security/mac_audit.c

   1 /*
   2  * Copyright (c) 2006-2020 Apple Inc. All rights reserved.
   3  *
   4  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. The rights granted to you under the License
  10  * may not be used to create, or enable the creation or redistribution of,
  11  * unlawful or unlicensed copies of an Apple operating system, or to
  12  * circumvent, violate, or enable the circumvention or violation of, any
  13  * terms of an Apple operating system software license agreement.
  14  *
  15  * Please obtain a copy of the License at
  16  * http://www.opensource.apple.com/apsl/ and read it before using this file.
  17  *
  18  * The Original Code and all software distributed under the License are
  19  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  20  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  21  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  22  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  23  * Please see the License for the specific language governing rights and
  24  * limitations under the License.
  25  *
  26  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
  27  */
  28 /*
  29  * Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson
  30  * Copyright (c) 2001 Ilmar S. Habibulin
  31  * Copyright (c) 2001, 2002, 2003, 2004 Networks Associates Technology, Inc.
  32  *
  33  * This software was developed by Robert Watson and Ilmar Habibulin for the
  34  * TrustedBSD Project.
  35  *
  36  * This software was developed for the FreeBSD Project in part by Network
  37  * Associates Laboratories, the Security Research Division of Network
  38  * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"),
  39  * as part of the DARPA CHATS research program.
  40  *
  41  * Redistribution and use in source and binary forms, with or without
  42  * modification, are permitted provided that the following conditions
  43  * are met:
  44  * 1. Redistributions of source code must retain the above copyright
  45  *    notice, this list of conditions and the following disclaimer.
  46  * 2. Redistributions in binary form must reproduce the above copyright
  47  *    notice, this list of conditions and the following disclaimer in the
  48  *    documentation and/or other materials provided with the distribution.
  49  *
  50  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  51  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  52  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  53  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  54  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  55  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  56  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  57  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  58  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  59  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  60  * SUCH DAMAGE.
  61  *
  62  */
  63 #include <sys/param.h>
  64 #include <sys/types.h>
  65 #include <sys/vnode.h>
  66 #include <sys/vnode_internal.h>
  67 #include <sys/kauth.h>
  68 #include <sys/queue.h>
  69 #include <security/mac_internal.h>
  70 #include <bsd/bsm/audit.h>
  71 #include <bsd/security/audit/audit.h>
  72 #include <bsd/sys/malloc.h>
  73 #include <vm/vm_kern.h>
  74 #include <kern/zalloc.h>
  75
  76 #if CONFIG_AUDIT
  77
  78 ZONE_DECLARE(mac_audit_data_zone, "mac_audit_data_zone",
  79     MAC_AUDIT_DATA_LIMIT, ZC_NONE);
  80
  81 int
  82 mac_system_check_audit(struct ucred *cred, void *record, int length)
  83 {
  84         int error;
  85
  86         MAC_CHECK(system_check_audit, cred, record, length);
  87
  88         return error;
  89 }
  90
  91 int
  92 mac_system_check_auditon(struct ucred *cred, int cmd)
  93 {
  94         int error;
  95
  96         MAC_CHECK(system_check_auditon, cred, cmd);
  97
  98         return error;
  99 }
 100
 101 int
 102 mac_system_check_auditctl(struct ucred *cred, struct vnode *vp)
 103 {
 104         int error;
 105         struct label *vl = vp ? vp->v_label : NULL;
 106
 107         MAC_CHECK(system_check_auditctl, cred, vp, vl);
 108
 109         return error;
 110 }
 111
 112 int
 113 mac_proc_check_getauid(struct proc *curp)
 114 {
 115         kauth_cred_t cred;
 116         int error;
 117
 118 #if SECURITY_MAC_CHECK_ENFORCE
 119         /* 21167099 - only check if we allow write */
 120         if (!mac_proc_enforce) {
 121                 return 0;
 122         }
 123 #endif
 124
 125         if (!mac_proc_check_enforce(curp)) {
 126                 return 0;
 127         }
 128
 129         cred = kauth_cred_proc_ref(curp);
 130         MAC_CHECK(proc_check_getauid, cred);
 131         kauth_cred_unref(&cred);
 132
 133         return error;
 134 }
 135
 136 int
 137 mac_proc_check_setauid(struct proc *curp, uid_t auid)
 138 {
 139         kauth_cred_t cred;
 140         int error;
 141
 142 #if SECURITY_MAC_CHECK_ENFORCE
 143         /* 21167099 - only check if we allow write */
 144         if (!mac_proc_enforce) {
 145                 return 0;
 146         }
 147 #endif
 148         if (!mac_proc_check_enforce(curp)) {
 149                 return 0;
 150         }
 151
 152         cred = kauth_cred_proc_ref(curp);
 153         MAC_CHECK(proc_check_setauid, cred, auid);
