diff options
author | rwatson <rwatson@FreeBSD.org> | 2002-10-06 14:39:15 +0000 |
---|---|---|
committer | rwatson <rwatson@FreeBSD.org> | 2002-10-06 14:39:15 +0000 |
commit | 1f2df657503291aadbf40ec48f3e8e237ad3c707 (patch) | |
tree | 0b5cc32d50a169da85cc7b19c39e5529d3450270 /sys/security | |
parent | 4b96abfa44e821eda91a0fa4b460990ae2d283b7 (diff) | |
download | FreeBSD-src-1f2df657503291aadbf40ec48f3e8e237ad3c707.zip FreeBSD-src-1f2df657503291aadbf40ec48f3e8e237ad3c707.tar.gz |
Integrate mac_check_socket_send() and mac_check_socket_receive()
checks from the MAC tree: allow policies to perform access control
for the ability of a process to send and receive data via a socket.
At some point, we might also pass in additional address information
if an explicit address is requested on send.
Obtained from: TrustedBSD Project
Sponsored by: DARPA, Network Associates Laboratories
Diffstat (limited to 'sys/security')
-rw-r--r-- | sys/security/mac/mac_framework.c | 34 | ||||
-rw-r--r-- | sys/security/mac/mac_framework.h | 2 | ||||
-rw-r--r-- | sys/security/mac/mac_internal.h | 34 | ||||
-rw-r--r-- | sys/security/mac/mac_net.c | 34 | ||||
-rw-r--r-- | sys/security/mac/mac_pipe.c | 34 | ||||
-rw-r--r-- | sys/security/mac/mac_policy.h | 6 | ||||
-rw-r--r-- | sys/security/mac/mac_process.c | 34 | ||||
-rw-r--r-- | sys/security/mac/mac_syscalls.c | 34 | ||||
-rw-r--r-- | sys/security/mac/mac_system.c | 34 | ||||
-rw-r--r-- | sys/security/mac/mac_vfs.c | 34 |
10 files changed, 280 insertions, 0 deletions
diff --git a/sys/security/mac/mac_framework.c b/sys/security/mac/mac_framework.c index bed8a95..eca63c3 100644 --- a/sys/security/mac/mac_framework.c +++ b/sys/security/mac/mac_framework.c @@ -761,10 +761,18 @@ mac_policy_register(struct mac_policy_conf *mpc) mpc->mpc_ops->mpo_check_socket_listen = mpe->mpe_function; break; + case MAC_CHECK_SOCKET_RECEIVE: + mpc->mpc_ops->mpo_check_socket_receive = + mpe->mpe_function; + break; case MAC_CHECK_SOCKET_RELABEL: mpc->mpc_ops->mpo_check_socket_relabel = mpe->mpe_function; break; + case MAC_CHECK_SOCKET_SEND: + mpc->mpc_ops->mpo_check_socket_send = + mpe->mpe_function; + break; case MAC_CHECK_SOCKET_VISIBLE: mpc->mpc_ops->mpo_check_socket_visible = mpe->mpe_function; @@ -2961,6 +2969,19 @@ mac_check_socket_listen(struct ucred *cred, struct socket *socket) return (error); } +int +mac_check_socket_receive(struct ucred *cred, struct socket *so) +{ + int error; + + if (!mac_enforce_socket) + return (0); + + MAC_CHECK(check_socket_receive, cred, so, &so->so_label); + + return (error); +} + static int mac_check_socket_relabel(struct ucred *cred, struct socket *socket, struct label *newlabel) @@ -2974,6 +2995,19 @@ mac_check_socket_relabel(struct ucred *cred, struct socket *socket, } int +mac_check_socket_send(struct ucred *cred, struct socket *so) +{ + int error; + + if (!mac_enforce_socket) + return (0); + + MAC_CHECK(check_socket_send, cred, so, &so->so_label); + + return (error); +} + +int mac_check_socket_visible(struct ucred *cred, struct socket *socket) { int error; diff --git a/sys/security/mac/mac_framework.h