diff options
author | rwatson <rwatson@FreeBSD.org> | 2003-11-18 00:39:07 +0000 |
---|---|---|
committer | rwatson <rwatson@FreeBSD.org> | 2003-11-18 00:39:07 +0000 |
commit | 9c969b771a32651104f16586408deb67d7039014 (patch) | |
tree | 9ae16c9f3cb9780bbad2d9f596380ed1094d201c /sys/security/mac_test/mac_test.c | |
parent | c428ace885437d38f0343448bc61807c6e7a690c (diff) | |
download | FreeBSD-src-9c969b771a32651104f16586408deb67d7039014.zip FreeBSD-src-9c969b771a32651104f16586408deb67d7039014.tar.gz |
Introduce a MAC label reference in 'struct inpcb', which caches
the MAC label referenced from 'struct socket' in the IPv4 and
IPv6-based protocols. This permits MAC labels to be checked during
network delivery operations without dereferencing inp->inp_socket
to get to so->so_label, which will eventually avoid our having to
grab the socket lock during delivery at the network layer.
This change introduces 'struct inpcb' as a labeled object to the
MAC Framework, along with the normal circus of entry points:
initialization, creation from socket, destruction, as well as a
delivery access control check.
For most policies, the inpcb label will simply be a cache of the
socket label, so a new protocol switch method is introduced,
pr_sosetlabel() to notify protocols that the socket layer label
has been updated so that the cache can be updated while holding
appropriate locks. Most protocols implement this using
pru_sosetlabel_null(), but IPv4/IPv6 protocols using inpcbs use
the the worker function in_pcbsosetlabel(), which calls into the
MAC Framework to perform a cache update.
Biba, LOMAC, and MLS implement these entry points, as do the stub
policy, and test policy.
Reviewed by: sam, bms
Obtained from: TrustedBSD Project
Sponsored by: DARPA, Network Associates Laboratories
Diffstat (limited to 'sys/security/mac_test/mac_test.c')
-rw-r--r-- | sys/security/mac_test/mac_test.c | 71 |
1 files changed, 71 insertions, 0 deletions
diff --git a/sys/security/mac_test/mac_test.c b/sys/security/mac_test/mac_test.c index 8b591902..847c9e9 100644 --- a/sys/security/mac_test/mac_test.c +++ b/sys/security/mac_test/mac_test.c @@ -81,6 +81,7 @@ SYSCTL_INT(_security_mac_test, OID_AUTO, enabled, CTLFLAG_RW, #define BPFMAGIC 0xfe1ad1b6 #define DEVFSMAGIC 0x9ee79c32 #define IFNETMAGIC 0xc218b120 +#define INPCBMAGIC 0x4440f7bb #define IPQMAGIC 0x206188ef #define MBUFMAGIC 0xbbefa5bb #define MOUNTMAGIC 0xc7c46e47 @@ -99,6 +100,8 @@ SYSCTL_INT(_security_mac_test, OID_AUTO, enabled, CTLFLAG_RW, SLOT(x) == 0, ("%s: Bad DEVFS label", __func__ )) #define ASSERT_IFNET_LABEL(x) KASSERT(SLOT(x) == IFNETMAGIC || \ SLOT(x) == 0, ("%s: Bad IFNET label", __func__ )) +#define ASSERT_INPCB_LABEL(x) KASSERT(SLOT(x) == INPCBMAGIC || \ + SLOT(x) == 0, ("%s: Bad INPCB label", __func__ )) #define ASSERT_IPQ_LABEL(x) KASSERT(SLOT(x) == IPQMAGIC || \ SLOT(x) == 0, ("%s: Bad IPQ label", __func__ )) #define ASSERT_MBUF_LABEL(x) KASSERT(SLOT(x) == MBUFMAGIC || \ @@ -132,6 +135,9 @@ SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_devfsdirent, CTLFLAG_RD, static int init_count_ifnet; SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_ifnet, CTLFLAG_RD, &init_count_ifnet, 0, "ifnet init calls"); +static int init_count_inpcb; +SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_inpcb, CTLFLAG_RD, + &init_count_inpcb, 0, "inpcb init calls"); static int init_count_ipq; SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_ipq, CTLFLAG_RD, &init_count_ipq, 0, "ipq init calls"); @@ -173,6 +179,9 @@ SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_devfsdirent, CTLFLAG_RD, static int destroy_count_ifnet; SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_ifnet, CTLFLAG_RD, &destroy_count_ifnet, 0, "ifnet destroy calls"); +static int destroy_count_inpcb; +SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_inpcb, CTLFLAG_RD, + &destroy_count_inpcb, 0, "inpcb destroy calls"); static int destroy_count_ipq; SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_ipq, CTLFLAG_RD, &destroy_count_ipq, 0, "ipq destroy calls"); @@ -268,6 +277,20 @@ mac_test_init_ifnet_label(struct label *label) } static int +mac_test_init_inpcb_label(struct label *label, int