X-Git-Url: https://git.saurik.com/apple/xnu.git/blobdiff_plain/743345f9a4b36f7e2f9ba37691e70c50baecb56e..0a7de7458d150b5d4dffc935ba399be265ef0a1a:/security/mac_vfs.c diff --git a/security/mac_vfs.c b/security/mac_vfs.c index 1f88f57a3..81b311012 100644 --- a/security/mac_vfs.c +++ b/security/mac_vfs.c @@ -2,7 +2,7 @@ * Copyright (c) 2007-2016 Apple Inc. All rights reserved. * * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ - * + * * This file contains Original Code and/or Modifications of Original Code * as defined in and that are subject to the Apple Public Source License * Version 2.0 (the 'License'). You may not use this file except in @@ -11,10 +11,10 @@ * unlawful or unlicensed copies of an Apple operating system, or to * circumvent, violate, or enable the circumvention or violation of, any * terms of an Apple operating system software license agreement. - * + * * Please obtain a copy of the License at * http://www.opensource.apple.com/apsl/ and read it before using this file. - * + * * The Original Code and all software distributed under the License are * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, @@ -22,7 +22,7 @@ * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. * Please see the License for the specific language governing rights and * limitations under the License. - * + * * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ */ /*- @@ -87,7 +87,7 @@ #include /* convert {R,W,X}_OK values to V{READ,WRITE,EXEC} */ -#define ACCESS_MODE_TO_VNODE_MASK(m) (m << 6) +#define ACCESS_MODE_TO_VNODE_MASK(m) (m << 6) static struct label * mac_devfsdirent_label_alloc(void) @@ -95,16 +95,16 @@ mac_devfsdirent_label_alloc(void) struct label *label; label = mac_labelzone_alloc(MAC_WAITOK); - if (label == NULL) - return (NULL); + if (label == NULL) { + return NULL; + } MAC_PERFORM(devfs_label_init, label); - return (label); + return label; } void mac_devfs_label_init(struct devnode *de) { - de->dn_label = mac_devfsdirent_label_alloc(); } @@ -114,16 +114,16 @@ mac_mount_label_alloc(void) struct label *label; label = mac_labelzone_alloc(MAC_WAITOK); - if (label == NULL) - return (NULL); + if (label == NULL) { + return NULL; + } MAC_PERFORM(mount_label_init, label); - return (label); + return label; } void mac_mount_label_init(struct mount *mp) { - mp->mnt_mntlabel = mac_mount_label_alloc(); } @@ -133,10 +133,11 @@ mac_vnode_label_alloc(void) struct label *label; label = mac_labelzone_alloc(MAC_WAITOK); - if (label == NULL) - return (NULL); + if (label == NULL) { + return NULL; + } MAC_PERFORM(vnode_label_init, label); - return (label); + return label; } void @@ -148,18 +149,17 @@ mac_vnode_label_init(vnode_t vp) int mac_vnode_label_init_needed(vnode_t vp) { - return (mac_label_vnodes != 0 && vp->v_label == NULL); + return mac_label_vnodes != 0 && vp->v_label == NULL; } -/* +/* * vnode labels are allocated at the same time as vnodes, but vnodes are never * freed. Instead, we want to remove any sensitive information before putting * them on the free list for reuse. -*/ + */ void mac_vnode_label_recycle(vnode_t vp) { - MAC_PERFORM(vnode_label_recycle, vp->v_label); } @@ -182,7 +182,6 @@ mac_devfs_label_destroy(struct devnode *de) static void mac_mount_label_free(struct label *label) { - MAC_PERFORM(mount_label_destroy, label); mac_labelzone_free(label); } @@ -233,7 +232,7 @@ mac_vnode_label_externalize_audit(struct vnode *vp, struct mac *mac) error = MAC_EXTERNALIZE_AUDIT(vnode, vp->v_label, mac->m_string, mac->m_buflen); - return (error); + return error; } int @@ -244,7 +243,7 @@ mac_vnode_label_externalize(struct label *label, char *elements, error = MAC_EXTERNALIZE(vnode, label, elements, outbuf, outbuflen); - return (error); + return error; } int @@ -254,7 +253,7 @@ mac_vnode_label_internalize(struct label *label, char *string) error = MAC_INTERNALIZE(vnode, label, string); - return (error); + return error; } int @@ -264,7 +263,7 @@ mac_mount_label_internalize(struct label *label, char *string) error = MAC_INTERNALIZE(mount, label, string); - return (error); + return error; } int @@ -275,7 +274,7 @@ mac_mount_label_externalize(struct label *label, char *elements, error = MAC_EXTERNALIZE(mount, label, elements, outbuf, outbuflen); - return (error); + return error; } void @@ -283,8 +282,9 @@ mac_devfs_label_copy(struct label *src, struct label *dest) { #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_device_enforce) + if (!mac_device_enforce) { return; + } #endif MAC_PERFORM(devfs_label_copy, src, dest); @@ -296,8 +296,9 @@ mac_devfs_label_update(struct mount *mp, struct devnode *de, { #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_device_enforce) + if (!mac_device_enforce) { return; + } #endif MAC_PERFORM(devfs_label_update, mp, de, de->dn_label, vp, @@ -313,8 +314,9 @@ mac_vnode_label_associate(struct mount *mp, struct vnode *vp, vfs_context_t ctx) #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_vnode_enforce) - return (error); + if (!mac_vnode_enforce) { + return error; + } #endif /* XXX: should not inspect v_tag in kernel! */ @@ -332,7 +334,7 @@ mac_vnode_label_associate(struct mount *mp, struct vnode *vp, vfs_context_t ctx) break; } - return (error); + return error; } void @@ -341,8 +343,9 @@ mac_vnode_label_associate_devfs(struct mount *mp, struct devnode *de, { #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_device_enforce) + if (!mac_device_enforce) { return; + } #endif MAC_PERFORM(vnode_label_associate_devfs, @@ -359,7 +362,7 @@ mac_vnode_label_associate_extattr(struct mount *mp, struct vnode *vp) MAC_CHECK(vnode_label_associate_extattr, mp, mp->mnt_mntlabel, vp, vp->v_label); - return (error); + return error; } void @@ -367,11 +370,13 @@ mac_vnode_label_associate_singlelabel(struct mount *mp, struct vnode *vp) { #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_vnode_enforce) + if (!mac_vnode_enforce) { return; + } #endif - if (!mac_label_vnodes) + if (!mac_label_vnodes) { return; + } MAC_PERFORM(vnode_label_associate_singlelabel, mp, mp ? mp->mnt_mntlabel : NULL, vp, vp->v_label); @@ -386,17 +391,18 @@ mac_vnode_notify_create(vfs_context_t ctx, struct mount *mp, #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_vnode_enforce) - return (0); + if (!mac_vnode_enforce) { + return 0; + } #endif - if (!mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return (0); - cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_notify_create, cred, mp, mp->mnt_mntlabel, dvp, dvp->v_label, vp, vp->v_label, cnp); - return (error); + return error; } void @@ -407,13 +413,14 @@ mac_vnode_notify_rename(vfs_context_t ctx, struct vnode *vp, #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_vnode_enforce) + if (!mac_vnode_enforce) { return; + } #endif - if (!mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return; - cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return; + } MAC_PERFORM(vnode_notify_rename, cred, vp, vp->v_label, dvp, dvp->v_label, cnp); } @@ -425,31 +432,33 @@ mac_vnode_notify_open(vfs_context_t ctx, struct vnode *vp, int acc_flags) #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_vnode_enforce) + if (!mac_vnode_enforce) { return; + } #endif - if (!mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return; - cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return; + } MAC_PERFORM(vnode_notify_open, cred, vp, vp->v_label, acc_flags); } void mac_vnode_notify_link(vfs_context_t ctx, struct vnode *vp, - struct vnode *dvp, struct componentname *cnp) + struct vnode *dvp, struct componentname *cnp) { kauth_cred_t cred; #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_vnode_enforce) + if (!mac_vnode_enforce) { return; + } #endif - if (!mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return; - cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return; + } MAC_PERFORM(vnode_notify_link, cred, dvp, dvp->v_label, vp, vp->v_label, cnp); } @@ -460,13 +469,14 @@ mac_vnode_notify_deleteextattr(vfs_context_t ctx, struct vnode *vp, const char * #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_vnode_enforce) + if (!mac_vnode_enforce) { return; + } #endif - if (!mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return; - cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return; + } MAC_PERFORM(vnode_notify_deleteextattr, cred, vp, vp->v_label, name); } @@ -477,13 +487,14 @@ mac_vnode_notify_setacl(vfs_context_t ctx, struct vnode *vp, struct kauth_acl *a #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_vnode_enforce) + if (!mac_vnode_enforce) { return; + } #endif - if (!mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return; - cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return; + } MAC_PERFORM(vnode_notify_setacl, cred, vp, vp->v_label, acl); } @@ -494,13 +505,14 @@ mac_vnode_notify_setattrlist(vfs_context_t ctx, struct vnode *vp, struct attrlis #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_vnode_enforce) + if (!mac_vnode_enforce) { return; + } #endif - if (!mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return; - cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return; + } MAC_PERFORM(vnode_notify_setattrlist, cred, vp, vp->v_label, alist); } @@ -511,13 +523,14 @@ mac_vnode_notify_setextattr(vfs_context_t ctx, struct vnode *vp, const char *nam #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_vnode_enforce) + if (!mac_vnode_enforce) { return; + } #endif - if (!mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return; - cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return; + } MAC_PERFORM(vnode_notify_setextattr, cred, vp, vp->v_label, name, uio); } @@ -528,13 +541,14 @@ mac_vnode_notify_setflags(vfs_context_t ctx, struct vnode *vp, u_long flags) #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_vnode_enforce) + if (!mac_vnode_enforce) { return; + } #endif - if (!mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return; - cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return; + } MAC_PERFORM(vnode_notify_setflags, cred, vp, vp->v_label, flags); } @@ -545,13 +559,14 @@ mac_vnode_notify_setmode(vfs_context_t ctx, struct vnode *vp, mode_t mode) #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_vnode_enforce) + if (!mac_vnode_enforce) { return; + } #endif - if (!mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return; - cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return; + } MAC_PERFORM(vnode_notify_setmode, cred, vp, vp->v_label, mode); } @@ -562,13 +577,14 @@ mac_vnode_notify_setowner(vfs_context_t ctx, struct vnode *vp, uid_t uid, gid_t #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_vnode_enforce) + if (!mac_vnode_enforce) { return; + } #endif - if (!mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return; - cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return; + } MAC_PERFORM(vnode_notify_setowner, cred, vp, vp->v_label, uid, gid); } @@ -579,13 +595,14 @@ mac_vnode_notify_setutimes(vfs_context_t ctx, struct vnode *vp, struct timespec #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_vnode_enforce) + if (!mac_vnode_enforce) { return; + } #endif - if (!mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return; - cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return; + } MAC_PERFORM(vnode_notify_setutimes, cred, vp, vp->v_label, atime, mtime); } @@ -596,13 +613,14 @@ mac_vnode_notify_truncate(vfs_context_t ctx, kauth_cred_t file_cred, struct vnod #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_vnode_enforce) + if (!mac_vnode_enforce) { return; + } #endif - if (!mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return; - cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return; + } MAC_PERFORM(vnode_notify_truncate, cred, file_cred, vp, vp->v_label); } @@ -619,16 +637,19 @@ mac_vnode_label_update_extattr(struct mount *mp, struct vnode *vp, #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_vnode_enforce) + if (!mac_vnode_enforce) { return; + } #endif - if (!mac_label_vnodes) + if (!mac_label_vnodes) { return; + } MAC_PERFORM(vnode_label_update_extattr, mp, mp->mnt_mntlabel, vp, - vp->v_label, name); - if (error == 0) + vp->v_label, name); + if (error == 0) { return; + } vnode_lock(vp); vnode_relabel(vp); @@ -645,23 +666,27 @@ mac_vnode_label_store(vfs_context_t ctx, struct vnode *vp, #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_vnode_enforce) + if (!mac_vnode_enforce) { return 0; + } #endif - if (!mac_label_vnodes || - !mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) + if (!mac_label_vnodes) { return 0; + } cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_label_store, cred, vp, vp->v_label, intlabel); - return (error); + return error; } void mac_cred_label_update_execve(vfs_context_t ctx, kauth_cred_t new, struct vnode *vp, off_t offset, - struct vnode *scriptvp, struct label *scriptvnodelabel, struct label *execl, u_int *csflags, - void *macextensions, int *disjoint, int *labelupdateerror) + struct vnode *scriptvp, struct label *scriptvnodelabel, struct label *execl, u_int *csflags, + void *macextensions, int *disjoint, int *labelupdateerror) { kauth_cred_t cred; *disjoint = 0; @@ -670,8 +695,9 @@ mac_cred_label_update_execve(vfs_context_t ctx, kauth_cred_t new, struct vnode * #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_proc_enforce || !mac_vnode_enforce) + if (!mac_proc_enforce || !mac_vnode_enforce) { return; + } #endif /* mark the new cred to indicate "matching" includes the label */ @@ -689,38 +715,42 @@ mac_cred_label_update_execve(vfs_context_t ctx, kauth_cred_t new, struct vnode * u_int i; error = 0; - for (i = 0; i< mac_policy_list.staticmax; i++) { + for (i = 0; i < mac_policy_list.staticmax; i++) { mpc = mac_policy_list.entries[i].mpc; - if (mpc == NULL) + if (mpc == NULL) { continue; + } mpo_cred_label_update_execve_t *hook = mpc->mpc_ops->mpo_cred_label_update_execve; - if (hook == NULL) + if (hook == NULL) { continue; + } size_t spawnattrlen = 0; void *spawnattr = exec_spawnattr_getmacpolicyinfo(macextensions, mpc->mpc_name, &spawnattrlen); error = mac_error_select(hook(cred, new, vfs_context_proc(ctx), vp, offset, scriptvp, - vp->v_label, scriptvnodelabel, execl, csflags, spawnattr, spawnattrlen, disjoint), - error); + vp->v_label, scriptvnodelabel, execl, csflags, spawnattr, spawnattrlen, disjoint), + error); } - if (mac_policy_list_conditional_busy() != 0) { + if (mac_policy_list_conditional_busy() != 0) { for (; i <= mac_policy_list.maxindex; i++) { mpc = mac_policy_list.entries[i].mpc; - if (mpc == NULL) + if (mpc == NULL) { continue; + } mpo_cred_label_update_execve_t *hook = mpc->mpc_ops->mpo_cred_label_update_execve; - if (hook == NULL) + if (hook == NULL) { continue; + } size_t spawnattrlen = 0; void *spawnattr = exec_spawnattr_getmacpolicyinfo(macextensions, mpc->mpc_name, &spawnattrlen); error = mac_error_select(hook(cred, new, vfs_context_proc(ctx), vp, offset, scriptvp, - vp->v_label, scriptvnodelabel, execl, csflags, spawnattr, spawnattrlen, disjoint), - error); + vp->v_label, scriptvnodelabel, execl, csflags, spawnattr, spawnattrlen, disjoint), + error); } mac_policy_list_unbusy(); } @@ -730,16 +760,17 @@ mac_cred_label_update_execve(vfs_context_t ctx, kauth_cred_t new, struct vnode * int mac_cred_check_label_update_execve(vfs_context_t ctx, struct vnode *vp, off_t offset, - struct vnode *scriptvp, struct label *scriptvnodelabel, struct label *execlabel, - struct proc *p, void *macextensions) + struct vnode *scriptvp, struct label *scriptvnodelabel, struct label *execlabel, + struct proc *p, void *macextensions) { kauth_cred_t cred; int result = 0; #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_proc_enforce || !mac_vnode_enforce) + if (!mac_proc_enforce || !mac_vnode_enforce) { return result; + } #endif cred = vfs_context_ucred(ctx); @@ -753,29 +784,33 @@ mac_cred_check_label_update_execve(vfs_context_t ctx, struct vnode *vp, off_t of struct mac_policy_conf *mpc; u_int i; - for (i = 0; i< mac_policy_list.staticmax; i++) { + for (i = 0; i < mac_policy_list.staticmax; i++) { mpc = mac_policy_list.entries[i].mpc; - if (mpc == NULL) + if (mpc == NULL) { continue; + } mpo_cred_check_label_update_execve_t *hook = mpc->mpc_ops->mpo_cred_check_label_update_execve; - if (hook == NULL) + if (hook == NULL) { continue; + } size_t spawnattrlen = 0; void *spawnattr = exec_spawnattr_getmacpolicyinfo(macextensions, mpc->mpc_name, &spawnattrlen); result = result || hook(cred, vp, offset, scriptvp, vp->v_label, scriptvnodelabel, execlabel, p, spawnattr, spawnattrlen); } - if (mac_policy_list_conditional_busy() != 0) { + if (mac_policy_list_conditional_busy() != 0) { for (; i <= mac_policy_list.maxindex; i++) { mpc = mac_policy_list.entries[i].mpc; - if (mpc == NULL) + if (mpc == NULL) { continue; + } mpo_cred_check_label_update_execve_t *hook = mpc->mpc_ops->mpo_cred_check_label_update_execve; - if (hook == NULL) + if (hook == NULL) { continue; + } size_t spawnattrlen = 0; void *spawnattr = exec_spawnattr_getmacpolicyinfo(macextensions, mpc->mpc_name, &spawnattrlen); @@ -786,7 +821,7 @@ mac_cred_check_label_update_execve(vfs_context_t ctx, struct vnode *vp, off_t of } } - return (result); + return result; } int @@ -799,18 +834,19 @@ mac_vnode_check_access(vfs_context_t ctx, struct vnode *vp, #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_vnode_enforce) + if (!mac_vnode_enforce) { return 0; + } #endif - if (!mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return 0; - cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } /* Convert {R,W,X}_OK values to V{READ,WRITE,EXEC} for entry points */ mask = ACCESS_MODE_TO_VNODE_MASK(acc_mode); MAC_CHECK(vnode_check_access, cred, vp, vp->v_label, mask); - return (error); - } + return error; +} int mac_vnode_check_chdir(vfs_context_t ctx, struct vnode *dvp) @@ -820,15 +856,16 @@ mac_vnode_check_chdir(vfs_context_t ctx, struct vnode *dvp) #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_vnode_enforce) + if (!mac_vnode_enforce) { return 0; + } #endif - if (!mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return 0; - cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_chdir, cred, dvp, dvp->v_label); - return (error); + return error; } int @@ -840,15 +877,16 @@ mac_vnode_check_chroot(vfs_context_t ctx, struct vnode *dvp, #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_vnode_enforce) + if (!mac_vnode_enforce) { return 0; + } #endif - if (!mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return 0; - cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_chroot, cred, dvp, dvp->v_label, cnp); - return (error); + return error; } int @@ -860,16 +898,17 @@ mac_vnode_check_clone(vfs_context_t ctx, struct vnode *dvp, #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_vnode_enforce) + if (!mac_vnode_enforce) { return 0; + } #endif - if (!mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return 0; - cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_clone, cred, dvp, dvp->v_label, vp, vp->v_label, cnp); - return (error); + return error; } int mac_vnode_check_create(vfs_context_t ctx, struct vnode *dvp, @@ -880,15 +919,16 @@ mac_vnode_check_create(vfs_context_t ctx, struct vnode *dvp, #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_vnode_enforce) + if (!mac_vnode_enforce) { return 0; + } #endif - if (!mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return 0; - cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_create, cred, dvp, dvp->v_label, cnp, vap); - return (error); + return error; } int @@ -900,16 +940,17 @@ mac_vnode_check_unlink(vfs_context_t ctx, struct vnode *dvp, struct vnode *vp, #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_vnode_enforce) + if (!mac_vnode_enforce) { return 0; + } #endif - if (!mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return 0; - cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_unlink, cred, dvp, dvp->v_label, vp, vp->v_label, cnp); - return (error); + return error; } #if 0 int @@ -921,15 +962,16 @@ mac_vnode_check_deleteacl(vfs_context_t ctx, struct vnode *vp, #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_vnode_enforce) + if (!mac_vnode_enforce) { return 0; + } #endif - if (!mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return 0; - cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_deleteacl, cred, vp, vp->v_label, type); - return (error); + return error; } #endif @@ -942,15 +984,16 @@ mac_vnode_check_deleteextattr(vfs_context_t ctx, struct vnode *vp, #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_vnode_enforce) + if (!mac_vnode_enforce) { return 0; + } #endif - if (!mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return 0; - cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_deleteextattr, cred, vp, vp->v_label, name); - return (error); + return error; } int mac_vnode_check_exchangedata(vfs_context_t ctx, @@ -961,17 +1004,18 @@ mac_vnode_check_exchangedata(vfs_context_t ctx, #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_vnode_enforce) + if (!mac_vnode_enforce) { return 0; + } #endif - if (!mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return 0; - cred = vfs_context_ucred(ctx); - MAC_CHECK(vnode_check_exchangedata, cred, v1, v1->v_label, + if (!mac_cred_check_enforce(cred)) { + return 0; + } + MAC_CHECK(vnode_check_exchangedata, cred, v1, v1->v_label, v2, v2->v_label); - return (error); + return error; } #if 0 @@ -983,15 +1027,16 @@ mac_vnode_check_getacl(vfs_context_t ctx, struct vnode *vp, acl_type_t type) #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_vnode_enforce) + if (!mac_vnode_enforce) { return 0; + } #endif - if (!mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return 0; - cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_getacl, cred, vp, vp->v_label, type); - return (error); + return error; } #endif @@ -1004,15 +1049,16 @@ mac_vnode_check_getattr(vfs_context_t ctx, struct ucred *file_cred, #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_vnode_enforce) + if (!mac_vnode_enforce) { return 0; + } #endif - if (!mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return 0; - cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_getattr, cred, file_cred, vp, vp->v_label, va); - return (error); + return error; } int @@ -1024,17 +1070,18 @@ mac_vnode_check_getattrlist(vfs_context_t ctx, struct vnode *vp, #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_vnode_enforce) + if (!mac_vnode_enforce) { return 0; + } #endif - if (!mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return 0; - cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_getattrlist, cred, vp, vp->v_label, alist); /* Falsify results instead of returning error? */ - return (error); + return error; } int @@ -1046,8 +1093,9 @@ mac_vnode_check_exec(vfs_context_t ctx, struct vnode *vp, #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_proc_enforce || !mac_vnode_enforce) + if (!mac_proc_enforce || !mac_vnode_enforce) { return 0; + } #endif cred = vfs_context_ucred(ctx); @@ -1061,48 +1109,52 @@ mac_vnode_check_exec(vfs_context_t ctx, struct vnode *vp, struct mac_policy_conf *mpc; u_int i; - for (i = 0; i< mac_policy_list.staticmax; i++) { + for (i = 0; i < mac_policy_list.staticmax; i++) { mpc = mac_policy_list.entries[i].mpc; - if (mpc == NULL) + if (mpc == NULL) { continue; + } mpo_vnode_check_exec_t *hook = mpc->mpc_ops->mpo_vnode_check_exec; - if (hook == NULL) + if (hook == NULL) { continue; + } size_t spawnattrlen = 0; void *spawnattr = exec_spawnattr_getmacpolicyinfo(imgp->ip_px_smpx, mpc->mpc_name, &spawnattrlen); error = mac_error_select( - hook(cred, - vp, imgp->ip_scriptvp, vp->v_label, imgp->ip_scriptlabelp, - imgp->ip_execlabelp, &imgp->ip_ndp->ni_cnd, &imgp->ip_csflags, - spawnattr, spawnattrlen), error); + hook(cred, + vp, imgp->ip_scriptvp, vp->v_label, imgp->ip_scriptlabelp, + imgp->ip_execlabelp, &imgp->ip_ndp->ni_cnd, &imgp->ip_csflags, + spawnattr, spawnattrlen), error); } - if (mac_policy_list_conditional_busy() != 0) { + if (mac_policy_list_conditional_busy() != 0) { for (; i <= mac_policy_list.maxindex; i++) { mpc = mac_policy_list.entries[i].mpc; - if (mpc == NULL) + if (mpc == NULL) { continue; + } mpo_vnode_check_exec_t *hook = mpc->mpc_ops->mpo_vnode_check_exec; - if (hook == NULL) + if (hook == NULL) { continue; + } size_t spawnattrlen = 0; void *spawnattr = exec_spawnattr_getmacpolicyinfo(imgp->ip_px_smpx, mpc->mpc_name, &spawnattrlen); error = mac_error_select( - hook(cred, - vp, imgp->ip_scriptvp, vp->v_label, imgp->ip_scriptlabelp, - imgp->ip_execlabelp, &imgp->ip_ndp->ni_cnd, &imgp->ip_csflags, - spawnattr, spawnattrlen), error); + hook(cred, + vp, imgp->ip_scriptvp, vp->v_label, imgp->ip_scriptlabelp, + imgp->ip_execlabelp, &imgp->ip_ndp->ni_cnd, &imgp->ip_csflags, + spawnattr, spawnattrlen), error); } mac_policy_list_unbusy(); } } - return (error); + return error; } int @@ -1113,124 +1165,127 @@ mac_vnode_check_fsgetpath(vfs_context_t ctx, struct vnode *vp) #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_vnode_enforce) + if (!mac_vnode_enforce) { return 0; + } #endif - if (!mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return 0; - cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_fsgetpath, cred, vp, vp->v_label); - return (error); + return error; } int mac_vnode_check_signature(struct vnode *vp, struct cs_blob *cs_blob, - struct image_params *imgp, - unsigned int *cs_flags, int flags) + struct image_params *imgp, + unsigned int *cs_flags, unsigned int *signer_type, + int flags) { - int error; - char *fatal_failure_desc = NULL; - size_t fatal_failure_desc_len = 0; + int error; + char *fatal_failure_desc = NULL; + size_t fatal_failure_desc_len = 0; - char *vn_path = NULL; - vm_size_t vn_pathlen = MAXPATHLEN; + char *vn_path = NULL; + vm_size_t vn_pathlen = MAXPATHLEN; + cpu_type_t cpu_type = (imgp == NULL) ? CPU_TYPE_ANY : imgp->ip_origcputype; #if SECURITY_MAC_CHECK_ENFORCE - /* 21167099 - only check if we allow write */ - if (!mac_proc_enforce || !mac_vnode_enforce) - return 0; + /* 21167099 - only check if we allow write */ + if (!mac_proc_enforce || !mac_vnode_enforce) { + return 0; + } #endif - MAC_CHECK(vnode_check_signature, vp, vp->v_label, cs_blob, - cs_flags, flags, &fatal_failure_desc, &fatal_failure_desc_len); + MAC_CHECK(vnode_check_signature, vp, vp->v_label, cpu_type, cs_blob, + cs_flags, signer_type, flags, &fatal_failure_desc, &fatal_failure_desc_len); - if (fatal_failure_desc_len) { - // A fatal code signature validation failure occured, formulate a crash - // reason. + if (fatal_failure_desc_len) { + // A fatal code signature validation failure occured, formulate a crash + // reason. - char const *path = NULL; + char const *path = NULL; - vn_path = (char *)kalloc(MAXPATHLEN); - if (vn_path != NULL) { - if (vn_getpath(vp, vn_path, (int*)&vn_pathlen) == 0) { - path = vn_path; - } else { - path = "(get vnode path failed)"; - } - } else { - path = "(path alloc failed)"; - } - - if (error == 0) { - panic("mac_vnode_check_signature: MAC hook returned no error, " - "but status is claimed to be fatal? " - "path: '%s', fatal_failure_desc_len: %ld, fatal_failure_desc:\n%s\n", - path, fatal_failure_desc_len, fatal_failure_desc); - } - - printf("mac_vnode_check_signature: %s: code signature validation failed fatally: %s", - path, fatal_failure_desc); - - if (imgp == NULL) { - goto out; - } - - os_reason_t reason = os_reason_create(OS_REASON_CODESIGNING, - CODESIGNING_EXIT_REASON_TASKGATED_INVALID_SIG); - - if (reason == OS_REASON_NULL) { - printf("mac_vnode_check_signature: %s: failure to allocate exit reason for validation failure: %s\n", - path, fatal_failure_desc); - goto out; - } - - imgp->ip_cs_error = reason; - reason->osr_flags = (OS_REASON_FLAG_GENERATE_CRASH_REPORT | - OS_REASON_FLAG_CONSISTENT_FAILURE); - - if (fatal_failure_desc == NULL) { - // This may happen if allocation for the buffer failed. - printf("mac_vnode_check_signature: %s: fatal failure is missing its description.