Page MenuHomeFreeBSD
Files F169134400

D58013.id181233.diff
No OneTemporary
Actions

D58013.id181233.diff
View Options

diff --git a/sys/security/mac_do/mac_do.c b/sys/security/mac_do/mac_do.c
--- a/sys/security/mac_do/mac_do.c
+++ b/sys/security/mac_do/mac_do.c
@@ -71,10 +71,10 @@
_Static_assert(MAX_RULE_STRING_SIZE > 0,
"MAX_RULE_STRING_SIZE: No space for the NUL terminator!");
-#define MAX_EXEC_PATHS_SIZE 2048
-#define MAX_EXEC_PATHS 8
-_Static_assert(MAX_EXEC_PATHS_SIZE > 0,
- "MAX_EXEC_PATHS_SIZE: No space for the NUL terminator!");
+#define MAX_TRUSTED_BINS_SIZE 2048
+#define MAX_TRUSTED_BINS 8
+_Static_assert(MAX_TRUSTED_BINS_SIZE > 0,
+ "MAX_TRUSTED_BINS_SIZE: No space for the NUL terminator!");
struct rmlock mac_do_rml;
@@ -213,10 +213,10 @@
struct rulehead head;
};
-struct exec_paths {
- char exec_paths_str[MAX_EXEC_PATHS_SIZE];
- char exec_paths[MAX_EXEC_PATHS][PATH_MAX];
- int exec_path_count;
+struct trusted_bins {
+ char trusted_bins_str[MAX_TRUSTED_BINS_SIZE];
+ char trusted_bins[MAX_TRUSTED_BINS][PATH_MAX];
+ int trusted_bins_count;
};
/*
@@ -226,7 +226,7 @@
*/
struct conf {
struct rules rules;
- struct exec_paths exec_paths;
+ struct trusted_bins trusted_bins;
volatile u_int use_count __aligned(CACHE_LINE_SIZE);
};
@@ -349,9 +349,9 @@
}
static bool
-has_exec_paths(const struct exec_paths *const exec_paths)
+has_trusted_bins(const struct trusted_bins *const trusted_bins)
{
- return (exec_paths->exec_paths_str[0] != '\0');
+ return (trusted_bins->trusted_bins_str[0] != '\0');
}
/*
@@ -407,9 +407,9 @@
}
static inline void
-init_exec_paths(struct exec_paths *const exec_paths)
+init_trusted_bins(struct trusted_bins *const trusted_bins)
{
- MPASS(is_zeroed(exec_paths, sizeof(*exec_paths)));
+ MPASS(is_zeroed(trusted_bins, sizeof(*trusted_bins)));
}
static struct conf *
@@ -419,7 +419,7 @@
M_WAITOK | M_ZERO);
init_rules(&conf->rules);
- init_exec_paths(&conf->exec_paths);
+ init_trusted_bins(&conf->trusted_bins);
refcount_init(&conf->use_count, 1);
return (conf);
@@ -1266,22 +1266,22 @@
* Similar constraints as parse_rules() (which see).
