1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved. 23 */ 24 25 #include <sys/types.h> 26 #include <sys/sysmacros.h> 27 #include <sys/param.h> 28 #include <sys/systm.h> 29 #include <sys/cred_impl.h> 30 #include <sys/vnode.h> 31 #include <sys/vfs.h> 32 #include <sys/stat.h> 33 #include <sys/errno.h> 34 #include <sys/kmem.h> 35 #include <sys/user.h> 36 #include <sys/proc.h> 37 #include <sys/acct.h> 38 #include <sys/ipc_impl.h> 39 #include <sys/cmn_err.h> 40 #include <sys/debug.h> 41 #include <sys/policy.h> 42 #include <sys/kobj.h> 43 #include <sys/msg.h> 44 #include <sys/devpolicy.h> 45 #include <c2/audit.h> 46 #include <sys/varargs.h> 47 #include <sys/klpd.h> 48 #include <sys/modctl.h> 49 #include <sys/disp.h> 50 #include <sys/zone.h> 51 #include <inet/optcom.h> 52 #include <sys/sdt.h> 53 #include <sys/vfs.h> 54 #include <sys/mntent.h> 55 #include <sys/contract_impl.h> 56 #include <sys/dld_ioc.h> 57 58 /* 59 * There are two possible layers of privilege routines and two possible 60 * levels of secpolicy. Plus one other we may not be interested in, so 61 * we may need as many as 6 but no more. 62 */ 63 #define MAXPRIVSTACK 6 64 65 int priv_debug = 0; 66 int priv_basic_test = -1; 67 68 /* 69 * This file contains the majority of the policy routines. 70 * Since the policy routines are defined by function and not 71 * by privilege, there is quite a bit of duplication of 72 * functions. 73 * 74 * The secpolicy functions must not make assumptions about 75 * locks held or not held as any lock can be held while they're 76 * being called. 77 * 78 * Credentials are read-only so no special precautions need to 79 * be taken while locking them. 80 * 81 * When a new policy check needs to be added to the system the 82 * following procedure should be followed: 83 * 84 * Pick an appropriate secpolicy_*() function 85 * -> done if one exists. 86 * Create a new secpolicy function, preferably with 87 * a descriptive name using the standard template. 88 * Pick an appropriate privilege for the policy. 89 * If no appropraite privilege exists, define new one 90 * (this should be done with extreme care; in most cases 91 * little is gained by adding another privilege) 92 * 93 * WHY ROOT IS STILL SPECIAL. 94 * 95 * In a number of the policy functions, there are still explicit 96 * checks for uid 0. The rationale behind these is that many root 97 * owned files/objects hold configuration information which can give full 98 * privileges to the user once written to. To prevent escalation 99 * of privilege by allowing just a single privilege to modify root owned 100 * objects, we've added these root specific checks where we considered 101 * them necessary: modifying root owned files, changing uids to 0, etc. 102 * 103 * PRIVILEGE ESCALATION AND ZONES. 104 * 105 * A number of operations potentially allow the caller to achieve 106 * privileges beyond the ones normally required to perform the operation. 107 * For example, if allowed to create a setuid 0 executable, a process can 108 * gain privileges beyond PRIV_FILE_SETID. Zones, however, place 109 * restrictions on the ability to gain privileges beyond those available 110 * within the zone through file and process manipulation. Hence, such 111 * operations require that the caller have an effective set that includes 112 * all privileges available within the current zone, or all privileges 113 * if executing in the global zone. 114 * 115 * This is indicated in the priv_policy* policy checking functions 116 * through a combination of parameters. The "priv" parameter indicates 117 * the privilege that is required, and the "allzone" parameter indicates 118 * whether or not all privileges in the zone are required. In addition, 119 * priv can be set to PRIV_ALL to indicate that all privileges are 120 * required (regardless of zone). There are three scenarios of interest: 121 * (1) operation requires a specific privilege 122 * (2) operation requires a specific privilege, and requires all 123 * privileges available within the zone (or all privileges if in 124 * the global zone) 125 * (3) operation requires all privileges, regardless of zone 126 * 127 * For (1), priv should be set to the specific privilege, and allzone 128 * should be set to B_FALSE. 129 * For (2), priv should be set to the specific privilege, and allzone 130 * should be set to B_TRUE. 131 * For (3), priv should be set to PRIV_ALL, and allzone should be set 132 * to B_FALSE. 133 * 134 */ 135 136 /* 137 * The privileges are checked against the Effective set for 138 * ordinary processes and checked against the Limit set 139 * for euid 0 processes that haven't manipulated their privilege 140 * sets. 141 */ 142 #define HAS_ALLPRIVS(cr) priv_isfullset(&CR_OEPRIV(cr)) 143 #define ZONEPRIVS(cr) ((cr)->cr_zone->zone_privset) 144 #define HAS_ALLZONEPRIVS(cr) priv_issubset(ZONEPRIVS(cr), &CR_OEPRIV(cr)) 145 #define HAS_PRIVILEGE(cr, pr) ((pr) == PRIV_ALL ? \ 146 HAS_ALLPRIVS(cr) : \ 147 PRIV_ISASSERT(&CR_OEPRIV(cr), pr)) 148 149 #define FAST_BASIC_CHECK(cr, priv) \ 150 if (PRIV_ISASSERT(&CR_OEPRIV(cr), priv)) { \ 151 DTRACE_PROBE2(priv__ok, int, priv, boolean_t, B_FALSE); \ 152 return (0); \ 153 } 154 155 /* 156 * Policy checking functions. 157 * 158 * All of the system's policy should be implemented here. 159 */ 160 161 /* 162 * Private functions which take an additional va_list argument to 163 * implement an object specific policy override. 164 */ 165 static int priv_policy_ap(const cred_t *, int, boolean_t, int, 166 const char *, va_list); 167 static int priv_policy_va(const cred_t *, int, boolean_t, int, 168 const char *, ...); 169 170 /* 171 * Generic policy calls 172 * 173 * The "bottom" functions of policy control 174 */ 175 static char * 176 mprintf(const char *fmt, ...) 177 { 178 va_list args; 179 char *buf; 180 size_t len; 181 182 va_start(args, fmt); 183 len = vsnprintf(NULL, 0, fmt, args) + 1; 184 va_end(args); 185 186 buf = kmem_alloc(len, KM_NOSLEEP); 187 188 if (buf == NULL) 189 return (NULL); 190 191 va_start(args, fmt); 192 (void) vsnprintf(buf, len, fmt, args); 193 va_end(args); 194 195 return (buf); 196 } 197 198 /* 199 * priv_policy_errmsg() 200 * 201 * Generate an error message if privilege debugging is enabled system wide 202 * or for this particular process. 203 */ 204 205 #define FMTHDR "%s[%d]: missing privilege \"%s\" (euid = %d, syscall = %d)" 206 #define FMTMSG " for \"%s\"" 207 #define FMTFUN " needed at %s+0x%lx" 208 209 /* The maximum size privilege format: the concatenation of the above */ 210 #define FMTMAX FMTHDR FMTMSG FMTFUN "\n" 211 212 static void 213 priv_policy_errmsg(const cred_t *cr, int priv, const char *msg) 214 { 215 struct proc *me; 216 pc_t stack[MAXPRIVSTACK]; 217 int depth; 218 int i; 219 char *sym; 220 ulong_t off; 221 const char *pname; 222 223 char *cmd; 224 char fmt[sizeof (FMTMAX)]; 225 226 if ((me = curproc) == &p0) 227 return; 228 229 /* Privileges must be defined */ 230 ASSERT(priv == PRIV_ALL || priv == PRIV_MULTIPLE || 231 priv == PRIV_ALLZONE || priv == PRIV_GLOBAL || 232 priv_getbynum(priv) != NULL); 233 234 if (priv == PRIV_ALLZONE && INGLOBALZONE(me)) 235 priv = PRIV_ALL; 236 237 if (curthread->t_pre_sys) 238 ttolwp(curthread)->lwp_badpriv = (short)priv; 239 240 if (priv_debug == 0 && (CR_FLAGS(cr) & PRIV_DEBUG) == 0) 241 return; 242 243 (void) strcpy(fmt, FMTHDR); 244 245 if (me->p_user.u_comm[0]) 246 cmd = &me->p_user.u_comm[0]; 247 else 248 cmd = "priv_policy"; 249 250 if (msg != NULL && *msg != '\0') { 251 (void) strcat(fmt, FMTMSG); 252 } else { 253 (void) strcat(fmt, "%s"); 254 msg = ""; 255 } 256 257 sym = NULL; 258 259 depth = getpcstack(stack, MAXPRIVSTACK); 260 261 /* 262 * Try to find the first interesting function on the stack. 263 * priv_policy* that's us, so completely uninteresting. 264 * suser(), drv_priv(), secpolicy_* are also called from 265 * too many locations to convey useful information. 266 */ 267 for (i = 0; i < depth; i++) { 268 sym = kobj_getsymname((uintptr_t)stack[i], &off); 269 if (sym != NULL && 270 strstr(sym, "hasprocperm") == 0 && 271 strcmp("suser", sym) != 0 && 272 strcmp("ipcaccess", sym) != 0 && 273 strcmp("drv_priv", sym) != 0 && 274 strncmp("secpolicy_", sym, 10) != 0 && 275 strncmp("priv_policy", sym, 11) != 0) 276 break; 277 } 278 279 if (sym != NULL) 280 (void) strcat(fmt, FMTFUN); 281 282 (void) strcat(fmt, "\n"); 283 284 switch (priv) { 285 case PRIV_ALL: 286 pname = "ALL"; 287 break; 288 case PRIV_MULTIPLE: 289 pname = "MULTIPLE"; 290 break; 291 case PRIV_ALLZONE: 292 pname = "ZONE"; 293 break; 294 case PRIV_GLOBAL: 295 pname = "GLOBAL"; 296 break; 297 default: 298 pname = priv_getbynum(priv); 299 break; 300 } 301 302 if (CR_FLAGS(cr) & PRIV_DEBUG) { 303 /* Remember last message, just like lwp_badpriv. */ 304 if (curthread->t_pdmsg != NULL) { 305 kmem_free(curthread->t_pdmsg, 306 strlen(curthread->t_pdmsg) + 1); 307 } 308 309 curthread->t_pdmsg = mprintf(fmt, cmd, me->p_pid, pname, 310 cr->cr_uid, curthread->t_sysnum, msg, sym, off); 311 312 curthread->t_post_sys = 1; 313 } 314 if (priv_debug) { 315 cmn_err(CE_NOTE, fmt, cmd, me->p_pid, pname, cr->cr_uid, 316 curthread->t_sysnum, msg, sym, off); 317 } 318 } 319 320 /* 321 * Override the policy, if appropriate. Return 0 if the external 322 * policy engine approves. 