1 /*- 2 * Copyright (c) 1999-2002, 2007-2011 Robert N. M. Watson 3 * Copyright (c) 2001-2005 McAfee, Inc. 4 * Copyright (c) 2006 SPARTA, Inc. 5 * All rights reserved. 6 * 7 * This software was developed by Robert Watson for the TrustedBSD Project. 8 * 9 * This software was developed for the FreeBSD Project in part by McAfee 10 * Research, the Security Research Division of McAfee, Inc. under 11 * DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA 12 * CHATS research program. 13 * 14 * This software was enhanced by SPARTA ISSO under SPAWAR contract 15 * N66001-04-C-6019 ("SEFOS"). 16 * 17 * This software was developed at the University of Cambridge Computer 18 * Laboratory with support from a grant from Google, Inc. 19 * 20 * Redistribution and use in source and binary forms, with or without 21 * modification, are permitted provided that the following conditions 22 * are met: 23 * 1. Redistributions of source code must retain the above copyright 24 * notice, this list of conditions and the following disclaimer. 25 * 2. Redistributions in binary form must reproduce the above copyright 26 * notice, this list of conditions and the following disclaimer in the 27 * documentation and/or other materials provided with the distribution. 28 * 29 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 30 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 31 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 32 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 33 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 34 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 35 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 36 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 37 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 38 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 39 * SUCH DAMAGE. 40 * 41 * $FreeBSD$ 42 */ 43 44 /* 45 * Developed by the TrustedBSD Project. 46 * 47 * MLS fixed label mandatory confidentiality policy. 48 */ 49 50 #include <sys/types.h> 51 #include <sys/param.h> 52 #include <sys/acl.h> 53 #include <sys/conf.h> 54 #include <sys/extattr.h> 55 #include <sys/kernel.h> 56 #include <sys/ksem.h> 57 #include <sys/mman.h> 58 #include <sys/malloc.h> 59 #include <sys/mount.h> 60 #include <sys/proc.h> 61 #include <sys/sbuf.h> 62 #include <sys/systm.h> 63 #include <sys/sysproto.h> 64 #include <sys/sysent.h> 65 #include <sys/systm.h> 66 #include <sys/vnode.h> 67 #include <sys/file.h> 68 #include <sys/socket.h> 69 #include <sys/socketvar.h> 70 #include <sys/pipe.h> 71 #include <sys/sx.h> 72 #include <sys/sysctl.h> 73 #include <sys/msg.h> 74 #include <sys/sem.h> 75 #include <sys/shm.h> 76 77 #include <fs/devfs/devfs.h> 78 79 #include <net/bpfdesc.h> 80 #include <net/if.h> 81 #include <net/if_types.h> 82 #include <net/if_var.h> 83 84 #include <netinet/in.h> 85 #include <netinet/in_pcb.h> 86 #include <netinet/ip_var.h> 87 88 #include <vm/uma.h> 89 #include <vm/vm.h> 90 91 #include <security/mac/mac_policy.h> 92 #include <security/mac_mls/mac_mls.h> 93 94 SYSCTL_DECL(_security_mac); 95 96 static SYSCTL_NODE(_security_mac, OID_AUTO, mls, CTLFLAG_RW, 0, 97 "TrustedBSD mac_mls policy controls"); 98 99 static int mls_label_size = sizeof(struct mac_mls); 100 SYSCTL_INT(_security_mac_mls, OID_AUTO, label_size, CTLFLAG_RD, 101 &mls_label_size, 0, "Size of struct mac_mls"); 102 103 static int mls_enabled = 1; 104 SYSCTL_INT(_security_mac_mls, OID_AUTO, enabled, CTLFLAG_RW, &mls_enabled, 0, 105 "Enforce MAC/MLS policy"); 106 TUNABLE_INT("security.mac.mls.enabled", &mls_enabled); 107 108 static int destroyed_not_inited; 109 SYSCTL_INT(_security_mac_mls, OID_AUTO, destroyed_not_inited, CTLFLAG_RD, 110 &destroyed_not_inited, 0, "Count of labels destroyed but not inited"); 111 112 static int ptys_equal = 0; 113 SYSCTL_INT(_security_mac_mls, OID_AUTO, ptys_equal, CTLFLAG_RW, 114 &ptys_equal, 0, "Label pty devices as mls/equal on create"); 115 TUNABLE_INT("security.mac.mls.ptys_equal", &ptys_equal); 116 117 static int revocation_enabled = 0; 118 SYSCTL_INT(_security_mac_mls, OID_AUTO, revocation_enabled, CTLFLAG_RW, 119 &revocation_enabled, 0, "Revoke access to objects on relabel"); 120 TUNABLE_INT("security.mac.mls.revocation_enabled", &revocation_enabled); 121 122 static int max_compartments = MAC_MLS_MAX_COMPARTMENTS; 123 SYSCTL_INT(_security_mac_mls, OID_AUTO, max_compartments, CTLFLAG_RD, 124 &max_compartments, 0, "Maximum compartments the policy supports"); 125 126 static int mls_slot; 127 #define SLOT(l) ((struct mac_mls *)mac_label_get((l), mls_slot)) 128 #define SLOT_SET(l, val) mac_label_set((l), mls_slot, (uintptr_t)(val)) 129 130 static uma_zone_t zone_mls; 131 132 static __inline int 133 mls_bit_set_empty(u_char *set) { 134 int i; 135 136 for (i = 0; i < MAC_MLS_MAX_COMPARTMENTS >> 3; i++) 137 if (set[i] != 0) 138 return (0); 139 return (1); 140 } 141 142 static struct mac_mls * 143 mls_alloc(int flag) 144 { 145 146 return (uma_zalloc(zone_mls, flag | M_ZERO)); 147 } 148 149 static void 150 mls_free(struct mac_mls *mm) 151 { 152 153 if (mm != NULL) 154 uma_zfree(zone_mls, mm); 155 else 156 atomic_add_int(&destroyed_not_inited, 1); 157 } 158 159 static int 160 mls_atmostflags(struct mac_mls *mm, int flags) 161 { 162 163 if ((mm->mm_flags & flags) != mm->mm_flags) 164 return (EINVAL); 165 return (0); 166 } 167 168 static int 169 mls_dominate_element(struct mac_mls_element *a, struct mac_mls_element *b) 170 { 171 int bit; 172 173 switch (a->mme_type) { 174 case MAC_MLS_TYPE_EQUAL: 175 case MAC_MLS_TYPE_HIGH: 176 return (1); 177 178 case MAC_MLS_TYPE_LOW: 179 switch (b->mme_type) { 180 case MAC_MLS_TYPE_LEVEL: 181 case MAC_MLS_TYPE_HIGH: 182 return (0); 183 184 case MAC_MLS_TYPE_EQUAL: 185 case MAC_MLS_TYPE_LOW: 186 return (1); 187 188 default: 189 panic("mls_dominate_element: b->mme_type invalid"); 190 } 191 192 case MAC_MLS_TYPE_LEVEL: 193 switch (b->mme_type) { 194 case MAC_MLS_TYPE_EQUAL: 195 case MAC_MLS_TYPE_LOW: 196 return (1); 197 198 case MAC_MLS_TYPE_HIGH: 199 return (0); 200 201 case MAC_MLS_TYPE_LEVEL: 202 for (bit = 1; bit <= MAC_MLS_MAX_COMPARTMENTS; bit++) 203 if (!MAC_MLS_BIT_TEST(bit, 204 a->mme_compartments) && 205 MAC_MLS_BIT_TEST(bit, b->mme_compartments)) 206 return (0); 207 return (a->mme_level >= b->mme_level); 208 209 default: 210 panic("mls_dominate_element: b->mme_type invalid"); 211 } 212 213 default: 214 panic("mls_dominate_element: a->mme_type invalid"); 215 } 216 217 return (0); 218 } 219 220 static int 221 mls_range_in_range(struct mac_mls *rangea, struct mac_mls *rangeb) 222 { 223 224 return (mls_dominate_element(&rangeb->mm_rangehigh, 225 &rangea->mm_rangehigh) && 226 mls_dominate_element(&rangea->mm_rangelow, 227 &rangeb->mm_rangelow)); 228 } 229 230 static int 231 mls_effective_in_range(struct mac_mls *effective, struct mac_mls *range) 232 { 233 234 KASSERT((effective->mm_flags & MAC_MLS_FLAG_EFFECTIVE) != 0, 235 ("mls_effective_in_range: a not effective")); 236 KASSERT((range->mm_flags & MAC_MLS_FLAG_RANGE) != 0, 237 ("mls_effective_in_range: b not range")); 238 239 return (mls_dominate_element(&range->mm_rangehigh, 240 &effective->mm_effective) && 241 mls_dominate_element(&effective->mm_effective, 242 &range->mm_rangelow)); 243 244 return (1); 245 } 246 247 static int 248 mls_dominate_effective(struct mac_mls *a, struct mac_mls *b) 249 { 250 KASSERT((a->mm_flags & MAC_MLS_FLAG_EFFECTIVE) != 0, 251 ("mls_dominate_effective: a not effective")); 252 KASSERT((b->mm_flags & MAC_MLS_FLAG_EFFECTIVE) != 0, 253 ("mls_dominate_effective: b not effective")); 254 255 return (mls_dominate_element(&a->mm_effective, &b->mm_effective)); 256 } 257 258 static int 259 mls_equal_element(struct mac_mls_element *a, struct mac_mls_element *b) 260 { 261 262 if (a->mme_type == MAC_MLS_TYPE_EQUAL || 263 b->mme_type == MAC_MLS_TYPE_EQUAL) 264 return (1); 265 266 return (a->mme_type == b->mme_type && a->mme_level == b->mme_level); 267 } 268 269 static int 270 mls_equal_effective(struct mac_mls *a, struct mac_mls *b) 271 { 272 273 KASSERT((a->mm_flags & MAC_MLS_FLAG_EFFECTIVE) != 0, 274 ("mls_equal_effective: a not effective")); 275 KASSERT((b->mm_flags & MAC_MLS_FLAG_EFFECTIVE) != 0, 276 ("mls_equal_effective: b not effective")); 277 278 return (mls_equal_element(&a->mm_effective, &b->mm_effective)); 279 } 280 281 static int 282 mls_contains_equal(struct mac_mls *mm) 283 { 284 285 if (mm->mm_flags & MAC_MLS_FLAG_EFFECTIVE) 286 if (mm->mm_effective.mme_type == MAC_MLS_TYPE_EQUAL) 287 return (1); 288 289 if (mm->mm_flags & MAC_MLS_FLAG_RANGE) { 290 if (mm->mm_rangelow.mme_type == MAC_MLS_TYPE_EQUAL) 291 return (1); 292 if (mm->mm_rangehigh.mme_type == MAC_MLS_TYPE_EQUAL) 293 return (1); 294 } 295 296 return (0); 297 } 298 299 static int 300 mls_subject_privileged(struct mac_mls *mm) 301 { 302 303 KASSERT((mm->mm_flags & MAC_MLS_FLAGS_BOTH) == MAC_MLS_FLAGS_BOTH, 304 ("mls_subject_privileged: subject doesn't have both labels")); 305 306 /* If the effective is EQUAL, it's ok. */ 307 if (mm->mm_effective.mme_type == MAC_MLS_TYPE_EQUAL) 308 return (0); 309 310 /* If either range endpoint is EQUAL, it's ok. */ 311 if (mm->mm_rangelow.mme_type == MAC_MLS_TYPE_EQUAL || 312 mm->mm_rangehigh.mme_type == MAC_MLS_TYPE_EQUAL) 313 return (0); 314 315 /* If the range is low-high, it's ok. */ 316 if (mm->mm_rangelow.mme_type == MAC_MLS_TYPE_LOW && 317 mm->mm_rangehigh.mme_type == MAC_MLS_TYPE_HIGH) 318 return (0); 319 320 /* It's not ok. */ 321 return (EPERM); 322 } 323 324 static int 325 mls_valid(struct mac_mls *mm) 326 { 327 328 if (mm->mm_flags & MAC_MLS_FLAG_EFFECTIVE) { 329 switch (mm->mm_effective.mme_type) { 330 case MAC_MLS_TYPE_LEVEL: 331 break; 332 333 case MAC_MLS_TYPE_EQUAL: 334 case MAC_MLS_TYPE_HIGH: 335 case MAC_MLS_TYPE_LOW: 336 if (mm->mm_effective.mme_level != 0 || 337 !MAC_MLS_BIT_SET_EMPTY( 338 mm->mm_effective.mme_compartments)) 339 return (EINVAL); 340 break; 341 342 default: 343 return (EINVAL); 344 } 345 } else { 346 if (mm->mm_effective.mme_type != MAC_MLS_TYPE_UNDEF) 347 return (EINVAL); 348 } 349 350 if (mm->mm_flags & MAC_MLS_FLAG_RANGE) { 351 switch (mm->mm_rangelow.mme_type) { 352 case MAC_MLS_TYPE_LEVEL: 353 break; 354 355 case MAC_MLS_TYPE_EQUAL: 356 case MAC_MLS_TYPE_HIGH: 357 case MAC_MLS_TYPE_LOW: 358 if (mm->mm_rangelow.mme_level != 0 || 359 !MAC_MLS_BIT_SET_EMPTY( 360 mm->mm_rangelow.mme_compartments)) 361 return (EINVAL); 362 break; 363 364 default: 365 return (EINVAL); 366 } 367 368 switch (mm->mm_rangehigh.mme_type) { 369 case MAC_MLS_TYPE_LEVEL: 370 break; 371 372 case MAC_MLS_TYPE_EQUAL: 373 case MAC_MLS_TYPE_HIGH: 374 case MAC_MLS_TYPE_LOW: 375 if (mm->mm_rangehigh.mme_level != 0 || 376 !MAC_MLS_BIT_SET_EMPTY( 377 mm->mm_rangehigh.mme_compartments)) 378 return (EINVAL); 379 break; 380 381 default: 382 return (EINVAL); 383 } 384 if (!mls_dominate_element(&mm->mm_rangehigh, 385 &mm->mm_rangelow)) 386 return (EINVAL); 387 } else { 388 if (mm->mm_rangelow.mme_type != MAC_MLS_TYPE_UNDEF || 389 mm->mm_rangehigh.mme_type != MAC_MLS_TYPE_UNDEF) 390 return (EINVAL); 391 } 392 393 return (0); 394 } 395 396 static void 397 mls_set_range(struct mac_mls *mm, u_short typelow, u_short levellow, 398 u_char *compartmentslow, u_short typehigh, u_short levelhigh, 399 u_char *compartmentshigh) 400 { 401 402 mm->mm_rangelow.mme_type = typelow; 403 mm->mm_rangelow.mme_level = levellow; 404 if (compartmentslow != NULL) 405 memcpy(mm->mm_rangelow.mme_compartments, compartmentslow, 406 sizeof(mm->mm_rangelow.mme_compartments)); 407 mm->mm_rangehigh.mme_type = typehigh; 408 mm->mm_rangehigh.mme_level = levelhigh; 409 if (compartmentshigh != NULL) 410 memcpy(mm->mm_rangehigh.mme_compartments, compartmentshigh, 411 sizeof(mm->mm_rangehigh.mme_compartments)); 412 mm->mm_flags |= MAC_MLS_FLAG_RANGE; 413 } 414 415 static void 416 mls_set_effective(struct mac_mls *mm, u_short type, u_short level, 417 u_char *compartments) 418 { 419 420 mm->mm_effective.mme_type = type; 421 mm->mm_effective.mme_level = level; 422 if (compartments != NULL) 423 memcpy(mm->mm_effective.mme_compartments, compartments, 424 sizeof(mm->mm_effective.mme_compartments)); 425 mm->mm_flags |= MAC_MLS_FLAG_EFFECTIVE; 426 } 427 428 static void 429 mls_copy_range(struct mac_mls *labelfrom, struct mac_mls *labelto) 430 { 431 432 KASSERT((labelfrom->mm_flags & MAC_MLS_FLAG_RANGE) != 0, 433 ("mls_copy_range: labelfrom not range")); 434 435 labelto->mm_rangelow = labelfrom->mm_rangelow; 436 labelto->mm_rangehigh = labelfrom->mm_rangehigh; 437 labelto->mm_flags |= MAC_MLS_FLAG_RANGE; 438 } 439 440 static void 441 mls_copy_effective(struct mac_mls *labelfrom, struct mac_mls *labelto) 442 { 443 444 KASSERT((labelfrom->mm_flags & MAC_MLS_FLAG_EFFECTIVE) != 0, 445 ("mls_copy_effective: labelfrom not effective")); 446 447 labelto->mm_effective = labelfrom->mm_effective; 448 labelto->mm_flags |= MAC_MLS_FLAG_EFFECTIVE; 449 } 450 451 static void 452 mls_copy(struct mac_mls *source, struct mac_mls *dest) 453 { 454 455 if (source->mm_flags & MAC_MLS_FLAG_EFFECTIVE) 456 mls_copy_effective(source, dest); 457 if (source->mm_flags & MAC_MLS_FLAG_RANGE) 458 mls_copy_range(source, dest); 459 } 460 461 /* 462 * Policy module operations. 463 */ 464 static void 465 mls_init(struct mac_policy_conf *conf) 466 { 467 468 zone_mls = uma_zcreate("mac_mls", sizeof(struct mac_mls), NULL, 469 NULL, NULL, NULL, UMA_ALIGN_PTR, 0); 470 } 471 472 /* 473 * Label operations. 474 */ 475 static void 476 mls_init_label(struct label *label) 477 { 478 479 SLOT_SET(label, mls_alloc(M_WAITOK)); 480 } 481 482 static int 483 mls_init_label_waitcheck(struct label *label, int flag) 484 { 485 486 SLOT_SET(label, mls_alloc(flag)); 487 if (SLOT(label) == NULL) 488 return (ENOMEM); 489 490 return (0); 491 } 492 493 static void 494 mls_destroy_label(struct label *label) 495 { 496 497 mls_free(SLOT(label)); 498 SLOT_SET(label, NULL); 499 } 500 501 /* 502 * mls_element_to_string() accepts an sbuf and MLS element. It converts the 503 * MLS element to a string and stores the result in the sbuf; if there isn't 504 * space in the sbuf, -1 is returned. 505 */ 506 static int 507 mls_element_to_string(struct sbuf *sb, struct mac_mls_element *element) 508 { 509 int i, first; 510 511 switch (element->mme_type) { 512 case MAC_MLS_TYPE_HIGH: 513 return (sbuf_printf(sb, "high")); 514 515 case MAC_MLS_TYPE_LOW: 516 return (sbuf_printf(sb, "low")); 517 518 case MAC_MLS_TYPE_EQUAL: 519 return (sbuf_printf(sb, "equal")); 520 521 case MAC_MLS_TYPE_LEVEL: 522 if (sbuf_printf(sb, "%d", element->mme_level) == -1) 523 return (-1); 524 525 first = 1; 526 for (i = 1; i <= MAC_MLS_MAX_COMPARTMENTS; i++) { 527 if (MAC_MLS_BIT_TEST(i, element->mme_compartments)) { 528 if (first) { 529 if (sbuf_putc(sb, ':') == -1) 530 return (-1); 531 if (sbuf_printf(sb, "%d", i) == -1) 532 return (-1); 533 first = 0; 534 } else { 535 if (sbuf_printf(sb, "+%d", i) == -1) 536 return (-1); 537 } 538 } 539 } 540 return (0); 541 542 default: 543 panic("mls_element_to_string: invalid type (%d)", 544 element->mme_type); 545 } 546 } 547 548 /* 549 * mls_to_string() converts an MLS label to a string, and places the results 550 * in the passed sbuf. It returns 0 on success, or EINVAL if there isn't 551 * room in the sbuf. Note: the sbuf will be modified even in a failure case, 552 * so the caller may need to revert the sbuf by restoring the offset if 553 * that's undesired. 554 */ 555 static int 556 mls_to_string(struct sbuf *sb, struct mac_mls *mm) 557 { 558 559 if (mm->mm_flags & MAC_MLS_FLAG_EFFECTIVE) { 560 if (mls_element_to_string(sb, &mm->mm_effective) == -1) 561 return (EINVAL); 562 } 563 564 if (mm->mm_flags & MAC_MLS_FLAG_RANGE) { 565 if (sbuf_putc(sb, '(') == -1) 566 return (EINVAL); 567 568 if (mls_element_to_string(sb, &mm->mm_rangelow) == -1) 569 return (EINVAL); 570 571 if (sbuf_putc(sb, '-') == -1) 572 return (EINVAL); 573 574 if (mls_element_to_string(sb, &mm->mm_rangehigh) == -1) 575 return (EINVAL); 576 577 if (sbuf_putc(sb, ')') == -1) 578 return (EINVAL); 579 } 580 581 return (0); 582 } 583 584 static int 585 mls_externalize_label(struct label *label, char *element_name, 586 struct sbuf *sb, int *claimed) 587 { 588 struct mac_mls *mm; 589 590 if (strcmp(MAC_MLS_LABEL_NAME, element_name) != 0) 591 return (0); 592 593 (*claimed)++; 594 595 mm = SLOT(label); 596 597 return (mls_to_string(sb, mm)); 598 } 599 600 static int 601 mls_parse_element(struct mac_mls_element *element, char *string) 602 { 603 char *compartment, *end, *level; 604 int value; 605 606 if (strcmp(string, "high") == 0 || strcmp(string, "hi") == 0) { 607 element->mme_type = MAC_MLS_TYPE_HIGH; 608 element->mme_level = MAC_MLS_TYPE_UNDEF; 609 } else if (strcmp(string, "low") == 0 || strcmp(string, "lo") == 0) { 610 element->mme_type = MAC_MLS_TYPE_LOW; 611 element->mme_level = MAC_MLS_TYPE_UNDEF; 612 } else if (strcmp(string, "equal") == 0 || 613 strcmp(string, "eq") == 0) { 614 element->mme_type = MAC_MLS_TYPE_EQUAL; 615 element->mme_level = MAC_MLS_TYPE_UNDEF; 616 } else { 617 element->mme_type = MAC_MLS_TYPE_LEVEL; 618 619 /* 620 * Numeric level piece of the element. 621 */ 622 level = strsep(&string, ":"); 623 value = strtol(level, &end, 10); 624 if (end == level || *end != '\0') 625 return (EINVAL); 626 if (value < 0 || value > 65535) 627 return (EINVAL); 628 element->mme_level = value; 629 630 /* 631 * Optional compartment piece of the element. If none are 632 * included, we assume that the label has no compartments. 633 */ 634 if (string == NULL) 635 return (0); 636 if (*string == '\0') 637 return (0); 638 639 while ((compartment = strsep(&string, "+")) != NULL) { 640 value = strtol(compartment, &end, 10); 641 if (compartment == end || *end != '\0') 642 return (EINVAL); 643 if (value < 1 || value > MAC_MLS_MAX_COMPARTMENTS) 644 return (EINVAL); 645 MAC_MLS_BIT_SET(value, element->mme_compartments); 646 } 647 } 648 649 return (0); 650 } 651 652 /* 653 * Note: destructively consumes the string, make a local copy before calling 654 * if that's a problem. 655 */ 656 static int 657 mls_parse(struct mac_mls *mm, char *string) 658 { 659 char *rangehigh, *rangelow, *effective; 660 int error; 661 662 effective = strsep(&string, "("); 663 if (*effective == '\0') 664 effective = NULL; 665 666 if (string != NULL) { 667 rangelow = strsep(&string, "-"); 668 if (string == NULL) 669 return (EINVAL); 670 rangehigh = strsep(&string, ")"); 671 if (string == NULL) 672 return (EINVAL); 673 if (*string != '\0') 674 return (EINVAL); 675 } else { 676 rangelow = NULL; 677 rangehigh = NULL; 678 } 679 680 KASSERT((rangelow != NULL && rangehigh != NULL) || 681 (rangelow == NULL && rangehigh == NULL), 682 ("mls_parse: range mismatch")); 683 684 bzero(mm, sizeof(*mm)); 685 if (effective != NULL) { 686 error = mls_parse_element(&mm->mm_effective, effective); 687 if (error) 688 return (error); 689 mm->mm_flags |= MAC_MLS_FLAG_EFFECTIVE; 690 } 691 692 if (rangelow != NULL) { 693 error = mls_parse_element(&mm->mm_rangelow, rangelow); 694 if (error) 695 return (error); 696 error = mls_parse_element(&mm->mm_rangehigh, rangehigh); 697 if (error) 698 return (error); 699 mm->mm_flags |= MAC_MLS_FLAG_RANGE; 700 } 701 702 error = mls_valid(mm); 703 if (error) 704 return (error); 705 706 return (0); 707 } 708 709 static int 710 mls_internalize_label(struct label *label, char *element_name, 711 char *element_data, int *claimed) 712 { 713 struct mac_mls *mm, mm_temp; 714 int error; 715 716 if (strcmp(MAC_MLS_LABEL_NAME, element_name) != 0) 717 return (0); 718 719 (*claimed)++; 720 721 error = mls_parse(&mm_temp, element_data); 722 if (error) 723 return (error); 724 725 mm = SLOT(label); 726 *mm = mm_temp; 727 728 return (0); 729 } 730 731 static void 732 mls_copy_label(struct label *src, struct label *dest) 733 { 734 735 *SLOT(dest) = *SLOT(src); 736 } 737 738 /* 739 * Object-specific entry point implementations are sorted alphabetically by 740 * object type name and then by operation. 741 */ 742 static int 743 mls_bpfdesc_check_receive(struct bpf_d *d, struct label *dlabel, 744 struct ifnet *ifp, struct label *ifplabel) 745 { 746 struct mac_mls *a, *b; 747 748 if (!mls_enabled) 749 return (0); 750 751 a = SLOT(dlabel); 752 b = SLOT(ifplabel); 753 754 if (mls_equal_effective(a, b)) 755 return (0); 756 return (EACCES); 757 } 758 759 static void 760 mls_bpfdesc_create(struct ucred *cred, struct bpf_d *d, struct label *dlabel) 761 { 762 struct mac_mls *source, *dest; 763 764 source = SLOT(cred->cr_label); 765 dest = SLOT(dlabel); 766 767 mls_copy_effective(source, dest); 768 } 769 770 static void 771 mls_bpfdesc_create_mbuf(struct bpf_d *d, struct label *dlabel, 772 struct mbuf *m, struct label *mlabel) 773 { 774 struct mac_mls *source, *dest; 775 776 source = SLOT(dlabel); 777 dest = SLOT(mlabel); 778 779 mls_copy_effective(source, dest); 780 } 781 782 static void 783 mls_cred_associate_nfsd(struct ucred *cred) 784 { 785 struct mac_mls *label; 786 787 label = SLOT(cred->cr_label); 788 mls_set_effective(label, MAC_MLS_TYPE_LOW, 0, NULL); 789 mls_set_range(label, MAC_MLS_TYPE_LOW, 0, NULL, MAC_MLS_TYPE_HIGH, 0, 790 NULL); 791 } 792 793 static int 794 mls_cred_check_relabel(struct ucred *cred, struct label *newlabel) 795 { 796 struct mac_mls *subj, *new; 797 int error; 798 799 subj = SLOT(cred->cr_label); 800 new = SLOT(newlabel); 801 802 /* 803 * If there is an MLS label update for the credential, it may be an 804 * update of effective, range, or both. 805 */ 806 error = mls_atmostflags(new, MAC_MLS_FLAGS_BOTH); 807 if (error) 808 return (error); 809 810 /* 811 * If the MLS label is to be changed, authorize as appropriate. 812 */ 813 if (new->mm_flags & MAC_MLS_FLAGS_BOTH) { 814 /* 815 * If the change request modifies both the MLS label 816 * effective and range, check that the new effective will be 817 * in the new range. 818 */ 819 if ((new->mm_flags & MAC_MLS_FLAGS_BOTH) == 820 MAC_MLS_FLAGS_BOTH && !mls_effective_in_range(new, new)) 821 return (EINVAL); 822 823 /* 824 * To change the MLS effective label on a credential, the new 825 * effective label must be in the current range. 