1/*
2 * Copyright (c) 2007 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28
29/*-
30 * Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson
31 * Copyright (c) 2001 Ilmar S. Habibulin
32 * Copyright (c) 2001, 2002, 2003, 2004 Networks Associates Technology, Inc.
33 * Copyright (c) 2005 SPARTA, Inc.
34 * All rights reserved.
35 *
36 * This software was developed by Robert Watson and Ilmar Habibulin for the
37 * TrustedBSD Project.
38 *
39 * This software was developed for the FreeBSD Project in part by Network
40 * Associates Laboratories, the Security Research Division of Network
41 * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"),
42 * as part of the DARPA CHATS research program.
43 *
44 * Redistribution and use in source and binary forms, with or without
45 * modification, are permitted provided that the following conditions
46 * are met:
47 * 1. Redistributions of source code must retain the above copyright
48 * notice, this list of conditions and the following disclaimer.
49 * 2. Redistributions in binary form must reproduce the above copyright
50 * notice, this list of conditions and the following disclaimer in the
51 * documentation and/or other materials provided with the distribution.
52 *
53 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
54 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
55 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
56 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
57 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
58 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
59 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
60 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
61 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
62 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
63 * SUCH DAMAGE.
64 *
65 */
66
67#ifndef _SECURITY_MAC_INTERNAL_H_
68#define _SECURITY_MAC_INTERNAL_H_
69
70#ifndef PRIVATE
71#warning "MAC policy is not KPI, see Technical Q&A QA1574, this header will be removed in next version"
72#endif
73
74#include <string.h>
75#include <sys/param.h>
76#include <sys/queue.h>
77#include <security/mac.h>
78#include <security/mac_framework.h>
79#include <security/mac_policy.h>
80#include <security/mac_data.h>
81#include <sys/sysctl.h>
82#include <kern/locks.h>
83#include <sys/kernel.h>
84#include <sys/lock.h>
85#include <sys/malloc.h>
86#include <sys/sbuf.h>
87#include <sys/proc.h>
88#include <sys/systm.h>
89#include <sys/socket.h>
90#include <sys/socketvar.h>
91#include <sys/vnode.h>
92
93/*
94 * MAC Framework sysctl namespace.
95 */
96
97SYSCTL_DECL(_security);
98SYSCTL_DECL(_security_mac);
99
100extern int mac_late;
101
102struct mac_policy_list_element {
103 struct mac_policy_conf *mpc;
104};
105
106struct mac_policy_list {
107 u_int numloaded;
108 u_int max;
109 u_int maxindex;
110 u_int staticmax;
111 u_int chunks;
112 u_int freehint;
113 struct mac_policy_list_element *entries;
114};
115
116typedef struct mac_policy_list mac_policy_list_t;
117
118
119/*
120 * Policy that has registered with the framework for a specific
121 * label namespace name.
122 */
123struct mac_label_listener {
124 mac_policy_handle_t mll_handle;
125 LIST_ENTRY(mac_label_listener) mll_list;
126};
127
128LIST_HEAD(mac_label_listeners_t, mac_label_listener);
129
130/*
131 * Type of list used to manage label namespace names.
132 */
133struct mac_label_element {
134 char mle_name[MAC_MAX_LABEL_ELEMENT_NAME];
135 struct mac_label_listeners_t mle_listeners;
136 LIST_ENTRY(mac_label_element) mle_list;
137};
138
139LIST_HEAD(mac_label_element_list_t, mac_label_element);
140
141/*
142 * MAC Framework global variables.
143 */
144
145extern struct mac_label_element_list_t mac_label_element_list;
146extern struct mac_label_element_list_t mac_static_label_element_list;
147
148extern struct mac_policy_list mac_policy_list;
149
150/*
151 * global flags to control whether a MACF subsystem is configured
152 * at all in the system.
153 */
154extern unsigned int mac_device_enforce;
155extern unsigned int mac_pipe_enforce;
156extern unsigned int mac_posixsem_enforce;
157extern unsigned int mac_posixshm_enforce;
158extern unsigned int mac_proc_enforce;
159extern unsigned int mac_socket_enforce;
160extern unsigned int mac_system_enforce;
161extern unsigned int mac_sysvmsg_enforce;
162extern unsigned int mac_sysvsem_enforce;
163extern unsigned int mac_sysvshm_enforce;
164extern unsigned int mac_vm_enforce;
165extern unsigned int mac_vnode_enforce;
166
167#if CONFIG_MACF_NET
168extern unsigned int mac_label_mbufs;
169#endif
170
171extern unsigned int mac_label_vnodes;
172
173static bool mac_proc_check_enforce(proc_t p);
174
175static __inline__ bool mac_proc_check_enforce(proc_t p)
176{
177#if CONFIG_MACF
178 // Don't apply policies to the kernel itself.
