1/*
2 * Copyright (c) 2007-2016 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28/*-
29 * Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson
30 * Copyright (c) 2001 Ilmar S. Habibulin
31 * Copyright (c) 2001, 2002, 2003, 2004 Networks Associates Technology, Inc.
32 * Copyright (c) 2005-2006 SPARTA, Inc.
33 *
34 * This software was developed by Robert Watson and Ilmar Habibulin for the
35 * TrustedBSD Project.
36 *
37 * This software was developed for the FreeBSD Project in part by Network
38 * Associates Laboratories, the Security Research Division of Network
39 * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"),
40 * as part of the DARPA CHATS research program.
41 *
42 * Redistribution and use in source and binary forms, with or without
43 * modification, are permitted provided that the following conditions
44 * are met:
45 * 1. Redistributions of source code must retain the above copyright
46 * notice, this list of conditions and the following disclaimer.
47 * 2. Redistributions in binary form must reproduce the above copyright
48 * notice, this list of conditions and the following disclaimer in the
49 * documentation and/or other materials provided with the distribution.
50 *
51 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
52 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
53 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
54 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
55 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
56 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
57 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
58 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
59 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
60 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
61 * SUCH DAMAGE.
62 *
63 */
64
65/*-
66 * Framework for extensible kernel access control. This file contains
67 * Kernel and userland interface to the framework, policy registration
68 * and composition. Per-object interfaces, controls, and labeling may be
69 * found in src/sys/mac/. Sample policies may be found in src/sys/mac*.
70 */
71
72#include <stdarg.h>
73#include <string.h>
74#include <security/mac_internal.h>
75#include <security/mac_mach_internal.h>
76#include <sys/param.h>
77#include <sys/vnode.h>
78#include <sys/vnode_internal.h>
79#include <sys/vfs_context.h>
80#include <sys/namei.h>
81#include <bsd/bsm/audit.h>
82#include <bsd/security/audit/audit.h>
83#include <sys/file.h>
84#include <sys/file_internal.h>
85#include <sys/filedesc.h>
86#include <sys/proc.h>
87#include <sys/proc_internal.h>
88#include <sys/kauth.h>
89#include <sys/sysproto.h>
90
91#include <mach/exception_types.h>
92#include <mach/vm_types.h>
93#include <mach/vm_prot.h>
94
95#include <kern/zalloc.h>
96#include <kern/sched_prim.h>
97#include <osfmk/kern/task.h>
98#include <osfmk/kern/kalloc.h>
99
100#if CONFIG_MACF
101#include <security/mac.h>
102#include <security/mac_policy.h>
103#include <security/mac_framework.h>
104#include <security/mac_internal.h>
105#include <security/mac_mach_internal.h>
106#endif
107
108#if CONFIG_EMBEDDED
109#include <libkern/section_keywords.h>
110#endif
111
112/*
113 * define MB_DEBUG to display run-time debugging information
114 * #define MB_DEBUG 1
115 */
116
117#ifdef MB_DEBUG
118#define DPRINTF(x) printf x
119#else
120#define MB_DEBUG
121#define DPRINTF(x)
122#endif
123
124#if CONFIG_MACF
125SYSCTL_NODE(, OID_AUTO, security, CTLFLAG_RW|CTLFLAG_LOCKED, 0,
126 "Security Controls");
127SYSCTL_NODE(_security, OID_AUTO, mac, CTLFLAG_RW|CTLFLAG_LOCKED, 0,
128 "TrustedBSD MAC policy controls");
129
130/*
131 * Declare that the kernel provides MAC support, version 1. This permits
132 * modules to refuse to be loaded if the necessary support isn't present,
133 * even if it's pre-boot.
134 */
135#if 0
136MODULE_VERSION(kernel_mac_support, 1);
137#endif
138
139#if MAC_MAX_SLOTS > 32
140#error "MAC_MAX_SLOTS too large"
141#endif
142
143static unsigned int mac_max_slots = MAC_MAX_SLOTS;
144static unsigned int mac_slot_offsets_free = (1 << MAC_MAX_SLOTS) - 1;
145SYSCTL_UINT(_security_mac, OID_AUTO, max_slots, CTLFLAG_RD | CTLFLAG_LOCKED,
146 &mac_max_slots, 0, "");
147
148/*
149 * Has the kernel started generating labeled objects yet? All read/write
150 * access to this variable is serialized during the boot process. Following
151 * the end of serialization, we don't update this flag; no locking.
152 */
153int mac_late = 0;
154
155/*
156 * Flag to indicate whether or not we should allocate label storage for
157 * new mbufs. Since most dynamic policies we currently work with don't
158 * rely on mbuf labeling, try to avoid paying the cost of mtag allocation
159 * unless specifically notified of interest. One result of this is
160 * that if a dynamically loaded policy requests mbuf labels, it must
161 * be able to deal with a NULL label being returned on any mbufs that
162 * were already in flight when the policy was loaded. Since the policy
163 * already has to deal with uninitialized labels, this probably won't
164 * be a problem. Note: currently no locking. Will this be a problem?
165 */
166#if CONFIG_MACF_NET
167unsigned int mac_label_mbufs = 1;
168SYSCTL_UINT(_security_mac, OID_AUTO, label_mbufs, SECURITY_MAC_CTLFLAGS,
169 &mac_label_mbufs, 0, "Label all MBUFs");
170#endif
171
172
173/*
174 * Flag to indicate whether or not we should allocate label storage for
175 * new vnodes. Since most dynamic policies we currently work with don't
176 * rely on vnode labeling, try to avoid paying the cost of mtag allocation
177 * unless specifically notified of interest. One result of this is
178 * that if a dynamically loaded policy requests vnode labels, it must
179 * be able to deal with a NULL label being returned on any vnodes that
180 * were already in flight when the policy was loaded. Since the policy
181 * already has to deal with uninitialized labels, this probably won't
182 * be a problem.
183 */
184unsigned int mac_label_vnodes = 0;
185SYSCTL_UINT(_security_mac, OID_AUTO, labelvnodes, SECURITY_MAC_CTLFLAGS,
186 &mac_label_vnodes, 0, "Label all vnodes");
187
188unsigned int mac_device_enforce = 1;
189SYSCTL_UINT(_security_mac, OID_AUTO, device_enforce, SECURITY_MAC_CTLFLAGS,
190 &mac_device_enforce, 0, "Enforce MAC policy on device operations");
191
192unsigned int mac_pipe_enforce = 1;
193SYSCTL_UINT(_security_mac, OID_AUTO, pipe_enforce, SECURITY_MAC_CTLFLAGS,
194 &mac_pipe_enforce, 0, "Enforce MAC policy on pipe operations");
195
196unsigned int mac_posixsem_enforce = 1;
197SYSCTL_UINT(_security_mac, OID_AUTO, posixsem_enforce, SECURITY_MAC_CTLFLAGS,
198 &mac_posixsem_enforce, 0, "Enforce MAC policy on POSIX semaphores");
199
200unsigned int mac_posixshm_enforce = 1;
201SYSCTL_UINT(_security_mac, OID_AUTO, posixshm_enforce, SECURITY_MAC_CTLFLAGS,
202 &mac_posixshm_enforce, 0, "Enforce MAC policy on Posix Shared Memory");
203
204unsigned int mac_proc_enforce = 1;
205SYSCTL_UINT(_security_mac, OID_AUTO, proc_enforce, SECURITY_MAC_CTLFLAGS,
206 &mac_proc_enforce, 0, "Enforce MAC policy on process operations");
207
208unsigned int mac_socket_enforce = 1;
209SYSCTL_UINT(_security_mac, OID_AUTO, socket_enforce, SECURITY_MAC_CTLFLAGS,
210 &mac_socket_enforce, 0, "Enforce MAC policy on socket operations");
211
212unsigned int mac_system_enforce = 1;
213SYSCTL_UINT(_security_mac, OID_AUTO, system_enforce, SECURITY_MAC_CTLFLAGS,
214 &mac_system_enforce, 0, "Enforce MAC policy on system-wide interfaces");
215
216unsigned int mac_sysvmsg_enforce = 1;
217SYSCTL_UINT(_security_mac, OID_AUTO, sysvmsg_enforce, SECURITY_MAC_CTLFLAGS,
218 &mac_sysvmsg_enforce, 0, "Enforce MAC policy on System V IPC message queues");
219
220unsigned int mac_sysvsem_enforce = 1;
221SYSCTL_UINT(_security_mac, OID_AUTO, sysvsem_enforce, SECURITY_MAC_CTLFLAGS,
222 &mac_sysvsem_enforce, 0, "Enforce MAC policy on System V IPC semaphores");
223
224unsigned int mac_sysvshm_enforce = 1;
225SYSCTL_INT(_security_mac, OID_AUTO, sysvshm_enforce, SECURITY_MAC_CTLFLAGS,
226 &mac_sysvshm_enforce, 0, "Enforce MAC policy on System V Shared Memory");
227
228unsigned int mac_vm_enforce = 1;
229SYSCTL_INT(_security_mac, OID_AUTO, vm_enforce, SECURITY_MAC_CTLFLAGS,
230 &mac_vm_enforce, 0, "Enforce MAC policy on VM operations");
231
232unsigned int mac_vnode_enforce = 1;
233SYSCTL_UINT(_security_mac, OID_AUTO, vnode_enforce, SECURITY_MAC_CTLFLAGS,
234 &mac_vnode_enforce, 0, "Enforce MAC policy on vnode operations");
235
236#if CONFIG_AUDIT
237/*
238 * mac_audit_data_zone is the zone used for data pushed into the audit
239 * record by policies. Using a zone simplifies memory management of this
240 * data, and allows tracking of the amount of data in flight.