*/
static int
-parse_exec_paths(const char *const string, struct exec_paths *const exec_paths,
+parse_trusted_bins(const char *const string, struct trusted_bins *const trusted_bins,
struct parse_error **const parse_error)
{
const size_t len = strlen(string);
char *copy, *p, *path;
int error = 0;
- if (len >= MAX_EXEC_PATHS_SIZE) {
+ if (len >= MAX_TRUSTED_BINS_SIZE) {
make_parse_error(parse_error, 0,
"Exec path specification string is too long (%zu, max %u)",
- len, MAX_EXEC_PATHS_SIZE - 1);
+ len, MAX_TRUSTED_BINS_SIZE - 1);
return (ENAMETOOLONG);
}
- bcopy(string, exec_paths->exec_paths_str, len + 1);
- MPASS(exec_paths->exec_paths_str[len] == '\0');
+ bcopy(string, trusted_bins->trusted_bins_str, len + 1);
+ MPASS(trusted_bins->trusted_bins_str[len] == '\0');
copy = malloc(len + 1, M_MAC_DO, M_WAITOK);
bcopy(string, copy, len + 1);
@@ -1294,10 +1294,10 @@
if (*path == '\0')
continue;
- if (exec_paths->exec_path_count >= MAX_EXEC_PATHS) {
+ if (trusted_bins->trusted_bins_count >= MAX_TRUSTED_BINS) {
make_parse_error(parse_error, path - copy,
"Too many exec paths specified (max %d)",
- MAX_EXEC_PATHS);
+ MAX_TRUSTED_BINS);
error = EINVAL;
goto error;
}
@@ -1311,9 +1311,9 @@
goto error;
}
- strlcpy(exec_paths->exec_paths[exec_paths->exec_path_count],
+ strlcpy(trusted_bins->trusted_bins[trusted_bins->trusted_bins_count],
path, PATH_MAX);
- exec_paths->exec_path_count++;
+ trusted_bins->trusted_bins_count++;
}
MPASS(error == 0 && *parse_error == NULL);
@@ -1541,11 +1541,11 @@
const char *const mdo_path = "/usr/bin/mdo";
struct conf *conf = new_conf();
- strlcpy(conf->exec_paths.exec_paths_str, mdo_path,
- MAX_EXEC_PATHS_SIZE);
- strlcpy(conf->exec_paths.exec_paths[0], mdo_path,
+ strlcpy(conf->trusted_bins.trusted_bins_str, mdo_path,
+ MAX_TRUSTED_BINS_SIZE);
+ strlcpy(conf->trusted_bins.trusted_bins[0], mdo_path,
PATH_MAX);
- conf->exec_paths.exec_path_count = 1;
+ conf->trusted_bins.trusted_bins_count = 1;
return (conf);
}
@@ -1583,17 +1583,17 @@
}
static void
-clone_exec_paths(struct exec_paths *const dst,
- const struct exec_paths *const src)
+clone_trusted_bins(struct trusted_bins *const dst,
+ const struct trusted_bins *const src)
{
MPASS(is_zeroed(dst, sizeof(*dst)));
- dst->exec_path_count = src->exec_path_count;
- for (int i = 0; i < src->exec_path_count; i++)
- strlcpy(dst->exec_paths[i], src->exec_paths[i],
- sizeof(dst->exec_paths[i]));
+ dst->trusted_bins_count = src->trusted_bins_count;
+ for (int i = 0; i < src->trusted_bins_count; i++)
+ strlcpy(dst->trusted_bins[i], src->trusted_bins[i],
+ sizeof(dst->trusted_bins[i]));
- strlcpy(dst->exec_paths_str, src->exec_paths_str,
- sizeof(dst->exec_paths_str));
+ strlcpy(dst->trusted_bins_str, src->trusted_bins_str,
+ sizeof(dst->trusted_bins_str));
}
/*
@@ -1613,14 +1613,14 @@
*/
static int
parse_and_set_conf(struct prison *const pr, const char *const rules_string,
- const char *const exec_paths_string, const struct conf *const model_conf,
+ const char *const trusted_bins_string, const struct conf *const model_conf,
struct conf **const old_conf, struct parse_error **const parse_error)
{
struct conf *const conf = new_conf();
int error = 0;
KASSERT(model_conf != NULL ||
