1/*
2 * Copyright (c) 2007-2012 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28/*-
29 * Copyright (c) 1999-2002 Robert N. M. Watson
30 * Copyright (c) 2001 Ilmar S. Habibulin
31 * Copyright (c) 2001-2005 Networks Associates Technology, Inc.
32 * Copyright (c) 2005 SPARTA, Inc.
33 * All rights reserved.
34 *
35 * This software was developed by Robert Watson and Ilmar Habibulin for the
36 * TrustedBSD Project.
37 *
38 * This software was developed for the FreeBSD Project in part by McAfee
39 * Research, the Technology Research Division of Network Associates, Inc.
40 * under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the
41 * DARPA CHATS research program.
42 *
43 * This software was enhanced by SPARTA ISSO under SPAWAR contract
44 * N66001-04-C-6019 ("SEFOS").
45 *
46 * Redistribution and use in source and binary forms, with or without
47 * modification, are permitted provided that the following conditions
48 * are met:
49 * 1. Redistributions of source code must retain the above copyright
50 * notice, this list of conditions and the following disclaimer.
51 * 2. Redistributions in binary form must reproduce the above copyright
52 * notice, this list of conditions and the following disclaimer in the
53 * documentation and/or other materials provided with the distribution.
54 *
55 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
56 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
57 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
58 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
59 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
60 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
61 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
62 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
63 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
64 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
65 * SUCH DAMAGE.
66 */
67
68#include <sys/cdefs.h>
69
70#include <sys/param.h>
71#include <sys/kernel.h>
72#include <sys/lock.h>
73#include <sys/malloc.h>
74#include <sys/sbuf.h>
75#include <sys/systm.h>
76#include <sys/mount.h>
77#include <sys/file.h>
78#include <sys/namei.h>
79#include <sys/protosw.h>
80#include <sys/socket.h>
81#include <sys/socketvar.h>
82#include <sys/sysctl.h>
83#include <sys/kpi_socket.h>
84
85#include <security/mac_internal.h>
86
87#if CONFIG_MACF_SOCKET
88struct label *
89mac_socket_label_alloc(int flag)
90{
91 struct label *label;
92 int error;
93
94 label = mac_labelzone_alloc(flag);
95 if (label == NULL)
96 return (NULL);
97
98 MAC_CHECK(socket_label_init, label, flag);
99 if (error) {
100 MAC_PERFORM(socket_label_destroy, label);
101 mac_labelzone_free(label);
102 return (NULL);
103 }
104
105 return (label);
106}
107
108static struct label *
109mac_socket_peer_label_alloc(int flag)
110{
111 struct label *label;
112 int error;
113
114 label = mac_labelzone_alloc(flag);
115 if (label == NULL)
116 return (NULL);
117
118 MAC_CHECK(socketpeer_label_init, label, flag);
119 if (error) {
120 MAC_PERFORM(socketpeer_label_destroy, label);
121 mac_labelzone_free(label);
122 return (NULL);
123 }
124
125 return (label);
126}
127
128int
129mac_socket_label_init(struct socket *so, int flag)
130{
131
132 so->so_label = mac_socket_label_alloc(flag);
133 if (so->so_label == NULL)
134 return (ENOMEM);
135 so->so_peerlabel = mac_socket_peer_label_alloc(flag);
136 if (so->so_peerlabel == NULL) {
137 mac_socket_label_free(so->so_label);
138 so->so_label = NULL;
139 return (ENOMEM);
140 }
141 return (0);
142}
143
144void
145mac_socket_label_free(struct label *label)
146{
147
148 MAC_PERFORM(socket_label_destroy, label);
149 mac_labelzone_free(label);
150}
151
152static void
153mac_socket_peer_label_free(struct label *label)
154{
155
156 MAC_PERFORM(socketpeer_label_destroy, label);
157 mac_labelzone_free(label);
158}
159
160void
161mac_socket_label_destroy(struct socket *so)
162{
163
164 if (so->so_label != NULL) {
165 mac_socket_label_free(so->so_label);
166 so->so_label = NULL;
167 }
168 if (so->so_peerlabel != NULL) {
169 mac_socket_peer_label_free(so->so_peerlabel);
170 so->so_peerlabel = NULL;
171 }
172}
173
174void
175mac_socket_label_copy(struct label *src, struct label *dest)
176{
177
178 MAC_PERFORM(socket_label_copy, src, dest);
179}
180
181int
182mac_socket_label_externalize(struct label *label, char *elements,
