1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved. 23 */ 24 25 #include <sys/types.h> 26 #include <sys/sysmacros.h> 27 #include <sys/param.h> 28 #include <sys/systm.h> 29 #include <sys/cred_impl.h> 30 #include <sys/vnode.h> 31 #include <sys/vfs.h> 32 #include <sys/stat.h> 33 #include <sys/errno.h> 34 #include <sys/kmem.h> 35 #include <sys/user.h> 36 #include <sys/proc.h> 37 #include <sys/acct.h> 38 #include <sys/ipc_impl.h> 39 #include <sys/cmn_err.h> 40 #include <sys/debug.h> 41 #include <sys/policy.h> 42 #include <sys/kobj.h> 43 #include <sys/msg.h> 44 #include <sys/devpolicy.h> 45 #include <c2/audit.h> 46 #include <sys/varargs.h> 47 #include <sys/klpd.h> 48 #include <sys/modctl.h> 49 #include <sys/disp.h> 50 #include <sys/zone.h> 51 #include <inet/optcom.h> 52 #include <sys/sdt.h> 53 #include <sys/vfs.h> 54 #include <sys/mntent.h> 55 #include <sys/contract_impl.h> 56 #include <sys/dld_ioc.h> 57 58 /* 59 * There are two possible layers of privilege routines and two possible 60 * levels of secpolicy. Plus one other we may not be interested in, so 61 * we may need as many as 6 but no more. 62 */ 63 #define MAXPRIVSTACK 6 64 65 int priv_debug = 0; 66 int priv_basic_test = -1; 67 68 /* 69 * This file contains the majority of the policy routines. 70 * Since the policy routines are defined by function and not 71 * by privilege, there is quite a bit of duplication of 72 * functions. 73 * 74 * The secpolicy functions must not make assumptions about 75 * locks held or not held as any lock can be held while they're 76 * being called. 77 * 78 * Credentials are read-only so no special precautions need to 79 * be taken while locking them. 80 * 81 * When a new policy check needs to be added to the system the 82 * following procedure should be followed: 83 * 84 * Pick an appropriate secpolicy_*() function 85 * -> done if one exists. 86 * Create a new secpolicy function, preferably with 87 * a descriptive name using the standard template. 88 * Pick an appropriate privilege for the policy. 89 * If no appropraite privilege exists, define new one 90 * (this should be done with extreme care; in most cases 91 * little is gained by adding another privilege) 92 * 93 * WHY ROOT IS STILL SPECIAL. 94 * 95 * In a number of the policy functions, there are still explicit 96 * checks for uid 0. The rationale behind these is that many root 97 * owned files/objects hold configuration information which can give full 98 * privileges to the user once written to. To prevent escalation 99 * of privilege by allowing just a single privilege to modify root owned 100 * objects, we've added these root specific checks where we considered 101 * them necessary: modifying root owned files, changing uids to 0, etc. 102 * 103 * PRIVILEGE ESCALATION AND ZONES. 104 * 105 * A number of operations potentially allow the caller to achieve 106 * privileges beyond the ones normally required to perform the operation. 107 * For example, if allowed to create a setuid 0 executable, a process can 108 * gain privileges beyond PRIV_FILE_SETID. Zones, however, place 109 * restrictions on the ability to gain privileges beyond those available 110 * within the zone through file and process manipulation. Hence, such 111 * operations require that the caller have an effective set that includes 112 * all privileges available within the current zone, or all privileges 113 * if executing in the global zone. 114 * 115 * This is indicated in the priv_policy* policy checking functions 116 * through a combination of parameters. The "priv" parameter indicates 117 * the privilege that is required, and the "allzone" parameter indicates 118 * whether or not all privileges in the zone are required. In addition, 119 * priv can be set to PRIV_ALL to indicate that all privileges are 120 * required (regardless of zone). There are three scenarios of interest: 121 * (1) operation requires a specific privilege 122 * (2) operation requires a specific privilege, and requires all 123 * privileges available within the zone (or all privileges if in 124 * the global zone) 125 * (3) operation requires all privileges, regardless of zone 126 * 127 * For (1), priv should be set to the specific privilege, and allzone 128 * should be set to B_FALSE. 129 * For (2), priv should be set to the specific privilege, and allzone 130 * should be set to B_TRUE. 131 * For (3), priv should be set to PRIV_ALL, and allzone should be set 132 * to B_FALSE. 133 * 134 */ 135 136 /* 137 * The privileges are checked against the Effective set for 138 * ordinary processes and checked against the Limit set 139 * for euid 0 processes that haven't manipulated their privilege 140 * sets. 141 */ 142 #define HAS_ALLPRIVS(cr) priv_isfullset(&CR_OEPRIV(cr)) 143 #define ZONEPRIVS(cr) ((cr)->cr_zone->zone_privset) 144 #define HAS_ALLZONEPRIVS(cr) priv_issubset(ZONEPRIVS(cr), &CR_OEPRIV(cr)) 145 #define HAS_PRIVILEGE(cr, pr) ((pr) == PRIV_ALL ? \ 146 HAS_ALLPRIVS(cr) : \ 147 PRIV_ISASSERT(&CR_OEPRIV(cr), pr)) 148 149 #define FAST_BASIC_CHECK(cr, priv) \ 150 if (PRIV_ISASSERT(&CR_OEPRIV(cr), priv)) { \ 151 DTRACE_PROBE2(priv__ok, int, priv, boolean_t, B_FALSE); \ 152 return (0); \ 153 } 154 155 /* 156 * Policy checking functions. 157 * 158 * All of the system's policy should be implemented here. 159 */ 160 161 /* 162 * Private functions which take an additional va_list argument to 163 * implement an object specific policy override. 164 */ 165 static int priv_policy_ap(const cred_t *, int, boolean_t, int, 166 const char *, va_list); 167 static int priv_policy_va(const cred_t *, int, boolean_t, int, 168 const char *, ...); 169 170 /* 171 * Generic policy calls 172 * 173 * The "bottom" functions of policy control 174 */ 175 static char * 176 mprintf(const char *fmt, ...) 177 { 178 va_list args; 179 char *buf; 180 size_t len; 181 182 va_start(args, fmt); 183 len = vsnprintf(NULL, 0, fmt, args) + 1; 184 va_end(args); 185 186 buf = kmem_alloc(len, KM_NOSLEEP); 187 188 if (buf == NULL) 189 return (NULL); 190 191 va_start(args, fmt); 192 (void) vsnprintf(buf, len, fmt, args); 193 va_end(args); 194 195 return (buf); 196 } 197 198 /* 199 * priv_policy_errmsg() 200 * 201 * Generate an error message if privilege debugging is enabled system wide 202 * or for this particular process. 203 */ 204 205 #define FMTHDR "%s[%d]: missing privilege \"%s\" (euid = %d, syscall = %d)" 206 #define FMTMSG " for \"%s\"" 207 #define FMTFUN " needed at %s+0x%lx" 208 209 /* The maximum size privilege format: the concatenation of the above */ 210 #define FMTMAX FMTHDR FMTMSG FMTFUN "\n" 211 212 static void 213 priv_policy_errmsg(const cred_t *cr, int priv, const char *msg) 214 { 215 struct proc *me; 216 pc_t stack[MAXPRIVSTACK]; 217 int depth; 218 int i; 219 char *sym; 220 ulong_t off; 221 const char *pname; 222 223 char *cmd; 224 char fmt[sizeof (FMTMAX)]; 225 226 if ((me = curproc) == &p0) 227 return; 228 229 /* Privileges must be defined */ 230 ASSERT(priv == PRIV_ALL || priv == PRIV_MULTIPLE || 231 priv == PRIV_ALLZONE || priv == PRIV_GLOBAL || 232 priv_getbynum(priv) != NULL); 233 234 if (priv == PRIV_ALLZONE && INGLOBALZONE(me)) 235 priv = PRIV_ALL; 236 237 if (curthread->t_pre_sys) 238 ttolwp(curthread)->lwp_badpriv = (short)priv; 239 240 if (priv_debug == 0 && (CR_FLAGS(cr) & PRIV_DEBUG) == 0) 241 return; 242 243 (void) strcpy(fmt, FMTHDR); 244 245 if (me->p_user.u_comm[0]) 246 cmd = &me->p_user.u_comm[0]; 247 else 248 cmd = "priv_policy"; 249 250 if (msg != NULL && *msg != '\0') { 251 (void) strcat(fmt, FMTMSG); 252 } else { 253 (void) strcat(fmt, "%s"); 254 msg = ""; 255 } 256 257 sym = NULL; 258 259 depth = getpcstack(stack, MAXPRIVSTACK); 260 261 /* 262 * Try to find the first interesting function on the stack. 263 * priv_policy* that's us, so completely uninteresting. 264 * suser(), drv_priv(), secpolicy_* are also called from 265 * too many locations to convey useful information. 266 */ 267 for (i = 0; i < depth; i++) { 268 sym = kobj_getsymname((uintptr_t)stack[i], &off); 269 if (sym != NULL && 270 strstr(sym, "hasprocperm") == 0 && 271 strcmp("suser", sym) != 0 && 272 strcmp("ipcaccess", sym) != 0 && 273 strcmp("drv_priv", sym) != 0 && 274 strncmp("secpolicy_", sym, 10) != 0 && 275 strncmp("priv_policy", sym, 11) != 0) 276 break; 277 } 278 279 if (sym != NULL) 280 (void) strcat(fmt, FMTFUN); 281 282 (void) strcat(fmt, "\n"); 283 284 switch (priv) { 285 case PRIV_ALL: 286 pname = "ALL"; 287 break; 288 case PRIV_MULTIPLE: 289 pname = "MULTIPLE"; 290 break; 291 case PRIV_ALLZONE: 292 pname = "ZONE"; 293 break; 294 case PRIV_GLOBAL: 295 pname = "GLOBAL"; 296 break; 297 default: 298 pname = priv_getbynum(priv); 299 break; 300 } 301 302 if (CR_FLAGS(cr) & PRIV_DEBUG) { 303 /* Remember last message, just like lwp_badpriv. */ 304 if (curthread->t_pdmsg != NULL) { 305 kmem_free(curthread->t_pdmsg, 306 strlen(curthread->t_pdmsg) + 1); 307 } 308 309 curthread->t_pdmsg = mprintf(fmt, cmd, me->p_pid, pname, 310 cr->cr_uid, curthread->t_sysnum, msg, sym, off); 311 312 curthread->t_post_sys = 1; 313 } 314 if (priv_debug) { 315 cmn_err(CE_NOTE, fmt, cmd, me->p_pid, pname, cr->cr_uid, 316 curthread->t_sysnum, msg, sym, off); 317 } 318 } 319 320 /* 321 * Override the policy, if appropriate. Return 0 if the external 322 * policy engine approves. 