#include <sys/vfs_context.h>
#include <sys/namei.h>
#include <bsd/bsm/audit.h>
-#include <bsd/bsm/audit_kernel.h>
+#include <bsd/security/audit/audit.h>
#include <sys/file.h>
#include <sys/file_internal.h>
#include <sys/filedesc.h>
#include <sys/kauth.h>
#include <sys/sysproto.h>
+#include <mach/exception_types.h>
#include <mach/vm_types.h>
#include <mach/vm_prot.h>
#include <kern/sched_prim.h>
#include <osfmk/kern/task.h>
#include <osfmk/kern/kalloc.h>
-#include <libsa/libsa/kext.h>
#if CONFIG_MACF
#include <security/mac.h>
#include <security/mac_mach_internal.h>
#endif
+
/*
* define MB_DEBUG to display run-time debugging information
* #define MB_DEBUG 1
SYSCTL_NODE(_security, OID_AUTO, mac, CTLFLAG_RW|CTLFLAG_LOCKED, 0,
"TrustedBSD MAC policy controls");
-
+#if DEBUG
+#define SECURITY_MAC_CTLFLAGS CTLFLAG_RW | CTLFLAG_LOCKED
+#else
+#define SECURITY_MAC_CTLFLAGS CTLFLAG_RD | CTLFLAG_LOCKED
+#endif
/*
* Declare that the kernel provides MAC support, version 1. This permits
static unsigned int mac_max_slots = MAC_MAX_SLOTS;
static unsigned int mac_slot_offsets_free = (1 << MAC_MAX_SLOTS) - 1;
-SYSCTL_UINT(_security_mac, OID_AUTO, max_slots, CTLFLAG_RD,
+SYSCTL_UINT(_security_mac, OID_AUTO, max_slots, CTLFLAG_RD | CTLFLAG_LOCKED,
&mac_max_slots, 0, "");
/*
* already has to deal with uninitialized labels, this probably won't
* be a problem. Note: currently no locking. Will this be a problem?
*/
-#if !defined(CONFIG_MACF_ALWAYS_LABEL_MBUF) && 0
-static int mac_labelmbufs = 0;
+#if CONFIG_MACF_NET
+unsigned int mac_label_mbufs = 1;
+SYSCTL_UINT(_security_mac, OID_AUTO, label_mbufs, SECURITY_MAC_CTLFLAGS,
+ &mac_label_mbufs, 0, "Label all MBUFs");
#endif
+
+/*
+ * Flag to indicate whether or not we should allocate label storage for
+ * new vnodes. Since most dynamic policies we currently work with don't
+ * rely on vnode labeling, try to avoid paying the cost of mtag allocation
+ * unless specifically notified of interest. One result of this is
+ * that if a dynamically loaded policy requests vnode labels, it must
+ * be able to deal with a NULL label being returned on any vnodes that
+ * were already in flight when the policy was loaded. Since the policy
+ * already has to deal with uninitialized labels, this probably won't
+ * be a problem.
+ */
+unsigned int mac_label_vnodes = 0;
+SYSCTL_UINT(_security_mac, OID_AUTO, labelvnodes, SECURITY_MAC_CTLFLAGS,
+ &mac_label_vnodes, 0, "Label all vnodes");
+
+
unsigned int mac_mmap_revocation = 0;
-SYSCTL_UINT(_security_mac, OID_AUTO, mmap_revocation, CTLFLAG_RW,
+SYSCTL_UINT(_security_mac, OID_AUTO, mmap_revocation, SECURITY_MAC_CTLFLAGS,
&mac_mmap_revocation, 0, "Revoke mmap access to files on subject "
"relabel");
unsigned int mac_mmap_revocation_via_cow = 0;
-SYSCTL_UINT(_security_mac, OID_AUTO, mmap_revocation_via_cow, CTLFLAG_RW,
+SYSCTL_UINT(_security_mac, OID_AUTO, mmap_revocation_via_cow, SECURITY_MAC_CTLFLAGS,
&mac_mmap_revocation_via_cow, 0, "Revoke mmap access to files via "
"copy-on-write semantics, or by removing all write access");
unsigned int mac_device_enforce = 1;
-SYSCTL_UINT(_security_mac, OID_AUTO, device_enforce, CTLFLAG_RW,
+SYSCTL_UINT(_security_mac, OID_AUTO, device_enforce, SECURITY_MAC_CTLFLAGS,
&mac_device_enforce, 0, "Enforce MAC policy on device operations");
-unsigned int mac_file_enforce = 0;
-SYSCTL_UINT(_security_mac, OID_AUTO, file_enforce, CTLFLAG_RW,
- &mac_file_enforce, 0, "Enforce MAC policy on file operations");
-
-unsigned int mac_iokit_enforce = 0;
-SYSCTL_UINT(_security_mac, OID_AUTO, iokit_enforce, CTLFLAG_RW,
