mac_syscalls.c

Version: - FREEBSD - FREEBSD-13-STABLE - FREEBSD-13-0 - FREEBSD-12-STABLE - FREEBSD-12-0 - FREEBSD-11-STABLE - FREEBSD-11-0 - FREEBSD-10-STABLE - FREEBSD-10-0 - FREEBSD-9-STABLE - FREEBSD-9-0 - FREEBSD-8-STABLE - FREEBSD-8-0 - FREEBSD-7-STABLE - FREEBSD-7-0 - FREEBSD-6-STABLE - FREEBSD-6-0 - FREEBSD-5-STABLE - FREEBSD-5-0 - FREEBSD-4-STABLE - FREEBSD-3-STABLE - FREEBSD22 - l41 - OPENBSD - linux-2.6 - MK84 - PLAN9 - xnu-8792
SearchContext: - none - 3 - 10
    1 /*-
    2  * Copyright (c) 1999-2002, 2006, 2009 Robert N. M. Watson
    3  * Copyright (c) 2001 Ilmar S. Habibulin
    4  * Copyright (c) 2001-2005 Networks Associates Technology, Inc.
    5  * Copyright (c) 2005-2006 SPARTA, Inc.
    6  * Copyright (c) 2008 Apple Inc.
    7  * All rights reserved.
    8  *
    9  * This software was developed by Robert Watson and Ilmar Habibulin for the
   10  * TrustedBSD Project.
   11  *
   12  * This software was developed for the FreeBSD Project in part by Network
   13  * Associates Laboratories, the Security Research Division of Network
   14  * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"),
   15  * as part of the DARPA CHATS research program.
   16  *
   17  * This software was enhanced by SPARTA ISSO under SPAWAR contract 
   18  * N66001-04-C-6019 ("SEFOS").
   19  *
   20  * This software was developed at the University of Cambridge Computer
   21  * Laboratory with support from a grant from Google, Inc.
   22  *
   23  * Redistribution and use in source and binary forms, with or without
   24  * modification, are permitted provided that the following conditions
   25  * are met:
   26  * 1. Redistributions of source code must retain the above copyright
   27  *    notice, this list of conditions and the following disclaimer.
   28  * 2. Redistributions in binary form must reproduce the above copyright
   29  *    notice, this list of conditions and the following disclaimer in the
   30  *    documentation and/or other materials provided with the distribution.
   31  *
   32  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
   33  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
   34  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
   35  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
   36  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
   37  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
   38  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
   39  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
   40  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
   41  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
   42  * SUCH DAMAGE.
   43  */
   44 
   45 #include <sys/cdefs.h>
   46 __FBSDID("$FreeBSD: releng/9.1/sys/security/mac/mac_syscalls.c 238285 2012-07-09 08:42:54Z rwatson $");
   47 
   48 #include "opt_mac.h"
   49 
   50 #include <sys/param.h>
   51 #include <sys/capability.h>
   52 #include <sys/fcntl.h>
   53 #include <sys/kernel.h>
   54 #include <sys/lock.h>
   55 #include <sys/malloc.h>
   56 #include <sys/mutex.h>
   57 #include <sys/mac.h>
   58 #include <sys/proc.h>
   59 #include <sys/systm.h>
   60 #include <sys/sysctl.h>
   61 #include <sys/sysproto.h>
   62 #include <sys/sysent.h>
   63 #include <sys/vnode.h>
   64 #include <sys/mount.h>
   65 #include <sys/file.h>
   66 #include <sys/namei.h>
   67 #include <sys/socket.h>
   68 #include <sys/pipe.h>
   69 #include <sys/socketvar.h>
   70 
   71 #include <security/mac/mac_framework.h>
   72 #include <security/mac/mac_internal.h>
   73 #include <security/mac/mac_policy.h>
   74 
   75 #ifdef MAC
   76 
   77 FEATURE(security_mac, "Mandatory Access Control Framework support");
   78 
   79 int
   80 sys___mac_get_pid(struct thread *td, struct __mac_get_pid_args *uap)
   81 {
   82         char *elements, *buffer;
   83         struct mac mac;
   84         struct proc *tproc;