323 */ 324 static int 325 priv_policy_override(const cred_t *cr, int priv, boolean_t allzone, va_list ap) 326 { 327 priv_set_t set; 328 int ret; 329 330 if (!(CR_FLAGS(cr) & PRIV_XPOLICY)) 331 return (-1); 332 333 if (priv == PRIV_ALL) { 334 priv_fillset(&set); 335 } else if (allzone) { 336 set = *ZONEPRIVS(cr); 337 } else { 338 priv_emptyset(&set); 339 priv_addset(&set, priv); 340 } 341 ret = klpd_call(cr, &set, ap); 342 return (ret); 343 } 344 345 static int 346 priv_policy_override_set(const cred_t *cr, const priv_set_t *req, va_list ap) 347 { 348 if (CR_FLAGS(cr) & PRIV_PFEXEC) 349 return (check_user_privs(cr, req)); 350 if (CR_FLAGS(cr) & PRIV_XPOLICY) { 351 return (klpd_call(cr, req, ap)); 352 } 353 return (-1); 354 } 355 356 static int 357 priv_policy_override_set_va(const cred_t *cr, const priv_set_t *req, ...) 358 { 359 va_list ap; 360 int ret; 361 362 va_start(ap, req); 363 ret = priv_policy_override_set(cr, req, ap); 364 va_end(ap); 365 return (ret); 366 } 367 368 /* 369 * Audit failure, log error message. 370 */ 371 static void 372 priv_policy_err(const cred_t *cr, int priv, boolean_t allzone, const char *msg) 373 { 374 375 if (AU_AUDITING()) 376 audit_priv(priv, allzone ? ZONEPRIVS(cr) : NULL, 0); 377 DTRACE_PROBE2(priv__err, int, priv, boolean_t, allzone); 378 379 if (priv_debug || (CR_FLAGS(cr) & PRIV_DEBUG) || 380 curthread->t_pre_sys) { 381 if (allzone && !HAS_ALLZONEPRIVS(cr)) { 382 priv_policy_errmsg(cr, PRIV_ALLZONE, msg); 383 } else { 384 ASSERT(!HAS_PRIVILEGE(cr, priv)); 385 priv_policy_errmsg(cr, priv, msg); 386 } 387 } 388 } 389 390 /* 391 * priv_policy_ap() 392 * return 0 or error. 393 * See block comment above for a description of "priv" and "allzone" usage. 394 */ 395 static int 396 priv_policy_ap(const cred_t *cr, int priv, boolean_t allzone, int err, 397 const char *msg, va_list ap) 398 { 399 if ((HAS_PRIVILEGE(cr, priv) && (!allzone || HAS_ALLZONEPRIVS(cr))) || 400 (!servicing_interrupt() && 401 priv_policy_override(cr, priv, allzone, ap) == 0)) { 402 if ((allzone || priv == PRIV_ALL || 403 !PRIV_ISASSERT(priv_basic, priv)) && 404 !servicing_interrupt()) { 405 PTOU(curproc)->u_acflag |= ASU; /* Needed for SVVS */ 406 if (AU_AUDITING()) 407 audit_priv(priv, 408 allzone ? ZONEPRIVS(cr) : NULL, 1); 409 } 410 err = 0; 411 DTRACE_PROBE2(priv__ok, int, priv, boolean_t, allzone); 412 } else if (!servicing_interrupt()) { 413 /* Failure audited in this procedure */ 414 priv_policy_err(cr, priv, allzone, msg); 415 } 416 return (err); 417 } 418 419 int 420 priv_policy_va(const cred_t *cr, int priv, boolean_t allzone, int err, 421 const char *msg, ...) 422 { 423 int ret; 424 va_list ap; 425 426 va_start(ap, msg); 427 ret = priv_policy_ap(cr, priv, allzone, err, msg, ap); 428 va_end(ap); 429 430 return (ret); 431 } 432 433 int 434 priv_policy(const cred_t *cr, int priv, boolean_t allzone, int err, 435 const char *msg) 436 { 437 return (priv_policy_va(cr, priv, allzone, err, msg, KLPDARG_NONE)); 438 } 439 440 /* 441 * Return B_TRUE for sufficient privileges, B_FALSE for insufficient privileges. 442 */ 443 boolean_t 444 priv_policy_choice(const cred_t *cr, int priv, boolean_t allzone) 445 { 446 boolean_t res = HAS_PRIVILEGE(cr, priv) && 447 (!allzone || HAS_ALLZONEPRIVS(cr)); 448 449 /* Audit success only */ 450 if (res && AU_AUDITING() && 451 (allzone || priv == PRIV_ALL || !PRIV_ISASSERT(priv_basic, priv)) && 452 !servicing_interrupt()) { 453 audit_priv(priv, allzone ? ZONEPRIVS(cr) : NULL, 1); 454 } 455 if (res) { 456 DTRACE_PROBE2(priv__ok, int, priv, boolean_t, allzone); 457 } else { 458 DTRACE_PROBE2(priv__err, int, priv, boolean_t, allzone); 459 } 460 return (res); 461 } 462 463 /* 464 * Non-auditing variant of priv_policy_choice(). 465 */ 466 boolean_t 467 priv_policy_only(const cred_t *cr, int priv, boolean_t allzone) 468 { 469 boolean_t res = HAS_PRIVILEGE(cr, priv) && 470 (!allzone || HAS_ALLZONEPRIVS(cr)); 471 472 if (res) { 473 DTRACE_PROBE2(priv__ok, int, priv, boolean_t, allzone); 474 } else { 475 DTRACE_PROBE2(priv__err, int, priv, boolean_t, allzone); 476 } 477 return (res); 478 } 479 480 /* 481 * Check whether all privileges in the required set are present. 482 */ 483 static int 484 secpolicy_require_set(const cred_t *cr, const priv_set_t *req, 485 const char *msg, ...) 486 { 487 int priv; 488 int pfound = -1; 489 priv_set_t pset; 490 va_list ap; 491 int ret; 492 493 if (req == PRIV_FULLSET ? HAS_ALLPRIVS(cr) : priv_issubset(req, 494 &CR_OEPRIV(cr))) { 495 return (0); 496 } 497 498 va_start(ap, msg); 499 ret = priv_policy_override_set(cr, req, ap); 500 va_end(ap); 501 if (ret == 0) 502 return (0); 503 504 if (req == PRIV_FULLSET || priv_isfullset(req)) { 505 priv_policy_err(cr, PRIV_ALL, B_FALSE, msg); 506 return (EACCES); 507 } 508 509 pset = CR_OEPRIV(cr); /* present privileges */ 510 priv_inverse(&pset); /* all non present privileges */ 511 priv_intersect(req, &pset); /* the actual missing privs */ 512 513 if (AU_AUDITING()) 514 audit_priv(PRIV_NONE, &pset, 0); 515 /* 516 * Privilege debugging; special case "one privilege in set". 517 */ 518 if (priv_debug || (CR_FLAGS(cr) & PRIV_DEBUG) || curthread->t_pre_sys) { 519 for (priv = 0; priv < nprivs; priv++) { 520 if (priv_ismember(&pset, priv)) { 521 if (pfound != -1) { 522 /* Multiple missing privs */ 523 priv_policy_errmsg(cr, PRIV_MULTIPLE, 524 msg); 525 return (EACCES); 526 } 527 pfound = priv; 528 } 529 } 530 ASSERT(pfound != -1); 531 /* Just the one missing privilege */ 532 priv_policy_errmsg(cr, pfound, msg); 533 } 534 535 return (EACCES); 536 } 537 538 /* 539 * Called when an operation requires that the caller be in the 540 * global zone, regardless of privilege. 541 */ 542 static int 543 priv_policy_global(const cred_t *cr) 544 { 545 if (crgetzoneid(cr) == GLOBAL_ZONEID) 546 return (0); /* success */ 547 548 if (priv_debug || (CR_FLAGS(cr) & PRIV_DEBUG) || 549 curthread->t_pre_sys) { 550 priv_policy_errmsg(cr, PRIV_GLOBAL, NULL); 551 } 552 return (EPERM); 553 } 554 555 /* 556 * Changing process priority 557 */ 558 int 559 secpolicy_setpriority(const cred_t *cr) 560 { 561 return (PRIV_POLICY(cr, PRIV_PROC_PRIOCNTL, B_FALSE, EPERM, NULL)); 562 } 563 564 /* 565 * Binding to a privileged port, port must be specified in host byte 566 * order. 567 * When adding a new privilege which allows binding to currently privileged 568 * ports, then you MUST also allow processes with PRIV_NET_PRIVADDR bind 569 * to these ports because of backward compatibility. 570 */ 571 int 572 secpolicy_net_privaddr(const cred_t *cr, in_port_t port, int proto) 573 { 574 char *reason; 575 int priv; 576 577 switch (port) { 578 case 137: 579 case 138: 580 case 139: 581 case 445: 582 /* 583 * NBT and SMB ports, these are normal privileged ports, 584 * allow bind only if the SYS_SMB or NET_PRIVADDR privilege 585 * is present. 586 * Try both, if neither is present return an error for 587 * priv SYS_SMB. 588 */ 589 if (PRIV_POLICY_ONLY(cr, PRIV_NET_PRIVADDR, B_FALSE)) 590 priv = PRIV_NET_PRIVADDR; 591 else 592 priv = PRIV_SYS_SMB; 593 reason = "NBT or SMB port"; 594 break; 595 596 case 2049: 597 case 4045: 598 /* 599 * NFS ports, these are extra privileged ports, allow bind 600 * only if the SYS_NFS privilege is present. 601 */ 602 priv = PRIV_SYS_NFS; 603 reason = "NFS port"; 604 break; 605 606 default: 607 priv = PRIV_NET_PRIVADDR; 608 reason = NULL; 609 break; 610 611 } 612 613 return (priv_policy_va(cr, priv, B_FALSE, EACCES, reason, 614 KLPDARG_PORT, (int)proto, (int)port, KLPDARG_NOMORE)); 615 } 616 617 /* 618 * Binding to a multilevel port on a trusted (labeled) system. 619 */ 620 int 621 secpolicy_net_bindmlp(const cred_t *cr) 622 { 623 return (PRIV_POLICY(cr, PRIV_NET_BINDMLP, B_FALSE, EACCES, NULL)); 624 } 625 626 /* 627 * Allow a communication between a zone and an unlabeled host when their 628 * labels don't match. 