Date: Mon, 20 Oct 2003 15:06:09 -0700 (PDT) From: Robert Watson <rwatson@FreeBSD.org> To: Perforce Change Reviews <perforce@freebsd.org> Subject: PERFORCE change 40027 for review Message-ID: <200310202206.h9KM6900093560@repoman.freebsd.org>
next in thread | raw e-mail | index | archive | help
http://perforce.freebsd.org/chv.cgi?CH=40027 Change 40027 by rwatson@rwatson_tislabs on 2003/10/20 15:05:45 Remove not-pipe stuff. Do export many of the pipe functions globally so they may be used by kern_mac.c (for now). Affected files ... .. //depot/projects/trustedbsd/mac/sys/security/mac/mac_pipe.c#2 edit Differences ... ==== //depot/projects/trustedbsd/mac/sys/security/mac/mac_pipe.c#2 (text+ko) ==== @@ -1,12 +1,7 @@ /*- - * Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson - * Copyright (c) 2001 Ilmar S. Habibulin - * Copyright (c) 2001, 2002, 2003 Networks Associates Technology, Inc. + * Copyright (c) 2002, 2003 Networks Associates Technology, Inc. * All rights reserved. * - * This software was developed by Robert Watson and Ilmar Habibulin for the - * TrustedBSD Project. - * * This software was developed for the FreeBSD Project in part by Network * Associates Laboratories, the Security Research Division of Network * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), @@ -34,17 +29,10 @@ * SUCH DAMAGE. */ -/* - * Framework for extensible kernel access control. Kernel and userland - * interface to the framework, policy registration and composition. - */ - #include <sys/cdefs.h> __FBSDID("$FreeBSD: src/sys/kern/kern_mac.c,v 1.99 2003/09/29 18:35:17 rwatson Exp $"); #include "opt_mac.h" -#include "opt_devfs.h" -#include "opt_posix.h" #include <sys/param.h> #include <sys/condvar.h> @@ -92,909 +80,22 @@ #include <netinet/in.h> #include <netinet/ip_var.h> -#ifdef MAC - -/* - * Declare that the kernel provides MAC support, version 1. This permits - * modules to refuse to be loaded if the necessary support isn't present, - * even if it's pre-boot. - */ -MODULE_VERSION(kernel_mac_support, 1); - -SYSCTL_DECL(_security); +#include <security/mac/mac_internal.h> -SYSCTL_NODE(_security, OID_AUTO, mac, CTLFLAG_RW, 0, - "TrustedBSD MAC policy controls"); - -#if MAC_MAX_SLOTS > 32 -#error "MAC_MAX_SLOTS too large" -#endif - -static unsigned int mac_max_slots = MAC_MAX_SLOTS; -static unsigned int mac_slot_offsets_free = (1 << MAC_MAX_SLOTS) - 1; -SYSCTL_UINT(_security_mac, OID_AUTO, max_slots, CTLFLAG_RD, - &mac_max_slots, 0, ""); - -/* - * Has the kernel started generating labeled objects yet? All read/write - * access to this variable is serialized during the boot process. Following - * the end of serialization, we don't update this flag; no locking. - */ -static int mac_late = 0; - -/* - * Warn about EA transactions only the first time they happen. - * Weak coherency, no locking. - */ -static int ea_warn_once = 0; - -/* - * Flag to indicate whether or not we should allocate label storage for - * new mbufs. Since most dynamic policies we currently work with don't - * rely on mbuf labeling, try to avoid paying the cost of mtag allocation - * unless specifically notified of interest. One result of this is - * that if a dynamically loaded policy requests mbuf labels, it must - * be able to deal with a NULL label being returned on any mbufs that - * were already in flight when the policy was loaded. Since the policy - * already has to deal with uninitialized labels, this probably won't - * be a problem. Note: currently no locking. Will this be a problem? - */ -#ifndef MAC_ALWAYS_LABEL_MBUF -static int mac_labelmbufs = 0; -#endif - -static int mac_enforce_fs = 1; -SYSCTL_INT(_security_mac, OID_AUTO, enforce_fs, CTLFLAG_RW, - &mac_enforce_fs, 0, "Enforce MAC policy on file system objects"); -TUNABLE_INT("security.mac.enforce_fs", &mac_enforce_fs); - -static int mac_enforce_kld = 1; -SYSCTL_INT(_security_mac, OID_AUTO, enforce_kld, CTLFLAG_RW, - &mac_enforce_kld, 0, "Enforce MAC policy on kld operations"); -TUNABLE_INT("security.mac.enforce_kld", &mac_enforce_kld); - -static int mac_enforce_network = 1; -SYSCTL_INT(_security_mac, OID_AUTO, enforce_network, CTLFLAG_RW, - &mac_enforce_network, 0, "Enforce MAC policy on network packets"); -TUNABLE_INT("security.mac.enforce_network", &mac_enforce_network); - static int mac_enforce_pipe = 1; SYSCTL_INT(_security_mac, OID_AUTO, enforce_pipe, CTLFLAG_RW, &mac_enforce_pipe, 0, "Enforce MAC policy on pipe operations"); TUNABLE_INT("security.mac.enforce_pipe", &mac_enforce_pipe); -static int mac_enforce_posix_sem = 1; -SYSCTL_INT(_security_mac, OID_AUTO, enforce_posix_sem, CTLFLAG_RW, - &mac_enforce_posix_sem, 0, "Enforce MAC policy on global POSIX semaphores"); -TUNABLE_INT("security.mac.enforce_posix_sem", &mac_enforce_posix_sem); - -static int mac_enforce_process = 1; -SYSCTL_INT(_security_mac, OID_AUTO, enforce_process, CTLFLAG_RW, - &mac_enforce_process, 0, "Enforce MAC policy on inter-process operations"); -TUNABLE_INT("security.mac.enforce_process", &mac_enforce_process); - -static int mac_enforce_socket = 1; -SYSCTL_INT(_security_mac, OID_AUTO, enforce_socket, CTLFLAG_RW, - &mac_enforce_socket, 0, "Enforce MAC policy on socket operations"); -TUNABLE_INT("security.mac.enforce_socket", &mac_enforce_socket); - -static int mac_enforce_system = 1; -SYSCTL_INT(_security_mac, OID_AUTO, enforce_system, CTLFLAG_RW, - &mac_enforce_system, 0, "Enforce MAC policy on system operations"); -TUNABLE_INT("security.mac.enforce_system", &mac_enforce_system); - -static int mac_enforce_sysv = 1; -SYSCTL_INT(_security_mac, OID_AUTO, enforce_sysv, CTLFLAG_RW, - &mac_enforce_sysv, 0, "Enforce MAC policy on System V IPC objects"); -TUNABLE_INT("security.mac.enforce_sysv", &mac_enforce_sysv); - -static int mac_enforce_vm = 1; -SYSCTL_INT(_security_mac, OID_AUTO, enforce_vm, CTLFLAG_RW, - &mac_enforce_vm, 0, "Enforce MAC policy on vm operations"); -TUNABLE_INT("security.mac.enforce_vm", &mac_enforce_vm); - -static int mac_mmap_revocation = 0; -SYSCTL_INT(_security_mac, OID_AUTO, mmap_revocation, CTLFLAG_RW, - &mac_mmap_revocation, 0, "Revoke mmap access to files on subject " - "relabel"); - -static int mac_mmap_revocation_via_cow = 1; -SYSCTL_INT(_security_mac, OID_AUTO, mmap_revocation_via_cow, CTLFLAG_RW, - &mac_mmap_revocation_via_cow, 0, "Revoke mmap access to files via " - "copy-on-write semantics, or by removing all write access"); - #ifdef MAC_DEBUG -SYSCTL_NODE(_security_mac, OID_AUTO, debug, CTLFLAG_RW, 0, - "TrustedBSD MAC debug info"); - -static int mac_debug_label_fallback = 0; -SYSCTL_INT(_security_mac_debug, OID_AUTO, label_fallback, CTLFLAG_RW, - &mac_debug_label_fallback, 0, "Filesystems should fall back to fs label" - "when label is corrupted."); -TUNABLE_INT("security.mac.debug_label_fallback", - &mac_debug_label_fallback); - -SYSCTL_NODE(_security_mac_debug, OID_AUTO, counters, CTLFLAG_RW, 0, - "TrustedBSD MAC object counters"); - -static unsigned int nmacmbufs, nmaccreds, nmacifnets, nmacbpfdescs, - nmacsockets, nmacmounts, nmactemp, nmacvnodes, nmacdevfsdirents, - nmacipqs, nmacpipes, nmacprocs, nmacipcmsgs, nmacipcmsqs, - nmacipcsemas, nmacipcshms, nmacposixksems; - -#define MAC_DEBUG_COUNTER_INC(x) atomic_add_int(x, 1); -#define