323 */ 324 static int 325 priv_policy_override(const cred_t *cr, int priv, boolean_t allzone, va_list ap) 326 { 327 priv_set_t set; 328 int ret; 329 330 if (!(CR_FLAGS(cr) & PRIV_XPOLICY)) 331 return (-1); 332 333 if (priv == PRIV_ALL) { 334 priv_fillset(&set); 335 } else if (allzone) { 336 set = *ZONEPRIVS(cr); 337 } else { 338 priv_emptyset(&set); 339 priv_addset(&set, priv); 340 } 341 ret = klpd_call(cr, &set, ap); 342 return (ret); 343 } 344 345 static int 346 priv_policy_override_set(const cred_t *cr, const priv_set_t *req, va_list ap) 347 { 348 if (CR_FLAGS(cr) & PRIV_PFEXEC) 349 return (check_user_privs(cr, req)); 350 if (CR_FLAGS(cr) & PRIV_XPOLICY) { 351 return (klpd_call(cr, req, ap)); 352 } 353 return (-1); 354 } 355 356 static int 357 priv_policy_override_set_va(const cred_t *cr, const priv_set_t *req, ...) 358 { 359 va_list ap; 360 int ret; 361 362 va_start(ap, req); 363 ret = priv_policy_override_set(cr, req, ap); 364 va_end(ap); 365 return (ret); 366 } 367 368 /* 369 * Audit failure, log error message. 370 */ 371 static void 372 priv_policy_err(const cred_t *cr, int priv, boolean_t allzone, const char *msg) 373 { 374 375 if (AU_AUDITING()) 376 audit_priv(priv, allzone ? ZONEPRIVS(cr) : NULL, 0); 377 DTRACE_PROBE2(priv__err, int, priv, boolean_t, allzone); 378 379 if (priv_debug || (CR_FLAGS(cr) & PRIV_DEBUG) || 380 curthread->t_pre_sys) { 381 if (allzone && !HAS_ALLZONEPRIVS(cr)) { 382 priv_policy_errmsg(cr, PRIV_ALLZONE, msg); 383 } else { 384 ASSERT(!HAS_PRIVILEGE(cr, priv)); 385 priv_policy_errmsg(cr, priv, msg); 386 } 387 } 388 } 389 390 /* 391 * priv_policy_ap() 392 * return 0 or error. 393 * See block comment above for a description of "priv" and "allzone" usage. 394 */ 395 static int 396 priv_policy_ap(const cred_t *cr, int priv, boolean_t allzone, int err, 397 const char *msg, va_list ap) 398 { 399 if ((HAS_PRIVILEGE(cr, priv) && (!allzone || HAS_ALLZONEPRIVS(cr))) || 400 (!servicing_interrupt() && 401 priv_policy_override(cr, priv, allzone, ap) == 0)) { 402 if ((allzone || priv == PRIV_ALL || 403 !PRIV_ISASSERT(priv_basic, priv)) && 404 !servicing_interrupt()) { 405 PTOU(curproc)->u_acflag |= ASU; /* Needed for SVVS */ 406 if (AU_AUDITING()) 407 audit_priv(priv, 408 allzone ? ZONEPRIVS(cr) : NULL, 1); 409 } 410 err = 0; 411 DTRACE_PROBE2(priv__ok, int, priv, boolean_t, allzone); 412 } else if (!servicing_interrupt()) { 413 /* Failure audited in this procedure */ 414 priv_policy_err(cr, priv, allzone, msg); 415 } 416 return (err); 417 } 418 419 int 420 priv_policy_va(const cred_t *cr, int priv, boolean_t allzone, int err, 421 const char *msg, ...) 422 { 423 int ret; 424 va_list ap; 425 426 va_start(ap, msg); 427 ret = priv_policy_ap(cr, priv, allzone, err, msg, ap); 428 va_end(ap); 429 430 return (ret); 431 } 432 433 int 434 priv_policy(const cred_t *cr, int priv, boolean_t allzone, int err, 435 const char *msg) 436 { 437 return (priv_policy_va(cr, priv, allzone, err, msg, KLPDARG_NONE)); 438 } 439 440 /* 441 * Return B_TRUE for sufficient privileges, B_FALSE for insufficient privileges. 442 */ 443 boolean_t 444 priv_policy_choice(const cred_t *cr, int priv, boolean_t allzone) 445 { 446 boolean_t res = HAS_PRIVILEGE(cr, priv) && 447 (!allzone || HAS_ALLZONEPRIVS(cr)); 448 449 /* Audit success only */ 450 if (res && AU_AUDITING() && 451 (allzone || priv == PRIV_ALL || !PRIV_ISASSERT(priv_basic, priv)) && 452 !servicing_interrupt()) { 453 audit_priv(priv, allzone ? ZONEPRIVS(cr) : NULL, 1); 454 } 455 if (res) { 456 DTRACE_PROBE2(priv__ok, int, priv, boolean_t, allzone); 457 } else { 458 DTRACE_PROBE2(priv__err, int, priv, boolean_t, allzone); 459 } 460 return (res); 461 } 462 463 /* 464 * Non-auditing variant of priv_policy_choice(). 465 */ 466 boolean_t 467 priv_policy_only(const cred_t *cr, int priv, boolean_t allzone) 468 { 469 boolean_t res = HAS_PRIVILEGE(cr, priv) && 470 (!allzone || HAS_ALLZONEPRIVS(cr)); 471 472 if (res) { 473 DTRACE_PROBE2(priv__ok, int, priv, boolean_t, allzone); 474 } else { 475 DTRACE_PROBE2(priv__err, int, priv, boolean_t, allzone); 476 } 477 return (res); 478 } 479 480 /* 481 * Check whether all privileges in the required set are present. 482 */ 483 static int 484 secpolicy_require_set(const cred_t *cr, const priv_set_t *req, 485 const char *msg, ...) 486 { 487 int priv; 488 int pfound = -1; 489 priv_set_t pset; 490 va_list ap; 491 int ret; 492 493 if (req == PRIV_FULLSET ? HAS_ALLPRIVS(cr) : priv_issubset(req, 494 &CR_OEPRIV(cr))) { 495 return (0); 496 } 497 498 va_start(ap, msg); 499 ret = priv_policy_override_set(cr, req, ap); 500 va_end(ap); 501 if (ret == 0) 502 return (0); 503 504 if (req == PRIV_FULLSET || priv_isfullset(req)) { 505 priv_policy_err(cr, PRIV_ALL, B_FALSE, msg); 506 return (EACCES); 507 } 508 509 pset = CR_OEPRIV(cr); /* present privileges */ 510 priv_inverse(&pset); /* all non present privileges */ 511 priv_intersect(req, &pset); /* the actual missing privs */ 512 513 if (AU_AUDITING()) 514 audit_priv(PRIV_NONE, &pset, 0); 515 /* 516 * Privilege debugging; special case "one privilege in set". 517 */ 518 if (priv_debug || (CR_FLAGS(cr) & PRIV_DEBUG) || curthread->t_pre_sys) { 519 for (priv = 0; priv < nprivs; priv++) { 520 if (priv_ismember(&pset, priv)) { 521 if (pfound != -1) { 522 /* Multiple missing privs */ 523 priv_policy_errmsg(cr, PRIV_MULTIPLE, 524 msg); 525 return (EACCES); 526 } 527 pfound = priv; 528 } 529 } 530 ASSERT(pfound != -1); 531 /* Just the one missing privilege */ 532 priv_policy_errmsg(cr, pfound, msg); 533 } 534 535 return (EACCES); 536 } 537 538 /* 539 * Called when an operation requires that the caller be in the 540 * global zone, regardless of privilege. 541 */ 542 static int 543 priv_policy_global(const cred_t *cr) 544 { 545 if (crgetzoneid(cr) == GLOBAL_ZONEID) 546 return (0); /* success */ 547 548 if (priv_debug || (CR_FLAGS(cr) & PRIV_DEBUG) || 549 curthread->t_pre_sys) { 550 priv_policy_errmsg(cr, PRIV_GLOBAL, NULL); 551 } 552 return (EPERM); 553 } 554 555 /* 556 * Changing process priority 557 */ 558 int 559 secpolicy_setpriority(const cred_t *cr) 560 { 561 return (PRIV_POLICY(cr, PRIV_PROC_PRIOCNTL, B_FALSE, EPERM, NULL)); 562 } 563 564 /* 565 * Binding to a privileged port, port must be specified in host byte 566 * order. 567 * When adding a new privilege which allows binding to currently privileged 568 * ports, then you MUST also allow processes with PRIV_NET_PRIVADDR bind 569 * to these ports because of backward compatibility. 570 */ 571 int 572 secpolicy_net_privaddr(const cred_t *cr, in_port_t port, int proto) 573 { 574 char *reason; 575 int priv; 576 577 switch (port) { 578 case 137: 579 case 138: 580 case 139: 581 case 445: 582 /* 583 * NBT and SMB ports, these are normal privileged ports, 584 * allow bind only if the SYS_SMB or NET_PRIVADDR privilege 585 * is present. 586 * Try both, if neither is present return an error for 587 * priv SYS_SMB. 588 */ 589 if (PRIV_POLICY_ONLY(cr, PRIV_NET_PRIVADDR, B_FALSE)) 590 priv = PRIV_NET_PRIVADDR; 591 else 592 priv = PRIV_SYS_SMB; 593 reason = "NBT or SMB port"; 594 break; 595 596 case 2049: 597 case 4045: 598 /* 599 * NFS ports, these are extra privileged ports, allow bind 600 * only if the SYS_NFS privilege is present. 601 */ 602 priv = PRIV_SYS_NFS; 603 reason = "NFS port"; 604 break; 605 606 default: 607 priv = PRIV_NET_PRIVADDR; 608 reason = NULL; 609 break; 610 611 } 612 613 return (priv_policy_va(cr, priv, B_FALSE, EACCES, reason, 614 KLPDARG_PORT, (int)proto, (int)port, KLPDARG_NOMORE)); 615 } 616 617 /* 618 * Binding to a multilevel port on a trusted (labeled) system. 619 */ 620 int 621 secpolicy_net_bindmlp(const cred_t *cr) 622 { 623 return (PRIV_POLICY(cr, PRIV_NET_BINDMLP, B_FALSE, EACCES, NULL)); 624 } 625 626 /* 627 * Allow a communication between a zone and an unlabeled host when their 628 * labels don't match. 