2 * Copyright (c) 1999-2002 Robert N. M. Watson
3 * Copyright (c) 2001 Ilmar S. Habibulin
4 * Copyright (c) 2001-2004 Networks Associates Technology, Inc.
5 * Copyright (c) 2006 SPARTA, Inc.
6 * Copyright (c) 2008 Apple Inc.
9 * This software was developed by Robert Watson and Ilmar Habibulin for the
12 * This software was enhanced by SPARTA ISSO under SPAWAR contract
13 * N66001-04-C-6019 ("SEFOS").
15 * This software was developed for the FreeBSD Project in part by Network
16 * Associates Laboratories, the Security Research Division of Network
17 * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"),
18 * as part of the DARPA CHATS research program.
20 * Redistribution and use in source and binary forms, with or without
21 * modification, are permitted provided that the following conditions
23 * 1. Redistributions of source code must retain the above copyright
24 * notice, this list of conditions and the following disclaimer.
25 * 2. Redistributions in binary form must reproduce the above copyright
26 * notice, this list of conditions and the following disclaimer in the
27 * documentation and/or other materials provided with the distribution.
29 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
30 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
31 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
32 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
33 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
34 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
35 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
36 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
37 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
38 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
42 #include <sys/cdefs.h>
43 __FBSDID("$FreeBSD$");
47 #include <sys/param.h>
48 #include <sys/kernel.h>
50 #include <sys/malloc.h>
51 #include <sys/mutex.h>
55 #include <sys/systm.h>
56 #include <sys/mount.h>
58 #include <sys/namei.h>
59 #include <sys/protosw.h>
60 #include <sys/socket.h>
61 #include <sys/socketvar.h>
62 #include <sys/sysctl.h>
64 #include <net/bpfdesc.h>
66 #include <net/if_var.h>
68 #include <security/mac/mac_framework.h>
69 #include <security/mac/mac_internal.h>
70 #include <security/mac/mac_policy.h>
73 * XXXRW: struct ifnet locking is incomplete in the network code, so we use
74 * our own global mutex for struct ifnet. Non-ideal, but should help in the
77 struct mtx mac_ifnet_mtx;
78 MTX_SYSINIT(mac_ifnet_mtx, &mac_ifnet_mtx, "mac_ifnet", MTX_DEF);
81 * Retrieve the label associated with an mbuf by searching for the tag.
82 * Depending on the value of mac_labelmbufs, it's possible that a label will
83 * not be present, in which case NULL is returned. Policies must handle the
84 * possibility of an mbuf not having label storage if they do not enforce
88 mac_mbuf_to_label(struct mbuf *m)
95 tag = m_tag_find(m, PACKET_TAG_MACLABEL, NULL);
98 label = (struct label *)(tag+1);
102 static struct label *
103 mac_bpfdesc_label_alloc(void)
107 label = mac_labelzone_alloc(M_WAITOK);
108 MAC_PERFORM(bpfdesc_init_label, label);
113 mac_bpfdesc_init(struct bpf_d *d)
116 if (mac_labeled & MPC_OBJECT_BPFDESC)
117 d->bd_label = mac_bpfdesc_label_alloc();
122 static struct label *
123 mac_ifnet_label_alloc(void)
127 label = mac_labelzone_alloc(M_WAITOK);
128 MAC_PERFORM(ifnet_init_label, label);
133 mac_ifnet_init(struct ifnet *ifp)
136 if (mac_labeled & MPC_OBJECT_IFNET)
137 ifp->if_label = mac_ifnet_label_alloc();
139 ifp->if_label = NULL;
143 mac_mbuf_tag_init(struct m_tag *tag, int flag)
148 label = (struct label *) (tag + 1);
149 mac_init_label(label);
151 MAC_CHECK(mbuf_init_label, label, flag);
153 MAC_PERFORM(mbuf_destroy_label, label);
154 mac_destroy_label(label);
160 mac_mbuf_init(struct mbuf *m, int flag)
167 if (mac_labeled & MPC_OBJECT_MBUF) {
168 tag = m_tag_get(PACKET_TAG_MACLABEL, sizeof(struct label),
172 error = mac_mbuf_tag_init(tag, flag);
177 m_tag_prepend(m, tag);
183 mac_bpfdesc_label_free(struct label *label)
186 MAC_PERFORM(bpfdesc_destroy_label, label);
187 mac_labelzone_free(label);
191 mac_bpfdesc_destroy(struct bpf_d *d)
194 if (d->bd_label != NULL) {
195 mac_bpfdesc_label_free(d->bd_label);
201 mac_ifnet_label_free(struct label *label)
204 MAC_PERFORM(ifnet_destroy_label, label);
205 mac_labelzone_free(label);
209 mac_ifnet_destroy(struct ifnet *ifp)
212 if (ifp->if_label != NULL) {
213 mac_ifnet_label_free(ifp->if_label);
214 ifp->if_label = NULL;
219 mac_mbuf_tag_destroy(struct m_tag *tag)
223 label = (struct label *)(tag+1);
225 MAC_PERFORM(mbuf_destroy_label, label);
226 mac_destroy_label(label);
230 * mac_mbuf_tag_copy is called when an mbuf header is duplicated, in which
231 * case the labels must also be duplicated.