MAC_DEBUG_COUNTER_DEC(x) atomic_subtract_int(x, 1); - -SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, mbufs, CTLFLAG_RD, - &nmacmbufs, 0, "number of mbufs in use"); -SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, creds, CTLFLAG_RD, - &nmaccreds, 0, "number of ucreds in use"); -SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, ifnets, CTLFLAG_RD, - &nmacifnets, 0, "number of ifnets in use"); -SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, ipqs, CTLFLAG_RD, - &nmacipqs, 0, "number of ipqs in use"); -SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, bpfdescs, CTLFLAG_RD, - &nmacbpfdescs, 0, "number of bpfdescs in use"); -SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, sockets, CTLFLAG_RD, - &nmacsockets, 0, "number of sockets in use"); +static unsigned int nmacpipes; SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, pipes, CTLFLAG_RD, &nmacpipes, 0, "number of pipes in use"); -SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, procs, CTLFLAG_RD, - &nmacprocs, 0, "number of procs in use"); -SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, mounts, CTLFLAG_RD, - &nmacmounts, 0, "number of mounts in use"); -SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, temp, CTLFLAG_RD, - &nmactemp, 0, "number of temporary labels in use"); -SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, vnodes, CTLFLAG_RD, - &nmacvnodes, 0, "number of vnodes in use"); -SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, devfsdirents, CTLFLAG_RD, - &nmacdevfsdirents, 0, "number of devfs dirents inuse"); -SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, ipc_msgs, CTLFLAG_RD, - &nmacipcmsgs, 0, "number of sysv ipc messages inuse"); -SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, ipc_msqs, CTLFLAG_RD, - &nmacipcmsqs, 0, "number of sysv ipc message queue identifiers inuse"); -SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, ipc_semas, CTLFLAG_RD, - &nmacipcsemas, 0, "number of sysv ipc semaphore identifiers inuse"); -SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, ipc_shms, CTLFLAG_RD, - &nmacipcshms, 0, "number of sysv ipc shm identifiers inuse"); -SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, posix_ksems, CTLFLAG_RD, - &nmacposixksems, 0, "number of posix global semaphores inuse"); -#else -#define MAC_DEBUG_COUNTER_INC(x) -#define MAC_DEBUG_COUNTER_DEC(x) #endif -static int error_select(int error1, int error2); -static int mac_policy_register(struct mac_policy_conf *mpc); -static int mac_policy_unregister(struct mac_policy_conf *mpc); - -static void mac_check_vnode_mmap_downgrade(struct ucred *cred, - struct vnode *vp, int *prot); -static void mac_cred_mmapped_drop_perms_recurse(struct thread *td, - struct ucred *cred, struct vm_map *map); - -static void mac_destroy_socket_label(struct label *label); - -static int mac_setlabel_vnode_extattr(struct ucred *cred, - struct vnode *vp, struct label *intlabel); - MALLOC_DEFINE(M_MACPIPELABEL, "macpipelabel", "MAC labels for pipes"); -MALLOC_DEFINE(M_MACTEMP, "mactemp", "MAC temporary label storage"); - -/* - * mac_static_policy_list holds a list of policy modules that are not - * loaded while the system is "live", and cannot be unloaded. These - * policies can be invoked without holding the busy count. - * - * mac_policy_list stores the list of dynamic policies. A busy count is - * maintained for the list, stored in mac_policy_busy. The busy count - * is protected by mac_policy_mtx; the list may be modified only - * while the busy count is 0, requiring that the lock be held to - * prevent new references to the list from being