diff --git a/sys/security/mac/mac_syscalls.c b/sys/security/mac/mac_syscalls.c index e97a7dc09700..26181781a394 100644 --- a/sys/security/mac/mac_syscalls.c +++ b/sys/security/mac/mac_syscalls.c @@ -1,701 +1,739 @@ /*- * Copyright (c) 1999-2002, 2006, 2009 Robert N. M. Watson * Copyright (c) 2001 Ilmar S. Habibulin * Copyright (c) 2001-2005 Networks Associates Technology, Inc. * Copyright (c) 2005-2006 SPARTA, Inc. * Copyright (c) 2008 Apple Inc. * All rights reserved. * * This software was developed by Robert Watson and Ilmar Habibulin for the * TrustedBSD Project. * * This software was developed for the FreeBSD Project in part by Network * Associates Laboratories, the Security Research Division of Network * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), * as part of the DARPA CHATS research program. * * This software was enhanced by SPARTA ISSO under SPAWAR contract * N66001-04-C-6019 ("SEFOS"). * * This software was developed at the University of Cambridge Computer * Laboratory with support from a grant from Google, Inc. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. */ #include #include "opt_mac.h" #include +#include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #ifdef MAC FEATURE(security_mac, "Mandatory Access Control Framework support"); static int kern___mac_get_path(struct thread *td, const char *path_p, struct mac *mac_p, int follow); static int kern___mac_set_path(struct thread *td, const char *path_p, struct mac *mac_p, int follow); +#ifdef COMPAT_FREEBSD32 +struct mac32 { + uint32_t m_buflen; /* size_t */ + uint32_t m_string; /* char * */ +}; +#endif + /* * Copyin a 'struct mac', including the string pointed to by 'm_string'. * * On success (0 returned), fills '*mac', whose associated storage must be freed * after use by calling free_copied_label() (which see). On success, 'u_string' * if not NULL is filled with the userspace address for 'u_mac->m_string'. */ -int -mac_label_copyin(const struct mac *const u_mac, struct mac *const mac, - char **const u_string) +static int +mac_label_copyin_impl(const void *const u_mac, struct mac *const mac, + char **const u_string, bool is_32bit) { char *buffer; int error; - error = copyin(u_mac, mac, sizeof(*mac)); - if (error != 0) - return (error); +#ifdef COMPAT_FREEBSD32 + if (is_32bit) { + struct mac32 mac32; + + error = copyin(u_mac, &mac32, sizeof(mac32)); + if (error != 0) + return (error); + + CP(mac32, *mac, m_buflen); + PTRIN_CP(mac32, *mac, m_string); + } else +#endif + { + error = copyin(u_mac, mac, sizeof(*mac)); + if (error != 0) + return (error); + } error = mac_check_structmac_consistent(mac); if (error != 0) return (error); /* 'm_buflen' not too big checked by function call above. */ buffer = malloc(mac->m_buflen, M_MACTEMP, M_WAITOK); error = copyinstr(mac->m_string, buffer, mac->m_buflen, NULL); if (error != 0) { free(buffer, M_MACTEMP); return (error); } MPASS(error == 0); if (u_string != NULL) *u_string = mac->m_string; mac->m_string = buffer; return (0); } +int +mac_label_copyin(const struct mac *const u_mac, struct mac *const mac, + char **const u_string) +{ + return (mac_label_copyin_impl(u_mac, mac, u_string, false)); +} + void free_copied_label(const struct mac *const mac) { free(mac->m_string, M_MACTEMP); } +#ifdef COMPAT_FREEBSD32 +int +mac_label_copyin32(const struct mac32 *const u_mac, + struct mac *const mac, char **const