[apple/xnu.git] / security / mac_socket.c

/*
 * Copyright (c) 2007-2012 Apple Inc. All rights reserved.
 *
 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
 * 
 * This file contains Original Code and/or Modifications of Original Code
 * as defined in and that are subject to the Apple Public Source License
 * Version 2.0 (the 'License'). You may not use this file except in
 * compliance with the License. The rights granted to you under the License
 * may not be used to create, or enable the creation or redistribution of,
 * unlawful or unlicensed copies of an Apple operating system, or to
 * circumvent, violate, or enable the circumvention or violation of, any
 * terms of an Apple operating system software license agreement.
 * 
 * Please obtain a copy of the License at
 * http://www.opensource.apple.com/apsl/ and read it before using this file.
 * 
 * The Original Code and all software distributed under the License are
 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
 * Please see the License for the specific language governing rights and
 * limitations under the License.
 * 
 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
 */
/*-
 * Copyright (c) 1999-2002 Robert N. M. Watson
 * Copyright (c) 2001 Ilmar S. Habibulin
 * Copyright (c) 2001-2005 Networks Associates Technology, Inc.
 * Copyright (c) 2005 SPARTA, Inc.
 * All rights reserved.
 *
 * This software was developed by Robert Watson and Ilmar Habibulin for the
 * TrustedBSD Project.
 *
 * This software was developed for the FreeBSD Project in part by McAfee
 * Research, the Technology Research Division of Network Associates, Inc.
 * under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the
 * DARPA CHATS research program.
 * 
 * This software was enhanced by SPARTA ISSO under SPAWAR contract
 * N66001-04-C-6019 ("SEFOS").
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 */

#include <sys/cdefs.h>

#include <sys/param.h>
#include <sys/kernel.h>
#include <sys/lock.h>
#include <sys/malloc.h>
#include <sys/sbuf.h>
#include <sys/systm.h>
#include <sys/mount.h>
#include <sys/file.h>
#include <sys/namei.h>
#include <sys/protosw.h>
#include <sys/socket.h>
#include <sys/socketvar.h>
#include <sys/sysctl.h>
#include <sys/kpi_socket.h>

#include <security/mac_internal.h>

#if CONFIG_MACF_SOCKET
struct label *
mac_socket_label_alloc(int flag)
{
	struct label *label;
	int error;

	label = mac_labelzone_alloc(flag);
	if (label == NULL)
		return (NULL);

	MAC_CHECK(socket_label_init, label, flag);
	if (error) {
		MAC_PERFORM(socket_label_destroy, label);
		mac_labelzone_free(label);
		return (NULL);
	}

	return (label);
}

static struct label *
mac_socket_peer_label_alloc(int flag)
{
	struct label *label;
	int error;

	label = mac_labelzone_alloc(flag);
	if (label == NULL)
		return (NULL);

	MAC_CHECK(socketpeer_label_init, label, flag);
	if (error) {
		MAC_PERFORM(socketpeer_label_destroy, label);
		mac_labelzone_free(label);
		return (NULL);
	}

	return (label);
}

int
mac_socket_label_init(struct socket *so, int flag)
{

	so->so_label = mac_socket_label_alloc(flag);
	if (so->so_label == NULL)
		return (ENOMEM);
	so->so_peerlabel = mac_socket_peer_label_alloc(flag);
	if (so->so_peerlabel == NULL) {
		mac_socket_label_free(so->so_label);
		so->so_label = NULL;
		return (ENOMEM);
	}
	return (0);
}

void
mac_socket_label_free(struct label *label)
{

	MAC_PERFORM(socket_label_destroy, label);
	mac_labelzone_free(label);
}

static void
mac_socket_peer_label_free(struct label *label)
{

	MAC_PERFORM(socketpeer_label_destroy, label);
	mac_labelzone_free(label);
}

void
mac_socket_label_destroy(struct socket *so)
{

	if (so->so_label != NULL) {
		mac_socket_label_free(so->so_label);
		so->so_label = NULL;
	}
	if (so->so_peerlabel != NULL) {
		mac_socket_peer_label_free(so->so_peerlabel);
		so->so_peerlabel = NULL;
	}
}

void
mac_socket_label_copy(struct label *src, struct label *dest)
{

	MAC_PERFORM(socket_label_copy, src, dest);
}

int
mac_socket_label_externalize(struct label *label, char *elements,
    char *outbuf, size_t outbuflen)
{
	int error;

	error = MAC_EXTERNALIZE(socket, label, elements, outbuf, outbuflen);

	return (error);
}

static int
mac_socketpeer_label_externalize(struct label *label, char *elements,
    char *outbuf, size_t outbuflen)
{
	int error;

	error = MAC_EXTERNALIZE(socketpeer, label, elements, outbuf, outbuflen);

	return (error);
}

int
mac_socket_label_internalize(struct label *label, char *string)
{
	int error;

	error = MAC_INTERNALIZE(socket, label, string);

	return (error);
}

void
mac_socket_label_associate(struct ucred *cred, struct socket *so)
{
#if SECURITY_MAC_CHECK_ENFORCE
    /* 21167099 - only check if we allow write */
    if (!mac_socket_enforce)
        return;
#endif

	MAC_PERFORM(socket_label_associate, cred, 
		    (socket_t)so, so->so_label);
}

void
mac_socket_label_associate_accept(struct socket *oldsocket,
    struct socket *newsocket)
{
#if SECURITY_MAC_CHECK_ENFORCE
    /* 21167099 - only check if we allow write */
    if (!mac_socket_enforce)
        return;
#endif