- &mac_file_enforce, 0, "Enforce MAC policy on IOKit operations");
-
unsigned int mac_pipe_enforce = 1;
-SYSCTL_UINT(_security_mac, OID_AUTO, pipe_enforce, CTLFLAG_RW,
+SYSCTL_UINT(_security_mac, OID_AUTO, pipe_enforce, SECURITY_MAC_CTLFLAGS,
&mac_pipe_enforce, 0, "Enforce MAC policy on pipe operations");
unsigned int mac_posixsem_enforce = 1;
-SYSCTL_UINT(_security_mac, OID_AUTO, posixsem_enforce, CTLFLAG_RW,
+SYSCTL_UINT(_security_mac, OID_AUTO, posixsem_enforce, SECURITY_MAC_CTLFLAGS,
&mac_posixsem_enforce, 0, "Enforce MAC policy on POSIX semaphores");
unsigned int mac_posixshm_enforce = 1;
-SYSCTL_UINT(_security_mac, OID_AUTO, posixshm_enforce, CTLFLAG_RW,
+SYSCTL_UINT(_security_mac, OID_AUTO, posixshm_enforce, SECURITY_MAC_CTLFLAGS,
&mac_posixshm_enforce, 0, "Enforce MAC policy on Posix Shared Memory");
unsigned int mac_proc_enforce = 1;
-SYSCTL_UINT(_security_mac, OID_AUTO, proc_enforce, CTLFLAG_RW,
+SYSCTL_UINT(_security_mac, OID_AUTO, proc_enforce, SECURITY_MAC_CTLFLAGS,
&mac_proc_enforce, 0, "Enforce MAC policy on process operations");
unsigned int mac_socket_enforce = 1;
-SYSCTL_UINT(_security_mac, OID_AUTO, socket_enforce, CTLFLAG_RW,
+SYSCTL_UINT(_security_mac, OID_AUTO, socket_enforce, SECURITY_MAC_CTLFLAGS,
&mac_socket_enforce, 0, "Enforce MAC policy on socket operations");
unsigned int mac_system_enforce = 1;
-SYSCTL_UINT(_security_mac, OID_AUTO, system_enforce, CTLFLAG_RW,
+SYSCTL_UINT(_security_mac, OID_AUTO, system_enforce, SECURITY_MAC_CTLFLAGS,
&mac_system_enforce, 0, "Enforce MAC policy on system-wide interfaces");
unsigned int mac_sysvmsg_enforce = 1;
-SYSCTL_UINT(_security_mac, OID_AUTO, sysvmsg_enforce, CTLFLAG_RW,
+SYSCTL_UINT(_security_mac, OID_AUTO, sysvmsg_enforce, SECURITY_MAC_CTLFLAGS,
&mac_sysvmsg_enforce, 0, "Enforce MAC policy on System V IPC message queues");
unsigned int mac_sysvsem_enforce = 1;
-SYSCTL_UINT(_security_mac, OID_AUTO, sysvsem_enforce, CTLFLAG_RW,
+SYSCTL_UINT(_security_mac, OID_AUTO, sysvsem_enforce, SECURITY_MAC_CTLFLAGS,
&mac_sysvsem_enforce, 0, "Enforce MAC policy on System V IPC semaphores");
unsigned int mac_sysvshm_enforce = 1;
-SYSCTL_INT(_security_mac, OID_AUTO, sysvshm_enforce, CTLFLAG_RW,
+SYSCTL_INT(_security_mac, OID_AUTO, sysvshm_enforce, SECURITY_MAC_CTLFLAGS,
&mac_sysvshm_enforce, 0, "Enforce MAC policy on System V Shared Memory");
unsigned int mac_vm_enforce = 1;
-SYSCTL_INT(_security_mac, OID_AUTO, vm_enforce, CTLFLAG_RW,
+SYSCTL_INT(_security_mac, OID_AUTO, vm_enforce, SECURITY_MAC_CTLFLAGS,
&mac_vm_enforce, 0, "Enforce MAC policy on VM operations");
unsigned int mac_vnode_enforce = 1;
-SYSCTL_UINT(_security_mac, OID_AUTO, vnode_enforce, CTLFLAG_RW,
+SYSCTL_UINT(_security_mac, OID_AUTO, vnode_enforce, SECURITY_MAC_CTLFLAGS,
&mac_vnode_enforce, 0, "Enforce MAC policy on vnode operations");
-
-#if CONFIG_MACF_MACH
-unsigned int mac_port_enforce = 0;
-SYSCTL_UINT(_security_mac, OID_AUTO, port_enforce, CTLFLAG_RW,
- &mac_port_enforce, 0, "Enforce MAC policy on Mach port operations");
-
-unsigned int mac_task_enforce = 0;
-SYSCTL_UINT(_security_mac, OID_AUTO, task_enforce, CTLFLAG_RW,
- &mac_task_enforce, 0, "Enforce MAC policy on Mach task operations");
-#endif
-
-#if CONFIG_MACF_NET
-unsigned int mac_label_mbufs = 1;
-SYSCTL_UINT(_security_mac, OID_AUTO, label_mbufs, CTLFLAG_RW,
- &mac_label_mbufs, 0, "Label all MBUFs");
-#endif
-
-#if AUDIT
+#if CONFIG_AUDIT
/*
* mac_audit_data_zone is the zone used for data pushed into the audit
* record by policies. Using a zone simplifies memory management of this
mac_labelzone_init();
}
+/* Function pointer set up for loading security extensions.
