cred); 1132 } 1133 1134 void 1135 mac_thread_userret(struct thread *td) 1136 { 1137 1138 MAC_PERFORM(thread_userret, td); 1139 } 1140 1141 /* 1142 * When a new process is created, its label must be initialized. Generally, 1143 * this involves inheritence from the parent process, modulo possible 1144 * deltas. This function allows that processing to take place. 1145 */ 1146 void 1147 mac_create_cred(struct ucred *parent_cred, struct ucred *child_cred) 1148 { 1149 1150 MAC_PERFORM(create_cred, parent_cred, child_cred); 1151 } 1152 1153 void 1154 mac_update_devfsdirent(struct devfs_dirent *de, struct vnode *vp) 1155 { 1156 1157 MAC_PERFORM(update_devfsdirent, de, &de->de_label, vp, &vp->v_label); 1158 } 1159 1160 void 1161 mac_associate_vnode_devfs(struct mount *mp, struct devfs_dirent *de, 1162 struct vnode *vp) 1163 { 1164 1165 MAC_PERFORM(associate_vnode_devfs, mp, &mp->mnt_fslabel, de, 1166 &de->de_label, vp, &vp->v_label); 1167 } 1168 1169 int 1170 mac_associate_vnode_extattr(struct mount *mp, struct vnode *vp) 1171 { 1172 int error; 1173 1174 ASSERT_VOP_LOCKED(vp, "mac_associate_vnode_extattr"); 1175 1176 MAC_CHECK(associate_vnode_extattr, mp, &mp->mnt_fslabel, vp, 1177 &vp->v_label); 1178 1179 return (error); 1180 } 1181 1182 void 1183 mac_associate_vnode_singlelabel(struct mount *mp, struct vnode *vp) 1184 { 1185 1186 MAC_PERFORM(associate_vnode_singlelabel, mp, &mp->mnt_fslabel, vp, 1187 &vp->v_label); 1188 } 1189 1190 int 1191 mac_create_vnode_extattr(struct ucred *cred, struct mount *mp, 1192 struct vnode *dvp, struct vnode *vp, struct componentname *cnp) 1193 { 1194 int error; 1195 1196 ASSERT_VOP_LOCKED(dvp, "mac_create_vnode_extattr"); 1197 ASSERT_VOP_LOCKED(vp, "mac_create_vnode_extattr"); 1198 1199 error = VOP_OPENEXTATTR(vp, cred, curthread); 1200 if (error == EOPNOTSUPP) { 1201 /* XXX: Optionally abort if transactions not supported. */ 1202 if (ea_warn_once == 0) { 1203 printf("Warning: transactions not supported " 1204 "in EA write.\n"); 1205 ea_warn_once = 1; 1206 } 1207 } else if (error) 1208 return (error); 1209 1210 MAC_CHECK(create_vnode_extattr, cred, mp, &mp->mnt_fslabel, 1211 dvp, &dvp->v_label, vp, &vp->v_label, cnp); 1212 1213 if (error) { 1214 VOP_CLOSEEXTATTR(vp, 0, NOCRED, curthread); 1215 return (error); 1216 } 1217 1218 error = VOP_CLOSEEXTATTR(vp, 1, NOCRED, curthread); 1219 1220 if (error == EOPNOTSUPP) 1221 error = 0; /* XXX */ 1222 1223 return (error); 1224 } 1225 1226 static int 1227 mac_setlabel_vnode_extattr(struct ucred *cred, struct vnode *vp, 1228 struct label *intlabel) 1229 { 1230 int error; 1231 1232 ASSERT_VOP_LOCKED(vp, "mac_setlabel_vnode_extattr"); 1233 1234 error = VOP_OPENEXTATTR(vp, cred, curthread); 1235 if (error == EOPNOTSUPP) { 1236 /* XXX: Optionally abort if transactions not supported. */ 1237 if (ea_warn_once == 0) { 1238 printf("Warning: transactions not supported " 1239 "in EA write.\n"); 1240 ea_warn_once = 1; 1241 } 1242 } else if (error) 1243 return (error); 1244 1245 MAC_CHECK(setlabel_vnode_extattr, cred, vp, &vp->v_label, intlabel); 1246 1247 if (error) { 1248 VOP_CLOSEEXTATTR(vp, 0, NOCRED, curthread); 1249 return (error); 1250 } 1251 1252 error = VOP_CLOSEEXTATTR(vp, 1, NOCRED, curthread); 1253 1254 if (error == EOPNOTSUPP) 1255 error = 0; /* XXX */ 1256 1257 return (error); 1258 } 1259 1260 void 1261 mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp) 1262 { 1263 1264 ASSERT_VOP_LOCKED(vp, "mac_execve_transition"); 1265 1266 MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label); 1267 } 1268 1269 int 1270 mac_execve_will_transition(struct ucred *old, struct vnode *vp) 1271 { 1272 int result; 1273 1274 result = 0; 1275 MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label); 1276 1277 return (result); 1278 } 1279 1280 int 1281 mac_check_vnode_access(struct ucred *cred, struct vnode *vp, int acc_mode) 1282 { 1283 int error; 1284 1285 ASSERT_VOP_LOCKED(vp, "mac_check_vnode_access"); 1286 1287 if (!mac_enforce_fs) 1288 return (0); 1289 1290 MAC_CHECK(check_vnode_access, cred, vp, &vp->v_label, acc_mode); 1291 return (error); 1292 } 1293 1294 int 1295 mac_check_vnode_chdir(struct ucred *cred, struct vnode *dvp) 1296 { 1297 int error; 1298 1299 ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_chdir"); 1300 1301 if (!mac_enforce_fs) 1302 return (0); 1303 1304 MAC_CHECK(check_vnode_chdir, cred, dvp, &dvp->v_label); 1305 return (error); 1306 } 1307 1308 int 1309 mac_check_vnode_chroot(struct ucred *cred, struct vnode *dvp) 1310 { 1311 int error; 1312 1313 ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_chroot"); 1314 1315 if (!mac_enforce_fs) 1316 return (0); 1317 1318 MAC_CHECK(check_vnode_chroot, cred, dvp, &dvp->v_label); 1319 return (error); 1320 } 1321 1322 int 1323 mac_check_vnode_create(struct ucred *cred, struct vnode *dvp, 1324 struct componentname *cnp, struct vattr *vap) 1325 { 1326 int error; 1327 1328 ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_create"); 1329 1330 if (!mac_enforce_fs) 1331 return (0); 1332 1333 MAC_CHECK(check_vnode_create, cred, dvp, &dvp->v_label, cnp, vap); 1334 return (error); 1335 } 1336 1337 int 1338 mac_check_vnode_delete(struct ucred *cred, struct vnode *dvp, struct vnode *vp, 1339 struct componentname *cnp) 1340 { 1341 int error; 1342 1343 ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_delete"); 1344 ASSERT_VOP_LOCKED(vp, "mac_check_vnode_delete"); 1345 1346 if (!mac_enforce_fs) 1347 return (0); 1348 1349 MAC_CHECK(check_vnode_delete, cred, dvp, &dvp->v_label, vp, 1350 &vp->v_label, cnp); 1351 return (error); 1352 } 1353 1354 int 1355 mac_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp, 1356 acl_type_t type) 1357 { 1358 int error; 1359 1360 ASSERT_VOP_LOCKED(vp, "mac_check_vnode_deleteacl"); 1361 1362 if (!mac_enforce_fs) 1363 return (0); 1364 1365 MAC_CHECK(check_vnode_deleteacl, cred, vp, &vp->v_label, type); 1366 return (error); 1367 } 1368 1369 int 1370 mac_check_vnode_exec(struct ucred *cred, struct vnode *vp) 1371 { 1372 int error; 1373 1374 ASSERT_VOP_LOCKED(vp, "mac_check_vnode_exec"); 1375 1376 if (!mac_enforce_process && !mac_enforce_fs) 1377 return (0); 1378 1379 MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label); 1380 1381 return (error); 1382 } 1383 1384 int 1385 mac_check_vnode_getacl(struct ucred *cred, struct vnode *vp, acl_type_t type) 1386 { 1387 int error; 1388 1389 ASSERT_VOP_LOCKED(vp, "mac_check_vnode_getacl"); 1390 1391 if (!mac_enforce_fs) 1392 return (0); 1393 1394 MAC_CHECK(check_vnode_getacl, cred, vp, &vp->v_label, type); 1395 return (error); 1396 } 1397 1398 int 1399 mac_check_vnode_getextattr(struct ucred *cred, struct vnode *vp, 1400 int attrnamespace, const char *name, struct uio *uio) 1401 { 1402 int error; 1403 1404 ASSERT_VOP_LOCKED(vp, "mac_check_vnode_getextattr"); 1405 1406 if (!mac_enforce_fs) 1407 return (0); 1408 1409 MAC_CHECK(check_vnode_getextattr, cred, vp, &vp->v_label, 1410 attrnamespace, name, uio); 1411 return (error); 1412 } 1413 1414 int 1415 mac_check_vnode_link(struct ucred *cred, struct vnode *dvp, 1416 struct vnode *vp, struct componentname *cnp) 1417 { 1418 int error; 1419 1420 ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_link"); 1421 ASSERT_VOP_LOCKED(vp, "mac_check_vnode_link"); 1422 1423 if (!mac_enforce_fs) 1424 