u_string) +{ + return (mac_label_copyin_impl(u_mac, mac, u_string, true)); +} +#endif + int sys___mac_get_pid(struct thread *td, struct __mac_get_pid_args *uap) { char *buffer, *u_buffer; struct mac mac; struct proc *tproc; struct ucred *tcred; int error; error = mac_label_copyin(uap->mac_p, &mac, &u_buffer); if (error) return (error); tproc = pfind(uap->pid); if (tproc == NULL) { error = ESRCH; goto free_mac_and_exit; } tcred = NULL; /* Satisfy gcc. */ error = p_cansee(td, tproc); if (error == 0) tcred = crhold(tproc->p_ucred); PROC_UNLOCK(tproc); if (error) goto free_mac_and_exit; buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK | M_ZERO); error = mac_cred_externalize_label(tcred->cr_label, mac.m_string, buffer, mac.m_buflen); if (error == 0) error = copyout(buffer, u_buffer, strlen(buffer)+1); free(buffer, M_MACTEMP); crfree(tcred); free_mac_and_exit: free_copied_label(&mac); return (error); } int sys___mac_get_proc(struct thread *td, struct __mac_get_proc_args *uap) { char *buffer, *u_buffer; struct mac mac; int error; error = mac_label_copyin(uap->mac_p, &mac, &u_buffer); if (error) return (error); buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK | M_ZERO); error = mac_cred_externalize_label(td->td_ucred->cr_label, mac.m_string, buffer, mac.m_buflen); if (error == 0) error = copyout(buffer, u_buffer, strlen(buffer)+1); free(buffer, M_MACTEMP); free_copied_label(&mac); return (error); } /* * Performs preparation (including allocations) for mac_set_proc(). * * No lock should be held while calling this function. On success, * mac_set_proc_finish() must be called to free the data associated to * 'mac_set_proc_data', even if mac_set_proc_core() fails. 'mac_set_proc_data' * is not set in case of error, and is set to a non-NULL value on success. */ int mac_set_proc_prepare(struct thread *const td, const struct mac *const mac, void **const mac_set_proc_data) { struct label *intlabel; int error; PROC_LOCK_ASSERT(td->td_proc, MA_NOTOWNED); if (!(mac_labeled & MPC_OBJECT_CRED)) return (EINVAL); intlabel = mac_cred_label_alloc(); error = mac_cred_internalize_label(intlabel, mac->m_string); if (error) { mac_cred_label_free(intlabel); return (error); } *mac_set_proc_data = intlabel; return (0); } /* * Actually sets the MAC label on 'newcred'. * * The current process' lock *must* be held. This function only sets the label * on 'newcred', but does not put 'newcred' in place on the current process' * (consequently, it also does not call setsugid()). 'mac_set_proc_data' must * be the pointer returned by mac_set_proc_prepare(). If called, this function * must be so between a successful call to mac_set_proc_prepare() and * mac_set_proc_finish(), but calling it is not mandatory (e.g., if some other * error occured under the process lock that obsoletes setting the MAC label). */ int mac_set_proc_core(struct thread *const td, struct ucred *const newcred, void *const mac_set_proc_data) { struct label *const intlabel = mac_set_proc_data; struct proc *const p = td->td_proc; int error; MPASS(td == curthread); PROC_LOCK_ASSERT(p, MA_OWNED); error = mac_cred_check_relabel(p->p_ucred, intlabel); if (error) return (error); mac_cred_relabel(newcred, intlabel); return (0); } /* * Performs mac_set_proc() last operations, without the process lock. * * 'proc_label_set' indicates whether the label was actually set by a call to * mac_set_proc_core() that succeeded. 