acquired. For almost - * all operations, incrementing the busy count is sufficient to - * guarantee consistency, as the list cannot be modified while the - * busy count is elevated. For a few special operations involving a - * change to the list of active policies, the mtx itself must be held. - * A condition variable, mac_policy_cv, is used to signal potential - * exclusive consumers that they should try to acquire the lock if a - * first attempt at exclusive access fails. - */ -#ifndef MAC_STATIC -static struct mtx mac_policy_mtx; -static struct cv mac_policy_cv; -static int mac_policy_count; -#endif -static LIST_HEAD(, mac_policy_conf) mac_policy_list; -static LIST_HEAD(, mac_policy_conf) mac_static_policy_list; - -/* - * We manually invoke WITNESS_WARN() to allow Witness to generate - * warnings even if we don't end up ever triggering the wait at - * run-time. The consumer of the exclusive interface must not hold - * any locks (other than potentially Giant) since we may sleep for - * long (potentially indefinite) periods of time waiting for the - * framework to become quiescent so that a policy list change may - * be made. - */ -static __inline void -mac_policy_grab_exclusive(void) -{ - -#ifndef MAC_STATIC - WITNESS_WARN(WARN_GIANTOK | WARN_SLEEPOK, NULL, - "mac_policy_grab_exclusive() at %s:%d", __FILE__, __LINE__); - mtx_lock(&mac_policy_mtx); - while (mac_policy_count != 0) - cv_wait(&mac_policy_cv, &mac_policy_mtx); -#endif -} - -static __inline void -mac_policy_assert_exclusive(void) -{ - -#ifndef MAC_STATIC - mtx_assert(&mac_policy_mtx, MA_OWNED); - KASSERT(mac_policy_count == 0, - ("mac_policy_assert_exclusive(): not exclusive")); -#endif -} - -static __inline void -mac_policy_release_exclusive(void) -{ - -#ifndef MAC_STATIC - KASSERT(mac_policy_count == 0, - ("mac_policy_release_exclusive(): not exclusive")); - mtx_unlock(&mac_policy_mtx); - cv_signal(&mac_policy_cv); -#endif -} - -static __inline void -mac_policy_list_busy(void) -{ - -#ifndef MAC_STATIC - mtx_lock(&mac_policy_mtx); - mac_policy_count++; - mtx_unlock(&mac_policy_mtx); -#endif -} - -static __inline int -mac_policy_list_conditional_busy(void) -{ -#ifndef MAC_STATIC - int ret; - - mtx_lock(&mac_policy_mtx); - if (!LIST_EMPTY(&mac_policy_list)) { - mac_policy_count++; - ret = 1; - } else - ret = 0; - mtx_unlock(&mac_policy_mtx); - return (ret); -#else - return (0); -#endif -} - -static __inline void -mac_policy_list_unbusy(void) -{ - -#ifndef MAC_STATIC - mtx_lock(&mac_policy_mtx); - mac_policy_count--; - KASSERT(mac_policy_count >= 0, ("MAC_POLICY_LIST_LOCK")); - if (mac_policy_count == 0) - cv_signal(&mac_policy_cv); - mtx_unlock(&mac_policy_mtx); -#endif -} - -/* - * MAC_CHECK performs the designated check by walking the policy - * module list and checking with each as to how it feels about the - * request. Note that it returns its value via 'error' in the scope - * of the caller. - */ -#define MAC_CHECK(check, args...) do { \ - struct mac_policy_conf *mpc; \ - int entrycount; \ - \ - error = 0; \ - LIST_FOREACH(mpc, &mac_static_policy_list, mpc_list) { \ - if (mpc->mpc_ops->mpo_ ## check != NULL) \ - error = error_select( \ - mpc->mpc_ops->mpo_ ## check (args), \ - error); \ - } \ - if ((entrycount = mac_policy_list_conditional_busy()) != 0) { \ - LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { \ - if (mpc->mpc_ops->mpo_ ## check != NULL) \ - error = error_select( \ - mpc->mpc_ops->mpo_ ## check (args), \ - error); \ - } \ - mac_policy_list_unbusy(); \ - } \ -} while (0) - -/* - * MAC_BOOLEAN performs the designated boolean composition by walking - * the