The Design and Implementation of the FreeBSD Operating System, Second Edition
Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]

FreeBSD/Linux Kernel Cross Reference
sys/security/mac/mac_system.c

Version: -  FREEBSD  -  FREEBSD-13-STABLE  -  FREEBSD-13-0  -  FREEBSD-12-STABLE  -  FREEBSD-12-0  -  FREEBSD-11-STABLE  -  FREEBSD-11-0  -  FREEBSD-10-STABLE  -  FREEBSD-10-0  -  FREEBSD-9-STABLE  -  FREEBSD-9-0  -  FREEBSD-8-STABLE  -  FREEBSD-8-0  -  FREEBSD-7-STABLE  -  FREEBSD-7-0  -  FREEBSD-6-STABLE  -  FREEBSD-6-0  -  FREEBSD-5-STABLE  -  FREEBSD-5-0  -  FREEBSD-4-STABLE  -  FREEBSD-3-STABLE  -  FREEBSD22  -  l41  -  OPENBSD  -  linux-2.6  -  MK84  -  PLAN9  -  xnu-8792 
SearchContext: -  none  -  3  -  10 

    1 /*-
    2  * Copyright (c) 2002-2003 Networks Associates Technology, Inc.
    3  * Copyright (c) 2006 SPARTA, Inc.
    4  * Copyright (c) 2007, 2009 Robert N. M. Watson
    5  * All rights reserved.
    6  *
    7  * This software was developed for the FreeBSD Project in part by Network
    8  * Associates Laboratories, the Security Research Division of Network
    9  * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"),
   10  * as part of the DARPA CHATS research program.
   11  *
   12  * Portions of this software were developed by Robert Watson for the
   13  * TrustedBSD Project.
   14  *
   15  * This software was enhanced by SPARTA ISSO under SPAWAR contract
   16  * N66001-04-C-6019 ("SEFOS").
   17  *
   18  * This software was developed at the University of Cambridge Computer
   19  * Laboratory with support from a grant from Google, Inc.
   20  *
   21  * Redistribution and use in source and binary forms, with or without
   22  * modification, are permitted provided that the following conditions
   23  * are met:
   24  * 1. Redistributions of source code must retain the above copyright
   25  *    notice, this list of conditions and the following disclaimer.
   26  * 2. Redistributions in binary form must reproduce the above copyright
   27  *    notice, this list of conditions and the following disclaimer in the
   28  *    documentation and/or other materials provided with the distribution.
   29  *
   30  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
   31  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
   32  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
   33  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
   34  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
   35  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
   36  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
   37  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
   38  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
   39  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
   40  * SUCH DAMAGE.
   41  */
   42 
   43 /*
   44  * MAC Framework entry points relating to overall operation of system,
   45  * including global services such as the kernel environment and loadable
   46  * modules.
   47  *
   48  * System checks often align with existing privilege checks, but provide
   49  * additional security context that may be relevant to policies, such as the
   50  * specific object being operated on.
   51  */
   52 
   53 #include <sys/cdefs.h>
   54 __FBSDID("$FreeBSD: releng/9.1/sys/security/mac/mac_system.c 191731 2009-05-01 21:05:40Z rwatson $");
   55 
   56 #include "opt_kdtrace.h"
   57 #include "opt_mac.h"
   58 
   59 #include <sys/param.h>
   60 #include <sys/kernel.h>
   61 #include <sys/lock.h>
   62 #include <sys/malloc.h>
   63 #include <sys/module.h>
   64 #include <sys/mutex.h>
   65 #include <sys/sdt.h>
   66 #include <sys/systm.h>
   67 #include <sys/vnode.h>
   68 #include <sys/sysctl.h>
   69 
   70 #include <security/mac/mac_framework.h>
   71 #include <security/mac/mac_internal.h>
   72 #include <security/mac/mac_policy.h>
   73 
   74 MAC_CHECK_PROBE_DEFINE1(kenv_check_dump, "struct ucred *");
   75 
   76 int
   77 mac_kenv_check_dump(struct ucred *cred)
   78 {
   79         int error;
   80 
   81         MAC_POLICY_CHECK_NOSLEEP(kenv_check_dump, cred);
   82         MAC_CHECK_PROBE1(kenv_check_dump, error, cred);
   83 
   84         return (error);
   85 }
   86 
   87 MAC_CHECK_PROBE_DEFINE2(kenv_check_get, "struct ucred *", "char *");
   88 
   89 int
   90 mac_kenv_check_get(struct ucred *cred, char *name)
   91 {
   92         int error;
   93 
   94         MAC_POLICY_CHECK_NOSLEEP(kenv_check_get, cred, name);
   95         MAC_CHECK_PROBE2(kenv_check_get, error, cred, name);
