lib/libugidfw/ugidfw.c

   1 /*-
   2  * Copyright (c) 2002-2005 Networks Associates Technology, Inc.
   3  * All rights reserved.
   4  *
   5  * This software was developed for the FreeBSD Project by Network Associates
   6  * Laboratories, the Security Research Division of Network Associates, Inc.
   7  * under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the
   8  * DARPA CHATS research program.
   9  *
  10  * Redistribution and use in source and binary forms, with or without
  11  * modification, are permitted provided that the following conditions
  12  * are met:
  13  * 1. Redistributions of source code must retain the above copyright
  14  *    notice, this list of conditions and the following disclaimer.
  15  * 2. Redistributions in binary form must reproduce the above copyright
  16  *    notice, this list of conditions and the following disclaimer in the
  17  *    documentation and/or other materials provided with the distribution.
  18  *
  19  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  29  * SUCH DAMAGE.
  30  *
  31  * $FreeBSD$
  32  */
  33 #include <sys/param.h>
  34 #include <sys/errno.h>
  35 #include <sys/time.h>
  36 #include <sys/sysctl.h>
  37 #include <sys/ucred.h>
  38 #include <sys/mount.h>
  39
  40 #include <security/mac_bsdextended/mac_bsdextended.h>
  41
  42 #include <grp.h>
  43 #include <pwd.h>
  44 #include <stdio.h>
  45 #include <stdlib.h>
  46 #include <string.h>
  47
  48 #include "ugidfw.h"
  49
  50 /*
  51  * Text format for rules: rules contain subject and object elements, mode.
  52  * The total form is "subject [s_element] object [o_element] mode [mode]".
  53  * At least * one of a uid or gid entry must be present; both may also be
  54  * present.
  55  */
  56
  57 #define MIB     "security.mac.bsdextended"
  58
  59 int
  60 bsde_rule_to_string(struct mac_bsdextended_rule *rule, char *buf, size_t buflen)
  61 {
  62         struct group *grp;
  63         struct passwd *pwd;
  64         struct statfs *mntbuf;
  65         char *cur, type[sizeof(rule->mbr_object.mbo_type) * CHAR_BIT + 1];
  66         size_t left, len;
  67         int anymode, unknownmode, numfs, i, notdone;
  68
  69         cur = buf;
  70         left = buflen;
  71
  72         len = snprintf(cur, left, "subject ");
  73         if (len < 0 || len > left)
  74                 goto truncated;
  75         left -= len;
  76         cur += len;
  77         if (rule->mbr_subject.mbs_flags) {
  78                 if (rule->mbr_subject.mbs_neg == MBS_ALL_FLAGS) {
  79                         len = snprintf(cur, left, "not ");
  80                         if (len < 0 || len > left)
  81                                 goto truncated;
  82                         left -= len;
  83                         cur += len;
  84                         notdone = 1;
  85                 } else {
  86                         notdone = 0;
  87                 }
  88
  89                 if (!notdone && (rule->mbr_subject.mbs_neg & MBO_UID_DEFINED)) {
  90                         len = snprintf(cur, left, "! ");
  91                         if (len < 0 || len > left)
  92                                 goto truncated;
  93                         left -= len;
  94                         cur += len;
  95                 }
  96                 if (rule->mbr_subject.mbs_flags & MBO_UID_DEFINED) {
  97                         pwd = getpwuid(rule->mbr_subject.mbs_uid_min);
  98                         if (pwd != NULL) {
  99                                 len = snprintf(cur, left, "uid %s",
 100                                     pwd->pw_name);
 101                                 if (len < 0 || len > left)
 102                                         goto truncated;
 103                                 left -= len;
 104                                 cur += len;
 105                         } else {
 106                                 len = snprintf(cur, left, "uid %u",
 107                                     rule->mbr_subject.mbs_uid_min);
 108                                 if (len < 0 || len > left)
 109                                         goto truncated;
 110                                 left -= len;
 111                                 cur += len;
 112                         }
 113                         if (rule->mbr_subject.mbs_uid_min !=
 114                             rule->mbr_subject.mbs_uid_max) {
 115                                 pwd = getpwuid(rule->mbr_subject.mbs_uid_max);
 116                                 if (pwd != NULL) {
 117                                         len = snprintf(cur, left, ":%s ",
 118                                             pwd->pw_name);
 119                                         if (len < 0 || len > left)
 120                                                 goto truncated;
 121                                         left -= len;
 122                                         cur += len;
 123                                 } else {
 124                                         len = snprintf(cur, left, ":%u ",
 125                                             rule->mbr_subject.mbs_uid_max);
 126                                         if (len < 0 || len > left)
 127                                                 goto truncated;
 128                                         left -= len;
 129                                         cur += len;
 130                                 }
 131                         } else {
 132                                 len = snprintf(cur, left, " ");
 133                                 if (len < 0 || len > left)
 134                                         goto truncated;
 135                                 left -= len;
 136                                 cur += len;
 137                         }
 138                 }
 139                 if (!notdone && (rule->mbr_subject.mbs_neg & MBO_GID_DEFINED)) {
 140                         len = snprintf(cur, left, "! ");
 141                         if (len < 0 || len > left)
 142                                 goto truncated;
 143                         left -= len;
 144                         cur += len;
 145                 }
 146                 if (rule->mbr_subject.mbs_flags & MBO_GID_DEFINED) {
 147                         grp = getgrgid(rule->mbr_subject.mbs_gid_min);
 148                         if (grp != NULL) {
 149                                 len = snprintf(cur, left, "gid %s",
 150                                     grp->gr_name);
 151                                 if (len < 0 || len > left)
 152                                         goto truncated;
