The Design and Implementation of the FreeBSD Operating System, Second Edition
Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]

FreeBSD/Linux Kernel Cross Reference
sys/security/mac/mac_pipe.c

Version: -  FREEBSD  -  FREEBSD-13-STABLE  -  FREEBSD-13-0  -  FREEBSD-12-STABLE  -  FREEBSD-12-0  -  FREEBSD-11-STABLE  -  FREEBSD-11-0  -  FREEBSD-10-STABLE  -  FREEBSD-10-0  -  FREEBSD-9-STABLE  -  FREEBSD-9-0  -  FREEBSD-8-STABLE  -  FREEBSD-8-0  -  FREEBSD-7-STABLE  -  FREEBSD-7-0  -  FREEBSD-6-STABLE  -  FREEBSD-6-0  -  FREEBSD-5-STABLE  -  FREEBSD-5-0  -  FREEBSD-4-STABLE  -  FREEBSD-3-STABLE  -  FREEBSD22  -  l41  -  OPENBSD  -  linux-2.6  -  MK84  -  PLAN9  -  xnu-8792 
SearchContext: -  none  -  3  -  10 

    1 /*-
    2  * Copyright (c) 2002, 2003 Networks Associates Technology, Inc.
    3  * All rights reserved.
    4  *
    5  * This software was developed for the FreeBSD Project in part by Network
    6  * Associates Laboratories, the Security Research Division of Network
    7  * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"),
    8  * as part of the DARPA CHATS research program.
    9  *
   10  * Redistribution and use in source and binary forms, with or without
   11  * modification, are permitted provided that the following conditions
   12  * are met:
   13  * 1. Redistributions of source code must retain the above copyright
   14  *    notice, this list of conditions and the following disclaimer.
   15  * 2. Redistributions in binary form must reproduce the above copyright
   16  *    notice, this list of conditions and the following disclaimer in the
   17  *    documentation and/or other materials provided with the distribution.
   18  *
   19  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
   20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
   21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
   22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
   23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
   24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
   25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
   26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
   27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
   28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
   29  * SUCH DAMAGE.
   30  */
   31 
   32 #include <sys/cdefs.h>
   33 __FBSDID("$FreeBSD$");
   34 
   35 #include "opt_mac.h"
   36 
   37 #include <sys/param.h>
   38 #include <sys/kernel.h>
   39 #include <sys/lock.h>
   40 #include <sys/malloc.h>
   41 #include <sys/module.h>
   42 #include <sys/mutex.h>
   43 #include <sys/mac.h>
   44 #include <sys/sbuf.h>
   45 #include <sys/systm.h>
   46 #include <sys/vnode.h>
   47 #include <sys/pipe.h>
   48 #include <sys/sysctl.h>
   49 
   50 #include <sys/mac_policy.h>
   51 
   52 #include <security/mac/mac_internal.h>
   53 
   54 static int      mac_enforce_pipe = 1;
   55 SYSCTL_INT(_security_mac, OID_AUTO, enforce_pipe, CTLFLAG_RW,
   56     &mac_enforce_pipe, 0, "Enforce MAC policy on pipe operations");
   57 TUNABLE_INT("security.mac.enforce_pipe", &mac_enforce_pipe);
   58 
   59 #ifdef MAC_DEBUG
   60 static unsigned int nmacpipes;
   61 SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, pipes, CTLFLAG_RD,
   62     &nmacpipes, 0, "number of pipes in use");
   63 #endif
   64 
   65 struct label *
   66 mac_pipe_label_alloc(void)
   67 {
   68         struct label *label;
   69 
   70         label = mac_labelzone_alloc(M_WAITOK);
   71         MAC_PERFORM(init_pipe_label, label);
   72         MAC_DEBUG_COUNTER_INC(&nmacpipes);
   73         return (label);
   74 }
   75 
   76 void
   77 mac_init_pipe(struct pipepair *pp)
   78 {
   79 
   80         pp->pp_label = mac_pipe_label_alloc();
   81 }
   82 
   83 void
   84 mac_pipe_label_free(struct label *label)
   85 {
   86 
   87         MAC_PERFORM(destroy_pipe_label, label);
   88         mac_labelzone_free(label);
   89         MAC_DEBUG_COUNTER_DEC(&nmacpipes);
   90 }
   91 
   92 void
   93 mac_destroy_pipe(struct pipepair *pp)
   94 {
   95 
