The Design and Implementation of the FreeBSD Operating System, Second Edition
Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]

FreeBSD/Linux Kernel Cross Reference
sys/security/mac/mac_pipe.c

Version: -  FREEBSD  -  FREEBSD-13-STABLE  -  FREEBSD-13-0  -  FREEBSD-12-STABLE  -  FREEBSD-12-0  -  FREEBSD-11-STABLE  -  FREEBSD-11-0  -  FREEBSD-10-STABLE  -  FREEBSD-10-0  -  FREEBSD-9-STABLE  -  FREEBSD-9-0  -  FREEBSD-8-STABLE  -  FREEBSD-8-0  -  FREEBSD-7-STABLE  -  FREEBSD-7-0  -  FREEBSD-6-STABLE  -  FREEBSD-6-0  -  FREEBSD-5-STABLE  -  FREEBSD-5-0  -  FREEBSD-4-STABLE  -  FREEBSD-3-STABLE  -  FREEBSD22  -  l41  -  OPENBSD  -  linux-2.6  -  MK84  -  PLAN9  -  xnu-8792 
SearchContext: -  none  -  3  -  10 

    1 /*-
    2  * Copyright (c) 2002-2003 Networks Associates Technology, Inc.
    3  * Copyright (c) 2006 SPARTA, Inc.
    4  * Copyright (c) 2009 Robert N. M. Watson
    5  * All rights reserved.
    6  *
    7  * This software was developed for the FreeBSD Project in part by Network
    8  * Associates Laboratories, the Security Research Division of Network
    9  * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"),
   10  * as part of the DARPA CHATS research program.
   11  *
   12  * This software was enhanced by SPARTA ISSO under SPAWAR contract
   13  * N66001-04-C-6019 ("SEFOS").
   14  *
   15  * This software was developed at the University of Cambridge Computer
   16  * Laboratory with support from a grant from Google, Inc. 
   17  *
   18  * Redistribution and use in source and binary forms, with or without
   19  * modification, are permitted provided that the following conditions
   20  * are met:
   21  * 1. Redistributions of source code must retain the above copyright
   22  *    notice, this list of conditions and the following disclaimer.
   23  * 2. Redistributions in binary form must reproduce the above copyright
   24  *    notice, this list of conditions and the following disclaimer in the
   25  *    documentation and/or other materials provided with the distribution.
   26  *
   27  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
   28  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
   29  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
   30  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
   31  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
   32  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
   33  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
   34  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
   35  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
   36  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
   37  * SUCH DAMAGE.
   38  */
   39 
   40 #include <sys/cdefs.h>
   41 __FBSDID("$FreeBSD: releng/11.0/sys/security/mac/mac_pipe.c 258541 2013-11-25 07:38:45Z attilio $");
   42 
   43 #include "opt_mac.h"
   44 
   45 #include <sys/param.h>
   46 #include <sys/kernel.h>
   47 #include <sys/lock.h>
   48 #include <sys/malloc.h>
   49 #include <sys/module.h>
   50 #include <sys/mutex.h>
   51 #include <sys/sbuf.h>
   52 #include <sys/sdt.h>
   53 #include <sys/systm.h>
   54 #include <sys/vnode.h>
   55 #include <sys/pipe.h>
   56 #include <sys/sysctl.h>
   57 
   58 #include <security/mac/mac_framework.h>
   59 #include <security/mac/mac_internal.h>
   60 #include <security/mac/mac_policy.h>
   61 
   62 struct label *
   63 mac_pipe_label_alloc(void)
   64 {
   65         struct label *label;
   66 
   67         label = mac_labelzone_alloc(M_WAITOK);
   68         MAC_POLICY_PERFORM(pipe_init_label, label);
   69         return (label);
   70 }
   71 
   72 void
   73 mac_pipe_init(struct pipepair *pp)
   74 {
   75 
   76         if (mac_labeled & MPC_OBJECT_PIPE)
   77                 pp->pp_label = mac_pipe_label_alloc();
   78         else
   79                 pp->pp_label = NULL;
   80 }
   81 
   82 void
   83 mac_pipe_label_free(struct label *label)
   84 {
   85 
   86         MAC_POLICY_PERFORM_NOSLEEP(pipe_destroy_label, label);
   87         mac_labelzone_free(label);
   88 }
   89 
   90 void
   91 mac_pipe_destroy(struct pipepair *pp)
   92 {
   93 
   94         if (pp->pp_label != NULL) {
   95                 mac_pipe_label_free(pp->pp_label);
   96                 pp->pp_label = NULL;
   97         }
   98 }
   99 
  100 void
  101 mac_pipe_copy_label(struct label *src, struct label *dest)
  102 {
  103 
  104         MAC_POLICY_PERFORM_NOSLEEP(pipe_copy_label, src, dest);
  105 }
  106 
  107 int
  108 mac_pipe_externalize_label(struct label *label, char *elements,