241 */
242extern zone_t mac_audit_data_zone;
243#endif
244
245/*
246 * mac_policy_list holds the list of policy modules. Modules with a
247 * handle lower than staticmax are considered "static" and cannot be
248 * unloaded. Such policies can be invoked without holding the busy count.
249 *
250 * Modules with a handle at or above the staticmax high water mark
251 * are considered to be "dynamic" policies. A busy count is maintained
252 * for the list, stored in mac_policy_busy. The busy count is protected
253 * by mac_policy_mtx; the list may be modified only while the busy
254 * count is 0, requiring that the lock be held to prevent new references
255 * to the list from being acquired. For almost all operations,
256 * incrementing the busy count is sufficient to guarantee consistency,
257 * as the list cannot be modified while the busy count is elevated.
258 * For a few special operations involving a change to the list of
259 * active policies, the mtx itself must be held.
260 */
261static lck_mtx_t *mac_policy_mtx;
262
263/*
264 * Policy list array allocation chunk size. Trying to set this so that we
265 * allocate a page at a time.
266 */
267#define MAC_POLICY_LIST_CHUNKSIZE 512
268
269static int mac_policy_busy;
270
271#if CONFIG_EMBEDDED
272SECURITY_READ_ONLY_LATE(mac_policy_list_t) mac_policy_list;
273SECURITY_READ_ONLY_LATE(static struct mac_policy_list_element) mac_policy_static_entries[MAC_POLICY_LIST_CHUNKSIZE];
274#else
275mac_policy_list_t mac_policy_list;
276#endif
277
278/*
279 * mac_label_element_list holds the master list of label namespaces for
280 * all the policies. When a policy is loaded, each of it's label namespace
281 * elements is added to the master list if not already present. When a
282 * policy is unloaded, the namespace elements are removed if no other
283 * policy is interested in that namespace element.
284 */
285struct mac_label_element_list_t mac_label_element_list;
286struct mac_label_element_list_t mac_static_label_element_list;
287
288static __inline void
289mac_policy_grab_exclusive(void)
290{
291 lck_mtx_lock(mac_policy_mtx);
292 while (mac_policy_busy != 0) {
293 lck_mtx_sleep(mac_policy_mtx, LCK_SLEEP_UNLOCK,
294 (event_t)&mac_policy_busy, THREAD_UNINT);
295 lck_mtx_lock(mac_policy_mtx);
296 }
297}
298
299static __inline void
300mac_policy_release_exclusive(void)
301{
302
303 KASSERT(mac_policy_busy == 0,
304 ("mac_policy_release_exclusive(): not exclusive"));
305 lck_mtx_unlock(mac_policy_mtx);
306 thread_wakeup((event_t) &mac_policy_busy);
307}
308
309void
310mac_policy_list_busy(void)
311{
312 lck_mtx_lock(mac_policy_mtx);
313 mac_policy_busy++;
314 lck_mtx_unlock(mac_policy_mtx);
315}
316
317int
318mac_policy_list_conditional_busy(void)
319{
320 int ret;
321
322 if (mac_policy_list.numloaded <= mac_policy_list.staticmax)
323 return(0);
324
325 lck_mtx_lock(mac_policy_mtx);
326 if (mac_policy_list.numloaded > mac_policy_list.staticmax) {
327 mac_policy_busy++;
328 ret = 1;
329 } else
330 ret = 0;
331 lck_mtx_unlock(mac_policy_mtx);
332 return (ret);
333}
334
335void
336mac_policy_list_unbusy(void)
337{
338 lck_mtx_lock(mac_policy_mtx);
339 mac_policy_busy--;
340 KASSERT(mac_policy_busy >= 0, ("MAC_POLICY_LIST_LOCK"));
341 if (mac_policy_busy == 0)
342 thread_wakeup(&mac_policy_busy);
343 lck_mtx_unlock(mac_policy_mtx);
344}
345
346/*
347 * Early pre-malloc MAC initialization, including appropriate SMP locks.
348 */
349void
350mac_policy_init(void)
351{
352 lck_grp_attr_t *mac_lck_grp_attr;
353 lck_attr_t *mac_lck_attr;
354 lck_grp_t *mac_lck_grp;
355
356 mac_policy_list.numloaded = 0;
357 mac_policy_list.max = MAC_POLICY_LIST_CHUNKSIZE;
358 mac_policy_list.maxindex = 0;
359 mac_policy_list.staticmax = 0;
360 mac_policy_list.freehint = 0;
361 mac_policy_list.chunks = 1;
362
363#if CONFIG_EMBEDDED
364 mac_policy_list.entries = mac_policy_static_entries;
365#else
366 mac_policy_list.entries = kalloc(sizeof(struct mac_policy_list_element) * MAC_POLICY_LIST_CHUNKSIZE);
367#endif
368
369 bzero(mac_policy_list.entries, sizeof(struct mac_policy_list_element) * MAC_POLICY_LIST_CHUNKSIZE);
370
371 LIST_INIT(&mac_label_element_list);
372 LIST_INIT(&mac_static_label_element_list);
373
374 mac_lck_grp_attr = lck_grp_attr_alloc_init();
375 lck_grp_attr_setstat(mac_lck_grp_attr);
376 mac_lck_grp = lck_grp_alloc_init("MAC lock", mac_lck_grp_attr);
377 mac_lck_attr = lck_attr_alloc_init();
378 lck_attr_setdefault(mac_lck_attr);
379 mac_policy_mtx = lck_mtx_alloc_init(mac_lck_grp, mac_lck_attr);
380 lck_attr_free(mac_lck_attr);
381 lck_grp_attr_free(mac_lck_grp_attr);
382 lck_grp_free(mac_lck_grp);
383
384 mac_labelzone_init();
385}
386
387/* Function pointer set up for loading security extensions.
388 * It is set to an actual function after OSlibkernInit()
389 * has been called, and is set back to 0 by OSKextRemoveKextBootstrap()
390 * after bsd_init().
391 */
392void (*load_security_extensions_function)(void) = 0;
393
394/*
395 * Init after early Mach startup, but before BSD
396 */
397void
398mac_policy_initmach(void)
399{
400
401 /*
402 * For the purposes of modules that want to know if they were
403 * loaded "early", set the mac_late flag once we've processed
404 * modules either linked into the kernel, or loaded before the
405 * kernel startup.
406 */
407
408 if (load_security_extensions_function) {
409 load_security_extensions_function();
410 }
411 mac_late = 1;
412}
413
414/*
415 * BSD startup.
416 */
417void
418mac_policy_initbsd(void)
419{
420 struct mac_policy_conf *mpc;
421 u_int i;
422
423#if CONFIG_AUDIT
424 mac_audit_data_zone = zinit(MAC_AUDIT_DATA_LIMIT,
425 AQ_HIWATER * MAC_AUDIT_DATA_LIMIT,
426 8192, "mac_audit_data_zone");
427#endif
428
429 printf("MAC Framework successfully initialized\n");
430
431 /* Call bsd init functions of already loaded policies */
432
433 /*
434 * Using the exclusive lock means no other framework entry
435 * points can proceed while initializations are running.
436 * This may not be necessary.
437 */
438 mac_policy_grab_exclusive();
439
440 for (i = 0; i <= mac_policy_list.maxindex; i++) {
441 mpc = mac_get_mpc(i);
442 if ((mpc != NULL) && (mpc->mpc_ops->mpo_policy_initbsd != NULL))
443 (*(mpc->mpc_ops->mpo_policy_initbsd))(mpc);
444 }
445
446 mac_policy_release_exclusive();
447}
448
449/*
450 * After a policy has been loaded, add the label namespaces managed by the
451 * policy to either the static or non-static label namespace list.
452 * A namespace is added to the the list only if it is not already on one of
453 * the lists.
454 */
455void
456mac_policy_addto_labellist(mac_policy_handle_t handle, int static_entry)
457{
458 struct mac_label_listener **new_mlls;
459 struct mac_label_element *mle, **new_mles;
460 struct mac_label_element_list_t *list;
461 struct mac_policy_conf *mpc;
462 const char *name, *name2;
463 u_int idx, mle_free, mll_free;
464
465 mpc = mac_get_mpc(handle);
466
467 if (mpc->mpc_labelnames == NULL)
468 return;
469
470 if (mpc->mpc_labelname_count == 0)
471 return;
472
473 if (static_entry)
474 list = &mac_static_label_element_list;
475 else
476 list = &mac_label_element_list;
477
478 /*
479 * Before we grab the policy list lock, allocate enough memory
480 * to contain the potential new elements so we don't have to
481 * give up the lock, or allocate with the lock held.
