242 lines
8.3 KiB
C
242 lines
8.3 KiB
C
/*-
|
|
* Copyright (c) 2001 Networks Associates Technology, Inc.
|
|
* All rights reserved.
|
|
*
|
|
* This software was developed for the FreeBSD Project by NAI Labs, the
|
|
* Security Research Division of Network Associates, Inc. under
|
|
* DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA
|
|
* CHATS research program.
|
|
*
|
|
* Redistribution and use in source and binary forms, with or without
|
|
* modification, are permitted provided that the following conditions
|
|
* are met:
|
|
* 1. Redistributions of source code must retain the above copyright
|
|
* notice, this list of conditions and the following disclaimer.
|
|
* 2. Redistributions in binary form must reproduce the above copyright
|
|
* notice, this list of conditions and the following disclaimer in the
|
|
* documentation and/or other materials provided with the distribution.
|
|
* 3. The name of the author may not be used to endorse or promote
|
|
* products derived from this software without specific prior written
|
|
* permission.
|
|
*
|
|
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
|
|
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
|
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
|
|
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
|
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
|
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
|
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
|
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
|
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
|
* SUCH DAMAGE.
|
|
*
|
|
* $Id$
|
|
* $FreeBSD$
|
|
*/
|
|
|
|
/*
|
|
* This file contains part of LOMAC's interface to the kernel. This
|
|
* part allows LOMAC to monitor (unnamed) pipe read and write
|
|
* operations by interposing control on the kernel's pipeops vector.
|
|
*
|
|
* The pipeops vector is defined in kern/sys_pipe.c.
|
|
*
|
|
* USAGE:
|
|
*
|
|
* The LOMAC LKM should call lomac_initialize_pipes() at LKM load time.
|
|
* This function turns unnamed pipe interposition on by modifying
|
|
* the function addresses in pipeops.
|
|
*
|
|
* Once the LOMAC LKM turns interposition on, all reads and writes
|
|
* will pass through this file's monitoring functions.
|
|
*
|
|
* This file provides a lomac_uninitialize_pipes() function which
|
|
* turns unnamed pipe interposition off by restoring pipeops to
|
|
* its original unmodified state. Once the LOMAC LKM turns
|
|
* interposition off, subsequent unnamed pipe reads and writes
|
|
* will not pass through this file's monitoring functions.
|
|
*
|
|
* HOW LOMAC HANDLES PIPES:
|
|
*
|
|
* (This text describes how LOMAC handles (unnamed) pipes in terms of
|
|
* abstract architecture-independent concepts.) LOMAC does not treat
|
|
* pipes as objects, as it does files. When the kernel creates a new
|
|
* pipe, LOMAC assigns it the highest level. Whenever a process
|
|
* writes to the pipe, LOMAC reduces the pipe's level to match the
|
|
* level of the writing process. Whenever a process reads from a
|
|
* pipe, LOMAC reduces the level of the reading process to match the
|
|
* pipe's level. As a result, if a high-level process reads the
|
|
* output of a low-level process through a pipe, the reading process
|
|
* will wind up at the low level.
|
|
*
|
|
* It takes two `struct pipe's to make a pipe. We set the level
|
|
* information in both `struct pipes', and keep them synchronized.
|
|
*
|
|
* This code presently relies on the one-big-kernel-lock to
|
|
* synchronize its access to the `pipe_state' field of each `struct
|
|
* pipe'.
|
|
*
|
|
*/
|
|
|
|
#include <sys/types.h>
|
|
#include <sys/param.h>
|
|
#include <sys/systm.h>
|
|
#include <sys/malloc.h>
|
|
#include <sys/file.h>
|
|
#include <sys/selinfo.h>
|
|
#include <sys/pipe.h>
|
|
#include <sys/proc.h>
|
|
#include <sys/uio.h>
|
|
|
|
#include "lomac.h"
|
|
#include "kernel_interface.h"
|
|
#include "kernel_monitor.h"
|
|
#include "kernel_pipe.h"
|
|
|
|
|
|
/* `pipeops' is the kernel's pipe operations vector for the file *
|
|
* structure. All reads and writes to pipes call through this vector. */
|
|
extern struct fileops pipeops; /* defined in kern/sys_pipe.c */
|
|
|
|
|
|
/* These vars store the original addresses of the pipeops read and *
|
|
* write operations, so we can call them, and even restore them *
|
|
* later if we want to. */
|
|
static int (*pipe_read_orig)(struct file *, struct uio *, struct ucred *,
|
|
int, struct thread *);
|
|
static int (*pipe_write_orig)(struct file *, struct uio *, struct ucred *,
|
|
int, struct thread *);
|
|
|
|
|
|
/* declarations of functions private to this module: */
|
|
static int lomac_pipe_read(struct file *, struct uio *, struct ucred *,
|
|
int, struct thread *);
|
|
static int lomac_pipe_write(struct file *, struct uio *, struct ucred *,
|
|
int, struct thread *);
|
|
|
|
/* -------------------- public functions ---------------------------- */
|
|
|
|
/* lomac_initialize_pipes()
|
|
*
|
|
* in: nothing
|
|
* out: nothing
|
|
* return: 0
|
|
*
|
|
* Turns pipe interposition on by replacing the pipe_read() and pipe_write()
|
|
* operations in the kernel's pipeops vector with lomac_pipe_read() and
|
|
* lomac_pipe_write(). Saves the addresses of the original operations
|
|
* so other functions can call them, and so pipe_interposition_off()
|
|
* can restore the pipeops vector to its original unmodified state.