	MAC_PERFORM(socket_label_associate_accept, 
		    (socket_t)oldsocket, oldsocket->so_label,
		    (socket_t)newsocket, newsocket->so_label);
}

#if CONFIG_MACF_SOCKET && CONFIG_MACF_NET
void
mac_socketpeer_label_associate_mbuf(struct mbuf *mbuf, struct socket *so)
{
	struct label *label;

#if SECURITY_MAC_CHECK_ENFORCE
    /* 21167099 - only check if we allow write */
    if (!mac_socket_enforce && !mac_net_enforce)
        return;
#endif

	label = mac_mbuf_to_label(mbuf);

	/* Policy must deal with NULL label (unlabeled mbufs) */
	MAC_PERFORM(socketpeer_label_associate_mbuf, mbuf, label,
		    (socket_t)so, so->so_peerlabel);
}
#else
void
mac_socketpeer_label_associate_mbuf(__unused struct mbuf *mbuf, 
	__unused struct socket *so)
{
	return;
}
#endif

void
mac_socketpeer_label_associate_socket(struct socket *oldsocket,
    struct socket *newsocket)
{
#if SECURITY_MAC_CHECK_ENFORCE
    /* 21167099 - only check if we allow write */
    if (!mac_socket_enforce)
        return;
#endif

	MAC_PERFORM(socketpeer_label_associate_socket,
		    (socket_t)oldsocket, oldsocket->so_label,
		    (socket_t)newsocket, newsocket->so_peerlabel);
}

int
mac_socket_check_kqfilter(kauth_cred_t cred, struct knote *kn,
			  struct socket *so)
{
	int error;

#if SECURITY_MAC_CHECK_ENFORCE
    /* 21167099 - only check if we allow write */
    if (!mac_socket_enforce)
        return 0;
#endif

	MAC_CHECK(socket_check_kqfilter, cred, kn, 
		  (socket_t)so, so->so_label);
	return (error);
}

static int
int
mac_socket_check_select(kauth_cred_t cred, struct socket *so, int which)
{
	int error;

#if SECURITY_MAC_CHECK_ENFORCE
    /* 21167099 - only check if we allow write */
    if (!mac_socket_enforce)
        return 0;
#endif

	MAC_CHECK(socket_check_select, cred,
		  (socket_t)so, so->so_label, which);
	return (error);
}

mac_socket_check_label_update(kauth_cred_t cred, struct socket *so,
    struct label *newlabel)
{
	int error;

#if SECURITY_MAC_CHECK_ENFORCE
    /* 21167099 - only check if we allow write */
    if (!mac_socket_enforce)
        return 0;
#endif

	MAC_CHECK(socket_check_label_update, cred,
		  (socket_t)so, so->so_label,
		  newlabel);
	return (error);
}

int
mac_socket_label_update(kauth_cred_t cred, struct socket *so, struct label *label)
{
	int error;
#if 0
#if SECURITY_MAC_CHECK_ENFORCE
    /* 21167099 - only check if we allow write */
    if (!mac_socket_enforce)
        return 0;
#endif
#endif
	error = mac_socket_check_label_update(cred, so, label);
	if (error)
		return (error);

	MAC_PERFORM(socket_label_update, cred,
		    (socket_t)so, so->so_label, label);

#if CONFIG_MACF_NET
	/*
	 * If the protocol has expressed interest in socket layer changes,
	 * such as if it needs to propagate changes to a cached pcb
	 * label from the socket, notify it of the label change while
	 * holding the socket lock.
	 * XXXMAC - are there cases when we should not do this?
	 */
	mac_inpcb_label_update(so);
#endif
	return (0);
}

int
mac_setsockopt_label(kauth_cred_t cred, struct socket *so, struct mac *mac)
{
	struct label *intlabel;
	char *buffer;
	int error;
	size_t len;

	error = mac_check_structmac_consistent(mac);
	if (error)
		return (error);

	MALLOC(buffer, char *, mac->m_buflen, M_MACTEMP, M_WAITOK);
	error = copyinstr(CAST_USER_ADDR_T(mac->m_string), buffer,
		mac->m_buflen, &len);
	if (error) {
		FREE(buffer, M_MACTEMP);
		return (error);
	}

	intlabel = mac_socket_label_alloc(MAC_WAITOK);
	error = mac_socket_label_internalize(intlabel, buffer);
	FREE(buffer, M_MACTEMP);
	if (error)
		goto out;

	error = mac_socket_label_update(cred, so, intlabel);
out:
	mac_socket_label_free(intlabel);
	return (error);
}

int
mac_socket_label_get(__unused kauth_cred_t cred, struct socket *so,
    struct mac *mac)
{
	char *buffer, *elements;
	struct label *intlabel;
	int error;
	size_t len;

	error = mac_check_structmac_consistent(mac);
	if (error)
		return (error);

	MALLOC(elements, char *, mac->m_buflen, M_MACTEMP, M_WAITOK);
	error = copyinstr(CAST_USER_ADDR_T(mac->m_string), elements,
		mac->m_buflen, &len);
	if (error) {
		FREE(elements, M_MACTEMP);
		return (error);
	}

	MALLOC(buffer, char *, mac->m_buflen, M_MACTEMP, M_WAITOK | M_ZERO);
	intlabel = mac_socket_label_alloc(MAC_WAITOK);
	mac_socket_label_copy(so->so_label, intlabel);
	error = mac_socket_label_externalize(intlabel, elements, buffer,
	    mac->m_buflen);
	mac_socket_label_free(intlabel);
	if (error == 0)
		error = copyout(buffer, CAST_USER_ADDR_T(mac->m_string),
			strlen(buffer)+1);

