/*
- * Copyright (c) 2007 Apple Inc. All rights reserved.
+ * Copyright (c) 2007-2020 Apple Inc. All rights reserved.
*
* @APPLE_OSREFERENCE_LICENSE_HEADER_START@
- *
+ *
* This file contains Original Code and/or Modifications of Original Code
* as defined in and that are subject to the Apple Public Source License
* Version 2.0 (the 'License'). You may not use this file except in
* unlawful or unlicensed copies of an Apple operating system, or to
* circumvent, violate, or enable the circumvention or violation of, any
* terms of an Apple operating system software license agreement.
- *
+ *
* Please obtain a copy of the License at
* http://www.opensource.apple.com/apsl/ and read it before using this file.
- *
+ *
* The Original Code and all software distributed under the License are
* distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
* EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
* FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
* Please see the License for the specific language governing rights and
* limitations under the License.
- *
+ *
* @APPLE_OSREFERENCE_LICENSE_HEADER_END@
*/
/*-
#include <sys/vfs_context.h>
#include <sys/namei.h>
#include <bsd/bsm/audit.h>
-#include <bsd/bsm/audit_kernel.h>
+#include <bsd/security/audit/audit.h>
+#include <bsd/security/audit/audit_private.h>
#include <sys/file.h>
#include <sys/file_internal.h>
#include <sys/filedesc.h>
#include <sys/kauth.h>
#include <sys/sysproto.h>
+#include <mach/exception_types.h>
#include <mach/vm_types.h>
#include <mach/vm_prot.h>
-#include <kern/zalloc.h>
+#include <kern/kalloc.h>
#include <kern/sched_prim.h>
-#include <osfmk/kern/task.h>
-#include <osfmk/kern/kalloc.h>
-#include <libsa/libsa/kext.h>
+#include <kern/task.h>
#if CONFIG_MACF
#include <security/mac.h>
#include <security/mac_mach_internal.h>
#endif
-/*
+#include <libkern/section_keywords.h>
+
+/*
* define MB_DEBUG to display run-time debugging information
* #define MB_DEBUG 1
*/
#ifdef MB_DEBUG
-#define DPRINTF(x) printf x
+#define DPRINTF(x) printf x
#else
#define MB_DEBUG
#define DPRINTF(x)
#endif
#if CONFIG_MACF
-SYSCTL_NODE(, OID_AUTO, security, CTLFLAG_RW|CTLFLAG_LOCKED, 0,
+SYSCTL_NODE(, OID_AUTO, security, CTLFLAG_RW | CTLFLAG_LOCKED, 0,
"Security Controls");
-SYSCTL_NODE(_security, OID_AUTO, mac, CTLFLAG_RW|CTLFLAG_LOCKED, 0,
+SYSCTL_EXTENSIBLE_NODE(_security, OID_AUTO, mac, CTLFLAG_RW | CTLFLAG_LOCKED, 0,
"TrustedBSD MAC policy controls");
-
-
/*
* Declare that the kernel provides MAC support, version 1. This permits
* modules to refuse to be loaded if the necessary support isn't present,
static unsigned int mac_max_slots = MAC_MAX_SLOTS;
static unsigned int mac_slot_offsets_free = (1 << MAC_MAX_SLOTS) - 1;
-SYSCTL_UINT(_security_mac, OID_AUTO, max_slots, CTLFLAG_RD,
+SYSCTL_UINT(_security_mac, OID_AUTO, max_slots, CTLFLAG_RD | CTLFLAG_LOCKED,
&mac_max_slots, 0, "");
/*
* access to this variable is serialized during the boot process. Following
* the end of serialization, we don't update this flag; no locking.
*/
-int mac_late = 0;
+int mac_late = 0;
/*
* Flag to indicate whether or not we should allocate label storage for
- * new mbufs. Since most dynamic policies we currently work with don't
- * rely on mbuf labeling, try to avoid paying the cost of mtag allocation
+ * new vnodes. Since most dynamic policies we currently work with don't
+ * rely on vnode labeling, try to avoid paying the cost of mtag allocation
* unless specifically notified of interest. One result of this is
- * that if a dynamically loaded policy requests mbuf labels, it must
- * be able to deal with a NULL label being returned on any mbufs that
+ * that if a dynamically loaded policy requests vnode labels, it must
+ * be able to deal with a NULL label being returned on any vnodes that
* were already in flight when the policy was loaded. Since the policy
* already has to deal with uninitialized labels, this probably won't
- * be a problem. Note: currently no locking. Will this be a problem?
+ * be a problem.
*/
-#if !defined(CONFIG_MACF_ALWAYS_LABEL_MBUF) && 0
-static int mac_labelmbufs = 0;
+#if CONFIG_MACF_LAZY_VNODE_LABELS
+unsigned int mac_label_vnodes = 1;
+#else
+unsigned int mac_label_vnodes = 0;
+#endif /* CONFIG_MACF_LAZY_VNODE_LABELS */
+SYSCTL_UINT(_security_mac, OID_AUTO, labelvnodes, SECURITY_MAC_CTLFLAGS
+#if CONFIG_MACF_LAZY_VNODE_LABELS
+ | CTLFLAG_RD
#endif
+ , &mac_label_vnodes, 0, "Label all vnodes");
-unsigned int mac_mmap_revocation = 0;
-SYSCTL_UINT(_security_mac, OID_AUTO, mmap_revocation, CTLFLAG_RW,
- &mac_mmap_revocation, 0, "Revoke mmap access to files on subject "
- "relabel");
-
-unsigned int mac_mmap_revocation_via_cow = 0;
-SYSCTL_UINT(_security_mac, OID_AUTO, mmap_revocation_via_cow, CTLFLAG_RW,
- &mac_mmap_revocation_via_cow, 0, "Revoke mmap access to files via "
- "copy-on-write semantics, or by removing all write access");
+unsigned int mac_vnode_label_count = 0;
+SYSCTL_UINT(_security_mac, OID_AUTO, vnode_label_count, SECURITY_MAC_CTLFLAGS | CTLFLAG_RD,
+ &mac_vnode_label_count, 0, "Count of vnode labels");
unsigned int mac_device_enforce = 1;
-SYSCTL_UINT(_security_mac, OID_AUTO, device_enforce, CTLFLAG_RW,
- &mac_device_enforce, 0, "Enforce MAC policy on device operations");
-
-unsigned int mac_file_enforce = 0;
-SYSCTL_UINT(_security_mac, OID_AUTO, file_enforce, CTLFLAG_RW,
- &mac_file_enforce, 0, "Enforce MAC policy on file operations");
-
-unsigned int mac_iokit_enforce = 0;
-SYSCTL_UINT(_security_mac, OID_AUTO, iokit_enforce, CTLFLAG_RW,
- &mac_file_enforce, 0, "Enforce MAC policy on IOKit operations");
+SYSCTL_UINT(_security_mac, OID_AUTO, device_enforce, SECURITY_MAC_CTLFLAGS,
+ &mac_device_enforce, 0, "Enforce MAC policy on device operations");
-unsigned int mac_pipe_enforce = 1;
-SYSCTL_UINT(_security_mac, OID_AUTO, pipe_enforce, CTLFLAG_RW,
+unsigned int mac_pipe_enforce = 1;
+SYSCTL_UINT(_security_mac, OID_AUTO, pipe_enforce, SECURITY_MAC_CTLFLAGS,
&mac_pipe_enforce, 0, "Enforce MAC policy on pipe operations");
-unsigned int mac_posixsem_enforce = 1;
-SYSCTL_UINT(_security_mac, OID_AUTO, posixsem_enforce, CTLFLAG_RW,
+unsigned int mac_posixsem_enforce = 1;
+SYSCTL_UINT(_security_mac, OID_AUTO, posixsem_enforce, SECURITY_MAC_CTLFLAGS,
&mac_posixsem_enforce, 0, "Enforce MAC policy on POSIX semaphores");
unsigned int mac_posixshm_enforce = 1;
-SYSCTL_UINT(_security_mac, OID_AUTO, posixshm_enforce, CTLFLAG_RW,
+SYSCTL_UINT(_security_mac, OID_AUTO, posixshm_enforce, SECURITY_MAC_CTLFLAGS,
&mac_posixshm_enforce, 0, "Enforce MAC policy on Posix Shared Memory");
-unsigned int mac_proc_enforce = 1;
-SYSCTL_UINT(_security_mac, OID_AUTO, proc_enforce, CTLFLAG_RW,
- &mac_proc_enforce, 0, "Enforce MAC policy on process operations");
+unsigned int mac_proc_enforce = 1;
+SYSCTL_UINT(_security_mac, OID_AUTO, proc_enforce, SECURITY_MAC_CTLFLAGS,
+ &mac_proc_enforce, 0, "Enforce MAC policy on process operations");
unsigned int mac_socket_enforce = 1;
-SYSCTL_UINT(_security_mac, OID_AUTO, socket_enforce, CTLFLAG_RW,
- &mac_socket_enforce, 0, "Enforce MAC policy on socket operations");
+SYSCTL_UINT(_security_mac, OID_AUTO, socket_enforce, SECURITY_MAC_CTLFLAGS,
+ &mac_socket_enforce, 0, "Enforce MAC policy on socket operations");
-unsigned int mac_system_enforce = 1;
-SYSCTL_UINT(_security_mac, OID_AUTO, system_enforce, CTLFLAG_RW,
+unsigned int mac_system_enforce = 1;
+SYSCTL_UINT(_security_mac, OID_AUTO, system_enforce, SECURITY_MAC_CTLFLAGS,
&mac_system_enforce, 0, "Enforce MAC policy on system-wide interfaces");
-unsigned int mac_sysvmsg_enforce = 1;
-SYSCTL_UINT(_security_mac, OID_AUTO, sysvmsg_enforce, CTLFLAG_RW,
+unsigned int mac_sysvmsg_enforce = 1;
+SYSCTL_UINT(_security_mac, OID_AUTO, sysvmsg_enforce, SECURITY_MAC_CTLFLAGS,
&mac_sysvmsg_enforce, 0, "Enforce MAC policy on System V IPC message queues");
-unsigned int mac_sysvsem_enforce = 1;
-SYSCTL_UINT(_security_mac, OID_AUTO, sysvsem_enforce, CTLFLAG_RW,
+unsigned int mac_sysvsem_enforce = 1;
+SYSCTL_UINT(_security_mac, OID_AUTO, sysvsem_enforce, SECURITY_MAC_CTLFLAGS,
&mac_sysvsem_enforce, 0, "Enforce MAC policy on System V IPC semaphores");
-unsigned int mac_sysvshm_enforce = 1;
-SYSCTL_INT(_security_mac, OID_AUTO, sysvshm_enforce, CTLFLAG_RW,
+unsigned int mac_sysvshm_enforce = 1;
+SYSCTL_INT(_security_mac, OID_AUTO, sysvshm_enforce, SECURITY_MAC_CTLFLAGS,
&mac_sysvshm_enforce, 0, "Enforce MAC policy on System V Shared Memory");
-unsigned int mac_vm_enforce = 1;
-SYSCTL_INT(_security_mac, OID_AUTO, vm_enforce, CTLFLAG_RW,
- &mac_vm_enforce, 0, "Enforce MAC policy on VM operations");
-
-unsigned int mac_vnode_enforce = 1;
-SYSCTL_UINT(_security_mac, OID_AUTO, vnode_enforce, CTLFLAG_RW,
- &mac_vnode_enforce, 0, "Enforce MAC policy on vnode operations");
-
-
-#if CONFIG_MACF_MACH
-unsigned int mac_port_enforce = 0;
-SYSCTL_UINT(_security_mac, OID_AUTO, port_enforce, CTLFLAG_RW,
- &mac_port_enforce, 0, "Enforce MAC policy on Mach port operations");
-
-unsigned int mac_task_enforce = 0;
-SYSCTL_UINT(_security_mac, OID_AUTO, task_enforce, CTLFLAG_RW,
- &mac_task_enforce, 0, "Enforce MAC policy on Mach task operations");
-#endif
-
-#if CONFIG_MACF_NET
-unsigned int mac_label_mbufs = 1;
-SYSCTL_UINT(_security_mac, OID_AUTO, label_mbufs, CTLFLAG_RW,
- &mac_label_mbufs, 0, "Label all MBUFs");
-#endif
+unsigned int mac_vm_enforce = 1;
+SYSCTL_INT(_security_mac, OID_AUTO, vm_enforce, SECURITY_MAC_CTLFLAGS,
+ &mac_vm_enforce, 0, "Enforce MAC policy on VM operations");
-/*
- * mac_audit_data_zone is the zone used for data pushed into the audit
- * record by policies. Using a zone simplifies memory management of this
- * data, and allows tracking of the amount of data in flight.
