Introduce new MAC Framework and MAC Policy entry points to control the use

of system calls to manipulate elements of the process credential,
including:

        setuid()                mac_check_proc_setuid()
        seteuid()               mac_check_proc_seteuid()
        setgid()                mac_check_proc_setgid()
        setegid()               mac_check_proc_setegid()
        setgroups()             mac_check_proc_setgroups()
        setreuid()              mac_check_proc_setreuid()
        setregid()              mac_check_proc_setregid()
        setresuid()             mac_check_proc_setresuid()
        setresgid()             mac_check_rpoc_setresgid()

MAC checks are performed before other existing security checks; both
current credential and intended modifications are passed as arguments
to the entry points.  The mac_test and mac_stub policies are updated.

Submitted by:	Samy Al Bahra <samy@kerneled.org>
Obtained from:	TrustedBSD Project

5 files changed, 337 insertions, 0 deletions

diff --git a/sys/security/mac/mac_framework.h b/sys/security/mac/mac_framework.h
index 055a5ad..3e6e53e 100644
--- a/sys/security/mac/mac_framework.h
+++ b/sys/security/mac/mac_framework.h
@@ -330,6 +330,24 @@ int	mac_check_pipe_stat(struct ucred *cred, struct pipepair *pp);
 int	mac_check_pipe_write(struct ucred *cred, struct pipepair *pp);
 int	mac_check_proc_debug(struct ucred *cred, struct proc *proc);
 int	mac_check_proc_sched(struct ucred *cred, struct proc *proc);
+int	mac_check_proc_setuid(struct proc *proc,  struct ucred *cred,
+	    uid_t uid);
+int	mac_check_proc_seteuid(struct proc *proc, struct ucred *cred,
+	    uid_t euid);
+int	mac_check_proc_setgid(struct proc *proc, struct ucred *cred,
+	    gid_t gid);
+int	mac_check_proc_setegid(struct proc *proc, struct ucred *cred,
+	    gid_t egid);
+int	mac_check_proc_setgroups(struct proc *proc, struct ucred *cred,
+	    int ngroups, gid_t *gidset);
+int	mac_check_proc_setreuid(struct proc *proc, struct ucred *cred,
+	    uid_t ruid, uid_t euid);
+int	mac_check_proc_setregid(struct proc *proc, struct ucred *cred,
+	    gid_t rgid, gid_t egid);
+int	mac_check_proc_setresuid(struct proc *proc, struct ucred *cred,
+	    uid_t ruid, uid_t euid, uid_t suid);
+int	mac_check_proc_setresgid(struct proc *proc, struct ucred *cred,
+	    gid_t rgid, gid_t egid, gid_t sgid);
 int	mac_check_proc_signal(struct ucred *cred, struct proc *proc,
 	    int signum);
 int	mac_check_socket_bind(struct ucred *cred, struct socket *so,
diff --git a/sys/security/mac/mac_policy.h b/sys/security/mac/mac_policy.h
index 036c7a9..910690a 100644
--- a/sys/security/mac/mac_policy.h
+++ b/sys/security/mac/mac_policy.h
@@ -408,6 +408,20 @@ struct mac_policy_ops {
 		    struct proc *proc);
 	int	(*mpo_check_proc_sched)(struct ucred *cred,
 		    struct proc *proc);
+	int	(*mpo_check_proc_setuid)(struct ucred *cred, uid_t uid);
+	int	(*mpo_check_proc_seteuid)(struct ucred *cred, uid_t euid);
+	int	(*mpo_check_proc_setgid)(struct ucred *cred, gid_t gid);
+	int	(*mpo_check_proc_setegid)(struct ucred *cred, gid_t egid);
+	int	(*mpo_check_proc_setgroups)(struct ucred *cred, int ngroups,
+		    gid_t *gidset);
+	int	(*mpo_check_proc_setreuid)(struct ucred *cred, uid_t ruid,
+		    uid_t euid);
+	int	(*mpo_check_proc_setregid)(struct ucred *cred, gid_t rgid,
+		    gid_t egid);
+	int	(*mpo_check_proc_setresuid)(struct ucred *cred, uid_t ruid,
+		    uid_t euid, uid_t suid);
+	int	(*mpo_check_proc_setresgid)(struct ucred *cred, gid_t rgid,
+		    gid_t egid, gid_t sgid);
 	int	(*mpo_check_proc_signal)(struct ucred *cred,
 		    struct proc *proc, int signum);
 	int	(*mpo_check_socket_bind)(struct ucred *cred,
diff --git a/sys/security/mac/mac_process.c b/sys/security/mac/mac_process.c
index 4f3a6c0..8dda7b1 100644
--- a/sys/security/mac/mac_process.c
+++ b/sys/security/mac/mac_process.c
@@ -2,6 +2,7 @@
  * Copyright (c) 1999-2002 Robert N. M. Watson
  * Copyright (c) 2001 Ilmar S. Habibulin
  * Copyright (c) 2001-2003 Networks Associates Technology, Inc.
+ * Copyright (c) 2005 Samy Al Bahra
  * All rights reserved.
  *
  * This software was developed by Robert Watson and Ilmar Habibulin for the
@@ -85,6 +86,11 @@ SYSCTL_INT(_security_mac, OID_AUTO, mmap_revocation_via_cow, CTLFLAG_RW,
     &mac_mmap_revocation_via_cow, 0, "Revoke mmap access to files via "
     "copy-on-write semantics, or by removing all write access");
 
