2 * Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson
3 * Copyright (c) 2001, 2002 Networks Associates Technology, Inc.
6 * This software was developed by Robert Watson for the TrustedBSD Project.
8 * This software was developed for the FreeBSD Project in part by NAI Labs,
9 * the Security Research Division of Network Associates, Inc. under
10 * DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA
11 * CHATS research program.
13 * Redistribution and use in source and binary forms, with or without
14 * modification, are permitted provided that the following conditions
16 * 1. Redistributions of source code must retain the above copyright
17 * notice, this list of conditions and the following disclaimer.
18 * 2. Redistributions in binary form must reproduce the above copyright
19 * notice, this list of conditions and the following disclaimer in the
20 * documentation and/or other materials provided with the distribution.
21 * 3. The names of the authors may not be used to endorse or promote
22 * products derived from this software without specific prior written
25 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
26 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
27 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
28 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
29 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
30 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
31 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
32 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
33 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
34 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
40 * Kernel interface for MAC policy modules.
42 #ifndef _SYS_MAC_POLICY_H
43 #define _SYS_MAC_POLICY_H
46 * Pluggable access control policy definition structure.
48 * List of operations that are performed as part of the implementation
49 * of a MAC policy. Policy implementors declare operations with a
50 * mac_policy_ops structure, and using the MAC_POLICY_SET() macro.
51 * If an entry point is not declared, then then the policy will be ignored
52 * during evaluation of that event or check.
54 * Operations are sorted first by general class of operation, then
57 struct mac_policy_conf;
58 struct mac_policy_ops {
60 * Policy module operations.
62 void (*mpo_destroy)(struct mac_policy_conf *mpc);
63 void (*mpo_init)(struct mac_policy_conf *mpc);
66 * General policy-directed security system call so that policies
67 * may implement new services without reserving explicit
68 * system call numbers.
70 int (*mpo_syscall)(struct thread *td, int call, void *arg);
75 void (*mpo_init_bpfdesc)(struct bpf_d *, struct label *label);
76 void (*mpo_init_cred)(struct ucred *, struct label *label);
77 void (*mpo_init_devfsdirent)(struct devfs_dirent *,
79 void (*mpo_init_ifnet)(struct ifnet *, struct label *label);
80 void (*mpo_init_ipq)(struct ipq *ipq, struct label *label);
81 int (*mpo_init_mbuf)(struct mbuf *, int how, struct label *label);
82 void (*mpo_init_mount)(struct mount *, struct label *mntlabel,
83 struct label *fslabel);
84 void (*mpo_init_socket)(struct socket *so, struct label *label,
85 struct label *peerlabel);
86 void (*mpo_init_pipe)(struct pipe *pipe, struct label *label);
87 void (*mpo_init_temp)(struct label *label);
88 void (*mpo_init_vnode)(struct vnode *, struct label *label);
89 void (*mpo_destroy_bpfdesc)(struct bpf_d *, struct label *label);
90 void (*mpo_destroy_cred)(struct ucred *, struct label *label);
91 void (*mpo_destroy_devfsdirent)(struct devfs_dirent *de,
93 void (*mpo_destroy_ifnet)(struct ifnet *, struct label *label);
94 void (*mpo_destroy_ipq)(struct ipq *ipq, struct label *label);
95 void (*mpo_destroy_mbuf)(struct mbuf *, struct label *label);
96 void (*mpo_destroy_mount)(struct mount *, struct label *mntlabel,
97 struct label *fslabel);
98 void (*mpo_destroy_socket)(struct socket *so, struct label *label,
99 struct label *peerlabel);
100 void (*mpo_destroy_pipe)(struct pipe *pipe, struct label *label);
101 void (*mpo_destroy_temp)(struct label *label);
102 void (*mpo_destroy_vnode)(struct vnode *, struct label *label);
103 int (*mpo_externalize)(struct label *label, struct mac *extmac);
104 int (*mpo_internalize)(struct label *label, struct mac *extmac);
107 * Labeling event operations: file system objects, and things that
108 * look a lot like file system objects.