return (0); 1425 1426 MAC_CHECK(check_vnode_link, cred, dvp, &dvp->v_label, vp, 1427 &vp->v_label, cnp); 1428 return (error); 1429 } 1430 1431 int 1432 mac_check_vnode_lookup(struct ucred *cred, struct vnode *dvp, 1433 struct componentname *cnp) 1434 { 1435 int error; 1436 1437 ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_lookup"); 1438 1439 if (!mac_enforce_fs) 1440 return (0); 1441 1442 MAC_CHECK(check_vnode_lookup, cred, dvp, &dvp->v_label, cnp); 1443 return (error); 1444 } 1445 1446 int 1447 mac_check_vnode_mmap(struct ucred *cred, struct vnode *vp, int prot) 1448 { 1449 int error; 1450 1451 ASSERT_VOP_LOCKED(vp, "mac_check_vnode_mmap"); 1452 1453 if (!mac_enforce_fs || !mac_enforce_vm) 1454 return (0); 1455 1456 MAC_CHECK(check_vnode_mmap, cred, vp, &vp->v_label, prot); 1457 return (error); 1458 } 1459 1460 void 1461 mac_check_vnode_mmap_downgrade(struct ucred *cred, struct vnode *vp, int *prot) 1462 { 1463 int result = *prot; 1464 1465 ASSERT_VOP_LOCKED(vp, "mac_check_vnode_mmap_downgrade"); 1466 1467 if (!mac_enforce_fs || !mac_enforce_vm) 1468 return; 1469 1470 MAC_PERFORM(check_vnode_mmap_downgrade, cred, vp, &vp->v_label, 1471 &result); 1472 1473 *prot = result; 1474 } 1475 1476 int 1477 mac_check_vnode_mprotect(struct ucred *cred, struct vnode *vp, int prot) 1478 { 1479 int error; 1480 1481 ASSERT_VOP_LOCKED(vp, "mac_check_vnode_mprotect"); 1482 1483 if (!mac_enforce_fs || !mac_enforce_vm) 1484 return (0); 1485 1486 MAC_CHECK(check_vnode_mprotect, cred, vp, &vp->v_label, prot); 1487 return (error); 1488 } 1489 1490 int 1491 mac_check_vnode_open(struct ucred *cred, struct vnode *vp, int acc_mode) 1492 { 1493 int error; 1494 1495 ASSERT_VOP_LOCKED(vp, "mac_check_vnode_open"); 1496 1497 if (!mac_enforce_fs) 1498 return (0); 1499 1500 MAC_CHECK(check_vnode_open, cred, vp, &vp->v_label, acc_mode); 1501 return (error); 1502 } 1503 1504 int 1505 mac_check_vnode_poll(struct ucred *active_cred, struct ucred *file_cred, 1506 struct vnode *vp) 1507 { 1508 int error; 1509 1510 ASSERT_VOP_LOCKED(vp, "mac_check_vnode_poll"); 1511 1512 if (!mac_enforce_fs) 1513 return (0); 1514 1515 MAC_CHECK(check_vnode_poll, active_cred, file_cred, vp, 1516 &vp->v_label); 1517 1518 return (error); 1519 } 1520 1521 int 1522 mac_check_vnode_read(struct ucred *active_cred, struct ucred *file_cred, 1523 struct vnode *vp) 1524 { 1525 int error; 1526 1527 ASSERT_VOP_LOCKED(vp, "mac_check_vnode_read"); 1528 1529 if (!mac_enforce_fs) 1530 return (0); 1531 1532 MAC_CHECK(check_vnode_read, active_cred, file_cred, vp, 1533 &vp->v_label); 1534 1535 return (error); 1536 } 1537 1538 int 1539 mac_check_vnode_readdir(struct ucred *cred, struct vnode *dvp) 1540 { 1541 int error; 1542 1543 ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_readdir"); 1544 1545 if (!mac_enforce_fs) 1546 return (0); 1547 1548 MAC_CHECK(check_vnode_readdir, cred, dvp, &dvp->v_label); 1549 return (error); 1550 } 1551 1552 int 1553 mac_check_vnode_readlink(struct ucred *cred, struct vnode *vp) 1554 { 1555 int error; 1556 1557 ASSERT_VOP_LOCKED(vp, "mac_check_vnode_readlink"); 1558 1559 if (!mac_enforce_fs) 1560 return (0); 1561 1562 MAC_CHECK(check_vnode_readlink, cred, vp, &vp->v_label); 1563 return (error); 1564 } 1565 1566 static int 1567 mac_check_vnode_relabel(struct ucred *cred, struct vnode *vp, 1568 struct label *newlabel) 1569 { 1570 int error; 1571 1572 ASSERT_VOP_LOCKED(vp, "mac_check_vnode_relabel"); 1573 1574 MAC_CHECK(check_vnode_relabel, cred, vp, &vp->v_label, newlabel); 1575 1576 return (error); 1577 } 1578 1579 int 1580 mac_check_vnode_rename_from(struct ucred *cred, struct vnode *dvp, 1581 struct vnode *vp, struct componentname *cnp) 1582 { 1583 int error; 1584 1585 ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_rename_from"); 1586 ASSERT_VOP_LOCKED(vp, "mac_check_vnode_rename_from"); 1587 1588 if (!mac_enforce_fs) 1589 return (0); 1590 1591 MAC_CHECK(check_vnode_rename_from, cred, dvp, &dvp->v_label, vp, 1592 &vp->v_label, cnp); 1593 return (error); 1594 } 1595 1596 int 1597 mac_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp, 1598 struct vnode *vp, int samedir, struct componentname *cnp) 1599 { 1600 int error; 1601 1602 ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_rename_to"); 1603 ASSERT_VOP_LOCKED(vp, "mac_check_vnode_rename_to"); 1604 1605 if (!mac_enforce_fs) 1606 return (0); 1607 1608 MAC_CHECK(check_vnode_rename_to, cred, dvp, &dvp->v_label, vp, 1609 vp != NULL ? &vp->v_label : NULL, samedir, cnp); 1610 return (error); 1611 } 1612 1613 int 1614 mac_check_vnode_revoke(struct ucred *cred, struct vnode *vp) 1615 { 1616 int error; 1617 1618 ASSERT_VOP_LOCKED(vp, "mac_check_vnode_revoke"); 1619 1620 if (!mac_enforce_fs) 1621 return (0); 1622 1623 MAC_CHECK(check_vnode_revoke, cred, vp, &vp->v_label); 1624 return (error); 1625 } 1626 1627 int 1628 mac_check_vnode_setacl(struct ucred *cred, struct vnode *vp, acl_type_t type, 1629 struct acl *acl) 1630 { 1631 int error; 1632 1633 ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setacl"); 1634 1635 if (!mac_enforce_fs) 1636 return (0); 1637 1638 MAC_CHECK(check_vnode_setacl, cred, vp, &vp->v_label, type, acl); 1639 return (error); 1640 } 1641 1642 int 1643 mac_check_vnode_setextattr(struct ucred *cred, struct vnode *vp, 1644 int attrnamespace, const char *name, struct uio *uio) 1645 { 1646 int error; 1647 1648 ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setextattr"); 1649 1650 if (!mac_enforce_fs) 1651 return (0); 1652 1653 MAC_CHECK(check_vnode_setextattr, cred, vp, &vp->v_label, 1654 attrnamespace, name, uio); 1655 return (error); 1656 } 1657 1658 int 1659 mac_check_vnode_setflags(struct ucred *cred, struct vnode *vp, u_long flags) 1660 { 1661 int error; 1662 1663 ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setflags"); 1664 1665 if (!mac_enforce_fs) 1666 return (0); 1667 1668 MAC_CHECK(check_vnode_setflags, cred, vp, &vp->v_label, flags); 1669 return (error); 1670 } 1671 1672 int 1673 mac_check_vnode_setmode(struct ucred *cred, struct vnode *vp, mode_t mode) 1674 { 1675 int error; 1676 1677 ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setmode"); 1678 1679 if (!mac_enforce_fs) 1680 return (0); 1681 1682 MAC_CHECK(check_vnode_setmode, cred, vp, &vp->v_label, mode); 1683 return (error); 1684 } 1685 1686 int 1687 mac_check_vnode_setowner(struct ucred *cred, struct vnode *vp, uid_t uid, 1688 gid_t gid) 1689 { 1690 int error; 1691 1692 ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setowner"); 1693 1694 if (!mac_enforce_fs) 1695 return (0); 1696 1697 MAC_CHECK(check_vnode_setowner, cred, vp, &vp->v_label, uid, gid); 1698 return (error); 1699 } 1700 1701 int 1702 mac_check_vnode_setutimes(struct ucred *cred, struct vnode *vp, 1703 struct timespec atime, struct timespec mtime) 1704 { 1705 int error; 1706 1707 ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setutimes"); 1708 1709 if (!mac_enforce_fs) 1710 return (0); 1711 1712 MAC_CHECK(check_vnode_setutimes, cred, vp, &vp->v_label, atime, 1713 mtime); 1714 return (error); 1715 } 1716 1717 int 1718 mac_check_vnode_stat(struct ucred *active_cred, struct ucred *file_cred, 1719 struct vnode *vp) 1720 { 1721 int error; 1722 1723 ASSERT_VOP_LOCKED(vp, "mac_check_vnode_stat"); 1724 1725 if (!mac_enforce_fs) 1726 return (0); 1727 1728 MAC_CHECK(check_vnode_stat, active_cred, file_cred, vp, 1729 &vp->v_label); 1730 return (error); 1731 } 1732 1733 int 1734 mac_check_vnode_write(struct ucred *active_cred, struct ucred *file_cred, 1735 struct vnode *vp) 1736 { 1737 int error; 1738 1739 ASSERT_VOP_LOCKED(vp, "mac_check_vnode_write"); 1740 1741 if (!mac_enforce_fs) 1742 return (0); 1743 1744 MAC_CHECK(check_vnode_write, active_cred, file_cred, vp, 1745 &vp->v_label); 1746 1747 return (error); 1748 } 1749 1750 /* 1751 * When relabeling a process, call out to the policies for the maximum 1752 * permission allowed for each object type we know about in its 1753 * memory space, and revoke access (in the least surprising ways we 1754 * know) when necessary. The process lock is not held here. 1755 */ 1756 static void 1757 mac_cred_mmapped_drop_perms(struct thread *td, struct ucred *cred) 1758 { 1759 1760 /* XXX freeze all other threads */ 1761 mac_cred_mmapped_drop_perms_recurse(td, cred, 1762 &td->td_proc->p_vmspace->vm_map); 1763 /* XXX allow other threads to continue */ 1764 } 1765 1766 static __inline const char * 1767 prot2str(vm_prot_t prot) 1768 { 1769 1770 switch (prot & VM_PROT_ALL) { 1771 case VM_PROT_READ: 1772 return ("r--"); 1773 case VM_PROT_READ | VM_PROT_WRITE: 1774 return ("rw-"); 1775 case VM_PROT_READ | VM_PROT_EXECUTE: 1776 return ("r-x"); 1777 case VM_PROT_READ | VM_PROT_WRITE | VM_PROT_EXECUTE: 1778 return ("rwx"); 1779 case VM_PROT_WRITE: 1780 return ("-w-"); 1781 case VM_PROT_EXECUTE: 1782 return ("--x"); 1783 case VM_PROT_WRITE | VM_PROT_EXECUTE: 1784 return ("-wx"); 1785 default: 1786 return ("---"); 1787 } 1788 } 1789 1790 static void 1791 mac_cred_mmapped_drop_perms_recurse(struct thread *td, struct ucred *cred, 1792 struct vm_map *map) 1793 { 1794 struct vm_map_entry *vme; 1795 int result; 1796 vm_prot_t revokeperms; 1797 vm_object_t object; 1798 vm_ooffset_t offset; 1799 struct vnode *vp; 1800 1801 if (!mac_mmap_revocation) 1802 return; 1803 1804 vm_map_lock_read(map); 1805 for (vme = map->header.next; vme != &map->header; vme = vme->next) { 1806 if (vme->eflags & MAP_ENTRY_IS_SUB_MAP) { 1807 mac_cred_mmapped_drop_perms_recurse(td, cred, 1808 vme->object.sub_map); 1809 continue; 1810 } 1811 /* 1812 * Skip over entries that obviously are not shared. 1813 */ 1814 if (vme->eflags & (MAP_ENTRY_COW | MAP_ENTRY_NOSYNC) || 1815 !vme->max_protection) 1816 continue; 1817 /* 1818 * Drill down to the deepest backing object. 1819 */ 1820 offset = vme->offset; 1821 object = vme->object.vm_object; 1822 if (object == NULL) 1823 continue; 1824 while (object->backing_object != NULL) { 1825 object = object->backing_object; 1826 offset += object->backing_object_offset; 1827 } 1828 /* 1829 * At the moment, vm_maps and objects aren't considered 1830 * by the MAC system, so only things with backing by a 1831 * normal object (read: vnodes) are checked. 1832 */ 1833 if (object->type != OBJT_VNODE) 1834 continue; 1835 vp = (struct vnode *)object->handle; 1836 vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); 1837 result = vme->max_protection; 1838 mac_check_vnode_mmap_downgrade(cred, vp, &result); 1839 VOP_UNLOCK(vp, 0, td); 1840 /* 1841 * Find out what maximum protection we may be allowing 1842 * now but a policy needs to get removed. 1843 */ 1844 revokeperms = vme->max_protection & ~result; 1845 if (!revokeperms) 1846 continue; 1847 printf("pid %ld: revoking %s perms from %#lx:%ld " 1848 "(max %s/cur %s)\n", (long)td->td_proc->p_pid, 1849 prot2str(revokeperms), (u_long)vme->start, 1850 (long)(vme->end - vme->start), 1851 prot2str(vme->max_protection), prot2str(vme->protection)); 1852 vm_map_lock_upgrade(map); 1853 /* 1854 * This is the really simple case: if a map has more 1855 * max_protection than is allowed, but it's not being 1856 * actually used (that is, the current protection is 1857 * still allowed), we can just wipe it out and do 1858 * nothing more. 1859 */ 1860 if ((vme->protection & revokeperms) == 0) { 1861 vme->max_protection -= revokeperms; 1862 } else { 1863 if (revokeperms & VM_PROT_WRITE) { 1864 /* 1865 * In the more complicated case, flush out all 1866 * pending changes to the object then turn it 1867 * copy-on-write. 1868 */ 1869 vm_object_reference(object); 1870 vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); 1871 vm_object_page_clean(object, 1872 OFF_TO_IDX(offset), 1873 OFF_TO_IDX(offset + vme->end - vme->start + 1874 PAGE_MASK), 1875 OBJPC_SYNC); 1876 VOP_UNLOCK(vp, 0, td); 1877 vm_object_deallocate(object); 1878 /* 1879 * Why bother if there's no read permissions 1880 * anymore? For the rest, we need to leave 1881 * the write permissions on for COW, or 1882 * remove them entirely if configured to. 1883 */ 1884 if (!mac_mmap_revocation_via_cow) { 1885 vme->max_protection &= ~VM_PROT_WRITE; 1886 vme->protection &= ~VM_PROT_WRITE; 1887 } if ((revokeperms & VM_PROT_READ) == 0) 1888 vme->eflags |= MAP_ENTRY_COW | 1889 MAP_ENTRY_NEEDS_COPY; 1890 } 1891 if (revokeperms & VM_PROT_EXECUTE) { 1892 vme->max_protection &= ~VM_PROT_EXECUTE; 1893 vme->protection &= ~VM_PROT_EXECUTE; 1894 } 1895 if (revokeperms & VM_PROT_READ) { 1896 vme->max_protection = 0; 1897 vme->protection = 0; 1898 } 1899 pmap_protect(map->pmap, vme->start, vme->end, 1900 vme->protection & ~revokeperms); 1901 vm_map_simplify_entry(map, vme); 1902 } 1903 vm_map_lock_downgrade(map); 1904 } 1905 vm_map_unlock_read(map); 1906 } 1907 1908 /* 1909 * When the subject's label changes, it may require revocation of privilege 1910 * to mapped objects. This can't be done on-the-fly later with a unified 1911 * buffer cache. 1912 */ 1913 static void 1914 mac_relabel_cred(struct ucred *cred, struct label *newlabel) 1915 { 1916 1917 MAC_PERFORM(relabel_cred, cred, newlabel); 1918 } 1919 1920 void 1921 mac_relabel_vnode(struct ucred *cred, struct vnode *vp, struct label *newlabel) 1922 { 1923 1924 MAC_PERFORM(relabel_vnode, cred, vp, &vp->v_label, newlabel); 1925 } 1926 1927 void 1928 mac_create_ifnet(struct ifnet *ifnet) 1929 { 1930 1931 MAC_PERFORM(create_ifnet, ifnet, &ifnet->if_label); 1932 } 1933 1934 void 1935 mac_create_bpfdesc(struct ucred *cred, struct bpf_d *bpf_d) 1936 { 1937 1938 MAC_PERFORM(create_bpfdesc, cred, bpf_d, &bpf_d->bd_label); 1939 } 1940 1941 void 1942 mac_create_socket(struct ucred *cred, struct socket *socket) 1943 { 1944 1945 MAC_PERFORM(create_socket, cred, socket, &socket->so_label); 1946 } 1947 1948 void 1949 mac_create_pipe(struct ucred *cred, struct pipe *pipe) 1950 { 1951 1952 MAC_PERFORM(create_pipe, cred, pipe, pipe->pipe_label); 1953 } 1954 1955 void 1956 mac_create_socket_from_socket(struct socket *oldsocket, 1957 struct socket *newsocket) 1958 { 1959 1960 MAC_PERFORM(create_socket_from_socket, oldsocket, &oldsocket->so_label, 1961 newsocket, &newsocket->so_label); 1962 } 1963 1964 static void 1965 mac_relabel_socket(struct ucred *cred, struct socket *socket, 1966 struct label *newlabel) 1967 { 1968 1969 MAC_PERFORM(relabel_socket, cred, socket, &socket->so_label, newlabel); 1970 } 1971 1972 static void 1973 mac_relabel_pipe(struct ucred *cred, struct pipe *pipe, struct label *newlabel) 1974 { 1975 1976 MAC_PERFORM(relabel_pipe, cred, pipe, pipe->pipe_label, newlabel); 1977 } 1978 1979 void 1980 mac_set_socket_peer_from_mbuf(struct mbuf *mbuf, struct socket *socket) 1981 { 1982 1983 MAC_PERFORM(set_socket_peer_from_mbuf, mbuf, &mbuf->m_pkthdr.label, 1984 socket, &socket->so_peerlabel); 1985 } 1986 1987 void 1988 mac_set_socket_peer_from_socket(struct socket *oldsocket, 1989 struct socket *newsocket) 1990 { 1991 1992 MAC_PERFORM(set_socket_peer_from_socket, oldsocket, 1993 &oldsocket->so_label, newsocket, &newsocket->so_peerlabel); 1994 } 1995 1996 void 1997 mac_create_datagram_from_ipq(struct ipq *ipq, struct mbuf *datagram) 1998 { 1999 2000 MAC_PERFORM(create_datagram_from_ipq, ipq, &ipq->ipq_label, 2001 datagram, &datagram->m_pkthdr.label); 2002 } 2003 2004 void 2005 mac_create_fragment(struct mbuf *datagram, struct mbuf *fragment) 2006 { 2007 2008 MAC_PERFORM(create_fragment, datagram, &datagram->m_pkthdr.label, 2009 fragment, &fragment->m_pkthdr.label); 2010 } 2011 2012 void 2013 mac_create_ipq(struct mbuf *fragment, struct ipq *ipq) 2014 { 2015 2016 MAC_PERFORM(create_ipq, fragment, &fragment->m_pkthdr.label, ipq, 2017 &ipq->ipq_label); 2018 } 2019 2020 void 2021 mac_create_mbuf_from_mbuf(struct mbuf *oldmbuf, struct mbuf *newmbuf) 2022 { 2023 2024 MAC_PERFORM(create_mbuf_from_mbuf, oldmbuf, &oldmbuf->m_pkthdr.label, 2025 newmbuf, &newmbuf->m_pkthdr.label); 2026 } 2027 2028 void 2029 mac_create_mbuf_from_bpfdesc(struct bpf_d *bpf_d, struct mbuf *mbuf) 2030 { 2031 2032 MAC_PERFORM(create_mbuf_from_bpfdesc, bpf_d, &bpf_d->bd_label, mbuf, 2033 &mbuf->m_pkthdr.label); 2034 } 2035 2036 void 2037 mac_create_mbuf_linklayer(struct ifnet *ifnet, struct mbuf *mbuf) 2038 { 2039 2040 MAC_PERFORM(create_mbuf_linklayer, ifnet, &ifnet->if_label, mbuf, 2041 &mbuf->m_pkthdr.label); 2042 } 2043 2044 void 2045 mac_create_mbuf_from_ifnet(struct ifnet *ifnet, struct mbuf *mbuf) 2046 { 2047 2048 MAC_PERFORM(create_mbuf_from_ifnet, ifnet, &ifnet->if_label, mbuf, 2049 &mbuf->m_pkthdr.label); 2050 } 2051 2052 void 2053 mac_create_mbuf_multicast_encap(struct mbuf *oldmbuf, struct ifnet *ifnet, 2054 struct mbuf *newmbuf) 2055 { 2056 2057 MAC_PERFORM(create_mbuf_multicast_encap, oldmbuf, 2058 &oldmbuf->m_pkthdr.label, ifnet, &ifnet->if_label, newmbuf, 2059 &newmbuf->m_pkthdr.label); 2060 } 2061 2062 void 2063 mac_create_mbuf_netlayer(struct mbuf *oldmbuf, struct mbuf *newmbuf) 2064 { 2065 2066 MAC_PERFORM(create_mbuf_netlayer, oldmbuf, &oldmbuf->m_pkthdr.label, 2067 newmbuf, &newmbuf->m_pkthdr.label); 2068 } 2069 2070 int 2071 mac_fragment_match(struct mbuf *fragment, struct ipq *ipq) 2072 { 2073 int result; 2074 2075 result = 1; 2076 MAC_BOOLEAN(fragment_match, &&, fragment, &fragment->m_pkthdr.label, 2077 ipq, &ipq->ipq_label); 2078 2079 return (result); 2080 } 2081 2082 void 2083 mac_update_ipq(struct mbuf *fragment, struct ipq *ipq) 2084 { 2085 2086 MAC_PERFORM(update_ipq, fragment, &fragment->m_pkthdr.label, ipq, 2087 &ipq->ipq_label); 2088 } 2089 2090 void 2091 mac_create_mbuf_from_socket(struct socket *socket, struct mbuf *mbuf) 2092 { 2093 2094 MAC_PERFORM(create_mbuf_from_socket, socket, &socket->so_label, mbuf, 2095 &mbuf->m_pkthdr.label); 2096 } 2097 2098 void 2099 mac_create_mount(struct ucred *cred, struct mount *mp) 2100 { 2101 2102 MAC_PERFORM(create_mount, cred, mp, &mp->mnt_mntlabel, 2103 &mp->mnt_fslabel); 2104 } 2105 2106 void 2107 mac_create_root_mount(struct ucred *cred, struct mount *mp) 2108 { 2109 2110 MAC_PERFORM(create_root_mount, cred, mp, &mp->mnt_mntlabel, 2111 &mp->mnt_fslabel); 2112 } 2113 2114 int 2115 mac_check_bpfdesc_receive(struct bpf_d *bpf_d, struct ifnet *ifnet) 2116 { 2117 int error; 2118 2119 if (!mac_enforce_network) 2120 return (0); 2121 2122 MAC_CHECK(check_bpfdesc_receive, bpf_d, &bpf_d->bd_label, ifnet, 2123 &ifnet->if_label); 2124 2125 return (error); 2126 } 2127 2128 static int 2129 mac_check_cred_relabel(struct ucred *cred, struct label *newlabel) 2130 { 2131 int error; 2132 2133 MAC_CHECK(check_cred_relabel, cred, newlabel); 2134 2135 return (error); 2136 } 2137 2138 int 2139 mac_check_cred_visible(struct ucred *u1, struct ucred *u2) 2140 { 2141 int error; 2142 2143 if (!mac_enforce_process) 2144 return (0); 2145 2146 MAC_CHECK(check_cred_visible, u1, u2); 2147 2148 return (error); 2149 } 2150 2151 int 2152 mac_check_ifnet_transmit(struct ifnet *ifnet, struct mbuf *mbuf) 2153 { 2154 int error; 2155 2156 if (!mac_enforce_network) 2157 return (0); 2158 2159 KASSERT(mbuf->m_flags & M_PKTHDR, ("packet has no pkthdr")); 2160 if (!(mbuf->m_pkthdr.label.l_flags & MAC_FLAG_INITIALIZED)) 2161 if_printf(ifnet, "not initialized\n"); 2162 2163 MAC_CHECK(check_ifnet_transmit, ifnet, &ifnet->if_label, mbuf, 2164 &mbuf->m_pkthdr.label); 2165 2166 return (error); 2167 } 2168 2169 int 2170 mac_check_kenv_dump(struct ucred *cred) 2171 { 2172 int error; 2173 2174 if (!mac_enforce_system) 2175 return (0); 2176 2177 MAC_CHECK(check_kenv_dump, cred); 2178 2179 return (error); 2180 } 2181 2182 int 2183 mac_check_kenv_get(struct ucred *cred, char *name) 2184 { 2185 int error; 2186 2187 if (!mac_enforce_system) 2188 return (0); 2189 2190 MAC_CHECK(check_kenv_get, cred, name); 2191 2192 return (error); 2193 } 2194 2195 int 2196 mac_check_kenv_set(struct ucred *cred, char *name, char *value) 2197 { 2198 int error; 2199 2200 if (!mac_enforce_system) 2201 return (0); 2202 2203 MAC_CHECK(check_kenv_set, cred, name, value); 2204 2205 return (error); 2206 } 2207 2208 int 2209 mac_check_kenv_unset(struct ucred *cred, char *name) 2210 { 2211 int error; 2212 2213 if (!mac_enforce_system) 2214 return (0); 2215 2216 MAC_CHECK(check_kenv_unset, cred, name); 2217 2218 return (error); 2219 } 2220 2221 int 2222 mac_check_mount_stat(struct ucred *cred, struct mount *mount) 2223 { 2224 int error; 2225 2226 if (!mac_enforce_fs) 2227 return (0); 2228 2229 MAC_CHECK(check_mount_stat, cred, mount, &mount->mnt_mntlabel); 2230 2231 return (error); 2232 } 2233 2234 int 2235 mac_check_pipe_ioctl(struct ucred *cred, struct pipe *pipe, unsigned long cmd, 2236 void *data) 2237 { 2238 int error; 2239 2240 PIPE_LOCK_ASSERT(pipe, MA_OWNED); 2241 2242 if (!mac_enforce_pipe) 2243 return (0); 2244 2245 MAC_CHECK(check_pipe_ioctl, cred, pipe, pipe->pipe_label, cmd, data); 2246 2247 return (error); 2248 } 2249 2250 int 2251 mac_check_pipe_poll(struct ucred *cred, struct pipe *pipe) 2252 { 2253 int error; 2254 2255 PIPE_LOCK_ASSERT(pipe, MA_OWNED); 2256 2257 if (!mac_enforce_pipe) 2258 return (0); 2259 2260 MAC_CHECK(check_pipe_poll, cred, pipe, pipe->pipe_label); 2261 2262 return (error); 2263 } 2264 2265 int 2266 mac_check_pipe_read(struct ucred *cred, struct pipe *pipe) 2267 { 2268 int error; 2269 2270 PIPE_LOCK_ASSERT(pipe, MA_OWNED); 2271 2272 if (!mac_enforce_pipe) 2273 return (0); 2274 2275 MAC_CHECK(check_pipe_read, cred, pipe, pipe->pipe_label); 2276 2277 return (error); 2278 } 2279 2280 static int 2281 mac_check_pipe_relabel(struct ucred *cred, struct pipe *pipe, 2282 struct label *newlabel) 2283 { 2284 int error; 2285 2286 PIPE_LOCK_ASSERT(pipe, MA_OWNED); 2287 2288 if (!mac_enforce_pipe) 2289 return (0); 2290 2291 MAC_CHECK(check_pipe_relabel, cred, pipe, pipe->pipe_label, newlabel); 2292 2293 return (error); 2294 } 2295 2296 int 2297 mac_check_pipe_stat(struct ucred *cred, struct pipe *pipe) 2298 { 2299 int error; 2300 2301 PIPE_LOCK_ASSERT(pipe, MA_OWNED); 2302 2303 if (!mac_enforce_pipe) 2304 