+static int	mac_enforce_suid = 1;
+SYSCTL_INT(_security_mac, OID_AUTO, enforce_suid, CTLFLAG_RW,
+    &mac_enforce_suid, 0, "Enforce MAC policy on suid/sgid operations");
+TUNABLE_INT("security.mac.enforce_suid", &mac_enforce_suid);
+
 #ifdef MAC_DEBUG
 static unsigned int nmaccreds, nmacprocs;
 SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, creds, CTLFLAG_RD,
@@ -513,3 +519,134 @@ mac_check_proc_signal(struct ucred *cred, struct proc *proc, int signum)
 
 	return (error);
 }
+
+int
+mac_check_proc_setuid(struct proc *proc, struct ucred *cred, uid_t uid)
+{
+	int error;
+
+	PROC_LOCK_ASSERT(proc, MA_OWNED);
+
+	if (!mac_enforce_suid)
+		return (0);
+
+	MAC_CHECK(check_proc_setuid, cred, uid);
+	return (error);
+}
+
+int
+mac_check_proc_seteuid(struct proc *proc, struct ucred *cred, uid_t euid)
+{
+	int error;
+
+	PROC_LOCK_ASSERT(proc, MA_OWNED);
+
+	if (!mac_enforce_suid)
+		return (0);
+
+	MAC_CHECK(check_proc_seteuid, cred, euid);
+	return (error);
+}
+
+int
+mac_check_proc_setgid(struct proc *proc, struct ucred *cred, gid_t gid)
+{
+	int error;
+
+	PROC_LOCK_ASSERT(proc, MA_OWNED);
+
+	if (!mac_enforce_suid)
+		return (0);
+
+	MAC_CHECK(check_proc_setgid, cred, gid);
+	return (error);
+}
+
+int
+mac_check_proc_setegid(struct proc *proc, struct ucred *cred, gid_t egid)
+{
+	int error;
+
+	PROC_LOCK_ASSERT(proc, MA_OWNED);
+
+	if (!mac_enforce_suid)
+		return (0);
+
+	MAC_CHECK(check_proc_setegid, cred, egid);
+	return (error);
+}
+
+int
+mac_check_proc_setgroups(struct proc *proc, struct ucred *cred,
+	int ngroups, gid_t *gidset)
+{
+	int error;
+
+	PROC_LOCK_ASSERT(proc, MA_OWNED);
+
+	if (!mac_enforce_suid)
+		return (0);
+
+	MAC_CHECK(check_proc_setgroups, cred, ngroups, gidset);
+	return (error);
+}
+
+int
+mac_check_proc_setreuid(struct proc *proc, struct ucred *cred, uid_t ruid,
+	uid_t euid)
+{
+	int error;
+
+	PROC_LOCK_ASSERT(proc, MA_OWNED);
+
+	if (!mac_enforce_suid)
+		return (0);
+
+	MAC_CHECK(check_proc_setreuid, cred, ruid, euid);
+	return (error);
+}
+
+int
+mac_check_proc_setregid(struct proc *proc, struct ucred *cred, gid_t rgid,
+	gid_t egid)
+{
+	int error;
+
+	PROC_LOCK_ASSERT(proc, MA_OWNED);
+
+	if (!mac_enforce_suid)
+		return (0);
+
+	MAC_CHECK(check_proc_setregid, cred, rgid, egid);
+	return (error);
+}
+
+int
+mac_check_proc_setresuid(struct proc *proc, struct ucred *cred, uid_t ruid,
+	uid_t euid, uid_t suid)
+{
+	int error;
+
+	PROC_LOCK_ASSERT(proc, MA_OWNED);
+
+	if (!mac_enforce_suid)
+		return (0);
+
+	MAC_CHECK(check_proc_setresuid, cred, ruid, euid, suid);
+	return (error);
+}
+
+int
+mac_check_proc_setresgid(struct proc *proc, struct ucred *cred, gid_t rgid,
+	gid_t egid, gid_t sgid)
+{
+	int error;
+
+	PROC_LOCK_ASSERT(proc, MA_OWNED);
+
+	if (!mac_enforce_suid)
+		return (0);
+
+	MAC_CHECK(check_proc_setresgid, cred, rgid, egid, sgid);
+	return (error);
+}
diff --git a/sys/security/mac_stub/mac_stub.c b/sys/security/mac_stub/mac_stub.c
index 35e3c34..cc93edf 100644
--- a/sys/security/mac_stub/mac_stub.c
+++ b/sys/security/mac_stub/mac_stub.c
@@ -842,6 +842,72 @@ stub_check_proc_signal(struct ucred *cred, struct proc *proc, int signum)
 }
 