   85         struct ucred *tcred;
   86         int error;
   87 
   88         error = copyin(uap->mac_p, &mac, sizeof(mac));
   89         if (error)
   90                 return (error);
   91 
   92         error = mac_check_structmac_consistent(&mac);
   93         if (error)
   94                 return (error);
   95 
   96         tproc = pfind(uap->pid);
   97         if (tproc == NULL)
   98                 return (ESRCH);
   99 
  100         tcred = NULL;                           /* Satisfy gcc. */
  101         error = p_cansee(td, tproc);
  102         if (error == 0)
  103                 tcred = crhold(tproc->p_ucred);
  104         PROC_UNLOCK(tproc);
  105         if (error)
  106                 return (error);
  107 
  108         elements = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK);
  109         error = copyinstr(mac.m_string, elements, mac.m_buflen, NULL);
  110         if (error) {
  111                 free(elements, M_MACTEMP);
  112                 crfree(tcred);
  113                 return (error);
  114         }
  115 
  116         buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK | M_ZERO);
  117         error = mac_cred_externalize_label(tcred->cr_label, elements,
  118             buffer, mac.m_buflen);
  119         if (error == 0)
  120                 error = copyout(buffer, mac.m_string, strlen(buffer)+1);
  121 
  122         free(buffer, M_MACTEMP);
  123         free(elements, M_MACTEMP);
  124         crfree(tcred);
  125         return (error);
  126 }
  127 
  128 int
  129 sys___mac_get_proc(struct thread *td, struct __mac_get_proc_args *uap)
  130 {
  131         char *elements, *buffer;
  132         struct mac mac;
  133         int error;
  134 
  135         error = copyin(uap->mac_p, &mac, sizeof(mac));
  136         if (error)
  137                 return (error);
  138 
  139         error = mac_check_structmac_consistent(&mac);
  140         if (error)
  141                 return (error);
  142 
  143         elements = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK);
  144         error = copyinstr(mac.m_string, elements, mac.m_buflen, NULL);
  145         if (error) {
  146                 free(elements, M_MACTEMP);
  147                 return (error);
  148         }
  149 
  150         buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK | M_ZERO);
  151         error = mac_cred_externalize_label(td->td_ucred->cr_label,
  152             elements, buffer, mac.m_buflen);
  153         if (error == 0)
  154                 error = copyout(buffer, mac.m_string, strlen(buffer)+1);
  155 
  156         free(buffer, M_MACTEMP);
  157         free(elements, M_MACTEMP);
  158         return (error);
  159 }
  160 
  161 int
  162 sys___mac_set_proc(struct thread *td, struct __mac_set_proc_args *uap)
  163 {
  164         struct ucred *newcred, *oldcred;
  165         struct label *intlabel;
  166         struct proc *p;
  167         struct mac mac;
  168         char *buffer;
  169         int error;
  170 
  171         if (!(mac_labeled & MPC_OBJECT_CRED))
  172                 return (EINVAL);
  173 
  174         error = copyin(uap->mac_p, &mac, sizeof(mac));
  175         if (error)
  176                 return (error);
  177 
  178         error = mac_check_structmac_consistent(&mac);
  179         if (error)
  180                 return (error);
  181 
  182         buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK);
  183         error = copyinstr(mac.m_string, buffer, mac.m_buflen, NULL);
  184         if (error) {
  185                 free(buffer, M_MACTEMP);
  186                 return (error);
  187         }
  188 
  189         intlabel = mac_cred_label_alloc();
  190         error = mac_cred_internalize_label(intlabel, buffer);
  191         free(buffer, M_MACTEMP);
  192         if (error)
  193                 goto out;
