xref: /freebsd/sys/security/mac/mac_net.c (revision 8d20be1e22095c27faf8fe8b2f0d089739cc742e)
1 /*-
2  * Copyright (c) 1999-2002, 2009 Robert N. M. Watson
3  * Copyright (c) 2001 Ilmar S. Habibulin
4  * Copyright (c) 2001-2004 Networks Associates Technology, Inc.
5  * Copyright (c) 2006 SPARTA, Inc.
6  * Copyright (c) 2008 Apple Inc.
7  * All rights reserved.
8  *
9  * This software was developed by Robert Watson and Ilmar Habibulin for the
10  * TrustedBSD Project.
11  *
12  * This software was enhanced by SPARTA ISSO under SPAWAR contract
13  * N66001-04-C-6019 ("SEFOS").
14  *
15  * This software was developed for the FreeBSD Project in part by Network
16  * Associates Laboratories, the Security Research Division of Network
17  * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"),
18  * as part of the DARPA CHATS research program.
19  *
20  * This software was developed at the University of Cambridge Computer
21  * Laboratory with support from a grant from Google, Inc.
22  *
23  * Redistribution and use in source and binary forms, with or without
24  * modification, are permitted provided that the following conditions
25  * are met:
26  * 1. Redistributions of source code must retain the above copyright
27  *    notice, this list of conditions and the following disclaimer.
28  * 2. Redistributions in binary form must reproduce the above copyright
29  *    notice, this list of conditions and the following disclaimer in the
30  *    documentation and/or other materials provided with the distribution.
31  *
32  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
33  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
34  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
35  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
36  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
37  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
38  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
39  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
40  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
41  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
42  * SUCH DAMAGE.
43  */
44 
45 #include <sys/cdefs.h>
46 __FBSDID("$FreeBSD$");
47 
48 #include "opt_kdtrace.h"
49 #include "opt_mac.h"
50 
51 #include <sys/param.h>
52 #include <sys/kernel.h>
53 #include <sys/lock.h>
54 #include <sys/malloc.h>
55 #include <sys/mutex.h>
56 #include <sys/mac.h>
57 #include <sys/priv.h>
58 #include <sys/sbuf.h>
59 #include <sys/sdt.h>
60 #include <sys/systm.h>
61 #include <sys/mount.h>
62 #include <sys/file.h>
63 #include <sys/namei.h>
64 #include <sys/protosw.h>
65 #include <sys/socket.h>
66 #include <sys/socketvar.h>
67 #include <sys/sysctl.h>
68 
69 #include <net/bpfdesc.h>
70 #include <net/if.h>
71 #include <net/if_var.h>
72 
73 #include <security/mac/mac_framework.h>
74 #include <security/mac/mac_internal.h>
75 #include <security/mac/mac_policy.h>
76 
77 /*
78  * XXXRW: struct ifnet locking is incomplete in the network code, so we use
79  * our own global mutex for struct ifnet.  Non-ideal, but should help in the
80  * SMP environment.
81  */
82 struct mtx mac_ifnet_mtx;
83 MTX_SYSINIT(mac_ifnet_mtx, &mac_ifnet_mtx, "mac_ifnet", MTX_DEF);
84 
85 /*
86  * Retrieve the label associated with an mbuf by searching for the tag.
87  * Depending on the value of mac_labelmbufs, it's possible that a label will
88  * not be present, in which case NULL is returned.  Policies must handle the
89  * possibility of an mbuf not having label storage if they do not enforce
90  * early loading.