629 */ 630 int 631 secpolicy_net_mac_aware(const cred_t *cr) 632 { 633 return (PRIV_POLICY(cr, PRIV_NET_MAC_AWARE, B_FALSE, EACCES, NULL)); 634 } 635 636 /* 637 * Allow a privileged process to transmit traffic without explicit labels 638 */ 639 int 640 secpolicy_net_mac_implicit(const cred_t *cr) 641 { 642 return (PRIV_POLICY(cr, PRIV_NET_MAC_IMPLICIT, B_FALSE, EACCES, NULL)); 643 } 644 645 /* 646 * Common routine which determines whether a given credential can 647 * act on a given mount. 648 * When called through mount, the parameter needoptcheck is a pointer 649 * to a boolean variable which will be set to either true or false, 650 * depending on whether the mount policy should change the mount options. 651 * In all other cases, needoptcheck should be a NULL pointer. 652 */ 653 static int 654 secpolicy_fs_common(cred_t *cr, vnode_t *mvp, const vfs_t *vfsp, 655 boolean_t *needoptcheck) 656 { 657 boolean_t allzone = B_FALSE; 658 boolean_t mounting = needoptcheck != NULL; 659 660 /* 661 * Short circuit the following cases: 662 * vfsp == NULL or mvp == NULL (pure privilege check) 663 * have all privileges - no further checks required 664 * and no mount options need to be set. 665 */ 666 if (vfsp == NULL || mvp == NULL || HAS_ALLPRIVS(cr)) { 667 if (mounting) 668 *needoptcheck = B_FALSE; 669 670 return (priv_policy_va(cr, PRIV_SYS_MOUNT, allzone, EPERM, 671 NULL, KLPDARG_VNODE, mvp, (char *)NULL, KLPDARG_NOMORE)); 672 } 673 674 /* 675 * When operating on an existing mount (either we're not mounting 676 * or we're doing a remount and VFS_REMOUNT will be set), zones 677 * can operate only on mounts established by the zone itself. 678 */ 679 if (!mounting || (vfsp->vfs_flag & VFS_REMOUNT) != 0) { 680 zoneid_t zoneid = crgetzoneid(cr); 681 682 if (zoneid != GLOBAL_ZONEID && 683 vfsp->vfs_zone->zone_id != zoneid) { 684 return (EPERM); 685 } 686 } 687 688 if (mounting) 689 *needoptcheck = B_TRUE; 690 691 /* 692 * Overlay mounts may hide important stuff; if you can't write to a 693 * mount point but would be able to mount on top of it, you can 694 * escalate your privileges. 695 * So we go about asking the same questions namefs does when it 696 * decides whether you can mount over a file or not but with the 697 * added restriction that you can only mount on top of a regular 698 * file or directory. 699 * If we have all the zone's privileges, we skip all other checks, 700 * or else we may actually get in trouble inside the automounter. 701 */ 702 if ((mvp->v_flag & VROOT) != 0 || 703 (mvp->v_type != VDIR && mvp->v_type != VREG) || 704 HAS_ALLZONEPRIVS(cr)) { 705 allzone = B_TRUE; 706 } else { 707 vattr_t va; 708 int err; 709 710 va.va_mask = AT_UID|AT_MODE; 711 err = VOP_GETATTR(mvp, &va, 0, cr, NULL); 712 if (err != 0) 713 return (err); 714 715 if ((err = secpolicy_vnode_owner(cr, va.va_uid)) != 0) 716 return (err); 717 718 if (secpolicy_vnode_access2(cr, mvp, va.va_uid, va.va_mode, 719 VWRITE) != 0) { 720 return (EACCES); 721 } 722 } 723 return (priv_policy_va(cr, PRIV_SYS_MOUNT, allzone, EPERM, 724 NULL, KLPDARG_VNODE, mvp, (char *)NULL, KLPDARG_NOMORE)); 725 } 726 727 void 728 secpolicy_fs_mount_clearopts(cred_t *cr, struct vfs *vfsp) 729 { 730 boolean_t amsuper = HAS_ALLZONEPRIVS(cr); 731 732 /* 733 * check; if we don't have either "nosuid" or 734 * both "nosetuid" and "nodevices", then we add 735 * "nosuid"; this depends on how the current 736 * implementation works (it first checks nosuid). In a 737 * zone, a user with all zone privileges can mount with 738 * "setuid" but never with "devices". 739 */ 740 if (!vfs_optionisset(vfsp, MNTOPT_NOSUID, NULL) && 741 (!vfs_optionisset(vfsp, MNTOPT_NODEVICES, NULL) || 742 !vfs_optionisset(vfsp, MNTOPT_NOSETUID, NULL))) { 743 if (crgetzoneid(cr) == GLOBAL_ZONEID || !amsuper) 744 vfs_setmntopt(vfsp, MNTOPT_NOSUID, NULL, 0); 745 else 746 vfs_setmntopt(vfsp, MNTOPT_NODEVICES, NULL, 0); 747 } 748 /* 749 * If we're not the local super user, we set the "restrict" 750 * option to indicate to automountd that this mount should 751 * be handled with care. 752 */ 753 if (!amsuper) 754 vfs_setmntopt(vfsp, MNTOPT_RESTRICT, NULL, 0); 755 756 } 757 758 extern vnode_t *rootvp; 759 extern vfs_t *rootvfs; 760 761 int 762 secpolicy_fs_mount(cred_t *cr, vnode_t *mvp, struct vfs *vfsp) 763 { 764 boolean_t needoptchk; 765 int error; 766 767 /* 768 * If it's a remount, get the underlying mount point, 769 * except for the root where we use the rootvp. 770 */ 771 if ((vfsp->vfs_flag & VFS_REMOUNT) != 0) { 772 if (vfsp == rootvfs) 773 mvp = rootvp; 774 else 775 mvp = vfsp->vfs_vnodecovered; 776 } 777 778 error = secpolicy_fs_common(cr, mvp, vfsp, &needoptchk); 779 780 if (error == 0 && needoptchk) { 781 secpolicy_fs_mount_clearopts(cr, vfsp); 782 } 783 784 return (error); 785 } 786 787 /* 788 * Does the policy computations for "ownership" of a mount; 789 * here ownership is defined as the ability to "mount" 790 * the filesystem originally. The rootvfs doesn't cover any 791 * vnodes; we attribute its ownership to the rootvp. 792 */ 793 static int 794 secpolicy_fs_owner(cred_t *cr, const struct vfs *vfsp) 795 { 796 vnode_t *mvp; 797 798 if (vfsp == NULL) 799 mvp = NULL; 800 else if (vfsp == rootvfs) 801 mvp = rootvp; 802 else 803 mvp = vfsp->vfs_vnodecovered; 804 805 return (secpolicy_fs_common(cr, mvp, vfsp, NULL)); 806 } 807 808 int 809 secpolicy_fs_unmount(cred_t *cr, struct vfs *vfsp) 810 { 811 return (secpolicy_fs_owner(cr, vfsp)); 812 } 813 814 /* 815 * Quotas are a resource, but if one has the ability to mount a filesystem, he 816 * should be able to modify quotas on it. 817 */ 818 int 819 secpolicy_fs_quota(const cred_t *cr, const vfs_t *vfsp) 820 { 821 return (secpolicy_fs_owner((cred_t *)cr, vfsp)); 822 } 823 824 /* 825 * Exceeding minfree: also a per-mount resource constraint. 826 */ 827 int 828 secpolicy_fs_minfree(const cred_t *cr, const vfs_t *vfsp) 829 { 830 return (secpolicy_fs_owner((cred_t *)cr, vfsp)); 831 } 832 833 int 834 secpolicy_fs_config(const cred_t *cr, const vfs_t *vfsp) 835 { 836 return (secpolicy_fs_owner((cred_t *)cr, vfsp)); 837 } 838 839 /* ARGSUSED */ 840 int 841 secpolicy_fs_linkdir(const cred_t *cr, const vfs_t *vfsp) 842 { 843 return (PRIV_POLICY(cr, PRIV_SYS_LINKDIR, B_FALSE, EPERM, NULL)); 844 } 845 846 /* 847 * Name: secpolicy_vnode_access() 848 * 849 * Parameters: Process credential 850 * vnode 851 * uid of owner of vnode 852 * permission bits not granted to the caller when examining 853 * file mode bits (i.e., when a process wants to open a 854 * mode 444 file for VREAD|VWRITE, this function should be 855 * called only with a VWRITE argument). 856 * 857 * Normal: Verifies that cred has the appropriate privileges to 858 * override the mode bits that were denied. 859 * 860 * Override: file_dac_execute - if VEXEC bit was denied and vnode is 861 * not a directory. 862 * file_dac_read - if VREAD bit was denied. 863 * file_dac_search - if VEXEC bit was denied and vnode is 864 * a directory. 865 * file_dac_write - if VWRITE bit was denied. 866 * 867 * Root owned files are special cased to protect system 868 * configuration files and such. 869 * 870 * Output: EACCES - if privilege check fails. 871 */ 872 873 int 874 secpolicy_vnode_access(const cred_t *cr, vnode_t *vp, uid_t owner, mode_t mode) 875 { 876 if ((mode & VREAD) && priv_policy_va(cr, PRIV_FILE_DAC_READ, B_FALSE, 877 EACCES, NULL, KLPDARG_VNODE, vp, (char *)NULL, 878 KLPDARG_NOMORE) != 0) { 879 return (EACCES); 880 } 881 882 if (mode & VWRITE) { 883 boolean_t allzone; 884 885 if (owner == 0 && cr->cr_uid != 0) 886 allzone = B_TRUE; 887 else 888 allzone = B_FALSE; 889 if (priv_policy_va(cr, PRIV_FILE_DAC_WRITE, allzone, EACCES, 890 NULL, KLPDARG_VNODE, vp, (char *)NULL, 891 KLPDARG_NOMORE) != 0) { 892 return (EACCES); 893 } 894 } 895 896 if (mode & VEXEC) { 897 /* 898 * Directories use file_dac_search to override the execute bit. 899 */ 900 int p = vp->v_type == VDIR ? PRIV_FILE_DAC_SEARCH : 901 PRIV_FILE_DAC_EXECUTE; 902 903 return (priv_policy_va(cr, p, B_FALSE, EACCES, NULL, 904 KLPDARG_VNODE, vp, (char *)NULL, KLPDARG_NOMORE)); 905 } 906 return (0); 907 } 908 909 /* 910 * Like secpolicy_vnode_access() but we get the actual wanted mode and the 911 * current mode of the file, not the missing bits. 912 */ 913 int 914 secpolicy_vnode_access2(const cred_t *cr, vnode_t *vp, uid_t owner, 915 mode_t curmode, mode_t wantmode) 916 { 917 mode_t mode; 918 919 /* Inline the basic privileges tests. */ 920 if ((wantmode & VREAD) && 921 !PRIV_ISASSERT(&CR_OEPRIV(cr), PRIV_FILE_READ) && 922 priv_policy_va(cr, PRIV_FILE_READ, B_FALSE, EACCES, NULL, 923 KLPDARG_VNODE, vp, (char *)NULL, KLPDARG_NOMORE) != 0) { 924 return (EACCES); 925 } 926 927 if ((wantmode & VWRITE) && 928 !PRIV_ISASSERT(&CR_OEPRIV(cr), PRIV_FILE_WRITE) && 929 priv_policy_va(cr, PRIV_FILE_WRITE, B_FALSE, EACCES, NULL, 930 KLPDARG_VNODE, vp, (char *)NULL, KLPDARG_NOMORE) != 0) { 931 return (EACCES); 932 } 933 934 mode = ~curmode & wantmode; 935 936 if (mode == 0) 937 return (0); 938 939 if ((mode & VREAD) && priv_policy_va(cr, PRIV_FILE_DAC_READ, B_FALSE, 940 EACCES, NULL, KLPDARG_VNODE, vp, (char *)NULL, 941 KLPDARG_NOMORE) != 0) { 942 return (EACCES); 943 } 944 945 if (mode & VWRITE) { 946 boolean_t allzone; 947 948 if (owner == 0 && cr->cr_uid != 0) 949 allzone = B_TRUE; 950 else 951 allzone = B_FALSE; 952 if (priv_policy_va(cr, PRIV_FILE_DAC_WRITE, allzone, EACCES, 953 NULL, KLPDARG_VNODE, vp, (char *)NULL, 954 KLPDARG_NOMORE) != 0) { 955 return (EACCES); 956 } 957 } 958 959 if (mode & VEXEC) { 960 /* 961 * Directories use file_dac_search to override the execute bit. 962 */ 963 int p = vp->v_type == VDIR ? PRIV_FILE_DAC_SEARCH : 964 PRIV_FILE_DAC_EXECUTE; 965 966 return (priv_policy_va(cr, p, B_FALSE, EACCES, NULL, 967 KLPDARG_VNODE, vp, (char *)NULL, KLPDARG_NOMORE)); 968 } 969 return (0); 970 } 971 972 /* 973 * This is a special routine for ZFS; it is used to determine whether 974 * any of the privileges in effect allow any form of access to the 975 * file. There's no reason to audit this or any reason to record 976 * this. More work is needed to do the "KPLD" stuff. 977 */ 978 int 979 secpolicy_vnode_any_access(const cred_t *cr, vnode_t *vp, uid_t owner) 980 { 981 static int privs[] = { 982 PRIV_FILE_OWNER, 983 PRIV_FILE_CHOWN, 984 PRIV_FILE_DAC_READ, 985 PRIV_FILE_DAC_WRITE, 986 PRIV_FILE_DAC_EXECUTE, 987 PRIV_FILE_DAC_SEARCH, 988 }; 989 int i; 990 991 /* Same as secpolicy_vnode_setdac */ 992 if (owner == cr->cr_uid) 993 return (0); 994 995 for (i = 0; i < sizeof (privs)/sizeof (int); i++) { 996 boolean_t allzone = B_FALSE; 997 int priv; 998 999 switch (priv = privs[i]) { 1000 case PRIV_FILE_DAC_EXECUTE: 1001 if (vp->v_type == VDIR) 1002 continue; 1003 break; 1004 case PRIV_FILE_DAC_SEARCH: 1005 if (vp->v_type != VDIR) 1006 continue; 1007 break; 1008 case PRIV_FILE_DAC_WRITE: 1009 case PRIV_FILE_OWNER: 1010 case PRIV_FILE_CHOWN: 1011 /* We know here that if owner == 0, that cr_uid != 0 */ 1012 allzone = owner == 0; 1013 break; 1014 } 1015 if (PRIV_POLICY_CHOICE(cr, priv, allzone)) 1016 return (0); 1017 } 1018 return (EPERM); 1019 } 1020 1021 /* 1022 * Name: secpolicy_vnode_setid_modify() 1023 * 1024 * Normal: verify that subject can set the file setid flags. 1025 * 1026 * Output: EPERM - if not privileged. 1027 */ 1028 1029 static int 1030 secpolicy_vnode_setid_modify(const cred_t *cr, uid_t owner) 1031 { 1032 /* If changing to suid root, must have all zone privs */ 1033 boolean_t allzone = B_TRUE; 1034 1035 if (owner != 0) { 1036 if (owner == cr->cr_uid) 1037 return (0); 1038 allzone = B_FALSE; 1039 } 1040 return (PRIV_POLICY(cr, PRIV_FILE_SETID, allzone, EPERM, NULL)); 1041 } 1042 1043 /* 1044 * Are we allowed to retain the set-uid/set-gid bits when 1045 * changing ownership or when writing to a file? 1046 * "issuid" should be true when set-uid; only in that case 1047 * root ownership is checked (setgid is assumed). 1048 */ 1049 int 1050 secpolicy_vnode_setid_retain(const cred_t *cred, boolean_t issuidroot) 1051 { 1052 if (issuidroot && !HAS_ALLZONEPRIVS(cred)) 1053 return (EPERM); 1054 1055 return (!PRIV_POLICY_CHOICE(cred, PRIV_FILE_SETID, B_FALSE)); 1056 } 1057 1058 /* 1059 * Name: secpolicy_vnode_setids_setgids() 1060 * 1061 * Normal: verify that subject can set the file setgid flag. 1062 * 1063 * Output: EPERM - if not privileged 1064 */ 1065 1066 int 1067 secpolicy_vnode_setids_setgids(const cred_t *cred, gid_t gid) 1068 { 1069 if (!groupmember(gid, cred)) 1070 return (PRIV_POLICY(cred, PRIV_FILE_SETID, B_FALSE, EPERM, 1071 NULL)); 1072 return (0); 1073 } 1074 1075 /* 1076 * Name: secpolicy_vnode_chown 1077 * 1078 * Normal: Determine if subject can chown owner of a file. 1079 * 1080 * Output: EPERM - if access denied 1081 */ 1082 1083 int 1084 secpolicy_vnode_chown(const cred_t *cred, uid_t owner) 1085 { 1086 boolean_t is_owner = (owner == crgetuid(cred)); 1087 boolean_t allzone = B_FALSE; 1088 int priv; 1089 1090 if (!is_owner) { 1091 allzone = (owner == 0); 1092 priv = PRIV_FILE_CHOWN; 1093 } else { 1094 priv = HAS_PRIVILEGE(cred, PRIV_FILE_CHOWN) ? 1095 PRIV_FILE_CHOWN : PRIV_FILE_CHOWN_SELF; 1096 } 1097 1098 return (PRIV_POLICY(cred, priv, allzone, EPERM, NULL)); 1099 } 1100 1101 /* 1102 * Name: secpolicy_vnode_create_gid 1103 * 1104 * Normal: Determine if subject can change group ownership of a file. 1105 * 1106 * Output: EPERM - if access denied 1107 */ 1108 int 1109 secpolicy_vnode_create_gid(const cred_t *cred) 1110 { 1111 if (HAS_PRIVILEGE(cred, PRIV_FILE_CHOWN)) 1112 return (PRIV_POLICY(cred, PRIV_FILE_CHOWN, B_FALSE, EPERM, 1113 NULL)); 1114 else 1115 return (PRIV_POLICY(cred, PRIV_FILE_CHOWN_SELF, B_FALSE, EPERM, 1116 NULL)); 1117 } 1118 1119 /* 1120 * Name: secpolicy_vnode_utime_modify() 1121 * 1122 * Normal: verify that subject can modify the utime on a file. 1123 * 1124 * Output: EPERM - if access denied. 1125 */ 1126 1127 static int 1128 secpolicy_vnode_utime_modify(const cred_t *cred) 1129 { 1130 return (PRIV_POLICY(cred, PRIV_FILE_OWNER, B_FALSE, EPERM, 1131 "modify file times")); 1132 } 1133 1134 1135 /* 1136 * Name: secpolicy_vnode_setdac() 1137 * 1138 * Normal: verify that subject can modify the mode of a file. 1139 * allzone privilege needed when modifying root owned object. 1140 * 1141 * Output: EPERM - if access denied. 1142 */ 1143 1144 int 1145 secpolicy_vnode_setdac(const cred_t *cred, uid_t owner) 1146 { 1147 if (owner == cred->cr_uid) 1148 return (0); 1149 1150 return (PRIV_POLICY(cred, PRIV_FILE_OWNER, owner == 0, EPERM, NULL)); 1151 } 1152 /* 1153 * Name: secpolicy_vnode_stky_modify() 1154 * 1155 * Normal: verify that subject can make a file a "sticky". 1156 * 1157 * Output: EPERM - if access denied. 1158 */ 1159 1160 int 1161 secpolicy_vnode_stky_modify(const cred_t *cred) 1162 { 1163 return (PRIV_POLICY(cred, PRIV_SYS_CONFIG, B_FALSE, EPERM, 1164 "set file sticky")); 1165 } 1166 1167 /* 1168 * Policy determines whether we can remove an entry from a directory, 1169 * regardless of permission bits. 1170 */ 1171 int 1172 secpolicy_vnode_remove(const cred_t *cr) 1173 { 1174 return (PRIV_POLICY(cr, PRIV_FILE_OWNER, B_FALSE, EACCES, 1175 "sticky directory")); 1176 } 1177 1178 int 1179 secpolicy_vnode_owner(const cred_t *cr, uid_t owner) 1180 { 1181 boolean_t allzone = (owner == 0); 1182 1183 if (owner == cr->cr_uid) 1184 return (0); 1185 1186 return (PRIV_POLICY(cr, PRIV_FILE_OWNER, allzone, EPERM, NULL)); 1187 } 1188 1189 void 1190 secpolicy_setid_clear(vattr_t *vap, cred_t *cr) 1191 { 1192 if ((vap->va_mode & (S_ISUID | S_ISGID)) != 0 && 1193 secpolicy_vnode_setid_retain(cr, 1194 (vap->va_mode & S_ISUID) != 0 && 1195 (vap->va_mask & AT_UID) != 0 && vap->va_uid == 0) != 0) { 1196 vap->va_mask |= AT_MODE; 1197 vap->va_mode &= ~(S_ISUID|S_ISGID); 1198 } 1199 } 1200 1201 int 1202 secpolicy_setid_setsticky_clear(vnode_t *vp, vattr_t *vap, const vattr_t *ovap, 1203 cred_t *cr) 1204 { 1205 int error; 1206 1207 if ((vap->va_mode & S_ISUID) != 0 && 1208 (error = secpolicy_vnode_setid_modify(cr, 1209 ovap->va_uid)) != 0) { 1210 return (error); 1211 } 1212 1213 /* 1214 * Check privilege if attempting to set the 1215 * sticky bit on a non-directory. 