Index: head/sys/kern/kern_mac.c =================================================================== --- head/sys/kern/kern_mac.c (revision 104528) +++ head/sys/kern/kern_mac.c (revision 104529) @@ -1,3432 +1,3462 @@ /*- * Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson * Copyright (c) 2001 Ilmar S. Habibulin * Copyright (c) 2001, 2002 Networks Associates Technology, Inc. * All rights reserved. * * This software was developed by Robert Watson and Ilmar Habibulin for the * TrustedBSD Project. * * This software was developed for the FreeBSD Project in part by NAI Labs, * the Security Research Division of Network Associates, Inc. under * DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA * CHATS research program. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * 3. The names of the authors may not be used to endorse or promote * products derived from this software without specific prior written * permission. * * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. * * $FreeBSD$ */ /* * Developed by the TrustedBSD Project. * * Framework for extensible kernel access control. Kernel and userland * interface to the framework, policy registration and composition. */ #include "opt_mac.h" #include "opt_devfs.h" #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #ifdef MAC /* * Declare that the kernel provides MAC support, version 1. This permits * modules to refuse to be loaded if the necessary support isn't present, * even if it's pre-boot. */ MODULE_VERSION(kernel_mac_support, 1); SYSCTL_DECL(_security); SYSCTL_NODE(_security, OID_AUTO, mac, CTLFLAG_RW, 0, "TrustedBSD MAC policy controls"); #ifndef MAC_MAX_POLICIES #define MAC_MAX_POLICIES 8 #endif #if MAC_MAX_POLICIES > 32 #error "MAC_MAX_POLICIES too large" #endif static unsigned int mac_max_policies = MAC_MAX_POLICIES; static unsigned int mac_policy_offsets_free = (1 << MAC_MAX_POLICIES) - 1; SYSCTL_UINT(_security_mac, OID_AUTO, max_policies, CTLFLAG_RD, &mac_max_policies, 0, ""); static int mac_late = 0; static int mac_enforce_fs = 1; SYSCTL_INT(_security_mac, OID_AUTO, enforce_fs, CTLFLAG_RW, &mac_enforce_fs, 0, "Enforce MAC policy on file system objects"); TUNABLE_INT("security.mac.enforce_fs", &mac_enforce_fs); static int mac_enforce_network = 1; SYSCTL_INT(_security_mac, OID_AUTO, enforce_network, CTLFLAG_RW, &mac_enforce_network, 0, "Enforce MAC policy on network packets"); TUNABLE_INT("security.mac.enforce_network", &mac_enforce_network); static int mac_enforce_pipe = 1; SYSCTL_INT(_security_mac, OID_AUTO, enforce_pipe, CTLFLAG_RW, &mac_enforce_pipe, 0, "Enforce MAC policy on pipe operations"); TUNABLE_INT("security.mac.enforce_pipe", &mac_enforce_pipe); static int mac_enforce_process = 1; SYSCTL_INT(_security_mac, OID_AUTO, enforce_process, CTLFLAG_RW, &mac_enforce_process, 0, "Enforce MAC policy on inter-process operations"); TUNABLE_INT("security.mac.enforce_process", &mac_enforce_process); static int mac_enforce_socket = 1; SYSCTL_INT(_security_mac, OID_AUTO, enforce_socket, CTLFLAG_RW, &mac_enforce_socket, 0, "Enforce MAC policy on socket operations"); TUNABLE_INT("security.mac.enforce_socket", &mac_enforce_socket); static int mac_enforce_vm = 1; SYSCTL_INT(_security_mac, OID_AUTO, enforce_vm, CTLFLAG_RW, &mac_enforce_vm, 0, "Enforce MAC policy on vm operations"); TUNABLE_INT("security.mac.enforce_vm", &mac_enforce_vm); static int mac_label_size = sizeof(struct mac); SYSCTL_INT(_security_mac, OID_AUTO, label_size, CTLFLAG_RD, &mac_label_size, 0, "Pre-compiled MAC label size"); static int mac_cache_fslabel_in_vnode = 1; SYSCTL_INT(_security_mac, OID_AUTO, cache_fslabel_in_vnode, CTLFLAG_RW, &mac_cache_fslabel_in_vnode, 0, "Cache mount fslabel in vnode"); TUNABLE_INT("security.mac.cache_fslabel_in_vnode", &mac_cache_fslabel_in_vnode); static int mac_vnode_label_cache_hits = 0; SYSCTL_INT(_security_mac, OID_AUTO, vnode_label_cache_hits, CTLFLAG_RD, &mac_vnode_label_cache_hits, 0, "Cache hits on vnode labels"); static int mac_vnode_label_cache_misses = 0; SYSCTL_INT(_security_mac, OID_AUTO, vnode_label_cache_misses, CTLFLAG_RD, &mac_vnode_label_cache_misses, 0, "Cache misses on vnode labels"); static int mac_mmap_revocation = 1; SYSCTL_INT(_security_mac, OID_AUTO, mmap_revocation, CTLFLAG_RW, &mac_mmap_revocation, 0, "Revoke mmap access to files on subject " "relabel"); static int mac_mmap_revocation_via_cow = 0; SYSCTL_INT(_security_mac, OID_AUTO, mmap_revocation_via_cow, CTLFLAG_RW, &mac_mmap_revocation_via_cow, 0, "Revoke mmap access to files via " "copy-on-write semantics, or by removing all write access"); #ifdef MAC_DEBUG SYSCTL_NODE(_security_mac, OID_AUTO, debug, CTLFLAG_RW, 0, "TrustedBSD MAC debug info"); static int mac_debug_label_fallback = 0; SYSCTL_INT(_security_mac_debug, OID_AUTO, label_fallback, CTLFLAG_RW, &mac_debug_label_fallback, 0, "Filesystems should fall back to fs label" "when label is corrupted."); TUNABLE_INT("security.mac.debug_label_fallback", &mac_debug_label_fallback); SYSCTL_NODE(_security_mac_debug, OID_AUTO, counters, CTLFLAG_RW, 0, "TrustedBSD MAC object counters"); static unsigned int nmacmbufs, nmaccreds, nmacifnets, nmacbpfdescs, nmacsockets, nmacmounts, nmactemp, nmacvnodes, nmacdevfsdirents, nmacipqs, nmacpipes; SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, mbufs, CTLFLAG_RD, &nmacmbufs, 0, "number of mbufs in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, creds, CTLFLAG_RD, &nmaccreds, 0, "number of ucreds in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, ifnets, CTLFLAG_RD, &nmacifnets, 0, "number of ifnets in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, ipqs, CTLFLAG_RD, &nmacipqs, 0, "number of ipqs in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, bpfdescs, CTLFLAG_RD, &nmacbpfdescs, 0, "number of bpfdescs in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, sockets, CTLFLAG_RD, &nmacsockets, 0, "number of sockets in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, pipes, CTLFLAG_RD, &nmacpipes, 0, "number of pipes in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, mounts, CTLFLAG_RD, &nmacmounts, 0, "number of mounts in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, temp, CTLFLAG_RD, &nmactemp, 0, "number of temporary labels in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, vnodes, CTLFLAG_RD, &nmacvnodes, 0, "number of vnodes in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, devfsdirents, CTLFLAG_RD, &nmacdevfsdirents, 0, "number of devfs dirents inuse"); #endif static int error_select(int error1, int error2); static int mac_externalize(struct label *label, struct mac *mac); static int mac_policy_register(struct mac_policy_conf *mpc); static int mac_policy_unregister(struct mac_policy_conf *mpc); static int mac_stdcreatevnode_ea(struct vnode *vp); static void mac_cred_mmapped_drop_perms(struct thread *td, struct ucred *cred); static void mac_cred_mmapped_drop_perms_recurse(struct thread *td, struct ucred *cred, struct vm_map *map); MALLOC_DEFINE(M_MACOPVEC, "macopvec", "MAC policy operation vector"); MALLOC_DEFINE(M_MACPIPELABEL, "macpipelabel", "MAC labels for pipes"); /* * mac_policy_list_lock protects the consistency of 'mac_policy_list', * the linked list of attached policy modules. Read-only consumers of * the list must acquire a shared lock for the duration of their use; * writers must acquire an exclusive lock. Note that for compound * operations, locks should be held for the entire compound operation, * and that this is not yet done for relabel requests. */ static struct mtx mac_policy_list_lock; static LIST_HEAD(, mac_policy_conf) mac_policy_list; static int mac_policy_list_busy; #define MAC_POLICY_LIST_LOCKINIT() mtx_init(&mac_policy_list_lock, \ "mac_policy_list_lock", NULL, MTX_DEF); #define MAC_POLICY_LIST_LOCK() mtx_lock(&mac_policy_list_lock); #define MAC_POLICY_LIST_UNLOCK() mtx_unlock(&mac_policy_list_lock); #define MAC_POLICY_LIST_BUSY() do { \ MAC_POLICY_LIST_LOCK(); \ mac_policy_list_busy++; \ MAC_POLICY_LIST_UNLOCK(); \ } while (0) #define MAC_POLICY_LIST_UNBUSY() do { \ MAC_POLICY_LIST_LOCK(); \ mac_policy_list_busy--; \ if (mac_policy_list_busy < 0) \ panic("Extra mac_policy_list_busy--"); \ MAC_POLICY_LIST_UNLOCK(); \ } while (0) /* * MAC_CHECK performs the designated check by walking the policy * module list and checking with each as to how it feels about the * request. Note that it returns its value via 'error' in the scope * of the caller. */ #define MAC_CHECK(check, args...) do { \ struct mac_policy_conf *mpc; \ \ error = 0; \ MAC_POLICY_LIST_BUSY(); \ LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { \ if (mpc->mpc_ops->mpo_ ## check != NULL) \ error = error_select( \ mpc->mpc_ops->mpo_ ## check (args), \ error); \ } \ MAC_POLICY_LIST_UNBUSY(); \ } while (0) /* * MAC_BOOLEAN performs the designated boolean composition by walking * the module list, invoking each instance of the operation, and * combining the results using the passed C operator. Note that it * returns its value via 'result' in the scope of the caller, which * should be initialized by the caller in a meaningful way to get * a meaningful result. */ #define MAC_BOOLEAN(operation, composition, args...) do { \ struct mac_policy_conf *mpc; \ \ MAC_POLICY_LIST_BUSY(); \ LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { \ if (mpc->mpc_ops->mpo_ ## operation != NULL) \ result = result composition \ mpc->mpc_ops->mpo_ ## operation (args); \ } \ MAC_POLICY_LIST_UNBUSY(); \ } while (0) /* * MAC_PERFORM performs the designated operation by walking the policy * module list and invoking that operation for each policy. */ #define MAC_PERFORM(operation, args...) do { \ struct mac_policy_conf *mpc; \ \ MAC_POLICY_LIST_BUSY(); \ LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { \ if (mpc->mpc_ops->mpo_ ## operation != NULL) \ mpc->mpc_ops->mpo_ ## operation (args); \ } \ MAC_POLICY_LIST_UNBUSY(); \ } while (0) /* * Initialize the MAC subsystem, including appropriate SMP locks. */ static void mac_init(void) { LIST_INIT(&mac_policy_list); MAC_POLICY_LIST_LOCKINIT(); } /* * For the purposes of modules that want to know if they were loaded * "early", set the mac_late flag once we've processed modules either * linked into the kernel, or loaded before the kernel startup. */ static void mac_late_init(void) { mac_late = 1; } /* * Allow MAC policy modules to register during boot, etc. */ int mac_policy_modevent(module_t mod, int type, void *data) { struct mac_policy_conf *mpc; int error; error = 0; mpc = (struct mac_policy_conf *) data; switch (type) { case MOD_LOAD: if (mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_NOTLATE && mac_late) { printf("mac_policy_modevent: can't load %s policy " "after booting\n", mpc->mpc_name); error = EBUSY; break; } error = mac_policy_register(mpc); break; case MOD_UNLOAD: /* Don't unregister the module if it was never registered. */ if ((mpc->mpc_runtime_flags & MPC_RUNTIME_FLAG_REGISTERED) != 0) error = mac_policy_unregister(mpc); else error = 0; break; default: break; } return (error); } static int mac_policy_register(struct mac_policy_conf *mpc) { struct mac_policy_conf *tmpc; struct mac_policy_op_entry *mpe; int slot; MALLOC(mpc->mpc_ops, struct mac_policy_ops *, sizeof(*mpc->mpc_ops), M_MACOPVEC, M_WAITOK | M_ZERO); for (mpe = mpc->mpc_entries; mpe->mpe_constant != MAC_OP_LAST; mpe++) { switch (mpe->mpe_constant) { case MAC_OP_LAST: /* * Doesn't actually happen, but this allows checking * that all enumerated values are handled. */ break; case MAC_DESTROY: mpc->mpc_ops->mpo_destroy = mpe->mpe_function; break; case MAC_INIT: mpc->mpc_ops->mpo_init = mpe->mpe_function; break; case MAC_SYSCALL: mpc->mpc_ops->mpo_syscall = mpe->mpe_function; break; case MAC_INIT_BPFDESC_LABEL: mpc->mpc_ops->mpo_init_bpfdesc_label = mpe->mpe_function; break; case MAC_INIT_CRED_LABEL: mpc->mpc_ops->mpo_init_cred_label = mpe->mpe_function; break; case MAC_INIT_DEVFSDIRENT_LABEL: mpc->mpc_ops->mpo_init_devfsdirent_label = mpe->mpe_function; break; case MAC_INIT_IFNET_LABEL: mpc->mpc_ops->mpo_init_ifnet_label = mpe->mpe_function; break; case MAC_INIT_IPQ_LABEL: mpc->mpc_ops->mpo_init_ipq_label = mpe->mpe_function; break; case MAC_INIT_MBUF_LABEL: mpc->mpc_ops->mpo_init_mbuf_label = mpe->mpe_function; break; case MAC_INIT_MOUNT_LABEL: mpc->mpc_ops->mpo_init_mount_label = mpe->mpe_function; break; case MAC_INIT_MOUNT_FS_LABEL: mpc->mpc_ops->mpo_init_mount_fs_label = mpe->mpe_function; break; case MAC_INIT_PIPE_LABEL: mpc->mpc_ops->mpo_init_pipe_label = mpe->mpe_function; break; case MAC_INIT_SOCKET_LABEL: mpc->mpc_ops->mpo_init_socket_label = mpe->mpe_function; break; case MAC_INIT_SOCKET_PEER_LABEL: mpc->mpc_ops->mpo_init_socket_peer_label = mpe->mpe_function; break; case MAC_INIT_TEMP_LABEL: mpc->mpc_ops->mpo_init_temp_label = mpe->mpe_function; break; case MAC_INIT_VNODE_LABEL: mpc->mpc_ops->mpo_init_vnode_label = mpe->mpe_function; break; case MAC_DESTROY_BPFDESC_LABEL: mpc->mpc_ops->mpo_destroy_bpfdesc_label = mpe->mpe_function; break; case MAC_DESTROY_CRED_LABEL: mpc->mpc_ops->mpo_destroy_cred_label = mpe->mpe_function; break; case MAC_DESTROY_DEVFSDIRENT_LABEL: mpc->mpc_ops->mpo_destroy_devfsdirent_label = mpe->mpe_function; break; case MAC_DESTROY_IFNET_LABEL: mpc->mpc_ops->mpo_destroy_ifnet_label = mpe->mpe_function; break; case MAC_DESTROY_IPQ_LABEL: mpc->mpc_ops->mpo_destroy_ipq_label = mpe->mpe_function; break; case MAC_DESTROY_MBUF_LABEL: mpc->mpc_ops->mpo_destroy_mbuf_label = mpe->mpe_function; break; case MAC_DESTROY_MOUNT_LABEL: mpc->mpc_ops->mpo_destroy_mount_label = mpe->mpe_function; break; case MAC_DESTROY_MOUNT_FS_LABEL: mpc->mpc_ops->mpo_destroy_mount_fs_label = mpe->mpe_function; break; case MAC_DESTROY_PIPE_LABEL: mpc->mpc_ops->mpo_destroy_pipe_label = mpe->mpe_function; break; case MAC_DESTROY_SOCKET_LABEL: mpc->mpc_ops->mpo_destroy_socket_label = mpe->mpe_function; break; case MAC_DESTROY_SOCKET_PEER_LABEL: mpc->mpc_ops->mpo_destroy_socket_peer_label = mpe->mpe_function; break; case MAC_DESTROY_TEMP_LABEL: mpc->mpc_ops->mpo_destroy_temp_label = mpe->mpe_function; break; case MAC_DESTROY_VNODE_LABEL: mpc->mpc_ops->mpo_destroy_vnode_label = mpe->mpe_function; break; case MAC_EXTERNALIZE: mpc->mpc_ops->mpo_externalize = mpe->mpe_function; break; case MAC_INTERNALIZE: mpc->mpc_ops->mpo_internalize = mpe->mpe_function; break; case MAC_CREATE_DEVFS_DEVICE: mpc->mpc_ops->mpo_create_devfs_device = mpe->mpe_function; break; case MAC_CREATE_DEVFS_DIRECTORY: mpc->mpc_ops->mpo_create_devfs_directory = mpe->mpe_function; break; case MAC_CREATE_DEVFS_VNODE: mpc->mpc_ops->mpo_create_devfs_vnode = mpe->mpe_function; break; case MAC_STDCREATEVNODE_EA: mpc->mpc_ops->mpo_stdcreatevnode_ea = mpe->mpe_function; break; case MAC_CREATE_VNODE: mpc->mpc_ops->mpo_create_vnode = mpe->mpe_function; break; case MAC_CREATE_MOUNT: mpc->mpc_ops->mpo_create_mount = mpe->mpe_function; break; case MAC_CREATE_ROOT_MOUNT: mpc->mpc_ops->mpo_create_root_mount = mpe->mpe_function; break; case MAC_RELABEL_VNODE: mpc->mpc_ops->mpo_relabel_vnode = mpe->mpe_function; break; case MAC_UPDATE_DEVFSDIRENT: mpc->mpc_ops->mpo_update_devfsdirent = mpe->mpe_function; break; case MAC_UPDATE_PROCFSVNODE: mpc->mpc_ops->mpo_update_procfsvnode = mpe->mpe_function; break; case MAC_UPDATE_VNODE_FROM_EXTATTR: mpc->mpc_ops->mpo_update_vnode_from_extattr = mpe->mpe_function; break; case MAC_UPDATE_VNODE_FROM_EXTERNALIZED: mpc->mpc_ops->mpo_update_vnode_from_externalized = mpe->mpe_function; break; case MAC_UPDATE_VNODE_FROM_MOUNT: mpc->mpc_ops->mpo_update_vnode_from_mount = mpe->mpe_function; break; case MAC_CREATE_MBUF_FROM_SOCKET: mpc->mpc_ops->mpo_create_mbuf_from_socket = mpe->mpe_function; break; case MAC_CREATE_PIPE: mpc->mpc_ops->mpo_create_pipe = mpe->mpe_function; break; case MAC_CREATE_SOCKET: mpc->mpc_ops->mpo_create_socket = mpe->mpe_function; break; case MAC_CREATE_SOCKET_FROM_SOCKET: mpc->mpc_ops->mpo_create_socket_from_socket = mpe->mpe_function; break; case MAC_RELABEL_PIPE: mpc->mpc_ops->mpo_relabel_pipe = mpe->mpe_function; break; case MAC_RELABEL_SOCKET: mpc->mpc_ops->mpo_relabel_socket = mpe->mpe_function; break; case MAC_SET_SOCKET_PEER_FROM_MBUF: mpc->mpc_ops->mpo_set_socket_peer_from_mbuf = mpe->mpe_function; break; case MAC_SET_SOCKET_PEER_FROM_SOCKET: mpc->mpc_ops->mpo_set_socket_peer_from_socket = mpe->mpe_function; break; case MAC_CREATE_BPFDESC: mpc->mpc_ops->mpo_create_bpfdesc = mpe->mpe_function; break; case MAC_CREATE_DATAGRAM_FROM_IPQ: mpc->mpc_ops->mpo_create_datagram_from_ipq = mpe->mpe_function; break; case MAC_CREATE_FRAGMENT: mpc->mpc_ops->mpo_create_fragment = mpe->mpe_function; break; case MAC_CREATE_IFNET: mpc->mpc_ops->mpo_create_ifnet = mpe->mpe_function; break; case MAC_CREATE_IPQ: mpc->mpc_ops->mpo_create_ipq = mpe->mpe_function; break; case MAC_CREATE_MBUF_FROM_MBUF: mpc->mpc_ops->mpo_create_mbuf_from_mbuf = mpe->mpe_function; break; case MAC_CREATE_MBUF_LINKLAYER: mpc->mpc_ops->mpo_create_mbuf_linklayer = mpe->mpe_function; break; case MAC_CREATE_MBUF_FROM_BPFDESC: mpc->mpc_ops->mpo_create_mbuf_from_bpfdesc = mpe->mpe_function; break; case MAC_CREATE_MBUF_FROM_IFNET: mpc->mpc_ops->mpo_create_mbuf_from_ifnet = mpe->mpe_function; break; case MAC_CREATE_MBUF_MULTICAST_ENCAP: mpc->mpc_ops->mpo_create_mbuf_multicast_encap = mpe->mpe_function; break; case MAC_CREATE_MBUF_NETLAYER: mpc->mpc_ops->mpo_create_mbuf_netlayer = mpe->mpe_function; break; case MAC_FRAGMENT_MATCH: mpc->mpc_ops->mpo_fragment_match = mpe->mpe_function; break; case MAC_RELABEL_IFNET: mpc->mpc_ops->mpo_relabel_ifnet = mpe->mpe_function; break; case MAC_UPDATE_IPQ: mpc->mpc_ops->mpo_update_ipq = mpe->mpe_function; break; case MAC_CREATE_CRED: mpc->mpc_ops->mpo_create_cred = mpe->mpe_function; break; case MAC_EXECVE_TRANSITION: mpc->mpc_ops->mpo_execve_transition = mpe->mpe_function; break; case MAC_EXECVE_WILL_TRANSITION: mpc->mpc_ops->mpo_execve_will_transition = mpe->mpe_function; break; case MAC_CREATE_PROC0: mpc->mpc_ops->mpo_create_proc0 = mpe->mpe_function; break; case MAC_CREATE_PROC1: mpc->mpc_ops->mpo_create_proc1 = mpe->mpe_function; break; case MAC_RELABEL_CRED: mpc->mpc_ops->mpo_relabel_cred = mpe->mpe_function; break; case MAC_THREAD_USERRET: mpc->mpc_ops->mpo_thread_userret = mpe->mpe_function; break; case MAC_CHECK_BPFDESC_RECEIVE: mpc->mpc_ops->mpo_check_bpfdesc_receive = mpe->mpe_function; break; case MAC_CHECK_CRED_RELABEL: mpc->mpc_ops->mpo_check_cred_relabel = mpe->mpe_function; break; case MAC_CHECK_CRED_VISIBLE: mpc->mpc_ops->mpo_check_cred_visible = mpe->mpe_function; break; case MAC_CHECK_IFNET_RELABEL: mpc->mpc_ops->mpo_check_ifnet_relabel = mpe->mpe_function; break; case MAC_CHECK_IFNET_TRANSMIT: mpc->mpc_ops->mpo_check_ifnet_transmit = mpe->mpe_function; break; case MAC_CHECK_MOUNT_STAT: mpc->mpc_ops->mpo_check_mount_stat = mpe->mpe_function; break; case MAC_CHECK_PIPE_IOCTL: mpc->mpc_ops->mpo_check_pipe_ioctl = mpe->mpe_function; break; case MAC_CHECK_PIPE_POLL: mpc->mpc_ops->mpo_check_pipe_poll = mpe->mpe_function; break; case MAC_CHECK_PIPE_READ: mpc->mpc_ops->mpo_check_pipe_read = mpe->mpe_function; break; case MAC_CHECK_PIPE_RELABEL: mpc->mpc_ops->mpo_check_pipe_relabel = mpe->mpe_function; break; case MAC_CHECK_PIPE_STAT: mpc->mpc_ops->mpo_check_pipe_stat = mpe->mpe_function; break; case MAC_CHECK_PIPE_WRITE: mpc->mpc_ops->mpo_check_pipe_write = mpe->mpe_function; break; case MAC_CHECK_PROC_DEBUG: mpc->mpc_ops->mpo_check_proc_debug = mpe->mpe_function; break; case MAC_CHECK_PROC_SCHED: mpc->mpc_ops->mpo_check_proc_sched = mpe->mpe_function; break; case MAC_CHECK_PROC_SIGNAL: mpc->mpc_ops->mpo_check_proc_signal = mpe->mpe_function; break; case MAC_CHECK_SOCKET_BIND: mpc->mpc_ops->mpo_check_socket_bind = mpe->mpe_function; break; case MAC_CHECK_SOCKET_CONNECT: mpc->mpc_ops->mpo_check_socket_connect = mpe->mpe_function; break; case MAC_CHECK_SOCKET_DELIVER: mpc->mpc_ops->mpo_check_socket_deliver = mpe->mpe_function; break; case MAC_CHECK_SOCKET_LISTEN: mpc->mpc_ops->mpo_check_socket_listen = mpe->mpe_function; break; case MAC_CHECK_SOCKET_RELABEL: mpc->mpc_ops->mpo_check_socket_relabel = mpe->mpe_function; break; case MAC_CHECK_SOCKET_VISIBLE: mpc->mpc_ops->mpo_check_socket_visible = mpe->mpe_function; break; case MAC_CHECK_VNODE_ACCESS: mpc->mpc_ops->mpo_check_vnode_access = mpe->mpe_function; break; case MAC_CHECK_VNODE_CHDIR: mpc->mpc_ops->mpo_check_vnode_chdir = mpe->mpe_function; break; case MAC_CHECK_VNODE_CHROOT: mpc->mpc_ops->mpo_check_vnode_chroot = mpe->mpe_function; break; case MAC_CHECK_VNODE_CREATE: mpc->mpc_ops->mpo_check_vnode_create = mpe->mpe_function; break; case MAC_CHECK_VNODE_DELETE: mpc->mpc_ops->mpo_check_vnode_delete = mpe->mpe_function; break; case MAC_CHECK_VNODE_DELETEACL: mpc->mpc_ops->mpo_check_vnode_deleteacl = mpe->mpe_function; break; case MAC_CHECK_VNODE_EXEC: mpc->mpc_ops->mpo_check_vnode_exec = mpe->mpe_function; break; case MAC_CHECK_VNODE_GETACL: mpc->mpc_ops->mpo_check_vnode_getacl = mpe->mpe_function; break; case MAC_CHECK_VNODE_GETEXTATTR: mpc->mpc_ops->mpo_check_vnode_getextattr = mpe->mpe_function; break; + case MAC_CHECK_VNODE_LINK: + mpc->mpc_ops->mpo_check_vnode_link = + mpe->mpe_function; + break; case MAC_CHECK_VNODE_LOOKUP: mpc->mpc_ops->mpo_check_vnode_lookup = mpe->mpe_function; break; case MAC_CHECK_VNODE_MMAP_PERMS: mpc->mpc_ops->mpo_check_vnode_mmap_perms = mpe->mpe_function; break; case MAC_CHECK_VNODE_OPEN: mpc->mpc_ops->mpo_check_vnode_open = mpe->mpe_function; break; case MAC_CHECK_VNODE_POLL: mpc->mpc_ops->mpo_check_vnode_poll = mpe->mpe_function; break; case MAC_CHECK_VNODE_READ: mpc->mpc_ops->mpo_check_vnode_read = mpe->mpe_function; break; case MAC_CHECK_VNODE_READDIR: mpc->mpc_ops->mpo_check_vnode_readdir = mpe->mpe_function; break; case MAC_CHECK_VNODE_READLINK: mpc->mpc_ops->mpo_check_vnode_readlink = mpe->mpe_function; break; case MAC_CHECK_VNODE_RELABEL: mpc->mpc_ops->mpo_check_vnode_relabel = mpe->mpe_function; break; case MAC_CHECK_VNODE_RENAME_FROM: mpc->mpc_ops->mpo_check_vnode_rename_from = mpe->mpe_function; break; case MAC_CHECK_VNODE_RENAME_TO: mpc->mpc_ops->mpo_check_vnode_rename_to = mpe->mpe_function; break; case MAC_CHECK_VNODE_REVOKE: mpc->mpc_ops->mpo_check_vnode_revoke = mpe->mpe_function; break; case MAC_CHECK_VNODE_SETACL: mpc->mpc_ops->mpo_check_vnode_setacl = mpe->mpe_function; break; case MAC_CHECK_VNODE_SETEXTATTR: mpc->mpc_ops->mpo_check_vnode_setextattr = mpe->mpe_function; break; case MAC_CHECK_VNODE_SETFLAGS: mpc->mpc_ops->mpo_check_vnode_setflags = mpe->mpe_function; break; case MAC_CHECK_VNODE_SETMODE: mpc->mpc_ops->mpo_check_vnode_setmode = mpe->mpe_function; break; case MAC_CHECK_VNODE_SETOWNER: mpc->mpc_ops->mpo_check_vnode_setowner = mpe->mpe_function; break; case MAC_CHECK_VNODE_SETUTIMES: mpc->mpc_ops->mpo_check_vnode_setutimes = mpe->mpe_function; break; case MAC_CHECK_VNODE_STAT: mpc->mpc_ops->mpo_check_vnode_stat = mpe->mpe_function; break; case MAC_CHECK_VNODE_WRITE: mpc->mpc_ops->mpo_check_vnode_write = mpe->mpe_function; break; /* default: printf("MAC policy `%s': unknown operation %d\n", mpc->mpc_name, mpe->mpe_constant); return (EINVAL); */ } } MAC_POLICY_LIST_LOCK(); if (mac_policy_list_busy > 0) { MAC_POLICY_LIST_UNLOCK(); FREE(mpc->mpc_ops, M_MACOPVEC); mpc->mpc_ops = NULL; return (EBUSY); } LIST_FOREACH(tmpc, &mac_policy_list, mpc_list) { if (strcmp(tmpc->mpc_name, mpc->mpc_name) == 0) { MAC_POLICY_LIST_UNLOCK(); FREE(mpc->mpc_ops, M_MACOPVEC); mpc->mpc_ops = NULL; return (EEXIST); } } if (mpc->mpc_field_off != NULL) { slot = ffs(mac_policy_offsets_free); if (slot == 0) { MAC_POLICY_LIST_UNLOCK(); FREE(mpc->mpc_ops, M_MACOPVEC); mpc->mpc_ops = NULL; return (ENOMEM); } slot--; mac_policy_offsets_free &= ~(1 << slot); *mpc->mpc_field_off = slot; } mpc->mpc_runtime_flags |= MPC_RUNTIME_FLAG_REGISTERED; LIST_INSERT_HEAD(&mac_policy_list, mpc, mpc_list); /* Per-policy initialization. */ if (mpc->mpc_ops->mpo_init != NULL) (*(mpc->mpc_ops->mpo_init))(mpc); MAC_POLICY_LIST_UNLOCK(); printf("Security policy loaded: %s (%s)\n", mpc->mpc_fullname, mpc->mpc_name); return (0); } static int mac_policy_unregister(struct mac_policy_conf *mpc) { /* * If we fail the load, we may get a request to unload. Check * to see if we did the run-time registration, and if not, * silently succeed. */ MAC_POLICY_LIST_LOCK(); if ((mpc->mpc_runtime_flags & MPC_RUNTIME_FLAG_REGISTERED) == 0) { MAC_POLICY_LIST_UNLOCK(); return (0); } #if 0 /* * Don't allow unloading modules with private data. */ if (mpc->mpc_field_off != NULL) { MAC_POLICY_LIST_UNLOCK(); return (EBUSY); } #endif /* * Only allow the unload to proceed if the module is unloadable * by its own definition. */ if ((mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_UNLOADOK) == 0) { MAC_POLICY_LIST_UNLOCK(); return (EBUSY); } /* * Right now, we EBUSY if the list is in use. In the future, * for reliability reasons, we might want to sleep and wakeup * later to try again. */ if (mac_policy_list_busy > 0) { MAC_POLICY_LIST_UNLOCK(); return (EBUSY); } if (mpc->mpc_ops->mpo_destroy != NULL) (*(mpc->mpc_ops->mpo_destroy))(mpc); LIST_REMOVE(mpc, mpc_list); MAC_POLICY_LIST_UNLOCK(); FREE(mpc->mpc_ops, M_MACOPVEC); mpc->mpc_ops = NULL; printf("Security policy unload: %s (%s)\n", mpc->mpc_fullname, mpc->mpc_name); return (0); } /* * Define an error value precedence, and given two arguments, selects the * value with the higher precedence. */ static int error_select(int error1, int error2) { /* Certain decision-making errors take top priority. */ if (error1 == EDEADLK || error2 == EDEADLK) return (EDEADLK); /* Invalid arguments should be reported where possible. */ if (error1 == EINVAL || error2 == EINVAL) return (EINVAL); /* Precedence goes to "visibility", with both process and file. */ if (error1 == ESRCH || error2 == ESRCH) return (ESRCH); if (error1 == ENOENT || error2 == ENOENT) return (ENOENT); /* Precedence goes to DAC/MAC protections. */ if (error1 == EACCES || error2 == EACCES) return (EACCES); /* Precedence goes to privilege. */ if (error1 == EPERM || error2 == EPERM) return (EPERM); /* Precedence goes to error over success; otherwise, arbitrary. */ if (error1 != 0) return (error1); return (error2); } static void mac_init_label(struct label *label) { bzero(label, sizeof(*label)); label->l_flags = MAC_FLAG_INITIALIZED; } static void mac_destroy_label(struct label *label) { KASSERT(label->l_flags & MAC_FLAG_INITIALIZED, ("destroying uninitialized label")); bzero(label, sizeof(*label)); /* implicit: label->l_flags &= ~MAC_FLAG_INITIALIZED; */ } static void mac_init_structmac(struct mac *mac) { bzero(mac, sizeof(*mac)); mac->m_macflags = MAC_FLAG_INITIALIZED; } void mac_init_bpfdesc(struct bpf_d *bpf_d) { mac_init_label(&bpf_d->bd_label); MAC_PERFORM(init_bpfdesc_label, &bpf_d->bd_label); #ifdef MAC_DEBUG atomic_add_int(&nmacbpfdescs, 1); #endif } void mac_init_cred(struct ucred *cr) { mac_init_label(&cr->cr_label); MAC_PERFORM(init_cred_label, &cr->cr_label); #ifdef MAC_DEBUG atomic_add_int(&nmaccreds, 1); #endif } void mac_init_devfsdirent(struct devfs_dirent *de) { mac_init_label(&de->de_label); MAC_PERFORM(init_devfsdirent_label, &de->de_label); #ifdef MAC_DEBUG atomic_add_int(&nmacdevfsdirents, 1); #endif } void mac_init_ifnet(struct ifnet *ifp) { mac_init_label(&ifp->if_label); MAC_PERFORM(init_ifnet_label, &ifp->if_label); #ifdef MAC_DEBUG atomic_add_int(&nmacifnets, 1); #endif } void mac_init_ipq(struct ipq *ipq) { mac_init_label(&ipq->ipq_label); MAC_PERFORM(init_ipq_label, &ipq->ipq_label); #ifdef MAC_DEBUG atomic_add_int(&nmacipqs, 1); #endif } int mac_init_mbuf(struct mbuf *m, int flag) { int error; KASSERT(m->m_flags & M_PKTHDR, ("mac_init_mbuf on non-header mbuf")); mac_init_label(&m->m_pkthdr.label); MAC_CHECK(init_mbuf_label, &m->m_pkthdr.label, flag); if (error) { MAC_PERFORM(destroy_mbuf_label, &m->m_pkthdr.label); mac_destroy_label(&m->m_pkthdr.label); } #ifdef MAC_DEBUG if (error == 0) atomic_add_int(&nmacmbufs, 1); #endif return (error); } void mac_init_mount(struct mount *mp) { mac_init_label(&mp->mnt_mntlabel); mac_init_label(&mp->mnt_fslabel); MAC_PERFORM(init_mount_label, &mp->mnt_mntlabel); MAC_PERFORM(init_mount_fs_label, &mp->mnt_fslabel); #ifdef MAC_DEBUG atomic_add_int(&nmacmounts, 1); #endif } void mac_init_pipe(struct pipe *pipe) { struct label *label; label = malloc(sizeof(struct label), M_MACPIPELABEL, M_ZERO|M_WAITOK); mac_init_label(label); pipe->pipe_label = label; pipe->pipe_peer->pipe_label = label; MAC_PERFORM(init_pipe_label, pipe->pipe_label); #ifdef MAC_DEBUG atomic_add_int(&nmacpipes, 1); #endif } void mac_init_socket(struct socket *socket) { mac_init_label(&socket->so_label); mac_init_label(&socket->so_peerlabel); MAC_PERFORM(init_socket_label, &socket->so_label); MAC_PERFORM(init_socket_peer_label, &socket->so_peerlabel); #ifdef MAC_DEBUG atomic_add_int(&nmacsockets, 1); #endif } static void mac_init_temp(struct label *label) { mac_init_label(label); MAC_PERFORM(init_temp_label, label); #ifdef MAC_DEBUG atomic_add_int(&nmactemp, 1); #endif } void mac_init_vnode(struct vnode *vp) { mac_init_label(&vp->v_label); MAC_PERFORM(init_vnode_label, &vp->v_label); #ifdef MAC_DEBUG atomic_add_int(&nmacvnodes, 1); #endif } void mac_destroy_bpfdesc(struct bpf_d *bpf_d) { MAC_PERFORM(destroy_bpfdesc_label, &bpf_d->bd_label); mac_destroy_label(&bpf_d->bd_label); #ifdef MAC_DEBUG atomic_subtract_int(&nmacbpfdescs, 1); #endif } void mac_destroy_cred(struct ucred *cr) { MAC_PERFORM(destroy_cred_label, &cr->cr_label); mac_destroy_label(&cr->cr_label); #ifdef MAC_DEBUG atomic_subtract_int(&nmaccreds, 1); #endif } void mac_destroy_devfsdirent(struct devfs_dirent *de) { MAC_PERFORM(destroy_devfsdirent_label, &de->de_label); mac_destroy_label(&de->de_label); #ifdef MAC_DEBUG atomic_subtract_int(&nmacdevfsdirents, 1); #endif } void mac_destroy_ifnet(struct ifnet *ifp) { MAC_PERFORM(destroy_ifnet_label, &ifp->if_label); mac_destroy_label(&ifp->if_label); #ifdef MAC_DEBUG atomic_subtract_int(&nmacifnets, 1); #endif } void mac_destroy_ipq(struct ipq *ipq) { MAC_PERFORM(destroy_ipq_label, &ipq->ipq_label); mac_destroy_label(&ipq->ipq_label); #ifdef MAC_DEBUG atomic_subtract_int(&nmacipqs, 1); #endif } void mac_destroy_mbuf(struct mbuf *m) { MAC_PERFORM(destroy_mbuf_label, &m->m_pkthdr.label); mac_destroy_label(&m->m_pkthdr.label); #ifdef MAC_DEBUG atomic_subtract_int(&nmacmbufs, 1); #endif } void mac_destroy_mount(struct mount *mp) { MAC_PERFORM(destroy_mount_label, &mp->mnt_mntlabel); MAC_PERFORM(destroy_mount_fs_label, &mp->mnt_fslabel); mac_destroy_label(&mp->mnt_fslabel); mac_destroy_label(&mp->mnt_mntlabel); #ifdef MAC_DEBUG atomic_subtract_int(&nmacmounts, 1); #endif } void mac_destroy_pipe(struct pipe *pipe) { MAC_PERFORM(destroy_pipe_label, pipe->pipe_label); mac_destroy_label(pipe->pipe_label); free(pipe->pipe_label, M_MACPIPELABEL); #ifdef MAC_DEBUG atomic_subtract_int(&nmacpipes, 1); #endif } void mac_destroy_socket(struct socket *socket) { MAC_PERFORM(destroy_socket_label, &socket->so_label); MAC_PERFORM(destroy_socket_peer_label, &socket->so_peerlabel); mac_destroy_label(&socket->so_label); mac_destroy_label(&socket->so_peerlabel); #ifdef MAC_DEBUG atomic_subtract_int(&nmacsockets, 1); #endif } static void mac_destroy_temp(struct label *label) { MAC_PERFORM(destroy_temp_label, label); mac_destroy_label(label); #ifdef MAC_DEBUG atomic_subtract_int(&nmactemp, 1); #endif } void mac_destroy_vnode(struct vnode *vp) { MAC_PERFORM(destroy_vnode_label, &vp->v_label); mac_destroy_label(&vp->v_label); #ifdef MAC_DEBUG atomic_subtract_int(&nmacvnodes, 1); #endif } static int mac_externalize(struct label *label, struct mac *mac) { int error; mac_init_structmac(mac); MAC_CHECK(externalize, label, mac); return (error); } static int mac_internalize(struct label *label, struct mac *mac) { int error; mac_init_temp(label); MAC_CHECK(internalize, label, mac); if (error) mac_destroy_temp(label); return (error); } /* * Initialize MAC label for the first kernel process, from which other * kernel processes and threads are spawned. */ void mac_create_proc0(struct ucred *cred) { MAC_PERFORM(create_proc0, cred); } /* * Initialize MAC label for the first userland process, from which other * userland processes and threads are spawned. */ void mac_create_proc1(struct ucred *cred) { MAC_PERFORM(create_proc1, cred); } void mac_thread_userret(struct thread *td) { MAC_PERFORM(thread_userret, td); } /* * When a new process is created, its label must be initialized. Generally, * this involves inheritence from the parent process, modulo possible * deltas. This function allows that processing to take place. */ void mac_create_cred(struct ucred *parent_cred, struct ucred *child_cred) { MAC_PERFORM(create_cred, parent_cred, child_cred); } void mac_update_devfsdirent(struct devfs_dirent *de, struct vnode *vp) { MAC_PERFORM(update_devfsdirent, de, &de->de_label, vp, &vp->v_label); } void mac_update_procfsvnode(struct vnode *vp, struct ucred *cred) { MAC_PERFORM(update_procfsvnode, vp, &vp->v_label, cred); } /* * Support callout for policies that manage their own externalization * using extended attributes. */ static int mac_update_vnode_from_extattr(struct vnode *vp, struct mount *mp) { int error; MAC_CHECK(update_vnode_from_extattr, vp, &vp->v_label, mp, &mp->mnt_fslabel); return (error); } /* * Given an externalized mac label, internalize it and stamp it on a * vnode. */ static int mac_update_vnode_from_externalized(struct vnode *vp, struct mac *extmac) { int error; MAC_CHECK(update_vnode_from_externalized, vp, &vp->v_label, extmac); return (error); } /* * Call out to individual policies to update the label in a vnode from * the mountpoint. */ void mac_update_vnode_from_mount(struct vnode *vp, struct mount *mp) { MAC_PERFORM(update_vnode_from_mount, vp, &vp->v_label, mp, &mp->mnt_fslabel); ASSERT_VOP_LOCKED(vp, "mac_update_vnode_from_mount"); if (mac_cache_fslabel_in_vnode) vp->v_vflag |= VV_CACHEDLABEL; } /* * Implementation of VOP_REFRESHLABEL() that relies on extended attributes * to store label data. Can be referenced by filesystems supporting * extended attributes. */ int vop_stdrefreshlabel_ea(struct vop_refreshlabel_args *ap) { struct vnode *vp = ap->a_vp; struct mac extmac; int buflen, error; ASSERT_VOP_LOCKED(vp, "vop_stdrefreshlabel_ea"); /* * Call out to external policies first. Order doesn't really * matter, as long as failure of one assures failure of all. */ error = mac_update_vnode_from_extattr(vp, vp->v_mount); if (error) return (error); buflen = sizeof(extmac); error = vn_extattr_get(vp, IO_NODELOCKED, FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME, &buflen, (char *)&extmac, curthread); switch (error) { case 0: /* Got it */ break; case ENOATTR: /* * Use the label from the mount point. */ mac_update_vnode_from_mount(vp, vp->v_mount); return (0); case EOPNOTSUPP: default: /* Fail horribly. */ return (error); } if (buflen != sizeof(extmac)) error = EPERM; /* Fail very closed. */ if (error == 0) error = mac_update_vnode_from_externalized(vp, &extmac); if (error == 0) vp->v_vflag |= VV_CACHEDLABEL; else { struct vattr va; printf("Corrupted label on %s", vp->v_mount->mnt_stat.f_mntonname); if (VOP_GETATTR(vp, &va, curthread->td_ucred, curthread) == 0) printf(" inum %ld", va.va_fileid); #ifdef MAC_DEBUG if (mac_debug_label_fallback) { printf(", falling back.\n"); mac_update_vnode_from_mount(vp, vp->v_mount); error = 0; } else { #endif printf(".\n"); error = EPERM; #ifdef MAC_DEBUG } #endif } return (error); } /* * Make sure the vnode label is up-to-date. If EOPNOTSUPP, then we handle * the labeling activity outselves. Filesystems should be careful not * to change their minds regarding whether they support vop_refreshlabel() * for a vnode or not. Don't cache the vnode here, allow the file * system code to determine if it's safe to cache. If we update from * the mount, don't cache since a change to the mount label should affect * all vnodes. */ static int vn_refreshlabel(struct vnode *vp, struct ucred *cred) { int error; ASSERT_VOP_LOCKED(vp, "vn_refreshlabel"); if (vp->v_mount == NULL) { /* Eventually, we probably want to special-case refreshing of deadfs vnodes, and if there's a lock-free race somewhere, that case might be handled here. mac_update_vnode_deadfs(vp); return (0); */ /* printf("vn_refreshlabel: null v_mount\n"); */ if (vp->v_type != VNON) printf( "vn_refreshlabel: null v_mount with non-VNON\n"); return (EBADF); } if (vp->v_vflag & VV_CACHEDLABEL) { mac_vnode_label_cache_hits++; return (0); } else mac_vnode_label_cache_misses++; if ((vp->v_mount->mnt_flag & MNT_MULTILABEL) == 0) { mac_update_vnode_from_mount(vp, vp->v_mount); return (0); } error = VOP_REFRESHLABEL(vp, cred, curthread); switch (error) { case EOPNOTSUPP: /* * If labels are not supported on this vnode, fall back to * the label in the mount and propagate it to the vnode. * There should probably be some sort of policy/flag/decision * about doing this. */ mac_update_vnode_from_mount(vp, vp->v_mount); error = 0; default: return (error); } } /* * Helper function for file systems using the vop_std*_ea() calls. This * function must be called after EA service is available for the vnode, * but before it's hooked up to the namespace so that the node persists * if there's a crash, or before it can be accessed. On successful * commit of the label to disk (etc), do cache the label. */ int vop_stdcreatevnode_ea(struct vnode *dvp, struct vnode *tvp, struct ucred *cred) { struct mac extmac; int error; ASSERT_VOP_LOCKED(tvp, "vop_stdcreatevnode_ea"); if ((dvp->v_mount->mnt_flag & MNT_MULTILABEL) == 0) { mac_update_vnode_from_mount(tvp, tvp->v_mount); } else { error = vn_refreshlabel(dvp, cred); if (error) return (error); /* * Stick the label in the vnode. Then try to write to * disk. If we fail, return a failure to abort the * create operation. Really, this failure shouldn't * happen except in fairly unusual circumstances (out * of disk, etc). */ mac_create_vnode(cred, dvp, tvp); error = mac_stdcreatevnode_ea(tvp); if (error) return (error); /* * XXX: Eventually this will go away and all policies will * directly manage their extended attributes. */ error = mac_externalize(&tvp->v_label, &extmac); if (error) return (error); error = vn_extattr_set(tvp, IO_NODELOCKED, FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME, sizeof(extmac), (char *)&extmac, curthread); if (error == 0) tvp->v_vflag |= VV_CACHEDLABEL; else { #if 0 /* * In theory, we could have fall-back behavior here. * It would probably be incorrect. */ #endif return (error); } } return (0); } void mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_execve_transition"); error = vn_refreshlabel(vp, old); if (error) { printf("mac_execve_transition: vn_refreshlabel returned %d\n", error); printf("mac_execve_transition: using old vnode label\n"); } MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label); } int mac_execve_will_transition(struct ucred *old, struct vnode *vp) { int error, result; error = vn_refreshlabel(vp, old); if (error) return (error); result = 0; MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label); return (result); } int mac_check_vnode_access(struct ucred *cred, struct vnode *vp, int flags) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_access"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_access, cred, vp, &vp->v_label, flags); return (error); } int mac_check_vnode_chdir(struct ucred *cred, struct vnode *dvp) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_chdir"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); MAC_CHECK(check_vnode_chdir, cred, dvp, &dvp->v_label); return (error); } int mac_check_vnode_chroot(struct ucred *cred, struct vnode *dvp) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_chroot"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); MAC_CHECK(check_vnode_chroot, cred, dvp, &dvp->v_label); return (error); } int mac_check_vnode_create(struct ucred *cred, struct vnode *dvp, struct componentname *cnp, struct vattr *vap) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_create"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); MAC_CHECK(check_vnode_create, cred, dvp, &dvp->v_label, cnp, vap); return (error); } int mac_check_vnode_delete(struct ucred *cred, struct vnode *dvp, struct vnode *vp, struct componentname *cnp) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_delete"); ASSERT_VOP_LOCKED(vp, "mac_check_vnode_delete"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_delete, cred, dvp, &dvp->v_label, vp, &vp->v_label, cnp); return (error); } int mac_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp, acl_type_t type) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_deleteacl"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_deleteacl, cred, vp, &vp->v_label, type); return (error); } int mac_check_vnode_exec(struct ucred *cred, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_exec"); if (!mac_enforce_process && !mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label); return (error); } int mac_check_vnode_getacl(struct ucred *cred, struct vnode *vp, acl_type_t type) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_getacl"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_getacl, cred, vp, &vp->v_label, type); return (error); } int mac_check_vnode_getextattr(struct ucred *cred, struct vnode *vp, int attrnamespace, const char *name, struct uio *uio) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_getextattr"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_getextattr, cred, vp, &vp->v_label, attrnamespace, name, uio); + return (error); +} + +int +mac_check_vnode_link(struct ucred *cred, struct vnode *dvp, + struct vnode *vp, struct componentname *cnp) +{ + + int error; + + ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_link"); + ASSERT_VOP_LOCKED(vp, "mac_check_vnode_link"); + + if (!mac_enforce_fs) + return (0); + + error = vn_refreshlabel(dvp, cred); + if (error) + return (error); + + error = vn_refreshlabel(vp, cred); + if (error) + return (error); + + MAC_CHECK(check_vnode_link, cred, dvp, &dvp->v_label, vp, + &vp->v_label, cnp); return (error); } int mac_check_vnode_lookup(struct ucred *cred, struct vnode *dvp, struct componentname *cnp) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_lookup"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); MAC_CHECK(check_vnode_lookup, cred, dvp, &dvp->v_label, cnp); return (error); } vm_prot_t mac_check_vnode_mmap_prot(struct ucred *cred, struct vnode *vp, int newmapping) { vm_prot_t result = VM_PROT_ALL; if (!mac_enforce_vm) return (result); /* * This should be some sort of MAC_BITWISE, maybe :) */ ASSERT_VOP_LOCKED(vp, "mac_check_vnode_mmap_perms"); MAC_BOOLEAN(check_vnode_mmap_perms, &, cred, vp, &vp->v_label, newmapping); return (result); } int mac_check_vnode_open(struct ucred *cred, struct vnode *vp, mode_t acc_mode) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_open"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_open, cred, vp, &vp->v_label, acc_mode); return (error); } int mac_check_vnode_poll(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_poll"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, active_cred); if (error) return (error); MAC_CHECK(check_vnode_poll, active_cred, file_cred, vp, &vp->v_label); return (error); } int mac_check_vnode_read(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_read"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, active_cred); if (error) return (error); MAC_CHECK(check_vnode_read, active_cred, file_cred, vp, &vp->v_label); return (error); } int mac_check_vnode_readdir(struct ucred *cred, struct vnode *dvp) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_readdir"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); MAC_CHECK(check_vnode_readdir, cred, dvp, &dvp->v_label); return (error); } int mac_check_vnode_readlink(struct ucred *cred, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_readlink"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_readlink, cred, vp, &vp->v_label); return (error); } static int mac_check_vnode_relabel(struct ucred *cred, struct vnode *vp, struct label *newlabel) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_relabel"); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_relabel, cred, vp, &vp->v_label, newlabel); return (error); } int mac_check_vnode_rename_from(struct ucred *cred, struct vnode *dvp, struct vnode *vp, struct componentname *cnp) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_rename_from"); ASSERT_VOP_LOCKED(vp, "mac_check_vnode_rename_from"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_rename_from, cred, dvp, &dvp->v_label, vp, &vp->v_label, cnp); return (error); } int mac_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp, struct vnode *vp, int samedir, struct componentname *cnp) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_rename_to"); ASSERT_VOP_LOCKED(vp, "mac_check_vnode_rename_to"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); if (vp != NULL) { error = vn_refreshlabel(vp, cred); if (error) return (error); } MAC_CHECK(check_vnode_rename_to, cred, dvp, &dvp->v_label, vp, vp != NULL ? &vp->v_label : NULL, samedir, cnp); return (error); } int mac_check_vnode_revoke(struct ucred *cred, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_revoke"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_revoke, cred, vp, &vp->v_label); return (error); } int mac_check_vnode_setacl(struct ucred *cred, struct vnode *vp, acl_type_t type, struct acl *acl) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setacl"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_setacl, cred, vp, &vp->v_label, type, acl); return (error); } int mac_check_vnode_setextattr(struct ucred *cred, struct vnode *vp, int attrnamespace, const char *name, struct uio *uio) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setextattr"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_setextattr, cred, vp, &vp->v_label, attrnamespace, name, uio); return (error); } int mac_check_vnode_setflags(struct ucred *cred, struct vnode *vp, u_long flags) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setflags"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_setflags, cred, vp, &vp->v_label, flags); return (error); } int mac_check_vnode_setmode(struct ucred *cred, struct vnode *vp, mode_t mode) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setmode"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_setmode, cred, vp, &vp->v_label, mode); return (error); } int mac_check_vnode_setowner(struct ucred *cred, struct vnode *vp, uid_t uid, gid_t gid) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setowner"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_setowner, cred, vp, &vp->v_label, uid, gid); return (error); } int mac_check_vnode_setutimes(struct ucred *cred, struct vnode *vp, struct timespec atime, struct timespec mtime) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setutimes"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_setutimes, cred, vp, &vp->v_label, atime, mtime); return (error); } int mac_check_vnode_stat(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_stat"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, active_cred); if (error) return (error); MAC_CHECK(check_vnode_stat, active_cred, file_cred, vp, &vp->v_label); return (error); } int mac_check_vnode_write(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_write"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, active_cred); if (error) return (error); MAC_CHECK(check_vnode_write, active_cred, file_cred, vp, &vp->v_label); return (error); } /* * When relabeling a process, call out to the policies for the maximum * permission allowed for each object type we know about in its * memory space, and revoke access (in the least surprising ways we * know) when necessary. The process lock is not held here. */ static void mac_cred_mmapped_drop_perms(struct thread *td, struct ucred *cred) { /* XXX freeze all other threads */ mac_cred_mmapped_drop_perms_recurse(td, cred, &td->td_proc->p_vmspace->vm_map); /* XXX allow other threads to continue */ } static __inline const char * prot2str(vm_prot_t prot) { switch (prot & VM_PROT_ALL) { case VM_PROT_READ: return ("r--"); case VM_PROT_READ | VM_PROT_WRITE: return ("rw-"); case VM_PROT_READ | VM_PROT_EXECUTE: return ("r-x"); case VM_PROT_READ | VM_PROT_WRITE | VM_PROT_EXECUTE: return ("rwx"); case VM_PROT_WRITE: return ("-w-"); case VM_PROT_EXECUTE: return ("--x"); case VM_PROT_WRITE | VM_PROT_EXECUTE: return ("-wx"); default: return ("---"); } } static void mac_cred_mmapped_drop_perms_recurse(struct thread *td, struct ucred *cred, struct vm_map *map) { struct vm_map_entry *vme; vm_prot_t result, revokeperms; vm_object_t object; vm_ooffset_t offset; struct vnode *vp; if (!mac_mmap_revocation) return; vm_map_lock_read(map); for (vme = map->header.next; vme != &map->header; vme = vme->next) { if (vme->eflags & MAP_ENTRY_IS_SUB_MAP) { mac_cred_mmapped_drop_perms_recurse(td, cred, vme->object.sub_map); continue; } /* * Skip over entries that obviously are not shared. */ if (vme->eflags & (MAP_ENTRY_COW | MAP_ENTRY_NOSYNC) || !vme->max_protection) continue; /* * Drill down to the deepest backing object. */ offset = vme->offset; object = vme->object.vm_object; if (object == NULL) continue; while (object->backing_object != NULL) { object = object->backing_object; offset += object->backing_object_offset; } /* * At the moment, vm_maps and objects aren't considered * by the MAC system, so only things with backing by a * normal object (read: vnodes) are checked. */ if (object->type != OBJT_VNODE) continue; vp = (struct vnode *)object->handle; vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); result = mac_check_vnode_mmap_prot(cred, vp, 0); VOP_UNLOCK(vp, 0, td); /* * Find out what maximum protection we may be allowing * now but a policy needs to get removed. */ revokeperms = vme->max_protection & ~result; if (!revokeperms) continue; printf("pid %ld: revoking %s perms from %#lx:%ld " "(max %s/cur %s)\n", (long)td->td_proc->p_pid, prot2str(revokeperms), (u_long)vme->start, (long)(vme->end - vme->start), prot2str(vme->max_protection), prot2str(vme->protection)); vm_map_lock_upgrade(map); /* * This is the really simple case: if a map has more * max_protection than is allowed, but it's not being * actually used (that is, the current protection is * still allowed), we can just wipe it out and do * nothing more. */ if ((vme->protection & revokeperms) == 0) { vme->max_protection -= revokeperms; } else { if (revokeperms & VM_PROT_WRITE) { /* * In the more complicated case, flush out all * pending changes to the object then turn it * copy-on-write. */ vm_object_reference(object); vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); vm_object_page_clean(object, OFF_TO_IDX(offset), OFF_TO_IDX(offset + vme->end - vme->start + PAGE_MASK), OBJPC_SYNC); VOP_UNLOCK(vp, 0, td); vm_object_deallocate(object); /* * Why bother if there's no read permissions * anymore? For the rest, we need to leave * the write permissions on for COW, or * remove them entirely if configured to. */ if (!mac_mmap_revocation_via_cow) { vme->max_protection &= ~VM_PROT_WRITE; vme->protection &= ~VM_PROT_WRITE; } if ((revokeperms & VM_PROT_READ) == 0) vme->eflags |= MAP_ENTRY_COW | MAP_ENTRY_NEEDS_COPY; } if (revokeperms & VM_PROT_EXECUTE) { vme->max_protection &= ~VM_PROT_EXECUTE; vme->protection &= ~VM_PROT_EXECUTE; } if (revokeperms & VM_PROT_READ) { vme->max_protection = 0; vme->protection = 0; } pmap_protect(map->pmap, vme->start, vme->end, vme->protection & ~revokeperms); vm_map_simplify_entry(map, vme); } vm_map_lock_downgrade(map); } vm_map_unlock_read(map); } /* * When the subject's label changes, it may require revocation of privilege * to mapped objects. This can't be done on-the-fly later with a unified * buffer cache. */ static void mac_relabel_cred(struct ucred *cred, struct label *newlabel) { MAC_PERFORM(relabel_cred, cred, newlabel); } void mac_relabel_vnode(struct ucred *cred, struct vnode *vp, struct label *newlabel) { MAC_PERFORM(relabel_vnode, cred, vp, &vp->v_label, newlabel); } void mac_create_ifnet(struct ifnet *ifnet) { MAC_PERFORM(create_ifnet, ifnet, &ifnet->if_label); } void mac_create_bpfdesc(struct ucred *cred, struct bpf_d *bpf_d) { MAC_PERFORM(create_bpfdesc, cred, bpf_d, &bpf_d->bd_label); } void mac_create_socket(struct ucred *cred, struct socket *socket) { MAC_PERFORM(create_socket, cred, socket, &socket->so_label); } void mac_create_pipe(struct ucred *cred, struct pipe *pipe) { MAC_PERFORM(create_pipe, cred, pipe, pipe->pipe_label); } void mac_create_socket_from_socket(struct socket *oldsocket, struct socket *newsocket) { MAC_PERFORM(create_socket_from_socket, oldsocket, &oldsocket->so_label, newsocket, &newsocket->so_label); } static void mac_relabel_socket(struct ucred *cred, struct socket *socket, struct label *newlabel) { MAC_PERFORM(relabel_socket, cred, socket, &socket->so_label, newlabel); } static void mac_relabel_pipe(struct ucred *cred, struct pipe *pipe, struct label *newlabel) { MAC_PERFORM(relabel_pipe, cred, pipe, pipe->pipe_label, newlabel); } void mac_set_socket_peer_from_mbuf(struct mbuf *mbuf, struct socket *socket) { MAC_PERFORM(set_socket_peer_from_mbuf, mbuf, &mbuf->m_pkthdr.label, socket, &socket->so_peerlabel); } void mac_set_socket_peer_from_socket(struct socket *oldsocket, struct socket *newsocket) { MAC_PERFORM(set_socket_peer_from_socket, oldsocket, &oldsocket->so_label, newsocket, &newsocket->so_peerlabel); } void mac_create_datagram_from_ipq(struct ipq *ipq, struct mbuf *datagram) { MAC_PERFORM(create_datagram_from_ipq, ipq, &ipq->ipq_label, datagram, &datagram->m_pkthdr.label); } void mac_create_fragment(struct mbuf *datagram, struct mbuf *fragment) { MAC_PERFORM(create_fragment, datagram, &datagram->m_pkthdr.label, fragment, &fragment->m_pkthdr.label); } void mac_create_ipq(struct mbuf *fragment, struct ipq *ipq) { MAC_PERFORM(create_ipq, fragment, &fragment->m_pkthdr.label, ipq, &ipq->ipq_label); } void mac_create_mbuf_from_mbuf(struct mbuf *oldmbuf, struct mbuf *newmbuf) { MAC_PERFORM(create_mbuf_from_mbuf, oldmbuf, &oldmbuf->m_pkthdr.label, newmbuf, &newmbuf->m_pkthdr.label); } void mac_create_mbuf_from_bpfdesc(struct bpf_d *bpf_d, struct mbuf *mbuf) { MAC_PERFORM(create_mbuf_from_bpfdesc, bpf_d, &bpf_d->bd_label, mbuf, &mbuf->m_pkthdr.label); } void mac_create_mbuf_linklayer(struct ifnet *ifnet, struct mbuf *mbuf) { MAC_PERFORM(create_mbuf_linklayer, ifnet, &ifnet->if_label, mbuf, &mbuf->m_pkthdr.label); } void mac_create_mbuf_from_ifnet(struct ifnet *ifnet, struct mbuf *mbuf) { MAC_PERFORM(create_mbuf_from_ifnet, ifnet, &ifnet->if_label, mbuf, &mbuf->m_pkthdr.label); } void mac_create_mbuf_multicast_encap(struct mbuf *oldmbuf, struct ifnet *ifnet, struct mbuf *newmbuf) { MAC_PERFORM(create_mbuf_multicast_encap, oldmbuf, &oldmbuf->m_pkthdr.label, ifnet, &ifnet->if_label, newmbuf, &newmbuf->m_pkthdr.label); } void mac_create_mbuf_netlayer(struct mbuf *oldmbuf, struct mbuf *newmbuf) { MAC_PERFORM(create_mbuf_netlayer, oldmbuf, &oldmbuf->m_pkthdr.label, newmbuf, &newmbuf->m_pkthdr.label); } int mac_fragment_match(struct mbuf *fragment, struct ipq *ipq) { int result; result = 1; MAC_BOOLEAN(fragment_match, &&, fragment, &fragment->m_pkthdr.label, ipq, &ipq->ipq_label); return (result); } void mac_update_ipq(struct mbuf *fragment, struct ipq *ipq) { MAC_PERFORM(update_ipq, fragment, &fragment->m_pkthdr.label, ipq, &ipq->ipq_label); } void mac_create_mbuf_from_socket(struct socket *socket, struct mbuf *mbuf) { MAC_PERFORM(create_mbuf_from_socket, socket, &socket->so_label, mbuf, &mbuf->m_pkthdr.label); } void mac_create_mount(struct ucred *cred, struct mount *mp) { MAC_PERFORM(create_mount, cred, mp, &mp->mnt_mntlabel, &mp->mnt_fslabel); } void mac_create_root_mount(struct ucred *cred, struct mount *mp) { MAC_PERFORM(create_root_mount, cred, mp, &mp->mnt_mntlabel, &mp->mnt_fslabel); } int mac_check_bpfdesc_receive(struct bpf_d *bpf_d, struct ifnet *ifnet) { int error; if (!mac_enforce_network) return (0); MAC_CHECK(check_bpfdesc_receive, bpf_d, &bpf_d->bd_label, ifnet, &ifnet->if_label); return (error); } static int mac_check_cred_relabel(struct ucred *cred, struct label *newlabel) { int error; MAC_CHECK(check_cred_relabel, cred, newlabel); return (error); } int mac_check_cred_visible(struct ucred *u1, struct ucred *u2) { int error; if (!mac_enforce_process) return (0); MAC_CHECK(check_cred_visible, u1, u2); return (error); } int mac_check_ifnet_transmit(struct ifnet *ifnet, struct mbuf *mbuf) { int error; if (!mac_enforce_network) return (0); KASSERT(mbuf->m_flags & M_PKTHDR, ("packet has no pkthdr")); if (!(mbuf->m_pkthdr.label.l_flags & MAC_FLAG_INITIALIZED)) printf("%s%d: not initialized\n", ifnet->if_name, ifnet->if_unit); MAC_CHECK(check_ifnet_transmit, ifnet, &ifnet->if_label, mbuf, &mbuf->m_pkthdr.label); return (error); } int mac_check_mount_stat(struct ucred *cred, struct mount *mount) { int error; if (!mac_enforce_fs) return (0); MAC_CHECK(check_mount_stat, cred, mount, &mount->mnt_mntlabel); return (error); } int mac_check_pipe_ioctl(struct ucred *cred, struct pipe *pipe, unsigned long cmd, void *data) { int error; PIPE_LOCK_ASSERT(pipe, MA_OWNED); if (!mac_enforce_pipe) return (0); MAC_CHECK(check_pipe_ioctl, cred, pipe, pipe->pipe_label, cmd, data); return (error); } int mac_check_pipe_poll(struct ucred *cred, struct pipe *pipe) { int error; PIPE_LOCK_ASSERT(pipe, MA_OWNED); if (!mac_enforce_pipe) return (0); MAC_CHECK(check_pipe_poll, cred, pipe, pipe->pipe_label); return (error); } int mac_check_pipe_read(struct ucred *cred, struct pipe *pipe) { int error; PIPE_LOCK_ASSERT(pipe, MA_OWNED); if (!mac_enforce_pipe) return (0); MAC_CHECK(check_pipe_read, cred, pipe, pipe->pipe_label); return (error); } static int mac_check_pipe_relabel(struct ucred *cred, struct pipe *pipe, struct label *newlabel) { int error; PIPE_LOCK_ASSERT(pipe, MA_OWNED); if (!mac_enforce_pipe) return (0); MAC_CHECK(check_pipe_relabel, cred, pipe, pipe->pipe_label, newlabel); return (error); } int mac_check_pipe_stat(struct ucred *cred, struct pipe *pipe) { int error; PIPE_LOCK_ASSERT(pipe, MA_OWNED); if (!mac_enforce_pipe) return (0); MAC_CHECK(check_pipe_stat, cred, pipe, pipe->pipe_label); return (error); } int mac_check_pipe_write(struct ucred *cred, struct pipe *pipe) { int error; PIPE_LOCK_ASSERT(pipe, MA_OWNED); if (!mac_enforce_pipe) return (0); MAC_CHECK(check_pipe_write, cred, pipe, pipe->pipe_label); return (error); } int mac_check_proc_debug(struct ucred *cred, struct proc *proc) { int error; PROC_LOCK_ASSERT(proc, MA_OWNED); if (!mac_enforce_process) return (0); MAC_CHECK(check_proc_debug, cred, proc); return (error); } int mac_check_proc_sched(struct ucred *cred, struct proc *proc) { int error; PROC_LOCK_ASSERT(proc, MA_OWNED); if (!mac_enforce_process) return (0); MAC_CHECK(check_proc_sched, cred, proc); return (error); } int mac_check_proc_signal(struct ucred *cred, struct proc *proc, int signum) { int error; PROC_LOCK_ASSERT(proc, MA_OWNED); if (!mac_enforce_process) return (0); MAC_CHECK(check_proc_signal, cred, proc, signum); return (error); } int mac_check_socket_bind(struct ucred *ucred, struct socket *socket, struct sockaddr *sockaddr) { int error; if (!mac_enforce_socket) return (0); MAC_CHECK(check_socket_bind, ucred, socket, &socket->so_label, sockaddr); return (error); } int mac_check_socket_connect(struct ucred *cred, struct socket *socket, struct sockaddr *sockaddr) { int error; if (!mac_enforce_socket) return (0); MAC_CHECK(check_socket_connect, cred, socket, &socket->so_label, sockaddr); return (error); } int mac_check_socket_deliver(struct socket *socket, struct mbuf *mbuf) { int error; if (!mac_enforce_socket) return (0); MAC_CHECK(check_socket_deliver, socket, &socket->so_label, mbuf, &mbuf->m_pkthdr.label); return (error); } int mac_check_socket_listen(struct ucred *cred, struct socket *socket) { int error; if (!mac_enforce_socket) return (0); MAC_CHECK(check_socket_listen, cred, socket, &socket->so_label); return (error); } static int mac_check_socket_relabel(struct ucred *cred, struct socket *socket, struct label *newlabel) { int error; MAC_CHECK(check_socket_relabel, cred, socket, &socket->so_label, newlabel); return (error); } int mac_check_socket_visible(struct ucred *cred, struct socket *socket) { int error; if (!mac_enforce_socket) return (0); MAC_CHECK(check_socket_visible, cred, socket, &socket->so_label); return (error); } int mac_ioctl_ifnet_get(struct ucred *cred, struct ifreq *ifr, struct ifnet *ifnet) { struct mac label; int error; error = mac_externalize(&ifnet->if_label, &label); if (error) return (error); return (copyout(&label, ifr->ifr_ifru.ifru_data, sizeof(label))); } int mac_ioctl_ifnet_set(struct ucred *cred, struct ifreq *ifr, struct ifnet *ifnet) { struct mac newlabel; struct label intlabel; int error; error = copyin(ifr->ifr_ifru.ifru_data, &newlabel, sizeof(newlabel)); if (error) return (error); error = mac_internalize(&intlabel, &newlabel); if (error) return (error); /* * XXX: Note that this is a redundant privilege check, since * policies impose this check themselves if required by the * policy. Eventually, this should go away. */ error = suser_cred(cred, 0); if (error) goto out; MAC_CHECK(check_ifnet_relabel, cred, ifnet, &ifnet->if_label, &intlabel); if (error) goto out; MAC_PERFORM(relabel_ifnet, cred, ifnet, &ifnet->if_label, &intlabel); out: mac_destroy_temp(&intlabel); return (error); } void mac_create_devfs_vnode(struct devfs_dirent *de, struct vnode *vp) { MAC_PERFORM(create_devfs_vnode, de, &de->de_label, vp, &vp->v_label); } void mac_create_devfs_device(dev_t dev, struct devfs_dirent *de) { MAC_PERFORM(create_devfs_device, dev, de, &de->de_label); } static int mac_stdcreatevnode_ea(struct vnode *vp) { int error; MAC_CHECK(stdcreatevnode_ea, vp, &vp->v_label); return (error); } void mac_create_devfs_directory(char *dirname, int dirnamelen, struct devfs_dirent *de) { MAC_PERFORM(create_devfs_directory, dirname, dirnamelen, de, &de->de_label); } /* * When a new vnode is created, this call will initialize its label. */ void mac_create_vnode(struct ucred *cred, struct vnode *parent, struct vnode *child) { int error; ASSERT_VOP_LOCKED(parent, "mac_create_vnode"); ASSERT_VOP_LOCKED(child, "mac_create_vnode"); error = vn_refreshlabel(parent, cred); if (error) { printf("mac_create_vnode: vn_refreshlabel returned %d\n", error); printf("mac_create_vnode: using old vnode label\n"); } MAC_PERFORM(create_vnode, cred, parent, &parent->v_label, child, &child->v_label); } int mac_setsockopt_label_set(struct ucred *cred, struct socket *so, struct mac *extmac) { struct label intlabel; int error; error = mac_internalize(&intlabel, extmac); if (error) return (error); mac_check_socket_relabel(cred, so, &intlabel); if (error) { mac_destroy_temp(&intlabel); return (error); } mac_relabel_socket(cred, so, &intlabel); mac_destroy_temp(&intlabel); return (0); } int mac_pipe_label_set(struct ucred *cred, struct pipe *pipe, struct label *label) { int error; PIPE_LOCK_ASSERT(pipe, MA_OWNED); error = mac_check_pipe_relabel(cred, pipe, label); if (error) return (error); mac_relabel_pipe(cred, pipe, label); return (0); } int mac_getsockopt_label_get(struct ucred *cred, struct socket *so, struct mac *extmac) { return (mac_externalize(&so->so_label, extmac)); } int mac_getsockopt_peerlabel_get(struct ucred *cred, struct socket *so, struct mac *extmac) { return (mac_externalize(&so->so_peerlabel, extmac)); } /* * Implementation of VOP_SETLABEL() that relies on extended attributes * to store label data. Can be referenced by filesystems supporting * extended attributes. */ int vop_stdsetlabel_ea(struct vop_setlabel_args *ap) { struct vnode *vp = ap->a_vp; struct label *intlabel = ap->a_label; struct mac extmac; int error; ASSERT_VOP_LOCKED(vp, "vop_stdsetlabel_ea"); /* * XXX: Eventually call out to EA check/set calls here. * Be particularly careful to avoid race conditions, * consistency problems, and stability problems when * dealing with multiple EAs. In particular, we require * the ability to write multiple EAs on the same file in * a single transaction, which the current EA interface * does not provide. */ error = mac_externalize(intlabel, &extmac); if (error) return (error); error = vn_extattr_set(vp, IO_NODELOCKED, FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME, sizeof(extmac), (char *)&extmac, curthread); if (error) return (error); mac_relabel_vnode(ap->a_cred, vp, intlabel); vp->v_vflag |= VV_CACHEDLABEL; return (0); } static int vn_setlabel(struct vnode *vp, struct label *intlabel, struct ucred *cred) { int error; if (vp->v_mount == NULL) { /* printf("vn_setlabel: null v_mount\n"); */ if (vp->v_type != VNON) printf("vn_setlabel: null v_mount with non-VNON\n"); return (EBADF); } if ((vp->v_mount->mnt_flag & MNT_MULTILABEL) == 0) return (EOPNOTSUPP); /* * Multi-phase commit. First check the policies to confirm the * change is OK. Then commit via the filesystem. Finally, * update the actual vnode label. Question: maybe the filesystem * should update the vnode at the end as part of VOP_SETLABEL()? */ error = mac_check_vnode_relabel(cred, vp, intlabel); if (error) return (error); /* * VADMIN provides the opportunity for the filesystem to make * decisions about who is and is not able to modify labels * and protections on files. This might not be right. We can't * assume VOP_SETLABEL() will do it, because we might implement * that as part of vop_stdsetlabel_ea(). */ error = VOP_ACCESS(vp, VADMIN, cred, curthread); if (error) return (error); error = VOP_SETLABEL(vp, intlabel, cred, curthread); if (error) return (error); return (0); } /* * MPSAFE */ int __mac_get_proc(struct thread *td, struct __mac_get_proc_args *uap) { struct mac extmac; int error; error = mac_externalize(&td->td_ucred->cr_label, &extmac); if (error == 0) error = copyout(&extmac, SCARG(uap, mac_p), sizeof(extmac)); return (error); } /* * MPSAFE */ int __mac_set_proc(struct thread *td, struct __mac_set_proc_args *uap) { struct ucred *newcred, *oldcred; struct proc *p; struct mac extmac; struct label intlabel; int error; error = copyin(SCARG(uap, mac_p), &extmac, sizeof(extmac)); if (error) return (error); error = mac_internalize(&intlabel, &extmac); if (error) return (error); newcred = crget(); p = td->td_proc; PROC_LOCK(p); oldcred = p->p_ucred; error = mac_check_cred_relabel(oldcred, &intlabel); if (error) { PROC_UNLOCK(p); mac_destroy_temp(&intlabel); crfree(newcred); return (error); } setsugid(p); crcopy(newcred, oldcred); mac_relabel_cred(newcred, &intlabel); p->p_ucred = newcred; /* * Grab additional reference for use while revoking mmaps, prior * to releasing the proc lock and sharing the cred. */ crhold(newcred); PROC_UNLOCK(p); mtx_lock(&Giant); mac_cred_mmapped_drop_perms(td, newcred); mtx_unlock(&Giant); crfree(newcred); /* Free revocation reference. */ crfree(oldcred); mac_destroy_temp(&intlabel); return (0); } /* * MPSAFE */ int __mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap) { struct file *fp; struct mac extmac; struct vnode *vp; struct pipe *pipe; int error; mtx_lock(&Giant); error = fget(td, SCARG(uap, fd), &fp); if (error) goto out; switch (fp->f_type) { case DTYPE_FIFO: case DTYPE_VNODE: vp = (struct vnode *)fp->f_data; vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); error = vn_refreshlabel(vp, td->td_ucred); if (error == 0) error = mac_externalize(&vp->v_label, &extmac); VOP_UNLOCK(vp, 0, td); break; case DTYPE_PIPE: pipe = (struct pipe *)fp->f_data; error = mac_externalize(pipe->pipe_label, &extmac); break; default: error = EINVAL; } if (error == 0) error = copyout(&extmac, SCARG(uap, mac_p), sizeof(extmac)); fdrop(fp, td); out: mtx_unlock(&Giant); return (error); } /* * MPSAFE */ int __mac_get_file(struct thread *td, struct __mac_get_file_args *uap) { struct nameidata nd; struct mac extmac; int error; mtx_lock(&Giant); NDINIT(&nd, LOOKUP, LOCKLEAF | FOLLOW, UIO_USERSPACE, SCARG(uap, path_p), td); error = namei(&nd); if (error) goto out; error = vn_refreshlabel(nd.ni_vp, td->td_ucred); if (error == 0) error = mac_externalize(&nd.ni_vp->v_label, &extmac); NDFREE(&nd, 0); if (error) goto out; error = copyout(&extmac, SCARG(uap, mac_p), sizeof(extmac)); out: mtx_unlock(&Giant); return (error); } /* * MPSAFE */ int __mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap) { struct file *fp; struct mac extmac; struct label intlabel; struct mount *mp; struct vnode *vp; struct pipe *pipe; int error; mtx_lock(&Giant); error = fget(td, SCARG(uap, fd), &fp); if (error) goto out1; error = copyin(SCARG(uap, mac_p), &extmac, sizeof(extmac)); if (error) goto out2; error = mac_internalize(&intlabel, &extmac); if (error) goto out2; switch (fp->f_type) { case DTYPE_FIFO: case DTYPE_VNODE: vp = (struct vnode *)fp->f_data; error = vn_start_write(vp, &mp, V_WAIT | PCATCH); if (error != 0) break; vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); error = vn_setlabel(vp, &intlabel, td->td_ucred); VOP_UNLOCK(vp, 0, td); vn_finished_write(mp); mac_destroy_temp(&intlabel); break; case DTYPE_PIPE: pipe = (struct pipe *)fp->f_data; PIPE_LOCK(pipe); error = mac_pipe_label_set(td->td_ucred, pipe, &intlabel); PIPE_UNLOCK(pipe); break; default: error = EINVAL; } out2: fdrop(fp, td); out1: mtx_unlock(&Giant); return (error); } /* * MPSAFE */ int __mac_set_file(struct thread *td, struct __mac_set_file_args *uap) { struct nameidata nd; struct mac extmac; struct label intlabel; struct mount *mp; int error; mtx_lock(&Giant); error = copyin(SCARG(uap, mac_p), &extmac, sizeof(extmac)); if (error) goto out; error = mac_internalize(&intlabel, &extmac); if (error) goto out; NDINIT(&nd, LOOKUP, LOCKLEAF | FOLLOW, UIO_USERSPACE, SCARG(uap, path_p), td); error = namei(&nd); if (error) goto out2; error = vn_start_write(nd.ni_vp, &mp, V_WAIT | PCATCH); if (error) goto out2; error = vn_setlabel(nd.ni_vp, &intlabel, td->td_ucred); vn_finished_write(mp); out2: mac_destroy_temp(&intlabel); NDFREE(&nd, 0); out: mtx_unlock(&Giant); return (error); } int mac_syscall(struct thread *td, struct mac_syscall_args *uap) { struct mac_policy_conf *mpc; char target[MAC_MAX_POLICY_NAME]; int error; error = copyinstr(SCARG(uap, policy), target, sizeof(target), NULL); if (error) return (error); error = ENOSYS; MAC_POLICY_LIST_BUSY(); LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { if (strcmp(mpc->mpc_name, target) == 0 && mpc->mpc_ops->mpo_syscall != NULL) { error = mpc->mpc_ops->mpo_syscall(td, SCARG(uap, call), SCARG(uap, arg)); goto out; } } out: MAC_POLICY_LIST_UNBUSY(); return (error); } SYSINIT(mac, SI_SUB_MAC, SI_ORDER_FIRST, mac_init, NULL); SYSINIT(mac_late, SI_SUB_MAC_LATE, SI_ORDER_FIRST, mac_late_init, NULL); #else /* !MAC */ int __mac_get_proc(struct thread *td, struct __mac_get_proc_args *uap) { return (ENOSYS); } int __mac_set_proc(struct thread *td, struct __mac_set_proc_args *uap) { return (ENOSYS); } int __mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap) { return (ENOSYS); } int __mac_get_file(struct thread *td, struct __mac_get_file_args *uap) { return (ENOSYS); } int __mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap) { return (ENOSYS); } int __mac_set_file(struct thread *td, struct __mac_set_file_args *uap) { return (ENOSYS); } int mac_syscall(struct thread *td, struct mac_syscall_args *uap) { return (ENOSYS); } #endif /* !MAC */ Index: head/sys/kern/vfs_extattr.c =================================================================== --- head/sys/kern/vfs_extattr.c (revision 104528) +++ head/sys/kern/vfs_extattr.c (revision 104529) @@ -1,4114 +1,4119 @@ /* * Copyright (c) 1989, 1993 * The Regents of the University of California. All rights reserved. * (c) UNIX System Laboratories, Inc. * All or some portions of this file are derived from material licensed * to the University of California by American Telephone and Telegraph * Co. or Unix System Laboratories, Inc. and are reproduced herein with * the permission of UNIX System Laboratories, Inc. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * 3. All advertising materials mentioning features or use of this software * must display the following acknowledgement: * This product includes software developed by the University of * California, Berkeley and its contributors. * 4. Neither the name of the University nor the names of its contributors * may be used to endorse or promote products derived from this software * without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. * * @(#)vfs_syscalls.c 8.13 (Berkeley) 4/15/94 * $FreeBSD$ */ /* For 4.3 integer FS ID compatibility */ #include "opt_compat.h" #include "opt_mac.h" #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include static int change_dir(struct nameidata *ndp, struct thread *td); static int chroot_refuse_vdir_fds(struct filedesc *fdp); static int getutimes(const struct timeval *, enum uio_seg, struct timespec *); static int setfown(struct thread *td, struct vnode *, uid_t, gid_t); static int setfmode(struct thread *td, struct vnode *, int); static int setfflags(struct thread *td, struct vnode *, int); static int setutimes(struct thread *td, struct vnode *, const struct timespec *, int, int); static int vn_access(struct vnode *vp, int user_flags, struct ucred *cred, struct thread *td); int (*union_dircheckp)(struct thread *td, struct vnode **, struct file *); int (*softdep_fsync_hook)(struct vnode *); /* * Sync each mounted filesystem. */ #ifndef _SYS_SYSPROTO_H_ struct sync_args { int dummy; }; #endif #ifdef DEBUG static int syncprt = 0; SYSCTL_INT(_debug, OID_AUTO, syncprt, CTLFLAG_RW, &syncprt, 0, ""); #endif /* ARGSUSED */ int sync(td, uap) struct thread *td; struct sync_args *uap; { struct mount *mp, *nmp; int asyncflag; mtx_lock(&mountlist_mtx); for (mp = TAILQ_FIRST(&mountlist); mp != NULL; mp = nmp) { if (vfs_busy(mp, LK_NOWAIT, &mountlist_mtx, td)) { nmp = TAILQ_NEXT(mp, mnt_list); continue; } if ((mp->mnt_flag & MNT_RDONLY) == 0 && vn_start_write(NULL, &mp, V_NOWAIT) == 0) { asyncflag = mp->mnt_flag & MNT_ASYNC; mp->mnt_flag &= ~MNT_ASYNC; vfs_msync(mp, MNT_NOWAIT); VFS_SYNC(mp, MNT_NOWAIT, ((td != NULL) ? td->td_ucred : NOCRED), td); mp->mnt_flag |= asyncflag; vn_finished_write(mp); } mtx_lock(&mountlist_mtx); nmp = TAILQ_NEXT(mp, mnt_list); vfs_unbusy(mp, td); } mtx_unlock(&mountlist_mtx); #if 0 /* * XXX don't call vfs_bufstats() yet because that routine * was not imported in the Lite2 merge. */ #ifdef DIAGNOSTIC if (syncprt) vfs_bufstats(); #endif /* DIAGNOSTIC */ #endif return (0); } /* XXX PRISON: could be per prison flag */ static int prison_quotas; #if 0 SYSCTL_INT(_kern_prison, OID_AUTO, quotas, CTLFLAG_RW, &prison_quotas, 0, ""); #endif /* * Change filesystem quotas. */ #ifndef _SYS_SYSPROTO_H_ struct quotactl_args { char *path; int cmd; int uid; caddr_t arg; }; #endif /* ARGSUSED */ int quotactl(td, uap) struct thread *td; register struct quotactl_args /* { syscallarg(char *) path; syscallarg(int) cmd; syscallarg(int) uid; syscallarg(caddr_t) arg; } */ *uap; { struct mount *mp; int error; struct nameidata nd; if (jailed(td->td_ucred) && !prison_quotas) return (EPERM); NDINIT(&nd, LOOKUP, FOLLOW, UIO_USERSPACE, SCARG(uap, path), td); if ((error = namei(&nd)) != 0) return (error); NDFREE(&nd, NDF_ONLY_PNBUF); error = vn_start_write(nd.ni_vp, &mp, V_WAIT | PCATCH); vrele(nd.ni_vp); if (error) return (error); error = VFS_QUOTACTL(mp, SCARG(uap, cmd), SCARG(uap, uid), SCARG(uap, arg), td); vn_finished_write(mp); return (error); } /* * Get filesystem statistics. */ #ifndef _SYS_SYSPROTO_H_ struct statfs_args { char *path; struct statfs *buf; }; #endif /* ARGSUSED */ int statfs(td, uap) struct thread *td; register struct statfs_args /* { syscallarg(char *) path; syscallarg(struct statfs *) buf; } */ *uap; { register struct mount *mp; register struct statfs *sp; int error; struct nameidata nd; struct statfs sb; NDINIT(&nd, LOOKUP, FOLLOW, UIO_USERSPACE, SCARG(uap, path), td); if ((error = namei(&nd)) != 0) return (error); mp = nd.ni_vp->v_mount; sp = &mp->mnt_stat; NDFREE(&nd, NDF_ONLY_PNBUF); vrele(nd.ni_vp); #ifdef MAC error = mac_check_mount_stat(td->td_ucred, mp); if (error) return (error); #endif error = VFS_STATFS(mp, sp, td); if (error) return (error); sp->f_flags = mp->mnt_flag & MNT_VISFLAGMASK; if (suser(td)) { bcopy(sp, &sb, sizeof(sb)); sb.f_fsid.val[0] = sb.f_fsid.val[1] = 0; sp = &sb; } return (copyout(sp, SCARG(uap, buf), sizeof(*sp))); } /* * Get filesystem statistics. */ #ifndef _SYS_SYSPROTO_H_ struct fstatfs_args { int fd; struct statfs *buf; }; #endif /* ARGSUSED */ int fstatfs(td, uap) struct thread *td; register struct fstatfs_args /* { syscallarg(int) fd; syscallarg(struct statfs *) buf; } */ *uap; { struct file *fp; struct mount *mp; register struct statfs *sp; int error; struct statfs sb; if ((error = getvnode(td->td_proc->p_fd, SCARG(uap, fd), &fp)) != 0) return (error); mp = ((struct vnode *)fp->f_data)->v_mount; fdrop(fp, td); if (mp == NULL) return (EBADF); #ifdef MAC error = mac_check_mount_stat(td->td_ucred, mp); if (error) return (error); #endif sp = &mp->mnt_stat; error = VFS_STATFS(mp, sp, td); if (error) return (error); sp->f_flags = mp->mnt_flag & MNT_VISFLAGMASK; if (suser(td)) { bcopy(sp, &sb, sizeof(sb)); sb.f_fsid.val[0] = sb.f_fsid.val[1] = 0; sp = &sb; } return (copyout(sp, SCARG(uap, buf), sizeof(*sp))); } /* * Get statistics on all filesystems. */ #ifndef _SYS_SYSPROTO_H_ struct getfsstat_args { struct statfs *buf; long bufsize; int flags; }; #endif int getfsstat(td, uap) struct thread *td; register struct getfsstat_args /* { syscallarg(struct statfs *) buf; syscallarg(long) bufsize; syscallarg(int) flags; } */ *uap; { register struct mount *mp, *nmp; register struct statfs *sp; caddr_t sfsp; long count, maxcount, error; maxcount = SCARG(uap, bufsize) / sizeof(struct statfs); sfsp = (caddr_t)SCARG(uap, buf); count = 0; mtx_lock(&mountlist_mtx); for (mp = TAILQ_FIRST(&mountlist); mp != NULL; mp = nmp) { #ifdef MAC if (mac_check_mount_stat(td->td_ucred, mp) != 0) { nmp = TAILQ_NEXT(mp, mnt_list); continue; } #endif if (vfs_busy(mp, LK_NOWAIT, &mountlist_mtx, td)) { nmp = TAILQ_NEXT(mp, mnt_list); continue; } if (sfsp && count < maxcount) { sp = &mp->mnt_stat; /* * If MNT_NOWAIT or MNT_LAZY is specified, do not * refresh the fsstat cache. MNT_NOWAIT or MNT_LAZY * overrides MNT_WAIT. */ if (((SCARG(uap, flags) & (MNT_LAZY|MNT_NOWAIT)) == 0 || (SCARG(uap, flags) & MNT_WAIT)) && (error = VFS_STATFS(mp, sp, td))) { mtx_lock(&mountlist_mtx); nmp = TAILQ_NEXT(mp, mnt_list); vfs_unbusy(mp, td); continue; } sp->f_flags = mp->mnt_flag & MNT_VISFLAGMASK; error = copyout(sp, sfsp, sizeof(*sp)); if (error) { vfs_unbusy(mp, td); return (error); } sfsp += sizeof(*sp); } count++; mtx_lock(&mountlist_mtx); nmp = TAILQ_NEXT(mp, mnt_list); vfs_unbusy(mp, td); } mtx_unlock(&mountlist_mtx); if (sfsp && count > maxcount) td->td_retval[0] = maxcount; else td->td_retval[0] = count; return (0); } /* * Change current working directory to a given file descriptor. */ #ifndef _SYS_SYSPROTO_H_ struct fchdir_args { int fd; }; #endif /* ARGSUSED */ int fchdir(td, uap) struct thread *td; struct fchdir_args /* { syscallarg(int) fd; } */ *uap; { register struct filedesc *fdp = td->td_proc->p_fd; struct vnode *vp, *tdp, *vpold; struct mount *mp; struct file *fp; int error; if ((error = getvnode(fdp, SCARG(uap, fd), &fp)) != 0) return (error); vp = (struct vnode *)fp->f_data; VREF(vp); fdrop(fp, td); vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); if (vp->v_type != VDIR) error = ENOTDIR; #ifdef MAC else if ((error = mac_check_vnode_chdir(td->td_ucred, vp)) != 0) { } #endif else error = VOP_ACCESS(vp, VEXEC, td->td_ucred, td); while (!error && (mp = vp->v_mountedhere) != NULL) { if (vfs_busy(mp, 0, 0, td)) continue; error = VFS_ROOT(mp, &tdp); vfs_unbusy(mp, td); if (error) break; vput(vp); vp = tdp; } if (error) { vput(vp); return (error); } VOP_UNLOCK(vp, 0, td); FILEDESC_LOCK(fdp); vpold = fdp->fd_cdir; fdp->fd_cdir = vp; FILEDESC_UNLOCK(fdp); vrele(vpold); return (0); } /* * Change current working directory (``.''). */ #ifndef _SYS_SYSPROTO_H_ struct chdir_args { char *path; }; #endif /* ARGSUSED */ int chdir(td, uap) struct thread *td; struct chdir_args /* { syscallarg(char *) path; } */ *uap; { return (kern_chdir(td, uap->path, UIO_USERSPACE)); } int kern_chdir(struct thread *td, char *path, enum uio_seg pathseg) { register struct filedesc *fdp = td->td_proc->p_fd; int error; struct nameidata nd; struct vnode *vp; NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF, pathseg, path, td); if ((error = change_dir(&nd, td)) != 0) return (error); NDFREE(&nd, NDF_ONLY_PNBUF); FILEDESC_LOCK(fdp); vp = fdp->fd_cdir; fdp->fd_cdir = nd.ni_vp; FILEDESC_UNLOCK(fdp); vrele(vp); return (0); } /* * Helper function for raised chroot(2) security function: Refuse if * any filedescriptors are open directories. */ static int chroot_refuse_vdir_fds(fdp) struct filedesc *fdp; { struct vnode *vp; struct file *fp; int fd; FILEDESC_LOCK_ASSERT(fdp, MA_OWNED); for (fd = 0; fd < fdp->fd_nfiles ; fd++) { fp = fget_locked(fdp, fd); if (fp == NULL) continue; if (fp->f_type == DTYPE_VNODE) { vp = (struct vnode *)fp->f_data; if (vp->v_type == VDIR) return (EPERM); } } return (0); } /* * This sysctl determines if we will allow a process to chroot(2) if it * has a directory open: * 0: disallowed for all processes. * 1: allowed for processes that were not already chroot(2)'ed. * 2: allowed for all processes. */ static int chroot_allow_open_directories = 1; SYSCTL_INT(_kern, OID_AUTO, chroot_allow_open_directories, CTLFLAG_RW, &chroot_allow_open_directories, 0, ""); /* * Change notion of root (``/'') directory. */ #ifndef _SYS_SYSPROTO_H_ struct chroot_args { char *path; }; #endif /* ARGSUSED */ int chroot(td, uap) struct thread *td; struct chroot_args /* { syscallarg(char *) path; } */ *uap; { register struct filedesc *fdp = td->td_proc->p_fd; int error; struct nameidata nd; struct vnode *vp; error = suser_cred(td->td_ucred, PRISON_ROOT); if (error) return (error); NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF, UIO_USERSPACE, SCARG(uap, path), td); mtx_lock(&Giant); if ((error = change_dir(&nd, td)) != 0) goto error; #ifdef MAC if ((error = mac_check_vnode_chroot(td->td_ucred, nd.ni_vp))) goto error; #endif FILEDESC_LOCK(fdp); if (chroot_allow_open_directories == 0 || (chroot_allow_open_directories == 1 && fdp->fd_rdir != rootvnode)) { error = chroot_refuse_vdir_fds(fdp); if (error) goto error_unlock; } vp = fdp->fd_rdir; fdp->fd_rdir = nd.ni_vp; if (!fdp->fd_jdir) { fdp->fd_jdir = nd.ni_vp; VREF(fdp->fd_jdir); } FILEDESC_UNLOCK(fdp); NDFREE(&nd, NDF_ONLY_PNBUF); vrele(vp); mtx_unlock(&Giant); return (0); error_unlock: FILEDESC_UNLOCK(fdp); error: mtx_unlock(&Giant); NDFREE(&nd, 0); return (error); } /* * Common routine for chroot and chdir. */ static int change_dir(ndp, td) register struct nameidata *ndp; struct thread *td; { struct vnode *vp; int error; error = namei(ndp); if (error) return (error); vp = ndp->ni_vp; if (vp->v_type != VDIR) error = ENOTDIR; #ifdef MAC else if ((error = mac_check_vnode_chdir(td->td_ucred, vp)) != 0) { } #endif else error = VOP_ACCESS(vp, VEXEC, td->td_ucred, td); if (error) vput(vp); else VOP_UNLOCK(vp, 0, td); return (error); } /* * Check permissions, allocate an open file structure, * and call the device open routine if any. */ #ifndef _SYS_SYSPROTO_H_ struct open_args { char *path; int flags; int mode; }; #endif int open(td, uap) struct thread *td; register struct open_args /* { syscallarg(char *) path; syscallarg(int) flags; syscallarg(int) mode; } */ *uap; { return (kern_open(td, uap->path, UIO_USERSPACE, uap->flags, uap->mode)); } int kern_open(struct thread *td, char *path, enum uio_seg pathseg, int flags, int mode) { struct proc *p = td->td_proc; struct filedesc *fdp = p->p_fd; struct file *fp; struct vnode *vp; struct vattr vat; struct mount *mp; int cmode, oflags; struct file *nfp; int type, indx, error; struct flock lf; struct nameidata nd; if ((flags & O_ACCMODE) == O_ACCMODE) return (EINVAL); oflags = flags; flags = FFLAGS(flags); error = falloc(td, &nfp, &indx); if (error) return (error); fp = nfp; FILEDESC_LOCK(fdp); cmode = ((mode &~ fdp->fd_cmask) & ALLPERMS) &~ S_ISTXT; FILEDESC_UNLOCK(fdp); NDINIT(&nd, LOOKUP, FOLLOW, pathseg, path, td); td->td_dupfd = -indx - 1; /* XXX check for fdopen */ /* * Bump the ref count to prevent another process from closing * the descriptor while we are blocked in vn_open() */ fhold(fp); error = vn_open(&nd, &flags, cmode); if (error) { /* * release our own reference */ fdrop(fp, td); /* * handle special fdopen() case. bleh. dupfdopen() is * responsible for dropping the old contents of ofiles[indx] * if it succeeds. */ if ((error == ENODEV || error == ENXIO) && td->td_dupfd >= 0 && /* XXX from fdopen */ (error = dupfdopen(td, fdp, indx, td->td_dupfd, flags, error)) == 0) { td->td_retval[0] = indx; return (0); } /* * Clean up the descriptor, but only if another thread hadn't * replaced or closed it. */ FILEDESC_LOCK(fdp); if (fdp->fd_ofiles[indx] == fp) { fdp->fd_ofiles[indx] = NULL; FILEDESC_UNLOCK(fdp); fdrop(fp, td); } else FILEDESC_UNLOCK(fdp); if (error == ERESTART) error = EINTR; return (error); } td->td_dupfd = 0; NDFREE(&nd, NDF_ONLY_PNBUF); vp = nd.ni_vp; /* * There should be 2 references on the file, one from the descriptor * table, and one for us. * * Handle the case where someone closed the file (via its file * descriptor) while we were blocked. The end result should look * like opening the file succeeded but it was immediately closed. */ FILEDESC_LOCK(fdp); FILE_LOCK(fp); if (fp->f_count == 1) { KASSERT(fdp->fd_ofiles[indx] != fp, ("Open file descriptor lost all refs")); FILEDESC_UNLOCK(fdp); FILE_UNLOCK(fp); VOP_UNLOCK(vp, 0, td); vn_close(vp, flags & FMASK, fp->f_cred, td); fdrop(fp, td); td->td_retval[0] = indx; return 0; } /* assert that vn_open created a backing object if one is needed */ KASSERT(!vn_canvmio(vp) || VOP_GETVOBJECT(vp, NULL) == 0, ("open: vmio vnode has no backing object after vn_open")); fp->f_data = vp; fp->f_flag = flags & FMASK; fp->f_ops = &vnops; fp->f_type = (vp->v_type == VFIFO ? DTYPE_FIFO : DTYPE_VNODE); FILEDESC_UNLOCK(fdp); FILE_UNLOCK(fp); VOP_UNLOCK(vp, 0, td); if (flags & (O_EXLOCK | O_SHLOCK)) { lf.l_whence = SEEK_SET; lf.l_start = 0; lf.l_len = 0; if (flags & O_EXLOCK) lf.l_type = F_WRLCK; else lf.l_type = F_RDLCK; type = F_FLOCK; if ((flags & FNONBLOCK) == 0) type |= F_WAIT; if ((error = VOP_ADVLOCK(vp, (caddr_t)fp, F_SETLK, &lf, type)) != 0) goto bad; fp->f_flag |= FHASLOCK; } if (flags & O_TRUNC) { if ((error = vn_start_write(vp, &mp, V_WAIT | PCATCH)) != 0) goto bad; VOP_LEASE(vp, td, td->td_ucred, LEASE_WRITE); VATTR_NULL(&vat); vat.va_size = 0; vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); #ifdef MAC error = mac_check_vnode_write(td->td_ucred, fp->f_cred, vp); if (error == 0) #endif error = VOP_SETATTR(vp, &vat, td->td_ucred, td); VOP_UNLOCK(vp, 0, td); vn_finished_write(mp); if (error) goto bad; } /* * Release our private reference, leaving the one associated with * the descriptor table intact. */ fdrop(fp, td); td->td_retval[0] = indx; return (0); bad: FILEDESC_LOCK(fdp); if (fdp->fd_ofiles[indx] == fp) { fdp->fd_ofiles[indx] = NULL; FILEDESC_UNLOCK(fdp); fdrop(fp, td); } else FILEDESC_UNLOCK(fdp); return (error); } #ifdef COMPAT_43 /* * Create a file. */ #ifndef _SYS_SYSPROTO_H_ struct ocreat_args { char *path; int mode; }; #endif int ocreat(td, uap) struct thread *td; register struct ocreat_args /* { syscallarg(char *) path; syscallarg(int) mode; } */ *uap; { struct open_args /* { syscallarg(char *) path; syscallarg(int) flags; syscallarg(int) mode; } */ nuap; SCARG(&nuap, path) = SCARG(uap, path); SCARG(&nuap, mode) = SCARG(uap, mode); SCARG(&nuap, flags) = O_WRONLY | O_CREAT | O_TRUNC; return (open(td, &nuap)); } #endif /* COMPAT_43 */ /* * Create a special file. */ #ifndef _SYS_SYSPROTO_H_ struct mknod_args { char *path; int mode; int dev; }; #endif /* ARGSUSED */ int mknod(td, uap) struct thread *td; register struct mknod_args /* { syscallarg(char *) path; syscallarg(int) mode; syscallarg(int) dev; } */ *uap; { return (kern_mknod(td, uap->path, UIO_USERSPACE, uap->mode, uap->dev)); } int kern_mknod(struct thread *td, char *path, enum uio_seg pathseg, int mode, int dev) { struct vnode *vp; struct mount *mp; struct vattr vattr; int error; int whiteout = 0; struct nameidata nd; switch (mode & S_IFMT) { case S_IFCHR: case S_IFBLK: error = suser(td); break; default: error = suser_cred(td->td_ucred, PRISON_ROOT); break; } if (error) return (error); restart: bwillwrite(); NDINIT(&nd, CREATE, LOCKPARENT | SAVENAME, pathseg, path, td); if ((error = namei(&nd)) != 0) return (error); vp = nd.ni_vp; if (vp != NULL) { vrele(vp); error = EEXIST; } else { VATTR_NULL(&vattr); FILEDESC_LOCK(td->td_proc->p_fd); vattr.va_mode = (mode & ALLPERMS) & ~td->td_proc->p_fd->fd_cmask; FILEDESC_UNLOCK(td->td_proc->p_fd); vattr.va_rdev = dev; whiteout = 0; switch (mode & S_IFMT) { case S_IFMT: /* used by badsect to flag bad sectors */ vattr.va_type = VBAD; break; case S_IFCHR: vattr.va_type = VCHR; break; case S_IFBLK: vattr.va_type = VBLK; break; case S_IFWHT: whiteout = 1; break; default: error = EINVAL; break; } } if (vn_start_write(nd.ni_dvp, &mp, V_NOWAIT) != 0) { NDFREE(&nd, NDF_ONLY_PNBUF); vput(nd.ni_dvp); if ((error = vn_start_write(NULL, &mp, V_XSLEEP | PCATCH)) != 0) return (error); goto restart; } if (!error) { VOP_LEASE(nd.ni_dvp, td, td->td_ucred, LEASE_WRITE); if (whiteout) error = VOP_WHITEOUT(nd.ni_dvp, &nd.ni_cnd, CREATE); else { error = VOP_MKNOD(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &vattr); if (error == 0) vput(nd.ni_vp); } } NDFREE(&nd, NDF_ONLY_PNBUF); vput(nd.ni_dvp); vn_finished_write(mp); ASSERT_VOP_UNLOCKED(nd.ni_dvp, "mknod"); ASSERT_VOP_UNLOCKED(nd.ni_vp, "mknod"); return (error); } /* * Create a named pipe. */ #ifndef _SYS_SYSPROTO_H_ struct mkfifo_args { char *path; int mode; }; #endif /* ARGSUSED */ int mkfifo(td, uap) struct thread *td; register struct mkfifo_args /* { syscallarg(char *) path; syscallarg(int) mode; } */ *uap; { return (kern_mkfifo(td, uap->path, UIO_USERSPACE, uap->mode)); } int kern_mkfifo(struct thread *td, char *path, enum uio_seg pathseg, int mode) { struct mount *mp; struct vattr vattr; int error; struct nameidata nd; restart: bwillwrite(); NDINIT(&nd, CREATE, LOCKPARENT | SAVENAME, pathseg, path, td); if ((error = namei(&nd)) != 0) return (error); if (nd.ni_vp != NULL) { NDFREE(&nd, NDF_ONLY_PNBUF); vrele(nd.ni_vp); vput(nd.ni_dvp); return (EEXIST); } if (vn_start_write(nd.ni_dvp, &mp, V_NOWAIT) != 0) { NDFREE(&nd, NDF_ONLY_PNBUF); vput(nd.ni_dvp); if ((error = vn_start_write(NULL, &mp, V_XSLEEP | PCATCH)) != 0) return (error); goto restart; } VATTR_NULL(&vattr); vattr.va_type = VFIFO; FILEDESC_LOCK(td->td_proc->p_fd); vattr.va_mode = (mode & ALLPERMS) & ~td->td_proc->p_fd->fd_cmask; FILEDESC_UNLOCK(td->td_proc->p_fd); VOP_LEASE(nd.ni_dvp, td, td->td_ucred, LEASE_WRITE); error = VOP_MKNOD(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &vattr); if (error == 0) vput(nd.ni_vp); NDFREE(&nd, NDF_ONLY_PNBUF); vput(nd.ni_dvp); vn_finished_write(mp); return (error); } /* * Make a hard file link. */ #ifndef _SYS_SYSPROTO_H_ struct link_args { char *path; char *link; }; #endif /* ARGSUSED */ int link(td, uap) struct thread *td; register struct link_args /* { syscallarg(char *) path; syscallarg(char *) link; } */ *uap; { return (kern_link(td, uap->path, uap->link, UIO_USERSPACE)); } int kern_link(struct thread *td, char *path, char *link, enum uio_seg segflg) { struct vnode *vp; struct mount *mp; struct nameidata nd; int error; bwillwrite(); NDINIT(&nd, LOOKUP, FOLLOW|NOOBJ, segflg, path, td); if ((error = namei(&nd)) != 0) return (error); NDFREE(&nd, NDF_ONLY_PNBUF); vp = nd.ni_vp; if (vp->v_type == VDIR) { vrele(vp); return (EPERM); /* POSIX */ } if ((error = vn_start_write(vp, &mp, V_WAIT | PCATCH)) != 0) { vrele(vp); return (error); } NDINIT(&nd, CREATE, LOCKPARENT | NOOBJ | SAVENAME, segflg, link, td); if ((error = namei(&nd)) == 0) { if (nd.ni_vp != NULL) { vrele(nd.ni_vp); error = EEXIST; } else if ((error = vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td)) == 0) { VOP_LEASE(nd.ni_dvp, td, td->td_ucred, LEASE_WRITE); VOP_LEASE(vp, td, td->td_ucred, LEASE_WRITE); - error = VOP_LINK(nd.ni_dvp, vp, &nd.ni_cnd); +#ifdef MAC + error = mac_check_vnode_link(td->td_ucred, nd.ni_dvp, + vp, &nd.ni_cnd); + if (error == 0) +#endif + error = VOP_LINK(nd.ni_dvp, vp, &nd.ni_cnd); VOP_UNLOCK(vp, 0, td); } NDFREE(&nd, NDF_ONLY_PNBUF); vput(nd.ni_dvp); } vrele(vp); vn_finished_write(mp); ASSERT_VOP_UNLOCKED(nd.ni_dvp, "link"); ASSERT_VOP_UNLOCKED(nd.ni_vp, "link"); return (error); } /* * Make a symbolic link. */ #ifndef _SYS_SYSPROTO_H_ struct symlink_args { char *path; char *link; }; #endif /* ARGSUSED */ int symlink(td, uap) struct thread *td; register struct symlink_args /* { syscallarg(char *) path; syscallarg(char *) link; } */ *uap; { return (kern_symlink(td, uap->path, uap->link, UIO_USERSPACE)); } int kern_symlink(struct thread *td, char *path, char *link, enum uio_seg segflg) { struct mount *mp; struct vattr vattr; char *syspath; int error; struct nameidata nd; if (segflg == UIO_SYSSPACE) { syspath = path; } else { syspath = uma_zalloc(namei_zone, M_WAITOK); if ((error = copyinstr(path, syspath, MAXPATHLEN, NULL)) != 0) goto out; } restart: bwillwrite(); NDINIT(&nd, CREATE, LOCKPARENT | NOOBJ | SAVENAME, segflg, link, td); if ((error = namei(&nd)) != 0) goto out; if (nd.ni_vp) { NDFREE(&nd, NDF_ONLY_PNBUF); vrele(nd.ni_vp); vput(nd.ni_dvp); error = EEXIST; goto out; } if (vn_start_write(nd.ni_dvp, &mp, V_NOWAIT) != 0) { NDFREE(&nd, NDF_ONLY_PNBUF); vput(nd.ni_dvp); if ((error = vn_start_write(NULL, &mp, V_XSLEEP | PCATCH)) != 0) return (error); goto restart; } VATTR_NULL(&vattr); FILEDESC_LOCK(td->td_proc->p_fd); vattr.va_mode = ACCESSPERMS &~ td->td_proc->p_fd->fd_cmask; FILEDESC_UNLOCK(td->td_proc->p_fd); VOP_LEASE(nd.ni_dvp, td, td->td_ucred, LEASE_WRITE); error = VOP_SYMLINK(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &vattr, syspath); NDFREE(&nd, NDF_ONLY_PNBUF); if (error == 0) vput(nd.ni_vp); vput(nd.ni_dvp); vn_finished_write(mp); ASSERT_VOP_UNLOCKED(nd.ni_dvp, "symlink"); ASSERT_VOP_UNLOCKED(nd.ni_vp, "symlink"); out: if (segflg != UIO_SYSSPACE) uma_zfree(namei_zone, syspath); return (error); } /* * Delete a whiteout from the filesystem. */ /* ARGSUSED */ int undelete(td, uap) struct thread *td; register struct undelete_args /* { syscallarg(char *) path; } */ *uap; { int error; struct mount *mp; struct nameidata nd; restart: bwillwrite(); NDINIT(&nd, DELETE, LOCKPARENT|DOWHITEOUT, UIO_USERSPACE, SCARG(uap, path), td); error = namei(&nd); if (error) return (error); if (nd.ni_vp != NULLVP || !