826 */ 827 if (new->mm_flags & MAC_MLS_FLAG_EFFECTIVE && 828 !mls_effective_in_range(new, subj)) 829 return (EPERM); 830 831 /* 832 * To change the MLS range label on a credential, the new 833 * range must be in the current range. 834 */ 835 if (new->mm_flags & MAC_MLS_FLAG_RANGE && 836 !mls_range_in_range(new, subj)) 837 return (EPERM); 838 839 /* 840 * To have EQUAL in any component of the new credential MLS 841 * label, the subject must already have EQUAL in their label. 842 */ 843 if (mls_contains_equal(new)) { 844 error = mls_subject_privileged(subj); 845 if (error) 846 return (error); 847 } 848 } 849 850 return (0); 851 } 852 853 static int 854 mls_cred_check_visible(struct ucred *cr1, struct ucred *cr2) 855 { 856 struct mac_mls *subj, *obj; 857 858 if (!mls_enabled) 859 return (0); 860 861 subj = SLOT(cr1->cr_label); 862 obj = SLOT(cr2->cr_label); 863 864 /* XXX: range */ 865 if (!mls_dominate_effective(subj, obj)) 866 return (ESRCH); 867 868 return (0); 869 } 870 871 static void 872 mls_cred_create_init(struct ucred *cred) 873 { 874 struct mac_mls *dest; 875 876 dest = SLOT(cred->cr_label); 877 878 mls_set_effective(dest, MAC_MLS_TYPE_LOW, 0, NULL); 879 mls_set_range(dest, MAC_MLS_TYPE_LOW, 0, NULL, MAC_MLS_TYPE_HIGH, 0, 880 NULL); 881 } 882 883 static void 884 mls_cred_create_swapper(struct ucred *cred) 885 { 886 struct mac_mls *dest; 887 888 dest = SLOT(cred->cr_label); 889 890 mls_set_effective(dest, MAC_MLS_TYPE_EQUAL, 0, NULL); 891 mls_set_range(dest, MAC_MLS_TYPE_LOW, 0, NULL, MAC_MLS_TYPE_HIGH, 0, 892 NULL); 893 } 894 895 static void 896 mls_cred_relabel(struct ucred *cred, struct label *newlabel) 897 { 898 struct mac_mls *source, *dest; 899 900 source = SLOT(newlabel); 901 dest = SLOT(cred->cr_label); 902 903 mls_copy(source, dest); 904 } 905 906 static void 907 mls_devfs_create_device(struct ucred *cred, struct mount *mp, 908 struct cdev *dev, struct devfs_dirent *de, struct label *delabel) 909 { 910 struct mac_mls *mm; 911 const char *dn; 912 int mls_type; 913 914 mm = SLOT(delabel); 915 dn = devtoname(dev); 916 if (strcmp(dn, "null") == 0 || 917 strcmp(dn, "zero") == 0 || 918 strcmp(dn, "random") == 0 || 919 strncmp(dn, "fd/", strlen("fd/")) == 0) 920 mls_type = MAC_MLS_TYPE_EQUAL; 921 else if (strcmp(dn, "kmem") == 0 || 922 strcmp(dn, "mem") == 0) 923 mls_type = MAC_MLS_TYPE_HIGH; 924 else if (ptys_equal && 925 (strncmp(dn, "ttyp", strlen("ttyp")) == 0 || 926 strncmp(dn, "pts/", strlen("pts/")) == 0 || 927 strncmp(dn, "ptyp", strlen("ptyp")) == 0)) 928 mls_type = MAC_MLS_TYPE_EQUAL; 929 else 930 mls_type = MAC_MLS_TYPE_LOW; 931 mls_set_effective(mm, mls_type, 0, NULL); 932 } 933 934 static void 935 mls_devfs_create_directory(struct mount *mp, char *dirname, int dirnamelen, 936 struct devfs_dirent *de, struct label *delabel) 937 { 938 struct mac_mls *mm; 939 940 mm = SLOT(delabel); 941 mls_set_effective(mm, MAC_MLS_TYPE_LOW, 0, NULL); 942 } 943 944 static void 945 mls_devfs_create_symlink(struct ucred *cred, struct mount *mp, 946 struct devfs_dirent *dd, struct label *ddlabel, struct devfs_dirent *de, 947 struct label *delabel) 948 { 949 struct mac_mls *source, *dest; 950 951 source = SLOT(cred->cr_label); 952 dest = SLOT(delabel); 953 954 mls_copy_effective(source, dest); 955 } 956 957 static void 958 mls_devfs_update(struct mount *mp, struct devfs_dirent *de, 959 struct label *delabel, struct vnode *vp, struct label *vplabel) 960 { 961 struct mac_mls *source, *dest; 962 963 source = SLOT(vplabel); 964 dest = SLOT(delabel); 965 966 mls_copy_effective(source, dest); 967 } 968 969 static void 970 mls_devfs_vnode_associate(struct mount *mp, struct label *mplabel, 971 struct devfs_dirent *de, struct label *delabel, struct vnode *vp, 972 struct label *vplabel) 973 { 974 struct mac_mls *source, *dest; 975 976 source = SLOT(delabel); 977 dest = SLOT(vplabel); 978 979 mls_copy_effective(source, dest); 980 } 981 982 static int 983 mls_ifnet_check_relabel(struct ucred *cred, struct ifnet *ifp, 984 struct label *ifplabel, struct label *newlabel) 985 { 986 struct mac_mls *subj, *new; 987 int error; 988 989 subj = SLOT(cred->cr_label); 990 new = SLOT(newlabel); 991 992 /* 993 * If there is an MLS label update for the interface, it may be an 994 * update of effective, range, or both. 995 */ 996 error = mls_atmostflags(new, MAC_MLS_FLAGS_BOTH); 997 if (error) 998 return (error); 999 1000 /* 1001 * Relabeling network interfaces requires MLS privilege. 1002 */ 1003 return (mls_subject_privileged(subj)); 1004 } 1005 1006 static int 1007 mls_ifnet_check_transmit(struct ifnet *ifp, struct label *ifplabel, 1008 struct mbuf *m, struct label *mlabel) 1009 { 1010 struct mac_mls *p, *i; 1011 1012 if (!mls_enabled) 1013 return (0); 1014 1015 p = SLOT(mlabel); 1016 i = SLOT(ifplabel); 1017 1018 return (mls_effective_in_range(p, i) ? 0 : EACCES); 1019 } 1020 1021 static void 1022 mls_ifnet_create(struct ifnet *ifp, struct label *ifplabel) 1023 { 1024 struct mac_mls *dest; 1025 int type; 1026 1027 dest = SLOT(ifplabel); 1028 1029 if (ifp->if_type == IFT_LOOP) 1030 type = MAC_MLS_TYPE_EQUAL; 1031 else 1032 type = MAC_MLS_TYPE_LOW; 1033 1034 mls_set_effective(dest, type, 0, NULL); 1035 mls_set_range(dest, type, 0, NULL, type, 0, NULL); 1036 } 1037 1038 static void 1039 mls_ifnet_create_mbuf(struct ifnet *ifp, struct label *ifplabel, 1040 struct mbuf *m, struct label *mlabel) 1041 { 1042 struct mac_mls *source, *dest; 1043 1044 source = SLOT(ifplabel); 1045 dest = SLOT(mlabel); 1046 1047 mls_copy_effective(source, dest); 1048 } 1049 1050 static void 1051 mls_ifnet_relabel(struct ucred *cred, struct ifnet *ifp, 1052 struct label *ifplabel, struct label *newlabel) 1053 { 1054 struct mac_mls *source, *dest; 1055 1056 source = SLOT(newlabel); 1057 dest = SLOT(ifplabel); 1058 1059 mls_copy(source, dest); 1060 } 1061 1062 static int 1063 mls_inpcb_check_deliver(struct inpcb *inp, struct label *inplabel, 1064 struct mbuf *m, struct label *mlabel) 1065 { 1066 struct mac_mls *p, *i; 1067 1068 if (!mls_enabled) 1069 return (0); 1070 1071 p = SLOT(mlabel); 1072 i = SLOT(inplabel); 1073 1074 return (mls_equal_effective(p, i) ? 0 : EACCES); 1075 } 1076 1077 static int 1078 mls_inpcb_check_visible(struct ucred *cred, struct inpcb *inp, 1079 struct label *inplabel) 1080 { 1081 struct mac_mls *subj, *obj; 1082 1083 if (!mls_enabled) 1084 return (0); 1085 1086 subj = SLOT(cred->cr_label); 1087 obj = SLOT(inplabel); 1088 1089 if (!mls_dominate_effective(subj, obj)) 1090 return (ENOENT); 1091 1092 return (0); 1093 } 1094 1095 static void 1096 mls_inpcb_create(struct socket *so, struct label *solabel, struct inpcb *inp, 1097 struct label *inplabel) 1098 { 1099 struct mac_mls *source, *dest; 1100 1101 source = SLOT(solabel); 1102 dest = SLOT(inplabel); 1103 1104 mls_copy_effective(source, dest); 1105 } 1106 1107 static void 1108 mls_inpcb_create_mbuf(struct inpcb *inp, struct label *inplabel, 1109 struct mbuf *m, struct label *mlabel) 1110 { 1111 struct mac_mls *source, *dest; 1112 1113 source = SLOT(inplabel); 1114 dest = SLOT(mlabel); 1115 1116 mls_copy_effective(source, dest); 1117 } 1118 1119 static void 1120 mls_inpcb_sosetlabel(struct socket *so, struct label *solabel, 1121 struct inpcb *inp, struct label *inplabel) 1122 { 1123 struct mac_mls *source, *dest; 1124 1125 SOCK_LOCK_ASSERT(so); 1126 1127 source = SLOT(solabel); 1128 dest = SLOT(inplabel); 1129 1130 mls_copy(source, dest); 1131 } 1132 1133 static void 1134 mls_ip6q_create(struct mbuf *m, struct label *mlabel, struct ip6q *q6, 1135 struct label *q6label) 1136 { 1137 struct mac_mls *source, *dest; 1138 1139 source = SLOT(mlabel); 1140 dest = SLOT(q6label); 1141 1142 mls_copy_effective(source, dest); 1143 } 1144 1145 static int 1146 mls_ip6q_match(struct mbuf *m, struct label *mlabel, struct ip6q *q6, 1147 struct label *q6label) 1148 { 1149 struct mac_mls *a, *b; 1150 1151 a = SLOT(q6label); 1152 b = SLOT(mlabel); 1153 1154 return (mls_equal_effective(a, b)); 1155 } 1156 1157 static void 1158 mls_ip6q_reassemble(struct ip6q *q6, struct label *q6label, struct mbuf *m, 1159 struct label *mlabel) 1160 { 1161 struct mac_mls *source, *dest; 1162 1163 source = SLOT(q6label); 1164 dest = SLOT(mlabel); 1165 1166 /* Just use the head, since we require them all to match. */ 1167 mls_copy_effective(source, dest); 1168 } 1169 1170 static void 1171 mls_ip6q_update(struct mbuf *m, struct label *mlabel, struct ip6q *q6, 1172 struct label *q6label) 1173 { 1174 1175 /* NOOP: we only accept matching labels, so no need to update */ 1176 } 1177 1178 static void 1179 mls_ipq_create(struct mbuf *m, struct label *mlabel, struct ipq *q, 1180 struct label *qlabel) 1181 { 1182 struct mac_mls *source, *dest; 1183 1184 source = SLOT(mlabel); 1185 dest = SLOT(qlabel); 1186 1187 mls_copy_effective(source, dest); 1188 } 1189 1190 static int 1191 mls_ipq_match(struct mbuf *m, struct label *mlabel, struct ipq *q, 1192 struct label *qlabel) 1193 { 1194 struct mac_mls *a, *b; 1195 1196 a = SLOT(qlabel); 1197 b = SLOT(mlabel); 1198 1199 return (mls_equal_effective(a, b)); 1200 } 1201 1202 static void 1203 mls_ipq_reassemble(struct ipq *q, struct label *qlabel, struct mbuf *m, 1204 struct label *mlabel) 1205 { 1206 struct mac_mls *source, *dest; 1207 1208 source = SLOT(qlabel); 1209 dest = SLOT(mlabel); 1210 1211 /* Just use the head, since we require them all to match. */ 1212 mls_copy_effective(source, dest); 1213 } 1214 1215 static void 1216 mls_ipq_update(struct mbuf *m, struct label *mlabel, struct ipq *q, 1217 struct label *qlabel) 1218 { 1219 1220 /* NOOP: we only accept matching labels, so no need to update */ 1221 } 1222 1223 static int 1224 mls_mount_check_stat(struct ucred *cred, struct mount *mp, 1225 struct label *mntlabel) 1226 { 1227 struct mac_mls *subj, *obj; 1228 1229 if (!mls_enabled) 1230 return (0); 1231 1232 subj = SLOT(cred->cr_label); 1233 obj = SLOT(mntlabel); 1234 1235 if (!mls_dominate_effective(subj, obj)) 1236 return (EACCES); 1237 1238 return (0); 1239 } 1240 1241 static void 1242 mls_mount_create(struct ucred *cred, struct mount *mp, struct label *mplabel) 1243 { 1244 struct mac_mls *source, *dest; 1245 1246 source = SLOT(cred->cr_label); 1247 dest = SLOT(mplabel); 1248 1249 mls_copy_effective(source, dest); 1250 } 1251 1252 static void 1253 mls_netinet_arp_send(struct ifnet *ifp, struct label *ifplabel, 1254 struct mbuf *m, struct label *mlabel) 1255 { 1256 struct mac_mls *dest; 1257 1258 dest = SLOT(mlabel); 1259 1260 mls_set_effective(dest, MAC_MLS_TYPE_EQUAL, 0, NULL); 1261 } 1262 1263 static void 1264 mls_netinet_firewall_reply(struct mbuf *mrecv, struct label *mrecvlabel, 1265 struct mbuf *msend, struct label *msendlabel) 1266 { 1267 struct mac_mls *source, *dest; 1268 1269 source = SLOT(mrecvlabel); 1270 dest = SLOT(msendlabel); 1271 1272 mls_copy_effective(source, dest); 1273 } 1274 1275 static void 1276 mls_netinet_firewall_send(struct mbuf *m, struct label *mlabel) 