d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Slightly change the semantics of vnode labels for MAC: rather than

Browse Source 
"refreshing" the label on the vnode before use, just get the label
right from inception.  For single-label file systems, set the label
in the generic VFS getnewvnode() code; for multi-label file systems,
leave the labeling up to the file system.  With UFS1/2, this means
reading the extended attribute during vfs_vget() as the inode is
pulled off disk, rather than hitting the extended attributes
frequently during operations later, improving performance.  This
also corrects sematics for shared vnode locks, which were not
previously present in the system.  This chances the cache
coherrency properties WRT out-of-band access to label data, but in
an acceptable form.  With UFS1, there is a small race condition
during automatic extended attribute start -- this is not present
with UFS2, and occurs because EAs aren't available at vnode
inception.  We'll introduce a work around for this shortly.

Approved by:	re
Obtained from:	TrustedBSD Project
Sponsored by:	DARPA, Network Associates Laboratories
This commit is contained in:
Robert Watson 2002-10-26 14:38:24 +00:00
parent 49d7a091ac
commit 763bbd2f4f
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=105988
29 changed files with 1299 additions and 4869 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
sys/conf/files
View File

@ -829,7 +829,6 @@ fs/procfs/procfs_ctl.c optional procfs
fs/procfs/procfs_dbregs.c optional procfs
fs/procfs/procfs_fpregs.c optional procfs
fs/procfs/procfs_ioctl.c optional procfs
fs/procfs/procfs_mac.c optional procfs
fs/procfs/procfs_map.c optional procfs
fs/procfs/procfs_mem.c optional procfs
fs/procfs/procfs_note.c optional procfs

2
sys/fs/devfs/devfs_vnops.c
View File

@ -167,7 +167,7 @@ devfs_allocv(struct devfs_dirent *de, struct mount *mp, struct vnode **vpp, stru
de->de_vnode = vp;
vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td);
#ifdef MAC
mac_create_devfs_vnode(de, vp);
mac_associate_vnode_devfs(mp, de, vp);
#endif
*vpp = vp;
return (0);

1
sys/fs/procfs/procfs.c
View File

@ -153,7 +153,6 @@ procfs_init(PFS_INIT_ARGS)
dir = pfs_create_dir(root, "pid",
procfs_attr, NULL, PFS_PROCDEP);
dir->pn_refreshlabel = procfs_piddir_refreshlabel;
pfs_create_file(dir, "cmdline", procfs_doproccmdline,
NULL, NULL, PFS_RD);
pfs_create_file(dir, "ctl", procfs_doprocctl,

3
sys/fs/procfs/procfs.h
View File

@ -61,9 +61,6 @@ int procfs_close(PFS_CLOSE_ARGS);
/* Attributes */
int procfs_attr(PFS_ATTR_ARGS);
/* MAC */
int procfs_piddir_refreshlabel(PFS_REFRESHLABEL_ARGS);
/* Visibility */
int procfs_notsystem(PFS_VIS_ARGS);
int procfs_candebug(PFS_VIS_ARGS);

68
sys/fs/procfs/procfs_mac.c
View File

@ -1,68 +0,0 @@
/*-
* Copyright (c) 2002 Network Associates Technology, Inc.
* All rights reserved.
*
* This software was developed in part by NAI Labs, the Security Research
* Division of Network Associates, Inc. under DARPA/SPAWAR contract
* N66001-01-C-8035 ("CBOSS"), as part of the DARPA CHATS research program.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* 3. The names of the authors may not be used to endorse or promote
* products derived from this software without specific prior written
* permission.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
* $FreeBSD$
*/
#include "opt_mac.h"
#include <sys/param.h>
#include <sys/lock.h>
#include <sys/mac.h>
#include <sys/mount.h>
#include <sys/mutex.h>
#include <sys/proc.h>
#include <sys/systm.h>
#include <sys/ucred.h>
#include <sys/vnode.h>
#include <fs/pseudofs/pseudofs.h>
#include <fs/procfs/procfs.h>
int
procfs_piddir_refreshlabel(PFS_REFRESHLABEL_ARGS)
{
#ifdef MAC
if (p == NULL)
mac_update_vnode_from_mount(vp, vp->v_mount);
else {
PROC_LOCK(p);
mac_update_procfsvnode(vp, p->p_ucred);
PROC_UNLOCK(p);
}
return (0);
#else
return (EOPNOTSUPP);
#endif
}

10
sys/fs/pseudofs/pseudofs.h
View File

@ -144,15 +144,6 @@ typedef int (*pfs_ioctl_t)(PFS_IOCTL_ARGS);
struct ucred;
typedef int (*pfs_getextattr_t)(PFS_GETEXTATTR_ARGS);
/*
* Getlabel callback
*/
#define PFS_REFRESHLABEL_ARGS \
struct thread *td, struct proc *p, struct vnode *vp, \
struct pfs_node *pn, struct ucred *cred
struct mac;
typedef int (*pfs_refreshlabel_t)(PFS_REFRESHLABEL_ARGS);
/*
* Last-close callback
*/
@ -194,7 +185,6 @@ struct pfs_node {
pfs_attr_t pn_attr;
pfs_vis_t pn_vis;
pfs_getextattr_t pn_getextattr;
pfs_refreshlabel_t pn_refreshlabel;
void *pn_data;
int pn_flags;

47
sys/fs/pseudofs/pseudofs_vnops.c
View File

@ -28,8 +28,6 @@
* $FreeBSD$
*/
#include "opt_mac.h"
#include <sys/param.h>
#include <sys/kernel.h>
#include <sys/systm.h>
@ -37,7 +35,6 @@
#include <sys/dirent.h>
#include <sys/fcntl.h>
#include <sys/lock.h>
#include <sys/mac.h>
#include <sys/mount.h>
#include <sys/mutex.h>
#include <sys/namei.h>
@ -732,50 +729,6 @@ pfs_reclaim(struct vop_reclaim_args *va)
return (pfs_vncache_free(va->a_vp));
}
#ifdef MAC
/*
* Refresh the vnode label as appropriate for the pseudo-file system.
*/
static int
pfs_refreshlabel(struct vop_refreshlabel_args *va)
{
struct vnode *vn = va->a_vp;
struct pfs_vdata *pvd = (struct pfs_vdata *)vn->v_data;
struct pfs_node *pn = pvd->pvd_pn;
struct proc *proc = NULL;
int error;
PFS_TRACE((pd->pn_name));
if (pn->pn_refreshlabel == NULL) {
mac_update_vnode_from_mount(vn, vn->v_mount);
return (0);
}
/*
* This is necessary because either process' privileges may
* have changed since the last open() call.
*/
if (!pfs_visible(curthread, pn, pvd->pvd_pid))
PFS_RETURN (EIO);
/* XXX duplicate bits of pfs_visible() */
if (pvd->pvd_pid != NO_PID) {
if ((proc = pfind(pvd->pvd_pid)) == NULL)
PFS_RETURN (EIO);
_PHOLD(proc);
PROC_UNLOCK(proc);
}
error = (pn->pn_refreshlabel)(curthread, proc, vn, pn, va->a_cred);
if (proc != NULL)
PRELE(proc);
PFS_RETURN (error);
}
#endif
/*
* Set attributes
*/

586
sys/kern/kern_mac.c
View File

File diff suppressed because it is too large Load Diff

2
sys/kern/vfs_subr.c
View File

@ -1004,6 +1004,8 @@ getnewvnode(tag, mp, vops, vpp)
VI_UNLOCK(vp);
#ifdef MAC
mac_init_vnode(vp);
if (mp != NULL && (mp->mnt_flag & MNT_MULTILABEL) == 0)
mac_associate_vnode_singlelabel(mp, vp);
#endif
insmntque(vp, mp);

2
sys/modules/procfs/Makefile
View File

@ -4,13 +4,11 @@
KMOD= procfs
SRCS=
SRCS+= opt_mac.h
SRCS+= vnode_if.h
SRCS+= procfs_ctl.c
SRCS+= procfs_dbregs.c
SRCS+= procfs_fpregs.c
SRCS+= procfs_ioctl.c
SRCS+= procfs_mac.c
SRCS+= procfs_map.c
SRCS+= procfs_mem.c
SRCS+= procfs_note.c

