The Design and Implementation of the FreeBSD Operating System, Second Edition
Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]

FreeBSD/Linux Kernel Cross Reference
sys/security/mac/mac_net.c

Version: -  FREEBSD  -  FREEBSD-13-STABLE  -  FREEBSD-13-0  -  FREEBSD-12-STABLE  -  FREEBSD-12-0  -  FREEBSD-11-STABLE  -  FREEBSD-11-0  -  FREEBSD-10-STABLE  -  FREEBSD-10-0  -  FREEBSD-9-STABLE  -  FREEBSD-9-0  -  FREEBSD-8-STABLE  -  FREEBSD-8-0  -  FREEBSD-7-STABLE  -  FREEBSD-7-0  -  FREEBSD-6-STABLE  -  FREEBSD-6-0  -  FREEBSD-5-STABLE  -  FREEBSD-5-0  -  FREEBSD-4-STABLE  -  FREEBSD-3-STABLE  -  FREEBSD22  -  l41  -  OPENBSD  -  linux-2.6  -  MK84  -  PLAN9  -  xnu-8792 
SearchContext: -  none  -  3  -  10 

    1 /*-
    2  * Copyright (c) 1999-2002, 2009 Robert N. M. Watson
    3  * Copyright (c) 2001 Ilmar S. Habibulin
    4  * Copyright (c) 2001-2004 Networks Associates Technology, Inc.
    5  * Copyright (c) 2006 SPARTA, Inc.
    6  * Copyright (c) 2008 Apple Inc.
    7  * All rights reserved.
    8  *
    9  * This software was developed by Robert Watson and Ilmar Habibulin for the
   10  * TrustedBSD Project.
   11  *
   12  * This software was enhanced by SPARTA ISSO under SPAWAR contract
   13  * N66001-04-C-6019 ("SEFOS").
   14  *
   15  * This software was developed for the FreeBSD Project in part by Network
   16  * Associates Laboratories, the Security Research Division of Network
   17  * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"),
   18  * as part of the DARPA CHATS research program.
   19  *
   20  * This software was developed at the University of Cambridge Computer
   21  * Laboratory with support from a grant from Google, Inc. 
   22  *
   23  * Redistribution and use in source and binary forms, with or without
   24  * modification, are permitted provided that the following conditions
   25  * are met:
   26  * 1. Redistributions of source code must retain the above copyright
   27  *    notice, this list of conditions and the following disclaimer.
   28  * 2. Redistributions in binary form must reproduce the above copyright
   29  *    notice, this list of conditions and the following disclaimer in the
   30  *    documentation and/or other materials provided with the distribution.
   31  *
   32  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
   33  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
   34  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
   35  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
   36  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
   37  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
   38  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
   39  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
   40  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
   41  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
   42  * SUCH DAMAGE.
   43  */
   44 
   45 #include <sys/cdefs.h>
   46 __FBSDID("$FreeBSD: releng/9.0/sys/security/mac/mac_net.c 193393 2009-06-03 19:41:12Z rwatson $");
   47 
   48 #include "opt_kdtrace.h"
   49 #include "opt_mac.h"
   50 
   51 #include <sys/param.h>
   52 #include <sys/kernel.h>
   53 #include <sys/lock.h>
   54 #include <sys/malloc.h>
   55 #include <sys/mutex.h>
   56 #include <sys/mac.h>
   57 #include <sys/priv.h>
   58 #include <sys/sbuf.h>
   59 #include <sys/sdt.h>
   60 #include <sys/systm.h>
   61 #include <sys/mount.h>
   62 #include <sys/file.h>
   63 #include <sys/namei.h>
   64 #include <sys/protosw.h>
   65 #include <sys/socket.h>
   66 #include <sys/socketvar.h>
   67 #include <sys/sysctl.h>
   68 
   69 #include <net/bpfdesc.h>
   70 #include <net/if.h>
   71 #include <net/if_var.h>
   72 
   73 #include <security/mac/mac_framework.h>
   74 #include <security/mac/mac_internal.h>
   75 #include <security/mac/mac_policy.h>
   76 
   77 /*
   78  * XXXRW: struct ifnet locking is incomplete in the network code, so we use
   79  * our own global mutex for struct ifnet.  Non-ideal, but should help in the
   80  * SMP environment.
   81  */
   82 struct mtx mac_ifnet_mtx;
   83 MTX_SYSINIT(mac_ifnet_mtx, &mac_ifnet_mtx, "mac_ifnet", MTX_DEF);
   84 
   85 /*
   86  * Retrieve the label associated with an mbuf by searching for the tag.
   87  * Depending on the value of mac_labelmbufs, it's possible that a label will
   88  * not be present, in which case NULL is returned.  Policies must handle the
   89  * possibility of an mbuf not having label storage if they do not enforce
   90  * early loading.
