security/mac_socket.c

   1 /*
   2  * Copyright (c) 2007-2012 Apple Inc. All rights reserved.
   3  *
   4  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. The rights granted to you under the License
  10  * may not be used to create, or enable the creation or redistribution of,
  11  * unlawful or unlicensed copies of an Apple operating system, or to
  12  * circumvent, violate, or enable the circumvention or violation of, any
  13  * terms of an Apple operating system software license agreement.
  14  *
  15  * Please obtain a copy of the License at
  16  * http://www.opensource.apple.com/apsl/ and read it before using this file.
  17  *
  18  * The Original Code and all software distributed under the License are
  19  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  20  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  21  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  22  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  23  * Please see the License for the specific language governing rights and
  24  * limitations under the License.
  25  *
  26  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
  27  */
  28 /*-
  29  * Copyright (c) 1999-2002 Robert N. M. Watson
  30  * Copyright (c) 2001 Ilmar S. Habibulin
  31  * Copyright (c) 2001-2005 Networks Associates Technology, Inc.
  32  * Copyright (c) 2005 SPARTA, Inc.
  33  * All rights reserved.
  34  *
  35  * This software was developed by Robert Watson and Ilmar Habibulin for the
  36  * TrustedBSD Project.
  37  *
  38  * This software was developed for the FreeBSD Project in part by McAfee
  39  * Research, the Technology Research Division of Network Associates, Inc.
  40  * under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the
  41  * DARPA CHATS research program.
  42  *
  43  * This software was enhanced by SPARTA ISSO under SPAWAR contract
  44  * N66001-04-C-6019 ("SEFOS").
  45  *
  46  * Redistribution and use in source and binary forms, with or without
  47  * modification, are permitted provided that the following conditions
  48  * are met:
  49  * 1. Redistributions of source code must retain the above copyright
  50  *    notice, this list of conditions and the following disclaimer.
  51  * 2. Redistributions in binary form must reproduce the above copyright
  52  *    notice, this list of conditions and the following disclaimer in the
  53  *    documentation and/or other materials provided with the distribution.
  54  *
  55  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  56  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  57  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  58  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  59  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  60  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  61  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  62  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  63  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  64  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  65  * SUCH DAMAGE.
  66  */
  67
  68 #include <sys/cdefs.h>
  69
  70 #include <sys/param.h>
  71 #include <sys/kernel.h>
  72 #include <sys/lock.h>
  73 #include <sys/malloc.h>
  74 #include <sys/sbuf.h>
  75 #include <sys/systm.h>
  76 #include <sys/mount.h>
  77 #include <sys/file.h>
  78 #include <sys/namei.h>
  79 #include <sys/protosw.h>
  80 #include <sys/socket.h>
  81 #include <sys/socketvar.h>
  82 #include <sys/sysctl.h>
  83 #include <sys/kpi_socket.h>
  84
  85 #include <security/mac_internal.h>
  86
  87 #if CONFIG_MACF_SOCKET
  88 struct label *
  89 mac_socket_label_alloc(int flag)
  90 {
  91         struct label *label;
  92         int error;
  93
  94         label = mac_labelzone_alloc(flag);
  95         if (label == NULL)
  96                 return (NULL);
  97
  98         MAC_CHECK(socket_label_init, label, flag);
  99         if (error) {