(nd.ni_cnd.cn_flags & ISWHITEOUT)) { NDFREE(&nd, NDF_ONLY_PNBUF); if (nd.ni_vp) vrele(nd.ni_vp); vput(nd.ni_dvp); return (EEXIST); } if (vn_start_write(nd.ni_dvp, &mp, V_NOWAIT) != 0) { NDFREE(&nd, NDF_ONLY_PNBUF); vput(nd.ni_dvp); if ((error = vn_start_write(NULL, &mp, V_XSLEEP | PCATCH)) != 0) return (error); goto restart; } VOP_LEASE(nd.ni_dvp, td, td->td_ucred, LEASE_WRITE); error = VOP_WHITEOUT(nd.ni_dvp, &nd.ni_cnd, DELETE); NDFREE(&nd, NDF_ONLY_PNBUF); vput(nd.ni_dvp); vn_finished_write(mp); ASSERT_VOP_UNLOCKED(nd.ni_dvp, "undelete"); ASSERT_VOP_UNLOCKED(nd.ni_vp, "undelete"); return (error); } /* * Delete a name from the filesystem. */ #ifndef _SYS_SYSPROTO_H_ struct unlink_args { char *path; }; #endif /* ARGSUSED */ int unlink(td, uap) struct thread *td; struct unlink_args /* { syscallarg(char *) path; } */ *uap; { return (kern_unlink(td, SCARG(uap, path), UIO_USERSPACE)); } int kern_unlink(struct thread *td, char *path, enum uio_seg pathseg) { struct mount *mp; struct vnode *vp; int error; struct nameidata nd; restart: bwillwrite(); NDINIT(&nd, DELETE, LOCKPARENT|LOCKLEAF, pathseg, path, td); if ((error = namei(&nd)) != 0) return (error); vp = nd.ni_vp; if (vp->v_type == VDIR) error = EPERM; /* POSIX */ else { /* * The root of a mounted filesystem cannot be deleted. * * XXX: can this only be a VDIR case? */ if (vp->v_vflag & VV_ROOT) error = EBUSY; } if (error == 0) { if (vn_start_write(nd.ni_dvp, &mp, V_NOWAIT) != 0) { NDFREE(&nd, NDF_ONLY_PNBUF); if (vp == nd.ni_dvp) vrele(vp); else vput(vp); vput(nd.ni_dvp); if ((error = vn_start_write(NULL, &mp, V_XSLEEP | PCATCH)) != 0) return (error); goto restart; } VOP_LEASE(nd.ni_dvp, td, td->td_ucred, LEASE_WRITE); error = VOP_REMOVE(nd.ni_dvp, vp, &nd.ni_cnd); vn_finished_write(mp); } NDFREE(&nd, NDF_ONLY_PNBUF); if (vp == nd.ni_dvp) vrele(vp); else vput(vp); vput(nd.ni_dvp); ASSERT_VOP_UNLOCKED(nd.ni_dvp, "unlink"); ASSERT_VOP_UNLOCKED(nd.ni_vp, "unlink"); return (error); } /* * Reposition read/write file offset. */ #ifndef _SYS_SYSPROTO_H_ struct lseek_args { int fd; int pad; off_t offset; int whence; }; #endif int lseek(td, uap) struct thread *td; register struct lseek_args /* { syscallarg(int) fd; syscallarg(int) pad; syscallarg(off_t) offset; syscallarg(int) whence; } */ *uap; { struct ucred *cred = td->td_ucred; struct file *fp; struct vnode *vp; struct vattr vattr; off_t offset; int error, noneg; if ((error = fget(td, uap->fd, &fp)) != 0) return (error); if (fp->f_type != DTYPE_VNODE) { fdrop(fp, td); return (ESPIPE); } vp = (struct vnode *)fp->f_data; noneg = (vp->v_type != VCHR); offset = SCARG(uap, offset); switch (SCARG(uap, whence)) { case L_INCR: if (noneg && (fp->f_offset < 0 || (offset > 0 && fp->f_offset > OFF_MAX - offset))) return (EOVERFLOW); offset += fp->f_offset; break; case L_XTND: vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); error = VOP_GETATTR(vp, &vattr, cred, td); VOP_UNLOCK(vp, 0, td); if (error) return (error); if (noneg && (vattr.va_size > OFF_MAX || (offset > 0 && vattr.va_size > OFF_MAX - offset))) return (EOVERFLOW); offset += vattr.va_size; break; case L_SET: break; default: fdrop(fp, td); return (EINVAL); } if (noneg && offset < 0) return (EINVAL); fp->f_offset = offset; *(off_t *)(td->td_retval) = fp->f_offset; fdrop(fp, td); return (0); } #if defined(COMPAT_43) || defined(COMPAT_SUNOS) /* * Reposition read/write file offset. */ #ifndef _SYS_SYSPROTO_H_ struct olseek_args { int fd; long offset; int whence; }; #endif int olseek(td, uap) struct thread *td; register struct olseek_args /* { syscallarg(int) fd; syscallarg(long) offset; syscallarg(int) whence; } */ *uap; { struct lseek_args /* { syscallarg(int) fd; syscallarg(int) pad; syscallarg(off_t) offset; syscallarg(int) whence; } */ nuap; int error; SCARG(&nuap, fd) = SCARG(uap, fd); SCARG(&nuap, offset) = SCARG(uap, offset); SCARG(&nuap, whence) = SCARG(uap, whence); error = lseek(td, &nuap); return (error); } #endif /* COMPAT_43 */ /* * Check access permissions using passed credentials. */ static int vn_access(vp, user_flags, cred, td) struct vnode *vp; int user_flags; struct ucred *cred; struct thread *td; { int error, flags; /* Flags == 0 means only check for existence. */ error = 0; if (user_flags) { flags = 0; if (user_flags & R_OK) flags |= VREAD; if (user_flags & W_OK) flags |= VWRITE; if (user_flags & X_OK) flags |= VEXEC; #ifdef MAC error = mac_check_vnode_access(cred, vp, flags); if (error) return (error); #endif if ((flags & VWRITE) == 0 || (error = vn_writechk(vp)) == 0) error = VOP_ACCESS(vp, flags, cred, td); } return (error); } /* * Check access permissions using "real" credentials. */ #ifndef _SYS_SYSPROTO_H_ struct access_args { char *path; int flags; }; #endif int access(td, uap) struct thread *td; register struct access_args /* { syscallarg(char *) path; syscallarg(int) flags; } */ *uap; { return (kern_access(td, uap->path, UIO_USERSPACE, uap->flags)); } int kern_access(struct thread *td, char *path, enum uio_seg pathseg, int flags) { struct ucred *cred, *tmpcred; register struct vnode *vp; int error; struct nameidata nd; /* * Create and modify a temporary credential instead of one that * is potentially shared. This could also mess up socket * buffer accounting which can run in an interrupt context. * * XXX - Depending on how "threads" are finally implemented, it * may be better to explicitly pass the credential to namei() * rather than to modify the potentially shared process structure. */ cred = td->td_ucred; tmpcred = crdup(cred); tmpcred->cr_uid = cred->cr_ruid; tmpcred->cr_groups[0] = cred->cr_rgid; td->td_ucred = tmpcred; NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF | NOOBJ, pathseg, path, td); if ((error = namei(&nd)) != 0) goto out1; vp = nd.ni_vp; error = vn_access(vp, flags, tmpcred, td); NDFREE(&nd, NDF_ONLY_PNBUF); vput(vp); out1: td->td_ucred = cred; crfree(tmpcred); return (error); } /* * Check access permissions using "effective" credentials. */ #ifndef _SYS_SYSPROTO_H_ struct eaccess_args { char *path; int flags; }; #endif int eaccess(td, uap) struct thread *td; register struct eaccess_args /* { syscallarg(char *) path; syscallarg(int) flags; } */ *uap; { struct nameidata nd; struct vnode *vp; int error; NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF | NOOBJ, UIO_USERSPACE, SCARG(uap, path), td); if ((error = namei(&nd)) != 0) return (error); vp = nd.ni_vp; error = vn_access(vp, SCARG(uap, flags), td->td_ucred, td); NDFREE(&nd, NDF_ONLY_PNBUF); vput(vp); return (error); } #if defined(COMPAT_43) || defined(COMPAT_SUNOS) /* * Get file status; this version follows links. */ #ifndef _SYS_SYSPROTO_H_ struct ostat_args { char *path; struct ostat *ub; }; #endif /* ARGSUSED */ int ostat(td, uap) struct thread *td; register struct ostat_args /* { syscallarg(char *) path; syscallarg(struct ostat *) ub; } */ *uap; { struct stat sb; struct ostat osb; int error; struct nameidata nd; NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF | NOOBJ, UIO_USERSPACE, SCARG(uap, path), td); if ((error = namei(&nd)) != 0) return (error); NDFREE(&nd, NDF_ONLY_PNBUF); error = vn_stat(nd.ni_vp, &sb, td->td_ucred, NOCRED, td); vput(nd.ni_vp); if (error) return (error); cvtstat(&sb, &osb); error = copyout(&osb, SCARG(uap, ub), sizeof (osb)); return (error); } /* * Get file status; this version does not follow links. */ #ifndef _SYS_SYSPROTO_H_ struct olstat_args { char *path; struct ostat *ub; }; #endif /* ARGSUSED */ int olstat(td, uap) struct thread *td; register struct olstat_args /* { syscallarg(char *) path; syscallarg(struct ostat *) ub; } */ *uap; { struct vnode *vp; struct stat sb; struct ostat osb; int error; struct nameidata nd; NDINIT(&nd, LOOKUP, NOFOLLOW | LOCKLEAF | NOOBJ, UIO_USERSPACE, SCARG(uap, path), td); if ((error = namei(&nd)) != 0) return (error); vp = nd.ni_vp; error = vn_stat(vp, &sb, td->td_ucred, NOCRED, td); NDFREE(&nd, NDF_ONLY_PNBUF); vput(vp); if (error) return (error); cvtstat(&sb, &osb); error = copyout(&osb, SCARG(uap, ub), sizeof (osb)); return (error); } /* * Convert from an old to a new stat structure. */ void cvtstat(st, ost) struct stat *st; struct ostat *ost; { ost->st_dev = st->st_dev; ost->st_ino = st->st_ino; ost->st_mode = st->st_mode; ost->st_nlink = st->st_nlink; ost->st_uid = st->st_uid; ost->st_gid = st->st_gid; ost->st_rdev = st->st_rdev; if (st->st_size < (quad_t)1 << 32) ost->st_size = st->st_size; else ost->st_size = -2; ost->st_atime = st->st_atime; ost->st_mtime = st->st_mtime; ost->st_ctime = st->st_ctime; ost->st_blksize = st->st_blksize; ost->st_blocks = st->st_blocks; ost->st_flags = st->st_flags; ost->st_gen = st->st_gen; } #endif /* COMPAT_43 || COMPAT_SUNOS */ /* * Get file status; this version follows links. */ #ifndef _SYS_SYSPROTO_H_ struct stat_args { char *path; struct stat *ub; }; #endif /* ARGSUSED */ int stat(td, uap) struct thread *td; register struct stat_args /* { syscallarg(char *) path; syscallarg(struct stat *) ub; } */ *uap; { struct stat sb; int error; struct nameidata nd; #ifdef LOOKUP_SHARED NDINIT(&nd, LOOKUP, FOLLOW | LOCKSHARED | LOCKLEAF | NOOBJ, UIO_USERSPACE, SCARG(uap, path), td); #else NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF | NOOBJ, UIO_USERSPACE, SCARG(uap, path), td); #endif if ((error = namei(&nd)) != 0) return (error); error = vn_stat(nd.ni_vp, &sb, td->td_ucred, NOCRED, td); NDFREE(&nd, NDF_ONLY_PNBUF); vput(nd.ni_vp); if (error) return (error); error = copyout(&sb, SCARG(uap, ub), sizeof (sb)); return (error); } /* * Get file status; this version does not follow links. */ #ifndef _SYS_SYSPROTO_H_ struct lstat_args { char *path; struct stat *ub; }; #endif /* ARGSUSED */ int lstat(td, uap) struct thread *td; register struct lstat_args /* { syscallarg(char *) path; syscallarg(struct stat *) ub; } */ *uap; { int error; struct vnode *vp; struct stat sb; struct nameidata nd; NDINIT(&nd, LOOKUP, NOFOLLOW | LOCKLEAF | NOOBJ, UIO_USERSPACE, SCARG(uap, path), td); if ((error = namei(&nd)) != 0) return (error); vp = nd.ni_vp; error = vn_stat(vp, &sb, td->td_ucred, NOCRED, td); NDFREE(&nd, NDF_ONLY_PNBUF); vput(vp); if (error) return (error); error = copyout(&sb, SCARG(uap, ub), sizeof (sb)); return (error); } /* * Implementation of the NetBSD stat() function. * XXX This should probably be collapsed with the FreeBSD version, * as the differences are only due to vn_stat() clearing spares at * the end of the structures. vn_stat could be split to avoid this, * and thus collapse the following to close to zero code. */ void cvtnstat(sb, nsb) struct stat *sb; struct nstat *nsb; { bzero(nsb, sizeof *nsb); nsb->st_dev = sb->st_dev; nsb->st_ino = sb->st_ino; nsb->st_mode = sb->st_mode; nsb->st_nlink = sb->st_nlink; nsb->st_uid = sb->st_uid; nsb->st_gid = sb->st_gid; nsb->st_rdev = sb->st_rdev; nsb->st_atimespec = sb->st_atimespec; nsb->st_mtimespec = sb->st_mtimespec; nsb->st_ctimespec = sb->st_ctimespec; nsb->st_size = sb->st_size; nsb->st_blocks = sb->st_blocks; nsb->st_blksize = sb->st_blksize; nsb->st_flags = sb->st_flags; nsb->st_gen = sb->st_gen; nsb->st_birthtimespec = sb->st_birthtimespec; } #ifndef _SYS_SYSPROTO_H_ struct nstat_args { char *path; struct nstat *ub; }; #endif /* ARGSUSED */ int nstat(td, uap) struct thread *td; register struct nstat_args /* { syscallarg(char *) path; syscallarg(struct nstat *) ub; } */ *uap; { struct stat sb; struct nstat nsb; int error; struct nameidata nd; NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF | NOOBJ, UIO_USERSPACE, SCARG(uap, path), td); if ((error = namei(&nd)) != 0) return (error); NDFREE(&nd, NDF_ONLY_PNBUF); error = vn_stat(nd.ni_vp, &sb, td->td_ucred, NOCRED, td); vput(nd.ni_vp); if (error) return (error); cvtnstat(&sb, &nsb); error = copyout(&nsb, SCARG(uap, ub), sizeof (nsb)); return (error); } /* * NetBSD lstat. Get file status; this version does not follow links. */ #ifndef _SYS_SYSPROTO_H_ struct lstat_args { char *path; struct stat *ub; }; #endif /* ARGSUSED */ int nlstat(td, uap) struct thread *td; register struct nlstat_args /* { syscallarg(char *) path; syscallarg(struct nstat *) ub; } */ *uap; { int error; struct vnode *vp; struct stat sb; struct nstat nsb; struct nameidata nd; NDINIT(&nd, LOOKUP, NOFOLLOW | LOCKLEAF | NOOBJ, UIO_USERSPACE, SCARG(uap, path), td); if ((error = namei(&nd)) != 0) return (error); vp = nd.ni_vp; NDFREE(&nd, NDF_ONLY_PNBUF); error = vn_stat(vp, &sb, td->td_ucred, NOCRED, td); vput(vp); if (error) return (error); cvtnstat(&sb, &nsb); error = copyout(&nsb, SCARG(uap, ub), sizeof (nsb)); return (error); } /* * Get configurable pathname variables. */ #ifndef _SYS_SYSPROTO_H_ struct pathconf_args { char *path; int name; }; #endif /* ARGSUSED */ int pathconf(td, uap) struct thread *td; register struct pathconf_args /* { syscallarg(char *) path; syscallarg(int) name; } */ *uap; { int error; struct nameidata nd; NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF | NOOBJ, UIO_USERSPACE, SCARG(uap, path), td); if ((error = namei(&nd)) != 0) return (error); NDFREE(&nd, NDF_ONLY_PNBUF); error = VOP_PATHCONF(nd.ni_vp, SCARG(uap, name), td->td_retval); vput(nd.ni_vp); return (error); } /* * Return target name of a symbolic link. */ #ifndef _SYS_SYSPROTO_H_ struct readlink_args { char *path; char *buf; int count; }; #endif /* ARGSUSED */ int readlink(td, uap) struct thread *td; register struct readlink_args /* { syscallarg(char *) path; syscallarg(char *) buf; syscallarg(int) count; } */ *uap; { return (kern_readlink(td, uap->path, UIO_USERSPACE, uap->buf, UIO_USERSPACE, uap->count)); } int kern_readlink(struct thread *td, char *path, enum uio_seg pathseg, char *buf, enum uio_seg bufseg, int count) { register struct vnode *vp; struct iovec aiov; struct uio auio; int error; struct nameidata nd; NDINIT(&nd, LOOKUP, NOFOLLOW | LOCKLEAF | NOOBJ, pathseg, path, td); if ((error = namei(&nd)) != 0) return (error); NDFREE(&nd, NDF_ONLY_PNBUF); vp = nd.ni_vp; #ifdef MAC error = mac_check_vnode_readlink(td->td_ucred, vp); if (error) { vput(vp); return (error); } #endif if (vp->v_type != VLNK) error = EINVAL; else { aiov.iov_base = buf; aiov.iov_len = count; auio.uio_iov = &aiov; auio.uio_iovcnt = 1; auio.uio_offset = 0; auio.uio_rw = UIO_READ; auio.uio_segflg = bufseg; auio.uio_td = td; auio.uio_resid = count; error = VOP_READLINK(vp, &auio, td->td_ucred); } vput(vp); td->td_retval[0] = count - auio.uio_resid; return (error); } /* * Common implementation code for chflags() and fchflags(). */ static int setfflags(td, vp, flags) struct thread *td; struct vnode *vp; int flags; { int error; struct mount *mp; struct vattr vattr; /* * Prevent non-root users from setting flags on devices. When * a device is reused, users can retain ownership of the device * if they are allowed to set flags and programs assume that * chown can't fail when done as root. */ if (vp->v_type == VCHR || vp->v_type == VBLK) { error = suser_cred(td->td_ucred, PRISON_ROOT); if (error) return (error); } if ((error = vn_start_write(vp, &mp, V_WAIT | PCATCH)) != 0) return (error); VOP_LEASE(vp, td, td->td_ucred, LEASE_WRITE); vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); #ifdef MAC error = mac_check_vnode_setflags(td->td_ucred, vp, vattr.va_flags); if (error == 0) { #endif VATTR_NULL(&vattr); vattr.va_flags = flags; error = VOP_SETATTR(vp, &vattr, td->td_ucred, td); #ifdef MAC } #endif VOP_UNLOCK(vp, 0, td); vn_finished_write(mp); return (error); } /* * Change flags of a file given a path name. */ #ifndef _SYS_SYSPROTO_H_ struct chflags_args { char *path; int flags; }; #endif /* ARGSUSED */ int chflags(td, uap) struct thread *td; register struct chflags_args /* { syscallarg(char *) path; syscallarg(int) flags; } */ *uap; { int error; struct nameidata nd; NDINIT(&nd, LOOKUP, FOLLOW, UIO_USERSPACE, SCARG(uap, path), td); if ((error = namei(&nd)) != 0) return (error); NDFREE(&nd, NDF_ONLY_PNBUF); error = setfflags(td, nd.ni_vp, SCARG(uap, flags)); vrele(nd.ni_vp); return error; } /* * Same as chflags() but doesn't follow symlinks. */ int lchflags(td, uap) struct thread *td; register struct lchflags_args /* { syscallarg(char *) path; syscallarg(int) flags; } */ *uap; { int error; struct nameidata nd; NDINIT(&nd, LOOKUP, NOFOLLOW, UIO_USERSPACE, SCARG(uap, path), td); if ((error = namei(&nd)) != 0) return (error); NDFREE(&nd, NDF_ONLY_PNBUF); error = setfflags(td, nd.ni_vp, SCARG(uap, flags)); vrele(nd.ni_vp); return error; } /* * Change flags of a file given a file descriptor. */ #ifndef _SYS_SYSPROTO_H_ struct fchflags_args { int fd; int flags; }; #endif /* ARGSUSED */ int fchflags(td, uap) struct thread *td; register struct fchflags_args /* { syscallarg(int) fd; syscallarg(int) flags; } */ *uap; { struct file *fp; int error; if ((error = getvnode(td->td_proc->p_fd, SCARG(uap, fd), &fp)) != 0) return (error); error = setfflags(td, (struct vnode *) fp->f_data, SCARG(uap, flags)); fdrop(fp, td); return (error); } /* * Common implementation code for chmod(), lchmod() and fchmod(). */ static int setfmode(td, vp, mode) struct thread *td; struct vnode *vp; int mode; { int error; struct mount *mp; struct vattr vattr; if ((error = vn_start_write(vp, &mp, V_WAIT | PCATCH)) != 0) return (error); VOP_LEASE(vp, td, td->td_ucred, LEASE_WRITE); vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); VATTR_NULL(&vattr); vattr.va_mode = mode & ALLPERMS; #ifdef MAC error = mac_check_vnode_setmode(td->td_ucred, vp, vattr.va_mode); if (error == 0) #endif error = VOP_SETATTR(vp, &vattr, td->td_ucred, td); VOP_UNLOCK(vp, 0, td); vn_finished_write(mp); return error; } /* * Change mode of a file given path name. */ #ifndef _SYS_SYSPROTO_H_ struct chmod_args { char *path; int mode; }; #endif /* ARGSUSED */ int chmod(td, uap) struct thread *td; register struct chmod_args /* { syscallarg(char *) path; syscallarg(int) mode; } */ *uap; { return (kern_chmod(td, uap->path, UIO_USERSPACE, uap->mode)); } int kern_chmod(struct thread *td, char *path, enum uio_seg pathseg, int mode) { int error; struct nameidata nd; NDINIT(&nd, LOOKUP, FOLLOW, pathseg, path, td); if ((error = namei(&nd)) != 0) return (error); NDFREE(&nd, NDF_ONLY_PNBUF); error = setfmode(td, nd.ni_vp, mode); vrele(nd.ni_vp); return error; } /* * Change mode of a file given path name (don't follow links.) */ #ifndef _SYS_SYSPROTO_H_ struct lchmod_args { char *path; int mode; }; #endif /* ARGSUSED */ int lchmod(td, uap) struct thread *td; register struct lchmod_args /* { syscallarg(char *) path; syscallarg(int) mode; } */ *uap; { int error; struct nameidata nd; NDINIT(&nd, LOOKUP, NOFOLLOW, UIO_USERSPACE, SCARG(uap, path), td); if ((error = namei(&nd)) != 0) return (error); NDFREE(&nd, NDF_ONLY_PNBUF); error = setfmode(td, nd.ni_vp, SCARG(uap, mode)); vrele(nd.ni_vp); return error; } /* * Change mode of a file given a file descriptor. */ #ifndef _SYS_SYSPROTO_H_ struct fchmod_args { int fd; int mode; }; #endif /* ARGSUSED */ int fchmod(td, uap) struct thread *td; register struct fchmod_args /* { syscallarg(int) fd; syscallarg(int) mode; } */ *uap; { struct file *fp; struct vnode *vp; int error; if ((error = getvnode(td->td_proc->p_fd, SCARG(uap, fd), &fp)) != 0) return (error); vp = (struct vnode *)fp->f_data; error = setfmode(td, (struct vnode *)fp->f_data, SCARG(uap, mode)); fdrop(fp, td); return (error); } /* * Common implementation for chown(), lchown(), and fchown() */ static int setfown(td, vp, uid, gid) struct thread *td; struct vnode *vp; uid_t uid; gid_t gid; { int error; struct mount *mp; struct vattr vattr; if ((error = vn_start_write(vp, &mp, V_WAIT | PCATCH)) != 0) return (error); VOP_LEASE(vp, td, td->td_ucred, LEASE_WRITE); vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); VATTR_NULL(&vattr); vattr.va_uid = uid; vattr.va_gid = gid; #ifdef MAC error = mac_check_vnode_setowner(td->td_ucred, vp, vattr.va_uid, vattr.va_gid); if (error == 0) #endif error = VOP_SETATTR(vp, &vattr, td->td_ucred, td); VOP_UNLOCK(vp, 0, td); vn_finished_write(mp); return error; } /* * Set ownership given a path name. */ #ifndef _SYS_SYSPROTO_H_ struct chown_args { char *path; int uid; int gid; }; #endif /* ARGSUSED */ int chown(td, uap) struct thread *td; register struct chown_args /* { syscallarg(char *) path; syscallarg(int) uid; syscallarg(int) gid; } */ *uap; { return (kern_chown(td, uap->path, UIO_USERSPACE, uap->uid, uap->gid)); } int kern_chown(struct thread *td, char *path, enum uio_seg pathseg, int uid, int gid) { int error; struct nameidata nd; NDINIT(&nd, LOOKUP, FOLLOW, pathseg, path, td); if ((error = namei(&nd)) != 0) return (error); NDFREE(&nd, NDF_ONLY_PNBUF); error = setfown(td, nd.ni_vp, uid, gid); vrele(nd.ni_vp); return (error); } /* * Set ownership given a path name, do not cross symlinks. */ #ifndef _SYS_SYSPROTO_H_ struct lchown_args { char *path; int uid; int gid; }; #endif /* ARGSUSED */ int lchown(td, uap) struct thread *td; register struct lchown_args /* { syscallarg(char *) path; syscallarg(int) uid; syscallarg(int) gid; } */ *uap; { return (kern_lchown(td, uap->path, UIO_USERSPACE, uap->uid, uap->gid)); } int kern_lchown(struct thread *td, char *path, enum uio_seg pathseg, int uid, int gid) { int error; struct nameidata nd; NDINIT(&nd, LOOKUP, NOFOLLOW, pathseg, path, td); if ((error = namei(&nd)) != 0) return (error); NDFREE(&nd, NDF_ONLY_PNBUF); error = setfown(td, nd.ni_vp, uid, gid); vrele(nd.ni_vp); return (error); } /* * Set ownership given a file descriptor. */ #ifndef _SYS_SYSPROTO_H_ struct fchown_args { int fd; int uid; int gid; }; #endif /* ARGSUSED */ int fchown(td, uap) struct thread *td; register struct fchown_args /* { syscallarg(int) fd; syscallarg(int) uid; syscallarg(int) gid; } */ *uap; { struct file *fp; struct vnode *vp; int error; if ((error = getvnode(td->td_proc->p_fd, SCARG(uap, fd), &fp)) != 0) return (error); vp = (struct vnode *)fp->f_data; error = setfown(td, (struct vnode *)fp->f_data, SCARG(uap, uid), SCARG(uap, gid)); fdrop(fp, td); return (error); } /* * Common implementation code for utimes(), lutimes(), and futimes(). */ static int getutimes(usrtvp, tvpseg, tsp) const struct timeval *usrtvp; enum uio_seg tvpseg; struct timespec *tsp; { struct timeval tv[2]; const struct timeval *tvp; int error; if (usrtvp == NULL) { microtime(&tv[0]); TIMEVAL_TO_TIMESPEC(&tv[0], &tsp[0]); tsp[1] = tsp[0]; } else { if (tvpseg == UIO_SYSSPACE) { tvp = usrtvp; } else { if ((error = copyin(usrtvp, tv, sizeof(tv))) != 0) return (error); tvp = tv; } TIMEVAL_TO_TIMESPEC(&tvp[0], &tsp[0]); TIMEVAL_TO_TIMESPEC(&tvp[1], &tsp[1]); } return 0; } /* * Common implementation code for utimes(), lutimes(), and futimes(). */ static int setutimes(td, vp, ts, numtimes, nullflag) struct thread *td; struct vnode *vp; const struct timespec *ts; int numtimes; int nullflag; { int error, setbirthtime; struct mount *mp; struct vattr vattr; if ((error = vn_start_write(vp, &mp, V_WAIT | PCATCH)) != 0) return (error); VOP_LEASE(vp, td, td->td_ucred, LEASE_WRITE); vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); setbirthtime = 0; if (numtimes < 3 && VOP_GETATTR(vp, &vattr, td->td_ucred, td) == 0 && timespeccmp(&ts[1], &vattr.va_birthtime, < )) setbirthtime = 1; VATTR_NULL(&vattr); vattr.va_atime = ts[0]; vattr.va_mtime = ts[1]; if (setbirthtime) vattr.va_birthtime = ts[1]; if (numtimes > 2) vattr.va_birthtime = ts[2]; if (nullflag) vattr.va_vaflags |= VA_UTIMES_NULL; #ifdef MAC error = mac_check_vnode_setutimes(td->td_ucred, vp, vattr.va_atime, vattr.va_mtime); #endif if (error == 0) error = VOP_SETATTR(vp, &vattr, td->td_ucred, td); VOP_UNLOCK(vp, 0, td); vn_finished_write(mp); return error; } /* * Set the access and modification times of a file. */ #ifndef _SYS_SYSPROTO_H_ struct utimes_args { char *path; struct timeval *tptr; }; #endif /* ARGSUSED */ int utimes(td, uap) struct thread *td; register struct utimes_args /* { syscallarg(char *) path; syscallarg(struct timeval *) tptr; } */ *uap; { return (kern_utimes(td, uap->path, UIO_USERSPACE, uap->tptr, UIO_USERSPACE)); } int kern_utimes(struct thread *td, char *path, enum uio_seg pathseg, struct timeval *tptr, enum uio_seg tptrseg) { struct timespec ts[2]; int error; struct nameidata nd; if ((error = getutimes(tptr, tptrseg, ts)) != 0) return (error); NDINIT(&nd, LOOKUP, FOLLOW, pathseg, path, td); if ((error = namei(&nd)) != 0) return (error); NDFREE(&nd, NDF_ONLY_PNBUF); error = setutimes(td, nd.ni_vp, ts, 2, tptr == NULL); vrele(nd.ni_vp); return (error); } /* * Set the access and modification times of a file. */ #ifndef _SYS_SYSPROTO_H_ struct lutimes_args { char *path; struct timeval *tptr; }; #endif /* ARGSUSED */ int lutimes(td, uap) struct thread *td; register struct lutimes_args /* { syscallarg(char *) path; syscallarg(struct timeval *) tptr; } */ *uap; { return (kern_lutimes(td, uap->path, UIO_USERSPACE, uap->tptr, UIO_USERSPACE)); } int kern_lutimes(struct thread *td, char *path, enum uio_seg pathseg, struct timeval *tptr, enum uio_seg tptrseg) { struct timespec ts[2]; int error; struct nameidata nd; if ((error = getutimes(tptr, tptrseg, ts)) != 0) return (error); NDINIT(&nd, LOOKUP, NOFOLLOW, pathseg, path, td); if ((error = namei(&nd)) != 0) return (error); NDFREE(&nd, NDF_ONLY_PNBUF); error = setutimes(td, nd.ni_vp, ts, 2, tptr == NULL); vrele(nd.ni_vp); return (error); } /* * Set the access and modification times of a file. */ #ifndef _SYS_SYSPROTO_H_ struct futimes_args { int fd; struct timeval *tptr; }; #endif /* ARGSUSED */ int futimes(td, uap) struct thread *td; register struct futimes_args /* { syscallarg(int ) fd; syscallarg(struct timeval *) tptr; } */ *uap; { return (kern_futimes(td, uap->fd, uap->tptr, UIO_USERSPACE)); } int kern_futimes(struct thread *td, int fd, struct timeval *tptr, enum uio_seg tptrseg) { struct timespec ts[2]; struct file *fp; int error; if ((error = getutimes(tptr, tptrseg, ts)) != 0) return (error); if ((error = getvnode(td->td_proc->p_fd, fd, &fp)) != 0) return (error); error = setutimes(td, (struct vnode *)fp->f_data, ts, 2, tptr == NULL); fdrop(fp, td); return (error); } /* * Truncate a file given its path name. */ #ifndef _SYS_SYSPROTO_H_ struct truncate_args { char *path; int pad; off_t length; }; #endif /* ARGSUSED */ int truncate(td, uap) struct thread *td; register struct truncate_args /* { syscallarg(char *) path; syscallarg(int) pad; syscallarg(off_t) length; } */ *uap; { return (kern_truncate(td, uap->path, UIO_USERSPACE, uap->length)); } int kern_truncate(struct thread *td, char *path, enum uio_seg pathseg, off_t length) { struct mount *mp; struct vnode *vp; struct vattr vattr; int error; struct nameidata nd; if (length < 0) return(EINVAL); NDINIT(&nd, LOOKUP, FOLLOW, pathseg, path, td); if ((error = namei(&nd)) != 0) return (error); vp = nd.ni_vp; if ((error = vn_start_write(vp, &mp, V_WAIT | PCATCH)) != 0) { vrele(vp); return (error); } NDFREE(&nd, NDF_ONLY_PNBUF); VOP_LEASE(vp, td, td->td_ucred, LEASE_WRITE); vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); if (vp->v_type == VDIR) error = EISDIR; #ifdef MAC else if ((error = mac_check_vnode_write(td->td_ucred, NOCRED, vp))) { } #endif else if ((error = vn_writechk(vp)) == 0 && (error = VOP_ACCESS(vp, VWRITE, td->td_ucred, td)) == 0) { VATTR_NULL(&vattr); vattr.va_size = length; error = VOP_SETATTR(vp, &vattr, td->td_ucred, td); } vput(vp); vn_finished_write(mp); return (error); } /* * Truncate a file given a file descriptor. */ #ifndef _SYS_SYSPROTO_H_ struct ftruncate_args { int fd; int pad; off_t length; }; #endif /* ARGSUSED */ int ftruncate(td, uap) struct thread *td; register struct ftruncate_args /* { syscallarg(int) fd; syscallarg(int) pad; syscallarg(off_t) length; } */ *uap; { struct mount *mp; struct vattr vattr; struct vnode *vp; struct file *fp; int error; if (uap->length < 0) return(EINVAL); if ((error = getvnode(td->td_proc->p_fd, SCARG(uap, fd), &fp)) != 0) return (error); if ((fp->f_flag & FWRITE) == 0) { fdrop(fp, td); return (EINVAL); } vp = (struct vnode *)fp->f_data; if ((error = vn_start_write(vp, &mp, V_WAIT | PCATCH)) != 0) { fdrop(fp, td); return (error); } VOP_LEASE(vp, td, td->td_ucred, LEASE_WRITE); vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); if (vp->v_type == VDIR) error = EISDIR; #ifdef MAC else if ((error = mac_check_vnode_write(td->td_ucred, fp->f_cred, vp))) { } #endif else if ((error = vn_writechk(vp)) == 0) { VATTR_NULL(&vattr); vattr.va_size = SCARG(uap, length); error = VOP_SETATTR(vp, &vattr, fp->f_cred, td); } VOP_UNLOCK(vp, 0, td); vn_finished_write(mp); fdrop(fp, td); return (error); } #if defined(COMPAT_43) || defined(COMPAT_SUNOS) /* * Truncate a file given its path name. */ #ifndef _SYS_SYSPROTO_H_ struct otruncate_args { char *path; long length; }; #endif /* ARGSUSED */ int otruncate(td, uap) struct thread *td; register struct otruncate_args /* { syscallarg(char *) path; syscallarg(long) length; } */ *uap; { struct truncate_args /* { syscallarg(char *) path; syscallarg(int) pad; syscallarg(off_t) length; } */ nuap; SCARG(&nuap, path) = SCARG(uap, path); SCARG(&nuap, length) = SCARG(uap, length); return (truncate(td, &nuap)); } /* * Truncate a file given a file descriptor. */ #ifndef _SYS_SYSPROTO_H_ struct oftruncate_args { int fd; long length; }; #endif /* ARGSUSED */ int oftruncate(td, uap) struct thread *td; register struct oftruncate_args /* { syscallarg(int) fd; syscallarg(long) length; } */ *uap; { struct ftruncate_args /* { syscallarg(int) fd; syscallarg(int) pad; syscallarg(off_t) length; } */ nuap; SCARG(&nuap, fd) = SCARG(uap, fd); SCARG(&nuap, length) = SCARG(uap, length); return (ftruncate(td, &nuap)); } #endif /* COMPAT_43 || COMPAT_SUNOS */ /* * Sync an open file. */ #ifndef _SYS_SYSPROTO_H_ struct fsync_args { int fd; }; #endif /* ARGSUSED */ int fsync(td, uap) struct thread *td; struct fsync_args /* { syscallarg(int) fd; } */ *uap; { struct vnode *vp; struct mount *mp; struct file *fp; vm_object_t obj; int error; GIANT_REQUIRED; if ((error = getvnode(td->td_proc->p_fd, SCARG(uap, fd), &fp)) != 0) return (error); vp = (struct vnode *)fp->f_data; if ((error = vn_start_write(vp, &mp, V_WAIT | PCATCH)) != 0) { fdrop(fp, td); return (error); } vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); if (VOP_GETVOBJECT(vp, &obj) == 0) { vm_object_page_clean(obj, 0, 0, 0); } error = VOP_FSYNC(vp, fp->f_cred, MNT_WAIT, td); if (error == 0 && vp->v_mount && (vp->v_mount->mnt_flag & MNT_SOFTDEP) && softdep_fsync_hook != NULL) error = (*softdep_fsync_hook)(vp); VOP_UNLOCK(vp, 0, td); vn_finished_write(mp); fdrop(fp, td); return (error); } /* * Rename files. Source and destination must either both be directories, * or both not be directories. If target is a directory, it must be empty. */ #ifndef _SYS_SYSPROTO_H_ struct rename_args { char *from; char *to; }; #endif /* ARGSUSED */ int rename(td, uap) struct thread *td; register struct rename_args /* { syscallarg(char *) from; syscallarg(char *) to; } */ *uap; { return (kern_rename(td, uap->from, uap->to, UIO_USERSPACE)); } int kern_rename(struct thread *td, char *from, char *to, enum uio_seg pathseg) { struct mount *mp; struct vnode *tvp, *fvp, *tdvp; struct nameidata fromnd, tond; int error; bwillwrite(); NDINIT(&fromnd, DELETE, WANTPARENT | SAVESTART, pathseg, from, td); if ((error = namei(&fromnd)) != 0) return (error); fvp = fromnd.ni_vp; if ((error = vn_start_write(fvp, &mp, V_WAIT | PCATCH)) != 0) { NDFREE(&fromnd, NDF_ONLY_PNBUF); vrele(fromnd.ni_dvp); vrele(fvp); goto out1; } NDINIT(&tond, RENAME, LOCKPARENT | LOCKLEAF | NOCACHE | SAVESTART | NOOBJ, pathseg, to, td); if (fromnd.ni_vp->v_type == VDIR) tond.ni_cnd.cn_flags |= WILLBEDIR; if ((error = namei(&tond)) != 0) { /* Translate error code for rename("dir1", "dir2/."). */ if (error == EISDIR && fvp->v_type == VDIR) error = EINVAL; NDFREE(&fromnd, NDF_ONLY_PNBUF); vrele(fromnd.ni_dvp); vrele(fvp); goto out1; } tdvp = tond.ni_dvp; tvp = tond.ni_vp; if (tvp != NULL) { if (fvp->v_type == VDIR && tvp->v_type != VDIR) { error = ENOTDIR; goto out; } else if (fvp->v_type != VDIR && tvp->v_type == VDIR) { error = EISDIR; goto out; } } if (fvp == tdvp) error = EINVAL; /* * If the source is the same as the destination (that is, if they * are links to the same vnode), then there is nothing to do. */ if (fvp == tvp) error = -1; out: if (!error) { VOP_LEASE(tdvp, td, td->td_ucred, LEASE_WRITE); if (fromnd.ni_dvp != tdvp) { VOP_LEASE(fromnd.ni_dvp, td, td->td_ucred, LEASE_WRITE); } if (tvp) { VOP_LEASE(tvp, td, td->td_ucred, LEASE_WRITE); } error = VOP_RENAME(fromnd.ni_dvp, fromnd.ni_vp, &fromnd.ni_cnd, tond.ni_dvp, tond.ni_vp, &tond.ni_cnd); NDFREE(&fromnd, NDF_ONLY_PNBUF); NDFREE(&tond, NDF_ONLY_PNBUF); } else { NDFREE(&fromnd, NDF_ONLY_PNBUF); NDFREE(&tond, NDF_ONLY_PNBUF); if (tdvp == tvp) vrele(tdvp); else vput(tdvp); if (tvp) vput(tvp); vrele(fromnd.ni_dvp); vrele(fvp); } vrele(tond.ni_startdir); vn_finished_write(mp); ASSERT_VOP_UNLOCKED(fromnd.ni_dvp, "rename"); ASSERT_VOP_UNLOCKED(fromnd.ni_vp, "rename"); ASSERT_VOP_UNLOCKED(tond.ni_dvp, "rename"); ASSERT_VOP_UNLOCKED(tond.ni_vp, "rename"); out1: if (fromnd.ni_startdir) vrele(fromnd.ni_startdir); if (error == -1) return (0); return (error); } /* * Make a directory file. */ #ifndef _SYS_SYSPROTO_H_ struct mkdir_args { char *path; int mode; }; #endif /* ARGSUSED */ int mkdir(td, uap) struct thread *td; register struct mkdir_args /* { syscallarg(char *) path; syscallarg(int) mode; } */ *uap; { return (kern_mkdir(td, uap->path, UIO_USERSPACE, uap->mode)); } int kern_mkdir(struct thread *td, char *path, enum uio_seg segflg, int mode) { struct mount *mp; struct vnode *vp; struct vattr vattr; int error; struct nameidata nd; restart: bwillwrite(); NDINIT(&nd, CREATE, LOCKPARENT | SAVENAME, segflg, path, td); nd.ni_cnd.cn_flags |= WILLBEDIR; if ((error = namei(&nd)) != 0) return (error); vp = nd.ni_vp; if (vp != NULL) { NDFREE(&nd, NDF_ONLY_PNBUF); vrele(vp); /* * XXX namei called with LOCKPARENT but not LOCKLEAF has * the strange behaviour of leaving the vnode unlocked * if the target is the same vnode as the parent. */ if (vp == nd.ni_dvp) vrele(nd.ni_dvp); else vput(nd.ni_dvp); return (EEXIST); } if (vn_start_write(nd.ni_dvp, &mp, V_NOWAIT) != 0) { NDFREE(&nd, NDF_ONLY_PNBUF); vput(nd.ni_dvp); if ((error = vn_start_write(NULL, &mp, V_XSLEEP | PCATCH)) != 0) return (error); goto restart; } VATTR_NULL(&vattr); vattr.va_type = VDIR; FILEDESC_LOCK(td->td_proc->p_fd); vattr.va_mode = (mode & ACCESSPERMS) &~ td->td_proc->p_fd->fd_cmask; FILEDESC_UNLOCK(td->td_proc->p_fd); VOP_LEASE(nd.ni_dvp, td, td->td_ucred, LEASE_WRITE); error = VOP_MKDIR(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &vattr); NDFREE(&nd, NDF_ONLY_PNBUF); vput(nd.ni_dvp); if (!error) vput(nd.ni_vp); vn_finished_write(mp); ASSERT_VOP_UNLOCKED(nd.ni_dvp, "mkdir"); ASSERT_VOP_UNLOCKED(nd.ni_vp, "mkdir"); return (error); } /* * Remove a directory file. */ #ifndef _SYS_SYSPROTO_H_ struct rmdir_args { char *path; }; #endif /* ARGSUSED */ int rmdir(td, uap) struct thread *td; struct rmdir_args /* { syscallarg(char *) path; } */ *uap; { return (kern_rmdir(td, uap->path, UIO_USERSPACE)); } int kern_rmdir(struct thread *td, char *path, enum uio_seg pathseg) { struct mount *mp; struct vnode *vp; int error; struct nameidata nd; restart: bwillwrite(); NDINIT(&nd, DELETE, LOCKPARENT | LOCKLEAF, pathseg, path, td); if ((error = namei(&nd)) != 0) return (error); vp = nd.ni_vp; if (vp->v_type != VDIR) { error = ENOTDIR; goto out; } /* * No rmdir "." please. */ if (nd.ni_dvp == vp) { error = EINVAL; goto out; } /* * The root of a mounted filesystem cannot be deleted. */ if (vp->v_vflag & VV_ROOT) { error = EBUSY; goto out; } if (vn_start_write(nd.ni_dvp, &mp, V_NOWAIT) != 0) { NDFREE(&nd, NDF_ONLY_PNBUF); if (nd.ni_dvp == vp) vrele(nd.ni_dvp); else vput(nd.ni_dvp); vput(vp); if ((error = vn_start_write(NULL, &mp, V_XSLEEP | PCATCH)) != 0) return (error); goto restart; } VOP_LEASE(nd.ni_dvp, td, td->td_ucred, LEASE_WRITE); VOP_LEASE(vp, td, td->td_ucred, LEASE_WRITE); error = VOP_RMDIR(nd.ni_dvp, nd.ni_vp, &nd.ni_cnd); vn_finished_write(mp); out: NDFREE(&nd, NDF_ONLY_PNBUF); if (nd.ni_dvp == vp) vrele(nd.ni_dvp); else vput(nd.ni_dvp); vput(vp); ASSERT_VOP_UNLOCKED(nd.ni_dvp, "rmdir"); ASSERT_VOP_UNLOCKED(nd.ni_vp, "rmdir"); return (error); } #ifdef COMPAT_43 /* * Read a block of directory entries in a filesystem independent format. */ #ifndef _SYS_SYSPROTO_H_ struct ogetdirentries_args { int fd; char *buf; u_int count; long *basep; }; #endif int ogetdirentries(td, uap) struct thread *td; register struct ogetdirentries_args /* { syscallarg(int) fd; syscallarg(char *) buf; syscallarg(u_int) count; syscallarg(long *) basep; } */ *uap; { struct vnode *vp; struct file *fp; struct uio auio, kuio; struct iovec aiov, kiov; struct dirent *dp, *edp; caddr_t dirbuf; int error, eofflag, readcnt; long loff; /* XXX arbitrary sanity limit on `count'. */ if (SCARG(uap, count) > 64 * 1024) return (EINVAL); if ((error = getvnode(td->td_proc->p_fd, SCARG(uap, fd), &fp)) != 0) return (error); if ((fp->f_flag & FREAD) == 0) { fdrop(fp, td); return (EBADF); } vp = (struct vnode *)fp->f_data; unionread: if (vp->v_type != VDIR) { fdrop(fp, td); return (EINVAL); } aiov.iov_base = SCARG(uap, buf); aiov.iov_len = SCARG(uap, count); auio.uio_iov = &aiov; auio.uio_iovcnt = 1; auio.uio_rw = UIO_READ; auio.uio_segflg = UIO_USERSPACE; auio.uio_td = td; auio.uio_resid = SCARG(uap, count); vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); loff = auio.uio_offset = fp->f_offset; #ifdef MAC error = mac_check_vnode_readdir(td->td_ucred, vp); if (error) { VOP_UNLOCK(vp, 0, td); fdrop(fp, td); return (error); } #endif # if (BYTE_ORDER != LITTLE_ENDIAN) if (vp->v_mount->mnt_maxsymlinklen <= 0) { error = VOP_READDIR(vp, &auio, fp->f_cred, &eofflag, NULL, NULL); fp->f_offset = auio.uio_offset; } else # endif { kuio = auio; kuio.uio_iov = &kiov; kuio.uio_segflg = UIO_SYSSPACE; kiov.iov_len = SCARG(uap, count); MALLOC(dirbuf, caddr_t, SCARG(uap, count), M_TEMP, M_WAITOK); kiov.iov_base = dirbuf; error = VOP_READDIR(vp, &kuio, fp->f_cred, &eofflag, NULL, NULL); fp->f_offset = kuio.uio_offset; if (error == 0) { readcnt = SCARG(uap, count) - kuio.uio_resid; edp = (struct dirent *)&dirbuf[readcnt]; for (dp = (struct dirent *)dirbuf; dp < edp; ) { # if (BYTE_ORDER == LITTLE_ENDIAN) /* * The expected low byte of * dp->d_namlen is our dp->d_type. * The high MBZ byte of dp->d_namlen * is our dp->d_namlen. */ dp->d_type = dp->d_namlen; dp->d_namlen = 0; # else /* * The dp->d_type is the high byte * of the expected dp->d_namlen, * so must be zero'ed. */ dp->d_type = 0; # endif if (dp->d_reclen > 0) { dp = (struct dirent *) ((char *)dp + dp->d_reclen); } else { error = EIO; break; } } if (dp >= edp) error = uiomove(dirbuf, readcnt, &auio); } FREE(dirbuf, M_TEMP); } VOP_UNLOCK(vp, 0, td); if (error) { fdrop(fp, td); return (error); } if (SCARG(uap, count) == auio.uio_resid) { if (union_dircheckp) { error = union_dircheckp(td, &vp, fp); if (error == -1) goto unionread; if (error) { fdrop(fp, td); return (error); } } /* * XXX We could delay dropping the lock above but * union_dircheckp complicates things. */ vn_lock(vp, LK_EXCLUSIVE|LK_RETRY, td); if ((vp->v_vflag & VV_ROOT) && (vp->v_mount->mnt_flag & MNT_UNION)) { struct vnode *tvp = vp; vp = vp->v_mount->mnt_vnodecovered; VREF(vp); fp->f_data = vp; fp->f_offset = 0; vput(tvp); goto unionread; } VOP_UNLOCK(vp, 0, td); } error = copyout(&loff, SCARG(uap, basep), sizeof(long)); fdrop(fp, td); td->td_retval[0] = SCARG(uap, count) - auio.uio_resid; return (error); } #endif /* COMPAT_43 */ /* * Read a block of directory entries in a filesystem independent format. */ #ifndef _SYS_SYSPROTO_H_ struct getdirentries_args { int fd; char *buf; u_int count; long *basep; }; #endif int getdirentries(td, uap) struct thread *td; register struct getdirentries_args /* { syscallarg(int) fd; syscallarg(char *) buf; syscallarg(u_int) count; syscallarg(long *) basep; } */ *uap; { struct vnode *vp; struct file *fp; struct uio auio; struct iovec aiov; long loff; int error, eofflag; if ((error = getvnode(td->td_proc->p_fd, SCARG(uap, fd), &fp)) != 0) return (error); if ((fp->f_flag & FREAD) == 0) { fdrop(fp, td); return (EBADF); } vp = (struct vnode *)fp->f_data; unionread: if (vp->v_type != VDIR) { fdrop(fp, td); return (EINVAL); } aiov.iov_base = SCARG(uap, buf); aiov.iov_len = SCARG(uap, count); auio.uio_iov = &aiov; auio.uio_iovcnt = 1; auio.uio_rw = UIO_READ; auio.uio_segflg = UIO_USERSPACE; auio.uio_td = td; auio.uio_resid = SCARG(uap, count); /* vn_lock(vp, LK_SHARED | LK_RETRY, td); */ vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); loff = auio.uio_offset = fp->f_offset; #ifdef MAC error = mac_check_vnode_readdir(td->td_ucred, vp); if (error == 0) #endif error = VOP_READDIR(vp, &auio, fp->f_cred, &eofflag, NULL, NULL); fp->f_offset = auio.uio_offset; VOP_UNLOCK(vp, 0, td); if (error) { fdrop(fp, td); return (error); } if (SCARG(uap, count) == auio.uio_resid) { if (union_dircheckp) { error = union_dircheckp(td, &vp, fp); if (error == -1) goto unionread; if (error) { fdrop(fp, td); return (error); } } /* * XXX We could delay dropping the lock above but * union_dircheckp complicates things. */ vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); if ((vp->v_vflag & VV_ROOT) && (vp->v_mount->mnt_flag & MNT_UNION)) { struct vnode *tvp = vp; vp = vp->v_mount->mnt_vnodecovered; VREF(vp); fp->f_data = vp; fp->f_offset = 0; vput(tvp); goto unionread; } VOP_UNLOCK(vp, 0, td); } if (SCARG(uap, basep) != NULL) { error = copyout(&loff, SCARG(uap, basep), sizeof(long)); } td->td_retval[0] = SCARG(uap, count) - auio.uio_resid; fdrop(fp, td); return (error); } #ifndef _SYS_SYSPROTO_H_ struct getdents_args { int fd; char *buf; size_t count; }; #endif int getdents(td, uap) struct thread *td; register struct getdents_args /* { syscallarg(int) fd; syscallarg(char *) buf; syscallarg(u_int) count; } */ *uap; { struct getdirentries_args ap; ap.fd = uap->fd; ap.buf = uap->buf; ap.count = uap->count; ap.basep = NULL; return getdirentries(td, &ap); } /* * Set the mode mask for creation of filesystem nodes. * * MP SAFE */ #ifndef _SYS_SYSPROTO_H_ struct umask_args { int newmask; }; #endif int umask(td, uap) struct thread *td; struct umask_args /* { syscallarg(int) newmask; } */ *uap; { register struct filedesc *fdp; FILEDESC_LOCK(td->td_proc->p_fd); fdp = td->td_proc->p_fd; td->td_retval[0] = fdp->fd_cmask; fdp->fd_cmask = SCARG(uap, newmask) & ALLPERMS; FILEDESC_UNLOCK(td->td_proc->p_fd); return (0); } /* * Void all references to file by ripping underlying filesystem * away from vnode. */ #ifndef _SYS_SYSPROTO_H_ struct revoke_args { char *path; }; #endif /* ARGSUSED */ int revoke(td, uap) struct thread *td; register struct revoke_args /* { syscallarg(char *) path; } */ *uap; { struct mount *mp; struct vnode *vp; struct vattr vattr; int error; struct nameidata nd; NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF, UIO_USERSPACE, SCARG(uap, path), td); if ((error = namei(&nd)) != 0) return (error); vp = nd.ni_vp; NDFREE(&nd, NDF_ONLY_PNBUF); if (vp->v_type != VCHR) { vput(vp); return (EINVAL); } #ifdef MAC error = mac_check_vnode_revoke(td->td_ucred, vp); if (error) { vput(vp); return (error); } #endif error = VOP_GETATTR(vp, &vattr, td->td_ucred, td); if (error) { vput(vp); return (error); } VOP_UNLOCK(vp, 0, td); if (td->td_ucred->cr_uid != vattr.va_uid) { error = suser_cred(td->td_ucred, PRISON_ROOT); if (error) goto out; } if ((error = vn_start_write(vp, &mp, V_WAIT | PCATCH)) != 0) goto out; if (vcount(vp) > 1) VOP_REVOKE(vp, REVOKEALL); vn_finished_write(mp); out: vrele(vp); return (error); } /* * Convert a user file descriptor to a kernel file entry. * The file entry is locked upon returning. */ int getvnode(fdp, fd, fpp) struct filedesc *fdp; int fd; struct file **fpp; { int error; struct file *fp; fp = NULL; if (fdp == NULL) error = EBADF; else { FILEDESC_LOCK(fdp); if ((u_int)fd >= fdp->fd_nfiles || (fp = fdp->fd_ofiles[fd]) == NULL) error = EBADF; else if (fp->f_type != DTYPE_VNODE && fp->f_type != DTYPE_FIFO) { fp = NULL; error = EINVAL; } else { fhold(fp); error = 0; } FILEDESC_UNLOCK(fdp); } *fpp = fp; return (error); } /* * Get (NFS) file handle */ #ifndef _SYS_SYSPROTO_H_ struct getfh_args { char *fname; fhandle_t *fhp; }; #endif int getfh(td, uap) struct thread *td; register struct getfh_args *uap; { struct nameidata nd; fhandle_t fh; register struct vnode *vp; int error; /* * Must be super user */ error = suser(td); if (error) return (error); NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF, UIO_USERSPACE, uap->fname, td); error = namei(&nd); if (error) return (error); NDFREE(&nd, NDF_ONLY_PNBUF); vp = nd.ni_vp; bzero(&fh, sizeof(fh)); fh.fh_fsid = vp->v_mount->mnt_stat.f_fsid; error = VFS_VPTOFH(vp, &fh.fh_fid); vput(vp); if (error) return (error); error = copyout(&fh, uap->fhp, sizeof (fh)); return (error); } /* * syscall for the rpc.lockd to use to translate a NFS file handle into * an open descriptor. * * warning: do not remove the suser() call or this becomes one giant * security hole. */ #ifndef _SYS_SYSPROTO_H_ struct fhopen_args { const struct fhandle *u_fhp; int flags; }; #endif int fhopen(td, uap) struct thread *td; struct fhopen_args /* { syscallarg(const struct fhandle *) u_fhp; syscallarg(int) flags; } */ *uap; { struct proc *p = td->td_proc; struct mount *mp; struct vnode *vp; struct fhandle fhp; struct vattr vat; struct vattr *vap = &vat; struct flock lf; struct file *fp; register struct filedesc *fdp = p->p_fd; int fmode, mode, error, type; struct file *nfp; int indx; /* * Must be super user */ error = suser(td); if (error) return (error); fmode = FFLAGS(SCARG(uap, flags)); /* why not allow a non-read/write open for our lockd? */ if (((fmode & (FREAD | FWRITE)) == 0) || (fmode & O_CREAT)) return (EINVAL); error = copyin(SCARG(uap,u_fhp), &fhp, sizeof(fhp)); if (error) return(error); /* find the mount point */ mp = vfs_getvfs(&fhp.fh_fsid); if (mp == NULL) return (ESTALE); /* now give me my vnode, it gets returned to me locked */ error = VFS_FHTOVP(mp, &fhp.fh_fid, &vp); if (error) return (error); /* * from now on we have to make sure not * to forget about the vnode * any error that causes an abort must vput(vp) * just set error = err and 'goto bad;'. */ /* * from vn_open */ if (vp->v_type == VLNK) { error = EMLINK; goto bad; } if (vp->v_type == VSOCK) { error = EOPNOTSUPP; goto bad; } mode = 0; if (fmode & (FWRITE | O_TRUNC)) { if (vp->v_type == VDIR) { error = EISDIR; goto bad; } error = vn_writechk(vp); if (error) goto bad; mode |= VWRITE; } if (fmode & FREAD) mode |= VREAD; if (fmode & O_APPEND) mode |= VAPPEND; #ifdef MAC error = mac_check_vnode_open(td->td_ucred, vp, mode); if (error) goto bad; #endif if (mode) { error = VOP_ACCESS(vp, mode, td->td_ucred, td); if (error) goto bad; } if (fmode & O_TRUNC) { VOP_UNLOCK(vp, 0, td); /* XXX */ if ((error = vn_start_write(NULL, &mp, V_WAIT | PCATCH)) != 0) { vrele(vp); return (error); } VOP_LEASE(vp, td, td->td_ucred, LEASE_WRITE); vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); /* XXX */ #ifdef MAC /* * We don't yet have fp->f_cred, so use td->td_ucred, which * should be right. */ error = mac_check_vnode_write(td->td_ucred, td->td_ucred, vp); if (error == 0) { #endif VATTR_NULL(vap); vap->va_size = 0; error = VOP_SETATTR(vp, vap, td->td_ucred, td); #ifdef MAC } #endif vn_finished_write(mp); if (error) goto bad; } error = VOP_OPEN(vp, fmode, td->td_ucred, td); if (error) goto bad; /* * Make sure that a VM object is created for VMIO support. */ if (vn_canvmio(vp) == TRUE) { if ((error = vfs_object_create(vp, td, td->td_ucred)) != 0) goto bad; } if (fmode & FWRITE) vp->v_writecount++; /* * end of vn_open code */ if ((error = falloc(td, &nfp, &indx)) != 0) { if (fmode & FWRITE) vp->v_writecount--; goto bad; } fp = nfp; /* * Hold an extra reference to avoid having fp ripped out * from under us while we block in the lock op */ fhold(fp); nfp->f_data = vp; nfp->f_flag = fmode & FMASK; nfp->f_ops = &vnops; nfp->f_type = DTYPE_VNODE; if (fmode & (O_EXLOCK | O_SHLOCK)) { lf.l_whence = SEEK_SET; lf.l_start = 0; lf.l_len = 0; if (fmode & O_EXLOCK) lf.l_type = F_WRLCK; else lf.l_type = F_RDLCK; type = F_FLOCK; if ((fmode & FNONBLOCK) == 0) type |= F_WAIT; VOP_UNLOCK(vp, 0, td); if ((error = VOP_ADVLOCK(vp, (caddr_t)fp, F_SETLK, &lf, type)) != 0) { /* * The lock request failed. Normally close the * descriptor but handle the case where someone might * have dup()d or close()d it when we weren't looking. */ FILEDESC_LOCK(fdp); if (fdp->fd_ofiles[indx] == fp) { fdp->fd_ofiles[indx] = NULL; FILEDESC_UNLOCK(fdp); fdrop(fp, td); } else FILEDESC_UNLOCK(fdp); /* * release our private reference */ fdrop(fp, td); return(error); } vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); fp->f_flag |= FHASLOCK; } if ((vp->v_type == VREG) && (VOP_GETVOBJECT(vp, NULL) != 0)) vfs_object_create(vp, td, td->td_ucred); VOP_UNLOCK(vp, 0, td); fdrop(fp, td); td->td_retval[0] = indx; return (0); bad: vput(vp); return (error); } /* * Stat an (NFS) file handle. */ #ifndef _SYS_SYSPROTO_H_ struct fhstat_args { struct fhandle *u_fhp; struct stat *sb; }; #endif int fhstat(td, uap) struct thread *td; register struct fhstat_args /* { syscallarg(struct fhandle *) u_fhp; syscallarg(struct stat *) sb; } */ *uap; { struct stat sb; fhandle_t fh; struct mount *mp; struct vnode *vp; int error; /* * Must be super user */ error = suser(td); if (error) return (error); error = copyin(SCARG(uap, u_fhp), &fh, sizeof(fhandle_t)); if (error) return (error); if ((mp = vfs_getvfs(&fh.fh_fsid)) == NULL) return (ESTALE); if ((error = VFS_FHTOVP(mp, &fh.fh_fid, &vp))) return (error); error = vn_stat(vp, &sb, td->td_ucred, NOCRED, td); vput(vp); if (error) return (error); error = copyout(&sb, SCARG(uap, sb), sizeof(sb)); return (error); } /* * Implement fstatfs() for (NFS) file handles. */ #ifndef _SYS_SYSPROTO_H_ struct fhstatfs_args { struct fhandle *u_fhp; struct statfs *buf; }; #endif int fhstatfs(td, uap) struct thread *td; struct fhstatfs_args /* { syscallarg(struct fhandle) *u_fhp; syscallarg(struct statfs) *buf; } */ *uap; { struct statfs *sp; struct mount *mp; struct vnode *vp; struct statfs sb; fhandle_t fh; int error; /* * Must be super user */ error = suser(td); if (error) return (error); if ((error = copyin(SCARG(uap, u_fhp), &fh, sizeof(fhandle_t))) != 0) return (error); if ((mp = vfs_getvfs(&fh.fh_fsid)) == NULL) return (ESTALE); if ((error = VFS_FHTOVP(mp, &fh.fh_fid, &vp))) return (error); mp = vp->v_mount; sp = &mp->mnt_stat; vput(vp); #ifdef MAC error = mac_check_mount_stat(td->td_ucred, mp); if (error) return (error); #endif if ((error = VFS_STATFS(mp, sp, td)) != 0) return (error); sp->f_flags = mp->mnt_flag & MNT_VISFLAGMASK; if (suser(td)) { bcopy(sp, &sb, sizeof(sb)); sb.f_fsid.val[0] = sb.f_fsid.val[1] = 0; sp = &sb; } return (copyout(sp, SCARG(uap, buf), sizeof(*sp))); } /* * Syscall to push extended attribute configuration information into the * VFS. Accepts a path, which it converts to a mountpoint, as well as * a command (int cmd), and attribute name and misc data. For now, the * attribute name is left in userspace for consumption by the VFS_op. * It will probably be changed to be copied into sysspace by the * syscall in the future, once issues with various consumers of the * attribute code have raised their hands. * * Currently this is used only by UFS Extended Attributes. */ int extattrctl(td, uap) struct thread *td; struct extattrctl_args /* { syscallarg(const char *) path; syscallarg(int) cmd; syscallarg(const char *) filename; syscallarg(int) attrnamespace; syscallarg(const char *) attrname; } */ *uap; { struct vnode *filename_vp; struct nameidata nd; struct mount *mp, *mp_writable; char attrname[EXTATTR_MAXNAMELEN]; int error; /* * uap->attrname is not always defined. We check again later when we * invoke the VFS call so as to pass in NULL there if needed. */ if (uap->attrname != NULL) { error = copyinstr(uap->attrname, attrname, EXTATTR_MAXNAMELEN, NULL); if (error) return (error); } /* * uap->filename is not always defined. If it is, grab a vnode lock, * which VFS_EXTATTRCTL() will later release. */ filename_vp = NULL; if (uap->filename != NULL) { NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF, UIO_USERSPACE, uap->filename, td); if ((error = namei(&nd)) != 0) return (error); filename_vp = nd.ni_vp; NDFREE(&nd, NDF_NO_VP_RELE | NDF_NO_VP_UNLOCK); } /* uap->path is always defined. */ NDINIT(&nd, LOOKUP, FOLLOW, UIO_USERSPACE, uap->path, td); if ((error = namei(&nd)) != 0) { if (filename_vp != NULL) vput(filename_vp); return (error); } mp = nd.ni_vp->v_mount; error = vn_start_write(nd.ni_vp, &mp_writable, V_WAIT | PCATCH); NDFREE(&nd, 0); if (error) { if (filename_vp != NULL) vput(filename_vp); return (error); } error = VFS_EXTATTRCTL(mp, uap->cmd, filename_vp, uap->attrnamespace, uap->attrname != NULL ? attrname : NULL, td); vn_finished_write(mp_writable); /* * VFS_EXTATTRCTL will have unlocked, but not de-ref'd, * filename_vp, so vrele it if it is defined. */ if (filename_vp != NULL) vrele(filename_vp); return (error); } /*- * Set a named extended attribute on a file or directory * * Arguments: unlocked vnode "vp", attribute namespace "attrnamespace", * kernelspace string pointer "attrname", userspace buffer * pointer "data", buffer length "nbytes", thread "td". * Returns: 0 on success, an error number otherwise * Locks: none * References: vp must be a valid reference for the duration of the call */ static int extattr_set_vp(struct vnode *vp, int attrnamespace, const char *attrname, void *data, size_t nbytes, struct thread *td) { struct mount *mp; struct uio auio; struct iovec aiov; ssize_t cnt; int error; if ((error = vn_start_write(vp, &mp, V_WAIT | PCATCH)) != 0) return (error); VOP_LEASE(vp, td, td->td_ucred, LEASE_WRITE); vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); aiov.iov_base = data; aiov.iov_len = nbytes; auio.uio_iov = &aiov; auio.uio_iovcnt = 1; auio.uio_offset = 0; if (nbytes > INT_MAX) { error = EINVAL; goto done; } auio.uio_resid = nbytes; auio.uio_rw = UIO_WRITE; auio.uio_segflg = UIO_USERSPACE; auio.uio_td = td; cnt = nbytes; #ifdef MAC error = mac_check_vnode_setextattr(td->td_ucred, vp, attrnamespace, attrname, &auio); if (error) goto done; #endif error = VOP_SETEXTATTR(vp, attrnamespace, attrname, &auio, td->td_ucred, td); cnt -= auio.uio_resid; td->td_retval[0] = cnt; done: VOP_UNLOCK(vp, 0, td); vn_finished_write(mp); return (error); } int extattr_set_file(td, uap) struct thread *td; struct extattr_set_file_args /* { syscallarg(const char *) path; syscallarg(int) attrnamespace; syscallarg(const char *) attrname; syscallarg(void *) data; syscallarg(size_t) nbytes; } */ *uap; { struct nameidata nd; char attrname[EXTATTR_MAXNAMELEN]; int error; error = copyinstr(uap->attrname, attrname, EXTATTR_MAXNAMELEN, NULL); if (error) return (error); NDINIT(&nd, LOOKUP, FOLLOW, UIO_USERSPACE, uap->path, td); if ((error = namei(&nd)) != 0) return (error); NDFREE(&nd, NDF_ONLY_PNBUF); error = extattr_set_vp(nd.ni_vp, uap->attrnamespace, attrname, uap->data, uap->nbytes, td); vrele(nd.ni_vp); return (error); } int extattr_set_fd(td, uap) struct thread *td; struct extattr_set_fd_args /* { syscallarg(int) fd; syscallarg(int) attrnamespace; syscallarg(const char *) attrname; syscallarg(void *) data; syscallarg(size_t) nbytes; } */ *uap; { struct file *fp; char attrname[EXTATTR_MAXNAMELEN]; int error; error = copyinstr(uap->attrname, attrname, EXTATTR_MAXNAMELEN, NULL); if (error) return (error); if ((error = getvnode(td->td_proc->p_fd, uap->fd, &fp)) != 0) return (error); error = extattr_set_vp((struct vnode *)fp->f_data, uap->attrnamespace, attrname, uap->data, uap->nbytes, td); fdrop(fp, td); return (error); } /*- * Get a named extended attribute on a file or directory * * Arguments: unlocked vnode "vp", attribute namespace "attrnamespace", * kernelspace string pointer "attrname", userspace buffer * pointer "data", buffer length "nbytes", thread "td". * Returns: 0 on success, an error number otherwise * Locks: none * References: vp must be a valid reference for the duration of the call */ static int extattr_get_vp(struct vnode *vp, int attrnamespace, const char *attrname, void *data, size_t nbytes, struct thread *td) { struct uio auio, *auiop; struct iovec aiov; ssize_t cnt; size_t size, *sizep; int error; VOP_LEASE(vp, td, td->td_ucred, LEASE_READ); vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); /* * Slightly unusual semantics: if the user provides a NULL data * pointer, they don't want to receive the data, just the * maximum read length. */ auiop = NULL; sizep = NULL; cnt = 0; if (data != NULL) { aiov.iov_base = data; aiov.iov_len = nbytes; auio.uio_iov = &aiov; auio.uio_offset = 0; if (nbytes > INT_MAX) { error = EINVAL; goto done; } auio.uio_resid = nbytes; auio.uio_rw = UIO_READ; auio.uio_segflg = UIO_USERSPACE; auio.uio_td = td; auiop = &auio; cnt = nbytes; } else sizep = &size; #ifdef MAC error = mac_check_vnode_getextattr(td->td_ucred, vp, attrnamespace, attrname, &auio); if (error) goto done; #endif error = VOP_GETEXTATTR(vp, attrnamespace, attrname, auiop, sizep, td->td_ucred, td); if (auiop != NULL) { cnt -= auio.uio_resid; td->td_retval[0] = cnt; } else td->td_retval[0] = size; done: VOP_UNLOCK(vp, 0, td); return (error); } int extattr_get_file(td, uap) struct thread *td; struct extattr_get_file_args /* { syscallarg(const char *) path; syscallarg(int) attrnamespace; syscallarg(const char *) attrname; syscallarg(void *) data; syscallarg(size_t) nbytes; } */ *uap; { struct nameidata nd; char attrname[EXTATTR_MAXNAMELEN]; int error; error = copyinstr(uap->attrname, attrname, EXTATTR_MAXNAMELEN, NULL); if (error) return (error); NDINIT(&nd, LOOKUP, FOLLOW, UIO_USERSPACE, uap->path, td); if ((error = namei(&nd)) != 0) return (error); NDFREE(&nd, NDF_ONLY_PNBUF); error = extattr_get_vp(nd.ni_vp, uap->attrnamespace, attrname, uap->data, uap->nbytes, td); vrele(nd.ni_vp); return (error); } int extattr_get_fd(td, uap) struct thread *td; struct extattr_get_fd_args /* { syscallarg(int) fd; syscallarg(int) attrnamespace; syscallarg(const char *) attrname; syscallarg(void *) data; syscallarg(size_t) nbytes; } */ *uap; { struct file *fp; char attrname[EXTATTR_MAXNAMELEN]; int error; error = copyinstr(uap->attrname, attrname, EXTATTR_MAXNAMELEN, NULL); if (error) return (error); if ((error = getvnode(td->td_proc->p_fd, uap->fd, &fp)) != 0) return (error); error = extattr_get_vp((struct vnode *)fp->f_data, uap->attrnamespace, attrname, uap->data, uap->nbytes, td); fdrop(fp, td); return (error); } /* * extattr_delete_vp(): Delete a named extended attribute on a file or * directory * * Arguments: unlocked vnode "vp", attribute namespace "attrnamespace", * kernelspace string pointer "attrname", proc "p" * Returns: 0 on success, an error number otherwise * Locks: none * References: vp must be a valid reference for the duration of the call */ static int extattr_delete_vp(struct vnode *vp, int attrnamespace, const char *attrname, struct thread *td) { struct mount *mp; int error; if ((error = vn_start_write(vp, &mp, V_WAIT | PCATCH)) != 0) return (error); VOP_LEASE(vp, td, td->td_ucred, LEASE_WRITE); vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); #ifdef MAC error = mac_check_vnode_setextattr(td->td_ucred, vp, attrnamespace, attrname, NULL); #endif error = VOP_SETEXTATTR(vp, attrnamespace, attrname, NULL, td->td_ucred, td); VOP_UNLOCK(vp, 0, td); vn_finished_write(mp); return (error); } int extattr_delete_file(td, uap) struct thread *td; struct extattr_delete_file_args /* { syscallarg(const char *) path; syscallarg(int) attrnamespace; syscallarg(const char *) attrname; } */ *uap; { struct nameidata nd; char attrname[EXTATTR_MAXNAMELEN]; int error; error = copyinstr(uap->attrname, attrname, EXTATTR_MAXNAMELEN, NULL); if (error) return(error); NDINIT(&nd, LOOKUP, FOLLOW, UIO_USERSPACE, uap->path, td); if ((error = namei(&nd)) != 0) return(error); NDFREE(&nd, NDF_ONLY_PNBUF); error = extattr_delete_vp(nd.ni_vp, uap->attrnamespace, attrname, td); vrele(nd.ni_vp); return(error); } int extattr_delete_fd(td, uap) struct thread *td; struct extattr_delete_fd_args /* { syscallarg(int) fd; syscallarg(int) attrnamespace; syscallarg(const char *) attrname; } */ *uap; { struct file *fp; struct vnode *vp; char attrname[EXTATTR_MAXNAMELEN]; int error; error = copyinstr(uap->attrname, attrname, EXTATTR_MAXNAMELEN, NULL); if (error) return (error); if ((error = getvnode(td->td_proc->p_fd, uap->fd, &fp)) != 0) return (error); vp = (struct vnode *)fp->f_data; error = extattr_delete_vp(vp, uap->attrnamespace, attrname, td); fdrop(fp, td); return (error); } Index: head/sys/kern/vfs_syscalls.c =================================================================== --- head/sys/kern/vfs_syscalls.c (revision 104528) +++ head/sys/kern/vfs_syscalls.c (revision 104529) @@ -1,4114 +1,4119 @@ /* * Copyright (c) 1989, 1993 * The Regents of the University of California. All rights reserved. * (c) UNIX System Laboratories, Inc. * All or some portions of this file are derived from material licensed * to the University of California by American Telephone and Telegraph * Co. or Unix System Laboratories, Inc. and are reproduced herein with * the permission of UNIX System Laboratories, Inc. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * 3. All advertising materials mentioning features or use of this software * must display the following acknowledgement: * This product includes software developed by the University of * California, Berkeley and its contributors. * 4. Neither the name of the University nor the names of its contributors * may be used to endorse or promote products derived from this software * without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. * * @(#)vfs_syscalls.c 8.13 (Berkeley) 4/15/94 * $FreeBSD$ */ /* For 4.3 integer FS ID compatibility */ #include "opt_compat.h" #include "opt_mac.h" #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include static int change_dir(struct nameidata *ndp, struct thread *td); static int chroot_refuse_vdir_fds(struct filedesc *fdp); static int getutimes(const struct timeval *, enum uio_seg, struct timespec *); static int setfown(struct thread *td, struct vnode *, uid_t, gid_t); static int setfmode(struct thread *td, struct vnode *, int); static int setfflags(struct thread *td, struct vnode *, int); static int setutimes(struct thread *td, struct vnode *, const struct timespec *, int, int); static int vn_access(struct vnode *vp, int user_flags, struct ucred *cred, struct thread *td); int (*union_dircheckp)(struct thread *td, struct vnode **, struct file *); int (*softdep_fsync_hook)(struct vnode *); /* * Sync each mounted filesystem. */ #ifndef _SYS_SYSPROTO_H_ struct sync_args { int dummy; }; #endif #ifdef DEBUG static int syncprt = 0; SYSCTL_INT(_debug, OID_AUTO, syncprt, CTLFLAG_RW, &syncprt, 0, ""); #endif /* ARGSUSED */ int sync(td, uap) struct thread *td; struct sync_args *uap; { struct mount *mp, *nmp; int asyncflag; mtx_lock(&mountlist_mtx); for (mp = TAILQ_FIRST(&mountlist); mp != NULL; mp = nmp) { if (vfs_busy(mp, LK_NOWAIT, &mountlist_mtx, td)) { nmp = TAILQ_NEXT(mp, mnt_list); continue; } if ((mp->mnt_flag & MNT_RDONLY) == 0 && vn_start_write(NULL, &mp, V_NOWAIT) == 0) { asyncflag = mp->mnt_flag & MNT_ASYNC; mp->mnt_flag &= ~MNT_ASYNC; vfs_msync(mp, MNT_NOWAIT); VFS_SYNC(mp, MNT_NOWAIT, ((td != NULL) ? td->td_ucred : NOCRED), td); mp->mnt_flag |= asyncflag; vn_finished_write(mp); } mtx_lock(&mountlist_mtx); nmp = TAILQ_NEXT(mp, mnt_list); vfs_unbusy(mp, td); } mtx_unlock(&mountlist_mtx); #if 0 /* * XXX don't call vfs_bufstats() yet because that routine * was not imported in the Lite2 merge. */ #ifdef DIAGNOSTIC if (syncprt) vfs_bufstats(); #endif /* DIAGNOSTIC */ #endif return (0); } /* XXX PRISON: could be per prison flag */ static int prison_quotas; #if 0 SYSCTL_INT(_kern_prison, OID_AUTO, quotas, CTLFLAG_RW, &prison_quotas, 0, ""); #endif /* * Change filesystem quotas. */ #ifndef _SYS_SYSPROTO_H_ struct quotactl_args { char *path; int cmd; int uid; caddr_t arg; }; #endif /* ARGSUSED */ int quotactl(td, uap) struct thread *td; register struct quotactl_args /* { syscallarg(char *) path; syscallarg(int) cmd; syscallarg(int) uid; syscallarg(caddr_t) arg; } */ *uap; { struct mount *mp; int error; struct nameidata nd; if (jailed(td->td_ucred) && !prison_quotas) return (EPERM); NDINIT(&nd, LOOKUP, FOLLOW, UIO_USERSPACE, SCARG(uap, path), td); if ((error = namei(&nd)) != 0) return (error); NDFREE(&nd, NDF_ONLY_PNBUF); error = vn_start_write(nd.ni_vp, &mp, V_WAIT | PCATCH); vrele(nd.ni_vp); if (error) return (error); error = VFS_QUOTACTL(mp, SCARG(uap, cmd), SCARG(uap, uid), SCARG(uap, arg), td); vn_finished_write(mp); return (error); } /* * Get filesystem statistics. */ #ifndef _SYS_SYSPROTO_H_ struct statfs_args { char *path; struct statfs *buf; }; #endif /* ARGSUSED */ int statfs(td, uap) struct thread *td; register struct statfs_args /* { syscallarg(char *) path; syscallarg(struct statfs *) buf; } */ *uap; { register struct mount *mp; register struct statfs *sp; int error; struct nameidata nd; struct statfs sb; NDINIT(&nd, LOOKUP, FOLLOW, UIO_USERSPACE, SCARG(uap, path), td); if ((error = namei(&nd)) != 0) return (error); mp = nd.ni_vp->v_mount; sp = &mp->mnt_stat; NDFREE(&nd, NDF_ONLY_PNBUF); vrele(nd.ni_vp); #ifdef MAC error = mac_check_mount_stat(td->td_ucred, mp); if (error) return (error); #endif error = VFS_STATFS(mp, sp, td); if (error) return (error); sp->f_flags = mp->mnt_flag & MNT_VISFLAGMASK; if (suser(td)) { bcopy(sp, &sb, sizeof(sb)); sb.f_fsid.val[0] = sb.f_fsid.val[1] = 0; sp = &sb; } return (copyout(sp, SCARG(uap, buf), sizeof(*sp))); } /* * Get filesystem statistics. */ #ifndef _SYS_SYSPROTO_H_ struct fstatfs_args { int fd; struct statfs *buf; }; #endif /* ARGSUSED */ int fstatfs(td, uap) struct thread *td; register struct fstatfs_args /* { syscallarg(int) fd; syscallarg(struct statfs *) buf; } */ *uap; { struct file *fp; struct mount *mp; register struct statfs *sp; int error; struct statfs sb; if ((error = getvnode(td->td_proc->p_fd, SCARG(uap, fd), &fp)) != 0) return (error); mp = ((struct vnode *)fp->f_data)->v_mount; fdrop(fp, td); if (mp == NULL) return (EBADF); #ifdef MAC error = mac_check_mount_stat(td->td_ucred, mp); if (error) return (error); #endif sp = &mp->mnt_stat; error = VFS_STATFS(mp, sp, td); if (error) return (error); sp->f_flags = mp->mnt_flag & MNT_VISFLAGMASK; if (suser(td)) { bcopy(sp, &sb, sizeof(sb)); sb.f_fsid.val[0] = sb.f_fsid.val[1] = 0; sp = &sb; } return (copyout(sp, SCARG(uap, buf), sizeof(*sp))); } /* * Get statistics on all filesystems. */ #ifndef _SYS_SYSPROTO_H_ struct getfsstat_args { struct statfs *buf; long bufsize; int flags; }; #endif int getfsstat(td, uap) struct thread *td; register struct getfsstat_args /* { syscallarg(struct statfs *) buf; syscallarg(long) bufsize; syscallarg(int) flags; } */ *uap; { register struct mount *mp, *nmp; register struct statfs *sp; caddr_t sfsp; long count, maxcount, error; maxcount = SCARG(uap, bufsize) / sizeof(struct statfs); sfsp = (caddr_t)SCARG(uap, buf); count = 0; mtx_lock(&mountlist_mtx); for (mp = TAILQ_FIRST(&mountlist); mp != NULL; mp = nmp) { #ifdef MAC if (mac_check_mount_stat(td->td_ucred, mp) != 0) { nmp = TAILQ_NEXT(mp, mnt_list); continue; } #endif if (vfs_busy(mp, LK_NOWAIT, &mountlist_mtx, td)) { nmp = TAILQ_NEXT(mp, mnt_list); continue; } if (sfsp && count < maxcount) { sp = &mp->mnt_stat; /* * If MNT_NOWAIT or MNT_LAZY is specified, do not * refresh the fsstat cache. MNT_NOWAIT or MNT_LAZY * overrides MNT_WAIT. */ if (((SCARG(uap, flags) & (MNT_LAZY|MNT_NOWAIT)) == 0 || (SCARG(uap, flags) & MNT_WAIT)) && (error = VFS_STATFS(mp, sp, td))) { mtx_lock(&mountlist_mtx); nmp = TAILQ_NEXT(mp, mnt_list); vfs_unbusy(mp, td); continue; } sp->f_flags = mp->mnt_flag & MNT_VISFLAGMASK; error = copyout(sp, sfsp, sizeof(*sp)); if (error) { vfs_unbusy(mp, td); return (error); } sfsp += sizeof(*sp); } count++; mtx_lock(&mountlist_mtx); nmp = TAILQ_NEXT(mp, mnt_list); vfs_unbusy(mp, td); } mtx_unlock(&mountlist_mtx); if (sfsp && count > maxcount) td->td_retval[0] = maxcount; else td->td_retval[0] = count; return (0); } /* * Change current working directory to a given file descriptor. */ #ifndef _SYS_SYSPROTO_H_ struct fchdir_args { int fd; }; #endif /* ARGSUSED */ int fchdir(td, uap) struct thread *td; struct fchdir_args /* { syscallarg(int) fd; } */ *uap; { register struct filedesc *fdp = td->td_proc->p_fd; struct vnode *vp, *tdp, *vpold; struct mount *mp; struct file *fp; int error; if ((error = getvnode(fdp, SCARG(uap, fd), &fp)) != 0) return (error); vp = (struct vnode *)fp->f_data; VREF(vp); fdrop(fp, td); vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); if (vp->v_type != VDIR) error = ENOTDIR; #ifdef MAC else if ((error = mac_check_vnode_chdir(td->td_ucred, vp)) != 0) { } #endif else error = VOP_ACCESS(vp, VEXEC, td->td_ucred, td); while (!error && (mp = vp->v_mountedhere) != NULL) { if (vfs_busy(mp, 0, 0, td)) continue; error = VFS_ROOT(mp, &tdp); vfs_unbusy(mp, td); if (error) break; vput(vp); vp = tdp; } if (error) { vput(vp); return (error); } VOP_UNLOCK(vp, 0, td); FILEDESC_LOCK(fdp); vpold = fdp->fd_cdir; fdp->fd_cdir = vp; FILEDESC_UNLOCK(fdp); vrele(vpold); return (0); } /* * Change current working directory (``.''). */ #ifndef _SYS_SYSPROTO_H_ struct chdir_args { char *path; }; #endif /* ARGSUSED */ int chdir(td, uap) struct thread *td; struct chdir_args /* { syscallarg(char *) path; } */ *uap; { return (kern_chdir(td, uap->path, UIO_USERSPACE)); } int kern_chdir(struct thread *td, char *path, enum uio_seg pathseg) { register struct filedesc *fdp = td->td_proc->p_fd; int error; struct nameidata nd; struct vnode *vp; NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF, pathseg, path, td); if ((error = change_dir(&nd, td)) != 0) return (error); NDFREE(&nd, NDF_ONLY_PNBUF); FILEDESC_LOCK(fdp); vp = fdp->fd_cdir; fdp->fd_cdir = nd.ni_vp; FILEDESC_UNLOCK(fdp); vrele(vp); return (0); } /* * Helper function for raised chroot(2) security function: Refuse if * any filedescriptors are open directories. */ static int chroot_refuse_vdir_fds(fdp) struct filedesc *fdp; { struct vnode *vp; struct file *fp; int fd; FILEDESC_LOCK_ASSERT(fdp, MA_OWNED); for (fd = 0; fd < fdp->fd_nfiles ; fd++) { fp = fget_locked(fdp, fd); if (fp == NULL) continue; if (fp->f_type == DTYPE_VNODE) { vp = (struct vnode *)fp->f_data; if (vp->v_type == VDIR) return (EPERM); } } return (0); } /* * This sysctl determines if we will allow a process to chroot(2) if it * has a directory open: * 0: disallowed for all processes. * 1: allowed for processes that were not already chroot(2)'ed. * 2: allowed for all processes. */ static int chroot_allow_open_directories = 1; SYSCTL_INT(_kern, OID_AUTO, chroot_allow_open_directories, CTLFLAG_RW, &chroot_allow_open_directories, 0, ""); /* * Change notion of root (``/'') directory. */ #ifndef _SYS_SYSPROTO_H_ struct chroot_args { char *path; }; #endif /* ARGSUSED */ int chroot(td, uap) struct thread *td; struct chroot_args /* { syscallarg(char *) path; } */ *uap; { register struct filedesc *fdp = td->td_proc->p_fd; int error; struct nameidata nd; struct vnode *vp; error = suser_cred(td->td_ucred, PRISON_ROOT); if (error) return (error); NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF, UIO_USERSPACE, SCARG(uap, path), td); mtx_lock(&Giant); if ((error = change_dir(&nd, td)) != 0) goto error; #ifdef MAC if ((error = mac_check_vnode_chroot(td->td_ucred, nd.ni_vp))) goto error; #endif FILEDESC_LOCK(fdp); if (chroot_allow_open_directories == 0 || (chroot_allow_open_directories == 1 && fdp->fd_rdir != rootvnode)) { error = chroot_refuse_vdir_fds(fdp); if (error) goto error_unlock; } vp = fdp->fd_rdir; fdp->fd_rdir = nd.ni_vp; if (!fdp->fd_jdir) { fdp->fd_jdir = nd.ni_vp; VREF(fdp->fd_jdir); } FILEDESC_UNLOCK(fdp); NDFREE(&nd, NDF_ONLY_PNBUF); vrele(vp); mtx_unlock(&Giant); return (0); error_unlock: FILEDESC_UNLOCK(fdp); error: mtx_unlock(&Giant); NDFREE(&nd, 0); return (error); } /* * Common routine for chroot and chdir. */ static int change_dir(ndp, td) register struct nameidata *ndp; struct thread *td; { struct vnode *vp; int error; error = namei(ndp); if (error) return (error); vp = ndp->ni_vp; if (vp->v_type != VDIR) error = ENOTDIR; #ifdef MAC else if ((error = mac_check_vnode_chdir(td->td_ucred, vp)) != 0) { } #endif else error = VOP_ACCESS(vp, VEXEC, td->td_ucred, td); if (error) vput(vp); else VOP_UNLOCK(vp, 0, td); return (error); } /* * Check permissions, allocate an open file structure, * and call the device open routine if any. */ #ifndef _SYS_SYSPROTO_H_ struct open_args { char *path; int flags; int mode; }; #endif int open(td, uap) struct thread *td; register struct open_args /* { syscallarg(char *) path; syscallarg(int) flags; syscallarg(int) mode; } */ *uap; { return (kern_open(td, uap->path, UIO_USERSPACE, uap->flags, uap->mode)); } int kern_open(struct thread *td, char *path, enum uio_seg pathseg, int flags, int mode) { struct proc *p = td->td_proc; struct filedesc *fdp = p->p_fd; struct file *fp; struct vnode *vp; struct vattr vat; struct mount *mp; int cmode, oflags; struct file *nfp; int type, indx, error; struct flock lf; struct nameidata nd; if ((flags & O_ACCMODE) == O_ACCMODE) return (EINVAL); oflags = flags; flags = FFLAGS(flags); error = falloc(td, &nfp, &indx); if (error) return (error); fp = nfp; FILEDESC_LOCK(fdp); cmode = ((mode &~ fdp->fd_cmask) & ALLPERMS) &~ S_ISTXT; FILEDESC_UNLOCK(fdp); NDINIT(&nd, LOOKUP, FOLLOW, pathseg, path, td); td->td_dupfd = -indx - 1; /* XXX check for fdopen */ /* * Bump the ref count to prevent another process from closing * the descriptor while we are blocked in vn_open() */ fhold(fp); error = vn_open(&nd, &flags, cmode); if (error) { /* * release our own reference */ fdrop(fp, td); /* * handle special fdopen() case. bleh. dupfdopen() is * responsible for dropping the old contents of ofiles[indx] * if it succeeds. */ if ((error == ENODEV || error == ENXIO) && td->td_dupfd >= 0 && /* XXX from fdopen */ (error = dupfdopen(td, fdp, indx, td->td_dupfd, flags, error)) == 0) { td->td_retval[0] = indx; return (0); } /* * Clean up the descriptor, but only if another thread hadn't * replaced or closed it. */ FILEDESC_LOCK(fdp); if (fdp->fd_ofiles[indx] == fp) { fdp->fd_ofiles[indx] = NULL; FILEDESC_UNLOCK(fdp); fdrop(fp, td); } else FILEDESC_UNLOCK(fdp); if (error == ERESTART) error = EINTR; return (error); } td->td_dupfd = 0; NDFREE(&nd, NDF_ONLY_PNBUF); vp = nd.ni_vp; /* * There should be 2 references on the file, one from the descriptor * table, and one for us. * * Handle the case where someone closed the file (via its file * descriptor) while we were blocked. The end result should look * like opening the file succeeded but it was immediately closed. */ FILEDESC_LOCK(fdp); FILE_LOCK(fp); if (fp->f_count == 1) { KASSERT(fdp->fd_ofiles[indx] != fp, ("Open file descriptor lost all refs")); FILEDESC_UNLOCK(fdp); FILE_UNLOCK(fp); VOP_UNLOCK(vp, 0, td); vn_close(vp, flags & FMASK, fp->f_cred, td); fdrop(fp, td); td->td_retval[0] = indx; return 0; } /* assert that vn_open created a backing object if one is needed */ KASSERT(!vn_canvmio(vp) || VOP_GETVOBJECT(vp, NULL) == 0, ("open: vmio vnode has no backing object after vn_open")); fp->f_data = vp; fp->f_flag = flags & FMASK; fp->f_ops = &vnops; fp->f_type = (vp->v_type == VFIFO ? DTYPE_FIFO : DTYPE_VNODE); FILEDESC_UNLOCK(fdp); FILE_UNLOCK(fp); VOP_UNLOCK(vp, 0, td); if (flags & (O_EXLOCK | O_SHLOCK)) { lf.l_whence = SEEK_SET; lf.l_start = 0; lf.l_len = 0; if (flags & O_EXLOCK) lf.l_type = F_WRLCK; else lf.l_type = F_RDLCK; type = F_FLOCK; if ((flags & FNONBLOCK) == 0) type |= F_WAIT; if ((error = VOP_ADVLOCK(vp, (caddr_t)fp, F_SETLK, &lf, type)) != 0) goto bad; fp->f_flag |= FHASLOCK; } if (flags & O_TRUNC) { if ((error = vn_start_write(vp, &mp, V_WAIT | PCATCH)) != 0) goto bad; VOP_LEASE(vp, td, td->td_ucred, LEASE_WRITE); VATTR_NULL(&vat); vat.va_size = 0; vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); #ifdef MAC error = mac_check_vnode_write(td->td_ucred, fp->f_cred, vp); if (error == 0) #endif error = VOP_SETATTR(vp, &vat, td->td_ucred, td); VOP_UNLOCK(vp, 0, td); vn_finished_write(mp); if (error) goto bad; } /* * Release our private reference, leaving the one associated with * the descriptor table intact. */ fdrop(fp, td); td->td_retval[0] = indx; return (0); bad: FILEDESC_LOCK(fdp); if (fdp->fd_ofiles[indx] == fp) { fdp->fd_ofiles[indx] = NULL; FILEDESC_UNLOCK(fdp); fdrop(fp, td); } else FILEDESC_UNLOCK(fdp); return (error); } #ifdef COMPAT_43 /* * Create a file. */ #ifndef _SYS_SYSPROTO_H_ struct ocreat_args { char *path; int mode; }; #endif int ocreat(td, uap) struct thread *td; register struct ocreat_args /* { syscallarg(char *) path; syscallarg(int) mode; } */ *uap; { struct open_args /* { syscallarg(char *) path; syscallarg(int) flags; syscallarg(int) mode; } */ nuap; SCARG(&nuap, path) = SCARG(uap, path); SCARG(&nuap, mode) = SCARG(uap, mode); SCARG(&nuap, flags) = O_WRONLY | O_CREAT | O_TRUNC; return (open(td, &nuap)); } #endif /* COMPAT_43 */ /* * Create a special file. */ #ifndef _SYS_SYSPROTO_H_ struct mknod_args { char *path; int mode; int dev; }; #endif /* ARGSUSED */ int mknod(td, uap) struct thread *td; register struct mknod_args /* { syscallarg(char *) path; syscallarg(int) mode; syscallarg(int) dev; } */ *uap; { return (kern_mknod(td, uap->path, UIO_USERSPACE, uap->mode, uap->dev)); } int kern_mknod(struct thread *td, char *path, enum uio_seg pathseg, int mode, int dev) { struct vnode *vp; struct mount *mp; struct vattr vattr; int error; int whiteout = 0; struct nameidata nd; switch (mode & S_IFMT) { case S_IFCHR: case S_IFBLK: error = suser(td); break; default: error = suser_cred(td->td_ucred, PRISON_ROOT); break; } if (error) return (error); restart: bwillwrite(); NDINIT(&nd, CREATE, LOCKPARENT | SAVENAME, pathseg, path, td); if ((error = namei(&nd)) != 0) return (error); vp = nd.ni_vp; if (vp != NULL) { vrele(vp); error = EEXIST; } else { VATTR_NULL(&vattr); FILEDESC_LOCK(td->td_proc->p_fd); vattr.va_mode = (mode & ALLPERMS) & ~td->td_proc->p_fd->fd_cmask; FILEDESC_UNLOCK(td->td_proc->p_fd); vattr.va_rdev = dev; whiteout = 0; switch (mode & S_IFMT) { case S_IFMT: /* used by badsect to flag bad sectors */ vattr.va_type = VBAD; break; case S_IFCHR: vattr.va_type = VCHR; break; case S_IFBLK: vattr.va_type = VBLK; break; case S_IFWHT: whiteout = 1; break; default: error = EINVAL; break; } } if (vn_start_write(nd.ni_dvp, &mp, V_NOWAIT) != 0) { NDFREE(&nd, NDF_ONLY_PNBUF); vput(nd.ni_dvp); if ((error = vn_start_write(NULL, &mp, V_XSLEEP | PCATCH)) != 0) return (error); goto restart; } if (!error) { VOP_LEASE(nd.ni_dvp, td, td->td_ucred, LEASE_WRITE); if (whiteout) error = VOP_WHITEOUT(nd.ni_dvp, &nd.ni_cnd, CREATE); else { error = VOP_MKNOD(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &vattr); if (error == 0) vput(nd.ni_vp); } } NDFREE(&nd, NDF_ONLY_PNBUF); vput(nd.ni_dvp); vn_finished_write(mp); ASSERT_VOP_UNLOCKED(nd.ni_dvp, "mknod"); ASSERT_VOP_UNLOCKED(nd.ni_vp, "mknod"); return (error); } /* * Create a named pipe. */ #ifndef _SYS_SYSPROTO_H_ struct mkfifo_args { char *path; int mode; }; #endif /* ARGSUSED */ int mkfifo(td, uap) struct thread *td; register struct mkfifo_args /* { syscallarg(char *) path; syscallarg(int) mode; } */ *uap; { return (kern_mkfifo(td, uap->path, UIO_USERSPACE, uap->mode)); } int kern_mkfifo(struct thread *td, char *path, enum uio_seg pathseg, int mode) { struct mount *mp; struct vattr vattr; int error; struct nameidata nd; restart: bwillwrite(); NDINIT(&nd, CREATE, LOCKPARENT | SAVENAME, pathseg, path, td); if ((error = namei(&nd)) != 0) return (error); if (nd.ni_vp != NULL) { NDFREE(&nd, NDF_ONLY_PNBUF); vrele(nd.ni_vp); vput(nd.ni_dvp); return (EEXIST); } if (vn_start_write(nd.ni_dvp, &mp, V_NOWAIT) != 0) { NDFREE(&nd, NDF_ONLY_PNBUF); vput(nd.ni_dvp); if ((error = vn_start_write(NULL, &mp, V_XSLEEP | PCATCH)) != 0) return (error); goto restart; } VATTR_NULL(&vattr); vattr.va_type = VFIFO; FILEDESC_LOCK(td->td_proc->p_fd); vattr.va_mode = (mode & ALLPERMS) & ~td->td_proc->p_fd->fd_cmask; FILEDESC_UNLOCK(td->td_proc->p_fd); VOP_LEASE(nd.ni_dvp, td, td->td_ucred, LEASE_WRITE); error = VOP_MKNOD(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &vattr); if (error == 0) vput(nd.ni_vp); NDFREE(&nd, NDF_ONLY_PNBUF); vput(nd.ni_dvp); vn_finished_write(mp); return (error); } /* * Make a hard file link. */ #ifndef _SYS_SYSPROTO_H_ struct link_args { char *path; char *link; }; #endif /* ARGSUSED */ int link(td, uap) struct thread *td; register struct link_args /* { syscallarg(char *) path; syscallarg(char *) link; } */ *uap; { return (kern_link(td, uap->path, uap->link, UIO_USERSPACE)); } int kern_link(struct thread *td, char *path, char *link, enum uio_seg segflg) { struct vnode *vp; struct mount *mp; struct nameidata nd; int error; bwillwrite(); NDINIT(&nd, LOOKUP, FOLLOW|NOOBJ, segflg, path, td); if ((error = namei(&nd)) != 0) return (error); NDFREE(&nd, NDF_ONLY_PNBUF); vp = nd.ni_vp; if (vp->v_type == VDIR) { vrele(vp); return (EPERM); /* POSIX */ } if ((error = vn_start_write(vp, &mp, V_WAIT | PCATCH)) != 0) { vrele(vp); return (error); } NDINIT(&nd, CREATE, LOCKPARENT | NOOBJ | SAVENAME, segflg, link, td); if ((error = namei(&nd)) == 0) { if (nd.ni_vp != NULL) { vrele(nd.ni_vp); error = EEXIST; } else if ((error = vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td)) == 0) { VOP_LEASE(nd.ni_dvp, td, td->td_ucred, LEASE_WRITE); VOP_LEASE(vp, td, td->td_ucred, LEASE_WRITE); - error = VOP_LINK(nd.ni_dvp, vp, &nd.ni_cnd); +#ifdef MAC + error = mac_check_vnode_link(td->td_ucred, nd.ni_dvp, + vp, &nd.ni_cnd); + if (error == 0) +#endif + error = VOP_LINK(nd.ni_dvp, vp, &nd.ni_cnd); VOP_UNLOCK(vp, 0, td); } NDFREE(&nd, NDF_ONLY_PNBUF); vput(nd.ni_dvp); } vrele(vp); vn_finished_write(mp); ASSERT_VOP_UNLOCKED(nd.ni_dvp, "link"); ASSERT_VOP_UNLOCKED(nd.ni_vp, "link"); return (error); } /* * Make a symbolic link. */ #ifndef _SYS_SYSPROTO_H_ struct symlink_args { char *path; char *link; }; #endif /* ARGSUSED */ int symlink(td, uap) struct thread *td; register struct symlink_args /* { syscallarg(char *) path; syscallarg(char *) link; } */ *uap; { return (kern_symlink(td, uap->path, uap->link, UIO_USERSPACE)); } int kern_symlink(struct thread *td, char *path, char *link, enum uio_seg segflg) { struct mount *mp; struct vattr vattr; char *syspath; int error; struct nameidata nd; if (segflg == UIO_SYSSPACE) { syspath = path; } else { syspath = uma_zalloc(namei_zone, M_WAITOK); if ((error = copyinstr(path, syspath, MAXPATHLEN, NULL)) != 0) goto out; } restart: bwillwrite(); NDINIT(&nd, CREATE, LOCKPARENT | NOOBJ | SAVENAME, segflg, link, td); if ((error = namei(&nd)) != 0) goto out; if (nd.ni_vp) { NDFREE(&nd, NDF_ONLY_PNBUF); vrele(nd.ni_vp); vput(nd.ni_dvp); error = EEXIST; goto out; } if (vn_start_write(nd.ni_dvp, &mp, V_NOWAIT) != 0) { NDFREE(&nd, NDF_ONLY_PNBUF); vput(nd.ni_dvp); if ((error = vn_start_write(NULL, &mp, V_XSLEEP | PCATCH)) != 0) return (error); goto restart; } VATTR_NULL(&vattr); FILEDESC_LOCK(td->td_proc->p_fd); vattr.va_mode = ACCESSPERMS &~ td->td_proc->p_fd->fd_cmask; FILEDESC_UNLOCK(td->td_proc->p_fd); VOP_LEASE(nd.ni_dvp, td, td->td_ucred, LEASE_WRITE); error = VOP_SYMLINK(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &vattr, syspath); NDFREE(&nd, NDF_ONLY_PNBUF); if (error == 0) vput(nd.ni_vp); vput(nd.ni_dvp); vn_finished_write(mp); ASSERT_VOP_UNLOCKED(nd.ni_dvp, "symlink"); ASSERT_VOP_UNLOCKED(nd.ni_vp, "symlink"); out: if (segflg != UIO_SYSSPACE) uma_zfree(namei_zone, syspath); return (error); } /* * Delete a whiteout from the filesystem. */ /* ARGSUSED */ int undelete(td, uap) struct thread *td; register struct undelete_args /* { syscallarg(char *) path; } */ *uap; { int error; struct mount *mp; struct nameidata nd; restart: bwillwrite(); NDINIT(&nd, DELETE, LOCKPARENT|DOWHITEOUT, UIO_USERSPACE, SCARG(uap, path), td); error = namei(&nd); if (error) return (error); if (nd.ni_vp != NULLVP || !(nd.ni_cnd.cn_flags & ISWHITEOUT)) { NDFREE(&nd, NDF_ONLY_PNBUF); if (nd.ni_vp) vrele(nd.ni_vp); vput(nd.ni_dvp); return (EEXIST); } if (vn_start_write(nd.ni_dvp, &mp, V_NOWAIT) != 0) { NDFREE(&nd, NDF_ONLY_PNBUF); vput(nd.ni_dvp); if ((error = vn_start_write(NULL, &mp, V_XSLEEP | PCATCH)) != 0) return (error); goto restart; } VOP_LEASE(nd.ni_dvp, td, td->td_ucred, LEASE_WRITE); error = VOP_WHITEOUT(nd.ni_dvp, &nd.ni_cnd, DELETE); NDFREE(&nd, NDF_ONLY_PNBUF); vput(nd.ni_dvp); vn_finished_write(mp); ASSERT_VOP_UNLOCKED(nd.ni_dvp, "undelete"); ASSERT_VOP_UNLOCKED(nd.ni_vp, "undelete"); return (error); } /* * Delete a name from the filesystem. */ #ifndef _SYS_SYSPROTO_H_ struct unlink_args { char *path; }; #endif /* ARGSUSED */ int unlink(td, uap) struct thread *td; struct unlink_args /* { syscallarg(char *) path; } */ *uap; { return (kern_unlink(td, SCARG(uap, path), UIO_USERSPACE)); } int kern_unlink(struct thread *td, char *path, enum uio_seg pathseg) { struct mount *mp; struct vnode *vp; int error; struct nameidata nd; restart: bwillwrite(); NDINIT(&nd, DELETE, LOCKPARENT|LOCKLEAF, pathseg, path, td); if ((error = namei(&nd)) != 0) return (error); vp = nd.ni_vp; if (vp->v_type == VDIR) error = EPERM; /* POSIX */ else { /* * The root of a mounted filesystem cannot be deleted. * * XXX: can this only be a VDIR case? */ if (vp->v_vflag & VV_ROOT) error = EBUSY; } if (error == 0) { if (vn_start_write(nd.ni_dvp, &mp, V_NOWAIT) != 0) { NDFREE(&nd, NDF_ONLY_PNBUF); if (vp == nd.ni_dvp) vrele(vp); else vput(vp); vput(nd.ni_dvp); if ((error = vn_start_write(NULL, &mp, V_XSLEEP | PCATCH)) != 0) return (error); goto restart; } VOP_LEASE(nd.ni_dvp, td, td->td_ucred, LEASE_WRITE); error = VOP_REMOVE(nd.ni_dvp, vp, &nd.ni_cnd); vn_finished_write(mp); } NDFREE(&nd, NDF_ONLY_PNBUF); if (vp == nd.ni_dvp) vrele(vp); else vput(vp); vput(nd.ni_dvp); ASSERT_VOP_UNLOCKED(nd.ni_dvp, "unlink"); ASSERT_VOP_UNLOCKED(nd.ni_vp, "unlink"); return (error); } /* * Reposition read/write file offset. */ #ifndef _SYS_SYSPROTO_H_ struct lseek_args { int fd; int pad; off_t offset; int whence; }; #endif int lseek(td, uap) struct thread *td; register struct lseek_args /* { syscallarg(int) fd; syscallarg(int) pad; syscallarg(off_t) offset; syscallarg(int) whence; } */ *uap; { struct ucred *cred = td->td_ucred; struct file *fp; struct vnode *vp; struct vattr vattr; off_t offset; int error, noneg; if ((error = fget(td, uap->fd, &fp)) != 0) return (error); if (fp->f_type != DTYPE_VNODE) { fdrop(fp, td); return (ESPIPE); } vp = (struct vnode *)fp->f_data; noneg = (vp->v_type != VCHR); offset = SCARG(uap, offset); switch (SCARG(uap, whence)) { case L_INCR: if (noneg && (fp->f_offset < 0 || (offset > 0 && fp->f_offset > OFF_MAX - offset))) return (EOVERFLOW); offset += fp->f_offset; break; case L_XTND: vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); error = VOP_GETATTR(vp, &vattr, cred, td); VOP_UNLOCK(vp, 0, td); if (error) return (error); if (noneg && (vattr.va_size > OFF_MAX || (offset > 0 && vattr.va_size > OFF_MAX - offset))) return (EOVERFLOW); offset += vattr.va_size; break; case L_SET: break; default: fdrop(fp, td); return (EINVAL); } if (noneg && offset < 0) return (EINVAL); fp->f_offset = offset; *(off_t *)(td->td_retval) = fp->f_offset; fdrop(fp, td); return (0); } #if defined(COMPAT_43) || defined(COMPAT_SUNOS) /* * Reposition read/write file offset. */ #ifndef _SYS_SYSPROTO_H_ struct olseek_args { int fd; long offset; int whence; }; #endif int olseek(td, uap) struct thread *td; register struct olseek_args /* { syscallarg(int) fd; syscallarg(long) offset; syscallarg(int) whence; } */ *uap; { struct lseek_args /* { syscallarg(int) fd; syscallarg(int) pad; syscallarg(off_t) offset; syscallarg(int) whence; } */ nuap; int error; SCARG(&nuap, fd) = SCARG(uap, fd); SCARG(&nuap, offset) = SCARG(uap, offset); SCARG(&nuap, whence) = SCARG(uap, whence); error = lseek(td, &nuap); return (error); } #endif /* COMPAT_43 */ /* * Check access permissions using passed credentials. */ static int vn_access(vp, user_flags, cred, td) struct vnode *vp; int user_flags; struct ucred *cred; struct thread *td; { int error, flags; /* Flags == 0 means only check for existence. */ error = 0; if (user_flags) { flags = 0; if (user_flags & R_OK) flags |= VREAD; if (user_flags & W_OK) flags |= VWRITE; if (user_flags & X_OK) flags |= VEXEC; #ifdef MAC error = mac_check_vnode_access(cred, vp, flags); if (error) return (error); #endif if ((flags & VWRITE) == 0 || (error = vn_writechk(vp)) == 0) error = VOP_ACCESS(vp, flags, cred, td); } return (error); } /* * Check access permissions using "real" credentials. */ #ifndef _SYS_SYSPROTO_H_ struct access_args { char *path; int flags; }; #endif int access(td, uap) struct thread *td; register struct access_args /* { syscallarg(char *) path; syscallarg(int) flags; } */ *uap; { return (kern_access(td, uap->path, UIO_USERSPACE, uap->flags)); } int kern_access(struct thread *td, char *path, enum uio_seg pathseg, int flags) { struct ucred *cred, *tmpcred; register struct vnode *vp; int error; struct nameidata nd; /* * Create and modify a temporary credential instead of one that * is potentially shared. This could also mess up socket * buffer accounting which can run in an interrupt context. * * XXX - Depending on how "threads" are finally implemented, it * may be better to explicitly pass the credential to namei() * rather than to modify the potentially shared process structure. */ cred = td->td_ucred; tmpcred = crdup(cred); tmpcred->cr_uid = cred->cr_ruid; tmpcred->cr_groups[0] = cred->cr_rgid; td->td_ucred = tmpcred; NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF | NOOBJ, pathseg, path, td); if ((error = namei(&nd)) != 0) goto out1; vp = nd.ni_vp; error = vn_access(vp, flags, tmpcred, td); NDFREE(&nd, NDF_ONLY_PNBUF); vput(vp); out1: td->td_ucred = cred; crfree(tmpcred); return (error); } /* * Check access permissions using "effective" credentials. */ #ifndef _SYS_SYSPROTO_H_ struct eaccess_args { char *path; int flags; }; #endif int eaccess(td, uap) struct thread *td; register struct eaccess_args /* { syscallarg(char *) path; syscallarg(int) flags; } */ *uap; { struct nameidata nd; struct vnode *vp; int error; NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF | NOOBJ, UIO_USERSPACE, SCARG(uap, path), td); if ((error = namei(&nd)) != 0) return (error); vp = nd.ni_vp; error = vn_access(vp, SCARG(uap, flags), td->td_ucred, td); NDFREE(&nd, NDF_ONLY_PNBUF); vput(vp); return (error); } #if defined(COMPAT_43) || defined(COMPAT_SUNOS) /* * Get file status; this version follows links. */ #ifndef _SYS_SYSPROTO_H_ struct ostat_args { char *path; struct ostat *ub; }; #endif /* ARGSUSED */ int ostat(td, uap) struct thread *td; register struct ostat_args /* { syscallarg(char *) path; syscallarg(struct ostat *) ub; } */ *uap; { struct stat sb; struct ostat osb; int error; struct nameidata nd; NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF | NOOBJ, UIO_USERSPACE, SCARG(uap, path), td); if ((error = namei(&nd)) != 0) return (error); NDFREE(&nd, NDF_ONLY_PNBUF); error = vn_stat(nd.ni_vp, &sb, td->td_ucred, NOCRED, td); vput(nd.ni_vp); if (error) return (error); cvtstat(&sb, &osb); error = copyout(&osb, SCARG(uap, ub), sizeof (osb)); return (error); } /* * Get file status; this version does not follow links. */ #ifndef _SYS_SYSPROTO_H_ struct olstat_args { char *path; struct ostat *ub; }; #endif /* ARGSUSED */ int olstat(td, uap) struct thread *td; register struct olstat_args /* { syscallarg(char *) path; syscallarg(struct ostat *) ub; } */ *uap; { struct vnode *vp; struct stat sb; struct ostat osb; int error; struct nameidata nd; NDINIT(&nd, LOOKUP, NOFOLLOW | LOCKLEAF | NOOBJ, UIO_USERSPACE, SCARG(uap, path), td); if ((error = namei(&nd)) != 0) return (error); vp = nd.ni_vp; error = vn_stat(vp, &sb, td->td_ucred, NOCRED, td); NDFREE(&nd, NDF_ONLY_PNBUF); vput(vp); if (error) return (error); cvtstat(&sb, &osb); error = copyout(&osb, SCARG(uap, ub), sizeof (osb)); return (error); } /* * Convert from an old to a new stat structure. */ void cvtstat(st, ost) struct stat *st; struct ostat *ost; { ost->st_dev = st->st_dev; ost->st_ino = st->st_ino; ost->st_mode = st->st_mode; ost->st_nlink = st->st_nlink; ost->st_uid = st->st_uid; ost->st_gid = st->st_gid; ost->st_rdev = st->st_rdev; if (st->st_size < (quad_t)1 << 32) ost->st_size = st->st_size; else ost->st_size = -2; ost->st_atime = st->st_atime; ost->st_mtime = st->st_mtime; ost->st_ctime = st->st_ctime; ost->st_blksize = st->st_blksize; ost->st_blocks = st->st_blocks; ost->st_flags = st->st_flags; ost->st_gen = st->st_gen; } #endif /* COMPAT_43 || COMPAT_SUNOS */ /* * Get file status; this version follows links. */ #ifndef _SYS_SYSPROTO_H_ struct stat_args { char *path; struct stat *ub; }; #endif /* ARGSUSED */ int stat(td, uap) struct thread *td; register struct stat_args /* { syscallarg(char *) path; syscallarg(struct stat *) ub; } */ *uap; { struct stat sb; int error; struct nameidata nd; #ifdef LOOKUP_SHARED NDINIT(&nd, LOOKUP, FOLLOW | LOCKSHARED | LOCKLEAF | NOOBJ, UIO_USERSPACE, SCARG(uap, path), td); #else NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF | NOOBJ, UIO_USERSPACE, SCARG(uap, path), td); #endif if ((error = namei(&nd)) != 0) return (error); error = vn_stat(nd.ni_vp, &sb, td->td_ucred, NOCRED, td); NDFREE(&nd, NDF_ONLY_PNBUF); vput(nd.ni_vp); if (error) return (error); error = copyout(&sb, SCARG(uap, ub), sizeof (sb)); return (error); } /* * Get file status; this version does not follow links. */ #ifndef _SYS_SYSPROTO_H_ struct lstat_args { char *path; struct stat *ub; }; #endif /* ARGSUSED */ int lstat(td, uap) struct thread *td; register struct lstat_args /* { syscallarg(char *) path; syscallarg(struct stat *) ub; } */ *uap; { int error; struct vnode *vp; struct stat sb; struct nameidata nd; NDINIT(&nd, LOOKUP, NOFOLLOW | LOCKLEAF | NOOBJ, UIO_USERSPACE, SCARG(uap, path), td); if ((error = namei(&nd)) != 0) return (error); vp = nd.ni_vp; error = vn_stat(vp, &sb, td->td_ucred, NOCRED, td); NDFREE(&nd, NDF_ONLY_PNBUF); vput(vp); if (error) return (error); error = copyout(&sb, SCARG(uap, ub), sizeof (sb)); return (error); } /* * Implementation of the NetBSD stat() function. * XXX This should probably be collapsed with the FreeBSD version, * as the differences are only due to vn_stat() clearing spares at * the end of the structures. vn_stat could be split to avoid this, * and thus collapse the following to close to zero code. */ void cvtnstat(sb, nsb) struct stat *sb; struct nstat *nsb; { bzero(nsb, sizeof *nsb); nsb->st_dev = sb->st_dev; nsb->st_ino = sb->st_ino; nsb->st_mode = sb->st_mode; nsb->st_nlink = sb->st_nlink; nsb->st_uid = sb->st_uid; nsb->st_gid = sb->st_gid; nsb->st_rdev = sb->st_rdev; nsb->st_atimespec = sb->st_atimespec; nsb->st_mtimespec = sb->st_mtimespec; nsb->st_ctimespec = sb->st_ctimespec; nsb->st_size = sb->st_size; nsb->st_blocks = sb->st_blocks; nsb->st_blksize = sb->st_blksize; nsb->st_flags = sb->st_flags; nsb->st_gen = sb->st_gen; nsb->st_birthtimespec = sb->st_birthtimespec; } #ifndef _SYS_SYSPROTO_H_ struct nstat_args { char *path; struct nstat *ub; }; #endif /* ARGSUSED */ int nstat(td, uap) struct thread *td; register struct nstat_args /* { syscallarg(char *) path; syscallarg(struct nstat *) ub; } */ *uap; { struct stat sb; struct nstat nsb; int error; struct nameidata nd; NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF | NOOBJ, UIO_USERSPACE, SCARG(uap, path), td); if ((error = namei(&nd)) != 0) return (error); NDFREE(&nd, NDF_ONLY_PNBUF); error = vn_stat(nd.ni_vp, &sb, td->td_ucred, NOCRED, td); vput(nd.ni_vp); if (error) return (error); cvtnstat(&sb, &nsb); error = copyout(&nsb, SCARG(uap, ub), sizeof (nsb)); return (error); } /* * NetBSD lstat. Get file status; this version does not follow links. */ #ifndef _SYS_SYSPROTO_H_ struct lstat_args { char *path; struct stat *ub; }; #endif /* ARGSUSED */ int nlstat(td, uap) struct thread *td; register struct nlstat_args /* { syscallarg(char *) path; syscallarg(struct nstat *) ub; } */ *uap; { int error; struct vnode *vp; struct stat sb; struct nstat nsb; struct nameidata nd; NDINIT(&nd, LOOKUP, NOFOLLOW | LOCKLEAF | NOOBJ, UIO_USERSPACE, SCARG(uap, path), td); if ((error = namei(&nd)) != 0) return (error); vp = nd.ni_vp; NDFREE(&nd, NDF_ONLY_PNBUF); error = vn_stat(vp, &sb, td->td_ucred, NOCRED, td); vput(vp); if (error) return (error); cvtnstat(&sb, &nsb); error = copyout(&nsb, SCARG(uap, ub), sizeof (nsb)); return (error); } /* * Get configurable pathname variables. */ #ifndef _SYS_SYSPROTO_H_ struct pathconf_args { char *path; int name; }; #endif /* ARGSUSED */ int pathconf(td, uap) struct thread *td; register struct pathconf_args /* { syscallarg(char *) path; syscallarg(int) name; } */ *uap; { int error; struct nameidata nd; NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF | NOOBJ, UIO_USERSPACE, SCARG(uap, path), td); if ((error = namei(&nd)) != 0) return (error); NDFREE(&nd, NDF_ONLY_PNBUF); error = VOP_PATHCONF(nd.ni_vp, SCARG(uap, name), td->td_retval); vput(nd.ni_vp); return (error); } /* * Return target name of a symbolic link. */ #ifndef _SYS_SYSPROTO_H_ struct readlink_args { char *path; char *buf; int count; }; #endif /* ARGSUSED */ int readlink(td, uap) struct thread *td; register struct readlink_args /* { syscallarg(char *) path; syscallarg(char *) buf; syscallarg(int) count; } */ *uap; { return (kern_readlink(td, uap->path, UIO_USERSPACE, uap->buf, UIO_USERSPACE, uap->count)); } int kern_readlink(struct thread *td, char *path, enum uio_seg pathseg, char *buf, enum uio_seg bufseg, int count) { register struct vnode *vp; struct iovec aiov; struct uio auio; int error; struct nameidata nd; NDINIT(&nd, LOOKUP, NOFOLLOW | LOCKLEAF | NOOBJ, pathseg, path, td); if ((error = namei(&nd)) != 0) return (error); NDFREE(&nd, NDF_ONLY_PNBUF); vp = nd.ni_vp; #ifdef MAC error = mac_check_vnode_readlink(td->td_ucred, vp); if (error) { vput(vp); return (error); } #endif if (vp->v_type != VLNK) error = EINVAL; else { aiov.iov_base = buf; aiov.iov_len = count; auio.uio_iov = &aiov; auio.uio_iovcnt = 1; auio.uio_offset = 0; auio.uio_rw = UIO_READ; auio.uio_segflg = bufseg; auio.uio_td = td; auio.uio_resid = count; error = VOP_READLINK(vp, &auio, td->td_ucred); } vput(vp); td->td_retval[0] = count - auio.uio_resid; return (error); } /* * Common implementation code for chflags() and fchflags(). */ static int setfflags(td, vp, flags) struct thread *td; struct vnode *vp; int flags; { int error; struct mount *mp; struct vattr vattr; /* * Prevent non-root users from setting flags on devices. When * a device is reused, users can retain ownership of the device * if they are allowed to set flags and programs assume that * chown can't fail when done as root. */ if (vp->v_type == VCHR || vp->v_type == VBLK) { error = suser_cred(td->td_ucred, PRISON_ROOT); if (error) return (error); } if ((error = vn_start_write(vp, &mp, V_WAIT | PCATCH)) != 0) return (error); VOP_LEASE(vp, td, td->td_ucred, LEASE_WRITE); vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); #ifdef MAC error = mac_check_vnode_setflags(td->td_ucred, vp, vattr.va_flags); if (error == 0) { #endif VATTR_NULL(&vattr); vattr.va_flags = flags; error = VOP_SETATTR(vp, &vattr, td->td_ucred, td); #ifdef MAC } #endif VOP_UNLOCK(vp, 0, td); vn_finished_write(mp); return (error); } /* * Change flags of a file given a path name. */ #ifndef _SYS_SYSPROTO_H_ struct chflags_args { char *path; int flags; }; #endif /* ARGSUSED */ int chflags(td, uap) struct thread *td; register struct chflags_args /* { syscallarg(char *) path; syscallarg(int) flags; } */ *uap; { int error; struct nameidata nd; NDINIT(&nd, LOOKUP, FOLLOW, UIO_USERSPACE, SCARG(uap, path), td); if ((error = namei(&nd)) != 0) return (error); NDFREE(&nd, NDF_ONLY_PNBUF); error = setfflags(td, nd.ni_vp, SCARG(uap, flags)); vrele(nd.ni_vp); return error; } /* * Same as chflags() but doesn't follow symlinks. */ int lchflags(td, uap) struct thread *td; register struct lchflags_args /* { syscallarg(char *) path; syscallarg(int) flags; } */ *uap; { int error; struct nameidata nd; NDINIT(&nd, LOOKUP, NOFOLLOW, UIO_USERSPACE, SCARG(uap, path), td); if ((error = namei(&nd)) != 0) return (error); NDFREE(&nd, NDF_ONLY_PNBUF); error = setfflags(td, nd.ni_vp, SCARG(uap, flags)); vrele(nd.ni_vp); return error; } /* * Change flags of a file given a file descriptor. */ #ifndef _SYS_SYSPROTO_H_ struct fchflags_args { int fd; int flags; }; #endif /* ARGSUSED */ int fchflags(td, uap) struct thread *td; register struct fchflags_args /* { syscallarg(int) fd; syscallarg(int) flags; } */ *uap; { struct file *fp; int error; if ((error = getvnode(td->td_proc->p_fd, SCARG(uap, fd), &fp)) != 0) return (error); error = setfflags(td, (struct vnode *) fp->f_data, SCARG(uap, flags)); fdrop(fp, td); return (error); } /* * Common implementation code for chmod(), lchmod() and fchmod(). */ static int setfmode(td, vp, mode) struct thread *td; struct vnode *vp; int mode; { int error; struct mount *mp; struct vattr vattr; if ((error = vn_start_write(vp, &mp, V_WAIT | PCATCH)) != 0) return (error); VOP_LEASE(vp, td, td->td_ucred, LEASE_WRITE); vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); VATTR_NULL(&vattr); vattr.va_mode = mode & ALLPERMS; #ifdef MAC error = mac_check_vnode_setmode(td->td_ucred, vp, vattr.va_mode); if (error == 0) #endif error = VOP_SETATTR(vp, &vattr, td->td_ucred, td); VOP_UNLOCK(vp, 0, td); vn_finished_write(mp); return error; } /* * Change mode of a file given path name. */ #ifndef _SYS_SYSPROTO_H_ struct chmod_args { char *path; int mode; }; #endif /* ARGSUSED */ int chmod(td, uap) struct thread *td; register struct chmod_args /* { syscallarg(char *) path; syscallarg(int) mode; } */ *uap; { return (kern_chmod(td, uap->path, UIO_USERSPACE, uap->mode)); } int kern_chmod(struct thread *td, char *path, enum uio_seg pathseg, int mode) { int error; struct nameidata nd; NDINIT(&nd, LOOKUP, FOLLOW, pathseg, path, td); if ((error = namei(&nd)) != 0) return (error); NDFREE(&nd, NDF_ONLY_PNBUF); error = setfmode(td, nd.ni_vp, mode); vrele(nd.ni_vp); return error; } /* * Change mode of a file given path name (don't follow links.) */ #ifndef _SYS_SYSPROTO_H_ struct lchmod_args { char *path; int mode; }; #endif /* ARGSUSED */ int lchmod(td, uap) struct thread *td; register struct lchmod_args /* { syscallarg(char *) path; syscallarg(int) mode; } */ *uap; { int error; struct nameidata nd; NDINIT(&nd, LOOKUP, NOFOLLOW, UIO_USERSPACE, SCARG(uap, path), td); if ((error = namei(&nd)) != 0) return (error); NDFREE(&nd, NDF_ONLY_PNBUF); error = setfmode(td, nd.ni_vp, SCARG(uap, mode)); vrele(nd.ni_vp); return error; } /* * Change mode of a file given a file descriptor. */ #ifndef _SYS_SYSPROTO_H_ struct fchmod_args { int fd; int mode; }; #endif /* ARGSUSED */ int fchmod(td, uap) struct thread *td; register struct fchmod_args /* { syscallarg(int) fd; syscallarg(int) mode; } */ *uap; { struct file *fp; struct vnode *vp; int error; if ((error = getvnode(td->td_proc->p_fd, SCARG(uap, fd), &fp)) != 0) return (error); vp = (struct vnode *)fp->f_data; error = setfmode(td, (struct vnode *)fp->f_data, SCARG(uap, mode)); fdrop(fp, td); return (error); } /* * Common implementation for chown(), lchown(), and fchown() */ static int setfown(td, vp, uid, gid) struct thread *td; struct vnode *vp; uid_t uid; gid_t gid; { int error; struct mount *mp; struct vattr vattr; if ((error = vn_start_write(vp, &mp, V_WAIT | PCATCH)) != 0) return (error); VOP_LEASE(vp, td, td->td_ucred, LEASE_WRITE); vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); VATTR_NULL(&vattr); vattr.va_uid = uid; vattr.va_gid = gid; #ifdef MAC error = mac_check_vnode_setowner(td->td_ucred, vp, vattr.va_uid, vattr.va_gid); if (error == 0) #endif error = VOP_SETATTR(vp, &vattr, td->td_ucred, td); VOP_UNLOCK(vp, 0, td); vn_finished_write(mp); return error; } /* * Set ownership given a path name. */ #ifndef _SYS_SYSPROTO_H_ struct chown_args { char *path; int uid; int gid; }; #endif /* ARGSUSED */ int chown(td, uap) struct thread *td; register struct chown_args /* { syscallarg(char *) path; syscallarg(int) uid; syscallarg(int) gid; } */ *uap; { return (kern_chown(td, uap->path, UIO_USERSPACE, uap->uid, uap->gid)); } int kern_chown(struct thread *td, char *path, enum uio_seg pathseg, int uid, int gid) { int error; struct nameidata nd; NDINIT(&nd, LOOKUP, FOLLOW, pathseg, path, td); if ((error = namei(&nd)) != 0) return (error); NDFREE(&nd, NDF_ONLY_PNBUF); error = setfown(td, nd.ni_vp, uid, gid); vrele(nd.ni_vp); return (error); } /* * Set ownership given a path name, do not cross symlinks. */ #ifndef _SYS_SYSPROTO_H_ struct lchown_args { char *path; int uid; int gid; }; #endif /* ARGSUSED */ int lchown(td, uap) struct thread *td; register struct lchown_args /* { syscallarg(char *) path; syscallarg(int) uid; syscallarg(int) gid; } */ *uap; { return (kern_lchown(td, uap->path, UIO_USERSPACE, uap->uid, uap->gid)); } int kern_lchown(struct thread *td, char *path, enum uio_seg pathseg, int uid, int gid) { int error; struct nameidata nd; NDINIT(&nd, LOOKUP, NOFOLLOW, pathseg, path, td); if ((error = namei(&nd)) != 0) return (error); NDFREE(&nd, NDF_ONLY_PNBUF); error = setfown(td, nd.ni_vp, uid, gid); vrele(nd.ni_vp); return (error); } /* * Set ownership given a file descriptor. */ #ifndef _SYS_SYSPROTO_H_ struct fchown_args { int fd; int uid; int gid; }; #endif /* ARGSUSED */ int fchown(td, uap) struct thread *td; register struct fchown_args /* { syscallarg(int) fd; syscallarg(int) uid; syscallarg(int) gid; } */ *uap; { struct file *fp; struct vnode *vp; int error; if ((error = getvnode(td->td_proc->p_fd, SCARG(uap, fd), &fp)) != 0) return (error); vp = (struct vnode *)fp->f_data; error = setfown(td, (struct vnode *)fp->f_data, SCARG(uap, uid), SCARG(uap, gid)); fdrop(fp, td); return (error); } /* * Common implementation code for utimes(), lutimes(), and futimes(). */ static int getutimes(usrtvp, tvpseg, tsp) const struct timeval *usrtvp; enum uio_seg tvpseg; struct timespec *tsp; { struct timeval tv[2]; const struct timeval *tvp; int error; if (usrtvp == NULL) { microtime(&tv[0]); TIMEVAL_TO_TIMESPEC(&tv[0], &tsp[0]); tsp[1] = tsp[0]; } else { if (tvpseg == UIO_SYSSPACE) { tvp = usrtvp; } else { if ((error = copyin(usrtvp, tv, sizeof(tv))) != 0) return (error); tvp = tv; } TIMEVAL_TO_TIMESPEC(&tvp[0], &tsp[0]); TIMEVAL_TO_TIMESPEC(&tvp[1], &tsp[1]); } return 0; } /* * Common implementation code for utimes(), lutimes(), and futimes(). */ static int setutimes(td, vp, ts, numtimes, nullflag) struct thread *td; struct vnode *vp; const struct timespec *ts; int numtimes; int nullflag; { int error, setbirthtime; struct mount *mp; struct vattr vattr; if ((error = vn_start_write(vp, &mp, V_WAIT | PCATCH)) != 0) return (error); VOP_LEASE(vp, td, td->td_ucred, LEASE_WRITE); vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); setbirthtime = 0; if (numtimes < 3 && VOP_GETATTR(vp, &vattr, td->td_ucred, td) == 0 && timespeccmp(&ts[1], &vattr.va_birthtime, < )) setbirthtime = 1; VATTR_NULL(&vattr); vattr.va_atime = ts[0]; vattr.va_mtime = ts[1]; if (setbirthtime) vattr.va_birthtime = ts[1]; if (numtimes > 2) vattr.va_birthtime = ts[2]; if (nullflag) vattr.va_vaflags |= VA_UTIMES_NULL; #ifdef MAC error = mac_check_vnode_setutimes(td->td_ucred, vp, vattr.va_atime, vattr.va_mtime); #endif if (error == 0) error = VOP_SETATTR(vp, &vattr, td->td_ucred, td); VOP_UNLOCK(vp, 0, td); vn_finished_write(mp); return error; } /* * Set the access and modification times of a file. */ #ifndef _SYS_SYSPROTO_H_ struct utimes_args { char *path; struct timeval *tptr; }; #endif /* ARGSUSED */ int utimes(td, uap) struct thread *td; register struct utimes_args /* { syscallarg(char *) path; syscallarg(struct timeval *) tptr; } */ *uap; { return (kern_utimes(td, uap->path, UIO_USERSPACE, uap->tptr, UIO_USERSPACE)); } int kern_utimes(struct thread *td, char *path, enum uio_seg pathseg, struct timeval *tptr, enum uio_seg tptrseg) { struct timespec ts[2]; int error; struct nameidata nd; if ((error = getutimes(tptr, tptrseg, ts)) != 0) return (error); NDINIT(&nd, LOOKUP, FOLLOW, pathseg, path, td); if ((error = namei(&nd)) != 0) return (error); NDFREE(&nd, NDF_ONLY_PNBUF); error = setutimes(td, nd.ni_vp, ts, 2, tptr == NULL); vrele(nd.ni_vp); return (error); } /* * Set the access and modification times of a file. */ #ifndef _SYS_SYSPROTO_H_ struct lutimes_args { char *path; struct timeval *tptr; }; #endif /* ARGSUSED */ int lutimes(td, uap) struct thread *td; register struct lutimes_args /* { syscallarg(char *) path; syscallarg(struct timeval *) tptr; } */ *uap; { return (kern_lutimes(td, uap->path, UIO_USERSPACE, uap->tptr, UIO_USERSPACE)); } int kern_lutimes(struct thread *td, char *path, enum uio_seg pathseg, struct timeval *tptr, enum uio_seg tptrseg) { struct timespec ts[2]; int error; struct nameidata nd; if ((error = getutimes(tptr, tptrseg, ts)) != 0) return (error); NDINIT(&nd, LOOKUP, NOFOLLOW, pathseg, path, td); if ((error = namei(&nd)) != 0) return (error); NDFREE(&nd, NDF_ONLY_PNBUF); error = setutimes(td, nd.ni_vp, ts, 2, tptr == NULL); vrele(nd.ni_vp); return (error); } /* * Set the access and modification times of a file. */ #ifndef _SYS_SYSPROTO_H_ struct futimes_args { int fd; struct timeval *tptr; }; #endif /* ARGSUSED */ int futimes(td, uap) struct thread *td; register struct futimes_args /* { syscallarg(int ) fd; syscallarg(struct timeval *) tptr; } */ *uap; { return (kern_futimes(td, uap->fd, uap->tptr, UIO_USERSPACE)); } int kern_futimes(struct thread *td, int fd, struct timeval *tptr, enum uio_seg tptrseg) { struct timespec ts[2]; struct file *fp; int error; if ((error = getutimes(tptr, tptrseg, ts)) != 0) return (error); if ((error = getvnode(td->td_proc->p_fd, fd, &fp)) != 0) return (error); error = setutimes(td, (struct vnode *)fp->f_data, ts, 2, tptr == NULL); fdrop(fp, td); return (error); } /* * Truncate a file given its path name. */ #ifndef _SYS_SYSPROTO_H_ struct truncate_args { char *path; int pad; off_t length; }; #endif /* ARGSUSED */ int truncate(td, uap) struct thread *td; register struct truncate_args /* { syscallarg(char *) path; syscallarg(int) pad; syscallarg(off_t) length; } */ *uap; { return (kern_truncate(td, uap->path, UIO_USERSPACE, uap->length)); } int kern_truncate(struct thread *td, char *path, enum uio_seg pathseg, off_t length) { struct mount *mp; struct vnode *vp; struct vattr vattr; int error; struct nameidata nd; if (length < 0) return(EINVAL); NDINIT(&nd, LOOKUP, FOLLOW, pathseg, path, td); if ((error = namei(&nd)) != 0) return (error); vp = nd.ni_vp; if ((error = vn_start_write(vp, &mp, V_WAIT | PCATCH)) != 0) { vrele(vp); return (error); } NDFREE(&nd, NDF_ONLY_PNBUF); VOP_LEASE(vp, td, td->td_ucred, LEASE_WRITE); vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); if (vp->v_type == VDIR) error = EISDIR; #ifdef MAC else if ((error = mac_check_vnode_write(td->td_ucred, NOCRED, vp))) { } #endif else if ((error = vn_writechk(vp)) == 0 && (error = VOP_ACCESS(vp, VWRITE, td->td_ucred, td)) == 0) { VATTR_NULL(&vattr); vattr.va_size = length; error = VOP_SETATTR(vp, &vattr, td->td_ucred, td); } vput(vp); vn_finished_write(mp); return (error); } /* * Truncate a file given a file descriptor. */ #ifndef _SYS_SYSPROTO_H_ struct ftruncate_args { int fd; int pad; off_t length; }; #endif /* ARGSUSED */ int ftruncate(td, uap) struct thread *td; register struct ftruncate_args /* { syscallarg(int) fd; syscallarg(int) pad; syscallarg(off_t) length; } */ *uap; { struct mount *mp; struct vattr vattr; struct vnode *vp; struct file *fp; int error; if (uap->length < 0) return(EINVAL); if ((error = getvnode(td->td_proc->p_fd, SCARG(uap, fd), &fp)) != 0) return (error); if ((fp->f_flag & FWRITE) == 0) { fdrop(fp, td); return (EINVAL); } vp = (struct vnode *)fp->f_data; if ((error = vn_start_write(vp, &mp, V_WAIT | PCATCH)) != 0) { fdrop(fp, td); return (error); } VOP_LEASE(vp, td, td->td_ucred, LEASE_WRITE); vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); if (vp->v_type == VDIR) error = EISDIR; #ifdef MAC else if ((error = mac_check_vnode_write(td->td_ucred, fp->f_cred, vp))) { } #endif else if ((error = vn_writechk(vp)) == 0) { VATTR_NULL(&vattr); vattr.va_size = SCARG(uap, length); error = VOP_SETATTR(vp, &vattr, fp->f_cred, td); } VOP_UNLOCK(vp, 0, td); vn_finished_write(mp); fdrop(fp, td); return (error); } #if defined(COMPAT_43) || defined(COMPAT_SUNOS) /* * Truncate a file given its path name. */ #ifndef _SYS_SYSPROTO_H_ struct otruncate_args { char *path; long length; }; #endif /* ARGSUSED */ int otruncate(td, uap) struct thread *td; register struct otruncate_args /* { syscallarg(char *) path; syscallarg(long) length; } */ *uap; { struct truncate_args /* { syscallarg(char *) path; syscallarg(int) pad; syscallarg(off_t) length; } */ nuap; SCARG(&nuap, path) = SCARG(uap, path); SCARG(&nuap, length) = SCARG(uap, length); return (truncate(td, &nuap)); } /* * Truncate a file given a file descriptor. */ #ifndef _SYS_SYSPROTO_H_ struct oftruncate_args { int fd; long length; }; #endif /* ARGSUSED */ int oftruncate(td, uap) struct thread *td; register struct oftruncate_args /* { syscallarg(int) fd; syscallarg(long) length; } */ *uap; { struct ftruncate_args /* { syscallarg(int) fd; syscallarg(int) pad; syscallarg(off_t) length; } */ nuap; SCARG(&nuap, fd) = SCARG(uap, fd); SCARG(&nuap, length) = SCARG(uap, length); return (ftruncate(td, &nuap)); } #endif /* COMPAT_43 || COMPAT_SUNOS */ /* * Sync an open file. */ #ifndef _SYS_SYSPROTO_H_ struct fsync_args { int fd; }; #endif /* ARGSUSED */ int fsync(td, uap) struct thread *td; struct fsync_args /* { syscallarg(int) fd; } */ *uap; { struct vnode *vp; struct mount *mp; struct file *fp; vm_object_t obj; int error; GIANT_REQUIRED; if ((error = getvnode(td->td_proc->p_fd, SCARG(uap, fd), &fp)) != 0) return (error); vp = (struct vnode *)fp->f_data; if ((error = vn_start_write(vp, &mp, V_WAIT | PCATCH)) != 0) { fdrop(fp, td); return (error); } vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); if (VOP_GETVOBJECT(vp, &obj) == 0) { vm_object_page_clean(obj, 0, 0, 0); } error = VOP_FSYNC(vp, fp->f_cred, MNT_WAIT, td); if (error == 0 && vp->v_mount && (vp->v_mount->mnt_flag & MNT_SOFTDEP) && softdep_fsync_hook != NULL) error = (*softdep_fsync_hook)(vp); VOP_UNLOCK(vp, 0, td); vn_finished_write(mp); fdrop(fp, td); return (error); } /* * Rename files. Source and destination must either both be directories, * or both not be directories. If target is a directory, it must be empty. */ #ifndef _SYS_SYSPROTO_H_ struct rename_args { char *from; char *to; }; #endif /* ARGSUSED */ int rename(td, uap) struct thread *td; register struct rename_args /* { syscallarg(char *) from; syscallarg(char *) to; } */ *uap; { return (kern_rename(td, uap->from, uap->to, UIO_USERSPACE)); } int kern_rename(struct thread *td, char *from, char *to, enum uio_seg pathseg) { struct mount *mp; struct vnode *tvp, *fvp, *tdvp; struct nameidata fromnd, tond; int error; bwillwrite(); NDINIT(&fromnd, DELETE, WANTPARENT | SAVESTART, pathseg, from, td); if ((error = namei(&fromnd)) != 0) return (error); fvp = fromnd.ni_vp; if ((error = vn_start_write(fvp, &mp, V_WAIT | PCATCH)) != 0) { NDFREE(&fromnd, NDF_ONLY_PNBUF); vrele(fromnd.ni_dvp); vrele(fvp); goto out1; } NDINIT(&tond, RENAME, LOCKPARENT | LOCKLEAF | NOCACHE | SAVESTART | NOOBJ, pathseg, to, td); if (fromnd.ni_vp->v_type == VDIR) tond.ni_cnd.cn_flags |= WILLBEDIR; if ((error = namei(&tond)) != 0) { /* Translate error code for rename("dir1", "dir2/."). */ if (error == EISDIR && fvp->v_type == VDIR) error = EINVAL; NDFREE(&fromnd, NDF_ONLY_PNBUF); vrele(fromnd.ni_dvp); vrele(fvp); goto out1; } tdvp = tond.ni_dvp; tvp = tond.ni_vp; if (tvp != NULL) { if (fvp->v_type == VDIR && tvp->v_type != VDIR) { error = ENOTDIR; goto out; } else if (fvp->v_type != VDIR && tvp->v_type == VDIR) { error = EISDIR; goto out; } } if (fvp == tdvp) error = EINVAL; /* * If the source is the same as the destination (that is, if they * are links to the same vnode), then there is nothing to do. */ if (fvp == tvp) error = -1; out: if (!error) { VOP_LEASE(tdvp, td, td->td_ucred, LEASE_WRITE); if (fromnd.ni_dvp != tdvp) { VOP_LEASE(fromnd.ni_dvp, td, td->td_ucred, LEASE_WRITE); } if (tvp) { VOP_LEASE(tvp, td, td->td_ucred, LEASE_WRITE); } error = VOP_RENAME(fromnd.ni_dvp, fromnd.ni_vp, &fromnd.ni_cnd, tond.ni_dvp, tond.ni_vp, &tond.ni_cnd); NDFREE(&fromnd, NDF_ONLY_PNBUF); NDFREE(&tond, NDF_ONLY_PNBUF); } else { NDFREE(&fromnd, NDF_ONLY_PNBUF); NDFREE(&tond, NDF_ONLY_PNBUF); if (tdvp == tvp) vrele(tdvp); else vput(tdvp); if (tvp) vput(tvp); vrele(fromnd.ni_dvp); vrele(fvp); } vrele(tond.ni_startdir); vn_finished_write(mp); ASSERT_VOP_UNLOCKED(fromnd.ni_dvp, "rename"); ASSERT_VOP_UNLOCKED(fromnd.ni_vp, "rename"); ASSERT_VOP_UNLOCKED(tond.ni_dvp, "rename"); ASSERT_VOP_UNLOCKED(tond.ni_vp, "rename"); out1: if (fromnd.ni_startdir) vrele(fromnd.ni_startdir); if (error == -1) return (0); return (error); } /* * Make a directory file. */ #ifndef _SYS_SYSPROTO_H_ struct mkdir_args { char *path; int mode; }; #endif /* ARGSUSED */ int mkdir(td, uap) struct thread *td; register struct mkdir_args /* { syscallarg(char *) path; syscallarg(int) mode; } */ *uap; { return (kern_mkdir(td, uap->path, UIO_USERSPACE, uap->mode)); } int kern_mkdir(struct thread *td, char *path, enum uio_seg segflg, int mode) { struct mount *mp; struct vnode *vp; struct vattr vattr; int error; struct nameidata nd; restart: bwillwrite(); NDINIT(&nd, CREATE, LOCKPARENT | SAVENAME, segflg, path, td); nd.ni_cnd.cn_flags |= WILLBEDIR; if ((error = namei(&nd)) != 0) return (error); vp = nd.ni_vp; if (vp != NULL) { NDFREE(&nd, NDF_ONLY_PNBUF); vrele(vp); /* * XXX namei called with LOCKPARENT but not LOCKLEAF has * the strange behaviour of leaving the vnode unlocked * if the target is the same vnode as the parent. */ if (vp == nd.ni_dvp) vrele(nd.ni_dvp); else vput(nd.ni_dvp); return (EEXIST); } if (vn_start_write(nd.ni_dvp, &mp, V_NOWAIT) != 0) { NDFREE(&nd, NDF_ONLY_PNBUF); vput(nd.ni_dvp); if ((error = vn_start_write(NULL, &mp, V_XSLEEP | PCATCH)) != 0) return (error); goto restart; } VATTR_NULL(&vattr); vattr.va_type = VDIR; FILEDESC_LOCK(td->td_proc->p_fd); vattr.va_mode = (mode & ACCESSPERMS) &~ td->td_proc->p_fd->fd_cmask; FILEDESC_UNLOCK(td->td_proc->p_fd); VOP_LEASE(nd.ni_dvp, td, td->td_ucred, LEASE_WRITE); error = VOP_MKDIR(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &vattr); NDFREE(&nd, NDF_ONLY_PNBUF); vput(nd.ni_dvp); if (!error) vput(nd.ni_vp); vn_finished_write(mp); ASSERT_VOP_UNLOCKED(nd.ni_dvp, "mkdir"); ASSERT_VOP_UNLOCKED(nd.ni_vp, "mkdir"); return (error); } /* * Remove a directory file. */ #ifndef _SYS_SYSPROTO_H_ struct rmdir_args { char *path; }; #endif /* ARGSUSED */ int rmdir(td, uap) struct thread *td; struct rmdir_args /* { syscallarg(char *) path; } */ *uap; { return (kern_rmdir(td, uap->path, UIO_USERSPACE)); } int kern_rmdir(struct thread *td, char *path, enum uio_seg pathseg) { struct mount *mp; struct vnode *vp; int error; struct nameidata nd; restart: bwillwrite(); NDINIT(&nd, DELETE, LOCKPARENT | LOCKLEAF, pathseg, path, td); if ((error = namei(&nd)) != 0) return (error); vp = nd.ni_vp; if (vp->v_type != VDIR) { error = ENOTDIR; goto out; } /* * No rmdir "." please. */ if (nd.ni_dvp == vp) { error = EINVAL; goto out; } /* * The root of a mounted filesystem cannot be deleted. */ if (vp->v_vflag & VV_ROOT) { error = EBUSY; goto out; } if (vn_start_write(nd.ni_dvp, &mp, V_NOWAIT) != 0) { NDFREE(&nd, NDF_ONLY_PNBUF); if (nd.ni_dvp == vp) vrele(nd.ni_dvp); else vput(nd.ni_dvp); vput(vp); if ((error = vn_start_write(NULL, &mp, V_XSLEEP | PCATCH)) != 0) return (error); goto restart; } VOP_LEASE(nd.ni_dvp, td, td->td_ucred, LEASE_WRITE); VOP_LEASE(vp, td, td->td_ucred, LEASE_WRITE); error = VOP_RMDIR(nd.ni_dvp, nd.ni_vp, &nd.ni_cnd); vn_finished_write(mp); out: NDFREE(&nd, NDF_ONLY_PNBUF); if (nd.ni_dvp == vp) vrele(nd.ni_dvp); else vput(nd.ni_dvp); vput(vp); ASSERT_VOP_UNLOCKED(nd.ni_dvp, "rmdir"); ASSERT_VOP_UNLOCKED(nd.ni_vp, "rmdir"); return (error); } #ifdef COMPAT_43 /* * Read a block of directory entries in a filesystem independent format. */ #ifndef _SYS_SYSPROTO_H_ struct ogetdirentries_args { int fd; char *buf; u_int count; long *basep; }; #endif int ogetdirentries(td, uap) struct thread *td; register struct ogetdirentries_args /* { syscallarg(int) fd; syscallarg(char *) buf; syscallarg(u_int) count; syscallarg(long *) basep; } */ *uap; { struct vnode *vp; struct file *fp; struct uio auio, kuio; struct iovec aiov, kiov; struct dirent *dp, *edp; caddr_t dirbuf; int error, eofflag, readcnt; long loff; /* XXX arbitrary sanity limit on `count'. */ if (SCARG(uap, count) > 64 * 1024) return (EINVAL); if ((error = getvnode(td->td_proc->p_fd, SCARG(uap, fd), &fp)) != 0) return (error); if ((fp->f_flag & FREAD) == 0) { fdrop(fp, td); return (EBADF); } vp = (struct vnode *)fp->f_data; unionread: if (vp->v_type != VDIR) { fdrop(fp, td); return (EINVAL); } aiov.iov_base = SCARG(uap, buf); aiov.iov_len = SCARG(uap, count); auio.uio_iov = &aiov; auio.uio_iovcnt = 1; auio.uio_rw = UIO_READ; auio.uio_segflg = UIO_USERSPACE; auio.uio_td = td; auio.uio_resid = SCARG(uap, count); vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); loff = auio.uio_offset = fp->f_offset; #ifdef MAC error = mac_check_vnode_readdir(td->td_ucred, vp); if (error) { VOP_UNLOCK(vp, 0, td); fdrop(fp, td); return (error); } #endif # if (BYTE_ORDER != LITTLE_ENDIAN) if (vp->v_mount->mnt_maxsymlinklen <= 0) { error = VOP_READDIR(vp, &auio, fp->f_cred, &eofflag, NULL, NULL); fp->f_offset = auio.uio_offset; } else # endif { kuio = auio; kuio.uio_iov = &kiov; kuio.uio_segflg = UIO_SYSSPACE; kiov.iov_len = SCARG(uap, count); MALLOC(dirbuf, caddr_t, SCARG(uap, count), M_TEMP, M_WAITOK); kiov.iov_base = dirbuf; error = VOP_READDIR(vp, &kuio, fp->f_cred, &eofflag, NULL, NULL); fp->f_offset = kuio.uio_offset; if (error == 0) { readcnt = SCARG(uap, count) - kuio.uio_resid; edp = (struct dirent *)&dirbuf[readcnt]; for (dp = (struct dirent *)dirbuf; dp < edp; ) { # if (BYTE_ORDER == LITTLE_ENDIAN) /* * The expected low byte of * dp->d_namlen is our dp->d_type. * The high MBZ byte of dp->d_namlen * is our dp->d_namlen. */ dp->d_type = dp->d_namlen; dp->d_namlen = 0; # else /* * The dp->d_type is the high byte * of the expected dp->d_namlen, * so must be zero'ed. */ dp->d_type = 0; # endif if (dp->d_reclen > 0) { dp = (struct dirent *) ((char *)dp + dp->d_reclen); } else { error = EIO; break; } } if (dp >= edp) error = uiomove(dirbuf, readcnt, &auio); } FREE(dirbuf, M_TEMP); } VOP_UNLOCK(vp, 0, td); if (error) { fdrop(fp, td); return (error); } if (SCARG(uap, count) == auio.uio_resid) { if (union_dircheckp) { error = union_dircheckp(td, &vp, fp); if (error == -1) goto unionread; if (error) { fdrop(fp, td); return (error); } } /* * XXX We could delay dropping the lock above but * union_dircheckp complicates things. */ vn_lock(vp, LK_EXCLUSIVE|LK_RETRY, td); if ((vp->v_vflag & VV_ROOT) && (vp->v_mount->mnt_flag & MNT_UNION)) { struct vnode *tvp = vp; vp = vp->v_mount->mnt_vnodecovered; VREF(vp); fp->f_data = vp; fp->f_offset = 0; vput(tvp); goto unionread; } VOP_UNLOCK(vp, 0, td); } error = copyout(&loff, SCARG(uap, basep), sizeof(long)); fdrop(fp, td); td->td_retval[0] = SCARG(uap, count) - auio.uio_resid; return (error); } #endif /* COMPAT_43 */ /* * Read a block of directory entries in a filesystem independent format. */ #ifndef _SYS_SYSPROTO_H_ struct getdirentries_args { int fd; char *buf; u_int count; long *basep; }; #endif int getdirentries(td, uap) struct thread *td; register struct getdirentries_args /* { syscallarg(int) fd; syscallarg(char *) buf; syscallarg(u_int) count; syscallarg(long *) basep; } */ *uap; { struct vnode *vp; struct file *fp; struct uio auio; struct