]> git.saurik.com Git - apple/xnu.git/blame - security/mac_base.c
xnu-1699.24.23.tar.gz
[apple/xnu.git] / security / mac_base.c
CommitLineData
2d21ac55
A
1/*
2 * Copyright (c) 2007 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28/*-
29 * Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson
30 * Copyright (c) 2001 Ilmar S. Habibulin
31 * Copyright (c) 2001, 2002, 2003, 2004 Networks Associates Technology, Inc.
32 * Copyright (c) 2005-2006 SPARTA, Inc.
33 *
34 * This software was developed by Robert Watson and Ilmar Habibulin for the
35 * TrustedBSD Project.
36 *
37 * This software was developed for the FreeBSD Project in part by Network
38 * Associates Laboratories, the Security Research Division of Network
39 * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"),
40 * as part of the DARPA CHATS research program.
41 *
42 * Redistribution and use in source and binary forms, with or without
43 * modification, are permitted provided that the following conditions
44 * are met:
45 * 1. Redistributions of source code must retain the above copyright
46 * notice, this list of conditions and the following disclaimer.
47 * 2. Redistributions in binary form must reproduce the above copyright
48 * notice, this list of conditions and the following disclaimer in the
49 * documentation and/or other materials provided with the distribution.
50 *
51 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
52 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
53 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
54 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
55 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
56 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
57 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
58 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
59 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
60 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
61 * SUCH DAMAGE.
62 *
63 */
64
65/*-
66 * Framework for extensible kernel access control. This file contains
67 * Kernel and userland interface to the framework, policy registration
68 * and composition. Per-object interfaces, controls, and labeling may be
69 * found in src/sys/mac/. Sample policies may be found in src/sys/mac*.
70 */
71
72#include <stdarg.h>
73#include <string.h>
74#include <security/mac_internal.h>
75#include <security/mac_mach_internal.h>
76#include <sys/param.h>
77#include <sys/vnode.h>
78#include <sys/vnode_internal.h>
79#include <sys/vfs_context.h>
80#include <sys/namei.h>
81#include <bsd/bsm/audit.h>
b0d623f7 82#include <bsd/security/audit/audit.h>
2d21ac55
A
83#include <sys/file.h>
84#include <sys/file_internal.h>
85#include <sys/filedesc.h>
86#include <sys/proc.h>
87#include <sys/proc_internal.h>
88#include <sys/kauth.h>
89#include <sys/sysproto.h>
90
91#include <mach/vm_types.h>
92#include <mach/vm_prot.h>
93
94#include <kern/zalloc.h>
95#include <kern/sched_prim.h>
96#include <osfmk/kern/task.h>
97#include <osfmk/kern/kalloc.h>
2d21ac55
A
98
99#if CONFIG_MACF
100#include <security/mac.h>
101#include <security/mac_policy.h>
102#include <security/mac_framework.h>
103#include <security/mac_internal.h>
104#include <security/mac_mach_internal.h>
105#endif
106
b0d623f7 107
2d21ac55
A
108/*
109 * define MB_DEBUG to display run-time debugging information
110 * #define MB_DEBUG 1
111 */
112
113#ifdef MB_DEBUG
114#define DPRINTF(x) printf x
115#else
116#define MB_DEBUG
117#define DPRINTF(x)
118#endif
119
120#if CONFIG_MACF
121SYSCTL_NODE(, OID_AUTO, security, CTLFLAG_RW|CTLFLAG_LOCKED, 0,
122 "Security Controls");
123SYSCTL_NODE(_security, OID_AUTO, mac, CTLFLAG_RW|CTLFLAG_LOCKED, 0,
124 "TrustedBSD MAC policy controls");
125
126
127
128/*
129 * Declare that the kernel provides MAC support, version 1. This permits
130 * modules to refuse to be loaded if the necessary support isn't present,
131 * even if it's pre-boot.
132 */
133#if 0
134MODULE_VERSION(kernel_mac_support, 1);
135#endif
136
137#if MAC_MAX_SLOTS > 32
138#error "MAC_MAX_SLOTS too large"
139#endif
140
141static unsigned int mac_max_slots = MAC_MAX_SLOTS;
142static unsigned int mac_slot_offsets_free = (1 << MAC_MAX_SLOTS) - 1;
6d2010ae 143SYSCTL_UINT(_security_mac, OID_AUTO, max_slots, CTLFLAG_RD | CTLFLAG_LOCKED,
2d21ac55
A
144 &mac_max_slots, 0, "");
145
146/*
147 * Has the kernel started generating labeled objects yet? All read/write
148 * access to this variable is serialized during the boot process. Following
149 * the end of serialization, we don't update this flag; no locking.
150 */
151int mac_late = 0;
152
153/*
154 * Flag to indicate whether or not we should allocate label storage for
155 * new mbufs. Since most dynamic policies we currently work with don't
156 * rely on mbuf labeling, try to avoid paying the cost of mtag allocation
157 * unless specifically notified of interest. One result of this is
158 * that if a dynamically loaded policy requests mbuf labels, it must
159 * be able to deal with a NULL label being returned on any mbufs that
160 * were already in flight when the policy was loaded. Since the policy
161 * already has to deal with uninitialized labels, this probably won't
162 * be a problem. Note: currently no locking. Will this be a problem?
163 */
b0d623f7
A
164#if CONFIG_MACF_NET
165unsigned int mac_label_mbufs = 1;
6d2010ae 166SYSCTL_UINT(_security_mac, OID_AUTO, label_mbufs, CTLFLAG_RW | CTLFLAG_LOCKED,
b0d623f7
A
167 &mac_label_mbufs, 0, "Label all MBUFs");
168#endif
169
2d21ac55 170
b0d623f7
A
171/*
172 * Flag to indicate whether or not we should allocate label storage for
173 * new vnodes. Since most dynamic policies we currently work with don't
174 * rely on vnode labeling, try to avoid paying the cost of mtag allocation
175 * unless specifically notified of interest. One result of this is
176 * that if a dynamically loaded policy requests vnode labels, it must
177 * be able to deal with a NULL label being returned on any vnodes that
178 * were already in flight when the policy was loaded. Since the policy
179 * already has to deal with uninitialized labels, this probably won't
180 * be a problem.
181 */
182unsigned int mac_label_vnodes = 0;
6d2010ae 183SYSCTL_UINT(_security_mac, OID_AUTO, labelvnodes, CTLFLAG_RW | CTLFLAG_LOCKED,
b0d623f7
A
184 &mac_label_vnodes, 0, "Label all vnodes");
185
186
2d21ac55 187unsigned int mac_mmap_revocation = 0;
6d2010ae 188SYSCTL_UINT(_security_mac, OID_AUTO, mmap_revocation, CTLFLAG_RW | CTLFLAG_LOCKED,
2d21ac55
A
189 &mac_mmap_revocation, 0, "Revoke mmap access to files on subject "
190 "relabel");
191
192unsigned int mac_mmap_revocation_via_cow = 0;
6d2010ae 193SYSCTL_UINT(_security_mac, OID_AUTO, mmap_revocation_via_cow, CTLFLAG_RW | CTLFLAG_LOCKED,
2d21ac55
A
194 &mac_mmap_revocation_via_cow, 0, "Revoke mmap access to files via "
195 "copy-on-write semantics, or by removing all write access");
196
197unsigned int mac_device_enforce = 1;
6d2010ae 198SYSCTL_UINT(_security_mac, OID_AUTO, device_enforce, CTLFLAG_RW | CTLFLAG_LOCKED,
2d21ac55
A
199 &mac_device_enforce, 0, "Enforce MAC policy on device operations");
200
201unsigned int mac_file_enforce = 0;
6d2010ae 202SYSCTL_UINT(_security_mac, OID_AUTO, file_enforce, CTLFLAG_RW | CTLFLAG_LOCKED,
2d21ac55
A
203 &mac_file_enforce, 0, "Enforce MAC policy on file operations");
204
205unsigned int mac_iokit_enforce = 0;
6d2010ae 206SYSCTL_UINT(_security_mac, OID_AUTO, iokit_enforce, CTLFLAG_RW | CTLFLAG_LOCKED,
2d21ac55
A
207 &mac_file_enforce, 0, "Enforce MAC policy on IOKit operations");
208
209unsigned int mac_pipe_enforce = 1;
6d2010ae 210SYSCTL_UINT(_security_mac, OID_AUTO, pipe_enforce, CTLFLAG_RW | CTLFLAG_LOCKED,
2d21ac55
A
211 &mac_pipe_enforce, 0, "Enforce MAC policy on pipe operations");
212
213unsigned int mac_posixsem_enforce = 1;
6d2010ae 214SYSCTL_UINT(_security_mac, OID_AUTO, posixsem_enforce, CTLFLAG_RW | CTLFLAG_LOCKED,
2d21ac55
A
215 &mac_posixsem_enforce, 0, "Enforce MAC policy on POSIX semaphores");
216
217unsigned int mac_posixshm_enforce = 1;
6d2010ae 218SYSCTL_UINT(_security_mac, OID_AUTO, posixshm_enforce, CTLFLAG_RW | CTLFLAG_LOCKED,
2d21ac55
A
219 &mac_posixshm_enforce, 0, "Enforce MAC policy on Posix Shared Memory");
220
221unsigned int mac_proc_enforce = 1;
6d2010ae 222SYSCTL_UINT(_security_mac, OID_AUTO, proc_enforce, CTLFLAG_RW | CTLFLAG_LOCKED,
2d21ac55
A
223 &mac_proc_enforce, 0, "Enforce MAC policy on process operations");
224
225unsigned int mac_socket_enforce = 1;
6d2010ae 226SYSCTL_UINT(_security_mac, OID_AUTO, socket_enforce, CTLFLAG_RW | CTLFLAG_LOCKED,
2d21ac55
A
227 &mac_socket_enforce, 0, "Enforce MAC policy on socket operations");
228
229unsigned int mac_system_enforce = 1;
6d2010ae 230SYSCTL_UINT(_security_mac, OID_AUTO, system_enforce, CTLFLAG_RW | CTLFLAG_LOCKED,
2d21ac55
A
231 &mac_system_enforce, 0, "Enforce MAC policy on system-wide interfaces");
232
233unsigned int mac_sysvmsg_enforce = 1;
6d2010ae 234SYSCTL_UINT(_security_mac, OID_AUTO, sysvmsg_enforce, CTLFLAG_RW | CTLFLAG_LOCKED,
2d21ac55
A
235 &mac_sysvmsg_enforce, 0, "Enforce MAC policy on System V IPC message queues");
236
237unsigned int mac_sysvsem_enforce = 1;
6d2010ae 238SYSCTL_UINT(_security_mac, OID_AUTO, sysvsem_enforce, CTLFLAG_RW | CTLFLAG_LOCKED,
2d21ac55
A
239 &mac_sysvsem_enforce, 0, "Enforce MAC policy on System V IPC semaphores");
240
241unsigned int mac_sysvshm_enforce = 1;
6d2010ae 242SYSCTL_INT(_security_mac, OID_AUTO, sysvshm_enforce, CTLFLAG_RW | CTLFLAG_LOCKED,
2d21ac55
A
243 &mac_sysvshm_enforce, 0, "Enforce MAC policy on System V Shared Memory");
244
245unsigned int mac_vm_enforce = 1;
6d2010ae 246SYSCTL_INT(_security_mac, OID_AUTO, vm_enforce, CTLFLAG_RW | CTLFLAG_LOCKED,
2d21ac55
A
247 &mac_vm_enforce, 0, "Enforce MAC policy on VM operations");
248
249unsigned int mac_vnode_enforce = 1;
6d2010ae 250SYSCTL_UINT(_security_mac, OID_AUTO, vnode_enforce, CTLFLAG_RW | CTLFLAG_LOCKED,
2d21ac55
A
251 &mac_vnode_enforce, 0, "Enforce MAC policy on vnode operations");
252
253
254#if CONFIG_MACF_MACH
255unsigned int mac_port_enforce = 0;
6d2010ae 256SYSCTL_UINT(_security_mac, OID_AUTO, port_enforce, CTLFLAG_RW | CTLFLAG_LOCKED,
2d21ac55
A
257 &mac_port_enforce, 0, "Enforce MAC policy on Mach port operations");
258
259unsigned int mac_task_enforce = 0;
6d2010ae 260SYSCTL_UINT(_security_mac, OID_AUTO, task_enforce, CTLFLAG_RW | CTLFLAG_LOCKED,
2d21ac55
A
261 &mac_task_enforce, 0, "Enforce MAC policy on Mach task operations");
262#endif
263
b0d623f7 264#if CONFIG_AUDIT
2d21ac55
A
265/*
266 * mac_audit_data_zone is the zone used for data pushed into the audit
267 * record by policies. Using a zone simplifies memory management of this
268 * data, and allows tracking of the amount of data in flight.