1277 { 1278 struct mac_mls *dest; 1279 1280 dest = SLOT(mlabel); 1281 1282 /* XXX: where is the label for the firewall really comming from? */ 1283 mls_set_effective(dest, MAC_MLS_TYPE_EQUAL, 0, NULL); 1284 } 1285 1286 static void 1287 mls_netinet_fragment(struct mbuf *m, struct label *mlabel, struct mbuf *frag, 1288 struct label *fraglabel) 1289 { 1290 struct mac_mls *source, *dest; 1291 1292 source = SLOT(mlabel); 1293 dest = SLOT(fraglabel); 1294 1295 mls_copy_effective(source, dest); 1296 } 1297 1298 static void 1299 mls_netinet_icmp_reply(struct mbuf *mrecv, struct label *mrecvlabel, 1300 struct mbuf *msend, struct label *msendlabel) 1301 { 1302 struct mac_mls *source, *dest; 1303 1304 source = SLOT(mrecvlabel); 1305 dest = SLOT(msendlabel); 1306 1307 mls_copy_effective(source, dest); 1308 } 1309 1310 static void 1311 mls_netinet_igmp_send(struct ifnet *ifp, struct label *ifplabel, 1312 struct mbuf *m, struct label *mlabel) 1313 { 1314 struct mac_mls *dest; 1315 1316 dest = SLOT(mlabel); 1317 1318 mls_set_effective(dest, MAC_MLS_TYPE_EQUAL, 0, NULL); 1319 } 1320 1321 static void 1322 mls_netinet6_nd6_send(struct ifnet *ifp, struct label *ifplabel, 1323 struct mbuf *m, struct label *mlabel) 1324 { 1325 struct mac_mls *dest; 1326 1327 dest = SLOT(mlabel); 1328 1329 mls_set_effective(dest, MAC_MLS_TYPE_EQUAL, 0, NULL); 1330 } 1331 1332 static int 1333 mls_pipe_check_ioctl(struct ucred *cred, struct pipepair *pp, 1334 struct label *pplabel, unsigned long cmd, void /* caddr_t */ *data) 1335 { 1336 1337 if (!mls_enabled) 1338 return (0); 1339 1340 /* XXX: This will be implemented soon... */ 1341 1342 return (0); 1343 } 1344 1345 static int 1346 mls_pipe_check_poll(struct ucred *cred, struct pipepair *pp, 1347 struct label *pplabel) 1348 { 1349 struct mac_mls *subj, *obj; 1350 1351 if (!mls_enabled) 1352 return (0); 1353 1354 subj = SLOT(cred->cr_label); 1355 obj = SLOT(pplabel); 1356 1357 if (!mls_dominate_effective(subj, obj)) 1358 return (EACCES); 1359 1360 return (0); 1361 } 1362 1363 static int 1364 mls_pipe_check_read(struct ucred *cred, struct pipepair *pp, 1365 struct label *pplabel) 1366 { 1367 struct mac_mls *subj, *obj; 1368 1369 if (!mls_enabled) 1370 return (0); 1371 1372 subj = SLOT(cred->cr_label); 1373 obj = SLOT(pplabel); 1374 1375 if (!mls_dominate_effective(subj, obj)) 1376 return (EACCES); 1377 1378 return (0); 1379 } 1380 1381 static int 1382 mls_pipe_check_relabel(struct ucred *cred, struct pipepair *pp, 1383 struct label *pplabel, struct label *newlabel) 1384 { 1385 struct mac_mls *subj, *obj, *new; 1386 int error; 1387 1388 new = SLOT(newlabel); 1389 subj = SLOT(cred->cr_label); 1390 obj = SLOT(pplabel); 1391 1392 /* 1393 * If there is an MLS label update for a pipe, it must be a effective 1394 * update. 1395 */ 1396 error = mls_atmostflags(new, MAC_MLS_FLAG_EFFECTIVE); 1397 if (error) 1398 return (error); 1399 1400 /* 1401 * To perform a relabel of a pipe (MLS label or not), MLS must 1402 * authorize the relabel. 1403 */ 1404 if (!mls_effective_in_range(obj, subj)) 1405 return (EPERM); 1406 1407 /* 1408 * If the MLS label is to be changed, authorize as appropriate. 1409 */ 1410 if (new->mm_flags & MAC_MLS_FLAG_EFFECTIVE) { 1411 /* 1412 * To change the MLS label on a pipe, the new pipe label must 1413 * be in the subject range. 1414 */ 1415 if (!mls_effective_in_range(new, subj)) 1416 return (EPERM); 1417 1418 /* 1419 * To change the MLS label on a pipe to be EQUAL, the subject 1420 * must have appropriate privilege. 1421 */ 1422 if (mls_contains_equal(new)) { 1423 error = mls_subject_privileged(subj); 1424 if (error) 1425 return (error); 1426 } 1427 } 1428 1429 return (0); 1430 } 1431 1432 static int 1433 mls_pipe_check_stat(struct ucred *cred, struct pipepair *pp, 1434 struct label *pplabel) 1435 { 1436 struct mac_mls *subj, *obj; 1437 1438 if (!mls_enabled) 1439 return (0); 1440 1441 subj = SLOT(cred->cr_label); 1442 obj = SLOT(pplabel); 1443 1444 if (!mls_dominate_effective(subj, obj)) 1445 return (EACCES); 1446 1447 return (0); 1448 } 1449 1450 static int 1451 mls_pipe_check_write(struct ucred *cred, struct pipepair *pp, 1452 struct label *pplabel) 1453 { 1454 struct mac_mls *subj, *obj; 1455 1456 if (!mls_enabled) 1457 return (0); 1458 1459 subj = SLOT(cred->cr_label); 1460 obj = SLOT(pplabel); 1461 1462 if (!mls_dominate_effective(obj, subj)) 1463 return (EACCES); 1464 1465 return (0); 1466 } 1467 1468 static void 1469 mls_pipe_create(struct ucred *cred, struct pipepair *pp, 1470 struct label *pplabel) 1471 { 1472 struct mac_mls *source, *dest; 1473 1474 source = SLOT(cred->cr_label); 1475 dest = SLOT(pplabel); 1476 1477 mls_copy_effective(source, dest); 1478 } 1479 1480 static void 1481 mls_pipe_relabel(struct ucred *cred, struct pipepair *pp, 1482 struct label *pplabel, struct label *newlabel) 1483 { 1484 struct mac_mls *source, *dest; 1485 1486 source = SLOT(newlabel); 1487 dest = SLOT(pplabel); 1488 1489 mls_copy(source, dest); 1490 } 1491 1492 static int 1493 mls_posixsem_check_openunlink(struct ucred *cred, struct ksem *ks, 1494 struct label *kslabel) 1495 { 1496 struct mac_mls *subj, *obj; 1497 1498 if (!mls_enabled) 1499 return (0); 1500 1501 subj = SLOT(cred->cr_label); 1502 obj = SLOT(kslabel); 1503 1504 if (!mls_dominate_effective(obj, subj)) 1505 return (EACCES); 1506 1507 return (0); 1508 } 1509 1510 static int 1511 mls_posixsem_check_rdonly(struct ucred *active_cred, struct ucred *file_cred, 1512 struct ksem *ks, struct label *kslabel) 1513 { 1514 struct mac_mls *subj, *obj; 1515 1516 if (!mls_enabled) 1517 return (0); 1518 1519 subj = SLOT(active_cred->cr_label); 1520 obj = SLOT(kslabel); 1521 1522 if (!mls_dominate_effective(subj, obj)) 1523 return (EACCES); 1524 1525 return (0); 1526 } 1527 1528 static int 1529 mls_posixsem_check_setmode(struct ucred *cred, struct ksem *ks, 1530 struct label *shmlabel, mode_t mode) 1531 { 1532 struct mac_mls *subj, *obj; 1533 1534 if (!mls_enabled) 1535 return (0); 1536 1537 subj = SLOT(cred->cr_label); 1538 obj = SLOT(shmlabel); 1539 1540 if (!mls_dominate_effective(obj, subj)) 1541 return (EACCES); 1542 1543 return (0); 1544 } 1545 1546 static int 1547 mls_posixsem_check_setowner(struct ucred *cred, struct ksem *ks, 1548 struct label *shmlabel, uid_t uid, gid_t gid) 1549 { 1550 struct mac_mls *subj, *obj; 1551 1552 if (!mls_enabled) 1553 return (0); 1554 1555 subj = SLOT(cred->cr_label); 1556 obj = SLOT(shmlabel); 1557 1558 if (!mls_dominate_effective(obj, subj)) 1559 return (EACCES); 1560 1561 return (0); 1562 } 1563 1564 static int 1565 mls_posixsem_check_write(struct ucred *active_cred, struct ucred *file_cred, 1566 struct ksem *ks, struct label *kslabel) 1567 { 1568 struct mac_mls *subj, *obj; 1569 1570 if (!mls_enabled) 1571 return (0); 1572 1573 subj = SLOT(active_cred->cr_label); 1574 obj = SLOT(kslabel); 1575 1576 if (!mls_dominate_effective(obj, subj)) 1577 return (EACCES); 1578 1579 return (0); 1580 } 1581 1582 static void 1583 mls_posixsem_create(struct ucred *cred, struct ksem *ks, 1584 struct label *kslabel) 1585 { 1586 struct mac_mls *source, *dest; 1587 1588 source = SLOT(cred->cr_label); 1589 dest = SLOT(kslabel); 1590 1591 mls_copy_effective(source, dest); 1592 } 1593 1594 static int 1595 mls_posixshm_check_mmap(struct ucred *cred, struct shmfd *shmfd, 1596 struct label *shmlabel, int prot, int flags) 1597 { 1598 struct mac_mls *subj, *obj; 1599 1600 if (!mls_enabled) 1601 return (0); 1602 1603 subj = SLOT(cred->cr_label); 1604 obj = SLOT(shmlabel); 1605 1606 if (prot & (VM_PROT_READ | VM_PROT_EXECUTE)) { 1607 if (!mls_dominate_effective(subj, obj)) 1608 return (EACCES); 1609 } 1610 if (((prot & VM_PROT_WRITE) != 0) && ((flags & MAP_SHARED) != 0)) { 1611 if (!mls_dominate_effective(obj, subj)) 1612 return (EACCES); 1613 } 1614 1615 return (0); 1616 } 1617 1618 static int 1619 mls_posixshm_check_open(struct ucred *cred, struct shmfd *shmfd, 1620 struct label *shmlabel, accmode_t accmode) 1621 { 1622 struct mac_mls *subj, *obj; 1623 1624 if (!mls_enabled) 1625 return (0); 1626 1627 subj = SLOT(cred->cr_label); 1628 obj = SLOT(shmlabel); 1629 1630 if (accmode & (VREAD | VEXEC | VSTAT_PERMS)) { 1631 if (!mls_dominate_effective(subj, obj)) 1632 return (EACCES); 1633 } 1634 if (accmode & VMODIFY_PERMS) { 1635 if (!mls_dominate_effective(obj, subj)) 1636 return (EACCES); 1637 } 1638 1639 return (0); 1640 } 1641 1642 static int 1643 mls_posixshm_check_read(struct ucred *active_cred, struct ucred *file_cred, 1644 struct shmfd *shm, struct label *shmlabel) 1645 { 1646 struct mac_mls *subj, *obj; 1647 1648 if (!mls_enabled || !revocation_enabled) 1649 return (0); 1650 1651 subj = SLOT(active_cred->cr_label); 1652 obj = SLOT(shmlabel); 1653 1654 if (!mls_dominate_effective(subj, obj)) 1655 return (EACCES); 1656 1657 return (0); 1658 } 1659 1660 static int 1661 mls_posixshm_check_setmode(struct ucred *cred, struct shmfd *shmfd, 1662 struct label *shmlabel, mode_t mode) 1663 { 1664 struct mac_mls *subj, *obj; 1665 1666 if (!mls_enabled) 1667 return (0); 1668 1669 subj = SLOT(cred->cr_label); 1670 obj = SLOT(shmlabel); 1671 1672 if (!mls_dominate_effective(obj, subj)) 1673 return (EACCES); 1674 1675 return (0); 1676 } 1677 1678 static int 1679 mls_posixshm_check_setowner(struct ucred *cred, struct shmfd *shmfd, 1680 struct label *shmlabel, uid_t uid, gid_t gid) 1681 { 1682 struct mac_mls *subj, *obj; 1683 1684 if (!mls_enabled) 1685 return (0); 1686 1687 subj = SLOT(cred->cr_label); 1688 obj = SLOT(shmlabel); 1689 1690 if (!mls_dominate_effective(obj, subj)) 1691 return (EACCES); 1692 1693 return (0); 1694 } 1695 1696 static int 1697 mls_posixshm_check_stat(struct ucred *active_cred, struct ucred *file_cred, 1698 struct shmfd *shmfd, struct label *shmlabel) 1699 { 1700 struct mac_mls *subj, *obj; 1701 1702 if (!mls_enabled) 1703 return (0); 1704 1705 subj = SLOT(active_cred->cr_label); 1706 obj = SLOT(shmlabel); 1707 1708 if (!mls_dominate_effective(subj, obj)) 1709 return (EACCES); 1710 1711 return (0); 1712 } 1713 1714 static int 1715 mls_posixshm_check_truncate(struct ucred *active_cred, 1716 struct ucred *file_cred, struct shmfd *shmfd, struct label *shmlabel) 1717 { 1718 struct mac_mls *subj, *obj; 1719 1720 if (!mls_enabled) 1721 return (0); 1722 1723 subj = SLOT(active_cred->cr_label); 1724 obj = SLOT(shmlabel); 1725 1726 if (!mls_dominate_effective(obj, subj)) 1727 return (EACCES); 1728 1729 return (0); 1730 } 1731 1732 static int 1733 mls_posixshm_check_unlink(struct ucred *cred, struct shmfd *shmfd, 1734 struct label *shmlabel) 1735 { 1736 struct mac_mls *subj, *obj; 1737 1738 if (!mls_enabled) 1739 return (0); 1740 1741 subj = SLOT(cred->cr_label); 1742 obj = SLOT(shmlabel); 1743 1744 if (!mls_dominate_effective(obj, subj)) 1745 return (EACCES); 1746 1747 return (0); 1748 } 1749 1750 static int 1751 mls_posixshm_check_write(struct ucred *active_cred, struct ucred *file_cred, 1752 struct shmfd *shm, struct label *shmlabel) 1753 { 1754 struct mac_mls *subj, *obj; 1755 1756 if (!mls_enabled || !revocation_enabled) 1757 return (0); 1758 1759 subj = SLOT(active_cred->cr_label); 1760 obj = SLOT(shmlabel); 1761 1762 if (!mls_dominate_effective(subj, obj)) 1763 return (EACCES); 1764 1765 return (0); 1766 } 1767 1768 static void 1769 mls_posixshm_create(struct ucred *cred, struct shmfd *shmfd, 1770 struct label *shmlabel) 1771 { 1772 struct mac_mls *source, *dest; 1773 1774 source = SLOT(cred->cr_label); 1775 dest = SLOT(shmlabel); 1776 1777 mls_copy_effective(source, dest); 1778 } 1779 1780 static int 1781 mls_proc_check_debug(struct ucred *cred, struct proc *p) 1782 { 1783 struct mac_mls *subj, *obj; 1784 1785 if (!mls_enabled) 1786 return (0); 1787 1788 subj = SLOT(cred->cr_label); 1789 obj = SLOT(p->p_ucred->cr_label); 1790 1791 /* XXX: range checks */ 1792 if (!mls_dominate_effective(subj, obj)) 1793 return (ESRCH); 1794 if (!mls_dominate_effective(obj, subj)) 1795 return (EACCES); 1796 1797 return (0); 1798 } 1799 1800 static int 1801 mls_proc_check_sched(struct ucred *cred, struct proc *p) 1802 { 1803 struct mac_mls *subj, *obj; 1804 1805 if (!mls_enabled) 1806 return (0); 1807 1808 subj = SLOT(cred->cr_label); 1809 obj = SLOT(p->p_ucred->cr_label); 1810 1811 /* XXX: range checks */ 1812 if (!mls_dominate_effective(subj, obj)) 1813 return (ESRCH); 1814 if (!mls_dominate_effective(obj, subj)) 1815 return (EACCES); 1816 1817 return (0); 1818 } 1819 1820 static int 1821 mls_proc_check_signal(struct ucred *cred, struct proc *p, int signum) 1822 { 1823 struct mac_mls *subj, *obj; 1824 1825 if (!mls_enabled) 1826 return (0); 1827 1828 subj = SLOT(cred->cr_label); 1829 obj = SLOT(p->p_ucred->cr_label); 1830 1831 /* XXX: range checks */ 1832 if (!mls_dominate_effective(subj, obj)) 1833 return (ESRCH); 1834 if (!mls_dominate_effective(obj, subj)) 1835 return (EACCES); 1836 1837 return (0); 1838 } 1839 1840 static int 1841 mls_socket_check_deliver(struct socket *so, struct label *solabel, 1842 struct mbuf *m, struct label *mlabel) 1843 { 1844 struct mac_mls *p, *s; 1845 int error; 1846 1847 if (!mls_enabled) 1848 return (0); 1849 1850 p = SLOT(mlabel); 1851 s = SLOT(solabel); 1852 1853 SOCK_LOCK(so); 1854 error = mls_equal_effective(p, s) ? 0 : EACCES; 1855 SOCK_UNLOCK(so); 1856 1857 return (error); 1858 } 1859 1860 static int 1861 mls_socket_check_relabel(struct ucred *cred, struct socket *so, 1862 struct label *solabel, struct label *newlabel) 1863 { 1864 struct mac_mls *subj, *obj, *new; 1865 int error; 1866 1867 SOCK_LOCK_ASSERT(so); 1868 1869 new = SLOT(newlabel); 1870 subj = SLOT(cred->cr_label); 1871 obj = SLOT(solabel); 1872 1873 /* 1874 * If there is an MLS label update for the socket, it may be an 1875 * update of effective. 1876 */ 1877 error = mls_atmostflags(new, MAC_MLS_FLAG_EFFECTIVE); 1878 if (error) 1879 return (error); 1880 1881 /* 1882 * To relabel a socket, the old socket effective must be in the 1883 * subject range. 1884 */ 1885 if (!mls_effective_in_range(obj, subj)) 1886 return (EPERM); 1887 1888 /* 1889 * If the MLS label is to be changed, authorize as appropriate. 1890 */ 1891 if (new->mm_flags & MAC_MLS_FLAG_EFFECTIVE) { 1892 /* 1893 * To relabel a socket, the new socket effective must be in 1894 * the subject range. 1895 */ 1896 if (!mls_effective_in_range(new, subj)) 1897 return (EPERM); 1898 1899 /* 1900 * To change the MLS label on the socket to contain EQUAL, 1901 * the subject must have appropriate privilege. 1902 */ 1903 if (mls_contains_equal(new)) { 1904 error = mls_subject_privileged(subj); 1905 if (error) 1906 return (error); 1907 } 1908 } 1909 1910 return (0); 1911 } 1912 1913 static int 1914 mls_socket_check_visible(struct ucred *cred, struct socket *so, 1915 struct label *solabel) 1916 { 1917 struct mac_mls *subj, *obj; 1918 1919 if (!mls_enabled) 1920 return (0); 1921 1922 subj = SLOT(cred->cr_label); 1923 obj = SLOT(solabel); 1924 1925 SOCK_LOCK(so); 1926 if (!mls_dominate_effective(subj, obj)) { 1927 SOCK_UNLOCK(so); 1928 return (ENOENT); 1929 } 1930 SOCK_UNLOCK(so); 1931 1932 return (0); 1933 } 1934 1935 static void 1936 mls_socket_create(struct ucred *cred, struct socket *so, 1937 struct label *solabel) 1938 { 1939 struct mac_mls *source, *dest; 1940 1941 source = SLOT(cred->cr_label); 1942 dest = SLOT(solabel); 1943 1944 mls_copy_effective(source, dest); 1945 } 1946 1947 static void 1948 mls_socket_create_mbuf(struct socket *so, struct label *solabel, 1949 struct mbuf *m, struct label *mlabel) 1950 { 1951 struct mac_mls *source, *dest; 1952 1953 source = SLOT(solabel); 1954 dest = SLOT(mlabel); 1955 1956 SOCK_LOCK(so); 1957 mls_copy_effective(source, dest); 1958 SOCK_UNLOCK(so); 1959 } 1960 1961 static void 1962 mls_socket_newconn(struct socket *oldso, struct label *oldsolabel, 1963 struct socket *newso, struct label *newsolabel) 1964 { 1965 struct mac_mls source, *dest; 1966 1967 SOCK_LOCK(oldso); 1968 source = *SLOT(oldsolabel); 1969 SOCK_UNLOCK(oldso); 1970 1971 dest = SLOT(newsolabel); 1972 1973 SOCK_LOCK(newso); 1974 mls_copy_effective(&source, dest); 1975 SOCK_UNLOCK(newso); 1976 } 1977 1978 static void 1979 mls_socket_relabel(struct ucred *cred, struct socket *so, 1980 struct label *solabel, struct label *newlabel) 1981 { 1982 struct mac_mls *source, *dest; 1983 1984 SOCK_LOCK_ASSERT(so); 1985 1986 source = SLOT(newlabel); 1987 dest = SLOT(solabel); 1988 1989 mls_copy(source, dest); 1990 } 1991 1992 static void 1993 mls_socketpeer_set_from_mbuf(struct mbuf *m, struct label *mlabel, 1994 struct socket *so, struct label *sopeerlabel) 1995 { 1996 struct mac_mls *source, *dest; 1997 1998 source = SLOT(mlabel); 1999 dest = SLOT(sopeerlabel); 2000 2001 SOCK_LOCK(so); 2002 mls_copy_effective(source, dest); 2003 SOCK_UNLOCK(so); 2004 } 2005 2006 static void 2007 mls_socketpeer_set_from_socket(struct socket *oldso, 2008 struct label *oldsolabel, struct socket *newso, 2009 struct label *newsopeerlabel) 2010 { 2011 struct mac_mls source, *dest; 2012 2013 SOCK_LOCK(oldso); 2014 source = *SLOT(oldsolabel); 2015 SOCK_UNLOCK(oldso); 2016 2017 dest = SLOT(newsopeerlabel); 2018 2019 SOCK_LOCK(newso); 2020 mls_copy_effective(&source, dest); 2021 SOCK_UNLOCK(newso); 2022 } 2023 2024 static void 2025 mls_syncache_create(struct label *label, struct inpcb *inp) 2026 { 2027 struct mac_mls *source, *dest; 2028 2029 source = SLOT(inp->inp_label); 2030 dest = SLOT(label); 2031 2032 mls_copy_effective(source, dest); 2033 } 2034 2035 static void 2036 mls_syncache_create_mbuf(struct label *sc_label, struct mbuf *m, 2037 struct label *mlabel) 2038 { 2039 struct mac_mls *source, *dest; 2040 2041 source = SLOT(sc_label); 2042 dest = SLOT(mlabel); 2043 2044 mls_copy_effective(source, dest); 2045 } 2046 2047 static int 2048 mls_system_check_acct(struct ucred *cred, struct vnode *vp, 2049 struct label *vplabel) 2050 { 2051 struct mac_mls *subj, *obj; 2052 2053 if (!mls_enabled) 2054 return (0); 2055 2056 if (vplabel == NULL) 2057 return (0); 2058 2059 subj = SLOT(cred->cr_label); 2060 obj = SLOT(vplabel); 2061 2062 if (!mls_dominate_effective(obj, subj) || 2063 !mls_dominate_effective(subj, obj)) 2064 return (EACCES); 2065 2066 return (0); 2067 } 2068 2069 static int 2070 mls_system_check_auditctl(struct ucred *cred, struct vnode *vp, 2071 struct label *vplabel) 2072 { 2073 struct mac_mls *subj, *obj; 2074 2075 if (!mls_enabled) 2076 return (0); 2077 2078 subj = SLOT(cred->cr_label); 2079 obj = SLOT(vplabel); 2080 2081 if (!mls_dominate_effective(obj, subj) || 2082 !mls_dominate_effective(subj, obj)) 2083 return (EACCES); 2084 2085 return (0); 2086 } 2087 2088 static int 2089 mls_system_check_swapon(struct ucred *cred, struct vnode *vp, 2090 struct label *vplabel) 2091 { 2092 struct mac_mls *subj, *obj; 2093 2094 if (!mls_enabled) 2095 return (0); 2096 2097 subj = SLOT(cred->cr_label); 2098 obj = SLOT(vplabel); 2099 2100 if (!mls_dominate_effective(obj, subj) || 2101 !mls_dominate_effective(subj, obj)) 2102 return (EACCES); 2103 2104 return (0); 2105 } 2106 2107 static void 2108 mls_sysvmsg_cleanup(struct label *msglabel) 2109 { 2110 2111 bzero(SLOT(msglabel), sizeof(struct mac_mls)); 2112 } 2113 2114 static void 2115 mls_sysvmsg_create(struct ucred *cred, struct msqid_kernel *msqkptr, 2116 struct label *msqlabel, struct msg *msgptr, struct label *msglabel) 2117 { 2118 struct mac_mls *source, *dest; 2119 2120 /* Ignore the msgq label. */ 2121 source = SLOT(cred->cr_label); 2122 dest = SLOT(msglabel); 2123 2124 mls_copy_effective(source, dest); 2125 } 2126 2127 static int 2128 mls_sysvmsq_check_msgrcv(struct ucred *cred, struct msg *msgptr, 2129 struct label *msglabel) 2130 { 2131 struct mac_mls *subj, *obj; 2132 2133 if (!mls_enabled) 2134 return (0); 2135 2136 subj = SLOT(cred->cr_label); 2137 obj = SLOT(msglabel); 2138 2139 if (!mls_dominate_effective(subj, obj)) 2140 return (EACCES); 2141 2142 return (0); 2143 } 2144 2145 static int 2146 mls_sysvmsq_check_msgrmid(struct ucred *cred, struct msg *msgptr, 2147 struct label *msglabel) 2148 { 2149 struct mac_mls *subj, *obj; 2150 2151 if (!mls_enabled) 2152 return (0); 2153 2154 subj = SLOT(cred->cr_label); 2155 obj = SLOT(msglabel); 2156 2157 if (!mls_dominate_effective(obj, subj)) 2158 return (EACCES); 2159 2160 return (0); 2161 } 2162 2163 static int 2164 mls_sysvmsq_check_msqget(struct ucred *cred, struct msqid_kernel *msqkptr, 2165 struct label *msqklabel) 2166 { 2167 struct mac_mls *subj, *obj; 2168 2169 if (!mls_enabled) 2170 return (0); 2171 2172 subj = SLOT(cred->cr_label); 2173 obj = SLOT(msqklabel); 2174 2175 if (!mls_dominate_effective(subj, obj)) 2176 return (EACCES); 2177 2178 return (0); 2179 } 2180 2181 static int 2182 mls_sysvmsq_check_msqsnd(struct ucred *cred, struct msqid_kernel *msqkptr, 2183 struct label *msqklabel) 2184 { 2185 struct mac_mls *subj, *obj; 2186 2187 if (!mls_enabled) 2188 return (0); 2189 2190 subj = SLOT(cred->cr_label); 2191 obj = SLOT(msqklabel); 2192 2193 if (!mls_dominate_effective(obj, subj)) 2194 return (EACCES); 2195 2196 return (0); 2197 } 2198 2199 static int 2200 mls_sysvmsq_check_msqrcv(struct ucred *cred, struct msqid_kernel *msqkptr, 2201 struct label *msqklabel) 2202 { 2203 struct mac_mls *subj, *obj; 2204 2205 if (!mls_enabled) 2206 return (0); 2207 2208 subj = SLOT(cred->cr_label); 2209 obj = SLOT(msqklabel); 2210 2211 if (!mls_dominate_effective(subj, obj)) 2212 return (EACCES); 2213 2214 return (0); 2215 } 2216 2217 static int 2218 mls_sysvmsq_check_msqctl(struct ucred *cred, struct msqid_kernel *msqkptr, 2219 struct label *msqklabel, int cmd) 2220 { 2221 struct mac_mls *subj, *obj; 2222 2223 if (!mls_enabled) 2224 return (0); 2225 2226 subj = SLOT(cred->cr_label); 2227 obj = SLOT(msqklabel); 2228 2229 switch(cmd) { 2230 case IPC_RMID: 2231 case IPC_SET: 2232 if (!mls_dominate_effective(obj, subj)) 2233 return (EACCES); 2234 break; 2235 2236 case IPC_STAT: 2237 if (!mls_dominate_effective(subj, obj)) 2238 return (EACCES); 2239 break; 2240 2241 default: 2242 return (EACCES); 2243 } 2244 2245 return (0); 2246 } 2247 2248 static void 2249 