xref: /freebsd/sys/security/mac/mac_process.c (revision d72a078647de20e31ab09295e671f1b8b4ad89b2) 
1 /*-
2  * Copyright (c) 1999-2002 Robert N. M. Watson
3  * Copyright (c) 2001 Ilmar S. Habibulin
4  * Copyright (c) 2001-2003 Networks Associates Technology, Inc.
5  * Copyright (c) 2005 Samy Al Bahra
6  * All rights reserved.
7  *
8  * This software was developed by Robert Watson and Ilmar Habibulin for the
9  * TrustedBSD Project.
10  *
11  * This software was developed for the FreeBSD Project in part by Network
12  * Associates Laboratories, the Security Research Division of Network
13  * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"),
14  * as part of the DARPA CHATS research program.
15  *
16  * Redistribution and use in source and binary forms, with or without
17  * modification, are permitted provided that the following conditions
18  * are met:
19  * 1. Redistributions of source code must retain the above copyright
20  *    notice, this list of conditions and the following disclaimer.
21  * 2. Redistributions in binary form must reproduce the above copyright
22  *    notice, this list of conditions and the following disclaimer in the
23  *    documentation and/or other materials provided with the distribution.
24  *
25  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
26  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
27  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
28  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
29  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
30  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
31  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
32  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
33  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
34  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
35  * SUCH DAMAGE.
36  */
37 
38 #include <sys/cdefs.h>
39 __FBSDID("$FreeBSD$");
40 
41 #include "opt_mac.h"
42 
43 #include <sys/param.h>
44 #include <sys/condvar.h>
45 #include <sys/imgact.h>
46 #include <sys/kernel.h>
47 #include <sys/lock.h>
48 #include <sys/malloc.h>
49 #include <sys/mutex.h>
50 #include <sys/mac.h>
51 #include <sys/proc.h>
52 #include <sys/sbuf.h>
53 #include <sys/systm.h>
54 #include <sys/vnode.h>
55 #include <sys/mount.h>
56 #include <sys/file.h>
57 #include <sys/namei.h>
58 #include <sys/sysctl.h>
59 
60 #include <vm/vm.h>
61 #include <vm/pmap.h>
62 #include <vm/vm_map.h>
63 #include <vm/vm_object.h>
64 
65 #include <sys/mac_policy.h>
66 
67 #include <security/mac/mac_internal.h>
68 
69 int	mac_enforce_process = 1;
70 SYSCTL_INT(_security_mac, OID_AUTO, enforce_process, CTLFLAG_RW,
71     &mac_enforce_process, 0, "Enforce MAC policy on inter-process operations");
72 TUNABLE_INT("security.mac.enforce_process", &mac_enforce_process);
73 
74 int	mac_enforce_vm = 1;
75 SYSCTL_INT(_security_mac, OID_AUTO, enforce_vm, CTLFLAG_RW,
76     &mac_enforce_vm, 0, "Enforce MAC policy on vm operations");
77 TUNABLE_INT("security.mac.enforce_vm", &mac_enforce_vm);
78 
79 static int	mac_mmap_revocation = 1;
80 SYSCTL_INT(_security_mac, OID_AUTO, mmap_revocation, CTLFLAG_RW,
81     &mac_mmap_revocation, 0, "Revoke mmap access to files on subject "
82     "relabel");
83 
84 static int	mac_mmap_revocation_via_cow = 0;
85 SYSCTL_INT(_security_mac, OID_AUTO, mmap_revocation_via_cow, CTLFLAG_RW,
86     &mac_mmap_revocation_via_cow, 0, "Revoke mmap access to files via "
87     "copy-on-write semantics, or by removing all write access");
88 
89 static int	mac_enforce_suid = 1;
90 SYSCTL_INT(_security_mac, OID_AUTO, enforce_suid, CTLFLAG_RW,
91     &mac_enforce_suid, 0, "Enforce MAC policy on suid/sgid operations");
92 TUNABLE_INT("security.mac.enforce_suid", &mac_enforce_suid);
93 
94 static void	mac_cred_mmapped_drop_perms_recurse(struct thread *td,
95 		    struct ucred *cred, struct vm_map *map);
96 
97 struct label *
98 mac_cred_label_alloc(void)
99 {