- */
-extern zone_t mac_audit_data_zone;
+unsigned int mac_vnode_enforce = 1;
+SYSCTL_UINT(_security_mac, OID_AUTO, vnode_enforce, SECURITY_MAC_CTLFLAGS,
+ &mac_vnode_enforce, 0, "Enforce MAC policy on vnode operations");
/*
* mac_policy_list holds the list of policy modules. Modules with a
* For a few special operations involving a change to the list of
* active policies, the mtx itself must be held.
*/
-static lck_mtx_t *mac_policy_mtx;
+static LCK_GRP_DECLARE(mac_lck_grp, "MAC lock");
+static LCK_MTX_DECLARE(mac_policy_mtx, &mac_lck_grp);
/*
- * Policy list array allocation chunk size. Trying to set this so that we
- * allocate a page at a time.
+ * Policy list array allocation chunk size. Each entry holds a pointer.
*/
-#define MAC_POLICY_LIST_CHUNKSIZE 512
+#define MAC_POLICY_LIST_CHUNKSIZE 8
static int mac_policy_busy;
+#if !XNU_TARGET_OS_OSX
+SECURITY_READ_ONLY_LATE(mac_policy_list_t) mac_policy_list;
+SECURITY_READ_ONLY_LATE(static struct mac_policy_list_element) mac_policy_static_entries[MAC_POLICY_LIST_CHUNKSIZE];
+#else
mac_policy_list_t mac_policy_list;
+#endif
/*
* mac_label_element_list holds the master list of label namespaces for
* all the policies. When a policy is loaded, each of it's label namespace
* elements is added to the master list if not already present. When a
- * policy is unloaded, the namespace elements are removed if no other
+ * policy is unloaded, the namespace elements are removed if no other
* policy is interested in that namespace element.
*/
struct mac_label_element_list_t mac_label_element_list;
struct mac_label_element_list_t mac_static_label_element_list;
-/*
- * Journal of label operations that occur before policies are loaded.
- */
-struct mac_label_journal_list_t mac_label_journal_list;
-
-int
-mac_label_journal_add (struct label *l, int type)
-{
- struct mac_label_journal *mlj;
-
- if (mac_label_journal_find(l))
- return (0);
-
- MALLOC(mlj, struct mac_label_journal *,
- sizeof(struct mac_label_journal), M_MACTEMP, M_WAITOK);
- mlj->l = l;
- mlj->type = type;
- TAILQ_INSERT_TAIL(&mac_label_journal_list, mlj, link);
-
- return (0);
-}
-
-int
-mac_label_journal_remove (struct label *l)
-{
- struct mac_label_journal *mlj;
-
- mlj = mac_label_journal_find(l);
- if (mlj == NULL)
- return (-1);
-
- TAILQ_REMOVE(&mac_label_journal_list, mlj, link);
- FREE(mlj, M_MACTEMP);
- return (0);
-}
-
-struct mac_label_journal *
-mac_label_journal_find (struct label *l)
-{
- struct mac_label_journal *mlj;
-
- TAILQ_FOREACH(mlj, &mac_label_journal_list, link) {
- if (l == mlj->l)
- return (mlj);
- }
-
- return (NULL);
-}
-
-int
-mac_label_journal (struct label *l, int op, ...)
-{
- struct mac_label_journal *mlj;
- va_list ap;
-
- mlj = mac_label_journal_find(l);
- if (mlj == NULL) {
- printf("%s(): Label not in list!\n", __func__);
- return (-1);
- }
-
- if (op == MLJ_PORT_OP_UPDATE) {
- va_start(ap, op);
- mlj->kotype = va_arg(ap, int);
- va_end(ap);
- }
-
- mlj->ops |= op;
- return (0);
-}
-
-/*
- * The assumption during replay is that the system is totally
- * serialized and no additional tasks/ports will be created.
- */
-void
-mac_label_journal_replay (void)
-{
- struct mac_label_journal *mlj;
-
- TAILQ_FOREACH(mlj, &mac_label_journal_list, link) {
- switch (mlj->type) {
- case MLJ_TYPE_PORT:
- if (mlj->ops & MLJ_PORT_OP_INIT)
- MAC_PERFORM(port_label_init, mlj->l);
- if (mlj->ops & MLJ_PORT_OP_CREATE_K)
- MAC_PERFORM(port_label_associate_kernel, mlj->l, 0);
- if (mlj->ops & MLJ_PORT_OP_UPDATE)
- MAC_PERFORM(port_label_update_kobject, mlj->l,
- mlj->kotype);
- break;
- case MLJ_TYPE_TASK:
- if (mlj->ops & MLJ_TASK_OP_INIT)
- MAC_PERFORM(task_label_init, mlj->l);
-#if 0
- /* Not enough context to replay. */
- if (mlj->ops & MLJ_TASK_OP_CREATE_K)
- ;
-#endif
- break;
- default:
- break;
- }
- }
-
- /* Free list */
- while (!TAILQ_EMPTY(&mac_label_journal_list)) {
- mlj = TAILQ_FIRST(&mac_label_journal_list);
- TAILQ_REMOVE(&mac_label_journal_list, mlj, link);
- FREE(mlj, M_MACTEMP);
- }
- return;
-}
-
static __inline void
mac_policy_grab_exclusive(void)
{
- lck_mtx_lock(mac_policy_mtx);
+ lck_mtx_lock(&mac_policy_mtx);
while (mac_policy_busy != 0) {
- lck_mtx_sleep(mac_policy_mtx, LCK_SLEEP_UNLOCK,
- (event_t)&mac_policy_busy, THREAD_UNINT);
- lck_mtx_lock(mac_policy_mtx);
+ lck_mtx_sleep(&mac_policy_mtx, LCK_SLEEP_UNLOCK,
+ (event_t)&mac_policy_busy, THREAD_UNINT);
+ lck_mtx_lock(&mac_policy_mtx);
}
}
-static __inline void
-mac_policy_assert_exclusive(void)
-{
- lck_mtx_assert(mac_policy_mtx, LCK_MTX_ASSERT_OWNED);
- KASSERT(mac_policy_busy == 0,
- ("mac_policy_assert_exclusive(): not exclusive"));
-}
-
static __inline void
mac_policy_release_exclusive(void)
{
-
KASSERT(mac_policy_busy == 0,
("mac_policy_release_exclusive(): not exclusive"));
- lck_mtx_unlock(mac_policy_mtx);
+ lck_mtx_unlock(&mac_policy_mtx);
thread_wakeup((event_t) &mac_policy_busy);
}
void
mac_policy_list_busy(void)
{
- lck_mtx_lock(mac_policy_mtx);
+ lck_mtx_lock(&mac_policy_mtx);
mac_policy_busy++;
- lck_mtx_unlock(mac_policy_mtx);
+ lck_mtx_unlock(&mac_policy_mtx);
}
int
{
int ret;
- if (mac_policy_list.numloaded <= mac_policy_list.staticmax)
- return(0);
+ if (mac_policy_list.numloaded <= mac_policy_list.staticmax) {
+ return 0;
+ }
- lck_mtx_lock(mac_policy_mtx);
+ lck_mtx_lock(&mac_policy_mtx);
if (mac_policy_list.numloaded > mac_policy_list.staticmax) {
mac_policy_busy++;
ret = 1;
- } else
+ } else {
ret = 0;
- lck_mtx_unlock(mac_policy_mtx);
- return (ret);
+ }
+ lck_mtx_unlock(&mac_policy_mtx);
+ return ret;
}
void
mac_policy_list_unbusy(void)
{
- lck_mtx_lock(mac_policy_mtx);
+ lck_mtx_lock(&mac_policy_mtx);
mac_policy_busy--;
KASSERT(mac_policy_busy >= 0, ("MAC_POLICY_LIST_LOCK"));
- if (mac_policy_busy == 0)
+ if (mac_policy_busy == 0) {
thread_wakeup(&mac_policy_busy);
- lck_mtx_unlock(mac_policy_mtx);
+ }
+ lck_mtx_unlock(&mac_policy_mtx);
}
/*
void
mac_policy_init(void)
{
- lck_grp_attr_t *mac_lck_grp_attr;
- lck_attr_t *mac_lck_attr;
- lck_grp_t *mac_lck_grp;
-
mac_policy_list.numloaded = 0;
mac_policy_list.max = MAC_POLICY_LIST_CHUNKSIZE;
mac_policy_list.maxindex = 0;
mac_policy_list.freehint = 0;
mac_policy_list.chunks = 1;
- mac_policy_list.entries = kalloc(sizeof(struct mac_policy_list_element) * MAC_POLICY_LIST_CHUNKSIZE);
- bzero(mac_policy_list.entries, sizeof(struct mac_policy_list_element) * MAC_POLICY_LIST_CHUNKSIZE);
+#if !XNU_TARGET_OS_OSX
+ mac_policy_list.entries = mac_policy_static_entries;
+#else
+ mac_policy_list.entries = kalloc_flags(
+ sizeof(struct mac_policy_list_element) * MAC_POLICY_LIST_CHUNKSIZE,
+ Z_WAITOK | Z_ZERO);
+#endif
LIST_INIT(&mac_label_element_list);
LIST_INIT(&mac_static_label_element_list);
- TAILQ_INIT(&mac_label_journal_list);
-
- mac_lck_grp_attr = lck_grp_attr_alloc_init();
- lck_grp_attr_setstat(mac_lck_grp_attr);
- mac_lck_grp = lck_grp_alloc_init("MAC lock", mac_lck_grp_attr);
- mac_lck_attr = lck_attr_alloc_init();
- lck_attr_setdefault(mac_lck_attr);
- mac_policy_mtx = lck_mtx_alloc_init(mac_lck_grp, mac_lck_attr);
- lck_attr_free(mac_lck_attr);
- lck_grp_attr_free(mac_lck_grp_attr);
- lck_grp_free(mac_lck_grp);
-
- mac_labelzone_init();
}
+/* Function pointer set up for loading security extensions.
