f44d9e24fb
pointer instead of a proc pointer and require the process pointed to by the second argument to be locked. We now use the thread ucred reference for the credential checks in p_can*() as a result. p_canfoo() should now no longer need Giant.
287 lines
7.8 KiB
C
287 lines
7.8 KiB
C
/*-
|
|
* Copyright (c) 2001 Networks Associates Technology, Inc.
|
|
* All rights reserved.
|
|
*
|
|
* This software was developed for the FreeBSD Project by NAI Labs, the
|
|
* Security Research Division of Network Associates, Inc. under
|
|
* DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA
|
|
* CHATS research program.
|
|
*
|
|
* Redistribution and use in source and binary forms, with or without
|
|
* modification, are permitted provided that the following conditions
|
|
* are met:
|
|
* 1. Redistributions of source code must retain the above copyright
|
|
* notice, this list of conditions and the following disclaimer.
|
|
* 2. Redistributions in binary form must reproduce the above copyright
|
|
* notice, this list of conditions and the following disclaimer in the
|
|
* documentation and/or other materials provided with the distribution.
|
|
* 3. The name of the author may not be used to endorse or promote
|
|
* products derived from this software without specific prior written
|
|
* permission.
|
|
*
|
|
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
|
|
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
|
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
|
|
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
|
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
|
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
|
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
|
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
|
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
|
* SUCH DAMAGE.
|
|
*
|
|
* $Id$
|
|
* $FreeBSD$
|
|
*/
|
|
|
|
#include <sys/param.h>
|
|
#include <sys/conf.h>
|
|
#include <sys/errno.h>
|
|
#include <sys/kernel.h>
|
|
#include <sys/module.h>
|
|
#include <sys/mount.h>
|
|
#include <sys/linker.h>
|
|
#include <sys/lock.h>
|
|
#include <sys/mutex.h>
|
|
#include <sys/namei.h>
|
|
#include <sys/proc.h>
|
|
#include <sys/systm.h>
|
|
|
|
#include "kernel_interface.h"
|
|
#include "kernel_mediate.h"
|
|
#include "kernel_plm.h"
|
|
#include "kernel_util.h"
|
|
#include "kernel_pipe.h"
|
|
#include "kernel_socket.h"
|
|
#include "lomacfs.h"
|
|
#include "lomacio.h"
|
|
|
|
static d_ioctl_t lomac_ioctl;
|
|
|
|
#define CDEV_MAJOR 207
|
|
#define LOMAC_MINOR 0
|
|
|
|
static struct cdevsw lomac_cdevsw = {
|
|
/* open */ (d_open_t *)nullop,
|
|
/* close */ (d_open_t *)nullop,
|
|
/* read */ noread,
|
|
/* write */ nowrite,
|
|
/* ioctl */ lomac_ioctl,
|
|
/* poll */ nopoll,
|
|
/* mmap */ nommap,
|
|
/* strategy */ nostrategy,
|
|
/* name */ "lomac",
|
|
