sys/security/mac/mac_internal.h

   1 /*-
   2  * Copyright (c) 1999-2002 Robert N. M. Watson
   3  * Copyright (c) 2001 Ilmar S. Habibulin
   4  * Copyright (c) 2001-2004 Networks Associates Technology, Inc.
   5  * All rights reserved.
   6  *
   7  * This software was developed by Robert Watson and Ilmar Habibulin for the
   8  * TrustedBSD Project.
   9  *
  10  * This software was developed for the FreeBSD Project in part by Network
  11  * Associates Laboratories, the Security Research Division of Network
  12  * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"),
  13  * as part of the DARPA CHATS research program.
  14  *
  15  * Redistribution and use in source and binary forms, with or without
  16  * modification, are permitted provided that the following conditions
  17  * are met:
  18  * 1. Redistributions of source code must retain the above copyright
  19  *    notice, this list of conditions and the following disclaimer.
  20  * 2. Redistributions in binary form must reproduce the above copyright
  21  *    notice, this list of conditions and the following disclaimer in the
  22  *    documentation and/or other materials provided with the distribution.
  23  *
  24  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  25  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  26  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  27  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  28  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  29  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  30  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  31  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  32  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  33  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  34  * SUCH DAMAGE.
  35  *
  36  * $FreeBSD$
  37  */
  38
  39 /*
  40  * MAC Framework sysctl namespace.
  41  */
  42 #ifdef SYSCTL_DECL
  43 SYSCTL_DECL(_security);
  44 SYSCTL_DECL(_security_mac);
  45 #ifdef MAC_DEBUG
  46 SYSCTL_DECL(_security_mac_debug);
  47 SYSCTL_DECL(_security_mac_debug_counters);
  48 #endif
  49 #endif /* SYSCTL_DECL */
  50
  51 /*
  52  * MAC Framework global types and typedefs.
  53  */
  54 LIST_HEAD(mac_policy_list_head, mac_policy_conf);
  55 #ifdef MALLOC_DECLARE
  56 MALLOC_DECLARE(M_MACTEMP);
  57 #endif
  58
  59 /*
  60  * MAC Framework global variables.
  61  */
  62 extern struct mac_policy_list_head      mac_policy_list;
  63 extern struct mac_policy_list_head      mac_static_policy_list;
  64 extern int                              mac_late;
  65 extern int                              mac_enforce_network;
  66 extern int                              mac_enforce_process;
  67 extern int                              mac_enforce_socket;
  68 extern int                              mac_enforce_vm;
  69 #ifndef MAC_ALWAYS_LABEL_MBUF
  70 extern int                              mac_labelmbufs;
  71 #endif
  72
  73 /*
  74  * MAC Framework object/access counter primitives, conditionally
  75  * compiled.
  76  */
  77 #ifdef MAC_DEBUG
  78 #define MAC_DEBUG_COUNTER_INC(x)        atomic_add_int(x, 1);
  79 #define MAC_DEBUG_COUNTER_DEC(x)        atomic_subtract_int(x, 1);
  80 #else
  81 #define MAC_DEBUG_COUNTER_INC(x)
  82 #define MAC_DEBUG_COUNTER_DEC(x)
  83 #endif
  84
  85 /*
  86  * MAC Framework infrastructure functions.
  87  */
  88 int     mac_error_select(int error1, int error2);
  89
  90 void    mac_policy_grab_exclusive(void);
  91 void    mac_policy_assert_exclusive(void);
  92 void    mac_policy_release_exclusive(void);
  93 void    mac_policy_list_busy(void);
  94 int     mac_policy_list_conditional_busy(void);
  95 void    mac_policy_list_unbusy(void);
  96
  97 struct label    *mac_labelzone_alloc(int flags);
  98 void             mac_labelzone_free(struct label *label);
  99 void             mac_labelzone_init(void);
 100
 101 void    mac_init_label(struct label *label);
 102 void    mac_destroy_label(struct label *label);
 103 int     mac_check_structmac_consistent(struct mac *mac);
 104 int     mac_allocate_slot(void);
 105
 106 /*
 107  * MAC Framework per-object type functions.  It's not yet clear how
 108  * the namespaces, etc, should work for these, so for now, sort by
 109  * object type.