586
sys/security/mac/mac_framework.c
View File

File diff suppressed because it is too large Load Diff

16
sys/security/mac/mac_framework.h
View File

@ -195,6 +195,8 @@ void mac_init_pipe(struct pipe *);
int mac_init_mbuf(struct mbuf *m, int flag);
void mac_init_mount(struct mount *);
void mac_init_vnode(struct vnode *);
void mac_init_vnode_label(struct label *);
void mac_copy_vnode_label(struct label *, struct label *label);
void mac_destroy_bpfdesc(struct bpf_d *);
void mac_destroy_cred(struct ucred *);
void mac_destroy_devfsdirent(struct devfs_dirent *);
@ -205,26 +207,29 @@ void mac_destroy_pipe(struct pipe *);
void mac_destroy_mbuf(struct mbuf *);
void mac_destroy_mount(struct mount *);
void mac_destroy_vnode(struct vnode *);
void mac_destroy_vnode_label(struct label *);
/*
* Labeling event operations: file system objects, and things that
* look a lot like file system objects.
*/
void mac_associate_vnode_devfs(struct mount *mp, struct devfs_dirent *de,
struct vnode *vp);
int mac_associate_vnode_extattr(struct mount *mp, struct vnode *vp);
void mac_associate_vnode_singlelabel(struct mount *mp, struct vnode *vp);
void mac_create_devfs_device(dev_t dev, struct devfs_dirent *de);
void mac_create_devfs_directory(char *dirname, int dirnamelen,
struct devfs_dirent *de);
void mac_create_devfs_symlink(struct ucred *cred, struct devfs_dirent *dd,
struct devfs_dirent *de);
void mac_create_devfs_vnode(struct devfs_dirent *de, struct vnode *vp);
void mac_create_vnode(struct ucred *cred, struct vnode *parent,
struct vnode *child);
int mac_create_vnode_extattr(struct ucred *cred, struct mount *mp,
struct vnode *dvp, struct vnode *vp, struct componentname *cnp);
void mac_create_mount(struct ucred *cred, struct mount *mp);
void mac_create_root_mount(struct ucred *cred, struct mount *mp);
void mac_relabel_vnode(struct ucred *cred, struct vnode *vp,
struct label *newlabel);
void mac_update_devfsdirent(struct devfs_dirent *de, struct vnode *vp);
void mac_update_procfsvnode(struct vnode *vp, struct ucred *cred);
void mac_update_vnode_from_mount(struct vnode *vp, struct mount *mp);
/*
* Labeling event operations: IPC objects.
@ -362,9 +367,6 @@ int mac_pipe_label_set(struct ucred *cred, struct pipe *pipe,
* Calls to help various file systems implement labeling functionality
* using their existing EA implementation.
*/
int vop_stdcreatevnode_ea(struct vnode *dvp, struct vnode *tvp,
struct ucred *cred);
int vop_stdrefreshlabel_ea(struct vop_refreshlabel_args *ap);
int vop_stdsetlabel_ea(struct vop_setlabel_args *ap);
#endif /* _KERNEL */

586
sys/security/mac/mac_internal.h
View File

File diff suppressed because it is too large Load Diff

586
sys/security/mac/mac_net.c
View File

File diff suppressed because it is too large Load Diff

586
sys/security/mac/mac_pipe.c
View File

File diff suppressed because it is too large Load Diff

47
sys/security/mac/mac_policy.h
View File

@ -118,8 +118,6 @@ struct mac_policy_ops {
int (*mpo_externalize_vnode_label)(struct label *label,
char *element_name, char *buffer, size_t buflen,
size_t *len, int *claimed);
int (*mpo_externalize_vnode_oldmac)(struct label *label,
struct oldmac *extmac);
int (*mpo_internalize_cred_label)(struct label *label,
char *element_name, char *element_data, int *claimed);
int (*mpo_internalize_ifnet_label)(struct label *label,
@ -135,6 +133,16 @@ struct mac_policy_ops {
* Labeling event operations: file system objects, and things that
* look a lot like file system objects.
*/
void (*mpo_associate_vnode_devfs)(struct mount *mp,
struct label *fslabel, struct devfs_dirent *de,
struct label *delabel, struct vnode *vp,
struct label *vlabel);
int (*mpo_associate_vnode_extattr)(struct mount *mp,
struct label *fslabel, struct vnode *vp,
struct label *vlabel);
void (*mpo_associate_vnode_singlelabel)(struct mount *mp,
struct label *fslabel, struct vnode *vp,
struct label *vlabel);
void (*mpo_create_devfs_device)(dev_t dev, struct devfs_dirent *de,
struct label *label);
void (*mpo_create_devfs_directory)(char *dirname, int dirnamelen,
@ -145,30 +153,23 @@ struct mac_policy_ops {
void (*mpo_create_devfs_vnode)(struct devfs_dirent *de,
struct label *direntlabel, struct vnode *vp,
struct label *vnodelabel);
void (*mpo_create_vnode)(struct ucred *cred, struct vnode *parent,
struct label *parentlabel, struct vnode *child,
struct label *childlabel);
int (*mpo_create_vnode_extattr)(struct ucred *cred,
struct mount *mp, struct label *fslabel,
struct vnode *dvp, struct label *dlabel,
struct vnode *vp, struct label *vlabel,
struct componentname *cnp);
void (*mpo_create_mount)(struct ucred *cred, struct mount *mp,
struct label *mntlabel, struct label *fslabel);
void (*mpo_create_root_mount)(struct ucred *cred, struct mount *mp,
struct label *mountlabel, struct label *fslabel);
void (*mpo_relabel_vnode)(struct ucred *cred, struct vnode *vp,
struct label *vnodelabel, struct label *label);
int (*mpo_stdcreatevnode_ea)(struct vnode *vp,
struct label *vnodelabel);
int (*mpo_setlabel_vnode_extattr)(struct ucred *cred,
struct vnode *vp, struct label *vlabel,
struct label *intlabel);
void (*mpo_update_devfsdirent)(struct devfs_dirent *devfs_dirent,
struct label *direntlabel, struct vnode *vp,
struct label *vnodelabel);
void (*mpo_update_procfsvnode)(struct vnode *vp,
struct label *vnodelabel, struct ucred *cred);
int (*mpo_update_vnode_from_extattr)(struct vnode *vp,
struct label *vnodelabel, struct mount *mp,
struct label *fslabel);
int (*mpo_update_vnode_from_externalized)(struct vnode *vp,
struct label *vnodelabel, struct oldmac *extmac);
void (*mpo_update_vnode_from_mount)(struct vnode *vp,
struct label *vnodelabel, struct mount *mp,
struct label *fslabel);
/*
* Labeling event operations: IPC objects.
@ -431,7 +432,6 @@ enum mac_op_constant {
MAC_EXTERNALIZE_SOCKET_LABEL,
MAC_EXTERNALIZE_SOCKET_PEER_LABEL,
MAC_EXTERNALIZE_VNODE_LABEL,
MAC_EXTERNALIZE_VNODE_OLDMAC,
MAC_INTERNALIZE_CRED_LABEL,
MAC_INTERNALIZE_IFNET_LABEL,
MAC_INTERNALIZE_PIPE_LABEL,
@ -441,16 +441,15 @@ enum mac_op_constant {
MAC_CREATE_DEVFS_DIRECTORY,
MAC_CREATE_DEVFS_SYMLINK,
MAC_CREATE_DEVFS_VNODE,
MAC_CREATE_VNODE,
MAC_CREATE_MOUNT,
MAC_CREATE_ROOT_MOUNT,
MAC_RELABEL_VNODE,
MAC_STDCREATEVNODE_EA,
MAC_UPDATE_DEVFSDIRENT,
MAC_UPDATE_PROCFSVNODE,
MAC_UPDATE_VNODE_FROM_EXTATTR,
MAC_UPDATE_VNODE_FROM_EXTERNALIZED,
MAC_UPDATE_VNODE_FROM_MOUNT,
MAC_ASSOCIATE_VNODE_DEVFS,
MAC_ASSOCIATE_VNODE_EXTATTR,
MAC_ASSOCIATE_VNODE_SINGLELABEL,
MAC_CREATE_VNODE_EXTATTR,
MAC_SETLABEL_VNODE_EXTATTR,
MAC_CREATE_MBUF_FROM_SOCKET,
MAC_CREATE_PIPE,
MAC_CREATE_SOCKET,

