1/*
2 * Copyright (c) 2004-2016 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28
29/*
30 * Centralized authorisation framework.
31 */
32
33#include <sys/appleapiopts.h>
34#include <sys/param.h> /* XXX trim includes */
35#include <sys/acct.h>
36#include <sys/systm.h>
37#include <sys/ucred.h>
38#include <sys/proc_internal.h>
39#include <sys/timeb.h>
40#include <sys/times.h>
41#include <sys/malloc.h>
42#include <sys/vnode_internal.h>
43#include <sys/kauth.h>
44#include <sys/stat.h>
45
46#include <security/audit/audit.h>
47
48#include <sys/mount.h>
49#include <sys/sysproto.h>
50#include <mach/message.h>
51#include <mach/host_security.h>
52
53#include <kern/locks.h>
54
55
56/*
57 * Authorization scopes.
58 */
59
60lck_grp_t *kauth_lck_grp;
61static lck_mtx_t *kauth_scope_mtx;
62#define KAUTH_SCOPELOCK() lck_mtx_lock(kauth_scope_mtx);
63#define KAUTH_SCOPEUNLOCK() lck_mtx_unlock(kauth_scope_mtx);
64
65/*
66 * We support listeners for scopes that have not been registered yet.
67 * If a listener comes in for a scope that is not active we hang the listener
68 * off our kauth_dangling_listeners list and once the scope becomes active we
69 * remove it from kauth_dangling_listeners and add it to the active scope.
70 */
71struct kauth_listener {
72 TAILQ_ENTRY(kauth_listener) kl_link;
73 const char * kl_identifier;
74 kauth_scope_callback_t kl_callback;
75 void * kl_idata;
76};
77
78/* XXX - kauth_todo - there is a race if a scope listener is removed while we
79 * we are in the kauth_authorize_action code path. We intentionally do not take
80 * a scope lock in order to get the best possible performance. we will fix this
81 * post Tiger.
82 * Until the race is fixed our kext clients are responsible for all active
83 * requests that may be in their callback code or on the way to their callback
84 * code before they free kauth_listener.kl_callback or kauth_listener.kl_idata.
85 * We keep copies of these in our kauth_local_listener in an attempt to limit
86 * our expose to unlisten race.
87 */
88struct kauth_local_listener {
89 kauth_listener_t kll_listenerp;
90 kauth_scope_callback_t kll_callback;
91 void * kll_idata;
92};
93typedef struct kauth_local_listener *kauth_local_listener_t;
94
95static TAILQ_HEAD(,kauth_listener) kauth_dangling_listeners;
96
97/*
98 * Scope listeners need to be reworked to be dynamic.
99 * We intentionally used a static table to avoid locking issues with linked
100 * lists. The listeners may be called quite often.
101 * XXX - kauth_todo
102 */
103#define KAUTH_SCOPE_MAX_LISTENERS 15
104
105struct kauth_scope {
106 TAILQ_ENTRY(kauth_scope) ks_link;
107 volatile struct kauth_local_listener ks_listeners[KAUTH_SCOPE_MAX_LISTENERS];
108 const char * ks_identifier;
109 kauth_scope_callback_t ks_callback;
110 void * ks_idata;
111 u_int ks_flags;
112};
113
114/* values for kauth_scope.ks_flags */
115#define KS_F_HAS_LISTENERS (1 << 0)
116
117static TAILQ_HEAD(,kauth_scope) kauth_scopes;
118
119static int kauth_add_callback_to_scope(kauth_scope_t sp, kauth_listener_t klp);
120static void kauth_scope_init(void);
121static kauth_scope_t kauth_alloc_scope(const char *identifier, kauth_scope_callback_t callback, void *idata);
122static kauth_listener_t kauth_alloc_listener(const char *identifier, kauth_scope_callback_t callback, void *idata);
123#if 0
124static int kauth_scope_valid(kauth_scope_t scope);
125#endif
126
127kauth_scope_t kauth_scope_process;
128static int kauth_authorize_process_callback(kauth_cred_t _credential, void *_idata, kauth_action_t _action,
129 uintptr_t arg0, uintptr_t arg1, __unused uintptr_t arg2, __unused uintptr_t arg3);
130kauth_scope_t kauth_scope_generic;
131static int kauth_authorize_generic_callback(kauth_cred_t _credential, void *_idata, kauth_action_t _action,
132 uintptr_t arg0, uintptr_t arg1, uintptr_t arg2, uintptr_t arg3);
133kauth_scope_t kauth_scope_fileop;
134
135extern int cansignal(struct proc *, kauth_cred_t, struct proc *, int);
136extern char * get_pathbuff(void);
137extern void release_pathbuff(char *path);
138
139/*
140 * Initialization.
141 */
142void
143kauth_init(void)
144{
145 lck_grp_attr_t *grp_attributes;
146
147 TAILQ_INIT(&kauth_scopes);
148 TAILQ_INIT(&kauth_dangling_listeners);
149
150 /* set up our lock group */
151 grp_attributes = lck_grp_attr_alloc_init();
152 kauth_lck_grp = lck_grp_alloc_init("kauth", grp_attributes);
153 lck_grp_attr_free(grp_attributes);
154
155 /* bring up kauth subsystem components */
156 kauth_cred_init();
157#if CONFIG_EXT_RESOLVER
158 kauth_identity_init();
159 kauth_groups_init();
160#endif
161 kauth_scope_init();
162#if CONFIG_EXT_RESOLVER
163 kauth_resolver_init();
164#endif
165 /* can't alloc locks after this */
166 lck_grp_free(kauth_lck_grp);
167 kauth_lck_grp = NULL;
168}
169
170static void
171kauth_scope_init(void)
172{
173 kauth_scope_mtx = lck_mtx_alloc_init(kauth_lck_grp, 0 /*LCK_ATTR_NULL*/);
174 kauth_scope_process = kauth_register_scope(KAUTH_SCOPE_PROCESS, kauth_authorize_process_callback, NULL);
175 kauth_scope_generic = kauth_register_scope(KAUTH_SCOPE_GENERIC, kauth_authorize_generic_callback, NULL);
176 kauth_scope_fileop = kauth_register_scope(KAUTH_SCOPE_FILEOP, NULL, NULL);
177}
178
179/*
180 * Scope registration.