'mac_set_proc_data' must be the pointer * returned by mac_set_proc_prepare(), and its associated data will be freed. */ void mac_set_proc_finish(struct thread *const td, bool proc_label_set, void *const mac_set_proc_data) { struct label *const intlabel = mac_set_proc_data; PROC_LOCK_ASSERT(td->td_proc, MA_NOTOWNED); if (proc_label_set) mac_proc_vm_revoke(td); mac_cred_label_free(intlabel); } int sys___mac_set_proc(struct thread *td, struct __mac_set_proc_args *uap) { struct ucred *newcred, *oldcred; void *intlabel; struct proc *const p = td->td_proc; struct mac mac; int error; error = mac_label_copyin(uap->mac_p, &mac, NULL); if (error) return (error); error = mac_set_proc_prepare(td, &mac, &intlabel); if (error) goto free_label; newcred = crget(); PROC_LOCK(p); oldcred = p->p_ucred; crcopy(newcred, oldcred); error = mac_set_proc_core(td, newcred, intlabel); if (error) { PROC_UNLOCK(p); crfree(newcred); goto finish; } setsugid(p); proc_set_cred(p, newcred); PROC_UNLOCK(p); crfree(oldcred); finish: mac_set_proc_finish(td, error == 0, intlabel); free_label: free_copied_label(&mac); return (error); } int sys___mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap) { char *u_buffer, *buffer; struct label *intlabel; struct file *fp; struct mac mac; struct vnode *vp; struct pipe *pipe; struct socket *so; cap_rights_t rights; int error; error = mac_label_copyin(uap->mac_p, &mac, &u_buffer); if (error) return (error); buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK | M_ZERO); error = fget(td, uap->fd, cap_rights_init_one(&rights, CAP_MAC_GET), &fp); if (error) goto out; switch (fp->f_type) { case DTYPE_FIFO: case DTYPE_VNODE: if (!(mac_labeled & MPC_OBJECT_VNODE)) { error = EINVAL; goto out_fdrop; } vp = fp->f_vnode; intlabel = mac_vnode_label_alloc(); vn_lock(vp, LK_EXCLUSIVE | LK_RETRY); mac_vnode_copy_label(vp->v_label, intlabel); VOP_UNLOCK(vp); error = mac_vnode_externalize_label(intlabel, mac.m_string, buffer, mac.m_buflen); mac_vnode_label_free(intlabel); break; case DTYPE_PIPE: if (!(mac_labeled & MPC_OBJECT_PIPE)) { error = EINVAL; goto out_fdrop; } pipe = fp->f_data; intlabel = mac_pipe_label_alloc(); PIPE_LOCK(pipe); mac_pipe_copy_label(pipe->pipe_pair->pp_label, intlabel); PIPE_UNLOCK(pipe); error = mac_pipe_externalize_label(intlabel, mac.m_string, buffer, mac.m_buflen); mac_pipe_label_free(intlabel); break; case DTYPE_SOCKET: if (!(mac_labeled & MPC_OBJECT_SOCKET)) { error = EINVAL; goto out_fdrop; } so = fp->f_data; intlabel = mac_socket_label_alloc(M_WAITOK); SOCK_LOCK(so); mac_socket_copy_label(so->so_label, intlabel); SOCK_UNLOCK(so); error = mac_socket_externalize_label(intlabel, mac.m_string, buffer, mac.m_buflen); mac_socket_label_free(intlabel); break; default: error = EINVAL; } if (error == 0) error = copyout(buffer, u_buffer, strlen(buffer)+1); out_fdrop: fdrop(fp, td); out: free(buffer, M_MACTEMP); free_copied_label(&mac); return (error); } int sys___mac_get_file(struct thread *td, struct __mac_get_file_args *uap) { return (kern___mac_get_path(td, uap->path_p, uap->mac_p, FOLLOW)); } int sys___mac_get_link(struct thread *td, struct __mac_get_link_args *uap) { return (kern___mac_get_path(td, uap->path_p, uap->mac_p, NOFOLLOW)); } static int kern___mac_get_path(struct thread *td, const char *path_p, struct mac *mac_p, int follow) { char *u_buffer, *buffer; struct nameidata nd; struct label *intlabel; struct mac mac; int error; if (!