+ * It is set to an actual function after OSlibkernInit()
+ * has been called, and is set back to 0 by OSKextRemoveKextBootstrap()
+ * after bsd_init().
+ */
+void (*load_security_extensions_function)(void) = 0;
+
/*
* Init after early Mach startup, but before BSD
*/
void
mac_policy_initmach(void)
{
-
/*
* For the purposes of modules that want to know if they were
* loaded "early", set the mac_late flag once we've processed
* kernel startup.
*/
- load_security_extensions();
+ if (load_security_extensions_function) {
+ load_security_extensions_function();
+ }
mac_late = 1;
-#if CONFIG_MACF_MACH
- mac_label_journal_replay();
-#endif
}
/*
struct mac_policy_conf *mpc;
u_int i;
- mac_audit_data_zone = zinit(MAC_AUDIT_DATA_LIMIT,
- AQ_HIWATER * MAC_AUDIT_DATA_LIMIT,
- 8192, "mac_audit_data_zone");
-
printf("MAC Framework successfully initialized\n");
/* Call bsd init functions of already loaded policies */
for (i = 0; i <= mac_policy_list.maxindex; i++) {
mpc = mac_get_mpc(i);
- if ((mpc != NULL) && (mpc->mpc_ops->mpo_policy_initbsd != NULL))
+ if ((mpc != NULL) && (mpc->mpc_ops->mpo_policy_initbsd != NULL)) {
(*(mpc->mpc_ops->mpo_policy_initbsd))(mpc);
+ }
}
mac_policy_release_exclusive();
/*
* After a policy has been loaded, add the label namespaces managed by the
- * policy to either the static or non-static label namespace list.
- * A namespace is added to the the list only if it is not already on one of
+ * policy to either the static or non-static label namespace list.
+ * A namespace is added to the the list only if it is not already on one of
* the lists.
*/
void
mpc = mac_get_mpc(handle);
- if (mpc->mpc_labelnames == NULL)
+ if (mpc->mpc_labelnames == NULL) {
return;
+ }
- if (mpc->mpc_labelname_count == 0)
+ if (mpc->mpc_labelname_count == 0) {
return;
+ }
- if (static_entry)
+ if (static_entry) {
list = &mac_static_label_element_list;
- else
+ } else {
list = &mac_label_element_list;
+ }
/*
* Before we grab the policy list lock, allocate enough memory
- * to contain the potential new elements so we don't have to
+ * to contain the potential new elements so we don't have to
* give up the lock, or allocate with the lock held.
*/
MALLOC(new_mles, struct mac_label_element **,
sizeof(struct mac_label_element *) *
mpc->mpc_labelname_count, M_MACTEMP, M_WAITOK | M_ZERO);
- for (idx = 0; idx < mpc->mpc_labelname_count; idx++)
- MALLOC(new_mles[idx], struct mac_label_element *,
+ for (idx = 0; idx < mpc->mpc_labelname_count; idx++) {
+ MALLOC(new_mles[idx], struct mac_label_element *,
sizeof(struct mac_label_element),
M_MACTEMP, M_WAITOK);
+ }
mle_free = 0;
MALLOC(new_mlls, struct mac_label_listener **,
sizeof(struct mac_label_listener *) *
mpc->mpc_labelname_count, M_MACTEMP, M_WAITOK);
- for (idx = 0; idx < mpc->mpc_labelname_count; idx++)
+ for (idx = 0; idx < mpc->mpc_labelname_count; idx++) {
MALLOC(new_mlls[idx], struct mac_label_listener *,
sizeof(struct mac_label_listener), M_MACTEMP, M_WAITOK);
+ }
mll_free = 0;
- if (mac_late)
+ if (mac_late) {
mac_policy_grab_exclusive();
+ }
for (idx = 0; idx < mpc->mpc_labelname_count; idx++) {
-
- if (*(name = mpc->mpc_labelnames[idx]) == '?')
+ if (*(name = mpc->mpc_labelnames[idx]) == '?') {
name++;
+ }
/*
- * Check both label element lists and add to the
+ * Check both label element lists and add to the
* appropriate list only if not already on a list.
*/
LIST_FOREACH(mle, &mac_static_label_element_list, mle_list) {
- if (*(name2 = mle->mle_name) == '?')
+ if (*(name2 = mle->mle_name) == '?') {
name2++;
- if (strcmp(name, name2) == 0)
+ }
+ if (strcmp(name, name2) == 0) {
break;
+ }
}
if (mle == NULL) {
LIST_FOREACH(mle, &mac_label_element_list, mle_list) {
- if (*(name2 = mle->mle_name) == '?')
+ if (*(name2 = mle->mle_name) == '?') {
name2++;
- if (strcmp(name, name2) == 0)
+ }
+ if (strcmp(name, name2) == 0) {
break;
+ }
}
}
if (mle == NULL) {
mle = new_mles[mle_free];
strlcpy(mle->mle_name, mpc->mpc_labelnames[idx],
- MAC_MAX_LABEL_ELEMENT_NAME);
+ MAC_MAX_LABEL_ELEMENT_NAME);
LIST_INIT(&mle->mle_listeners);
LIST_INSERT_HEAD(list, mle, mle_list);
mle_free++;
mll_list);
mll_free++;
}
- if (mac_late)
+ if (mac_late) {
mac_policy_release_exclusive();
+ }
/* Free up any unused label elements and listeners */
- for (idx = mle_free; idx < mpc->mpc_labelname_count; idx++)
+ for (idx = mle_free; idx < mpc->mpc_labelname_count; idx++) {
FREE(new_mles[idx], M_MACTEMP);
+ }
FREE(new_mles, M_MACTEMP);
- for (idx = mll_free; idx < mpc->mpc_labelname_count; idx++)
+ for (idx = mll_free; idx < mpc->mpc_labelname_count; idx++) {
FREE(new_mlls[idx], M_MACTEMP);
+ }
FREE(new_mlls, M_MACTEMP);
}
mpc = mac_get_mpc(handle);
- if (mpc->mpc_labelnames == NULL)
+ if (mpc->mpc_labelnames == NULL) {
return;
+ }
- if (mpc->mpc_labelname_count == 0)
+ if (mpc->mpc_labelname_count == 0) {
return;
+ }
/*
* Unregister policy as being interested in any label
static void
mac_policy_updateflags(void)
{
-#if !defined(CONFIG_MACF_ALWAYS_LABEL_MBUF) && 0 /* port to new list style */
-
- struct mac_policy_conf *tmpc;
- int labelmbufs;
-
- mac_policy_assert_exclusive();
-
- labelmbufs = 0;
-
- /* XXX - convert to new list structure */
- LIST_FOREACH(tmpc, &mac_static_policy_list, mpc_list) {
- if (tmpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_LABELMBUFS)
- labelmbufs++;
- }
- LIST_FOREACH(tmpc, &mac_policy_list, mpc_list) {
- if (tmpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_LABELMBUFS)
- labelmbufs++;
- }
- mac_labelmbufs = (labelmbufs != 0);
-#endif
}
static __inline void
if (arr->type == MAC_DATA_TYPE_DICT) {
dict = (struct mac_module_data_list *)aele->value;
DPRINTF(("fixup_mmd: dict @%p\n", dict));
- for (k = 0; k < dict->count; k++)
+ for (k = 0; k < dict->count; k++) {
mmd_fixup_ele(old, new,
&(dict->list[k]));
+ }
}
}
}
mac_policy_register(struct mac_policy_conf *mpc, mac_policy_handle_t *handlep,
void *xd)
{
+#if XNU_TARGET_OS_OSX
struct mac_policy_list_element *tmac_policy_list_element;
+#endif
int error, slot, static_entry = 0;
u_int i;
* Some preliminary checks to make sure the policy's conf structure
* contains the required fields.