	FREE(buffer, M_MACTEMP);
	FREE(elements, M_MACTEMP);

	return (error);
}

int
mac_socketpeer_label_get(__unused kauth_cred_t cred, struct socket *so,
    struct mac *mac)
{
	char *elements, *buffer;
	struct label *intlabel;
	int error;
	size_t len;

	error = mac_check_structmac_consistent(mac);
	if (error)
		return (error);

	MALLOC(elements, char *, mac->m_buflen, M_MACTEMP, M_WAITOK);
	error = copyinstr(CAST_USER_ADDR_T(mac->m_string), elements,
		mac->m_buflen, &len);
	if (error) {
		FREE(elements, M_MACTEMP);
		return (error);
	}

	MALLOC(buffer, char *, mac->m_buflen, M_MACTEMP, M_WAITOK | M_ZERO);
	intlabel = mac_socket_label_alloc(MAC_WAITOK);
	mac_socket_label_copy(so->so_peerlabel, intlabel);
	error = mac_socketpeer_label_externalize(intlabel, elements, buffer,
	    mac->m_buflen);
	mac_socket_label_free(intlabel);
	if (error == 0)
		error = copyout(buffer, CAST_USER_ADDR_T(mac->m_string),
				strlen(buffer)+1);

	FREE(buffer, M_MACTEMP);
	FREE(elements, M_MACTEMP);

	return (error);
}

#endif /* MAC_SOCKET */

int
mac_socket_check_accept(kauth_cred_t cred, struct socket *so)
{
	int error;

#if SECURITY_MAC_CHECK_ENFORCE
    /* 21167099 - only check if we allow write */
    if (!mac_socket_enforce)
        return 0;
#endif

	MAC_CHECK(socket_check_accept, cred,
		  (socket_t)so, so->so_label);
	return (error);
}

#if CONFIG_MACF_SOCKET_SUBSET
int
mac_socket_check_accepted(kauth_cred_t cred, struct socket *so)
{
	struct sockaddr *sockaddr;
	int error;

#if SECURITY_MAC_CHECK_ENFORCE
    /* 21167099 - only check if we allow write */
    if (!mac_socket_enforce)
        return 0;
#endif

	if (sock_getaddr((socket_t)so, &sockaddr, 1) != 0) {
		error = ECONNABORTED;
	} else {
		MAC_CHECK(socket_check_accepted, cred,
			  (socket_t)so, so->so_label, sockaddr);
		sock_freeaddr(sockaddr);
	}
	return (error);
}
#endif

int
mac_socket_check_bind(kauth_cred_t ucred, struct socket *so,
    struct sockaddr *sockaddr)
{
	int error;

#if SECURITY_MAC_CHECK_ENFORCE
    /* 21167099 - only check if we allow write */
    if (!mac_socket_enforce)
        return 0;
#endif

	MAC_CHECK(socket_check_bind, ucred,
		  (socket_t)so, so->so_label, sockaddr);
	return (error);
}

int
mac_socket_check_connect(kauth_cred_t cred, struct socket *so,
    struct sockaddr *sockaddr)
{
	int error;

#if SECURITY_MAC_CHECK_ENFORCE
    /* 21167099 - only check if we allow write */
    if (!mac_socket_enforce)
        return 0;
#endif

	MAC_CHECK(socket_check_connect, cred,
		  (socket_t)so, so->so_label,
		  sockaddr);
	return (error);
}

int
mac_socket_check_create(kauth_cred_t cred, int domain, int type, int protocol)
{
	int error;

#if SECURITY_MAC_CHECK_ENFORCE
    /* 21167099 - only check if we allow write */
    if (!mac_socket_enforce)
        return 0;
#endif

	MAC_CHECK(socket_check_create, cred, domain, type, protocol);
	return (error);
}

#if CONFIG_MACF_SOCKET && CONFIG_MACF_NET
int
mac_socket_check_deliver(struct socket *so, struct mbuf *mbuf)
{
	struct label *label;
	int error;

#if SECURITY_MAC_CHECK_ENFORCE
    /* 21167099 - only check if we allow write */
    if (!mac_socket_enforce)
        return 0;
#endif

	label = mac_mbuf_to_label(mbuf);

	/* Policy must deal with NULL label (unlabeled mbufs) */
	MAC_CHECK(socket_check_deliver,
		  (socket_t)so, so->so_label, mbuf, label);
	return (error);
}
#else
int
mac_socket_check_deliver(__unused struct socket *so, __unused struct mbuf *mbuf)
{
	return (0);
}
#endif

int
mac_socket_check_ioctl(kauth_cred_t cred, struct socket *so,
		       unsigned int cmd)
{
	int error;

#if SECURITY_MAC_CHECK_ENFORCE
	/* 21167099 - only check if we allow write */
	if (!mac_socket_enforce)
		return 0;
#endif

	MAC_CHECK(socket_check_ioctl, cred,
		  (socket_t)so, cmd, so->so_label);
	return (error);
}

int
mac_socket_check_stat(kauth_cred_t cred, struct socket *so)
{
	int error;

#if SECURITY_MAC_CHECK_ENFORCE
    /* 21167099 - only check if we allow write */
    if (!mac_socket_enforce)
        return 0;
#endif