 154         kauth_cred_unref(&cred);
 155
 156         return error;
 157 }
 158
 159 int
 160 mac_proc_check_getaudit(struct proc *curp)
 161 {
 162         kauth_cred_t cred;
 163         int error;
 164
 165 #if SECURITY_MAC_CHECK_ENFORCE
 166         /* 21167099 - only check if we allow write */
 167         if (!mac_proc_enforce) {
 168                 return 0;
 169         }
 170 #endif
 171         if (!mac_proc_check_enforce(curp)) {
 172                 return 0;
 173         }
 174
 175         cred = kauth_cred_proc_ref(curp);
 176         MAC_CHECK(proc_check_getaudit, cred);
 177         kauth_cred_unref(&cred);
 178
 179         return error;
 180 }
 181
 182 int
 183 mac_proc_check_setaudit(struct proc *curp, struct auditinfo_addr *ai)
 184 {
 185         kauth_cred_t cred;
 186         int error;
 187
 188 #if SECURITY_MAC_CHECK_ENFORCE
 189         /* 21167099 - only check if we allow write */
 190         if (!mac_proc_enforce) {
 191                 return 0;
 192         }
 193 #endif
 194         if (!mac_proc_check_enforce(curp)) {
 195                 return 0;
 196         }
 197
 198         cred = kauth_cred_proc_ref(curp);
 199         MAC_CHECK(proc_check_setaudit, cred, ai);
 200         kauth_cred_unref(&cred);
 201
 202         return error;
 203 }
 204
 205 #if 0
 206 /*
 207  * This is the framework entry point for MAC policies to use to add
 208  * arbitrary data to the current audit record.
 209  * (Currently not supported, as no existing audit viewers would
 210  * display this format)
 211  *
 212  */
 213 int
 214 mac_audit_data(int len, u_char *data, mac_policy_handle_t handle)
 215 {
 216         char *sanitized;
 217
 218         if ((len <= 0) || (len > MAC_AUDIT_DATA_LIMIT)) {
 219                 return EINVAL;
 220         }
 221
 222         sanitized = (char *)zalloc(mac_audit_data_zone);
 223
 224         bcopy(data, sanitized, len);
 225         return audit_mac_data(MAC_AUDIT_DATA_TYPE, len, sanitized);
 226 }
 227 #endif
 228
 229 /*
 230  * This is the entry point a MAC policy will call to add NULL-
 231  * terminated ASCII text to the current audit record.
 232  */
 233 int
 234 mac_audit_text(char *text, mac_policy_handle_t handle)
 235 {
 236         char *sanitized;
 237         const char *name;
 238         size_t i, size, plen, text_len;
 239
 240         name = mac_get_mpc(handle)->mpc_name;
 241         text_len = strlen(text);
 242         plen = 2 + strlen(name);
 243         if (plen + text_len >= MAC_AUDIT_DATA_LIMIT) {
 244                 return EINVAL;
 245         }
 246
 247         /*
 248          * Make sure the text is only composed of only ASCII printable
 249          * characters.
 250          */
 251         for (i = 0; i < text_len; i++) {
 252                 if (text[i] < (char) 32 || text[i] > (char) 126) {
 253                         return EINVAL;
 254                 }
 255         }
 256
 257         size = text_len + plen + 1;
 258         sanitized = (char *)zalloc(mac_audit_data_zone);
 259
 260         strlcpy(sanitized, name, MAC_AUDIT_DATA_LIMIT);
 261         strlcat(sanitized, ": ", MAC_AUDIT_DATA_LIMIT);
 262         strlcat(sanitized, text, MAC_AUDIT_DATA_LIMIT);
 263
 264         return audit_mac_data(MAC_AUDIT_TEXT_TYPE, size, (u_char *)sanitized);
 265 }
 266
 267 int
 268 mac_audit_check_preselect(struct ucred *cred, unsigned short syscode, void *args)
 269 {
 270         struct mac_policy_conf *mpc;
 271         int ret, error;
 272         u_int i;
 273
 274         ret = MAC_AUDIT_DEFAULT;
 275         for (i = 0; i < mac_policy_list.staticmax; i++) {
 276                 mpc = mac_policy_list.entries[i].mpc;
 277                 if (mpc == NULL) {
 278                         continue;
 279                 }
 280
 281                 if (mpc->mpc_ops->mpo_audit_check_preselect != NULL) {
 282                         error = mpc->mpc_ops->mpo_audit_check_preselect(cred,
 283                             syscode, args);
 284                         ret = (ret > error ? ret : error);
 285                 }
 286         }
 287         if (mac_policy_list_conditional_busy() != 0) {
 288                 for (; i <= mac_policy_list.maxindex; i++) {
 289                         mpc = mac_policy_list.entries[i].mpc;
 290                         if (mpc == NULL) {
 291                                 continue;
 292                         }
 293
 294                         if (mpc->mpc_ops->mpo_audit_check_preselect != NULL) {
 295                                 error = mpc->mpc_ops->mpo_audit_check_preselect(cred,
 296                                     syscode, args);
 297                                 ret = (ret > error ? ret : error);
 298                         }
 299                 }
 300                 mac_policy_list_unbusy();
 301         }
 302
 303         return ret;
 304 }
 305
 306 int
 307 mac_audit_check_postselect(struct ucred *cred, unsigned short syscode,
 308     void *args, int error, int retval, int mac_forced)
 309 {
 310         struct mac_policy_conf *mpc;
 311         int ret, mac_error;
 312         u_int i;
 313
 314         /*
 315          * If the audit was forced by a MAC policy by mac_audit_check_preselect(),
 316          * echo that.