234 mac_mbuf_tag_copy(struct m_tag *src, struct m_tag *dest)
236 struct label *src_label, *dest_label;
238 src_label = (struct label *)(src+1);
239 dest_label = (struct label *)(dest+1);
242 * mac_mbuf_tag_init() is called on the target tag in m_tag_copy(),
243 * so we don't need to call it here.
245 MAC_PERFORM(mbuf_copy_label, src_label, dest_label);
249 mac_mbuf_copy(struct mbuf *m_from, struct mbuf *m_to)
251 struct label *src_label, *dest_label;
253 src_label = mac_mbuf_to_label(m_from);
254 dest_label = mac_mbuf_to_label(m_to);
256 MAC_PERFORM(mbuf_copy_label, src_label, dest_label);
260 mac_ifnet_copy_label(struct label *src, struct label *dest)
263 MAC_PERFORM(ifnet_copy_label, src, dest);
267 mac_ifnet_externalize_label(struct label *label, char *elements,
268 char *outbuf, size_t outbuflen)
272 MAC_EXTERNALIZE(ifnet, label, elements, outbuf, outbuflen);
278 mac_ifnet_internalize_label(struct label *label, char *string)
282 MAC_INTERNALIZE(ifnet, label, string);
288 mac_ifnet_create(struct ifnet *ifp)
292 MAC_PERFORM(ifnet_create, ifp, ifp->if_label);
293 MAC_IFNET_UNLOCK(ifp);
297 mac_bpfdesc_create(struct ucred *cred, struct bpf_d *d)
300 MAC_PERFORM(bpfdesc_create, cred, d, d->bd_label);
304 mac_bpfdesc_create_mbuf(struct bpf_d *d, struct mbuf *m)
310 label = mac_mbuf_to_label(m);
312 MAC_PERFORM(bpfdesc_create_mbuf, d, d->bd_label, m, label);
316 mac_ifnet_create_mbuf(struct ifnet *ifp, struct mbuf *m)
320 label = mac_mbuf_to_label(m);
323 MAC_PERFORM(ifnet_create_mbuf, ifp, ifp->if_label, m, label);
324 MAC_IFNET_UNLOCK(ifp);
328 mac_bpfdesc_check_receive(struct bpf_d *d, struct ifnet *ifp)
335 MAC_CHECK(bpfdesc_check_receive, d, d->bd_label, ifp, ifp->if_label);
336 MAC_IFNET_UNLOCK(ifp);
342 mac_ifnet_check_transmit(struct ifnet *ifp, struct mbuf *m)
349 label = mac_mbuf_to_label(m);
352 MAC_CHECK(ifnet_check_transmit, ifp, ifp->if_label, m, label);
353 MAC_IFNET_UNLOCK(ifp);
359 mac_ifnet_ioctl_get(struct ucred *cred, struct ifreq *ifr,
362 char *elements, *buffer;
363 struct label *intlabel;
367 if (!(mac_labeled & MPC_OBJECT_IFNET))
370 error = copyin(ifr->ifr_ifru.ifru_data, &mac, sizeof(mac));
374 error = mac_check_structmac_consistent(&mac);
378 elements = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK);
379 error = copyinstr(mac.m_string, elements, mac.m_buflen, NULL);
381 free(elements, M_MACTEMP);
385 buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK | M_ZERO);
386 intlabel = mac_ifnet_label_alloc();
388 mac_ifnet_copy_label(ifp->if_label, intlabel);
389 MAC_IFNET_UNLOCK(ifp);
390 error = mac_ifnet_externalize_label(intlabel, elements, buffer,
392 mac_ifnet_label_free(intlabel);
394 error = copyout(buffer, mac.m_string, strlen(buffer)+1);
396 free(buffer, M_MACTEMP);
397 free(elements, M_MACTEMP);
403 mac_ifnet_ioctl_set(struct ucred *cred, struct ifreq *ifr, struct ifnet *ifp)
405 struct label *intlabel;
410 if (!(mac_labeled & MPC_OBJECT_IFNET))
413 error = copyin(ifr->ifr_ifru.ifru_data, &mac, sizeof(mac));
417 error = mac_check_structmac_consistent(&mac);
421 buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK);
422 error = copyinstr(mac.m_string, buffer, mac.m_buflen, NULL);
424 free(buffer, M_MACTEMP);
428 intlabel = mac_ifnet_label_alloc();
429 error = mac_ifnet_internalize_label(intlabel, buffer);
430 free(buffer, M_MACTEMP);
432 mac_ifnet_label_free(intlabel);
437 * XXX: Note that this is a redundant privilege check, since policies
438 * impose this check themselves if required by the policy
439 * Eventually, this should go away.
441 error = priv_check_cred(cred, PRIV_NET_SETIFMAC, 0);
443 mac_ifnet_label_free(intlabel);
448 MAC_CHECK(ifnet_check_relabel, cred, ifp, ifp->if_label, intlabel);
450 MAC_IFNET_UNLOCK(ifp);
451 mac_ifnet_label_free(intlabel);
455 MAC_PERFORM(ifnet_relabel, cred, ifp, ifp->if_label, intlabel);
456 MAC_IFNET_UNLOCK(ifp);
458 mac_ifnet_label_free(intlabel);