  194 
  195         newcred = crget();
  196 
  197         p = td->td_proc;
  198         PROC_LOCK(p);
  199         oldcred = p->p_ucred;
  200 
  201         error = mac_cred_check_relabel(oldcred, intlabel);
  202         if (error) {
  203                 PROC_UNLOCK(p);
  204                 crfree(newcred);
  205                 goto out;
  206         }
  207 
  208         setsugid(p);
  209         crcopy(newcred, oldcred);
  210         mac_cred_relabel(newcred, intlabel);
  211         p->p_ucred = newcred;
  212 
  213         PROC_UNLOCK(p);
  214         crfree(oldcred);
  215         mac_proc_vm_revoke(td);
  216 
  217 out:
  218         mac_cred_label_free(intlabel);
  219         return (error);
  220 }
  221 
  222 int
  223 sys___mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap)
  224 {
  225         char *elements, *buffer;
  226         struct label *intlabel;
  227         struct file *fp;
  228         struct mac mac;
  229         struct vnode *vp;
  230         struct pipe *pipe;
  231         struct socket *so;
  232         short label_type;
  233         int vfslocked, error;
  234 
  235         error = copyin(uap->mac_p, &mac, sizeof(mac));
  236         if (error)
  237                 return (error);
  238 
  239         error = mac_check_structmac_consistent(&mac);
  240         if (error)
  241                 return (error);
  242 
  243         elements = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK);
  244         error = copyinstr(mac.m_string, elements, mac.m_buflen, NULL);
  245         if (error) {
  246                 free(elements, M_MACTEMP);
  247                 return (error);
  248         }
  249 
  250         buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK | M_ZERO);
  251         error = fget(td, uap->fd, CAP_MAC_GET, &fp);
  252         if (error)
  253                 goto out;
  254 
  255         label_type = fp->f_type;
  256         switch (fp->f_type) {
  257         case DTYPE_FIFO:
  258         case DTYPE_VNODE:
  259                 if (!(mac_labeled & MPC_OBJECT_VNODE)) {
  260                         error = EINVAL;
  261                         goto out_fdrop;
  262                 }
  263                 vp = fp->f_vnode;
  264                 intlabel = mac_vnode_label_alloc();
  265                 vfslocked = VFS_LOCK_GIANT(vp->v_mount);
  266                 vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
  267                 mac_vnode_copy_label(vp->v_label, intlabel);
  268                 VOP_UNLOCK(vp, 0);
  269                 VFS_UNLOCK_GIANT(vfslocked);
  270                 error = mac_vnode_externalize_label(intlabel, elements,
  271                     buffer, mac.m_buflen);
  272                 mac_vnode_label_free(intlabel);
  273                 break;
  274 
  275         case DTYPE_PIPE:
  276                 if (!(mac_labeled & MPC_OBJECT_PIPE)) {
  277                         error = EINVAL;
  278                         goto out_fdrop;
  279                 }
  280                 pipe = fp->f_data;
  281                 intlabel = mac_pipe_label_alloc();
  282                 PIPE_LOCK(pipe);
  283                 mac_pipe_copy_label(pipe->pipe_pair->pp_label, intlabel);
  284                 PIPE_UNLOCK(pipe);
  285                 error = mac_pipe_externalize_label(intlabel, elements,
  286                     buffer, mac.m_buflen);
  287                 mac_pipe_label_free(intlabel);
  288                 break;
  289 
  290         case DTYPE_SOCKET:
  291                 if (!(mac_labeled & MPC_OBJECT_SOCKET)) {
  292                         error = EINVAL;
  293                         goto out_fdrop;
  294                 }
  295                 so = fp->f_data;
  296                 intlabel = mac_socket_label_alloc(M_WAITOK);
  297                 SOCK_LOCK(so);
