Sneed-Group/gems-kernel
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
gems-kernel/source/THIRDPARTY/xnu/security/mac_base.c
Sam Sneed f5727805f2 add darwin/xnu functionality
2024-06-03 11:29:39 -05:00

1829 lines
47 KiB
C
Raw Blame History

/*
* Copyright (c) 2007-2020 Apple Inc. All rights reserved.
*
* @APPLE_OSREFERENCE_LICENSE_HEADER_START@
*
* This file contains Original Code and/or Modifications of Original Code
* as defined in and that are subject to the Apple Public Source License
* Version 2.0 (the 'License'). You may not use this file except in
* compliance with the License. The rights granted to you under the License
* may not be used to create, or enable the creation or redistribution of,
* unlawful or unlicensed copies of an Apple operating system, or to
* circumvent, violate, or enable the circumvention or violation of, any
* terms of an Apple operating system software license agreement.
*
* Please obtain a copy of the License at
* http://www.opensource.apple.com/apsl/ and read it before using this file.
*
* The Original Code and all software distributed under the License are
* distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
* EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
* INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
* FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
* Please see the License for the specific language governing rights and
* limitations under the License.
*
* @APPLE_OSREFERENCE_LICENSE_HEADER_END@
*/
/*-
* Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson
* Copyright (c) 2001 Ilmar S. Habibulin
* Copyright (c) 2001, 2002, 2003, 2004 Networks Associates Technology, Inc.
* Copyright (c) 2005-2006 SPARTA, Inc.
*
* This software was developed by Robert Watson and Ilmar Habibulin for the
* TrustedBSD Project.
*
* This software was developed for the FreeBSD Project in part by Network
* Associates Laboratories, the Security Research Division of Network
* Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"),
* as part of the DARPA CHATS research program.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
*/
/*-
* Framework for extensible kernel access control. This file contains
* Kernel and userland interface to the framework, policy registration
* and composition. Per-object interfaces, controls, and labeling may be
* found in src/sys/mac/. Sample policies may be found in src/sys/mac*.
*/
#include <stdarg.h>
#include <string.h>
#include <security/mac_internal.h>
#include <security/mac_mach_internal.h>
#include <sys/param.h>
#include <sys/vnode.h>
#include <sys/vnode_internal.h>
#include <sys/vfs_context.h>
#include <sys/namei.h>
#include <bsd/bsm/audit.h>
#include <bsd/security/audit/audit.h>
#include <bsd/security/audit/audit_private.h>
#include <sys/file.h>
#include <sys/file_internal.h>
#include <sys/filedesc.h>
#include <sys/proc.h>
#include <sys/proc_internal.h>
#include <sys/kauth.h>
#include <sys/sysproto.h>
#include <mach/exception_types.h>
#include <mach/vm_types.h>
#include <mach/vm_prot.h>
#include <kern/kalloc.h>
#include <kern/sched_prim.h>
#include <kern/task.h>
#if CONFIG_MACF
#include <security/mac.h>
#include <security/mac_policy.h>
#include <security/mac_framework.h>
#include <security/mac_internal.h>
#include <security/mac_mach_internal.h>
#endif
#include <libkern/section_keywords.h>
/*
* define MB_DEBUG to display run-time debugging information
* #define MB_DEBUG 1
*/
#ifdef MB_DEBUG
#define DPRINTF(x) printf x
#else
#define MB_DEBUG
#define DPRINTF(x)
#endif
#if CONFIG_MACF
SYSCTL_NODE(, OID_AUTO, security, CTLFLAG_RW | CTLFLAG_LOCKED, 0,
"Security Controls");
SYSCTL_EXTENSIBLE_NODE(_security, OID_AUTO, mac, CTLFLAG_RW | CTLFLAG_LOCKED, 0,
"TrustedBSD MAC policy controls");
/*
* Declare that the kernel provides MAC support, version 1. This permits
* modules to refuse to be loaded if the necessary support isn't present,
* even if it's pre-boot.
*/
#if 0
MODULE_VERSION(kernel_mac_support, 1);
#endif
#if MAC_MAX_SLOTS > 32
#error "MAC_MAX_SLOTS too large"
#endif
static unsigned int mac_max_slots = MAC_MAX_SLOTS;
static unsigned int mac_slot_offsets_free = (1 << MAC_MAX_SLOTS) - 1;
SYSCTL_UINT(_security_mac, OID_AUTO, max_slots, CTLFLAG_RD | CTLFLAG_LOCKED,
&mac_max_slots, 0, "");
/*
* Has the kernel started generating labeled objects yet? All read/write
* access to this variable is serialized during the boot process. Following
* the end of serialization, we don't update this flag; no locking.
*/
int mac_late = 0;
/*
* Flag to indicate whether or not we should allocate label storage for
* new vnodes. Since most dynamic policies we currently work with don't
* rely on vnode labeling, try to avoid paying the cost of mtag allocation
* unless specifically notified of interest. One result of this is
* that if a dynamically loaded policy requests vnode labels, it must
* be able to deal with a NULL label being returned on any vnodes that
* were already in flight when the policy was loaded. Since the policy
* already has to deal with uninitialized labels, this probably won't
* be a problem.