 153                                 left -= len;
 154                                 cur += len;
 155                         } else {
 156                                 len = snprintf(cur, left, "gid %u",
 157                                     rule->mbr_subject.mbs_gid_min);
 158                                 if (len < 0 || len > left)
 159                                         goto truncated;
 160                                 left -= len;
 161                                 cur += len;
 162                         }
 163                         if (rule->mbr_subject.mbs_gid_min !=
 164                             rule->mbr_subject.mbs_gid_max) {
 165                                 grp = getgrgid(rule->mbr_subject.mbs_gid_max);
 166                                 if (grp != NULL) {
 167                                         len = snprintf(cur, left, ":%s ",
 168                                             grp->gr_name);
 169                                         if (len < 0 || len > left)
 170                                                 goto truncated;
 171                                         left -= len;
 172                                         cur += len;
 173                                 } else {
 174                                         len = snprintf(cur, left, ":%u ",
 175                                             rule->mbr_subject.mbs_gid_max);
 176                                         if (len < 0 || len > left)
 177                                                 goto truncated;
 178                                         left -= len;
 179                                         cur += len;
 180                                 }
 181                         } else {
 182                                 len = snprintf(cur, left, " ");
 183                                 if (len < 0 || len > left)
 184                                         goto truncated;
 185                                 left -= len;
 186                                 cur += len;
 187                         }
 188                 }
 189                 if (!notdone && (rule->mbr_subject.mbs_neg & MBS_PRISON_DEFINED)) {
 190                         len = snprintf(cur, left, "! ");
 191                         if (len < 0 || len > left)
 192                                 goto truncated;
 193                         left -= len;
 194                         cur += len;
 195                 }
 196                 if (rule->mbr_subject.mbs_flags & MBS_PRISON_DEFINED) {
 197                         len = snprintf(cur, left, "jailid %d ",
 198                             rule->mbr_subject.mbs_prison);
 199                         if (len < 0 || len > left)
 200                                 goto truncated;
 201                         left -= len;
 202                         cur += len;
 203                 }
 204         }
 205
 206         len = snprintf(cur, left, "object ");
 207         if (len < 0 || len > left)
 208                 goto truncated;
 209         left -= len;
 210         cur += len;
 211         if (rule->mbr_object.mbo_flags) {
 212                 if (rule->mbr_object.mbo_neg == MBO_ALL_FLAGS) {
 213                         len = snprintf(cur, left, "not ");
 214                         if (len < 0 || len > left)
 215                                 goto truncated;
 216                         left -= len;
 217                         cur += len;
 218                         notdone = 1;
 219                 } else {
 220                         notdone = 0;
 221                 }
 222
 223                 if (!notdone && (rule->mbr_object.mbo_neg & MBO_UID_DEFINED)) {
 224                         len = snprintf(cur, left, "! ");
 225                         if (len < 0 || len > left)
 226                                 goto truncated;
 227                         left -= len;
 228                         cur += len;
 229                 }
 230                 if (rule->mbr_object.mbo_flags & MBO_UID_DEFINED) {
 231                         pwd = getpwuid(rule->mbr_object.mbo_uid_min);
 232                         if (pwd != NULL) {
 233                                 len = snprintf(cur, left, "uid %s",
 234                                     pwd->pw_name);
 235                                 if (len < 0 || len > left)
 236                                         goto truncated;
 237                                 left -= len;
 238                                 cur += len;
 239                         } else {
 240                                 len = snprintf(cur, left, "uid %u",
 241                                     rule->mbr_object.mbo_uid_min);
 242                                 if (len < 0 || len > left)
 243                                         goto truncated;
 244                                 left -= len;
 245                                 cur += len;
 246                         }
 247                         if (rule->mbr_object.mbo_uid_min !=
 248                             rule->mbr_object.mbo_uid_max) {
 249                                 pwd = getpwuid(rule->mbr_object.mbo_uid_max);
 250                                 if (pwd != NULL) {
 251                                         len = snprintf(cur, left, ":%s ",
 252                                             pwd->pw_name);
 253                                         if (len < 0 || len > left)
 254                                                 goto truncated;
 255                                         left -= len;
 256                                         cur += len;
 257                                 } else {
 258                                         len = snprintf(cur, left, ":%u ",
 259                                             rule->mbr_object.mbo_uid_max);
 260                                         if (len < 0 || len > left)
 261                                                 goto truncated;
 262                                         left -= len;
 263                                         cur += len;
 264                                 }
 265                         } else {
 266                                 len = snprintf(cur, left, " ");
 267                                 if (len < 0 || len > left)
 268                                         goto truncated;
 269                                 left -= len;
 270                                 cur += len;
 271                         }
 272                 }
 273                 if (!notdone && (rule->mbr_object.mbo_neg & MBO_GID_DEFINED)) {
 274                         len = snprintf(cur, left, "! ");
 275                         if (len < 0 || len > left)