629 */ 630 int 631 secpolicy_net_mac_aware(const cred_t *cr) 632 { 633 return (PRIV_POLICY(cr, PRIV_NET_MAC_AWARE, B_FALSE, EACCES, NULL)); 634 } 635 636 /* 637 * Allow a privileged process to transmit traffic without explicit labels 638 */ 639 int 640 secpolicy_net_mac_implicit(const cred_t *cr) 641 { 642 return (PRIV_POLICY(cr, PRIV_NET_MAC_IMPLICIT, B_FALSE, EACCES, NULL)); 643 } 644 645 /* 646 * Common routine which determines whether a given credential can 647 * act on a given mount. 648 * When called through mount, the parameter needoptcheck is a pointer 649 * to a boolean variable which will be set to either true or false, 650 * depending on whether the mount policy should change the mount options. 651 * In all other cases, needoptcheck should be a NULL pointer. 652 */ 653 static int 654 secpolicy_fs_common(cred_t *cr, vnode_t *mvp, const vfs_t *vfsp, 655 boolean_t *needoptcheck) 656 { 657 boolean_t allzone = B_FALSE; 658 boolean_t mounting = needoptcheck != NULL; 659 660 /* 661 * Short circuit the following cases: 662 * vfsp == NULL or mvp == NULL (pure privilege check) 663 * have all privileges - no further checks required 664 * and no mount options need to be set. 665 */ 666 if (vfsp == NULL || mvp == NULL || HAS_ALLPRIVS(cr)) { 667 if (mounting) 668 *needoptcheck = B_FALSE; 669 670 return (priv_policy_va(cr, PRIV_SYS_MOUNT, allzone, EPERM, 671 NULL, KLPDARG_VNODE, mvp, (char *)NULL, KLPDARG_NOMORE)); 672 } 673 674 /* 675 * When operating on an existing mount (either we're not mounting 676 * or we're doing a remount and VFS_REMOUNT will be set), zones 677 * can operate only on mounts established by the zone itself. 678 */ 679 if (!mounting || (vfsp->vfs_flag & VFS_REMOUNT) != 0) { 680 zoneid_t zoneid = crgetzoneid(cr); 681 682 if (zoneid != GLOBAL_ZONEID && 683 vfsp->vfs_zone->zone_id != zoneid) { 684 return (EPERM); 685 } 686 } 687 688 if (mounting) 689 *needoptcheck = B_TRUE; 690 691 /* 692 * Overlay mounts may hide important stuff; if you can't write to a 693 * mount point but would be able to mount on top of it, you can 694 * escalate your privileges. 695 * So we go about asking the same questions namefs does when it 696 * decides whether you can mount over a file or not but with the 697 * added restriction that you can only mount on top of a regular 698 * file or directory. 699 * If we have all the zone's privileges, we skip all other checks, 700 * or else we may actually get in trouble inside the automounter. 701 */ 702 if ((mvp->v_flag & VROOT) != 0 || 703 (mvp->v_type != VDIR && mvp->v_type != VREG) || 704 HAS_ALLZONEPRIVS(cr)) { 705 allzone = B_TRUE; 706 } else { 707 vattr_t va; 708 int err; 709 710 va.va_mask = AT_UID|AT_MODE; 711 err = VOP_GETATTR(mvp, &va, 0, cr, NULL); 712 if (err != 0) 713 return (err); 714 715 if ((err = secpolicy_vnode_owner(cr, va.va_uid)) != 0) 716 return (err); 717 718 if (secpolicy_vnode_access2(cr, mvp, va.va_uid, va.va_mode, 719 VWRITE) != 0) { 720 return (EACCES); 721 } 722 } 723 return (priv_policy_va(cr, PRIV_SYS_MOUNT, allzone, EPERM, 724 NULL, KLPDARG_VNODE, mvp, (char *)NULL, KLPDARG_NOMORE)); 725 } 726 727 void 728 secpolicy_fs_mount_clearopts(cred_t *cr, struct vfs *vfsp) 729 { 730 boolean_t amsuper = HAS_ALLZONEPRIVS(cr); 731 732 /* 733 * check; if we don't have either "nosuid" or 734 * both "nosetuid" and "nodevices", then we add 735 * "nosuid"; this depends on how the current 736 * implementation works (it first checks nosuid). In a 737 * zone, a user with all zone privileges can mount with 738 * "setuid" but never with "devices". 739 */ 740 if (!vfs_optionisset(vfsp, MNTOPT_NOSUID, NULL) && 741 (!vfs_optionisset(vfsp, MNTOPT_NODEVICES, NULL) || 742 !vfs_optionisset(vfsp, MNTOPT_NOSETUID, NULL))) { 743 if (crgetzoneid(cr) == GLOBAL_ZONEID || !amsuper) 744 vfs_setmntopt(vfsp, MNTOPT_NOSUID, NULL, 0); 745 else 746 vfs_setmntopt(vfsp, MNTOPT_NODEVICES, NULL, 0); 747 } 748 /* 749 * If we're not the local super user, we set the "restrict" 750 * option to indicate to automountd that this mount should 751 * be handled with care. 752 */ 753 if (!amsuper) 754 vfs_setmntopt(vfsp, MNTOPT_RESTRICT, NULL, 0); 755 756 } 757 758 extern vnode_t *rootvp; 759 extern vfs_t *rootvfs; 760 761 int 762 secpolicy_fs_mount(cred_t *cr, vnode_t *mvp, struct vfs *vfsp) 763 { 764 boolean_t needoptchk; 765 int error; 766 767 /* 768 * If it's a remount, get the underlying mount point, 769 * except for the root where we use the rootvp. 770 */ 771 if ((vfsp->vfs_flag & VFS_REMOUNT) != 0) { 772 if (vfsp == rootvfs) 773 mvp = rootvp; 774 else 775 mvp = vfsp->vfs_vnodecovered; 776 } 777 778 error = secpolicy_fs_common(cr, mvp, vfsp, &needoptchk); 779 780 if (error == 0 && needoptchk) { 781 secpolicy_fs_mount_clearopts(cr, vfsp); 782 } 783 784 return (error); 785 } 786 787 /* 788 * Does the policy computations for "ownership" of a mount; 789 * here ownership is defined as the ability to "mount" 790 * the filesystem originally. The rootvfs doesn't cover any 791 * vnodes; we attribute its ownership to the rootvp. 792 */ 793 static int 794 secpolicy_fs_owner(cred_t *cr, const struct vfs *vfsp) 795 { 796 vnode_t *mvp; 797 798 if (vfsp == NULL) 799 mvp = NULL; 800 else if (vfsp == rootvfs) 801 mvp = rootvp; 802 else 803 mvp = vfsp->vfs_vnodecovered; 804 805 return (secpolicy_fs_common(cr, mvp, vfsp, NULL)); 806 } 807 808 int 809 secpolicy_fs_unmount(cred_t *cr, struct vfs *vfsp) 810 { 811 return (secpolicy_fs_owner(cr, vfsp)); 812 } 813 814 /* 815 * Quotas are a resource, but if one has the ability to mount a filesystem, he 816 * should be able to modify quotas on it. 817 */ 818 int 819 secpolicy_fs_quota(const cred_t *cr, const vfs_t *vfsp) 820 { 821 return (secpolicy_fs_owner((cred_t *)cr, vfsp)); 822 } 823 824 /* 825 * Exceeding minfree: also a per-mount resource constraint. 826 */ 827 int 828 secpolicy_fs_minfree(const cred_t *cr, const vfs_t *vfsp) 829 { 830 return (secpolicy_fs_owner((cred_t *)cr, vfsp)); 831 } 832 833 int 834 secpolicy_fs_config(const cred_t *cr, const vfs_t *vfsp) 835 { 836 return (secpolicy_fs_owner((cred_t *)cr, vfsp)); 837 } 838 839 /* ARGSUSED */ 840 int 841 secpolicy_fs_linkdir(const cred_t *cr, const vfs_t *vfsp) 842 { 843 return (PRIV_POLICY(cr, PRIV_SYS_LINKDIR, B_FALSE, EPERM, NULL)); 844 } 845 846 /* 847 * Name: secpolicy_vnode_access() 848 * 849 * Parameters: Process credential 850 * vnode 851 * uid of owner of vnode 852 * permission bits not granted to the caller when examining 853 * file mode bits (i.e., when a process wants to open a 854 * mode 444 file for VREAD|VWRITE, this function should be 855 * called only with a VWRITE argument). 856 * 857 * Normal: Verifies that cred has the appropriate privileges to 858 * override the mode bits that were denied. 859 * 860 * Override: file_dac_execute - if VEXEC bit was denied and vnode is 861 * not a directory. 862 * file_dac_read - if VREAD bit was denied. 863 * file_dac_search - if VEXEC bit was denied and vnode is 864 * a directory. 865 * file_dac_write - if VWRITE bit was denied. 866 * 867 * Root owned files are special cased to protect system 868 * configuration files and such. 869 * 870 * Output: EACCES - if privilege check fails. 871 */ 872 873 int 874 secpolicy_vnode_access(const cred_t *cr, vnode_t *vp, uid_t owner, mode_t mode) 875 { 876 if ((mode & VREAD) && priv_policy_va(cr, PRIV_FILE_DAC_READ, B_FALSE, 877 EACCES, NULL, KLPDARG_VNODE, vp, (char *)NULL, 878 KLPDARG_NOMORE) != 0) { 879 return (EACCES); 880 } 881 882 if (mode & VWRITE) { 883 boolean_t allzone; 884 885 if (owner == 0 && cr->cr_uid != 0) 886 allzone = B_TRUE; 887 else 888 allzone = B_FALSE; 889 if (priv_policy_va(cr, PRIV_FILE_DAC_WRITE, allzone, EACCES, 890 NULL, KLPDARG_VNODE, vp, (char *)NULL, 891 KLPDARG_NOMORE) != 0) { 892 return (EACCES); 893 } 894 } 895 896 if (mode & VEXEC) { 897 /* 898 * Directories use file_dac_search to override the execute bit. 899 */ 900 int p = vp->v_type == VDIR ? PRIV_FILE_DAC_SEARCH : 901 PRIV_FILE_DAC_EXECUTE; 902 903 return (priv_policy_va(cr, p, B_FALSE, EACCES, NULL, 904 KLPDARG_VNODE, vp, (char *)NULL, KLPDARG_NOMORE)); 905 } 906 return (0); 907 } 908 909 /* 910 * Like secpolicy_vnode_access() but we get the actual wanted mode and the 911 * current mode of the file, not the missing bits. 912 */ 913 int 914 secpolicy_vnode_access2(const cred_t *cr, vnode_t *vp, uid_t owner, 915 mode_t curmode, mode_t wantmode) 916 { 917 mode_t mode; 918 919 /* Inline the basic privileges tests. */ 920 if ((wantmode & VREAD) && 921 !PRIV_ISASSERT(&CR_OEPRIV(cr), PRIV_FILE_READ) && 922 priv_policy_va(cr, PRIV_FILE_READ, B_FALSE, EACCES, NULL, 923 KLPDARG_VNODE, vp, (char *)NULL, KLPDARG_NOMORE) != 0) { 924 return (EACCES); 925 } 926 927 if ((wantmode & VWRITE) && 928 !PRIV_ISASSERT(&CR_OEPRIV(cr), PRIV_FILE_WRITE) && 929 priv_policy_va(cr, PRIV_FILE_WRITE, B_FALSE, EACCES, NULL, 930 KLPDARG_VNODE, vp, (char *)NULL, KLPDARG_NOMORE) != 0) { 931 return (EACCES); 932 } 933 934 mode = ~curmode & wantmode; 935 936 if (mode == 0) 937 return (0); 938 939 if ((mode & VREAD) && priv_policy_va(cr, PRIV_FILE_DAC_READ, B_FALSE, 940 EACCES, NULL, KLPDARG_VNODE, vp, (char *)NULL, 941 KLPDARG_NOMORE) != 0) { 942 return (EACCES); 943 } 944 945 if (mode & VWRITE) { 946 boolean_t allzone; 947 948 if (owner == 0 && cr->cr_uid != 0) 949 allzone = B_TRUE; 950 else 951 allzone = B_FALSE; 952 if (priv_policy_va(cr, PRIV_FILE_DAC_WRITE, allzone, EACCES, 953 NULL, KLPDARG_VNODE, vp, (char *)NULL, 954 KLPDARG_NOMORE) != 0) { 955 return (EACCES); 956 } 957 } 958 959 if (mode & VEXEC) { 960 /* 961 * Directories use file_dac_search to override the execute bit. 962 */ 963 int p = vp->v_type == VDIR ? PRIV_FILE_DAC_SEARCH : 964 PRIV_FILE_DAC_EXECUTE; 965 966 return (priv_policy_va(cr, p, B_FALSE, EACCES, NULL, 967 KLPDARG_VNODE, vp, (char *)NULL, KLPDARG_NOMORE)); 968 } 969 return (0); 970 } 971 972 /* 973 * This is a special routine for ZFS; it is used to determine whether 974 * any of the privileges in effect allow any form of access to the 975 * file. There's no reason to audit this or any reason to record 976 * this. More work is needed to do the "KPLD" stuff. 977 */ 978 int 979 secpolicy_vnode_any_access(const cred_t *cr, vnode_t *vp, uid_t owner) 980 { 981 static int privs[] = { 982 PRIV_FILE_OWNER, 983 PRIV_FILE_DAC_READ, 984 PRIV_FILE_DAC_WRITE, 985 PRIV_FILE_DAC_EXECUTE, 986 PRIV_FILE_DAC_SEARCH, 987 }; 988 int i; 989 990 /* Same as secpolicy_vnode_setdac */ 991 if (owner == cr->cr_uid) 992 return (0); 993 994 for (i = 0; i < sizeof (privs)/sizeof (int); i++) { 995 boolean_t allzone = B_FALSE; 996 int priv; 997 998 switch (priv = privs[i]) { 999 case PRIV_FILE_DAC_EXECUTE: 1000 if (vp->v_type == VDIR) 1001 continue; 1002 break; 1003 case PRIV_FILE_DAC_SEARCH: 1004 if (vp->v_type != VDIR) 1005 continue; 1006 break; 1007 case PRIV_FILE_DAC_WRITE: 1008 case PRIV_FILE_OWNER: 1009 /* We know here that if owner == 0, that cr_uid != 0 */ 1010 allzone = owner == 0; 1011 break; 1012 } 1013 if (PRIV_POLICY_CHOICE(cr, priv, allzone)) 1014 return (0); 1015 } 1016 return (EPERM); 1017 } 1018 1019 /* 1020 * Name: secpolicy_vnode_setid_modify() 1021 * 1022 * Normal: verify that subject can set the file setid flags. 1023 * 1024 * Output: EPERM - if not privileged. 1025 */ 1026 1027 static int 1028 secpolicy_vnode_setid_modify(const cred_t *cr, uid_t owner) 1029 { 1030 /* If changing to suid root, must have all zone privs */ 1031 boolean_t allzone = B_TRUE; 1032 1033 if (owner != 0) { 1034 if (owner == cr->cr_uid) 1035 return (0); 1036 allzone = B_FALSE; 1037 } 1038 return (PRIV_POLICY(cr, PRIV_FILE_SETID, allzone, EPERM, NULL)); 1039 } 1040 1041 /* 1042 * Are we allowed to retain the set-uid/set-gid bits when 1043 * changing ownership or when writing to a file? 1044 * "issuid" should be true when set-uid; only in that case 1045 * root ownership is checked (setgid is assumed). 1046 */ 1047 int 1048 secpolicy_vnode_setid_retain(const cred_t *cred, boolean_t issuidroot) 1049 { 1050 if (issuidroot && !HAS_ALLZONEPRIVS(cred)) 1051 return (EPERM); 1052 1053 return (!PRIV_POLICY_CHOICE(cred, PRIV_FILE_SETID, B_FALSE)); 1054 } 1055 1056 /* 1057 * Name: secpolicy_vnode_setids_setgids() 1058 * 1059 * Normal: verify that subject can set the file setgid flag. 1060 * 1061 * Output: EPERM - if not privileged 1062 */ 1063 1064 int 1065 secpolicy_vnode_setids_setgids(const cred_t *cred, gid_t gid) 1066 { 1067 if (!groupmember(gid, cred)) 1068 return (PRIV_POLICY(cred, PRIV_FILE_SETID, B_FALSE, EPERM, 1069 NULL)); 1070 return (0); 1071 } 1072 1073 /* 1074 * Name: secpolicy_vnode_chown 1075 * 1076 * Normal: Determine if subject can chown owner of a file. 1077 * 1078 * Output: EPERM - if access denied 1079 */ 1080 1081 int 1082 secpolicy_vnode_chown(const cred_t *cred, uid_t owner) 1083 { 1084 boolean_t is_owner = (owner == crgetuid(cred)); 1085 boolean_t allzone = B_FALSE; 1086 int priv; 1087 1088 if (!is_owner) { 1089 allzone = (owner == 0); 1090 priv = PRIV_FILE_CHOWN; 1091 } else { 1092 priv = HAS_PRIVILEGE(cred, PRIV_FILE_CHOWN) ? 1093 PRIV_FILE_CHOWN : PRIV_FILE_CHOWN_SELF; 1094 } 1095 1096 return (PRIV_POLICY(cred, priv, allzone, EPERM, NULL)); 1097 } 1098 1099 /* 1100 * Name: secpolicy_vnode_create_gid 1101 * 1102 * Normal: Determine if subject can change group ownership of a file. 1103 * 1104 * Output: EPERM - if access denied 1105 */ 1106 int 1107 secpolicy_vnode_create_gid(const cred_t *cred) 1108 { 1109 if (HAS_PRIVILEGE(cred, PRIV_FILE_CHOWN)) 1110 return (PRIV_POLICY(cred, PRIV_FILE_CHOWN, B_FALSE, EPERM, 1111 NULL)); 1112 else 1113 return (PRIV_POLICY(cred, PRIV_FILE_CHOWN_SELF, B_FALSE, EPERM, 1114 NULL)); 1115 } 1116 1117 /* 1118 * Name: secpolicy_vnode_utime_modify() 1119 * 1120 * Normal: verify that subject can modify the utime on a file. 1121 * 1122 * Output: EPERM - if access denied. 1123 */ 1124 1125 static int 1126 secpolicy_vnode_utime_modify(const cred_t *cred) 1127 { 1128 return (PRIV_POLICY(cred, PRIV_FILE_OWNER, B_FALSE, EPERM, 1129 "modify file times")); 1130 } 1131 1132 1133 /* 1134 * Name: secpolicy_vnode_setdac() 1135 * 1136 * Normal: verify that subject can modify the mode of a file. 1137 * allzone privilege needed when modifying root owned object. 1138 * 1139 * Output: EPERM - if access denied. 1140 */ 1141 1142 int 1143 secpolicy_vnode_setdac(const cred_t *cred, uid_t owner) 1144 { 1145 if (owner == cred->cr_uid) 1146 return (0); 1147 1148 return (PRIV_POLICY(cred, PRIV_FILE_OWNER, owner == 0, EPERM, NULL)); 1149 } 1150 /* 1151 * Name: secpolicy_vnode_stky_modify() 1152 * 1153 * Normal: verify that subject can make a file a "sticky". 1154 * 1155 * Output: EPERM - if access denied. 1156 */ 1157 1158 int 1159 secpolicy_vnode_stky_modify(const cred_t *cred) 1160 { 1161 return (PRIV_POLICY(cred, PRIV_SYS_CONFIG, B_FALSE, EPERM, 1162 "set file sticky")); 1163 } 1164 1165 /* 1166 * Policy determines whether we can remove an entry from a directory, 1167 * regardless of permission bits. 1168 */ 1169 int 1170 secpolicy_vnode_remove(const cred_t *cr) 1171 { 1172 return (PRIV_POLICY(cr, PRIV_FILE_OWNER, B_FALSE, EACCES, 1173 "sticky directory")); 1174 } 1175 1176 int 1177 secpolicy_vnode_owner(const cred_t *cr, uid_t owner) 1178 { 1179 boolean_t allzone = (owner == 0); 1180 1181 if (owner == cr->cr_uid) 1182 return (0); 1183 1184 return (PRIV_POLICY(cr, PRIV_FILE_OWNER, allzone, EPERM, NULL)); 1185 } 1186 1187 void 1188 secpolicy_setid_clear(vattr_t *vap, cred_t *cr) 1189 { 1190 if ((vap->va_mode & (S_ISUID | S_ISGID)) != 0 && 1191 secpolicy_vnode_setid_retain(cr, 1192 (vap->va_mode & S_ISUID) != 0 && 1193 (vap->va_mask & AT_UID) != 0 && vap->va_uid == 0) != 0) { 1194 vap->va_mask |= AT_MODE; 1195 vap->va_mode &= ~(S_ISUID|S_ISGID); 1196 } 1197 } 1198 1199 int 1200 secpolicy_setid_setsticky_clear(vnode_t *vp, vattr_t *vap, const vattr_t *ovap, 1201 cred_t *cr) 1202 { 1203 int error; 1204 1205 if ((vap->va_mode & S_ISUID) != 0 && 1206 (error = secpolicy_vnode_setid_modify(cr, 1207 ovap->va_uid)) != 0) { 1208 return (error); 1209 } 1210 1211 /* 1212 * Check privilege if attempting to set the 1213 * sticky bit on a non-directory. 