181 */
182
183static kauth_scope_t
184kauth_alloc_scope(const char *identifier, kauth_scope_callback_t callback, void *idata)
185{
186 kauth_scope_t sp;
187
188 /*
189 * Allocate and populate the scope structure.
190 */
191 MALLOC(sp, kauth_scope_t, sizeof(*sp), M_KAUTH, M_WAITOK | M_ZERO);
192 if (sp == NULL)
193 return(NULL);
194 sp->ks_flags = 0;
195 sp->ks_identifier = identifier;
196 sp->ks_idata = idata;
197 sp->ks_callback = callback;
198 return(sp);
199}
200
201static kauth_listener_t
202kauth_alloc_listener(const char *identifier, kauth_scope_callback_t callback, void *idata)
203{
204 kauth_listener_t lsp;
205
206 /*
207 * Allocate and populate the listener structure.
208 */
209 MALLOC(lsp, kauth_listener_t, sizeof(*lsp), M_KAUTH, M_WAITOK);
210 if (lsp == NULL)
211 return(NULL);
212 lsp->kl_identifier = identifier;
213 lsp->kl_idata = idata;
214 lsp->kl_callback = callback;
215 return(lsp);
216}
217
218kauth_scope_t
219kauth_register_scope(const char *identifier, kauth_scope_callback_t callback, void *idata)
220{
221 kauth_scope_t sp, tsp;
222 kauth_listener_t klp;
223
224 if ((sp = kauth_alloc_scope(identifier, callback, idata)) == NULL)
225 return(NULL);
226
227 /*
228 * Lock the list and insert.
229 */
230 KAUTH_SCOPELOCK();
231 TAILQ_FOREACH(tsp, &kauth_scopes, ks_link) {
232 /* duplicate! */
233 if (strncmp(tsp->ks_identifier, identifier,
234 strlen(tsp->ks_identifier) + 1) == 0) {
235 KAUTH_SCOPEUNLOCK();
236 FREE(sp, M_KAUTH);
237 return(NULL);
238 }
239 }
240 TAILQ_INSERT_TAIL(&kauth_scopes, sp, ks_link);
241
242 /*
243 * Look for listeners waiting for this scope, move them to the active scope
244 * listener table.
245 * Note that we have to restart the scan every time we remove an entry
246 * from the list, since we can't remove the current item from the list.
247 */
248restart:
249 TAILQ_FOREACH(klp, &kauth_dangling_listeners, kl_link) {
250 if (strncmp(klp->kl_identifier, sp->ks_identifier,
251 strlen(klp->kl_identifier) + 1) == 0) {
252 /* found a match on the dangling listener list. add it to the
253 * the active scope.
254 */
255 if (kauth_add_callback_to_scope(sp, klp) == 0) {
256 TAILQ_REMOVE(&kauth_dangling_listeners, klp, kl_link);
257 }
258 else {
259#if 0
260 printf("%s - failed to add listener to scope \"%s\" \n", __FUNCTION__, sp->ks_identifier);
261#endif
262 break;
263 }
264 goto restart;
265 }
266 }
267
268 KAUTH_SCOPEUNLOCK();
269 return(sp);
270}
271
272
273
274void
275kauth_deregister_scope(kauth_scope_t scope)
276{
277 int i;
278
279 KAUTH_SCOPELOCK();
280
281 TAILQ_REMOVE(&kauth_scopes, scope, ks_link);
282
283 /* relocate listeners back to the waiting list */
284 for (i = 0; i < KAUTH_SCOPE_MAX_LISTENERS; i++) {
285 if (scope->ks_listeners[i].kll_listenerp != NULL) {
286 TAILQ_INSERT_TAIL(&kauth_dangling_listeners, scope->ks_listeners[i].kll_listenerp, kl_link);
287 scope->ks_listeners[i].kll_listenerp = NULL;
288 /*
289 * XXX - kauth_todo - WARNING, do not clear kll_callback or
290 * kll_idata here. they are part of our scope unlisten race hack
291 */
292 }
293 }
294 KAUTH_SCOPEUNLOCK();
295 FREE(scope, M_KAUTH);
296
297 return;
298}
299
300kauth_listener_t
301kauth_listen_scope(const char *identifier, kauth_scope_callback_t callback, void *idata)
302{
303 kauth_listener_t klp;
304 kauth_scope_t sp;
305
306 if ((klp = kauth_alloc_listener(identifier, callback, idata)) == NULL)
307 return(NULL);
308
309 /*
310 * Lock the scope list and check to see whether this scope already exists.