+ * It is set to an actual function after OSlibkernInit()
+ * has been called, and is set back to 0 by OSKextRemoveKextBootstrap()
+ * after bsd_init().
+ */
+void (*load_security_extensions_function)(void) = 0;
+
/*
* Init after early Mach startup, but before BSD
*/
* kernel startup.
*/
- load_security_extensions();
+ if (load_security_extensions_function) {
+ load_security_extensions_function();
+ }
mac_late = 1;
#if CONFIG_MACF_MACH
mac_label_journal_replay();
struct mac_policy_conf *mpc;
u_int i;
-#if AUDIT
+#if CONFIG_AUDIT
mac_audit_data_zone = zinit(MAC_AUDIT_DATA_LIMIT,
AQ_HIWATER * MAC_AUDIT_DATA_LIMIT,
8192, "mac_audit_data_zone");
static void
mac_policy_updateflags(void)
{
-#if !defined(CONFIG_MACF_ALWAYS_LABEL_MBUF) && 0 /* port to new list style */
-
- struct mac_policy_conf *tmpc;
- int labelmbufs;
-
- mac_policy_assert_exclusive();
-
- labelmbufs = 0;
-
- /* XXX - convert to new list structure */
- LIST_FOREACH(tmpc, &mac_static_policy_list, mpc_list) {
- if (tmpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_LABELMBUFS)
- labelmbufs++;
- }
- LIST_FOREACH(tmpc, &mac_policy_list, mpc_list) {
- if (tmpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_LABELMBUFS)
- labelmbufs++;
- }
- mac_labelmbufs = (labelmbufs != 0);
-#endif
}
static __inline void
/*
* Get the external forms of labels from all policies, for all label
* namespaces contained in a list.
+ *
+ * XXX This may be leaking an sbuf.
*/
int
mac_externalize(size_t mpo_externalize_off, struct label *label,
const char *elementlist, char *outbuf, size_t outbuflen)
{
char *element;
+ char *scratch_base;
+ char *scratch;
struct sbuf sb;
int error = 0, len;
- sbuf_new(&sb, outbuf, outbuflen, SBUF_FIXEDLEN);
- while ((element = strsep(&elementlist, ",")) != NULL) {
+ /* allocate a scratch buffer the size of the string */
+ MALLOC(scratch_base, char *, strlen(elementlist)+1, M_MACTEMP, M_WAITOK);
+ if (scratch_base == NULL) {
+ error = ENOMEM;
+ goto out;
+ }
+
+ /* copy the elementlist to the scratch buffer */
+ strlcpy(scratch_base, elementlist, strlen(elementlist)+1);
+
+ /*
+ * set up a temporary pointer that can be used to iterate the
+ * scratch buffer without losing the allocation address
+ */
+ scratch = scratch_base;
+
+ /* get an sbuf */
+ if (sbuf_new(&sb, outbuf, outbuflen, SBUF_FIXEDLEN) == NULL) {
+ /* could not allocate interior buffer */
+ error = ENOMEM;
+ goto out;
+ }
+ /* iterate the scratch buffer; NOTE: buffer contents modified! */
+ while ((element = strsep(&scratch, ",")) != NULL) {
error = mac_label_externalize(mpo_externalize_off, label,
element, &sb);
if (error)
if ((len = sbuf_len(&sb)) > 0)
sbuf_setpos(&sb, len - 1); /* trim trailing comma */
sbuf_finish(&sb);
+
+out:
+ if (scratch_base != NULL)
+ FREE(scratch_base, M_MACTEMP);
+
return (error);
}
/* system calls */
int
-__mac_get_pid(struct proc *p, struct __mac_get_pid_args *uap, register_t *ret __unused)
+__mac_get_pid(struct proc *p, struct __mac_get_pid_args *uap, int *ret __unused)
{
char *elements, *buffer;
struct user_mac mac;
AUDIT_ARG(pid, uap->pid);
if (IS_64BIT_PROCESS(p)) {
- error = copyin(uap->mac_p, &mac, sizeof(mac));
+ struct user64_mac mac64;
+ error = copyin(uap->mac_p, &mac64, sizeof(mac64));
