/*
- * Copyright (c) 2004 Apple Computer, Inc. All rights reserved.
+ * Copyright (c) 2004-2016 Apple Inc. All rights reserved.
*
- * @APPLE_LICENSE_HEADER_START@
+ * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
*
- * The contents of this file constitute Original Code as defined in and
- * are subject to the Apple Public Source License Version 1.1 (the
- * "License"). You may not use this file except in compliance with the
- * License. Please obtain a copy of the License at
- * http://www.apple.com/publicsource and read it before using this file.
+ * This file contains Original Code and/or Modifications of Original Code
+ * as defined in and that are subject to the Apple Public Source License
+ * Version 2.0 (the 'License'). You may not use this file except in
+ * compliance with the License. The rights granted to you under the License
+ * may not be used to create, or enable the creation or redistribution of,
+ * unlawful or unlicensed copies of an Apple operating system, or to
+ * circumvent, violate, or enable the circumvention or violation of, any
+ * terms of an Apple operating system software license agreement.
*
- * This Original Code and all software distributed under the License are
- * distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY KIND, EITHER
+ * Please obtain a copy of the License at
+ * http://www.opensource.apple.com/apsl/ and read it before using this file.
+ *
+ * The Original Code and all software distributed under the License are
+ * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
* EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
* INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT. Please see the
- * License for the specific language governing rights and limitations
- * under the License.
+ * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
+ * Please see the License for the specific language governing rights and
+ * limitations under the License.
*
- * @APPLE_LICENSE_HEADER_END@
+ * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
*/
/*
#include <sys/kauth.h>
#include <sys/stat.h>
-#include <bsm/audit_kernel.h>
+#include <security/audit/audit.h>
#include <sys/mount.h>
#include <sys/sysproto.h>
/* bring up kauth subsystem components */
kauth_cred_init();
+#if CONFIG_EXT_RESOLVER
kauth_identity_init();
kauth_groups_init();
+#endif
kauth_scope_init();
+#if CONFIG_EXT_RESOLVER
kauth_resolver_init();
-
+#endif
/* can't alloc locks after this */
lck_grp_free(kauth_lck_grp);
kauth_lck_grp = NULL;
/*
* Allocate and populate the scope structure.
*/
- MALLOC(sp, kauth_scope_t, sizeof(*sp), M_KAUTH, M_WAITOK);
+ MALLOC(sp, kauth_scope_t, sizeof(*sp), M_KAUTH, M_WAITOK | M_ZERO);
if (sp == NULL)
return(NULL);
- bzero(&sp->ks_listeners, sizeof(sp->ks_listeners));
sp->ks_flags = 0;
sp->ks_identifier = identifier;
sp->ks_idata = idata;
KAUTH_SCOPELOCK();
TAILQ_FOREACH(tsp, &kauth_scopes, ks_link) {
/* duplicate! */
- if (strcmp(tsp->ks_identifier, identifier) == 0) {
+ if (strncmp(tsp->ks_identifier, identifier,
+ strlen(tsp->ks_identifier) + 1) == 0) {
KAUTH_SCOPEUNLOCK();
FREE(sp, M_KAUTH);
return(NULL);
*/
restart:
TAILQ_FOREACH(klp, &kauth_dangling_listeners, kl_link) {
- if (strcmp(klp->kl_identifier, sp->ks_identifier) == 0) {
+ if (strncmp(klp->kl_identifier, sp->ks_identifier,
+ strlen(klp->kl_identifier) + 1) == 0) {
/* found a match on the dangling listener list. add it to the
* the active scope.
*/
*/
KAUTH_SCOPELOCK();
TAILQ_FOREACH(sp, &kauth_scopes, ks_link) {
- if (strcmp(sp->ks_identifier, identifier) == 0) {
+ if (strncmp(sp->ks_identifier, identifier,
+ strlen(sp->ks_identifier) + 1) == 0) {
/* scope exists, add it to scope listener table */
if (kauth_add_callback_to_scope(sp, klp) == 0) {
KAUTH_SCOPEUNLOCK();
/*
* Authorization requests.