/* maj */ CDEV_MAJOR,
|
|
/* dump */ nodump,
|
|
/* psize */ nopsize,
|
|
/* flags */ 0,
|
|
};
|
|
|
|
static dev_t lomac_dev = NULL;
|
|
|
|
int
|
|
lomac_ioctl(dev_t dev, u_long cmd, caddr_t data, int fflag, struct thread *td) {
|
|
struct nameidata nd;
|
|
struct proc *targp;
|
|
struct lomac_fioctl *fio;
|
|
lomac_object_t lobj;
|
|
lattr_t lattr;
|
|
int error;
|
|
|
|
switch (cmd) {
|
|
case LIOGETPLEVEL:
|
|
targp = pfind(*(int *)data);
|
|
if (targp == NULL)
|
|
return (ESRCH);
|
|
if (p_cansee(td, targp) != 0) {
|
|
PROC_UNLOCK(targp);
|
|
return (ESRCH);
|
|
}
|
|
get_subject_lattr(targp, &lattr);
|
|
*(level_t *)data = lattr.level;
|
|
PROC_UNLOCK(targp);
|
|
return (0);
|
|
case LIOGETFLEVEL:
|
|
fio = (struct lomac_fioctl *)data;
|
|
NDINIT(&nd, LOOKUP, NOFOLLOW | LOCKLEAF | NOOBJ, UIO_SYSSPACE,
|
|
fio->path, td);
|
|
if ((error = namei(&nd)) != 0)
|
|
return (error);
|
|
if (VISLOMAC(nd.ni_vp))
|
|
lobj.lo_type = LO_TYPE_LVNODE;
|
|
else
|
|
lobj.lo_type = LO_TYPE_UVNODE;
|
|
lobj.lo_object.vnode = nd.ni_vp;
|
|
get_object_lattr(&lobj, &lattr);
|
|
*(level_t *)&fio->level = lattr.level;
|
|
NDFREE(&nd, NDF_ONLY_PNBUF);
|
|
vput(nd.ni_vp);
|
|
return (error);
|
|
case LIOGETFLATTR:
|
|
fio = (struct lomac_fioctl *)data;
|
|
NDINIT(&nd, LOOKUP, NOFOLLOW | LOCKLEAF | NOOBJ, UIO_SYSSPACE,
|
|
fio->path, td);
|
|
if ((error = namei(&nd)) != 0)
|
|
return (error);
|
|
if (VISLOMAC(nd.ni_vp))
|
|
lobj.lo_type = LO_TYPE_LVNODE;
|
|
else
|
|
lobj.lo_type = LO_TYPE_UVNODE;
|
|
lobj.lo_object.vnode = nd.ni_vp;
|
|
get_object_lattr(&lobj, (lattr_t *)&fio->level);
|
|
NDFREE(&nd, NDF_ONLY_PNBUF);
|
|
vput(nd.ni_vp);
|
|
return (error);
|
|
case LIOPMAKELOWLEVEL:
|
|
lattr.level = LOMAC_LOWEST_LEVEL;
|
|
lattr.flags = 0;
|
|
set_subject_lattr(td->td_proc, lattr);
|
|
return (0);
|
|
default:
|
|
return (ENOTTY);
|
|
}
|
|
}
|
|
|
|
int (*old_execve)(struct proc *, void *);
|
|
#ifdef __i386__
|
|
int (*old_sysarch)(struct proc *, void *);
|
|
#endif
|
|
|
|
/*
|
|
* This is "borrowed" from kern_module.c and MUST be kept in synch!
|
|
*/
|
|
struct module {
|
|
TAILQ_ENTRY(module) link; /* chain together all modules */
|
|
TAILQ_ENTRY(module) flink; /* all modules in a file */
|
|
struct linker_file* file; /* file which contains this module */
|
|
int refs; /* reference count */
|
|
int id; /* unique id number */
|
|
char *name; /* module name */
|
|
modeventhand_t handler; /* event handler */
|
|
void *arg; /* argument for handler */
|
|
modspecific_t data; /* module specific data */
|
|
};
|
|
|
|
static int
|
|
lomac_modevent(module_t module, int event, void *unused) {
|
|
static int initialized_procs = 0;
|
|
static int initialized_syscalls = 0;
|
|
static int initialized_pipes = 0;
|
|
static int initialized_sockets = 0;
|
|
static int initialized_vm = 0;
|
|
static linker_file_t kernlf;
|
|
int error;