269 */
270extern zone_t mac_audit_data_zone;
4a3eedf9 271#endif
2d21ac55
A
272
273/*
274 * mac_policy_list holds the list of policy modules. Modules with a
275 * handle lower than staticmax are considered "static" and cannot be
276 * unloaded. Such policies can be invoked without holding the busy count.
277 *
278 * Modules with a handle at or above the staticmax high water mark
279 * are considered to be "dynamic" policies. A busy count is maintained
280 * for the list, stored in mac_policy_busy. The busy count is protected
281 * by mac_policy_mtx; the list may be modified only while the busy
282 * count is 0, requiring that the lock be held to prevent new references
283 * to the list from being acquired. For almost all operations,
284 * incrementing the busy count is sufficient to guarantee consistency,
285 * as the list cannot be modified while the busy count is elevated.
286 * For a few special operations involving a change to the list of
287 * active policies, the mtx itself must be held.
288 */
289static lck_mtx_t *mac_policy_mtx;
290
291/*
292 * Policy list array allocation chunk size. Trying to set this so that we
293 * allocate a page at a time.
294 */
295#define MAC_POLICY_LIST_CHUNKSIZE 512
296
297static int mac_policy_busy;
298
299mac_policy_list_t mac_policy_list;
300
301/*
302 * mac_label_element_list holds the master list of label namespaces for
303 * all the policies. When a policy is loaded, each of it's label namespace
304 * elements is added to the master list if not already present. When a
305 * policy is unloaded, the namespace elements are removed if no other
306 * policy is interested in that namespace element.
307 */
308struct mac_label_element_list_t mac_label_element_list;
309struct mac_label_element_list_t mac_static_label_element_list;
310
311/*
312 * Journal of label operations that occur before policies are loaded.
313 */
314struct mac_label_journal_list_t mac_label_journal_list;
315
316int
317mac_label_journal_add (struct label *l, int type)
318{
319 struct mac_label_journal *mlj;
320
321 if (mac_label_journal_find(l))
322 return (0);
323
324 MALLOC(mlj, struct mac_label_journal *,
325 sizeof(struct mac_label_journal), M_MACTEMP, M_WAITOK);
326 mlj->l = l;
327 mlj->type = type;
328 TAILQ_INSERT_TAIL(&mac_label_journal_list, mlj, link);
329
330 return (0);
331}
332
333int
334mac_label_journal_remove (struct label *l)
335{
336 struct mac_label_journal *mlj;
337
338 mlj = mac_label_journal_find(l);
339 if (mlj == NULL)
340 return (-1);
341
342 TAILQ_REMOVE(&mac_label_journal_list, mlj, link);
343 FREE(mlj, M_MACTEMP);
344 return (0);
345}
346
347struct mac_label_journal *
348mac_label_journal_find (struct label *l)
349{
350 struct mac_label_journal *mlj;
351
352 TAILQ_FOREACH(mlj, &mac_label_journal_list, link) {
353 if (l == mlj->l)
354 return (mlj);
355 }
356
357 return (NULL);
358}
359
360int
361mac_label_journal (struct label *l, int op, ...)
362{
363 struct mac_label_journal *mlj;
364 va_list ap;
365
366 mlj = mac_label_journal_find(l);
367 if (mlj == NULL) {
368 printf("%s(): Label not in list!\n", __func__);
369 return (-1);
370 }
371
372 if (op == MLJ_PORT_OP_UPDATE) {
373 va_start(ap, op);
374 mlj->kotype = va_arg(ap, int);
375 va_end(ap);
376 }
377
378 mlj->ops |= op;
379 return (0);
380}
381
382/*
383 * The assumption during replay is that the system is totally
384 * serialized and no additional tasks/ports will be created.
385 */
386void
387mac_label_journal_replay (void)
388{
389 struct mac_label_journal *mlj;
390
391 TAILQ_FOREACH(mlj, &mac_label_journal_list, link) {
392 switch (mlj->type) {
393 case MLJ_TYPE_PORT:
394 if (mlj->ops & MLJ_PORT_OP_INIT)
395 MAC_PERFORM(port_label_init, mlj->l);
396 if (mlj->ops & MLJ_PORT_OP_CREATE_K)
397 MAC_PERFORM(port_label_associate_kernel, mlj->l, 0);
398 if (mlj->ops & MLJ_PORT_OP_UPDATE)
399 MAC_PERFORM(port_label_update_kobject, mlj->l,
400 mlj->kotype);
401 break;
402 case MLJ_TYPE_TASK:
403 if (mlj->ops & MLJ_TASK_OP_INIT)
404 MAC_PERFORM(task_label_init, mlj->l);
405#if 0
406 /* Not enough context to replay. */
407 if (mlj->ops & MLJ_TASK_OP_CREATE_K)
408 ;
409#endif
410 break;
411 default:
412 break;
413 }
414 }
415
416 /* Free list */
417 while (!TAILQ_EMPTY(&mac_label_journal_list)) {
418 mlj = TAILQ_FIRST(&mac_label_journal_list);
419 TAILQ_REMOVE(&mac_label_journal_list, mlj, link);
420 FREE(mlj, M_MACTEMP);
421 }
422 return;
423}
424
425static __inline void
426mac_policy_grab_exclusive(void)
427{
428 lck_mtx_lock(mac_policy_mtx);
429 while (mac_policy_busy != 0) {
430 lck_mtx_sleep(mac_policy_mtx, LCK_SLEEP_UNLOCK,
431 (event_t)&mac_policy_busy, THREAD_UNINT);
432 lck_mtx_lock(mac_policy_mtx);
433 }
434}
435
436static __inline void
437mac_policy_assert_exclusive(void)
438{
439 lck_mtx_assert(mac_policy_mtx, LCK_MTX_ASSERT_OWNED);
440 KASSERT(mac_policy_busy == 0,
441 ("mac_policy_assert_exclusive(): not exclusive"));
442}
443
444static __inline void
445mac_policy_release_exclusive(void)
446{
447
448 KASSERT(mac_policy_busy == 0,
449 ("mac_policy_release_exclusive(): not exclusive"));
450 lck_mtx_unlock(mac_policy_mtx);
451 thread_wakeup((event_t) &mac_policy_busy);
452}
453
454void
455mac_policy_list_busy(void)
456{
457 lck_mtx_lock(mac_policy_mtx);
458 mac_policy_busy++;
459 lck_mtx_unlock(mac_policy_mtx);
460}
461
462int
463mac_policy_list_conditional_busy(void)
464{
465 int ret;
466
467 if (mac_policy_list.numloaded <= mac_policy_list.staticmax)
468 return(0);
469
470 lck_mtx_lock(mac_policy_mtx);
471 if (mac_policy_list.numloaded > mac_policy_list.staticmax) {
472 mac_policy_busy++;
473 ret = 1;
474 } else
475 ret = 0;
476 lck_mtx_unlock(mac_policy_mtx);
477 return (ret);
478}
479
480void
481mac_policy_list_unbusy(void)
482{
483 lck_mtx_lock(mac_policy_mtx);
484 mac_policy_busy--;
485 KASSERT(mac_policy_busy >= 0, ("MAC_POLICY_LIST_LOCK"));
486 if (mac_policy_busy == 0)
487 thread_wakeup(&mac_policy_busy);
488 lck_mtx_unlock(mac_policy_mtx);
489}
490
491/*
492 * Early pre-malloc MAC initialization, including appropriate SMP locks.
493 */
494void
495mac_policy_init(void)
496{
497 lck_grp_attr_t *mac_lck_grp_attr;
498 lck_attr_t *mac_lck_attr;
499 lck_grp_t *mac_lck_grp;
500
501 mac_policy_list.numloaded = 0;
502 mac_policy_list.max = MAC_POLICY_LIST_CHUNKSIZE;
503 mac_policy_list.maxindex = 0;
504 mac_policy_list.staticmax = 0;
505 mac_policy_list.freehint = 0;
506 mac_policy_list.chunks = 1;
507
508 mac_policy_list.entries = kalloc(sizeof(struct mac_policy_list_element) * MAC_POLICY_LIST_CHUNKSIZE);
509 bzero(mac_policy_list.entries, sizeof(struct mac_policy_list_element) * MAC_POLICY_LIST_CHUNKSIZE);
510
511 LIST_INIT(&mac_label_element_list);
512 LIST_INIT(&mac_static_label_element_list);
513 TAILQ_INIT(&mac_label_journal_list);
514
515 mac_lck_grp_attr = lck_grp_attr_alloc_init();
516 lck_grp_attr_setstat(mac_lck_grp_attr);
517 mac_lck_grp = lck_grp_alloc_init("MAC lock", mac_lck_grp_attr);
518 mac_lck_attr = lck_attr_alloc_init();
519 lck_attr_setdefault(mac_lck_attr);
520 mac_policy_mtx = lck_mtx_alloc_init(mac_lck_grp, mac_lck_attr);
521 lck_attr_free(mac_lck_attr);
522 lck_grp_attr_free(mac_lck_grp_attr);
523 lck_grp_free(mac_lck_grp);
524
525 mac_labelzone_init();
526}
527
b0d623f7
A
528/* Function pointer set up for loading security extensions.
529 * It is set to an actual function after OSlibkernInit()
530 * has been called, and is set back to 0 by OSKextRemoveKextBootstrap()
531 * after bsd_init().
532 */
533void (*load_security_extensions_function)(void) = 0;
534
2d21ac55
A
535/*
536 * Init after early Mach startup, but before BSD
537 */
538void
539mac_policy_initmach(void)
540{
541
542 /*
543 * For the purposes of modules that want to know if they were
544 * loaded "early", set the mac_late flag once we've processed
545 * modules either linked into the kernel, or loaded before the
546 * kernel startup.
547 */
548
b0d623f7
A
549 if (load_security_extensions_function) {
550 load_security_extensions_function();
551 }
2d21ac55
A
552 mac_late = 1;
553#if CONFIG_MACF_MACH
554 mac_label_journal_replay();
555#endif
556}
557
558/*
559 * BSD startup.