+ *
+ * Returns: 0 Success
+ * EPERM Operation not permitted
+ *
+ * Imputed: *arg3, modified Callback return - depends on callback
+ * modification of *arg3, if any
*/
int
kauth_authorize_action(kauth_scope_t scope, kauth_cred_t credential, kauth_action_t action,
* arg0 is pointer to vnode (vnode *) for file to be closed.
* arg1 is pointer to path (char *) of file to be closed.
* arg2 is close flags.
+ * arguments passed to KAUTH_FILEOP_WILL_RENAME listeners
+ * arg0 is pointer to vnode (vnode *) of the file being renamed
+ * arg1 is pointer to the "from" path (char *)
+ * arg2 is pointer to the "to" path (char *)
* arguments passed to KAUTH_FILEOP_RENAME listeners
* arg0 is pointer to "from" path (char *).
* arg1 is pointer to "to" path (char *).
return(0);
}
- if (action == KAUTH_FILEOP_OPEN || action == KAUTH_FILEOP_CLOSE || action == KAUTH_FILEOP_EXEC) {
+ if (action == KAUTH_FILEOP_OPEN ||
+ action == KAUTH_FILEOP_CLOSE ||
+ action == KAUTH_FILEOP_EXEC ||
+ action == KAUTH_FILEOP_WILL_RENAME) {
/* get path to the given vnode as a convenience to our listeners.
*/
namep = get_pathbuff();
release_pathbuff(namep);
return(0);
}
- if (action == KAUTH_FILEOP_CLOSE) {
- arg2 = arg1; /* close has some flags that come in via arg1 */
+ if (action == KAUTH_FILEOP_CLOSE ||
+ action == KAUTH_FILEOP_WILL_RENAME) {
+ /*
+ * - Close has some flags that come in via arg1.
+ * - Will-rename wants to pass the vnode and
+ * both paths to the listeners ("to" path
+ * starts in arg1, moves to arg2).
+ */
+ arg2 = arg1;
}
arg1 = (uintptr_t)namep;
}
/* XXX == 0 ? */
return((kauth_cred_getuid(credential) == 0) ?
KAUTH_RESULT_ALLOW : KAUTH_RESULT_DENY);
- break;
}
/* no explicit result, so defer to others in the chain */
int
kauth_acl_evaluate(kauth_cred_t cred, kauth_acl_eval_t eval)
{
- int applies, error, i;
+ int applies, error, i, gotguid;
kauth_ace_t ace;
guid_t guid;
uint32_t rights;
}
eval->ae_residual = eval->ae_requested;
+ eval->ae_found_deny = FALSE;
/*
* Get our guid for comparison purposes.
*/
if ((error = kauth_cred_getguid(cred, &guid)) != 0) {
- eval->ae_result = KAUTH_RESULT_DENY;
- KAUTH_DEBUG(" ACL - can't get credential GUID (%d), ACL denied", error);
- return(error);
+ KAUTH_DEBUG(" ACL - can't get credential GUID (%d)", error);
+ error = 0;
+ gotguid = 0;
+ } else {
+ gotguid = 1;
}
KAUTH_DEBUG(" ACL - %d entries, initial residual %x", eval->ae_count, eval->ae_residual);
case KAUTH_ACE_DENY:
if (!(eval->ae_requested & rights))
continue;
+ eval->ae_found_deny = TRUE;
break;
default:
/* we don't recognise this ACE, skip it */
continue;
}
-
+
/*
* Verify whether this entry applies to the credential.