return (0); 2305 2306 MAC_CHECK(check_pipe_stat, cred, pipe, pipe->pipe_label); 2307 2308 return (error); 2309 } 2310 2311 int 2312 mac_check_pipe_write(struct ucred *cred, struct pipe *pipe) 2313 { 2314 int error; 2315 2316 PIPE_LOCK_ASSERT(pipe, MA_OWNED); 2317 2318 if (!mac_enforce_pipe) 2319 return (0); 2320 2321 MAC_CHECK(check_pipe_write, cred, pipe, pipe->pipe_label); 2322 2323 return (error); 2324 } 2325 2326 int 2327 mac_check_proc_debug(struct ucred *cred, struct proc *proc) 2328 { 2329 int error; 2330 2331 PROC_LOCK_ASSERT(proc, MA_OWNED); 2332 2333 if (!mac_enforce_process) 2334 return (0); 2335 2336 MAC_CHECK(check_proc_debug, cred, proc); 2337 2338 return (error); 2339 } 2340 2341 int 2342 mac_check_proc_sched(struct ucred *cred, struct proc *proc) 2343 { 2344 int error; 2345 2346 PROC_LOCK_ASSERT(proc, MA_OWNED); 2347 2348 if (!mac_enforce_process) 2349 return (0); 2350 2351 MAC_CHECK(check_proc_sched, cred, proc); 2352 2353 return (error); 2354 } 2355 2356 int 2357 mac_check_proc_signal(struct ucred *cred, struct proc *proc, int signum) 2358 { 2359 int error; 2360 2361 PROC_LOCK_ASSERT(proc, MA_OWNED); 2362 2363 if (!mac_enforce_process) 2364 return (0); 2365 2366 MAC_CHECK(check_proc_signal, cred, proc, signum); 2367 2368 return (error); 2369 } 2370 2371 int 2372 mac_check_socket_bind(struct ucred *ucred, struct socket *socket, 2373 struct sockaddr *sockaddr) 2374 { 2375 int error; 2376 2377 if (!mac_enforce_socket) 2378 return (0); 2379 2380 MAC_CHECK(check_socket_bind, ucred, socket, &socket->so_label, 2381 sockaddr); 2382 2383 return (error); 2384 } 2385 2386 int 2387 mac_check_socket_connect(struct ucred *cred, struct socket *socket, 2388 struct sockaddr *sockaddr) 2389 { 2390 int error; 2391 2392 if (!mac_enforce_socket) 2393 return (0); 2394 2395 MAC_CHECK(check_socket_connect, cred, socket, &socket->so_label, 2396 sockaddr); 2397 2398 return (error); 2399 } 2400 2401 int 2402 mac_check_socket_deliver(struct socket *socket, struct mbuf *mbuf) 2403 { 2404 int error; 2405 2406 if (!mac_enforce_socket) 2407 return (0); 2408 2409 MAC_CHECK(check_socket_deliver, socket, &socket->so_label, mbuf, 2410 &mbuf->m_pkthdr.label); 2411 2412 return (error); 2413 } 2414 2415 int 2416 mac_check_socket_listen(struct ucred *cred, struct socket *socket) 2417 { 2418 int error; 2419 2420 if (!mac_enforce_socket) 2421 return (0); 2422 2423 MAC_CHECK(check_socket_listen, cred, socket, &socket->so_label); 2424 return (error); 2425 } 2426 2427 int 2428 mac_check_socket_receive(struct ucred *cred, struct socket *so) 2429 { 2430 int error; 2431 2432 if (!mac_enforce_socket) 2433 return (0); 2434 2435 MAC_CHECK(check_socket_receive, cred, so, &so->so_label); 2436 2437 return (error); 2438 } 2439 2440 static int 2441 mac_check_socket_relabel(struct ucred *cred, struct socket *socket, 2442 struct label *newlabel) 2443 { 2444 int error; 2445 2446 MAC_CHECK(check_socket_relabel, cred, socket, &socket->so_label, 2447 newlabel); 2448 2449 return (error); 2450 } 2451 2452 int 2453 mac_check_socket_send(struct ucred *cred, struct socket *so) 2454 { 2455 int error; 2456 2457 if (!mac_enforce_socket) 2458 return (0); 2459 2460 MAC_CHECK(check_socket_send, cred, so, &so->so_label); 2461 2462 return (error); 2463 } 2464 2465 int 2466 mac_check_socket_visible(struct ucred *cred, struct socket *socket) 2467 { 2468 int error; 2469 2470 if (!mac_enforce_socket) 2471 return (0); 2472 2473 MAC_CHECK(check_socket_visible, cred, socket, &socket->so_label); 2474 2475 return (error); 2476 } 2477 2478 int 2479 mac_check_system_reboot(struct ucred *cred, int howto) 2480 { 2481 int error; 2482 2483 if (!mac_enforce_system) 2484 return (0); 2485 2486 MAC_CHECK(check_system_reboot, cred, howto); 2487 2488 return (error); 2489 } 2490 2491 int 2492 mac_check_system_settime(struct ucred *cred) 2493 { 2494 int error; 2495 2496 if (!mac_enforce_system) 2497 return (0); 2498 2499 MAC_CHECK(check_system_settime, cred); 2500 2501 return (error); 2502 } 2503 2504 int 2505 mac_check_system_swapon(struct ucred *cred, struct vnode *vp) 2506 { 2507 int error; 2508 2509 ASSERT_VOP_LOCKED(vp, "mac_check_system_swapon"); 2510 2511 if (!mac_enforce_system) 2512 return (0); 2513 2514 MAC_CHECK(check_system_swapon, cred, vp, &vp->v_label); 2515 return (error); 2516 } 2517 2518 int 2519 mac_check_system_sysctl(struct ucred *cred, int *name, u_int namelen, 2520 void *old, size_t *oldlenp, int inkernel, void *new, size_t newlen) 2521 { 2522 int error; 2523 2524 /* 2525 * XXXMAC: We're very much like to assert the SYSCTL_LOCK here, 2526 * but since it's not exported from kern_sysctl.c, we can't. 2527 */ 2528 if (!mac_enforce_system) 2529 return (0); 2530 2531 MAC_CHECK(check_system_sysctl, cred, name, namelen, old, oldlenp, 2532 inkernel, new, newlen); 2533 2534 return (error); 2535 } 2536 2537 int 2538 mac_ioctl_ifnet_get(struct ucred *cred, struct ifreq *ifr, 2539 struct ifnet *ifnet) 2540 { 2541 char *elements, *buffer; 2542 struct mac mac; 2543 int error; 2544 2545 error = copyin(ifr->ifr_ifru.ifru_data, &mac, sizeof(mac)); 2546 if (error) 2547 return (error); 2548 2549 error = mac_check_structmac_consistent(&mac); 2550 if (error) 2551 return (error); 2552 2553 elements = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK); 2554 error = copyinstr(mac.m_string, elements, mac.m_buflen, NULL); 2555 if (error) { 2556 free(elements, M_MACTEMP); 2557 return (error); 2558 } 2559 2560 buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK | M_ZERO); 2561 error = mac_externalize_ifnet_label(&ifnet->if_label, elements, 2562 buffer, mac.m_buflen, M_WAITOK); 2563 if (error == 0) 2564 error = copyout(buffer, mac.m_string, strlen(buffer)+1); 2565 2566 free(buffer, M_MACTEMP); 2567 free(elements, M_MACTEMP); 2568 2569 return (error); 2570 } 2571 2572 int 2573 mac_ioctl_ifnet_set(struct ucred *cred, struct ifreq *ifr, 2574 struct ifnet *ifnet) 2575 { 2576 struct label intlabel; 2577 struct mac mac; 2578 char *buffer; 2579 int error; 2580 2581 error = copyin(ifr->ifr_ifru.ifru_data, &mac, sizeof(mac)); 2582 if (error) 2583 return (error); 2584 2585 error = mac_check_structmac_consistent(&mac); 2586 if (error) 2587 return (error); 2588 2589 buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK); 2590 error = copyinstr(mac.m_string, buffer, mac.m_buflen, NULL); 2591 if (error) { 2592 free(buffer, M_MACTEMP); 2593 return (error); 2594 } 2595 2596 mac_init_ifnet_label(&intlabel); 2597 error = mac_internalize_ifnet_label(&intlabel, buffer); 2598 free(buffer, M_MACTEMP); 2599 if (error) { 2600 mac_destroy_ifnet_label(&intlabel); 2601 return (error); 2602 } 2603 2604 /* 2605 * XXX: Note that this is a redundant privilege check, since 2606 * policies impose this check themselves if required by the 2607 * policy. Eventually, this should go away. 2608 */ 2609 error = suser_cred(cred, 0); 2610 if (error) { 2611 mac_destroy_ifnet_label(&intlabel); 2612 return (error); 2613 } 2614 2615 MAC_CHECK(check_ifnet_relabel, cred, ifnet, &ifnet->if_label, 2616 &intlabel); 2617 if (error) { 2618 mac_destroy_ifnet_label(&intlabel); 2619 return (error); 2620 } 2621 2622 MAC_PERFORM(relabel_ifnet, cred, ifnet, &ifnet->if_label, &intlabel); 2623 2624 mac_destroy_ifnet_label(&intlabel); 2625 return (0); 2626 } 2627 2628 void 