security/mac_net.c

   1 /*
   2  * Copyright (c) 2007 Apple Inc. All rights reserved.
   3  *
   4  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. The rights granted to you under the License
  10  * may not be used to create, or enable the creation or redistribution of,
  11  * unlawful or unlicensed copies of an Apple operating system, or to
  12  * circumvent, violate, or enable the circumvention or violation of, any
  13  * terms of an Apple operating system software license agreement.
  14  *
  15  * Please obtain a copy of the License at
  16  * http://www.opensource.apple.com/apsl/ and read it before using this file.
  17  *
  18  * The Original Code and all software distributed under the License are
  19  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  20  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  21  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  22  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  23  * Please see the License for the specific language governing rights and
  24  * limitations under the License.
  25  *
  26  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
  27  */
  28 /*-
  29  * Copyright (c) 1999-2002 Robert N. M. Watson
  30  * Copyright (c) 2001 Ilmar S. Habibulin
  31  * Copyright (c) 2001-2004 Networks Associates Technology, Inc.
  32  * Copyright (c) 2006 SPARTA, Inc.
  33  * All rights reserved.
  34  *
  35  * This software was developed by Robert Watson and Ilmar Habibulin for the
  36  * TrustedBSD Project.
  37  *
  38  * This software was developed for the FreeBSD Project in part by Network
  39  * Associates Laboratories, the Security Research Division of Network
  40  * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"),
  41  * as part of the DARPA CHATS research program.
  42  *
  43  * This software was enhanced by SPARTA ISSO under SPAWAR contract
  44  * N66001-04-C-6019 ("SEFOS").
  45  *
  46  * Redistribution and use in source and binary forms, with or without
  47  * modification, are permitted provided that the following conditions
  48  * are met:
  49  * 1. Redistributions of source code must retain the above copyright
  50  *    notice, this list of conditions and the following disclaimer.
  51  * 2. Redistributions in binary form must reproduce the above copyright
  52  *    notice, this list of conditions and the following disclaimer in the
  53  *    documentation and/or other materials provided with the distribution.
  54  *
  55  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  56  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  57  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  58  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  59  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  60  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  61  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  62  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  63  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  64  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  65  * SUCH DAMAGE.
  66  */
  67
  68 #include <sys/param.h>
  69 #include <sys/kernel.h>
  70 #include <sys/mbuf.h>
  71
  72 #include <net/bpf.h>
  73 #include <net/if.h>
  74
  75 #include <bsd/bsm/audit.h>
  76 #include <bsd/security/audit/audit.h>
  77
  78 #include <security/mac_internal.h>
  79
  80 struct label *
  81 mac_mbuf_to_label(struct mbuf *mbuf)
  82 {
  83         struct m_tag *tag;
  84         struct label *label;
  85
  86         if (mbuf == NULL) {
  87                 return NULL;
  88         }
  89
  90         if ((mbuf->m_flags & M_PKTHDR) == 0) {
  91                 printf("%s() got non-header MBUF!\n", __func__);
  92                 return NULL;
  93         }
  94
  95         tag = m_tag_locate(mbuf, KERNEL_MODULE_TAG_ID, KERNEL_TAG_TYPE_MACLABEL,
  96             NULL);
  97         if (tag == NULL) {
  98                 printf("%s() m_tag_locate() returned NULL! (m->flags %04x)\n",
  99                     __func__, mbuf->m_flags);
 100                 return NULL;
 101         }
 102         label = (struct label *)(tag + 1);
 103         return label;
 104 }
 105
 106 static struct label *
 107 mac_bpfdesc_label_alloc(void)
 108 {
 109         struct label *label;
 110
 111         label = mac_labelzone_alloc(M_WAITOK);
 112         if (label == NULL) {
 113                 return NULL;
 114         }
 115         MAC_PERFORM(bpfdesc_label_init, label);
 116         return label;
 117 }
 118
 119 void
 120 mac_bpfdesc_label_init(struct bpf_d *bpf_d)
 121 {
 122         struct label *label;
 123
 124         label = mac_bpfdesc_label_alloc();
 125         mac_bpfdesc_label_set(bpf_d, label);
 126 }
 127
 128 static struct label *
 129 mac_ifnet_label_alloc(void)
 130 {
 131         struct label *label;
 132
 133         label = mac_labelzone_alloc(M_WAITOK);
 134         if (label == NULL) {
 135                 return NULL;
 136         }
 137         MAC_PERFORM(ifnet_label_init, label);
 138         return label;
 139 }
 140
 141 void
 142 mac_ifnet_label_init(struct ifnet *ifp)
 143 {
 144         ifp->if_label = mac_ifnet_label_alloc();
 145 }
 146
 147 /*
 148  * On failure, caller should cleanup with m_tag_free().