183 char *outbuf, size_t outbuflen)
184{
185 int error;
186
187 error = MAC_EXTERNALIZE(socket, label, elements, outbuf, outbuflen);
188
189 return (error);
190}
191
192static int
193mac_socketpeer_label_externalize(struct label *label, char *elements,
194 char *outbuf, size_t outbuflen)
195{
196 int error;
197
198 error = MAC_EXTERNALIZE(socketpeer, label, elements, outbuf, outbuflen);
199
200 return (error);
201}
202
203int
204mac_socket_label_internalize(struct label *label, char *string)
205{
206 int error;
207
208 error = MAC_INTERNALIZE(socket, label, string);
209
210 return (error);
211}
212
213void
214mac_socket_label_associate(struct ucred *cred, struct socket *so)
215{
216#if SECURITY_MAC_CHECK_ENFORCE
217 /* 21167099 - only check if we allow write */
218 if (!mac_socket_enforce)
219 return;
220#endif
221
222 MAC_PERFORM(socket_label_associate, cred,
223 (socket_t)so, so->so_label);
224}
225
226void
227mac_socket_label_associate_accept(struct socket *oldsocket,
228 struct socket *newsocket)
229{
230#if SECURITY_MAC_CHECK_ENFORCE
231 /* 21167099 - only check if we allow write */
232 if (!mac_socket_enforce)
233 return;
234#endif
235
236 MAC_PERFORM(socket_label_associate_accept,
237 (socket_t)oldsocket, oldsocket->so_label,
238 (socket_t)newsocket, newsocket->so_label);
239}
240
241#if CONFIG_MACF_SOCKET && CONFIG_MACF_NET
242void
243mac_socketpeer_label_associate_mbuf(struct mbuf *mbuf, struct socket *so)
244{
245 struct label *label;
246
247#if SECURITY_MAC_CHECK_ENFORCE
248 /* 21167099 - only check if we allow write */
249 if (!mac_socket_enforce && !mac_net_enforce)
250 return;
251#endif
252
253 label = mac_mbuf_to_label(mbuf);
254
255 /* Policy must deal with NULL label (unlabeled mbufs) */
256 MAC_PERFORM(socketpeer_label_associate_mbuf, mbuf, label,
257 (socket_t)so, so->so_peerlabel);
258}
259#else
260void
261mac_socketpeer_label_associate_mbuf(__unused struct mbuf *mbuf,
262 __unused struct socket *so)
263{
264 return;
265}
266#endif
267
268void
269mac_socketpeer_label_associate_socket(struct socket *oldsocket,
270 struct socket *newsocket)
271{
272#if SECURITY_MAC_CHECK_ENFORCE
273 /* 21167099 - only check if we allow write */
274 if (!mac_socket_enforce)
275 return;
276#endif
277
278 MAC_PERFORM(socketpeer_label_associate_socket,
279 (socket_t)oldsocket, oldsocket->so_label,
280 (socket_t)newsocket, newsocket->so_peerlabel);
281}
282
283int
284mac_socket_check_kqfilter(kauth_cred_t cred, struct knote *kn,
285 struct socket *so)
286{
287 int error;
288
289#if SECURITY_MAC_CHECK_ENFORCE
290 /* 21167099 - only check if we allow write */
291 if (!mac_socket_enforce)
292 return 0;
293#endif
294
295 MAC_CHECK(socket_check_kqfilter, cred, kn,
296 (socket_t)so, so->so_label);
297 return (error);
298}
299
300static int
301int
302mac_socket_check_select(kauth_cred_t cred, struct socket *so, int which)
303{
304 int error;
305
306#if SECURITY_MAC_CHECK_ENFORCE
307 /* 21167099 - only check if we allow write */
308 if (!mac_socket_enforce)
309 return 0;
310#endif
311
312 MAC_CHECK(socket_check_select, cred,
313 (socket_t)so, so->so_label, which);
314 return (error);
315}
316
317mac_socket_check_label_update(kauth_cred_t cred, struct socket *so,
318 struct label *newlabel)
319{
320 int error;
321
322#if SECURITY_MAC_CHECK_ENFORCE
323 /* 21167099 - only check if we allow write */
324 if (!mac_socket_enforce)
325 return 0;
326#endif
327
328 MAC_CHECK(socket_check_label_update, cred,
329 (socket_t)so, so->so_label,
330 newlabel);
331 return (error);
332}
333
334int
335mac_socket_label_update(kauth_cred_t cred, struct socket *so, struct label *label)
336{
337 int error;
338#if 0
339#if SECURITY_MAC_CHECK_ENFORCE
340 /* 21167099 - only check if we allow write */
341 if (!mac_socket_enforce)
342 return 0;
343#endif
344#endif
345 error = mac_socket_check_label_update(cred, so, label);
346 if (error)
347 return (error);
348
349 MAC_PERFORM(socket_label_update, cred,
350 (socket_t)so, so->so_label, label);
351
352#if CONFIG_MACF_NET
353 /*
354 * If the protocol has expressed interest in socket layer changes,
355 * such as if it needs to propagate changes to a cached pcb
356 * label from the socket, notify it of the label change while
357 * holding the socket lock.
358 * XXXMAC - are there cases when we should not do this?