iovec aiov; long loff; int error, eofflag; if ((error = getvnode(td->td_proc->p_fd, SCARG(uap, fd), &fp)) != 0) return (error); if ((fp->f_flag & FREAD) == 0) { fdrop(fp, td); return (EBADF); } vp = (struct vnode *)fp->f_data; unionread: if (vp->v_type != VDIR) { fdrop(fp, td); return (EINVAL); } aiov.iov_base = SCARG(uap, buf); aiov.iov_len = SCARG(uap, count); auio.uio_iov = &aiov; auio.uio_iovcnt = 1; auio.uio_rw = UIO_READ; auio.uio_segflg = UIO_USERSPACE; auio.uio_td = td; auio.uio_resid = SCARG(uap, count); /* vn_lock(vp, LK_SHARED | LK_RETRY, td); */ vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); loff = auio.uio_offset = fp->f_offset; #ifdef MAC error = mac_check_vnode_readdir(td->td_ucred, vp); if (error == 0) #endif error = VOP_READDIR(vp, &auio, fp->f_cred, &eofflag, NULL, NULL); fp->f_offset = auio.uio_offset; VOP_UNLOCK(vp, 0, td); if (error) { fdrop(fp, td); return (error); } if (SCARG(uap, count) == auio.uio_resid) { if (union_dircheckp) { error = union_dircheckp(td, &vp, fp); if (error == -1) goto unionread; if (error) { fdrop(fp, td); return (error); } } /* * XXX We could delay dropping the lock above but * union_dircheckp complicates things. */ vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); if ((vp->v_vflag & VV_ROOT) && (vp->v_mount->mnt_flag & MNT_UNION)) { struct vnode *tvp = vp; vp = vp->v_mount->mnt_vnodecovered; VREF(vp); fp->f_data = vp; fp->f_offset = 0; vput(tvp); goto unionread; } VOP_UNLOCK(vp, 0, td); } if (SCARG(uap, basep) != NULL) { error = copyout(&loff, SCARG(uap, basep), sizeof(long)); } td->td_retval[0] = SCARG(uap, count) - auio.uio_resid; fdrop(fp, td); return (error); } #ifndef _SYS_SYSPROTO_H_ struct getdents_args { int fd; char *buf; size_t count; }; #endif int getdents(td, uap) struct thread *td; register struct getdents_args /* { syscallarg(int) fd; syscallarg(char *) buf; syscallarg(u_int) count; } */ *uap; { struct getdirentries_args ap; ap.fd = uap->fd; ap.buf = uap->buf; ap.count = uap->count; ap.basep = NULL; return getdirentries(td, &ap); } /* * Set the mode mask for creation of filesystem nodes. * * MP SAFE */ #ifndef _SYS_SYSPROTO_H_ struct umask_args { int newmask; }; #endif int umask(td, uap) struct thread *td; struct umask_args /* { syscallarg(int) newmask; } */ *uap; { register struct filedesc *fdp; FILEDESC_LOCK(td->td_proc->p_fd); fdp = td->td_proc->p_fd; td->td_retval[0] = fdp->fd_cmask; fdp->fd_cmask = SCARG(uap, newmask) & ALLPERMS; FILEDESC_UNLOCK(td->td_proc->p_fd); return (0); } /* * Void all references to file by ripping underlying filesystem * away from vnode. */ #ifndef _SYS_SYSPROTO_H_ struct revoke_args { char *path; }; #endif /* ARGSUSED */ int revoke(td, uap) struct thread *td; register struct revoke_args /* { syscallarg(char *) path; } */ *uap; { struct mount *mp; struct vnode *vp; struct vattr vattr; int error; struct nameidata nd; NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF, UIO_USERSPACE, SCARG(uap, path), td); if ((error = namei(&nd)) != 0) return (error); vp = nd.ni_vp; NDFREE(&nd, NDF_ONLY_PNBUF); if (vp->v_type != VCHR) { vput(vp); return (EINVAL); } #ifdef MAC error = mac_check_vnode_revoke(td->td_ucred, vp); if (error) { vput(vp); return (error); } #endif error = VOP_GETATTR(vp, &vattr, td->td_ucred, td); if (error) { vput(vp); return (error); } VOP_UNLOCK(vp, 0, td); if (td->td_ucred->cr_uid != vattr.va_uid) { error = suser_cred(td->td_ucred, PRISON_ROOT); if (error) goto out; } if ((error = vn_start_write(vp, &mp, V_WAIT | PCATCH)) != 0) goto out; if (vcount(vp) > 1) VOP_REVOKE(vp, REVOKEALL); vn_finished_write(mp); out: vrele(vp); return (error); } /* * Convert a user file descriptor to a kernel file entry. * The file entry is locked upon returning. */ int getvnode(fdp, fd, fpp) struct filedesc *fdp; int fd; struct file **fpp; { int error; struct file *fp; fp = NULL; if (fdp == NULL) error = EBADF; else { FILEDESC_LOCK(fdp); if ((u_int)fd >= fdp->fd_nfiles || (fp = fdp->fd_ofiles[fd]) == NULL) error = EBADF; else if (fp->f_type != DTYPE_VNODE && fp->f_type != DTYPE_FIFO) { fp = NULL; error = EINVAL; } else { fhold(fp); error = 0; } FILEDESC_UNLOCK(fdp); } *fpp = fp; return (error); } /* * Get (NFS) file handle */ #ifndef _SYS_SYSPROTO_H_ struct getfh_args { char *fname; fhandle_t *fhp; }; #endif int getfh(td, uap) struct thread *td; register struct getfh_args *uap; { struct nameidata nd; fhandle_t fh; register struct vnode *vp; int error; /* * Must be super user */ error = suser(td); if (error) return (error); NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF, UIO_USERSPACE, uap->fname, td); error = namei(&nd); if (error) return (error); NDFREE(&nd, NDF_ONLY_PNBUF); vp = nd.ni_vp; bzero(&fh, sizeof(fh)); fh.fh_fsid = vp->v_mount->mnt_stat.f_fsid; error = VFS_VPTOFH(vp, &fh.fh_fid); vput(vp); if (error) return (error); error = copyout(&fh, uap->fhp, sizeof (fh)); return (error); } /* * syscall for the rpc.lockd to use to translate a NFS file handle into * an open descriptor. * * warning: do not remove the suser() call or this becomes one giant * security hole. */ #ifndef _SYS_SYSPROTO_H_ struct fhopen_args { const struct fhandle *u_fhp; int flags; }; #endif int fhopen(td, uap) struct thread *td; struct fhopen_args /* { syscallarg(const struct fhandle *) u_fhp; syscallarg(int) flags; } */ *uap; { struct proc *p = td->td_proc; struct mount *mp; struct vnode *vp; struct fhandle fhp; struct vattr vat; struct vattr *vap = &vat; struct flock lf; struct file *fp; register struct filedesc *fdp = p->p_fd; int fmode, mode, error, type; struct file *nfp; int indx; /* * Must be super user */ error = suser(td); if (error) return (error); fmode = FFLAGS(SCARG(uap, flags)); /* why not allow a non-read/write open for our lockd? */ if (((fmode & (FREAD | FWRITE)) == 0) || (fmode & O_CREAT)) return (EINVAL); error = copyin(SCARG(uap,u_fhp), &fhp, sizeof(fhp)); if (error) return(error); /* find the mount point */ mp = vfs_getvfs(&fhp.fh_fsid); if (mp == NULL) return (ESTALE); /* now give me my vnode, it gets returned to me locked */ error = VFS_FHTOVP(mp, &fhp.fh_fid, &vp); if (error) return (error); /* * from now on we have to make sure not * to forget about the vnode * any error that causes an abort must vput(vp) * just set error = err and 'goto bad;'. */ /* * from vn_open */ if (vp->v_type == VLNK) { error = EMLINK; goto bad; } if (vp->v_type == VSOCK) { error = EOPNOTSUPP; goto bad; } mode = 0; if (fmode & (FWRITE | O_TRUNC)) { if (vp->v_type == VDIR) { error = EISDIR; goto bad; } error = vn_writechk(vp); if (error) goto bad; mode |= VWRITE; } if (fmode & FREAD) mode |= VREAD; if (fmode & O_APPEND) mode |= VAPPEND; #ifdef MAC error = mac_check_vnode_open(td->td_ucred, vp, mode); if (error) goto bad; #endif if (mode) { error = VOP_ACCESS(vp, mode, td->td_ucred, td); if (error) goto bad; } if (fmode & O_TRUNC) { VOP_UNLOCK(vp, 0, td); /* XXX */ if ((error = vn_start_write(NULL, &mp, V_WAIT | PCATCH)) != 0) { vrele(vp); return (error); } VOP_LEASE(vp, td, td->td_ucred, LEASE_WRITE); vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); /* XXX */ #ifdef MAC /* * We don't yet have fp->f_cred, so use td->td_ucred, which * should be right. */ error = mac_check_vnode_write(td->td_ucred, td->td_ucred, vp); if (error == 0) { #endif VATTR_NULL(vap); vap->va_size = 0; error = VOP_SETATTR(vp, vap, td->td_ucred, td); #ifdef MAC } #endif vn_finished_write(mp); if (error) goto bad; } error = VOP_OPEN(vp, fmode, td->td_ucred, td); if (error) goto bad; /* * Make sure that a VM object is created for VMIO support. */ if (vn_canvmio(vp) == TRUE) { if ((error = vfs_object_create(vp, td, td->td_ucred)) != 0) goto bad; } if (fmode & FWRITE) vp->v_writecount++; /* * end of vn_open code */ if ((error = falloc(td, &nfp, &indx)) != 0) { if (fmode & FWRITE) vp->v_writecount--; goto bad; } fp = nfp; /* * Hold an extra reference to avoid having fp ripped out * from under us while we block in the lock op */ fhold(fp); nfp->f_data = vp; nfp->f_flag = fmode & FMASK; nfp->f_ops = &vnops; nfp->f_type = DTYPE_VNODE; if (fmode & (O_EXLOCK | O_SHLOCK)) { lf.l_whence = SEEK_SET; lf.l_start = 0; lf.l_len = 0; if (fmode & O_EXLOCK) lf.l_type = F_WRLCK; else lf.l_type = F_RDLCK; type = F_FLOCK; if ((fmode & FNONBLOCK) == 0) type |= F_WAIT; VOP_UNLOCK(vp, 0, td); if ((error = VOP_ADVLOCK(vp, (caddr_t)fp, F_SETLK, &lf, type)) != 0) { /* * The lock request failed. Normally close the * descriptor but handle the case where someone might * have dup()d or close()d it when we weren't looking. */ FILEDESC_LOCK(fdp); if (fdp->fd_ofiles[indx] == fp) { fdp->fd_ofiles[indx] = NULL; FILEDESC_UNLOCK(fdp); fdrop(fp, td); } else FILEDESC_UNLOCK(fdp); /* * release our private reference */ fdrop(fp, td); return(error); } vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); fp->f_flag |= FHASLOCK; } if ((vp->v_type == VREG) && (VOP_GETVOBJECT(vp, NULL) != 0)) vfs_object_create(vp, td, td->td_ucred); VOP_UNLOCK(vp, 0, td); fdrop(fp, td); td->td_retval[0] = indx; return (0); bad: vput(vp); return (error); } /* * Stat an (NFS) file handle. */ #ifndef _SYS_SYSPROTO_H_ struct fhstat_args { struct fhandle *u_fhp; struct stat *sb; }; #endif int fhstat(td, uap) struct thread *td; register struct fhstat_args /* { syscallarg(struct fhandle *) u_fhp; syscallarg(struct stat *) sb; } */ *uap; { struct stat sb; fhandle_t fh; struct mount *mp; struct vnode *vp; int error; /* * Must be super user */ error = suser(td); if (error) return (error); error = copyin(SCARG(uap, u_fhp), &fh, sizeof(fhandle_t)); if (error) return (error); if ((mp = vfs_getvfs(&fh.fh_fsid)) == NULL) return (ESTALE); if ((error = VFS_FHTOVP(mp, &fh.fh_fid, &vp))) return (error); error = vn_stat(vp, &sb, td->td_ucred, NOCRED, td); vput(vp); if (error) return (error); error = copyout(&sb, SCARG(uap, sb), sizeof(sb)); return (error); } /* * Implement fstatfs() for (NFS) file handles. */ #ifndef _SYS_SYSPROTO_H_ struct fhstatfs_args { struct fhandle *u_fhp; struct statfs *buf; }; #endif int fhstatfs(td, uap) struct thread *td; struct fhstatfs_args /* { syscallarg(struct fhandle) *u_fhp; syscallarg(struct statfs) *buf; } */ *uap; { struct statfs *sp; struct mount *mp; struct vnode *vp; struct statfs sb; fhandle_t fh; int error; /* * Must be super user */ error = suser(td); if (error) return (error); if ((error = copyin(SCARG(uap, u_fhp), &fh, sizeof(fhandle_t))) != 0) return (error); if ((mp = vfs_getvfs(&fh.fh_fsid)) == NULL) return (ESTALE); if ((error = VFS_FHTOVP(mp, &fh.fh_fid, &vp))) return (error); mp = vp->v_mount; sp = &mp->mnt_stat; vput(vp); #ifdef MAC error = mac_check_mount_stat(td->td_ucred, mp); if (error) return (error); #endif if ((error = VFS_STATFS(mp, sp, td)) != 0) return (error); sp->f_flags = mp->mnt_flag & MNT_VISFLAGMASK; if (suser(td)) { bcopy(sp, &sb, sizeof(sb)); sb.f_fsid.val[0] = sb.f_fsid.val[1] = 0; sp = &sb; } return (copyout(sp, SCARG(uap, buf), sizeof(*sp))); } /* * Syscall to push extended attribute configuration information into the * VFS. Accepts a path, which it converts to a mountpoint, as well as * a command (int cmd), and attribute name and misc data. For now, the * attribute name is left in userspace for consumption by the VFS_op. * It will probably be changed to be copied into sysspace by the * syscall in the future, once issues with various consumers of the * attribute code have raised their hands. * * Currently this is used only by UFS Extended Attributes. */ int extattrctl(td, uap) struct thread *td; struct extattrctl_args /* { syscallarg(const char *) path; syscallarg(int) cmd; syscallarg(const char *) filename; syscallarg(int) attrnamespace; syscallarg(const char *) attrname; } */ *uap; { struct vnode *filename_vp; struct nameidata nd; struct mount *mp, *mp_writable; char attrname[EXTATTR_MAXNAMELEN]; int error; /* * uap->attrname is not always defined. We check again later when we * invoke the VFS call so as to pass in NULL there if needed. */ if (uap->attrname != NULL) { error = copyinstr(uap->attrname, attrname, EXTATTR_MAXNAMELEN, NULL); if (error) return (error); } /* * uap->filename is not always defined. If it is, grab a vnode lock, * which VFS_EXTATTRCTL() will later release. */ filename_vp = NULL; if (uap->filename != NULL) { NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF, UIO_USERSPACE, uap->filename, td); if ((error = namei(&nd)) != 0) return (error); filename_vp = nd.ni_vp; NDFREE(&nd, NDF_NO_VP_RELE | NDF_NO_VP_UNLOCK); } /* uap->path is always defined. */ NDINIT(&nd, LOOKUP, FOLLOW, UIO_USERSPACE, uap->path, td); if ((error = namei(&nd)) != 0) { if (filename_vp != NULL) vput(filename_vp); return (error); } mp = nd.ni_vp->v_mount; error = vn_start_write(nd.ni_vp, &mp_writable, V_WAIT | PCATCH); NDFREE(&nd, 0); if (error) { if (filename_vp != NULL) vput(filename_vp); return (error); } error = VFS_EXTATTRCTL(mp, uap->cmd, filename_vp, uap->attrnamespace, uap->attrname != NULL ? attrname : NULL, td); vn_finished_write(mp_writable); /* * VFS_EXTATTRCTL will have unlocked, but not de-ref'd, * filename_vp, so vrele it if it is defined. */ if (filename_vp != NULL) vrele(filename_vp); return (error); } /*- * Set a named extended attribute on a file or directory * * Arguments: unlocked vnode "vp", attribute namespace "attrnamespace", * kernelspace string pointer "attrname", userspace buffer * pointer "data", buffer length "nbytes", thread "td". * Returns: 0 on success, an error number otherwise * Locks: none * References: vp must be a valid reference for the duration of the call */ static int extattr_set_vp(struct vnode *vp, int attrnamespace, const char *attrname, void *data, size_t nbytes, struct thread *td) { struct mount *mp; struct uio auio; struct iovec aiov; ssize_t cnt; int error; if ((error = vn_start_write(vp, &mp, V_WAIT | PCATCH)) != 0) return (error); VOP_LEASE(vp, td, td->td_ucred, LEASE_WRITE); vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); aiov.iov_base = data; aiov.iov_len = nbytes; auio.uio_iov = &aiov; auio.uio_iovcnt = 1; auio.uio_offset = 0; if (nbytes > INT_MAX) { error = EINVAL; goto done; } auio.uio_resid = nbytes; auio.uio_rw = UIO_WRITE; auio.uio_segflg = UIO_USERSPACE; auio.uio_td = td; cnt = nbytes; #ifdef MAC error = mac_check_vnode_setextattr(td->td_ucred, vp, attrnamespace, attrname, &auio); if (error) goto done; #endif error = VOP_SETEXTATTR(vp, attrnamespace, attrname, &auio, td->td_ucred, td); cnt -= auio.uio_resid; td->td_retval[0] = cnt; done: VOP_UNLOCK(vp, 0, td); vn_finished_write(mp); return (error); } int extattr_set_file(td, uap) struct thread *td; struct extattr_set_file_args /* { syscallarg(const char *) path; syscallarg(int) attrnamespace; syscallarg(const char *) attrname; syscallarg(void *) data; syscallarg(size_t) nbytes; } */ *uap; { struct nameidata nd; char attrname[EXTATTR_MAXNAMELEN]; int error; error = copyinstr(uap->attrname, attrname, EXTATTR_MAXNAMELEN, NULL); if (error) return (error); NDINIT(&nd, LOOKUP, FOLLOW, UIO_USERSPACE, uap->path, td); if ((error = namei(&nd)) != 0) return (error); NDFREE(&nd, NDF_ONLY_PNBUF); error = extattr_set_vp(nd.ni_vp, uap->attrnamespace, attrname, uap->data, uap->nbytes, td); vrele(nd.ni_vp); return (error); } int extattr_set_fd(td, uap) struct thread *td; struct extattr_set_fd_args /* { syscallarg(int) fd; syscallarg(int) attrnamespace; syscallarg(const char *) attrname; syscallarg(void *) data; syscallarg(size_t) nbytes; } */ *uap; { struct file *fp; char attrname[EXTATTR_MAXNAMELEN]; int error; error = copyinstr(uap->attrname, attrname, EXTATTR_MAXNAMELEN, NULL); if (error) return (error); if ((error = getvnode(td->td_proc->p_fd, uap->fd, &fp)) != 0) return (error); error = extattr_set_vp((struct vnode *)fp->f_data, uap->attrnamespace, attrname, uap->data, uap->nbytes, td); fdrop(fp, td); return (error); } /*- * Get a named extended attribute on a file or directory * * Arguments: unlocked vnode "vp", attribute namespace "attrnamespace", * kernelspace string pointer "attrname", userspace buffer * pointer "data", buffer length "nbytes", thread "td". * Returns: 0 on success, an error number otherwise * Locks: none * References: vp must be a valid reference for the duration of the call */ static int extattr_get_vp(struct vnode *vp, int attrnamespace, const char *attrname, void *data, size_t nbytes, struct thread *td) { struct uio auio, *auiop; struct iovec aiov; ssize_t cnt; size_t size, *sizep; int error; VOP_LEASE(vp, td, td->td_ucred, LEASE_READ); vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); /* * Slightly unusual semantics: if the user provides a NULL data * pointer, they don't want to receive the data, just the * maximum read length. */ auiop = NULL; sizep = NULL; cnt = 0; if (data != NULL) { aiov.iov_base = data; aiov.iov_len = nbytes; auio.uio_iov = &aiov; auio.uio_offset = 0; if (nbytes > INT_MAX) { error = EINVAL; goto done; } auio.uio_resid = nbytes; auio.uio_rw = UIO_READ; auio.uio_segflg = UIO_USERSPACE; auio.uio_td = td; auiop = &auio; cnt = nbytes; } else sizep = &size; #ifdef MAC error = mac_check_vnode_getextattr(td->td_ucred, vp, attrnamespace, attrname, &auio); if (error) goto done; #endif error = VOP_GETEXTATTR(vp, attrnamespace, attrname, auiop, sizep, td->td_ucred, td); if (auiop != NULL) { cnt -= auio.uio_resid; td->td_retval[0] = cnt; } else td->td_retval[0] = size; done: VOP_UNLOCK(vp, 0, td); return (error); } int extattr_get_file(td, uap) struct thread *td; struct extattr_get_file_args /* { syscallarg(const char *) path; syscallarg(int) attrnamespace; syscallarg(const char *) attrname; syscallarg(void *) data; syscallarg(size_t) nbytes; } */ *uap; { struct nameidata nd; char attrname[EXTATTR_MAXNAMELEN]; int error; error = copyinstr(uap->attrname, attrname, EXTATTR_MAXNAMELEN, NULL); if (error) return (error); NDINIT(&nd, LOOKUP, FOLLOW, UIO_USERSPACE, uap->path, td); if ((error = namei(&nd)) != 0) return (error); NDFREE(&nd, NDF_ONLY_PNBUF); error = extattr_get_vp(nd.ni_vp, uap->attrnamespace, attrname, uap->data, uap->nbytes, td); vrele(nd.ni_vp); return (error); } int extattr_get_fd(td, uap) struct thread *td; struct extattr_get_fd_args /* { syscallarg(int) fd; syscallarg(int) attrnamespace; syscallarg(const char *) attrname; syscallarg(void *) data; syscallarg(size_t) nbytes; } */ *uap; { struct file *fp; char attrname[EXTATTR_MAXNAMELEN]; int error; error = copyinstr(uap->attrname, attrname, EXTATTR_MAXNAMELEN, NULL); if (error) return (error); if ((error = getvnode(td->td_proc->p_fd, uap->fd, &fp)) != 0) return (error); error = extattr_get_vp((struct vnode *)fp->f_data, uap->attrnamespace, attrname, uap->data, uap->nbytes, td); fdrop(fp, td); return (error); } /* * extattr_delete_vp(): Delete a named extended attribute on a file or * directory * * Arguments: unlocked vnode "vp", attribute namespace "attrnamespace", * kernelspace string pointer "attrname", proc "p" * Returns: 0 on success, an error number otherwise * Locks: none * References: vp must be a valid reference for the duration of the call */ static int extattr_delete_vp(struct vnode *vp, int attrnamespace, const char *attrname, struct thread *td) { struct mount *mp; int error; if ((error = vn_start_write(vp, &mp, V_WAIT | PCATCH)) != 0) return (error); VOP_LEASE(vp, td, td->td_ucred, LEASE_WRITE); vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); #ifdef MAC error = mac_check_vnode_setextattr(td->td_ucred, vp, attrnamespace, attrname, NULL); #endif error = VOP_SETEXTATTR(vp, attrnamespace, attrname, NULL, td->td_ucred, td); VOP_UNLOCK(vp, 0, td); vn_finished_write(mp); return (error); } int extattr_delete_file(td, uap) struct thread *td; struct extattr_delete_file_args /* { syscallarg(const char *) path; syscallarg(int) attrnamespace; syscallarg(const char *) attrname; } */ *uap; { struct nameidata nd; char attrname[EXTATTR_MAXNAMELEN]; int error; error = copyinstr(uap->attrname, attrname, EXTATTR_MAXNAMELEN, NULL); if (error) return(error); NDINIT(&nd, LOOKUP, FOLLOW, UIO_USERSPACE, uap->path, td); if ((error = namei(&nd)) != 0) return(error); NDFREE(&nd, NDF_ONLY_PNBUF); error = extattr_delete_vp(nd.ni_vp, uap->attrnamespace, attrname, td); vrele(nd.ni_vp); return(error); } int extattr_delete_fd(td, uap) struct thread *td; struct extattr_delete_fd_args /* { syscallarg(int) fd; syscallarg(int) attrnamespace; syscallarg(const char *) attrname; } */ *uap; { struct file *fp; struct vnode *vp; char attrname[EXTATTR_MAXNAMELEN]; int error; error = copyinstr(uap->attrname, attrname, EXTATTR_MAXNAMELEN, NULL); if (error) return (error); if ((error = getvnode(td->td_proc->p_fd, uap->fd, &fp)) != 0) return (error); vp = (struct vnode *)fp->f_data; error = extattr_delete_vp(vp, uap->attrnamespace, attrname, td); fdrop(fp, td); return (error); } Index: head/sys/security/mac/mac_framework.c =================================================================== --- head/sys/security/mac/mac_framework.c (revision 104528) +++ head/sys/security/mac/mac_framework.c (revision 104529) @@ -1,3432 +1,3462 @@ /*- * Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson * Copyright (c) 2001 Ilmar S. Habibulin * Copyright (c) 2001, 2002 Networks Associates Technology, Inc. * All rights reserved. * * This software was developed by Robert Watson and Ilmar Habibulin for the * TrustedBSD Project. * * This software was developed for the FreeBSD Project in part by NAI Labs, * the Security Research Division of Network Associates, Inc. under * DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA * CHATS research program. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * 3. The names of the authors may not be used to endorse or promote * products derived from this software without specific prior written * permission. * * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. * * $FreeBSD$ */ /* * Developed by the TrustedBSD Project. * * Framework for extensible kernel access control. Kernel and userland * interface to the framework, policy registration and composition. */ #include "opt_mac.h" #include "opt_devfs.h" #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #ifdef MAC /* * Declare that the kernel provides MAC support, version 1. This permits * modules to refuse to be loaded if the necessary support isn't present, * even if it's pre-boot. */ MODULE_VERSION(kernel_mac_support, 1); SYSCTL_DECL(_security); SYSCTL_NODE(_security, OID_AUTO, mac, CTLFLAG_RW, 0, "TrustedBSD MAC policy controls"); #ifndef MAC_MAX_POLICIES #define MAC_MAX_POLICIES 8 #endif #if MAC_MAX_POLICIES > 32 #error "MAC_MAX_POLICIES too large" #endif static unsigned int mac_max_policies = MAC_MAX_POLICIES; static unsigned int mac_policy_offsets_free = (1 << MAC_MAX_POLICIES) - 1; SYSCTL_UINT(_security_mac, OID_AUTO, max_policies, CTLFLAG_RD, &mac_max_policies, 0, ""); static int mac_late = 0; static int mac_enforce_fs = 1; SYSCTL_INT(_security_mac, OID_AUTO, enforce_fs, CTLFLAG_RW, &mac_enforce_fs, 0, "Enforce MAC policy on file system objects"); TUNABLE_INT("security.mac.enforce_fs", &mac_enforce_fs); static int mac_enforce_network = 1; SYSCTL_INT(_security_mac, OID_AUTO, enforce_network, CTLFLAG_RW, &mac_enforce_network, 0, "Enforce MAC policy on network packets"); TUNABLE_INT("security.mac.enforce_network", &mac_enforce_network); static int mac_enforce_pipe = 1; SYSCTL_INT(_security_mac, OID_AUTO, enforce_pipe, CTLFLAG_RW, &mac_enforce_pipe, 0, "Enforce MAC policy on pipe operations"); TUNABLE_INT("security.mac.enforce_pipe", &mac_enforce_pipe); static int mac_enforce_process = 1; SYSCTL_INT(_security_mac, OID_AUTO, enforce_process, CTLFLAG_RW, &mac_enforce_process, 0, "Enforce MAC policy on inter-process operations"); TUNABLE_INT("security.mac.enforce_process", &mac_enforce_process); static int mac_enforce_socket = 1; SYSCTL_INT(_security_mac, OID_AUTO, enforce_socket, CTLFLAG_RW, &mac_enforce_socket, 0, "Enforce MAC policy on socket operations"); TUNABLE_INT("security.mac.enforce_socket", &mac_enforce_socket); static int mac_enforce_vm = 1; SYSCTL_INT(_security_mac, OID_AUTO, enforce_vm, CTLFLAG_RW, &mac_enforce_vm, 0, "Enforce MAC policy on vm operations"); TUNABLE_INT("security.mac.enforce_vm", &mac_enforce_vm); static int mac_label_size = sizeof(struct mac); SYSCTL_INT(_security_mac, OID_AUTO, label_size, CTLFLAG_RD, &mac_label_size, 0, "Pre-compiled MAC label size"); static int mac_cache_fslabel_in_vnode = 1; SYSCTL_INT(_security_mac, OID_AUTO, cache_fslabel_in_vnode, CTLFLAG_RW, &mac_cache_fslabel_in_vnode, 0, "Cache mount fslabel in vnode"); TUNABLE_INT("security.mac.cache_fslabel_in_vnode", &mac_cache_fslabel_in_vnode); static int mac_vnode_label_cache_hits = 0; SYSCTL_INT(_security_mac, OID_AUTO, vnode_label_cache_hits, CTLFLAG_RD, &mac_vnode_label_cache_hits, 0, "Cache hits on vnode labels"); static int mac_vnode_label_cache_misses = 0; SYSCTL_INT(_security_mac, OID_AUTO, vnode_label_cache_misses, CTLFLAG_RD, &mac_vnode_label_cache_misses, 0, "Cache misses on vnode labels"); static int mac_mmap_revocation = 1; SYSCTL_INT(_security_mac, OID_AUTO, mmap_revocation, CTLFLAG_RW, &mac_mmap_revocation, 0, "Revoke mmap access to files on subject " "relabel"); static int mac_mmap_revocation_via_cow = 0; SYSCTL_INT(_security_mac, OID_AUTO, mmap_revocation_via_cow, CTLFLAG_RW, &mac_mmap_revocation_via_cow, 0, "Revoke mmap access to files via " "copy-on-write semantics, or by removing all write access"); #ifdef MAC_DEBUG SYSCTL_NODE(_security_mac, OID_AUTO, debug, CTLFLAG_RW, 0, "TrustedBSD MAC debug info"); static int mac_debug_label_fallback = 0; SYSCTL_INT(_security_mac_debug, OID_AUTO, label_fallback, CTLFLAG_RW, &mac_debug_label_fallback, 0, "Filesystems should fall back to fs label" "when label is corrupted."); TUNABLE_INT("security.mac.debug_label_fallback", &mac_debug_label_fallback); SYSCTL_NODE(_security_mac_debug, OID_AUTO, counters, CTLFLAG_RW, 0, "TrustedBSD MAC object counters"); static unsigned int nmacmbufs, nmaccreds, nmacifnets, nmacbpfdescs, nmacsockets, nmacmounts, nmactemp, nmacvnodes, nmacdevfsdirents, nmacipqs, nmacpipes; SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, mbufs, CTLFLAG_RD, &nmacmbufs, 0, "number of mbufs in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, creds, CTLFLAG_RD, &nmaccreds, 0, "number of ucreds in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, ifnets, CTLFLAG_RD, &nmacifnets, 0, "number of ifnets in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, ipqs, CTLFLAG_RD, &nmacipqs, 0, "number of ipqs in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, bpfdescs, CTLFLAG_RD, &nmacbpfdescs, 0, "number of bpfdescs in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, sockets, CTLFLAG_RD, &nmacsockets, 0, "number of sockets in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, pipes, CTLFLAG_RD, &nmacpipes, 0, "number of pipes in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, mounts, CTLFLAG_RD, &nmacmounts, 0, "number of mounts in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, temp, CTLFLAG_RD, &nmactemp, 0, "number of temporary labels in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, vnodes, CTLFLAG_RD, &nmacvnodes, 0, "number of vnodes in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, devfsdirents, CTLFLAG_RD, &nmacdevfsdirents, 0, "number of devfs dirents inuse"); #endif static int error_select(int error1, int error2); static int mac_externalize(struct label *label, struct mac *mac); static int mac_policy_register(struct mac_policy_conf *mpc); static int mac_policy_unregister(struct mac_policy_conf *mpc); static int mac_stdcreatevnode_ea(struct vnode *vp); static void mac_cred_mmapped_drop_perms(struct thread *td, struct ucred *cred); static void mac_cred_mmapped_drop_perms_recurse(struct thread *td, struct ucred *cred, struct vm_map *map); MALLOC_DEFINE(M_MACOPVEC, "macopvec", "MAC policy operation vector"); MALLOC_DEFINE(M_MACPIPELABEL, "macpipelabel", "MAC labels for pipes"); /* * mac_policy_list_lock protects the consistency of 'mac_policy_list', * the linked list of attached policy modules. Read-only consumers of * the list must acquire a shared lock for the duration of their use; * writers must acquire an exclusive lock. Note that for compound * operations, locks should be held for the entire compound operation, * and that this is not yet done for relabel requests. */ static struct mtx mac_policy_list_lock; static LIST_HEAD(, mac_policy_conf) mac_policy_list; static int mac_policy_list_busy; #define MAC_POLICY_LIST_LOCKINIT() mtx_init(&mac_policy_list_lock, \ "mac_policy_list_lock", NULL, MTX_DEF); #define MAC_POLICY_LIST_LOCK() mtx_lock(&mac_policy_list_lock); #define MAC_POLICY_LIST_UNLOCK() mtx_unlock(&mac_policy_list_lock); #define MAC_POLICY_LIST_BUSY() do { \ MAC_POLICY_LIST_LOCK(); \ mac_policy_list_busy++; \ MAC_POLICY_LIST_UNLOCK(); \ } while (0) #define MAC_POLICY_LIST_UNBUSY() do { \ MAC_POLICY_LIST_LOCK(); \ mac_policy_list_busy--; \ if (mac_policy_list_busy < 0) \ panic("Extra mac_policy_list_busy--"); \ MAC_POLICY_LIST_UNLOCK(); \ } while (0) /* * MAC_CHECK performs the designated check by walking the policy * module list and checking with each as to how it feels about the * request. Note that it returns its value via 'error' in the scope * of the caller. */ #define MAC_CHECK(check, args...) do { \ struct mac_policy_conf *mpc; \ \ error = 0; \ MAC_POLICY_LIST_BUSY(); \ LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { \ if (mpc->mpc_ops->mpo_ ## check != NULL) \ error = error_select( \ mpc->mpc_ops->mpo_ ## check (args), \ error); \ } \ MAC_POLICY_LIST_UNBUSY(); \ } while (0) /* * MAC_BOOLEAN performs the designated boolean composition by walking * the module list, invoking each instance of the operation, and * combining the results using the passed C operator. Note that it * returns its value via 'result' in the scope of the caller, which * should be initialized by the caller in a meaningful way to get * a meaningful result. */ #define MAC_BOOLEAN(operation, composition, args...) do { \ struct mac_policy_conf *mpc; \ \ MAC_POLICY_LIST_BUSY(); \ LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { \ if (mpc->mpc_ops->mpo_ ## operation != NULL) \ result = result composition \ mpc->mpc_ops->mpo_ ## operation (args); \ } \ MAC_POLICY_LIST_UNBUSY(); \ } while (0) /* * MAC_PERFORM performs the designated operation by walking the policy * module list and invoking that operation for each policy. */ #define MAC_PERFORM(operation, args...) do { \ struct mac_policy_conf *mpc; \ \ MAC_POLICY_LIST_BUSY(); \ LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { \ if (mpc->mpc_ops->mpo_ ## operation != NULL) \ mpc->mpc_ops->mpo_ ## operation (args); \ } \ MAC_POLICY_LIST_UNBUSY(); \ } while (0) /* * Initialize the MAC subsystem, including appropriate SMP locks. */ static void mac_init(void) { LIST_INIT(&mac_policy_list); MAC_POLICY_LIST_LOCKINIT(); } /* * For the purposes of modules that want to know if they were loaded * "early", set the mac_late flag once we've processed modules either * linked into the kernel, or loaded before the kernel startup. */ static void mac_late_init(void) { mac_late = 1; } /* * Allow MAC policy modules to register during boot, etc. */ int mac_policy_modevent(module_t mod, int type, void *data) { struct mac_policy_conf *mpc; int error; error = 0; mpc = (struct mac_policy_conf *) data; switch (type) { case MOD_LOAD: if (mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_NOTLATE && mac_late) { printf("mac_policy_modevent: can't load %s policy " "after booting\n", mpc->mpc_name); error = EBUSY; break; } error = mac_policy_register(mpc); break; case MOD_UNLOAD: /* Don't unregister the module if it was never registered. */ if ((mpc->mpc_runtime_flags & MPC_RUNTIME_FLAG_REGISTERED) != 0) error = mac_policy_unregister(mpc); else error = 0; break; default: break; } return (error); } static int mac_policy_register(struct mac_policy_conf *mpc) { struct mac_policy_conf *tmpc; struct mac_policy_op_entry *mpe; int slot; MALLOC(mpc->mpc_ops, struct mac_policy_ops *, sizeof(*mpc->mpc_ops), M_MACOPVEC, M_WAITOK | M_ZERO); for (mpe = mpc->mpc_entries; mpe->mpe_constant != MAC_OP_LAST; mpe++) { switch (mpe->mpe_constant) { case MAC_OP_LAST: /* * Doesn't actually happen, but this allows checking * that all enumerated values are handled. */ break; case MAC_DESTROY: mpc->mpc_ops->mpo_destroy = mpe->mpe_function; break; case MAC_INIT: mpc->mpc_ops->mpo_init = mpe->mpe_function; break; case MAC_SYSCALL: mpc->mpc_ops->mpo_syscall = mpe->mpe_function; break; case MAC_INIT_BPFDESC_LABEL: mpc->mpc_ops->mpo_init_bpfdesc_label = mpe->mpe_function; break; case MAC_INIT_CRED_LABEL: mpc->mpc_ops->mpo_init_cred_label = mpe->mpe_function; break; case MAC_INIT_DEVFSDIRENT_LABEL: mpc->mpc_ops->mpo_init_devfsdirent_label = mpe->mpe_function; break; case MAC_INIT_IFNET_LABEL: mpc->mpc_ops->mpo_init_ifnet_label = mpe->mpe_function; break; case MAC_INIT_IPQ_LABEL: mpc->mpc_ops->mpo_init_ipq_label = mpe->mpe_function; break; case MAC_INIT_MBUF_LABEL: mpc->mpc_ops->mpo_init_mbuf_label = mpe->mpe_function; break; case MAC_INIT_MOUNT_LABEL: mpc->mpc_ops->mpo_init_mount_label = mpe->mpe_function; break; case MAC_INIT_MOUNT_FS_LABEL: mpc->mpc_ops->mpo_init_mount_fs_label = mpe->mpe_function; break; case MAC_INIT_PIPE_LABEL: mpc->mpc_ops->mpo_init_pipe_label = mpe->mpe_function; break; case MAC_INIT_SOCKET_LABEL: mpc->mpc_ops->mpo_init_socket_label = mpe->mpe_function; break; case MAC_INIT_SOCKET_PEER_LABEL: mpc->mpc_ops->mpo_init_socket_peer_label = mpe->mpe_function; break; case MAC_INIT_TEMP_LABEL: mpc->mpc_ops->mpo_init_temp_label = mpe->mpe_function; break; case MAC_INIT_VNODE_LABEL: mpc->mpc_ops->mpo_init_vnode_label = mpe->mpe_function; break; case MAC_DESTROY_BPFDESC_LABEL: mpc->mpc_ops->mpo_destroy_bpfdesc_label = mpe->mpe_function; break; case MAC_DESTROY_CRED_LABEL: mpc->mpc_ops->mpo_destroy_cred_label = mpe->mpe_function; break; case MAC_DESTROY_DEVFSDIRENT_LABEL: mpc->mpc_ops->mpo_destroy_devfsdirent_label = mpe->mpe_function; break; case MAC_DESTROY_IFNET_LABEL: mpc->mpc_ops->mpo_destroy_ifnet_label = mpe->mpe_function; break; case MAC_DESTROY_IPQ_LABEL: mpc->mpc_ops->mpo_destroy_ipq_label = mpe->mpe_function; break; case MAC_DESTROY_MBUF_LABEL: mpc->mpc_ops->mpo_destroy_mbuf_label = mpe->mpe_function; break; case MAC_DESTROY_MOUNT_LABEL: mpc->mpc_ops->mpo_destroy_mount_label = mpe->mpe_function; break; case MAC_DESTROY_MOUNT_FS_LABEL: mpc->mpc_ops->mpo_destroy_mount_fs_label = mpe->mpe_function; break; case MAC_DESTROY_PIPE_LABEL: mpc->mpc_ops->mpo_destroy_pipe_label = mpe->mpe_function; break; case MAC_DESTROY_SOCKET_LABEL: mpc->mpc_ops->mpo_destroy_socket_label = mpe->mpe_function; break; case MAC_DESTROY_SOCKET_PEER_LABEL: mpc->mpc_ops->mpo_destroy_socket_peer_label = mpe->mpe_function; break; case MAC_DESTROY_TEMP_LABEL: mpc->mpc_ops->mpo_destroy_temp_label = mpe->mpe_function; break; case MAC_DESTROY_VNODE_LABEL: mpc->mpc_ops->mpo_destroy_vnode_label = mpe->mpe_function; break; case MAC_EXTERNALIZE: mpc->mpc_ops->mpo_externalize = mpe->mpe_function; break; case MAC_INTERNALIZE: mpc->mpc_ops->mpo_internalize = mpe->mpe_function; break; case MAC_CREATE_DEVFS_DEVICE: mpc->mpc_ops->mpo_create_devfs_device = mpe->mpe_function; break; case MAC_CREATE_DEVFS_DIRECTORY: mpc->mpc_ops->mpo_create_devfs_directory = mpe->mpe_function; break; case MAC_CREATE_DEVFS_VNODE: mpc->mpc_ops->mpo_create_devfs_vnode = mpe->mpe_function; break; case MAC_STDCREATEVNODE_EA: mpc->mpc_ops->mpo_stdcreatevnode_ea = mpe->mpe_function; break; case MAC_CREATE_VNODE: mpc->mpc_ops->mpo_create_vnode = mpe->mpe_function; break; case MAC_CREATE_MOUNT: mpc->mpc_ops->mpo_create_mount = mpe->mpe_function; break; case MAC_CREATE_ROOT_MOUNT: mpc->mpc_ops->mpo_create_root_mount = mpe->mpe_function; break; case MAC_RELABEL_VNODE: mpc->mpc_ops->mpo_relabel_vnode = mpe->mpe_function; break; case MAC_UPDATE_DEVFSDIRENT: mpc->mpc_ops->mpo_update_devfsdirent = mpe->mpe_function; break; case MAC_UPDATE_PROCFSVNODE: mpc->mpc_ops->mpo_update_procfsvnode = mpe->mpe_function; break; case MAC_UPDATE_VNODE_FROM_EXTATTR: mpc->mpc_ops->mpo_update_vnode_from_extattr = mpe->mpe_function; break; case MAC_UPDATE_VNODE_FROM_EXTERNALIZED: mpc->mpc_ops->mpo_update_vnode_from_externalized = mpe->mpe_function; break; case MAC_UPDATE_VNODE_FROM_MOUNT: mpc->mpc_ops->mpo_update_vnode_from_mount = mpe->mpe_function; break; case MAC_CREATE_MBUF_FROM_SOCKET: mpc->mpc_ops->mpo_create_mbuf_from_socket = mpe->mpe_function; break; case MAC_CREATE_PIPE: mpc->mpc_ops->mpo_create_pipe = mpe->mpe_function; break; case MAC_CREATE_SOCKET: mpc->mpc_ops->mpo_create_socket = mpe->mpe_function; break; case MAC_CREATE_SOCKET_FROM_SOCKET: mpc->mpc_ops->mpo_create_socket_from_socket = mpe->mpe_function; break; case MAC_RELABEL_PIPE: mpc->mpc_ops->mpo_relabel_pipe = mpe->mpe_function; break; case MAC_RELABEL_SOCKET: mpc->mpc_ops->mpo_relabel_socket = mpe->mpe_function; break; case MAC_SET_SOCKET_PEER_FROM_MBUF: mpc->mpc_ops->mpo_set_socket_peer_from_mbuf = mpe->mpe_function; break; case MAC_SET_SOCKET_PEER_FROM_SOCKET: mpc->mpc_ops->mpo_set_socket_peer_from_socket = mpe->mpe_function; break; case MAC_CREATE_BPFDESC: mpc->mpc_ops->mpo_create_bpfdesc = mpe->mpe_function; break; case MAC_CREATE_DATAGRAM_FROM_IPQ: mpc->mpc_ops->mpo_create_datagram_from_ipq = mpe->mpe_function; break; case MAC_CREATE_FRAGMENT: mpc->mpc_ops->mpo_create_fragment = mpe->mpe_function; break; case MAC_CREATE_IFNET: mpc->mpc_ops->mpo_create_ifnet = mpe->mpe_function; break; case MAC_CREATE_IPQ: mpc->mpc_ops->mpo_create_ipq = mpe->mpe_function; break; case MAC_CREATE_MBUF_FROM_MBUF: mpc->mpc_ops->mpo_create_mbuf_from_mbuf = mpe->mpe_function; break; case MAC_CREATE_MBUF_LINKLAYER: mpc->mpc_ops->mpo_create_mbuf_linklayer = mpe->mpe_function; break; case MAC_CREATE_MBUF_FROM_BPFDESC: mpc->mpc_ops->mpo_create_mbuf_from_bpfdesc = mpe->mpe_function; break; case MAC_CREATE_MBUF_FROM_IFNET: mpc->mpc_ops->mpo_create_mbuf_from_ifnet = mpe->mpe_function; break; case MAC_CREATE_MBUF_MULTICAST_ENCAP: mpc->mpc_ops->mpo_create_mbuf_multicast_encap = mpe->mpe_function; break; case MAC_CREATE_MBUF_NETLAYER: mpc->mpc_ops->mpo_create_mbuf_netlayer = mpe->mpe_function; break; case MAC_FRAGMENT_MATCH: mpc->mpc_ops->mpo_fragment_match = mpe->mpe_function; break; case MAC_RELABEL_IFNET: mpc->mpc_ops->mpo_relabel_ifnet = mpe->mpe_function; break; case MAC_UPDATE_IPQ: mpc->mpc_ops->mpo_update_ipq = mpe->mpe_function; break; case MAC_CREATE_CRED: mpc->mpc_ops->mpo_create_cred = mpe->mpe_function; break; case MAC_EXECVE_TRANSITION: mpc->mpc_ops->mpo_execve_transition = mpe->mpe_function; break; case MAC_EXECVE_WILL_TRANSITION: mpc->mpc_ops->mpo_execve_will_transition = mpe->mpe_function; break; case MAC_CREATE_PROC0: mpc->mpc_ops->mpo_create_proc0 = mpe->mpe_function; break; case MAC_CREATE_PROC1: mpc->mpc_ops->mpo_create_proc1 = mpe->mpe_function; break; case MAC_RELABEL_CRED: mpc->mpc_ops->mpo_relabel_cred = mpe->mpe_function; break; case MAC_THREAD_USERRET: mpc->mpc_ops->mpo_thread_userret = mpe->mpe_function; break; case MAC_CHECK_BPFDESC_RECEIVE: mpc->mpc_ops->mpo_check_bpfdesc_receive = mpe->mpe_function; break; case MAC_CHECK_CRED_RELABEL: mpc->mpc_ops->mpo_check_cred_relabel = mpe->mpe_function; break; case MAC_CHECK_CRED_VISIBLE: mpc->mpc_ops->mpo_check_cred_visible = mpe->mpe_function; break; case MAC_CHECK_IFNET_RELABEL: mpc->mpc_ops->mpo_check_ifnet_relabel = mpe->mpe_function; break; case MAC_CHECK_IFNET_TRANSMIT: mpc->mpc_ops->mpo_check_ifnet_transmit = mpe->mpe_function; break; case MAC_CHECK_MOUNT_STAT: mpc->mpc_ops->mpo_check_mount_stat = mpe->mpe_function; break; case MAC_CHECK_PIPE_IOCTL: mpc->mpc_ops->mpo_check_pipe_ioctl = mpe->mpe_function; break; case MAC_CHECK_PIPE_POLL: mpc->mpc_ops->mpo_check_pipe_poll = mpe->mpe_function; break; case MAC_CHECK_PIPE_READ: mpc->mpc_ops->mpo_check_pipe_read = mpe->mpe_function; break; case MAC_CHECK_PIPE_RELABEL: mpc->mpc_ops->mpo_check_pipe_relabel = mpe->mpe_function; break; case MAC_CHECK_PIPE_STAT: mpc->mpc_ops->mpo_check_pipe_stat = mpe->mpe_function; break; case MAC_CHECK_PIPE_WRITE: mpc->mpc_ops->mpo_check_pipe_write = mpe->mpe_function; break; case MAC_CHECK_PROC_DEBUG: mpc->mpc_ops->mpo_check_proc_debug = mpe->mpe_function; break; case MAC_CHECK_PROC_SCHED: mpc->mpc_ops->mpo_check_proc_sched = mpe->mpe_function; break; case MAC_CHECK_PROC_SIGNAL: mpc->mpc_ops->mpo_check_proc_signal = mpe->mpe_function; break; case MAC_CHECK_SOCKET_BIND: mpc->mpc_ops->mpo_check_socket_bind = mpe->mpe_function; break; case MAC_CHECK_SOCKET_CONNECT: mpc->mpc_ops->mpo_check_socket_connect = mpe->mpe_function; break; case MAC_CHECK_SOCKET_DELIVER: mpc->mpc_ops->mpo_check_socket_deliver = mpe->mpe_function; break; case MAC_CHECK_SOCKET_LISTEN: mpc->mpc_ops->mpo_check_socket_listen = mpe->mpe_function; break; case MAC_CHECK_SOCKET_RELABEL: mpc->mpc_ops->mpo_check_socket_relabel = mpe->mpe_function; break; case MAC_CHECK_SOCKET_VISIBLE: mpc->mpc_ops->mpo_check_socket_visible = mpe->mpe_function; break; case MAC_CHECK_VNODE_ACCESS: mpc->mpc_ops->mpo_check_vnode_access = mpe->mpe_function; break; case MAC_CHECK_VNODE_CHDIR: mpc->mpc_ops->mpo_check_vnode_chdir = mpe->mpe_function; break; case MAC_CHECK_VNODE_CHROOT: mpc->mpc_ops->mpo_check_vnode_chroot = mpe->mpe_function; break; case MAC_CHECK_VNODE_CREATE: mpc->mpc_ops->mpo_check_vnode_create = mpe->mpe_function; break; case MAC_CHECK_VNODE_DELETE: mpc->mpc_ops->mpo_check_vnode_delete = mpe->mpe_function; break; case MAC_CHECK_VNODE_DELETEACL: mpc->mpc_ops->mpo_check_vnode_deleteacl = mpe->mpe_function; break; case MAC_CHECK_VNODE_EXEC: mpc->mpc_ops->mpo_check_vnode_exec = mpe->mpe_function; break; case MAC_CHECK_VNODE_GETACL: mpc->mpc_ops->mpo_check_vnode_getacl = mpe->mpe_function; break; case MAC_CHECK_VNODE_GETEXTATTR: mpc->mpc_ops->mpo_check_vnode_getextattr = mpe->mpe_function; break; + case MAC_CHECK_VNODE_LINK: + mpc->mpc_ops->mpo_check_vnode_link = + mpe->mpe_function; + break; case MAC_CHECK_VNODE_LOOKUP: mpc->mpc_ops->mpo_check_vnode_lookup = mpe->mpe_function; break; case MAC_CHECK_VNODE_MMAP_PERMS: mpc->mpc_ops->mpo_check_vnode_mmap_perms = mpe->mpe_function; break; case MAC_CHECK_VNODE_OPEN: mpc->mpc_ops->mpo_check_vnode_open = mpe->mpe_function; break; case MAC_CHECK_VNODE_POLL: mpc->mpc_ops->mpo_check_vnode_poll = mpe->mpe_function; break; case MAC_CHECK_VNODE_READ: mpc->mpc_ops->mpo_check_vnode_read = mpe->mpe_function; break; case MAC_CHECK_VNODE_READDIR: mpc->mpc_ops->mpo_check_vnode_readdir = mpe->mpe_function; break; case MAC_CHECK_VNODE_READLINK: mpc->mpc_ops->mpo_check_vnode_readlink = mpe->mpe_function; break; case MAC_CHECK_VNODE_RELABEL: mpc->mpc_ops->mpo_check_vnode_relabel = mpe->mpe_function; break; case MAC_CHECK_VNODE_RENAME_FROM: mpc->mpc_ops->mpo_check_vnode_rename_from = mpe->mpe_function; break; case MAC_CHECK_VNODE_RENAME_TO: mpc->mpc_ops->mpo_check_vnode_rename_to = mpe->mpe_function; break; case MAC_CHECK_VNODE_REVOKE: mpc->mpc_ops->mpo_check_vnode_revoke = mpe->mpe_function; break; case MAC_CHECK_VNODE_SETACL: mpc->mpc_ops->mpo_check_vnode_setacl = mpe->mpe_function; break; case MAC_CHECK_VNODE_SETEXTATTR: mpc->mpc_ops->mpo_check_vnode_setextattr = mpe->mpe_function; break; case MAC_CHECK_VNODE_SETFLAGS: mpc->mpc_ops->mpo_check_vnode_setflags = mpe->mpe_function; break; case MAC_CHECK_VNODE_SETMODE: mpc->mpc_ops->mpo_check_vnode_setmode = mpe->mpe_function; break; case MAC_CHECK_VNODE_SETOWNER: mpc->mpc_ops->mpo_check_vnode_setowner = mpe->mpe_function; break; case MAC_CHECK_VNODE_SETUTIMES: mpc->mpc_ops->mpo_check_vnode_setutimes = mpe->mpe_function; break; case MAC_CHECK_VNODE_STAT: mpc->mpc_ops->mpo_check_vnode_stat = mpe->mpe_function; break; case MAC_CHECK_VNODE_WRITE: mpc->mpc_ops->mpo_check_vnode_write = mpe->mpe_function; break; /* default: printf("MAC policy `%s': unknown operation %d\n", mpc->mpc_name, mpe->mpe_constant); return (EINVAL); */ } } MAC_POLICY_LIST_LOCK(); if (mac_policy_list_busy > 0) { MAC_POLICY_LIST_UNLOCK(); FREE(mpc->mpc_ops, M_MACOPVEC); mpc->mpc_ops = NULL; return (EBUSY); } LIST_FOREACH(tmpc, &mac_policy_list, mpc_list) { if (strcmp(tmpc->mpc_name, mpc->mpc_name) == 0) { MAC_POLICY_LIST_UNLOCK(); FREE(mpc->mpc_ops, M_MACOPVEC); mpc->mpc_ops = NULL; return (EEXIST); } } if (mpc->mpc_field_off != NULL) { slot = ffs(mac_policy_offsets_free); if (slot == 0) { MAC_POLICY_LIST_UNLOCK(); FREE(mpc->mpc_ops, M_MACOPVEC); mpc->mpc_ops = NULL; return (ENOMEM); } slot--; mac_policy_offsets_free &= ~(1 << slot); *mpc->mpc_field_off = slot; } mpc->mpc_runtime_flags |= MPC_RUNTIME_FLAG_REGISTERED; LIST_INSERT_HEAD(&mac_policy_list, mpc, mpc_list); /* Per-policy initialization. */ if (mpc->mpc_ops->mpo_init != NULL) (*(mpc->mpc_ops->mpo_init))(mpc); MAC_POLICY_LIST_UNLOCK(); printf("Security policy loaded: %s (%s)\n", mpc->mpc_fullname, mpc->mpc_name); return (0); } static int mac_policy_unregister(struct mac_policy_conf *mpc) { /* * If we fail the load, we may get a request to unload. Check * to see if we did the run-time registration, and if not, * silently succeed. */ MAC_POLICY_LIST_LOCK(); if ((mpc->mpc_runtime_flags & MPC_RUNTIME_FLAG_REGISTERED) == 0) { MAC_POLICY_LIST_UNLOCK(); return (0); } #if 0 /* * Don't allow unloading modules with private data. */ if (mpc->mpc_field_off != NULL) { MAC_POLICY_LIST_UNLOCK(); return (EBUSY); } #endif /* * Only allow the unload to proceed if the module is unloadable * by its own definition. */ if ((mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_UNLOADOK) == 0) { MAC_POLICY_LIST_UNLOCK(); return (EBUSY); } /* * Right now, we EBUSY if the list is in use. In the future, * for reliability reasons, we might want to sleep and wakeup * later to try again. */ if (mac_policy_list_busy > 0) { MAC_POLICY_LIST_UNLOCK(); return (EBUSY); } if (mpc->mpc_ops->mpo_destroy != NULL) (*(mpc->mpc_ops->mpo_destroy))(mpc); LIST_REMOVE(mpc, mpc_list); MAC_POLICY_LIST_UNLOCK(); FREE(mpc->mpc_ops, M_MACOPVEC); mpc->mpc_ops = NULL; printf("Security policy unload: %s (%s)\n", mpc->mpc_fullname, mpc->mpc_name); return (0); } /* * Define an error value precedence, and given two arguments, selects the * value with the higher precedence. */ static int error_select(int error1, int error2) { /* Certain decision-making errors take top priority. */ if (error1 == EDEADLK || error2 == EDEADLK) return (EDEADLK); /* Invalid arguments should be reported where possible. */ if (error1 == EINVAL || error2 == EINVAL) return (EINVAL); /* Precedence goes to "visibility", with both process and file. */ if (error1 == ESRCH || error2 == ESRCH) return (ESRCH); if (error1 == ENOENT || error2 == ENOENT) return (ENOENT); /* Precedence goes to DAC/MAC protections. */ if (error1 == EACCES || error2 == EACCES) return (EACCES); /* Precedence goes to privilege. */ if (error1 == EPERM || error2 == EPERM) return (EPERM); /* Precedence goes to error over success; otherwise, arbitrary. */ if (error1 != 0) return (error1); return (error2); } static void mac_init_label(struct label *label) { bzero(label, sizeof(*label)); label->l_flags = MAC_FLAG_INITIALIZED; } static void mac_destroy_label(struct label *label) { KASSERT(label->l_flags & MAC_FLAG_INITIALIZED, ("destroying uninitialized label")); bzero(label, sizeof(*label)); /* implicit: label->l_flags &= ~MAC_FLAG_INITIALIZED; */ } static void mac_init_structmac(struct mac *mac) { bzero(mac, sizeof(*mac)); mac->m_macflags = MAC_FLAG_INITIALIZED; } void mac_init_bpfdesc(struct bpf_d *bpf_d) { mac_init_label(&bpf_d->bd_label); MAC_PERFORM(init_bpfdesc_label, &bpf_d->bd_label); #ifdef MAC_DEBUG atomic_add_int(&nmacbpfdescs, 1); #endif } void mac_init_cred(struct ucred *cr) { mac_init_label(&cr->cr_label); MAC_PERFORM(init_cred_label, &cr->cr_label); #ifdef MAC_DEBUG atomic_add_int(&nmaccreds, 1); #endif } void mac_init_devfsdirent(struct devfs_dirent *de) { mac_init_label(&de->de_label); MAC_PERFORM(init_devfsdirent_label, &de->de_label); #ifdef MAC_DEBUG atomic_add_int(&nmacdevfsdirents, 1); #endif } void mac_init_ifnet(struct ifnet *ifp) { mac_init_label(&ifp->if_label); MAC_PERFORM(init_ifnet_label, &ifp->if_label); #ifdef MAC_DEBUG atomic_add_int(&nmacifnets, 1); #endif } void mac_init_ipq(struct ipq *ipq) { mac_init_label(&ipq->ipq_label); MAC_PERFORM(init_ipq_label, &ipq->ipq_label); #ifdef MAC_DEBUG atomic_add_int(&nmacipqs, 1); #endif } int mac_init_mbuf(struct mbuf *m, int flag) { int error; KASSERT(m->m_flags & M_PKTHDR, ("mac_init_mbuf on non-header mbuf")); mac_init_label(&m->m_pkthdr.label); MAC_CHECK(init_mbuf_label, &m->m_pkthdr.label, flag); if (error) { MAC_PERFORM(destroy_mbuf_label, &m->m_pkthdr.label); mac_destroy_label(&m->m_pkthdr.label); } #ifdef MAC_DEBUG if (error == 0) atomic_add_int(&nmacmbufs, 1); #endif return (error); } void mac_init_mount(struct mount *mp) { mac_init_label(&mp->mnt_mntlabel); mac_init_label(&mp->mnt_fslabel); MAC_PERFORM(init_mount_label, &mp->mnt_mntlabel); MAC_PERFORM(init_mount_fs_label, &mp->mnt_fslabel); #ifdef MAC_DEBUG atomic_add_int(&nmacmounts, 1); #endif } void mac_init_pipe(struct pipe *pipe) { struct label *label; label = malloc(sizeof(struct label), M_MACPIPELABEL, M_ZERO|M_WAITOK); mac_init_label(label); pipe->pipe_label = label; pipe->pipe_peer->pipe_label = label; MAC_PERFORM(init_pipe_label, pipe->pipe_label); #ifdef MAC_DEBUG atomic_add_int(&nmacpipes, 1); #endif } void mac_init_socket(struct socket *socket) { mac_init_label(&socket->so_label); mac_init_label(&socket->so_peerlabel); MAC_PERFORM(init_socket_label, &socket->so_label); MAC_PERFORM(init_socket_peer_label, &socket->so_peerlabel); #ifdef MAC_DEBUG atomic_add_int(&nmacsockets, 1); #endif } static void mac_init_temp(struct label *label) { mac_init_label(label); MAC_PERFORM(init_temp_label, label); #ifdef MAC_DEBUG atomic_add_int(&nmactemp, 1); #endif } void mac_init_vnode(struct vnode *vp) { mac_init_label(&vp->v_label); MAC_PERFORM(init_vnode_label, &vp->v_label); #ifdef MAC_DEBUG atomic_add_int(&nmacvnodes, 1); #endif } void mac_destroy_bpfdesc(struct bpf_d *bpf_d) { MAC_PERFORM(destroy_bpfdesc_label, &bpf_d->bd_label); mac_destroy_label(&bpf_d->bd_label); #ifdef MAC_DEBUG atomic_subtract_int(&nmacbpfdescs, 1); #endif } void mac_destroy_cred(struct ucred *cr) { MAC_PERFORM(destroy_cred_label, &cr->cr_label); mac_destroy_label(&cr->cr_label); #ifdef MAC_DEBUG atomic_subtract_int(&nmaccreds, 1); #endif } void mac_destroy_devfsdirent(struct devfs_dirent *de) { MAC_PERFORM(destroy_devfsdirent_label, &de->de_label); mac_destroy_label(&de->de_label); #ifdef MAC_DEBUG atomic_subtract_int(&nmacdevfsdirents, 1); #endif } void mac_destroy_ifnet(struct ifnet *ifp) { MAC_PERFORM(destroy_ifnet_label, &ifp->if_label); mac_destroy_label(&ifp->if_label); #ifdef MAC_DEBUG atomic_subtract_int(&nmacifnets, 1); #endif } void mac_destroy_ipq(struct ipq *ipq) { MAC_PERFORM(destroy_ipq_label, &ipq->ipq_label); mac_destroy_label(&ipq->ipq_label); #ifdef MAC_DEBUG atomic_subtract_int(&nmacipqs, 1); #endif } void mac_destroy_mbuf(struct mbuf *m) { MAC_PERFORM(destroy_mbuf_label, &m->m_pkthdr.label); mac_destroy_label(&m->m_pkthdr.label); #ifdef MAC_DEBUG atomic_subtract_int(&nmacmbufs, 1); #endif } void mac_destroy_mount(struct mount *mp) { MAC_PERFORM(destroy_mount_label, &mp->mnt_mntlabel); MAC_PERFORM(destroy_mount_fs_label, &mp->mnt_fslabel); mac_destroy_label(&mp->mnt_fslabel); mac_destroy_label(&mp->mnt_mntlabel); #ifdef MAC_DEBUG atomic_subtract_int(&nmacmounts, 1); #endif } void mac_destroy_pipe(struct pipe *pipe) { MAC_PERFORM(destroy_pipe_label, pipe->pipe_label); mac_destroy_label(pipe->pipe_label); free(pipe->pipe_label, M_MACPIPELABEL); #ifdef MAC_DEBUG atomic_subtract_int(&nmacpipes, 1); #endif } void mac_destroy_socket(struct socket *socket) { MAC_PERFORM(destroy_socket_label, &socket->so_label); MAC_PERFORM(destroy_socket_peer_label, &socket->so_peerlabel); mac_destroy_label(&socket->so_label); mac_destroy_label(&socket->so_peerlabel); #ifdef MAC_DEBUG atomic_subtract_int(&nmacsockets, 1); #endif } static void mac_destroy_temp(struct label *label) { MAC_PERFORM(destroy_temp_label, label); mac_destroy_label(label); #ifdef MAC_DEBUG atomic_subtract_int(&nmactemp, 1); #endif } void mac_destroy_vnode(struct vnode *vp) { MAC_PERFORM(destroy_vnode_label, &vp->v_label); mac_destroy_label(&vp->v_label); #ifdef MAC_DEBUG atomic_subtract_int(&nmacvnodes, 1); #endif } static int mac_externalize(struct label *label, struct mac *mac) { int error; mac_init_structmac(mac); MAC_CHECK(externalize, label, mac); return (error); } static int mac_internalize(struct label *label, struct mac *mac) { int error; mac_init_temp(label); MAC_CHECK(internalize, label, mac); if (error) mac_destroy_temp(label); return (error); } /* * Initialize MAC label for the first kernel process, from which other * kernel processes and threads are spawned. */ void mac_create_proc0(struct ucred *cred) { MAC_PERFORM(create_proc0, cred); } /* * Initialize MAC label for the first userland process, from which other * userland processes and threads are spawned. */ void mac_create_proc1(struct ucred *cred) { MAC_PERFORM(create_proc1, cred); } void mac_thread_userret(struct thread *td) { MAC_PERFORM(thread_userret, td); } /* * When a new process is created, its label must be initialized. Generally, * this involves inheritence from the parent process, modulo possible * deltas. This function allows that processing to take place. */ void mac_create_cred(struct ucred *parent_cred, struct ucred *child_cred) { MAC_PERFORM(create_cred, parent_cred, child_cred); } void mac_update_devfsdirent(struct devfs_dirent *de, struct vnode *vp) { MAC_PERFORM(update_devfsdirent, de, &de->de_label, vp, &vp->v_label); } void mac_update_procfsvnode(struct vnode *vp, struct ucred *cred) { MAC_PERFORM(update_procfsvnode, vp, &vp->v_label, cred); } /* * Support callout for policies that manage their own externalization * using extended attributes. */ static int mac_update_vnode_from_extattr(struct vnode *vp, struct mount *mp) { int error; MAC_CHECK(update_vnode_from_extattr, vp, &vp->v_label, mp, &mp->mnt_fslabel); return (error); } /* * Given an externalized mac label, internalize it and stamp it on a * vnode. */ static int mac_update_vnode_from_externalized(struct vnode *vp, struct mac *extmac) { int error; MAC_CHECK(update_vnode_from_externalized, vp, &vp->v_label, extmac); return (error); } /* * Call out to individual policies to update the label in a vnode from * the mountpoint. */ void mac_update_vnode_from_mount(struct vnode *vp, struct mount *mp) { MAC_PERFORM(update_vnode_from_mount, vp, &vp->v_label, mp, &mp->mnt_fslabel); ASSERT_VOP_LOCKED(vp, "mac_update_vnode_from_mount"); if (mac_cache_fslabel_in_vnode) vp->v_vflag |= VV_CACHEDLABEL; } /* * Implementation of VOP_REFRESHLABEL() that relies on extended attributes * to store label data. Can be referenced by filesystems supporting * extended attributes. */ int vop_stdrefreshlabel_ea(struct vop_refreshlabel_args *ap) { struct vnode *vp = ap->a_vp; struct mac extmac; int buflen, error; ASSERT_VOP_LOCKED(vp, "vop_stdrefreshlabel_ea"); /* * Call out to external policies first. Order doesn't really * matter, as long as failure of one assures failure of all. */ error = mac_update_vnode_from_extattr(vp, vp->v_mount); if (error) return (error); buflen = sizeof(extmac); error = vn_extattr_get(vp, IO_NODELOCKED, FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME, &buflen, (char *)&extmac, curthread); switch (error) { case 0: /* Got it */ break; case ENOATTR: /* * Use the label from the mount point. */ mac_update_vnode_from_mount(vp, vp->v_mount); return (0); case EOPNOTSUPP: default: /* Fail horribly. */ return (error); } if (buflen != sizeof(extmac)) error = EPERM; /* Fail very closed. */ if (error == 0) error = mac_update_vnode_from_externalized(vp, &extmac); if (error == 0) vp->v_vflag |= VV_CACHEDLABEL; else { struct vattr va; printf("Corrupted label on %s", vp->v_mount->mnt_stat.f_mntonname); if (VOP_GETATTR(vp, &va, curthread->td_ucred, curthread) == 0) printf(" inum %ld", va.va_fileid); #ifdef MAC_DEBUG if (mac_debug_label_fallback) { printf(", falling back.\n"); mac_update_vnode_from_mount(vp, vp->v_mount); error = 0; } else { #endif printf(".\n"); error = EPERM; #ifdef MAC_DEBUG } #endif } return (error); } /* * Make sure the vnode label is up-to-date. If EOPNOTSUPP, then we handle * the labeling activity outselves. Filesystems should be careful not * to change their minds regarding whether they support vop_refreshlabel() * for a vnode or not. Don't cache the vnode here, allow the file * system code to determine if it's safe to cache. If we update from * the mount, don't cache since a change to the mount label should affect * all vnodes. */ static int vn_refreshlabel(struct vnode *vp, struct ucred *cred) { int error; ASSERT_VOP_LOCKED(vp, "vn_refreshlabel"); if (vp->v_mount == NULL) { /* Eventually, we probably want to special-case refreshing of deadfs vnodes, and if there's a lock-free race somewhere, that case might be handled here. mac_update_vnode_deadfs(vp); return (0); */ /* printf("vn_refreshlabel: null v_mount\n"); */ if (vp->v_type != VNON) printf( "vn_refreshlabel: null v_mount with non-VNON\n"); return (EBADF); } if (vp->v_vflag & VV_CACHEDLABEL) { mac_vnode_label_cache_hits++; return (0); } else mac_vnode_label_cache_misses++; if ((vp->v_mount->mnt_flag & MNT_MULTILABEL) == 0) { mac_update_vnode_from_mount(vp, vp->v_mount); return (0); } error = VOP_REFRESHLABEL(vp, cred, curthread); switch (error) { case EOPNOTSUPP: /* * If labels are not supported on this vnode, fall back to * the label in the mount and propagate it to the vnode. * There should probably be some sort of policy/flag/decision * about doing this. */ mac_update_vnode_from_mount(vp, vp->v_mount); error = 0; default: return (error); } } /* * Helper function for file systems using the vop_std*_ea() calls. This * function must be called after EA service is available for the vnode, * but before it's hooked up to the namespace so that the node persists * if there's a crash, or before it can be accessed. On successful * commit of the label to disk (etc), do cache the label. */ int vop_stdcreatevnode_ea(struct vnode *dvp, struct vnode *tvp, struct ucred *cred) { struct mac extmac; int error; ASSERT_VOP_LOCKED(tvp, "vop_stdcreatevnode_ea"); if ((dvp->v_mount->mnt_flag & MNT_MULTILABEL) == 0) { mac_update_vnode_from_mount(tvp, tvp->v_mount); } else { error = vn_refreshlabel(dvp, cred); if (error) return (error); /* * Stick the label in the vnode. Then try to write to * disk. If we fail, return a failure to abort the * create operation. Really, this failure shouldn't * happen except in fairly unusual circumstances (out * of disk, etc). */ mac_create_vnode(cred, dvp, tvp); error = mac_stdcreatevnode_ea(tvp); if (error) return (error); /* * XXX: Eventually this will go away and all policies will * directly manage their extended attributes. */ error = mac_externalize(&tvp->v_label, &extmac); if (error) return (error); error = vn_extattr_set(tvp, IO_NODELOCKED, FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME, sizeof(extmac), (char *)&extmac, curthread); if (error == 0) tvp->v_vflag |= VV_CACHEDLABEL; else { #if 0 /* * In theory, we could have fall-back behavior here. * It would probably be incorrect. */ #endif return (error); } } return (0); } void mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_execve_transition"); error = vn_refreshlabel(vp, old); if (error) { printf("mac_execve_transition: vn_refreshlabel returned %d\n", error); printf("mac_execve_transition: using old vnode label\n"); } MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label); } int mac_execve_will_transition(struct ucred *old, struct vnode *vp) { int error, result; error = vn_refreshlabel(vp, old); if (error) return (error); result = 0; MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label); return (result); } int mac_check_vnode_access(struct ucred *cred, struct vnode *vp, int flags) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_access"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_access, cred, vp, &vp->v_label, flags); return (error); } int mac_check_vnode_chdir(struct ucred *cred, struct vnode *dvp) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_chdir"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); MAC_CHECK(check_vnode_chdir, cred, dvp, &dvp->v_label); return (error); } int mac_check_vnode_chroot(struct ucred *cred, struct vnode *dvp) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_chroot"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); MAC_CHECK(check_vnode_chroot, cred, dvp, &dvp->v_label); return (error); } int mac_check_vnode_create(struct ucred *cred, struct vnode *dvp, struct componentname *cnp, struct vattr *vap) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_create"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); MAC_CHECK(check_vnode_create, cred, dvp, &dvp->v_label, cnp, vap); return (error); } int mac_check_vnode_delete(struct ucred *cred, struct vnode *dvp, struct vnode *vp, struct componentname *cnp) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_delete"); ASSERT_VOP_LOCKED(vp, "mac_check_vnode_delete"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_delete, cred, dvp, &dvp->v_label, vp, &vp->v_label, cnp); return (error); } int mac_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp, acl_type_t type) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_deleteacl"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_deleteacl, cred, vp, &vp->v_label, type); return (error); } int mac_check_vnode_exec(struct ucred *cred, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_exec"); if (!mac_enforce_process && !mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label); return (error); } int mac_check_vnode_getacl(struct ucred *cred, struct vnode *vp, acl_type_t type) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_getacl"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_getacl, cred, vp, &vp->v_label, type); return (error); } int mac_check_vnode_getextattr(struct ucred *cred, struct vnode *vp, int attrnamespace, const char *name, struct uio *uio) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_getextattr"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_getextattr, cred, vp, &vp->v_label, attrnamespace, name, uio); + return (error); +} + +int +mac_check_vnode_link(struct ucred *cred, struct vnode *dvp, + struct vnode *vp, struct componentname *cnp) +{ + + int error; + + ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_link"); + ASSERT_VOP_LOCKED(vp, "mac_check_vnode_link"); + + if (!mac_enforce_fs) + return (0); + + error = vn_refreshlabel(dvp, cred); + if (error) + return (error); + + error = vn_refreshlabel(vp, cred); + if (error) + return (error); + + MAC_CHECK(check_vnode_link, cred, dvp, &dvp->v_label, vp, + &vp->v_label, cnp); return (error); } int mac_check_vnode_lookup(struct ucred *cred, struct vnode *dvp, struct componentname *cnp) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_lookup"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); MAC_CHECK(check_vnode_lookup, cred, dvp, &dvp->v_label, cnp); return (error); } vm_prot_t mac_check_vnode_mmap_prot(struct ucred *cred, struct vnode *vp, int newmapping) { vm_prot_t result = VM_PROT_ALL; if (!mac_enforce_vm) return (result); /* * This should be some sort of MAC_BITWISE, maybe :) */ ASSERT_VOP_LOCKED(vp, "mac_check_vnode_mmap_perms"); MAC_BOOLEAN(check_vnode_mmap_perms, &, cred, vp, &vp->v_label, newmapping); return (result); } int mac_check_vnode_open(struct ucred *cred, struct vnode *vp, mode_t acc_mode) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_open"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_open, cred, vp, &vp->v_label, acc_mode); return (error); } int mac_check_vnode_poll(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_poll"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, active_cred); if (error) return (error); MAC_CHECK(check_vnode_poll, active_cred, file_cred, vp, &vp->v_label); return (error); } int mac_check_vnode_read(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_read"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, active_cred); if (error) return (error); MAC_CHECK(check_vnode_read, active_cred, file_cred, vp, &vp->v_label); return (error); } int mac_check_vnode_readdir(struct ucred *cred, struct vnode *dvp) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_readdir"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); MAC_CHECK(check_vnode_readdir, cred, dvp, &dvp->v_label); return (error); } int mac_check_vnode_readlink(struct ucred *cred, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_readlink"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_readlink, cred, vp, &vp->v_label); return (error); } static int mac_check_vnode_relabel(struct ucred *cred, struct vnode *vp, struct label *newlabel) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_relabel"); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_relabel, cred, vp, &vp->v_label, newlabel); return (error); } int mac_check_vnode_rename_from(struct ucred *cred, struct vnode *dvp, struct vnode *vp, struct componentname *cnp) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_rename_from"); ASSERT_VOP_LOCKED(vp, "mac_check_vnode_rename_from"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_rename_from, cred, dvp, &dvp->v_label, vp, &vp->v_label, cnp); return (error); } int mac_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp, struct vnode *vp, int samedir, struct componentname *cnp) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_rename_to"); ASSERT_VOP_LOCKED(vp, "mac_check_vnode_rename_to"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); if (vp != NULL) { error = vn_refreshlabel(vp, cred); if (error) return (error); } MAC_CHECK(check_vnode_rename_to, cred, dvp, &dvp->v_label, vp, vp != NULL ? &vp->v_label : NULL, samedir, cnp); return (error); } int mac_check_vnode_revoke(struct ucred *cred, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_revoke"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_revoke, cred, vp, &vp->v_label); return (error); } int mac_check_vnode_setacl(struct ucred *cred, struct vnode *vp, acl_type_t type, struct acl *acl) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setacl"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_setacl, cred, vp, &vp->v_label, type, acl); return (error); } int mac_check_vnode_setextattr(struct ucred *cred, struct vnode *vp, int attrnamespace, const char *name, struct uio *uio) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setextattr"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_setextattr, cred, vp, &vp->v_label, attrnamespace, name, uio); return (error); } int mac_check_vnode_setflags(struct ucred *cred, struct vnode *vp, u_long flags) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setflags"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_setflags, cred, vp, &vp->v_label, flags); return (error); } int mac_check_vnode_setmode(struct ucred *cred, struct vnode *vp, mode_t mode) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setmode"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_setmode, cred, vp, &vp->v_label, mode); return (error); } int mac_check_vnode_setowner(struct ucred *cred, struct vnode *vp, uid_t uid, gid_t gid) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setowner"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_setowner, cred, vp, &vp->v_label, uid, gid); return (error); } int mac_check_vnode_setutimes(struct ucred *cred, struct vnode *vp, struct timespec atime, struct timespec mtime) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setutimes"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_setutimes, cred, vp, &vp->v_label, atime, mtime); return (error); } int mac_check_vnode_stat(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_stat"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, active_cred); if (error) return (error); MAC_CHECK(check_vnode_stat, active_cred, file_cred, vp, &vp->v_label); return (error); } int mac_check_vnode_write(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_write"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, active_cred); if (error) return (error); MAC_CHECK(check_vnode_write, active_cred, file_cred, vp, &vp->v_label); return (error); } /* * When relabeling a process, call out to the policies for the maximum * permission allowed for each object type we know about in its * memory space, and revoke access (in the least surprising ways we * know) when necessary. The process lock is not held here. */ static void mac_cred_mmapped_drop_perms(struct thread *td, struct ucred *cred) { /* XXX freeze all other threads */ mac_cred_mmapped_drop_perms_recurse(td, cred, &td->td_proc->p_vmspace->vm_map); /* XXX allow other threads to continue */ } static __inline const char * prot2str(vm_prot_t prot) { switch (prot & VM_PROT_ALL) { case VM_PROT_READ: return ("r--"); case VM_PROT_READ | VM_PROT_WRITE: return ("rw-"); case VM_PROT_READ | VM_PROT_EXECUTE: return ("r-x"); case VM_PROT_READ | VM_PROT_WRITE | VM_PROT_EXECUTE: return ("rwx"); case VM_PROT_WRITE: return ("-w-"); case VM_PROT_EXECUTE: return ("--x"); case VM_PROT_WRITE | VM_PROT_EXECUTE: return ("-wx"); default: return ("---"); } } static void mac_cred_mmapped_drop_perms_recurse(struct thread *td, struct ucred *cred, struct vm_map *map) { struct vm_map_entry *vme; vm_prot_t result, revokeperms; vm_object_t object; vm_ooffset_t offset; struct vnode *vp; if (!mac_mmap_revocation) return; vm_map_lock_read(map); for (vme = map->header.next; vme != &map->header; vme = vme->next) { if (vme->eflags & MAP_ENTRY_IS_SUB_MAP) { mac_cred_mmapped_drop_perms_recurse(td, cred, vme->object.sub_map); continue; } /* * Skip over entries that obviously are not shared. */ if (vme->eflags & (MAP_ENTRY_COW | MAP_ENTRY_NOSYNC) || !vme->max_protection) continue; /* * Drill down to the deepest backing object. */ offset = vme->offset; object = vme->object.vm_object; if (object == NULL) continue; while (object->backing_object != NULL) { object = object->backing_object; offset += object->backing_object_offset; } /* * At the moment, vm_maps and objects aren't considered * by the MAC system, so only things with backing by a * normal object (read: vnodes) are checked. */ if (object->type != OBJT_VNODE) continue; vp = (struct vnode *)object->handle; vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); result = mac_check_vnode_mmap_prot(cred, vp, 0); VOP_UNLOCK(vp, 0, td); /* * Find out what maximum protection we may be allowing * now but a policy needs to get removed. */ revokeperms = vme->max_protection & ~result; if (!revokeperms) continue; printf("pid %ld: revoking %s perms from %#lx:%ld " "(max %s/cur %s)\n", (long)td->td_proc->p_pid, prot2str(revokeperms), (u_long)vme->start, (long)(vme->end - vme->start), prot2str(vme->max_protection), prot2str(vme->protection)); vm_map_lock_upgrade(map); /* * This is the really simple case: if a map has more * max_protection than is allowed, but it's not being * actually used (that is, the current protection is * still allowed), we can just wipe it out and do * nothing more. */ if ((vme->protection & revokeperms) == 0) { vme->max_protection -= revokeperms; } else { if (revokeperms & VM_PROT_WRITE) { /* * In the more complicated case, flush out all * pending changes to the object then turn it * copy-on-write. */ vm_object_reference(object); vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); vm_object_page_clean(object, OFF_TO_IDX(offset), OFF_TO_IDX(offset + vme->end - vme->start + PAGE_MASK), OBJPC_SYNC); VOP_UNLOCK(vp, 0, td); vm_object_deallocate(object); /* * Why bother if there's no read permissions * anymore? For the rest, we need to leave * the write permissions on for COW, or * remove them entirely if configured to. */ if (!mac_mmap_revocation_via_cow) { vme->max_protection &= ~VM_PROT_WRITE; vme->protection &= ~VM_PROT_WRITE; } if ((revokeperms & VM_PROT_READ) == 0) vme->eflags |= MAP_ENTRY_COW | MAP_ENTRY_NEEDS_COPY; } if (revokeperms & VM_PROT_EXECUTE) { vme->max_protection &= ~VM_PROT_EXECUTE; vme->protection &= ~VM_PROT_EXECUTE; } if (revokeperms & VM_PROT_READ) { vme->max_protection = 0; vme->protection = 0; } pmap_protect(map->pmap, vme->start, vme->end, vme->protection & ~revokeperms); vm_map_simplify_entry(map, vme); } vm_map_lock_downgrade(map); } vm_map_unlock_read(map); } /* * When the subject's label changes, it may require revocation of privilege * to mapped objects. This can't be done on-the-fly later with a unified * buffer cache. */ static void mac_relabel_cred(struct ucred *cred, struct label *newlabel) { MAC_PERFORM(relabel_cred, cred, newlabel); } void mac_relabel_vnode(struct ucred *cred, struct vnode *vp, struct label *newlabel) { MAC_PERFORM(relabel_vnode, cred, vp, &vp->v_label, newlabel); } void mac_create_ifnet(struct ifnet *ifnet) { MAC_PERFORM(create_ifnet, ifnet, &ifnet->if_label); } void mac_create_bpfdesc(struct ucred *cred, struct bpf_d *bpf_d) { MAC_PERFORM(create_bpfdesc, cred, bpf_d, &bpf_d->bd_label); } void mac_create_socket(struct ucred *cred, struct socket *socket) { MAC_PERFORM(create_socket, cred, socket, &socket->so_label); } void mac_create_pipe(struct ucred *cred, struct pipe *pipe) { MAC_PERFORM(create_pipe, cred, pipe, pipe->pipe_label); } void mac_create_socket_from_socket(struct socket *oldsocket, struct socket *newsocket) { MAC_PERFORM(create_socket_from_socket, oldsocket, &oldsocket->so_label, newsocket, &newsocket->so_label); } static void mac_relabel_socket(struct ucred *cred, struct socket *socket, struct label *newlabel) { MAC_PERFORM(relabel_socket, cred, socket, &socket->so_label, newlabel); } static void mac_relabel_pipe(struct ucred *cred, struct pipe *pipe, struct label *newlabel) { MAC_PERFORM(relabel_pipe, cred, pipe, pipe->pipe_label, newlabel); } void mac_set_socket_peer_from_mbuf(struct mbuf *mbuf, struct socket *socket) { MAC_PERFORM(set_socket_peer_from_mbuf, mbuf, &mbuf->m_pkthdr.label, socket, &socket->so_peerlabel); } void mac_set_socket_peer_from_socket(struct socket *oldsocket, struct socket *newsocket) { MAC_PERFORM(set_socket_peer_from_socket, oldsocket, &oldsocket->so_label, newsocket, &newsocket->so_peerlabel); } void mac_create_datagram_from_ipq(struct ipq *ipq, struct mbuf *datagram) { MAC_PERFORM(create_datagram_from_ipq, ipq, &ipq->ipq_label, datagram, &datagram->m_pkthdr.label); } void mac_create_fragment(struct mbuf *datagram, struct mbuf *fragment) { MAC_PERFORM(create_fragment, datagram, &datagram->m_pkthdr.label, fragment, &fragment->m_pkthdr.label); } void mac_create_ipq(struct mbuf *fragment, struct ipq *ipq) { MAC_PERFORM(create_ipq, fragment, &fragment->m_pkthdr.label, ipq, &ipq->ipq_label); } void mac_create_mbuf_from_mbuf(struct mbuf *oldmbuf, struct mbuf *newmbuf) { MAC_PERFORM(create_mbuf_from_mbuf, oldmbuf, &oldmbuf->m_pkthdr.label, newmbuf, &newmbuf->m_pkthdr.label); } void mac_create_mbuf_from_bpfdesc(struct bpf_d *bpf_d, struct mbuf *mbuf) { MAC_PERFORM(create_mbuf_from_bpfdesc, bpf_d, &bpf_d->bd_label, mbuf, &mbuf->m_pkthdr.label); } void mac_create_mbuf_linklayer(struct ifnet *ifnet, struct mbuf *mbuf) { MAC_PERFORM(create_mbuf_linklayer, ifnet, &ifnet->if_label, mbuf, &mbuf->m_pkthdr.label); } void mac_create_mbuf_from_ifnet(struct ifnet *ifnet, struct mbuf *mbuf) { MAC_PERFORM(create_mbuf_from_ifnet, ifnet, &ifnet->if_label, mbuf, &mbuf->m_pkthdr.label); } void mac_create_mbuf_multicast_encap(struct mbuf *oldmbuf, struct ifnet *ifnet, struct mbuf *newmbuf) { MAC_PERFORM(create_mbuf_multicast_encap, oldmbuf, &oldmbuf->m_pkthdr.label, ifnet, &ifnet->if_label, newmbuf, &newmbuf->m_pkthdr.label); } void mac_create_mbuf_netlayer(struct mbuf *oldmbuf, struct mbuf *newmbuf) { MAC_PERFORM(create_mbuf_netlayer, oldmbuf, &oldmbuf->m_pkthdr.label, newmbuf, &newmbuf->m_pkthdr.label); } int mac_fragment_match(struct mbuf *fragment, struct ipq *ipq) { int result; result = 1; MAC_BOOLEAN(fragment_match, &&, fragment, &fragment->m_pkthdr.label, ipq, &ipq->ipq_label); return (result); } void mac_update_ipq(struct mbuf *fragment, struct ipq *ipq) { MAC_PERFORM(update_ipq, fragment, &fragment->m_pkthdr.label, ipq, &ipq->ipq_label); } void mac_create_mbuf_from_socket(struct socket *socket, struct mbuf *mbuf) { MAC_PERFORM(create_mbuf_from_socket, socket, &socket->so_label, mbuf, &mbuf->m_pkthdr.label); } void mac_create_mount(struct ucred *cred, struct mount *mp) { MAC_PERFORM(create_mount, cred, mp, &mp->mnt_mntlabel, &mp->mnt_fslabel); } void mac_create_root_mount(struct ucred *cred, struct mount *mp) { MAC_PERFORM(create_root_mount, cred, mp, &mp->mnt_mntlabel, &mp->mnt_fslabel); } int mac_check_bpfdesc_receive(struct bpf_d *bpf_d, struct ifnet *ifnet) { int error; if (!mac_enforce_network) return (0); MAC_CHECK(check_bpfdesc_receive, bpf_d, &bpf_d->bd_label, ifnet, &ifnet->if_label); return (error); } static int mac_check_cred_relabel(struct ucred *cred, struct label *newlabel) { int error; MAC_CHECK(check_cred_relabel, cred, newlabel); return (error); } int mac_check_cred_visible(struct ucred *u1, struct ucred *u2) { int error; if (!mac_enforce_process) return (0); MAC_CHECK(check_cred_visible, u1, u2); return (error); } int mac_check_ifnet_transmit(struct ifnet *ifnet, struct mbuf *mbuf) { int error; if (!mac_enforce_network) return (0); KASSERT(mbuf->m_flags & M_PKTHDR, ("packet has no pkthdr")); if (!(mbuf->m_pkthdr.label.l_flags & MAC_FLAG_INITIALIZED)) printf("%s%d: not initialized\n", ifnet->if_name, ifnet->if_unit); MAC_CHECK(check_ifnet_transmit, ifnet, &ifnet->if_label, mbuf, &mbuf->m_pkthdr.label); return (error); } int mac_check_mount_stat(struct ucred *cred, struct mount *mount) { int error; if (!mac_enforce_fs) return (0); MAC_CHECK(check_mount_stat, cred, mount, &mount->mnt_mntlabel); return (error); } int mac_check_pipe_ioctl(struct ucred *cred, struct pipe *pipe, unsigned long cmd, void *data) { int error; PIPE_LOCK_ASSERT(pipe, MA_OWNED); if (!mac_enforce_pipe) return (0); MAC_CHECK(check_pipe_ioctl, cred, pipe, pipe->pipe_label, cmd, data); return (error); } int mac_check_pipe_poll(struct ucred *cred, struct pipe *pipe) { int error; PIPE_LOCK_ASSERT(pipe, MA_OWNED); if (!mac_enforce_pipe) return (0); MAC_CHECK(check_pipe_poll, cred, pipe, pipe->pipe_label); return (error); } int mac_check_pipe_read(struct ucred *cred, struct pipe *pipe) { int error; PIPE_LOCK_ASSERT(pipe, MA_OWNED); if (!mac_enforce_pipe) return (0); MAC_CHECK(check_pipe_read, cred, pipe, pipe->pipe_label); return (error); } static int mac_check_pipe_relabel(struct ucred *cred, struct pipe *pipe, struct label *newlabel) { int error; PIPE_LOCK_ASSERT(pipe, MA_OWNED); if (!mac_enforce_pipe) return (0); MAC_CHECK(check_pipe_relabel, cred, pipe, pipe->pipe_label, newlabel); return (error); } int mac_check_pipe_stat(struct ucred *cred, struct pipe *pipe) { int error; PIPE_LOCK_ASSERT(pipe, MA_OWNED); if (!mac_enforce_pipe) return (0); MAC_CHECK(check_pipe_stat, cred, pipe, pipe->pipe_label); return (error); } int mac_check_pipe_write(struct ucred *cred, struct pipe *pipe) { int error; PIPE_LOCK_ASSERT(pipe, MA_OWNED); if (!mac_enforce_pipe) return (0); MAC_CHECK(check_pipe_write, cred, pipe, pipe->pipe_label); return (error); } int mac_check_proc_debug(struct ucred *cred, struct proc *proc) { int error; PROC_LOCK_ASSERT(proc, MA_OWNED); if (!mac_enforce_process) return (0); MAC_CHECK(check_proc_debug, cred, proc); return (error); } int mac_check_proc_sched(struct ucred *cred, struct proc *proc) { int error; PROC_LOCK_ASSERT(proc, MA_OWNED); if (!mac_enforce_process) return (0); MAC_CHECK(check_proc_sched, cred, proc); return (error); } int mac_check_proc_signal(struct ucred *cred, struct proc *proc, int signum) { int error; PROC_LOCK_ASSERT(proc, MA_OWNED); if (!mac_enforce_process) return (0); MAC_CHECK(check_proc_signal, cred, proc, signum); return (error); } int mac_check_socket_bind(struct ucred *ucred, struct socket *socket, struct sockaddr *sockaddr) { int error; if (!mac_enforce_socket) return (0); MAC_CHECK(check_socket_bind, ucred, socket, &socket->so_label, sockaddr); return (error); } int mac_check_socket_connect(struct ucred *cred, struct socket *socket, struct sockaddr *sockaddr) { int error; if (!mac_enforce_socket) return (0); MAC_CHECK(check_socket_connect, cred, socket, &socket->so_label, sockaddr); return (error); } int mac_check_socket_deliver(struct socket *socket, struct mbuf *mbuf) { int error; if (!mac_enforce_socket) return (0); MAC_CHECK(check_socket_deliver, socket, &socket->so_label, mbuf, &mbuf->m_pkthdr.label); return (error); } int mac_check_socket_listen(struct ucred *cred, struct socket *socket) { int error; if (!mac_enforce_socket) return (0); MAC_CHECK(check_socket_listen, cred, socket, &socket->so_label); return (error); } static int mac_check_socket_relabel(struct ucred *cred, struct socket *socket, struct label *newlabel) { int error; MAC_CHECK(check_socket_relabel, cred, socket, &socket->so_label, newlabel); return (error); } int mac_check_socket_visible(struct ucred *cred, struct socket *socket) { int error; if (!mac_enforce_socket) return (0); MAC_CHECK(check_socket_visible, cred, socket, &socket->so_label); return (error); } int mac_ioctl_ifnet_get(struct ucred *cred, struct ifreq *ifr, struct ifnet *ifnet) { struct mac label; int error; error = mac_externalize(&ifnet->if_label, &label); if (error) return (error); return (copyout(&label, ifr->ifr_ifru.ifru_data, sizeof(label))); } int mac_ioctl_ifnet_set(struct ucred *cred, struct ifreq *ifr, struct ifnet *ifnet) { struct mac newlabel; struct label intlabel; int error; error = copyin(ifr->ifr_ifru.ifru_data, &newlabel, sizeof(newlabel)); if (error) return (error); error = mac_internalize(&intlabel, &newlabel); if (error) return (error); /* * XXX: Note that this is a redundant privilege check, since * policies impose this check themselves if required by the * policy. Eventually, this should go away. */ error = suser_cred(cred, 0); if (error) goto out; MAC_CHECK(check_ifnet_relabel, cred, ifnet, &ifnet->if_label, &intlabel); if (error) goto out; MAC_PERFORM(relabel_ifnet, cred, ifnet, &ifnet->if_label, &intlabel); out: mac_destroy_temp(&intlabel); return (error); } void mac_create_devfs_vnode(struct devfs_dirent *de, struct vnode *vp) { MAC_PERFORM(create_devfs_vnode, de, &de->de_label, vp, &vp->v_label); } void mac_create_devfs_device(dev_t dev, struct devfs_dirent *de) { MAC_PERFORM(create_devfs_device, dev, de, &de->de_label); } static int mac_stdcreatevnode_ea(struct vnode *vp) { int error; MAC_CHECK(stdcreatevnode_ea, vp, &vp->v_label); return (error); } void mac_create_devfs_directory(char *dirname, int dirnamelen, struct devfs_dirent *de) { MAC_PERFORM(create_devfs_directory, dirname, dirnamelen, de, &de->de_label); } /* * When a new vnode is created, this call will initialize its label. */ void mac_create_vnode(struct ucred *cred, struct vnode *parent, struct vnode *child) { int error; ASSERT_VOP_LOCKED(parent, "mac_create_vnode"); ASSERT_VOP_LOCKED(child, "mac_create_vnode"); error = vn_refreshlabel(parent, cred); if (error) { printf("mac_create_vnode: vn_refreshlabel returned %d\n", error); printf("mac_create_vnode: using old vnode label\n"); } MAC_PERFORM(create_vnode, cred, parent, &parent->v_label, child, &child->v_label); } int mac_setsockopt_label_set(struct ucred *cred, struct socket *so, struct mac *extmac) { struct label intlabel; int error; error = mac_internalize(&intlabel, extmac); if (error) return (error); mac_check_socket_relabel(cred, so, &intlabel); if (error) { mac_destroy_temp(&intlabel); return (error); } mac_relabel_socket(cred, so, &intlabel); mac_destroy_temp(&intlabel); return (0); } int mac_pipe_label_set(struct ucred *cred, struct pipe *pipe, struct label *label) { int error; PIPE_LOCK_ASSERT(pipe, MA_OWNED); error = mac_check_pipe_relabel(cred, pipe, label); if (error) return (error); mac_relabel_pipe(cred, pipe, label); return (0); } int mac_getsockopt_label_get(struct ucred *cred, struct socket *so, struct mac *extmac) { return (mac_externalize(&so->so_label, extmac)); } int mac_getsockopt_peerlabel_get(struct ucred *cred, struct socket *so, struct mac *extmac) { return (mac_externalize(&so->so_peerlabel, extmac)); } /* * Implementation of VOP_SETLABEL() that relies on extended attributes * to store label data. Can be referenced by filesystems supporting * extended attributes. */ int vop_stdsetlabel_ea(struct vop_setlabel_args *ap) { struct vnode *vp = ap->a_vp; struct label *intlabel = ap->a_label; struct mac extmac; int error; ASSERT_VOP_LOCKED(vp, "vop_stdsetlabel_ea"); /* * XXX: Eventually call out to EA check/set calls here. * Be particularly careful to avoid race conditions, * consistency problems, and stability problems when * dealing with multiple EAs. In particular, we require * the ability to write multiple EAs on the same file in * a single transaction, which the current EA interface * does not provide. */ error = mac_externalize(intlabel, &extmac); if (error) return (error); error = vn_extattr_set(vp, IO_NODELOCKED, FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME, sizeof(extmac), (char *)&extmac, curthread); if (error) return (error); mac_relabel_vnode(ap->a_cred, vp, intlabel); vp->v_vflag |= VV_CACHEDLABEL; return (0); } static int vn_setlabel(struct vnode *vp, struct label *intlabel, struct ucred *cred) { int error; if (vp->v_mount == NULL) { /* printf("vn_setlabel: null v_mount\n"); */ if (vp->v_type != VNON) printf("vn_setlabel: null v_mount with non-VNON\n"); return (EBADF); } if ((vp->v_mount->mnt_flag & MNT_MULTILABEL) == 0) return (EOPNOTSUPP); /* * Multi-phase commit. First check the policies to confirm the * change is OK. Then commit via the filesystem. Finally, * update the actual vnode label. Question: maybe the filesystem * should update the vnode at the end as part of VOP_SETLABEL()? */ error = mac_check_vnode_relabel(cred, vp, intlabel); if (error) return (error); /* * VADMIN provides the opportunity for the filesystem to make * decisions about who is and is not able to modify labels * and protections on files. This might not be right. We can't * assume VOP_SETLABEL() will do it, because we might implement * that as part of vop_stdsetlabel_ea(). */ error = VOP_ACCESS(vp, VADMIN, cred, curthread); if (error) return (error); error = VOP_SETLABEL(vp, intlabel, cred, curthread); if (error) return (error); return (0); } /* * MPSAFE */ int __mac_get_proc(struct thread *td, struct __mac_get_proc_args *uap) { struct mac extmac; int error; error = mac_externalize(&td->td_ucred->cr_label, &extmac); if (error == 0) error = copyout(&extmac, SCARG(uap, mac_p), sizeof(extmac)); return (error); } /* * MPSAFE */ int __mac_set_proc(struct thread *td, struct __mac_set_proc_args *uap) { struct ucred *newcred, *oldcred; struct proc *p; struct mac extmac; struct label intlabel; int error; error = copyin(SCARG(uap, mac_p), &extmac, sizeof(extmac)); if (error) return (error); error = mac_internalize(&intlabel, &extmac); if (error) return (error); newcred = crget(); p = td->td_proc; PROC_LOCK(p); oldcred = p->p_ucred; error = mac_check_cred_relabel(oldcred, &intlabel); if (error) { PROC_UNLOCK(p); mac_destroy_temp(&intlabel); crfree(newcred); return (error); } setsugid(p); crcopy(newcred, oldcred); mac_relabel_cred(newcred, &intlabel); p->p_ucred = newcred; /* * Grab additional reference for use while revoking mmaps, prior * to releasing the proc lock and sharing the cred. */ crhold(newcred); PROC_UNLOCK(p); mtx_lock(&Giant); mac_cred_mmapped_drop_perms(td, newcred); mtx_unlock(&Giant); crfree(newcred); /* Free revocation reference. */ crfree(oldcred); mac_destroy_temp(&intlabel); return (0); } /* * MPSAFE */ int __mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap) { struct file *fp; struct mac extmac; struct vnode *vp; struct pipe *pipe; int error; mtx_lock(&Giant); error = fget(td, SCARG(uap, fd), &fp); if (error) goto out; switch (fp->f_type) { case DTYPE_FIFO: case DTYPE_VNODE: vp = (struct vnode *)fp->f_data; vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); error = vn_refreshlabel(vp, td->td_ucred); if (error == 0) error = mac_externalize(&vp->v_label, &extmac); VOP_UNLOCK(vp, 0, td); break; case DTYPE_PIPE: pipe = (struct pipe *)fp->f_data; error = mac_externalize(pipe->pipe_label, &extmac); break; default: error = EINVAL; } if (error == 0) error = copyout(&extmac, SCARG(uap, mac_p), sizeof(extmac)); fdrop(fp, td); out: mtx_unlock(&Giant); return (error); } /* * MPSAFE */ int __mac_get_file(struct thread *td, struct __mac_get_file_args *uap) { struct nameidata nd; struct mac extmac; int error; mtx_lock(&Giant); NDINIT(&nd, LOOKUP, LOCKLEAF | FOLLOW, UIO_USERSPACE, SCARG(uap, path_p), td); error = namei(&nd); if (error) goto out; error = vn_refreshlabel(nd.ni_vp, td->td_ucred); if (error == 0) error = mac_externalize(&nd.ni_vp->v_label, &extmac); NDFREE(&nd, 0); if (error) goto out; error = copyout(&extmac, SCARG(uap, mac_p), sizeof(extmac)); out: mtx_unlock(&Giant); return (error); } /* * MPSAFE */ int __mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap) { struct file *fp; struct mac extmac; struct label intlabel; struct mount *mp; struct vnode *vp; struct pipe *pipe; int error; mtx_lock(&Giant); error = fget(td, SCARG(uap, fd), &fp); if (error) goto out1; error = copyin(SCARG(uap, mac_p), &extmac, sizeof(extmac)); if (error) goto out2; error = mac_internalize(&intlabel, &extmac); if (error) goto out2; switch (fp->f_type) { case DTYPE_FIFO: case DTYPE_VNODE: vp = (struct vnode *)fp->f_data; error = vn_start_write(vp, &mp, V_WAIT | PCATCH); if (error != 0) break; vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); error = vn_setlabel(vp, &intlabel, td->td_ucred); VOP_UNLOCK(vp, 0, td); vn_finished_write(mp); mac_destroy_temp(&intlabel); break; case DTYPE_PIPE: pipe = (struct pipe *)fp->f_data; PIPE_LOCK(pipe); error = mac_pipe_label_set(td->td_ucred, pipe, &intlabel); PIPE_UNLOCK(pipe); break; default: error = EINVAL; } out2: fdrop(fp, td); out1: mtx_unlock(&Giant); return (error); } /* * MPSAFE */ int __mac_set_file(struct thread *td, struct __mac_set_file_args *uap) { struct nameidata nd; struct mac extmac; struct label intlabel; struct mount *mp; int error; mtx_lock(&Giant); error = copyin(SCARG(uap, mac_p), &extmac, sizeof(extmac)); if (error) goto out; error = mac_internalize(&intlabel, &extmac); if (error) goto out; NDINIT(&nd, LOOKUP, LOCKLEAF | FOLLOW, UIO_USERSPACE, SCARG(uap, path_p), td); error = namei(&nd); if (error) goto out2; error = vn_start_write(nd.ni_vp, &mp, V_WAIT | PCATCH); if (error) goto out2; error = vn_setlabel(nd.ni_vp, &intlabel, td->td_ucred); vn_finished_write(mp); out2: mac_destroy_temp(&intlabel); NDFREE(&nd, 0); out: mtx_unlock(&Giant); return (error); } int mac_syscall(struct thread *td, struct mac_syscall_args *uap) { struct mac_policy_conf *mpc; char target[MAC_MAX_POLICY_NAME]; int error; error = copyinstr(SCARG(uap, policy), target, sizeof(target), NULL); if (error) return (error); error = ENOSYS; MAC_POLICY_LIST_BUSY(); LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { if (strcmp(mpc->mpc_name, target) == 0 && mpc->mpc_ops->mpo_syscall != NULL) { error = mpc->mpc_ops->mpo_syscall(td, SCARG(uap, call), SCARG(uap, arg)); goto out; } } out: MAC_POLICY_LIST_UNBUSY(); return (error); } SYSINIT(mac, SI_SUB_MAC, SI_ORDER_FIRST, mac_init, NULL); SYSINIT(mac_late, SI_SUB_MAC_LATE, SI_ORDER_FIRST, mac_late_init, NULL); #else /* !MAC */ int __mac_get_proc(struct thread *td, struct __mac_get_proc_args *uap) { return (ENOSYS); } int __mac_set_proc(struct thread *td, struct __mac_set_proc_args *uap) { return (ENOSYS); } int __mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap) { return (ENOSYS); } int __mac_get_file(struct thread *td, struct __mac_get_file_args *uap) { return (ENOSYS); } int __mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap) { return (ENOSYS); } int __mac_set_file(struct thread *td, struct __mac_set_file_args *uap) { return (ENOSYS); } int mac_syscall(struct thread *td, struct mac_syscall_args *uap) { return (ENOSYS); } #endif /* !MAC */ Index: head/sys/security/mac/mac_framework.h =================================================================== --- head/sys/security/mac/mac_framework.h (revision 104528) +++ head/sys/security/mac/mac_framework.h (revision 104529) @@ -1,394 +1,396 @@ /*- * Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson * Copyright (c) 2001, 2002 Networks Associates Technology, Inc. * All rights reserved. * * This software was developed by Robert Watson for the TrustedBSD Project. * * This software was developed for the FreeBSD Project in part by NAI Labs, * the Security Research Division of Network Associates, Inc. under * DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA * CHATS research program. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * 3. The names of the authors may not be used to endorse or promote * products derived from this software without specific prior written * permission. * * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. * * $FreeBSD$ */ /* * Userland/kernel interface for Mandatory Access Control. * * The POSIX.1e implementation page may be reached at: * http://www.trustedbsd.org/ */ #ifndef _SYS_MAC_H #define _SYS_MAC_H #include #ifndef _POSIX_MAC #define _POSIX_MAC #endif /* * XXXMAC: The single MAC extended attribute will be deprecated once * compound EA writes on a single target file can be performed cleanly * with UFS2. */ #define FREEBSD_MAC_EXTATTR_NAME "freebsd.mac" #define FREEBSD_MAC_EXTATTR_NAMESPACE EXTATTR_NAMESPACE_SYSTEM /* * MAC framework-related constants and limits. */ #define MAC_MAX_POLICY_NAME 32 /* * XXXMAC: Per-policy structures will be moved from mac.h to per-policy * include files once the revised user interface is available. */ /* * Structures and constants associated with a Biba Integrity policy. * mac_biba represents a Biba label, with mb_type determining its properties, * and mb_grade represents the hierarchal grade if valid for the current * mb_type. These structures will move to mac_biba.h once we have dymamic * labels exposed to userland. */ struct mac_biba_element { u_short mbe_type; u_short mbe_grade; }; /* * Biba labels consist of two components: a single label, and a label * range. Depending on the context, one or both may be used; the mb_flags * field permits the provider to indicate what fields are intended for * use. */ struct mac_biba { int mb_flags; struct mac_biba_element mb_single; struct mac_biba_element mb_rangelow, mb_rangehigh; }; /* * Structures and constants associated with a Multi-Level Security policy. * mac_mls represents an MLS label, with mm_type determining its properties, * and mm_level represents the hierarchal sensitivity level if valid for the * current mm_type. These structures will move to mac_mls.h once we have * dynamic labels exposed to userland. */ struct mac_mls_element { u_short mme_type; u_short mme_level; }; /* * MLS labels consist of two components: a single label, and a label * range. Depending on the context, one or both may be used; the mb_flags * field permits the provider to indicate what fields are intended for * use. */ struct mac_mls { int mm_flags; struct mac_mls_element mm_single; struct mac_mls_element mm_rangelow, mm_rangehigh; }; /* * Structures and constants associated with a Type Enforcement policy. * mac_te represents a Type Enforcement label. */ #define MAC_TE_TYPE_MAXLEN 32 struct mac_te { char mt_type[MAC_TE_TYPE_MAXLEN+1]; /* TE type */ }; struct mac_sebsd { uint32_t ms_psid; /* persistent sid storage */ }; /* * Composite structures and constants which combine the various policy * elements into common structures to be associated with subjects and * objects. */ struct mac { int m_macflags; struct mac_biba m_biba; struct mac_mls m_mls; struct mac_te m_te; struct mac_sebsd m_sebsd; }; typedef struct mac *mac_t; #define MAC_FLAG_INITIALIZED 0x00000001 /* Is initialized. */ #ifndef _KERNEL /* * POSIX.1e functions visible in the application namespace. */ int mac_dominate(const mac_t _labela, const mac_t _labelb); int mac_equal(const mac_t labela, const mac_t _labelb); int mac_free(void *_buf_p); mac_t mac_from_text(const char *_text_p); mac_t mac_get_fd(int _fildes); mac_t mac_get_file(const char *_path_p); mac_t mac_get_proc(void); mac_t mac_glb(const mac_t _labela, const mac_t _labelb); mac_t mac_lub(const mac_t _labela, const mac_t _labelb); int mac_set_fd(int _fildes, const mac_t _label); int mac_set_file(const char *_path_p, mac_t _label); int mac_set_proc(const mac_t _label); ssize_t mac_size(mac_t _label); char * mac_to_text(const mac_t _label, size_t *_len_p); int mac_valid(const mac_t _label); /* * Extensions to POSIX.1e visible in the application namespace. */ int mac_is_present_np(const char *_policyname); int mac_syscall(const char *_policyname, int call, void *arg); /* * System calls wrapped by some POSIX.1e functions. */ int __mac_get_fd(int _fd, struct mac *_mac_p); int __mac_get_file(const char *_path_p, struct mac *_mac_p); int __mac_get_proc(struct mac *_mac_p); int __mac_set_fd(int fd, struct mac *_mac_p); int __mac_set_file(const char *_path_p, struct mac *_mac_p); int __mac_set_proc(struct mac *_mac_p); #else /* _KERNEL */ /* * Kernel functions to manage and evaluate labels. */ struct bpf_d; struct componentname; struct devfs_dirent; struct ifnet; struct ifreq; struct ipq; struct mbuf; struct mount; struct proc; struct sockaddr; struct socket; struct pipe; struct thread; struct timespec; struct ucred; struct uio; struct vattr; struct vnode; #include /* XXX acl_type_t */ struct vop_refreshlabel_args; struct vop_setlabel_args; /* * Label operations. */ void mac_init_bpfdesc(struct bpf_d *); void mac_init_cred(struct ucred *); void mac_init_devfsdirent(struct devfs_dirent *); void mac_init_ifnet(struct ifnet *); void mac_init_ipq(struct ipq *); void mac_init_socket(struct socket *); void mac_init_pipe(struct pipe *); int mac_init_mbuf(struct mbuf *m, int how); void mac_init_mount(struct mount *); void mac_init_vnode(struct vnode *); void mac_destroy_bpfdesc(struct bpf_d *); void mac_destroy_cred(struct ucred *); void mac_destroy_devfsdirent(struct devfs_dirent *); void mac_destroy_ifnet(struct ifnet *); void mac_destroy_ipq(struct ipq *); void mac_destroy_socket(struct socket *); void mac_destroy_pipe(struct pipe *); void mac_destroy_mbuf(struct mbuf *); void mac_destroy_mount(struct mount *); void mac_destroy_vnode(struct vnode *); /* * Labeling event operations: file system objects, and things that * look a lot like file system objects. */ void mac_create_devfs_device(dev_t dev, struct devfs_dirent *de); void mac_create_devfs_directory(char *dirname, int dirnamelen, struct devfs_dirent *de); void mac_create_devfs_vnode(struct devfs_dirent *de, struct vnode *vp); void mac_create_vnode(struct ucred *cred, struct vnode *parent, struct vnode *child); void mac_create_mount(struct ucred *cred, struct mount *mp); void mac_create_root_mount(struct ucred *cred, struct mount *mp); void mac_relabel_vnode(struct ucred *cred, struct vnode *vp, struct label *newlabel); void mac_update_devfsdirent(struct devfs_dirent *de, struct vnode *vp); void mac_update_procfsvnode(struct vnode *vp, struct ucred *cred); void mac_update_vnode_from_mount(struct vnode *vp, struct mount *mp); /* * Labeling event operations: IPC objects. */ void mac_create_mbuf_from_socket(struct socket *so, struct mbuf *m); void mac_create_socket(struct ucred *cred, struct socket *socket); void mac_create_socket_from_socket(struct socket *oldsocket, struct socket *newsocket); void mac_set_socket_peer_from_mbuf(struct mbuf *mbuf, struct socket *socket); void mac_set_socket_peer_from_socket(struct socket *oldsocket, struct socket *newsocket); void mac_create_pipe(struct ucred *cred, struct pipe *pipe); /* * Labeling event operations: network objects. */ void mac_create_bpfdesc(struct ucred *cred, struct bpf_d *bpf_d); void mac_create_ifnet(struct ifnet *ifp); void mac_create_ipq(struct mbuf *fragment, struct ipq *ipq); void mac_create_datagram_from_ipq(struct ipq *ipq, struct mbuf *datagram); void mac_create_fragment(struct mbuf *datagram, struct mbuf *fragment); void mac_create_mbuf_from_mbuf(struct mbuf *oldmbuf, struct mbuf *newmbuf); void mac_create_mbuf_linklayer(struct ifnet *ifnet, struct mbuf *m); void mac_create_mbuf_from_bpfdesc(struct bpf_d *bpf_d, struct mbuf *m); void mac_create_mbuf_from_ifnet(struct ifnet *ifnet, struct mbuf *m); void mac_create_mbuf_multicast_encap(struct mbuf *oldmbuf, struct ifnet *ifnet, struct mbuf *newmbuf); void mac_create_mbuf_netlayer(struct mbuf *oldmbuf, struct mbuf *newmbuf); int mac_fragment_match(struct mbuf *fragment, struct ipq *ipq); void mac_update_ipq(struct mbuf *fragment, struct ipq *ipq); /* * Labeling event operations: processes. */ void mac_create_cred(struct ucred *cred_parent, struct ucred *cred_child); void mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp); int mac_execve_will_transition(struct ucred *old, struct vnode *vp); void mac_create_proc0(struct ucred *cred); void mac_create_proc1(struct ucred *cred); void mac_thread_userret(struct thread *td); /* Access control checks. */ int mac_check_bpfdesc_receive(struct bpf_d *bpf_d, struct ifnet *ifnet); int mac_check_cred_visible(struct ucred *u1, struct ucred *u2); int mac_check_ifnet_transmit(struct ifnet *ifnet, struct mbuf *m); int mac_check_mount_stat(struct ucred *cred, struct mount *mp); int mac_check_pipe_ioctl(struct ucred *cred, struct pipe *pipe, unsigned long cmd, void *data); int mac_check_pipe_poll(struct ucred *cred, struct pipe *pipe); int mac_check_pipe_read(struct ucred *cred, struct pipe *pipe); int mac_check_pipe_stat(struct ucred *cred, struct pipe *pipe); int mac_check_pipe_write(struct ucred *cred, struct pipe *pipe); int mac_check_proc_debug(struct ucred *cred, struct proc *proc); int mac_check_proc_sched(struct ucred *cred, struct proc *proc); int mac_check_proc_signal(struct ucred *cred, struct proc *proc, int signum); int mac_check_socket_bind(struct ucred *cred, struct socket *so, struct sockaddr *sockaddr); int mac_check_socket_connect(struct ucred *cred, struct socket *so, struct sockaddr *sockaddr); int mac_check_socket_deliver(struct socket *so, struct mbuf *m); int mac_check_socket_listen(struct ucred *cred, struct socket *so); int mac_check_socket_visible(struct ucred *cred, struct socket *so); int mac_check_vnode_access(struct ucred *cred, struct vnode *vp, int flags); int mac_check_vnode_chdir(struct ucred *cred, struct vnode *dvp); int mac_check_vnode_chroot(struct ucred *cred, struct vnode *dvp); int mac_check_vnode_create(struct ucred *cred, struct vnode *dvp, struct componentname *cnp, struct vattr *vap); int mac_check_vnode_delete(struct ucred *cred, struct vnode *dvp, struct vnode *vp, struct componentname *cnp); int mac_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp, acl_type_t type); int mac_check_vnode_exec(struct ucred *cred, struct vnode *vp); int mac_check_vnode_getacl(struct ucred *cred, struct vnode *vp, acl_type_t type); int mac_check_vnode_getextattr(struct ucred *cred, struct vnode *vp, int attrnamespace, const char *name, struct uio *uio); +int mac_check_vnode_link(struct ucred *cred, struct vnode *dvp, + struct vnode *vp, struct componentname *cnp); int mac_check_vnode_lookup(struct ucred *cred, struct vnode *dvp, struct componentname *cnp); /* XXX This u_char should be vm_prot_t! */ u_char mac_check_vnode_mmap_prot(struct ucred *cred, struct vnode *vp, int newmapping); int mac_check_vnode_open(struct ucred *cred, struct vnode *vp, mode_t acc_mode); int mac_check_vnode_poll(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp); int mac_check_vnode_read(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp); int mac_check_vnode_readdir(struct ucred *cred, struct vnode *vp); int mac_check_vnode_readlink(struct ucred *cred, struct vnode *vp); int mac_check_vnode_rename_from(struct ucred *cred, struct vnode *dvp, struct vnode *vp, struct componentname *cnp); int mac_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp, struct vnode *vp, int samedir, struct componentname *cnp); int mac_check_vnode_revoke(struct ucred *cred, struct vnode *vp); int mac_check_vnode_setacl(struct ucred *cred, struct vnode *vp, acl_type_t type, struct acl *acl); int mac_check_vnode_setextattr(struct ucred *cred, struct vnode *vp, int attrnamespace, const char *name, struct uio *uio); int mac_check_vnode_setflags(struct ucred *cred, struct vnode *vp, u_long flags); int mac_check_vnode_setmode(struct ucred *cred, struct vnode *vp, mode_t mode); int mac_check_vnode_setowner(struct ucred *cred, struct vnode *vp, uid_t uid, gid_t gid); int mac_check_vnode_setutimes(struct ucred *cred, struct vnode *vp, struct timespec atime, struct timespec mtime); int mac_check_vnode_stat(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp); int mac_check_vnode_write(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp); int mac_getsockopt_label_get(struct ucred *cred, struct socket *so, struct mac *extmac); int mac_getsockopt_peerlabel_get(struct ucred *cred, struct socket *so, struct mac *extmac); int mac_ioctl_ifnet_get(struct ucred *cred, struct ifreq *ifr, struct ifnet *ifnet); int mac_ioctl_ifnet_set(struct ucred *cred, struct ifreq *ifr, struct ifnet *ifnet); int mac_setsockopt_label_set(struct ucred *cred, struct socket *so, struct mac *extmac); int mac_pipe_label_set(struct ucred *cred, struct pipe *pipe, struct label *label); /* * Calls to help various file systems implement labeling functionality * using their existing EA implementation. */ int vop_stdcreatevnode_ea(struct vnode *dvp, struct vnode *tvp, struct ucred *cred); int vop_stdrefreshlabel_ea(struct vop_refreshlabel_args *ap); int vop_stdsetlabel_ea(struct vop_setlabel_args *ap); #endif /* _KERNEL */ #endif /* !_SYS_MAC_H */ Index: head/sys/security/mac/mac_internal.h =================================================================== --- head/sys/security/mac/mac_internal.h (revision 104528) +++ head/sys/security/mac/mac_internal.h (revision 104529) @@ -1,3432 +1,3462 @@ /*- * Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson * Copyright (c) 2001 Ilmar S. Habibulin * Copyright (c) 2001, 2002 Networks Associates Technology, Inc. * All rights reserved. * * This software was developed by Robert Watson and Ilmar Habibulin for the * TrustedBSD Project. * * This software was developed for the FreeBSD Project in part by NAI Labs, * the Security Research Division of Network Associates, Inc. under * DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA * CHATS research program. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * 3. The names of the authors may not be used to endorse or promote * products derived from this software without specific prior written * permission. * * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. * * $FreeBSD$ */ /* * Developed by the TrustedBSD Project. * * Framework for extensible kernel access control. Kernel and userland * interface to the framework, policy registration and composition. */ #include "opt_mac.h" #include "opt_devfs.h" #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #ifdef MAC /* * Declare that the kernel provides MAC support, version 1. This permits * modules to refuse to be loaded if the necessary support isn't present, * even if it's pre-boot. */ MODULE_VERSION(kernel_mac_support, 1); SYSCTL_DECL(_security); SYSCTL_NODE(_security, OID_AUTO, mac, CTLFLAG_RW, 0, "TrustedBSD MAC policy controls"); #ifndef MAC_MAX_POLICIES #define MAC_MAX_POLICIES 8 #endif #if MAC_MAX_POLICIES > 32 #error "MAC_MAX_POLICIES too large" #endif static unsigned int mac_max_policies = MAC_MAX_POLICIES; static unsigned int mac_policy_offsets_free = (1 << MAC_MAX_POLICIES) - 1; SYSCTL_UINT(_security_mac, OID_AUTO, max_policies, CTLFLAG_RD, &mac_max_policies, 0, ""); static int mac_late = 0; static int mac_enforce_fs = 1; SYSCTL_INT(_security_mac, OID_AUTO, enforce_fs, CTLFLAG_RW, &mac_enforce_fs, 0, "Enforce MAC policy on file system objects"); TUNABLE_INT("security.mac.enforce_fs", &mac_enforce_fs); static int mac_enforce_network = 1; SYSCTL_INT(_security_mac, OID_AUTO, enforce_network, CTLFLAG_RW, &mac_enforce_network, 0, "Enforce MAC policy on network packets"); TUNABLE_INT("security.mac.enforce_network", &mac_enforce_network); static int mac_enforce_pipe = 1; SYSCTL_INT(_security_mac, OID_AUTO, enforce_pipe, CTLFLAG_RW, &mac_enforce_pipe, 0, "Enforce MAC policy on pipe operations"); TUNABLE_INT("security.mac.enforce_pipe", &mac_enforce_pipe); static int mac_enforce_process = 1; SYSCTL_INT(_security_mac, OID_AUTO, enforce_process, CTLFLAG_RW, &mac_enforce_process, 0, "Enforce MAC policy on inter-process operations"); TUNABLE_INT("security.mac.enforce_process", &mac_enforce_process); static int mac_enforce_socket = 1; SYSCTL_INT(_security_mac, OID_AUTO, enforce_socket, CTLFLAG_RW, &mac_enforce_socket, 0, "Enforce MAC policy on socket operations"); TUNABLE_INT("security.mac.enforce_socket", &mac_enforce_socket); static int mac_enforce_vm = 1; SYSCTL_INT(_security_mac, OID_AUTO, enforce_vm, CTLFLAG_RW, &mac_enforce_vm, 0, "Enforce MAC policy on vm operations"); TUNABLE_INT("security.mac.enforce_vm", &mac_enforce_vm); static int mac_label_size = sizeof(struct mac); SYSCTL_INT(_security_mac, OID_AUTO, label_size, CTLFLAG_RD, &mac_label_size, 0, "Pre-compiled MAC label size"); static int mac_cache_fslabel_in_vnode = 1; SYSCTL_INT(_security_mac, OID_AUTO, cache_fslabel_in_vnode, CTLFLAG_RW, &mac_cache_fslabel_in_vnode, 0, "Cache mount fslabel in vnode"); TUNABLE_INT("security.mac.cache_fslabel_in_vnode", &mac_cache_fslabel_in_vnode); static int mac_vnode_label_cache_hits = 0; SYSCTL_INT(_security_mac, OID_AUTO, vnode_label_cache_hits, CTLFLAG_RD, &mac_vnode_label_cache_hits, 0, "Cache hits on vnode labels"); static int mac_vnode_label_cache_misses = 0; SYSCTL_INT(_security_mac, OID_AUTO, vnode_label_cache_misses, CTLFLAG_RD, &mac_vnode_label_cache_misses, 0, "Cache misses on vnode labels"); static int mac_mmap_revocation = 1; SYSCTL_INT(_security_mac, OID_AUTO, mmap_revocation, CTLFLAG_RW, &mac_mmap_revocation, 0, "Revoke mmap access to files on subject " "relabel"); static int mac_mmap_revocation_via_cow = 0; SYSCTL_INT(_security_mac, OID_AUTO, mmap_revocation_via_cow, CTLFLAG_RW, &mac_mmap_revocation_via_cow, 0, "Revoke mmap access to files via " "copy-on-write semantics, or by removing all write access"); #ifdef MAC_DEBUG SYSCTL_NODE(_security_mac, OID_AUTO, debug, CTLFLAG_RW, 0, "TrustedBSD MAC debug info"); static int mac_debug_label_fallback = 0; SYSCTL_INT(_security_mac_debug, OID_AUTO, label_fallback, CTLFLAG_RW, &mac_debug_label_fallback, 0, "Filesystems should fall back to fs label" "when label is corrupted."); TUNABLE_INT("security.mac.debug_label_fallback", &mac_debug_label_fallback); SYSCTL_NODE(_security_mac_debug, OID_AUTO, counters, CTLFLAG_RW, 0, "TrustedBSD MAC object counters"); static unsigned int nmacmbufs, nmaccreds, nmacifnets, nmacbpfdescs, nmacsockets, nmacmounts, nmactemp, nmacvnodes, nmacdevfsdirents, nmacipqs, nmacpipes; SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, mbufs, CTLFLAG_RD, &nmacmbufs, 0, "number of mbufs in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, creds, CTLFLAG_RD, &nmaccreds, 0, "number of ucreds in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, ifnets, CTLFLAG_RD, &nmacifnets, 0, "number of ifnets in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, ipqs, CTLFLAG_RD, &nmacipqs, 0, "number of ipqs in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, bpfdescs, CTLFLAG_RD, &nmacbpfdescs, 0, "number of bpfdescs in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, sockets, CTLFLAG_RD, &nmacsockets, 0, "number of sockets in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, pipes, CTLFLAG_RD, &nmacpipes, 0, "number of pipes in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, mounts, CTLFLAG_RD, &nmacmounts, 0, "number of mounts in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, temp, CTLFLAG_RD, &nmactemp, 0, "number of temporary labels in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, vnodes, CTLFLAG_RD, &nmacvnodes, 0, "number of vnodes in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, devfsdirents, CTLFLAG_RD, &nmacdevfsdirents, 0, "number of devfs dirents inuse"); #endif static int error_select(int error1, int error2); static int mac_externalize(struct label *label, struct mac *mac); static int mac_policy_register(struct mac_policy_conf *mpc); static int mac_policy_unregister(struct mac_policy_conf *mpc); static int mac_stdcreatevnode_ea(struct vnode *vp); static void mac_cred_mmapped_drop_perms(struct thread *td, struct ucred *cred); static void mac_cred_mmapped_drop_perms_recurse(struct thread *td, struct ucred *cred, struct vm_map *map); MALLOC_DEFINE(M_MACOPVEC, "macopvec", "MAC policy operation vector"); MALLOC_DEFINE(M_MACPIPELABEL, "macpipelabel", "MAC labels for pipes"); /* * mac_policy_list_lock protects the consistency of 'mac_policy_list', * the linked list of attached policy modules. Read-only consumers of * the list must acquire a shared lock for the duration of their use; * writers must acquire an exclusive lock. Note that for compound * operations, locks should be held for the entire compound operation, * and that this is not yet done for relabel requests. */ static struct mtx mac_policy_list_lock; static LIST_HEAD(, mac_policy_conf) mac_policy_list; static int mac_policy_list_busy; #define MAC_POLICY_LIST_LOCKINIT() mtx_init(&mac_policy_list_lock, \ "mac_policy_list_lock", NULL, MTX_DEF); #define MAC_POLICY_LIST_LOCK() mtx_lock(&mac_policy_list_lock); #define MAC_POLICY_LIST_UNLOCK() mtx_unlock(&mac_policy_list_lock); #define MAC_POLICY_LIST_BUSY() do { \ MAC_POLICY_LIST_LOCK(); \ mac_policy_list_busy++; \ MAC_POLICY_LIST_UNLOCK(); \ } while (0) #define MAC_POLICY_LIST_UNBUSY() do { \ MAC_POLICY_LIST_LOCK(); \ mac_policy_list_busy--; \ if (mac_policy_list_busy < 0) \ panic("Extra mac_policy_list_busy--"); \ MAC_POLICY_LIST_UNLOCK(); \ } while (0) /* * MAC_CHECK performs the designated check by walking the policy * module list and checking with each as to how it feels about the * request. Note that it returns its value via 'error' in the scope * of the caller. */ #define MAC_CHECK(check, args...) do { \ struct mac_policy_conf *mpc; \ \ error = 0; \ MAC_POLICY_LIST_BUSY(); \ LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { \ if (mpc->mpc_ops->mpo_ ## check != NULL) \ error = error_select( \ mpc->mpc_ops->mpo_ ## check (args), \ error); \ } \ MAC_POLICY_LIST_UNBUSY(); \ } while (0) /* * MAC_BOOLEAN performs the designated boolean composition by walking * the module list, invoking each instance of the operation, and * combining the results using the passed C operator. Note that it * returns its value via 'result' in the scope of the caller, which * should be initialized by the caller in a meaningful way to get * a meaningful result. */ #define MAC_BOOLEAN(operation, composition, args...) do { \ struct mac_policy_conf *mpc; \ \ MAC_POLICY_LIST_BUSY(); \ LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { \ if (mpc->mpc_ops->mpo_ ## operation != NULL) \ result = result composition \ mpc->mpc_ops->mpo_ ## operation (args); \ } \ MAC_POLICY_LIST_UNBUSY(); \ } while (0) /* * MAC_PERFORM performs the designated operation by walking the policy * module list and invoking that operation for each policy. */ #define MAC_PERFORM(operation, args...) do { \ struct mac_policy_conf *mpc; \ \ MAC_POLICY_LIST_BUSY(); \ LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { \ if (mpc->mpc_ops->mpo_ ## operation != NULL) \ mpc->mpc_ops->mpo_ ## operation (args); \ } \ MAC_POLICY_LIST_UNBUSY(); \ } while (0) /* * Initialize the MAC subsystem, including appropriate SMP locks. */ static void mac_init(void) { LIST_INIT(&mac_policy_list); MAC_POLICY_LIST_LOCKINIT(); } /* * For the purposes of modules that want to know if they were loaded * "early", set the mac_late flag once we've processed modules either * linked into the kernel, or loaded before the kernel startup. */ static void mac_late_init(void) { mac_late = 1; } /* * Allow MAC policy modules to register during boot, etc. */ int mac_policy_modevent(module_t mod, int type, void *data) { struct mac_policy_conf *mpc; int error; error = 0; mpc = (struct mac_policy_conf *) data; switch (type) { case MOD_LOAD: if (mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_NOTLATE && mac_late) { printf("mac_policy_modevent: can't load %s policy " "after booting\n", mpc->mpc_name); error = EBUSY; break; } error = mac_policy_register(mpc); break; case MOD_UNLOAD: /* Don't unregister the module if it was never registered. */ if ((mpc->mpc_runtime_flags & MPC_RUNTIME_FLAG_REGISTERED) != 0) error = mac_policy_unregister(mpc); else error = 0; break; default: break; } return (error); } static int mac_policy_register(struct mac_policy_conf *mpc) { struct mac_policy_conf *tmpc; struct mac_policy_op_entry *mpe; int slot; MALLOC(mpc->mpc_ops, struct mac_policy_ops *, sizeof(*mpc->mpc_ops), M_MACOPVEC, M_WAITOK | M_ZERO); for (mpe = mpc->mpc_entries; mpe->mpe_constant != MAC_OP_LAST; mpe++) { switch (mpe->mpe_constant) { case MAC_OP_LAST: /* * Doesn't actually happen, but this allows checking * that all enumerated values are handled. */ break; case MAC_DESTROY: mpc->mpc_ops->mpo_destroy = mpe->mpe_function; break; case MAC_INIT: mpc->mpc_ops->mpo_init = mpe->mpe_function; break; case MAC_SYSCALL: mpc->mpc_ops->mpo_syscall = mpe->mpe_function; break; case MAC_INIT_BPFDESC_LABEL: mpc->mpc_ops->mpo_init_bpfdesc_label = mpe->mpe_function; break; case MAC_INIT_CRED_LABEL: mpc->mpc_ops->mpo_init_cred_label = mpe->mpe_function; break; case MAC_INIT_DEVFSDIRENT_LABEL: mpc->mpc_ops->mpo_init_devfsdirent_label = mpe->mpe_function; break; case MAC_INIT_IFNET_LABEL: mpc->mpc_ops->mpo_init_ifnet_label = mpe->mpe_function; break; case MAC_INIT_IPQ_LABEL: mpc->mpc_ops->mpo_init_ipq_label = mpe->mpe_function; break; case MAC_INIT_MBUF_LABEL: mpc->mpc_ops->mpo_init_mbuf_label = mpe->mpe_function; break; case MAC_INIT_MOUNT_LABEL: mpc->mpc_ops->mpo_init_mount_label = mpe->mpe_function; break; case MAC_INIT_MOUNT_FS_LABEL: mpc->mpc_ops->mpo_init_mount_fs_label = mpe->mpe_function; break; case MAC_INIT_PIPE_LABEL: mpc->mpc_ops->mpo_init_pipe_label = mpe->mpe_function; break; case MAC_INIT_SOCKET_LABEL: mpc->mpc_ops->mpo_init_socket_label = mpe->mpe_function; break; case MAC_INIT_SOCKET_PEER_LABEL: mpc->mpc_ops->mpo_init_socket_peer_label = mpe->mpe_function; break; case MAC_INIT_TEMP_LABEL: mpc->mpc_ops->mpo_init_temp_label = mpe->mpe_function; break; case MAC_INIT_VNODE_LABEL: mpc->mpc_ops->mpo_init_vnode_label = mpe->mpe_function; break; case MAC_DESTROY_BPFDESC_LABEL: mpc->mpc_ops->mpo_destroy_bpfdesc_label = mpe->mpe_function; break; case MAC_DESTROY_CRED_LABEL: mpc->mpc_ops->mpo_destroy_cred_label = mpe->mpe_function; break; case MAC_DESTROY_DEVFSDIRENT_LABEL: mpc->mpc_ops->mpo_destroy_devfsdirent_label = mpe->mpe_function; break; case MAC_DESTROY_IFNET_LABEL: mpc->mpc_ops->mpo_destroy_ifnet_label = mpe->mpe_function; break; case MAC_DESTROY_IPQ_LABEL: mpc->mpc_ops->mpo_destroy_ipq_label = mpe->mpe_function; break; case MAC_DESTROY_MBUF_LABEL: mpc->mpc_ops->mpo_destroy_mbuf_label = mpe->mpe_function; break; case MAC_DESTROY_MOUNT_LABEL: mpc->mpc_ops->mpo_destroy_mount_label = mpe->mpe_function; break; case MAC_DESTROY_MOUNT_FS_LABEL: mpc->mpc_ops->mpo_destroy_mount_fs_label = mpe->mpe_function; break; case MAC_DESTROY_PIPE_LABEL: mpc->mpc_ops->mpo_destroy_pipe_label = mpe->mpe_function; break; case MAC_DESTROY_SOCKET_LABEL: mpc->mpc_ops->mpo_destroy_socket_label = mpe->mpe_function; break; case MAC_DESTROY_SOCKET_PEER_LABEL: mpc->mpc_ops->mpo_destroy_socket_peer_label = mpe->mpe_function; break; case MAC_DESTROY_TEMP_LABEL: mpc->mpc_ops->mpo_destroy_temp_label = mpe->mpe_function; break; case MAC_DESTROY_VNODE_LABEL: mpc->mpc_ops->mpo_destroy_vnode_label = mpe->mpe_function; break; case MAC_EXTERNALIZE: mpc->mpc_ops->mpo_externalize = mpe->mpe_function; break; case MAC_INTERNALIZE: mpc->mpc_ops->mpo_internalize = mpe->mpe_function; break; case MAC_CREATE_DEVFS_DEVICE: mpc->mpc_ops->mpo_create_devfs_device = mpe->mpe_function; break; case MAC_CREATE_DEVFS_DIRECTORY: mpc->mpc_ops->mpo_create_devfs_directory = mpe->mpe_function; break; case MAC_CREATE_DEVFS_VNODE: mpc->mpc_ops->mpo_create_devfs_vnode = mpe->mpe_function; break; case MAC_STDCREATEVNODE_EA: mpc->mpc_ops->mpo_stdcreatevnode_ea = mpe->mpe_function; break; case MAC_CREATE_VNODE: mpc->mpc_ops->mpo_create_vnode = mpe->mpe_function; break; case MAC_CREATE_MOUNT: mpc->mpc_ops->mpo_create_mount = mpe->mpe_function; break; case MAC_CREATE_ROOT_MOUNT: mpc->mpc_ops->mpo_create_root_mount = mpe->mpe_function; break; case MAC_RELABEL_VNODE: mpc->mpc_ops->mpo_relabel_vnode = mpe->mpe_function; break; case MAC_UPDATE_DEVFSDIRENT: mpc->mpc_ops->mpo_update_devfsdirent = mpe->mpe_function; break; case MAC_UPDATE_PROCFSVNODE: mpc->mpc_ops->mpo_update_procfsvnode = mpe->mpe_function; break; case MAC_UPDATE_VNODE_FROM_EXTATTR: mpc->mpc_ops->mpo_update_vnode_from_extattr = mpe->mpe_function; break; case MAC_UPDATE_VNODE_FROM_EXTERNALIZED: mpc->mpc_ops->mpo_update_vnode_from_externalized = mpe->mpe_function; break; case MAC_UPDATE_VNODE_FROM_MOUNT: mpc->mpc_ops->mpo_update_vnode_from_mount = mpe->mpe_function; break; case MAC_CREATE_MBUF_FROM_SOCKET: mpc->mpc_ops->mpo_create_mbuf_from_socket = mpe->mpe_function; break; case MAC_CREATE_PIPE: mpc->mpc_ops->mpo_create_pipe = mpe->mpe_function; break; case MAC_CREATE_SOCKET: mpc->mpc_ops->mpo_create_socket = mpe->mpe_function; break; case MAC_CREATE_SOCKET_FROM_SOCKET: mpc->mpc_ops->mpo_create_socket_from_socket = mpe->mpe_function; break; case MAC_RELABEL_PIPE: mpc->mpc_ops->mpo_relabel_pipe = mpe->mpe_function; break; case MAC_RELABEL_SOCKET: mpc->mpc_ops->mpo_relabel_socket = mpe->mpe_function; break; case MAC_SET_SOCKET_PEER_FROM_MBUF: mpc->mpc_ops->mpo_set_socket_peer_from_mbuf = mpe->mpe_function; break; case MAC_SET_SOCKET_PEER_FROM_SOCKET: mpc->mpc_ops->mpo_set_socket_peer_from_socket = mpe->mpe_function; break; case MAC_CREATE_BPFDESC: mpc->mpc_ops->mpo_create_bpfdesc = mpe->mpe_function; break; case MAC_CREATE_DATAGRAM_FROM_IPQ: mpc->mpc_ops->mpo_create_datagram_from_ipq = mpe->mpe_function; break; case MAC_CREATE_FRAGMENT: mpc->mpc_ops->mpo_create_fragment = mpe->mpe_function; break; case MAC_CREATE_IFNET: mpc->mpc_ops->mpo_create_ifnet = mpe->mpe_function; break; case MAC_CREATE_IPQ: mpc->mpc_ops->mpo_create_ipq = mpe->mpe_function; break; case MAC_CREATE_MBUF_FROM_MBUF: mpc->mpc_ops->mpo_create_mbuf_from_mbuf = mpe->mpe_function; break; case MAC_CREATE_MBUF_LINKLAYER: mpc->mpc_ops->mpo_create_mbuf_linklayer = mpe->mpe_function; break; case MAC_CREATE_MBUF_FROM_BPFDESC: mpc->mpc_ops->mpo_create_mbuf_from_bpfdesc = mpe->mpe_function; break; case MAC_CREATE_MBUF_FROM_IFNET: mpc->mpc_ops->mpo_create_mbuf_from_ifnet = mpe->mpe_function; break; case MAC_CREATE_MBUF_MULTICAST_ENCAP: mpc->mpc_ops->mpo_create_mbuf_multicast_encap = mpe->mpe_function; break; case MAC_CREATE_MBUF_NETLAYER: mpc->mpc_ops->mpo_create_mbuf_netlayer = mpe->mpe_function; break; case MAC_FRAGMENT_MATCH: mpc->mpc_ops->mpo_fragment_match = mpe->mpe_function; break; case MAC_RELABEL_IFNET: mpc->mpc_ops->mpo_relabel_ifnet = mpe->mpe_function; break; case MAC_UPDATE_IPQ: mpc->mpc_ops->mpo_update_ipq = mpe->mpe_function; break; case MAC_CREATE_CRED: mpc->mpc_ops->mpo_create_cred = mpe->mpe_function; break; case MAC_EXECVE_TRANSITION: mpc->mpc_ops->mpo_execve_transition = mpe->mpe_function; break; case MAC_EXECVE_WILL_TRANSITION: mpc->mpc_ops->mpo_execve_will_transition = mpe->mpe_function; break; case MAC_CREATE_PROC0: mpc->mpc_ops->mpo_create_proc0 = mpe->mpe_function; break; case MAC_CREATE_PROC1: mpc->mpc_ops->mpo_create_proc1 = mpe->mpe_function; break; case MAC_RELABEL_CRED: mpc->mpc_ops->mpo_relabel_cred = mpe->mpe_function; break; case MAC_THREAD_USERRET: mpc->mpc_ops->mpo_thread_userret = mpe->mpe_function; break; case MAC_CHECK_BPFDESC_RECEIVE: mpc->mpc_ops->mpo_check_bpfdesc_receive = mpe->mpe_function; break; case MAC_CHECK_CRED_RELABEL: mpc->mpc_ops->mpo_check_cred_relabel = mpe->mpe_function; break; case MAC_CHECK_CRED_VISIBLE: mpc->mpc_ops->mpo_check_cred_visible = mpe->mpe_function; break; case MAC_CHECK_IFNET_RELABEL: mpc->mpc_ops->mpo_check_ifnet_relabel = mpe->mpe_function; break; case MAC_CHECK_IFNET_TRANSMIT: mpc->mpc_ops->mpo_check_ifnet_transmit = mpe->mpe_function; break; case MAC_CHECK_MOUNT_STAT: mpc->mpc_ops->mpo_check_mount_stat = mpe->mpe_function; break; case MAC_CHECK_PIPE_IOCTL: mpc->mpc_ops->mpo_check_pipe_ioctl = mpe->mpe_function; break; case MAC_CHECK_PIPE_POLL: mpc->mpc_ops->mpo_check_pipe_poll = mpe->mpe_function; break; case MAC_CHECK_PIPE_READ: mpc->mpc_ops->mpo_check_pipe_read = mpe->mpe_function; break; case MAC_CHECK_PIPE_RELABEL: mpc->mpc_ops->mpo_check_pipe_relabel = mpe->mpe_function; break; case MAC_CHECK_PIPE_STAT: mpc->mpc_ops->mpo_check_pipe_stat = mpe->mpe_function; break; case MAC_CHECK_PIPE_WRITE: mpc->mpc_ops->mpo_check_pipe_write = mpe->mpe_function; break; case MAC_CHECK_PROC_DEBUG: mpc->mpc_ops->mpo_check_proc_debug = mpe->mpe_function; break; case MAC_CHECK_PROC_SCHED: mpc->mpc_ops->mpo_check_proc_sched = mpe->mpe_function; break; case MAC_CHECK_PROC_SIGNAL: mpc->mpc_ops->mpo_check_proc_signal = mpe->mpe_function; break; case MAC_CHECK_SOCKET_BIND: mpc->mpc_ops->mpo_check_socket_bind = mpe->mpe_function; break; case MAC_CHECK_SOCKET_CONNECT: mpc->mpc_ops->mpo_check_socket_connect = mpe->mpe_function; break; case MAC_CHECK_SOCKET_DELIVER: mpc->mpc_ops->mpo_check_socket_deliver = mpe->mpe_function; break; case MAC_CHECK_SOCKET_LISTEN: mpc->mpc_ops->mpo_check_socket_listen = mpe->mpe_function; break; case MAC_CHECK_SOCKET_RELABEL: mpc->mpc_ops->mpo_check_socket_relabel = mpe->mpe_function; break; case MAC_CHECK_SOCKET_VISIBLE: mpc->mpc_ops->mpo_check_socket_visible = mpe->mpe_function; break; case MAC_CHECK_VNODE_ACCESS: mpc->mpc_ops->mpo_check_vnode_access = mpe->mpe_function; break; case MAC_CHECK_VNODE_CHDIR: mpc->mpc_ops->mpo_check_vnode_chdir = mpe->mpe_function; break; case MAC_CHECK_VNODE_CHROOT: mpc->mpc_ops->mpo_check_vnode_chroot = mpe->mpe_function; break; case MAC_CHECK_VNODE_CREATE: mpc->mpc_ops->mpo_check_vnode_create = mpe->mpe_function; break; case MAC_CHECK_VNODE_DELETE: mpc->mpc_ops->mpo_check_vnode_delete = mpe->mpe_function; break; case MAC_CHECK_VNODE_DELETEACL: mpc->mpc_ops->mpo_check_vnode_deleteacl = mpe->mpe_function; break; case MAC_CHECK_VNODE_EXEC: mpc->mpc_ops->mpo_check_vnode_exec = mpe->mpe_function; break; case MAC_CHECK_VNODE_GETACL: mpc->mpc_ops->mpo_check_vnode_getacl = mpe->mpe_function; break; case MAC_CHECK_VNODE_GETEXTATTR: mpc->mpc_ops->mpo_check_vnode_getextattr = mpe->mpe_function; break; + case MAC_CHECK_VNODE_LINK: + mpc->mpc_ops->mpo_check_vnode_link = + mpe->mpe_function; + break; case MAC_CHECK_VNODE_LOOKUP: mpc->mpc_ops->mpo_check_vnode_lookup = mpe->mpe_function; break; case MAC_CHECK_VNODE_MMAP_PERMS: mpc->mpc_ops->mpo_check_vnode_mmap_perms = mpe->mpe_function; break; case MAC_CHECK_VNODE_OPEN: mpc->mpc_ops->mpo_check_vnode_open = mpe->mpe_function; break; case MAC_CHECK_VNODE_POLL: mpc->mpc_ops->mpo_check_vnode_poll = mpe->mpe_function; break; case MAC_CHECK_VNODE_READ: mpc->mpc_ops->mpo_check_vnode_read = mpe->mpe_function; break; case MAC_CHECK_VNODE_READDIR: mpc->mpc_ops->mpo_check_vnode_readdir = mpe->mpe_function; break; case MAC_CHECK_VNODE_READLINK: mpc->mpc_ops->mpo_check_vnode_readlink = mpe->mpe_function; break; case MAC_CHECK_VNODE_RELABEL: mpc->mpc_ops->mpo_check_vnode_relabel = mpe->mpe_function; break; case MAC_CHECK_VNODE_RENAME_FROM: mpc->mpc_ops->mpo_check_vnode_rename_from = mpe->mpe_function; break; case MAC_CHECK_VNODE_RENAME_TO: mpc->mpc_ops->mpo_check_vnode_rename_to = mpe->mpe_function; break; case MAC_CHECK_VNODE_REVOKE: mpc->mpc_ops->mpo_check_vnode_revoke = mpe->mpe_function; break; case MAC_CHECK_VNODE_SETACL: mpc->mpc_ops->mpo_check_vnode_setacl = mpe->mpe_function; break; case MAC_CHECK_VNODE_SETEXTATTR: mpc->mpc_ops->mpo_check_vnode_setextattr = mpe->mpe_function; break; case MAC_CHECK_VNODE_SETFLAGS: mpc->mpc_ops->mpo_check_vnode_setflags = mpe->mpe_function; break; case MAC_CHECK_VNODE_SETMODE: mpc->mpc_ops->mpo_check_vnode_setmode = mpe->mpe_function; break; case MAC_CHECK_VNODE_SETOWNER: mpc->mpc_ops->mpo_check_vnode_setowner = mpe->mpe_function; break; case MAC_CHECK_VNODE_SETUTIMES: mpc->mpc_ops->mpo_check_vnode_setutimes = mpe->mpe_function; break; case MAC_CHECK_VNODE_STAT: mpc->mpc_ops->mpo_check_vnode_stat = mpe->mpe_function; break; case MAC_CHECK_VNODE_WRITE: mpc->mpc_ops->mpo_check_vnode_write = mpe->mpe_function; break; /* default: printf("MAC policy `%s': unknown operation %d\n", mpc->mpc_name, mpe->mpe_constant); return (EINVAL); */ } } MAC_POLICY_LIST_LOCK(); if (mac_policy_list_busy > 0) { MAC_POLICY_LIST_UNLOCK(); FREE(mpc->mpc_ops, M_MACOPVEC); mpc->mpc_ops = NULL; return (EBUSY); } LIST_FOREACH(tmpc, &mac_policy_list, mpc_list) { if (strcmp(tmpc->mpc_name, mpc->mpc_name) == 0) { MAC_POLICY_LIST_UNLOCK(); FREE(mpc->mpc_ops, M_MACOPVEC); mpc->mpc_ops = NULL; return (EEXIST); } } if (mpc->mpc_field_off != NULL) { slot = ffs(mac_policy_offsets_free); if (slot == 0) { MAC_POLICY_LIST_UNLOCK(); FREE(mpc->mpc_ops, M_MACOPVEC); mpc->mpc_ops = NULL; return (ENOMEM); } slot--; mac_policy_offsets_free &= ~(1 << slot); *mpc->mpc_field_off = slot; } mpc->mpc_runtime_flags |= MPC_RUNTIME_FLAG_REGISTERED; LIST_INSERT_HEAD(&mac_policy_list, mpc, mpc_list); /* Per-policy initialization. */ if (mpc->mpc_ops->mpo_init != NULL) (*(mpc->mpc_ops->mpo_init))(mpc); MAC_POLICY_LIST_UNLOCK(); printf("Security policy loaded: %s (%s)\n", mpc->mpc_fullname, mpc->mpc_name); return (0); } static int mac_policy_unregister(struct mac_policy_conf *mpc) { /* * If we fail the load, we may get a request to unload. Check * to see if we did the run-time registration, and if not, * silently succeed. */ MAC_POLICY_LIST_LOCK(); if ((mpc->mpc_runtime_flags & MPC_RUNTIME_FLAG_REGISTERED) == 0) { MAC_POLICY_LIST_UNLOCK(); return (0); } #if 0 /* * Don't allow unloading modules with private data. */ if (mpc->mpc_field_off != NULL) { MAC_POLICY_LIST_UNLOCK(); return (EBUSY); } #endif /* * Only allow the unload to proceed if the module is unloadable * by its own definition. */ if ((mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_UNLOADOK) == 0) { MAC_POLICY_LIST_UNLOCK(); return (EBUSY); } /* * Right now, we EBUSY if the list is in use. In the future, * for reliability reasons, we might want to sleep and wakeup * later to try again. */ if (mac_policy_list_busy > 0) { MAC_POLICY_LIST_UNLOCK(); return (EBUSY); } if (mpc->mpc_ops->mpo_destroy != NULL) (*(mpc->mpc_ops->mpo_destroy))(mpc); LIST_REMOVE(mpc, mpc_list); MAC_POLICY_LIST_UNLOCK(); FREE(mpc->mpc_ops, M_MACOPVEC); mpc->mpc_ops = NULL; printf("Security policy unload: %s (%s)\n", mpc->mpc_fullname, mpc->mpc_name); return (0); } /* * Define an error value precedence, and given two arguments, selects the * value with the higher precedence. */ static int error_select(int error1, int error2) { /* Certain decision-making errors take top priority. */ if (error1 == EDEADLK || error2 == EDEADLK) return (EDEADLK); /* Invalid arguments should be reported where possible. */ if (error1 == EINVAL || error2 == EINVAL) return (EINVAL); /* Precedence goes to "visibility", with both process and file. */ if (error1 == ESRCH || error2 == ESRCH) return (ESRCH); if (error1 == ENOENT || error2 == ENOENT) return (ENOENT); /* Precedence goes to DAC/MAC protections. */ if (error1 == EACCES || error2 == EACCES) return (EACCES); /* Precedence goes to privilege. */ if (error1 == EPERM || error2 == EPERM) return (EPERM); /* Precedence goes to error over success; otherwise, arbitrary. */ if (error1 != 0) return (error1); return (error2); } static void mac_init_label(struct label *label) { bzero(label, sizeof(*label)); label->l_flags = MAC_FLAG_INITIALIZED; } static void mac_destroy_label(struct label *label) { KASSERT(label->l_flags & MAC_FLAG_INITIALIZED, ("destroying uninitialized label")); bzero(label, sizeof(*label)); /* implicit: label->l_flags &= ~MAC_FLAG_INITIALIZED; */ } static void mac_init_structmac(struct mac *mac) { bzero(mac, sizeof(*mac)); mac->m_macflags = MAC_FLAG_INITIALIZED; } void mac_init_bpfdesc(struct bpf_d *bpf_d) { mac_init_label(&bpf_d->bd_label); MAC_PERFORM(init_bpfdesc_label, &bpf_d->bd_label); #ifdef MAC_DEBUG atomic_add_int(&nmacbpfdescs, 1); #endif } void mac_init_cred(struct ucred *cr) { mac_init_label(&cr->cr_label); MAC_PERFORM(init_cred_label, &cr->cr_label); #ifdef MAC_DEBUG atomic_add_int(&nmaccreds, 1); #endif } void mac_init_devfsdirent(struct devfs_dirent *de) { mac_init_label(&de->de_label); MAC_PERFORM(init_devfsdirent_label, &de->de_label); #ifdef MAC_DEBUG atomic_add_int(&nmacdevfsdirents, 1); #endif } void mac_init_ifnet(struct ifnet *ifp) { mac_init_label(&ifp->if_label); MAC_PERFORM(init_ifnet_label, &ifp->if_label); #ifdef MAC_DEBUG atomic_add_int(&nmacifnets, 1); #endif } void mac_init_ipq(struct ipq *ipq) { mac_init_label(&ipq->ipq_label); MAC_PERFORM(init_ipq_label, &ipq->ipq_label); #ifdef MAC_DEBUG atomic_add_int(&nmacipqs, 1); #endif } int mac_init_mbuf(struct mbuf *m, int flag) { int error; KASSERT(m->m_flags & M_PKTHDR, ("mac_init_mbuf on non-header mbuf")); mac_init_label(&m->m_pkthdr.label); MAC_CHECK(init_mbuf_label, &m->m_pkthdr.label, flag); if (error) { MAC_PERFORM(destroy_mbuf_label, &m->m_pkthdr.label); mac_destroy_label(&m->m_pkthdr.label); } #ifdef MAC_DEBUG if (error == 0) atomic_add_int(&nmacmbufs, 1); #endif return (error); } void mac_init_mount(struct mount *mp) { mac_init_label(&mp->mnt_mntlabel); mac_init_label(&mp->mnt_fslabel); MAC_PERFORM(init_mount_label, &mp->mnt_mntlabel); MAC_PERFORM(init_mount_fs_label, &mp->mnt_fslabel); #ifdef MAC_DEBUG atomic_add_int(&nmacmounts, 1); #endif } void mac_init_pipe(struct pipe *pipe) { struct label *label; label = malloc(sizeof(struct label), M_MACPIPELABEL, M_ZERO|M_WAITOK); mac_init_label(label); pipe->pipe_label = label; pipe->pipe_peer->pipe_label = label; MAC_PERFORM(init_pipe_label, pipe->pipe_label); #ifdef MAC_DEBUG atomic_add_int(&nmacpipes, 1); #endif } void mac_init_socket(struct socket *socket) { mac_init_label(&socket->so_label); mac_init_label(&socket->so_peerlabel); MAC_PERFORM(init_socket_label, &socket->so_label); MAC_PERFORM(init_socket_peer_label, &socket->so_peerlabel); #ifdef MAC_DEBUG atomic_add_int(&nmacsockets, 1); #endif } static void mac_init_temp(struct label *label) { mac_init_label(label); MAC_PERFORM(init_temp_label, label); #ifdef MAC_DEBUG atomic_add_int(&nmactemp, 1); #endif } void mac_init_vnode(struct vnode *vp) { mac_init_label(&vp->v_label); MAC_PERFORM(init_vnode_label, &vp->v_label); #ifdef MAC_DEBUG atomic_add_int(&nmacvnodes, 1); #endif } void mac_destroy_bpfdesc(struct bpf_d *bpf_d) { MAC_PERFORM(destroy_bpfdesc_label, &bpf_d->bd_label); mac_destroy_label(&bpf_d->bd_label); #ifdef MAC_DEBUG atomic_subtract_int(&nmacbpfdescs, 1); #endif } void mac_destroy_cred(struct ucred *cr) { MAC_PERFORM(destroy_cred_label, &cr->cr_label); mac_destroy_label(&cr->cr_label); #ifdef MAC_DEBUG atomic_subtract_int(&nmaccreds, 1); #endif } void mac_destroy_devfsdirent(struct devfs_dirent *de) { MAC_PERFORM(destroy_devfsdirent_label, &de->de_label); mac_destroy_label(&de->de_label); #ifdef MAC_DEBUG atomic_subtract_int(&nmacdevfsdirents, 1); #endif } void mac_destroy_ifnet(struct ifnet *ifp) { MAC_PERFORM(destroy_ifnet_label, &ifp->if_label); mac_destroy_label(&ifp->if_label); #ifdef MAC_DEBUG atomic_subtract_int(&nmacifnets, 1); #endif } void mac_destroy_ipq(struct ipq *ipq) { MAC_PERFORM(destroy_ipq_label, &ipq->ipq_label); mac_destroy_label(&ipq->ipq_label); #ifdef MAC_DEBUG atomic_subtract_int(&nmacipqs, 1); #endif } void mac_destroy_mbuf(struct mbuf *m) { MAC_PERFORM(destroy_mbuf_label, &m->m_pkthdr.label); mac_destroy_label(&m->m_pkthdr.label); #ifdef MAC_DEBUG atomic_subtract_int(&nmacmbufs, 1); #endif } void mac_destroy_mount(struct mount *mp) { MAC_PERFORM(destroy_mount_label, &mp->mnt_mntlabel); MAC_PERFORM(destroy_mount_fs_label, &mp->mnt_fslabel); mac_destroy_label(&mp->mnt_fslabel); mac_destroy_label(&mp->mnt_mntlabel); #ifdef MAC_DEBUG atomic_subtract_int(&nmacmounts, 1); #endif } void mac_destroy_pipe(struct pipe *pipe) { MAC_PERFORM(destroy_pipe_label, pipe->pipe_label); mac_destroy_label(pipe->pipe_label); free(pipe->pipe_label, M_MACPIPELABEL); #ifdef MAC_DEBUG atomic_subtract_int(&nmacpipes, 1); #endif } void mac_destroy_socket(struct socket *socket) { MAC_PERFORM(destroy_socket_label, &socket->so_label); MAC_PERFORM(destroy_socket_peer_label, &socket->so_peerlabel); mac_destroy_label(&socket->so_label); mac_destroy_label(&socket->so_peerlabel); #ifdef MAC_DEBUG atomic_subtract_int(&nmacsockets, 1); #endif } static void mac_destroy_temp(struct label *label) { MAC_PERFORM(destroy_temp_label, label); mac_destroy_label(label); #ifdef MAC_DEBUG atomic_subtract_int(&nmactemp, 1); #endif } void mac_destroy_vnode(struct vnode *vp) { MAC_PERFORM(destroy_vnode_label, &vp->v_label); mac_destroy_label(&vp->v_label); #ifdef MAC_DEBUG atomic_subtract_int(&nmacvnodes, 1); #endif } static int mac_externalize(struct label *label, struct mac *mac) { int error; mac_init_structmac(mac); MAC_CHECK(externalize, label, mac); return (error); } static int mac_internalize(struct label *label, struct mac *mac) { int error; mac_init_temp(label); MAC_CHECK(internalize, label, mac); if (error) mac_destroy_temp(label); return (error); } /* * Initialize MAC label for the first kernel process, from which other * kernel processes and threads are spawned. */ void mac_create_proc0(struct ucred *cred) { MAC_PERFORM(create_proc0, cred); } /* * Initialize MAC label for the first userland process, from which other * userland processes and threads are spawned. */ void mac_create_proc1(struct ucred *cred) { MAC_PERFORM(create_proc1, cred); } void mac_thread_userret(struct thread *td) { MAC_PERFORM(thread_userret, td); } /* * When a new process is created, its label must be initialized. Generally, * this involves inheritence from the parent process, modulo possible * deltas. This function allows that processing to take place. */ void mac_create_cred(struct ucred *parent_cred, struct ucred *child_cred) { MAC_PERFORM(create_cred, parent_cred, child_cred); } void mac_update_devfsdirent(struct devfs_dirent *de, struct vnode *vp) { MAC_PERFORM(update_devfsdirent, de, &de->de_label, vp, &vp->v_label); } void mac_update_procfsvnode(struct vnode *vp, struct ucred *cred) { MAC_PERFORM(update_procfsvnode, vp, &vp->v_label, cred); } /* * Support callout for policies that manage their own externalization * using extended attributes. */ static int mac_update_vnode_from_extattr(struct vnode *vp, struct mount *mp) { int error; MAC_CHECK(update_vnode_from_extattr, vp, &vp->v_label, mp, &mp->mnt_fslabel); return (error); } /* * Given an externalized mac label, internalize it and stamp it on a * vnode. */ static int mac_update_vnode_from_externalized(struct vnode *vp, struct mac *extmac) { int error; MAC_CHECK(update_vnode_from_externalized, vp, &vp->v_label, extmac); return (error); } /* * Call out to individual policies to update the label in a vnode from * the mountpoint. */ void mac_update_vnode_from_mount(struct vnode *vp, struct mount *mp) { MAC_PERFORM(update_vnode_from_mount, vp, &vp->v_label, mp, &mp->mnt_fslabel); ASSERT_VOP_LOCKED(vp, "mac_update_vnode_from_mount"); if (mac_cache_fslabel_in_vnode) vp->v_vflag |= VV_CACHEDLABEL; } /* * Implementation of VOP_REFRESHLABEL() that relies on extended attributes * to store label data. Can be referenced by filesystems supporting * extended attributes. */ int vop_stdrefreshlabel_ea(struct vop_refreshlabel_args *ap) { struct vnode *vp = ap->a_vp; struct mac extmac; int buflen, error; ASSERT_VOP_LOCKED(vp, "vop_stdrefreshlabel_ea"); /* * Call out to external policies first. Order doesn't really * matter, as long as failure of one assures failure of all. */ error = mac_update_vnode_from_extattr(vp, vp->v_mount); if (error) return (error); buflen = sizeof(extmac); error = vn_extattr_get(vp, IO_NODELOCKED, FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME, &buflen, (char *)&extmac, curthread); switch (error) { case 0: /* Got it */ break; case ENOATTR: /* * Use the label from the mount point. */ mac_update_vnode_from_mount(vp, vp->v_mount); return (0); case EOPNOTSUPP: default: /* Fail horribly. */ return (error); } if (buflen != sizeof(extmac)) error = EPERM; /* Fail very closed. */ if (error == 0) error = mac_update_vnode_from_externalized(vp, &extmac); if (error == 0) vp->v_vflag |= VV_CACHEDLABEL; else { struct vattr va; printf("Corrupted label on %s", vp->v_mount->mnt_stat.f_mntonname); if (VOP_GETATTR(vp, &va, curthread->td_ucred, curthread) == 0) printf(" inum %ld", va.va_fileid); #ifdef MAC_DEBUG if (mac_debug_label_fallback) { printf(", falling back.\n"); mac_update_vnode_from_mount(vp, vp->v_mount); error = 0; } else { #endif printf(".\n"); error = EPERM; #ifdef MAC_DEBUG } #endif } return (error); } /* * Make sure the vnode label is up-to-date. If EOPNOTSUPP, then we handle * the labeling activity outselves. Filesystems should be careful not * to change their minds regarding whether they support vop_refreshlabel() * for a vnode or not. Don't cache the vnode here, allow the file * system code to determine if it's safe to cache. If we update from * the mount, don't cache since a change to the mount label should affect * all vnodes. */ static int vn_refreshlabel(struct vnode *vp, struct ucred *cred) { int error; ASSERT_VOP_LOCKED(vp, "vn_refreshlabel"); if (vp->v_mount == NULL) { /* Eventually, we probably want to special-case refreshing of deadfs vnodes, and if there's a lock-free race somewhere, that case might be handled here. mac_update_vnode_deadfs(vp); return (0); */ /* printf("vn_refreshlabel: null v_mount\n"); */ if (vp->v_type != VNON) printf( "vn_refreshlabel: null v_mount with non-VNON\n"); return (EBADF); } if (vp->v_vflag & VV_CACHEDLABEL) { mac_vnode_label_cache_hits++; return (0); } else mac_vnode_label_cache_misses++; if ((vp->v_mount->mnt_flag & MNT_MULTILABEL) == 0) { mac_update_vnode_from_mount(vp, vp->v_mount); return (0); } error = VOP_REFRESHLABEL(vp, cred, curthread); switch (error) { case EOPNOTSUPP: /* * If labels are not supported on this vnode, fall back to * the label in the mount and propagate it to the vnode. * There should probably be some sort of policy/flag/decision * about doing this. */ mac_update_vnode_from_mount(vp, vp->v_mount); error = 0; default: return (error); } } /* * Helper function for file systems using the vop_std*_ea() calls. This * function must be called after EA service is available for the vnode, * but before it's hooked up to the namespace so that the node persists * if there's a crash, or before it can be accessed. On successful * commit of the label to disk (etc), do cache the label. */ int vop_stdcreatevnode_ea(struct vnode *dvp, struct vnode *tvp, struct ucred *cred) { struct mac extmac; int error; ASSERT_VOP_LOCKED(tvp, "vop_stdcreatevnode_ea"); if ((dvp->v_mount->mnt_flag & MNT_MULTILABEL) == 0) { mac_update_vnode_from_mount(tvp, tvp->v_mount); } else { error = vn_refreshlabel(dvp, cred); if (error) return (error); /* * Stick the label in the vnode. Then try to write to * disk. If we fail, return a failure to abort the * create operation. Really, this failure shouldn't * happen except in fairly unusual circumstances (out * of disk, etc). */ mac_create_vnode(cred, dvp, tvp); error = mac_stdcreatevnode_ea(tvp); if (error) return (error); /* * XXX: Eventually this will go away and all policies will * directly manage their extended attributes. */ error = mac_externalize(&tvp->v_label, &extmac); if (error) return (error); error = vn_extattr_set(tvp, IO_NODELOCKED, FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME, sizeof(extmac), (char *)&extmac, curthread); if (error == 0) tvp->v_vflag |= VV_CACHEDLABEL; else { #if 0 /* * In theory, we could have fall-back behavior here. * It would probably be incorrect. */ #endif return (error); } } return (0); } void mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_execve_transition"); error = vn_refreshlabel(vp, old); if (error) { printf("mac_execve_transition: vn_refreshlabel returned %d\n", error); printf("mac_execve_transition: using old vnode label\n"); } MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label); } int mac_execve_will_transition(struct ucred *old, struct vnode *vp) { int error, result; error = vn_refreshlabel(vp, old); if (error) return (error); result = 0; MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label); return (result); } int mac_check_vnode_access(struct ucred *cred, struct vnode *vp, int flags) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_access"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_access, cred, vp, &vp->v_label, flags); return (error); } int mac_check_vnode_chdir(struct ucred *cred, struct vnode *dvp) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_chdir"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); MAC_CHECK(check_vnode_chdir, cred, dvp, &dvp->v_label); return (error); } int mac_check_vnode_chroot(struct ucred *cred, struct vnode *dvp) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_chroot"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); MAC_CHECK(check_vnode_chroot, cred, dvp, &dvp->v_label); return (error); } int mac_check_vnode_create(struct ucred *cred, struct vnode *dvp, struct componentname *cnp, struct vattr *vap) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_create"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); MAC_CHECK(check_vnode_create, cred, dvp, &dvp->v_label, cnp, vap); return (error); } int mac_check_vnode_delete(struct ucred *cred, struct vnode *dvp, struct vnode *vp, struct componentname *cnp) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_delete"); ASSERT_VOP_LOCKED(vp, "mac_check_vnode_delete"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_delete, cred, dvp, &dvp->v_label, vp, &vp->v_label, cnp); return (error); } int mac_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp, acl_type_t type) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_deleteacl"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_deleteacl, cred, vp, &vp->v_label, type); return (error); } int mac_check_vnode_exec(struct ucred *cred, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_exec"); if (!mac_enforce_process && !mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label); return (error); } int mac_check_vnode_getacl(struct ucred *cred, struct vnode *vp, acl_type_t type) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_getacl"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_getacl, cred, vp, &vp->v_label, type); return (error); } int mac_check_vnode_getextattr(struct ucred *cred, struct vnode *vp, int attrnamespace, const char *name, struct uio *uio) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_getextattr"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_getextattr, cred, vp, &vp->v_label, attrnamespace, name, uio); + return (error); +} + +int +mac_check_vnode_link(struct ucred *cred, struct vnode *dvp, + struct vnode *vp, struct componentname *cnp) +{ + + int error; + + ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_link"); + ASSERT_VOP_LOCKED(vp, "mac_check_vnode_link"); + + if (!mac_enforce_fs) + return (0); + + error = vn_refreshlabel(dvp, cred); + if (error) + return (error); + + error = vn_refreshlabel(vp, cred); + if (error) + return (error); + + MAC_CHECK(check_vnode_link, cred, dvp, &dvp->v_label, vp, + &vp->v_label, cnp); return (error); } int mac_check_vnode_lookup(struct ucred *cred, struct vnode *dvp, struct componentname *cnp) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_lookup"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); MAC_CHECK(check_vnode_lookup, cred, dvp, &dvp->v_label, cnp); return (error); } vm_prot_t mac_check_vnode_mmap_prot(struct ucred *cred, struct vnode *vp, int newmapping) { vm_prot_t result = VM_PROT_ALL; if (!mac_enforce_vm) return (result); /* * This should be some sort of MAC_BITWISE, maybe :) */ ASSERT_VOP_LOCKED(vp, "mac_check_vnode_mmap_perms"); MAC_BOOLEAN(check_vnode_mmap_perms, &, cred, vp, &vp->v_label, newmapping); return (result); } int mac_check_vnode_open(struct ucred *cred, struct vnode *vp, mode_t acc_mode) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_open"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_open, cred, vp, &vp->v_label, acc_mode); return (error); } int mac_check_vnode_poll(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_poll"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, active_cred); if (error) return (error); MAC_CHECK(check_vnode_poll, active_cred, file_cred, vp, &vp->v_label); return (error); } int mac_check_vnode_read(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_read"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, active_cred); if (error) return (error); MAC_CHECK(check_vnode_read, active_cred, file_cred, vp, &vp->v_label); return (error); } int mac_check_vnode_readdir(struct ucred *cred, struct vnode *dvp) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_readdir"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); MAC_CHECK(check_vnode_readdir, cred, dvp, &dvp->v_label); return (error); } int mac_check_vnode_readlink(struct ucred *cred, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_readlink"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_readlink, cred, vp, &vp->v_label); return (error); } static int mac_check_vnode_relabel(struct ucred *cred, struct vnode *vp, struct label *newlabel) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_relabel"); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_relabel, cred, vp, &vp->v_label, newlabel); return (error); } int mac_check_vnode_rename_from(struct ucred *cred, struct vnode *dvp, struct vnode *vp, struct componentname *cnp) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_rename_from"); ASSERT_VOP_LOCKED(vp, "mac_check_vnode_rename_from"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_rename_from, cred, dvp, &dvp->v_label, vp, &vp->v_label, cnp); return (error); } int mac_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp, struct vnode *vp, int samedir, struct componentname *cnp) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_rename_to"); ASSERT_VOP_LOCKED(vp, "mac_check_vnode_rename_to"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); if (vp != NULL) { error = vn_refreshlabel(vp, cred); if (error) return (error); } MAC_CHECK(check_vnode_rename_to, cred, dvp, &dvp->v_label, vp, vp != NULL ? &vp->v_label : NULL, samedir, cnp); return (error); } int mac_check_vnode_revoke(struct ucred *cred, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_revoke"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_revoke, cred, vp, &vp->v_label); return (error); } int mac_check_vnode_setacl(struct ucred *cred, struct vnode *vp, acl_type_t type, struct acl *acl) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setacl"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_setacl, cred, vp, &vp->v_label, type, acl); return (error); } int mac_check_vnode_setextattr(struct ucred *cred, struct vnode *vp, int attrnamespace, const char *name, struct uio *uio) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setextattr"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_setextattr, cred, vp, &vp->v_label, attrnamespace, name, uio); return (error); } int mac_check_vnode_setflags(struct ucred *cred, struct vnode *vp, u_long flags) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setflags"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_setflags, cred, vp, &vp->v_label, flags); return (error); } int mac_check_vnode_setmode(struct ucred *cred, struct vnode *vp, mode_t mode) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setmode"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_setmode, cred, vp, &vp->v_label, mode); return (error); } int mac_check_vnode_setowner(struct ucred *cred, struct vnode *vp, uid_t uid, gid_t gid) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setowner"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_setowner, cred, vp, &vp->v_label, uid, gid); return (error); } int mac_check_vnode_setutimes(struct ucred *cred, struct vnode *vp, struct timespec atime, struct timespec mtime) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setutimes"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_setutimes, cred, vp, &vp->v_label, atime, mtime); return (error); } int mac_check_vnode_stat(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_stat"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, active_cred); if (error) return (error); MAC_CHECK(check_vnode_stat, active_cred, file_cred, vp, &vp->v_label); return (error); } int mac_check_vnode_write(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_write"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, active_cred); if (error) return (error); MAC_CHECK(check_vnode_write, active_cred, file_cred, vp, &vp->v_label); return (error); } /* * When relabeling a process, call out to the policies for the maximum * permission allowed for each object type we know about in its * memory space, and revoke access (in the least surprising ways we * know) when necessary. The process lock is not held here. */ static void mac_cred_mmapped_drop_perms(struct thread *td, struct ucred *cred) { /* XXX freeze all other threads */ mac_cred_mmapped_drop_perms_recurse(td, cred, &td->td_proc->p_vmspace->vm_map); /* XXX allow other threads to continue */ } static __inline const char * prot2str(vm_prot_t prot) { switch (prot & VM_PROT_ALL) { case VM_PROT_READ: return ("r--"); case VM_PROT_READ | VM_PROT_WRITE: return ("rw-"); case VM_PROT_READ | VM_PROT_EXECUTE: return ("r-x"); case VM_PROT_READ | VM_PROT_WRITE | VM_PROT_EXECUTE: return ("rwx"); case VM_PROT_WRITE: return ("-w-"); case VM_PROT_EXECUTE: return ("--x"); case VM_PROT_WRITE | VM_PROT_EXECUTE: return ("-wx"); default: return ("---"); } } static void mac_cred_mmapped_drop_perms_recurse(struct thread *td, struct ucred *cred, struct vm_map *map) { struct vm_map_entry *vme; vm_prot_t result, revokeperms; vm_object_t object; vm_ooffset_t offset; struct vnode *vp; if (!mac_mmap_revocation) return; vm_map_lock_read(map); for (vme = map->header.next; vme != &map->header; vme = vme->next) { if (vme->eflags & MAP_ENTRY_IS_SUB_MAP) { mac_cred_mmapped_drop_perms_recurse(td, cred, vme->object.sub_map); continue; } /* * Skip over entries that obviously are not shared. */ if (vme->eflags & (MAP_ENTRY_COW | MAP_ENTRY_NOSYNC) || !vme->max_protection) continue; /* * Drill down to the deepest backing object. */ offset = vme->offset; object = vme->object.vm_object; if (object == NULL) continue; while (object->backing_object != NULL) { object = object->backing_object; offset += object->backing_object_offset; } /* * At the moment, vm_maps and objects aren't considered * by the MAC system, so only things with backing by a * normal object (read: vnodes) are checked. */ if (object->type != OBJT_VNODE) continue; vp = (struct vnode *)object->handle; vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); result = mac_check_vnode_mmap_prot(cred, vp, 0); VOP_UNLOCK(vp, 0, td); /* * Find out what maximum protection we may be allowing * now but a policy needs to get removed. */ revokeperms = vme->max_protection & ~result; if (!revokeperms) continue; printf("pid %ld: revoking %s perms from %#lx:%ld " "(max %s/cur %s)\n", (long)td->td_proc->p_pid, prot2str(revokeperms), (u_long)vme->start, (long)(vme->end - vme->start), prot2str(vme->max_protection), prot2str(vme->protection)); vm_map_lock_upgrade(map); /* * This is the really simple case: if a map has more * max_protection than is allowed, but it's not being * actually used (that is, the current protection is * still allowed), we can just wipe it out and do * nothing more. */ if ((vme->protection & revokeperms) == 0) { vme->max_protection -= revokeperms; } else { if (revokeperms & VM_PROT_WRITE) { /* * In the more complicated case, flush out all * pending changes to the object then turn it * copy-on-write. */ vm_object_reference(object); vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); vm_object_page_clean(object, OFF_TO_IDX(offset), OFF_TO_IDX(offset + vme->end - vme->start + PAGE_MASK), OBJPC_SYNC); VOP_UNLOCK(vp, 0, td); vm_object_deallocate(object); /* * Why bother if there's no read permissions * anymore? For the rest, we need to leave * the write permissions on for COW, or * remove them entirely if configured to. */ if (!mac_mmap_revocation_via_cow) { vme->max_protection &= ~VM_PROT_WRITE; vme->protection &= ~VM_PROT_WRITE; } if ((revokeperms & VM_PROT_READ) == 0) vme->eflags |= MAP_ENTRY_COW | MAP_ENTRY_NEEDS_COPY; } if (revokeperms & VM_PROT_EXECUTE) { vme->max_protection &= ~VM_PROT_EXECUTE; vme->protection &= ~VM_PROT_EXECUTE; } if (revokeperms & VM_PROT_READ) { vme->max_protection = 0; vme->protection = 0; } pmap_protect(map->pmap, vme->start, vme->end, vme->protection & ~revokeperms); vm_map_simplify_entry(map, vme); } vm_map_lock_downgrade(map); } vm_map_unlock_read(map); } /* * When the subject's label changes, it may require revocation of privilege * to mapped objects. This can't be done on-the-fly later with a unified * buffer cache. */ static void mac_relabel_cred(struct ucred *cred, struct label *newlabel) { MAC_PERFORM(relabel_cred, cred, newlabel); } void mac_relabel_vnode(struct ucred *cred, struct vnode *vp, struct label *newlabel) { MAC_PERFORM(relabel_vnode, cred, vp, &vp->v_label, newlabel); } void mac_create_ifnet(struct ifnet *ifnet) { MAC_PERFORM(create_ifnet, ifnet, &ifnet->if_label); } void mac_create_bpfdesc(struct ucred *cred, struct bpf_d *bpf_d) { MAC_PERFORM(create_bpfdesc, cred, bpf_d, &bpf_d->bd_label); } void mac_create_socket(struct ucred *cred, struct socket *socket) { MAC_PERFORM(create_socket, cred, socket, &socket->so_label); } void mac_create_pipe(struct ucred *cred, struct pipe *pipe) { MAC_PERFORM(create_pipe, cred, pipe, pipe->pipe_label); } void mac_create_socket_from_socket(struct socket *oldsocket, struct socket *newsocket) { MAC_PERFORM(create_socket_from_socket, oldsocket, &oldsocket->so_label, newsocket, &newsocket->so_label); } static void mac_relabel_socket(struct ucred *cred, struct socket *socket, struct label *newlabel) { MAC_PERFORM(relabel_socket, cred, socket, &socket->so_label, newlabel); } static void mac_relabel_pipe(struct ucred *cred, struct pipe *pipe, struct label *newlabel) { MAC_PERFORM(relabel_pipe, cred, pipe, pipe->pipe_label, newlabel); } void mac_set_socket_peer_from_mbuf(struct mbuf *mbuf, struct socket *socket) { MAC_PERFORM(set_socket_peer_from_mbuf, mbuf, &mbuf->m_pkthdr.label, socket, &socket->so_peerlabel); } void mac_set_socket_peer_from_socket(struct socket *oldsocket, struct socket *newsocket) { MAC_PERFORM(set_socket_peer_from_socket, oldsocket, &oldsocket->so_label, newsocket, &newsocket->so_peerlabel); } void mac_create_datagram_from_ipq(struct ipq *ipq, struct mbuf *datagram) { MAC_PERFORM(create_datagram_from_ipq, ipq, &ipq->ipq_label, datagram, &datagram->m_pkthdr.label); } void mac_create_fragment(struct mbuf *datagram, struct mbuf *fragment) { MAC_PERFORM(create_fragment, datagram, &datagram->m_pkthdr.label, fragment, &fragment->m_pkthdr.label); } void mac_create_ipq(struct mbuf *fragment, struct ipq *ipq) { MAC_PERFORM(create_ipq, fragment, &fragment->m_pkthdr.label, ipq, &ipq->ipq_label); } void mac_create_mbuf_from_mbuf(struct mbuf *oldmbuf, struct mbuf *newmbuf) { MAC_PERFORM(create_mbuf_from_mbuf, oldmbuf, &oldmbuf->m_pkthdr.label, newmbuf, &newmbuf->m_pkthdr.label); } void mac_create_mbuf_from_bpfdesc(struct bpf_d *bpf_d, struct mbuf *mbuf) { MAC_PERFORM(create_mbuf_from_bpfdesc, bpf_d, &bpf_d->bd_label, mbuf, &mbuf->m_pkthdr.label); } void mac_create_mbuf_linklayer(struct ifnet *ifnet, struct mbuf *mbuf) { MAC_PERFORM(create_mbuf_linklayer, ifnet, &ifnet->if_label, mbuf, &mbuf->m_pkthdr.label); } void mac_create_mbuf_from_ifnet(struct ifnet *ifnet, struct mbuf *mbuf) { MAC_PERFORM(create_mbuf_from_ifnet, ifnet, &ifnet->if_label, mbuf, &mbuf->m_pkthdr.label); } void mac_create_mbuf_multicast_encap(struct mbuf *oldmbuf, struct ifnet *ifnet, struct mbuf *newmbuf) { MAC_PERFORM(create_mbuf_multicast_encap, oldmbuf, &oldmbuf->m_pkthdr.label, ifnet, &ifnet->if_label, newmbuf, &newmbuf->m_pkthdr.label); } void mac_create_mbuf_netlayer(struct mbuf *oldmbuf, struct mbuf *newmbuf) { MAC_PERFORM(create_mbuf_netlayer, oldmbuf, &oldmbuf->m_pkthdr.label, newmbuf, &newmbuf->m_pkthdr.label); } int mac_fragment_match(struct mbuf *fragment, struct ipq *ipq) { int result; result = 1; MAC_BOOLEAN(fragment_match, &&, fragment, &fragment->m_pkthdr.label, ipq, &ipq->ipq_label); return (result); } void mac_update_ipq(struct mbuf *fragment, struct ipq *ipq) { MAC_PERFORM(update_ipq, fragment, &fragment->m_pkthdr.label, ipq, &ipq->ipq_label); } void mac_create_mbuf_from_socket(struct socket *socket, struct mbuf *mbuf) { MAC_PERFORM(create_mbuf_from_socket, socket, &socket->so_label, mbuf, &mbuf->m_pkthdr.label); } void mac_create_mount(struct ucred *cred, struct mount *mp) { MAC_PERFORM(create_mount, cred, mp, &mp->mnt_mntlabel, &mp->mnt_fslabel); } void mac_create_root_mount(struct ucred *cred, struct mount *mp) { MAC_PERFORM(create_root_mount, cred, mp, &mp->mnt_mntlabel, &mp->mnt_fslabel); } int mac_check_bpfdesc_receive(struct bpf_d *bpf_d, struct ifnet *ifnet) { int error; if (!mac_enforce_network) return (0); MAC_CHECK(check_bpfdesc_receive, bpf_d, &bpf_d->bd_label, ifnet, &ifnet->if_label); return (error); } static int mac_check_cred_relabel(struct ucred *cred, struct label *newlabel) { int error; MAC_CHECK(check_cred_relabel, cred, newlabel); return (error); } int mac_check_cred_visible(struct ucred *u1, struct ucred *u2) { int error; if (!mac_enforce_process) return (0); MAC_CHECK(check_cred_visible, u1, u2); return (error); } int mac_check_ifnet_transmit(struct ifnet *ifnet, struct mbuf *mbuf) { int error; if (!mac_enforce_network) return (0); KASSERT(mbuf->m_flags & M_PKTHDR, ("packet has no pkthdr")); if (!(mbuf->m_pkthdr.label.l_flags & MAC_FLAG_INITIALIZED)) printf("%s%d: not initialized\n", ifnet->if_name, ifnet->if_unit); MAC_CHECK(check_ifnet_transmit, ifnet, &ifnet->if_label, mbuf, &mbuf->m_pkthdr.label); return (error); } int mac_check_mount_stat(struct ucred *cred, struct mount *mount) { int error; if (!mac_enforce_fs) return (0); MAC_CHECK(check_mount_stat, cred, mount, &mount->mnt_mntlabel); return (error); } int mac_check_pipe_ioctl(struct ucred *cred, struct pipe *pipe, unsigned long cmd, void *data) { int error; PIPE_LOCK_ASSERT(pipe, MA_OWNED); if (!mac_enforce_pipe) return (0); MAC_CHECK(check_pipe_ioctl, cred, pipe, pipe->pipe_label, cmd, data); return (error); } int mac_check_pipe_poll(struct ucred *cred, struct pipe *pipe) { int error; PIPE_LOCK_ASSERT(pipe, MA_OWNED); if (!mac_enforce_pipe) return (0); MAC_CHECK(check_pipe_poll, cred, pipe, pipe->pipe_label); return (error); } int mac_check_pipe_read(struct ucred *cred, struct pipe *pipe) { int error; PIPE_LOCK_ASSERT(pipe, MA_OWNED); if (!mac_enforce_pipe) return (0); MAC_CHECK(check_pipe_read, cred, pipe, pipe->pipe_label); return (error); } static int mac_check_pipe_relabel(struct ucred *cred, struct pipe *pipe, struct label *newlabel) { int error; PIPE_LOCK_ASSERT(pipe, MA_OWNED); if (!mac_enforce_pipe) return (0); MAC_CHECK(check_pipe_relabel, cred, pipe, pipe->pipe_label, newlabel); return (error); } int mac_check_pipe_stat(struct ucred *cred, struct pipe *pipe) { int error; PIPE_LOCK_ASSERT(pipe, MA_OWNED); if (!mac_enforce_pipe) return (0); MAC_CHECK(check_pipe_stat, cred, pipe, pipe->pipe_label); return (error); } int mac_check_pipe_write(struct ucred *cred, struct pipe *pipe) { int error; PIPE_LOCK_ASSERT(pipe, MA_OWNED); if (!mac_enforce_pipe) return (0); MAC_CHECK(check_pipe_write, cred, pipe, pipe->pipe_label); return (error); } int mac_check_proc_debug(struct ucred *cred, struct proc *proc) { int error; PROC_LOCK_ASSERT(proc, MA_OWNED); if (!mac_enforce_process) return (0); MAC_CHECK(check_proc_debug, cred, proc); return (error); } int mac_check_proc_sched(struct ucred *cred, struct proc *proc) { int error; PROC_LOCK_ASSERT(proc, MA_OWNED); if (!mac_enforce_process) return (0); MAC_CHECK(check_proc_sched, cred, proc); return (error); } int mac_check_proc_signal(struct ucred *cred, struct proc *proc, int signum) { int error; PROC_LOCK_ASSERT(proc, MA_OWNED); if (!mac_enforce_process) return (0); MAC_CHECK(check_proc_signal, cred, proc, signum); return (error); } int mac_check_socket_bind(struct ucred *ucred, struct socket *socket, struct sockaddr *sockaddr) { int error; if (!mac_enforce_socket) return (0); MAC_CHECK(check_socket_bind, ucred, socket, &socket->so_label, sockaddr); return (error); } int mac_check_socket_connect(struct ucred *cred, struct socket *socket, struct sockaddr *sockaddr) { int error; if (!mac_enforce_socket) return (0); MAC_CHECK(check_socket_connect, cred, socket, &socket->so_label, sockaddr); return (error); } int mac_check_socket_deliver(struct socket *socket, struct mbuf *mbuf) { int error; if (!mac_enforce_socket) return (0); MAC_CHECK(check_socket_deliver, socket, &socket->so_label, mbuf, &mbuf->m_pkthdr.label); return (error); } int mac_check_socket_listen(struct ucred *cred, struct socket *socket) { int error; if (!mac_enforce_socket) return (0); MAC_CHECK(check_socket_listen, cred, socket, &socket->so_label); return (error); } static int mac_check_socket_relabel(struct ucred *cred, struct socket *socket, struct label *newlabel) { int error; MAC_CHECK(check_socket_relabel, cred, socket, &socket->so_label, newlabel); return (error); } int mac_check_socket_visible(struct ucred *cred, struct socket *socket) { int error; if (!mac_enforce_socket) return (0); MAC_CHECK(check_socket_visible, cred, socket, &socket->so_label); return (error); } int mac_ioctl_ifnet_get(struct ucred *cred, struct ifreq *ifr, struct ifnet *ifnet) { struct mac label; int error; error = mac_externalize(&ifnet->if_label, &label); if (error) return (error); return (copyout(&label, ifr->ifr_ifru.ifru_data, sizeof(label))); } int mac_ioctl_ifnet_set(struct ucred *cred, struct ifreq *ifr, struct ifnet *ifnet) { struct mac newlabel; struct label intlabel; int error; error = copyin(ifr->ifr_ifru.ifru_data, &newlabel, sizeof(newlabel)); if (error) return (error); error = mac_internalize(&intlabel, &newlabel); if (error) return (error); /* * XXX: Note that this is a redundant privilege check, since * policies impose this check themselves if required by the * policy. Eventually, this should go away. */ error = suser_cred(cred, 0); if (error) goto out; MAC_CHECK(check_ifnet_relabel, cred, ifnet, &ifnet->if_label, &intlabel); if (error) goto out; MAC_PERFORM(relabel_ifnet, cred, ifnet, &ifnet->if_label, &intlabel); out: mac_destroy_temp(&intlabel); return (error); } void mac_create_devfs_vnode(struct devfs_dirent *de, struct vnode *vp) { MAC_PERFORM(create_devfs_vnode, de, &de->de_label, vp, &vp->v_label); } void mac_create_devfs_device(dev_t dev, struct devfs_dirent *de) { MAC_PERFORM(create_devfs_device, dev, de, &de->de_label); } static int mac_stdcreatevnode_ea(struct vnode *vp) { int error; MAC_CHECK(stdcreatevnode_ea, vp, &vp->v_label); return (error); } void mac_create_devfs_directory(char *dirname, int dirnamelen, struct devfs_dirent *de) { MAC_PERFORM(create_devfs_directory, dirname, dirnamelen, de, &de->de_label); } /* * When a new vnode is created, this call will initialize its label. */ void mac_create_vnode(struct ucred *cred, struct vnode *parent, struct vnode *child) { int error; ASSERT_VOP_LOCKED(parent, "mac_create_vnode"); ASSERT_VOP_LOCKED(child, "mac_create_vnode"); error = vn_refreshlabel(parent, cred); if (error) { printf("mac_create_vnode: vn_refreshlabel returned %d\n", error); printf("mac_create_vnode: using old vnode label\n"); } MAC_PERFORM(create_vnode, cred, parent, &parent->v_label, child, &child->v_label); } int mac_setsockopt_label_set(struct ucred *cred, struct socket *so, struct mac *extmac) { struct label intlabel; int error; error = mac_internalize(&intlabel, extmac); if (error) return (error); mac_check_socket_relabel(cred, so, &intlabel); if (error) { mac_destroy_temp(&intlabel); return (error); } mac_relabel_socket(cred, so, &intlabel); mac_destroy_temp(&intlabel); return (0); } int mac_pipe_label_set(struct ucred *cred, struct pipe *pipe, struct label *label) { int error; PIPE_LOCK_ASSERT(pipe, MA_OWNED); error = mac_check_pipe_relabel(cred, pipe, label); if (error) return (error); mac_relabel_pipe(cred, pipe, label); return (0); } int mac_getsockopt_label_get(struct ucred *cred, struct socket *so, struct mac *extmac) { return (mac_externalize(&so->so_label, extmac)); } int mac_getsockopt_peerlabel_get(struct ucred *cred, struct socket *so, struct mac *extmac) { return (mac_externalize(&so->so_peerlabel, extmac)); } /* * Implementation of VOP_SETLABEL() that relies on extended attributes * to store label data. Can be referenced by filesystems supporting * extended attributes. */ int vop_stdsetlabel_ea(struct vop_setlabel_args *ap) { struct vnode *vp = ap->a_vp; struct label *intlabel = ap->a_label; struct mac extmac; int error; ASSERT_VOP_LOCKED(vp, "vop_stdsetlabel_ea"); /* * XXX: Eventually call out to EA check/set calls here. * Be particularly careful to avoid race conditions, * consistency problems, and stability problems when * dealing with multiple EAs. In particular, we require * the ability to write multiple EAs on the same file in * a single transaction, which the current EA interface * does not provide. */ error = mac_externalize(intlabel, &extmac); if (error) return (error); error = vn_extattr_set(vp, IO_NODELOCKED, FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME, sizeof(extmac), (char *)&extmac, curthread); if (error) return (error); mac_relabel_vnode(ap->a_cred, vp, intlabel); vp->v_vflag |= VV_CACHEDLABEL; return (0); } static int vn_setlabel(struct vnode *vp, struct label *intlabel, struct ucred *cred) { int error; if (vp->v_mount == NULL) { /* printf("vn_setlabel: null v_mount\n"); */ if (vp->v_type != VNON) printf("vn_setlabel: null v_mount with non-VNON\n"); return (EBADF); } if ((vp->v_mount->mnt_flag & MNT_MULTILABEL) == 0) return (EOPNOTSUPP); /* * Multi-phase commit. First check the policies to confirm the * change is OK. Then commit via the filesystem. Finally, * update the actual vnode label. Question: maybe the filesystem * should update the vnode at the end as part of VOP_SETLABEL()? */ error = mac_check_vnode_relabel(cred, vp, intlabel); if (error) return (error); /* * VADMIN provides the opportunity for the filesystem to make * decisions about who is and is not able to modify labels * and protections on files. This might not be right. We can't * assume VOP_SETLABEL() will do it, because we might implement * that as part of vop_stdsetlabel_ea(). */ error = VOP_ACCESS(vp, VADMIN, cred, curthread); if (error) return (error); error = VOP_SETLABEL(vp, intlabel, cred, curthread); if (error) return (error); return (0); } /* * MPSAFE */ int __mac_get_proc(struct thread *td, struct __mac_get_proc_args *uap) { struct mac extmac; int error; error = mac_externalize(&td->td_ucred->cr_label, &extmac); if (error == 0) error = copyout(&extmac, SCARG(uap, mac_p), sizeof(extmac)); return (error); } /* * MPSAFE */ int __mac_set_proc(struct thread *td, struct __mac_set_proc_args *uap) { struct ucred *newcred, *oldcred; struct proc *p; struct mac extmac; struct label intlabel; int error; error = copyin(SCARG(uap, mac_p), &extmac, sizeof(extmac)); if (error) return (error); error = mac_internalize(&intlabel, &extmac); if (error) return (error); newcred = crget(); p = td->td_proc; PROC_LOCK(p); oldcred = p->p_ucred; error = mac_check_cred_relabel(oldcred, &intlabel); if (error) { PROC_UNLOCK(p); mac_destroy_temp(&intlabel); crfree(newcred); return (error); } setsugid(p); crcopy(newcred, oldcred); mac_relabel_cred(newcred, &intlabel); p->p_ucred = newcred; /* * Grab additional reference for use while revoking mmaps, prior * to releasing the proc lock and sharing the cred. */ crhold(newcred); PROC_UNLOCK(p); mtx_lock(&Giant); mac_cred_mmapped_drop_perms(td, newcred); mtx_unlock(&Giant); crfree(newcred); /* Free revocation reference. */ crfree(oldcred); mac_destroy_temp(&intlabel); return (0); } /* * MPSAFE */ int __mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap) { struct file *fp; struct mac extmac; struct vnode *vp; struct pipe *pipe; int error; mtx_lock(&Giant); error = fget(td, SCARG(uap, fd), &fp); if (error) goto out; switch (fp->f_type) { case DTYPE_FIFO: case DTYPE_VNODE: vp = (struct vnode *)fp->f_data; vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); error = vn_refreshlabel(vp, td->td_ucred); if (error == 0) error = mac_externalize(&vp->v_label, &extmac); VOP_UNLOCK(vp, 0, td); break; case DTYPE_PIPE: pipe = (struct pipe *)fp->f_data; error = mac_externalize(pipe->pipe_label, &extmac); break; default: error = EINVAL; } if (error == 0) error = copyout(&extmac, SCARG(uap, mac_p), sizeof(extmac)); fdrop(fp, td); out: mtx_unlock(&Giant); return (error); } /* * MPSAFE */ int __mac_get_file(struct thread *td, struct __mac_get_file_args *uap) { struct nameidata nd; struct mac extmac; int error; mtx_lock(&Giant); NDINIT(&nd, LOOKUP, LOCKLEAF | FOLLOW, UIO_USERSPACE, SCARG(uap, path_p), td); error = namei(&nd); if (error) goto out; error = vn_refreshlabel(nd.ni_vp, td->td_ucred); if (error == 0) error = mac_externalize(&nd.ni_vp->v_label, &extmac); NDFREE(&nd, 0); if (error) goto out; error = copyout(&extmac, SCARG(uap, mac_p), sizeof(extmac)); out: mtx_unlock(&Giant); return (error); } /* * MPSAFE */ int __mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap) { struct file *fp; struct mac extmac; struct label intlabel; struct mount *mp; struct vnode *vp; struct pipe *pipe; int error; mtx_lock(&Giant); error = fget(td, SCARG(uap, fd), &fp); if (error) goto out1; error = copyin(SCARG(uap, mac_p), &extmac, sizeof(extmac)); if (error) goto out2; error = mac_internalize(&intlabel, &extmac); if (error) goto out2; switch (fp->f_type) { case DTYPE_FIFO: case DTYPE_VNODE: vp = (struct vnode *)fp->f_data; error = vn_start_write(vp, &mp, V_WAIT | PCATCH); if (error != 0) break; vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); error = vn_setlabel(vp, &intlabel, td->td_ucred); VOP_UNLOCK(vp, 0, td); vn_finished_write(mp); mac_destroy_temp(&intlabel); break; case DTYPE_PIPE: pipe = (struct pipe *)fp->f_data; PIPE_LOCK(pipe); error = mac_pipe_label_set(td->td_ucred, pipe, &intlabel); PIPE_UNLOCK(pipe); break; default: error = EINVAL; } out2: fdrop(fp, td); out1: mtx_unlock(&Giant); return (error); } /* * MPSAFE */ int __mac_set_file(struct thread *td, struct __mac_set_file_args *uap) { struct nameidata nd; struct mac extmac; struct label intlabel; struct mount *mp; int error; mtx_lock(&Giant); error = copyin(SCARG(uap, mac_p), &extmac, sizeof(extmac)); if (error) goto out; error = mac_internalize(&intlabel, &extmac); if (error) goto out; NDINIT(&nd, LOOKUP, LOCKLEAF | FOLLOW, UIO_USERSPACE, SCARG(uap, path_p), td); error = namei(&nd); if (error) goto out2; error = vn_start_write(nd.ni_vp, &mp, V_WAIT | PCATCH); if (error) goto out2; error = vn_setlabel(nd.ni_vp, &intlabel, td->td_ucred); vn_finished_write(mp); out2: mac_destroy_temp(&intlabel); NDFREE(&nd, 0); out: mtx_unlock(&Giant); return (error); } int mac_syscall(struct thread *td, struct mac_syscall_args *uap) { struct mac_policy_conf *mpc; char target[MAC_MAX_POLICY_NAME]; int error; error = copyinstr(SCARG(uap, policy), target, sizeof(target), NULL); if (error) return (error); error = ENOSYS; MAC_POLICY_LIST_BUSY(); LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { if (strcmp(mpc->mpc_name, target) == 0 && mpc->mpc_ops->mpo_syscall != NULL) { error = mpc->mpc_ops->mpo_syscall(td, SCARG(uap, call), SCARG(uap, arg)); goto out; } } out: MAC_POLICY_LIST_UNBUSY(); return (error); } SYSINIT(mac, SI_SUB_MAC, SI_ORDER_FIRST, mac_init, NULL); SYSINIT(mac_late, SI_SUB_MAC_LATE, SI_ORDER_FIRST, mac_late_init, NULL); #else /* !MAC */ int __mac_get_proc(struct thread *td, struct __mac_get_proc_args *uap) { return (ENOSYS); } int __mac_set_proc(struct thread *td, struct __mac_set_proc_args *uap) { return (ENOSYS); } int __mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap) { return (ENOSYS); } int __mac_get_file(struct thread *td, struct __mac_get_file_args *uap) { return (ENOSYS); } int __mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap) { return (ENOSYS); } int __mac_set_file(struct thread *td, struct __mac_set_file_args *uap) { return (ENOSYS); } int mac_syscall(struct thread *td, struct mac_syscall_args *uap) { return (ENOSYS); } #endif /* !MAC */ Index: head/sys/security/mac/mac_net.c =================================================================== --- head/sys/security/mac/mac_net.c (revision 104528) +++ head/sys/security/mac/mac_net.c (revision 104529) @@ -1,3432 +1,3462 @@ /*- * Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson * Copyright (c) 2001 Ilmar S. Habibulin * Copyright (c) 2001, 2002 Networks Associates Technology, Inc. * All rights reserved. * * This software was developed by Robert Watson and Ilmar Habibulin for the * TrustedBSD Project. * * This software was developed for the FreeBSD Project in part by NAI Labs, * the Security Research Division of Network Associates, Inc. under * DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA * CHATS research program. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * 3. The names of the authors may not be used to endorse or promote * products derived from this software without specific prior written * permission. * * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. * * $FreeBSD$ */ /* * Developed by the TrustedBSD Project. * * Framework for extensible kernel access control. Kernel and userland * interface to the framework, policy registration and composition. */ #include "opt_mac.h" #include "opt_devfs.h" #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #ifdef MAC /* * Declare that the kernel provides MAC support, version 1. This permits * modules to refuse to be loaded if the necessary support isn't present, * even if it's pre-boot. */ MODULE_VERSION(kernel_mac_support, 1); SYSCTL_DECL(_security); SYSCTL_NODE(_security, OID_AUTO, mac, CTLFLAG_RW, 0, "TrustedBSD MAC policy controls"); #ifndef MAC_MAX_POLICIES #define MAC_MAX_POLICIES 8 #endif #if MAC_MAX_POLICIES > 32 #error "MAC_MAX_POLICIES too large" #endif static unsigned int mac_max_policies = MAC_MAX_POLICIES; static unsigned int mac_policy_offsets_free = (1 << MAC_MAX_POLICIES) - 1; SYSCTL_UINT(_security_mac, OID_AUTO, max_policies, CTLFLAG_RD, &mac_max_policies, 0, ""); static int mac_late = 0; static int mac_enforce_fs = 1; SYSCTL_INT(_security_mac, OID_AUTO, enforce_fs, CTLFLAG_RW, &mac_enforce_fs, 0, "Enforce MAC policy on file system objects"); TUNABLE_INT("security.mac.enforce_fs", &mac_enforce_fs); static int mac_enforce_network = 1; SYSCTL_INT(_security_mac, OID_AUTO, enforce_network, CTLFLAG_RW, &mac_enforce_network, 0, "Enforce MAC policy on network packets"); TUNABLE_INT("security.mac.enforce_network", &mac_enforce_network); static int mac_enforce_pipe = 1; SYSCTL_INT(_security_mac, OID_AUTO, enforce_pipe, CTLFLAG_RW, &mac_enforce_pipe, 0, "Enforce MAC policy on pipe operations"); TUNABLE_INT("security.mac.enforce_pipe", &mac_enforce_pipe); static int mac_enforce_process = 1; SYSCTL_INT(_security_mac, OID_AUTO, enforce_process, CTLFLAG_RW, &mac_enforce_process, 0, "Enforce MAC policy on inter-process operations"); TUNABLE_INT("security.mac.enforce_process", &mac_enforce_process); static int mac_enforce_socket = 1; SYSCTL_INT(_security_mac, OID_AUTO, enforce_socket, CTLFLAG_RW, &mac_enforce_socket, 0, "Enforce MAC policy on socket operations"); TUNABLE_INT("security.mac.enforce_socket", &mac_enforce_socket); static int mac_enforce_vm = 1; SYSCTL_INT(_security_mac, OID_AUTO, enforce_vm, CTLFLAG_RW, &mac_enforce_vm, 0, "Enforce MAC policy on vm operations"); TUNABLE_INT("security.mac.enforce_vm", &mac_enforce_vm); static int mac_label_size = sizeof(struct mac); SYSCTL_INT(_security_mac, OID_AUTO, label_size, CTLFLAG_RD, &mac_label_size, 0, "Pre-compiled MAC label size"); static int mac_cache_fslabel_in_vnode = 1; SYSCTL_INT(_security_mac, OID_AUTO, cache_fslabel_in_vnode, CTLFLAG_RW, &mac_cache_fslabel_in_vnode, 0, "Cache mount fslabel in vnode"); TUNABLE_INT("security.mac.cache_fslabel_in_vnode", &mac_cache_fslabel_in_vnode); static int mac_vnode_label_cache_hits = 0; SYSCTL_INT(_security_mac, OID_AUTO, vnode_label_cache_hits, CTLFLAG_RD, &mac_vnode_label_cache_hits, 0, "Cache hits on vnode labels"); static int mac_vnode_label_cache_misses = 0; SYSCTL_INT(_security_mac, OID_AUTO, vnode_label_cache_misses, CTLFLAG_RD, &mac_vnode_label_cache_misses, 0, "Cache misses on vnode labels"); static int mac_mmap_revocation = 1; SYSCTL_INT(_security_mac, OID_AUTO, mmap_revocation, CTLFLAG_RW, &mac_mmap_revocation, 0, "Revoke mmap access to files on subject " "relabel"); static int mac_mmap_revocation_via_cow = 0; SYSCTL_INT(_security_mac, OID_AUTO, mmap_revocation_via_cow, CTLFLAG_RW, &mac_mmap_revocation_via_cow, 0, "Revoke mmap access to files via " "copy-on-write semantics, or by removing all write access"); #ifdef MAC_DEBUG SYSCTL_NODE(_security_mac, OID_AUTO, debug, CTLFLAG_RW, 0, "TrustedBSD MAC debug info"); static int mac_debug_label_fallback = 0; SYSCTL_INT(_security_mac_debug, OID_AUTO, label_fallback, CTLFLAG_RW, &mac_debug_label_fallback, 0, "Filesystems should fall back to fs label" "when label is corrupted."); TUNABLE_INT("security.mac.debug_label_fallback", &mac_debug_label_fallback); SYSCTL_NODE(_security_mac_debug, OID_AUTO, counters, CTLFLAG_RW, 0, "TrustedBSD MAC object counters"); static unsigned int nmacmbufs, nmaccreds, nmacifnets, nmacbpfdescs, nmacsockets, nmacmounts, nmactemp, nmacvnodes, nmacdevfsdirents, nmacipqs, nmacpipes; SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, mbufs, CTLFLAG_RD, &nmacmbufs, 0, "number of mbufs in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, creds, CTLFLAG_RD, &nmaccreds, 0, "number of ucreds in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, ifnets, CTLFLAG_RD, &nmacifnets, 0, "number of ifnets in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, ipqs, CTLFLAG_RD, &nmacipqs, 0, "number of ipqs in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, bpfdescs, CTLFLAG_RD, &nmacbpfdescs, 0, "number of bpfdescs in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, sockets, CTLFLAG_RD, &nmacsockets, 0, "number of sockets in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, pipes, CTLFLAG_RD, &nmacpipes, 0, "number of pipes in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, mounts, CTLFLAG_RD, &nmacmounts, 0, "number of mounts in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, temp, CTLFLAG_RD, &nmactemp, 0, "number of temporary labels in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, vnodes, CTLFLAG_RD, &nmacvnodes, 0, "number of vnodes in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, devfsdirents, CTLFLAG_RD, &nmacdevfsdirents, 0, "number of devfs dirents inuse"); #endif static int error_select(int error1, int error2); static int mac_externalize(struct label *label, struct mac *mac); static int mac_policy_register(struct mac_policy_conf *mpc); static int mac_policy_unregister(struct mac_policy_conf *mpc); static int mac_stdcreatevnode_ea(struct vnode *vp); static void mac_cred_mmapped_drop_perms(struct thread *td, struct ucred *cred); static void mac_cred_mmapped_drop_perms_recurse(struct thread *td, struct ucred *cred, struct vm_map *map); MALLOC_DEFINE(M_MACOPVEC, "macopvec", "MAC policy operation vector"); MALLOC_DEFINE(M_MACPIPELABEL, "macpipelabel", "MAC labels for pipes"); /* * mac_policy_list_lock protects the consistency of 'mac_policy_list', * the linked list of attached policy modules. Read-only consumers of * the list must acquire a shared lock for the duration of their use; * writers must acquire an exclusive lock. Note that for compound * operations, locks should be held for the entire compound operation, * and that this is not yet done for relabel requests. */ static struct mtx mac_policy_list_lock; static LIST_HEAD(, mac_policy_conf) mac_policy_list; static int mac_policy_list_busy; #define MAC_POLICY_LIST_LOCKINIT() mtx_init(&mac_policy_list_lock, \ "mac_policy_list_lock", NULL, MTX_DEF); #define MAC_POLICY_LIST_LOCK() mtx_lock(&mac_policy_list_lock); #define MAC_POLICY_LIST_UNLOCK() mtx_unlock(&mac_policy_list_lock); #define MAC_POLICY_LIST_BUSY() do { \ MAC_POLICY_LIST_LOCK(); \ mac_policy_list_busy++; \ MAC_POLICY_LIST_UNLOCK(); \ } while (0) #define MAC_POLICY_LIST_UNBUSY() do { \ MAC_POLICY_LIST_LOCK(); \ mac_policy_list_busy--; \ if (mac_policy_list_busy < 0) \ panic("Extra mac_policy_list_busy--"); \ MAC_POLICY_LIST_UNLOCK(); \ } while (0) /* * MAC_CHECK performs the designated check by walking the policy * module list and checking with each as to how it feels about the * request. Note that it returns its value via 'error' in the scope * of the caller. */ #define MAC_CHECK(check, args...) do { \ struct mac_policy_conf *mpc; \ \ error = 0; \ MAC_POLICY_LIST_BUSY(); \ LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { \ if (mpc->mpc_ops->mpo_ ## check != NULL) \ error = error_select( \ mpc->mpc_ops->mpo_ ## check (args), \ error); \ } \ MAC_POLICY_LIST_UNBUSY(); \ } while (0) /* * MAC_BOOLEAN performs the designated boolean composition by walking * the module list, invoking each instance of the operation, and * combining the results using the passed C operator. Note that it * returns its value via 'result' in the scope of the caller, which * should be initialized by the caller in a meaningful way to get * a meaningful result. */ #define MAC_BOOLEAN(operation, composition, args...) do { \ struct mac_policy_conf *mpc; \ \ MAC_POLICY_LIST_BUSY(); \ LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { \ if (mpc->mpc_ops->mpo_ ## operation != NULL) \ result = result composition \ mpc->mpc_ops->mpo_ ## operation (args); \ } \ MAC_POLICY_LIST_UNBUSY(); \ } while (0) /* * MAC_PERFORM performs the designated operation by walking the policy * module list and invoking that operation for each policy. */ #define MAC_PERFORM(operation, args...) do { \ struct mac_policy_conf *mpc; \ \ MAC_POLICY_LIST_BUSY(); \ LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { \ if (mpc->mpc_ops->mpo_ ## operation != NULL) \ mpc->mpc_ops->mpo_ ## operation (args); \ } \ MAC_POLICY_LIST_UNBUSY(); \ } while (0) /* * Initialize the MAC subsystem, including appropriate SMP locks. */ static void mac_init(void) { LIST_INIT(&mac_policy_list); MAC_POLICY_LIST_LOCKINIT(); } /* * For the purposes of modules that want to know if they were loaded * "early", set the mac_late flag once we've processed modules either * linked into the kernel, or loaded before the kernel startup. */ static void mac_late_init(void) { mac_late = 1; } /* * Allow MAC policy modules to register during boot, etc. */ int mac_policy_modevent(module_t mod, int type, void *data) { struct mac_policy_conf *mpc; int error; error = 0; mpc = (struct mac_policy_conf *) data; switch (type) { case MOD_LOAD: if (mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_NOTLATE && mac_late) { printf("mac_policy_modevent: can't load %s policy " "after booting\n", mpc->mpc_name); error = EBUSY; break; } error = mac_policy_register(mpc); break; case MOD_UNLOAD: /* Don't unregister the module if it was never registered. */ if ((mpc->mpc_runtime_flags & MPC_RUNTIME_FLAG_REGISTERED) != 0) error = mac_policy_unregister(mpc); else error = 0; break; default: break; } return (error); } static int mac_policy_register(struct mac_policy_conf *mpc) { struct mac_policy_conf *tmpc; struct mac_policy_op_entry *mpe; int slot; MALLOC(mpc->mpc_ops, struct mac_policy_ops *, sizeof(*mpc->mpc_ops), M_MACOPVEC, M_WAITOK | M_ZERO); for (mpe = mpc->mpc_entries; mpe->mpe_constant != MAC_OP_LAST; mpe++) { switch (mpe->mpe_constant) { case MAC_OP_LAST: /* * Doesn't actually happen, but this allows checking * that all enumerated values are handled. */ break; case MAC_DESTROY: mpc->mpc_ops->mpo_destroy = mpe->mpe_function; break; case MAC_INIT: mpc->mpc_ops->mpo_init = mpe->mpe_function; break; case MAC_SYSCALL: mpc->mpc_ops->mpo_syscall = mpe->mpe_function; break; case MAC_INIT_BPFDESC_LABEL: mpc->mpc_ops->mpo_init_bpfdesc_label = mpe->mpe_function; break; case MAC_INIT_CRED_LABEL: mpc->mpc_ops->mpo_init_cred_label = mpe->mpe_function; break; case MAC_INIT_DEVFSDIRENT_LABEL: mpc->mpc_ops->mpo_init_devfsdirent_label = mpe->mpe_function; break; case MAC_INIT_IFNET_LABEL: mpc->mpc_ops->mpo_init_ifnet_label = mpe->mpe_function; break; case MAC_INIT_IPQ_LABEL: mpc->mpc_ops->mpo_init_ipq_label = mpe->mpe_function; break; case MAC_INIT_MBUF_LABEL: mpc->mpc_ops->mpo_init_mbuf_label = mpe->mpe_function; break; case MAC_INIT_MOUNT_LABEL: mpc->mpc_ops->mpo_init_mount_label = mpe->mpe_function; break; case MAC_INIT_MOUNT_FS_LABEL: mpc->mpc_ops->mpo_init_mount_fs_label = mpe->mpe_function; break; case MAC_INIT_PIPE_LABEL: mpc->mpc_ops->mpo_init_pipe_label = mpe->mpe_function; break; case MAC_INIT_SOCKET_LABEL: mpc->mpc_ops->mpo_init_socket_label = mpe->mpe_function; break; case MAC_INIT_SOCKET_PEER_LABEL: mpc->mpc_ops->mpo_init_socket_peer_label = mpe->mpe_function; break; case MAC_INIT_TEMP_LABEL: mpc->mpc_ops->mpo_init_temp_label = mpe->mpe_function; break; case MAC_INIT_VNODE_LABEL: mpc->mpc_ops->mpo_init_vnode_label = mpe->mpe_function; break; case MAC_DESTROY_BPFDESC_LABEL: mpc->mpc_ops->mpo_destroy_bpfdesc_label = mpe->mpe_function; break; case MAC_DESTROY_CRED_LABEL: mpc->mpc_ops->mpo_destroy_cred_label = mpe->mpe_function; break; case MAC_DESTROY_DEVFSDIRENT_LABEL: mpc->mpc_ops->mpo_destroy_devfsdirent_label = mpe->mpe_function; break; case MAC_DESTROY_IFNET_LABEL: mpc->mpc_ops->mpo_destroy_ifnet_label = mpe->mpe_function; break; case MAC_DESTROY_IPQ_LABEL: mpc->mpc_ops->mpo_destroy_ipq_label = mpe->mpe_function; break; case MAC_DESTROY_MBUF_LABEL: mpc->mpc_ops->mpo_destroy_mbuf_label = mpe->mpe_function; break; case MAC_DESTROY_MOUNT_LABEL: mpc->mpc_ops->mpo_destroy_mount_label = mpe->mpe_function; break; case MAC_DESTROY_MOUNT_FS_LABEL: mpc->mpc_ops->mpo_destroy_mount_fs_label = mpe->mpe_function; break; case MAC_DESTROY_PIPE_LABEL: mpc->mpc_ops->mpo_destroy_pipe_label = mpe->mpe_function; break; case MAC_DESTROY_SOCKET_LABEL: mpc->mpc_ops->mpo_destroy_socket_label = mpe->mpe_function; break; case MAC_DESTROY_SOCKET_PEER_LABEL: mpc->mpc_ops->mpo_destroy_socket_peer_label = mpe->mpe_function; break; case MAC_DESTROY_TEMP_LABEL: mpc->mpc_ops->mpo_destroy_temp_label = mpe->mpe_function; break; case MAC_DESTROY_VNODE_LABEL: mpc->mpc_ops->mpo_destroy_vnode_label = mpe->mpe_function; break; case MAC_EXTERNALIZE: mpc->mpc_ops->mpo_externalize = mpe->mpe_function; break; case MAC_INTERNALIZE: mpc->mpc_ops->mpo_internalize = mpe->mpe_function; break; case MAC_CREATE_DEVFS_DEVICE: mpc->mpc_ops->mpo_create_devfs_device = mpe->mpe_function; break; case MAC_CREATE_DEVFS_DIRECTORY: mpc->mpc_ops->mpo_create_devfs_directory = mpe->mpe_function; break; case MAC_CREATE_DEVFS_VNODE: mpc->mpc_ops->mpo_create_devfs_vnode = mpe->mpe_function; break; case MAC_STDCREATEVNODE_EA: mpc->mpc_ops->mpo_stdcreatevnode_ea = mpe->mpe_function; break; case MAC_CREATE_VNODE: mpc->mpc_ops->mpo_create_vnode = mpe->mpe_function; break; case MAC_CREATE_MOUNT: mpc->mpc_ops->mpo_create_mount = mpe->mpe_function; break; case MAC_CREATE_ROOT_MOUNT: mpc->mpc_ops->mpo_create_root_mount = mpe->mpe_function; break; case MAC_RELABEL_VNODE: mpc->mpc_ops->mpo_relabel_vnode = mpe->mpe_function; break; case MAC_UPDATE_DEVFSDIRENT: mpc->mpc_ops->mpo_update_devfsdirent = mpe->mpe_function; break; case MAC_UPDATE_PROCFSVNODE: mpc->mpc_ops->mpo_update_procfsvnode = mpe->mpe_function; break; case MAC_UPDATE_VNODE_FROM_EXTATTR: mpc->mpc_ops->mpo_update_vnode_from_extattr = mpe->mpe_function; break; case MAC_UPDATE_VNODE_FROM_EXTERNALIZED: mpc->mpc_ops->mpo_update_vnode_from_externalized = mpe->mpe_function; break; case MAC_UPDATE_VNODE_FROM_MOUNT: mpc->mpc_ops->mpo_update_vnode_from_mount = mpe->mpe_function; break; case MAC_CREATE_MBUF_FROM_SOCKET: mpc->mpc_ops->mpo_create_mbuf_from_socket = mpe->mpe_function; break; case MAC_CREATE_PIPE: mpc->mpc_ops->mpo_create_pipe = mpe->mpe_function; break; case MAC_CREATE_SOCKET: mpc->mpc_ops->mpo_create_socket = mpe->mpe_function; break; case MAC_CREATE_SOCKET_FROM_SOCKET: mpc->mpc_ops->mpo_create_socket_from_socket = mpe->mpe_function; break; case MAC_RELABEL_PIPE: mpc->mpc_ops->mpo_relabel_pipe = mpe->mpe_function; break; case MAC_RELABEL_SOCKET: mpc->mpc_ops->mpo_relabel_socket = mpe->mpe_function; break; case MAC_SET_SOCKET_PEER_FROM_MBUF: mpc->mpc_ops->mpo_set_socket_peer_from_mbuf = mpe->mpe_function; break; case MAC_SET_SOCKET_PEER_FROM_SOCKET: mpc->mpc_ops->mpo_set_socket_peer_from_socket = mpe->mpe_function; break; case MAC_CREATE_BPFDESC: mpc->mpc_ops->mpo_create_bpfdesc = mpe->mpe_function; break; case MAC_CREATE_DATAGRAM_FROM_IPQ: mpc->mpc_ops->mpo_create_datagram_from_ipq = mpe->mpe_function; break; case MAC_CREATE_FRAGMENT: mpc->mpc_ops->mpo_create_fragment = mpe->mpe_function; break; case MAC_CREATE_IFNET: mpc->mpc_ops->mpo_create_ifnet = mpe->mpe_function; break; case MAC_CREATE_IPQ: mpc->mpc_ops->mpo_create_ipq = mpe->mpe_function; break; case MAC_CREATE_MBUF_FROM_MBUF: mpc->mpc_ops->mpo_create_mbuf_from_mbuf = mpe->mpe_function; break; case MAC_CREATE_MBUF_LINKLAYER: mpc->mpc_ops->mpo_create_mbuf_linklayer = mpe->mpe_function; break; case MAC_CREATE_MBUF_FROM_BPFDESC: mpc->mpc_ops->mpo_create_mbuf_from_bpfdesc = mpe->mpe_function; break; case MAC_CREATE_MBUF_FROM_IFNET: mpc->mpc_ops->mpo_create_mbuf_from_ifnet = mpe->mpe_function; break; case MAC_CREATE_MBUF_MULTICAST_ENCAP: mpc->mpc_ops->mpo_create_mbuf_multicast_encap = mpe->mpe_function; break; case MAC_CREATE_MBUF_NETLAYER: mpc->mpc_ops->mpo_create_mbuf_netlayer = mpe->mpe_function; break; case MAC_FRAGMENT_MATCH: mpc->mpc_ops->mpo_fragment_match = mpe->mpe_function; break; case MAC_RELABEL_IFNET: mpc->mpc_ops->mpo_relabel_ifnet = mpe->mpe_function; break; case MAC_UPDATE_IPQ: mpc->mpc_ops->mpo_update_ipq = mpe->mpe_function; break; case MAC_CREATE_CRED: mpc->mpc_ops->mpo_create_cred = mpe->mpe_function; break; case MAC_EXECVE_TRANSITION: mpc->mpc_ops->mpo_execve_transition = mpe->mpe_function; break; case MAC_EXECVE_WILL_TRANSITION: mpc->mpc_ops->mpo_execve_will_transition = mpe->mpe_function; break; case MAC_CREATE_PROC0: mpc->mpc_ops->mpo_create_proc0 = mpe->mpe_function; break; case MAC_CREATE_PROC1: mpc->mpc_ops->mpo_create_proc1 = mpe->mpe_function; break; case MAC_RELABEL_CRED: mpc->mpc_ops->mpo_relabel_cred = mpe->mpe_function; break; case MAC_THREAD_USERRET: mpc->mpc_ops->mpo_thread_userret = mpe->mpe_function; break; case MAC_CHECK_BPFDESC_RECEIVE: mpc->mpc_ops->mpo_check_bpfdesc_receive = mpe->mpe_function; break; case MAC_CHECK_CRED_RELABEL: mpc->mpc_ops->mpo_check_cred_relabel = mpe->mpe_function; break; case MAC_CHECK_CRED_VISIBLE: mpc->mpc_ops->mpo_check_cred_visible = mpe->mpe_function; break; case MAC_CHECK_IFNET_RELABEL: mpc->mpc_ops->mpo_check_ifnet_relabel = mpe->mpe_function; break; case MAC_CHECK_IFNET_TRANSMIT: mpc->mpc_ops->mpo_check_ifnet_transmit = mpe->mpe_function; break; case MAC_CHECK_MOUNT_STAT: mpc->mpc_ops->mpo_check_mount_stat = mpe->mpe_function; break; case MAC_CHECK_PIPE_IOCTL: mpc->mpc_ops->mpo_check_pipe_ioctl = mpe->mpe_function; break; case MAC_CHECK_PIPE_POLL: mpc->mpc_ops->mpo_check_pipe_poll = mpe->mpe_function; break; case MAC_CHECK_PIPE_READ: mpc->mpc_ops->mpo_check_pipe_read = mpe->mpe_function; break; case MAC_CHECK_PIPE_RELABEL: mpc->mpc_ops->mpo_check_pipe_relabel = mpe->mpe_function; break; case MAC_CHECK_PIPE_STAT: mpc->mpc_ops->mpo_check_pipe_stat = mpe->mpe_function; break; case MAC_CHECK_PIPE_WRITE: mpc->mpc_ops->mpo_check_pipe_write = mpe->mpe_function; break; case MAC_CHECK_PROC_DEBUG: mpc->mpc_ops->mpo_check_proc_debug = mpe->mpe_function; break; case MAC_CHECK_PROC_SCHED: mpc->mpc_ops->mpo_check_proc_sched = mpe->mpe_function; break; case MAC_CHECK_PROC_SIGNAL: mpc->mpc_ops->mpo_check_proc_signal = mpe->mpe_function; break; case MAC_CHECK_SOCKET_BIND: mpc->mpc_ops->mpo_check_socket_bind = mpe->mpe_function; break; case MAC_CHECK_SOCKET_CONNECT: mpc->mpc_ops->mpo_check_socket_connect = mpe->mpe_function; break; case MAC_CHECK_SOCKET_DELIVER: mpc->mpc_ops->mpo_check_socket_deliver = mpe->mpe_function; break; case MAC_CHECK_SOCKET_LISTEN: mpc->mpc_ops->mpo_check_socket_listen = mpe->mpe_function; break; case MAC_CHECK_SOCKET_RELABEL: mpc->mpc_ops->mpo_check_socket_relabel = mpe->mpe_function; break; case MAC_CHECK_SOCKET_VISIBLE: mpc->mpc_ops->mpo_check_socket_visible = mpe->mpe_function; break; case MAC_CHECK_VNODE_ACCESS: mpc->mpc_ops->mpo_check_vnode_access = mpe->mpe_function; break; case MAC_CHECK_VNODE_CHDIR: mpc->mpc_ops->mpo_check_vnode_chdir = mpe->mpe_function; break; case MAC_CHECK_VNODE_CHROOT: mpc->mpc_ops->mpo_check_vnode_chroot = mpe->mpe_function; break; case MAC_CHECK_VNODE_CREATE: mpc->mpc_ops->mpo_check_vnode_create = mpe->mpe_function; break; case MAC_CHECK_VNODE_DELETE: mpc->mpc_ops->mpo_check_vnode_delete = mpe->mpe_function; break; case MAC_CHECK_VNODE_DELETEACL: mpc->mpc_ops->mpo_check_vnode_deleteacl = mpe->mpe_function; break; case MAC_CHECK_VNODE_EXEC: mpc->mpc_ops->mpo_check_vnode_exec = mpe->mpe_function; break; case MAC_CHECK_VNODE_GETACL: mpc->mpc_ops->mpo_check_vnode_getacl = mpe->mpe_function; break; case MAC_CHECK_VNODE_GETEXTATTR: mpc->mpc_ops->mpo_check_vnode_getextattr = mpe->mpe_function; break; + case MAC_CHECK_VNODE_LINK: + mpc->mpc_ops->mpo_check_vnode_link = + mpe->mpe_function; + break; case MAC_CHECK_VNODE_LOOKUP: mpc->mpc_ops->mpo_check_vnode_lookup = mpe->mpe_function; break; case MAC_CHECK_VNODE_MMAP_PERMS: mpc->mpc_ops->mpo_check_vnode_mmap_perms = mpe->mpe_function; break; case MAC_CHECK_VNODE_OPEN: mpc->mpc_ops->mpo_check_vnode_open = mpe->mpe_function; break; case MAC_CHECK_VNODE_POLL: mpc->mpc_ops->mpo_check_vnode_poll = mpe->mpe_function; break; case MAC_CHECK_VNODE_READ: mpc->mpc_ops->mpo_check_vnode_read = mpe->mpe_function; break; case MAC_CHECK_VNODE_READDIR: mpc->mpc_ops->mpo_check_vnode_readdir = mpe->mpe_function; break; case MAC_CHECK_VNODE_READLINK: mpc->mpc_ops->mpo_check_vnode_readlink = mpe->mpe_function; break; case MAC_CHECK_VNODE_RELABEL: mpc->mpc_ops->mpo_check_vnode_relabel = mpe->mpe_function; break; case MAC_CHECK_VNODE_RENAME_FROM: mpc->mpc_ops->mpo_check_vnode_rename_from = mpe->mpe_function; break; case MAC_CHECK_VNODE_RENAME_TO: mpc->mpc_ops->mpo_check_vnode_rename_to = mpe->mpe_function; break; case MAC_CHECK_VNODE_REVOKE: mpc->mpc_ops->mpo_check_vnode_revoke = mpe->mpe_function; break; case MAC_CHECK_VNODE_SETACL: mpc->mpc_ops->mpo_check_vnode_setacl = mpe->mpe_function; break; case MAC_CHECK_VNODE_SETEXTATTR: mpc->mpc_ops->mpo_check_vnode_setextattr = mpe->mpe_function; break; case MAC_CHECK_VNODE_SETFLAGS: mpc->mpc_ops->mpo_check_vnode_setflags = mpe->mpe_function; break; case MAC_CHECK_VNODE_SETMODE: mpc->mpc_ops->mpo_check_vnode_setmode = mpe->mpe_function; break; case MAC_CHECK_VNODE_SETOWNER: mpc->mpc_ops->mpo_check_vnode_setowner = mpe->mpe_function; break; case MAC_CHECK_VNODE_SETUTIMES: mpc->mpc_ops->mpo_check_vnode_setutimes = mpe->mpe_function; break; case MAC_CHECK_VNODE_STAT: mpc->mpc_ops->mpo_check_vnode_stat = mpe->mpe_function; break; case MAC_CHECK_VNODE_WRITE: mpc->mpc_ops->mpo_check_vnode_write = mpe->mpe_function; break; /* default: printf("MAC policy `%s': unknown operation %d\n", mpc->mpc_name, mpe->mpe_constant); return (EINVAL); */ } } MAC_POLICY_LIST_LOCK(); if (mac_policy_list_busy > 0) { MAC_POLICY_LIST_UNLOCK(); FREE(mpc->mpc_ops, M_MACOPVEC); mpc->mpc_ops = NULL; return (EBUSY); } LIST_FOREACH(tmpc, &mac_policy_list, mpc_list) { if (strcmp(tmpc->mpc_name, mpc->mpc_name) == 0) { MAC_POLICY_LIST_UNLOCK(); FREE(mpc->mpc_ops, M_MACOPVEC); mpc->mpc_ops = NULL; return (EEXIST); } } if (mpc->mpc_field_off != NULL) { slot = ffs(mac_policy_offsets_free); if (slot == 0) { MAC_POLICY_LIST_UNLOCK(); FREE(mpc->mpc_ops, M_MACOPVEC); mpc->mpc_ops = NULL; return (ENOMEM); } slot--; mac_policy_offsets_free &= ~(1 << slot); *mpc->mpc_field_off = slot; } mpc->mpc_runtime_flags |= MPC_RUNTIME_FLAG_REGISTERED; LIST_INSERT_HEAD(&mac_policy_list, mpc, mpc_list); /* Per-policy initialization. */ if (mpc->mpc_ops->mpo_init != NULL) (*(mpc->mpc_ops->mpo_init))(mpc); MAC_POLICY_LIST_UNLOCK(); printf("Security policy loaded: %s (%s)\n", mpc->mpc_fullname, mpc->mpc_name); return (0); } static int mac_policy_unregister(struct mac_policy_conf *mpc) { /* * If we fail the load, we may get a request to unload. Check * to see if we did the run-time registration, and if not, * silently succeed. */ MAC_POLICY_LIST_LOCK(); if ((mpc->mpc_runtime_flags & MPC_RUNTIME_FLAG_REGISTERED) == 0) { MAC_POLICY_LIST_UNLOCK(); return (0); } #if 0 /* * Don't allow unloading modules with private data. */ if (mpc->mpc_field_off != NULL) { MAC_POLICY_LIST_UNLOCK(); return (EBUSY); } #endif /* * Only allow the unload to proceed if the module is unloadable * by its own definition. */ if ((mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_UNLOADOK) == 0) { MAC_POLICY_LIST_UNLOCK(); return (EBUSY); } /* * Right now, we EBUSY if the list is in use. In the future, * for reliability reasons, we might want to sleep and wakeup * later to try again. */ if (mac_policy_list_busy > 0) { MAC_POLICY_LIST_UNLOCK(); return (EBUSY); } if (mpc->mpc_ops->mpo_destroy != NULL) (*(mpc->mpc_ops->mpo_destroy))(mpc); LIST_REMOVE(mpc, mpc_list); MAC_POLICY_LIST_UNLOCK(); FREE(mpc->mpc_ops, M_MACOPVEC); mpc->mpc_ops = NULL; printf("Security policy unload: %s (%s)\n", mpc->mpc_fullname, mpc->mpc_name); return (0); } /* * Define an error value precedence, and given two arguments, selects the * value with the higher precedence. */ static int error_select(int error1, int error2) { /* Certain decision-making errors take top priority. */ if (error1 == EDEADLK || error2 == EDEADLK) return (EDEADLK); /* Invalid arguments should be reported where possible. */ if (error1 == EINVAL || error2 == EINVAL) return (EINVAL); /* Precedence goes to "visibility", with both process and file. */ if (error1 == ESRCH || error2 == ESRCH) return (ESRCH); if (error1 == ENOENT || error2 == ENOENT) return (ENOENT); /* Precedence goes to DAC/MAC protections. */ if (error1 == EACCES || error2 == EACCES) return (EACCES); /* Precedence goes to privilege. */ if (error1 == EPERM || error2 == EPERM) return (EPERM); /* Precedence goes to error over success; otherwise, arbitrary. */ if (error1 != 0) return (error1); return (error2); } static void mac_init_label(struct label *label) { bzero(label, sizeof(*label)); label->l_flags = MAC_FLAG_INITIALIZED; } static void mac_destroy_label(struct label *label) { KASSERT(label->l_flags & MAC_FLAG_INITIALIZED, ("destroying uninitialized label")); bzero(label, sizeof(*label)); /* implicit: label->l_flags &= ~MAC_FLAG_INITIALIZED; */ } static void mac_init_structmac(struct mac *mac) { bzero(mac, sizeof(*mac)); mac->m_macflags = MAC_FLAG_INITIALIZED; } void mac_init_bpfdesc(struct bpf_d *bpf_d) { mac_init_label(&bpf_d->bd_label); MAC_PERFORM(init_bpfdesc_label, &bpf_d->bd_label); #ifdef MAC_DEBUG atomic_add_int(&nmacbpfdescs, 1); #endif } void mac_init_cred(struct ucred *cr) { mac_init_label(&cr->cr_label); MAC_PERFORM(init_cred_label, &cr->cr_label); #ifdef MAC_DEBUG atomic_add_int(&nmaccreds, 1); #endif } void mac_init_devfsdirent(struct devfs_dirent *de) { mac_init_label(&de->de_label); MAC_PERFORM(init_devfsdirent_label, &de->de_label); #ifdef MAC_DEBUG atomic_add_int(&nmacdevfsdirents, 1); #endif } void mac_init_ifnet(struct ifnet *ifp) { mac_init_label(&ifp->if_label); MAC_PERFORM(init_ifnet_label, &ifp->if_label); #ifdef MAC_DEBUG atomic_add_int(&nmacifnets, 1); #endif } void mac_init_ipq(struct ipq *ipq) { mac_init_label(&ipq->ipq_label); MAC_PERFORM(init_ipq_label, &ipq->ipq_label); #ifdef MAC_DEBUG atomic_add_int(&nmacipqs, 1); #endif } int mac_init_mbuf(struct mbuf *m, int flag) { int error; KASSERT(m->m_flags & M_PKTHDR, ("mac_init_mbuf on non-header mbuf")); mac_init_label(&m->m_pkthdr.label); MAC_CHECK(init_mbuf_label, &m->m_pkthdr.label, flag); if (error) { MAC_PERFORM(destroy_mbuf_label, &m->m_pkthdr.label); mac_destroy_label(&m->m_pkthdr.label); } #ifdef MAC_DEBUG if (error == 0) atomic_add_int(&nmacmbufs, 1); #endif return (error); } void mac_init_mount(struct mount *mp) { mac_init_label(&mp->mnt_mntlabel); mac_init_label(&mp->mnt_fslabel); MAC_PERFORM(init_mount_label, &mp->mnt_mntlabel); MAC_PERFORM(init_mount_fs_label, &mp->mnt_fslabel); #ifdef MAC_DEBUG atomic_add_int(&nmacmounts, 1); #endif } void mac_init_pipe(struct pipe *pipe) { struct label *label; label = malloc(sizeof(struct label), M_MACPIPELABEL, M_ZERO|M_WAITOK); mac_init_label(label); pipe->pipe_label = label; pipe->pipe_peer->pipe_label = label; MAC_PERFORM(init_pipe_label, pipe->pipe_label); #ifdef MAC_DEBUG atomic_add_int(&nmacpipes, 1); #endif } void mac_init_socket(struct socket *socket) { mac_init_label(&socket->so_label); mac_init_label(&socket->so_peerlabel); MAC_PERFORM(init_socket_label, &socket->so_label); MAC_PERFORM(init_socket_peer_label, &socket->so_peerlabel); #ifdef MAC_DEBUG atomic_add_int(&nmacsockets, 1); #endif } static void mac_init_temp(struct label *label) { mac_init_label(label); MAC_PERFORM(init_temp_label, label); #ifdef MAC_DEBUG atomic_add_int(&nmactemp, 1); #endif } void mac_init_vnode(struct vnode *vp) { mac_init_label(&vp->v_label); MAC_PERFORM(init_vnode_label, &vp->v_label); #ifdef MAC_DEBUG atomic_add_int(&nmacvnodes, 1); #endif } void mac_destroy_bpfdesc(struct bpf_d *bpf_d) { MAC_PERFORM(destroy_bpfdesc_label, &bpf_d->bd_label); mac_destroy_label(&bpf_d->bd_label); #ifdef MAC_DEBUG atomic_subtract_int(&nmacbpfdescs, 1); #endif } void mac_destroy_cred(struct ucred *cr) { MAC_PERFORM(destroy_cred_label, &cr->cr_label); mac_destroy_label(&cr->cr_label); #ifdef MAC_DEBUG atomic_subtract_int(&nmaccreds, 1); #endif } void mac_destroy_devfsdirent(struct devfs_dirent *de) { MAC_PERFORM(destroy_devfsdirent_label, &de->de_label); mac_destroy_label(&de->de_label); #ifdef MAC_DEBUG atomic_subtract_int(&nmacdevfsdirents, 1); #endif } void mac_destroy_ifnet(struct ifnet *ifp) { MAC_PERFORM(destroy_ifnet_label, &ifp->if_label); mac_destroy_label(&ifp->if_label); #ifdef MAC_DEBUG atomic_subtract_int(&nmacifnets, 1); #endif } void mac_destroy_ipq(struct ipq *ipq) { MAC_PERFORM(destroy_ipq_label, &ipq->ipq_label); mac_destroy_label(&ipq->ipq_label); #ifdef MAC_DEBUG atomic_subtract_int(&nmacipqs, 1); #endif } void mac_destroy_mbuf(struct mbuf *m) { MAC_PERFORM(destroy_mbuf_label, &m->m_pkthdr.label); mac_destroy_label(&m->m_pkthdr.label); #ifdef MAC_DEBUG atomic_subtract_int(&nmacmbufs, 1); #endif } void mac_destroy_mount(struct mount *mp) { MAC_PERFORM(destroy_mount_label, &mp->mnt_mntlabel); MAC_PERFORM(destroy_mount_fs_label, &mp->mnt_fslabel); mac_destroy_label(&mp->mnt_fslabel); mac_destroy_label(&mp->mnt_mntlabel); #ifdef MAC_DEBUG atomic_subtract_int(&nmacmounts, 1); #endif } void mac_destroy_pipe(struct pipe *pipe) { MAC_PERFORM(destroy_pipe_label, pipe->pipe_label); mac_destroy_label(pipe->pipe_label); free(pipe->pipe_label, M_MACPIPELABEL); #ifdef MAC_DEBUG atomic_subtract_int(&nmacpipes, 1); #endif } void mac_destroy_socket(struct socket *socket) { MAC_PERFORM(destroy_socket_label, &socket->so_label); MAC_PERFORM(destroy_socket_peer_label, &socket->so_peerlabel); mac_destroy_label(&socket->so_label); mac_destroy_label(&socket->so_peerlabel); #ifdef MAC_DEBUG atomic_subtract_int(&nmacsockets, 1); #endif } static void mac_destroy_temp(struct label *label) { MAC_PERFORM(destroy_temp_label, label); mac_destroy_label(label); #ifdef MAC_DEBUG atomic_subtract_int(&nmactemp, 1); #endif } void mac_destroy_vnode(struct vnode *vp) { MAC_PERFORM(destroy_vnode_label, &vp->v_label); mac_destroy_label(&vp->v_label); #ifdef MAC_DEBUG atomic_subtract_int(&nmacvnodes, 1); #endif } static int mac_externalize(struct label *label, struct mac *mac) { int error; mac_init_structmac(mac); MAC_CHECK(externalize, label, mac); return (error); } static int mac_internalize(struct label *label, struct mac *mac) { int error; mac_init_temp(label); MAC_CHECK(internalize, label, mac); if (error) mac_destroy_temp(label); return (error); } /* * Initialize MAC label for the first kernel process, from which other * kernel processes and threads are spawned. */ void mac_create_proc0(struct ucred *cred) { MAC_PERFORM(create_proc0, cred); } /* * Initialize MAC label for the first userland process, from which other * userland processes and threads are spawned. */ void mac_create_proc1(struct ucred *cred) { MAC_PERFORM(create_proc1, cred); } void mac_thread_userret(struct thread *td) { MAC_PERFORM(thread_userret, td); } /* * When a new process is created, its label must be initialized. Generally, * this involves inheritence from the parent process, modulo possible * deltas. This function allows that processing to take place. */ void mac_create_cred(struct ucred *parent_cred, struct ucred *child_cred) { MAC_PERFORM(create_cred, parent_cred, child_cred); } void mac_update_devfsdirent(struct devfs_dirent *de, struct vnode *vp) { MAC_PERFORM(update_devfsdirent, de, &de->de_label, vp, &vp->v_label); } void mac_update_procfsvnode(struct vnode *vp, struct ucred *cred) { MAC_PERFORM(update_procfsvnode, vp, &vp->v_label, cred); } /* * Support callout for policies that manage their own externalization * using extended attributes. */ static int mac_update_vnode_from_extattr(struct vnode *vp, struct mount *mp) { int error; MAC_CHECK(update_vnode_from_extattr, vp, &vp->v_label, mp, &mp->mnt_fslabel); return (error); } /* * Given an externalized mac label, internalize it and stamp it on a * vnode. */ static int mac_update_vnode_from_externalized(struct vnode *vp, struct mac *extmac) { int error; MAC_CHECK(update_vnode_from_externalized, vp, &vp->v_label, extmac); return (error); } /* * Call out to individual policies to update the label in a vnode from * the mountpoint. */ void mac_update_vnode_from_mount(struct vnode *vp, struct mount *mp) { MAC_PERFORM(update_vnode_from_mount, vp, &vp->v_label, mp, &mp->mnt_fslabel); ASSERT_VOP_LOCKED(vp, "mac_update_vnode_from_mount"); if (mac_cache_fslabel_in_vnode) vp->v_vflag |= VV_CACHEDLABEL; } /* * Implementation of VOP_REFRESHLABEL() that relies on extended attributes * to store label data. Can be referenced by filesystems supporting * extended attributes. */ int vop_stdrefreshlabel_ea(struct vop_refreshlabel_args *ap) { struct vnode *vp = ap->a_vp; struct mac extmac; int buflen, error; ASSERT_VOP_LOCKED(vp, "vop_stdrefreshlabel_ea"); /* * Call out to external policies first. Order doesn't really * matter, as long as failure of one assures failure of all. */ error = mac_update_vnode_from_extattr(vp, vp->v_mount); if (error) return (error); buflen = sizeof(extmac); error = vn_extattr_get(vp, IO_NODELOCKED, FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME, &buflen, (char *)&extmac, curthread); switch (error) { case 0: /* Got it */ break; case ENOATTR: /* * Use the label from the mount point. */ mac_update_vnode_from_mount(vp, vp->v_mount); return (0); case EOPNOTSUPP: default: /* Fail horribly. */ return (error); } if (buflen != sizeof(extmac)) error = EPERM; /* Fail very closed. */ if (error == 0) error = mac_update_vnode_from_externalized(vp, &extmac); if (error == 0) vp->v_vflag |= VV_CACHEDLABEL; else { struct vattr va; printf("Corrupted label on %s", vp->v_mount->mnt_stat.f_mntonname); if (VOP_GETATTR(vp, &va, curthread->td_ucred, curthread) == 0) printf(" inum %ld", va.va_fileid); #ifdef MAC_DEBUG if (mac_debug_label_fallback) { printf(", falling back.\n"); mac_update_vnode_from_mount(vp, vp->v_mount); error = 0; } else { #endif printf(".