 149  */
 150 int
 151 mac_mbuf_tag_init(struct m_tag *tag, int flag)
 152 {
 153         struct label *label;
 154         int error;
 155
 156         label = (struct label *) (tag + 1);
 157         mac_label_init(label);
 158
 159         MAC_CHECK(mbuf_label_init, label, flag);
 160         if (error) {
 161                 printf("%s(): mpo_mbuf_label_init() failed!\n", __func__);
 162         }
 163
 164         return error;
 165 }
 166
 167 static void
 168 mac_bpfdesc_label_free(struct label *label)
 169 {
 170         MAC_PERFORM(bpfdesc_label_destroy, label);
 171         mac_labelzone_free(label);
 172 }
 173
 174 void
 175 mac_bpfdesc_label_destroy(struct bpf_d *bpf_d)
 176 {
 177         struct label *label;
 178
 179         label = mac_bpfdesc_label_get(bpf_d);
 180         mac_bpfdesc_label_free(label);
 181         mac_bpfdesc_label_set(bpf_d, NULL);
 182 }
 183
 184 static void
 185 mac_ifnet_label_free(struct label *label)
 186 {
 187         MAC_PERFORM(ifnet_label_destroy, label);
 188         mac_labelzone_free(label);
 189 }
 190
 191 void
 192 mac_ifnet_label_destroy(struct ifnet *ifp)
 193 {
 194         mac_ifnet_label_free(ifp->if_label);
 195         ifp->if_label = NULL;
 196 }
 197
 198 void
 199 mac_ifnet_label_recycle(struct ifnet *ifp)
 200 {
 201         MAC_PERFORM(ifnet_label_recycle, ifp->if_label);
 202 }
 203
 204 void
 205 mac_mbuf_tag_destroy(struct m_tag *tag)
 206 {
 207         struct label *label;
 208
 209         label = (struct label *)(tag + 1);
 210         MAC_PERFORM(mbuf_label_destroy, label);
 211         mac_label_destroy(label);
 212
 213         return;
 214 }
 215
 216 void
 217 mac_mbuf_tag_copy(struct m_tag *src, struct m_tag *dest)
 218 {
 219         struct label *src_label, *dest_label;
 220
 221         src_label = (struct label *)(src + 1);
 222         dest_label = (struct label *)(dest + 1);
 223
 224         if (src_label == NULL || dest_label == NULL) {
 225                 return;
 226         }
 227
 228         /*
 229          * mac_mbuf_tag_init() is called on the target tag
 230          * in m_tag_copy(), so we don't need to call it here.
 231          */
 232         MAC_PERFORM(mbuf_label_copy, src_label, dest_label);
 233
 234         return;
 235 }
 236
 237 void
 238 mac_mbuf_label_copy(struct mbuf *m_from, struct mbuf *m_to)
 239 {
 240         struct label *src_label, *dest_label;
 241
 242         src_label = mac_mbuf_to_label(m_from);
 243         dest_label = mac_mbuf_to_label(m_to);
 244
 245         MAC_PERFORM(mbuf_label_copy, src_label, dest_label);
 246 }
 247
 248 static void
 249 mac_ifnet_label_copy(struct label *src, struct label *dest)
 250 {
 251         MAC_PERFORM(ifnet_label_copy, src, dest);
 252 }
 253
 254 static int
 255 mac_ifnet_label_externalize(struct label *label, char *elements,
 256     char *outbuf, size_t outbuflen)
 257 {
 258         return MAC_EXTERNALIZE(ifnet, label, elements, outbuf, outbuflen);
 259 }
 260
 261 static int
 262 mac_ifnet_label_internalize(struct label *label, char *string)
 263 {
 264         return MAC_INTERNALIZE(ifnet, label, string);
 265 }
 266
 267 void
 268 mac_ifnet_label_associate(struct ifnet *ifp)
 269 {
 270         MAC_PERFORM(ifnet_label_associate, ifp, ifp->if_label);
 271 }
 272
 273 void
 274 mac_bpfdesc_label_associate(struct ucred *cred, struct bpf_d *bpf_d)
 275 {
 276         struct label *label;
 277
 278         label = mac_bpfdesc_label_get(bpf_d);
 279         MAC_PERFORM(bpfdesc_label_associate, cred, bpf_d, label);
 280 }
 281
 282 int
 283 mac_bpfdesc_check_receive(struct bpf_d *bpf_d, struct ifnet *ifp)
 284 {
 285         struct label *label;
 286         int error;
 287
 288         label = mac_bpfdesc_label_get(bpf_d);
 289         ifnet_lock_shared(ifp);
 290         MAC_CHECK(bpfdesc_check_receive, bpf_d, label, ifp,