 100                 MAC_PERFORM(socket_label_destroy, label);
 101                 mac_labelzone_free(label);
 102                 return (NULL);
 103         }
 104
 105         return (label);
 106 }
 107
 108 static struct label *
 109 mac_socket_peer_label_alloc(int flag)
 110 {
 111         struct label *label;
 112         int error;
 113
 114         label = mac_labelzone_alloc(flag);
 115         if (label == NULL)
 116                 return (NULL);
 117
 118         MAC_CHECK(socketpeer_label_init, label, flag);
 119         if (error) {
 120                 MAC_PERFORM(socketpeer_label_destroy, label);
 121                 mac_labelzone_free(label);
 122                 return (NULL);
 123         }
 124
 125         return (label);
 126 }
 127
 128 int
 129 mac_socket_label_init(struct socket *so, int flag)
 130 {
 131
 132         so->so_label = mac_socket_label_alloc(flag);
 133         if (so->so_label == NULL)
 134                 return (ENOMEM);
 135         so->so_peerlabel = mac_socket_peer_label_alloc(flag);
 136         if (so->so_peerlabel == NULL) {
 137                 mac_socket_label_free(so->so_label);
 138                 so->so_label = NULL;
 139                 return (ENOMEM);
 140         }
 141         return (0);
 142 }
 143
 144 void
 145 mac_socket_label_free(struct label *label)
 146 {
 147
 148         MAC_PERFORM(socket_label_destroy, label);
 149         mac_labelzone_free(label);
 150 }
 151
 152 static void
 153 mac_socket_peer_label_free(struct label *label)
 154 {
 155
 156         MAC_PERFORM(socketpeer_label_destroy, label);
 157         mac_labelzone_free(label);
 158 }
 159
 160 void
 161 mac_socket_label_destroy(struct socket *so)
 162 {
 163
 164         if (so->so_label != NULL) {
 165                 mac_socket_label_free(so->so_label);
 166                 so->so_label = NULL;
 167         }
 168         if (so->so_peerlabel != NULL) {
 169                 mac_socket_peer_label_free(so->so_peerlabel);
 170                 so->so_peerlabel = NULL;
 171         }
 172 }
 173
 174 void
 175 mac_socket_label_copy(struct label *src, struct label *dest)
 176 {
 177
 178         MAC_PERFORM(socket_label_copy, src, dest);
 179 }
 180
 181 int
 182 mac_socket_label_externalize(struct label *label, char *elements,
 183     char *outbuf, size_t outbuflen)
 184 {
 185         int error;
 186
 187         error = MAC_EXTERNALIZE(socket, label, elements, outbuf, outbuflen);
 188
 189         return (error);
 190 }
 191
 192 static int
 193 mac_socketpeer_label_externalize(struct label *label, char *elements,
 194     char *outbuf, size_t outbuflen)
 195 {
 196         int error;
 197
 198         error = MAC_EXTERNALIZE(socketpeer, label, elements, outbuf, outbuflen);
 199
 200         return (error);
 201 }
 202
 203 int
 204 mac_socket_label_internalize(struct label *label, char *string)
 205 {
 206         int error;
 207
 208         error = MAC_INTERNALIZE(socket, label, string);
 209
 210         return (error);
 211 }
 212
 213 void
 214 mac_socket_label_associate(struct ucred *cred, struct socket *so)
 215 {
 216 #if SECURITY_MAC_CHECK_ENFORCE
 217     /* 21167099 - only check if we allow write */
 218     if (!mac_socket_enforce)
 219         return;
 220 #endif
 221
 222         MAC_PERFORM(socket_label_associate, cred,
 223                     (socket_t)so, so->so_label);
 224 }
 225
 226 void
 227 mac_socket_label_associate_accept(struct socket *oldsocket,
 228     struct socket *newsocket)
 229 {
 230 #if SECURITY_MAC_CHECK_ENFORCE
 231     /* 21167099 - only check if we allow write */
 232     if (!mac_socket_enforce)
 233         return;
 234 #endif
 235
 236         MAC_PERFORM(socket_label_associate_accept,
 237                     (socket_t)oldsocket, oldsocket->so_label,
 238                     (socket_t)newsocket, newsocket->so_label);
 239 }
 240
 241 #if CONFIG_MACF_SOCKET && CONFIG_MACF_NET
 242 void
