d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
0a49733cb9
freebsd-dev/sys/security/mac_lomac/mac_lomac.c

2962 lines
72 KiB
C
Raw Normal View History

Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
/*-
Allow MAC policy modules to control access to audit configuration system calls. Add MAC Framework entry points and MAC policy entry points for audit(), auditctl(), auditon(), setaudit(), aud setauid(). MAC Framework entry points are only added for audit system calls where additional argument context may be useful for policy decision-making; other audit system calls without arguments may be controlled via the priv(9) entry points. Update various policy modules to implement audit-related checks, and in some cases, other missing system-related checks. Obtained from: TrustedBSD Project Sponsored by: SPARTA, Inc.
2007-04-21 22:08:48 +00:00
* Copyright (c) 1999-2002, 2007 Robert N. M. Watson
Remove policy references to mpo_check_vnode_mprotect(), which is currently unimplemented. Update copyrights. Pointed out by: csjp
2005-01-26 23:43:32 +00:00
* Copyright (c) 2001-2005 Networks Associates Technology, Inc.
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
* All rights reserved.
*
* This software was developed by Robert Watson for the TrustedBSD Project.
*
* This software was developed for the FreeBSD Project in part by NAI Labs,
* the Security Research Division of Network Associates, Inc. under
* DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA
* CHATS research program.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
* $FreeBSD$
*/
/*
* Developed by the TrustedBSD Project.
Remove MAC Framework access control check entry points made redundant with the introduction of priv(9) and MAC Framework entry points for privilege checking/granting. These entry points exactly aligned with privileges and provided no additional security context: - mac_check_sysarch_ioperm() - mac_check_kld_unload() - mac_check_settime() - mac_check_system_nfsd() Add mpo_priv_check() implementations to Biba and LOMAC policies, which, for each privilege, determine if they can be granted to processes considered unprivileged by those two policies. These mostly, but not entirely, align with the set of privileges granted in jails. Obtained from: TrustedBSD Project
2007-04-22 15:31:22 +00:00
*
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
* Low-watermark floating label mandatory integrity policy.
*/
#include <sys/types.h>
#include <sys/param.h>
#include <sys/acl.h>
#include <sys/conf.h>
#include <sys/extattr.h>
#include <sys/kernel.h>
#include <sys/malloc.h>
Move MAC check_vnode_mmap entry point out from being exclusive to MAP_SHARED so that the entry point gets executed un-conditionally. This may be useful for security policies which want to perform access control checks around run-time linking. -add the mmap(2) flags argument to the check_vnode_mmap entry point so that we can make access control decisions based on the type of mapped object. -update any dependent API around this parameter addition such as function prototype modifications, entry point parameter additions and the inclusion of sys/mman.h header file. -Change the MLS, BIBA and LOMAC security policies so that subject domination routines are not executed unless the type of mapping is shared. This is done to maintain compatibility between the old vm_mmap_vnode(9) and these policies. Reviewed by: rwatson MFC after: 1 month
2005-04-14 16:03:30 +00:00
#include <sys/mman.h>
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
#include <sys/mount.h>
Sweep kernel replacing suser(9) calls with priv(9) calls, assigning specific privilege names to a broad range of privileges. These may require some future tweaking. Sponsored by: nCircle Network Security, Inc. Obtained from: TrustedBSD Project Discussed on: arch@ Reviewed (at least in part) by: mlaier, jmg, pjd, bde, ceri, Alex Lyashkov <umka at sevcity dot net>, Skip Ford <skip dot ford at verizon dot net>, Antoine Brodin <antoine dot brodin at laposte dot net>
2006-11-06 13:42:10 +00:00
#include <sys/priv.h>
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
#include <sys/proc.h>
Redesign the externalization APIs from the MAC Framework to the MAC policy modules to improve robustness against C string bugs and vulnerabilities. Following these revisions, all string construction of labels for export to userspace (or elsewhere) is performed using the sbuf API, which prevents the consumer from having to perform laborious and intricate pointer and buffer checks. This substantially simplifies the externalization logic, both at the MAC Framework level, and in individual policies; this becomes especially useful when policies export more complex label data, such as with compartments in Biba and MLS. Bundled in here are some other minor fixes associated with externalization: including avoiding malloc while holding the process mutex in mac_lomac, and hence avoid a failure mode when printing labels during a downgrade operation due to the removal of the M_NOWAIT case. This has been running in the MAC development tree for about three weeks without problems. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-06-23 01:26:34 +00:00
#include <sys/sbuf.h>
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
#include <sys/systm.h>
#include <sys/sysproto.h>
#include <sys/sysent.h>
#include <sys/systm.h>
#include <sys/vnode.h>
#include <sys/file.h>
#include <sys/socket.h>
#include <sys/socketvar.h>
Add #include <sys/sx.h>, devfs is going to require this shortly.
2005-09-19 18:52:51 +00:00
#include <sys/sx.h>
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
#include <sys/pipe.h>
#include <sys/sysctl.h>
#include <sys/syslog.h>
#include <fs/devfs/devfs.h>
#include <net/bpfdesc.h>
#include <net/if.h>
#include <net/if_types.h>
#include <net/if_var.h>
#include <netinet/in.h>
Introduce a MAC label reference in 'struct inpcb', which caches the MAC label referenced from 'struct socket' in the IPv4 and IPv6-based protocols. This permits MAC labels to be checked during network delivery operations without dereferencing inp->inp_socket to get to so->so_label, which will eventually avoid our having to grab the socket lock during delivery at the network layer. This change introduces 'struct inpcb' as a labeled object to the MAC Framework, along with the normal circus of entry points: initialization, creation from socket, destruction, as well as a delivery access control check. For most policies, the inpcb label will simply be a cache of the socket label, so a new protocol switch method is introduced, pr_sosetlabel() to notify protocols that the socket layer label has been updated so that the cache can be updated while holding appropriate locks. Most protocols implement this using pru_sosetlabel_null(), but IPv4/IPv6 protocols using inpcbs use the the worker function in_pcbsosetlabel(), which calls into the MAC Framework to perform a cache update. Biba, LOMAC, and MLS implement these entry points, as do the stub policy, and test policy. Reviewed by: sam, bms Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-11-18 00:39:07 +00:00
#include <netinet/in_pcb.h>
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
#include <netinet/ip_var.h>
#include <vm/vm.h>
Move src/sys/sys/mac_policy.h, the kernel interface between the MAC Framework and security modules, to src/sys/security/mac/mac_policy.h, completing the removal of kernel-only MAC Framework include files from src/sys/sys. Update the MAC Framework and MAC policy modules. Delete the old mac_policy.h. Third party policy modules will need similar updating. Obtained from: TrustedBSD Project
2006-12-22 23:34:47 +00:00
#include <security/mac/mac_policy.h>
Complete break-out of sys/sys/mac.h into sys/security/mac/mac_framework.h begun with a repo-copy of mac.h to mac_framework.h. sys/mac.h now contains the userspace and user<->kernel API and definitions, with all in-kernel interfaces moved to mac_framework.h, which is now included across most of the kernel instead. This change is the first step in a larger cleanup and sweep of MAC Framework interfaces in the kernel, and will not be MFC'd. Obtained from: TrustedBSD Project Sponsored by: SPARTA
2006-10-22 11:52:19 +00:00
#include <security/mac/mac_framework.h>
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
#include <security/mac_lomac/mac_lomac.h>
struct mac_lomac_proc {
struct mac_lomac mac_lomac;
struct mtx mtx;
};
SYSCTL_DECL(_security_mac);
SYSCTL_NODE(_security_mac, OID_AUTO, lomac, CTLFLAG_RW, 0,
"TrustedBSD mac_lomac policy controls");
static int mac_lomac_label_size = sizeof(struct mac_lomac);
SYSCTL_INT(_security_mac_lomac, OID_AUTO, label_size, CTLFLAG_RD,
&mac_lomac_label_size, 0, "Size of struct mac_lomac");
Default policies to on: if you load them or compile them into your kernel, you should expect them to do something, so now they do. This doesn't affect users who don't load or explicitly compile in the policies. Approved by: re (jhb) Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-12-10 16:20:34 +00:00
static int mac_lomac_enabled = 1;
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
SYSCTL_INT(_security_mac_lomac, OID_AUTO, enabled, CTLFLAG_RW,
&mac_lomac_enabled, 0, "Enforce MAC/LOMAC policy");
TUNABLE_INT("security.mac.lomac.enabled", &mac_lomac_enabled);
static int destroyed_not_inited;
SYSCTL_INT(_security_mac_lomac, OID_AUTO, destroyed_not_inited, CTLFLAG_RD,
&destroyed_not_inited, 0, "Count of labels destroyed but not inited");
static int trust_all_interfaces = 0;
SYSCTL_INT(_security_mac_lomac, OID_AUTO, trust_all_interfaces, CTLFLAG_RD,
&trust_all_interfaces, 0, "Consider all interfaces 'trusted' by MAC/LOMAC");
TUNABLE_INT("security.mac.lomac.trust_all_interfaces", &trust_all_interfaces);
static char trusted_interfaces[128];
SYSCTL_STRING(_security_mac_lomac, OID_AUTO, trusted_interfaces, CTLFLAG_RD,
trusted_interfaces, 0, "Interfaces considered 'trusted' by MAC/LOMAC");
TUNABLE_STR("security.mac.lomac.trusted_interfaces", trusted_interfaces,
sizeof(trusted_interfaces));
static int ptys_equal = 0;
SYSCTL_INT(_security_mac_lomac, OID_AUTO, ptys_equal, CTLFLAG_RW,
&ptys_equal, 0, "Label pty devices as lomac/equal on create");
TUNABLE_INT("security.mac.lomac.ptys_equal", &ptys_equal);
static int revocation_enabled = 1;
SYSCTL_INT(_security_mac_lomac, OID_AUTO, revocation_enabled, CTLFLAG_RW,
&revocation_enabled, 0, "Revoke access to objects on relabel");
TUNABLE_INT("security.mac.lomac.revocation_enabled", &revocation_enabled);
static int mac_lomac_slot;
Introduce accessor functions mac_label_get() and mac_label_set() to replace LABEL_TO_SLOT() macro used by policy modules to query and set label data in struct label. Instead of using a union, store an intptr_t, simplifying the API. Update policies: in most cases this required only small tweaks to current wrapper macros. In two cases, a single wrapper macros had to be split into separate get and set macros. Move struct label definition from _label.h to mac_internal.h and remove _label.h. With this change, policies may now treat struct label * as opaque, allowing us to change the layout of struct label without breaking the policy module ABI. For example, we could make the maximum number of policies with labels modifiable at boot-time rather than just at compile-time. Obtained from: TrustedBSD Project
2007-02-06 14:19:25 +00:00
#define SLOT(l) ((struct mac_lomac *)mac_label_get((l), mac_lomac_slot))
#define SLOT_SET(l, val) mac_label_set((l), mac_lomac_slot, (uintptr_t)(val))
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
#define PSLOT(l) ((struct mac_lomac_proc *) \
Introduce accessor functions mac_label_get() and mac_label_set() to replace LABEL_TO_SLOT() macro used by policy modules to query and set label data in struct label. Instead of using a union, store an intptr_t, simplifying the API. Update policies: in most cases this required only small tweaks to current wrapper macros. In two cases, a single wrapper macros had to be split into separate get and set macros. Move struct label definition from _label.h to mac_internal.h and remove _label.h. With this change, policies may now treat struct label * as opaque, allowing us to change the layout of struct label without breaking the policy module ABI. For example, we could make the maximum number of policies with labels modifiable at boot-time rather than just at compile-time. Obtained from: TrustedBSD Project
2007-02-06 14:19:25 +00:00
mac_label_get((l), mac_lomac_slot))
#define PSLOT_SET(l, val) mac_label_set((l), mac_lomac_slot, (uintptr_t)(val))
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
Normalize a significant number of kernel malloc type names: - Prefer '_' to ' ', as it results in more easily parsed results in memory monitoring tools such as vmstat. - Remove punctuation that is incompatible with using memory type names as file names, such as '/' characters. - Disambiguate some collisions by adding subsystem prefixes to some memory types. - Generally prefer lower case to upper case. - If the same type is defined in multiple architecture directories, attempt to use the same name in additional cases. Not all instances were caught in this change, so more work is required to finish this conversion. Similar changes are required for UMA zone names.
2005-10-31 15:41:29 +00:00
MALLOC_DEFINE(M_MACLOMAC, "mac_lomac_label", "MAC/LOMAC labels");
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
static struct mac_lomac *
lomac_alloc(int flag)
{
struct mac_lomac *mac_lomac;
mac_lomac = malloc(sizeof(struct mac_lomac), M_MACLOMAC, M_ZERO | flag);
return (mac_lomac);
}
static void
lomac_free(struct mac_lomac *mac_lomac)
{
if (mac_lomac != NULL)
free(mac_lomac, M_MACLOMAC);
else
atomic_add_int(&destroyed_not_inited, 1);
}
static int
lomac_atmostflags(struct mac_lomac *mac_lomac, int flags)
{
if ((mac_lomac->ml_flags & flags) != mac_lomac->ml_flags)
return (EINVAL);
return (0);
}
static int
mac_lomac_dominate_element(struct mac_lomac_element *a,
struct mac_lomac_element *b)
{
switch (a->mle_type) {
case MAC_LOMAC_TYPE_EQUAL:
case MAC_LOMAC_TYPE_HIGH:
return (1);
case MAC_LOMAC_TYPE_LOW:
switch (b->mle_type) {
case MAC_LOMAC_TYPE_GRADE:
case MAC_LOMAC_TYPE_HIGH:
return (0);
case MAC_LOMAC_TYPE_EQUAL:
case MAC_LOMAC_TYPE_LOW:
return (1);
default:
panic("mac_lomac_dominate_element: b->mle_type invalid");
}
case MAC_LOMAC_TYPE_GRADE:
switch (b->mle_type) {
case MAC_LOMAC_TYPE_EQUAL:
case MAC_LOMAC_TYPE_LOW:
return (1);
case MAC_LOMAC_TYPE_HIGH:
return (0);
case MAC_LOMAC_TYPE_GRADE:
return (a->mle_grade >= b->mle_grade);
default:
panic("mac_lomac_dominate_element: b->mle_type invalid");
}
default:
panic("mac_lomac_dominate_element: a->mle_type invalid");
}
}
static int
mac_lomac_range_in_range(struct mac_lomac *rangea, struct mac_lomac *rangeb)
{
return (mac_lomac_dominate_element(&rangeb->ml_rangehigh,
&rangea->ml_rangehigh) &&
mac_lomac_dominate_element(&rangea->ml_rangelow,
&rangeb->ml_rangelow));
}
static int
mac_lomac_single_in_range(struct mac_lomac *single, struct mac_lomac *range)
{
KASSERT((single->ml_flags & MAC_LOMAC_FLAG_SINGLE) != 0,
("mac_lomac_single_in_range: a not single"));
KASSERT((range->ml_flags & MAC_LOMAC_FLAG_RANGE) != 0,
("mac_lomac_single_in_range: b not range"));
return (mac_lomac_dominate_element(&range->ml_rangehigh,
&single->ml_single) &&
mac_lomac_dominate_element(&single->ml_single,
&range->ml_rangelow));
}
static int
mac_lomac_auxsingle_in_range(struct mac_lomac *single, struct mac_lomac *range)
{
KASSERT((single->ml_flags & MAC_LOMAC_FLAG_AUX) != 0,
("mac_lomac_single_in_range: a not auxsingle"));
KASSERT((range->ml_flags & MAC_LOMAC_FLAG_RANGE) != 0,
("mac_lomac_single_in_range: b not range"));
return (mac_lomac_dominate_element(&range->ml_rangehigh,
&single->ml_auxsingle) &&
mac_lomac_dominate_element(&single->ml_auxsingle,
&range->ml_rangelow));
}
static int
mac_lomac_dominate_single(struct mac_lomac *a, struct mac_lomac *b)
{
KASSERT((a->ml_flags & MAC_LOMAC_FLAG_SINGLE) != 0,
("mac_lomac_dominate_single: a not single"));
KASSERT((b->ml_flags & MAC_LOMAC_FLAG_SINGLE) != 0,
("mac_lomac_dominate_single: b not single"));
return (mac_lomac_dominate_element(&a->ml_single, &b->ml_single));
}
static int
mac_lomac_subject_dominate(struct mac_lomac *a, struct mac_lomac *b)
{
KASSERT((~a->ml_flags &
(MAC_LOMAC_FLAG_SINGLE | MAC_LOMAC_FLAG_RANGE)) == 0,
("mac_lomac_dominate_single: a not subject"));
KASSERT((b->ml_flags & MAC_LOMAC_FLAG_SINGLE) != 0,
("mac_lomac_dominate_single: b not single"));
return (mac_lomac_dominate_element(&a->ml_rangehigh,
&b->ml_single));
}
static int
mac_lomac_equal_element(struct mac_lomac_element *a, struct mac_lomac_element *b)
{
if (a->mle_type == MAC_LOMAC_TYPE_EQUAL ||
b->mle_type == MAC_LOMAC_TYPE_EQUAL)
return (1);
return (a->mle_type == b->mle_type && a->mle_grade == b->mle_grade);
}
static int
mac_lomac_equal_single(struct mac_lomac *a, struct mac_lomac *b)
{
KASSERT((a->ml_flags & MAC_LOMAC_FLAG_SINGLE) != 0,
("mac_lomac_equal_single: a not single"));
KASSERT((b->ml_flags & MAC_LOMAC_FLAG_SINGLE) != 0,
("mac_lomac_equal_single: b not single"));
return (mac_lomac_equal_element(&a->ml_single, &b->ml_single));
}
static int
mac_lomac_contains_equal(struct mac_lomac *mac_lomac)
{
if (mac_lomac->ml_flags & MAC_LOMAC_FLAG_SINGLE)
if (mac_lomac->ml_single.mle_type == MAC_LOMAC_TYPE_EQUAL)
return (1);
if (mac_lomac->ml_flags & MAC_LOMAC_FLAG_AUX)
if (mac_lomac->ml_auxsingle.mle_type == MAC_LOMAC_TYPE_EQUAL)
return (1);
if (mac_lomac->ml_flags & MAC_LOMAC_FLAG_RANGE) {
if (mac_lomac->ml_rangelow.mle_type == MAC_LOMAC_TYPE_EQUAL)
return (1);
if (mac_lomac->ml_rangehigh.mle_type == MAC_LOMAC_TYPE_EQUAL)
return (1);
}
return (0);
}
static int
mac_lomac_subject_privileged(struct mac_lomac *mac_lomac)
{
KASSERT((mac_lomac->ml_flags & MAC_LOMAC_FLAGS_BOTH) ==
MAC_LOMAC_FLAGS_BOTH,
("mac_lomac_subject_privileged: subject doesn't have both labels"));
/* If the single is EQUAL, it's ok. */
if (mac_lomac->ml_single.mle_type == MAC_LOMAC_TYPE_EQUAL)
return (0);
/* If either range endpoint is EQUAL, it's ok. */
if (mac_lomac->ml_rangelow.mle_type == MAC_LOMAC_TYPE_EQUAL ||
mac_lomac->ml_rangehigh.mle_type == MAC_LOMAC_TYPE_EQUAL)
return (0);
/* If the range is low-high, it's ok. */
if (mac_lomac->ml_rangelow.mle_type == MAC_LOMAC_TYPE_LOW &&
mac_lomac->ml_rangehigh.mle_type == MAC_LOMAC_TYPE_HIGH)
return (0);
/* It's not ok. */
return (EPERM);
}
static int
mac_lomac_high_single(struct mac_lomac *mac_lomac)
{
KASSERT((mac_lomac->ml_flags & MAC_LOMAC_FLAG_SINGLE) != 0,
("mac_lomac_high_single: mac_lomac not single"));
Remove trailing whitespace.
2003-07-05 01:24:36 +00:00
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
return (mac_lomac->ml_single.mle_type == MAC_LOMAC_TYPE_HIGH);
}
static int
mac_lomac_valid(struct mac_lomac *mac_lomac)
{
if (mac_lomac->ml_flags & MAC_LOMAC_FLAG_SINGLE) {
switch (mac_lomac->ml_single.mle_type) {
case MAC_LOMAC_TYPE_GRADE:
case MAC_LOMAC_TYPE_EQUAL:
case MAC_LOMAC_TYPE_HIGH:
case MAC_LOMAC_TYPE_LOW:
break;
default:
return (EINVAL);
}
} else {
if (mac_lomac->ml_single.mle_type != MAC_LOMAC_TYPE_UNDEF)
return (EINVAL);
}
if (mac_lomac->ml_flags & MAC_LOMAC_FLAG_AUX) {
switch (mac_lomac->ml_auxsingle.mle_type) {
case MAC_LOMAC_TYPE_GRADE:
case MAC_LOMAC_TYPE_EQUAL:
case MAC_LOMAC_TYPE_HIGH:
case MAC_LOMAC_TYPE_LOW:
break;
default:
return (EINVAL);
}
} else {
if (mac_lomac->ml_auxsingle.mle_type != MAC_LOMAC_TYPE_UNDEF)
return (EINVAL);
}
if (mac_lomac->ml_flags & MAC_LOMAC_FLAG_RANGE) {
switch (mac_lomac->ml_rangelow.mle_type) {
case MAC_LOMAC_TYPE_GRADE:
case MAC_LOMAC_TYPE_EQUAL:
case MAC_LOMAC_TYPE_HIGH:
case MAC_LOMAC_TYPE_LOW:
break;
default:
return (EINVAL);
}
switch (mac_lomac->ml_rangehigh.mle_type) {
case MAC_LOMAC_TYPE_GRADE:
case MAC_LOMAC_TYPE_EQUAL:
case MAC_LOMAC_TYPE_HIGH:
case MAC_LOMAC_TYPE_LOW:
break;
default:
return (EINVAL);
}
if (!mac_lomac_dominate_element(&mac_lomac->ml_rangehigh,
&mac_lomac->ml_rangelow))
return (EINVAL);
} else {
if (mac_lomac->ml_rangelow.mle_type != MAC_LOMAC_TYPE_UNDEF ||
mac_lomac->ml_rangehigh.mle_type != MAC_LOMAC_TYPE_UNDEF)
return (EINVAL);
}
return (0);
}
static void
mac_lomac_set_range(struct mac_lomac *mac_lomac, u_short typelow,
u_short gradelow, u_short typehigh, u_short gradehigh)
{
mac_lomac->ml_rangelow.mle_type = typelow;
mac_lomac->ml_rangelow.mle_grade = gradelow;
mac_lomac->ml_rangehigh.mle_type = typehigh;
mac_lomac->ml_rangehigh.mle_grade = gradehigh;
mac_lomac->ml_flags |= MAC_LOMAC_FLAG_RANGE;
}
static void
mac_lomac_set_single(struct mac_lomac *mac_lomac, u_short type, u_short grade)
{
mac_lomac->ml_single.mle_type = type;
mac_lomac->ml_single.mle_grade = grade;
mac_lomac->ml_flags |= MAC_LOMAC_FLAG_SINGLE;
}
static void
mac_lomac_copy_range(struct mac_lomac *labelfrom, struct mac_lomac *labelto)
{
KASSERT((labelfrom->ml_flags & MAC_LOMAC_FLAG_RANGE) != 0,
("mac_lomac_copy_range: labelfrom not range"));
labelto->ml_rangelow = labelfrom->ml_rangelow;
labelto->ml_rangehigh = labelfrom->ml_rangehigh;
labelto->ml_flags |= MAC_LOMAC_FLAG_RANGE;
}
static void
mac_lomac_copy_single(struct mac_lomac *labelfrom, struct mac_lomac *labelto)
{
KASSERT((labelfrom->ml_flags & MAC_LOMAC_FLAG_SINGLE) != 0,
("mac_lomac_copy_single: labelfrom not single"));
labelto->ml_single = labelfrom->ml_single;
labelto->ml_flags |= MAC_LOMAC_FLAG_SINGLE;
}
static void
mac_lomac_copy_auxsingle(struct mac_lomac *labelfrom, struct mac_lomac *labelto)
{
KASSERT((labelfrom->ml_flags & MAC_LOMAC_FLAG_AUX) != 0,
("mac_lomac_copy_auxsingle: labelfrom not auxsingle"));
labelto->ml_auxsingle = labelfrom->ml_auxsingle;
labelto->ml_flags |= MAC_LOMAC_FLAG_AUX;
}
static void
mac_lomac_copy(struct mac_lomac *source, struct mac_lomac *dest)
{
if (source->ml_flags & MAC_LOMAC_FLAG_SINGLE)
mac_lomac_copy_single(source, dest);
if (source->ml_flags & MAC_LOMAC_FLAG_AUX)
mac_lomac_copy_auxsingle(source, dest);
if (source->ml_flags & MAC_LOMAC_FLAG_RANGE)
mac_lomac_copy_range(source, dest);
}
Redesign the externalization APIs from the MAC Framework to the MAC policy modules to improve robustness against C string bugs and vulnerabilities. Following these revisions, all string construction of labels for export to userspace (or elsewhere) is performed using the sbuf API, which prevents the consumer from having to perform laborious and intricate pointer and buffer checks. This substantially simplifies the externalization logic, both at the MAC Framework level, and in individual policies; this becomes especially useful when policies export more complex label data, such as with compartments in Biba and MLS. Bundled in here are some other minor fixes associated with externalization: including avoiding malloc while holding the process mutex in mac_lomac, and hence avoid a failure mode when printing labels during a downgrade operation due to the removal of the M_NOWAIT case. This has been running in the MAC development tree for about three weeks without problems. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-06-23 01:26:34 +00:00
static int mac_lomac_to_string(struct sbuf *sb,
struct mac_lomac *mac_lomac);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
static int
maybe_demote(struct mac_lomac *subjlabel, struct mac_lomac *objlabel,
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
const char *actionname, const char *objname, struct vnode *vp)
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
{
Redesign the externalization APIs from the MAC Framework to the MAC policy modules to improve robustness against C string bugs and vulnerabilities. Following these revisions, all string construction of labels for export to userspace (or elsewhere) is performed using the sbuf API, which prevents the consumer from having to perform laborious and intricate pointer and buffer checks. This substantially simplifies the externalization logic, both at the MAC Framework level, and in individual policies; this becomes especially useful when policies export more complex label data, such as with compartments in Biba and MLS. Bundled in here are some other minor fixes associated with externalization: including avoiding malloc while holding the process mutex in mac_lomac, and hence avoid a failure mode when printing labels during a downgrade operation due to the removal of the M_NOWAIT case. This has been running in the MAC development tree for about three weeks without problems. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-06-23 01:26:34 +00:00
struct sbuf subjlabel_sb, subjtext_sb, objlabel_sb;
char *subjlabeltext, *objlabeltext, *subjtext;
struct mac_lomac cached_subjlabel;
struct mac_lomac_proc *subj;
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
struct vattr va;
struct proc *p;
pid_t pgid;
Modify the MAC Framework so that instead of embedding a (struct label) in various kernel objects to represent security data, we embed a (struct label *) pointer, which now references labels allocated using a UMA zone (mac_label.c). This allows the size and shape of struct label to be varied without changing the size and shape of these kernel objects, which become part of the frozen ABI with 5-STABLE. This opens the door for boot-time selection of the number of label slots, and hence changes to the bound on the number of simultaneous labeled policies at boot-time instead of compile-time. This also makes it easier to embed label references in new objects as required for locking/caching with fine-grained network stack locking, such as inpcb structures. This change also moves us further in the direction of hiding the structure of kernel objects from MAC policy modules, not to mention dramatically reducing the number of '&' symbols appearing in both the MAC Framework and MAC policy modules, and improving readability. While this results in minimal performance change with MAC enabled, it will observably shrink the size of a number of critical kernel data structures for the !MAC case, and should have a small (but measurable) performance benefit (i.e., struct vnode, struct socket) do to memory conservation and reduced cost of zeroing memory. NOTE: Users of MAC must recompile their kernel and all MAC modules as a result of this change. Because this is an API change, third party MAC modules will also need to be updated to make less use of the '&' symbol. Suggestions from: bmilekic Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-11-12 03:14:31 +00:00
subj = PSLOT(curthread->td_proc->p_label);
Redesign the externalization APIs from the MAC Framework to the MAC policy modules to improve robustness against C string bugs and vulnerabilities. Following these revisions, all string construction of labels for export to userspace (or elsewhere) is performed using the sbuf API, which prevents the consumer from having to perform laborious and intricate pointer and buffer checks. This substantially simplifies the externalization logic, both at the MAC Framework level, and in individual policies; this becomes especially useful when policies export more complex label data, such as with compartments in Biba and MLS. Bundled in here are some other minor fixes associated with externalization: including avoiding malloc while holding the process mutex in mac_lomac, and hence avoid a failure mode when printing labels during a downgrade operation due to the removal of the M_NOWAIT case. This has been running in the MAC development tree for about three weeks without problems. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-06-23 01:26:34 +00:00
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
p = curthread->td_proc;
mtx_lock(&subj->mtx);
if (subj->mac_lomac.ml_flags & MAC_LOMAC_FLAG_UPDATE) {
/*
* Check to see if the pending demotion would be more or
* less severe than this one, and keep the more severe.