- (rules_string != NULL && exec_paths_string != NULL),
+ (rules_string != NULL && trusted_bins_string != NULL),
("MAC/do: %s: Model configuration needed!", __func__));
if (rules_string != NULL) {
@@ -1631,14 +1631,14 @@
else
clone_rules(&conf->rules, &model_conf->rules);
- if (exec_paths_string != NULL) {
- error = parse_exec_paths(exec_paths_string, &conf->exec_paths,
+ if (trusted_bins_string != NULL) {
+ error = parse_trusted_bins(trusted_bins_string, &conf->trusted_bins,
parse_error);
if (error != 0)
goto error;
} else
- clone_exec_paths(&conf->exec_paths,
- &model_conf->exec_paths);
+ clone_trusted_bins(&conf->trusted_bins,
+ &model_conf->trusted_bins);
MPASS(error == 0);
*old_conf = set_conf_locked(pr, conf, osd_reserve(osd_jail_slot));
@@ -1660,13 +1660,13 @@
*/
static int
parse_and_commit_conf(struct prison *const pr, const char *const rules_string,
- const char *const exec_paths_string, const struct conf *const model_conf,
+ const char *const trusted_bins_string, const struct conf *const model_conf,
struct parse_error **const parse_error)
{
struct conf *old_conf;
int error;
- error = parse_and_set_conf(pr, rules_string, exec_paths_string,
+ error = parse_and_set_conf(pr, rules_string, trusted_bins_string,
model_conf, &old_conf, parse_error);
rm_wunlock(&mac_do_rml);
@@ -1726,9 +1726,9 @@
"Jail MAC/do rules");
static int
-mac_do_sysctl_exec_paths(SYSCTL_HANDLER_ARGS)
+mac_do_sysctl_trusted_bins(SYSCTL_HANDLER_ARGS)
{
- char *const buf = malloc(MAX_EXEC_PATHS_SIZE, M_MAC_DO, M_WAITOK);
+ char *const buf = malloc(MAX_TRUSTED_BINS_SIZE, M_MAC_DO, M_WAITOK);
struct prison *const pr = req->td->td_ucred->cr_prison;
struct conf *conf;
struct parse_error *parse_error = NULL;
@@ -1739,9 +1739,9 @@
conf = find_conf_locked(pr, NULL);
} else
conf = find_conf(pr, NULL);
- strlcpy(buf, conf->exec_paths.exec_paths_str, MAX_EXEC_PATHS_SIZE);
+ strlcpy(buf, conf->trusted_bins.trusted_bins_str, MAX_TRUSTED_BINS_SIZE);
- error = sysctl_handle_string(oidp, buf, MAX_EXEC_PATHS_SIZE, req);
+ error = sysctl_handle_string(oidp, buf, MAX_TRUSTED_BINS_SIZE, req);
if (req->newptr == NULL)
goto out;
if (error != 0) {
@@ -1764,12 +1764,12 @@
return (error);
}
-SYSCTL_PROC(_security_mac_do, OID_AUTO, exec_paths,
+SYSCTL_PROC(_security_mac_do, OID_AUTO, trusted_bins,
CTLTYPE_STRING | CTLFLAG_RW | CTLFLAG_PRISON | CTLFLAG_MPSAFE,
- 0, 0, mac_do_sysctl_exec_paths, "A",
+ 0, 0, mac_do_sysctl_trusted_bins, "A",
"Colon-separated list of allowed executables");
-SYSCTL_JAIL_PARAM_STRING(_mac_do, exec_paths, CTLFLAG_RW, MAX_EXEC_PATHS_SIZE,
+SYSCTL_JAIL_PARAM_STRING(_mac_do, trusted_bins, CTLFLAG_RW, MAX_TRUSTED_BINS_SIZE,
"Jail MAC/do executable paths");
static int
@@ -1781,10 +1781,10 @@
struct conf *const applicable_conf = find_conf(pr, &hpr_out);
const struct prison *const hpr = hpr_out;
const struct rules *const rules = &applicable_conf->rules;
- const struct exec_paths *const exec_paths = &applicable_conf->exec_paths;
+ const struct trusted_bins *const trusted_bins = &applicable_conf->trusted_bins;
int jsys, error;
- jsys = hpr == pr ? (has_rules(rules) && has_exec_paths(exec_paths) ?
+ jsys = hpr == pr ? (has_rules(rules) && has_trusted_bins(trusted_bins) ?