560 */
561void
562mac_policy_initbsd(void)
563{
564 struct mac_policy_conf *mpc;
565 u_int i;
566
b0d623f7 567#if CONFIG_AUDIT
2d21ac55
A
568 mac_audit_data_zone = zinit(MAC_AUDIT_DATA_LIMIT,
569 AQ_HIWATER * MAC_AUDIT_DATA_LIMIT,
570 8192, "mac_audit_data_zone");
4a3eedf9 571#endif
2d21ac55
A
572
573 printf("MAC Framework successfully initialized\n");
574
575 /* Call bsd init functions of already loaded policies */
576
577 /*
578 * Using the exclusive lock means no other framework entry
579 * points can proceed while initializations are running.
580 * This may not be necessary.
581 */
582 mac_policy_grab_exclusive();
583
584 for (i = 0; i <= mac_policy_list.maxindex; i++) {
585 mpc = mac_get_mpc(i);
586 if ((mpc != NULL) && (mpc->mpc_ops->mpo_policy_initbsd != NULL))
587 (*(mpc->mpc_ops->mpo_policy_initbsd))(mpc);
588 }
589
590 mac_policy_release_exclusive();
591}
592
593/*
594 * After a policy has been loaded, add the label namespaces managed by the
595 * policy to either the static or non-static label namespace list.
596 * A namespace is added to the the list only if it is not already on one of
597 * the lists.
598 */
599void
600mac_policy_addto_labellist(mac_policy_handle_t handle, int static_entry)
601{
602 struct mac_label_listener **new_mlls;
603 struct mac_label_element *mle, **new_mles;
604 struct mac_label_element_list_t *list;
605 struct mac_policy_conf *mpc;
606 const char *name, *name2;
607 u_int idx, mle_free, mll_free;
608
609 mpc = mac_get_mpc(handle);
610
611 if (mpc->mpc_labelnames == NULL)
612 return;
613
614 if (mpc->mpc_labelname_count == 0)
615 return;
616
617 if (static_entry)
618 list = &mac_static_label_element_list;
619 else
620 list = &mac_label_element_list;
621
622 /*
623 * Before we grab the policy list lock, allocate enough memory
624 * to contain the potential new elements so we don't have to
625 * give up the lock, or allocate with the lock held.
626 */
627 MALLOC(new_mles, struct mac_label_element **,
628 sizeof(struct mac_label_element *) *
629 mpc->mpc_labelname_count, M_MACTEMP, M_WAITOK | M_ZERO);
630 for (idx = 0; idx < mpc->mpc_labelname_count; idx++)
631 MALLOC(new_mles[idx], struct mac_label_element *,
632 sizeof(struct mac_label_element),
633 M_MACTEMP, M_WAITOK);
634 mle_free = 0;
635 MALLOC(new_mlls, struct mac_label_listener **,
636 sizeof(struct mac_label_listener *) *
637 mpc->mpc_labelname_count, M_MACTEMP, M_WAITOK);
638 for (idx = 0; idx < mpc->mpc_labelname_count; idx++)
639 MALLOC(new_mlls[idx], struct mac_label_listener *,
640 sizeof(struct mac_label_listener), M_MACTEMP, M_WAITOK);
641 mll_free = 0;
642
643 if (mac_late)
644 mac_policy_grab_exclusive();
645 for (idx = 0; idx < mpc->mpc_labelname_count; idx++) {
646
647 if (*(name = mpc->mpc_labelnames[idx]) == '?')
648 name++;
649 /*
650 * Check both label element lists and add to the
651 * appropriate list only if not already on a list.
652 */
653 LIST_FOREACH(mle, &mac_static_label_element_list, mle_list) {
654 if (*(name2 = mle->mle_name) == '?')
655 name2++;
656 if (strcmp(name, name2) == 0)
657 break;
658 }
659 if (mle == NULL) {
660 LIST_FOREACH(mle, &mac_label_element_list, mle_list) {
661 if (*(name2 = mle->mle_name) == '?')
662 name2++;
663 if (strcmp(name, name2) == 0)
664 break;
665 }
666 }
667 if (mle == NULL) {
668 mle = new_mles[mle_free];
669 strlcpy(mle->mle_name, mpc->mpc_labelnames[idx],
670 MAC_MAX_LABEL_ELEMENT_NAME);
671 LIST_INIT(&mle->mle_listeners);
672 LIST_INSERT_HEAD(list, mle, mle_list);
673 mle_free++;
674 }
675 /* Add policy handler as a listener. */
676 new_mlls[mll_free]->mll_handle = handle;
677 LIST_INSERT_HEAD(&mle->mle_listeners, new_mlls[mll_free],
678 mll_list);
679 mll_free++;
680 }
681 if (mac_late)
682 mac_policy_release_exclusive();
683
684 /* Free up any unused label elements and listeners */
685 for (idx = mle_free; idx < mpc->mpc_labelname_count; idx++)
686 FREE(new_mles[idx], M_MACTEMP);
687 FREE(new_mles, M_MACTEMP);
688 for (idx = mll_free; idx < mpc->mpc_labelname_count; idx++)
689 FREE(new_mlls[idx], M_MACTEMP);
690 FREE(new_mlls, M_MACTEMP);
691}
692
693/*
694 * After a policy has been unloaded, remove the label namespaces that the
695 * the policy manages from the non-static list of namespaces.
696 * The removal only takes place when no other policy is interested in the
697 * namespace.
698 *
699 * Must be called with the policy exclusive lock held.
700 */
701void
702mac_policy_removefrom_labellist(mac_policy_handle_t handle)
703{
704 struct mac_label_listener *mll;
705 struct mac_label_element *mle;
706 struct mac_policy_conf *mpc;
707
708 mpc = mac_get_mpc(handle);
709
710 if (mpc->mpc_labelnames == NULL)
711 return;
712
713 if (mpc->mpc_labelname_count == 0)
714 return;
715
716 /*
717 * Unregister policy as being interested in any label
718 * namespaces. If no other policy is listening, remove
719 * that label element from the list. Note that we only
720 * have to worry about the non-static list.
721 */
722 LIST_FOREACH(mle, &mac_label_element_list, mle_list) {
723 LIST_FOREACH(mll, &mle->mle_listeners, mll_list) {
724 if (mll->mll_handle == handle) {
725 LIST_REMOVE(mll, mll_list);
726 FREE(mll, M_MACTEMP);
727 if (LIST_EMPTY(&mle->mle_listeners)) {
728 LIST_REMOVE(mle, mle_list);
729 FREE(mle, M_MACTEMP);
730 }
731 return;
732 }
733 }
734 }
735}
736
737/*
738 * After the policy list has changed, walk the list to update any global
739 * flags.
740 */
741static void
742mac_policy_updateflags(void)
743{
2d21ac55
A
744}
745
746static __inline void
747mac_policy_fixup_mmd_list(struct mac_module_data *new)
748{
749 struct mac_module_data *old;
750 struct mac_module_data_element *ele, *aele;
751 struct mac_module_data_list *arr, *dict;
752 unsigned int i, j, k;
753
754 old = new->base_addr;
755 DPRINTF(("fixup_mmd: old %p new %p\n", old, new));
756 for (i = 0; i < new->count; i++) {
757 ele = &(new->data[i]);
758 DPRINTF(("fixup_mmd: ele %p\n", ele));
759 DPRINTF((" key %p value %p\n", ele->key, ele->value));
760 mmd_fixup_ele(old, new, ele); /* Fix up key/value ptrs. */
761 DPRINTF((" key %p value %p\n", ele->key, ele->value));
762 if (ele->value_type == MAC_DATA_TYPE_ARRAY) {
763 arr = (struct mac_module_data_list *)ele->value;
764 DPRINTF(("fixup_mmd: array @%p\n", arr));
765 for (j = 0; j < arr->count; j++) {
766 aele = &(arr->list[j]);
767 DPRINTF(("fixup_mmd: aele %p\n", aele));
768 DPRINTF((" key %p value %p\n", aele->key, aele->value));
769 mmd_fixup_ele(old, new, aele);
770 DPRINTF((" key %p value %p\n", aele->key, aele->value));
771 if (arr->type == MAC_DATA_TYPE_DICT) {
772 dict = (struct mac_module_data_list *)aele->value;
773 DPRINTF(("fixup_mmd: dict @%p\n", dict));
774 for (k = 0; k < dict->count; k++)
775 mmd_fixup_ele(old, new,
776 &(dict->list[k]));
777 }
778 }
779 }
780 }
781 new->base_addr = new;
782}
783
784int
785mac_policy_register(struct mac_policy_conf *mpc, mac_policy_handle_t *handlep,
786 void *xd)
787{
788 struct mac_policy_list_element *tmac_policy_list_element;
789 int error, slot, static_entry = 0;
790 u_int i;
791
792 /*
793 * Some preliminary checks to make sure the policy's conf structure
794 * contains the required fields.
795 */
796 if (mpc->mpc_name == NULL)
797 panic("policy's name is not set\n");
798
799 if (mpc->mpc_fullname == NULL)
800 panic("policy's full name is not set\n");
801
802 if (mpc->mpc_labelname_count > MAC_MAX_MANAGED_NAMESPACES)
803 panic("policy's managed label namespaces exceeds maximum\n");
804
805 if (mpc->mpc_ops == NULL)
806 panic("policy's OPs field is NULL\n");
807
808 error = 0;
809
810 if (mac_late) {
811 if (mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_NOTLATE) {
812 printf("Module %s does not support late loading.\n",
813 mpc->mpc_name);
814 return (EPERM);
815 }
816 mac_policy_grab_exclusive();
817 }
818
819 if (mac_policy_list.numloaded >= mac_policy_list.max) {
820 /* allocate new policy list array, zero new chunk */
821 tmac_policy_list_element =
822 kalloc((sizeof(struct mac_policy_list_element) *
823 MAC_POLICY_LIST_CHUNKSIZE) * (mac_policy_list.chunks + 1));
824 bzero(&tmac_policy_list_element[mac_policy_list.max],
825 sizeof(struct mac_policy_list_element) *
826 MAC_POLICY_LIST_CHUNKSIZE);
827
828 /* copy old entries into new list */
829 memcpy(tmac_policy_list_element, mac_policy_list.entries,
830 sizeof(struct mac_policy_list_element) *
831 MAC_POLICY_LIST_CHUNKSIZE * mac_policy_list.chunks);
832
833 /* free old array */
834 kfree(mac_policy_list.entries,
835 sizeof(struct mac_policy_list_element) *
836 MAC_POLICY_LIST_CHUNKSIZE * mac_policy_list.chunks);
837
838 mac_policy_list.entries = tmac_policy_list_element;
839
840 /* Update maximums, etc */
841 mac_policy_list.max += MAC_POLICY_LIST_CHUNKSIZE;
842 mac_policy_list.chunks++;
843 }
844
845 /* Check for policy with same name already loaded */
846 for (i = 0; i <= mac_policy_list.maxindex; i++) {
847 if (mac_policy_list.entries[i].mpc == NULL)
848 continue;
849
850 if (strcmp(mac_policy_list.entries[i].mpc->mpc_name,
851 mpc->mpc_name) == 0) {
852 error = EEXIST;
853 goto out;
854 }
855 }
856
857 if (mpc->mpc_field_off != NULL) {
858 slot = ffs(mac_slot_offsets_free);
859 if (slot == 0) {
860 error = ENOMEM;
861 goto out;
862 }
863 slot--;
864 mac_slot_offsets_free &= ~(1 << slot);
865 *mpc->mpc_field_off = slot;
866 }
867 mpc->mpc_runtime_flags |= MPC_RUNTIME_FLAG_REGISTERED;
868
869 if (xd) {
870 struct mac_module_data *mmd = xd; /* module data from plist */
871
872 /* Make a copy of the data. */
873 mpc->mpc_data = (void *)kalloc(mmd->size);
874 if (mpc->mpc_data != NULL) {
875 memcpy(mpc->mpc_data, mmd, mmd->size);
876
877 /* Fix up pointers after copy. */
878 mac_policy_fixup_mmd_list(mpc->mpc_data);
879 }
880 }
881
882 /* Find the first free handle in the list (using our hint). */
883 for (i = mac_policy_list.freehint; i < mac_policy_list.max; i++) {
884 if (mac_policy_list.entries[i].mpc == NULL) {
885 *handlep = i;
886 mac_policy_list.freehint = ++i;
887 break;
888 }
889 }
890
891 /*
892 * If we are loading a MAC module before the framework has
893 * finished initializing or the module is not unloadable and
894 * we can place its handle adjacent to the last static entry,
895 * bump the static policy high water mark.