  298                 mac_socket_copy_label(so->so_label, intlabel);
  299                 SOCK_UNLOCK(so);
  300                 error = mac_socket_externalize_label(intlabel, elements,
  301                     buffer, mac.m_buflen);
  302                 mac_socket_label_free(intlabel);
  303                 break;
  304 
  305         default:
  306                 error = EINVAL;
  307         }
  308         if (error == 0)
  309                 error = copyout(buffer, mac.m_string, strlen(buffer)+1);
  310 out_fdrop:
  311         fdrop(fp, td);
  312 out:
  313         free(buffer, M_MACTEMP);
  314         free(elements, M_MACTEMP);
  315         return (error);
  316 }
  317 
  318 int
  319 sys___mac_get_file(struct thread *td, struct __mac_get_file_args *uap)
  320 {
  321         char *elements, *buffer;
  322         struct nameidata nd;
  323         struct label *intlabel;
  324         struct mac mac;
  325         int vfslocked, error;
  326 
  327         if (!(mac_labeled & MPC_OBJECT_VNODE))
  328                 return (EINVAL);
  329 
  330         error = copyin(uap->mac_p, &mac, sizeof(mac));
  331         if (error)
  332                 return (error);
  333 
  334         error = mac_check_structmac_consistent(&mac);
  335         if (error)
  336                 return (error);
  337 
  338         elements = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK);
  339         error = copyinstr(mac.m_string, elements, mac.m_buflen, NULL);
  340         if (error) {
  341                 free(elements, M_MACTEMP);
  342                 return (error);
  343         }
  344 
  345         buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK | M_ZERO);
  346         NDINIT(&nd, LOOKUP, MPSAFE | LOCKLEAF | FOLLOW, UIO_USERSPACE,
  347             uap->path_p, td);
  348         error = namei(&nd);
  349         if (error)
  350                 goto out;
  351 
  352         intlabel = mac_vnode_label_alloc();
  353         vfslocked = NDHASGIANT(&nd);
  354         mac_vnode_copy_label(nd.ni_vp->v_label, intlabel);
  355         error = mac_vnode_externalize_label(intlabel, elements, buffer,
  356             mac.m_buflen);
  357 
  358         NDFREE(&nd, 0);
  359         VFS_UNLOCK_GIANT(vfslocked);
  360         mac_vnode_label_free(intlabel);
  361         if (error == 0)
  362                 error = copyout(buffer, mac.m_string, strlen(buffer)+1);
  363 
  364 out:
  365         free(buffer, M_MACTEMP);
  366         free(elements, M_MACTEMP);
  367 
  368         return (error);
  369 }
  370 
  371 int
  372 sys___mac_get_link(struct thread *td, struct __mac_get_link_args *uap)
  373 {
  374         char *elements, *buffer;
  375         struct nameidata nd;
  376         struct label *intlabel;
  377         struct mac mac;
  378         int vfslocked, error;
  379 
  380         if (!(mac_labeled & MPC_OBJECT_VNODE))
  381                 return (EINVAL);
  382 
  383         error = copyin(uap->mac_p, &mac, sizeof(mac));
  384         if (error)
  385                 return (error);
  386 
  387         error = mac_check_structmac_consistent(&mac);
  388         if (error)
  389                 return (error);
  390 
  391         elements = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK);
  392         error = copyinstr(mac.m_string, elements, mac.m_buflen, NULL);
  393         if (error) {
  394                 free(elements, M_MACTEMP);
  395                 return (error);
  396         }
  397 
  398         buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK | M_ZERO);
  399         NDINIT(&nd, LOOKUP, MPSAFE | LOCKLEAF | NOFOLLOW, UIO_USERSPACE,
  400             uap->path_p, td);
  401         error = namei(&nd);
  402         if (error)
  403                 goto out;
  404 
  405         intlabel = mac_vnode_label_alloc();
  406         vfslocked = NDHASGIANT(&nd);
