freebsd-dev/sys/security/lomac/kernel_pipe.c
Brian Feldman 3795613d1d Import LOMAC preliminary release 2.0.0 in src/sys/security. These files may
be modified and do not have to remain on the vendor branch.

http://opensource.nailabs.com/lomac/index.html

Sponsored by: DARPA, NAI Labs (CBOSS project)
2001-11-19 22:34:06 +00:00

242 lines
8.3 KiB
C

/*-
* Copyright (c) 2001 Networks Associates Technologies, Inc.
* All rights reserved.
*
* This software was developed for the FreeBSD Project by NAI Labs, the
* Security Research Division of Network Associates, Inc. under
* DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA
* CHATS research program.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* 3. The name of the author may not be used to endorse or promote
* products derived from this software without specific prior written
* permission.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
* $Id$
* $FreeBSD$
*/
/*
* This file contains part of LOMAC's interface to the kernel. This
* part allows LOMAC to monitor (unnamed) pipe read and write
* operations by interposing control on the kernel's pipeops vector.
*
* The pipeops vector is defined in kern/sys_pipe.c.
*
* USAGE:
*
* The LOMAC LKM should call lomac_initialize_pipes() at LKM load time.
* This function turns unnamed pipe interposition on by modifying
* the function addresses in pipeops.
*
* Once the LOMAC LKM turns interposition on, all reads and writes
* will pass through this file's monitoring functions.
*
* This file provides a lomac_uninitialize_pipes() function which
* turns unnamed pipe interposition off by restoring pipeops to
* its original unmodified state. Once the LOMAC LKM turns
* interposition off, subsequent unnamed pipe reads and writes
* will not pass through this file's monitoring functions.
*
* HOW LOMAC HANDLES PIPES:
*
* (This text describes how LOMAC handles (unnamed) pipes in terms of
* abstract architecture-independent concepts.) LOMAC does not treat
* pipes as objects, as it does files. When the kernel creates a new
* pipe, LOMAC assigns it the highest level. Whenever a process
* writes to the pipe, LOMAC reduces the pipe's level to match the
* level of the writing process. Whenever a process reads from a
* pipe, LOMAC reduces the level of the reading process to match the
* pipe's level. As a result, if a high-level process reads the
* output of a low-level process through a pipe, the reading process
* will wind up at the low level.
*
* It takes two `struct pipe's to make a pipe. We set the level
* information in both `struct pipes', and keep them synchronized.
*
* This code presently relies on the one-big-kernel-lock to
* synchronize its access to the `pipe_state' field of each `struct
* pipe'.
*
*/
#include <sys/types.h>
#include <sys/param.h>
#include <sys/systm.h>
#include <sys/malloc.h>
#include <sys/file.h>
#include <sys/selinfo.h>
#include <sys/pipe.h>
#include <sys/proc.h>
#include <sys/uio.h>
#include "lomac.h"
#include "kernel_interface.h"
#include "kernel_monitor.h"
#include "kernel_pipe.h"
/* `pipeops' is the kernel's pipe operations vector for the file *
* structure. All reads and writes to pipes call through this vector. */
extern struct fileops pipeops; /* defined in kern/sys_pipe.c */
/* These vars store the original addresses of the pipeops read and *
* write operations, so we can call them, and even restore them *
* later if we want to. */
static int (*pipe_read_orig)(struct file *, struct uio *, struct ucred *,
int, struct thread *);
static int (*pipe_write_orig)(struct file *, struct uio *, struct ucred *,