mls_sysvmsq_cleanup(struct label *msqlabel) 2250 { 2251 2252 bzero(SLOT(msqlabel), sizeof(struct mac_mls)); 2253 } 2254 2255 static void 2256 mls_sysvmsq_create(struct ucred *cred, struct msqid_kernel *msqkptr, 2257 struct label *msqlabel) 2258 { 2259 struct mac_mls *source, *dest; 2260 2261 source = SLOT(cred->cr_label); 2262 dest = SLOT(msqlabel); 2263 2264 mls_copy_effective(source, dest); 2265 } 2266 2267 static int 2268 mls_sysvsem_check_semctl(struct ucred *cred, struct semid_kernel *semakptr, 2269 struct label *semaklabel, int cmd) 2270 { 2271 struct mac_mls *subj, *obj; 2272 2273 if (!mls_enabled) 2274 return (0); 2275 2276 subj = SLOT(cred->cr_label); 2277 obj = SLOT(semaklabel); 2278 2279 switch(cmd) { 2280 case IPC_RMID: 2281 case IPC_SET: 2282 case SETVAL: 2283 case SETALL: 2284 if (!mls_dominate_effective(obj, subj)) 2285 return (EACCES); 2286 break; 2287 2288 case IPC_STAT: 2289 case GETVAL: 2290 case GETPID: 2291 case GETNCNT: 2292 case GETZCNT: 2293 case GETALL: 2294 if (!mls_dominate_effective(subj, obj)) 2295 return (EACCES); 2296 break; 2297 2298 default: 2299 return (EACCES); 2300 } 2301 2302 return (0); 2303 } 2304 2305 static int 2306 mls_sysvsem_check_semget(struct ucred *cred, struct semid_kernel *semakptr, 2307 struct label *semaklabel) 2308 { 2309 struct mac_mls *subj, *obj; 2310 2311 if (!mls_enabled) 2312 return (0); 2313 2314 subj = SLOT(cred->cr_label); 2315 obj = SLOT(semaklabel); 2316 2317 if (!mls_dominate_effective(subj, obj)) 2318 return (EACCES); 2319 2320 return (0); 2321 } 2322 2323 static int 2324 mls_sysvsem_check_semop(struct ucred *cred, struct semid_kernel *semakptr, 2325 struct label *semaklabel, size_t accesstype) 2326 { 2327 struct mac_mls *subj, *obj; 2328 2329 if (!mls_enabled) 2330 return (0); 2331 2332 subj = SLOT(cred->cr_label); 2333 obj = SLOT(semaklabel); 2334 2335 if( accesstype & SEM_R ) 2336 if (!mls_dominate_effective(subj, obj)) 2337 return (EACCES); 2338 2339 if( accesstype & SEM_A ) 2340 if (!mls_dominate_effective(obj, subj)) 2341 return (EACCES); 2342 2343 return (0); 2344 } 2345 2346 static void 2347 mls_sysvsem_cleanup(struct label *semalabel) 2348 { 2349 2350 bzero(SLOT(semalabel), sizeof(struct mac_mls)); 2351 } 2352 2353 static void 2354 mls_sysvsem_create(struct ucred *cred, struct semid_kernel *semakptr, 2355 struct label *semalabel) 2356 { 2357 struct mac_mls *source, *dest; 2358 2359 source = SLOT(cred->cr_label); 2360 dest = SLOT(semalabel); 2361 2362 mls_copy_effective(source, dest); 2363 } 2364 2365 static int 2366 mls_sysvshm_check_shmat(struct ucred *cred, struct shmid_kernel *shmsegptr, 2367 struct label *shmseglabel, int shmflg) 2368 { 2369 struct mac_mls *subj, *obj; 2370 2371 if (!mls_enabled) 2372 return (0); 2373 2374 subj = SLOT(cred->cr_label); 2375 obj = SLOT(shmseglabel); 2376 2377 if (!mls_dominate_effective(subj, obj)) 2378 return (EACCES); 2379 if ((shmflg & SHM_RDONLY) == 0) { 2380 if (!mls_dominate_effective(obj, subj)) 2381 return (EACCES); 2382 } 2383 2384 return (0); 2385 } 2386 2387 static int 2388 mls_sysvshm_check_shmctl(struct ucred *cred, struct shmid_kernel *shmsegptr, 2389 struct label *shmseglabel, int cmd) 2390 { 2391 struct mac_mls *subj, *obj; 2392 2393 if (!mls_enabled) 2394 return (0); 2395 2396 subj = SLOT(cred->cr_label); 2397 obj = SLOT(shmseglabel); 2398 2399 switch(cmd) { 2400 case IPC_RMID: 2401 case IPC_SET: 2402 if (!mls_dominate_effective(obj, subj)) 2403 return (EACCES); 2404 break; 2405 2406 case IPC_STAT: 2407 case SHM_STAT: 2408 if (!mls_dominate_effective(subj, obj)) 2409 return (EACCES); 2410 break; 2411 2412 default: 2413 return (EACCES); 2414 } 2415 2416 return (0); 2417 } 2418 2419 static int 2420 mls_sysvshm_check_shmget(struct ucred *cred, struct shmid_kernel *shmsegptr, 2421 struct label *shmseglabel, int shmflg) 2422 { 2423 struct mac_mls *subj, *obj; 2424 2425 if (!mls_enabled) 2426 return (0); 2427 2428 subj = SLOT(cred->cr_label); 2429 obj = SLOT(shmseglabel); 2430 2431 if (!mls_dominate_effective(obj, subj)) 2432 return (EACCES); 2433 2434 return (0); 2435 } 2436 2437 static void 2438 mls_sysvshm_cleanup(struct label *shmlabel) 2439 { 2440 2441 bzero(SLOT(shmlabel), sizeof(struct mac_mls)); 2442 } 2443 2444 static void 2445 mls_sysvshm_create(struct ucred *cred, struct shmid_kernel *shmsegptr, 2446 struct label *shmlabel) 2447 { 2448 struct mac_mls *source, *dest; 2449 2450 source = SLOT(cred->cr_label); 2451 dest = SLOT(shmlabel); 2452 2453 mls_copy_effective(source, dest); 2454 } 2455 2456 static int 2457 mls_vnode_associate_extattr(struct mount *mp, struct label *mplabel, 2458 struct vnode *vp, struct label *vplabel) 2459 { 2460 struct mac_mls mm_temp, *source, *dest; 2461 int buflen, error; 2462 2463 source = SLOT(mplabel); 2464 dest = SLOT(vplabel); 2465 2466 buflen = sizeof(mm_temp); 2467 bzero(&mm_temp, buflen); 2468 2469 error = vn_extattr_get(vp, IO_NODELOCKED, MAC_MLS_EXTATTR_NAMESPACE, 2470 MAC_MLS_EXTATTR_NAME, &buflen, (char *) &mm_temp, curthread); 2471 if (error == ENOATTR || error == EOPNOTSUPP) { 2472 /* Fall back to the mntlabel. */ 2473 mls_copy_effective(source, dest); 2474 return (0); 2475 } else if (error) 2476 return (error); 2477 2478 if (buflen != sizeof(mm_temp)) { 2479 printf("mls_vnode_associate_extattr: bad size %d\n", buflen); 2480 return (EPERM); 2481 } 2482 if (mls_valid(&mm_temp) != 0) { 2483 printf("mls_vnode_associate_extattr: invalid\n"); 2484 return (EPERM); 2485 } 2486 if ((mm_temp.mm_flags & MAC_MLS_FLAGS_BOTH) != 2487 MAC_MLS_FLAG_EFFECTIVE) { 2488 printf("mls_associated_vnode_extattr: not effective\n"); 2489 return (EPERM); 2490 } 2491 2492 mls_copy_effective(&mm_temp, dest); 2493 return (0); 2494 } 2495 2496 static void 2497 mls_vnode_associate_singlelabel(struct mount *mp, struct label *mplabel, 2498 struct vnode *vp, struct label *vplabel) 2499 { 2500 struct mac_mls *source, *dest; 2501 2502 source = SLOT(mplabel); 2503 dest = SLOT(vplabel); 2504 2505 mls_copy_effective(source, dest); 2506 } 2507 2508 static int 2509 mls_vnode_check_chdir(struct ucred *cred, struct vnode *dvp, 2510 struct label *dvplabel) 2511 { 2512 struct mac_mls *subj, *obj; 2513 2514 if (!mls_enabled) 2515 return (0); 2516 2517 subj = SLOT(cred->cr_label); 2518 obj = SLOT(dvplabel); 2519 2520 if (!mls_dominate_effective(subj, obj)) 2521 return (EACCES); 2522 2523 return (0); 2524 } 2525 2526 static int 2527 mls_vnode_check_chroot(struct ucred *cred, struct vnode *dvp, 2528 struct label *dvplabel) 2529 { 2530 struct mac_mls *subj, *obj; 2531 2532 if (!mls_enabled) 2533 return (0); 2534 2535 subj = SLOT(cred->cr_label); 2536 obj = SLOT(dvplabel); 2537 2538 if (!mls_dominate_effective(subj, obj)) 2539 return (EACCES); 2540 2541 return (0); 2542 } 2543 2544 static int 2545 mls_vnode_check_create(struct ucred *cred, struct vnode *dvp, 2546 struct label *dvplabel, struct componentname *cnp, struct vattr *vap) 2547 { 2548 struct mac_mls *subj, *obj; 2549 2550 if (!mls_enabled) 2551 return (0); 2552 2553 subj = SLOT(cred->cr_label); 2554 obj = SLOT(dvplabel); 2555 2556 if (!mls_dominate_effective(obj, subj)) 2557 return (EACCES); 2558 2559 return (0); 2560 } 2561 2562 static int 2563 mls_vnode_check_deleteacl(struct ucred *cred, struct vnode *vp, 2564 struct label *vplabel, acl_type_t type) 2565 { 2566 struct mac_mls *subj, *obj; 2567 2568 if (!mls_enabled) 2569 return (0); 2570 2571 subj = SLOT(cred->cr_label); 2572 obj = SLOT(vplabel); 2573 2574 if (!mls_dominate_effective(obj, subj)) 2575 return (EACCES); 2576 2577 return (0); 2578 } 2579 2580 static int 2581 mls_vnode_check_deleteextattr(struct ucred *cred, struct vnode *vp, 2582 struct label *vplabel, int attrnamespace, const char *name) 2583 { 2584 struct mac_mls *subj, *obj; 2585 2586 if (!mls_enabled) 2587 return (0); 2588 2589 subj = SLOT(cred->cr_label); 2590 obj = SLOT(vplabel); 2591 2592 if (!mls_dominate_effective(obj, subj)) 2593 return (EACCES); 2594 2595 return (0); 2596 } 2597 2598 static int 2599 mls_vnode_check_exec(struct ucred *cred, struct vnode *vp, 2600 struct label *vplabel, struct image_params *imgp, 2601 struct label *execlabel) 2602 { 2603 struct mac_mls *subj, *obj, *exec; 2604 int error; 2605 2606 if (execlabel != NULL) { 2607 /* 2608 * We currently don't permit labels to be changed at 2609 * exec-time as part of MLS, so disallow non-NULL MLS label 2610 * elements in the execlabel. 2611 */ 2612 exec = SLOT(execlabel); 2613 error = mls_atmostflags(exec, 0); 2614 if (error) 2615 return (error); 2616 } 2617 2618 if (!mls_enabled) 2619 return (0); 2620 2621 subj = SLOT(cred->cr_label); 2622 obj = SLOT(vplabel); 2623 2624 if (!mls_dominate_effective(subj, obj)) 2625 return (EACCES); 2626 2627 return (0); 2628 } 2629 2630 static int 2631 mls_vnode_check_getacl(struct ucred *cred, struct vnode *vp, 2632 struct label *vplabel, acl_type_t type) 2633 { 2634 struct mac_mls *subj, *obj; 2635 2636 if (!mls_enabled) 2637 return (0); 2638 2639 subj = SLOT(cred->cr_label); 2640 obj = SLOT(vplabel); 2641 2642 if (!mls_dominate_effective(subj, obj)) 2643 return (EACCES); 2644 2645 return (0); 2646 } 2647 2648 static int 2649 mls_vnode_check_getextattr(struct ucred *cred, struct vnode *vp, 2650 struct label *vplabel, int attrnamespace, const char *name) 2651 { 2652 struct mac_mls *subj, *obj; 2653 2654 if (!mls_enabled) 2655 return (0); 2656 2657 subj = SLOT(cred->cr_label); 2658 obj = SLOT(vplabel); 2659 2660 if (!mls_dominate_effective(subj, obj)) 2661 return (EACCES); 2662 2663 return (0); 2664 } 2665 2666 static int 2667 mls_vnode_check_link(struct ucred *cred, struct vnode *dvp, 2668 struct label *dvplabel, struct vnode *vp, struct label *vplabel, 2669 struct componentname *cnp) 2670 { 2671 struct mac_mls *subj, *obj; 2672 2673 if (!mls_enabled) 2674 return (0); 2675 2676 subj = SLOT(cred->cr_label); 2677 obj = SLOT(dvplabel); 2678 2679 if (!mls_dominate_effective(obj, subj)) 2680 return (EACCES); 2681 2682 obj = SLOT(vplabel); 2683 if (!mls_dominate_effective(obj, subj)) 2684 return (EACCES); 2685 2686 return (0); 2687 } 2688 2689 static int 2690 mls_vnode_check_listextattr(struct ucred *cred, struct vnode *vp, 2691 struct label *vplabel, int attrnamespace) 2692 { 2693 2694 struct mac_mls *subj, *obj; 2695 2696 if (!mls_enabled) 2697 return (0); 2698 2699 subj = SLOT(cred->cr_label); 2700 obj = SLOT(vplabel); 2701 2702 if (!mls_dominate_effective(subj, obj)) 2703 return (EACCES); 2704 2705 return (0); 2706 } 2707 2708 static int 2709 mls_vnode_check_lookup(struct ucred *cred, struct vnode *dvp, 2710 struct label *dvplabel, struct componentname *cnp) 2711 { 2712 struct mac_mls *subj, *obj; 2713 2714 if (!mls_enabled) 2715 return (0); 2716 2717 subj = SLOT(cred->cr_label); 2718 obj = SLOT(dvplabel); 2719 2720 if (!mls_dominate_effective(subj, obj)) 2721 return (EACCES); 2722 2723 return (0); 2724 } 2725 2726 static int 2727 mls_vnode_check_mmap(struct ucred *cred, struct vnode *vp, 2728 struct label *vplabel, int prot, int flags) 2729 { 2730 struct mac_mls *subj, *obj; 2731 2732 /* 2733 * Rely on the use of open()-time protections to handle 2734 * non-revocation cases. 