diff options
Diffstat (limited to 'sys/security/lomac/kernel_monitor.c')
| -rw-r--r-- | sys/security/lomac/kernel_monitor.c | 206 |
1 files changed, 206 insertions, 0 deletions
diff --git a/sys/security/lomac/kernel_monitor.c b/sys/security/lomac/kernel_monitor.c new file mode 100644 index 0000000..3568680 --- /dev/null +++ b/sys/security/lomac/kernel_monitor.c @@ -0,0 +1,206 @@ +/*- + * Copyright (c) 2001 Networks Associates Technologies, Inc. + * All rights reserved. + * + * This software was developed for the FreeBSD Project by NAI Labs, the + * Security Research Division of Network Associates, Inc. under + * DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA + * CHATS research program. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. The name of the author may not be used to endorse or promote + * products derived from this software without specific prior written + * permission. + * + * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + * + * $Id$ + * $FreeBSD$ + */ + +/* + * This file contains functions which update LOMAC's internal + * state in response to system events, such as successful + * system calls. These updates allow LOMAC to keep an accurate + * picture of the kernel's state, enabling LOMAC to make reasonable + * decisions when it mediates processes' use of security-relevant + * system calls. These functions perform no mediation themselves - + * that is, they do not make access control decisions concerning + * whether a given system call should be allowed or denied. This + * mediation is handled by the functions in lomac_mediate.c. + */ + +#include "kernel_interface.h" +#include "kernel_monitor.h" +#include "kernel_log.h" + +#include "kernel_util.h" + + +/* monitor_read_object() + * + * in: p_subject - subject that read `p_object'. + * p_object - object read by `p_subject'. + * out: nothing + * return: nothing + * + * This function examines the objects read by subjects. If a subject + * reads from an object with a level lower than its own, this function + * reduces the subject's level to match the object's. This lowering + * is referred to as "demotion" in much of the LOMAC documentation. + * This function performs no mediation. + * + * This function is for the following kinds of objects: + * regular files and FIFOs. + * It is also used to monitor reads on unnamed pipes. LOMAC does not + * consider unnamed pipes to be objects, and treats them differently + * from objects such as files. However, the differences are mostly + * in the write-handling behavior. LOMAC's read-handling behavior is + * the same both for objects and unnamed pipes, so this function + * handles both cases. + */ + +int +monitor_read_object(lomac_subject_t *p_subject, lomac_object_t *p_object) { + lattr_t subject_lattr; /* lattr of `p_subject' */ + lattr_t object_lattr; /* lattr of `p_object' */ + + /* Get the lattrs of `p_subject' and `p_object' so we can compare them. */ + get_subject_lattr(p_subject, &subject_lattr); + get_object_lattr(p_object, &object_lattr); + + /* + * If `p_object's level is less than `p_subject's level, + * we must demote `p_subject'. The level may be 0 to indicate + * existence before LOMAC started. + */ + if (object_lattr.level && + lomac_must_demote(&subject_lattr, &object_lattr) && + (subject_lattr.flags & LOMAC_ATTR_NODEMOTE) == 0) { + if (subject_do_not_demote(p_subject)) + return (0); + set_subject_lattr(p_subject, object_lattr); /* demote! */ + if (lomac_verbose_demote_deny) { + lomac_log_t *s = log_start(); + + log_append_string(s, "LOMAC: level-"); + log_append_int(s, subject_lattr.level); + log_append_string(s, " subject "); + log_append_subject_id(s, p_subject); + log_append_string(s, " demoted to level "); + log_append_int(s, object_lattr.level); + log_append_string(s, " after reading "); + log_append_object_id(s, p_object); + log_append_string(s, "\n"); + log_print(s); + } + } /* if we need to demote */ + return (0); +} /* monitor_read_object() */ + + +/* monitor_pipe_write() + * + * in: p_subject - subject that just wrote to `p_pipe'. + * p_pipe - pipe `p_subject' has written to. + * out: p_pipe - pipe may have its level adjusted. + * return: 0 + * + * This function should be called after a successful write to + * `p_pipe'. If the level of `p_subject' is less than the level of + * `p_pipe', this function reduces `p_pipe's level to match + * `current's. + * + * + */ + +int +monitor_pipe_write(lomac_subject_t *p_subject, lomac_object_t *p_pipe) { + lattr_t pipe_lattr; /* lattr of `p_pipe' */ + lattr_t subject_lattr; /* lattr of `p_subject' */ + + get_subject_lattr(p_subject, &subject_lattr); + get_object_lattr(p_pipe, &pipe_lattr); + if (lomac_must_demote(&pipe_lattr, &subject_lattr)) { + subject_lattr.flags = 0; + set_object_lattr(p_pipe, subject_lattr); +#ifdef LOMAC_DEBUG_PIPE + if (lomac_verbose_pipe) { + lomac_log_t *s = log_start(); + + log_append_string(s, "LOMAC: level-"); + log_append_int(s, subject_lattr.level); + log_append_string(s, " subject "); + log_append_subject_id(s, p_subject); + log_append_string(s, " contaminated level-"); + log_append_int(s, pipe_lattr.level); + log_append_string(s, " "); + log_append_object_id(s, p_pipe); + log_append_string(s, "\n"); + log_print(s); + } +#endif /* LOMAC_DEBUG_PIPE */ + } + return (0); +} /* monitor_pipe_write() */ + + +/* monitor_read_net_socket() + * + * in: p_subject - subject that read from network socket. + * out: nothing + * return: 0 + * + * + */ + +int +monitor_read_net_socket(lomac_subject_t *p_subject) { + lattr_t subject_lattr; /* lattr of `p_subject' */ + lattr_t socket_lattr; /* lattr of socket (always lowest) */ + + socket_lattr.level = LOMAC_LOWEST_LEVEL; + socket_lattr.flags = 0; + get_subject_lattr(p_subject, &subject_lattr); + + if (lomac_must_demote(&subject_lattr, &socket_lattr) && + (subject_lattr.flags & + (LOMAC_ATTR_NODEMOTE | LOMAC_ATTR_NONETDEMOTE)) == 0) { + + if (subject_do_not_demote(p_subject)) + return (0); + socket_lattr.flags = subject_lattr.flags; + set_subject_lattr(p_subject, socket_lattr); /* demote! */ + if (lomac_verbose_demote_deny) { + lomac_log_t *s = log_start(); + + log_append_string(s, "LOMAC: level-"); + log_append_int(s, subject_lattr.level); + log_append_string(s, " subject "); + log_append_subject_id(s, p_subject); + log_append_string(s, " demoted to level "); + log_append_int(s, socket_lattr.level); + log_append_string(s, " after reading from " + "the network\n"); + log_print(s); + } + } + return (0); +} |