|
|
|
|
switch ((enum modeventtype)event) {
|
|
case MOD_LOAD:
|
|
if (!lomac_plm_initialized)
|
|
return (EINVAL);
|
|
kernlf = linker_kernel_file;
|
|
old_execve =
|
|
(int (*)(struct proc *, void *))linker_file_lookup_symbol(
|
|
kernlf, "execve", 1);
|
|
if (old_execve == NULL)
|
|
return (ENOENT);
|
|
#ifdef __i386__
|
|
old_sysarch =
|
|
(int (*)(struct proc *, void *))linker_file_lookup_symbol(
|
|
kernlf, "sysarch", 1);
|
|
if (old_sysarch == NULL)
|
|
return (ENOENT);
|
|
#endif
|
|
error = lomac_initialize_procs();
|
|
if (error)
|
|
break;
|
|
initialized_procs = 1;
|
|
error = lomac_initialize_syscalls();
|
|
if (error)
|
|
break;
|
|
initialized_syscalls = 1;
|
|
error = lomac_initialize_pipes();
|
|
if (error)
|
|
break;
|
|
initialized_pipes = 1;
|
|
error = lomac_initialize_sockets();
|
|
if (error)
|
|
break;
|
|
initialized_sockets = 1;
|
|
lomac_dev = make_dev(&lomac_cdevsw, LOMAC_MINOR, UID_ROOT,
|
|
GID_WHEEL, 0666, "lomac");
|
|
linker_kernel_file = module->file;
|
|
error = vfs_mount(curthread, "lomacfs", "/", 0, NULL);
|
|
if (error)
|
|
return (error);
|
|
error = lomac_initialize_cwds();
|
|
if (error)
|
|
return (error);
|
|
printf("LOMAC: Low-Watermark Mandatory Access Control v2.0.0\n");
|
|
return (error);
|
|
case MOD_UNLOAD:
|
|
/*
|
|
* It's always a bad idea to let a low-security process
|
|
* unload the module providing security.
|
|
*/
|
|
if (initialized_procs &&
|
|
!mediate_subject_at_level("kldunload", curthread->td_proc,
|
|
LOMAC_HIGHEST_LEVEL))
|
|
return (EPERM);
|
|
/*
|
|
* Unloading doesn't work well at the moment...
|
|
*/
|
|
return (EPERM);
|
|
if (initialized_sockets) {
|
|
error = lomac_uninitialize_sockets();
|
|
if (error)
|
|
break;
|
|
initialized_sockets = 0;
|
|
}
|
|
if (initialized_pipes) {
|
|
error = lomac_uninitialize_pipes();
|
|
if (error)
|
|
break;
|
|
initialized_pipes = 0;
|
|
}
|
|
if (initialized_syscalls) {
|
|
error = lomac_uninitialize_syscalls();
|
|
if (error)
|
|
break;
|
|
initialized_syscalls = 0;
|
|
}
|
|
if (initialized_procs) {
|
|
error = lomac_uninitialize_procs();
|
|
if (error)
|
|
break;
|
|
initialized_procs = 0;
|
|
}
|
|
if (initialized_vm) {
|
|
error = lomac_uninitialize_vm();
|
|
if (error)
|
|
break;
|
|
initialized_vm = 0;
|
|
}
|
|
if (lomac_dev) {
|
|
if (count_dev(lomac_dev) != 0)
|
|
return (EBUSY);
|
|
destroy_dev(lomac_dev);
|
|
}
|
|
printf("LOMAC: unloading\n");
|
|
linker_kernel_file = kernlf;
|
|
break;
|
|
case MOD_SHUTDOWN:
|
|
break;
|
|
}
|
|
return (0);
|
|
}
|
|
|
|
static moduledata_t lomac_moduledata = {
|
|
"lomac",
|
|
&lomac_modevent,
|
|
NULL
|
|
};
|
|
DECLARE_MODULE(lomac, lomac_moduledata, SI_SUB_VFS, SI_ORDER_ANY);
|
|
MODULE_VERSION(lomac, 1);
|
|
MODULE_DEPEND(lomac, syscall_gate, 1, 1, 1);
|
|
MODULE_DEPEND(lomac, lomacfs, 1, 1, 1);
|
|
MODULE_DEPEND(lomac, lomac_plm, 1, 1, 1);
|