flag) +{ + + if (flag & M_WAITOK) + WITNESS_WARN(WARN_GIANTOK | WARN_SLEEPOK, NULL, + "mac_test_init_inpcb_label() at %s:%d", __FILE__, + __LINE__); + + SLOT(label) = INPCBMAGIC; + atomic_add_int(&init_count_inpcb, 1); + return (0); +} + +static int mac_test_init_ipq_label(struct label *label, int flag) { @@ -420,6 +443,20 @@ mac_test_destroy_ifnet_label(struct label *label) } static void +mac_test_destroy_inpcb_label(struct label *label) +{ + + if (SLOT(label) == INPCBMAGIC || SLOT(label) == 0) { + atomic_add_int(&destroy_count_inpcb, 1); + SLOT(label) = EXMAGIC; + } else if (SLOT(label) == EXMAGIC) { + Debugger("mac_test_destroy_inpcb: dup destroy"); + } else { + Debugger("mac_test_destroy_inpcb: corrupted label"); + } +} + +static void mac_test_destroy_ipq_label(struct label *label) { @@ -852,6 +889,15 @@ mac_test_create_ifnet(struct ifnet *ifnet, struct label *ifnetlabel) } static void +mac_test_create_inpcb_from_socket(struct socket *so, struct label *solabel, + struct inpcb *inp, struct label *inplabel) +{ + + ASSERT_SOCKET_LABEL(solabel); + ASSERT_INPCB_LABEL(inplabel); +} + +static void mac_test_create_ipq(struct mbuf *fragment, struct label *fragmentlabel, struct ipq *ipq, struct label *ipqlabel) { @@ -962,6 +1008,15 @@ mac_test_update_ipq(struct mbuf *fragment, struct label *fragmentlabel, ASSERT_IPQ_LABEL(ipqlabel); } +static void +mac_test_inpcb_sosetlabel(struct socket *so, struct label *solabel, + struct inpcb *inp, struct label *inplabel) +{ + + ASSERT_SOCKET_LABEL(solabel); + ASSERT_INPCB_LABEL(inplabel); +} + /* * Labeling event operations: processes. */ @@ -1094,6 +1149,17 @@ mac_test_check_ifnet_transmit(struct ifnet *ifnet, struct label *ifnetlabel, } static int +mac_test_check_inpcb_deliver(struct inpcb *inp, struct label *inplabel, + struct mbuf *m, struct label *mlabel) +{ + + ASSERT_INPCB_LABEL(inplabel); + ASSERT_MBUF_LABEL(mlabel); + + return (0); +} + +static int mac_test_check_kenv_dump(struct ucred *cred) { @@ -1789,6 +1855,7 @@ static struct mac_policy_ops mac_test_ops = .mpo_init_cred_label = mac_test_init_cred_label, .mpo_init_devfsdirent_label = mac_test_init_devfsdirent_label, .mpo_init_ifnet_label = mac_test_init_ifnet_label, + .mpo_init_inpcb_label = mac_test_init_inpcb_label, .mpo_init_ipq_label = mac_test_init_ipq_label, .mpo_init_mbuf_label = mac_test_init_mbuf_label, .mpo_init_mount_label = mac_test_init_mount_label, @@ -1802,6 +1869,7 @@ static struct mac_policy_ops mac_test_ops = .mpo_destroy_cred_label = mac_test_destroy_cred_label, .mpo_destroy_devfsdirent_label = mac_test_destroy_devfsdirent_label, .mpo_destroy_ifnet_label = mac_test_destroy_ifnet_label, + .mpo_destroy_inpcb_label = mac_test_destroy_inpcb_label, .mpo_destroy_ipq_label = mac_test_destroy_ipq_label, .mpo_destroy_mbuf_label = mac_test_destroy_mbuf_label, .mpo_destroy_mount_label = mac_test_destroy_mount_label, @@ -1848,6 +1916,7 @@ static struct mac_policy_ops mac_test_ops = .mpo_set_socket_peer_from_socket = mac_test_set_socket_peer_from_socket, .mpo_create_bpfdesc = mac_test_create_bpfdesc, .mpo_create_ifnet = mac_test_create_ifnet, + .mpo_create_inpcb_from_socket = mac_test_create_inpcb_from_socket, .mpo_create_datagram_from_ipq = mac_test_create_datagram_from_ipq, .mpo_create_fragment = mac_test_create_fragment, .mpo_create_ipq = mac_test_create_ipq, @@ -1862,6 +1931,7 @@ static struct mac_policy_ops mac_test_ops = .mpo_reflect_mbuf_tcp = mac_test_reflect_mbuf_tcp, .mpo_relabel_ifnet = mac_test_relabel_ifnet, .mpo_update_ipq = mac_test_update_ipq, + .mpo_inpcb_sosetlabel = mac_test_inpcb_sosetlabel, .mpo_create_cred = mac_test_create_cred, .mpo_execve_transition = mac_test_execve_transition, .mpo_execve_will_transition = mac_test_execve_will_transition, @@ -1874,6 +1944,7 @@ static struct mac_policy_ops mac_test_ops = .mpo_check_cred_visible = mac_test_check_cred_visible, .mpo_check_ifnet_relabel = mac_test_check_ifnet_relabel, .mpo_check_ifnet_transmit = mac_test_check_ifnet_transmit, + .mpo_check_inpcb_deliver = mac_test_check_inpcb_deliver, .mpo_check_kenv_dump = mac_test_check_kenv_dump, .mpo_check_kenv_get = mac_test_check_kenv_get, .mpo_check_kenv_set = mac_test_check_kenv_set, |