 317          */
 318         if (mac_forced) {
 319                 return MAC_AUDIT_YES;
 320         }
 321
 322         ret = MAC_AUDIT_DEFAULT;
 323         for (i = 0; i < mac_policy_list.staticmax; i++) {
 324                 mpc = mac_policy_list.entries[i].mpc;
 325                 if (mpc == NULL) {
 326                         continue;
 327                 }
 328
 329                 if (mpc->mpc_ops->mpo_audit_check_postselect != NULL) {
 330                         mac_error = mpc->mpc_ops->mpo_audit_check_postselect(cred,
 331                             syscode, args, error, retval);
 332                         ret = (ret > mac_error ? ret : mac_error);
 333                 }
 334         }
 335         if (mac_policy_list_conditional_busy() != 0) {
 336                 for (; i <= mac_policy_list.maxindex; i++) {
 337                         mpc = mac_policy_list.entries[i].mpc;
 338                         if (mpc == NULL) {
 339                                 continue;
 340                         }
 341
 342                         if (mpc->mpc_ops->mpo_audit_check_postselect != NULL) {
 343                                 mac_error = mpc->mpc_ops->mpo_audit_check_postselect(cred,
 344                                     syscode, args, error, retval);
 345                                 ret = (ret > mac_error ? ret : mac_error);
 346                         }
 347                 }
 348                 mac_policy_list_unbusy();
 349         }
 350
 351         return ret;
 352 }
 353
 354 #else   /* !CONFIG_AUDIT */
 355
 356 /*
 357  * Function stubs for when AUDIT isn't defined.
 358  */
 359
 360 int
 361 mac_system_check_audit(__unused struct ucred *cred, __unused void *record, __unused int length)
 362 {
 363         return 0;
 364 }
 365
 366 int
 367 mac_system_check_auditon(__unused struct ucred *cred, __unused int cmd)
 368 {
 369         return 0;
 370 }
 371
 372 int
 373 mac_system_check_auditctl(__unused struct ucred *cred, __unused struct vnode *vp)
 374 {
 375         return 0;
 376 }
 377
 378 int
 379 mac_proc_check_getauid(__unused struct proc *curp)
 380 {
 381         return 0;
 382 }
 383
 384 int
 385 mac_proc_check_setauid(__unused struct proc *curp, __unused uid_t auid)
 386 {
 387         return 0;
 388 }
 389
 390 int
 391 mac_proc_check_getaudit(__unused struct proc *curp)
 392 {
 393         return 0;
 394 }
 395
 396 int
 397 mac_proc_check_setaudit(__unused struct proc *curp,
 398     __unused struct auditinfo_addr *ai)
 399 {
 400         return 0;
 401 }
 402
 403 int
 404 mac_audit_check_preselect(__unused struct ucred *cred, __unused unsigned short syscode,
 405     __unused void *args)
 406 {
 407         return MAC_AUDIT_DEFAULT;
 408 }
 409
 410 int
 411 mac_audit_check_postselect(__unused struct ucred *cred, __unused unsigned short syscode,
 412     __unused void *args, __unused int error, __unused int retval, __unused int mac_forced)
 413 {
 414         return MAC_AUDIT_DEFAULT;
 415 }
 416
 417 int
 418 mac_audit_text(__unused char *text, __unused mac_policy_handle_t handle)
 419 {
 420         return 0;
 421 }
 422 #endif  /* !CONFIG_AUDIT */