896 * Static policies can get by with weaker locking requirements.
897 */
898 if (!mac_late ||
899 ((mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_UNLOADOK) == 0 &&
900 *handlep == mac_policy_list.staticmax)) {
901 static_entry = 1;
902 mac_policy_list.staticmax++;
903 }
904
905 mac_policy_list.entries[*handlep].mpc = mpc;
906
907 /* Update counters, etc */
908 if (*handlep > mac_policy_list.maxindex)
909 mac_policy_list.maxindex = *handlep;
910 mac_policy_list.numloaded++;
911
912 /* Per-policy initialization. */
913 printf ("calling mpo_policy_init for %s\n", mpc->mpc_name);
914 if (mpc->mpc_ops->mpo_policy_init != NULL)
915 (*(mpc->mpc_ops->mpo_policy_init))(mpc);
916
917 if (mac_late && mpc->mpc_ops->mpo_policy_initbsd != NULL) {
918 printf ("calling mpo_policy_initbsd for %s\n", mpc->mpc_name);
919 (*(mpc->mpc_ops->mpo_policy_initbsd))(mpc);
920 }
921
922 mac_policy_updateflags();
923
924 if (mac_late)
925 mac_policy_release_exclusive();
926
927 mac_policy_addto_labellist(*handlep, static_entry);
928
929 printf("Security policy loaded: %s (%s)\n", mpc->mpc_fullname,
930 mpc->mpc_name);
931
932 return (0);
933
934out:
935 if (mac_late)
936 mac_policy_release_exclusive();
937
938 return (error);
939}
940
941int
942mac_policy_unregister(mac_policy_handle_t handle)
943{
944 struct mac_policy_conf *mpc;
945
946 /*
947 * If we fail the load, we may get a request to unload. Check
948 * to see if we did the run-time registration, and if not,
949 * silently succeed.
950 */
951 mac_policy_grab_exclusive();
952 mpc = mac_get_mpc(handle);
953 if ((mpc->mpc_runtime_flags & MPC_RUNTIME_FLAG_REGISTERED) == 0) {
954 mac_policy_release_exclusive();
955 return (0);
956 }
957
958#if 0
959 /*
960 * Don't allow unloading modules with private data.
961 */
962 if (mpc->mpc_field_off != NULL) {
963 MAC_POLICY_LIST_UNLOCK();
964 return (EBUSY);
965 }
966#endif
967 /*
968 * Only allow the unload to proceed if the module is unloadable
969 * by its own definition.
970 */
971 if ((mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_UNLOADOK) == 0) {
972 mac_policy_release_exclusive();
973 return (EBUSY);
974 }
975
976 mac_policy_removefrom_labellist(handle);
977
978 mac_get_mpc(handle) = NULL;
979 if (handle < mac_policy_list.freehint &&
980 handle >= mac_policy_list.staticmax)
981 mac_policy_list.freehint = handle;
982
983 if (handle == mac_policy_list.maxindex)
984 mac_policy_list.maxindex--;
985
986 mac_policy_list.numloaded--;
987 if (mpc->mpc_field_off != NULL) {
988 mac_slot_offsets_free |= (1 << *mpc->mpc_field_off);
989 }
990
991 if (mpc->mpc_ops->mpo_policy_destroy != NULL)
992 (*(mpc->mpc_ops->mpo_policy_destroy))(mpc);
993
994 mpc->mpc_runtime_flags &= ~MPC_RUNTIME_FLAG_REGISTERED;
995 mac_policy_updateflags();
996
997 mac_policy_release_exclusive();
998
999 if (mpc->mpc_data) {
1000 struct mac_module_data *mmd = mpc->mpc_data;
1001 kfree(mmd, mmd->size);
1002 mpc->mpc_data = NULL;
1003 }
1004
1005 printf("Security policy unload: %s (%s)\n", mpc->mpc_fullname,
1006 mpc->mpc_name);
1007
1008 return (0);
1009}
1010
1011/*
1012 * Define an error value precedence, and given two arguments, selects the
1013 * value with the higher precedence.
1014 */
1015int
1016mac_error_select(int error1, int error2)
1017{
1018
1019 /* Certain decision-making errors take top priority. */
1020 if (error1 == EDEADLK || error2 == EDEADLK)
1021 return (EDEADLK);
1022
1023 /* Invalid arguments should be reported where possible. */
1024 if (error1 == EINVAL || error2 == EINVAL)
1025 return (EINVAL);
1026
1027 /* Precedence goes to "visibility", with both process and file. */
1028 if (error1 == ESRCH || error2 == ESRCH)
1029 return (ESRCH);
1030
1031 if (error1 == ENOENT || error2 == ENOENT)
1032 return (ENOENT);
1033
1034 /* Precedence goes to DAC/MAC protections. */
1035 if (error1 == EACCES || error2 == EACCES)
1036 return (EACCES);
1037
1038 /* Precedence goes to privilege. */
1039 if (error1 == EPERM || error2 == EPERM)
1040 return (EPERM);
1041
1042 /* Precedence goes to error over success; otherwise, arbitrary. */
1043 if (error1 != 0)
1044 return (error1);
1045 return (error2);
1046}
1047
1048void
1049mac_label_init(struct label *label)
1050{
1051
1052 bzero(label, sizeof(*label));
1053 label->l_flags = MAC_FLAG_INITIALIZED;
1054}
1055
1056void
1057mac_label_destroy(struct label *label)
1058{
1059
1060 KASSERT(label->l_flags & MAC_FLAG_INITIALIZED,
1061 ("destroying uninitialized label"));
1062
1063 bzero(label, sizeof(*label));
1064 /* implicit: label->l_flags &= ~MAC_FLAG_INITIALIZED; */
1065}
1066
1067int
1068mac_port_check_service (struct label *subj, struct label *obj,
1069 const char *s, const char *p)
1070{
1071 int error;
1072
1073 MAC_CHECK(port_check_service, subj, obj, s, p);
1074 return (error);
1075}
1076
1077int
1078mac_port_label_compute(struct label *subj, struct label *obj,
1079 const char *s, struct label *out)
1080{
1081 int error;
1082
1083 MAC_CHECK(port_label_compute, subj, obj, s, out);
1084 return error;
1085}
1086
1087int
1088mac_check_structmac_consistent(struct user_mac *mac)
1089{
1090
1091 if (mac->m_buflen > MAC_MAX_LABEL_BUF_LEN || mac->m_buflen == 0)
1092 return (EINVAL);
1093
1094 return (0);
1095}
1096
1097/*
1098 * Get the external forms of labels from all policies, for a single
1099 * label namespace or "*" for all namespaces. Returns ENOENT if no policy
1100 * is registered for the namespace, unless the namespace begins with a '?'.
1101 */
1102static int
1103mac_label_externalize(size_t mpo_externalize_off, struct label *label,
1104 const char *element, struct sbuf *sb)
1105{
1106 struct mac_policy_conf *mpc;
1107 struct mac_label_listener *mll;
1108 struct mac_label_element *mle;
1109 struct mac_label_element_list_t *element_list;
1110 const char *name;
1111 int (*mpo_externalize)(struct label *, char *, struct sbuf *);
1112 int all_labels = 0, ignorenotfound = 0, error = 0, busy = FALSE;
1113 unsigned int count = 0;
1114
1115 if (element[0] == '?') {
1116 element++;
1117 ignorenotfound = 1;
1118 } else if (element[0] == '*' && element[1] == '\0')
1119 all_labels = 1;
1120
1121 element_list = &mac_static_label_element_list;
1122element_loop:
1123 LIST_FOREACH(mle, element_list, mle_list) {
1124 name = mle->mle_name;
1125 if (all_labels) {
1126 if (*name == '?')
1127 continue;
1128 } else {
1129 if (*name == '?')
1130 name++;
1131 if (strcmp(name, element) != 0)
1132 continue;
1133 }
1134 LIST_FOREACH(mll, &mle->mle_listeners, mll_list) {
1135 mpc = mac_policy_list.entries[mll->mll_handle].mpc;
1136 if (mpc == NULL)
1137 continue;
1138 mpo_externalize = *(typeof(mpo_externalize) *)
1139 ((char *)mpc->mpc_ops + mpo_externalize_off);
1140 if (mpo_externalize == NULL)
1141 continue;
1142 error = sbuf_printf(sb, "%s/", name);
1143 if (error)
1144 goto done;
1145 error = mpo_externalize(label, mle->mle_name, sb);
1146 if (error) {
1147 if (error != ENOENT)
1148 goto done;
1149 /*
1150 * If a policy doesn't have a label to
1151 * externalize it returns ENOENT. This
1152 * may occur for policies that support
1153 * multiple label elements for some
1154 * (but not all) object types.
1155 */
1156 sbuf_setpos(sb, sbuf_len(sb) -
1157 (strlen(name) + 1));
1158 error = 0;
1159 continue;
1160 }
1161 error = sbuf_putc(sb, ',');
1162 if (error)
1163 goto done;
1164 count++;
1165 }
1166 }
1167 /* If there are dynamic policies present, check their elements too. */
1168 if (!busy && mac_policy_list_conditional_busy() == 1) {
1169 element_list = &mac_label_element_list;
1170 busy = TRUE;
1171 goto element_loop;
1172 }
1173done:
1174 if (busy)
1175 mac_policy_list_unbusy();
1176 if (!error && count == 0) {
1177 if (!all_labels && !ignorenotfound)
1178 error = ENOENT; /* XXX: ENOLABEL? */
1179 }
1180 return (error);
1181}
1182
1183/*
1184 * Get the external forms of labels from all policies, for all label
1185 * namespaces contained in a list.
b0d623f7
A
1186 *
1187 * XXX This may be leaking an sbuf.
