d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
65290832bd
freebsd-dev/sys/security/mac/mac_vfs.c

977 lines
21 KiB
C
Raw Normal View History

Stubs for the TrustedBSD MAC system calls to permit TrustedBSD MAC userland code to operate on kernel's from the main tree. Not much in this file yet. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 02:04:05 +00:00
/*-
* Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson
* Copyright (c) 2001 Ilmar S. Habibulin
Update NAI copyright to 2003, missed in earlier commits and merges.
2003-04-18 19:57:37 +00:00
* Copyright (c) 2001, 2002, 2003 Networks Associates Technology, Inc.
Stubs for the TrustedBSD MAC system calls to permit TrustedBSD MAC userland code to operate on kernel's from the main tree. Not much in this file yet. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 02:04:05 +00:00
* All rights reserved.
*
* This software was developed by Robert Watson and Ilmar Habibulin for the
* TrustedBSD Project.
*
License clarification and wording changes: NAI has approved removal of clause three, and NAI Labs now goes by the name Network Associates Laboratories.
2002-11-04 01:42:39 +00:00
* This software was developed for the FreeBSD Project in part by Network
* Associates Laboratories, the Security Research Division of Network
* Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"),
* as part of the DARPA CHATS research program.
Stubs for the TrustedBSD MAC system calls to permit TrustedBSD MAC userland code to operate on kernel's from the main tree. Not much in this file yet. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 02:04:05 +00:00
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*/
Use __FBSDID().
2003-06-11 00:56:59 +00:00
#include <sys/cdefs.h>
__FBSDID("$FreeBSD$");
Stubs for the TrustedBSD MAC system calls to permit TrustedBSD MAC userland code to operate on kernel's from the main tree. Not much in this file yet. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 02:04:05 +00:00
#include "opt_mac.h"
Remember to include "opt_devfs.h" so we get any relevant changes to NDEVFSINO before we include devfs.h. Spotted by: FlexeLint
2002-10-01 15:24:35 +00:00
#include "opt_devfs.h"
Include file cleanup; mac.h and malloc.h at one point had ordering relationship requirements, and no longer do. Reminded by: bde
2002-08-01 17:47:56 +00:00
Stubs for the TrustedBSD MAC system calls to permit TrustedBSD MAC userland code to operate on kernel's from the main tree. Not much in this file yet. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 02:04:05 +00:00
#include <sys/param.h>
Introduce a condition variable to avoid returning EBUSY when the MAC policy list is busy during a load or unload attempt. We assert no locks held during the cv wait, meaning we should be fairly deadlock-safe. Because of the cv model and busy count, it's possible for a cv waiter waiting for exclusive access to the policy list to be starved by active and long-lived access control/labeling events. For now, we accept that as a necessary tradeoff. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-13 15:47:09 +00:00
#include <sys/condvar.h>
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
#include <sys/extattr.h>
Bring in two sets of changes: (1) Permit userland applications to request a change of label atomic with an execve() via mac_execve(). This is required for the SEBSD port of SELinux/FLASK. Attempts to invoke this without MAC compiled in result in ENOSYS, as with all other MAC system calls. Complexity, if desired, is present in policy modules, rather than the framework. (2) Permit policies to have access to both the label of the vnode being executed as well as the interpreter if it's a shell script or related UNIX nonsense. Because we can't hold both vnode locks at the same time, cache the interpreter label. SEBSD relies on this because it supports secure transitioning via shell script executables. Other policies might want to take both labels into account during an integrity or confidentiality decision at execve()-time. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-05 17:51:56 +00:00
#include <sys/imgact.h>
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
#include <sys/kernel.h>
#include <sys/lock.h>
Include <sys/malloc.h> instead of depending on namespace pollution 2 layers deep in <sys/proc.h> or <sys/vnode.h>. Removed unused includes. Fixed some printf format errors (1 fatal on i386's; 1 fatal on alphas; 1 not fatal on any supported machine).
2002-09-05 07:02:43 +00:00
#include <sys/malloc.h>
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
#include <sys/mutex.h>
#include <sys/mac.h>
#include <sys/proc.h>
Redesign the externalization APIs from the MAC Framework to the MAC policy modules to improve robustness against C string bugs and vulnerabilities. Following these revisions, all string construction of labels for export to userspace (or elsewhere) is performed using the sbuf API, which prevents the consumer from having to perform laborious and intricate pointer and buffer checks. This substantially simplifies the externalization logic, both at the MAC Framework level, and in individual policies; this becomes especially useful when policies export more complex label data, such as with compartments in Biba and MLS. Bundled in here are some other minor fixes associated with externalization: including avoiding malloc while holding the process mutex in mac_lomac, and hence avoid a failure mode when printing labels during a downgrade operation due to the removal of the M_NOWAIT case. This has been running in the MAC development tree for about three weeks without problems. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-06-23 01:26:34 +00:00
#include <sys/sbuf.h>
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
#include <sys/systm.h>
#include <sys/vnode.h>
#include <sys/mount.h>
#include <sys/file.h>
#include <sys/namei.h>
#include <sys/sysctl.h>
#include <vm/vm.h>
#include <vm/pmap.h>
#include <vm/vm_map.h>
#include <vm/vm_object.h>
#include <sys/mac_policy.h>
#include <fs/devfs/devfs.h>
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
#include <security/mac/mac_internal.h>
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
Slightly change the semantics of vnode labels for MAC: rather than "refreshing" the label on the vnode before use, just get the label right from inception. For single-label file systems, set the label in the generic VFS getnewvnode() code; for multi-label file systems, leave the labeling up to the file system. With UFS1/2, this means reading the extended attribute during vfs_vget() as the inode is pulled off disk, rather than hitting the extended attributes frequently during operations later, improving performance. This also corrects sematics for shared vnode locks, which were not previously present in the system. This chances the cache coherrency properties WRT out-of-band access to label data, but in an acceptable form. With UFS1, there is a small race condition during automatic extended attribute start -- this is not present with UFS2, and occurs because EAs aren't available at vnode inception. We'll introduce a work around for this shortly. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-26 14:38:24 +00:00
/*
* Warn about EA transactions only the first time they happen.
* Weak coherency, no locking.
*/
static int ea_warn_once = 0;
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
static int mac_enforce_fs = 1;
SYSCTL_INT(_security_mac, OID_AUTO, enforce_fs, CTLFLAG_RW,
&mac_enforce_fs, 0, "Enforce MAC policy on file system objects");
TUNABLE_INT("security.mac.enforce_fs", &mac_enforce_fs);
Wrap maintenance of varios nmac{objectname} counters in MAC_DEBUG so we can avoid the cost of a large number of atomic operations if we're not interested in the object count statistics. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-08-16 14:21:38 +00:00
#ifdef MAC_DEBUG
Push 'security.mac.debug_label_fallback' behind options MAC_DEBUG. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-10-01 03:24:20 +00:00
static int mac_debug_label_fallback = 0;
SYSCTL_INT(_security_mac_debug, OID_AUTO, label_fallback, CTLFLAG_RW,
&mac_debug_label_fallback, 0, "Filesystems should fall back to fs label"
"when label is corrupted.");
TUNABLE_INT("security.mac.debug_label_fallback",
&mac_debug_label_fallback);
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
static unsigned int nmacmounts, nmacvnodes, nmacdevfsdirents;
Push the debugging obect label counters into security.mac.debug.counters rather than directly under security.mac.debug. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-05 16:30:53 +00:00
SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, mounts, CTLFLAG_RD,
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
&nmacmounts, 0, "number of mounts in use");
Push the debugging obect label counters into security.mac.debug.counters rather than directly under security.mac.debug. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-05 16:30:53 +00:00
SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, vnodes, CTLFLAG_RD,
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
&nmacvnodes, 0, "number of vnodes in use");
Push the debugging obect label counters into security.mac.debug.counters rather than directly under security.mac.debug. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-05 16:30:53 +00:00
SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, devfsdirents, CTLFLAG_RD,
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
&nmacdevfsdirents, 0, "number of devfs dirents inuse");
Wrap maintenance of varios nmac{objectname} counters in MAC_DEBUG so we can avoid the cost of a large number of atomic operations if we're not interested in the object count statistics. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-08-16 14:21:38 +00:00
#endif
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
Slightly change the semantics of vnode labels for MAC: rather than "refreshing" the label on the vnode before use, just get the label right from inception. For single-label file systems, set the label in the generic VFS getnewvnode() code; for multi-label file systems, leave the labeling up to the file system. With UFS1/2, this means reading the extended attribute during vfs_vget() as the inode is pulled off disk, rather than hitting the extended attributes frequently during operations later, improving performance. This also corrects sematics for shared vnode locks, which were not previously present in the system. This chances the cache coherrency properties WRT out-of-band access to label data, but in an acceptable form. With UFS1, there is a small race condition during automatic extended attribute start -- this is not present with UFS2, and occurs because EAs aren't available at vnode inception. We'll introduce a work around for this shortly. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-26 14:38:24 +00:00
static int mac_setlabel_vnode_extattr(struct ucred *cred,
struct vnode *vp, struct label *intlabel);
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
void
mac_init_devfsdirent(struct devfs_dirent *de)
Clean up locking for the MAC Framework: (1) Accept that we're now going to use mutexes, so don't attempt to avoid treating them as mutexes. This cleans up locking accessor function names some. (2) Rename variables to _mtx, _cv, _count, simplifying the naming. (3) Add a new form of the _busy() primitive that conditionally makes the list busy: if there are entries on the list, bump the busy count. If there are no entries, don't bump the busy count. Return a boolean indicating whether or not the busy count was bumped. (4) Break mac_policy_list into two lists: one with the same name holding dynamic policies, and a new list, mac_static_policy_list, which holds policies loaded before mac_late and without the unload flag set. The static list may be accessed without holding the busy count, since it can't change at run-time. (5) In general, prefer making the list busy conditionally, meaning we pay only one mutex lock per entry point if all modules are on the static list, rather than two (since we don't have to lower the busy count when we're done with the framework). For systems running just Biba or MLS, this will halve the mutex accesses in the network stack, and may offer a substantial performance benefits. (6) Lay the groundwork for a dynamic-free kernel option which eliminates all locking associated with dynamically loaded or unloaded policies, for pre-configured systems requiring maximum performance but less run-time flexibility. These changes have been running for a few weeks on MAC development branch systems. Approved by: re (jhb) Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-05-07 17:49:24 +00:00
{
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
mac_init_label(&de->de_label);
MAC_PERFORM(init_devfsdirent_label, &de->de_label);
MAC_DEBUG_COUNTER_INC(&nmacdevfsdirents);
Clean up locking for the MAC Framework: (1) Accept that we're now going to use mutexes, so don't attempt to avoid treating them as mutexes. This cleans up locking accessor function names some. (2) Rename variables to _mtx, _cv, _count, simplifying the naming. (3) Add a new form of the _busy() primitive that conditionally makes the list busy: if there are entries on the list, bump the busy count. If there are no entries, don't bump the busy count. Return a boolean indicating whether or not the busy count was bumped. (4) Break mac_policy_list into two lists: one with the same name holding dynamic policies, and a new list, mac_static_policy_list, which holds policies loaded before mac_late and without the unload flag set. The static list may be accessed without holding the busy count, since it can't change at run-time. (5) In general, prefer making the list busy conditionally, meaning we pay only one mutex lock per entry point if all modules are on the static list, rather than two (since we don't have to lower the busy count when we're done with the framework). For systems running just Biba or MLS, this will halve the mutex accesses in the network stack, and may offer a substantial performance benefits. (6) Lay the groundwork for a dynamic-free kernel option which eliminates all locking associated with dynamically loaded or unloaded policies, for pre-configured systems requiring maximum performance but less run-time flexibility. These changes have been running for a few weeks on MAC development branch systems. Approved by: re (jhb) Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-05-07 17:49:24 +00:00
}
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
void
mac_init_mount(struct mount *mp)
Clean up locking for the MAC Framework: (1) Accept that we're now going to use mutexes, so don't attempt to avoid treating them as mutexes. This cleans up locking accessor function names some. (2) Rename variables to _mtx, _cv, _count, simplifying the naming. (3) Add a new form of the _busy() primitive that conditionally makes the list busy: if there are entries on the list, bump the busy count. If there are no entries, don't bump the busy count. Return a boolean indicating whether or not the busy count was bumped. (4) Break mac_policy_list into two lists: one with the same name holding dynamic policies, and a new list, mac_static_policy_list, which holds policies loaded before mac_late and without the unload flag set. The static list may be accessed without holding the busy count, since it can't change at run-time. (5) In general, prefer making the list busy conditionally, meaning we pay only one mutex lock per entry point if all modules are on the static list, rather than two (since we don't have to lower the busy count when we're done with the framework). For systems running just Biba or MLS, this will halve the mutex accesses in the network stack, and may offer a substantial performance benefits. (6) Lay the groundwork for a dynamic-free kernel option which eliminates all locking associated with dynamically loaded or unloaded policies, for pre-configured systems requiring maximum performance but less run-time flexibility. These changes have been running for a few weeks on MAC development branch systems. Approved by: re (jhb) Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-05-07 17:49:24 +00:00
{
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
mac_init_label(&mp->mnt_mntlabel);
mac_init_label(&mp->mnt_fslabel);
MAC_PERFORM(init_mount_label, &mp->mnt_mntlabel);
MAC_PERFORM(init_mount_fs_label, &mp->mnt_fslabel);
MAC_DEBUG_COUNTER_INC(&nmacmounts);
Clean up locking for the MAC Framework: (1) Accept that we're now going to use mutexes, so don't attempt to avoid treating them as mutexes. This cleans up locking accessor function names some. (2) Rename variables to _mtx, _cv, _count, simplifying the naming. (3) Add a new form of the _busy() primitive that conditionally makes the list busy: if there are entries on the list, bump the busy count. If there are no entries, don't bump the busy count. Return a boolean indicating whether or not the busy count was bumped. (4) Break mac_policy_list into two lists: one with the same name holding dynamic policies, and a new list, mac_static_policy_list, which holds policies loaded before mac_late and without the unload flag set. The static list may be accessed without holding the busy count, since it can't change at run-time. (5) In general, prefer making the list busy conditionally, meaning we pay only one mutex lock per entry point if all modules are on the static list, rather than two (since we don't have to lower the busy count when we're done with the framework). For systems running just Biba or MLS, this will halve the mutex accesses in the network stack, and may offer a substantial performance benefits. (6) Lay the groundwork for a dynamic-free kernel option which eliminates all locking associated with dynamically loaded or unloaded policies, for pre-configured systems requiring maximum performance but less run-time flexibility. These changes have been running for a few weeks on MAC development branch systems. Approved by: re (jhb) Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-05-07 17:49:24 +00:00
}
Move MAC label storage for mbufs into m_tags from the m_pkthdr structure, returning some additional room in the first mbuf in a chain, and avoiding feature-specific contents in the mbuf header. To do this: - Modify mbuf_to_label() to extract the tag, returning NULL if not found. - Introduce mac_init_mbuf_tag() which does most of the work mac_init_mbuf() used to do, except on an m_tag rather than an mbuf. - Scale back mac_init_mbuf() to perform m_tag allocation and invoke mac_init_mbuf_tag(). - Replace mac_destroy_mbuf() with mac_destroy_mbuf_tag(), since m_tag's are now GC'd deep in the m_tag/mbuf code rather than at a higher level when mbufs are directly free()'d. - Add mac_copy_mbuf_tag() to support m_copy_pkthdr() and related notions. - Generally change all references to mbuf labels so that they use mbuf_to_label() rather than &mbuf->m_pkthdr.label. This required no changes in the MAC policies (yay!). - Tweak mbuf release routines to not call mac_destroy_mbuf(), tag destruction takes care of it for us now. - Remove MAC magic from m_copy_pkthdr() and m_move_pkthdr() -- the existing m_tag support does all this for us. Note that we can no longer just zero the m_tag list on the target mbuf, rather, we have to delete the chain because m_tag's will already be hung off freshly allocated mbuf's. - Tweak m_tag copying routines so that if we're copying a MAC m_tag, we don't do a binary copy, rather, we initialize the new storage and do a deep copy of the label. - Remove use of MAC_FLAG_INITIALIZED in a few bizarre places having to do with mbuf header copies previously. - When an mbuf is copied in ip_input(), we no longer need to explicitly copy the label because it will get handled by the m_tag code now. - No longer any weird handling of MAC labels in if_loop.c during header copies. - Add MPC_LOADTIME_FLAG_LABELMBUFS flag to Biba, MLS, mac_test. In mac_test, handle the label==NULL case, since it can be dynamically loaded. In order to improve performance with this change, introduce the notion of "lazy MAC label allocation" -- only allocate m_tag storage for MAC labels if we're running with a policy that uses MAC labels on mbufs. Policies declare this intent by setting the MPC_LOADTIME_FLAG_LABELMBUFS flag in their load-time flags field during declaration. Note: this opens up the possibility of post-boot policy modules getting back NULL slot entries even though they have policy invariants of non-NULL slot entries, as the policy might have been loaded after the mbuf was allocated, leaving the mbuf without label storage. Policies that cannot handle this case must be declared as NOTLATE, or must be modified. - mac_labelmbufs holds the current cumulative status as to whether any policies require mbuf labeling or not. This is updated whenever the active policy set changes by the function mac_policy_updateflags(). The function iterates the list and checks whether any have the flag set. Write access to this variable is protected by the policy list; read access is currently not protected for performance reasons. This might change if it causes problems. - Add MAC_POLICY_LIST_ASSERT_EXCLUSIVE() to permit the flags update function to assert appropriate locks. - This makes allocation in mac_init_mbuf() conditional on the flag. Reviewed by: sam Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-04-14 20:39:06 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