311 */
312 KAUTH_SCOPELOCK();
313 TAILQ_FOREACH(sp, &kauth_scopes, ks_link) {
314 if (strncmp(sp->ks_identifier, identifier,
315 strlen(sp->ks_identifier) + 1) == 0) {
316 /* scope exists, add it to scope listener table */
317 if (kauth_add_callback_to_scope(sp, klp) == 0) {
318 KAUTH_SCOPEUNLOCK();
319 return(klp);
320 }
321 /* table already full */
322 KAUTH_SCOPEUNLOCK();
323 FREE(klp, M_KAUTH);
324 return(NULL);
325 }
326 }
327
328 /* scope doesn't exist, put on waiting list. */
329 TAILQ_INSERT_TAIL(&kauth_dangling_listeners, klp, kl_link);
330
331 KAUTH_SCOPEUNLOCK();
332
333 return(klp);
334}
335
336void
337kauth_unlisten_scope(kauth_listener_t listener)
338{
339 kauth_scope_t sp;
340 kauth_listener_t klp;
341 int i, listener_count, do_free;
342
343 KAUTH_SCOPELOCK();
344
345 /* search the active scope for this listener */
346 TAILQ_FOREACH(sp, &kauth_scopes, ks_link) {
347 do_free = 0;
348 if ((sp->ks_flags & KS_F_HAS_LISTENERS) != 0) {
349 listener_count = 0;
350 for (i = 0; i < KAUTH_SCOPE_MAX_LISTENERS; i++) {
351 if (sp->ks_listeners[i].kll_listenerp == listener) {
352 sp->ks_listeners[i].kll_listenerp = NULL;
353 do_free = 1;
354 /*
355 * XXX - kauth_todo - WARNING, do not clear kll_callback or
356 * kll_idata here. they are part of our scope unlisten race hack
357 */
358 }
359 else if (sp->ks_listeners[i].kll_listenerp != NULL) {
360 listener_count++;
361 }
362 }
363 if (do_free) {
364 if (listener_count == 0) {
365 sp->ks_flags &= ~KS_F_HAS_LISTENERS;
366 }
367 KAUTH_SCOPEUNLOCK();
368 FREE(listener, M_KAUTH);
369 return;
370 }
371 }
372 }
373
374 /* if not active, check the dangling list */
375 TAILQ_FOREACH(klp, &kauth_dangling_listeners, kl_link) {
376 if (klp == listener) {
377 TAILQ_REMOVE(&kauth_dangling_listeners, klp, kl_link);
378 KAUTH_SCOPEUNLOCK();
379 FREE(listener, M_KAUTH);
380 return;
381 }
382 }
383
384 KAUTH_SCOPEUNLOCK();
385 return;
386}
387
388/*
389 * Authorization requests.
390 *
391 * Returns: 0 Success
392 * EPERM Operation not permitted
393 *
394 * Imputed: *arg3, modified Callback return - depends on callback
395 * modification of *arg3, if any
396 */
397int
398kauth_authorize_action(kauth_scope_t scope, kauth_cred_t credential, kauth_action_t action,
399 uintptr_t arg0, uintptr_t arg1, uintptr_t arg2, uintptr_t arg3)
400{
401 int result, ret, i;
402
403 /* ask the scope */
404 if (scope->ks_callback != NULL)
405 result = scope->ks_callback(credential, scope->ks_idata, action, arg0, arg1, arg2, arg3);
406 else
407 result = KAUTH_RESULT_DEFER;
408
409 /* check with listeners */
410 if ((scope->ks_flags & KS_F_HAS_LISTENERS) != 0) {
411 for (i = 0; i < KAUTH_SCOPE_MAX_LISTENERS; i++) {
412 /* XXX - kauth_todo - there is a race here if listener is removed - we will fix this post Tiger.
413 * Until the race is fixed our kext clients are responsible for all active requests that may
414 * be in their callbacks or on the way to their callbacks before they free kl_callback or kl_idata.
415 * We keep copies of these in our kauth_local_listener in an attempt to limit our expose to
416 * unlisten race.
417 */
418 if (scope->ks_listeners[i].kll_listenerp == NULL ||
419 scope->ks_listeners[i].kll_callback == NULL)
420 continue;
421
422 ret = scope->ks_listeners[i].kll_callback(
423 credential, scope->ks_listeners[i].kll_idata,
424 action, arg0, arg1, arg2, arg3);
425 if ((ret == KAUTH_RESULT_DENY) ||
426 (result == KAUTH_RESULT_DEFER))
427 result = ret;
428 }
429 }
430
431 /* we need an explicit allow, or the auth fails */
432 /* XXX need a mechanism for auth failure to be signalled vs. denial */
433 return(result == KAUTH_RESULT_ALLOW ? 0 : EPERM);
434}
435
436/*
437 * Default authorization handlers.
438 */
439int
440kauth_authorize_allow(__unused kauth_cred_t credential, __unused void *idata, __unused kauth_action_t action,
441 __unused uintptr_t arg0, __unused uintptr_t arg1, __unused uintptr_t arg2, __unused uintptr_t arg3)
442{
443
444 return(KAUTH_RESULT_ALLOW);
445}
446
447#if 0
448/*
449 * Debugging support.
450 */
451static int
452kauth_scope_valid(kauth_scope_t scope)
453{
454 kauth_scope_t sp;
455
456 KAUTH_SCOPELOCK();
457 TAILQ_FOREACH(sp, &kauth_scopes, ks_link) {
458 if (sp == scope)
459 break;
460 }
461 KAUTH_SCOPEUNLOCK();
462 return((sp == NULL) ? 0 : 1);
463}
464#endif
465
466/*
467 * Process authorization scope.