2629 mac_create_devfs_vnode(struct devfs_dirent *de, struct vnode *vp) 2630 { 2631 2632 MAC_PERFORM(create_devfs_vnode, de, &de->de_label, vp, &vp->v_label); 2633 } 2634 2635 void 2636 mac_create_devfs_device(dev_t dev, struct devfs_dirent *de) 2637 { 2638 2639 MAC_PERFORM(create_devfs_device, dev, de, &de->de_label); 2640 } 2641 2642 void 2643 mac_create_devfs_symlink(struct ucred *cred, struct devfs_dirent *dd, 2644 struct devfs_dirent *de) 2645 { 2646 2647 MAC_PERFORM(create_devfs_symlink, cred, dd, &dd->de_label, de, 2648 &de->de_label); 2649 } 2650 2651 void 2652 mac_create_devfs_directory(char *dirname, int dirnamelen, 2653 struct devfs_dirent *de) 2654 { 2655 2656 MAC_PERFORM(create_devfs_directory, dirname, dirnamelen, de, 2657 &de->de_label); 2658 } 2659 2660 int 2661 mac_setsockopt_label_set(struct ucred *cred, struct socket *so, 2662 struct mac *mac) 2663 { 2664 struct label intlabel; 2665 char *buffer; 2666 int error; 2667 2668 error = mac_check_structmac_consistent(mac); 2669 if (error) 2670 return (error); 2671 2672 buffer = malloc(mac->m_buflen, M_MACTEMP, M_WAITOK); 2673 error = copyinstr(mac->m_string, buffer, mac->m_buflen, NULL); 2674 if (error) { 2675 free(buffer, M_MACTEMP); 2676 return (error); 2677 } 2678 2679 mac_init_socket_label(&intlabel, M_WAITOK); 2680 error = mac_internalize_socket_label(&intlabel, buffer); 2681 free(buffer, M_MACTEMP); 2682 if (error) { 2683 mac_destroy_socket_label(&intlabel); 2684 return (error); 2685 } 2686 2687 mac_check_socket_relabel(cred, so, &intlabel); 2688 if (error) { 2689 mac_destroy_socket_label(&intlabel); 2690 return (error); 2691 } 2692 2693 mac_relabel_socket(cred, so, &intlabel); 2694 2695 mac_destroy_socket_label(&intlabel); 2696 return (0); 2697 } 2698 2699 int 2700 mac_pipe_label_set(struct ucred *cred, struct pipe *pipe, struct label *label) 2701 { 2702 int error; 2703 2704 PIPE_LOCK_ASSERT(pipe, MA_OWNED); 2705 2706 error = mac_check_pipe_relabel(cred, pipe, label); 2707 if (error) 2708 return (error); 2709 2710 mac_relabel_pipe(cred, pipe, label); 2711 2712 return (0); 2713 } 2714 2715 int 2716 mac_getsockopt_label_get(struct ucred *cred, struct socket *so, 2717 struct mac *mac) 2718 { 2719 char *buffer, *elements; 2720 int error; 2721 2722 error = mac_check_structmac_consistent(mac); 2723 if (error) 2724 return (error); 2725 2726 elements = malloc(mac->m_buflen, M_MACTEMP, M_WAITOK); 2727 error = copyinstr(mac->m_string, elements, mac->m_buflen, NULL); 2728 if (error) { 2729 free(elements, M_MACTEMP); 2730 return (error); 2731 } 2732 2733 buffer = malloc(mac->m_buflen, M_MACTEMP, M_WAITOK | M_ZERO); 2734 error = mac_externalize_socket_label(&so->so_label, elements, 2735 buffer, mac->m_buflen, M_WAITOK); 2736 if (error == 0) 2737 error = copyout(buffer, mac->m_string, strlen(buffer)+1); 2738 2739 free(buffer, M_MACTEMP); 2740 free(elements, M_MACTEMP); 2741 2742 return (error); 2743 } 2744 2745 int 2746 mac_getsockopt_peerlabel_get(struct ucred *cred, struct socket *so, 2747 struct mac *mac) 2748 { 2749 char *elements, *buffer; 2750 int error; 2751 2752 error = mac_check_structmac_consistent(mac); 2753 if (error) 2754 return (error); 2755 2756 elements = malloc(mac->m_buflen, M_MACTEMP, M_WAITOK); 2757 error = copyinstr(mac->m_string, elements, mac->m_buflen, NULL); 2758 if (error) { 2759 free(elements, M_MACTEMP); 2760 return (error); 2761 } 2762 2763 buffer = malloc(mac->m_buflen, M_MACTEMP, M_WAITOK | M_ZERO); 2764 error = mac_externalize_socket_peer_label(&so->so_peerlabel, 2765 elements, buffer, mac->m_buflen, M_WAITOK); 2766 if (error == 0) 2767 error = copyout(buffer, mac->m_string, strlen(buffer)+1); 2768 2769 free(buffer, M_MACTEMP); 2770 free(elements, M_MACTEMP); 2771 2772 return (error); 2773 } 2774 2775 /* 2776 * Implementation of VOP_SETLABEL() that relies on extended attributes 2777 * to store label data. Can be referenced by filesystems supporting 2778 * extended attributes. 2779 */ 2780 int 2781 vop_stdsetlabel_ea(struct vop_setlabel_args *ap) 2782 { 2783 struct vnode *vp = ap->a_vp; 2784 struct label *intlabel = ap->a_label; 2785 int error; 2786 2787 ASSERT_VOP_LOCKED(vp, "vop_stdsetlabel_ea"); 2788 2789 if ((vp->v_mount->mnt_flag & MNT_MULTILABEL) == 0) 2790 return (EOPNOTSUPP); 2791 2792 error = mac_setlabel_vnode_extattr(ap->a_cred, vp, intlabel); 2793 if (error) 2794 return (error); 2795 2796 mac_relabel_vnode(ap->a_cred, vp, intlabel); 2797 2798 return (0); 2799 } 2800 2801 static int 2802 vn_setlabel(struct vnode *vp, struct label *intlabel, struct ucred *cred) 2803 { 2804 int error; 2805 2806 if (vp->v_mount == NULL) { 2807 /* printf("vn_setlabel: null v_mount\n"); */ 2808 if (vp->v_type != VNON) 2809 printf("vn_setlabel: null v_mount with non-VNON\n"); 2810 return (EBADF); 2811 } 2812 2813 if ((vp->v_mount->mnt_flag & MNT_MULTILABEL) == 0) 2814 return (EOPNOTSUPP); 2815 2816 /* 2817 * Multi-phase commit. First check the policies to confirm the 2818 * change is OK. Then commit via the filesystem. Finally, 2819 * update the actual vnode label. Question: maybe the filesystem 2820 * should update the vnode at the end as part of VOP_SETLABEL()? 2821 */ 2822 error = mac_check_vnode_relabel(cred, vp, intlabel); 2823 if (error) 2824 return (error); 2825 2826 /* 2827 * VADMIN provides the opportunity for the filesystem to make 2828 * decisions about who is and is not able to modify labels 2829 * and protections on files. This might not be right. We can't 2830 * assume VOP_SETLABEL() will do it, because we might implement 2831 * that as part of vop_stdsetlabel_ea(). 2832 */ 2833 error = VOP_ACCESS(vp, VADMIN, cred, curthread); 2834 if (error) 2835 return (error); 2836 2837 error = VOP_SETLABEL(vp, intlabel, cred, curthread); 2838 if (error) 2839 return (error); 2840 2841 return (0); 2842 } 2843 2844 int 2845 __mac_get_pid(struct thread *td, struct __mac_get_pid_args *uap) 2846 { 2847 char *elements, *buffer; 2848 struct mac mac; 2849 struct proc *tproc; 2850 struct ucred *tcred; 2851 int error; 2852 2853 error = copyin(SCARG(uap, mac_p), &mac, sizeof(mac)); 2854 if (error) 2855 return (error); 2856 2857 error = mac_check_structmac_consistent(&mac); 2858 if (error) 2859 return (error); 2860 2861 tproc = pfind(uap->pid); 2862 if (tproc == NULL) 2863 return (ESRCH); 2864 2865 tcred = NULL; /* Satisfy gcc. */ 2866 error = p_cansee(td, tproc); 2867 if (error == 0) 2868 tcred = crhold(tproc->p_ucred); 2869 PROC_UNLOCK(tproc); 2870 if (error) 2871 return (error); 2872 2873 elements = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK); 2874 error = copyinstr(mac.m_string, elements, mac.m_buflen, NULL); 2875 if (error) { 2876 free(elements, M_MACTEMP); 2877 crfree(tcred); 2878 return (error); 2879 } 2880 2881 buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK | M_ZERO); 2882 error = mac_externalize_cred_label(&tcred->cr_label, elements, 2883 buffer, mac.m_buflen, M_WAITOK); 2884 if (error == 0) 2885 error = copyout(buffer, mac.m_string, strlen(buffer)+1); 2886 2887 free(buffer, M_MACTEMP); 2888 free(elements, M_MACTEMP); 2889 crfree(tcred); 2890 return (error); 2891 } 2892 2893 /* 2894 * MPSAFE 2895 */ 2896 int 2897 __mac_get_proc(struct thread *td, struct __mac_get_proc_args *uap) 2898 { 2899 char *elements, *buffer; 2900 struct mac mac; 2901 int error; 