*/
applies = eval->ae_options & KAUTH_AEVAL_IS_OWNER;
break;
case KAUTH_WKG_GROUP:
- applies = eval->ae_options & KAUTH_AEVAL_IN_GROUP;
+ if (!gotguid || (eval->ae_options & KAUTH_AEVAL_IN_GROUP_UNKNOWN))
+ applies = ((ace->ace_flags & KAUTH_ACE_KINDMASK) == KAUTH_ACE_DENY);
+ else
+ applies = eval->ae_options & KAUTH_AEVAL_IN_GROUP;
break;
/* we short-circuit these here rather than wasting time calling the group membership code */
case KAUTH_WKG_EVERYBODY:
default:
/* check to see whether it's exactly us, or a group we are a member of */
- applies = kauth_guid_equal(&guid, &ace->ace_applicable);
+ applies = !gotguid ? 0 : kauth_guid_equal(&guid, &ace->ace_applicable);
KAUTH_DEBUG(" ACL - ACE applicable " K_UUID_FMT " caller " K_UUID_FMT " %smatched",
K_UUID_ARG(ace->ace_applicable), K_UUID_ARG(guid), applies ? "" : "not ");
if (!applies) {
- error = kauth_cred_ismember_guid(cred, &ace->ace_applicable, &applies);
+ error = !gotguid ? ENOENT : kauth_cred_ismember_guid(cred, &ace->ace_applicable, &applies);
/*
* If we can't resolve group membership, we have to limit misbehaviour.
* If the ACE is an 'allow' ACE, assume the cred is not a member (avoid
kauth_acl_t inherit, result;
/*
- * Fetch the ACL from the directory. This should never fail. Note that we don't
- * manage inheritance when the remote server is doing authorization; we just
- * want to compose the umask-ACL and any initial ACL.
+ * Fetch the ACL from the directory. This should never fail.
+ * Note that we don't manage inheritance when the remote server is
+ * doing authorization, since this means server enforcement of
+ * inheritance semantics; we just want to compose the initial
+ * ACL and any inherited ACE entries from the container object.
+ *
+ * XXX TODO: <rdar://3634665> wants a "umask ACL" from the process.
*/
inherit = NULL;
- if ((dvp != NULL) && !vfs_authopaque(vnode_mount(dvp))) {
+ /*
+ * If there is no initial ACL, or there is, and the initial ACLs
+ * flags do not request "no inheritance", then we inherit. This allows
+ * initial object creation via open_extended() and mkdir_extended()
+ * to reject inheritance for themselves and for inferior nodes by
+ * specifying a non-NULL inital ACL which has the KAUTH_ACL_NO_INHERIT
+ * flag set in the flags field.
+ */
+ if ((initial == NULL || !(initial->acl_flags & KAUTH_ACL_NO_INHERIT)) &&
+ (dvp != NULL) && !vfs_authopaque(vnode_mount(dvp))) {
VATTR_INIT(&dva);
VATTR_WANTED(&dva, va_acl);
if ((error = vnode_getattr(dvp, &dva, ctx)) != 0) {
}
/*
- * Compute the number of entries in the result ACL by scanning the input lists.
+ * Compute the number of entries in the result ACL by scanning the
+ * input lists.
*/
entries = 0;
if (inherit != NULL) {
}
if (initial == NULL) {
- /* XXX 3634665 TODO: fetch umask ACL from the process, set in initial */
+ /*
+ * XXX 3634665 TODO: if the initial ACL is not specfied by
+ * XXX the caller, fetch the umask ACL from the process,
+ * and use it in place of "initial".
+ */
}
if (initial != NULL) {
- entries += initial->acl_entrycount;
+ if (initial->acl_entrycount != KAUTH_FILESEC_NOACL)
+ entries += initial->acl_entrycount;
+ else
+ initial = NULL;
}
/*
* If there is no initial ACL, and no inheritable entries, the
- * object should have no ACL at all.
+ * object should be created with no ACL at all.
* Note that this differs from the case where the initial ACL
* is empty, in which case the object must also have an empty ACL.
*/
* Allocate the result buffer.