*/
- if (mpc->mpc_name == NULL)
+ if (mpc->mpc_name == NULL) {
panic("policy's name is not set\n");
+ }
- if (mpc->mpc_fullname == NULL)
+ if (mpc->mpc_fullname == NULL) {
panic("policy's full name is not set\n");
+ }
- if (mpc->mpc_labelname_count > MAC_MAX_MANAGED_NAMESPACES)
+ if (mpc->mpc_labelname_count > MAC_MAX_MANAGED_NAMESPACES) {
panic("policy's managed label namespaces exceeds maximum\n");
+ }
- if (mpc->mpc_ops == NULL)
+ if (mpc->mpc_ops == NULL) {
panic("policy's OPs field is NULL\n");
+ }
error = 0;
if (mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_NOTLATE) {
printf("Module %s does not support late loading.\n",
mpc->mpc_name);
- return (EPERM);
+ return EPERM;
}
mac_policy_grab_exclusive();
}
if (mac_policy_list.numloaded >= mac_policy_list.max) {
+#if XNU_TARGET_OS_OSX
/* allocate new policy list array, zero new chunk */
tmac_policy_list_element =
kalloc((sizeof(struct mac_policy_list_element) *
bzero(&tmac_policy_list_element[mac_policy_list.max],
sizeof(struct mac_policy_list_element) *
MAC_POLICY_LIST_CHUNKSIZE);
-
+
/* copy old entries into new list */
- memcpy(tmac_policy_list_element, mac_policy_list.entries,
- sizeof(struct mac_policy_list_element) *
- MAC_POLICY_LIST_CHUNKSIZE * mac_policy_list.chunks);
-
+ memcpy(tmac_policy_list_element, mac_policy_list.entries,
+ sizeof(struct mac_policy_list_element) *
+ MAC_POLICY_LIST_CHUNKSIZE * mac_policy_list.chunks);
+
/* free old array */
kfree(mac_policy_list.entries,
sizeof(struct mac_policy_list_element) *
MAC_POLICY_LIST_CHUNKSIZE * mac_policy_list.chunks);
-
+
mac_policy_list.entries = tmac_policy_list_element;
/* Update maximums, etc */
mac_policy_list.max += MAC_POLICY_LIST_CHUNKSIZE;
mac_policy_list.chunks++;
+#else
+ printf("out of space in mac_policy_list.\n");
+ return ENOMEM;
+#endif /* XNU_TARGET_OS_OSX */
}
/* Check for policy with same name already loaded */
for (i = 0; i <= mac_policy_list.maxindex; i++) {
- if (mac_policy_list.entries[i].mpc == NULL)
- continue;
+ if (mac_policy_list.entries[i].mpc == NULL) {
+ continue;
+ }
if (strcmp(mac_policy_list.entries[i].mpc->mpc_name,
mpc->mpc_name) == 0) {
mac_policy_list.entries[*handlep].mpc = mpc;
/* Update counters, etc */
- if (*handlep > mac_policy_list.maxindex)
+ if (*handlep > mac_policy_list.maxindex) {
mac_policy_list.maxindex = *handlep;
+ }
mac_policy_list.numloaded++;
-
+
/* Per-policy initialization. */
- printf ("calling mpo_policy_init for %s\n", mpc->mpc_name);
- if (mpc->mpc_ops->mpo_policy_init != NULL)
+ printf("calling mpo_policy_init for %s\n", mpc->mpc_name);
+ if (mpc->mpc_ops->mpo_policy_init != NULL) {
(*(mpc->mpc_ops->mpo_policy_init))(mpc);
+ }
if (mac_late && mpc->mpc_ops->mpo_policy_initbsd != NULL) {
- printf ("calling mpo_policy_initbsd for %s\n", mpc->mpc_name);
+ printf("calling mpo_policy_initbsd for %s\n", mpc->mpc_name);
(*(mpc->mpc_ops->mpo_policy_initbsd))(mpc);
}
mac_policy_updateflags();
- if (mac_late)
+ if (mac_late) {
mac_policy_release_exclusive();
+ }
mac_policy_addto_labellist(*handlep, static_entry);
printf("Security policy loaded: %s (%s)\n", mpc->mpc_fullname,
mpc->mpc_name);
- return (0);
+ return 0;
out:
- if (mac_late)
+ if (mac_late) {
mac_policy_release_exclusive();
+ }
- return (error);
+ return error;
}
int
mpc = mac_get_mpc(handle);
if ((mpc->mpc_runtime_flags & MPC_RUNTIME_FLAG_REGISTERED) == 0) {
mac_policy_release_exclusive();
- return (0);
+ return 0;
}
#if 0
*/
if (mpc->mpc_field_off != NULL) {
MAC_POLICY_LIST_UNLOCK();
- return (EBUSY);
+ return EBUSY;
}
#endif
/*
*/
if ((mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_UNLOADOK) == 0) {
mac_policy_release_exclusive();
- return (EBUSY);
+ return EBUSY;
}
mac_policy_removefrom_labellist(handle);
mac_get_mpc(handle) = NULL;
if (handle < mac_policy_list.freehint &&
- handle >= mac_policy_list.staticmax)
+ handle >= mac_policy_list.staticmax) {
mac_policy_list.freehint = handle;
+ }
- if (handle == mac_policy_list.maxindex)
+ if (handle == mac_policy_list.maxindex) {
mac_policy_list.maxindex--;
+ }
- mac_policy_list.numloaded--;
+ mac_policy_list.numloaded--;
if (mpc->mpc_field_off != NULL) {
mac_slot_offsets_free |= (1 << *mpc->mpc_field_off);
}
- if (mpc->mpc_ops->mpo_policy_destroy != NULL)
+ if (mpc->mpc_ops->mpo_policy_destroy != NULL) {
(*(mpc->mpc_ops->mpo_policy_destroy))(mpc);
+ }
mpc->mpc_runtime_flags &= ~MPC_RUNTIME_FLAG_REGISTERED;
mac_policy_updateflags();
printf("Security policy unload: %s (%s)\n", mpc->mpc_fullname,
mpc->mpc_name);
- return (0);
+ return 0;
}
/*
int
mac_error_select(int error1, int error2)
{
-
/* Certain decision-making errors take top priority. */
- if (error1 == EDEADLK || error2 == EDEADLK)
- return (EDEADLK);
+ if (error1 == EDEADLK || error2 == EDEADLK) {
+ return EDEADLK;
+ }
/* Invalid arguments should be reported where possible. */
- if (error1 == EINVAL || error2 == EINVAL)
- return (EINVAL);
+ if (error1 == EINVAL || error2 == EINVAL) {
+ return EINVAL;
+ }
/* Precedence goes to "visibility", with both process and file. */
- if (error1 == ESRCH || error2 == ESRCH)
- return (ESRCH);
+ if (error1 == ESRCH || error2 == ESRCH) {
+ return ESRCH;
+ }
- if (error1 == ENOENT || error2 == ENOENT)
- return (ENOENT);
+ if (error1 == ENOENT || error2 == ENOENT) {
+ return ENOENT;
+ }
/* Precedence goes to DAC/MAC protections. */
- if (error1 == EACCES || error2 == EACCES)
- return (EACCES);
+ if (error1 == EACCES || error2 == EACCES) {
+ return EACCES;
+ }
/* Precedence goes to privilege. */
- if (error1 == EPERM || error2 == EPERM)
- return (EPERM);
+ if (error1 == EPERM || error2 == EPERM) {
+ return EPERM;
+ }
/* Precedence goes to error over success; otherwise, arbitrary. */
- if (error1 != 0)
- return (error1);
- return (error2);
+ if (error1 != 0) {
+ return error1;
+ }
+ return error2;
}
void
mac_label_init(struct label *label)
{
-
bzero(label, sizeof(*label));
label->l_flags = MAC_FLAG_INITIALIZED;
}
void
mac_label_destroy(struct label *label)
{
-
KASSERT(label->l_flags & MAC_FLAG_INITIALIZED,
("destroying uninitialized label"));
/* implicit: label->l_flags &= ~MAC_FLAG_INITIALIZED; */
}
-int
-mac_port_check_service (struct label *subj, struct label *obj,
- const char *s, const char *p)
-{
- int error;
-
- MAC_CHECK(port_check_service, subj, obj, s, p);
- return (error);
-}
-
-int
-mac_port_label_compute(struct label *subj, struct label *obj,
- const char *s, struct label *out)
-{
- int error;
-
- MAC_CHECK(port_label_compute, subj, obj, s, out);
- return error;
-}
-
int
mac_check_structmac_consistent(struct user_mac *mac)
{
+ if (mac->m_buflen > MAC_MAX_LABEL_BUF_LEN || mac->m_buflen == 0) {
+ return EINVAL;
+ }
- if (mac->m_buflen > MAC_MAX_LABEL_BUF_LEN || mac->m_buflen == 0)
- return (EINVAL);
-
- return (0);
+ return 0;
}
/*
const char *name;
int (*mpo_externalize)(struct label *, char *, struct sbuf *);
int all_labels = 0, ignorenotfound = 0, error = 0, busy = FALSE;
+ int sb_pos;
unsigned int count = 0;
if (element[0] == '?') {
element++;
ignorenotfound = 1;
- } else if (element[0] == '*' && element[1] == '\0')
+ } else if (element[0] == '*' && element[1] == '\0') {
all_labels = 1;
+ }
element_list = &mac_static_label_element_list;
element_loop:
LIST_FOREACH(mle, element_list, mle_list) {
name = mle->mle_name;
if (all_labels) {
- if (*name == '?')
- continue;
+ if (*name == '?') {
+ continue;
+ }
} else {
- if (*name == '?')
+ if (*name == '?') {
name++;
- if (strcmp(name, element) != 0)
+ }
+ if (strcmp(name, element) != 0) {
continue;
+ }
}
LIST_FOREACH(mll, &mle->mle_listeners, mll_list) {
mpc = mac_policy_list.entries[mll->mll_handle].mpc;
- if (mpc == NULL)
+ if (mpc == NULL) {
continue;
- mpo_externalize = *(typeof(mpo_externalize) *)
- ((char *)mpc->mpc_ops + mpo_externalize_off);
- if (mpo_externalize == NULL)
+ }
+ mpo_externalize = *(const typeof(mpo_externalize) *)
+ ((const char *)mpc->mpc_ops + mpo_externalize_off);
+ if (mpo_externalize == NULL) {
continue;
+ }
+ sb_pos = sbuf_len(sb);
error = sbuf_printf(sb, "%s/", name);
- if (error)
+ if (error) {
goto done;
+ }
error = mpo_externalize(label, mle->mle_name, sb);
if (error) {
- if (error != ENOENT)
+ if (error != ENOENT) {
goto done;
+ }
/*
* If a policy doesn't have a label to
* externalize it returns ENOENT. This
* multiple label elements for some
* (but not all) object types.
*/
- sbuf_setpos(sb, sbuf_len(sb) -
- (strlen(name) + 1));
+ sbuf_setpos(sb, sb_pos);
error = 0;
continue;
}
error = sbuf_putc(sb, ',');
- if (error)
+ if (error) {
goto done;
+ }
count++;
}
}
goto element_loop;
}
done:
- if (busy)
+ if (busy) {
mac_policy_list_unbusy();
+ }
if (!error && count == 0) {
- if (!all_labels && !ignorenotfound)
- error = ENOENT; /* XXX: ENOLABEL? */
+ if (!all_labels && !ignorenotfound) {
+ error = ENOENT; /* XXX: ENOLABEL? */
+ }
}
- return (error);
+ return error;
}
/*
* Get the external forms of labels from all policies, for all label
* namespaces contained in a list.
+ *
+ * XXX This may be leaking an sbuf.
*/
int
mac_externalize(size_t mpo_externalize_off, struct label *label,
const char *elementlist, char *outbuf, size_t outbuflen)
{
char *element;
+ char *scratch_base;
+ char *scratch;
struct sbuf sb;
int error = 0, len;
- sbuf_new(&sb, outbuf, outbuflen, SBUF_FIXEDLEN);
- while ((element = strsep(&elementlist, ",")) != NULL) {
+ /* allocate a scratch buffer the size of the string */
+ MALLOC(scratch_base, char *, strlen(elementlist) + 1, M_MACTEMP, M_WAITOK);
+ if (scratch_base == NULL) {
+ error = ENOMEM;
+ goto out;
+ }
+
+ /* copy the elementlist to the scratch buffer */
+ strlcpy(scratch_base, elementlist, strlen(elementlist) + 1);
+
+ /*
+ * set up a temporary pointer that can be used to iterate the
+ * scratch buffer without losing the allocation address
+ */
+ scratch = scratch_base;
+
+ /*
+ * initialize an sbuf mapping over the output buffer (or newly-allocated internal buffer, if
+ * outbuf is NULL), up to sbuf's limit of INT_MAX.