+ mac.m_buflen = mac64.m_buflen;
+ mac.m_string = mac64.m_string;
} else {
- struct mac mac32;
+ struct user32_mac mac32;
error = copyin(uap->mac_p, &mac32, sizeof(mac32));
mac.m_buflen = mac32.m_buflen;
- mac.m_string = CAST_USER_ADDR_T(mac32.m_string);
+ mac.m_string = mac32.m_string;
}
if (error)
return (error);
}
int
-__mac_get_proc(proc_t p, struct __mac_get_proc_args *uap, register_t *ret __unused)
+__mac_get_proc(proc_t p, struct __mac_get_proc_args *uap, int *ret __unused)
{
char *elements, *buffer;
struct user_mac mac;
size_t ulen;
if (IS_64BIT_PROCESS(p)) {
- error = copyin(uap->mac_p, &mac, sizeof(mac));
+ struct user64_mac mac64;
+ error = copyin(uap->mac_p, &mac64, sizeof(mac64));
+ mac.m_buflen = mac64.m_buflen;
+ mac.m_string = mac64.m_string;
} else {
- struct mac mac32;
+ struct user32_mac mac32;
error = copyin(uap->mac_p, &mac32, sizeof(mac32));
mac.m_buflen = mac32.m_buflen;
- mac.m_string = CAST_USER_ADDR_T(mac32.m_string);
+ mac.m_string = mac32.m_string;
}
if (error)
return (error);
return (error);
}
-/*
- * MPSAFE
- */
-
int
-__mac_set_proc(proc_t p, struct __mac_set_proc_args *uap, register_t *ret __unused)
+__mac_set_proc(proc_t p, struct __mac_set_proc_args *uap, int *ret __unused)
{
- kauth_cred_t newcred, oldcred;
+ kauth_cred_t newcred;
struct label *intlabel;
struct user_mac mac;
char *buffer;
size_t ulen;
if (IS_64BIT_PROCESS(p)) {
- error = copyin(uap->mac_p, &mac, sizeof(mac));
+ struct user64_mac mac64;
+ error = copyin(uap->mac_p, &mac64, sizeof(mac64));
+ mac.m_buflen = mac64.m_buflen;
+ mac.m_string = mac64.m_string;
} else {
- struct mac mac32;
+ struct user32_mac mac32;
error = copyin(uap->mac_p, &mac32, sizeof(mac32));
mac.m_buflen = mac32.m_buflen;
- mac.m_string = CAST_USER_ADDR_T(mac32.m_string);
+ mac.m_string = mac32.m_string;
}
if (error)
return (error);
}
#if CONFIG_LCTX
+/*
+ * __mac_get_lcid:
+ * Get login context ID. A login context associates a BSD process
+ * with an instance of a user. For more information see getlcid(2) man page.
+ *
+ * Parameters: p Process requesting the get
+ * uap User argument descriptor (see below)
+ * ret (ignored)
+ *
+ * Indirect: uap->lcid login context ID to search
+ * uap->mac_p.m_buflen MAC info buffer size
+ * uap->mac_p.m_string MAC info user address
+ *
+ * Returns: 0 Success
+ * !0 Not success
+ */
int
-__mac_get_lcid(proc_t p, struct __mac_get_lcid_args *uap, register_t *ret __unused)
+__mac_get_lcid(proc_t p, struct __mac_get_lcid_args *uap, int *ret __unused)
{
char *elements, *buffer;
struct user_mac mac;
int error;
size_t ulen;
- AUDIT_ARG(value, uap->lcid);
+ AUDIT_ARG(value32, uap->lcid);
if (IS_64BIT_PROCESS(p)) {
- error = copyin(uap->mac_p, &mac, sizeof(mac));
+ struct user64_mac mac64;
+ error = copyin(uap->mac_p, &mac64, sizeof(mac64));
+ mac.m_buflen = mac64.m_buflen;
+ mac.m_string = mac64.m_string;
} else {
- struct mac mac32;
+ struct user32_mac mac32;
error = copyin(uap->mac_p, &mac32, sizeof(mac32));
mac.m_buflen = mac32.m_buflen;
- mac.m_string = CAST_USER_ADDR_T(mac32.m_string);
+ mac.m_string = mac32.m_string;
}
if (error)
return (error);
}
+/*
+ * __mac_get_lctx:
+ * Get login context label. A login context associates a BSD process
+ * associated with an instance of a user.