*/
#if CONFIG_MACF_LAZY_VNODE_LABELS
unsigned int mac_label_vnodes = 1;
#else
unsigned int mac_label_vnodes = 0;
#endif /* CONFIG_MACF_LAZY_VNODE_LABELS */
SYSCTL_UINT(_security_mac, OID_AUTO, labelvnodes, SECURITY_MAC_CTLFLAGS
#if CONFIG_MACF_LAZY_VNODE_LABELS
| CTLFLAG_RD
#endif
, &mac_label_vnodes, 0, "Label all vnodes");
unsigned int mac_vnode_label_count = 0;
SYSCTL_UINT(_security_mac, OID_AUTO, vnode_label_count, SECURITY_MAC_CTLFLAGS | CTLFLAG_RD,
&mac_vnode_label_count, 0, "Count of vnode labels");
unsigned int mac_device_enforce = 1;
SYSCTL_UINT(_security_mac, OID_AUTO, device_enforce, SECURITY_MAC_CTLFLAGS,
&mac_device_enforce, 0, "Enforce MAC policy on device operations");
unsigned int mac_pipe_enforce = 1;
SYSCTL_UINT(_security_mac, OID_AUTO, pipe_enforce, SECURITY_MAC_CTLFLAGS,
&mac_pipe_enforce, 0, "Enforce MAC policy on pipe operations");
unsigned int mac_posixsem_enforce = 1;
SYSCTL_UINT(_security_mac, OID_AUTO, posixsem_enforce, SECURITY_MAC_CTLFLAGS,
&mac_posixsem_enforce, 0, "Enforce MAC policy on POSIX semaphores");
unsigned int mac_posixshm_enforce = 1;
SYSCTL_UINT(_security_mac, OID_AUTO, posixshm_enforce, SECURITY_MAC_CTLFLAGS,
&mac_posixshm_enforce, 0, "Enforce MAC policy on Posix Shared Memory");
unsigned int mac_proc_enforce = 1;
SYSCTL_UINT(_security_mac, OID_AUTO, proc_enforce, SECURITY_MAC_CTLFLAGS,
&mac_proc_enforce, 0, "Enforce MAC policy on process operations");
unsigned int mac_socket_enforce = 1;
SYSCTL_UINT(_security_mac, OID_AUTO, socket_enforce, SECURITY_MAC_CTLFLAGS,
&mac_socket_enforce, 0, "Enforce MAC policy on socket operations");
unsigned int mac_system_enforce = 1;
SYSCTL_UINT(_security_mac, OID_AUTO, system_enforce, SECURITY_MAC_CTLFLAGS,
&mac_system_enforce, 0, "Enforce MAC policy on system-wide interfaces");
unsigned int mac_sysvmsg_enforce = 1;
SYSCTL_UINT(_security_mac, OID_AUTO, sysvmsg_enforce, SECURITY_MAC_CTLFLAGS,
&mac_sysvmsg_enforce, 0, "Enforce MAC policy on System V IPC message queues");
unsigned int mac_sysvsem_enforce = 1;
SYSCTL_UINT(_security_mac, OID_AUTO, sysvsem_enforce, SECURITY_MAC_CTLFLAGS,
&mac_sysvsem_enforce, 0, "Enforce MAC policy on System V IPC semaphores");
unsigned int mac_sysvshm_enforce = 1;
SYSCTL_INT(_security_mac, OID_AUTO, sysvshm_enforce, SECURITY_MAC_CTLFLAGS,
&mac_sysvshm_enforce, 0, "Enforce MAC policy on System V Shared Memory");
unsigned int mac_vm_enforce = 1;
SYSCTL_INT(_security_mac, OID_AUTO, vm_enforce, SECURITY_MAC_CTLFLAGS,
&mac_vm_enforce, 0, "Enforce MAC policy on VM operations");
unsigned int mac_vnode_enforce = 1;
SYSCTL_UINT(_security_mac, OID_AUTO, vnode_enforce, SECURITY_MAC_CTLFLAGS,
&mac_vnode_enforce, 0, "Enforce MAC policy on vnode operations");
/*
* mac_policy_list holds the list of policy modules. Modules with a
* handle lower than staticmax are considered "static" and cannot be
* unloaded. Such policies can be invoked without holding the busy count.
*
* Modules with a handle at or above the staticmax high water mark
* are considered to be "dynamic" policies. A busy count is maintained
* for the list, stored in mac_policy_busy. The busy count is protected
* by mac_policy_mtx; the list may be modified only while the busy
* count is 0, requiring that the lock be held to prevent new references
* to the list from being acquired. For almost all operations,
* incrementing the busy count is sufficient to guarantee consistency,
* as the list cannot be modified while the busy count is elevated.
* For a few special operations involving a change to the list of
* active policies, the mtx itself must be held.
*/
static LCK_GRP_DECLARE(mac_lck_grp, "MAC lock");
static LCK_MTX_DECLARE(mac_policy_mtx, &mac_lck_grp);
/*
* Policy list array allocation chunk size. Each entry holds a pointer.
*/
#define MAC_POLICY_LIST_CHUNKSIZE 8
static int mac_policy_busy;
#if !XNU_TARGET_OS_OSX
SECURITY_READ_ONLY_LATE(mac_policy_list_t) mac_policy_list;
SECURITY_READ_ONLY_LATE(static struct mac_policy_list_element) mac_policy_static_entries[MAC_POLICY_LIST_CHUNKSIZE];
#else
mac_policy_list_t mac_policy_list;
#endif
/*
* mac_label_element_list holds the master list of label namespaces for
* all the policies. When a policy is loaded, each of it's label namespace
* elements is added to the master list if not already present. When a
* policy is unloaded, the namespace elements are removed if no other
* policy is interested in that namespace element.
*/
struct mac_label_element_list_t mac_label_element_list;
struct mac_label_element_list_t mac_static_label_element_list;
static __inline void
mac_policy_grab_exclusive(void)
{
lck_mtx_lock(&mac_policy_mtx);
while (mac_policy_busy != 0) {
lck_mtx_sleep(&mac_policy_mtx, LCK_SLEEP_UNLOCK,
(event_t)&mac_policy_busy, THREAD_UNINT);
lck_mtx_lock(&mac_policy_mtx);
}
}
static __inline void
mac_policy_release_exclusive(void)
{
KASSERT(mac_policy_busy == 0,
("mac_policy_release_exclusive(): not exclusive"));
lck_mtx_unlock(&mac_policy_mtx);
thread_wakeup((event_t) &mac_policy_busy);
}
void
mac_policy_list_busy(void)
{
lck_mtx_lock(&mac_policy_mtx);
mac_policy_busy++;
lck_mtx_unlock(&mac_policy_mtx);
}
int
mac_policy_list_conditional_busy(void)
{
int ret;
if (mac_policy_list.numloaded <= mac_policy_list.staticmax) {
return 0;
}
lck_mtx_lock(&mac_policy_mtx);
if (mac_policy_list.numloaded > mac_policy_list.staticmax) {
mac_policy_busy++;
ret = 1;
} else {
ret = 0;
}
lck_mtx_unlock(&mac_policy_mtx);
return ret;
}
void
mac_policy_list_unbusy(void)
{
lck_mtx_lock(&mac_policy_mtx);
mac_policy_busy--;
KASSERT(mac_policy_busy >= 0, ("MAC_POLICY_LIST_LOCK"));
if (mac_policy_busy == 0) {
thread_wakeup(&mac_policy_busy);
}
lck_mtx_unlock(&mac_policy_mtx);
}
/*
* Early pre-malloc MAC initialization, including appropriate SMP locks.
*/
void
mac_policy_init(void)
{
mac_policy_list.numloaded = 0;
mac_policy_list.max = MAC_POLICY_LIST_CHUNKSIZE;
mac_policy_list.maxindex = 0;
mac_policy_list.staticmax = 0;
mac_policy_list.freehint = 0;
mac_policy_list.chunks = 1;
#if !XNU_TARGET_OS_OSX
mac_policy_list.entries = mac_policy_static_entries;
#else
mac_policy_list.entries = kalloc_type(struct mac_policy_list_element,
MAC_POLICY_LIST_CHUNKSIZE, Z_WAITOK | Z_ZERO);
#endif
SLIST_INIT(&mac_label_element_list);
SLIST_INIT(&mac_static_label_element_list);
}
/* Function pointer set up for loading security extensions.