586
sys/security/mac/mac_process.c
View File

File diff suppressed because it is too large Load Diff

586
sys/security/mac/mac_syscalls.c
View File

File diff suppressed because it is too large Load Diff

586
sys/security/mac/mac_system.c
View File

File diff suppressed because it is too large Load Diff

586
sys/security/mac/mac_vfs.c
View File

File diff suppressed because it is too large Load Diff

181
sys/security/mac_biba/mac_biba.c
View File

@ -46,6 +46,7 @@
#include <sys/param.h>
#include <sys/acl.h>
#include <sys/conf.h>
#include <sys/extattr.h>
#include <sys/kernel.h>
#include <sys/mac.h>
#include <sys/malloc.h>
@ -83,6 +84,10 @@ SYSCTL_DECL(_security_mac);
SYSCTL_NODE(_security_mac, OID_AUTO, biba, CTLFLAG_RW, 0,
"TrustedBSD mac_biba policy controls");
static int mac_biba_label_size = sizeof(struct mac_biba);
SYSCTL_INT(_security_mac_biba, OID_AUTO, label_size, CTLFLAG_RD,
&mac_biba_label_size, 0, "Size of struct mac_biba");
static int mac_biba_enabled = 0;
SYSCTL_INT(_security_mac_biba, OID_AUTO, enabled, CTLFLAG_RW,
&mac_biba_enabled, 0, "Enforce MAC/Biba policy");
@ -214,6 +219,19 @@ mac_biba_dominate_element(struct mac_biba_element *a,
return (0);
}
static int
mac_biba_subject_dominate_high(struct mac_biba *mac_biba)
{
struct mac_biba_element *element;
KASSERT((mac_biba->mb_single->mb_flags & MAC_BIBA_FLAG_SINGLE) != 0,
("mac_biba_single_in_range: mac_biba not single"));
element = &mac_biba->mb_single;
return (element->mbe_type == MAC_BIBA_TYPE_EQUAL ||
element->mbe_type == MAC_BIBA_TYPE_HIGH);
}
static int
mac_biba_range_in_range(struct mac_biba *rangea, struct mac_biba *rangeb)
{
@ -319,6 +337,15 @@ mac_biba_subject_equal_ok(struct mac_biba *mac_biba)
return (EPERM);
}
mac_biba_high_single(struct mac_biba *mac_biba)
{
KASSERT((mac_biba->mb_flags & MAC_BIBA_FLAG_SINGLE) != 0,
("mac_biba_equal_single: mac_biba not single"));
return (mac_biba->mb_single.mbe_type == MAC_BIBA_TYPE_HIGH);
}
static int
mac_biba_valid(struct mac_biba *mac_biba)
{
@ -619,23 +646,6 @@ mac_biba_externalize_label(struct label *label, char *element_name,
return (0);
}
static int
mac_biba_externalize_vnode_oldmac(struct label *label, struct oldmac *extmac)
{
struct mac_biba *mac_biba;
mac_biba = SLOT(label);
if (mac_biba == NULL) {
printf("mac_biba_externalize_vnode_oldmac: NULL pointer\n");
return (0);
}
extmac->m_biba = *mac_biba;
return (0);
}
static int
mac_biba_parse_element(struct mac_biba_element *element, char *string)
{
@ -846,18 +856,6 @@ mac_biba_create_devfs_vnode(struct devfs_dirent *devfs_dirent,
mac_biba_copy_single(source, dest);
}
static void
mac_biba_create_vnode(struct ucred *cred, struct vnode *parent,
struct label *parentlabel, struct vnode *child, struct label *childlabel)
{
struct mac_biba *source, *dest;
source = SLOT(&cred->cr_label);
dest = SLOT(childlabel);
mac_biba_copy_single(source, dest);
}
static void
mac_biba_create_mount(struct ucred *cred, struct mount *mp,
struct label *mntlabel, struct label *fslabel)
@ -909,55 +907,116 @@ mac_biba_update_devfsdirent(struct devfs_dirent *devfs_dirent,
}
static void
mac_biba_update_procfsvnode(struct vnode *vp, struct label *vnodelabel,
struct ucred *cred)
mac_biba_associate_vnode_devfs(struct mount *mp, struct label *fslabel,
struct devfs_dirent *de, struct label *delabel, struct vnode *vp,
struct label *vlabel)
{
struct mac_biba *source, *dest;
source = SLOT(&cred->cr_label);
dest = SLOT(vnodelabel);
source = SLOT(delabel);
dest = SLOT(vlabel);
/*
* Only copy the single, not the range, since vnodes only have
* a single.
*/
mac_biba_copy_single(source, dest);
}
static int
mac_biba_update_vnode_from_externalized(struct vnode *vp,
struct label *vnodelabel, struct oldmac *extmac)
mac_biba_associate_vnode_extattr(struct mount *mp, struct label *fslabel,
struct vnode *vp, struct label *vlabel)
{
struct mac_biba *source, *dest;
struct mac_biba temp, *source, *dest;
size_t buflen;
int error;
source = &extmac->m_biba;
dest = SLOT(vnodelabel);
source = SLOT(fslabel);
dest = SLOT(vlabel);
error = mac_biba_valid(source);
if (error)
buflen = sizeof(temp);
bzero(&temp, buflen);
error = vn_extattr_get(vp, IO_NODELOCKED, MAC_BIBA_EXTATTR_NAMESPACE,
MAC_BIBA_EXTATTR_NAME, &buflen, (char *) &temp, curthread);
if (error == ENOATTR || error == EOPNOTSUPP) {
/* Fall back to the fslabel. */
mac_biba_copy_single(source, dest);
return (0);
} else if (error)
return (error);
if ((source->mb_flags & MAC_BIBA_FLAGS_BOTH) != MAC_BIBA_FLAG_SINGLE)
return (EINVAL);
mac_biba_copy_single(source, dest);
if (buflen != sizeof(temp)) {
printf("mac_biba_associate_vnode_extattr: bad size %d\n",
buflen);
return (EPERM);
}
if (mac_biba_valid(&temp) != 0) {
printf("mac_biba_associate_vnode_extattr: invalid\n");
return (EPERM);
}
if ((temp.mb_flags & MAC_BIBA_FLAGS_BOTH) != MAC_BIBA_FLAG_SINGLE) {
printf("mac_biba_associate_vnode_extattr: not single\n");
return (EPERM);
}
mac_biba_copy_single(&temp, dest);
return (0);
}
static void
mac_biba_update_vnode_from_mount(struct vnode *vp, struct label *vnodelabel,
struct mount *mp, struct label *fslabel)
mac_biba_associate_vnode_singlelabel(struct mount *mp,
struct label *fslabel, struct vnode *vp, struct label *vlabel)
{
struct mac_biba *source, *dest;
source = SLOT(fslabel);
dest = SLOT(vnodelabel);
dest = SLOT(vlabel);
mac_biba_copy_single(source, dest);
}
static int
mac_biba_create_vnode_extattr(struct ucred *cred, struct mount *mp,
struct label *fslabel, struct vnode *dvp, struct label *dlabel,
struct vnode *vp, struct label *vlabel, struct componentname *cnp)
{
struct mac_biba *source, *dest, temp;
size_t buflen;
int error;
buflen = sizeof(temp);
bzero(&temp, buflen);
source = SLOT(&cred->cr_label);
dest = SLOT(vlabel);
mac_biba_copy_single(source, &temp);
error = vn_extattr_set(vp, IO_NODELOCKED, MAC_BIBA_EXTATTR_NAMESPACE,
MAC_BIBA_EXTATTR_NAME, buflen, (char *) &temp, curthread);
if (error == 0)
mac_biba_copy_single(source, dest);
return (error);
}
static int
mac_biba_setlabel_vnode_extattr(struct ucred *cred, struct vnode *vp,
struct label *vlabel, struct label *intlabel)
{
struct mac_biba *source, temp;
size_t buflen;
int error;
buflen = sizeof(temp);
bzero(&temp, buflen);
source = SLOT(intlabel);
if ((source->mb_flags & MAC_BIBA_FLAG_SINGLE) == 0)
return (0);
mac_biba_copy_single(source, &temp);
error = vn_extattr_set(vp, IO_NODELOCKED, MAC_BIBA_EXTATTR_NAMESPACE,
MAC_BIBA_EXTATTR_NAME, buflen, (char *) &temp, curthread);
return (error);
}
/*
* Labeling event operations: IPC object.
*/
@ -2450,8 +2509,6 @@ static struct mac_policy_op_entry mac_biba_ops[] =
(macop_t)mac_biba_externalize_label },
{ MAC_EXTERNALIZE_VNODE_LABEL,
(macop_t)mac_biba_externalize_label },
{ MAC_EXTERNALIZE_VNODE_OLDMAC,
(macop_t)mac_biba_externalize_vnode_oldmac },
{ MAC_INTERNALIZE_CRED_LABEL,
(macop_t)mac_biba_internalize_label },
{ MAC_INTERNALIZE_IFNET_LABEL,
@ -2470,8 +2527,6 @@ static struct mac_policy_op_entry mac_biba_ops[] =
(macop_t)mac_biba_create_devfs_symlink },
{ MAC_CREATE_DEVFS_VNODE,
(macop_t)mac_biba_create_devfs_vnode },
{ MAC_CREATE_VNODE,
(macop_t)mac_biba_create_vnode },
{ MAC_CREATE_MOUNT,
(macop_t)mac_biba_create_mount },
{ MAC_CREATE_ROOT_MOUNT,
@ -2480,12 +2535,16 @@ static struct mac_policy_op_entry mac_biba_ops[] =
(macop_t)mac_biba_relabel_vnode },
{ MAC_UPDATE_DEVFSDIRENT,
(macop_t)mac_biba_update_devfsdirent },
{ MAC_UPDATE_PROCFSVNODE,
(macop_t)mac_biba_update_procfsvnode },
{ MAC_UPDATE_VNODE_FROM_EXTERNALIZED,
(macop_t)mac_biba_update_vnode_from_externalized },
{ MAC_UPDATE_VNODE_FROM_MOUNT,
(macop_t)mac_biba_update_vnode_from_mount },
{ MAC_ASSOCIATE_VNODE_DEVFS,
(macop_t)mac_biba_associate_vnode_devfs },
{ MAC_ASSOCIATE_VNODE_EXTATTR,
(macop_t)mac_biba_associate_vnode_extattr },
{ MAC_ASSOCIATE_VNODE_SINGLELABEL,
(macop_t)mac_biba_associate_vnode_singlelabel },
{ MAC_CREATE_VNODE_EXTATTR,
(macop_t)mac_biba_create_vnode_extattr },
{ MAC_SETLABEL_VNODE_EXTATTR,
(macop_t)mac_biba_setlabel_vnode_extattr },
{ MAC_CREATE_MBUF_FROM_SOCKET,
(macop_t)mac_biba_create_mbuf_from_socket },
{ MAC_CREATE_PIPE,