+ *
+ * Parameters: p Process requesting the get
+ * uap User argument descriptor (see below)
+ * ret (ignored)
+ *
+ * Indirect: uap->lcid login context ID to search
+ * uap->mac_p MAC info
+ *
+ * Returns: 0 Success
+ * !0 Not success
+ *
+ */
int
-__mac_get_lctx(proc_t p, struct __mac_get_lctx_args *uap, register_t *ret __unused)
+__mac_get_lctx(proc_t p, struct __mac_get_lctx_args *uap, int *ret __unused)
{
char *elements, *buffer;
struct user_mac mac;
size_t ulen;
if (IS_64BIT_PROCESS(p)) {
- error = copyin(uap->mac_p, &mac, sizeof(mac));
+ struct user64_mac mac64;
+ error = copyin(uap->mac_p, &mac64, sizeof(mac64));
+ mac.m_buflen = mac64.m_buflen;
+ mac.m_string = mac64.m_string;
} else {
- struct mac mac32;
+ struct user32_mac mac32;
error = copyin(uap->mac_p, &mac32, sizeof(mac32));
mac.m_buflen = mac32.m_buflen;
- mac.m_string = CAST_USER_ADDR_T(mac32.m_string);
+ mac.m_string = mac32.m_string;
}
if (error)
}
int
-__mac_set_lctx(proc_t p, struct __mac_set_lctx_args *uap, register_t *ret __unused)
+__mac_set_lctx(proc_t p, struct __mac_set_lctx_args *uap, int *ret __unused)
{
struct user_mac mac;
struct label *intlabel;
size_t ulen;
if (IS_64BIT_PROCESS(p)) {
- error = copyin(uap->mac_p, &mac, sizeof(mac));
+ struct user64_mac mac64;
+ error = copyin(uap->mac_p, &mac64, sizeof(mac64));
+ mac.m_buflen = mac64.m_buflen;
+ mac.m_string = mac64.m_string;
} else {
- struct mac mac32;
+ struct user32_mac mac32;
error = copyin(uap->mac_p, &mac32, sizeof(mac32));
mac.m_buflen = mac32.m_buflen;
- mac.m_string = CAST_USER_ADDR_T(mac32.m_string);
+ mac.m_string = mac32.m_string;
}
if (error)
return (error);
#else /* LCTX */
int
-__mac_get_lcid(proc_t p __unused, struct __mac_get_lcid_args *uap __unused, register_t *ret __unused)
+__mac_get_lcid(proc_t p __unused, struct __mac_get_lcid_args *uap __unused, int *ret __unused)
{
return (ENOSYS);
}
int
-__mac_get_lctx(proc_t p __unused, struct __mac_get_lctx_args *uap __unused, register_t *ret __unused)
+__mac_get_lctx(proc_t p __unused, struct __mac_get_lctx_args *uap __unused, int *ret __unused)
{
return (ENOSYS);
}
int
-__mac_set_lctx(proc_t p __unused, struct __mac_set_lctx_args *uap __unused, register_t *ret __unused)
+__mac_set_lctx(proc_t p __unused, struct __mac_set_lctx_args *uap __unused, int *ret __unused)
{
return (ENOSYS);
#endif /* !LCTX */
int
-__mac_get_fd(proc_t p, struct __mac_get_fd_args *uap, register_t *ret __unused)
+__mac_get_fd(proc_t p, struct __mac_get_fd_args *uap, int *ret __unused)
{
struct fileproc *fp;
struct vnode *vp;
AUDIT_ARG(fd, uap->fd);
if (IS_64BIT_PROCESS(p)) {
- error = copyin(uap->mac_p, &mac, sizeof(mac));
+ struct user64_mac mac64;
+ error = copyin(uap->mac_p, &mac64, sizeof(mac64));
+ mac.m_buflen = mac64.m_buflen;
+ mac.m_string = mac64.m_string;
} else {
- struct mac mac32;
+ struct user32_mac mac32;
error = copyin(uap->mac_p, &mac32, sizeof(mac32));
mac.m_buflen = mac32.m_buflen;
- mac.m_string = CAST_USER_ADDR_T(mac32.m_string);
+ mac.m_string = mac32.m_string;
}
if (error)
switch (fp->f_fglob->fg_type) {
case DTYPE_VNODE:
-
intlabel = mac_vnode_label_alloc();
+ if (intlabel == NULL) {
+ error = ENOMEM;
+ break;
+ }
vp = (struct vnode *)fp->f_fglob->fg_data;
-
error = vnode_getwithref(vp);
if (error == 0) {
mac_vnode_label_copy(vp->v_label, intlabel);
return (error);
}
-/*
- * MPSAFE
- */
static int