* It is set to an actual function after OSlibkernInit()
* has been called, and is set back to 0 by OSKextRemoveKextBootstrap()
* after bsd_init().
*/
void (*load_security_extensions_function)(void) = 0;
/*
* Init after early Mach startup, but before BSD
*/
void
mac_policy_initmach(void)
{
/*
* For the purposes of modules that want to know if they were
* loaded "early", set the mac_late flag once we've processed
* modules either linked into the kernel, or loaded before the
* kernel startup.
*/
if (load_security_extensions_function) {
load_security_extensions_function();
}
mac_late = 1;
}
/*
* BSD startup.
*/
void
mac_policy_initbsd(void)
{
struct mac_policy_conf *mpc;
u_int i;
printf("MAC Framework successfully initialized\n");
/* Call bsd init functions of already loaded policies */
/*
* Using the exclusive lock means no other framework entry
* points can proceed while initializations are running.
* This may not be necessary.
*/
mac_policy_grab_exclusive();
for (i = 0; i <= mac_policy_list.maxindex; i++) {
mpc = mac_get_mpc(i);
if ((mpc != NULL) && (mpc->mpc_ops->mpo_policy_initbsd != NULL)) {
(*(mpc->mpc_ops->mpo_policy_initbsd))(mpc);
}
}
mac_policy_release_exclusive();
}
/*
* After a policy has been loaded, add the label namespaces managed by the
* policy to either the static or non-static label namespace list.
* A namespace is added to the the list only if it is not already on one of
* the lists.
*/
void
mac_policy_addto_labellist(mac_policy_handle_t handle, int static_entry)
{
struct mac_label_element *mle, *mle_tmp;
struct mac_label_listener *mll, *mll_tmp;
struct mac_label_element_list_t *list;
struct mac_policy_conf *mpc;
const char *name, *name2;
struct mac_label_element_list_t mles = SLIST_HEAD_INITIALIZER(mles);
struct mac_label_listeners_t mlls = SLIST_HEAD_INITIALIZER(mlls);
mpc = mac_get_mpc(handle);
if (mpc->mpc_labelnames == NULL) {
return;
}
if (mpc->mpc_labelname_count == 0) {
return;
}
if (static_entry) {
list = &mac_static_label_element_list;
} else {
list = &mac_label_element_list;
}
/*
* Before we grab the policy list lock, allocate enough memory
* to contain the potential new elements so we don't have to
* give up the lock, or allocate with the lock held.
*/
for (uint32_t idx = 0; idx < mpc->mpc_labelname_count; idx++) {
mle = kalloc_type(struct mac_label_element, Z_WAITOK_ZERO_NOFAIL);
SLIST_INSERT_HEAD(&mles, mle, mle_list);
mll = kalloc_type(struct mac_label_listener, Z_WAITOK);
SLIST_INSERT_HEAD(&mlls, mll, mll_list);
}
if (mac_late) {
mac_policy_grab_exclusive();
}
for (uint32_t idx = 0; idx < mpc->mpc_labelname_count; idx++) {
if (*(name = mpc->mpc_labelnames[idx]) == '?') {
name++;
}
/*
* Check both label element lists and add to the
* appropriate list only if not already on a list.
*/
SLIST_FOREACH(mle, &mac_static_label_element_list, mle_list) {
if (*(name2 = mle->mle_name) == '?') {
name2++;
}
if (strcmp(name, name2) == 0) {
break;
}
}
if (mle == NULL) {
SLIST_FOREACH(mle, &mac_label_element_list, mle_list) {
if (*(name2 = mle->mle_name) == '?') {
name2++;
}
if (strcmp(name, name2) == 0) {
break;
}
}
}
if (mle == NULL) {
mle = SLIST_FIRST(&mles);
SLIST_REMOVE_HEAD(&mles, mle_list);
strlcpy(mle->mle_name, mpc->mpc_labelnames[idx],
MAC_MAX_LABEL_ELEMENT_NAME);
SLIST_INIT(&mle->mle_listeners);
SLIST_INSERT_HEAD(list, mle, mle_list);
}
mll = SLIST_FIRST(&mlls);
SLIST_REMOVE_HEAD(&mlls, mll_list);
/* Add policy handler as a listener. */
mll->mll_handle = handle;
SLIST_INSERT_HEAD(&mle->mle_listeners, mll, mll_list);
}
if (mac_late) {
mac_policy_release_exclusive();
}
SLIST_FOREACH_SAFE(mle, &mles, mle_list, mle_tmp) {
kfree_type(struct mac_label_element, mle);
}
SLIST_FOREACH_SAFE(mll, &mlls, mll_list, mll_tmp) {
kfree_type(struct mac_label_listener, mll);
}
}
/*
* After a policy has been unloaded, remove the label namespaces that the
* the policy manages from the non-static list of namespaces.
* The removal only takes place when no other policy is interested in the
* namespace.
*
* Must be called with the policy exclusive lock held.
*/
void
mac_policy_removefrom_labellist(mac_policy_handle_t handle)
{
struct mac_label_listener *mll, **mllp;
struct mac_label_element *mle, **mlep;
struct mac_policy_conf *mpc;
mpc = mac_get_mpc(handle);
if (mpc->mpc_labelnames == NULL) {
return;
}
if (mpc->mpc_labelname_count == 0) {
return;
}
/*
* Unregister policy as being interested in any label
* namespaces. If no other policy is listening, remove
* that label element from the list. Note that we only
* have to worry about the non-static list.
*/
SLIST_FOREACH_PREVPTR(mle, mlep, &mac_label_element_list, mle_list) {
SLIST_FOREACH_PREVPTR(mll, mllp, &mle->mle_listeners, mll_list) {
if (mll->mll_handle == handle) {
*mllp = SLIST_NEXT(mll, mll_list);
kfree_type(struct mac_label_listener, mll);
if (SLIST_EMPTY(&mle->mle_listeners)) {
*mlep = SLIST_NEXT(mle, mle_list);
kfree_type(struct mac_label_element, mle);
}
return;
}
}
}
}
/*
* After the policy list has changed, walk the list to update any global
* flags.