void
mac_init_vnode_label(struct label *label)
Clean up locking for the MAC Framework: (1) Accept that we're now going to use mutexes, so don't attempt to avoid treating them as mutexes. This cleans up locking accessor function names some. (2) Rename variables to _mtx, _cv, _count, simplifying the naming. (3) Add a new form of the _busy() primitive that conditionally makes the list busy: if there are entries on the list, bump the busy count. If there are no entries, don't bump the busy count. Return a boolean indicating whether or not the busy count was bumped. (4) Break mac_policy_list into two lists: one with the same name holding dynamic policies, and a new list, mac_static_policy_list, which holds policies loaded before mac_late and without the unload flag set. The static list may be accessed without holding the busy count, since it can't change at run-time. (5) In general, prefer making the list busy conditionally, meaning we pay only one mutex lock per entry point if all modules are on the static list, rather than two (since we don't have to lower the busy count when we're done with the framework). For systems running just Biba or MLS, this will halve the mutex accesses in the network stack, and may offer a substantial performance benefits. (6) Lay the groundwork for a dynamic-free kernel option which eliminates all locking associated with dynamically loaded or unloaded policies, for pre-configured systems requiring maximum performance but less run-time flexibility. These changes have been running for a few weeks on MAC development branch systems. Approved by: re (jhb) Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-05-07 17:49:24 +00:00
{
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
mac_init_label(label);
MAC_PERFORM(init_vnode_label, label);
MAC_DEBUG_COUNTER_INC(&nmacvnodes);
Clean up locking for the MAC Framework: (1) Accept that we're now going to use mutexes, so don't attempt to avoid treating them as mutexes. This cleans up locking accessor function names some. (2) Rename variables to _mtx, _cv, _count, simplifying the naming. (3) Add a new form of the _busy() primitive that conditionally makes the list busy: if there are entries on the list, bump the busy count. If there are no entries, don't bump the busy count. Return a boolean indicating whether or not the busy count was bumped. (4) Break mac_policy_list into two lists: one with the same name holding dynamic policies, and a new list, mac_static_policy_list, which holds policies loaded before mac_late and without the unload flag set. The static list may be accessed without holding the busy count, since it can't change at run-time. (5) In general, prefer making the list busy conditionally, meaning we pay only one mutex lock per entry point if all modules are on the static list, rather than two (since we don't have to lower the busy count when we're done with the framework). For systems running just Biba or MLS, this will halve the mutex accesses in the network stack, and may offer a substantial performance benefits. (6) Lay the groundwork for a dynamic-free kernel option which eliminates all locking associated with dynamically loaded or unloaded policies, for pre-configured systems requiring maximum performance but less run-time flexibility. These changes have been running for a few weeks on MAC development branch systems. Approved by: re (jhb) Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-05-07 17:49:24 +00:00
}
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
void
mac_init_vnode(struct vnode *vp)
Clean up locking for the MAC Framework: (1) Accept that we're now going to use mutexes, so don't attempt to avoid treating them as mutexes. This cleans up locking accessor function names some. (2) Rename variables to _mtx, _cv, _count, simplifying the naming. (3) Add a new form of the _busy() primitive that conditionally makes the list busy: if there are entries on the list, bump the busy count. If there are no entries, don't bump the busy count. Return a boolean indicating whether or not the busy count was bumped. (4) Break mac_policy_list into two lists: one with the same name holding dynamic policies, and a new list, mac_static_policy_list, which holds policies loaded before mac_late and without the unload flag set. The static list may be accessed without holding the busy count, since it can't change at run-time. (5) In general, prefer making the list busy conditionally, meaning we pay only one mutex lock per entry point if all modules are on the static list, rather than two (since we don't have to lower the busy count when we're done with the framework). For systems running just Biba or MLS, this will halve the mutex accesses in the network stack, and may offer a substantial performance benefits. (6) Lay the groundwork for a dynamic-free kernel option which eliminates all locking associated with dynamically loaded or unloaded policies, for pre-configured systems requiring maximum performance but less run-time flexibility. These changes have been running for a few weeks on MAC development branch systems. Approved by: re (jhb) Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-05-07 17:49:24 +00:00
{
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
mac_init_vnode_label(&vp->v_label);
Clean up locking for the MAC Framework: (1) Accept that we're now going to use mutexes, so don't attempt to avoid treating them as mutexes. This cleans up locking accessor function names some. (2) Rename variables to _mtx, _cv, _count, simplifying the naming. (3) Add a new form of the _busy() primitive that conditionally makes the list busy: if there are entries on the list, bump the busy count. If there are no entries, don't bump the busy count. Return a boolean indicating whether or not the busy count was bumped. (4) Break mac_policy_list into two lists: one with the same name holding dynamic policies, and a new list, mac_static_policy_list, which holds policies loaded before mac_late and without the unload flag set. The static list may be accessed without holding the busy count, since it can't change at run-time. (5) In general, prefer making the list busy conditionally, meaning we pay only one mutex lock per entry point if all modules are on the static list, rather than two (since we don't have to lower the busy count when we're done with the framework). For systems running just Biba or MLS, this will halve the mutex accesses in the network stack, and may offer a substantial performance benefits. (6) Lay the groundwork for a dynamic-free kernel option which eliminates all locking associated with dynamically loaded or unloaded policies, for pre-configured systems requiring maximum performance but less run-time flexibility. These changes have been running for a few weeks on MAC development branch systems. Approved by: re (jhb) Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-05-07 17:49:24 +00:00
}
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
void
mac_destroy_devfsdirent(struct devfs_dirent *de)
Clean up locking for the MAC Framework: (1) Accept that we're now going to use mutexes, so don't attempt to avoid treating them as mutexes. This cleans up locking accessor function names some. (2) Rename variables to _mtx, _cv, _count, simplifying the naming. (3) Add a new form of the _busy() primitive that conditionally makes the list busy: if there are entries on the list, bump the busy count. If there are no entries, don't bump the busy count. Return a boolean indicating whether or not the busy count was bumped. (4) Break mac_policy_list into two lists: one with the same name holding dynamic policies, and a new list, mac_static_policy_list, which holds policies loaded before mac_late and without the unload flag set. The static list may be accessed without holding the busy count, since it can't change at run-time. (5) In general, prefer making the list busy conditionally, meaning we pay only one mutex lock per entry point if all modules are on the static list, rather than two (since we don't have to lower the busy count when we're done with the framework). For systems running just Biba or MLS, this will halve the mutex accesses in the network stack, and may offer a substantial performance benefits. (6) Lay the groundwork for a dynamic-free kernel option which eliminates all locking associated with dynamically loaded or unloaded policies, for pre-configured systems requiring maximum performance but less run-time flexibility. These changes have been running for a few weeks on MAC development branch systems. Approved by: re (jhb) Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-05-07 17:49:24 +00:00
{
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
MAC_PERFORM(destroy_devfsdirent_label, &de->de_label);
mac_destroy_label(&de->de_label);
MAC_DEBUG_COUNTER_DEC(&nmacdevfsdirents);
Clean up locking for the MAC Framework: (1) Accept that we're now going to use mutexes, so don't attempt to avoid treating them as mutexes. This cleans up locking accessor function names some. (2) Rename variables to _mtx, _cv, _count, simplifying the naming. (3) Add a new form of the _busy() primitive that conditionally makes the list busy: if there are entries on the list, bump the busy count. If there are no entries, don't bump the busy count. Return a boolean indicating whether or not the busy count was bumped. (4) Break mac_policy_list into two lists: one with the same name holding dynamic policies, and a new list, mac_static_policy_list, which holds policies loaded before mac_late and without the unload flag set. The static list may be accessed without holding the busy count, since it can't change at run-time. (5) In general, prefer making the list busy conditionally, meaning we pay only one mutex lock per entry point if all modules are on the static list, rather than two (since we don't have to lower the busy count when we're done with the framework). For systems running just Biba or MLS, this will halve the mutex accesses in the network stack, and may offer a substantial performance benefits. (6) Lay the groundwork for a dynamic-free kernel option which eliminates all locking associated with dynamically loaded or unloaded policies, for pre-configured systems requiring maximum performance but less run-time flexibility. These changes have been running for a few weeks on MAC development branch systems. Approved by: re (jhb) Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-05-07 17:49:24 +00:00
}
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
void
mac_destroy_mount(struct mount *mp)
Clean up locking for the MAC Framework: (1) Accept that we're now going to use mutexes, so don't attempt to avoid treating them as mutexes. This cleans up locking accessor function names some. (2) Rename variables to _mtx, _cv, _count, simplifying the naming. (3) Add a new form of the _busy() primitive that conditionally makes the list busy: if there are entries on the list, bump the busy count. If there are no entries, don't bump the busy count. Return a boolean indicating whether or not the busy count was bumped. (4) Break mac_policy_list into two lists: one with the same name holding dynamic policies, and a new list, mac_static_policy_list, which holds policies loaded before mac_late and without the unload flag set. The static list may be accessed without holding the busy count, since it can't change at run-time. (5) In general, prefer making the list busy conditionally, meaning we pay only one mutex lock per entry point if all modules are on the static list, rather than two (since we don't have to lower the busy count when we're done with the framework). For systems running just Biba or MLS, this will halve the mutex accesses in the network stack, and may offer a substantial performance benefits. (6) Lay the groundwork for a dynamic-free kernel option which eliminates all locking associated with dynamically loaded or unloaded policies, for pre-configured systems requiring maximum performance but less run-time flexibility. These changes have been running for a few weeks on MAC development branch systems. Approved by: re (jhb) Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-05-07 17:49:24 +00:00
{
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
MAC_PERFORM(destroy_mount_label, &mp->mnt_mntlabel);
MAC_PERFORM(destroy_mount_fs_label, &mp->mnt_fslabel);
mac_destroy_label(&mp->mnt_fslabel);
mac_destroy_label(&mp->mnt_mntlabel);
MAC_DEBUG_COUNTER_DEC(&nmacmounts);
}
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
void
mac_destroy_vnode_label(struct label *label)
{
Support the new MAC user API in kernel: modify existing system calls to use a modified notion of 'struct mac', and flesh out the new variation system calls (almost identical to existing ones except that they permit a pid to be specified for process label retrieval, and don't follow symlinks). This generalizes the label API so that the framework is now almost entirely policy-agnostic. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-22 14:29:47 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
MAC_PERFORM(destroy_vnode_label, label);
mac_destroy_label(label);
MAC_DEBUG_COUNTER_DEC(&nmacvnodes);
}
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
void
mac_destroy_vnode(struct vnode *vp)
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
{
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
mac_destroy_vnode_label(&vp->v_label);
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
}
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
void
mac_copy_vnode_label(struct label *src, struct label *dest)
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
{
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
MAC_PERFORM(copy_vnode_label, src, dest);
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
}
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
int
mac_externalize_vnode_label(struct label *label, char *elements,
char *outbuf, size_t outbuflen, int flags)
Move MAC label storage for mbufs into m_tags from the m_pkthdr structure, returning some additional room in the first mbuf in a chain, and avoiding feature-specific contents in the mbuf header. To do this: - Modify mbuf_to_label() to extract the tag, returning NULL if not found. - Introduce mac_init_mbuf_tag() which does most of the work mac_init_mbuf() used to do, except on an m_tag rather than an mbuf. - Scale back mac_init_mbuf() to perform m_tag allocation and invoke mac_init_mbuf_tag(). - Replace mac_destroy_mbuf() with mac_destroy_mbuf_tag(), since m_tag's are now GC'd deep in the m_tag/mbuf code rather than at a higher level when mbufs are directly free()'d. - Add mac_copy_mbuf_tag() to support m_copy_pkthdr() and related notions. - Generally change all references to mbuf labels so that they use mbuf_to_label() rather than &mbuf->m_pkthdr.label. This required no changes in the MAC policies (yay!). - Tweak mbuf release routines to not call mac_destroy_mbuf(), tag destruction takes care of it for us now. - Remove MAC magic from m_copy_pkthdr() and m_move_pkthdr() -- the existing m_tag support does all this for us. Note that we can no longer just zero the m_tag list on the target mbuf, rather, we have to delete the chain because m_tag's will already be hung off freshly allocated mbuf's. - Tweak m_tag copying routines so that if we're copying a MAC m_tag, we don't do a binary copy, rather, we initialize the new storage and do a deep copy of the label. - Remove use of MAC_FLAG_INITIALIZED in a few bizarre places having to do with mbuf header copies previously. - When an mbuf is copied in ip_input(), we no longer need to explicitly copy the label because it will get handled by the m_tag code now. - No longer any weird handling of MAC labels in if_loop.c during header copies. - Add MPC_LOADTIME_FLAG_LABELMBUFS flag to Biba, MLS, mac_test. In mac_test, handle the label==NULL case, since it can be dynamically loaded. In order to improve performance with this change, introduce the notion of "lazy MAC label allocation" -- only allocate m_tag storage for MAC labels if we're running with a policy that uses MAC labels on mbufs. Policies declare this intent by setting the MPC_LOADTIME_FLAG_LABELMBUFS flag in their load-time flags field during declaration. Note: this opens up the possibility of post-boot policy modules getting back NULL slot entries even though they have policy invariants of non-NULL slot entries, as the policy might have been loaded after the mbuf was allocated, leaving the mbuf without label storage. Policies that cannot handle this case must be declared as NOTLATE, or must be modified. - mac_labelmbufs holds the current cumulative status as to whether any policies require mbuf labeling or not. This is updated whenever the active policy set changes by the function mac_policy_updateflags(). The function iterates the list and checks whether any have the flag set. Write access to this variable is protected by the policy list; read access is currently not protected for performance reasons. This might change if it causes problems. - Add MAC_POLICY_LIST_ASSERT_EXCLUSIVE() to permit the flags update function to assert appropriate locks. - This makes allocation in mac_init_mbuf() conditional on the flag. Reviewed by: sam Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-04-14 20:39:06 +00:00
{
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
int error;
Move MAC label storage for mbufs into m_tags from the m_pkthdr structure, returning some additional room in the first mbuf in a chain, and avoiding feature-specific contents in the mbuf header. To do this: - Modify mbuf_to_label() to extract the tag, returning NULL if not found. - Introduce mac_init_mbuf_tag() which does most of the work mac_init_mbuf() used to do, except on an m_tag rather than an mbuf. - Scale back mac_init_mbuf() to perform m_tag allocation and invoke mac_init_mbuf_tag(). - Replace mac_destroy_mbuf() with mac_destroy_mbuf_tag(), since m_tag's are now GC'd deep in the m_tag/mbuf code rather than at a higher level when mbufs are directly free()'d. - Add mac_copy_mbuf_tag() to support m_copy_pkthdr() and related notions. - Generally change all references to mbuf labels so that they use mbuf_to_label() rather than &mbuf->m_pkthdr.label. This required no changes in the MAC policies (yay!). - Tweak mbuf release routines to not call mac_destroy_mbuf(), tag destruction takes care of it for us now. - Remove MAC magic from m_copy_pkthdr() and m_move_pkthdr() -- the existing m_tag support does all this for us. Note that we can no longer just zero the m_tag list on the target mbuf, rather, we have to delete the chain because m_tag's will already be hung off freshly allocated mbuf's. - Tweak m_tag copying routines so that if we're copying a MAC m_tag, we don't do a binary copy, rather, we initialize the new storage and do a deep copy of the label. - Remove use of MAC_FLAG_INITIALIZED in a few bizarre places having to do with mbuf header copies previously. - When an mbuf is copied in ip_input(), we no longer need to explicitly copy the label because it will get handled by the m_tag code now. - No longer any weird handling of MAC labels in if_loop.c during header copies. - Add MPC_LOADTIME_FLAG_LABELMBUFS flag to Biba, MLS, mac_test. In mac_test, handle the label==NULL case, since it can be dynamically loaded. In order to improve performance with this change, introduce the notion of "lazy MAC label allocation" -- only allocate m_tag storage for MAC labels if we're running with a policy that uses MAC labels on mbufs. Policies declare this intent by setting the MPC_LOADTIME_FLAG_LABELMBUFS flag in their load-time flags field during declaration. Note: this opens up the possibility of post-boot policy modules getting back NULL slot entries even though they have policy invariants of non-NULL slot entries, as the policy might have been loaded after the mbuf was allocated, leaving the mbuf without label storage. Policies that cannot handle this case must be declared as NOTLATE, or must be modified. - mac_labelmbufs holds the current cumulative status as to whether any policies require mbuf labeling or not. This is updated whenever the active policy set changes by the function mac_policy_updateflags(). The function iterates the list and checks whether any have the flag set. Write access to this variable is protected by the policy list; read access is currently not protected for performance reasons. This might change if it causes problems. - Add MAC_POLICY_LIST_ASSERT_EXCLUSIVE() to permit the flags update function to assert appropriate locks. - This makes allocation in mac_init_mbuf() conditional on the flag. Reviewed by: sam Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-04-14 20:39:06 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
MAC_EXTERNALIZE(vnode_label, label, elements, outbuf, outbuflen);