2902 2903 error = copyin(uap->mac_p, &mac, sizeof(mac)); 2904 if (error) 2905 return (error); 2906 2907 error = mac_check_structmac_consistent(&mac); 2908 if (error) 2909 return (error); 2910 2911 elements = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK); 2912 error = copyinstr(mac.m_string, elements, mac.m_buflen, NULL); 2913 if (error) { 2914 free(elements, M_MACTEMP); 2915 return (error); 2916 } 2917 2918 buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK | M_ZERO); 2919 error = mac_externalize_cred_label(&td->td_ucred->cr_label, 2920 elements, buffer, mac.m_buflen, M_WAITOK); 2921 if (error == 0) 2922 error = copyout(buffer, mac.m_string, strlen(buffer)+1); 2923 2924 free(buffer, M_MACTEMP); 2925 free(elements, M_MACTEMP); 2926 return (error); 2927 } 2928 2929 /* 2930 * MPSAFE 2931 */ 2932 int 2933 __mac_set_proc(struct thread *td, struct __mac_set_proc_args *uap) 2934 { 2935 struct ucred *newcred, *oldcred; 2936 struct label intlabel; 2937 struct proc *p; 2938 struct mac mac; 2939 char *buffer; 2940 int error; 2941 2942 error = copyin(uap->mac_p, &mac, sizeof(mac)); 2943 if (error) 2944 return (error); 2945 2946 error = mac_check_structmac_consistent(&mac); 2947 if (error) 2948 return (error); 2949 2950 buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK); 2951 error = copyinstr(mac.m_string, buffer, mac.m_buflen, NULL); 2952 if (error) { 2953 free(buffer, M_MACTEMP); 2954 return (error); 2955 } 2956 2957 mac_init_cred_label(&intlabel); 2958 error = mac_internalize_cred_label(&intlabel, buffer); 2959 free(buffer, M_MACTEMP); 2960 if (error) { 2961 mac_destroy_cred_label(&intlabel); 2962 return (error); 2963 } 2964 2965 newcred = crget(); 2966 2967 p = td->td_proc; 2968 PROC_LOCK(p); 2969 oldcred = p->p_ucred; 2970 2971 error = mac_check_cred_relabel(oldcred, &intlabel); 2972 if (error) { 2973 PROC_UNLOCK(p); 2974 crfree(newcred); 2975 goto out; 2976 } 2977 2978 setsugid(p); 2979 crcopy(newcred, oldcred); 2980 mac_relabel_cred(newcred, &intlabel); 2981 p->p_ucred = newcred; 2982 2983 /* 2984 * Grab additional reference for use while revoking mmaps, prior 2985 * to releasing the proc lock and sharing the cred. 2986 */ 2987 crhold(newcred); 2988 PROC_UNLOCK(p); 2989 2990 if (mac_enforce_vm) { 2991 mtx_lock(&Giant); 2992 mac_cred_mmapped_drop_perms(td, newcred); 2993 mtx_unlock(&Giant); 2994 } 2995 2996 crfree(newcred); /* Free revocation reference. */ 2997 crfree(oldcred); 2998 2999 out: 3000 mac_destroy_cred_label(&intlabel); 3001 return (error); 3002 } 3003 3004 /* 3005 * MPSAFE 3006 */ 3007 int 3008 __mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap) 3009 { 3010 char *elements, *buffer; 3011 struct label intlabel; 3012 struct file *fp; 3013 struct mac mac; 3014 struct vnode *vp; 3015 struct pipe *pipe; 3016 short label_type; 3017 int error; 3018 3019 error = copyin(uap->mac_p, &mac, sizeof(mac)); 3020 if (error) 3021 return (error); 3022 3023 error = mac_check_structmac_consistent(&mac); 3024 if (error) 3025 return (error); 3026 3027 elements = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK); 3028 error = copyinstr(mac.m_string, elements, mac.m_buflen, NULL); 3029 if (error) { 3030 free(elements, M_MACTEMP); 3031 return (error); 3032 } 3033 3034 buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK | M_ZERO); 3035 mtx_lock(&Giant); /* VFS */ 3036 error = fget(td, SCARG(uap, fd), &fp); 3037 if (error) 3038 goto out; 3039 3040 label_type = fp->f_type; 3041 switch (fp->f_type) { 3042 case DTYPE_FIFO: 3043 case DTYPE_VNODE: 3044 vp = (struct vnode *)fp->f_data; 3045 3046 mac_init_vnode_label(&intlabel); 3047 3048 vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); 3049 mac_copy_vnode_label(&vp->v_label, &intlabel); 3050 VOP_UNLOCK(vp, 0, td); 3051 3052 break; 3053 case DTYPE_PIPE: 3054 pipe = (struct pipe *)fp->f_data; 3055 3056 mac_init_pipe_label(&intlabel); 3057 3058 PIPE_LOCK(pipe); 3059 mac_copy_pipe_label(pipe->pipe_label, &intlabel); 3060 PIPE_UNLOCK(pipe); 3061 break; 3062 default: 3063 error = EINVAL; 3064 fdrop(fp, td); 3065 goto out; 3066 } 3067 fdrop(fp, td); 3068 3069 switch (label_type) { 3070 case DTYPE_FIFO: 3071 case DTYPE_VNODE: 3072 if (error == 0) 3073 error = mac_externalize_vnode_label(&intlabel, 3074 elements, buffer, mac.m_buflen, M_WAITOK); 3075 mac_destroy_vnode_label(&intlabel); 3076 break; 3077 case DTYPE_PIPE: 3078 error = mac_externalize_pipe_label(&intlabel, elements, 3079 buffer, mac.m_buflen, M_WAITOK); 3080 mac_destroy_pipe_label(&intlabel); 3081 break; 3082 default: 3083 panic("__mac_get_fd: corrupted label_type"); 3084 } 3085 3086 if (error == 0) 3087 error = copyout(buffer, mac.m_string, strlen(buffer)+1); 3088 3089 out: 3090 mtx_unlock(&Giant); /* VFS */ 3091 free(buffer, M_MACTEMP); 3092 free(elements, M_MACTEMP); 3093 3094 return (error); 3095 } 3096 3097 /* 3098 * MPSAFE 3099 */ 3100 int 3101 __mac_get_file(struct thread *td, struct __mac_get_file_args *uap) 3102 { 3103 char *elements, *buffer; 3104 struct nameidata nd; 3105 struct label intlabel; 3106 struct mac mac; 3107 int error; 3108 3109 error = copyin(uap->mac_p, &mac, sizeof(mac)); 3110 if (error) 3111 return (error); 3112 3113 error = mac_check_structmac_consistent(&mac); 3114 if (error) 3115 return (error); 3116 3117 elements = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK); 3118 error = copyinstr(mac.m_string, elements, mac.m_buflen, NULL); 3119 if (error) { 3120 free(elements, M_MACTEMP); 3121 return (error); 3122 } 3123 3124 buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK | M_ZERO); 3125 mtx_lock(&Giant); /* VFS */ 3126 NDINIT(&nd, LOOKUP, LOCKLEAF | FOLLOW, UIO_USERSPACE, uap->path_p, 3127 td); 3128 error = namei(&nd); 3129 if (error) 3130 goto out; 3131 3132 mac_init_vnode_label(&intlabel); 3133 mac_copy_vnode_label(&nd.ni_vp->v_label, &intlabel); 3134 error = mac_externalize_vnode_label(&intlabel, elements, buffer, 3135 mac.m_buflen, M_WAITOK); 3136 3137 NDFREE(&nd, 0); 3138 mac_destroy_vnode_label(&intlabel); 3139 3140 if (error == 0) 3141 error = copyout(buffer, mac.m_string, strlen(buffer)+1); 3142 3143 out: 3144 mtx_unlock(&Giant); /* VFS */ 3145 3146 free(buffer, M_MACTEMP); 3147 free(elements, M_MACTEMP); 3148 3149 return (error); 3150 } 3151 3152 /* 3153 * MPSAFE 3154 */ 3155 int 3156 __mac_get_link(struct thread *td, struct __mac_get_link_args *uap) 3157 { 3158 char *elements, *buffer; 3159 struct nameidata nd; 3160 struct label intlabel; 3161 struct mac mac; 3162 int error; 3163 3164 error = copyin(uap->mac_p, &mac, sizeof(mac)); 3165 if (error) 3166 return (error); 3167 3168 error = mac_check_structmac_consistent(&mac); 3169 if (error) 3170 return (error); 3171 3172 elements = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK); 3173 error = copyinstr(mac.m_string, elements, mac.m_buflen, NULL); 3174 if (error) { 3175 free(elements, M_MACTEMP); 3176 return (error); 3177 } 3178 3179 buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK | M_ZERO); 3180 mtx_lock(&Giant); /* VFS */ 3181 NDINIT(&nd, LOOKUP, LOCKLEAF | NOFOLLOW, UIO_USERSPACE, uap->path_p, 3182 td); 3183 error = namei(&nd); 3184 if (error) 3185 goto out; 3186 3187 mac_init_vnode_label(&intlabel); 3188 mac_copy_vnode_label(&nd.ni_vp->v_label, &intlabel); 3189 error = mac_externalize_vnode_label(&intlabel, elements, buffer, 