   91  */
   92 struct label *
   93 mac_mbuf_to_label(struct mbuf *m)
   94 {
   95         struct m_tag *tag;
   96         struct label *label;
   97 
   98         if (m == NULL)
   99                 return (NULL);
  100         tag = m_tag_find(m, PACKET_TAG_MACLABEL, NULL);
  101         if (tag == NULL)
  102                 return (NULL);
  103         label = (struct label *)(tag+1);
  104         return (label);
  105 }
  106 
  107 static struct label *
  108 mac_bpfdesc_label_alloc(void)
  109 {
  110         struct label *label;
  111 
  112         label = mac_labelzone_alloc(M_WAITOK);
  113         MAC_POLICY_PERFORM(bpfdesc_init_label, label);
  114         return (label);
  115 }
  116 
  117 void
  118 mac_bpfdesc_init(struct bpf_d *d)
  119 {
  120 
  121         if (mac_labeled & MPC_OBJECT_BPFDESC)
  122                 d->bd_label = mac_bpfdesc_label_alloc();
  123         else
  124                 d->bd_label = NULL;
  125 }
  126 
  127 static struct label *
  128 mac_ifnet_label_alloc(void)
  129 {
  130         struct label *label;
  131 
  132         label = mac_labelzone_alloc(M_WAITOK);
  133         MAC_POLICY_PERFORM(ifnet_init_label, label);
  134         return (label);
  135 }
  136 
  137 void
  138 mac_ifnet_init(struct ifnet *ifp)
  139 {
  140 
  141         if (mac_labeled & MPC_OBJECT_IFNET)
  142                 ifp->if_label = mac_ifnet_label_alloc();
  143         else
  144                 ifp->if_label = NULL;
  145 }
  146 
  147 int
  148 mac_mbuf_tag_init(struct m_tag *tag, int flag)
  149 {
  150         struct label *label;
  151         int error;
  152 
  153         label = (struct label *) (tag + 1);
  154         mac_init_label(label);
  155 
  156         if (flag & M_WAITOK)
  157                 MAC_POLICY_CHECK(mbuf_init_label, label, flag);
  158         else
  159                 MAC_POLICY_CHECK_NOSLEEP(mbuf_init_label, label, flag);
  160         if (error) {
  161                 MAC_POLICY_PERFORM_NOSLEEP(mbuf_destroy_label, label);
  162                 mac_destroy_label(label);
  163         }
  164         return (error);
  165 }
  166 
  167 int
  168 mac_mbuf_init(struct mbuf *m, int flag)
  169 {
  170         struct m_tag *tag;
  171         int error;
  172 
  173         M_ASSERTPKTHDR(m);
  174 
  175         if (mac_labeled & MPC_OBJECT_MBUF) {
  176                 tag = m_tag_get(PACKET_TAG_MACLABEL, sizeof(struct label),
  177                     flag);
  178                 if (tag == NULL)
  179                         return (ENOMEM);
  180                 error = mac_mbuf_tag_init(tag, flag);
  181                 if (error) {
  182                         m_tag_free(tag);
  183                         return (error);
  184                 }
  185                 m_tag_prepend(m, tag);
  186         }
  187         return (0);
  188 }
  189 
  190 static void
  191 mac_bpfdesc_label_free(struct label *label)
  192 {
  193 
  194         MAC_POLICY_PERFORM_NOSLEEP(bpfdesc_destroy_label, label);
  195         mac_labelzone_free(label);
  196 }
  197 
  198 void
  199 mac_bpfdesc_destroy(struct bpf_d *d)
  200 {
  201 
  202         if (d->bd_label != NULL) {
  203                 mac_bpfdesc_label_free(d->bd_label);
  204                 d->bd_label = NULL;
  205         }
  206 }
  207 
  208 static void
  209 mac_ifnet_label_free(struct label *label)
  210 {
  211 
  212         MAC_POLICY_PERFORM_NOSLEEP(ifnet_destroy_label, label);
  213         mac_labelzone_free(label);
  214 }
  215 
  216 void
  217 mac_ifnet_destroy(struct ifnet *ifp)
  218 {
  219 
  220         if (ifp->if_label != NULL) {
  221                 mac_ifnet_label_free(ifp->if_label);
  222                 ifp->if_label = NULL;
  223         }
  224 }
  225 
  226 void
  227 mac_mbuf_tag_destroy(struct m_tag *tag)
  228 {
  229         struct label *label;
  230 
  231         label = (struct label *)(tag+1);
  232 
  233         MAC_POLICY_PERFORM_NOSLEEP(mbuf_destroy_label, label);
  234         mac_destroy_label(label);
  235 }
  236 
  237 /*
  238  * mac_mbuf_tag_copy is called when an mbuf header is duplicated, in which
  239  * case the labels must also be duplicated.