(mac_labeled & MPC_OBJECT_VNODE)) return (EINVAL); error = mac_label_copyin(mac_p, &mac, &u_buffer); if (error) return (error); buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK | M_ZERO); NDINIT(&nd, LOOKUP, LOCKLEAF | follow, UIO_USERSPACE, path_p); error = namei(&nd); if (error) goto out; intlabel = mac_vnode_label_alloc(); mac_vnode_copy_label(nd.ni_vp->v_label, intlabel); error = mac_vnode_externalize_label(intlabel, mac.m_string, buffer, mac.m_buflen); vput(nd.ni_vp); NDFREE_PNBUF(&nd); mac_vnode_label_free(intlabel); if (error == 0) error = copyout(buffer, u_buffer, strlen(buffer)+1); out: free(buffer, M_MACTEMP); free_copied_label(&mac); return (error); } int sys___mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap) { struct label *intlabel; struct pipe *pipe; struct socket *so; struct file *fp; struct mount *mp; struct vnode *vp; struct mac mac; cap_rights_t rights; int error; error = mac_label_copyin(uap->mac_p, &mac, NULL); if (error) return (error); error = fget(td, uap->fd, cap_rights_init_one(&rights, CAP_MAC_SET), &fp); if (error) goto out; switch (fp->f_type) { case DTYPE_FIFO: case DTYPE_VNODE: if (!(mac_labeled & MPC_OBJECT_VNODE)) { error = EINVAL; goto out_fdrop; } intlabel = mac_vnode_label_alloc(); error = mac_vnode_internalize_label(intlabel, mac.m_string); if (error) { mac_vnode_label_free(intlabel); break; } vp = fp->f_vnode; error = vn_start_write(vp, &mp, V_WAIT | V_PCATCH); if (error != 0) { mac_vnode_label_free(intlabel); break; } vn_lock(vp, LK_EXCLUSIVE | LK_RETRY); error = vn_setlabel(vp, intlabel, td->td_ucred); VOP_UNLOCK(vp); vn_finished_write(mp); mac_vnode_label_free(intlabel); break; case DTYPE_PIPE: if (!(mac_labeled & MPC_OBJECT_PIPE)) { error = EINVAL; goto out_fdrop; } intlabel = mac_pipe_label_alloc(); error = mac_pipe_internalize_label(intlabel, mac.m_string); if (error == 0) { pipe = fp->f_data; PIPE_LOCK(pipe); error = mac_pipe_label_set(td->td_ucred, pipe->pipe_pair, intlabel); PIPE_UNLOCK(pipe); } mac_pipe_label_free(intlabel); break; case DTYPE_SOCKET: if (!(mac_labeled & MPC_OBJECT_SOCKET)) { error = EINVAL; goto out_fdrop; } intlabel = mac_socket_label_alloc(M_WAITOK); error = mac_socket_internalize_label(intlabel, mac.m_string); if (error == 0) { so = fp->f_data; error = mac_socket_label_set(td->td_ucred, so, intlabel); } mac_socket_label_free(intlabel); break; default: error = EINVAL; } out_fdrop: fdrop(fp, td); out: free_copied_label(&mac); return (error); } int sys___mac_set_file(struct thread *td, struct __mac_set_file_args *uap) { return (kern___mac_set_path(td, uap->path_p, uap->mac_p, FOLLOW)); } int sys___mac_set_link(struct thread *td, struct __mac_set_link_args *uap) { return (kern___mac_set_path(td, uap->path_p, uap->mac_p, NOFOLLOW)); } static int kern___mac_set_path(struct thread *td, const char *path_p, struct mac *mac_p, int follow) { struct label *intlabel; struct nameidata nd; struct mount *mp; struct mac mac; int error; if (!