 291             ifp->if_label);
 292         ifnet_lock_done(ifp);
 293
 294         return error;
 295 }
 296
 297 int
 298 mac_mbuf_label_init(struct mbuf *m, int flag)
 299 {
 300         struct m_tag *tag;
 301         int error;
 302
 303         if (mac_label_mbufs == 0) {
 304                 return 0;
 305         }
 306
 307         tag = m_tag_create(KERNEL_MODULE_TAG_ID, KERNEL_TAG_TYPE_MACLABEL,
 308             sizeof(struct label), flag, m);
 309         if (tag == NULL) {
 310                 printf("%s(): m_tag_alloc() failed!\n", __func__);
 311                 return ENOBUFS;
 312         }
 313         error = mac_mbuf_tag_init(tag, flag);
 314         if (error) {
 315                 printf("%s(): mac_mbuf_tag_init() failed!\n", __func__);
 316                 m_tag_free(tag);
 317                 return error;
 318         }
 319         m_tag_prepend(m, tag);
 320         return 0;
 321 }
 322
 323 void
 324 mac_mbuf_label_associate_bpfdesc(struct bpf_d *bpf_d, struct mbuf *mbuf)
 325 {
 326         struct label *m_label, *b_label;
 327
 328         /* bpf_d must be locked */
 329
 330         m_label = mac_mbuf_to_label(mbuf);
 331         b_label = mac_bpfdesc_label_get(bpf_d);
 332
 333         MAC_PERFORM(mbuf_label_associate_bpfdesc, bpf_d, b_label, mbuf,
 334             m_label);
 335 }
 336
 337 void
 338 mac_mbuf_label_associate_ifnet(struct ifnet *ifp, struct mbuf *mbuf)
 339 {
 340         struct label *m_label;
 341
 342         /* ifp must be locked */
 343
 344         m_label = mac_mbuf_to_label(mbuf);
 345
 346         MAC_PERFORM(mbuf_label_associate_ifnet, ifp, ifp->if_label, mbuf,
 347             m_label);
 348 }
 349
 350 void
 351 mac_mbuf_label_associate_linklayer(struct ifnet *ifp, struct mbuf *mbuf)
 352 {
 353         struct label *m_label;
 354
 355         /* ifp must be locked */
 356
 357         m_label = mac_mbuf_to_label(mbuf);
 358
 359         MAC_PERFORM(mbuf_label_associate_linklayer, ifp, ifp->if_label, mbuf,
 360             m_label);
 361 }
 362
 363 void
 364 mac_mbuf_label_associate_multicast_encap(struct mbuf *oldmbuf,
 365     struct ifnet *ifp, struct mbuf *newmbuf)
 366 {
 367         struct label *oldmbuflabel, *newmbuflabel;
 368
 369         oldmbuflabel = mac_mbuf_to_label(oldmbuf);
 370         newmbuflabel = mac_mbuf_to_label(newmbuf);
 371
 372         /* ifp must be locked */
 373
 374         MAC_PERFORM(mbuf_label_associate_multicast_encap, oldmbuf, oldmbuflabel,
 375             ifp, ifp->if_label, newmbuf, newmbuflabel);
 376 }
 377
 378 void
 379 mac_mbuf_label_associate_netlayer(struct mbuf *oldmbuf, struct mbuf *newmbuf)
 380 {
 381         struct label *oldmbuflabel, *newmbuflabel;
 382
 383         oldmbuflabel = mac_mbuf_to_label(oldmbuf);
 384         newmbuflabel = mac_mbuf_to_label(newmbuf);
 385
 386         MAC_PERFORM(mbuf_label_associate_netlayer, oldmbuf, oldmbuflabel,
 387             newmbuf, newmbuflabel);
 388 }
 389
 390 void
 391 mac_mbuf_label_associate_socket(struct socket *socket, struct mbuf *mbuf)
 392 {
 393         struct label *label;
 394         struct xsocket xso;
 395
 396         /* socket must be locked */
 397
 398         label = mac_mbuf_to_label(mbuf);
 399
 400         sotoxsocket(socket, &xso);
 401         MAC_PERFORM(mbuf_label_associate_socket, &xso, socket->so_label,
 402             mbuf, label);
 403 }
 404
 405 int
 406 mac_ifnet_check_transmit(struct ifnet *ifp, struct mbuf *mbuf, int family,
 407     int type)
 408 {
 409         struct label *label;
 410         int error;
 411
 412         label = mac_mbuf_to_label(mbuf);
 413
 414         ifnet_lock_shared(ifp);
 415         MAC_CHECK(ifnet_check_transmit, ifp, ifp->if_label, mbuf, label,
 416             family, type);
 417         ifnet_lock_done(ifp);
 418
 419         return error;