482 */
483 MALLOC(new_mles, struct mac_label_element **,
484 sizeof(struct mac_label_element *) *
485 mpc->mpc_labelname_count, M_MACTEMP, M_WAITOK | M_ZERO);
486 for (idx = 0; idx < mpc->mpc_labelname_count; idx++)
487 MALLOC(new_mles[idx], struct mac_label_element *,
488 sizeof(struct mac_label_element),
489 M_MACTEMP, M_WAITOK);
490 mle_free = 0;
491 MALLOC(new_mlls, struct mac_label_listener **,
492 sizeof(struct mac_label_listener *) *
493 mpc->mpc_labelname_count, M_MACTEMP, M_WAITOK);
494 for (idx = 0; idx < mpc->mpc_labelname_count; idx++)
495 MALLOC(new_mlls[idx], struct mac_label_listener *,
496 sizeof(struct mac_label_listener), M_MACTEMP, M_WAITOK);
497 mll_free = 0;
498
499 if (mac_late)
500 mac_policy_grab_exclusive();
501 for (idx = 0; idx < mpc->mpc_labelname_count; idx++) {
502
503 if (*(name = mpc->mpc_labelnames[idx]) == '?')
504 name++;
505 /*
506 * Check both label element lists and add to the
507 * appropriate list only if not already on a list.
508 */
509 LIST_FOREACH(mle, &mac_static_label_element_list, mle_list) {
510 if (*(name2 = mle->mle_name) == '?')
511 name2++;
512 if (strcmp(name, name2) == 0)
513 break;
514 }
515 if (mle == NULL) {
516 LIST_FOREACH(mle, &mac_label_element_list, mle_list) {
517 if (*(name2 = mle->mle_name) == '?')
518 name2++;
519 if (strcmp(name, name2) == 0)
520 break;
521 }
522 }
523 if (mle == NULL) {
524 mle = new_mles[mle_free];
525 strlcpy(mle->mle_name, mpc->mpc_labelnames[idx],
526 MAC_MAX_LABEL_ELEMENT_NAME);
527 LIST_INIT(&mle->mle_listeners);
528 LIST_INSERT_HEAD(list, mle, mle_list);
529 mle_free++;
530 }
531 /* Add policy handler as a listener. */
532 new_mlls[mll_free]->mll_handle = handle;
533 LIST_INSERT_HEAD(&mle->mle_listeners, new_mlls[mll_free],
534 mll_list);
535 mll_free++;
536 }
537 if (mac_late)
538 mac_policy_release_exclusive();
539
540 /* Free up any unused label elements and listeners */
541 for (idx = mle_free; idx < mpc->mpc_labelname_count; idx++)
542 FREE(new_mles[idx], M_MACTEMP);
543 FREE(new_mles, M_MACTEMP);
544 for (idx = mll_free; idx < mpc->mpc_labelname_count; idx++)
545 FREE(new_mlls[idx], M_MACTEMP);
546 FREE(new_mlls, M_MACTEMP);
547}
548
549/*
550 * After a policy has been unloaded, remove the label namespaces that the
551 * the policy manages from the non-static list of namespaces.
552 * The removal only takes place when no other policy is interested in the
553 * namespace.
554 *
555 * Must be called with the policy exclusive lock held.
556 */
557void
558mac_policy_removefrom_labellist(mac_policy_handle_t handle)
559{
560 struct mac_label_listener *mll;
561 struct mac_label_element *mle;
562 struct mac_policy_conf *mpc;
563
564 mpc = mac_get_mpc(handle);
565
566 if (mpc->mpc_labelnames == NULL)
567 return;
568
569 if (mpc->mpc_labelname_count == 0)
570 return;
571
572 /*
573 * Unregister policy as being interested in any label
574 * namespaces. If no other policy is listening, remove
575 * that label element from the list. Note that we only
576 * have to worry about the non-static list.
577 */
578 LIST_FOREACH(mle, &mac_label_element_list, mle_list) {
579 LIST_FOREACH(mll, &mle->mle_listeners, mll_list) {
580 if (mll->mll_handle == handle) {
581 LIST_REMOVE(mll, mll_list);
582 FREE(mll, M_MACTEMP);
583 if (LIST_EMPTY(&mle->mle_listeners)) {
584 LIST_REMOVE(mle, mle_list);
585 FREE(mle, M_MACTEMP);
586 }
587 return;
588 }
589 }
590 }
591}
592
593/*
594 * After the policy list has changed, walk the list to update any global
595 * flags.
596 */
597static void
598mac_policy_updateflags(void)
599{
600}
601
602static __inline void
603mac_policy_fixup_mmd_list(struct mac_module_data *new)
604{
605 struct mac_module_data *old;
606 struct mac_module_data_element *ele, *aele;
607 struct mac_module_data_list *arr, *dict;
608 unsigned int i, j, k;
609
610 old = new->base_addr;
611 DPRINTF(("fixup_mmd: old %p new %p\n", old, new));
612 for (i = 0; i < new->count; i++) {
613 ele = &(new->data[i]);
614 DPRINTF(("fixup_mmd: ele %p\n", ele));
615 DPRINTF((" key %p value %p\n", ele->key, ele->value));
616 mmd_fixup_ele(old, new, ele); /* Fix up key/value ptrs. */
617 DPRINTF((" key %p value %p\n", ele->key, ele->value));
618 if (ele->value_type == MAC_DATA_TYPE_ARRAY) {
619 arr = (struct mac_module_data_list *)ele->value;
620 DPRINTF(("fixup_mmd: array @%p\n", arr));
621 for (j = 0; j < arr->count; j++) {
622 aele = &(arr->list[j]);
623 DPRINTF(("fixup_mmd: aele %p\n", aele));
624 DPRINTF((" key %p value %p\n", aele->key, aele->value));
625 mmd_fixup_ele(old, new, aele);
626 DPRINTF((" key %p value %p\n", aele->key, aele->value));
627 if (arr->type == MAC_DATA_TYPE_DICT) {
628 dict = (struct mac_module_data_list *)aele->value;
629 DPRINTF(("fixup_mmd: dict @%p\n", dict));
630 for (k = 0; k < dict->count; k++)
631 mmd_fixup_ele(old, new,
632 &(dict->list[k]));
633 }
634 }
635 }
636 }
637 new->base_addr = new;
638}
639
640int
641mac_policy_register(struct mac_policy_conf *mpc, mac_policy_handle_t *handlep,
642 void *xd)
643{
644#if !CONFIG_EMBEDDED
645 struct mac_policy_list_element *tmac_policy_list_element;
646#endif
647 int error, slot, static_entry = 0;
648 u_int i;
649
650 /*
651 * Some preliminary checks to make sure the policy's conf structure
652 * contains the required fields.
653 */
654 if (mpc->mpc_name == NULL)
655 panic("policy's name is not set\n");
656
657 if (mpc->mpc_fullname == NULL)
658 panic("policy's full name is not set\n");
659
660 if (mpc->mpc_labelname_count > MAC_MAX_MANAGED_NAMESPACES)
661 panic("policy's managed label namespaces exceeds maximum\n");
662
663 if (mpc->mpc_ops == NULL)
664 panic("policy's OPs field is NULL\n");
665
666 error = 0;
667
668 if (mac_late) {
669 if (mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_NOTLATE) {
670 printf("Module %s does not support late loading.\n",
671 mpc->mpc_name);
672 return (EPERM);
673 }
674 mac_policy_grab_exclusive();
675 }
676
677 if (mac_policy_list.numloaded >= mac_policy_list.max) {
678#if !CONFIG_EMBEDDED
679 /* allocate new policy list array, zero new chunk */
680 tmac_policy_list_element =
681 kalloc((sizeof(struct mac_policy_list_element) *
682 MAC_POLICY_LIST_CHUNKSIZE) * (mac_policy_list.chunks + 1));
683 bzero(&tmac_policy_list_element[mac_policy_list.max],
684 sizeof(struct mac_policy_list_element) *
685 MAC_POLICY_LIST_CHUNKSIZE);
686
687 /* copy old entries into new list */
688 memcpy(tmac_policy_list_element, mac_policy_list.entries,
689 sizeof(struct mac_policy_list_element) *
690 MAC_POLICY_LIST_CHUNKSIZE * mac_policy_list.chunks);
691
692 /* free old array */
693 kfree(mac_policy_list.entries,
694 sizeof(struct mac_policy_list_element) *
695 MAC_POLICY_LIST_CHUNKSIZE * mac_policy_list.chunks);
696
697 mac_policy_list.entries = tmac_policy_list_element;
698
699 /* Update maximums, etc */
700 mac_policy_list.max += MAC_POLICY_LIST_CHUNKSIZE;
701 mac_policy_list.chunks++;
702#else
703 printf("out of space in mac_policy_list.\n");
704 return (ENOMEM);
705#endif /* CONFIG_EMBEDDED */
706 }
707
708 /* Check for policy with same name already loaded */
709 for (i = 0; i <= mac_policy_list.maxindex; i++) {
710 if (mac_policy_list.entries[i].mpc == NULL)
711 continue;
712
713 if (strcmp(mac_policy_list.entries[i].mpc->mpc_name,
714 mpc->mpc_name) == 0) {
715 error = EEXIST;
716 goto out;
717 }
718 }
719
720 if (mpc->mpc_field_off != NULL) {
721 slot = ffs(mac_slot_offsets_free);
722 if (slot == 0) {
723 error = ENOMEM;
724 goto out;
725 }
726 slot--;
727 mac_slot_offsets_free &= ~(1 << slot);
728 *mpc->mpc_field_off = slot;
729 }
730 mpc->mpc_runtime_flags |= MPC_RUNTIME_FLAG_REGISTERED;
731
732 if (xd) {
733 struct mac_module_data *mmd = xd; /* module data from plist */
734
735 /* Make a copy of the data. */
736 mpc->mpc_data = (void *)kalloc(mmd->size);
737 if (mpc->mpc_data != NULL) {
738 memcpy(mpc->mpc_data, mmd, mmd->size);
739
740 /* Fix up pointers after copy. */
741 mac_policy_fixup_mmd_list(mpc->mpc_data);
742 }
743 }
744
745 /* Find the first free handle in the list (using our hint). */
746 for (i = mac_policy_list.freehint; i < mac_policy_list.max; i++) {
747 if (mac_policy_list.entries[i].mpc == NULL) {
748 *handlep = i;
749 mac_policy_list.freehint = ++i;
750 break;
751 }
752 }
753
754 /*
755 * If we are loading a MAC module before the framework has
756 * finished initializing or the module is not unloadable and
757 * we can place its handle adjacent to the last static entry,
758 * bump the static policy high water mark.