(mac_labeled & MPC_OBJECT_VNODE)) return (EINVAL); error = mac_label_copyin(mac_p, &mac, NULL); if (error) return (error); intlabel = mac_vnode_label_alloc(); error = mac_vnode_internalize_label(intlabel, mac.m_string); free_copied_label(&mac); if (error) goto out; NDINIT(&nd, LOOKUP, LOCKLEAF | follow, UIO_USERSPACE, path_p); error = namei(&nd); if (error == 0) { error = vn_start_write(nd.ni_vp, &mp, V_WAIT | V_PCATCH); if (error == 0) { error = vn_setlabel(nd.ni_vp, intlabel, td->td_ucred); vn_finished_write(mp); } vput(nd.ni_vp); NDFREE_PNBUF(&nd); } out: mac_vnode_label_free(intlabel); return (error); } int sys_mac_syscall(struct thread *td, struct mac_syscall_args *uap) { struct mac_policy_conf *mpc; char target[MAC_MAX_POLICY_NAME]; int error; error = copyinstr(uap->policy, target, sizeof(target), NULL); if (error) return (error); error = ENOSYS; LIST_FOREACH(mpc, &mac_static_policy_list, mpc_list) { if (strcmp(mpc->mpc_name, target) == 0 && mpc->mpc_ops->mpo_syscall != NULL) { error = mpc->mpc_ops->mpo_syscall(td, uap->call, uap->arg); goto out; } } if (!LIST_EMPTY(&mac_policy_list)) { mac_policy_slock_sleep(); LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { if (strcmp(mpc->mpc_name, target) == 0 && mpc->mpc_ops->mpo_syscall != NULL) { error = mpc->mpc_ops->mpo_syscall(td, uap->call, uap->arg); break; } } mac_policy_sunlock_sleep(); } out: return (error); } #else /* !MAC */ int sys___mac_get_pid(struct thread *td, struct __mac_get_pid_args *uap) { return (ENOSYS); } int sys___mac_get_proc(struct thread *td, struct __mac_get_proc_args *uap) { return (ENOSYS); } int sys___mac_set_proc(struct thread *td, struct __mac_set_proc_args *uap) { return (ENOSYS); } int sys___mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap) { return (ENOSYS); } int sys___mac_get_file(struct thread *td, struct __mac_get_file_args *uap) { return (ENOSYS); } int sys___mac_get_link(struct thread *td, struct __mac_get_link_args *uap) { return (ENOSYS); } int sys___mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap) { return (ENOSYS); } int sys___mac_set_file(struct thread *td, struct __mac_set_file_args *uap) { return (ENOSYS); } int sys___mac_set_link(struct thread *td, struct __mac_set_link_args *uap) { return (ENOSYS); } int sys_mac_syscall(struct thread *td, struct mac_syscall_args *uap) { return (ENOSYS); } #endif /* !MAC */ diff --git a/sys/security/mac/mac_syscalls.h b/sys/security/mac/mac_syscalls.h index 37445eafe364..4efeaf300d31 100644 --- a/sys/security/mac/mac_syscalls.h +++ b/sys/security/mac/mac_syscalls.h @@ -1,33 +1,40 @@ /*- * SPDX-License-Identifier: BSD-2-Clause * * Copyright (c) 2024 The FreeBSD Foundation * * This software was developed by Olivier Certner at * Kumacom SARL under sponsorship from the FreeBSD Foundation. */ /* * Prototypes for functions used to implement system calls that must manipulate * MAC labels. */ #ifndef _SECURITY_MAC_MAC_SYSCALLS_H_ #define _SECURITY_MAC_MAC_SYSCALLS_H_ #ifndef _KERNEL #error "no user-serviceable parts inside" #endif int mac_label_copyin(const struct mac *const u_mac, struct mac *const mac, char **const u_string); void free_copied_label(const struct mac *const mac); +#ifdef COMPAT_FREEBSD32 +struct mac32; + +int mac_label_copyin32(const struct mac32 *const u_mac, + struct mac *const mac, char **const u_string); +#endif /* COMPAT_FREEBSD32 */ + int mac_set_proc_prepare(struct thread *const td, const struct mac *const mac, void **const mac_set_proc_data); int mac_set_proc_core(struct thread *const td, struct ucred *const newcred, void *const mac_set_proc_data); void mac_set_proc_finish(struct thread *const td, bool proc_label_set, void *const mac_set_proc_data); #endif /* !_SECURITY_MAC_MAC_SYSCALLS_H_ */