  240  */
  241 void
  242 mac_mbuf_tag_copy(struct m_tag *src, struct m_tag *dest)
  243 {
  244         struct label *src_label, *dest_label;
  245 
  246         src_label = (struct label *)(src+1);
  247         dest_label = (struct label *)(dest+1);
  248 
  249         /*
  250          * mac_mbuf_tag_init() is called on the target tag in m_tag_copy(),
  251          * so we don't need to call it here.
  252          */
  253         MAC_POLICY_PERFORM_NOSLEEP(mbuf_copy_label, src_label, dest_label);
  254 }
  255 
  256 void
  257 mac_mbuf_copy(struct mbuf *m_from, struct mbuf *m_to)
  258 {
  259         struct label *src_label, *dest_label;
  260 
  261         if (mac_policy_count == 0)
  262                 return;
  263 
  264         src_label = mac_mbuf_to_label(m_from);
  265         dest_label = mac_mbuf_to_label(m_to);
  266 
  267         MAC_POLICY_PERFORM_NOSLEEP(mbuf_copy_label, src_label, dest_label);
  268 }
  269 
  270 static void
  271 mac_ifnet_copy_label(struct label *src, struct label *dest)
  272 {
  273 
  274         MAC_POLICY_PERFORM_NOSLEEP(ifnet_copy_label, src, dest);
  275 }
  276 
  277 static int
  278 mac_ifnet_externalize_label(struct label *label, char *elements,
  279     char *outbuf, size_t outbuflen)
  280 {
  281         int error;
  282 
  283         MAC_POLICY_EXTERNALIZE(ifnet, label, elements, outbuf, outbuflen);
  284 
  285         return (error);
  286 }
  287 
  288 static int
  289 mac_ifnet_internalize_label(struct label *label, char *string)
  290 {
  291         int error;
  292 
  293         MAC_POLICY_INTERNALIZE(ifnet, label, string);
  294 
  295         return (error);
  296 }
  297 
  298 void
  299 mac_ifnet_create(struct ifnet *ifp)
  300 {
  301 
  302         if (mac_policy_count == 0)
  303                 return;
  304 
  305         MAC_IFNET_LOCK(ifp);
  306         MAC_POLICY_PERFORM_NOSLEEP(ifnet_create, ifp, ifp->if_label);
  307         MAC_IFNET_UNLOCK(ifp);
  308 }
  309 
  310 void
  311 mac_bpfdesc_create(struct ucred *cred, struct bpf_d *d)
  312 {
  313 
  314         MAC_POLICY_PERFORM_NOSLEEP(bpfdesc_create, cred, d, d->bd_label);
  315 }
  316 
  317 void
  318 mac_bpfdesc_create_mbuf(struct bpf_d *d, struct mbuf *m)
  319 {
  320         struct label *label;
  321 
  322         BPFD_LOCK_ASSERT(d);
  323 
  324         if (mac_policy_count == 0)
  325                 return;
  326 
  327         label = mac_mbuf_to_label(m);
  328 
  329         MAC_POLICY_PERFORM_NOSLEEP(bpfdesc_create_mbuf, d, d->bd_label, m,
  330             label);
  331 }
  332 
  333 void
  334 mac_ifnet_create_mbuf(struct ifnet *ifp, struct mbuf *m)
  335 {
  336         struct label *label;
  337 
  338         if (mac_policy_count == 0)
  339                 return;
  340 
  341         label = mac_mbuf_to_label(m);
  342 
  343         MAC_IFNET_LOCK(ifp);
  344         MAC_POLICY_PERFORM_NOSLEEP(ifnet_create_mbuf, ifp, ifp->if_label, m,
  345             label);
  346         MAC_IFNET_UNLOCK(ifp);
  347 }
  348 
  349 MAC_CHECK_PROBE_DEFINE2(bpfdesc_check_receive, "struct bpf_d *",
  350     "struct ifnet *");
  351 
  352 int
  353 mac_bpfdesc_check_receive(struct bpf_d *d, struct ifnet *ifp)
  354 {
  355         int error;
  356 
  357         BPFD_LOCK_ASSERT(d);
  358 
  359         if (mac_policy_count == 0)
  360                 return (0);
  361 
  362         MAC_IFNET_LOCK(ifp);
  363         MAC_POLICY_CHECK_NOSLEEP(bpfdesc_check_receive, d, d->bd_label, ifp,
  364             ifp->if_label);
  365         MAC_CHECK_PROBE2(bpfdesc_check_receive, error, d, ifp);
  366         MAC_IFNET_UNLOCK(ifp);
  367 
  368         return (error);
  369 }
  370 
  371 MAC_CHECK_PROBE_DEFINE2(ifnet_check_transmit, "struct ifnet *",
  372     "struct mbuf *");
  373 
  374 int
  375 mac_ifnet_check_transmit(struct ifnet *ifp, struct mbuf *m)
  376 {
  377         struct label *label;
  378         int error;
  379 
  380         M_ASSERTPKTHDR(m);
  381 
  382         if (mac_policy_count == 0)
  383                 return (0);
  384 
  385         label = mac_mbuf_to_label(m);
  386 
  387         MAC_IFNET_LOCK(ifp);