	MAC_CHECK(socket_check_stat, cred,
		  (socket_t)so, so->so_label);
	return (error);
}

int
mac_socket_check_listen(kauth_cred_t cred, struct socket *so)
{
	int error;

#if SECURITY_MAC_CHECK_ENFORCE
    /* 21167099 - only check if we allow write */
    if (!mac_socket_enforce)
        return 0;
#endif

	MAC_CHECK(socket_check_listen, cred,
		  (socket_t)so, so->so_label);
	return (error);
}

int
mac_socket_check_receive(kauth_cred_t cred, struct socket *so)
{
	int error;

#if SECURITY_MAC_CHECK_ENFORCE
    /* 21167099 - only check if we allow write */
    if (!mac_socket_enforce)
        return 0;
#endif

	MAC_CHECK(socket_check_receive, cred,
		  (socket_t)so, so->so_label);
	return (error);
}

int
mac_socket_check_received(kauth_cred_t cred, struct socket *so, struct sockaddr *saddr)
{
	int error;

#if SECURITY_MAC_CHECK_ENFORCE
    /* 21167099 - only check if we allow write */
    if (!mac_socket_enforce)
        return 0;
#endif
	
	MAC_CHECK(socket_check_received, cred,
		  so, so->so_label, saddr);
	return (error);
}

int
mac_socket_check_send(kauth_cred_t cred, struct socket *so,
		      struct sockaddr *sockaddr)
{
	int error;

#if SECURITY_MAC_CHECK_ENFORCE
    /* 21167099 - only check if we allow write */
    if (!mac_socket_enforce)
        return 0;
#endif

	MAC_CHECK(socket_check_send, cred,
		  (socket_t)so, so->so_label, sockaddr);
	return (error);
}

int
mac_socket_check_setsockopt(kauth_cred_t cred, struct socket *so,
			    struct sockopt *sopt)
{
	int error;

#if SECURITY_MAC_CHECK_ENFORCE
    /* 21167099 - only check if we allow write */
    if (!mac_socket_enforce)
        return 0;
#endif

	MAC_CHECK(socket_check_setsockopt, cred,
		  (socket_t)so, so->so_label, sopt);
	return (error);
}

int mac_socket_check_getsockopt(kauth_cred_t cred, struct socket *so,
				struct sockopt *sopt)
{
	int error;

#if SECURITY_MAC_CHECK_ENFORCE
    /* 21167099 - only check if we allow write */
    if (!mac_socket_enforce)
        return 0;
#endif