\n"); error = EPERM; #ifdef MAC_DEBUG } #endif } return (error); } /* * Make sure the vnode label is up-to-date. If EOPNOTSUPP, then we handle * the labeling activity outselves. Filesystems should be careful not * to change their minds regarding whether they support vop_refreshlabel() * for a vnode or not. Don't cache the vnode here, allow the file * system code to determine if it's safe to cache. If we update from * the mount, don't cache since a change to the mount label should affect * all vnodes. */ static int vn_refreshlabel(struct vnode *vp, struct ucred *cred) { int error; ASSERT_VOP_LOCKED(vp, "vn_refreshlabel"); if (vp->v_mount == NULL) { /* Eventually, we probably want to special-case refreshing of deadfs vnodes, and if there's a lock-free race somewhere, that case might be handled here. mac_update_vnode_deadfs(vp); return (0); */ /* printf("vn_refreshlabel: null v_mount\n"); */ if (vp->v_type != VNON) printf( "vn_refreshlabel: null v_mount with non-VNON\n"); return (EBADF); } if (vp->v_vflag & VV_CACHEDLABEL) { mac_vnode_label_cache_hits++; return (0); } else mac_vnode_label_cache_misses++; if ((vp->v_mount->mnt_flag & MNT_MULTILABEL) == 0) { mac_update_vnode_from_mount(vp, vp->v_mount); return (0); } error = VOP_REFRESHLABEL(vp, cred, curthread); switch (error) { case EOPNOTSUPP: /* * If labels are not supported on this vnode, fall back to * the label in the mount and propagate it to the vnode. * There should probably be some sort of policy/flag/decision * about doing this. */ mac_update_vnode_from_mount(vp, vp->v_mount); error = 0; default: return (error); } } /* * Helper function for file systems using the vop_std*_ea() calls. This * function must be called after EA service is available for the vnode, * but before it's hooked up to the namespace so that the node persists * if there's a crash, or before it can be accessed. On successful * commit of the label to disk (etc), do cache the label. */ int vop_stdcreatevnode_ea(struct vnode *dvp, struct vnode *tvp, struct ucred *cred) { struct mac extmac; int error; ASSERT_VOP_LOCKED(tvp, "vop_stdcreatevnode_ea"); if ((dvp->v_mount->mnt_flag & MNT_MULTILABEL) == 0) { mac_update_vnode_from_mount(tvp, tvp->v_mount); } else { error = vn_refreshlabel(dvp, cred); if (error) return (error); /* * Stick the label in the vnode. Then try to write to * disk. If we fail, return a failure to abort the * create operation. Really, this failure shouldn't * happen except in fairly unusual circumstances (out * of disk, etc). */ mac_create_vnode(cred, dvp, tvp); error = mac_stdcreatevnode_ea(tvp); if (error) return (error); /* * XXX: Eventually this will go away and all policies will * directly manage their extended attributes. */ error = mac_externalize(&tvp->v_label, &extmac); if (error) return (error); error = vn_extattr_set(tvp, IO_NODELOCKED, FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME, sizeof(extmac), (char *)&extmac, curthread); if (error == 0) tvp->v_vflag |= VV_CACHEDLABEL; else { #if 0 /* * In theory, we could have fall-back behavior here. * It would probably be incorrect. */ #endif return (error); } } return (0); } void mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_execve_transition"); error = vn_refreshlabel(vp, old); if (error) { printf("mac_execve_transition: vn_refreshlabel returned %d\n", error); printf("mac_execve_transition: using old vnode label\n"); } MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label); } int mac_execve_will_transition(struct ucred *old, struct vnode *vp) { int error, result; error = vn_refreshlabel(vp, old); if (error) return (error); result = 0; MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label); return (result); } int mac_check_vnode_access(struct ucred *cred, struct vnode *vp, int flags) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_access"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_access, cred, vp, &vp->v_label, flags); return (error); } int mac_check_vnode_chdir(struct ucred *cred, struct vnode *dvp) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_chdir"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); MAC_CHECK(check_vnode_chdir, cred, dvp, &dvp->v_label); return (error); } int mac_check_vnode_chroot(struct ucred *cred, struct vnode *dvp) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_chroot"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); MAC_CHECK(check_vnode_chroot, cred, dvp, &dvp->v_label); return (error); } int mac_check_vnode_create(struct ucred *cred, struct vnode *dvp, struct componentname *cnp, struct vattr *vap) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_create"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); MAC_CHECK(check_vnode_create, cred, dvp, &dvp->v_label, cnp, vap); return (error); } int mac_check_vnode_delete(struct ucred *cred, struct vnode *dvp, struct vnode *vp, struct componentname *cnp) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_delete"); ASSERT_VOP_LOCKED(vp, "mac_check_vnode_delete"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_delete, cred, dvp, &dvp->v_label, vp, &vp->v_label, cnp); return (error); } int mac_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp, acl_type_t type) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_deleteacl"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_deleteacl, cred, vp, &vp->v_label, type); return (error); } int mac_check_vnode_exec(struct ucred *cred, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_exec"); if (!mac_enforce_process && !mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label); return (error); } int mac_check_vnode_getacl(struct ucred *cred, struct vnode *vp, acl_type_t type) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_getacl"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_getacl, cred, vp, &vp->v_label, type); return (error); } int mac_check_vnode_getextattr(struct ucred *cred, struct vnode *vp, int attrnamespace, const char *name, struct uio *uio) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_getextattr"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_getextattr, cred, vp, &vp->v_label, attrnamespace, name, uio); + return (error); +} + +int +mac_check_vnode_link(struct ucred *cred, struct vnode *dvp, + struct vnode *vp, struct componentname *cnp) +{ + + int error; + + ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_link"); + ASSERT_VOP_LOCKED(vp, "mac_check_vnode_link"); + + if (!mac_enforce_fs) + return (0); + + error = vn_refreshlabel(dvp, cred); + if (error) + return (error); + + error = vn_refreshlabel(vp, cred); + if (error) + return (error); + + MAC_CHECK(check_vnode_link, cred, dvp, &dvp->v_label, vp, + &vp->v_label, cnp); return (error); } int mac_check_vnode_lookup(struct ucred *cred, struct vnode *dvp, struct componentname *cnp) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_lookup"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); MAC_CHECK(check_vnode_lookup, cred, dvp, &dvp->v_label, cnp); return (error); } vm_prot_t mac_check_vnode_mmap_prot(struct ucred *cred, struct vnode *vp, int newmapping) { vm_prot_t result = VM_PROT_ALL; if (!mac_enforce_vm) return (result); /* * This should be some sort of MAC_BITWISE, maybe :) */ ASSERT_VOP_LOCKED(vp, "mac_check_vnode_mmap_perms"); MAC_BOOLEAN(check_vnode_mmap_perms, &, cred, vp, &vp->v_label, newmapping); return (result); } int mac_check_vnode_open(struct ucred *cred, struct vnode *vp, mode_t acc_mode) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_open"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_open, cred, vp, &vp->v_label, acc_mode); return (error); } int mac_check_vnode_poll(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_poll"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, active_cred); if (error) return (error); MAC_CHECK(check_vnode_poll, active_cred, file_cred, vp, &vp->v_label); return (error); } int mac_check_vnode_read(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_read"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, active_cred); if (error) return (error); MAC_CHECK(check_vnode_read, active_cred, file_cred, vp, &vp->v_label); return (error); } int mac_check_vnode_readdir(struct ucred *cred, struct vnode *dvp) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_readdir"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); MAC_CHECK(check_vnode_readdir, cred, dvp, &dvp->v_label); return (error); } int mac_check_vnode_readlink(struct ucred *cred, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_readlink"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_readlink, cred, vp, &vp->v_label); return (error); } static int mac_check_vnode_relabel(struct ucred *cred, struct vnode *vp, struct label *newlabel) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_relabel"); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_relabel, cred, vp, &vp->v_label, newlabel); return (error); } int mac_check_vnode_rename_from(struct ucred *cred, struct vnode *dvp, struct vnode *vp, struct componentname *cnp) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_rename_from"); ASSERT_VOP_LOCKED(vp, "mac_check_vnode_rename_from"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_rename_from, cred, dvp, &dvp->v_label, vp, &vp->v_label, cnp); return (error); } int mac_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp, struct vnode *vp, int samedir, struct componentname *cnp) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_rename_to"); ASSERT_VOP_LOCKED(vp, "mac_check_vnode_rename_to"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); if (vp != NULL) { error = vn_refreshlabel(vp, cred); if (error) return (error); } MAC_CHECK(check_vnode_rename_to, cred, dvp, &dvp->v_label, vp, vp != NULL ? &vp->v_label : NULL, samedir, cnp); return (error); } int mac_check_vnode_revoke(struct ucred *cred, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_revoke"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_revoke, cred, vp, &vp->v_label); return (error); } int mac_check_vnode_setacl(struct ucred *cred, struct vnode *vp, acl_type_t type, struct acl *acl) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setacl"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_setacl, cred, vp, &vp->v_label, type, acl); return (error); } int mac_check_vnode_setextattr(struct ucred *cred, struct vnode *vp, int attrnamespace, const char *name, struct uio *uio) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setextattr"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_setextattr, cred, vp, &vp->v_label, attrnamespace, name, uio); return (error); } int mac_check_vnode_setflags(struct ucred *cred, struct vnode *vp, u_long flags) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setflags"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_setflags, cred, vp, &vp->v_label, flags); return (error); } int mac_check_vnode_setmode(struct ucred *cred, struct vnode *vp, mode_t mode) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setmode"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_setmode, cred, vp, &vp->v_label, mode); return (error); } int mac_check_vnode_setowner(struct ucred *cred, struct vnode *vp, uid_t uid, gid_t gid) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setowner"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_setowner, cred, vp, &vp->v_label, uid, gid); return (error); } int mac_check_vnode_setutimes(struct ucred *cred, struct vnode *vp, struct timespec atime, struct timespec mtime) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setutimes"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_setutimes, cred, vp, &vp->v_label, atime, mtime); return (error); } int mac_check_vnode_stat(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_stat"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, active_cred); if (error) return (error); MAC_CHECK(check_vnode_stat, active_cred, file_cred, vp, &vp->v_label); return (error); } int mac_check_vnode_write(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_write"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, active_cred); if (error) return (error); MAC_CHECK(check_vnode_write, active_cred, file_cred, vp, &vp->v_label); return (error); } /* * When relabeling a process, call out to the policies for the maximum * permission allowed for each object type we know about in its * memory space, and revoke access (in the least surprising ways we * know) when necessary. The process lock is not held here. */ static void mac_cred_mmapped_drop_perms(struct thread *td, struct ucred *cred) { /* XXX freeze all other threads */ mac_cred_mmapped_drop_perms_recurse(td, cred, &td->td_proc->p_vmspace->vm_map); /* XXX allow other threads to continue */ } static __inline const char * prot2str(vm_prot_t prot) { switch (prot & VM_PROT_ALL) { case VM_PROT_READ: return ("r--"); case VM_PROT_READ | VM_PROT_WRITE: return ("rw-"); case VM_PROT_READ | VM_PROT_EXECUTE: return ("r-x"); case VM_PROT_READ | VM_PROT_WRITE | VM_PROT_EXECUTE: return ("rwx"); case VM_PROT_WRITE: return ("-w-"); case VM_PROT_EXECUTE: return ("--x"); case VM_PROT_WRITE | VM_PROT_EXECUTE: return ("-wx"); default: return ("---"); } } static void mac_cred_mmapped_drop_perms_recurse(struct thread *td, struct ucred *cred, struct vm_map *map) { struct vm_map_entry *vme; vm_prot_t result, revokeperms; vm_object_t object; vm_ooffset_t offset; struct vnode *vp; if (!mac_mmap_revocation) return; vm_map_lock_read(map); for (vme = map->header.next; vme != &map->header; vme = vme->next) { if (vme->eflags & MAP_ENTRY_IS_SUB_MAP) { mac_cred_mmapped_drop_perms_recurse(td, cred, vme->object.sub_map); continue; } /* * Skip over entries that obviously are not shared. */ if (vme->eflags & (MAP_ENTRY_COW | MAP_ENTRY_NOSYNC) || !vme->max_protection) continue; /* * Drill down to the deepest backing object. */ offset = vme->offset; object = vme->object.vm_object; if (object == NULL) continue; while (object->backing_object != NULL) { object = object->backing_object; offset += object->backing_object_offset; } /* * At the moment, vm_maps and objects aren't considered * by the MAC system, so only things with backing by a * normal object (read: vnodes) are checked. */ if (object->type != OBJT_VNODE) continue; vp = (struct vnode *)object->handle; vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); result = mac_check_vnode_mmap_prot(cred, vp, 0); VOP_UNLOCK(vp, 0, td); /* * Find out what maximum protection we may be allowing * now but a policy needs to get removed. */ revokeperms = vme->max_protection & ~result; if (!revokeperms) continue; printf("pid %ld: revoking %s perms from %#lx:%ld " "(max %s/cur %s)\n", (long)td->td_proc->p_pid, prot2str(revokeperms), (u_long)vme->start, (long)(vme->end - vme->start), prot2str(vme->max_protection), prot2str(vme->protection)); vm_map_lock_upgrade(map); /* * This is the really simple case: if a map has more * max_protection than is allowed, but it's not being * actually used (that is, the current protection is * still allowed), we can just wipe it out and do * nothing more. */ if ((vme->protection & revokeperms) == 0) { vme->max_protection -= revokeperms; } else { if (revokeperms & VM_PROT_WRITE) { /* * In the more complicated case, flush out all * pending changes to the object then turn it * copy-on-write. */ vm_object_reference(object); vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); vm_object_page_clean(object, OFF_TO_IDX(offset), OFF_TO_IDX(offset + vme->end - vme->start + PAGE_MASK), OBJPC_SYNC); VOP_UNLOCK(vp, 0, td); vm_object_deallocate(object); /* * Why bother if there's no read permissions * anymore? For the rest, we need to leave * the write permissions on for COW, or * remove them entirely if configured to. */ if (!mac_mmap_revocation_via_cow) { vme->max_protection &= ~VM_PROT_WRITE; vme->protection &= ~VM_PROT_WRITE; } if ((revokeperms & VM_PROT_READ) == 0) vme->eflags |= MAP_ENTRY_COW | MAP_ENTRY_NEEDS_COPY; } if (revokeperms & VM_PROT_EXECUTE) { vme->max_protection &= ~VM_PROT_EXECUTE; vme->protection &= ~VM_PROT_EXECUTE; } if (revokeperms & VM_PROT_READ) { vme->max_protection = 0; vme->protection = 0; } pmap_protect(map->pmap, vme->start, vme->end, vme->protection & ~revokeperms); vm_map_simplify_entry(map, vme); } vm_map_lock_downgrade(map); } vm_map_unlock_read(map); } /* * When the subject's label changes, it may require revocation of privilege * to mapped objects. This can't be done on-the-fly later with a unified * buffer cache. */ static void mac_relabel_cred(struct ucred *cred, struct label *newlabel) { MAC_PERFORM(relabel_cred, cred, newlabel); } void mac_relabel_vnode(struct ucred *cred, struct vnode *vp, struct label *newlabel) { MAC_PERFORM(relabel_vnode, cred, vp, &vp->v_label, newlabel); } void mac_create_ifnet(struct ifnet *ifnet) { MAC_PERFORM(create_ifnet, ifnet, &ifnet->if_label); } void mac_create_bpfdesc(struct ucred *cred, struct bpf_d *bpf_d) { MAC_PERFORM(create_bpfdesc, cred, bpf_d, &bpf_d->bd_label); } void mac_create_socket(struct ucred *cred, struct socket *socket) { MAC_PERFORM(create_socket, cred, socket, &socket->so_label); } void mac_create_pipe(struct ucred *cred, struct pipe *pipe) { MAC_PERFORM(create_pipe, cred, pipe, pipe->pipe_label); } void mac_create_socket_from_socket(struct socket *oldsocket, struct socket *newsocket) { MAC_PERFORM(create_socket_from_socket, oldsocket, &oldsocket->so_label, newsocket, &newsocket->so_label); } static void mac_relabel_socket(struct ucred *cred, struct socket *socket, struct label *newlabel) { MAC_PERFORM(relabel_socket, cred, socket, &socket->so_label, newlabel); } static void mac_relabel_pipe(struct ucred *cred, struct pipe *pipe, struct label *newlabel) { MAC_PERFORM(relabel_pipe, cred, pipe, pipe->pipe_label, newlabel); } void mac_set_socket_peer_from_mbuf(struct mbuf *mbuf, struct socket *socket) { MAC_PERFORM(set_socket_peer_from_mbuf, mbuf, &mbuf->m_pkthdr.label, socket, &socket->so_peerlabel); } void mac_set_socket_peer_from_socket(struct socket *oldsocket, struct socket *newsocket) { MAC_PERFORM(set_socket_peer_from_socket, oldsocket, &oldsocket->so_label, newsocket, &newsocket->so_peerlabel); } void mac_create_datagram_from_ipq(struct ipq *ipq, struct mbuf *datagram) { MAC_PERFORM(create_datagram_from_ipq, ipq, &ipq->ipq_label, datagram, &datagram->m_pkthdr.label); } void mac_create_fragment(struct mbuf *datagram, struct mbuf *fragment) { MAC_PERFORM(create_fragment, datagram, &datagram->m_pkthdr.label, fragment, &fragment->m_pkthdr.label); } void mac_create_ipq(struct mbuf *fragment, struct ipq *ipq) { MAC_PERFORM(create_ipq, fragment, &fragment->m_pkthdr.label, ipq, &ipq->ipq_label); } void mac_create_mbuf_from_mbuf(struct mbuf *oldmbuf, struct mbuf *newmbuf) { MAC_PERFORM(create_mbuf_from_mbuf, oldmbuf, &oldmbuf->m_pkthdr.label, newmbuf, &newmbuf->m_pkthdr.label); } void mac_create_mbuf_from_bpfdesc(struct bpf_d *bpf_d, struct mbuf *mbuf) { MAC_PERFORM(create_mbuf_from_bpfdesc, bpf_d, &bpf_d->bd_label, mbuf, &mbuf->m_pkthdr.label); } void mac_create_mbuf_linklayer(struct ifnet *ifnet, struct mbuf *mbuf) { MAC_PERFORM(create_mbuf_linklayer, ifnet, &ifnet->if_label, mbuf, &mbuf->m_pkthdr.label); } void mac_create_mbuf_from_ifnet(struct ifnet *ifnet, struct mbuf *mbuf) { MAC_PERFORM(create_mbuf_from_ifnet, ifnet, &ifnet->if_label, mbuf, &mbuf->m_pkthdr.label); } void mac_create_mbuf_multicast_encap(struct mbuf *oldmbuf, struct ifnet *ifnet, struct mbuf *newmbuf) { MAC_PERFORM(create_mbuf_multicast_encap, oldmbuf, &oldmbuf->m_pkthdr.label, ifnet, &ifnet->if_label, newmbuf, &newmbuf->m_pkthdr.label); } void mac_create_mbuf_netlayer(struct mbuf *oldmbuf, struct mbuf *newmbuf) { MAC_PERFORM(create_mbuf_netlayer, oldmbuf, &oldmbuf->m_pkthdr.label, newmbuf, &newmbuf->m_pkthdr.label); } int mac_fragment_match(struct mbuf *fragment, struct ipq *ipq) { int result; result = 1; MAC_BOOLEAN(fragment_match, &&, fragment, &fragment->m_pkthdr.label, ipq, &ipq->ipq_label); return (result); } void mac_update_ipq(struct mbuf *fragment, struct ipq *ipq) { MAC_PERFORM(update_ipq, fragment, &fragment->m_pkthdr.label, ipq, &ipq->ipq_label); } void mac_create_mbuf_from_socket(struct socket *socket, struct mbuf *mbuf) { MAC_PERFORM(create_mbuf_from_socket, socket, &socket->so_label, mbuf, &mbuf->m_pkthdr.label); } void mac_create_mount(struct ucred *cred, struct mount *mp) { MAC_PERFORM(create_mount, cred, mp, &mp->mnt_mntlabel, &mp->mnt_fslabel); } void mac_create_root_mount(struct ucred *cred, struct mount *mp) { MAC_PERFORM(create_root_mount, cred, mp, &mp->mnt_mntlabel, &mp->mnt_fslabel); } int mac_check_bpfdesc_receive(struct bpf_d *bpf_d, struct ifnet *ifnet) { int error; if (!mac_enforce_network) return (0); MAC_CHECK(check_bpfdesc_receive, bpf_d, &bpf_d->bd_label, ifnet, &ifnet->if_label); return (error); } static int mac_check_cred_relabel(struct ucred *cred, struct label *newlabel) { int error; MAC_CHECK(check_cred_relabel, cred, newlabel); return (error); } int mac_check_cred_visible(struct ucred *u1, struct ucred *u2) { int error; if (!mac_enforce_process) return (0); MAC_CHECK(check_cred_visible, u1, u2); return (error); } int mac_check_ifnet_transmit(struct ifnet *ifnet, struct mbuf *mbuf) { int error; if (!mac_enforce_network) return (0); KASSERT(mbuf->m_flags & M_PKTHDR, ("packet has no pkthdr")); if (!(mbuf->m_pkthdr.label.l_flags & MAC_FLAG_INITIALIZED)) printf("%s%d: not initialized\n", ifnet->if_name, ifnet->if_unit); MAC_CHECK(check_ifnet_transmit, ifnet, &ifnet->if_label, mbuf, &mbuf->m_pkthdr.label); return (error); } int mac_check_mount_stat(struct ucred *cred, struct mount *mount) { int error; if (!mac_enforce_fs) return (0); MAC_CHECK(check_mount_stat, cred, mount, &mount->mnt_mntlabel); return (error); } int mac_check_pipe_ioctl(struct ucred *cred, struct pipe *pipe, unsigned long cmd, void *data) { int error; PIPE_LOCK_ASSERT(pipe, MA_OWNED); if (!mac_enforce_pipe) return (0); MAC_CHECK(check_pipe_ioctl, cred, pipe, pipe->pipe_label, cmd, data); return (error); } int mac_check_pipe_poll(struct ucred *cred, struct pipe *pipe) { int error; PIPE_LOCK_ASSERT(pipe, MA_OWNED); if (!mac_enforce_pipe) return (0); MAC_CHECK(check_pipe_poll, cred, pipe, pipe->pipe_label); return (error); } int mac_check_pipe_read(struct ucred *cred, struct pipe *pipe) { int error; PIPE_LOCK_ASSERT(pipe, MA_OWNED); if (!mac_enforce_pipe) return (0); MAC_CHECK(check_pipe_read, cred, pipe, pipe->pipe_label); return (error); } static int mac_check_pipe_relabel(struct ucred *cred, struct pipe *pipe, struct label *newlabel) { int error; PIPE_LOCK_ASSERT(pipe, MA_OWNED); if (!mac_enforce_pipe) return (0); MAC_CHECK(check_pipe_relabel, cred, pipe, pipe->pipe_label, newlabel); return (error); } int mac_check_pipe_stat(struct ucred *cred, struct pipe *pipe) { int error; PIPE_LOCK_ASSERT(pipe, MA_OWNED); if (!mac_enforce_pipe) return (0); MAC_CHECK(check_pipe_stat, cred, pipe, pipe->pipe_label); return (error); } int mac_check_pipe_write(struct ucred *cred, struct pipe *pipe) { int error; PIPE_LOCK_ASSERT(pipe, MA_OWNED); if (!mac_enforce_pipe) return (0); MAC_CHECK(check_pipe_write, cred, pipe, pipe->pipe_label); return (error); } int mac_check_proc_debug(struct ucred *cred, struct proc *proc) { int error; PROC_LOCK_ASSERT(proc, MA_OWNED); if (!mac_enforce_process) return (0); MAC_CHECK(check_proc_debug, cred, proc); return (error); } int mac_check_proc_sched(struct ucred *cred, struct proc *proc) { int error; PROC_LOCK_ASSERT(proc, MA_OWNED); if (!mac_enforce_process) return (0); MAC_CHECK(check_proc_sched, cred, proc); return (error); } int mac_check_proc_signal(struct ucred *cred, struct proc *proc, int signum) { int error; PROC_LOCK_ASSERT(proc, MA_OWNED); if (!mac_enforce_process) return (0); MAC_CHECK(check_proc_signal, cred, proc, signum); return (error); } int mac_check_socket_bind(struct ucred *ucred, struct socket *socket, struct sockaddr *sockaddr) { int error; if (!mac_enforce_socket) return (0); MAC_CHECK(check_socket_bind, ucred, socket, &socket->so_label, sockaddr); return (error); } int mac_check_socket_connect(struct ucred *cred, struct socket *socket, struct sockaddr *sockaddr) { int error; if (!mac_enforce_socket) return (0); MAC_CHECK(check_socket_connect, cred, socket, &socket->so_label, sockaddr); return (error); } int mac_check_socket_deliver(struct socket *socket, struct mbuf *mbuf) { int error; if (!mac_enforce_socket) return (0); MAC_CHECK(check_socket_deliver, socket, &socket->so_label, mbuf, &mbuf->m_pkthdr.label); return (error); } int mac_check_socket_listen(struct ucred *cred, struct socket *socket) { int error; if (!mac_enforce_socket) return (0); MAC_CHECK(check_socket_listen, cred, socket, &socket->so_label); return (error); } static int mac_check_socket_relabel(struct ucred *cred, struct socket *socket, struct label *newlabel) { int error; MAC_CHECK(check_socket_relabel, cred, socket, &socket->so_label, newlabel); return (error); } int mac_check_socket_visible(struct ucred *cred, struct socket *socket) { int error; if (!mac_enforce_socket) return (0); MAC_CHECK(check_socket_visible, cred, socket, &socket->so_label); return (error); } int mac_ioctl_ifnet_get(struct ucred *cred, struct ifreq *ifr, struct ifnet *ifnet) { struct mac label; int error; error = mac_externalize(&ifnet->if_label, &label); if (error) return (error); return (copyout(&label, ifr->ifr_ifru.ifru_data, sizeof(label))); } int mac_ioctl_ifnet_set(struct ucred *cred, struct ifreq *ifr, struct ifnet *ifnet) { struct mac newlabel; struct label intlabel; int error; error = copyin(ifr->ifr_ifru.ifru_data, &newlabel, sizeof(newlabel)); if (error) return (error); error = mac_internalize(&intlabel, &newlabel); if (error) return (error); /* * XXX: Note that this is a redundant privilege check, since * policies impose this check themselves if required by the * policy. Eventually, this should go away. */ error = suser_cred(cred, 0); if (error) goto out; MAC_CHECK(check_ifnet_relabel, cred, ifnet, &ifnet->if_label, &intlabel); if (error) goto out; MAC_PERFORM(relabel_ifnet, cred, ifnet, &ifnet->if_label, &intlabel); out: mac_destroy_temp(&intlabel); return (error); } void mac_create_devfs_vnode(struct devfs_dirent *de, struct vnode *vp) { MAC_PERFORM(create_devfs_vnode, de, &de->de_label, vp, &vp->v_label); } void mac_create_devfs_device(dev_t dev, struct devfs_dirent *de) { MAC_PERFORM(create_devfs_device, dev, de, &de->de_label); } static int mac_stdcreatevnode_ea(struct vnode *vp) { int error; MAC_CHECK(stdcreatevnode_ea, vp, &vp->v_label); return (error); } void mac_create_devfs_directory(char *dirname, int dirnamelen, struct devfs_dirent *de) { MAC_PERFORM(create_devfs_directory, dirname, dirnamelen, de, &de->de_label); } /* * When a new vnode is created, this call will initialize its label. */ void mac_create_vnode(struct ucred *cred, struct vnode *parent, struct vnode *child) { int error; ASSERT_VOP_LOCKED(parent, "mac_create_vnode"); ASSERT_VOP_LOCKED(child, "mac_create_vnode"); error = vn_refreshlabel(parent, cred); if (error) { printf("mac_create_vnode: vn_refreshlabel returned %d\n", error); printf("mac_create_vnode: using old vnode label\n"); } MAC_PERFORM(create_vnode, cred, parent, &parent->v_label, child, &child->v_label); } int mac_setsockopt_label_set(struct ucred *cred, struct socket *so, struct mac *extmac) { struct label intlabel; int error; error = mac_internalize(&intlabel, extmac); if (error) return (error); mac_check_socket_relabel(cred, so, &intlabel); if (error) { mac_destroy_temp(&intlabel); return (error); } mac_relabel_socket(cred, so, &intlabel); mac_destroy_temp(&intlabel); return (0); } int mac_pipe_label_set(struct ucred *cred, struct pipe *pipe, struct label *label) { int error; PIPE_LOCK_ASSERT(pipe, MA_OWNED); error = mac_check_pipe_relabel(cred, pipe, label); if (error) return (error); mac_relabel_pipe(cred, pipe, label); return (0); } int mac_getsockopt_label_get(struct ucred *cred, struct socket *so, struct mac *extmac) { return (mac_externalize(&so->so_label, extmac)); } int mac_getsockopt_peerlabel_get(struct ucred *cred, struct socket *so, struct mac *extmac) { return (mac_externalize(&so->so_peerlabel, extmac)); } /* * Implementation of VOP_SETLABEL() that relies on extended attributes * to store label data. Can be referenced by filesystems supporting * extended attributes. */ int vop_stdsetlabel_ea(struct vop_setlabel_args *ap) { struct vnode *vp = ap->a_vp; struct label *intlabel = ap->a_label; struct mac extmac; int error; ASSERT_VOP_LOCKED(vp, "vop_stdsetlabel_ea"); /* * XXX: Eventually call out to EA check/set calls here. * Be particularly careful to avoid race conditions, * consistency problems, and stability problems when * dealing with multiple EAs. In particular, we require * the ability to write multiple EAs on the same file in * a single transaction, which the current EA interface * does not provide. */ error = mac_externalize(intlabel, &extmac); if (error) return (error); error = vn_extattr_set(vp, IO_NODELOCKED, FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME, sizeof(extmac), (char *)&extmac, curthread); if (error) return (error); mac_relabel_vnode(ap->a_cred, vp, intlabel); vp->v_vflag |= VV_CACHEDLABEL; return (0); } static int vn_setlabel(struct vnode *vp, struct label *intlabel, struct ucred *cred) { int error; if (vp->v_mount == NULL) { /* printf("vn_setlabel: null v_mount\n"); */ if (vp->v_type != VNON) printf("vn_setlabel: null v_mount with non-VNON\n"); return (EBADF); } if ((vp->v_mount->mnt_flag & MNT_MULTILABEL) == 0) return (EOPNOTSUPP); /* * Multi-phase commit. First check the policies to confirm the * change is OK. Then commit via the filesystem. Finally, * update the actual vnode label. Question: maybe the filesystem * should update the vnode at the end as part of VOP_SETLABEL()? */ error = mac_check_vnode_relabel(cred, vp, intlabel); if (error) return (error); /* * VADMIN provides the opportunity for the filesystem to make * decisions about who is and is not able to modify labels * and protections on files. This might not be right. We can't * assume VOP_SETLABEL() will do it, because we might implement * that as part of vop_stdsetlabel_ea(). */ error = VOP_ACCESS(vp, VADMIN, cred, curthread); if (error) return (error); error = VOP_SETLABEL(vp, intlabel, cred, curthread); if (error) return (error); return (0); } /* * MPSAFE */ int __mac_get_proc(struct thread *td, struct __mac_get_proc_args *uap) { struct mac extmac; int error; error = mac_externalize(&td->td_ucred->cr_label, &extmac); if (error == 0) error = copyout(&extmac, SCARG(uap, mac_p), sizeof(extmac)); return (error); } /* * MPSAFE */ int __mac_set_proc(struct thread *td, struct __mac_set_proc_args *uap) { struct ucred *newcred, *oldcred; struct proc *p; struct mac extmac; struct label intlabel; int error; error = copyin(SCARG(uap, mac_p), &extmac, sizeof(extmac)); if (error) return (error); error = mac_internalize(&intlabel, &extmac); if (error) return (error); newcred = crget(); p = td->td_proc; PROC_LOCK(p); oldcred = p->p_ucred; error = mac_check_cred_relabel(oldcred, &intlabel); if (error) { PROC_UNLOCK(p); mac_destroy_temp(&intlabel); crfree(newcred); return (error); } setsugid(p); crcopy(newcred, oldcred); mac_relabel_cred(newcred, &intlabel); p->p_ucred = newcred; /* * Grab additional reference for use while revoking mmaps, prior * to releasing the proc lock and sharing the cred. */ crhold(newcred); PROC_UNLOCK(p); mtx_lock(&Giant); mac_cred_mmapped_drop_perms(td, newcred); mtx_unlock(&Giant); crfree(newcred); /* Free revocation reference. */ crfree(oldcred); mac_destroy_temp(&intlabel); return (0); } /* * MPSAFE */ int __mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap) { struct file *fp; struct mac extmac; struct vnode *vp; struct pipe *pipe; int error; mtx_lock(&Giant); error = fget(td, SCARG(uap, fd), &fp); if (error) goto out; switch (fp->f_type) { case DTYPE_FIFO: case DTYPE_VNODE: vp = (struct vnode *)fp->f_data; vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); error = vn_refreshlabel(vp, td->td_ucred); if (error == 0) error = mac_externalize(&vp->v_label, &extmac); VOP_UNLOCK(vp, 0, td); break; case DTYPE_PIPE: pipe = (struct pipe *)fp->f_data; error = mac_externalize(pipe->pipe_label, &extmac); break; default: error = EINVAL; } if (error == 0) error = copyout(&extmac, SCARG(uap, mac_p), sizeof(extmac)); fdrop(fp, td); out: mtx_unlock(&Giant); return (error); } /* * MPSAFE */ int __mac_get_file(struct thread *td, struct __mac_get_file_args *uap) { struct nameidata nd; struct mac extmac; int error; mtx_lock(&Giant); NDINIT(&nd, LOOKUP, LOCKLEAF | FOLLOW, UIO_USERSPACE, SCARG(uap, path_p), td); error = namei(&nd); if (error) goto out; error = vn_refreshlabel(nd.ni_vp, td->td_ucred); if (error == 0) error = mac_externalize(&nd.ni_vp->v_label, &extmac); NDFREE(&nd, 0); if (error) goto out; error = copyout(&extmac, SCARG(uap, mac_p), sizeof(extmac)); out: mtx_unlock(&Giant); return (error); } /* * MPSAFE */ int __mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap) { struct file *fp; struct mac extmac; struct label intlabel; struct mount *mp; struct vnode *vp; struct pipe *pipe; int error; mtx_lock(&Giant); error = fget(td, SCARG(uap, fd), &fp); if (error) goto out1; error = copyin(SCARG(uap, mac_p), &extmac, sizeof(extmac)); if (error) goto out2; error = mac_internalize(&intlabel, &extmac); if (error) goto out2; switch (fp->f_type) { case DTYPE_FIFO: case DTYPE_VNODE: vp = (struct vnode *)fp->f_data; error = vn_start_write(vp, &mp, V_WAIT | PCATCH); if (error != 0) break; vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); error = vn_setlabel(vp, &intlabel, td->td_ucred); VOP_UNLOCK(vp, 0, td); vn_finished_write(mp); mac_destroy_temp(&intlabel); break; case DTYPE_PIPE: pipe = (struct pipe *)fp->f_data; PIPE_LOCK(pipe); error = mac_pipe_label_set(td->td_ucred, pipe, &intlabel); PIPE_UNLOCK(pipe); break; default: error = EINVAL; } out2: fdrop(fp, td); out1: mtx_unlock(&Giant); return (error); } /* * MPSAFE */ int __mac_set_file(struct thread *td, struct __mac_set_file_args *uap) { struct nameidata nd; struct mac extmac; struct label intlabel; struct mount *mp; int error; mtx_lock(&Giant); error = copyin(SCARG(uap, mac_p), &extmac, sizeof(extmac)); if (error) goto out; error = mac_internalize(&intlabel, &extmac); if (error) goto out; NDINIT(&nd, LOOKUP, LOCKLEAF | FOLLOW, UIO_USERSPACE, SCARG(uap, path_p), td); error = namei(&nd); if (error) goto out2; error = vn_start_write(nd.ni_vp, &mp, V_WAIT | PCATCH); if (error) goto out2; error = vn_setlabel(nd.ni_vp, &intlabel, td->td_ucred); vn_finished_write(mp); out2: mac_destroy_temp(&intlabel); NDFREE(&nd, 0); out: mtx_unlock(&Giant); return (error); } int mac_syscall(struct thread *td, struct mac_syscall_args *uap) { struct mac_policy_conf *mpc; char target[MAC_MAX_POLICY_NAME]; int error; error = copyinstr(SCARG(uap, policy), target, sizeof(target), NULL); if (error) return (error); error = ENOSYS; MAC_POLICY_LIST_BUSY(); LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { if (strcmp(mpc->mpc_name, target) == 0 && mpc->mpc_ops->mpo_syscall != NULL) { error = mpc->mpc_ops->mpo_syscall(td, SCARG(uap, call), SCARG(uap, arg)); goto out; } } out: MAC_POLICY_LIST_UNBUSY(); return (error); } SYSINIT(mac, SI_SUB_MAC, SI_ORDER_FIRST, mac_init, NULL); SYSINIT(mac_late, SI_SUB_MAC_LATE, SI_ORDER_FIRST, mac_late_init, NULL); #else /* !MAC */ int __mac_get_proc(struct thread *td, struct __mac_get_proc_args *uap) { return (ENOSYS); } int __mac_set_proc(struct thread *td, struct __mac_set_proc_args *uap) { return (ENOSYS); } int __mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap) { return (ENOSYS); } int __mac_get_file(struct thread *td, struct __mac_get_file_args *uap) { return (ENOSYS); } int __mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap) { return (ENOSYS); } int __mac_set_file(struct thread *td, struct __mac_set_file_args *uap) { return (ENOSYS); } int mac_syscall(struct thread *td, struct mac_syscall_args *uap) { return (ENOSYS); } #endif /* !MAC */ Index: head/sys/security/mac/mac_pipe.c =================================================================== --- head/sys/security/mac/mac_pipe.c (revision 104528) +++ head/sys/security/mac/mac_pipe.c (revision 104529) @@ -1,3432 +1,3462 @@ /*- * Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson * Copyright (c) 2001 Ilmar S. Habibulin * Copyright (c) 2001, 2002 Networks Associates Technology, Inc. * All rights reserved. * * This software was developed by Robert Watson and Ilmar Habibulin for the * TrustedBSD Project. * * This software was developed for the FreeBSD Project in part by NAI Labs, * the Security Research Division of Network Associates, Inc. under * DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA * CHATS research program. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * 3. The names of the authors may not be used to endorse or promote * products derived from this software without specific prior written * permission. * * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. * * $FreeBSD$ */ /* * Developed by the TrustedBSD Project. * * Framework for extensible kernel access control. Kernel and userland * interface to the framework, policy registration and composition. */ #include "opt_mac.h" #include "opt_devfs.h" #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #ifdef MAC /* * Declare that the kernel provides MAC support, version 1. This permits * modules to refuse to be loaded if the necessary support isn't present, * even if it's pre-boot. */ MODULE_VERSION(kernel_mac_support, 1); SYSCTL_DECL(_security); SYSCTL_NODE(_security, OID_AUTO, mac, CTLFLAG_RW, 0, "TrustedBSD MAC policy controls"); #ifndef MAC_MAX_POLICIES #define MAC_MAX_POLICIES 8 #endif #if MAC_MAX_POLICIES > 32 #error "MAC_MAX_POLICIES too large" #endif static unsigned int mac_max_policies = MAC_MAX_POLICIES; static unsigned int mac_policy_offsets_free = (1 << MAC_MAX_POLICIES) - 1; SYSCTL_UINT(_security_mac, OID_AUTO, max_policies, CTLFLAG_RD, &mac_max_policies, 0, ""); static int mac_late = 0; static int mac_enforce_fs = 1; SYSCTL_INT(_security_mac, OID_AUTO, enforce_fs, CTLFLAG_RW, &mac_enforce_fs, 0, "Enforce MAC policy on file system objects"); TUNABLE_INT("security.mac.enforce_fs", &mac_enforce_fs); static int mac_enforce_network = 1; SYSCTL_INT(_security_mac, OID_AUTO, enforce_network, CTLFLAG_RW, &mac_enforce_network, 0, "Enforce MAC policy on network packets"); TUNABLE_INT("security.mac.enforce_network", &mac_enforce_network); static int mac_enforce_pipe = 1; SYSCTL_INT(_security_mac, OID_AUTO, enforce_pipe, CTLFLAG_RW, &mac_enforce_pipe, 0, "Enforce MAC policy on pipe operations"); TUNABLE_INT("security.mac.enforce_pipe", &mac_enforce_pipe); static int mac_enforce_process = 1; SYSCTL_INT(_security_mac, OID_AUTO, enforce_process, CTLFLAG_RW, &mac_enforce_process, 0, "Enforce MAC policy on inter-process operations"); TUNABLE_INT("security.mac.enforce_process", &mac_enforce_process); static int mac_enforce_socket = 1; SYSCTL_INT(_security_mac, OID_AUTO, enforce_socket, CTLFLAG_RW, &mac_enforce_socket, 0, "Enforce MAC policy on socket operations"); TUNABLE_INT("security.mac.enforce_socket", &mac_enforce_socket); static int mac_enforce_vm = 1; SYSCTL_INT(_security_mac, OID_AUTO, enforce_vm, CTLFLAG_RW, &mac_enforce_vm, 0, "Enforce MAC policy on vm operations"); TUNABLE_INT("security.mac.enforce_vm", &mac_enforce_vm); static int mac_label_size = sizeof(struct mac); SYSCTL_INT(_security_mac, OID_AUTO, label_size, CTLFLAG_RD, &mac_label_size, 0, "Pre-compiled MAC label size"); static int mac_cache_fslabel_in_vnode = 1; SYSCTL_INT(_security_mac, OID_AUTO, cache_fslabel_in_vnode, CTLFLAG_RW, &mac_cache_fslabel_in_vnode, 0, "Cache mount fslabel in vnode"); TUNABLE_INT("security.mac.cache_fslabel_in_vnode", &mac_cache_fslabel_in_vnode); static int mac_vnode_label_cache_hits = 0; SYSCTL_INT(_security_mac, OID_AUTO, vnode_label_cache_hits, CTLFLAG_RD, &mac_vnode_label_cache_hits, 0, "Cache hits on vnode labels"); static int mac_vnode_label_cache_misses = 0; SYSCTL_INT(_security_mac, OID_AUTO, vnode_label_cache_misses, CTLFLAG_RD, &mac_vnode_label_cache_misses, 0, "Cache misses on vnode labels"); static int mac_mmap_revocation = 1; SYSCTL_INT(_security_mac, OID_AUTO, mmap_revocation, CTLFLAG_RW, &mac_mmap_revocation, 0, "Revoke mmap access to files on subject " "relabel"); static int mac_mmap_revocation_via_cow = 0; SYSCTL_INT(_security_mac, OID_AUTO, mmap_revocation_via_cow, CTLFLAG_RW, &mac_mmap_revocation_via_cow, 0, "Revoke mmap access to files via " "copy-on-write semantics, or by removing all write access"); #ifdef MAC_DEBUG SYSCTL_NODE(_security_mac, OID_AUTO, debug, CTLFLAG_RW, 0, "TrustedBSD MAC debug info"); static int mac_debug_label_fallback = 0; SYSCTL_INT(_security_mac_debug, OID_AUTO, label_fallback, CTLFLAG_RW, &mac_debug_label_fallback, 0, "Filesystems should fall back to fs label" "when label is corrupted."); TUNABLE_INT("security.mac.debug_label_fallback", &mac_debug_label_fallback); SYSCTL_NODE(_security_mac_debug, OID_AUTO, counters, CTLFLAG_RW, 0, "TrustedBSD MAC object counters"); static unsigned int nmacmbufs, nmaccreds, nmacifnets, nmacbpfdescs, nmacsockets, nmacmounts, nmactemp, nmacvnodes, nmacdevfsdirents, nmacipqs, nmacpipes; SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, mbufs, CTLFLAG_RD, &nmacmbufs, 0, "number of mbufs in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, creds, CTLFLAG_RD, &nmaccreds, 0, "number of ucreds in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, ifnets, CTLFLAG_RD, &nmacifnets, 0, "number of ifnets in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, ipqs, CTLFLAG_RD, &nmacipqs, 0, "number of ipqs in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, bpfdescs, CTLFLAG_RD, &nmacbpfdescs, 0, "number of bpfdescs in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, sockets, CTLFLAG_RD, &nmacsockets, 0, "number of sockets in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, pipes, CTLFLAG_RD, &nmacpipes, 0, "number of pipes in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, mounts, CTLFLAG_RD, &nmacmounts, 0, "number of mounts in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, temp, CTLFLAG_RD, &nmactemp, 0, "number of temporary labels in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, vnodes, CTLFLAG_RD, &nmacvnodes, 0, "number of vnodes in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, devfsdirents, CTLFLAG_RD, &nmacdevfsdirents, 0, "number of devfs dirents inuse"); #endif static int error_select(int error1, int error2); static int mac_externalize(struct label *label, struct mac *mac); static int mac_policy_register(struct mac_policy_conf *mpc); static int mac_policy_unregister(struct mac_policy_conf *mpc); static int mac_stdcreatevnode_ea(struct vnode *vp); static void mac_cred_mmapped_drop_perms(struct thread *td, struct ucred *cred); static void mac_cred_mmapped_drop_perms_recurse(struct thread *td, struct ucred *cred, struct vm_map *map); MALLOC_DEFINE(M_MACOPVEC, "macopvec", "MAC policy operation vector"); MALLOC_DEFINE(M_MACPIPELABEL, "macpipelabel", "MAC labels for pipes"); /* * mac_policy_list_lock protects the consistency of 'mac_policy_list', * the linked list of attached policy modules. Read-only consumers of * the list must acquire a shared lock for the duration of their use; * writers must acquire an exclusive lock. Note that for compound * operations, locks should be held for the entire compound operation, * and that this is not yet done for relabel requests. */ static struct mtx mac_policy_list_lock; static LIST_HEAD(, mac_policy_conf) mac_policy_list; static int mac_policy_list_busy; #define MAC_POLICY_LIST_LOCKINIT() mtx_init(&mac_policy_list_lock, \ "mac_policy_list_lock", NULL, MTX_DEF); #define MAC_POLICY_LIST_LOCK() mtx_lock(&mac_policy_list_lock); #define MAC_POLICY_LIST_UNLOCK() mtx_unlock(&mac_policy_list_lock); #define MAC_POLICY_LIST_BUSY() do { \ MAC_POLICY_LIST_LOCK(); \ mac_policy_list_busy++; \ MAC_POLICY_LIST_UNLOCK(); \ } while (0) #define MAC_POLICY_LIST_UNBUSY() do { \ MAC_POLICY_LIST_LOCK(); \ mac_policy_list_busy--; \ if (mac_policy_list_busy < 0) \ panic("Extra mac_policy_list_busy--"); \ MAC_POLICY_LIST_UNLOCK(); \ } while (0) /* * MAC_CHECK performs the designated check by walking the policy * module list and checking with each as to how it feels about the * request. Note that it returns its value via 'error' in the scope * of the caller. */ #define MAC_CHECK(check, args...) do { \ struct mac_policy_conf *mpc; \ \ error = 0; \ MAC_POLICY_LIST_BUSY(); \ LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { \ if (mpc->mpc_ops->mpo_ ## check != NULL) \ error = error_select( \ mpc->mpc_ops->mpo_ ## check (args), \ error); \ } \ MAC_POLICY_LIST_UNBUSY(); \ } while (0) /* * MAC_BOOLEAN performs the designated boolean composition by walking * the module list, invoking each instance of the operation, and * combining the results using the passed C operator. Note that it * returns its value via 'result' in the scope of the caller, which * should be initialized by the caller in a meaningful way to get * a meaningful result. */ #define MAC_BOOLEAN(operation, composition, args...) do { \ struct mac_policy_conf *mpc; \ \ MAC_POLICY_LIST_BUSY(); \ LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { \ if (mpc->mpc_ops->mpo_ ## operation != NULL) \ result = result composition \ mpc->mpc_ops->mpo_ ## operation (args); \ } \ MAC_POLICY_LIST_UNBUSY(); \ } while (0) /* * MAC_PERFORM performs the designated operation by walking the policy * module list and invoking that operation for each policy. */ #define MAC_PERFORM(operation, args...) do { \ struct mac_policy_conf *mpc; \ \ MAC_POLICY_LIST_BUSY(); \ LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { \ if (mpc->mpc_ops->mpo_ ## operation != NULL) \ mpc->mpc_ops->mpo_ ## operation (args); \ } \ MAC_POLICY_LIST_UNBUSY(); \ } while (0) /* * Initialize the MAC subsystem, including appropriate SMP locks. */ static void mac_init(void) { LIST_INIT(&mac_policy_list); MAC_POLICY_LIST_LOCKINIT(); } /* * For the purposes of modules that want to know if they were loaded * "early", set the mac_late flag once we've processed modules either * linked into the kernel, or loaded before the kernel startup. */ static void mac_late_init(void) { mac_late = 1; } /* * Allow MAC policy modules to register during boot, etc. */ int mac_policy_modevent(module_t mod, int type, void *data) { struct mac_policy_conf *mpc; int error; error = 0; mpc = (struct mac_policy_conf *) data; switch (type) { case MOD_LOAD: if (mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_NOTLATE && mac_late) { printf("mac_policy_modevent: can't load %s policy " "after booting\n", mpc->mpc_name); error = EBUSY; break; } error = mac_policy_register(mpc); break; case MOD_UNLOAD: /* Don't unregister the module if it was never registered. */ if ((mpc->mpc_runtime_flags & MPC_RUNTIME_FLAG_REGISTERED) != 0) error = mac_policy_unregister(mpc); else error = 0; break; default: break; } return (error); } static int mac_policy_register(struct mac_policy_conf *mpc) { struct mac_policy_conf *tmpc; struct mac_policy_op_entry *mpe; int slot; MALLOC(mpc->mpc_ops, struct mac_policy_ops *, sizeof(*mpc->mpc_ops), M_MACOPVEC, M_WAITOK | M_ZERO); for (mpe = mpc->mpc_entries; mpe->mpe_constant != MAC_OP_LAST; mpe++) { switch (mpe->mpe_constant) { case MAC_OP_LAST: /* * Doesn't actually happen, but this allows checking * that all enumerated values are handled. */ break; case MAC_DESTROY: mpc->mpc_ops->mpo_destroy = mpe->mpe_function; break; case MAC_INIT: mpc->mpc_ops->mpo_init = mpe->mpe_function; break; case MAC_SYSCALL: mpc->mpc_ops->mpo_syscall = mpe->mpe_function; break; case MAC_INIT_BPFDESC_LABEL: mpc->mpc_ops->mpo_init_bpfdesc_label = mpe->mpe_function; break; case MAC_INIT_CRED_LABEL: mpc->mpc_ops->mpo_init_cred_label = mpe->mpe_function; break; case MAC_INIT_DEVFSDIRENT_LABEL: mpc->mpc_ops->mpo_init_devfsdirent_label = mpe->mpe_function; break; case MAC_INIT_IFNET_LABEL: mpc->mpc_ops->mpo_init_ifnet_label = mpe->mpe_function; break; case MAC_INIT_IPQ_LABEL: mpc->mpc_ops->mpo_init_ipq_label = mpe->mpe_function; break; case MAC_INIT_MBUF_LABEL: mpc->mpc_ops->mpo_init_mbuf_label = mpe->mpe_function; break; case MAC_INIT_MOUNT_LABEL: mpc->mpc_ops->mpo_init_mount_label = mpe->mpe_function; break; case MAC_INIT_MOUNT_FS_LABEL: mpc->mpc_ops->mpo_init_mount_fs_label = mpe->mpe_function; break; case MAC_INIT_PIPE_LABEL: mpc->mpc_ops->mpo_init_pipe_label = mpe->mpe_function; break; case MAC_INIT_SOCKET_LABEL: mpc->mpc_ops->mpo_init_socket_label = mpe->mpe_function; break; case MAC_INIT_SOCKET_PEER_LABEL: mpc->mpc_ops->mpo_init_socket_peer_label = mpe->mpe_function; break; case MAC_INIT_TEMP_LABEL: mpc->mpc_ops->mpo_init_temp_label = mpe->mpe_function; break; case MAC_INIT_VNODE_LABEL: mpc->mpc_ops->mpo_init_vnode_label = mpe->mpe_function; break; case MAC_DESTROY_BPFDESC_LABEL: mpc->mpc_ops->mpo_destroy_bpfdesc_label = mpe->mpe_function; break; case MAC_DESTROY_CRED_LABEL: mpc->mpc_ops->mpo_destroy_cred_label = mpe->mpe_function; break; case MAC_DESTROY_DEVFSDIRENT_LABEL: mpc->mpc_ops->mpo_destroy_devfsdirent_label = mpe->mpe_function; break; case MAC_DESTROY_IFNET_LABEL: mpc->mpc_ops->mpo_destroy_ifnet_label = mpe->mpe_function; break; case MAC_DESTROY_IPQ_LABEL: mpc->mpc_ops->mpo_destroy_ipq_label = mpe->mpe_function; break; case MAC_DESTROY_MBUF_LABEL: mpc->mpc_ops->mpo_destroy_mbuf_label = mpe->mpe_function; break; case MAC_DESTROY_MOUNT_LABEL: mpc->mpc_ops->mpo_destroy_mount_label = mpe->mpe_function; break; case MAC_DESTROY_MOUNT_FS_LABEL: mpc->mpc_ops->mpo_destroy_mount_fs_label = mpe->mpe_function; break; case MAC_DESTROY_PIPE_LABEL: mpc->mpc_ops->mpo_destroy_pipe_label = mpe->mpe_function; break; case MAC_DESTROY_SOCKET_LABEL: mpc->mpc_ops->mpo_destroy_socket_label = mpe->mpe_function; break; case MAC_DESTROY_SOCKET_PEER_LABEL: mpc->mpc_ops->mpo_destroy_socket_peer_label = mpe->mpe_function; break; case MAC_DESTROY_TEMP_LABEL: mpc->mpc_ops->mpo_destroy_temp_label = mpe->mpe_function; break; case MAC_DESTROY_VNODE_LABEL: mpc->mpc_ops->mpo_destroy_vnode_label = mpe->mpe_function; break; case MAC_EXTERNALIZE: mpc->mpc_ops->mpo_externalize = mpe->mpe_function; break; case MAC_INTERNALIZE: mpc->mpc_ops->mpo_internalize = mpe->mpe_function; break; case MAC_CREATE_DEVFS_DEVICE: mpc->mpc_ops->mpo_create_devfs_device = mpe->mpe_function; break; case MAC_CREATE_DEVFS_DIRECTORY: mpc->mpc_ops->mpo_create_devfs_directory = mpe->mpe_function; break; case MAC_CREATE_DEVFS_VNODE: mpc->mpc_ops->mpo_create_devfs_vnode = mpe->mpe_function; break; case MAC_STDCREATEVNODE_EA: mpc->mpc_ops->mpo_stdcreatevnode_ea = mpe->mpe_function; break; case MAC_CREATE_VNODE: mpc->mpc_ops->mpo_create_vnode = mpe->mpe_function; break; case MAC_CREATE_MOUNT: mpc->mpc_ops->mpo_create_mount = mpe->mpe_function; break; case MAC_CREATE_ROOT_MOUNT: mpc->mpc_ops->mpo_create_root_mount = mpe->mpe_function; break; case MAC_RELABEL_VNODE: mpc->mpc_ops->mpo_relabel_vnode = mpe->mpe_function; break; case MAC_UPDATE_DEVFSDIRENT: mpc->mpc_ops->mpo_update_devfsdirent = mpe->mpe_function; break; case MAC_UPDATE_PROCFSVNODE: mpc->mpc_ops->mpo_update_procfsvnode = mpe->mpe_function; break; case MAC_UPDATE_VNODE_FROM_EXTATTR: mpc->mpc_ops->mpo_update_vnode_from_extattr = mpe->mpe_function; break; case MAC_UPDATE_VNODE_FROM_EXTERNALIZED: mpc->mpc_ops->mpo_update_vnode_from_externalized = mpe->mpe_function; break; case MAC_UPDATE_VNODE_FROM_MOUNT: mpc->mpc_ops->mpo_update_vnode_from_mount = mpe->mpe_function; break; case MAC_CREATE_MBUF_FROM_SOCKET: mpc->mpc_ops->mpo_create_mbuf_from_socket = mpe->mpe_function; break; case MAC_CREATE_PIPE: mpc->mpc_ops->mpo_create_pipe = mpe->mpe_function; break; case MAC_CREATE_SOCKET: mpc->mpc_ops->mpo_create_socket = mpe->mpe_function; break; case MAC_CREATE_SOCKET_FROM_SOCKET: mpc->mpc_ops->mpo_create_socket_from_socket = mpe->mpe_function; break; case MAC_RELABEL_PIPE: mpc->mpc_ops->mpo_relabel_pipe = mpe->mpe_function; break; case MAC_RELABEL_SOCKET: mpc->mpc_ops->mpo_relabel_socket = mpe->mpe_function; break; case MAC_SET_SOCKET_PEER_FROM_MBUF: mpc->mpc_ops->mpo_set_socket_peer_from_mbuf = mpe->mpe_function; break; case MAC_SET_SOCKET_PEER_FROM_SOCKET: mpc->mpc_ops->mpo_set_socket_peer_from_socket = mpe->mpe_function; break; case MAC_CREATE_BPFDESC: mpc->mpc_ops->mpo_create_bpfdesc = mpe->mpe_function; break; case MAC_CREATE_DATAGRAM_FROM_IPQ: mpc->mpc_ops->mpo_create_datagram_from_ipq = mpe->mpe_function; break; case MAC_CREATE_FRAGMENT: mpc->mpc_ops->mpo_create_fragment = mpe->mpe_function; break; case MAC_CREATE_IFNET: mpc->mpc_ops->mpo_create_ifnet = mpe->mpe_function; break; case MAC_CREATE_IPQ: mpc->mpc_ops->mpo_create_ipq = mpe->mpe_function; break; case MAC_CREATE_MBUF_FROM_MBUF: mpc->mpc_ops->mpo_create_mbuf_from_mbuf = mpe->mpe_function; break; case MAC_CREATE_MBUF_LINKLAYER: mpc->mpc_ops->mpo_create_mbuf_linklayer = mpe->mpe_function; break; case MAC_CREATE_MBUF_FROM_BPFDESC: mpc->mpc_ops->mpo_create_mbuf_from_bpfdesc = mpe->mpe_function; break; case MAC_CREATE_MBUF_FROM_IFNET: mpc->mpc_ops->mpo_create_mbuf_from_ifnet = mpe->mpe_function; break; case MAC_CREATE_MBUF_MULTICAST_ENCAP: mpc->mpc_ops->mpo_create_mbuf_multicast_encap = mpe->mpe_function; break; case MAC_CREATE_MBUF_NETLAYER: mpc->mpc_ops->mpo_create_mbuf_netlayer = mpe->mpe_function; break; case MAC_FRAGMENT_MATCH: mpc->mpc_ops->mpo_fragment_match = mpe->mpe_function; break; case MAC_RELABEL_IFNET: mpc->mpc_ops->mpo_relabel_ifnet = mpe->mpe_function; break; case MAC_UPDATE_IPQ: mpc->mpc_ops->mpo_update_ipq = mpe->mpe_function; break; case MAC_CREATE_CRED: mpc->mpc_ops->mpo_create_cred = mpe->mpe_function; break; case MAC_EXECVE_TRANSITION: mpc->mpc_ops->mpo_execve_transition = mpe->mpe_function; break; case MAC_EXECVE_WILL_TRANSITION: mpc->mpc_ops->mpo_execve_will_transition = mpe->mpe_function; break; case MAC_CREATE_PROC0: mpc->mpc_ops->mpo_create_proc0 = mpe->mpe_function; break; case MAC_CREATE_PROC1: mpc->mpc_ops->mpo_create_proc1 = mpe->mpe_function; break; case MAC_RELABEL_CRED: mpc->mpc_ops->mpo_relabel_cred = mpe->mpe_function; break; case MAC_THREAD_USERRET: mpc->mpc_ops->mpo_thread_userret = mpe->mpe_function; break; case MAC_CHECK_BPFDESC_RECEIVE: mpc->mpc_ops->mpo_check_bpfdesc_receive = mpe->mpe_function; break; case MAC_CHECK_CRED_RELABEL: mpc->mpc_ops->mpo_check_cred_relabel = mpe->mpe_function; break; case MAC_CHECK_CRED_VISIBLE: mpc->mpc_ops->mpo_check_cred_visible = mpe->mpe_function; break; case MAC_CHECK_IFNET_RELABEL: mpc->mpc_ops->mpo_check_ifnet_relabel = mpe->mpe_function; break; case MAC_CHECK_IFNET_TRANSMIT: mpc->mpc_ops->mpo_check_ifnet_transmit = mpe->mpe_function; break; case MAC_CHECK_MOUNT_STAT: mpc->mpc_ops->mpo_check_mount_stat = mpe->mpe_function; break; case MAC_CHECK_PIPE_IOCTL: mpc->mpc_ops->mpo_check_pipe_ioctl = mpe->mpe_function; break; case MAC_CHECK_PIPE_POLL: mpc->mpc_ops->mpo_check_pipe_poll = mpe->mpe_function; break; case MAC_CHECK_PIPE_READ: mpc->mpc_ops->mpo_check_pipe_read = mpe->mpe_function; break; case MAC_CHECK_PIPE_RELABEL: mpc->mpc_ops->mpo_check_pipe_relabel = mpe->mpe_function; break; case MAC_CHECK_PIPE_STAT: mpc->mpc_ops->mpo_check_pipe_stat = mpe->mpe_function; break; case MAC_CHECK_PIPE_WRITE: mpc->mpc_ops->mpo_check_pipe_write = mpe->mpe_function; break; case MAC_CHECK_PROC_DEBUG: mpc->mpc_ops->mpo_check_proc_debug = mpe->mpe_function; break; case MAC_CHECK_PROC_SCHED: mpc->mpc_ops->mpo_check_proc_sched = mpe->mpe_function; break; case MAC_CHECK_PROC_SIGNAL: mpc->mpc_ops->mpo_check_proc_signal = mpe->mpe_function; break; case MAC_CHECK_SOCKET_BIND: mpc->mpc_ops->mpo_check_socket_bind = mpe->mpe_function; break; case MAC_CHECK_SOCKET_CONNECT: mpc->mpc_ops->mpo_check_socket_connect = mpe->mpe_function; break; case MAC_CHECK_SOCKET_DELIVER: mpc->mpc_ops->mpo_check_socket_deliver = mpe->mpe_function; break; case MAC_CHECK_SOCKET_LISTEN: mpc->mpc_ops->mpo_check_socket_listen = mpe->mpe_function; break; case MAC_CHECK_SOCKET_RELABEL: mpc->mpc_ops->mpo_check_socket_relabel = mpe->mpe_function; break; case MAC_CHECK_SOCKET_VISIBLE: mpc->mpc_ops->mpo_check_socket_visible = mpe->mpe_function; break; case MAC_CHECK_VNODE_ACCESS: mpc->mpc_ops->mpo_check_vnode_access = mpe->mpe_function; break; case MAC_CHECK_VNODE_CHDIR: mpc->mpc_ops->mpo_check_vnode_chdir = mpe->mpe_function; break; case MAC_CHECK_VNODE_CHROOT: mpc->mpc_ops->mpo_check_vnode_chroot = mpe->mpe_function; break; case MAC_CHECK_VNODE_CREATE: mpc->mpc_ops->mpo_check_vnode_create = mpe->mpe_function; break; case MAC_CHECK_VNODE_DELETE: mpc->mpc_ops->mpo_check_vnode_delete = mpe->mpe_function; break; case MAC_CHECK_VNODE_DELETEACL: mpc->mpc_ops->mpo_check_vnode_deleteacl = mpe->mpe_function; break; case MAC_CHECK_VNODE_EXEC: mpc->mpc_ops->mpo_check_vnode_exec = mpe->mpe_function; break; case MAC_CHECK_VNODE_GETACL: mpc->mpc_ops->mpo_check_vnode_getacl = mpe->mpe_function; break; case MAC_CHECK_VNODE_GETEXTATTR: mpc->mpc_ops->mpo_check_vnode_getextattr = mpe->mpe_function; break; + case MAC_CHECK_VNODE_LINK: + mpc->mpc_ops->mpo_check_vnode_link = + mpe->mpe_function; + break; case MAC_CHECK_VNODE_LOOKUP: mpc->mpc_ops->mpo_check_vnode_lookup = mpe->mpe_function; break; case MAC_CHECK_VNODE_MMAP_PERMS: mpc->mpc_ops->mpo_check_vnode_mmap_perms = mpe->mpe_function; break; case MAC_CHECK_VNODE_OPEN: mpc->mpc_ops->mpo_check_vnode_open = mpe->mpe_function; break; case MAC_CHECK_VNODE_POLL: mpc->mpc_ops->mpo_check_vnode_poll = mpe->mpe_function; break; case MAC_CHECK_VNODE_READ: mpc->mpc_ops->mpo_check_vnode_read = mpe->mpe_function; break; case MAC_CHECK_VNODE_READDIR: mpc->mpc_ops->mpo_check_vnode_readdir = mpe->mpe_function; break; case MAC_CHECK_VNODE_READLINK: mpc->mpc_ops->mpo_check_vnode_readlink = mpe->mpe_function; break; case MAC_CHECK_VNODE_RELABEL: mpc->mpc_ops->mpo_check_vnode_relabel = mpe->mpe_function; break; case MAC_CHECK_VNODE_RENAME_FROM: mpc->mpc_ops->mpo_check_vnode_rename_from = mpe->mpe_function; break; case MAC_CHECK_VNODE_RENAME_TO: mpc->mpc_ops->mpo_check_vnode_rename_to = mpe->mpe_function; break; case MAC_CHECK_VNODE_REVOKE: mpc->mpc_ops->mpo_check_vnode_revoke = mpe->mpe_function; break; case MAC_CHECK_VNODE_SETACL: mpc->mpc_ops->mpo_check_vnode_setacl = mpe->mpe_function; break; case MAC_CHECK_VNODE_SETEXTATTR: mpc->mpc_ops->mpo_check_vnode_setextattr = mpe->mpe_function; break; case MAC_CHECK_VNODE_SETFLAGS: mpc->mpc_ops->mpo_check_vnode_setflags = mpe->mpe_function; break; case MAC_CHECK_VNODE_SETMODE: mpc->mpc_ops->mpo_check_vnode_setmode = mpe->mpe_function; break; case MAC_CHECK_VNODE_SETOWNER: mpc->mpc_ops->mpo_check_vnode_setowner = mpe->mpe_function; break; case MAC_CHECK_VNODE_SETUTIMES: mpc->mpc_ops->mpo_check_vnode_setutimes = mpe->mpe_function; break; case MAC_CHECK_VNODE_STAT: mpc->mpc_ops->mpo_check_vnode_stat = mpe->mpe_function; break; case MAC_CHECK_VNODE_WRITE: mpc->mpc_ops->mpo_check_vnode_write = mpe->mpe_function; break; /* default: printf("MAC policy `%s': unknown operation %d\n", mpc->mpc_name, mpe->mpe_constant); return (EINVAL); */ } } MAC_POLICY_LIST_LOCK(); if (mac_policy_list_busy > 0) { MAC_POLICY_LIST_UNLOCK(); FREE(mpc->mpc_ops, M_MACOPVEC); mpc->mpc_ops = NULL; return (EBUSY); } LIST_FOREACH(tmpc, &mac_policy_list, mpc_list) { if (strcmp(tmpc->mpc_name, mpc->mpc_name) == 0) { MAC_POLICY_LIST_UNLOCK(); FREE(mpc->mpc_ops, M_MACOPVEC); mpc->mpc_ops = NULL; return (EEXIST); } } if (mpc->mpc_field_off != NULL) { slot = ffs(mac_policy_offsets_free); if (slot == 0) { MAC_POLICY_LIST_UNLOCK(); FREE(mpc->mpc_ops, M_MACOPVEC); mpc->mpc_ops = NULL; return (ENOMEM); } slot--; mac_policy_offsets_free &= ~(1 << slot); *mpc->mpc_field_off = slot; } mpc->mpc_runtime_flags |= MPC_RUNTIME_FLAG_REGISTERED; LIST_INSERT_HEAD(&mac_policy_list, mpc, mpc_list); /* Per-policy initialization. */ if (mpc->mpc_ops->mpo_init != NULL) (*(mpc->mpc_ops->mpo_init))(mpc); MAC_POLICY_LIST_UNLOCK(); printf("Security policy loaded: %s (%s)\n", mpc->mpc_fullname, mpc->mpc_name); return (0); } static int mac_policy_unregister(struct mac_policy_conf *mpc) { /* * If we fail the load, we may get a request to unload. Check * to see if we did the run-time registration, and if not, * silently succeed. */ MAC_POLICY_LIST_LOCK(); if ((mpc->mpc_runtime_flags & MPC_RUNTIME_FLAG_REGISTERED) == 0) { MAC_POLICY_LIST_UNLOCK(); return (0); } #if 0 /* * Don't allow unloading modules with private data. */ if (mpc->mpc_field_off != NULL) { MAC_POLICY_LIST_UNLOCK(); return (EBUSY); } #endif /* * Only allow the unload to proceed if the module is unloadable * by its own definition. */ if ((mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_UNLOADOK) == 0) { MAC_POLICY_LIST_UNLOCK(); return (EBUSY); } /* * Right now, we EBUSY if the list is in use. In the future, * for reliability reasons, we might want to sleep and wakeup * later to try again. */ if (mac_policy_list_busy > 0) { MAC_POLICY_LIST_UNLOCK(); return (EBUSY); } if (mpc->mpc_ops->mpo_destroy != NULL) (*(mpc->mpc_ops->mpo_destroy))(mpc); LIST_REMOVE(mpc, mpc_list); MAC_POLICY_LIST_UNLOCK(); FREE(mpc->mpc_ops, M_MACOPVEC); mpc->mpc_ops = NULL; printf("Security policy unload: %s (%s)\n", mpc->mpc_fullname, mpc->mpc_name); return (0); } /* * Define an error value precedence, and given two arguments, selects the * value with the higher precedence. */ static int error_select(int error1, int error2) { /* Certain decision-making errors take top priority. */ if (error1 == EDEADLK || error2 == EDEADLK) return (EDEADLK); /* Invalid arguments should be reported where possible. */ if (error1 == EINVAL || error2 == EINVAL) return (EINVAL); /* Precedence goes to "visibility", with both process and file. */ if (error1 == ESRCH || error2 == ESRCH) return (ESRCH); if (error1 == ENOENT || error2 == ENOENT) return (ENOENT); /* Precedence goes to DAC/MAC protections. */ if (error1 == EACCES || error2 == EACCES) return (EACCES); /* Precedence goes to privilege. */ if (error1 == EPERM || error2 == EPERM) return (EPERM); /* Precedence goes to error over success; otherwise, arbitrary. */ if (error1 != 0) return (error1); return (error2); } static void mac_init_label(struct label *label) { bzero(label, sizeof(*label)); label->l_flags = MAC_FLAG_INITIALIZED; } static void mac_destroy_label(struct label *label) { KASSERT(label->l_flags & MAC_FLAG_INITIALIZED, ("destroying uninitialized label")); bzero(label, sizeof(*label)); /* implicit: label->l_flags &= ~MAC_FLAG_INITIALIZED; */ } static void mac_init_structmac(struct mac *mac) { bzero(mac, sizeof(*mac)); mac->m_macflags = MAC_FLAG_INITIALIZED; } void mac_init_bpfdesc(struct bpf_d *bpf_d) { mac_init_label(&bpf_d->bd_label); MAC_PERFORM(init_bpfdesc_label, &bpf_d->bd_label); #ifdef MAC_DEBUG atomic_add_int(&nmacbpfdescs, 1); #endif } void mac_init_cred(struct ucred *cr) { mac_init_label(&cr->cr_label); MAC_PERFORM(init_cred_label, &cr->cr_label); #ifdef MAC_DEBUG atomic_add_int(&nmaccreds, 1); #endif } void mac_init_devfsdirent(struct devfs_dirent *de) { mac_init_label(&de->de_label); MAC_PERFORM(init_devfsdirent_label, &de->de_label); #ifdef MAC_DEBUG atomic_add_int(&nmacdevfsdirents, 1); #endif } void mac_init_ifnet(struct ifnet *ifp) { mac_init_label(&ifp->if_label); MAC_PERFORM(init_ifnet_label, &ifp->if_label); #ifdef MAC_DEBUG atomic_add_int(&nmacifnets, 1); #endif } void mac_init_ipq(struct ipq *ipq) { mac_init_label(&ipq->ipq_label); MAC_PERFORM(init_ipq_label, &ipq->ipq_label); #ifdef MAC_DEBUG atomic_add_int(&nmacipqs, 1); #endif } int mac_init_mbuf(struct mbuf *m, int flag) { int error; KASSERT(m->m_flags & M_PKTHDR, ("mac_init_mbuf on non-header mbuf")); mac_init_label(&m->m_pkthdr.label); MAC_CHECK(init_mbuf_label, &m->m_pkthdr.label, flag); if (error) { MAC_PERFORM(destroy_mbuf_label, &m->m_pkthdr.label); mac_destroy_label(&m->m_pkthdr.label); } #ifdef MAC_DEBUG if (error == 0) atomic_add_int(&nmacmbufs, 1); #endif return (error); } void mac_init_mount(struct mount *mp) { mac_init_label(&mp->mnt_mntlabel); mac_init_label(&mp->mnt_fslabel); MAC_PERFORM(init_mount_label, &mp->mnt_mntlabel); MAC_PERFORM(init_mount_fs_label, &mp->mnt_fslabel); #ifdef MAC_DEBUG atomic_add_int(&nmacmounts, 1); #endif } void mac_init_pipe(struct pipe *pipe) { struct label *label; label = malloc(sizeof(struct label), M_MACPIPELABEL, M_ZERO|M_WAITOK); mac_init_label(label); pipe->pipe_label = label; pipe->pipe_peer->pipe_label = label; MAC_PERFORM(init_pipe_label, pipe->pipe_label); #ifdef MAC_DEBUG atomic_add_int(&nmacpipes, 1); #endif } void mac_init_socket(struct socket *socket) { mac_init_label(&socket->so_label); mac_init_label(&socket->so_peerlabel); MAC_PERFORM(init_socket_label, &socket->so_label); MAC_PERFORM(init_socket_peer_label, &socket->so_peerlabel); #ifdef MAC_DEBUG atomic_add_int(&nmacsockets, 1); #endif } static void mac_init_temp(struct label *label) { mac_init_label(label); MAC_PERFORM(init_temp_label, label); #ifdef MAC_DEBUG atomic_add_int(&nmactemp, 1); #endif } void mac_init_vnode(struct vnode *vp) { mac_init_label(&vp->v_label); MAC_PERFORM(init_vnode_label, &vp->v_label); #ifdef MAC_DEBUG atomic_add_int(&nmacvnodes, 1); #endif } void mac_destroy_bpfdesc(struct bpf_d *bpf_d) { MAC_PERFORM(destroy_bpfdesc_label, &bpf_d->bd_label); mac_destroy_label(&bpf_d->bd_label); #ifdef MAC_DEBUG atomic_subtract_int(&nmacbpfdescs, 1); #endif } void mac_destroy_cred(struct ucred *cr) { MAC_PERFORM(destroy_cred_label, &cr->cr_label); mac_destroy_label(&cr->cr_label); #ifdef MAC_DEBUG atomic_subtract_int(&nmaccreds, 1); #endif } void mac_destroy_devfsdirent(struct devfs_dirent *de) { MAC_PERFORM(destroy_devfsdirent_label, &de->de_label); mac_destroy_label(&de->de_label); #ifdef MAC_DEBUG atomic_subtract_int(&nmacdevfsdirents, 1); #endif } void mac_destroy_ifnet(struct ifnet *ifp) { MAC_PERFORM(destroy_ifnet_label, &ifp->if_label); mac_destroy_label(&ifp->if_label); #ifdef MAC_DEBUG atomic_subtract_int(&nmacifnets, 1); #endif } void mac_destroy_ipq(struct ipq *ipq) { MAC_PERFORM(destroy_ipq_label, &ipq->ipq_label); mac_destroy_label(&ipq->ipq_label); #ifdef MAC_DEBUG atomic_subtract_int(&nmacipqs, 1); #endif } void mac_destroy_mbuf(struct mbuf *m) { MAC_PERFORM(destroy_mbuf_label, &m->m_pkthdr.label); mac_destroy_label(&m->m_pkthdr.label); #ifdef MAC_DEBUG atomic_subtract_int(&nmacmbufs, 1); #endif } void mac_destroy_mount(struct mount *mp) { MAC_PERFORM(destroy_mount_label, &mp->mnt_mntlabel); MAC_PERFORM(destroy_mount_fs_label, &mp->mnt_fslabel); mac_destroy_label(&mp->mnt_fslabel); mac_destroy_label(&mp->mnt_mntlabel); #ifdef MAC_DEBUG atomic_subtract_int(&nmacmounts, 1); #endif } void mac_destroy_pipe(struct pipe *pipe) { MAC_PERFORM(destroy_pipe_label, pipe->pipe_label); mac_destroy_label(pipe->pipe_label); free(pipe->pipe_label, M_MACPIPELABEL); #ifdef MAC_DEBUG atomic_subtract_int(&nmacpipes, 1); #endif } void mac_destroy_socket(struct socket *socket) { MAC_PERFORM(destroy_socket_label, &socket->so_label); MAC_PERFORM(destroy_socket_peer_label, &socket->so_peerlabel); mac_destroy_label(&socket->so_label); mac_destroy_label(&socket->so_peerlabel); #ifdef MAC_DEBUG atomic_subtract_int(&nmacsockets, 1); #endif } static void mac_destroy_temp(struct label *label) { MAC_PERFORM(destroy_temp_label, label); mac_destroy_label(label); #ifdef MAC_DEBUG atomic_subtract_int(&nmactemp, 1); #endif } void mac_destroy_vnode(struct vnode *vp) { MAC_PERFORM(destroy_vnode_label, &vp->v_label); mac_destroy_label(&vp->v_label); #ifdef MAC_DEBUG atomic_subtract_int(&nmacvnodes, 1); #endif } static int mac_externalize(struct label *label, struct mac *mac) { int error; mac_init_structmac(mac); MAC_CHECK(externalize, label, mac); return (error); } static int mac_internalize(struct label *label, struct mac *mac) { int error; mac_init_temp(label); MAC_CHECK(internalize, label, mac); if (error) mac_destroy_temp(label); return (error); } /* * Initialize MAC label for the first kernel process, from which other * kernel processes and threads are spawned. */ void mac_create_proc0(struct ucred *cred) { MAC_PERFORM(create_proc0, cred); } /* * Initialize MAC label for the first userland process, from which other * userland processes and threads are spawned. */ void mac_create_proc1(struct ucred *cred) { MAC_PERFORM(create_proc1, cred); } void mac_thread_userret(struct thread *td) { MAC_PERFORM(thread_userret, td); } /* * When a new process is created, its label must be initialized. Generally, * this involves inheritence from the parent process, modulo possible * deltas. This function allows that processing to take place. */ void mac_create_cred(struct ucred *parent_cred, struct ucred *child_cred) { MAC_PERFORM(create_cred, parent_cred, child_cred); } void mac_update_devfsdirent(struct devfs_dirent *de, struct vnode *vp) { MAC_PERFORM(update_devfsdirent, de, &de->de_label, vp, &vp->v_label); } void mac_update_procfsvnode(struct vnode *vp, struct ucred *cred) { MAC_PERFORM(update_procfsvnode, vp, &vp->v_label, cred); } /* * Support callout for policies that manage their own externalization * using extended attributes. */ static int mac_update_vnode_from_extattr(struct vnode *vp, struct mount *mp) { int error; MAC_CHECK(update_vnode_from_extattr, vp, &vp->v_label, mp, &mp->mnt_fslabel); return (error); } /* * Given an externalized mac label, internalize it and stamp it on a * vnode. */ static int mac_update_vnode_from_externalized(struct vnode *vp, struct mac *extmac) { int error; MAC_CHECK(update_vnode_from_externalized, vp, &vp->v_label, extmac); return (error); } /* * Call out to individual policies to update the label in a vnode from * the mountpoint. */ void mac_update_vnode_from_mount(struct vnode *vp, struct mount *mp) { MAC_PERFORM(update_vnode_from_mount, vp, &vp->v_label, mp, &mp->mnt_fslabel); ASSERT_VOP_LOCKED(vp, "mac_update_vnode_from_mount"); if (mac_cache_fslabel_in_vnode) vp->v_vflag |= VV_CACHEDLABEL; } /* * Implementation of VOP_REFRESHLABEL() that relies on extended attributes * to store label data. Can be referenced by filesystems supporting * extended attributes. */ int vop_stdrefreshlabel_ea(struct vop_refreshlabel_args *ap) { struct vnode *vp = ap->a_vp; struct mac extmac; int buflen, error; ASSERT_VOP_LOCKED(vp, "vop_stdrefreshlabel_ea"); /* * Call out to external policies first. Order doesn't really * matter, as long as failure of one assures failure of all. */ error = mac_update_vnode_from_extattr(vp, vp->v_mount); if (error) return (error); buflen = sizeof(extmac); error = vn_extattr_get(vp, IO_NODELOCKED, FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME, &buflen, (char *)&extmac, curthread); switch (error) { case 0: /* Got it */ break; case ENOATTR: /* * Use the label from the mount point. */ mac_update_vnode_from_mount(vp, vp->v_mount); return (0); case EOPNOTSUPP: default: /* Fail horribly. */ return (error); } if (buflen != sizeof(extmac)) error = EPERM; /* Fail very closed. */ if (error == 0) error = mac_update_vnode_from_externalized(vp, &extmac); if (error == 0) vp->v_vflag |= VV_CACHEDLABEL; else { struct vattr va; printf("Corrupted label on %s", vp->v_mount->mnt_stat.f_mntonname); if (VOP_GETATTR(vp, &va, curthread->td_ucred, curthread) == 0) printf(" inum %ld", va.va_fileid); #ifdef MAC_DEBUG if (mac_debug_label_fallback) { printf(", falling back.\n"); mac_update_vnode_from_mount(vp, vp->v_mount); error = 0; } else { #endif printf(".\n"); error = EPERM; #ifdef MAC_DEBUG } #endif } return (error); } /* * Make sure the vnode label is up-to-date. If EOPNOTSUPP, then we handle * the labeling activity outselves. Filesystems should be careful not * to change their minds regarding whether they support vop_refreshlabel() * for a vnode or not. Don't cache the vnode here, allow the file * system code to determine if it's safe to cache. If we update from * the mount, don't cache since a change to the mount label should affect * all vnodes. */ static int vn_refreshlabel(struct vnode *vp, struct ucred *cred) { int error; ASSERT_VOP_LOCKED(vp, "vn_refreshlabel"); if (vp->v_mount == NULL) { /* Eventually, we probably want to special-case refreshing of deadfs vnodes, and if there's a lock-free race somewhere, that case might be handled here. mac_update_vnode_deadfs(vp); return (0); */ /* printf("vn_refreshlabel: null v_mount\n"); */ if (vp->v_type != VNON) printf( "vn_refreshlabel: null v_mount with non-VNON\n"); return (EBADF); } if (vp->v_vflag & VV_CACHEDLABEL) { mac_vnode_label_cache_hits++; return (0); } else mac_vnode_label_cache_misses++; if ((vp->v_mount->mnt_flag & MNT_MULTILABEL) == 0) { mac_update_vnode_from_mount(vp, vp->v_mount); return (0); } error = VOP_REFRESHLABEL(vp, cred, curthread); switch (error) { case EOPNOTSUPP: /* * If labels are not supported on this vnode, fall back to * the label in the mount and propagate it to the vnode. * There should probably be some sort of policy/flag/decision * about doing this. */ mac_update_vnode_from_mount(vp, vp->v_mount); error = 0; default: return (error); } } /* * Helper function for file systems using the vop_std*_ea() calls. This * function must be called after EA service is available for the vnode, * but before it's hooked up to the namespace so that the node persists * if there's a crash, or before it can be accessed. On successful * commit of the label to disk (etc), do cache the label. */ int vop_stdcreatevnode_ea(struct vnode *dvp, struct vnode *tvp, struct ucred *cred) { struct mac extmac; int error; ASSERT_VOP_LOCKED(tvp, "vop_stdcreatevnode_ea"); if ((dvp->v_mount->mnt_flag & MNT_MULTILABEL) == 0) { mac_update_vnode_from_mount(tvp, tvp->v_mount); } else { error = vn_refreshlabel(dvp, cred); if (error) return (error); /* * Stick the label in the vnode. Then try to write to * disk. If we fail, return a failure to abort the * create operation. Really, this failure shouldn't * happen except in fairly unusual circumstances (out * of disk, etc). */ mac_create_vnode(cred, dvp, tvp); error = mac_stdcreatevnode_ea(tvp); if (error) return (error); /* * XXX: Eventually this will go away and all policies will * directly manage their extended attributes. */ error = mac_externalize(&tvp->v_label, &extmac); if (error) return (error); error = vn_extattr_set(tvp, IO_NODELOCKED, FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME, sizeof(extmac), (char *)&extmac, curthread); if (error == 0) tvp->v_vflag |= VV_CACHEDLABEL; else { #if 0 /* * In theory, we could have fall-back behavior here. * It would probably be incorrect. */ #endif return (error); } } return (0); } void mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_execve_transition"); error = vn_refreshlabel(vp, old); if (error) { printf("mac_execve_transition: vn_refreshlabel returned %d\n", error); printf("mac_execve_transition: using old vnode label\n"); } MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label); } int mac_execve_will_transition(struct ucred *old, struct vnode *vp) { int error, result; error = vn_refreshlabel(vp, old); if (error) return (error); result = 0; MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label); return (result); } int mac_check_vnode_access(struct ucred *cred, struct vnode *vp, int flags) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_access"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_access, cred, vp, &vp->v_label, flags); return (error); } int mac_check_vnode_chdir(struct ucred *cred, struct vnode *dvp) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_chdir"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); MAC_CHECK(check_vnode_chdir, cred, dvp, &dvp->v_label); return (error); } int mac_check_vnode_chroot(struct ucred *cred, struct vnode *dvp) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_chroot"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); MAC_CHECK(check_vnode_chroot, cred, dvp, &dvp->v_label); return (error); } int mac_check_vnode_create(struct ucred *cred, struct vnode *dvp, struct componentname *cnp, struct vattr *vap) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_create"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); MAC_CHECK(check_vnode_create, cred, dvp, &dvp->v_label, cnp, vap); return (error); } int mac_check_vnode_delete(struct ucred *cred, struct vnode *dvp, struct vnode *vp, struct componentname *cnp) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_delete"); ASSERT_VOP_LOCKED(vp, "mac_check_vnode_delete"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_delete, cred, dvp, &dvp->v_label, vp, &vp->v_label, cnp); return (error); } int mac_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp, acl_type_t type) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_deleteacl"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_deleteacl, cred, vp, &vp->v_label, type); return (error); } int mac_check_vnode_exec(struct ucred *cred, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_exec"); if (!mac_enforce_process && !mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label); return (error); } int mac_check_vnode_getacl(struct ucred *cred, struct vnode *vp, acl_type_t type) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_getacl"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_getacl, cred, vp, &vp->v_label, type); return (error); } int mac_check_vnode_getextattr(struct ucred *cred, struct vnode *vp, int attrnamespace, const char *name, struct uio *uio) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_getextattr"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_getextattr, cred, vp, &vp->v_label, attrnamespace, name, uio); + return (error); +} + +int +mac_check_vnode_link(struct ucred *cred, struct vnode *dvp, + struct vnode *vp, struct componentname *cnp) +{ + + int error; + + ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_link"); + ASSERT_VOP_LOCKED(vp, "mac_check_vnode_link"); + + if (!mac_enforce_fs) + return (0); + + error = vn_refreshlabel(dvp, cred); + if (error) + return (error); + + error = vn_refreshlabel(vp, cred); + if (error) + return (error); + + MAC_CHECK(check_vnode_link, cred, dvp, &dvp->v_label, vp, + &vp->v_label, cnp); return (error); } int mac_check_vnode_lookup(struct ucred *cred, struct vnode *dvp, struct componentname *cnp) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_lookup"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); MAC_CHECK(check_vnode_lookup, cred, dvp, &dvp->v_label, cnp); return (error); } vm_prot_t mac_check_vnode_mmap_prot(struct ucred *cred, struct vnode *vp, int newmapping) { vm_prot_t result = VM_PROT_ALL; if (!mac_enforce_vm) return (result); /* * This should be some sort of MAC_BITWISE, maybe :) */ ASSERT_VOP_LOCKED(vp, "mac_check_vnode_mmap_perms"); MAC_BOOLEAN(check_vnode_mmap_perms, &, cred, vp, &vp->v_label, newmapping); return (result); } int mac_check_vnode_open(struct ucred *cred, struct vnode *vp, mode_t acc_mode) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_open"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_open, cred, vp, &vp->v_label, acc_mode); return (error); } int mac_check_vnode_poll(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_poll"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, active_cred); if (error) return (error); MAC_CHECK(check_vnode_poll, active_cred, file_cred, vp, &vp->v_label); return (error); } int mac_check_vnode_read(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_read"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, active_cred); if (error) return (error); MAC_CHECK(check_vnode_read, active_cred, file_cred, vp, &vp->v_label); return (error); } int mac_check_vnode_readdir(struct ucred *cred, struct vnode *dvp) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_readdir"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); MAC_CHECK(check_vnode_readdir, cred, dvp, &dvp->v_label); return (error); } int mac_check_vnode_readlink(struct ucred *cred, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_readlink"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_readlink, cred, vp, &vp->v_label); return (error); } static int mac_check_vnode_relabel(struct ucred *cred, struct vnode *vp, struct label *newlabel) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_relabel"); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_relabel, cred, vp, &vp->v_label, newlabel); return (error); } int mac_check_vnode_rename_from(struct ucred *cred, struct vnode *dvp, struct vnode *vp, struct componentname *cnp) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_rename_from"); ASSERT_VOP_LOCKED(vp, "mac_check_vnode_rename_from"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_rename_from, cred, dvp, &dvp->v_label, vp, &vp->v_label, cnp); return (error); } int mac_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp, struct vnode *vp, int samedir, struct componentname *cnp) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_rename_to"); ASSERT_VOP_LOCKED(vp, "mac_check_vnode_rename_to"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); if (vp != NULL) { error = vn_refreshlabel(vp, cred); if (error) return (error); } MAC_CHECK(check_vnode_rename_to, cred, dvp, &dvp->v_label, vp, vp != NULL ? &vp->v_label : NULL, samedir, cnp); return (error); } int mac_check_vnode_revoke(struct ucred *cred, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_revoke"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_revoke, cred, vp, &vp->v_label); return (error); } int mac_check_vnode_setacl(struct ucred *cred, struct vnode *vp, acl_type_t type, struct acl *acl) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setacl"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_setacl, cred, vp, &vp->v_label, type, acl); return (error); } int mac_check_vnode_setextattr(struct ucred *cred, struct vnode *vp, int attrnamespace, const char *name, struct uio *uio) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setextattr"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_setextattr, cred, vp, &vp->v_label, attrnamespace, name, uio); return (error); } int mac_check_vnode_setflags(struct ucred *cred, struct vnode *vp, u_long flags) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setflags"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_setflags, cred, vp, &vp->v_label, flags); return (error); } int mac_check_vnode_setmode(struct ucred *cred, struct vnode *vp, mode_t mode) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setmode"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_setmode, cred, vp, &vp->v_label, mode); return (error); } int mac_check_vnode_setowner(struct ucred *cred, struct vnode *vp, uid_t uid, gid_t gid) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setowner"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_setowner, cred, vp, &vp->v_label, uid, gid); return (error); } int mac_check_vnode_setutimes(struct ucred *cred, struct vnode *vp, struct timespec atime, struct timespec mtime) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setutimes"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_setutimes, cred, vp, &vp->v_label, atime, mtime); return (error); } int mac_check_vnode_stat(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_stat"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, active_cred); if (error) return (error); MAC_CHECK(check_vnode_stat, active_cred, file_cred, vp, &vp->v_label); return (error); } int mac_check_vnode_write(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_write"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, active_cred); if (error) return (error); MAC_CHECK(check_vnode_write, active_cred, file_cred, vp, &vp->v_label); return (error); } /* * When relabeling a process, call out to the policies for the maximum * permission allowed for each object type we know about in its * memory space, and revoke access (in the least surprising ways we * know) when necessary. The process lock is not held here. */ static void mac_cred_mmapped_drop_perms(struct thread *td, struct ucred *cred) { /* XXX freeze all other threads */ mac_cred_mmapped_drop_perms_recurse(td, cred, &td->td_proc->p_vmspace->vm_map); /* XXX allow other threads to continue */ } static __inline const char * prot2str(vm_prot_t prot) { switch (prot & VM_PROT_ALL) { case VM_PROT_READ: return ("r--"); case VM_PROT_READ | VM_PROT_WRITE: return ("rw-"); case VM_PROT_READ | VM_PROT_EXECUTE: return ("r-x"); case VM_PROT_READ | VM_PROT_WRITE | VM_PROT_EXECUTE: return ("rwx"); case VM_PROT_WRITE: return ("-w-"); case VM_PROT_EXECUTE: return ("--x"); case VM_PROT_WRITE | VM_PROT_EXECUTE: return ("-wx"); default: return ("---"); } } static void mac_cred_mmapped_drop_perms_recurse(struct thread *td, struct ucred *cred, struct vm_map *map) { struct vm_map_entry *vme; vm_prot_t result, revokeperms; vm_object_t object; vm_ooffset_t offset; struct vnode *vp; if (!mac_mmap_revocation) return; vm_map_lock_read(map); for (vme = map->header.next; vme != &map->header; vme = vme->next) { if (vme->eflags & MAP_ENTRY_IS_SUB_MAP) { mac_cred_mmapped_drop_perms_recurse(td, cred, vme->object.sub_map); continue; } /* * Skip over entries that obviously are not shared. */ if (vme->eflags & (MAP_ENTRY_COW | MAP_ENTRY_NOSYNC) || !vme->max_protection) continue; /* * Drill down to the deepest backing object. */ offset = vme->offset; object = vme->object.vm_object; if (object == NULL) continue; while (object->backing_object != NULL) { object = object->backing_object; offset += object->backing_object_offset; } /* * At the moment, vm_maps and objects aren't considered * by the MAC system, so only things with backing by a * normal object (read: vnodes) are checked. */ if (object->type != OBJT_VNODE) continue; vp = (struct vnode *)object->handle; vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); result = mac_check_vnode_mmap_prot(cred, vp, 0); VOP_UNLOCK(vp, 0, td); /* * Find out what maximum protection we may be allowing * now but a policy needs to get removed. */ revokeperms = vme->max_protection & ~result; if (!revokeperms) continue; printf("pid %ld: revoking %s perms from %#lx:%ld " "(max %s/cur %s)\n", (long)td->td_proc->p_pid, prot2str(revokeperms), (u_long)vme->start, (long)(vme->end - vme->start), prot2str(vme->max_protection), prot2str(vme->protection)); vm_map_lock_upgrade(map); /* * This is the really simple case: if a map has more * max_protection than is allowed, but it's not being * actually used (that is, the current protection is * still allowed), we can just wipe it out and do * nothing more. */ if ((vme->protection & revokeperms) == 0) { vme->max_protection -= revokeperms; } else { if (revokeperms & VM_PROT_WRITE) { /* * In the more complicated case, flush out all * pending changes to the object then turn it * copy-on-write. */ vm_object_reference(object); vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); vm_object_page_clean(object, OFF_TO_IDX(offset), OFF_TO_IDX(offset + vme->end - vme->start + PAGE_MASK), OBJPC_SYNC); VOP_UNLOCK(vp, 0, td); vm_object_deallocate(object); /* * Why bother if there's no read permissions * anymore? For the rest, we need to leave * the write permissions on for COW, or * remove them entirely if configured to. */ if (!mac_mmap_revocation_via_cow) { vme->max_protection &= ~VM_PROT_WRITE; vme->protection &= ~VM_PROT_WRITE; } if ((revokeperms & VM_PROT_READ) == 0) vme->eflags |= MAP_ENTRY_COW | MAP_ENTRY_NEEDS_COPY; } if (revokeperms & VM_PROT_EXECUTE) { vme->max_protection &= ~VM_PROT_EXECUTE; vme->protection &= ~VM_PROT_EXECUTE; } if (revokeperms & VM_PROT_READ) { vme->max_protection = 0; vme->protection = 0; } pmap_protect(map->pmap, vme->start, vme->end, vme->protection & ~revokeperms); vm_map_simplify_entry(map, vme); } vm_map_lock_downgrade(map); } vm_map_unlock_read(map); } /* * When the subject's label changes, it may require revocation of privilege * to mapped objects. This can't be done on-the-fly later with a unified * buffer cache. */ static void mac_relabel_cred(struct ucred *cred, struct label *newlabel) { MAC_PERFORM(relabel_cred, cred, newlabel); } void mac_relabel_vnode(struct ucred *cred, struct vnode *vp, struct label *newlabel) { MAC_PERFORM(relabel_vnode, cred, vp, &vp->v_label, newlabel); } void mac_create_ifnet(struct ifnet *ifnet) { MAC_PERFORM(create_ifnet, ifnet, &ifnet->if_label); } void mac_create_bpfdesc(struct ucred *cred, struct bpf_d *bpf_d) { MAC_PERFORM(create_bpfdesc, cred, bpf_d, &bpf_d->bd_label); } void mac_create_socket(struct ucred *cred, struct socket *socket) { MAC_PERFORM(create_socket, cred, socket, &socket->so_label); } void mac_create_pipe(struct ucred *cred, struct pipe *pipe) { MAC_PERFORM(create_pipe, cred, pipe, pipe->pipe_label); } void mac_create_socket_from_socket(struct socket *oldsocket, struct socket *newsocket) { MAC_PERFORM(create_socket_from_socket, oldsocket, &oldsocket->so_label, newsocket, &newsocket->so_label); } static void mac_relabel_socket(struct ucred *cred, struct socket *socket, struct label *newlabel) { MAC_PERFORM(relabel_socket, cred, socket, &socket->so_label, newlabel); } static void mac_relabel_pipe(struct ucred *cred, struct pipe *pipe, struct label *newlabel) { MAC_PERFORM(relabel_pipe, cred, pipe, pipe->pipe_label, newlabel); } void mac_set_socket_peer_from_mbuf(struct mbuf *mbuf, struct socket *socket) { MAC_PERFORM(set_socket_peer_from_mbuf, mbuf, &mbuf->m_pkthdr.label, socket, &socket->so_peerlabel); } void mac_set_socket_peer_from_socket(struct socket *oldsocket, struct socket *newsocket) { MAC_PERFORM(set_socket_peer_from_socket, oldsocket, &oldsocket->so_label, newsocket, &newsocket->so_peerlabel); } void mac_create_datagram_from_ipq(struct ipq *ipq, struct mbuf *datagram) { MAC_PERFORM(create_datagram_from_ipq, ipq, &ipq->ipq_label, datagram, &datagram->m_pkthdr.label); } void mac_create_fragment(struct mbuf *datagram, struct mbuf *fragment) { MAC_PERFORM(create_fragment, datagram, &datagram->m_pkthdr.label, fragment, &fragment->m_pkthdr.label); } void mac_create_ipq(struct mbuf *fragment, struct ipq *ipq) { MAC_PERFORM(create_ipq, fragment, &fragment->m_pkthdr.label, ipq, &ipq->ipq_label); } void mac_create_mbuf_from_mbuf(struct mbuf *oldmbuf, struct mbuf *newmbuf) { MAC_PERFORM(create_mbuf_from_mbuf, oldmbuf, &oldmbuf->m_pkthdr.label, newmbuf, &newmbuf->m_pkthdr.label); } void mac_create_mbuf_from_bpfdesc(struct bpf_d *bpf_d, struct mbuf *mbuf) { MAC_PERFORM(create_mbuf_from_bpfdesc, bpf_d, &bpf_d->bd_label, mbuf, &mbuf->m_pkthdr.label); } void mac_create_mbuf_linklayer(struct ifnet *ifnet, struct mbuf *mbuf) { MAC_PERFORM(create_mbuf_linklayer, ifnet, &ifnet->if_label, mbuf, &mbuf->m_pkthdr.label); } void mac_create_mbuf_from_ifnet(struct ifnet *ifnet, struct mbuf *mbuf) { MAC_PERFORM(create_mbuf_from_ifnet, ifnet, &ifnet->if_label, mbuf, &mbuf->m_pkthdr.label); } void mac_create_mbuf_multicast_encap(struct mbuf *oldmbuf, struct ifnet *ifnet, struct mbuf *newmbuf) { MAC_PERFORM(create_mbuf_multicast_encap, oldmbuf, &oldmbuf->m_pkthdr.label, ifnet, &ifnet->if_label, newmbuf, &newmbuf->m_pkthdr.label); } void mac_create_mbuf_netlayer(struct mbuf *oldmbuf, struct mbuf *newmbuf) { MAC_PERFORM(create_mbuf_netlayer, oldmbuf, &oldmbuf->m_pkthdr.label, newmbuf, &newmbuf->m_pkthdr.label); } int mac_fragment_match(struct mbuf *fragment, struct ipq *ipq) { int result; result = 1; MAC_BOOLEAN(fragment_match, &&, fragment, &fragment->m_pkthdr.label, ipq, &ipq->ipq_label); return (result); } void mac_update_ipq(struct mbuf *fragment, struct ipq *ipq) { MAC_PERFORM(update_ipq, fragment, &fragment->m_pkthdr.label, ipq, &ipq->ipq_label); } void mac_create_mbuf_from_socket(struct socket *socket, struct mbuf *mbuf) { MAC_PERFORM(create_mbuf_from_socket, socket, &socket->so_label, mbuf, &mbuf->m_pkthdr.label); } void mac_create_mount(struct ucred *cred, struct mount *mp) { MAC_PERFORM(create_mount, cred, mp, &mp->mnt_mntlabel, &mp->mnt_fslabel); } void mac_create_root_mount(struct ucred *cred, struct mount *mp) { MAC_PERFORM(create_root_mount, cred, mp, &mp->mnt_mntlabel, &mp->mnt_fslabel); } int mac_check_bpfdesc_receive(struct bpf_d *bpf_d, struct ifnet *ifnet) { int error; if (!mac_enforce_network) return (0); MAC_CHECK(check_bpfdesc_receive, bpf_d, &bpf_d->bd_label, ifnet, &ifnet->if_label); return (error); } static int mac_check_cred_relabel(struct ucred *cred, struct label *newlabel) { int error; MAC_CHECK(check_cred_relabel, cred, newlabel); return (error); } int mac_check_cred_visible(struct ucred *u1, struct ucred *u2) { int error; if (!mac_enforce_process) return (0); MAC_CHECK(check_cred_visible, u1, u2); return (error); } int mac_check_ifnet_transmit(struct ifnet *ifnet, struct mbuf *mbuf) { int error; if (!mac_enforce_network) return (0); KASSERT(mbuf->m_flags & M_PKTHDR, ("packet has no pkthdr")); if (!(mbuf->m_pkthdr.label.l_flags & MAC_FLAG_INITIALIZED)) printf("%s%d: not initialized\n", ifnet->if_name, ifnet->if_unit); MAC_CHECK(check_ifnet_transmit, ifnet, &ifnet->if_label, mbuf, &mbuf->m_pkthdr.label); return (error); } int mac_check_mount_stat(struct ucred *cred, struct mount *mount) { int error; if (!mac_enforce_fs) return (0); MAC_CHECK(check_mount_stat, cred, mount, &mount->mnt_mntlabel); return (error); } int mac_check_pipe_ioctl(struct ucred *cred, struct pipe *pipe, unsigned long cmd, void *data) { int error; PIPE_LOCK_ASSERT(pipe, MA_OWNED); if (!mac_enforce_pipe) return (0); MAC_CHECK(check_pipe_ioctl, cred, pipe, pipe->pipe_label, cmd, data); return (error); } int mac_check_pipe_poll(struct ucred *cred, struct pipe *pipe) { int error; PIPE_LOCK_ASSERT(pipe, MA_OWNED); if (!mac_enforce_pipe) return (0); MAC_CHECK(check_pipe_poll, cred, pipe, pipe->pipe_label); return (error); } int mac_check_pipe_read(struct ucred *cred, struct pipe *pipe) { int error; PIPE_LOCK_ASSERT(pipe, MA_OWNED); if (!mac_enforce_pipe) return (0); MAC_CHECK(check_pipe_read, cred, pipe, pipe->pipe_label); return (error); } static int mac_check_pipe_relabel(struct ucred *cred, struct pipe *pipe, struct label *newlabel) { int error; PIPE_LOCK_ASSERT(pipe, MA_OWNED); if (!mac_enforce_pipe) return (0); MAC_CHECK(check_pipe_relabel, cred, pipe, pipe->pipe_label, newlabel); return (error); } int mac_check_pipe_stat(struct ucred *cred, struct pipe *pipe) { int error; PIPE_LOCK_ASSERT(pipe, MA_OWNED); if (!mac_enforce_pipe) return (0); MAC_CHECK(check_pipe_stat, cred, pipe, pipe->pipe_label); return (error); } int mac_check_pipe_write(struct ucred *cred, struct pipe *pipe) { int error; PIPE_LOCK_ASSERT(pipe, MA_OWNED); if (!mac_enforce_pipe) return (0); MAC_CHECK(check_pipe_write, cred, pipe, pipe->pipe_label); return (error); } int mac_check_proc_debug(struct ucred *cred, struct proc *proc) { int error; PROC_LOCK_ASSERT(proc, MA_OWNED); if (!mac_enforce_process) return (0); MAC_CHECK(check_proc_debug, cred, proc); return (error); } int mac_check_proc_sched(struct ucred *cred, struct proc *proc) { int error; PROC_LOCK_ASSERT(proc, MA_OWNED); if (!mac_enforce_process) return (0); MAC_CHECK(check_proc_sched, cred, proc); return (error); } int mac_check_proc_signal(struct ucred *cred, struct proc *proc, int signum) { int error; PROC_LOCK_ASSERT(proc, MA_OWNED); if (!mac_enforce_process) return (0); MAC_CHECK(check_proc_signal, cred, proc, signum); return (error); } int mac_check_socket_bind(struct ucred *ucred, struct socket *socket, struct sockaddr *sockaddr) { int error; if (!mac_enforce_socket) return (0); MAC_CHECK(check_socket_bind, ucred, socket, &socket->so_label, sockaddr); return (error); } int mac_check_socket_connect(struct ucred *cred, struct socket *socket, struct sockaddr *sockaddr) { int error; if (!mac_enforce_socket) return (0); MAC_CHECK(check_socket_connect, cred, socket, &socket->so_label, sockaddr); return (error); } int mac_check_socket_deliver(struct socket *socket, struct mbuf *mbuf) { int error; if (!mac_enforce_socket) return (0); MAC_CHECK(check_socket_deliver, socket, &socket->so_label, mbuf, &mbuf->m_pkthdr.label); return (error); } int mac_check_socket_listen(struct ucred *cred, struct socket *socket) { int error; if (!mac_enforce_socket) return (0); MAC_CHECK(check_socket_listen, cred, socket, &socket->so_label); return (error); } static int mac_check_socket_relabel(struct ucred *cred, struct socket *socket, struct label *newlabel) { int error; MAC_CHECK(check_socket_relabel, cred, socket, &socket->so_label, newlabel); return (error); } int mac_check_socket_visible(struct ucred *cred, struct socket *socket) { int error; if (!mac_enforce_socket) return (0); MAC_CHECK(check_socket_visible, cred, socket, &socket->so_label); return (error); } int mac_ioctl_ifnet_get(struct ucred *cred, struct ifreq *ifr, struct ifnet *ifnet) { struct mac label; int error; error = mac_externalize(&ifnet->if_label, &label); if (error) return (error); return (copyout(&label, ifr->ifr_ifru.ifru_data, sizeof(label))); } int mac_ioctl_ifnet_set(struct ucred *cred, struct ifreq *ifr, struct ifnet *ifnet) { struct mac newlabel; struct label intlabel; int error; error = copyin(ifr->ifr_ifru.ifru_data, &newlabel, sizeof(newlabel)); if (error) return (error); error = mac_internalize(&intlabel, &newlabel); if (error) return (error); /* * XXX: Note that this is a redundant privilege check, since * policies impose this check themselves if required by the * policy. Eventually, this should go away. */ error = suser_cred(cred, 0); if (error) goto out; MAC_CHECK(check_ifnet_relabel, cred, ifnet, &ifnet->if_label, &intlabel); if (error) goto out; MAC_PERFORM(relabel_ifnet, cred, ifnet, &ifnet->if_label, &intlabel); out: mac_destroy_temp(&intlabel); return (error); } void mac_create_devfs_vnode(struct devfs_dirent *de, struct vnode *vp) { MAC_PERFORM(create_devfs_vnode, de, &de->de_label, vp, &vp->v_label); } void mac_create_devfs_device(dev_t dev, struct devfs_dirent *de) { MAC_PERFORM(create_devfs_device, dev, de, &de->de_label); } static int mac_stdcreatevnode_ea(struct vnode *vp) { int error; MAC_CHECK(stdcreatevnode_ea, vp, &vp->v_label); return (error); } void mac_create_devfs_directory(char *dirname, int dirnamelen, struct devfs_dirent *de) { MAC_PERFORM(create_devfs_directory, dirname, dirnamelen, de, &de->de_label); } /* * When a new vnode is created, this call will initialize its label. */ void mac_create_vnode(struct ucred *cred, struct vnode *parent, struct vnode *child) { int error; ASSERT_VOP_LOCKED(parent, "mac_create_vnode"); ASSERT_VOP_LOCKED(child, "mac_create_vnode"); error = vn_refreshlabel(parent, cred); if (error) { printf("mac_create_vnode: vn_refreshlabel returned %d\n", error); printf("mac_create_vnode: using old vnode label\n"); } MAC_PERFORM(create_vnode, cred, parent, &parent->v_label, child, &child->v_label); } int mac_setsockopt_label_set(struct ucred *cred, struct socket *so, struct mac *extmac) { struct label intlabel; int error; error = mac_internalize(&intlabel, extmac); if (error) return (error); mac_check_socket_relabel(cred, so, &intlabel); if (error) { mac_destroy_temp(&intlabel); return (error); } mac_relabel_socket(cred, so, &intlabel); mac_destroy_temp(&intlabel); return (0); } int mac_pipe_label_set(struct ucred *cred, struct pipe *pipe, struct label *label) { int error; PIPE_LOCK_ASSERT(pipe, MA_OWNED); error = mac_check_pipe_relabel(cred, pipe, label); if (error) return (error); mac_relabel_pipe(cred, pipe, label); return (0); } int mac_getsockopt_label_get(struct ucred *cred, struct socket *so, struct mac *extmac) { return (mac_externalize(&so->so_label, extmac)); } int mac_getsockopt_peerlabel_get(struct ucred *cred, struct socket *so, struct mac *extmac) { return (mac_externalize(&so->so_peerlabel, extmac)); } /* * Implementation of VOP_SETLABEL() that relies on extended attributes * to store label data. Can be referenced by filesystems supporting * extended attributes. */ int vop_stdsetlabel_ea(struct vop_setlabel_args *ap) { struct vnode *vp = ap->a_vp; struct label *intlabel = ap->a_label; struct mac extmac; int error; ASSERT_VOP_LOCKED(vp, "vop_stdsetlabel_ea"); /* * XXX: Eventually call out to EA check/set calls here. * Be particularly careful to avoid race conditions, * consistency problems, and stability problems when * dealing with multiple EAs. In particular, we require * the ability to write multiple EAs on the same file in * a single transaction, which the current EA interface * does not provide. */ error = mac_externalize(intlabel, &extmac); if (error) return (error); error = vn_extattr_set(vp, IO_NODELOCKED, FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME, sizeof(extmac), (char *)&extmac, curthread); if (error) return (error); mac_relabel_vnode(ap->a_cred, vp, intlabel); vp->v_vflag |= VV_CACHEDLABEL; return (0); } static int vn_setlabel(struct vnode *vp, struct label *intlabel, struct ucred *cred) { int error; if (vp->v_mount == NULL) { /* printf("vn_setlabel: null v_mount\n"); */ if (vp->v_type != VNON) printf("vn_setlabel: null v_mount with non-VNON\n"); return (EBADF); } if ((vp->v_mount->mnt_flag & MNT_MULTILABEL) == 0) return (EOPNOTSUPP); /* * Multi-phase commit. First check the policies to confirm the * change is OK. Then commit via the filesystem. Finally, * update the actual vnode label. Question: maybe the filesystem * should update the vnode at the end as part of VOP_SETLABEL()? */ error = mac_check_vnode_relabel(cred, vp, intlabel); if (error) return (error); /* * VADMIN provides the opportunity for the filesystem to make * decisions about who is and is not able to modify labels * and protections on files. This might not be right. We can't * assume VOP_SETLABEL() will do it, because we might implement * that as part of vop_stdsetlabel_ea(). */ error = VOP_ACCESS(vp, VADMIN, cred, curthread); if (error) return (error); error = VOP_SETLABEL(vp, intlabel, cred, curthread); if (error) return (error); return (0); } /* * MPSAFE */ int __mac_get_proc(struct thread *td, struct __mac_get_proc_args *uap) { struct mac extmac; int error; error = mac_externalize(&td->td_ucred->cr_label, &extmac); if (error == 0) error = copyout(&extmac, SCARG(uap, mac_p), sizeof(extmac)); return (error); } /* * MPSAFE */ int __mac_set_proc(struct thread *td, struct __mac_set_proc_args *uap) { struct ucred *newcred, *oldcred; struct proc *p; struct mac extmac; struct label intlabel; int error; error = copyin(SCARG(uap, mac_p), &extmac, sizeof(extmac)); if (error) return (error); error = mac_internalize(&intlabel, &extmac); if (error) return (error); newcred = crget(); p = td->td_proc; PROC_LOCK(p); oldcred = p->p_ucred; error = mac_check_cred_relabel(oldcred, &intlabel); if (error) { PROC_UNLOCK(p); mac_destroy_temp(&intlabel); crfree(newcred); return (error); } setsugid(p); crcopy(newcred, oldcred); mac_relabel_cred(newcred, &intlabel); p->p_ucred = newcred; /* * Grab additional reference for use while revoking mmaps, prior * to releasing the proc lock and sharing the cred. */ crhold(newcred); PROC_UNLOCK(p); mtx_lock(&Giant); mac_cred_mmapped_drop_perms(td, newcred); mtx_unlock(&Giant); crfree(newcred); /* Free revocation reference. */ crfree(oldcred); mac_destroy_temp(&intlabel); return (0); } /* * MPSAFE */ int __mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap) { struct file *fp; struct mac extmac; struct vnode *vp; struct pipe *pipe; int error; mtx_lock(&Giant); error = fget(td, SCARG(uap, fd), &fp); if (error) goto out; switch (fp->f_type) { case DTYPE_FIFO: case DTYPE_VNODE: vp = (struct vnode *)fp->f_data; vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); error = vn_refreshlabel(vp, td->td_ucred); if (error == 0) error = mac_externalize(&vp->v_label, &extmac); VOP_UNLOCK(vp, 0, td); break; case DTYPE_PIPE: pipe = (struct pipe *)fp->f_data; error = mac_externalize(pipe->pipe_label, &extmac); break; default: error = EINVAL; } if (error == 0) error = copyout(&extmac, SCARG(uap, mac_p), sizeof(extmac)); fdrop(fp, td); out: mtx_unlock(&Giant); return (error); } /* * MPSAFE */ int __mac_get_file(struct thread *td, struct __mac_get_file_args *uap) { struct nameidata nd; struct mac extmac; int error; mtx_lock(&Giant); NDINIT(&nd, LOOKUP, LOCKLEAF | FOLLOW, UIO_USERSPACE, SCARG(uap, path_p), td); error = namei(&nd); if (error) goto out; error = vn_refreshlabel(nd.ni_vp, td->td_ucred); if (error == 0) error = mac_externalize(&nd.ni_vp->v_label, &extmac); NDFREE(&nd, 0); if (error) goto out; error = copyout(&extmac, SCARG(uap, mac_p), sizeof(extmac)); out: mtx_unlock(&Giant); return (error); } /* * MPSAFE */ int __mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap) { struct file *fp; struct mac extmac; struct label intlabel; struct mount *mp; struct vnode *vp; struct pipe *pipe; int error; mtx_lock(&Giant); error = fget(td, SCARG(uap, fd), &fp); if (error) goto out1; error = copyin(SCARG(uap, mac_p), &extmac, sizeof(extmac)); if (error) goto out2; error = mac_internalize(&intlabel, &extmac); if (error) goto out2; switch (fp->f_type) { case DTYPE_FIFO: case DTYPE_VNODE: vp = (struct vnode *)fp->f_data; error = vn_start_write(vp, &mp, V_WAIT | PCATCH); if (error != 0) break; vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); error = vn_setlabel(vp, &intlabel, td->td_ucred); VOP_UNLOCK(vp, 0, td); vn_finished_write(mp); mac_destroy_temp(&intlabel); break; case DTYPE_PIPE: pipe = (struct pipe *)fp->f_data; PIPE_LOCK(pipe); error = mac_pipe_label_set(td->td_ucred, pipe, &intlabel); PIPE_UNLOCK(pipe); break; default: error = EINVAL; } out2: fdrop(fp, td); out1: mtx_unlock(&Giant); return (error); } /* * MPSAFE */ int __mac_set_file(struct thread *td, struct __mac_set_file_args *uap) { struct nameidata nd; struct mac extmac; struct label intlabel; struct mount *mp; int error; mtx_lock(&Giant); error = copyin(SCARG(uap, mac_p), &extmac, sizeof(extmac)); if (error) goto out; error = mac_internalize(&intlabel, &extmac); if (error) goto out; NDINIT(&nd, LOOKUP, LOCKLEAF | FOLLOW, UIO_USERSPACE, SCARG(uap, path_p), td); error = namei(&nd); if (error) goto out2; error = vn_start_write(nd.ni_vp, &mp, V_WAIT | PCATCH); if (error) goto out2; error = vn_setlabel(nd.ni_vp, &intlabel, td->td_ucred); vn_finished_write(mp); out2: mac_destroy_temp(&intlabel); NDFREE(&nd, 0); out: mtx_unlock(&Giant); return (error); } int mac_syscall(struct thread *td, struct mac_syscall_args *uap) { struct mac_policy_conf *mpc; char target[MAC_MAX_POLICY_NAME]; int error; error = copyinstr(SCARG(uap, policy), target, sizeof(target), NULL); if (error) return (error); error = ENOSYS; MAC_POLICY_LIST_BUSY(); LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { if (strcmp(mpc->mpc_name, target) == 0 && mpc->mpc_ops->mpo_syscall != NULL) { error = mpc->mpc_ops->mpo_syscall(td, SCARG(uap, call), SCARG(uap, arg)); goto out; } } out: MAC_POLICY_LIST_UNBUSY(); return (error); } SYSINIT(mac, SI_SUB_MAC, SI_ORDER_FIRST, mac_init, NULL); SYSINIT(mac_late, SI_SUB_MAC_LATE, SI_ORDER_FIRST, mac_late_init, NULL); #else /* !MAC */ int __mac_get_proc(struct thread *td, struct __mac_get_proc_args *uap) { return (ENOSYS); } int __mac_set_proc(struct thread *td, struct __mac_set_proc_args *uap) { return (ENOSYS); } int __mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap) { return (ENOSYS); } int __mac_get_file(struct thread *td, struct __mac_get_file_args *uap) { return (ENOSYS); } int __mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap) { return (ENOSYS); } int __mac_set_file(struct thread *td, struct __mac_set_file_args *uap) { return (ENOSYS); } int mac_syscall(struct thread *td, struct mac_syscall_args *uap) { return (ENOSYS); } #endif /* !MAC */ Index: head/sys/security/mac/mac_policy.h =================================================================== --- head/sys/security/mac/mac_policy.h (revision 104528) +++ head/sys/security/mac/mac_policy.h (revision 104529) @@ -1,524 +1,528 @@ /*- * Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson * Copyright (c) 2001, 2002 Networks Associates Technology, Inc. * All rights reserved. * * This software was developed by Robert Watson for the TrustedBSD Project. * * This software was developed for the FreeBSD Project in part by NAI Labs, * the Security Research Division of Network Associates, Inc. under * DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA * CHATS research program. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * 3. The names of the authors may not be used to endorse or promote * products derived from this software without specific prior written * permission. * * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. * * $FreeBSD$ */ /* * Kernel interface for MAC policy modules. */ #ifndef _SYS_MAC_POLICY_H #define _SYS_MAC_POLICY_H /*- * Pluggable access control policy definition structure. * * List of operations that are performed as part of the implementation * of a MAC policy. Policy implementors declare operations with a * mac_policy_ops structure, and using the MAC_POLICY_SET() macro. * If an entry point is not declared, then then the policy will be ignored * during evaluation of that event or check. * * Operations are sorted first by general class of operation, then * alphabetically. */ struct mac_policy_conf; struct mac_policy_ops { /* * Policy module operations. */ void (*mpo_destroy)(struct mac_policy_conf *mpc); void (*mpo_init)(struct mac_policy_conf *mpc); /* * General policy-directed security system call so that policies * may implement new services without reserving explicit * system call numbers. */ int (*mpo_syscall)(struct thread *td, int call, void *arg); /* * Label operations. */ void (*mpo_init_bpfdesc_label)(struct label *label); void (*mpo_init_cred_label)(struct label *label); void (*mpo_init_devfsdirent_label)(struct label *label); void (*mpo_init_ifnet_label)(struct label *label); void (*mpo_init_ipq_label)(struct label *label); int (*mpo_init_mbuf_label)(struct label *label, int flag); void (*mpo_init_mount_label)(struct label *label); void (*mpo_init_mount_fs_label)(struct label *label); void (*mpo_init_socket_label)(struct label *label); void (*mpo_init_socket_peer_label)(struct label *label); void (*mpo_init_pipe_label)(struct label *label); void (*mpo_init_temp_label)(struct label *label); void (*mpo_init_vnode_label)(struct label *label); void (*mpo_destroy_bpfdesc_label)(struct label *label); void (*mpo_destroy_cred_label)(struct label *label); void (*mpo_destroy_devfsdirent_label)(struct label *label); void (*mpo_destroy_ifnet_label)(struct label *label); void (*mpo_destroy_ipq_label)(struct label *label); void (*mpo_destroy_mbuf_label)(struct label *label); void (*mpo_destroy_mount_label)(struct label *label); void (*mpo_destroy_mount_fs_label)(struct label *label); void (*mpo_destroy_socket_label)(struct label *label); void (*mpo_destroy_socket_peer_label)(struct label *label); void (*mpo_destroy_pipe_label)(struct label *label); void (*mpo_destroy_temp_label)(struct label *label); void (*mpo_destroy_vnode_label)(struct label *label); int (*mpo_externalize)(struct label *label, struct mac *extmac); int (*mpo_internalize)(struct label *label, struct mac *extmac); /* * Labeling event operations: file system objects, and things that * look a lot like file system objects. */ void (*mpo_create_devfs_device)(dev_t dev, struct devfs_dirent *de, struct label *label); void (*mpo_create_devfs_directory)(char *dirname, int dirnamelen, struct devfs_dirent *de, struct label *label); void (*mpo_create_devfs_vnode)(struct devfs_dirent *de, struct label *direntlabel, struct vnode *vp, struct label *vnodelabel); void (*mpo_create_vnode)(struct ucred *cred, struct vnode *parent, struct label *parentlabel, struct vnode *child, struct label *childlabel); void (*mpo_create_mount)(struct ucred *cred, struct mount *mp, struct label *mntlabel, struct label *fslabel); void (*mpo_create_root_mount)(struct ucred *cred, struct mount *mp, struct label *mountlabel, struct label *fslabel); void (*mpo_relabel_vnode)(struct ucred *cred, struct vnode *vp, struct label *vnodelabel, struct label *label); int (*mpo_stdcreatevnode_ea)(struct vnode *vp, struct label *vnodelabel); void (*mpo_update_devfsdirent)(struct devfs_dirent *devfs_dirent, struct label *direntlabel, struct vnode *vp, struct label *vnodelabel); void (*mpo_update_procfsvnode)(struct vnode *vp, struct label *vnodelabel, struct ucred *cred); int (*mpo_update_vnode_from_extattr)(struct vnode *vp, struct label *vnodelabel, struct mount *mp, struct label *fslabel); int (*mpo_update_vnode_from_externalized)(struct vnode *vp, struct label *vnodelabel, struct mac *mac); void (*mpo_update_vnode_from_mount)(struct vnode *vp, struct label *vnodelabel, struct mount *mp, struct label *fslabel); /* * Labeling event operations: IPC objects. */ void (*mpo_create_mbuf_from_socket)(struct socket *so, struct label *socketlabel, struct mbuf *m, struct label *mbuflabel); void (*mpo_create_socket)(struct ucred *cred, struct socket *so, struct label *socketlabel); void (*mpo_create_socket_from_socket)(struct socket *oldsocket, struct label *oldsocketlabel, struct socket *newsocket, struct label *newsocketlabel); void (*mpo_relabel_socket)(struct ucred *cred, struct socket *so, struct label *oldlabel, struct label *newlabel); void (*mpo_relabel_pipe)(struct ucred *cred, struct pipe *pipe, struct label *oldlabel, struct label *newlabel); void (*mpo_set_socket_peer_from_mbuf)(struct mbuf *mbuf, struct label *mbuflabel, struct socket *so, struct label *socketpeerlabel); void (*mpo_set_socket_peer_from_socket)(struct socket *oldsocket, struct label *oldsocketlabel, struct socket *newsocket, struct label *newsocketpeerlabel); void (*mpo_create_pipe)(struct ucred *cred, struct pipe *pipe, struct label *pipelabel); /* * Labeling event operations: network objects. */ void (*mpo_create_bpfdesc)(struct ucred *cred, struct bpf_d *bpf_d, struct label *bpflabel); void (*mpo_create_ifnet)(struct ifnet *ifnet, struct label *ifnetlabel); void (*mpo_create_ipq)(struct mbuf *fragment, struct label *fragmentlabel, struct ipq *ipq, struct label *ipqlabel); void (*mpo_create_datagram_from_ipq) (struct ipq *ipq, struct label *ipqlabel, struct mbuf *datagram, struct label *datagramlabel); void (*mpo_create_fragment)(struct mbuf *datagram, struct label *datagramlabel, struct mbuf *fragment, struct label *fragmentlabel); void (*mpo_create_mbuf_from_mbuf)(struct mbuf *oldmbuf, struct label *oldlabel, struct mbuf *newmbuf, struct label *newlabel); void (*mpo_create_mbuf_linklayer)(struct ifnet *ifnet, struct label *ifnetlabel, struct mbuf *mbuf, struct label *mbuflabel); void (*mpo_create_mbuf_from_bpfdesc)(struct bpf_d *bpf_d, struct label *bpflabel, struct mbuf *mbuf, struct label *mbuflabel); void (*mpo_create_mbuf_from_ifnet)(struct ifnet *ifnet, struct label *ifnetlabel, struct mbuf *mbuf, struct label *mbuflabel); void (*mpo_create_mbuf_multicast_encap)(struct mbuf *oldmbuf, struct label *oldmbuflabel, struct ifnet *ifnet, struct label *ifnetlabel, struct mbuf *newmbuf, struct label *newmbuflabel); void (*mpo_create_mbuf_netlayer)(struct mbuf *oldmbuf, struct label *oldmbuflabel, struct mbuf *newmbuf, struct label *newmbuflabel); int (*mpo_fragment_match)(struct mbuf *fragment, struct label *fragmentlabel, struct ipq *ipq, struct label *ipqlabel); void (*mpo_relabel_ifnet)(struct ucred *cred, struct ifnet *ifnet, struct label *ifnetlabel, struct label *newlabel); void (*mpo_update_ipq)(struct mbuf *fragment, struct label *fragmentlabel, struct ipq *ipq, struct label *ipqlabel); /* * Labeling event operations: processes. */ void (*mpo_create_cred)(struct ucred *parent_cred, struct ucred *child_cred); void (*mpo_execve_transition)(struct ucred *old, struct ucred *new, struct vnode *vp, struct label *vnodelabel); int (*mpo_execve_will_transition)(struct ucred *old, struct vnode *vp, struct label *vnodelabel); void (*mpo_create_proc0)(struct ucred *cred); void (*mpo_create_proc1)(struct ucred *cred); void (*mpo_relabel_cred)(struct ucred *cred, struct label *newlabel); void (*mpo_thread_userret)(struct thread *thread); /* * Access control checks. */ int (*mpo_check_bpfdesc_receive)(struct bpf_d *bpf_d, struct label *bpflabel, struct ifnet *ifnet, struct label *ifnetlabel); int (*mpo_check_cred_relabel)(struct ucred *cred, struct label *newlabel); int (*mpo_check_cred_visible)(struct ucred *u1, struct ucred *u2); int (*mpo_check_ifnet_relabel)(struct ucred *cred, struct ifnet *ifnet, struct label *ifnetlabel, struct label *newlabel); int (*mpo_check_ifnet_transmit)(struct ifnet *ifnet, struct label *ifnetlabel, struct mbuf *m, struct label *mbuflabel); int (*mpo_check_mount_stat)(struct ucred *cred, struct mount *mp, struct label *mntlabel); int (*mpo_check_pipe_ioctl)(struct ucred *cred, struct pipe *pipe, struct label *pipelabel, unsigned long cmd, void *data); int (*mpo_check_pipe_poll)(struct ucred *cred, struct pipe *pipe, struct label *pipelabel); int (*mpo_check_pipe_read)(struct ucred *cred, struct pipe *pipe, struct label *pipelabel); int (*mpo_check_pipe_relabel)(struct ucred *cred, struct pipe *pipe, struct label *pipelabel, struct label *newlabel); int (*mpo_check_pipe_stat)(struct ucred *cred, struct pipe *pipe, struct label *pipelabel); int (*mpo_check_pipe_write)(struct ucred *cred, struct pipe *pipe, struct label *pipelabel); int (*mpo_check_proc_debug)(struct ucred *cred, struct proc *proc); int (*mpo_check_proc_sched)(struct ucred *cred, struct proc *proc); int (*mpo_check_proc_signal)(struct ucred *cred, struct proc *proc, int signum); int (*mpo_check_socket_bind)(struct ucred *cred, struct socket *so, struct label *socketlabel, struct sockaddr *sockaddr); int (*mpo_check_socket_connect)(struct ucred *cred, struct socket *so, struct label *socketlabel, struct sockaddr *sockaddr); int (*mpo_check_socket_deliver)(struct socket *so, struct label *socketlabel, struct mbuf *m, struct label *mbuflabel); int (*mpo_check_socket_listen)(struct ucred *cred, struct socket *so, struct label *socketlabel); int (*mpo_check_socket_relabel)(struct ucred *cred, struct socket *so, struct label *socketlabel, struct label *newlabel); int (*mpo_check_socket_visible)(struct ucred *cred, struct socket *so, struct label *socketlabel); int (*mpo_check_vnode_access)(struct ucred *cred, struct vnode *vp, struct label *label, int flags); int (*mpo_check_vnode_chdir)(struct ucred *cred, struct vnode *dvp, struct label *dlabel); int (*mpo_check_vnode_chroot)(struct ucred *cred, struct vnode *dvp, struct label *dlabel); int (*mpo_check_vnode_create)(struct ucred *cred, struct vnode *dvp, struct label *dlabel, struct componentname *cnp, struct vattr *vap); int (*mpo_check_vnode_delete)(struct ucred *cred, struct vnode *dvp, struct label *dlabel, struct vnode *vp, void *label, struct componentname *cnp); int (*mpo_check_vnode_deleteacl)(struct ucred *cred, struct vnode *vp, struct label *label, acl_type_t type); int (*mpo_check_vnode_exec)(struct ucred *cred, struct vnode *vp, struct label *label); int (*mpo_check_vnode_getacl)(struct ucred *cred, struct vnode *vp, struct label *label, acl_type_t type); int (*mpo_check_vnode_getextattr)(struct ucred *cred, struct vnode *vp, struct label *label, int attrnamespace, const char *name, struct uio *uio); + int (*mpo_check_vnode_link)(struct ucred *cred, struct vnode *dvp, + struct label *dlabel, struct vnode *vp, + struct label *label, struct componentname *cnp); int (*mpo_check_vnode_lookup)(struct ucred *cred, struct vnode *dvp, struct label *dlabel, struct componentname *cnp); vm_prot_t (*mpo_check_vnode_mmap_perms)(struct ucred *cred, struct vnode *vp, struct label *label, int newmapping); int (*mpo_check_vnode_open)(struct ucred *cred, struct vnode *vp, struct label *label, mode_t acc_mode); int (*mpo_check_vnode_poll)(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp, struct label *label); int (*mpo_check_vnode_read)(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp, struct label *label); int (*mpo_check_vnode_readdir)(struct ucred *cred, struct vnode *dvp, struct label *dlabel); int (*mpo_check_vnode_readlink)(struct ucred *cred, struct vnode *vp, struct label *label); int (*mpo_check_vnode_relabel)(struct ucred *cred, struct vnode *vp, struct label *vnodelabel, struct label *newlabel); int (*mpo_check_vnode_rename_from)(struct ucred *cred, struct vnode *dvp, struct label *dlabel, struct vnode *vp, struct label *label, struct componentname *cnp); int (*mpo_check_vnode_rename_to)(struct ucred *cred, struct vnode *dvp, struct label *dlabel, struct vnode *vp, struct label *label, int samedir, struct componentname *cnp); int (*mpo_check_vnode_revoke)(struct ucred *cred, struct vnode *vp, struct label *label); int (*mpo_check_vnode_setacl)(struct ucred *cred, struct vnode *vp, struct label *label, acl_type_t type, struct acl *acl); int (*mpo_check_vnode_setextattr)(struct ucred *cred, struct vnode *vp, struct label *label, int attrnamespace, const char *name, struct uio *uio); int (*mpo_check_vnode_setflags)(struct ucred *cred, struct vnode *vp, struct label *label, u_long flags); int (*mpo_check_vnode_setmode)(struct ucred *cred, struct vnode *vp, struct label *label, mode_t mode); int (*mpo_check_vnode_setowner)(struct ucred *cred, struct vnode *vp, struct label *label, uid_t uid, gid_t gid); int (*mpo_check_vnode_setutimes)(struct ucred *cred, struct vnode *vp, struct label *label, struct timespec atime, struct timespec mtime); int (*mpo_check_vnode_stat)(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp, struct label *label); int (*mpo_check_vnode_write)(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp, struct label *label); }; typedef const void *macop_t; enum mac_op_constant { MAC_OP_LAST, MAC_DESTROY, MAC_INIT, MAC_SYSCALL, MAC_INIT_BPFDESC_LABEL, MAC_INIT_CRED_LABEL, MAC_INIT_DEVFSDIRENT_LABEL, MAC_INIT_IFNET_LABEL, MAC_INIT_IPQ_LABEL, MAC_INIT_MBUF_LABEL, MAC_INIT_MOUNT_LABEL, MAC_INIT_MOUNT_FS_LABEL, MAC_INIT_PIPE_LABEL, MAC_INIT_SOCKET_LABEL, MAC_INIT_SOCKET_PEER_LABEL, MAC_INIT_TEMP_LABEL, MAC_INIT_VNODE_LABEL, MAC_DESTROY_BPFDESC_LABEL, MAC_DESTROY_CRED_LABEL, MAC_DESTROY_DEVFSDIRENT_LABEL, MAC_DESTROY_IFNET_LABEL, MAC_DESTROY_IPQ_LABEL, MAC_DESTROY_MBUF_LABEL, MAC_DESTROY_MOUNT_LABEL, MAC_DESTROY_MOUNT_FS_LABEL, MAC_DESTROY_PIPE_LABEL, MAC_DESTROY_SOCKET_LABEL, MAC_DESTROY_SOCKET_PEER_LABEL, MAC_DESTROY_TEMP_LABEL, MAC_DESTROY_VNODE_LABEL, MAC_EXTERNALIZE, MAC_INTERNALIZE, MAC_CREATE_DEVFS_DEVICE, MAC_CREATE_DEVFS_DIRECTORY, MAC_CREATE_DEVFS_VNODE, MAC_CREATE_VNODE, MAC_CREATE_MOUNT, MAC_CREATE_ROOT_MOUNT, MAC_RELABEL_VNODE, MAC_STDCREATEVNODE_EA, MAC_UPDATE_DEVFSDIRENT, MAC_UPDATE_PROCFSVNODE, MAC_UPDATE_VNODE_FROM_EXTATTR, MAC_UPDATE_VNODE_FROM_EXTERNALIZED, MAC_UPDATE_VNODE_FROM_MOUNT, MAC_CREATE_MBUF_FROM_SOCKET, MAC_CREATE_PIPE, MAC_CREATE_SOCKET, MAC_CREATE_SOCKET_FROM_SOCKET, MAC_RELABEL_PIPE, MAC_RELABEL_SOCKET, MAC_SET_SOCKET_PEER_FROM_MBUF, MAC_SET_SOCKET_PEER_FROM_SOCKET, MAC_CREATE_BPFDESC, MAC_CREATE_DATAGRAM_FROM_IPQ, MAC_CREATE_IFNET, MAC_CREATE_IPQ, MAC_CREATE_FRAGMENT, MAC_CREATE_MBUF_FROM_MBUF, MAC_CREATE_MBUF_LINKLAYER, MAC_CREATE_MBUF_FROM_BPFDESC, MAC_CREATE_MBUF_FROM_IFNET, MAC_CREATE_MBUF_MULTICAST_ENCAP, MAC_CREATE_MBUF_NETLAYER, MAC_FRAGMENT_MATCH, MAC_RELABEL_IFNET, MAC_UPDATE_IPQ, MAC_CREATE_CRED, MAC_EXECVE_TRANSITION, MAC_EXECVE_WILL_TRANSITION, MAC_CREATE_PROC0, MAC_CREATE_PROC1, MAC_RELABEL_CRED, MAC_THREAD_USERRET, MAC_CHECK_BPFDESC_RECEIVE, MAC_CHECK_CRED_RELABEL, MAC_CHECK_CRED_VISIBLE, MAC_CHECK_IFNET_RELABEL, MAC_CHECK_IFNET_TRANSMIT, MAC_CHECK_MOUNT_STAT, MAC_CHECK_PIPE_IOCTL, MAC_CHECK_PIPE_POLL, MAC_CHECK_PIPE_READ, MAC_CHECK_PIPE_RELABEL, MAC_CHECK_PIPE_STAT, MAC_CHECK_PIPE_WRITE, MAC_CHECK_PROC_DEBUG, MAC_CHECK_PROC_SCHED, MAC_CHECK_PROC_SIGNAL, MAC_CHECK_SOCKET_BIND, MAC_CHECK_SOCKET_CONNECT, MAC_CHECK_SOCKET_DELIVER, MAC_CHECK_SOCKET_LISTEN, MAC_CHECK_SOCKET_RELABEL, MAC_CHECK_SOCKET_VISIBLE, MAC_CHECK_VNODE_ACCESS, MAC_CHECK_VNODE_CHDIR, MAC_CHECK_VNODE_CHROOT, MAC_CHECK_VNODE_CREATE, MAC_CHECK_VNODE_DELETE, MAC_CHECK_VNODE_DELETEACL, MAC_CHECK_VNODE_EXEC, MAC_CHECK_VNODE_GETACL, MAC_CHECK_VNODE_GETEXTATTR, + MAC_CHECK_VNODE_LINK, MAC_CHECK_VNODE_LOOKUP, MAC_CHECK_VNODE_MMAP_PERMS, MAC_CHECK_VNODE_OPEN, MAC_CHECK_VNODE_POLL, MAC_CHECK_VNODE_READ, MAC_CHECK_VNODE_READDIR, MAC_CHECK_VNODE_READLINK, MAC_CHECK_VNODE_RELABEL, MAC_CHECK_VNODE_RENAME_FROM, MAC_CHECK_VNODE_RENAME_TO, MAC_CHECK_VNODE_REVOKE, MAC_CHECK_VNODE_SETACL, MAC_CHECK_VNODE_SETEXTATTR, MAC_CHECK_VNODE_SETFLAGS, MAC_CHECK_VNODE_SETMODE, MAC_CHECK_VNODE_SETOWNER, MAC_CHECK_VNODE_SETUTIMES, MAC_CHECK_VNODE_STAT, MAC_CHECK_VNODE_WRITE, }; struct mac_policy_op_entry { enum mac_op_constant mpe_constant; /* what this hook implements */ macop_t mpe_function; /* hook's implementation */ }; struct mac_policy_conf { char *mpc_name; /* policy name */ char *mpc_fullname; /* policy full name */ struct mac_policy_ops *mpc_ops; /* policy operations */ struct mac_policy_op_entry *mpc_entries; /* ops to fill in */ int mpc_loadtime_flags; /* flags */ int *mpc_field_off; /* security field */ int mpc_runtime_flags; /* flags */ LIST_ENTRY(mac_policy_conf) mpc_list; /* global list */ }; /* Flags for the mpc_loadtime_flags field. */ #define MPC_LOADTIME_FLAG_NOTLATE 0x00000001 #define MPC_LOADTIME_FLAG_UNLOADOK 0x00000002 /* Flags for the mpc_runtime_flags field. */ #define MPC_RUNTIME_FLAG_REGISTERED 0x00000001 #define MAC_POLICY_SET(mpents, mpname, mpfullname, mpflags, privdata_wanted) \ static struct mac_policy_conf mpname##_mac_policy_conf = { \ #mpname, \ mpfullname, \ NULL, \ mpents, \ mpflags, \ privdata_wanted, \ 0, \ }; \ static moduledata_t mpname##_mod = { \ #mpname, \ mac_policy_modevent, \ &mpname##_mac_policy_conf \ }; \ MODULE_DEPEND(mpname, kernel_mac_support, 1, 1, 1); \ DECLARE_MODULE(mpname, mpname##_mod, SI_SUB_MAC_POLICY, \ SI_ORDER_MIDDLE) int mac_policy_modevent(module_t mod, int type, void *data); #define LABEL_TO_SLOT(l, s) (l)->l_perpolicy[s] #endif /* !_SYS_MAC_POLICY_H */ Index: head/sys/security/mac/mac_process.c =================================================================== --- head/sys/security/mac/mac_process.c (revision 104528) +++ head/sys/security/mac/mac_process.c (revision 104529) @@ -1,3432 +1,3462 @@ /*- * Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson * Copyright (c) 2001 Ilmar S. Habibulin * Copyright (c) 2001, 2002 Networks Associates Technology, Inc. * All rights reserved. * * This software was developed by Robert Watson and Ilmar Habibulin for the * TrustedBSD Project. * * This software was developed for the FreeBSD Project in part by NAI Labs, * the Security Research Division of Network Associates, Inc. under * DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA * CHATS research program. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * 3. The names of the authors may not be used to endorse or promote * products derived from this software without specific prior written * permission. * * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. * * $FreeBSD$ */ /* * Developed by the TrustedBSD Project. * * Framework for extensible kernel access control. Kernel and userland * interface to the framework, policy registration and composition. */ #include "opt_mac.h" #include "opt_devfs.h" #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #ifdef MAC /* * Declare that the kernel provides MAC support, version 1. This permits * modules to refuse to be loaded if the necessary support isn't present, * even if it's pre-boot. */ MODULE_VERSION(kernel_mac_support, 1); SYSCTL_DECL(_security); SYSCTL_NODE(_security, OID_AUTO, mac, CTLFLAG_RW, 0, "TrustedBSD MAC policy controls"); #ifndef MAC_MAX_POLICIES #define MAC_MAX_POLICIES 8 #endif #if MAC_MAX_POLICIES > 32 #error "MAC_MAX_POLICIES too large" #endif static unsigned int mac_max_policies = MAC_MAX_POLICIES; static unsigned int mac_policy_offsets_free = (1 << MAC_MAX_POLICIES) - 1; SYSCTL_UINT(_security_mac, OID_AUTO, max_policies, CTLFLAG_RD, &mac_max_policies, 0, ""); static int mac_late = 0; static int mac_enforce_fs = 1; SYSCTL_INT(_security_mac, OID_AUTO, enforce_fs, CTLFLAG_RW, &mac_enforce_fs, 0, "Enforce MAC policy on file system objects"); TUNABLE_INT("security.mac.enforce_fs", &mac_enforce_fs); static int mac_enforce_network = 1; SYSCTL_INT(_security_mac, OID_AUTO, enforce_network, CTLFLAG_RW, &mac_enforce_network, 0, "Enforce MAC policy on network packets"); TUNABLE_INT("security.mac.enforce_network", &mac_enforce_network); static int mac_enforce_pipe = 1; SYSCTL_INT(_security_mac, OID_AUTO, enforce_pipe, CTLFLAG_RW, &mac_enforce_pipe, 0, "Enforce MAC policy on pipe operations"); TUNABLE_INT("security.mac.enforce_pipe", &mac_enforce_pipe); static int mac_enforce_process = 1; SYSCTL_INT(_security_mac, OID_AUTO, enforce_process, CTLFLAG_RW, &mac_enforce_process, 0, "Enforce MAC policy on inter-process operations"); TUNABLE_INT("security.mac.enforce_process", &mac_enforce_process); static int mac_enforce_socket = 1; SYSCTL_INT(_security_mac, OID_AUTO, enforce_socket, CTLFLAG_RW, &mac_enforce_socket, 0, "Enforce MAC policy on socket operations"); TUNABLE_INT("security.mac.enforce_socket", &mac_enforce_socket); static int mac_enforce_vm = 1; SYSCTL_INT(_security_mac, OID_AUTO, enforce_vm, CTLFLAG_RW, &mac_enforce_vm, 0, "Enforce MAC policy on vm operations"); TUNABLE_INT("security.mac.enforce_vm", &mac_enforce_vm); static int mac_label_size = sizeof(struct mac); SYSCTL_INT(_security_mac, OID_AUTO, label_size, CTLFLAG_RD, &mac_label_size, 0, "Pre-compiled MAC label size"); static int mac_cache_fslabel_in_vnode = 1; SYSCTL_INT(_security_mac, OID_AUTO, cache_fslabel_in_vnode, CTLFLAG_RW, &mac_cache_fslabel_in_vnode, 0, "Cache mount fslabel in vnode"); TUNABLE_INT("security.mac.cache_fslabel_in_vnode", &mac_cache_fslabel_in_vnode); static int mac_vnode_label_cache_hits = 0; SYSCTL_INT(_security_mac, OID_AUTO, vnode_label_cache_hits, CTLFLAG_RD, &mac_vnode_label_cache_hits, 0, "Cache hits on vnode labels"); static int mac_vnode_label_cache_misses = 0; SYSCTL_INT(_security_mac, OID_AUTO, vnode_label_cache_misses, CTLFLAG_RD, &mac_vnode_label_cache_misses, 0, "Cache misses on vnode labels"); static int mac_mmap_revocation = 1; SYSCTL_INT(_security_mac, OID_AUTO, mmap_revocation, CTLFLAG_RW, &mac_mmap_revocation, 0, "Revoke mmap access to files on subject " "relabel"); static int mac_mmap_revocation_via_cow = 0; SYSCTL_INT(_security_mac, OID_AUTO, mmap_revocation_via_cow, CTLFLAG_RW, &mac_mmap_revocation_via_cow, 0, "Revoke mmap access to files via " "copy-on-write semantics, or by removing all write access"); #ifdef MAC_DEBUG SYSCTL_NODE(_security_mac, OID_AUTO, debug, CTLFLAG_RW, 0, "TrustedBSD MAC debug info"); static int mac_debug_label_fallback = 0; SYSCTL_INT(_security_mac_debug, OID_AUTO, label_fallback, CTLFLAG_RW, &mac_debug_label_fallback, 0, "Filesystems should fall back to fs label" "when label is corrupted."); TUNABLE_INT("security.mac.debug_label_fallback", &mac_debug_label_fallback); SYSCTL_NODE(_security_mac_debug, OID_AUTO, counters, CTLFLAG_RW, 0, "TrustedBSD MAC object counters"); static unsigned int nmacmbufs, nmaccreds, nmacifnets, nmacbpfdescs, nmacsockets, nmacmounts, nmactemp, nmacvnodes, nmacdevfsdirents, nmacipqs, nmacpipes; SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, mbufs, CTLFLAG_RD, &nmacmbufs, 0, "number of mbufs in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, creds, CTLFLAG_RD, &nmaccreds, 0, "number of ucreds in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, ifnets, CTLFLAG_RD, &nmacifnets, 0, "number of ifnets in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, ipqs, CTLFLAG_RD, &nmacipqs, 0, "number of ipqs in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, bpfdescs, CTLFLAG_RD, &nmacbpfdescs, 0, "number of bpfdescs in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, sockets, CTLFLAG_RD, &nmacsockets, 0, "number of sockets in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, pipes, CTLFLAG_RD, &nmacpipes, 0, "number of pipes in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, mounts, CTLFLAG_RD, &nmacmounts, 0, "number of mounts in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, temp, CTLFLAG_RD, &nmactemp, 0, "number of temporary labels in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, vnodes, CTLFLAG_RD, &nmacvnodes, 0, "number of vnodes in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, devfsdirents, CTLFLAG_RD, &nmacdevfsdirents, 0, "number of devfs dirents inuse"); #endif static int error_select(int error1, int error2); static int mac_externalize(struct label *label, struct mac *mac); static int mac_policy_register(struct mac_policy_conf *mpc); static int mac_policy_unregister(struct mac_policy_conf *mpc); static int mac_stdcreatevnode_ea(struct vnode *vp); static void mac_cred_mmapped_drop_perms(struct thread *td, struct ucred *cred); static void mac_cred_mmapped_drop_perms_recurse(struct thread *td, struct ucred *cred, struct vm_map *map); MALLOC_DEFINE(M_MACOPVEC, "macopvec", "MAC policy operation vector"); MALLOC_DEFINE(M_MACPIPELABEL, "macpipelabel", "MAC labels for pipes"); /* * mac_policy_list_lock protects the consistency of 'mac_policy_list', * the linked list of attached policy modules. Read-only consumers of * the list must acquire a shared lock for the duration of their use; * writers must acquire an exclusive lock. Note that for compound * operations, locks should be held for the entire compound operation, * and that this is not yet done for relabel requests. */ static struct mtx mac_policy_list_lock; static LIST_HEAD(, mac_policy_conf) mac_policy_list; static int mac_policy_list_busy; #define MAC_POLICY_LIST_LOCKINIT() mtx_init(&mac_policy_list_lock, \ "mac_policy_list_lock", NULL, MTX_DEF); #define MAC_POLICY_LIST_LOCK() mtx_lock(&mac_policy_list_lock); #define MAC_POLICY_LIST_UNLOCK() mtx_unlock(&mac_policy_list_lock); #define MAC_POLICY_LIST_BUSY() do { \ MAC_POLICY_LIST_LOCK(); \ mac_policy_list_busy++; \ MAC_POLICY_LIST_UNLOCK(); \ } while (0) #define MAC_POLICY_LIST_UNBUSY() do { \ MAC_POLICY_LIST_LOCK(); \ mac_policy_list_busy--; \ if (mac_policy_list_busy < 0) \ panic("Extra mac_policy_list_busy--"); \ MAC_POLICY_LIST_UNLOCK(); \ } while (0) /* * MAC_CHECK performs the designated check by walking the policy * module list and checking with each as to how it feels about the * request. Note that it returns its value via 'error' in the scope * of the caller. */ #define MAC_CHECK(check, args...) do { \ struct mac_policy_conf *mpc; \ \ error = 0; \ MAC_POLICY_LIST_BUSY(); \ LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { \ if (mpc->mpc_ops->mpo_ ## check != NULL) \ error = error_select( \ mpc->mpc_ops->mpo_ ## check (args), \ error); \ } \ MAC_POLICY_LIST_UNBUSY(); \ } while (0) /* * MAC_BOOLEAN performs the designated boolean composition by walking * the module list, invoking each instance of the operation, and * combining the results using the passed C operator. Note that it * returns its value via 'result' in the scope of the caller, which * should be initialized by the caller in a meaningful way to get * a meaningful result. */ #define MAC_BOOLEAN(operation, composition, args...) do { \ struct mac_policy_conf *mpc; \ \ MAC_POLICY_LIST_BUSY(); \ LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { \ if (mpc->mpc_ops->mpo_ ## operation != NULL) \ result = result composition \ mpc->mpc_ops->mpo_ ## operation (args); \ } \ MAC_POLICY_LIST_UNBUSY(); \ } while (0) /* * MAC_PERFORM performs the designated operation by walking the policy * module list and invoking that operation for each policy. */ #define MAC_PERFORM(operation, args...) do { \ struct mac_policy_conf *mpc; \ \ MAC_POLICY_LIST_BUSY(); \ LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { \ if (mpc->mpc_ops->mpo_ ## operation != NULL) \ mpc->mpc_ops->mpo_ ## operation (args); \ } \ MAC_POLICY_LIST_UNBUSY(); \ } while (0) /* * Initialize the MAC subsystem, including appropriate SMP locks. */ static void mac_init(void) { LIST_INIT(&mac_policy_list); MAC_POLICY_LIST_LOCKINIT(); } /* * For the purposes of modules that want to know if they were loaded * "early", set the mac_late flag once we've processed modules either * linked into the kernel, or loaded before the kernel startup. */ static void mac_late_init(void) { mac_late = 1; } /* * Allow MAC policy modules to register during boot, etc. */ int mac_policy_modevent(module_t mod, int type, void *data) { struct mac_policy_conf *mpc; int error; error = 0; mpc = (struct mac_policy_conf *) data; switch (type) { case MOD_LOAD: if (mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_NOTLATE && mac_late) { printf("mac_policy_modevent: can't load %s policy " "after booting\n", mpc->mpc_name); error = EBUSY; break; } error = mac_policy_register(mpc); break; case MOD_UNLOAD: /* Don't unregister the module if it was never registered. */ if ((mpc->mpc_runtime_flags & MPC_RUNTIME_FLAG_REGISTERED) != 0) error = mac_policy_unregister(mpc); else error = 0; break; default: break; } return (error); } static int mac_policy_register(struct mac_policy_conf *mpc) { struct mac_policy_conf *tmpc; struct mac_policy_op_entry *mpe; int slot; MALLOC(mpc->mpc_ops, struct mac_policy_ops *, sizeof(*mpc->mpc_ops), M_MACOPVEC, M_WAITOK | M_ZERO); for (mpe = mpc->mpc_entries; mpe->mpe_constant != MAC_OP_LAST; mpe++) { switch (mpe->mpe_constant) { case MAC_OP_LAST: /* * Doesn't actually happen, but this allows checking * that all enumerated values are handled. */ break; case MAC_DESTROY: mpc->mpc_ops->mpo_destroy = mpe->mpe_function; break; case MAC_INIT: mpc->mpc_ops->mpo_init = mpe->mpe_function; break; case MAC_SYSCALL: mpc->mpc_ops->mpo_syscall = mpe->mpe_function; break; case MAC_INIT_BPFDESC_LABEL: mpc->mpc_ops->mpo_init_bpfdesc_label = mpe->mpe_function; break; case MAC_INIT_CRED_LABEL: mpc->mpc_ops->mpo_init_cred_label = mpe->mpe_function; break; case MAC_INIT_DEVFSDIRENT_LABEL: mpc->mpc_ops->mpo_init_devfsdirent_label = mpe->mpe_function; break; case MAC_INIT_IFNET_LABEL: mpc->mpc_ops->mpo_init_ifnet_label = mpe->mpe_function; break; case MAC_INIT_IPQ_LABEL: mpc->mpc_ops->mpo_init_ipq_label = mpe->mpe_function; break; case MAC_INIT_MBUF_LABEL: mpc->mpc_ops->mpo_init_mbuf_label = mpe->mpe_function; break; case MAC_INIT_MOUNT_LABEL: mpc->mpc_ops->mpo_init_mount_label = mpe->mpe_function; break; case MAC_INIT_MOUNT_FS_LABEL: mpc->mpc_ops->mpo_init_mount_fs_label = mpe->mpe_function; break; case MAC_INIT_PIPE_LABEL: mpc->mpc_ops->mpo_init_pipe_label = mpe->mpe_function; break; case MAC_INIT_SOCKET_LABEL: mpc->mpc_ops->mpo_init_socket_label = mpe->mpe_function; break; case MAC_INIT_SOCKET_PEER_LABEL: mpc->mpc_ops->mpo_init_socket_peer_label = mpe->mpe_function; break; case MAC_INIT_TEMP_LABEL: mpc->mpc_ops->mpo_init_temp_label = mpe->mpe_function; break; case MAC_INIT_VNODE_LABEL: mpc->mpc_ops->mpo_init_vnode_label = mpe->mpe_function; break; case MAC_DESTROY_BPFDESC_LABEL: mpc->mpc_ops->mpo_destroy_bpfdesc_label = mpe->mpe_function; break; case MAC_DESTROY_CRED_LABEL: mpc->mpc_ops->mpo_destroy_cred_label = mpe->mpe_function; break; case MAC_DESTROY_DEVFSDIRENT_LABEL: mpc->mpc_ops->mpo_destroy_devfsdirent_label = mpe->mpe_function; break; case MAC_DESTROY_IFNET_LABEL: mpc->mpc_ops->mpo_destroy_ifnet_label = mpe->mpe_function; break; case MAC_DESTROY_IPQ_LABEL: mpc->mpc_ops->mpo_destroy_ipq_label = mpe->mpe_function; break; case MAC_DESTROY_MBUF_LABEL: mpc->mpc_ops->mpo_destroy_mbuf_label = mpe->mpe_function; break; case MAC_DESTROY_MOUNT_LABEL: mpc->mpc_ops->mpo_destroy_mount_label = mpe->mpe_function; break; case MAC_DESTROY_MOUNT_FS_LABEL: mpc->mpc_ops->mpo_destroy_mount_fs_label = mpe->mpe_function; break; case MAC_DESTROY_PIPE_LABEL: mpc->mpc_ops->mpo_destroy_pipe_label = mpe->mpe_function; break; case MAC_DESTROY_SOCKET_LABEL: mpc->mpc_ops->mpo_destroy_socket_label = mpe->mpe_function; break; case MAC_DESTROY_SOCKET_PEER_LABEL: mpc->mpc_ops->mpo_destroy_socket_peer_label = mpe->mpe_function; break; case MAC_DESTROY_TEMP_LABEL: mpc->mpc_ops->mpo_destroy_temp_label = mpe->mpe_function; break; case MAC_DESTROY_VNODE_LABEL: mpc->mpc_ops->mpo_destroy_vnode_label = mpe->mpe_function; break; case MAC_EXTERNALIZE: mpc->mpc_ops->mpo_externalize = mpe->mpe_function; break; case MAC_INTERNALIZE: mpc->mpc_ops->mpo_internalize = mpe->mpe_function; break; case MAC_CREATE_DEVFS_DEVICE: mpc->mpc_ops->mpo_create_devfs_device = mpe->mpe_function; break; case MAC_CREATE_DEVFS_DIRECTORY: mpc->mpc_ops->mpo_create_devfs_directory = mpe->mpe_function; break; case MAC_CREATE_DEVFS_VNODE: mpc->mpc_ops->mpo_create_devfs_vnode = mpe->mpe_function; break; case MAC_STDCREATEVNODE_EA: mpc->mpc_ops->mpo_stdcreatevnode_ea = mpe->mpe_function; break; case MAC_CREATE_VNODE: mpc->mpc_ops->mpo_create_vnode = mpe->mpe_function; break; case MAC_CREATE_MOUNT: mpc->mpc_ops->mpo_create_mount = mpe->mpe_function; break; case MAC_CREATE_ROOT_MOUNT: mpc->mpc_ops->mpo_create_root_mount = mpe->mpe_function; break; case MAC_RELABEL_VNODE: mpc->mpc_ops->mpo_relabel_vnode = mpe->mpe_function; break; case MAC_UPDATE_DEVFSDIRENT: mpc->mpc_ops->mpo_update_devfsdirent = mpe->mpe_function; break; case MAC_UPDATE_PROCFSVNODE: mpc->mpc_ops->mpo_update_procfsvnode = mpe->mpe_function; break; case MAC_UPDATE_VNODE_FROM_EXTATTR: mpc->mpc_ops->mpo_update_vnode_from_extattr = mpe->mpe_function; break; case MAC_UPDATE_VNODE_FROM_EXTERNALIZED: mpc->mpc_ops->mpo_update_vnode_from_externalized = mpe->mpe_function; break; case MAC_UPDATE_VNODE_FROM_MOUNT: mpc->mpc_ops->mpo_update_vnode_from_mount = mpe->mpe_function; break; case MAC_CREATE_MBUF_FROM_SOCKET: mpc->mpc_ops->mpo_create_mbuf_from_socket = mpe->mpe_function; break; case MAC_CREATE_PIPE: mpc->mpc_ops->mpo_create_pipe = mpe->mpe_function; break; case MAC_CREATE_SOCKET: mpc->mpc_ops->mpo_create_socket = mpe->mpe_function; break; case MAC_CREATE_SOCKET_FROM_SOCKET: mpc->mpc_ops->mpo_create_socket_from_socket = mpe->mpe_function; break; case MAC_RELABEL_PIPE: mpc->mpc_ops->mpo_relabel_pipe = mpe->mpe_function; break; case MAC_RELABEL_SOCKET: mpc->mpc_ops->mpo_relabel_socket = mpe->mpe_function; break; case MAC_SET_SOCKET_PEER_FROM_MBUF: mpc->mpc_ops->mpo_set_socket_peer_from_mbuf = mpe->mpe_function; break; case MAC_SET_SOCKET_PEER_FROM_SOCKET: mpc->mpc_ops->mpo_set_socket_peer_from_socket = mpe->mpe_function; break; case MAC_CREATE_BPFDESC: mpc->mpc_ops->mpo_create_bpfdesc = mpe->mpe_function; break; case MAC_CREATE_DATAGRAM_FROM_IPQ: mpc->mpc_ops->mpo_create_datagram_from_ipq = mpe->mpe_function; break; case MAC_CREATE_FRAGMENT: mpc->mpc_ops->mpo_create_fragment = mpe->mpe_function; break; case MAC_CREATE_IFNET: mpc->mpc_ops->mpo_create_ifnet = mpe->mpe_function; break; case MAC_CREATE_IPQ: mpc->mpc_ops->mpo_create_ipq = mpe->mpe_function; break; case MAC_CREATE_MBUF_FROM_MBUF: mpc->mpc_ops->mpo_create_mbuf_from_mbuf = mpe->mpe_function; break; case MAC_CREATE_MBUF_LINKLAYER: mpc->mpc_ops->mpo_create_mbuf_linklayer = mpe->mpe_function; break; case MAC_CREATE_MBUF_FROM_BPFDESC: mpc->mpc_ops->mpo_create_mbuf_from_bpfdesc = mpe->mpe_function; break; case MAC_CREATE_MBUF_FROM_IFNET: mpc->mpc_ops->mpo_create_mbuf_from_ifnet = mpe->mpe_function; break; case MAC_CREATE_MBUF_MULTICAST_ENCAP: mpc->mpc_ops->mpo_create_mbuf_multicast_encap = mpe->mpe_function; break; case MAC_CREATE_MBUF_NETLAYER: mpc->mpc_ops->mpo_create_mbuf_netlayer = mpe->mpe_function; break; case MAC_FRAGMENT_MATCH: mpc->mpc_ops->mpo_fragment_match = mpe->mpe_function; break; case MAC_RELABEL_IFNET: mpc->mpc_ops->mpo_relabel_ifnet = mpe->mpe_function; break; case MAC_UPDATE_IPQ: mpc->mpc_ops->mpo_update_ipq = mpe->mpe_function; break; case MAC_CREATE_CRED: mpc->mpc_ops->mpo_create_cred = mpe->mpe_function; break; case MAC_EXECVE_TRANSITION: mpc->mpc_ops->mpo_execve_transition = mpe->mpe_function; break; case MAC_EXECVE_WILL_TRANSITION: mpc->mpc_ops->mpo_execve_will_transition = mpe->mpe_function; break; case MAC_CREATE_PROC0: mpc->mpc_ops->mpo_create_proc0 = mpe->mpe_function; break; case MAC_CREATE_PROC1: mpc->mpc_ops->mpo_create_proc1 = mpe->mpe_function; break; case MAC_RELABEL_CRED: mpc->mpc_ops->mpo_relabel_cred = mpe->mpe_function; break; case MAC_THREAD_USERRET: mpc->mpc_ops->mpo_thread_userret = mpe->mpe_function; break; case MAC_CHECK_BPFDESC_RECEIVE: mpc->mpc_ops->mpo_check_bpfdesc_receive = mpe->mpe_function; break; case MAC_CHECK_CRED_RELABEL: mpc->mpc_ops->mpo_check_cred_relabel = mpe->mpe_function; break; case MAC_CHECK_CRED_VISIBLE: mpc->mpc_ops->mpo_check_cred_visible = mpe->mpe_function; break; case MAC_CHECK_IFNET_RELABEL: mpc->mpc_ops->mpo_check_ifnet_relabel = mpe->mpe_function; break; case MAC_CHECK_IFNET_TRANSMIT: mpc->mpc_ops->mpo_check_ifnet_transmit = mpe->mpe_function; break; case MAC_CHECK_MOUNT_STAT: mpc->mpc_ops->mpo_check_mount_stat = mpe->mpe_function; break; case MAC_CHECK_PIPE_IOCTL: mpc->mpc_ops->mpo_check_pipe_ioctl = mpe->mpe_function; break; case MAC_CHECK_PIPE_POLL: mpc->mpc_ops->mpo_check_pipe_poll = mpe->mpe_function; break; case MAC_CHECK_PIPE_READ: mpc->mpc_ops->mpo_check_pipe_read = mpe->mpe_function; break; case MAC_CHECK_PIPE_RELABEL: mpc->mpc_ops->mpo_check_pipe_relabel = mpe->mpe_function; break; case MAC_CHECK_PIPE_STAT: mpc->mpc_ops->mpo_check_pipe_stat = mpe->mpe_function; break; case MAC_CHECK_PIPE_WRITE: mpc->mpc_ops->mpo_check_pipe_write = mpe->mpe_function; break; case MAC_CHECK_PROC_DEBUG: mpc->mpc_ops->mpo_check_proc_debug = mpe->mpe_function; break; case MAC_CHECK_PROC_SCHED: mpc->mpc_ops->mpo_check_proc_sched = mpe->mpe_function; break; case MAC_CHECK_PROC_SIGNAL: mpc->mpc_ops->mpo_check_proc_signal = mpe->mpe_function; break; case MAC_CHECK_SOCKET_BIND: mpc->mpc_ops->mpo_check_socket_bind = mpe->mpe_function; break; case MAC_CHECK_SOCKET_CONNECT: mpc->mpc_ops->mpo_check_socket_connect = mpe->mpe_function; break; case MAC_CHECK_SOCKET_DELIVER: mpc->mpc_ops->mpo_check_socket_deliver = mpe->mpe_function; break; case MAC_CHECK_SOCKET_LISTEN: mpc->mpc_ops->mpo_check_socket_listen = mpe->mpe_function; break; case MAC_CHECK_SOCKET_RELABEL: mpc->mpc_ops->mpo_check_socket_relabel = mpe->mpe_function; break; case MAC_CHECK_SOCKET_VISIBLE: mpc->mpc_ops->mpo_check_socket_visible = mpe->mpe_function; break; case MAC_CHECK_VNODE_ACCESS: mpc->mpc_ops->mpo_check_vnode_access = mpe->mpe_function; break; case MAC_CHECK_VNODE_CHDIR: mpc->mpc_ops->mpo_check_vnode_chdir = mpe->mpe_function; break; case MAC_CHECK_VNODE_CHROOT: mpc->mpc_ops->mpo_check_vnode_chroot = mpe->mpe_function; break; case MAC_CHECK_VNODE_CREATE: mpc->mpc_ops->mpo_check_vnode_create = mpe->mpe_function; break; case MAC_CHECK_VNODE_DELETE: mpc->mpc_ops->mpo_check_vnode_delete = mpe->mpe_function; break; case MAC_CHECK_VNODE_DELETEACL: mpc->mpc_ops->mpo_check_vnode_deleteacl = mpe->mpe_function; break; case MAC_CHECK_VNODE_EXEC: mpc->mpc_ops->mpo_check_vnode_exec = mpe->mpe_function; break; case MAC_CHECK_VNODE_GETACL: mpc->mpc_ops->mpo_check_vnode_getacl = mpe->mpe_function; break; case MAC_CHECK_VNODE_GETEXTATTR: mpc->mpc_ops->mpo_check_vnode_getextattr = mpe->mpe_function; break; + case MAC_CHECK_VNODE_LINK: + mpc->mpc_ops->mpo_check_vnode_link = + mpe->mpe_function; + break; case MAC_CHECK_VNODE_LOOKUP: mpc->mpc_ops->mpo_check_vnode_lookup = mpe->mpe_function; break; case MAC_CHECK_VNODE_MMAP_PERMS: mpc->mpc_ops->mpo_check_vnode_mmap_perms = mpe->mpe_function; break; case MAC_CHECK_VNODE_OPEN: mpc->mpc_ops->mpo_check_vnode_open = mpe->mpe_function; break; case MAC_CHECK_VNODE_POLL: mpc->mpc_ops->mpo_check_vnode_poll = mpe->mpe_function; break; case MAC_CHECK_VNODE_READ: mpc->mpc_ops->mpo_check_vnode_read = mpe->mpe_function; break; case MAC_CHECK_VNODE_READDIR: mpc->mpc_ops->mpo_check_vnode_readdir = mpe->mpe_function; break; case MAC_CHECK_VNODE_READLINK: mpc->mpc_ops->mpo_check_vnode_readlink = mpe->mpe_function; break; case MAC_CHECK_VNODE_RELABEL: mpc->mpc_ops->mpo_check_vnode_relabel = mpe->mpe_function; break; case MAC_CHECK_VNODE_RENAME_FROM: mpc->mpc_ops->mpo_check_vnode_rename_from = mpe->mpe_function; break; case MAC_CHECK_VNODE_RENAME_TO: mpc->mpc_ops->mpo_check_vnode_rename_to = mpe->mpe_function; break; case MAC_CHECK_VNODE_REVOKE: mpc->mpc_ops->mpo_check_vnode_revoke = mpe->mpe_function; break; case MAC_CHECK_VNODE_SETACL: mpc->mpc_ops->mpo_check_vnode_setacl = mpe->mpe_function; break; case MAC_CHECK_VNODE_SETEXTATTR: mpc->mpc_ops->mpo_check_vnode_setextattr = mpe->mpe_function; break; case MAC_CHECK_VNODE_SETFLAGS: mpc->mpc_ops->mpo_check_vnode_setflags = mpe->mpe_function; break; case MAC_CHECK_VNODE_SETMODE: mpc->mpc_ops->mpo_check_vnode_setmode = mpe->mpe_function; break; case MAC_CHECK_VNODE_SETOWNER: mpc->mpc_ops->mpo_check_vnode_setowner = mpe->mpe_function; break; case MAC_CHECK_VNODE_SETUTIMES: mpc->mpc_ops->mpo_check_vnode_setutimes = mpe->mpe_function; break; case MAC_CHECK_VNODE_STAT: mpc->mpc_ops->mpo_check_vnode_stat = mpe->mpe_function; break; case MAC_CHECK_VNODE_WRITE: mpc->mpc_ops->mpo_check_vnode_write = mpe->mpe_function; break; /* default: printf("MAC policy `%s': unknown operation %d\n", mpc->mpc_name, mpe->mpe_constant); return (EINVAL); */ } } MAC_POLICY_LIST_LOCK(); if (mac_policy_list_busy > 0) { MAC_POLICY_LIST_UNLOCK(); FREE(mpc->mpc_ops, M_MACOPVEC); mpc->mpc_ops = NULL; return (EBUSY); } LIST_FOREACH(tmpc, &mac_policy_list, mpc_list) { if (strcmp(tmpc->mpc_name, mpc->mpc_name) == 0) { MAC_POLICY_LIST_UNLOCK(); FREE(mpc->mpc_ops, M_MACOPVEC); mpc->mpc_ops = NULL; return (EEXIST); } } if (mpc->mpc_field_off != NULL) { slot = ffs(mac_policy_offsets_free); if (slot == 0) { MAC_POLICY_LIST_UNLOCK(); FREE(mpc->mpc_ops, M_MACOPVEC); mpc->mpc_ops = NULL; return (ENOMEM); } slot--; mac_policy_offsets_free &= ~(1 << slot); *mpc->mpc_field_off = slot; } mpc->mpc_runtime_flags |= MPC_RUNTIME_FLAG_REGISTERED; LIST_INSERT_HEAD(&mac_policy_list, mpc, mpc_list); /* Per-policy initialization. */ if (mpc->mpc_ops->mpo_init != NULL) (*(mpc->mpc_ops->mpo_init))(mpc); MAC_POLICY_LIST_UNLOCK(); printf("Security policy loaded: %s (%s)\n", mpc->mpc_fullname, mpc->mpc_name); return (0); } static int mac_policy_unregister(struct mac_policy_conf *mpc) { /* * If we fail the load, we may get a request to unload. Check * to see if we did the run-time registration, and if not, * silently succeed. */ MAC_POLICY_LIST_LOCK(); if ((mpc->mpc_runtime_flags & MPC_RUNTIME_FLAG_REGISTERED) == 0) { MAC_POLICY_LIST_UNLOCK(); return (0); } #if 0 /* * Don't allow unloading modules with private data. */ if (mpc->mpc_field_off != NULL) { MAC_POLICY_LIST_UNLOCK(); return (EBUSY); } #endif /* * Only allow the unload to proceed if the module is unloadable * by its own definition. */ if ((mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_UNLOADOK) == 0) { MAC_POLICY_LIST_UNLOCK(); return (EBUSY); } /* * Right now, we EBUSY if the list is in use. In the future, * for reliability reasons, we might want to sleep and wakeup * later to try again. */ if (mac_policy_list_busy > 0) { MAC_POLICY_LIST_UNLOCK(); return (EBUSY); } if (mpc->mpc_ops->mpo_destroy != NULL) (*(mpc->mpc_ops->mpo_destroy))(mpc); LIST_REMOVE(mpc, mpc_list); MAC_POLICY_LIST_UNLOCK(); FREE(mpc->mpc_ops, M_MACOPVEC); mpc->mpc_ops = NULL; printf("Security policy unload: %s (%s)\n", mpc->mpc_fullname, mpc->mpc_name); return (0); } /* * Define an error value precedence, and given two arguments, selects the * value with the higher precedence. */ static int error_select(int error1, int error2) { /* Certain decision-making errors take top priority. */ if (error1 == EDEADLK || error2 == EDEADLK) return (EDEADLK); /* Invalid arguments should be reported where possible. */ if (error1 == EINVAL || error2 == EINVAL) return (EINVAL); /* Precedence goes to "visibility", with both process and file. */ if (error1 == ESRCH || error2 == ESRCH) return (ESRCH); if (error1 == ENOENT || error2 == ENOENT) return (ENOENT); /* Precedence goes to DAC/MAC protections. */ if (error1 == EACCES || error2 == EACCES) return (EACCES); /* Precedence goes to privilege. */ if (error1 == EPERM || error2 == EPERM) return (EPERM); /* Precedence goes to error over success; otherwise, arbitrary. */ if (error1 != 0) return (error1); return (error2); } static void mac_init_label(struct label *label) { bzero(label, sizeof(*label)); label->l_flags = MAC_FLAG_INITIALIZED; } static void mac_destroy_label(struct label *label) { KASSERT(label->l_flags & MAC_FLAG_INITIALIZED, ("destroying uninitialized label")); bzero(label, sizeof(*label)); /* implicit: label->l_flags &= ~MAC_FLAG_INITIALIZED; */ } static void mac_init_structmac(struct mac *mac) { bzero(mac, sizeof(*mac)); mac->m_macflags = MAC_FLAG_INITIALIZED; } void mac_init_bpfdesc(struct bpf_d *bpf_d) { mac_init_label(&bpf_d->bd_label); MAC_PERFORM(init_bpfdesc_label, &bpf_d->bd_label); #ifdef MAC_DEBUG atomic_add_int(&nmacbpfdescs, 1); #endif } void mac_init_cred(struct ucred *cr) { mac_init_label(&cr->cr_label); MAC_PERFORM(init_cred_label, &cr->cr_label); #ifdef MAC_DEBUG atomic_add_int(&nmaccreds, 1); #endif } void mac_init_devfsdirent(struct devfs_dirent *de) { mac_init_label(&de->de_label); MAC_PERFORM(init_devfsdirent_label, &de->de_label); #ifdef MAC_DEBUG atomic_add_int(&nmacdevfsdirents, 1); #endif } void mac_init_ifnet(struct ifnet *ifp) { mac_init_label(&ifp->if_label); MAC_PERFORM(init_ifnet_label, &ifp->if_label); #ifdef MAC_DEBUG atomic_add_int(&nmacifnets, 1); #endif } void mac_init_ipq(struct ipq *ipq) { mac_init_label(&ipq->ipq_label); MAC_PERFORM(init_ipq_label, &ipq->ipq_label); #ifdef MAC_DEBUG atomic_add_int(&nmacipqs, 1); #endif } int mac_init_mbuf(struct mbuf *m, int flag) { int error; KASSERT(m->m_flags & M_PKTHDR, ("mac_init_mbuf on non-header mbuf")); mac_init_label(&m->m_pkthdr.label); MAC_CHECK(init_mbuf_label, &m->m_pkthdr.label, flag); if (error) { MAC_PERFORM(destroy_mbuf_label, &m->m_pkthdr.label); mac_destroy_label(&m->m_pkthdr.label); } #ifdef MAC_DEBUG if (error == 0) atomic_add_int(&nmacmbufs, 1); #endif return (error); } void mac_init_mount(struct mount *mp) { mac_init_label(&mp->mnt_mntlabel); mac_init_label(&mp->mnt_fslabel); MAC_PERFORM(init_mount_label, &mp->mnt_mntlabel); MAC_PERFORM(init_mount_fs_label, &mp->mnt_fslabel); #ifdef MAC_DEBUG atomic_add_int(&nmacmounts, 1); #endif } void mac_init_pipe(struct pipe *pipe) { struct label *label; label = malloc(sizeof(struct label), M_MACPIPELABEL, M_ZERO|M_WAITOK); mac_init_label(label); pipe->pipe_label = label; pipe->pipe_peer->pipe_label = label; MAC_PERFORM(init_pipe_label, pipe->pipe_label); #ifdef MAC_DEBUG atomic_add_int(&nmacpipes, 1); #endif } void mac_init_socket(struct socket *socket) { mac_init_label(&socket->so_label); mac_init_label(&socket->so_peerlabel); MAC_PERFORM(init_socket_label, &socket->so_label); MAC_PERFORM(init_socket_peer_label, &socket->so_peerlabel); #ifdef MAC_DEBUG atomic_add_int(&nmacsockets, 1); #endif } static void mac_init_temp(struct label *label) { mac_init_label(label); MAC_PERFORM(init_temp_label, label); #ifdef MAC_DEBUG atomic_add_int(&nmactemp, 1); #endif } void mac_init_vnode(struct vnode *vp) { mac_init_label(&vp->v_label); MAC_PERFORM(init_vnode_label, &vp->v_label); #ifdef MAC_DEBUG atomic_add_int(&nmacvnodes, 1); #endif } void mac_destroy_bpfdesc(struct bpf_d *bpf_d) { MAC_PERFORM(destroy_bpfdesc_label, &bpf_d->bd_label); mac_destroy_label(&bpf_d->bd_label); #ifdef MAC_DEBUG atomic_subtract_int(&nmacbpfdescs, 1); #endif } void mac_destroy_cred(struct ucred *cr) { MAC_PERFORM(destroy_cred_label, &cr->cr_label); mac_destroy_label(&cr->cr_label); #ifdef MAC_DEBUG atomic_subtract_int(&nmaccreds, 1); #endif } void mac_destroy_devfsdirent(struct devfs_dirent *de) { MAC_PERFORM(destroy_devfsdirent_label, &de->de_label); mac_destroy_label(&de->de_label); #ifdef MAC_DEBUG atomic_subtract_int(&nmacdevfsdirents, 1); #endif } void mac_destroy_ifnet(struct ifnet *ifp) { MAC_PERFORM(destroy_ifnet_label, &ifp->if_label); mac_destroy_label(&ifp->if_label); #ifdef MAC_DEBUG atomic_subtract_int(&nmacifnets, 1); #endif } void mac_destroy_ipq(struct ipq *ipq) { MAC_PERFORM(destroy_ipq_label, &ipq->ipq_label); mac_destroy_label(&ipq->ipq_label); #ifdef MAC_DEBUG atomic_subtract_int(&nmacipqs, 1); #endif } void mac_destroy_mbuf(struct mbuf *m) { MAC_PERFORM(destroy_mbuf_label, &m->m_pkthdr.label); mac_destroy_label(&m->m_pkthdr.label); #ifdef MAC_DEBUG atomic_subtract_int(&nmacmbufs, 1); #endif } void mac_destroy_mount(struct mount *mp) { MAC_PERFORM(destroy_mount_label, &mp->mnt_mntlabel); MAC_PERFORM(destroy_mount_fs_label, &mp->mnt_fslabel); mac_destroy_label(&mp->mnt_fslabel); mac_destroy_label(&mp->mnt_mntlabel); #ifdef MAC_DEBUG atomic_subtract_int(&nmacmounts, 1); #endif } void mac_destroy_pipe(struct pipe *pipe) { MAC_PERFORM(destroy_pipe_label, pipe->pipe_label); mac_destroy_label(pipe->pipe_label); free(pipe->pipe_label, M_MACPIPELABEL); #ifdef MAC_DEBUG atomic_subtract_int(&nmacpipes, 1); #endif } void mac_destroy_socket(struct socket *socket) { MAC_PERFORM(destroy_socket_label, &socket->so_label); MAC_PERFORM(destroy_socket_peer_label, &socket->so_peerlabel); mac_destroy_label(&socket->so_label); mac_destroy_label(&socket->so_peerlabel); #ifdef MAC_DEBUG atomic_subtract_int(&nmacsockets, 1); #endif } static void mac_destroy_temp(struct label *label) { MAC_PERFORM(destroy_temp_label, label); mac_destroy_label(label); #ifdef MAC_DEBUG atomic_subtract_int(&nmactemp, 1); #endif } void mac_destroy_vnode(struct vnode *vp) { MAC_PERFORM(destroy_vnode_label, &vp->v_label); mac_destroy_label(&vp->v_label); #ifdef MAC_DEBUG atomic_subtract_int(&nmacvnodes, 1); #endif } static int mac_externalize(struct label *label, struct mac *mac) { int error; mac_init_structmac(mac); MAC_CHECK(externalize, label, mac); return (error); } static int mac_internalize(struct label *label, struct mac *mac) { int error; mac_init_temp(label); MAC_CHECK(internalize, label, mac); if (error) mac_destroy_temp(label); return (error); } /* * Initialize MAC label for the first kernel process, from which other * kernel processes and threads are spawned. */ void mac_create_proc0(struct ucred *cred) { MAC_PERFORM(create_proc0, cred); } /* * Initialize MAC label for the first userland process, from which other * userland processes and threads are spawned. */ void mac_create_proc1(struct ucred *cred) { MAC_PERFORM(create_proc1, cred); } void mac_thread_userret(struct thread *td) { MAC_PERFORM(thread_userret, td); } /* * When a new process is created, its label must be initialized. Generally, * this involves inheritence from the parent process, modulo possible * deltas. This function allows that processing to take place. */ void mac_create_cred(struct ucred *parent_cred, struct ucred *child_cred) { MAC_PERFORM(create_cred, parent_cred, child_cred); } void mac_update_devfsdirent(struct devfs_dirent *de, struct vnode *vp) { MAC_PERFORM(update_devfsdirent, de, &de->de_label, vp, &vp->v_label); } void mac_update_procfsvnode(struct vnode *vp, struct ucred *cred) { MAC_PERFORM(update_procfsvnode, vp, &vp->v_label, cred); } /* * Support callout for policies that manage their own externalization * using extended attributes. */ static int mac_update_vnode_from_extattr(struct vnode *vp, struct mount *mp) { int error; MAC_CHECK(update_vnode_from_extattr, vp, &vp->v_label, mp, &mp->mnt_fslabel); return (error); } /* * Given an externalized mac label, internalize it and stamp it on a * vnode. */ static int mac_update_vnode_from_externalized(struct vnode *vp, struct mac *extmac) { int error; MAC_CHECK(update_vnode_from_externalized, vp, &vp->v_label, extmac); return (error); } /* * Call out to individual policies to update the label in a vnode from * the mountpoint. */ void mac_update_vnode_from_mount(struct vnode *vp, struct mount *mp) { MAC_PERFORM(update_vnode_from_mount, vp, &vp->v_label, mp, &mp->mnt_fslabel); ASSERT_VOP_LOCKED(vp, "mac_update_vnode_from_mount"); if (mac_cache_fslabel_in_vnode) vp->v_vflag |= VV_CACHEDLABEL; } /* * Implementation of VOP_REFRESHLABEL() that relies on extended attributes * to store label data. Can be referenced by filesystems supporting * extended attributes. */ int vop_stdrefreshlabel_ea(struct vop_refreshlabel_args *ap) { struct vnode *vp = ap->a_vp; struct mac extmac; int buflen, error; ASSERT_VOP_LOCKED(vp, "vop_stdrefreshlabel_ea"); /* * Call out to external policies first. Order doesn't really * matter, as long as failure of one assures failure of all. */ error = mac_update_vnode_from_extattr(vp, vp->v_mount); if (error) return (error); buflen = sizeof(extmac); error = vn_extattr_get(vp, IO_NODELOCKED, FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME, &buflen, (char *)&extmac, curthread); switch (error) { case 0: /* Got it */ break; case ENOATTR: /* * Use the label from the mount point. */ mac_update_vnode_from_mount(vp, vp->v_mount); return (0); case EOPNOTSUPP: default: /* Fail horribly. */ return (error); } if (buflen != sizeof(extmac)) error = EPERM; /* Fail very closed. */ if (error == 0) error = mac_update_vnode_from_externalized(vp, &extmac); if (error == 0) vp->v_vflag |= VV_CACHEDLABEL; else { struct vattr va; printf("Corrupted label on %s", vp->v_mount->mnt_stat.f_mntonname); if (VOP_GETATTR(vp, &va, curthread->td_ucred, curthread) == 0) printf(" inum %ld", va.va_fileid); #ifdef MAC_DEBUG if (mac_debug_label_fallback) { printf(", falling back.\n"); mac_update_vnode_from_mount(vp, vp->v_mount); error = 0; } else { #endif printf(".\n"); error = EPERM; #ifdef MAC_DEBUG } #endif } return (error); } /* * Make sure the vnode label is up-to-date. If EOPNOTSUPP, then we handle * the labeling activity outselves. Filesystems should be careful not * to change their minds regarding whether they support vop_refreshlabel() * for a vnode or not. Don't cache the vnode here, allow the file * system code to determine if it's safe to cache. If we update from * the mount, don't cache since a change to the mount label should affect * all vnodes. */ static int vn_refreshlabel(struct vnode *vp, struct ucred *cred) { int error; ASSERT_VOP_LOCKED(vp, "vn_refreshlabel"); if (vp->v_mount == NULL) { /* Eventually, we probably want to special-case refreshing of deadfs vnodes, and if there's a lock-free race somewhere, that case might be handled here. mac_update_vnode_deadfs(vp); return (0); */ /* printf("vn_refreshlabel: null v_mount\n"); */ if (vp->v_type != VNON) printf( "vn_refreshlabel: null v_mount with non-VNON\n"); return (EBADF); } if (vp->v_vflag & VV_CACHEDLABEL) { mac_vnode_label_cache_hits++; return (0); } else mac_vnode_label_cache_misses++; if ((vp->v_mount->mnt_flag & MNT_MULTILABEL) == 0) { mac_update_vnode_from_mount(vp, vp->v_mount); return (0); } error = VOP_REFRESHLABEL(vp, cred, curthread); switch (error) { case EOPNOTSUPP: /* * If labels are not supported on this vnode, fall back to * the label in the mount and propagate it to the vnode. * There should probably be some sort of policy/flag/decision * about doing this. */ mac_update_vnode_from_mount(vp, vp->v_mount); error = 0; default: return (error); } } /* * Helper function for file systems using the vop_std*_ea() calls. This * function must be called after EA service is available for the vnode, * but before it's hooked up to the namespace so that the node persists * if there's a crash, or before it can be accessed. On successful * commit of the label to disk (etc), do cache the label. */ int vop_stdcreatevnode_ea(struct vnode *dvp, struct vnode *tvp, struct ucred *cred) { struct mac extmac; int error; ASSERT_VOP_LOCKED(tvp, "vop_stdcreatevnode_ea"); if ((dvp->v_mount->mnt_flag & MNT_MULTILABEL) == 0) { mac_update_vnode_from_mount(tvp, tvp->v_mount); } else { error = vn_refreshlabel(dvp, cred); if (error) return (error); /* * Stick the label in the vnode. Then try to write to * disk. If we fail, return a failure to abort the * create operation. Really, this failure shouldn't * happen except in fairly unusual circumstances (out * of disk, etc). */ mac_create_vnode(cred, dvp, tvp); error = mac_stdcreatevnode_ea(tvp); if (error) return (error); /* * XXX: Eventually this will go away and all policies will * directly manage their extended attributes. */ error = mac_externalize(&tvp->v_label, &extmac); if (error) return (error); error = vn_extattr_set(tvp, IO_NODELOCKED, FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME, sizeof(extmac), (char *)&extmac, curthread); if (error == 0) tvp->v_vflag |= VV_CACHEDLABEL; else { #if 0 /* * In theory, we could have fall-back behavior here. * It would probably be incorrect. */ #endif return (error); } } return (0); } void mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_execve_transition"); error = vn_refreshlabel(vp, old); if (error) { printf("mac_execve_transition: vn_refreshlabel returned %d\n", error); printf("mac_execve_transition: using old vnode label\n"); } MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label); } int mac_execve_will_transition(struct ucred *old, struct vnode *vp) { int error, result; error = vn_refreshlabel(vp, old); if (error) return (error); result = 0; MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label); return (result); } int mac_check_vnode_access(struct ucred *cred, struct vnode *vp, int flags) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_access"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_access, cred, vp, &vp->v_label, flags); return (error); } int mac_check_vnode_chdir(struct ucred *cred, struct vnode *dvp) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_chdir"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); MAC_CHECK(check_vnode_chdir, cred, dvp, &dvp->v_label); return (error); } int mac_check_vnode_chroot(struct ucred *cred, struct vnode *dvp) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_chroot"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); MAC_CHECK(check_vnode_chroot, cred, dvp, &dvp->v_label); return (error); } int mac_check_vnode_create(struct ucred *cred, struct vnode *dvp, struct componentname *cnp, struct vattr *vap) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_create"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); MAC_CHECK(check_vnode_create, cred, dvp, &dvp->v_label, cnp, vap); return (error); } int mac_check_vnode_delete(struct ucred *cred, struct vnode *dvp, struct vnode *vp, struct componentname *cnp) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_delete"); ASSERT_VOP_LOCKED(vp, "mac_check_vnode_delete"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_delete, cred, dvp, &dvp->v_label, vp, &vp->v_label, cnp); return (error); } int mac_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp, acl_type_t type) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_deleteacl"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_deleteacl, cred, vp, &vp->v_label, type); return (error); } int mac_check_vnode_exec(struct ucred *cred, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_exec"); if (!mac_enforce_process && !mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label); return (error); } int mac_check_vnode_getacl(struct ucred *cred, struct vnode *vp, acl_type_t type) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_getacl"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_getacl, cred, vp, &vp->v_label, type); return (error); } int mac_check_vnode_getextattr(struct ucred *cred, struct vnode *vp, int attrnamespace, const char *name, struct uio *uio) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_getextattr"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_getextattr, cred, vp, &vp->v_label, attrnamespace, name, uio); + return (error); +} + +int +mac_check_vnode_link(struct ucred *cred, struct vnode *dvp, + struct vnode *vp, struct componentname *cnp) +{ + + int error; + + ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_link"); + ASSERT_VOP_LOCKED(vp, "mac_check_vnode_link"); + + if (!mac_enforce_fs) + return (0); + + error = vn_refreshlabel(dvp, cred); + if (error) + return (error); + + error = vn_refreshlabel(vp, cred); + if (error) + return (error); + + MAC_CHECK(check_vnode_link, cred, dvp, &dvp->v_label, vp, + &vp->v_label, cnp); return (error); } int mac_check_vnode_lookup(struct ucred *cred, struct vnode *dvp, struct componentname *cnp) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_lookup"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); MAC_CHECK(check_vnode_lookup, cred, dvp, &dvp->v_label, cnp); return (error); } vm_prot_t mac_check_vnode_mmap_prot(struct ucred *cred, struct vnode *vp, int newmapping) { vm_prot_t result = VM_PROT_ALL; if (!mac_enforce_vm) return (result); /* * This should be some sort of MAC_BITWISE, maybe :) */ ASSERT_VOP_LOCKED(vp, "mac_check_vnode_mmap_perms"); MAC_BOOLEAN(check_vnode_mmap_perms, &, cred, vp, &vp->v_label, newmapping); return (result); } int mac_check_vnode_open(struct ucred *cred, struct vnode *vp, mode_t acc_mode) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_open"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_open, cred, vp, &vp->v_label, acc_mode); return (error); } int mac_check_vnode_poll(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_poll"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, active_cred); if (error) return (error); MAC_CHECK(check_vnode_poll, active_cred, file_cred, vp, &vp->v_label); return (error); } int mac_check_vnode_read(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_read"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, active_cred); if (error) return (error); MAC_CHECK(check_vnode_read, active_cred, file_cred, vp, &vp->v_label); return (error); } int mac_check_vnode_readdir(struct ucred *cred, struct vnode *dvp) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_readdir"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); MAC_CHECK(check_vnode_readdir, cred, dvp, &dvp->v_label); return (error); } int mac_check_vnode_readlink(struct ucred *cred, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_readlink"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_readlink, cred, vp, &vp->v_label); return (error); } static int mac_check_vnode_relabel(struct ucred *cred, struct vnode *vp, struct label *newlabel) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_relabel"); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_relabel, cred, vp, &vp->v_label, newlabel); return (error); } int mac_check_vnode_rename_from(struct ucred *cred, struct vnode *dvp, struct vnode *vp, struct componentname *cnp) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_rename_from"); ASSERT_VOP_LOCKED(vp, "mac_check_vnode_rename_from"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_rename_from, cred, dvp, &dvp->v_label, vp, &vp->v_label, cnp); return (error); } int mac_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp, struct vnode *vp, int samedir, struct componentname *cnp) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_rename_to"); ASSERT_VOP_LOCKED(vp, "mac_check_vnode_rename_to"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); if (vp != NULL) { error = vn_refreshlabel(vp, cred); if (error) return (error); } MAC_CHECK(check_vnode_rename_to, cred, dvp, &dvp->v_label, vp, vp != NULL ? &vp->v_label : NULL, samedir, cnp); return (error); } int mac_check_vnode_revoke(struct ucred *cred, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_revoke"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_revoke, cred, vp, &vp->v_label); return (error); } int mac_check_vnode_setacl(struct ucred *cred, struct vnode *vp, acl_type_t type, struct acl *acl) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setacl"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_setacl, cred, vp, &vp->v_label, type, acl); return (error); } int mac_check_vnode_setextattr(struct ucred *cred, struct vnode *vp, int attrnamespace, const char *name, struct uio *uio) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setextattr"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_setextattr, cred, vp, &vp->v_label, attrnamespace, name, uio); return (error); } int mac_check_vnode_setflags(struct ucred *cred, struct vnode *vp, u_long flags) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setflags"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_setflags, cred, vp, &vp->v_label, flags); return (error); } int mac_check_vnode_setmode(struct ucred *cred, struct vnode *vp, mode_t mode) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setmode"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_setmode, cred, vp, &vp->v_label, mode); return (error); } int mac_check_vnode_setowner(struct ucred *cred, struct vnode *vp, uid_t uid, gid_t gid) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setowner"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_setowner, cred, vp, &vp->v_label, uid, gid); return (error); } int mac_check_vnode_setutimes(struct ucred *cred, struct vnode *vp, struct timespec atime, struct timespec mtime) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setutimes"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_setutimes, cred, vp, &vp->v_label, atime, mtime); return (error); } int mac_check_vnode_stat(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_stat"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, active_cred); if (error) return (error); MAC_CHECK(check_vnode_stat, active_cred, file_cred, vp, &vp->v_label); return (error); } int mac_check_vnode_write(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_write"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, active_cred); if (error) return (error); MAC_CHECK(check_vnode_write, active_cred, file_cred, vp, &vp->v_label); return (error); } /* * When relabeling a process, call out to the policies for the maximum * permission allowed for each object type we know about in its * memory space, and revoke access (in the least surprising ways we * know) when necessary. The process lock is not held here. */ static void mac_cred_mmapped_drop_perms(struct thread *td, struct ucred *cred) { /* XXX freeze all other threads */ mac_cred_mmapped_drop_perms_recurse(td, cred, &td->td_proc->p_vmspace->vm_map); /* XXX allow other threads to continue */ } static __inline const char * prot2str(vm_prot_t prot) { switch (prot & VM_PROT_ALL) { case VM_PROT_READ: return ("r--"); case VM_PROT_READ | VM_PROT_WRITE: return ("rw-"); case VM_PROT_READ | VM_PROT_EXECUTE: return ("r-x"); case VM_PROT_READ | VM_PROT_WRITE | VM_PROT_EXECUTE: return ("rwx"); case VM_PROT_WRITE: return ("-w-"); case VM_PROT_EXECUTE: return ("--x"); case VM_PROT_WRITE | VM_PROT_EXECUTE: return ("-wx"); default: return ("---"); } } static void mac_cred_mmapped_drop_perms_recurse(struct thread *td, struct ucred *cred, struct vm_map *map) { struct vm_map_entry *vme; vm_prot_t result, revokeperms; vm_object_t object; vm_ooffset_t offset; struct vnode *vp; if (!mac_mmap_revocation) return; vm_map_lock_read(map); for (vme = map->header.next; vme != &map->header; vme = vme->next) { if (vme->eflags & MAP_ENTRY_IS_SUB_MAP) { mac_cred_mmapped_drop_perms_recurse(td, cred, vme->object.sub_map); continue; } /* * Skip over entries that obviously are not shared. */ if (vme->eflags & (MAP_ENTRY_COW | MAP_ENTRY_NOSYNC) || !vme->max_protection) continue; /* * Drill down to the deepest backing object. */ offset = vme->offset; object = vme->object.vm_object; if (object == NULL) continue; while (object->backing_object != NULL) { object = object->backing_object; offset += object->backing_object_offset; } /* * At the moment, vm_maps and objects aren't considered * by the MAC system, so only things with backing by a * normal object (read: vnodes) are checked. */ if (object->type != OBJT_VNODE) continue; vp = (struct vnode *)object->handle; vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); result = mac_check_vnode_mmap_prot(cred, vp, 0); VOP_UNLOCK(vp, 0, td); /* * Find out what maximum protection we may be allowing * now but a policy needs to get removed. */ revokeperms = vme->max_protection & ~result; if (!revokeperms) continue; printf("pid %ld: revoking %s perms from %#lx:%ld " "(max %s/cur %s)\n", (long)td->td_proc->p_pid, prot2str(revokeperms), (u_long)vme->start, (long)(vme->end - vme->start), prot2str(vme->max_protection), prot2str(vme->protection)); vm_map_lock_upgrade(map); /* * This is the really simple case: if a map has more * max_protection than is allowed, but it's not being * actually used (that is, the current protection is * still allowed), we can just wipe it out and do * nothing more. */ if ((vme->protection & revokeperms) == 0) { vme->max_protection -= revokeperms; } else { if (revokeperms & VM_PROT_WRITE) { /* * In the more complicated case, flush out all * pending changes to the object then turn it * copy-on-write. */ vm_object_reference(object); vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); vm_object_page_clean(object, OFF_TO_IDX(offset), OFF_TO_IDX(offset + vme->end - vme->start + PAGE_MASK), OBJPC_SYNC); VOP_UNLOCK(vp, 0, td); vm_object_deallocate(object); /* * Why bother if there's no read permissions * anymore? For the rest, we need to leave * the write permissions on for COW, or * remove them entirely if configured to. */ if (!mac_mmap_revocation_via_cow) { vme->max_protection &= ~VM_PROT_WRITE; vme->protection &= ~VM_PROT_WRITE; } if ((revokeperms & VM_PROT_READ) == 0) vme->eflags |= MAP_ENTRY_COW | MAP_ENTRY_NEEDS_COPY; } if (revokeperms & VM_PROT_EXECUTE) { vme->max_protection &= ~VM_PROT_EXECUTE; vme->protection &= ~VM_PROT_EXECUTE; } if (revokeperms & VM_PROT_READ) { vme->max_protection = 0; vme->protection = 0; } pmap_protect(map->pmap, vme->start, vme->end, vme->protection & ~revokeperms); vm_map_simplify_entry(map, vme); } vm_map_lock_downgrade(map); } vm_map_unlock_read(map); } /* * When the subject's label changes, it may require revocation of privilege * to mapped objects. This can't be done on-the-fly later with a unified * buffer cache. */ static void mac_relabel_cred(struct ucred *cred, struct label *newlabel) { MAC_PERFORM(relabel_cred, cred, newlabel); } void mac_relabel_vnode(struct ucred *cred, struct vnode *vp, struct label *newlabel) { MAC_PERFORM(relabel_vnode, cred, vp, &vp->v_label, newlabel); } void mac_create_ifnet(struct ifnet *ifnet) { MAC_PERFORM(create_ifnet, ifnet, &ifnet->if_label); } void mac_create_bpfdesc(struct ucred *cred, struct bpf_d *bpf_d) { MAC_PERFORM(create_bpfdesc, cred, bpf_d, &bpf_d->bd_label); } void mac_create_socket(struct ucred *cred, struct socket *socket) { MAC_PERFORM(create_socket, cred, socket, &socket->so_label); } void mac_create_pipe(struct ucred *cred, struct pipe *pipe) { MAC_PERFORM(create_pipe, cred, pipe, pipe->pipe_label); } void mac_create_socket_from_socket(struct socket *oldsocket, struct socket *newsocket) { MAC_PERFORM(create_socket_from_socket, oldsocket, &oldsocket->so_label, newsocket, &newsocket->so_label); } static void mac_relabel_socket(struct ucred *cred, struct socket *socket, struct label *newlabel) { MAC_PERFORM(relabel_socket, cred, socket, &socket->so_label, newlabel); } static void mac_relabel_pipe(struct ucred *cred, struct pipe *pipe, struct label *newlabel) { MAC_PERFORM(relabel_pipe, cred, pipe, pipe->pipe_label, newlabel); } void mac_set_socket_peer_from_mbuf(struct mbuf *mbuf, struct socket *socket) { MAC_PERFORM(set_socket_peer_from_mbuf, mbuf, &mbuf->m_pkthdr.label, socket, &socket->so_peerlabel); } void mac_set_socket_peer_from_socket(struct socket *oldsocket, struct socket *newsocket) { MAC_PERFORM(set_socket_peer_from_socket, oldsocket, &oldsocket->so_label, newsocket, &newsocket->so_peerlabel); } void mac_create_datagram_from_ipq(struct ipq *ipq, struct mbuf *datagram) { MAC_PERFORM(create_datagram_from_ipq, ipq, &ipq->ipq_label, datagram, &datagram->m_pkthdr.label); } void mac_create_fragment(struct mbuf *datagram, struct mbuf *fragment) { MAC_PERFORM(create_fragment, datagram, &datagram->m_pkthdr.label, fragment, &fragment->m_pkthdr.label); } void mac_create_ipq(struct mbuf *fragment, struct ipq *ipq) { MAC_PERFORM(create_ipq, fragment, &fragment->m_pkthdr.label, ipq, &ipq->ipq_label); } void mac_create_mbuf_from_mbuf(struct mbuf *oldmbuf, struct mbuf *newmbuf) { MAC_PERFORM(create_mbuf_from_mbuf, oldmbuf, &oldmbuf->m_pkthdr.label, newmbuf, &newmbuf->m_pkthdr.label); } void mac_create_mbuf_from_bpfdesc(struct bpf_d *bpf_d, struct mbuf *mbuf) { MAC_PERFORM(create_mbuf_from_bpfdesc, bpf_d, &bpf_d->bd_label, mbuf, &mbuf->m_pkthdr.label); } void mac_create_mbuf_linklayer(struct ifnet *ifnet, struct mbuf *mbuf) { MAC_PERFORM(create_mbuf_linklayer, ifnet, &ifnet->if_label, mbuf, &mbuf->m_pkthdr.label); } void mac_create_mbuf_from_ifnet(struct ifnet *ifnet, struct mbuf *mbuf) { MAC_PERFORM(create_mbuf_from_ifnet, ifnet, &ifnet->if_label, mbuf, &mbuf->m_pkthdr.label); } void mac_create_mbuf_multicast_encap(struct mbuf *oldmbuf, struct ifnet *ifnet, struct mbuf *newmbuf) { MAC_PERFORM(create_mbuf_multicast_encap, oldmbuf, &oldmbuf->m_pkthdr.label, ifnet, &ifnet->if_label, newmbuf, &newmbuf->m_pkthdr.label); } void mac_create_mbuf_netlayer(struct mbuf *oldmbuf, struct mbuf *newmbuf) { MAC_PERFORM(create_mbuf_netlayer, oldmbuf, &oldmbuf->m_pkthdr.label, newmbuf, &newmbuf->m_pkthdr.label); } int mac_fragment_match(struct mbuf *fragment, struct ipq *ipq) { int result; result = 1; MAC_BOOLEAN(fragment_match, &&, fragment, &fragment->m_pkthdr.label, ipq, &ipq->ipq_label); return (result); } void mac_update_ipq(struct mbuf *fragment, struct ipq *ipq) { MAC_PERFORM(update_ipq, fragment, &fragment->m_pkthdr.label, ipq, &ipq->ipq_label); } void mac_create_mbuf_from_socket(struct socket *socket, struct mbuf *mbuf) { MAC_PERFORM(create_mbuf_from_socket, socket, &socket->so_label, mbuf, &mbuf->m_pkthdr.label); } void mac_create_mount(struct ucred *cred, struct mount *mp) { MAC_PERFORM(create_mount, cred, mp, &mp->mnt_mntlabel, &mp->mnt_fslabel); } void mac_create_root_mount(struct ucred *cred, struct mount *mp) { MAC_PERFORM(create_root_mount, cred, mp, &mp->mnt_mntlabel, &mp->mnt_fslabel); } int mac_check_bpfdesc_receive(struct bpf_d *bpf_d, struct ifnet *ifnet) { int error; if (!mac_enforce_network) return (0); MAC_CHECK(check_bpfdesc_receive, bpf_d, &bpf_d->bd_label, ifnet, &ifnet->if_label); return (error); } static int mac_check_cred_relabel(struct ucred *cred, struct label *newlabel) { int error; MAC_CHECK(check_cred_relabel, cred, newlabel); return (error); } int mac_check_cred_visible(struct ucred *u1, struct ucred *u2) { int error; if (!mac_enforce_process) return (0); MAC_CHECK(check_cred_visible, u1, u2); return (error); } int mac_check_ifnet_transmit(struct ifnet *ifnet, struct mbuf *mbuf) { int error; if (!mac_enforce_network) return (0); KASSERT(mbuf->m_flags & M_PKTHDR, ("packet has no pkthdr")); if (!(mbuf->m_pkthdr.label.l_flags & MAC_FLAG_INITIALIZED)) printf("%s%d: not initialized\n", ifnet->if_name, ifnet->if_unit); MAC_CHECK(check_ifnet_transmit, ifnet, &ifnet->if_label, mbuf, &mbuf->m_pkthdr.label); return (error); } int mac_check_mount_stat(struct ucred *cred, struct mount *mount) { int error; if (!mac_enforce_fs) return (0); MAC_CHECK(check_mount_stat, cred, mount, &mount->mnt_mntlabel); return (error); } int mac_check_pipe_ioctl(struct ucred *cred, struct pipe *pipe, unsigned long cmd, void *data) { int error; PIPE_LOCK_ASSERT(pipe, MA_OWNED); if (!mac_enforce_pipe) return (0); MAC_CHECK(check_pipe_ioctl, cred, pipe, pipe->pipe_label, cmd, data); return (error); } int mac_check_pipe_poll(struct ucred *cred, struct pipe *pipe) { int error; PIPE_LOCK_ASSERT(pipe, MA_OWNED); if (!mac_enforce_pipe) return (0); MAC_CHECK(check_pipe_poll, cred, pipe, pipe->pipe_label); return (error); } int mac_check_pipe_read(struct ucred *cred, struct pipe *pipe) { int error; PIPE_LOCK_ASSERT(pipe, MA_OWNED); if (!mac_enforce_pipe) return (0); MAC_CHECK(check_pipe_read, cred, pipe, pipe->pipe_label); return (error); } static int mac_check_pipe_relabel(struct ucred *cred, struct pipe *pipe, struct label *newlabel) { int error; PIPE_LOCK_ASSERT(pipe, MA_OWNED); if (!mac_enforce_pipe) return (0); MAC_CHECK(check_pipe_relabel, cred, pipe, pipe->pipe_label, newlabel); return (error); } int mac_check_pipe_stat(struct ucred *cred, struct pipe *pipe) { int error; PIPE_LOCK_ASSERT(pipe, MA_OWNED); if (!mac_enforce_pipe) return (0); MAC_CHECK(check_pipe_stat, cred, pipe, pipe->pipe_label); return (error); } int mac_check_pipe_write(struct ucred *cred, struct pipe *pipe) { int error; PIPE_LOCK_ASSERT(pipe, MA_OWNED); if (!mac_enforce_pipe) return (0); MAC_CHECK(check_pipe_write, cred, pipe, pipe->pipe_label); return (error); } int mac_check_proc_debug(struct ucred *cred, struct proc *proc) { int error; PROC_LOCK_ASSERT(proc, MA_OWNED); if (!mac_enforce_process) return (0); MAC_CHECK(check_proc_debug, cred, proc); return (error); } int mac_check_proc_sched(struct ucred *cred, struct proc *proc) { int error; PROC_LOCK_ASSERT(proc, MA_OWNED); if (!mac_enforce_process) return (0); MAC_CHECK(check_proc_sched, cred, proc); return (error); } int mac_check_proc_signal(struct ucred *cred, struct proc *proc, int signum) { int error; PROC_LOCK_ASSERT(proc, MA_OWNED); if (!mac_enforce_process) return (0); MAC_CHECK(check_proc_signal, cred, proc, signum); return (error); } int mac_check_socket_bind(struct ucred *ucred, struct socket *socket, struct sockaddr *sockaddr) { int error; if (!mac_enforce_socket) return (0); MAC_CHECK(check_socket_bind, ucred, socket, &socket->so_label, sockaddr); return (error); } int mac_check_socket_connect(struct ucred *cred, struct socket *socket, struct sockaddr *sockaddr) { int error; if (!mac_enforce_socket) return (0); MAC_CHECK(check_socket_connect, cred, socket, &socket->so_label, sockaddr); return (error); } int mac_check_socket_deliver(struct socket *socket, struct mbuf *mbuf) { int error; if (!mac_enforce_socket) return (0); MAC_CHECK(check_socket_deliver, socket, &socket->so_label, mbuf, &mbuf->m_pkthdr.label); return (error); } int mac_check_socket_listen(struct ucred *cred, struct socket *socket) { int error; if (!mac_enforce_socket) return (0); MAC_CHECK(check_socket_listen, cred, socket, &socket->so_label); return (error); } static int mac_check_socket_relabel(struct ucred *cred, struct socket *socket, struct label *newlabel) { int error; MAC_CHECK(check_socket_relabel, cred, socket, &socket->so_label, newlabel); return (error); } int mac_check_socket_visible(struct ucred *cred, struct socket *socket) { int error; if (!mac_enforce_socket) return (0); MAC_CHECK(check_socket_visible, cred, socket, &socket->so_label); return (error); } int mac_ioctl_ifnet_get(struct ucred *cred, struct ifreq *ifr, struct ifnet *ifnet) { struct mac label; int error; error = mac_externalize(&ifnet->if_label, &label); if (error) return (error); return (copyout(&label, ifr->ifr_ifru.ifru_data, sizeof(label))); } int mac_ioctl_ifnet_set(struct ucred *cred, struct ifreq *ifr, struct ifnet *ifnet) { struct mac newlabel; struct label intlabel; int error; error = copyin(ifr->ifr_ifru.ifru_data, &newlabel, sizeof(newlabel)); if (error) return (error); error = mac_internalize(&intlabel, &newlabel); if (error) return (error); /* * XXX: Note that this is a redundant privilege check, since * policies impose this check themselves if required by the * policy. Eventually, this should go away. */ error = suser_cred(cred, 0); if (error) goto out; MAC_CHECK(check_ifnet_relabel, cred, ifnet, &ifnet->if_label, &intlabel); if (error) goto out; MAC_PERFORM(relabel_ifnet, cred, ifnet, &ifnet->if_label, &intlabel); out: mac_destroy_temp(&intlabel); return (error); } void mac_create_devfs_vnode(struct devfs_dirent *de, struct vnode *vp) { MAC_PERFORM(create_devfs_vnode, de, &de->de_label, vp, &vp->v_label); } void mac_create_devfs_device(dev_t dev, struct devfs_dirent *de) { MAC_PERFORM(create_devfs_device, dev, de, &de->de_label); } static int mac_stdcreatevnode_ea(struct vnode *vp) { int error; MAC_CHECK(stdcreatevnode_ea, vp, &vp->v_label); return (error); } void mac_create_devfs_directory(char *dirname, int dirnamelen, struct devfs_dirent *de) { MAC_PERFORM(create_devfs_directory, dirname, dirnamelen, de, &de->de_label); } /* * When a new vnode is created, this call will initialize its label. */ void mac_create_vnode(struct ucred *cred, struct vnode *parent, struct vnode *child) { int error; ASSERT_VOP_LOCKED(parent, "mac_create_vnode"); ASSERT_VOP_LOCKED(child, "mac_create_vnode"); error = vn_refreshlabel(parent, cred); if (error) { printf("mac_create_vnode: vn_refreshlabel returned %d\n", error); printf("mac_create_vnode: using old vnode label\n"); } MAC_PERFORM(create_vnode, cred, parent, &parent->v_label, child, &child->v_label); } int mac_setsockopt_label_set(struct ucred *cred, struct socket *so, struct mac *extmac) { struct label intlabel; int error; error = mac_internalize(&intlabel, extmac); if (error) return (error); mac_check_socket_relabel(cred, so, &intlabel); if (error) { mac_destroy_temp(&intlabel); return (error); } mac_relabel_socket(cred, so, &intlabel); mac_destroy_temp(&intlabel); return (0); } int mac_pipe_label_set(struct ucred *cred, struct pipe *pipe, struct label *label) { int error; PIPE_LOCK_ASSERT(pipe, MA_OWNED); error = mac_check_pipe_relabel(cred, pipe, label); if (error) return (error); mac_relabel_pipe(cred, pipe, label); return (0); } int mac_getsockopt_label_get(struct ucred *cred, struct socket *so, struct mac *extmac) { return (mac_externalize(&so->so_label, extmac)); } int mac_getsockopt_peerlabel_get(struct ucred *cred, struct socket *so, struct mac *extmac) { return (mac_externalize(&so->so_peerlabel, extmac)); } /* * Implementation of VOP_SETLABEL() that relies on extended attributes * to store label data. Can be referenced by filesystems supporting * extended attributes. */ int vop_stdsetlabel_ea(struct vop_setlabel_args *ap) { struct vnode *vp = ap->a_vp; struct label *intlabel = ap->a_label; struct mac extmac; int error; ASSERT_VOP_LOCKED(vp, "vop_stdsetlabel_ea"); /* * XXX: Eventually call out to EA check/set calls here. * Be particularly careful to avoid race conditions, * consistency problems, and stability problems when * dealing with multiple EAs. In particular, we require * the ability to write multiple EAs on the same file in * a single transaction, which the current EA interface * does not provide. */ error = mac_externalize(intlabel, &extmac); if (error) return (error); error = vn_extattr_set(vp, IO_NODELOCKED, FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME, sizeof(extmac), (char *)&extmac, curthread); if (error) return (error); mac_relabel_vnode(ap->a_cred, vp, intlabel); vp->v_vflag |= VV_CACHEDLABEL; return (0); } static int vn_setlabel(struct vnode *vp, struct label *intlabel, struct ucred *cred) { int error; if (vp->v_mount == NULL) { /* printf("vn_setlabel: null v_mount\n"); */ if (vp->v_type != VNON) printf("vn_setlabel: null v_mount with non-VNON\n"); return (EBADF); } if ((vp->v_mount->mnt_flag & MNT_MULTILABEL) == 0) return (EOPNOTSUPP); /* * Multi-phase commit. First check the policies to confirm the * change is OK. Then commit via the filesystem. Finally, * update the actual vnode label. Question: maybe the filesystem * should update the vnode at the end as part of VOP_SETLABEL()? */ error = mac_check_vnode_relabel(cred, vp, intlabel); if (error) return (error); /* * VADMIN provides the opportunity for the filesystem to make * decisions about who is and is not able to modify labels * and protections on files. This might not be right. We can't * assume VOP_SETLABEL() will do it, because we might implement * that as part of vop_stdsetlabel_ea(). */ error = VOP_ACCESS(vp, VADMIN, cred, curthread); if (error) return (error); error = VOP_SETLABEL(vp, intlabel, cred, curthread); if (error) return (error); return (0); } /* * MPSAFE */ int __mac_get_proc(struct thread *td, struct __mac_get_proc_args *uap) { struct mac extmac; int error; error = mac_externalize(&td->td_ucred->cr_label, &extmac); if (error == 0) error = copyout(&extmac, SCARG(uap, mac_p), sizeof(extmac)); return (error); } /* * MPSAFE */ int __mac_set_proc(struct thread *td, struct __mac_set_proc_args *uap) { struct ucred *newcred, *oldcred; struct proc *p; struct mac extmac; struct label intlabel; int error; error = copyin(SCARG(uap, mac_p), &extmac, sizeof(extmac)); if (error) return (error); error = mac_internalize(&intlabel, &extmac); if (error) return (error); newcred = crget(); p = td->td_proc; PROC_LOCK(p); oldcred = p->p_ucred; error = mac_check_cred_relabel(oldcred, &intlabel); if (error) { PROC_UNLOCK(p); mac_destroy_temp(&intlabel); crfree(newcred); return (error); } setsugid(p); crcopy(newcred, oldcred); mac_relabel_cred(newcred, &intlabel); p->p_ucred = newcred; /* * Grab additional reference for use while revoking mmaps, prior * to releasing the proc lock and sharing the cred. */ crhold(newcred); PROC_UNLOCK(p); mtx_lock(&Giant); mac_cred_mmapped_drop_perms(td, newcred); mtx_unlock(&Giant); crfree(newcred); /* Free revocation reference. */ crfree(oldcred); mac_destroy_temp(&intlabel); return (0); } /* * MPSAFE */ int __mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap) { struct file *fp; struct mac extmac; struct vnode *vp; struct pipe *pipe; int error; mtx_lock(&Giant); error = fget(td, SCARG(uap, fd), &fp); if (error) goto out; switch (fp->f_type) { case DTYPE_FIFO: case DTYPE_VNODE: vp = (struct vnode *)fp->f_data; vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); error = vn_refreshlabel(vp, td->td_ucred); if (error == 0) error = mac_externalize(&vp->v_label, &extmac); VOP_UNLOCK(vp, 0, td); break; case DTYPE_PIPE: pipe = (struct pipe *)fp->f_data; error = mac_externalize(pipe->pipe_label, &extmac); break; default: error = EINVAL; } if (error == 0) error = copyout(&extmac, SCARG(uap, mac_p), sizeof(extmac)); fdrop(fp, td); out: mtx_unlock(&Giant); return (error); } /* * MPSAFE */ int __mac_get_file(struct thread *td, struct __mac_get_file_args *uap) { struct nameidata nd; struct mac extmac; int error; mtx_lock(&Giant); NDINIT(&nd, LOOKUP, LOCKLEAF | FOLLOW, UIO_USERSPACE, SCARG(uap, path_p), td); error = namei(&nd); if (error) goto out; error = vn_refreshlabel(nd.ni_vp, td->td_ucred); if (error == 0) error = mac_externalize(&nd.ni_vp->v_label, &extmac); NDFREE(&nd, 0); if (error) goto out; error = copyout(&extmac, SCARG(uap, mac_p), sizeof(extmac)); out: mtx_unlock(&Giant); return (error); } /* * MPSAFE */ int __mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap) { struct file *fp; struct mac extmac; struct label intlabel; struct mount *mp; struct vnode *vp; struct pipe *pipe; int error; mtx_lock(&Giant); error = fget(td, SCARG(uap, fd), &fp); if (error) goto out1; error = copyin(SCARG(uap, mac_p), &extmac, sizeof(extmac)); if (error) goto out2; error = mac_internalize(&intlabel, &extmac); if (error) goto out2; switch (fp->f_type) { case DTYPE_FIFO: case DTYPE_VNODE: vp = (struct vnode *)fp->f_data; error = vn_start_write(vp, &mp, V_WAIT | PCATCH); if (error != 0) break; vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); error = vn_setlabel(vp, &intlabel, td->td_ucred); VOP_UNLOCK(vp, 0, td); vn_finished_write(mp); mac_destroy_temp(&intlabel); break; case DTYPE_PIPE: pipe = (struct pipe *)fp->f_data; PIPE_LOCK(pipe); error = mac_pipe_label_set(td->td_ucred, pipe, &intlabel); PIPE_UNLOCK(pipe); break; default: error = EINVAL; } out2: fdrop(fp, td); out1: mtx_unlock(&Giant); return (error); } /* * MPSAFE */ int __mac_set_file(struct thread *td, struct __mac_set_file_args *uap) { struct nameidata nd; struct mac extmac; struct label intlabel; struct mount *mp; int error; mtx_lock(&Giant); error = copyin(SCARG(uap, mac_p), &extmac, sizeof(extmac)); if (error) goto out; error = mac_internalize(&intlabel, &extmac); if (error) goto out; NDINIT(&nd, LOOKUP, LOCKLEAF | FOLLOW, UIO_USERSPACE, SCARG(uap, path_p), td); error = namei(&nd); if (error) goto out2; error = vn_start_write(nd.ni_vp, &mp, V_WAIT | PCATCH); if (error) goto out2; error = vn_setlabel(nd.ni_vp, &intlabel, td->td_ucred); vn_finished_write(mp); out2: mac_destroy_temp(&intlabel); NDFREE(&nd, 0); out: mtx_unlock(&Giant); return (error); } int mac_syscall(struct thread *td, struct mac_syscall_args *uap) { struct mac_policy_conf *mpc; char target[MAC_MAX_POLICY_NAME]; int error; error = copyinstr(SCARG(uap, policy), target, sizeof(target), NULL); if (error) return (error); error = ENOSYS; MAC_POLICY_LIST_BUSY(); LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { if (strcmp(mpc->mpc_name, target) == 0 && mpc->mpc_ops->mpo_syscall != NULL) { error = mpc->mpc_ops->mpo_syscall(td, SCARG(uap, call), SCARG(uap, arg)); goto out; } } out: MAC_POLICY_LIST_UNBUSY(); return (error); } SYSINIT(mac, SI_SUB_MAC, SI_ORDER_FIRST, mac_init, NULL); SYSINIT(mac_late, SI_SUB_MAC_LATE, SI_ORDER_FIRST, mac_late_init, NULL); #else /* !MAC */ int __mac_get_proc(struct thread *td, struct __mac_get_proc_args *uap) { return (ENOSYS); } int __mac_set_proc(struct thread *td, struct __mac_set_proc_args *uap) { return (ENOSYS); } int __mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap) { return (ENOSYS); } int __mac_get_file(struct thread *td, struct __mac_get_file_args *uap) { return (ENOSYS); } int __mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap) { return (ENOSYS); } int __mac_set_file(struct thread *td, struct __mac_set_file_args *uap) { return (ENOSYS); } int mac_syscall(struct thread *td, struct mac_syscall_args *uap) { return (ENOSYS); } #endif /* !MAC */ Index: head/sys/security/mac/mac_syscalls.c =================================================================== --- head/sys/security/mac/mac_syscalls.c (revision 104528) +++ head/sys/security/mac/mac_syscalls.c (revision 104529) @@ -1,3432 +1,3462 @@ /*- * Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson * Copyright (c) 2001 Ilmar S. Habibulin * Copyright (c) 2001, 2002 Networks Associates Technology, Inc. * All rights reserved. * * This software was developed by Robert Watson and Ilmar Habibulin for the * TrustedBSD Project. * * This software was developed for the FreeBSD Project in part by NAI Labs, * the Security Research Division of Network Associates, Inc. under * DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA * CHATS research program. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * 3. The names of the authors may not be used to endorse or promote * products derived from this software without specific prior written * permission. * * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. * * $FreeBSD$ */ /* * Developed by the TrustedBSD Project. * * Framework for extensible kernel access control. Kernel and userland * interface to the framework, policy registration and composition. */ #include "opt_mac.h" #include "opt_devfs.h" #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #ifdef MAC /* * Declare that the kernel provides MAC support, version 1. This permits * modules to refuse to be loaded if the necessary support isn't present, * even if it's pre-boot. */ MODULE_VERSION(kernel_mac_support, 1); SYSCTL_DECL(_security); SYSCTL_NODE(_security, OID_AUTO, mac, CTLFLAG_RW, 0, "TrustedBSD MAC policy controls"); #ifndef MAC_MAX_POLICIES #define MAC_MAX_POLICIES 8 #endif #if MAC_MAX_POLICIES > 32 #error "MAC_MAX_POLICIES too large" #endif static unsigned int mac_max_policies = MAC_MAX_POLICIES; static unsigned int mac_policy_offsets_free = (1 << MAC_MAX_POLICIES) - 1; SYSCTL_UINT(_security_mac, OID_AUTO, max_policies, CTLFLAG_RD, &mac_max_policies, 0, ""); static int mac_late = 0; static int mac_enforce_fs = 1; SYSCTL_INT(_security_mac, OID_AUTO, enforce_fs, CTLFLAG_RW, &mac_enforce_fs, 0, "Enforce MAC policy on file system objects"); TUNABLE_INT("security.mac.enforce_fs", &mac_enforce_fs); static int mac_enforce_network = 1; SYSCTL_INT(_security_mac, OID_AUTO, enforce_network, CTLFLAG_RW, &mac_enforce_network, 0, "Enforce MAC policy on network packets"); TUNABLE_INT("security.mac.enforce_network", &mac_enforce_network); static int mac_enforce_pipe = 1; SYSCTL_INT(_security_mac, OID_AUTO, enforce_pipe, CTLFLAG_RW, &mac_enforce_pipe, 0, "Enforce MAC policy on pipe operations"); TUNABLE_INT("security.mac.enforce_pipe", &mac_enforce_pipe); static int mac_enforce_process = 1; SYSCTL_INT(_security_mac, OID_AUTO, enforce_process, CTLFLAG_RW, &mac_enforce_process, 0, "Enforce MAC policy on inter-process operations"); TUNABLE_INT("security.mac.enforce_process", &mac_enforce_process); static int mac_enforce_socket = 1; SYSCTL_INT(_security_mac, OID_AUTO, enforce_socket, CTLFLAG_RW, &mac_enforce_socket, 0, "Enforce MAC policy on socket operations"); TUNABLE_INT("security.mac.enforce_socket", &mac_enforce_socket); static int mac_enforce_vm = 1; SYSCTL_INT(_security_mac, OID_AUTO, enforce_vm, CTLFLAG_RW, &mac_enforce_vm, 0, "Enforce MAC policy on vm operations"); TUNABLE_INT("security.mac.enforce_vm", &mac_enforce_vm); static int mac_label_size = sizeof(struct mac); SYSCTL_INT(_security_mac, OID_AUTO, label_size, CTLFLAG_RD, &mac_label_size, 0, "Pre-compiled MAC label size"); static int mac_cache_fslabel_in_vnode = 1; SYSCTL_INT(_security_mac, OID_AUTO, cache_fslabel_in_vnode, CTLFLAG_RW, &mac_cache_fslabel_in_vnode, 0, "Cache mount fslabel in vnode"); TUNABLE_INT("security.mac.cache_fslabel_in_vnode", &mac_cache_fslabel_in_vnode); static int mac_vnode_label_cache_hits = 0; SYSCTL_INT(_security_mac, OID_AUTO, vnode_label_cache_hits, CTLFLAG_RD, &mac_vnode_label_cache_hits, 0, "Cache hits on vnode labels"); static int mac_vnode_label_cache_misses = 0; SYSCTL_INT(_security_mac, OID_AUTO, vnode_label_cache_misses, CTLFLAG_RD, &mac_vnode_label_cache_misses, 0, "Cache misses on vnode labels"); static int mac_mmap_revocation = 1; SYSCTL_INT(_security_mac, OID_AUTO, mmap_revocation, CTLFLAG_RW, &mac_mmap_revocation, 0, "Revoke mmap access to files on subject " "relabel"); static int mac_mmap_revocation_via_cow = 0; SYSCTL_INT(_security_mac, OID_AUTO, mmap_revocation_via_cow, CTLFLAG_RW, &mac_mmap_revocation_via_cow, 0, "Revoke mmap access to files via " "copy-on-write semantics, or by removing all write access"); #ifdef MAC_DEBUG SYSCTL_NODE(_security_mac, OID_AUTO, debug, CTLFLAG_RW, 0, "TrustedBSD MAC debug info"); static int mac_debug_label_fallback = 0; SYSCTL_INT(_security_mac_debug, OID_AUTO, label_fallback, CTLFLAG_RW, &mac_debug_label_fallback, 0, "Filesystems should fall back to fs label" "when label is corrupted."); TUNABLE_INT("security.mac.debug_label_fallback", &mac_debug_label_fallback); SYSCTL_NODE(_security_mac_debug, OID_AUTO, counters, CTLFLAG_RW, 0, "TrustedBSD MAC object counters"); static unsigned int nmacmbufs, nmaccreds, nmacifnets, nmacbpfdescs, nmacsockets, nmacmounts, nmactemp, nmacvnodes, nmacdevfsdirents, nmacipqs, nmacpipes; SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, mbufs, CTLFLAG_RD, &nmacmbufs, 0, "number of mbufs in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, creds, CTLFLAG_RD, &nmaccreds, 0, "number of ucreds in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, ifnets, CTLFLAG_RD, &nmacifnets, 0, "number of ifnets in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, ipqs, CTLFLAG_RD, &nmacipqs, 0, "number of ipqs in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, bpfdescs, CTLFLAG_RD, &nmacbpfdescs, 0, "number of bpfdescs in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, sockets, CTLFLAG_RD, &nmacsockets, 0, "number of sockets in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, pipes, CTLFLAG_RD, &nmacpipes, 0, "number of pipes in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, mounts, CTLFLAG_RD, &nmacmounts, 0, "number of mounts in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, temp, CTLFLAG_RD, &nmactemp, 0, "number of temporary labels in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, vnodes, CTLFLAG_RD, &nmacvnodes, 0, "number of vnodes in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, devfsdirents, CTLFLAG_RD, &nmacdevfsdirents, 0, "number of devfs dirents inuse"); #endif static int error_select(int error1, int error2); static int mac_externalize(struct label *label, struct mac *mac); static int mac_policy_register(struct mac_policy_conf *mpc); static int mac_policy_unregister(struct mac_policy_conf *mpc); static int mac_stdcreatevnode_ea(struct vnode *vp); static void mac_cred_mmapped_drop_perms(struct thread *td, struct ucred *cred); static void mac_cred_mmapped_drop_perms_recurse(struct thread *td, struct ucred *cred, struct vm_map *map); MALLOC_DEFINE(M_MACOPVEC, "macopvec", "MAC policy operation vector"); MALLOC_DEFINE(M_MACPIPELABEL, "macpipelabel", "MAC labels for pipes"); /* * mac_policy_list_lock protects the consistency of 'mac_policy_list', * the linked list of attached policy modules. Read-only consumers of * the list must acquire a shared lock for the duration of their use; * writers must acquire an exclusive lock. Note that for compound * operations, locks should be held for the entire compound operation, * and that this is not yet done for relabel requests. */ static struct mtx mac_policy_list_lock; static LIST_HEAD(, mac_policy_conf) mac_policy_list; static int mac_policy_list_busy; #define MAC_POLICY_LIST_LOCKINIT() mtx_init(&mac_policy_list_lock, \ "mac_policy_list_lock", NULL, MTX_DEF); #define MAC_POLICY_LIST_LOCK() mtx_lock(&mac_policy_list_lock); #define MAC_POLICY_LIST_UNLOCK() mtx_unlock(&mac_policy_list_lock); #define MAC_POLICY_LIST_BUSY() do { \ MAC_POLICY_LIST_LOCK(); \ mac_policy_list_busy++; \ MAC_POLICY_LIST_UNLOCK(); \ } while (0) #define MAC_POLICY_LIST_UNBUSY() do { \ MAC_POLICY_LIST_LOCK(); \ mac_policy_list_busy--; \ if (mac_policy_list_busy < 0) \ panic("Extra mac_policy_list_busy--"); \ MAC_POLICY_LIST_UNLOCK(); \ } while (0) /* * MAC_CHECK performs the designated check by walking the policy * module list and checking with each as to how it feels about the * request. Note that it returns its value via 'error' in the scope * of the caller. */ #define MAC_CHECK(check, args...) do { \ struct mac_policy_conf *mpc; \ \ error = 0; \ MAC_POLICY_LIST_BUSY(); \ LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { \ if (mpc->mpc_ops->mpo_ ## check != NULL) \ error = error_select( \ mpc->mpc_ops->mpo_ ## check (args), \ error); \ } \ MAC_POLICY_LIST_UNBUSY(); \ } while (0) /* * MAC_BOOLEAN performs the designated boolean composition by walking * the module list, invoking each instance of the operation, and * combining the results using the passed C operator. Note that it * returns its value via 'result' in the scope of the caller, which * should be initialized by the caller in a meaningful way to get * a meaningful result. */ #define MAC_BOOLEAN(operation, composition, args...) do { \ struct mac_policy_conf *mpc; \ \ MAC_POLICY_LIST_BUSY(); \ LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { \ if (mpc->mpc_ops->mpo_ ## operation != NULL) \ result = result composition \ mpc->mpc_ops->mpo_ ## operation (args); \ } \ MAC_POLICY_LIST_UNBUSY(); \ } while (0) /* * MAC_PERFORM performs the designated operation by walking the policy * module list and invoking that operation for each policy. */ #define MAC_PERFORM(operation, args...) do { \ struct mac_policy_conf *mpc; \ \ MAC_POLICY_LIST_BUSY(); \ LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { \ if (mpc->mpc_ops->mpo_ ## operation != NULL) \ mpc->mpc_ops->mpo_ ## operation (args); \ } \ MAC_POLICY_LIST_UNBUSY(); \ } while (0) /* * Initialize the MAC subsystem, including appropriate SMP locks. */ static void mac_init(void) { LIST_INIT(&mac_policy_list); MAC_POLICY_LIST_LOCKINIT(); } /* * For the purposes of modules that want to know if they were loaded * "early", set the mac_late flag once we've processed modules either * linked into the kernel, or loaded before the kernel startup. */ static void mac_late_init(void) { mac_late = 1; } /* * Allow MAC policy modules to register during boot, etc. */ int mac_policy_modevent(module_t mod, int type, void *data) { struct mac_policy_conf *mpc; int error; error = 0; mpc = (struct mac_policy_conf *) data; switch (type) { case MOD_LOAD: if (mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_NOTLATE && mac_late) { printf("mac_policy_modevent: can't load %s policy " "after booting\n", mpc->mpc_name); error = EBUSY; break; } error = mac_policy_register(mpc); break; case MOD_UNLOAD: /* Don't unregister the module if it was never registered. */ if ((mpc->mpc_runtime_flags & MPC_RUNTIME_FLAG_REGISTERED) != 0) error = mac_policy_unregister(mpc); else error = 0; break; default: break; } return (error); } static int mac_policy_register(struct mac_policy_conf *mpc) { struct mac_policy_conf *tmpc; struct mac_policy_op_entry *mpe; int slot; MALLOC(mpc->mpc_ops, struct mac_policy_ops *, sizeof(*mpc->mpc_ops), M_MACOPVEC, M_WAITOK | M_ZERO); for (mpe = mpc->mpc_entries; mpe->mpe_constant != MAC_OP_LAST; mpe++) { switch (mpe->mpe_constant) { case MAC_OP_LAST: /* * Doesn't actually happen, but this allows checking * that all enumerated values are handled. */ break; case MAC_DESTROY: mpc->mpc_ops->mpo_destroy = mpe->mpe_function; break; case MAC_INIT: mpc->mpc_ops->mpo_init = mpe->mpe_function; break; case MAC_SYSCALL: mpc->mpc_ops->mpo_syscall = mpe->mpe_function; break; case MAC_INIT_BPFDESC_LABEL: mpc->mpc_ops->mpo_init_bpfdesc_label = mpe->mpe_function; break; case MAC_INIT_CRED_LABEL: mpc->mpc_ops->mpo_init_cred_label = mpe->mpe_function; break; case MAC_INIT_DEVFSDIRENT_LABEL: mpc->mpc_ops->mpo_init_devfsdirent_label = mpe->mpe_function; break; case MAC_INIT_IFNET_LABEL: mpc->mpc_ops->mpo_init_ifnet_label = mpe->mpe_function; break; case MAC_INIT_IPQ_LABEL: mpc->mpc_ops->mpo_init_ipq_label = mpe->mpe_function; break; case MAC_INIT_MBUF_LABEL: mpc->mpc_ops->mpo_init_mbuf_label = mpe->mpe_function; break; case MAC_INIT_MOUNT_LABEL: mpc->mpc_ops->mpo_init_mount_label = mpe->mpe_function; break; case MAC_INIT_MOUNT_FS_LABEL: mpc->mpc_ops->mpo_init_mount_fs_label = mpe->mpe_function; break; case MAC_INIT_PIPE_LABEL: mpc->mpc_ops->mpo_init_pipe_label = mpe->mpe_function; break; case MAC_INIT_SOCKET_LABEL: mpc->mpc_ops->mpo_init_socket_label = mpe->mpe_function; break; case MAC_INIT_SOCKET_PEER_LABEL: mpc->mpc_ops->mpo_init_socket_peer_label = mpe->mpe_function; break; case MAC_INIT_TEMP_LABEL: mpc->mpc_ops->mpo_init_temp_label = mpe->mpe_function; break; case MAC_INIT_VNODE_LABEL: mpc->mpc_ops->mpo_init_vnode_label = mpe->mpe_function; break; case MAC_DESTROY_BPFDESC_LABEL: mpc->mpc_ops->mpo_destroy_bpfdesc_label = mpe->mpe_function; break; case MAC_DESTROY_CRED_LABEL: mpc->mpc_ops->mpo_destroy_cred_label = mpe->mpe_function; break; case MAC_DESTROY_DEVFSDIRENT_LABEL: mpc->mpc_ops->mpo_destroy_devfsdirent_label = mpe->mpe_function; break; case MAC_DESTROY_IFNET_LABEL: mpc->mpc_ops->mpo_destroy_ifnet_label = mpe->mpe_function; break; case MAC_DESTROY_IPQ_LABEL: mpc->mpc_ops->mpo_destroy_ipq_label = mpe->mpe_function; break; case MAC_DESTROY_MBUF_LABEL: mpc->mpc_ops->mpo_destroy_mbuf_label = mpe->mpe_function; break; case MAC_DESTROY_MOUNT_LABEL: mpc->mpc_ops->mpo_destroy_mount_label = mpe->mpe_function; break; case MAC_DESTROY_MOUNT_FS_LABEL: mpc->mpc_ops->mpo_destroy_mount_fs_label = mpe->mpe_function; break; case MAC_DESTROY_PIPE_LABEL: mpc->mpc_ops->mpo_destroy_pipe_label = mpe->mpe_function; break; case MAC_DESTROY_SOCKET_LABEL: mpc->mpc_ops->mpo_destroy_socket_label = mpe->mpe_function; break; case MAC_DESTROY_SOCKET_PEER_LABEL: mpc->mpc_ops->mpo_destroy_socket_peer_label = mpe->mpe_function; break; case MAC_DESTROY_TEMP_LABEL: mpc->mpc_ops->mpo_destroy_temp_label = mpe->mpe_function; break; case MAC_DESTROY_VNODE_LABEL: mpc->mpc_ops->mpo_destroy_vnode_label = mpe->mpe_function; break; case MAC_EXTERNALIZE: mpc->mpc_ops->mpo_externalize = mpe->mpe_function; break; case MAC_INTERNALIZE: mpc->mpc_ops->mpo_internalize = mpe->mpe_function; break; case MAC_CREATE_DEVFS_DEVICE: mpc->mpc_ops->mpo_create_devfs_device = mpe->mpe_function; break; case MAC_CREATE_DEVFS_DIRECTORY: mpc->mpc_ops->mpo_create_devfs_directory = mpe->mpe_function; break; case MAC_CREATE_DEVFS_VNODE: mpc->mpc_ops->mpo_create_devfs_vnode = mpe->mpe_function; break; case MAC_STDCREATEVNODE_EA: mpc->mpc_ops->mpo_stdcreatevnode_ea = mpe->mpe_function; break; case MAC_CREATE_VNODE: mpc->mpc_ops->mpo_create_vnode = mpe->mpe_function; break; case MAC_CREATE_MOUNT: mpc->mpc_ops->mpo_create_mount = mpe->mpe_function; break; case MAC_CREATE_ROOT_MOUNT: mpc->mpc_ops->mpo_create_root_mount = mpe->mpe_function; break; case MAC_RELABEL_VNODE: mpc->mpc_ops->mpo_relabel_vnode = mpe->mpe_function; break; case MAC_UPDATE_DEVFSDIRENT: mpc->mpc_ops->mpo_update_devfsdirent = mpe->mpe_function; break; case MAC_UPDATE_PROCFSVNODE: mpc->mpc_ops->mpo_update_procfsvnode = mpe->mpe_function; break; case MAC_UPDATE_VNODE_FROM_EXTATTR: mpc->mpc_ops->mpo_update_vnode_from_extattr = mpe->mpe_function; break; case MAC_UPDATE_VNODE_FROM_EXTERNALIZED: mpc->mpc_ops->mpo_update_vnode_from_externalized = mpe->mpe_function; break; case MAC_UPDATE_VNODE_FROM_MOUNT: mpc->mpc_ops->mpo_update_vnode_from_mount = mpe->mpe_function; break; case MAC_CREATE_MBUF_FROM_SOCKET: mpc->mpc_ops->mpo_create_mbuf_from_socket = mpe->mpe_function; break; case MAC_CREATE_PIPE: mpc->mpc_ops->mpo_create_pipe = mpe->mpe_function; break; case MAC_CREATE_SOCKET: mpc->mpc_ops->mpo_create_socket = mpe->mpe_function; break; case MAC_CREATE_SOCKET_FROM_SOCKET: mpc->mpc_ops->mpo_create_socket_from_socket = mpe->mpe_function; break; case MAC_RELABEL_PIPE: mpc->mpc_ops->mpo_relabel_pipe = mpe->mpe_function; break; case MAC_RELABEL_SOCKET: mpc->mpc_ops->mpo_relabel_socket = mpe->mpe_function; break; case MAC_SET_SOCKET_PEER_FROM_MBUF: mpc->mpc_ops->mpo_set_socket_peer_from_mbuf = mpe->mpe_function; break; case MAC_SET_SOCKET_PEER_FROM_SOCKET: mpc->mpc_ops->mpo_set_socket_peer_from_socket = mpe->mpe_function; break; case MAC_CREATE_BPFDESC: mpc->mpc_ops->mpo_create_bpfdesc = mpe->mpe_function; break; case MAC_CREATE_DATAGRAM_FROM_IPQ: mpc->mpc_ops->mpo_create_datagram_from_ipq = mpe->mpe_function; break; case MAC_CREATE_FRAGMENT: mpc->mpc_ops->mpo_create_fragment = mpe->mpe_function; break; case MAC_CREATE_IFNET: mpc->mpc_ops->mpo_create_ifnet = mpe->mpe_function; break; case MAC_CREATE_IPQ: mpc->mpc_ops->mpo_create_ipq = mpe->mpe_function; break; case MAC_CREATE_MBUF_FROM_MBUF: mpc->mpc_ops->mpo_create_mbuf_from_mbuf = mpe->mpe_function; break; case MAC_CREATE_MBUF_LINKLAYER: mpc->mpc_ops->mpo_create_mbuf_linklayer = mpe->mpe_function; break; case MAC_CREATE_MBUF_FROM_BPFDESC: mpc->mpc_ops->mpo_create_mbuf_from_bpfdesc = mpe->mpe_function; break; case MAC_CREATE_MBUF_FROM_IFNET: mpc->mpc_ops->mpo_create_mbuf_from_ifnet = mpe->mpe_function; break; case MAC_CREATE_MBUF_MULTICAST_ENCAP: mpc->mpc_ops->mpo_create_mbuf_multicast_encap = mpe->mpe_function; break; case MAC_CREATE_MBUF_NETLAYER: mpc->mpc_ops->mpo_create_mbuf_netlayer = mpe->mpe_function; break; case MAC_FRAGMENT_MATCH: mpc->mpc_ops->mpo_fragment_match = mpe->mpe_function; break; case MAC_RELABEL_IFNET: mpc->mpc_ops->mpo_relabel_ifnet = mpe->mpe_function; break; case MAC_UPDATE_IPQ: mpc->mpc_ops->mpo_update_ipq = mpe->mpe_function; break; case MAC_CREATE_CRED: mpc->mpc_ops->mpo_create_cred = mpe->mpe_function; break; case MAC_EXECVE_TRANSITION: mpc->mpc_ops->mpo_execve_transition = mpe->mpe_function; break; case MAC_EXECVE_WILL_TRANSITION: mpc->mpc_ops->mpo_execve_will_transition = mpe->mpe_function; break; case MAC_CREATE_PROC0: mpc->mpc_ops->mpo_create_proc0 = mpe->mpe_function; break; case MAC_CREATE_PROC1: mpc->mpc_ops->mpo_create_proc1 = mpe->mpe_function; break; case MAC_RELABEL_CRED: mpc->mpc_ops->mpo_relabel_cred = mpe->mpe_function; break; case MAC_THREAD_USERRET: mpc->mpc_ops->mpo_thread_userret = mpe->mpe_function; break; case MAC_CHECK_BPFDESC_RECEIVE: mpc->mpc_ops->mpo_check_bpfdesc_receive = mpe->mpe_function; break; case MAC_CHECK_CRED_RELABEL: mpc->mpc_ops->mpo_check_cred_relabel = mpe->mpe_function; break; case MAC_CHECK_CRED_VISIBLE: mpc->mpc_ops->mpo_check_cred_visible = mpe->mpe_function; break; case MAC_CHECK_IFNET_RELABEL: mpc->mpc_ops->mpo_check_ifnet_relabel = mpe->mpe_function; break; case MAC_CHECK_IFNET_TRANSMIT: mpc->mpc_ops->mpo_check_ifnet_transmit = mpe->mpe_function; break; case MAC_CHECK_MOUNT_STAT: mpc->mpc_ops->mpo_check_mount_stat = mpe->mpe_function; break; case MAC_CHECK_PIPE_IOCTL: mpc->mpc_ops->mpo_check_pipe_ioctl = mpe->mpe_function; break; case MAC_CHECK_PIPE_POLL: mpc->mpc_ops->mpo_check_pipe_poll = mpe->mpe_function; break; case MAC_CHECK_PIPE_READ: mpc->mpc_ops->mpo_check_pipe_read = mpe->mpe_function; break; case MAC_CHECK_PIPE_RELABEL: mpc->mpc_ops->mpo_check_pipe_relabel = mpe->mpe_function; break; case MAC_CHECK_PIPE_STAT: mpc->mpc_ops->mpo_check_pipe_stat = mpe->mpe_function; break; case MAC_CHECK_PIPE_WRITE: mpc->mpc_ops->mpo_check_pipe_write = mpe->mpe_function; break; case MAC_CHECK_PROC_DEBUG: mpc->mpc_ops->mpo_check_proc_debug = mpe->mpe_function; break; case MAC_CHECK_PROC_SCHED: mpc->mpc_ops->mpo_check_proc_sched = mpe->mpe_function; break; case MAC_CHECK_PROC_SIGNAL: mpc->mpc_ops->mpo_check_proc_signal = mpe->mpe_function; break; case MAC_CHECK_SOCKET_BIND: mpc->mpc_ops->mpo_check_socket_bind = mpe->mpe_function; break; case MAC_CHECK_SOCKET_CONNECT: mpc->mpc_ops->mpo_check_socket_connect = mpe->mpe_function; break; case MAC_CHECK_SOCKET_DELIVER: mpc->mpc_ops->mpo_check_socket_deliver = mpe->mpe_function; break; case MAC_CHECK_SOCKET_LISTEN: mpc->mpc_ops->mpo_check_socket_listen = mpe->mpe_function; break; case MAC_CHECK_SOCKET_RELABEL: mpc->mpc_ops->mpo_check_socket_relabel = mpe->mpe_function; break; case MAC_CHECK_SOCKET_VISIBLE: mpc->mpc_ops->mpo_check_socket_visible = mpe->mpe_function; break; case MAC_CHECK_VNODE_ACCESS: mpc->mpc_ops->mpo_check_vnode_access = mpe->mpe_function; break; case MAC_CHECK_VNODE_CHDIR: mpc->mpc_ops->mpo_check_vnode_chdir = mpe->mpe_function; break; case MAC_CHECK_VNODE_CHROOT: mpc->mpc_ops->mpo_check_vnode_chroot = mpe->mpe_function; break; case MAC_CHECK_VNODE_CREATE: mpc->mpc_ops->mpo_check_vnode_create = mpe->mpe_function; break; case MAC_CHECK_VNODE_DELETE: mpc->mpc_ops->mpo_check_vnode_delete = mpe->mpe_function; break; case MAC_CHECK_VNODE_DELETEACL: mpc->mpc_ops->mpo_check_vnode_deleteacl = mpe->mpe_function; break; case MAC_CHECK_VNODE_EXEC: mpc->mpc_ops->mpo_check_vnode_exec = mpe->mpe_function; break; case MAC_CHECK_VNODE_GETACL: mpc->mpc_ops->mpo_check_vnode_getacl = mpe->mpe_function; break; case MAC_CHECK_VNODE_GETEXTATTR: mpc->mpc_ops->mpo_check_vnode_getextattr = mpe->mpe_function; break; + case MAC_CHECK_VNODE_LINK: + mpc->mpc_ops->mpo_check_vnode_link = + mpe->mpe_function; + break; case MAC_CHECK_VNODE_LOOKUP: mpc->mpc_ops->mpo_check_vnode_lookup = mpe->mpe_function; break; case MAC_CHECK_VNODE_MMAP_PERMS: mpc->mpc_ops->mpo_check_vnode_mmap_perms = mpe->mpe_function; break; case MAC_CHECK_VNODE_OPEN: mpc->mpc_ops->mpo_check_vnode_open = mpe->mpe_function; break; case MAC_CHECK_VNODE_POLL: mpc->mpc_ops->mpo_check_vnode_poll = mpe->mpe_function; break; case MAC_CHECK_VNODE_READ: mpc->mpc_ops->mpo_check_vnode_read = mpe->mpe_function; break; case MAC_CHECK_VNODE_READDIR: mpc->mpc_ops->mpo_check_vnode_readdir = mpe->mpe_function; break; case MAC_CHECK_VNODE_READLINK: mpc->mpc_ops->mpo_check_vnode_readlink = mpe->mpe_function; break; case MAC_CHECK_VNODE_RELABEL: mpc->mpc_ops->mpo_check_vnode_relabel = mpe->mpe_function; break; case MAC_CHECK_VNODE_RENAME_FROM: mpc->mpc_ops->mpo_check_vnode_rename_from = mpe->mpe_function; break; case MAC_CHECK_VNODE_RENAME_TO: mpc->mpc_ops->mpo_check_vnode_rename_to = mpe->mpe_function; break; case MAC_CHECK_VNODE_REVOKE: mpc->mpc_ops->mpo_check_vnode_revoke = mpe->mpe_function; break; case MAC_CHECK_VNODE_SETACL: mpc->mpc_ops->mpo_check_vnode_setacl = mpe->mpe_function; break; case MAC_CHECK_VNODE_SETEXTATTR: mpc->mpc_ops->mpo_check_vnode_setextattr = mpe->mpe_function; break; case MAC_CHECK_VNODE_SETFLAGS: mpc->mpc_ops->mpo_check_vnode_setflags = mpe->mpe_function; break; case MAC_CHECK_VNODE_SETMODE: mpc->mpc_ops->mpo_check_vnode_setmode = mpe->mpe_function; break; case MAC_CHECK_VNODE_SETOWNER: mpc->mpc_ops->mpo_check_vnode_setowner = mpe->mpe_function; break; case MAC_CHECK_VNODE_SETUTIMES: mpc->mpc_ops->mpo_check_vnode_setutimes = mpe->mpe_function; break; case MAC_CHECK_VNODE_STAT: mpc->mpc_ops->mpo_check_vnode_stat = mpe->mpe_function; break; case MAC_CHECK_VNODE_WRITE: mpc->mpc_ops->mpo_check_vnode_write = mpe->mpe_function; break; /* default: printf("MAC policy `%s': unknown operation %d\n", mpc->mpc_name, mpe->mpe_constant); return (EINVAL); */ } } MAC_POLICY_LIST_LOCK(); if (mac_policy_list_busy > 0) { MAC_POLICY_LIST_UNLOCK(); FREE(mpc->mpc_ops, M_MACOPVEC); mpc->mpc_ops = NULL; return (EBUSY); } LIST_FOREACH(tmpc, &mac_policy_list, mpc_list) { if (strcmp(tmpc->mpc_name, mpc->mpc_name) == 0) { MAC_POLICY_LIST_UNLOCK(); FREE(mpc->mpc_ops, M_MACOPVEC); mpc->mpc_ops = NULL; return (EEXIST); } } if (mpc->mpc_field_off != NULL) { slot = ffs(mac_policy_offsets_free); if (slot == 0) { MAC_POLICY_LIST_UNLOCK(); FREE(mpc->mpc_ops, M_MACOPVEC); mpc->mpc_ops = NULL; return (ENOMEM); } slot--; mac_policy_offsets_free &= ~(1 << slot); *mpc->mpc_field_off = slot; } mpc->mpc_runtime_flags |= MPC_RUNTIME_FLAG_REGISTERED; LIST_INSERT_HEAD(&mac_policy_list, mpc, mpc_list); /* Per-policy initialization. */ if (mpc->mpc_ops->mpo_init != NULL) (*(mpc->mpc_ops->mpo_init))(mpc); MAC_POLICY_LIST_UNLOCK(); printf("Security policy loaded: %s (%s)\n", mpc->mpc_fullname, mpc->mpc_name); return (0); } static int mac_policy_unregister(struct mac_policy_conf *mpc) { /* * If we fail the load, we may get a request to unload. Check * to see if we did the run-time registration, and if not, * silently succeed. */ MAC_POLICY_LIST_LOCK(); if ((mpc->mpc_runtime_flags & MPC_RUNTIME_FLAG_REGISTERED) == 0) { MAC_POLICY_LIST_UNLOCK(); return (0); } #if 0 /* * Don't allow unloading modules with private data. */ if (mpc->mpc_field_off != NULL) { MAC_POLICY_LIST_UNLOCK(); return (EBUSY); } #endif /* * Only allow the unload to proceed if the module is unloadable * by its own definition. */ if ((mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_UNLOADOK) == 0) { MAC_POLICY_LIST_UNLOCK(); return (EBUSY); } /* * Right now, we EBUSY if the list is in use. In the future, * for reliability reasons, we might want to sleep and wakeup * later to try again. */ if (mac_policy_list_busy > 0) { MAC_POLICY_LIST_UNLOCK(); return (EBUSY); } if (mpc->mpc_ops->mpo_destroy != NULL) (*(mpc->mpc_ops->mpo_destroy))(mpc); LIST_REMOVE(mpc, mpc_list); MAC_POLICY_LIST_UNLOCK(); FREE(mpc->mpc_ops, M_MACOPVEC); mpc->mpc_ops = NULL; printf("Security policy unload: %s (%s)\n", mpc->mpc_fullname, mpc->mpc_name); return (0); } /* * Define an error value precedence, and given two arguments, selects the * value with the higher precedence. */ static int error_select(int error1, int error2) { /* Certain decision-making errors take top priority. */ if (error1 == EDEADLK || error2 == EDEADLK) return (EDEADLK); /* Invalid arguments should be reported where possible. */ if (error1 == EINVAL || error2 == EINVAL) return (EINVAL); /* Precedence goes to "visibility", with both process and file. */ if (error1 == ESRCH || error2 == ESRCH) return (ESRCH); if (error1 == ENOENT || error2 == ENOENT) return (ENOENT); /* Precedence goes to DAC/MAC protections. */ if (error1 == EACCES || error2 == EACCES) return (EACCES); /* Precedence goes to privilege. */ if (error1 == EPERM || error2 == EPERM) return (EPERM); /* Precedence goes to error over success; otherwise, arbitrary. */ if (error1 != 0) return (error1); return (error2); } static void mac_init_label(struct label *label) { bzero(label, sizeof(*label)); label->l_flags = MAC_FLAG_INITIALIZED; } static void mac_destroy_label(struct label *label) { KASSERT(label->l_flags & MAC_FLAG_INITIALIZED, ("destroying uninitialized label")); bzero(label, sizeof(*label)); /* implicit: label->l_flags &= ~MAC_FLAG_INITIALIZED; */ } static void mac_init_structmac(struct mac *mac) { bzero(mac, sizeof(*mac)); mac->m_macflags = MAC_FLAG_INITIALIZED; } void mac_init_bpfdesc(struct bpf_d *bpf_d) { mac_init_label(&bpf_d->bd_label); MAC_PERFORM(init_bpfdesc_label, &bpf_d->bd_label); #ifdef MAC_DEBUG atomic_add_int(&nmacbpfdescs, 1); #endif } void mac_init_cred(struct ucred *cr) { mac_init_label(&cr->cr_label); MAC_PERFORM(init_cred_label, &cr->cr_label); #ifdef MAC_DEBUG atomic_add_int(&nmaccreds, 1); #endif } void mac_init_devfsdirent(struct devfs_dirent *de) { mac_init_label(&de->de_label); MAC_PERFORM(init_devfsdirent_label, &de->de_label); #ifdef MAC_DEBUG atomic_add_int(&nmacdevfsdirents, 1); #endif } void mac_init_ifnet(struct ifnet *ifp) { mac_init_label(&ifp->if_label); MAC_PERFORM(init_ifnet_label, &ifp->if_label); #ifdef MAC_DEBUG atomic_add_int(&nmacifnets, 1); #endif } void mac_init_ipq(struct ipq *ipq) { mac_init_label(&ipq->ipq_label); MAC_PERFORM(init_ipq_label, &ipq->ipq_label); #ifdef MAC_DEBUG atomic_add_int(&nmacipqs, 1); #endif } int mac_init_mbuf(struct mbuf *m, int flag) { int error; KASSERT(m->m_flags & M_PKTHDR, ("mac_init_mbuf on non-header mbuf")); mac_init_label(&m->m_pkthdr.label); MAC_CHECK(init_mbuf_label, &m->m_pkthdr.label, flag); if (error) { MAC_PERFORM(destroy_mbuf_label, &m->m_pkthdr.label); mac_destroy_label(&m->m_pkthdr.label); } #ifdef MAC_DEBUG if (error == 0) atomic_add_int(&nmacmbufs, 1); #endif return (error); } void mac_init_mount(struct mount *mp) { mac_init_label(&mp->mnt_mntlabel); mac_init_label(&mp->mnt_fslabel); MAC_PERFORM(init_mount_label, &mp->mnt_mntlabel); MAC_PERFORM(init_mount_fs_label, &mp->mnt_fslabel); #ifdef MAC_DEBUG atomic_add_int(&nmacmounts, 1); #endif } void mac_init_pipe(struct pipe *pipe) { struct label *label; label = malloc(sizeof(struct label), M_MACPIPELABEL, M_ZERO|M_WAITOK); mac_init_label(label); pipe->pipe_label = label; pipe->pipe_peer->pipe_label = label; MAC_PERFORM(init_pipe_label, pipe->pipe_label); #ifdef MAC_DEBUG atomic_add_int(&nmacpipes, 1); #endif } void mac_init_socket(struct socket *socket) { mac_init_label(&socket->so_label); mac_init_label(&socket->so_peerlabel); MAC_PERFORM(init_socket_label, &socket->so_label); MAC_PERFORM(init_socket_peer_label, &socket->so_peerlabel); #ifdef MAC_DEBUG atomic_add_int(&nmacsockets, 1); #endif } static void mac_init_temp(struct label *label) { mac_init_label(label); MAC_PERFORM(init_temp_label, label); #ifdef MAC_DEBUG atomic_add_int(&nmactemp, 1); #endif } void mac_init_vnode(struct vnode *vp) { mac_init_label(&vp->v_label); MAC_PERFORM(init_vnode_label, &vp->v_label); #ifdef MAC_DEBUG atomic_add_int(&nmacvnodes, 1); #endif } void mac_destroy_bpfdesc(struct bpf_d *bpf_d) { MAC_PERFORM(destroy_bpfdesc_label, &bpf_d->bd_label); mac_destroy_label(&bpf_d->bd_label); #ifdef MAC_DEBUG atomic_subtract_int(&nmacbpfdescs, 1); #endif } void mac_destroy_cred(struct ucred *cr) { MAC_PERFORM(destroy_cred_label, &cr->cr_label); mac_destroy_label(&cr->cr_label); #ifdef MAC_DEBUG atomic_subtract_int(&nmaccreds, 1); #endif } void mac_destroy_devfsdirent(struct devfs_dirent *de) { MAC_PERFORM(destroy_devfsdirent_label, &de->de_label); mac_destroy_label(&de->de_label); #ifdef MAC_DEBUG atomic_subtract_int(&nmacdevfsdirents, 1); #endif } void mac_destroy_ifnet(struct ifnet *ifp) { MAC_PERFORM(destroy_ifnet_label, &ifp->if_label); mac_destroy_label(&ifp->if_label); #ifdef MAC_DEBUG atomic_subtract_int(&nmacifnets, 1); #endif } void mac_destroy_ipq(struct ipq *ipq) { MAC_PERFORM(destroy_ipq_label, &ipq->ipq_label); mac_destroy_label(&ipq->ipq_label); #ifdef MAC_DEBUG atomic_subtract_int(&nmacipqs, 1); #endif } void mac_destroy_mbuf(struct mbuf *m) { MAC_PERFORM(destroy_mbuf_label, &m->m_pkthdr.label); mac_destroy_label(&m->m_pkthdr.label); #ifdef MAC_DEBUG atomic_subtract_int(&nmacmbufs, 1); #endif } void mac_destroy_mount(struct mount *mp) { MAC_PERFORM(destroy_mount_label, &mp->mnt_mntlabel); MAC_PERFORM(destroy_mount_fs_label, &mp->mnt_fslabel); mac_destroy_label(&mp->mnt_fslabel); mac_destroy_label(&mp->mnt_mntlabel); #ifdef MAC_DEBUG atomic_subtract_int(&nmacmounts, 1); #endif } void mac_destroy_pipe(struct pipe *pipe) { MAC_PERFORM(destroy_pipe_label, pipe->pipe_label); mac_destroy_label(pipe->pipe_label); free(pipe->pipe_label, M_MACPIPELABEL); #ifdef MAC_DEBUG atomic_subtract_int(&nmacpipes, 1); #endif } void mac_destroy_socket(struct socket *socket) { MAC_PERFORM(destroy_socket_label, &socket->so_label); MAC_PERFORM(destroy_socket_peer_label, &socket->so_peerlabel); mac_destroy_label(&socket->so_label); mac_destroy_label(&socket->so_peerlabel); #ifdef MAC_DEBUG atomic_subtract_int(&nmacsockets, 1); #endif } static void mac_destroy_temp(struct label *label) { MAC_PERFORM(destroy_temp_label, label); mac_destroy_label(label); #ifdef MAC_DEBUG atomic_subtract_int(&nmactemp, 1); #endif } void mac_destroy_vnode(struct vnode *vp) { MAC_PERFORM(destroy_vnode_label, &vp->v_label); mac_destroy_label(&vp->v_label); #ifdef MAC_DEBUG atomic_subtract_int(&nmacvnodes, 1); #endif } static int mac_externalize(struct label *label, struct mac *mac) { int error; mac_init_structmac(mac); MAC_CHECK(externalize, label, mac); return (error); } static int mac_internalize(struct label *label, struct mac *mac) { int error; mac_init_temp(label); MAC_CHECK(internalize, label, mac); if (error) mac_destroy_temp(label); return (error); } /* * Initialize MAC label for the first kernel process, from which other * kernel processes and threads are spawned. */ void mac_create_proc0(struct ucred *cred) { MAC_PERFORM(create_proc0, cred); } /* * Initialize MAC label for the first userland process, from which other * userland processes and threads are spawned. */ void mac_create_proc1(struct ucred *cred) { MAC_PERFORM(create_proc1, cred); } void mac_thread_userret(struct thread *td) { MAC_PERFORM(thread_userret, td); } /* * When a new process is created, its label must be initialized. Generally, * this involves inheritence from the parent process, modulo possible * deltas. This function allows that processing to take place. */ void mac_create_cred(struct ucred *parent_cred, struct ucred *child_cred) { MAC_PERFORM(create_cred, parent_cred, child_cred); } void mac_update_devfsdirent(struct devfs_dirent *de, struct vnode *vp) { MAC_PERFORM(update_devfsdirent, de, &de->de_label, vp, &vp->v_label); } void mac_update_procfsvnode(struct vnode *vp, struct ucred *cred) { MAC_PERFORM(update_procfsvnode, vp, &vp->v_label, cred); } /* * Support callout for policies that manage their own externalization * using extended attributes. */ static int mac_update_vnode_from_extattr(struct vnode *vp, struct mount *mp) { int error; MAC_CHECK(update_vnode_from_extattr, vp, &vp->v_label, mp, &mp->mnt_fslabel); return (error); } /* * Given an externalized mac label, internalize it and stamp it on a * vnode. */ static int mac_update_vnode_from_externalized(struct vnode *vp, struct mac *extmac) { int error; MAC_CHECK(update_vnode_from_externalized, vp, &vp->v_label, extmac); return (error); } /* * Call out to individual policies to update the label in a vnode from * the mountpoint. */ void mac_update_vnode_from_mount(struct vnode *vp, struct mount *mp) { MAC_PERFORM(update_vnode_from_mount, vp, &vp->v_label, mp, &mp->mnt_fslabel); ASSERT_VOP_LOCKED(vp, "mac_update_vnode_from_mount"); if (mac_cache_fslabel_in_vnode) vp->v_vflag |= VV_CACHEDLABEL; } /* * Implementation of VOP_REFRESHLABEL() that relies on extended attributes * to store label data. Can be referenced by filesystems supporting * extended attributes. */ int vop_stdrefreshlabel_ea(struct vop_refreshlabel_args *ap) { struct vnode *vp = ap->a_vp; struct mac extmac; int buflen, error; ASSERT_VOP_LOCKED(vp, "vop_stdrefreshlabel_ea"); /* * Call out to external policies first. Order doesn't really * matter, as long as failure of one assures failure of all. */ error = mac_update_vnode_from_extattr(vp, vp->v_mount); if (error) return (error); buflen = sizeof(extmac); error = vn_extattr_get(vp, IO_NODELOCKED, FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME, &buflen, (char *)&extmac, curthread); switch (error) { case 0: /* Got it */ break; case ENOATTR: /* * Use the label from the mount point. */ mac_update_vnode_from_mount(vp, vp->v_mount); return (0); case EOPNOTSUPP: default: /* Fail horribly. */ return (error); } if (buflen != sizeof(extmac)) error = EPERM; /* Fail very closed. */ if (error == 0) error = mac_update_vnode_from_externalized(vp, &extmac); if (error == 0) vp->v_vflag |= VV_CACHEDLABEL; else { struct vattr va; printf("Corrupted label on %s", vp->v_mount->mnt_stat.f_mntonname); if (VOP_GETATTR(vp, &va, curthread->td_ucred, curthread) == 0) printf(" inum %ld", va.va_fileid); #ifdef MAC_DEBUG if (mac_debug_label_fallback) { printf(", falling back.