* This can only happen for a multi-threaded application.
*/
if (mac_lomac_dominate_single(objlabel, &subj->mac_lomac)) {
mtx_unlock(&subj->mtx);
return (0);
}
}
bzero(&subj->mac_lomac, sizeof(subj->mac_lomac));
/*
* Always demote the single label.
*/
mac_lomac_copy_single(objlabel, &subj->mac_lomac);
/*
* Start with the original range, then minimize each side of
* the range to the point of not dominating the object. The
* high side will always be demoted, of course.
*/
mac_lomac_copy_range(subjlabel, &subj->mac_lomac);
if (!mac_lomac_dominate_element(&objlabel->ml_single,
&subj->mac_lomac.ml_rangelow))
subj->mac_lomac.ml_rangelow = objlabel->ml_single;
subj->mac_lomac.ml_rangehigh = objlabel->ml_single;
subj->mac_lomac.ml_flags |= MAC_LOMAC_FLAG_UPDATE;
Commit 14/14 of sched_lock decomposition. - Use thread_lock() rather than sched_lock for per-thread scheduling sychronization. - Use the per-process spinlock rather than the sched_lock for per-process scheduling synchronization. Tested by: kris, current@ Tested on: i386, amd64, ULE, 4BSD, libthr, libkse, PREEMPTION, etc. Discussed with: kris, attilio, kmacy, jhb, julian, bde (small parts each)
2007-06-05 00:00:57 +00:00
thread_lock(curthread);
Move a bunch of flags from the KSE to the thread. I was in two minds as to where to put them in the first case.. I should have listenned to the other mind. Submitted by: parts by davidxu@ Reviewed by: jeff@ mini@
2003-02-17 09:55:10 +00:00
curthread->td_flags |= TDF_ASTPENDING;
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
curthread->td_proc->p_sflag |= PS_MACPEND;
Commit 14/14 of sched_lock decomposition. - Use thread_lock() rather than sched_lock for per-thread scheduling sychronization. - Use the per-process spinlock rather than the sched_lock for per-process scheduling synchronization. Tested by: kris, current@ Tested on: i386, amd64, ULE, 4BSD, libthr, libkse, PREEMPTION, etc. Discussed with: kris, attilio, kmacy, jhb, julian, bde (small parts each)
2007-06-05 00:00:57 +00:00
thread_unlock(curthread);
Redesign the externalization APIs from the MAC Framework to the MAC policy modules to improve robustness against C string bugs and vulnerabilities. Following these revisions, all string construction of labels for export to userspace (or elsewhere) is performed using the sbuf API, which prevents the consumer from having to perform laborious and intricate pointer and buffer checks. This substantially simplifies the externalization logic, both at the MAC Framework level, and in individual policies; this becomes especially useful when policies export more complex label data, such as with compartments in Biba and MLS. Bundled in here are some other minor fixes associated with externalization: including avoiding malloc while holding the process mutex in mac_lomac, and hence avoid a failure mode when printing labels during a downgrade operation due to the removal of the M_NOWAIT case. This has been running in the MAC development tree for about three weeks without problems. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-06-23 01:26:34 +00:00
/*
* Avoid memory allocation while holding a mutex; cache the
* label.
*/
mac_lomac_copy_single(&subj->mac_lomac, &cached_subjlabel);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
mtx_unlock(&subj->mtx);
Redesign the externalization APIs from the MAC Framework to the MAC policy modules to improve robustness against C string bugs and vulnerabilities. Following these revisions, all string construction of labels for export to userspace (or elsewhere) is performed using the sbuf API, which prevents the consumer from having to perform laborious and intricate pointer and buffer checks. This substantially simplifies the externalization logic, both at the MAC Framework level, and in individual policies; this becomes especially useful when policies export more complex label data, such as with compartments in Biba and MLS. Bundled in here are some other minor fixes associated with externalization: including avoiding malloc while holding the process mutex in mac_lomac, and hence avoid a failure mode when printing labels during a downgrade operation due to the removal of the M_NOWAIT case. This has been running in the MAC development tree for about three weeks without problems. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-06-23 01:26:34 +00:00
sbuf_new(&subjlabel_sb, NULL, 0, SBUF_AUTOEXTEND);
mac_lomac_to_string(&subjlabel_sb, subjlabel);
sbuf_finish(&subjlabel_sb);
subjlabeltext = sbuf_data(&subjlabel_sb);
sbuf_new(&subjtext_sb, NULL, 0, SBUF_AUTOEXTEND);
mac_lomac_to_string(&subjtext_sb, &subj->mac_lomac);
sbuf_finish(&subjtext_sb);
subjtext = sbuf_data(&subjtext_sb);
sbuf_new(&objlabel_sb, NULL, 0, SBUF_AUTOEXTEND);
mac_lomac_to_string(&objlabel_sb, objlabel);
sbuf_finish(&objlabel_sb);
objlabeltext = sbuf_data(&objlabel_sb);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
pgid = p->p_pgrp->pg_id; /* XXX could be stale? */
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
if (vp != NULL && VOP_GETATTR(vp, &va, curthread->td_ucred,
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
curthread) == 0) {
log(LOG_INFO, "LOMAC: level-%s subject p%dg%du%d:%s demoted to"
" level %s after %s a level-%s %s (inode=%ld, "
"mountpount=%s)\n",
subjlabeltext, p->p_pid, pgid, curthread->td_ucred->cr_uid,
p->p_comm, subjtext, actionname, objlabeltext, objname,
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
va.va_fileid, vp->v_mount->mnt_stat.f_mntonname);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
} else {
log(LOG_INFO, "LOMAC: level-%s subject p%dg%du%d:%s demoted to"
" level %s after %s a level-%s %s\n",
subjlabeltext, p->p_pid, pgid, curthread->td_ucred->cr_uid,
p->p_comm, subjtext, actionname, objlabeltext, objname);
}
Redesign the externalization APIs from the MAC Framework to the MAC policy modules to improve robustness against C string bugs and vulnerabilities. Following these revisions, all string construction of labels for export to userspace (or elsewhere) is performed using the sbuf API, which prevents the consumer from having to perform laborious and intricate pointer and buffer checks. This substantially simplifies the externalization logic, both at the MAC Framework level, and in individual policies; this becomes especially useful when policies export more complex label data, such as with compartments in Biba and MLS. Bundled in here are some other minor fixes associated with externalization: including avoiding malloc while holding the process mutex in mac_lomac, and hence avoid a failure mode when printing labels during a downgrade operation due to the removal of the M_NOWAIT case. This has been running in the MAC development tree for about three weeks without problems. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-06-23 01:26:34 +00:00
sbuf_delete(&subjlabel_sb);
sbuf_delete(&subjtext_sb);
sbuf_delete(&objlabel_sb);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
return (0);
}
/*
* Relabel "to" to "from" only if "from" is a valid label (contains
* at least a single), as for a relabel operation which may or may
* not involve a relevant label.
*/
Correct two warnings by staticizing a function and removing an unused function. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:38:25 +00:00
static void
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
try_relabel(struct mac_lomac *from, struct mac_lomac *to)
{
if (from->ml_flags & MAC_LOMAC_FLAG_SINGLE) {
bzero(to, sizeof(*to));
mac_lomac_copy(from, to);
}
}
/*
* Policy module operations.
*/
static void
mac_lomac_init(struct mac_policy_conf *conf)
{
}
/*
* Label operations.
*/
static void
mac_lomac_init_label(struct label *label)
{
Introduce SLOT_SET macro and use it in place of casts as lvalues.
2004-07-28 07:01:33 +00:00
SLOT_SET(label, lomac_alloc(M_WAITOK));
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
}
static int
mac_lomac_init_label_waitcheck(struct label *label, int flag)
{
Introduce SLOT_SET macro and use it in place of casts as lvalues.
2004-07-28 07:01:33 +00:00
SLOT_SET(label, lomac_alloc(flag));
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
if (SLOT(label) == NULL)
return (ENOMEM);
return (0);
}
static void
mac_lomac_init_proc_label(struct label *label)
{
Introduce SLOT_SET macro and use it in place of casts as lvalues.
2004-07-28 07:01:33 +00:00
PSLOT_SET(label, malloc(sizeof(struct mac_lomac_proc), M_MACLOMAC,
M_ZERO | M_WAITOK));
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
mtx_init(&PSLOT(label)->mtx, "MAC/Lomac proc lock", NULL, MTX_DEF);
}
static void
mac_lomac_destroy_label(struct label *label)
{
lomac_free(SLOT(label));
Introduce SLOT_SET macro and use it in place of casts as lvalues.
2004-07-28 07:01:33 +00:00
SLOT_SET(label, NULL);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
}
static void
mac_lomac_destroy_proc_label(struct label *label)
{
mtx_destroy(&PSLOT(label)->mtx);
FREE(PSLOT(label), M_MACLOMAC);
Introduce SLOT_SET macro and use it in place of casts as lvalues.
2004-07-28 07:01:33 +00:00
PSLOT_SET(label, NULL);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
}
Redesign the externalization APIs from the MAC Framework to the MAC policy modules to improve robustness against C string bugs and vulnerabilities. Following these revisions, all string construction of labels for export to userspace (or elsewhere) is performed using the sbuf API, which prevents the consumer from having to perform laborious and intricate pointer and buffer checks. This substantially simplifies the externalization logic, both at the MAC Framework level, and in individual policies; this becomes especially useful when policies export more complex label data, such as with compartments in Biba and MLS. Bundled in here are some other minor fixes associated with externalization: including avoiding malloc while holding the process mutex in mac_lomac, and hence avoid a failure mode when printing labels during a downgrade operation due to the removal of the M_NOWAIT case. This has been running in the MAC development tree for about three weeks without problems. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-06-23 01:26:34 +00:00
static int
mac_lomac_element_to_string(struct sbuf *sb, struct mac_lomac_element *element)
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
{
switch (element->mle_type) {
case MAC_LOMAC_TYPE_HIGH:
Redesign the externalization APIs from the MAC Framework to the MAC policy modules to improve robustness against C string bugs and vulnerabilities. Following these revisions, all string construction of labels for export to userspace (or elsewhere) is performed using the sbuf API, which prevents the consumer from having to perform laborious and intricate pointer and buffer checks. This substantially simplifies the externalization logic, both at the MAC Framework level, and in individual policies; this becomes especially useful when policies export more complex label data, such as with compartments in Biba and MLS. Bundled in here are some other minor fixes associated with externalization: including avoiding malloc while holding the process mutex in mac_lomac, and hence avoid a failure mode when printing labels during a downgrade operation due to the removal of the M_NOWAIT case. This has been running in the MAC development tree for about three weeks without problems. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-06-23 01:26:34 +00:00
return (sbuf_printf(sb, "high"));
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
case MAC_LOMAC_TYPE_LOW:
Redesign the externalization APIs from the MAC Framework to the MAC policy modules to improve robustness against C string bugs and vulnerabilities. Following these revisions, all string construction of labels for export to userspace (or elsewhere) is performed using the sbuf API, which prevents the consumer from having to perform laborious and intricate pointer and buffer checks. This substantially simplifies the externalization logic, both at the MAC Framework level, and in individual policies; this becomes especially useful when policies export more complex label data, such as with compartments in Biba and MLS. Bundled in here are some other minor fixes associated with externalization: including avoiding malloc while holding the process mutex in mac_lomac, and hence avoid a failure mode when printing labels during a downgrade operation due to the removal of the M_NOWAIT case. This has been running in the MAC development tree for about three weeks without problems. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-06-23 01:26:34 +00:00
return (sbuf_printf(sb, "low"));
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
case MAC_LOMAC_TYPE_EQUAL:
Redesign the externalization APIs from the MAC Framework to the MAC policy modules to improve robustness against C string bugs and vulnerabilities. Following these revisions, all string construction of labels for export to userspace (or elsewhere) is performed using the sbuf API, which prevents the consumer from having to perform laborious and intricate pointer and buffer checks. This substantially simplifies the externalization logic, both at the MAC Framework level, and in individual policies; this becomes especially useful when policies export more complex label data, such as with compartments in Biba and MLS. Bundled in here are some other minor fixes associated with externalization: including avoiding malloc while holding the process mutex in mac_lomac, and hence avoid a failure mode when printing labels during a downgrade operation due to the removal of the M_NOWAIT case. This has been running in the MAC development tree for about three weeks without problems. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-06-23 01:26:34 +00:00
return (sbuf_printf(sb, "equal"));
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
case MAC_LOMAC_TYPE_GRADE:
Redesign the externalization APIs from the MAC Framework to the MAC policy modules to improve robustness against C string bugs and vulnerabilities. Following these revisions, all string construction of labels for export to userspace (or elsewhere) is performed using the sbuf API, which prevents the consumer from having to perform laborious and intricate pointer and buffer checks. This substantially simplifies the externalization logic, both at the MAC Framework level, and in individual policies; this becomes especially useful when policies export more complex label data, such as with compartments in Biba and MLS. Bundled in here are some other minor fixes associated with externalization: including avoiding malloc while holding the process mutex in mac_lomac, and hence avoid a failure mode when printing labels during a downgrade operation due to the removal of the M_NOWAIT case. This has been running in the MAC development tree for about three weeks without problems. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-06-23 01:26:34 +00:00
return (sbuf_printf(sb, "%d", element->mle_grade));
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
default:
panic("mac_lomac_element_to_string: invalid type (%d)",
element->mle_type);
}
}
static int
Redesign the externalization APIs from the MAC Framework to the MAC policy modules to improve robustness against C string bugs and vulnerabilities. Following these revisions, all string construction of labels for export to userspace (or elsewhere) is performed using the sbuf API, which prevents the consumer from having to perform laborious and intricate pointer and buffer checks. This substantially simplifies the externalization logic, both at the MAC Framework level, and in individual policies; this becomes especially useful when policies export more complex label data, such as with compartments in Biba and MLS. Bundled in here are some other minor fixes associated with externalization: including avoiding malloc while holding the process mutex in mac_lomac, and hence avoid a failure mode when printing labels during a downgrade operation due to the removal of the M_NOWAIT case. This has been running in the MAC development tree for about three weeks without problems. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-06-23 01:26:34 +00:00
mac_lomac_to_string(struct sbuf *sb, struct mac_lomac *mac_lomac)
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
{
if (mac_lomac->ml_flags & MAC_LOMAC_FLAG_SINGLE) {
Redesign the externalization APIs from the MAC Framework to the MAC policy modules to improve robustness against C string bugs and vulnerabilities. Following these revisions, all string construction of labels for export to userspace (or elsewhere) is performed using the sbuf API, which prevents the consumer from having to perform laborious and intricate pointer and buffer checks. This substantially simplifies the externalization logic, both at the MAC Framework level, and in individual policies; this becomes especially useful when policies export more complex label data, such as with compartments in Biba and MLS. Bundled in here are some other minor fixes associated with externalization: including avoiding malloc while holding the process mutex in mac_lomac, and hence avoid a failure mode when printing labels during a downgrade operation due to the removal of the M_NOWAIT case. This has been running in the MAC development tree for about three weeks without problems. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-06-23 01:26:34 +00:00
if (mac_lomac_element_to_string(sb, &mac_lomac->ml_single)
== -1)
return (EINVAL);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
}
if (mac_lomac->ml_flags & MAC_LOMAC_FLAG_AUX) {
Redesign the externalization APIs from the MAC Framework to the MAC policy modules to improve robustness against C string bugs and vulnerabilities. Following these revisions, all string construction of labels for export to userspace (or elsewhere) is performed using the sbuf API, which prevents the consumer from having to perform laborious and intricate pointer and buffer checks. This substantially simplifies the externalization logic, both at the MAC Framework level, and in individual policies; this becomes especially useful when policies export more complex label data, such as with compartments in Biba and MLS. Bundled in here are some other minor fixes associated with externalization: including avoiding malloc while holding the process mutex in mac_lomac, and hence avoid a failure mode when printing labels during a downgrade operation due to the removal of the M_NOWAIT case. This has been running in the MAC development tree for about three weeks without problems. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-06-23 01:26:34 +00:00
if (sbuf_putc(sb, '[') == -1)
return (EINVAL);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
Redesign the externalization APIs from the MAC Framework to the MAC policy modules to improve robustness against C string bugs and vulnerabilities. Following these revisions, all string construction of labels for export to userspace (or elsewhere) is performed using the sbuf API, which prevents the consumer from having to perform laborious and intricate pointer and buffer checks. This substantially simplifies the externalization logic, both at the MAC Framework level, and in individual policies; this becomes especially useful when policies export more complex label data, such as with compartments in Biba and MLS. Bundled in here are some other minor fixes associated with externalization: including avoiding malloc while holding the process mutex in mac_lomac, and hence avoid a failure mode when printing labels during a downgrade operation due to the removal of the M_NOWAIT case. This has been running in the MAC development tree for about three weeks without problems. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-06-23 01:26:34 +00:00
if (mac_lomac_element_to_string(sb, &mac_lomac->ml_auxsingle)
== -1)
return (EINVAL);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
Redesign the externalization APIs from the MAC Framework to the MAC policy modules to improve robustness against C string bugs and vulnerabilities. Following these revisions, all string construction of labels for export to userspace (or elsewhere) is performed using the sbuf API, which prevents the consumer from having to perform laborious and intricate pointer and buffer checks. This substantially simplifies the externalization logic, both at the MAC Framework level, and in individual policies; this becomes especially useful when policies export more complex label data, such as with compartments in Biba and MLS. Bundled in here are some other minor fixes associated with externalization: including avoiding malloc while holding the process mutex in mac_lomac, and hence avoid a failure mode when printing labels during a downgrade operation due to the removal of the M_NOWAIT case. This has been running in the MAC development tree for about three weeks without problems. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-06-23 01:26:34 +00:00
if (sbuf_putc(sb, ']') == -1)
return (EINVAL);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
}
if (mac_lomac->ml_flags & MAC_LOMAC_FLAG_RANGE) {
Redesign the externalization APIs from the MAC Framework to the MAC policy modules to improve robustness against C string bugs and vulnerabilities. Following these revisions, all string construction of labels for export to userspace (or elsewhere) is performed using the sbuf API, which prevents the consumer from having to perform laborious and intricate pointer and buffer checks. This substantially simplifies the externalization logic, both at the MAC Framework level, and in individual policies; this becomes especially useful when policies export more complex label data, such as with compartments in Biba and MLS. Bundled in here are some other minor fixes associated with externalization: including avoiding malloc while holding the process mutex in mac_lomac, and hence avoid a failure mode when printing labels during a downgrade operation due to the removal of the M_NOWAIT case. This has been running in the MAC development tree for about three weeks without problems. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-06-23 01:26:34 +00:00
if (sbuf_putc(sb, '(') == -1)
return (EINVAL);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
Redesign the externalization APIs from the MAC Framework to the MAC policy modules to improve robustness against C string bugs and vulnerabilities. Following these revisions, all string construction of labels for export to userspace (or elsewhere) is performed using the sbuf API, which prevents the consumer from having to perform laborious and intricate pointer and buffer checks. This substantially simplifies the externalization logic, both at the MAC Framework level, and in individual policies; this becomes especially useful when policies export more complex label data, such as with compartments in Biba and MLS. Bundled in here are some other minor fixes associated with externalization: including avoiding malloc while holding the process mutex in mac_lomac, and hence avoid a failure mode when printing labels during a downgrade operation due to the removal of the M_NOWAIT case. This has been running in the MAC development tree for about three weeks without problems. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-06-23 01:26:34 +00:00
if (mac_lomac_element_to_string(sb, &mac_lomac->ml_rangelow)
== -1)
return (EINVAL);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
Redesign the externalization APIs from the MAC Framework to the MAC policy modules to improve robustness against C string bugs and vulnerabilities. Following these revisions, all string construction of labels for export to userspace (or elsewhere) is performed using the sbuf API, which prevents the consumer from having to perform laborious and intricate pointer and buffer checks. This substantially simplifies the externalization logic, both at the MAC Framework level, and in individual policies; this becomes especially useful when policies export more complex label data, such as with compartments in Biba and MLS. Bundled in here are some other minor fixes associated with externalization: including avoiding malloc while holding the process mutex in mac_lomac, and hence avoid a failure mode when printing labels during a downgrade operation due to the removal of the M_NOWAIT case. This has been running in the MAC development tree for about three weeks without problems. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-06-23 01:26:34 +00:00
if (sbuf_putc(sb, '-') == -1)
return (EINVAL);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
Redesign the externalization APIs from the MAC Framework to the MAC policy modules to improve robustness against C string bugs and vulnerabilities. Following these revisions, all string construction of labels for export to userspace (or elsewhere) is performed using the sbuf API, which prevents the consumer from having to perform laborious and intricate pointer and buffer checks. This substantially simplifies the externalization logic, both at the MAC Framework level, and in individual policies; this becomes especially useful when policies export more complex label data, such as with compartments in Biba and MLS. Bundled in here are some other minor fixes associated with externalization: including avoiding malloc while holding the process mutex in mac_lomac, and hence avoid a failure mode when printing labels during a downgrade operation due to the removal of the M_NOWAIT case. This has been running in the MAC development tree for about three weeks without problems. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-06-23 01:26:34 +00:00
if (mac_lomac_element_to_string(sb, &mac_lomac->ml_rangehigh)
== -1)
return (EINVAL);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
Replace a '-' with a ')'. Update copyright. PR: 53195
2003-11-08 00:21:20 +00:00
if (sbuf_putc(sb, ')') == -1)
Redesign the externalization APIs from the MAC Framework to the MAC policy modules to improve robustness against C string bugs and vulnerabilities. Following these revisions, all string construction of labels for export to userspace (or elsewhere) is performed using the sbuf API, which prevents the consumer from having to perform laborious and intricate pointer and buffer checks. This substantially simplifies the externalization logic, both at the MAC Framework level, and in individual policies; this becomes especially useful when policies export more complex label data, such as with compartments in Biba and MLS. Bundled in here are some other minor fixes associated with externalization: including avoiding malloc while holding the process mutex in mac_lomac, and hence avoid a failure mode when printing labels during a downgrade operation due to the removal of the M_NOWAIT case. This has been running in the MAC development tree for about three weeks without problems. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-06-23 01:26:34 +00:00
return (EINVAL);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
}
return (0);
}
static int
mac_lomac_externalize_label(struct label *label, char *element_name,
Redesign the externalization APIs from the MAC Framework to the MAC policy modules to improve robustness against C string bugs and vulnerabilities. Following these revisions, all string construction of labels for export to userspace (or elsewhere) is performed using the sbuf API, which prevents the consumer from having to perform laborious and intricate pointer and buffer checks. This substantially simplifies the externalization logic, both at the MAC Framework level, and in individual policies; this becomes especially useful when policies export more complex label data, such as with compartments in Biba and MLS. Bundled in here are some other minor fixes associated with externalization: including avoiding malloc while holding the process mutex in mac_lomac, and hence avoid a failure mode when printing labels during a downgrade operation due to the removal of the M_NOWAIT case. This has been running in the MAC development tree for about three weeks without problems. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-06-23 01:26:34 +00:00
struct sbuf *sb, int *claimed)
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
{
struct mac_lomac *mac_lomac;
if (strcmp(MAC_LOMAC_LABEL_NAME, element_name) != 0)
return (0);
(*claimed)++;
mac_lomac = SLOT(label);
Redesign the externalization APIs from the MAC Framework to the MAC policy modules to improve robustness against C string bugs and vulnerabilities. Following these revisions, all string construction of labels for export to userspace (or elsewhere) is performed using the sbuf API, which prevents the consumer from having to perform laborious and intricate pointer and buffer checks. This substantially simplifies the externalization logic, both at the MAC Framework level, and in individual policies; this becomes especially useful when policies export more complex label data, such as with compartments in Biba and MLS. Bundled in here are some other minor fixes associated with externalization: including avoiding malloc while holding the process mutex in mac_lomac, and hence avoid a failure mode when printing labels during a downgrade operation due to the removal of the M_NOWAIT case. This has been running in the MAC development tree for about three weeks without problems. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-06-23 01:26:34 +00:00
return (mac_lomac_to_string(sb, mac_lomac));
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
}
static int
mac_lomac_parse_element(struct mac_lomac_element *element, char *string)
{
if (strcmp(string, "high") == 0 ||
strcmp(string, "hi") == 0) {
element->mle_type = MAC_LOMAC_TYPE_HIGH;
element->mle_grade = MAC_LOMAC_TYPE_UNDEF;
} else if (strcmp(string, "low") == 0 ||
strcmp(string, "lo") == 0) {
element->mle_type = MAC_LOMAC_TYPE_LOW;
element->mle_grade = MAC_LOMAC_TYPE_UNDEF;
} else if (strcmp(string, "equal") == 0 ||
strcmp(string, "eq") == 0) {
element->mle_type = MAC_LOMAC_TYPE_EQUAL;
element->mle_grade = MAC_LOMAC_TYPE_UNDEF;
} else {
char *p0, *p1;
int d;
p0 = string;
d = strtol(p0, &p1, 10);
if (d < 0 || d > 65535)
return (EINVAL);
element->mle_type = MAC_LOMAC_TYPE_GRADE;
element->mle_grade = d;
if (p1 == p0 || *p1 != '\0')
return (EINVAL);
}
return (0);
}
/*
* Note: destructively consumes the string, make a local copy before
* calling if that's a problem.