 243 mac_socketpeer_label_associate_mbuf(struct mbuf *mbuf, struct socket *so)
 244 {
 245         struct label *label;
 246
 247 #if SECURITY_MAC_CHECK_ENFORCE
 248     /* 21167099 - only check if we allow write */
 249     if (!mac_socket_enforce && !mac_net_enforce)
 250         return;
 251 #endif
 252
 253         label = mac_mbuf_to_label(mbuf);
 254
 255         /* Policy must deal with NULL label (unlabeled mbufs) */
 256         MAC_PERFORM(socketpeer_label_associate_mbuf, mbuf, label,
 257                     (socket_t)so, so->so_peerlabel);
 258 }
 259 #else
 260 void
 261 mac_socketpeer_label_associate_mbuf(__unused struct mbuf *mbuf,
 262         __unused struct socket *so)
 263 {
 264         return;
 265 }
 266 #endif
 267
 268 void
 269 mac_socketpeer_label_associate_socket(struct socket *oldsocket,
 270     struct socket *newsocket)
 271 {
 272 #if SECURITY_MAC_CHECK_ENFORCE
 273     /* 21167099 - only check if we allow write */
 274     if (!mac_socket_enforce)
 275         return;
 276 #endif
 277
 278         MAC_PERFORM(socketpeer_label_associate_socket,
 279                     (socket_t)oldsocket, oldsocket->so_label,
 280                     (socket_t)newsocket, newsocket->so_peerlabel);
 281 }
 282
 283 int
 284 mac_socket_check_kqfilter(kauth_cred_t cred, struct knote *kn,
 285                           struct socket *so)
 286 {
 287         int error;
 288
 289 #if SECURITY_MAC_CHECK_ENFORCE
 290     /* 21167099 - only check if we allow write */
 291     if (!mac_socket_enforce)
 292         return 0;
 293 #endif
 294
 295         MAC_CHECK(socket_check_kqfilter, cred, kn,
 296                   (socket_t)so, so->so_label);
 297         return (error);
 298 }
 299
 300 static int
 301 mac_socket_check_label_update(kauth_cred_t cred, struct socket *so,
 302     struct label *newlabel)
 303 {
 304         int error;
 305
 306 #if SECURITY_MAC_CHECK_ENFORCE
 307     /* 21167099 - only check if we allow write */
 308     if (!mac_socket_enforce)
 309         return 0;
 310 #endif
 311
 312         MAC_CHECK(socket_check_label_update, cred,
 313                   (socket_t)so, so->so_label,
 314                   newlabel);
 315         return (error);
 316 }
 317
 318 int
 319 mac_socket_check_select(kauth_cred_t cred, struct socket *so, int which)
 320 {
 321         int error;
 322
 323 #if SECURITY_MAC_CHECK_ENFORCE
 324     /* 21167099 - only check if we allow write */
 325     if (!mac_socket_enforce)
 326         return 0;
 327 #endif
 328
 329         MAC_CHECK(socket_check_select, cred,
 330                   (socket_t)so, so->so_label, which);
 331         return (error);
 332 }
 333
 334 int
 335 mac_socket_check_stat(kauth_cred_t cred, struct socket *so)
 336 {
 337         int error;
 338
 339 #if SECURITY_MAC_CHECK_ENFORCE
 340     /* 21167099 - only check if we allow write */
 341     if (!mac_socket_enforce)
 342         return 0;
 343 #endif
 344
 345         MAC_CHECK(socket_check_stat, cred,
 346                   (socket_t)so, so->so_label);
 347         return (error);
 348 }
 349
 350
 351 int
 352 mac_socket_label_update(kauth_cred_t cred, struct socket *so, struct label *label)
 353 {
 354         int error;
 355 #if 0
 356 #if SECURITY_MAC_CHECK_ENFORCE
 357     /* 21167099 - only check if we allow write */
 358     if (!mac_socket_enforce)
 359         return 0;
 360 #endif
 361 #endif
 362         error = mac_socket_check_label_update(cred, so, label);
 363         if (error)
 364                 return (error);
 365
 366         MAC_PERFORM(socket_label_update, cred,
 367                     (socket_t)so, so->so_label, label);
 368
 369 #if CONFIG_MACF_NET
 370         /*
 371          * If the protocol has expressed interest in socket layer changes,
 372          * such as if it needs to propagate changes to a cached pcb
 373          * label from the socket, notify it of the label change while
 374          * holding the socket lock.
