X-Git-Url: https://git.saurik.com/apple/xnu.git/blobdiff_plain/6d2010ae8f7a6078e10b361c6962983bab233e0f..0a7de7458d150b5d4dffc935ba399be265ef0a1a:/security/mac_vfs.c diff --git a/security/mac_vfs.c b/security/mac_vfs.c index 7cc5561a2..81b311012 100644 --- a/security/mac_vfs.c +++ b/security/mac_vfs.c @@ -1,8 +1,8 @@ /* - * Copyright (c) 2007 Apple Inc. All rights reserved. + * Copyright (c) 2007-2016 Apple Inc. All rights reserved. * * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ - * + * * This file contains Original Code and/or Modifications of Original Code * as defined in and that are subject to the Apple Public Source License * Version 2.0 (the 'License'). You may not use this file except in @@ -11,10 +11,10 @@ * unlawful or unlicensed copies of an Apple operating system, or to * circumvent, violate, or enable the circumvention or violation of, any * terms of an Apple operating system software license agreement. - * + * * Please obtain a copy of the License at * http://www.opensource.apple.com/apsl/ and read it before using this file. - * + * * The Original Code and all software distributed under the License are * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, @@ -22,7 +22,7 @@ * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. * Please see the License for the specific language governing rights and * limitations under the License. - * + * * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ */ /*- @@ -62,6 +62,8 @@ * */ +#include + #include #include #include @@ -75,6 +77,7 @@ #include #include #include +#include #include #include @@ -84,7 +87,7 @@ #include /* convert {R,W,X}_OK values to V{READ,WRITE,EXEC} */ -#define ACCESS_MODE_TO_VNODE_MASK(m) (m << 6) +#define ACCESS_MODE_TO_VNODE_MASK(m) (m << 6) static struct label * mac_devfsdirent_label_alloc(void) @@ -92,16 +95,16 @@ mac_devfsdirent_label_alloc(void) struct label *label; label = mac_labelzone_alloc(MAC_WAITOK); - if (label == NULL) - return (NULL); + if (label == NULL) { + return NULL; + } MAC_PERFORM(devfs_label_init, label); - return (label); + return label; } void mac_devfs_label_init(struct devnode *de) { - de->dn_label = mac_devfsdirent_label_alloc(); } @@ -111,16 +114,16 @@ mac_mount_label_alloc(void) struct label *label; label = mac_labelzone_alloc(MAC_WAITOK); - if (label == NULL) - return (NULL); + if (label == NULL) { + return NULL; + } MAC_PERFORM(mount_label_init, label); - return (label); + return label; } void mac_mount_label_init(struct mount *mp) { - mp->mnt_mntlabel = mac_mount_label_alloc(); } @@ -130,10 +133,11 @@ mac_vnode_label_alloc(void) struct label *label; label = mac_labelzone_alloc(MAC_WAITOK); - if (label == NULL) - return (NULL); + if (label == NULL) { + return NULL; + } MAC_PERFORM(vnode_label_init, label); - return (label); + return label; } void @@ -145,18 +149,17 @@ mac_vnode_label_init(vnode_t vp) int mac_vnode_label_init_needed(vnode_t vp) { - return (mac_label_vnodes != 0 && vp->v_label == NULL); + return mac_label_vnodes != 0 && vp->v_label == NULL; } -/* +/* * vnode labels are allocated at the same time as vnodes, but vnodes are never * freed. Instead, we want to remove any sensitive information before putting * them on the free list for reuse. -*/ + */ void mac_vnode_label_recycle(vnode_t vp) { - MAC_PERFORM(vnode_label_recycle, vp->v_label); } @@ -179,7 +182,6 @@ mac_devfs_label_destroy(struct devnode *de) static void mac_mount_label_free(struct label *label) { - MAC_PERFORM(mount_label_destroy, label); mac_labelzone_free(label); } @@ -230,7 +232,7 @@ mac_vnode_label_externalize_audit(struct vnode *vp, struct mac *mac) error = MAC_EXTERNALIZE_AUDIT(vnode, vp->v_label, mac->m_string, mac->m_buflen); - return (error); + return error; } int @@ -241,7 +243,7 @@ mac_vnode_label_externalize(struct label *label, char *elements, error = MAC_EXTERNALIZE(vnode, label, elements, outbuf, outbuflen); - return (error); + return error; } int @@ -251,7 +253,7 @@ mac_vnode_label_internalize(struct label *label, char *string) error = MAC_INTERNALIZE(vnode, label, string); - return (error); + return error; } int @@ -261,7 +263,7 @@ mac_mount_label_internalize(struct label *label, char *string) error = MAC_INTERNALIZE(mount, label, string); - return (error); + return error; } int @@ -272,14 +274,18 @@ mac_mount_label_externalize(struct label *label, char *elements, error = MAC_EXTERNALIZE(mount, label, elements, outbuf, outbuflen); - return (error); + return error; } void mac_devfs_label_copy(struct label *src, struct label *dest) { - if (!mac_device_enforce) +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_device_enforce) { return; + } +#endif MAC_PERFORM(devfs_label_copy, src, dest); } @@ -288,9 +294,12 @@ void mac_devfs_label_update(struct mount *mp, struct devnode *de, struct vnode *vp) { - - if (!mac_device_enforce) +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_device_enforce) { return; + } +#endif MAC_PERFORM(devfs_label_update, mp, de, de->dn_label, vp, vp->v_label); @@ -303,8 +312,12 @@ mac_vnode_label_associate(struct mount *mp, struct vnode *vp, vfs_context_t ctx) struct fdescnode *fnp; int error = 0; - if (!mac_vnode_enforce) - return (error); +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return error; + } +#endif /* XXX: should not inspect v_tag in kernel! */ switch (vp->v_tag) { @@ -321,15 +334,19 @@ mac_vnode_label_associate(struct mount *mp, struct vnode *vp, vfs_context_t ctx) break; } - return (error); + return error; } void mac_vnode_label_associate_devfs(struct mount *mp, struct devnode *de, struct vnode *vp) { - if (!mac_device_enforce) +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_device_enforce) { return; + } +#endif MAC_PERFORM(vnode_label_associate_devfs, mp, mp ? mp->mnt_mntlabel : NULL, @@ -345,15 +362,21 @@ mac_vnode_label_associate_extattr(struct mount *mp, struct vnode *vp) MAC_CHECK(vnode_label_associate_extattr, mp, mp->mnt_mntlabel, vp, vp->v_label); - return (error); + return error; } void mac_vnode_label_associate_singlelabel(struct mount *mp, struct vnode *vp) { - - if (!mac_vnode_enforce || !mac_label_vnodes) +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { return; + } +#endif + if (!mac_label_vnodes) { + return; + } MAC_PERFORM(vnode_label_associate_singlelabel, mp, mp ? mp->mnt_mntlabel : NULL, vp, vp->v_label); @@ -366,15 +389,20 @@ mac_vnode_notify_create(vfs_context_t ctx, struct mount *mp, kauth_cred_t cred; int error; - if (!mac_vnode_enforce || - !mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return (0); - +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return 0; + } +#endif cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_notify_create, cred, mp, mp->mnt_mntlabel, dvp, dvp->v_label, vp, vp->v_label, cnp); - return (error); + return error; } void @@ -383,15 +411,219 @@ mac_vnode_notify_rename(vfs_context_t ctx, struct vnode *vp, { kauth_cred_t cred; - if (!mac_vnode_enforce || - !mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { return; - + } +#endif cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return; + } MAC_PERFORM(vnode_notify_rename, cred, vp, vp->v_label, dvp, dvp->v_label, cnp); } +void +mac_vnode_notify_open(vfs_context_t ctx, struct vnode *vp, int acc_flags) +{ + kauth_cred_t cred; + +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return; + } +#endif + cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return; + } + MAC_PERFORM(vnode_notify_open, cred, vp, vp->v_label, acc_flags); +} + +void +mac_vnode_notify_link(vfs_context_t ctx, struct vnode *vp, + struct vnode *dvp, struct componentname *cnp) +{ + kauth_cred_t cred; + +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return; + } +#endif + cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return; + } + MAC_PERFORM(vnode_notify_link, cred, dvp, dvp->v_label, vp, vp->v_label, cnp); +} + +void +mac_vnode_notify_deleteextattr(vfs_context_t ctx, struct vnode *vp, const char *name) +{ + kauth_cred_t cred; + +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return; + } +#endif + cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return; + } + MAC_PERFORM(vnode_notify_deleteextattr, cred, vp, vp->v_label, name); +} + +void +mac_vnode_notify_setacl(vfs_context_t ctx, struct vnode *vp, struct kauth_acl *acl) +{ + kauth_cred_t cred; + +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return; + } +#endif + cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return; + } + MAC_PERFORM(vnode_notify_setacl, cred, vp, vp->v_label, acl); +} + +void +mac_vnode_notify_setattrlist(vfs_context_t ctx, struct vnode *vp, struct attrlist *alist) +{ + kauth_cred_t cred; + +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return; + } +#endif + cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return; + } + MAC_PERFORM(vnode_notify_setattrlist, cred, vp, vp->v_label, alist); +} + +void +mac_vnode_notify_setextattr(vfs_context_t ctx, struct vnode *vp, const char *name, struct uio *uio) +{ + kauth_cred_t cred; + +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return; + } +#endif + cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return; + } + MAC_PERFORM(vnode_notify_setextattr, cred, vp, vp->v_label, name, uio); +} + +void +mac_vnode_notify_setflags(vfs_context_t ctx, struct vnode *vp, u_long flags) +{ + kauth_cred_t cred; + +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return; + } +#endif + cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return; + } + MAC_PERFORM(vnode_notify_setflags, cred, vp, vp->v_label, flags); +} + +void +mac_vnode_notify_setmode(vfs_context_t ctx, struct vnode *vp, mode_t mode) +{ + kauth_cred_t cred; + +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return; + } +#endif + cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return; + } + MAC_PERFORM(vnode_notify_setmode, cred, vp, vp->v_label, mode); +} + +void +mac_vnode_notify_setowner(vfs_context_t ctx, struct vnode *vp, uid_t uid, gid_t gid) +{ + kauth_cred_t cred; + +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return; + } +#endif + cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return; + } + MAC_PERFORM(vnode_notify_setowner, cred, vp, vp->v_label, uid, gid); +} + +void +mac_vnode_notify_setutimes(vfs_context_t ctx, struct vnode *vp, struct timespec atime, struct timespec mtime) +{ + kauth_cred_t cred; + +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return; + } +#endif + cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return; + } + MAC_PERFORM(vnode_notify_setutimes, cred, vp, vp->v_label, atime, mtime); +} + +void +mac_vnode_notify_truncate(vfs_context_t ctx, kauth_cred_t file_cred, struct vnode *vp) +{ + kauth_cred_t cred; + +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return; + } +#endif + cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return; + } + MAC_PERFORM(vnode_notify_truncate, cred, file_cred, vp, vp->v_label); +} + /* * Extended attribute 'name' was updated via * vn_setxattr() or vn_removexattr(). Allow the @@ -403,13 +635,21 @@ mac_vnode_label_update_extattr(struct mount *mp, struct vnode *vp, { int error = 0; - if (!mac_vnode_enforce || !mac_label_vnodes) +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { return; + } +#endif + if (!mac_label_vnodes) { + return; + } MAC_PERFORM(vnode_label_update_extattr, mp, mp->mnt_mntlabel, vp, - vp->v_label, name); - if (error == 0) + vp->v_label, name); + if (error == 0) { return; + } vnode_lock(vp); vnode_relabel(vp); @@ -424,52 +664,164 @@ mac_vnode_label_store(vfs_context_t ctx, struct vnode *vp, kauth_cred_t cred; int error; - if (!mac_vnode_enforce || !mac_label_vnodes || - !mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return 0; + } +#endif + if (!mac_label_vnodes) { return 0; + } cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_label_store, cred, vp, vp->v_label, intlabel); - return (error); + return error; } -int -mac_cred_label_update_execve(vfs_context_t ctx, kauth_cred_t new, struct vnode *vp, - struct label *scriptvnodelabel, struct label *execl) +void +mac_cred_label_update_execve(vfs_context_t ctx, kauth_cred_t new, struct vnode *vp, off_t offset, + struct vnode *scriptvp, struct label *scriptvnodelabel, struct label *execl, u_int *csflags, + void *macextensions, int *disjoint, int *labelupdateerror) { kauth_cred_t cred; - int disjoint = 0; + *disjoint = 0; + int error; posix_cred_t pcred = posix_cred_get(new); - if (!mac_proc_enforce && !mac_vnode_enforce) - return disjoint; +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_proc_enforce || !mac_vnode_enforce) { + return; + } +#endif /* mark the new cred to indicate "matching" includes the label */ pcred->cr_flags |= CRF_MAC_ENFORCE; cred = vfs_context_ucred(ctx); - MAC_PERFORM(cred_label_update_execve, cred, new, vp, vp->v_label, - scriptvnodelabel, execl, &disjoint); - return (disjoint); + /* + * NB: Cannot use MAC_CHECK macro because we need a sequence point after + * calling exec_spawnattr_getmacpolicyinfo() and before passing the + * spawnattrlen as an argument to the hook. + */ + { + struct mac_policy_conf *mpc; + u_int i; + + error = 0; + for (i = 0; i < mac_policy_list.staticmax; i++) { + mpc = mac_policy_list.entries[i].mpc; + if (mpc == NULL) { + continue; + } + + mpo_cred_label_update_execve_t *hook = mpc->mpc_ops->mpo_cred_label_update_execve; + if (hook == NULL) { + continue; + } + + size_t spawnattrlen = 0; + void *spawnattr = exec_spawnattr_getmacpolicyinfo(macextensions, mpc->mpc_name, &spawnattrlen); + + error = mac_error_select(hook(cred, new, vfs_context_proc(ctx), vp, offset, scriptvp, + vp->v_label, scriptvnodelabel, execl, csflags, spawnattr, spawnattrlen, disjoint), + error); + } + if (mac_policy_list_conditional_busy() != 0) { + for (; i <= mac_policy_list.maxindex; i++) { + mpc = mac_policy_list.entries[i].mpc; + if (mpc == NULL) { + continue; + } + + mpo_cred_label_update_execve_t *hook = mpc->mpc_ops->mpo_cred_label_update_execve; + if (hook == NULL) { + continue; + } + + size_t spawnattrlen = 0; + void *spawnattr = exec_spawnattr_getmacpolicyinfo(macextensions, mpc->mpc_name, &spawnattrlen); + + error = mac_error_select(hook(cred, new, vfs_context_proc(ctx), vp, offset, scriptvp, + vp->v_label, scriptvnodelabel, execl, csflags, spawnattr, spawnattrlen, disjoint), + error); + } + mac_policy_list_unbusy(); + } + } + *labelupdateerror = error; } int -mac_cred_check_label_update_execve(vfs_context_t ctx, struct vnode *vp, - struct label *scriptvnodelabel, struct label *execlabel, struct proc *p) +mac_cred_check_label_update_execve(vfs_context_t ctx, struct vnode *vp, off_t offset, + struct vnode *scriptvp, struct label *scriptvnodelabel, struct label *execlabel, + struct proc *p, void *macextensions) { kauth_cred_t cred; int result = 0; - if (!mac_proc_enforce && !mac_vnode_enforce) +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_proc_enforce || !mac_vnode_enforce) { return result; + } +#endif cred = vfs_context_ucred(ctx); - MAC_BOOLEAN(cred_check_label_update_execve, ||, cred, vp, vp->v_label, - scriptvnodelabel, execlabel, p); - return (result); + /* + * NB: Cannot use MAC_BOOLEAN macro because we need a sequence point after + * calling exec_spawnattr_getmacpolicyinfo() and before passing the + * spawnattrlen as an argument to the hook. + */ + { + struct mac_policy_conf *mpc; + u_int i; + + for (i = 0; i < mac_policy_list.staticmax; i++) { + mpc = mac_policy_list.entries[i].mpc; + if (mpc == NULL) { + continue; + } + + mpo_cred_check_label_update_execve_t *hook = mpc->mpc_ops->mpo_cred_check_label_update_execve; + if (hook == NULL) { + continue; + } + + size_t spawnattrlen = 0; + void *spawnattr = exec_spawnattr_getmacpolicyinfo(macextensions, mpc->mpc_name, &spawnattrlen); + + result = result || hook(cred, vp, offset, scriptvp, vp->v_label, scriptvnodelabel, execlabel, p, spawnattr, spawnattrlen); + } + if (mac_policy_list_conditional_busy() != 0) { + for (; i <= mac_policy_list.maxindex; i++) { + mpc = mac_policy_list.entries[i].mpc; + if (mpc == NULL) { + continue; + } + + mpo_cred_check_label_update_execve_t *hook = mpc->mpc_ops->mpo_cred_check_label_update_execve; + if (hook == NULL) { + continue; + } + + size_t spawnattrlen = 0; + void *spawnattr = exec_spawnattr_getmacpolicyinfo(macextensions, mpc->mpc_name, &spawnattrlen); + + result = result || hook(cred, vp, offset, scriptvp, vp->v_label, scriptvnodelabel, execlabel, p, spawnattr, spawnattrlen); + } + mac_policy_list_unbusy(); + } + } + + return result; } int @@ -480,16 +832,21 @@ mac_vnode_check_access(vfs_context_t ctx, struct vnode *vp, int error; int mask; - if (!mac_vnode_enforce || - !mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { return 0; - + } +#endif cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } /* Convert {R,W,X}_OK values to V{READ,WRITE,EXEC} for entry points */ mask = ACCESS_MODE_TO_VNODE_MASK(acc_mode); MAC_CHECK(vnode_check_access, cred, vp, vp->v_label, mask); - return (error); - } + return error; +} int mac_vnode_check_chdir(vfs_context_t ctx, struct vnode *dvp) @@ -497,13 +854,18 @@ mac_vnode_check_chdir(vfs_context_t ctx, struct vnode *dvp) kauth_cred_t cred; int error; - if (!mac_vnode_enforce || - !mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return (0); - +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return 0; + } +#endif cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_chdir, cred, dvp, dvp->v_label); - return (error); + return error; } int @@ -513,15 +875,41 @@ mac_vnode_check_chroot(vfs_context_t ctx, struct vnode *dvp, kauth_cred_t cred; int error; - if (!mac_vnode_enforce || - !mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return (0); - +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return 0; + } +#endif cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_chroot, cred, dvp, dvp->v_label, cnp); - return (error); + return error; } +int +mac_vnode_check_clone(vfs_context_t ctx, struct vnode *dvp, + struct vnode *vp, struct componentname *cnp) +{ + kauth_cred_t cred; + int error; + +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return 0; + } +#endif + cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } + MAC_CHECK(vnode_check_clone, cred, dvp, dvp->v_label, vp, + vp->v_label, cnp); + return error; +} int mac_vnode_check_create(vfs_context_t ctx, struct vnode *dvp, struct componentname *cnp, struct vnode_attr *vap) @@ -529,13 +917,18 @@ mac_vnode_check_create(vfs_context_t ctx, struct vnode *dvp, kauth_cred_t cred; int error; - if (!mac_vnode_enforce || - !mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return (0); - +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return 0; + } +#endif cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_create, cred, dvp, dvp->v_label, cnp, vap); - return (error); + return error; } int @@ -545,14 +938,19 @@ mac_vnode_check_unlink(vfs_context_t ctx, struct vnode *dvp, struct vnode *vp, kauth_cred_t cred; int error; - if (!mac_vnode_enforce || - !mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return (0); - +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return 0; + } +#endif cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_unlink, cred, dvp, dvp->v_label, vp, vp->v_label, cnp); - return (error); + return error; } #if 0 int @@ -562,13 +960,18 @@ mac_vnode_check_deleteacl(vfs_context_t ctx, struct vnode *vp, kauth_cred_t cred; int error; - if (!mac_vnode_enforce || - !mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return (0); - +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return 0; + } +#endif cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_deleteacl, cred, vp, vp->v_label, type); - return (error); + return error; } #endif @@ -579,13 +982,18 @@ mac_vnode_check_deleteextattr(vfs_context_t ctx, struct vnode *vp, kauth_cred_t cred; int error; - if (!mac_vnode_enforce || - !mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return (0); - +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return 0; + } +#endif cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_deleteextattr, cred, vp, vp->v_label, name); - return (error); + return error; } int mac_vnode_check_exchangedata(vfs_context_t ctx, @@ -594,15 +1002,20 @@ mac_vnode_check_exchangedata(vfs_context_t ctx, kauth_cred_t cred; int error; - if (!mac_vnode_enforce || - !mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return (0); - +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return 0; + } +#endif cred = vfs_context_ucred(ctx); - MAC_CHECK(vnode_check_exchangedata, cred, v1, v1->v_label, + if (!mac_cred_check_enforce(cred)) { + return 0; + } + MAC_CHECK(vnode_check_exchangedata, cred, v1, v1->v_label, v2, v2->v_label); - return (error); + return error; } #if 0 @@ -612,16 +1025,42 @@ mac_vnode_check_getacl(vfs_context_t ctx, struct vnode *vp, acl_type_t type) kauth_cred_t cred; int error; - if (!mac_vnode_enforce || - !mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return (0); - +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return 0; + } +#endif cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_getacl, cred, vp, vp->v_label, type); - return (error); + return error; } #endif +int +mac_vnode_check_getattr(vfs_context_t ctx, struct ucred *file_cred, + struct vnode *vp, struct vnode_attr *va) +{ + kauth_cred_t cred; + int error; + +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return 0; + } +#endif + cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } + MAC_CHECK(vnode_check_getattr, cred, file_cred, vp, vp->v_label, va); + return error; +} + int mac_vnode_check_getattrlist(vfs_context_t ctx, struct vnode *vp, struct attrlist *alist) @@ -629,15 +1068,20 @@ mac_vnode_check_getattrlist(vfs_context_t ctx, struct vnode *vp, kauth_cred_t cred; int error; - if (!mac_vnode_enforce || - !mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return (0); - +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return 0; + } +#endif cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_getattrlist, cred, vp, vp->v_label, alist); /* Falsify results instead of returning error? */ - return (error); + return error; } int @@ -645,17 +1089,72 @@ mac_vnode_check_exec(vfs_context_t ctx, struct vnode *vp, struct image_params *imgp) { kauth_cred_t cred; - int error; + int error = 0; - if (!mac_vnode_enforce || !mac_proc_enforce) - return (0); +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_proc_enforce || !mac_vnode_enforce) { + return 0; + } +#endif cred = vfs_context_ucred(ctx); - MAC_CHECK(vnode_check_exec, cred, vp, vp->v_label, - (imgp != NULL) ? imgp->ip_execlabelp : NULL, - (imgp != NULL) ? &imgp->ip_ndp->ni_cnd : NULL, - (imgp != NULL) ? &imgp->ip_csflags : NULL); - return (error); + + /* + * NB: Cannot use MAC_CHECK macro because we need a sequence point after + * calling exec_spawnattr_getmacpolicyinfo() and before passing the + * spawnattrlen as an argument to the hook. + */ + { + struct mac_policy_conf *mpc; + u_int i; + + for (i = 0; i < mac_policy_list.staticmax; i++) { + mpc = mac_policy_list.entries[i].mpc; + if (mpc == NULL) { + continue; + } + + mpo_vnode_check_exec_t *hook = mpc->mpc_ops->mpo_vnode_check_exec; + if (hook == NULL) { + continue; + } + + size_t spawnattrlen = 0; + void *spawnattr = exec_spawnattr_getmacpolicyinfo(imgp->ip_px_smpx, mpc->mpc_name, &spawnattrlen); + + error = mac_error_select( + hook(cred, + vp, imgp->ip_scriptvp, vp->v_label, imgp->ip_scriptlabelp, + imgp->ip_execlabelp, &imgp->ip_ndp->ni_cnd, &imgp->ip_csflags, + spawnattr, spawnattrlen), error); + } + if (mac_policy_list_conditional_busy() != 0) { + for (; i <= mac_policy_list.maxindex; i++) { + mpc = mac_policy_list.entries[i].mpc; + if (mpc == NULL) { + continue; + } + + mpo_vnode_check_exec_t *hook = mpc->mpc_ops->mpo_vnode_check_exec; + if (hook == NULL) { + continue; + } + + size_t spawnattrlen = 0; + void *spawnattr = exec_spawnattr_getmacpolicyinfo(imgp->ip_px_smpx, mpc->mpc_name, &spawnattrlen); + + error = mac_error_select( + hook(cred, + vp, imgp->ip_scriptvp, vp->v_label, imgp->ip_scriptlabelp, + imgp->ip_execlabelp, &imgp->ip_ndp->ni_cnd, &imgp->ip_csflags, + spawnattr, spawnattrlen), error); + } + mac_policy_list_unbusy(); + } + } + + return error; } int @@ -664,26 +1163,129 @@ mac_vnode_check_fsgetpath(vfs_context_t ctx, struct vnode *vp) kauth_cred_t cred; int error; - if (!mac_vnode_enforce || - !mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return (0); - +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return 0; + } +#endif cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_fsgetpath, cred, vp, vp->v_label); - return (error); + return error; } int -mac_vnode_check_signature(struct vnode *vp, unsigned char *sha1, - void * signature, size_t size) +mac_vnode_check_signature(struct vnode *vp, struct cs_blob *cs_blob, + struct image_params *imgp, + unsigned int *cs_flags, unsigned int *signer_type, + int flags) { int error; - - if (!mac_vnode_enforce || !mac_proc_enforce) - return (0); - - MAC_CHECK(vnode_check_signature, vp, vp->v_label, sha1, signature, size); - return (error); + char *fatal_failure_desc = NULL; + size_t fatal_failure_desc_len = 0; + + char *vn_path = NULL; + vm_size_t vn_pathlen = MAXPATHLEN; + cpu_type_t cpu_type = (imgp == NULL) ? CPU_TYPE_ANY : imgp->ip_origcputype; + + +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_proc_enforce || !mac_vnode_enforce) { + return 0; + } +#endif + + MAC_CHECK(vnode_check_signature, vp, vp->v_label, cpu_type, cs_blob, + cs_flags, signer_type, flags, &fatal_failure_desc, &fatal_failure_desc_len); + + if (fatal_failure_desc_len) { + // A fatal code signature validation failure occured, formulate a crash + // reason. + + char const *path = NULL; + + vn_path = (char *)kalloc(MAXPATHLEN); + if (vn_path != NULL) { + if (vn_getpath(vp, vn_path, (int*)&vn_pathlen) == 0) { + path = vn_path; + } else { + path = "(get vnode path failed)"; + } + } else { + path = "(path alloc failed)"; + } + + if (error == 0) { + panic("mac_vnode_check_signature: MAC hook returned no error, " + "but status is claimed to be fatal? " + "path: '%s', fatal_failure_desc_len: %ld, fatal_failure_desc:\n%s\n", + path, fatal_failure_desc_len, fatal_failure_desc); + } + + printf("mac_vnode_check_signature: %s: code signature validation failed fatally: %s", + path, fatal_failure_desc); + + if (imgp == NULL) { + goto out; + } + + os_reason_t reason = os_reason_create(OS_REASON_CODESIGNING, + CODESIGNING_EXIT_REASON_TASKGATED_INVALID_SIG); + + if (reason == OS_REASON_NULL) { + printf("mac_vnode_check_signature: %s: failure to allocate exit reason for validation failure: %s\n", + path, fatal_failure_desc); + goto out; + } + + imgp->ip_cs_error = reason; + reason->osr_flags = (OS_REASON_FLAG_GENERATE_CRASH_REPORT | + OS_REASON_FLAG_CONSISTENT_FAILURE); + + if (fatal_failure_desc == NULL) { + // This may happen if allocation for the buffer failed. + printf("mac_vnode_check_signature: %s: fatal failure is missing its description.