security/mac_audit.c

   1 /*
   2  * Copyright (c) 2006-2007 Apple Inc. All rights reserved.
   3  *
   4  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. The rights granted to you under the License
  10  * may not be used to create, or enable the creation or redistribution of,
  11  * unlawful or unlicensed copies of an Apple operating system, or to
  12  * circumvent, violate, or enable the circumvention or violation of, any
  13  * terms of an Apple operating system software license agreement.
  14  *
  15  * Please obtain a copy of the License at
  16  * http://www.opensource.apple.com/apsl/ and read it before using this file.
  17  *
  18  * The Original Code and all software distributed under the License are
  19  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  20  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  21  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  22  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  23  * Please see the License for the specific language governing rights and
  24  * limitations under the License.
  25  *
  26  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
  27  */
  28 /*
  29  * Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson
  30  * Copyright (c) 2001 Ilmar S. Habibulin
  31  * Copyright (c) 2001, 2002, 2003, 2004 Networks Associates Technology, Inc.
  32  *
  33  * This software was developed by Robert Watson and Ilmar Habibulin for the
  34  * TrustedBSD Project.
  35  *
  36  * This software was developed for the FreeBSD Project in part by Network
  37  * Associates Laboratories, the Security Research Division of Network
  38  * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"),
  39  * as part of the DARPA CHATS research program.
  40  *
  41  * Redistribution and use in source and binary forms, with or without
  42  * modification, are permitted provided that the following conditions
  43  * are met:
  44  * 1. Redistributions of source code must retain the above copyright
  45  *    notice, this list of conditions and the following disclaimer.
  46  * 2. Redistributions in binary form must reproduce the above copyright
  47  *    notice, this list of conditions and the following disclaimer in the
  48  *    documentation and/or other materials provided with the distribution.
  49  *
  50  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  51  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  52  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  53  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  54  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  55  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  56  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  57  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  58  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  59  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  60  * SUCH DAMAGE.
  61  *
  62  */
  63 #include <sys/param.h>
  64 #include <sys/types.h>
  65 #include <sys/vnode.h>
  66 #include <sys/vnode_internal.h>
  67 #include <sys/kauth.h>
  68 #include <sys/queue.h>
  69 #include <security/mac_internal.h>
  70 #include <bsd/bsm/audit.h>
  71 #include <bsd/security/audit/audit.h>
  72 #include <bsd/sys/malloc.h>
  73 #include <vm/vm_kern.h>
  74 #include <kern/kalloc.h>
  75 #include <kern/zalloc.h>
  76
  77 #if CONFIG_AUDIT
  78
  79 /* The zone allocator is initialized in mac_base.c. */
  80 zone_t mac_audit_data_zone;
  81
  82 int
  83 mac_system_check_audit(struct ucred *cred, void *record, int length)
  84 {
  85         int error;
  86
  87         MAC_CHECK(system_check_audit, cred, record, length);
  88
  89         return error;
  90 }
  91
  92 int
  93 mac_system_check_auditon(struct ucred *cred, int cmd)
  94 {
  95         int error;
  96
  97         MAC_CHECK(system_check_auditon, cred, cmd);
  98
  99         return error;
 100 }
 101
 102 int
 103 mac_system_check_auditctl(struct ucred *cred, struct vnode *vp)
 104 {
 105         int error;
 106         struct label *vl = vp ? vp->v_label : NULL;
 107
 108         MAC_CHECK(system_check_auditctl, cred, vp, vl);
 109
 110         return error;
 111 }
 112
 113 int
 114 mac_proc_check_getauid(struct proc *curp)
 115 {
 116         kauth_cred_t cred;
 117         int error;
 118
 119 #if SECURITY_MAC_CHECK_ENFORCE
 120         /* 21167099 - only check if we allow write */
 121         if (!mac_proc_enforce) {
 122                 return 0;
 123         }
 124 #endif
 125
 126         if (!mac_proc_check_enforce(curp)) {
 127                 return 0;
 128         }
 129
 130         cred = kauth_cred_proc_ref(curp);
 131         MAC_CHECK(proc_check_getauid, cred);
 132         kauth_cred_unref(&cred);
 133
 134         return error;
 135 }
 136
 137 int
 138 mac_proc_check_setauid(struct proc *curp, uid_t auid)
 139 {
 140         kauth_cred_t cred;
 141         int error;
 142
 143 #if SECURITY_MAC_CHECK_ENFORCE
 144         /* 21167099 - only check if we allow write */
 145         if (!mac_proc_enforce) {
 146                 return 0;
 147         }
 148 #endif
 149         if (!mac_proc_check_enforce(curp)) {
 150                 return 0;
 151         }
 152
 153         cred = kauth_cred_proc_ref(curp);