100 	struct label *label;
101 
102 	label = mac_labelzone_alloc(M_WAITOK);
103 	MAC_PERFORM(init_cred_label, label);
104 	return (label);
105 }
106 
107 void
108 mac_init_cred(struct ucred *cred)
109 {
110 
111 	cred->cr_label = mac_cred_label_alloc();
112 }
113 
114 static struct label *
115 mac_proc_label_alloc(void)
116 {
117 	struct label *label;
118 
119 	label = mac_labelzone_alloc(M_WAITOK);
120 	MAC_PERFORM(init_proc_label, label);
121 	return (label);
122 }
123 
124 void
125 mac_init_proc(struct proc *p)
126 {
127 
128 	p->p_label = mac_proc_label_alloc();
129 }
130 
131 void
132 mac_cred_label_free(struct label *label)
133 {
134 
135 	MAC_PERFORM(destroy_cred_label, label);
136 	mac_labelzone_free(label);
137 }
138 
139 void
140 mac_destroy_cred(struct ucred *cred)
141 {
142 
143 	mac_cred_label_free(cred->cr_label);
144 	cred->cr_label = NULL;
145 }
146 
147 static void
148 mac_proc_label_free(struct label *label)
149 {
150 
151 	MAC_PERFORM(destroy_proc_label, label);
152 	mac_labelzone_free(label);
153 }
154 
155 void
156 mac_destroy_proc(struct proc *p)
157 {
158 
159 	mac_proc_label_free(p->p_label);
160 	p->p_label = NULL;
161 }
162 
163 int
164 mac_externalize_cred_label(struct label *label, char *elements,
165     char *outbuf, size_t outbuflen)
166 {
167 	int error;
168 
169 	MAC_EXTERNALIZE(cred, label, elements, outbuf, outbuflen);
170 
171 	return (error);
172 }
173 
174 int
175 mac_internalize_cred_label(struct label *label, char *string)
176 {
177 	int error;
178 
179 	MAC_INTERNALIZE(cred, label, string);
180 
181 	return (error);
182 }
183 
184 /*
185  * Initialize MAC label for the first kernel process, from which other
186  * kernel processes and threads are spawned.
187  */
188 void
189 mac_create_proc0(struct ucred *cred)
190 {
191 
192 	MAC_PERFORM(create_proc0, cred);
193 }
194 
195 /*
196  * Initialize MAC label for the first userland process, from which other
197  * userland processes and threads are spawned.
198  */
199 void
200 mac_create_proc1(struct ucred *cred)
201 {
202 
203 	MAC_PERFORM(create_proc1, cred);
204 }
205 
206 void
207 mac_thread_userret(struct thread *td)
208 {
209 
210 	MAC_PERFORM(thread_userret, td);
211 }
212 
213 /*
214  * When a new process is created, its label must be initialized.  Generally,
215  * this involves inheritence from the parent process, modulo possible
216  * deltas.  This function allows that processing to take place.
217  */
218 void
219 mac_copy_cred(struct ucred *src, struct ucred *dest)
220 {
221 
222 	MAC_PERFORM(copy_cred_label, src->cr_label, dest->cr_label);
223 }
224 
225 int
226 mac_execve_enter(struct image_params *imgp, struct mac *mac_p)
227 {
228 	struct label *label;
229 	struct mac mac;
230 	char *buffer;
231 	int error;
232 
233 	if (mac_p == NULL)
234 		return (0);
235 
236 	error = copyin(mac_p, &mac, sizeof(mac));
237 	if (error)
238 		return (error);
239 
240 	error = mac_check_structmac_consistent(&mac);
241 	if (error)
242 		return (error);
243 
244 	buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK);
245 	error = copyinstr(mac.m_string, buffer, mac.m_buflen, NULL);
246 	if (error) {
247 		free(buffer, M_MACTEMP);
248 		return (error);
249 	}
250 
251 	label = mac_cred_label_alloc();
252 	error = mac_internalize_cred_label(label, buffer);
253 	free(buffer, M_MACTEMP);
254 	if (error) {
255 		mac_cred_label_free(label);
256 		return (error);
257 	}
258 	imgp->execlabel = label;
259 	return (0);
260 }
261 
262 void
263 mac_execve_exit(struct image_params *imgp)
264 {
265 	if (imgp->execlabel != NULL) {
266 		mac_cred_label_free(imgp->execlabel);
267 		imgp->execlabel = NULL;
268 	}
269 }
270 
271 /*
272  * When relabeling a process, call out to the policies for the maximum
273  * permission allowed for each object type we know about in its
274  * memory space, and revoke access (in the least surprising ways we
275  * know) when necessary.  The process lock is not held here.