mac_get_filelink(proc_t p, user_addr_t mac_p, user_addr_t path_p, int follow)
{
size_t ulen;
if (IS_64BIT_PROCESS(p)) {
- error = copyin(mac_p, &mac, sizeof(mac));
+ struct user64_mac mac64;
+ error = copyin(mac_p, &mac64, sizeof(mac64));
+ mac.m_buflen = mac64.m_buflen;
+ mac.m_string = mac64.m_string;
} else {
- struct mac mac32;
+ struct user32_mac mac32;
error = copyin(mac_p, &mac32, sizeof(mac32));
mac.m_buflen = mac32.m_buflen;
- mac.m_string = CAST_USER_ADDR_T(mac32.m_string);
+ mac.m_string = mac32.m_string;
}
if (error)
return (error);
MALLOC(elements, char *, mac.m_buflen, M_MACTEMP, M_WAITOK);
+ MALLOC(buffer, char *, mac.m_buflen, M_MACTEMP, M_WAITOK | M_ZERO);
+
error = copyinstr(mac.m_string, elements, mac.m_buflen, &ulen);
if (error) {
+ FREE(buffer, M_MACTEMP);
FREE(elements, M_MACTEMP);
return (error);
}
ctx = vfs_context_current();
- NDINIT(&nd, LOOKUP,
+ NDINIT(&nd, LOOKUP, OP_LOOKUP,
LOCKLEAF | (follow ? FOLLOW : NOFOLLOW) | AUDITVNPATH1,
UIO_USERSPACE, path_p, ctx);
error = namei(&nd);
if (error) {
+ FREE(buffer, M_MACTEMP);
FREE(elements, M_MACTEMP);
return (error);
}
intlabel = mac_vnode_label_alloc();
mac_vnode_label_copy(vp->v_label, intlabel);
-
- MALLOC(buffer, char *, mac.m_buflen, M_MACTEMP, M_WAITOK | M_ZERO);
error = mac_vnode_label_externalize(intlabel, elements, buffer,
- mac.m_buflen, M_WAITOK);
- FREE(elements, M_MACTEMP);
-
+ mac.m_buflen, M_WAITOK);
+ mac_vnode_label_free(intlabel);
if (error == 0)
error = copyout(buffer, mac.m_string, strlen(buffer) + 1);
- FREE(buffer, M_MACTEMP);
vnode_put(vp);
- mac_vnode_label_free(intlabel);
+
+ FREE(buffer, M_MACTEMP);
+ FREE(elements, M_MACTEMP);
return (error);
}
int
__mac_get_file(proc_t p, struct __mac_get_file_args *uap,
- register_t *ret __unused)
+ int *ret __unused)
{
return (mac_get_filelink(p, uap->mac_p, uap->path_p, 1));
int
__mac_get_link(proc_t p, struct __mac_get_link_args *uap,
- register_t *ret __unused)
+ int *ret __unused)
{
return (mac_get_filelink(p, uap->mac_p, uap->path_p, 0));
}
int
-__mac_set_fd(proc_t p, struct __mac_set_fd_args *uap, register_t *ret __unused)
+__mac_set_fd(proc_t p, struct __mac_set_fd_args *uap, int *ret __unused)
{
struct fileproc *fp;
AUDIT_ARG(fd, uap->fd);
if (IS_64BIT_PROCESS(p)) {
- error = copyin(uap->mac_p, &mac, sizeof(mac));
+ struct user64_mac mac64;
+ error = copyin(uap->mac_p, &mac64, sizeof(mac64));
+ mac.m_buflen = mac64.m_buflen;
+ mac.m_string = mac64.m_string;
} else {
- struct mac mac32;
+ struct user32_mac mac32;
error = copyin(uap->mac_p, &mac32, sizeof(mac32));
mac.m_buflen = mac32.m_buflen;
- mac.m_string = CAST_USER_ADDR_T(mac32.m_string);
+ mac.m_string = mac32.m_string;
}
if (error)
return (error);
switch (fp->f_fglob->fg_type) {
case DTYPE_VNODE:
+ if (mac_label_vnodes == 0) {
+ error = ENOSYS;
+ break;
+ }
+
intlabel = mac_vnode_label_alloc();
error = mac_vnode_label_internalize(intlabel, buffer);
return (error);
}
-/*
- * MPSAFE
- */
static int
mac_set_filelink(proc_t p, user_addr_t mac_p, user_addr_t path_p,
int follow)
int error;
size_t ulen;
+ if (mac_label_vnodes == 0)
+ return ENOSYS;
+
if (IS_64BIT_PROCESS(p)) {
- error = copyin(mac_p, &mac, sizeof(mac));
+ struct user64_mac mac64;
+ error = copyin(mac_p, &mac64, sizeof(mac64));
+ mac.m_buflen = mac64.m_buflen;
+ mac.m_string = mac64.m_string;
} else {
- struct mac mac32;
+ struct user32_mac mac32;
