1 /*-
2 * Copyright (c) 1999-2002, 2007 Robert N. M. Watson
3 * Copyright (c) 2001-2002 Networks Associates Technology, Inc.
4 * All rights reserved.
5 *
6 * This software was developed by Robert Watson for the TrustedBSD Project.
7 *
8 * This software was developed for the FreeBSD Project in part by Network
9 * Associates Laboratories, the Security Research Division of Network
10 * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"),
11 * as part of the DARPA CHATS research program.
12 *
13 * Redistribution and use in source and binary forms, with or without
14 * modification, are permitted provided that the following conditions
15 * are met:
16 * 1. Redistributions of source code must retain the above copyright
17 * notice, this list of conditions and the following disclaimer.
18 * 2. Redistributions in binary form must reproduce the above copyright
19 * notice, this list of conditions and the following disclaimer in the
20 * documentation and/or other materials provided with the distribution.
21 *
22 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
23 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
26 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32 * SUCH DAMAGE.
33 *
34 * $FreeBSD$
35 */
36
37 /*
38 * Developed by the TrustedBSD Project.
39 * Limit access to interfaces until they are specifically administratively
40 * enabled. Prevents protocol stack-driven packet leakage in unsafe
41 * environments.
42 */
43
44 #include <sys/param.h>
45 #include <sys/kernel.h>
46 #include <sys/module.h>
47 #include <sys/socket.h>
48 #include <sys/sysctl.h>
49
50 #include <net/bpfdesc.h>
51 #include <net/if_types.h>
52
53 #include <security/mac/mac_policy.h>
54
55 SYSCTL_DECL(_security_mac);
56
57 SYSCTL_NODE(_security_mac, OID_AUTO, ifoff, CTLFLAG_RW, 0,
58 "TrustedBSD mac_ifoff policy controls");
59
60 static int mac_ifoff_enabled = 1;
61 SYSCTL_INT(_security_mac_ifoff, OID_AUTO, enabled, CTLFLAG_RW,
62 &mac_ifoff_enabled, 0, "Enforce ifoff policy");
63 TUNABLE_INT("security.mac.ifoff.enabled", &mac_ifoff_enabled);
64
65 static int mac_ifoff_lo_enabled = 1;
66 SYSCTL_INT(_security_mac_ifoff, OID_AUTO, lo_enabled, CTLFLAG_RW,
67 &mac_ifoff_lo_enabled, 0, "Enable loopback interfaces");
68 TUNABLE_INT("security.mac.ifoff.lo_enabled", &mac_ifoff_lo_enabled);
69
70 static int mac_ifoff_other_enabled = 0;
71 SYSCTL_INT(_security_mac_ifoff, OID_AUTO, other_enabled, CTLFLAG_RW,
72 &mac_ifoff_other_enabled, 0, "Enable other interfaces");
73 TUNABLE_INT("security.mac.ifoff.other_enabled", &mac_ifoff_other_enabled);
74
75 static int mac_ifoff_bpfrecv_enabled = 0;
76 SYSCTL_INT(_security_mac_ifoff, OID_AUTO, bpfrecv_enabled, CTLFLAG_RW,
77 &mac_ifoff_bpfrecv_enabled, 0, "Enable BPF reception even when interface "
78 "is disabled");
79 TUNABLE_INT("security.mac.ifoff.bpfrecv.enabled", &mac_ifoff_bpfrecv_enabled);
80
81 static int
82 check_ifnet_outgoing(struct ifnet *ifp)
83 {
84
85 if (!mac_ifoff_enabled)
86 return (0);
87
88 if (mac_ifoff_lo_enabled && ifp->if_type == IFT_LOOP)
89 return (0);
90
91 if (mac_ifoff_other_enabled && ifp->if_type != IFT_LOOP)
92 return (0);
93
94 return (EPERM);
95 }
96
97 static int
98 check_ifnet_incoming(struct ifnet *ifp, int viabpf)
99 {
100 if (!mac_ifoff_enabled)
101 return (0);
102
103 if (mac_ifoff_lo_enabled && ifp->if_type == IFT_LOOP)
104 return (0);
105
106 if (mac_ifoff_other_enabled && ifp->if_type != IFT_LOOP)
107 return (0);
108
109 if (viabpf && mac_ifoff_bpfrecv_enabled)
110 return (0);
111
112 return (EPERM);
113 }
114
115 static int
116 mac_ifoff_check_bpfdesc_receive(struct bpf_d *d, struct label *dlabel,
117 struct ifnet *ifp, struct label *ifplabel)
118 {
119
120 return (check_ifnet_incoming(ifp, 1));
121 }
122
123 static int
124 mac_ifoff_check_ifnet_transmit(struct ifnet *ifp, struct label *ifplabel,
125 struct mbuf *m, struct label *mlabel)
126 {
127
128 return (check_ifnet_outgoing(ifp));
129 }
130
131 static int
132 mac_ifoff_check_inpcb_deliver(struct inpcb *inp, struct label *inplabel,
133 struct mbuf *m, struct label *mlabel)
134 {
135
136 M_ASSERTPKTHDR(m);
137 if (m->m_pkthdr.rcvif != NULL)
138 return (check_ifnet_incoming(m->m_pkthdr.rcvif, 0));
139
140 return (0);
141 }
142
143 static int
144 mac_ifoff_check_socket_deliver(struct socket *so, struct label *solabel,
145 struct mbuf *m, struct label *mlabel)
146 {
147
148 M_ASSERTPKTHDR(m);
149 if (m->m_pkthdr.rcvif != NULL)
150 return (check_ifnet_incoming(m->m_pkthdr.rcvif, 0));
151
152 return (0);
153 }
154
155 static struct mac_policy_ops mac_ifoff_ops =
156 {
157 .mpo_check_bpfdesc_receive = mac_ifoff_check_bpfdesc_receive,
158 .mpo_check_ifnet_transmit = mac_ifoff_check_ifnet_transmit,
159 .mpo_check_inpcb_deliver = mac_ifoff_check_inpcb_deliver,
160 .mpo_check_socket_deliver = mac_ifoff_check_socket_deliver,
161 };
162
163 MAC_POLICY_SET(&mac_ifoff_ops, mac_ifoff, "TrustedBSD MAC/ifoff",
164 MPC_LOADTIME_FLAG_UNLOADOK, NULL);
Cache object: 2a1a25adb9c71ea1f25264883cc2908e
|