|
|
*
|
|
*/
|
|
|
|
int
|
|
lomac_initialize_pipes(void) {
|
|
|
|
pipe_read_orig = pipeops.fo_read;
|
|
pipeops.fo_read = lomac_pipe_read;
|
|
pipe_write_orig = pipeops.fo_write;
|
|
pipeops.fo_write = lomac_pipe_write;
|
|
return (0);
|
|
} /* lomac_initialize_pipes() */
|
|
|
|
|
|
/* lomac_uninitialize_pipes()
|
|
*
|
|
* in: nothing
|
|
* out: nothing
|
|
* return: 0
|
|
*
|
|
* Turns pipe interposition off by restoring the pipeops vector to its
|
|
* original unmodified state.
|
|
*
|
|
* See note at top of file regarding this function and unloading the
|
|
* LOMAC LKM.
|
|
*
|
|
*/
|
|
|
|
int
|
|
lomac_uninitialize_pipes(void) {
|
|
|
|
KASSERT(pipe_read_orig, ("LOMAC:pipe interpositon off before on"));
|
|
KASSERT(pipe_write_orig, ("LOMAC:pipe interpositon off before on"));
|
|
pipeops.fo_read = pipe_read_orig;
|
|
pipeops.fo_write = pipe_write_orig;
|
|
return (0);
|
|
} /* lomac_uninitialize_pipes() */
|
|
|
|
|
|
|
|
/* ------------------- private functions --------------------------- */
|
|
|
|
#ifndef MIN
|
|
#define MIN(lo, mac) ((lo) < (mac) ? (lo) : (mac))
|
|
#endif
|
|
|
|
/* lomac_pipe_read()
|
|
*
|
|
* Passes the read operation down to pipe_read_orig(). If
|
|
* pipe_read_orig() returns success, examines the level of the pipe
|
|
* and the reading process. If the reading process has a higher
|
|
* level, reduces the level of the process to equal the pipe's level.
|
|
*
|
|
*/
|
|
|
|
static int
|
|
lomac_pipe_read(struct file *fp, struct uio *uio, struct ucred *cred,
|
|
int flags, struct thread *td) {
|
|
lomac_object_t read_pipe; /* attrs are in read end of pipe */
|
|
struct uio kuio;
|
|
struct iovec kiov;
|
|
void *buf;
|
|
int len;
|
|
int ret_val; /* holds return values */
|
|
|
|
len = MIN(uio->uio_resid, BIG_PIPE_SIZE);
|
|
kiov.iov_base = buf = malloc(len, M_TEMP, M_WAITOK);
|
|
kiov.iov_len = len;
|
|
kuio.uio_iov = &kiov;
|
|
kuio.uio_iovcnt = 1;
|
|
kuio.uio_offset = 0;
|
|
kuio.uio_resid = len;
|
|
kuio.uio_segflg = UIO_SYSSPACE;
|
|
kuio.uio_rw = UIO_READ;
|
|
kuio.uio_td = td;
|
|
ret_val = pipe_read_orig(fp, &kuio, cred, flags, td);
|
|
if (ret_val == 0) {
|
|
read_pipe.lo_type = LO_TYPE_PIPE;
|
|
read_pipe.lo_object.pipe = (struct pipe *)fp->f_data;
|
|
(void)monitor_read_object(td->td_proc, &read_pipe);
|
|
ret_val = uiomove(buf, len - kuio.uio_resid, uio);
|
|
}
|
|
free(buf, M_TEMP);
|
|
return (ret_val);
|
|
} /* lomac_pipe_read() */
|
|
|
|
|
|
/* lomac_pipe_write()
|
|
*
|
|
* Passes the write operation down to pipe_write_orig(). If
|
|
* pipe_write_orig() returns success, examines the level of the pipe
|
|
* and the writing process. If the pipe has a higher level than the
|
|
* writing process, this function reduces the pipe's level to equal
|
|
* the level of the writing process.
|
|
*
|
|
*/
|
|
|
|
static int
|
|
lomac_pipe_write(struct file *fp, struct uio *uio, struct ucred *cred,
|
|
int flags, struct thread *td) {
|
|
lomac_object_t pipe;
|
|
int ret_val; /* holds return values */
|
|
|
|
pipe.lo_type = LO_TYPE_PIPE;
|
|
pipe.lo_object.pipe = (struct pipe *)fp->f_data;
|
|
ret_val = monitor_pipe_write(td->td_proc, &pipe);
|
|
if (ret_val == 0)
|
|
ret_val = pipe_write_orig(fp, uio, cred, flags, td);
|
|
|
|
return (ret_val);
|
|
} /* lomac_pipe_write() */
|