*/
static int
mac_lomac_parse(struct mac_lomac *mac_lomac, char *string)
{
char *range, *rangeend, *rangehigh, *rangelow, *single, *auxsingle,
*auxsingleend;
int error;
/* Do we have a range? */
single = string;
range = index(string, '(');
if (range == single)
single = NULL;
auxsingle = index(string, '[');
if (auxsingle == single)
single = NULL;
if (range != NULL && auxsingle != NULL)
return (EINVAL);
rangelow = rangehigh = NULL;
if (range != NULL) {
/* Nul terminate the end of the single string. */
*range = '\0';
range++;
rangelow = range;
rangehigh = index(rangelow, '-');
if (rangehigh == NULL)
return (EINVAL);
rangehigh++;
if (*rangelow == '\0' || *rangehigh == '\0')
return (EINVAL);
rangeend = index(rangehigh, ')');
if (rangeend == NULL)
return (EINVAL);
if (*(rangeend + 1) != '\0')
return (EINVAL);
/* Nul terminate the ends of the ranges. */
*(rangehigh - 1) = '\0';
*rangeend = '\0';
}
KASSERT((rangelow != NULL && rangehigh != NULL) ||
(rangelow == NULL && rangehigh == NULL),
("mac_lomac_internalize_label: range mismatch"));
if (auxsingle != NULL) {
/* Nul terminate the end of the single string. */
*auxsingle = '\0';
auxsingle++;
auxsingleend = index(auxsingle, ']');
if (auxsingleend == NULL)
return (EINVAL);
if (*(auxsingleend + 1) != '\0')
return (EINVAL);
/* Nul terminate the end of the auxsingle. */
*auxsingleend = '\0';
}
bzero(mac_lomac, sizeof(*mac_lomac));
if (single != NULL) {
error = mac_lomac_parse_element(&mac_lomac->ml_single, single);
if (error)
return (error);
mac_lomac->ml_flags |= MAC_LOMAC_FLAG_SINGLE;
}
if (auxsingle != NULL) {
error = mac_lomac_parse_element(&mac_lomac->ml_auxsingle,
auxsingle);
if (error)
return (error);
mac_lomac->ml_flags |= MAC_LOMAC_FLAG_AUX;
}
if (rangelow != NULL) {
error = mac_lomac_parse_element(&mac_lomac->ml_rangelow,
rangelow);
if (error)
return (error);
error = mac_lomac_parse_element(&mac_lomac->ml_rangehigh,
rangehigh);
if (error)
return (error);
mac_lomac->ml_flags |= MAC_LOMAC_FLAG_RANGE;
}
error = mac_lomac_valid(mac_lomac);
if (error)
return (error);
return (0);
}
static int
mac_lomac_internalize_label(struct label *label, char *element_name,
char *element_data, int *claimed)
{
struct mac_lomac *mac_lomac, mac_lomac_temp;
int error;
if (strcmp(MAC_LOMAC_LABEL_NAME, element_name) != 0)
return (0);
(*claimed)++;
error = mac_lomac_parse(&mac_lomac_temp, element_data);
if (error)
return (error);
mac_lomac = SLOT(label);
*mac_lomac = mac_lomac_temp;
return (0);
}
static void
mac_lomac_copy_label(struct label *src, struct label *dest)
{
*SLOT(dest) = *SLOT(src);
}
/*
* Labeling event operations: file system objects, and things that look
* a lot like file system objects.
*/
static void
When devfs cloning takes place, provide access to the credential of the process that caused the clone event to take place for the device driver creating the device. This allows cloned device drivers to adapt the device node based on security aspects of the process, such as the uid, gid, and MAC label. - Add a cred reference to struct cdev, so that when a device node is instantiated as a vnode, the cloning credential can be exposed to MAC. - Add make_dev_cred(), a version of make_dev() that additionally accepts the credential to stick in the struct cdev. Implement it and make_dev() in terms of a back-end make_dev_credv(). - Add a new event handler, dev_clone_cred, which can be registered to receive the credential instead of dev_clone, if desired. - Modify the MAC entry point mac_create_devfs_device() to accept an optional credential pointer (may be NULL), so that MAC policies can inspect and act on the label or other elements of the credential when initializing the skeleton device protections. - Modify tty_pty.c to register clone_dev_cred and invoke make_dev_cred(), so that the pty clone credential is exposed to the MAC Framework. While currently primarily focussed on MAC policies, this change is also a prerequisite for changes to allow ptys to be instantiated with the UID of the process looking up the pty. This requires further changes to the pty driver -- in particular, to immediately recycle pty nodes on last close so that the credential-related state can be recreated on next lookup. Submitted by: Andrew Reisse <andrew.reisse@sparta.com> Obtained from: TrustedBSD Project Sponsored by: SPAWAR, SPARTA MFC after: 1 week MFC note: Merge to 6.x, but not 5.x for ABI reasons
2005-07-14 10:22:09 +00:00
mac_lomac_create_devfs_device(struct ucred *cred, struct mount *mp,
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
struct cdev *dev, struct devfs_dirent *de, struct label *delabel)
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
{
struct mac_lomac *mac_lomac;
int lomac_type;
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
mac_lomac = SLOT(delabel);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
if (strcmp(dev->si_name, "null") == 0 ||
strcmp(dev->si_name, "zero") == 0 ||
strcmp(dev->si_name, "random") == 0 ||
strncmp(dev->si_name, "fd/", strlen("fd/")) == 0 ||
strncmp(dev->si_name, "ttyv", strlen("ttyv")) == 0)
lomac_type = MAC_LOMAC_TYPE_EQUAL;
else if (ptys_equal &&
(strncmp(dev->si_name, "ttyp", strlen("ttyp")) == 0 ||
strncmp(dev->si_name, "ptyp", strlen("ptyp")) == 0))
lomac_type = MAC_LOMAC_TYPE_EQUAL;
else
lomac_type = MAC_LOMAC_TYPE_HIGH;
mac_lomac_set_single(mac_lomac, lomac_type, 0);
}
static void
Remove dm_root entry from struct devfs_mount. It's never set, and is unused. Replace it with a dm_mount back-pointer to the struct mount that the devfs_mount is associated with. Export that pointer to MAC Framework entry points, where all current policies don't use the pointer. This permits the SEBSD port of SELinux's FLASK/TE to compile out-of-the-box on 5.0-CURRENT with full file system labeling support. Approved by: re (murray) Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-12-09 03:44:28 +00:00
mac_lomac_create_devfs_directory(struct mount *mp, char *dirname,
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
int dirnamelen, struct devfs_dirent *de, struct label *delabel)
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
{
struct mac_lomac *mac_lomac;
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
mac_lomac = SLOT(delabel);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
mac_lomac_set_single(mac_lomac, MAC_LOMAC_TYPE_HIGH, 0);
}
static void
Remove dm_root entry from struct devfs_mount. It's never set, and is unused. Replace it with a dm_mount back-pointer to the struct mount that the devfs_mount is associated with. Export that pointer to MAC Framework entry points, where all current policies don't use the pointer. This permits the SEBSD port of SELinux's FLASK/TE to compile out-of-the-box on 5.0-CURRENT with full file system labeling support. Approved by: re (murray) Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-12-09 03:44:28 +00:00
mac_lomac_create_devfs_symlink(struct ucred *cred, struct mount *mp,
struct devfs_dirent *dd, struct label *ddlabel, struct devfs_dirent *de,
struct label *delabel)
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
{
struct mac_lomac *source, *dest;
Modify the MAC Framework so that instead of embedding a (struct label) in various kernel objects to represent security data, we embed a (struct label *) pointer, which now references labels allocated using a UMA zone (mac_label.c). This allows the size and shape of struct label to be varied without changing the size and shape of these kernel objects, which become part of the frozen ABI with 5-STABLE. This opens the door for boot-time selection of the number of label slots, and hence changes to the bound on the number of simultaneous labeled policies at boot-time instead of compile-time. This also makes it easier to embed label references in new objects as required for locking/caching with fine-grained network stack locking, such as inpcb structures. This change also moves us further in the direction of hiding the structure of kernel objects from MAC policy modules, not to mention dramatically reducing the number of '&' symbols appearing in both the MAC Framework and MAC policy modules, and improving readability. While this results in minimal performance change with MAC enabled, it will observably shrink the size of a number of critical kernel data structures for the !MAC case, and should have a small (but measurable) performance benefit (i.e., struct vnode, struct socket) do to memory conservation and reduced cost of zeroing memory. NOTE: Users of MAC must recompile their kernel and all MAC modules as a result of this change. Because this is an API change, third party MAC modules will also need to be updated to make less use of the '&' symbol. Suggestions from: bmilekic Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-11-12 03:14:31 +00:00
source = SLOT(cred->cr_label);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
dest = SLOT(delabel);
mac_lomac_copy_single(source, dest);
}
static void
mac_lomac_create_mount(struct ucred *cred, struct mount *mp,
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
struct label *mplabel)
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
{
struct mac_lomac *source, *dest;
Modify the MAC Framework so that instead of embedding a (struct label) in various kernel objects to represent security data, we embed a (struct label *) pointer, which now references labels allocated using a UMA zone (mac_label.c). This allows the size and shape of struct label to be varied without changing the size and shape of these kernel objects, which become part of the frozen ABI with 5-STABLE. This opens the door for boot-time selection of the number of label slots, and hence changes to the bound on the number of simultaneous labeled policies at boot-time instead of compile-time. This also makes it easier to embed label references in new objects as required for locking/caching with fine-grained network stack locking, such as inpcb structures. This change also moves us further in the direction of hiding the structure of kernel objects from MAC policy modules, not to mention dramatically reducing the number of '&' symbols appearing in both the MAC Framework and MAC policy modules, and improving readability. While this results in minimal performance change with MAC enabled, it will observably shrink the size of a number of critical kernel data structures for the !MAC case, and should have a small (but measurable) performance benefit (i.e., struct vnode, struct socket) do to memory conservation and reduced cost of zeroing memory. NOTE: Users of MAC must recompile their kernel and all MAC modules as a result of this change. Because this is an API change, third party MAC modules will also need to be updated to make less use of the '&' symbol. Suggestions from: bmilekic Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-11-12 03:14:31 +00:00
source = SLOT(cred->cr_label);
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
dest = SLOT(mplabel);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
mac_lomac_copy_single(source, dest);
}
static void
mac_lomac_relabel_vnode(struct ucred *cred, struct vnode *vp,
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
struct label *vplabel, struct label *newlabel)
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
{
struct mac_lomac *source, *dest;
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
source = SLOT(newlabel);
dest = SLOT(vplabel);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
try_relabel(source, dest);
}
static void
Rename mac*devfsdirent*() to mac*devfs*() to synchronize with SEDarwin, where similar data structures exist to support devfs and the MAC Framework, but are named differently. Obtained from: TrustedBSD Project Sponsored by: SPARTA, Inc.
2007-04-23 13:36:54 +00:00
mac_lomac_update_devfs(struct mount *mp, struct devfs_dirent *de,
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
struct label *delabel, struct vnode *vp, struct label *vplabel)
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
{
struct mac_lomac *source, *dest;
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
source = SLOT(vplabel);
dest = SLOT(delabel);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
mac_lomac_copy(source, dest);
}
static void
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
mac_lomac_associate_vnode_devfs(struct mount *mp, struct label *mplabel,
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
struct devfs_dirent *de, struct label *delabel, struct vnode *vp,
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
struct label *vplabel)
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
{
struct mac_lomac *source, *dest;
source = SLOT(delabel);
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
dest = SLOT(vplabel);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
mac_lomac_copy_single(source, dest);
}
static int
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
mac_lomac_associate_vnode_extattr(struct mount *mp, struct label *mplabel,
struct vnode *vp, struct label *vplabel)
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
{
struct mac_lomac temp, *source, *dest;
Fix warnings on 64bits architectures. Noticed by: alpha tinderbox
2003-01-06 12:07:38 +00:00
int buflen, error;
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
source = SLOT(mplabel);
dest = SLOT(vplabel);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
buflen = sizeof(temp);
bzero(&temp, buflen);
error = vn_extattr_get(vp, IO_NODELOCKED, MAC_LOMAC_EXTATTR_NAMESPACE,
MAC_LOMAC_EXTATTR_NAME, &buflen, (char *)&temp, curthread);
if (error == ENOATTR || error == EOPNOTSUPP) {
In the MAC Framework implementation, file systems have two per-mountpoint labels: the mount label (label of the mountpoint) and the fs label (label of the file system). In practice, policies appear to only ever use one, and the distinction is not helpful. Combine mnt_mntlabel and mnt_fslabel into a single mnt_label, and eliminate extra machinery required to maintain the additional label. Update policies to reflect removal of extra entry points and label. Obtained from: TrustedBSD Project Sponsored by: SPARTA, Inc.
2007-04-22 16:18:10 +00:00
/* Fall back to the mntlabel. */
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
mac_lomac_copy_single(source, dest);
return (0);
} else if (error)
return (error);
if (buflen != sizeof(temp)) {
if (buflen != sizeof(temp) - sizeof(temp.ml_auxsingle)) {
printf("mac_lomac_associate_vnode_extattr: bad size %d\n",
buflen);
return (EPERM);
}
bzero(&temp.ml_auxsingle, sizeof(temp.ml_auxsingle));
buflen = sizeof(temp);
(void)vn_extattr_set(vp, IO_NODELOCKED,
MAC_LOMAC_EXTATTR_NAMESPACE, MAC_LOMAC_EXTATTR_NAME,
buflen, (char *)&temp, curthread);
}
if (mac_lomac_valid(&temp) != 0) {
printf("mac_lomac_associate_vnode_extattr: invalid\n");
return (EPERM);
}
if ((temp.ml_flags & MAC_LOMAC_FLAGS_BOTH) != MAC_LOMAC_FLAG_SINGLE) {
printf("mac_lomac_associate_vnode_extattr: not single\n");
return (EPERM);
}
mac_lomac_copy_single(&temp, dest);
return (0);
}
static void
mac_lomac_associate_vnode_singlelabel(struct mount *mp,
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
struct label *mplabel, struct vnode *vp, struct label *vplabel)
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
{
struct mac_lomac *source, *dest;
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
source = SLOT(mplabel);
dest = SLOT(vplabel);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
mac_lomac_copy_single(source, dest);
}
static int
mac_lomac_create_vnode_extattr(struct ucred *cred, struct mount *mp,
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
struct label *mplabel, struct vnode *dvp, struct label *dvplabel,
struct vnode *vp, struct label *vplabel, struct componentname *cnp)
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
{
struct mac_lomac *source, *dest, *dir, temp;
size_t buflen;
int error;
buflen = sizeof(temp);
bzero(&temp, buflen);
Modify the MAC Framework so that instead of embedding a (struct label) in various kernel objects to represent security data, we embed a (struct label *) pointer, which now references labels allocated using a UMA zone (mac_label.c). This allows the size and shape of struct label to be varied without changing the size and shape of these kernel objects, which become part of the frozen ABI with 5-STABLE. This opens the door for boot-time selection of the number of label slots, and hence changes to the bound on the number of simultaneous labeled policies at boot-time instead of compile-time. This also makes it easier to embed label references in new objects as required for locking/caching with fine-grained network stack locking, such as inpcb structures. This change also moves us further in the direction of hiding the structure of kernel objects from MAC policy modules, not to mention dramatically reducing the number of '&' symbols appearing in both the MAC Framework and MAC policy modules, and improving readability. While this results in minimal performance change with MAC enabled, it will observably shrink the size of a number of critical kernel data structures for the !MAC case, and should have a small (but measurable) performance benefit (i.e., struct vnode, struct socket) do to memory conservation and reduced cost of zeroing memory. NOTE: Users of MAC must recompile their kernel and all MAC modules as a result of this change. Because this is an API change, third party MAC modules will also need to be updated to make less use of the '&' symbol. Suggestions from: bmilekic Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-11-12 03:14:31 +00:00
source = SLOT(cred->cr_label);
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
dest = SLOT(vplabel);
dir = SLOT(dvplabel);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
if (dir->ml_flags & MAC_LOMAC_FLAG_AUX) {
mac_lomac_copy_auxsingle(dir, &temp);
mac_lomac_set_single(&temp, dir->ml_auxsingle.mle_type,
dir->ml_auxsingle.mle_grade);
} else {
mac_lomac_copy_single(source, &temp);
}
error = vn_extattr_set(vp, IO_NODELOCKED, MAC_LOMAC_EXTATTR_NAMESPACE,
MAC_LOMAC_EXTATTR_NAME, buflen, (char *)&temp, curthread);
if (error == 0)
mac_lomac_copy(&temp, dest);
return (error);
}
static int
mac_lomac_setlabel_vnode_extattr(struct ucred *cred, struct vnode *vp,
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
struct label *vplabel, struct label *intlabel)
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
{
struct mac_lomac *source, temp;
size_t buflen;
int error;
buflen = sizeof(temp);
bzero(&temp, buflen);
source = SLOT(intlabel);
if ((source->ml_flags & MAC_LOMAC_FLAG_SINGLE) == 0)
return (0);
mac_lomac_copy_single(source, &temp);
error = vn_extattr_set(vp, IO_NODELOCKED, MAC_LOMAC_EXTATTR_NAMESPACE,
MAC_LOMAC_EXTATTR_NAME, buflen, (char *)&temp, curthread);
return (error);
}
/*
* Labeling event operations: IPC object.
*/
Introduce a MAC label reference in 'struct inpcb', which caches the MAC label referenced from 'struct socket' in the IPv4 and IPv6-based protocols. This permits MAC labels to be checked during network delivery operations without dereferencing inp->inp_socket to get to so->so_label, which will eventually avoid our having to grab the socket lock during delivery at the network layer. This change introduces 'struct inpcb' as a labeled object to the MAC Framework, along with the normal circus of entry points: initialization, creation from socket, destruction, as well as a delivery access control check. For most policies, the inpcb label will simply be a cache of the socket label, so a new protocol switch method is introduced, pr_sosetlabel() to notify protocols that the socket layer label has been updated so that the cache can be updated while holding appropriate locks. Most protocols implement this using pru_sosetlabel_null(), but IPv4/IPv6 protocols using inpcbs use the the worker function in_pcbsosetlabel(), which calls into the MAC Framework to perform a cache update. Biba, LOMAC, and MLS implement these entry points, as do the stub policy, and test policy. Reviewed by: sam, bms Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-11-18 00:39:07 +00:00
static void
mac_lomac_create_inpcb_from_socket(struct socket *so, struct label *solabel,
struct inpcb *inp, struct label *inplabel)
{
struct mac_lomac *source, *dest;
source = SLOT(solabel);
dest = SLOT(inplabel);
mac_lomac_copy_single(source, dest);
}
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
static void
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
mac_lomac_create_mbuf_from_socket(struct socket *so, struct label *solabel,
struct mbuf *m, struct label *mlabel)
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
{
struct mac_lomac *source, *dest;
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
source = SLOT(solabel);
dest = SLOT(mlabel);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
mac_lomac_copy_single(source, dest);
}
static void
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
mac_lomac_create_socket(struct ucred *cred, struct socket *so,
struct label *solabel)
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
{
struct mac_lomac *source, *dest;
Modify the MAC Framework so that instead of embedding a (struct label) in various kernel objects to represent security data, we embed a (struct label *) pointer, which now references labels allocated using a UMA zone (mac_label.c). This allows the size and shape of struct label to be varied without changing the size and shape of these kernel objects, which become part of the frozen ABI with 5-STABLE. This opens the door for boot-time selection of the number of label slots, and hence changes to the bound on the number of simultaneous labeled policies at boot-time instead of compile-time. This also makes it easier to embed label references in new objects as required for locking/caching with fine-grained network stack locking, such as inpcb structures. This change also moves us further in the direction of hiding the structure of kernel objects from MAC policy modules, not to mention dramatically reducing the number of '&' symbols appearing in both the MAC Framework and MAC policy modules, and improving readability. While this results in minimal performance change with MAC enabled, it will observably shrink the size of a number of critical kernel data structures for the !MAC case, and should have a small (but measurable) performance benefit (i.e., struct vnode, struct socket) do to memory conservation and reduced cost of zeroing memory. NOTE: Users of MAC must recompile their kernel and all MAC modules as a result of this change. Because this is an API change, third party MAC modules will also need to be updated to make less use of the '&' symbol. Suggestions from: bmilekic Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-11-12 03:14:31 +00:00
source = SLOT(cred->cr_label);
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
dest = SLOT(solabel);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
mac_lomac_copy_single(source, dest);
}
static void
Coalesce pipe allocations and frees. Previously, the pipe code would allocate two 'struct pipe's from the pipe zone, and malloc a mutex. - Create a new "struct pipepair" object holding the two 'struct pipe' instances, struct mutex, and struct label reference. Pipe structures now have a back-pointer to the pipe pair, and a 'pipe_present' flag to indicate whether the half has been closed. - Perform mutex init/destroy in zone init/destroy, avoiding reallocating the mutex for each pipe. Perform most pipe structure setup in zone constructor. - VM memory mappings for pageable buffers are still done outside of the UMA zone. - Change MAC API to speak 'struct pipepair' instead of 'struct pipe', update many policies. MAC labels are also handled outside of the UMA zone for now. Label-only policy modules don't have to be recompiled, but if a module is recompiled, its pipe entry points will need to be updated. If a module actually reached into the pipe structures (unlikely), that would also need to be modified. These changes substantially simplify failure handling in the pipe code as there are many fewer possible failure modes. On half-close, pipes no longer free the 'struct pipe' for the closed half until a full-close takes place. However, VM mapped buffers are still released on half-close. Some code refactoring is now possible to clean up some of the back references, etc; this patch attempts not to change the structure of most of the pipe implementation, only allocation/free code paths, so as to avoid introducing bugs (hopefully). This cuts about 8%-9% off the cost of sequential pipe allocation and free in system call tests on UP and SMP in my micro-benchmarks. May or may not make a difference in macro-benchmarks, but doing less work is good. Reviewed by: juli, tjr Testing help: dwhite, fenestro, scottl, et al
2004-02-01 05:56:51 +00:00
mac_lomac_create_pipe(struct ucred *cred, struct pipepair *pp,
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
struct label *pplabel)
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
{
struct mac_lomac *source, *dest;
Modify the MAC Framework so that instead of embedding a (struct label) in various kernel objects to represent security data, we embed a (struct label *) pointer, which now references labels allocated using a UMA zone (mac_label.c). This allows the size and shape of struct label to be varied without changing the size and shape of these kernel objects, which become part of the frozen ABI with 5-STABLE. This opens the door for boot-time selection of the number of label slots, and hence changes to the bound on the number of simultaneous labeled policies at boot-time instead of compile-time. This also makes it easier to embed label references in new objects as required for locking/caching with fine-grained network stack locking, such as inpcb structures. This change also moves us further in the direction of hiding the structure of kernel objects from MAC policy modules, not to mention dramatically reducing the number of '&' symbols appearing in both the MAC Framework and MAC policy modules, and improving readability. While this results in minimal performance change with MAC enabled, it will observably shrink the size of a number of critical kernel data structures for the !MAC case, and should have a small (but measurable) performance benefit (i.e., struct vnode, struct socket) do to memory conservation and reduced cost of zeroing memory. NOTE: Users of MAC must recompile their kernel and all MAC modules as a result of this change. Because this is an API change, third party MAC modules will also need to be updated to make less use of the '&' symbol. Suggestions from: bmilekic Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-11-12 03:14:31 +00:00
source = SLOT(cred->cr_label);
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
dest = SLOT(pplabel);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
mac_lomac_copy_single(source, dest);
}
static void
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
mac_lomac_create_socket_from_socket(struct socket *oldso,
struct label *oldsolabel, struct socket *newso, struct label *newsolabel)
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
{
struct mac_lomac *source, *dest;
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
source = SLOT(oldsolabel);
dest = SLOT(newsolabel);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
mac_lomac_copy_single(source, dest);
}
static void
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
mac_lomac_relabel_socket(struct ucred *cred, struct socket *so,
struct label *solabel, struct label *newlabel)
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
{
struct mac_lomac *source, *dest;
source = SLOT(newlabel);
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
dest = SLOT(solabel);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
try_relabel(source, dest);
}
static void
Coalesce pipe allocations and frees. Previously, the pipe code would allocate two 'struct pipe's from the pipe zone, and malloc a mutex. - Create a new "struct pipepair" object holding the two 'struct pipe' instances, struct mutex, and struct label reference. Pipe structures now have a back-pointer to the pipe pair, and a 'pipe_present' flag to indicate whether the half has been closed. - Perform mutex init/destroy in zone init/destroy, avoiding reallocating the mutex for each pipe. Perform most pipe structure setup in zone constructor. - VM memory mappings for pageable buffers are still done outside of the UMA zone. - Change MAC API to speak 'struct pipepair' instead of 'struct pipe', update many policies. MAC labels are also handled outside of the UMA zone for now. Label-only policy modules don't have to be recompiled, but if a module is recompiled, its pipe entry points will need to be updated. If a module actually reached into the pipe structures (unlikely), that would also need to be modified. These changes substantially simplify failure handling in the pipe code as there are many fewer possible failure modes. On half-close, pipes no longer free the 'struct pipe' for the closed half until a full-close takes place. However, VM mapped buffers are still released on half-close. Some code refactoring is now possible to clean up some of the back references, etc; this patch attempts not to change the structure of most of the pipe implementation, only allocation/free code paths, so as to avoid introducing bugs (hopefully). This cuts about 8%-9% off the cost of sequential pipe allocation and free in system call tests on UP and SMP in my micro-benchmarks. May or may not make a difference in macro-benchmarks, but doing less work is good. Reviewed by: juli, tjr Testing help: dwhite, fenestro, scottl, et al
2004-02-01 05:56:51 +00:00
mac_lomac_relabel_pipe(struct ucred *cred, struct pipepair *pp,
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
struct label *pplabel, struct label *newlabel)
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
{
struct mac_lomac *source, *dest;
source = SLOT(newlabel);
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
dest = SLOT(pplabel);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
try_relabel(source, dest);
}
static void
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
mac_lomac_set_socket_peer_from_mbuf(struct mbuf *m, struct label *mlabel,
struct socket *so, struct label *sopeerlabel)
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
{
struct mac_lomac *source, *dest;
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
source = SLOT(mlabel);
dest = SLOT(sopeerlabel);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
mac_lomac_copy_single(source, dest);
}
/*
* Labeling event operations: network objects.