*/
static void
mac_policy_updateflags(void)
{
}
static __inline void
mac_policy_fixup_mmd_list(struct mac_module_data *new)
{
struct mac_module_data *old;
struct mac_module_data_element *ele, *aele;
struct mac_module_data_list *arr, *dict;
unsigned int i, j, k;
old = new->base_addr;
DPRINTF(("fixup_mmd: old %p new %p\n", old, new));
for (i = 0; i < new->count; i++) {
ele = &(new->data[i]);
DPRINTF(("fixup_mmd: ele %p\n", ele));
DPRINTF((" key %p value %p\n", ele->key, ele->value));
mmd_fixup_ele(old, new, ele); /* Fix up key/value ptrs. */
DPRINTF((" key %p value %p\n", ele->key, ele->value));
if (ele->value_type == MAC_DATA_TYPE_ARRAY) {
arr = (struct mac_module_data_list *)ele->value;
DPRINTF(("fixup_mmd: array @%p\n", arr));
for (j = 0; j < arr->count; j++) {
aele = &(arr->list[j]);
DPRINTF(("fixup_mmd: aele %p\n", aele));
DPRINTF((" key %p value %p\n", aele->key, aele->value));
mmd_fixup_ele(old, new, aele);
DPRINTF((" key %p value %p\n", aele->key, aele->value));
if (arr->type == MAC_DATA_TYPE_DICT) {
dict = (struct mac_module_data_list *)aele->value;
DPRINTF(("fixup_mmd: dict @%p\n", dict));
for (k = 0; k < dict->count; k++) {
mmd_fixup_ele(old, new,
&(dict->list[k]));
}
}
}
}
}
new->base_addr = new;
}
int
mac_policy_register(struct mac_policy_conf *mpc, mac_policy_handle_t *handlep,
void *xd)
{
#if XNU_TARGET_OS_OSX
struct mac_policy_list_element *tmac_policy_list_element;
#endif
int error, slot, static_entry = 0;
u_int i;
/*
* Some preliminary checks to make sure the policy's conf structure
* contains the required fields.
*/
if (mpc->mpc_name == NULL) {
panic("policy's name is not set");
}
if (mpc->mpc_fullname == NULL) {
panic("policy's full name is not set");
}
if (mpc->mpc_labelname_count > MAC_MAX_MANAGED_NAMESPACES) {
panic("policy's managed label namespaces exceeds maximum");
}
if (mpc->mpc_ops == NULL) {
panic("policy's OPs field is NULL");
}
error = 0;
if (mac_late) {
if (mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_NOTLATE) {
printf("Module %s does not support late loading.\n",
mpc->mpc_name);
return EPERM;
}
mac_policy_grab_exclusive();
}
if (mac_policy_list.numloaded >= mac_policy_list.max) {
#if XNU_TARGET_OS_OSX
/* allocate new policy list array, zero new chunk */
tmac_policy_list_element =
kalloc_type(struct mac_policy_list_element,
MAC_POLICY_LIST_CHUNKSIZE * (mac_policy_list.chunks + 1),
Z_WAITOK | Z_ZERO);
/* copy old entries into new list */
memcpy(tmac_policy_list_element, mac_policy_list.entries,
sizeof(struct mac_policy_list_element) *
MAC_POLICY_LIST_CHUNKSIZE * mac_policy_list.chunks);
/* free old array */
kfree_type(struct mac_policy_list_element,
MAC_POLICY_LIST_CHUNKSIZE * mac_policy_list.chunks,
mac_policy_list.entries);
mac_policy_list.entries = tmac_policy_list_element;
/* Update maximums, etc */
mac_policy_list.max += MAC_POLICY_LIST_CHUNKSIZE;
mac_policy_list.chunks++;
#else
printf("out of space in mac_policy_list.\n");
return ENOMEM;
#endif /* XNU_TARGET_OS_OSX */
}
/* Check for policy with same name already loaded */
for (i = 0; i <= mac_policy_list.maxindex; i++) {
if (mac_policy_list.entries[i].mpc == NULL) {
continue;
}
if (strcmp(mac_policy_list.entries[i].mpc->mpc_name,
mpc->mpc_name) == 0) {
error = EEXIST;
goto out;
}
}
if (mpc->mpc_field_off != NULL) {
slot = ffs(mac_slot_offsets_free);
if (slot == 0) {
error = ENOMEM;
goto out;
}
slot--;
mac_slot_offsets_free &= ~(1 << slot);
*mpc->mpc_field_off = slot;
}
mpc->mpc_runtime_flags |= MPC_RUNTIME_FLAG_REGISTERED;
if (xd) {
struct mac_module_data *mmd = xd; /* module data from plist */
/* Make a copy of the data. */
mpc->mpc_data = (void *)kalloc_data(mmd->size, Z_WAITOK);
if (mpc->mpc_data != NULL) {
memcpy(mpc->mpc_data, mmd, mmd->size);
/* Fix up pointers after copy. */
mac_policy_fixup_mmd_list(mpc->mpc_data);
}
}
/* Find the first free handle in the list (using our hint). */
for (i = mac_policy_list.freehint; i < mac_policy_list.max; i++) {
if (mac_policy_list.entries[i].mpc == NULL) {
*handlep = i;
mac_policy_list.freehint = ++i;
break;
}
}
/*
* If we are loading a MAC module before the framework has
* finished initializing or the module is not unloadable and
* we can place its handle adjacent to the last static entry,
* bump the static policy high water mark.
* Static policies can get by with weaker locking requirements.
*/
if (!mac_late ||
((mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_UNLOADOK) == 0 &&
*handlep == mac_policy_list.staticmax)) {
static_entry = 1;
mac_policy_list.staticmax++;
}
mac_policy_list.entries[*handlep].mpc = mpc;
/* Update counters, etc */
if (*handlep > mac_policy_list.maxindex) {
mac_policy_list.maxindex = *handlep;
}
mac_policy_list.numloaded++;
/* Per-policy initialization. */
printf("calling mpo_policy_init for %s\n", mpc->mpc_name);
if (mpc->mpc_ops->mpo_policy_init != NULL) {
(*(mpc->mpc_ops->mpo_policy_init))(mpc);
}
if (mac_late && mpc->mpc_ops->mpo_policy_initbsd != NULL) {
printf("calling mpo_policy_initbsd for %s\n", mpc->mpc_name);
(*(mpc->mpc_ops->mpo_policy_initbsd))(mpc);
}
mac_policy_updateflags();
if (mac_late) {
mac_policy_release_exclusive();
}
mac_policy_addto_labellist(*handlep, static_entry);
printf("Security policy loaded: %s (%s)\n", mpc->mpc_fullname,
mpc->mpc_name);
return 0;
out:
if (mac_late) {
mac_policy_release_exclusive();
}
return error;
}
int
mac_policy_unregister(mac_policy_handle_t handle)
{
struct mac_policy_conf *mpc;
/*
* If we fail the load, we may get a request to unload. Check
* to see if we did the run-time registration, and if not,
* silently succeed.
*/
mac_policy_grab_exclusive();
mpc = mac_get_mpc(handle);
if ((mpc->mpc_runtime_flags & MPC_RUNTIME_FLAG_REGISTERED) == 0) {
mac_policy_release_exclusive();
return 0;
}
#if 0
/*
* Don't allow unloading modules with private data.