110 void (*mpo_create_devfs_device)(dev_t dev, struct devfs_dirent *de,
111 struct label *label);
112 void (*mpo_create_devfs_directory)(char *dirname, int dirnamelen,
113 struct devfs_dirent *de, struct label *label);
114 void (*mpo_create_devfs_vnode)(struct devfs_dirent *de,
115 struct label *direntlabel, struct vnode *vp,
116 struct label *vnodelabel);
117 void (*mpo_create_vnode)(struct ucred *cred, struct vnode *parent,
118 struct label *parentlabel, struct vnode *child,
119 struct label *childlabel);
120 void (*mpo_create_mount)(struct ucred *cred, struct mount *mp,
121 struct label *mntlabel, struct label *fslabel);
122 void (*mpo_create_root_mount)(struct ucred *cred, struct mount *mp,
123 struct label *mountlabel, struct label *fslabel);
124 void (*mpo_relabel_vnode)(struct ucred *cred, struct vnode *vp,
125 struct label *vnodelabel, struct label *label);
126 int (*mpo_stdcreatevnode_ea)(struct vnode *vp,
127 struct label *vnodelabel);
128 void (*mpo_update_devfsdirent)(struct devfs_dirent *devfs_dirent,
129 struct label *direntlabel, struct vnode *vp,
130 struct label *vnodelabel);
131 void (*mpo_update_procfsvnode)(struct vnode *vp,
132 struct label *vnodelabel, struct ucred *cred);
133 int (*mpo_update_vnode_from_extattr)(struct vnode *vp,
134 struct label *vnodelabel, struct mount *mp,
135 struct label *fslabel);
136 int (*mpo_update_vnode_from_externalized)(struct vnode *vp,
137 struct label *vnodelabel, struct mac *mac);
138 void (*mpo_update_vnode_from_mount)(struct vnode *vp,
139 struct label *vnodelabel, struct mount *mp,
140 struct label *fslabel);
143 * Labeling event operations: IPC objects.
145 void (*mpo_create_mbuf_from_socket)(struct socket *so,
146 struct label *socketlabel, struct mbuf *m,
147 struct label *mbuflabel);
148 void (*mpo_create_socket)(struct ucred *cred, struct socket *so,
149 struct label *socketlabel);
150 void (*mpo_create_socket_from_socket)(struct socket *oldsocket,
151 struct label *oldsocketlabel, struct socket *newsocket,
152 struct label *newsocketlabel);
153 void (*mpo_relabel_socket)(struct ucred *cred, struct socket *so,
154 struct label *oldlabel, struct label *newlabel);
155 void (*mpo_relabel_pipe)(struct ucred *cred, struct pipe *pipe,
156 struct label *oldlabel, struct label *newlabel);
157 void (*mpo_set_socket_peer_from_mbuf)(struct mbuf *mbuf,
158 struct label *mbuflabel, struct socket *so,
159 struct label *socketpeerlabel);
160 void (*mpo_set_socket_peer_from_socket)(struct socket *oldsocket,
161 struct label *oldsocketlabel, struct socket *newsocket,
162 struct label *newsocketpeerlabel);
163 void (*mpo_create_pipe)(struct ucred *cred, struct pipe *pipe,
164 struct label *pipelabel);
167 * Labeling event operations: network objects.