*/
static void
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
mac_lomac_set_socket_peer_from_socket(struct socket *oldso,
struct label *oldsolabel, struct socket *newso,
struct label *newsopeerlabel)
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
{
struct mac_lomac *source, *dest;
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
source = SLOT(oldsolabel);
dest = SLOT(newsopeerlabel);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
mac_lomac_copy_single(source, dest);
}
static void
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
mac_lomac_create_bpfdesc(struct ucred *cred, struct bpf_d *d,
struct label *dlabel)
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
{
struct mac_lomac *source, *dest;
Modify the MAC Framework so that instead of embedding a (struct label) in various kernel objects to represent security data, we embed a (struct label *) pointer, which now references labels allocated using a UMA zone (mac_label.c). This allows the size and shape of struct label to be varied without changing the size and shape of these kernel objects, which become part of the frozen ABI with 5-STABLE. This opens the door for boot-time selection of the number of label slots, and hence changes to the bound on the number of simultaneous labeled policies at boot-time instead of compile-time. This also makes it easier to embed label references in new objects as required for locking/caching with fine-grained network stack locking, such as inpcb structures. This change also moves us further in the direction of hiding the structure of kernel objects from MAC policy modules, not to mention dramatically reducing the number of '&' symbols appearing in both the MAC Framework and MAC policy modules, and improving readability. While this results in minimal performance change with MAC enabled, it will observably shrink the size of a number of critical kernel data structures for the !MAC case, and should have a small (but measurable) performance benefit (i.e., struct vnode, struct socket) do to memory conservation and reduced cost of zeroing memory. NOTE: Users of MAC must recompile their kernel and all MAC modules as a result of this change. Because this is an API change, third party MAC modules will also need to be updated to make less use of the '&' symbol. Suggestions from: bmilekic Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-11-12 03:14:31 +00:00
source = SLOT(cred->cr_label);
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
dest = SLOT(dlabel);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
mac_lomac_copy_single(source, dest);
}
static void
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
mac_lomac_create_ifnet(struct ifnet *ifp, struct label *ifplabel)
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
{
Replace the if_name and if_unit members of struct ifnet with new members if_xname, if_dname, and if_dunit. if_xname is the name of the interface and if_dname/unit are the driver name and instance. This change paves the way for interface renaming and enhanced pseudo device creation and configuration symantics. Approved By: re (in principle) Reviewed By: njl, imp Tested On: i386, amd64, sparc64 Obtained From: NetBSD (if_xname)
2003-10-31 18:32:15 +00:00
char tifname[IFNAMSIZ], *p, *q;
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
char tiflist[sizeof(trusted_interfaces)];
struct mac_lomac *dest;
int len, grade;
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
dest = SLOT(ifplabel);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
if (ifp->if_type == IFT_LOOP) {
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
grade = MAC_LOMAC_TYPE_EQUAL;
goto set;
}
if (trust_all_interfaces) {
grade = MAC_LOMAC_TYPE_HIGH;
goto set;
}
grade = MAC_LOMAC_TYPE_LOW;
if (trusted_interfaces[0] == '\0' ||
!strvalid(trusted_interfaces, sizeof(trusted_interfaces)))
goto set;
bzero(tiflist, sizeof(tiflist));
for (p = trusted_interfaces, q = tiflist; *p != '\0'; p++, q++)
if(*p != ' ' && *p != '\t')
*q = *p;
for (p = q = tiflist;; p++) {
if (*p == ',' || *p == '\0') {
len = p - q;
if (len < IFNAMSIZ) {
bzero(tifname, sizeof(tifname));
bcopy(q, tifname, len);
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
if (strcmp(tifname, ifp->if_xname) == 0) {
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
grade = MAC_LOMAC_TYPE_HIGH;
break;
}
}
else {
*p = '\0';
printf("MAC/LOMAC warning: interface name "
"\"%s\" is too long (must be < %d)\n",
q, IFNAMSIZ);
}
if (*p == '\0')
break;
q = p + 1;
}
}
set:
mac_lomac_set_single(dest, grade, 0);
mac_lomac_set_range(dest, grade, 0, grade, 0);
}
static void
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
mac_lomac_create_ipq(struct mbuf *m, struct label *mlabel, struct ipq *ipq,
struct label *ipqlabel)
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
{
struct mac_lomac *source, *dest;
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
source = SLOT(mlabel);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
dest = SLOT(ipqlabel);
mac_lomac_copy_single(source, dest);
}
static void
mac_lomac_create_datagram_from_ipq(struct ipq *ipq, struct label *ipqlabel,
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
struct mbuf *m, struct label *mlabel)
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
{
struct mac_lomac *source, *dest;
source = SLOT(ipqlabel);
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
dest = SLOT(mlabel);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
/* Just use the head, since we require them all to match. */
mac_lomac_copy_single(source, dest);
}
static void
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
mac_lomac_create_fragment(struct mbuf *m, struct label *mlabel,
struct mbuf *frag, struct label *fraglabel)
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
{
struct mac_lomac *source, *dest;
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
source = SLOT(mlabel);
dest = SLOT(fraglabel);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
mac_lomac_copy_single(source, dest);
}
Switch TCP over to using the inpcb label when responding in timed wait, rather than the socket label. This avoids reaching up to the socket layer during connection close, which requires locking changes. To do this, introduce MAC Framework entry point mac_create_mbuf_from_inpcb(), which is called from tcp_twrespond() instead of calling mac_create_mbuf_from_socket() or mac_create_mbuf_netlayer(). Introduce MAC Policy entry point mpo_create_mbuf_from_inpcb(), and implementations for various policies, which generally just copy label data from the inpcb to the mbuf. Assert the inpcb lock in the entry point since we require consistency for the inpcb label reference. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-12-17 14:55:11 +00:00
static void
mac_lomac_create_mbuf_from_inpcb(struct inpcb *inp, struct label *inplabel,
struct mbuf *m, struct label *mlabel)
{
struct mac_lomac *source, *dest;
source = SLOT(inplabel);
dest = SLOT(mlabel);
mac_lomac_copy_single(source, dest);
}
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
static void
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
mac_lomac_create_mbuf_linklayer(struct ifnet *ifp, struct label *ifplabel,
struct mbuf *m, struct label *mlabel)
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
{
struct mac_lomac *dest;
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
dest = SLOT(mlabel);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
mac_lomac_set_single(dest, MAC_LOMAC_TYPE_EQUAL, 0);
}
static void
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
mac_lomac_create_mbuf_from_bpfdesc(struct bpf_d *d, struct label *dlabel,
struct mbuf *m, struct label *mlabel)
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
{
struct mac_lomac *source, *dest;
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
source = SLOT(dlabel);
dest = SLOT(mlabel);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
mac_lomac_copy_single(source, dest);
}
static void
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
mac_lomac_create_mbuf_from_ifnet(struct ifnet *ifp, struct label *ifplabel,
struct mbuf *m, struct label *mlabel)
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
{
struct mac_lomac *source, *dest;
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
source = SLOT(ifplabel);
dest = SLOT(mlabel);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
mac_lomac_copy_single(source, dest);
}
static void
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
mac_lomac_create_mbuf_multicast_encap(struct mbuf *m, struct label *mlabel,
struct ifnet *ifp, struct label *ifplabel, struct mbuf *mnew,
struct label *mnewlabel)
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
{
struct mac_lomac *source, *dest;
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
source = SLOT(mlabel);
dest = SLOT(mnewlabel);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
mac_lomac_copy_single(source, dest);
}
static void
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
mac_lomac_create_mbuf_netlayer(struct mbuf *m, struct label *mlabel,
struct mbuf *mnew, struct label *mnewlabel)
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
{
struct mac_lomac *source, *dest;
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
source = SLOT(mlabel);
dest = SLOT(mnewlabel);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
mac_lomac_copy_single(source, dest);
}
static int
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
mac_lomac_fragment_match(struct mbuf *m, struct label *mlabel,
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
struct ipq *ipq, struct label *ipqlabel)
{
struct mac_lomac *a, *b;
a = SLOT(ipqlabel);
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
b = SLOT(mlabel);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
return (mac_lomac_equal_single(a, b));
}
static void
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
mac_lomac_relabel_ifnet(struct ucred *cred, struct ifnet *ifp,
struct label *ifplabel, struct label *newlabel)
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
{
struct mac_lomac *source, *dest;
source = SLOT(newlabel);
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
dest = SLOT(ifplabel);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
try_relabel(source, dest);
}
static void
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
mac_lomac_update_ipq(struct mbuf *m, struct label *mlabel, struct ipq *ipq,
struct label *ipqlabel)
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
{
/* NOOP: we only accept matching labels, so no need to update */
}
Introduce a MAC label reference in 'struct inpcb', which caches the MAC label referenced from 'struct socket' in the IPv4 and IPv6-based protocols. This permits MAC labels to be checked during network delivery operations without dereferencing inp->inp_socket to get to so->so_label, which will eventually avoid our having to grab the socket lock during delivery at the network layer. This change introduces 'struct inpcb' as a labeled object to the MAC Framework, along with the normal circus of entry points: initialization, creation from socket, destruction, as well as a delivery access control check. For most policies, the inpcb label will simply be a cache of the socket label, so a new protocol switch method is introduced, pr_sosetlabel() to notify protocols that the socket layer label has been updated so that the cache can be updated while holding appropriate locks. Most protocols implement this using pru_sosetlabel_null(), but IPv4/IPv6 protocols using inpcbs use the the worker function in_pcbsosetlabel(), which calls into the MAC Framework to perform a cache update. Biba, LOMAC, and MLS implement these entry points, as do the stub policy, and test policy. Reviewed by: sam, bms Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-11-18 00:39:07 +00:00
static void
mac_lomac_inpcb_sosetlabel(struct socket *so, struct label *solabel,
struct inpcb *inp, struct label *inplabel)
{
struct mac_lomac *source, *dest;
source = SLOT(solabel);
dest = SLOT(inplabel);
mac_lomac_copy_single(source, dest);
}
Teach the MAC policies which utilize mbuf labeling the new syncache entry points. Properly initialize the mbuf label based on the label we copy from the PCB. This fixes an LOR between the PCB and syncache code.
2006-12-13 06:03:22 +00:00
static void
mac_lomac_init_syncache_from_inpcb(struct label *label, struct inpcb *inp)
{
struct mac_lomac *source, *dest;
source = SLOT(inp->inp_label);
dest = SLOT(label);
mac_lomac_copy(source, dest);
}
static void
mac_lomac_create_mbuf_from_syncache(struct label *sc_label, struct mbuf *m,
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
struct label *mlabel)
Teach the MAC policies which utilize mbuf labeling the new syncache entry points. Properly initialize the mbuf label based on the label we copy from the PCB. This fixes an LOR between the PCB and syncache code.
2006-12-13 06:03:22 +00:00
{
struct mac_lomac *source, *dest;
source = SLOT(sc_label);
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
dest = SLOT(mlabel);
Teach the MAC policies which utilize mbuf labeling the new syncache entry points. Properly initialize the mbuf label based on the label we copy from the PCB. This fixes an LOR between the PCB and syncache code.
2006-12-13 06:03:22 +00:00
mac_lomac_copy(source, dest);
}
Introduce a new entry point, mac_create_mbuf_from_firewall. This entry point exists to allow the mandatory access control policy to properly initialize mbufs generated by the firewall. An example where this might happen is keep alive packets, or ICMP error packets in response to other packets. This takes care of kernel panics associated with un-initialize mbuf labels when the firewall generates packets. [1] I modified this patch from it's original version, the initial patch introduced a number of entry points which were programmatically equivalent. So I introduced only one. Instead, we should leverage mac_create_mbuf_netlayer() which is used for similar situations, an example being icmp_error() This will minimize the impact associated with the MFC Submitted by: mlaier [1] MFC after: 1 week This is a RELENG_6 candidate
2006-09-12 04:25:13 +00:00
static void
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
mac_lomac_create_mbuf_from_firewall(struct mbuf *m, struct label *mlabel)
Introduce a new entry point, mac_create_mbuf_from_firewall. This entry point exists to allow the mandatory access control policy to properly initialize mbufs generated by the firewall. An example where this might happen is keep alive packets, or ICMP error packets in response to other packets. This takes care of kernel panics associated with un-initialize mbuf labels when the firewall generates packets. [1] I modified this patch from it's original version, the initial patch introduced a number of entry points which were programmatically equivalent. So I introduced only one. Instead, we should leverage mac_create_mbuf_netlayer() which is used for similar situations, an example being icmp_error() This will minimize the impact associated with the MFC Submitted by: mlaier [1] MFC after: 1 week This is a RELENG_6 candidate
2006-09-12 04:25:13 +00:00
{
struct mac_lomac *dest;
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
dest = SLOT(mlabel);
Introduce a new entry point, mac_create_mbuf_from_firewall. This entry point exists to allow the mandatory access control policy to properly initialize mbufs generated by the firewall. An example where this might happen is keep alive packets, or ICMP error packets in response to other packets. This takes care of kernel panics associated with un-initialize mbuf labels when the firewall generates packets. [1] I modified this patch from it's original version, the initial patch introduced a number of entry points which were programmatically equivalent. So I introduced only one. Instead, we should leverage mac_create_mbuf_netlayer() which is used for similar situations, an example being icmp_error() This will minimize the impact associated with the MFC Submitted by: mlaier [1] MFC after: 1 week This is a RELENG_6 candidate
2006-09-12 04:25:13 +00:00
/* XXX: where is the label for the firewall really comming from? */
mac_lomac_set_single(dest, MAC_LOMAC_TYPE_EQUAL, 0);
}
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
/*
* Labeling event operations: processes.
*/
static void
mac_lomac_execve_transition(struct ucred *old, struct ucred *new,
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
struct vnode *vp, struct label *vplabel, struct label *interpvnodelabel,
struct image_params *imgp, struct label *execlabel)
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
{
struct mac_lomac *source, *dest, *obj, *robj;
Modify the MAC Framework so that instead of embedding a (struct label) in various kernel objects to represent security data, we embed a (struct label *) pointer, which now references labels allocated using a UMA zone (mac_label.c). This allows the size and shape of struct label to be varied without changing the size and shape of these kernel objects, which become part of the frozen ABI with 5-STABLE. This opens the door for boot-time selection of the number of label slots, and hence changes to the bound on the number of simultaneous labeled policies at boot-time instead of compile-time. This also makes it easier to embed label references in new objects as required for locking/caching with fine-grained network stack locking, such as inpcb structures. This change also moves us further in the direction of hiding the structure of kernel objects from MAC policy modules, not to mention dramatically reducing the number of '&' symbols appearing in both the MAC Framework and MAC policy modules, and improving readability. While this results in minimal performance change with MAC enabled, it will observably shrink the size of a number of critical kernel data structures for the !MAC case, and should have a small (but measurable) performance benefit (i.e., struct vnode, struct socket) do to memory conservation and reduced cost of zeroing memory. NOTE: Users of MAC must recompile their kernel and all MAC modules as a result of this change. Because this is an API change, third party MAC modules will also need to be updated to make less use of the '&' symbol. Suggestions from: bmilekic Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-11-12 03:14:31 +00:00
source = SLOT(old->cr_label);
dest = SLOT(new->cr_label);
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
obj = SLOT(vplabel);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
robj = interpvnodelabel != NULL ? SLOT(interpvnodelabel) : obj;
mac_lomac_copy(source, dest);
/*
* If there's an auxiliary label on the real object, respect it
* and assume that this level should be assumed immediately if
* a higher level is currently in place.
*/
if (robj->ml_flags & MAC_LOMAC_FLAG_AUX &&
!mac_lomac_dominate_element(&robj->ml_auxsingle, &dest->ml_single)
&& mac_lomac_auxsingle_in_range(robj, dest))
mac_lomac_set_single(dest, robj->ml_auxsingle.mle_type,
robj->ml_auxsingle.mle_grade);
/*
* Restructuring to use the execve transitioning mechanism
* instead of the normal demotion mechanism here would be
* difficult, so just copy the label over and perform standard
* demotion. This is also non-optimal because it will result
* in the intermediate label "new" being created and immediately
* recycled.
*/
if (mac_lomac_enabled && revocation_enabled &&
!mac_lomac_dominate_single(obj, source))
(void)maybe_demote(source, obj, "executing", "file", vp);
}
static int
mac_lomac_execve_will_transition(struct ucred *old, struct vnode *vp,
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
struct label *vplabel, struct label *interpvnodelabel,
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
struct image_params *imgp, struct label *execlabel)
{
struct mac_lomac *subj, *obj, *robj;
if (!mac_lomac_enabled || !revocation_enabled)
return (0);
Modify the MAC Framework so that instead of embedding a (struct label) in various kernel objects to represent security data, we embed a (struct label *) pointer, which now references labels allocated using a UMA zone (mac_label.c). This allows the size and shape of struct label to be varied without changing the size and shape of these kernel objects, which become part of the frozen ABI with 5-STABLE. This opens the door for boot-time selection of the number of label slots, and hence changes to the bound on the number of simultaneous labeled policies at boot-time instead of compile-time. This also makes it easier to embed label references in new objects as required for locking/caching with fine-grained network stack locking, such as inpcb structures. This change also moves us further in the direction of hiding the structure of kernel objects from MAC policy modules, not to mention dramatically reducing the number of '&' symbols appearing in both the MAC Framework and MAC policy modules, and improving readability. While this results in minimal performance change with MAC enabled, it will observably shrink the size of a number of critical kernel data structures for the !MAC case, and should have a small (but measurable) performance benefit (i.e., struct vnode, struct socket) do to memory conservation and reduced cost of zeroing memory. NOTE: Users of MAC must recompile their kernel and all MAC modules as a result of this change. Because this is an API change, third party MAC modules will also need to be updated to make less use of the '&' symbol. Suggestions from: bmilekic Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-11-12 03:14:31 +00:00
subj = SLOT(old->cr_label);
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
obj = SLOT(vplabel);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
robj = interpvnodelabel != NULL ? SLOT(interpvnodelabel) : obj;
return ((robj->ml_flags & MAC_LOMAC_FLAG_AUX &&
!mac_lomac_dominate_element(&robj->ml_auxsingle, &subj->ml_single)
&& mac_lomac_auxsingle_in_range(robj, subj)) ||
!mac_lomac_dominate_single(obj, subj));
}
static void
mac_lomac_create_proc0(struct ucred *cred)
{
struct mac_lomac *dest;
Modify the MAC Framework so that instead of embedding a (struct label) in various kernel objects to represent security data, we embed a (struct label *) pointer, which now references labels allocated using a UMA zone (mac_label.c). This allows the size and shape of struct label to be varied without changing the size and shape of these kernel objects, which become part of the frozen ABI with 5-STABLE. This opens the door for boot-time selection of the number of label slots, and hence changes to the bound on the number of simultaneous labeled policies at boot-time instead of compile-time. This also makes it easier to embed label references in new objects as required for locking/caching with fine-grained network stack locking, such as inpcb structures. This change also moves us further in the direction of hiding the structure of kernel objects from MAC policy modules, not to mention dramatically reducing the number of '&' symbols appearing in both the MAC Framework and MAC policy modules, and improving readability. While this results in minimal performance change with MAC enabled, it will observably shrink the size of a number of critical kernel data structures for the !MAC case, and should have a small (but measurable) performance benefit (i.e., struct vnode, struct socket) do to memory conservation and reduced cost of zeroing memory. NOTE: Users of MAC must recompile their kernel and all MAC modules as a result of this change. Because this is an API change, third party MAC modules will also need to be updated to make less use of the '&' symbol. Suggestions from: bmilekic Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-11-12 03:14:31 +00:00
dest = SLOT(cred->cr_label);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
mac_lomac_set_single(dest, MAC_LOMAC_TYPE_EQUAL, 0);
mac_lomac_set_range(dest, MAC_LOMAC_TYPE_LOW, 0, MAC_LOMAC_TYPE_HIGH,
0);
}
static void
mac_lomac_create_proc1(struct ucred *cred)
{
struct mac_lomac *dest;
Modify the MAC Framework so that instead of embedding a (struct label) in various kernel objects to represent security data, we embed a (struct label *) pointer, which now references labels allocated using a UMA zone (mac_label.c). This allows the size and shape of struct label to be varied without changing the size and shape of these kernel objects, which become part of the frozen ABI with 5-STABLE. This opens the door for boot-time selection of the number of label slots, and hence changes to the bound on the number of simultaneous labeled policies at boot-time instead of compile-time. This also makes it easier to embed label references in new objects as required for locking/caching with fine-grained network stack locking, such as inpcb structures. This change also moves us further in the direction of hiding the structure of kernel objects from MAC policy modules, not to mention dramatically reducing the number of '&' symbols appearing in both the MAC Framework and MAC policy modules, and improving readability. While this results in minimal performance change with MAC enabled, it will observably shrink the size of a number of critical kernel data structures for the !MAC case, and should have a small (but measurable) performance benefit (i.e., struct vnode, struct socket) do to memory conservation and reduced cost of zeroing memory. NOTE: Users of MAC must recompile their kernel and all MAC modules as a result of this change. Because this is an API change, third party MAC modules will also need to be updated to make less use of the '&' symbol. Suggestions from: bmilekic Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-11-12 03:14:31 +00:00
dest = SLOT(cred->cr_label);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
mac_lomac_set_single(dest, MAC_LOMAC_TYPE_HIGH, 0);
mac_lomac_set_range(dest, MAC_LOMAC_TYPE_LOW, 0, MAC_LOMAC_TYPE_HIGH,
0);
}
static void
mac_lomac_relabel_cred(struct ucred *cred, struct label *newlabel)
{
struct mac_lomac *source, *dest;
source = SLOT(newlabel);
Modify the MAC Framework so that instead of embedding a (struct label) in various kernel objects to represent security data, we embed a (struct label *) pointer, which now references labels allocated using a UMA zone (mac_label.c). This allows the size and shape of struct label to be varied without changing the size and shape of these kernel objects, which become part of the frozen ABI with 5-STABLE. This opens the door for boot-time selection of the number of label slots, and hence changes to the bound on the number of simultaneous labeled policies at boot-time instead of compile-time. This also makes it easier to embed label references in new objects as required for locking/caching with fine-grained network stack locking, such as inpcb structures. This change also moves us further in the direction of hiding the structure of kernel objects from MAC policy modules, not to mention dramatically reducing the number of '&' symbols appearing in both the MAC Framework and MAC policy modules, and improving readability. While this results in minimal performance change with MAC enabled, it will observably shrink the size of a number of critical kernel data structures for the !MAC case, and should have a small (but measurable) performance benefit (i.e., struct vnode, struct socket) do to memory conservation and reduced cost of zeroing memory. NOTE: Users of MAC must recompile their kernel and all MAC modules as a result of this change. Because this is an API change, third party MAC modules will also need to be updated to make less use of the '&' symbol. Suggestions from: bmilekic Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-11-12 03:14:31 +00:00
dest = SLOT(cred->cr_label);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
try_relabel(source, dest);
}
/*
* Access control checks.
*/
static int
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
mac_lomac_check_bpfdesc_receive(struct bpf_d *d, struct label *dlabel,
struct ifnet *ifp, struct label *ifplabel)
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
{
struct mac_lomac *a, *b;
if (!mac_lomac_enabled)
return (0);
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
a = SLOT(dlabel);
b = SLOT(ifplabel);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
if (mac_lomac_equal_single(a, b))
return (0);
return (EACCES);
}
static int
mac_lomac_check_cred_relabel(struct ucred *cred, struct label *newlabel)
{
struct mac_lomac *subj, *new;
int error;
Modify the MAC Framework so that instead of embedding a (struct label) in various kernel objects to represent security data, we embed a (struct label *) pointer, which now references labels allocated using a UMA zone (mac_label.c). This allows the size and shape of struct label to be varied without changing the size and shape of these kernel objects, which become part of the frozen ABI with 5-STABLE. This opens the door for boot-time selection of the number of label slots, and hence changes to the bound on the number of simultaneous labeled policies at boot-time instead of compile-time. This also makes it easier to embed label references in new objects as required for locking/caching with fine-grained network stack locking, such as inpcb structures. This change also moves us further in the direction of hiding the structure of kernel objects from MAC policy modules, not to mention dramatically reducing the number of '&' symbols appearing in both the MAC Framework and MAC policy modules, and improving readability. While this results in minimal performance change with MAC enabled, it will observably shrink the size of a number of critical kernel data structures for the !MAC case, and should have a small (but measurable) performance benefit (i.e., struct vnode, struct socket) do to memory conservation and reduced cost of zeroing memory. NOTE: Users of MAC must recompile their kernel and all MAC modules as a result of this change. Because this is an API change, third party MAC modules will also need to be updated to make less use of the '&' symbol. Suggestions from: bmilekic Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-11-12 03:14:31 +00:00
subj = SLOT(cred->cr_label);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
new = SLOT(newlabel);
/*
* If there is a LOMAC label update for the credential, it may
* be an update of the single, range, or both.
*/
error = lomac_atmostflags(new, MAC_LOMAC_FLAGS_BOTH);
if (error)
return (error);
/*
* If the LOMAC label is to be changed, authorize as appropriate.
*/
if (new->ml_flags & MAC_LOMAC_FLAGS_BOTH) {
/*
Correct logic for filling out a "new" label during a credential change in mac_lomac: if both flags are set on the new label, we may not need to always fill out the label (only if one flag is set, not both). Avoid stomping on a section of the label if we are in fact modifying both elements. Because we know that both flags will be set, we don't need to test whether the range or single are set in later consistency checks of the range and single -- just test them. By checking the range of the new vs. the range of the old label before testing the single against the new range, we implicitly test that the new single is in the old range. Document this with a comment. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-08-21 18:07:52 +00:00
* Fill in the missing parts from the previous label.
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
*/
Correct logic for filling out a "new" label during a credential change in mac_lomac: if both flags are set on the new label, we may not need to always fill out the label (only if one flag is set, not both). Avoid stomping on a section of the label if we are in fact modifying both elements. Because we know that both flags will be set, we don't need to test whether the range or single are set in later consistency checks of the range and single -- just test them. By checking the range of the new vs. the range of the old label before testing the single against the new range, we implicitly test that the new single is in the old range. Document this with a comment. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-08-21 18:07:52 +00:00
if ((new->ml_flags & MAC_LOMAC_FLAG_SINGLE) == 0)
mac_lomac_copy_single(subj, new);
if ((new->ml_flags & MAC_LOMAC_FLAG_RANGE) == 0)
mac_lomac_copy_range(subj, new);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
/*
* To change the LOMAC range on a credential, the new
* range label must be in the current range.
*/
Correct logic for filling out a "new" label during a credential change in mac_lomac: if both flags are set on the new label, we may not need to always fill out the label (only if one flag is set, not both). Avoid stomping on a section of the label if we are in fact modifying both elements. Because we know that both flags will be set, we don't need to test whether the range or single are set in later consistency checks of the range and single -- just test them. By checking the range of the new vs. the range of the old label before testing the single against the new range, we implicitly test that the new single is in the old range. Document this with a comment. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-08-21 18:07:52 +00:00
if (!mac_lomac_range_in_range(new, subj))
return (EPERM);
/*
* To change the LOMAC single label on a credential, the
* new single label must be in the new range. Implicitly
* from the previous check, the new single is in the old
* range.
*/
if (!mac_lomac_single_in_range(new, new))
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
return (EPERM);
/*
* To have EQUAL in any component of the new credential
* LOMAC label, the subject must already have EQUAL in
* their label.
*/
if (mac_lomac_contains_equal(new)) {
error = mac_lomac_subject_privileged(subj);
if (error)
return (error);
}
/*
* XXXMAC: Additional consistency tests regarding the
* single and range of the new label might be performed
* here.
