1 /*- 2 * Copyright (c) 2002, 2003 Networks Associates Technology, Inc. 3 * All rights reserved. 4 * 5 * This software was developed for the FreeBSD Project in part by Network 6 * Associates Laboratories, the Security Research Division of Network 7 * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), 8 * as part of the DARPA CHATS research program. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29 * SUCH DAMAGE. 30 */ 31 32 #include <sys/cdefs.h> 33 __FBSDID("$FreeBSD$"); 34 35 #include "opt_mac.h" 36 37 #include <sys/param.h> 38 #include <sys/kernel.h> 39 #include <sys/lock.h> 40 #include <sys/malloc.h> 41 #include <sys/module.h> 42 #include <sys/mutex.h> 43 #include <sys/mac.h> 44 #include <sys/systm.h> 45 #include <sys/vnode.h> 46 #include <sys/sysctl.h> 47 48 #include <sys/mac_policy.h> 49 50 #include <security/mac/mac_framework.h> 51 #include <security/mac/mac_internal.h> 52 53 static int mac_enforce_kld = 1; 54 SYSCTL_INT(_security_mac, OID_AUTO, enforce_kld, CTLFLAG_RW, 55 &mac_enforce_kld, 0, "Enforce MAC policy on kld operations"); 56 TUNABLE_INT("security.mac.enforce_kld", &mac_enforce_kld); 57 58 static int mac_enforce_system = 1; 59 SYSCTL_INT(_security_mac, OID_AUTO, enforce_system, CTLFLAG_RW, 60 &mac_enforce_system, 0, "Enforce MAC policy on system operations"); 61 TUNABLE_INT("security.mac.enforce_system", &mac_enforce_system); 62 63 /* 64 * XXXRW: Some of these checks now duplicate privilege checks. However, 65 * others provide additional security context that may be useful to policies. 66 * We need to review these and remove ones that are pure duplicates. 67 */ 68 69 int 70 mac_check_kenv_dump(struct ucred *cred) 71 { 72 int error; 73 74 if (!mac_enforce_system) 75 return (0); 76 77 MAC_CHECK(check_kenv_dump, cred); 78 79 return (error); 80 } 81 82 int 83 mac_check_kenv_get(struct ucred *cred, char *name) 84 { 85 int error; 86 87 if (!mac_enforce_system) 88 return (0); 89 90 MAC_CHECK(check_kenv_get, cred, name); 91 92 return (error); 93 } 94 95 int 96 mac_check_kenv_set(struct ucred *cred, char *name, char *value) 97 { 98 int error; 99 100 if (!mac_enforce_system) 101 return (0); 102 103 MAC_CHECK(check_kenv_set, cred, name, value); 104 105 return (error); 106 } 107 108 int 109 mac_check_kenv_unset(struct ucred *cred, char *name) 110 { 111 int error; 112 113 if (!mac_enforce_system) 114 return (0); 115 116 MAC_CHECK(check_kenv_unset, cred, name); 117 118 return (error); 119 } 120 121 int 122 mac_check_kld_load(struct ucred *cred, struct vnode *vp) 123 { 124 int error; 125 126 ASSERT_VOP_LOCKED(vp, "mac_check_kld_load"); 127 128 if (!mac_enforce_kld) 129 return (0); 130 131 MAC_CHECK(check_kld_load, cred, vp, vp->v_label); 132 133 return (error); 134 } 135 136 int 137 mac_check_kld_stat(struct ucred *cred) 138 { 139 int error; 140 141 if (!mac_enforce_kld) 142 return (0); 143 144 MAC_CHECK(check_kld_stat, cred); 145 146 return (error); 147 } 148 149 int 150 mac_check_kld_unload(struct ucred *cred) 151 { 152 int error; 153 154 if (!mac_enforce_kld) 155 return (0); 156 157 MAC_CHECK(check_kld_unload, cred); 158 159 return (error); 160 } 161 162 int 163 mac_check_sysarch_ioperm(struct ucred *cred) 164 { 165 int error; 166 167 if (!mac_enforce_system) 168 return (0); 169 170 MAC_CHECK(check_sysarch_ioperm, cred); 171 return (error); 172 } 173 174 int 175 mac_check_system_acct(struct ucred *cred, struct vnode *vp) 176 { 177 int error; 178 179 if (vp != NULL) { 180 ASSERT_VOP_LOCKED(vp, "mac_check_system_acct"); 181 } 182 183 if (!mac_enforce_system) 184 return (0); 185 186 MAC_CHECK(check_system_acct, cred, vp, 187 vp != NULL ? vp->v_label : NULL); 188 189 return (error); 190 } 191 192 int 193 mac_check_system_nfsd(struct ucred *cred) 194 { 195 int error; 196 197 if (!mac_enforce_system) 198 return (0); 199 200 MAC_CHECK(check_system_nfsd, cred); 201 202 return (error); 203 } 204 205 int 206 mac_check_system_reboot(struct ucred *cred, int howto) 207 { 208 int error; 209 210 if (!mac_enforce_system) 211 return (0); 212 213 MAC_CHECK(check_system_reboot, cred, howto); 214 215 return (error); 216 } 217 218 int 219 mac_check_system_settime(struct ucred *cred) 220 { 221 int error; 222 223 if (!mac_enforce_system) 224 return (0); 225 226 MAC_CHECK(check_system_settime, cred); 227 228 return (error); 229 } 230 231 int 232 mac_check_system_swapon(struct ucred *cred, struct vnode *vp) 233 { 234 int error; 235 236 ASSERT_VOP_LOCKED(vp, "mac_check_system_swapon"); 237 238 if (!mac_enforce_system) 239 return (0); 240 241 MAC_CHECK(check_system_swapon, cred, vp, vp->v_label); 242 return (error); 243 } 244 245 int 246 mac_check_system_swapoff(struct ucred *cred, struct vnode *vp) 247 { 248 int error; 249 250 ASSERT_VOP_LOCKED(vp, "mac_check_system_swapoff"); 251 252 if (!mac_enforce_system) 253 return (0); 254 255 MAC_CHECK(check_system_swapoff, cred, vp, vp->v_label); 256 return (error); 257 } 258 259 int 260 mac_check_system_sysctl(struct ucred *cred, struct sysctl_oid *oidp, void *arg1, 261 int arg2, struct sysctl_req *req) 262 { 263 int error; 264 265 /* 266 * XXXMAC: We would very much like to assert the SYSCTL_LOCK here, 267 * but since it's not exported from kern_sysctl.c, we can't. 268 */ 269 if (!mac_enforce_system) 270 return (0); 271 272 MAC_CHECK(check_system_sysctl, cred, oidp, arg1, arg2, req); 273 274 return (error); 275 } 276