159
sys/security/mac_mls/mac_mls.c
View File

@ -46,6 +46,7 @@
#include <sys/param.h>
#include <sys/acl.h>
#include <sys/conf.h>
#include <sys/extattr.h>
#include <sys/kernel.h>
#include <sys/mac.h>
#include <sys/malloc.h>
@ -83,6 +84,10 @@ SYSCTL_DECL(_security_mac);
SYSCTL_NODE(_security_mac, OID_AUTO, mls, CTLFLAG_RW, 0,
"TrustedBSD mac_mls policy controls");
static int mac_mls_label_size = sizeof(struct mac_mls);
SYSCTL_INT(_security_mac_mls, OID_AUTO, label_size, CTLFLAG_RD,
&mac_mls_label_size, 0, "Size of struct mac_mls");
static int mac_mls_enabled = 0;
SYSCTL_INT(_security_mac_mls, OID_AUTO, enabled, CTLFLAG_RW,
&mac_mls_enabled, 0, "Enforce MAC/MLS policy");
@ -608,23 +613,6 @@ mac_mls_externalize_label(struct label *label, char *element_name,
return (0);
}
static int
mac_mls_externalize_vnode_oldmac(struct label *label, struct oldmac *extmac)
{
struct mac_mls *mac_mls;
mac_mls = SLOT(label);
if (mac_mls == NULL) {
printf("mac_mls_externalize: NULL pointer\n");
return (0);
}
extmac->m_mls = *mac_mls;
return (0);
}
static int
mac_mls_parse_element(struct mac_mls_element *element, char *string)
{
@ -838,18 +826,6 @@ mac_mls_create_devfs_vnode(struct devfs_dirent *devfs_dirent,
mac_mls_copy_single(source, dest);
}
static void
mac_mls_create_vnode(struct ucred *cred, struct vnode *parent,
struct label *parentlabel, struct vnode *child, struct label *childlabel)
{
struct mac_mls *source, *dest;
source = SLOT(&cred->cr_label);
dest = SLOT(childlabel);
mac_mls_copy_single(source, dest);
}
static void
mac_mls_create_mount(struct ucred *cred, struct mount *mp,
struct label *mntlabel, struct label *fslabel)
@ -901,55 +877,116 @@ mac_mls_update_devfsdirent(struct devfs_dirent *devfs_dirent,
}
static void
mac_mls_update_procfsvnode(struct vnode *vp, struct label *vnodelabel,
struct ucred *cred)
mac_mls_associate_vnode_devfs(struct mount *mp, struct label *fslabel,
struct devfs_dirent *de, struct label *delabel, struct vnode *vp,
struct label *vlabel)
{
struct mac_mls *source, *dest;
source = SLOT(&cred->cr_label);
dest = SLOT(vnodelabel);
source = SLOT(delabel);
dest = SLOT(vlabel);
/*
* Only copy the single, not the range, since vnodes only have
* a single.
*/
mac_mls_copy_single(source, dest);
}
static int
mac_mls_update_vnode_from_externalized(struct vnode *vp,
struct label *vnodelabel, struct oldmac *extmac)
mac_mls_associate_vnode_extattr(struct mount *mp, struct label *fslabel,
struct vnode *vp, struct label *vlabel)
{
struct mac_mls *source, *dest;
struct mac_mls temp, *source, *dest;
size_t buflen;
int error;
source = &extmac->m_mls;
dest = SLOT(vnodelabel);
source = SLOT(fslabel);
dest = SLOT(vlabel);
error = mac_mls_valid(source);
if (error)
buflen = sizeof(temp);
bzero(&temp, buflen);
error = vn_extattr_get(vp, IO_NODELOCKED, MAC_MLS_EXTATTR_NAMESPACE,
MAC_MLS_EXTATTR_NAME, &buflen, (char *) &temp, curthread);
if (error == ENOATTR || error == EOPNOTSUPP) {
/* Fall back to the fslabel. */
mac_mls_copy_single(source, dest);
return (0);
} else if (error)
return (error);
if ((source->mm_flags & MAC_MLS_FLAGS_BOTH) != MAC_MLS_FLAG_SINGLE)
return (EINVAL);
mac_mls_copy_single(source, dest);
if (buflen != sizeof(temp)) {
printf("mac_mls_associate_vnode_extattr: bad size %d\n",
buflen);
return (EPERM);
}
if (mac_mls_valid(&temp) != 0) {
printf("mac_mls_associate_vnode_extattr: invalid\n");
return (EPERM);
}
if ((temp.mm_flags & MAC_MLS_FLAGS_BOTH) != MAC_MLS_FLAG_SINGLE) {
printf("mac_mls_associated_vnode_extattr: not single\n");
return (EPERM);
}
mac_mls_copy_single(&temp, dest);
return (0);
}
static void
mac_mls_update_vnode_from_mount(struct vnode *vp, struct label *vnodelabel,
struct mount *mp, struct label *fslabel)
mac_mls_associate_vnode_singlelabel(struct mount *mp,
struct label *fslabel, struct vnode *vp, struct label *vlabel)
{
struct mac_mls *source, *dest;
source = SLOT(fslabel);
dest = SLOT(vnodelabel);
dest = SLOT(vlabel);
mac_mls_copy_single(source, dest);
}
static int
mac_mls_create_vnode_extattr(struct ucred *cred, struct mount *mp,
struct label *fslabel, struct vnode *dvp, struct label *dlabel,
struct vnode *vp, struct label *vlabel, struct componentname *cnp)
{
struct mac_mls *source, *dest, temp;
size_t buflen;
int error;
buflen = sizeof(temp);
bzero(&temp, buflen);
source = SLOT(&cred->cr_label);
dest = SLOT(vlabel);
mac_mls_copy_single(source, &temp);
error = vn_extattr_set(vp, IO_NODELOCKED, MAC_MLS_EXTATTR_NAMESPACE,
MAC_MLS_EXTATTR_NAME, buflen, (char *) &temp, curthread);
if (error == 0)
mac_mls_copy_single(source, dest);
return (error);
}
static int
mac_mls_setlabel_vnode_extattr(struct ucred *cred, struct vnode *vp,
struct label *vlabel, struct label *intlabel)
{
struct mac_mls *source, temp;
size_t buflen;
int error;
buflen = sizeof(temp);
bzero(&temp, buflen);
source = SLOT(intlabel);
if ((source->mm_flags & MAC_MLS_FLAG_SINGLE) == 0)
return (0);
mac_mls_copy_single(source, &temp);
error = vn_extattr_set(vp, IO_NODELOCKED, MAC_MLS_EXTATTR_NAMESPACE,
MAC_MLS_EXTATTR_NAME, buflen, (char *) &temp, curthread);
return (error);
}
/*
* Labeling event operations: IPC object.
*/
@ -2405,8 +2442,6 @@ static struct mac_policy_op_entry mac_mls_ops[] =
(macop_t)mac_mls_externalize_label },
{ MAC_EXTERNALIZE_VNODE_LABEL,
(macop_t)mac_mls_externalize_label },
{ MAC_EXTERNALIZE_VNODE_OLDMAC,
(macop_t)mac_mls_externalize_vnode_oldmac },
{ MAC_INTERNALIZE_CRED_LABEL,
(macop_t)mac_mls_internalize_label },
{ MAC_INTERNALIZE_IFNET_LABEL,
@ -2425,8 +2460,6 @@ static struct mac_policy_op_entry mac_mls_ops[] =
(macop_t)mac_mls_create_devfs_symlink },
{ MAC_CREATE_DEVFS_VNODE,
(macop_t)mac_mls_create_devfs_vnode },
{ MAC_CREATE_VNODE,
(macop_t)mac_mls_create_vnode },
{ MAC_CREATE_MOUNT,
(macop_t)mac_mls_create_mount },
{ MAC_CREATE_ROOT_MOUNT,
@ -2435,12 +2468,16 @@ static struct mac_policy_op_entry mac_mls_ops[] =
(macop_t)mac_mls_relabel_vnode },
{ MAC_UPDATE_DEVFSDIRENT,
(macop_t)mac_mls_update_devfsdirent },
{ MAC_UPDATE_PROCFSVNODE,
(macop_t)mac_mls_update_procfsvnode },
{ MAC_UPDATE_VNODE_FROM_EXTERNALIZED,
(macop_t)mac_mls_update_vnode_from_externalized },
{ MAC_UPDATE_VNODE_FROM_MOUNT,
(macop_t)mac_mls_update_vnode_from_mount },
{ MAC_ASSOCIATE_VNODE_DEVFS,
(macop_t)mac_mls_associate_vnode_devfs },
{ MAC_ASSOCIATE_VNODE_EXTATTR,
(macop_t)mac_mls_associate_vnode_extattr },
{ MAC_ASSOCIATE_VNODE_SINGLELABEL,
(macop_t)mac_mls_associate_vnode_singlelabel },
{ MAC_CREATE_VNODE_EXTATTR,
(macop_t)mac_mls_create_vnode_extattr },
{ MAC_SETLABEL_VNODE_EXTATTR,
(macop_t)mac_mls_setlabel_vnode_extattr },
{ MAC_CREATE_MBUF_FROM_SOCKET,
(macop_t)mac_mls_create_mbuf_from_socket },
{ MAC_CREATE_PIPE,