1214 */ 1215 if (vp->v_type != VDIR && (vap->va_mode & S_ISVTX) != 0 && 1216 secpolicy_vnode_stky_modify(cr) != 0) { 1217 vap->va_mode &= ~S_ISVTX; 1218 } 1219 1220 /* 1221 * Check for privilege if attempting to set the 1222 * group-id bit. 1223 */ 1224 if ((vap->va_mode & S_ISGID) != 0 && 1225 secpolicy_vnode_setids_setgids(cr, ovap->va_gid) != 0) { 1226 vap->va_mode &= ~S_ISGID; 1227 } 1228 1229 return (0); 1230 } 1231 1232 #define ATTR_FLAG_PRIV(attr, value, cr) \ 1233 PRIV_POLICY(cr, value ? PRIV_FILE_FLAG_SET : PRIV_ALL, \ 1234 B_FALSE, EPERM, NULL) 1235 1236 /* 1237 * Check privileges for setting xvattr attributes 1238 */ 1239 int 1240 secpolicy_xvattr(xvattr_t *xvap, uid_t owner, cred_t *cr, vtype_t vtype) 1241 { 1242 xoptattr_t *xoap; 1243 int error = 0; 1244 1245 if ((xoap = xva_getxoptattr(xvap)) == NULL) 1246 return (EINVAL); 1247 1248 /* 1249 * First process the DOS bits 1250 */ 1251 if (XVA_ISSET_REQ(xvap, XAT_ARCHIVE) || 1252 XVA_ISSET_REQ(xvap, XAT_HIDDEN) || 1253 XVA_ISSET_REQ(xvap, XAT_READONLY) || 1254 XVA_ISSET_REQ(xvap, XAT_SYSTEM) || 1255 XVA_ISSET_REQ(xvap, XAT_CREATETIME)) { 1256 if ((error = secpolicy_vnode_owner(cr, owner)) != 0) 1257 return (error); 1258 } 1259 1260 /* 1261 * Now handle special attributes 1262 */ 1263 1264 if (XVA_ISSET_REQ(xvap, XAT_IMMUTABLE)) 1265 error = ATTR_FLAG_PRIV(XAT_IMMUTABLE, 1266 xoap->xoa_immutable, cr); 1267 if (error == 0 && XVA_ISSET_REQ(xvap, XAT_NOUNLINK)) 1268 error = ATTR_FLAG_PRIV(XAT_NOUNLINK, 1269 xoap->xoa_nounlink, cr); 1270 if (error == 0 && XVA_ISSET_REQ(xvap, XAT_APPENDONLY)) 1271 error = ATTR_FLAG_PRIV(XAT_APPENDONLY, 1272 xoap->xoa_appendonly, cr); 1273 if (error == 0 && XVA_ISSET_REQ(xvap, XAT_NODUMP)) 1274 error = ATTR_FLAG_PRIV(XAT_NODUMP, 1275 xoap->xoa_nodump, cr); 1276 if (error == 0 && XVA_ISSET_REQ(xvap, XAT_OPAQUE)) 1277 error = EPERM; 1278 if (error == 0 && XVA_ISSET_REQ(xvap, XAT_AV_QUARANTINED)) { 1279 error = ATTR_FLAG_PRIV(XAT_AV_QUARANTINED, 1280 xoap->xoa_av_quarantined, cr); 1281 if (error == 0 && vtype != VREG && xoap->xoa_av_quarantined) 1282 error = EINVAL; 1283 } 1284 if (error == 0 && XVA_ISSET_REQ(xvap, XAT_AV_MODIFIED)) 1285 error = ATTR_FLAG_PRIV(XAT_AV_MODIFIED, 1286 xoap->xoa_av_modified, cr); 1287 if (error == 0 && XVA_ISSET_REQ(xvap, XAT_AV_SCANSTAMP)) { 1288 error = ATTR_FLAG_PRIV(XAT_AV_SCANSTAMP, 1289 xoap->xoa_av_scanstamp, cr); 1290 if (error == 0 && vtype != VREG) 1291 error = EINVAL; 1292 } 1293 return (error); 1294 } 1295 1296 /* 1297 * This function checks the policy decisions surrounding the 1298 * vop setattr call. 1299 * 1300 * It should be called after sufficient locks have been established 1301 * on the underlying data structures. No concurrent modifications 1302 * should be allowed. 1303 * 1304 * The caller must pass in unlocked version of its vaccess function 1305 * this is required because vop_access function should lock the 1306 * node for reading. A three argument function should be defined 1307 * which accepts the following argument: 1308 * A pointer to the internal "node" type (inode *) 1309 * vnode access bits (VREAD|VWRITE|VEXEC) 1310 * a pointer to the credential 1311 * 1312 * This function makes the following policy decisions: 1313 * 1314 * - change permissions 1315 * - permission to change file mode if not owner 1316 * - permission to add sticky bit to non-directory 1317 * - permission to add set-gid bit 1318 * 1319 * The ovap argument should include AT_MODE|AT_UID|AT_GID. 1320 * 1321 * If the vap argument does not include AT_MODE, the mode will be copied from 1322 * ovap. In certain situations set-uid/set-gid bits need to be removed; 1323 * this is done by marking vap->va_mask to include AT_MODE and va_mode 1324 * is updated to the newly computed mode. 1325 */ 1326 1327 int 1328 secpolicy_vnode_setattr(cred_t *cr, struct vnode *vp, struct vattr *vap, 1329 const struct vattr *ovap, int flags, 1330 int unlocked_access(void *, int, cred_t *), 1331 void *node) 1332 { 1333 int mask = vap->va_mask; 1334 int error = 0; 1335 boolean_t skipaclchk = (flags & ATTR_NOACLCHECK) ? B_TRUE : B_FALSE; 1336 1337 if (mask & AT_SIZE) { 1338 if (vp->v_type == VDIR) { 1339 error = EISDIR; 1340 goto out; 1341 } 1342 1343 /* 1344 * If ATTR_NOACLCHECK is set in the flags, then we don't 1345 * perform the secondary unlocked_access() call since the 1346 * ACL (if any) is being checked there. 1347 */ 1348 if (skipaclchk == B_FALSE) { 1349 error = unlocked_access(node, VWRITE, cr); 1350 if (error) 1351 goto out; 1352 } 1353 } 1354 if (mask & AT_MODE) { 1355 /* 1356 * If not the owner of the file then check privilege 1357 * for two things: the privilege to set the mode at all 1358 * and, if we're setting setuid, we also need permissions 1359 * to add the set-uid bit, if we're not the owner. 1360 * In the specific case of creating a set-uid root 1361 * file, we need even more permissions. 1362 */ 1363 if ((error = secpolicy_vnode_setdac(cr, ovap->va_uid)) != 0) 1364 goto out; 1365 1366 if ((error = secpolicy_setid_setsticky_clear(vp, vap, 1367 ovap, cr)) != 0) 1368 goto out; 1369 } else 1370 vap->va_mode = ovap->va_mode; 1371 1372 if (mask & (AT_UID|AT_GID)) { 1373 boolean_t checkpriv = B_FALSE; 1374 1375 /* 1376 * Chowning files. 1377 * 1378 * If you are the file owner: 1379 * chown to other uid FILE_CHOWN_SELF 1380 * chown to gid (non-member) FILE_CHOWN_SELF 1381 * chown to gid (member) <none> 1382 * 1383 * Instead of PRIV_FILE_CHOWN_SELF, FILE_CHOWN is also 1384 * acceptable but the first one is reported when debugging. 1385 * 1386 * If you are not the file owner: 1387 * chown from root PRIV_FILE_CHOWN + zone 1388 * chown from other to any PRIV_FILE_CHOWN 1389 * 1390 */ 1391 if (cr->cr_uid != ovap->va_uid) { 1392 checkpriv = B_TRUE; 1393 } else { 1394 if (((mask & AT_UID) && vap->va_uid != ovap->va_uid) || 1395 ((mask & AT_GID) && vap->va_gid != ovap->va_gid && 1396 !groupmember(vap->va_gid, cr))) { 1397 checkpriv = B_TRUE; 1398 } 1399 } 1400 /* 1401 * If necessary, check privilege to see if update can be done. 1402 */ 1403 if (checkpriv && 1404 (error = secpolicy_vnode_chown(cr, ovap->va_uid)) != 0) { 1405 goto out; 1406 } 1407 1408 /* 1409 * If the file has either the set UID or set GID bits 1410 * set and the caller can set the bits, then leave them. 1411 */ 1412 secpolicy_setid_clear(vap, cr); 1413 } 1414 if (mask & (AT_ATIME|AT_MTIME)) { 1415 /* 1416 * If not the file owner and not otherwise privileged, 1417 * always return an error when setting the 1418 * time other than the current (ATTR_UTIME flag set). 1419 * If setting the current time (ATTR_UTIME not set) then 1420 * unlocked_access will check permissions according to policy. 1421 */ 1422 if (cr->cr_uid != ovap->va_uid) { 1423 if (flags & ATTR_UTIME) 1424 error = secpolicy_vnode_utime_modify(cr); 1425 else if (skipaclchk == B_FALSE) { 1426 error = unlocked_access(node, VWRITE, cr); 1427 if (error == EACCES && 1428 secpolicy_vnode_utime_modify(cr) == 0) 1429 error = 0; 1430 } 1431 if (error) 1432 goto out; 1433 } 1434 } 1435 1436 /* 1437 * Check for optional attributes here by checking the following: 1438 */ 1439 if (mask & AT_XVATTR) 1440 error = secpolicy_xvattr((xvattr_t *)vap, ovap->va_uid, cr, 1441 vp->v_type); 1442 out: 1443 return (error); 1444 } 1445 1446 /* 1447 * Name: secpolicy_pcfs_modify_bootpartition() 1448 * 1449 * Normal: verify that subject can modify a pcfs boot partition. 1450 * 1451 * Output: EACCES - if privilege check failed. 1452 */ 1453 /*ARGSUSED*/ 1454 int 1455 secpolicy_pcfs_modify_bootpartition(const cred_t *cred) 1456 { 1457 return (PRIV_POLICY(cred, PRIV_ALL, B_FALSE, EACCES, 1458 "modify pcfs boot partition")); 1459 } 1460 1461 /* 1462 * System V IPC routines 1463 */ 1464 int 1465 secpolicy_ipc_owner(const cred_t *cr, const struct kipc_perm *ip) 1466 { 1467 if (crgetzoneid(cr) != ip->ipc_zoneid || 1468 (cr->cr_uid != ip->ipc_uid && cr->cr_uid != ip->ipc_cuid)) { 1469 boolean_t allzone = B_FALSE; 1470 if (ip->ipc_uid == 0 || ip->ipc_cuid == 0) 1471 allzone = B_TRUE; 1472 return (PRIV_POLICY(cr, PRIV_IPC_OWNER, allzone, EPERM, NULL)); 1473 } 1474 return (0); 1475 } 1476 1477 int 1478 secpolicy_ipc_config(const cred_t *cr) 1479 { 1480 return (PRIV_POLICY(cr, PRIV_SYS_IPC_CONFIG, B_FALSE, EPERM, NULL)); 1481 } 1482 1483 int 1484 secpolicy_ipc_access(const cred_t *cr, const struct kipc_perm *ip, mode_t mode) 1485 { 1486 1487 boolean_t allzone = B_FALSE; 1488 1489 ASSERT((mode & (MSG_R|MSG_W)) != 0); 1490 1491 if ((mode & MSG_R) && 1492 PRIV_POLICY(cr, PRIV_IPC_DAC_READ, allzone, EACCES, NULL) != 0) 1493 return (EACCES); 1494 1495 if (mode & MSG_W) { 1496 if (cr->cr_uid != 0 && (ip->ipc_uid == 0 || ip->ipc_cuid == 0)) 1497 allzone = B_TRUE; 1498 1499 return (PRIV_POLICY(cr, PRIV_IPC_DAC_WRITE, allzone, EACCES, 1500 NULL)); 1501 } 1502 return (0); 1503 } 1504 1505 int 1506 secpolicy_rsm_access(const cred_t *cr, uid_t owner, mode_t mode) 1507 { 1508 boolean_t allzone = B_FALSE; 1509 1510 ASSERT((mode & (MSG_R|MSG_W)) != 0); 1511 1512 if ((mode & MSG_R) && 1513 PRIV_POLICY(cr, PRIV_IPC_DAC_READ, allzone, EACCES, NULL) != 0) 1514 return (EACCES); 1515 1516 if (mode & MSG_W) { 1517 if (cr->cr_uid != 0 && owner == 0) 1518 allzone = B_TRUE; 1519 1520 return (PRIV_POLICY(cr, PRIV_IPC_DAC_WRITE, allzone, EACCES, 1521 NULL)); 1522 } 1523 return (0); 1524 } 1525 1526 /* 1527 * Audit configuration. 1528 */ 1529 int 1530 secpolicy_audit_config(const cred_t *cr) 1531 { 1532 return (PRIV_POLICY(cr, PRIV_SYS_AUDIT, B_FALSE, EPERM, NULL)); 1533 } 1534 1535 /* 1536 * Audit record generation. 1537 */ 1538 int 1539 secpolicy_audit_modify(const cred_t *cr) 1540 { 1541 return (PRIV_POLICY(cr, PRIV_PROC_AUDIT, B_FALSE, EPERM, NULL)); 1542 } 1543 1544 /* 1545 * Get audit attributes. 1546 * Either PRIV_SYS_AUDIT or PRIV_PROC_AUDIT required; report the 1547 * "Least" of the two privileges on error. 