468 */
469
470int
471kauth_authorize_process(kauth_cred_t credential, kauth_action_t action, struct proc *process, uintptr_t arg1, uintptr_t arg2, uintptr_t arg3)
472{
473 return(kauth_authorize_action(kauth_scope_process, credential, action, (uintptr_t)process, arg1, arg2, arg3));
474}
475
476static int
477kauth_authorize_process_callback(kauth_cred_t credential, __unused void *idata, kauth_action_t action,
478 uintptr_t arg0, uintptr_t arg1, __unused uintptr_t arg2, __unused uintptr_t arg3)
479{
480 switch(action) {
481 case KAUTH_PROCESS_CANSIGNAL:
482 panic("KAUTH_PROCESS_CANSIGNAL not implemented");
483 /* XXX credential wrong here */
484 /* arg0 - process to signal
485 * arg1 - signal to send the process
486 */
487 if (cansignal(current_proc(), credential, (struct proc *)arg0, (int)arg1))
488 return(KAUTH_RESULT_ALLOW);
489 break;
490 case KAUTH_PROCESS_CANTRACE:
491 /* current_proc() - process that will do the tracing
492 * arg0 - process to be traced
493 * arg1 - pointer to int - reason (errno) for denial
494 */
495 if (cantrace(current_proc(), credential, (proc_t)arg0, (int *)arg1))
496 return(KAUTH_RESULT_ALLOW);
497 break;
498 }
499
500 /* no explicit result, so defer to others in the chain */
501 return(KAUTH_RESULT_DEFER);
502}
503
504/*
505 * File system operation authorization scope. This is really only a notification
506 * of the file system operation, not an authorization check. Thus the result is
507 * not relevant.
508 * arguments passed to KAUTH_FILEOP_OPEN listeners
509 * arg0 is pointer to vnode (vnode *) for given user path.
510 * arg1 is pointer to path (char *) passed in to open.
511 * arguments passed to KAUTH_FILEOP_CLOSE listeners
512 * arg0 is pointer to vnode (vnode *) for file to be closed.
513 * arg1 is pointer to path (char *) of file to be closed.
514 * arg2 is close flags.
515 * arguments passed to KAUTH_FILEOP_WILL_RENAME listeners
516 * arg0 is pointer to vnode (vnode *) of the file being renamed
517 * arg1 is pointer to the "from" path (char *)
518 * arg2 is pointer to the "to" path (char *)
519 * arguments passed to KAUTH_FILEOP_RENAME listeners
520 * arg0 is pointer to "from" path (char *).
521 * arg1 is pointer to "to" path (char *).
522 * arguments passed to KAUTH_FILEOP_EXCHANGE listeners
523 * arg0 is pointer to file 1 path (char *).
524 * arg1 is pointer to file 2 path (char *).
525 * arguments passed to KAUTH_FILEOP_EXEC listeners
526 * arg0 is pointer to vnode (vnode *) for executable.
527 * arg1 is pointer to path (char *) to executable.
528 */
529
530int
531kauth_authorize_fileop_has_listeners(void)
532{
533 /*
534 * return 1 if we have any listeners for the fileop scope
535 * otherwize return 0
536 */
537 if ((kauth_scope_fileop->ks_flags & KS_F_HAS_LISTENERS) != 0) {
538 return(1);
539 }
540 return (0);
541}
542
543int
544kauth_authorize_fileop(kauth_cred_t credential, kauth_action_t action, uintptr_t arg0, uintptr_t arg1)
545{
546 char *namep = NULL;
547 int name_len;
548 uintptr_t arg2 = 0;
549
550 /* we do not have a primary handler for the fileop scope so bail out if
551 * there are no listeners.
552 */
553 if ((kauth_scope_fileop->ks_flags & KS_F_HAS_LISTENERS) == 0) {
554 return(0);
555 }
556
557 if (action == KAUTH_FILEOP_OPEN ||
558 action == KAUTH_FILEOP_CLOSE ||
559 action == KAUTH_FILEOP_EXEC ||
560 action == KAUTH_FILEOP_WILL_RENAME) {
561 /* get path to the given vnode as a convenience to our listeners.
562 */
563 namep = get_pathbuff();
564 name_len = MAXPATHLEN;
565 if (vn_getpath((vnode_t)arg0, namep, &name_len) != 0) {
566 release_pathbuff(namep);
567 return(0);
568 }
569 if (action == KAUTH_FILEOP_CLOSE ||
570 action == KAUTH_FILEOP_WILL_RENAME) {
571 /*
572 * - Close has some flags that come in via arg1.
573 * - Will-rename wants to pass the vnode and
574 * both paths to the listeners ("to" path
575 * starts in arg1, moves to arg2).
576 */
577 arg2 = arg1;
578 }
579 arg1 = (uintptr_t)namep;
580 }
581 kauth_authorize_action(kauth_scope_fileop, credential, action, arg0, arg1, arg2, 0);
582
583 if (namep != NULL) {
584 release_pathbuff(namep);
585 }
586
587 return(0);
588}
589
590/*
591 * Generic authorization scope.
592 */
593
594int
595kauth_authorize_generic(kauth_cred_t credential, kauth_action_t action)
596{
597 if (credential == NULL)
598 panic("auth against NULL credential");
599
600 return(kauth_authorize_action(kauth_scope_generic, credential, action, 0, 0, 0, 0));
601
602}
603
604static int
605kauth_authorize_generic_callback(kauth_cred_t credential, __unused void *idata, kauth_action_t action,
606 __unused uintptr_t arg0, __unused uintptr_t arg1, __unused uintptr_t arg2, __unused uintptr_t arg3)
607{
608 switch(action) {
609 case KAUTH_GENERIC_ISSUSER:
610 /* XXX == 0 ? */
611 return((kauth_cred_getuid(credential) == 0) ?
612 KAUTH_RESULT_ALLOW : KAUTH_RESULT_DENY);
613 }
614
615 /* no explicit result, so defer to others in the chain */
616 return(KAUTH_RESULT_DEFER);
617}
618
619/*
620 * ACL evaluator.
621 *
622 * Determines whether the credential has the requested rights for an object secured by the supplied
623 * ACL.
624 *
625 * Evaluation proceeds from the top down, with access denied if any ACE denies any of the requested
626 * rights, or granted if all of the requested rights are satisfied by the ACEs so far.
