From 78a117e6fa3ea5484baa385417846432dcafd758 Mon Sep 17 00:00:00 2001 From: rwatson Date: Sat, 23 Aug 2008 15:26:36 +0000 Subject: Introduce two related changes to the TrustedBSD MAC Framework: (1) Abstract interpreter vnode labeling in execve(2) and mac_execve(2) so that the general exec code isn't aware of the details of allocating, copying, and freeing labels, rather, simply passes in a void pointer to start and stop functions that will be used by the framework. This change will be MFC'd. (2) Introduce a new flags field to the MAC_POLICY_SET(9) interface allowing policies to declare which types of objects require label allocation, initialization, and destruction, and define a set of flags covering various supported object types (MPC_OBJECT_PROC, MPC_OBJECT_VNODE, MPC_OBJECT_INPCB, ...). This change reduces the overhead of compiling the MAC Framework into the kernel if policies aren't loaded, or if policies require labels on only a small number or even no object types. Each time a policy is loaded or unloaded, we recalculate a mask of labeled object types across all policies present in the system. Eliminate MAC_ALWAYS_LABEL_MBUF option as it is no longer required. MFC after: 1 week ((1) only) Reviewed by: csjp Obtained from: TrustedBSD Project Sponsored by: Apple, Inc. --- sys/security/mac/mac_syscalls.c | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) (limited to 'sys/security/mac/mac_syscalls.c') diff --git a/sys/security/mac/mac_syscalls.c b/sys/security/mac/mac_syscalls.c index 701b019..5cff185 100644 --- a/sys/security/mac/mac_syscalls.c +++ b/sys/security/mac/mac_syscalls.c @@ -3,6 +3,7 @@ * Copyright (c) 2001 Ilmar S. Habibulin * Copyright (c) 2001-2005 Networks Associates Technology, Inc. * Copyright (c) 2005-2006 SPARTA, Inc. + * Copyright (c) 2008 Apple Inc. * All rights reserved. * * This software was developed by Robert Watson and Ilmar Habibulin for the @@ -160,6 +161,9 @@ __mac_set_proc(struct thread *td, struct __mac_set_proc_args *uap) char *buffer; int error; + if (!(mac_labeled & MPC_OBJECT_CRED)) + return (EINVAL); + error = copyin(uap->mac_p, &mac, sizeof(mac)); if (error) return (error); @@ -253,6 +257,8 @@ __mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap) switch (fp->f_type) { case DTYPE_FIFO: case DTYPE_VNODE: + if (!(mac_labeled & MPC_OBJECT_VNODE)) + return (EINVAL); vp = fp->f_vnode; intlabel = mac_vnode_label_alloc(); vfslocked = VFS_LOCK_GIANT(vp->v_mount); @@ -266,6 +272,8 @@ __mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap) break; case DTYPE_PIPE: + if (!(mac_labeled & MPC_OBJECT_PIPE)) + return (EINVAL); pipe = fp->f_data; intlabel = mac_pipe_label_alloc(); PIPE_LOCK(pipe); @@ -277,6 +285,8 @@ __mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap) break; case DTYPE_SOCKET: + if (!(mac_labeled & MPC_OBJECT_SOCKET)) + return (EINVAL); so = fp->f_data; intlabel = mac_socket_label_alloc(M_WAITOK); SOCK_LOCK(so); @@ -309,6 +319,9 @@ __mac_get_file(struct thread *td, struct __mac_get_file_args *uap) struct mac mac; int vfslocked, error; + if (!(mac_labeled & MPC_OBJECT_VNODE)) + return (EINVAL); + error = copyin(uap->mac_p, &mac, sizeof(mac)); if (error) return (error); @@ -359,6 +372,9 @@ __mac_get_link(struct thread *td, struct __mac_get_link_args *uap) struct mac mac; int vfslocked, error; + if (!(mac_labeled & MPC_OBJECT_VNODE)) + return (EINVAL); + error = copyin(uap->mac_p, &mac, sizeof(mac)); if (error) return (error); @@ -435,6 +451,8 @@ __mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap) switch (fp->f_type) { case DTYPE_FIFO: case DTYPE_VNODE: + if (!(mac_labeled & MPC_OBJECT_VNODE)) + return (EINVAL); intlabel = mac_vnode_label_alloc(); error = mac_vnode_internalize_label(intlabel, buffer); if (error) { @@ -458,6 +476,8 @@ __mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap) break; case DTYPE_PIPE: + if (!(mac_labeled & MPC_OBJECT_PIPE)) + return (EINVAL); intlabel = mac_pipe_label_alloc(); error = mac_pipe_internalize_label(intlabel, buffer); if (error == 0) { @@ -471,6 +491,8 @@ __mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap) break; case DTYPE_SOCKET: + if (!(mac_labeled & MPC_OBJECT_SOCKET)) + return (EINVAL); intlabel = mac_socket_label_alloc(M_WAITOK); error = mac_socket_internalize_label(intlabel, buffer); if (error == 0) { @@ -500,6 +522,9 @@ __mac_set_file(struct thread *td, struct __mac_set_file_args *uap) char *buffer; int vfslocked, error; + if (!(mac_labeled & MPC_OBJECT_VNODE)) + return (EINVAL); + error = copyin(uap->mac_p, &mac, sizeof(mac)); if (error) return (error); @@ -551,6 +576,9 @@ __mac_set_link(struct thread *td, struct __mac_set_link_args *uap) char *buffer; int vfslocked, error; + if (!(mac_labeled & MPC_OBJECT_VNODE)) + return (EINVAL); + error = copyin(uap->mac_p, &mac, sizeof(mac)); if (error) return (error); -- cgit v1.1