1216 */ 1217 if (vp->v_type != VDIR && (vap->va_mode & S_ISVTX) != 0 && 1218 secpolicy_vnode_stky_modify(cr) != 0) { 1219 vap->va_mode &= ~S_ISVTX; 1220 } 1221 1222 /* 1223 * Check for privilege if attempting to set the 1224 * group-id bit. 1225 */ 1226 if ((vap->va_mode & S_ISGID) != 0 && 1227 secpolicy_vnode_setids_setgids(cr, ovap->va_gid) != 0) { 1228 vap->va_mode &= ~S_ISGID; 1229 } 1230 1231 return (0); 1232 } 1233 1234 #define ATTR_FLAG_PRIV(attr, value, cr) \ 1235 PRIV_POLICY(cr, value ? PRIV_FILE_FLAG_SET : PRIV_ALL, \ 1236 B_FALSE, EPERM, NULL) 1237 1238 /* 1239 * Check privileges for setting xvattr attributes 1240 */ 1241 int 1242 secpolicy_xvattr(xvattr_t *xvap, uid_t owner, cred_t *cr, vtype_t vtype) 1243 { 1244 xoptattr_t *xoap; 1245 int error = 0; 1246 1247 if ((xoap = xva_getxoptattr(xvap)) == NULL) 1248 return (EINVAL); 1249 1250 /* 1251 * First process the DOS bits 1252 */ 1253 if (XVA_ISSET_REQ(xvap, XAT_ARCHIVE) || 1254 XVA_ISSET_REQ(xvap, XAT_HIDDEN) || 1255 XVA_ISSET_REQ(xvap, XAT_READONLY) || 1256 XVA_ISSET_REQ(xvap, XAT_SYSTEM) || 1257 XVA_ISSET_REQ(xvap, XAT_CREATETIME)) { 1258 if ((error = secpolicy_vnode_owner(cr, owner)) != 0) 1259 return (error); 1260 } 1261 1262 /* 1263 * Now handle special attributes 1264 */ 1265 1266 if (XVA_ISSET_REQ(xvap, XAT_IMMUTABLE)) 1267 error = ATTR_FLAG_PRIV(XAT_IMMUTABLE, 1268 xoap->xoa_immutable, cr); 1269 if (error == 0 && XVA_ISSET_REQ(xvap, XAT_NOUNLINK)) 1270 error = ATTR_FLAG_PRIV(XAT_NOUNLINK, 1271 xoap->xoa_nounlink, cr); 1272 if (error == 0 && XVA_ISSET_REQ(xvap, XAT_APPENDONLY)) 1273 error = ATTR_FLAG_PRIV(XAT_APPENDONLY, 1274 xoap->xoa_appendonly, cr); 1275 if (error == 0 && XVA_ISSET_REQ(xvap, XAT_NODUMP)) 1276 error = ATTR_FLAG_PRIV(XAT_NODUMP, 1277 xoap->xoa_nodump, cr); 1278 if (error == 0 && XVA_ISSET_REQ(xvap, XAT_OPAQUE)) 1279 error = EPERM; 1280 if (error == 0 && XVA_ISSET_REQ(xvap, XAT_AV_QUARANTINED)) { 1281 error = ATTR_FLAG_PRIV(XAT_AV_QUARANTINED, 1282 xoap->xoa_av_quarantined, cr); 1283 if (error == 0 && vtype != VREG && xoap->xoa_av_quarantined) 1284 error = EINVAL; 1285 } 1286 if (error == 0 && XVA_ISSET_REQ(xvap, XAT_AV_MODIFIED)) 1287 error = ATTR_FLAG_PRIV(XAT_AV_MODIFIED, 1288 xoap->xoa_av_modified, cr); 1289 if (error == 0 && XVA_ISSET_REQ(xvap, XAT_AV_SCANSTAMP)) { 1290 error = ATTR_FLAG_PRIV(XAT_AV_SCANSTAMP, 1291 xoap->xoa_av_scanstamp, cr); 1292 if (error == 0 && vtype != VREG) 1293 error = EINVAL; 1294 } 1295 return (error); 1296 } 1297 1298 /* 1299 * This function checks the policy decisions surrounding the 1300 * vop setattr call. 1301 * 1302 * It should be called after sufficient locks have been established 1303 * on the underlying data structures. No concurrent modifications 1304 * should be allowed. 1305 * 1306 * The caller must pass in unlocked version of its vaccess function 1307 * this is required because vop_access function should lock the 1308 * node for reading. A three argument function should be defined 1309 * which accepts the following argument: 1310 * A pointer to the internal "node" type (inode *) 1311 * vnode access bits (VREAD|VWRITE|VEXEC) 1312 * a pointer to the credential 1313 * 1314 * This function makes the following policy decisions: 1315 * 1316 * - change permissions 1317 * - permission to change file mode if not owner 1318 * - permission to add sticky bit to non-directory 1319 * - permission to add set-gid bit 1320 * 1321 * The ovap argument should include AT_MODE|AT_UID|AT_GID. 1322 * 1323 * If the vap argument does not include AT_MODE, the mode will be copied from 1324 * ovap. In certain situations set-uid/set-gid bits need to be removed; 1325 * this is done by marking vap->va_mask to include AT_MODE and va_mode 1326 * is updated to the newly computed mode. 1327 */ 1328 1329 int 1330 secpolicy_vnode_setattr(cred_t *cr, struct vnode *vp, struct vattr *vap, 1331 const struct vattr *ovap, int flags, 1332 int unlocked_access(void *, int, cred_t *), 1333 void *node) 1334 { 1335 int mask = vap->va_mask; 1336 int error = 0; 1337 boolean_t skipaclchk = (flags & ATTR_NOACLCHECK) ? B_TRUE : B_FALSE; 1338 1339 if (mask & AT_SIZE) { 1340 if (vp->v_type == VDIR) { 1341 error = EISDIR; 1342 goto out; 1343 } 1344 1345 /* 1346 * If ATTR_NOACLCHECK is set in the flags, then we don't 1347 * perform the secondary unlocked_access() call since the 1348 * ACL (if any) is being checked there. 1349 */ 1350 if (skipaclchk == B_FALSE) { 1351 error = unlocked_access(node, VWRITE, cr); 1352 if (error) 1353 goto out; 1354 } 1355 } 1356 if (mask & AT_MODE) { 1357 /* 1358 * If not the owner of the file then check privilege 1359 * for two things: the privilege to set the mode at all 1360 * and, if we're setting setuid, we also need permissions 1361 * to add the set-uid bit, if we're not the owner. 1362 * In the specific case of creating a set-uid root 1363 * file, we need even more permissions. 1364 */ 1365 if ((error = secpolicy_vnode_setdac(cr, ovap->va_uid)) != 0) 1366 goto out; 1367 1368 if ((error = secpolicy_setid_setsticky_clear(vp, vap, 1369 ovap, cr)) != 0) 1370 goto out; 1371 } else 1372 vap->va_mode = ovap->va_mode; 1373 1374 if (mask & (AT_UID|AT_GID)) { 1375 boolean_t checkpriv = B_FALSE; 1376 1377 /* 1378 * Chowning files. 1379 * 1380 * If you are the file owner: 1381 * chown to other uid FILE_CHOWN_SELF 1382 * chown to gid (non-member) FILE_CHOWN_SELF 1383 * chown to gid (member) <none> 1384 * 1385 * Instead of PRIV_FILE_CHOWN_SELF, FILE_CHOWN is also 1386 * acceptable but the first one is reported when debugging. 1387 * 1388 * If you are not the file owner: 1389 * chown from root PRIV_FILE_CHOWN + zone 1390 * chown from other to any PRIV_FILE_CHOWN 1391 * 1392 */ 1393 if (cr->cr_uid != ovap->va_uid) { 1394 checkpriv = B_TRUE; 1395 } else { 1396 if (((mask & AT_UID) && vap->va_uid != ovap->va_uid) || 1397 ((mask & AT_GID) && vap->va_gid != ovap->va_gid && 1398 !groupmember(vap->va_gid, cr))) { 1399 checkpriv = B_TRUE; 1400 } 1401 } 1402 /* 1403 * If necessary, check privilege to see if update can be done. 1404 */ 1405 if (checkpriv && 1406 (error = secpolicy_vnode_chown(cr, ovap->va_uid)) != 0) { 1407 goto out; 1408 } 1409 1410 /* 1411 * If the file has either the set UID or set GID bits 1412 * set and the caller can set the bits, then leave them. 1413 */ 1414 secpolicy_setid_clear(vap, cr); 1415 } 1416 if (mask & (AT_ATIME|AT_MTIME)) { 1417 /* 1418 * If not the file owner and not otherwise privileged, 1419 * always return an error when setting the 1420 * time other than the current (ATTR_UTIME flag set). 1421 * If setting the current time (ATTR_UTIME not set) then 1422 * unlocked_access will check permissions according to policy. 1423 */ 1424 if (cr->cr_uid != ovap->va_uid) { 1425 if (flags & ATTR_UTIME) 1426 error = secpolicy_vnode_utime_modify(cr); 1427 else if (skipaclchk == B_FALSE) { 1428 error = unlocked_access(node, VWRITE, cr); 1429 if (error == EACCES && 1430 secpolicy_vnode_utime_modify(cr) == 0) 1431 error = 0; 1432 } 1433 if (error) 1434 goto out; 1435 } 1436 } 1437 1438 /* 1439 * Check for optional attributes here by checking the following: 1440 */ 1441 if (mask & AT_XVATTR) 1442 error = secpolicy_xvattr((xvattr_t *)vap, ovap->va_uid, cr, 1443 vp->v_type); 1444 out: 1445 return (error); 1446 } 1447 1448 /* 1449 * Name: secpolicy_pcfs_modify_bootpartition() 1450 * 1451 * Normal: verify that subject can modify a pcfs boot partition. 1452 * 1453 * Output: EACCES - if privilege check failed. 1454 */ 1455 /*ARGSUSED*/ 1456 int 1457 secpolicy_pcfs_modify_bootpartition(const cred_t *cred) 1458 { 1459 return (PRIV_POLICY(cred, PRIV_ALL, B_FALSE, EACCES, 1460 "modify pcfs boot partition")); 1461 } 1462 1463 /* 1464 * System V IPC routines 1465 */ 1466 int 1467 secpolicy_ipc_owner(const cred_t *cr, const struct kipc_perm *ip) 1468 { 1469 if (crgetzoneid(cr) != ip->ipc_zoneid || 1470 (cr->cr_uid != ip->ipc_uid && cr->cr_uid != ip->ipc_cuid)) { 1471 boolean_t allzone = B_FALSE; 1472 if (ip->ipc_uid == 0 || ip->ipc_cuid == 0) 1473 allzone = B_TRUE; 1474 return (PRIV_POLICY(cr, PRIV_IPC_OWNER, allzone, EPERM, NULL)); 1475 } 1476 return (0); 1477 } 1478 1479 int 1480 secpolicy_ipc_config(const cred_t *cr) 1481 { 1482 return (PRIV_POLICY(cr, PRIV_SYS_IPC_CONFIG, B_FALSE, EPERM, NULL)); 1483 } 1484 1485 int 1486 secpolicy_ipc_access(const cred_t *cr, const struct kipc_perm *ip, mode_t mode) 1487 { 1488 1489 boolean_t allzone = B_FALSE; 1490 1491 ASSERT((mode & (MSG_R|MSG_W)) != 0); 1492 1493 if ((mode & MSG_R) && 1494 PRIV_POLICY(cr, PRIV_IPC_DAC_READ, allzone, EACCES, NULL) != 0) 1495 return (EACCES); 1496 1497 if (mode & MSG_W) { 1498 if (cr->cr_uid != 0 && (ip->ipc_uid == 0 || ip->ipc_cuid == 0)) 1499 allzone = B_TRUE; 1500 1501 return (PRIV_POLICY(cr, PRIV_IPC_DAC_WRITE, allzone, EACCES, 1502 NULL)); 1503 } 1504 return (0); 1505 } 1506 1507 int 1508 secpolicy_rsm_access(const cred_t *cr, uid_t owner, mode_t mode) 1509 { 1510 boolean_t allzone = B_FALSE; 1511 1512 ASSERT((mode & (MSG_R|MSG_W)) != 0); 1513 1514 if ((mode & MSG_R) && 1515 PRIV_POLICY(cr, PRIV_IPC_DAC_READ, allzone, EACCES, NULL) != 0) 1516 return (EACCES); 1517 1518 if (mode & MSG_W) { 1519 if (cr->cr_uid != 0 && owner == 0) 1520 allzone = B_TRUE; 1521 1522 return (PRIV_POLICY(cr, PRIV_IPC_DAC_WRITE, allzone, EACCES, 1523 NULL)); 1524 } 1525 return (0); 1526 } 1527 1528 /* 1529 * Audit configuration. 1530 */ 1531 int 1532 secpolicy_audit_config(const cred_t *cr) 1533 { 1534 return (PRIV_POLICY(cr, PRIV_SYS_AUDIT, B_FALSE, EPERM, NULL)); 1535 } 1536 1537 /* 1538 * Audit record generation. 1539 */ 1540 int 1541 secpolicy_audit_modify(const cred_t *cr) 1542 { 1543 return (PRIV_POLICY(cr, PRIV_PROC_AUDIT, B_FALSE, EPERM, NULL)); 1544 } 1545 1546 /* 1547 * Get audit attributes. 1548 * Either PRIV_SYS_AUDIT or PRIV_PROC_AUDIT required; report the 1549 * "Least" of the two privileges on error. 