2735 */ 2736 if (!mls_enabled || !revocation_enabled) 2737 return (0); 2738 2739 subj = SLOT(cred->cr_label); 2740 obj = SLOT(vplabel); 2741 2742 if (prot & (VM_PROT_READ | VM_PROT_EXECUTE)) { 2743 if (!mls_dominate_effective(subj, obj)) 2744 return (EACCES); 2745 } 2746 if (((prot & VM_PROT_WRITE) != 0) && ((flags & MAP_SHARED) != 0)) { 2747 if (!mls_dominate_effective(obj, subj)) 2748 return (EACCES); 2749 } 2750 2751 return (0); 2752 } 2753 2754 static int 2755 mls_vnode_check_open(struct ucred *cred, struct vnode *vp, 2756 struct label *vplabel, accmode_t accmode) 2757 { 2758 struct mac_mls *subj, *obj; 2759 2760 if (!mls_enabled) 2761 return (0); 2762 2763 subj = SLOT(cred->cr_label); 2764 obj = SLOT(vplabel); 2765 2766 /* XXX privilege override for admin? */ 2767 if (accmode & (VREAD | VEXEC | VSTAT_PERMS)) { 2768 if (!mls_dominate_effective(subj, obj)) 2769 return (EACCES); 2770 } 2771 if (accmode & VMODIFY_PERMS) { 2772 if (!mls_dominate_effective(obj, subj)) 2773 return (EACCES); 2774 } 2775 2776 return (0); 2777 } 2778 2779 static int 2780 mls_vnode_check_poll(struct ucred *active_cred, struct ucred *file_cred, 2781 struct vnode *vp, struct label *vplabel) 2782 { 2783 struct mac_mls *subj, *obj; 2784 2785 if (!mls_enabled || !revocation_enabled) 2786 return (0); 2787 2788 subj = SLOT(active_cred->cr_label); 2789 obj = SLOT(vplabel); 2790 2791 if (!mls_dominate_effective(subj, obj)) 2792 return (EACCES); 2793 2794 return (0); 2795 } 2796 2797 static int 2798 mls_vnode_check_read(struct ucred *active_cred, struct ucred *file_cred, 2799 struct vnode *vp, struct label *vplabel) 2800 { 2801 struct mac_mls *subj, *obj; 2802 2803 if (!mls_enabled || !revocation_enabled) 2804 return (0); 2805 2806 subj = SLOT(active_cred->cr_label); 2807 obj = SLOT(vplabel); 2808 2809 if (!mls_dominate_effective(subj, obj)) 2810 return (EACCES); 2811 2812 return (0); 2813 } 2814 2815 static int 2816 mls_vnode_check_readdir(struct ucred *cred, struct vnode *dvp, 2817 struct label *dvplabel) 2818 { 2819 struct mac_mls *subj, *obj; 2820 2821 if (!mls_enabled) 2822 return (0); 2823 2824 subj = SLOT(cred->cr_label); 2825 obj = SLOT(dvplabel); 2826 2827 if (!mls_dominate_effective(subj, obj)) 2828 return (EACCES); 2829 2830 return (0); 2831 } 2832 2833 static int 2834 mls_vnode_check_readlink(struct ucred *cred, struct vnode *vp, 2835 struct label *vplabel) 2836 { 2837 struct mac_mls *subj, *obj; 2838 2839 if (!mls_enabled) 2840 return (0); 2841 2842 subj = SLOT(cred->cr_label); 2843 obj = SLOT(vplabel); 2844 2845 if (!mls_dominate_effective(subj, obj)) 2846 return (EACCES); 2847 2848 return (0); 2849 } 2850 2851 static int 2852 mls_vnode_check_relabel(struct ucred *cred, struct vnode *vp, 2853 struct label *vplabel, struct label *newlabel) 2854 { 2855 struct mac_mls *old, *new, *subj; 2856 int error; 2857 2858 old = SLOT(vplabel); 2859 new = SLOT(newlabel); 2860 subj = SLOT(cred->cr_label); 2861 2862 /* 2863 * If there is an MLS label update for the vnode, it must be a 2864 * effective label. 2865 */ 2866 error = mls_atmostflags(new, MAC_MLS_FLAG_EFFECTIVE); 2867 if (error) 2868 return (error); 2869 2870 /* 2871 * To perform a relabel of the vnode (MLS label or not), MLS must 2872 * authorize the relabel. 2873 */ 2874 if (!mls_effective_in_range(old, subj)) 2875 return (EPERM); 2876 2877 /* 2878 * If the MLS label is to be changed, authorize as appropriate. 2879 */ 2880 if (new->mm_flags & MAC_MLS_FLAG_EFFECTIVE) { 2881 /* 2882 * To change the MLS label on a vnode, the new vnode label 2883 * must be in the subject range. 2884 */ 2885 if (!mls_effective_in_range(new, subj)) 2886 return (EPERM); 2887 2888 /* 2889 * To change the MLS label on the vnode to be EQUAL, the 2890 * subject must have appropriate privilege. 2891 */ 2892 if (mls_contains_equal(new)) { 2893 error = mls_subject_privileged(subj); 2894 if (error) 2895 return (error); 2896 } 2897 } 2898 2899 return (0); 2900 } 2901 2902 static int 2903 mls_vnode_check_rename_from(struct ucred *cred, struct vnode *dvp, 2904 struct label *dvplabel, struct vnode *vp, struct label *vplabel, 2905 struct componentname *cnp) 2906 { 2907 struct mac_mls *subj, *obj; 2908 2909 if (!mls_enabled) 2910 return (0); 2911 2912 subj = SLOT(cred->cr_label); 2913 obj = SLOT(dvplabel); 2914 2915 if (!mls_dominate_effective(obj, subj)) 2916 return (EACCES); 2917 2918 obj = SLOT(vplabel); 2919 2920 if (!mls_dominate_effective(obj, subj)) 2921 return (EACCES); 2922 2923 return (0); 2924 } 2925 2926 static int 2927 mls_vnode_check_rename_to(struct ucred *cred, struct vnode *dvp, 2928 struct label *dvplabel, struct vnode *vp, struct label *vplabel, 2929 int samedir, struct componentname *cnp) 2930 { 2931 struct mac_mls *subj, *obj; 2932 2933 if (!mls_enabled) 2934 return (0); 2935 2936 subj = SLOT(cred->cr_label); 2937 obj = SLOT(dvplabel); 2938 2939 if (!mls_dominate_effective(obj, subj)) 2940 return (EACCES); 2941 2942 if (vp != NULL) { 2943 obj = SLOT(vplabel); 2944 2945 if (!mls_dominate_effective(obj, subj)) 2946 return (EACCES); 2947 } 2948 2949 return (0); 2950 } 2951 2952 static int 2953 mls_vnode_check_revoke(struct ucred *cred, struct vnode *vp, 2954 struct label *vplabel) 2955 { 2956 struct mac_mls *subj, *obj; 2957 2958 if (!mls_enabled) 2959 return (0); 2960 2961 subj = SLOT(cred->cr_label); 2962 obj = SLOT(vplabel); 2963 2964 if (!mls_dominate_effective(obj, subj)) 2965 return (EACCES); 2966 2967 return (0); 2968 } 2969 2970 static int 2971 mls_vnode_check_setacl(struct ucred *cred, struct vnode *vp, 2972 struct label *vplabel, acl_type_t type, struct acl *acl) 2973 { 2974 struct mac_mls *subj, *obj; 2975 2976 if (!mls_enabled) 2977 return (0); 2978 2979 subj = SLOT(cred->cr_label); 2980 obj = SLOT(vplabel); 2981 2982 if (!mls_dominate_effective(obj, subj)) 2983 return (EACCES); 2984 2985 return (0); 2986 } 2987 2988 static int 2989 mls_vnode_check_setextattr(struct ucred *cred, struct vnode *vp, 2990 struct label *vplabel, int attrnamespace, const char *name) 2991 { 2992 struct mac_mls *subj, *obj; 2993 2994 if (!mls_enabled) 2995 return (0); 2996 2997 subj = SLOT(cred->cr_label); 2998 obj = SLOT(vplabel); 2999 3000 if (!mls_dominate_effective(obj, subj)) 3001 return (EACCES); 3002 3003 /* XXX: protect the MAC EA in a special way? */ 3004 3005 return (0); 3006 } 3007 3008 static int 3009 mls_vnode_check_setflags(struct ucred *cred, struct vnode *vp, 3010 struct label *vplabel, u_long flags) 3011 { 3012 struct mac_mls *subj, *obj; 3013 3014 if (!mls_enabled) 3015 return (0); 3016 3017 subj = SLOT(cred->cr_label); 3018 obj = SLOT(vplabel); 3019 3020 if (!mls_dominate_effective(obj, subj)) 3021 return (EACCES); 3022 3023 return (0); 3024 } 3025 3026 static int 3027 mls_vnode_check_setmode(struct ucred *cred, struct vnode *vp, 3028 struct label *vplabel, mode_t mode) 3029 { 3030 struct mac_mls *subj, *obj; 3031 3032 if (!mls_enabled) 3033 return (0); 3034 3035 subj = SLOT(cred->cr_label); 3036 obj = SLOT(vplabel); 3037 3038 if (!mls_dominate_effective(obj, subj)) 3039 return (EACCES); 3040 3041 return (0); 3042 } 3043 3044 static int 3045 mls_vnode_check_setowner(struct ucred *cred, struct vnode *vp, 3046 struct label *vplabel, uid_t uid, gid_t gid) 3047 { 3048 struct mac_mls *subj, *obj; 3049 3050 if (!mls_enabled) 3051 return (0); 3052 3053 subj = SLOT(cred->cr_label); 3054 obj = SLOT(vplabel); 3055 3056 if (!mls_dominate_effective(obj, subj)) 3057 return (EACCES); 3058 3059 return (0); 3060 } 3061 3062 static int 3063 mls_vnode_check_setutimes(struct ucred *cred, struct vnode *vp, 3064 struct label *vplabel, struct timespec atime, struct timespec mtime) 3065 { 3066 struct mac_mls *subj, *obj; 3067 3068 if (!mls_enabled) 3069 return (0); 3070 3071 subj = SLOT(cred->cr_label); 3072 obj = SLOT(vplabel); 3073 3074 if (!mls_dominate_effective(obj, subj)) 3075 return (EACCES); 3076 3077 return (0); 3078 } 3079 3080 static int 3081 mls_vnode_check_stat(struct ucred *active_cred, struct ucred *file_cred, 3082 struct vnode *vp, struct label *vplabel) 3083 { 3084 struct mac_mls *subj, *obj; 3085 3086 if (!mls_enabled) 3087 return (0); 3088 3089 subj = SLOT(active_cred->cr_label); 3090 obj = SLOT(vplabel); 3091 3092 if (!mls_dominate_effective(subj, obj)) 3093 return (EACCES); 3094 3095 return (0); 3096 } 3097 3098 static int 3099 mls_vnode_check_unlink(struct ucred *cred, struct vnode *dvp, 3100 struct label *dvplabel, struct vnode *vp, struct label *vplabel, 3101 struct componentname *cnp) 3102 { 3103 struct mac_mls *subj, *obj; 3104 3105 if (!mls_enabled) 3106 return (0); 3107 3108 subj = SLOT(cred->cr_label); 3109 obj = SLOT(dvplabel); 3110 3111 if (!mls_dominate_effective(obj, subj)) 3112 return (EACCES); 3113 3114 obj = SLOT(vplabel); 3115 3116 if (!mls_dominate_effective(obj, subj)) 3117 return (EACCES); 3118 3119 return (0); 3120 } 3121 3122 static int 3123 mls_vnode_check_write(struct ucred *active_cred, struct ucred *file_cred, 3124 struct vnode *vp, struct label *vplabel) 3125 { 3126 struct mac_mls *subj, *obj; 3127 3128 if (!mls_enabled || !revocation_enabled) 3129 return (0); 3130 3131 subj = SLOT(active_cred->cr_label); 3132 obj = SLOT(vplabel); 3133 3134 if (!mls_dominate_effective(obj, subj)) 3135 return (EACCES); 3136 3137 return (0); 3138 } 3139 3140 static int 3141 mls_vnode_create_extattr(struct ucred *cred, struct mount *mp, 3142 struct label *mplabel, struct vnode *dvp, struct label *dvplabel, 3143 struct vnode *vp, struct label *vplabel, struct componentname *cnp) 3144 { 3145 struct mac_mls *source, *dest, mm_temp; 3146 size_t buflen; 3147 int error; 3148 3149 buflen = sizeof(mm_temp); 3150 bzero(&mm_temp, buflen); 3151 3152 source = SLOT(cred->cr_label); 3153 dest = SLOT(vplabel); 3154 mls_copy_effective(source, &mm_temp); 3155 3156 error = vn_extattr_set(vp, IO_NODELOCKED, MAC_MLS_EXTATTR_NAMESPACE, 3157 MAC_MLS_EXTATTR_NAME, buflen, (char *) &mm_temp, curthread); 3158 if (error == 0) 3159 mls_copy_effective(source, dest); 3160 return (error); 3161 } 3162 3163 static void 3164 mls_vnode_relabel(struct ucred *cred, struct vnode *vp, 3165 struct label *vplabel, struct label *label) 3166 { 3167 struct mac_mls *source, *dest; 3168 3169 source = SLOT(label); 3170 dest = SLOT(vplabel); 3171 3172 mls_copy(source, dest); 3173 } 3174 3175 static int 3176 mls_vnode_setlabel_extattr(struct ucred *cred, struct vnode *vp, 3177 struct label *vplabel, struct label *intlabel) 3178 { 3179 struct mac_mls *source, mm_temp; 3180 size_t buflen; 3181 int error; 3182 3183 buflen = sizeof(mm_temp); 3184 bzero(&mm_temp, buflen); 3185 3186 source = SLOT(intlabel); 3187 if ((source->mm_flags & MAC_MLS_FLAG_EFFECTIVE) == 0) 3188 return (0); 3189 3190 mls_copy_effective(source, &mm_temp); 3191 3192 error = vn_extattr_set(vp, IO_NODELOCKED, MAC_MLS_EXTATTR_NAMESPACE, 3193 MAC_MLS_EXTATTR_NAME, buflen, (char *) &mm_temp, curthread); 3194 return (error); 3195 } 3196 3197 