*/
if ((result = kauth_acl_alloc(entries)) == NULL) {
- KAUTH_DEBUG(" ERROR - could not allocate %d-entry result buffer for inherited ACL");
+ KAUTH_DEBUG(" ERROR - could not allocate %d-entry result buffer for inherited ACL", entries);
error = ENOMEM;
goto out;
}
/*
* Composition is simply:
- * - initial
- * - inherited
+ * - initial direct ACEs
+ * - inherited ACEs from new parent
*/
index = 0;
if (initial != NULL) {
- for (i = 0; i < initial->acl_entrycount; i++)
- result->acl_ace[index++] = initial->acl_ace[i];
- KAUTH_DEBUG(" INHERIT - applied %d initial entries", index);
+ for (i = 0; i < initial->acl_entrycount; i++) {
+ if (!(initial->acl_ace[i].ace_flags & KAUTH_ACE_INHERITED)) {
+ result->acl_ace[index++] = initial->acl_ace[i];
+ }
+ }
+ KAUTH_DEBUG(" INHERIT - applied %d of %d initial entries", index, initial->acl_entrycount);
}
if (inherit != NULL) {
for (i = 0; i < inherit->acl_entrycount; i++) {
- /* inherit onto this object? */
+ /*
+ * Inherit onto this object? We inherit only if
+ * the target object is a container object and the
+ * KAUTH_ACE_DIRECTORY_INHERIT bit is set, OR if
+ * if the target object is not a container, and
+ * the KAUTH_ACE_FILE_INHERIT bit is set.
+ */
if (inherit->acl_ace[i].ace_flags & (isdir ? KAUTH_ACE_DIRECTORY_INHERIT : KAUTH_ACE_FILE_INHERIT)) {
result->acl_ace[index] = inherit->acl_ace[i];
result->acl_ace[index].ace_flags |= KAUTH_ACE_INHERITED;
- /* don't re-inherit? */
- if (result->acl_ace[index].ace_flags & KAUTH_ACE_LIMIT_INHERIT)
+ result->acl_ace[index].ace_flags &= ~KAUTH_ACE_ONLY_INHERIT;
+ /*
+ * We do not re-inherit inheritance flags
+ * if the ACE from the container has a
+ * KAUTH_ACE_LIMIT_INHERIT, OR if the new
+ * object is not itself a container (since
+ * inheritance is always container-based).
+ */
+ if ((result->acl_ace[index].ace_flags & KAUTH_ACE_LIMIT_INHERIT) || !isdir) {
result->acl_ace[index].ace_flags &=
- ~(KAUTH_ACE_DIRECTORY_INHERIT | KAUTH_ACE_FILE_INHERIT | KAUTH_ACE_LIMIT_INHERIT);
+ ~(KAUTH_ACE_INHERIT_CONTROL_FLAGS);
+ }
index++;
}
}
int
kauth_copyinfilesec(user_addr_t xsecurity, kauth_filesec_t *xsecdestpp)
{
- user_addr_t uaddr, known_bound;
int error;
kauth_filesec_t fsec;
u_int32_t count;
*
* The upper bound must be less than KAUTH_ACL_MAX_ENTRIES. The
* value here is fairly arbitrary. It's ok to have a zero count.
+ *
+ * Because we're just using these values to make a guess about the
+ * number of entries, the actual address doesn't matter, only their
+ * relative offsets into the page. We take advantage of this to
+ * avoid an overflow in the rounding step (this is a user-provided
+ * parameter, so caution pays off).
*/
- known_bound = xsecurity + sizeof(struct kauth_filesec);
- uaddr = mach_vm_round_page(known_bound);
- count = (uaddr - known_bound) / sizeof(struct kauth_ace);
+ {
+ user_addr_t known_bound = (xsecurity & PAGE_MASK) + KAUTH_FILESEC_SIZE(0);
+ user_addr_t uaddr = mach_vm_round_page(known_bound);
+ count = (uaddr - known_bound) / sizeof(struct kauth_ace);
+ }
if (count > 32)
count = 32;
restart:
kauth_filesec_free(fsec);
} else {
*xsecdestpp = fsec;
+ AUDIT_ARG(opaque, fsec, copysize);
}
return(error);
}
projects / apple / xnu.git / blobdiff