Move MAC label storage for mbufs into m_tags from the m_pkthdr structure, returning some additional room in the first mbuf in a chain, and avoiding feature-specific contents in the mbuf header. To do this: - Modify mbuf_to_label() to extract the tag, returning NULL if not found. - Introduce mac_init_mbuf_tag() which does most of the work mac_init_mbuf() used to do, except on an m_tag rather than an mbuf. - Scale back mac_init_mbuf() to perform m_tag allocation and invoke mac_init_mbuf_tag(). - Replace mac_destroy_mbuf() with mac_destroy_mbuf_tag(), since m_tag's are now GC'd deep in the m_tag/mbuf code rather than at a higher level when mbufs are directly free()'d. - Add mac_copy_mbuf_tag() to support m_copy_pkthdr() and related notions. - Generally change all references to mbuf labels so that they use mbuf_to_label() rather than &mbuf->m_pkthdr.label. This required no changes in the MAC policies (yay!). - Tweak mbuf release routines to not call mac_destroy_mbuf(), tag destruction takes care of it for us now. - Remove MAC magic from m_copy_pkthdr() and m_move_pkthdr() -- the existing m_tag support does all this for us. Note that we can no longer just zero the m_tag list on the target mbuf, rather, we have to delete the chain because m_tag's will already be hung off freshly allocated mbuf's. - Tweak m_tag copying routines so that if we're copying a MAC m_tag, we don't do a binary copy, rather, we initialize the new storage and do a deep copy of the label. - Remove use of MAC_FLAG_INITIALIZED in a few bizarre places having to do with mbuf header copies previously. - When an mbuf is copied in ip_input(), we no longer need to explicitly copy the label because it will get handled by the m_tag code now. - No longer any weird handling of MAC labels in if_loop.c during header copies. - Add MPC_LOADTIME_FLAG_LABELMBUFS flag to Biba, MLS, mac_test. In mac_test, handle the label==NULL case, since it can be dynamically loaded. In order to improve performance with this change, introduce the notion of "lazy MAC label allocation" -- only allocate m_tag storage for MAC labels if we're running with a policy that uses MAC labels on mbufs. Policies declare this intent by setting the MPC_LOADTIME_FLAG_LABELMBUFS flag in their load-time flags field during declaration. Note: this opens up the possibility of post-boot policy modules getting back NULL slot entries even though they have policy invariants of non-NULL slot entries, as the policy might have been loaded after the mbuf was allocated, leaving the mbuf without label storage. Policies that cannot handle this case must be declared as NOTLATE, or must be modified. - mac_labelmbufs holds the current cumulative status as to whether any policies require mbuf labeling or not. This is updated whenever the active policy set changes by the function mac_policy_updateflags(). The function iterates the list and checks whether any have the flag set. Write access to this variable is protected by the policy list; read access is currently not protected for performance reasons. This might change if it causes problems. - Add MAC_POLICY_LIST_ASSERT_EXCLUSIVE() to permit the flags update function to assert appropriate locks. - This makes allocation in mac_init_mbuf() conditional on the flag. Reviewed by: sam Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-04-14 20:39:06 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
return (error);
Move MAC label storage for mbufs into m_tags from the m_pkthdr structure, returning some additional room in the first mbuf in a chain, and avoiding feature-specific contents in the mbuf header. To do this: - Modify mbuf_to_label() to extract the tag, returning NULL if not found. - Introduce mac_init_mbuf_tag() which does most of the work mac_init_mbuf() used to do, except on an m_tag rather than an mbuf. - Scale back mac_init_mbuf() to perform m_tag allocation and invoke mac_init_mbuf_tag(). - Replace mac_destroy_mbuf() with mac_destroy_mbuf_tag(), since m_tag's are now GC'd deep in the m_tag/mbuf code rather than at a higher level when mbufs are directly free()'d. - Add mac_copy_mbuf_tag() to support m_copy_pkthdr() and related notions. - Generally change all references to mbuf labels so that they use mbuf_to_label() rather than &mbuf->m_pkthdr.label. This required no changes in the MAC policies (yay!). - Tweak mbuf release routines to not call mac_destroy_mbuf(), tag destruction takes care of it for us now. - Remove MAC magic from m_copy_pkthdr() and m_move_pkthdr() -- the existing m_tag support does all this for us. Note that we can no longer just zero the m_tag list on the target mbuf, rather, we have to delete the chain because m_tag's will already be hung off freshly allocated mbuf's. - Tweak m_tag copying routines so that if we're copying a MAC m_tag, we don't do a binary copy, rather, we initialize the new storage and do a deep copy of the label. - Remove use of MAC_FLAG_INITIALIZED in a few bizarre places having to do with mbuf header copies previously. - When an mbuf is copied in ip_input(), we no longer need to explicitly copy the label because it will get handled by the m_tag code now. - No longer any weird handling of MAC labels in if_loop.c during header copies. - Add MPC_LOADTIME_FLAG_LABELMBUFS flag to Biba, MLS, mac_test. In mac_test, handle the label==NULL case, since it can be dynamically loaded. In order to improve performance with this change, introduce the notion of "lazy MAC label allocation" -- only allocate m_tag storage for MAC labels if we're running with a policy that uses MAC labels on mbufs. Policies declare this intent by setting the MPC_LOADTIME_FLAG_LABELMBUFS flag in their load-time flags field during declaration. Note: this opens up the possibility of post-boot policy modules getting back NULL slot entries even though they have policy invariants of non-NULL slot entries, as the policy might have been loaded after the mbuf was allocated, leaving the mbuf without label storage. Policies that cannot handle this case must be declared as NOTLATE, or must be modified. - mac_labelmbufs holds the current cumulative status as to whether any policies require mbuf labeling or not. This is updated whenever the active policy set changes by the function mac_policy_updateflags(). The function iterates the list and checks whether any have the flag set. Write access to this variable is protected by the policy list; read access is currently not protected for performance reasons. This might change if it causes problems. - Add MAC_POLICY_LIST_ASSERT_EXCLUSIVE() to permit the flags update function to assert appropriate locks. - This makes allocation in mac_init_mbuf() conditional on the flag. Reviewed by: sam Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-04-14 20:39:06 +00:00
}
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
int
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
mac_internalize_vnode_label(struct label *label, char *string)
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
{
int error;
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
MAC_INTERNALIZE(vnode_label, label, string);
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
return (error);
}
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
void
mac_update_devfsdirent(struct mount *mp, struct devfs_dirent *de,
struct vnode *vp)
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
{
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
MAC_PERFORM(update_devfsdirent, mp, de, &de->de_label, vp,
&vp->v_label);
}
Clean up locking for the MAC Framework: (1) Accept that we're now going to use mutexes, so don't attempt to avoid treating them as mutexes. This cleans up locking accessor function names some. (2) Rename variables to _mtx, _cv, _count, simplifying the naming. (3) Add a new form of the _busy() primitive that conditionally makes the list busy: if there are entries on the list, bump the busy count. If there are no entries, don't bump the busy count. Return a boolean indicating whether or not the busy count was bumped. (4) Break mac_policy_list into two lists: one with the same name holding dynamic policies, and a new list, mac_static_policy_list, which holds policies loaded before mac_late and without the unload flag set. The static list may be accessed without holding the busy count, since it can't change at run-time. (5) In general, prefer making the list busy conditionally, meaning we pay only one mutex lock per entry point if all modules are on the static list, rather than two (since we don't have to lower the busy count when we're done with the framework). For systems running just Biba or MLS, this will halve the mutex accesses in the network stack, and may offer a substantial performance benefits. (6) Lay the groundwork for a dynamic-free kernel option which eliminates all locking associated with dynamically loaded or unloaded policies, for pre-configured systems requiring maximum performance but less run-time flexibility. These changes have been running for a few weeks on MAC development branch systems. Approved by: re (jhb) Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-05-07 17:49:24 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
void
mac_associate_vnode_devfs(struct mount *mp, struct devfs_dirent *de,
struct vnode *vp)
{
Clean up locking for the MAC Framework: (1) Accept that we're now going to use mutexes, so don't attempt to avoid treating them as mutexes. This cleans up locking accessor function names some. (2) Rename variables to _mtx, _cv, _count, simplifying the naming. (3) Add a new form of the _busy() primitive that conditionally makes the list busy: if there are entries on the list, bump the busy count. If there are no entries, don't bump the busy count. Return a boolean indicating whether or not the busy count was bumped. (4) Break mac_policy_list into two lists: one with the same name holding dynamic policies, and a new list, mac_static_policy_list, which holds policies loaded before mac_late and without the unload flag set. The static list may be accessed without holding the busy count, since it can't change at run-time. (5) In general, prefer making the list busy conditionally, meaning we pay only one mutex lock per entry point if all modules are on the static list, rather than two (since we don't have to lower the busy count when we're done with the framework). For systems running just Biba or MLS, this will halve the mutex accesses in the network stack, and may offer a substantial performance benefits. (6) Lay the groundwork for a dynamic-free kernel option which eliminates all locking associated with dynamically loaded or unloaded policies, for pre-configured systems requiring maximum performance but less run-time flexibility. These changes have been running for a few weeks on MAC development branch systems. Approved by: re (jhb) Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-05-07 17:49:24 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
MAC_PERFORM(associate_vnode_devfs, mp, &mp->mnt_fslabel, de,
&de->de_label, vp, &vp->v_label);
}
Clean up locking for the MAC Framework: (1) Accept that we're now going to use mutexes, so don't attempt to avoid treating them as mutexes. This cleans up locking accessor function names some. (2) Rename variables to _mtx, _cv, _count, simplifying the naming. (3) Add a new form of the _busy() primitive that conditionally makes the list busy: if there are entries on the list, bump the busy count. If there are no entries, don't bump the busy count. Return a boolean indicating whether or not the busy count was bumped. (4) Break mac_policy_list into two lists: one with the same name holding dynamic policies, and a new list, mac_static_policy_list, which holds policies loaded before mac_late and without the unload flag set. The static list may be accessed without holding the busy count, since it can't change at run-time. (5) In general, prefer making the list busy conditionally, meaning we pay only one mutex lock per entry point if all modules are on the static list, rather than two (since we don't have to lower the busy count when we're done with the framework). For systems running just Biba or MLS, this will halve the mutex accesses in the network stack, and may offer a substantial performance benefits. (6) Lay the groundwork for a dynamic-free kernel option which eliminates all locking associated with dynamically loaded or unloaded policies, for pre-configured systems requiring maximum performance but less run-time flexibility. These changes have been running for a few weeks on MAC development branch systems. Approved by: re (jhb) Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-05-07 17:49:24 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
int
mac_associate_vnode_extattr(struct mount *mp, struct vnode *vp)
{
int error;
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
ASSERT_VOP_LOCKED(vp, "mac_associate_vnode_extattr");
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
MAC_CHECK(associate_vnode_extattr, mp, &mp->mnt_fslabel, vp,
&vp->v_label);
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
Clean up locking for the MAC Framework: (1) Accept that we're now going to use mutexes, so don't attempt to avoid treating them as mutexes. This cleans up locking accessor function names some. (2) Rename variables to _mtx, _cv, _count, simplifying the naming. (3) Add a new form of the _busy() primitive that conditionally makes the list busy: if there are entries on the list, bump the busy count. If there are no entries, don't bump the busy count. Return a boolean indicating whether or not the busy count was bumped. (4) Break mac_policy_list into two lists: one with the same name holding dynamic policies, and a new list, mac_static_policy_list, which holds policies loaded before mac_late and without the unload flag set. The static list may be accessed without holding the busy count, since it can't change at run-time. (5) In general, prefer making the list busy conditionally, meaning we pay only one mutex lock per entry point if all modules are on the static list, rather than two (since we don't have to lower the busy count when we're done with the framework). For systems running just Biba or MLS, this will halve the mutex accesses in the network stack, and may offer a substantial performance benefits. (6) Lay the groundwork for a dynamic-free kernel option which eliminates all locking associated with dynamically loaded or unloaded policies, for pre-configured systems requiring maximum performance but less run-time flexibility. These changes have been running for a few weeks on MAC development branch systems. Approved by: re (jhb) Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-05-07 17:49:24 +00:00
return (error);
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
}
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
void
mac_associate_vnode_singlelabel(struct mount *mp, struct vnode *vp)
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
{
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
MAC_PERFORM(associate_vnode_singlelabel, mp, &mp->mnt_fslabel, vp,
&vp->v_label);
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
}
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
int
mac_create_vnode_extattr(struct ucred *cred, struct mount *mp,
struct vnode *dvp, struct vnode *vp, struct componentname *cnp)
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
{
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
int error;
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
ASSERT_VOP_LOCKED(dvp, "mac_create_vnode_extattr");
ASSERT_VOP_LOCKED(vp, "mac_create_vnode_extattr");
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
error = VOP_OPENEXTATTR(vp, cred, curthread);
if (error == EOPNOTSUPP) {
/* XXX: Optionally abort if transactions not supported. */
if (ea_warn_once == 0) {
printf("Warning: transactions not supported "
"in EA write.\n");
ea_warn_once = 1;
}
} else if (error)
return (error);
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
MAC_CHECK(create_vnode_extattr, cred, mp, &mp->mnt_fslabel,
dvp, &dvp->v_label, vp, &vp->v_label, cnp);
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
if (error) {
VOP_CLOSEEXTATTR(vp, 0, NOCRED, curthread);
return (error);
}
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
error = VOP_CLOSEEXTATTR(vp, 1, NOCRED, curthread);
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
if (error == EOPNOTSUPP)
error = 0; /* XXX */
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
return (error);
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
}
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
static int
mac_setlabel_vnode_extattr(struct ucred *cred, struct vnode *vp,
struct label *intlabel)
Abstract access to the mbuf header label behind a new function, mbuf_to_label(). This permits the vast majority of entry point code to be unaware that labels are stored in m->m_pkthdr.label, such that we can experiment storage of labels elsewhere (such as in m_tags). Reviewed by: sam Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-04-14 18:11:18 +00:00
{
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
int error;
Abstract access to the mbuf header label behind a new function, mbuf_to_label(). This permits the vast majority of entry point code to be unaware that labels are stored in m->m_pkthdr.label, such that we can experiment storage of labels elsewhere (such as in m_tags). Reviewed by: sam Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-04-14 18:11:18 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
ASSERT_VOP_LOCKED(vp, "mac_setlabel_vnode_extattr");
Abstract access to the mbuf header label behind a new function, mbuf_to_label(). This permits the vast majority of entry point code to be unaware that labels are stored in m->m_pkthdr.label, such that we can experiment storage of labels elsewhere (such as in m_tags). Reviewed by: sam Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-04-14 18:11:18 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
error = VOP_OPENEXTATTR(vp, cred, curthread);
if (error == EOPNOTSUPP) {
/* XXX: Optionally abort if transactions not supported. */
if (ea_warn_once == 0) {
printf("Warning: transactions not supported "
"in EA write.\n");
ea_warn_once = 1;
}
} else if (error)
return (error);
Abstract access to the mbuf header label behind a new function, mbuf_to_label(). This permits the vast majority of entry point code to be unaware that labels are stored in m->m_pkthdr.label, such that we can experiment storage of labels elsewhere (such as in m_tags). Reviewed by: sam Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-04-14 18:11:18 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
MAC_CHECK(setlabel_vnode_extattr, cred, vp, &vp->v_label, intlabel);
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
if (error) {
VOP_CLOSEEXTATTR(vp, 0, NOCRED, curthread);
return (error);
}
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
error = VOP_CLOSEEXTATTR(vp, 1, NOCRED, curthread);
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
if (error == EOPNOTSUPP)
error = 0; /* XXX */
Move all object label init/destroy routines to the head of the entry points to better match the entry point ordering in mac_policy.h. Big diff, no functional change; merge from the MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-05 16:54:59 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
return (error);
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
}
void
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp,
struct label *interpvnodelabel, struct image_params *imgp)
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
{
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
ASSERT_VOP_LOCKED(vp, "mac_execve_transition");
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
if (!mac_enforce_process && !mac_enforce_fs)
return;
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label,
interpvnodelabel, imgp, imgp->execlabel);
Move all object label init/destroy routines to the head of the entry points to better match the entry point ordering in mac_policy.h. Big diff, no functional change; merge from the MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-05 16:54:59 +00:00
}
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
int
mac_execve_will_transition(struct ucred *old, struct vnode *vp,
struct label *interpvnodelabel, struct image_params *imgp)
Support the new MAC user API in kernel: modify existing system calls to use a modified notion of 'struct mac', and flesh out the new variation system calls (almost identical to existing ones except that they permit a pid to be specified for process label retrieval, and don't follow symlinks). This generalizes the label API so that the framework is now almost entirely policy-agnostic. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-22 14:29:47 +00:00
{
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
int result;
Support the new MAC user API in kernel: modify existing system calls to use a modified notion of 'struct mac', and flesh out the new variation system calls (almost identical to existing ones except that they permit a pid to be specified for process label retrieval, and don't follow symlinks). This generalizes the label API so that the framework is now almost entirely policy-agnostic. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-22 14:29:47 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