2d21ac55
A
1188 */
1189int
1190mac_externalize(size_t mpo_externalize_off, struct label *label,
1191 const char *elementlist, char *outbuf, size_t outbuflen)
1192{
1193 char *element;
b0d623f7
A
1194 char *scratch_base;
1195 char *scratch;
2d21ac55
A
1196 struct sbuf sb;
1197 int error = 0, len;
1198
b0d623f7
A
1199 /* allocate a scratch buffer the size of the string */
1200 MALLOC(scratch_base, char *, strlen(elementlist)+1, M_MACTEMP, M_WAITOK);
1201 if (scratch_base == NULL) {
1202 error = ENOMEM;
1203 goto out;
1204 }
1205
1206 /* copy the elementlist to the scratch buffer */
1207 strlcpy(scratch_base, elementlist, strlen(elementlist)+1);
1208
1209 /*
1210 * set up a temporary pointer that can be used to iterate the
1211 * scratch buffer without losing the allocation address
1212 */
1213 scratch = scratch_base;
1214
1215 /* get an sbuf */
1216 if (sbuf_new(&sb, outbuf, outbuflen, SBUF_FIXEDLEN) == NULL) {
1217 /* could not allocate interior buffer */
1218 error = ENOMEM;
1219 goto out;
1220 }
1221 /* iterate the scratch buffer; NOTE: buffer contents modified! */
1222 while ((element = strsep(&scratch, ",")) != NULL) {
2d21ac55
A
1223 error = mac_label_externalize(mpo_externalize_off, label,
1224 element, &sb);
1225 if (error)
1226 break;
1227 }
1228 if ((len = sbuf_len(&sb)) > 0)
1229 sbuf_setpos(&sb, len - 1); /* trim trailing comma */
1230 sbuf_finish(&sb);
b0d623f7
A
1231
1232out:
1233 if (scratch_base != NULL)
1234 FREE(scratch_base, M_MACTEMP);
1235
2d21ac55
A
1236 return (error);
1237}
1238
1239/*
1240 * Have all policies set the internal form of a label, for a single
1241 * label namespace.
1242 */
1243static int
1244mac_label_internalize(size_t mpo_internalize_off, struct label *label,
1245 char *element_name, char *element_data)
1246{
1247 struct mac_policy_conf *mpc;
1248 struct mac_label_listener *mll;
1249 struct mac_label_element *mle;
1250 struct mac_label_element_list_t *element_list;
1251 int (*mpo_internalize)(struct label *, char *, char *);
1252 int error = 0, busy = FALSE;
1253 unsigned int count = 0;
1254 const char *name;
1255
1256 element_list = &mac_static_label_element_list;
1257element_loop:
1258 LIST_FOREACH(mle, element_list, mle_list) {
1259 if (*(name = mle->mle_name) == '?')
1260 name++;
1261 if (strcmp(element_name, name) != 0)
1262 continue;
1263 LIST_FOREACH(mll, &mle->mle_listeners, mll_list) {
1264 mpc = mac_policy_list.entries[mll->mll_handle].mpc;
1265 if (mpc == NULL)
1266 continue;
1267 mpo_internalize = *(typeof(mpo_internalize) *)
1268 ((char *)mpc->mpc_ops + mpo_internalize_off);
1269 if (mpo_internalize == NULL)
1270 continue;
1271 error = mpo_internalize(label, element_name,
1272 element_data);
1273 if (error)
1274 goto done;
1275 count++;
1276 }
1277 }
1278 /* If there are dynamic policies present, check their elements too. */
1279 if (!busy && mac_policy_list_conditional_busy() == 1) {
1280 element_list = &mac_label_element_list;
1281 busy = TRUE;
1282 goto element_loop;
1283 }
1284done:
1285 if (busy)
1286 mac_policy_list_unbusy();
1287 if (!error && count == 0)
1288 error = ENOPOLICY;
1289 return (error);
1290}
1291
1292int
1293mac_internalize(size_t mpo_internalize_off, struct label *label,
1294 char *textlabels)
1295{
1296 char *element_name, *element_data;
1297 int error = 0;
1298
1299 while (!error && (element_name = strsep(&textlabels, ",")) != NULL) {
1300 element_data = strchr(element_name, '/');
1301 if (element_data == NULL) {
1302 error = EINVAL;
1303 break;
1304 }
1305 *element_data++ = '\0';
1306 error = mac_label_internalize(mpo_internalize_off, label,
1307 element_name, element_data);
1308 }
1309 return (error);
1310}
1311
1312/* system calls */
1313
1314int
b0d623f7 1315__mac_get_pid(struct proc *p, struct __mac_get_pid_args *uap, int *ret __unused)
2d21ac55
A
1316{
1317 char *elements, *buffer;
1318 struct user_mac mac;
1319 struct proc *tproc;
1320 struct ucred *tcred;
1321 int error;
1322 size_t ulen;
1323
1324 AUDIT_ARG(pid, uap->pid);
1325 if (IS_64BIT_PROCESS(p)) {
6d2010ae
A
1326 struct user64_mac mac64;
1327 error = copyin(uap->mac_p, &mac64, sizeof(mac64));
1328 mac.m_buflen = mac64.m_buflen;
1329 mac.m_string = mac64.m_string;
2d21ac55 1330 } else {
6d2010ae 1331 struct user32_mac mac32;
2d21ac55
A
1332 error = copyin(uap->mac_p, &mac32, sizeof(mac32));
1333 mac.m_buflen = mac32.m_buflen;
6d2010ae 1334 mac.m_string = mac32.m_string;
2d21ac55
A
1335 }
1336 if (error)
1337 return (error);
1338
1339 error = mac_check_structmac_consistent(&mac);
1340 if (error)
1341 return (error);
1342
1343 tproc = proc_find(uap->pid);
1344 if (tproc == NULL)
1345 return (ESRCH);
1346 tcred = kauth_cred_proc_ref(tproc);
1347 proc_rele(tproc);
1348
1349 MALLOC(elements, char *, mac.m_buflen, M_MACTEMP, M_WAITOK);
1350 error = copyinstr(mac.m_string, elements, mac.m_buflen, &ulen);
1351 if (error) {
1352 FREE(elements, M_MACTEMP);
1353 kauth_cred_unref(&tcred);
1354 return (error);
1355 }
1356 AUDIT_ARG(mac_string, elements);
1357
1358 MALLOC(buffer, char *, mac.m_buflen, M_MACTEMP, M_WAITOK | M_ZERO);
1359 error = mac_cred_label_externalize(tcred->cr_label, elements,
1360 buffer, mac.m_buflen, M_WAITOK);
1361 if (error == 0)
1362 error = copyout(buffer, mac.m_string, strlen(buffer)+1);
1363
1364 FREE(buffer, M_MACTEMP);
1365 FREE(elements, M_MACTEMP);
1366 kauth_cred_unref(&tcred);
1367 return (error);
1368}
1369
1370int
b0d623f7 1371__mac_get_proc(proc_t p, struct __mac_get_proc_args *uap, int *ret __unused)
2d21ac55
A
1372{
1373 char *elements, *buffer;
1374 struct user_mac mac;
1375 kauth_cred_t cr;
1376 int error;
1377 size_t ulen;
1378
1379 if (IS_64BIT_PROCESS(p)) {
6d2010ae
A
1380 struct user64_mac mac64;
1381 error = copyin(uap->mac_p, &mac64, sizeof(mac64));
1382 mac.m_buflen = mac64.m_buflen;
1383 mac.m_string = mac64.m_string;
2d21ac55 1384 } else {
6d2010ae 1385 struct user32_mac mac32;
2d21ac55
A
1386 error = copyin(uap->mac_p, &mac32, sizeof(mac32));
1387 mac.m_buflen = mac32.m_buflen;
6d2010ae 1388 mac.m_string = mac32.m_string;
2d21ac55
A
1389 }
1390 if (error)
1391 return (error);
1392
1393 error = mac_check_structmac_consistent(&mac);
1394 if (error)
1395 return (error);
1396
1397 MALLOC(elements, char *, mac.m_buflen, M_MACTEMP, M_WAITOK);
1398 error = copyinstr(mac.m_string, elements, mac.m_buflen, &ulen);
1399 if (error) {
1400 FREE(elements, M_MACTEMP);
1401 return (error);
1402 }
1403 AUDIT_ARG(mac_string, elements);
1404
1405 cr = kauth_cred_proc_ref(p);
1406
1407 MALLOC(buffer, char *, mac.m_buflen, M_MACTEMP, M_WAITOK | M_ZERO);
1408 error = mac_cred_label_externalize(cr->cr_label,
1409 elements, buffer, mac.m_buflen, M_WAITOK);
1410 if (error == 0)
1411 error = copyout(buffer, mac.m_string, strlen(buffer)+1);
1412
1413 FREE(buffer, M_MACTEMP);
1414 FREE(elements, M_MACTEMP);
1415 kauth_cred_unref(&cr);
1416 return (error);
1417}
1418
2d21ac55 1419int
b0d623f7 1420__mac_set_proc(proc_t p, struct __mac_set_proc_args *uap, int *ret __unused)
2d21ac55 1421{
b0d623f7 1422 kauth_cred_t newcred;
2d21ac55
A
1423 struct label *intlabel;
1424 struct user_mac mac;
1425 char *buffer;
1426 int error;
1427 size_t ulen;
1428
1429 if (IS_64BIT_PROCESS(p)) {
6d2010ae
A
1430 struct user64_mac mac64;
1431 error = copyin(uap->mac_p, &mac64, sizeof(mac64));
1432 mac.m_buflen = mac64.m_buflen;
1433 mac.m_string = mac64.m_string;
2d21ac55 1434 } else {
6d2010ae 1435 struct user32_mac mac32;
2d21ac55
A
1436 error = copyin(uap->mac_p, &mac32, sizeof(mac32));
1437 mac.m_buflen = mac32.m_buflen;
6d2010ae 1438 mac.m_string = mac32.m_string;
2d21ac55
A
1439 }
1440 if (error)
1441 return (error);
1442
1443 error = mac_check_structmac_consistent(&mac);
1444 if (error)
1445 return (error);
1446
1447 MALLOC(buffer, char *, mac.m_buflen, M_MACTEMP, M_WAITOK);
1448 error = copyinstr(mac.m_string, buffer, mac.m_buflen, &ulen);
1449 if (error) {
1450 FREE(buffer, M_MACTEMP);
1451 return (error);
1452 }
1453 AUDIT_ARG(mac_string, buffer);
1454
1455 intlabel = mac_cred_label_alloc();
1456 error = mac_cred_label_internalize(intlabel, buffer);
1457 FREE(buffer, M_MACTEMP);
1458 if (error)
1459 goto out;
1460
1461 error = mac_cred_check_label_update(kauth_cred_get(), intlabel);
1462 if (error) {
1463 goto out;
1464 }
1465
1466 error = kauth_proc_label_update(p, intlabel);
1467 if (error)
1468 goto out;
1469
1470 newcred = kauth_cred_proc_ref(p);
1471 mac_task_label_update_cred(newcred, p->task);
1472
1473#if 0
1474 if (mac_vm_enforce) {
1475 mutex_lock(Giant); /* XXX FUNNEL? */
1476 mac_cred_mmapped_drop_perms(p, newcred);
1477 mutex_unlock(Giant); /* XXX FUNNEL? */
1478 }
1479#endif
1480
1481 kauth_cred_unref(&newcred);
1482out:
1483 mac_cred_label_free(intlabel);
1484 return (error);
1485}
1486
1487#if CONFIG_LCTX
b0d623f7
A
1488/*
1489 * __mac_get_lcid:
1490 * Get login context ID. A login context associates a BSD process
1491 * with an instance of a user. For more information see getlcid(2) man page.