169 void (*mpo_create_bpfdesc)(struct ucred *cred, struct bpf_d *bpf_d,
170 struct label *bpflabel);
171 void (*mpo_create_ifnet)(struct ifnet *ifnet,
172 struct label *ifnetlabel);
173 void (*mpo_create_ipq)(struct mbuf *fragment,
174 struct label *fragmentlabel, struct ipq *ipq,
175 struct label *ipqlabel);
176 void (*mpo_create_datagram_from_ipq)
177 (struct ipq *ipq, struct label *ipqlabel,
178 struct mbuf *datagram, struct label *datagramlabel);
179 void (*mpo_create_fragment)(struct mbuf *datagram,
180 struct label *datagramlabel, struct mbuf *fragment,
181 struct label *fragmentlabel);
182 void (*mpo_create_mbuf_from_mbuf)(struct mbuf *oldmbuf,
183 struct label *oldlabel, struct mbuf *newmbuf,
184 struct label *newlabel);
185 void (*mpo_create_mbuf_linklayer)(struct ifnet *ifnet,
186 struct label *ifnetlabel, struct mbuf *mbuf,
187 struct label *mbuflabel);
188 void (*mpo_create_mbuf_from_bpfdesc)(struct bpf_d *bpf_d,
189 struct label *bpflabel, struct mbuf *mbuf,
190 struct label *mbuflabel);
191 void (*mpo_create_mbuf_from_ifnet)(struct ifnet *ifnet,
192 struct label *ifnetlabel, struct mbuf *mbuf,
193 struct label *mbuflabel);
194 void (*mpo_create_mbuf_multicast_encap)(struct mbuf *oldmbuf,
195 struct label *oldmbuflabel, struct ifnet *ifnet,
196 struct label *ifnetlabel, struct mbuf *newmbuf,
197 struct label *newmbuflabel);
198 void (*mpo_create_mbuf_netlayer)(struct mbuf *oldmbuf,
199 struct label *oldmbuflabel, struct mbuf *newmbuf,
200 struct label *newmbuflabel);
201 int (*mpo_fragment_match)(struct mbuf *fragment,
202 struct label *fragmentlabel, struct ipq *ipq,
203 struct label *ipqlabel);
204 void (*mpo_relabel_ifnet)(struct ucred *cred, struct ifnet *ifnet,
205 struct label *ifnetlabel, struct label *newlabel);
206 void (*mpo_update_ipq)(struct mbuf *fragment,
207 struct label *fragmentlabel, struct ipq *ipq,
208 struct label *ipqlabel);
211 * Labeling event operations: processes.
213 void (*mpo_create_cred)(struct ucred *parent_cred,
214 struct ucred *child_cred);
215 void (*mpo_execve_transition)(struct ucred *old, struct ucred *new,
216 struct vnode *vp, struct label *vnodelabel);
217 int (*mpo_execve_will_transition)(struct ucred *old,
218 struct vnode *vp, struct label *vnodelabel);
219 void (*mpo_create_proc0)(struct ucred *cred);
220 void (*mpo_create_proc1)(struct ucred *cred);
221 void (*mpo_relabel_cred)(struct ucred *cred,
222 struct label *newlabel);
225 * Access control checks.
227 int (*mpo_check_bpfdesc_receive)(struct bpf_d *bpf_d,
228 struct label *bpflabel, struct ifnet *ifnet,
229 struct label *ifnetlabel);
230 int (*mpo_check_cred_relabel)(struct ucred *cred,
231 struct label *newlabel);
232 int (*mpo_check_cred_visible)(struct ucred *u1, struct ucred *u2);
233 int (*mpo_check_ifnet_relabel)(struct ucred *cred,
234 struct ifnet *ifnet, struct label *ifnetlabel,
235 struct label *newlabel);
236 int (*mpo_check_ifnet_transmit)(struct ifnet *ifnet,