1550 */ 1551 int 1552 secpolicy_audit_getattr(const cred_t *cr, boolean_t checkonly) 1553 { 1554 int priv; 1555 1556 if (PRIV_POLICY_ONLY(cr, PRIV_SYS_AUDIT, B_FALSE)) 1557 priv = PRIV_SYS_AUDIT; 1558 else 1559 priv = PRIV_PROC_AUDIT; 1560 1561 if (checkonly) 1562 return (!PRIV_POLICY_ONLY(cr, priv, B_FALSE)); 1563 else 1564 return (PRIV_POLICY(cr, priv, B_FALSE, EPERM, NULL)); 1565 } 1566 1567 1568 /* 1569 * Locking physical memory 1570 */ 1571 int 1572 secpolicy_lock_memory(const cred_t *cr) 1573 { 1574 return (PRIV_POLICY(cr, PRIV_PROC_LOCK_MEMORY, B_FALSE, EPERM, NULL)); 1575 } 1576 1577 /* 1578 * Accounting (both acct(2) and exacct). 1579 */ 1580 int 1581 secpolicy_acct(const cred_t *cr) 1582 { 1583 return (PRIV_POLICY(cr, PRIV_SYS_ACCT, B_FALSE, EPERM, NULL)); 1584 } 1585 1586 /* 1587 * Is this process privileged to change its uids at will? 1588 * Uid 0 is still considered "special" and having the SETID 1589 * privilege is not sufficient to get uid 0. 1590 * Files are owned by root, so the privilege would give 1591 * full access and euid 0 is still effective. 1592 * 1593 * If you have the privilege and euid 0 only then do you 1594 * get the powers of root wrt uid 0. 1595 * 1596 * For gid manipulations, this is should be called with an 1597 * uid of -1. 1598 * 1599 */ 1600 int 1601 secpolicy_allow_setid(const cred_t *cr, uid_t newuid, boolean_t checkonly) 1602 { 1603 boolean_t allzone = B_FALSE; 1604 1605 if (newuid == 0 && cr->cr_uid != 0 && cr->cr_suid != 0 && 1606 cr->cr_ruid != 0) { 1607 allzone = B_TRUE; 1608 } 1609 1610 return (checkonly ? !PRIV_POLICY_ONLY(cr, PRIV_PROC_SETID, allzone) : 1611 PRIV_POLICY(cr, PRIV_PROC_SETID, allzone, EPERM, NULL)); 1612 } 1613 1614 1615 /* 1616 * Acting on a different process: if the mode is for writing, 1617 * the restrictions are more severe. This is called after 1618 * we've verified that the uids do not match. 1619 */ 1620 int 1621 secpolicy_proc_owner(const cred_t *scr, const cred_t *tcr, int mode) 1622 { 1623 boolean_t allzone = B_FALSE; 1624 1625 if ((mode & VWRITE) && scr->cr_uid != 0 && 1626 (tcr->cr_uid == 0 || tcr->cr_ruid == 0 || tcr->cr_suid == 0)) 1627 allzone = B_TRUE; 1628 1629 return (PRIV_POLICY(scr, PRIV_PROC_OWNER, allzone, EPERM, NULL)); 1630 } 1631 1632 int 1633 secpolicy_proc_access(const cred_t *scr) 1634 { 1635 return (PRIV_POLICY(scr, PRIV_PROC_OWNER, B_FALSE, EACCES, NULL)); 1636 } 1637 1638 int 1639 secpolicy_proc_excl_open(const cred_t *scr) 1640 { 1641 return (PRIV_POLICY(scr, PRIV_PROC_OWNER, B_FALSE, EBUSY, NULL)); 1642 } 1643 1644 int 1645 secpolicy_proc_zone(const cred_t *scr) 1646 { 1647 return (PRIV_POLICY(scr, PRIV_PROC_ZONE, B_FALSE, EPERM, NULL)); 1648 } 1649 1650 /* 1651 * Destroying the system 1652 */ 1653 1654 int 1655 secpolicy_kmdb(const cred_t *scr) 1656 { 1657 return (PRIV_POLICY(scr, PRIV_ALL, B_FALSE, EPERM, NULL)); 1658 } 1659 1660 int 1661 secpolicy_error_inject(const cred_t *scr) 1662 { 1663 return (PRIV_POLICY(scr, PRIV_ALL, B_FALSE, EPERM, NULL)); 1664 } 1665 1666 /* 1667 * Processor sets, cpu configuration, resource pools. 1668 */ 1669 int 1670 secpolicy_pset(const cred_t *cr) 1671 { 1672 return (PRIV_POLICY(cr, PRIV_SYS_RES_CONFIG, B_FALSE, EPERM, NULL)); 1673 } 1674 1675 int 1676 secpolicy_ponline(const cred_t *cr) 1677 { 1678 return (PRIV_POLICY(cr, PRIV_SYS_RES_CONFIG, B_FALSE, EPERM, NULL)); 1679 } 1680 1681 int 1682 secpolicy_pool(const cred_t *cr) 1683 { 1684 return (PRIV_POLICY(cr, PRIV_SYS_RES_CONFIG, B_FALSE, EPERM, NULL)); 1685 } 1686 1687 int 1688 secpolicy_blacklist(const cred_t *cr) 1689 { 1690 return (PRIV_POLICY(cr, PRIV_SYS_RES_CONFIG, B_FALSE, EPERM, NULL)); 1691 } 1692 1693 /* 1694 * Catch all system configuration. 1695 */ 1696 int 1697 secpolicy_sys_config(const cred_t *cr, boolean_t checkonly) 1698 { 1699 if (checkonly) { 1700 return (PRIV_POLICY_ONLY(cr, PRIV_SYS_CONFIG, B_FALSE) ? 0 : 1701 EPERM); 1702 } else { 1703 return (PRIV_POLICY(cr, PRIV_SYS_CONFIG, B_FALSE, EPERM, NULL)); 1704 } 1705 } 1706 1707 /* 1708 * Zone administration (halt, reboot, etc.) from within zone. 1709 */ 1710 int 1711 secpolicy_zone_admin(const cred_t *cr, boolean_t checkonly) 1712 { 1713 if (checkonly) { 1714 return (PRIV_POLICY_ONLY(cr, PRIV_SYS_ADMIN, B_FALSE) ? 0 : 1715 EPERM); 1716 } else { 1717 return (PRIV_POLICY(cr, PRIV_SYS_ADMIN, B_FALSE, EPERM, 1718 NULL)); 1719 } 1720 } 1721 1722 /* 1723 * Zone configuration (create, halt, enter). 1724 */ 1725 int 1726 secpolicy_zone_config(const cred_t *cr) 1727 { 1728 /* 1729 * Require all privileges to avoid possibility of privilege 1730 * escalation. 1731 */ 1732 return (secpolicy_require_set(cr, PRIV_FULLSET, NULL, KLPDARG_NONE)); 1733 } 1734 1735 /* 1736 * Various other system configuration calls 1737 */ 1738 int 1739 secpolicy_coreadm(const cred_t *cr) 1740 { 1741 return (PRIV_POLICY(cr, PRIV_SYS_ADMIN, B_FALSE, EPERM, NULL)); 1742 } 1743 1744 int 1745 secpolicy_systeminfo(const cred_t *cr) 1746 { 1747 return (PRIV_POLICY(cr, PRIV_SYS_ADMIN, B_FALSE, EPERM, NULL)); 1748 } 1749 1750 int 1751 secpolicy_dispadm(const cred_t *cr) 1752 { 1753 return (PRIV_POLICY(cr, PRIV_SYS_CONFIG, B_FALSE, EPERM, NULL)); 1754 } 1755 1756 int 1757 secpolicy_settime(const cred_t *cr) 1758 { 1759 return (PRIV_POLICY(cr, PRIV_SYS_TIME, B_FALSE, EPERM, NULL)); 1760 } 1761 1762 /* 1763 * For realtime users: high resolution clock. 1764 */ 1765 int 1766 secpolicy_clock_highres(const cred_t *cr) 1767 { 1768 return (PRIV_POLICY(cr, PRIV_PROC_CLOCK_HIGHRES, B_FALSE, EPERM, 1769 NULL)); 1770 } 1771 1772 /* 1773 * drv_priv() is documented as callable from interrupt context, not that 1774 * anyone ever does, but still. No debugging or auditing can be done when 1775 * it is called from interrupt context. 1776 * returns 0 on succes, EPERM on failure. 1777 */ 1778 int 1779 drv_priv(cred_t *cr) 1780 { 1781 return (PRIV_POLICY(cr, PRIV_SYS_DEVICES, B_FALSE, EPERM, NULL)); 1782 } 1783 1784 int 1785 secpolicy_sys_devices(const cred_t *cr) 1786 { 1787 return (PRIV_POLICY(cr, PRIV_SYS_DEVICES, B_FALSE, EPERM, NULL)); 1788 } 1789 1790 int 1791 secpolicy_excl_open(const cred_t *cr) 1792 { 1793 return (PRIV_POLICY(cr, PRIV_SYS_DEVICES, B_FALSE, EBUSY, NULL)); 1794 } 1795 1796 int 1797 secpolicy_rctlsys(const cred_t *cr, boolean_t is_zone_rctl) 1798 { 1799 /* zone.* rctls can only be set from the global zone */ 1800 if (is_zone_rctl && priv_policy_global(cr) != 0) 1801 return (EPERM); 1802 return (PRIV_POLICY(cr, PRIV_SYS_RESOURCE, B_FALSE, EPERM, NULL)); 1803 } 1804 1805 int 1806 secpolicy_resource(const cred_t *cr) 1807 { 1808 return (PRIV_POLICY(cr, PRIV_SYS_RESOURCE, B_FALSE, EPERM, NULL)); 1809 } 1810 1811 int 1812 secpolicy_resource_anon_mem(const cred_t *cr) 1813 { 1814 return (PRIV_POLICY_ONLY(cr, PRIV_SYS_RESOURCE, B_FALSE)); 1815 } 1816 1817 /* 1818 * Processes with a real uid of 0 escape any form of accounting, much 1819 * like before. 1820 */ 1821 int 1822 secpolicy_newproc(const cred_t *cr) 1823 { 1824 if (cr->cr_ruid == 0) 1825 return (0); 1826 1827 return (PRIV_POLICY(cr, PRIV_SYS_RESOURCE, B_FALSE, EPERM, NULL)); 1828 } 1829 1830 /* 1831 * Networking 1832 */ 1833 int 1834 secpolicy_net_rawaccess(const cred_t *cr) 1835 { 1836 return (PRIV_POLICY(cr, PRIV_NET_RAWACCESS, B_FALSE, EACCES, NULL)); 1837 } 1838 1839 int 1840 secpolicy_net_observability(const cred_t *cr) 1841 { 1842 return (PRIV_POLICY(cr, PRIV_NET_OBSERVABILITY, B_FALSE, EACCES, NULL)); 1843 } 1844 1845 /* 1846 * Need this privilege for accessing the ICMP device 1847 */ 1848 int 1849 secpolicy_net_icmpaccess(const cred_t *cr) 1850 { 1851 return (PRIV_POLICY(cr, PRIV_NET_ICMPACCESS, B_FALSE, EACCES, NULL)); 1852 } 1853 1854 /* 1855 * There are a few rare cases where the kernel generates ioctls() from 1856 * interrupt context with a credential of kcred rather than NULL. 1857 * In those cases, we take the safe and cheap test. 1858 */ 1859 int 1860 secpolicy_net_config(const cred_t *cr, boolean_t checkonly) 1861 { 1862 if (checkonly) { 1863 return (PRIV_POLICY_ONLY(cr, PRIV_SYS_NET_CONFIG, B_FALSE) ? 1864 0 : EPERM); 1865 } else { 1866 return (PRIV_POLICY(cr, PRIV_SYS_NET_CONFIG, B_FALSE, EPERM, 1867 NULL)); 1868 } 1869 } 1870 1871 1872 /* 1873 * PRIV_SYS_NET_CONFIG is a superset of PRIV_SYS_IP_CONFIG. 1874 * 1875 * There are a few rare cases where the kernel generates ioctls() from 1876 * interrupt context with a credential of kcred rather than NULL. 1877 * In those cases, we take the safe and cheap test. 1878 */ 1879 int 1880 secpolicy_ip_config(const cred_t *cr, boolean_t checkonly) 1881 { 1882 if (PRIV_POLICY_ONLY(cr, PRIV_SYS_NET_CONFIG, B_FALSE)) 1883 return (secpolicy_net_config(cr, checkonly)); 1884 1885 if (checkonly) { 1886 return (PRIV_POLICY_ONLY(cr, PRIV_SYS_IP_CONFIG, B_FALSE) ? 