module list, invoking each instance of the operation, and - * combining the results using the passed C operator. Note that it - * returns its value via 'result' in the scope of the caller, which - * should be initialized by the caller in a meaningful way to get - * a meaningful result. - */ -#define MAC_BOOLEAN(operation, composition, args...) do { \ - struct mac_policy_conf *mpc; \ - int entrycount; \ - \ - LIST_FOREACH(mpc, &mac_static_policy_list, mpc_list) { \ - if (mpc->mpc_ops->mpo_ ## operation != NULL) \ - result = result composition \ - mpc->mpc_ops->mpo_ ## operation (args); \ - } \ - if ((entrycount = mac_policy_list_conditional_busy()) != 0) { \ - LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { \ - if (mpc->mpc_ops->mpo_ ## operation != NULL) \ - result = result composition \ - mpc->mpc_ops->mpo_ ## operation \ - (args); \ - } \ - mac_policy_list_unbusy(); \ - } \ -} while (0) - -#define MAC_EXTERNALIZE(type, label, elementlist, outbuf, \ - outbuflen) do { \ - int claimed, first, ignorenotfound, savedlen; \ - char *element_name, *element_temp; \ - struct sbuf sb; \ - \ - error = 0; \ - first = 1; \ - sbuf_new(&sb, outbuf, outbuflen, SBUF_FIXEDLEN); \ - element_temp = elementlist; \ - while ((element_name = strsep(&element_temp, ",")) != NULL) { \ - if (element_name[0] == '?') { \ - element_name++; \ - ignorenotfound = 1; \ - } else \ - ignorenotfound = 0; \ - savedlen = sbuf_len(&sb); \ - if (first) \ - error = sbuf_printf(&sb, "%s/", element_name); \ - else \ - error = sbuf_printf(&sb, ",%s/", element_name); \ - if (error == -1) { \ - error = EINVAL; /* XXX: E2BIG? */ \ - break; \ - } \ - claimed = 0; \ - MAC_CHECK(externalize_ ## type, label, element_name, \ - &sb, &claimed); \ - if (error) \ - break; \ - if (claimed == 0 && ignorenotfound) { \ - /* Revert last label name. */ \ - sbuf_setpos(&sb, savedlen); \ - } else if (claimed != 1) { \ - error = EINVAL; /* XXX: ENOLABEL? */ \ - break; \ - } else { \ - first = 0; \ - } \ - } \ - sbuf_finish(&sb); \ -} while (0) - -#define MAC_INTERNALIZE(type, label, instring) do { \ - char *element, *element_name, *element_data; \ - int claimed; \ - \ - error = 0; \ - element = instring; \ - while ((element_name = strsep(&element, ",")) != NULL) { \ - element_data = element_name; \ - element_name = strsep(&element_data, "/"); \ - if (element_data == NULL) { \ - error = EINVAL; \ - break; \ - } \ - claimed = 0; \ - MAC_CHECK(internalize_ ## type, label, element_name, \ - element_data, &claimed); \ - if (error) \ - break; \ - if (claimed != 1) { \ - /* XXXMAC: Another error here? */ \ - error = EINVAL; \ - break; \ - } \ - } \ -} while (0) - -/* - * MAC_PERFORM performs the designated operation by walking the policy - * module list and invoking that operation for each policy. - */ -#define MAC_PERFORM(operation, args...) do { \ - struct mac_policy_conf *mpc; \ - int entrycount; \ - \ - LIST_FOREACH(mpc, &mac_static_policy_list, mpc_list) { \ - if (mpc->mpc_ops->mpo_ ## operation != NULL) \ - mpc->mpc_ops->mpo_ ## operation (args); \ - } \ - if ((entrycount = mac_policy_list_conditional_busy()) != 0) { \ - LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { \ - if (mpc->mpc_ops->mpo_ ## operation != NULL) \ - mpc->mpc_ops->mpo_ ## operation (args); \ - } \ - mac_policy_list_unbusy(); \ - } \ -} while (0) - -/* - * Initialize the MAC subsystem, including appropriate SMP locks. - */ -static void -mac_init(void) -{ - - LIST_INIT(&mac_static_policy_list); - LIST_INIT(&mac_policy_list); - -#ifndef MAC_STATIC - mtx_init(&mac_policy_mtx, "mac_policy_mtx", NULL, MTX_DEF); - cv_init(&mac_policy_cv, "mac_policy_cv"); -#endif -} - -/* - * For the purposes of modules that want to know if they were loaded - * "early", set the mac_late flag once we've processed modules either - * linked into the kernel, or loaded before the kernel startup. - */ -static void -mac_late_init(void) -{ - - mac_late = 1; -} - -/* - * After the policy list has changed, walk the list to update any global - * flags. Currently, we support only one flag, and it's conditionally - * defined; as a result, the entire function is conditional. Eventually, - * the #else case might also iterate across the policies. - */ -static void -mac_policy_updateflags(void) -{ -#ifndef MAC_ALWAYS_LABEL_MBUF - struct mac_policy_conf *tmpc; - int labelmbufs; - - mac_policy_assert_exclusive(); - - labelmbufs = 0; - LIST_FOREACH(tmpc, &mac_static_policy_list, mpc_list) { - if (tmpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_LABELMBUFS) - labelmbufs++; - } - LIST_FOREACH(tmpc, &mac_policy_list, mpc_list) { - if (tmpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_LABELMBUFS) - labelmbufs++; - } - mac_labelmbufs = (labelmbufs != 0); -#endif -} - -/* - * Allow MAC policy modules to register during boot, etc. - */ -int -mac_policy_modevent(module_t mod, int type, void *data) -{ - struct mac_policy_conf *mpc; - int error; - - error = 0; - mpc = (struct mac_policy_conf *) data; - -#ifdef MAC_STATIC - if (mac_late) { - printf("mac_policy_modevent: MAC_STATIC and late\n"); - return (EBUSY); - } -#endif - - switch (type) { - case MOD_LOAD: - if (mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_NOTLATE && - mac_late) { - printf("mac_policy_modevent: can't load %s policy " - "after booting\n", mpc->mpc_name); - error = EBUSY; - break; - } - error = mac_policy_register(mpc); - break; - case MOD_UNLOAD: - /* Don't unregister the module if it was never registered. */ - if ((mpc->mpc_runtime_flags & MPC_RUNTIME_FLAG_REGISTERED) - != 0) - error = mac_policy_unregister(mpc); - else - error = 0; - break; - default: - break; - } - - return (error); -} - -static int -mac_policy_register(struct mac_policy_conf *mpc) -{ - struct mac_policy_conf *tmpc; - int error, slot, static_entry; - - error = 0; - - /* - * We don't technically need exclusive access while !mac_late, - * but hold it for assertion consistency. - */ - mac_policy_grab_exclusive(); - - /* - * If the module can potentially be unloaded, or we're loading - * late, we have to stick it in the non-static list and pay - * an extra performance overhead. Otherwise, we can pay a - * light locking cost and stick it in the static list. - */ - static_entry = (!mac_late && - !(mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_UNLOADOK)); - - if (static_entry) { - LIST_FOREACH(tmpc, &mac_static_policy_list, mpc_list) { - if (strcmp(tmpc->mpc_name, mpc->mpc_name) == 0) { - error = EEXIST; - goto out; - } - } - } else { - LIST_FOREACH(tmpc, &mac_policy_list, mpc_list) { - if (strcmp(tmpc->mpc_name, mpc->mpc_name) == 0) { - error = EEXIST; - goto out; - } - } - } - if (mpc->mpc_field_off != NULL) { - slot = ffs(mac_slot_offsets_free); - if (slot == 0) { - error = ENOMEM; - goto out; - } - slot--; - mac_slot_offsets_free &= ~(1 << slot); - *mpc->mpc_field_off = slot; - } - mpc->mpc_runtime_flags |= MPC_RUNTIME_FLAG_REGISTERED; - - /* - * If we're loading a MAC module after the framework has - * initialized, it has to go into the dynamic list. If - * we're loading it before we've finished initializing, - * it can go into the static list with weaker locker - * requirements. - */ - if (static_entry) - LIST_INSERT_HEAD(&mac_static_policy_list, mpc, mpc_list); - else - LIST_INSERT_HEAD(&mac_policy_list, mpc, mpc_list); - - /* Per-policy initialization. */ - if (mpc->mpc_ops->mpo_init != NULL) - (*(mpc->mpc_ops->mpo_init))(mpc); - mac_policy_updateflags(); - - printf("Security policy loaded: %s (%s)\n", mpc->mpc_fullname, - mpc->mpc_name); - -out: - mac_policy_release_exclusive(); - return (error); -} - -static int -mac_policy_unregister(struct mac_policy_conf *mpc) -{ - - /* - * If we fail the load, we may get a request to unload. Check - * to see if we did the run-time registration, and if not, - * silently succeed. - */ - mac_policy_grab_exclusive(); - if ((mpc->mpc_runtime_flags & MPC_RUNTIME_FLAG_REGISTERED) == 0) { - mac_policy_release_exclusive(); - return (0); - } -#if 0 - /* - * Don't allow unloading modules with private data. - */ - if (mpc->mpc_field_off != NULL) { - MAC_POLICY_LIST_UNLOCK(); - return (EBUSY); - } -#endif - /* - * Only allow the unload to proceed if the module is unloadable - * by its own definition. - */ - if ((mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_UNLOADOK) == 0) { - mac_policy_release_exclusive(); - return (EBUSY); - } - if (mpc->mpc_ops->mpo_destroy != NULL) - (*(mpc->mpc_ops->mpo_destroy))(mpc); - - LIST_REMOVE(mpc, mpc_list); - mpc->mpc_runtime_flags &= ~MPC_RUNTIME_FLAG_REGISTERED; - mac_policy_updateflags(); - - mac_policy_release_exclusive(); - - printf("Security policy unload: %s (%s)\n", mpc->mpc_fullname, - mpc->mpc_name); - - return (0); -} - -/* - * Define an error value precedence, and given two arguments, selects the - * value with the higher precedence. - */ -static int -error_select(int error1, int error2) -{ - - /* Certain decision-making errors take top priority. */ - if (error1 == EDEADLK || error2 == EDEADLK) - return (EDEADLK); - - /* Invalid arguments should be reported where possible. */ - if (error1 == EINVAL || error2 == EINVAL) - return (EINVAL); - - /* Precedence goes to "visibility", with both process and file. */ - if (error1 == ESRCH || error2 == ESRCH) - return (ESRCH); - - if (error1 == ENOENT || error2 == ENOENT) - return (ENOENT); - - /* Precedence goes to DAC/MAC protections. */ - if (error1 == EACCES || error2 == EACCES) - return (EACCES); - - /* Precedence goes to privilege. */ - if (error1 == EPERM || error2 == EPERM) - return (EPERM); - - /* Precedence goes to error over success; otherwise, arbitrary. */ - if (error1 != 0) - return (error1); - return (error2); -} - -static struct label * -mbuf_to_label(struct mbuf *mbuf) -{ - struct m_tag *tag; - struct label *label; - - tag = m_tag_find(mbuf, PACKET_TAG_MACLABEL, NULL); - label = (struct label *)(tag+1); - - return (label); -} - -static void -mac_init_label(struct label *label) -{ - - bzero(label, sizeof(*label)); - label->l_flags = MAC_FLAG_INITIALIZED; -} - -static void -mac_destroy_label(struct label *label) -{ - - KASSERT(label->l_flags & MAC_FLAG_INITIALIZED, - ("destroying uninitialized label")); - - bzero(label, sizeof(*label)); - /* implicit: label->l_flags &= ~MAC_FLAG_INITIALIZED; */ -} - -void -mac_init_bpfdesc(struct bpf_d *bpf_d) -{ - - mac_init_label(&bpf_d->bd_label); - MAC_PERFORM(init_bpfdesc_label, &bpf_d->bd_label); - MAC_DEBUG_COUNTER_INC(&nmacbpfdescs); -} - -static void -mac_init_cred_label(struct label *label) -{ - - mac_init_label(label); - MAC_PERFORM(init_cred_label, label); - MAC_DEBUG_COUNTER_INC(&nmaccreds); -} - -void -mac_init_cred(struct ucred *cred) -{ - - mac_init_cred_label(&cred->cr_label); -} - -void -mac_init_devfsdirent(struct devfs_dirent *de) -{ - - mac_init_label(&de->de_label); - MAC_PERFORM(init_devfsdirent_label, &de->de_label); - MAC_DEBUG_COUNTER_INC(&nmacdevfsdirents); -} - -static void -mac_init_ifnet_label(struct label *label) -{ - - mac_init_label(label); - MAC_PERFORM(init_ifnet_label, label); - MAC_DEBUG_COUNTER_INC(&nmacifnets); -} - -void -mac_init_ifnet(struct ifnet *ifp) -{ - - mac_init_ifnet_label(&ifp->if_label); -} - -void -mac_init_ipc_msgmsg(struct msg *msgptr) -{ - - mac_init_label(&msgptr->label); - MAC_PERFORM(init_ipc_msgmsg_label, &msgptr->label); - MAC_DEBUG_COUNTER_INC(&nmacipcmsgs); -} - -void -mac_init_ipc_msgqueue(struct msqid_kernel *msqkptr) -{ - - mac_init_label(&msqkptr->label); - MAC_PERFORM(init_ipc_msgqueue_label, &msqkptr->label); - MAC_DEBUG_COUNTER_INC(&nmacipcmsqs); -} - -void -mac_init_ipc_sema(struct semid_kernel *semakptr) -{ - mac_init_label(&semakptr->label); - MAC_PERFORM(init_ipc_sema_label, &semakptr->label); - MAC_DEBUG_COUNTER_INC(&nmacipcsemas); -} - void -mac_init_ipc_shm(struct shmid_kernel *shmsegptr) -{ - - mac_init_label(&shmsegptr->label); - MAC_PERFORM(init_ipc_shm_label, &shmsegptr->label); - MAC_DEBUG_COUNTER_INC(&nmacipcshms); -} - -int -mac_init_ipq(struct ipq *ipq, int flag) -{ - int error; - - mac_init_label(&ipq->ipq_label); - - MAC_CHECK(init_ipq_label, &ipq->ipq_label, flag); - if (error) { - MAC_PERFORM(destroy_ipq_label, &ipq->ipq_label); - mac_destroy_label(&ipq->ipq_label); - } else { - MAC_DEBUG_COUNTER_INC(&nmacipqs); - } - return (error); -} - -int -mac_init_mbuf_tag(struct m_tag *tag, int flag) -{ - struct label *label; - int error; - - label = (struct label *) (tag + 1); - mac_init_label(label); - - MAC_CHECK(init_mbuf_label, label, flag); - if (error) { - MAC_PERFORM(destroy_mbuf_label, label); - mac_destroy_label(label); - } else { - MAC_DEBUG_COUNTER_INC(&nmacmbufs); - } - return (error); -} - -int -mac_init_mbuf(struct mbuf *m, int flag) -{ - struct m_tag *tag; - int error; - - M_ASSERTPKTHDR(m); - -#ifndef MAC_ALWAYS_LABEL_MBUF - /* - * If conditionally allocating mbuf labels, don't allocate unless - * they are required. - */ - if (!mac_labelmbufs) - return (0); -#endif - tag = m_tag_get(PACKET_TAG_MACLABEL, sizeof(struct label), - flag); - if (tag == NULL) - return (ENOMEM); - error = mac_init_mbuf_tag(tag, flag); - if (error) { - m_tag_free(tag); - return (error); - } - m_tag_prepend(m, tag); - return (0); -} - -void -mac_init_mount(struct mount *mp) -{ - - mac_init_label(&mp->mnt_mntlabel); - mac_init_label(&mp->mnt_fslabel); - MAC_PERFORM(init_mount_label, &mp->mnt_mntlabel); - MAC_PERFORM(init_mount_fs_label, &mp->mnt_fslabel); - MAC_DEBUG_COUNTER_INC(&nmacmounts); -} - -static void mac_init_pipe_label(struct label *label) { @@ -1014,209 +115,7 @@ mac_init_pipe_label(label); } -void -mac_init_posix_ksem(struct ksem *ksemptr) -{ - - mac_init_label(&ksemptr->ks_label); - MAC_PERFORM(init_posix_ksem_label, &ksemptr->ks_label); - MAC_DEBUG_COUNTER_INC(&nmacposixksems); -} - void -mac_init_proc(struct proc *p) -{ - - mac_init_label(&p->p_label); - MAC_PERFORM(init_proc_label, &p->p_label); - MAC_DEBUG_COUNTER_INC(&nmacprocs); -} - -static int -mac_init_socket_label(struct label *label, int flag) -{ - int error; - - mac_init_label(label); - - MAC_CHECK(init_socket_label, label, flag); - if (error) { - MAC_PERFORM(destroy_socket_label, label); - mac_destroy_label(label); - } else { - MAC_DEBUG_COUNTER_INC(&nmacsockets); - } - - return (error); -} - -static int -mac_init_socket_peer_label(struct label *label, int flag) -{ >>> TRUNCATED FOR MAIL (1000 lines) <<<
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200310202206.h9KM6900093560>