	MAC_CHECK(socket_check_getsockopt, cred,
		  (socket_t)so, so->so_label, sopt);
	return (error);
}
Commit	Line	Data
2d21ac55	1	/*
316670eb	2	* Copyright (c) 2007-2012 Apple Inc. All rights reserved.
2d21ac55 A	3	*
	4	* @APPLE_OSREFERENCE_LICENSE_HEADER_START@
	5	*
	6	* This file contains Original Code and/or Modifications of Original Code
	7	* as defined in and that are subject to the Apple Public Source License
	8	* Version 2.0 (the 'License'). You may not use this file except in
	9	* compliance with the License. The rights granted to you under the License
	10	* may not be used to create, or enable the creation or redistribution of,
	11	* unlawful or unlicensed copies of an Apple operating system, or to
	12	* circumvent, violate, or enable the circumvention or violation of, any
	13	* terms of an Apple operating system software license agreement.
	14	*
	15	* Please obtain a copy of the License at
	16	* http://www.opensource.apple.com/apsl/ and read it before using this file.
	17	*
	18	* The Original Code and all software distributed under the License are
	19	* distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
	20	* EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
	21	* INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
	22	* FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
	23	* Please see the License for the specific language governing rights and
	24	* limitations under the License.
	25	*
	26	* @APPLE_OSREFERENCE_LICENSE_HEADER_END@
	27	*/
	28	/*-
	29	* Copyright (c) 1999-2002 Robert N. M. Watson
	30	* Copyright (c) 2001 Ilmar S. Habibulin
	31	* Copyright (c) 2001-2005 Networks Associates Technology, Inc.
	32	* Copyright (c) 2005 SPARTA, Inc.
	33	* All rights reserved.
	34	*
	35	* This software was developed by Robert Watson and Ilmar Habibulin for the
	36	* TrustedBSD Project.
	37	*
	38	* This software was developed for the FreeBSD Project in part by McAfee
	39	* Research, the Technology Research Division of Network Associates, Inc.
	40	* under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the
	41	* DARPA CHATS research program.
	42	*
	43	* This software was enhanced by SPARTA ISSO under SPAWAR contract
	44	* N66001-04-C-6019 ("SEFOS").
	45	*
	46	* Redistribution and use in source and binary forms, with or without
	47	* modification, are permitted provided that the following conditions
	48	* are met:
	49	* 1. Redistributions of source code must retain the above copyright
	50	* notice, this list of conditions and the following disclaimer.
	51	* 2. Redistributions in binary form must reproduce the above copyright
	52	* notice, this list of conditions and the following disclaimer in the
	53	* documentation and/or other materials provided with the distribution.
	54	*
	55	* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
	56	* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	57	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
	58	* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
	59	* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
	60	* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
	61	* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
	62	* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
	63	* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
	64	* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
	65	* SUCH DAMAGE.
	66	*/
67
68	#include <sys/cdefs.h>
69
70	#include <sys/param.h>
71	#include <sys/kernel.h>
72	#include <sys/lock.h>
73	#include <sys/malloc.h>
74	#include <sys/sbuf.h>
75	#include <sys/systm.h>
76	#include <sys/mount.h>
77	#include <sys/file.h>
78	#include <sys/namei.h>
79	#include <sys/protosw.h>
80	#include <sys/socket.h>
81	#include <sys/socketvar.h>
82	#include <sys/sysctl.h>
83	#include <sys/kpi_socket.h>
84
2d21ac55 A	85	#include <security/mac_internal.h>
	86
	87	#if CONFIG_MACF_SOCKET
	88	struct label *
	89	mac_socket_label_alloc(int flag)
	90	{
	91	struct label *label;
	92	int error;
	93
	94	label = mac_labelzone_alloc(flag);
	95	if (label == NULL)
	96	return (NULL);
	97
	98	MAC_CHECK(socket_label_init, label, flag);
	99	if (error) {
	100	MAC_PERFORM(socket_label_destroy, label);
	101	mac_labelzone_free(label);
	102	return (NULL);
	103	}
	104
	105	return (label);
	106	}
	107
	108	static struct label *
	109	mac_socket_peer_label_alloc(int flag)
	110	{
	111	struct label *label;
	112	int error;
	113
	114	label = mac_labelzone_alloc(flag);
	115	if (label == NULL)
	116	return (NULL);
	117
	118	MAC_CHECK(socketpeer_label_init, label, flag);
	119	if (error) {
	120	MAC_PERFORM(socketpeer_label_destroy, label);
	121	mac_labelzone_free(label);
	122	return (NULL);
	123	}
	124
	125	return (label);
	126	}
	127
	128	int
	129	mac_socket_label_init(struct socket *so, int flag)
	130	{
	131
	132	so->so_label = mac_socket_label_alloc(flag);
	133	if (so->so_label == NULL)
	134	return (ENOMEM);
	135	so->so_peerlabel = mac_socket_peer_label_alloc(flag);
	136	if (so->so_peerlabel == NULL) {