+ */
+ if (outbuflen > INT_MAX) {
+ outbuflen = INT_MAX;
+ }
+ if (sbuf_new(&sb, outbuf, (int)outbuflen, SBUF_FIXEDLEN) == NULL) {
+ /* could not allocate interior buffer */
+ error = ENOMEM;
+ goto out;
+ }
+ /* iterate the scratch buffer; NOTE: buffer contents modified! */
+ while ((element = strsep(&scratch, ",")) != NULL) {
error = mac_label_externalize(mpo_externalize_off, label,
element, &sb);
- if (error)
+ if (error) {
break;
+ }
+ }
+ if ((len = sbuf_len(&sb)) > 0) {
+ sbuf_setpos(&sb, len - 1); /* trim trailing comma */
}
- if ((len = sbuf_len(&sb)) > 0)
- sbuf_setpos(&sb, len - 1); /* trim trailing comma */
sbuf_finish(&sb);
- return (error);
+
+out:
+ if (scratch_base != NULL) {
+ FREE(scratch_base, M_MACTEMP);
+ }
+
+ return error;
}
/*
element_list = &mac_static_label_element_list;
element_loop:
LIST_FOREACH(mle, element_list, mle_list) {
- if (*(name = mle->mle_name) == '?')
+ if (*(name = mle->mle_name) == '?') {
name++;
- if (strcmp(element_name, name) != 0)
+ }
+ if (strcmp(element_name, name) != 0) {
continue;
+ }
LIST_FOREACH(mll, &mle->mle_listeners, mll_list) {
mpc = mac_policy_list.entries[mll->mll_handle].mpc;
- if (mpc == NULL)
+ if (mpc == NULL) {
continue;
- mpo_internalize = *(typeof(mpo_internalize) *)
- ((char *)mpc->mpc_ops + mpo_internalize_off);
- if (mpo_internalize == NULL)
+ }
+ mpo_internalize = *(const typeof(mpo_internalize) *)
+ ((const char *)mpc->mpc_ops + mpo_internalize_off);
+ if (mpo_internalize == NULL) {
continue;
+ }
error = mpo_internalize(label, element_name,
element_data);
- if (error)
+ if (error) {
goto done;
+ }
count++;
}
}
goto element_loop;
}
done:
- if (busy)
+ if (busy) {
mac_policy_list_unbusy();
- if (!error && count == 0)
+ }
+ if (!error && count == 0) {
error = ENOPOLICY;
- return (error);
+ }
+ return error;
}
int
error = mac_label_internalize(mpo_internalize_off, label,
element_name, element_data);
}
- return (error);
+ return error;
}
/* system calls */
int
-__mac_get_pid(struct proc *p, struct __mac_get_pid_args *uap, register_t *ret __unused)
+__mac_get_pid(struct proc *p, struct __mac_get_pid_args *uap, int *ret __unused)
{
char *elements, *buffer;
struct user_mac mac;
AUDIT_ARG(pid, uap->pid);
if (IS_64BIT_PROCESS(p)) {
- error = copyin(uap->mac_p, &mac, sizeof(mac));
+ struct user64_mac mac64;
+ error = copyin(uap->mac_p, &mac64, sizeof(mac64));
+ mac.m_buflen = mac64.m_buflen;
+ mac.m_string = mac64.m_string;
} else {
- struct mac mac32;
+ struct user32_mac mac32;
error = copyin(uap->mac_p, &mac32, sizeof(mac32));
mac.m_buflen = mac32.m_buflen;
- mac.m_string = CAST_USER_ADDR_T(mac32.m_string);
+ mac.m_string = mac32.m_string;
+ }
+ if (error) {
+ return error;
}
- if (error)
- return (error);
error = mac_check_structmac_consistent(&mac);
- if (error)
- return (error);
+ if (error) {
+ return error;
+ }
tproc = proc_find(uap->pid);
- if (tproc == NULL)
- return (ESRCH);
+ if (tproc == NULL) {
+ return ESRCH;
+ }
tcred = kauth_cred_proc_ref(tproc);
proc_rele(tproc);
if (error) {
FREE(elements, M_MACTEMP);
kauth_cred_unref(&tcred);
- return (error);
+ return error;
}
AUDIT_ARG(mac_string, elements);
MALLOC(buffer, char *, mac.m_buflen, M_MACTEMP, M_WAITOK | M_ZERO);
error = mac_cred_label_externalize(tcred->cr_label, elements,
buffer, mac.m_buflen, M_WAITOK);
- if (error == 0)
- error = copyout(buffer, mac.m_string, strlen(buffer)+1);
+ if (error == 0) {
+ error = copyout(buffer, mac.m_string, strlen(buffer) + 1);
+ }
FREE(buffer, M_MACTEMP);
FREE(elements, M_MACTEMP);
kauth_cred_unref(&tcred);
- return (error);
+ return error;
}
int
-__mac_get_proc(proc_t p, struct __mac_get_proc_args *uap, register_t *ret __unused)
+__mac_get_proc(proc_t p, struct __mac_get_proc_args *uap, int *ret __unused)
{
char *elements, *buffer;
struct user_mac mac;
size_t ulen;
if (IS_64BIT_PROCESS(p)) {
- error = copyin(uap->mac_p, &mac, sizeof(mac));
+ struct user64_mac mac64;
+ error = copyin(uap->mac_p, &mac64, sizeof(mac64));
+ mac.m_buflen = mac64.m_buflen;
+ mac.m_string = mac64.m_string;
} else {
- struct mac mac32;
+ struct user32_mac mac32;
error = copyin(uap->mac_p, &mac32, sizeof(mac32));
mac.m_buflen = mac32.m_buflen;
- mac.m_string = CAST_USER_ADDR_T(mac32.m_string);
+ mac.m_string = mac32.m_string;
+ }
+ if (error) {
+ return error;
}
- if (error)
- return (error);
error = mac_check_structmac_consistent(&mac);
- if (error)
- return (error);
+ if (error) {
+ return error;
+ }
MALLOC(elements, char *, mac.m_buflen, M_MACTEMP, M_WAITOK);
error = copyinstr(mac.m_string, elements, mac.m_buflen, &ulen);
if (error) {
FREE(elements, M_MACTEMP);
- return (error);
+ return error;
}
AUDIT_ARG(mac_string, elements);
MALLOC(buffer, char *, mac.m_buflen, M_MACTEMP, M_WAITOK | M_ZERO);
error = mac_cred_label_externalize(cr->cr_label,
elements, buffer, mac.m_buflen, M_WAITOK);
- if (error == 0)
- error = copyout(buffer, mac.m_string, strlen(buffer)+1);
+ if (error == 0) {
+ error = copyout(buffer, mac.m_string, strlen(buffer) + 1);
+ }
FREE(buffer, M_MACTEMP);
FREE(elements, M_MACTEMP);
kauth_cred_unref(&cr);
- return (error);
+ return error;
}
-/*
- * MPSAFE
- */
-
int
-__mac_set_proc(proc_t p, struct __mac_set_proc_args *uap, register_t *ret __unused)
+__mac_set_proc(proc_t p, struct __mac_set_proc_args *uap, int *ret __unused)
{
- kauth_cred_t newcred, oldcred;
struct label *intlabel;
struct user_mac mac;
char *buffer;
size_t ulen;
if (IS_64BIT_PROCESS(p)) {
- error = copyin(uap->mac_p, &mac, sizeof(mac));
+ struct user64_mac mac64;
+ error = copyin(uap->mac_p, &mac64, sizeof(mac64));
+ mac.m_buflen = mac64.m_buflen;
+ mac.m_string = mac64.m_string;
} else {
- struct mac mac32;
+ struct user32_mac mac32;
error = copyin(uap->mac_p, &mac32, sizeof(mac32));
mac.m_buflen = mac32.m_buflen;
- mac.m_string = CAST_USER_ADDR_T(mac32.m_string);
+ mac.m_string = mac32.m_string;
+ }
+ if (error) {
+ return error;
}
- if (error)
- return (error);
error = mac_check_structmac_consistent(&mac);
- if (error)
- return (error);
+ if (error) {
+ return error;
+ }
MALLOC(buffer, char *, mac.m_buflen, M_MACTEMP, M_WAITOK);
error = copyinstr(mac.m_string, buffer, mac.m_buflen, &ulen);
if (error) {
FREE(buffer, M_MACTEMP);
- return (error);
+ return error;
}
AUDIT_ARG(mac_string, buffer);
intlabel = mac_cred_label_alloc();
error = mac_cred_label_internalize(intlabel, buffer);
FREE(buffer, M_MACTEMP);
- if (error)
+ if (error) {
goto out;
+ }
error = mac_cred_check_label_update(kauth_cred_get(), intlabel);
if (error) {
}
error = kauth_proc_label_update(p, intlabel);
- if (error)
+ if (error) {
goto out;
-
- newcred = kauth_cred_proc_ref(p);
- mac_task_label_update_cred(newcred, p->task);
-
-#if 0
- if (mac_vm_enforce) {
- mutex_lock(Giant); /* XXX FUNNEL? */
- mac_cred_mmapped_drop_perms(p, newcred);
- mutex_unlock(Giant); /* XXX FUNNEL? */
}
-#endif
- kauth_cred_unref(&newcred);
out:
mac_cred_label_free(intlabel);
- return (error);
+ return error;
}
-#if CONFIG_LCTX
int
-__mac_get_lcid(proc_t p, struct __mac_get_lcid_args *uap, register_t *ret __unused)
+__mac_get_fd(proc_t p, struct __mac_get_fd_args *uap, int *ret __unused)
{
- char *elements, *buffer;
+ struct fileproc *fp;
+ struct vnode *vp;
struct user_mac mac;
- struct lctx *l;
+ char *elements, *buffer;
int error;
size_t ulen;
+ kauth_cred_t my_cred;
+ struct label *intlabel;
+
+ AUDIT_ARG(fd, uap->fd);
- AUDIT_ARG(value, uap->lcid);
if (IS_64BIT_PROCESS(p)) {
- error = copyin(uap->mac_p, &mac, sizeof(mac));
+ struct user64_mac mac64;
+ error = copyin(uap->mac_p, &mac64, sizeof(mac64));
+ mac.m_buflen = mac64.m_buflen;
+ mac.m_string = mac64.m_string;
} else {
- struct mac mac32;
+ struct user32_mac mac32;
error = copyin(uap->mac_p, &mac32, sizeof(mac32));
mac.m_buflen = mac32.m_buflen;
- mac.m_string = CAST_USER_ADDR_T(mac32.m_string);
+ mac.m_string = mac32.m_string;
}
- if (error)
- return (error);
+ if (error) {
+ return error;
+ }
error = mac_check_structmac_consistent(&mac);
- if (error)
- return (error);
-
- l = lcfind(uap->lcid);
- if (l == NULL)
- return (ESRCH);
-
- MALLOC(elements, char *, mac.m_buflen, M_MACTEMP, M_WAITOK);
- error = copyinstr(mac.m_string, elements, mac.m_buflen, &ulen);
if (error) {
- LCTX_UNLOCK(l);
- FREE(elements, M_MACTEMP);