1492 *
1493 * Parameters: p Process requesting the get
1494 * uap User argument descriptor (see below)
1495 * ret (ignored)
1496 *
1497 * Indirect: uap->lcid login context ID to search
1498 * uap->mac_p.m_buflen MAC info buffer size
1499 * uap->mac_p.m_string MAC info user address
1500 *
1501 * Returns: 0 Success
1502 * !0 Not success
1503 */
2d21ac55 1504int
b0d623f7 1505__mac_get_lcid(proc_t p, struct __mac_get_lcid_args *uap, int *ret __unused)
2d21ac55
A
1506{
1507 char *elements, *buffer;
1508 struct user_mac mac;
1509 struct lctx *l;
1510 int error;
1511 size_t ulen;
1512
b0d623f7 1513 AUDIT_ARG(value32, uap->lcid);
2d21ac55 1514 if (IS_64BIT_PROCESS(p)) {
6d2010ae
A
1515 struct user64_mac mac64;
1516 error = copyin(uap->mac_p, &mac64, sizeof(mac64));
1517 mac.m_buflen = mac64.m_buflen;
1518 mac.m_string = mac64.m_string;
2d21ac55 1519 } else {
6d2010ae 1520 struct user32_mac mac32;
2d21ac55
A
1521 error = copyin(uap->mac_p, &mac32, sizeof(mac32));
1522 mac.m_buflen = mac32.m_buflen;
6d2010ae 1523 mac.m_string = mac32.m_string;
2d21ac55
A
1524 }
1525
1526 if (error)
1527 return (error);
1528
1529 error = mac_check_structmac_consistent(&mac);
1530 if (error)
1531 return (error);
1532
1533 l = lcfind(uap->lcid);
1534 if (l == NULL)
1535 return (ESRCH);
1536
1537 MALLOC(elements, char *, mac.m_buflen, M_MACTEMP, M_WAITOK);
1538 error = copyinstr(mac.m_string, elements, mac.m_buflen, &ulen);
1539 if (error) {
1540 LCTX_UNLOCK(l);
1541 FREE(elements, M_MACTEMP);
1542 return (error);
1543 }
1544 AUDIT_ARG(mac_string, elements);
1545 MALLOC(buffer, char *, mac.m_buflen, M_MACTEMP, M_WAITOK);
1546 error = mac_lctx_label_externalize(l->lc_label, elements,
1547 buffer, mac.m_buflen);
1548 if (error == 0)
1549 error = copyout(buffer, mac.m_string, strlen(buffer)+1);
1550
1551 LCTX_UNLOCK(l);
1552 FREE(buffer, M_MACTEMP);
1553 FREE(elements, M_MACTEMP);
1554 return (error);
1555}
1556
b0d623f7
A
1557/*
1558 * __mac_get_lctx:
1559 * Get login context label. A login context associates a BSD process
1560 * associated with an instance of a user.
1561 *
1562 * Parameters: p Process requesting the get
1563 * uap User argument descriptor (see below)
1564 * ret (ignored)
1565 *
1566 * Indirect: uap->lcid login context ID to search
1567 * uap->mac_p MAC info
1568 *
1569 * Returns: 0 Success
1570 * !0 Not success
1571 *
1572 */
2d21ac55 1573int
b0d623f7 1574__mac_get_lctx(proc_t p, struct __mac_get_lctx_args *uap, int *ret __unused)
2d21ac55
A
1575{
1576 char *elements, *buffer;
1577 struct user_mac mac;
1578 int error;
1579 size_t ulen;
1580
1581 if (IS_64BIT_PROCESS(p)) {
6d2010ae
A
1582 struct user64_mac mac64;
1583 error = copyin(uap->mac_p, &mac64, sizeof(mac64));
1584 mac.m_buflen = mac64.m_buflen;
1585 mac.m_string = mac64.m_string;
2d21ac55 1586 } else {
6d2010ae 1587 struct user32_mac mac32;
2d21ac55
A
1588 error = copyin(uap->mac_p, &mac32, sizeof(mac32));
1589 mac.m_buflen = mac32.m_buflen;
6d2010ae 1590 mac.m_string = mac32.m_string;
2d21ac55
A
1591 }
1592
1593 if (error)
1594 return (error);
1595
1596 error = mac_check_structmac_consistent(&mac);
1597 if (error)
1598 return (error);
1599
1600 MALLOC(elements, char *, mac.m_buflen, M_MACTEMP, M_WAITOK);
1601 error = copyinstr(mac.m_string, elements, mac.m_buflen, &ulen);
1602 if (error) {
1603 FREE(elements, M_MACTEMP);
1604 return (error);
1605 }
1606 AUDIT_ARG(mac_string, elements);
1607 MALLOC(buffer, char *, mac.m_buflen, M_MACTEMP, M_WAITOK);
1608
1609 proc_lock(p);
1610 if (p->p_lctx == NULL) {
1611 proc_unlock(p);
1612 error = ENOENT;
1613 goto out;
1614 }
1615
1616 error = mac_lctx_label_externalize(p->p_lctx->lc_label,
1617 elements, buffer, mac.m_buflen);
1618 proc_unlock(p);
1619 if (error == 0)
1620 error = copyout(buffer, mac.m_string, strlen(buffer)+1);
1621
1622out:
1623 FREE(buffer, M_MACTEMP);
1624 FREE(elements, M_MACTEMP);
1625 return (error);
1626}
1627
1628int
b0d623f7 1629__mac_set_lctx(proc_t p, struct __mac_set_lctx_args *uap, int *ret __unused)
2d21ac55
A
1630{
1631 struct user_mac mac;
1632 struct label *intlabel;
1633 char *buffer;
1634 int error;
1635 size_t ulen;
1636
1637 if (IS_64BIT_PROCESS(p)) {
6d2010ae
A
1638 struct user64_mac mac64;
1639 error = copyin(uap->mac_p, &mac64, sizeof(mac64));
1640 mac.m_buflen = mac64.m_buflen;
1641 mac.m_string = mac64.m_string;
2d21ac55 1642 } else {
6d2010ae 1643 struct user32_mac mac32;
2d21ac55
A
1644 error = copyin(uap->mac_p, &mac32, sizeof(mac32));
1645 mac.m_buflen = mac32.m_buflen;
6d2010ae 1646 mac.m_string = mac32.m_string;
2d21ac55
A
1647 }
1648 if (error)
1649 return (error);
1650
1651 error = mac_check_structmac_consistent(&mac);
1652 if (error)
1653 return (error);
1654
1655 MALLOC(buffer, char *, mac.m_buflen, M_MACTEMP, M_WAITOK);
1656 error = copyinstr(mac.m_string, buffer, mac.m_buflen, &ulen);
1657 if (error) {
1658 FREE(buffer, M_MACTEMP);
1659 return (error);
1660 }
1661 AUDIT_ARG(mac_string, buffer);
1662
1663 intlabel = mac_lctx_label_alloc();
1664 error = mac_lctx_label_internalize(intlabel, buffer);
1665 FREE(buffer, M_MACTEMP);
1666 if (error)
1667 goto out;
1668
1669 proc_lock(p);
1670 if (p->p_lctx == NULL) {
1671 proc_unlock(p);
1672 error = ENOENT;
1673 goto out;
1674 }
1675
1676 error = mac_lctx_check_label_update(p->p_lctx, intlabel);
1677 if (error) {
1678 proc_unlock(p);
1679 goto out;
1680 }
1681 mac_lctx_label_update(p->p_lctx, intlabel);
1682 proc_unlock(p);
1683out:
1684 mac_lctx_label_free(intlabel);
1685 return (error);
1686}
1687
1688#else /* LCTX */
1689
1690int
b0d623f7 1691__mac_get_lcid(proc_t p __unused, struct __mac_get_lcid_args *uap __unused, int *ret __unused)
2d21ac55
A
1692{
1693
1694 return (ENOSYS);
1695}
1696
1697int
b0d623f7 1698__mac_get_lctx(proc_t p __unused, struct __mac_get_lctx_args *uap __unused, int *ret __unused)
2d21ac55
A
1699{
1700
1701 return (ENOSYS);
1702}
1703
1704int
b0d623f7 1705__mac_set_lctx(proc_t p __unused, struct __mac_set_lctx_args *uap __unused, int *ret __unused)
2d21ac55
A
1706{
1707
1708 return (ENOSYS);
1709}
1710#endif /* !LCTX */
1711
1712int
b0d623f7 1713__mac_get_fd(proc_t p, struct __mac_get_fd_args *uap, int *ret __unused)
2d21ac55
A
1714{
1715 struct fileproc *fp;
1716 struct vnode *vp;
1717 struct user_mac mac;
1718 char *elements, *buffer;
1719 int error;
1720 size_t ulen;
1721 kauth_cred_t my_cred;
1722#if CONFIG_MACF_SOCKET
1723 struct socket *so;
1724#endif /* MAC_SOCKET */
1725 struct label *intlabel;
1726
1727 AUDIT_ARG(fd, uap->fd);
1728
1729 if (IS_64BIT_PROCESS(p)) {
6d2010ae
A
1730 struct user64_mac mac64;
1731 error = copyin(uap->mac_p, &mac64, sizeof(mac64));
1732 mac.m_buflen = mac64.m_buflen;
1733 mac.m_string = mac64.m_string;
2d21ac55 1734 } else {
6d2010ae 1735 struct user32_mac mac32;
2d21ac55
A
1736 error = copyin(uap->mac_p, &mac32, sizeof(mac32));
1737 mac.m_buflen = mac32.m_buflen;
6d2010ae 1738 mac.m_string = mac32.m_string;
2d21ac55
A
1739 }
1740
1741 if (error)
1742 return (error);
1743
1744 error = mac_check_structmac_consistent(&mac);
1745 if (error)
1746 return (error);
1747
1748 MALLOC(elements, char *, mac.m_buflen, M_MACTEMP, M_WAITOK);
1749 error = copyinstr(mac.m_string, elements, mac.m_buflen, &ulen);
1750 if (error) {
1751 FREE(elements, M_MACTEMP);
1752 return (error);
1753 }
1754 AUDIT_ARG(mac_string, elements);
1755
1756 MALLOC(buffer, char *, mac.m_buflen, M_MACTEMP, M_WAITOK);
1757 error = fp_lookup(p, uap->fd, &fp, 0);
1758 if (error) {
1759 FREE(buffer, M_MACTEMP);
1760 FREE(elements, M_MACTEMP);
1761 return (error);
1762 }
1763
1764 my_cred = kauth_cred_proc_ref(p);
1765 error = mac_file_check_get(my_cred, fp->f_fglob, elements, mac.m_buflen);
1766 kauth_cred_unref(&my_cred);
1767 if (error) {
1768 fp_drop(p, uap->fd, fp, 0);
1769 FREE(buffer, M_MACTEMP);
1770 FREE(elements, M_MACTEMP);
1771 return (error);
1772 }
1773
1774 switch (fp->f_fglob->fg_type) {
1775 case DTYPE_VNODE:
2d21ac55 1776 intlabel = mac_vnode_label_alloc();
b0d623f7
A
1777 if (intlabel == NULL) {
1778 error = ENOMEM;
1779 break;
1780 }
2d21ac55 1781 vp = (struct vnode *)fp->f_fglob->fg_data;
2d21ac55
A
1782 error = vnode_getwithref(vp);
1783 if (error == 0) {
1784 mac_vnode_label_copy(vp->v_label, intlabel);
