sys/security/mac/mac_internal.h

   1 /*-
   2  * Copyright (c) 1999-2002, 2006 Robert N. M. Watson
   3  * Copyright (c) 2001 Ilmar S. Habibulin
   4  * Copyright (c) 2001-2004 Networks Associates Technology, Inc.
   5  * Copyright (c) 2006 nCircle Network Security, Inc.
   6  * Copyright (c) 2006 SPARTA, Inc.
   7  * All rights reserved.
   8  *
   9  * This software was developed by Robert Watson and Ilmar Habibulin for the
  10  * TrustedBSD Project.
  11  *
  12  * This software was developed for the FreeBSD Project in part by Network
  13  * Associates Laboratories, the Security Research Division of Network
  14  * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"),
  15  * as part of the DARPA CHATS research program.
  16  *
  17  * This software was developed by Robert N. M. Watson for the TrustedBSD
  18  * Project under contract to nCircle Network Security, Inc.
  19  *
  20  * This software was enhanced by SPARTA ISSO under SPAWAR contract
  21  * N66001-04-C-6019 ("SEFOS").
  22  *
  23  * Redistribution and use in source and binary forms, with or without
  24  * modification, are permitted provided that the following conditions
  25  * are met:
  26  * 1. Redistributions of source code must retain the above copyright
  27  *    notice, this list of conditions and the following disclaimer.
  28  * 2. Redistributions in binary form must reproduce the above copyright
  29  *    notice, this list of conditions and the following disclaimer in the
  30  *    documentation and/or other materials provided with the distribution.
  31  *
  32  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  33  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  34  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  35  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  36  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  37  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  38  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  39  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  40  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  41  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  42  * SUCH DAMAGE.
  43  *
  44  * $FreeBSD$
  45  */
  46
  47 #ifndef _SECURITY_MAC_MAC_INTERNAL_H_
  48 #define _SECURITY_MAC_MAC_INTERNAL_H_
  49
  50 #ifndef _KERNEL
  51 #error "no user-serviceable parts inside"
  52 #endif
  53
  54 /*
  55  * MAC Framework sysctl namespace.
  56  */
  57 #ifdef SYSCTL_DECL
  58 SYSCTL_DECL(_security_mac);
  59 #endif /* SYSCTL_DECL */
  60
  61 /*
  62  * MAC Framework global types and typedefs.
  63  */
  64 LIST_HEAD(mac_policy_list_head, mac_policy_conf);
  65 #ifdef MALLOC_DECLARE
  66 MALLOC_DECLARE(M_MACTEMP);
  67 #endif
  68
  69 /*
  70  * MAC labels -- in-kernel storage format.
  71  *
  72  * In general, struct label pointers are embedded in kernel data structures
  73  * representing objects that may be labeled (and protected).  Struct label is
  74  * opaque to both kernel services that invoke the MAC Framework and MAC
  75  * policy modules.  In particular, we do not wish to encode the layout of the
  76  * label structure into any ABIs.  Historically, the slot array contained
  77  * unions of {long, void} but now contains uintptr_t.
  78  */
  79 #define MAC_MAX_SLOTS   4
  80 #define MAC_FLAG_INITIALIZED    0x0000001       /* Is initialized for use. */
  81 struct label {
  82         int             l_flags;
  83         intptr_t        l_perpolicy[MAC_MAX_SLOTS];
  84 };
  85
  86 /*
  87  * MAC Framework global variables.
  88  */
  89 extern struct mac_policy_list_head      mac_policy_list;
  90 extern struct mac_policy_list_head      mac_static_policy_list;
  91 extern uint64_t                         mac_labeled;
  92 extern struct mtx                       mac_ifnet_mtx;
  93
  94 /*
  95  * MAC Framework infrastructure functions.