- return (error);
+ return error;
}
- AUDIT_ARG(mac_string, elements);
- MALLOC(buffer, char *, mac.m_buflen, M_MACTEMP, M_WAITOK);
- error = mac_lctx_label_externalize(l->lc_label, elements,
- buffer, mac.m_buflen);
- if (error == 0)
- error = copyout(buffer, mac.m_string, strlen(buffer)+1);
-
- LCTX_UNLOCK(l);
- FREE(buffer, M_MACTEMP);
- FREE(elements, M_MACTEMP);
- return (error);
-}
-
-int
-__mac_get_lctx(proc_t p, struct __mac_get_lctx_args *uap, register_t *ret __unused)
-{
- char *elements, *buffer;
- struct user_mac mac;
- int error;
- size_t ulen;
-
- if (IS_64BIT_PROCESS(p)) {
- error = copyin(uap->mac_p, &mac, sizeof(mac));
- } else {
- struct mac mac32;
- error = copyin(uap->mac_p, &mac32, sizeof(mac32));
- mac.m_buflen = mac32.m_buflen;
- mac.m_string = CAST_USER_ADDR_T(mac32.m_string);
- }
-
- if (error)
- return (error);
-
- error = mac_check_structmac_consistent(&mac);
- if (error)
- return (error);
MALLOC(elements, char *, mac.m_buflen, M_MACTEMP, M_WAITOK);
error = copyinstr(mac.m_string, elements, mac.m_buflen, &ulen);
if (error) {
FREE(elements, M_MACTEMP);
- return (error);
- }
- AUDIT_ARG(mac_string, elements);
- MALLOC(buffer, char *, mac.m_buflen, M_MACTEMP, M_WAITOK);
-
- proc_lock(p);
- if (p->p_lctx == NULL) {
- proc_unlock(p);
- error = ENOENT;
- goto out;
- }
-
- error = mac_lctx_label_externalize(p->p_lctx->lc_label,
- elements, buffer, mac.m_buflen);
- proc_unlock(p);
- if (error == 0)
- error = copyout(buffer, mac.m_string, strlen(buffer)+1);
-
-out:
- FREE(buffer, M_MACTEMP);
- FREE(elements, M_MACTEMP);
- return (error);
-}
-
-int
-__mac_set_lctx(proc_t p, struct __mac_set_lctx_args *uap, register_t *ret __unused)
-{
- struct user_mac mac;
- struct label *intlabel;
- char *buffer;
- int error;
- size_t ulen;
-
- if (IS_64BIT_PROCESS(p)) {
- error = copyin(uap->mac_p, &mac, sizeof(mac));
- } else {
- struct mac mac32;
- error = copyin(uap->mac_p, &mac32, sizeof(mac32));
- mac.m_buflen = mac32.m_buflen;
- mac.m_string = CAST_USER_ADDR_T(mac32.m_string);
- }
- if (error)
- return (error);
-
- error = mac_check_structmac_consistent(&mac);
- if (error)
- return (error);
-
- MALLOC(buffer, char *, mac.m_buflen, M_MACTEMP, M_WAITOK);
- error = copyinstr(mac.m_string, buffer, mac.m_buflen, &ulen);
- if (error) {
- FREE(buffer, M_MACTEMP);
- return (error);
- }
- AUDIT_ARG(mac_string, buffer);
-
- intlabel = mac_lctx_label_alloc();
- error = mac_lctx_label_internalize(intlabel, buffer);
- FREE(buffer, M_MACTEMP);
- if (error)
- goto out;
-
- proc_lock(p);
- if (p->p_lctx == NULL) {
- proc_unlock(p);
- error = ENOENT;
- goto out;
- }
-
- error = mac_lctx_check_label_update(p->p_lctx, intlabel);
- if (error) {
- proc_unlock(p);
- goto out;
- }
- mac_lctx_label_update(p->p_lctx, intlabel);
- proc_unlock(p);
-out:
- mac_lctx_label_free(intlabel);
- return (error);
-}
-
-#else /* LCTX */
-
-int
-__mac_get_lcid(proc_t p __unused, struct __mac_get_lcid_args *uap __unused, register_t *ret __unused)
-{
-
- return (ENOSYS);
-}
-
-int
-__mac_get_lctx(proc_t p __unused, struct __mac_get_lctx_args *uap __unused, register_t *ret __unused)
-{
-
- return (ENOSYS);
-}
-
-int
-__mac_set_lctx(proc_t p __unused, struct __mac_set_lctx_args *uap __unused, register_t *ret __unused)
-{
-
- return (ENOSYS);
-}
-#endif /* !LCTX */
-
-int
-__mac_get_fd(proc_t p, struct __mac_get_fd_args *uap, register_t *ret __unused)
-{
- struct fileproc *fp;
- struct vnode *vp;
- struct user_mac mac;
- char *elements, *buffer;
- int error;
- size_t ulen;
- kauth_cred_t my_cred;
-#if CONFIG_MACF_SOCKET
- struct socket *so;
-#endif /* MAC_SOCKET */
- struct label *intlabel;
-
- AUDIT_ARG(fd, uap->fd);
-
- if (IS_64BIT_PROCESS(p)) {
- error = copyin(uap->mac_p, &mac, sizeof(mac));
- } else {
- struct mac mac32;
- error = copyin(uap->mac_p, &mac32, sizeof(mac32));
- mac.m_buflen = mac32.m_buflen;
- mac.m_string = CAST_USER_ADDR_T(mac32.m_string);
- }
-
- if (error)
- return (error);
-
- error = mac_check_structmac_consistent(&mac);
- if (error)
- return (error);
-
- MALLOC(elements, char *, mac.m_buflen, M_MACTEMP, M_WAITOK);
- error = copyinstr(mac.m_string, elements, mac.m_buflen, &ulen);
- if (error) {
- FREE(elements, M_MACTEMP);
- return (error);
+ return error;
}
AUDIT_ARG(mac_string, elements);
if (error) {
FREE(buffer, M_MACTEMP);
FREE(elements, M_MACTEMP);
- return (error);
+ return error;
}
-
+
my_cred = kauth_cred_proc_ref(p);
- error = mac_file_check_get(my_cred, fp->f_fglob, elements, mac.m_buflen);
+ error = mac_file_check_get(my_cred, fp->fp_glob, elements, mac.m_buflen);
kauth_cred_unref(&my_cred);
if (error) {
fp_drop(p, uap->fd, fp, 0);
FREE(buffer, M_MACTEMP);
FREE(elements, M_MACTEMP);
- return (error);
- }
-
- switch (fp->f_fglob->fg_type) {
- case DTYPE_VNODE:
-
- intlabel = mac_vnode_label_alloc();
- vp = (struct vnode *)fp->f_fglob->fg_data;
-
- error = vnode_getwithref(vp);
- if (error == 0) {
- mac_vnode_label_copy(vp->v_label, intlabel);
- error = mac_vnode_label_externalize(intlabel,
- elements, buffer,
- mac.m_buflen, M_WAITOK);
- vnode_put(vp);
- }
- mac_vnode_label_free(intlabel);
- break;
- case DTYPE_SOCKET:
-#if CONFIG_MACF_SOCKET
- so = (struct socket *) fp->f_fglob->fg_data;
- intlabel = mac_socket_label_alloc(MAC_WAITOK);
- sock_lock(so, 1);
- mac_socket_label_copy(so->so_label, intlabel);
- sock_unlock(so, 1);
- error = mac_socket_label_externalize(intlabel, elements, buffer, mac.m_buflen);
- mac_socket_label_free(intlabel);
- break;
-#endif
- case DTYPE_PSXSHM:
- case DTYPE_PSXSEM:
- case DTYPE_PIPE:
- case DTYPE_KQUEUE:
- case DTYPE_FSEVENTS:
- default:
- error = ENOSYS; // only sockets/vnodes so far
+ return error;
+ }
+
+ switch (FILEGLOB_DTYPE(fp->fp_glob)) {
+ case DTYPE_VNODE:
+ intlabel = mac_vnode_label_alloc();
+ if (intlabel == NULL) {
+ error = ENOMEM;
break;
+ }
+ vp = (struct vnode *)fp->fp_glob->fg_data;
+ error = vnode_getwithref(vp);
+ if (error == 0) {
+ mac_vnode_label_copy(vp->v_label, intlabel);
+ error = mac_vnode_label_externalize(intlabel,
+ elements, buffer,
+ mac.m_buflen, M_WAITOK);
+ vnode_put(vp);
+ }
+ mac_vnode_label_free(intlabel);
+ break;
+ case DTYPE_SOCKET:
+ case DTYPE_PSXSHM:
+ case DTYPE_PSXSEM:
+ case DTYPE_PIPE:
+ case DTYPE_KQUEUE:
+ case DTYPE_FSEVENTS:
+ case DTYPE_ATALK:
+ case DTYPE_NETPOLICY:
+ default:
+ error = ENOSYS; // only sockets/vnodes so far
+ break;
}
fp_drop(p, uap->fd, fp, 0);
-
- if (error == 0)
- error = copyout(buffer, mac.m_string, strlen(buffer)+1);
-
+
+ if (error == 0) {
+ error = copyout(buffer, mac.m_string, strlen(buffer) + 1);
+ }
+
FREE(buffer, M_MACTEMP);
FREE(elements, M_MACTEMP);
- return (error);
+ return error;
}
-/*
- * MPSAFE
- */
static int
mac_get_filelink(proc_t p, user_addr_t mac_p, user_addr_t path_p, int follow)
{
size_t ulen;
if (IS_64BIT_PROCESS(p)) {
- error = copyin(mac_p, &mac, sizeof(mac));
+ struct user64_mac mac64;
+ error = copyin(mac_p, &mac64, sizeof(mac64));
+ mac.m_buflen = mac64.m_buflen;
+ mac.m_string = mac64.m_string;
} else {
- struct mac mac32;
+ struct user32_mac mac32;
error = copyin(mac_p, &mac32, sizeof(mac32));
mac.m_buflen = mac32.m_buflen;
- mac.m_string = CAST_USER_ADDR_T(mac32.m_string);
+ mac.m_string = mac32.m_string;
}
- if (error)
- return (error);
+ if (error) {
+ return error;
+ }
error = mac_check_structmac_consistent(&mac);
- if (error)
- return (error);
+ if (error) {
+ return error;
+ }
MALLOC(elements, char *, mac.m_buflen, M_MACTEMP, M_WAITOK);
+ MALLOC(buffer, char *, mac.m_buflen, M_MACTEMP, M_WAITOK | M_ZERO);
+
error = copyinstr(mac.m_string, elements, mac.m_buflen, &ulen);
if (error) {
+ FREE(buffer, M_MACTEMP);
FREE(elements, M_MACTEMP);
- return (error);
+ return error;
}
AUDIT_ARG(mac_string, elements);
ctx = vfs_context_current();
- NDINIT(&nd, LOOKUP,
- LOCKLEAF | (follow ? FOLLOW : NOFOLLOW) | AUDITVNPATH1,
- UIO_USERSPACE, path_p, ctx);
+ NDINIT(&nd, LOOKUP, OP_LOOKUP,
+ LOCKLEAF | (follow ? FOLLOW : NOFOLLOW) | AUDITVNPATH1,
+ UIO_USERSPACE, path_p, ctx);
error = namei(&nd);
if (error) {
+ FREE(buffer, M_MACTEMP);
FREE(elements, M_MACTEMP);
- return (error);
+ return error;
}
vp = nd.ni_vp;
intlabel = mac_vnode_label_alloc();
mac_vnode_label_copy(vp->v_label, intlabel);