237 struct label *ifnetlabel, struct mbuf *m,
238 struct label *mbuflabel);
239 int (*mpo_check_mount_stat)(struct ucred *cred, struct mount *mp,
240 struct label *mntlabel);
241 int (*mpo_check_pipe_ioctl)(struct ucred *cred, struct pipe *pipe,
242 struct label *pipelabel, unsigned long cmd, void *data);
243 int (*mpo_check_pipe_poll)(struct ucred *cred, struct pipe *pipe,
244 struct label *pipelabel);
245 int (*mpo_check_pipe_read)(struct ucred *cred, struct pipe *pipe,
246 struct label *pipelabel);
247 int (*mpo_check_pipe_relabel)(struct ucred *cred,
248 struct pipe *pipe, struct label *pipelabel,
249 struct label *newlabel);
250 int (*mpo_check_pipe_stat)(struct ucred *cred, struct pipe *pipe,
251 struct label *pipelabel);
252 int (*mpo_check_pipe_write)(struct ucred *cred, struct pipe *pipe,
253 struct label *pipelabel);
254 int (*mpo_check_proc_debug)(struct ucred *cred,
256 int (*mpo_check_proc_sched)(struct ucred *cred,
258 int (*mpo_check_proc_signal)(struct ucred *cred,
259 struct proc *proc, int signum);
260 int (*mpo_check_socket_bind)(struct ucred *cred,
261 struct socket *so, struct label *socketlabel,
262 struct sockaddr *sockaddr);
263 int (*mpo_check_socket_connect)(struct ucred *cred,
264 struct socket *so, struct label *socketlabel,
265 struct sockaddr *sockaddr);
266 int (*mpo_check_socket_deliver)(struct socket *so,
267 struct label *socketlabel, struct mbuf *m,
268 struct label *mbuflabel);
269 int (*mpo_check_socket_listen)(struct ucred *cred,
270 struct socket *so, struct label *socketlabel);
271 int (*mpo_check_socket_relabel)(struct ucred *cred,
272 struct socket *so, struct label *socketlabel,
273 struct label *newlabel);
274 int (*mpo_check_socket_visible)(struct ucred *cred,
275 struct socket *so, struct label *socketlabel);
276 int (*mpo_check_vnode_access)(struct ucred *cred,
277 struct vnode *vp, struct label *label, int flags);
278 int (*mpo_check_vnode_chdir)(struct ucred *cred,
279 struct vnode *dvp, struct label *dlabel);
280 int (*mpo_check_vnode_chroot)(struct ucred *cred,
281 struct vnode *dvp, struct label *dlabel);
282 int (*mpo_check_vnode_create)(struct ucred *cred,
283 struct vnode *dvp, struct label *dlabel,
284 struct componentname *cnp, struct vattr *vap);
285 int (*mpo_check_vnode_delete)(struct ucred *cred,
286 struct vnode *dvp, struct label *dlabel,
287 struct vnode *vp, void *label, struct componentname *cnp);
288 int (*mpo_check_vnode_deleteacl)(struct ucred *cred,
289 struct vnode *vp, struct label *label, acl_type_t type);
290 int (*mpo_check_vnode_exec)(struct ucred *cred, struct vnode *vp,
291 struct label *label);
292 int (*mpo_check_vnode_getacl)(struct ucred *cred,
293 struct vnode *vp, struct label *label, acl_type_t type);
294 int (*mpo_check_vnode_getextattr)(struct ucred *cred,
295 struct vnode *vp, struct label *label, int attrnamespace,
296 const char *name, struct uio *uio);
297 int (*mpo_check_vnode_lookup)(struct ucred *cred,