82
sys/security/mac_none/mac_none.c
View File

@ -46,6 +46,7 @@
#include <sys/param.h>
#include <sys/acl.h>
#include <sys/conf.h>
#include <sys/extattr.h>
#include <sys/kernel.h>
#include <sys/mac.h>
#include <sys/mount.h>
@ -135,13 +136,6 @@ mac_none_externalize_label(struct label *label, char *element_name,
return (0);
}
static int
mac_none_externalize_vnode_oldmac(struct label *label, struct oldmac *extmac)
{
return (0);
}
static int
mac_none_internalize_label(struct label *label, char *element_name,
char *element_data, int *claimed)
@ -154,6 +148,29 @@ mac_none_internalize_label(struct label *label, char *element_name,
* Labeling event operations: file system objects, and things that look
* a lot like file system objects.
*/
static void
mac_none_associate_vnode_devfs(struct mount *mp, struct label *fslabel,
struct devfs_dirent *de, struct label *delabel, struct vnode *vp,
struct label *vlabel)
{
}
static int
mac_none_associate_vnode_extattr(struct mount *mp, struct label *fslabel,
struct vnode *vp, struct label *vlabel)
{
return (0);
}
static void
mac_none_associate_vnode_singlelabel(struct mount *mp,
struct label *fslabel, struct vnode *vp, struct label *vlabel)
{
}
static void
mac_none_create_devfs_device(dev_t dev, struct devfs_dirent *devfs_dirent,
struct label *label)
@ -182,12 +199,13 @@ mac_none_create_devfs_vnode(struct devfs_dirent *devfs_dirent,
}
static void
mac_none_create_vnode(struct ucred *cred, struct vnode *parent,
struct label *parentlabel, struct vnode *child,
struct label *childlabel)
static int
mac_none_create_vnode_extattr(struct ucred *cred, struct mount *mp,
struct label *fslabel, struct vnode *dvp, struct label *dlabel,
struct vnode *vp, struct label *vlabel, struct componentname *cnp)
{
return (0);
}
static void
@ -211,31 +229,17 @@ mac_none_relabel_vnode(struct ucred *cred, struct vnode *vp,
}
static void
mac_none_update_devfsdirent(struct devfs_dirent *devfs_dirent,
struct label *direntlabel, struct vnode *vp, struct label *vnodelabel)
{
}
static void
mac_none_update_procfsvnode(struct vnode *vp, struct label *vnodelabel,
struct ucred *cred)
{
}
static int
mac_none_update_vnode_from_externalized(struct vnode *vp,
struct label *vnodelabel, struct oldmac *extmac)
mac_none_setlabel_vnode_extattr(struct ucred *cred, struct vnode *vp,
struct label *vlabel, struct label *intlabel)
{
return (0);
}
static void
mac_none_update_vnode_from_mount(struct vnode *vp, struct label *vnodelabel,
struct mount *mp, struct label *fslabel)
mac_none_update_devfsdirent(struct devfs_dirent *devfs_dirent,
struct label *direntlabel, struct vnode *vp, struct label *vnodelabel)
{
}
@ -924,8 +928,6 @@ static struct mac_policy_op_entry mac_none_ops[] =
(macop_t)mac_none_externalize_label },
{ MAC_EXTERNALIZE_VNODE_LABEL,
(macop_t)mac_none_externalize_label },
{ MAC_EXTERNALIZE_VNODE_OLDMAC,
(macop_t)mac_none_externalize_vnode_oldmac },
{ MAC_INTERNALIZE_CRED_LABEL,
(macop_t)mac_none_internalize_label },
{ MAC_INTERNALIZE_IFNET_LABEL,
@ -936,6 +938,12 @@ static struct mac_policy_op_entry mac_none_ops[] =
(macop_t)mac_none_internalize_label },
{ MAC_INTERNALIZE_VNODE_LABEL,
(macop_t)mac_none_internalize_label },
{ MAC_ASSOCIATE_VNODE_DEVFS,
(macop_t)mac_none_associate_vnode_devfs },
{ MAC_ASSOCIATE_VNODE_EXTATTR,
(macop_t)mac_none_associate_vnode_extattr },
{ MAC_ASSOCIATE_VNODE_SINGLELABEL,
(macop_t)mac_none_associate_vnode_singlelabel },
{ MAC_CREATE_DEVFS_DEVICE,
(macop_t)mac_none_create_devfs_device },
{ MAC_CREATE_DEVFS_DIRECTORY,
@ -944,22 +952,18 @@ static struct mac_policy_op_entry mac_none_ops[] =
(macop_t)mac_none_create_devfs_symlink },
{ MAC_CREATE_DEVFS_VNODE,
(macop_t)mac_none_create_devfs_vnode },
{ MAC_CREATE_VNODE,
(macop_t)mac_none_create_vnode },
{ MAC_CREATE_VNODE_EXTATTR,
(macop_t)mac_none_create_vnode_extattr },
{ MAC_CREATE_MOUNT,
(macop_t)mac_none_create_mount },
{ MAC_CREATE_ROOT_MOUNT,
(macop_t)mac_none_create_root_mount },
{ MAC_RELABEL_VNODE,
(macop_t)mac_none_relabel_vnode },
{ MAC_SETLABEL_VNODE_EXTATTR,
(macop_t)mac_none_setlabel_vnode_extattr },
{ MAC_UPDATE_DEVFSDIRENT,
(macop_t)mac_none_update_devfsdirent },
{ MAC_UPDATE_PROCFSVNODE,
(macop_t)mac_none_update_procfsvnode },
{ MAC_UPDATE_VNODE_FROM_EXTERNALIZED,
(macop_t)mac_none_update_vnode_from_externalized },
{ MAC_UPDATE_VNODE_FROM_MOUNT,
(macop_t)mac_none_update_vnode_from_mount },
{ MAC_CREATE_MBUF_FROM_SOCKET,
(macop_t)mac_none_create_mbuf_from_socket },
{ MAC_CREATE_PIPE,