 static int
+stub_check_proc_setuid(struct ucred *cred, uid_t uid)
+{
+
+	return (0);
+}
+
+static int
+stub_check_proc_seteuid(struct ucred *cred, uid_t euid)
+{
+
+	return (0);
+}
+
+static int
+stub_check_proc_setgid(struct ucred *cred, gid_t gid)
+{
+
+	return (0);
+}
+
+static int
+stub_check_proc_setegid(struct ucred *cred, gid_t egid)
+{
+
+	return (0);
+}
+
+static int
+stub_check_proc_setgroups(struct ucred *cred, int ngroups,
+	gid_t *gidset)
+{
+
+	return (0);
+}
+
+static int
+stub_check_proc_setreuid(struct ucred *cred, uid_t ruid, uid_t euid)
+{
+
+	return (0);
+}
+
+static int
+stub_check_proc_setregid(struct ucred *cred, gid_t rgid, gid_t egid)
+{
+
+	return (0);
+}
+
+static int
+stub_check_proc_setresuid(struct ucred *cred, uid_t ruid, uid_t euid,
+	uid_t suid)
+{
+
+	return (0);
+}
+
+static int
+stub_check_proc_setresgid(struct ucred *cred, gid_t rgid, gid_t egid,
+	gid_t sgid)
+{
+
+	return (0);
+}
+
+static int
 stub_check_socket_bind(struct ucred *cred, struct socket *socket,
     struct label *socketlabel, struct sockaddr *sockaddr)
 {
@@ -1341,6 +1407,15 @@ static struct mac_policy_ops mac_stub_ops =
 	.mpo_check_pipe_write = stub_check_pipe_write,
 	.mpo_check_proc_debug = stub_check_proc_debug,
 	.mpo_check_proc_sched = stub_check_proc_sched,
+	.mpo_check_proc_setuid = stub_check_proc_setuid,
+	.mpo_check_proc_seteuid = stub_check_proc_seteuid,
+	.mpo_check_proc_setgid = stub_check_proc_setgid,
+	.mpo_check_proc_setegid = stub_check_proc_setegid,
+	.mpo_check_proc_setgroups = stub_check_proc_setgroups,
+	.mpo_check_proc_setreuid = stub_check_proc_setreuid,
+	.mpo_check_proc_setregid = stub_check_proc_setregid,
+	.mpo_check_proc_setresuid = stub_check_proc_setresuid,
+	.mpo_check_proc_setresgid = stub_check_proc_setresgid,
 	.mpo_check_proc_signal = stub_check_proc_signal,
 	.mpo_check_socket_bind = stub_check_socket_bind,
 	.mpo_check_socket_connect = stub_check_socket_connect,
diff --git a/sys/security/mac_test/mac_test.c b/sys/security/mac_test/mac_test.c
index d2555bc..4c77874 100644
--- a/sys/security/mac_test/mac_test.c
+++ b/sys/security/mac_test/mac_test.c
@@ -1707,6 +1707,90 @@ mac_test_check_proc_signal(struct ucred *cred, struct proc *proc, int signum)
 }
 