*/
if (mpc->mpc_field_off != NULL) {
MAC_POLICY_LIST_UNLOCK();
return EBUSY;
}
#endif
/*
* Only allow the unload to proceed if the module is unloadable
* by its own definition.
*/
if ((mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_UNLOADOK) == 0) {
mac_policy_release_exclusive();
return EBUSY;
}
mac_policy_removefrom_labellist(handle);
mac_get_mpc(handle) = NULL;
if (handle < mac_policy_list.freehint &&
handle >= mac_policy_list.staticmax) {
mac_policy_list.freehint = handle;
}
if (handle == mac_policy_list.maxindex) {
mac_policy_list.maxindex--;
}
mac_policy_list.numloaded--;
if (mpc->mpc_field_off != NULL) {
mac_slot_offsets_free |= (1 << *mpc->mpc_field_off);
}
if (mpc->mpc_ops->mpo_policy_destroy != NULL) {
(*(mpc->mpc_ops->mpo_policy_destroy))(mpc);
}
mpc->mpc_runtime_flags &= ~MPC_RUNTIME_FLAG_REGISTERED;
mac_policy_updateflags();
mac_policy_release_exclusive();
if (mpc->mpc_data) {
struct mac_module_data *mmd = mpc->mpc_data;
__typed_allocators_ignore(kfree_data(mmd, mmd->size)); // rdar://87952845
mpc->mpc_data = NULL;
}
printf("Security policy unload: %s (%s)\n", mpc->mpc_fullname,
mpc->mpc_name);
return 0;
}
/*
* Define an error value precedence, and given two arguments, selects the
* value with the higher precedence.
*/
int
mac_error_select(int error1, int error2)
{
/* Certain decision-making errors take top priority. */
if (error1 == EDEADLK || error2 == EDEADLK) {
return EDEADLK;
}
/* Invalid arguments should be reported where possible. */
if (error1 == EINVAL || error2 == EINVAL) {
return EINVAL;
}
/* Precedence goes to "visibility", with both process and file. */
if (error1 == ESRCH || error2 == ESRCH) {
return ESRCH;
}
if (error1 == ENOENT || error2 == ENOENT) {
return ENOENT;
}
/* Precedence goes to DAC/MAC protections. */
if (error1 == EACCES || error2 == EACCES) {
return EACCES;
}
/* Precedence goes to privilege. */
if (error1 == EPERM || error2 == EPERM) {
return EPERM;
}
/* Precedence goes to error over success; otherwise, arbitrary. */
if (error1 != 0) {
return error1;
}
return error2;
}
int
mac_check_structmac_consistent(struct user_mac *mac)
{
if (mac->m_buflen > MAC_MAX_LABEL_BUF_LEN || mac->m_buflen == 0) {
return EINVAL;
}
return 0;
}
/*
* Get the external forms of labels from all policies, for a single
* label namespace or "*" for all namespaces. Returns ENOENT if no policy
* is registered for the namespace, unless the namespace begins with a '?'.
*/
static int
mac_label_externalize(size_t mpo_externalize_off, struct label *label,
const char *element, struct sbuf *sb)
{
struct mac_policy_conf *mpc;
struct mac_label_listener *mll;
struct mac_label_element *mle;
struct mac_label_element_list_t *element_list;
const char *name;
int (*mpo_externalize)(struct label *, char *, struct sbuf *);
int all_labels = 0, ignorenotfound = 0, error = 0, busy = FALSE;
int sb_pos;
unsigned int count = 0;
if (element[0] == '?') {
element++;
ignorenotfound = 1;
} else if (element[0] == '*' && element[1] == '\0') {
all_labels = 1;
}
element_list = &mac_static_label_element_list;
element_loop:
SLIST_FOREACH(mle, element_list, mle_list) {
name = mle->mle_name;
if (all_labels) {
if (*name == '?') {
continue;
}
} else {
if (*name == '?') {
name++;
}
if (strcmp(name, element) != 0) {
continue;
}
}
SLIST_FOREACH(mll, &mle->mle_listeners, mll_list) {
mpc = mac_policy_list.entries[mll->mll_handle].mpc;
if (mpc == NULL) {
continue;
}
mpo_externalize = *(const typeof(mpo_externalize) *)
((const char *)mpc->mpc_ops + mpo_externalize_off);
if (mpo_externalize == NULL) {
continue;
}
sb_pos = sbuf_len(sb);
error = sbuf_printf(sb, "%s/", name);
if (error) {
goto done;
}
error = mpo_externalize(label, mle->mle_name, sb);
if (error) {
if (error != ENOENT) {
goto done;
}
/*
* If a policy doesn't have a label to
* externalize it returns ENOENT. This
* may occur for policies that support
* multiple label elements for some
* (but not all) object types.
*/
sbuf_setpos(sb, sb_pos);
error = 0;
continue;
}
error = sbuf_putc(sb, ',');
if (error) {
goto done;
}
count++;
}
}
/* If there are dynamic policies present, check their elements too. */
if (!busy && mac_policy_list_conditional_busy() == 1) {
element_list = &mac_label_element_list;
busy = TRUE;
goto element_loop;
}
done:
if (busy) {
mac_policy_list_unbusy();
}
if (!error && count == 0) {
if (!all_labels && !ignorenotfound) {
error = ENOENT; /* XXX: ENOLABEL? */
}
}
return error;
}
/*
* Get the external forms of labels from all policies, for all label
* namespaces contained in a list.
*
* XXX This may be leaking an sbuf.
*/
int
mac_externalize(size_t mpo_externalize_off, struct label *label,
const char *elementlist, char *outbuf, size_t outbuflen)
{
char *element;
char *scratch_base;
char *scratch;
struct sbuf sb;
int error = 0, len;
size_t buf_len = strlen(elementlist) + 1;
/* allocate a scratch buffer the size of the string */
scratch_base = kalloc_data(buf_len, Z_WAITOK);
if (scratch_base == NULL) {
error = ENOMEM;
goto out;
}
/* copy the elementlist to the scratch buffer */
strlcpy(scratch_base, elementlist, buf_len);
/*
* set up a temporary pointer that can be used to iterate the
* scratch buffer without losing the allocation address
*/
scratch = scratch_base;
/*
* initialize an sbuf mapping over the output buffer (or newly-allocated internal buffer, if
* outbuf is NULL), up to sbuf's limit of INT_MAX.