759 * Static policies can get by with weaker locking requirements.
760 */
761 if (!mac_late ||
762 ((mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_UNLOADOK) == 0 &&
763 *handlep == mac_policy_list.staticmax)) {
764 static_entry = 1;
765 mac_policy_list.staticmax++;
766 }
767
768 mac_policy_list.entries[*handlep].mpc = mpc;
769
770 /* Update counters, etc */
771 if (*handlep > mac_policy_list.maxindex)
772 mac_policy_list.maxindex = *handlep;
773 mac_policy_list.numloaded++;
774
775 /* Per-policy initialization. */
776 printf ("calling mpo_policy_init for %s\n", mpc->mpc_name);
777 if (mpc->mpc_ops->mpo_policy_init != NULL)
778 (*(mpc->mpc_ops->mpo_policy_init))(mpc);
779
780 if (mac_late && mpc->mpc_ops->mpo_policy_initbsd != NULL) {
781 printf ("calling mpo_policy_initbsd for %s\n", mpc->mpc_name);
782 (*(mpc->mpc_ops->mpo_policy_initbsd))(mpc);
783 }
784
785 mac_policy_updateflags();
786
787 if (mac_late)
788 mac_policy_release_exclusive();
789
790 mac_policy_addto_labellist(*handlep, static_entry);
791
792 printf("Security policy loaded: %s (%s)\n", mpc->mpc_fullname,
793 mpc->mpc_name);
794
795 return (0);
796
797out:
798 if (mac_late)
799 mac_policy_release_exclusive();
800
801 return (error);
802}
803
804int
805mac_policy_unregister(mac_policy_handle_t handle)
806{
807 struct mac_policy_conf *mpc;
808
809 /*
810 * If we fail the load, we may get a request to unload. Check
811 * to see if we did the run-time registration, and if not,
812 * silently succeed.
813 */
814 mac_policy_grab_exclusive();
815 mpc = mac_get_mpc(handle);
816 if ((mpc->mpc_runtime_flags & MPC_RUNTIME_FLAG_REGISTERED) == 0) {
817 mac_policy_release_exclusive();
818 return (0);
819 }
820
821#if 0
822 /*
823 * Don't allow unloading modules with private data.
824 */
825 if (mpc->mpc_field_off != NULL) {
826 MAC_POLICY_LIST_UNLOCK();
827 return (EBUSY);
828 }
829#endif
830 /*
831 * Only allow the unload to proceed if the module is unloadable
832 * by its own definition.
833 */
834 if ((mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_UNLOADOK) == 0) {
835 mac_policy_release_exclusive();
836 return (EBUSY);
837 }
838
839 mac_policy_removefrom_labellist(handle);
840
841 mac_get_mpc(handle) = NULL;
842 if (handle < mac_policy_list.freehint &&
843 handle >= mac_policy_list.staticmax)
844 mac_policy_list.freehint = handle;
845
846 if (handle == mac_policy_list.maxindex)
847 mac_policy_list.maxindex--;
848
849 mac_policy_list.numloaded--;
850 if (mpc->mpc_field_off != NULL) {
851 mac_slot_offsets_free |= (1 << *mpc->mpc_field_off);
852 }
853
854 if (mpc->mpc_ops->mpo_policy_destroy != NULL)
855 (*(mpc->mpc_ops->mpo_policy_destroy))(mpc);
856
857 mpc->mpc_runtime_flags &= ~MPC_RUNTIME_FLAG_REGISTERED;
858 mac_policy_updateflags();
859
860 mac_policy_release_exclusive();
861
862 if (mpc->mpc_data) {
863 struct mac_module_data *mmd = mpc->mpc_data;
864 kfree(mmd, mmd->size);
865 mpc->mpc_data = NULL;
866 }
867
868 printf("Security policy unload: %s (%s)\n", mpc->mpc_fullname,
869 mpc->mpc_name);
870
871 return (0);
872}
873
874/*
875 * Define an error value precedence, and given two arguments, selects the
876 * value with the higher precedence.
877 */
878int
879mac_error_select(int error1, int error2)
880{
881
882 /* Certain decision-making errors take top priority. */
883 if (error1 == EDEADLK || error2 == EDEADLK)
884 return (EDEADLK);
885
886 /* Invalid arguments should be reported where possible. */
887 if (error1 == EINVAL || error2 == EINVAL)
888 return (EINVAL);
889
890 /* Precedence goes to "visibility", with both process and file. */
891 if (error1 == ESRCH || error2 == ESRCH)
892 return (ESRCH);
893
894 if (error1 == ENOENT || error2 == ENOENT)
895 return (ENOENT);
896
897 /* Precedence goes to DAC/MAC protections. */
898 if (error1 == EACCES || error2 == EACCES)
899 return (EACCES);
900
901 /* Precedence goes to privilege. */
902 if (error1 == EPERM || error2 == EPERM)
903 return (EPERM);
904
905 /* Precedence goes to error over success; otherwise, arbitrary. */
906 if (error1 != 0)
907 return (error1);
908 return (error2);
909}
910
911void
912mac_label_init(struct label *label)
913{
914
915 bzero(label, sizeof(*label));
916 label->l_flags = MAC_FLAG_INITIALIZED;
917}
918
919void
920mac_label_destroy(struct label *label)
921{
922
923 KASSERT(label->l_flags & MAC_FLAG_INITIALIZED,
924 ("destroying uninitialized label"));
925
926 bzero(label, sizeof(*label));
927 /* implicit: label->l_flags &= ~MAC_FLAG_INITIALIZED; */
928}
929
930int
931mac_check_structmac_consistent(struct user_mac *mac)
932{
933
934 if (mac->m_buflen > MAC_MAX_LABEL_BUF_LEN || mac->m_buflen == 0)
935 return (EINVAL);
936
937 return (0);
938}
939
940/*
941 * Get the external forms of labels from all policies, for a single
942 * label namespace or "*" for all namespaces. Returns ENOENT if no policy
943 * is registered for the namespace, unless the namespace begins with a '?'.
944 */
945static int
946mac_label_externalize(size_t mpo_externalize_off, struct label *label,
947 const char *element, struct sbuf *sb)
948{
949 struct mac_policy_conf *mpc;
950 struct mac_label_listener *mll;
951 struct mac_label_element *mle;
952 struct mac_label_element_list_t *element_list;
953 const char *name;
954 int (*mpo_externalize)(struct label *, char *, struct sbuf *);
955 int all_labels = 0, ignorenotfound = 0, error = 0, busy = FALSE;
956 unsigned int count = 0;
957
958 if (element[0] == '?') {
959 element++;
960 ignorenotfound = 1;
961 } else if (element[0] == '*' && element[1] == '\0')
962 all_labels = 1;
963
964 element_list = &mac_static_label_element_list;
965element_loop:
966 LIST_FOREACH(mle, element_list, mle_list) {
967 name = mle->mle_name;
968 if (all_labels) {
969 if (*name == '?')
970 continue;
971 } else {
972 if (*name == '?')