 154         MAC_CHECK(proc_check_setauid, cred, auid);
 155         kauth_cred_unref(&cred);
 156
 157         return error;
 158 }
 159
 160 int
 161 mac_proc_check_getaudit(struct proc *curp)
 162 {
 163         kauth_cred_t cred;
 164         int error;
 165
 166 #if SECURITY_MAC_CHECK_ENFORCE
 167         /* 21167099 - only check if we allow write */
 168         if (!mac_proc_enforce) {
 169                 return 0;
 170         }
 171 #endif
 172         if (!mac_proc_check_enforce(curp)) {
 173                 return 0;
 174         }
 175
 176         cred = kauth_cred_proc_ref(curp);
 177         MAC_CHECK(proc_check_getaudit, cred);
 178         kauth_cred_unref(&cred);
 179
 180         return error;
 181 }
 182
 183 int
 184 mac_proc_check_setaudit(struct proc *curp, struct auditinfo_addr *ai)
 185 {
 186         kauth_cred_t cred;
 187         int error;
 188
 189 #if SECURITY_MAC_CHECK_ENFORCE
 190         /* 21167099 - only check if we allow write */
 191         if (!mac_proc_enforce) {
 192                 return 0;
 193         }
 194 #endif
 195         if (!mac_proc_check_enforce(curp)) {
 196                 return 0;
 197         }
 198
 199         cred = kauth_cred_proc_ref(curp);
 200         MAC_CHECK(proc_check_setaudit, cred, ai);
 201         kauth_cred_unref(&cred);
 202
 203         return error;
 204 }
 205
 206 #if 0
 207 /*
 208  * This is the framework entry point for MAC policies to use to add
 209  * arbitrary data to the current audit record.
 210  * (Currently not supported, as no existing audit viewers would
 211  * display this format)
 212  *
 213  */
 214 int
 215 mac_audit_data(int len, u_char *data, mac_policy_handle_t handle)
 216 {
 217         char *sanitized;
 218
 219         if ((len <= 0) || (len > MAC_AUDIT_DATA_LIMIT)) {
 220                 return EINVAL;
 221         }
 222
 223         sanitized = (char *)zalloc(mac_audit_data_zone);
 224
 225         bcopy(data, sanitized, len);
 226         return audit_mac_data(MAC_AUDIT_DATA_TYPE, len, sanitized);
 227 }
 228 #endif
 229
 230 /*
 231  * This is the entry point a MAC policy will call to add NULL-
 232  * terminated ASCII text to the current audit record.
 233  */
 234 int
 235 mac_audit_text(char *text, mac_policy_handle_t handle)
 236 {
 237         char *sanitized;
 238         const char *name;
 239         int i, size, plen, len;
 240
 241         name = mac_get_mpc(handle)->mpc_name;
 242         len = strlen(text);
 243         plen = 2 + strlen(name);
 244         if (plen + len >= MAC_AUDIT_DATA_LIMIT) {
 245                 return EINVAL;
 246         }
 247
 248         /*
 249          * Make sure the text is only composed of only ASCII printable
 250          * characters.
 251          */
 252         for (i = 0; i < len; i++) {
 253                 if (text[i] < (char) 32 || text[i] > (char) 126) {
 254                         return EINVAL;
 255                 }
 256         }
 257
 258         size = len + plen + 1;
 259         sanitized = (char *)zalloc(mac_audit_data_zone);
 260
 261         strlcpy(sanitized, name, MAC_AUDIT_DATA_LIMIT);
 262         strncat(sanitized, ": ", MAC_AUDIT_DATA_LIMIT - plen + 2);
 263         strncat(sanitized, text, MAC_AUDIT_DATA_LIMIT - plen);
 264
 265         return audit_mac_data(MAC_AUDIT_TEXT_TYPE, size, (u_char *)sanitized);
 266 }
 267
 268 int
 269 mac_audit_check_preselect(struct ucred *cred, unsigned short syscode, void *args)
 270 {
 271         struct mac_policy_conf *mpc;
 272         int ret, error;
 273         u_int i;
 274
 275         ret = MAC_AUDIT_DEFAULT;
 276         for (i = 0; i < mac_policy_list.staticmax; i++) {
 277                 mpc = mac_policy_list.entries[i].mpc;
 278                 if (mpc == NULL) {
 279                         continue;
 280                 }
 281
 282                 if (mpc->mpc_ops->mpo_audit_check_preselect != NULL) {
 283                         error = mpc->mpc_ops->mpo_audit_check_preselect(cred,
 284                             syscode, args);
 285                         ret = (ret > error ? ret : error);
 286                 }
 287         }
 288         if (mac_policy_list_conditional_busy() != 0) {
 289                 for (; i <= mac_policy_list.maxindex; i++) {
 290                         mpc = mac_policy_list.entries[i].mpc;
 291                         if (mpc == NULL) {
 292                                 continue;
 293                         }
 294
 295                         if (mpc->mpc_ops->mpo_audit_check_preselect != NULL) {
 296                                 error = mpc->mpc_ops->mpo_audit_check_preselect(cred,
 297                                     syscode, args);
 298                                 ret = (ret > error ? ret : error);
 299                         }
 300                 }
 301                 mac_policy_list_unbusy();
 302         }
 303
 304         return ret;
 305 }
 306
 307 int
 308 mac_audit_check_postselect(struct ucred *cred, unsigned short syscode,
 309     void *args, int error, int retval, int mac_forced)
 310 {
 311         struct mac_policy_conf *mpc;
 312         int ret, mac_error;
 313         u_int i;
 314
 315         /*
 316          * If the audit was forced by a MAC policy by mac_audit_check_preselect(),
 317          * echo that.