179 return (p != kernproc);
180#else
181#pragma unused(p)
182 return false;
183#endif // CONFIG_MACF
184}
185
186static bool mac_cred_check_enforce(kauth_cred_t cred);
187
188static __inline__ bool mac_cred_check_enforce(kauth_cred_t cred)
189{
190#if CONFIG_MACF
191 return (cred != proc_ucred(kernproc));
192#else
193#pragma unused(p)
194 return false;
195#endif // CONFIG_MACF
196}
197
198/*
199 * MAC Framework infrastructure functions.
200 */
201
202int mac_error_select(int error1, int error2);
203
204void mac_policy_list_busy(void);
205int mac_policy_list_conditional_busy(void);
206void mac_policy_list_unbusy(void);
207
208void mac_labelzone_init(void);
209struct label *mac_labelzone_alloc(int flags);
210void mac_labelzone_free(struct label *label);
211
212void mac_label_init(struct label *label);
213void mac_label_destroy(struct label *label);
214#if KERNEL
215int mac_check_structmac_consistent(struct user_mac *mac);
216#else
217int mac_check_structmac_consistent(struct mac *mac);
218#endif
219
220int mac_cred_label_externalize(struct label *, char *e, char *out, size_t olen, int flags);
221#if CONFIG_MACF_SOCKET
222int mac_socket_label_externalize(struct label *, char *e, char *out, size_t olen);
223#endif /* CONFIG_MACF_SOCKET */
224int mac_vnode_label_externalize(struct label *, char *e, char *out, size_t olen, int flags);
225int mac_pipe_label_externalize(struct label *label, char *elements,
226 char *outbuf, size_t outbuflen);
227
228int mac_cred_label_internalize(struct label *label, char *string);
229#if CONFIG_MACF_SOCKET
230int mac_socket_label_internalize(struct label *label, char *string);
231#endif /* CONFIG_MACF_SOCKET */
232int mac_vnode_label_internalize(struct label *label, char *string);
233int mac_pipe_label_internalize(struct label *label, char *string);
234
235#if CONFIG_MACF_SOCKET
236/* internal socket label manipulation functions */
237struct label *mac_socket_label_alloc(int flags);
238void mac_socket_label_free(struct label *l);
239int mac_socket_label_update(struct ucred *cred, struct socket *so, struct label *l);
240#endif /* MAC_SOCKET */
241
242#if CONFIG_MACF_NET
243struct label *mac_mbuf_to_label(struct mbuf *m);
244#else
245#define mac_mbuf_to_label(m) (NULL)
246#endif
247
248/*
249 * MAC_CHECK performs the designated check by walking the policy
250 * module list and checking with each as to how it feels about the
251 * request. Note that it returns its value via 'error' in the scope
252 * of the caller.
253 */
254#define MAC_CHECK(check, args...) do { \
255 struct mac_policy_conf *mpc; \
256 u_int i; \
257 \
258 error = 0; \
259 for (i = 0; i < mac_policy_list.staticmax; i++) { \
260 mpc = mac_policy_list.entries[i].mpc; \
261 if (mpc == NULL) \
262 continue; \
263 \
264 if (mpc->mpc_ops->mpo_ ## check != NULL) \
265 error = mac_error_select( \
266 mpc->mpc_ops->mpo_ ## check (args), \
267 error); \
268 } \
269 if (mac_policy_list_conditional_busy() != 0) { \
270 for (; i <= mac_policy_list.maxindex; i++) { \
271 mpc = mac_policy_list.entries[i].mpc; \
272 if (mpc == NULL) \
273 continue; \
274 \
275 if (mpc->mpc_ops->mpo_ ## check != NULL) \
276 error = mac_error_select( \
277 mpc->mpc_ops->mpo_ ## check (args), \
278 error); \
279 } \
280 mac_policy_list_unbusy(); \
281 } \
282} while (0)
283
284/*
285 * MAC_GRANT performs the designated check by walking the policy
286 * module list and checking with each as to how it feels about the
287 * request. Unlike MAC_CHECK, it grants if any policies return '0',
288 * and otherwise returns EPERM. Note that it returns its value via
289 * 'error' in the scope of the caller.