  388         MAC_POLICY_CHECK_NOSLEEP(ifnet_check_transmit, ifp, ifp->if_label, m,
  389             label);
  390         MAC_CHECK_PROBE2(ifnet_check_transmit, error, ifp, m);
  391         MAC_IFNET_UNLOCK(ifp);
  392 
  393         return (error);
  394 }
  395 
  396 int
  397 mac_ifnet_ioctl_get(struct ucred *cred, struct ifreq *ifr,
  398     struct ifnet *ifp)
  399 {
  400         char *elements, *buffer;
  401         struct label *intlabel;
  402         struct mac mac;
  403         int error;
  404 
  405         if (!(mac_labeled & MPC_OBJECT_IFNET))
  406                 return (EINVAL);
  407 
  408         error = copyin(ifr->ifr_ifru.ifru_data, &mac, sizeof(mac));
  409         if (error)
  410                 return (error);
  411 
  412         error = mac_check_structmac_consistent(&mac);
  413         if (error)
  414                 return (error);
  415 
  416         elements = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK);
  417         error = copyinstr(mac.m_string, elements, mac.m_buflen, NULL);
  418         if (error) {
  419                 free(elements, M_MACTEMP);
  420                 return (error);
  421         }
  422 
  423         buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK | M_ZERO);
  424         intlabel = mac_ifnet_label_alloc();
  425         MAC_IFNET_LOCK(ifp);
  426         mac_ifnet_copy_label(ifp->if_label, intlabel);
  427         MAC_IFNET_UNLOCK(ifp);
  428         error = mac_ifnet_externalize_label(intlabel, elements, buffer,
  429             mac.m_buflen);
  430         mac_ifnet_label_free(intlabel);
  431         if (error == 0)
  432                 error = copyout(buffer, mac.m_string, strlen(buffer)+1);
  433 
  434         free(buffer, M_MACTEMP);
  435         free(elements, M_MACTEMP);
  436 
  437         return (error);
  438 }
  439 
  440 int
  441 mac_ifnet_ioctl_set(struct ucred *cred, struct ifreq *ifr, struct ifnet *ifp)
  442 {
  443         struct label *intlabel;
  444         struct mac mac;
  445         char *buffer;
  446         int error;
  447 
  448         if (!(mac_labeled & MPC_OBJECT_IFNET))
  449                 return (EINVAL);
  450 
  451         error = copyin(ifr->ifr_ifru.ifru_data, &mac, sizeof(mac));
  452         if (error)
  453                 return (error);
  454 
  455         error = mac_check_structmac_consistent(&mac);
  456         if (error)
  457                 return (error);
  458 
  459         buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK);
  460         error = copyinstr(mac.m_string, buffer, mac.m_buflen, NULL);
  461         if (error) {
  462                 free(buffer, M_MACTEMP);
  463                 return (error);
  464         }
  465 
  466         intlabel = mac_ifnet_label_alloc();
  467         error = mac_ifnet_internalize_label(intlabel, buffer);
  468         free(buffer, M_MACTEMP);
  469         if (error) {
  470                 mac_ifnet_label_free(intlabel);
  471                 return (error);
  472         }
  473 
  474         /*
  475          * XXX: Note that this is a redundant privilege check, since policies
  476          * impose this check themselves if required by the policy
  477          * Eventually, this should go away.
  478          */
  479         error = priv_check_cred(cred, PRIV_NET_SETIFMAC, 0);
  480         if (error) {
  481                 mac_ifnet_label_free(intlabel);
  482                 return (error);
  483         }
  484 
  485         MAC_IFNET_LOCK(ifp);
  486         MAC_POLICY_CHECK_NOSLEEP(ifnet_check_relabel, cred, ifp,
  487             ifp->if_label, intlabel);
  488         if (error) {
  489                 MAC_IFNET_UNLOCK(ifp);
  490                 mac_ifnet_label_free(intlabel);
  491                 return (error);
  492         }
  493 
  494         MAC_POLICY_PERFORM_NOSLEEP(ifnet_relabel, cred, ifp, ifp->if_label,
  495             intlabel);
  496         MAC_IFNET_UNLOCK(ifp);
  497 
  498         mac_ifnet_label_free(intlabel);
  499         return (0);
  500 }

Cache object: 87025a78137a3e16e59b25ec488f2e70


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]


This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.