   96 
   97         return (error);
   98 }
   99 
  100 MAC_CHECK_PROBE_DEFINE3(kenv_check_set, "struct ucred *", "char *",
  101     "char *");
  102 
  103 int
  104 mac_kenv_check_set(struct ucred *cred, char *name, char *value)
  105 {
  106         int error;
  107 
  108         MAC_POLICY_CHECK_NOSLEEP(kenv_check_set, cred, name, value);
  109         MAC_CHECK_PROBE3(kenv_check_set, error, cred, name, value);
  110 
  111         return (error);
  112 }
  113 
  114 MAC_CHECK_PROBE_DEFINE2(kenv_check_unset, "struct ucred *", "char *");
  115 
  116 int
  117 mac_kenv_check_unset(struct ucred *cred, char *name)
  118 {
  119         int error;
  120 
  121         MAC_POLICY_CHECK_NOSLEEP(kenv_check_unset, cred, name);
  122         MAC_CHECK_PROBE2(kenv_check_unset, error, cred, name);
  123 
  124         return (error);
  125 }
  126 
  127 MAC_CHECK_PROBE_DEFINE2(kld_check_load, "struct ucred *", "struct vnode *");
  128 
  129 int
  130 mac_kld_check_load(struct ucred *cred, struct vnode *vp)
  131 {
  132         int error;
  133 
  134         ASSERT_VOP_LOCKED(vp, "mac_kld_check_load");
  135 
  136         MAC_POLICY_CHECK(kld_check_load, cred, vp, vp->v_label);
  137         MAC_CHECK_PROBE2(kld_check_load, error, cred, vp);
  138 
  139         return (error);
  140 }
  141 
  142 MAC_CHECK_PROBE_DEFINE1(kld_check_stat, "struct ucred *");
  143 
  144 int
  145 mac_kld_check_stat(struct ucred *cred)
  146 {
  147         int error;
  148 
  149         MAC_POLICY_CHECK_NOSLEEP(kld_check_stat, cred);
  150         MAC_CHECK_PROBE1(kld_check_stat, error, cred);
  151 
  152         return (error);
  153 }
  154 
  155 MAC_CHECK_PROBE_DEFINE2(system_check_acct, "struct ucred *",
  156     "struct vnode *");
  157 
  158 int
  159 mac_system_check_acct(struct ucred *cred, struct vnode *vp)
  160 {
  161         int error;
  162 
  163         if (vp != NULL) {
  164                 ASSERT_VOP_LOCKED(vp, "mac_system_check_acct");
  165         }
  166 
  167         MAC_POLICY_CHECK(system_check_acct, cred, vp,
  168             vp != NULL ? vp->v_label : NULL);
  169         MAC_CHECK_PROBE2(system_check_acct, error, cred, vp);
  170 
  171         return (error);
  172 }
  173 
  174 MAC_CHECK_PROBE_DEFINE2(system_check_reboot, "struct ucred *", "int");
  175 
  176 int
  177 mac_system_check_reboot(struct ucred *cred, int howto)
  178 {
  179         int error;
  180 
  181         MAC_POLICY_CHECK_NOSLEEP(system_check_reboot, cred, howto);
  182         MAC_CHECK_PROBE2(system_check_reboot, error, cred, howto);
  183 
  184         return (error);
  185 }
  186 
  187 MAC_CHECK_PROBE_DEFINE2(system_check_swapon, "struct ucred *",
  188     "struct vnode *");
  189 
  190 int
  191 mac_system_check_swapon(struct ucred *cred, struct vnode *vp)
  192 {
  193         int error;
  194 
  195         ASSERT_VOP_LOCKED(vp, "mac_system_check_swapon");
  196 
  197         MAC_POLICY_CHECK(system_check_swapon, cred, vp, vp->v_label);
  198         MAC_CHECK_PROBE2(system_check_swapon, error, cred, vp);
  199 
  200         return (error);
  201 }
  202 
  203 MAC_CHECK_PROBE_DEFINE2(system_check_swapoff, "struct ucred *",
  204     "struct vnode *");
  205 
  206 int
  207 mac_system_check_swapoff(struct ucred *cred, struct vnode *vp)
  208 {
  209         int error;
  210 
  211         ASSERT_VOP_LOCKED(vp, "mac_system_check_swapoff");
  212 
  213         MAC_POLICY_CHECK(system_check_swapoff, cred, vp, vp->v_label);
  214         MAC_CHECK_PROBE2(system_check_swapoff, error, cred, vp);
  215 
  216         return (error);
  217 }
  218 
  219 MAC_CHECK_PROBE_DEFINE3(system_check_sysctl, "struct ucred *",
  220     "struct sysctl_oid *", "struct sysctl_req *");
  221 
  222 int
  223 mac_system_check_sysctl(struct ucred *cred, struct sysctl_oid *oidp,
  224     void *arg1, int arg2, struct sysctl_req *req)
  225 {
  226         int error;
  227 
  228         /*
  229          * XXXMAC: We would very much like to assert the SYSCTL_LOCK here,
  230          * but since it's not exported from kern_sysctl.c, we can't.
  231          */
  232         MAC_POLICY_CHECK_NOSLEEP(system_check_sysctl, cred, oidp, arg1, arg2,
  233             req);
  234         MAC_CHECK_PROBE3(system_check_sysctl, error, cred, oidp, req);
  235 
  236         return (error);
  237 }

Cache object: e9465963f5cc92268c563530fb61f723


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]


This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.