91  */
92 struct label *
93 mac_mbuf_to_label(struct mbuf *m)
94 {
95 	struct m_tag *tag;
96 	struct label *label;
97 
98 	if (m == NULL)
99 		return (NULL);
100 	tag = m_tag_find(m, PACKET_TAG_MACLABEL, NULL);
101 	if (tag == NULL)
102 		return (NULL);
103 	label = (struct label *)(tag+1);
104 	return (label);
105 }
106 
107 static struct label *
108 mac_bpfdesc_label_alloc(void)
109 {
110 	struct label *label;
111 
112 	label = mac_labelzone_alloc(M_WAITOK);
113 	MAC_POLICY_PERFORM(bpfdesc_init_label, label);
114 	return (label);
115 }
116 
117 void
118 mac_bpfdesc_init(struct bpf_d *d)
119 {
120 
121 	if (mac_labeled & MPC_OBJECT_BPFDESC)
122 		d->bd_label = mac_bpfdesc_label_alloc();
123 	else
124 		d->bd_label = NULL;
125 }
126 
127 static struct label *
128 mac_ifnet_label_alloc(void)
129 {
130 	struct label *label;
131 
132 	label = mac_labelzone_alloc(M_WAITOK);
133 	MAC_POLICY_PERFORM(ifnet_init_label, label);
134 	return (label);
135 }
136 
137 void
138 mac_ifnet_init(struct ifnet *ifp)
139 {
140 
141 	if (mac_labeled & MPC_OBJECT_IFNET)
142 		ifp->if_label = mac_ifnet_label_alloc();
143 	else
144 		ifp->if_label = NULL;
145 }
146 
147 int
148 mac_mbuf_tag_init(struct m_tag *tag, int flag)
149 {
150 	struct label *label;
151 	int error;
152 
153 	label = (struct label *) (tag + 1);
154 	mac_init_label(label);
155 
156 	if (flag & M_WAITOK)
157 		MAC_POLICY_CHECK(mbuf_init_label, label, flag);
158 	else
159 		MAC_POLICY_CHECK_NOSLEEP(mbuf_init_label, label, flag);
160 	if (error) {
161 		MAC_POLICY_PERFORM_NOSLEEP(mbuf_destroy_label, label);
162 		mac_destroy_label(label);
163 	}
164 	return (error);
165 }
166 
167 int
168 mac_mbuf_init(struct mbuf *m, int flag)
169 {
170 	struct m_tag *tag;
171 	int error;
172 
173 	M_ASSERTPKTHDR(m);
174 
175 	if (mac_labeled & MPC_OBJECT_MBUF) {
176 		tag = m_tag_get(PACKET_TAG_MACLABEL, sizeof(struct label),
177 		    flag);
178 		if (tag == NULL)
179 			return (ENOMEM);
180 		error = mac_mbuf_tag_init(tag, flag);
181 		if (error) {
182 			m_tag_free(tag);
183 			return (error);
184 		}
185 		m_tag_prepend(m, tag);
186 	}
187 	return (0);
188 }
189 
190 static void
191 mac_bpfdesc_label_free(struct label *label)
192 {
193 
194 	MAC_POLICY_PERFORM_NOSLEEP(bpfdesc_destroy_label, label);
195 	mac_labelzone_free(label);
196 }
197 
198 void
199 mac_bpfdesc_destroy(struct bpf_d *d)
200 {
201 
202 	if (d->bd_label != NULL) {
203 		mac_bpfdesc_label_free(d->bd_label);
204 		d->bd_label = NULL;
205 	}
206 }
207 
208 static void
209 mac_ifnet_label_free(struct label *label)
210 {
211 
212 	MAC_POLICY_PERFORM_NOSLEEP(ifnet_destroy_label, label);
213 	mac_labelzone_free(label);
214 }
215 
216 void
217 mac_ifnet_destroy(struct ifnet *ifp)
218 {
219 
220 	if (ifp->if_label != NULL) {
221 		mac_ifnet_label_free(ifp->if_label);
222 		ifp->if_label = NULL;
223 	}
224 }
225 
226 void
227 mac_mbuf_tag_destroy(struct m_tag *tag)
228 {
229 	struct label *label;
230 
231 	label = (struct label *)(tag+1);
232 
233 	MAC_POLICY_PERFORM_NOSLEEP(mbuf_destroy_label, label);
234 	mac_destroy_label(label);
235 }
236 
237 /*
238  * mac_mbuf_tag_copy is called when an mbuf header is duplicated, in which
239  * case the labels must also be duplicated.
240  */
241 void
242 mac_mbuf_tag_copy(struct m_tag *src, struct m_tag *dest)
243 {
244 	struct label *src_label, *dest_label;
245 
246 	src_label = (struct label *)(src+1);
247 	dest_label = (struct label *)(dest+1);
248 
249 	/*
250 	 * mac_mbuf_tag_init() is called on the target tag in m_tag_copy(),
251 	 * so we don't need to call it here.