1548 */ 1549 int 1550 secpolicy_audit_getattr(const cred_t *cr, boolean_t checkonly) 1551 { 1552 int priv; 1553 1554 if (PRIV_POLICY_ONLY(cr, PRIV_SYS_AUDIT, B_FALSE)) 1555 priv = PRIV_SYS_AUDIT; 1556 else 1557 priv = PRIV_PROC_AUDIT; 1558 1559 if (checkonly) 1560 return (!PRIV_POLICY_ONLY(cr, priv, B_FALSE)); 1561 else 1562 return (PRIV_POLICY(cr, priv, B_FALSE, EPERM, NULL)); 1563 } 1564 1565 1566 /* 1567 * Locking physical memory 1568 */ 1569 int 1570 secpolicy_lock_memory(const cred_t *cr) 1571 { 1572 return (PRIV_POLICY(cr, PRIV_PROC_LOCK_MEMORY, B_FALSE, EPERM, NULL)); 1573 } 1574 1575 /* 1576 * Accounting (both acct(2) and exacct). 1577 */ 1578 int 1579 secpolicy_acct(const cred_t *cr) 1580 { 1581 return (PRIV_POLICY(cr, PRIV_SYS_ACCT, B_FALSE, EPERM, NULL)); 1582 } 1583 1584 /* 1585 * Is this process privileged to change its uids at will? 1586 * Uid 0 is still considered "special" and having the SETID 1587 * privilege is not sufficient to get uid 0. 1588 * Files are owned by root, so the privilege would give 1589 * full access and euid 0 is still effective. 1590 * 1591 * If you have the privilege and euid 0 only then do you 1592 * get the powers of root wrt uid 0. 1593 * 1594 * For gid manipulations, this is should be called with an 1595 * uid of -1. 1596 * 1597 */ 1598 int 1599 secpolicy_allow_setid(const cred_t *cr, uid_t newuid, boolean_t checkonly) 1600 { 1601 boolean_t allzone = B_FALSE; 1602 1603 if (newuid == 0 && cr->cr_uid != 0 && cr->cr_suid != 0 && 1604 cr->cr_ruid != 0) { 1605 allzone = B_TRUE; 1606 } 1607 1608 return (checkonly ? !PRIV_POLICY_ONLY(cr, PRIV_PROC_SETID, allzone) : 1609 PRIV_POLICY(cr, PRIV_PROC_SETID, allzone, EPERM, NULL)); 1610 } 1611 1612 1613 /* 1614 * Acting on a different process: if the mode is for writing, 1615 * the restrictions are more severe. This is called after 1616 * we've verified that the uids do not match. 1617 */ 1618 int 1619 secpolicy_proc_owner(const cred_t *scr, const cred_t *tcr, int mode) 1620 { 1621 boolean_t allzone = B_FALSE; 1622 1623 if ((mode & VWRITE) && scr->cr_uid != 0 && 1624 (tcr->cr_uid == 0 || tcr->cr_ruid == 0 || tcr->cr_suid == 0)) 1625 allzone = B_TRUE; 1626 1627 return (PRIV_POLICY(scr, PRIV_PROC_OWNER, allzone, EPERM, NULL)); 1628 } 1629 1630 int 1631 secpolicy_proc_access(const cred_t *scr) 1632 { 1633 return (PRIV_POLICY(scr, PRIV_PROC_OWNER, B_FALSE, EACCES, NULL)); 1634 } 1635 1636 int 1637 secpolicy_proc_excl_open(const cred_t *scr) 1638 { 1639 return (PRIV_POLICY(scr, PRIV_PROC_OWNER, B_FALSE, EBUSY, NULL)); 1640 } 1641 1642 int 1643 secpolicy_proc_zone(const cred_t *scr) 1644 { 1645 return (PRIV_POLICY(scr, PRIV_PROC_ZONE, B_FALSE, EPERM, NULL)); 1646 } 1647 1648 /* 1649 * Destroying the system 1650 */ 1651 1652 int 1653 secpolicy_kmdb(const cred_t *scr) 1654 { 1655 return (PRIV_POLICY(scr, PRIV_ALL, B_FALSE, EPERM, NULL)); 1656 } 1657 1658 int 1659 secpolicy_error_inject(const cred_t *scr) 1660 { 1661 return (PRIV_POLICY(scr, PRIV_ALL, B_FALSE, EPERM, NULL)); 1662 } 1663 1664 /* 1665 * Processor sets, cpu configuration, resource pools. 1666 */ 1667 int 1668 secpolicy_pset(const cred_t *cr) 1669 { 1670 return (PRIV_POLICY(cr, PRIV_SYS_RES_CONFIG, B_FALSE, EPERM, NULL)); 1671 } 1672 1673 int 1674 secpolicy_ponline(const cred_t *cr) 1675 { 1676 return (PRIV_POLICY(cr, PRIV_SYS_RES_CONFIG, B_FALSE, EPERM, NULL)); 1677 } 1678 1679 int 1680 secpolicy_pool(const cred_t *cr) 1681 { 1682 return (PRIV_POLICY(cr, PRIV_SYS_RES_CONFIG, B_FALSE, EPERM, NULL)); 1683 } 1684 1685 int 1686 secpolicy_blacklist(const cred_t *cr) 1687 { 1688 return (PRIV_POLICY(cr, PRIV_SYS_RES_CONFIG, B_FALSE, EPERM, NULL)); 1689 } 1690 1691 /* 1692 * Catch all system configuration. 1693 */ 1694 int 1695 secpolicy_sys_config(const cred_t *cr, boolean_t checkonly) 1696 { 1697 if (checkonly) { 1698 return (PRIV_POLICY_ONLY(cr, PRIV_SYS_CONFIG, B_FALSE) ? 0 : 1699 EPERM); 1700 } else { 1701 return (PRIV_POLICY(cr, PRIV_SYS_CONFIG, B_FALSE, EPERM, NULL)); 1702 } 1703 } 1704 1705 /* 1706 * Zone administration (halt, reboot, etc.) from within zone. 1707 */ 1708 int 1709 secpolicy_zone_admin(const cred_t *cr, boolean_t checkonly) 1710 { 1711 if (checkonly) { 1712 return (PRIV_POLICY_ONLY(cr, PRIV_SYS_ADMIN, B_FALSE) ? 0 : 1713 EPERM); 1714 } else { 1715 return (PRIV_POLICY(cr, PRIV_SYS_ADMIN, B_FALSE, EPERM, 1716 NULL)); 1717 } 1718 } 1719 1720 /* 1721 * Zone configuration (create, halt, enter). 1722 */ 1723 int 1724 secpolicy_zone_config(const cred_t *cr) 1725 { 1726 /* 1727 * Require all privileges to avoid possibility of privilege 1728 * escalation. 1729 */ 1730 return (secpolicy_require_set(cr, PRIV_FULLSET, NULL, KLPDARG_NONE)); 1731 } 1732 1733 /* 1734 * Various other system configuration calls 1735 */ 1736 int 1737 secpolicy_coreadm(const cred_t *cr) 1738 { 1739 return (PRIV_POLICY(cr, PRIV_SYS_ADMIN, B_FALSE, EPERM, NULL)); 1740 } 1741 1742 int 1743 secpolicy_systeminfo(const cred_t *cr) 1744 { 1745 return (PRIV_POLICY(cr, PRIV_SYS_ADMIN, B_FALSE, EPERM, NULL)); 1746 } 1747 1748 int 1749 secpolicy_dispadm(const cred_t *cr) 1750 { 1751 return (PRIV_POLICY(cr, PRIV_SYS_CONFIG, B_FALSE, EPERM, NULL)); 1752 } 1753 1754 int 1755 secpolicy_settime(const cred_t *cr) 1756 { 1757 return (PRIV_POLICY(cr, PRIV_SYS_TIME, B_FALSE, EPERM, NULL)); 1758 } 1759 1760 /* 1761 * For realtime users: high resolution clock. 1762 */ 1763 int 1764 secpolicy_clock_highres(const cred_t *cr) 1765 { 1766 return (PRIV_POLICY(cr, PRIV_PROC_CLOCK_HIGHRES, B_FALSE, EPERM, 1767 NULL)); 1768 } 1769 1770 /* 1771 * drv_priv() is documented as callable from interrupt context, not that 1772 * anyone ever does, but still. No debugging or auditing can be done when 1773 * it is called from interrupt context. 1774 * returns 0 on succes, EPERM on failure. 1775 */ 1776 int 1777 drv_priv(cred_t *cr) 1778 { 1779 return (PRIV_POLICY(cr, PRIV_SYS_DEVICES, B_FALSE, EPERM, NULL)); 1780 } 1781 1782 int 1783 secpolicy_sys_devices(const cred_t *cr) 1784 { 1785 return (PRIV_POLICY(cr, PRIV_SYS_DEVICES, B_FALSE, EPERM, NULL)); 1786 } 1787 1788 int 1789 secpolicy_excl_open(const cred_t *cr) 1790 { 1791 return (PRIV_POLICY(cr, PRIV_SYS_DEVICES, B_FALSE, EBUSY, NULL)); 1792 } 1793 1794 int 1795 secpolicy_rctlsys(const cred_t *cr, boolean_t is_zone_rctl) 1796 { 1797 /* zone.* rctls can only be set from the global zone */ 1798 if (is_zone_rctl && priv_policy_global(cr) != 0) 1799 return (EPERM); 1800 return (PRIV_POLICY(cr, PRIV_SYS_RESOURCE, B_FALSE, EPERM, NULL)); 1801 } 1802 1803 int 1804 secpolicy_resource(const cred_t *cr) 1805 { 1806 return (PRIV_POLICY(cr, PRIV_SYS_RESOURCE, B_FALSE, EPERM, NULL)); 1807 } 1808 1809 int 1810 secpolicy_resource_anon_mem(const cred_t *cr) 1811 { 1812 return (PRIV_POLICY_ONLY(cr, PRIV_SYS_RESOURCE, B_FALSE)); 1813 } 1814 1815 /* 1816 * Processes with a real uid of 0 escape any form of accounting, much 1817 * like before. 1818 */ 1819 int 1820 secpolicy_newproc(const cred_t *cr) 1821 { 1822 if (cr->cr_ruid == 0) 1823 return (0); 1824 1825 return (PRIV_POLICY(cr, PRIV_SYS_RESOURCE, B_FALSE, EPERM, NULL)); 1826 } 1827 1828 /* 1829 * Networking 1830 */ 1831 int 1832 secpolicy_net_rawaccess(const cred_t *cr) 1833 { 1834 return (PRIV_POLICY(cr, PRIV_NET_RAWACCESS, B_FALSE, EACCES, NULL)); 1835 } 1836 1837 int 1838 secpolicy_net_observability(const cred_t *cr) 1839 { 1840 return (PRIV_POLICY(cr, PRIV_NET_OBSERVABILITY, B_FALSE, EACCES, NULL)); 1841 } 1842 1843 /* 1844 * Need this privilege for accessing the ICMP device 1845 */ 1846 int 1847 secpolicy_net_icmpaccess(const cred_t *cr) 1848 { 1849 return (PRIV_POLICY(cr, PRIV_NET_ICMPACCESS, B_FALSE, EACCES, NULL)); 1850 } 1851 1852 /* 1853 * There are a few rare cases where the kernel generates ioctls() from 1854 * interrupt context with a credential of kcred rather than NULL. 1855 * In those cases, we take the safe and cheap test. 1856 */ 1857 int 1858 secpolicy_net_config(const cred_t *cr, boolean_t checkonly) 1859 { 1860 if (checkonly) { 1861 return (PRIV_POLICY_ONLY(cr, PRIV_SYS_NET_CONFIG, B_FALSE) ? 1862 0 : EPERM); 1863 } else { 1864 return (PRIV_POLICY(cr, PRIV_SYS_NET_CONFIG, B_FALSE, EPERM, 1865 NULL)); 1866 } 1867 } 1868 1869 1870 /* 1871 * PRIV_SYS_NET_CONFIG is a superset of PRIV_SYS_IP_CONFIG. 1872 * 1873 * There are a few rare cases where the kernel generates ioctls() from 1874 * interrupt context with a credential of kcred rather than NULL. 1875 * In those cases, we take the safe and cheap test. 1876 */ 1877 int 1878 secpolicy_ip_config(const cred_t *cr, boolean_t checkonly) 1879 { 1880 if (PRIV_POLICY_ONLY(cr, PRIV_SYS_NET_CONFIG, B_FALSE)) 1881 return (secpolicy_net_config(cr, checkonly)); 1882 1883 if (checkonly) { 1884 return (PRIV_POLICY_ONLY(cr, PRIV_SYS_IP_CONFIG, B_FALSE) ? 