298 struct vnode *dvp, struct label *dlabel,
299 struct componentname *cnp);
300 vm_prot_t (*mpo_check_vnode_mmap_perms)(struct ucred *cred,
301 struct vnode *vp, struct label *label, int newmapping);
302 int (*mpo_check_vnode_open)(struct ucred *cred, struct vnode *vp,
303 struct label *label, mode_t acc_mode);
304 int (*mpo_check_vnode_poll)(struct ucred *active_cred,
305 struct ucred *file_cred, struct vnode *vp,
306 struct label *label);
307 int (*mpo_check_vnode_read)(struct ucred *active_cred,
308 struct ucred *file_cred, struct vnode *vp,
309 struct label *label);
310 int (*mpo_check_vnode_readdir)(struct ucred *cred,
311 struct vnode *dvp, struct label *dlabel);
312 int (*mpo_check_vnode_readlink)(struct ucred *cred,
313 struct vnode *vp, struct label *label);
314 int (*mpo_check_vnode_relabel)(struct ucred *cred,
315 struct vnode *vp, struct label *vnodelabel,
316 struct label *newlabel);
317 int (*mpo_check_vnode_rename_from)(struct ucred *cred,
318 struct vnode *dvp, struct label *dlabel, struct vnode *vp,
319 struct label *label, struct componentname *cnp);
320 int (*mpo_check_vnode_rename_to)(struct ucred *cred,
321 struct vnode *dvp, struct label *dlabel, struct vnode *vp,
322 struct label *label, int samedir,
323 struct componentname *cnp);
324 int (*mpo_check_vnode_revoke)(struct ucred *cred,
325 struct vnode *vp, struct label *label);
326 int (*mpo_check_vnode_setacl)(struct ucred *cred,
327 struct vnode *vp, struct label *label, acl_type_t type,
329 int (*mpo_check_vnode_setextattr)(struct ucred *cred,
330 struct vnode *vp, struct label *label, int attrnamespace,
331 const char *name, struct uio *uio);
332 int (*mpo_check_vnode_setflags)(struct ucred *cred,
333 struct vnode *vp, struct label *label, u_long flags);
334 int (*mpo_check_vnode_setmode)(struct ucred *cred,
335 struct vnode *vp, struct label *label, mode_t mode);
336 int (*mpo_check_vnode_setowner)(struct ucred *cred,
337 struct vnode *vp, struct label *label, uid_t uid,
339 int (*mpo_check_vnode_setutimes)(struct ucred *cred,
340 struct vnode *vp, struct label *label,
341 struct timespec atime, struct timespec mtime);
342 int (*mpo_check_vnode_stat)(struct ucred *active_cred,
343 struct ucred *file_cred, struct vnode *vp,
344 struct label *label);
345 int (*mpo_check_vnode_write)(struct ucred *active_cred,
346 struct ucred *file_cred, struct vnode *vp,
347 struct label *label);
350 typedef const void *macop_t;
352 enum mac_op_constant {
359 MAC_INIT_DEVFSDIRENT,
370 MAC_DESTROY_DEVFSDIRENT,
381 MAC_CREATE_DEVFS_DEVICE,
382 MAC_CREATE_DEVFS_DIRECTORY,
383 MAC_CREATE_DEVFS_VNODE,
386 MAC_CREATE_ROOT_MOUNT,
388 MAC_STDCREATEVNODE_EA,
389 MAC_UPDATE_DEVFSDIRENT,
390 MAC_UPDATE_PROCFSVNODE,
391 MAC_UPDATE_VNODE_FROM_EXTATTR,
392 MAC_UPDATE_VNODE_FROM_EXTERNALIZED,
393 MAC_UPDATE_VNODE_FROM_MOUNT,
394 MAC_CREATE_MBUF_FROM_SOCKET,
397 MAC_CREATE_SOCKET_FROM_SOCKET,
400 MAC_SET_SOCKET_PEER_FROM_MBUF,
401 MAC_SET_SOCKET_PEER_FROM_SOCKET,