 static int
+mac_test_check_proc_setuid(struct ucred *cred, uid_t uid)
+{
+
+	ASSERT_CRED_LABEL(cred->cr_label);
+
+	return (0);
+}
+
+static int
+mac_test_check_proc_seteuid(struct ucred *cred, uid_t euid)
+{
+
+	ASSERT_CRED_LABEL(cred->cr_label);
+
+	return (0);
+}
+
+static int
+mac_test_check_proc_setgid(struct ucred *cred, gid_t gid)
+{
+
+	ASSERT_CRED_LABEL(cred->cr_label);
+
+	return (0);
+}
+
+static int
+mac_test_check_proc_setegid(struct ucred *cred, gid_t egid)
+{
+
+	ASSERT_CRED_LABEL(cred->cr_label);
+
+	return (0);
+}
+
+static int
+mac_test_check_proc_setgroups(struct ucred *cred, int ngroups,
+	gid_t *gidset)
+{
+
+	ASSERT_CRED_LABEL(cred->cr_label);
+
+	return (0);
+}
+
+static int
+mac_test_check_proc_setreuid(struct ucred *cred, uid_t ruid, uid_t euid)
+{
+
+	ASSERT_CRED_LABEL(cred->cr_label);
+
+	return (0);
+}
+
+static int
+mac_test_check_proc_setregid(struct ucred *cred, gid_t rgid, gid_t egid)
+{
+
+	ASSERT_CRED_LABEL(cred->cr_label);
+
+	return (0);
+}
+
+static int
+mac_test_check_proc_setresuid(struct ucred *cred, uid_t ruid, uid_t euid,
+	uid_t suid)
+{
+
+	ASSERT_CRED_LABEL(cred->cr_label);
+
+	return (0);
+}
+
+static int
+mac_test_check_proc_setresgid(struct ucred *cred, gid_t rgid, gid_t egid,
+	gid_t sgid)
+{
+
+	ASSERT_CRED_LABEL(cred->cr_label);
+
+	return (0);
+}
+
+static int
 mac_test_check_socket_bind(struct ucred *cred, struct socket *socket,
     struct label *socketlabel, struct sockaddr *sockaddr)
 {
@@ -2357,6 +2441,15 @@ static struct mac_policy_ops mac_test_ops =
 	.mpo_check_pipe_write = mac_test_check_pipe_write,
 	.mpo_check_proc_debug = mac_test_check_proc_debug,
 	.mpo_check_proc_sched = mac_test_check_proc_sched,
+	.mpo_check_proc_setuid = mac_test_check_proc_setuid,
+	.mpo_check_proc_seteuid = mac_test_check_proc_seteuid,
+	.mpo_check_proc_setgid = mac_test_check_proc_setgid,
+	.mpo_check_proc_setegid = mac_test_check_proc_setegid,
+	.mpo_check_proc_setgroups = mac_test_check_proc_setgroups,
+	.mpo_check_proc_setreuid = mac_test_check_proc_setreuid,
+	.mpo_check_proc_setregid = mac_test_check_proc_setregid,
+	.mpo_check_proc_setresuid = mac_test_check_proc_setresuid,
+	.mpo_check_proc_setresgid = mac_test_check_proc_setresgid,
 	.mpo_check_proc_signal = mac_test_check_proc_signal,
 	.mpo_check_socket_bind = mac_test_check_socket_bind,
 	.mpo_check_socket_connect = mac_test_check_socket_connect,