  109     char *outbuf, size_t outbuflen)
  110 {
  111         int error;
  112 
  113         MAC_POLICY_EXTERNALIZE(pipe, label, elements, outbuf, outbuflen);
  114 
  115         return (error);
  116 }
  117 
  118 int
  119 mac_pipe_internalize_label(struct label *label, char *string)
  120 {
  121         int error;
  122 
  123         MAC_POLICY_INTERNALIZE(pipe, label, string);
  124 
  125         return (error);
  126 }
  127 
  128 void
  129 mac_pipe_create(struct ucred *cred, struct pipepair *pp)
  130 {
  131 
  132         MAC_POLICY_PERFORM_NOSLEEP(pipe_create, cred, pp, pp->pp_label);
  133 }
  134 
  135 static void
  136 mac_pipe_relabel(struct ucred *cred, struct pipepair *pp,
  137     struct label *newlabel)
  138 {
  139 
  140         MAC_POLICY_PERFORM_NOSLEEP(pipe_relabel, cred, pp, pp->pp_label,
  141             newlabel);
  142 }
  143 
  144 MAC_CHECK_PROBE_DEFINE4(pipe_check_ioctl, "struct ucred *",
  145     "struct pipepair *", "unsigned long", "void *");
  146 
  147 int
  148 mac_pipe_check_ioctl(struct ucred *cred, struct pipepair *pp,
  149     unsigned long cmd, void *data)
  150 {
  151         int error;
  152 
  153         mtx_assert(&pp->pp_mtx, MA_OWNED);
  154 
  155         MAC_POLICY_CHECK_NOSLEEP(pipe_check_ioctl, cred, pp, pp->pp_label,
  156             cmd, data);
  157         MAC_CHECK_PROBE4(pipe_check_ioctl, error, cred, pp, cmd, data);
  158 
  159         return (error);
  160 }
  161 
  162 MAC_CHECK_PROBE_DEFINE2(pipe_check_poll, "struct ucred *",
  163     "struct pipepair *");
  164 
  165 int
  166 mac_pipe_check_poll(struct ucred *cred, struct pipepair *pp)
  167 {
  168         int error;
  169 
  170         mtx_assert(&pp->pp_mtx, MA_OWNED);
  171 
  172         MAC_POLICY_CHECK_NOSLEEP(pipe_check_poll, cred, pp, pp->pp_label);
  173         MAC_CHECK_PROBE2(pipe_check_poll, error, cred, pp);
  174 
  175         return (error);
  176 }
  177 
  178 MAC_CHECK_PROBE_DEFINE2(pipe_check_read, "struct ucred *",
  179     "struct pipepair *");
  180 
  181 int
  182 mac_pipe_check_read(struct ucred *cred, struct pipepair *pp)
  183 {
  184         int error;
  185 
  186         mtx_assert(&pp->pp_mtx, MA_OWNED);
  187 
  188         MAC_POLICY_CHECK_NOSLEEP(pipe_check_read, cred, pp, pp->pp_label);
  189         MAC_CHECK_PROBE2(pipe_check_read, error, cred, pp);
  190 
  191         return (error);
  192 }
  193 
  194 MAC_CHECK_PROBE_DEFINE3(pipe_check_relabel, "struct ucred *",
  195     "struct pipepair *", "struct label *");
  196 
  197 static int
  198 mac_pipe_check_relabel(struct ucred *cred, struct pipepair *pp,
  199     struct label *newlabel)
  200 {
  201         int error;
  202 
  203         mtx_assert(&pp->pp_mtx, MA_OWNED);
  204 
  205         MAC_POLICY_CHECK_NOSLEEP(pipe_check_relabel, cred, pp, pp->pp_label,
  206             newlabel);
  207         MAC_CHECK_PROBE3(pipe_check_relabel, error, cred, pp, newlabel);
  208 
  209         return (error);
  210 }
  211 
  212 MAC_CHECK_PROBE_DEFINE2(pipe_check_stat, "struct ucred *",
  213     "struct pipepair *");
  214 
  215 int
  216 mac_pipe_check_stat(struct ucred *cred, struct pipepair *pp)
  217 {
  218         int error;
  219 
  220         mtx_assert(&pp->pp_mtx, MA_OWNED);
  221 
  222         MAC_POLICY_CHECK_NOSLEEP(pipe_check_stat, cred, pp, pp->pp_label);
  223         MAC_CHECK_PROBE2(pipe_check_stat, error, cred, pp);
  224 
  225         return (error);
  226 }
  227 
  228 MAC_CHECK_PROBE_DEFINE2(pipe_check_write, "struct ucred *",
  229     "struct pipepair *");
  230 
  231 int
  232 mac_pipe_check_write(struct ucred *cred, struct pipepair *pp)
  233 {
  234         int error;
  235 
  236         mtx_assert(&pp->pp_mtx, MA_OWNED);
  237 
  238         MAC_POLICY_CHECK_NOSLEEP(pipe_check_write, cred, pp, pp->pp_label);
  239         MAC_CHECK_PROBE2(pipe_check_write, error, cred, pp);
  240 
  241         return (error);
  242 }
  243 
  244 int
  245 mac_pipe_label_set(struct ucred *cred, struct pipepair *pp,
  246     struct label *label)
  247 {
  248         int error;
  249 
  250         mtx_assert(&pp->pp_mtx, MA_OWNED);
  251 
  252         error = mac_pipe_check_relabel(cred, pp, label);
  253         if (error)
  254                 return (error);
  255 
  256         mac_pipe_relabel(cred, pp, label);
  257 
  258         return (0);
  259 }

Cache object: 0079b4b8b4becb8f210572aba978076d


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]


This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.