82
sys/security/mac_stub/mac_stub.c
View File

@ -46,6 +46,7 @@
#include <sys/param.h>
#include <sys/acl.h>
#include <sys/conf.h>
#include <sys/extattr.h>
#include <sys/kernel.h>
#include <sys/mac.h>
#include <sys/mount.h>
@ -135,13 +136,6 @@ mac_none_externalize_label(struct label *label, char *element_name,
return (0);
}
static int
mac_none_externalize_vnode_oldmac(struct label *label, struct oldmac *extmac)
{
return (0);
}
static int
mac_none_internalize_label(struct label *label, char *element_name,
char *element_data, int *claimed)
@ -154,6 +148,29 @@ mac_none_internalize_label(struct label *label, char *element_name,
* Labeling event operations: file system objects, and things that look
* a lot like file system objects.
*/
static void
mac_none_associate_vnode_devfs(struct mount *mp, struct label *fslabel,
struct devfs_dirent *de, struct label *delabel, struct vnode *vp,
struct label *vlabel)
{
}
static int
mac_none_associate_vnode_extattr(struct mount *mp, struct label *fslabel,
struct vnode *vp, struct label *vlabel)
{
return (0);
}
static void
mac_none_associate_vnode_singlelabel(struct mount *mp,
struct label *fslabel, struct vnode *vp, struct label *vlabel)
{
}
static void
mac_none_create_devfs_device(dev_t dev, struct devfs_dirent *devfs_dirent,
struct label *label)
@ -182,12 +199,13 @@ mac_none_create_devfs_vnode(struct devfs_dirent *devfs_dirent,
}
static void
mac_none_create_vnode(struct ucred *cred, struct vnode *parent,
struct label *parentlabel, struct vnode *child,
struct label *childlabel)
static int
mac_none_create_vnode_extattr(struct ucred *cred, struct mount *mp,
struct label *fslabel, struct vnode *dvp, struct label *dlabel,
struct vnode *vp, struct label *vlabel, struct componentname *cnp)
{
return (0);
}
static void
@ -211,31 +229,17 @@ mac_none_relabel_vnode(struct ucred *cred, struct vnode *vp,
}
static void
mac_none_update_devfsdirent(struct devfs_dirent *devfs_dirent,
struct label *direntlabel, struct vnode *vp, struct label *vnodelabel)
{
}
static void
mac_none_update_procfsvnode(struct vnode *vp, struct label *vnodelabel,
struct ucred *cred)
{
}
static int
mac_none_update_vnode_from_externalized(struct vnode *vp,
struct label *vnodelabel, struct oldmac *extmac)
mac_none_setlabel_vnode_extattr(struct ucred *cred, struct vnode *vp,
struct label *vlabel, struct label *intlabel)
{
return (0);
}
static void
mac_none_update_vnode_from_mount(struct vnode *vp, struct label *vnodelabel,
struct mount *mp, struct label *fslabel)
mac_none_update_devfsdirent(struct devfs_dirent *devfs_dirent,
struct label *direntlabel, struct vnode *vp, struct label *vnodelabel)
{
}
@ -924,8 +928,6 @@ static struct mac_policy_op_entry mac_none_ops[] =
(macop_t)mac_none_externalize_label },
{ MAC_EXTERNALIZE_VNODE_LABEL,
(macop_t)mac_none_externalize_label },
{ MAC_EXTERNALIZE_VNODE_OLDMAC,
(macop_t)mac_none_externalize_vnode_oldmac },
{ MAC_INTERNALIZE_CRED_LABEL,
(macop_t)mac_none_internalize_label },
{ MAC_INTERNALIZE_IFNET_LABEL,
@ -936,6 +938,12 @@ static struct mac_policy_op_entry mac_none_ops[] =
(macop_t)mac_none_internalize_label },
{ MAC_INTERNALIZE_VNODE_LABEL,
(macop_t)mac_none_internalize_label },
{ MAC_ASSOCIATE_VNODE_DEVFS,
(macop_t)mac_none_associate_vnode_devfs },
{ MAC_ASSOCIATE_VNODE_EXTATTR,
(macop_t)mac_none_associate_vnode_extattr },
{ MAC_ASSOCIATE_VNODE_SINGLELABEL,
(macop_t)mac_none_associate_vnode_singlelabel },
{ MAC_CREATE_DEVFS_DEVICE,
(macop_t)mac_none_create_devfs_device },
{ MAC_CREATE_DEVFS_DIRECTORY,
@ -944,22 +952,18 @@ static struct mac_policy_op_entry mac_none_ops[] =
(macop_t)mac_none_create_devfs_symlink },
{ MAC_CREATE_DEVFS_VNODE,
(macop_t)mac_none_create_devfs_vnode },
{ MAC_CREATE_VNODE,
(macop_t)mac_none_create_vnode },
{ MAC_CREATE_VNODE_EXTATTR,
(macop_t)mac_none_create_vnode_extattr },
{ MAC_CREATE_MOUNT,
(macop_t)mac_none_create_mount },
{ MAC_CREATE_ROOT_MOUNT,
(macop_t)mac_none_create_root_mount },
{ MAC_RELABEL_VNODE,
(macop_t)mac_none_relabel_vnode },
{ MAC_SETLABEL_VNODE_EXTATTR,
(macop_t)mac_none_setlabel_vnode_extattr },
{ MAC_UPDATE_DEVFSDIRENT,
(macop_t)mac_none_update_devfsdirent },
{ MAC_UPDATE_PROCFSVNODE,
(macop_t)mac_none_update_procfsvnode },
{ MAC_UPDATE_VNODE_FROM_EXTERNALIZED,
(macop_t)mac_none_update_vnode_from_externalized },
{ MAC_UPDATE_VNODE_FROM_MOUNT,
(macop_t)mac_none_update_vnode_from_mount },
{ MAC_CREATE_MBUF_FROM_SOCKET,
(macop_t)mac_none_create_mbuf_from_socket },
{ MAC_CREATE_PIPE,