	137	mac_socket_label_free(so->so_label);
	138	so->so_label = NULL;
	139	return (ENOMEM);
	140	}
	141	return (0);
	142	}
	143
	144	void
	145	mac_socket_label_free(struct label *label)
	146	{
	147
	148	MAC_PERFORM(socket_label_destroy, label);
149	mac_labelzone_free(label);
150	}
151
152	static void
153	mac_socket_peer_label_free(struct label *label)
154	{
155
156	MAC_PERFORM(socketpeer_label_destroy, label);
157	mac_labelzone_free(label);
158	}
159
160	void
161	mac_socket_label_destroy(struct socket *so)
162	{
163
164	if (so->so_label != NULL) {
165	mac_socket_label_free(so->so_label);
166	so->so_label = NULL;
167	}
168	if (so->so_peerlabel != NULL) {
169	mac_socket_peer_label_free(so->so_peerlabel);
170	so->so_peerlabel = NULL;
171	}
172	}
173
174	void
175	mac_socket_label_copy(struct label src, struct label dest)
176	{
177
178	MAC_PERFORM(socket_label_copy, src, dest);
179	}
180
181	int
182	mac_socket_label_externalize(struct label label, char elements,
183	char *outbuf, size_t outbuflen)
184	{
185	int error;
186
187	error = MAC_EXTERNALIZE(socket, label, elements, outbuf, outbuflen);
188
189	return (error);
190	}
191
192	static int
193	mac_socketpeer_label_externalize(struct label label, char elements,
194	char *outbuf, size_t outbuflen)
195	{
196	int error;
197
198	error = MAC_EXTERNALIZE(socketpeer, label, elements, outbuf, outbuflen);
199
200	return (error);
201	}
202
203	int
204	mac_socket_label_internalize(struct label label, char string)
205	{
206	int error;
207
208	error = MAC_INTERNALIZE(socket, label, string);
209
210	return (error);
211	}
212
213	void
214	mac_socket_label_associate(struct ucred cred, struct socket so)
215	{
3e170ce0 A	216	#if SECURITY_MAC_CHECK_ENFORCE
	217	/* 21167099 - only check if we allow write */
	218	if (!mac_socket_enforce)
	219	return;
	220	#endif
2d21ac55 A	221
	222	MAC_PERFORM(socket_label_associate, cred,
	223	(socket_t)so, so->so_label);
	224	}
	225
	226	void
	227	mac_socket_label_associate_accept(struct socket *oldsocket,
	228	struct socket *newsocket)
	229	{
3e170ce0 A	230	#if SECURITY_MAC_CHECK_ENFORCE
	231	/* 21167099 - only check if we allow write */
	232	if (!mac_socket_enforce)
	233	return;
	234	#endif
2d21ac55 A	235
	236	MAC_PERFORM(socket_label_associate_accept,
	237	(socket_t)oldsocket, oldsocket->so_label,
	238	(socket_t)newsocket, newsocket->so_label);
	239	}
	240
	241	#if CONFIG_MACF_SOCKET && CONFIG_MACF_NET
	242	void
	243	mac_socketpeer_label_associate_mbuf(struct mbuf mbuf, struct socket so)
	244	{
	245	struct label *label;
	246
3e170ce0 A	247	#if SECURITY_MAC_CHECK_ENFORCE
	248	/* 21167099 - only check if we allow write */
	249	if (!mac_socket_enforce && !mac_net_enforce)
	250	return;
	251	#endif
2d21ac55 A	252
	253	label = mac_mbuf_to_label(mbuf);
	254
	255	/* Policy must deal with NULL label (unlabeled mbufs) */
	256	MAC_PERFORM(socketpeer_label_associate_mbuf, mbuf, label,
	257	(socket_t)so, so->so_peerlabel);
	258	}
	259	#else
	260	void
	261	mac_socketpeer_label_associate_mbuf(__unused struct mbuf *mbuf,
	262	__unused struct socket *so)
	263	{
	264	return;
	265	}
	266	#endif
	267
	268	void
	269	mac_socketpeer_label_associate_socket(struct socket *oldsocket,
	270	struct socket *newsocket)
	271	{
3e170ce0 A	272	#if SECURITY_MAC_CHECK_ENFORCE
	273	/* 21167099 - only check if we allow write */
	274	if (!mac_socket_enforce)
	275	return;
	276	#endif
2d21ac55 A	277
	278	MAC_PERFORM(socketpeer_label_associate_socket,
	279	(socket_t)oldsocket, oldsocket->so_label,
	280	(socket_t)newsocket, newsocket->so_peerlabel);
	281	}
	282
	283	int
	284	mac_socket_check_kqfilter(kauth_cred_t cred, struct knote *kn,
	285	struct socket *so)
	286	{
	287	int error;
	288
3e170ce0 A	289	#if SECURITY_MAC_CHECK_ENFORCE
	290	/* 21167099 - only check if we allow write */
	291	if (!mac_socket_enforce)
	292	return 0;
	293	#endif
2d21ac55 A	294
	295	MAC_CHECK(socket_check_kqfilter, cred, kn,
	296	(socket_t)so, so->so_label);
	297	return (error);
	298	}
	299
	300	static int
2d21ac55 A	301	int
	302	mac_socket_check_select(kauth_cred_t cred, struct socket *so, int which)
	303	{
	304	int error;
	305
3e170ce0 A	306	#if SECURITY_MAC_CHECK_ENFORCE
	307	/* 21167099 - only check if we allow write */
	308	if (!mac_socket_enforce)
	309	return 0;
	310	#endif
2d21ac55 A	311
	312	MAC_CHECK(socket_check_select, cred,
	313	(socket_t)so, so->so_label, which);
	314	return (error);
	315	}
	316
5ba3f43e A	317	mac_socket_check_label_update(kauth_cred_t cred, struct socket *so,
5ba3f43e A	318	struct label *newlabel)
2d21ac55 A	319	{
	320	int error;
	321
3e170ce0 A	322	#if SECURITY_MAC_CHECK_ENFORCE
	323	/* 21167099 - only check if we allow write */
	324	if (!mac_socket_enforce)
	325	return 0;
	326	#endif
2d21ac55	327
5ba3f43e A	328	MAC_CHECK(socket_check_label_update, cred,
	329	(socket_t)so, so->so_label,
	330	newlabel);
2d21ac55 A	331	return (error);
	332	}
	333
2d21ac55 A	334	int
	335	mac_socket_label_update(kauth_cred_t cred, struct socket so, struct label label)
	336	{
	337	int error;