 110  */
 111 struct label    *mac_pipe_label_alloc(void);
 112 void             mac_pipe_label_free(struct label *label);
 113 struct label    *mac_socket_label_alloc(int flag);
 114 void             mac_socket_label_free(struct label *label);
 115
 116 int     mac_check_cred_relabel(struct ucred *cred, struct label *newlabel);
 117 int     mac_externalize_cred_label(struct label *label, char *elements,
 118             char *outbuf, size_t outbuflen);
 119 int     mac_internalize_cred_label(struct label *label, char *string);
 120 void    mac_relabel_cred(struct ucred *cred, struct label *newlabel);
 121
 122 struct label    *mac_mbuf_to_label(struct mbuf *m);
 123
 124 void    mac_copy_pipe_label(struct label *src, struct label *dest);
 125 int     mac_externalize_pipe_label(struct label *label, char *elements,
 126             char *outbuf, size_t outbuflen);
 127 int     mac_internalize_pipe_label(struct label *label, char *string);
 128
 129 int     mac_socket_label_set(struct ucred *cred, struct socket *so,
 130             struct label *label);
 131 void    mac_copy_socket_label(struct label *src, struct label *dest);
 132 int     mac_externalize_socket_label(struct label *label, char *elements,
 133             char *outbuf, size_t outbuflen);
 134 int     mac_internalize_socket_label(struct label *label, char *string);
 135
 136 int     mac_externalize_vnode_label(struct label *label, char *elements,
 137             char *outbuf, size_t outbuflen);
 138 int     mac_internalize_vnode_label(struct label *label, char *string);
 139 void    mac_check_vnode_mmap_downgrade(struct ucred *cred, struct vnode *vp,
 140             int *prot);
 141 int     vn_setlabel(struct vnode *vp, struct label *intlabel,
 142             struct ucred *cred);
 143
 144 /*
 145  * MAC_CHECK performs the designated check by walking the policy module
 146  * list and checking with each as to how it feels about the request.
 147  * Note that it returns its value via 'error' in the scope of the caller.
 148  */
 149 #define MAC_CHECK(check, args...) do {                                  \
 150         struct mac_policy_conf *mpc;                                    \
 151         int entrycount;                                                 \
 152                                                                         \
 153         error = 0;                                                      \
 154         LIST_FOREACH(mpc, &mac_static_policy_list, mpc_list) {          \
 155                 if (mpc->mpc_ops->mpo_ ## check != NULL)                \
 156                         error = mac_error_select(                       \
 157                             mpc->mpc_ops->mpo_ ## check (args),         \
 158                             error);                                     \
 159         }                                                               \
 160         if ((entrycount = mac_policy_list_conditional_busy()) != 0) {   \
 161                 LIST_FOREACH(mpc, &mac_policy_list, mpc_list) {         \
 162                         if (mpc->mpc_ops->mpo_ ## check != NULL)        \
 163                                 error = mac_error_select(               \
 164                                     mpc->mpc_ops->mpo_ ## check (args), \
 165                                     error);                             \
 166                 }                                                       \
 167                 mac_policy_list_unbusy();                               \
 168         }                                                               \
 169 } while (0)
 170
 171 /*
 172  * MAC_BOOLEAN performs the designated boolean composition by walking
 173  * the module list, invoking each instance of the operation, and
 174  * combining the results using the passed C operator.  Note that it
 175  * returns its value via 'result' in the scope of the caller, which
 176  * should be initialized by the caller in a meaningful way to get
 177  * a meaningful result.