973 name++;
974 if (strcmp(name, element) != 0)
975 continue;
976 }
977 LIST_FOREACH(mll, &mle->mle_listeners, mll_list) {
978 mpc = mac_policy_list.entries[mll->mll_handle].mpc;
979 if (mpc == NULL)
980 continue;
981 mpo_externalize = *(const typeof(mpo_externalize) *)
982 ((const char *)mpc->mpc_ops + mpo_externalize_off);
983 if (mpo_externalize == NULL)
984 continue;
985 error = sbuf_printf(sb, "%s/", name);
986 if (error)
987 goto done;
988 error = mpo_externalize(label, mle->mle_name, sb);
989 if (error) {
990 if (error != ENOENT)
991 goto done;
992 /*
993 * If a policy doesn't have a label to
994 * externalize it returns ENOENT. This
995 * may occur for policies that support
996 * multiple label elements for some
997 * (but not all) object types.
998 */
999 sbuf_setpos(sb, sbuf_len(sb) -
1000 (strlen(name) + 1));
1001 error = 0;
1002 continue;
1003 }
1004 error = sbuf_putc(sb, ',');
1005 if (error)
1006 goto done;
1007 count++;
1008 }
1009 }
1010 /* If there are dynamic policies present, check their elements too. */
1011 if (!busy && mac_policy_list_conditional_busy() == 1) {
1012 element_list = &mac_label_element_list;
1013 busy = TRUE;
1014 goto element_loop;
1015 }
1016done:
1017 if (busy)
1018 mac_policy_list_unbusy();
1019 if (!error && count == 0) {
1020 if (!all_labels && !ignorenotfound)
1021 error = ENOENT; /* XXX: ENOLABEL? */
1022 }
1023 return (error);
1024}
1025
1026/*
1027 * Get the external forms of labels from all policies, for all label
1028 * namespaces contained in a list.
1029 *
1030 * XXX This may be leaking an sbuf.
1031 */
1032int
1033mac_externalize(size_t mpo_externalize_off, struct label *label,
1034 const char *elementlist, char *outbuf, size_t outbuflen)
1035{
1036 char *element;
1037 char *scratch_base;
1038 char *scratch;
1039 struct sbuf sb;
1040 int error = 0, len;
1041
1042 /* allocate a scratch buffer the size of the string */
1043 MALLOC(scratch_base, char *, strlen(elementlist)+1, M_MACTEMP, M_WAITOK);
1044 if (scratch_base == NULL) {
1045 error = ENOMEM;
1046 goto out;
1047 }
1048
1049 /* copy the elementlist to the scratch buffer */
1050 strlcpy(scratch_base, elementlist, strlen(elementlist)+1);
1051
1052 /*
1053 * set up a temporary pointer that can be used to iterate the
1054 * scratch buffer without losing the allocation address
1055 */
1056 scratch = scratch_base;
1057
1058 /* get an sbuf */
1059 if (sbuf_new(&sb, outbuf, outbuflen, SBUF_FIXEDLEN) == NULL) {
1060 /* could not allocate interior buffer */
1061 error = ENOMEM;
1062 goto out;
1063 }
1064 /* iterate the scratch buffer; NOTE: buffer contents modified! */
1065 while ((element = strsep(&scratch, ",")) != NULL) {
1066 error = mac_label_externalize(mpo_externalize_off, label,
1067 element, &sb);
1068 if (error)
1069 break;
1070 }
1071 if ((len = sbuf_len(&sb)) > 0)
1072 sbuf_setpos(&sb, len - 1); /* trim trailing comma */
1073 sbuf_finish(&sb);
1074
1075out:
1076 if (scratch_base != NULL)
1077 FREE(scratch_base, M_MACTEMP);
1078
1079 return (error);
1080}
1081
1082/*
1083 * Have all policies set the internal form of a label, for a single
1084 * label namespace.
1085 */
1086static int
1087mac_label_internalize(size_t mpo_internalize_off, struct label *label,
1088 char *element_name, char *element_data)
1089{
1090 struct mac_policy_conf *mpc;
1091 struct mac_label_listener *mll;
1092 struct mac_label_element *mle;
1093 struct mac_label_element_list_t *element_list;
1094 int (*mpo_internalize)(struct label *, char *, char *);
1095 int error = 0, busy = FALSE;
1096 unsigned int count = 0;
1097 const char *name;
1098
1099 element_list = &mac_static_label_element_list;
1100element_loop:
1101 LIST_FOREACH(mle, element_list, mle_list) {
1102 if (*(name = mle->mle_name) == '?')
1103 name++;
1104 if (strcmp(element_name, name) != 0)
1105 continue;
1106 LIST_FOREACH(mll, &mle->mle_listeners, mll_list) {
1107 mpc = mac_policy_list.entries[mll->mll_handle].mpc;
1108 if (mpc == NULL)
1109 continue;
1110 mpo_internalize = *(const typeof(mpo_internalize) *)
1111 ((const char *)mpc->mpc_ops + mpo_internalize_off);
1112 if (mpo_internalize == NULL)
1113 continue;
1114 error = mpo_internalize(label, element_name,
1115 element_data);
1116 if (error)
1117 goto done;
1118 count++;
1119 }
1120 }
1121 /* If there are dynamic policies present, check their elements too. */
1122 if (!busy && mac_policy_list_conditional_busy() == 1) {
1123 element_list = &mac_label_element_list;
1124 busy = TRUE;
1125 goto element_loop;
1126 }
1127done:
1128 if (busy)
1129 mac_policy_list_unbusy();
1130 if (!error && count == 0)
1131 error = ENOPOLICY;
1132 return (error);
1133}
1134
1135int
1136mac_internalize(size_t mpo_internalize_off, struct label *label,
1137 char *textlabels)
1138{
1139 char *element_name, *element_data;
1140 int error = 0;
1141
1142 while (!error && (element_name = strsep(&textlabels, ",")) != NULL) {
1143 element_data = strchr(element_name, '/');
1144 if (element_data == NULL) {
1145 error = EINVAL;
1146 break;
1147 }
1148 *element_data++ = '\0';
1149 error = mac_label_internalize(mpo_internalize_off, label,
1150 element_name, element_data);
1151 }
1152 return (error);
1153}
1154
1155/* system calls */
1156
1157int
1158__mac_get_pid(struct proc *p, struct __mac_get_pid_args *uap, int *ret __unused)
1159{
1160 char *elements, *buffer;
1161 struct user_mac mac;
1162 struct proc *tproc;
1163 struct ucred *tcred;
1164 int error;
1165 size_t ulen;
1166
1167 AUDIT_ARG(pid, uap->pid);
1168 if (IS_64BIT_PROCESS(p)) {
1169 struct user64_mac mac64;
1170 error = copyin(uap->mac_p, &mac64, sizeof(mac64));
1171 mac.m_buflen = mac64.m_buflen;
1172 mac.m_string = mac64.m_string;
1173 } else {
1174 struct user32_mac mac32;
1175 error = copyin(uap->mac_p, &mac32, sizeof(mac32));
1176 mac.m_buflen = mac32.m_buflen;
1177 mac.m_string = mac32.m_string;
1178 }
1179 if (error)
1180 return (error);
1181
1182 error = mac_check_structmac_consistent(&mac);
1183 if (error)
1184 return (error);
1185
1186 tproc = proc_find(uap->pid);
1187 if (tproc == NULL)
1188 return (ESRCH);
1189 tcred = kauth_cred_proc_ref(tproc);
1190 proc_rele(tproc);
1191
1192 MALLOC(elements, char *, mac.m_buflen, M_MACTEMP, M_WAITOK);
1193 error = copyinstr(mac.m_string, elements, mac.m_buflen, &ulen);
1194 if (error) {
1195 FREE(elements, M_MACTEMP);
1196 kauth_cred_unref(&tcred);
1197 return (error);
1198 }
1199 AUDIT_ARG(mac_string, elements);
1200
1201 MALLOC(buffer, char *, mac.m_buflen, M_MACTEMP, M_WAITOK | M_ZERO);
1202 error = mac_cred_label_externalize(tcred->cr_label, elements,
1203 buffer, mac.m_buflen, M_WAITOK);
1204 if (error == 0)
1205 error = copyout(buffer, mac.m_string, strlen(buffer)+1);
1206
1207 FREE(buffer, M_MACTEMP);
1208 FREE(elements, M_MACTEMP);
1209 kauth_cred_unref(&tcred);
1210 return (error);
1211}
1212
1213int
1214__mac_get_proc(proc_t p, struct __mac_get_proc_args *uap, int *ret __unused)
1215{
1216 char *elements, *buffer;
