sys/security/mac/mac_internal.h

   1 /*-
   2  * Copyright (c) 1999-2002, 2006 Robert N. M. Watson
   3  * Copyright (c) 2001 Ilmar S. Habibulin
   4  * Copyright (c) 2001-2004 Networks Associates Technology, Inc.
   5  * Copyright (c) 2006 nCircle Network Security, Inc.
   6  * Copyright (c) 2006 SPARTA, Inc.
   7  * All rights reserved.
   8  *
   9  * This software was developed by Robert Watson and Ilmar Habibulin for the
  10  * TrustedBSD Project.
  11  *
  12  * This software was developed for the FreeBSD Project in part by Network
  13  * Associates Laboratories, the Security Research Division of Network
  14  * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"),
  15  * as part of the DARPA CHATS research program.
  16  *
  17  * This software was developed by Robert N. M. Watson for the TrustedBSD
  18  * Project under contract to nCircle Network Security, Inc.
  19  *
  20  * This software was enhanced by SPARTA ISSO under SPAWAR contract
  21  * N66001-04-C-6019 ("SEFOS").
  22  *
  23  * Redistribution and use in source and binary forms, with or without
  24  * modification, are permitted provided that the following conditions
  25  * are met:
  26  * 1. Redistributions of source code must retain the above copyright
  27  *    notice, this list of conditions and the following disclaimer.
  28  * 2. Redistributions in binary form must reproduce the above copyright
  29  *    notice, this list of conditions and the following disclaimer in the
  30  *    documentation and/or other materials provided with the distribution.
  31  *
  32  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  33  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  34  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  35  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  36  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  37  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  38  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  39  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  40  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  41  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  42  * SUCH DAMAGE.
  43  *
  44  * $FreeBSD$
  45  */
  46
  47 #ifndef _SYS_SECURITY_MAC_MAC_INTERNAL_H_
  48 #define _SYS_SECURITY_MAC_MAC_INTERNAL_H_
  49
  50 #ifndef _KERNEL
  51 #error "no user-serviceable parts inside"
  52 #endif
  53
  54 /*
  55  * MAC Framework sysctl namespace.
  56  */
  57 #ifdef SYSCTL_DECL
  58 SYSCTL_DECL(_security_mac);
  59 #endif /* SYSCTL_DECL */
  60
  61 /*
  62  * MAC Framework global types and typedefs.
  63  */
  64 LIST_HEAD(mac_policy_list_head, mac_policy_conf);
  65 #ifdef MALLOC_DECLARE
  66 MALLOC_DECLARE(M_MACTEMP);
  67 #endif
  68
  69 /*
  70  * MAC labels -- in-kernel storage format.
  71  *
  72  * In general, struct label pointers are embedded in kernel data structures
  73  * representing objects that may be labeled (and protected).  Struct label is
  74  * opaque to both kernel services that invoke the MAC Framework and MAC
  75  * policy modules.  In particular, we do not wish to encode the layout of the
  76  * label structure into any ABIs.  Historically, the slot array contained
  77  * unions of {long, void} but now contains uintptr_t.
  78  */
  79 #define MAC_MAX_SLOTS   4
  80 #define MAC_FLAG_INITIALIZED    0x0000001       /* Is initialized for use. */
  81 struct label {
  82         int             l_flags;
  83         intptr_t        l_perpolicy[MAC_MAX_SLOTS];
  84 };
  85
  86 /*
  87  * MAC Framework global variables.
  88  */
  89 extern struct mac_policy_list_head      mac_policy_list;
  90 extern struct mac_policy_list_head      mac_static_policy_list;
  91 #ifndef MAC_ALWAYS_LABEL_MBUF
  92 extern int                              mac_labelmbufs;
  93 #endif
  94 extern struct mtx                       mac_ifnet_mtx;
  95
  96 /*
  97  * MAC Framework infrastructure functions.