627 */
628int
629kauth_acl_evaluate(kauth_cred_t cred, kauth_acl_eval_t eval)
630{
631 int applies, error, i, gotguid;
632 kauth_ace_t ace;
633 guid_t guid;
634 uint32_t rights;
635 int wkguid;
636
637 /* always allowed to do nothing */
638 if (eval->ae_requested == 0) {
639 eval->ae_result = KAUTH_RESULT_ALLOW;
640 return(0);
641 }
642
643 eval->ae_residual = eval->ae_requested;
644 eval->ae_found_deny = FALSE;
645
646 /*
647 * Get our guid for comparison purposes.
648 */
649 if ((error = kauth_cred_getguid(cred, &guid)) != 0) {
650 KAUTH_DEBUG(" ACL - can't get credential GUID (%d)", error);
651 error = 0;
652 gotguid = 0;
653 } else {
654 gotguid = 1;
655 }
656
657 KAUTH_DEBUG(" ACL - %d entries, initial residual %x", eval->ae_count, eval->ae_residual);
658 for (i = 0, ace = eval->ae_acl; i < eval->ae_count; i++, ace++) {
659
660 /*
661 * Skip inherit-only entries.
662 */
663 if (ace->ace_flags & KAUTH_ACE_ONLY_INHERIT)
664 continue;
665
666 /*
667 * Expand generic rights, if appropriate.
668 */
669 rights = ace->ace_rights;
670 if (rights & KAUTH_ACE_GENERIC_ALL)
671 rights |= eval->ae_exp_gall;
672 if (rights & KAUTH_ACE_GENERIC_READ)
673 rights |= eval->ae_exp_gread;
674 if (rights & KAUTH_ACE_GENERIC_WRITE)
675 rights |= eval->ae_exp_gwrite;
676 if (rights & KAUTH_ACE_GENERIC_EXECUTE)
677 rights |= eval->ae_exp_gexec;
678
679 /*
680 * Determine whether this entry applies to the current request. This
681 * saves us checking the GUID if the entry has nothing to do with what
682 * we're currently doing.
683 */
684 switch(ace->ace_flags & KAUTH_ACE_KINDMASK) {
685 case KAUTH_ACE_PERMIT:
686 if (!(eval->ae_residual & rights))
687 continue;
688 break;
689 case KAUTH_ACE_DENY:
690 if (!(eval->ae_requested & rights))
691 continue;
692 eval->ae_found_deny = TRUE;
693 break;
694 default:
695 /* we don't recognise this ACE, skip it */
696 continue;
697 }
698
699 /*
700 * Verify whether this entry applies to the credential.
701 */
702 wkguid = kauth_wellknown_guid(&ace->ace_applicable);
703 switch(wkguid) {
704 case KAUTH_WKG_OWNER:
705 applies = eval->ae_options & KAUTH_AEVAL_IS_OWNER;
706 break;
707 case KAUTH_WKG_GROUP:
708 if (!gotguid || (eval->ae_options & KAUTH_AEVAL_IN_GROUP_UNKNOWN))
709 applies = ((ace->ace_flags & KAUTH_ACE_KINDMASK) == KAUTH_ACE_DENY);
710 else
711 applies = eval->ae_options & KAUTH_AEVAL_IN_GROUP;
712 break;
713 /* we short-circuit these here rather than wasting time calling the group membership code */
714 case KAUTH_WKG_EVERYBODY:
715 applies = 1;
716 break;
717 case KAUTH_WKG_NOBODY:
718 applies = 0;
719 break;
720
721 default:
722 /* check to see whether it's exactly us, or a group we are a member of */
723 applies = !gotguid ? 0 : kauth_guid_equal(&guid, &ace->ace_applicable);
724 KAUTH_DEBUG(" ACL - ACE applicable " K_UUID_FMT " caller " K_UUID_FMT " %smatched",
725 K_UUID_ARG(ace->ace_applicable), K_UUID_ARG(guid), applies ? "" : "not ");
726
727 if (!applies) {
728 error = !gotguid ? ENOENT : kauth_cred_ismember_guid(cred, &ace->ace_applicable, &applies);
729 /*
730 * If we can't resolve group membership, we have to limit misbehaviour.
731 * If the ACE is an 'allow' ACE, assume the cred is not a member (avoid
732 * granting excess access). If the ACE is a 'deny' ACE, assume the cred
733 * is a member (avoid failing to deny).
734 */
735 if (error != 0) {
736 KAUTH_DEBUG(" ACL[%d] - can't get membership, making pessimistic assumption", i);
737 switch(ace->ace_flags & KAUTH_ACE_KINDMASK) {
738 case KAUTH_ACE_PERMIT:
739 applies = 0;
740 break;
741 case KAUTH_ACE_DENY:
742 applies = 1;
743 break;
744 }
745 } else {
746 KAUTH_DEBUG(" ACL - %s group member", applies ? "is" : "not");
747 }
748 } else {
749 KAUTH_DEBUG(" ACL - entry matches caller");
750 }
751 }
752 if (!applies)
753 continue;
754
755 /*
756 * Apply ACE to outstanding rights.
757 */
758 switch(ace->ace_flags & KAUTH_ACE_KINDMASK) {
759 case KAUTH_ACE_PERMIT:
760 /* satisfy any rights that this ACE grants */
761 eval->ae_residual = eval->ae_residual & ~rights;
762 KAUTH_DEBUG(" ACL[%d] - rights %x leave residual %x", i, rights, eval->ae_residual);
763 /* all rights satisfied? */
764 if (eval->ae_residual == 0) {
765 eval->ae_result = KAUTH_RESULT_ALLOW;
766 return(0);
767 }
768 break;
769 case KAUTH_ACE_DENY:
770 /* deny the request if any of the requested rights is denied */
771 if (eval->ae_requested & rights) {
772 KAUTH_DEBUG(" ACL[%d] - denying based on %x", i, rights);
773 eval->ae_result = KAUTH_RESULT_DENY;
774 return(0);
775 }
776 break;
777 default:
778 KAUTH_DEBUG(" ACL - unknown entry kind %d", ace->ace_flags & KAUTH_ACE_KINDMASK);
779 break;
780 }
781 }
782 /* if not permitted, defer to other modes of authorisation */
783 eval->ae_result = KAUTH_RESULT_DEFER;
784 return(0);
785}
786
787/*
788 * Perform ACL inheritance and umask-ACL handling.