  96  */
  97 int     mac_error_select(int error1, int error2);
  98
  99 void    mac_policy_grab_exclusive(void);
 100 void    mac_policy_assert_exclusive(void);
 101 void    mac_policy_release_exclusive(void);
 102 void    mac_policy_list_busy(void);
 103 int     mac_policy_list_conditional_busy(void);
 104 void    mac_policy_list_unbusy(void);
 105
 106 struct label    *mac_labelzone_alloc(int flags);
 107 void             mac_labelzone_free(struct label *label);
 108 void             mac_labelzone_init(void);
 109
 110 void    mac_init_label(struct label *label);
 111 void    mac_destroy_label(struct label *label);
 112 int     mac_check_structmac_consistent(struct mac *mac);
 113 int     mac_allocate_slot(void);
 114
 115 #define MAC_IFNET_LOCK(ifp)     mtx_lock(&mac_ifnet_mtx)
 116 #define MAC_IFNET_UNLOCK(ifp)   mtx_unlock(&mac_ifnet_mtx)
 117
 118 /*
 119  * MAC Framework per-object type functions.  It's not yet clear how the
 120  * namespaces, etc, should work for these, so for now, sort by object type.
 121  */
 122 struct label    *mac_cred_label_alloc(void);
 123 void             mac_cred_label_free(struct label *label);
 124 struct label    *mac_pipe_label_alloc(void);
 125 void             mac_pipe_label_free(struct label *label);
 126 struct label    *mac_socket_label_alloc(int flag);
 127 void             mac_socket_label_free(struct label *label);
 128 struct label    *mac_vnode_label_alloc(void);
 129 void             mac_vnode_label_free(struct label *label);
 130
 131 int     mac_cred_check_relabel(struct ucred *cred, struct label *newlabel);
 132 int     mac_cred_externalize_label(struct label *label, char *elements,
 133             char *outbuf, size_t outbuflen);
 134 int     mac_cred_internalize_label(struct label *label, char *string);
 135 void    mac_cred_relabel(struct ucred *cred, struct label *newlabel);
 136
 137 struct label    *mac_mbuf_to_label(struct mbuf *m);
 138
 139 void    mac_pipe_copy_label(struct label *src, struct label *dest);
 140 int     mac_pipe_externalize_label(struct label *label, char *elements,
 141             char *outbuf, size_t outbuflen);
 142 int     mac_pipe_internalize_label(struct label *label, char *string);
 143
 144 int     mac_socket_label_set(struct ucred *cred, struct socket *so,
 145             struct label *label);
 146 void    mac_socket_copy_label(struct label *src, struct label *dest);
 147 int     mac_socket_externalize_label(struct label *label, char *elements,
 148             char *outbuf, size_t outbuflen);
 149 int     mac_socket_internalize_label(struct label *label, char *string);
 150
 151 int     mac_vnode_externalize_label(struct label *label, char *elements,
 152             char *outbuf, size_t outbuflen);
 153 int     mac_vnode_internalize_label(struct label *label, char *string);
 154 void    mac_vnode_check_mmap_downgrade(struct ucred *cred, struct vnode *vp,
 155             int *prot);
 156 int     vn_setlabel(struct vnode *vp, struct label *intlabel,
 157             struct ucred *cred);
 158
 159 /*
 160  * MAC_CHECK performs the designated check by walking the policy module list
 161  * and checking with each as to how it feels about the request.  Note that it
 162  * returns its value via 'error' in the scope of the caller.
 163  */
 164 #define MAC_CHECK(check, args...) do {                                  \
 165         struct mac_policy_conf *mpc;                                    \
 166         int entrycount;                                                 \
 167                                                                         \
 168         error = 0;                                                      \
 169         LIST_FOREACH(mpc, &mac_static_policy_list, mpc_list) {          \
 170                 if (mpc->mpc_ops->mpo_ ## check != NULL)                \
 171                         error = mac_error_select(                       \
 172                             mpc->mpc_ops->mpo_ ## check (args),         \
 173                             error);                                     \
 174         }                                                               \
 175         if ((entrycount = mac_policy_list_conditional_busy()) != 0) {   \
 176                 LIST_FOREACH(mpc, &mac_policy_list, mpc_list) {         \
 177                         if (mpc->mpc_ops->mpo_ ## check != NULL)        \
 178                                 error = mac_error_select(               \
 179                                     mpc->mpc_ops->mpo_ ## check (args), \
 180                                     error);                             \
 181                 }                                                       \
 182                 mac_policy_list_unbusy();                               \
 183         }                                                               \
 184 } while (0)
 185
 186 /*
 187  * MAC_GRANT performs the designated check by walking the policy module list
 188  * and checking with each as to how it feels about the request.  Unlike
 189  * MAC_CHECK, it grants if any policies return '0', and otherwise returns
 190  * EPERM.  Note that it returns its value via 'error' in the scope of the
 191  * caller.