	338	#if 0
3e170ce0 A	339	#if SECURITY_MAC_CHECK_ENFORCE
	340	/* 21167099 - only check if we allow write */
	341	if (!mac_socket_enforce)
	342	return 0;
	343	#endif
2d21ac55 A	344	#endif
	345	error = mac_socket_check_label_update(cred, so, label);
	346	if (error)
	347	return (error);
	348
	349	MAC_PERFORM(socket_label_update, cred,
	350	(socket_t)so, so->so_label, label);
	351
	352	#if CONFIG_MACF_NET
	353	/*
	354	* If the protocol has expressed interest in socket layer changes,
	355	* such as if it needs to propagate changes to a cached pcb
	356	* label from the socket, notify it of the label change while
	357	* holding the socket lock.
	358	* XXXMAC - are there cases when we should not do this?
	359	*/
	360	mac_inpcb_label_update(so);
	361	#endif
	362	return (0);
	363	}
	364
	365	int
	366	mac_setsockopt_label(kauth_cred_t cred, struct socket so, struct mac mac)
	367	{
	368	struct label *intlabel;
	369	char *buffer;
	370	int error;
	371	size_t len;
	372
	373	error = mac_check_structmac_consistent(mac);
	374	if (error)
	375	return (error);
	376
	377	MALLOC(buffer, char *, mac->m_buflen, M_MACTEMP, M_WAITOK);
	378	error = copyinstr(CAST_USER_ADDR_T(mac->m_string), buffer,
	379	mac->m_buflen, &len);
	380	if (error) {
	381	FREE(buffer, M_MACTEMP);
	382	return (error);
	383	}
	384
	385	intlabel = mac_socket_label_alloc(MAC_WAITOK);
	386	error = mac_socket_label_internalize(intlabel, buffer);
	387	FREE(buffer, M_MACTEMP);
	388	if (error)
	389	goto out;
	390
	391	error = mac_socket_label_update(cred, so, intlabel);
	392	out:
	393	mac_socket_label_free(intlabel);
	394	return (error);
	395	}
	396
	397	int
	398	mac_socket_label_get(__unused kauth_cred_t cred, struct socket *so,
	399	struct mac *mac)
	400	{
	401	char buffer, elements;
	402	struct label *intlabel;
	403	int error;
	404	size_t len;
	405
	406	error = mac_check_structmac_consistent(mac);
	407	if (error)
408	return (error);
409
410	MALLOC(elements, char *, mac->m_buflen, M_MACTEMP, M_WAITOK);
411	error = copyinstr(CAST_USER_ADDR_T(mac->m_string), elements,
412	mac->m_buflen, &len);
413	if (error) {
414	FREE(elements, M_MACTEMP);
415	return (error);
416	}
417
418	MALLOC(buffer, char *, mac->m_buflen, M_MACTEMP, M_WAITOK \| M_ZERO);
419	intlabel = mac_socket_label_alloc(MAC_WAITOK);
420	mac_socket_label_copy(so->so_label, intlabel);
421	error = mac_socket_label_externalize(intlabel, elements, buffer,
422	mac->m_buflen);
423	mac_socket_label_free(intlabel);
424	if (error == 0)
425	error = copyout(buffer, CAST_USER_ADDR_T(mac->m_string),
426	strlen(buffer)+1);
427
428	FREE(buffer, M_MACTEMP);
429	FREE(elements, M_MACTEMP);
430
431	return (error);
432	}
433
434	int
435	mac_socketpeer_label_get(__unused kauth_cred_t cred, struct socket *so,
436	struct mac *mac)
437	{
438	char elements, buffer;
439	struct label *intlabel;
440	int error;
441	size_t len;
442
443	error = mac_check_structmac_consistent(mac);
444	if (error)
445	return (error);
446
447	MALLOC(elements, char *, mac->m_buflen, M_MACTEMP, M_WAITOK);
448	error = copyinstr(CAST_USER_ADDR_T(mac->m_string), elements,
449	mac->m_buflen, &len);
450	if (error) {
451	FREE(elements, M_MACTEMP);
452	return (error);
453	}
454
455	MALLOC(buffer, char *, mac->m_buflen, M_MACTEMP, M_WAITOK \| M_ZERO);
456	intlabel = mac_socket_label_alloc(MAC_WAITOK);
457	mac_socket_label_copy(so->so_peerlabel, intlabel);
458	error = mac_socketpeer_label_externalize(intlabel, elements, buffer,
459	mac->m_buflen);
460	mac_socket_label_free(intlabel);
461	if (error == 0)
462	error = copyout(buffer, CAST_USER_ADDR_T(mac->m_string),
463	strlen(buffer)+1);
464
465	FREE(buffer, M_MACTEMP);
466	FREE(elements, M_MACTEMP);
467
468	return (error);
469	}
5ba3f43e	470
2d21ac55 A	471	#endif /* MAC_SOCKET */
	472
	473	int
	474	mac_socket_check_accept(kauth_cred_t cred, struct socket *so)
	475	{
	476	int error;
	477
3e170ce0 A	478	#if SECURITY_MAC_CHECK_ENFORCE
	479	/* 21167099 - only check if we allow write */
	480	if (!mac_socket_enforce)
	481	return 0;
	482	#endif
2d21ac55 A	483
	484	MAC_CHECK(socket_check_accept, cred,
	485	(socket_t)so, so->so_label);
	486	return (error);
	487	}
	488
39236c6e	489	#if CONFIG_MACF_SOCKET_SUBSET
2d21ac55 A	490	int
	491	mac_socket_check_accepted(kauth_cred_t cred, struct socket *so)
	492	{
	493	struct sockaddr *sockaddr;
	494	int error;
	495
3e170ce0 A	496	#if SECURITY_MAC_CHECK_ENFORCE
	497	/* 21167099 - only check if we allow write */
	498	if (!mac_socket_enforce)
	499	return 0;
	500	#endif
2d21ac55 A	501
	502	if (sock_getaddr((socket_t)so, &sockaddr, 1) != 0) {
	503	error = ECONNABORTED;
	504	} else {
	505	MAC_CHECK(socket_check_accepted, cred,
	506	(socket_t)so, so->so_label, sockaddr);
	507	sock_freeaddr(sockaddr);
	508	}
	509	return (error);
	510	}
39236c6e	511	#endif
2d21ac55 A	512
	513	int
	514	mac_socket_check_bind(kauth_cred_t ucred, struct socket *so,
	515	struct sockaddr *sockaddr)
	516	{
	517	int error;
	518
3e170ce0 A	519	#if SECURITY_MAC_CHECK_ENFORCE