error = copyin(mac_p, &mac32, sizeof(mac32));
mac.m_buflen = mac32.m_buflen;
- mac.m_string = CAST_USER_ADDR_T(mac32.m_string);
+ mac.m_string = mac32.m_string;
}
if (error)
return (error);
return (error);
}
- NDINIT(&nd, LOOKUP,
+ NDINIT(&nd, LOOKUP, OP_LOOKUP,
LOCKLEAF | (follow ? FOLLOW : NOFOLLOW) | AUDITVNPATH1,
UIO_USERSPACE, path_p, ctx);
error = namei(&nd);
int
__mac_set_file(proc_t p, struct __mac_set_file_args *uap,
- register_t *ret __unused)
+ int *ret __unused)
{
return (mac_set_filelink(p, uap->mac_p, uap->path_p, 1));
int
__mac_set_link(proc_t p, struct __mac_set_link_args *uap,
- register_t *ret __unused)
+ int *ret __unused)
{
return (mac_set_filelink(p, uap->mac_p, uap->path_p, 0));
}
/*
- * MPSAFE
+ * __mac_syscall: Perform a MAC policy system call
+ *
+ * Parameters: p Process calling this routine
+ * uap User argument descriptor (see below)
+ * retv (Unused)
+ *
+ * Indirect: uap->policy Name of target MAC policy
+ * uap->call MAC policy-specific system call to perform
+ * uap->arg MAC policy-specific system call arguments
+ *
+ * Returns: 0 Success
+ * !0 Not success
+ *
*/
-
int
-__mac_syscall(proc_t p, struct __mac_syscall_args *uap, register_t *retv __unused)
+__mac_syscall(proc_t p, struct __mac_syscall_args *uap, int *retv __unused)
{
struct mac_policy_conf *mpc;
char target[MAC_MAX_POLICY_NAME];
error = copyinstr(uap->policy, target, sizeof(target), &ulen);
if (error)
return (error);
- AUDIT_ARG(value, uap->call);
+ AUDIT_ARG(value32, uap->call);
AUDIT_ARG(mac_string, target);
error = ENOPOLICY;
size_t ulen;
if (IS_64BIT_PROCESS(current_proc())) {
- error = copyin(mac_p, &mac, sizeof(mac));
+ struct user64_mac mac64;
+ error = copyin(mac_p, &mac64, sizeof(mac64));
+ mac.m_buflen = mac64.m_buflen;
+ mac.m_string = mac64.m_string;
} else {
- struct mac mac32;
+ struct user32_mac mac32;
error = copyin(mac_p, &mac32, sizeof(mac32));
mac.m_buflen = mac32.m_buflen;
- mac.m_string = CAST_USER_ADDR_T(mac32.m_string);
+ mac.m_string = mac32.m_string;
}
if (error)
return (error);
return (error);
}
+/*
+ * __mac_get_mount: Get mount point label information for a given pathname
+ *
+ * Parameters: p (ignored)
+ * uap User argument descriptor (see below)
+ * ret (ignored)
+ *
+ * Indirect: uap->path Pathname
+ * uap->mac_p MAC info
+ *
+ * Returns: 0 Success
+ * !0 Not success
+ */
int
__mac_get_mount(proc_t p __unused, struct __mac_get_mount_args *uap,
- register_t *ret __unused)
+ int *ret __unused)
{
struct nameidata nd;
struct vfs_context *ctx = vfs_context_current();
struct mount *mp;
int error;
- NDINIT(&nd, LOOKUP, FOLLOW | AUDITVNPATH1,
+ NDINIT(&nd, LOOKUP, OP_LOOKUP, FOLLOW | AUDITVNPATH1,
UIO_USERSPACE, uap->path, ctx);
error = namei(&nd);
if (error) {
return mac_mount_label_get(mp, uap->mac_p);
}
+/*
+ * mac_schedule_userret()
+ *
+ * Schedule a callback to the mpo_thread_userret hook. The mpo_thread_userret
+ * hook is called just before the thread exit from the kernel in ast_taken().
+ *
+ * Returns: 0 Success
+ * !0 Not successful
+ */
+int
+mac_schedule_userret(void)
+{
+
+ act_set_astmacf(current_thread());
+ return (0);
+}
+
+/*
+ * mac_do_machexc()
+ *
+ * Do a Mach exception. This should only be done in the mpo_thread_userret
+ * callback.
+ *
+ * params: code exception code
+ * subcode exception subcode
+ * flags flags:
+ * MAC_DOEXCF_TRACED Only do exception if being
+ * ptrace()'ed.