\n", path); + } else { + mach_vm_address_t data_addr = 0; + + int reason_error = 0; + int kcdata_error = 0; + + if ((reason_error = os_reason_alloc_buffer_noblock(reason, kcdata_estimate_required_buffer_size + (1, fatal_failure_desc_len))) == 0 && + (kcdata_error = kcdata_get_memory_addr(&reason->osr_kcd_descriptor, + EXIT_REASON_USER_DESC, fatal_failure_desc_len, + &data_addr)) == KERN_SUCCESS) { + kern_return_t mc_error = kcdata_memcpy(&reason->osr_kcd_descriptor, (mach_vm_address_t)data_addr, + fatal_failure_desc, fatal_failure_desc_len); + + if (mc_error != KERN_SUCCESS) { + printf("mac_vnode_check_signature: %s: failed to copy reason string " + "(kcdata_memcpy error: %d, length: %ld)\n", + path, mc_error, fatal_failure_desc_len); + } + } else { + printf("mac_vnode_check_signature: %s: failed to allocate space for reason string " + "(os_reason_alloc_buffer error: %d, kcdata error: %d, length: %ld)\n", + path, reason_error, kcdata_error, fatal_failure_desc_len); + } + } + } + +out: + if (vn_path) { + kfree(vn_path, MAXPATHLEN); + } + + if (fatal_failure_desc_len > 0 && fatal_failure_desc != NULL) { + kfree(fatal_failure_desc, fatal_failure_desc_len); + } + + return error; } #if 0 @@ -693,13 +1295,18 @@ mac_vnode_check_getacl(vfs_context_t ctx, struct vnode *vp, acl_type_t type) kauth_cred_t cred; int error; - if (!mac_vnode_enforce || - !mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return (0); - +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return 0; + } +#endif cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_getacl, cred, vp, vp->v_label, type); - return (error); + return error; } #endif @@ -710,14 +1317,19 @@ mac_vnode_check_getextattr(vfs_context_t ctx, struct vnode *vp, kauth_cred_t cred; int error; - if (!mac_vnode_enforce || - !mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return (0); - +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return 0; + } +#endif cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_getextattr, cred, vp, vp->v_label, name, uio); - return (error); + return error; } int @@ -726,13 +1338,18 @@ mac_vnode_check_ioctl(vfs_context_t ctx, struct vnode *vp, u_int cmd) kauth_cred_t cred; int error; - if (!mac_vnode_enforce || - !mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return (0); - +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return 0; + } +#endif cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_ioctl, cred, vp, vp->v_label, cmd); - return (error); + return error; } int @@ -742,15 +1359,20 @@ mac_vnode_check_kqfilter(vfs_context_t ctx, kauth_cred_t file_cred, kauth_cred_t cred; int error; - if (!mac_vnode_enforce || - !mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return (0); - +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return 0; + } +#endif cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_kqfilter, cred, file_cred, kn, vp, vp->v_label); - return (error); + return error; } int @@ -760,14 +1382,19 @@ mac_vnode_check_link(vfs_context_t ctx, struct vnode *dvp, kauth_cred_t cred; int error; - if (!mac_vnode_enforce || - !mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return (0); - +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return 0; + } +#endif cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_link, cred, dvp, dvp->v_label, vp, vp->v_label, cnp); - return (error); + return error; } int @@ -776,13 +1403,39 @@ mac_vnode_check_listextattr(vfs_context_t ctx, struct vnode *vp) kauth_cred_t cred; int error; - if (!mac_vnode_enforce || - !mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return (0); - +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return 0; + } +#endif cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_listextattr, cred, vp, vp->v_label); - return (error); + return error; +} + +int +mac_vnode_check_lookup_preflight(vfs_context_t ctx, struct vnode *dvp, + const char *path, size_t pathlen) +{ + kauth_cred_t cred; + int error; + +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return 0; + } +#endif + cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } + MAC_CHECK(vnode_check_lookup_preflight, cred, dvp, dvp->v_label, path, pathlen); + return error; } int @@ -792,13 +1445,18 @@ mac_vnode_check_lookup(vfs_context_t ctx, struct vnode *dvp, kauth_cred_t cred; int error; - if (!mac_vnode_enforce || - !mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return (0); - +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return 0; + } +#endif cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_lookup, cred, dvp, dvp->v_label, cnp); - return (error); + return error; } int @@ -807,13 +1465,18 @@ mac_vnode_check_open(vfs_context_t ctx, struct vnode *vp, int acc_mode) kauth_cred_t cred; int error; - if (!mac_vnode_enforce || - !mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return (0); - +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return 0; + } +#endif cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_open, cred, vp, vp->v_label, acc_mode); - return (error); + return error; } int @@ -823,15 +1486,20 @@ mac_vnode_check_read(vfs_context_t ctx, struct ucred *file_cred, kauth_cred_t cred; int error; - if (!mac_vnode_enforce || - !mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return (0); - +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return 0; + } +#endif cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_read, cred, file_cred, vp, vp->v_label); - return (error); + return error; } int @@ -840,13 +1508,18 @@ mac_vnode_check_readdir(vfs_context_t ctx, struct vnode *dvp) kauth_cred_t cred; int error; - if (!mac_vnode_enforce || - !mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return (0); - +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return 0; + } +#endif cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_readdir, cred, dvp, dvp->v_label); - return (error); + return error; } int @@ -855,13 +1528,18 @@ mac_vnode_check_readlink(vfs_context_t ctx, struct vnode *vp) kauth_cred_t cred; int error; - if (!mac_vnode_enforce || - !mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return (0); - +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return 0; + } +#endif cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_readlink, cred, vp, vp->v_label); - return (error); + return error; } int @@ -871,48 +1549,56 @@ mac_vnode_check_label_update(vfs_context_t ctx, struct vnode *vp, kauth_cred_t cred; int error; - if (!mac_vnode_enforce || - !mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return (0); - +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return 0; + } +#endif cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_label_update, cred, vp, vp->v_label, newlabel); - return (error); + return error; } int -mac_vnode_check_rename_from(vfs_context_t ctx, struct vnode *dvp, - struct vnode *vp, struct componentname *cnp) +mac_vnode_check_rename(vfs_context_t ctx, struct vnode *dvp, + struct vnode *vp, struct componentname *cnp, struct vnode *tdvp, + struct vnode *tvp, struct componentname *tcnp) { kauth_cred_t cred; int error; - if (!mac_vnode_enforce || - !mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return (0); - +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return 0; + } +#endif cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } + MAC_CHECK(vnode_check_rename_from, cred, dvp, dvp->v_label, vp, vp->v_label, cnp); - return (error); -} - -int -mac_vnode_check_rename_to(vfs_context_t ctx, struct vnode *dvp, - struct vnode *vp, int samedir, struct componentname *cnp) -{ - kauth_cred_t cred; - int error; + if (error) { + return error; + } - if (!mac_vnode_enforce || - !mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return (0); + MAC_CHECK(vnode_check_rename_to, cred, tdvp, tdvp->v_label, tvp, + tvp != NULL ? tvp->v_label : NULL, dvp == tdvp, tcnp); + if (error) { + return error; + } - cred = vfs_context_ucred(ctx); - MAC_CHECK(vnode_check_rename_to, cred, dvp, dvp->v_label, vp, - vp != NULL ? vp->v_label : NULL, samedir, cnp); - return (error); + MAC_CHECK(vnode_check_rename, cred, dvp, dvp->v_label, vp, + vp->v_label, cnp, tdvp, tdvp->v_label, tvp, + tvp != NULL ? tvp->v_label : NULL, tcnp); + return error; } int @@ -921,13 +1607,18 @@ mac_vnode_check_revoke(vfs_context_t ctx, struct vnode *vp) kauth_cred_t cred; int error; - if (!mac_vnode_enforce || - !mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return (0); - +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return 0; + } +#endif cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_revoke, cred, vp, vp->v_label); - return (error); + return error; } int @@ -936,13 +1627,18 @@ mac_vnode_check_searchfs(vfs_context_t ctx, struct vnode *vp, struct attrlist *a kauth_cred_t cred; int error; - if (!mac_vnode_enforce || - !mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return (0); - +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return 0; + } +#endif cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_searchfs, cred, vp, vp->v_label, alist); - return (error); + return error; } int @@ -951,32 +1647,40 @@ mac_vnode_check_select(vfs_context_t ctx, struct vnode *vp, int which) kauth_cred_t cred; int error; - if (!mac_vnode_enforce || - !mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return (0); - +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return 0; + } +#endif cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_select, cred, vp, vp->v_label, which); - return (error); + return error; } -#if 0 int -mac_vnode_check_setacl(vfs_context_t ctx, struct vnode *vp, acl_type_t type, - struct acl *acl) +mac_vnode_check_setacl(vfs_context_t ctx, struct vnode *vp, + struct kauth_acl *acl) { kauth_cred_t cred; int error; - if (!mac_vnode_enforce || - !mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return (0); - +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return 0; + } +#endif cred = vfs_context_ucred(ctx); - MAC_CHECK(vnode_check_setacl, cred, vp, vp->v_label, type, acl); - return (error); + if (!mac_cred_check_enforce(cred)) { + return 0; + } + MAC_CHECK(vnode_check_setacl, cred, vp, vp->v_label, acl); + return error; } -#endif int mac_vnode_check_setattrlist(vfs_context_t ctx, struct vnode *vp, @@ -985,13 +1689,18 @@ mac_vnode_check_setattrlist(vfs_context_t ctx, struct vnode *vp, kauth_cred_t cred; int error; - if (!mac_vnode_enforce || - !mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return (0); - +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return 0; + } +#endif cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_setattrlist, cred, vp, vp->v_label, alist); - return (error); + return error; } int @@ -1001,14 +1710,19 @@ mac_vnode_check_setextattr(vfs_context_t ctx, struct vnode *vp, kauth_cred_t cred; int error; - if (!mac_vnode_enforce || - !mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return (0); - +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return 0; + } +#endif cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_setextattr, cred, vp, vp->v_label, name, uio); - return (error); + return error; } int @@ -1017,13 +1731,18 @@ mac_vnode_check_setflags(vfs_context_t ctx, struct vnode *vp, u_long flags) kauth_cred_t cred; int error; - if (!mac_vnode_enforce || - !mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return (0); - +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return 0; + } +#endif cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_setflags, cred, vp, vp->v_label, flags); - return (error); + return error; } int @@ -1032,13 +1751,18 @@ mac_vnode_check_setmode(vfs_context_t ctx, struct vnode *vp, mode_t mode) kauth_cred_t cred; int error; - if (!mac_vnode_enforce || - !mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return (0); - +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return 0; + } +#endif cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_setmode, cred, vp, vp->v_label, mode); - return (error); + return error; } int @@ -1048,13 +1772,18 @@ mac_vnode_check_setowner(vfs_context_t ctx, struct vnode *vp, uid_t uid, kauth_cred_t cred; int error; - if (!mac_vnode_enforce || - !mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return (0); - +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return 0; + } +#endif cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_setowner, cred, vp, vp->v_label, uid, gid); - return (error); + return error; } int @@ -1064,14 +1793,19 @@ mac_vnode_check_setutimes(vfs_context_t ctx, struct vnode *vp, kauth_cred_t cred; int error; - if (!mac_vnode_enforce || - !mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return (0); - +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return 0; + } +#endif cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_setutimes, cred, vp, vp->v_label, atime, mtime); - return (error); + return error; } int @@ -1081,14 +1815,40 @@ mac_vnode_check_stat(vfs_context_t ctx, struct ucred *file_cred, kauth_cred_t cred; int error; - if (!mac_vnode_enforce || - !mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return (0); - +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return 0; + } +#endif cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_stat, cred, file_cred, vp, vp->v_label); - return (error); + return error; +} + +int +mac_vnode_check_trigger_resolve(vfs_context_t ctx, struct vnode *dvp, + struct componentname *cnp) +{ + kauth_cred_t cred; + int error; + +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return 0; + } +#endif + cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } + MAC_CHECK(vnode_check_trigger_resolve, cred, dvp, dvp->v_label, cnp); + return error; } int @@ -1098,15 +1858,20 @@ mac_vnode_check_truncate(vfs_context_t ctx, struct ucred *file_cred, kauth_cred_t cred; int