 375          * XXXMAC - are there cases when we should not do this?
 376          */
 377         mac_inpcb_label_update(so);
 378 #endif
 379         return (0);
 380 }
 381
 382 int
 383 mac_setsockopt_label(kauth_cred_t cred, struct socket *so, struct mac *mac)
 384 {
 385         struct label *intlabel;
 386         char *buffer;
 387         int error;
 388         size_t len;
 389
 390         error = mac_check_structmac_consistent(mac);
 391         if (error)
 392                 return (error);
 393
 394         MALLOC(buffer, char *, mac->m_buflen, M_MACTEMP, M_WAITOK);
 395         error = copyinstr(CAST_USER_ADDR_T(mac->m_string), buffer,
 396                 mac->m_buflen, &len);
 397         if (error) {
 398                 FREE(buffer, M_MACTEMP);
 399                 return (error);
 400         }
 401
 402         intlabel = mac_socket_label_alloc(MAC_WAITOK);
 403         error = mac_socket_label_internalize(intlabel, buffer);
 404         FREE(buffer, M_MACTEMP);
 405         if (error)
 406                 goto out;
 407
 408         error = mac_socket_label_update(cred, so, intlabel);
 409 out:
 410         mac_socket_label_free(intlabel);
 411         return (error);
 412 }
 413
 414 int
 415 mac_socket_label_get(__unused kauth_cred_t cred, struct socket *so,
 416     struct mac *mac)
 417 {
 418         char *buffer, *elements;
 419         struct label *intlabel;
 420         int error;
 421         size_t len;
 422
 423         error = mac_check_structmac_consistent(mac);
 424         if (error)
 425                 return (error);
 426
 427         MALLOC(elements, char *, mac->m_buflen, M_MACTEMP, M_WAITOK);
 428         error = copyinstr(CAST_USER_ADDR_T(mac->m_string), elements,
 429                 mac->m_buflen, &len);
 430         if (error) {
 431                 FREE(elements, M_MACTEMP);
 432                 return (error);
 433         }
 434
 435         MALLOC(buffer, char *, mac->m_buflen, M_MACTEMP, M_WAITOK | M_ZERO);
 436         intlabel = mac_socket_label_alloc(MAC_WAITOK);
 437         mac_socket_label_copy(so->so_label, intlabel);
 438         error = mac_socket_label_externalize(intlabel, elements, buffer,
 439             mac->m_buflen);
 440         mac_socket_label_free(intlabel);
 441         if (error == 0)
 442                 error = copyout(buffer, CAST_USER_ADDR_T(mac->m_string),
 443                         strlen(buffer)+1);
 444
 445         FREE(buffer, M_MACTEMP);
 446         FREE(elements, M_MACTEMP);
 447
 448         return (error);
 449 }
 450
 451 int
 452 mac_socketpeer_label_get(__unused kauth_cred_t cred, struct socket *so,
 453     struct mac *mac)
 454 {
 455         char *elements, *buffer;
 456         struct label *intlabel;
 457         int error;
 458         size_t len;
 459
 460         error = mac_check_structmac_consistent(mac);
 461         if (error)
 462                 return (error);
 463
 464         MALLOC(elements, char *, mac->m_buflen, M_MACTEMP, M_WAITOK);
 465         error = copyinstr(CAST_USER_ADDR_T(mac->m_string), elements,
 466                 mac->m_buflen, &len);
 467         if (error) {
 468                 FREE(elements, M_MACTEMP);
 469                 return (error);
 470         }
 471
 472         MALLOC(buffer, char *, mac->m_buflen, M_MACTEMP, M_WAITOK | M_ZERO);