1887 0 : EPERM); 1888 } else { 1889 return (PRIV_POLICY(cr, PRIV_SYS_IP_CONFIG, B_FALSE, EPERM, 1890 NULL)); 1891 } 1892 } 1893 1894 /* 1895 * PRIV_SYS_NET_CONFIG is a superset of PRIV_SYS_DL_CONFIG. 1896 */ 1897 int 1898 secpolicy_dl_config(const cred_t *cr) 1899 { 1900 if (PRIV_POLICY_ONLY(cr, PRIV_SYS_NET_CONFIG, B_FALSE)) 1901 return (secpolicy_net_config(cr, B_FALSE)); 1902 return (PRIV_POLICY(cr, PRIV_SYS_DL_CONFIG, B_FALSE, EPERM, NULL)); 1903 } 1904 1905 /* 1906 * PRIV_SYS_DL_CONFIG is a superset of PRIV_SYS_IPTUN_CONFIG. 1907 */ 1908 int 1909 secpolicy_iptun_config(const cred_t *cr) 1910 { 1911 if (PRIV_POLICY_ONLY(cr, PRIV_SYS_NET_CONFIG, B_FALSE)) 1912 return (secpolicy_net_config(cr, B_FALSE)); 1913 if (PRIV_POLICY_ONLY(cr, PRIV_SYS_DL_CONFIG, B_FALSE)) 1914 return (secpolicy_dl_config(cr)); 1915 return (PRIV_POLICY(cr, PRIV_SYS_IPTUN_CONFIG, B_FALSE, EPERM, NULL)); 1916 } 1917 1918 /* 1919 * Map IP pseudo privileges to actual privileges. 1920 * So we don't need to recompile IP when we change the privileges. 1921 */ 1922 int 1923 secpolicy_ip(const cred_t *cr, int netpriv, boolean_t checkonly) 1924 { 1925 int priv = PRIV_ALL; 1926 1927 switch (netpriv) { 1928 case OP_CONFIG: 1929 priv = PRIV_SYS_IP_CONFIG; 1930 break; 1931 case OP_RAW: 1932 priv = PRIV_NET_RAWACCESS; 1933 break; 1934 case OP_PRIVPORT: 1935 priv = PRIV_NET_PRIVADDR; 1936 break; 1937 } 1938 ASSERT(priv != PRIV_ALL); 1939 if (checkonly) 1940 return (PRIV_POLICY_ONLY(cr, priv, B_FALSE) ? 0 : EPERM); 1941 else 1942 return (PRIV_POLICY(cr, priv, B_FALSE, EPERM, NULL)); 1943 } 1944 1945 /* 1946 * Map network pseudo privileges to actual privileges. 1947 * So we don't need to recompile IP when we change the privileges. 1948 */ 1949 int 1950 secpolicy_net(const cred_t *cr, int netpriv, boolean_t checkonly) 1951 { 1952 int priv = PRIV_ALL; 1953 1954 switch (netpriv) { 1955 case OP_CONFIG: 1956 priv = PRIV_SYS_NET_CONFIG; 1957 break; 1958 case OP_RAW: 1959 priv = PRIV_NET_RAWACCESS; 1960 break; 1961 case OP_PRIVPORT: 1962 priv = PRIV_NET_PRIVADDR; 1963 break; 1964 } 1965 ASSERT(priv != PRIV_ALL); 1966 if (checkonly) 1967 return (PRIV_POLICY_ONLY(cr, priv, B_FALSE) ? 0 : EPERM); 1968 else 1969 return (PRIV_POLICY(cr, priv, B_FALSE, EPERM, NULL)); 1970 } 1971 1972 /* 1973 * Checks for operations that are either client-only or are used by 1974 * both clients and servers. 1975 */ 1976 int 1977 secpolicy_nfs(const cred_t *cr) 1978 { 1979 return (PRIV_POLICY(cr, PRIV_SYS_NFS, B_FALSE, EPERM, NULL)); 1980 } 1981 1982 /* 1983 * Special case for opening rpcmod: have NFS privileges or network 1984 * config privileges. 1985 */ 1986 int 1987 secpolicy_rpcmod_open(const cred_t *cr) 1988 { 1989 if (PRIV_POLICY_ONLY(cr, PRIV_SYS_NFS, B_FALSE)) 1990 return (secpolicy_nfs(cr)); 1991 else 1992 return (secpolicy_net_config(cr, NULL)); 1993 } 1994 1995 int 1996 secpolicy_chroot(const cred_t *cr) 1997 { 1998 return (PRIV_POLICY(cr, PRIV_PROC_CHROOT, B_FALSE, EPERM, NULL)); 1999 } 2000 2001 int 2002 secpolicy_tasksys(const cred_t *cr) 2003 { 2004 return (PRIV_POLICY(cr, PRIV_PROC_TASKID, B_FALSE, EPERM, NULL)); 2005 } 2006 2007 int 2008 secpolicy_pfexec_register(const cred_t *cr) 2009 { 2010 return (PRIV_POLICY(cr, PRIV_SYS_ADMIN, B_TRUE, EPERM, NULL)); 2011 } 2012 2013 /* 2014 * Basic privilege checks. 2015 */ 2016 int 2017 secpolicy_basic_exec(const cred_t *cr, vnode_t *vp) 2018 { 2019 FAST_BASIC_CHECK(cr, PRIV_PROC_EXEC); 2020 2021 return (priv_policy_va(cr, PRIV_PROC_EXEC, B_FALSE, EPERM, NULL, 2022 KLPDARG_VNODE, vp, (char *)NULL, KLPDARG_NOMORE)); 2023 } 2024 2025 int 2026 secpolicy_basic_fork(const cred_t *cr) 2027 { 2028 FAST_BASIC_CHECK(cr, PRIV_PROC_FORK); 2029 2030 return (PRIV_POLICY(cr, PRIV_PROC_FORK, B_FALSE, EPERM, NULL)); 2031 } 2032 2033 int 2034 secpolicy_basic_proc(const cred_t *cr) 2035 { 2036 FAST_BASIC_CHECK(cr, PRIV_PROC_SESSION); 2037 2038 return (PRIV_POLICY(cr, PRIV_PROC_SESSION, B_FALSE, EPERM, NULL)); 2039 } 2040 2041 /* 2042 * Slightly complicated because we don't want to trigger the policy too 2043 * often. First we shortcircuit access to "self" (tp == sp) or if 2044 * we don't have the privilege but if we have permission 2045 * just return (0) and we don't flag the privilege as needed. 2046 * Else, we test for the privilege because we either have it or need it. 2047 */ 2048 int 2049 secpolicy_basic_procinfo(const cred_t *cr, proc_t *tp, proc_t *sp) 2050 { 2051 if (tp == sp || 2052 !HAS_PRIVILEGE(cr, PRIV_PROC_INFO) && prochasprocperm(tp, sp, cr)) { 2053 return (0); 2054 } else { 2055 return (PRIV_POLICY(cr, PRIV_PROC_INFO, B_FALSE, EPERM, NULL)); 2056 } 2057 } 2058 2059 int 2060 secpolicy_basic_link(const cred_t *cr) 2061 { 2062 FAST_BASIC_CHECK(cr, PRIV_FILE_LINK_ANY); 2063 2064 return (PRIV_POLICY(cr, PRIV_FILE_LINK_ANY, B_FALSE, EPERM, NULL)); 2065 } 2066 2067 int 2068 secpolicy_basic_net_access(const cred_t *cr) 2069 { 2070 FAST_BASIC_CHECK(cr, PRIV_NET_ACCESS); 2071 2072 return (PRIV_POLICY(cr, PRIV_NET_ACCESS, B_FALSE, EACCES, NULL)); 2073 } 2074 2075 /* ARGSUSED */ 2076 int 2077 secpolicy_basic_file_read(const cred_t *cr, vnode_t *vp, const char *pn) 2078 { 2079 FAST_BASIC_CHECK(cr, PRIV_FILE_READ); 2080 2081 return (priv_policy_va(cr, PRIV_FILE_READ, B_FALSE, EACCES, NULL, 2082 KLPDARG_VNODE, vp, (char *)pn, KLPDARG_NOMORE)); 2083 } 2084 2085 /* ARGSUSED */ 2086 int 2087 secpolicy_basic_file_write(const cred_t *cr, vnode_t *vp, const char *pn) 2088 { 2089 FAST_BASIC_CHECK(cr, PRIV_FILE_WRITE); 2090 2091 return (priv_policy_va(cr, PRIV_FILE_WRITE, B_FALSE, EACCES, NULL, 2092 KLPDARG_VNODE, vp, (char *)pn, KLPDARG_NOMORE)); 2093 } 2094 2095 /* 2096 * Additional device protection. 2097 * 2098 * Traditionally, a device has specific permissions on the node in 2099 * the filesystem which govern which devices can be opened by what 2100 * processes. In certain cases, it is desirable to add extra 2101 * restrictions, as writing to certain devices is identical to 2102 * having a complete run of the system. 2103 * 2104 * This mechanism is called the device policy. 2105 * 2106 * When a device is opened, its policy entry is looked up in the 2107 * policy cache and checked. 2108 */ 2109 int 2110 secpolicy_spec_open(const cred_t *cr, struct vnode *vp, int oflag) 2111 { 2112 devplcy_t *plcy; 2113 int err; 2114 struct snode *csp = VTOS(common_specvp(vp)); 2115 priv_set_t pset; 2116 2117 mutex_enter(&csp->s_lock); 2118 2119 if (csp->s_plcy == NULL || csp->s_plcy->dp_gen != devplcy_gen) { 2120 plcy = devpolicy_find(vp); 2121 if (csp->s_plcy) 2122 dpfree(csp->s_plcy); 2123 csp->s_plcy = plcy; 2124 ASSERT(plcy != NULL); 2125 } else 2126 plcy = csp->s_plcy; 2127 2128 if (plcy == nullpolicy) { 2129 mutex_exit(&csp->s_lock); 2130 return (0); 2131 } 2132 2133 dphold(plcy); 2134 2135 mutex_exit(&csp->s_lock); 2136 2137 if (oflag & FWRITE) 2138 pset = plcy->dp_wrp; 2139 else 2140 pset = plcy->dp_rdp; 2141 /* 2142 * Special case: 2143 * PRIV_SYS_NET_CONFIG is a superset of PRIV_SYS_IP_CONFIG. 2144 * If PRIV_SYS_NET_CONFIG is present and PRIV_SYS_IP_CONFIG is 2145 * required, replace PRIV_SYS_IP_CONFIG with PRIV_SYS_NET_CONFIG 2146 * in the required privilege set before doing the check. 2147 */ 2148 if (priv_ismember(&pset, PRIV_SYS_IP_CONFIG) && 2149 priv_ismember(&CR_OEPRIV(cr), PRIV_SYS_NET_CONFIG) && 2150 !priv_ismember(&CR_OEPRIV(cr), PRIV_SYS_IP_CONFIG)) { 2151 priv_delset(&pset, PRIV_SYS_IP_CONFIG); 2152 priv_addset(&pset, PRIV_SYS_NET_CONFIG); 2153 } 2154 2155 err = secpolicy_require_set(cr, &pset, "devpolicy", KLPDARG_NONE); 2156 dpfree(plcy); 2157 2158 return (err); 2159 } 2160 2161 int 2162 secpolicy_modctl(const cred_t *cr, int cmd) 2163 { 2164 switch (cmd) { 2165 case MODINFO: 2166 case MODGETMAJBIND: 2167 case MODGETPATH: 2168 case MODGETPATHLEN: 2169 case MODGETNAME: 2170 case MODGETFBNAME: 2171 case MODGETDEVPOLICY: 2172 case MODGETDEVPOLICYBYNAME: 2173 case MODDEVT2INSTANCE: 2174 case MODSIZEOF_DEVID: 2175 case MODGETDEVID: 2176 case MODSIZEOF_MINORNAME: 2177 case MODGETMINORNAME: 2178 case MODGETDEVFSPATH_LEN: 2179 case MODGETDEVFSPATH: 2180 case MODGETDEVFSPATH_MI_LEN: 2181 case MODGETDEVFSPATH_MI: 2182 /* Unprivileged */ 2183 return (0); 2184 case MODLOAD: 2185 case MODSETDEVPOLICY: 2186 return (secpolicy_require_set(cr, PRIV_FULLSET, NULL, 2187 KLPDARG_NONE)); 2188 default: 2189 return (secpolicy_sys_config(cr, B_FALSE)); 2190 } 2191 } 2192 2193 int 2194 secpolicy_console(const cred_t *cr) 2195 { 2196 return (PRIV_POLICY(cr, PRIV_SYS_DEVICES, B_FALSE, EPERM, NULL)); 2197 } 2198 2199 int 2200 secpolicy_power_mgmt(const cred_t *cr) 2201 { 2202 return (PRIV_POLICY(cr, PRIV_SYS_DEVICES, B_FALSE, EPERM, NULL)); 2203 } 2204 2205 /* 2206 * Simulate terminal input; another escalation of privileges avenue. 