 318          */
 319         if (mac_forced) {
 320                 return MAC_AUDIT_YES;
 321         }
 322
 323         ret = MAC_AUDIT_DEFAULT;
 324         for (i = 0; i < mac_policy_list.staticmax; i++) {
 325                 mpc = mac_policy_list.entries[i].mpc;
 326                 if (mpc == NULL) {
 327                         continue;
 328                 }
 329
 330                 if (mpc->mpc_ops->mpo_audit_check_postselect != NULL) {
 331                         mac_error = mpc->mpc_ops->mpo_audit_check_postselect(cred,
 332                             syscode, args, error, retval);
 333                         ret = (ret > mac_error ? ret : mac_error);
 334                 }
 335         }
 336         if (mac_policy_list_conditional_busy() != 0) {
 337                 for (; i <= mac_policy_list.maxindex; i++) {
 338                         mpc = mac_policy_list.entries[i].mpc;
 339                         if (mpc == NULL) {
 340                                 continue;
 341                         }
 342
 343                         if (mpc->mpc_ops->mpo_audit_check_postselect != NULL) {
 344                                 mac_error = mpc->mpc_ops->mpo_audit_check_postselect(cred,
 345                                     syscode, args, error, retval);
 346                                 ret = (ret > mac_error ? ret : mac_error);
 347                         }
 348                 }
 349                 mac_policy_list_unbusy();
 350         }
 351
 352         return ret;
 353 }
 354
 355 #else   /* !CONFIG_AUDIT */
 356
 357 /*
 358  * Function stubs for when AUDIT isn't defined.
 359  */
 360
 361 int
 362 mac_system_check_audit(__unused struct ucred *cred, __unused void *record, __unused int length)
 363 {
 364         return 0;
 365 }
 366
 367 int
 368 mac_system_check_auditon(__unused struct ucred *cred, __unused int cmd)
 369 {
 370         return 0;
 371 }
 372
 373 int
 374 mac_system_check_auditctl(__unused struct ucred *cred, __unused struct vnode *vp)
 375 {
 376         return 0;
 377 }
 378
 379 int
 380 mac_proc_check_getauid(__unused struct proc *curp)
 381 {
 382         return 0;
 383 }
 384
 385 int
 386 mac_proc_check_setauid(__unused struct proc *curp, __unused uid_t auid)
 387 {
 388         return 0;
 389 }
 390
 391 int
 392 mac_proc_check_getaudit(__unused struct proc *curp)
 393 {
 394         return 0;
 395 }
 396
 397 int
 398 mac_proc_check_setaudit(__unused struct proc *curp,
 399     __unused struct auditinfo_addr *ai)
 400 {
 401         return 0;
 402 }
 403
 404 int
 405 mac_audit_check_preselect(__unused struct ucred *cred, __unused unsigned short syscode,
 406     __unused void *args)
 407 {
 408         return MAC_AUDIT_DEFAULT;
 409 }
 410
 411 int
 412 mac_audit_check_postselect(__unused struct ucred *cred, __unused unsigned short syscode,
 413     __unused void *args, __unused int error, __unused int retval, __unused int mac_forced)
 414 {
 415         return MAC_AUDIT_DEFAULT;
 416 }
 417
 418 int
 419 mac_audit_text(__unused char *text, __unused mac_policy_handle_t handle)
 420 {
 421         return 0;
 422 }
 423 #endif  /* !CONFIG_AUDIT */