*/
}
return (0);
}
static int
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
mac_lomac_check_cred_visible(struct ucred *cr1, struct ucred *cr2)
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
{
struct mac_lomac *subj, *obj;
if (!mac_lomac_enabled)
return (0);
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
subj = SLOT(cr1->cr_label);
obj = SLOT(cr2->cr_label);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
/* XXX: range */
if (!mac_lomac_dominate_single(obj, subj))
return (ESRCH);
return (0);
}
static int
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
mac_lomac_check_ifnet_relabel(struct ucred *cred, struct ifnet *ifp,
struct label *ifplabel, struct label *newlabel)
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
{
struct mac_lomac *subj, *new;
int error;
Modify the MAC Framework so that instead of embedding a (struct label) in various kernel objects to represent security data, we embed a (struct label *) pointer, which now references labels allocated using a UMA zone (mac_label.c). This allows the size and shape of struct label to be varied without changing the size and shape of these kernel objects, which become part of the frozen ABI with 5-STABLE. This opens the door for boot-time selection of the number of label slots, and hence changes to the bound on the number of simultaneous labeled policies at boot-time instead of compile-time. This also makes it easier to embed label references in new objects as required for locking/caching with fine-grained network stack locking, such as inpcb structures. This change also moves us further in the direction of hiding the structure of kernel objects from MAC policy modules, not to mention dramatically reducing the number of '&' symbols appearing in both the MAC Framework and MAC policy modules, and improving readability. While this results in minimal performance change with MAC enabled, it will observably shrink the size of a number of critical kernel data structures for the !MAC case, and should have a small (but measurable) performance benefit (i.e., struct vnode, struct socket) do to memory conservation and reduced cost of zeroing memory. NOTE: Users of MAC must recompile their kernel and all MAC modules as a result of this change. Because this is an API change, third party MAC modules will also need to be updated to make less use of the '&' symbol. Suggestions from: bmilekic Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-11-12 03:14:31 +00:00
subj = SLOT(cred->cr_label);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
new = SLOT(newlabel);
/*
* If there is a LOMAC label update for the interface, it may
* be an update of the single, range, or both.
*/
error = lomac_atmostflags(new, MAC_LOMAC_FLAGS_BOTH);
if (error)
return (error);
/*
* Relabling network interfaces requires LOMAC privilege.
*/
error = mac_lomac_subject_privileged(subj);
if (error)
return (error);
/*
* If the LOMAC label is to be changed, authorize as appropriate.
*/
if (new->ml_flags & MAC_LOMAC_FLAGS_BOTH) {
Correct logic for filling out a "new" label during a credential change in mac_lomac: if both flags are set on the new label, we may not need to always fill out the label (only if one flag is set, not both). Avoid stomping on a section of the label if we are in fact modifying both elements. Because we know that both flags will be set, we don't need to test whether the range or single are set in later consistency checks of the range and single -- just test them. By checking the range of the new vs. the range of the old label before testing the single against the new range, we implicitly test that the new single is in the old range. Document this with a comment. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-08-21 18:07:52 +00:00
/*
* Fill in the missing parts from the previous label.
*/
if ((new->ml_flags & MAC_LOMAC_FLAG_SINGLE) == 0)
mac_lomac_copy_single(subj, new);
if ((new->ml_flags & MAC_LOMAC_FLAG_RANGE) == 0)
mac_lomac_copy_range(subj, new);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
/*
* Rely on the traditional superuser status for the LOMAC
* interface relabel requirements. XXXMAC: This will go
* away.
Sweep kernel replacing suser(9) calls with priv(9) calls, assigning specific privilege names to a broad range of privileges. These may require some future tweaking. Sponsored by: nCircle Network Security, Inc. Obtained from: TrustedBSD Project Discussed on: arch@ Reviewed (at least in part) by: mlaier, jmg, pjd, bde, ceri, Alex Lyashkov <umka at sevcity dot net>, Skip Ford <skip dot ford at verizon dot net>, Antoine Brodin <antoine dot brodin at laposte dot net>
2006-11-06 13:42:10 +00:00
*
* XXXRW: This is also redundant to a higher layer check.
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
*/
Sweep kernel replacing suser(9) calls with priv(9) calls, assigning specific privilege names to a broad range of privileges. These may require some future tweaking. Sponsored by: nCircle Network Security, Inc. Obtained from: TrustedBSD Project Discussed on: arch@ Reviewed (at least in part) by: mlaier, jmg, pjd, bde, ceri, Alex Lyashkov <umka at sevcity dot net>, Skip Ford <skip dot ford at verizon dot net>, Antoine Brodin <antoine dot brodin at laposte dot net>
2006-11-06 13:42:10 +00:00
error = priv_check_cred(cred, PRIV_NET_SETIFMAC, 0);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
if (error)
return (EPERM);
/*
* XXXMAC: Additional consistency tests regarding the single
* and the range of the new label might be performed here.
*/
}
return (0);
}
static int
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
mac_lomac_check_ifnet_transmit(struct ifnet *ifp, struct label *ifplabel,
struct mbuf *m, struct label *mlabel)
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
{
struct mac_lomac *p, *i;
if (!mac_lomac_enabled)
return (0);
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
p = SLOT(mlabel);
i = SLOT(ifplabel);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
return (mac_lomac_single_in_range(p, i) ? 0 : EACCES);
}
Introduce a MAC label reference in 'struct inpcb', which caches the MAC label referenced from 'struct socket' in the IPv4 and IPv6-based protocols. This permits MAC labels to be checked during network delivery operations without dereferencing inp->inp_socket to get to so->so_label, which will eventually avoid our having to grab the socket lock during delivery at the network layer. This change introduces 'struct inpcb' as a labeled object to the MAC Framework, along with the normal circus of entry points: initialization, creation from socket, destruction, as well as a delivery access control check. For most policies, the inpcb label will simply be a cache of the socket label, so a new protocol switch method is introduced, pr_sosetlabel() to notify protocols that the socket layer label has been updated so that the cache can be updated while holding appropriate locks. Most protocols implement this using pru_sosetlabel_null(), but IPv4/IPv6 protocols using inpcbs use the the worker function in_pcbsosetlabel(), which calls into the MAC Framework to perform a cache update. Biba, LOMAC, and MLS implement these entry points, as do the stub policy, and test policy. Reviewed by: sam, bms Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-11-18 00:39:07 +00:00
static int
mac_lomac_check_inpcb_deliver(struct inpcb *inp, struct label *inplabel,
struct mbuf *m, struct label *mlabel)
{
struct mac_lomac *p, *i;
if (!mac_lomac_enabled)
return (0);
p = SLOT(mlabel);
i = SLOT(inplabel);
return (mac_lomac_equal_single(p, i) ? 0 : EACCES);
}
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
static int
mac_lomac_check_kld_load(struct ucred *cred, struct vnode *vp,
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
struct label *vplabel)
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
{
struct mac_lomac *subj, *obj;
if (!mac_lomac_enabled)
return (0);
Modify the MAC Framework so that instead of embedding a (struct label) in various kernel objects to represent security data, we embed a (struct label *) pointer, which now references labels allocated using a UMA zone (mac_label.c). This allows the size and shape of struct label to be varied without changing the size and shape of these kernel objects, which become part of the frozen ABI with 5-STABLE. This opens the door for boot-time selection of the number of label slots, and hence changes to the bound on the number of simultaneous labeled policies at boot-time instead of compile-time. This also makes it easier to embed label references in new objects as required for locking/caching with fine-grained network stack locking, such as inpcb structures. This change also moves us further in the direction of hiding the structure of kernel objects from MAC policy modules, not to mention dramatically reducing the number of '&' symbols appearing in both the MAC Framework and MAC policy modules, and improving readability. While this results in minimal performance change with MAC enabled, it will observably shrink the size of a number of critical kernel data structures for the !MAC case, and should have a small (but measurable) performance benefit (i.e., struct vnode, struct socket) do to memory conservation and reduced cost of zeroing memory. NOTE: Users of MAC must recompile their kernel and all MAC modules as a result of this change. Because this is an API change, third party MAC modules will also need to be updated to make less use of the '&' symbol. Suggestions from: bmilekic Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-11-12 03:14:31 +00:00
subj = SLOT(cred->cr_label);
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
obj = SLOT(vplabel);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
if (mac_lomac_subject_privileged(subj))
return (EPERM);
if (!mac_lomac_high_single(obj))
return (EACCES);
return (0);
}
static int
Coalesce pipe allocations and frees. Previously, the pipe code would allocate two 'struct pipe's from the pipe zone, and malloc a mutex. - Create a new "struct pipepair" object holding the two 'struct pipe' instances, struct mutex, and struct label reference. Pipe structures now have a back-pointer to the pipe pair, and a 'pipe_present' flag to indicate whether the half has been closed. - Perform mutex init/destroy in zone init/destroy, avoiding reallocating the mutex for each pipe. Perform most pipe structure setup in zone constructor. - VM memory mappings for pageable buffers are still done outside of the UMA zone. - Change MAC API to speak 'struct pipepair' instead of 'struct pipe', update many policies. MAC labels are also handled outside of the UMA zone for now. Label-only policy modules don't have to be recompiled, but if a module is recompiled, its pipe entry points will need to be updated. If a module actually reached into the pipe structures (unlikely), that would also need to be modified. These changes substantially simplify failure handling in the pipe code as there are many fewer possible failure modes. On half-close, pipes no longer free the 'struct pipe' for the closed half until a full-close takes place. However, VM mapped buffers are still released on half-close. Some code refactoring is now possible to clean up some of the back references, etc; this patch attempts not to change the structure of most of the pipe implementation, only allocation/free code paths, so as to avoid introducing bugs (hopefully). This cuts about 8%-9% off the cost of sequential pipe allocation and free in system call tests on UP and SMP in my micro-benchmarks. May or may not make a difference in macro-benchmarks, but doing less work is good. Reviewed by: juli, tjr Testing help: dwhite, fenestro, scottl, et al
2004-02-01 05:56:51 +00:00
mac_lomac_check_pipe_ioctl(struct ucred *cred, struct pipepair *pp,
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
struct label *pplabel, unsigned long cmd, void /* caddr_t */ *data)
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
{
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
if (!mac_lomac_enabled)
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
return (0);
/* XXX: This will be implemented soon... */
return (0);
}
static int
Coalesce pipe allocations and frees. Previously, the pipe code would allocate two 'struct pipe's from the pipe zone, and malloc a mutex. - Create a new "struct pipepair" object holding the two 'struct pipe' instances, struct mutex, and struct label reference. Pipe structures now have a back-pointer to the pipe pair, and a 'pipe_present' flag to indicate whether the half has been closed. - Perform mutex init/destroy in zone init/destroy, avoiding reallocating the mutex for each pipe. Perform most pipe structure setup in zone constructor. - VM memory mappings for pageable buffers are still done outside of the UMA zone. - Change MAC API to speak 'struct pipepair' instead of 'struct pipe', update many policies. MAC labels are also handled outside of the UMA zone for now. Label-only policy modules don't have to be recompiled, but if a module is recompiled, its pipe entry points will need to be updated. If a module actually reached into the pipe structures (unlikely), that would also need to be modified. These changes substantially simplify failure handling in the pipe code as there are many fewer possible failure modes. On half-close, pipes no longer free the 'struct pipe' for the closed half until a full-close takes place. However, VM mapped buffers are still released on half-close. Some code refactoring is now possible to clean up some of the back references, etc; this patch attempts not to change the structure of most of the pipe implementation, only allocation/free code paths, so as to avoid introducing bugs (hopefully). This cuts about 8%-9% off the cost of sequential pipe allocation and free in system call tests on UP and SMP in my micro-benchmarks. May or may not make a difference in macro-benchmarks, but doing less work is good. Reviewed by: juli, tjr Testing help: dwhite, fenestro, scottl, et al
2004-02-01 05:56:51 +00:00
mac_lomac_check_pipe_read(struct ucred *cred, struct pipepair *pp,
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
struct label *pplabel)
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
{
struct mac_lomac *subj, *obj;
if (!mac_lomac_enabled)
return (0);
Modify the MAC Framework so that instead of embedding a (struct label) in various kernel objects to represent security data, we embed a (struct label *) pointer, which now references labels allocated using a UMA zone (mac_label.c). This allows the size and shape of struct label to be varied without changing the size and shape of these kernel objects, which become part of the frozen ABI with 5-STABLE. This opens the door for boot-time selection of the number of label slots, and hence changes to the bound on the number of simultaneous labeled policies at boot-time instead of compile-time. This also makes it easier to embed label references in new objects as required for locking/caching with fine-grained network stack locking, such as inpcb structures. This change also moves us further in the direction of hiding the structure of kernel objects from MAC policy modules, not to mention dramatically reducing the number of '&' symbols appearing in both the MAC Framework and MAC policy modules, and improving readability. While this results in minimal performance change with MAC enabled, it will observably shrink the size of a number of critical kernel data structures for the !MAC case, and should have a small (but measurable) performance benefit (i.e., struct vnode, struct socket) do to memory conservation and reduced cost of zeroing memory. NOTE: Users of MAC must recompile their kernel and all MAC modules as a result of this change. Because this is an API change, third party MAC modules will also need to be updated to make less use of the '&' symbol. Suggestions from: bmilekic Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-11-12 03:14:31 +00:00
subj = SLOT(cred->cr_label);
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
obj = SLOT(pplabel);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
if (!mac_lomac_dominate_single(obj, subj))
return (maybe_demote(subj, obj, "reading", "pipe", NULL));
return (0);
}
static int
Coalesce pipe allocations and frees. Previously, the pipe code would allocate two 'struct pipe's from the pipe zone, and malloc a mutex. - Create a new "struct pipepair" object holding the two 'struct pipe' instances, struct mutex, and struct label reference. Pipe structures now have a back-pointer to the pipe pair, and a 'pipe_present' flag to indicate whether the half has been closed. - Perform mutex init/destroy in zone init/destroy, avoiding reallocating the mutex for each pipe. Perform most pipe structure setup in zone constructor. - VM memory mappings for pageable buffers are still done outside of the UMA zone. - Change MAC API to speak 'struct pipepair' instead of 'struct pipe', update many policies. MAC labels are also handled outside of the UMA zone for now. Label-only policy modules don't have to be recompiled, but if a module is recompiled, its pipe entry points will need to be updated. If a module actually reached into the pipe structures (unlikely), that would also need to be modified. These changes substantially simplify failure handling in the pipe code as there are many fewer possible failure modes. On half-close, pipes no longer free the 'struct pipe' for the closed half until a full-close takes place. However, VM mapped buffers are still released on half-close. Some code refactoring is now possible to clean up some of the back references, etc; this patch attempts not to change the structure of most of the pipe implementation, only allocation/free code paths, so as to avoid introducing bugs (hopefully). This cuts about 8%-9% off the cost of sequential pipe allocation and free in system call tests on UP and SMP in my micro-benchmarks. May or may not make a difference in macro-benchmarks, but doing less work is good. Reviewed by: juli, tjr Testing help: dwhite, fenestro, scottl, et al
2004-02-01 05:56:51 +00:00
mac_lomac_check_pipe_relabel(struct ucred *cred, struct pipepair *pp,
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
struct label *pplabel, struct label *newlabel)
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
{
struct mac_lomac *subj, *obj, *new;
int error;
new = SLOT(newlabel);
Modify the MAC Framework so that instead of embedding a (struct label) in various kernel objects to represent security data, we embed a (struct label *) pointer, which now references labels allocated using a UMA zone (mac_label.c). This allows the size and shape of struct label to be varied without changing the size and shape of these kernel objects, which become part of the frozen ABI with 5-STABLE. This opens the door for boot-time selection of the number of label slots, and hence changes to the bound on the number of simultaneous labeled policies at boot-time instead of compile-time. This also makes it easier to embed label references in new objects as required for locking/caching with fine-grained network stack locking, such as inpcb structures. This change also moves us further in the direction of hiding the structure of kernel objects from MAC policy modules, not to mention dramatically reducing the number of '&' symbols appearing in both the MAC Framework and MAC policy modules, and improving readability. While this results in minimal performance change with MAC enabled, it will observably shrink the size of a number of critical kernel data structures for the !MAC case, and should have a small (but measurable) performance benefit (i.e., struct vnode, struct socket) do to memory conservation and reduced cost of zeroing memory. NOTE: Users of MAC must recompile their kernel and all MAC modules as a result of this change. Because this is an API change, third party MAC modules will also need to be updated to make less use of the '&' symbol. Suggestions from: bmilekic Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-11-12 03:14:31 +00:00
subj = SLOT(cred->cr_label);
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
obj = SLOT(pplabel);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
/*
* If there is a LOMAC label update for a pipe, it must be a
* single update.
*/
error = lomac_atmostflags(new, MAC_LOMAC_FLAG_SINGLE);
if (error)
return (error);
/*
* To perform a relabel of a pipe (LOMAC label or not), LOMAC must
* authorize the relabel.
*/
if (!mac_lomac_single_in_range(obj, subj))
return (EPERM);
/*
* If the LOMAC label is to be changed, authorize as appropriate.
*/
if (new->ml_flags & MAC_LOMAC_FLAG_SINGLE) {
/*
* To change the LOMAC label on a pipe, the new pipe label
* must be in the subject range.
*/
if (!mac_lomac_single_in_range(new, subj))
return (EPERM);
/*
* To change the LOMAC label on a pipe to be EQUAL, the
* subject must have appropriate privilege.
*/
if (mac_lomac_contains_equal(new)) {
error = mac_lomac_subject_privileged(subj);
if (error)
return (error);
}
}
return (0);
}
static int
Coalesce pipe allocations and frees. Previously, the pipe code would allocate two 'struct pipe's from the pipe zone, and malloc a mutex. - Create a new "struct pipepair" object holding the two 'struct pipe' instances, struct mutex, and struct label reference. Pipe structures now have a back-pointer to the pipe pair, and a 'pipe_present' flag to indicate whether the half has been closed. - Perform mutex init/destroy in zone init/destroy, avoiding reallocating the mutex for each pipe. Perform most pipe structure setup in zone constructor. - VM memory mappings for pageable buffers are still done outside of the UMA zone. - Change MAC API to speak 'struct pipepair' instead of 'struct pipe', update many policies. MAC labels are also handled outside of the UMA zone for now. Label-only policy modules don't have to be recompiled, but if a module is recompiled, its pipe entry points will need to be updated. If a module actually reached into the pipe structures (unlikely), that would also need to be modified. These changes substantially simplify failure handling in the pipe code as there are many fewer possible failure modes. On half-close, pipes no longer free the 'struct pipe' for the closed half until a full-close takes place. However, VM mapped buffers are still released on half-close. Some code refactoring is now possible to clean up some of the back references, etc; this patch attempts not to change the structure of most of the pipe implementation, only allocation/free code paths, so as to avoid introducing bugs (hopefully). This cuts about 8%-9% off the cost of sequential pipe allocation and free in system call tests on UP and SMP in my micro-benchmarks. May or may not make a difference in macro-benchmarks, but doing less work is good. Reviewed by: juli, tjr Testing help: dwhite, fenestro, scottl, et al
2004-02-01 05:56:51 +00:00
mac_lomac_check_pipe_write(struct ucred *cred, struct pipepair *pp,
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
struct label *pplabel)
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
{
struct mac_lomac *subj, *obj;
if (!mac_lomac_enabled)
return (0);
Modify the MAC Framework so that instead of embedding a (struct label) in various kernel objects to represent security data, we embed a (struct label *) pointer, which now references labels allocated using a UMA zone (mac_label.c). This allows the size and shape of struct label to be varied without changing the size and shape of these kernel objects, which become part of the frozen ABI with 5-STABLE. This opens the door for boot-time selection of the number of label slots, and hence changes to the bound on the number of simultaneous labeled policies at boot-time instead of compile-time. This also makes it easier to embed label references in new objects as required for locking/caching with fine-grained network stack locking, such as inpcb structures. This change also moves us further in the direction of hiding the structure of kernel objects from MAC policy modules, not to mention dramatically reducing the number of '&' symbols appearing in both the MAC Framework and MAC policy modules, and improving readability. While this results in minimal performance change with MAC enabled, it will observably shrink the size of a number of critical kernel data structures for the !MAC case, and should have a small (but measurable) performance benefit (i.e., struct vnode, struct socket) do to memory conservation and reduced cost of zeroing memory. NOTE: Users of MAC must recompile their kernel and all MAC modules as a result of this change. Because this is an API change, third party MAC modules will also need to be updated to make less use of the '&' symbol. Suggestions from: bmilekic Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-11-12 03:14:31 +00:00
subj = SLOT(cred->cr_label);
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
obj = SLOT(pplabel);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
if (!mac_lomac_subject_dominate(subj, obj))
return (EACCES);
return (0);
}
static int
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
mac_lomac_check_proc_debug(struct ucred *cred, struct proc *p)
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
{
struct mac_lomac *subj, *obj;
if (!mac_lomac_enabled)
return (0);
Modify the MAC Framework so that instead of embedding a (struct label) in various kernel objects to represent security data, we embed a (struct label *) pointer, which now references labels allocated using a UMA zone (mac_label.c). This allows the size and shape of struct label to be varied without changing the size and shape of these kernel objects, which become part of the frozen ABI with 5-STABLE. This opens the door for boot-time selection of the number of label slots, and hence changes to the bound on the number of simultaneous labeled policies at boot-time instead of compile-time. This also makes it easier to embed label references in new objects as required for locking/caching with fine-grained network stack locking, such as inpcb structures. This change also moves us further in the direction of hiding the structure of kernel objects from MAC policy modules, not to mention dramatically reducing the number of '&' symbols appearing in both the MAC Framework and MAC policy modules, and improving readability. While this results in minimal performance change with MAC enabled, it will observably shrink the size of a number of critical kernel data structures for the !MAC case, and should have a small (but measurable) performance benefit (i.e., struct vnode, struct socket) do to memory conservation and reduced cost of zeroing memory. NOTE: Users of MAC must recompile their kernel and all MAC modules as a result of this change. Because this is an API change, third party MAC modules will also need to be updated to make less use of the '&' symbol. Suggestions from: bmilekic Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-11-12 03:14:31 +00:00
subj = SLOT(cred->cr_label);
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
obj = SLOT(p->p_ucred->cr_label);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
/* XXX: range checks */
if (!mac_lomac_dominate_single(obj, subj))
return (ESRCH);
if (!mac_lomac_subject_dominate(subj, obj))
return (EACCES);
return (0);
}
static int
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
mac_lomac_check_proc_sched(struct ucred *cred, struct proc *p)
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
{
struct mac_lomac *subj, *obj;
if (!mac_lomac_enabled)
return (0);
Modify the MAC Framework so that instead of embedding a (struct label) in various kernel objects to represent security data, we embed a (struct label *) pointer, which now references labels allocated using a UMA zone (mac_label.c). This allows the size and shape of struct label to be varied without changing the size and shape of these kernel objects, which become part of the frozen ABI with 5-STABLE. This opens the door for boot-time selection of the number of label slots, and hence changes to the bound on the number of simultaneous labeled policies at boot-time instead of compile-time. This also makes it easier to embed label references in new objects as required for locking/caching with fine-grained network stack locking, such as inpcb structures. This change also moves us further in the direction of hiding the structure of kernel objects from MAC policy modules, not to mention dramatically reducing the number of '&' symbols appearing in both the MAC Framework and MAC policy modules, and improving readability. While this results in minimal performance change with MAC enabled, it will observably shrink the size of a number of critical kernel data structures for the !MAC case, and should have a small (but measurable) performance benefit (i.e., struct vnode, struct socket) do to memory conservation and reduced cost of zeroing memory. NOTE: Users of MAC must recompile their kernel and all MAC modules as a result of this change. Because this is an API change, third party MAC modules will also need to be updated to make less use of the '&' symbol. Suggestions from: bmilekic Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-11-12 03:14:31 +00:00
subj = SLOT(cred->cr_label);
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
obj = SLOT(p->p_ucred->cr_label);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
/* XXX: range checks */
if (!mac_lomac_dominate_single(obj, subj))
return (ESRCH);
if (!mac_lomac_subject_dominate(subj, obj))
return (EACCES);
return (0);
}
static int
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
mac_lomac_check_proc_signal(struct ucred *cred, struct proc *p, int signum)
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
{
struct mac_lomac *subj, *obj;
if (!mac_lomac_enabled)
return (0);
Modify the MAC Framework so that instead of embedding a (struct label) in various kernel objects to represent security data, we embed a (struct label *) pointer, which now references labels allocated using a UMA zone (mac_label.c). This allows the size and shape of struct label to be varied without changing the size and shape of these kernel objects, which become part of the frozen ABI with 5-STABLE. This opens the door for boot-time selection of the number of label slots, and hence changes to the bound on the number of simultaneous labeled policies at boot-time instead of compile-time. This also makes it easier to embed label references in new objects as required for locking/caching with fine-grained network stack locking, such as inpcb structures. This change also moves us further in the direction of hiding the structure of kernel objects from MAC policy modules, not to mention dramatically reducing the number of '&' symbols appearing in both the MAC Framework and MAC policy modules, and improving readability. While this results in minimal performance change with MAC enabled, it will observably shrink the size of a number of critical kernel data structures for the !MAC case, and should have a small (but measurable) performance benefit (i.e., struct vnode, struct socket) do to memory conservation and reduced cost of zeroing memory. NOTE: Users of MAC must recompile their kernel and all MAC modules as a result of this change. Because this is an API change, third party MAC modules will also need to be updated to make less use of the '&' symbol. Suggestions from: bmilekic Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-11-12 03:14:31 +00:00
subj = SLOT(cred->cr_label);
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
obj = SLOT(p->p_ucred->cr_label);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
/* XXX: range checks */
if (!mac_lomac_dominate_single(obj, subj))
return (ESRCH);
if (!mac_lomac_subject_dominate(subj, obj))
return (EACCES);
return (0);
}
static int
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
mac_lomac_check_socket_deliver(struct socket *so, struct label *solabel,
struct mbuf *m, struct label *mlabel)
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
{
struct mac_lomac *p, *s;
if (!mac_lomac_enabled)
return (0);
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
p = SLOT(mlabel);
s = SLOT(solabel);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
return (mac_lomac_equal_single(p, s) ? 0 : EACCES);
}
static int
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
mac_lomac_check_socket_relabel(struct ucred *cred, struct socket *so,
struct label *solabel, struct label *newlabel)
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
{
struct mac_lomac *subj, *obj, *new;
int error;
new = SLOT(newlabel);
Modify the MAC Framework so that instead of embedding a (struct label) in various kernel objects to represent security data, we embed a (struct label *) pointer, which now references labels allocated using a UMA zone (mac_label.c). This allows the size and shape of struct label to be varied without changing the size and shape of these kernel objects, which become part of the frozen ABI with 5-STABLE. This opens the door for boot-time selection of the number of label slots, and hence changes to the bound on the number of simultaneous labeled policies at boot-time instead of compile-time. This also makes it easier to embed label references in new objects as required for locking/caching with fine-grained network stack locking, such as inpcb structures. This change also moves us further in the direction of hiding the structure of kernel objects from MAC policy modules, not to mention dramatically reducing the number of '&' symbols appearing in both the MAC Framework and MAC policy modules, and improving readability. While this results in minimal performance change with MAC enabled, it will observably shrink the size of a number of critical kernel data structures for the !MAC case, and should have a small (but measurable) performance benefit (i.e., struct vnode, struct socket) do to memory conservation and reduced cost of zeroing memory. NOTE: Users of MAC must recompile their kernel and all MAC modules as a result of this change. Because this is an API change, third party MAC modules will also need to be updated to make less use of the '&' symbol. Suggestions from: bmilekic Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-11-12 03:14:31 +00:00
subj = SLOT(cred->cr_label);
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
obj = SLOT(solabel);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
/*
* If there is a LOMAC label update for the socket, it may be
* an update of single.