b/sys/security/mac/mac_framework.h index cd82ef5..8a07849 100644 --- a/sys/security/mac/mac_framework.h +++ b/sys/security/mac/mac_framework.h @@ -319,6 +319,8 @@ int mac_check_socket_connect(struct ucred *cred, struct socket *so, struct sockaddr *sockaddr); int mac_check_socket_deliver(struct socket *so, struct mbuf *m); int mac_check_socket_listen(struct ucred *cred, struct socket *so); +int mac_check_socket_receive(struct ucred *cred, struct socket *so); +int mac_check_socket_send(struct ucred *cred, struct socket *so); int mac_check_socket_visible(struct ucred *cred, struct socket *so); int mac_check_vnode_access(struct ucred *cred, struct vnode *vp, int flags); diff --git a/sys/security/mac/mac_internal.h b/sys/security/mac/mac_internal.h index bed8a95..eca63c3 100644 --- a/sys/security/mac/mac_internal.h +++ b/sys/security/mac/mac_internal.h @@ -761,10 +761,18 @@ mac_policy_register(struct mac_policy_conf *mpc) mpc->mpc_ops->mpo_check_socket_listen = mpe->mpe_function; break; + case MAC_CHECK_SOCKET_RECEIVE: + mpc->mpc_ops->mpo_check_socket_receive = + mpe->mpe_function; + break; case MAC_CHECK_SOCKET_RELABEL: mpc->mpc_ops->mpo_check_socket_relabel = mpe->mpe_function; break; + case MAC_CHECK_SOCKET_SEND: + mpc->mpc_ops->mpo_check_socket_send = + mpe->mpe_function; + break; case MAC_CHECK_SOCKET_VISIBLE: mpc->mpc_ops->mpo_check_socket_visible = mpe->mpe_function; @@ -2961,6 +2969,19 @@ mac_check_socket_listen(struct ucred *cred, struct socket *socket) return (error); } +int +mac_check_socket_receive(struct ucred *cred, struct socket *so) +{ + int error; + + if (!mac_enforce_socket) + return (0); + + MAC_CHECK(check_socket_receive, cred, so, &so->so_label); + + return (error); +} + static int mac_check_socket_relabel(struct ucred *cred, struct socket *socket, struct label *newlabel) @@ -2974,6 +2995,19 @@ mac_check_socket_relabel(struct ucred *cred, struct socket *socket, } int +mac_check_socket_send(struct ucred *cred, struct socket *so) +{ + int error; + + if (!mac_enforce_socket) + return (0); + + MAC_CHECK(check_socket_send, cred, so, &so->so_label); + + return (error); +} + +int mac_check_socket_visible(struct ucred *cred, struct socket *socket) { int error; diff --git a/sys/security/mac/mac_net.c b/sys/security/mac/mac_net.c index bed8a95..eca63c3 100644 --- a/sys/security/mac/mac_net.c +++ b/sys/security/mac/mac_net.c @@ -761,10 +761,18 @@ mac_policy_register(struct mac_policy_conf *mpc) mpc->mpc_ops->mpo_check_socket_listen = mpe->mpe_function; break; + case MAC_CHECK_SOCKET_RECEIVE: + mpc->mpc_ops->mpo_check_socket_receive = + mpe->mpe_function; + break; case MAC_CHECK_SOCKET_RELABEL: mpc->mpc_ops->mpo_check_socket_relabel = mpe->mpe_function; break; + case MAC_CHECK_SOCKET_SEND: + mpc->mpc_ops->mpo_check_socket_send = + mpe->mpe_function; + break; case MAC_CHECK_SOCKET_VISIBLE: mpc->mpc_ops->mpo_check_socket_visible = mpe->mpe_function; @@ -2961,6 +2969,19 @@ mac_check_socket_listen(struct ucred *cred, struct socket *socket) return (error); } +int +mac_check_socket_receive(struct ucred *cred, struct socket *so) +{ + int error; + + if (!mac_enforce_socket) + return (0); + + MAC_CHECK(check_socket_receive, cred, so, &so->so_label); + + return (error); +} + static int mac_check_socket_relabel(struct ucred *cred, struct socket *socket, struct label *newlabel) @@ -2974,6 +2995,19 @@ mac_check_socket_relabel(struct ucred *cred, struct socket *socket, } int +mac_check_socket_send(struct ucred *cred, struct socket *so) +{ + int error; + + if (!mac_enforce_socket) + return (0); + + MAC_CHECK(check_socket_send, cred, so, &so->so_label); + + return (error); +} + +int mac_check_socket_visible(struct ucred *cred, struct socket *socket) { int error; diff --git a/sys/security/mac/mac_pipe.c b/sys/security/mac/mac_pipe.c index bed8a95..eca63c3 100644 --- a/sys/security/mac/mac_pipe.c +++ b/sys/security/mac/mac_pipe.c @@ -761,10 +761,18 @@ mac_policy_register(struct mac_policy_conf *mpc) mpc->mpc_ops->mpo_check_socket_listen = mpe->mpe_function; break; + case MAC_CHECK_SOCKET_RECEIVE: + mpc->mpc_ops->mpo_check_socket_receive = + mpe->mpe_function; + break; case MAC_CHECK_SOCKET_RELABEL: mpc->mpc_ops->mpo_check_socket_relabel = mpe->mpe_function; break; + case MAC_CHECK_SOCKET_SEND: + mpc->mpc_ops->mpo_check_socket_send = + mpe->mpe_function; + break; case MAC_CHECK_SOCKET_VISIBLE: mpc->mpc_ops->mpo_check_socket_visible = mpe->mpe_function; @@ -2961,6 +2969,19 @@ mac_check_socket_listen(struct ucred *cred, struct socket *socket) return (error); } +int +mac_check_socket_receive(struct ucred *cred, struct socket *so) +{ + int error; + + if (!mac_enforce_socket) + return (0); + + MAC_CHECK(check_socket_receive, cred, so, &so->so_label); + + return (error); +} + static int mac_check_socket_relabel(struct ucred *cred, struct socket *socket, struct label *newlabel) @@ -2974,6 +2995,19 @@ mac_check_socket_relabel(struct ucred *cred, struct socket *socket, } int +mac_check_socket_send(struct ucred *cred, struct socket *so) +{ + int error; + + if (!mac_enforce_socket) + return (0); + + MAC_CHECK(check_socket_send, cred, so, &so->so_label); + + return (error); +} + +int mac_check_socket_visible(struct ucred *cred, struct socket *socket) { int error; diff --git a/sys/security/mac/mac_policy.h b/sys/security/mac/mac_policy.h index 5610e01..e003f84 100644 --- a/sys/security/mac/mac_policy.h +++ b/sys/security/mac/mac_policy.h @@ -271,9 +271,13 @@ struct mac_policy_ops { struct label *mbuflabel); int (*mpo_check_socket_listen)(struct ucred *cred, struct socket *so, struct label *socketlabel); + int (*mpo_check_socket_receive)(struct ucred *cred, + struct socket *so, struct label *socketlabel); int (*mpo_check_socket_relabel)(struct ucred *cred, struct socket *so, struct label *socketlabel, struct label *newlabel); + int (*mpo_check_socket_send)(struct ucred *cred, + struct socket *so, struct label *socketlabel); int (*mpo_check_socket_visible)(struct ucred *cred, struct socket *so, struct label *socketlabel); int (*mpo_check_vnode_access)(struct ucred *cred, @@ -454,7 +458,9 @@ enum mac_op_constant { MAC_CHECK_SOCKET_CONNECT, MAC_CHECK_SOCKET_DELIVER, MAC_CHECK_SOCKET_LISTEN, + MAC_CHECK_SOCKET_RECEIVE, MAC_CHECK_SOCKET_RELABEL, + MAC_CHECK_SOCKET_SEND, MAC_CHECK_SOCKET_VISIBLE, MAC_CHECK_VNODE_ACCESS, MAC_CHECK_VNODE_CHDIR, diff --git a/sys/security/mac/mac_process.c b/sys/security/mac/mac_process.c index bed8a95..eca63c3 100644 --- a/sys/security/mac/mac_process.c +++ b/sys/security/mac/mac_process.c @@ -761,10 +761,18 @@ mac_policy_register(struct mac_policy_conf *mpc) mpc->mpc_ops->mpo_check_socket_listen = mpe->mpe_function; break; + case MAC_CHECK_SOCKET_RECEIVE: + mpc->mpc_ops->mpo_check_socket_receive = + mpe->mpe_function; + break; case MAC_CHECK_SOCKET_RELABEL: mpc->mpc_ops->mpo_check_socket_relabel = mpe->mpe_function; break; + case MAC_CHECK_SOCKET_SEND: + mpc->mpc_ops->mpo_check_socket_send = + mpe->mpe_function; + break; case MAC_CHECK_SOCKET_VISIBLE: mpc->mpc_ops->mpo_check_socket_visible = mpe->mpe_function; @@ -2961,6 +2969,19 @@ mac_check_socket_listen(struct ucred *cred, struct socket *socket) return (error); } +int +mac_check_socket_receive(struct ucred *cred, struct socket *so) +{ + int error; + + if (!mac_enforce_socket) + return (0); + + MAC_CHECK(check_socket_receive, cred, so, &so->so_label); + + return (error); +} + static int mac_check_socket_relabel(struct ucred *cred, struct socket *socket, struct label *newlabel) @@ -2974,6 +2995,19 @@ mac_check_socket_relabel(struct ucred *cred, struct socket *socket, } int +mac_check_socket_send(struct ucred *cred, struct socket *so) +{ + int error; + + if (!mac_enforce_socket) + return (0); + + MAC_CHECK(check_socket_send, cred, so, &so->so_label); + + return (error); +} + +int mac_check_socket_visible(struct ucred *cred, struct socket *socket) { int error; diff --git a/sys/security/mac/mac_syscalls.c b/sys/security/mac/mac_syscalls.c index bed8a95..eca63c3 100644 --- a/sys/security/mac/mac_syscalls.c +++ b/sys/security/mac/mac_syscalls.c @@ -761,10 +761,18 @@ mac_policy_register(struct mac_policy_conf *mpc) mpc->mpc_ops->mpo_check_socket_listen = mpe->mpe_function; break; + case MAC_CHECK_SOCKET_RECEIVE: + mpc->mpc_ops->mpo_check_socket_receive = + mpe->mpe_function; + break; case MAC_CHECK_SOCKET_RELABEL: mpc->mpc_ops->mpo_check_socket_relabel = mpe->mpe_function; break; + case MAC_CHECK_SOCKET_SEND: + mpc->mpc_ops->mpo_check_socket_send = + mpe->mpe_function; + break; case MAC_CHECK_SOCKET_VISIBLE: mpc->mpc_ops->mpo_check_socket_visible = mpe->mpe_function; @@ -2961,6 +2969,19 @@ mac_check_socket_listen(struct ucred *cred, struct socket *socket) return (error); } +int +mac_check_socket_receive(struct ucred *cred, struct socket *so) +{ + int error; + + if (!mac_enforce_socket) + return (0); + + MAC_CHECK(check_socket_receive, cred, so, &so->so_label); + + return (error); +} + static int mac_check_socket_relabel(struct ucred *cred, struct socket *socket, struct label *newlabel) @@ -2974,6 +2995,19 @@ mac_check_socket_relabel(struct ucred *cred, struct socket *socket, } int +mac_check_socket_send(struct ucred *cred, struct socket *so) +{ + int error; + + if (!mac_enforce_socket) + return (0); + + MAC_CHECK(check_socket_send, cred, so, &so->so_label); + + return (error); +} + +int