  98  */
  99 int     mac_error_select(int error1, int error2);
 100
 101 void    mac_policy_grab_exclusive(void);
 102 void    mac_policy_assert_exclusive(void);
 103 void    mac_policy_release_exclusive(void);
 104 void    mac_policy_list_busy(void);
 105 int     mac_policy_list_conditional_busy(void);
 106 void    mac_policy_list_unbusy(void);
 107
 108 struct label    *mac_labelzone_alloc(int flags);
 109 void             mac_labelzone_free(struct label *label);
 110 void             mac_labelzone_init(void);
 111
 112 void    mac_init_label(struct label *label);
 113 void    mac_destroy_label(struct label *label);
 114 int     mac_check_structmac_consistent(struct mac *mac);
 115 int     mac_allocate_slot(void);
 116
 117 #define MAC_IFNET_LOCK(ifp)     mtx_lock(&mac_ifnet_mtx)
 118 #define MAC_IFNET_UNLOCK(ifp)   mtx_unlock(&mac_ifnet_mtx)
 119
 120 /*
 121  * MAC Framework per-object type functions.  It's not yet clear how the
 122  * namespaces, etc, should work for these, so for now, sort by object type.
 123  */
 124 struct label    *mac_pipe_label_alloc(void);
 125 void             mac_pipe_label_free(struct label *label);
 126 struct label    *mac_socket_label_alloc(int flag);
 127 void             mac_socket_label_free(struct label *label);
 128
 129 int     mac_cred_check_relabel(struct ucred *cred, struct label *newlabel);
 130 int     mac_cred_externalize_label(struct label *label, char *elements,
 131             char *outbuf, size_t outbuflen);
 132 int     mac_cred_internalize_label(struct label *label, char *string);
 133 void    mac_cred_relabel(struct ucred *cred, struct label *newlabel);
 134
 135 struct label    *mac_mbuf_to_label(struct mbuf *m);
 136
 137 void    mac_pipe_copy_label(struct label *src, struct label *dest);
 138 int     mac_pipe_externalize_label(struct label *label, char *elements,
 139             char *outbuf, size_t outbuflen);
 140 int     mac_pipe_internalize_label(struct label *label, char *string);
 141
 142 int     mac_socket_label_set(struct ucred *cred, struct socket *so,
 143             struct label *label);
 144 void    mac_socket_copy_label(struct label *src, struct label *dest);
 145 int     mac_socket_externalize_label(struct label *label, char *elements,
 146             char *outbuf, size_t outbuflen);
 147 int     mac_socket_internalize_label(struct label *label, char *string);
 148
 149 int     mac_vnode_externalize_label(struct label *label, char *elements,
 150             char *outbuf, size_t outbuflen);
 151 int     mac_vnode_internalize_label(struct label *label, char *string);
 152 void    mac_vnode_check_mmap_downgrade(struct ucred *cred, struct vnode *vp,
 153             int *prot);
 154 int     vn_setlabel(struct vnode *vp, struct label *intlabel,
 155             struct ucred *cred);
 156
 157 /*
 158  * MAC_CHECK performs the designated check by walking the policy module list
 159  * and checking with each as to how it feels about the request.  Note that it
 160  * returns its value via 'error' in the scope of the caller.
 161  */
 162 #define MAC_CHECK(check, args...) do {                                  \
 163         struct mac_policy_conf *mpc;                                    \
 164         int entrycount;                                                 \
 165                                                                         \
 166         error = 0;                                                      \
 167         LIST_FOREACH(mpc, &mac_static_policy_list, mpc_list) {          \
 168                 if (mpc->mpc_ops->mpo_ ## check != NULL)                \
 169                         error = mac_error_select(                       \
 170                             mpc->mpc_ops->mpo_ ## check (args),         \
 171                             error);                                     \
 172         }                                                               \
 173         if ((entrycount = mac_policy_list_conditional_busy()) != 0) {   \
 174                 LIST_FOREACH(mpc, &mac_policy_list, mpc_list) {         \
 175                         if (mpc->mpc_ops->mpo_ ## check != NULL)        \
 176                                 error = mac_error_select(               \
 177                                     mpc->mpc_ops->mpo_ ## check (args), \
 178                                     error);                             \
 179                 }                                                       \
 180                 mac_policy_list_unbusy();                               \
 181         }                                                               \
 182 } while (0)
 183
 184 /*
 185  * MAC_GRANT performs the designated check by walking the policy module list
 186  * and checking with each as to how it feels about the request.  Unlike
 187  * MAC_CHECK, it grants if any policies return '0', and otherwise returns
 188  * EPERM.  Note that it returns its value via 'error' in the scope of the
 189  * caller.