 473         intlabel = mac_socket_label_alloc(MAC_WAITOK);
 474         mac_socket_label_copy(so->so_peerlabel, intlabel);
 475         error = mac_socketpeer_label_externalize(intlabel, elements, buffer,
 476             mac->m_buflen);
 477         mac_socket_label_free(intlabel);
 478         if (error == 0)
 479                 error = copyout(buffer, CAST_USER_ADDR_T(mac->m_string),
 480                                 strlen(buffer)+1);
 481
 482         FREE(buffer, M_MACTEMP);
 483         FREE(elements, M_MACTEMP);
 484
 485         return (error);
 486 }
 487 #endif /* MAC_SOCKET */
 488
 489 int
 490 mac_socket_check_accept(kauth_cred_t cred, struct socket *so)
 491 {
 492         int error;
 493
 494 #if SECURITY_MAC_CHECK_ENFORCE
 495     /* 21167099 - only check if we allow write */
 496     if (!mac_socket_enforce)
 497         return 0;
 498 #endif
 499
 500         MAC_CHECK(socket_check_accept, cred,
 501                   (socket_t)so, so->so_label);
 502         return (error);
 503 }
 504
 505 #if CONFIG_MACF_SOCKET_SUBSET
 506 int
 507 mac_socket_check_accepted(kauth_cred_t cred, struct socket *so)
 508 {
 509         struct sockaddr *sockaddr;
 510         int error;
 511
 512 #if SECURITY_MAC_CHECK_ENFORCE
 513     /* 21167099 - only check if we allow write */
 514     if (!mac_socket_enforce)
 515         return 0;
 516 #endif
 517
 518         if (sock_getaddr((socket_t)so, &sockaddr, 1) != 0) {
 519                 error = ECONNABORTED;
 520         } else {
 521                 MAC_CHECK(socket_check_accepted, cred,
 522                           (socket_t)so, so->so_label, sockaddr);
 523                 sock_freeaddr(sockaddr);
 524         }
 525         return (error);
 526 }
 527 #endif
 528
 529 int
 530 mac_socket_check_bind(kauth_cred_t ucred, struct socket *so,
 531     struct sockaddr *sockaddr)
 532 {
 533         int error;
 534
 535 #if SECURITY_MAC_CHECK_ENFORCE
 536     /* 21167099 - only check if we allow write */
 537     if (!mac_socket_enforce)
 538         return 0;
 539 #endif
 540
 541         MAC_CHECK(socket_check_bind, ucred,
 542                   (socket_t)so, so->so_label, sockaddr);
 543         return (error);
 544 }
 545
 546 int
 547 mac_socket_check_connect(kauth_cred_t cred, struct socket *so,
 548     struct sockaddr *sockaddr)
 549 {
 550         int error;
 551
 552 #if SECURITY_MAC_CHECK_ENFORCE
 553     /* 21167099 - only check if we allow write */
 554     if (!mac_socket_enforce)
 555         return 0;
 556 #endif
 557
 558         MAC_CHECK(socket_check_connect, cred,
 559                   (socket_t)so, so->so_label,
 560                   sockaddr);
 561         return (error);
 562 }
 563
 564 int
 565 mac_socket_check_create(kauth_cred_t cred, int domain, int type, int protocol)
 566 {
 567         int error;
 568
 569 #if SECURITY_MAC_CHECK_ENFORCE
 570     /* 21167099 - only check if we allow write */
 571     if (!mac_socket_enforce)
 572         return 0;
 573 #endif
 574
 575         MAC_CHECK(socket_check_create, cred, domain, type, protocol);
 576         return (error);
 577 }
 578
 579 #if CONFIG_MACF_SOCKET && CONFIG_MACF_NET
 580 int
 581 mac_socket_check_deliver(struct socket *so, struct mbuf *mbuf)
 582 {
 583         struct label *label;
 584         int error;
 585