error; - if (!mac_vnode_enforce || - !mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return (0); - +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return 0; + } +#endif cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_truncate, cred, file_cred, vp, vp->v_label); - return (error); + return error; } int @@ -1116,14 +1881,19 @@ mac_vnode_check_write(vfs_context_t ctx, struct ucred *file_cred, kauth_cred_t cred; int error; - if (!mac_vnode_enforce || - !mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return (0); - +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return 0; + } +#endif cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_write, cred, file_cred, vp, vp->v_label); - return (error); + return error; } int @@ -1133,28 +1903,38 @@ mac_vnode_check_uipc_bind(vfs_context_t ctx, struct vnode *dvp, kauth_cred_t cred; int error; - if (!mac_vnode_enforce || - !mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return (0); - +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return 0; + } +#endif cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_uipc_bind, cred, dvp, dvp->v_label, cnp, vap); - return (error); + return error; } int -mac_vnode_check_uipc_connect(vfs_context_t ctx, struct vnode *vp) +mac_vnode_check_uipc_connect(vfs_context_t ctx, struct vnode *vp, struct socket *so) { kauth_cred_t cred; int error; - if (!mac_vnode_enforce || - !mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return (0); - +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return 0; + } +#endif cred = vfs_context_ucred(ctx); - MAC_CHECK(vnode_check_uipc_connect, cred, vp, vp->v_label); - return (error); + if (!mac_cred_check_enforce(cred)) { + return 0; + } + MAC_CHECK(vnode_check_uipc_connect, cred, vp, vp->v_label, (socket_t) so); + return error; } void @@ -1163,8 +1943,9 @@ mac_vnode_label_update(vfs_context_t ctx, struct vnode *vp, struct label *newlab kauth_cred_t cred = vfs_context_ucred(ctx); struct label *tmpl = NULL; - if (vp->v_label == NULL) + if (vp->v_label == NULL) { tmpl = mac_vnode_label_alloc(); + } vnode_lock(vp); @@ -1177,8 +1958,26 @@ mac_vnode_label_update(vfs_context_t ctx, struct vnode *vp, struct label *newlab MAC_PERFORM(vnode_label_update, cred, vp, vp->v_label, newlabel); vnode_unlock(vp); - if (tmpl != NULL) + if (tmpl != NULL) { mac_vnode_label_free(tmpl); + } +} + +int +mac_vnode_find_sigs(struct proc *p, struct vnode *vp, off_t offset) +{ + int error; + +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_proc_enforce || !mac_vnode_enforce) { + return 0; + } +#endif + + MAC_CHECK(vnode_find_sigs, p, vp, offset, vp->v_label); + + return error; } void @@ -1189,44 +1988,51 @@ mac_mount_label_associate(vfs_context_t ctx, struct mount *mp) /* XXX: eventually this logic may be handled by the policy? */ /* We desire MULTILABEL for the root filesystem. */ - if ((mp->mnt_flag & MNT_ROOTFS) && - (strcmp(mp->mnt_vfsstat.f_fstypename, "hfs") == 0)) + if ((mp->mnt_flag & MNT_ROOTFS) && + (strcmp(mp->mnt_vfsstat.f_fstypename, "hfs") == 0)) { mp->mnt_flag |= MNT_MULTILABEL; + } /* MULTILABEL on DEVFS. */ - if (strcmp(mp->mnt_vfsstat.f_fstypename, "devfs") == 0) + if (strcmp(mp->mnt_vfsstat.f_fstypename, "devfs") == 0) { mp->mnt_flag |= MNT_MULTILABEL; + } /* MULTILABEL on FDESC pseudo-filesystem. */ - if (strcmp(mp->mnt_vfsstat.f_fstypename, "fdesc") == 0) + if (strcmp(mp->mnt_vfsstat.f_fstypename, "fdesc") == 0) { mp->mnt_flag |= MNT_MULTILABEL; + } /* MULTILABEL on all NFS filesystems. */ - if (strcmp(mp->mnt_vfsstat.f_fstypename, "nfs") == 0) + if (strcmp(mp->mnt_vfsstat.f_fstypename, "nfs") == 0) { mp->mnt_flag |= MNT_MULTILABEL; + } /* MULTILABEL on all AFP filesystems. */ - if (strcmp(mp->mnt_vfsstat.f_fstypename, "afpfs") == 0) + if (strcmp(mp->mnt_vfsstat.f_fstypename, "afpfs") == 0) { mp->mnt_flag |= MNT_MULTILABEL; + } if (mp->mnt_vtable != NULL) { /* Any filesystem that supports native XATTRs. */ - if ((mp->mnt_vtable->vfc_vfsflags & VFC_VFSNATIVEXATTR)) + if ((mp->mnt_vtable->vfc_vfsflags & VFC_VFSNATIVEXATTR)) { mp->mnt_flag |= MNT_MULTILABEL; + } /* Filesystem does not support multilabel. */ if ((mp->mnt_vtable->vfc_vfsflags & VFC_VFSNOMACLABEL) && - (mp->mnt_flag & MNT_MULTILABEL)) + (mp->mnt_flag & MNT_MULTILABEL)) { mp->mnt_flag &= ~MNT_MULTILABEL; + } } MAC_PERFORM(mount_label_associate, cred, mp, mp->mnt_mntlabel); -#if MAC_DEBUG +#if DEBUG printf("MAC Framework enabling %s support: %s -> %s (%s)\n", - mp->mnt_flag & MNT_MULTILABEL ? "multilabel" : "singlelabel", - mp->mnt_vfsstat.f_mntfromname, - mp->mnt_vfsstat.f_mntonname, - mp->mnt_vfsstat.f_fstypename); + mp->mnt_flag & MNT_MULTILABEL ? "multilabel" : "singlelabel", + mp->mnt_vfsstat.f_mntfromname, + mp->mnt_vfsstat.f_mntonname, + mp->mnt_vfsstat.f_fstypename); #endif } @@ -1237,30 +2043,103 @@ mac_mount_check_mount(vfs_context_t ctx, struct vnode *vp, kauth_cred_t cred; int error; - if (!mac_vnode_enforce || - !mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return (0); - +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return 0; + } +#endif cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(mount_check_mount, cred, vp, vp->v_label, cnp, vfc_name); - return (error); + return error; } int -mac_mount_check_remount(vfs_context_t ctx, struct mount *mp) +mac_mount_check_snapshot_create(vfs_context_t ctx, struct mount *mp, + const char *name) { kauth_cred_t cred; int error; - if (!mac_vnode_enforce || - !mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return (0); +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return 0; + } +#endif + cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } + MAC_CHECK(mount_check_snapshot_create, cred, mp, name); + return error; +} +int +mac_mount_check_snapshot_delete(vfs_context_t ctx, struct mount *mp, + const char *name) +{ + kauth_cred_t cred; + int error; + +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return 0; + } +#endif cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } + MAC_CHECK(mount_check_snapshot_delete, cred, mp, name); + return error; +} + +int +mac_mount_check_snapshot_revert(vfs_context_t ctx, struct mount *mp, + const char *name) +{ + kauth_cred_t cred; + int error; + +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return 0; + } +#endif + cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } + MAC_CHECK(mount_check_snapshot_revert, cred, mp, name); + return error; +} + +int +mac_mount_check_remount(vfs_context_t ctx, struct mount *mp) +{ + kauth_cred_t cred; + int error; + +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return 0; + } +#endif + cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(mount_check_remount, cred, mp, mp->mnt_mntlabel); - return (error); + return error; } int @@ -1269,46 +2148,61 @@ mac_mount_check_umount(vfs_context_t