83
sys/security/mac_test/mac_test.c
View File

@ -46,6 +46,7 @@
#include <sys/param.h>
#include <sys/acl.h>
#include <sys/conf.h>
#include <sys/extattr.h>
#include <sys/kernel.h>
#include <sys/mac.h>
#include <sys/mount.h>
@ -482,15 +483,6 @@ mac_test_externalize_label(struct label *label, char *element_name,
return (0);
}
static int
mac_test_externalize_vnode_oldmac(struct label *label, struct oldmac *extmac)
{
atomic_add_int(&externalize_count, 1);
return (0);
}
static int
mac_test_internalize_label(struct label *label, struct mac *mac,
char *element_name, char *element_data, int *claimed)
@ -505,6 +497,29 @@ mac_test_internalize_label(struct label *label, struct mac *mac,
* Labeling event operations: file system objects, and things that look
* a lot like file system objects.
*/
static void
mac_test_associate_vnode_devfs(struct mount *mp, struct label *fslabel,
struct devfs_dirent *de, struct label *delabel, struct vnode *vp,
struct label *vlabel)
{
}
static int
mac_test_associate_vnode_extattr(struct mount *mp, struct label *fslabel,
struct vnode *vp, struct label *vlabel)
{
return (0);
}
static void
mac_test_associate_vnode_singlelabel(struct mount *mp,
struct label *fslabel, struct vnode *vp, struct label *vlabel)
{
}
static void
mac_test_create_devfs_device(dev_t dev, struct devfs_dirent *devfs_dirent,
struct label *label)
@ -533,11 +548,13 @@ mac_test_create_devfs_vnode(struct devfs_dirent *devfs_dirent,
}
static void
mac_test_create_vnode(struct ucred *cred, struct vnode *parent,
struct label *parentlabel, struct vnode *child, struct label *childlabel)
static int
mac_test_create_vnode_extattr(struct ucred *cred, struct mount *mp,
struct label *fslabel, struct vnode *dvp, struct label *dlabel,
struct vnode *vp, struct label *vlabel, struct componentname *cnp)
{
return (0);
}
static void
@ -561,31 +578,17 @@ mac_test_relabel_vnode(struct ucred *cred, struct vnode *vp,
}
static void
mac_test_update_devfsdirent(struct devfs_dirent *devfs_dirent,
struct vnode *vp)
{
}
static void
mac_test_update_procfsvnode(struct vnode *vp, struct label *vnodelabel,
struct ucred *cred)
{
}
static int
mac_test_update_vnode_from_externalized(struct vnode *vp,
struct label *vnodelabel, struct mac *extmac)
mac_test_setlabel_vnode_extattr(struct ucred *cred, struct vnode *vp,
struct label *vlabel, struct label *intlabel)
{
return (0);
}
static void
mac_test_update_vnode_from_mount(struct vnode *vp, struct label *vnodelabel,
struct mount *mp, struct label *fslabel)
mac_test_update_devfsdirent(struct devfs_dirent *devfs_dirent,
struct label *direntlabel, struct vnode *vp, struct label *vnodelabel)
{
}
@ -1275,8 +1278,6 @@ static struct mac_policy_op_entry mac_test_ops[] =
(macop_t)mac_test_externalize_label },
{ MAC_EXTERNALIZE_VNODE_LABEL,
(macop_t)mac_test_externalize_label },
{ MAC_EXTERNALIZE_VNODE_OLDMAC,
(macop_t)mac_test_externalize_vnode_oldmac },
{ MAC_INTERNALIZE_CRED_LABEL,
(macop_t)mac_test_internalize_label },
{ MAC_INTERNALIZE_IFNET_LABEL,
@ -1287,6 +1288,12 @@ static struct mac_policy_op_entry mac_test_ops[] =
(macop_t)mac_test_internalize_label },
{ MAC_INTERNALIZE_VNODE_LABEL,
(macop_t)mac_test_internalize_label },
{ MAC_ASSOCIATE_VNODE_DEVFS,
(macop_t)mac_test_associate_vnode_devfs },
{ MAC_ASSOCIATE_VNODE_EXTATTR,
(macop_t)mac_test_associate_vnode_extattr },
{ MAC_ASSOCIATE_VNODE_SINGLELABEL,
(macop_t)mac_test_associate_vnode_singlelabel },
{ MAC_CREATE_DEVFS_DEVICE,
(macop_t)mac_test_create_devfs_device },
{ MAC_CREATE_DEVFS_DIRECTORY,
@ -1295,22 +1302,18 @@ static struct mac_policy_op_entry mac_test_ops[] =
(macop_t)mac_test_create_devfs_symlink },
{ MAC_CREATE_DEVFS_VNODE,
(macop_t)mac_test_create_devfs_vnode },
{ MAC_CREATE_VNODE,
(macop_t)mac_test_create_vnode },
{ MAC_CREATE_VNODE_EXTATTR,
(macop_t)mac_test_create_vnode_extattr },
{ MAC_CREATE_MOUNT,
(macop_t)mac_test_create_mount },
{ MAC_CREATE_ROOT_MOUNT,
(macop_t)mac_test_create_root_mount },
{ MAC_RELABEL_VNODE,
(macop_t)mac_test_relabel_vnode },
{ MAC_SETLABEL_VNODE_EXTATTR,
(macop_t)mac_test_setlabel_vnode_extattr },
{ MAC_UPDATE_DEVFSDIRENT,
(macop_t)mac_test_update_devfsdirent },
{ MAC_UPDATE_PROCFSVNODE,
(macop_t)mac_test_update_procfsvnode },
{ MAC_UPDATE_VNODE_FROM_EXTERNALIZED,
(macop_t)mac_test_update_vnode_from_externalized },
{ MAC_UPDATE_VNODE_FROM_MOUNT,
(macop_t)mac_test_update_vnode_from_mount },
{ MAC_CREATE_MBUF_FROM_SOCKET,
(macop_t)mac_test_create_mbuf_from_socket },
{ MAC_CREATE_PIPE,

16
sys/sys/mac.h
View File

@ -195,6 +195,8 @@ void mac_init_pipe(struct pipe *);
int mac_init_mbuf(struct mbuf *m, int flag);
void mac_init_mount(struct mount *);
void mac_init_vnode(struct vnode *);
void mac_init_vnode_label(struct label *);
void mac_copy_vnode_label(struct label *, struct label *label);
void mac_destroy_bpfdesc(struct bpf_d *);
void mac_destroy_cred(struct ucred *);
void mac_destroy_devfsdirent(struct devfs_dirent *);
@ -205,26 +207,29 @@ void mac_destroy_pipe(struct pipe *);
void mac_destroy_mbuf(struct mbuf *);
void mac_destroy_mount(struct mount *);
void mac_destroy_vnode(struct vnode *);
void mac_destroy_vnode_label(struct label *);
/*
* Labeling event operations: file system objects, and things that
* look a lot like file system objects.
*/
void mac_associate_vnode_devfs(struct mount *mp, struct devfs_dirent *de,
struct vnode *vp);
int mac_associate_vnode_extattr(struct mount *mp, struct vnode *vp);
void mac_associate_vnode_singlelabel(struct mount *mp, struct vnode *vp);
void mac_create_devfs_device(dev_t dev, struct devfs_dirent *de);
void mac_create_devfs_directory(char *dirname, int dirnamelen,
struct devfs_dirent *de);
void mac_create_devfs_symlink(struct ucred *cred, struct devfs_dirent *dd,
struct devfs_dirent *de);
void mac_create_devfs_vnode(struct devfs_dirent *de, struct vnode *vp);
void mac_create_vnode(struct ucred *cred, struct vnode *parent,
struct vnode *child);
int mac_create_vnode_extattr(struct ucred *cred, struct mount *mp,
struct vnode *dvp, struct vnode *vp, struct componentname *cnp);
void mac_create_mount(struct ucred *cred, struct mount *mp);
void mac_create_root_mount(struct ucred *cred, struct mount *mp);
void mac_relabel_vnode(struct ucred *cred, struct vnode *vp,
struct label *newlabel);
void mac_update_devfsdirent(struct devfs_dirent *de, struct vnode *vp);
void mac_update_procfsvnode(struct vnode *vp, struct ucred *cred);
void mac_update_vnode_from_mount(struct vnode *vp, struct mount *mp);
/*
* Labeling event operations: IPC objects.
@ -362,9 +367,6 @@ int mac_pipe_label_set(struct ucred *cred, struct pipe *pipe,
* Calls to help various file systems implement labeling functionality
* using their existing EA implementation.
*/
int vop_stdcreatevnode_ea(struct vnode *dvp, struct vnode *tvp,
struct ucred *cred);
int vop_stdrefreshlabel_ea(struct vop_refreshlabel_args *ap);
int vop_stdsetlabel_ea(struct vop_setlabel_args *ap);
#endif /* _KERNEL */