 276                                 goto truncated;
 277                         left -= len;
 278                         cur += len;
 279                 }
 280                 if (rule->mbr_object.mbo_flags & MBO_GID_DEFINED) {
 281                         grp = getgrgid(rule->mbr_object.mbo_gid_min);
 282                         if (grp != NULL) {
 283                                 len = snprintf(cur, left, "gid %s",
 284                                     grp->gr_name);
 285                                 if (len < 0 || len > left)
 286                                         goto truncated;
 287                                 left -= len;
 288                                 cur += len;
 289                         } else {
 290                                 len = snprintf(cur, left, "gid %u",
 291                                     rule->mbr_object.mbo_gid_min);
 292                                 if (len < 0 || len > left)
 293                                         goto truncated;
 294                                 left -= len;
 295                                 cur += len;
 296                         }
 297                         if (rule->mbr_object.mbo_gid_min !=
 298                             rule->mbr_object.mbo_gid_max) {
 299                                 grp = getgrgid(rule->mbr_object.mbo_gid_max);
 300                                 if (grp != NULL) {
 301                                         len = snprintf(cur, left, ":%s ",
 302                                             grp->gr_name);
 303                                         if (len < 0 || len > left)
 304                                                 goto truncated;
 305                                         left -= len;
 306                                         cur += len;
 307                                 } else {
 308                                         len = snprintf(cur, left, ":%u ",
 309                                             rule->mbr_object.mbo_gid_max);
 310                                         if (len < 0 || len > left)
 311                                                 goto truncated;
 312                                         left -= len;
 313                                         cur += len;
 314                                 }
 315                         } else {
 316                                 len = snprintf(cur, left, " ");
 317                                 if (len < 0 || len > left)
 318                                         goto truncated;
 319                                 left -= len;
 320                                 cur += len;
 321                         }
 322                 }
 323                 if (!notdone && (rule->mbr_object.mbo_neg & MBO_FSID_DEFINED)) {
 324                         len = snprintf(cur, left, "! ");
 325                         if (len < 0 || len > left)
 326                                 goto truncated;
 327                         left -= len;
 328                         cur += len;
 329                 }
 330                 if (rule->mbr_object.mbo_flags & MBO_FSID_DEFINED) {
 331                         numfs = getmntinfo(&mntbuf, MNT_NOWAIT);
 332                         for (i = 0; i < numfs; i++)
 333                                 if (memcmp(&(rule->mbr_object.mbo_fsid),
 334                                     &(mntbuf[i].f_fsid),
 335                                     sizeof(mntbuf[i].f_fsid)) == 0)
 336                                         break;
 337                         len = snprintf(cur, left, "filesys %s ",
 338                             i == numfs ? "???" : mntbuf[i].f_mntonname);
 339                         if (len < 0 || len > left)
 340                                 goto truncated;
 341                         left -= len;
 342                         cur += len;
 343                 }
 344                 if (!notdone && (rule->mbr_object.mbo_neg & MBO_SUID)) {
 345                         len = snprintf(cur, left, "! ");
 346                         if (len < 0 || len > left)
 347                                 goto truncated;
 348                         left -= len;
 349                         cur += len;
 350                 }
 351                 if (rule->mbr_object.mbo_flags & MBO_SUID) {
 352                         len = snprintf(cur, left, "suid ");
 353                         if (len < 0 || len > left)
 354                                 goto truncated;
 355                         left -= len;
 356                         cur += len;
 357                 }
 358                 if (!notdone && (rule->mbr_object.mbo_neg & MBO_SGID)) {
 359                         len = snprintf(cur, left, "! ");
 360                         if (len < 0 || len > left)
 361                                 goto truncated;
 362                         left -= len;
 363                         cur += len;
 364                 }
 365                 if (rule->mbr_object.mbo_flags & MBO_SGID) {
 366                         len = snprintf(cur, left, "sgid ");
 367                         if (len < 0 || len > left)
 368                                 goto truncated;
 369                         left -= len;
 370                         cur += len;
 371                 }
 372                 if (!notdone && (rule->mbr_object.mbo_neg & MBO_UID_SUBJECT)) {
 373                         len = snprintf(cur, left, "! ");
 374                         if (len < 0 || len > left)
 375                                 goto truncated;
 376                         left -= len;
 377                         cur += len;
 378                 }
 379                 if (rule->mbr_object.mbo_flags & MBO_UID_SUBJECT) {
 380                         len = snprintf(cur, left, "uid_of_subject ");
 381                         if (len < 0 || len > left)
 382                                 goto truncated;
 383                         left -= len;
 384                         cur += len;
 385                 }
 386                 if (!notdone && (rule->mbr_object.mbo_neg & MBO_GID_SUBJECT)) {
 387                         len = snprintf(cur, left, "! ");
 388                         if (len < 0 || len > left)
 389                                 goto truncated;
 390                         left -= len;
 391                         cur += len;
 392                 }
 393                 if (rule->mbr_object.mbo_flags & MBO_GID_SUBJECT) {
 394                         len = snprintf(cur, left, "gid_of_subject ");
 395                         if (len < 0 || len > left)
 396                                 goto truncated;
 397                         left -= len;