-
- MALLOC(buffer, char *, mac.m_buflen, M_MACTEMP, M_WAITOK | M_ZERO);
error = mac_vnode_label_externalize(intlabel, elements, buffer,
- mac.m_buflen, M_WAITOK);
- FREE(elements, M_MACTEMP);
-
- if (error == 0)
+ mac.m_buflen, M_WAITOK);
+ mac_vnode_label_free(intlabel);
+ if (error == 0) {
error = copyout(buffer, mac.m_string, strlen(buffer) + 1);
- FREE(buffer, M_MACTEMP);
+ }
vnode_put(vp);
- mac_vnode_label_free(intlabel);
- return (error);
+ FREE(buffer, M_MACTEMP);
+ FREE(elements, M_MACTEMP);
+
+ return error;
}
int
__mac_get_file(proc_t p, struct __mac_get_file_args *uap,
- register_t *ret __unused)
+ int *ret __unused)
{
-
- return (mac_get_filelink(p, uap->mac_p, uap->path_p, 1));
+ return mac_get_filelink(p, uap->mac_p, uap->path_p, 1);
}
int
__mac_get_link(proc_t p, struct __mac_get_link_args *uap,
- register_t *ret __unused)
+ int *ret __unused)
{
-
- return (mac_get_filelink(p, uap->mac_p, uap->path_p, 0));
+ return mac_get_filelink(p, uap->mac_p, uap->path_p, 0);
}
int
-__mac_set_fd(proc_t p, struct __mac_set_fd_args *uap, register_t *ret __unused)
+__mac_set_fd(proc_t p, struct __mac_set_fd_args *uap, int *ret __unused)
{
-
struct fileproc *fp;
struct user_mac mac;
struct vfs_context *ctx = vfs_context_current();
size_t ulen;
char *buffer;
struct label *intlabel;
-#if CONFIG_MACF_SOCKET
- struct socket *so;
-#endif
struct vnode *vp;
AUDIT_ARG(fd, uap->fd);
if (IS_64BIT_PROCESS(p)) {
- error = copyin(uap->mac_p, &mac, sizeof(mac));
+ struct user64_mac mac64;
+ error = copyin(uap->mac_p, &mac64, sizeof(mac64));
+ mac.m_buflen = mac64.m_buflen;
+ mac.m_string = mac64.m_string;
} else {
- struct mac mac32;
+ struct user32_mac mac32;
error = copyin(uap->mac_p, &mac32, sizeof(mac32));
mac.m_buflen = mac32.m_buflen;
- mac.m_string = CAST_USER_ADDR_T(mac32.m_string);
+ mac.m_string = mac32.m_string;
+ }
+ if (error) {
+ return error;
}
- if (error)
- return (error);
-
+
error = mac_check_structmac_consistent(&mac);
- if (error)
- return (error);
-
+ if (error) {
+ return error;
+ }
+
MALLOC(buffer, char *, mac.m_buflen, M_MACTEMP, M_WAITOK);
error = copyinstr(mac.m_string, buffer, mac.m_buflen, &ulen);
if (error) {
FREE(buffer, M_MACTEMP);
- return (error);
+ return error;
}
AUDIT_ARG(mac_string, buffer);
-
+
error = fp_lookup(p, uap->fd, &fp, 0);
if (error) {
FREE(buffer, M_MACTEMP);
- return (error);
+ return error;
}
-
- error = mac_file_check_set(vfs_context_ucred(ctx), fp->f_fglob, buffer, mac.m_buflen);
+
+ error = mac_file_check_set(vfs_context_ucred(ctx), fp->fp_glob, buffer, mac.m_buflen);
if (error) {
fp_drop(p, uap->fd, fp, 0);
FREE(buffer, M_MACTEMP);
- return (error);
+ return error;
}
-
- switch (fp->f_fglob->fg_type) {
-
- case DTYPE_VNODE:
- intlabel = mac_vnode_label_alloc();
-
- error = mac_vnode_label_internalize(intlabel, buffer);
- if (error) {
- mac_vnode_label_free(intlabel);
- break;
- }
+ switch (FILEGLOB_DTYPE(fp->fp_glob)) {
+ case DTYPE_VNODE:
+ if (mac_label_vnodes == 0) {
+ error = ENOSYS;
+ break;
+ }
- vp = (struct vnode *)fp->f_fglob->fg_data;
+ intlabel = mac_vnode_label_alloc();
- error = vnode_getwithref(vp);
- if (error == 0) {
- error = vn_setlabel(vp, intlabel, ctx);
- vnode_put(vp);
- }
+ error = mac_vnode_label_internalize(intlabel, buffer);
+ if (error) {
mac_vnode_label_free(intlabel);
break;
+ }
- case DTYPE_SOCKET:
-#if CONFIG_MACF_SOCKET
- intlabel = mac_socket_label_alloc(MAC_WAITOK);
- error = mac_socket_label_internalize(intlabel, buffer);
- if (error == 0) {
- so = (struct socket *) fp->f_fglob->fg_data;
- SOCK_LOCK(so);
- error = mac_socket_label_update(vfs_context_ucred(ctx), so, intlabel);
- SOCK_UNLOCK(so);
- }
- mac_socket_label_free(intlabel);
- break;
-#endif
- case DTYPE_PSXSHM:
- case DTYPE_PSXSEM:
- case DTYPE_PIPE:
- case DTYPE_KQUEUE:
- case DTYPE_FSEVENTS:
- default:
- error = ENOSYS; // only sockets/vnodes so far
- break;
+
+ vp = (struct vnode *)fp->fp_glob->fg_data;
+
+ error = vnode_getwithref(vp);
+ if (error == 0) {
+ error = vn_setlabel(vp, intlabel, ctx);
+ vnode_put(vp);
+ }
+ mac_vnode_label_free(intlabel);
+ break;
+
+ case DTYPE_SOCKET:
+ case DTYPE_PSXSHM:
+ case DTYPE_PSXSEM:
+ case DTYPE_PIPE:
+ case DTYPE_KQUEUE:
+ case DTYPE_FSEVENTS:
+ case DTYPE_ATALK:
+ case DTYPE_NETPOLICY:
+ default:
+ error = ENOSYS; // only sockets/vnodes so far
+ break;
}
fp_drop(p, uap->fd, fp, 0);
FREE(buffer, M_MACTEMP);
- return (error);
+ return error;
}
-/*
- * MPSAFE
- */
static int
mac_set_filelink(proc_t p, user_addr_t mac_p, user_addr_t path_p,
- int follow)
+ int follow)
{
- register struct vnode *vp;
+ struct vnode *vp;
struct vfs_context *ctx = vfs_context_current();
struct label *intlabel;
struct nameidata nd;
int error;
size_t ulen;
+ if (mac_label_vnodes == 0) {
+ return ENOSYS;
+ }
+
if (IS_64BIT_PROCESS(p)) {
- error = copyin(mac_p, &mac, sizeof(mac));
+ struct user64_mac mac64;
+ error = copyin(mac_p, &mac64, sizeof(mac64));
+ mac.m_buflen = mac64.m_buflen;
+ mac.m_string = mac64.m_string;
} else {
- struct mac mac32;
+ struct user32_mac mac32;
error = copyin(mac_p, &mac32, sizeof(mac32));
mac.m_buflen = mac32.m_buflen;
- mac.m_string = CAST_USER_ADDR_T(mac32.m_string);
+ mac.m_string = mac32.m_string;
+ }
+ if (error) {
+ return error;
}
- if (error)
- return (error);
error = mac_check_structmac_consistent(&mac);
if (error) {
printf("mac_set_file: failed structure consistency check\n");
- return (error);
+ return error;
}
MALLOC(buffer, char *, mac.m_buflen, M_MACTEMP, M_WAITOK);
error = copyinstr(mac.m_string, buffer, mac.m_buflen, &ulen);
if (error) {
FREE(buffer, M_MACTEMP);
- return (error);
+ return error;
}
AUDIT_ARG(mac_string, buffer);
FREE(buffer, M_MACTEMP);
if (error) {
mac_vnode_label_free(intlabel);
- return (error);
+ return error;
}
- NDINIT(&nd, LOOKUP,
- LOCKLEAF | (follow ? FOLLOW : NOFOLLOW) | AUDITVNPATH1,
- UIO_USERSPACE, path_p, ctx);
+ NDINIT(&nd, LOOKUP, OP_LOOKUP,
+ LOCKLEAF | (follow ? FOLLOW : NOFOLLOW) | AUDITVNPATH1,
+ UIO_USERSPACE, path_p, ctx);
error = namei(&nd);
if (error) {
mac_vnode_label_free(intlabel);
- return (error);
+ return error;
}
vp = nd.ni_vp;
vnode_put(vp);
mac_vnode_label_free(intlabel);
- return (error);
+ return error;
}
int
__mac_set_file(proc_t p, struct __mac_set_file_args *uap,
- register_t *ret __unused)
+ int *ret __unused)
{
-
- return (mac_set_filelink(p, uap->mac_p, uap->path_p, 1));
+ return mac_set_filelink(p, uap->mac_p, uap->path_p, 1);
}
int
__mac_set_link(proc_t p, struct __mac_set_link_args *uap,
- register_t *ret __unused)
+ int *ret __unused)
{
-
- return (mac_set_filelink(p, uap->mac_p, uap->path_p, 0));
+ return mac_set_filelink(p, uap->mac_p, uap->path_p, 0);
}
/*
- * MPSAFE
+ * __mac_syscall: Perform a MAC policy system call
+ *
+ * Parameters: p Process calling this routine
+ * uap User argument descriptor (see below)
+ * retv (Unused)
+ *
+ * Indirect: uap->policy Name of target MAC policy
+ * uap->call MAC policy-specific system call to perform
+ * uap->arg MAC policy-specific system call arguments
+ *
+ * Returns: 0 Success
+ * !0 Not success
+ *
*/
-
int
-__mac_syscall(proc_t p, struct __mac_syscall_args *uap, register_t *retv __unused)
+__mac_syscall(proc_t p, struct __mac_syscall_args *uap, int *retv __unused)
{
struct mac_policy_conf *mpc;
char target[MAC_MAX_POLICY_NAME];
size_t ulen;
error = copyinstr(uap->policy, target, sizeof(target), &ulen);
- if (error)
- return (error);
- AUDIT_ARG(value, uap->call);
+ if (error) {
+ return error;
+ }
+ AUDIT_ARG(value32, uap->call);
AUDIT_ARG(mac_string, target);
error = ENOPOLICY;
for (i = 0; i < mac_policy_list.staticmax; i++) {
mpc = mac_policy_list.entries[i].mpc;
- if (mpc == NULL)
+ if (mpc == NULL) {
continue;
+ }
if (strcmp(mpc->mpc_name, target) == 0 &&
mpc->mpc_ops->mpo_policy_syscall != NULL) {
error = mpc->mpc_ops->mpo_policy_syscall(p,
uap->call, uap->arg);
goto done;
- }
+ }
}
if (mac_policy_list_conditional_busy() != 0) {
for (; i <= mac_policy_list.maxindex; i++) {
mpc = mac_policy_list.entries[i].mpc;
- if (mpc == NULL)
+ if (mpc == NULL) {
continue;
+ }
if (strcmp(mpc->mpc_name, target) == 0 &&
mpc->mpc_ops->mpo_policy_syscall != NULL) {
}
done:
- return (error);
+ return error;
}
int
size_t ulen;