ASSERT_VOP_LOCKED(vp, "mac_execve_will_transition");
Support the new MAC user API in kernel: modify existing system calls to use a modified notion of 'struct mac', and flesh out the new variation system calls (almost identical to existing ones except that they permit a pid to be specified for process label retrieval, and don't follow symlinks). This generalizes the label API so that the framework is now almost entirely policy-agnostic. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-22 14:29:47 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
if (!mac_enforce_process && !mac_enforce_fs)
return (0);
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
result = 0;
MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label,
interpvnodelabel, imgp, imgp->execlabel);
return (result);
Move all object label init/destroy routines to the head of the entry points to better match the entry point ordering in mac_policy.h. Big diff, no functional change; merge from the MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-05 16:54:59 +00:00
}
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
int
mac_check_vnode_access(struct ucred *cred, struct vnode *vp, int acc_mode)
Move all object label init/destroy routines to the head of the entry points to better match the entry point ordering in mac_policy.h. Big diff, no functional change; merge from the MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-05 16:54:59 +00:00
{
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
int error;
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
ASSERT_VOP_LOCKED(vp, "mac_check_vnode_access");
Move all object label init/destroy routines to the head of the entry points to better match the entry point ordering in mac_policy.h. Big diff, no functional change; merge from the MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-05 16:54:59 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
if (!mac_enforce_fs)
return (0);
Support the new MAC user API in kernel: modify existing system calls to use a modified notion of 'struct mac', and flesh out the new variation system calls (almost identical to existing ones except that they permit a pid to be specified for process label retrieval, and don't follow symlinks). This generalizes the label API so that the framework is now almost entirely policy-agnostic. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-22 14:29:47 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
MAC_CHECK(check_vnode_access, cred, vp, &vp->v_label, acc_mode);
return (error);
Support the new MAC user API in kernel: modify existing system calls to use a modified notion of 'struct mac', and flesh out the new variation system calls (almost identical to existing ones except that they permit a pid to be specified for process label retrieval, and don't follow symlinks). This generalizes the label API so that the framework is now almost entirely policy-agnostic. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-22 14:29:47 +00:00
}
Modify the mac_init_ipq() MAC Framework entry point to accept an additional flags argument to indicate blocking disposition, and pass in M_NOWAIT from the IP reassembly code to indicate that blocking is not OK when labeling a new IP fragment reassembly queue. This should eliminate some of the WITNESS warnings that have started popping up since fine-grained IP stack locking started going in; if memory allocation fails, the creation of the fragment queue will be aborted. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-03-26 15:12:03 +00:00
int
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
mac_check_vnode_chdir(struct ucred *cred, struct vnode *dvp)
Move all object label init/destroy routines to the head of the entry points to better match the entry point ordering in mac_policy.h. Big diff, no functional change; merge from the MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-05 16:54:59 +00:00
{
Modify the mac_init_ipq() MAC Framework entry point to accept an additional flags argument to indicate blocking disposition, and pass in M_NOWAIT from the IP reassembly code to indicate that blocking is not OK when labeling a new IP fragment reassembly queue. This should eliminate some of the WITNESS warnings that have started popping up since fine-grained IP stack locking started going in; if memory allocation fails, the creation of the fragment queue will be aborted. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-03-26 15:12:03 +00:00
int error;
Move all object label init/destroy routines to the head of the entry points to better match the entry point ordering in mac_policy.h. Big diff, no functional change; merge from the MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-05 16:54:59 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_chdir");
Modify the mac_init_ipq() MAC Framework entry point to accept an additional flags argument to indicate blocking disposition, and pass in M_NOWAIT from the IP reassembly code to indicate that blocking is not OK when labeling a new IP fragment reassembly queue. This should eliminate some of the WITNESS warnings that have started popping up since fine-grained IP stack locking started going in; if memory allocation fails, the creation of the fragment queue will be aborted. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-03-26 15:12:03 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
if (!mac_enforce_fs)
return (0);
MAC_CHECK(check_vnode_chdir, cred, dvp, &dvp->v_label);
Modify the mac_init_ipq() MAC Framework entry point to accept an additional flags argument to indicate blocking disposition, and pass in M_NOWAIT from the IP reassembly code to indicate that blocking is not OK when labeling a new IP fragment reassembly queue. This should eliminate some of the WITNESS warnings that have started popping up since fine-grained IP stack locking started going in; if memory allocation fails, the creation of the fragment queue will be aborted. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-03-26 15:12:03 +00:00
return (error);
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
}
Rearrange object and label init/destroy functions to match the order used in mac_policy.h and elsewhere. Sort order is basically "by operation category", then "alphabetically by object". Sync to MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-05 17:38:45 +00:00
int
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
mac_check_vnode_chroot(struct ucred *cred, struct vnode *dvp)
Rearrange object and label init/destroy functions to match the order used in mac_policy.h and elsewhere. Sort order is basically "by operation category", then "alphabetically by object". Sync to MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-05 17:38:45 +00:00
{
mac_init_mbuf_tag() accepts malloc flags, not mbuf allocator flags, so don't try and convert the argument flags to malloc flags, or we risk implicitly requesting blocking and generating witness warnings. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-04-15 19:33:23 +00:00
int error;
Rearrange object and label init/destroy functions to match the order used in mac_policy.h and elsewhere. Sort order is basically "by operation category", then "alphabetically by object". Sync to MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-05 17:38:45 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_chroot");
Rearrange object and label init/destroy functions to match the order used in mac_policy.h and elsewhere. Sort order is basically "by operation category", then "alphabetically by object". Sync to MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-05 17:38:45 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
if (!mac_enforce_fs)
return (0);
MAC_CHECK(check_vnode_chroot, cred, dvp, &dvp->v_label);
While the MAC API has supported the ability to handle M_NOWAIT passed to mbuf label initialization, that functionality was never merged to the main tree. Go ahead and merge that functionality now. Note that this requires policy modules to accept the case where the label element may be destroyed even if init has not succeeded on it (in the event that policy failed the init). This will shortly also apply to sockets. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-05 17:44:49 +00:00
return (error);
Rearrange object and label init/destroy functions to match the order used in mac_policy.h and elsewhere. Sort order is basically "by operation category", then "alphabetically by object". Sync to MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-05 17:38:45 +00:00
}
Move MAC label storage for mbufs into m_tags from the m_pkthdr structure, returning some additional room in the first mbuf in a chain, and avoiding feature-specific contents in the mbuf header. To do this: - Modify mbuf_to_label() to extract the tag, returning NULL if not found. - Introduce mac_init_mbuf_tag() which does most of the work mac_init_mbuf() used to do, except on an m_tag rather than an mbuf. - Scale back mac_init_mbuf() to perform m_tag allocation and invoke mac_init_mbuf_tag(). - Replace mac_destroy_mbuf() with mac_destroy_mbuf_tag(), since m_tag's are now GC'd deep in the m_tag/mbuf code rather than at a higher level when mbufs are directly free()'d. - Add mac_copy_mbuf_tag() to support m_copy_pkthdr() and related notions. - Generally change all references to mbuf labels so that they use mbuf_to_label() rather than &mbuf->m_pkthdr.label. This required no changes in the MAC policies (yay!). - Tweak mbuf release routines to not call mac_destroy_mbuf(), tag destruction takes care of it for us now. - Remove MAC magic from m_copy_pkthdr() and m_move_pkthdr() -- the existing m_tag support does all this for us. Note that we can no longer just zero the m_tag list on the target mbuf, rather, we have to delete the chain because m_tag's will already be hung off freshly allocated mbuf's. - Tweak m_tag copying routines so that if we're copying a MAC m_tag, we don't do a binary copy, rather, we initialize the new storage and do a deep copy of the label. - Remove use of MAC_FLAG_INITIALIZED in a few bizarre places having to do with mbuf header copies previously. - When an mbuf is copied in ip_input(), we no longer need to explicitly copy the label because it will get handled by the m_tag code now. - No longer any weird handling of MAC labels in if_loop.c during header copies. - Add MPC_LOADTIME_FLAG_LABELMBUFS flag to Biba, MLS, mac_test. In mac_test, handle the label==NULL case, since it can be dynamically loaded. In order to improve performance with this change, introduce the notion of "lazy MAC label allocation" -- only allocate m_tag storage for MAC labels if we're running with a policy that uses MAC labels on mbufs. Policies declare this intent by setting the MPC_LOADTIME_FLAG_LABELMBUFS flag in their load-time flags field during declaration. Note: this opens up the possibility of post-boot policy modules getting back NULL slot entries even though they have policy invariants of non-NULL slot entries, as the policy might have been loaded after the mbuf was allocated, leaving the mbuf without label storage. Policies that cannot handle this case must be declared as NOTLATE, or must be modified. - mac_labelmbufs holds the current cumulative status as to whether any policies require mbuf labeling or not. This is updated whenever the active policy set changes by the function mac_policy_updateflags(). The function iterates the list and checks whether any have the flag set. Write access to this variable is protected by the policy list; read access is currently not protected for performance reasons. This might change if it causes problems. - Add MAC_POLICY_LIST_ASSERT_EXCLUSIVE() to permit the flags update function to assert appropriate locks. - This makes allocation in mac_init_mbuf() conditional on the flag. Reviewed by: sam Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-04-14 20:39:06 +00:00
int
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
mac_check_vnode_create(struct ucred *cred, struct vnode *dvp,
struct componentname *cnp, struct vattr *vap)
Move MAC label storage for mbufs into m_tags from the m_pkthdr structure, returning some additional room in the first mbuf in a chain, and avoiding feature-specific contents in the mbuf header. To do this: - Modify mbuf_to_label() to extract the tag, returning NULL if not found. - Introduce mac_init_mbuf_tag() which does most of the work mac_init_mbuf() used to do, except on an m_tag rather than an mbuf. - Scale back mac_init_mbuf() to perform m_tag allocation and invoke mac_init_mbuf_tag(). - Replace mac_destroy_mbuf() with mac_destroy_mbuf_tag(), since m_tag's are now GC'd deep in the m_tag/mbuf code rather than at a higher level when mbufs are directly free()'d. - Add mac_copy_mbuf_tag() to support m_copy_pkthdr() and related notions. - Generally change all references to mbuf labels so that they use mbuf_to_label() rather than &mbuf->m_pkthdr.label. This required no changes in the MAC policies (yay!). - Tweak mbuf release routines to not call mac_destroy_mbuf(), tag destruction takes care of it for us now. - Remove MAC magic from m_copy_pkthdr() and m_move_pkthdr() -- the existing m_tag support does all this for us. Note that we can no longer just zero the m_tag list on the target mbuf, rather, we have to delete the chain because m_tag's will already be hung off freshly allocated mbuf's. - Tweak m_tag copying routines so that if we're copying a MAC m_tag, we don't do a binary copy, rather, we initialize the new storage and do a deep copy of the label. - Remove use of MAC_FLAG_INITIALIZED in a few bizarre places having to do with mbuf header copies previously. - When an mbuf is copied in ip_input(), we no longer need to explicitly copy the label because it will get handled by the m_tag code now. - No longer any weird handling of MAC labels in if_loop.c during header copies. - Add MPC_LOADTIME_FLAG_LABELMBUFS flag to Biba, MLS, mac_test. In mac_test, handle the label==NULL case, since it can be dynamically loaded. In order to improve performance with this change, introduce the notion of "lazy MAC label allocation" -- only allocate m_tag storage for MAC labels if we're running with a policy that uses MAC labels on mbufs. Policies declare this intent by setting the MPC_LOADTIME_FLAG_LABELMBUFS flag in their load-time flags field during declaration. Note: this opens up the possibility of post-boot policy modules getting back NULL slot entries even though they have policy invariants of non-NULL slot entries, as the policy might have been loaded after the mbuf was allocated, leaving the mbuf without label storage. Policies that cannot handle this case must be declared as NOTLATE, or must be modified. - mac_labelmbufs holds the current cumulative status as to whether any policies require mbuf labeling or not. This is updated whenever the active policy set changes by the function mac_policy_updateflags(). The function iterates the list and checks whether any have the flag set. Write access to this variable is protected by the policy list; read access is currently not protected for performance reasons. This might change if it causes problems. - Add MAC_POLICY_LIST_ASSERT_EXCLUSIVE() to permit the flags update function to assert appropriate locks. - This makes allocation in mac_init_mbuf() conditional on the flag. Reviewed by: sam Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-04-14 20:39:06 +00:00
{
int error;
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_create");
Move MAC label storage for mbufs into m_tags from the m_pkthdr structure, returning some additional room in the first mbuf in a chain, and avoiding feature-specific contents in the mbuf header. To do this: - Modify mbuf_to_label() to extract the tag, returning NULL if not found. - Introduce mac_init_mbuf_tag() which does most of the work mac_init_mbuf() used to do, except on an m_tag rather than an mbuf. - Scale back mac_init_mbuf() to perform m_tag allocation and invoke mac_init_mbuf_tag(). - Replace mac_destroy_mbuf() with mac_destroy_mbuf_tag(), since m_tag's are now GC'd deep in the m_tag/mbuf code rather than at a higher level when mbufs are directly free()'d. - Add mac_copy_mbuf_tag() to support m_copy_pkthdr() and related notions. - Generally change all references to mbuf labels so that they use mbuf_to_label() rather than &mbuf->m_pkthdr.label. This required no changes in the MAC policies (yay!). - Tweak mbuf release routines to not call mac_destroy_mbuf(), tag destruction takes care of it for us now. - Remove MAC magic from m_copy_pkthdr() and m_move_pkthdr() -- the existing m_tag support does all this for us. Note that we can no longer just zero the m_tag list on the target mbuf, rather, we have to delete the chain because m_tag's will already be hung off freshly allocated mbuf's. - Tweak m_tag copying routines so that if we're copying a MAC m_tag, we don't do a binary copy, rather, we initialize the new storage and do a deep copy of the label. - Remove use of MAC_FLAG_INITIALIZED in a few bizarre places having to do with mbuf header copies previously. - When an mbuf is copied in ip_input(), we no longer need to explicitly copy the label because it will get handled by the m_tag code now. - No longer any weird handling of MAC labels in if_loop.c during header copies. - Add MPC_LOADTIME_FLAG_LABELMBUFS flag to Biba, MLS, mac_test. In mac_test, handle the label==NULL case, since it can be dynamically loaded. In order to improve performance with this change, introduce the notion of "lazy MAC label allocation" -- only allocate m_tag storage for MAC labels if we're running with a policy that uses MAC labels on mbufs. Policies declare this intent by setting the MPC_LOADTIME_FLAG_LABELMBUFS flag in their load-time flags field during declaration. Note: this opens up the possibility of post-boot policy modules getting back NULL slot entries even though they have policy invariants of non-NULL slot entries, as the policy might have been loaded after the mbuf was allocated, leaving the mbuf without label storage. Policies that cannot handle this case must be declared as NOTLATE, or must be modified. - mac_labelmbufs holds the current cumulative status as to whether any policies require mbuf labeling or not. This is updated whenever the active policy set changes by the function mac_policy_updateflags(). The function iterates the list and checks whether any have the flag set. Write access to this variable is protected by the policy list; read access is currently not protected for performance reasons. This might change if it causes problems. - Add MAC_POLICY_LIST_ASSERT_EXCLUSIVE() to permit the flags update function to assert appropriate locks. - This makes allocation in mac_init_mbuf() conditional on the flag. Reviewed by: sam Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-04-14 20:39:06 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
if (!mac_enforce_fs)
Attempt to simplify #ifdef logic for MAC_ALWAYS_LABEL_MBUF. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-08-01 15:45:14 +00:00
return (0);
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
MAC_CHECK(check_vnode_create, cred, dvp, &dvp->v_label, cnp, vap);
return (error);
Move MAC label storage for mbufs into m_tags from the m_pkthdr structure, returning some additional room in the first mbuf in a chain, and avoiding feature-specific contents in the mbuf header. To do this: - Modify mbuf_to_label() to extract the tag, returning NULL if not found. - Introduce mac_init_mbuf_tag() which does most of the work mac_init_mbuf() used to do, except on an m_tag rather than an mbuf. - Scale back mac_init_mbuf() to perform m_tag allocation and invoke mac_init_mbuf_tag(). - Replace mac_destroy_mbuf() with mac_destroy_mbuf_tag(), since m_tag's are now GC'd deep in the m_tag/mbuf code rather than at a higher level when mbufs are directly free()'d. - Add mac_copy_mbuf_tag() to support m_copy_pkthdr() and related notions. - Generally change all references to mbuf labels so that they use mbuf_to_label() rather than &mbuf->m_pkthdr.label. This required no changes in the MAC policies (yay!). - Tweak mbuf release routines to not call mac_destroy_mbuf(), tag destruction takes care of it for us now. - Remove MAC magic from m_copy_pkthdr() and m_move_pkthdr() -- the existing m_tag support does all this for us. Note that we can no longer just zero the m_tag list on the target mbuf, rather, we have to delete the chain because m_tag's will already be hung off freshly allocated mbuf's. - Tweak m_tag copying routines so that if we're copying a MAC m_tag, we don't do a binary copy, rather, we initialize the new storage and do a deep copy of the label. - Remove use of MAC_FLAG_INITIALIZED in a few bizarre places having to do with mbuf header copies previously. - When an mbuf is copied in ip_input(), we no longer need to explicitly copy the label because it will get handled by the m_tag code now. - No longer any weird handling of MAC labels in if_loop.c during header copies. - Add MPC_LOADTIME_FLAG_LABELMBUFS flag to Biba, MLS, mac_test. In mac_test, handle the label==NULL case, since it can be dynamically loaded. In order to improve performance with this change, introduce the notion of "lazy MAC label allocation" -- only allocate m_tag storage for MAC labels if we're running with a policy that uses MAC labels on mbufs. Policies declare this intent by setting the MPC_LOADTIME_FLAG_LABELMBUFS flag in their load-time flags field during declaration. Note: this opens up the possibility of post-boot policy modules getting back NULL slot entries even though they have policy invariants of non-NULL slot entries, as the policy might have been loaded after the mbuf was allocated, leaving the mbuf without label storage. Policies that cannot handle this case must be declared as NOTLATE, or must be modified. - mac_labelmbufs holds the current cumulative status as to whether any policies require mbuf labeling or not. This is updated whenever the active policy set changes by the function mac_policy_updateflags(). The function iterates the list and checks whether any have the flag set. Write access to this variable is protected by the policy list; read access is currently not protected for performance reasons. This might change if it causes problems. - Add MAC_POLICY_LIST_ASSERT_EXCLUSIVE() to permit the flags update function to assert appropriate locks. - This makes allocation in mac_init_mbuf() conditional on the flag. Reviewed by: sam Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-04-14 20:39:06 +00:00