JAIL_SYS_NEW : JAIL_SYS_DISABLE) : JAIL_SYS_INHERIT;
error = vfs_setopt(opts, "mac.do", &jsys, sizeof(jsys));
@@ -1795,8 +1795,8 @@
if (error != 0 && error != ENOENT)
goto done;
- error = vfs_setopts(opts, "mac.do.exec_paths",
- exec_paths->exec_paths_str);
+ error = vfs_setopts(opts, "mac.do.trusted_bins",
+ trusted_bins->trusted_bins_str);
if (error != 0 && error != ENOENT)
goto done;
@@ -1821,9 +1821,9 @@
mac_do_jail_check(void *obj, void *data)
{
struct vfsoptlist *opts = data;
- char *rules_string, *exec_paths_string;
- int error, jsys, rules_size = 0, exec_paths_size = 0;
- bool absent_or_empty_rules, absent_or_empty_exec_paths;
+ char *rules_string, *trusted_bins_string;
+ int error, jsys, rules_size = 0, trusted_bins_size = 0;
+ bool absent_or_empty_rules, absent_or_empty_trusted_bins;
error = vfs_copyopt(opts, "mac.do", &jsys, sizeof(jsys));
if (error == ENOENT)
@@ -1867,36 +1867,36 @@
}
/* Executable paths. */
- error = vfs_getopt(opts, "mac.do.exec_paths",
- (void **)&exec_paths_string, &exec_paths_size);
+ error = vfs_getopt(opts, "mac.do.trusted_bins",
+ (void **)&trusted_bins_string, &trusted_bins_size);
if (error == ENOENT)
- exec_paths_string = NULL;
+ trusted_bins_string = NULL;
else {
if (error != 0)
return (error);
- if (exec_paths_size == 0 ||
- exec_paths_string[exec_paths_size - 1] != '\0') {
+ if (trusted_bins_size == 0 ||
+ trusted_bins_string[trusted_bins_size - 1] != '\0') {
vfs_opterror(opts,
- "'mac.do.exec_paths' not a proper string");
+ "'mac.do.trusted_bins' not a proper string");
return (EINVAL);
}
- if (exec_paths_size > MAX_EXEC_PATHS_SIZE) {
- vfs_opterror(opts, "'mac.do.exec_paths' too long");
+ if (trusted_bins_size > MAX_TRUSTED_BINS_SIZE) {
+ vfs_opterror(opts, "'mac.do.trusted_bins' too long");
return (ENAMETOOLONG);
}
}
absent_or_empty_rules = is_null_or_empty(rules_string);
- absent_or_empty_exec_paths = is_null_or_empty(exec_paths_string);
+ absent_or_empty_trusted_bins = is_null_or_empty(trusted_bins_string);
/* If not specified, infer 'jsys' from passed options. */
if (jsys == -1) {
/*
- * Default in absence of "mac.do.rules" and "mac.do.exec_paths"
+ * Default in absence of "mac.do.rules" and "mac.do.trusted_bins"
* is to disable. We never implicitly inherit, as that changes
* reasoning about configurations.
*/
- if (!absent_or_empty_rules || !absent_or_empty_exec_paths)
+ if (!absent_or_empty_rules || !absent_or_empty_trusted_bins)
jsys = JAIL_SYS_NEW;
else
jsys = JAIL_SYS_DISABLE;
@@ -1915,9 +1915,9 @@
* which no value for the parameter is explicitly specified
* (because then the value passed here is copied).
*/
- if (!absent_or_empty_rules && !absent_or_empty_exec_paths) {
+ if (!absent_or_empty_rules && !absent_or_empty_trusted_bins) {
vfs_opterror(opts,
- "One of 'mac.do.rules' and 'mac_do.exec_paths' "
+ "One of 'mac.do.rules' and 'mac_do.trusted_bins' "
"should not be specified or should be empty when "
"'mac.do' is 'disabled'");
return (EINVAL);
@@ -1947,11 +1947,11 @@
{
struct prison *const pr = obj;
struct vfsoptlist *const opts = data;
- char *rules_string, *exec_paths_string;
+ char *rules_string, *trusted_bins_string;
struct parse_error *parse_error = NULL;
struct conf *model_conf;
int error, jsys;
- bool absent_or_empty_rules, absent_or_empty_exec_paths;
+ bool absent_or_empty_rules, absent_or_empty_trusted_bins;
/*
* The invariants checks used below correspond to what has already been
@@ -1965,14 +1965,14 @@
rules_string = vfs_getopts(opts, "mac.do.rules", &error);
MPASS(error == 0 || error == ENOENT);
- exec_paths_string = vfs_getopts(opts, "mac.do.exec_paths", &error);
+ trusted_bins_string = vfs_getopts(opts, "mac.do.trusted_bins", &error);
MPASS(error == 0 || error == ENOENT);
absent_or_empty_rules = is_null_or_empty(rules_string);
- absent_or_empty_exec_paths = is_null_or_empty(exec_paths_string);
+ absent_or_empty_trusted_bins = is_null_or_empty(trusted_bins_string);
if (jsys == -1) {
- if (!absent_or_empty_rules || !absent_or_empty_exec_paths)
+ if (!absent_or_empty_rules || !absent_or_empty_trusted_bins)
jsys = JAIL_SYS_NEW;
else
jsys = JAIL_SYS_DISABLE;
@@ -1984,7 +1984,7 @@
error = 0;
rm_wlock(&mac_do_rml);
- if (!absent_or_empty_rules || !absent_or_empty_exec_paths) {
+ if (!absent_or_empty_rules || !absent_or_empty_trusted_bins) {
/*
* Some values specified. Check that they match the
* ones we are going to inherit.