290 */
291#define MAC_GRANT(check, args...) do { \
292 struct mac_policy_conf *mpc; \
293 u_int i; \
294 \
295 error = EPERM; \
296 for (i = 0; i < mac_policy_list.staticmax; i++) { \
297 mpc = mac_policy_list.entries[i].mpc; \
298 if (mpc == NULL) \
299 continue; \
300 \
301 if (mpc->mpc_ops->mpo_ ## check != NULL) { \
302 if (mpc->mpc_ops->mpo_ ## check (args) == 0) \
303 error = 0; \
304 } \
305 } \
306 if (mac_policy_list_conditional_busy() != 0) { \
307 for (; i <= mac_policy_list.maxindex; i++) { \
308 mpc = mac_policy_list.entries[i].mpc; \
309 if (mpc == NULL) \
310 continue; \
311 \
312 if (mpc->mpc_ops->mpo_ ## check != NULL) { \
313 if (mpc->mpc_ops->mpo_ ## check (args) \
314 == 0) \
315 error = 0; \
316 } \
317 } \
318 mac_policy_list_unbusy(); \
319 } \
320} while (0)
321
322/*
323 * MAC_BOOLEAN performs the designated boolean composition by walking
324 * the module list, invoking each instance of the operation, and
325 * combining the results using the passed C operator. Note that it
326 * returns its value via 'result' in the scope of the caller, which
327 * should be initialized by the caller in a meaningful way to get
328 * a meaningful result.
329 */
330#define MAC_BOOLEAN(operation, composition, args...) do { \
331 struct mac_policy_conf *mpc; \
332 u_int i; \
333 \
334 for (i = 0; i < mac_policy_list.staticmax; i++) { \
335 mpc = mac_policy_list.entries[i].mpc; \
336 if (mpc == NULL) \
337 continue; \
338 \
339 if (mpc->mpc_ops->mpo_ ## operation != NULL) \
340 result = result composition \
341 mpc->mpc_ops->mpo_ ## operation \
342 (args); \
343 } \
344 if (mac_policy_list_conditional_busy() != 0) { \
345 for (; i <= mac_policy_list.maxindex; i++) { \
346 mpc = mac_policy_list.entries[i].mpc; \
347 if (mpc == NULL) \
348 continue; \
349 \
350 if (mpc->mpc_ops->mpo_ ## operation != NULL) \
351 result = result composition \
352 mpc->mpc_ops->mpo_ ## operation \
353 (args); \
354 } \
355 mac_policy_list_unbusy(); \
356 } \
357} while (0)
358
359#define MAC_INTERNALIZE(obj, label, instring) \
360 mac_internalize(offsetof(struct mac_policy_ops, mpo_ ## obj ## _label_internalize), label, instring)
361
362#define MAC_EXTERNALIZE(obj, label, elementlist, outbuf, outbuflen) \
363 mac_externalize(offsetof(struct mac_policy_ops, mpo_ ## obj ## _label_externalize), label, elementlist, outbuf, outbuflen)
364
365#define MAC_EXTERNALIZE_AUDIT(obj, label, outbuf, outbuflen) \
366 mac_externalize(offsetof(struct mac_policy_ops, mpo_ ## obj ## _label_externalize_audit), label, "*", outbuf, outbuflen)
367
368/*
369 * MAC_PERFORM performs the designated operation by walking the policy
370 * module list and invoking that operation for each policy.
371 */
372#define MAC_PERFORM(operation, args...) do { \
373 struct mac_policy_conf *mpc; \
374 u_int i; \
375 \
376 for (i = 0; i < mac_policy_list.staticmax; i++) { \
377 mpc = mac_policy_list.entries[i].mpc; \
378 if (mpc == NULL) \
379 continue; \
380 \
381 if (mpc->mpc_ops->mpo_ ## operation != NULL) \
382 mpc->mpc_ops->mpo_ ## operation (args); \
383 } \
384 if (mac_policy_list_conditional_busy() != 0) { \
385 for (; i <= mac_policy_list.maxindex; i++) { \
386 mpc = mac_policy_list.entries[i].mpc; \
387 if (mpc == NULL) \
388 continue; \
389 \
390 if (mpc->mpc_ops->mpo_ ## operation != NULL) \
391 mpc->mpc_ops->mpo_ ## operation (args); \
392 } \
393 mac_policy_list_unbusy(); \
394 } \
395} while (0)
396
397struct __mac_get_pid_args;
398struct __mac_get_proc_args;
399struct __mac_set_proc_args;
400struct __mac_get_lcid_args;
401struct __mac_get_fd_args;
402struct __mac_get_file_args;
403struct __mac_get_link_args;
404struct __mac_set_fd_args;
405struct __mac_set_file_args;
406struct __mac_syscall_args;
407
408void mac_policy_addto_labellist(const mac_policy_handle_t, int);
409void mac_policy_removefrom_labellist(const mac_policy_handle_t);
410
411int mac_externalize(size_t mpo_externalize_off, struct label *label,
412 const char *elementlist, char *outbuf, size_t outbuflen);
413int mac_internalize(size_t mpo_internalize_off, struct label *label,
414 char *elementlist);
415#endif /* !_SECURITY_MAC_INTERNAL_H_ */
416