   96         mac_pipe_label_free(pp->pp_label);
   97         pp->pp_label = NULL;
   98 }
   99 
  100 void
  101 mac_copy_pipe_label(struct label *src, struct label *dest)
  102 {
  103 
  104         MAC_PERFORM(copy_pipe_label, src, dest);
  105 }
  106 
  107 int
  108 mac_externalize_pipe_label(struct label *label, char *elements,
  109     char *outbuf, size_t outbuflen)
  110 {
  111         int error;
  112 
  113         MAC_EXTERNALIZE(pipe, label, elements, outbuf, outbuflen);
  114 
  115         return (error);
  116 }
  117 
  118 int
  119 mac_internalize_pipe_label(struct label *label, char *string)
  120 {
  121         int error;
  122 
  123         MAC_INTERNALIZE(pipe, label, string);
  124 
  125         return (error);
  126 }
  127 
  128 void
  129 mac_create_pipe(struct ucred *cred, struct pipepair *pp)
  130 {
  131 
  132         MAC_PERFORM(create_pipe, cred, pp, pp->pp_label);
  133 }
  134 
  135 static void
  136 mac_relabel_pipe(struct ucred *cred, struct pipepair *pp,
  137     struct label *newlabel)
  138 {
  139 
  140         MAC_PERFORM(relabel_pipe, cred, pp, pp->pp_label, newlabel);
  141 }
  142 
  143 int
  144 mac_check_pipe_ioctl(struct ucred *cred, struct pipepair *pp,
  145     unsigned long cmd, void *data)
  146 {
  147         int error;
  148 
  149         mtx_assert(&pp->pp_mtx, MA_OWNED);
  150 
  151         if (!mac_enforce_pipe)
  152                 return (0);
  153 
  154         MAC_CHECK(check_pipe_ioctl, cred, pp, pp->pp_label, cmd, data);
  155 
  156         return (error);
  157 }
  158 
  159 int
  160 mac_check_pipe_poll(struct ucred *cred, struct pipepair *pp)
  161 {
  162         int error;
  163 
  164         mtx_assert(&pp->pp_mtx, MA_OWNED);
  165 
  166         if (!mac_enforce_pipe)
  167                 return (0);
  168 
  169         MAC_CHECK(check_pipe_poll, cred, pp, pp->pp_label);
  170 
  171         return (error);
  172 }
  173 
  174 int
  175 mac_check_pipe_read(struct ucred *cred, struct pipepair *pp)
  176 {
  177         int error;
  178 
  179         mtx_assert(&pp->pp_mtx, MA_OWNED);
  180 
  181         if (!mac_enforce_pipe)
  182                 return (0);
  183 
  184         MAC_CHECK(check_pipe_read, cred, pp, pp->pp_label);
  185 
  186         return (error);
  187 }
  188 
  189 static int
  190 mac_check_pipe_relabel(struct ucred *cred, struct pipepair *pp,
  191     struct label *newlabel)
  192 {
  193         int error;
  194 
  195         mtx_assert(&pp->pp_mtx, MA_OWNED);
  196 
  197         if (!mac_enforce_pipe)
  198                 return (0);
  199 
  200         MAC_CHECK(check_pipe_relabel, cred, pp, pp->pp_label, newlabel);
  201 
  202         return (error);
  203 }
  204 
  205 int
  206 mac_check_pipe_stat(struct ucred *cred, struct pipepair *pp)
  207 {
  208         int error;
  209 
  210         mtx_assert(&pp->pp_mtx, MA_OWNED);
  211 
  212         if (!mac_enforce_pipe)
  213                 return (0);
  214 
  215         MAC_CHECK(check_pipe_stat, cred, pp, pp->pp_label);
  216 
  217         return (error);
  218 }
  219 
  220 int
  221 mac_check_pipe_write(struct ucred *cred, struct pipepair *pp)
  222 {
  223         int error;
  224 
  225         mtx_assert(&pp->pp_mtx, MA_OWNED);
  226 
  227         if (!mac_enforce_pipe)
  228                 return (0);
  229 
  230         MAC_CHECK(check_pipe_write, cred, pp, pp->pp_label);
  231 
  232         return (error);
  233 }
  234 
  235 int
  236 mac_pipe_label_set(struct ucred *cred, struct pipepair *pp,
  237     struct label *label)
  238 {
  239         int error;
  240 
  241         mtx_assert(&pp->pp_mtx, MA_OWNED);
  242 
  243         error = mac_check_pipe_relabel(cred, pp, label);
  244         if (error)
  245                 return (error);
  246 
  247         mac_relabel_pipe(cred, pp, label);
  248 
  249         return (0);
  250 }

Cache object: c8ce59102d79dcccb107ecc072aeae2e


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]


This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.