  407         mac_vnode_copy_label(nd.ni_vp->v_label, intlabel);
  408         error = mac_vnode_externalize_label(intlabel, elements, buffer,
  409             mac.m_buflen);
  410         NDFREE(&nd, 0);
  411         VFS_UNLOCK_GIANT(vfslocked);
  412         mac_vnode_label_free(intlabel);
  413 
  414         if (error == 0)
  415                 error = copyout(buffer, mac.m_string, strlen(buffer)+1);
  416 
  417 out:
  418         free(buffer, M_MACTEMP);
  419         free(elements, M_MACTEMP);
  420 
  421         return (error);
  422 }
  423 
  424 int
  425 sys___mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap)
  426 {
  427         struct label *intlabel;
  428         struct pipe *pipe;
  429         struct socket *so;
  430         struct file *fp;
  431         struct mount *mp;
  432         struct vnode *vp;
  433         struct mac mac;
  434         char *buffer;
  435         int error, vfslocked;
  436 
  437         error = copyin(uap->mac_p, &mac, sizeof(mac));
  438         if (error)
  439                 return (error);
  440 
  441         error = mac_check_structmac_consistent(&mac);
  442         if (error)
  443                 return (error);
  444 
  445         buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK);
  446         error = copyinstr(mac.m_string, buffer, mac.m_buflen, NULL);
  447         if (error) {
  448                 free(buffer, M_MACTEMP);
  449                 return (error);
  450         }
  451 
  452         error = fget(td, uap->fd, CAP_MAC_SET, &fp);
  453         if (error)
  454                 goto out;
  455 
  456         switch (fp->f_type) {
  457         case DTYPE_FIFO:
  458         case DTYPE_VNODE:
  459                 if (!(mac_labeled & MPC_OBJECT_VNODE)) {
  460                         error = EINVAL;
  461                         goto out_fdrop;
  462                 }
  463                 intlabel = mac_vnode_label_alloc();
  464                 error = mac_vnode_internalize_label(intlabel, buffer);
  465                 if (error) {
  466                         mac_vnode_label_free(intlabel);
  467                         break;
  468                 }
  469                 vp = fp->f_vnode;
  470                 vfslocked = VFS_LOCK_GIANT(vp->v_mount);
  471                 error = vn_start_write(vp, &mp, V_WAIT | PCATCH);
  472                 if (error != 0) {
  473                         VFS_UNLOCK_GIANT(vfslocked);
  474                         mac_vnode_label_free(intlabel);
  475                         break;
  476                 }
  477                 vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
  478                 error = vn_setlabel(vp, intlabel, td->td_ucred);
  479                 VOP_UNLOCK(vp, 0);
  480                 vn_finished_write(mp);
  481                 VFS_UNLOCK_GIANT(vfslocked);
  482                 mac_vnode_label_free(intlabel);
  483                 break;
  484 
  485         case DTYPE_PIPE:
  486                 if (!(mac_labeled & MPC_OBJECT_PIPE)) {
  487                         error = EINVAL;
  488                         goto out_fdrop;
  489                 }
  490                 intlabel = mac_pipe_label_alloc();
  491                 error = mac_pipe_internalize_label(intlabel, buffer);
  492                 if (error == 0) {
  493                         pipe = fp->f_data;
  494                         PIPE_LOCK(pipe);
  495                         error = mac_pipe_label_set(td->td_ucred,
  496                             pipe->pipe_pair, intlabel);
  497                         PIPE_UNLOCK(pipe);
  498                 }
  499                 mac_pipe_label_free(intlabel);
  500                 break;
  501 
  502         case DTYPE_SOCKET:
  503                 if (!(mac_labeled & MPC_OBJECT_SOCKET)) {
  504                         error = EINVAL;
  505                         goto out_fdrop;