 190  */
 191 #define MAC_GRANT(check, args...) do {                                  \
 192         struct mac_policy_conf *mpc;                                    \
 193         int entrycount;                                                 \
 194                                                                         \
 195         error = EPERM;                                                  \
 196         LIST_FOREACH(mpc, &mac_static_policy_list, mpc_list) {          \
 197                 if (mpc->mpc_ops->mpo_ ## check != NULL) {              \
 198                         if (mpc->mpc_ops->mpo_ ## check(args) == 0)     \
 199                                 error = 0;                              \
 200                 }                                                       \
 201         }                                                               \
 202         if ((entrycount = mac_policy_list_conditional_busy()) != 0) {   \
 203                 LIST_FOREACH(mpc, &mac_policy_list, mpc_list) {         \
 204                         if (mpc->mpc_ops->mpo_ ## check != NULL) {      \
 205                                 if (mpc->mpc_ops->mpo_ ## check (args)  \
 206                                     == 0)                               \
 207                                         error = 0;                      \
 208                         }                                               \
 209                 }                                                       \
 210                 mac_policy_list_unbusy();                               \
 211         }                                                               \
 212 } while (0)
 213
 214 /*
 215  * MAC_BOOLEAN performs the designated boolean composition by walking the
 216  * module list, invoking each instance of the operation, and combining the
 217  * results using the passed C operator.  Note that it returns its value via
 218  * 'result' in the scope of the caller, which should be initialized by the
 219  * caller in a meaningful way to get a meaningful result.
 220  */
 221 #define MAC_BOOLEAN(operation, composition, args...) do {               \
 222         struct mac_policy_conf *mpc;                                    \
 223         int entrycount;                                                 \
 224                                                                         \
 225         LIST_FOREACH(mpc, &mac_static_policy_list, mpc_list) {          \
 226                 if (mpc->mpc_ops->mpo_ ## operation != NULL)            \
 227                         result = result composition                     \
 228                             mpc->mpc_ops->mpo_ ## operation (args);     \
 229         }                                                               \
 230         if ((entrycount = mac_policy_list_conditional_busy()) != 0) {   \
 231                 LIST_FOREACH(mpc, &mac_policy_list, mpc_list) {         \
 232                         if (mpc->mpc_ops->mpo_ ## operation != NULL)    \
 233                                 result = result composition             \
 234                                     mpc->mpc_ops->mpo_ ## operation     \
 235                                     (args);                             \
 236                 }                                                       \
 237                 mac_policy_list_unbusy();                               \
 238         }                                                               \
 239 } while (0)
 240
 241 /*
 242  * MAC_EXTERNALIZE queries each policy to see if it can generate an
 243  * externalized version of a label element by name.  Policies declare whether
 244  * they have matched a particular element name, parsed from the string by
 245  * MAC_EXTERNALIZE, and an error is returned if any element is matched by no
 246  * policy.