1785 error = mac_vnode_label_externalize(intlabel,
1786 elements, buffer,
1787 mac.m_buflen, M_WAITOK);
1788 vnode_put(vp);
1789 }
1790 mac_vnode_label_free(intlabel);
1791 break;
1792 case DTYPE_SOCKET:
1793#if CONFIG_MACF_SOCKET
1794 so = (struct socket *) fp->f_fglob->fg_data;
1795 intlabel = mac_socket_label_alloc(MAC_WAITOK);
1796 sock_lock(so, 1);
1797 mac_socket_label_copy(so->so_label, intlabel);
1798 sock_unlock(so, 1);
1799 error = mac_socket_label_externalize(intlabel, elements, buffer, mac.m_buflen);
1800 mac_socket_label_free(intlabel);
1801 break;
1802#endif
1803 case DTYPE_PSXSHM:
1804 case DTYPE_PSXSEM:
1805 case DTYPE_PIPE:
1806 case DTYPE_KQUEUE:
1807 case DTYPE_FSEVENTS:
1808 default:
1809 error = ENOSYS; // only sockets/vnodes so far
1810 break;
1811 }
1812 fp_drop(p, uap->fd, fp, 0);
1813
1814 if (error == 0)
1815 error = copyout(buffer, mac.m_string, strlen(buffer)+1);
1816
1817 FREE(buffer, M_MACTEMP);
1818 FREE(elements, M_MACTEMP);
1819 return (error);
1820}
1821
2d21ac55
A
1822static int
1823mac_get_filelink(proc_t p, user_addr_t mac_p, user_addr_t path_p, int follow)
1824{
1825 struct vnode *vp;
1826 vfs_context_t ctx;
1827 char *elements, *buffer;
1828 struct nameidata nd;
1829 struct label *intlabel;
1830 struct user_mac mac;
1831 int error;
1832 size_t ulen;
1833
1834 if (IS_64BIT_PROCESS(p)) {
6d2010ae
A
1835 struct user64_mac mac64;
1836 error = copyin(mac_p, &mac64, sizeof(mac64));
1837 mac.m_buflen = mac64.m_buflen;
1838 mac.m_string = mac64.m_string;
2d21ac55 1839 } else {
6d2010ae 1840 struct user32_mac mac32;
2d21ac55
A
1841 error = copyin(mac_p, &mac32, sizeof(mac32));
1842 mac.m_buflen = mac32.m_buflen;
6d2010ae 1843 mac.m_string = mac32.m_string;
2d21ac55
A
1844 }
1845
1846 if (error)
1847 return (error);
1848
1849 error = mac_check_structmac_consistent(&mac);
1850 if (error)
1851 return (error);
1852
1853 MALLOC(elements, char *, mac.m_buflen, M_MACTEMP, M_WAITOK);
b0d623f7
A
1854 MALLOC(buffer, char *, mac.m_buflen, M_MACTEMP, M_WAITOK | M_ZERO);
1855
2d21ac55
A
1856 error = copyinstr(mac.m_string, elements, mac.m_buflen, &ulen);
1857 if (error) {
b0d623f7 1858 FREE(buffer, M_MACTEMP);
2d21ac55
A
1859 FREE(elements, M_MACTEMP);
1860 return (error);
1861 }
1862 AUDIT_ARG(mac_string, elements);
1863
1864 ctx = vfs_context_current();
1865
6d2010ae 1866 NDINIT(&nd, LOOKUP, OP_LOOKUP,
2d21ac55
A
1867 LOCKLEAF | (follow ? FOLLOW : NOFOLLOW) | AUDITVNPATH1,
1868 UIO_USERSPACE, path_p, ctx);
1869 error = namei(&nd);
1870 if (error) {
b0d623f7 1871 FREE(buffer, M_MACTEMP);
2d21ac55
A
1872 FREE(elements, M_MACTEMP);
1873 return (error);
1874 }
1875 vp = nd.ni_vp;
1876
1877 nameidone(&nd);
1878
1879 intlabel = mac_vnode_label_alloc();
1880 mac_vnode_label_copy(vp->v_label, intlabel);
2d21ac55 1881 error = mac_vnode_label_externalize(intlabel, elements, buffer,
b0d623f7
A
1882 mac.m_buflen, M_WAITOK);
1883 mac_vnode_label_free(intlabel);
2d21ac55
A
1884 if (error == 0)
1885 error = copyout(buffer, mac.m_string, strlen(buffer) + 1);
2d21ac55
A
1886
1887 vnode_put(vp);
b0d623f7
A
1888
1889 FREE(buffer, M_MACTEMP);
1890 FREE(elements, M_MACTEMP);
2d21ac55
A
1891
1892 return (error);
1893}
1894
1895int
1896__mac_get_file(proc_t p, struct __mac_get_file_args *uap,
b0d623f7 1897 int *ret __unused)
2d21ac55
A
1898{
1899
1900 return (mac_get_filelink(p, uap->mac_p, uap->path_p, 1));
1901}
1902
1903int
1904__mac_get_link(proc_t p, struct __mac_get_link_args *uap,
b0d623f7 1905 int *ret __unused)
2d21ac55
A
1906{
1907
1908 return (mac_get_filelink(p, uap->mac_p, uap->path_p, 0));
1909}
1910
1911int
b0d623f7 1912__mac_set_fd(proc_t p, struct __mac_set_fd_args *uap, int *ret __unused)
2d21ac55
A
1913{
1914
1915 struct fileproc *fp;
1916 struct user_mac mac;
1917 struct vfs_context *ctx = vfs_context_current();
1918 int error;
1919 size_t ulen;
1920 char *buffer;
1921 struct label *intlabel;
1922#if CONFIG_MACF_SOCKET
1923 struct socket *so;
1924#endif
1925 struct vnode *vp;
1926
1927 AUDIT_ARG(fd, uap->fd);
1928
1929 if (IS_64BIT_PROCESS(p)) {
6d2010ae
A
1930 struct user64_mac mac64;
1931 error = copyin(uap->mac_p, &mac64, sizeof(mac64));
1932 mac.m_buflen = mac64.m_buflen;
1933 mac.m_string = mac64.m_string;
2d21ac55 1934 } else {
6d2010ae 1935 struct user32_mac mac32;
2d21ac55
A
1936 error = copyin(uap->mac_p, &mac32, sizeof(mac32));
1937 mac.m_buflen = mac32.m_buflen;
6d2010ae 1938 mac.m_string = mac32.m_string;
2d21ac55
A
1939 }
1940 if (error)
1941 return (error);
1942
1943 error = mac_check_structmac_consistent(&mac);
1944 if (error)
1945 return (error);
1946
1947 MALLOC(buffer, char *, mac.m_buflen, M_MACTEMP, M_WAITOK);
1948 error = copyinstr(mac.m_string, buffer, mac.m_buflen, &ulen);
1949 if (error) {
1950 FREE(buffer, M_MACTEMP);
1951 return (error);
1952 }
1953 AUDIT_ARG(mac_string, buffer);
1954
1955 error = fp_lookup(p, uap->fd, &fp, 0);
1956 if (error) {
1957 FREE(buffer, M_MACTEMP);
1958 return (error);
1959 }
1960
1961
1962 error = mac_file_check_set(vfs_context_ucred(ctx), fp->f_fglob, buffer, mac.m_buflen);
1963 if (error) {
1964 fp_drop(p, uap->fd, fp, 0);
1965 FREE(buffer, M_MACTEMP);
1966 return (error);
1967 }
1968
1969 switch (fp->f_fglob->fg_type) {
1970
1971 case DTYPE_VNODE:
b0d623f7
A
1972 if (mac_label_vnodes == 0) {
1973 error = ENOSYS;
1974 break;
1975 }
1976
2d21ac55
A
1977 intlabel = mac_vnode_label_alloc();
1978
1979 error = mac_vnode_label_internalize(intlabel, buffer);
1980 if (error) {
1981 mac_vnode_label_free(intlabel);
1982 break;
1983 }
1984
1985
1986 vp = (struct vnode *)fp->f_fglob->fg_data;
1987
1988 error = vnode_getwithref(vp);
1989 if (error == 0) {
1990 error = vn_setlabel(vp, intlabel, ctx);
1991 vnode_put(vp);
1992 }
1993 mac_vnode_label_free(intlabel);
1994 break;
1995
1996 case DTYPE_SOCKET:
1997#if CONFIG_MACF_SOCKET
1998 intlabel = mac_socket_label_alloc(MAC_WAITOK);
1999 error = mac_socket_label_internalize(intlabel, buffer);
2000 if (error == 0) {
2001 so = (struct socket *) fp->f_fglob->fg_data;
2002 SOCK_LOCK(so);
2003 error = mac_socket_label_update(vfs_context_ucred(ctx), so, intlabel);
2004 SOCK_UNLOCK(so);
2005 }
2006 mac_socket_label_free(intlabel);
2007 break;
2008#endif
2009 case DTYPE_PSXSHM:
2010 case DTYPE_PSXSEM:
2011 case DTYPE_PIPE:
2012 case DTYPE_KQUEUE:
2013 case DTYPE_FSEVENTS:
2014 default:
2015 error = ENOSYS; // only sockets/vnodes so far
2016 break;
2017 }
2018
2019 fp_drop(p, uap->fd, fp, 0);
2020 FREE(buffer, M_MACTEMP);
2021 return (error);
2022}
2023
2d21ac55
A
2024static int
2025mac_set_filelink(proc_t p, user_addr_t mac_p, user_addr_t path_p,
2026 int follow)
2027{
2028 register struct vnode *vp;
2029 struct vfs_context *ctx = vfs_context_current();
2030 struct label *intlabel;
2031 struct nameidata nd;
2032 struct user_mac mac;
2033 char *buffer;
2034 int error;
2035 size_t ulen;
2036
b0d623f7
A
2037 if (mac_label_vnodes == 0)
2038 return ENOSYS;
2039
2d21ac55 2040 if (IS_64BIT_PROCESS(p)) {
6d2010ae
A
2041 struct user64_mac mac64;
2042 error = copyin(mac_p, &mac64, sizeof(mac64));
2043 mac.m_buflen = mac64.m_buflen;
2044 mac.m_string = mac64.m_string;
2d21ac55 2045 } else {
6d2010ae 2046 struct user32_mac mac32;
2d21ac55
A
2047 error = copyin(mac_p, &mac32, sizeof(mac32));
2048 mac.m_buflen = mac32.m_buflen;
6d2010ae 2049 mac.m_string = mac32.m_string;
2d21ac55
A
2050 }
2051 if (error)
2052 return (error);
2053
2054 error = mac_check_structmac_consistent(&mac);
2055 if (error) {
2056 printf("mac_set_file: failed structure consistency check\n");
2057 return (error);
2058 }
2059
2060 MALLOC(buffer, char *, mac.m_buflen, M_MACTEMP, M_WAITOK);
2061 error = copyinstr(mac.m_string, buffer, mac.m_buflen, &ulen);
2062 if (error) {
2063 FREE(buffer, M_MACTEMP);
2064 return (error);
2065 }
2066 AUDIT_ARG(mac_string, buffer);
2067
2068 intlabel = mac_vnode_label_alloc();
2069 error = mac_vnode_label_internalize(intlabel, buffer);
2070 FREE(buffer, M_MACTEMP);
2071 if (error) {
2072 mac_vnode_label_free(intlabel);
2073 return (error);
2074 }
2075
6d2010ae 2076 NDINIT(&nd, LOOKUP, OP_LOOKUP,
2d21ac55
A
2077 LOCKLEAF | (follow ? FOLLOW : NOFOLLOW) | AUDITVNPATH1,
2078 UIO_USERSPACE, path_p, ctx);
2079 error = namei(&nd);