1885 0 : EPERM); 1886 } else { 1887 return (PRIV_POLICY(cr, PRIV_SYS_IP_CONFIG, B_FALSE, EPERM, 1888 NULL)); 1889 } 1890 } 1891 1892 /* 1893 * PRIV_SYS_NET_CONFIG is a superset of PRIV_SYS_DL_CONFIG. 1894 */ 1895 int 1896 secpolicy_dl_config(const cred_t *cr) 1897 { 1898 if (PRIV_POLICY_ONLY(cr, PRIV_SYS_NET_CONFIG, B_FALSE)) 1899 return (secpolicy_net_config(cr, B_FALSE)); 1900 return (PRIV_POLICY(cr, PRIV_SYS_DL_CONFIG, B_FALSE, EPERM, NULL)); 1901 } 1902 1903 /* 1904 * PRIV_SYS_DL_CONFIG is a superset of PRIV_SYS_IPTUN_CONFIG. 1905 */ 1906 int 1907 secpolicy_iptun_config(const cred_t *cr) 1908 { 1909 if (PRIV_POLICY_ONLY(cr, PRIV_SYS_NET_CONFIG, B_FALSE)) 1910 return (secpolicy_net_config(cr, B_FALSE)); 1911 if (PRIV_POLICY_ONLY(cr, PRIV_SYS_DL_CONFIG, B_FALSE)) 1912 return (secpolicy_dl_config(cr)); 1913 return (PRIV_POLICY(cr, PRIV_SYS_IPTUN_CONFIG, B_FALSE, EPERM, NULL)); 1914 } 1915 1916 /* 1917 * Map IP pseudo privileges to actual privileges. 1918 * So we don't need to recompile IP when we change the privileges. 1919 */ 1920 int 1921 secpolicy_ip(const cred_t *cr, int netpriv, boolean_t checkonly) 1922 { 1923 int priv = PRIV_ALL; 1924 1925 switch (netpriv) { 1926 case OP_CONFIG: 1927 priv = PRIV_SYS_IP_CONFIG; 1928 break; 1929 case OP_RAW: 1930 priv = PRIV_NET_RAWACCESS; 1931 break; 1932 case OP_PRIVPORT: 1933 priv = PRIV_NET_PRIVADDR; 1934 break; 1935 } 1936 ASSERT(priv != PRIV_ALL); 1937 if (checkonly) 1938 return (PRIV_POLICY_ONLY(cr, priv, B_FALSE) ? 0 : EPERM); 1939 else 1940 return (PRIV_POLICY(cr, priv, B_FALSE, EPERM, NULL)); 1941 } 1942 1943 /* 1944 * Map network pseudo privileges to actual privileges. 1945 * So we don't need to recompile IP when we change the privileges. 1946 */ 1947 int 1948 secpolicy_net(const cred_t *cr, int netpriv, boolean_t checkonly) 1949 { 1950 int priv = PRIV_ALL; 1951 1952 switch (netpriv) { 1953 case OP_CONFIG: 1954 priv = PRIV_SYS_NET_CONFIG; 1955 break; 1956 case OP_RAW: 1957 priv = PRIV_NET_RAWACCESS; 1958 break; 1959 case OP_PRIVPORT: 1960 priv = PRIV_NET_PRIVADDR; 1961 break; 1962 } 1963 ASSERT(priv != PRIV_ALL); 1964 if (checkonly) 1965 return (PRIV_POLICY_ONLY(cr, priv, B_FALSE) ? 0 : EPERM); 1966 else 1967 return (PRIV_POLICY(cr, priv, B_FALSE, EPERM, NULL)); 1968 } 1969 1970 /* 1971 * Checks for operations that are either client-only or are used by 1972 * both clients and servers. 1973 */ 1974 int 1975 secpolicy_nfs(const cred_t *cr) 1976 { 1977 return (PRIV_POLICY(cr, PRIV_SYS_NFS, B_FALSE, EPERM, NULL)); 1978 } 1979 1980 /* 1981 * Special case for opening rpcmod: have NFS privileges or network 1982 * config privileges. 1983 */ 1984 int 1985 secpolicy_rpcmod_open(const cred_t *cr) 1986 { 1987 if (PRIV_POLICY_ONLY(cr, PRIV_SYS_NFS, B_FALSE)) 1988 return (secpolicy_nfs(cr)); 1989 else 1990 return (secpolicy_net_config(cr, NULL)); 1991 } 1992 1993 int 1994 secpolicy_chroot(const cred_t *cr) 1995 { 1996 return (PRIV_POLICY(cr, PRIV_PROC_CHROOT, B_FALSE, EPERM, NULL)); 1997 } 1998 1999 int 2000 secpolicy_tasksys(const cred_t *cr) 2001 { 2002 return (PRIV_POLICY(cr, PRIV_PROC_TASKID, B_FALSE, EPERM, NULL)); 2003 } 2004 2005 int 2006 secpolicy_pfexec_register(const cred_t *cr) 2007 { 2008 return (PRIV_POLICY(cr, PRIV_SYS_ADMIN, B_TRUE, EPERM, NULL)); 2009 } 2010 2011 /* 2012 * Basic privilege checks. 2013 */ 2014 int 2015 secpolicy_basic_exec(const cred_t *cr, vnode_t *vp) 2016 { 2017 FAST_BASIC_CHECK(cr, PRIV_PROC_EXEC); 2018 2019 return (priv_policy_va(cr, PRIV_PROC_EXEC, B_FALSE, EPERM, NULL, 2020 KLPDARG_VNODE, vp, (char *)NULL, KLPDARG_NOMORE)); 2021 } 2022 2023 int 2024 secpolicy_basic_fork(const cred_t *cr) 2025 { 2026 FAST_BASIC_CHECK(cr, PRIV_PROC_FORK); 2027 2028 return (PRIV_POLICY(cr, PRIV_PROC_FORK, B_FALSE, EPERM, NULL)); 2029 } 2030 2031 int 2032 secpolicy_basic_proc(const cred_t *cr) 2033 { 2034 FAST_BASIC_CHECK(cr, PRIV_PROC_SESSION); 2035 2036 return (PRIV_POLICY(cr, PRIV_PROC_SESSION, B_FALSE, EPERM, NULL)); 2037 } 2038 2039 /* 2040 * Slightly complicated because we don't want to trigger the policy too 2041 * often. First we shortcircuit access to "self" (tp == sp) or if 2042 * we don't have the privilege but if we have permission 2043 * just return (0) and we don't flag the privilege as needed. 2044 * Else, we test for the privilege because we either have it or need it. 2045 */ 2046 int 2047 secpolicy_basic_procinfo(const cred_t *cr, proc_t *tp, proc_t *sp) 2048 { 2049 if (tp == sp || 2050 !HAS_PRIVILEGE(cr, PRIV_PROC_INFO) && prochasprocperm(tp, sp, cr)) { 2051 return (0); 2052 } else { 2053 return (PRIV_POLICY(cr, PRIV_PROC_INFO, B_FALSE, EPERM, NULL)); 2054 } 2055 } 2056 2057 int 2058 secpolicy_basic_link(const cred_t *cr) 2059 { 2060 FAST_BASIC_CHECK(cr, PRIV_FILE_LINK_ANY); 2061 2062 return (PRIV_POLICY(cr, PRIV_FILE_LINK_ANY, B_FALSE, EPERM, NULL)); 2063 } 2064 2065 int 2066 secpolicy_basic_net_access(const cred_t *cr) 2067 { 2068 FAST_BASIC_CHECK(cr, PRIV_NET_ACCESS); 2069 2070 return (PRIV_POLICY(cr, PRIV_NET_ACCESS, B_FALSE, EACCES, NULL)); 2071 } 2072 2073 /* ARGSUSED */ 2074 int 2075 secpolicy_basic_file_read(const cred_t *cr, vnode_t *vp, const char *pn) 2076 { 2077 FAST_BASIC_CHECK(cr, PRIV_FILE_READ); 2078 2079 return (priv_policy_va(cr, PRIV_FILE_READ, B_FALSE, EACCES, NULL, 2080 KLPDARG_VNODE, vp, (char *)pn, KLPDARG_NOMORE)); 2081 } 2082 2083 /* ARGSUSED */ 2084 int 2085 secpolicy_basic_file_write(const cred_t *cr, vnode_t *vp, const char *pn) 2086 { 2087 FAST_BASIC_CHECK(cr, PRIV_FILE_WRITE); 2088 2089 return (priv_policy_va(cr, PRIV_FILE_WRITE, B_FALSE, EACCES, NULL, 2090 KLPDARG_VNODE, vp, (char *)pn, KLPDARG_NOMORE)); 2091 } 2092 2093 /* 2094 * Additional device protection. 2095 * 2096 * Traditionally, a device has specific permissions on the node in 2097 * the filesystem which govern which devices can be opened by what 2098 * processes. In certain cases, it is desirable to add extra 2099 * restrictions, as writing to certain devices is identical to 2100 * having a complete run of the system. 2101 * 2102 * This mechanism is called the device policy. 2103 * 2104 * When a device is opened, its policy entry is looked up in the 2105 * policy cache and checked. 2106 */ 2107 int 2108 secpolicy_spec_open(const cred_t *cr, struct vnode *vp, int oflag) 2109 { 2110 devplcy_t *plcy; 2111 int err; 2112 struct snode *csp = VTOS(common_specvp(vp)); 2113 priv_set_t pset; 2114 2115 mutex_enter(&csp->s_lock); 2116 2117 if (csp->s_plcy == NULL || csp->s_plcy->dp_gen != devplcy_gen) { 2118 plcy = devpolicy_find(vp); 2119 if (csp->s_plcy) 2120 dpfree(csp->s_plcy); 2121 csp->s_plcy = plcy; 2122 ASSERT(plcy != NULL); 2123 } else 2124 plcy = csp->s_plcy; 2125 2126 if (plcy == nullpolicy) { 2127 mutex_exit(&csp->s_lock); 2128 return (0); 2129 } 2130 2131 dphold(plcy); 2132 2133 mutex_exit(&csp->s_lock); 2134 2135 if (oflag & FWRITE) 2136 pset = plcy->dp_wrp; 2137 else 2138 pset = plcy->dp_rdp; 2139 /* 2140 * Special case: 2141 * PRIV_SYS_NET_CONFIG is a superset of PRIV_SYS_IP_CONFIG. 2142 * If PRIV_SYS_NET_CONFIG is present and PRIV_SYS_IP_CONFIG is 2143 * required, replace PRIV_SYS_IP_CONFIG with PRIV_SYS_NET_CONFIG 2144 * in the required privilege set before doing the check. 2145 */ 2146 if (priv_ismember(&pset, PRIV_SYS_IP_CONFIG) && 2147 priv_ismember(&CR_OEPRIV(cr), PRIV_SYS_NET_CONFIG) && 2148 !priv_ismember(&CR_OEPRIV(cr), PRIV_SYS_IP_CONFIG)) { 2149 priv_delset(&pset, PRIV_SYS_IP_CONFIG); 2150 priv_addset(&pset, PRIV_SYS_NET_CONFIG); 2151 } 2152 2153 err = secpolicy_require_set(cr, &pset, "devpolicy", KLPDARG_NONE); 2154 dpfree(plcy); 2155 2156 return (err); 2157 } 2158 2159 int 2160 secpolicy_modctl(const cred_t *cr, int cmd) 2161 { 2162 switch (cmd) { 2163 case MODINFO: 2164 case MODGETMAJBIND: 2165 case MODGETPATH: 2166 case MODGETPATHLEN: 2167 case MODGETNAME: 2168 case MODGETFBNAME: 2169 case MODGETDEVPOLICY: 2170 case MODGETDEVPOLICYBYNAME: 2171 case MODDEVT2INSTANCE: 2172 case MODSIZEOF_DEVID: 2173 case MODGETDEVID: 2174 case MODSIZEOF_MINORNAME: 2175 case MODGETMINORNAME: 2176 case MODGETDEVFSPATH_LEN: 2177 case MODGETDEVFSPATH: 2178 case MODGETDEVFSPATH_MI_LEN: 2179 case MODGETDEVFSPATH_MI: 2180 /* Unprivileged */ 2181 return (0); 2182 case MODLOAD: 2183 case MODSETDEVPOLICY: 2184 return (secpolicy_require_set(cr, PRIV_FULLSET, NULL, 2185 KLPDARG_NONE)); 2186 default: 2187 return (secpolicy_sys_config(cr, B_FALSE)); 2188 } 2189 } 2190 2191 int 2192 secpolicy_console(const cred_t *cr) 2193 { 2194 return (PRIV_POLICY(cr, PRIV_SYS_DEVICES, B_FALSE, EPERM, NULL)); 2195 } 2196 2197 int 2198 secpolicy_power_mgmt(const cred_t *cr) 2199 { 2200 return (PRIV_POLICY(cr, PRIV_SYS_DEVICES, B_FALSE, EPERM, NULL)); 2201 } 2202 2203 /* 2204 * Simulate terminal input; another escalation of privileges avenue. 