276  */
277 void
278 mac_cred_mmapped_drop_perms(struct thread *td, struct ucred *cred)
279 {
280 
281 	/* XXX freeze all other threads */
282 	mac_cred_mmapped_drop_perms_recurse(td, cred,
283 	    &td->td_proc->p_vmspace->vm_map);
284 	/* XXX allow other threads to continue */
285 }
286 
287 static __inline const char *
288 prot2str(vm_prot_t prot)
289 {
290 
291 	switch (prot & VM_PROT_ALL) {
292 	case VM_PROT_READ:
293 		return ("r--");
294 	case VM_PROT_READ | VM_PROT_WRITE:
295 		return ("rw-");
296 	case VM_PROT_READ | VM_PROT_EXECUTE:
297 		return ("r-x");
298 	case VM_PROT_READ | VM_PROT_WRITE | VM_PROT_EXECUTE:
299 		return ("rwx");
300 	case VM_PROT_WRITE:
301 		return ("-w-");
302 	case VM_PROT_EXECUTE:
303 		return ("--x");
304 	case VM_PROT_WRITE | VM_PROT_EXECUTE:
305 		return ("-wx");
306 	default:
307 		return ("---");
308 	}
309 }
310 
311 static void
312 mac_cred_mmapped_drop_perms_recurse(struct thread *td, struct ucred *cred,
313     struct vm_map *map)
314 {
315 	struct vm_map_entry *vme;
316 	int vfslocked, result;
317 	vm_prot_t revokeperms;
318 	vm_object_t backing_object, object;
319 	vm_ooffset_t offset;
320 	struct vnode *vp;
321 	struct mount *mp;
322 
323 	if (!mac_mmap_revocation)
324 		return;
325 
326 	vm_map_lock_read(map);
327 	for (vme = map->header.next; vme != &map->header; vme = vme->next) {
328 		if (vme->eflags & MAP_ENTRY_IS_SUB_MAP) {
329 			mac_cred_mmapped_drop_perms_recurse(td, cred,
330 			    vme->object.sub_map);
331 			continue;
332 		}
333 		/*
334 		 * Skip over entries that obviously are not shared.
335 		 */
336 		if (vme->eflags & (MAP_ENTRY_COW | MAP_ENTRY_NOSYNC) ||
337 		    !vme->max_protection)
338 			continue;
339 		/*
340 		 * Drill down to the deepest backing object.
341 		 */
342 		offset = vme->offset;
343 		object = vme->object.vm_object;
344 		if (object == NULL)
345 			continue;
346 		VM_OBJECT_LOCK(object);
347 		while ((backing_object = object->backing_object) != NULL) {
348 			VM_OBJECT_LOCK(backing_object);
349 			offset += object->backing_object_offset;
350 			VM_OBJECT_UNLOCK(object);
351 			object = backing_object;
352 		}
353 		VM_OBJECT_UNLOCK(object);
354 		/*
355 		 * At the moment, vm_maps and objects aren't considered
356 		 * by the MAC system, so only things with backing by a
357 		 * normal object (read: vnodes) are checked.
358 		 */
359 		if (object->type != OBJT_VNODE)
360 			continue;
361 		vp = (struct vnode *)object->handle;
362 		vfslocked = VFS_LOCK_GIANT(vp->v_mount);
363 		vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td);
364 		result = vme->max_protection;
365 		mac_check_vnode_mmap_downgrade(cred, vp, &result);
366 		VOP_UNLOCK(vp, 0, td);
367 		/*
368 		 * Find out what maximum protection we may be allowing
369 		 * now but a policy needs to get removed.
370 		 */
371 		revokeperms = vme->max_protection & ~result;
372 		if (!revokeperms) {
373 			VFS_UNLOCK_GIANT(vfslocked);
374 			continue;
375 		}
376 		printf("pid %ld: revoking %s perms from %#lx:%ld "
377 		    "(max %s/cur %s)\n", (long)td->td_proc->p_pid,
378 		    prot2str(revokeperms), (u_long)vme->start,
379 		    (long)(vme->end - vme->start),
380 		    prot2str(vme->max_protection), prot2str(vme->protection));
381 		vm_map_lock_upgrade(map);
382 		/*
383 		 * This is the really simple case: if a map has more
384 		 * max_protection than is allowed, but it's not being
385 		 * actually used (that is, the current protection is
386 		 * still allowed), we can just wipe it out and do
387 		 * nothing more.