789 *
790 * Entries are inherited from the ACL on dvp. A caller-supplied
791 * ACL is in initial, and the result is output into product.
792 * If the process has a umask ACL and one is not supplied, we use
793 * the umask ACL.
794 * If isdir is set, the resultant ACL is for a directory, otherwise it is for a file.
795 */
796int
797kauth_acl_inherit(vnode_t dvp, kauth_acl_t initial, kauth_acl_t *product, int isdir, vfs_context_t ctx)
798{
799 int entries, error, index;
800 unsigned int i;
801 struct vnode_attr dva;
802 kauth_acl_t inherit, result;
803
804 /*
805 * Fetch the ACL from the directory. This should never fail.
806 * Note that we don't manage inheritance when the remote server is
807 * doing authorization, since this means server enforcement of
808 * inheritance semantics; we just want to compose the initial
809 * ACL and any inherited ACE entries from the container object.
810 *
811 * XXX TODO: <rdar://3634665> wants a "umask ACL" from the process.
812 */
813 inherit = NULL;
814 /*
815 * If there is no initial ACL, or there is, and the initial ACLs
816 * flags do not request "no inheritance", then we inherit. This allows
817 * initial object creation via open_extended() and mkdir_extended()
818 * to reject inheritance for themselves and for inferior nodes by
819 * specifying a non-NULL inital ACL which has the KAUTH_ACL_NO_INHERIT
820 * flag set in the flags field.
821 */
822 if ((initial == NULL || !(initial->acl_flags & KAUTH_ACL_NO_INHERIT)) &&
823 (dvp != NULL) && !vfs_authopaque(vnode_mount(dvp))) {
824 VATTR_INIT(&dva);
825 VATTR_WANTED(&dva, va_acl);
826 if ((error = vnode_getattr(dvp, &dva, ctx)) != 0) {
827 KAUTH_DEBUG(" ERROR - could not get parent directory ACL for inheritance");
828 return(error);
829 }
830 if (VATTR_IS_SUPPORTED(&dva, va_acl))
831 inherit = dva.va_acl;
832 }
833
834 /*
835 * Compute the number of entries in the result ACL by scanning the
836 * input lists.
837 */
838 entries = 0;
839 if (inherit != NULL) {
840 for (i = 0; i < inherit->acl_entrycount; i++) {
841 if (inherit->acl_ace[i].ace_flags & (isdir ? KAUTH_ACE_DIRECTORY_INHERIT : KAUTH_ACE_FILE_INHERIT))
842 entries++;
843 }
844 }
845
846 if (initial == NULL) {
847 /*
848 * XXX 3634665 TODO: if the initial ACL is not specfied by
849 * XXX the caller, fetch the umask ACL from the process,
850 * and use it in place of "initial".
851 */
852 }
853
854 if (initial != NULL) {
855 if (initial->acl_entrycount != KAUTH_FILESEC_NOACL)
856 entries += initial->acl_entrycount;
857 else
858 initial = NULL;
859 }
860
861 /*
862 * If there is no initial ACL, and no inheritable entries, the
863 * object should be created with no ACL at all.
864 * Note that this differs from the case where the initial ACL
865 * is empty, in which case the object must also have an empty ACL.
866 */
867 if ((entries == 0) && (initial == NULL)) {
868 *product = NULL;
869 error = 0;
870 goto out;
871 }
872
873 /*
874 * Allocate the result buffer.
875 */
876 if ((result = kauth_acl_alloc(entries)) == NULL) {
877 KAUTH_DEBUG(" ERROR - could not allocate %d-entry result buffer for inherited ACL", entries);
878 error = ENOMEM;
879 goto out;
880 }
881
882 /*
883 * Composition is simply:
884 * - initial direct ACEs
885 * - inherited ACEs from new parent
886 */
887 index = 0;
888 if (initial != NULL) {
889 for (i = 0; i < initial->acl_entrycount; i++) {
890 if (!(initial->acl_ace[i].ace_flags & KAUTH_ACE_INHERITED)) {
891 result->acl_ace[index++] = initial->acl_ace[i];
892 }
893 }
894 KAUTH_DEBUG(" INHERIT - applied %d of %d initial entries", index, initial->acl_entrycount);
895 }
896 if (inherit != NULL) {
897 for (i = 0; i < inherit->acl_entrycount; i++) {
898 /*
899 * Inherit onto this object? We inherit only if
900 * the target object is a container object and the
901 * KAUTH_ACE_DIRECTORY_INHERIT bit is set, OR if
902 * if the target object is not a container, and
903 * the KAUTH_ACE_FILE_INHERIT bit is set.
904 */
905 if (inherit->acl_ace[i].ace_flags & (isdir ? KAUTH_ACE_DIRECTORY_INHERIT : KAUTH_ACE_FILE_INHERIT)) {
906 result->acl_ace[index] = inherit->acl_ace[i];
907 result->acl_ace[index].ace_flags |= KAUTH_ACE_INHERITED;
908 result->acl_ace[index].ace_flags &= ~KAUTH_ACE_ONLY_INHERIT;
909 /*
910 * We do not re-inherit inheritance flags
911 * if the ACE from the container has a
912 * KAUTH_ACE_LIMIT_INHERIT, OR if the new
913 * object is not itself a container (since
914 * inheritance is always container-based).