 586 #if SECURITY_MAC_CHECK_ENFORCE
 587     /* 21167099 - only check if we allow write */
 588     if (!mac_socket_enforce)
 589         return 0;
 590 #endif
 591
 592         label = mac_mbuf_to_label(mbuf);
 593
 594         /* Policy must deal with NULL label (unlabeled mbufs) */
 595         MAC_CHECK(socket_check_deliver,
 596                   (socket_t)so, so->so_label, mbuf, label);
 597         return (error);
 598 }
 599 #else
 600 int
 601 mac_socket_check_deliver(__unused struct socket *so, __unused struct mbuf *mbuf)
 602 {
 603         return (0);
 604 }
 605 #endif
 606
 607 int
 608 mac_socket_check_listen(kauth_cred_t cred, struct socket *so)
 609 {
 610         int error;
 611
 612 #if SECURITY_MAC_CHECK_ENFORCE
 613     /* 21167099 - only check if we allow write */
 614     if (!mac_socket_enforce)
 615         return 0;
 616 #endif
 617
 618         MAC_CHECK(socket_check_listen, cred,
 619                   (socket_t)so, so->so_label);
 620         return (error);
 621 }
 622
 623 int
 624 mac_socket_check_receive(kauth_cred_t cred, struct socket *so)
 625 {
 626         int error;
 627
 628 #if SECURITY_MAC_CHECK_ENFORCE
 629     /* 21167099 - only check if we allow write */
 630     if (!mac_socket_enforce)
 631         return 0;
 632 #endif
 633
 634         MAC_CHECK(socket_check_receive, cred,
 635                   (socket_t)so, so->so_label);
 636         return (error);
 637 }
 638
 639 int
 640 mac_socket_check_received(kauth_cred_t cred, struct socket *so, struct sockaddr *saddr)
 641 {
 642         int error;
 643
 644 #if SECURITY_MAC_CHECK_ENFORCE
 645     /* 21167099 - only check if we allow write */
 646     if (!mac_socket_enforce)
 647         return 0;
 648 #endif
 649
 650         MAC_CHECK(socket_check_received, cred,
 651                   so, so->so_label, saddr);
 652         return (error);
 653 }
 654
 655 int
 656 mac_socket_check_send(kauth_cred_t cred, struct socket *so,
 657                       struct sockaddr *sockaddr)
 658 {
 659         int error;
 660
 661 #if SECURITY_MAC_CHECK_ENFORCE
 662     /* 21167099 - only check if we allow write */
 663     if (!mac_socket_enforce)
 664         return 0;
 665 #endif
 666
 667         MAC_CHECK(socket_check_send, cred,
 668                   (socket_t)so, so->so_label, sockaddr);
 669         return (error);
 670 }
 671
 672 int
 673 mac_socket_check_setsockopt(kauth_cred_t cred, struct socket *so,
 674                             struct sockopt *sopt)
 675 {
 676         int error;
 677
 678 #if SECURITY_MAC_CHECK_ENFORCE
 679     /* 21167099 - only check if we allow write */
 680     if (!mac_socket_enforce)
 681         return 0;
 682 #endif
 683
 684         MAC_CHECK(socket_check_setsockopt, cred,
 685                   (socket_t)so, so->so_label, sopt);
 686         return (error);
 687 }
 688
 689 int mac_socket_check_getsockopt(kauth_cred_t cred, struct socket *so,
 690                                 struct sockopt *sopt)
 691 {
 692         int error;
 693
 694 #if SECURITY_MAC_CHECK_ENFORCE
 695     /* 21167099 - only check if we allow write */
 696     if (!mac_socket_enforce)
 697         return 0;
 698 #endif
 699
 700         MAC_CHECK(socket_check_getsockopt, cred,
 701                   (socket_t)so, so->so_label, sopt);
 702         return (error);
 703 }