 398                         cur += len;
 399                 }
 400                 if (!notdone && (rule->mbr_object.mbo_neg & MBO_TYPE_DEFINED)) {
 401                         len = snprintf(cur, left, "! ");
 402                         if (len < 0 || len > left)
 403                                 goto truncated;
 404                         left -= len;
 405                         cur += len;
 406                 }
 407                 if (rule->mbr_object.mbo_flags & MBO_TYPE_DEFINED) {
 408                         i = 0;
 409                         if (rule->mbr_object.mbo_type & MBO_TYPE_REG)
 410                                 type[i++] = 'r';
 411                         if (rule->mbr_object.mbo_type & MBO_TYPE_DIR)
 412                                 type[i++] = 'd';
 413                         if (rule->mbr_object.mbo_type & MBO_TYPE_BLK)
 414                                 type[i++] = 'b';
 415                         if (rule->mbr_object.mbo_type & MBO_TYPE_CHR)
 416                                 type[i++] = 'c';
 417                         if (rule->mbr_object.mbo_type & MBO_TYPE_LNK)
 418                                 type[i++] = 'l';
 419                         if (rule->mbr_object.mbo_type & MBO_TYPE_SOCK)
 420                                 type[i++] = 's';
 421                         if (rule->mbr_object.mbo_type & MBO_TYPE_FIFO)
 422                                 type[i++] = 'p';
 423                         if (rule->mbr_object.mbo_type == MBO_ALL_TYPE) {
 424                                 i = 0;
 425                                 type[i++] = 'a';
 426                         }
 427                         type[i++] = '\0';
 428                         len = snprintf(cur, left, "type %s ", type);
 429                         if (len < 0 || len > left)
 430                                 goto truncated;
 431                         left -= len;
 432                         cur += len;
 433                 }
 434         }
 435
 436         len = snprintf(cur, left, "mode ");
 437         if (len < 0 || len > left)
 438                 goto truncated;
 439         left -= len;
 440         cur += len;
 441
 442         anymode = (rule->mbr_mode & MBI_ALLPERM);
 443         unknownmode = (rule->mbr_mode & ~MBI_ALLPERM);
 444
 445         if (rule->mbr_mode & MBI_ADMIN) {
 446                 len = snprintf(cur, left, "a");
 447                 if (len < 0 || len > left)
 448                         goto truncated;
 449
 450                 left -= len;
 451                 cur += len;
 452         }
 453         if (rule->mbr_mode & MBI_READ) {
 454                 len = snprintf(cur, left, "r");
 455                 if (len < 0 || len > left)
 456                         goto truncated;
 457
 458                 left -= len;
 459                 cur += len;
 460         }
 461         if (rule->mbr_mode & MBI_STAT) {
 462                 len = snprintf(cur, left, "s");
 463                 if (len < 0 || len > left)
 464                         goto truncated;
 465
 466                 left -= len;
 467                 cur += len;
 468         }
 469         if (rule->mbr_mode & MBI_WRITE) {
 470                 len = snprintf(cur, left, "w");
 471                 if (len < 0 || len > left)
 472                         goto truncated;
 473
 474                 left -= len;
 475                 cur += len;
 476         }
 477         if (rule->mbr_mode & MBI_EXEC) {
 478                 len = snprintf(cur, left, "x");
 479                 if (len < 0 || len > left)
 480                         goto truncated;
 481
 482                 left -= len;
 483                 cur += len;
 484         }
 485         if (!anymode) {
 486                 len = snprintf(cur, left, "n");
 487                 if (len < 0 || len > left)
 488                         goto truncated;
 489
 490                 left -= len;
 491                 cur += len;
 492         }
 493         if (unknownmode) {
 494                 len = snprintf(cur, left, "?");
 495                 if (len < 0 || len > left)
 496                         goto truncated;
 497
 498                 left -= len;
 499                 cur += len;
 500         }
 501
 502         return (0);
 503
 504 truncated:
 505         return (-1);
 506 }
 507
 508 static int
 509 bsde_parse_uidrange(char *spec, uid_t *min, uid_t *max,
 510     size_t buflen, char *errstr){
 511         struct passwd *pwd;
 512         uid_t uid1, uid2;
 513         char *spec1, *spec2, *endp;
 514         unsigned long value;
 515
 516         spec2 = spec;
 517         spec1 = strsep(&spec2, ":");
 518
 519         pwd = getpwnam(spec1);
 520         if (pwd != NULL)
 521                 uid1 = pwd->pw_uid;
 522         else {
 523                 value = strtoul(spec1, &endp, 10);
 524                 if (*endp != '\0') {
 525                         snprintf(errstr, buflen, "invalid uid: '%s'", spec1);
 526                         return (-1);
 527                 }
 528                 uid1 = value;
 529         }
 530
 531         if (spec2 == NULL) {
 532                 *max = *min = uid1;
 533                 return (0);
 534         }
 535
 536         pwd = getpwnam(spec2);
 537         if (pwd != NULL)
 538                 uid2 = pwd->pw_uid;
 539         else {
 540                 value = strtoul(spec2, &endp, 10);
 541                 if (*endp != '\0') {
 542                         snprintf(errstr, buflen, "invalid uid: '%s'", spec2);
 543                         return (-1);
 544                 }
 545                 uid2 = value;
 546         }
 547
 548         *min = uid1;
 549         *max = uid2;
 550
 551         return (0);
 552 }
 553
 554 static int
 555 bsde_parse_gidrange(char *spec, gid_t *min, gid_t *max,
 556     size_t buflen, char *errstr){
 557         struct group *grp;
 558         gid_t gid1, gid2;
 559         char *spec1, *spec2, *endp;
 560         unsigned long value;
 561
 562         spec2 = spec;
 563         spec1 = strsep(&spec2, ":");
 564
 565         grp = getgrnam(spec1);
 566         if (grp != NULL)
 567                 gid1 = grp->gr_gid;
 568         else {
 569                 value = strtoul(spec1, &endp, 10);
 570                 if (*endp != '\0') {
 571                         snprintf(errstr, buflen, "invalid gid: '%s'", spec1);
 572                         return (-1);
 573                 }
 574                 gid1 = value;
 575         }
 576
 577         if (spec2 == NULL) {
 578                 *max = *min = gid1;
 579                 return (0);
 580         }
 581
 582         grp = getgrnam(spec2);
 583         if (grp != NULL)