252 	 */
253 	MAC_POLICY_PERFORM_NOSLEEP(mbuf_copy_label, src_label, dest_label);
254 }
255 
256 void
257 mac_mbuf_copy(struct mbuf *m_from, struct mbuf *m_to)
258 {
259 	struct label *src_label, *dest_label;
260 
261 	if (mac_policy_count == 0)
262 		return;
263 
264 	src_label = mac_mbuf_to_label(m_from);
265 	dest_label = mac_mbuf_to_label(m_to);
266 
267 	MAC_POLICY_PERFORM_NOSLEEP(mbuf_copy_label, src_label, dest_label);
268 }
269 
270 static void
271 mac_ifnet_copy_label(struct label *src, struct label *dest)
272 {
273 
274 	MAC_POLICY_PERFORM_NOSLEEP(ifnet_copy_label, src, dest);
275 }
276 
277 static int
278 mac_ifnet_externalize_label(struct label *label, char *elements,
279     char *outbuf, size_t outbuflen)
280 {
281 	int error;
282 
283 	MAC_POLICY_EXTERNALIZE(ifnet, label, elements, outbuf, outbuflen);
284 
285 	return (error);
286 }
287 
288 static int
289 mac_ifnet_internalize_label(struct label *label, char *string)
290 {
291 	int error;
292 
293 	MAC_POLICY_INTERNALIZE(ifnet, label, string);
294 
295 	return (error);
296 }
297 
298 void
299 mac_ifnet_create(struct ifnet *ifp)
300 {
301 
302 	if (mac_policy_count == 0)
303 		return;
304 
305 	MAC_IFNET_LOCK(ifp);
306 	MAC_POLICY_PERFORM_NOSLEEP(ifnet_create, ifp, ifp->if_label);
307 	MAC_IFNET_UNLOCK(ifp);
308 }
309 
310 void
311 mac_bpfdesc_create(struct ucred *cred, struct bpf_d *d)
312 {
313 
314 	MAC_POLICY_PERFORM_NOSLEEP(bpfdesc_create, cred, d, d->bd_label);
315 }
316 
317 void
318 mac_bpfdesc_create_mbuf(struct bpf_d *d, struct mbuf *m)
319 {
320 	struct label *label;
321 
322 	/* Assume reader lock is enough. */
323 	BPFD_LOCK_ASSERT(d);
324 
325 	if (mac_policy_count == 0)
326 		return;
327 
328 	label = mac_mbuf_to_label(m);
329 
330 	MAC_POLICY_PERFORM_NOSLEEP(bpfdesc_create_mbuf, d, d->bd_label, m,
331 	    label);
332 }
333 
334 void
335 mac_ifnet_create_mbuf(struct ifnet *ifp, struct mbuf *m)
336 {
337 	struct label *label;
338 
339 	if (mac_policy_count == 0)
340 		return;
341 
342 	label = mac_mbuf_to_label(m);
343 
344 	MAC_IFNET_LOCK(ifp);
345 	MAC_POLICY_PERFORM_NOSLEEP(ifnet_create_mbuf, ifp, ifp->if_label, m,
346 	    label);
347 	MAC_IFNET_UNLOCK(ifp);
348 }
349 
350 MAC_CHECK_PROBE_DEFINE2(bpfdesc_check_receive, "struct bpf_d *",
351     "struct ifnet *");
352 
353 int
354 mac_bpfdesc_check_receive(struct bpf_d *d, struct ifnet *ifp)
355 {
356 	int error;
357 
358 	/* Assume reader lock is enough. */
359 	BPFD_LOCK_ASSERT(d);
360 
361 	if (mac_policy_count == 0)
362 		return (0);
363 
364 	MAC_IFNET_LOCK(ifp);
365 	MAC_POLICY_CHECK_NOSLEEP(bpfdesc_check_receive, d, d->bd_label, ifp,
366 	    ifp->if_label);
367 	MAC_CHECK_PROBE2(bpfdesc_check_receive, error, d, ifp);
368 	MAC_IFNET_UNLOCK(ifp);
369 
370 	return (error);
371 }
372 
373 MAC_CHECK_PROBE_DEFINE2(ifnet_check_transmit, "struct ifnet *",
374     "struct mbuf *");
375 
376 int
377 mac_ifnet_check_transmit(struct ifnet *ifp, struct mbuf *m)
378 {
379 	struct label *label;
380 	int error;
381 
382 	M_ASSERTPKTHDR(m);
383 
384 	if (mac_policy_count == 0)
385 		return (0);
386 
387 	label = mac_mbuf_to_label(m);
388 
389 	MAC_IFNET_LOCK(ifp);