int, struct thread *);
/* declarations of functions private to this module: */
static int lomac_pipe_read(struct file *, struct uio *, struct ucred *,
int, struct thread *);
static int lomac_pipe_write(struct file *, struct uio *, struct ucred *,
int, struct thread *);
/* -------------------- public functions ---------------------------- */
/* lomac_initialize_pipes()
*
* in: nothing
* out: nothing
* return: 0
*
* Turns pipe interposition on by replacing the pipe_read() and pipe_write()
* operations in the kernel's pipeops vector with lomac_pipe_read() and
* lomac_pipe_write(). Saves the addresses of the original operations
* so other functions can call them, and so pipe_interposition_off()
* can restore the pipeops vector to its original unmodified state.
*
*/
int
lomac_initialize_pipes(void) {
pipe_read_orig = pipeops.fo_read;
pipeops.fo_read = lomac_pipe_read;
pipe_write_orig = pipeops.fo_write;
pipeops.fo_write = lomac_pipe_write;
return (0);
} /* lomac_initialize_pipes() */
/* lomac_uninitialize_pipes()
*
* in: nothing
* out: nothing
* return: 0
*
* Turns pipe interposition off by restoring the pipeops vector to its
* original unmodified state.
*
* See note at top of file regarding this function and unloading the
* LOMAC LKM.
*
*/
int
lomac_uninitialize_pipes(void) {
KASSERT(pipe_read_orig, ("LOMAC:pipe interpositon off before on"));
KASSERT(pipe_write_orig, ("LOMAC:pipe interpositon off before on"));
pipeops.fo_read = pipe_read_orig;
pipeops.fo_write = pipe_write_orig;
return (0);
} /* lomac_uninitialize_pipes() */
/* ------------------- private functions --------------------------- */
#ifndef MIN
#define MIN(lo, mac) ((lo) < (mac) ? (lo) : (mac))
#endif
/* lomac_pipe_read()
*
* Passes the read operation down to pipe_read_orig(). If
* pipe_read_orig() returns success, examines the level of the pipe
* and the reading process. If the reading process has a higher
* level, reduces the level of the process to equal the pipe's level.
*
*/
static int
lomac_pipe_read(struct file *fp, struct uio *uio, struct ucred *cred,
int flags, struct thread *td) {
lomac_object_t read_pipe; /* attrs are in read end of pipe */
struct uio kuio;
struct iovec kiov;
void *buf;
int len;
int ret_val; /* holds return values */
len = MIN(uio->uio_resid, BIG_PIPE_SIZE);
kiov.iov_base = buf = malloc(len, M_TEMP, M_WAITOK);
kiov.iov_len = len;
kuio.uio_iov = &kiov;
kuio.uio_iovcnt = 1;
kuio.uio_offset = 0;
kuio.uio_resid = len;
kuio.uio_segflg = UIO_SYSSPACE;
kuio.uio_rw = UIO_READ;
kuio.uio_td = td;
ret_val = pipe_read_orig(fp, &kuio, cred, flags, td);
if (ret_val == 0) {
read_pipe.lo_type = LO_TYPE_PIPE;
read_pipe.lo_object.pipe = (struct pipe *)fp->f_data;
(void)monitor_read_object(td->td_proc, &read_pipe);
ret_val = uiomove(buf, len - kuio.uio_resid, uio);
}
free(buf, M_TEMP);
return (ret_val);
} /* lomac_pipe_read() */
/* lomac_pipe_write()
*
* Passes the write operation down to pipe_write_orig(). If
* pipe_write_orig() returns success, examines the level of the pipe
* and the writing process. If the pipe has a higher level than the
* writing process, this function reduces the pipe's level to equal
* the level of the writing process.
*
*/
static int
lomac_pipe_write(struct file *fp, struct uio *uio, struct ucred *cred,
int flags, struct thread *td) {
lomac_object_t pipe;
int ret_val; /* holds return values */
pipe.lo_type = LO_TYPE_PIPE;
pipe.lo_object.pipe = (struct pipe *)fp->f_data;
ret_val = monitor_pipe_write(td->td_proc, &pipe);
if (ret_val == 0)
ret_val = pipe_write_orig(fp, uio, cred, flags, td);
return (ret_val);
} /* lomac_pipe_write() */