 584                 gid2 = grp->gr_gid;
 585         else {
 586                 value = strtoul(spec2, &endp, 10);
 587                 if (*endp != '\0') {
 588                         snprintf(errstr, buflen, "invalid gid: '%s'", spec2);
 589                         return (-1);
 590                 }
 591                 gid2 = value;
 592         }
 593
 594         *min = gid1;
 595         *max = gid2;
 596
 597         return (0);
 598 }
 599
 600 static int
 601 bsde_parse_subject(int argc, char *argv[],
 602     struct mac_bsdextended_subject *subject, size_t buflen, char *errstr)
 603 {
 604         int not_seen, flags;
 605         int current, neg, nextnot;
 606         char *endp;
 607         uid_t uid_min, uid_max;
 608         gid_t gid_min, gid_max;
 609         int jid = 0;
 610         long value;
 611
 612         current = 0;
 613         flags = 0;
 614         neg = 0;
 615         nextnot = 0;
 616
 617         if (strcmp("not", argv[current]) == 0) {
 618                 not_seen = 1;
 619                 current++;
 620         } else
 621                 not_seen = 0;
 622
 623         while (current < argc) {
 624                 if (strcmp(argv[current], "uid") == 0) {
 625                         if (current + 2 > argc) {
 626                                 snprintf(errstr, buflen, "uid short");
 627                                 return (-1);
 628                         }
 629                         if (flags & MBS_UID_DEFINED) {
 630                                 snprintf(errstr, buflen, "one uid only");
 631                                 return (-1);
 632                         }
 633                         if (bsde_parse_uidrange(argv[current+1],
 634                             &uid_min, &uid_max, buflen, errstr) < 0)
 635                                 return (-1);
 636                         flags |= MBS_UID_DEFINED;
 637                         if (nextnot) {
 638                                 neg ^= MBS_UID_DEFINED;
 639                                 nextnot = 0;
 640                         }
 641                         current += 2;
 642                 } else if (strcmp(argv[current], "gid") == 0) {
 643                         if (current + 2 > argc) {
 644                                 snprintf(errstr, buflen, "gid short");
 645                                 return (-1);
 646                         }
 647                         if (flags & MBS_GID_DEFINED) {
 648                                 snprintf(errstr, buflen, "one gid only");
 649                                 return (-1);
 650                         }
 651                         if (bsde_parse_gidrange(argv[current+1],
 652                             &gid_min, &gid_max, buflen, errstr) < 0)
 653                                 return (-1);
 654                         flags |= MBS_GID_DEFINED;
 655                         if (nextnot) {
 656                                 neg ^= MBS_GID_DEFINED;
 657                                 nextnot = 0;
 658                         }
 659                         current += 2;
 660                 } else if (strcmp(argv[current], "jailid") == 0) {
 661                         if (current + 2 > argc) {
 662                                 snprintf(errstr, buflen, "prison short");
 663                                 return (-1);
 664                         }
 665                         if (flags & MBS_PRISON_DEFINED) {
 666                                 snprintf(errstr, buflen, "one jail only");
 667                                 return (-1);
 668                         }
 669                         value = strtol(argv[current+1], &endp, 10);
 670                         if (*endp != '\0') {
 671                                 snprintf(errstr, buflen, "invalid jid: '%s'",
 672                                     argv[current+1]);
 673                                 return (-1);
 674                         }
 675                         jid = value;
 676                         flags |= MBS_PRISON_DEFINED;
 677                         if (nextnot) {
 678                                 neg ^= MBS_PRISON_DEFINED;
 679                                 nextnot = 0;
 680                         }
 681                         current += 2;
 682                 } else if (strcmp(argv[current], "!") == 0) {
 683                         if (nextnot) {
 684                                 snprintf(errstr, buflen, "double negative");
 685                                 return (-1);
 686                         }
 687                         nextnot = 1;
 688                         current += 1;
 689                 } else {
 690                         snprintf(errstr, buflen, "'%s' not expected",
 691                             argv[current]);
 692                         return (-1);
 693                 }
 694         }
 695
 696         subject->mbs_flags = flags;
 697         if (not_seen)
 698                 subject->mbs_neg = MBS_ALL_FLAGS ^ neg;
 699         else
 700                 subject->mbs_neg = neg;
 701         if (flags & MBS_UID_DEFINED) {
 702                 subject->mbs_uid_min = uid_min;
 703                 subject->mbs_uid_max = uid_max;
 704         }
 705         if (flags & MBS_GID_DEFINED) {
 706                 subject->mbs_gid_min = gid_min;
 707                 subject->mbs_gid_max = gid_max;
 708         }
 709         if (flags & MBS_PRISON_DEFINED)
 710                 subject->mbs_prison = jid;
 711
 712         return (0);
 713 }
 714
 715 static int
 716 bsde_parse_type(char *spec, int *type, size_t buflen, char *errstr)
 717 {
 718         int i;
 719
 720         *type = 0;
 721         for (i = 0; i < strlen(spec); i++) {
 722                 switch (spec[i]) {
 723                 case 'r':
 724                 case '-':
 725                         *type |= MBO_TYPE_REG;
 726                         break;
 727                 case 'd':
 728                         *type |= MBO_TYPE_DIR;
 729                         break;
 730                 case 'b':
 731                         *type |= MBO_TYPE_BLK;
 732                         break;
 733                 case 'c':
 734                         *type |= MBO_TYPE_CHR;
 735                         break;
 736                 case 'l':
 737                         *type |= MBO_TYPE_LNK;
 738                         break;
 739                 case 's':
 740                         *type |= MBO_TYPE_SOCK;
 741                         break;
 742                 case 'p':
 743                         *type |= MBO_TYPE_FIFO;
 744                         break;
 745                 case 'a':