\n", path); - } else { - mach_vm_address_t data_addr = 0; - - int reason_error = 0; - int kcdata_error = 0; - - if ((reason_error = os_reason_alloc_buffer(reason, kcdata_estimate_required_buffer_size - (1, fatal_failure_desc_len))) == 0 && - (kcdata_error = kcdata_get_memory_addr(&reason->osr_kcd_descriptor, - EXIT_REASON_USER_DESC, fatal_failure_desc_len, - &data_addr)) == KERN_SUCCESS) { - kern_return_t mc_error = kcdata_memcpy(&reason->osr_kcd_descriptor, (mach_vm_address_t)data_addr, - fatal_failure_desc, fatal_failure_desc_len); - - if (mc_error != KERN_SUCCESS) { - printf("mac_vnode_check_signature: %s: failed to copy reason string " - "(kcdata_memcpy error: %d, length: %ld)\n", - path, mc_error, fatal_failure_desc_len); - } - } else { - printf("mac_vnode_check_signature: %s: failed to allocate space for reason string " - "(os_reason_alloc_buffer error: %d, kcdata error: %d, length: %ld)\n", - path, reason_error, kcdata_error, fatal_failure_desc_len); - } + vn_path = (char *)kalloc(MAXPATHLEN); + if (vn_path != NULL) { + if (vn_getpath(vp, vn_path, (int*)&vn_pathlen) == 0) { + path = vn_path; + } else { + path = "(get vnode path failed)"; + } + } else { + path = "(path alloc failed)"; + } + + if (error == 0) { + panic("mac_vnode_check_signature: MAC hook returned no error, " + "but status is claimed to be fatal? " + "path: '%s', fatal_failure_desc_len: %ld, fatal_failure_desc:\n%s\n", + path, fatal_failure_desc_len, fatal_failure_desc); + } - } - } + printf("mac_vnode_check_signature: %s: code signature validation failed fatally: %s", + path, fatal_failure_desc); + + if (imgp == NULL) { + goto out; + } + + os_reason_t reason = os_reason_create(OS_REASON_CODESIGNING, + CODESIGNING_EXIT_REASON_TASKGATED_INVALID_SIG); + + if (reason == OS_REASON_NULL) { + printf("mac_vnode_check_signature: %s: failure to allocate exit reason for validation failure: %s\n", + path, fatal_failure_desc); + goto out; + } + + imgp->ip_cs_error = reason; + reason->osr_flags = (OS_REASON_FLAG_GENERATE_CRASH_REPORT | + OS_REASON_FLAG_CONSISTENT_FAILURE); + + if (fatal_failure_desc == NULL) { + // This may happen if allocation for the buffer failed. + printf("mac_vnode_check_signature: %s: fatal failure is missing its description.\n", path); + } else { + mach_vm_address_t data_addr = 0; + + int reason_error = 0; + int kcdata_error = 0; + + if ((reason_error = os_reason_alloc_buffer_noblock(reason, kcdata_estimate_required_buffer_size + (1, fatal_failure_desc_len))) == 0 && + (kcdata_error = kcdata_get_memory_addr(&reason->osr_kcd_descriptor, + EXIT_REASON_USER_DESC, fatal_failure_desc_len, + &data_addr)) == KERN_SUCCESS) { + kern_return_t mc_error = kcdata_memcpy(&reason->osr_kcd_descriptor, (mach_vm_address_t)data_addr, + fatal_failure_desc, fatal_failure_desc_len); + + if (mc_error != KERN_SUCCESS) { + printf("mac_vnode_check_signature: %s: failed to copy reason string " + "(kcdata_memcpy error: %d, length: %ld)\n", + path, mc_error, fatal_failure_desc_len); + } + } else { + printf("mac_vnode_check_signature: %s: failed to allocate space for reason string " + "(os_reason_alloc_buffer error: %d, kcdata error: %d, length: %ld)\n", + path, reason_error, kcdata_error, fatal_failure_desc_len); + } + } + } out: - if (vn_path) { - kfree(vn_path, MAXPATHLEN); - } + if (vn_path) { + kfree(vn_path, MAXPATHLEN); + } - if (fatal_failure_desc_len > 0 && fatal_failure_desc != NULL) { - kfree(fatal_failure_desc, fatal_failure_desc_len); - } + if (fatal_failure_desc_len > 0 && fatal_failure_desc != NULL) { + kfree(fatal_failure_desc, fatal_failure_desc_len); + } - return (error); + return error; } #if 0 @@ -1242,15 +1297,16 @@ mac_vnode_check_getacl(vfs_context_t ctx, struct vnode *vp, acl_type_t type) #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_vnode_enforce) + if (!mac_vnode_enforce) { return 0; + } #endif - if (!mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return 0; - cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_getacl, cred, vp, vp->v_label, type); - return (error); + return error; } #endif @@ -1263,16 +1319,17 @@ mac_vnode_check_getextattr(vfs_context_t ctx, struct vnode *vp, #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_vnode_enforce) + if (!mac_vnode_enforce) { return 0; + } #endif - if (!mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return 0; - cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_getextattr, cred, vp, vp->v_label, name, uio); - return (error); + return error; } int @@ -1283,15 +1340,16 @@ mac_vnode_check_ioctl(vfs_context_t ctx, struct vnode *vp, u_int cmd) #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_vnode_enforce) + if (!mac_vnode_enforce) { return 0; + } #endif - if (!mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return 0; - cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_ioctl, cred, vp, vp->v_label, cmd); - return (error); + return error; } int @@ -1303,17 +1361,18 @@ mac_vnode_check_kqfilter(vfs_context_t ctx, kauth_cred_t file_cred, #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_vnode_enforce) + if (!mac_vnode_enforce) { return 0; + } #endif - if (!mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return 0; - cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_kqfilter, cred, file_cred, kn, vp, vp->v_label); - return (error); + return error; } int @@ -1325,16 +1384,17 @@ mac_vnode_check_link(vfs_context_t ctx, struct vnode *dvp, #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_vnode_enforce) + if (!mac_vnode_enforce) { return 0; + } #endif - if (!mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return 0; - cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_link, cred, dvp, dvp->v_label, vp, vp->v_label, cnp); - return (error); + return error; } int @@ -1345,15 +1405,37 @@ mac_vnode_check_listextattr(vfs_context_t ctx, struct vnode *vp) #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_vnode_enforce) + if (!mac_vnode_enforce) { return 0; + } #endif - if (!mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) + cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { return 0; + } + MAC_CHECK(vnode_check_listextattr, cred, vp, vp->v_label); + return error; +} +int +mac_vnode_check_lookup_preflight(vfs_context_t ctx, struct vnode *dvp, + const char *path, size_t pathlen) +{ + kauth_cred_t cred; + int error; + +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return 0; + } +#endif cred = vfs_context_ucred(ctx); - MAC_CHECK(vnode_check_listextattr, cred, vp, vp->v_label); - return (error); + if (!mac_cred_check_enforce(cred)) { + return 0; + } + MAC_CHECK(vnode_check_lookup_preflight, cred, dvp, dvp->v_label, path, pathlen); + return error; } int @@ -1365,15 +1447,16 @@ mac_vnode_check_lookup(vfs_context_t ctx, struct vnode *dvp, #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_vnode_enforce) + if (!mac_vnode_enforce) { return 0; + } #endif - if (!mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return 0; - cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_lookup, cred, dvp, dvp->v_label, cnp); - return (error); + return error; } int @@ -1384,15 +1467,16 @@ mac_vnode_check_open(vfs_context_t ctx, struct vnode *vp, int acc_mode) #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_vnode_enforce) + if (!mac_vnode_enforce) { return 0; + } #endif - if (!mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return 0; - cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_open, cred, vp, vp->v_label, acc_mode); - return (error); + return error; } int @@ -1404,17 +1488,18 @@ mac_vnode_check_read(vfs_context_t ctx, struct ucred *file_cred, #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_vnode_enforce) + if (!mac_vnode_enforce) { return 0; + } #endif - if (!mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return 0; - cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_read, cred, file_cred, vp, vp->v_label); - return (error); + return error; } int @@ -1425,15 +1510,16 @@ mac_vnode_check_readdir(vfs_context_t ctx, struct vnode *dvp) #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_vnode_enforce) + if (!mac_vnode_enforce) { return 0; + } #endif - if (!mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return 0; - cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_readdir, cred, dvp, dvp->v_label); - return (error); + return error; } int @@ -1444,15 +1530,16 @@ mac_vnode_check_readlink(vfs_context_t ctx, struct vnode *vp) #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_vnode_enforce) + if (!mac_vnode_enforce) { return 0; + } #endif - if (!mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return 0; - cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_readlink, cred, vp, vp->v_label); - return (error); + return error; } int @@ -1464,16 +1551,17 @@ mac_vnode_check_label_update(vfs_context_t ctx, struct vnode *vp, #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_vnode_enforce) + if (!mac_vnode_enforce) { return 0; + } #endif - if (!mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return 0; - cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_label_update, cred, vp, vp->v_label, newlabel); - return (error); + return error; } int @@ -1486,28 +1574,31 @@ mac_vnode_check_rename(vfs_context_t ctx, struct vnode *dvp, #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_vnode_enforce) + if (!mac_vnode_enforce) { return 0; + } #endif - if (!mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return 0; - cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_rename_from, cred, dvp, dvp->v_label, vp, vp->v_label, cnp); - if (error) - return (error); + if (error) { + return error; + } MAC_CHECK(vnode_check_rename_to, cred, tdvp, tdvp->v_label, tvp, tvp != NULL ? tvp->v_label : NULL, dvp == tdvp, tcnp); - if (error) - return (error); + if (error) { + return error; + } MAC_CHECK(vnode_check_rename, cred, dvp, dvp->v_label, vp, vp->v_label, cnp, tdvp, tdvp->v_label, tvp, tvp != NULL ? tvp->v_label : NULL, tcnp); - return (error); + return error; } int @@ -1518,15 +1609,16 @@ mac_vnode_check_revoke(vfs_context_t ctx, struct vnode *vp) #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_vnode_enforce) + if (!mac_vnode_enforce) { return 0; + } #endif - if (!mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return 0; - cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_revoke, cred, vp, vp->v_label); - return (error); + return error; } int @@ -1537,15 +1629,16 @@ mac_vnode_check_searchfs(vfs_context_t ctx, struct vnode *vp, struct attrlist *a #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_vnode_enforce) + if (!mac_vnode_enforce) { return 0; + } #endif - if (!mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return 0; - cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_searchfs, cred, vp, vp->v_label, alist); - return (error); + return error; } int @@ -1556,15 +1649,16 @@ mac_vnode_check_select(vfs_context_t ctx, struct vnode *vp, int which) #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_vnode_enforce) + if (!mac_vnode_enforce) { return 0; + } #endif - if (!mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return 0; - cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_select, cred, vp, vp->v_label, which); - return (error); + return error; } int @@ -1576,15 +1670,16 @@ mac_vnode_check_setacl(vfs_context_t ctx, struct vnode *vp, #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_vnode_enforce) + if (!mac_vnode_enforce) { return 0; + } #endif - if (!mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return 0; - cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_setacl, cred, vp, vp->v_label, acl); - return (error); + return error; } int @@ -1596,15 +1691,16 @@ mac_vnode_check_setattrlist(vfs_context_t ctx, struct vnode *vp, #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_vnode_enforce) + if (!mac_vnode_enforce) { return 0; + } #endif - if (!mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return 0; - cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_setattrlist, cred, vp, vp->v_label, alist); - return (error); + return error; } int @@ -1616,16 +1712,17 @@ mac_vnode_check_setextattr(vfs_context_t ctx, struct vnode *vp, #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_vnode_enforce) + if (!mac_vnode_enforce) { return 0; + } #endif - if (!mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return 0; - cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_setextattr, cred, vp, vp->v_label, name, uio); - return (error); + return error; } int @@ -1636,15 +1733,16 @@ mac_vnode_check_setflags(vfs_context_t ctx, struct vnode *vp, u_long flags) #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_vnode_enforce) + if (!mac_vnode_enforce) { return 0; + } #endif - if (!mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return 0; - cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_setflags, cred, vp, vp->v_label, flags); - return (error); + return error; } int @@ -1655,15 +1753,16 @@ mac_vnode_check_setmode(vfs_context_t ctx, struct vnode *vp, mode_t mode) #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_vnode_enforce) + if (!mac_vnode_enforce) { return 0; + } #endif - if (!mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return 0; - cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_setmode, cred, vp, vp->v_label, mode); - return (error); + return error; } int @@ -1675,15 +1774,16 @@ mac_vnode_check_setowner(vfs_context_t ctx, struct vnode *vp, uid_t uid, #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_vnode_enforce) + if (!mac_vnode_enforce) { return 0; + } #endif - if (!mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return 0; - cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_setowner, cred, vp, vp->v_label, uid, gid); - return (error); + return error; } int @@ -1695,16 +1795,17 @@ mac_vnode_check_setutimes(vfs_context_t ctx, struct vnode *vp, #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_vnode_enforce) + if (!mac_vnode_enforce) { return 0; + } #endif - if (!mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return 0; - cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_setutimes, cred, vp, vp->v_label, atime, mtime); - return (error); + return error; } int @@ -1716,38 +1817,61 @@ mac_vnode_check_stat(vfs_context_t ctx, struct ucred *file_cred, #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_vnode_enforce) + if (!mac_vnode_enforce) { return 0; + } #endif - if (!mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return 0; - cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_stat, cred, file_cred, vp, vp->v_label); - return (error); + return error; } int -mac_vnode_check_truncate(vfs_context_t ctx, struct ucred *file_cred, - struct vnode *vp) +mac_vnode_check_trigger_resolve(vfs_context_t ctx, struct vnode *dvp, + struct