}
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
int
mac_check_vnode_delete(struct ucred *cred, struct vnode *dvp, struct vnode *vp,
struct componentname *cnp)
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
{
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
int error;
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_delete");
ASSERT_VOP_LOCKED(vp, "mac_check_vnode_delete");
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
if (!mac_enforce_fs)
return (0);
Support the new MAC user API in kernel: modify existing system calls to use a modified notion of 'struct mac', and flesh out the new variation system calls (almost identical to existing ones except that they permit a pid to be specified for process label retrieval, and don't follow symlinks). This generalizes the label API so that the framework is now almost entirely policy-agnostic. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-22 14:29:47 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
MAC_CHECK(check_vnode_delete, cred, dvp, &dvp->v_label, vp,
&vp->v_label, cnp);
return (error);
Support the new MAC user API in kernel: modify existing system calls to use a modified notion of 'struct mac', and flesh out the new variation system calls (almost identical to existing ones except that they permit a pid to be specified for process label retrieval, and don't follow symlinks). This generalizes the label API so that the framework is now almost entirely policy-agnostic. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-22 14:29:47 +00:00
}
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
int
mac_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp,
acl_type_t type)
Move all object label init/destroy routines to the head of the entry points to better match the entry point ordering in mac_policy.h. Big diff, no functional change; merge from the MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-05 16:54:59 +00:00
{
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
int error;
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
ASSERT_VOP_LOCKED(vp, "mac_check_vnode_deleteacl");
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
if (!mac_enforce_fs)
return (0);
Introduce p_label, extensible security label storage for the MAC framework in struct proc. While the process label is actually stored in the struct ucred pointed to by p_ucred, there is a need for transient storage that may be used when asynchronous (deferred) updates need to be performed on the "real" label for locking reasons. Unlike other label storage, this label has no locking semantics, relying on policies to provide their own protection for the label contents, meaning that a policy leaf mutex may be used, avoiding lock order issues. This permits policies that act based on historical process behavior (such as audit policies, the MAC Framework port of LOMAC, etc) can update process properties even when many existing locks are held without violating the lock order. No currently committed policies implement use of this label storage. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-20 15:41:25 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
MAC_CHECK(check_vnode_deleteacl, cred, vp, &vp->v_label, type);
return (error);
Introduce p_label, extensible security label storage for the MAC framework in struct proc. While the process label is actually stored in the struct ucred pointed to by p_ucred, there is a need for transient storage that may be used when asynchronous (deferred) updates need to be performed on the "real" label for locking reasons. Unlike other label storage, this label has no locking semantics, relying on policies to provide their own protection for the label contents, meaning that a policy leaf mutex may be used, avoiding lock order issues. This permits policies that act based on historical process behavior (such as audit policies, the MAC Framework port of LOMAC, etc) can update process properties even when many existing locks are held without violating the lock order. No currently committed policies implement use of this label storage. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-20 15:41:25 +00:00
}
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
int
mac_check_vnode_deleteextattr(struct ucred *cred, struct vnode *vp,
int attrnamespace, const char *name)
Move all object label init/destroy routines to the head of the entry points to better match the entry point ordering in mac_policy.h. Big diff, no functional change; merge from the MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-05 16:54:59 +00:00
{
Modify label allocation semantics for sockets: pass in soalloc's malloc flags so that we can call malloc with M_NOWAIT if necessary, avoiding potential sleeps while holding mutexes in the TCP syncache code. Similar to the existing support for mbuf label allocation: if we can't allocate all the necessary label store in each policy, we back out the label allocation and fail the socket creation. Sync from MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-05 21:23:47 +00:00
int error;
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
ASSERT_VOP_LOCKED(vp, "mac_check_vnode_deleteextattr");
Modify label allocation semantics for sockets: pass in soalloc's malloc flags so that we can call malloc with M_NOWAIT if necessary, avoiding potential sleeps while holding mutexes in the TCP syncache code. Similar to the existing support for mbuf label allocation: if we can't allocate all the necessary label store in each policy, we back out the label allocation and fail the socket creation. Sync from MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-05 21:23:47 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
if (!mac_enforce_fs)
return (0);
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
MAC_CHECK(check_vnode_deleteextattr, cred, vp, &vp->v_label,
attrnamespace, name);
Modify label allocation semantics for sockets: pass in soalloc's malloc flags so that we can call malloc with M_NOWAIT if necessary, avoiding potential sleeps while holding mutexes in the TCP syncache code. Similar to the existing support for mbuf label allocation: if we can't allocate all the necessary label store in each policy, we back out the label allocation and fail the socket creation. Sync from MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-05 21:23:47 +00:00
return (error);
}
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
int
mac_check_vnode_exec(struct ucred *cred, struct vnode *vp,
struct image_params *imgp)
Modify label allocation semantics for sockets: pass in soalloc's malloc flags so that we can call malloc with M_NOWAIT if necessary, avoiding potential sleeps while holding mutexes in the TCP syncache code. Similar to the existing support for mbuf label allocation: if we can't allocate all the necessary label store in each policy, we back out the label allocation and fail the socket creation. Sync from MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-05 21:23:47 +00:00
{
int error;
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
ASSERT_VOP_LOCKED(vp, "mac_check_vnode_exec");
Modify label allocation semantics for sockets: pass in soalloc's malloc flags so that we can call malloc with M_NOWAIT if necessary, avoiding potential sleeps while holding mutexes in the TCP syncache code. Similar to the existing support for mbuf label allocation: if we can't allocate all the necessary label store in each policy, we back out the label allocation and fail the socket creation. Sync from MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-05 21:23:47 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
if (!mac_enforce_process && !mac_enforce_fs)
return (0);
MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label, imgp,
imgp->execlabel);
Modify label allocation semantics for sockets: pass in soalloc's malloc flags so that we can call malloc with M_NOWAIT if necessary, avoiding potential sleeps while holding mutexes in the TCP syncache code. Similar to the existing support for mbuf label allocation: if we can't allocate all the necessary label store in each policy, we back out the label allocation and fail the socket creation. Sync from MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-05 21:23:47 +00:00
return (error);
}
int
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
mac_check_vnode_getacl(struct ucred *cred, struct vnode *vp, acl_type_t type)
Modify label allocation semantics for sockets: pass in soalloc's malloc flags so that we can call malloc with M_NOWAIT if necessary, avoiding potential sleeps while holding mutexes in the TCP syncache code. Similar to the existing support for mbuf label allocation: if we can't allocate all the necessary label store in each policy, we back out the label allocation and fail the socket creation. Sync from MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-05 21:23:47 +00:00
{
int error;
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
ASSERT_VOP_LOCKED(vp, "mac_check_vnode_getacl");
Modify label allocation semantics for sockets: pass in soalloc's malloc flags so that we can call malloc with M_NOWAIT if necessary, avoiding potential sleeps while holding mutexes in the TCP syncache code. Similar to the existing support for mbuf label allocation: if we can't allocate all the necessary label store in each policy, we back out the label allocation and fail the socket creation. Sync from MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-05 21:23:47 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
if (!mac_enforce_fs)
return (0);
Modify label allocation semantics for sockets: pass in soalloc's malloc flags so that we can call malloc with M_NOWAIT if necessary, avoiding potential sleeps while holding mutexes in the TCP syncache code. Similar to the existing support for mbuf label allocation: if we can't allocate all the necessary label store in each policy, we back out the label allocation and fail the socket creation. Sync from MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-05 21:23:47 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
MAC_CHECK(check_vnode_getacl, cred, vp, &vp->v_label, type);
Modify label allocation semantics for sockets: pass in soalloc's malloc flags so that we can call malloc with M_NOWAIT if necessary, avoiding potential sleeps while holding mutexes in the TCP syncache code. Similar to the existing support for mbuf label allocation: if we can't allocate all the necessary label store in each policy, we back out the label allocation and fail the socket creation. Sync from MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-05 21:23:47 +00:00
return (error);
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
}
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
int
mac_check_vnode_getextattr(struct ucred *cred, struct vnode *vp,
int attrnamespace, const char *name, struct uio *uio)
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
{
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
int error;
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
ASSERT_VOP_LOCKED(vp, "mac_check_vnode_getextattr");
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
if (!mac_enforce_fs)
return (0);
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
MAC_CHECK(check_vnode_getextattr, cred, vp, &vp->v_label,
attrnamespace, name, uio);
return (error);
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
}
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
int
mac_check_vnode_link(struct ucred *cred, struct vnode *dvp,
struct vnode *vp, struct componentname *cnp)
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
{
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
int error;
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_link");
ASSERT_VOP_LOCKED(vp, "mac_check_vnode_link");
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
if (!mac_enforce_fs)
return (0);
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
MAC_CHECK(check_vnode_link, cred, dvp, &dvp->v_label, vp,
&vp->v_label, cnp);
return (error);
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
}
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
int
mac_check_vnode_listextattr(struct ucred *cred, struct vnode *vp,
int attrnamespace)
Support the new MAC user API in kernel: modify existing system calls to use a modified notion of 'struct mac', and flesh out the new variation system calls (almost identical to existing ones except that they permit a pid to be specified for process label retrieval, and don't follow symlinks). This generalizes the label API so that the framework is now almost entirely policy-agnostic. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-22 14:29:47 +00:00
{
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
int error;
Support the new MAC user API in kernel: modify existing system calls to use a modified notion of 'struct mac', and flesh out the new variation system calls (almost identical to existing ones except that they permit a pid to be specified for process label retrieval, and don't follow symlinks). This generalizes the label API so that the framework is now almost entirely policy-agnostic. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-22 14:29:47 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
ASSERT_VOP_LOCKED(vp, "mac_check_vnode_listextattr");
Support the new MAC user API in kernel: modify existing system calls to use a modified notion of 'struct mac', and flesh out the new variation system calls (almost identical to existing ones except that they permit a pid to be specified for process label retrieval, and don't follow symlinks). This generalizes the label API so that the framework is now almost entirely policy-agnostic. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-22 14:29:47 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
if (!mac_enforce_fs)
return (0);
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
MAC_CHECK(check_vnode_listextattr, cred, vp, &vp->v_label,
attrnamespace);
return (error);
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
}
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
int
mac_check_vnode_lookup(struct ucred *cred, struct vnode *dvp,
struct componentname *cnp)
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
{
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
int error;
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_lookup");
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
if (!mac_enforce_fs)
return (0);
Support the new MAC user API in kernel: modify existing system calls to use a modified notion of 'struct mac', and flesh out the new variation system calls (almost identical to existing ones except that they permit a pid to be specified for process label retrieval, and don't follow symlinks). This generalizes the label API so that the framework is now almost entirely policy-agnostic. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-22 14:29:47 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
MAC_CHECK(check_vnode_lookup, cred, dvp, &dvp->v_label, cnp);
return (error);
Support the new MAC user API in kernel: modify existing system calls to use a modified notion of 'struct mac', and flesh out the new variation system calls (almost identical to existing ones except that they permit a pid to be specified for process label retrieval, and don't follow symlinks). This generalizes the label API so that the framework is now almost entirely policy-agnostic. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-22 14:29:47 +00:00
}
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
int
mac_check_vnode_mmap(struct ucred *cred, struct vnode *vp, int prot)
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
{
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
int error;
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
ASSERT_VOP_LOCKED(vp, "mac_check_vnode_mmap");
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
if (!mac_enforce_fs || !mac_enforce_vm)
return (0);
Move MAC label storage for mbufs into m_tags from the m_pkthdr structure, returning some additional room in the first mbuf in a chain, and avoiding feature-specific contents in the mbuf header. To do this: - Modify mbuf_to_label() to extract the tag, returning NULL if not found. - Introduce mac_init_mbuf_tag() which does most of the work mac_init_mbuf() used to do, except on an m_tag rather than an mbuf. - Scale back mac_init_mbuf() to perform m_tag allocation and invoke mac_init_mbuf_tag(). - Replace mac_destroy_mbuf() with mac_destroy_mbuf_tag(), since m_tag's are now GC'd deep in the m_tag/mbuf code rather than at a higher level when mbufs are directly free()'d. - Add mac_copy_mbuf_tag() to support m_copy_pkthdr() and related notions. - Generally change all references to mbuf labels so that they use mbuf_to_label() rather than &mbuf->m_pkthdr.label. This required no changes in the MAC policies (yay!). - Tweak mbuf release routines to not call mac_destroy_mbuf(), tag destruction takes care of it for us now. - Remove MAC magic from m_copy_pkthdr() and m_move_pkthdr() -- the existing m_tag support does all this for us. Note that we can no longer just zero the m_tag list on the target mbuf, rather, we have to delete the chain because m_tag's will already be hung off freshly allocated mbuf's. - Tweak m_tag copying routines so that if we're copying a MAC m_tag, we don't do a binary copy, rather, we initialize the new storage and do a deep copy of the label. - Remove use of MAC_FLAG_INITIALIZED in a few bizarre places having to do with mbuf header copies previously. - When an mbuf is copied in ip_input(), we no longer need to explicitly copy the label because it will get handled by the m_tag code now. - No longer any weird handling of MAC labels in if_loop.c during header copies. - Add MPC_LOADTIME_FLAG_LABELMBUFS flag to Biba, MLS, mac_test. In mac_test, handle the label==NULL case, since it can be dynamically loaded. In order to improve performance with this change, introduce the notion of "lazy MAC label allocation" -- only allocate m_tag storage for MAC labels if we're running with a policy that uses MAC labels on mbufs. Policies declare this intent by setting the MPC_LOADTIME_FLAG_LABELMBUFS flag in their load-time flags field during declaration. Note: this opens up the possibility of post-boot policy modules getting back NULL slot entries even though they have policy invariants of non-NULL slot entries, as the policy might have been loaded after the mbuf was allocated, leaving the mbuf without label storage. Policies that cannot handle this case must be declared as NOTLATE, or must be modified. - mac_labelmbufs holds the current cumulative status as to whether any policies require mbuf labeling or not. This is updated whenever the active policy set changes by the function mac_policy_updateflags(). The function iterates the list and checks whether any have the flag set. Write access to this variable is protected by the policy list; read access is currently not protected for performance reasons. This might change if it causes problems. - Add MAC_POLICY_LIST_ASSERT_EXCLUSIVE() to permit the flags update function to assert appropriate locks. - This makes allocation in mac_init_mbuf() conditional on the flag. Reviewed by: sam Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-04-14 20:39:06 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
MAC_CHECK(check_vnode_mmap, cred, vp, &vp->v_label, prot);
return (error);
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
}
Rearrange object and label init/destroy functions to match the order used in mac_policy.h and elsewhere. Sort order is basically "by operation category", then "alphabetically by object". Sync to MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-05 17:38:45 +00:00
void
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
mac_check_vnode_mmap_downgrade(struct ucred *cred, struct vnode *vp, int *prot)
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
{
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
int result = *prot;