  506                 }
  507                 intlabel = mac_socket_label_alloc(M_WAITOK);
  508                 error = mac_socket_internalize_label(intlabel, buffer);
  509                 if (error == 0) {
  510                         so = fp->f_data;
  511                         error = mac_socket_label_set(td->td_ucred, so,
  512                             intlabel);
  513                 }
  514                 mac_socket_label_free(intlabel);
  515                 break;
  516 
  517         default:
  518                 error = EINVAL;
  519         }
  520 out_fdrop:
  521         fdrop(fp, td);
  522 out:
  523         free(buffer, M_MACTEMP);
  524         return (error);
  525 }
  526 
  527 int
  528 sys___mac_set_file(struct thread *td, struct __mac_set_file_args *uap)
  529 {
  530         struct label *intlabel;
  531         struct nameidata nd;
  532         struct mount *mp;
  533         struct mac mac;
  534         char *buffer;
  535         int vfslocked, error;
  536 
  537         if (!(mac_labeled & MPC_OBJECT_VNODE))
  538                 return (EINVAL);
  539 
  540         error = copyin(uap->mac_p, &mac, sizeof(mac));
  541         if (error)
  542                 return (error);
  543 
  544         error = mac_check_structmac_consistent(&mac);
  545         if (error)
  546                 return (error);
  547 
  548         buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK);
  549         error = copyinstr(mac.m_string, buffer, mac.m_buflen, NULL);
  550         if (error) {
  551                 free(buffer, M_MACTEMP);
  552                 return (error);
  553         }
  554 
  555         intlabel = mac_vnode_label_alloc();
  556         error = mac_vnode_internalize_label(intlabel, buffer);
  557         free(buffer, M_MACTEMP);
  558         if (error)
  559                 goto out;
  560 
  561         NDINIT(&nd, LOOKUP, MPSAFE | LOCKLEAF | FOLLOW, UIO_USERSPACE,
  562             uap->path_p, td);
  563         error = namei(&nd);
  564         vfslocked = NDHASGIANT(&nd);
  565         if (error == 0) {
  566                 error = vn_start_write(nd.ni_vp, &mp, V_WAIT | PCATCH);
  567                 if (error == 0) {
  568                         error = vn_setlabel(nd.ni_vp, intlabel,
  569                             td->td_ucred);
  570                         vn_finished_write(mp);
  571                 }
  572         }
  573 
  574         NDFREE(&nd, 0);
  575         VFS_UNLOCK_GIANT(vfslocked);
  576 out:
  577         mac_vnode_label_free(intlabel);
  578         return (error);
  579 }
  580 
  581 int
  582 sys___mac_set_link(struct thread *td, struct __mac_set_link_args *uap)
  583 {
  584         struct label *intlabel;
  585         struct nameidata nd;
  586         struct mount *mp;
  587         struct mac mac;
  588         char *buffer;
  589         int vfslocked, error;
  590 
  591         if (!(mac_labeled & MPC_OBJECT_VNODE))
  592                 return (EINVAL);
  593 
  594         error = copyin(uap->mac_p, &mac, sizeof(mac));
  595         if (error)
  596                 return (error);
  597 
  598         error = mac_check_structmac_consistent(&mac);
  599         if (error)
  600                 return (error);
  601 
  602         buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK);
  603         error = copyinstr(mac.m_string, buffer, mac.m_buflen, NULL);
  604         if (error) {
  605                 free(buffer, M_MACTEMP);
  606                 return (error);
  607         }
  608 
  609         intlabel = mac_vnode_label_alloc();
  610         error = mac_vnode_internalize_label(intlabel, buffer);
  611         free(buffer, M_MACTEMP);
  612         if (error)
  613                 goto out;
  614 
  615         NDINIT(&nd, LOOKUP, MPSAFE | LOCKLEAF | NOFOLLOW, UIO_USERSPACE,
  616             uap->path_p, td);