*/
error = lomac_atmostflags(new, MAC_LOMAC_FLAG_SINGLE);
if (error)
return (error);
/*
* To relabel a socket, the old socket single must be in the subject
* range.
*/
if (!mac_lomac_single_in_range(obj, subj))
return (EPERM);
/*
* If the LOMAC label is to be changed, authorize as appropriate.
*/
if (new->ml_flags & MAC_LOMAC_FLAG_SINGLE) {
/*
* To relabel a socket, the new socket single must be in
* the subject range.
*/
if (!mac_lomac_single_in_range(new, subj))
return (EPERM);
/*
* To change the LOMAC label on the socket to contain EQUAL,
* the subject must have appropriate privilege.
*/
if (mac_lomac_contains_equal(new)) {
error = mac_lomac_subject_privileged(subj);
if (error)
return (error);
}
}
return (0);
}
static int
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
mac_lomac_check_socket_visible(struct ucred *cred, struct socket *so,
struct label *solabel)
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
{
struct mac_lomac *subj, *obj;
if (!mac_lomac_enabled)
return (0);
Modify the MAC Framework so that instead of embedding a (struct label) in various kernel objects to represent security data, we embed a (struct label *) pointer, which now references labels allocated using a UMA zone (mac_label.c). This allows the size and shape of struct label to be varied without changing the size and shape of these kernel objects, which become part of the frozen ABI with 5-STABLE. This opens the door for boot-time selection of the number of label slots, and hence changes to the bound on the number of simultaneous labeled policies at boot-time instead of compile-time. This also makes it easier to embed label references in new objects as required for locking/caching with fine-grained network stack locking, such as inpcb structures. This change also moves us further in the direction of hiding the structure of kernel objects from MAC policy modules, not to mention dramatically reducing the number of '&' symbols appearing in both the MAC Framework and MAC policy modules, and improving readability. While this results in minimal performance change with MAC enabled, it will observably shrink the size of a number of critical kernel data structures for the !MAC case, and should have a small (but measurable) performance benefit (i.e., struct vnode, struct socket) do to memory conservation and reduced cost of zeroing memory. NOTE: Users of MAC must recompile their kernel and all MAC modules as a result of this change. Because this is an API change, third party MAC modules will also need to be updated to make less use of the '&' symbol. Suggestions from: bmilekic Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-11-12 03:14:31 +00:00
subj = SLOT(cred->cr_label);
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
obj = SLOT(solabel);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
if (!mac_lomac_dominate_single(obj, subj))
return (ENOENT);
return (0);
}
Remove MAC Framework access control check entry points made redundant with the introduction of priv(9) and MAC Framework entry points for privilege checking/granting. These entry points exactly aligned with privileges and provided no additional security context: - mac_check_sysarch_ioperm() - mac_check_kld_unload() - mac_check_settime() - mac_check_system_nfsd() Add mpo_priv_check() implementations to Biba and LOMAC policies, which, for each privilege, determine if they can be granted to processes considered unprivileged by those two policies. These mostly, but not entirely, align with the set of privileges granted in jails. Obtained from: TrustedBSD Project
2007-04-22 15:31:22 +00:00
/*
* Some system privileges are allowed regardless of integrity grade; others
* are allowed only when running with privilege with respect to the LOMAC
* policy as they might otherwise allow bypassing of the integrity policy.
*/
static int
mac_lomac_priv_check(struct ucred *cred, int priv)
{
struct mac_lomac *subj;
int error;
if (!mac_lomac_enabled)
return (0);
/*
* Exempt only specific privileges from the LOMAC integrity policy.
*/
switch (priv) {
case PRIV_KTRACE:
case PRIV_MSGBUF:
/*
* Allow processes to manipulate basic process audit properties, and
* to submit audit records.
*/
case PRIV_AUDIT_GETAUDIT:
case PRIV_AUDIT_SETAUDIT:
case PRIV_AUDIT_SUBMIT:
/*
* Allow processes to manipulate their regular UNIX credentials.
*/
case PRIV_CRED_SETUID:
case PRIV_CRED_SETEUID:
case PRIV_CRED_SETGID:
case PRIV_CRED_SETEGID:
case PRIV_CRED_SETGROUPS:
case PRIV_CRED_SETREUID:
case PRIV_CRED_SETREGID:
case PRIV_CRED_SETRESUID:
case PRIV_CRED_SETRESGID:
/*
* Allow processes to perform system monitoring.
*/
case PRIV_SEEOTHERGIDS:
case PRIV_SEEOTHERUIDS:
break;
/*
* Allow access to general process debugging facilities. We
* separately control debugging based on MAC label.
*/
case PRIV_DEBUG_DIFFCRED:
case PRIV_DEBUG_SUGID:
case PRIV_DEBUG_UNPRIV:
/*
* Allow manipulating jails.
*/
case PRIV_JAIL_ATTACH:
/*
* Allow privilege with respect to the Partition policy, but not the
* Privs policy.
*/
case PRIV_MAC_PARTITION:
/*
* Allow privilege with respect to process resource limits and login
* context.
*/
case PRIV_PROC_LIMIT:
case PRIV_PROC_SETLOGIN:
case PRIV_PROC_SETRLIMIT:
/*
* Allow System V and POSIX IPC privileges.
*/
case PRIV_IPC_READ:
case PRIV_IPC_WRITE:
case PRIV_IPC_ADMIN:
case PRIV_IPC_MSGSIZE:
case PRIV_MQ_ADMIN:
/*
* Allow certain scheduler manipulations -- possibly this should be
* controlled by more fine-grained policy, as potentially low
* integrity processes can deny CPU to higher integrity ones.
*/
case PRIV_SCHED_DIFFCRED:
case PRIV_SCHED_SETPRIORITY:
case PRIV_SCHED_RTPRIO:
case PRIV_SCHED_SETPOLICY:
case PRIV_SCHED_SET:
case PRIV_SCHED_SETPARAM:
/*
* More IPC privileges.
*/
case PRIV_SEM_WRITE:
/*
* Allow signaling privileges subject to integrity policy.
*/
case PRIV_SIGNAL_DIFFCRED:
case PRIV_SIGNAL_SUGID:
/*
* Allow access to only limited sysctls from lower integrity levels;
* piggy-back on the Jail definition.
*/
case PRIV_SYSCTL_WRITEJAIL:
/*
* Allow TTY-based privileges, subject to general device access using
* labels on TTY device nodes, but not console privilege.
*/
case PRIV_TTY_DRAINWAIT:
case PRIV_TTY_DTRWAIT:
case PRIV_TTY_EXCLUSIVE:
case PRIV_TTY_PRISON:
case PRIV_TTY_STI:
case PRIV_TTY_SETA:
/*
* Grant most VFS privileges, as almost all are in practice bounded
* by more specific checks using labels.
*/
case PRIV_VFS_READ:
case PRIV_VFS_WRITE:
case PRIV_VFS_ADMIN:
case PRIV_VFS_EXEC:
case PRIV_VFS_LOOKUP:
case PRIV_VFS_CHFLAGS_DEV:
case PRIV_VFS_CHOWN:
case PRIV_VFS_CHROOT:
case PRIV_VFS_RETAINSUGID:
case PRIV_VFS_EXCEEDQUOTA:
case PRIV_VFS_FCHROOT:
case PRIV_VFS_FHOPEN:
case PRIV_VFS_FHSTATFS:
case PRIV_VFS_GENERATION:
case PRIV_VFS_GETFH:
case PRIV_VFS_GETQUOTA:
case PRIV_VFS_LINK:
case PRIV_VFS_MOUNT:
case PRIV_VFS_MOUNT_OWNER:
case PRIV_VFS_MOUNT_PERM:
case PRIV_VFS_MOUNT_SUIDDIR:
case PRIV_VFS_MOUNT_NONUSER:
case PRIV_VFS_SETGID:
case PRIV_VFS_STICKYFILE:
case PRIV_VFS_SYSFLAGS:
case PRIV_VFS_UNMOUNT:
/*
* Allow VM privileges; it would be nice if these were subject to
* resource limits.
*/
case PRIV_VM_MADV_PROTECT:
case PRIV_VM_MLOCK:
case PRIV_VM_MUNLOCK:
/*
* Allow some but not all network privileges. In general, dont allow
* reconfiguring the network stack, just normal use.
*/
case PRIV_NETATALK_RESERVEDPORT:
case PRIV_NETINET_RESERVEDPORT:
case PRIV_NETINET_RAW:
case PRIV_NETINET_REUSEPORT:
case PRIV_NETIPX_RESERVEDPORT:
case PRIV_NETIPX_RAW:
break;
/*
* All remaining system privileges are allow only if the process
* holds privilege with respect to the LOMAC policy.
*/
default:
subj = SLOT(cred->cr_label);
error = mac_lomac_subject_privileged(subj);
if (error)
return (error);
}
return (0);
}
Allow MAC policy modules to control access to audit configuration system calls. Add MAC Framework entry points and MAC policy entry points for audit(), auditctl(), auditon(), setaudit(), aud setauid(). MAC Framework entry points are only added for audit system calls where additional argument context may be useful for policy decision-making; other audit system calls without arguments may be controlled via the priv(9) entry points. Update various policy modules to implement audit-related checks, and in some cases, other missing system-related checks. Obtained from: TrustedBSD Project Sponsored by: SPARTA, Inc.
2007-04-21 22:08:48 +00:00
static int
mac_lomac_check_system_acct(struct ucred *cred, struct vnode *vp,
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
struct label *vplabel)
Allow MAC policy modules to control access to audit configuration system calls. Add MAC Framework entry points and MAC policy entry points for audit(), auditctl(), auditon(), setaudit(), aud setauid(). MAC Framework entry points are only added for audit system calls where additional argument context may be useful for policy decision-making; other audit system calls without arguments may be controlled via the priv(9) entry points. Update various policy modules to implement audit-related checks, and in some cases, other missing system-related checks. Obtained from: TrustedBSD Project Sponsored by: SPARTA, Inc.
2007-04-21 22:08:48 +00:00
{
struct mac_lomac *subj, *obj;
if (!mac_lomac_enabled)
return (0);
subj = SLOT(cred->cr_label);
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
obj = SLOT(vplabel);
Allow MAC policy modules to control access to audit configuration system calls. Add MAC Framework entry points and MAC policy entry points for audit(), auditctl(), auditon(), setaudit(), aud setauid(). MAC Framework entry points are only added for audit system calls where additional argument context may be useful for policy decision-making; other audit system calls without arguments may be controlled via the priv(9) entry points. Update various policy modules to implement audit-related checks, and in some cases, other missing system-related checks. Obtained from: TrustedBSD Project Sponsored by: SPARTA, Inc.
2007-04-21 22:08:48 +00:00
if (mac_lomac_subject_privileged(subj))
return (EPERM);
if (!mac_lomac_high_single(obj))
return (EACCES);
return (0);
}
static int
mac_lomac_check_system_auditctl(struct ucred *cred, struct vnode *vp,
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
struct label *vplabel)
Allow MAC policy modules to control access to audit configuration system calls. Add MAC Framework entry points and MAC policy entry points for audit(), auditctl(), auditon(), setaudit(), aud setauid(). MAC Framework entry points are only added for audit system calls where additional argument context may be useful for policy decision-making; other audit system calls without arguments may be controlled via the priv(9) entry points. Update various policy modules to implement audit-related checks, and in some cases, other missing system-related checks. Obtained from: TrustedBSD Project Sponsored by: SPARTA, Inc.
2007-04-21 22:08:48 +00:00
{
struct mac_lomac *subj, *obj;
if (!mac_lomac_enabled)
return (0);
subj = SLOT(cred->cr_label);
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
obj = SLOT(vplabel);
Allow MAC policy modules to control access to audit configuration system calls. Add MAC Framework entry points and MAC policy entry points for audit(), auditctl(), auditon(), setaudit(), aud setauid(). MAC Framework entry points are only added for audit system calls where additional argument context may be useful for policy decision-making; other audit system calls without arguments may be controlled via the priv(9) entry points. Update various policy modules to implement audit-related checks, and in some cases, other missing system-related checks. Obtained from: TrustedBSD Project Sponsored by: SPARTA, Inc.
2007-04-21 22:08:48 +00:00
if (mac_lomac_subject_privileged(subj))
return (EPERM);
if (!mac_lomac_high_single(obj))
return (EACCES);
return (0);
}
static int
mac_lomac_check_system_swapoff(struct ucred *cred, struct vnode *vp,
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
struct label *vplabel)
Allow MAC policy modules to control access to audit configuration system calls. Add MAC Framework entry points and MAC policy entry points for audit(), auditctl(), auditon(), setaudit(), aud setauid(). MAC Framework entry points are only added for audit system calls where additional argument context may be useful for policy decision-making; other audit system calls without arguments may be controlled via the priv(9) entry points. Update various policy modules to implement audit-related checks, and in some cases, other missing system-related checks. Obtained from: TrustedBSD Project Sponsored by: SPARTA, Inc.
2007-04-21 22:08:48 +00:00
{
struct mac_lomac *subj;
if (!mac_lomac_enabled)
return (0);
subj = SLOT(cred->cr_label);
if (mac_lomac_subject_privileged(subj))
return (EPERM);
return (0);
}
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
static int
mac_lomac_check_system_swapon(struct ucred *cred, struct vnode *vp,
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
struct label *vplabel)
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
{
struct mac_lomac *subj, *obj;
if (!mac_lomac_enabled)
return (0);
Modify the MAC Framework so that instead of embedding a (struct label) in various kernel objects to represent security data, we embed a (struct label *) pointer, which now references labels allocated using a UMA zone (mac_label.c). This allows the size and shape of struct label to be varied without changing the size and shape of these kernel objects, which become part of the frozen ABI with 5-STABLE. This opens the door for boot-time selection of the number of label slots, and hence changes to the bound on the number of simultaneous labeled policies at boot-time instead of compile-time. This also makes it easier to embed label references in new objects as required for locking/caching with fine-grained network stack locking, such as inpcb structures. This change also moves us further in the direction of hiding the structure of kernel objects from MAC policy modules, not to mention dramatically reducing the number of '&' symbols appearing in both the MAC Framework and MAC policy modules, and improving readability. While this results in minimal performance change with MAC enabled, it will observably shrink the size of a number of critical kernel data structures for the !MAC case, and should have a small (but measurable) performance benefit (i.e., struct vnode, struct socket) do to memory conservation and reduced cost of zeroing memory. NOTE: Users of MAC must recompile their kernel and all MAC modules as a result of this change. Because this is an API change, third party MAC modules will also need to be updated to make less use of the '&' symbol. Suggestions from: bmilekic Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-11-12 03:14:31 +00:00
subj = SLOT(cred->cr_label);
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
obj = SLOT(vplabel);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
if (mac_lomac_subject_privileged(subj))
return (EPERM);
if (!mac_lomac_high_single(obj))
return (EACCES);
return (0);
}
static int
Reimplement sysctls handling by MAC framework. Now I believe it is done in the right way. Removed some XXMAC cases, we now assume 'high' integrity level for all sysctls, except those with CTLFLAG_ANYBODY flag set. No more magic. Reviewed by: rwatson Approved by: rwatson, scottl (mentor) Tested with: LINT (compilation), mac_biba(4) (functionality)
2004-02-22 12:31:44 +00:00
mac_lomac_check_system_sysctl(struct ucred *cred, struct sysctl_oid *oidp,
void *arg1, int arg2, struct sysctl_req *req)
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
{
struct mac_lomac *subj;
if (!mac_lomac_enabled)
return (0);
Modify the MAC Framework so that instead of embedding a (struct label) in various kernel objects to represent security data, we embed a (struct label *) pointer, which now references labels allocated using a UMA zone (mac_label.c). This allows the size and shape of struct label to be varied without changing the size and shape of these kernel objects, which become part of the frozen ABI with 5-STABLE. This opens the door for boot-time selection of the number of label slots, and hence changes to the bound on the number of simultaneous labeled policies at boot-time instead of compile-time. This also makes it easier to embed label references in new objects as required for locking/caching with fine-grained network stack locking, such as inpcb structures. This change also moves us further in the direction of hiding the structure of kernel objects from MAC policy modules, not to mention dramatically reducing the number of '&' symbols appearing in both the MAC Framework and MAC policy modules, and improving readability. While this results in minimal performance change with MAC enabled, it will observably shrink the size of a number of critical kernel data structures for the !MAC case, and should have a small (but measurable) performance benefit (i.e., struct vnode, struct socket) do to memory conservation and reduced cost of zeroing memory. NOTE: Users of MAC must recompile their kernel and all MAC modules as a result of this change. Because this is an API change, third party MAC modules will also need to be updated to make less use of the '&' symbol. Suggestions from: bmilekic Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-11-12 03:14:31 +00:00
subj = SLOT(cred->cr_label);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
/*
Reimplement sysctls handling by MAC framework. Now I believe it is done in the right way. Removed some XXMAC cases, we now assume 'high' integrity level for all sysctls, except those with CTLFLAG_ANYBODY flag set. No more magic. Reviewed by: rwatson Approved by: rwatson, scottl (mentor) Tested with: LINT (compilation), mac_biba(4) (functionality)
2004-02-22 12:31:44 +00:00
* Treat sysctl variables without CTLFLAG_ANYBODY flag as
* lomac/high, but also require privilege to change them.
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
*/
Reimplement sysctls handling by MAC framework. Now I believe it is done in the right way. Removed some XXMAC cases, we now assume 'high' integrity level for all sysctls, except those with CTLFLAG_ANYBODY flag set. No more magic. Reviewed by: rwatson Approved by: rwatson, scottl (mentor) Tested with: LINT (compilation), mac_biba(4) (functionality)
2004-02-22 12:31:44 +00:00
if (req->newptr != NULL && (oidp->oid_kind & CTLFLAG_ANYBODY) == 0) {
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
#ifdef notdef
if (!mac_lomac_subject_dominate_high(subj))
return (EACCES);
#endif
if (mac_lomac_subject_privileged(subj))
return (EPERM);
}
return (0);
}
static int
mac_lomac_check_vnode_create(struct ucred *cred, struct vnode *dvp,
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
struct label *dvplabel, struct componentname *cnp, struct vattr *vap)
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
{
struct mac_lomac *subj, *obj;
if (!mac_lomac_enabled)
return (0);
Modify the MAC Framework so that instead of embedding a (struct label) in various kernel objects to represent security data, we embed a (struct label *) pointer, which now references labels allocated using a UMA zone (mac_label.c). This allows the size and shape of struct label to be varied without changing the size and shape of these kernel objects, which become part of the frozen ABI with 5-STABLE. This opens the door for boot-time selection of the number of label slots, and hence changes to the bound on the number of simultaneous labeled policies at boot-time instead of compile-time. This also makes it easier to embed label references in new objects as required for locking/caching with fine-grained network stack locking, such as inpcb structures. This change also moves us further in the direction of hiding the structure of kernel objects from MAC policy modules, not to mention dramatically reducing the number of '&' symbols appearing in both the MAC Framework and MAC policy modules, and improving readability. While this results in minimal performance change with MAC enabled, it will observably shrink the size of a number of critical kernel data structures for the !MAC case, and should have a small (but measurable) performance benefit (i.e., struct vnode, struct socket) do to memory conservation and reduced cost of zeroing memory. NOTE: Users of MAC must recompile their kernel and all MAC modules as a result of this change. Because this is an API change, third party MAC modules will also need to be updated to make less use of the '&' symbol. Suggestions from: bmilekic Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-11-12 03:14:31 +00:00
subj = SLOT(cred->cr_label);
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
obj = SLOT(dvplabel);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
if (!mac_lomac_subject_dominate(subj, obj))
return (EACCES);
if (obj->ml_flags & MAC_LOMAC_FLAG_AUX &&
!mac_lomac_dominate_element(&subj->ml_single, &obj->ml_auxsingle))
return (EACCES);
return (0);
}
static int
mac_lomac_check_vnode_delete(struct ucred *cred, struct vnode *dvp,
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
struct label *dvplabel, struct vnode *vp, struct label *vplabel,
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
struct componentname *cnp)
{
struct mac_lomac *subj, *obj;
if (!mac_lomac_enabled)
return (0);
Modify the MAC Framework so that instead of embedding a (struct label) in various kernel objects to represent security data, we embed a (struct label *) pointer, which now references labels allocated using a UMA zone (mac_label.c). This allows the size and shape of struct label to be varied without changing the size and shape of these kernel objects, which become part of the frozen ABI with 5-STABLE. This opens the door for boot-time selection of the number of label slots, and hence changes to the bound on the number of simultaneous labeled policies at boot-time instead of compile-time. This also makes it easier to embed label references in new objects as required for locking/caching with fine-grained network stack locking, such as inpcb structures. This change also moves us further in the direction of hiding the structure of kernel objects from MAC policy modules, not to mention dramatically reducing the number of '&' symbols appearing in both the MAC Framework and MAC policy modules, and improving readability. While this results in minimal performance change with MAC enabled, it will observably shrink the size of a number of critical kernel data structures for the !MAC case, and should have a small (but measurable) performance benefit (i.e., struct vnode, struct socket) do to memory conservation and reduced cost of zeroing memory. NOTE: Users of MAC must recompile their kernel and all MAC modules as a result of this change. Because this is an API change, third party MAC modules will also need to be updated to make less use of the '&' symbol. Suggestions from: bmilekic Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-11-12 03:14:31 +00:00
subj = SLOT(cred->cr_label);
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
obj = SLOT(dvplabel);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
if (!mac_lomac_subject_dominate(subj, obj))
return (EACCES);
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
obj = SLOT(vplabel);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
if (!mac_lomac_subject_dominate(subj, obj))
return (EACCES);
return (0);
}
static int
mac_lomac_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp,
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
struct label *vplabel, acl_type_t type)
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
{
struct mac_lomac *subj, *obj;
if (!mac_lomac_enabled)
return (0);
Modify the MAC Framework so that instead of embedding a (struct label) in various kernel objects to represent security data, we embed a (struct label *) pointer, which now references labels allocated using a UMA zone (mac_label.c). This allows the size and shape of struct label to be varied without changing the size and shape of these kernel objects, which become part of the frozen ABI with 5-STABLE. This opens the door for boot-time selection of the number of label slots, and hence changes to the bound on the number of simultaneous labeled policies at boot-time instead of compile-time. This also makes it easier to embed label references in new objects as required for locking/caching with fine-grained network stack locking, such as inpcb structures. This change also moves us further in the direction of hiding the structure of kernel objects from MAC policy modules, not to mention dramatically reducing the number of '&' symbols appearing in both the MAC Framework and MAC policy modules, and improving readability. While this results in minimal performance change with MAC enabled, it will observably shrink the size of a number of critical kernel data structures for the !MAC case, and should have a small (but measurable) performance benefit (i.e., struct vnode, struct socket) do to memory conservation and reduced cost of zeroing memory. NOTE: Users of MAC must recompile their kernel and all MAC modules as a result of this change. Because this is an API change, third party MAC modules will also need to be updated to make less use of the '&' symbol. Suggestions from: bmilekic Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-11-12 03:14:31 +00:00
subj = SLOT(cred->cr_label);
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
obj = SLOT(vplabel);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
if (!mac_lomac_subject_dominate(subj, obj))
return (EACCES);
return (0);
}
static int
mac_lomac_check_vnode_link(struct ucred *cred, struct vnode *dvp,
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
struct label *dvplabel, struct vnode *vp, struct label *vplabel,
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
struct componentname *cnp)
{
struct mac_lomac *subj, *obj;
if (!mac_lomac_enabled)
return (0);
Modify the MAC Framework so that instead of embedding a (struct label) in various kernel objects to represent security data, we embed a (struct label *) pointer, which now references labels allocated using a UMA zone (mac_label.c). This allows the size and shape of struct label to be varied without changing the size and shape of these kernel objects, which become part of the frozen ABI with 5-STABLE. This opens the door for boot-time selection of the number of label slots, and hence changes to the bound on the number of simultaneous labeled policies at boot-time instead of compile-time. This also makes it easier to embed label references in new objects as required for locking/caching with fine-grained network stack locking, such as inpcb structures. This change also moves us further in the direction of hiding the structure of kernel objects from MAC policy modules, not to mention dramatically reducing the number of '&' symbols appearing in both the MAC Framework and MAC policy modules, and improving readability. While this results in minimal performance change with MAC enabled, it will observably shrink the size of a number of critical kernel data structures for the !MAC case, and should have a small (but measurable) performance benefit (i.e., struct vnode, struct socket) do to memory conservation and reduced cost of zeroing memory. NOTE: Users of MAC must recompile their kernel and all MAC modules as a result of this change. Because this is an API change, third party MAC modules will also need to be updated to make less use of the '&' symbol. Suggestions from: bmilekic Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-11-12 03:14:31 +00:00
subj = SLOT(cred->cr_label);
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
obj = SLOT(dvplabel);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
if (!mac_lomac_subject_dominate(subj, obj))
return (EACCES);
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
obj = SLOT(vplabel);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
if (!mac_lomac_subject_dominate(subj, obj))
return (EACCES);
return (0);
}
static int
mac_lomac_check_vnode_mmap(struct ucred *cred, struct vnode *vp,
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
struct label *vplabel, int prot, int flags)
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
{
struct mac_lomac *subj, *obj;
/*
* Rely on the use of open()-time protections to handle
* non-revocation cases.