	520	/* 21167099 - only check if we allow write */
	521	if (!mac_socket_enforce)
	522	return 0;
	523	#endif
2d21ac55 A	524
	525	MAC_CHECK(socket_check_bind, ucred,
	526	(socket_t)so, so->so_label, sockaddr);
	527	return (error);
	528	}
	529
	530	int
	531	mac_socket_check_connect(kauth_cred_t cred, struct socket *so,
	532	struct sockaddr *sockaddr)
	533	{
	534	int error;
	535
3e170ce0 A	536	#if SECURITY_MAC_CHECK_ENFORCE
	537	/* 21167099 - only check if we allow write */
	538	if (!mac_socket_enforce)
	539	return 0;
	540	#endif
2d21ac55 A	541
	542	MAC_CHECK(socket_check_connect, cred,
	543	(socket_t)so, so->so_label,
	544	sockaddr);
	545	return (error);
	546	}
	547
	548	int
	549	mac_socket_check_create(kauth_cred_t cred, int domain, int type, int protocol)
	550	{
	551	int error;
	552
3e170ce0 A	553	#if SECURITY_MAC_CHECK_ENFORCE
	554	/* 21167099 - only check if we allow write */
	555	if (!mac_socket_enforce)
	556	return 0;
	557	#endif
2d21ac55 A	558
	559	MAC_CHECK(socket_check_create, cred, domain, type, protocol);
	560	return (error);
	561	}
	562
	563	#if CONFIG_MACF_SOCKET && CONFIG_MACF_NET
	564	int
	565	mac_socket_check_deliver(struct socket so, struct mbuf mbuf)
	566	{
	567	struct label *label;
	568	int error;
	569
3e170ce0 A	570	#if SECURITY_MAC_CHECK_ENFORCE
	571	/* 21167099 - only check if we allow write */
	572	if (!mac_socket_enforce)
	573	return 0;
	574	#endif
2d21ac55 A	575
	576	label = mac_mbuf_to_label(mbuf);
	577
	578	/* Policy must deal with NULL label (unlabeled mbufs) */
	579	MAC_CHECK(socket_check_deliver,
	580	(socket_t)so, so->so_label, mbuf, label);
	581	return (error);
	582	}
	583	#else
	584	int
	585	mac_socket_check_deliver(__unused struct socket so, __unused struct mbuf mbuf)
	586	{
	587	return (0);
	588	}
	589	#endif
	590
5ba3f43e A	591	int
	592	mac_socket_check_ioctl(kauth_cred_t cred, struct socket *so,
	593	unsigned int cmd)
	594	{
	595	int error;
	596
	597	#if SECURITY_MAC_CHECK_ENFORCE
	598	/* 21167099 - only check if we allow write */
	599	if (!mac_socket_enforce)
	600	return 0;
	601	#endif
	602
	603	MAC_CHECK(socket_check_ioctl, cred,
	604	(socket_t)so, cmd, so->so_label);
	605	return (error);
	606	}
	607
	608	int
	609	mac_socket_check_stat(kauth_cred_t cred, struct socket *so)
	610	{
	611	int error;
	612
	613	#if SECURITY_MAC_CHECK_ENFORCE
	614	/* 21167099 - only check if we allow write */
	615	if (!mac_socket_enforce)
	616	return 0;
	617	#endif
	618
	619	MAC_CHECK(socket_check_stat, cred,
	620	(socket_t)so, so->so_label);
	621	return (error);
	622	}
	623
2d21ac55 A	624	int
	625	mac_socket_check_listen(kauth_cred_t cred, struct socket *so)
	626	{
	627	int error;
	628
3e170ce0 A	629	#if SECURITY_MAC_CHECK_ENFORCE
	630	/* 21167099 - only check if we allow write */
	631	if (!mac_socket_enforce)
	632	return 0;
	633	#endif
2d21ac55 A	634
	635	MAC_CHECK(socket_check_listen, cred,
	636	(socket_t)so, so->so_label);
	637	return (error);
	638	}
	639
	640	int
	641	mac_socket_check_receive(kauth_cred_t cred, struct socket *so)
	642	{
	643	int error;
	644
3e170ce0 A	645	#if SECURITY_MAC_CHECK_ENFORCE
	646	/* 21167099 - only check if we allow write */
	647	if (!mac_socket_enforce)
	648	return 0;
	649	#endif
2d21ac55 A	650
	651	MAC_CHECK(socket_check_receive, cred,
	652	(socket_t)so, so->so_label);
	653	return (error);
	654	}
	655
	656	int
	657	mac_socket_check_received(kauth_cred_t cred, struct socket so, struct sockaddr saddr)
	658	{
	659	int error;
	660
3e170ce0 A	661	#if SECURITY_MAC_CHECK_ENFORCE
	662	/* 21167099 - only check if we allow write */
	663	if (!mac_socket_enforce)
	664	return 0;
	665	#endif
b0d623f7	666
2d21ac55	667	MAC_CHECK(socket_check_received, cred,
b0d623f7	668	so, so->so_label, saddr);
2d21ac55 A	669	return (error);
	670	}
	671
	672	int
	673	mac_socket_check_send(kauth_cred_t cred, struct socket *so,
	674	struct sockaddr *sockaddr)
	675	{
	676	int error;
	677
3e170ce0 A	678	#if SECURITY_MAC_CHECK_ENFORCE
	679	/* 21167099 - only check if we allow write */
	680	if (!mac_socket_enforce)
	681	return 0;
	682	#endif
2d21ac55 A	683
	684	MAC_CHECK(socket_check_send, cred,
	685	(socket_t)so, so->so_label, sockaddr);
	686	return (error);
	687	}
	688
	689	int
	690	mac_socket_check_setsockopt(kauth_cred_t cred, struct socket *so,
	691	struct sockopt *sopt)
	692	{
	693	int error;
	694
3e170ce0 A	695	#if SECURITY_MAC_CHECK_ENFORCE
	696	/* 21167099 - only check if we allow write */
	697	if (!mac_socket_enforce)
	698	return 0;
	699	#endif
2d21ac55 A	700
	701	MAC_CHECK(socket_check_setsockopt, cred,
	702	(socket_t)so, so->so_label, sopt);
	703	return (error);
	704	}
	705
	706	int mac_socket_check_getsockopt(kauth_cred_t cred, struct socket *so,
	707	struct sockopt *sopt)
	708	{
	709	int error;
	710
3e170ce0 A	711	#if SECURITY_MAC_CHECK_ENFORCE
	712	/* 21167099 - only check if we allow write */
	713	if (!mac_socket_enforce)
	714	return 0;
	715	#endif
2d21ac55 A	716
	717	MAC_CHECK(socket_check_getsockopt, cred,
	718	(socket_t)so, so->so_label, sopt);
	719	return (error);
	720	}