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
ASSERT_VOP_LOCKED(vp, "mac_check_vnode_mmap_downgrade");
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
if (!mac_enforce_fs || !mac_enforce_vm)
return;
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
MAC_PERFORM(check_vnode_mmap_downgrade, cred, vp, &vp->v_label,
&result);
Support the new MAC user API in kernel: modify existing system calls to use a modified notion of 'struct mac', and flesh out the new variation system calls (almost identical to existing ones except that they permit a pid to be specified for process label retrieval, and don't follow symlinks). This generalizes the label API so that the framework is now almost entirely policy-agnostic. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-22 14:29:47 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
*prot = result;
Support the new MAC user API in kernel: modify existing system calls to use a modified notion of 'struct mac', and flesh out the new variation system calls (almost identical to existing ones except that they permit a pid to be specified for process label retrieval, and don't follow symlinks). This generalizes the label API so that the framework is now almost entirely policy-agnostic. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-22 14:29:47 +00:00
}
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
int
mac_check_vnode_mprotect(struct ucred *cred, struct vnode *vp, int prot)
Introduce p_label, extensible security label storage for the MAC framework in struct proc. While the process label is actually stored in the struct ucred pointed to by p_ucred, there is a need for transient storage that may be used when asynchronous (deferred) updates need to be performed on the "real" label for locking reasons. Unlike other label storage, this label has no locking semantics, relying on policies to provide their own protection for the label contents, meaning that a policy leaf mutex may be used, avoiding lock order issues. This permits policies that act based on historical process behavior (such as audit policies, the MAC Framework port of LOMAC, etc) can update process properties even when many existing locks are held without violating the lock order. No currently committed policies implement use of this label storage. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-20 15:41:25 +00:00
{
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
int error;
Introduce p_label, extensible security label storage for the MAC framework in struct proc. While the process label is actually stored in the struct ucred pointed to by p_ucred, there is a need for transient storage that may be used when asynchronous (deferred) updates need to be performed on the "real" label for locking reasons. Unlike other label storage, this label has no locking semantics, relying on policies to provide their own protection for the label contents, meaning that a policy leaf mutex may be used, avoiding lock order issues. This permits policies that act based on historical process behavior (such as audit policies, the MAC Framework port of LOMAC, etc) can update process properties even when many existing locks are held without violating the lock order. No currently committed policies implement use of this label storage. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-20 15:41:25 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
ASSERT_VOP_LOCKED(vp, "mac_check_vnode_mprotect");
Introduce p_label, extensible security label storage for the MAC framework in struct proc. While the process label is actually stored in the struct ucred pointed to by p_ucred, there is a need for transient storage that may be used when asynchronous (deferred) updates need to be performed on the "real" label for locking reasons. Unlike other label storage, this label has no locking semantics, relying on policies to provide their own protection for the label contents, meaning that a policy leaf mutex may be used, avoiding lock order issues. This permits policies that act based on historical process behavior (such as audit policies, the MAC Framework port of LOMAC, etc) can update process properties even when many existing locks are held without violating the lock order. No currently committed policies implement use of this label storage. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-11-20 15:41:25 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
if (!mac_enforce_fs || !mac_enforce_vm)
return (0);
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
MAC_CHECK(check_vnode_mprotect, cred, vp, &vp->v_label, prot);
return (error);
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
}
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
int
mac_check_vnode_open(struct ucred *cred, struct vnode *vp, int acc_mode)
Modify label allocation semantics for sockets: pass in soalloc's malloc flags so that we can call malloc with M_NOWAIT if necessary, avoiding potential sleeps while holding mutexes in the TCP syncache code. Similar to the existing support for mbuf label allocation: if we can't allocate all the necessary label store in each policy, we back out the label allocation and fail the socket creation. Sync from MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-05 21:23:47 +00:00
{
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
int error;
Modify label allocation semantics for sockets: pass in soalloc's malloc flags so that we can call malloc with M_NOWAIT if necessary, avoiding potential sleeps while holding mutexes in the TCP syncache code. Similar to the existing support for mbuf label allocation: if we can't allocate all the necessary label store in each policy, we back out the label allocation and fail the socket creation. Sync from MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-05 21:23:47 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
ASSERT_VOP_LOCKED(vp, "mac_check_vnode_open");
Modify label allocation semantics for sockets: pass in soalloc's malloc flags so that we can call malloc with M_NOWAIT if necessary, avoiding potential sleeps while holding mutexes in the TCP syncache code. Similar to the existing support for mbuf label allocation: if we can't allocate all the necessary label store in each policy, we back out the label allocation and fail the socket creation. Sync from MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-05 21:23:47 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
if (!mac_enforce_fs)
return (0);
Modify label allocation semantics for sockets: pass in soalloc's malloc flags so that we can call malloc with M_NOWAIT if necessary, avoiding potential sleeps while holding mutexes in the TCP syncache code. Similar to the existing support for mbuf label allocation: if we can't allocate all the necessary label store in each policy, we back out the label allocation and fail the socket creation. Sync from MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-05 21:23:47 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
MAC_CHECK(check_vnode_open, cred, vp, &vp->v_label, acc_mode);
return (error);
Modify label allocation semantics for sockets: pass in soalloc's malloc flags so that we can call malloc with M_NOWAIT if necessary, avoiding potential sleeps while holding mutexes in the TCP syncache code. Similar to the existing support for mbuf label allocation: if we can't allocate all the necessary label store in each policy, we back out the label allocation and fail the socket creation. Sync from MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-05 21:23:47 +00:00
}
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
int
mac_check_vnode_poll(struct ucred *active_cred, struct ucred *file_cred,
struct vnode *vp)
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
{
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
int error;
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
ASSERT_VOP_LOCKED(vp, "mac_check_vnode_poll");
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
if (!mac_enforce_fs)
return (0);
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
MAC_CHECK(check_vnode_poll, active_cred, file_cred, vp,
&vp->v_label);
return (error);
Support the new MAC user API in kernel: modify existing system calls to use a modified notion of 'struct mac', and flesh out the new variation system calls (almost identical to existing ones except that they permit a pid to be specified for process label retrieval, and don't follow symlinks). This generalizes the label API so that the framework is now almost entirely policy-agnostic. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-22 14:29:47 +00:00
}
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
int
mac_check_vnode_read(struct ucred *active_cred, struct ucred *file_cred,
struct vnode *vp)
Move MAC label storage for mbufs into m_tags from the m_pkthdr structure, returning some additional room in the first mbuf in a chain, and avoiding feature-specific contents in the mbuf header. To do this: - Modify mbuf_to_label() to extract the tag, returning NULL if not found. - Introduce mac_init_mbuf_tag() which does most of the work mac_init_mbuf() used to do, except on an m_tag rather than an mbuf. - Scale back mac_init_mbuf() to perform m_tag allocation and invoke mac_init_mbuf_tag(). - Replace mac_destroy_mbuf() with mac_destroy_mbuf_tag(), since m_tag's are now GC'd deep in the m_tag/mbuf code rather than at a higher level when mbufs are directly free()'d. - Add mac_copy_mbuf_tag() to support m_copy_pkthdr() and related notions. - Generally change all references to mbuf labels so that they use mbuf_to_label() rather than &mbuf->m_pkthdr.label. This required no changes in the MAC policies (yay!). - Tweak mbuf release routines to not call mac_destroy_mbuf(), tag destruction takes care of it for us now. - Remove MAC magic from m_copy_pkthdr() and m_move_pkthdr() -- the existing m_tag support does all this for us. Note that we can no longer just zero the m_tag list on the target mbuf, rather, we have to delete the chain because m_tag's will already be hung off freshly allocated mbuf's. - Tweak m_tag copying routines so that if we're copying a MAC m_tag, we don't do a binary copy, rather, we initialize the new storage and do a deep copy of the label. - Remove use of MAC_FLAG_INITIALIZED in a few bizarre places having to do with mbuf header copies previously. - When an mbuf is copied in ip_input(), we no longer need to explicitly copy the label because it will get handled by the m_tag code now. - No longer any weird handling of MAC labels in if_loop.c during header copies. - Add MPC_LOADTIME_FLAG_LABELMBUFS flag to Biba, MLS, mac_test. In mac_test, handle the label==NULL case, since it can be dynamically loaded. In order to improve performance with this change, introduce the notion of "lazy MAC label allocation" -- only allocate m_tag storage for MAC labels if we're running with a policy that uses MAC labels on mbufs. Policies declare this intent by setting the MPC_LOADTIME_FLAG_LABELMBUFS flag in their load-time flags field during declaration. Note: this opens up the possibility of post-boot policy modules getting back NULL slot entries even though they have policy invariants of non-NULL slot entries, as the policy might have been loaded after the mbuf was allocated, leaving the mbuf without label storage. Policies that cannot handle this case must be declared as NOTLATE, or must be modified. - mac_labelmbufs holds the current cumulative status as to whether any policies require mbuf labeling or not. This is updated whenever the active policy set changes by the function mac_policy_updateflags(). The function iterates the list and checks whether any have the flag set. Write access to this variable is protected by the policy list; read access is currently not protected for performance reasons. This might change if it causes problems. - Add MAC_POLICY_LIST_ASSERT_EXCLUSIVE() to permit the flags update function to assert appropriate locks. - This makes allocation in mac_init_mbuf() conditional on the flag. Reviewed by: sam Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-04-14 20:39:06 +00:00
{
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
int error;
Move MAC label storage for mbufs into m_tags from the m_pkthdr structure, returning some additional room in the first mbuf in a chain, and avoiding feature-specific contents in the mbuf header. To do this: - Modify mbuf_to_label() to extract the tag, returning NULL if not found. - Introduce mac_init_mbuf_tag() which does most of the work mac_init_mbuf() used to do, except on an m_tag rather than an mbuf. - Scale back mac_init_mbuf() to perform m_tag allocation and invoke mac_init_mbuf_tag(). - Replace mac_destroy_mbuf() with mac_destroy_mbuf_tag(), since m_tag's are now GC'd deep in the m_tag/mbuf code rather than at a higher level when mbufs are directly free()'d. - Add mac_copy_mbuf_tag() to support m_copy_pkthdr() and related notions. - Generally change all references to mbuf labels so that they use mbuf_to_label() rather than &mbuf->m_pkthdr.label. This required no changes in the MAC policies (yay!). - Tweak mbuf release routines to not call mac_destroy_mbuf(), tag destruction takes care of it for us now. - Remove MAC magic from m_copy_pkthdr() and m_move_pkthdr() -- the existing m_tag support does all this for us. Note that we can no longer just zero the m_tag list on the target mbuf, rather, we have to delete the chain because m_tag's will already be hung off freshly allocated mbuf's. - Tweak m_tag copying routines so that if we're copying a MAC m_tag, we don't do a binary copy, rather, we initialize the new storage and do a deep copy of the label. - Remove use of MAC_FLAG_INITIALIZED in a few bizarre places having to do with mbuf header copies previously. - When an mbuf is copied in ip_input(), we no longer need to explicitly copy the label because it will get handled by the m_tag code now. - No longer any weird handling of MAC labels in if_loop.c during header copies. - Add MPC_LOADTIME_FLAG_LABELMBUFS flag to Biba, MLS, mac_test. In mac_test, handle the label==NULL case, since it can be dynamically loaded. In order to improve performance with this change, introduce the notion of "lazy MAC label allocation" -- only allocate m_tag storage for MAC labels if we're running with a policy that uses MAC labels on mbufs. Policies declare this intent by setting the MPC_LOADTIME_FLAG_LABELMBUFS flag in their load-time flags field during declaration. Note: this opens up the possibility of post-boot policy modules getting back NULL slot entries even though they have policy invariants of non-NULL slot entries, as the policy might have been loaded after the mbuf was allocated, leaving the mbuf without label storage. Policies that cannot handle this case must be declared as NOTLATE, or must be modified. - mac_labelmbufs holds the current cumulative status as to whether any policies require mbuf labeling or not. This is updated whenever the active policy set changes by the function mac_policy_updateflags(). The function iterates the list and checks whether any have the flag set. Write access to this variable is protected by the policy list; read access is currently not protected for performance reasons. This might change if it causes problems. - Add MAC_POLICY_LIST_ASSERT_EXCLUSIVE() to permit the flags update function to assert appropriate locks. - This makes allocation in mac_init_mbuf() conditional on the flag. Reviewed by: sam Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-04-14 20:39:06 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
ASSERT_VOP_LOCKED(vp, "mac_check_vnode_read");
Move MAC label storage for mbufs into m_tags from the m_pkthdr structure, returning some additional room in the first mbuf in a chain, and avoiding feature-specific contents in the mbuf header. To do this: - Modify mbuf_to_label() to extract the tag, returning NULL if not found. - Introduce mac_init_mbuf_tag() which does most of the work mac_init_mbuf() used to do, except on an m_tag rather than an mbuf. - Scale back mac_init_mbuf() to perform m_tag allocation and invoke mac_init_mbuf_tag(). - Replace mac_destroy_mbuf() with mac_destroy_mbuf_tag(), since m_tag's are now GC'd deep in the m_tag/mbuf code rather than at a higher level when mbufs are directly free()'d. - Add mac_copy_mbuf_tag() to support m_copy_pkthdr() and related notions. - Generally change all references to mbuf labels so that they use mbuf_to_label() rather than &mbuf->m_pkthdr.label. This required no changes in the MAC policies (yay!). - Tweak mbuf release routines to not call mac_destroy_mbuf(), tag destruction takes care of it for us now. - Remove MAC magic from m_copy_pkthdr() and m_move_pkthdr() -- the existing m_tag support does all this for us. Note that we can no longer just zero the m_tag list on the target mbuf, rather, we have to delete the chain because m_tag's will already be hung off freshly allocated mbuf's. - Tweak m_tag copying routines so that if we're copying a MAC m_tag, we don't do a binary copy, rather, we initialize the new storage and do a deep copy of the label. - Remove use of MAC_FLAG_INITIALIZED in a few bizarre places having to do with mbuf header copies previously. - When an mbuf is copied in ip_input(), we no longer need to explicitly copy the label because it will get handled by the m_tag code now. - No longer any weird handling of MAC labels in if_loop.c during header copies. - Add MPC_LOADTIME_FLAG_LABELMBUFS flag to Biba, MLS, mac_test. In mac_test, handle the label==NULL case, since it can be dynamically loaded. In order to improve performance with this change, introduce the notion of "lazy MAC label allocation" -- only allocate m_tag storage for MAC labels if we're running with a policy that uses MAC labels on mbufs. Policies declare this intent by setting the MPC_LOADTIME_FLAG_LABELMBUFS flag in their load-time flags field during declaration. Note: this opens up the possibility of post-boot policy modules getting back NULL slot entries even though they have policy invariants of non-NULL slot entries, as the policy might have been loaded after the mbuf was allocated, leaving the mbuf without label storage. Policies that cannot handle this case must be declared as NOTLATE, or must be modified. - mac_labelmbufs holds the current cumulative status as to whether any policies require mbuf labeling or not. This is updated whenever the active policy set changes by the function mac_policy_updateflags(). The function iterates the list and checks whether any have the flag set. Write access to this variable is protected by the policy list; read access is currently not protected for performance reasons. This might change if it causes problems. - Add MAC_POLICY_LIST_ASSERT_EXCLUSIVE() to permit the flags update function to assert appropriate locks. - This makes allocation in mac_init_mbuf() conditional on the flag. Reviewed by: sam Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-04-14 20:39:06 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
if (!mac_enforce_fs)
return (0);
Move MAC label storage for mbufs into m_tags from the m_pkthdr structure, returning some additional room in the first mbuf in a chain, and avoiding feature-specific contents in the mbuf header. To do this: - Modify mbuf_to_label() to extract the tag, returning NULL if not found. - Introduce mac_init_mbuf_tag() which does most of the work mac_init_mbuf() used to do, except on an m_tag rather than an mbuf. - Scale back mac_init_mbuf() to perform m_tag allocation and invoke mac_init_mbuf_tag(). - Replace mac_destroy_mbuf() with mac_destroy_mbuf_tag(), since m_tag's are now GC'd deep in the m_tag/mbuf code rather than at a higher level when mbufs are directly free()'d. - Add mac_copy_mbuf_tag() to support m_copy_pkthdr() and related notions. - Generally change all references to mbuf labels so that they use mbuf_to_label() rather than &mbuf->m_pkthdr.label. This required no changes in the MAC policies (yay!). - Tweak mbuf release routines to not call mac_destroy_mbuf(), tag destruction takes care of it for us now. - Remove MAC magic from m_copy_pkthdr() and m_move_pkthdr() -- the existing m_tag support does all this for us. Note that we can no longer just zero the m_tag list on the target mbuf, rather, we have to delete the chain because m_tag's will already be hung off freshly allocated mbuf's. - Tweak m_tag copying routines so that if we're copying a MAC m_tag, we don't do a binary copy, rather, we initialize the new storage and do a deep copy of the label. - Remove use of MAC_FLAG_INITIALIZED in a few bizarre places having to do with mbuf header copies previously. - When an mbuf is copied in ip_input(), we no longer need to explicitly copy the label because it will get handled by the m_tag code now. - No longer any weird handling of MAC labels in if_loop.c during header copies. - Add MPC_LOADTIME_FLAG_LABELMBUFS flag to Biba, MLS, mac_test. In mac_test, handle the label==NULL case, since it can be dynamically loaded. In order to improve performance with this change, introduce the notion of "lazy MAC label allocation" -- only allocate m_tag storage for MAC labels if we're running with a policy that uses MAC labels on mbufs. Policies declare this intent by setting the MPC_LOADTIME_FLAG_LABELMBUFS flag in their load-time flags field during declaration. Note: this opens up the possibility of post-boot policy modules getting back NULL slot entries even though they have policy invariants of non-NULL slot entries, as the policy might have been loaded after the mbuf was allocated, leaving the mbuf without label storage. Policies that cannot handle this case must be declared as NOTLATE, or must be modified. - mac_labelmbufs holds the current cumulative status as to whether any policies require mbuf labeling or not. This is updated whenever the active policy set changes by the function mac_policy_updateflags(). The function iterates the list and checks whether any have the flag set. Write access to this variable is protected by the policy list; read access is currently not protected for performance reasons. This might change if it causes problems. - Add MAC_POLICY_LIST_ASSERT_EXCLUSIVE() to permit the flags update function to assert appropriate locks. - This makes allocation in mac_init_mbuf() conditional on the flag. Reviewed by: sam Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-04-14 20:39:06 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