*/
if (!mac_lomac_enabled)
return (0);
Modify the MAC Framework so that instead of embedding a (struct label) in various kernel objects to represent security data, we embed a (struct label *) pointer, which now references labels allocated using a UMA zone (mac_label.c). This allows the size and shape of struct label to be varied without changing the size and shape of these kernel objects, which become part of the frozen ABI with 5-STABLE. This opens the door for boot-time selection of the number of label slots, and hence changes to the bound on the number of simultaneous labeled policies at boot-time instead of compile-time. This also makes it easier to embed label references in new objects as required for locking/caching with fine-grained network stack locking, such as inpcb structures. This change also moves us further in the direction of hiding the structure of kernel objects from MAC policy modules, not to mention dramatically reducing the number of '&' symbols appearing in both the MAC Framework and MAC policy modules, and improving readability. While this results in minimal performance change with MAC enabled, it will observably shrink the size of a number of critical kernel data structures for the !MAC case, and should have a small (but measurable) performance benefit (i.e., struct vnode, struct socket) do to memory conservation and reduced cost of zeroing memory. NOTE: Users of MAC must recompile their kernel and all MAC modules as a result of this change. Because this is an API change, third party MAC modules will also need to be updated to make less use of the '&' symbol. Suggestions from: bmilekic Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-11-12 03:14:31 +00:00
subj = SLOT(cred->cr_label);
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
obj = SLOT(vplabel);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
Move MAC check_vnode_mmap entry point out from being exclusive to MAP_SHARED so that the entry point gets executed un-conditionally. This may be useful for security policies which want to perform access control checks around run-time linking. -add the mmap(2) flags argument to the check_vnode_mmap entry point so that we can make access control decisions based on the type of mapped object. -update any dependent API around this parameter addition such as function prototype modifications, entry point parameter additions and the inclusion of sys/mman.h header file. -Change the MLS, BIBA and LOMAC security policies so that subject domination routines are not executed unless the type of mapping is shared. This is done to maintain compatibility between the old vm_mmap_vnode(9) and these policies. Reviewed by: rwatson MFC after: 1 month
2005-04-14 16:03:30 +00:00
if (((prot & VM_PROT_WRITE) != 0) && ((flags & MAP_SHARED) != 0)) {
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
if (!mac_lomac_subject_dominate(subj, obj))
return (EACCES);
}
if (prot & (VM_PROT_READ | VM_PROT_EXECUTE)) {
if (!mac_lomac_dominate_single(obj, subj))
return (maybe_demote(subj, obj, "mapping", "file", vp));
}
return (0);
}
static void
mac_lomac_check_vnode_mmap_downgrade(struct ucred *cred, struct vnode *vp,
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
struct label *vplabel, /* XXX vm_prot_t */ int *prot)
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
{
struct mac_lomac *subj, *obj;
/*
* Rely on the use of open()-time protections to handle
* non-revocation cases.
*/
if (!mac_lomac_enabled || !revocation_enabled)
return;
Modify the MAC Framework so that instead of embedding a (struct label) in various kernel objects to represent security data, we embed a (struct label *) pointer, which now references labels allocated using a UMA zone (mac_label.c). This allows the size and shape of struct label to be varied without changing the size and shape of these kernel objects, which become part of the frozen ABI with 5-STABLE. This opens the door for boot-time selection of the number of label slots, and hence changes to the bound on the number of simultaneous labeled policies at boot-time instead of compile-time. This also makes it easier to embed label references in new objects as required for locking/caching with fine-grained network stack locking, such as inpcb structures. This change also moves us further in the direction of hiding the structure of kernel objects from MAC policy modules, not to mention dramatically reducing the number of '&' symbols appearing in both the MAC Framework and MAC policy modules, and improving readability. While this results in minimal performance change with MAC enabled, it will observably shrink the size of a number of critical kernel data structures for the !MAC case, and should have a small (but measurable) performance benefit (i.e., struct vnode, struct socket) do to memory conservation and reduced cost of zeroing memory. NOTE: Users of MAC must recompile their kernel and all MAC modules as a result of this change. Because this is an API change, third party MAC modules will also need to be updated to make less use of the '&' symbol. Suggestions from: bmilekic Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-11-12 03:14:31 +00:00
subj = SLOT(cred->cr_label);
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
obj = SLOT(vplabel);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
if (!mac_lomac_subject_dominate(subj, obj))
*prot &= ~VM_PROT_WRITE;
}
static int
mac_lomac_check_vnode_open(struct ucred *cred, struct vnode *vp,
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
struct label *vplabel, int acc_mode)
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
{
struct mac_lomac *subj, *obj;
if (!mac_lomac_enabled)
return (0);
Modify the MAC Framework so that instead of embedding a (struct label) in various kernel objects to represent security data, we embed a (struct label *) pointer, which now references labels allocated using a UMA zone (mac_label.c). This allows the size and shape of struct label to be varied without changing the size and shape of these kernel objects, which become part of the frozen ABI with 5-STABLE. This opens the door for boot-time selection of the number of label slots, and hence changes to the bound on the number of simultaneous labeled policies at boot-time instead of compile-time. This also makes it easier to embed label references in new objects as required for locking/caching with fine-grained network stack locking, such as inpcb structures. This change also moves us further in the direction of hiding the structure of kernel objects from MAC policy modules, not to mention dramatically reducing the number of '&' symbols appearing in both the MAC Framework and MAC policy modules, and improving readability. While this results in minimal performance change with MAC enabled, it will observably shrink the size of a number of critical kernel data structures for the !MAC case, and should have a small (but measurable) performance benefit (i.e., struct vnode, struct socket) do to memory conservation and reduced cost of zeroing memory. NOTE: Users of MAC must recompile their kernel and all MAC modules as a result of this change. Because this is an API change, third party MAC modules will also need to be updated to make less use of the '&' symbol. Suggestions from: bmilekic Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-11-12 03:14:31 +00:00
subj = SLOT(cred->cr_label);
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
obj = SLOT(vplabel);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
/* XXX privilege override for admin? */
if (acc_mode & (VWRITE | VAPPEND | VADMIN)) {
if (!mac_lomac_subject_dominate(subj, obj))
return (EACCES);
}
return (0);
}
static int
mac_lomac_check_vnode_read(struct ucred *active_cred, struct ucred *file_cred,
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
struct vnode *vp, struct label *vplabel)
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
{
struct mac_lomac *subj, *obj;
if (!mac_lomac_enabled || !revocation_enabled)
return (0);
Modify the MAC Framework so that instead of embedding a (struct label) in various kernel objects to represent security data, we embed a (struct label *) pointer, which now references labels allocated using a UMA zone (mac_label.c). This allows the size and shape of struct label to be varied without changing the size and shape of these kernel objects, which become part of the frozen ABI with 5-STABLE. This opens the door for boot-time selection of the number of label slots, and hence changes to the bound on the number of simultaneous labeled policies at boot-time instead of compile-time. This also makes it easier to embed label references in new objects as required for locking/caching with fine-grained network stack locking, such as inpcb structures. This change also moves us further in the direction of hiding the structure of kernel objects from MAC policy modules, not to mention dramatically reducing the number of '&' symbols appearing in both the MAC Framework and MAC policy modules, and improving readability. While this results in minimal performance change with MAC enabled, it will observably shrink the size of a number of critical kernel data structures for the !MAC case, and should have a small (but measurable) performance benefit (i.e., struct vnode, struct socket) do to memory conservation and reduced cost of zeroing memory. NOTE: Users of MAC must recompile their kernel and all MAC modules as a result of this change. Because this is an API change, third party MAC modules will also need to be updated to make less use of the '&' symbol. Suggestions from: bmilekic Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-11-12 03:14:31 +00:00
subj = SLOT(active_cred->cr_label);
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
obj = SLOT(vplabel);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
if (!mac_lomac_dominate_single(obj, subj))
return (maybe_demote(subj, obj, "reading", "file", vp));
return (0);
}
static int
mac_lomac_check_vnode_relabel(struct ucred *cred, struct vnode *vp,
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
struct label *vplabel, struct label *newlabel)
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
{
struct mac_lomac *old, *new, *subj;
int error;
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
old = SLOT(vplabel);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
new = SLOT(newlabel);
Modify the MAC Framework so that instead of embedding a (struct label) in various kernel objects to represent security data, we embed a (struct label *) pointer, which now references labels allocated using a UMA zone (mac_label.c). This allows the size and shape of struct label to be varied without changing the size and shape of these kernel objects, which become part of the frozen ABI with 5-STABLE. This opens the door for boot-time selection of the number of label slots, and hence changes to the bound on the number of simultaneous labeled policies at boot-time instead of compile-time. This also makes it easier to embed label references in new objects as required for locking/caching with fine-grained network stack locking, such as inpcb structures. This change also moves us further in the direction of hiding the structure of kernel objects from MAC policy modules, not to mention dramatically reducing the number of '&' symbols appearing in both the MAC Framework and MAC policy modules, and improving readability. While this results in minimal performance change with MAC enabled, it will observably shrink the size of a number of critical kernel data structures for the !MAC case, and should have a small (but measurable) performance benefit (i.e., struct vnode, struct socket) do to memory conservation and reduced cost of zeroing memory. NOTE: Users of MAC must recompile their kernel and all MAC modules as a result of this change. Because this is an API change, third party MAC modules will also need to be updated to make less use of the '&' symbol. Suggestions from: bmilekic Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-11-12 03:14:31 +00:00
subj = SLOT(cred->cr_label);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
/*
* If there is a LOMAC label update for the vnode, it must be a
* single label, with an optional explicit auxiliary single.
*/
error = lomac_atmostflags(new,
MAC_LOMAC_FLAG_SINGLE | MAC_LOMAC_FLAG_AUX);
if (error)
return (error);
/*
* To perform a relabel of the vnode (LOMAC label or not), LOMAC must
* authorize the relabel.
*/
if (!mac_lomac_single_in_range(old, subj))
return (EPERM);
/*
* If the LOMAC label is to be changed, authorize as appropriate.
*/
if (new->ml_flags & MAC_LOMAC_FLAG_SINGLE) {
/*
* To change the LOMAC label on a vnode, the new vnode label
* must be in the subject range.
*/
if (!mac_lomac_single_in_range(new, subj))
return (EPERM);
/*
* To change the LOMAC label on the vnode to be EQUAL,
* the subject must have appropriate privilege.
*/
if (mac_lomac_contains_equal(new)) {
error = mac_lomac_subject_privileged(subj);
if (error)
return (error);
}
}
if (new->ml_flags & MAC_LOMAC_FLAG_AUX) {
Correct logic for filling out a "new" label during a credential change in mac_lomac: if both flags are set on the new label, we may not need to always fill out the label (only if one flag is set, not both). Avoid stomping on a section of the label if we are in fact modifying both elements. Because we know that both flags will be set, we don't need to test whether the range or single are set in later consistency checks of the range and single -- just test them. By checking the range of the new vs. the range of the old label before testing the single against the new range, we implicitly test that the new single is in the old range. Document this with a comment. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-08-21 18:07:52 +00:00
/*
* Fill in the missing parts from the previous label.
*/
if ((new->ml_flags & MAC_LOMAC_FLAG_SINGLE) == 0)
mac_lomac_copy_single(subj, new);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
/*
* To change the auxiliary LOMAC label on a vnode, the new
* vnode label must be in the subject range.
*/
if (!mac_lomac_auxsingle_in_range(new, subj))
return (EPERM);
/*
* To change the auxiliary LOMAC label on the vnode to be
* EQUAL, the subject must have appropriate privilege.
*/
if (mac_lomac_contains_equal(new)) {
error = mac_lomac_subject_privileged(subj);
if (error)
return (error);
}
}
return (0);
}
static int
mac_lomac_check_vnode_rename_from(struct ucred *cred, struct vnode *dvp,
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
struct label *dvplabel, struct vnode *vp, struct label *vplabel,
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
struct componentname *cnp)
{
struct mac_lomac *subj, *obj;
if (!mac_lomac_enabled)
return (0);
Modify the MAC Framework so that instead of embedding a (struct label) in various kernel objects to represent security data, we embed a (struct label *) pointer, which now references labels allocated using a UMA zone (mac_label.c). This allows the size and shape of struct label to be varied without changing the size and shape of these kernel objects, which become part of the frozen ABI with 5-STABLE. This opens the door for boot-time selection of the number of label slots, and hence changes to the bound on the number of simultaneous labeled policies at boot-time instead of compile-time. This also makes it easier to embed label references in new objects as required for locking/caching with fine-grained network stack locking, such as inpcb structures. This change also moves us further in the direction of hiding the structure of kernel objects from MAC policy modules, not to mention dramatically reducing the number of '&' symbols appearing in both the MAC Framework and MAC policy modules, and improving readability. While this results in minimal performance change with MAC enabled, it will observably shrink the size of a number of critical kernel data structures for the !MAC case, and should have a small (but measurable) performance benefit (i.e., struct vnode, struct socket) do to memory conservation and reduced cost of zeroing memory. NOTE: Users of MAC must recompile their kernel and all MAC modules as a result of this change. Because this is an API change, third party MAC modules will also need to be updated to make less use of the '&' symbol. Suggestions from: bmilekic Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-11-12 03:14:31 +00:00
subj = SLOT(cred->cr_label);
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
obj = SLOT(dvplabel);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
if (!mac_lomac_subject_dominate(subj, obj))
return (EACCES);
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
obj = SLOT(vplabel);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
if (!mac_lomac_subject_dominate(subj, obj))
return (EACCES);
return (0);
}
static int
mac_lomac_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp,
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
struct label *dvplabel, struct vnode *vp, struct label *vplabel,
int samedir, struct componentname *cnp)
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
{
struct mac_lomac *subj, *obj;
if (!mac_lomac_enabled)
return (0);
Modify the MAC Framework so that instead of embedding a (struct label) in various kernel objects to represent security data, we embed a (struct label *) pointer, which now references labels allocated using a UMA zone (mac_label.c). This allows the size and shape of struct label to be varied without changing the size and shape of these kernel objects, which become part of the frozen ABI with 5-STABLE. This opens the door for boot-time selection of the number of label slots, and hence changes to the bound on the number of simultaneous labeled policies at boot-time instead of compile-time. This also makes it easier to embed label references in new objects as required for locking/caching with fine-grained network stack locking, such as inpcb structures. This change also moves us further in the direction of hiding the structure of kernel objects from MAC policy modules, not to mention dramatically reducing the number of '&' symbols appearing in both the MAC Framework and MAC policy modules, and improving readability. While this results in minimal performance change with MAC enabled, it will observably shrink the size of a number of critical kernel data structures for the !MAC case, and should have a small (but measurable) performance benefit (i.e., struct vnode, struct socket) do to memory conservation and reduced cost of zeroing memory. NOTE: Users of MAC must recompile their kernel and all MAC modules as a result of this change. Because this is an API change, third party MAC modules will also need to be updated to make less use of the '&' symbol. Suggestions from: bmilekic Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-11-12 03:14:31 +00:00
subj = SLOT(cred->cr_label);
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
obj = SLOT(dvplabel);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
if (!mac_lomac_subject_dominate(subj, obj))
return (EACCES);
if (vp != NULL) {
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
obj = SLOT(vplabel);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
if (!mac_lomac_subject_dominate(subj, obj))
return (EACCES);
}
return (0);
}
static int
mac_lomac_check_vnode_revoke(struct ucred *cred, struct vnode *vp,
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
struct label *vplabel)
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
{
struct mac_lomac *subj, *obj;
if (!mac_lomac_enabled)
return (0);
Modify the MAC Framework so that instead of embedding a (struct label) in various kernel objects to represent security data, we embed a (struct label *) pointer, which now references labels allocated using a UMA zone (mac_label.c). This allows the size and shape of struct label to be varied without changing the size and shape of these kernel objects, which become part of the frozen ABI with 5-STABLE. This opens the door for boot-time selection of the number of label slots, and hence changes to the bound on the number of simultaneous labeled policies at boot-time instead of compile-time. This also makes it easier to embed label references in new objects as required for locking/caching with fine-grained network stack locking, such as inpcb structures. This change also moves us further in the direction of hiding the structure of kernel objects from MAC policy modules, not to mention dramatically reducing the number of '&' symbols appearing in both the MAC Framework and MAC policy modules, and improving readability. While this results in minimal performance change with MAC enabled, it will observably shrink the size of a number of critical kernel data structures for the !MAC case, and should have a small (but measurable) performance benefit (i.e., struct vnode, struct socket) do to memory conservation and reduced cost of zeroing memory. NOTE: Users of MAC must recompile their kernel and all MAC modules as a result of this change. Because this is an API change, third party MAC modules will also need to be updated to make less use of the '&' symbol. Suggestions from: bmilekic Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-11-12 03:14:31 +00:00
subj = SLOT(cred->cr_label);
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
obj = SLOT(vplabel);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
if (!mac_lomac_subject_dominate(subj, obj))
return (EACCES);
return (0);
}
static int
mac_lomac_check_vnode_setacl(struct ucred *cred, struct vnode *vp,
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
struct label *vplabel, acl_type_t type, struct acl *acl)
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
{
struct mac_lomac *subj, *obj;
if (!mac_lomac_enabled)
return (0);
Modify the MAC Framework so that instead of embedding a (struct label) in various kernel objects to represent security data, we embed a (struct label *) pointer, which now references labels allocated using a UMA zone (mac_label.c). This allows the size and shape of struct label to be varied without changing the size and shape of these kernel objects, which become part of the frozen ABI with 5-STABLE. This opens the door for boot-time selection of the number of label slots, and hence changes to the bound on the number of simultaneous labeled policies at boot-time instead of compile-time. This also makes it easier to embed label references in new objects as required for locking/caching with fine-grained network stack locking, such as inpcb structures. This change also moves us further in the direction of hiding the structure of kernel objects from MAC policy modules, not to mention dramatically reducing the number of '&' symbols appearing in both the MAC Framework and MAC policy modules, and improving readability. While this results in minimal performance change with MAC enabled, it will observably shrink the size of a number of critical kernel data structures for the !MAC case, and should have a small (but measurable) performance benefit (i.e., struct vnode, struct socket) do to memory conservation and reduced cost of zeroing memory. NOTE: Users of MAC must recompile their kernel and all MAC modules as a result of this change. Because this is an API change, third party MAC modules will also need to be updated to make less use of the '&' symbol. Suggestions from: bmilekic Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-11-12 03:14:31 +00:00
subj = SLOT(cred->cr_label);
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
obj = SLOT(vplabel);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
if (!mac_lomac_subject_dominate(subj, obj))
return (EACCES);
return (0);
}
static int
mac_lomac_check_vnode_setextattr(struct ucred *cred, struct vnode *vp,
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
struct label *vplabel, int attrnamespace, const char *name,
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
struct uio *uio)
{
struct mac_lomac *subj, *obj;
if (!mac_lomac_enabled)
return (0);
Modify the MAC Framework so that instead of embedding a (struct label) in various kernel objects to represent security data, we embed a (struct label *) pointer, which now references labels allocated using a UMA zone (mac_label.c). This allows the size and shape of struct label to be varied without changing the size and shape of these kernel objects, which become part of the frozen ABI with 5-STABLE. This opens the door for boot-time selection of the number of label slots, and hence changes to the bound on the number of simultaneous labeled policies at boot-time instead of compile-time. This also makes it easier to embed label references in new objects as required for locking/caching with fine-grained network stack locking, such as inpcb structures. This change also moves us further in the direction of hiding the structure of kernel objects from MAC policy modules, not to mention dramatically reducing the number of '&' symbols appearing in both the MAC Framework and MAC policy modules, and improving readability. While this results in minimal performance change with MAC enabled, it will observably shrink the size of a number of critical kernel data structures for the !MAC case, and should have a small (but measurable) performance benefit (i.e., struct vnode, struct socket) do to memory conservation and reduced cost of zeroing memory. NOTE: Users of MAC must recompile their kernel and all MAC modules as a result of this change. Because this is an API change, third party MAC modules will also need to be updated to make less use of the '&' symbol. Suggestions from: bmilekic Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-11-12 03:14:31 +00:00
subj = SLOT(cred->cr_label);
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
obj = SLOT(vplabel);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
if (!mac_lomac_subject_dominate(subj, obj))
return (EACCES);
/* XXX: protect the MAC EA in a special way? */
return (0);
}
static int
mac_lomac_check_vnode_setflags(struct ucred *cred, struct vnode *vp,
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
struct label *vplabel, u_long flags)
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
{
struct mac_lomac *subj, *obj;
if (!mac_lomac_enabled)
return (0);
Modify the MAC Framework so that instead of embedding a (struct label) in various kernel objects to represent security data, we embed a (struct label *) pointer, which now references labels allocated using a UMA zone (mac_label.c). This allows the size and shape of struct label to be varied without changing the size and shape of these kernel objects, which become part of the frozen ABI with 5-STABLE. This opens the door for boot-time selection of the number of label slots, and hence changes to the bound on the number of simultaneous labeled policies at boot-time instead of compile-time. This also makes it easier to embed label references in new objects as required for locking/caching with fine-grained network stack locking, such as inpcb structures. This change also moves us further in the direction of hiding the structure of kernel objects from MAC policy modules, not to mention dramatically reducing the number of '&' symbols appearing in both the MAC Framework and MAC policy modules, and improving readability. While this results in minimal performance change with MAC enabled, it will observably shrink the size of a number of critical kernel data structures for the !MAC case, and should have a small (but measurable) performance benefit (i.e., struct vnode, struct socket) do to memory conservation and reduced cost of zeroing memory. NOTE: Users of MAC must recompile their kernel and all MAC modules as a result of this change. Because this is an API change, third party MAC modules will also need to be updated to make less use of the '&' symbol. Suggestions from: bmilekic Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-11-12 03:14:31 +00:00
subj = SLOT(cred->cr_label);
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
obj = SLOT(vplabel);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
if (!mac_lomac_subject_dominate(subj, obj))
return (EACCES);
return (0);
}
static int
mac_lomac_check_vnode_setmode(struct ucred *cred, struct vnode *vp,
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
struct label *vplabel, mode_t mode)
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
{
struct mac_lomac *subj, *obj;
if (!mac_lomac_enabled)
return (0);
Modify the MAC Framework so that instead of embedding a (struct label) in various kernel objects to represent security data, we embed a (struct label *) pointer, which now references labels allocated using a UMA zone (mac_label.c). This allows the size and shape of struct label to be varied without changing the size and shape of these kernel objects, which become part of the frozen ABI with 5-STABLE. This opens the door for boot-time selection of the number of label slots, and hence changes to the bound on the number of simultaneous labeled policies at boot-time instead of compile-time. This also makes it easier to embed label references in new objects as required for locking/caching with fine-grained network stack locking, such as inpcb structures. This change also moves us further in the direction of hiding the structure of kernel objects from MAC policy modules, not to mention dramatically reducing the number of '&' symbols appearing in both the MAC Framework and MAC policy modules, and improving readability. While this results in minimal performance change with MAC enabled, it will observably shrink the size of a number of critical kernel data structures for the !MAC case, and should have a small (but measurable) performance benefit (i.e., struct vnode, struct socket) do to memory conservation and reduced cost of zeroing memory. NOTE: Users of MAC must recompile their kernel and all MAC modules as a result of this change. Because this is an API change, third party MAC modules will also need to be updated to make less use of the '&' symbol. Suggestions from: bmilekic Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-11-12 03:14:31 +00:00
subj = SLOT(cred->cr_label);
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
obj = SLOT(vplabel);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
if (!mac_lomac_subject_dominate(subj, obj))
return (EACCES);
return (0);
}
static int
mac_lomac_check_vnode_setowner(struct ucred *cred, struct vnode *vp,
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
struct label *vplabel, uid_t uid, gid_t gid)
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
{
struct mac_lomac *subj, *obj;
if (!mac_lomac_enabled)
return (0);
Modify the MAC Framework so that instead of embedding a (struct label) in various kernel objects to represent security data, we embed a (struct label *) pointer, which now references labels allocated using a UMA zone (mac_label.c). This allows the size and shape of struct label to be varied without changing the size and shape of these kernel objects, which become part of the frozen ABI with 5-STABLE. This opens the door for boot-time selection of the number of label slots, and hence changes to the bound on the number of simultaneous labeled policies at boot-time instead of compile-time. This also makes it easier to embed label references in new objects as required for locking/caching with fine-grained network stack locking, such as inpcb structures. This change also moves us further in the direction of hiding the structure of kernel objects from MAC policy modules, not to mention dramatically reducing the number of '&' symbols appearing in both the MAC Framework and MAC policy modules, and improving readability. While this results in minimal performance change with MAC enabled, it will observably shrink the size of a number of critical kernel data structures for the !MAC case, and should have a small (but measurable) performance benefit (i.e., struct vnode, struct socket) do to memory conservation and reduced cost of zeroing memory. NOTE: Users of MAC must recompile their kernel and all MAC modules as a result of this change. Because this is an API change, third party MAC modules will also need to be updated to make less use of the '&' symbol. Suggestions from: bmilekic Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-11-12 03:14:31 +00:00
subj = SLOT(cred->cr_label);
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
obj = SLOT(vplabel);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
if (!mac_lomac_subject_dominate(subj, obj))
return (EACCES);
return (0);
}
static int
mac_lomac_check_vnode_setutimes(struct ucred *cred, struct vnode *vp,
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
struct label *vplabel, struct timespec atime, struct timespec mtime)
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
{
struct mac_lomac *subj, *obj;
if (!mac_lomac_enabled)
return (0);
Modify the MAC Framework so that instead of embedding a (struct label) in various kernel objects to represent security data, we embed a (struct label *) pointer, which now references labels allocated using a UMA zone (mac_label.c). This allows the size and shape of struct label to be varied without changing the size and shape of these kernel objects, which become part of the frozen ABI with 5-STABLE. This opens the door for boot-time selection of the number of label slots, and hence changes to the bound on the number of simultaneous labeled policies at boot-time instead of compile-time. This also makes it easier to embed label references in new objects as required for locking/caching with fine-grained network stack locking, such as inpcb structures. This change also moves us further in the direction of hiding the structure of kernel objects from MAC policy modules, not to mention dramatically reducing the number of '&' symbols appearing in both the MAC Framework and MAC policy modules, and improving readability. While this results in minimal performance change with MAC enabled, it will observably shrink the size of a number of critical kernel data structures for the !MAC case, and should have a small (but measurable) performance benefit (i.e., struct vnode, struct socket) do to memory conservation and reduced cost of zeroing memory. NOTE: Users of MAC must recompile their kernel and all MAC modules as a result of this change. Because this is an API change, third party MAC modules will also need to be updated to make less use of the '&' symbol. Suggestions from: bmilekic Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-11-12 03:14:31 +00:00
subj = SLOT(cred->cr_label);
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
obj = SLOT(vplabel);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
if (!mac_lomac_subject_dominate(subj, obj))
return (EACCES);
return (0);
}
static int
mac_lomac_check_vnode_write(struct ucred *active_cred,
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
struct ucred *file_cred, struct vnode *vp, struct label *vplabel)
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
{
struct mac_lomac *subj, *obj;
if (!mac_lomac_enabled || !revocation_enabled)
return (0);
Modify the MAC Framework so that instead of embedding a (struct label) in various kernel objects to represent security data, we embed a (struct label *) pointer, which now references labels allocated using a UMA zone (mac_label.c). This allows the size and shape of struct label to be varied without changing the size and shape of these kernel objects, which become part of the frozen ABI with 5-STABLE. This opens the door for boot-time selection of the number of label slots, and hence changes to the bound on the number of simultaneous labeled policies at boot-time instead of compile-time. This also makes it easier to embed label references in new objects as required for locking/caching with fine-grained network stack locking, such as inpcb structures. This change also moves us further in the direction of hiding the structure of kernel objects from MAC policy modules, not to mention dramatically reducing the number of '&' symbols appearing in both the MAC Framework and MAC policy modules, and improving readability. While this results in minimal performance change with MAC enabled, it will observably shrink the size of a number of critical kernel data structures for the !MAC case, and should have a small (but measurable) performance benefit (i.e., struct vnode, struct socket) do to memory conservation and reduced cost of zeroing memory. NOTE: Users of MAC must recompile their kernel and all MAC modules as a result of this change. Because this is an API change, third party MAC modules will also need to be updated to make less use of the '&' symbol. Suggestions from: bmilekic Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-11-12 03:14:31 +00:00
subj = SLOT(active_cred->cr_label);
Apply variable name normalization to MAC policies: adopt global conventions for the naming of variables associated with specific data structures. Obtained from: TrustedBSD Project
2007-04-23 13:15:23 +00:00
obj = SLOT(vplabel);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
if (!mac_lomac_subject_dominate(subj, obj))
return (EACCES);
return (0);
}
static void
mac_lomac_thread_userret(struct thread *td)
{
struct proc *p = td->td_proc;
Modify the MAC Framework so that instead of embedding a (struct label) in various kernel objects to represent security data, we embed a (struct label *) pointer, which now references labels allocated using a UMA zone (mac_label.c). This allows the size and shape of struct label to be varied without changing the size and shape of these kernel objects, which become part of the frozen ABI with 5-STABLE. This opens the door for boot-time selection of the number of label slots, and hence changes to the bound on the number of simultaneous labeled policies at boot-time instead of compile-time. This also makes it easier to embed label references in new objects as required for locking/caching with fine-grained network stack locking, such as inpcb structures. This change also moves us further in the direction of hiding the structure of kernel objects from MAC policy modules, not to mention dramatically reducing the number of '&' symbols appearing in both the MAC Framework and MAC policy modules, and improving readability. While this results in minimal performance change with MAC enabled, it will observably shrink the size of a number of critical kernel data structures for the !MAC case, and should have a small (but measurable) performance benefit (i.e., struct vnode, struct socket) do to memory conservation and reduced cost of zeroing memory. NOTE: Users of MAC must recompile their kernel and all MAC modules as a result of this change. Because this is an API change, third party MAC modules will also need to be updated to make less use of the '&' symbol. Suggestions from: bmilekic Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-11-12 03:14:31 +00:00
struct mac_lomac_proc *subj = PSLOT(p->p_label);
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
struct ucred *newcred, *oldcred;
int dodrop;
mtx_lock(&subj->mtx);
if (subj->mac_lomac.ml_flags & MAC_LOMAC_FLAG_UPDATE) {
dodrop = 0;
mtx_unlock(&subj->mtx);
newcred = crget();
/*
* Prevent a lock order reversal in
* mac_cred_mmapped_drop_perms; ideally, the other
* user of subj->mtx wouldn't be holding Giant.