*/
if (outbuflen > INT_MAX) {
outbuflen = INT_MAX;
}
if (sbuf_new(&sb, outbuf, (int)outbuflen, SBUF_FIXEDLEN) == NULL) {
/* could not allocate interior buffer */
error = ENOMEM;
goto out;
}
/* iterate the scratch buffer; NOTE: buffer contents modified! */
while ((element = strsep(&scratch, ",")) != NULL) {
error = mac_label_externalize(mpo_externalize_off, label,
element, &sb);
if (error) {
break;
}
}
if ((len = sbuf_len(&sb)) > 0) {
sbuf_setpos(&sb, len - 1); /* trim trailing comma */
}
sbuf_finish(&sb);
out:
if (scratch_base != NULL) {
kfree_data(scratch_base, buf_len);
}
return error;
}
/*
* Have all policies set the internal form of a label, for a single
* label namespace.
*/
static int
mac_label_internalize(size_t mpo_internalize_off, struct label *label,
char *element_name, char *element_data)
{
struct mac_policy_conf *mpc;
struct mac_label_listener *mll;
struct mac_label_element *mle;
struct mac_label_element_list_t *element_list;
int (*mpo_internalize)(struct label *, char *, char *);
int error = 0, busy = FALSE;
unsigned int count = 0;
const char *name;
element_list = &mac_static_label_element_list;
element_loop:
SLIST_FOREACH(mle, element_list, mle_list) {
if (*(name = mle->mle_name) == '?') {
name++;
}
if (strcmp(element_name, name) != 0) {
continue;
}
SLIST_FOREACH(mll, &mle->mle_listeners, mll_list) {
mpc = mac_policy_list.entries[mll->mll_handle].mpc;
if (mpc == NULL) {
continue;
}
mpo_internalize = *(const typeof(mpo_internalize) *)
((const char *)mpc->mpc_ops + mpo_internalize_off);
if (mpo_internalize == NULL) {
continue;
}
error = mpo_internalize(label, element_name,
element_data);
if (error) {
goto done;
}
count++;
}
}
/* If there are dynamic policies present, check their elements too. */
if (!busy && mac_policy_list_conditional_busy() == 1) {
element_list = &mac_label_element_list;
busy = TRUE;
goto element_loop;
}
done:
if (busy) {
mac_policy_list_unbusy();
}
if (!error && count == 0) {
error = ENOPOLICY;
}
return error;
}
int
mac_internalize(size_t mpo_internalize_off, struct label *label,
char *textlabels)
{
char *element_name, *element_data;
int error = 0;
while (!error && (element_name = strsep(&textlabels, ",")) != NULL) {
element_data = strchr(element_name, '/');
if (element_data == NULL) {
error = EINVAL;
break;
}
*element_data++ = '\0';
error = mac_label_internalize(mpo_internalize_off, label,
element_name, element_data);
}
return error;
}
static int
user_mac_copyin(struct proc *p, user_addr_t mac_p, struct user_mac *mac)
{
int error;
if (IS_64BIT_PROCESS(p)) {
struct user64_mac mac64;
if ((error = copyin(mac_p, &mac64, sizeof(mac64)))) {
return error;
}
mac->m_buflen = mac64.m_buflen;
mac->m_string = mac64.m_string;
} else {
struct user32_mac mac32;
if ((error = copyin(mac_p, &mac32, sizeof(mac32)))) {
return error;
}
mac->m_buflen = mac32.m_buflen;
mac->m_string = mac32.m_string;
}
return mac_check_structmac_consistent(mac);
}
int
mac_do_get(struct proc *p, user_addr_t mac_p, mac_getter_t getter)
{
struct user_mac mac;
char *input;
char *output;
size_t len;
size_t ulen;
int error;
if ((error = user_mac_copyin(p, mac_p, &mac))) {
return error;
}
len = mac.m_buflen;
input = kalloc_data(len, Z_WAITOK);
if ((error = copyinstr(mac.m_string, input, len, &ulen))) {
kfree_data(input, len);
return error;
}
AUDIT_ARG(mac_string, input);
output = kalloc_data(len, Z_WAITOK | Z_ZERO);
error = getter(input, output, len);
if (error == 0) {
/* mac_check_structmac_consistent => len > 0 */
output[len - 1] = '\0';
error = copyout(output, mac.m_string, strlen(output) + 1);
}
kfree_data(output, len);
kfree_data(input, len);
return error;
}
int
mac_do_set(struct proc *p, user_addr_t mac_p, mac_setter_t setter)
{
struct user_mac mac;
char *input;
size_t len;
size_t ulen;
int error;
if ((error = user_mac_copyin(p, mac_p, &mac))) {
return error;
}
len = mac.m_buflen;
input = kalloc_data(len, Z_WAITOK);
if ((error = copyinstr(mac.m_string, input, len, &ulen))) {
kfree_data(input, len);
return error;
}
AUDIT_ARG(mac_string, input);
error = setter(input, len);
kfree_data(input, len);
return error;
}
/* system calls */
int
__mac_get_pid(struct proc *p, struct __mac_get_pid_args *uap, int *ret __unused)
{
return mac_do_get(p, uap->mac_p,
^(char *input, char *output, size_t len) {
struct ucred *tcred;
int error;
AUDIT_ARG(pid, uap->pid);
tcred = kauth_cred_proc_ref_for_pid(uap->pid);
if (tcred == NOCRED) {
return ESRCH;
}
error = mac_cred_label_externalize(mac_cred_label(tcred),
input, output, len, M_WAITOK);
kauth_cred_unref(&tcred);
return error;
});
}
int
__mac_get_proc(proc_t p, struct __mac_get_proc_args *uap, int *ret __unused)
{
return mac_do_get(p, uap->mac_p,
^(char *input, char *output, size_t len) {
struct label *label;
label = mac_cred_label(kauth_cred_get());
return mac_cred_label_externalize(label, input, output, len, M_WAITOK);
});
}
int
__mac_set_proc(proc_t p, struct __mac_set_proc_args *uap, int *ret __unused)
{
return mac_do_set(p, uap->mac_p,
^(char *input, __unused size_t len) {
struct label *intlabel;
int error;
intlabel = mac_cred_label_alloc();
if ((error = mac_cred_label_internalize(intlabel, input))) {
goto out;
}
if ((error = mac_cred_check_label_update(kauth_cred_get(), intlabel))) {
goto out;
}
error = kauth_proc_label_update(p, intlabel);
out:
mac_cred_label_free(intlabel);
return error;
});
}
int
__mac_get_fd(proc_t p, struct __mac_get_fd_args *uap, int *ret __unused)
{