MAC_CHECK(check_vnode_read, active_cred, file_cred, vp,
&vp->v_label);
Support the new MAC user API in kernel: modify existing system calls to use a modified notion of 'struct mac', and flesh out the new variation system calls (almost identical to existing ones except that they permit a pid to be specified for process label retrieval, and don't follow symlinks). This generalizes the label API so that the framework is now almost entirely policy-agnostic. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-22 14:29:47 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
return (error);
Support the new MAC user API in kernel: modify existing system calls to use a modified notion of 'struct mac', and flesh out the new variation system calls (almost identical to existing ones except that they permit a pid to be specified for process label retrieval, and don't follow symlinks). This generalizes the label API so that the framework is now almost entirely policy-agnostic. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-22 14:29:47 +00:00
}
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
int
mac_check_vnode_readdir(struct ucred *cred, struct vnode *dvp)
Support the new MAC user API in kernel: modify existing system calls to use a modified notion of 'struct mac', and flesh out the new variation system calls (almost identical to existing ones except that they permit a pid to be specified for process label retrieval, and don't follow symlinks). This generalizes the label API so that the framework is now almost entirely policy-agnostic. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-22 14:29:47 +00:00
{
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
int error;
Support the new MAC user API in kernel: modify existing system calls to use a modified notion of 'struct mac', and flesh out the new variation system calls (almost identical to existing ones except that they permit a pid to be specified for process label retrieval, and don't follow symlinks). This generalizes the label API so that the framework is now almost entirely policy-agnostic. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-22 14:29:47 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_readdir");
if (!mac_enforce_fs)
return (0);
MAC_CHECK(check_vnode_readdir, cred, dvp, &dvp->v_label);
return (error);
Support the new MAC user API in kernel: modify existing system calls to use a modified notion of 'struct mac', and flesh out the new variation system calls (almost identical to existing ones except that they permit a pid to be specified for process label retrieval, and don't follow symlinks). This generalizes the label API so that the framework is now almost entirely policy-agnostic. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-22 14:29:47 +00:00
}
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
int
mac_check_vnode_readlink(struct ucred *cred, struct vnode *vp)
Support the new MAC user API in kernel: modify existing system calls to use a modified notion of 'struct mac', and flesh out the new variation system calls (almost identical to existing ones except that they permit a pid to be specified for process label retrieval, and don't follow symlinks). This generalizes the label API so that the framework is now almost entirely policy-agnostic. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-22 14:29:47 +00:00
{
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
int error;
ASSERT_VOP_LOCKED(vp, "mac_check_vnode_readlink");
Support the new MAC user API in kernel: modify existing system calls to use a modified notion of 'struct mac', and flesh out the new variation system calls (almost identical to existing ones except that they permit a pid to be specified for process label retrieval, and don't follow symlinks). This generalizes the label API so that the framework is now almost entirely policy-agnostic. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-22 14:29:47 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
if (!mac_enforce_fs)
return (0);
Support the new MAC user API in kernel: modify existing system calls to use a modified notion of 'struct mac', and flesh out the new variation system calls (almost identical to existing ones except that they permit a pid to be specified for process label retrieval, and don't follow symlinks). This generalizes the label API so that the framework is now almost entirely policy-agnostic. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-22 14:29:47 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
MAC_CHECK(check_vnode_readlink, cred, vp, &vp->v_label);
return (error);
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
}
Another big diff, little functional change: move label internalization, externalization, and cred label life cycle events to entirely above devfs and vnode events. Sync from MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-05 16:57:16 +00:00
static int
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
mac_check_vnode_relabel(struct ucred *cred, struct vnode *vp,
struct label *newlabel)
Another big diff, little functional change: move label internalization, externalization, and cred label life cycle events to entirely above devfs and vnode events. Sync from MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-05 16:57:16 +00:00
{
int error;
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
ASSERT_VOP_LOCKED(vp, "mac_check_vnode_relabel");
MAC_CHECK(check_vnode_relabel, cred, vp, &vp->v_label, newlabel);
Another big diff, little functional change: move label internalization, externalization, and cred label life cycle events to entirely above devfs and vnode events. Sync from MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-05 16:57:16 +00:00
return (error);
}
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
int
mac_check_vnode_rename_from(struct ucred *cred, struct vnode *dvp,
struct vnode *vp, struct componentname *cnp)
Another big diff, little functional change: move label internalization, externalization, and cred label life cycle events to entirely above devfs and vnode events. Sync from MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-05 16:57:16 +00:00
{
int error;
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_rename_from");
ASSERT_VOP_LOCKED(vp, "mac_check_vnode_rename_from");
if (!mac_enforce_fs)
return (0);
Support the new MAC user API in kernel: modify existing system calls to use a modified notion of 'struct mac', and flesh out the new variation system calls (almost identical to existing ones except that they permit a pid to be specified for process label retrieval, and don't follow symlinks). This generalizes the label API so that the framework is now almost entirely policy-agnostic. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-22 14:29:47 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
MAC_CHECK(check_vnode_rename_from, cred, dvp, &dvp->v_label, vp,
&vp->v_label, cnp);
Support the new MAC user API in kernel: modify existing system calls to use a modified notion of 'struct mac', and flesh out the new variation system calls (almost identical to existing ones except that they permit a pid to be specified for process label retrieval, and don't follow symlinks). This generalizes the label API so that the framework is now almost entirely policy-agnostic. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-22 14:29:47 +00:00
return (error);
}
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
int
mac_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp,
struct vnode *vp, int samedir, struct componentname *cnp)
Support the new MAC user API in kernel: modify existing system calls to use a modified notion of 'struct mac', and flesh out the new variation system calls (almost identical to existing ones except that they permit a pid to be specified for process label retrieval, and don't follow symlinks). This generalizes the label API so that the framework is now almost entirely policy-agnostic. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-22 14:29:47 +00:00
{
int error;
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_rename_to");
ASSERT_VOP_LOCKED(vp, "mac_check_vnode_rename_to");
if (!mac_enforce_fs)
return (0);
Support the new MAC user API in kernel: modify existing system calls to use a modified notion of 'struct mac', and flesh out the new variation system calls (almost identical to existing ones except that they permit a pid to be specified for process label retrieval, and don't follow symlinks). This generalizes the label API so that the framework is now almost entirely policy-agnostic. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-22 14:29:47 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
MAC_CHECK(check_vnode_rename_to, cred, dvp, &dvp->v_label, vp,
vp != NULL ? &vp->v_label : NULL, samedir, cnp);
Support the new MAC user API in kernel: modify existing system calls to use a modified notion of 'struct mac', and flesh out the new variation system calls (almost identical to existing ones except that they permit a pid to be specified for process label retrieval, and don't follow symlinks). This generalizes the label API so that the framework is now almost entirely policy-agnostic. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-22 14:29:47 +00:00
return (error);
}
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
int
mac_check_vnode_revoke(struct ucred *cred, struct vnode *vp)
Support the new MAC user API in kernel: modify existing system calls to use a modified notion of 'struct mac', and flesh out the new variation system calls (almost identical to existing ones except that they permit a pid to be specified for process label retrieval, and don't follow symlinks). This generalizes the label API so that the framework is now almost entirely policy-agnostic. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-22 14:29:47 +00:00
{
int error;
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
ASSERT_VOP_LOCKED(vp, "mac_check_vnode_revoke");
if (!mac_enforce_fs)
return (0);
Support the new MAC user API in kernel: modify existing system calls to use a modified notion of 'struct mac', and flesh out the new variation system calls (almost identical to existing ones except that they permit a pid to be specified for process label retrieval, and don't follow symlinks). This generalizes the label API so that the framework is now almost entirely policy-agnostic. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-22 14:29:47 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
MAC_CHECK(check_vnode_revoke, cred, vp, &vp->v_label);
Support the new MAC user API in kernel: modify existing system calls to use a modified notion of 'struct mac', and flesh out the new variation system calls (almost identical to existing ones except that they permit a pid to be specified for process label retrieval, and don't follow symlinks). This generalizes the label API so that the framework is now almost entirely policy-agnostic. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-22 14:29:47 +00:00
return (error);
}
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
int
mac_check_vnode_setacl(struct ucred *cred, struct vnode *vp, acl_type_t type,
struct acl *acl)
Support the new MAC user API in kernel: modify existing system calls to use a modified notion of 'struct mac', and flesh out the new variation system calls (almost identical to existing ones except that they permit a pid to be specified for process label retrieval, and don't follow symlinks). This generalizes the label API so that the framework is now almost entirely policy-agnostic. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-22 14:29:47 +00:00
{
int error;
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setacl");
if (!mac_enforce_fs)
return (0);
Support the new MAC user API in kernel: modify existing system calls to use a modified notion of 'struct mac', and flesh out the new variation system calls (almost identical to existing ones except that they permit a pid to be specified for process label retrieval, and don't follow symlinks). This generalizes the label API so that the framework is now almost entirely policy-agnostic. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-22 14:29:47 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
MAC_CHECK(check_vnode_setacl, cred, vp, &vp->v_label, type, acl);
Support the new MAC user API in kernel: modify existing system calls to use a modified notion of 'struct mac', and flesh out the new variation system calls (almost identical to existing ones except that they permit a pid to be specified for process label retrieval, and don't follow symlinks). This generalizes the label API so that the framework is now almost entirely policy-agnostic. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-22 14:29:47 +00:00
return (error);
}
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
int
mac_check_vnode_setextattr(struct ucred *cred, struct vnode *vp,
int attrnamespace, const char *name, struct uio *uio)
Support the new MAC user API in kernel: modify existing system calls to use a modified notion of 'struct mac', and flesh out the new variation system calls (almost identical to existing ones except that they permit a pid to be specified for process label retrieval, and don't follow symlinks). This generalizes the label API so that the framework is now almost entirely policy-agnostic. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-22 14:29:47 +00:00
{
int error;
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setextattr");
if (!mac_enforce_fs)
return (0);
Support the new MAC user API in kernel: modify existing system calls to use a modified notion of 'struct mac', and flesh out the new variation system calls (almost identical to existing ones except that they permit a pid to be specified for process label retrieval, and don't follow symlinks). This generalizes the label API so that the framework is now almost entirely policy-agnostic. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-22 14:29:47 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
MAC_CHECK(check_vnode_setextattr, cred, vp, &vp->v_label,
attrnamespace, name, uio);
Support the new MAC user API in kernel: modify existing system calls to use a modified notion of 'struct mac', and flesh out the new variation system calls (almost identical to existing ones except that they permit a pid to be specified for process label retrieval, and don't follow symlinks). This generalizes the label API so that the framework is now almost entirely policy-agnostic. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-22 14:29:47 +00:00
return (error);
}
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
int
mac_check_vnode_setflags(struct ucred *cred, struct vnode *vp, u_long flags)
Support the new MAC user API in kernel: modify existing system calls to use a modified notion of 'struct mac', and flesh out the new variation system calls (almost identical to existing ones except that they permit a pid to be specified for process label retrieval, and don't follow symlinks). This generalizes the label API so that the framework is now almost entirely policy-agnostic. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-22 14:29:47 +00:00
{
int error;
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setflags");
if (!mac_enforce_fs)
return (0);
Support the new MAC user API in kernel: modify existing system calls to use a modified notion of 'struct mac', and flesh out the new variation system calls (almost identical to existing ones except that they permit a pid to be specified for process label retrieval, and don't follow symlinks). This generalizes the label API so that the framework is now almost entirely policy-agnostic. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-22 14:29:47 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
MAC_CHECK(check_vnode_setflags, cred, vp, &vp->v_label, flags);
Support the new MAC user API in kernel: modify existing system calls to use a modified notion of 'struct mac', and flesh out the new variation system calls (almost identical to existing ones except that they permit a pid to be specified for process label retrieval, and don't follow symlinks). This generalizes the label API so that the framework is now almost entirely policy-agnostic. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-22 14:29:47 +00:00
return (error);
}
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
int
mac_check_vnode_setmode(struct ucred *cred, struct vnode *vp, mode_t mode)
Support the new MAC user API in kernel: modify existing system calls to use a modified notion of 'struct mac', and flesh out the new variation system calls (almost identical to existing ones except that they permit a pid to be specified for process label retrieval, and don't follow symlinks). This generalizes the label API so that the framework is now almost entirely policy-agnostic. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-22 14:29:47 +00:00
{
int error;
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setmode");
if (!mac_enforce_fs)
return (0);
Support the new MAC user API in kernel: modify existing system calls to use a modified notion of 'struct mac', and flesh out the new variation system calls (almost identical to existing ones except that they permit a pid to be specified for process label retrieval, and don't follow symlinks). This generalizes the label API so that the framework is now almost entirely policy-agnostic. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-22 14:29:47 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
MAC_CHECK(check_vnode_setmode, cred, vp, &vp->v_label, mode);
Support the new MAC user API in kernel: modify existing system calls to use a modified notion of 'struct mac', and flesh out the new variation system calls (almost identical to existing ones except that they permit a pid to be specified for process label retrieval, and don't follow symlinks). This generalizes the label API so that the framework is now almost entirely policy-agnostic. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-22 14:29:47 +00:00
return (error);
}
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
int
mac_check_vnode_setowner(struct ucred *cred, struct vnode *vp, uid_t uid,
gid_t gid)
Support the new MAC user API in kernel: modify existing system calls to use a modified notion of 'struct mac', and flesh out the new variation system calls (almost identical to existing ones except that they permit a pid to be specified for process label retrieval, and don't follow symlinks). This generalizes the label API so that the framework is now almost entirely policy-agnostic. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-22 14:29:47 +00:00
{
int error;
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setowner");
if (!mac_enforce_fs)
return (0);
Support the new MAC user API in kernel: modify existing system calls to use a modified notion of 'struct mac', and flesh out the new variation system calls (almost identical to existing ones except that they permit a pid to be specified for process label retrieval, and don't follow symlinks). This generalizes the label API so that the framework is now almost entirely policy-agnostic. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-22 14:29:47 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
MAC_CHECK(check_vnode_setowner, cred, vp, &vp->v_label, uid, gid);
Support the new MAC user API in kernel: modify existing system calls to use a modified notion of 'struct mac', and flesh out the new variation system calls (almost identical to existing ones except that they permit a pid to be specified for process label retrieval, and don't follow symlinks). This generalizes the label API so that the framework is now almost entirely policy-agnostic. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-22 14:29:47 +00:00
return (error);
}
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
int
mac_check_vnode_setutimes(struct ucred *cred, struct vnode *vp,
struct timespec atime, struct timespec mtime)