1217 struct user_mac mac;
1218 kauth_cred_t cr;
1219 int error;
1220 size_t ulen;
1221
1222 if (IS_64BIT_PROCESS(p)) {
1223 struct user64_mac mac64;
1224 error = copyin(uap->mac_p, &mac64, sizeof(mac64));
1225 mac.m_buflen = mac64.m_buflen;
1226 mac.m_string = mac64.m_string;
1227 } else {
1228 struct user32_mac mac32;
1229 error = copyin(uap->mac_p, &mac32, sizeof(mac32));
1230 mac.m_buflen = mac32.m_buflen;
1231 mac.m_string = mac32.m_string;
1232 }
1233 if (error)
1234 return (error);
1235
1236 error = mac_check_structmac_consistent(&mac);
1237 if (error)
1238 return (error);
1239
1240 MALLOC(elements, char *, mac.m_buflen, M_MACTEMP, M_WAITOK);
1241 error = copyinstr(mac.m_string, elements, mac.m_buflen, &ulen);
1242 if (error) {
1243 FREE(elements, M_MACTEMP);
1244 return (error);
1245 }
1246 AUDIT_ARG(mac_string, elements);
1247
1248 cr = kauth_cred_proc_ref(p);
1249
1250 MALLOC(buffer, char *, mac.m_buflen, M_MACTEMP, M_WAITOK | M_ZERO);
1251 error = mac_cred_label_externalize(cr->cr_label,
1252 elements, buffer, mac.m_buflen, M_WAITOK);
1253 if (error == 0)
1254 error = copyout(buffer, mac.m_string, strlen(buffer)+1);
1255
1256 FREE(buffer, M_MACTEMP);
1257 FREE(elements, M_MACTEMP);
1258 kauth_cred_unref(&cr);
1259 return (error);
1260}
1261
1262int
1263__mac_set_proc(proc_t p, struct __mac_set_proc_args *uap, int *ret __unused)
1264{
1265 struct label *intlabel;
1266 struct user_mac mac;
1267 char *buffer;
1268 int error;
1269 size_t ulen;
1270
1271 if (IS_64BIT_PROCESS(p)) {
1272 struct user64_mac mac64;
1273 error = copyin(uap->mac_p, &mac64, sizeof(mac64));
1274 mac.m_buflen = mac64.m_buflen;
1275 mac.m_string = mac64.m_string;
1276 } else {
1277 struct user32_mac mac32;
1278 error = copyin(uap->mac_p, &mac32, sizeof(mac32));
1279 mac.m_buflen = mac32.m_buflen;
1280 mac.m_string = mac32.m_string;
1281 }
1282 if (error)
1283 return (error);
1284
1285 error = mac_check_structmac_consistent(&mac);
1286 if (error)
1287 return (error);
1288
1289 MALLOC(buffer, char *, mac.m_buflen, M_MACTEMP, M_WAITOK);
1290 error = copyinstr(mac.m_string, buffer, mac.m_buflen, &ulen);
1291 if (error) {
1292 FREE(buffer, M_MACTEMP);
1293 return (error);
1294 }
1295 AUDIT_ARG(mac_string, buffer);
1296
1297 intlabel = mac_cred_label_alloc();
1298 error = mac_cred_label_internalize(intlabel, buffer);
1299 FREE(buffer, M_MACTEMP);
1300 if (error)
1301 goto out;
1302
1303 error = mac_cred_check_label_update(kauth_cred_get(), intlabel);
1304 if (error) {
1305 goto out;
1306 }
1307
1308 error = kauth_proc_label_update(p, intlabel);
1309 if (error)
1310 goto out;
1311
1312out:
1313 mac_cred_label_free(intlabel);
1314 return (error);
1315}
1316
1317int
1318__mac_get_fd(proc_t p, struct __mac_get_fd_args *uap, int *ret __unused)
1319{
1320 struct fileproc *fp;
1321 struct vnode *vp;
1322 struct user_mac mac;
1323 char *elements, *buffer;
1324 int error;
1325 size_t ulen;
1326 kauth_cred_t my_cred;
1327#if CONFIG_MACF_SOCKET
1328 struct socket *so;
1329#endif /* MAC_SOCKET */
1330 struct label *intlabel;
1331
1332 AUDIT_ARG(fd, uap->fd);
1333
1334 if (IS_64BIT_PROCESS(p)) {
1335 struct user64_mac mac64;
1336 error = copyin(uap->mac_p, &mac64, sizeof(mac64));
1337 mac.m_buflen = mac64.m_buflen;
1338 mac.m_string = mac64.m_string;
1339 } else {
1340 struct user32_mac mac32;
1341 error = copyin(uap->mac_p, &mac32, sizeof(mac32));
1342 mac.m_buflen = mac32.m_buflen;
1343 mac.m_string = mac32.m_string;
1344 }
1345
1346 if (error)
1347 return (error);
1348
1349 error = mac_check_structmac_consistent(&mac);
1350 if (error)
1351 return (error);
1352
1353 MALLOC(elements, char *, mac.m_buflen, M_MACTEMP, M_WAITOK);
1354 error = copyinstr(mac.m_string, elements, mac.m_buflen, &ulen);
1355 if (error) {
1356 FREE(elements, M_MACTEMP);
1357 return (error);
1358 }
1359 AUDIT_ARG(mac_string, elements);
1360
1361 MALLOC(buffer, char *, mac.m_buflen, M_MACTEMP, M_WAITOK);
1362 error = fp_lookup(p, uap->fd, &fp, 0);
1363 if (error) {
1364 FREE(buffer, M_MACTEMP);
1365 FREE(elements, M_MACTEMP);
1366 return (error);
1367 }
1368
1369 my_cred = kauth_cred_proc_ref(p);
1370 error = mac_file_check_get(my_cred, fp->f_fglob, elements, mac.m_buflen);
1371 kauth_cred_unref(&my_cred);
1372 if (error) {
1373 fp_drop(p, uap->fd, fp, 0);
1374 FREE(buffer, M_MACTEMP);
1375 FREE(elements, M_MACTEMP);
1376 return (error);
1377 }
1378
1379 switch (FILEGLOB_DTYPE(fp->f_fglob)) {
1380 case DTYPE_VNODE:
1381 intlabel = mac_vnode_label_alloc();
1382 if (intlabel == NULL) {
1383 error = ENOMEM;
1384 break;
1385 }
1386 vp = (struct vnode *)fp->f_fglob->fg_data;
1387 error = vnode_getwithref(vp);
1388 if (error == 0) {
1389 mac_vnode_label_copy(vp->v_label, intlabel);
1390 error = mac_vnode_label_externalize(intlabel,
1391 elements, buffer,
1392 mac.m_buflen, M_WAITOK);
1393 vnode_put(vp);
1394 }
1395 mac_vnode_label_free(intlabel);
1396 break;
1397 case DTYPE_SOCKET:
1398#if CONFIG_MACF_SOCKET
1399 so = (struct socket *) fp->f_fglob->fg_data;
1400 intlabel = mac_socket_label_alloc(MAC_WAITOK);
1401 sock_lock(so, 1);
1402 mac_socket_label_copy(so->so_label, intlabel);
1403 sock_unlock(so, 1);
1404 error = mac_socket_label_externalize(intlabel, elements, buffer, mac.m_buflen);
1405 mac_socket_label_free(intlabel);
1406 break;
1407#endif
1408 case DTYPE_PSXSHM:
1409 case DTYPE_PSXSEM:
1410 case DTYPE_PIPE:
1411 case DTYPE_KQUEUE:
1412 case DTYPE_FSEVENTS:
1413 case DTYPE_ATALK:
1414 case DTYPE_NETPOLICY:
1415 default:
1416 error = ENOSYS; // only sockets/vnodes so far
1417 break;
1418 }
1419 fp_drop(p, uap->fd, fp, 0);
1420
1421 if (error == 0)
1422 error = copyout(buffer, mac.m_string, strlen(buffer)+1);
1423
1424 FREE(buffer, M_MACTEMP);
1425 FREE(elements, M_MACTEMP);
1426 return (error);
1427}
1428
1429static int
1430mac_get_filelink(proc_t p, user_addr_t mac_p, user_addr_t path_p, int follow)
1431{
1432 struct vnode *vp;
1433 vfs_context_t ctx;
1434 char *elements, *buffer;
1435 struct nameidata nd;
1436 struct label *intlabel;
1437 struct user_mac mac;
1438 int error;
1439 size_t ulen;
1440
1441 if (IS_64BIT_PROCESS(p)) {
1442 struct user64_mac mac64;
1443 error = copyin(mac_p, &mac64, sizeof(mac64));
1444 mac.m_buflen = mac64.m_buflen;
1445 mac.m_string = mac64.m_string;
1446 } else {
1447 struct user32_mac mac32;
1448 error = copyin(mac_p, &mac32, sizeof(mac32));
1449 mac.m_buflen = mac32.m_buflen;
1450 mac.m_string = mac32.m_string;
1451 }
1452
1453 if (error)
1454 return (error);
1455
1456 error = mac_check_structmac_consistent(&mac);
1457 if (error)
1458 return (error);
1459
1460 MALLOC(elements, char *, mac.m_buflen, M_MACTEMP, M_WAITOK);
1461 MALLOC(buffer, char *, mac.m_buflen, M_MACTEMP, M_WAITOK | M_ZERO);
1462
1463 error = copyinstr(mac.m_string, elements, mac.m_buflen, &ulen);
1464 if (error) {
1465 FREE(buffer, M_MACTEMP);
1466 FREE(elements, M_MACTEMP);
1467 return (error);
1468 }
1469 AUDIT_ARG(mac_string, elements);