@@ -1999,15 +1999,15 @@
"than the one to be inherited (\"%s\")",
model_conf->rules.string);
}
- if (strcmp(model_conf->exec_paths.exec_paths_str,
- exec_paths_string) != 0) {
+ if (strcmp(model_conf->trusted_bins.trusted_bins_str,
+ trusted_bins_string) != 0) {
error = EINVAL;
vfs_opterror(opts,
"'mac.do' is 'inherited' but "
- "'mac.do.exec_paths' was specified with a "
+ "'mac.do.trusted_bins' was specified with a "
"different value than the one to be "
"inherited (\"%s\")",
- model_conf->exec_paths.exec_paths_str);
+ model_conf->trusted_bins.trusted_bins_str);
}
drop_conf(model_conf);
}
@@ -2040,10 +2040,10 @@
* absent or empty (see the comment for the corresponding case
* there).
*/
- MPASS(absent_or_empty_rules || absent_or_empty_exec_paths);
+ MPASS(absent_or_empty_rules || absent_or_empty_trusted_bins);
if (!absent_or_empty_rules)
- exec_paths_string = "";
- else if (!absent_or_empty_exec_paths)
+ trusted_bins_string = "";
+ else if (!absent_or_empty_trusted_bins)
rules_string = "";
else {
/*
@@ -2052,7 +2052,7 @@
* it will serve as a template (provides default
* values).
*/
- if (rules_string == NULL || exec_paths_string == NULL)
+ if (rules_string == NULL || trusted_bins_string == NULL)
model_conf = find_conf_locked(pr, NULL);
/* If both are absent, we have to examine if, in the
* currently applicable configuration, one of the
@@ -2063,16 +2063,16 @@
* administrators that may want to enable mac_do(4)
* later by just setting new rules.
*/
- if (rules_string == NULL && exec_paths_string == NULL &&
+ if (rules_string == NULL && trusted_bins_string == NULL &&
has_rules(&model_conf->rules) &&
- has_exec_paths(&model_conf->exec_paths))
+ has_trusted_bins(&model_conf->trusted_bins))
rules_string = "";
}
break;
case JAIL_SYS_NEW:
/* See the comment before the same test above. */
- if (rules_string == NULL || exec_paths_string == NULL)
+ if (rules_string == NULL || trusted_bins_string == NULL)
model_conf = find_conf_locked(pr, NULL);
break;
@@ -2081,7 +2081,7 @@
}
/* Unlocks 'mac_do_rml'. */
- error = parse_and_commit_conf(pr, rules_string, exec_paths_string,
+ error = parse_and_commit_conf(pr, rules_string, trusted_bins_string,
model_conf, &parse_error);
if (model_conf != NULL)
drop_conf(model_conf);
@@ -2653,7 +2653,7 @@
struct prison *const pr = curproc->p_ucred->cr_prison;
char *path, *to_free;
struct conf *conf;
- struct exec_paths *exec_paths;
+ struct trusted_bins *trusted_bins;
int error;
/*
@@ -2679,10 +2679,10 @@
error = EPERM;
conf = find_conf(pr, NULL);
- exec_paths = &conf->exec_paths;
+ trusted_bins = &conf->trusted_bins;
- for (int i = 0; i < exec_paths->exec_path_count; i++)
- if (strcmp(exec_paths->exec_paths[i], path) == 0) {
+ for (int i = 0; i < trusted_bins->trusted_bins_count; i++)
+ if (strcmp(trusted_bins->trusted_bins[i], path) == 0) {
error = 0;
break;
}

File Metadata

Mime Type
text/plain
Expires
Tue, Sep 1, 1:18 PM (20 h, 16 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
34637272
Default Alt Text
D58013.id181233.diff (16 KB)

Event Timeline