Support the new MAC user API in kernel: modify existing system calls to use a modified notion of 'struct mac', and flesh out the new variation system calls (almost identical to existing ones except that they permit a pid to be specified for process label retrieval, and don't follow symlinks). This generalizes the label API so that the framework is now almost entirely policy-agnostic. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-22 14:29:47 +00:00
{
int error;
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setutimes");
if (!mac_enforce_fs)
return (0);
Support the new MAC user API in kernel: modify existing system calls to use a modified notion of 'struct mac', and flesh out the new variation system calls (almost identical to existing ones except that they permit a pid to be specified for process label retrieval, and don't follow symlinks). This generalizes the label API so that the framework is now almost entirely policy-agnostic. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-22 14:29:47 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
MAC_CHECK(check_vnode_setutimes, cred, vp, &vp->v_label, atime,
mtime);
Support the new MAC user API in kernel: modify existing system calls to use a modified notion of 'struct mac', and flesh out the new variation system calls (almost identical to existing ones except that they permit a pid to be specified for process label retrieval, and don't follow symlinks). This generalizes the label API so that the framework is now almost entirely policy-agnostic. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-22 14:29:47 +00:00
return (error);
}
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
int
mac_check_vnode_stat(struct ucred *active_cred, struct ucred *file_cred,
struct vnode *vp)
Support the new MAC user API in kernel: modify existing system calls to use a modified notion of 'struct mac', and flesh out the new variation system calls (almost identical to existing ones except that they permit a pid to be specified for process label retrieval, and don't follow symlinks). This generalizes the label API so that the framework is now almost entirely policy-agnostic. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-22 14:29:47 +00:00
{
int error;
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
ASSERT_VOP_LOCKED(vp, "mac_check_vnode_stat");
if (!mac_enforce_fs)
return (0);
Another big diff, little functional change: move label internalization, externalization, and cred label life cycle events to entirely above devfs and vnode events. Sync from MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-05 16:57:16 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
MAC_CHECK(check_vnode_stat, active_cred, file_cred, vp,
&vp->v_label);
Another big diff, little functional change: move label internalization, externalization, and cred label life cycle events to entirely above devfs and vnode events. Sync from MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-05 16:57:16 +00:00
return (error);
}
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
int
mac_check_vnode_write(struct ucred *active_cred, struct ucred *file_cred,
struct vnode *vp)
Another big diff, little functional change: move label internalization, externalization, and cred label life cycle events to entirely above devfs and vnode events. Sync from MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-05 16:57:16 +00:00
{
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
int error;
ASSERT_VOP_LOCKED(vp, "mac_check_vnode_write");
Another big diff, little functional change: move label internalization, externalization, and cred label life cycle events to entirely above devfs and vnode events. Sync from MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-05 16:57:16 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
if (!mac_enforce_fs)
return (0);
MAC_CHECK(check_vnode_write, active_cred, file_cred, vp,
&vp->v_label);
return (error);
Another big diff, little functional change: move label internalization, externalization, and cred label life cycle events to entirely above devfs and vnode events. Sync from MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-05 16:57:16 +00:00
}
void
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
mac_relabel_vnode(struct ucred *cred, struct vnode *vp, struct label *newlabel)
Another big diff, little functional change: move label internalization, externalization, and cred label life cycle events to entirely above devfs and vnode events. Sync from MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-05 16:57:16 +00:00
{
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
MAC_PERFORM(relabel_vnode, cred, vp, &vp->v_label, newlabel);
Another big diff, little functional change: move label internalization, externalization, and cred label life cycle events to entirely above devfs and vnode events. Sync from MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-05 16:57:16 +00:00
}
void
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
mac_create_mount(struct ucred *cred, struct mount *mp)
Another big diff, little functional change: move label internalization, externalization, and cred label life cycle events to entirely above devfs and vnode events. Sync from MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-05 16:57:16 +00:00
{
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
MAC_PERFORM(create_mount, cred, mp, &mp->mnt_mntlabel,
&mp->mnt_fslabel);
Another big diff, little functional change: move label internalization, externalization, and cred label life cycle events to entirely above devfs and vnode events. Sync from MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-05 16:57:16 +00:00
}
void
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
mac_create_root_mount(struct ucred *cred, struct mount *mp)
Another big diff, little functional change: move label internalization, externalization, and cred label life cycle events to entirely above devfs and vnode events. Sync from MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-05 16:57:16 +00:00
{
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
MAC_PERFORM(create_root_mount, cred, mp, &mp->mnt_mntlabel,
&mp->mnt_fslabel);
Another big diff, little functional change: move label internalization, externalization, and cred label life cycle events to entirely above devfs and vnode events. Sync from MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-05 16:57:16 +00:00
}
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
int
mac_check_mount_stat(struct ucred *cred, struct mount *mount)
Move all object label init/destroy routines to the head of the entry points to better match the entry point ordering in mac_policy.h. Big diff, no functional change; merge from the MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-05 16:54:59 +00:00
{
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
int error;
Move all object label init/destroy routines to the head of the entry points to better match the entry point ordering in mac_policy.h. Big diff, no functional change; merge from the MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-05 16:54:59 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
if (!mac_enforce_fs)
return (0);
MAC_CHECK(check_mount_stat, cred, mount, &mount->mnt_mntlabel);
return (error);
Move all object label init/destroy routines to the head of the entry points to better match the entry point ordering in mac_policy.h. Big diff, no functional change; merge from the MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-05 16:54:59 +00:00
}
void
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
mac_create_devfs_device(struct mount *mp, dev_t dev, struct devfs_dirent *de)
Move all object label init/destroy routines to the head of the entry points to better match the entry point ordering in mac_policy.h. Big diff, no functional change; merge from the MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-05 16:54:59 +00:00
{
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
MAC_PERFORM(create_devfs_device, mp, dev, de, &de->de_label);
Move all object label init/destroy routines to the head of the entry points to better match the entry point ordering in mac_policy.h. Big diff, no functional change; merge from the MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-05 16:54:59 +00:00
}
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
void
mac_create_devfs_symlink(struct ucred *cred, struct mount *mp,
struct devfs_dirent *dd, struct devfs_dirent *de)
Move all object label init/destroy routines to the head of the entry points to better match the entry point ordering in mac_policy.h. Big diff, no functional change; merge from the MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-05 16:54:59 +00:00
{
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
MAC_PERFORM(create_devfs_symlink, cred, mp, dd, &dd->de_label, de,
&de->de_label);
Move all object label init/destroy routines to the head of the entry points to better match the entry point ordering in mac_policy.h. Big diff, no functional change; merge from the MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-05 16:54:59 +00:00
}
void
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
mac_create_devfs_directory(struct mount *mp, char *dirname, int dirnamelen,
struct devfs_dirent *de)
Move all object label init/destroy routines to the head of the entry points to better match the entry point ordering in mac_policy.h. Big diff, no functional change; merge from the MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-05 16:54:59 +00:00
{
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
MAC_PERFORM(create_devfs_directory, mp, dirname, dirnamelen, de,
&de->de_label);
Move all object label init/destroy routines to the head of the entry points to better match the entry point ordering in mac_policy.h. Big diff, no functional change; merge from the MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-05 16:54:59 +00:00
}
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
/*
* Implementation of VOP_SETLABEL() that relies on extended attributes
* to store label data. Can be referenced by filesystems supporting
* extended attributes.
*/
Move all object label init/destroy routines to the head of the entry points to better match the entry point ordering in mac_policy.h. Big diff, no functional change; merge from the MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-05 16:54:59 +00:00
int
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
vop_stdsetlabel_ea(struct vop_setlabel_args *ap)
Move all object label init/destroy routines to the head of the entry points to better match the entry point ordering in mac_policy.h. Big diff, no functional change; merge from the MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-05 16:54:59 +00:00
{
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
struct vnode *vp = ap->a_vp;
struct label *intlabel = ap->a_label;
Slightly change the semantics of vnode labels for MAC: rather than "refreshing" the label on the vnode before use, just get the label right from inception. For single-label file systems, set the label in the generic VFS getnewvnode() code; for multi-label file systems, leave the labeling up to the file system. With UFS1/2, this means reading the extended attribute during vfs_vget() as the inode is pulled off disk, rather than hitting the extended attributes frequently during operations later, improving performance. This also corrects sematics for shared vnode locks, which were not previously present in the system. This chances the cache coherrency properties WRT out-of-band access to label data, but in an acceptable form. With UFS1, there is a small race condition during automatic extended attribute start -- this is not present with UFS2, and occurs because EAs aren't available at vnode inception. We'll introduce a work around for this shortly. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-26 14:38:24 +00:00
int error;
Move all object label init/destroy routines to the head of the entry points to better match the entry point ordering in mac_policy.h. Big diff, no functional change; merge from the MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-05 16:54:59 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
ASSERT_VOP_LOCKED(vp, "vop_stdsetlabel_ea");
Move all object label init/destroy routines to the head of the entry points to better match the entry point ordering in mac_policy.h. Big diff, no functional change; merge from the MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-05 16:54:59 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
if ((vp->v_mount->mnt_flag & MNT_MULTILABEL) == 0)
return (EOPNOTSUPP);
Move all object label init/destroy routines to the head of the entry points to better match the entry point ordering in mac_policy.h. Big diff, no functional change; merge from the MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-05 16:54:59 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
error = mac_setlabel_vnode_extattr(ap->a_cred, vp, intlabel);
if (error)
Move all object label init/destroy routines to the head of the entry points to better match the entry point ordering in mac_policy.h. Big diff, no functional change; merge from the MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-05 16:54:59 +00:00
return (error);
Slightly change the semantics of vnode labels for MAC: rather than "refreshing" the label on the vnode before use, just get the label right from inception. For single-label file systems, set the label in the generic VFS getnewvnode() code; for multi-label file systems, leave the labeling up to the file system. With UFS1/2, this means reading the extended attribute during vfs_vget() as the inode is pulled off disk, rather than hitting the extended attributes frequently during operations later, improving performance. This also corrects sematics for shared vnode locks, which were not previously present in the system. This chances the cache coherrency properties WRT out-of-band access to label data, but in an acceptable form. With UFS1, there is a small race condition during automatic extended attribute start -- this is not present with UFS2, and occurs because EAs aren't available at vnode inception. We'll introduce a work around for this shortly. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-26 14:38:24 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
mac_relabel_vnode(ap->a_cred, vp, intlabel);
Move all object label init/destroy routines to the head of the entry points to better match the entry point ordering in mac_policy.h. Big diff, no functional change; merge from the MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-05 16:54:59 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
return (0);
Move all object label init/destroy routines to the head of the entry points to better match the entry point ordering in mac_policy.h. Big diff, no functional change; merge from the MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-05 16:54:59 +00:00
}
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
int
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
vn_setlabel(struct vnode *vp, struct label *intlabel, struct ucred *cred)
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
{
int error;
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
if (vp->v_mount == NULL) {
/* printf("vn_setlabel: null v_mount\n"); */
if (vp->v_type != VNON)
printf("vn_setlabel: null v_mount with non-VNON\n");
return (EBADF);
Support the new MAC user API in kernel: modify existing system calls to use a modified notion of 'struct mac', and flesh out the new variation system calls (almost identical to existing ones except that they permit a pid to be specified for process label retrieval, and don't follow symlinks). This generalizes the label API so that the framework is now almost entirely policy-agnostic. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-22 14:29:47 +00:00
}
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
if ((vp->v_mount->mnt_flag & MNT_MULTILABEL) == 0)
return (EOPNOTSUPP);
Support the new MAC user API in kernel: modify existing system calls to use a modified notion of 'struct mac', and flesh out the new variation system calls (almost identical to existing ones except that they permit a pid to be specified for process label retrieval, and don't follow symlinks). This generalizes the label API so that the framework is now almost entirely policy-agnostic. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-22 14:29:47 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
/*
* Multi-phase commit. First check the policies to confirm the
* change is OK. Then commit via the filesystem. Finally,
* update the actual vnode label. Question: maybe the filesystem
* should update the vnode at the end as part of VOP_SETLABEL()?
*/
error = mac_check_vnode_relabel(cred, vp, intlabel);
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
if (error)
Support the new MAC user API in kernel: modify existing system calls to use a modified notion of 'struct mac', and flesh out the new variation system calls (almost identical to existing ones except that they permit a pid to be specified for process label retrieval, and don't follow symlinks). This generalizes the label API so that the framework is now almost entirely policy-agnostic. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-22 14:29:47 +00:00
return (error);
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
/*
* VADMIN provides the opportunity for the filesystem to make
* decisions about who is and is not able to modify labels
* and protections on files. This might not be right. We can't
* assume VOP_SETLABEL() will do it, because we might implement
* that as part of vop_stdsetlabel_ea().
*/
error = VOP_ACCESS(vp, VADMIN, cred, curthread);
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
if (error)
Support the new MAC user API in kernel: modify existing system calls to use a modified notion of 'struct mac', and flesh out the new variation system calls (almost identical to existing ones except that they permit a pid to be specified for process label retrieval, and don't follow symlinks). This generalizes the label API so that the framework is now almost entirely policy-agnostic. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2002-10-22 14:29:47 +00:00
return (error);
Begin committing support for Mandatory Access Control and extensible kernel access control. The MAC framework permits loadable kernel modules to link to the kernel at compile-time, boot-time, or run-time, and augment the system security policy. This commit includes the initial kernel implementation, although the interface with the userland components of the oeprating system is still under work, and not all kernel subsystems are supported. Later in this commit sequence, documentation of which kernel subsystems will not work correctly with a kernel compiled with MAC support will be added. kern_mac.c contains the body of the MAC framework. Kernel and user APIs defined in mac.h are implemented here, providing a front end to loaded security modules. This code implements a module registration service, state (label) management, security configuration and policy composition. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-07-30 21:36:05 +00:00
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
error = VOP_SETLABEL(vp, intlabel, cred, curthread);
Provide an implementation of mac_syscall() so that security modules can offer new services without reserving system call numbers, or augmented versions of existing services. User code requests a target policy by name, and specifies the policy-specific API plus target. This is required in particular for our port of SELinux/FLASK to the MAC framework since it offers additional security services. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-08-19 17:59:48 +00:00
if (error)
return (error);
Remove non-VFS related code from mac_vfs.c. Leave: Extended attribute transaction warning flag if transactions aren't supported on the EA implementation being used. Debug fallback flag to permit a less conservative fallback if reading an on-disk label fails. Enforce_fs toggle to enforce file systme access control. Debugging counters for file system objects: mounts, vnodes, devfs_dirents. Object initialization, destruction, copying, internalization, externalization, relabeling for file system objects. Life cycle operations for devfs entries. Generic extended attribute label implementation for use by UFS, UFS2 in multilabel mode. Generic single-level label implementation for use by all file systems when in singlelabel mode. Exec-time transition based on file label entry points. Vnode operation access control checks (many). Mount operation access control checks (few). Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
2003-10-22 20:29:41 +00:00
return (0);
Provide an implementation of mac_syscall() so that security modules can offer new services without reserving system call numbers, or augmented versions of existing services. User code requests a target policy by name, and specifies the policy-specific API plus target. This is required in particular for our port of SELinux/FLASK to the MAC framework since it offers additional security services. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
2002-08-19 17:59:48 +00:00
}
Reference in New Issue Copy Permalink