2205 */ 2206 2207 int 2208 secpolicy_sti(const cred_t *cr) 2209 { 2210 return (secpolicy_require_set(cr, PRIV_FULLSET, NULL, KLPDARG_NONE)); 2211 } 2212 2213 boolean_t 2214 secpolicy_net_reply_equal(const cred_t *cr) 2215 { 2216 return (PRIV_POLICY(cr, PRIV_SYS_CONFIG, B_FALSE, EPERM, NULL)); 2217 } 2218 2219 int 2220 secpolicy_swapctl(const cred_t *cr) 2221 { 2222 return (PRIV_POLICY(cr, PRIV_SYS_CONFIG, B_FALSE, EPERM, NULL)); 2223 } 2224 2225 int 2226 secpolicy_cpc_cpu(const cred_t *cr) 2227 { 2228 return (PRIV_POLICY(cr, PRIV_CPC_CPU, B_FALSE, EACCES, NULL)); 2229 } 2230 2231 /* 2232 * secpolicy_contract_identity 2233 * 2234 * Determine if the subject may set the process contract FMRI value 2235 */ 2236 int 2237 secpolicy_contract_identity(const cred_t *cr) 2238 { 2239 return (PRIV_POLICY(cr, PRIV_CONTRACT_IDENTITY, B_FALSE, EPERM, NULL)); 2240 } 2241 2242 /* 2243 * secpolicy_contract_observer 2244 * 2245 * Determine if the subject may observe a specific contract's events. 2246 */ 2247 int 2248 secpolicy_contract_observer(const cred_t *cr, struct contract *ct) 2249 { 2250 if (contract_owned(ct, cr, B_FALSE)) 2251 return (0); 2252 return (PRIV_POLICY(cr, PRIV_CONTRACT_OBSERVER, B_FALSE, EPERM, NULL)); 2253 } 2254 2255 /* 2256 * secpolicy_contract_observer_choice 2257 * 2258 * Determine if the subject may observe any contract's events. Just 2259 * tests privilege and audits on success. 2260 */ 2261 boolean_t 2262 secpolicy_contract_observer_choice(const cred_t *cr) 2263 { 2264 return (PRIV_POLICY_CHOICE(cr, PRIV_CONTRACT_OBSERVER, B_FALSE)); 2265 } 2266 2267 /* 2268 * secpolicy_contract_event 2269 * 2270 * Determine if the subject may request critical contract events or 2271 * reliable contract event delivery. 2272 */ 2273 int 2274 secpolicy_contract_event(const cred_t *cr) 2275 { 2276 return (PRIV_POLICY(cr, PRIV_CONTRACT_EVENT, B_FALSE, EPERM, NULL)); 2277 } 2278 2279 /* 2280 * secpolicy_contract_event_choice 2281 * 2282 * Determine if the subject may retain contract events in its critical 2283 * set when a change in other terms would normally require a change in 2284 * the critical set. Just tests privilege and audits on success. 2285 */ 2286 boolean_t 2287 secpolicy_contract_event_choice(const cred_t *cr) 2288 { 2289 return (PRIV_POLICY_CHOICE(cr, PRIV_CONTRACT_EVENT, B_FALSE)); 2290 } 2291 2292 /* 2293 * secpolicy_gart_access 2294 * 2295 * Determine if the subject has sufficient priveleges to make ioctls to agpgart 2296 * device. 2297 */ 2298 int 2299 secpolicy_gart_access(const cred_t *cr) 2300 { 2301 return (PRIV_POLICY(cr, PRIV_GRAPHICS_ACCESS, B_FALSE, EPERM, NULL)); 2302 } 2303 2304 /* 2305 * secpolicy_gart_map 2306 * 2307 * Determine if the subject has sufficient priveleges to map aperture range 2308 * through agpgart driver. 2309 */ 2310 int 2311 secpolicy_gart_map(const cred_t *cr) 2312 { 2313 if (PRIV_POLICY_ONLY(cr, PRIV_GRAPHICS_ACCESS, B_FALSE)) { 2314 return (PRIV_POLICY(cr, PRIV_GRAPHICS_ACCESS, B_FALSE, EPERM, 2315 NULL)); 2316 } else { 2317 return (PRIV_POLICY(cr, PRIV_GRAPHICS_MAP, B_FALSE, EPERM, 2318 NULL)); 2319 } 2320 } 2321 2322 /* 2323 * secpolicy_zinject 2324 * 2325 * Determine if the subject can inject faults in the ZFS fault injection 2326 * framework. Requires all privileges. 2327 */ 2328 int 2329 secpolicy_zinject(const cred_t *cr) 2330 { 2331 return (secpolicy_require_set(cr, PRIV_FULLSET, NULL, KLPDARG_NONE)); 2332 } 2333 2334 /* 2335 * secpolicy_zfs 2336 * 2337 * Determine if the subject has permission to manipulate ZFS datasets 2338 * (not pools). Equivalent to the SYS_MOUNT privilege. 2339 */ 2340 int 2341 secpolicy_zfs(const cred_t *cr) 2342 { 2343 return (PRIV_POLICY(cr, PRIV_SYS_MOUNT, B_FALSE, EPERM, NULL)); 2344 } 2345 2346 /* 2347 * secpolicy_idmap 2348 * 2349 * Determine if the calling process has permissions to register an SID 2350 * mapping daemon and allocate ephemeral IDs. 2351 */ 2352 int 2353 secpolicy_idmap(const cred_t *cr) 2354 { 2355 return (PRIV_POLICY(cr, PRIV_FILE_SETID, B_TRUE, EPERM, NULL)); 2356 } 2357 2358 /* 2359 * secpolicy_ucode_update 2360 * 2361 * Determine if the subject has sufficient privilege to update microcode. 2362 */ 2363 int 2364 secpolicy_ucode_update(const cred_t *scr) 2365 { 2366 return (PRIV_POLICY(scr, PRIV_ALL, B_FALSE, EPERM, NULL)); 2367 } 2368 2369 /* 2370 * secpolicy_sadopen 2371 * 2372 * Determine if the subject has sufficient privilege to access /dev/sad/admin. 2373 * /dev/sad/admin appear in global zone and exclusive-IP zones only. 2374 * In global zone, sys_config is required. 2375 * In exclusive-IP zones, sys_ip_config is required. 2376 * Note that sys_config is prohibited in non-global zones. 2377 */ 2378 int 2379 secpolicy_sadopen(const cred_t *credp) 2380 { 2381 priv_set_t pset; 2382 2383 priv_emptyset(&pset); 2384 2385 if (crgetzoneid(credp) == GLOBAL_ZONEID) 2386 priv_addset(&pset, PRIV_SYS_CONFIG); 2387 else 2388 priv_addset(&pset, PRIV_SYS_IP_CONFIG); 2389 2390 return (secpolicy_require_set(credp, &pset, "devpolicy", KLPDARG_NONE)); 2391 } 2392 2393 2394 /* 2395 * Add privileges to a particular privilege set; this is called when the 2396 * current sets of privileges are not sufficient. I.e., we should always 2397 * call the policy override functions from here. 2398 * What we are allowed to have is in the Observed Permitted set; so 2399 * we compute the difference between that and the newset. 2400 */ 2401 int 2402 secpolicy_require_privs(const cred_t *cr, const priv_set_t *nset) 2403 { 2404 priv_set_t rqd; 2405 2406 rqd = CR_OPPRIV(cr); 2407 2408 priv_inverse(&rqd); 2409 priv_intersect(nset, &rqd); 2410 2411 return (secpolicy_require_set(cr, &rqd, NULL, KLPDARG_NONE)); 2412 } 2413 2414 /* 2415 * secpolicy_smb 2416 * 2417 * Determine if the cred_t has PRIV_SYS_SMB privilege, indicating 2418 * that it has permission to access the smbsrv kernel driver. 2419 * PRIV_POLICY checks the privilege and audits the check. 2420 * 2421 * Returns: 2422 * 0 Driver access is allowed. 2423 * EPERM Driver access is NOT permitted. 2424 */ 2425 int 2426 secpolicy_smb(const cred_t *cr) 2427 { 2428 return (PRIV_POLICY(cr, PRIV_SYS_SMB, B_FALSE, EPERM, NULL)); 2429 } 2430 2431 /* 2432 * secpolicy_vscan 2433 * 2434 * Determine if cred_t has the necessary privileges to access a file 2435 * for virus scanning and update its extended system attributes. 2436 * PRIV_FILE_DAC_SEARCH, PRIV_FILE_DAC_READ - file access 2437 * PRIV_FILE_FLAG_SET - set extended system attributes 2438 * 2439 * PRIV_POLICY checks the privilege and audits the check. 2440 * 2441 * Returns: 2442 * 0 file access for virus scanning allowed. 2443 * EPERM file access for virus scanning is NOT permitted. 2444 */ 2445 int 2446 secpolicy_vscan(const cred_t *cr) 2447 { 2448 if ((PRIV_POLICY(cr, PRIV_FILE_DAC_SEARCH, B_FALSE, EPERM, NULL)) || 2449 (PRIV_POLICY(cr, PRIV_FILE_DAC_READ, B_FALSE, EPERM, NULL)) || 2450 (PRIV_POLICY(cr, PRIV_FILE_FLAG_SET, B_FALSE, EPERM, NULL))) { 2451 return (EPERM); 2452 } 2453 2454 return (0); 2455 } 2456 2457 /* 2458 * secpolicy_smbfs_login 2459 * 2460 * Determines if the caller can add and delete the smbfs login 2461 * password in the the nsmb kernel module for the CIFS client. 2462 * 2463 * Returns: 2464 * 0 access is allowed. 2465 * EPERM access is NOT allowed. 2466 */ 2467 int 2468 secpolicy_smbfs_login(const cred_t *cr, uid_t uid) 2469 { 2470 uid_t cruid = crgetruid(cr); 2471 2472 if (cruid == uid) 2473 return (0); 2474 return (PRIV_POLICY(cr, PRIV_PROC_OWNER, B_FALSE, 2475 EPERM, NULL)); 2476 } 2477 2478 /* 2479 * secpolicy_xvm_control 2480 * 2481 * Determines if a caller can control the xVM hypervisor and/or running 2482 * domains (x86 specific). 2483 * 2484 * Returns: 2485 * 0 access is allowed. 2486 * EPERM access is NOT allowed. 2487 */ 2488 int 2489 secpolicy_xvm_control(const cred_t *cr) 2490 { 2491 if (PRIV_POLICY(cr, PRIV_XVM_CONTROL, B_FALSE, EPERM, NULL)) 2492 return (EPERM); 2493 return (0); 2494 } 2495 2496 /* 2497 * secpolicy_ppp_config 2498 * 2499 * Determine if the subject has sufficient privileges to configure PPP and 2500 * PPP-related devices. 2501 */ 2502 int 2503 secpolicy_ppp_config(const cred_t *cr) 2504 { 2505 if (PRIV_POLICY_ONLY(cr, PRIV_SYS_NET_CONFIG, B_FALSE)) 2506 return (secpolicy_net_config(cr, B_FALSE)); 2507 return (PRIV_POLICY(cr, PRIV_SYS_PPP_CONFIG, B_FALSE, EPERM, NULL)); 2508 } 2509