390 	MAC_POLICY_CHECK_NOSLEEP(ifnet_check_transmit, ifp, ifp->if_label, m,
391 	    label);
392 	MAC_CHECK_PROBE2(ifnet_check_transmit, error, ifp, m);
393 	MAC_IFNET_UNLOCK(ifp);
394 
395 	return (error);
396 }
397 
398 int
399 mac_ifnet_ioctl_get(struct ucred *cred, struct ifreq *ifr,
400     struct ifnet *ifp)
401 {
402 	char *elements, *buffer;
403 	struct label *intlabel;
404 	struct mac mac;
405 	int error;
406 
407 	if (!(mac_labeled & MPC_OBJECT_IFNET))
408 		return (EINVAL);
409 
410 	error = copyin(ifr->ifr_ifru.ifru_data, &mac, sizeof(mac));
411 	if (error)
412 		return (error);
413 
414 	error = mac_check_structmac_consistent(&mac);
415 	if (error)
416 		return (error);
417 
418 	elements = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK);
419 	error = copyinstr(mac.m_string, elements, mac.m_buflen, NULL);
420 	if (error) {
421 		free(elements, M_MACTEMP);
422 		return (error);
423 	}
424 
425 	buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK | M_ZERO);
426 	intlabel = mac_ifnet_label_alloc();
427 	MAC_IFNET_LOCK(ifp);
428 	mac_ifnet_copy_label(ifp->if_label, intlabel);
429 	MAC_IFNET_UNLOCK(ifp);
430 	error = mac_ifnet_externalize_label(intlabel, elements, buffer,
431 	    mac.m_buflen);
432 	mac_ifnet_label_free(intlabel);
433 	if (error == 0)
434 		error = copyout(buffer, mac.m_string, strlen(buffer)+1);
435 
436 	free(buffer, M_MACTEMP);
437 	free(elements, M_MACTEMP);
438 
439 	return (error);
440 }
441 
442 int
443 mac_ifnet_ioctl_set(struct ucred *cred, struct ifreq *ifr, struct ifnet *ifp)
444 {
445 	struct label *intlabel;
446 	struct mac mac;
447 	char *buffer;
448 	int error;
449 
450 	if (!(mac_labeled & MPC_OBJECT_IFNET))
451 		return (EINVAL);
452 
453 	error = copyin(ifr->ifr_ifru.ifru_data, &mac, sizeof(mac));
454 	if (error)
455 		return (error);
456 
457 	error = mac_check_structmac_consistent(&mac);
458 	if (error)
459 		return (error);
460 
461 	buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK);
462 	error = copyinstr(mac.m_string, buffer, mac.m_buflen, NULL);
463 	if (error) {
464 		free(buffer, M_MACTEMP);
465 		return (error);
466 	}
467 
468 	intlabel = mac_ifnet_label_alloc();
469 	error = mac_ifnet_internalize_label(intlabel, buffer);
470 	free(buffer, M_MACTEMP);
471 	if (error) {
472 		mac_ifnet_label_free(intlabel);
473 		return (error);
474 	}
475 
476 	/*
477 	 * XXX: Note that this is a redundant privilege check, since policies
478 	 * impose this check themselves if required by the policy
479 	 * Eventually, this should go away.
480 	 */
481 	error = priv_check_cred(cred, PRIV_NET_SETIFMAC, 0);
482 	if (error) {
483 		mac_ifnet_label_free(intlabel);
484 		return (error);
485 	}
486 
487 	MAC_IFNET_LOCK(ifp);
488 	MAC_POLICY_CHECK_NOSLEEP(ifnet_check_relabel, cred, ifp,
489 	    ifp->if_label, intlabel);
490 	if (error) {
491 		MAC_IFNET_UNLOCK(ifp);
492 		mac_ifnet_label_free(intlabel);
493 		return (error);
494 	}
495 
496 	MAC_POLICY_PERFORM_NOSLEEP(ifnet_relabel, cred, ifp, ifp->if_label,
497 	    intlabel);
498 	MAC_IFNET_UNLOCK(ifp);
499 
500 	mac_ifnet_label_free(intlabel);
501 	return (0);
502 }
503