  617         error = namei(&nd);
  618         vfslocked = NDHASGIANT(&nd);
  619         if (error == 0) {
  620                 error = vn_start_write(nd.ni_vp, &mp, V_WAIT | PCATCH);
  621                 if (error == 0) {
  622                         error = vn_setlabel(nd.ni_vp, intlabel,
  623                             td->td_ucred);
  624                         vn_finished_write(mp);
  625                 }
  626         }
  627 
  628         NDFREE(&nd, 0);
  629         VFS_UNLOCK_GIANT(vfslocked);
  630 out:
  631         mac_vnode_label_free(intlabel);
  632         return (error);
  633 }
  634 
  635 int
  636 sys_mac_syscall(struct thread *td, struct mac_syscall_args *uap)
  637 {
  638         struct mac_policy_conf *mpc;
  639         char target[MAC_MAX_POLICY_NAME];
  640         int error;
  641 
  642         error = copyinstr(uap->policy, target, sizeof(target), NULL);
  643         if (error)
  644                 return (error);
  645 
  646         error = ENOSYS;
  647         LIST_FOREACH(mpc, &mac_static_policy_list, mpc_list) {
  648                 if (strcmp(mpc->mpc_name, target) == 0 &&
  649                     mpc->mpc_ops->mpo_syscall != NULL) {
  650                         error = mpc->mpc_ops->mpo_syscall(td,
  651                             uap->call, uap->arg);
  652                         goto out;
  653                 }
  654         }
  655 
  656         if (!LIST_EMPTY(&mac_policy_list)) {
  657                 mac_policy_slock_sleep();
  658                 LIST_FOREACH(mpc, &mac_policy_list, mpc_list) {
  659                         if (strcmp(mpc->mpc_name, target) == 0 &&
  660                             mpc->mpc_ops->mpo_syscall != NULL) {
  661                                 error = mpc->mpc_ops->mpo_syscall(td,
  662                                     uap->call, uap->arg);
  663                                 break;
  664                         }
  665                 }
  666                 mac_policy_sunlock_sleep();
  667         }
  668 out:
  669         return (error);
  670 }
  671 
  672 #else /* !MAC */
  673 
  674 int
  675 sys___mac_get_pid(struct thread *td, struct __mac_get_pid_args *uap)
  676 {
  677 
  678         return (ENOSYS);
  679 }
  680 
  681 int
  682 sys___mac_get_proc(struct thread *td, struct __mac_get_proc_args *uap)
  683 {
  684 
  685         return (ENOSYS);
  686 }
  687 
  688 int
  689 sys___mac_set_proc(struct thread *td, struct __mac_set_proc_args *uap)
  690 {
  691 
  692         return (ENOSYS);
  693 }
  694 
  695 int
  696 sys___mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap)
  697 {
  698 
  699         return (ENOSYS);
  700 }
  701 
  702 int
  703 sys___mac_get_file(struct thread *td, struct __mac_get_file_args *uap)
  704 {
  705 
  706         return (ENOSYS);
  707 }
  708 
  709 int
  710 sys___mac_get_link(struct thread *td, struct __mac_get_link_args *uap)
  711 {
  712 
  713         return (ENOSYS);
  714 }
  715 
  716 int
  717 sys___mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap)
  718 {
  719 
  720         return (ENOSYS);
  721 }
  722 
  723 int
  724 sys___mac_set_file(struct thread *td, struct __mac_set_file_args *uap)
  725 {
  726 
  727         return (ENOSYS);
  728 }
  729 
  730 int
  731 sys___mac_set_link(struct thread *td, struct __mac_set_link_args *uap)
  732 {
  733 
  734         return (ENOSYS);
  735 }
  736 
  737 int
  738 sys_mac_syscall(struct thread *td, struct mac_syscall_args *uap)
  739 {
  740 
  741         return (ENOSYS);
  742 }
  743 
  744 #endif /* !MAC */
Cache object: 50efa55c5c82f63d49f1adfe542a09c3
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]
This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.
FreeBSD/Linux Kernel Cross Reference sys/security/mac/mac_syscalls.c

FreeBSD/Linux Kernel Cross Reference
sys/security/mac/mac_syscalls.c