componentname *cnp) { kauth_cred_t cred; int error; #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_vnode_enforce) + if (!mac_vnode_enforce) { return 0; + } #endif - if (!mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) + cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { return 0; + } + MAC_CHECK(vnode_check_trigger_resolve, cred, dvp, dvp->v_label, cnp); + return error; +} + +int +mac_vnode_check_truncate(vfs_context_t ctx, struct ucred *file_cred, + struct vnode *vp) +{ + kauth_cred_t cred; + int error; +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return 0; + } +#endif cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_truncate, cred, file_cred, vp, vp->v_label); - return (error); + return error; } int @@ -1759,16 +1883,17 @@ mac_vnode_check_write(vfs_context_t ctx, struct ucred *file_cred, #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_vnode_enforce) + if (!mac_vnode_enforce) { return 0; + } #endif - if (!mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return 0; - cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_write, cred, file_cred, vp, vp->v_label); - return (error); + return error; } int @@ -1780,15 +1905,16 @@ mac_vnode_check_uipc_bind(vfs_context_t ctx, struct vnode *dvp, #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_vnode_enforce) + if (!mac_vnode_enforce) { return 0; + } #endif - if (!mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return 0; - cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_uipc_bind, cred, dvp, dvp->v_label, cnp, vap); - return (error); + return error; } int @@ -1799,15 +1925,16 @@ mac_vnode_check_uipc_connect(vfs_context_t ctx, struct vnode *vp, struct socket #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_vnode_enforce) + if (!mac_vnode_enforce) { return 0; + } #endif - if (!mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return 0; - cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(vnode_check_uipc_connect, cred, vp, vp->v_label, (socket_t) so); - return (error); + return error; } void @@ -1816,8 +1943,9 @@ mac_vnode_label_update(vfs_context_t ctx, struct vnode *vp, struct label *newlab kauth_cred_t cred = vfs_context_ucred(ctx); struct label *tmpl = NULL; - if (vp->v_label == NULL) + if (vp->v_label == NULL) { tmpl = mac_vnode_label_alloc(); + } vnode_lock(vp); @@ -1830,8 +1958,9 @@ mac_vnode_label_update(vfs_context_t ctx, struct vnode *vp, struct label *newlab MAC_PERFORM(vnode_label_update, cred, vp, vp->v_label, newlabel); vnode_unlock(vp); - if (tmpl != NULL) + if (tmpl != NULL) { mac_vnode_label_free(tmpl); + } } int @@ -1841,13 +1970,14 @@ mac_vnode_find_sigs(struct proc *p, struct vnode *vp, off_t offset) #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_proc_enforce || !mac_vnode_enforce) + if (!mac_proc_enforce || !mac_vnode_enforce) { return 0; + } #endif MAC_CHECK(vnode_find_sigs, p, vp, offset, vp->v_label); - return (error); + return error; } void @@ -1858,44 +1988,51 @@ mac_mount_label_associate(vfs_context_t ctx, struct mount *mp) /* XXX: eventually this logic may be handled by the policy? */ /* We desire MULTILABEL for the root filesystem. */ - if ((mp->mnt_flag & MNT_ROOTFS) && - (strcmp(mp->mnt_vfsstat.f_fstypename, "hfs") == 0)) + if ((mp->mnt_flag & MNT_ROOTFS) && + (strcmp(mp->mnt_vfsstat.f_fstypename, "hfs") == 0)) { mp->mnt_flag |= MNT_MULTILABEL; + } /* MULTILABEL on DEVFS. */ - if (strcmp(mp->mnt_vfsstat.f_fstypename, "devfs") == 0) + if (strcmp(mp->mnt_vfsstat.f_fstypename, "devfs") == 0) { mp->mnt_flag |= MNT_MULTILABEL; + } /* MULTILABEL on FDESC pseudo-filesystem. */ - if (strcmp(mp->mnt_vfsstat.f_fstypename, "fdesc") == 0) + if (strcmp(mp->mnt_vfsstat.f_fstypename, "fdesc") == 0) { mp->mnt_flag |= MNT_MULTILABEL; + } /* MULTILABEL on all NFS filesystems. */ - if (strcmp(mp->mnt_vfsstat.f_fstypename, "nfs") == 0) + if (strcmp(mp->mnt_vfsstat.f_fstypename, "nfs") == 0) { mp->mnt_flag |= MNT_MULTILABEL; + } /* MULTILABEL on all AFP filesystems. */ - if (strcmp(mp->mnt_vfsstat.f_fstypename, "afpfs") == 0) + if (strcmp(mp->mnt_vfsstat.f_fstypename, "afpfs") == 0) { mp->mnt_flag |= MNT_MULTILABEL; + } if (mp->mnt_vtable != NULL) { /* Any filesystem that supports native XATTRs. */ - if ((mp->mnt_vtable->vfc_vfsflags & VFC_VFSNATIVEXATTR)) + if ((mp->mnt_vtable->vfc_vfsflags & VFC_VFSNATIVEXATTR)) { mp->mnt_flag |= MNT_MULTILABEL; + } /* Filesystem does not support multilabel. */ if ((mp->mnt_vtable->vfc_vfsflags & VFC_VFSNOMACLABEL) && - (mp->mnt_flag & MNT_MULTILABEL)) + (mp->mnt_flag & MNT_MULTILABEL)) { mp->mnt_flag &= ~MNT_MULTILABEL; + } } MAC_PERFORM(mount_label_associate, cred, mp, mp->mnt_mntlabel); #if DEBUG printf("MAC Framework enabling %s support: %s -> %s (%s)\n", - mp->mnt_flag & MNT_MULTILABEL ? "multilabel" : "singlelabel", - mp->mnt_vfsstat.f_mntfromname, - mp->mnt_vfsstat.f_mntonname, - mp->mnt_vfsstat.f_fstypename); + mp->mnt_flag & MNT_MULTILABEL ? "multilabel" : "singlelabel", + mp->mnt_vfsstat.f_mntfromname, + mp->mnt_vfsstat.f_mntonname, + mp->mnt_vfsstat.f_fstypename); #endif } @@ -1908,16 +2045,17 @@ mac_mount_check_mount(vfs_context_t ctx, struct vnode *vp, #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_vnode_enforce) + if (!mac_vnode_enforce) { return 0; + } #endif - if (!mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return 0; - cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(mount_check_mount, cred, vp, vp->v_label, cnp, vfc_name); - return (error); + return error; } int @@ -1929,15 +2067,16 @@ mac_mount_check_snapshot_create(vfs_context_t ctx, struct mount *mp, #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_vnode_enforce) + if (!mac_vnode_enforce) { return 0; + } #endif - if (!mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return 0; - cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(mount_check_snapshot_create, cred, mp, name); - return (error); + return error; } int @@ -1949,35 +2088,58 @@ mac_mount_check_snapshot_delete(vfs_context_t ctx, struct mount *mp, #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_vnode_enforce) + if (!mac_vnode_enforce) { return 0; + } #endif - if (!mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return 0; - cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(mount_check_snapshot_delete, cred, mp, name); - return (error); + return error; } int -mac_mount_check_remount(vfs_context_t ctx, struct mount *mp) +mac_mount_check_snapshot_revert(vfs_context_t ctx, struct mount *mp, + const char *name) { kauth_cred_t cred; int error; #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_vnode_enforce) + if (!mac_vnode_enforce) { return 0; + } #endif - if (!mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) + cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { return 0; + } + MAC_CHECK(mount_check_snapshot_revert, cred, mp, name); + return error; +} + +int +mac_mount_check_remount(vfs_context_t ctx, struct mount *mp) +{ + kauth_cred_t cred; + int error; +#if SECURITY_MAC_CHECK_ENFORCE + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return 0; + } +#endif cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(mount_check_remount, cred, mp, mp->mnt_mntlabel); - return (error); + return error; } int @@ -1988,20 +2150,21 @@ mac_mount_check_umount(vfs_context_t ctx, struct mount *mp) #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_vnode_enforce) + if (!mac_vnode_enforce) { return 0; + } #endif - if (!mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return 0; - cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(mount_check_umount, cred, mp, mp->mnt_mntlabel); - return (error); + return error; } int -mac_mount_check_getattr(vfs_context_t ctx, struct mount *mp, +mac_mount_check_getattr(vfs_context_t ctx, struct mount *mp, struct vfs_attr *vfa) { kauth_cred_t cred; @@ -2009,19 +2172,20 @@ mac_mount_check_getattr(vfs_context_t ctx, struct mount *mp, #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_vnode_enforce) + if (!mac_vnode_enforce) { return 0; + } #endif - if (!mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return 0; - cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(mount_check_getattr, cred, mp, mp->mnt_mntlabel, vfa); - return (error); + return error; } int -mac_mount_check_setattr(vfs_context_t ctx, struct mount *mp, +mac_mount_check_setattr(vfs_context_t ctx, struct mount *mp, struct vfs_attr *vfa) { kauth_cred_t cred; @@ -2029,15 +2193,16 @@ mac_mount_check_setattr(vfs_context_t ctx, struct mount *mp, #if SECURITY_MAC_CHECK_ENFORCE /* 21167099 - only check if we allow write */ - if (!mac_vnode_enforce) + if (!mac_vnode_enforce) { return 0; + } #endif - if (!mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return 0; - cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(mount_check_setattr, cred, mp, mp->mnt_mntlabel, vfa); - return (error); + return error; } int @@ -2047,17 +2212,18 @@ mac_mount_check_stat(vfs_context_t ctx, struct mount *mount) int error; #if SECURITY_MAC_CHECK_ENFORCE - /* 21167099 - only check if we allow write */ - if (!mac_vnode_enforce) - return 0; + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return 0; + } #endif - if (!mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return 0; - cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(mount_check_stat, cred, mount, mount->mnt_mntlabel); - return (error); + return error; } int @@ -2067,17 +2233,18 @@ mac_mount_check_label_update(vfs_context_t ctx, struct mount *mount) int error; #if SECURITY_MAC_CHECK_ENFORCE - /* 21167099 - only check if we allow write */ - if (!mac_vnode_enforce) - return 0; + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return 0; + } #endif - if (!mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return 0; - cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(mount_check_label_update, cred, mount, mount->mnt_mntlabel); - return (error); + return error; } int @@ -2087,17 +2254,18 @@ mac_mount_check_fsctl(vfs_context_t ctx, struct mount *mp, u_int cmd) int error; #if SECURITY_MAC_CHECK_ENFORCE - /* 21167099 - only check if we allow write */ - if (!mac_vnode_enforce) - return 0; + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return 0; + } #endif - if (!mac_context_check_enforce(ctx, MAC_VNODE_ENFORCE)) - return 0; - cred = vfs_context_ucred(ctx); + if (!mac_cred_check_enforce(cred)) { + return 0; + } MAC_CHECK(mount_check_fsctl, cred, mp, mp->mnt_mntlabel, cmd); - return (error); + return error; } void @@ -2105,9 +2273,10 @@ mac_devfs_label_associate_device(dev_t dev, struct devnode *de, const char *fullpath) { #if SECURITY_MAC_CHECK_ENFORCE - /* 21167099 - only check if we allow write */ - if (!mac_device_enforce) - return; + /* 21167099 - only check if we allow write */ + if (!mac_device_enforce) { + return; + } #endif MAC_PERFORM(devfs_label_associate_device, dev, de, de->dn_label, @@ -2119,9 +2288,10 @@ mac_devfs_label_associate_directory(const char *dirname, int dirnamelen, struct devnode *de, const char *fullpath) { #if SECURITY_MAC_CHECK_ENFORCE - /* 21167099 - only check if we allow write */ - if (!mac_device_enforce) - return; + /* 21167099 - only check if we allow write */ + if (!mac_device_enforce) { + return; + } #endif MAC_PERFORM(devfs_label_associate_directory, dirname, dirnamelen, de, @@ -2134,22 +2304,26 @@ vn_setlabel(struct vnode *vp, struct label *intlabel, vfs_context_t context) int error; #if SECURITY_MAC_CHECK_ENFORCE - /* 21167099 - only check if we allow write */ - if (!mac_vnode_enforce) - return 0; + /* 21167099 - only check if we allow write */ + if (!mac_vnode_enforce) { + return 0; + } #endif - if (!mac_label_vnodes) - return (0); + if (!mac_label_vnodes) { + return 0; + } if (vp->v_mount == NULL) { printf("vn_setlabel: null v_mount\n"); - if (vp->v_type != VNON) + if (vp->v_type != VNON) { printf("vn_setlabel: null v_mount with non-VNON\n"); - return (EBADF); + } + return EBADF; } - if ((vp->v_mount->mnt_flag & MNT_MULTILABEL) == 0) - return (ENOTSUP); + if ((vp->v_mount->mnt_flag & MNT_MULTILABEL) == 0) { + return ENOTSUP; + } /* * Multi-phase commit. First check the policies to confirm the @@ -2158,26 +2332,26 @@ vn_setlabel(struct vnode *vp, struct label *intlabel, vfs_context_t context) * should update the vnode at the end as part of VNOP_SETLABEL()? */ error = mac_vnode_check_label_update(context, vp, intlabel); - if (error) - return (error); + if (error) { + return error; + } error = VNOP_SETLABEL(vp, intlabel, context); if (error == ENOTSUP) { error = mac_vnode_label_store(context, vp, - intlabel); + intlabel); if (error) { printf("%s: mac_vnode_label_store failed %d\n", - __func__, error); - return (error); + __func__, error); + return error; } mac_vnode_label_update(context, vp, intlabel); - } else - if (error) { + } else if (error) { printf("vn_setlabel: vop setlabel failed %d\n", error); - return (error); + return error; } - return (0); + return 0; } int @@ -2201,13 +2375,14 @@ mac_vnode_label_associate_fdesc(struct mount *mp, struct fdescnode *fnp, if (fnp->fd_fd == -1) { MAC_PERFORM(vnode_label_associate_file, vfs_context_ucred(ctx), mp, mp->mnt_mntlabel, NULL, NULL, vp, vp->v_label); - return (0); + return 0; } p = vfs_context_proc(ctx); error = fp_lookup(p, fnp->fd_fd, &fp, 0); - if (error) - return (error); + if (error) { + return error; + } if (fp->f_fglob == NULL) { error = EBADF; @@ -2217,8 +2392,9 @@ mac_vnode_label_associate_fdesc(struct mount *mp, struct fdescnode *fnp, switch (FILEGLOB_DTYPE(fp->f_fglob)) { case DTYPE_VNODE: fvp = (struct vnode *)fp->f_fglob->fg_data; - if ((error = vnode_getwithref(fvp))) + if ((error = vnode_getwithref(fvp))) { goto out; + } MAC_PERFORM(vnode_label_copy, fvp->v_label, vp->v_label); (void)vnode_put(fvp); break; @@ -2227,7 +2403,7 @@ mac_vnode_label_associate_fdesc(struct mount *mp, struct fdescnode *fnp, so = (struct socket *)fp->f_fglob->fg_data; socket_lock(so, 1); MAC_PERFORM(vnode_label_associate_socket, - vfs_context_ucred(ctx), (socket_t)so, so->so_label, + vfs_context_ucred(ctx), (socket_t)so, so->so_label, vp, vp->v_label); socket_unlock(so, 1); break; @@ -2262,5 +2438,5 @@ mac_vnode_label_associate_fdesc(struct mount *mp, struct fdescnode *fnp, } out: fp_drop(p, fnp->fd_fd, fp, 0); - return (error); + return error; }