403 MAC_CREATE_DATAGRAM_FROM_IPQ,
407 MAC_CREATE_MBUF_FROM_MBUF,
408 MAC_CREATE_MBUF_LINKLAYER,
409 MAC_CREATE_MBUF_FROM_BPFDESC,
410 MAC_CREATE_MBUF_FROM_IFNET,
411 MAC_CREATE_MBUF_MULTICAST_ENCAP,
412 MAC_CREATE_MBUF_NETLAYER,
417 MAC_EXECVE_TRANSITION,
418 MAC_EXECVE_WILL_TRANSITION,
422 MAC_CHECK_BPFDESC_RECEIVE,
423 MAC_CHECK_CRED_RELABEL,
424 MAC_CHECK_CRED_VISIBLE,
425 MAC_CHECK_IFNET_RELABEL,
426 MAC_CHECK_IFNET_TRANSMIT,
427 MAC_CHECK_MOUNT_STAT,
428 MAC_CHECK_PIPE_IOCTL,
431 MAC_CHECK_PIPE_RELABEL,
433 MAC_CHECK_PIPE_WRITE,
434 MAC_CHECK_PROC_DEBUG,
435 MAC_CHECK_PROC_SCHED,
436 MAC_CHECK_PROC_SIGNAL,
437 MAC_CHECK_SOCKET_BIND,
438 MAC_CHECK_SOCKET_CONNECT,
439 MAC_CHECK_SOCKET_DELIVER,
440 MAC_CHECK_SOCKET_LISTEN,
441 MAC_CHECK_SOCKET_RELABEL,
442 MAC_CHECK_SOCKET_VISIBLE,
443 MAC_CHECK_VNODE_ACCESS,
444 MAC_CHECK_VNODE_CHDIR,
445 MAC_CHECK_VNODE_CHROOT,
446 MAC_CHECK_VNODE_CREATE,
447 MAC_CHECK_VNODE_DELETE,
448 MAC_CHECK_VNODE_DELETEACL,
449 MAC_CHECK_VNODE_EXEC,
450 MAC_CHECK_VNODE_GETACL,
451 MAC_CHECK_VNODE_GETEXTATTR,
452 MAC_CHECK_VNODE_LOOKUP,
453 MAC_CHECK_VNODE_MMAP_PERMS,
454 MAC_CHECK_VNODE_OPEN,
455 MAC_CHECK_VNODE_POLL,
456 MAC_CHECK_VNODE_READ,
457 MAC_CHECK_VNODE_READDIR,
458 MAC_CHECK_VNODE_READLINK,
459 MAC_CHECK_VNODE_RELABEL,
460 MAC_CHECK_VNODE_RENAME_FROM,
461 MAC_CHECK_VNODE_RENAME_TO,
462 MAC_CHECK_VNODE_REVOKE,
463 MAC_CHECK_VNODE_SETACL,
464 MAC_CHECK_VNODE_SETEXTATTR,
465 MAC_CHECK_VNODE_SETFLAGS,
466 MAC_CHECK_VNODE_SETMODE,
467 MAC_CHECK_VNODE_SETOWNER,
468 MAC_CHECK_VNODE_SETUTIMES,
469 MAC_CHECK_VNODE_STAT,
470 MAC_CHECK_VNODE_WRITE,
473 struct mac_policy_op_entry {
474 enum mac_op_constant mpe_constant; /* what this hook implements */
475 macop_t mpe_function; /* hook's implementation */
478 struct mac_policy_conf {
479 char *mpc_name; /* policy name */
480 char *mpc_fullname; /* policy full name */
481 struct mac_policy_ops *mpc_ops; /* policy operations */
482 struct mac_policy_op_entry *mpc_entries; /* ops to fill in */
483 int mpc_loadtime_flags; /* flags */
484 int *mpc_field_off; /* security field */
485 int mpc_runtime_flags; /* flags */
486 LIST_ENTRY(mac_policy_conf) mpc_list; /* global list */
489 /* Flags for the mpc_loadtime_flags field. */
490 #define MPC_LOADTIME_FLAG_NOTLATE 0x00000001
491 #define MPC_LOADTIME_FLAG_UNLOADOK 0x00000002
493 /* Flags for the mpc_runtime_flags field. */
494 #define MPC_RUNTIME_FLAG_REGISTERED 0x00000001
496 #define MAC_POLICY_SET(mpents, mpname, mpfullname, mpflags, privdata_wanted) \
497 static struct mac_policy_conf mpname##_mac_policy_conf = { \
506 static moduledata_t mpname##_mod = { \
508 mac_policy_modevent, \
509 &mpname##_mac_policy_conf \
511 MODULE_DEPEND(mpname, kernel_mac_support, 1, 1, 1); \
512 DECLARE_MODULE(mpname, mpname##_mod, SI_SUB_MAC_POLICY, \
515 int mac_policy_modevent(module_t mod, int type, void *data);
517 #define LABEL_TO_SLOT(l, s) (l)->l_perpolicy[s]
519 #endif /* !_SYS_MAC_POLICY_H */