915 */
916 if ((result->acl_ace[index].ace_flags & KAUTH_ACE_LIMIT_INHERIT) || !isdir) {
917 result->acl_ace[index].ace_flags &=
918 ~(KAUTH_ACE_INHERIT_CONTROL_FLAGS);
919 }
920 index++;
921 }
922 }
923 }
924 result->acl_entrycount = index;
925 *product = result;
926 KAUTH_DEBUG(" INHERIT - product ACL has %d entries", index);
927 error = 0;
928out:
929 if (inherit != NULL)
930 kauth_acl_free(inherit);
931 return(error);
932}
933
934/*
935 * Optimistically copy in a kauth_filesec structure
936 *
937 * Parameters: xsecurity user space kauth_filesec_t
938 * xsecdstpp pointer to kauth_filesec_t to be
939 * modified to contain the contain a
940 * pointer to an allocated copy of the
941 * user space argument
942 *
943 * Returns: 0 Success
944 * ENOMEM Insufficient memory for the copy.
945 * EINVAL The user space data was invalid, or
946 * there were too many ACE entries.
947 * EFAULT The user space address was invalid;
948 * this may mean 'fsec_entrycount' in
949 * the user copy is corrupt/incorrect.
950 *
951 * Implicit returns: xsecdestpp, modified (only if successful!)
952 *
953 * Notes: The returned kauth_filesec_t is in host byte order
954 *
955 * The caller is responsible for freeing the returned
956 * kauth_filesec_t in the success case using the function
957 * kauth_filesec_free()
958 *
959 * Our largest initial guess is 32; this needs to move to
960 * a manifest constant in <sys/kauth.h>.
961 */
962int
963kauth_copyinfilesec(user_addr_t xsecurity, kauth_filesec_t *xsecdestpp)
964{
965 int error;
966 kauth_filesec_t fsec;
967 u_int32_t count;
968 size_t copysize;
969
970 error = 0;
971 fsec = NULL;
972
973 /*
974 * Make a guess at the size of the filesec. We start with the base
975 * pointer, and look at how much room is left on the page, clipped
976 * to a sensible upper bound. If it turns out this isn't enough,
977 * we'll size based on the actual ACL contents and come back again.
978 *
979 * The upper bound must be less than KAUTH_ACL_MAX_ENTRIES. The
980 * value here is fairly arbitrary. It's ok to have a zero count.
981 *
982 * Because we're just using these values to make a guess about the
983 * number of entries, the actual address doesn't matter, only their
984 * relative offsets into the page. We take advantage of this to
985 * avoid an overflow in the rounding step (this is a user-provided
986 * parameter, so caution pays off).
987 */
988 {
989 user_addr_t known_bound = (xsecurity & PAGE_MASK) + KAUTH_FILESEC_SIZE(0);
990 user_addr_t uaddr = mach_vm_round_page(known_bound);
991 count = (uaddr - known_bound) / sizeof(struct kauth_ace);
992 }
993 if (count > 32)
994 count = 32;
995restart:
996 if ((fsec = kauth_filesec_alloc(count)) == NULL) {
997 error = ENOMEM;
998 goto out;
999 }
1000 copysize = KAUTH_FILESEC_SIZE(count);
1001 if ((error = copyin(xsecurity, (caddr_t)fsec, copysize)) != 0)
1002 goto out;
1003
1004 /* validate the filesec header */
1005 if (fsec->fsec_magic != KAUTH_FILESEC_MAGIC) {
1006 error = EINVAL;
1007 goto out;
1008 }
1009
1010 /*
1011 * Is there an ACL payload, and is it too big?
1012 */
1013 if ((fsec->fsec_entrycount != KAUTH_FILESEC_NOACL) &&
1014 (fsec->fsec_entrycount > count)) {
1015 if (fsec->fsec_entrycount > KAUTH_ACL_MAX_ENTRIES) {
1016 /* XXX This should be E2BIG */
1017 error = EINVAL;
1018 goto out;
1019 }
1020 count = fsec->fsec_entrycount;
1021 kauth_filesec_free(fsec);
1022 goto restart;
1023 }
1024
1025out:
1026 if (error) {
1027 if (fsec)
1028 kauth_filesec_free(fsec);
1029 } else {
1030 *xsecdestpp = fsec;
1031 AUDIT_ARG(opaque, fsec, copysize);
1032 }
1033 return(error);
1034}
1035
1036/*
1037 * Allocate a block of memory containing a filesec structure, immediately
1038 * followed by 'count' kauth_ace structures.
1039 *
1040 * Parameters: count Number of kauth_ace structures needed
1041 *
1042 * Returns: !NULL A pointer to the allocated block
1043 * NULL Invalid 'count' or insufficient memory
1044 *
1045 * Notes: Returned memory area assumes that the structures are packed
1046 * densely, so this function may only be used by code that also
1047 * assumes no padding following structures.
1048 *
1049 * The returned structure must be freed by the caller using the
1050 * function kauth_filesec_free(), in case we decide to use an
1051 * allocation mechanism that is aware of the object size at some
1052 * point, since the object size is only available by introspecting
1053 * the object itself.
1054 */
1055kauth_filesec_t
1056kauth_filesec_alloc(int count)
1057{
1058 kauth_filesec_t fsp;
1059
1060 /* if the caller hasn't given us a valid size hint, assume the worst */
1061 if ((count < 0) || (count > KAUTH_ACL_MAX_ENTRIES))
1062 return(NULL);
1063
1064 MALLOC(fsp, kauth_filesec_t, KAUTH_FILESEC_SIZE(count), M_KAUTH, M_WAITOK);
1065 if (fsp != NULL) {
1066 fsp->fsec_magic = KAUTH_FILESEC_MAGIC;
1067 fsp->fsec_owner = kauth_null_guid;
1068 fsp->fsec_group = kauth_null_guid;
1069 fsp->fsec_entrycount = KAUTH_FILESEC_NOACL;
1070 fsp->fsec_flags = 0;
1071 }
1072 return(fsp);
1073}
1074
1075/*
1076 * Free a kauth_filesec_t that was previous allocated, either by a direct
1077 * call to kauth_filesec_alloc() or by calling a function that calls it.