388 		 */
389 		if ((vme->protection & revokeperms) == 0) {
390 			vme->max_protection -= revokeperms;
391 		} else {
392 			if (revokeperms & VM_PROT_WRITE) {
393 				/*
394 				 * In the more complicated case, flush out all
395 				 * pending changes to the object then turn it
396 				 * copy-on-write.
397 				 */
398 				vm_object_reference(object);
399 				(void) vn_start_write(vp, &mp, V_WAIT);
400 				vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td);
401 				VM_OBJECT_LOCK(object);
402 				vm_object_page_clean(object,
403 				    OFF_TO_IDX(offset),
404 				    OFF_TO_IDX(offset + vme->end - vme->start +
405 					PAGE_MASK),
406 				    OBJPC_SYNC);
407 				VM_OBJECT_UNLOCK(object);
408 				VOP_UNLOCK(vp, 0, td);
409 				vn_finished_write(mp);
410 				vm_object_deallocate(object);
411 				/*
412 				 * Why bother if there's no read permissions
413 				 * anymore?  For the rest, we need to leave
414 				 * the write permissions on for COW, or
415 				 * remove them entirely if configured to.
416 				 */
417 				if (!mac_mmap_revocation_via_cow) {
418 					vme->max_protection &= ~VM_PROT_WRITE;
419 					vme->protection &= ~VM_PROT_WRITE;
420 				} if ((revokeperms & VM_PROT_READ) == 0)
421 					vme->eflags |= MAP_ENTRY_COW |
422 					    MAP_ENTRY_NEEDS_COPY;
423 			}
424 			if (revokeperms & VM_PROT_EXECUTE) {
425 				vme->max_protection &= ~VM_PROT_EXECUTE;
426 				vme->protection &= ~VM_PROT_EXECUTE;
427 			}
428 			if (revokeperms & VM_PROT_READ) {
429 				vme->max_protection = 0;
430 				vme->protection = 0;
431 			}
432 			pmap_protect(map->pmap, vme->start, vme->end,
433 			    vme->protection & ~revokeperms);
434 			vm_map_simplify_entry(map, vme);
435 		}
436 		vm_map_lock_downgrade(map);
437 		VFS_UNLOCK_GIANT(vfslocked);
438 	}
439 	vm_map_unlock_read(map);
440 }
441 
442 /*
443  * When the subject's label changes, it may require revocation of privilege
444  * to mapped objects.  This can't be done on-the-fly later with a unified
445  * buffer cache.
446  */
447 void
448 mac_relabel_cred(struct ucred *cred, struct label *newlabel)
449 {
450 
451 	MAC_PERFORM(relabel_cred, cred, newlabel);
452 }
453 
454 int
455 mac_check_cred_relabel(struct ucred *cred, struct label *newlabel)
456 {
457 	int error;
458 
459 	MAC_CHECK(check_cred_relabel, cred, newlabel);
460 
461 	return (error);
462 }
463 
464 int
465 mac_check_cred_visible(struct ucred *u1, struct ucred *u2)
466 {
467 	int error;
468 
469 	if (!mac_enforce_process)
470 		return (0);
471 
472 	MAC_CHECK(check_cred_visible, u1, u2);
473 
474 	return (error);
475 }
476 
477 int
478 mac_check_proc_debug(struct ucred *cred, struct proc *proc)
479 {
480 	int error;
481 
482 	PROC_LOCK_ASSERT(proc, MA_OWNED);
483 
484 	if (!mac_enforce_process)
485 		return (0);
486 
487 	MAC_CHECK(check_proc_debug, cred, proc);
488 
489 	return (error);
490 }
491 
492 int
493 mac_check_proc_sched(struct ucred *cred, struct proc *proc)
494 {
495 	int error;
496 
497 	PROC_LOCK_ASSERT(proc, MA_OWNED);
498 
499 	if (!mac_enforce_process)
500 		return (0);
501 
502 	MAC_CHECK(check_proc_sched, cred, proc);
503 
504 	return (error);
505 }
506 
507 int
508 mac_check_proc_signal(struct ucred *cred, struct proc *proc, int signum)
509 {