mac_check_socket_visible(struct ucred *cred, struct socket *socket) { int error; diff --git a/sys/security/mac/mac_system.c b/sys/security/mac/mac_system.c index bed8a95..eca63c3 100644 --- a/sys/security/mac/mac_system.c +++ b/sys/security/mac/mac_system.c @@ -761,10 +761,18 @@ mac_policy_register(struct mac_policy_conf *mpc) mpc->mpc_ops->mpo_check_socket_listen = mpe->mpe_function; break; + case MAC_CHECK_SOCKET_RECEIVE: + mpc->mpc_ops->mpo_check_socket_receive = + mpe->mpe_function; + break; case MAC_CHECK_SOCKET_RELABEL: mpc->mpc_ops->mpo_check_socket_relabel = mpe->mpe_function; break; + case MAC_CHECK_SOCKET_SEND: + mpc->mpc_ops->mpo_check_socket_send = + mpe->mpe_function; + break; case MAC_CHECK_SOCKET_VISIBLE: mpc->mpc_ops->mpo_check_socket_visible = mpe->mpe_function; @@ -2961,6 +2969,19 @@ mac_check_socket_listen(struct ucred *cred, struct socket *socket) return (error); } +int +mac_check_socket_receive(struct ucred *cred, struct socket *so) +{ + int error; + + if (!mac_enforce_socket) + return (0); + + MAC_CHECK(check_socket_receive, cred, so, &so->so_label); + + return (error); +} + static int mac_check_socket_relabel(struct ucred *cred, struct socket *socket, struct label *newlabel) @@ -2974,6 +2995,19 @@ mac_check_socket_relabel(struct ucred *cred, struct socket *socket, } int +mac_check_socket_send(struct ucred *cred, struct socket *so) +{ + int error; + + if (!mac_enforce_socket) + return (0); + + MAC_CHECK(check_socket_send, cred, so, &so->so_label); + + return (error); +} + +int mac_check_socket_visible(struct ucred *cred, struct socket *socket) { int error; diff --git a/sys/security/mac/mac_vfs.c b/sys/security/mac/mac_vfs.c index bed8a95..eca63c3 100644 --- a/sys/security/mac/mac_vfs.c +++ b/sys/security/mac/mac_vfs.c @@ -761,10 +761,18 @@ mac_policy_register(struct mac_policy_conf *mpc) mpc->mpc_ops->mpo_check_socket_listen = mpe->mpe_function; break; + case MAC_CHECK_SOCKET_RECEIVE: + mpc->mpc_ops->mpo_check_socket_receive = + mpe->mpe_function; + break; case MAC_CHECK_SOCKET_RELABEL: mpc->mpc_ops->mpo_check_socket_relabel = mpe->mpe_function; break; + case MAC_CHECK_SOCKET_SEND: + mpc->mpc_ops->mpo_check_socket_send = + mpe->mpe_function; + break; case MAC_CHECK_SOCKET_VISIBLE: mpc->mpc_ops->mpo_check_socket_visible = mpe->mpe_function; @@ -2961,6 +2969,19 @@ mac_check_socket_listen(struct ucred *cred, struct socket *socket) return (error); } +int +mac_check_socket_receive(struct ucred *cred, struct socket *so) +{ + int error; + + if (!mac_enforce_socket) + return (0); + + MAC_CHECK(check_socket_receive, cred, so, &so->so_label); + + return (error); +} + static int mac_check_socket_relabel(struct ucred *cred, struct socket *socket, struct label *newlabel) @@ -2974,6 +2995,19 @@ mac_check_socket_relabel(struct ucred *cred, struct socket *socket, } int +mac_check_socket_send(struct ucred *cred, struct socket *so) +{ + int error; + + if (!mac_enforce_socket) + return (0); + + MAC_CHECK(check_socket_send, cred, so, &so->so_label); + + return (error); +} + +int mac_check_socket_visible(struct ucred *cred, struct socket *socket) { int error; |