 746                         *type |= MBO_ALL_TYPE;
 747                         break;
 748                 default:
 749                         snprintf(errstr, buflen, "Unknown type code: %c",
 750                             spec[i]);
 751                         return (-1);
 752                 }
 753         }
 754
 755         return (0);
 756 }
 757
 758 static int
 759 bsde_parse_fsid(char *spec, struct fsid *fsid, size_t buflen, char *errstr)
 760 {
 761         struct statfs buf;
 762
 763         if (statfs(spec, &buf) < 0) {
 764                 snprintf(errstr, buflen, "Unable to get id for %s: %s",
 765                     spec, strerror(errno));
 766                 return (-1);
 767         }
 768
 769         *fsid = buf.f_fsid;
 770
 771         return (0);
 772 }
 773
 774 static int
 775 bsde_parse_object(int argc, char *argv[],
 776     struct mac_bsdextended_object *object, size_t buflen, char *errstr)
 777 {
 778         int not_seen, flags;
 779         int current, neg, nextnot;
 780         int type;
 781         uid_t uid_min, uid_max;
 782         gid_t gid_min, gid_max;
 783         struct fsid fsid;
 784
 785         current = 0;
 786         flags = 0;
 787         neg = 0;
 788         nextnot = 0;
 789         type = 0;
 790
 791         if (strcmp("not", argv[current]) == 0) {
 792                 not_seen = 1;
 793                 current++;
 794         } else
 795                 not_seen = 0;
 796
 797         while (current < argc) {
 798                 if (strcmp(argv[current], "uid") == 0) {
 799                         if (current + 2 > argc) {
 800                                 snprintf(errstr, buflen, "uid short");
 801                                 return (-1);
 802                         }
 803                         if (flags & MBO_UID_DEFINED) {
 804                                 snprintf(errstr, buflen, "one uid only");
 805                                 return (-1);
 806                         }
 807                         if (bsde_parse_uidrange(argv[current+1],
 808                             &uid_min, &uid_max, buflen, errstr) < 0)
 809                                 return (-1);
 810                         flags |= MBO_UID_DEFINED;
 811                         if (nextnot) {
 812                                 neg ^= MBO_UID_DEFINED;
 813                                 nextnot = 0;
 814                         }
 815                         current += 2;
 816                 } else if (strcmp(argv[current], "gid") == 0) {
 817                         if (current + 2 > argc) {
 818                                 snprintf(errstr, buflen, "gid short");
 819                                 return (-1);
 820                         }
 821                         if (flags & MBO_GID_DEFINED) {
 822                                 snprintf(errstr, buflen, "one gid only");
 823                                 return (-1);
 824                         }
 825                         if (bsde_parse_gidrange(argv[current+1],
 826                             &gid_min, &gid_max, buflen, errstr) < 0)
 827                                 return (-1);
 828                         flags |= MBO_GID_DEFINED;
 829                         if (nextnot) {
 830                                 neg ^= MBO_GID_DEFINED;
 831                                 nextnot = 0;
 832                         }
 833                         current += 2;
 834                 } else if (strcmp(argv[current], "filesys") == 0) {
 835                         if (current + 2 > argc) {
 836                                 snprintf(errstr, buflen, "filesys short");
 837                                 return (-1);
 838                         }
 839                         if (flags & MBO_FSID_DEFINED) {
 840                                 snprintf(errstr, buflen, "one fsid only");
 841                                 return (-1);
 842                         }
 843                         if (bsde_parse_fsid(argv[current+1], &fsid,
 844                             buflen, errstr) < 0)
 845                                 return (-1);
 846                         flags |= MBO_FSID_DEFINED;
 847                         if (nextnot) {
 848                                 neg ^= MBO_FSID_DEFINED;
 849                                 nextnot = 0;
 850                         }
 851                         current += 2;
 852                 } else if (strcmp(argv[current], "suid") == 0) {
 853                         flags |= MBO_SUID;
 854                         if (nextnot) {
 855                                 neg ^= MBO_SUID;
 856                                 nextnot = 0;
 857                         }
 858                         current += 1;
 859                 } else if (strcmp(argv[current], "sgid") == 0) {
 860                         flags |= MBO_SGID;
 861                         if (nextnot) {
 862                                 neg ^= MBO_SGID;
 863                                 nextnot = 0;
 864                         }
 865                         current += 1;
 866                 } else if (strcmp(argv[current], "uid_of_subject") == 0) {
 867                         flags |= MBO_UID_SUBJECT;
 868                         if (nextnot) {
 869                                 neg ^= MBO_UID_SUBJECT;
 870                                 nextnot = 0;
 871                         }
 872                         current += 1;
 873                 } else if (strcmp(argv[current], "gid_of_subject") == 0) {
 874                         flags |= MBO_GID_SUBJECT;
 875                         if (nextnot) {
 876                                 neg ^= MBO_GID_SUBJECT;
 877                                 nextnot = 0;
 878                         }
 879                         current += 1;
 880                 } else if (strcmp(argv[current], "type") == 0) {
 881                         if (current + 2 > argc) {
 882                                 snprintf(errstr, buflen, "type short");
 883                                 return (-1);
 884                         }
 885                         if (flags & MBO_TYPE_DEFINED) {
 886                                 snprintf(errstr, buflen, "one type only");
 887                                 return (-1);
 888                         }
 889                         if (bsde_parse_type(argv[current+1], &type,
 890                             buflen, errstr) < 0)
 891                                 return (-1);
 892                         flags |= MBO_TYPE_DEFINED;
 893                         if (nextnot) {
 894                                 neg ^= MBO_TYPE_DEFINED;