\n"); mac_update_vnode_from_mount(vp, vp->v_mount); error = 0; } else { #endif printf(".\n"); error = EPERM; #ifdef MAC_DEBUG } #endif } return (error); } /* * Make sure the vnode label is up-to-date. If EOPNOTSUPP, then we handle * the labeling activity outselves. Filesystems should be careful not * to change their minds regarding whether they support vop_refreshlabel() * for a vnode or not. Don't cache the vnode here, allow the file * system code to determine if it's safe to cache. If we update from * the mount, don't cache since a change to the mount label should affect * all vnodes. */ static int vn_refreshlabel(struct vnode *vp, struct ucred *cred) { int error; ASSERT_VOP_LOCKED(vp, "vn_refreshlabel"); if (vp->v_mount == NULL) { /* Eventually, we probably want to special-case refreshing of deadfs vnodes, and if there's a lock-free race somewhere, that case might be handled here. mac_update_vnode_deadfs(vp); return (0); */ /* printf("vn_refreshlabel: null v_mount\n"); */ if (vp->v_type != VNON) printf( "vn_refreshlabel: null v_mount with non-VNON\n"); return (EBADF); } if (vp->v_vflag & VV_CACHEDLABEL) { mac_vnode_label_cache_hits++; return (0); } else mac_vnode_label_cache_misses++; if ((vp->v_mount->mnt_flag & MNT_MULTILABEL) == 0) { mac_update_vnode_from_mount(vp, vp->v_mount); return (0); } error = VOP_REFRESHLABEL(vp, cred, curthread); switch (error) { case EOPNOTSUPP: /* * If labels are not supported on this vnode, fall back to * the label in the mount and propagate it to the vnode. * There should probably be some sort of policy/flag/decision * about doing this. */ mac_update_vnode_from_mount(vp, vp->v_mount); error = 0; default: return (error); } } /* * Helper function for file systems using the vop_std*_ea() calls. This * function must be called after EA service is available for the vnode, * but before it's hooked up to the namespace so that the node persists * if there's a crash, or before it can be accessed. On successful * commit of the label to disk (etc), do cache the label. */ int vop_stdcreatevnode_ea(struct vnode *dvp, struct vnode *tvp, struct ucred *cred) { struct mac extmac; int error; ASSERT_VOP_LOCKED(tvp, "vop_stdcreatevnode_ea"); if ((dvp->v_mount->mnt_flag & MNT_MULTILABEL) == 0) { mac_update_vnode_from_mount(tvp, tvp->v_mount); } else { error = vn_refreshlabel(dvp, cred); if (error) return (error); /* * Stick the label in the vnode. Then try to write to * disk. If we fail, return a failure to abort the * create operation. Really, this failure shouldn't * happen except in fairly unusual circumstances (out * of disk, etc). */ mac_create_vnode(cred, dvp, tvp); error = mac_stdcreatevnode_ea(tvp); if (error) return (error); /* * XXX: Eventually this will go away and all policies will * directly manage their extended attributes. */ error = mac_externalize(&tvp->v_label, &extmac); if (error) return (error); error = vn_extattr_set(tvp, IO_NODELOCKED, FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME, sizeof(extmac), (char *)&extmac, curthread); if (error == 0) tvp->v_vflag |= VV_CACHEDLABEL; else { #if 0 /* * In theory, we could have fall-back behavior here. * It would probably be incorrect. */ #endif return (error); } } return (0); } void mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_execve_transition"); error = vn_refreshlabel(vp, old); if (error) { printf("mac_execve_transition: vn_refreshlabel returned %d\n", error); printf("mac_execve_transition: using old vnode label\n"); } MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label); } int mac_execve_will_transition(struct ucred *old, struct vnode *vp) { int error, result; error = vn_refreshlabel(vp, old); if (error) return (error); result = 0; MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label); return (result); } int mac_check_vnode_access(struct ucred *cred, struct vnode *vp, int flags) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_access"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_access, cred, vp, &vp->v_label, flags); return (error); } int mac_check_vnode_chdir(struct ucred *cred, struct vnode *dvp) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_chdir"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); MAC_CHECK(check_vnode_chdir, cred, dvp, &dvp->v_label); return (error); } int mac_check_vnode_chroot(struct ucred *cred, struct vnode *dvp) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_chroot"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); MAC_CHECK(check_vnode_chroot, cred, dvp, &dvp->v_label); return (error); } int mac_check_vnode_create(struct ucred *cred, struct vnode *dvp, struct componentname *cnp, struct vattr *vap) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_create"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); MAC_CHECK(check_vnode_create, cred, dvp, &dvp->v_label, cnp, vap); return (error); } int mac_check_vnode_delete(struct ucred *cred, struct vnode *dvp, struct vnode *vp, struct componentname *cnp) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_delete"); ASSERT_VOP_LOCKED(vp, "mac_check_vnode_delete"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_delete, cred, dvp, &dvp->v_label, vp, &vp->v_label, cnp); return (error); } int mac_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp, acl_type_t type) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_deleteacl"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_deleteacl, cred, vp, &vp->v_label, type); return (error); } int mac_check_vnode_exec(struct ucred *cred, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_exec"); if (!mac_enforce_process && !mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label); return (error); } int mac_check_vnode_getacl(struct ucred *cred, struct vnode *vp, acl_type_t type) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_getacl"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_getacl, cred, vp, &vp->v_label, type); return (error); } int mac_check_vnode_getextattr(struct ucred *cred, struct vnode *vp, int attrnamespace, const char *name, struct uio *uio) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_getextattr"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_getextattr, cred, vp, &vp->v_label, attrnamespace, name, uio); + return (error); +} + +int +mac_check_vnode_link(struct ucred *cred, struct vnode *dvp, + struct vnode *vp, struct componentname *cnp) +{ + + int error; + + ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_link"); + ASSERT_VOP_LOCKED(vp, "mac_check_vnode_link"); + + if (!mac_enforce_fs) + return (0); + + error = vn_refreshlabel(dvp, cred); + if (error) + return (error); + + error = vn_refreshlabel(vp, cred); + if (error) + return (error); + + MAC_CHECK(check_vnode_link, cred, dvp, &dvp->v_label, vp, + &vp->v_label, cnp); return (error); } int mac_check_vnode_lookup(struct ucred *cred, struct vnode *dvp, struct componentname *cnp) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_lookup"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); MAC_CHECK(check_vnode_lookup, cred, dvp, &dvp->v_label, cnp); return (error); } vm_prot_t mac_check_vnode_mmap_prot(struct ucred *cred, struct vnode *vp, int newmapping) { vm_prot_t result = VM_PROT_ALL; if (!mac_enforce_vm) return (result); /* * This should be some sort of MAC_BITWISE, maybe :) */ ASSERT_VOP_LOCKED(vp, "mac_check_vnode_mmap_perms"); MAC_BOOLEAN(check_vnode_mmap_perms, &, cred, vp, &vp->v_label, newmapping); return (result); } int mac_check_vnode_open(struct ucred *cred, struct vnode *vp, mode_t acc_mode) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_open"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_open, cred, vp, &vp->v_label, acc_mode); return (error); } int mac_check_vnode_poll(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_poll"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, active_cred); if (error) return (error); MAC_CHECK(check_vnode_poll, active_cred, file_cred, vp, &vp->v_label); return (error); } int mac_check_vnode_read(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_read"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, active_cred); if (error) return (error); MAC_CHECK(check_vnode_read, active_cred, file_cred, vp, &vp->v_label); return (error); } int mac_check_vnode_readdir(struct ucred *cred, struct vnode *dvp) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_readdir"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); MAC_CHECK(check_vnode_readdir, cred, dvp, &dvp->v_label); return (error); } int mac_check_vnode_readlink(struct ucred *cred, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_readlink"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_readlink, cred, vp, &vp->v_label); return (error); } static int mac_check_vnode_relabel(struct ucred *cred, struct vnode *vp, struct label *newlabel) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_relabel"); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_relabel, cred, vp, &vp->v_label, newlabel); return (error); } int mac_check_vnode_rename_from(struct ucred *cred, struct vnode *dvp, struct vnode *vp, struct componentname *cnp) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_rename_from"); ASSERT_VOP_LOCKED(vp, "mac_check_vnode_rename_from"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_rename_from, cred, dvp, &dvp->v_label, vp, &vp->v_label, cnp); return (error); } int mac_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp, struct vnode *vp, int samedir, struct componentname *cnp) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_rename_to"); ASSERT_VOP_LOCKED(vp, "mac_check_vnode_rename_to"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); if (vp != NULL) { error = vn_refreshlabel(vp, cred); if (error) return (error); } MAC_CHECK(check_vnode_rename_to, cred, dvp, &dvp->v_label, vp, vp != NULL ? &vp->v_label : NULL, samedir, cnp); return (error); } int mac_check_vnode_revoke(struct ucred *cred, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_revoke"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_revoke, cred, vp, &vp->v_label); return (error); } int mac_check_vnode_setacl(struct ucred *cred, struct vnode *vp, acl_type_t type, struct acl *acl) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setacl"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_setacl, cred, vp, &vp->v_label, type, acl); return (error); } int mac_check_vnode_setextattr(struct ucred *cred, struct vnode *vp, int attrnamespace, const char *name, struct uio *uio) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setextattr"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_setextattr, cred, vp, &vp->v_label, attrnamespace, name, uio); return (error); } int mac_check_vnode_setflags(struct ucred *cred, struct vnode *vp, u_long flags) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setflags"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_setflags, cred, vp, &vp->v_label, flags); return (error); } int mac_check_vnode_setmode(struct ucred *cred, struct vnode *vp, mode_t mode) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setmode"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_setmode, cred, vp, &vp->v_label, mode); return (error); } int mac_check_vnode_setowner(struct ucred *cred, struct vnode *vp, uid_t uid, gid_t gid) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setowner"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_setowner, cred, vp, &vp->v_label, uid, gid); return (error); } int mac_check_vnode_setutimes(struct ucred *cred, struct vnode *vp, struct timespec atime, struct timespec mtime) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setutimes"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_setutimes, cred, vp, &vp->v_label, atime, mtime); return (error); } int mac_check_vnode_stat(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_stat"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, active_cred); if (error) return (error); MAC_CHECK(check_vnode_stat, active_cred, file_cred, vp, &vp->v_label); return (error); } int mac_check_vnode_write(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_write"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, active_cred); if (error) return (error); MAC_CHECK(check_vnode_write, active_cred, file_cred, vp, &vp->v_label); return (error); } /* * When relabeling a process, call out to the policies for the maximum * permission allowed for each object type we know about in its * memory space, and revoke access (in the least surprising ways we * know) when necessary. The process lock is not held here. */ static void mac_cred_mmapped_drop_perms(struct thread *td, struct ucred *cred) { /* XXX freeze all other threads */ mac_cred_mmapped_drop_perms_recurse(td, cred, &td->td_proc->p_vmspace->vm_map); /* XXX allow other threads to continue */ } static __inline const char * prot2str(vm_prot_t prot) { switch (prot & VM_PROT_ALL) { case VM_PROT_READ: return ("r--"); case VM_PROT_READ | VM_PROT_WRITE: return ("rw-"); case VM_PROT_READ | VM_PROT_EXECUTE: return ("r-x"); case VM_PROT_READ | VM_PROT_WRITE | VM_PROT_EXECUTE: return ("rwx"); case VM_PROT_WRITE: return ("-w-"); case VM_PROT_EXECUTE: return ("--x"); case VM_PROT_WRITE | VM_PROT_EXECUTE: return ("-wx"); default: return ("---"); } } static void mac_cred_mmapped_drop_perms_recurse(struct thread *td, struct ucred *cred, struct vm_map *map) { struct vm_map_entry *vme; vm_prot_t result, revokeperms; vm_object_t object; vm_ooffset_t offset; struct vnode *vp; if (!mac_mmap_revocation) return; vm_map_lock_read(map); for (vme = map->header.next; vme != &map->header; vme = vme->next) { if (vme->eflags & MAP_ENTRY_IS_SUB_MAP) { mac_cred_mmapped_drop_perms_recurse(td, cred, vme->object.sub_map); continue; } /* * Skip over entries that obviously are not shared. */ if (vme->eflags & (MAP_ENTRY_COW | MAP_ENTRY_NOSYNC) || !vme->max_protection) continue; /* * Drill down to the deepest backing object. */ offset = vme->offset; object = vme->object.vm_object; if (object == NULL) continue; while (object->backing_object != NULL) { object = object->backing_object; offset += object->backing_object_offset; } /* * At the moment, vm_maps and objects aren't considered * by the MAC system, so only things with backing by a * normal object (read: vnodes) are checked. */ if (object->type != OBJT_VNODE) continue; vp = (struct vnode *)object->handle; vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); result = mac_check_vnode_mmap_prot(cred, vp, 0); VOP_UNLOCK(vp, 0, td); /* * Find out what maximum protection we may be allowing * now but a policy needs to get removed. */ revokeperms = vme->max_protection & ~result; if (!revokeperms) continue; printf("pid %ld: revoking %s perms from %#lx:%ld " "(max %s/cur %s)\n", (long)td->td_proc->p_pid, prot2str(revokeperms), (u_long)vme->start, (long)(vme->end - vme->start), prot2str(vme->max_protection), prot2str(vme->protection)); vm_map_lock_upgrade(map); /* * This is the really simple case: if a map has more * max_protection than is allowed, but it's not being * actually used (that is, the current protection is * still allowed), we can just wipe it out and do * nothing more. */ if ((vme->protection & revokeperms) == 0) { vme->max_protection -= revokeperms; } else { if (revokeperms & VM_PROT_WRITE) { /* * In the more complicated case, flush out all * pending changes to the object then turn it * copy-on-write. */ vm_object_reference(object); vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); vm_object_page_clean(object, OFF_TO_IDX(offset), OFF_TO_IDX(offset + vme->end - vme->start + PAGE_MASK), OBJPC_SYNC); VOP_UNLOCK(vp, 0, td); vm_object_deallocate(object); /* * Why bother if there's no read permissions * anymore? For the rest, we need to leave * the write permissions on for COW, or * remove them entirely if configured to. */ if (!mac_mmap_revocation_via_cow) { vme->max_protection &= ~VM_PROT_WRITE; vme->protection &= ~VM_PROT_WRITE; } if ((revokeperms & VM_PROT_READ) == 0) vme->eflags |= MAP_ENTRY_COW | MAP_ENTRY_NEEDS_COPY; } if (revokeperms & VM_PROT_EXECUTE) { vme->max_protection &= ~VM_PROT_EXECUTE; vme->protection &= ~VM_PROT_EXECUTE; } if (revokeperms & VM_PROT_READ) { vme->max_protection = 0; vme->protection = 0; } pmap_protect(map->pmap, vme->start, vme->end, vme->protection & ~revokeperms); vm_map_simplify_entry(map, vme); } vm_map_lock_downgrade(map); } vm_map_unlock_read(map); } /* * When the subject's label changes, it may require revocation of privilege * to mapped objects. This can't be done on-the-fly later with a unified * buffer cache. */ static void mac_relabel_cred(struct ucred *cred, struct label *newlabel) { MAC_PERFORM(relabel_cred, cred, newlabel); } void mac_relabel_vnode(struct ucred *cred, struct vnode *vp, struct label *newlabel) { MAC_PERFORM(relabel_vnode, cred, vp, &vp->v_label, newlabel); } void mac_create_ifnet(struct ifnet *ifnet) { MAC_PERFORM(create_ifnet, ifnet, &ifnet->if_label); } void mac_create_bpfdesc(struct ucred *cred, struct bpf_d *bpf_d) { MAC_PERFORM(create_bpfdesc, cred, bpf_d, &bpf_d->bd_label); } void mac_create_socket(struct ucred *cred, struct socket *socket) { MAC_PERFORM(create_socket, cred, socket, &socket->so_label); } void mac_create_pipe(struct ucred *cred, struct pipe *pipe) { MAC_PERFORM(create_pipe, cred, pipe, pipe->pipe_label); } void mac_create_socket_from_socket(struct socket *oldsocket, struct socket *newsocket) { MAC_PERFORM(create_socket_from_socket, oldsocket, &oldsocket->so_label, newsocket, &newsocket->so_label); } static void mac_relabel_socket(struct ucred *cred, struct socket *socket, struct label *newlabel) { MAC_PERFORM(relabel_socket, cred, socket, &socket->so_label, newlabel); } static void mac_relabel_pipe(struct ucred *cred, struct pipe *pipe, struct label *newlabel) { MAC_PERFORM(relabel_pipe, cred, pipe, pipe->pipe_label, newlabel); } void mac_set_socket_peer_from_mbuf(struct mbuf *mbuf, struct socket *socket) { MAC_PERFORM(set_socket_peer_from_mbuf, mbuf, &mbuf->m_pkthdr.label, socket, &socket->so_peerlabel); } void mac_set_socket_peer_from_socket(struct socket *oldsocket, struct socket *newsocket) { MAC_PERFORM(set_socket_peer_from_socket, oldsocket, &oldsocket->so_label, newsocket, &newsocket->so_peerlabel); } void mac_create_datagram_from_ipq(struct ipq *ipq, struct mbuf *datagram) { MAC_PERFORM(create_datagram_from_ipq, ipq, &ipq->ipq_label, datagram, &datagram->m_pkthdr.label); } void mac_create_fragment(struct mbuf *datagram, struct mbuf *fragment) { MAC_PERFORM(create_fragment, datagram, &datagram->m_pkthdr.label, fragment, &fragment->m_pkthdr.label); } void mac_create_ipq(struct mbuf *fragment, struct ipq *ipq) { MAC_PERFORM(create_ipq, fragment, &fragment->m_pkthdr.label, ipq, &ipq->ipq_label); } void mac_create_mbuf_from_mbuf(struct mbuf *oldmbuf, struct mbuf *newmbuf) { MAC_PERFORM(create_mbuf_from_mbuf, oldmbuf, &oldmbuf->m_pkthdr.label, newmbuf, &newmbuf->m_pkthdr.label); } void mac_create_mbuf_from_bpfdesc(struct bpf_d *bpf_d, struct mbuf *mbuf) { MAC_PERFORM(create_mbuf_from_bpfdesc, bpf_d, &bpf_d->bd_label, mbuf, &mbuf->m_pkthdr.label); } void mac_create_mbuf_linklayer(struct ifnet *ifnet, struct mbuf *mbuf) { MAC_PERFORM(create_mbuf_linklayer, ifnet, &ifnet->if_label, mbuf, &mbuf->m_pkthdr.label); } void mac_create_mbuf_from_ifnet(struct ifnet *ifnet, struct mbuf *mbuf) { MAC_PERFORM(create_mbuf_from_ifnet, ifnet, &ifnet->if_label, mbuf, &mbuf->m_pkthdr.label); } void mac_create_mbuf_multicast_encap(struct mbuf *oldmbuf, struct ifnet *ifnet, struct mbuf *newmbuf) { MAC_PERFORM(create_mbuf_multicast_encap, oldmbuf, &oldmbuf->m_pkthdr.label, ifnet, &ifnet->if_label, newmbuf, &newmbuf->m_pkthdr.label); } void mac_create_mbuf_netlayer(struct mbuf *oldmbuf, struct mbuf *newmbuf) { MAC_PERFORM(create_mbuf_netlayer, oldmbuf, &oldmbuf->m_pkthdr.label, newmbuf, &newmbuf->m_pkthdr.label); } int mac_fragment_match(struct mbuf *fragment, struct ipq *ipq) { int result; result = 1; MAC_BOOLEAN(fragment_match, &&, fragment, &fragment->m_pkthdr.label, ipq, &ipq->ipq_label); return (result); } void mac_update_ipq(struct mbuf *fragment, struct ipq *ipq) { MAC_PERFORM(update_ipq, fragment, &fragment->m_pkthdr.label, ipq, &ipq->ipq_label); } void mac_create_mbuf_from_socket(struct socket *socket, struct mbuf *mbuf) { MAC_PERFORM(create_mbuf_from_socket, socket, &socket->so_label, mbuf, &mbuf->m_pkthdr.label); } void mac_create_mount(struct ucred *cred, struct mount *mp) { MAC_PERFORM(create_mount, cred, mp, &mp->mnt_mntlabel, &mp->mnt_fslabel); } void mac_create_root_mount(struct ucred *cred, struct mount *mp) { MAC_PERFORM(create_root_mount, cred, mp, &mp->mnt_mntlabel, &mp->mnt_fslabel); } int mac_check_bpfdesc_receive(struct bpf_d *bpf_d, struct ifnet *ifnet) { int error; if (!mac_enforce_network) return (0); MAC_CHECK(check_bpfdesc_receive, bpf_d, &bpf_d->bd_label, ifnet, &ifnet->if_label); return (error); } static int mac_check_cred_relabel(struct ucred *cred, struct label *newlabel) { int error; MAC_CHECK(check_cred_relabel, cred, newlabel); return (error); } int mac_check_cred_visible(struct ucred *u1, struct ucred *u2) { int error; if (!mac_enforce_process) return (0); MAC_CHECK(check_cred_visible, u1, u2); return (error); } int mac_check_ifnet_transmit(struct ifnet *ifnet, struct mbuf *mbuf) { int error; if (!mac_enforce_network) return (0); KASSERT(mbuf->m_flags & M_PKTHDR, ("packet has no pkthdr")); if (!(mbuf->m_pkthdr.label.l_flags & MAC_FLAG_INITIALIZED)) printf("%s%d: not initialized\n", ifnet->if_name, ifnet->if_unit); MAC_CHECK(check_ifnet_transmit, ifnet, &ifnet->if_label, mbuf, &mbuf->m_pkthdr.label); return (error); } int mac_check_mount_stat(struct ucred *cred, struct mount *mount) { int error; if (!mac_enforce_fs) return (0); MAC_CHECK(check_mount_stat, cred, mount, &mount->mnt_mntlabel); return (error); } int mac_check_pipe_ioctl(struct ucred *cred, struct pipe *pipe, unsigned long cmd, void *data) { int error; PIPE_LOCK_ASSERT(pipe, MA_OWNED); if (!mac_enforce_pipe) return (0); MAC_CHECK(check_pipe_ioctl, cred, pipe, pipe->pipe_label, cmd, data); return (error); } int mac_check_pipe_poll(struct ucred *cred, struct pipe *pipe) { int error; PIPE_LOCK_ASSERT(pipe, MA_OWNED); if (!mac_enforce_pipe) return (0); MAC_CHECK(check_pipe_poll, cred, pipe, pipe->pipe_label); return (error); } int mac_check_pipe_read(struct ucred *cred, struct pipe *pipe) { int error; PIPE_LOCK_ASSERT(pipe, MA_OWNED); if (!mac_enforce_pipe) return (0); MAC_CHECK(check_pipe_read, cred, pipe, pipe->pipe_label); return (error); } static int mac_check_pipe_relabel(struct ucred *cred, struct pipe *pipe, struct label *newlabel) { int error; PIPE_LOCK_ASSERT(pipe, MA_OWNED); if (!mac_enforce_pipe) return (0); MAC_CHECK(check_pipe_relabel, cred, pipe, pipe->pipe_label, newlabel); return (error); } int mac_check_pipe_stat(struct ucred *cred, struct pipe *pipe) { int error; PIPE_LOCK_ASSERT(pipe, MA_OWNED); if (!mac_enforce_pipe) return (0); MAC_CHECK(check_pipe_stat, cred, pipe, pipe->pipe_label); return (error); } int mac_check_pipe_write(struct ucred *cred, struct pipe *pipe) { int error; PIPE_LOCK_ASSERT(pipe, MA_OWNED); if (!mac_enforce_pipe) return (0); MAC_CHECK(check_pipe_write, cred, pipe, pipe->pipe_label); return (error); } int mac_check_proc_debug(struct ucred *cred, struct proc *proc) { int error; PROC_LOCK_ASSERT(proc, MA_OWNED); if (!mac_enforce_process) return (0); MAC_CHECK(check_proc_debug, cred, proc); return (error); } int mac_check_proc_sched(struct ucred *cred, struct proc *proc) { int error; PROC_LOCK_ASSERT(proc, MA_OWNED); if (!mac_enforce_process) return (0); MAC_CHECK(check_proc_sched, cred, proc); return (error); } int mac_check_proc_signal(struct ucred *cred, struct proc *proc, int signum) { int error; PROC_LOCK_ASSERT(proc, MA_OWNED); if (!mac_enforce_process) return (0); MAC_CHECK(check_proc_signal, cred, proc, signum); return (error); } int mac_check_socket_bind(struct ucred *ucred, struct socket *socket, struct sockaddr *sockaddr) { int error; if (!mac_enforce_socket) return (0); MAC_CHECK(check_socket_bind, ucred, socket, &socket->so_label, sockaddr); return (error); } int mac_check_socket_connect(struct ucred *cred, struct socket *socket, struct sockaddr *sockaddr) { int error; if (!mac_enforce_socket) return (0); MAC_CHECK(check_socket_connect, cred, socket, &socket->so_label, sockaddr); return (error); } int mac_check_socket_deliver(struct socket *socket, struct mbuf *mbuf) { int error; if (!mac_enforce_socket) return (0); MAC_CHECK(check_socket_deliver, socket, &socket->so_label, mbuf, &mbuf->m_pkthdr.label); return (error); } int mac_check_socket_listen(struct ucred *cred, struct socket *socket) { int error; if (!mac_enforce_socket) return (0); MAC_CHECK(check_socket_listen, cred, socket, &socket->so_label); return (error); } static int mac_check_socket_relabel(struct ucred *cred, struct socket *socket, struct label *newlabel) { int error; MAC_CHECK(check_socket_relabel, cred, socket, &socket->so_label, newlabel); return (error); } int mac_check_socket_visible(struct ucred *cred, struct socket *socket) { int error; if (!mac_enforce_socket) return (0); MAC_CHECK(check_socket_visible, cred, socket, &socket->so_label); return (error); } int mac_ioctl_ifnet_get(struct ucred *cred, struct ifreq *ifr, struct ifnet *ifnet) { struct mac label; int error; error = mac_externalize(&ifnet->if_label, &label); if (error) return (error); return (copyout(&label, ifr->ifr_ifru.ifru_data, sizeof(label))); } int mac_ioctl_ifnet_set(struct ucred *cred, struct ifreq *ifr, struct ifnet *ifnet) { struct mac newlabel; struct label intlabel; int error; error = copyin(ifr->ifr_ifru.ifru_data, &newlabel, sizeof(newlabel)); if (error) return (error); error = mac_internalize(&intlabel, &newlabel); if (error) return (error); /* * XXX: Note that this is a redundant privilege check, since * policies impose this check themselves if required by the * policy. Eventually, this should go away. */ error = suser_cred(cred, 0); if (error) goto out; MAC_CHECK(check_ifnet_relabel, cred, ifnet, &ifnet->if_label, &intlabel); if (error) goto out; MAC_PERFORM(relabel_ifnet, cred, ifnet, &ifnet->if_label, &intlabel); out: mac_destroy_temp(&intlabel); return (error); } void mac_create_devfs_vnode(struct devfs_dirent *de, struct vnode *vp) { MAC_PERFORM(create_devfs_vnode, de, &de->de_label, vp, &vp->v_label); } void mac_create_devfs_device(dev_t dev, struct devfs_dirent *de) { MAC_PERFORM(create_devfs_device, dev, de, &de->de_label); } static int mac_stdcreatevnode_ea(struct vnode *vp) { int error; MAC_CHECK(stdcreatevnode_ea, vp, &vp->v_label); return (error); } void mac_create_devfs_directory(char *dirname, int dirnamelen, struct devfs_dirent *de) { MAC_PERFORM(create_devfs_directory, dirname, dirnamelen, de, &de->de_label); } /* * When a new vnode is created, this call will initialize its label. */ void mac_create_vnode(struct ucred *cred, struct vnode *parent, struct vnode *child) { int error; ASSERT_VOP_LOCKED(parent, "mac_create_vnode"); ASSERT_VOP_LOCKED(child, "mac_create_vnode"); error = vn_refreshlabel(parent, cred); if (error) { printf("mac_create_vnode: vn_refreshlabel returned %d\n", error); printf("mac_create_vnode: using old vnode label\n"); } MAC_PERFORM(create_vnode, cred, parent, &parent->v_label, child, &child->v_label); } int mac_setsockopt_label_set(struct ucred *cred, struct socket *so, struct mac *extmac) { struct label intlabel; int error; error = mac_internalize(&intlabel, extmac); if (error) return (error); mac_check_socket_relabel(cred, so, &intlabel); if (error) { mac_destroy_temp(&intlabel); return (error); } mac_relabel_socket(cred, so, &intlabel); mac_destroy_temp(&intlabel); return (0); } int mac_pipe_label_set(struct ucred *cred, struct pipe *pipe, struct label *label) { int error; PIPE_LOCK_ASSERT(pipe, MA_OWNED); error = mac_check_pipe_relabel(cred, pipe, label); if (error) return (error); mac_relabel_pipe(cred, pipe, label); return (0); } int mac_getsockopt_label_get(struct ucred *cred, struct socket *so, struct mac *extmac) { return (mac_externalize(&so->so_label, extmac)); } int mac_getsockopt_peerlabel_get(struct ucred *cred, struct socket *so, struct mac *extmac) { return (mac_externalize(&so->so_peerlabel, extmac)); } /* * Implementation of VOP_SETLABEL() that relies on extended attributes * to store label data. Can be referenced by filesystems supporting * extended attributes. */ int vop_stdsetlabel_ea(struct vop_setlabel_args *ap) { struct vnode *vp = ap->a_vp; struct label *intlabel = ap->a_label; struct mac extmac; int error; ASSERT_VOP_LOCKED(vp, "vop_stdsetlabel_ea"); /* * XXX: Eventually call out to EA check/set calls here. * Be particularly careful to avoid race conditions, * consistency problems, and stability problems when * dealing with multiple EAs. In particular, we require * the ability to write multiple EAs on the same file in * a single transaction, which the current EA interface * does not provide. */ error = mac_externalize(intlabel, &extmac); if (error) return (error); error = vn_extattr_set(vp, IO_NODELOCKED, FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME, sizeof(extmac), (char *)&extmac, curthread); if (error) return (error); mac_relabel_vnode(ap->a_cred, vp, intlabel); vp->v_vflag |= VV_CACHEDLABEL; return (0); } static int vn_setlabel(struct vnode *vp, struct label *intlabel, struct ucred *cred) { int error; if (vp->v_mount == NULL) { /* printf("vn_setlabel: null v_mount\n"); */ if (vp->v_type != VNON) printf("vn_setlabel: null v_mount with non-VNON\n"); return (EBADF); } if ((vp->v_mount->mnt_flag & MNT_MULTILABEL) == 0) return (EOPNOTSUPP); /* * Multi-phase commit. First check the policies to confirm the * change is OK. Then commit via the filesystem. Finally, * update the actual vnode label. Question: maybe the filesystem * should update the vnode at the end as part of VOP_SETLABEL()? */ error = mac_check_vnode_relabel(cred, vp, intlabel); if (error) return (error); /* * VADMIN provides the opportunity for the filesystem to make * decisions about who is and is not able to modify labels * and protections on files. This might not be right. We can't * assume VOP_SETLABEL() will do it, because we might implement * that as part of vop_stdsetlabel_ea(). */ error = VOP_ACCESS(vp, VADMIN, cred, curthread); if (error) return (error); error = VOP_SETLABEL(vp, intlabel, cred, curthread); if (error) return (error); return (0); } /* * MPSAFE */ int __mac_get_proc(struct thread *td, struct __mac_get_proc_args *uap) { struct mac extmac; int error; error = mac_externalize(&td->td_ucred->cr_label, &extmac); if (error == 0) error = copyout(&extmac, SCARG(uap, mac_p), sizeof(extmac)); return (error); } /* * MPSAFE */ int __mac_set_proc(struct thread *td, struct __mac_set_proc_args *uap) { struct ucred *newcred, *oldcred; struct proc *p; struct mac extmac; struct label intlabel; int error; error = copyin(SCARG(uap, mac_p), &extmac, sizeof(extmac)); if (error) return (error); error = mac_internalize(&intlabel, &extmac); if (error) return (error); newcred = crget(); p = td->td_proc; PROC_LOCK(p); oldcred = p->p_ucred; error = mac_check_cred_relabel(oldcred, &intlabel); if (error) { PROC_UNLOCK(p); mac_destroy_temp(&intlabel); crfree(newcred); return (error); } setsugid(p); crcopy(newcred, oldcred); mac_relabel_cred(newcred, &intlabel); p->p_ucred = newcred; /* * Grab additional reference for use while revoking mmaps, prior * to releasing the proc lock and sharing the cred. */ crhold(newcred); PROC_UNLOCK(p); mtx_lock(&Giant); mac_cred_mmapped_drop_perms(td, newcred); mtx_unlock(&Giant); crfree(newcred); /* Free revocation reference. */ crfree(oldcred); mac_destroy_temp(&intlabel); return (0); } /* * MPSAFE */ int __mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap) { struct file *fp; struct mac extmac; struct vnode *vp; struct pipe *pipe; int error; mtx_lock(&Giant); error = fget(td, SCARG(uap, fd), &fp); if (error) goto out; switch (fp->f_type) { case DTYPE_FIFO: case DTYPE_VNODE: vp = (struct vnode *)fp->f_data; vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); error = vn_refreshlabel(vp, td->td_ucred); if (error == 0) error = mac_externalize(&vp->v_label, &extmac); VOP_UNLOCK(vp, 0, td); break; case DTYPE_PIPE: pipe = (struct pipe *)fp->f_data; error = mac_externalize(pipe->pipe_label, &extmac); break; default: error = EINVAL; } if (error == 0) error = copyout(&extmac, SCARG(uap, mac_p), sizeof(extmac)); fdrop(fp, td); out: mtx_unlock(&Giant); return (error); } /* * MPSAFE */ int __mac_get_file(struct thread *td, struct __mac_get_file_args *uap) { struct nameidata nd; struct mac extmac; int error; mtx_lock(&Giant); NDINIT(&nd, LOOKUP, LOCKLEAF | FOLLOW, UIO_USERSPACE, SCARG(uap, path_p), td); error = namei(&nd); if (error) goto out; error = vn_refreshlabel(nd.ni_vp, td->td_ucred); if (error == 0) error = mac_externalize(&nd.ni_vp->v_label, &extmac); NDFREE(&nd, 0); if (error) goto out; error = copyout(&extmac, SCARG(uap, mac_p), sizeof(extmac)); out: mtx_unlock(&Giant); return (error); } /* * MPSAFE */ int __mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap) { struct file *fp; struct mac extmac; struct label intlabel; struct mount *mp; struct vnode *vp; struct pipe *pipe; int error; mtx_lock(&Giant); error = fget(td, SCARG(uap, fd), &fp); if (error) goto out1; error = copyin(SCARG(uap, mac_p), &extmac, sizeof(extmac)); if (error) goto out2; error = mac_internalize(&intlabel, &extmac); if (error) goto out2; switch (fp->f_type) { case DTYPE_FIFO: case DTYPE_VNODE: vp = (struct vnode *)fp->f_data; error = vn_start_write(vp, &mp, V_WAIT | PCATCH); if (error != 0) break; vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); error = vn_setlabel(vp, &intlabel, td->td_ucred); VOP_UNLOCK(vp, 0, td); vn_finished_write(mp); mac_destroy_temp(&intlabel); break; case DTYPE_PIPE: pipe = (struct pipe *)fp->f_data; PIPE_LOCK(pipe); error = mac_pipe_label_set(td->td_ucred, pipe, &intlabel); PIPE_UNLOCK(pipe); break; default: error = EINVAL; } out2: fdrop(fp, td); out1: mtx_unlock(&Giant); return (error); } /* * MPSAFE */ int __mac_set_file(struct thread *td, struct __mac_set_file_args *uap) { struct nameidata nd; struct mac extmac; struct label intlabel; struct mount *mp; int error; mtx_lock(&Giant); error = copyin(SCARG(uap, mac_p), &extmac, sizeof(extmac)); if (error) goto out; error = mac_internalize(&intlabel, &extmac); if (error) goto out; NDINIT(&nd, LOOKUP, LOCKLEAF | FOLLOW, UIO_USERSPACE, SCARG(uap, path_p), td); error = namei(&nd); if (error) goto out2; error = vn_start_write(nd.ni_vp, &mp, V_WAIT | PCATCH); if (error) goto out2; error = vn_setlabel(nd.ni_vp, &intlabel, td->td_ucred); vn_finished_write(mp); out2: mac_destroy_temp(&intlabel); NDFREE(&nd, 0); out: mtx_unlock(&Giant); return (error); } int mac_syscall(struct thread *td, struct mac_syscall_args *uap) { struct mac_policy_conf *mpc; char target[MAC_MAX_POLICY_NAME]; int error; error = copyinstr(SCARG(uap, policy), target, sizeof(target), NULL); if (error) return (error); error = ENOSYS; MAC_POLICY_LIST_BUSY(); LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { if (strcmp(mpc->mpc_name, target) == 0 && mpc->mpc_ops->mpo_syscall != NULL) { error = mpc->mpc_ops->mpo_syscall(td, SCARG(uap, call), SCARG(uap, arg)); goto out; } } out: MAC_POLICY_LIST_UNBUSY(); return (error); } SYSINIT(mac, SI_SUB_MAC, SI_ORDER_FIRST, mac_init, NULL); SYSINIT(mac_late, SI_SUB_MAC_LATE, SI_ORDER_FIRST, mac_late_init, NULL); #else /* !MAC */ int __mac_get_proc(struct thread *td, struct __mac_get_proc_args *uap) { return (ENOSYS); } int __mac_set_proc(struct thread *td, struct __mac_set_proc_args *uap) { return (ENOSYS); } int __mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap) { return (ENOSYS); } int __mac_get_file(struct thread *td, struct __mac_get_file_args *uap) { return (ENOSYS); } int __mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap) { return (ENOSYS); } int __mac_set_file(struct thread *td, struct __mac_set_file_args *uap) { return (ENOSYS); } int mac_syscall(struct thread *td, struct mac_syscall_args *uap) { return (ENOSYS); } #endif /* !MAC */ Index: head/sys/security/mac/mac_system.c =================================================================== --- head/sys/security/mac/mac_system.c (revision 104528) +++ head/sys/security/mac/mac_system.c (revision 104529) @@ -1,3432 +1,3462 @@ /*- * Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson * Copyright (c) 2001 Ilmar S. Habibulin * Copyright (c) 2001, 2002 Networks Associates Technology, Inc. * All rights reserved. * * This software was developed by Robert Watson and Ilmar Habibulin for the * TrustedBSD Project. * * This software was developed for the FreeBSD Project in part by NAI Labs, * the Security Research Division of Network Associates, Inc. under * DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA * CHATS research program. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * 3. The names of the authors may not be used to endorse or promote * products derived from this software without specific prior written * permission. * * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. * * $FreeBSD$ */ /* * Developed by the TrustedBSD Project. * * Framework for extensible kernel access control. Kernel and userland * interface to the framework, policy registration and composition. */ #include "opt_mac.h" #include "opt_devfs.h" #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #ifdef MAC /* * Declare that the kernel provides MAC support, version 1. This permits * modules to refuse to be loaded if the necessary support isn't present, * even if it's pre-boot. */ MODULE_VERSION(kernel_mac_support, 1); SYSCTL_DECL(_security); SYSCTL_NODE(_security, OID_AUTO, mac, CTLFLAG_RW, 0, "TrustedBSD MAC policy controls"); #ifndef MAC_MAX_POLICIES #define MAC_MAX_POLICIES 8 #endif #if MAC_MAX_POLICIES > 32 #error "MAC_MAX_POLICIES too large" #endif static unsigned int mac_max_policies = MAC_MAX_POLICIES; static unsigned int mac_policy_offsets_free = (1 << MAC_MAX_POLICIES) - 1; SYSCTL_UINT(_security_mac, OID_AUTO, max_policies, CTLFLAG_RD, &mac_max_policies, 0, ""); static int mac_late = 0; static int mac_enforce_fs = 1; SYSCTL_INT(_security_mac, OID_AUTO, enforce_fs, CTLFLAG_RW, &mac_enforce_fs, 0, "Enforce MAC policy on file system objects"); TUNABLE_INT("security.mac.enforce_fs", &mac_enforce_fs); static int mac_enforce_network = 1; SYSCTL_INT(_security_mac, OID_AUTO, enforce_network, CTLFLAG_RW, &mac_enforce_network, 0, "Enforce MAC policy on network packets"); TUNABLE_INT("security.mac.enforce_network", &mac_enforce_network); static int mac_enforce_pipe = 1; SYSCTL_INT(_security_mac, OID_AUTO, enforce_pipe, CTLFLAG_RW, &mac_enforce_pipe, 0, "Enforce MAC policy on pipe operations"); TUNABLE_INT("security.mac.enforce_pipe", &mac_enforce_pipe); static int mac_enforce_process = 1; SYSCTL_INT(_security_mac, OID_AUTO, enforce_process, CTLFLAG_RW, &mac_enforce_process, 0, "Enforce MAC policy on inter-process operations"); TUNABLE_INT("security.mac.enforce_process", &mac_enforce_process); static int mac_enforce_socket = 1; SYSCTL_INT(_security_mac, OID_AUTO, enforce_socket, CTLFLAG_RW, &mac_enforce_socket, 0, "Enforce MAC policy on socket operations"); TUNABLE_INT("security.mac.enforce_socket", &mac_enforce_socket); static int mac_enforce_vm = 1; SYSCTL_INT(_security_mac, OID_AUTO, enforce_vm, CTLFLAG_RW, &mac_enforce_vm, 0, "Enforce MAC policy on vm operations"); TUNABLE_INT("security.mac.enforce_vm", &mac_enforce_vm); static int mac_label_size = sizeof(struct mac); SYSCTL_INT(_security_mac, OID_AUTO, label_size, CTLFLAG_RD, &mac_label_size, 0, "Pre-compiled MAC label size"); static int mac_cache_fslabel_in_vnode = 1; SYSCTL_INT(_security_mac, OID_AUTO, cache_fslabel_in_vnode, CTLFLAG_RW, &mac_cache_fslabel_in_vnode, 0, "Cache mount fslabel in vnode"); TUNABLE_INT("security.mac.cache_fslabel_in_vnode", &mac_cache_fslabel_in_vnode); static int mac_vnode_label_cache_hits = 0; SYSCTL_INT(_security_mac, OID_AUTO, vnode_label_cache_hits, CTLFLAG_RD, &mac_vnode_label_cache_hits, 0, "Cache hits on vnode labels"); static int mac_vnode_label_cache_misses = 0; SYSCTL_INT(_security_mac, OID_AUTO, vnode_label_cache_misses, CTLFLAG_RD, &mac_vnode_label_cache_misses, 0, "Cache misses on vnode labels"); static int mac_mmap_revocation = 1; SYSCTL_INT(_security_mac, OID_AUTO, mmap_revocation, CTLFLAG_RW, &mac_mmap_revocation, 0, "Revoke mmap access to files on subject " "relabel"); static int mac_mmap_revocation_via_cow = 0; SYSCTL_INT(_security_mac, OID_AUTO, mmap_revocation_via_cow, CTLFLAG_RW, &mac_mmap_revocation_via_cow, 0, "Revoke mmap access to files via " "copy-on-write semantics, or by removing all write access"); #ifdef MAC_DEBUG SYSCTL_NODE(_security_mac, OID_AUTO, debug, CTLFLAG_RW, 0, "TrustedBSD MAC debug info"); static int mac_debug_label_fallback = 0; SYSCTL_INT(_security_mac_debug, OID_AUTO, label_fallback, CTLFLAG_RW, &mac_debug_label_fallback, 0, "Filesystems should fall back to fs label" "when label is corrupted."); TUNABLE_INT("security.mac.debug_label_fallback", &mac_debug_label_fallback); SYSCTL_NODE(_security_mac_debug, OID_AUTO, counters, CTLFLAG_RW, 0, "TrustedBSD MAC object counters"); static unsigned int nmacmbufs, nmaccreds, nmacifnets, nmacbpfdescs, nmacsockets, nmacmounts, nmactemp, nmacvnodes, nmacdevfsdirents, nmacipqs, nmacpipes; SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, mbufs, CTLFLAG_RD, &nmacmbufs, 0, "number of mbufs in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, creds, CTLFLAG_RD, &nmaccreds, 0, "number of ucreds in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, ifnets, CTLFLAG_RD, &nmacifnets, 0, "number of ifnets in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, ipqs, CTLFLAG_RD, &nmacipqs, 0, "number of ipqs in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, bpfdescs, CTLFLAG_RD, &nmacbpfdescs, 0, "number of bpfdescs in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, sockets, CTLFLAG_RD, &nmacsockets, 0, "number of sockets in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, pipes, CTLFLAG_RD, &nmacpipes, 0, "number of pipes in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, mounts, CTLFLAG_RD, &nmacmounts, 0, "number of mounts in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, temp, CTLFLAG_RD, &nmactemp, 0, "number of temporary labels in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, vnodes, CTLFLAG_RD, &nmacvnodes, 0, "number of vnodes in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, devfsdirents, CTLFLAG_RD, &nmacdevfsdirents, 0, "number of devfs dirents inuse"); #endif static int error_select(int error1, int error2); static int mac_externalize(struct label *label, struct mac *mac); static int mac_policy_register(struct mac_policy_conf *mpc); static int mac_policy_unregister(struct mac_policy_conf *mpc); static int mac_stdcreatevnode_ea(struct vnode *vp); static void mac_cred_mmapped_drop_perms(struct thread *td, struct ucred *cred); static void mac_cred_mmapped_drop_perms_recurse(struct thread *td, struct ucred *cred, struct vm_map *map); MALLOC_DEFINE(M_MACOPVEC, "macopvec", "MAC policy operation vector"); MALLOC_DEFINE(M_MACPIPELABEL, "macpipelabel", "MAC labels for pipes"); /* * mac_policy_list_lock protects the consistency of 'mac_policy_list', * the linked list of attached policy modules. Read-only consumers of * the list must acquire a shared lock for the duration of their use; * writers must acquire an exclusive lock. Note that for compound * operations, locks should be held for the entire compound operation, * and that this is not yet done for relabel requests. */ static struct mtx mac_policy_list_lock; static LIST_HEAD(, mac_policy_conf) mac_policy_list; static int mac_policy_list_busy; #define MAC_POLICY_LIST_LOCKINIT() mtx_init(&mac_policy_list_lock, \ "mac_policy_list_lock", NULL, MTX_DEF); #define MAC_POLICY_LIST_LOCK() mtx_lock(&mac_policy_list_lock); #define MAC_POLICY_LIST_UNLOCK() mtx_unlock(&mac_policy_list_lock); #define MAC_POLICY_LIST_BUSY() do { \ MAC_POLICY_LIST_LOCK(); \ mac_policy_list_busy++; \ MAC_POLICY_LIST_UNLOCK(); \ } while (0) #define MAC_POLICY_LIST_UNBUSY() do { \ MAC_POLICY_LIST_LOCK(); \ mac_policy_list_busy--; \ if (mac_policy_list_busy < 0) \ panic("Extra mac_policy_list_busy--"); \ MAC_POLICY_LIST_UNLOCK(); \ } while (0) /* * MAC_CHECK performs the designated check by walking the policy * module list and checking with each as to how it feels about the * request. Note that it returns its value via 'error' in the scope * of the caller. */ #define MAC_CHECK(check, args...) do { \ struct mac_policy_conf *mpc; \ \ error = 0; \ MAC_POLICY_LIST_BUSY(); \ LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { \ if (mpc->mpc_ops->mpo_ ## check != NULL) \ error = error_select( \ mpc->mpc_ops->mpo_ ## check (args), \ error); \ } \ MAC_POLICY_LIST_UNBUSY(); \ } while (0) /* * MAC_BOOLEAN performs the designated boolean composition by walking * the module list, invoking each instance of the operation, and * combining the results using the passed C operator. Note that it * returns its value via 'result' in the scope of the caller, which * should be initialized by the caller in a meaningful way to get * a meaningful result. */ #define MAC_BOOLEAN(operation, composition, args...) do { \ struct mac_policy_conf *mpc; \ \ MAC_POLICY_LIST_BUSY(); \ LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { \ if (mpc->mpc_ops->mpo_ ## operation != NULL) \ result = result composition \ mpc->mpc_ops->mpo_ ## operation (args); \ } \ MAC_POLICY_LIST_UNBUSY(); \ } while (0) /* * MAC_PERFORM performs the designated operation by walking the policy * module list and invoking that operation for each policy. */ #define MAC_PERFORM(operation, args...) do { \ struct mac_policy_conf *mpc; \ \ MAC_POLICY_LIST_BUSY(); \ LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { \ if (mpc->mpc_ops->mpo_ ## operation != NULL) \ mpc->mpc_ops->mpo_ ## operation (args); \ } \ MAC_POLICY_LIST_UNBUSY(); \ } while (0) /* * Initialize the MAC subsystem, including appropriate SMP locks. */ static void mac_init(void) { LIST_INIT(&mac_policy_list); MAC_POLICY_LIST_LOCKINIT(); } /* * For the purposes of modules that want to know if they were loaded * "early", set the mac_late flag once we've processed modules either * linked into the kernel, or loaded before the kernel startup. */ static void mac_late_init(void) { mac_late = 1; } /* * Allow MAC policy modules to register during boot, etc. */ int mac_policy_modevent(module_t mod, int type, void *data) { struct mac_policy_conf *mpc; int error; error = 0; mpc = (struct mac_policy_conf *) data; switch (type) { case MOD_LOAD: if (mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_NOTLATE && mac_late) { printf("mac_policy_modevent: can't load %s policy " "after booting\n", mpc->mpc_name); error = EBUSY; break; } error = mac_policy_register(mpc); break; case MOD_UNLOAD: /* Don't unregister the module if it was never registered. */ if ((mpc->mpc_runtime_flags & MPC_RUNTIME_FLAG_REGISTERED) != 0) error = mac_policy_unregister(mpc); else error = 0; break; default: break; } return (error); } static int mac_policy_register(struct mac_policy_conf *mpc) { struct mac_policy_conf *tmpc; struct mac_policy_op_entry *mpe; int slot; MALLOC(mpc->mpc_ops, struct mac_policy_ops *, sizeof(*mpc->mpc_ops), M_MACOPVEC, M_WAITOK | M_ZERO); for (mpe = mpc->mpc_entries; mpe->mpe_constant != MAC_OP_LAST; mpe++) { switch (mpe->mpe_constant) { case MAC_OP_LAST: /* * Doesn't actually happen, but this allows checking * that all enumerated values are handled. */ break; case MAC_DESTROY: mpc->mpc_ops->mpo_destroy = mpe->mpe_function; break; case MAC_INIT: mpc->mpc_ops->mpo_init = mpe->mpe_function; break; case MAC_SYSCALL: mpc->mpc_ops->mpo_syscall = mpe->mpe_function; break; case MAC_INIT_BPFDESC_LABEL: mpc->mpc_ops->mpo_init_bpfdesc_label = mpe->mpe_function; break; case MAC_INIT_CRED_LABEL: mpc->mpc_ops->mpo_init_cred_label = mpe->mpe_function; break; case MAC_INIT_DEVFSDIRENT_LABEL: mpc->mpc_ops->mpo_init_devfsdirent_label = mpe->mpe_function; break; case MAC_INIT_IFNET_LABEL: mpc->mpc_ops->mpo_init_ifnet_label = mpe->mpe_function; break; case MAC_INIT_IPQ_LABEL: mpc->mpc_ops->mpo_init_ipq_label = mpe->mpe_function; break; case MAC_INIT_MBUF_LABEL: mpc->mpc_ops->mpo_init_mbuf_label = mpe->mpe_function; break; case MAC_INIT_MOUNT_LABEL: mpc->mpc_ops->mpo_init_mount_label = mpe->mpe_function; break; case MAC_INIT_MOUNT_FS_LABEL: mpc->mpc_ops->mpo_init_mount_fs_label = mpe->mpe_function; break; case MAC_INIT_PIPE_LABEL: mpc->mpc_ops->mpo_init_pipe_label = mpe->mpe_function; break; case MAC_INIT_SOCKET_LABEL: mpc->mpc_ops->mpo_init_socket_label = mpe->mpe_function; break; case MAC_INIT_SOCKET_PEER_LABEL: mpc->mpc_ops->mpo_init_socket_peer_label = mpe->mpe_function; break; case MAC_INIT_TEMP_LABEL: mpc->mpc_ops->mpo_init_temp_label = mpe->mpe_function; break; case MAC_INIT_VNODE_LABEL: mpc->mpc_ops->mpo_init_vnode_label = mpe->mpe_function; break; case MAC_DESTROY_BPFDESC_LABEL: mpc->mpc_ops->mpo_destroy_bpfdesc_label = mpe->mpe_function; break; case MAC_DESTROY_CRED_LABEL: mpc->mpc_ops->mpo_destroy_cred_label = mpe->mpe_function; break; case MAC_DESTROY_DEVFSDIRENT_LABEL: mpc->mpc_ops->mpo_destroy_devfsdirent_label = mpe->mpe_function; break; case MAC_DESTROY_IFNET_LABEL: mpc->mpc_ops->mpo_destroy_ifnet_label = mpe->mpe_function; break; case MAC_DESTROY_IPQ_LABEL: mpc->mpc_ops->mpo_destroy_ipq_label = mpe->mpe_function; break; case MAC_DESTROY_MBUF_LABEL: mpc->mpc_ops->mpo_destroy_mbuf_label = mpe->mpe_function; break; case MAC_DESTROY_MOUNT_LABEL: mpc->mpc_ops->mpo_destroy_mount_label = mpe->mpe_function; break; case MAC_DESTROY_MOUNT_FS_LABEL: mpc->mpc_ops->mpo_destroy_mount_fs_label = mpe->mpe_function; break; case MAC_DESTROY_PIPE_LABEL: mpc->mpc_ops->mpo_destroy_pipe_label = mpe->mpe_function; break; case MAC_DESTROY_SOCKET_LABEL: mpc->mpc_ops->mpo_destroy_socket_label = mpe->mpe_function; break; case MAC_DESTROY_SOCKET_PEER_LABEL: mpc->mpc_ops->mpo_destroy_socket_peer_label = mpe->mpe_function; break; case MAC_DESTROY_TEMP_LABEL: mpc->mpc_ops->mpo_destroy_temp_label = mpe->mpe_function; break; case MAC_DESTROY_VNODE_LABEL: mpc->mpc_ops->mpo_destroy_vnode_label = mpe->mpe_function; break; case MAC_EXTERNALIZE: mpc->mpc_ops->mpo_externalize = mpe->mpe_function; break; case MAC_INTERNALIZE: mpc->mpc_ops->mpo_internalize = mpe->mpe_function; break; case MAC_CREATE_DEVFS_DEVICE: mpc->mpc_ops->mpo_create_devfs_device = mpe->mpe_function; break; case MAC_CREATE_DEVFS_DIRECTORY: mpc->mpc_ops->mpo_create_devfs_directory = mpe->mpe_function; break; case MAC_CREATE_DEVFS_VNODE: mpc->mpc_ops->mpo_create_devfs_vnode = mpe->mpe_function; break; case MAC_STDCREATEVNODE_EA: mpc->mpc_ops->mpo_stdcreatevnode_ea = mpe->mpe_function; break; case MAC_CREATE_VNODE: mpc->mpc_ops->mpo_create_vnode = mpe->mpe_function; break; case MAC_CREATE_MOUNT: mpc->mpc_ops->mpo_create_mount = mpe->mpe_function; break; case MAC_CREATE_ROOT_MOUNT: mpc->mpc_ops->mpo_create_root_mount = mpe->mpe_function; break; case MAC_RELABEL_VNODE: mpc->mpc_ops->mpo_relabel_vnode = mpe->mpe_function; break; case MAC_UPDATE_DEVFSDIRENT: mpc->mpc_ops->mpo_update_devfsdirent = mpe->mpe_function; break; case MAC_UPDATE_PROCFSVNODE: mpc->mpc_ops->mpo_update_procfsvnode = mpe->mpe_function; break; case MAC_UPDATE_VNODE_FROM_EXTATTR: mpc->mpc_ops->mpo_update_vnode_from_extattr = mpe->mpe_function; break; case MAC_UPDATE_VNODE_FROM_EXTERNALIZED: mpc->mpc_ops->mpo_update_vnode_from_externalized = mpe->mpe_function; break; case MAC_UPDATE_VNODE_FROM_MOUNT: mpc->mpc_ops->mpo_update_vnode_from_mount = mpe->mpe_function; break; case MAC_CREATE_MBUF_FROM_SOCKET: mpc->mpc_ops->mpo_create_mbuf_from_socket = mpe->mpe_function; break; case MAC_CREATE_PIPE: mpc->mpc_ops->mpo_create_pipe = mpe->mpe_function; break; case MAC_CREATE_SOCKET: mpc->mpc_ops->mpo_create_socket = mpe->mpe_function; break; case MAC_CREATE_SOCKET_FROM_SOCKET: mpc->mpc_ops->mpo_create_socket_from_socket = mpe->mpe_function; break; case MAC_RELABEL_PIPE: mpc->mpc_ops->mpo_relabel_pipe = mpe->mpe_function; break; case MAC_RELABEL_SOCKET: mpc->mpc_ops->mpo_relabel_socket = mpe->mpe_function; break; case MAC_SET_SOCKET_PEER_FROM_MBUF: mpc->mpc_ops->mpo_set_socket_peer_from_mbuf = mpe->mpe_function; break; case MAC_SET_SOCKET_PEER_FROM_SOCKET: mpc->mpc_ops->mpo_set_socket_peer_from_socket = mpe->mpe_function; break; case MAC_CREATE_BPFDESC: mpc->mpc_ops->mpo_create_bpfdesc = mpe->mpe_function; break; case MAC_CREATE_DATAGRAM_FROM_IPQ: mpc->mpc_ops->mpo_create_datagram_from_ipq = mpe->mpe_function; break; case MAC_CREATE_FRAGMENT: mpc->mpc_ops->mpo_create_fragment = mpe->mpe_function; break; case MAC_CREATE_IFNET: mpc->mpc_ops->mpo_create_ifnet = mpe->mpe_function; break; case MAC_CREATE_IPQ: mpc->mpc_ops->mpo_create_ipq = mpe->mpe_function; break; case MAC_CREATE_MBUF_FROM_MBUF: mpc->mpc_ops->mpo_create_mbuf_from_mbuf = mpe->mpe_function; break; case MAC_CREATE_MBUF_LINKLAYER: mpc->mpc_ops->mpo_create_mbuf_linklayer = mpe->mpe_function; break; case MAC_CREATE_MBUF_FROM_BPFDESC: mpc->mpc_ops->mpo_create_mbuf_from_bpfdesc = mpe->mpe_function; break; case MAC_CREATE_MBUF_FROM_IFNET: mpc->mpc_ops->mpo_create_mbuf_from_ifnet = mpe->mpe_function; break; case MAC_CREATE_MBUF_MULTICAST_ENCAP: mpc->mpc_ops->mpo_create_mbuf_multicast_encap = mpe->mpe_function; break; case MAC_CREATE_MBUF_NETLAYER: mpc->mpc_ops->mpo_create_mbuf_netlayer = mpe->mpe_function; break; case MAC_FRAGMENT_MATCH: mpc->mpc_ops->mpo_fragment_match = mpe->mpe_function; break; case MAC_RELABEL_IFNET: mpc->mpc_ops->mpo_relabel_ifnet = mpe->mpe_function; break; case MAC_UPDATE_IPQ: mpc->mpc_ops->mpo_update_ipq = mpe->mpe_function; break; case MAC_CREATE_CRED: mpc->mpc_ops->mpo_create_cred = mpe->mpe_function; break; case MAC_EXECVE_TRANSITION: mpc->mpc_ops->mpo_execve_transition = mpe->mpe_function; break; case MAC_EXECVE_WILL_TRANSITION: mpc->mpc_ops->mpo_execve_will_transition = mpe->mpe_function; break; case MAC_CREATE_PROC0: mpc->mpc_ops->mpo_create_proc0 = mpe->mpe_function; break; case MAC_CREATE_PROC1: mpc->mpc_ops->mpo_create_proc1 = mpe->mpe_function; break; case MAC_RELABEL_CRED: mpc->mpc_ops->mpo_relabel_cred = mpe->mpe_function; break; case MAC_THREAD_USERRET: mpc->mpc_ops->mpo_thread_userret = mpe->mpe_function; break; case MAC_CHECK_BPFDESC_RECEIVE: mpc->mpc_ops->mpo_check_bpfdesc_receive = mpe->mpe_function; break; case MAC_CHECK_CRED_RELABEL: mpc->mpc_ops->mpo_check_cred_relabel = mpe->mpe_function; break; case MAC_CHECK_CRED_VISIBLE: mpc->mpc_ops->mpo_check_cred_visible = mpe->mpe_function; break; case MAC_CHECK_IFNET_RELABEL: mpc->mpc_ops->mpo_check_ifnet_relabel = mpe->mpe_function; break; case MAC_CHECK_IFNET_TRANSMIT: mpc->mpc_ops->mpo_check_ifnet_transmit = mpe->mpe_function; break; case MAC_CHECK_MOUNT_STAT: mpc->mpc_ops->mpo_check_mount_stat = mpe->mpe_function; break; case MAC_CHECK_PIPE_IOCTL: mpc->mpc_ops->mpo_check_pipe_ioctl = mpe->mpe_function; break; case MAC_CHECK_PIPE_POLL: mpc->mpc_ops->mpo_check_pipe_poll = mpe->mpe_function; break; case MAC_CHECK_PIPE_READ: mpc->mpc_ops->mpo_check_pipe_read = mpe->mpe_function; break; case MAC_CHECK_PIPE_RELABEL: mpc->mpc_ops->mpo_check_pipe_relabel = mpe->mpe_function; break; case MAC_CHECK_PIPE_STAT: mpc->mpc_ops->mpo_check_pipe_stat = mpe->mpe_function; break; case MAC_CHECK_PIPE_WRITE: mpc->mpc_ops->mpo_check_pipe_write = mpe->mpe_function; break; case MAC_CHECK_PROC_DEBUG: mpc->mpc_ops->mpo_check_proc_debug = mpe->mpe_function; break; case MAC_CHECK_PROC_SCHED: mpc->mpc_ops->mpo_check_proc_sched = mpe->mpe_function; break; case MAC_CHECK_PROC_SIGNAL: mpc->mpc_ops->mpo_check_proc_signal = mpe->mpe_function; break; case MAC_CHECK_SOCKET_BIND: mpc->mpc_ops->mpo_check_socket_bind = mpe->mpe_function; break; case MAC_CHECK_SOCKET_CONNECT: mpc->mpc_ops->mpo_check_socket_connect = mpe->mpe_function; break; case MAC_CHECK_SOCKET_DELIVER: mpc->mpc_ops->mpo_check_socket_deliver = mpe->mpe_function; break; case MAC_CHECK_SOCKET_LISTEN: mpc->mpc_ops->mpo_check_socket_listen = mpe->mpe_function; break; case MAC_CHECK_SOCKET_RELABEL: mpc->mpc_ops->mpo_check_socket_relabel = mpe->mpe_function; break; case MAC_CHECK_SOCKET_VISIBLE: mpc->mpc_ops->mpo_check_socket_visible = mpe->mpe_function; break; case MAC_CHECK_VNODE_ACCESS: mpc->mpc_ops->mpo_check_vnode_access = mpe->mpe_function; break; case MAC_CHECK_VNODE_CHDIR: mpc->mpc_ops->mpo_check_vnode_chdir = mpe->mpe_function; break; case MAC_CHECK_VNODE_CHROOT: mpc->mpc_ops->mpo_check_vnode_chroot = mpe->mpe_function; break; case MAC_CHECK_VNODE_CREATE: mpc->mpc_ops->mpo_check_vnode_create = mpe->mpe_function; break; case MAC_CHECK_VNODE_DELETE: mpc->mpc_ops->mpo_check_vnode_delete = mpe->mpe_function; break; case MAC_CHECK_VNODE_DELETEACL: mpc->mpc_ops->mpo_check_vnode_deleteacl = mpe->mpe_function; break; case MAC_CHECK_VNODE_EXEC: mpc->mpc_ops->mpo_check_vnode_exec = mpe->mpe_function; break; case MAC_CHECK_VNODE_GETACL: mpc->mpc_ops->mpo_check_vnode_getacl = mpe->mpe_function; break; case MAC_CHECK_VNODE_GETEXTATTR: mpc->mpc_ops->mpo_check_vnode_getextattr = mpe->mpe_function; break; + case MAC_CHECK_VNODE_LINK: + mpc->mpc_ops->mpo_check_vnode_link = + mpe->mpe_function; + break; case MAC_CHECK_VNODE_LOOKUP: mpc->mpc_ops->mpo_check_vnode_lookup = mpe->mpe_function; break; case MAC_CHECK_VNODE_MMAP_PERMS: mpc->mpc_ops->mpo_check_vnode_mmap_perms = mpe->mpe_function; break; case MAC_CHECK_VNODE_OPEN: mpc->mpc_ops->mpo_check_vnode_open = mpe->mpe_function; break; case MAC_CHECK_VNODE_POLL: mpc->mpc_ops->mpo_check_vnode_poll = mpe->mpe_function; break; case MAC_CHECK_VNODE_READ: mpc->mpc_ops->mpo_check_vnode_read = mpe->mpe_function; break; case MAC_CHECK_VNODE_READDIR: mpc->mpc_ops->mpo_check_vnode_readdir = mpe->mpe_function; break; case MAC_CHECK_VNODE_READLINK: mpc->mpc_ops->mpo_check_vnode_readlink = mpe->mpe_function; break; case MAC_CHECK_VNODE_RELABEL: mpc->mpc_ops->mpo_check_vnode_relabel = mpe->mpe_function; break; case MAC_CHECK_VNODE_RENAME_FROM: mpc->mpc_ops->mpo_check_vnode_rename_from = mpe->mpe_function; break; case MAC_CHECK_VNODE_RENAME_TO: mpc->mpc_ops->mpo_check_vnode_rename_to = mpe->mpe_function; break; case MAC_CHECK_VNODE_REVOKE: mpc->mpc_ops->mpo_check_vnode_revoke = mpe->mpe_function; break; case MAC_CHECK_VNODE_SETACL: mpc->mpc_ops->mpo_check_vnode_setacl = mpe->mpe_function; break; case MAC_CHECK_VNODE_SETEXTATTR: mpc->mpc_ops->mpo_check_vnode_setextattr = mpe->mpe_function; break; case MAC_CHECK_VNODE_SETFLAGS: mpc->mpc_ops->mpo_check_vnode_setflags = mpe->mpe_function; break; case MAC_CHECK_VNODE_SETMODE: mpc->mpc_ops->mpo_check_vnode_setmode = mpe->mpe_function; break; case MAC_CHECK_VNODE_SETOWNER: mpc->mpc_ops->mpo_check_vnode_setowner = mpe->mpe_function; break; case MAC_CHECK_VNODE_SETUTIMES: mpc->mpc_ops->mpo_check_vnode_setutimes = mpe->mpe_function; break; case MAC_CHECK_VNODE_STAT: mpc->mpc_ops->mpo_check_vnode_stat = mpe->mpe_function; break; case MAC_CHECK_VNODE_WRITE: mpc->mpc_ops->mpo_check_vnode_write = mpe->mpe_function; break; /* default: printf("MAC policy `%s': unknown operation %d\n", mpc->mpc_name, mpe->mpe_constant); return (EINVAL); */ } } MAC_POLICY_LIST_LOCK(); if (mac_policy_list_busy > 0) { MAC_POLICY_LIST_UNLOCK(); FREE(mpc->mpc_ops, M_MACOPVEC); mpc->mpc_ops = NULL; return (EBUSY); } LIST_FOREACH(tmpc, &mac_policy_list, mpc_list) { if (strcmp(tmpc->mpc_name, mpc->mpc_name) == 0) { MAC_POLICY_LIST_UNLOCK(); FREE(mpc->mpc_ops, M_MACOPVEC); mpc->mpc_ops = NULL; return (EEXIST); } } if (mpc->mpc_field_off != NULL) { slot = ffs(mac_policy_offsets_free); if (slot == 0) { MAC_POLICY_LIST_UNLOCK(); FREE(mpc->mpc_ops, M_MACOPVEC); mpc->mpc_ops = NULL; return (ENOMEM); } slot--; mac_policy_offsets_free &= ~(1 << slot); *mpc->mpc_field_off = slot; } mpc->mpc_runtime_flags |= MPC_RUNTIME_FLAG_REGISTERED; LIST_INSERT_HEAD(&mac_policy_list, mpc, mpc_list); /* Per-policy initialization. */ if (mpc->mpc_ops->mpo_init != NULL) (*(mpc->mpc_ops->mpo_init))(mpc); MAC_POLICY_LIST_UNLOCK(); printf("Security policy loaded: %s (%s)\n", mpc->mpc_fullname, mpc->mpc_name); return (0); } static int mac_policy_unregister(struct mac_policy_conf *mpc) { /* * If we fail the load, we may get a request to unload. Check * to see if we did the run-time registration, and if not, * silently succeed. */ MAC_POLICY_LIST_LOCK(); if ((mpc->mpc_runtime_flags & MPC_RUNTIME_FLAG_REGISTERED) == 0) { MAC_POLICY_LIST_UNLOCK(); return (0); } #if 0 /* * Don't allow unloading modules with private data. */ if (mpc->mpc_field_off != NULL) { MAC_POLICY_LIST_UNLOCK(); return (EBUSY); } #endif /* * Only allow the unload to proceed if the module is unloadable * by its own definition. */ if ((mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_UNLOADOK) == 0) { MAC_POLICY_LIST_UNLOCK(); return (EBUSY); } /* * Right now, we EBUSY if the list is in use. In the future, * for reliability reasons, we might want to sleep and wakeup * later to try again. */ if (mac_policy_list_busy > 0) { MAC_POLICY_LIST_UNLOCK(); return (EBUSY); } if (mpc->mpc_ops->mpo_destroy != NULL) (*(mpc->mpc_ops->mpo_destroy))(mpc); LIST_REMOVE(mpc, mpc_list); MAC_POLICY_LIST_UNLOCK(); FREE(mpc->mpc_ops, M_MACOPVEC); mpc->mpc_ops = NULL; printf("Security policy unload: %s (%s)\n", mpc->mpc_fullname, mpc->mpc_name); return (0); } /* * Define an error value precedence, and given two arguments, selects the * value with the higher precedence. */ static int error_select(int error1, int error2) { /* Certain decision-making errors take top priority. */ if (error1 == EDEADLK || error2 == EDEADLK) return (EDEADLK); /* Invalid arguments should be reported where possible. */ if (error1 == EINVAL || error2 == EINVAL) return (EINVAL); /* Precedence goes to "visibility", with both process and file. */ if (error1 == ESRCH || error2 == ESRCH) return (ESRCH); if (error1 == ENOENT || error2 == ENOENT) return (ENOENT); /* Precedence goes to DAC/MAC protections. */ if (error1 == EACCES || error2 == EACCES) return (EACCES); /* Precedence goes to privilege. */ if (error1 == EPERM || error2 == EPERM) return (EPERM); /* Precedence goes to error over success; otherwise, arbitrary. */ if (error1 != 0) return (error1); return (error2); } static void mac_init_label(struct label *label) { bzero(label, sizeof(*label)); label->l_flags = MAC_FLAG_INITIALIZED; } static void mac_destroy_label(struct label *label) { KASSERT(label->l_flags & MAC_FLAG_INITIALIZED, ("destroying uninitialized label")); bzero(label, sizeof(*label)); /* implicit: label->l_flags &= ~MAC_FLAG_INITIALIZED; */ } static void mac_init_structmac(struct mac *mac) { bzero(mac, sizeof(*mac)); mac->m_macflags = MAC_FLAG_INITIALIZED; } void mac_init_bpfdesc(struct bpf_d *bpf_d) { mac_init_label(&bpf_d->bd_label); MAC_PERFORM(init_bpfdesc_label, &bpf_d->bd_label); #ifdef MAC_DEBUG atomic_add_int(&nmacbpfdescs, 1); #endif } void mac_init_cred(struct ucred *cr) { mac_init_label(&cr->cr_label); MAC_PERFORM(init_cred_label, &cr->cr_label); #ifdef MAC_DEBUG atomic_add_int(&nmaccreds, 1); #endif } void mac_init_devfsdirent(struct devfs_dirent *de) { mac_init_label(&de->de_label); MAC_PERFORM(init_devfsdirent_label, &de->de_label); #ifdef MAC_DEBUG atomic_add_int(&nmacdevfsdirents, 1); #endif } void mac_init_ifnet(struct ifnet *ifp) { mac_init_label(&ifp->if_label); MAC_PERFORM(init_ifnet_label, &ifp->if_label); #ifdef MAC_DEBUG atomic_add_int(&nmacifnets, 1); #endif } void mac_init_ipq(struct ipq *ipq) { mac_init_label(&ipq->ipq_label); MAC_PERFORM(init_ipq_label, &ipq->ipq_label); #ifdef MAC_DEBUG atomic_add_int(&nmacipqs, 1); #endif } int mac_init_mbuf(struct mbuf *m, int flag) { int error; KASSERT(m->m_flags & M_PKTHDR, ("mac_init_mbuf on non-header mbuf")); mac_init_label(&m->m_pkthdr.label); MAC_CHECK(init_mbuf_label, &m->m_pkthdr.label, flag); if (error) { MAC_PERFORM(destroy_mbuf_label, &m->m_pkthdr.label); mac_destroy_label(&m->m_pkthdr.label); } #ifdef MAC_DEBUG if (error == 0) atomic_add_int(&nmacmbufs, 1); #endif return (error); } void mac_init_mount(struct mount *mp) { mac_init_label(&mp->mnt_mntlabel); mac_init_label(&mp->mnt_fslabel); MAC_PERFORM(init_mount_label, &mp->mnt_mntlabel); MAC_PERFORM(init_mount_fs_label, &mp->mnt_fslabel); #ifdef MAC_DEBUG atomic_add_int(&nmacmounts, 1); #endif } void mac_init_pipe(struct pipe *pipe) { struct label *label; label = malloc(sizeof(struct label), M_MACPIPELABEL, M_ZERO|M_WAITOK); mac_init_label(label); pipe->pipe_label = label; pipe->pipe_peer->pipe_label = label; MAC_PERFORM(init_pipe_label, pipe->pipe_label); #ifdef MAC_DEBUG atomic_add_int(&nmacpipes, 1); #endif } void mac_init_socket(struct socket *socket) { mac_init_label(&socket->so_label); mac_init_label(&socket->so_peerlabel); MAC_PERFORM(init_socket_label, &socket->so_label); MAC_PERFORM(init_socket_peer_label, &socket->so_peerlabel); #ifdef MAC_DEBUG atomic_add_int(&nmacsockets, 1); #endif } static void mac_init_temp(struct label *label) { mac_init_label(label); MAC_PERFORM(init_temp_label, label); #ifdef MAC_DEBUG atomic_add_int(&nmactemp, 1); #endif } void mac_init_vnode(struct vnode *vp) { mac_init_label(&vp->v_label); MAC_PERFORM(init_vnode_label, &vp->v_label); #ifdef MAC_DEBUG atomic_add_int(&nmacvnodes, 1); #endif } void mac_destroy_bpfdesc(struct bpf_d *bpf_d) { MAC_PERFORM(destroy_bpfdesc_label, &bpf_d->bd_label); mac_destroy_label(&bpf_d->bd_label); #ifdef MAC_DEBUG atomic_subtract_int(&nmacbpfdescs, 1); #endif } void mac_destroy_cred(struct ucred *cr) { MAC_PERFORM(destroy_cred_label, &cr->cr_label); mac_destroy_label(&cr->cr_label); #ifdef MAC_DEBUG atomic_subtract_int(&nmaccreds, 1); #endif } void mac_destroy_devfsdirent(struct devfs_dirent *de) { MAC_PERFORM(destroy_devfsdirent_label, &de->de_label); mac_destroy_label(&de->de_label); #ifdef MAC_DEBUG atomic_subtract_int(&nmacdevfsdirents, 1); #endif } void mac_destroy_ifnet(struct ifnet *ifp) { MAC_PERFORM(destroy_ifnet_label, &ifp->if_label); mac_destroy_label(&ifp->if_label); #ifdef MAC_DEBUG atomic_subtract_int(&nmacifnets, 1); #endif } void mac_destroy_ipq(struct ipq *ipq) { MAC_PERFORM(destroy_ipq_label, &ipq->ipq_label); mac_destroy_label(&ipq->ipq_label); #ifdef MAC_DEBUG atomic_subtract_int(&nmacipqs, 1); #endif } void mac_destroy_mbuf(struct mbuf *m) { MAC_PERFORM(destroy_mbuf_label, &m->m_pkthdr.label); mac_destroy_label(&m->m_pkthdr.label); #ifdef MAC_DEBUG atomic_subtract_int(&nmacmbufs, 1); #endif } void mac_destroy_mount(struct mount *mp) { MAC_PERFORM(destroy_mount_label, &mp->mnt_mntlabel); MAC_PERFORM(destroy_mount_fs_label, &mp->mnt_fslabel); mac_destroy_label(&mp->mnt_fslabel); mac_destroy_label(&mp->mnt_mntlabel); #ifdef MAC_DEBUG atomic_subtract_int(&nmacmounts, 1); #endif } void mac_destroy_pipe(struct pipe *pipe) { MAC_PERFORM(destroy_pipe_label, pipe->pipe_label); mac_destroy_label(pipe->pipe_label); free(pipe->pipe_label, M_MACPIPELABEL); #ifdef MAC_DEBUG atomic_subtract_int(&nmacpipes, 1); #endif } void mac_destroy_socket(struct socket *socket) { MAC_PERFORM(destroy_socket_label, &socket->so_label); MAC_PERFORM(destroy_socket_peer_label, &socket->so_peerlabel); mac_destroy_label(&socket->so_label); mac_destroy_label(&socket->so_peerlabel); #ifdef MAC_DEBUG atomic_subtract_int(&nmacsockets, 1); #endif } static void mac_destroy_temp(struct label *label) { MAC_PERFORM(destroy_temp_label, label); mac_destroy_label(label); #ifdef MAC_DEBUG atomic_subtract_int(&nmactemp, 1); #endif } void mac_destroy_vnode(struct vnode *vp) { MAC_PERFORM(destroy_vnode_label, &vp->v_label); mac_destroy_label(&vp->v_label); #ifdef MAC_DEBUG atomic_subtract_int(&nmacvnodes, 1); #endif } static int mac_externalize(struct label *label, struct mac *mac) { int error; mac_init_structmac(mac); MAC_CHECK(externalize, label, mac); return (error); } static int mac_internalize(struct label *label, struct mac *mac) { int error; mac_init_temp(label); MAC_CHECK(internalize, label, mac); if (error) mac_destroy_temp(label); return (error); } /* * Initialize MAC label for the first kernel process, from which other * kernel processes and threads are spawned. */ void mac_create_proc0(struct ucred *cred) { MAC_PERFORM(create_proc0, cred); } /* * Initialize MAC label for the first userland process, from which other * userland processes and threads are spawned. */ void mac_create_proc1(struct ucred *cred) { MAC_PERFORM(create_proc1, cred); } void mac_thread_userret(struct thread *td) { MAC_PERFORM(thread_userret, td); } /* * When a new process is created, its label must be initialized. Generally, * this involves inheritence from the parent process, modulo possible * deltas. This function allows that processing to take place. */ void mac_create_cred(struct ucred *parent_cred, struct ucred *child_cred) { MAC_PERFORM(create_cred, parent_cred, child_cred); } void mac_update_devfsdirent(struct devfs_dirent *de, struct vnode *vp) { MAC_PERFORM(update_devfsdirent, de, &de->de_label, vp, &vp->v_label); } void mac_update_procfsvnode(struct vnode *vp, struct ucred *cred) { MAC_PERFORM(update_procfsvnode, vp, &vp->v_label, cred); } /* * Support callout for policies that manage their own externalization * using extended attributes. */ static int mac_update_vnode_from_extattr(struct vnode *vp, struct mount *mp) { int error; MAC_CHECK(update_vnode_from_extattr, vp, &vp->v_label, mp, &mp->mnt_fslabel); return (error); } /* * Given an externalized mac label, internalize it and stamp it on a * vnode. */ static int mac_update_vnode_from_externalized(struct vnode *vp, struct mac *extmac) { int error; MAC_CHECK(update_vnode_from_externalized, vp, &vp->v_label, extmac); return (error); } /* * Call out to individual policies to update the label in a vnode from * the mountpoint. */ void mac_update_vnode_from_mount(struct vnode *vp, struct mount *mp) { MAC_PERFORM(update_vnode_from_mount, vp, &vp->v_label, mp, &mp->mnt_fslabel); ASSERT_VOP_LOCKED(vp, "mac_update_vnode_from_mount"); if (mac_cache_fslabel_in_vnode) vp->v_vflag |= VV_CACHEDLABEL; } /* * Implementation of VOP_REFRESHLABEL() that relies on extended attributes * to store label data. Can be referenced by filesystems supporting * extended attributes. */ int vop_stdrefreshlabel_ea(struct vop_refreshlabel_args *ap) { struct vnode *vp = ap->a_vp; struct mac extmac; int buflen, error; ASSERT_VOP_LOCKED(vp, "vop_stdrefreshlabel_ea"); /* * Call out to external policies first. Order doesn't really * matter, as long as failure of one assures failure of all. */ error = mac_update_vnode_from_extattr(vp, vp->v_mount); if (error) return (error); buflen = sizeof(extmac); error = vn_extattr_get(vp, IO_NODELOCKED, FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME, &buflen, (char *)&extmac, curthread); switch (error) { case 0: /* Got it */ break; case ENOATTR: /* * Use the label from the mount point. */ mac_update_vnode_from_mount(vp, vp->v_mount); return (0); case EOPNOTSUPP: default: /* Fail horribly. */ return (error); } if (buflen != sizeof(extmac)) error = EPERM; /* Fail very closed. */ if (error == 0) error = mac_update_vnode_from_externalized(vp, &extmac); if (error == 0) vp->v_vflag |= VV_CACHEDLABEL; else { struct vattr va; printf("Corrupted label on %s", vp->v_mount->mnt_stat.f_mntonname); if (VOP_GETATTR(vp, &va, curthread->td_ucred, curthread) == 0) printf(" inum %ld", va.va_fileid); #ifdef MAC_DEBUG if (mac_debug_label_fallback) { printf(", falling back.\n"); mac_update_vnode_from_mount(vp, vp->v_mount); error = 0; } else { #endif printf(".\n"); error = EPERM; #ifdef MAC_DEBUG } #endif } return (error); } /* * Make sure the vnode label is up-to-date. If EOPNOTSUPP, then we handle * the labeling activity outselves. Filesystems should be careful not * to change their minds regarding whether they support vop_refreshlabel() * for a vnode or not. Don't cache the vnode here, allow the file * system code to determine if it's safe to cache. If we update from * the mount, don't cache since a change to the mount label should affect * all vnodes. */ static int vn_refreshlabel(struct vnode *vp, struct ucred *cred) { int error; ASSERT_VOP_LOCKED(vp, "vn_refreshlabel"); if (vp->v_mount == NULL) { /* Eventually, we probably want to special-case refreshing of deadfs vnodes, and if there's a lock-free race somewhere, that case might be handled here. mac_update_vnode_deadfs(vp); return (0); */ /* printf("vn_refreshlabel: null v_mount\n"); */ if (vp->v_type != VNON) printf( "vn_refreshlabel: null v_mount with non-VNON\n"); return (EBADF); } if (vp->v_vflag & VV_CACHEDLABEL) { mac_vnode_label_cache_hits++; return (0); } else mac_vnode_label_cache_misses++; if ((vp->v_mount->mnt_flag & MNT_MULTILABEL) == 0) { mac_update_vnode_from_mount(vp, vp->v_mount); return (0); } error = VOP_REFRESHLABEL(vp, cred, curthread); switch (error) { case EOPNOTSUPP: /* * If labels are not supported on this vnode, fall back to * the label in the mount and propagate it to the vnode. * There should probably be some sort of policy/flag/decision * about doing this. */ mac_update_vnode_from_mount(vp, vp->v_mount); error = 0; default: return (error); } } /* * Helper function for file systems using the vop_std*_ea() calls. This * function must be called after EA service is available for the vnode, * but before it's hooked up to the namespace so that the node persists * if there's a crash, or before it can be accessed. On successful * commit of the label to disk (etc), do cache the label. */ int vop_stdcreatevnode_ea(struct vnode *dvp, struct vnode *tvp, struct ucred *cred) { struct mac extmac; int error; ASSERT_VOP_LOCKED(tvp, "vop_stdcreatevnode_ea"); if ((dvp->v_mount->mnt_flag & MNT_MULTILABEL) == 0) { mac_update_vnode_from_mount(tvp, tvp->v_mount); } else { error = vn_refreshlabel(dvp, cred); if (error) return (error); /* * Stick the label in the vnode. Then try to write to * disk. If we fail, return a failure to abort the * create operation. Really, this failure shouldn't * happen except in fairly unusual circumstances (out * of disk, etc). */ mac_create_vnode(cred, dvp, tvp); error = mac_stdcreatevnode_ea(tvp); if (error) return (error); /* * XXX: Eventually this will go away and all policies will * directly manage their extended attributes. */ error = mac_externalize(&tvp->v_label, &extmac); if (error) return (error); error = vn_extattr_set(tvp, IO_NODELOCKED, FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME, sizeof(extmac), (char *)&extmac, curthread); if (error == 0) tvp->v_vflag |= VV_CACHEDLABEL; else { #if 0 /* * In theory, we could have fall-back behavior here. * It would probably be incorrect. */ #endif return (error); } } return (0); } void mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_execve_transition"); error = vn_refreshlabel(vp, old); if (error) { printf("mac_execve_transition: vn_refreshlabel returned %d\n", error); printf("mac_execve_transition: using old vnode label\n"); } MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label); } int mac_execve_will_transition(struct ucred *old, struct vnode *vp) { int error, result; error = vn_refreshlabel(vp, old); if (error) return (error); result = 0; MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label); return (result); } int mac_check_vnode_access(struct ucred *cred, struct vnode *vp, int flags) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_access"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_access, cred, vp, &vp->v_label, flags); return (error); } int mac_check_vnode_chdir(struct ucred *cred, struct vnode *dvp) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_chdir"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); MAC_CHECK(check_vnode_chdir, cred, dvp, &dvp->v_label); return (error); } int mac_check_vnode_chroot(struct ucred *cred, struct vnode *dvp) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_chroot"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); MAC_CHECK(check_vnode_chroot, cred, dvp, &dvp->v_label); return (error); } int mac_check_vnode_create(struct ucred *cred, struct vnode *dvp, struct componentname *cnp, struct vattr *vap) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_create"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); MAC_CHECK(check_vnode_create, cred, dvp, &dvp->v_label, cnp, vap); return (error); } int mac_check_vnode_delete(struct ucred *cred, struct vnode *dvp, struct vnode *vp, struct componentname *cnp) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_delete"); ASSERT_VOP_LOCKED(vp, "mac_check_vnode_delete"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_delete, cred, dvp, &dvp->v_label, vp, &vp->v_label, cnp); return (error); } int mac_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp, acl_type_t type) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_deleteacl"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_deleteacl, cred, vp, &vp->v_label, type); return (error); } int mac_check_vnode_exec(struct ucred *cred, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_exec"); if (!mac_enforce_process && !mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label); return (error); } int mac_check_vnode_getacl(struct ucred *cred, struct vnode *vp, acl_type_t type) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_getacl"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_getacl, cred, vp, &vp->v_label, type); return (error); } int mac_check_vnode_getextattr(struct ucred *cred, struct vnode *vp, int attrnamespace, const char *name, struct uio *uio) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_getextattr"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_getextattr, cred, vp, &vp->v_label, attrnamespace, name, uio); + return (error); +} + +int +mac_check_vnode_link(struct ucred *cred, struct vnode *dvp, + struct vnode *vp, struct componentname *cnp) +{ + + int error; + + ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_link"); + ASSERT_VOP_LOCKED(vp, "mac_check_vnode_link"); + + if (!mac_enforce_fs) + return (0); + + error = vn_refreshlabel(dvp, cred); + if (error) + return (error); + + error = vn_refreshlabel(vp, cred); + if (error) + return (error); + + MAC_CHECK(check_vnode_link, cred, dvp, &dvp->v_label, vp, + &vp->v_label, cnp); return (error); } int mac_check_vnode_lookup(struct ucred *cred, struct vnode *dvp, struct componentname *cnp) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_lookup"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); MAC_CHECK(check_vnode_lookup, cred, dvp, &dvp->v_label, cnp); return (error); } vm_prot_t mac_check_vnode_mmap_prot(struct ucred *cred, struct vnode *vp, int newmapping) { vm_prot_t result = VM_PROT_ALL; if (!mac_enforce_vm) return (result); /* * This should be some sort of MAC_BITWISE, maybe :) */ ASSERT_VOP_LOCKED(vp, "mac_check_vnode_mmap_perms"); MAC_BOOLEAN(check_vnode_mmap_perms, &, cred, vp, &vp->v_label, newmapping); return (result); } int mac_check_vnode_open(struct ucred *cred, struct vnode *vp, mode_t acc_mode) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_open"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_open, cred, vp, &vp->v_label, acc_mode); return (error); } int mac_check_vnode_poll(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_poll"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, active_cred); if (error) return (error); MAC_CHECK(check_vnode_poll, active_cred, file_cred, vp, &vp->v_label); return (error); } int mac_check_vnode_read(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_read"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, active_cred); if (error) return (error); MAC_CHECK(check_vnode_read, active_cred, file_cred, vp, &vp->v_label); return (error); } int mac_check_vnode_readdir(struct ucred *cred, struct vnode *dvp) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_readdir"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); MAC_CHECK(check_vnode_readdir, cred, dvp, &dvp->v_label); return (error); } int mac_check_vnode_readlink(struct ucred *cred, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_readlink"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_readlink, cred, vp, &vp->v_label); return (error); } static int mac_check_vnode_relabel(struct ucred *cred, struct vnode *vp, struct label *newlabel) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_relabel"); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_relabel, cred, vp, &vp->v_label, newlabel); return (error); } int mac_check_vnode_rename_from(struct ucred *cred, struct vnode *dvp, struct vnode *vp, struct componentname *cnp) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_rename_from"); ASSERT_VOP_LOCKED(vp, "mac_check_vnode_rename_from"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_rename_from, cred, dvp, &dvp->v_label, vp, &vp->v_label, cnp); return (error); } int mac_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp, struct vnode *vp, int samedir, struct componentname *cnp) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_rename_to"); ASSERT_VOP_LOCKED(vp, "mac_check_vnode_rename_to"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); if (vp != NULL) { error = vn_refreshlabel(vp, cred); if (error) return (error); } MAC_CHECK(check_vnode_rename_to, cred, dvp, &dvp->v_label, vp, vp != NULL ? &vp->v_label : NULL, samedir, cnp); return (error); } int mac_check_vnode_revoke(struct ucred *cred, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_revoke"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_revoke, cred, vp, &vp->v_label); return (error); } int mac_check_vnode_setacl(struct ucred *cred, struct vnode *vp, acl_type_t type, struct acl *acl) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setacl"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_setacl, cred, vp, &vp->v_label, type, acl); return (error); } int mac_check_vnode_setextattr(struct ucred *cred, struct vnode *vp, int attrnamespace, const char *name, struct uio *uio) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setextattr"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_setextattr, cred, vp, &vp->v_label, attrnamespace, name, uio); return (error); } int mac_check_vnode_setflags(struct ucred *cred, struct vnode *vp, u_long flags) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setflags"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_setflags, cred, vp, &vp->v_label, flags); return (error); } int mac_check_vnode_setmode(struct ucred *cred, struct vnode *vp, mode_t mode) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setmode"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_setmode, cred, vp, &vp->v_label, mode); return (error); } int mac_check_vnode_setowner(struct ucred *cred, struct vnode *vp, uid_t uid, gid_t gid) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setowner"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_setowner, cred, vp, &vp->v_label, uid, gid); return (error); } int mac_check_vnode_setutimes(struct ucred *cred, struct vnode *vp, struct timespec atime, struct timespec mtime) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setutimes"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_setutimes, cred, vp, &vp->v_label, atime, mtime); return (error); } int mac_check_vnode_stat(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_stat"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, active_cred); if (error) return (error); MAC_CHECK(check_vnode_stat, active_cred, file_cred, vp, &vp->v_label); return (error); } int mac_check_vnode_write(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_write"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, active_cred); if (error) return (error); MAC_CHECK(check_vnode_write, active_cred, file_cred, vp, &vp->v_label); return (error); } /* * When relabeling a process, call out to the policies for the maximum * permission allowed for each object type we know about in its * memory space, and revoke access (in the least surprising ways we * know) when necessary. The process lock is not held here. */ static void mac_cred_mmapped_drop_perms(struct thread *td, struct ucred *cred) { /* XXX freeze all other threads */ mac_cred_mmapped_drop_perms_recurse(td, cred, &td->td_proc->p_vmspace->vm_map); /* XXX allow other threads to continue */ } static __inline const char * prot2str(vm_prot_t prot) { switch (prot & VM_PROT_ALL) { case VM_PROT_READ: return ("r--"); case VM_PROT_READ | VM_PROT_WRITE: return ("rw-"); case VM_PROT_READ | VM_PROT_EXECUTE: return ("r-x"); case VM_PROT_READ | VM_PROT_WRITE | VM_PROT_EXECUTE: return ("rwx"); case VM_PROT_WRITE: return ("-w-"); case VM_PROT_EXECUTE: return ("--x"); case VM_PROT_WRITE | VM_PROT_EXECUTE: return ("-wx"); default: return ("---"); } } static void mac_cred_mmapped_drop_perms_recurse(struct thread *td, struct ucred *cred, struct vm_map *map) { struct vm_map_entry *vme; vm_prot_t result, revokeperms; vm_object_t object; vm_ooffset_t offset; struct vnode *vp; if (!mac_mmap_revocation) return; vm_map_lock_read(map); for (vme = map->header.next; vme != &map->header; vme = vme->next) { if (vme->eflags & MAP_ENTRY_IS_SUB_MAP) { mac_cred_mmapped_drop_perms_recurse(td, cred, vme->object.sub_map); continue; } /* * Skip over entries that obviously are not shared. */ if (vme->eflags & (MAP_ENTRY_COW | MAP_ENTRY_NOSYNC) || !vme->max_protection) continue; /* * Drill down to the deepest backing object. */ offset = vme->offset; object = vme->object.vm_object; if (object == NULL) continue; while (object->backing_object != NULL) { object = object->backing_object; offset += object->backing_object_offset; } /* * At the moment, vm_maps and objects aren't considered * by the MAC system, so only things with backing by a * normal object (read: vnodes) are checked. */ if (object->type != OBJT_VNODE) continue; vp = (struct vnode *)object->handle; vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); result = mac_check_vnode_mmap_prot(cred, vp, 0); VOP_UNLOCK(vp, 0, td); /* * Find out what maximum protection we may be allowing * now but a policy needs to get removed. */ revokeperms = vme->max_protection & ~result; if (!revokeperms) continue; printf("pid %ld: revoking %s perms from %#lx:%ld " "(max %s/cur %s)\n", (long)td->td_proc->p_pid, prot2str(revokeperms), (u_long)vme->start, (long)(vme->end - vme->start), prot2str(vme->max_protection), prot2str(vme->protection)); vm_map_lock_upgrade(map); /* * This is the really simple case: if a map has more * max_protection than is allowed, but it's not being * actually used (that is, the current protection is * still allowed), we can just wipe it out and do * nothing more. */ if ((vme->protection & revokeperms) == 0) { vme->max_protection -= revokeperms; } else { if (revokeperms & VM_PROT_WRITE) { /* * In the more complicated case, flush out all * pending changes to the object then turn it * copy-on-write. */ vm_object_reference(object); vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); vm_object_page_clean(object, OFF_TO_IDX(offset), OFF_TO_IDX(offset + vme->end - vme->start + PAGE_MASK), OBJPC_SYNC); VOP_UNLOCK(vp, 0, td); vm_object_deallocate(object); /* * Why bother if there's no read permissions * anymore? For the rest, we need to leave * the write permissions on for COW, or * remove them entirely if configured to. */ if (!mac_mmap_revocation_via_cow) { vme->max_protection &= ~VM_PROT_WRITE; vme->protection &= ~VM_PROT_WRITE; } if ((revokeperms & VM_PROT_READ) == 0) vme->eflags |= MAP_ENTRY_COW | MAP_ENTRY_NEEDS_COPY; } if (revokeperms & VM_PROT_EXECUTE) { vme->max_protection &= ~VM_PROT_EXECUTE; vme->protection &= ~VM_PROT_EXECUTE; } if (revokeperms & VM_PROT_READ) { vme->max_protection = 0; vme->protection = 0; } pmap_protect(map->pmap, vme->start, vme->end, vme->protection & ~revokeperms); vm_map_simplify_entry(map, vme); } vm_map_lock_downgrade(map); } vm_map_unlock_read(map); } /* * When the subject's label changes, it may require revocation of privilege * to mapped objects. This can't be done on-the-fly later with a unified * buffer cache. */ static void mac_relabel_cred(struct ucred *cred, struct label *newlabel) { MAC_PERFORM(relabel_cred, cred, newlabel); } void mac_relabel_vnode(struct ucred *cred, struct vnode *vp, struct label *newlabel) { MAC_PERFORM(relabel_vnode, cred, vp, &vp->v_label, newlabel); } void mac_create_ifnet(struct ifnet *ifnet) { MAC_PERFORM(create_ifnet, ifnet, &ifnet->if_label); } void mac_create_bpfdesc(struct ucred *cred, struct bpf_d *bpf_d) { MAC_PERFORM(create_bpfdesc, cred, bpf_d, &bpf_d->bd_label); } void mac_create_socket(struct ucred *cred, struct socket *socket) { MAC_PERFORM(create_socket, cred, socket, &socket->so_label); } void mac_create_pipe(struct ucred *cred, struct pipe *pipe) { MAC_PERFORM(create_pipe, cred, pipe, pipe->pipe_label); } void mac_create_socket_from_socket(struct socket *oldsocket, struct socket *newsocket) { MAC_PERFORM(create_socket_from_socket, oldsocket, &oldsocket->so_label, newsocket, &newsocket->so_label); } static void mac_relabel_socket(struct ucred *cred, struct socket *socket, struct label *newlabel) { MAC_PERFORM(relabel_socket, cred, socket, &socket->so_label, newlabel); } static void mac_relabel_pipe(struct ucred *cred, struct pipe *pipe, struct label *newlabel) { MAC_PERFORM(relabel_pipe, cred, pipe, pipe->pipe_label, newlabel); } void mac_set_socket_peer_from_mbuf(struct mbuf *mbuf, struct socket *socket) { MAC_PERFORM(set_socket_peer_from_mbuf, mbuf, &mbuf->m_pkthdr.label, socket, &socket->so_peerlabel); } void mac_set_socket_peer_from_socket(struct socket *oldsocket, struct socket *newsocket) { MAC_PERFORM(set_socket_peer_from_socket, oldsocket, &oldsocket->so_label, newsocket, &newsocket->so_peerlabel); } void mac_create_datagram_from_ipq(struct ipq *ipq, struct mbuf *datagram) { MAC_PERFORM(create_datagram_from_ipq, ipq, &ipq->ipq_label, datagram, &datagram->m_pkthdr.label); } void mac_create_fragment(struct mbuf *datagram, struct mbuf *fragment) { MAC_PERFORM(create_fragment, datagram, &datagram->m_pkthdr.label, fragment, &fragment->m_pkthdr.label); } void mac_create_ipq(struct mbuf *fragment, struct ipq *ipq) { MAC_PERFORM(create_ipq, fragment, &fragment->m_pkthdr.label, ipq, &ipq->ipq_label); } void mac_create_mbuf_from_mbuf(struct mbuf *oldmbuf, struct mbuf *newmbuf) { MAC_PERFORM(create_mbuf_from_mbuf, oldmbuf, &oldmbuf->m_pkthdr.label, newmbuf, &newmbuf->m_pkthdr.label); } void mac_create_mbuf_from_bpfdesc(struct bpf_d *bpf_d, struct mbuf *mbuf) { MAC_PERFORM(create_mbuf_from_bpfdesc, bpf_d, &bpf_d->bd_label, mbuf, &mbuf->m_pkthdr.label); } void mac_create_mbuf_linklayer(struct ifnet *ifnet, struct mbuf *mbuf) { MAC_PERFORM(create_mbuf_linklayer, ifnet, &ifnet->if_label, mbuf, &mbuf->m_pkthdr.label); } void mac_create_mbuf_from_ifnet(struct ifnet *ifnet, struct mbuf *mbuf) { MAC_PERFORM(create_mbuf_from_ifnet, ifnet, &ifnet->if_label, mbuf, &mbuf->m_pkthdr.label); } void mac_create_mbuf_multicast_encap(struct mbuf *oldmbuf, struct ifnet *ifnet, struct mbuf *newmbuf) { MAC_PERFORM(create_mbuf_multicast_encap, oldmbuf, &oldmbuf->m_pkthdr.label, ifnet, &ifnet->if_label, newmbuf, &newmbuf->m_pkthdr.label); } void mac_create_mbuf_netlayer(struct mbuf *oldmbuf, struct mbuf *newmbuf) { MAC_PERFORM(create_mbuf_netlayer, oldmbuf, &oldmbuf->m_pkthdr.label, newmbuf, &newmbuf->m_pkthdr.label); } int mac_fragment_match(struct mbuf *fragment, struct ipq *ipq) { int result; result = 1; MAC_BOOLEAN(fragment_match, &&, fragment, &fragment->m_pkthdr.label, ipq, &ipq->ipq_label); return (result); } void mac_update_ipq(struct mbuf *fragment, struct ipq *ipq) { MAC_PERFORM(update_ipq, fragment, &fragment->m_pkthdr.label, ipq, &ipq->ipq_label); } void mac_create_mbuf_from_socket(struct socket *socket, struct mbuf *mbuf) { MAC_PERFORM(create_mbuf_from_socket, socket, &socket->so_label, mbuf, &mbuf->m_pkthdr.label); } void mac_create_mount(struct ucred *cred, struct mount *mp) { MAC_PERFORM(create_mount, cred, mp, &mp->mnt_mntlabel, &mp->mnt_fslabel); } void mac_create_root_mount(struct ucred *cred, struct mount *mp) { MAC_PERFORM(create_root_mount, cred, mp, &mp->mnt_mntlabel, &mp->mnt_fslabel); } int mac_check_bpfdesc_receive(struct bpf_d *bpf_d, struct ifnet *ifnet) { int error; if (!mac_enforce_network) return (0); MAC_CHECK(check_bpfdesc_receive, bpf_d, &bpf_d->bd_label, ifnet, &ifnet->if_label); return (error); } static int mac_check_cred_relabel(struct ucred *cred, struct label *newlabel) { int error; MAC_CHECK(check_cred_relabel, cred, newlabel); return (error); } int mac_check_cred_visible(struct ucred *u1, struct ucred *u2) { int error; if (!mac_enforce_process) return (0); MAC_CHECK(check_cred_visible, u1, u2); return (error); } int mac_check_ifnet_transmit(struct ifnet *ifnet, struct mbuf *mbuf) { int error; if (!mac_enforce_network) return (0); KASSERT(mbuf->m_flags & M_PKTHDR, ("packet has no pkthdr")); if (!(mbuf->m_pkthdr.label.l_flags & MAC_FLAG_INITIALIZED)) printf("%s%d: not initialized\n", ifnet->if_name, ifnet->if_unit); MAC_CHECK(check_ifnet_transmit, ifnet, &ifnet->if_label, mbuf, &mbuf->m_pkthdr.label); return (error); } int mac_check_mount_stat(struct ucred *cred, struct mount *mount) { int error; if (!mac_enforce_fs) return (0); MAC_CHECK(check_mount_stat, cred, mount, &mount->mnt_mntlabel); return (error); } int mac_check_pipe_ioctl(struct ucred *cred, struct pipe *pipe, unsigned long cmd, void *data) { int error; PIPE_LOCK_ASSERT(pipe, MA_OWNED); if (!mac_enforce_pipe) return (0); MAC_CHECK(check_pipe_ioctl, cred, pipe, pipe->pipe_label, cmd, data); return (error); } int mac_check_pipe_poll(struct ucred *cred, struct pipe *pipe) { int error; PIPE_LOCK_ASSERT(pipe, MA_OWNED); if (!mac_enforce_pipe) return (0); MAC_CHECK(check_pipe_poll, cred, pipe, pipe->pipe_label); return (error); } int mac_check_pipe_read(struct ucred *cred, struct pipe *pipe) { int error; PIPE_LOCK_ASSERT(pipe, MA_OWNED); if (!mac_enforce_pipe) return (0); MAC_CHECK(check_pipe_read, cred, pipe, pipe->pipe_label); return (error); } static int mac_check_pipe_relabel(struct ucred *cred, struct pipe *pipe, struct label *newlabel) { int error; PIPE_LOCK_ASSERT(pipe, MA_OWNED); if (!mac_enforce_pipe) return (0); MAC_CHECK(check_pipe_relabel, cred, pipe, pipe->pipe_label, newlabel); return (error); } int mac_check_pipe_stat(struct ucred *cred, struct pipe *pipe) { int error; PIPE_LOCK_ASSERT(pipe, MA_OWNED); if (!mac_enforce_pipe) return (0); MAC_CHECK(check_pipe_stat, cred, pipe, pipe->pipe_label); return (error); } int mac_check_pipe_write(struct ucred *cred, struct pipe *pipe) { int error; PIPE_LOCK_ASSERT(pipe, MA_OWNED); if (!mac_enforce_pipe) return (0); MAC_CHECK(check_pipe_write, cred, pipe, pipe->pipe_label); return (error); } int mac_check_proc_debug(struct ucred *cred, struct proc *proc) { int error; PROC_LOCK_ASSERT(proc, MA_OWNED); if (!mac_enforce_process) return (0); MAC_CHECK(check_proc_debug, cred, proc); return (error); } int mac_check_proc_sched(struct ucred *cred, struct proc *proc) { int error; PROC_LOCK_ASSERT(proc, MA_OWNED); if (!mac_enforce_process) return (0); MAC_CHECK(check_proc_sched, cred, proc); return (error); } int mac_check_proc_signal(struct ucred *cred, struct proc *proc, int signum) { int error; PROC_LOCK_ASSERT(proc, MA_OWNED); if (!mac_enforce_process) return (0); MAC_CHECK(check_proc_signal, cred, proc, signum); return (error); } int mac_check_socket_bind(struct ucred *ucred, struct socket *socket, struct sockaddr *sockaddr) { int error; if (!mac_enforce_socket) return (0); MAC_CHECK(check_socket_bind, ucred, socket, &socket->so_label, sockaddr); return (error); } int mac_check_socket_connect(struct ucred *cred, struct socket *socket, struct sockaddr *sockaddr) { int error; if (!mac_enforce_socket) return (0); MAC_CHECK(check_socket_connect, cred, socket, &socket->so_label, sockaddr); return (error); } int mac_check_socket_deliver(struct socket *socket, struct mbuf *mbuf) { int error; if (!mac_enforce_socket) return (0); MAC_CHECK(check_socket_deliver, socket, &socket->so_label, mbuf, &mbuf->m_pkthdr.label); return (error); } int mac_check_socket_listen(struct ucred *cred, struct socket *socket) { int error; if (!mac_enforce_socket) return (0); MAC_CHECK(check_socket_listen, cred, socket, &socket->so_label); return (error); } static int mac_check_socket_relabel(struct ucred *cred, struct socket *socket, struct label *newlabel) { int error; MAC_CHECK(check_socket_relabel, cred, socket, &socket->so_label, newlabel); return (error); } int mac_check_socket_visible(struct ucred *cred, struct socket *socket) { int error; if (!mac_enforce_socket) return (0); MAC_CHECK(check_socket_visible, cred, socket, &socket->so_label); return (error); } int mac_ioctl_ifnet_get(struct ucred *cred, struct ifreq *ifr, struct ifnet *ifnet) { struct mac label; int error; error = mac_externalize(&ifnet->if_label, &label); if (error) return (error); return (copyout(&label, ifr->ifr_ifru.ifru_data, sizeof(label))); } int mac_ioctl_ifnet_set(struct ucred *cred, struct ifreq *ifr, struct ifnet *ifnet) { struct mac newlabel; struct label intlabel; int error; error = copyin(ifr->ifr_ifru.ifru_data, &newlabel, sizeof(newlabel)); if (error) return (error); error = mac_internalize(&intlabel, &newlabel); if (error) return (error); /* * XXX: Note that this is a redundant privilege check, since * policies impose this check themselves if required by the * policy. Eventually, this should go away. */ error = suser_cred(cred, 0); if (error) goto out; MAC_CHECK(check_ifnet_relabel, cred, ifnet, &ifnet->if_label, &intlabel); if (error) goto out; MAC_PERFORM(relabel_ifnet, cred, ifnet, &ifnet->if_label, &intlabel); out: mac_destroy_temp(&intlabel); return (error); } void mac_create_devfs_vnode(struct devfs_dirent *de, struct vnode *vp) { MAC_PERFORM(create_devfs_vnode, de, &de->de_label, vp, &vp->v_label); } void mac_create_devfs_device(dev_t dev, struct devfs_dirent *de) { MAC_PERFORM(create_devfs_device, dev, de, &de->de_label); } static int mac_stdcreatevnode_ea(struct vnode *vp) { int error; MAC_CHECK(stdcreatevnode_ea, vp, &vp->v_label); return (error); } void mac_create_devfs_directory(char *dirname, int dirnamelen, struct devfs_dirent *de) { MAC_PERFORM(create_devfs_directory, dirname, dirnamelen, de, &de->de_label); } /* * When a new vnode is created, this call will initialize its label. */ void mac_create_vnode(struct ucred *cred, struct vnode *parent, struct vnode *child) { int error; ASSERT_VOP_LOCKED(parent, "mac_create_vnode"); ASSERT_VOP_LOCKED(child, "mac_create_vnode"); error = vn_refreshlabel(parent, cred); if (error) { printf("mac_create_vnode: vn_refreshlabel returned %d\n", error); printf("mac_create_vnode: using old vnode label\n"); } MAC_PERFORM(create_vnode, cred, parent, &parent->v_label, child, &child->v_label); } int mac_setsockopt_label_set(struct ucred *cred, struct socket *so, struct mac *extmac) { struct label intlabel; int error; error = mac_internalize(&intlabel, extmac); if (error) return (error); mac_check_socket_relabel(cred, so, &intlabel); if (error) { mac_destroy_temp(&intlabel); return (error); } mac_relabel_socket(cred, so, &intlabel); mac_destroy_temp(&intlabel); return (0); } int mac_pipe_label_set(struct ucred *cred, struct pipe *pipe, struct label *label) { int error; PIPE_LOCK_ASSERT(pipe, MA_OWNED); error = mac_check_pipe_relabel(cred, pipe, label); if (error) return (error); mac_relabel_pipe(cred, pipe, label); return (0); } int mac_getsockopt_label_get(struct ucred *cred, struct socket *so, struct mac *extmac) { return (mac_externalize(&so->so_label, extmac)); } int mac_getsockopt_peerlabel_get(struct ucred *cred, struct socket *so, struct mac *extmac) { return (mac_externalize(&so->so_peerlabel, extmac)); } /* * Implementation of VOP_SETLABEL() that relies on extended attributes * to store label data. Can be referenced by filesystems supporting * extended attributes. */ int vop_stdsetlabel_ea(struct vop_setlabel_args *ap) { struct vnode *vp = ap->a_vp; struct label *intlabel = ap->a_label; struct mac extmac; int error; ASSERT_VOP_LOCKED(vp, "vop_stdsetlabel_ea"); /* * XXX: Eventually call out to EA check/set calls here. * Be particularly careful to avoid race conditions, * consistency problems, and stability problems when * dealing with multiple EAs. In particular, we require * the ability to write multiple EAs on the same file in * a single transaction, which the current EA interface * does not provide. */ error = mac_externalize(intlabel, &extmac); if (error) return (error); error = vn_extattr_set(vp, IO_NODELOCKED, FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME, sizeof(extmac), (char *)&extmac, curthread); if (error) return (error); mac_relabel_vnode(ap->a_cred, vp, intlabel); vp->v_vflag |= VV_CACHEDLABEL; return (0); } static int vn_setlabel(struct vnode *vp, struct label *intlabel, struct ucred *cred) { int error; if (vp->v_mount == NULL) { /* printf("vn_setlabel: null v_mount\n"); */ if (vp->v_type != VNON) printf("vn_setlabel: null v_mount with non-VNON\n"); return (EBADF); } if ((vp->v_mount->mnt_flag & MNT_MULTILABEL) == 0) return (EOPNOTSUPP); /* * Multi-phase commit. First check the policies to confirm the * change is OK. Then commit via the filesystem. Finally, * update the actual vnode label. Question: maybe the filesystem * should update the vnode at the end as part of VOP_SETLABEL()? */ error = mac_check_vnode_relabel(cred, vp, intlabel); if (error) return (error); /* * VADMIN provides the opportunity for the filesystem to make * decisions about who is and is not able to modify labels * and protections on files. This might not be right. We can't * assume VOP_SETLABEL() will do it, because we might implement * that as part of vop_stdsetlabel_ea(). */ error = VOP_ACCESS(vp, VADMIN, cred, curthread); if (error) return (error); error = VOP_SETLABEL(vp, intlabel, cred, curthread); if (error) return (error); return (0); } /* * MPSAFE */ int __mac_get_proc(struct thread *td, struct __mac_get_proc_args *uap) { struct mac extmac; int error; error = mac_externalize(&td->td_ucred->cr_label, &extmac); if (error == 0) error = copyout(&extmac, SCARG(uap, mac_p), sizeof(extmac)); return (error); } /* * MPSAFE */ int __mac_set_proc(struct thread *td, struct __mac_set_proc_args *uap) { struct ucred *newcred, *oldcred; struct proc *p; struct mac extmac; struct label intlabel; int error; error = copyin(SCARG(uap, mac_p), &extmac, sizeof(extmac)); if (error) return (error); error = mac_internalize(&intlabel, &extmac); if (error) return (error); newcred = crget(); p = td->td_proc; PROC_LOCK(p); oldcred = p->p_ucred; error = mac_check_cred_relabel(oldcred, &intlabel); if (error) { PROC_UNLOCK(p); mac_destroy_temp(&intlabel); crfree(newcred); return (error); } setsugid(p); crcopy(newcred, oldcred); mac_relabel_cred(newcred, &intlabel); p->p_ucred = newcred; /* * Grab additional reference for use while revoking mmaps, prior * to releasing the proc lock and sharing the cred. */ crhold(newcred); PROC_UNLOCK(p); mtx_lock(&Giant); mac_cred_mmapped_drop_perms(td, newcred); mtx_unlock(&Giant); crfree(newcred); /* Free revocation reference. */ crfree(oldcred); mac_destroy_temp(&intlabel); return (0); } /* * MPSAFE */ int __mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap) { struct file *fp; struct mac extmac; struct vnode *vp; struct pipe *pipe; int error; mtx_lock(&Giant); error = fget(td, SCARG(uap, fd), &fp); if (error) goto out; switch (fp->f_type) { case DTYPE_FIFO: case DTYPE_VNODE: vp = (struct vnode *)fp->f_data; vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); error = vn_refreshlabel(vp, td->td_ucred); if (error == 0) error = mac_externalize(&vp->v_label, &extmac); VOP_UNLOCK(vp, 0, td); break; case DTYPE_PIPE: pipe = (struct pipe *)fp->f_data; error = mac_externalize(pipe->pipe_label, &extmac); break; default: error = EINVAL; } if (error == 0) error = copyout(&extmac, SCARG(uap, mac_p), sizeof(extmac)); fdrop(fp, td); out: mtx_unlock(&Giant); return (error); } /* * MPSAFE */ int __mac_get_file(struct thread *td, struct __mac_get_file_args *uap) { struct nameidata nd; struct mac extmac; int error; mtx_lock(&Giant); NDINIT(&nd, LOOKUP, LOCKLEAF | FOLLOW, UIO_USERSPACE, SCARG(uap, path_p), td); error = namei(&nd); if (error) goto out; error = vn_refreshlabel(nd.ni_vp, td->td_ucred); if (error == 0) error = mac_externalize(&nd.ni_vp->v_label, &extmac); NDFREE(&nd, 0); if (error) goto out; error = copyout(&extmac, SCARG(uap, mac_p), sizeof(extmac)); out: mtx_unlock(&Giant); return (error); } /* * MPSAFE */ int __mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap) { struct file *fp; struct mac extmac; struct label intlabel; struct mount *mp; struct vnode *vp; struct pipe *pipe; int error; mtx_lock(&Giant); error = fget(td, SCARG(uap, fd), &fp); if (error) goto out1; error = copyin(SCARG(uap, mac_p), &extmac, sizeof(extmac)); if (error) goto out2; error = mac_internalize(&intlabel, &extmac); if (error) goto out2; switch (fp->f_type) { case DTYPE_FIFO: case DTYPE_VNODE: vp = (struct vnode *)fp->f_data; error = vn_start_write(vp, &mp, V_WAIT | PCATCH); if (error != 0) break; vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); error = vn_setlabel(vp, &intlabel, td->td_ucred); VOP_UNLOCK(vp, 0, td); vn_finished_write(mp); mac_destroy_temp(&intlabel); break; case DTYPE_PIPE: pipe = (struct pipe *)fp->f_data; PIPE_LOCK(pipe); error = mac_pipe_label_set(td->td_ucred, pipe, &intlabel); PIPE_UNLOCK(pipe); break; default: error = EINVAL; } out2: fdrop(fp, td); out1: mtx_unlock(&Giant); return (error); } /* * MPSAFE */ int __mac_set_file(struct thread *td, struct __mac_set_file_args *uap) { struct nameidata nd; struct mac extmac; struct label intlabel; struct mount *mp; int error; mtx_lock(&Giant); error = copyin(SCARG(uap, mac_p), &extmac, sizeof(extmac)); if (error) goto out; error = mac_internalize(&intlabel, &extmac); if (error) goto out; NDINIT(&nd, LOOKUP, LOCKLEAF | FOLLOW, UIO_USERSPACE, SCARG(uap, path_p), td); error = namei(&nd); if (error) goto out2; error = vn_start_write(nd.ni_vp, &mp, V_WAIT | PCATCH); if (error) goto out2; error = vn_setlabel(nd.ni_vp, &intlabel, td->td_ucred); vn_finished_write(mp); out2: mac_destroy_temp(&intlabel); NDFREE(&nd, 0); out: mtx_unlock(&Giant); return (error); } int mac_syscall(struct thread *td, struct mac_syscall_args *uap) { struct mac_policy_conf *mpc; char target[MAC_MAX_POLICY_NAME]; int error; error = copyinstr(SCARG(uap, policy), target, sizeof(target), NULL); if (error) return (error); error = ENOSYS; MAC_POLICY_LIST_BUSY(); LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { if (strcmp(mpc->mpc_name, target) == 0 && mpc->mpc_ops->mpo_syscall != NULL) { error = mpc->mpc_ops->mpo_syscall(td, SCARG(uap, call), SCARG(uap, arg)); goto out; } } out: MAC_POLICY_LIST_UNBUSY(); return (error); } SYSINIT(mac, SI_SUB_MAC, SI_ORDER_FIRST, mac_init, NULL); SYSINIT(mac_late, SI_SUB_MAC_LATE, SI_ORDER_FIRST, mac_late_init, NULL); #else /* !MAC */ int __mac_get_proc(struct thread *td, struct __mac_get_proc_args *uap) { return (ENOSYS); } int __mac_set_proc(struct thread *td, struct __mac_set_proc_args *uap) { return (ENOSYS); } int __mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap) { return (ENOSYS); } int __mac_get_file(struct thread *td, struct __mac_get_file_args *uap) { return (ENOSYS); } int __mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap) { return (ENOSYS); } int __mac_set_file(struct thread *td, struct __mac_set_file_args *uap) { return (ENOSYS); } int mac_syscall(struct thread *td, struct mac_syscall_args *uap) { return (ENOSYS); } #endif /* !MAC */ Index: head/sys/security/mac/mac_vfs.c =================================================================== --- head/sys/security/mac/mac_vfs.c (revision 104528) +++ head/sys/security/mac/mac_vfs.c (revision 104529) @@ -1,3432 +1,3462 @@ /*- * Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson * Copyright (c) 2001 Ilmar S. Habibulin * Copyright (c) 2001, 2002 Networks Associates Technology, Inc. * All rights reserved. * * This software was developed by Robert Watson and Ilmar Habibulin for the * TrustedBSD Project. * * This software was developed for the FreeBSD Project in part by NAI Labs, * the Security Research Division of Network Associates, Inc. under * DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA * CHATS research program. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * 3. The names of the authors may not be used to endorse or promote * products derived from this software without specific prior written * permission. * * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. * * $FreeBSD$ */ /* * Developed by the TrustedBSD Project. * * Framework for extensible kernel access control. Kernel and userland * interface to the framework, policy registration and composition. */ #include "opt_mac.h" #include "opt_devfs.h" #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #ifdef MAC /* * Declare that the kernel provides MAC support, version 1. This permits * modules to refuse to be loaded if the necessary support isn't present, * even if it's pre-boot. */ MODULE_VERSION(kernel_mac_support, 1); SYSCTL_DECL(_security); SYSCTL_NODE(_security, OID_AUTO, mac, CTLFLAG_RW, 0, "TrustedBSD MAC policy controls"); #ifndef MAC_MAX_POLICIES #define MAC_MAX_POLICIES 8 #endif #if MAC_MAX_POLICIES > 32 #error "MAC_MAX_POLICIES too large" #endif static unsigned int mac_max_policies = MAC_MAX_POLICIES; static unsigned int mac_policy_offsets_free = (1 << MAC_MAX_POLICIES) - 1; SYSCTL_UINT(_security_mac, OID_AUTO, max_policies, CTLFLAG_RD, &mac_max_policies, 0, ""); static int mac_late = 0; static int mac_enforce_fs = 1; SYSCTL_INT(_security_mac, OID_AUTO, enforce_fs, CTLFLAG_RW, &mac_enforce_fs, 0, "Enforce MAC policy on file system objects"); TUNABLE_INT("security.mac.enforce_fs", &mac_enforce_fs); static int mac_enforce_network = 1; SYSCTL_INT(_security_mac, OID_AUTO, enforce_network, CTLFLAG_RW, &mac_enforce_network, 0, "Enforce MAC policy on network packets"); TUNABLE_INT("security.mac.enforce_network", &mac_enforce_network); static int mac_enforce_pipe = 1; SYSCTL_INT(_security_mac, OID_AUTO, enforce_pipe, CTLFLAG_RW, &mac_enforce_pipe, 0, "Enforce MAC policy on pipe operations"); TUNABLE_INT("security.mac.enforce_pipe", &mac_enforce_pipe); static int mac_enforce_process = 1; SYSCTL_INT(_security_mac, OID_AUTO, enforce_process, CTLFLAG_RW, &mac_enforce_process, 0, "Enforce MAC policy on inter-process operations"); TUNABLE_INT("security.mac.enforce_process", &mac_enforce_process); static int mac_enforce_socket = 1; SYSCTL_INT(_security_mac, OID_AUTO, enforce_socket, CTLFLAG_RW, &mac_enforce_socket, 0, "Enforce MAC policy on socket operations"); TUNABLE_INT("security.mac.enforce_socket", &mac_enforce_socket); static int mac_enforce_vm = 1; SYSCTL_INT(_security_mac, OID_AUTO, enforce_vm, CTLFLAG_RW, &mac_enforce_vm, 0, "Enforce MAC policy on vm operations"); TUNABLE_INT("security.mac.enforce_vm", &mac_enforce_vm); static int mac_label_size = sizeof(struct mac); SYSCTL_INT(_security_mac, OID_AUTO, label_size, CTLFLAG_RD, &mac_label_size, 0, "Pre-compiled MAC label size"); static int mac_cache_fslabel_in_vnode = 1; SYSCTL_INT(_security_mac, OID_AUTO, cache_fslabel_in_vnode, CTLFLAG_RW, &mac_cache_fslabel_in_vnode, 0, "Cache mount fslabel in vnode"); TUNABLE_INT("security.mac.cache_fslabel_in_vnode", &mac_cache_fslabel_in_vnode); static int mac_vnode_label_cache_hits = 0; SYSCTL_INT(_security_mac, OID_AUTO, vnode_label_cache_hits, CTLFLAG_RD, &mac_vnode_label_cache_hits, 0, "Cache hits on vnode labels"); static int mac_vnode_label_cache_misses = 0; SYSCTL_INT(_security_mac, OID_AUTO, vnode_label_cache_misses, CTLFLAG_RD, &mac_vnode_label_cache_misses, 0, "Cache misses on vnode labels"); static int mac_mmap_revocation = 1; SYSCTL_INT(_security_mac, OID_AUTO, mmap_revocation, CTLFLAG_RW, &mac_mmap_revocation, 0, "Revoke mmap access to files on subject " "relabel"); static int mac_mmap_revocation_via_cow = 0; SYSCTL_INT(_security_mac, OID_AUTO, mmap_revocation_via_cow, CTLFLAG_RW, &mac_mmap_revocation_via_cow, 0, "Revoke mmap access to files via " "copy-on-write semantics, or by removing all write access"); #ifdef MAC_DEBUG SYSCTL_NODE(_security_mac, OID_AUTO, debug, CTLFLAG_RW, 0, "TrustedBSD MAC debug info"); static int mac_debug_label_fallback = 0; SYSCTL_INT(_security_mac_debug, OID_AUTO, label_fallback, CTLFLAG_RW, &mac_debug_label_fallback, 0, "Filesystems should fall back to fs label" "when label is corrupted."); TUNABLE_INT("security.mac.debug_label_fallback", &mac_debug_label_fallback); SYSCTL_NODE(_security_mac_debug, OID_AUTO, counters, CTLFLAG_RW, 0, "TrustedBSD MAC object counters"); static unsigned int nmacmbufs, nmaccreds, nmacifnets, nmacbpfdescs, nmacsockets, nmacmounts, nmactemp, nmacvnodes, nmacdevfsdirents, nmacipqs, nmacpipes; SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, mbufs, CTLFLAG_RD, &nmacmbufs, 0, "number of mbufs in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, creds, CTLFLAG_RD, &nmaccreds, 0, "number of ucreds in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, ifnets, CTLFLAG_RD, &nmacifnets, 0, "number of ifnets in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, ipqs, CTLFLAG_RD, &nmacipqs, 0, "number of ipqs in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, bpfdescs, CTLFLAG_RD, &nmacbpfdescs, 0, "number of bpfdescs in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, sockets, CTLFLAG_RD, &nmacsockets, 0, "number of sockets in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, pipes, CTLFLAG_RD, &nmacpipes, 0, "number of pipes in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, mounts, CTLFLAG_RD, &nmacmounts, 0, "number of mounts in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, temp, CTLFLAG_RD, &nmactemp, 0, "number of temporary labels in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, vnodes, CTLFLAG_RD, &nmacvnodes, 0, "number of vnodes in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, devfsdirents, CTLFLAG_RD, &nmacdevfsdirents, 0, "number of devfs dirents inuse"); #endif static int error_select(int error1, int error2); static int mac_externalize(struct label *label, struct mac *mac); static int mac_policy_register(struct mac_policy_conf *mpc); static int mac_policy_unregister(struct mac_policy_conf *mpc); static int mac_stdcreatevnode_ea(struct vnode *vp); static void mac_cred_mmapped_drop_perms(struct thread *td, struct ucred *cred); static void mac_cred_mmapped_drop_perms_recurse(struct thread *td, struct ucred *cred, struct vm_map *map); MALLOC_DEFINE(M_MACOPVEC, "macopvec", "MAC policy operation vector"); MALLOC_DEFINE(M_MACPIPELABEL, "macpipelabel", "MAC labels for pipes"); /* * mac_policy_list_lock protects the consistency of 'mac_policy_list', * the linked list of attached policy modules. Read-only consumers of * the list must acquire a shared lock for the duration of their use; * writers must acquire an exclusive lock. Note that for compound * operations, locks should be held for the entire compound operation, * and that this is not yet done for relabel requests. */ static struct mtx mac_policy_list_lock; static LIST_HEAD(, mac_policy_conf) mac_policy_list; static int mac_policy_list_busy; #define MAC_POLICY_LIST_LOCKINIT() mtx_init(&mac_policy_list_lock, \ "mac_policy_list_lock", NULL, MTX_DEF); #define MAC_POLICY_LIST_LOCK() mtx_lock(&mac_policy_list_lock); #define MAC_POLICY_LIST_UNLOCK() mtx_unlock(&mac_policy_list_lock); #define MAC_POLICY_LIST_BUSY() do { \ MAC_POLICY_LIST_LOCK(); \ mac_policy_list_busy++; \ MAC_POLICY_LIST_UNLOCK(); \ } while (0) #define MAC_POLICY_LIST_UNBUSY() do { \ MAC_POLICY_LIST_LOCK(); \ mac_policy_list_busy--; \ if (mac_policy_list_busy < 0) \ panic("Extra mac_policy_list_busy--"); \ MAC_POLICY_LIST_UNLOCK(); \ } while (0) /* * MAC_CHECK performs the designated check by walking the policy * module list and checking with each as to how it feels about the * request. Note that it returns its value via 'error' in the scope * of the caller. */ #define MAC_CHECK(check, args...) do { \ struct mac_policy_conf *mpc; \ \ error = 0; \ MAC_POLICY_LIST_BUSY(); \ LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { \ if (mpc->mpc_ops->mpo_ ## check != NULL) \ error = error_select( \ mpc->mpc_ops->mpo_ ## check (args), \ error); \ } \ MAC_POLICY_LIST_UNBUSY(); \ } while (0) /* * MAC_BOOLEAN performs the designated boolean composition by walking * the module list, invoking each instance of the operation, and * combining the results using the passed C operator. Note that it * returns its value via 'result' in the scope of the caller, which * should be initialized by the caller in a meaningful way to get * a meaningful result. */ #define MAC_BOOLEAN(operation, composition, args...) do { \ struct mac_policy_conf *mpc; \ \ MAC_POLICY_LIST_BUSY(); \ LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { \ if (mpc->mpc_ops->mpo_ ## operation != NULL) \ result = result composition \ mpc->mpc_ops->mpo_ ## operation (args); \ } \ MAC_POLICY_LIST_UNBUSY(); \ } while (0) /* * MAC_PERFORM performs the designated operation by walking the policy * module list and invoking that operation for each policy. */ #define MAC_PERFORM(operation, args...) do { \ struct mac_policy_conf *mpc; \ \ MAC_POLICY_LIST_BUSY(); \ LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { \ if (mpc->mpc_ops->mpo_ ## operation != NULL) \ mpc->mpc_ops->mpo_ ## operation (args); \ } \ MAC_POLICY_LIST_UNBUSY(); \ } while (0) /* * Initialize the MAC subsystem, including appropriate SMP locks. */ static void mac_init(void) { LIST_INIT(&mac_policy_list); MAC_POLICY_LIST_LOCKINIT(); } /* * For the purposes of modules that want to know if they were loaded * "early", set the mac_late flag once we've processed modules either * linked into the kernel, or loaded before the kernel startup. */ static void mac_late_init(void) { mac_late = 1; } /* * Allow MAC policy modules to register during boot, etc. */ int mac_policy_modevent(module_t mod, int type, void *data) { struct mac_policy_conf *mpc; int error; error = 0; mpc = (struct mac_policy_conf *) data; switch (type) { case MOD_LOAD: if (mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_NOTLATE && mac_late) { printf("mac_policy_modevent: can't load %s policy " "after booting\n", mpc->mpc_name); error = EBUSY; break; } error = mac_policy_register(mpc); break; case MOD_UNLOAD: /* Don't unregister the module if it was never registered. */ if ((mpc->mpc_runtime_flags & MPC_RUNTIME_FLAG_REGISTERED) != 0) error = mac_policy_unregister(mpc); else error = 0; break; default: break; } return (error); } static int mac_policy_register(struct mac_policy_conf *mpc) { struct mac_policy_conf *tmpc; struct mac_policy_op_entry *mpe; int slot; MALLOC(mpc->mpc_ops, struct mac_policy_ops *, sizeof(*mpc->mpc_ops), M_MACOPVEC, M_WAITOK | M_ZERO); for (mpe = mpc->mpc_entries; mpe->mpe_constant != MAC_OP_LAST; mpe++) { switch (mpe->mpe_constant) { case MAC_OP_LAST: /* * Doesn't actually happen, but this allows checking * that all enumerated values are handled. */ break; case MAC_DESTROY: mpc->mpc_ops->mpo_destroy = mpe->mpe_function; break; case MAC_INIT: mpc->mpc_ops->mpo_init = mpe->mpe_function; break; case MAC_SYSCALL: mpc->mpc_ops->mpo_syscall = mpe->mpe_function; break; case MAC_INIT_BPFDESC_LABEL: mpc->mpc_ops->mpo_init_bpfdesc_label = mpe->mpe_function; break; case MAC_INIT_CRED_LABEL: mpc->mpc_ops->mpo_init_cred_label = mpe->mpe_function; break; case MAC_INIT_DEVFSDIRENT_LABEL: mpc->mpc_ops->mpo_init_devfsdirent_label = mpe->mpe_function; break; case MAC_INIT_IFNET_LABEL: mpc->mpc_ops->mpo_init_ifnet_label = mpe->mpe_function; break; case MAC_INIT_IPQ_LABEL: mpc->mpc_ops->mpo_init_ipq_label = mpe->mpe_function; break; case MAC_INIT_MBUF_LABEL: mpc->mpc_ops->mpo_init_mbuf_label = mpe->mpe_function; break; case MAC_INIT_MOUNT_LABEL: mpc->mpc_ops->mpo_init_mount_label = mpe->mpe_function; break; case MAC_INIT_MOUNT_FS_LABEL: mpc->mpc_ops->mpo_init_mount_fs_label = mpe->mpe_function; break; case MAC_INIT_PIPE_LABEL: mpc->mpc_ops->mpo_init_pipe_label = mpe->mpe_function; break; case MAC_INIT_SOCKET_LABEL: mpc->mpc_ops->mpo_init_socket_label = mpe->mpe_function; break; case MAC_INIT_SOCKET_PEER_LABEL: mpc->mpc_ops->mpo_init_socket_peer_label = mpe->mpe_function; break; case MAC_INIT_TEMP_LABEL: mpc->mpc_ops->mpo_init_temp_label = mpe->mpe_function; break; case MAC_INIT_VNODE_LABEL: mpc->mpc_ops->mpo_init_vnode_label = mpe->mpe_function; break; case MAC_DESTROY_BPFDESC_LABEL: mpc->mpc_ops->mpo_destroy_bpfdesc_label = mpe->mpe_function; break; case MAC_DESTROY_CRED_LABEL: mpc->mpc_ops->mpo_destroy_cred_label = mpe->mpe_function; break; case MAC_DESTROY_DEVFSDIRENT_LABEL: mpc->mpc_ops->mpo_destroy_devfsdirent_label = mpe->mpe_function; break; case MAC_DESTROY_IFNET_LABEL: mpc->mpc_ops->mpo_destroy_ifnet_label = mpe->mpe_function; break; case MAC_DESTROY_IPQ_LABEL: mpc->mpc_ops->mpo_destroy_ipq_label = mpe->mpe_function; break; case MAC_DESTROY_MBUF_LABEL: mpc->mpc_ops->mpo_destroy_mbuf_label = mpe->mpe_function; break; case MAC_DESTROY_MOUNT_LABEL: mpc->mpc_ops->mpo_destroy_mount_label = mpe->mpe_function; break; case MAC_DESTROY_MOUNT_FS_LABEL: mpc->mpc_ops->mpo_destroy_mount_fs_label = mpe->mpe_function; break; case MAC_DESTROY_PIPE_LABEL: mpc->mpc_ops->mpo_destroy_pipe_label = mpe->mpe_function; break; case MAC_DESTROY_SOCKET_LABEL: mpc->mpc_ops->mpo_destroy_socket_label = mpe->mpe_function; break; case MAC_DESTROY_SOCKET_PEER_LABEL: mpc->mpc_ops->mpo_destroy_socket_peer_label = mpe->mpe_function; break; case MAC_DESTROY_TEMP_LABEL: mpc->mpc_ops->mpo_destroy_temp_label = mpe->mpe_function; break; case MAC_DESTROY_VNODE_LABEL: mpc->mpc_ops->mpo_destroy_vnode_label = mpe->mpe_function; break; case MAC_EXTERNALIZE: mpc->mpc_ops->mpo_externalize = mpe->mpe_function; break; case MAC_INTERNALIZE: mpc->mpc_ops->mpo_internalize = mpe->mpe_function; break; case MAC_CREATE_DEVFS_DEVICE: mpc->mpc_ops->mpo_create_devfs_device = mpe->mpe_function; break; case MAC_CREATE_DEVFS_DIRECTORY: mpc->mpc_ops->mpo_create_devfs_directory = mpe->mpe_function; break; case MAC_CREATE_DEVFS_VNODE: mpc->mpc_ops->mpo_create_devfs_vnode = mpe->mpe_function; break; case MAC_STDCREATEVNODE_EA: mpc->mpc_ops->mpo_stdcreatevnode_ea = mpe->mpe_function; break; case MAC_CREATE_VNODE: mpc->mpc_ops->mpo_create_vnode = mpe->mpe_function; break; case MAC_CREATE_MOUNT: mpc->mpc_ops->mpo_create_mount = mpe->mpe_function; break; case MAC_CREATE_ROOT_MOUNT: mpc->mpc_ops->mpo_create_root_mount = mpe->mpe_function; break; case MAC_RELABEL_VNODE: mpc->mpc_ops->mpo_relabel_vnode = mpe->mpe_function; break; case MAC_UPDATE_DEVFSDIRENT: mpc->mpc_ops->mpo_update_devfsdirent = mpe->mpe_function; break; case MAC_UPDATE_PROCFSVNODE: mpc->mpc_ops->mpo_update_procfsvnode = mpe->mpe_function; break; case MAC_UPDATE_VNODE_FROM_EXTATTR: mpc->mpc_ops->mpo_update_vnode_from_extattr = mpe->mpe_function; break; case MAC_UPDATE_VNODE_FROM_EXTERNALIZED: mpc->mpc_ops->mpo_update_vnode_from_externalized = mpe->mpe_function; break; case MAC_UPDATE_VNODE_FROM_MOUNT: mpc->mpc_ops->mpo_update_vnode_from_mount = mpe->mpe_function; break; case MAC_CREATE_MBUF_FROM_SOCKET: mpc->mpc_ops->mpo_create_mbuf_from_socket = mpe->mpe_function; break; case MAC_CREATE_PIPE: mpc->mpc_ops->mpo_create_pipe = mpe->mpe_function; break; case MAC_CREATE_SOCKET: mpc->mpc_ops->mpo_create_socket = mpe->mpe_function; break; case MAC_CREATE_SOCKET_FROM_SOCKET: mpc->mpc_ops->mpo_create_socket_from_socket = mpe->mpe_function; break; case MAC_RELABEL_PIPE: mpc->mpc_ops->mpo_relabel_pipe = mpe->mpe_function; break; case MAC_RELABEL_SOCKET: mpc->mpc_ops->mpo_relabel_socket = mpe->mpe_function; break; case MAC_SET_SOCKET_PEER_FROM_MBUF: mpc->mpc_ops->mpo_set_socket_peer_from_mbuf = mpe->mpe_function; break; case MAC_SET_SOCKET_PEER_FROM_SOCKET: mpc->mpc_ops->mpo_set_socket_peer_from_socket = mpe->mpe_function; break; case MAC_CREATE_BPFDESC: mpc->mpc_ops->mpo_create_bpfdesc = mpe->mpe_function; break; case MAC_CREATE_DATAGRAM_FROM_IPQ: mpc->mpc_ops->mpo_create_datagram_from_ipq = mpe->mpe_function; break; case MAC_CREATE_FRAGMENT: mpc->mpc_ops->mpo_create_fragment = mpe->mpe_function; break; case MAC_CREATE_IFNET: mpc->mpc_ops->mpo_create_ifnet = mpe->mpe_function; break; case MAC_CREATE_IPQ: mpc->mpc_ops->mpo_create_ipq = mpe->mpe_function; break; case MAC_CREATE_MBUF_FROM_MBUF: mpc->mpc_ops->mpo_create_mbuf_from_mbuf = mpe->mpe_function; break; case MAC_CREATE_MBUF_LINKLAYER: mpc->mpc_ops->mpo_create_mbuf_linklayer = mpe->mpe_function; break; case MAC_CREATE_MBUF_FROM_BPFDESC: mpc->mpc_ops->mpo_create_mbuf_from_bpfdesc = mpe->mpe_function; break; case MAC_CREATE_MBUF_FROM_IFNET: mpc->mpc_ops->mpo_create_mbuf_from_ifnet = mpe->mpe_function; break; case MAC_CREATE_MBUF_MULTICAST_ENCAP: mpc->mpc_ops->mpo_create_mbuf_multicast_encap = mpe->mpe_function; break; case MAC_CREATE_MBUF_NETLAYER: mpc->mpc_ops->mpo_create_mbuf_netlayer = mpe->mpe_function; break; case MAC_FRAGMENT_MATCH: mpc->mpc_ops->mpo_fragment_match = mpe->mpe_function; break; case MAC_RELABEL_IFNET: mpc->mpc_ops->mpo_relabel_ifnet = mpe->mpe_function; break; case MAC_UPDATE_IPQ: mpc->mpc_ops->mpo_update_ipq = mpe->mpe_function; break; case MAC_CREATE_CRED: mpc->mpc_ops->mpo_create_cred = mpe->mpe_function; break; case MAC_EXECVE_TRANSITION: mpc->mpc_ops->mpo_execve_transition = mpe->mpe_function; break; case MAC_EXECVE_WILL_TRANSITION: mpc->mpc_ops->mpo_execve_will_transition = mpe->mpe_function; break; case MAC_CREATE_PROC0: mpc->mpc_ops->mpo_create_proc0 = mpe->mpe_function; break; case MAC_CREATE_PROC1: mpc->mpc_ops->mpo_create_proc1 = mpe->mpe_function; break; case MAC_RELABEL_CRED: mpc->mpc_ops->mpo_relabel_cred = mpe->mpe_function; break; case MAC_THREAD_USERRET: mpc->mpc_ops->mpo_thread_userret = mpe->mpe_function; break; case MAC_CHECK_BPFDESC_RECEIVE: mpc->mpc_ops->mpo_check_bpfdesc_receive = mpe->mpe_function; break; case MAC_CHECK_CRED_RELABEL: mpc->mpc_ops->mpo_check_cred_relabel = mpe->mpe_function; break; case MAC_CHECK_CRED_VISIBLE: mpc->mpc_ops->mpo_check_cred_visible = mpe->mpe_function; break; case MAC_CHECK_IFNET_RELABEL: mpc->mpc_ops->mpo_check_ifnet_relabel = mpe->mpe_function; break; case MAC_CHECK_IFNET_TRANSMIT: mpc->mpc_ops->mpo_check_ifnet_transmit = mpe->mpe_function; break; case MAC_CHECK_MOUNT_STAT: mpc->mpc_ops->mpo_check_mount_stat = mpe->mpe_function; break; case MAC_CHECK_PIPE_IOCTL: mpc->mpc_ops->mpo_check_pipe_ioctl = mpe->mpe_function; break; case MAC_CHECK_PIPE_POLL: mpc->mpc_ops->mpo_check_pipe_poll = mpe->mpe_function; break; case MAC_CHECK_PIPE_READ: mpc->mpc_ops->mpo_check_pipe_read = mpe->mpe_function; break; case MAC_CHECK_PIPE_RELABEL: mpc->mpc_ops->mpo_check_pipe_relabel = mpe->mpe_function; break; case MAC_CHECK_PIPE_STAT: mpc->mpc_ops->mpo_check_pipe_stat = mpe->mpe_function; break; case MAC_CHECK_PIPE_WRITE: mpc->mpc_ops->mpo_check_pipe_write = mpe->mpe_function; break; case MAC_CHECK_PROC_DEBUG: mpc->mpc_ops->mpo_check_proc_debug = mpe->mpe_function; break; case MAC_CHECK_PROC_SCHED: mpc->mpc_ops->mpo_check_proc_sched = mpe->mpe_function; break; case MAC_CHECK_PROC_SIGNAL: mpc->mpc_ops->mpo_check_proc_signal = mpe->mpe_function; break; case MAC_CHECK_SOCKET_BIND: mpc->mpc_ops->mpo_check_socket_bind = mpe->mpe_function; break; case MAC_CHECK_SOCKET_CONNECT: mpc->mpc_ops->mpo_check_socket_connect = mpe->mpe_function; break; case MAC_CHECK_SOCKET_DELIVER: mpc->mpc_ops->mpo_check_socket_deliver = mpe->mpe_function; break; case MAC_CHECK_SOCKET_LISTEN: mpc->mpc_ops->mpo_check_socket_listen = mpe->mpe_function; break; case MAC_CHECK_SOCKET_RELABEL: mpc->mpc_ops->mpo_check_socket_relabel = mpe->mpe_function; break; case MAC_CHECK_SOCKET_VISIBLE: mpc->mpc_ops->mpo_check_socket_visible = mpe->mpe_function; break; case MAC_CHECK_VNODE_ACCESS: mpc->mpc_ops->mpo_check_vnode_access = mpe->mpe_function; break; case MAC_CHECK_VNODE_CHDIR: mpc->mpc_ops->mpo_check_vnode_chdir = mpe->mpe_function; break; case MAC_CHECK_VNODE_CHROOT: mpc->mpc_ops->mpo_check_vnode_chroot = mpe->mpe_function; break; case MAC_CHECK_VNODE_CREATE: mpc->mpc_ops->mpo_check_vnode_create = mpe->mpe_function; break; case MAC_CHECK_VNODE_DELETE: mpc->mpc_ops->mpo_check_vnode_delete = mpe->mpe_function; break; case MAC_CHECK_VNODE_DELETEACL: mpc->mpc_ops->mpo_check_vnode_deleteacl = mpe->mpe_function; break; case MAC_CHECK_VNODE_EXEC: mpc->mpc_ops->mpo_check_vnode_exec = mpe->mpe_function; break; case MAC_CHECK_VNODE_GETACL: mpc->mpc_ops->mpo_check_vnode_getacl = mpe->mpe_function; break; case MAC_CHECK_VNODE_GETEXTATTR: mpc->mpc_ops->mpo_check_vnode_getextattr = mpe->mpe_function; break; + case MAC_CHECK_VNODE_LINK: + mpc->mpc_ops->mpo_check_vnode_link = + mpe->mpe_function; + break; case MAC_CHECK_VNODE_LOOKUP: mpc->mpc_ops->mpo_check_vnode_lookup = mpe->mpe_function; break; case MAC_CHECK_VNODE_MMAP_PERMS: mpc->mpc_ops->mpo_check_vnode_mmap_perms = mpe->mpe_function; break; case MAC_CHECK_VNODE_OPEN: mpc->mpc_ops->mpo_check_vnode_open = mpe->mpe_function; break; case MAC_CHECK_VNODE_POLL: mpc->mpc_ops->mpo_check_vnode_poll = mpe->mpe_function; break; case MAC_CHECK_VNODE_READ: mpc->mpc_ops->mpo_check_vnode_read = mpe->mpe_function; break; case MAC_CHECK_VNODE_READDIR: mpc->mpc_ops->mpo_check_vnode_readdir = mpe->mpe_function; break; case MAC_CHECK_VNODE_READLINK: mpc->mpc_ops->mpo_check_vnode_readlink = mpe->mpe_function; break; case MAC_CHECK_VNODE_RELABEL: mpc->mpc_ops->mpo_check_vnode_relabel = mpe->mpe_function; break; case MAC_CHECK_VNODE_RENAME_FROM: mpc->mpc_ops->mpo_check_vnode_rename_from = mpe->mpe_function; break; case MAC_CHECK_VNODE_RENAME_TO: mpc->mpc_ops->mpo_check_vnode_rename_to = mpe->mpe_function; break; case MAC_CHECK_VNODE_REVOKE: mpc->mpc_ops->mpo_check_vnode_revoke = mpe->mpe_function; break; case MAC_CHECK_VNODE_SETACL: mpc->mpc_ops->mpo_check_vnode_setacl = mpe->mpe_function; break; case MAC_CHECK_VNODE_SETEXTATTR: mpc->mpc_ops->mpo_check_vnode_setextattr = mpe->mpe_function; break; case MAC_CHECK_VNODE_SETFLAGS: mpc->mpc_ops->mpo_check_vnode_setflags = mpe->mpe_function; break; case MAC_CHECK_VNODE_SETMODE: mpc->mpc_ops->mpo_check_vnode_setmode = mpe->mpe_function; break; case MAC_CHECK_VNODE_SETOWNER: mpc->mpc_ops->mpo_check_vnode_setowner = mpe->mpe_function; break; case MAC_CHECK_VNODE_SETUTIMES: mpc->mpc_ops->mpo_check_vnode_setutimes = mpe->mpe_function; break; case MAC_CHECK_VNODE_STAT: mpc->mpc_ops->mpo_check_vnode_stat = mpe->mpe_function; break; case MAC_CHECK_VNODE_WRITE: mpc->mpc_ops->mpo_check_vnode_write = mpe->mpe_function; break; /* default: printf("MAC policy `%s': unknown operation %d\n", mpc->mpc_name, mpe->mpe_constant); return (EINVAL); */ } } MAC_POLICY_LIST_LOCK(); if (mac_policy_list_busy > 0) { MAC_POLICY_LIST_UNLOCK(); FREE(mpc->mpc_ops, M_MACOPVEC); mpc->mpc_ops = NULL; return (EBUSY); } LIST_FOREACH(tmpc, &mac_policy_list, mpc_list) { if (strcmp(tmpc->mpc_name, mpc->mpc_name) == 0) { MAC_POLICY_LIST_UNLOCK(); FREE(mpc->mpc_ops, M_MACOPVEC); mpc->mpc_ops = NULL; return (EEXIST); } } if (mpc->mpc_field_off != NULL) { slot = ffs(mac_policy_offsets_free); if (slot == 0) { MAC_POLICY_LIST_UNLOCK(); FREE(mpc->mpc_ops, M_MACOPVEC); mpc->mpc_ops = NULL; return (ENOMEM); } slot--; mac_policy_offsets_free &= ~(1 << slot); *mpc->mpc_field_off = slot; } mpc->mpc_runtime_flags |= MPC_RUNTIME_FLAG_REGISTERED; LIST_INSERT_HEAD(&mac_policy_list, mpc, mpc_list); /* Per-policy initialization. */ if (mpc->mpc_ops->mpo_init != NULL) (*(mpc->mpc_ops->mpo_init))(mpc); MAC_POLICY_LIST_UNLOCK(); printf("Security policy loaded: %s (%s)\n", mpc->mpc_fullname, mpc->mpc_name); return (0); } static int mac_policy_unregister(struct mac_policy_conf *mpc) { /* * If we fail the load, we may get a request to unload. Check * to see if we did the run-time registration, and if not, * silently succeed. */ MAC_POLICY_LIST_LOCK(); if ((mpc->mpc_runtime_flags & MPC_RUNTIME_FLAG_REGISTERED) == 0) { MAC_POLICY_LIST_UNLOCK(); return (0); } #if 0 /* * Don't allow unloading modules with private data. */ if (mpc->mpc_field_off != NULL) { MAC_POLICY_LIST_UNLOCK(); return (EBUSY); } #endif /* * Only allow the unload to proceed if the module is unloadable * by its own definition. */ if ((mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_UNLOADOK) == 0) { MAC_POLICY_LIST_UNLOCK(); return (EBUSY); } /* * Right now, we EBUSY if the list is in use. In the future, * for reliability reasons, we might want to sleep and wakeup * later to try again. */ if (mac_policy_list_busy > 0) { MAC_POLICY_LIST_UNLOCK(); return (EBUSY); } if (mpc->mpc_ops->mpo_destroy != NULL) (*(mpc->mpc_ops->mpo_destroy))(mpc); LIST_REMOVE(mpc, mpc_list); MAC_POLICY_LIST_UNLOCK(); FREE(mpc->mpc_ops, M_MACOPVEC); mpc->mpc_ops = NULL; printf("Security policy unload: %s (%s)\n", mpc->mpc_fullname, mpc->mpc_name); return (0); } /* * Define an error value precedence, and given two arguments, selects the * value with the higher precedence. */ static int error_select(int error1, int error2) { /* Certain decision-making errors take top priority. */ if (error1 == EDEADLK || error2 == EDEADLK) return (EDEADLK); /* Invalid arguments should be reported where possible. */ if (error1 == EINVAL || error2 == EINVAL) return (EINVAL); /* Precedence goes to "visibility", with both process and file. */ if (error1 == ESRCH || error2 == ESRCH) return (ESRCH); if (error1 == ENOENT || error2 == ENOENT) return (ENOENT); /* Precedence goes to DAC/MAC protections. */ if (error1 == EACCES || error2 == EACCES) return (EACCES); /* Precedence goes to privilege. */ if (error1 == EPERM || error2 == EPERM) return (EPERM); /* Precedence goes to error over success; otherwise, arbitrary. */ if (error1 != 0) return (error1); return (error2); } static void mac_init_label(struct label *label) { bzero(label, sizeof(*label)); label->l_flags = MAC_FLAG_INITIALIZED; } static void mac_destroy_label(struct label *label) { KASSERT(label->l_flags & MAC_FLAG_INITIALIZED, ("destroying uninitialized label")); bzero(label, sizeof(*label)); /* implicit: label->l_flags &= ~MAC_FLAG_INITIALIZED; */ } static void mac_init_structmac(struct mac *mac) { bzero(mac, sizeof(*mac)); mac->m_macflags = MAC_FLAG_INITIALIZED; } void mac_init_bpfdesc(struct bpf_d *bpf_d) { mac_init_label(&bpf_d->bd_label); MAC_PERFORM(init_bpfdesc_label, &bpf_d->bd_label); #ifdef MAC_DEBUG atomic_add_int(&nmacbpfdescs, 1); #endif } void mac_init_cred(struct ucred *cr) { mac_init_label(&cr->cr_label); MAC_PERFORM(init_cred_label, &cr->cr_label); #ifdef MAC_DEBUG atomic_add_int(&nmaccreds, 1); #endif } void mac_init_devfsdirent(struct devfs_dirent *de) { mac_init_label(&de->de_label); MAC_PERFORM(init_devfsdirent_label, &de->de_label); #ifdef MAC_DEBUG atomic_add_int(&nmacdevfsdirents, 1); #endif } void mac_init_ifnet(struct ifnet *ifp) { mac_init_label(&ifp->if_label); MAC_PERFORM(init_ifnet_label, &ifp->if_label); #ifdef MAC_DEBUG atomic_add_int(&nmacifnets, 1); #endif } void mac_init_ipq(struct ipq *ipq) { mac_init_label(&ipq->ipq_label); MAC_PERFORM(init_ipq_label, &ipq->ipq_label); #ifdef MAC_DEBUG atomic_add_int(&nmacipqs, 1); #endif } int mac_init_mbuf(struct mbuf *m, int flag) { int error; KASSERT(m->m_flags & M_PKTHDR, ("mac_init_mbuf on non-header mbuf")); mac_init_label(&m->m_pkthdr.label); MAC_CHECK(init_mbuf_label, &m->m_pkthdr.label, flag); if (error) { MAC_PERFORM(destroy_mbuf_label, &m->m_pkthdr.label); mac_destroy_label(&m->m_pkthdr.label); } #ifdef MAC_DEBUG if (error == 0) atomic_add_int(&nmacmbufs, 1); #endif return (error); } void mac_init_mount(struct mount *mp) { mac_init_label(&mp->mnt_mntlabel); mac_init_label(&mp->mnt_fslabel); MAC_PERFORM(init_mount_label, &mp->mnt_mntlabel); MAC_PERFORM(init_mount_fs_label, &mp->mnt_fslabel); #ifdef MAC_DEBUG atomic_add_int(&nmacmounts, 1); #endif } void mac_init_pipe(struct pipe *pipe) { struct label *label; label = malloc(sizeof(struct label), M_MACPIPELABEL, M_ZERO|M_WAITOK); mac_init_label(label); pipe->pipe_label = label; pipe->pipe_peer->pipe_label = label; MAC_PERFORM(init_pipe_label, pipe->pipe_label); #ifdef MAC_DEBUG atomic_add_int(&nmacpipes, 1); #endif } void mac_init_socket(struct socket *socket) { mac_init_label(&socket->so_label); mac_init_label(&socket->so_peerlabel); MAC_PERFORM(init_socket_label, &socket->so_label); MAC_PERFORM(init_socket_peer_label, &socket->so_peerlabel); #ifdef MAC_DEBUG atomic_add_int(&nmacsockets, 1); #endif } static void mac_init_temp(struct label *label) { mac_init_label(label); MAC_PERFORM(init_temp_label, label); #ifdef MAC_DEBUG atomic_add_int(&nmactemp, 1); #endif } void mac_init_vnode(struct vnode *vp) { mac_init_label(&vp->v_label); MAC_PERFORM(init_vnode_label, &vp->v_label); #ifdef MAC_DEBUG atomic_add_int(&nmacvnodes, 1); #endif } void mac_destroy_bpfdesc(struct bpf_d *bpf_d) { MAC_PERFORM(destroy_bpfdesc_label, &bpf_d->bd_label); mac_destroy_label(&bpf_d->bd_label); #ifdef MAC_DEBUG atomic_subtract_int(&nmacbpfdescs, 1); #endif } void mac_destroy_cred(struct ucred *cr) { MAC_PERFORM(destroy_cred_label, &cr->cr_label); mac_destroy_label(&cr->cr_label); #ifdef MAC_DEBUG atomic_subtract_int(&nmaccreds, 1); #endif } void mac_destroy_devfsdirent(struct devfs_dirent *de) { MAC_PERFORM(destroy_devfsdirent_label, &de->de_label); mac_destroy_label(&de->de_label); #ifdef MAC_DEBUG atomic_subtract_int(&nmacdevfsdirents, 1); #endif } void mac_destroy_ifnet(struct ifnet *ifp) { MAC_PERFORM(destroy_ifnet_label, &ifp->if_label); mac_destroy_label(&ifp->if_label); #ifdef MAC_DEBUG atomic_subtract_int(&nmacifnets, 1); #endif } void mac_destroy_ipq(struct ipq *ipq) { MAC_PERFORM(destroy_ipq_label, &ipq->ipq_label); mac_destroy_label(&ipq->ipq_label); #ifdef MAC_DEBUG atomic_subtract_int(&nmacipqs, 1); #endif } void mac_destroy_mbuf(struct mbuf *m) { MAC_PERFORM(destroy_mbuf_label, &m->m_pkthdr.label); mac_destroy_label(&m->m_pkthdr.label); #ifdef MAC_DEBUG atomic_subtract_int(&nmacmbufs, 1); #endif } void mac_destroy_mount(struct mount *mp) { MAC_PERFORM(destroy_mount_label, &mp->mnt_mntlabel); MAC_PERFORM(destroy_mount_fs_label, &mp->mnt_fslabel); mac_destroy_label(&mp->mnt_fslabel); mac_destroy_label(&mp->mnt_mntlabel); #ifdef MAC_DEBUG atomic_subtract_int(&nmacmounts, 1); #endif } void mac_destroy_pipe(struct pipe *pipe) { MAC_PERFORM(destroy_pipe_label, pipe->pipe_label); mac_destroy_label(pipe->pipe_label); free(pipe->pipe_label, M_MACPIPELABEL); #ifdef MAC_DEBUG atomic_subtract_int(&nmacpipes, 1); #endif } void mac_destroy_socket(struct socket *socket) { MAC_PERFORM(destroy_socket_label, &socket->so_label); MAC_PERFORM(destroy_socket_peer_label, &socket->so_peerlabel); mac_destroy_label(&socket->so_label); mac_destroy_label(&socket->so_peerlabel); #ifdef MAC_DEBUG atomic_subtract_int(&nmacsockets, 1); #endif } static void mac_destroy_temp(struct label *label) { MAC_PERFORM(destroy_temp_label, label); mac_destroy_label(label); #ifdef MAC_DEBUG atomic_subtract_int(&nmactemp, 1); #endif } void mac_destroy_vnode(struct vnode *vp) { MAC_PERFORM(destroy_vnode_label, &vp->v_label); mac_destroy_label(&vp->v_label); #ifdef MAC_DEBUG atomic_subtract_int(&nmacvnodes, 1); #endif } static int mac_externalize(struct label *label, struct mac *mac) { int error; mac_init_structmac(mac); MAC_CHECK(externalize, label, mac); return (error); } static int mac_internalize(struct label *label, struct mac *mac) { int error; mac_init_temp(label); MAC_CHECK(internalize, label, mac); if (error) mac_destroy_temp(label); return (error); } /* * Initialize MAC label for the first kernel process, from which other * kernel processes and threads are spawned. */ void mac_create_proc0(struct ucred *cred) { MAC_PERFORM(create_proc0, cred); } /* * Initialize MAC label for the first userland process, from which other * userland processes and threads are spawned. */ void mac_create_proc1(struct ucred *cred) { MAC_PERFORM(create_proc1, cred); } void mac_thread_userret(struct thread *td) { MAC_PERFORM(thread_userret, td); } /* * When a new process is created, its label must be initialized. Generally, * this involves inheritence from the parent process, modulo possible * deltas. This function allows that processing to take place. */ void mac_create_cred(struct ucred *parent_cred, struct ucred *child_cred) { MAC_PERFORM(create_cred, parent_cred, child_cred); } void mac_update_devfsdirent(struct devfs_dirent *de, struct vnode *vp) { MAC_PERFORM(update_devfsdirent, de, &de->de_label, vp, &vp->v_label); } void mac_update_procfsvnode(struct vnode *vp, struct ucred *cred) { MAC_PERFORM(update_procfsvnode, vp, &vp->v_label, cred); } /* * Support callout for policies that manage their own externalization * using extended attributes. */ static int mac_update_vnode_from_extattr(struct vnode *vp, struct mount *mp) { int error; MAC_CHECK(update_vnode_from_extattr, vp, &vp->v_label, mp, &mp->mnt_fslabel); return (error); } /* * Given an externalized mac label, internalize it and stamp it on a * vnode. */ static int mac_update_vnode_from_externalized(struct vnode *vp, struct mac *extmac) { int error; MAC_CHECK(update_vnode_from_externalized, vp, &vp->v_label, extmac); return (error); } /* * Call out to individual policies to update the label in a vnode from * the mountpoint. */ void mac_update_vnode_from_mount(struct vnode *vp, struct mount *mp) { MAC_PERFORM(update_vnode_from_mount, vp, &vp->v_label, mp, &mp->mnt_fslabel); ASSERT_VOP_LOCKED(vp, "mac_update_vnode_from_mount"); if (mac_cache_fslabel_in_vnode) vp->v_vflag |= VV_CACHEDLABEL; } /* * Implementation of VOP_REFRESHLABEL() that relies on extended attributes * to store label data. Can be referenced by filesystems supporting * extended attributes. */ int vop_stdrefreshlabel_ea(struct vop_refreshlabel_args *ap) { struct vnode *vp = ap->a_vp; struct mac extmac; int buflen, error; ASSERT_VOP_LOCKED(vp, "vop_stdrefreshlabel_ea"); /* * Call out to external policies first. Order doesn't really * matter, as long as failure of one assures failure of all. */ error = mac_update_vnode_from_extattr(vp, vp->v_mount); if (error) return (error); buflen = sizeof(extmac); error = vn_extattr_get(vp, IO_NODELOCKED, FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME, &buflen, (char *)&extmac, curthread); switch (error) { case 0: /* Got it */ break; case ENOATTR: /* * Use the label from the mount point. */ mac_update_vnode_from_mount(vp, vp->v_mount); return (0); case EOPNOTSUPP: default: /* Fail horribly. */ return (error); } if (buflen != sizeof(extmac)) error = EPERM; /* Fail very closed. */ if (error == 0) error = mac_update_vnode_from_externalized(vp, &extmac); if (error == 0) vp->v_vflag |= VV_CACHEDLABEL; else { struct vattr va; printf("Corrupted label on %s", vp->v_mount->mnt_stat.f_mntonname); if (VOP_GETATTR(vp, &va, curthread->td_ucred, curthread) == 0) printf(" inum %ld", va.va_fileid); #ifdef MAC_DEBUG if (mac_debug_label_fallback) { printf(", falling back.\n"); mac_update_vnode_from_mount(vp, vp->v_mount); error = 0; } else { #endif printf(".\n"); error = EPERM; #ifdef MAC_DEBUG } #endif } return (error); } /* * Make sure the vnode label is up-to-date. If EOPNOTSUPP, then we handle * the labeling activity outselves. Filesystems should be careful not * to change their minds regarding whether they support vop_refreshlabel() * for a vnode or not. Don't cache the vnode here, allow the file * system code to determine if it's safe to cache. If we update from * the mount, don't cache since a change to the mount label should affect * all vnodes. */ static int vn_refreshlabel(struct vnode *vp, struct ucred *cred) { int error; ASSERT_VOP_LOCKED(vp, "vn_refreshlabel"); if (vp->v_mount == NULL) { /* Eventually, we probably want to special-case refreshing of deadfs vnodes, and if there's a lock-free race somewhere, that case might be handled here. mac_update_vnode_deadfs(vp); return (0); */ /* printf("vn_refreshlabel: null v_mount\n"); */ if (vp->v_type != VNON) printf( "vn_refreshlabel: null v_mount with non-VNON\n"); return (EBADF); } if (vp->v_vflag & VV_CACHEDLABEL) { mac_vnode_label_cache_hits++; return (0); } else mac_vnode_label_cache_misses++; if ((vp->v_mount->mnt_flag & MNT_MULTILABEL) == 0) { mac_update_vnode_from_mount(vp, vp->v_mount); return (0); } error = VOP_REFRESHLABEL(vp, cred, curthread); switch (error) { case EOPNOTSUPP: /* * If labels are not supported on this vnode, fall back to * the label in the mount and propagate it to the vnode. * There should probably be some sort of policy/flag/decision * about doing this. */ mac_update_vnode_from_mount(vp, vp->v_mount); error = 0; default: return (error); } } /* * Helper function for file systems using the vop_std*_ea() calls. This * function must be called after EA service is available for the vnode, * but before it's hooked up to the namespace so that the node persists * if there's a crash, or before it can be accessed. On successful * commit of the label to disk (etc), do cache the label. */ int vop_stdcreatevnode_ea(struct vnode *dvp, struct vnode *tvp, struct ucred *cred) { struct mac extmac; int error; ASSERT_VOP_LOCKED(tvp, "vop_stdcreatevnode_ea"); if ((dvp->v_mount->mnt_flag & MNT_MULTILABEL) == 0) { mac_update_vnode_from_mount(tvp, tvp->v_mount); } else { error = vn_refreshlabel(dvp, cred); if (error) return (error); /* * Stick the label in the vnode. Then try to write to * disk. If we fail, return a failure to abort the * create operation. Really, this failure shouldn't * happen except in fairly unusual circumstances (out * of disk, etc). */ mac_create_vnode(cred, dvp, tvp); error = mac_stdcreatevnode_ea(tvp); if (error) return (error); /* * XXX: Eventually this will go away and all policies will * directly manage their extended attributes. */ error = mac_externalize(&tvp->v_label, &extmac); if (error) return (error); error = vn_extattr_set(tvp, IO_NODELOCKED, FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME, sizeof(extmac), (char *)&extmac, curthread); if (error == 0) tvp->v_vflag |= VV_CACHEDLABEL; else { #if 0 /* * In theory, we could have fall-back behavior here. * It would probably be incorrect. */ #endif return (error); } } return (0); } void mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_execve_transition"); error = vn_refreshlabel(vp, old); if (error) { printf("mac_execve_transition: vn_refreshlabel returned %d\n", error); printf("mac_execve_transition: using old vnode label\n"); } MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label); } int mac_execve_will_transition(struct ucred *old, struct vnode *vp) { int error, result; error = vn_refreshlabel(vp, old); if (error) return (error); result = 0; MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label); return (result); } int mac_check_vnode_access(struct ucred *cred, struct vnode *vp, int flags) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_access"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_access, cred, vp, &vp->v_label, flags); return (error); } int mac_check_vnode_chdir(struct ucred *cred, struct vnode *dvp) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_chdir"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); MAC_CHECK(check_vnode_chdir, cred, dvp, &dvp->v_label); return (error); } int mac_check_vnode_chroot(struct ucred *cred, struct vnode *dvp) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_chroot"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); MAC_CHECK(check_vnode_chroot, cred, dvp, &dvp->v_label); return (error); } int mac_check_vnode_create(struct ucred *cred, struct vnode *dvp, struct componentname *cnp, struct vattr *vap) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_create"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); MAC_CHECK(check_vnode_create, cred, dvp, &dvp->v_label, cnp, vap); return (error); } int mac_check_vnode_delete(struct ucred *cred, struct vnode *dvp, struct vnode *vp, struct componentname *cnp) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_delete"); ASSERT_VOP_LOCKED(vp, "mac_check_vnode_delete"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_delete, cred, dvp, &dvp->v_label, vp, &vp->v_label, cnp); return (error); } int mac_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp, acl_type_t type) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_deleteacl"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_deleteacl, cred, vp, &vp->v_label, type); return (error); } int mac_check_vnode_exec(struct ucred *cred, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_exec"); if (!mac_enforce_process && !mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label); return (error); } int mac_check_vnode_getacl(struct ucred *cred, struct vnode *vp, acl_type_t type) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_getacl"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_getacl, cred, vp, &vp->v_label, type); return (error); } int mac_check_vnode_getextattr(struct ucred *cred, struct vnode *vp, int attrnamespace, const char *name, struct uio *uio) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_getextattr"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_getextattr, cred, vp, &vp->v_label, attrnamespace, name, uio); + return (error); +} + +int +mac_check_vnode_link(struct ucred *cred, struct vnode *dvp, + struct vnode *vp, struct componentname *cnp) +{ + + int error; + + ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_link"); + ASSERT_VOP_LOCKED(vp, "mac_check_vnode_link"); + + if (!mac_enforce_fs) + return (0); + + error = vn_refreshlabel(dvp, cred); + if (error) + return (error); + + error = vn_refreshlabel(vp, cred); + if (error) + return (error); + + MAC_CHECK(check_vnode_link, cred, dvp, &dvp->v_label, vp, + &vp->v_label, cnp); return (error); } int mac_check_vnode_lookup(struct ucred *cred, struct vnode *dvp, struct componentname *cnp) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_lookup"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); MAC_CHECK(check_vnode_lookup, cred, dvp, &dvp->v_label, cnp); return (error); } vm_prot_t mac_check_vnode_mmap_prot(struct ucred *cred, struct vnode *vp, int newmapping) { vm_prot_t result = VM_PROT_ALL; if (!mac_enforce_vm) return (result); /* * This should be some sort of MAC_BITWISE, maybe :) */ ASSERT_VOP_LOCKED(vp, "mac_check_vnode_mmap_perms"); MAC_BOOLEAN(check_vnode_mmap_perms, &, cred, vp, &vp->v_label, newmapping); return (result); } int mac_check_vnode_open(struct ucred *cred, struct vnode *vp, mode_t acc_mode) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_open"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_open, cred, vp, &vp->v_label, acc_mode); return (error); } int mac_check_vnode_poll(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_poll"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, active_cred); if (error) return (error); MAC_CHECK(check_vnode_poll, active_cred, file_cred, vp, &vp->v_label); return (error); } int mac_check_vnode_read(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_read"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, active_cred); if (error) return (error); MAC_CHECK(check_vnode_read, active_cred, file_cred, vp, &vp->v_label); return (error); } int mac_check_vnode_readdir(struct ucred *cred, struct vnode *dvp) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_readdir"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); MAC_CHECK(check_vnode_readdir, cred, dvp, &dvp->v_label); return (error); } int mac_check_vnode_readlink(struct ucred *cred, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_readlink"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_readlink, cred, vp, &vp->v_label); return (error); } static int mac_check_vnode_relabel(struct ucred *cred, struct vnode *vp, struct label *newlabel) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_relabel"); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_relabel, cred, vp, &vp->v_label, newlabel); return (error); } int mac_check_vnode_rename_from(struct ucred *cred, struct vnode *dvp, struct vnode *vp, struct componentname *cnp) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_rename_from"); ASSERT_VOP_LOCKED(vp, "mac_check_vnode_rename_from"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_rename_from, cred, dvp, &dvp->v_label, vp, &vp->v_label, cnp); return (error); } int mac_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp, struct vnode *vp, int samedir, struct componentname *cnp) { int error; ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_rename_to"); ASSERT_VOP_LOCKED(vp, "mac_check_vnode_rename_to"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(dvp, cred); if (error) return (error); if (vp != NULL) { error = vn_refreshlabel(vp, cred); if (error) return (error); } MAC_CHECK(check_vnode_rename_to, cred, dvp, &dvp->v_label, vp, vp != NULL ? &vp->v_label : NULL, samedir, cnp); return (error); } int mac_check_vnode_revoke(struct ucred *cred, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_revoke"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_revoke, cred, vp, &vp->v_label); return (error); } int mac_check_vnode_setacl(struct ucred *cred, struct vnode *vp, acl_type_t type, struct acl *acl) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setacl"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_setacl, cred, vp, &vp->v_label, type, acl); return (error); } int mac_check_vnode_setextattr(struct ucred *cred, struct vnode *vp, int attrnamespace, const char *name, struct uio *uio) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setextattr"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_setextattr, cred, vp, &vp->v_label, attrnamespace, name, uio); return (error); } int mac_check_vnode_setflags(struct ucred *cred, struct vnode *vp, u_long flags) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setflags"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_setflags, cred, vp, &vp->v_label, flags); return (error); } int mac_check_vnode_setmode(struct ucred *cred, struct vnode *vp, mode_t mode) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setmode"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_setmode, cred, vp, &vp->v_label, mode); return (error); } int mac_check_vnode_setowner(struct ucred *cred, struct vnode *vp, uid_t uid, gid_t gid) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setowner"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_setowner, cred, vp, &vp->v_label, uid, gid); return (error); } int mac_check_vnode_setutimes(struct ucred *cred, struct vnode *vp, struct timespec atime, struct timespec mtime) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setutimes"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(check_vnode_setutimes, cred, vp, &vp->v_label, atime, mtime); return (error); } int mac_check_vnode_stat(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_stat"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, active_cred); if (error) return (error); MAC_CHECK(check_vnode_stat, active_cred, file_cred, vp, &vp->v_label); return (error); } int mac_check_vnode_write(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp) { int error; ASSERT_VOP_LOCKED(vp, "mac_check_vnode_write"); if (!mac_enforce_fs) return (0); error = vn_refreshlabel(vp, active_cred); if (error) return (error); MAC_CHECK(check_vnode_write, active_cred, file_cred, vp, &vp->v_label); return (error); } /* * When relabeling a process, call out to the policies for the maximum * permission allowed for each object type we know about in its * memory space, and revoke access (in the least surprising ways we * know) when necessary. The process lock is not held here. */ static void mac_cred_mmapped_drop_perms(struct thread *td, struct ucred *cred) { /* XXX freeze all other threads */ mac_cred_mmapped_drop_perms_recurse(td, cred, &td->td_proc->p_vmspace->vm_map); /* XXX allow other threads to continue */ } static __inline const char * prot2str(vm_prot_t prot) { switch (prot & VM_PROT_ALL) { case VM_PROT_READ: return ("r--"); case VM_PROT_READ | VM_PROT_WRITE: return ("rw-"); case VM_PROT_READ | VM_PROT_EXECUTE: return ("r-x"); case VM_PROT_READ | VM_PROT_WRITE | VM_PROT_EXECUTE: return ("rwx"); case VM_PROT_WRITE: return ("-w-"); case VM_PROT_EXECUTE: return ("--x"); case VM_PROT_WRITE | VM_PROT_EXECUTE: return ("-wx"); default: return ("---"); } } static void mac_cred_mmapped_drop_perms_recurse(struct thread *td, struct ucred *cred, struct vm_map *map) { struct vm_map_entry *vme; vm_prot_t result, revokeperms; vm_object_t object; vm_ooffset_t offset; struct vnode *vp; if (!mac_mmap_revocation) return; vm_map_lock_read(map); for (vme = map->header.next; vme != &map->header; vme = vme->next) { if (vme->eflags & MAP_ENTRY_IS_SUB_MAP) { mac_cred_mmapped_drop_perms_recurse(td, cred, vme->object.sub_map); continue; } /* * Skip over entries that obviously are not shared. */ if (vme->eflags & (MAP_ENTRY_COW | MAP_ENTRY_NOSYNC) || !vme->max_protection) continue; /* * Drill down to the deepest backing object. */ offset = vme->offset; object = vme->object.vm_object; if (object == NULL) continue; while (object->backing_object != NULL) { object = object->backing_object; offset += object->backing_object_offset; } /* * At the moment, vm_maps and objects aren't considered * by the MAC system, so only things with backing by a * normal object (read: vnodes) are checked. */ if (object->type != OBJT_VNODE) continue; vp = (struct vnode *)object->handle; vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); result = mac_check_vnode_mmap_prot(cred, vp, 0); VOP_UNLOCK(vp, 0, td); /* * Find out what maximum protection we may be allowing * now but a policy needs to get removed. */ revokeperms = vme->max_protection & ~result; if (!revokeperms) continue; printf("pid %ld: revoking %s perms from %#lx:%ld " "(max %s/cur %s)\n", (long)td->td_proc->p_pid, prot2str(revokeperms), (u_long)vme->start, (long)(vme->end - vme->start), prot2str(vme->max_protection), prot2str(vme->protection)); vm_map_lock_upgrade(map); /* * This is the really simple case: if a map has more * max_protection than is allowed, but it's not being * actually used (that is, the current protection is * still allowed), we can just wipe it out and do * nothing more. */ if ((vme->protection & revokeperms) == 0) { vme->max_protection -= revokeperms; } else { if (revokeperms & VM_PROT_WRITE) { /* * In the more complicated case, flush out all * pending changes to the object then turn it * copy-on-write. */ vm_object_reference(object); vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); vm_object_page_clean(object, OFF_TO_IDX(offset), OFF_TO_IDX(offset + vme->end - vme->start + PAGE_MASK), OBJPC_SYNC); VOP_UNLOCK(vp, 0, td); vm_object_deallocate(object); /* * Why bother if there's no read permissions * anymore? For the rest, we need to leave * the write permissions on for COW, or * remove them entirely if configured to. */ if (!mac_mmap_revocation_via_cow) { vme->max_protection &= ~VM_PROT_WRITE; vme->protection &= ~VM_PROT_WRITE; } if ((revokeperms & VM_PROT_READ) == 0) vme->eflags |= MAP_ENTRY_COW | MAP_ENTRY_NEEDS_COPY; } if (revokeperms & VM_PROT_EXECUTE) { vme->max_protection &= ~VM_PROT_EXECUTE; vme->protection &= ~VM_PROT_EXECUTE; } if (revokeperms & VM_PROT_READ) { vme->max_protection = 0; vme->protection = 0; } pmap_protect(map->pmap, vme->start, vme->end, vme->protection & ~revokeperms); vm_map_simplify_entry(map, vme); } vm_map_lock_downgrade(map); } vm_map_unlock_read(map); } /* * When the subject's label changes, it may require revocation of privilege * to mapped objects. This can't be done on-the-fly later with a unified * buffer cache. */ static void mac_relabel_cred(struct ucred *cred, struct label *newlabel) { MAC_PERFORM(relabel_cred, cred, newlabel); } void mac_relabel_vnode(struct ucred *cred, struct vnode *vp, struct label *newlabel) { MAC_PERFORM(relabel_vnode, cred, vp, &vp->v_label, newlabel); } void mac_create_ifnet(struct ifnet *ifnet) { MAC_PERFORM(create_ifnet, ifnet, &ifnet->if_label); } void mac_create_bpfdesc(struct ucred *cred, struct bpf_d *bpf_d) { MAC_PERFORM(create_bpfdesc, cred, bpf_d, &bpf_d->bd_label); } void mac_create_socket(struct ucred *cred, struct socket *socket) { MAC_PERFORM(create_socket, cred, socket, &socket->so_label); } void mac_create_pipe(struct ucred *cred, struct pipe *pipe) { MAC_PERFORM(create_pipe, cred, pipe, pipe->pipe_label); } void mac_create_socket_from_socket(struct socket *oldsocket, struct socket *newsocket) { MAC_PERFORM(create_socket_from_socket, oldsocket, &oldsocket->so_label, newsocket, &newsocket->so_label); } static void mac_relabel_socket(struct ucred *cred, struct socket *socket, struct label *newlabel) { MAC_PERFORM(relabel_socket, cred, socket, &socket->so_label, newlabel); } static void mac_relabel_pipe(struct ucred *cred, struct pipe *pipe, struct label *newlabel) { MAC_PERFORM(relabel_pipe, cred, pipe, pipe->pipe_label, newlabel); } void mac_set_socket_peer_from_mbuf(struct mbuf *mbuf, struct socket *socket) { MAC_PERFORM(set_socket_peer_from_mbuf, mbuf, &mbuf->m_pkthdr.label, socket, &socket->so_peerlabel); } void mac_set_socket_peer_from_socket(struct socket *oldsocket, struct socket *newsocket) { MAC_PERFORM(set_socket_peer_from_socket, oldsocket, &oldsocket->so_label, newsocket, &newsocket->so_peerlabel); } void mac_create_datagram_from_ipq(struct ipq *ipq, struct mbuf *datagram) { MAC_PERFORM(create_datagram_from_ipq, ipq, &ipq->ipq_label, datagram, &datagram->m_pkthdr.label); } void mac_create_fragment(struct mbuf *datagram, struct mbuf *fragment) { MAC_PERFORM(create_fragment, datagram, &datagram->m_pkthdr.label, fragment, &fragment->m_pkthdr.label); } void mac_create_ipq(struct mbuf *fragment, struct ipq *ipq) { MAC_PERFORM(create_ipq, fragment, &fragment->m_pkthdr.label, ipq, &ipq->ipq_label); } void mac_create_mbuf_from_mbuf(struct mbuf *oldmbuf, struct mbuf *newmbuf) { MAC_PERFORM(create_mbuf_from_mbuf, oldmbuf, &oldmbuf->m_pkthdr.label, newmbuf, &newmbuf->m_pkthdr.label); } void mac_create_mbuf_from_bpfdesc(struct bpf_d *bpf_d, struct mbuf *mbuf) { MAC_PERFORM(create_mbuf_from_bpfdesc, bpf_d, &bpf_d->bd_label, mbuf, &mbuf->m_pkthdr.label); } void mac_create_mbuf_linklayer(struct ifnet *ifnet, struct mbuf *mbuf) { MAC_PERFORM(create_mbuf_linklayer, ifnet, &ifnet->if_label, mbuf, &mbuf->m_pkthdr.label); } void mac_create_mbuf_from_ifnet(struct ifnet *ifnet, struct mbuf *mbuf) { MAC_PERFORM(create_mbuf_from_ifnet, ifnet, &ifnet->if_label, mbuf, &mbuf->m_pkthdr.label); } void mac_create_mbuf_multicast_encap(struct mbuf *oldmbuf, struct ifnet *ifnet, struct mbuf *newmbuf) { MAC_PERFORM(create_mbuf_multicast_encap, oldmbuf, &oldmbuf->m_pkthdr.label, ifnet, &ifnet->if_label, newmbuf, &newmbuf->m_pkthdr.label); } void mac_create_mbuf_netlayer(struct mbuf *oldmbuf, struct mbuf *newmbuf) { MAC_PERFORM(create_mbuf_netlayer, oldmbuf, &oldmbuf->m_pkthdr.label, newmbuf, &newmbuf->m_pkthdr.label); } int mac_fragment_match(struct mbuf *fragment, struct ipq *ipq) { int result; result = 1; MAC_BOOLEAN(fragment_match, &&, fragment, &fragment->m_pkthdr.label, ipq, &ipq->ipq_label); return (result); } void mac_update_ipq(struct mbuf *fragment, struct ipq *ipq) { MAC_PERFORM(update_ipq, fragment, &fragment->m_pkthdr.label, ipq, &ipq->ipq_label); } void mac_create_mbuf_from_socket(struct socket *socket, struct mbuf *mbuf) { MAC_PERFORM(create_mbuf_from_socket, socket, &socket->so_label, mbuf, &mbuf->m_pkthdr.label); } void mac_create_mount(struct ucred *cred, struct mount *mp) { MAC_PERFORM(create_mount, cred, mp, &mp->mnt_mntlabel, &mp->mnt_fslabel); } void mac_create_root_mount(struct ucred *cred, struct mount *mp) { MAC_PERFORM(create_root_mount, cred, mp, &mp->mnt_mntlabel, &mp->mnt_fslabel); } int mac_check_bpfdesc_receive(struct bpf_d *bpf_d, struct ifnet *ifnet) { int error; if (!mac_enforce_network) return (0); MAC_CHECK(check_bpfdesc_receive, bpf_d, &bpf_d->bd_label, ifnet, &ifnet->if_label); return (error); } static int mac_check_cred_relabel(struct ucred *cred, struct label *newlabel) { int error; MAC_CHECK(check_cred_relabel, cred, newlabel); return (error); } int mac_check_cred_visible(struct ucred *u1, struct ucred *u2) { int error; if (!mac_enforce_process) return (0); MAC_CHECK(check_cred_visible, u1, u2); return (error); } int mac_check_ifnet_transmit(struct ifnet *ifnet, struct mbuf *mbuf) { int error; if (!mac_enforce_network) return (0); KASSERT(mbuf->m_flags & M_PKTHDR, ("packet has no pkthdr")); if (!(mbuf->m_pkthdr.label.l_flags & MAC_FLAG_INITIALIZED)) printf("%s%d: not initialized\n", ifnet->if_name, ifnet->if_unit); MAC_CHECK(check_ifnet_transmit, ifnet, &ifnet->if_label, mbuf, &mbuf->m_pkthdr.label); return (error); } int mac_check_mount_stat(struct ucred *cred, struct mount *mount) { int error; if (!mac_enforce_fs) return (0); MAC_CHECK(check_mount_stat, cred, mount, &mount->mnt_mntlabel); return (error); } int mac_check_pipe_ioctl(struct ucred *cred, struct pipe *pipe, unsigned long cmd, void *data) { int error; PIPE_LOCK_ASSERT(pipe, MA_OWNED); if (!mac_enforce_pipe) return (0); MAC_CHECK(check_pipe_ioctl, cred, pipe, pipe->pipe_label, cmd, data); return (error); } int mac_check_pipe_poll(struct ucred *cred, struct pipe *pipe) { int error; PIPE_LOCK_ASSERT(pipe, MA_OWNED); if (!mac_enforce_pipe) return (0); MAC_CHECK(check_pipe_poll, cred, pipe, pipe->pipe_label); return (error); } int mac_check_pipe_read(struct ucred *cred, struct pipe *pipe) { int error; PIPE_LOCK_ASSERT(pipe, MA_OWNED); if (!mac_enforce_pipe) return (0); MAC_CHECK(check_pipe_read, cred, pipe, pipe->pipe_label); return (error); } static int mac_check_pipe_relabel(struct ucred *cred, struct pipe *pipe, struct label *newlabel) { int error; PIPE_LOCK_ASSERT(pipe, MA_OWNED); if (!mac_enforce_pipe) return (0); MAC_CHECK(check_pipe_relabel, cred, pipe, pipe->pipe_label, newlabel); return (error); } int mac_check_pipe_stat(struct ucred *cred, struct pipe *pipe) { int error; PIPE_LOCK_ASSERT(pipe, MA_OWNED); if (!mac_enforce_pipe) return (0); MAC_CHECK(check_pipe_stat, cred, pipe, pipe->pipe_label); return (error); } int mac_check_pipe_write(struct ucred *cred, struct pipe *pipe) { int error; PIPE_LOCK_ASSERT(pipe, MA_OWNED); if (!mac_enforce_pipe) return (0); MAC_CHECK(check_pipe_write, cred, pipe, pipe->pipe_label); return (error); } int mac_check_proc_debug(struct ucred *cred, struct proc *proc) { int error; PROC_LOCK_ASSERT(proc, MA_OWNED); if (!mac_enforce_process) return (0); MAC_CHECK(check_proc_debug, cred, proc); return (error); } int mac_check_proc_sched(struct ucred *cred, struct proc *proc) { int error; PROC_LOCK_ASSERT(proc, MA_OWNED); if (!mac_enforce_process) return (0); MAC_CHECK(check_proc_sched, cred, proc); return (error); } int mac_check_proc_signal(struct ucred *cred, struct proc *proc, int signum) { int error; PROC_LOCK_ASSERT(proc, MA_OWNED); if (!mac_enforce_process) return (0); MAC_CHECK(check_proc_signal, cred, proc, signum); return (error); } int mac_check_socket_bind(struct ucred *ucred, struct socket *socket, struct sockaddr *sockaddr) { int error; if (!mac_enforce_socket) return (0); MAC_CHECK(check_socket_bind, ucred, socket, &socket->so_label, sockaddr); return (error); } int mac_check_socket_connect(struct ucred *cred, struct socket *socket, struct sockaddr *sockaddr) { int error; if (!mac_enforce_socket) return (0); MAC_CHECK(check_socket_connect, cred, socket, &socket->so_label, sockaddr); return (error); } int mac_check_socket_deliver(struct socket *socket, struct mbuf *mbuf) { int error; if (!mac_enforce_socket) return (0); MAC_CHECK(check_socket_deliver, socket, &socket->so_label, mbuf, &mbuf->m_pkthdr.label); return (error); } int mac_check_socket_listen(struct ucred *cred, struct socket *socket) { int error; if (!mac_enforce_socket) return (0); MAC_CHECK(check_socket_listen, cred, socket, &socket->so_label); return (error); } static int mac_check_socket_relabel(struct ucred *cred, struct socket *socket, struct label *newlabel) { int error; MAC_CHECK(check_socket_relabel, cred, socket, &socket->so_label, newlabel); return (error); } int mac_check_socket_visible(struct ucred *cred, struct socket *socket) { int error; if (!mac_enforce_socket) return (0); MAC_CHECK(check_socket_visible, cred, socket, &socket->so_label); return (error); } int mac_ioctl_ifnet_get(struct ucred *cred, struct ifreq *ifr, struct ifnet *ifnet) { struct mac label; int error; error = mac_externalize(&ifnet->if_label, &label); if (error) return (error); return (copyout(&label, ifr->ifr_ifru.ifru_data, sizeof(label))); } int mac_ioctl_ifnet_set(struct ucred *cred, struct ifreq *ifr, struct ifnet *ifnet) { struct mac newlabel; struct label intlabel; int error; error = copyin(ifr->ifr_ifru.ifru_data, &newlabel, sizeof(newlabel)); if (error) return (error); error = mac_internalize(&intlabel, &newlabel); if (error) return (error); /* * XXX: Note that this is a redundant privilege check, since * policies impose this check themselves if required by the * policy. Eventually, this should go away. */ error = suser_cred(cred, 0); if (error) goto out; MAC_CHECK(check_ifnet_relabel, cred, ifnet, &ifnet->if_label, &intlabel); if (error) goto out; MAC_PERFORM(relabel_ifnet, cred, ifnet, &ifnet->if_label, &intlabel); out: mac_destroy_temp(&intlabel); return (error); } void mac_create_devfs_vnode(struct devfs_dirent *de, struct vnode *vp) { MAC_PERFORM(create_devfs_vnode, de, &de->de_label, vp, &vp->v_label); } void mac_create_devfs_device(dev_t dev, struct devfs_dirent *de) { MAC_PERFORM(create_devfs_device, dev, de, &de->de_label); } static int mac_stdcreatevnode_ea(struct vnode *vp) { int error; MAC_CHECK(stdcreatevnode_ea, vp, &vp->v_label); return (error); } void mac_create_devfs_directory(char *dirname, int dirnamelen, struct devfs_dirent *de) { MAC_PERFORM(create_devfs_directory, dirname, dirnamelen, de, &de->de_label); } /* * When a new vnode is created, this call will initialize its label. */ void mac_create_vnode(struct ucred *cred, struct vnode *parent, struct vnode *child) { int error; ASSERT_VOP_LOCKED(parent, "mac_create_vnode"); ASSERT_VOP_LOCKED(child, "mac_create_vnode"); error = vn_refreshlabel(parent, cred); if (error) { printf("mac_create_vnode: vn_refreshlabel returned %d\n", error); printf("mac_create_vnode: using old vnode label\n"); } MAC_PERFORM(create_vnode, cred, parent, &parent->v_label, child, &child->v_label); } int mac_setsockopt_label_set(struct ucred *cred, struct socket *so, struct mac *extmac) { struct label intlabel; int error; error = mac_internalize(&intlabel, extmac); if (error) return (error); mac_check_socket_relabel(cred, so, &intlabel); if (error) { mac_destroy_temp(&intlabel); return (error); } mac_relabel_socket(cred, so, &intlabel); mac_destroy_temp(&intlabel); return (0); } int mac_pipe_label_set(struct ucred *cred, struct pipe *pipe, struct label *label) { int error; PIPE_LOCK_ASSERT(pipe, MA_OWNED); error = mac_check_pipe_relabel(cred, pipe, label); if (error) return (error); mac_relabel_pipe(cred, pipe, label); return (0); } int mac_getsockopt_label_get(struct ucred *cred, struct socket *so, struct mac *extmac) { return (mac_externalize(&so->so_label, extmac)); } int mac_getsockopt_peerlabel_get(struct ucred *cred, struct socket *so, struct mac *extmac) { return (mac_externalize(&so->so_peerlabel, extmac)); } /* * Implementation of VOP_SETLABEL() that relies on extended attributes * to store label data. Can be referenced by filesystems supporting * extended attributes. */ int vop_stdsetlabel_ea(struct vop_setlabel_args *ap) { struct vnode *vp = ap->a_vp; struct label *intlabel = ap->a_label; struct mac extmac; int error; ASSERT_VOP_LOCKED(vp, "vop_stdsetlabel_ea"); /* * XXX: Eventually call out to EA check/set calls here. * Be particularly careful to avoid race conditions, * consistency problems, and stability problems when * dealing with multiple EAs. In particular, we require * the ability to write multiple EAs on the same file in * a single transaction, which the current EA interface * does not provide. */ error = mac_externalize(intlabel, &extmac); if (error) return (error); error = vn_extattr_set(vp, IO_NODELOCKED, FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME, sizeof(extmac), (char *)&extmac, curthread); if (error) return (error); mac_relabel_vnode(ap->a_cred, vp, intlabel); vp->v_vflag |= VV_CACHEDLABEL; return (0); } static int vn_setlabel(struct vnode *vp, struct label *intlabel, struct ucred *cred) { int error; if (vp->v_mount == NULL) { /* printf("vn_setlabel: null v_mount\n"); */ if (vp->v_type != VNON) printf("vn_setlabel: null v_mount with non-VNON\n"); return (EBADF); } if ((vp->v_mount->mnt_flag & MNT_MULTILABEL) == 0) return (EOPNOTSUPP); /* * Multi-phase commit. First check the policies to confirm the * change is OK. Then commit via the filesystem. Finally, * update the actual vnode label. Question: maybe the filesystem * should update the vnode at the end as part of VOP_SETLABEL()? */ error = mac_check_vnode_relabel(cred, vp, intlabel); if (error) return (error); /* * VADMIN provides the opportunity for the filesystem to make * decisions about who is and is not able to modify labels * and protections on files. This might not be right. We can't * assume VOP_SETLABEL() will do it, because we might implement * that as part of vop_stdsetlabel_ea(). */ error = VOP_ACCESS(vp, VADMIN, cred, curthread); if (error) return (error); error = VOP_SETLABEL(vp, intlabel, cred, curthread); if (error) return (error); return (0); } /* * MPSAFE */ int __mac_get_proc(struct thread *td, struct __mac_get_proc_args *uap) { struct mac extmac; int error; error = mac_externalize(&td->td_ucred->cr_label, &extmac); if (error == 0) error = copyout(&extmac, SCARG(uap, mac_p), sizeof(extmac)); return (error); } /* * MPSAFE */ int __mac_set_proc(struct thread *td, struct __mac_set_proc_args *uap) { struct ucred *newcred, *oldcred; struct proc *p; struct mac extmac; struct label intlabel; int error; error = copyin(SCARG(uap, mac_p), &extmac, sizeof(extmac)); if (error) return (error); error = mac_internalize(&intlabel, &extmac); if (error) return (error); newcred = crget(); p = td->td_proc; PROC_LOCK(p); oldcred = p->p_ucred; error = mac_check_cred_relabel(oldcred, &intlabel); if (error) { PROC_UNLOCK(p); mac_destroy_temp(&intlabel); crfree(newcred); return (error); } setsugid(p); crcopy(newcred, oldcred); mac_relabel_cred(newcred, &intlabel); p->p_ucred = newcred; /* * Grab additional reference for use while revoking mmaps, prior * to releasing the proc lock and sharing the cred. */ crhold(newcred); PROC_UNLOCK(p); mtx_lock(&Giant); mac_cred_mmapped_drop_perms(td, newcred); mtx_unlock(&Giant); crfree(newcred); /* Free revocation reference. */ crfree(oldcred); mac_destroy_temp(&intlabel); return (0); } /* * MPSAFE */ int __mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap) { struct file *fp; struct mac extmac; struct vnode *vp; struct pipe *pipe; int error; mtx_lock(&Giant); error = fget(td, SCARG(uap, fd), &fp); if (error) goto out; switch (fp->f_type) { case DTYPE_FIFO: case DTYPE_VNODE: vp = (struct vnode *)fp->f_data; vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); error = vn_refreshlabel(vp, td->td_ucred); if (error == 0) error = mac_externalize(&vp->v_label, &extmac); VOP_UNLOCK(vp, 0, td); break; case DTYPE_PIPE: pipe = (struct pipe *)fp->f_data; error = mac_externalize(pipe->pipe_label, &extmac); break; default: error = EINVAL; } if (error == 0) error = copyout(&extmac, SCARG(uap, mac_p), sizeof(extmac)); fdrop(fp, td); out: mtx_unlock(&Giant); return (error); } /* * MPSAFE */ int __mac_get_file(struct thread *td, struct __mac_get_file_args *uap) { struct nameidata nd; struct mac extmac; int error; mtx_lock(&Giant); NDINIT(&nd, LOOKUP, LOCKLEAF | FOLLOW, UIO_USERSPACE, SCARG(uap, path_p), td); error = namei(&nd); if (error) goto out; error = vn_refreshlabel(nd.ni_vp, td->td_ucred); if (error == 0) error = mac_externalize(&nd.ni_vp->v_label, &extmac); NDFREE(&nd, 0); if (error) goto out; error = copyout(&extmac, SCARG(uap, mac_p), sizeof(extmac)); out: mtx_unlock(&Giant); return (error); } /* * MPSAFE */ int __mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap) { struct file *fp; struct mac extmac; struct label intlabel; struct mount *mp; struct vnode *vp; struct pipe *pipe; int error; mtx_lock(&Giant); error = fget(td, SCARG(uap, fd), &fp); if (error) goto out1; error = copyin(SCARG(uap, mac_p), &extmac, sizeof(extmac)); if (error) goto out2; error = mac_internalize(&intlabel, &extmac); if (error) goto out2; switch (fp->f_type) { case DTYPE_FIFO: case DTYPE_VNODE: vp = (struct vnode *)fp->f_data; error = vn_start_write(vp, &mp, V_WAIT | PCATCH); if (error != 0) break; vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); error = vn_setlabel(vp, &intlabel, td->td_ucred); VOP_UNLOCK(vp, 0, td); vn_finished_write(mp); mac_destroy_temp(&intlabel); break; case DTYPE_PIPE: pipe = (struct pipe *)fp->f_data; PIPE_LOCK(pipe); error = mac_pipe_label_set(td->td_ucred, pipe, &intlabel); PIPE_UNLOCK(pipe); break; default: error = EINVAL; } out2: fdrop(fp, td); out1: mtx_unlock(&Giant); return (error); } /* * MPSAFE */ int __mac_set_file(struct thread *td, struct __mac_set_file_args *uap) { struct nameidata nd; struct mac extmac; struct label intlabel; struct mount *mp; int error; mtx_lock(&Giant); error = copyin(SCARG(uap, mac_p), &extmac, sizeof(extmac)); if (error) goto out; error = mac_internalize(&intlabel, &extmac); if (error) goto out; NDINIT(&nd, LOOKUP, LOCKLEAF | FOLLOW, UIO_USERSPACE, SCARG(uap, path_p), td); error = namei(&nd); if (error) goto out2; error = vn_start_write(nd.ni_vp, &mp, V_WAIT | PCATCH); if (error) goto out2; error = vn_setlabel(nd.ni_vp, &intlabel, td->td_ucred); vn_finished_write(mp); out2: mac_destroy_temp(&intlabel); NDFREE(&nd, 0); out: mtx_unlock(&Giant); return (error); } int mac_syscall(struct thread *td, struct mac_syscall_args *uap) { struct mac_policy_conf *mpc; char target[MAC_MAX_POLICY_NAME]; int error; error = copyinstr(SCARG(uap, policy), target, sizeof(target), NULL); if (error) return (error); error = ENOSYS; MAC_POLICY_LIST_BUSY(); LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { if (strcmp(mpc->mpc_name, target) == 0 && mpc->mpc_ops->mpo_syscall != NULL) { error = mpc->mpc_ops->mpo_syscall(td, SCARG(uap, call), SCARG(uap, arg)); goto out; } } out: MAC_POLICY_LIST_UNBUSY(); return (error); } SYSINIT(mac, SI_SUB_MAC, SI_ORDER_FIRST, mac_init, NULL); SYSINIT(mac_late, SI_SUB_MAC_LATE, SI_ORDER_FIRST, mac_late_init, NULL); #else /* !MAC */ int __mac_get_proc(struct thread *td, struct __mac_get_proc_args *uap) { return (ENOSYS); } int __mac_set_proc(struct thread *td, struct __mac_set_proc_args *uap) { return (ENOSYS); } int __mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap) { return (ENOSYS); } int __mac_get_file(struct thread *td, struct __mac_get_file_args *uap) { return (ENOSYS); } int __mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap) { return (ENOSYS); } int __mac_set_file(struct thread *td, struct __mac_set_file_args *uap) { return (ENOSYS); } int mac_syscall(struct thread *td, struct mac_syscall_args *uap) { return (ENOSYS); } #endif /* !MAC */ Index: head/sys/sys/mac.h =================================================================== --- head/sys/sys/mac.h (revision 104528) +++ head/sys/sys/mac.h (revision 104529) @@ -1,394 +1,396 @@ /*- * Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson * Copyright (c) 2001, 2002 Networks Associates Technology, Inc. * All rights reserved. * * This software was developed by Robert Watson for the TrustedBSD Project. * * This software was developed for the FreeBSD Project in part by NAI Labs, * the Security Research Division of Network Associates, Inc. under * DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA * CHATS research program. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * 3. The names of the authors may not be used to endorse or promote * products derived from this software without specific prior written * permission. * * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. * * $FreeBSD$ */ /* * Userland/kernel interface for Mandatory Access Control. * * The POSIX.1e implementation page may be reached at: * http://www.trustedbsd.org/ */ #ifndef _SYS_MAC_H #define _SYS_MAC_H #include #ifndef _POSIX_MAC #define _POSIX_MAC #endif /* * XXXMAC: The single MAC extended attribute will be deprecated once * compound EA writes on a single target file can be performed cleanly * with UFS2. */ #define FREEBSD_MAC_EXTATTR_NAME "freebsd.mac" #define FREEBSD_MAC_EXTATTR_NAMESPACE EXTATTR_NAMESPACE_SYSTEM /* * MAC framework-related constants and limits. */ #define MAC_MAX_POLICY_NAME 32 /* * XXXMAC: Per-policy structures will be moved from mac.h to per-policy * include files once the revised user interface is available. */ /* * Structures and constants associated with a Biba Integrity policy. * mac_biba represents a Biba label, with mb_type determining its properties, * and mb_grade represents the hierarchal grade if valid for the current * mb_type. These structures will move to mac_biba.h once we have dymamic * labels exposed to userland. */ struct mac_biba_element { u_short mbe_type; u_short mbe_grade; }; /* * Biba labels consist of two components: a single label, and a label * range. Depending on the context, one or both may be used; the mb_flags * field permits the provider to indicate what fields are intended for * use. */ struct mac_biba { int mb_flags; struct mac_biba_element mb_single; struct mac_biba_element mb_rangelow, mb_rangehigh; }; /* * Structures and constants associated with a Multi-Level Security policy. * mac_mls represents an MLS label, with mm_type determining its properties, * and mm_level represents the hierarchal sensitivity level if valid for the * current mm_type. These structures will move to mac_mls.h once we have * dynamic labels exposed to userland. */ struct mac_mls_element { u_short mme_type; u_short mme_level; }; /* * MLS labels consist of two components: a single label, and a label * range. Depending on the context, one or both may be used; the mb_flags * field permits the provider to indicate what fields are intended for * use. */ struct mac_mls { int mm_flags; struct mac_mls_element mm_single; struct mac_mls_element mm_rangelow, mm_rangehigh; }; /* * Structures and constants associated with a Type Enforcement policy. * mac_te represents a Type Enforcement label. */ #define MAC_TE_TYPE_MAXLEN 32 struct mac_te { char mt_type[MAC_TE_TYPE_MAXLEN+1]; /* TE type */ }; struct mac_sebsd { uint32_t ms_psid; /* persistent sid storage */ }; /* * Composite structures and constants which combine the various policy * elements into common structures to be associated with subjects and * objects. */ struct mac { int m_macflags; struct mac_biba m_biba; struct mac_mls m_mls; struct mac_te m_te; struct mac_sebsd m_sebsd; }; typedef struct mac *mac_t; #define MAC_FLAG_INITIALIZED 0x00000001 /* Is initialized. */ #ifndef _KERNEL /* * POSIX.1e functions visible in the application namespace. */ int mac_dominate(const mac_t _labela, const mac_t _labelb); int mac_equal(const mac_t labela, const mac_t _labelb); int mac_free(void *_buf_p); mac_t mac_from_text(const char *_text_p); mac_t mac_get_fd(int _fildes); mac_t mac_get_file(const char *_path_p); mac_t mac_get_proc(void); mac_t mac_glb(const mac_t _labela, const mac_t _labelb); mac_t mac_lub(const mac_t _labela, const mac_t _labelb); int mac_set_fd(int _fildes, const mac_t _label); int mac_set_file(const char *_path_p, mac_t _label); int mac_set_proc(const mac_t _label); ssize_t mac_size(mac_t _label); char * mac_to_text(const mac_t _label, size_t *_len_p); int mac_valid(const mac_t _label); /* * Extensions to POSIX.1e visible in the application namespace. */ int mac_is_present_np(const char *_policyname); int mac_syscall(const char *_policyname, int call, void *arg); /* * System calls wrapped by some POSIX.1e functions. */ int __mac_get_fd(int _fd, struct mac *_mac_p); int __mac_get_file(const char *_path_p, struct mac *_mac_p); int __mac_get_proc(struct mac *_mac_p); int __mac_set_fd(int fd, struct mac *_mac_p); int __mac_set_file(const char *_path_p, struct mac *_mac_p); int __mac_set_proc(struct mac *_mac_p); #else /* _KERNEL */ /* * Kernel functions to manage and evaluate labels. */ struct bpf_d; struct componentname; struct devfs_dirent; struct ifnet; struct ifreq; struct ipq; struct mbuf; struct mount; struct proc; struct sockaddr; struct socket; struct pipe; struct thread; struct timespec; struct ucred; struct uio; struct vattr; struct vnode; #include /* XXX acl_type_t */ struct vop_refreshlabel_args; struct vop_setlabel_args; /* * Label operations. */ void mac_init_bpfdesc(struct bpf_d *); void mac_init_cred(struct ucred *); void mac_init_devfsdirent(struct devfs_dirent *); void mac_init_ifnet(struct ifnet *); void mac_init_ipq(struct ipq *); void mac_init_socket(struct socket *); void mac_init_pipe(struct pipe *); int mac_init_mbuf(struct mbuf *m, int how); void mac_init_mount(struct mount *); void mac_init_vnode(struct vnode *); void mac_destroy_bpfdesc(struct bpf_d *); void mac_destroy_cred(struct ucred *); void mac_destroy_devfsdirent(struct devfs_dirent *); void mac_destroy_ifnet(struct ifnet *); void mac_destroy_ipq(struct ipq *); void mac_destroy_socket(struct socket *); void mac_destroy_pipe(struct pipe *); void mac_destroy_mbuf(struct mbuf *); void mac_destroy_mount(struct mount *); void mac_destroy_vnode(struct vnode *); /* * Labeling event operations: file system objects, and things that * look a lot like file system objects. */ void mac_create_devfs_device(dev_t dev, struct devfs_dirent *de); void mac_create_devfs_directory(char *dirname, int dirnamelen, struct devfs_dirent *de); void mac_create_devfs_vnode(struct devfs_dirent *de, struct vnode *vp); void mac_create_vnode(struct ucred *cred, struct vnode *parent, struct vnode *child); void mac_create_mount(struct ucred *cred, struct mount *mp); void mac_create_root_mount(struct ucred *cred, struct mount *mp); void mac_relabel_vnode(struct ucred *cred, struct vnode *vp, struct label *newlabel); void mac_update_devfsdirent(struct devfs_dirent *de, struct vnode *vp); void mac_update_procfsvnode(struct vnode *vp, struct ucred *cred); void mac_update_vnode_from_mount(struct vnode *vp, struct mount *mp); /* * Labeling event operations: IPC objects. */ void mac_create_mbuf_from_socket(struct socket *so, struct mbuf *m); void mac_create_socket(struct ucred *cred, struct socket *socket); void mac_create_socket_from_socket(struct socket *oldsocket, struct socket *newsocket); void mac_set_socket_peer_from_mbuf(struct mbuf *mbuf, struct socket *socket); void mac_set_socket_peer_from_socket(struct socket *oldsocket, struct socket *newsocket); void mac_create_pipe(struct ucred *cred, struct pipe *pipe); /* * Labeling event operations: network objects. */ void mac_create_bpfdesc(struct ucred *cred, struct bpf_d *bpf_d); void mac_create_ifnet(struct ifnet *ifp); void mac_create_ipq(struct mbuf *fragment, struct ipq *ipq); void mac_create_datagram_from_ipq(struct ipq *ipq, struct mbuf *datagram); void mac_create_fragment(struct mbuf *datagram, struct mbuf *fragment); void mac_create_mbuf_from_mbuf(struct mbuf *oldmbuf, struct mbuf *newmbuf); void mac_create_mbuf_linklayer(struct ifnet *ifnet, struct mbuf *m); void mac_create_mbuf_from_bpfdesc(struct bpf_d *bpf_d, struct mbuf *m); void mac_create_mbuf_from_ifnet(struct ifnet *ifnet, struct mbuf *m); void mac_create_mbuf_multicast_encap(struct mbuf *oldmbuf, struct ifnet *ifnet, struct mbuf *newmbuf); void mac_create_mbuf_netlayer(struct mbuf *oldmbuf, struct mbuf *newmbuf); int mac_fragment_match(struct mbuf *fragment, struct ipq *ipq); void mac_update_ipq(struct mbuf *fragment, struct ipq *ipq); /* * Labeling event operations: processes. */ void mac_create_cred(struct ucred *cred_parent, struct ucred *cred_child); void mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp); int mac_execve_will_transition(struct ucred *old, struct vnode *vp); void mac_create_proc0(struct ucred *cred); void mac_create_proc1(struct ucred *cred); void mac_thread_userret(struct thread *td); /* Access control checks. */ int mac_check_bpfdesc_receive(struct bpf_d *bpf_d, struct ifnet *ifnet); int mac_check_cred_visible(struct ucred *u1, struct ucred *u2); int mac_check_ifnet_transmit(struct ifnet *ifnet, struct mbuf *m); int mac_check_mount_stat(struct ucred *cred, struct mount *mp); int mac_check_pipe_ioctl(struct ucred *cred, struct pipe *pipe, unsigned long cmd, void *data); int mac_check_pipe_poll(struct ucred *cred, struct pipe *pipe); int mac_check_pipe_read(struct ucred *cred, struct pipe *pipe); int mac_check_pipe_stat(struct ucred *cred, struct pipe *pipe); int mac_check_pipe_write(struct ucred *cred, struct pipe *pipe); int mac_check_proc_debug(struct ucred *cred, struct proc *proc); int mac_check_proc_sched(struct ucred *cred, struct proc *proc); int mac_check_proc_signal(struct ucred *cred, struct proc *proc, int signum); int mac_check_socket_bind(struct ucred *cred, struct socket *so, struct sockaddr *sockaddr); int mac_check_socket_connect(struct ucred *cred, struct socket *so, struct sockaddr *sockaddr); int mac_check_socket_deliver(struct socket *so, struct mbuf *m); int mac_check_socket_listen(struct ucred *cred, struct socket *so); int mac_check_socket_visible(struct ucred *cred, struct socket *so); int mac_check_vnode_access(struct ucred *cred, struct vnode *vp, int flags); int mac_check_vnode_chdir(struct ucred *cred, struct vnode *dvp); int mac_check_vnode_chroot(struct ucred *cred, struct vnode *dvp); int mac_check_vnode_create(struct ucred *cred, struct vnode *dvp, struct componentname *cnp, struct vattr *vap); int mac_check_vnode_delete(struct ucred *cred, struct vnode *dvp, struct vnode *vp, struct componentname *cnp); int mac_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp, acl_type_t type); int mac_check_vnode_exec(struct ucred *cred, struct vnode *vp); int mac_check_vnode_getacl(struct ucred *cred, struct vnode *vp, acl_type_t type); int mac_check_vnode_getextattr(struct ucred *cred, struct vnode *vp, int attrnamespace, const char *name, struct uio *uio); +int mac_check_vnode_link(struct ucred *cred, struct vnode *dvp, + struct vnode *vp, struct componentname *cnp); int mac_check_vnode_lookup(struct ucred *cred, struct vnode *dvp, struct componentname *cnp); /* XXX This u_char should be vm_prot_t! */ u_char mac_check_vnode_mmap_prot(struct ucred *cred, struct vnode *vp, int newmapping); int mac_check_vnode_open(struct ucred *cred, struct vnode *vp, mode_t acc_mode); int mac_check_vnode_poll(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp); int mac_check_vnode_read(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp); int mac_check_vnode_readdir(struct ucred *cred, struct vnode *vp); int mac_check_vnode_readlink(struct ucred *cred, struct vnode *vp); int mac_check_vnode_rename_from(struct ucred *cred, struct vnode *dvp, struct vnode *vp, struct componentname *cnp); int mac_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp, struct vnode *vp, int samedir, struct componentname *cnp); int mac_check_vnode_revoke(struct ucred *cred, struct vnode *vp); int mac_check_vnode_setacl(struct ucred *cred, struct vnode *vp, acl_type_t type, struct acl *acl); int mac_check_vnode_setextattr(struct ucred *cred, struct vnode *vp, int attrnamespace, const char *name, struct uio *uio); int mac_check_vnode_setflags(struct ucred *cred, struct vnode *vp, u_long flags); int mac_check_vnode_setmode(struct ucred *cred, struct vnode *vp, mode_t mode); int mac_check_vnode_setowner(struct ucred *cred, struct vnode *vp, uid_t uid, gid_t gid); int mac_check_vnode_setutimes(struct ucred *cred, struct vnode *vp, struct timespec atime, struct timespec mtime); int mac_check_vnode_stat(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp); int mac_check_vnode_write(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp); int mac_getsockopt_label_get(struct ucred *cred, struct socket *so, struct mac *extmac); int mac_getsockopt_peerlabel_get(struct ucred *cred, struct socket *so, struct mac *extmac); int mac_ioctl_ifnet_get(struct ucred *cred, struct ifreq *ifr, struct ifnet *ifnet); int mac_ioctl_ifnet_set(struct ucred *cred, struct ifreq *ifr, struct ifnet *ifnet); int mac_setsockopt_label_set(struct ucred *cred, struct socket *so, struct mac *extmac); int mac_pipe_label_set(struct ucred *cred, struct pipe *pipe, struct label *label); /* * Calls to help various file systems implement labeling functionality * using their existing EA implementation. */ int vop_stdcreatevnode_ea(struct vnode *dvp, struct vnode *tvp, struct ucred *cred); int vop_stdrefreshlabel_ea(struct vop_refreshlabel_args *ap); int vop_stdsetlabel_ea(struct vop_setlabel_args *ap); #endif /* _KERNEL */ #endif /* !_SYS_MAC_H */ Index: head/sys/sys/mac_policy.h =================================================================== --- head/sys/sys/mac_policy.h (revision 104528) +++ head/sys/sys/mac_policy.h (revision 104529) @@ -1,524 +1,528 @@ /*- * Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson * Copyright (c) 2001, 2002 Networks Associates Technology, Inc. * All rights reserved. * * This software was developed by Robert Watson for the TrustedBSD Project. * * This software was developed for the FreeBSD Project in part by NAI Labs, * the Security Research Division of Network Associates, Inc. under * DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA * CHATS research program. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * 3. The names of the authors may not be used to endorse or promote * products derived from this software without specific prior written * permission. * * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. * * $FreeBSD$ */ /* * Kernel interface for MAC policy modules. */ #ifndef _SYS_MAC_POLICY_H #define _SYS_MAC_POLICY_H /*- * Pluggable access control policy definition structure. * * List of operations that are performed as part of the implementation * of a MAC policy. Policy implementors declare operations with a * mac_policy_ops structure, and using the MAC_POLICY_SET() macro. * If an entry point is not declared, then then the policy will be ignored * during evaluation of that event or check. * * Operations are sorted first by general class of operation, then * alphabetically. */ struct mac_policy_conf; struct mac_policy_ops { /* * Policy module operations. */ void (*mpo_destroy)(struct mac_policy_conf *mpc); void (*mpo_init)(struct mac_policy_conf *mpc); /* * General policy-directed security system call so that policies * may implement new services without reserving explicit * system call numbers. */ int (*mpo_syscall)(struct thread *td, int call, void *arg); /* * Label operations. */ void (*mpo_init_bpfdesc_label)(struct label *label); void (*mpo_init_cred_label)(struct label *label); void (*mpo_init_devfsdirent_label)(struct label *label); void (*mpo_init_ifnet_label)(struct label *label); void (*mpo_init_ipq_label)(struct label *label); int (*mpo_init_mbuf_label)(struct label *label, int flag); void (*mpo_init_mount_label)(struct label *label); void (*mpo_init_mount_fs_label)(struct label *label); void (*mpo_init_socket_label)(struct label *label); void (*mpo_init_socket_peer_label)(struct label *label); void (*mpo_init_pipe_label)(struct label *label); void (*mpo_init_temp_label)(struct label *label); void (*mpo_init_vnode_label)(struct label *label); void (*mpo_destroy_bpfdesc_label)(struct label *label); void (*mpo_destroy_cred_label)(struct label *label); void (*mpo_destroy_devfsdirent_label)(struct label *label); void (*mpo_destroy_ifnet_label)(struct label *label); void (*mpo_destroy_ipq_label)(struct label *label); void (*mpo_destroy_mbuf_label)(struct label *label); void (*mpo_destroy_mount_label)(struct label *label); void (*mpo_destroy_mount_fs_label)(struct label *label); void (*mpo_destroy_socket_label)(struct label *label); void (*mpo_destroy_socket_peer_label)(struct label *label); void (*mpo_destroy_pipe_label)(struct label *label); void (*mpo_destroy_temp_label)(struct label *label); void (*mpo_destroy_vnode_label)(struct label *label); int (*mpo_externalize)(struct label *label, struct mac *extmac); int (*mpo_internalize)(struct label *label, struct mac *extmac); /* * Labeling event operations: file system objects, and things that * look a lot like file system objects. */ void (*mpo_create_devfs_device)(dev_t dev, struct devfs_dirent *de, struct label *label); void (*mpo_create_devfs_directory)(char *dirname, int dirnamelen, struct devfs_dirent *de, struct label *label); void (*mpo_create_devfs_vnode)(struct devfs_dirent *de, struct label *direntlabel, struct vnode *vp, struct label *vnodelabel); void (*mpo_create_vnode)(struct ucred *cred, struct vnode *parent, struct label *parentlabel, struct vnode *child, struct label *childlabel); void (*mpo_create_mount)(struct ucred *cred, struct mount *mp, struct label *mntlabel, struct label *fslabel); void (*mpo_create_root_mount)(struct ucred *cred, struct mount *mp, struct label *mountlabel, struct label *fslabel); void (*mpo_relabel_vnode)(struct ucred *cred, struct vnode *vp, struct label *vnodelabel, struct label *label); int (*mpo_stdcreatevnode_ea)(struct vnode *vp, struct label *vnodelabel); void (*mpo_update_devfsdirent)(struct devfs_dirent *devfs_dirent, struct label *direntlabel, struct vnode *vp, struct label *vnodelabel); void (*mpo_update_procfsvnode)(struct vnode *vp, struct label *vnodelabel, struct ucred *cred); int (*mpo_update_vnode_from_extattr)(struct vnode *vp, struct label *vnodelabel, struct mount *mp, struct label *fslabel); int (*mpo_update_vnode_from_externalized)(struct vnode *vp, struct label *vnodelabel, struct mac *mac); void (*mpo_update_vnode_from_mount)(struct vnode *vp, struct label *vnodelabel, struct mount *mp, struct label *fslabel); /* * Labeling event operations: IPC objects. */ void (*mpo_create_mbuf_from_socket)(struct socket *so, struct label *socketlabel, struct mbuf *m, struct label *mbuflabel); void (*mpo_create_socket)(struct ucred *cred, struct socket *so, struct label *socketlabel); void (*mpo_create_socket_from_socket)(struct socket *oldsocket, struct label *oldsocketlabel, struct socket *newsocket, struct label *newsocketlabel); void (*mpo_relabel_socket)(struct ucred *cred, struct socket *so, struct label *oldlabel, struct label *newlabel); void (*mpo_relabel_pipe)(struct ucred *cred, struct pipe *pipe, struct label *oldlabel, struct label *newlabel); void (*mpo_set_socket_peer_from_mbuf)(struct mbuf *mbuf, struct label *mbuflabel, struct socket *so, struct label *socketpeerlabel); void (*mpo_set_socket_peer_from_socket)(struct socket *oldsocket, struct label *oldsocketlabel, struct socket *newsocket, struct label *newsocketpeerlabel); void (*mpo_create_pipe)(struct ucred *cred, struct pipe *pipe, struct label *pipelabel); /* * Labeling event operations: network objects. */ void (*mpo_create_bpfdesc)(struct ucred *cred, struct bpf_d *bpf_d, struct label *bpflabel); void (*mpo_create_ifnet)(struct ifnet *ifnet, struct label *ifnetlabel); void (*mpo_create_ipq)(struct mbuf *fragment, struct label *fragmentlabel, struct ipq *ipq, struct label *ipqlabel); void (*mpo_create_datagram_from_ipq) (struct ipq *ipq, struct label *ipqlabel, struct mbuf *datagram, struct label *datagramlabel); void (*mpo_create_fragment)(struct mbuf *datagram, struct label *datagramlabel, struct mbuf *fragment, struct label *fragmentlabel); void (*mpo_create_mbuf_from_mbuf)(struct mbuf *oldmbuf, struct label *oldlabel, struct mbuf *newmbuf, struct label *newlabel); void (*mpo_create_mbuf_linklayer)(struct ifnet *ifnet, struct label *ifnetlabel, struct mbuf *mbuf, struct label *mbuflabel); void (*mpo_create_mbuf_from_bpfdesc)(struct bpf_d *bpf_d, struct label *bpflabel, struct mbuf *mbuf, struct label *mbuflabel); void (*mpo_create_mbuf_from_ifnet)(struct ifnet *ifnet, struct label *ifnetlabel, struct mbuf *mbuf, struct label *mbuflabel); void (*mpo_create_mbuf_multicast_encap)(struct mbuf *oldmbuf, struct label *oldmbuflabel, struct ifnet *ifnet, struct label *ifnetlabel, struct mbuf *newmbuf, struct label *newmbuflabel); void (*mpo_create_mbuf_netlayer)(struct mbuf *oldmbuf, struct label *oldmbuflabel, struct mbuf *newmbuf, struct label *newmbuflabel); int (*mpo_fragment_match)(struct mbuf *fragment, struct label *fragmentlabel, struct ipq *ipq, struct label *ipqlabel); void (*mpo_relabel_ifnet)(struct ucred *cred, struct ifnet *ifnet, struct label *ifnetlabel, struct label *newlabel); void (*mpo_update_ipq)(struct mbuf *fragment, struct label *fragmentlabel, struct ipq *ipq, struct label *ipqlabel); /* * Labeling event operations: processes. */ void (*mpo_create_cred)(struct ucred *parent_cred, struct ucred *child_cred); void (*mpo_execve_transition)(struct ucred *old, struct ucred *new, struct vnode *vp, struct label *vnodelabel); int (*mpo_execve_will_transition)(struct ucred *old, struct vnode *vp, struct label *vnodelabel); void (*mpo_create_proc0)(struct ucred *cred); void (*mpo_create_proc1)(struct ucred *cred); void (*mpo_relabel_cred)(struct ucred *cred, struct label *newlabel); void (*mpo_thread_userret)(struct thread *thread); /* * Access control checks. */ int (*mpo_check_bpfdesc_receive)(struct bpf_d *bpf_d, struct label *bpflabel, struct ifnet *ifnet, struct label *ifnetlabel); int (*mpo_check_cred_relabel)(struct ucred *cred, struct label *newlabel); int (*mpo_check_cred_visible)(struct ucred *u1, struct ucred *u2); int (*mpo_check_ifnet_relabel)(struct ucred *cred, struct ifnet *ifnet, struct label *ifnetlabel, struct label *newlabel); int (*mpo_check_ifnet_transmit)(struct ifnet *ifnet, struct label *ifnetlabel, struct mbuf *m, struct label *mbuflabel); int (*mpo_check_mount_stat)(struct ucred *cred, struct mount *mp, struct label *mntlabel); int (*mpo_check_pipe_ioctl)(struct ucred *cred, struct pipe *pipe, struct label *pipelabel, unsigned long cmd, void *data); int (*mpo_check_pipe_poll)(struct ucred *cred, struct pipe *pipe, struct label *pipelabel); int (*mpo_check_pipe_read)(struct ucred *cred, struct pipe *pipe, struct label *pipelabel); int (*mpo_check_pipe_relabel)(struct ucred *cred, struct pipe *pipe, struct label *pipelabel, struct label *newlabel); int (*mpo_check_pipe_stat)(struct ucred *cred, struct pipe *pipe, struct label *pipelabel); int (*mpo_check_pipe_write)(struct ucred *cred, struct pipe *pipe, struct label *pipelabel); int (*mpo_check_proc_debug)(struct ucred *cred, struct proc *proc); int (*mpo_check_proc_sched)(struct ucred *cred, struct proc *proc); int (*mpo_check_proc_signal)(struct ucred *cred, struct proc *proc, int signum); int (*mpo_check_socket_bind)(struct ucred *cred, struct socket *so, struct label *socketlabel, struct sockaddr *sockaddr); int (*mpo_check_socket_connect)(struct ucred *cred, struct socket *so, struct label *socketlabel, struct sockaddr *sockaddr); int (*mpo_check_socket_deliver)(struct socket *so, struct label *socketlabel, struct mbuf *m, struct label *mbuflabel); int (*mpo_check_socket_listen)(struct ucred *cred, struct socket *so, struct label *socketlabel); int (*mpo_check_socket_relabel)(struct ucred *cred, struct socket *so, struct label *socketlabel, struct label *newlabel); int (*mpo_check_socket_visible)(struct ucred *cred, struct socket *so, struct label *socketlabel); int (*mpo_check_vnode_access)(struct ucred *cred, struct vnode *vp, struct label *label, int flags); int (*mpo_check_vnode_chdir)(struct ucred *cred, struct vnode *dvp, struct label *dlabel); int (*mpo_check_vnode_chroot)(struct ucred *cred, struct vnode *dvp, struct label *dlabel); int (*mpo_check_vnode_create)(struct ucred *cred, struct vnode *dvp, struct label *dlabel, struct componentname *cnp, struct vattr *vap); int (*mpo_check_vnode_delete)(struct ucred *cred, struct vnode *dvp, struct label *dlabel, struct vnode *vp, void *label, struct componentname *cnp); int (*mpo_check_vnode_deleteacl)(struct ucred *cred, struct vnode *vp, struct label *label, acl_type_t type); int (*mpo_check_vnode_exec)(struct ucred *cred, struct vnode *vp, struct label *label); int (*mpo_check_vnode_getacl)(struct ucred *cred, struct vnode *vp, struct label *label, acl_type_t type); int (*mpo_check_vnode_getextattr)(struct ucred *cred, struct vnode *vp, struct label *label, int attrnamespace, const char *name, struct uio *uio); + int (*mpo_check_vnode_link)(struct ucred *cred, struct vnode *dvp, + struct label *dlabel, struct vnode *vp, + struct label *label, struct componentname *cnp); int (*mpo_check_vnode_lookup)(struct ucred *cred, struct vnode *dvp, struct label *dlabel, struct componentname *cnp); vm_prot_t (*mpo_check_vnode_mmap_perms)(struct ucred *cred, struct vnode *vp, struct label *label, int newmapping); int (*mpo_check_vnode_open)(struct ucred *cred, struct vnode *vp, struct label *label, mode_t acc_mode); int (*mpo_check_vnode_poll)(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp, struct label *label); int (*mpo_check_vnode_read)(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp, struct label *label); int (*mpo_check_vnode_readdir)(struct ucred *cred, struct vnode *dvp, struct label *dlabel); int (*mpo_check_vnode_readlink)(struct ucred *cred, struct vnode *vp, struct label *label); int (*mpo_check_vnode_relabel)(struct ucred *cred, struct vnode *vp, struct label *vnodelabel, struct label *newlabel); int (*mpo_check_vnode_rename_from)(struct ucred *cred, struct vnode *dvp, struct label *dlabel, struct vnode *vp, struct label *label, struct componentname *cnp); int (*mpo_check_vnode_rename_to)(struct ucred *cred, struct vnode *dvp, struct label *dlabel, struct vnode *vp, struct label *label, int samedir, struct componentname *cnp); int (*mpo_check_vnode_revoke)(struct ucred *cred, struct vnode *vp, struct label *label); int (*mpo_check_vnode_setacl)(struct ucred *cred, struct vnode *vp, struct label *label, acl_type_t type, struct acl *acl); int (*mpo_check_vnode_setextattr)(struct ucred *cred, struct vnode *vp, struct label *label, int attrnamespace, const char *name, struct uio *uio); int (*mpo_check_vnode_setflags)(struct ucred *cred, struct vnode *vp, struct label *label, u_long flags); int (*mpo_check_vnode_setmode)(struct ucred *cred, struct vnode *vp, struct label *label, mode_t mode); int (*mpo_check_vnode_setowner)(struct ucred *cred, struct vnode *vp, struct label *label, uid_t uid, gid_t gid); int (*mpo_check_vnode_setutimes)(struct ucred *cred, struct vnode *vp, struct label *label, struct timespec atime, struct timespec mtime); int (*mpo_check_vnode_stat)(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp, struct label *label); int (*mpo_check_vnode_write)(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp, struct label *label); }; typedef const void *macop_t; enum mac_op_constant { MAC_OP_LAST, MAC_DESTROY, MAC_INIT, MAC_SYSCALL, MAC_INIT_BPFDESC_LABEL, MAC_INIT_CRED_LABEL, MAC_INIT_DEVFSDIRENT_LABEL, MAC_INIT_IFNET_LABEL, MAC_INIT_IPQ_LABEL, MAC_INIT_MBUF_LABEL, MAC_INIT_MOUNT_LABEL, MAC_INIT_MOUNT_FS_LABEL, MAC_INIT_PIPE_LABEL, MAC_INIT_SOCKET_LABEL, MAC_INIT_SOCKET_PEER_LABEL, MAC_INIT_TEMP_LABEL, MAC_INIT_VNODE_LABEL, MAC_DESTROY_BPFDESC_LABEL, MAC_DESTROY_CRED_LABEL, MAC_DESTROY_DEVFSDIRENT_LABEL, MAC_DESTROY_IFNET_LABEL, MAC_DESTROY_IPQ_LABEL, MAC_DESTROY_MBUF_LABEL, MAC_DESTROY_MOUNT_LABEL, MAC_DESTROY_MOUNT_FS_LABEL, MAC_DESTROY_PIPE_LABEL, MAC_DESTROY_SOCKET_LABEL, MAC_DESTROY_SOCKET_PEER_LABEL, MAC_DESTROY_TEMP_LABEL, MAC_DESTROY_VNODE_LABEL, MAC_EXTERNALIZE, MAC_INTERNALIZE, MAC_CREATE_DEVFS_DEVICE, MAC_CREATE_DEVFS_DIRECTORY, MAC_CREATE_DEVFS_VNODE, MAC_CREATE_VNODE, MAC_CREATE_MOUNT, MAC_CREATE_ROOT_MOUNT, MAC_RELABEL_VNODE, MAC_STDCREATEVNODE_EA, MAC_UPDATE_DEVFSDIRENT, MAC_UPDATE_PROCFSVNODE, MAC_UPDATE_VNODE_FROM_EXTATTR, MAC_UPDATE_VNODE_FROM_EXTERNALIZED, MAC_UPDATE_VNODE_FROM_MOUNT, MAC_CREATE_MBUF_FROM_SOCKET, MAC_CREATE_PIPE, MAC_CREATE_SOCKET, MAC_CREATE_SOCKET_FROM_SOCKET, MAC_RELABEL_PIPE, MAC_RELABEL_SOCKET, MAC_SET_SOCKET_PEER_FROM_MBUF, MAC_SET_SOCKET_PEER_FROM_SOCKET, MAC_CREATE_BPFDESC, MAC_CREATE_DATAGRAM_FROM_IPQ, MAC_CREATE_IFNET, MAC_CREATE_IPQ, MAC_CREATE_FRAGMENT, MAC_CREATE_MBUF_FROM_MBUF, MAC_CREATE_MBUF_LINKLAYER, MAC_CREATE_MBUF_FROM_BPFDESC, MAC_CREATE_MBUF_FROM_IFNET, MAC_CREATE_MBUF_MULTICAST_ENCAP, MAC_CREATE_MBUF_NETLAYER, MAC_FRAGMENT_MATCH, MAC_RELABEL_IFNET, MAC_UPDATE_IPQ, MAC_CREATE_CRED, MAC_EXECVE_TRANSITION, MAC_EXECVE_WILL_TRANSITION, MAC_CREATE_PROC0, MAC_CREATE_PROC1, MAC_RELABEL_CRED, MAC_THREAD_USERRET, MAC_CHECK_BPFDESC_RECEIVE, MAC_CHECK_CRED_RELABEL, MAC_CHECK_CRED_VISIBLE, MAC_CHECK_IFNET_RELABEL, MAC_CHECK_IFNET_TRANSMIT, MAC_CHECK_MOUNT_STAT, MAC_CHECK_PIPE_IOCTL, MAC_CHECK_PIPE_POLL, MAC_CHECK_PIPE_READ, MAC_CHECK_PIPE_RELABEL, MAC_CHECK_PIPE_STAT, MAC_CHECK_PIPE_WRITE, MAC_CHECK_PROC_DEBUG, MAC_CHECK_PROC_SCHED, MAC_CHECK_PROC_SIGNAL, MAC_CHECK_SOCKET_BIND, MAC_CHECK_SOCKET_CONNECT, MAC_CHECK_SOCKET_DELIVER, MAC_CHECK_SOCKET_LISTEN, MAC_CHECK_SOCKET_RELABEL, MAC_CHECK_SOCKET_VISIBLE, MAC_CHECK_VNODE_ACCESS, MAC_CHECK_VNODE_CHDIR, MAC_CHECK_VNODE_CHROOT, MAC_CHECK_VNODE_CREATE, MAC_CHECK_VNODE_DELETE, MAC_CHECK_VNODE_DELETEACL, MAC_CHECK_VNODE_EXEC, MAC_CHECK_VNODE_GETACL, MAC_CHECK_VNODE_GETEXTATTR, + MAC_CHECK_VNODE_LINK, MAC_CHECK_VNODE_LOOKUP, MAC_CHECK_VNODE_MMAP_PERMS, MAC_CHECK_VNODE_OPEN, MAC_CHECK_VNODE_POLL, MAC_CHECK_VNODE_READ, MAC_CHECK_VNODE_READDIR, MAC_CHECK_VNODE_READLINK, MAC_CHECK_VNODE_RELABEL, MAC_CHECK_VNODE_RENAME_FROM, MAC_CHECK_VNODE_RENAME_TO, MAC_CHECK_VNODE_REVOKE, MAC_CHECK_VNODE_SETACL, MAC_CHECK_VNODE_SETEXTATTR, MAC_CHECK_VNODE_SETFLAGS, MAC_CHECK_VNODE_SETMODE, MAC_CHECK_VNODE_SETOWNER, MAC_CHECK_VNODE_SETUTIMES, MAC_CHECK_VNODE_STAT, MAC_CHECK_VNODE_WRITE, }; struct mac_policy_op_entry { enum mac_op_constant mpe_constant; /* what this hook implements */ macop_t mpe_function; /* hook's implementation */ }; struct mac_policy_conf { char *mpc_name; /* policy name */ char *mpc_fullname; /* policy full name */ struct mac_policy_ops *mpc_ops; /* policy operations */ struct mac_policy_op_entry *mpc_entries; /* ops to fill in */ int mpc_loadtime_flags; /* flags */ int *mpc_field_off; /* security field */ int mpc_runtime_flags; /* flags */ LIST_ENTRY(mac_policy_conf) mpc_list; /* global list */ }; /* Flags for the mpc_loadtime_flags field. */ #define MPC_LOADTIME_FLAG_NOTLATE 0x00000001 #define MPC_LOADTIME_FLAG_UNLOADOK 0x00000002 /* Flags for the mpc_runtime_flags field. */ #define MPC_RUNTIME_FLAG_REGISTERED 0x00000001 #define MAC_POLICY_SET(mpents, mpname, mpfullname, mpflags, privdata_wanted) \ static struct mac_policy_conf mpname##_mac_policy_conf = { \ #mpname, \ mpfullname, \ NULL, \ mpents, \ mpflags, \ privdata_wanted, \ 0, \ }; \ static moduledata_t mpname##_mod = { \ #mpname, \ mac_policy_modevent, \ &mpname##_mac_policy_conf \ }; \ MODULE_DEPEND(mpname, kernel_mac_support, 1, 1, 1); \ DECLARE_MODULE(mpname, mpname##_mod, SI_SUB_MAC_POLICY, \ SI_ORDER_MIDDLE) int mac_policy_modevent(module_t mod, int type, void *data); #define LABEL_TO_SLOT(l, s) (l)->l_perpolicy[s] #endif /* !_SYS_MAC_POLICY_H */