2207 */ 2208 2209 int 2210 secpolicy_sti(const cred_t *cr) 2211 { 2212 return (secpolicy_require_set(cr, PRIV_FULLSET, NULL, KLPDARG_NONE)); 2213 } 2214 2215 boolean_t 2216 secpolicy_net_reply_equal(const cred_t *cr) 2217 { 2218 return (PRIV_POLICY(cr, PRIV_SYS_CONFIG, B_FALSE, EPERM, NULL)); 2219 } 2220 2221 int 2222 secpolicy_swapctl(const cred_t *cr) 2223 { 2224 return (PRIV_POLICY(cr, PRIV_SYS_CONFIG, B_FALSE, EPERM, NULL)); 2225 } 2226 2227 int 2228 secpolicy_cpc_cpu(const cred_t *cr) 2229 { 2230 return (PRIV_POLICY(cr, PRIV_CPC_CPU, B_FALSE, EACCES, NULL)); 2231 } 2232 2233 /* 2234 * secpolicy_contract_identity 2235 * 2236 * Determine if the subject may set the process contract FMRI value 2237 */ 2238 int 2239 secpolicy_contract_identity(const cred_t *cr) 2240 { 2241 return (PRIV_POLICY(cr, PRIV_CONTRACT_IDENTITY, B_FALSE, EPERM, NULL)); 2242 } 2243 2244 /* 2245 * secpolicy_contract_observer 2246 * 2247 * Determine if the subject may observe a specific contract's events. 2248 */ 2249 int 2250 secpolicy_contract_observer(const cred_t *cr, struct contract *ct) 2251 { 2252 if (contract_owned(ct, cr, B_FALSE)) 2253 return (0); 2254 return (PRIV_POLICY(cr, PRIV_CONTRACT_OBSERVER, B_FALSE, EPERM, NULL)); 2255 } 2256 2257 /* 2258 * secpolicy_contract_observer_choice 2259 * 2260 * Determine if the subject may observe any contract's events. Just 2261 * tests privilege and audits on success. 2262 */ 2263 boolean_t 2264 secpolicy_contract_observer_choice(const cred_t *cr) 2265 { 2266 return (PRIV_POLICY_CHOICE(cr, PRIV_CONTRACT_OBSERVER, B_FALSE)); 2267 } 2268 2269 /* 2270 * secpolicy_contract_event 2271 * 2272 * Determine if the subject may request critical contract events or 2273 * reliable contract event delivery. 2274 */ 2275 int 2276 secpolicy_contract_event(const cred_t *cr) 2277 { 2278 return (PRIV_POLICY(cr, PRIV_CONTRACT_EVENT, B_FALSE, EPERM, NULL)); 2279 } 2280 2281 /* 2282 * secpolicy_contract_event_choice 2283 * 2284 * Determine if the subject may retain contract events in its critical 2285 * set when a change in other terms would normally require a change in 2286 * the critical set. Just tests privilege and audits on success. 2287 */ 2288 boolean_t 2289 secpolicy_contract_event_choice(const cred_t *cr) 2290 { 2291 return (PRIV_POLICY_CHOICE(cr, PRIV_CONTRACT_EVENT, B_FALSE)); 2292 } 2293 2294 /* 2295 * secpolicy_gart_access 2296 * 2297 * Determine if the subject has sufficient priveleges to make ioctls to agpgart 2298 * device. 2299 */ 2300 int 2301 secpolicy_gart_access(const cred_t *cr) 2302 { 2303 return (PRIV_POLICY(cr, PRIV_GRAPHICS_ACCESS, B_FALSE, EPERM, NULL)); 2304 } 2305 2306 /* 2307 * secpolicy_gart_map 2308 * 2309 * Determine if the subject has sufficient priveleges to map aperture range 2310 * through agpgart driver. 2311 */ 2312 int 2313 secpolicy_gart_map(const cred_t *cr) 2314 { 2315 if (PRIV_POLICY_ONLY(cr, PRIV_GRAPHICS_ACCESS, B_FALSE)) { 2316 return (PRIV_POLICY(cr, PRIV_GRAPHICS_ACCESS, B_FALSE, EPERM, 2317 NULL)); 2318 } else { 2319 return (PRIV_POLICY(cr, PRIV_GRAPHICS_MAP, B_FALSE, EPERM, 2320 NULL)); 2321 } 2322 } 2323 2324 /* 2325 * secpolicy_zinject 2326 * 2327 * Determine if the subject can inject faults in the ZFS fault injection 2328 * framework. Requires all privileges. 2329 */ 2330 int 2331 secpolicy_zinject(const cred_t *cr) 2332 { 2333 return (secpolicy_require_set(cr, PRIV_FULLSET, NULL, KLPDARG_NONE)); 2334 } 2335 2336 /* 2337 * secpolicy_zfs 2338 * 2339 * Determine if the subject has permission to manipulate ZFS datasets 2340 * (not pools). Equivalent to the SYS_MOUNT privilege. 2341 */ 2342 int 2343 secpolicy_zfs(const cred_t *cr) 2344 { 2345 return (PRIV_POLICY(cr, PRIV_SYS_MOUNT, B_FALSE, EPERM, NULL)); 2346 } 2347 2348 /* 2349 * secpolicy_idmap 2350 * 2351 * Determine if the calling process has permissions to register an SID 2352 * mapping daemon and allocate ephemeral IDs. 2353 */ 2354 int 2355 secpolicy_idmap(const cred_t *cr) 2356 { 2357 return (PRIV_POLICY(cr, PRIV_FILE_SETID, B_TRUE, EPERM, NULL)); 2358 } 2359 2360 /* 2361 * secpolicy_ucode_update 2362 * 2363 * Determine if the subject has sufficient privilege to update microcode. 2364 */ 2365 int 2366 secpolicy_ucode_update(const cred_t *scr) 2367 { 2368 return (PRIV_POLICY(scr, PRIV_ALL, B_FALSE, EPERM, NULL)); 2369 } 2370 2371 /* 2372 * secpolicy_sadopen 2373 * 2374 * Determine if the subject has sufficient privilege to access /dev/sad/admin. 2375 * /dev/sad/admin appear in global zone and exclusive-IP zones only. 2376 * In global zone, sys_config is required. 2377 * In exclusive-IP zones, sys_ip_config is required. 2378 * Note that sys_config is prohibited in non-global zones. 2379 */ 2380 int 2381 secpolicy_sadopen(const cred_t *credp) 2382 { 2383 priv_set_t pset; 2384 2385 priv_emptyset(&pset); 2386 2387 if (crgetzoneid(credp) == GLOBAL_ZONEID) 2388 priv_addset(&pset, PRIV_SYS_CONFIG); 2389 else 2390 priv_addset(&pset, PRIV_SYS_IP_CONFIG); 2391 2392 return (secpolicy_require_set(credp, &pset, "devpolicy", KLPDARG_NONE)); 2393 } 2394 2395 2396 /* 2397 * Add privileges to a particular privilege set; this is called when the 2398 * current sets of privileges are not sufficient. I.e., we should always 2399 * call the policy override functions from here. 2400 * What we are allowed to have is in the Observed Permitted set; so 2401 * we compute the difference between that and the newset. 2402 */ 2403 int 2404 secpolicy_require_privs(const cred_t *cr, const priv_set_t *nset) 2405 { 2406 priv_set_t rqd; 2407 2408 rqd = CR_OPPRIV(cr); 2409 2410 priv_inverse(&rqd); 2411 priv_intersect(nset, &rqd); 2412 2413 return (secpolicy_require_set(cr, &rqd, NULL, KLPDARG_NONE)); 2414 } 2415 2416 /* 2417 * secpolicy_smb 2418 * 2419 * Determine if the cred_t has PRIV_SYS_SMB privilege, indicating 2420 * that it has permission to access the smbsrv kernel driver. 2421 * PRIV_POLICY checks the privilege and audits the check. 2422 * 2423 * Returns: 2424 * 0 Driver access is allowed. 2425 * EPERM Driver access is NOT permitted. 2426 */ 2427 int 2428 secpolicy_smb(const cred_t *cr) 2429 { 2430 return (PRIV_POLICY(cr, PRIV_SYS_SMB, B_FALSE, EPERM, NULL)); 2431 } 2432 2433 /* 2434 * secpolicy_vscan 2435 * 2436 * Determine if cred_t has the necessary privileges to access a file 2437 * for virus scanning and update its extended system attributes. 2438 * PRIV_FILE_DAC_SEARCH, PRIV_FILE_DAC_READ - file access 2439 * PRIV_FILE_FLAG_SET - set extended system attributes 2440 * 2441 * PRIV_POLICY checks the privilege and audits the check. 2442 * 2443 * Returns: 2444 * 0 file access for virus scanning allowed. 2445 * EPERM file access for virus scanning is NOT permitted. 2446 */ 2447 int 2448 secpolicy_vscan(const cred_t *cr) 2449 { 2450 if ((PRIV_POLICY(cr, PRIV_FILE_DAC_SEARCH, B_FALSE, EPERM, NULL)) || 2451 (PRIV_POLICY(cr, PRIV_FILE_DAC_READ, B_FALSE, EPERM, NULL)) || 2452 (PRIV_POLICY(cr, PRIV_FILE_FLAG_SET, B_FALSE, EPERM, NULL))) { 2453 return (EPERM); 2454 } 2455 2456 return (0); 2457 } 2458 2459 /* 2460 * secpolicy_smbfs_login 2461 * 2462 * Determines if the caller can add and delete the smbfs login 2463 * password in the the nsmb kernel module for the CIFS client. 2464 * 2465 * Returns: 2466 * 0 access is allowed. 2467 * EPERM access is NOT allowed. 2468 */ 2469 int 2470 secpolicy_smbfs_login(const cred_t *cr, uid_t uid) 2471 { 2472 uid_t cruid = crgetruid(cr); 2473 2474 if (cruid == uid) 2475 return (0); 2476 return (PRIV_POLICY(cr, PRIV_PROC_OWNER, B_FALSE, 2477 EPERM, NULL)); 2478 } 2479 2480 /* 2481 * secpolicy_xvm_control 2482 * 2483 * Determines if a caller can control the xVM hypervisor and/or running 2484 * domains (x86 specific). 2485 * 2486 * Returns: 2487 * 0 access is allowed. 2488 * EPERM access is NOT allowed. 2489 */ 2490 int 2491 secpolicy_xvm_control(const cred_t *cr) 2492 { 2493 if (PRIV_POLICY(cr, PRIV_XVM_CONTROL, B_FALSE, EPERM, NULL)) 2494 return (EPERM); 2495 return (0); 2496 } 2497 2498 /* 2499 * secpolicy_ppp_config 2500 * 2501 * Determine if the subject has sufficient privileges to configure PPP and 2502 * PPP-related devices. 2503 */ 2504 int 2505 secpolicy_ppp_config(const cred_t *cr) 2506 { 2507 if (PRIV_POLICY_ONLY(cr, PRIV_SYS_NET_CONFIG, B_FALSE)) 2508 return (secpolicy_net_config(cr, B_FALSE)); 2509 return (PRIV_POLICY(cr, PRIV_SYS_PPP_CONFIG, B_FALSE, EPERM, NULL)); 2510 } 2511