 895                                 nextnot = 0;
 896                         }
 897                         current += 2;
 898                 } else if (strcmp(argv[current], "!") == 0) {
 899                         if (nextnot) {
 900                                 snprintf(errstr, buflen,
 901                                     "double negative'");
 902                                 return (-1);
 903                         }
 904                         nextnot = 1;
 905                         current += 1;
 906                 } else {
 907                         snprintf(errstr, buflen, "'%s' not expected",
 908                             argv[current]);
 909                         return (-1);
 910                 }
 911         }
 912
 913         object->mbo_flags = flags;
 914         if (not_seen)
 915                 object->mbo_neg = MBO_ALL_FLAGS ^ neg;
 916         else
 917                 object->mbo_neg = neg;
 918         if (flags & MBO_UID_DEFINED) {
 919                 object->mbo_uid_min = uid_min;
 920                 object->mbo_uid_max = uid_max;
 921         }
 922         if (flags & MBO_GID_DEFINED) {
 923                 object->mbo_gid_min = gid_min;
 924                 object->mbo_gid_max = gid_max;
 925         }
 926         if (flags & MBO_FSID_DEFINED)
 927                 object->mbo_fsid = fsid;
 928         if (flags & MBO_TYPE_DEFINED)
 929                 object->mbo_type = type;
 930
 931         return (0);
 932 }
 933
 934 int
 935 bsde_parse_mode(int argc, char *argv[], mode_t *mode, size_t buflen,
 936     char *errstr)
 937 {
 938         int i;
 939
 940         if (argc == 0) {
 941                 snprintf(errstr, buflen, "mode expects mode value");
 942                 return (-1);
 943         }
 944
 945         if (argc != 1) {
 946                 snprintf(errstr, buflen, "'%s' unexpected", argv[1]);
 947                 return (-1);
 948         }
 949
 950         *mode = 0;
 951         for (i = 0; i < strlen(argv[0]); i++) {
 952                 switch (argv[0][i]) {
 953                 case 'a':
 954                         *mode |= MBI_ADMIN;
 955                         break;
 956                 case 'r':
 957                         *mode |= MBI_READ;
 958                         break;
 959                 case 's':
 960                         *mode |= MBI_STAT;
 961                         break;
 962                 case 'w':
 963                         *mode |= MBI_WRITE;
 964                         break;
 965                 case 'x':
 966                         *mode |= MBI_EXEC;
 967                         break;
 968                 case 'n':
 969                         /* ignore */
 970                         break;
 971                 default:
 972                         snprintf(errstr, buflen, "Unknown mode letter: %c",
 973                             argv[0][i]);
 974                         return (-1);
 975                 }
 976         }
 977
 978         return (0);
 979 }
 980
 981 int
 982 bsde_parse_rule(int argc, char *argv[], struct mac_bsdextended_rule *rule,
 983     size_t buflen, char *errstr)
 984 {
 985         int subject, subject_elements, subject_elements_length;
 986         int object, object_elements, object_elements_length;
 987         int mode, mode_elements, mode_elements_length;
 988         int error, i;
 989
 990         bzero(rule, sizeof(*rule));
 991
 992         if (argc < 1) {
 993                 snprintf(errstr, buflen, "Rule must begin with subject");
 994                 return (-1);
 995         }
 996
 997         if (strcmp(argv[0], "subject") != 0) {
 998                 snprintf(errstr, buflen, "Rule must begin with subject");
 999                 return (-1);
1000         }
1001         subject = 0;
1002         subject_elements = 1;
1003
1004         /* Search forward for object. */
1005
1006         object = -1;
1007         for (i = 1; i < argc; i++)
1008                 if (strcmp(argv[i], "object") == 0)
1009                         object = i;
1010
1011         if (object == -1) {
1012                 snprintf(errstr, buflen, "Rule must contain an object");
1013                 return (-1);
1014         }
1015
1016         /* Search forward for mode. */
1017         mode = -1;
1018         for (i = object; i < argc; i++)
1019                 if (strcmp(argv[i], "mode") == 0)
1020                         mode = i;
1021
1022         if (mode == -1) {
1023                 snprintf(errstr, buflen, "Rule must contain mode");
1024                 return (-1);
1025         }
1026
1027         subject_elements_length = object - subject - 1;
1028         object_elements = object + 1;
1029         object_elements_length = mode - object_elements;
1030         mode_elements = mode + 1;
1031         mode_elements_length = argc - mode_elements;
1032
1033         error = bsde_parse_subject(subject_elements_length,
1034             argv + subject_elements, &rule->mbr_subject, buflen, errstr);
1035         if (error)
1036                 return (-1);
1037
1038         error = bsde_parse_object(object_elements_length,
1039             argv + object_elements, &rule->mbr_object, buflen, errstr);
1040         if (error)
1041                 return (-1);
1042
1043         error = bsde_parse_mode(mode_elements_length, argv + mode_elements,
1044             &rule->mbr_mode, buflen, errstr);
1045         if (error)
1046                 return (-1);
1047
1048         return (0);
1049 }
1050
1051 int
1052 bsde_parse_rule_string(const char *string, struct mac_bsdextended_rule *rule,
1053     size_t buflen, char *errstr)
1054 {
1055         char *stringdup, *stringp, *argv[100], **ap;
1056         int argc, error;
1057
1058         stringp = stringdup = strdup(string);
1059         while (*stringp == ' ' || *stringp == '\t')
1060                 stringp++;
1061
1062         argc = 0;
1063         for (ap = argv; (*ap = strsep(&stringp, " \t")) != NULL;) {
1064                 argc++;
1065                 if (**ap != '\0')
1066                         if (++ap >= &argv[100])
1067                                 break;
1068         }
1069
1070         error = bsde_parse_rule(argc, argv, rule, buflen, errstr);
1071
1072         free(stringdup);
1073
1074         return (error);
1075 }
1076
1077 int
1078 bsde_get_mib(const char *string, int *name, size_t *namelen)
1079 {
1080         size_t len;
1081         int error;
1082
1083         len = *namelen;
1084         error = sysctlnametomib(string, name, &len);
1085         if (error)
1086                 return (error);
1087
1088         *namelen = len;
1089         return (0);
1090 }
1091