return mac_do_get(p, uap->mac_p,
^(char *input, char *output, size_t len) {
struct fileproc *fp;
struct vnode *vp;
int error;
struct label *intlabel;
AUDIT_ARG(fd, uap->fd);
if ((error = fp_lookup(p, uap->fd, &fp, 0))) {
return error;
}
error = mac_file_check_get(kauth_cred_get(), fp->fp_glob, input, len);
if (error) {
fp_drop(p, uap->fd, fp, 0);
return error;
}
switch (FILEGLOB_DTYPE(fp->fp_glob)) {
case DTYPE_VNODE:
intlabel = mac_vnode_label_alloc(NULL);
if (intlabel == NULL) {
error = ENOMEM;
break;
}
vp = (struct vnode *)fp_get_data(fp);
error = vnode_getwithref(vp);
if (error == 0) {
mac_vnode_label_copy(mac_vnode_label(vp), intlabel);
error = mac_vnode_label_externalize(intlabel,
input, output, len, M_WAITOK);
vnode_put(vp);
}
mac_vnode_label_free(intlabel);
break;
case DTYPE_SOCKET:
case DTYPE_PSXSHM:
case DTYPE_PSXSEM:
case DTYPE_PIPE:
case DTYPE_KQUEUE:
case DTYPE_FSEVENTS:
case DTYPE_ATALK:
case DTYPE_NETPOLICY:
case DTYPE_CHANNEL:
case DTYPE_NEXUS:
default:
error = ENOSYS; // only sockets/vnodes so far
break;
}
fp_drop(p, uap->fd, fp, 0);
return error;
});
}
static int
mac_get_filelink(proc_t p, user_addr_t mac_p, user_addr_t path_p, int follow)
{
return mac_do_get(p, mac_p,
^(char *input, char *output, size_t len) {
struct vnode *vp;
struct nameidata nd;
struct label *intlabel;
int error;
NDINIT(&nd, LOOKUP, OP_LOOKUP,
LOCKLEAF | (follow ? FOLLOW : NOFOLLOW) | AUDITVNPATH1,
UIO_USERSPACE, path_p,
vfs_context_current());
if ((error = namei(&nd))) {
return error;
}
vp = nd.ni_vp;
nameidone(&nd);
intlabel = mac_vnode_label_alloc(NULL);
mac_vnode_label_copy(mac_vnode_label(vp), intlabel);
error = mac_vnode_label_externalize(intlabel, input, output,
len, M_WAITOK);
mac_vnode_label_free(intlabel);
vnode_put(vp);
return error;
});
}
int
__mac_get_file(proc_t p, struct __mac_get_file_args *uap,
int *ret __unused)
{
return mac_get_filelink(p, uap->mac_p, uap->path_p, 1);
}
int
__mac_get_link(proc_t p, struct __mac_get_link_args *uap,
int *ret __unused)
{
return mac_get_filelink(p, uap->mac_p, uap->path_p, 0);
}
int
__mac_set_fd(proc_t p, struct __mac_set_fd_args *uap, int *ret __unused)
{
return mac_do_set(p, uap->mac_p,
^(char *input, size_t len) {
struct fileproc *fp;
struct vfs_context *ctx = vfs_context_current();
int error;
struct label *intlabel;
struct vnode *vp;
AUDIT_ARG(fd, uap->fd);
if ((error = fp_lookup(p, uap->fd, &fp, 0))) {
return error;
}
error = mac_file_check_set(vfs_context_ucred(ctx), fp->fp_glob, input, len);
if (error) {
fp_drop(p, uap->fd, fp, 0);
return error;
}
switch (FILEGLOB_DTYPE(fp->fp_glob)) {
case DTYPE_VNODE:
if (mac_label_vnodes == 0) {
error = ENOSYS;
break;
}
intlabel = mac_vnode_label_alloc(NULL);
error = mac_vnode_label_internalize(intlabel, input);
if (error) {
mac_vnode_label_free(intlabel);
break;
}
vp = (struct vnode *)fp_get_data(fp);
error = vnode_getwithref(vp);
if (error == 0) {
error = vn_setlabel(vp, intlabel, ctx);
vnode_put(vp);
}
mac_vnode_label_free(intlabel);
break;
case DTYPE_SOCKET:
case DTYPE_PSXSHM:
case DTYPE_PSXSEM:
case DTYPE_PIPE:
case DTYPE_KQUEUE:
case DTYPE_FSEVENTS:
case DTYPE_ATALK:
case DTYPE_NETPOLICY:
case DTYPE_CHANNEL:
case DTYPE_NEXUS:
default:
error = ENOSYS; // only sockets/vnodes so far
break;
}
fp_drop(p, uap->fd, fp, 0);
return error;
});
}
static int
mac_set_filelink(proc_t p, user_addr_t mac_p, user_addr_t path_p,
int follow)
{
return mac_do_set(p, mac_p,
^(char *input, __unused size_t len) {
struct vnode *vp;
struct vfs_context *ctx = vfs_context_current();
struct label *intlabel;
struct nameidata nd;
int error;
if (mac_label_vnodes == 0) {
return ENOSYS;
}
intlabel = mac_vnode_label_alloc(NULL);
error = mac_vnode_label_internalize(intlabel, input);
if (error) {
mac_vnode_label_free(intlabel);
return error;
}
NDINIT(&nd, LOOKUP, OP_LOOKUP,
LOCKLEAF | (follow ? FOLLOW : NOFOLLOW) | AUDITVNPATH1,
UIO_USERSPACE, path_p, ctx);
error = namei(&nd);
if (error) {
mac_vnode_label_free(intlabel);
return error;
}
vp = nd.ni_vp;
nameidone(&nd);
error = vn_setlabel(vp, intlabel, ctx);
vnode_put(vp);
mac_vnode_label_free(intlabel);
return error;
});
}
int
__mac_set_file(proc_t p, struct __mac_set_file_args *uap,
int *ret __unused)
{
return mac_set_filelink(p, uap->mac_p, uap->path_p, 1);
}
int
__mac_set_link(proc_t p, struct __mac_set_link_args *uap,
int *ret __unused)
{
return mac_set_filelink(p, uap->mac_p, uap->path_p, 0);
}
static int
mac_proc_check_mac_syscall(proc_t p, const char *target, int callnum)
{
int error;
#if SECURITY_MAC_CHECK_ENFORCE
/* 21167099 - only check if we allow write */
if (!mac_proc_enforce) {
return 0;
}
#endif
MAC_CHECK(proc_check_syscall_mac, p, target, callnum);
return error;
}
/*
* __mac_syscall: Perform a MAC policy system call
*
* Parameters: p Process calling this routine
* uap User argument descriptor (see below)
* retv (Unused)
*
* Indirect: uap->policy Name of target MAC policy
* uap->call MAC policy-specific system call to perform
* uap->arg MAC policy-specific system call arguments
*
* Returns: 0 Success
* !0 Not success
*
*/
int
__mac_syscall(proc_t p, struct __mac_syscall_args *uap, int *retv __unused)
{
struct mac_policy_conf *mpc;
char target[MAC_MAX_POLICY_NAME];
int error;
u_int i;
size_t ulen;
error = copyinstr(uap->policy, target, sizeof(target), &ulen);
if (error) {
return error;
}
AUDIT_ARG(value32, uap->call);
AUDIT_ARG(mac_string, target);