 192  */
 193 #define MAC_GRANT(check, args...) do {                                  \
 194         struct mac_policy_conf *mpc;                                    \
 195         int entrycount;                                                 \
 196                                                                         \
 197         error = EPERM;                                                  \
 198         LIST_FOREACH(mpc, &mac_static_policy_list, mpc_list) {          \
 199                 if (mpc->mpc_ops->mpo_ ## check != NULL) {              \
 200                         if (mpc->mpc_ops->mpo_ ## check(args) == 0)     \
 201                                 error = 0;                              \
 202                 }                                                       \
 203         }                                                               \
 204         if ((entrycount = mac_policy_list_conditional_busy()) != 0) {   \
 205                 LIST_FOREACH(mpc, &mac_policy_list, mpc_list) {         \
 206                         if (mpc->mpc_ops->mpo_ ## check != NULL) {      \
 207                                 if (mpc->mpc_ops->mpo_ ## check (args)  \
 208                                     == 0)                               \
 209                                         error = 0;                      \
 210                         }                                               \
 211                 }                                                       \
 212                 mac_policy_list_unbusy();                               \
 213         }                                                               \
 214 } while (0)
 215
 216 /*
 217  * MAC_BOOLEAN performs the designated boolean composition by walking the
 218  * module list, invoking each instance of the operation, and combining the
 219  * results using the passed C operator.  Note that it returns its value via
 220  * 'result' in the scope of the caller, which should be initialized by the
 221  * caller in a meaningful way to get a meaningful result.
 222  */
 223 #define MAC_BOOLEAN(operation, composition, args...) do {               \
 224         struct mac_policy_conf *mpc;                                    \
 225         int entrycount;                                                 \
 226                                                                         \
 227         LIST_FOREACH(mpc, &mac_static_policy_list, mpc_list) {          \
 228                 if (mpc->mpc_ops->mpo_ ## operation != NULL)            \
 229                         result = result composition                     \
 230                             mpc->mpc_ops->mpo_ ## operation (args);     \
 231         }                                                               \
 232         if ((entrycount = mac_policy_list_conditional_busy()) != 0) {   \
 233                 LIST_FOREACH(mpc, &mac_policy_list, mpc_list) {         \
 234                         if (mpc->mpc_ops->mpo_ ## operation != NULL)    \
 235                                 result = result composition             \
 236                                     mpc->mpc_ops->mpo_ ## operation     \
 237                                     (args);                             \
 238                 }                                                       \
 239                 mac_policy_list_unbusy();                               \
 240         }                                                               \
 241 } while (0)
 242
 243 /*
 244  * MAC_EXTERNALIZE queries each policy to see if it can generate an
 245  * externalized version of a label element by name.  Policies declare whether
 246  * they have matched a particular element name, parsed from the string by
 247  * MAC_EXTERNALIZE, and an error is returned if any element is matched by no
 248  * policy.