1092 static int
1093 bsde_check_version(size_t buflen, char *errstr)
1094 {
1095         size_t len;
1096         int error;
1097         int version;
1098
1099         len = sizeof(version);
1100         error = sysctlbyname(MIB ".rule_version", &version, &len, NULL, 0);
1101         if (error) {
1102                 snprintf(errstr, buflen, "version check failed: %s",
1103                     strerror(errno));
1104                 return (-1);
1105         }
1106         if (version != MB_VERSION) {
1107                 snprintf(errstr, buflen, "module v%d != library v%d",
1108                     version, MB_VERSION);
1109                 return (-1);
1110         }
1111         return (0);
1112 }
1113
1114 int
1115 bsde_get_rule_count(size_t buflen, char *errstr)
1116 {
1117         size_t len;
1118         int error;
1119         int rule_count;
1120
1121         len = sizeof(rule_count);
1122         error = sysctlbyname(MIB ".rule_count", &rule_count, &len, NULL, 0);
1123         if (error) {
1124                 snprintf(errstr, buflen, "%s", strerror(errno));
1125                 return (-1);
1126         }
1127         if (len != sizeof(rule_count)) {
1128                 snprintf(errstr, buflen, "Data error in %s.rule_count",
1129                     MIB);
1130                 return (-1);
1131         }
1132
1133         return (rule_count);
1134 }
1135
1136 int
1137 bsde_get_rule_slots(size_t buflen, char *errstr)
1138 {
1139         size_t len;
1140         int error;
1141         int rule_slots;
1142
1143         len = sizeof(rule_slots);
1144         error = sysctlbyname(MIB ".rule_slots", &rule_slots, &len, NULL, 0);
1145         if (error) {
1146                 snprintf(errstr, buflen, "%s", strerror(errno));
1147                 return (-1);
1148         }
1149         if (len != sizeof(rule_slots)) {
1150                 snprintf(errstr, buflen, "Data error in %s.rule_slots", MIB);
1151                 return (-1);
1152         }
1153
1154         return (rule_slots);
1155 }
1156
1157 /*
1158  * Returns 0 for success;
1159  * Returns -1 for failure;
1160  * Returns -2 for not present
1161  */
1162 int
1163 bsde_get_rule(int rulenum, struct mac_bsdextended_rule *rule, size_t errlen,
1164     char *errstr)
1165 {
1166         int name[10];
1167         size_t len, size;
1168         int error;
1169
1170         if (bsde_check_version(errlen, errstr) != 0)
1171                 return (-1);
1172
1173         len = 10;
1174         error = bsde_get_mib(MIB ".rules", name, &len);
1175         if (error) {
1176                 snprintf(errstr, errlen, "%s: %s", MIB ".rules",
1177                     strerror(errno));
1178                 return (-1);
1179         }
1180
1181         size = sizeof(*rule);
1182         name[len] = rulenum;
1183         len++;
1184         error = sysctl(name, len, rule, &size, NULL, 0);
1185         if (error  == -1 && errno == ENOENT)
1186                 return (-2);
1187         if (error) {
1188                 snprintf(errstr, errlen, "%s.%d: %s", MIB ".rules",
1189                     rulenum, strerror(errno));
1190                 return (-1);
1191         } else if (size != sizeof(*rule)) {
1192                 snprintf(errstr, errlen, "Data error in %s.%d: %s",
1193                     MIB ".rules", rulenum, strerror(errno));
1194                 return (-1);
1195         }
1196
1197         return (0);
1198 }
1199
1200 int
1201 bsde_delete_rule(int rulenum, size_t buflen, char *errstr)
1202 {
1203         struct mac_bsdextended_rule rule;
1204         int name[10];
1205         size_t len;
1206         int error;
1207
1208         if (bsde_check_version(buflen, errstr) != 0)
1209                 return (-1);
1210
1211         len = 10;
1212         error = bsde_get_mib(MIB ".rules", name, &len);
1213         if (error) {
1214                 snprintf(errstr, buflen, "%s: %s", MIB ".rules",
1215                     strerror(errno));
1216                 return (-1);
1217         }
1218
1219         name[len] = rulenum;
1220         len++;
1221
1222         error = sysctl(name, len, NULL, NULL, &rule, 0);
1223         if (error) {
1224                 snprintf(errstr, buflen, "%s.%d: %s", MIB ".rules",
1225                     rulenum, strerror(errno));
1226                 return (-1);
1227         }
1228
1229         return (0);
1230 }
1231
1232 int
1233 bsde_set_rule(int rulenum, struct mac_bsdextended_rule *rule, size_t buflen,
1234     char *errstr)
1235 {
1236         int name[10];
1237         size_t len;
1238         int error;
1239
1240         if (bsde_check_version(buflen, errstr) != 0)
1241                 return (-1);
1242
1243         len = 10;
1244         error = bsde_get_mib(MIB ".rules", name, &len);
1245         if (error) {
1246                 snprintf(errstr, buflen, "%s: %s", MIB ".rules",
1247                     strerror(errno));
1248                 return (-1);
1249         }
1250
1251         name[len] = rulenum;
1252         len++;
1253
1254         error = sysctl(name, len, NULL, NULL, rule, sizeof(*rule));
1255         if (error) {
1256                 snprintf(errstr, buflen, "%s.%d: %s", MIB ".rules",
1257                     rulenum, strerror(errno));
1258                 return (-1);
1259         }
1260
1261         return (0);
1262 }
1263
1264 int
1265 bsde_add_rule(int *rulenum, struct mac_bsdextended_rule *rule, size_t buflen,
1266     char *errstr)
1267 {
1268         char charstr[BUFSIZ];
1269         int name[10];
1270         size_t len;
1271         int error, rule_slots;
1272
1273         if (bsde_check_version(buflen, errstr) != 0)
1274                 return (-1);
1275
1276         len = 10;
1277         error = bsde_get_mib(MIB ".rules", name, &len);
1278         if (error) {
1279                 snprintf(errstr, buflen, "%s: %s", MIB ".rules",
1280                     strerror(errno));
1281                 return (-1);
1282         }
1283
1284         rule_slots = bsde_get_rule_slots(BUFSIZ, charstr);
1285         if (rule_slots == -1) {
1286                 snprintf(errstr, buflen, "unable to get rule slots: %s",
1287                     strerror(errno));
1288                 return (-1);
1289         }
1290
1291         name[len] = rule_slots;
1292         len++;
1293
1294         error = sysctl(name, len, NULL, NULL, rule, sizeof(*rule));
1295         if (error) {
1296                 snprintf(errstr, buflen, "%s.%d: %s", MIB ".rules",
1297                     rule_slots, strerror(errno));
1298                 return (-1);
1299         }
1300
1301         if (rulenum != NULL)
1302                 *rulenum = rule_slots;
1303
1304         return (0);
1305 }