if (IS_64BIT_PROCESS(current_proc())) {
- error = copyin(mac_p, &mac, sizeof(mac));
+ struct user64_mac mac64;
+ error = copyin(mac_p, &mac64, sizeof(mac64));
+ mac.m_buflen = mac64.m_buflen;
+ mac.m_string = mac64.m_string;
} else {
- struct mac mac32;
+ struct user32_mac mac32;
error = copyin(mac_p, &mac32, sizeof(mac32));
mac.m_buflen = mac32.m_buflen;
- mac.m_string = CAST_USER_ADDR_T(mac32.m_string);
+ mac.m_string = mac32.m_string;
+ }
+ if (error) {
+ return error;
}
- if (error)
- return (error);
error = mac_check_structmac_consistent(&mac);
- if (error)
- return (error);
+ if (error) {
+ return error;
+ }
MALLOC(elements, char *, mac.m_buflen, M_MACTEMP, M_WAITOK);
error = copyinstr(mac.m_string, elements, mac.m_buflen, &ulen);
if (error) {
FREE(elements, M_MACTEMP);
- return (error);
+ return error;
}
AUDIT_ARG(mac_string, elements);
mac.m_buflen);
FREE(elements, M_MACTEMP);
- if (error == 0)
+ if (error == 0) {
error = copyout(buffer, mac.m_string, strlen(buffer) + 1);
+ }
FREE(buffer, M_MACTEMP);
- return (error);
+ return error;
}
+/*
+ * __mac_get_mount: Get mount point label information for a given pathname
+ *
+ * Parameters: p (ignored)
+ * uap User argument descriptor (see below)
+ * ret (ignored)
+ *
+ * Indirect: uap->path Pathname
+ * uap->mac_p MAC info
+ *
+ * Returns: 0 Success
+ * !0 Not success
+ */
int
__mac_get_mount(proc_t p __unused, struct __mac_get_mount_args *uap,
- register_t *ret __unused)
+ int *ret __unused)
{
struct nameidata nd;
struct vfs_context *ctx = vfs_context_current();
struct mount *mp;
int error;
- NDINIT(&nd, LOOKUP, FOLLOW | AUDITVNPATH1,
- UIO_USERSPACE, uap->path, ctx);
+ NDINIT(&nd, LOOKUP, OP_LOOKUP, FOLLOW | AUDITVNPATH1,
+ UIO_USERSPACE, uap->path, ctx);
error = namei(&nd);
if (error) {
- return (error);
+ return error;
}
mp = nd.ni_vp->v_mount;
+ mount_ref(mp, 0);
+ vnode_put(nd.ni_vp);
nameidone(&nd);
- return mac_mount_label_get(mp, uap->mac_p);
+ error = mac_mount_label_get(mp, uap->mac_p);
+ mount_drop(mp, 0);
+ return error;
}
-#else /* MAC */
-
+/*
+ * mac_schedule_userret()
+ *
+ * Schedule a callback to the mpo_thread_userret hook. The mpo_thread_userret
+ * hook is called just before the thread exit from the kernel in ast_taken().
+ *
+ * Returns: 0 Success
+ * !0 Not successful
+ */
int
-mac_policy_register(struct mac_policy_conf *mpc __unused,
- mac_policy_handle_t *handlep __unused, void *xd __unused)
+mac_schedule_userret(void)
{
-
- return (0);
+ act_set_astmacf(current_thread());
+ return 0;
}
+/*
+ * mac_do_machexc()
+ *
+ * Do a Mach exception. This should only be done in the mpo_thread_userret
+ * callback.
+ *
+ * params: code exception code
+ * subcode exception subcode
+ * flags flags:
+ * MAC_DOEXCF_TRACED Only do exception if being
+ * ptrace()'ed.
+ *
+ *
+ * Returns: 0 Success
+ * !0 Not successful
+ */
int
-mac_policy_unregister(mac_policy_handle_t handle __unused)
+mac_do_machexc(int64_t code, int64_t subcode, uint32_t flags)
{
+ mach_exception_data_type_t codes[EXCEPTION_CODE_MAX];
+ proc_t p = current_proc();
- return (0);
-}
+ /* Only allow execption codes in MACF's reserved range. */
+ if ((code < EXC_MACF_MIN) || (code > EXC_MACF_MAX)) {
+ return 1;
+ }
-int
-mac_audit_text(char *text __unused, mac_policy_handle_t handle __unused)
-{
+ if (flags & MAC_DOEXCF_TRACED &&
+ !(p->p_lflag & P_LTRACED && (p->p_lflag & P_LPPWAIT) == 0)) {
+ return 0;
+ }
- return (0);
-}
-int
-mac_mount_label_get(struct mount *mp __unused, user_addr_t mac_p __unused)
-{
- return (ENOSYS);
-}
+ /* Send the Mach exception */
+ codes[0] = (mach_exception_data_type_t)code;
+ codes[1] = (mach_exception_data_type_t)subcode;
-int
-mac_vnop_setxattr(struct vnode *vp __unused, const char *name __unused, char *buf __unused, size_t len __unused)
-{
-
- return (ENOENT);
+ return bsd_exception(EXC_SOFTWARE, codes, 2) != KERN_SUCCESS;
}
-int
-mac_vnop_getxattr(struct vnode *vp __unused, const char *name __unused,
- char *buf __unused, size_t len __unused, size_t *attrlen __unused)
-{
+#else /* MAC */
- return (ENOENT);
-}
+void (*load_security_extensions_function)(void) = 0;
-int
-mac_vnop_removexattr(struct vnode *vp __unused, const char *name __unused)
-{
-
- return (ENOENT);
-}
+struct sysctl_oid_list sysctl__security_mac_children;
int
-__mac_get_pid(proc_t p __unused, struct __mac_get_pid_args *uap __unused, register_t *ret __unused)
+mac_policy_register(struct mac_policy_conf *mpc __unused,
+ mac_policy_handle_t *handlep __unused, void *xd __unused)
{
-
- return (ENOSYS);
+ return 0;
}
int
-__mac_get_proc(proc_t p __unused, struct __mac_get_proc_args *uap __unused, register_t *ret __unused)
+mac_policy_unregister(mac_policy_handle_t handle __unused)
{
-
- return (ENOSYS);
+ return 0;
}
int
-__mac_set_proc(proc_t p __unused, struct __mac_set_proc_args *uap __unused, register_t *ret __unused)
+mac_audit_text(char *text __unused, mac_policy_handle_t handle __unused)
{
-
- return (ENOSYS);
+ return 0;
}
int
-__mac_get_file(proc_t p __unused, struct __mac_get_file_args *uap __unused, register_t *ret __unused)
+mac_vnop_setxattr(struct vnode *vp __unused, const char *name __unused, char *buf __unused, size_t len __unused)
{
-
- return (ENOSYS);
+ return ENOENT;
}
int
-__mac_get_link(proc_t p __unused, struct __mac_get_link_args *uap __unused, register_t *ret __unused)
+mac_vnop_getxattr(struct vnode *vp __unused, const char *name __unused,
+ char *buf __unused, size_t len __unused, size_t *attrlen __unused)
{
-
- return (ENOSYS);
+ return ENOENT;
}
int
-__mac_set_file(proc_t p __unused, struct __mac_set_file_args *uap __unused, register_t *ret __unused)
+mac_vnop_removexattr(struct vnode *vp __unused, const char *name __unused)
{
-
- return (ENOSYS);
+ return ENOENT;
}
int
-__mac_set_link(proc_t p __unused, struct __mac_set_link_args *uap __unused, register_t *ret __unused)
+mac_file_setxattr(struct fileglob *fg __unused, const char *name __unused, char *buf __unused, size_t len __unused)
{
-
- return (ENOSYS);
+ return ENOENT;
}
int
-__mac_get_fd(proc_t p __unused, struct __mac_get_fd_args *uap __unused, register_t *ret __unused)
+mac_file_getxattr(struct fileglob *fg __unused, const char *name __unused,
+ char *buf __unused, size_t len __unused, size_t *attrlen __unused)
{
-
- return (ENOSYS);
+ return ENOENT;
}
int
-__mac_set_fd(proc_t p __unused, struct __mac_set_fd_args *uap __unused, register_t *ret __unused)
+mac_file_removexattr(struct fileglob *fg __unused, const char *name __unused)
{
-
- return (ENOSYS);
+ return ENOENT;
}
-int
-__mac_syscall(proc_t p __unused, struct __mac_syscall_args *uap __unused, register_t *ret __unused)
+intptr_t
+mac_label_get(struct label *l __unused, int slot __unused)
{
-
- return (ENOSYS);
+ return 0;
}
-int
-__mac_get_lcid(proc_t p __unused, struct __mac_get_lcid_args *uap __unused, register_t *ret __unused)
+void
+mac_label_set(struct label *l __unused, int slot __unused, intptr_t v __unused)
{
-
- return (ENOSYS);
+ return;
}
+int mac_iokit_check_hid_control(kauth_cred_t cred __unused);
int
-__mac_get_lctx(proc_t p __unused, struct __mac_get_lctx_args *uap __unused, register_t *ret __unused)
+mac_iokit_check_hid_control(kauth_cred_t cred __unused)
{
-
- return (ENOSYS);
+ return 0;
}
+int mac_mount_check_snapshot_mount(vfs_context_t ctx, struct vnode *rvp, struct vnode *vp, struct componentname *cnp,
+ const char *name, const char *vfc_name);
int
-__mac_set_lctx(proc_t p __unused, struct __mac_set_lctx_args *uap __unused, register_t *ret __unused)
+mac_mount_check_snapshot_mount(vfs_context_t ctx __unused, struct vnode *rvp __unused, struct vnode *vp __unused,
+ struct componentname *cnp __unused, const char *name __unused, const char *vfc_name __unused)
{
-
- return (ENOSYS);
+ return 0;
}
+int mac_vnode_check_trigger_resolve(vfs_context_t ctx __unused, struct vnode *dvp __unused, struct componentname *cnp __unused);
int
-__mac_get_mount(proc_t p __unused,
- struct __mac_get_mount_args *uap __unused, register_t *ret __unused)
+mac_vnode_check_trigger_resolve(vfs_context_t ctx __unused, struct vnode *dvp __unused, struct componentname *cnp __unused)
{
-
- return (ENOSYS);
+ return 0;
}
+
#endif /* !MAC */
projects / apple / xnu.git / blobdiff