1470
1471 ctx = vfs_context_current();
1472
1473 NDINIT(&nd, LOOKUP, OP_LOOKUP,
1474 LOCKLEAF | (follow ? FOLLOW : NOFOLLOW) | AUDITVNPATH1,
1475 UIO_USERSPACE, path_p, ctx);
1476 error = namei(&nd);
1477 if (error) {
1478 FREE(buffer, M_MACTEMP);
1479 FREE(elements, M_MACTEMP);
1480 return (error);
1481 }
1482 vp = nd.ni_vp;
1483
1484 nameidone(&nd);
1485
1486 intlabel = mac_vnode_label_alloc();
1487 mac_vnode_label_copy(vp->v_label, intlabel);
1488 error = mac_vnode_label_externalize(intlabel, elements, buffer,
1489 mac.m_buflen, M_WAITOK);
1490 mac_vnode_label_free(intlabel);
1491 if (error == 0)
1492 error = copyout(buffer, mac.m_string, strlen(buffer) + 1);
1493
1494 vnode_put(vp);
1495
1496 FREE(buffer, M_MACTEMP);
1497 FREE(elements, M_MACTEMP);
1498
1499 return (error);
1500}
1501
1502int
1503__mac_get_file(proc_t p, struct __mac_get_file_args *uap,
1504 int *ret __unused)
1505{
1506
1507 return (mac_get_filelink(p, uap->mac_p, uap->path_p, 1));
1508}
1509
1510int
1511__mac_get_link(proc_t p, struct __mac_get_link_args *uap,
1512 int *ret __unused)
1513{
1514
1515 return (mac_get_filelink(p, uap->mac_p, uap->path_p, 0));
1516}
1517
1518int
1519__mac_set_fd(proc_t p, struct __mac_set_fd_args *uap, int *ret __unused)
1520{
1521
1522 struct fileproc *fp;
1523 struct user_mac mac;
1524 struct vfs_context *ctx = vfs_context_current();
1525 int error;
1526 size_t ulen;
1527 char *buffer;
1528 struct label *intlabel;
1529#if CONFIG_MACF_SOCKET
1530 struct socket *so;
1531#endif
1532 struct vnode *vp;
1533
1534 AUDIT_ARG(fd, uap->fd);
1535
1536 if (IS_64BIT_PROCESS(p)) {
1537 struct user64_mac mac64;
1538 error = copyin(uap->mac_p, &mac64, sizeof(mac64));
1539 mac.m_buflen = mac64.m_buflen;
1540 mac.m_string = mac64.m_string;
1541 } else {
1542 struct user32_mac mac32;
1543 error = copyin(uap->mac_p, &mac32, sizeof(mac32));
1544 mac.m_buflen = mac32.m_buflen;
1545 mac.m_string = mac32.m_string;
1546 }
1547 if (error)
1548 return (error);
1549
1550 error = mac_check_structmac_consistent(&mac);
1551 if (error)
1552 return (error);
1553
1554 MALLOC(buffer, char *, mac.m_buflen, M_MACTEMP, M_WAITOK);
1555 error = copyinstr(mac.m_string, buffer, mac.m_buflen, &ulen);
1556 if (error) {
1557 FREE(buffer, M_MACTEMP);
1558 return (error);
1559 }
1560 AUDIT_ARG(mac_string, buffer);
1561
1562 error = fp_lookup(p, uap->fd, &fp, 0);
1563 if (error) {
1564 FREE(buffer, M_MACTEMP);
1565 return (error);
1566 }
1567
1568
1569 error = mac_file_check_set(vfs_context_ucred(ctx), fp->f_fglob, buffer, mac.m_buflen);
1570 if (error) {
1571 fp_drop(p, uap->fd, fp, 0);
1572 FREE(buffer, M_MACTEMP);
1573 return (error);
1574 }
1575
1576 switch (FILEGLOB_DTYPE(fp->f_fglob)) {
1577
1578 case DTYPE_VNODE:
1579 if (mac_label_vnodes == 0) {
1580 error = ENOSYS;
1581 break;
1582 }
1583
1584 intlabel = mac_vnode_label_alloc();
1585
1586 error = mac_vnode_label_internalize(intlabel, buffer);
1587 if (error) {
1588 mac_vnode_label_free(intlabel);
1589 break;
1590 }
1591
1592
1593 vp = (struct vnode *)fp->f_fglob->fg_data;
1594
1595 error = vnode_getwithref(vp);
1596 if (error == 0) {
1597 error = vn_setlabel(vp, intlabel, ctx);
1598 vnode_put(vp);
1599 }
1600 mac_vnode_label_free(intlabel);
1601 break;
1602
1603 case DTYPE_SOCKET:
1604#if CONFIG_MACF_SOCKET
1605 intlabel = mac_socket_label_alloc(MAC_WAITOK);
1606 error = mac_socket_label_internalize(intlabel, buffer);
1607 if (error == 0) {
1608 so = (struct socket *) fp->f_fglob->fg_data;
1609 SOCK_LOCK(so);
1610 error = mac_socket_label_update(vfs_context_ucred(ctx), so, intlabel);
1611 SOCK_UNLOCK(so);
1612 }
1613 mac_socket_label_free(intlabel);
1614 break;
1615#endif
1616 case DTYPE_PSXSHM:
1617 case DTYPE_PSXSEM:
1618 case DTYPE_PIPE:
1619 case DTYPE_KQUEUE:
1620 case DTYPE_FSEVENTS:
1621 case DTYPE_ATALK:
1622 case DTYPE_NETPOLICY:
1623 default:
1624 error = ENOSYS; // only sockets/vnodes so far
1625 break;
1626 }
1627
1628 fp_drop(p, uap->fd, fp, 0);
1629 FREE(buffer, M_MACTEMP);
1630 return (error);
1631}
1632
1633static int
1634mac_set_filelink(proc_t p, user_addr_t mac_p, user_addr_t path_p,
1635 int follow)
1636{
1637 struct vnode *vp;
1638 struct vfs_context *ctx = vfs_context_current();
1639 struct label *intlabel;
1640 struct nameidata nd;
1641 struct user_mac mac;
1642 char *buffer;
1643 int error;
1644 size_t ulen;
1645
1646 if (mac_label_vnodes == 0)
1647 return ENOSYS;
1648
1649 if (IS_64BIT_PROCESS(p)) {
1650 struct user64_mac mac64;
1651 error = copyin(mac_p, &mac64, sizeof(mac64));
1652 mac.m_buflen = mac64.m_buflen;
1653 mac.m_string = mac64.m_string;
1654 } else {
1655 struct user32_mac mac32;
1656 error = copyin(mac_p, &mac32, sizeof(mac32));
1657 mac.m_buflen = mac32.m_buflen;
1658 mac.m_string = mac32.m_string;
1659 }
1660 if (error)
1661 return (error);
1662
1663 error = mac_check_structmac_consistent(&mac);
1664 if (error) {
1665 printf("mac_set_file: failed structure consistency check\n");
1666 return (error);
1667 }
1668
1669 MALLOC(buffer, char *, mac.m_buflen, M_MACTEMP, M_WAITOK);
1670 error = copyinstr(mac.m_string, buffer, mac.m_buflen, &ulen);
1671 if (error) {
1672 FREE(buffer, M_MACTEMP);
1673 return (error);
1674 }
1675 AUDIT_ARG(mac_string, buffer);
1676
1677 intlabel = mac_vnode_label_alloc();
1678 error = mac_vnode_label_internalize(intlabel, buffer);
1679 FREE(buffer, M_MACTEMP);
1680 if (error) {
1681 mac_vnode_label_free(intlabel);
1682 return (error);
1683 }
1684
1685 NDINIT(&nd, LOOKUP, OP_LOOKUP,
1686 LOCKLEAF | (follow ? FOLLOW : NOFOLLOW) | AUDITVNPATH1,
1687 UIO_USERSPACE, path_p, ctx);
1688 error = namei(&nd);
1689 if (error) {
1690 mac_vnode_label_free(intlabel);
1691 return (error);
1692 }
1693 vp = nd.ni_vp;
1694
1695 nameidone(&nd);
1696
1697 error = vn_setlabel(vp, intlabel, ctx);
1698 vnode_put(vp);
1699 mac_vnode_label_free(intlabel);
1700
1701 return (error);
1702}
1703
1704int
1705__mac_set_file(proc_t p, struct __mac_set_file_args *uap,
1706 int *ret __unused)
1707{
1708
1709 return (mac_set_filelink(p, uap->mac_p, uap->path_p, 1));
1710}
1711
1712int
1713__mac_set_link(proc_t p, struct __mac_set_link_args *uap,
1714 int *ret __unused)
1715{
1716
1717 return (mac_set_filelink(p, uap->mac_p, uap->path_p, 0));
1718}
1719
1720/*
1721 * __mac_syscall: Perform a MAC policy system call
1722 *
1723 * Parameters: p Process calling this routine
1724 * uap User argument descriptor (see below)
1725 * retv (Unused)
1726 *
1727 * Indirect: uap->policy Name of target MAC policy
1728 * uap->call MAC policy-specific system call to perform
1729 * uap->arg MAC policy-specific system call arguments
1730 *
1731 * Returns: 0 Success
1732 * !0 Not success
1733 *
1734 */
1735int
1736__mac_syscall(proc_t p, struct __mac_syscall_args *uap, int *retv __unused)
1737{
1738 struct mac_policy_conf *mpc;
1739 char target[MAC_MAX_POLICY_NAME];
1740 int error;
1741 u_int i;
1742 size_t ulen;
1743