 420 }
 421
 422 int
 423 mac_ifnet_label_get(__unused struct ucred *cred, struct ifreq *ifr,
 424     struct ifnet *ifp)
 425 {
 426         char *elements, *buffer;
 427         struct label *intlabel;
 428         struct mac mac;
 429         int error;
 430         size_t len;
 431
 432         error = copyin(CAST_USER_ADDR_T(ifr->ifr_ifru.ifru_data),
 433             &mac, sizeof(mac));
 434         if (error) {
 435                 return error;
 436         }
 437
 438         error = mac_check_structmac_consistent(&mac);
 439         if (error) {
 440                 return error;
 441         }
 442
 443         MALLOC(elements, char *, mac.m_buflen, M_MACTEMP, M_WAITOK);
 444         error = copyinstr(CAST_USER_ADDR_T(mac.m_string), elements,
 445             mac.m_buflen, &len);
 446         if (error) {
 447                 FREE(elements, M_MACTEMP);
 448                 return error;
 449         }
 450         AUDIT_ARG(mac_string, elements);
 451
 452         MALLOC(buffer, char *, mac.m_buflen, M_MACTEMP, M_WAITOK | M_ZERO);
 453         intlabel = mac_ifnet_label_alloc();
 454         ifnet_lock_shared(ifp);
 455         mac_ifnet_label_copy(ifp->if_label, intlabel);
 456         ifnet_lock_done(ifp);
 457         error = mac_ifnet_label_externalize(intlabel, elements,
 458             buffer, mac.m_buflen);
 459         mac_ifnet_label_free(intlabel);
 460         FREE(elements, M_MACTEMP);
 461
 462         if (error == 0) {
 463                 error = copyout(buffer, CAST_USER_ADDR_T(mac.m_string),
 464                     strlen(buffer) + 1);
 465         }
 466         FREE(buffer, M_MACTEMP);
 467
 468         return error;
 469 }
 470
 471 int
 472 mac_ifnet_label_set(struct ucred *cred, struct ifreq *ifr,
 473     struct ifnet *ifp)
 474 {
 475         struct label *intlabel;
 476         struct mac mac;
 477         char *buffer;
 478         int error;
 479         size_t len;
 480
 481         error = copyin(CAST_USER_ADDR_T(ifr->ifr_ifru.ifru_data),
 482             &mac, sizeof(mac));
 483         if (error) {
 484                 return error;
 485         }
 486
 487         error = mac_check_structmac_consistent(&mac);
 488         if (error) {
 489                 return error;
 490         }
 491
 492         MALLOC(buffer, char *, mac.m_buflen, M_MACTEMP, M_WAITOK);
 493         error = copyinstr(CAST_USER_ADDR_T(mac.m_string), buffer,
 494             mac.m_buflen, &len);
 495         if (error) {
 496                 FREE(buffer, M_MACTEMP);
 497                 return error;
 498         }
 499         AUDIT_ARG(mac_string, buffer);
 500
 501         intlabel = mac_ifnet_label_alloc();
 502         error = mac_ifnet_label_internalize(intlabel, buffer);
 503         FREE(buffer, M_MACTEMP);
 504         if (error) {
 505                 mac_ifnet_label_free(intlabel);
 506                 return error;
 507         }
 508
 509         /*
 510          * XXX: Note that this is a redundant privilege check, since
 511          * policies impose this check themselves if required by the
 512          * policy.  Eventually, this should go away.
 513          */
 514         error = suser(cred, NULL);
 515         if (error) {
 516                 mac_ifnet_label_free(intlabel);
 517                 return error;
 518         }
 519
 520         ifnet_lock_exclusive(ifp);
 521         MAC_CHECK(ifnet_check_label_update, cred, ifp, ifp->if_label,
 522             intlabel);
 523         if (error) {
 524                 ifnet_lock_done(ifp);
 525                 mac_ifnet_label_free(intlabel);
 526                 return error;
 527         }
 528
 529         MAC_PERFORM(ifnet_label_update, cred, ifp, ifp->if_label, intlabel);
 530         ifnet_lock_done(ifp);
 531         mac_ifnet_label_free(intlabel);
 532
 533         return 0;
 534 }