error = mac_proc_check_mac_syscall(p, target, uap->call);
if (error) {
return error;
}
error = ENOPOLICY;
for (i = 0; i < mac_policy_list.staticmax; i++) {
mpc = mac_policy_list.entries[i].mpc;
if (mpc == NULL) {
continue;
}
if (strcmp(mpc->mpc_name, target) == 0 &&
mpc->mpc_ops->mpo_policy_syscall != NULL) {
error = mpc->mpc_ops->mpo_policy_syscall(p,
uap->call, uap->arg);
goto done;
}
}
if (mac_policy_list_conditional_busy() != 0) {
for (; i <= mac_policy_list.maxindex; i++) {
mpc = mac_policy_list.entries[i].mpc;
if (mpc == NULL) {
continue;
}
if (strcmp(mpc->mpc_name, target) == 0 &&
mpc->mpc_ops->mpo_policy_syscall != NULL) {
error = mpc->mpc_ops->mpo_policy_syscall(p,
uap->call, uap->arg);
break;
}
}
mac_policy_list_unbusy();
}
done:
return error;
}
int
mac_mount_label_get(struct mount *mp, user_addr_t mac_p)
{
return mac_do_get(current_proc(), mac_p,
^(char *input, char *output, size_t len) {
return mac_mount_label_externalize(mac_mount_label(mp), input,
output, len);
});
}
/*
* __mac_get_mount: Get mount point label information for a given pathname
*
* Parameters: p (ignored)
* uap User argument descriptor (see below)
* ret (ignored)
*
* Indirect: uap->path Pathname
* uap->mac_p MAC info
*
* Returns: 0 Success
* !0 Not success
*/
int
__mac_get_mount(proc_t p __unused, struct __mac_get_mount_args *uap,
int *ret __unused)
{
struct nameidata nd;
struct vfs_context *ctx = vfs_context_current();
struct mount *mp;
int error;
NDINIT(&nd, LOOKUP, OP_LOOKUP, FOLLOW | AUDITVNPATH1,
UIO_USERSPACE, uap->path, ctx);
error = namei(&nd);
if (error) {
return error;
}
mp = nd.ni_vp->v_mount;
mount_ref(mp, 0);
vnode_put(nd.ni_vp);
nameidone(&nd);
error = mac_mount_label_get(mp, uap->mac_p);
mount_drop(mp, 0);
return error;
}
/*
* mac_schedule_userret()
*
* Schedule a callback to the mpo_thread_userret hook. The mpo_thread_userret
* hook is called just before the thread exit from the kernel in ast_taken().
*
* Returns: 0 Success
* !0 Not successful
*/
int
mac_schedule_userret(void)
{
act_set_astmacf(current_thread());
return 0;
}
/*
* mac_do_machexc()
*
* Do a Mach exception. This should only be done in the mpo_thread_userret
* callback.
*
* params: code exception code
* subcode exception subcode
* flags flags:
* MAC_DOEXCF_TRACED Only do exception if being
* ptrace()'ed.
*
*
* Returns: 0 Success
* !0 Not successful
*/
int
mac_do_machexc(int64_t code, int64_t subcode, uint32_t flags)
{
mach_exception_data_type_t codes[EXCEPTION_CODE_MAX];
proc_t p = current_proc();
/* Only allow execption codes in MACF's reserved range. */
if ((code < EXC_MACF_MIN) || (code > EXC_MACF_MAX)) {
return 1;
}
if (flags & MAC_DOEXCF_TRACED &&
!(p->p_lflag & P_LTRACED && (p->p_lflag & P_LPPWAIT) == 0)) {
return 0;
}
/* Send the Mach exception */
codes[0] = (mach_exception_data_type_t)code;
codes[1] = (mach_exception_data_type_t)subcode;
return bsd_exception(EXC_SOFTWARE, codes, 2) != KERN_SUCCESS;
}
#else /* MAC */
void (*load_security_extensions_function)(void) = 0;
struct sysctl_oid_list sysctl__security_mac_children;
int
mac_policy_register(struct mac_policy_conf *mpc __unused,
mac_policy_handle_t *handlep __unused, void *xd __unused)
{
return 0;
}
int
mac_policy_unregister(mac_policy_handle_t handle __unused)
{
return 0;
}
int
mac_audit_text(char *text __unused, mac_policy_handle_t handle __unused)
{
return 0;
}
int
mac_vnop_setxattr(struct vnode *vp __unused, const char *name __unused, char *buf __unused, size_t len __unused)
{
return ENOENT;
}
int
mac_vnop_getxattr(struct vnode *vp __unused, const char *name __unused,
char *buf __unused, size_t len __unused, size_t *attrlen __unused)
{
return ENOENT;
}
int
mac_vnop_removexattr(struct vnode *vp __unused, const char *name __unused)
{
return ENOENT;
}
int
mac_file_setxattr(struct fileglob *fg __unused, const char *name __unused, char *buf __unused, size_t len __unused)
{
return ENOENT;
}
int
mac_file_getxattr(struct fileglob *fg __unused, const char *name __unused,
char *buf __unused, size_t len __unused, size_t *attrlen __unused)
{
return ENOENT;
}
int
mac_file_removexattr(struct fileglob *fg __unused, const char *name __unused)
{
return ENOENT;
}
intptr_t
mac_label_get(struct label *l __unused, int slot __unused)
{
return 0;
}
void
mac_label_set(struct label *l __unused, int slot __unused, intptr_t v __unused)
{
return;
}
int mac_iokit_check_hid_control(kauth_cred_t cred __unused);
int
mac_iokit_check_hid_control(kauth_cred_t cred __unused)
{
return 0;
}
int mac_vnode_check_open(vfs_context_t ctx, struct vnode *vp, int acc_mode);
int
mac_vnode_check_open(vfs_context_t ctx __unused, struct vnode *vp __unused, int acc_mode __unused)
{
return 0;
}
int mac_mount_check_snapshot_mount(vfs_context_t ctx, struct vnode *rvp, struct vnode *vp, struct componentname *cnp,
const char *name, const char *vfc_name);
int
mac_mount_check_snapshot_mount(vfs_context_t ctx __unused, struct vnode *rvp __unused, struct vnode *vp __unused,
struct componentname *cnp __unused, const char *name __unused, const char *vfc_name __unused)
{
return 0;
}
int mac_vnode_check_trigger_resolve(vfs_context_t ctx __unused, struct vnode *dvp __unused, struct componentname *cnp __unused);
int
mac_vnode_check_trigger_resolve(vfs_context_t ctx __unused, struct vnode *dvp __unused, struct componentname *cnp __unused)
{
return 0;
}
#endif /* !MAC */
Reference in a new issue View git blame Copy permalink