*/
mtx_lock(&Giant);
PROC_LOCK(p);
mtx_lock(&subj->mtx);
/*
* Check if we lost the race while allocating the cred.
*/
if ((subj->mac_lomac.ml_flags & MAC_LOMAC_FLAG_UPDATE) == 0) {
crfree(newcred);
goto out;
}
oldcred = p->p_ucred;
crcopy(newcred, oldcred);
crhold(newcred);
Modify the MAC Framework so that instead of embedding a (struct label) in various kernel objects to represent security data, we embed a (struct label *) pointer, which now references labels allocated using a UMA zone (mac_label.c). This allows the size and shape of struct label to be varied without changing the size and shape of these kernel objects, which become part of the frozen ABI with 5-STABLE. This opens the door for boot-time selection of the number of label slots, and hence changes to the bound on the number of simultaneous labeled policies at boot-time instead of compile-time. This also makes it easier to embed label references in new objects as required for locking/caching with fine-grained network stack locking, such as inpcb structures. This change also moves us further in the direction of hiding the structure of kernel objects from MAC policy modules, not to mention dramatically reducing the number of '&' symbols appearing in both the MAC Framework and MAC policy modules, and improving readability. While this results in minimal performance change with MAC enabled, it will observably shrink the size of a number of critical kernel data structures for the !MAC case, and should have a small (but measurable) performance benefit (i.e., struct vnode, struct socket) do to memory conservation and reduced cost of zeroing memory. NOTE: Users of MAC must recompile their kernel and all MAC modules as a result of this change. Because this is an API change, third party MAC modules will also need to be updated to make less use of the '&' symbol. Suggestions from: bmilekic Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-11-12 03:14:31 +00:00
mac_lomac_copy(&subj->mac_lomac, SLOT(newcred->cr_label));
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
p->p_ucred = newcred;
crfree(oldcred);
dodrop = 1;
out:
mtx_unlock(&subj->mtx);
PROC_UNLOCK(p);
if (dodrop)
mac_cred_mmapped_drop_perms(curthread, newcred);
mtx_unlock(&Giant);
} else {
mtx_unlock(&subj->mtx);
}
}
static struct mac_policy_ops mac_lomac_ops =
{
.mpo_init = mac_lomac_init,
.mpo_init_bpfdesc_label = mac_lomac_init_label,
.mpo_init_cred_label = mac_lomac_init_label,
Rename mac*devfsdirent*() to mac*devfs*() to synchronize with SEDarwin, where similar data structures exist to support devfs and the MAC Framework, but are named differently. Obtained from: TrustedBSD Project Sponsored by: SPARTA, Inc.
2007-04-23 13:36:54 +00:00
.mpo_init_devfs_label = mac_lomac_init_label,
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
.mpo_init_ifnet_label = mac_lomac_init_label,
Teach the MAC policies which utilize mbuf labeling the new syncache entry points. Properly initialize the mbuf label based on the label we copy from the PCB. This fixes an LOR between the PCB and syncache code.
2006-12-13 06:03:22 +00:00
.mpo_init_syncache_label = mac_lomac_init_label_waitcheck,
Introduce a MAC label reference in 'struct inpcb', which caches the MAC label referenced from 'struct socket' in the IPv4 and IPv6-based protocols. This permits MAC labels to be checked during network delivery operations without dereferencing inp->inp_socket to get to so->so_label, which will eventually avoid our having to grab the socket lock during delivery at the network layer. This change introduces 'struct inpcb' as a labeled object to the MAC Framework, along with the normal circus of entry points: initialization, creation from socket, destruction, as well as a delivery access control check. For most policies, the inpcb label will simply be a cache of the socket label, so a new protocol switch method is introduced, pr_sosetlabel() to notify protocols that the socket layer label has been updated so that the cache can be updated while holding appropriate locks. Most protocols implement this using pru_sosetlabel_null(), but IPv4/IPv6 protocols using inpcbs use the the worker function in_pcbsosetlabel(), which calls into the MAC Framework to perform a cache update. Biba, LOMAC, and MLS implement these entry points, as do the stub policy, and test policy. Reviewed by: sam, bms Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-11-18 00:39:07 +00:00
.mpo_init_inpcb_label = mac_lomac_init_label_waitcheck,
Modify the mac_init_ipq() MAC Framework entry point to accept an additional flags argument to indicate blocking disposition, and pass in M_NOWAIT from the IP reassembly code to indicate that blocking is not OK when labeling a new IP fragment reassembly queue. This should eliminate some of the WITNESS warnings that have started popping up since fine-grained IP stack locking started going in; if memory allocation fails, the creation of the fragment queue will be aborted. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-03-26 15:12:03 +00:00
.mpo_init_ipq_label = mac_lomac_init_label_waitcheck,
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
.mpo_init_mbuf_label = mac_lomac_init_label_waitcheck,
.mpo_init_mount_label = mac_lomac_init_label,
.mpo_init_pipe_label = mac_lomac_init_label,
.mpo_init_proc_label = mac_lomac_init_proc_label,
.mpo_init_socket_label = mac_lomac_init_label_waitcheck,
.mpo_init_socket_peer_label = mac_lomac_init_label_waitcheck,
.mpo_init_vnode_label = mac_lomac_init_label,
Teach the MAC policies which utilize mbuf labeling the new syncache entry points. Properly initialize the mbuf label based on the label we copy from the PCB. This fixes an LOR between the PCB and syncache code.
2006-12-13 06:03:22 +00:00
.mpo_init_syncache_from_inpcb = mac_lomac_init_syncache_from_inpcb,
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
.mpo_destroy_bpfdesc_label = mac_lomac_destroy_label,
.mpo_destroy_cred_label = mac_lomac_destroy_label,
Rename mac*devfsdirent*() to mac*devfs*() to synchronize with SEDarwin, where similar data structures exist to support devfs and the MAC Framework, but are named differently. Obtained from: TrustedBSD Project Sponsored by: SPARTA, Inc.
2007-04-23 13:36:54 +00:00
.mpo_destroy_devfs_label = mac_lomac_destroy_label,
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
.mpo_destroy_ifnet_label = mac_lomac_destroy_label,
Introduce a MAC label reference in 'struct inpcb', which caches the MAC label referenced from 'struct socket' in the IPv4 and IPv6-based protocols. This permits MAC labels to be checked during network delivery operations without dereferencing inp->inp_socket to get to so->so_label, which will eventually avoid our having to grab the socket lock during delivery at the network layer. This change introduces 'struct inpcb' as a labeled object to the MAC Framework, along with the normal circus of entry points: initialization, creation from socket, destruction, as well as a delivery access control check. For most policies, the inpcb label will simply be a cache of the socket label, so a new protocol switch method is introduced, pr_sosetlabel() to notify protocols that the socket layer label has been updated so that the cache can be updated while holding appropriate locks. Most protocols implement this using pru_sosetlabel_null(), but IPv4/IPv6 protocols using inpcbs use the the worker function in_pcbsosetlabel(), which calls into the MAC Framework to perform a cache update. Biba, LOMAC, and MLS implement these entry points, as do the stub policy, and test policy. Reviewed by: sam, bms Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-11-18 00:39:07 +00:00
.mpo_destroy_inpcb_label = mac_lomac_destroy_label,
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
.mpo_destroy_ipq_label = mac_lomac_destroy_label,
.mpo_destroy_mbuf_label = mac_lomac_destroy_label,
.mpo_destroy_mount_label = mac_lomac_destroy_label,
.mpo_destroy_pipe_label = mac_lomac_destroy_label,
.mpo_destroy_proc_label = mac_lomac_destroy_proc_label,
Teach the MAC policies which utilize mbuf labeling the new syncache entry points. Properly initialize the mbuf label based on the label we copy from the PCB. This fixes an LOR between the PCB and syncache code.
2006-12-13 06:03:22 +00:00
.mpo_destroy_syncache_label = mac_lomac_destroy_label,
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
.mpo_destroy_socket_label = mac_lomac_destroy_label,
.mpo_destroy_socket_peer_label = mac_lomac_destroy_label,
.mpo_destroy_vnode_label = mac_lomac_destroy_label,
Rename mac_create_cred() MAC Framework entry point to mac_copy_cred(), and the mpo_create_cred() MAC policy entry point to mpo_copy_cred_label(). This is more consistent with similar entry points for creation and label copying, as mac_create_cred() was called from crdup() as opposed to during process creation. For a number of policies, this removes the requirement for special handling when copying credential labels, and improves consistency. Approved by: re (scottl) Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-12-06 21:48:03 +00:00
.mpo_copy_cred_label = mac_lomac_copy_label,
Introduce a temporary mutex, mac_ifnet_mtx, to lock MAC labels on network interfaces. This global mutex will protect all ifnet labels. Acquire the mutex across various MAC activities on interfaces, such as security checks, propagating interface labels to mbufs generated from the interface, retrieving and setting the interface label. Introduce mpo_copy_ifnet_label MAC policy entry point to copy the value of an interface label from one label to another. Use this to avoid performing a label externalize while holding mac_ifnet_mtx; copy the label to a temporary ifnet label and then externalize that. Implement mpo_copy_ifnet_label for various MAC policies that implement interface labeling using generic label copying routines. Obtained from: TrustedBSD Project Sponsored by: DARPA, McAfee Research
2004-06-24 03:34:46 +00:00
.mpo_copy_ifnet_label = mac_lomac_copy_label,
Also implement mpo_copy_mbuf_label() for mac_lomac, or labels may not be properly propagated across some mbuf copy operations. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-06-02 18:49:11 +00:00
.mpo_copy_mbuf_label = mac_lomac_copy_label,
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
.mpo_copy_pipe_label = mac_lomac_copy_label,
Implement sockets support for __mac_get_fd() and __mac_set_fd() system calls, and prefer these calls over getsockopt()/setsockopt() for ABI reasons. When addressing UNIX domain sockets, these calls retrieve and modify the socket label, not the label of the rendezvous vnode. - Create mac_copy_socket_label() entry point based on mac_copy_pipe_label() entry point, intended to copy the socket label into temporary storage that doesn't require a socket lock to be held (currently Giant). - Implement mac_copy_socket_label() for various policies. - Expose socket label allocation, free, internalize, externalize entry points as non-static from mac_net.c. - Use mac_socket_label_set() in __mac_set_fd(). MAC-aware applications may now use mac_get_fd(), mac_set_fd(), and mac_get_peer() to retrieve and set various socket labels without directly invoking the getsockopt() interface. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-11-16 23:31:45 +00:00
.mpo_copy_socket_label = mac_lomac_copy_label,
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
.mpo_copy_vnode_label = mac_lomac_copy_label,
.mpo_externalize_cred_label = mac_lomac_externalize_label,
.mpo_externalize_ifnet_label = mac_lomac_externalize_label,
.mpo_externalize_pipe_label = mac_lomac_externalize_label,
.mpo_externalize_socket_label = mac_lomac_externalize_label,
.mpo_externalize_socket_peer_label = mac_lomac_externalize_label,
.mpo_externalize_vnode_label = mac_lomac_externalize_label,
.mpo_internalize_cred_label = mac_lomac_internalize_label,
.mpo_internalize_ifnet_label = mac_lomac_internalize_label,
.mpo_internalize_pipe_label = mac_lomac_internalize_label,
.mpo_internalize_socket_label = mac_lomac_internalize_label,
.mpo_internalize_vnode_label = mac_lomac_internalize_label,
.mpo_create_devfs_device = mac_lomac_create_devfs_device,
.mpo_create_devfs_directory = mac_lomac_create_devfs_directory,
.mpo_create_devfs_symlink = mac_lomac_create_devfs_symlink,
.mpo_create_mount = mac_lomac_create_mount,
.mpo_relabel_vnode = mac_lomac_relabel_vnode,
Rename mac*devfsdirent*() to mac*devfs*() to synchronize with SEDarwin, where similar data structures exist to support devfs and the MAC Framework, but are named differently. Obtained from: TrustedBSD Project Sponsored by: SPARTA, Inc.
2007-04-23 13:36:54 +00:00
.mpo_update_devfs = mac_lomac_update_devfs,
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
.mpo_associate_vnode_devfs = mac_lomac_associate_vnode_devfs,
.mpo_associate_vnode_extattr = mac_lomac_associate_vnode_extattr,
.mpo_associate_vnode_singlelabel =
mac_lomac_associate_vnode_singlelabel,
.mpo_create_vnode_extattr = mac_lomac_create_vnode_extattr,
.mpo_setlabel_vnode_extattr = mac_lomac_setlabel_vnode_extattr,
.mpo_create_mbuf_from_socket = mac_lomac_create_mbuf_from_socket,
Teach the MAC policies which utilize mbuf labeling the new syncache entry points. Properly initialize the mbuf label based on the label we copy from the PCB. This fixes an LOR between the PCB and syncache code.
2006-12-13 06:03:22 +00:00
.mpo_create_mbuf_from_syncache = mac_lomac_create_mbuf_from_syncache,
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
.mpo_create_pipe = mac_lomac_create_pipe,
.mpo_create_socket = mac_lomac_create_socket,
.mpo_create_socket_from_socket = mac_lomac_create_socket_from_socket,
.mpo_relabel_pipe = mac_lomac_relabel_pipe,
.mpo_relabel_socket = mac_lomac_relabel_socket,
.mpo_set_socket_peer_from_mbuf = mac_lomac_set_socket_peer_from_mbuf,
.mpo_set_socket_peer_from_socket =
mac_lomac_set_socket_peer_from_socket,
.mpo_create_bpfdesc = mac_lomac_create_bpfdesc,
.mpo_create_datagram_from_ipq = mac_lomac_create_datagram_from_ipq,
.mpo_create_fragment = mac_lomac_create_fragment,
.mpo_create_ifnet = mac_lomac_create_ifnet,
Introduce a MAC label reference in 'struct inpcb', which caches the MAC label referenced from 'struct socket' in the IPv4 and IPv6-based protocols. This permits MAC labels to be checked during network delivery operations without dereferencing inp->inp_socket to get to so->so_label, which will eventually avoid our having to grab the socket lock during delivery at the network layer. This change introduces 'struct inpcb' as a labeled object to the MAC Framework, along with the normal circus of entry points: initialization, creation from socket, destruction, as well as a delivery access control check. For most policies, the inpcb label will simply be a cache of the socket label, so a new protocol switch method is introduced, pr_sosetlabel() to notify protocols that the socket layer label has been updated so that the cache can be updated while holding appropriate locks. Most protocols implement this using pru_sosetlabel_null(), but IPv4/IPv6 protocols using inpcbs use the the worker function in_pcbsosetlabel(), which calls into the MAC Framework to perform a cache update. Biba, LOMAC, and MLS implement these entry points, as do the stub policy, and test policy. Reviewed by: sam, bms Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-11-18 00:39:07 +00:00
.mpo_create_inpcb_from_socket = mac_lomac_create_inpcb_from_socket,
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
.mpo_create_ipq = mac_lomac_create_ipq,
Switch TCP over to using the inpcb label when responding in timed wait, rather than the socket label. This avoids reaching up to the socket layer during connection close, which requires locking changes. To do this, introduce MAC Framework entry point mac_create_mbuf_from_inpcb(), which is called from tcp_twrespond() instead of calling mac_create_mbuf_from_socket() or mac_create_mbuf_netlayer(). Introduce MAC Policy entry point mpo_create_mbuf_from_inpcb(), and implementations for various policies, which generally just copy label data from the inpcb to the mbuf. Assert the inpcb lock in the entry point since we require consistency for the inpcb label reference. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-12-17 14:55:11 +00:00
.mpo_create_mbuf_from_inpcb = mac_lomac_create_mbuf_from_inpcb,
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
.mpo_create_mbuf_linklayer = mac_lomac_create_mbuf_linklayer,
.mpo_create_mbuf_from_bpfdesc = mac_lomac_create_mbuf_from_bpfdesc,
.mpo_create_mbuf_from_ifnet = mac_lomac_create_mbuf_from_ifnet,
.mpo_create_mbuf_multicast_encap =
mac_lomac_create_mbuf_multicast_encap,
.mpo_create_mbuf_netlayer = mac_lomac_create_mbuf_netlayer,
.mpo_fragment_match = mac_lomac_fragment_match,
.mpo_relabel_ifnet = mac_lomac_relabel_ifnet,
.mpo_update_ipq = mac_lomac_update_ipq,
Introduce a MAC label reference in 'struct inpcb', which caches the MAC label referenced from 'struct socket' in the IPv4 and IPv6-based protocols. This permits MAC labels to be checked during network delivery operations without dereferencing inp->inp_socket to get to so->so_label, which will eventually avoid our having to grab the socket lock during delivery at the network layer. This change introduces 'struct inpcb' as a labeled object to the MAC Framework, along with the normal circus of entry points: initialization, creation from socket, destruction, as well as a delivery access control check. For most policies, the inpcb label will simply be a cache of the socket label, so a new protocol switch method is introduced, pr_sosetlabel() to notify protocols that the socket layer label has been updated so that the cache can be updated while holding appropriate locks. Most protocols implement this using pru_sosetlabel_null(), but IPv4/IPv6 protocols using inpcbs use the the worker function in_pcbsosetlabel(), which calls into the MAC Framework to perform a cache update. Biba, LOMAC, and MLS implement these entry points, as do the stub policy, and test policy. Reviewed by: sam, bms Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-11-18 00:39:07 +00:00
.mpo_inpcb_sosetlabel = mac_lomac_inpcb_sosetlabel,
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
.mpo_execve_transition = mac_lomac_execve_transition,
.mpo_execve_will_transition = mac_lomac_execve_will_transition,
.mpo_create_proc0 = mac_lomac_create_proc0,
.mpo_create_proc1 = mac_lomac_create_proc1,
.mpo_relabel_cred = mac_lomac_relabel_cred,
.mpo_check_bpfdesc_receive = mac_lomac_check_bpfdesc_receive,
.mpo_check_cred_relabel = mac_lomac_check_cred_relabel,
.mpo_check_cred_visible = mac_lomac_check_cred_visible,
.mpo_check_ifnet_relabel = mac_lomac_check_ifnet_relabel,
.mpo_check_ifnet_transmit = mac_lomac_check_ifnet_transmit,
Introduce a MAC label reference in 'struct inpcb', which caches the MAC label referenced from 'struct socket' in the IPv4 and IPv6-based protocols. This permits MAC labels to be checked during network delivery operations without dereferencing inp->inp_socket to get to so->so_label, which will eventually avoid our having to grab the socket lock during delivery at the network layer. This change introduces 'struct inpcb' as a labeled object to the MAC Framework, along with the normal circus of entry points: initialization, creation from socket, destruction, as well as a delivery access control check. For most policies, the inpcb label will simply be a cache of the socket label, so a new protocol switch method is introduced, pr_sosetlabel() to notify protocols that the socket layer label has been updated so that the cache can be updated while holding appropriate locks. Most protocols implement this using pru_sosetlabel_null(), but IPv4/IPv6 protocols using inpcbs use the the worker function in_pcbsosetlabel(), which calls into the MAC Framework to perform a cache update. Biba, LOMAC, and MLS implement these entry points, as do the stub policy, and test policy. Reviewed by: sam, bms Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-11-18 00:39:07 +00:00
.mpo_check_inpcb_deliver = mac_lomac_check_inpcb_deliver,
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
.mpo_check_kld_load = mac_lomac_check_kld_load,
.mpo_check_pipe_ioctl = mac_lomac_check_pipe_ioctl,
.mpo_check_pipe_read = mac_lomac_check_pipe_read,
.mpo_check_pipe_relabel = mac_lomac_check_pipe_relabel,
.mpo_check_pipe_write = mac_lomac_check_pipe_write,
.mpo_check_proc_debug = mac_lomac_check_proc_debug,
.mpo_check_proc_sched = mac_lomac_check_proc_sched,
.mpo_check_proc_signal = mac_lomac_check_proc_signal,
.mpo_check_socket_deliver = mac_lomac_check_socket_deliver,
.mpo_check_socket_relabel = mac_lomac_check_socket_relabel,
.mpo_check_socket_visible = mac_lomac_check_socket_visible,
Allow MAC policy modules to control access to audit configuration system calls. Add MAC Framework entry points and MAC policy entry points for audit(), auditctl(), auditon(), setaudit(), aud setauid(). MAC Framework entry points are only added for audit system calls where additional argument context may be useful for policy decision-making; other audit system calls without arguments may be controlled via the priv(9) entry points. Update various policy modules to implement audit-related checks, and in some cases, other missing system-related checks. Obtained from: TrustedBSD Project Sponsored by: SPARTA, Inc.
2007-04-21 22:08:48 +00:00
.mpo_check_system_acct = mac_lomac_check_system_acct,
.mpo_check_system_auditctl = mac_lomac_check_system_auditctl,
.mpo_check_system_swapoff = mac_lomac_check_system_swapoff,
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
.mpo_check_system_swapon = mac_lomac_check_system_swapon,
.mpo_check_system_sysctl = mac_lomac_check_system_sysctl,
.mpo_check_vnode_access = mac_lomac_check_vnode_open,
.mpo_check_vnode_create = mac_lomac_check_vnode_create,
.mpo_check_vnode_delete = mac_lomac_check_vnode_delete,
.mpo_check_vnode_deleteacl = mac_lomac_check_vnode_deleteacl,
.mpo_check_vnode_link = mac_lomac_check_vnode_link,
.mpo_check_vnode_mmap = mac_lomac_check_vnode_mmap,
.mpo_check_vnode_mmap_downgrade = mac_lomac_check_vnode_mmap_downgrade,
.mpo_check_vnode_open = mac_lomac_check_vnode_open,
.mpo_check_vnode_read = mac_lomac_check_vnode_read,
.mpo_check_vnode_relabel = mac_lomac_check_vnode_relabel,
.mpo_check_vnode_rename_from = mac_lomac_check_vnode_rename_from,
.mpo_check_vnode_rename_to = mac_lomac_check_vnode_rename_to,
.mpo_check_vnode_revoke = mac_lomac_check_vnode_revoke,
.mpo_check_vnode_setacl = mac_lomac_check_vnode_setacl,
.mpo_check_vnode_setextattr = mac_lomac_check_vnode_setextattr,
.mpo_check_vnode_setflags = mac_lomac_check_vnode_setflags,
.mpo_check_vnode_setmode = mac_lomac_check_vnode_setmode,
.mpo_check_vnode_setowner = mac_lomac_check_vnode_setowner,
.mpo_check_vnode_setutimes = mac_lomac_check_vnode_setutimes,
.mpo_check_vnode_write = mac_lomac_check_vnode_write,
.mpo_thread_userret = mac_lomac_thread_userret,
Introduce a new entry point, mac_create_mbuf_from_firewall. This entry point exists to allow the mandatory access control policy to properly initialize mbufs generated by the firewall. An example where this might happen is keep alive packets, or ICMP error packets in response to other packets. This takes care of kernel panics associated with un-initialize mbuf labels when the firewall generates packets. [1] I modified this patch from it's original version, the initial patch introduced a number of entry points which were programmatically equivalent. So I introduced only one. Instead, we should leverage mac_create_mbuf_netlayer() which is used for similar situations, an example being icmp_error() This will minimize the impact associated with the MFC Submitted by: mlaier [1] MFC after: 1 week This is a RELENG_6 candidate
2006-09-12 04:25:13 +00:00
.mpo_create_mbuf_from_firewall = mac_lomac_create_mbuf_from_firewall,
Remove MAC Framework access control check entry points made redundant with the introduction of priv(9) and MAC Framework entry points for privilege checking/granting. These entry points exactly aligned with privileges and provided no additional security context: - mac_check_sysarch_ioperm() - mac_check_kld_unload() - mac_check_settime() - mac_check_system_nfsd() Add mpo_priv_check() implementations to Biba and LOMAC policies, which, for each privilege, determine if they can be granted to processes considered unprivileged by those two policies. These mostly, but not entirely, align with the set of privileges granted in jails. Obtained from: TrustedBSD Project
2007-04-22 15:31:22 +00:00
.mpo_priv_check = mac_lomac_priv_check,
Import an implementation of LOMAC (Low-Watermark Mandatory Access Control) as a MAC Framework policy module. Unlike the existing src/sys/security/lomac implementation, this one has its fingers out of the kernel lock order and doesn't make use of flags in existing kernel structures. This greatly reduces the quantity of replicated code with src/sys/kern, simplifies the implementation (3000 vs 8500 lines), and correctes a number of known stability problems with the existing LOMAC implementation, which will be removed. A bit more hooking up to do here. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-26 17:26:06 +00:00
};
MAC_POLICY_SET(&mac_lomac_ops, mac_lomac, "TrustedBSD MAC/LOMAC",
Line-break sync to the MAC development branch.
2003-10-21 15:18:26 +00:00
MPC_LOADTIME_FLAG_NOTLATE | MPC_LOADTIME_FLAG_LABELMBUFS,
&mac_lomac_slot);
Reference in New Issue Copy Permalink