510 	int error;
511 
512 	PROC_LOCK_ASSERT(proc, MA_OWNED);
513 
514 	if (!mac_enforce_process)
515 		return (0);
516 
517 	MAC_CHECK(check_proc_signal, cred, proc, signum);
518 
519 	return (error);
520 }
521 
522 int
523 mac_check_proc_setuid(struct proc *proc, struct ucred *cred, uid_t uid)
524 {
525 	int error;
526 
527 	PROC_LOCK_ASSERT(proc, MA_OWNED);
528 
529 	if (!mac_enforce_suid)
530 		return (0);
531 
532 	MAC_CHECK(check_proc_setuid, cred, uid);
533 	return (error);
534 }
535 
536 int
537 mac_check_proc_seteuid(struct proc *proc, struct ucred *cred, uid_t euid)
538 {
539 	int error;
540 
541 	PROC_LOCK_ASSERT(proc, MA_OWNED);
542 
543 	if (!mac_enforce_suid)
544 		return (0);
545 
546 	MAC_CHECK(check_proc_seteuid, cred, euid);
547 	return (error);
548 }
549 
550 int
551 mac_check_proc_setgid(struct proc *proc, struct ucred *cred, gid_t gid)
552 {
553 	int error;
554 
555 	PROC_LOCK_ASSERT(proc, MA_OWNED);
556 
557 	if (!mac_enforce_suid)
558 		return (0);
559 
560 	MAC_CHECK(check_proc_setgid, cred, gid);
561 	return (error);
562 }
563 
564 int
565 mac_check_proc_setegid(struct proc *proc, struct ucred *cred, gid_t egid)
566 {
567 	int error;
568 
569 	PROC_LOCK_ASSERT(proc, MA_OWNED);
570 
571 	if (!mac_enforce_suid)
572 		return (0);
573 
574 	MAC_CHECK(check_proc_setegid, cred, egid);
575 	return (error);
576 }
577 
578 int
579 mac_check_proc_setgroups(struct proc *proc, struct ucred *cred,
580 	int ngroups, gid_t *gidset)
581 {
582 	int error;
583 
584 	PROC_LOCK_ASSERT(proc, MA_OWNED);
585 
586 	if (!mac_enforce_suid)
587 		return (0);
588 
589 	MAC_CHECK(check_proc_setgroups, cred, ngroups, gidset);
590 	return (error);
591 }
592 
593 int
594 mac_check_proc_setreuid(struct proc *proc, struct ucred *cred, uid_t ruid,
595 	uid_t euid)
596 {
597 	int error;
598 
599 	PROC_LOCK_ASSERT(proc, MA_OWNED);
600 
601 	if (!mac_enforce_suid)
602 		return (0);
603 
604 	MAC_CHECK(check_proc_setreuid, cred, ruid, euid);
605 	return (error);
606 }
607 
608 int
609 mac_check_proc_setregid(struct proc *proc, struct ucred *cred, gid_t rgid,
610 	gid_t egid)
611 {
612 	int error;
613 
614 	PROC_LOCK_ASSERT(proc, MA_OWNED);
615 
616 	if (!mac_enforce_suid)
617 		return (0);
618 
619 	MAC_CHECK(check_proc_setregid, cred, rgid, egid);
620 	return (error);
621 }
622 
623 int
624 mac_check_proc_setresuid(struct proc *proc, struct ucred *cred, uid_t ruid,
625 	uid_t euid, uid_t suid)
626 {
627 	int error;
628 
629 	PROC_LOCK_ASSERT(proc, MA_OWNED);
630 
631 	if (!mac_enforce_suid)
632 		return (0);
633 
634 	MAC_CHECK(check_proc_setresuid, cred, ruid, euid, suid);
635 	return (error);
636 }
637 
638 int
639 mac_check_proc_setresgid(struct proc *proc, struct ucred *cred, gid_t rgid,
640 	gid_t egid, gid_t sgid)
641 {
642 	int error;
643 
644 	PROC_LOCK_ASSERT(proc, MA_OWNED);
645 
646 	if (!mac_enforce_suid)
647 		return (0);
648 
649 	MAC_CHECK(check_proc_setresgid, cred, rgid, egid, sgid);
650 	return (error);
651 }
652 
653 int
654 mac_check_proc_wait(struct ucred *cred, struct proc *proc)
655 {
656 	int error;
657 
658 	PROC_LOCK_ASSERT(proc, MA_OWNED);
659 
660 	if (!mac_enforce_process)
661 		return (0);
662 
663 	MAC_CHECK(check_proc_wait, cred, proc);
664 
665 	return (error);
666 }
667