diff options
Diffstat (limited to 'sys/security')
-rw-r--r-- | sys/security/mac/mac_framework.c | 62 | ||||
-rw-r--r-- | sys/security/mac/mac_framework.h | 16 | ||||
-rw-r--r-- | sys/security/mac/mac_internal.h | 62 | ||||
-rw-r--r-- | sys/security/mac/mac_net.c | 62 | ||||
-rw-r--r-- | sys/security/mac/mac_pipe.c | 62 | ||||
-rw-r--r-- | sys/security/mac/mac_policy.h | 10 | ||||
-rw-r--r-- | sys/security/mac/mac_process.c | 62 | ||||
-rw-r--r-- | sys/security/mac/mac_syscalls.c | 62 | ||||
-rw-r--r-- | sys/security/mac/mac_system.c | 62 | ||||
-rw-r--r-- | sys/security/mac/mac_vfs.c | 62 |
10 files changed, 467 insertions, 55 deletions
diff --git a/sys/security/mac/mac_framework.c b/sys/security/mac/mac_framework.c index e1f2531..9f76f05 100644 --- a/sys/security/mac/mac_framework.c +++ b/sys/security/mac/mac_framework.c @@ -47,6 +47,7 @@ #include <sys/param.h> #include <sys/extattr.h> +#include <sys/imgact.h> #include <sys/kernel.h> #include <sys/lock.h> #include <sys/malloc.h> @@ -1251,8 +1252,53 @@ mac_setlabel_vnode_extattr(struct ucred *cred, struct vnode *vp, return (error); } +int +mac_execve_enter(struct image_params *imgp, struct mac *mac_p, + struct label *execlabelstorage) +{ + struct mac mac; + char *buffer; + int error; + + if (mac_p == NULL) + return (0); + + error = copyin(mac_p, &mac, sizeof(mac)); + if (error) + return (error); + + error = mac_check_structmac_consistent(&mac); + if (error) + return (error); + + buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK); + error = copyinstr(mac.m_string, buffer, mac.m_buflen, NULL); + if (error) { + free(buffer, M_MACTEMP); + return (error); + } + + mac_init_cred_label(execlabelstorage); + error = mac_internalize_cred_label(execlabelstorage, buffer); + free(buffer, M_MACTEMP); + if (error) { + mac_destroy_cred_label(execlabelstorage); + return (error); + } + imgp->execlabel = execlabelstorage; + return (0); +} + +void +mac_execve_exit(struct image_params *imgp) +{ + if (imgp->execlabel != NULL) + mac_destroy_cred_label(imgp->execlabel); +} + void -mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp) +mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp, + struct label *interpvnodelabel, struct image_params *imgp) { ASSERT_VOP_LOCKED(vp, "mac_execve_transition"); @@ -1260,11 +1306,13 @@ mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp) if (!mac_enforce_process && !mac_enforce_fs) return; - MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label); + MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label, + interpvnodelabel, imgp); } int -mac_execve_will_transition(struct ucred *old, struct vnode *vp) +mac_execve_will_transition(struct ucred *old, struct vnode *vp, + struct label *interpvnodelabel, struct image_params *imgp) { int result; @@ -1274,7 +1322,8 @@ mac_execve_will_transition(struct ucred *old, struct vnode *vp) return (0); result = 0; - MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label); + MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label, + interpvnodelabel, imgp); return (result); } @@ -1369,7 +1418,8 @@ mac_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp, } int -mac_check_vnode_exec(struct ucred *cred, struct vnode *vp) +mac_check_vnode_exec(struct ucred *cred, struct vnode *vp, + struct image_params *imgp) { int error; @@ -1378,7 +1428,7 @@ mac_check_vnode_exec(struct ucred *cred, struct vnode *vp) if (!mac_enforce_process && !mac_enforce_fs) return (0); - MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label); + MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label, imgp); return (error); } diff --git a/sys/security/mac/mac_framework.h b/sys/security/mac/mac_framework.h index 904ead3..3d56a17 100644 --- a/sys/security/mac/mac_framework.h +++ b/sys/security/mac/mac_framework.h @@ -84,6 +84,8 @@ typedef struct mac *mac_t; * Extended non-POSIX.1e interfaces that offer additional services * available from the userland and kernel MAC frameworks. */ +int mac_execve(char *fname, char **argv, char **envv, + mac_t _label); int mac_free(mac_t _label); int mac_from_text(mac_t *_label, const char *_text); int mac_get_fd(int _fd, mac_t _label); @@ -113,6 +115,7 @@ struct componentname; struct devfs_dirent; struct ifnet; struct ifreq; +struct image_params; struct ipq; struct mbuf; struct mount; @@ -129,7 +132,6 @@ struct vnode; #include <sys/acl.h> /* XXX acl_type_t */ -struct vop_refreshlabel_args; struct vop_setlabel_args; /* @@ -216,9 +218,14 @@ void mac_update_ipq(struct mbuf *fragment, struct ipq *ipq); * Labeling event operations: processes. */ void mac_create_cred(struct ucred *cred_parent, struct ucred *cred_child); +int mac_execve_enter(struct image_params *imgp, struct mac *mac_p, + struct label *execlabel); +void mac_execve_exit(struct image_params *imgp); void mac_execve_transition(struct ucred *old, struct ucred *new, - struct vnode *vp); -int mac_execve_will_transition(struct ucred *old, struct vnode *vp); + struct vnode *vp, struct label *interpvnodelabel, + struct image_params *imgp); +int mac_execve_will_transition(struct ucred *old, struct vnode *vp, + struct label *interpvnodelabel, struct image_params *imgp); void mac_create_proc0(struct ucred *cred); void mac_create_proc1(struct ucred *cred); void mac_thread_userret(struct thread *td); @@ -269,7 +276,8 @@ int mac_check_vnode_delete(struct ucred *cred, struct vnode *dvp, struct vnode *vp, struct componentname *cnp); int mac_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp, acl_type_t type); -int mac_check_vnode_exec(struct ucred *cred, struct vnode *vp); +int mac_check_vnode_exec(struct ucred *cred, struct vnode *vp, + struct image_params *imgp); int mac_check_vnode_getacl(struct ucred *cred, struct vnode *vp, acl_type_t type); int mac_check_vnode_getextattr(struct ucred *cred, struct vnode *vp, diff --git a/sys/security/mac/mac_internal.h b/sys/security/mac/mac_internal.h index e1f2531..9f76f05 100644 --- a/sys/security/mac/mac_internal.h +++ b/sys/security/mac/mac_internal.h @@ -47,6 +47,7 @@ #include <sys/param.h> #include <sys/extattr.h> +#include <sys/imgact.h> #include <sys/kernel.h> #include <sys/lock.h> #include <sys/malloc.h> @@ -1251,8 +1252,53 @@ mac_setlabel_vnode_extattr(struct ucred *cred, struct vnode *vp, return (error); } +int +mac_execve_enter(struct image_params *imgp, struct mac *mac_p, + struct label *execlabelstorage) +{ + struct mac mac; + char *buffer; + int error; + + if (mac_p == NULL) + return (0); + + error = copyin(mac_p, &mac, sizeof(mac)); + if (error) + return (error); + + error = mac_check_structmac_consistent(&mac); + if (error) + return (error); + + buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK); + error = copyinstr(mac.m_string, buffer, mac.m_buflen, NULL); + if (error) { + free(buffer, M_MACTEMP); + return (error); + } + + mac_init_cred_label(execlabelstorage); + error = mac_internalize_cred_label(execlabelstorage, buffer); + free(buffer, M_MACTEMP); + if (error) { + mac_destroy_cred_label(execlabelstorage); + return (error); + } + imgp->execlabel = execlabelstorage; + return (0); +} + +void +mac_execve_exit(struct image_params *imgp) +{ + if (imgp->execlabel != NULL) + mac_destroy_cred_label(imgp->execlabel); +} + void -mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp) +mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp, + struct label *interpvnodelabel, struct image_params *imgp) { ASSERT_VOP_LOCKED(vp, "mac_execve_transition"); @@ -1260,11 +1306,13 @@ mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp) if (!mac_enforce_process && !mac_enforce_fs) return; - MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label); + MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label, + interpvnodelabel, imgp); } int -mac_execve_will_transition(struct ucred *old, struct vnode *vp) +mac_execve_will_transition(struct ucred *old, struct vnode *vp, + struct label *interpvnodelabel, struct image_params *imgp) { int result; @@ -1274,7 +1322,8 @@ mac_execve_will_transition(struct ucred *old, struct vnode *vp) return (0); result = 0; - MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label); + MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label, + interpvnodelabel, imgp); return (result); } @@ -1369,7 +1418,8 @@ mac_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp, } int -mac_check_vnode_exec(struct ucred *cred, struct vnode *vp) +mac_check_vnode_exec(struct ucred *cred, struct vnode *vp, + struct image_params *imgp) { int error; @@ -1378,7 +1428,7 @@ mac_check_vnode_exec(struct ucred *cred, struct vnode *vp) if (!mac_enforce_process && !mac_enforce_fs) return (0); - MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label); + MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label, imgp); return (error); } diff --git a/sys/security/mac/mac_net.c b/sys/security/mac/mac_net.c index e1f2531..9f76f05 100644 --- a/sys/security/mac/mac_net.c +++ b/sys/security/mac/mac_net.c @@ -47,6 +47,7 @@ #include <sys/param.h> #include <sys/extattr.h> +#include <sys/imgact.h> #include <sys/kernel.h> #include <sys/lock.h> #include <sys/malloc.h> @@ -1251,8 +1252,53 @@ mac_setlabel_vnode_extattr(struct ucred *cred, struct vnode *vp, return (error); } +int +mac_execve_enter(struct image_params *imgp, struct mac *mac_p, + struct label *execlabelstorage) +{ + struct mac mac; + char *buffer; + int error; + + if (mac_p == NULL) + return (0); + + error = copyin(mac_p, &mac, sizeof(mac)); + if (error) + return (error); + + error = mac_check_structmac_consistent(&mac); + if (error) + return (error); + + buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK); + error = copyinstr(mac.m_string, buffer, mac.m_buflen, NULL); + if (error) { + free(buffer, M_MACTEMP); + return (error); + } + + mac_init_cred_label(execlabelstorage); + error = mac_internalize_cred_label(execlabelstorage, buffer); + free(buffer, M_MACTEMP); + if (error) { + mac_destroy_cred_label(execlabelstorage); + return (error); + } + imgp->execlabel = execlabelstorage; + return (0); +} + +void +mac_execve_exit(struct image_params *imgp) +{ + if (imgp->execlabel != NULL) + mac_destroy_cred_label(imgp->execlabel); +} + void -mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp) +mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp, + struct label *interpvnodelabel, struct image_params *imgp) { ASSERT_VOP_LOCKED(vp, "mac_execve_transition"); @@ -1260,11 +1306,13 @@ mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp) if (!mac_enforce_process && !mac_enforce_fs) return; - MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label); + MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label, + interpvnodelabel, imgp); } int -mac_execve_will_transition(struct ucred *old, struct vnode *vp) +mac_execve_will_transition(struct ucred *old, struct vnode *vp, + struct label *interpvnodelabel, struct image_params *imgp) { int result; @@ -1274,7 +1322,8 @@ mac_execve_will_transition(struct ucred *old, struct vnode *vp) return (0); result = 0; - MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label); + MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label, + interpvnodelabel, imgp); return (result); } @@ -1369,7 +1418,8 @@ mac_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp, } int -mac_check_vnode_exec(struct ucred *cred, struct vnode *vp) +mac_check_vnode_exec(struct ucred *cred, struct vnode *vp, + struct image_params *imgp) { int error; @@ -1378,7 +1428,7 @@ mac_check_vnode_exec(struct ucred *cred, struct vnode *vp) if (!mac_enforce_process && !mac_enforce_fs) return (0); - MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label); + MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label, imgp); return (error); } diff --git a/sys/security/mac/mac_pipe.c b/sys/security/mac/mac_pipe.c index e1f2531..9f76f05 100644 --- a/sys/security/mac/mac_pipe.c +++ b/sys/security/mac/mac_pipe.c @@ -47,6 +47,7 @@ #include <sys/param.h> #include <sys/extattr.h> +#include <sys/imgact.h> #include <sys/kernel.h> #include <sys/lock.h> #include <sys/malloc.h> @@ -1251,8 +1252,53 @@ mac_setlabel_vnode_extattr(struct ucred *cred, struct vnode *vp, return (error); } +int +mac_execve_enter(struct image_params *imgp, struct mac *mac_p, + struct label *execlabelstorage) +{ + struct mac mac; + char *buffer; + int error; + + if (mac_p == NULL) + return (0); + + error = copyin(mac_p, &mac, sizeof(mac)); + if (error) + return (error); + + error = mac_check_structmac_consistent(&mac); + if (error) + return (error); + + buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK); + error = copyinstr(mac.m_string, buffer, mac.m_buflen, NULL); + if (error) { + free(buffer, M_MACTEMP); + return (error); + } + + mac_init_cred_label(execlabelstorage); + error = mac_internalize_cred_label(execlabelstorage, buffer); + free(buffer, M_MACTEMP); + if (error) { + mac_destroy_cred_label(execlabelstorage); + return (error); + } + imgp->execlabel = execlabelstorage; + return (0); +} + +void +mac_execve_exit(struct image_params *imgp) +{ + if (imgp->execlabel != NULL) + mac_destroy_cred_label(imgp->execlabel); +} + void -mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp) +mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp, + struct label *interpvnodelabel, struct image_params *imgp) { ASSERT_VOP_LOCKED(vp, "mac_execve_transition"); @@ -1260,11 +1306,13 @@ mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp) if (!mac_enforce_process && !mac_enforce_fs) return; - MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label); + MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label, + interpvnodelabel, imgp); } int -mac_execve_will_transition(struct ucred *old, struct vnode *vp) +mac_execve_will_transition(struct ucred *old, struct vnode *vp, + struct label *interpvnodelabel, struct image_params *imgp) { int result; @@ -1274,7 +1322,8 @@ mac_execve_will_transition(struct ucred *old, struct vnode *vp) return (0); result = 0; - MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label); + MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label, + interpvnodelabel, imgp); return (result); } @@ -1369,7 +1418,8 @@ mac_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp, } int -mac_check_vnode_exec(struct ucred *cred, struct vnode *vp) +mac_check_vnode_exec(struct ucred *cred, struct vnode *vp, + struct image_params *imgp) { int error; @@ -1378,7 +1428,7 @@ mac_check_vnode_exec(struct ucred *cred, struct vnode *vp) if (!mac_enforce_process && !mac_enforce_fs) return (0); - MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label); + MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label, imgp); return (error); } diff --git a/sys/security/mac/mac_policy.h b/sys/security/mac/mac_policy.h index fff7845..9bed8ff 100644 --- a/sys/security/mac/mac_policy.h +++ b/sys/security/mac/mac_policy.h @@ -242,9 +242,13 @@ struct mac_policy_ops { void (*mpo_create_cred)(struct ucred *parent_cred, struct ucred *child_cred); void (*mpo_execve_transition)(struct ucred *old, struct ucred *new, - struct vnode *vp, struct label *vnodelabel); + struct vnode *vp, struct label *vnodelabel, + struct label *interpvnodelabel, + struct image_params *imgp); int (*mpo_execve_will_transition)(struct ucred *old, - struct vnode *vp, struct label *vnodelabel); + struct vnode *vp, struct label *vnodelabel, + struct label *interpvnodelabel, + struct image_params *imgp); void (*mpo_create_proc0)(struct ucred *cred); void (*mpo_create_proc1)(struct ucred *cred); void (*mpo_relabel_cred)(struct ucred *cred, @@ -338,7 +342,7 @@ struct mac_policy_ops { int (*mpo_check_vnode_deleteacl)(struct ucred *cred, struct vnode *vp, struct label *label, acl_type_t type); int (*mpo_check_vnode_exec)(struct ucred *cred, struct vnode *vp, - struct label *label); + struct label *label, struct image_params *imgp); int (*mpo_check_vnode_getacl)(struct ucred *cred, struct vnode *vp, struct label *label, acl_type_t type); int (*mpo_check_vnode_getextattr)(struct ucred *cred, diff --git a/sys/security/mac/mac_process.c b/sys/security/mac/mac_process.c index e1f2531..9f76f05 100644 --- a/sys/security/mac/mac_process.c +++ b/sys/security/mac/mac_process.c @@ -47,6 +47,7 @@ #include <sys/param.h> #include <sys/extattr.h> +#include <sys/imgact.h> #include <sys/kernel.h> #include <sys/lock.h> #include <sys/malloc.h> @@ -1251,8 +1252,53 @@ mac_setlabel_vnode_extattr(struct ucred *cred, struct vnode *vp, return (error); } +int +mac_execve_enter(struct image_params *imgp, struct mac *mac_p, + struct label *execlabelstorage) +{ + struct mac mac; + char *buffer; + int error; + + if (mac_p == NULL) + return (0); + + error = copyin(mac_p, &mac, sizeof(mac)); + if (error) + return (error); + + error = mac_check_structmac_consistent(&mac); + if (error) + return (error); + + buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK); + error = copyinstr(mac.m_string, buffer, mac.m_buflen, NULL); + if (error) { + free(buffer, M_MACTEMP); + return (error); + } + + mac_init_cred_label(execlabelstorage); + error = mac_internalize_cred_label(execlabelstorage, buffer); + free(buffer, M_MACTEMP); + if (error) { + mac_destroy_cred_label(execlabelstorage); + return (error); + } + imgp->execlabel = execlabelstorage; + return (0); +} + +void +mac_execve_exit(struct image_params *imgp) +{ + if (imgp->execlabel != NULL) + mac_destroy_cred_label(imgp->execlabel); +} + void -mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp) +mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp, + struct label *interpvnodelabel, struct image_params *imgp) { ASSERT_VOP_LOCKED(vp, "mac_execve_transition"); @@ -1260,11 +1306,13 @@ mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp) if (!mac_enforce_process && !mac_enforce_fs) return; - MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label); + MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label, + interpvnodelabel, imgp); } int -mac_execve_will_transition(struct ucred *old, struct vnode *vp) +mac_execve_will_transition(struct ucred *old, struct vnode *vp, + struct label *interpvnodelabel, struct image_params *imgp) { int result; @@ -1274,7 +1322,8 @@ mac_execve_will_transition(struct ucred *old, struct vnode *vp) return (0); result = 0; - MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label); + MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label, + interpvnodelabel, imgp); return (result); } @@ -1369,7 +1418,8 @@ mac_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp, } int -mac_check_vnode_exec(struct ucred *cred, struct vnode *vp) +mac_check_vnode_exec(struct ucred *cred, struct vnode *vp, + struct image_params *imgp) { int error; @@ -1378,7 +1428,7 @@ mac_check_vnode_exec(struct ucred *cred, struct vnode *vp) if (!mac_enforce_process && !mac_enforce_fs) return (0); - MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label); + MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label, imgp); return (error); } diff --git a/sys/security/mac/mac_syscalls.c b/sys/security/mac/mac_syscalls.c index e1f2531..9f76f05 100644 --- a/sys/security/mac/mac_syscalls.c +++ b/sys/security/mac/mac_syscalls.c @@ -47,6 +47,7 @@ #include <sys/param.h> #include <sys/extattr.h> +#include <sys/imgact.h> #include <sys/kernel.h> #include <sys/lock.h> #include <sys/malloc.h> @@ -1251,8 +1252,53 @@ mac_setlabel_vnode_extattr(struct ucred *cred, struct vnode *vp, return (error); } +int +mac_execve_enter(struct image_params *imgp, struct mac *mac_p, + struct label *execlabelstorage) +{ + struct mac mac; + char *buffer; + int error; + + if (mac_p == NULL) + return (0); + + error = copyin(mac_p, &mac, sizeof(mac)); + if (error) + return (error); + + error = mac_check_structmac_consistent(&mac); + if (error) + return (error); + + buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK); + error = copyinstr(mac.m_string, buffer, mac.m_buflen, NULL); + if (error) { + free(buffer, M_MACTEMP); + return (error); + } + + mac_init_cred_label(execlabelstorage); + error = mac_internalize_cred_label(execlabelstorage, buffer); + free(buffer, M_MACTEMP); + if (error) { + mac_destroy_cred_label(execlabelstorage); + return (error); + } + imgp->execlabel = execlabelstorage; + return (0); +} + +void +mac_execve_exit(struct image_params *imgp) +{ + if (imgp->execlabel != NULL) + mac_destroy_cred_label(imgp->execlabel); +} + void -mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp) +mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp, + struct label *interpvnodelabel, struct image_params *imgp) { ASSERT_VOP_LOCKED(vp, "mac_execve_transition"); @@ -1260,11 +1306,13 @@ mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp) if (!mac_enforce_process && !mac_enforce_fs) return; - MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label); + MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label, + interpvnodelabel, imgp); } int -mac_execve_will_transition(struct ucred *old, struct vnode *vp) +mac_execve_will_transition(struct ucred *old, struct vnode *vp, + struct label *interpvnodelabel, struct image_params *imgp) { int result; @@ -1274,7 +1322,8 @@ mac_execve_will_transition(struct ucred *old, struct vnode *vp) return (0); result = 0; - MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label); + MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label, + interpvnodelabel, imgp); return (result); } @@ -1369,7 +1418,8 @@ mac_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp, } int -mac_check_vnode_exec(struct ucred *cred, struct vnode *vp) +mac_check_vnode_exec(struct ucred *cred, struct vnode *vp, + struct image_params *imgp) { int error; @@ -1378,7 +1428,7 @@ mac_check_vnode_exec(struct ucred *cred, struct vnode *vp) if (!mac_enforce_process && !mac_enforce_fs) return (0); - MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label); + MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label, imgp); return (error); } diff --git a/sys/security/mac/mac_system.c b/sys/security/mac/mac_system.c index e1f2531..9f76f05 100644 --- a/sys/security/mac/mac_system.c +++ b/sys/security/mac/mac_system.c @@ -47,6 +47,7 @@ #include <sys/param.h> #include <sys/extattr.h> +#include <sys/imgact.h> #include <sys/kernel.h> #include <sys/lock.h> #include <sys/malloc.h> @@ -1251,8 +1252,53 @@ mac_setlabel_vnode_extattr(struct ucred *cred, struct vnode *vp, return (error); } +int +mac_execve_enter(struct image_params *imgp, struct mac *mac_p, + struct label *execlabelstorage) +{ + struct mac mac; + char *buffer; + int error; + + if (mac_p == NULL) + return (0); + + error = copyin(mac_p, &mac, sizeof(mac)); + if (error) + return (error); + + error = mac_check_structmac_consistent(&mac); + if (error) + return (error); + + buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK); + error = copyinstr(mac.m_string, buffer, mac.m_buflen, NULL); + if (error) { + free(buffer, M_MACTEMP); + return (error); + } + + mac_init_cred_label(execlabelstorage); + error = mac_internalize_cred_label(execlabelstorage, buffer); + free(buffer, M_MACTEMP); + if (error) { + mac_destroy_cred_label(execlabelstorage); + return (error); + } + imgp->execlabel = execlabelstorage; + return (0); +} + +void +mac_execve_exit(struct image_params *imgp) +{ + if (imgp->execlabel != NULL) + mac_destroy_cred_label(imgp->execlabel); +} + void -mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp) +mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp, + struct label *interpvnodelabel, struct image_params *imgp) { ASSERT_VOP_LOCKED(vp, "mac_execve_transition"); @@ -1260,11 +1306,13 @@ mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp) if (!mac_enforce_process && !mac_enforce_fs) return; - MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label); + MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label, + interpvnodelabel, imgp); } int -mac_execve_will_transition(struct ucred *old, struct vnode *vp) +mac_execve_will_transition(struct ucred *old, struct vnode *vp, + struct label *interpvnodelabel, struct image_params *imgp) { int result; @@ -1274,7 +1322,8 @@ mac_execve_will_transition(struct ucred *old, struct vnode *vp) return (0); result = 0; - MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label); + MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label, + interpvnodelabel, imgp); return (result); } @@ -1369,7 +1418,8 @@ mac_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp, } int -mac_check_vnode_exec(struct ucred *cred, struct vnode *vp) +mac_check_vnode_exec(struct ucred *cred, struct vnode *vp, + struct image_params *imgp) { int error; @@ -1378,7 +1428,7 @@ mac_check_vnode_exec(struct ucred *cred, struct vnode *vp) if (!mac_enforce_process && !mac_enforce_fs) return (0); - MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label); + MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label, imgp); return (error); } diff --git a/sys/security/mac/mac_vfs.c b/sys/security/mac/mac_vfs.c index e1f2531..9f76f05 100644 --- a/sys/security/mac/mac_vfs.c +++ b/sys/security/mac/mac_vfs.c @@ -47,6 +47,7 @@ #include <sys/param.h> #include <sys/extattr.h> +#include <sys/imgact.h> #include <sys/kernel.h> #include <sys/lock.h> #include <sys/malloc.h> @@ -1251,8 +1252,53 @@ mac_setlabel_vnode_extattr(struct ucred *cred, struct vnode *vp, return (error); } +int +mac_execve_enter(struct image_params *imgp, struct mac *mac_p, + struct label *execlabelstorage) +{ + struct mac mac; + char *buffer; + int error; + + if (mac_p == NULL) + return (0); + + error = copyin(mac_p, &mac, sizeof(mac)); + if (error) + return (error); + + error = mac_check_structmac_consistent(&mac); + if (error) + return (error); + + buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK); + error = copyinstr(mac.m_string, buffer, mac.m_buflen, NULL); + if (error) { + free(buffer, M_MACTEMP); + return (error); + } + + mac_init_cred_label(execlabelstorage); + error = mac_internalize_cred_label(execlabelstorage, buffer); + free(buffer, M_MACTEMP); + if (error) { + mac_destroy_cred_label(execlabelstorage); + return (error); + } + imgp->execlabel = execlabelstorage; + return (0); +} + +void +mac_execve_exit(struct image_params *imgp) +{ + if (imgp->execlabel != NULL) + mac_destroy_cred_label(imgp->execlabel); +} + void -mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp) +mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp, + struct label *interpvnodelabel, struct image_params *imgp) { ASSERT_VOP_LOCKED(vp, "mac_execve_transition"); @@ -1260,11 +1306,13 @@ mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp) if (!mac_enforce_process && !mac_enforce_fs) return; - MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label); + MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label, + interpvnodelabel, imgp); } int -mac_execve_will_transition(struct ucred *old, struct vnode *vp) +mac_execve_will_transition(struct ucred *old, struct vnode *vp, + struct label *interpvnodelabel, struct image_params *imgp) { int result; @@ -1274,7 +1322,8 @@ mac_execve_will_transition(struct ucred *old, struct vnode *vp) return (0); result = 0; - MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label); + MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label, + interpvnodelabel, imgp); return (result); } @@ -1369,7 +1418,8 @@ mac_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp, } int -mac_check_vnode_exec(struct ucred *cred, struct vnode *vp) +mac_check_vnode_exec(struct ucred *cred, struct vnode *vp, + struct image_params *imgp) { int error; @@ -1378,7 +1428,7 @@ mac_check_vnode_exec(struct ucred *cred, struct vnode *vp) if (!mac_enforce_process && !mac_enforce_fs) return (0); - MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label); + MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label, imgp); return (error); } |