47
sys/sys/mac_policy.h
View File

@ -118,8 +118,6 @@ struct mac_policy_ops {
int (*mpo_externalize_vnode_label)(struct label *label,
char *element_name, char *buffer, size_t buflen,
size_t *len, int *claimed);
int (*mpo_externalize_vnode_oldmac)(struct label *label,
struct oldmac *extmac);
int (*mpo_internalize_cred_label)(struct label *label,
char *element_name, char *element_data, int *claimed);
int (*mpo_internalize_ifnet_label)(struct label *label,
@ -135,6 +133,16 @@ struct mac_policy_ops {
* Labeling event operations: file system objects, and things that
* look a lot like file system objects.
*/
void (*mpo_associate_vnode_devfs)(struct mount *mp,
struct label *fslabel, struct devfs_dirent *de,
struct label *delabel, struct vnode *vp,
struct label *vlabel);
int (*mpo_associate_vnode_extattr)(struct mount *mp,
struct label *fslabel, struct vnode *vp,
struct label *vlabel);
void (*mpo_associate_vnode_singlelabel)(struct mount *mp,
struct label *fslabel, struct vnode *vp,
struct label *vlabel);
void (*mpo_create_devfs_device)(dev_t dev, struct devfs_dirent *de,
struct label *label);
void (*mpo_create_devfs_directory)(char *dirname, int dirnamelen,
@ -145,30 +153,23 @@ struct mac_policy_ops {
void (*mpo_create_devfs_vnode)(struct devfs_dirent *de,
struct label *direntlabel, struct vnode *vp,
struct label *vnodelabel);
void (*mpo_create_vnode)(struct ucred *cred, struct vnode *parent,
struct label *parentlabel, struct vnode *child,
struct label *childlabel);
int (*mpo_create_vnode_extattr)(struct ucred *cred,
struct mount *mp, struct label *fslabel,
struct vnode *dvp, struct label *dlabel,
struct vnode *vp, struct label *vlabel,
struct componentname *cnp);
void (*mpo_create_mount)(struct ucred *cred, struct mount *mp,
struct label *mntlabel, struct label *fslabel);
void (*mpo_create_root_mount)(struct ucred *cred, struct mount *mp,
struct label *mountlabel, struct label *fslabel);
void (*mpo_relabel_vnode)(struct ucred *cred, struct vnode *vp,
struct label *vnodelabel, struct label *label);
int (*mpo_stdcreatevnode_ea)(struct vnode *vp,
struct label *vnodelabel);
int (*mpo_setlabel_vnode_extattr)(struct ucred *cred,
struct vnode *vp, struct label *vlabel,
struct label *intlabel);
void (*mpo_update_devfsdirent)(struct devfs_dirent *devfs_dirent,
struct label *direntlabel, struct vnode *vp,
struct label *vnodelabel);
void (*mpo_update_procfsvnode)(struct vnode *vp,
struct label *vnodelabel, struct ucred *cred);
int (*mpo_update_vnode_from_extattr)(struct vnode *vp,
struct label *vnodelabel, struct mount *mp,
struct label *fslabel);
int (*mpo_update_vnode_from_externalized)(struct vnode *vp,
struct label *vnodelabel, struct oldmac *extmac);
void (*mpo_update_vnode_from_mount)(struct vnode *vp,
struct label *vnodelabel, struct mount *mp,
struct label *fslabel);
/*
* Labeling event operations: IPC objects.
@ -431,7 +432,6 @@ enum mac_op_constant {
MAC_EXTERNALIZE_SOCKET_LABEL,
MAC_EXTERNALIZE_SOCKET_PEER_LABEL,
MAC_EXTERNALIZE_VNODE_LABEL,
MAC_EXTERNALIZE_VNODE_OLDMAC,
MAC_INTERNALIZE_CRED_LABEL,
MAC_INTERNALIZE_IFNET_LABEL,
MAC_INTERNALIZE_PIPE_LABEL,
@ -441,16 +441,15 @@ enum mac_op_constant {
MAC_CREATE_DEVFS_DIRECTORY,
MAC_CREATE_DEVFS_SYMLINK,
MAC_CREATE_DEVFS_VNODE,
MAC_CREATE_VNODE,
MAC_CREATE_MOUNT,
MAC_CREATE_ROOT_MOUNT,
MAC_RELABEL_VNODE,
MAC_STDCREATEVNODE_EA,
MAC_UPDATE_DEVFSDIRENT,
MAC_UPDATE_PROCFSVNODE,
MAC_UPDATE_VNODE_FROM_EXTATTR,
MAC_UPDATE_VNODE_FROM_EXTERNALIZED,
MAC_UPDATE_VNODE_FROM_MOUNT,
MAC_ASSOCIATE_VNODE_DEVFS,
MAC_ASSOCIATE_VNODE_EXTATTR,
MAC_ASSOCIATE_VNODE_SINGLELABEL,
MAC_CREATE_VNODE_EXTATTR,
MAC_SETLABEL_VNODE_EXTATTR,
MAC_CREATE_MBUF_FROM_SOCKET,
MAC_CREATE_PIPE,
MAC_CREATE_SOCKET,

18
sys/ufs/ffs/ffs_vfsops.c
View File

@ -44,6 +44,7 @@
#include <sys/namei.h>
#include <sys/proc.h>
#include <sys/kernel.h>
#include <sys/mac.h>
#include <sys/vnode.h>
#include <sys/mount.h>
#include <sys/bio.h>
@ -1337,6 +1338,23 @@ ffs_vget(mp, ino, flags, vpp)
ip->i_gid = ip->i_din1->di_ogid; /* XXX */
} /* XXX */
#ifdef MAC
if ((mp->mnt_flag & MNT_MULTILABEL) && ip->i_mode) {
/*
* If this vnode is already allocated, and we're running
* multi-label, attempt to perform a label association
* from the extended attributes on the inode.
*/
error = mac_associate_vnode_extattr(mp, vp);
if (error) {
/* ufs_inactive will release ip->i_devvp ref. */
vput(vp);
*vpp = NULL;
return (error);
}
}
#endif
*vpp = vp;
return (0);
}

27
sys/ufs/ufs/ufs_vnops.c
View File

@ -1523,9 +1523,12 @@ ufs_mkdir(ap)
if (error)
goto bad;
#ifdef MAC
error = vop_stdcreatevnode_ea(dvp, tvp, cnp->cn_cred);
if (error)
goto bad;
if (dvp->v_mount->mnt_flag & MNT_MULTILABEL) {
error = mac_create_vnode_extattr(cnp->cn_cred, dvp->v_mount,
dvp, tvp, cnp);
if (error)
goto bad;
}
#endif
#ifdef UFS_ACL
if (acl != NULL) {
@ -2459,9 +2462,12 @@ ufs_makeinode(mode, dvp, vpp, cnp)
if (error)
goto bad;
#ifdef MAC
error = vop_stdcreatevnode_ea(dvp, tvp, cnp->cn_cred);
if (error)
goto bad;
if (dvp->v_mount->mnt_flag & MNT_MULTILABEL) {
error = mac_create_vnode_extattr(cnp->cn_cred, dvp->v_mount,
dvp, tvp, cnp);
if (error)
goto bad;
}
#endif
#ifdef UFS_ACL
if (acl != NULL) {
@ -2649,9 +2655,6 @@ static struct vnodeopv_entry_desc ufs_vnodeop_entries[] = {
{ &vop_readdir_desc, (vop_t *) ufs_readdir },
{ &vop_readlink_desc, (vop_t *) ufs_readlink },
{ &vop_reclaim_desc, (vop_t *) ufs_reclaim },
#ifdef MAC
{ &vop_refreshlabel_desc, (vop_t *) vop_stdrefreshlabel_ea },
#endif
{ &vop_remove_desc, (vop_t *) ufs_remove },
{ &vop_rename_desc, (vop_t *) ufs_rename },
{ &vop_rmdir_desc, (vop_t *) ufs_rmdir },
@ -2690,9 +2693,6 @@ static struct vnodeopv_entry_desc ufs_specop_entries[] = {
{ &vop_print_desc, (vop_t *) ufs_print },
{ &vop_read_desc, (vop_t *) ufsspec_read },
{ &vop_reclaim_desc, (vop_t *) ufs_reclaim },
#ifdef MAC
{ &vop_refreshlabel_desc, (vop_t *) vop_stdrefreshlabel_ea },
#endif
{ &vop_setattr_desc, (vop_t *) ufs_setattr },
#ifdef MAC
{ &vop_setlabel_desc, (vop_t *) vop_stdsetlabel_ea },
@ -2727,9 +2727,6 @@ static struct vnodeopv_entry_desc ufs_fifoop_entries[] = {
{ &vop_print_desc, (vop_t *) ufs_print },
{ &vop_read_desc, (vop_t *) ufsfifo_read },
{ &vop_reclaim_desc, (vop_t *) ufs_reclaim },
#ifdef MAC
{ &vop_refreshlabel_desc, (vop_t *) vop_stdrefreshlabel_ea },
#endif
{ &vop_setattr_desc, (vop_t *) ufs_setattr },
#ifdef MAC
{ &vop_setlabel_desc, (vop_t *) vop_stdsetlabel_ea },