 178  */
 179 #define MAC_BOOLEAN(operation, composition, args...) do {               \
 180         struct mac_policy_conf *mpc;                                    \
 181         int entrycount;                                                 \
 182                                                                         \
 183         LIST_FOREACH(mpc, &mac_static_policy_list, mpc_list) {          \
 184                 if (mpc->mpc_ops->mpo_ ## operation != NULL)            \
 185                         result = result composition                     \
 186                             mpc->mpc_ops->mpo_ ## operation (args);     \
 187         }                                                               \
 188         if ((entrycount = mac_policy_list_conditional_busy()) != 0) {   \
 189                 LIST_FOREACH(mpc, &mac_policy_list, mpc_list) {         \
 190                         if (mpc->mpc_ops->mpo_ ## operation != NULL)    \
 191                                 result = result composition             \
 192                                     mpc->mpc_ops->mpo_ ## operation     \
 193                                     (args);                             \
 194                 }                                                       \
 195                 mac_policy_list_unbusy();                               \
 196         }                                                               \
 197 } while (0)
 198
 199 #define MAC_EXTERNALIZE(type, label, elementlist, outbuf,               \
 200     outbuflen) do {                                                     \
 201         int claimed, first, ignorenotfound, savedlen;                   \
 202         char *element_name, *element_temp;                              \
 203         struct sbuf sb;                                                 \
 204                                                                         \
 205         error = 0;                                                      \
 206         first = 1;                                                      \
 207         sbuf_new(&sb, outbuf, outbuflen, SBUF_FIXEDLEN);                \
 208         element_temp = elementlist;                                     \
 209         while ((element_name = strsep(&element_temp, ",")) != NULL) {   \
 210                 if (element_name[0] == '?') {                           \
 211                         element_name++;                                 \
 212                         ignorenotfound = 1;                             \
 213                  } else                                                 \
 214                         ignorenotfound = 0;                             \
 215                 savedlen = sbuf_len(&sb);                               \
 216                 if (first)                                              \
 217                         error = sbuf_printf(&sb, "%s/", element_name);  \
 218                 else                                                    \
 219                         error = sbuf_printf(&sb, ",%s/", element_name); \
 220                 if (error == -1) {                                      \
 221                         error = EINVAL; /* XXX: E2BIG? */               \
 222                         break;                                          \
 223                 }                                                       \
 224                 claimed = 0;                                            \
 225                 MAC_CHECK(externalize_ ## type ## _label, label,        \
 226                     element_name, &sb, &claimed);                       \
 227                 if (error)                                              \
 228                         break;                                          \
 229                 if (claimed == 0 && ignorenotfound) {                   \
 230                         /* Revert last label name. */                   \
 231                         sbuf_setpos(&sb, savedlen);                     \
 232                 } else if (claimed != 1) {                              \
 233                         error = EINVAL; /* XXX: ENOLABEL? */            \
 234                         break;                                          \
 235                 } else {                                                \
 236                         first = 0;                                      \
 237                 }                                                       \
 238         }                                                               \
 239         sbuf_finish(&sb);                                               \
 240 } while (0)
 241
 242 #define MAC_INTERNALIZE(type, label, instring) do {                     \
 243         char *element, *element_name, *element_data;                    \
 244         int claimed;                                                    \
 245                                                                         \
 246         error = 0;                                                      \
 247         element = instring;                                             \
 248         while ((element_name = strsep(&element, ",")) != NULL) {        \
 249                 element_data = element_name;                            \
 250                 element_name = strsep(&element_data, "/");              \
 251                 if (element_data == NULL) {                             \
 252                         error = EINVAL;                                 \
 253                         break;                                          \
 254                 }                                                       \
 255                 claimed = 0;                                            \
 256                 MAC_CHECK(internalize_ ## type ## _label, label,        \
 257                     element_name, element_data, &claimed);              \
 258                 if (error)                                              \
 259                         break;                                          \
 260                 if (claimed != 1) {                                     \
 261                         /* XXXMAC: Another error here? */               \
 262                         error = EINVAL;                                 \
 263                         break;                                          \
 264                 }                                                       \
 265         }                                                               \
 266 } while (0)
 267
 268 /*
 269  * MAC_PERFORM performs the designated operation by walking the policy
 270  * module list and invoking that operation for each policy.
 271  */
 272 #define MAC_PERFORM(operation, args...) do {                            \
 273         struct mac_policy_conf *mpc;                                    \
 274         int entrycount;                                                 \
 275                                                                         \
 276         LIST_FOREACH(mpc, &mac_static_policy_list, mpc_list) {          \
 277                 if (mpc->mpc_ops->mpo_ ## operation != NULL)            \
 278                         mpc->mpc_ops->mpo_ ## operation (args);         \
 279         }                                                               \
 280         if ((entrycount = mac_policy_list_conditional_busy()) != 0) {   \
 281                 LIST_FOREACH(mpc, &mac_policy_list, mpc_list) {         \
 282                         if (mpc->mpc_ops->mpo_ ## operation != NULL)    \
 283                                 mpc->mpc_ops->mpo_ ## operation (args); \
 284                 }                                                       \
 285                 mac_policy_list_unbusy();                               \
 286         }                                                               \
 287 } while (0)