 249  */
 250 #define MAC_EXTERNALIZE(type, label, elementlist, outbuf,               \
 251     outbuflen) do {                                                     \
 252         int claimed, first, ignorenotfound, savedlen;                   \
 253         char *element_name, *element_temp;                              \
 254         struct sbuf sb;                                                 \
 255                                                                         \
 256         error = 0;                                                      \
 257         first = 1;                                                      \
 258         sbuf_new(&sb, outbuf, outbuflen, SBUF_FIXEDLEN);                \
 259         element_temp = elementlist;                                     \
 260         while ((element_name = strsep(&element_temp, ",")) != NULL) {   \
 261                 if (element_name[0] == '?') {                           \
 262                         element_name++;                                 \
 263                         ignorenotfound = 1;                             \
 264                  } else                                                 \
 265                         ignorenotfound = 0;                             \
 266                 savedlen = sbuf_len(&sb);                               \
 267                 if (first)                                              \
 268                         error = sbuf_printf(&sb, "%s/", element_name);  \
 269                 else                                                    \
 270                         error = sbuf_printf(&sb, ",%s/", element_name); \
 271                 if (error == -1) {                                      \
 272                         error = EINVAL; /* XXX: E2BIG? */               \
 273                         break;                                          \
 274                 }                                                       \
 275                 claimed = 0;                                            \
 276                 MAC_CHECK(type ## _externalize_label, label,            \
 277                     element_name, &sb, &claimed);                       \
 278                 if (error)                                              \
 279                         break;                                          \
 280                 if (claimed == 0 && ignorenotfound) {                   \
 281                         /* Revert last label name. */                   \
 282                         sbuf_setpos(&sb, savedlen);                     \
 283                 } else if (claimed != 1) {                              \
 284                         error = EINVAL; /* XXX: ENOLABEL? */            \
 285                         break;                                          \
 286                 } else {                                                \
 287                         first = 0;                                      \
 288                 }                                                       \
 289         }                                                               \
 290         sbuf_finish(&sb);                                               \
 291 } while (0)
 292
 293 /*
 294  * MAC_INTERNALIZE presents parsed element names and data to each policy to
 295  * see if any is willing to claim it and internalize the label data.  If no
 296  * policies match, an error is returned.
 297  */
 298 #define MAC_INTERNALIZE(type, label, instring) do {                     \
 299         char *element, *element_name, *element_data;                    \
 300         int claimed;                                                    \
 301                                                                         \
 302         error = 0;                                                      \
 303         element = instring;                                             \
 304         while ((element_name = strsep(&element, ",")) != NULL) {        \
 305                 element_data = element_name;                            \
 306                 element_name = strsep(&element_data, "/");              \
 307                 if (element_data == NULL) {                             \
 308                         error = EINVAL;                                 \
 309                         break;                                          \
 310                 }                                                       \
 311                 claimed = 0;                                            \
 312                 MAC_CHECK(type ## _internalize_label, label,            \
 313                     element_name, element_data, &claimed);              \
 314                 if (error)                                              \
 315                         break;                                          \
 316                 if (claimed != 1) {                                     \
 317                         /* XXXMAC: Another error here? */               \
 318                         error = EINVAL;                                 \
 319                         break;                                          \
 320                 }                                                       \
 321         }                                                               \
 322 } while (0)
 323
 324 /*
 325  * MAC_PERFORM performs the designated operation by walking the policy module
 326  * list and invoking that operation for each policy.
 327  */
 328 #define MAC_PERFORM(operation, args...) do {                            \
 329         struct mac_policy_conf *mpc;                                    \
 330         int entrycount;                                                 \
 331                                                                         \
 332         LIST_FOREACH(mpc, &mac_static_policy_list, mpc_list) {          \
 333                 if (mpc->mpc_ops->mpo_ ## operation != NULL)            \
 334                         mpc->mpc_ops->mpo_ ## operation (args);         \
 335         }                                                               \
 336         if ((entrycount = mac_policy_list_conditional_busy()) != 0) {   \
 337                 LIST_FOREACH(mpc, &mac_policy_list, mpc_list) {         \
 338                         if (mpc->mpc_ops->mpo_ ## operation != NULL)    \
 339                                 mpc->mpc_ops->mpo_ ## operation (args); \
 340                 }                                                       \
 341                 mac_policy_list_unbusy();                               \
 342         }                                                               \
 343 } while (0)
 344
 345 #endif /* !_SECURITY_MAC_MAC_INTERNAL_H_ */