2080 if (error) {
2081 mac_vnode_label_free(intlabel);
2082 return (error);
2083 }
2084 vp = nd.ni_vp;
2085
2086 nameidone(&nd);
2087
2088 error = vn_setlabel(vp, intlabel, ctx);
2089 vnode_put(vp);
2090 mac_vnode_label_free(intlabel);
2091
2092 return (error);
2093}
2094
2095int
2096__mac_set_file(proc_t p, struct __mac_set_file_args *uap,
b0d623f7 2097 int *ret __unused)
2d21ac55
A
2098{
2099
2100 return (mac_set_filelink(p, uap->mac_p, uap->path_p, 1));
2101}
2102
2103int
2104__mac_set_link(proc_t p, struct __mac_set_link_args *uap,
b0d623f7 2105 int *ret __unused)
2d21ac55
A
2106{
2107
2108 return (mac_set_filelink(p, uap->mac_p, uap->path_p, 0));
2109}
2110
2111/*
b0d623f7
A
2112 * __mac_syscall: Perform a MAC policy system call
2113 *
2114 * Parameters: p Process calling this routine
2115 * uap User argument descriptor (see below)
2116 * retv (Unused)
2117 *
2118 * Indirect: uap->policy Name of target MAC policy
2119 * uap->call MAC policy-specific system call to perform
2120 * uap->arg MAC policy-specific system call arguments
2121 *
2122 * Returns: 0 Success
2123 * !0 Not success
2124 *
2d21ac55 2125 */
2d21ac55 2126int
b0d623f7 2127__mac_syscall(proc_t p, struct __mac_syscall_args *uap, int *retv __unused)
2d21ac55
A
2128{
2129 struct mac_policy_conf *mpc;
2130 char target[MAC_MAX_POLICY_NAME];
2131 int error;
2132 u_int i;
2133 size_t ulen;
2134
2135 error = copyinstr(uap->policy, target, sizeof(target), &ulen);
2136 if (error)
2137 return (error);
b0d623f7 2138 AUDIT_ARG(value32, uap->call);
2d21ac55
A
2139 AUDIT_ARG(mac_string, target);
2140
2141 error = ENOPOLICY;
2142
2143 for (i = 0; i < mac_policy_list.staticmax; i++) {
2144 mpc = mac_policy_list.entries[i].mpc;
2145 if (mpc == NULL)
2146 continue;
2147
2148 if (strcmp(mpc->mpc_name, target) == 0 &&
2149 mpc->mpc_ops->mpo_policy_syscall != NULL) {
2150 error = mpc->mpc_ops->mpo_policy_syscall(p,
2151 uap->call, uap->arg);
2152 goto done;
2153 }
2154 }
2155 if (mac_policy_list_conditional_busy() != 0) {
2156 for (; i <= mac_policy_list.maxindex; i++) {
2157 mpc = mac_policy_list.entries[i].mpc;
2158 if (mpc == NULL)
2159 continue;
2160
2161 if (strcmp(mpc->mpc_name, target) == 0 &&
2162 mpc->mpc_ops->mpo_policy_syscall != NULL) {
2163 error = mpc->mpc_ops->mpo_policy_syscall(p,
2164 uap->call, uap->arg);
2165 break;
2166 }
2167 }
2168 mac_policy_list_unbusy();
2169 }
2170
2171done:
2172 return (error);
2173}
2174
2175int
2176mac_mount_label_get(struct mount *mp, user_addr_t mac_p)
2177{
2178 char *elements, *buffer;
2179 struct label *label;
2180 struct user_mac mac;
2181 int error;
2182 size_t ulen;
2183
2184 if (IS_64BIT_PROCESS(current_proc())) {
6d2010ae
A
2185 struct user64_mac mac64;
2186 error = copyin(mac_p, &mac64, sizeof(mac64));
2187 mac.m_buflen = mac64.m_buflen;
2188 mac.m_string = mac64.m_string;
2d21ac55 2189 } else {
6d2010ae 2190 struct user32_mac mac32;
2d21ac55
A
2191 error = copyin(mac_p, &mac32, sizeof(mac32));
2192 mac.m_buflen = mac32.m_buflen;
6d2010ae 2193 mac.m_string = mac32.m_string;
2d21ac55
A
2194 }
2195 if (error)
2196 return (error);
2197
2198 error = mac_check_structmac_consistent(&mac);
2199 if (error)
2200 return (error);
2201
2202 MALLOC(elements, char *, mac.m_buflen, M_MACTEMP, M_WAITOK);
2203 error = copyinstr(mac.m_string, elements, mac.m_buflen, &ulen);
2204 if (error) {
2205 FREE(elements, M_MACTEMP);
2206 return (error);
2207 }
2208 AUDIT_ARG(mac_string, elements);
2209
2210 label = mp->mnt_mntlabel;
2211 MALLOC(buffer, char *, mac.m_buflen, M_MACTEMP, M_WAITOK | M_ZERO);
2212 error = mac_mount_label_externalize(label, elements, buffer,
2213 mac.m_buflen);
2214 FREE(elements, M_MACTEMP);
2215
2216 if (error == 0)
2217 error = copyout(buffer, mac.m_string, strlen(buffer) + 1);
2218 FREE(buffer, M_MACTEMP);
2219
2220 return (error);
2221}
2222
b0d623f7
A
2223/*
2224 * __mac_get_mount: Get mount point label information for a given pathname
2225 *
2226 * Parameters: p (ignored)
2227 * uap User argument descriptor (see below)
2228 * ret (ignored)
2229 *
2230 * Indirect: uap->path Pathname
2231 * uap->mac_p MAC info
2232 *
2233 * Returns: 0 Success
2234 * !0 Not success
2235 */
2d21ac55
A
2236int
2237__mac_get_mount(proc_t p __unused, struct __mac_get_mount_args *uap,
b0d623f7 2238 int *ret __unused)
2d21ac55
A
2239{
2240 struct nameidata nd;
2241 struct vfs_context *ctx = vfs_context_current();
2242 struct mount *mp;
2243 int error;
2244
6d2010ae 2245 NDINIT(&nd, LOOKUP, OP_LOOKUP, FOLLOW | AUDITVNPATH1,
2d21ac55
A
2246 UIO_USERSPACE, uap->path, ctx);
2247 error = namei(&nd);
2248 if (error) {
2249 return (error);
2250 }
2251 mp = nd.ni_vp->v_mount;
2252 nameidone(&nd);
2253
2254 return mac_mount_label_get(mp, uap->mac_p);
2255}
2256
2257#else /* MAC */
2258
2259int
2260mac_policy_register(struct mac_policy_conf *mpc __unused,
2261 mac_policy_handle_t *handlep __unused, void *xd __unused)
2262{
2263
2264 return (0);
2265}
2266
2267int
2268mac_policy_unregister(mac_policy_handle_t handle __unused)
2269{
2270
2271 return (0);
2272}
2273
2274int
2275mac_audit_text(char *text __unused, mac_policy_handle_t handle __unused)
2276{
2277
2278 return (0);
2279}
2280
2281int
2282mac_mount_label_get(struct mount *mp __unused, user_addr_t mac_p __unused)
2283{
2284 return (ENOSYS);
2285}
2286
2287int
2288mac_vnop_setxattr(struct vnode *vp __unused, const char *name __unused, char *buf __unused, size_t len __unused)
2289{
2290
2291 return (ENOENT);
2292}
2293
2294int
2295mac_vnop_getxattr(struct vnode *vp __unused, const char *name __unused,
2296 char *buf __unused, size_t len __unused, size_t *attrlen __unused)
2297{
2298
2299 return (ENOENT);
2300}
2301
2302int
2303mac_vnop_removexattr(struct vnode *vp __unused, const char *name __unused)
2304{
2305
2306 return (ENOENT);
2307}
2308
2309int
b0d623f7 2310__mac_get_pid(proc_t p __unused, struct __mac_get_pid_args *uap __unused, int *ret __unused)
2d21ac55
A
2311{
2312
2313 return (ENOSYS);
2314}
2315
2316int
b0d623f7 2317__mac_get_proc(proc_t p __unused, struct __mac_get_proc_args *uap __unused, int *ret __unused)
2d21ac55
A
2318{
2319
2320 return (ENOSYS);
2321}
2322
2323int
b0d623f7 2324__mac_set_proc(proc_t p __unused, struct __mac_set_proc_args *uap __unused, int *ret __unused)
2d21ac55
A
2325{
2326
2327 return (ENOSYS);
2328}
2329
2330int
b0d623f7 2331__mac_get_file(proc_t p __unused, struct __mac_get_file_args *uap __unused, int *ret __unused)
2d21ac55
A
2332{
2333
2334 return (ENOSYS);
2335}
2336
2337int
b0d623f7 2338__mac_get_link(proc_t p __unused, struct __mac_get_link_args *uap __unused, int *ret __unused)
2d21ac55
A
2339{
2340
2341 return (ENOSYS);
2342}
2343
2344int
b0d623f7 2345__mac_set_file(proc_t p __unused, struct __mac_set_file_args *uap __unused, int *ret __unused)
2d21ac55
A
2346{
2347
2348 return (ENOSYS);
2349}
2350
2351int
b0d623f7 2352__mac_set_link(proc_t p __unused, struct __mac_set_link_args *uap __unused, int *ret __unused)
2d21ac55
A
2353{
2354
2355 return (ENOSYS);
2356}
2357
2358int
b0d623f7 2359__mac_get_fd(proc_t p __unused, struct __mac_get_fd_args *uap __unused, int *ret __unused)
2d21ac55
A
2360{
2361
2362 return (ENOSYS);
2363}
2364
2365int
b0d623f7 2366__mac_set_fd(proc_t p __unused, struct __mac_set_fd_args *uap __unused, int *ret __unused)
2d21ac55
A
2367{
2368
2369 return (ENOSYS);
2370}
2371
2372int
b0d623f7 2373__mac_syscall(proc_t p __unused, struct __mac_syscall_args *uap __unused, int *ret __unused)
2d21ac55
A
2374{
2375
2376 return (ENOSYS);
2377}
2378
2379int
b0d623f7 2380__mac_get_lcid(proc_t p __unused, struct __mac_get_lcid_args *uap __unused, int *ret __unused)
2d21ac55
A
2381{
2382
2383 return (ENOSYS);
2384}
2385
2386int
b0d623f7 2387__mac_get_lctx(proc_t p __unused, struct __mac_get_lctx_args *uap __unused, int *ret __unused)
2d21ac55
A
2388{
2389
2390 return (ENOSYS);
2391}
2392
2393int
b0d623f7 2394__mac_set_lctx(proc_t p __unused, struct __mac_set_lctx_args *uap __unused, int *ret __unused)
2d21ac55
A
2395{
2396
2397 return (ENOSYS);
2398}
2399
2400int
2401__mac_get_mount(proc_t p __unused,
b0d623f7 2402 struct __mac_get_mount_args *uap __unused, int *ret __unused)
2d21ac55
A
2403{
2404
2405 return (ENOSYS);
2406}
2407#endif /* !MAC */