3190 mac.m_buflen, M_WAITOK); 3191 NDFREE(&nd, 0); 3192 mac_destroy_vnode_label(&intlabel); 3193 3194 if (error == 0) 3195 error = copyout(buffer, mac.m_string, strlen(buffer)+1); 3196 3197 out: 3198 mtx_unlock(&Giant); /* VFS */ 3199 3200 free(buffer, M_MACTEMP); 3201 free(elements, M_MACTEMP); 3202 3203 return (error); 3204 } 3205 3206 /* 3207 * MPSAFE 3208 */ 3209 int 3210 __mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap) 3211 { 3212 struct label intlabel; 3213 struct pipe *pipe; 3214 struct file *fp; 3215 struct mount *mp; 3216 struct vnode *vp; 3217 struct mac mac; 3218 char *buffer; 3219 int error; 3220 3221 error = copyin(uap->mac_p, &mac, sizeof(mac)); 3222 if (error) 3223 return (error); 3224 3225 error = mac_check_structmac_consistent(&mac); 3226 if (error) 3227 return (error); 3228 3229 buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK); 3230 error = copyinstr(mac.m_string, buffer, mac.m_buflen, NULL); 3231 if (error) { 3232 free(buffer, M_MACTEMP); 3233 return (error); 3234 } 3235 3236 mtx_lock(&Giant); /* VFS */ 3237 3238 error = fget(td, SCARG(uap, fd), &fp); 3239 if (error) 3240 goto out; 3241 3242 switch (fp->f_type) { 3243 case DTYPE_FIFO: 3244 case DTYPE_VNODE: 3245 mac_init_vnode_label(&intlabel); 3246 error = mac_internalize_vnode_label(&intlabel, buffer); 3247 if (error) { 3248 mac_destroy_vnode_label(&intlabel); 3249 break; 3250 } 3251 3252 vp = (struct vnode *)fp->f_data; 3253 error = vn_start_write(vp, &mp, V_WAIT | PCATCH); 3254 if (error != 0) { 3255 mac_destroy_vnode_label(&intlabel); 3256 break; 3257 } 3258 3259 vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); 3260 error = vn_setlabel(vp, &intlabel, td->td_ucred); 3261 VOP_UNLOCK(vp, 0, td); 3262 vn_finished_write(mp); 3263 3264 mac_destroy_vnode_label(&intlabel); 3265 break; 3266 3267 case DTYPE_PIPE: 3268 mac_init_pipe_label(&intlabel); 3269 error = mac_internalize_pipe_label(&intlabel, buffer); 3270 if (error == 0) { 3271 pipe = (struct pipe *)fp->f_data; 3272 PIPE_LOCK(pipe); 3273 error = mac_pipe_label_set(td->td_ucred, pipe, 3274 &intlabel); 3275 PIPE_UNLOCK(pipe); 3276 } 3277 3278 mac_destroy_pipe_label(&intlabel); 3279 break; 3280 3281 default: 3282 error = EINVAL; 3283 } 3284 3285 fdrop(fp, td); 3286 out: 3287 mtx_unlock(&Giant); /* VFS */ 3288 3289 free(buffer, M_MACTEMP); 3290 3291 return (error); 3292 } 3293 3294 /* 3295 * MPSAFE 3296 */ 3297 int 3298 __mac_set_file(struct thread *td, struct __mac_set_file_args *uap) 3299 { 3300 struct label intlabel; 3301 struct nameidata nd; 3302 struct mount *mp; 3303 struct mac mac; 3304 char *buffer; 3305 int error; 3306 3307 error = copyin(uap->mac_p, &mac, sizeof(mac)); 3308 if (error) 3309 return (error); 3310 3311 error = mac_check_structmac_consistent(&mac); 3312 if (error) 3313 return (error); 3314 3315 buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK); 3316 error = copyinstr(mac.m_string, buffer, mac.m_buflen, NULL); 3317 if (error) { 3318 free(buffer, M_MACTEMP); 3319 return (error); 3320 } 3321 3322 mac_init_vnode_label(&intlabel); 3323 error = mac_internalize_vnode_label(&intlabel, buffer); 3324 free(buffer, M_MACTEMP); 3325 if (error) { 3326 mac_destroy_vnode_label(&intlabel); 3327 return (error); 3328 } 3329 3330 mtx_lock(&Giant); /* VFS */ 3331 3332 NDINIT(&nd, LOOKUP, LOCKLEAF | FOLLOW, UIO_USERSPACE, uap->path_p, 3333 td); 3334 error = namei(&nd); 3335 if (error == 0) { 3336 error = vn_start_write(nd.ni_vp, &mp, V_WAIT | PCATCH); 3337 if (error == 0) 3338 error = vn_setlabel(nd.ni_vp, &intlabel, 3339 td->td_ucred); 3340 vn_finished_write(mp); 3341 } 3342 3343 NDFREE(&nd, 0); 3344 mtx_unlock(&Giant); /* VFS */ 3345 mac_destroy_vnode_label(&intlabel); 3346 3347 return (error); 3348 } 3349 3350 /* 3351 * MPSAFE 3352 */ 3353 int 3354 __mac_set_link(struct thread *td, struct __mac_set_link_args *uap) 3355 { 3356 struct label intlabel; 3357 struct nameidata nd; 3358 struct mount *mp; 3359 struct mac mac; 3360 char *buffer; 3361 int error; 3362 3363 error = copyin(uap->mac_p, &mac, sizeof(mac)); 3364 if (error) 3365 return (error); 3366 3367 error = mac_check_structmac_consistent(&mac); 3368 if (error) 3369 return (error); 3370 3371 buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK); 3372 error = copyinstr(mac.m_string, buffer, mac.m_buflen, NULL); 3373 if (error) { 3374 free(buffer, M_MACTEMP); 3375 return (error); 3376 } 3377 3378 mac_init_vnode_label(&intlabel); 3379 error = mac_internalize_vnode_label(&intlabel, buffer); 3380 free(buffer, M_MACTEMP); 3381 if (error) { 3382 mac_destroy_vnode_label(&intlabel); 3383 return (error); 3384 } 3385 3386 mtx_lock(&Giant); /* VFS */ 3387 3388 NDINIT(&nd, LOOKUP, LOCKLEAF | NOFOLLOW, UIO_USERSPACE, uap->path_p, 3389 td); 3390 error = namei(&nd); 3391 if (error == 0) { 3392 error = vn_start_write(nd.ni_vp, &mp, V_WAIT | PCATCH); 3393 if (error == 0) 3394 error = vn_setlabel(nd.ni_vp, &intlabel, 3395 td->td_ucred); 3396 vn_finished_write(mp); 3397 } 3398 3399 NDFREE(&nd, 0); 3400 mtx_unlock(&Giant); /* VFS */ 3401 mac_destroy_vnode_label(&intlabel); 3402 3403 return (error); 3404 } 3405 3406 /* 3407 * MPSAFE 3408 */ 3409 int 3410 mac_syscall(struct thread *td, struct mac_syscall_args *uap) 3411 { 3412 struct mac_policy_conf *mpc; 3413 char target[MAC_MAX_POLICY_NAME]; 3414 int error; 3415 3416 error = copyinstr(SCARG(uap, policy), target, sizeof(target), NULL); 3417 if (error) 3418 return (error); 3419 3420 error = ENOSYS; 3421 MAC_POLICY_LIST_BUSY(); 3422 LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { 3423 if (strcmp(mpc->mpc_name, target) == 0 && 3424 mpc->mpc_ops->mpo_syscall != NULL) { 3425 error = mpc->mpc_ops->mpo_syscall(td, 3426 SCARG(uap, call), SCARG(uap, arg)); 3427 goto out; 3428 } 3429 } 3430 3431 out: 3432 MAC_POLICY_LIST_UNBUSY(); 3433 return (error); 3434 } 3435 3436 SYSINIT(mac, SI_SUB_MAC, SI_ORDER_FIRST, mac_init, NULL); 3437 SYSINIT(mac_late, SI_SUB_MAC_LATE, SI_ORDER_FIRST, mac_late_init, NULL); 3438 3439 #else /* !MAC */ 3440 3441 int 3442 __mac_get_pid(struct thread *td, struct __mac_get_pid_args *uap) 3443 { 3444 3445 return (ENOSYS); 3446 } 3447 3448 int 3449 __mac_get_proc(struct thread *td, struct __mac_get_proc_args *uap) 3450 { 3451 3452 return (ENOSYS); 3453 } 3454 3455 int 3456 __mac_set_proc(struct thread *td, struct __mac_set_proc_args *uap) 3457 { 3458 3459 return (ENOSYS); 3460 } 3461 3462 int 3463 __mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap) 3464 { 3465 3466 return (ENOSYS); 3467 } 3468 3469 int 3470 __mac_get_file(struct thread *td, struct __mac_get_file_args *uap) 3471 { 3472 3473 return (ENOSYS); 3474 } 3475 3476 int 3477 __mac_get_link(struct thread *td, struct __mac_get_link_args *uap) 3478 { 3479 3480 return (ENOSYS); 3481 } 3482 3483 int 3484 __mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap) 3485 { 3486 3487 return (ENOSYS); 3488 } 3489 3490 int 3491 __mac_set_file(struct thread *td, struct __mac_set_file_args *uap) 3492 { 3493 3494 return (ENOSYS); 3495 } 3496 3497 int 3498 __mac_set_link(struct thread *td, struct __mac_set_link_args *uap) 3499 { 3500 3501 return (ENOSYS); 3502 } 3503 3504 int 3505 mac_syscall(struct thread *td, struct mac_syscall_args *uap) 3506 { 3507 3508 return (ENOSYS); 3509 } 3510 3511 #endif 3512