 247  */
 248 #define MAC_EXTERNALIZE(type, label, elementlist, outbuf,               \
 249     outbuflen) do {                                                     \
 250         int claimed, first, ignorenotfound, savedlen;                   \
 251         char *element_name, *element_temp;                              \
 252         struct sbuf sb;                                                 \
 253                                                                         \
 254         error = 0;                                                      \
 255         first = 1;                                                      \
 256         sbuf_new(&sb, outbuf, outbuflen, SBUF_FIXEDLEN);                \
 257         element_temp = elementlist;                                     \
 258         while ((element_name = strsep(&element_temp, ",")) != NULL) {   \
 259                 if (element_name[0] == '?') {                           \
 260                         element_name++;                                 \
 261                         ignorenotfound = 1;                             \
 262                  } else                                                 \
 263                         ignorenotfound = 0;                             \
 264                 savedlen = sbuf_len(&sb);                               \
 265                 if (first)                                              \
 266                         error = sbuf_printf(&sb, "%s/", element_name);  \
 267                 else                                                    \
 268                         error = sbuf_printf(&sb, ",%s/", element_name); \
 269                 if (error == -1) {                                      \
 270                         error = EINVAL; /* XXX: E2BIG? */               \
 271                         break;                                          \
 272                 }                                                       \
 273                 claimed = 0;                                            \
 274                 MAC_CHECK(type ## _externalize_label, label,            \
 275                     element_name, &sb, &claimed);                       \
 276                 if (error)                                              \
 277                         break;                                          \
 278                 if (claimed == 0 && ignorenotfound) {                   \
 279                         /* Revert last label name. */                   \
 280                         sbuf_setpos(&sb, savedlen);                     \
 281                 } else if (claimed != 1) {                              \
 282                         error = EINVAL; /* XXX: ENOLABEL? */            \
 283                         break;                                          \
 284                 } else {                                                \
 285                         first = 0;                                      \
 286                 }                                                       \
 287         }                                                               \
 288         sbuf_finish(&sb);                                               \
 289 } while (0)
 290
 291 /*
 292  * MAC_INTERNALIZE presents parsed element names and data to each policy to
 293  * see if any is willing to claim it and internalize the label data.  If no
 294  * policies match, an error is returned.
 295  */
 296 #define MAC_INTERNALIZE(type, label, instring) do {                     \
 297         char *element, *element_name, *element_data;                    \
 298         int claimed;                                                    \
 299                                                                         \
 300         error = 0;                                                      \
 301         element = instring;                                             \
 302         while ((element_name = strsep(&element, ",")) != NULL) {        \
 303                 element_data = element_name;                            \
 304                 element_name = strsep(&element_data, "/");              \
 305                 if (element_data == NULL) {                             \
 306                         error = EINVAL;                                 \
 307                         break;                                          \
 308                 }                                                       \
 309                 claimed = 0;                                            \
 310                 MAC_CHECK(type ## _internalize_label, label,            \
 311                     element_name, element_data, &claimed);              \
 312                 if (error)                                              \
 313                         break;                                          \
 314                 if (claimed != 1) {                                     \
 315                         /* XXXMAC: Another error here? */               \
 316                         error = EINVAL;                                 \
 317                         break;                                          \
 318                 }                                                       \
 319         }                                                               \
 320 } while (0)
 321
 322 /*
 323  * MAC_PERFORM performs the designated operation by walking the policy module
 324  * list and invoking that operation for each policy.
 325  */
 326 #define MAC_PERFORM(operation, args...) do {                            \
 327         struct mac_policy_conf *mpc;                                    \
 328         int entrycount;                                                 \
 329                                                                         \
 330         LIST_FOREACH(mpc, &mac_static_policy_list, mpc_list) {          \
 331                 if (mpc->mpc_ops->mpo_ ## operation != NULL)            \
 332                         mpc->mpc_ops->mpo_ ## operation (args);         \
 333         }                                                               \
 334         if ((entrycount = mac_policy_list_conditional_busy()) != 0) {   \
 335                 LIST_FOREACH(mpc, &mac_policy_list, mpc_list) {         \
 336                         if (mpc->mpc_ops->mpo_ ## operation != NULL)    \
 337                                 mpc->mpc_ops->mpo_ ## operation (args); \
 338                 }                                                       \
 339                 mac_policy_list_unbusy();                               \
 340         }                                                               \
 341 } while (0)
 342
 343 #endif /* !_SYS_SECURITY_MAC_MAC_INTERNAL_H_ */