ctx, struct mount *mp) kauth_cred_t cred; int error; - if (!mac_vnode_enforce || - !mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return (0); - +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return 0; + } +#endif cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(mount_check_umount, cred, mp, mp->mnt_mntlabel); - return (error); + return error; } int -mac_mount_check_getattr(vfs_context_t ctx, struct mount *mp, +mac_mount_check_getattr(vfs_context_t ctx, struct mount *mp, struct vfs_attr *vfa) { kauth_cred_t cred; int error; - if (!mac_vnode_enforce || - !mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return (0); - +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return 0; + } +#endif cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(mount_check_getattr, cred, mp, mp->mnt_mntlabel, vfa); - return (error); + return error; } int -mac_mount_check_setattr(vfs_context_t ctx, struct mount *mp, +mac_mount_check_setattr(vfs_context_t ctx, struct mount *mp, struct vfs_attr *vfa) { kauth_cred_t cred; int error; - if (!mac_vnode_enforce || - !mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return (0); - +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return 0; + } +#endif cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(mount_check_setattr, cred, mp, mp->mnt_mntlabel, vfa); - return (error); + return error; } int @@ -1317,14 +2211,19 @@ mac_mount_check_stat(vfs_context_t ctx, struct mount *mount) kauth_cred_t cred; int error; - if (!mac_vnode_enforce || - !mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return (0); - +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return 0; + } +#endif cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(mount_check_stat, cred, mount, mount->mnt_mntlabel); - return (error); + return error; } int @@ -1333,14 +2232,19 @@ mac_mount_check_label_update(vfs_context_t ctx, struct mount *mount) kauth_cred_t cred; int error; - if (!mac_vnode_enforce || - !mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return (0); - +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return 0; + } +#endif cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(mount_check_label_update, cred, mount, mount->mnt_mntlabel); - return (error); + return error; } int @@ -1349,22 +2253,31 @@ mac_mount_check_fsctl(vfs_context_t ctx, struct mount *mp, u_int cmd) kauth_cred_t cred; int error; - if (!mac_vnode_enforce || - !mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return (0); - +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return 0; + } +#endif cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(mount_check_fsctl, cred, mp, mp->mnt_mntlabel, cmd); - return (error); + return error; } void mac_devfs_label_associate_device(dev_t dev, struct devnode *de, const char *fullpath) { - if (!mac_device_enforce) +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_device_enforce) { return; + } +#endif MAC_PERFORM(devfs_label_associate_device, dev, de, de->dn_label, fullpath); @@ -1374,8 +2287,12 @@ void mac_devfs_label_associate_directory(const char *dirname, int dirnamelen, struct devnode *de, const char *fullpath) { - if (!mac_device_enforce) +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_device_enforce) { return; + } +#endif MAC_PERFORM(devfs_label_associate_directory, dirname, dirnamelen, de, de->dn_label, fullpath); @@ -1386,18 +2303,27 @@ vn_setlabel(struct vnode *vp, struct label *intlabel, vfs_context_t context) { int error; - if (!mac_vnode_enforce || !mac_label_vnodes) - return (0); +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return 0; + } +#endif + if (!mac_label_vnodes) { + return 0; + } if (vp->v_mount == NULL) { printf("vn_setlabel: null v_mount\n"); - if (vp->v_type != VNON) + if (vp->v_type != VNON) { printf("vn_setlabel: null v_mount with non-VNON\n"); - return (EBADF); + } + return EBADF; } - if ((vp->v_mount->mnt_flag & MNT_MULTILABEL) == 0) - return (ENOTSUP); + if ((vp->v_mount->mnt_flag & MNT_MULTILABEL) == 0) { + return ENOTSUP; + } /* * Multi-phase commit. First check the policies to confirm the @@ -1406,26 +2332,26 @@ vn_setlabel(struct vnode *vp, struct label *intlabel, vfs_context_t context) * should update the vnode at the end as part of VNOP_SETLABEL()? */ error = mac_vnode_check_label_update(context, vp, intlabel); - if (error) - return (error); + if (error) { + return error; + } error = VNOP_SETLABEL(vp, intlabel, context); if (error == ENOTSUP) { error = mac_vnode_label_store(context, vp, - intlabel); + intlabel); if (error) { printf("%s: mac_vnode_label_store failed %d\n", - __func__, error); - return (error); + __func__, error); + return error; } mac_vnode_label_update(context, vp, intlabel); - } else - if (error) { + } else if (error) { printf("vn_setlabel: vop setlabel failed %d\n", error); - return (error); + return error; } - return (0); + return 0; } int @@ -1433,7 +2359,9 @@ mac_vnode_label_associate_fdesc(struct mount *mp, struct fdescnode *fnp, struct vnode *vp, vfs_context_t ctx) { struct fileproc *fp; +#if CONFIG_MACF_SOCKET_SUBSET struct socket *so; +#endif struct pipe *cpipe; struct vnode *fvp; struct proc *p; @@ -1447,35 +2375,39 @@ mac_vnode_label_associate_fdesc(struct mount *mp, struct fdescnode *fnp, if (fnp->fd_fd == -1) { MAC_PERFORM(vnode_label_associate_file, vfs_context_ucred(ctx), mp, mp->mnt_mntlabel, NULL, NULL, vp, vp->v_label); - return (0); + return 0; } p = vfs_context_proc(ctx); error = fp_lookup(p, fnp->fd_fd, &fp, 0); - if (error) - return (error); + if (error) { + return error; + } if (fp->f_fglob == NULL) { error = EBADF; goto out; } - switch (fp->f_fglob->fg_type) { + switch (FILEGLOB_DTYPE(fp->f_fglob)) { case DTYPE_VNODE: fvp = (struct vnode *)fp->f_fglob->fg_data; - if ((error = vnode_getwithref(fvp))) + if ((error = vnode_getwithref(fvp))) { goto out; + } MAC_PERFORM(vnode_label_copy, fvp->v_label, vp->v_label); (void)vnode_put(fvp); break; +#if CONFIG_MACF_SOCKET_SUBSET case DTYPE_SOCKET: so = (struct socket *)fp->f_fglob->fg_data; socket_lock(so, 1); MAC_PERFORM(vnode_label_associate_socket, - vfs_context_ucred(ctx), (socket_t)so, so->so_label, + vfs_context_ucred(ctx), (socket_t)so, so->so_label, vp, vp->v_label); socket_unlock(so, 1); break; +#endif case DTYPE_PSXSHM: pshm_label_associate(fp, vp, ctx); break; @@ -1496,6 +2428,8 @@ mac_vnode_label_associate_fdesc(struct mount *mp, struct fdescnode *fnp, break; case DTYPE_KQUEUE: case DTYPE_FSEVENTS: + case DTYPE_ATALK: + case DTYPE_NETPOLICY: default: MAC_PERFORM(vnode_label_associate_file, vfs_context_ucred(ctx), mp, mp->mnt_mntlabel, fp->f_fglob, fp->f_fglob->fg_label, @@ -1504,5 +2438,5 @@ mac_vnode_label_associate_fdesc(struct mount *mp, struct fdescnode *fnp, } out: fp_drop(p, fnp->fd_fd, fp, 0); - return (error); + return error; }