static struct mac_policy_ops mls_ops = 3198 { 3199 .mpo_init = mls_init, 3200 3201 .mpo_bpfdesc_check_receive = mls_bpfdesc_check_receive, 3202 .mpo_bpfdesc_create = mls_bpfdesc_create, 3203 .mpo_bpfdesc_create_mbuf = mls_bpfdesc_create_mbuf, 3204 .mpo_bpfdesc_destroy_label = mls_destroy_label, 3205 .mpo_bpfdesc_init_label = mls_init_label, 3206 3207 .mpo_cred_associate_nfsd = mls_cred_associate_nfsd, 3208 .mpo_cred_check_relabel = mls_cred_check_relabel, 3209 .mpo_cred_check_visible = mls_cred_check_visible, 3210 .mpo_cred_copy_label = mls_copy_label, 3211 .mpo_cred_create_init = mls_cred_create_init, 3212 .mpo_cred_create_swapper = mls_cred_create_swapper, 3213 .mpo_cred_destroy_label = mls_destroy_label, 3214 .mpo_cred_externalize_label = mls_externalize_label, 3215 .mpo_cred_init_label = mls_init_label, 3216 .mpo_cred_internalize_label = mls_internalize_label, 3217 .mpo_cred_relabel = mls_cred_relabel, 3218 3219 .mpo_devfs_create_device = mls_devfs_create_device, 3220 .mpo_devfs_create_directory = mls_devfs_create_directory, 3221 .mpo_devfs_create_symlink = mls_devfs_create_symlink, 3222 .mpo_devfs_destroy_label = mls_destroy_label, 3223 .mpo_devfs_init_label = mls_init_label, 3224 .mpo_devfs_update = mls_devfs_update, 3225 .mpo_devfs_vnode_associate = mls_devfs_vnode_associate, 3226 3227 .mpo_ifnet_check_relabel = mls_ifnet_check_relabel, 3228 .mpo_ifnet_check_transmit = mls_ifnet_check_transmit, 3229 .mpo_ifnet_copy_label = mls_copy_label, 3230 .mpo_ifnet_create = mls_ifnet_create, 3231 .mpo_ifnet_create_mbuf = mls_ifnet_create_mbuf, 3232 .mpo_ifnet_destroy_label = mls_destroy_label, 3233 .mpo_ifnet_externalize_label = mls_externalize_label, 3234 .mpo_ifnet_init_label = mls_init_label, 3235 .mpo_ifnet_internalize_label = mls_internalize_label, 3236 .mpo_ifnet_relabel = mls_ifnet_relabel, 3237 3238 .mpo_inpcb_check_deliver = mls_inpcb_check_deliver, 3239 .mpo_inpcb_check_visible = mls_inpcb_check_visible, 3240 .mpo_inpcb_create = mls_inpcb_create, 3241 .mpo_inpcb_create_mbuf = mls_inpcb_create_mbuf, 3242 .mpo_inpcb_destroy_label = mls_destroy_label, 3243 .mpo_inpcb_init_label = mls_init_label_waitcheck, 3244 .mpo_inpcb_sosetlabel = mls_inpcb_sosetlabel, 3245 3246 .mpo_ip6q_create = mls_ip6q_create, 3247 .mpo_ip6q_destroy_label = mls_destroy_label, 3248 .mpo_ip6q_init_label = mls_init_label_waitcheck, 3249 .mpo_ip6q_match = mls_ip6q_match, 3250 .mpo_ip6q_reassemble = mls_ip6q_reassemble, 3251 .mpo_ip6q_update = mls_ip6q_update, 3252 3253 .mpo_ipq_create = mls_ipq_create, 3254 .mpo_ipq_destroy_label = mls_destroy_label, 3255 .mpo_ipq_init_label = mls_init_label_waitcheck, 3256 .mpo_ipq_match = mls_ipq_match, 3257 .mpo_ipq_reassemble = mls_ipq_reassemble, 3258 .mpo_ipq_update = mls_ipq_update, 3259 3260 .mpo_mbuf_copy_label = mls_copy_label, 3261 .mpo_mbuf_destroy_label = mls_destroy_label, 3262 .mpo_mbuf_init_label = mls_init_label_waitcheck, 3263 3264 .mpo_mount_check_stat = mls_mount_check_stat, 3265 .mpo_mount_create = mls_mount_create, 3266 .mpo_mount_destroy_label = mls_destroy_label, 3267 .mpo_mount_init_label = mls_init_label, 3268 3269 .mpo_netinet_arp_send = mls_netinet_arp_send, 3270 .mpo_netinet_firewall_reply = mls_netinet_firewall_reply, 3271 .mpo_netinet_firewall_send = mls_netinet_firewall_send, 3272 .mpo_netinet_fragment = mls_netinet_fragment, 3273 .mpo_netinet_icmp_reply = mls_netinet_icmp_reply, 3274 .mpo_netinet_igmp_send = mls_netinet_igmp_send, 3275 3276 .mpo_netinet6_nd6_send = mls_netinet6_nd6_send, 3277 3278 .mpo_pipe_check_ioctl = mls_pipe_check_ioctl, 3279 .mpo_pipe_check_poll = mls_pipe_check_poll, 3280 .mpo_pipe_check_read = mls_pipe_check_read, 3281 .mpo_pipe_check_relabel = mls_pipe_check_relabel, 3282 .mpo_pipe_check_stat = mls_pipe_check_stat, 3283 .mpo_pipe_check_write = mls_pipe_check_write, 3284 .mpo_pipe_copy_label = mls_copy_label, 3285 .mpo_pipe_create = mls_pipe_create, 3286 .mpo_pipe_destroy_label = mls_destroy_label, 3287 .mpo_pipe_externalize_label = mls_externalize_label, 3288 .mpo_pipe_init_label = mls_init_label, 3289 .mpo_pipe_internalize_label = mls_internalize_label, 3290 .mpo_pipe_relabel = mls_pipe_relabel, 3291 3292 .mpo_posixsem_check_getvalue = mls_posixsem_check_rdonly, 3293 .mpo_posixsem_check_open = mls_posixsem_check_openunlink, 3294 .mpo_posixsem_check_post = mls_posixsem_check_write, 3295 .mpo_posixsem_check_setmode = mls_posixsem_check_setmode, 3296 .mpo_posixsem_check_setowner = mls_posixsem_check_setowner, 3297 .mpo_posixsem_check_stat = mls_posixsem_check_rdonly, 3298 .mpo_posixsem_check_unlink = mls_posixsem_check_openunlink, 3299 .mpo_posixsem_check_wait = mls_posixsem_check_write, 3300 .mpo_posixsem_create = mls_posixsem_create, 3301 .mpo_posixsem_destroy_label = mls_destroy_label, 3302 .mpo_posixsem_init_label = mls_init_label, 3303 3304 .mpo_posixshm_check_mmap = mls_posixshm_check_mmap, 3305 .mpo_posixshm_check_open = mls_posixshm_check_open, 3306 .mpo_posixshm_check_read = mls_posixshm_check_read, 3307 .mpo_posixshm_check_setmode = mls_posixshm_check_setmode, 3308 .mpo_posixshm_check_setowner = mls_posixshm_check_setowner, 3309 .mpo_posixshm_check_stat = mls_posixshm_check_stat, 3310 .mpo_posixshm_check_truncate = mls_posixshm_check_truncate, 3311 .mpo_posixshm_check_unlink = mls_posixshm_check_unlink, 3312 .mpo_posixshm_check_write = mls_posixshm_check_write, 3313 .mpo_posixshm_create = mls_posixshm_create, 3314 .mpo_posixshm_destroy_label = mls_destroy_label, 3315 .mpo_posixshm_init_label = mls_init_label, 3316 3317 .mpo_proc_check_debug = mls_proc_check_debug, 3318 .mpo_proc_check_sched = mls_proc_check_sched, 3319 .mpo_proc_check_signal = mls_proc_check_signal, 3320 3321 .mpo_socket_check_deliver = mls_socket_check_deliver, 3322 .mpo_socket_check_relabel = mls_socket_check_relabel, 3323 .mpo_socket_check_visible = mls_socket_check_visible, 3324 .mpo_socket_copy_label = mls_copy_label, 3325 .mpo_socket_create = mls_socket_create, 3326 .mpo_socket_create_mbuf = mls_socket_create_mbuf, 3327 .mpo_socket_destroy_label = mls_destroy_label, 3328 .mpo_socket_externalize_label = mls_externalize_label, 3329 .mpo_socket_init_label = mls_init_label_waitcheck, 3330 .mpo_socket_internalize_label = mls_internalize_label, 3331 .mpo_socket_newconn = mls_socket_newconn, 3332 .mpo_socket_relabel = mls_socket_relabel, 3333 3334 .mpo_socketpeer_destroy_label = mls_destroy_label, 3335 .mpo_socketpeer_externalize_label = mls_externalize_label, 3336 .mpo_socketpeer_init_label = mls_init_label_waitcheck, 3337 .mpo_socketpeer_set_from_mbuf = mls_socketpeer_set_from_mbuf, 3338 .mpo_socketpeer_set_from_socket = mls_socketpeer_set_from_socket, 3339 3340 .mpo_syncache_create = mls_syncache_create, 3341 .mpo_syncache_create_mbuf = mls_syncache_create_mbuf, 3342 .mpo_syncache_destroy_label = mls_destroy_label, 3343 .mpo_syncache_init_label = mls_init_label_waitcheck, 3344 3345 .mpo_sysvmsg_cleanup = mls_sysvmsg_cleanup, 3346 .mpo_sysvmsg_create = mls_sysvmsg_create, 3347 .mpo_sysvmsg_destroy_label = mls_destroy_label, 3348 .mpo_sysvmsg_init_label = mls_init_label, 3349 3350 .mpo_sysvmsq_check_msgrcv = mls_sysvmsq_check_msgrcv, 3351 .mpo_sysvmsq_check_msgrmid = mls_sysvmsq_check_msgrmid, 3352 .mpo_sysvmsq_check_msqget = mls_sysvmsq_check_msqget, 3353 .mpo_sysvmsq_check_msqsnd = mls_sysvmsq_check_msqsnd, 3354 .mpo_sysvmsq_check_msqrcv = mls_sysvmsq_check_msqrcv, 3355 .mpo_sysvmsq_check_msqctl = mls_sysvmsq_check_msqctl, 3356 .mpo_sysvmsq_cleanup = mls_sysvmsq_cleanup, 3357 .mpo_sysvmsq_destroy_label = mls_destroy_label, 3358 .mpo_sysvmsq_init_label = mls_init_label, 3359 .mpo_sysvmsq_create = mls_sysvmsq_create, 3360 3361 .mpo_sysvsem_check_semctl = mls_sysvsem_check_semctl, 3362 .mpo_sysvsem_check_semget = mls_sysvsem_check_semget, 3363 .mpo_sysvsem_check_semop = mls_sysvsem_check_semop, 3364 .mpo_sysvsem_cleanup = mls_sysvsem_cleanup, 3365 .mpo_sysvsem_create = mls_sysvsem_create, 3366 .mpo_sysvsem_destroy_label = mls_destroy_label, 3367 .mpo_sysvsem_init_label = mls_init_label, 3368 3369 .mpo_sysvshm_check_shmat = mls_sysvshm_check_shmat, 3370 .mpo_sysvshm_check_shmctl = mls_sysvshm_check_shmctl, 3371 .mpo_sysvshm_check_shmget = mls_sysvshm_check_shmget, 3372 .mpo_sysvshm_cleanup = mls_sysvshm_cleanup, 3373 .mpo_sysvshm_create = mls_sysvshm_create, 3374 .mpo_sysvshm_destroy_label = mls_destroy_label, 3375 .mpo_sysvshm_init_label = mls_init_label, 3376 3377 3378 .mpo_system_check_acct = mls_system_check_acct, 3379 .mpo_system_check_auditctl = mls_system_check_auditctl, 3380 .mpo_system_check_swapon = mls_system_check_swapon, 3381 3382 .mpo_vnode_associate_extattr = mls_vnode_associate_extattr, 3383 .mpo_vnode_associate_singlelabel = mls_vnode_associate_singlelabel, 3384 .mpo_vnode_check_access = mls_vnode_check_open, 3385 .mpo_vnode_check_chdir = mls_vnode_check_chdir, 3386 .mpo_vnode_check_chroot = mls_vnode_check_chroot, 3387 .mpo_vnode_check_create = mls_vnode_check_create, 3388 .mpo_vnode_check_deleteacl = mls_vnode_check_deleteacl, 3389 .mpo_vnode_check_deleteextattr = mls_vnode_check_deleteextattr, 3390 .mpo_vnode_check_exec = mls_vnode_check_exec, 3391 .mpo_vnode_check_getacl = mls_vnode_check_getacl, 3392 .mpo_vnode_check_getextattr = mls_vnode_check_getextattr, 3393 .mpo_vnode_check_link = mls_vnode_check_link, 3394 .mpo_vnode_check_listextattr = mls_vnode_check_listextattr, 3395 .mpo_vnode_check_lookup = mls_vnode_check_lookup, 3396 .mpo_vnode_check_mmap = mls_vnode_check_mmap, 3397 .mpo_vnode_check_open = mls_vnode_check_open, 3398 .mpo_vnode_check_poll = mls_vnode_check_poll, 3399 .mpo_vnode_check_read = mls_vnode_check_read, 3400 .mpo_vnode_check_readdir = mls_vnode_check_readdir, 3401 .mpo_vnode_check_readlink = mls_vnode_check_readlink, 3402 .mpo_vnode_check_relabel = mls_vnode_check_relabel, 3403 .mpo_vnode_check_rename_from = mls_vnode_check_rename_from, 3404 .mpo_vnode_check_rename_to = mls_vnode_check_rename_to, 3405 .mpo_vnode_check_revoke = mls_vnode_check_revoke, 3406 .mpo_vnode_check_setacl = mls_vnode_check_setacl, 3407 .mpo_vnode_check_setextattr = mls_vnode_check_setextattr, 3408 .mpo_vnode_check_setflags = mls_vnode_check_setflags, 3409 .mpo_vnode_check_setmode = mls_vnode_check_setmode, 3410 .mpo_vnode_check_setowner = mls_vnode_check_setowner, 3411 .mpo_vnode_check_setutimes = mls_vnode_check_setutimes, 3412 .mpo_vnode_check_stat = mls_vnode_check_stat, 3413 .mpo_vnode_check_unlink = mls_vnode_check_unlink, 3414 .mpo_vnode_check_write = mls_vnode_check_write, 3415 .mpo_vnode_copy_label = mls_copy_label, 3416 .mpo_vnode_create_extattr = mls_vnode_create_extattr, 3417 .mpo_vnode_destroy_label = mls_destroy_label, 3418 .mpo_vnode_externalize_label = mls_externalize_label, 3419 .mpo_vnode_init_label = mls_init_label, 3420 .mpo_vnode_internalize_label = mls_internalize_label, 3421 .mpo_vnode_relabel = mls_vnode_relabel, 3422 .mpo_vnode_setlabel_extattr = mls_vnode_setlabel_extattr, 3423 }; 3424 3425 MAC_POLICY_SET(&mls_ops, mac_mls, "TrustedBSD MAC/MLS", 3426 MPC_LOADTIME_FLAG_NOTLATE, &mls_slot); 3427