+ *
+ *
+ * Returns: 0 Success
+ * !0 Not successful
+ */
+int
+mac_do_machexc(int64_t code, int64_t subcode, uint32_t flags)
+{
+ mach_exception_data_type_t codes[EXCEPTION_CODE_MAX];
+ proc_t p = current_proc();
+
+ /* Only allow execption codes in MACF's reserved range. */
+ if ((code < EXC_MACF_MIN) || (code > EXC_MACF_MAX))
+ return (1);
+
+ if (flags & MAC_DOEXCF_TRACED &&
+ !(p->p_lflag & P_LTRACED && (p->p_lflag & P_LPPWAIT) == 0))
+ return (0);
+
+
+ /* Send the Mach exception */
+ codes[0] = (mach_exception_data_type_t)code;
+ codes[1] = (mach_exception_data_type_t)subcode;
+
+ return (bsd_exception(EXC_SOFTWARE, codes, 2) != KERN_SUCCESS);
+}
+
#else /* MAC */
int
}
int
-__mac_get_pid(proc_t p __unused, struct __mac_get_pid_args *uap __unused, register_t *ret __unused)
+__mac_get_pid(proc_t p __unused, struct __mac_get_pid_args *uap __unused, int *ret __unused)
{
return (ENOSYS);
}
int
-__mac_get_proc(proc_t p __unused, struct __mac_get_proc_args *uap __unused, register_t *ret __unused)
+__mac_get_proc(proc_t p __unused, struct __mac_get_proc_args *uap __unused, int *ret __unused)
{
return (ENOSYS);
}
int
-__mac_set_proc(proc_t p __unused, struct __mac_set_proc_args *uap __unused, register_t *ret __unused)
+__mac_set_proc(proc_t p __unused, struct __mac_set_proc_args *uap __unused, int *ret __unused)
{
return (ENOSYS);
}
int
-__mac_get_file(proc_t p __unused, struct __mac_get_file_args *uap __unused, register_t *ret __unused)
+__mac_get_file(proc_t p __unused, struct __mac_get_file_args *uap __unused, int *ret __unused)
{
return (ENOSYS);
}
int
-__mac_get_link(proc_t p __unused, struct __mac_get_link_args *uap __unused, register_t *ret __unused)
+__mac_get_link(proc_t p __unused, struct __mac_get_link_args *uap __unused, int *ret __unused)
{
return (ENOSYS);
}
int
-__mac_set_file(proc_t p __unused, struct __mac_set_file_args *uap __unused, register_t *ret __unused)
+__mac_set_file(proc_t p __unused, struct __mac_set_file_args *uap __unused, int *ret __unused)
{
return (ENOSYS);
}
int
-__mac_set_link(proc_t p __unused, struct __mac_set_link_args *uap __unused, register_t *ret __unused)
+__mac_set_link(proc_t p __unused, struct __mac_set_link_args *uap __unused, int *ret __unused)
{
return (ENOSYS);
}
int
-__mac_get_fd(proc_t p __unused, struct __mac_get_fd_args *uap __unused, register_t *ret __unused)
+__mac_get_fd(proc_t p __unused, struct __mac_get_fd_args *uap __unused, int *ret __unused)
{
return (ENOSYS);
}
int
-__mac_set_fd(proc_t p __unused, struct __mac_set_fd_args *uap __unused, register_t *ret __unused)
+__mac_set_fd(proc_t p __unused, struct __mac_set_fd_args *uap __unused, int *ret __unused)
{
return (ENOSYS);
}
int
-__mac_syscall(proc_t p __unused, struct __mac_syscall_args *uap __unused, register_t *ret __unused)
+__mac_syscall(proc_t p __unused, struct __mac_syscall_args *uap __unused, int *ret __unused)
{
return (ENOSYS);
}
int
-__mac_get_lcid(proc_t p __unused, struct __mac_get_lcid_args *uap __unused, register_t *ret __unused)
+__mac_get_lcid(proc_t p __unused, struct __mac_get_lcid_args *uap __unused, int *ret __unused)
{
return (ENOSYS);
}
int
-__mac_get_lctx(proc_t p __unused, struct __mac_get_lctx_args *uap __unused, register_t *ret __unused)
+__mac_get_lctx(proc_t p __unused, struct __mac_get_lctx_args *uap __unused, int *ret __unused)
{
return (ENOSYS);
}
int
-__mac_set_lctx(proc_t p __unused, struct __mac_set_lctx_args *uap __unused, register_t *ret __unused)
+__mac_set_lctx(proc_t p __unused, struct __mac_set_lctx_args *uap __unused, int *ret __unused)
{
return (ENOSYS);
int
__mac_get_mount(proc_t p __unused,
- struct __mac_get_mount_args *uap __unused, register_t *ret __unused)
+ struct __mac_get_mount_args *uap __unused, int *ret __unused)
{
return (ENOSYS);
}
+
+int
+mac_schedule_userret(void)
+{
+
+ return (1);
+}
+
+int
+mac_do_machexc(int64_t code __unused, int64_t subcode __unused, uint32_t flags __unused)
+{
+
+ return (1);
+}
#endif /* !MAC */
projects / apple / xnu.git / blobdiff