1078 *
1079 * Parameters: fsp kauth_filesec_t to free
1080 *
1081 * Returns: (void)
1082 *
1083 * Notes: The kauth_filesec_t to be freed is assumed to be in host
1084 * byte order so that this function can introspect it in the
1085 * future to determine its size, if necesssary.
1086 */
1087void
1088kauth_filesec_free(kauth_filesec_t fsp)
1089{
1090#ifdef KAUTH_DEBUG_ENABLE
1091 if (fsp == KAUTH_FILESEC_NONE)
1092 panic("freeing KAUTH_FILESEC_NONE");
1093 if (fsp == KAUTH_FILESEC_WANTED)
1094 panic("freeing KAUTH_FILESEC_WANTED");
1095#endif
1096 FREE(fsp, M_KAUTH);
1097}
1098
1099/*
1100 * Set the endianness of a filesec and an ACL; if 'acl' is NULL, use the
1101 * ACL interior to 'fsec' instead. If the endianness doesn't change, then
1102 * this function will have no effect.
1103 *
1104 * Parameters: kendian The endianness to set; this is either
1105 * KAUTH_ENDIAN_HOST or KAUTH_ENDIAN_DISK.
1106 * fsec The filesec to convert.
1107 * acl The ACL to convert (optional)
1108 *
1109 * Returns: (void)
1110 *
1111 * Notes: We use ntohl() because it has a transitive property on Intel
1112 * machines and no effect on PPC mancines. This guarantees us
1113 * that the swapping only occurs if the endiannes is wrong.
1114 */
1115void
1116kauth_filesec_acl_setendian(int kendian, kauth_filesec_t fsec, kauth_acl_t acl)
1117{
1118 uint32_t compare_magic = KAUTH_FILESEC_MAGIC;
1119 uint32_t invert_magic = ntohl(KAUTH_FILESEC_MAGIC);
1120 uint32_t compare_acl_entrycount;
1121 uint32_t i;
1122
1123 if (compare_magic == invert_magic)
1124 return;
1125
1126 /* If no ACL, use ACL interior to 'fsec' instead */
1127 if (acl == NULL)
1128 acl = &fsec->fsec_acl;
1129
1130 compare_acl_entrycount = acl->acl_entrycount;
1131
1132 /*
1133 * Only convert what needs to be converted, and only if the arguments
1134 * are valid. The following switch and tests effectively reject
1135 * conversions on invalid magic numbers as a desirable side effect.
1136 */
1137 switch(kendian) {
1138 case KAUTH_ENDIAN_HOST: /* not in host, convert to host */
1139 if (fsec->fsec_magic != invert_magic)
1140 return;
1141 /* acl_entrycount is byteswapped */
1142 compare_acl_entrycount = ntohl(acl->acl_entrycount);
1143 break;
1144 case KAUTH_ENDIAN_DISK: /* not in disk, convert to disk */
1145 if (fsec->fsec_magic != compare_magic)
1146 return;
1147 break;
1148 default: /* bad argument */
1149 return;
1150 }
1151
1152 /* We are go for conversion */
1153 fsec->fsec_magic = ntohl(fsec->fsec_magic);
1154 acl->acl_entrycount = ntohl(acl->acl_entrycount);
1155 if (compare_acl_entrycount != KAUTH_FILESEC_NOACL) {
1156 acl->acl_flags = ntohl(acl->acl_flags);
1157
1158 /* swap ACE rights and flags */
1159 for (i = 0; i < compare_acl_entrycount; i++) {
1160 acl->acl_ace[i].ace_flags = ntohl(acl->acl_ace[i].ace_flags);
1161 acl->acl_ace[i].ace_rights = ntohl(acl->acl_ace[i].ace_rights);
1162 }
1163 }
1164 }
1165
1166
1167/*
1168 * Allocate an ACL buffer.
1169 */
1170kauth_acl_t
1171kauth_acl_alloc(int count)
1172{
1173 kauth_acl_t aclp;
1174
1175 /* if the caller hasn't given us a valid size hint, assume the worst */
1176 if ((count < 0) || (count > KAUTH_ACL_MAX_ENTRIES))
1177 return(NULL);
1178
1179 MALLOC(aclp, kauth_acl_t, KAUTH_ACL_SIZE(count), M_KAUTH, M_WAITOK);
1180 if (aclp != NULL) {
1181 aclp->acl_entrycount = 0;
1182 aclp->acl_flags = 0;
1183 }
1184 return(aclp);
1185}
1186
1187void
1188kauth_acl_free(kauth_acl_t aclp)
1189{
1190 FREE(aclp, M_KAUTH);
1191}
1192
1193
1194/*
1195 * WARNING - caller must hold KAUTH_SCOPELOCK
1196 */
1197static int kauth_add_callback_to_scope(kauth_scope_t sp, kauth_listener_t klp)
1198{
1199 int i;
1200
1201 for (i = 0; i < KAUTH_SCOPE_MAX_LISTENERS; i++) {
1202 if (sp->ks_listeners[i].kll_listenerp == NULL) {
1203 sp->ks_listeners[i].kll_callback = klp->kl_callback;
1204 sp->ks_listeners[i].kll_idata = klp->kl_idata;
1205 sp->ks_listeners[i].kll_listenerp = klp;
1206 sp->ks_flags |= KS_F_HAS_LISTENERS;
1207 return(0);
1208 }
1209 }
1210 return(ENOSPC);
1211}
1212