1744 error = copyinstr(uap->policy, target, sizeof(target), &ulen);
1745 if (error)
1746 return (error);
1747 AUDIT_ARG(value32, uap->call);
1748 AUDIT_ARG(mac_string, target);
1749
1750 error = ENOPOLICY;
1751
1752 for (i = 0; i < mac_policy_list.staticmax; i++) {
1753 mpc = mac_policy_list.entries[i].mpc;
1754 if (mpc == NULL)
1755 continue;
1756
1757 if (strcmp(mpc->mpc_name, target) == 0 &&
1758 mpc->mpc_ops->mpo_policy_syscall != NULL) {
1759 error = mpc->mpc_ops->mpo_policy_syscall(p,
1760 uap->call, uap->arg);
1761 goto done;
1762 }
1763 }
1764 if (mac_policy_list_conditional_busy() != 0) {
1765 for (; i <= mac_policy_list.maxindex; i++) {
1766 mpc = mac_policy_list.entries[i].mpc;
1767 if (mpc == NULL)
1768 continue;
1769
1770 if (strcmp(mpc->mpc_name, target) == 0 &&
1771 mpc->mpc_ops->mpo_policy_syscall != NULL) {
1772 error = mpc->mpc_ops->mpo_policy_syscall(p,
1773 uap->call, uap->arg);
1774 break;
1775 }
1776 }
1777 mac_policy_list_unbusy();
1778 }
1779
1780done:
1781 return (error);
1782}
1783
1784int
1785mac_mount_label_get(struct mount *mp, user_addr_t mac_p)
1786{
1787 char *elements, *buffer;
1788 struct label *label;
1789 struct user_mac mac;
1790 int error;
1791 size_t ulen;
1792
1793 if (IS_64BIT_PROCESS(current_proc())) {
1794 struct user64_mac mac64;
1795 error = copyin(mac_p, &mac64, sizeof(mac64));
1796 mac.m_buflen = mac64.m_buflen;
1797 mac.m_string = mac64.m_string;
1798 } else {
1799 struct user32_mac mac32;
1800 error = copyin(mac_p, &mac32, sizeof(mac32));
1801 mac.m_buflen = mac32.m_buflen;
1802 mac.m_string = mac32.m_string;
1803 }
1804 if (error)
1805 return (error);
1806
1807 error = mac_check_structmac_consistent(&mac);
1808 if (error)
1809 return (error);
1810
1811 MALLOC(elements, char *, mac.m_buflen, M_MACTEMP, M_WAITOK);
1812 error = copyinstr(mac.m_string, elements, mac.m_buflen, &ulen);
1813 if (error) {
1814 FREE(elements, M_MACTEMP);
1815 return (error);
1816 }
1817 AUDIT_ARG(mac_string, elements);
1818
1819 label = mp->mnt_mntlabel;
1820 MALLOC(buffer, char *, mac.m_buflen, M_MACTEMP, M_WAITOK | M_ZERO);
1821 error = mac_mount_label_externalize(label, elements, buffer,
1822 mac.m_buflen);
1823 FREE(elements, M_MACTEMP);
1824
1825 if (error == 0)
1826 error = copyout(buffer, mac.m_string, strlen(buffer) + 1);
1827 FREE(buffer, M_MACTEMP);
1828
1829 return (error);
1830}
1831
1832/*
1833 * __mac_get_mount: Get mount point label information for a given pathname
1834 *
1835 * Parameters: p (ignored)
1836 * uap User argument descriptor (see below)
1837 * ret (ignored)
1838 *
1839 * Indirect: uap->path Pathname
1840 * uap->mac_p MAC info
1841 *
1842 * Returns: 0 Success
1843 * !0 Not success
1844 */
1845int
1846__mac_get_mount(proc_t p __unused, struct __mac_get_mount_args *uap,
1847 int *ret __unused)
1848{
1849 struct nameidata nd;
1850 struct vfs_context *ctx = vfs_context_current();
1851 struct mount *mp;
1852 int error;
1853
1854 NDINIT(&nd, LOOKUP, OP_LOOKUP, FOLLOW | AUDITVNPATH1,
1855 UIO_USERSPACE, uap->path, ctx);
1856 error = namei(&nd);
1857 if (error) {
1858 return (error);
1859 }
1860 mp = nd.ni_vp->v_mount;
1861 vnode_put(nd.ni_vp);
1862 nameidone(&nd);
1863
1864 return mac_mount_label_get(mp, uap->mac_p);
1865}
1866
1867/*
1868 * mac_schedule_userret()
1869 *
1870 * Schedule a callback to the mpo_thread_userret hook. The mpo_thread_userret
1871 * hook is called just before the thread exit from the kernel in ast_taken().
1872 *
1873 * Returns: 0 Success
1874 * !0 Not successful
1875 */
1876int
1877mac_schedule_userret(void)
1878{
1879
1880 act_set_astmacf(current_thread());
1881 return (0);
1882}
1883
1884/*
1885 * mac_do_machexc()
1886 *
1887 * Do a Mach exception. This should only be done in the mpo_thread_userret
1888 * callback.
1889 *
1890 * params: code exception code
1891 * subcode exception subcode
1892 * flags flags:
1893 * MAC_DOEXCF_TRACED Only do exception if being
1894 * ptrace()'ed.
1895 *
1896 *
1897 * Returns: 0 Success
1898 * !0 Not successful
1899 */
1900int
1901mac_do_machexc(int64_t code, int64_t subcode, uint32_t flags)
1902{
1903 mach_exception_data_type_t codes[EXCEPTION_CODE_MAX];
1904 proc_t p = current_proc();
1905
1906 /* Only allow execption codes in MACF's reserved range. */
1907 if ((code < EXC_MACF_MIN) || (code > EXC_MACF_MAX))
1908 return (1);
1909
1910 if (flags & MAC_DOEXCF_TRACED &&
1911 !(p->p_lflag & P_LTRACED && (p->p_lflag & P_LPPWAIT) == 0))
1912 return (0);
1913
1914
1915 /* Send the Mach exception */
1916 codes[0] = (mach_exception_data_type_t)code;
1917 codes[1] = (mach_exception_data_type_t)subcode;
1918
1919 return (bsd_exception(EXC_SOFTWARE, codes, 2) != KERN_SUCCESS);
1920}
1921
1922#else /* MAC */
1923
1924void (*load_security_extensions_function)(void) = 0;
1925
1926struct sysctl_oid_list sysctl__security_mac_children;
1927
1928int
1929mac_policy_register(struct mac_policy_conf *mpc __unused,
1930 mac_policy_handle_t *handlep __unused, void *xd __unused)
1931{
1932
1933 return (0);
1934}
1935
1936int
1937mac_policy_unregister(mac_policy_handle_t handle __unused)
1938{
1939
1940 return (0);
1941}
1942
1943int
1944mac_audit_text(char *text __unused, mac_policy_handle_t handle __unused)
1945{
1946
1947 return (0);
1948}
1949
1950int
1951mac_vnop_setxattr(struct vnode *vp __unused, const char *name __unused, char *buf __unused, size_t len __unused)
1952{
1953
1954 return (ENOENT);
1955}
1956
1957int
1958mac_vnop_getxattr(struct vnode *vp __unused, const char *name __unused,
1959 char *buf __unused, size_t len __unused, size_t *attrlen __unused)
1960{
1961
1962 return (ENOENT);
1963}
1964
1965int
1966mac_vnop_removexattr(struct vnode *vp __unused, const char *name __unused)
1967{
1968
1969 return (ENOENT);
1970}
1971
1972int
1973mac_file_setxattr(struct fileglob *fg __unused, const char *name __unused, char *buf __unused, size_t len __unused)
1974{
1975
1976 return (ENOENT);
1977}
1978
1979int
1980mac_file_getxattr(struct fileglob *fg __unused, const char *name __unused,
1981 char *buf __unused, size_t len __unused, size_t *attrlen __unused)
1982{
1983
1984 return (ENOENT);
1985}
1986
1987int
1988mac_file_removexattr(struct fileglob *fg __unused, const char *name __unused)
1989{
1990
1991 return (ENOENT);
1992}
1993
1994intptr_t mac_label_get(struct label *l __unused, int slot __unused)
1995{
1996 return 0;
1997}
1998
1999void mac_label_set(struct label *l __unused, int slot __unused, intptr_t v __unused)
2000{
2001 return;
2002}
2003
2004int mac_iokit_check_hid_control(kauth_cred_t cred __unused);
2005int mac_iokit_check_hid_control(kauth_cred_t cred __unused)
2006{
2007 return 0;
2008}
2009
2010int mac_vnode_check_trigger_resolve(vfs_context_t ctx __unused, struct vnode *dvp __unused, struct componentname *cnp __unused);
2011int mac_vnode_check_trigger_resolve(vfs_context_t ctx __unused, struct vnode *dvp __unused, struct componentname *cnp __unused)
2012{
2013 return 0;
2014}
2015
2016#endif /* !MAC */
2017