359 */
360 mac_inpcb_label_update(so);
361#endif
362 return (0);
363}
364
365int
366mac_setsockopt_label(kauth_cred_t cred, struct socket *so, struct mac *mac)
367{
368 struct label *intlabel;
369 char *buffer;
370 int error;
371 size_t len;
372
373 error = mac_check_structmac_consistent(mac);
374 if (error)
375 return (error);
376
377 MALLOC(buffer, char *, mac->m_buflen, M_MACTEMP, M_WAITOK);
378 error = copyinstr(CAST_USER_ADDR_T(mac->m_string), buffer,
379 mac->m_buflen, &len);
380 if (error) {
381 FREE(buffer, M_MACTEMP);
382 return (error);
383 }
384
385 intlabel = mac_socket_label_alloc(MAC_WAITOK);
386 error = mac_socket_label_internalize(intlabel, buffer);
387 FREE(buffer, M_MACTEMP);
388 if (error)
389 goto out;
390
391 error = mac_socket_label_update(cred, so, intlabel);
392out:
393 mac_socket_label_free(intlabel);
394 return (error);
395}
396
397int
398mac_socket_label_get(__unused kauth_cred_t cred, struct socket *so,
399 struct mac *mac)
400{
401 char *buffer, *elements;
402 struct label *intlabel;
403 int error;
404 size_t len;
405
406 error = mac_check_structmac_consistent(mac);
407 if (error)
408 return (error);
409
410 MALLOC(elements, char *, mac->m_buflen, M_MACTEMP, M_WAITOK);
411 error = copyinstr(CAST_USER_ADDR_T(mac->m_string), elements,
412 mac->m_buflen, &len);
413 if (error) {
414 FREE(elements, M_MACTEMP);
415 return (error);
416 }
417
418 MALLOC(buffer, char *, mac->m_buflen, M_MACTEMP, M_WAITOK | M_ZERO);
419 intlabel = mac_socket_label_alloc(MAC_WAITOK);
420 mac_socket_label_copy(so->so_label, intlabel);
421 error = mac_socket_label_externalize(intlabel, elements, buffer,
422 mac->m_buflen);
423 mac_socket_label_free(intlabel);
424 if (error == 0)
425 error = copyout(buffer, CAST_USER_ADDR_T(mac->m_string),
426 strlen(buffer)+1);
427
428 FREE(buffer, M_MACTEMP);
429 FREE(elements, M_MACTEMP);
430
431 return (error);
432}
433
434int
435mac_socketpeer_label_get(__unused kauth_cred_t cred, struct socket *so,
436 struct mac *mac)
437{
438 char *elements, *buffer;
439 struct label *intlabel;
440 int error;
441 size_t len;
442
443 error = mac_check_structmac_consistent(mac);
444 if (error)
445 return (error);
446
447 MALLOC(elements, char *, mac->m_buflen, M_MACTEMP, M_WAITOK);
448 error = copyinstr(CAST_USER_ADDR_T(mac->m_string), elements,
449 mac->m_buflen, &len);
450 if (error) {
451 FREE(elements, M_MACTEMP);
452 return (error);
453 }
454
455 MALLOC(buffer, char *, mac->m_buflen, M_MACTEMP, M_WAITOK | M_ZERO);
456 intlabel = mac_socket_label_alloc(MAC_WAITOK);
457 mac_socket_label_copy(so->so_peerlabel, intlabel);
458 error = mac_socketpeer_label_externalize(intlabel, elements, buffer,
459 mac->m_buflen);
460 mac_socket_label_free(intlabel);
461 if (error == 0)
462 error = copyout(buffer, CAST_USER_ADDR_T(mac->m_string),
463 strlen(buffer)+1);
464
465 FREE(buffer, M_MACTEMP);
466 FREE(elements, M_MACTEMP);
467
468 return (error);
469}
470
471#endif /* MAC_SOCKET */
472
473int
474mac_socket_check_accept(kauth_cred_t cred, struct socket *so)
475{
476 int error;
477
478#if SECURITY_MAC_CHECK_ENFORCE
479 /* 21167099 - only check if we allow write */
480 if (!mac_socket_enforce)
481 return 0;
482#endif
483
484 MAC_CHECK(socket_check_accept, cred,
485 (socket_t)so, so->so_label);
486 return (error);
487}
488
489#if CONFIG_MACF_SOCKET_SUBSET
490int
491mac_socket_check_accepted(kauth_cred_t cred, struct socket *so)
492{
493 struct sockaddr *sockaddr;
494 int error;
495
496#if SECURITY_MAC_CHECK_ENFORCE
497 /* 21167099 - only check if we allow write */
498 if (!mac_socket_enforce)
499 return 0;
500#endif
501
502 if (sock_getaddr((socket_t)so, &sockaddr, 1) != 0) {
503 error = ECONNABORTED;
504 } else {
505 MAC_CHECK(socket_check_accepted, cred,
506 (socket_t)so, so->so_label, sockaddr);
507 sock_freeaddr(sockaddr);
508 }
509 return (error);
510}
511#endif
512
513int
514mac_socket_check_bind(kauth_cred_t ucred, struct socket *so,
515 struct sockaddr *sockaddr)
516{
517 int error;
518
519#if SECURITY_MAC_CHECK_ENFORCE
520 /* 21167099 - only check if we allow write */
521 if (!mac_socket_enforce)
522 return 0;
523#endif
524
525 MAC_CHECK(socket_check_bind, ucred,
526 (socket_t)so, so->so_label, sockaddr);
527 return (error);
528}
529
530int
531mac_socket_check_connect(kauth_cred_t cred, struct socket *so,
532 struct sockaddr *sockaddr)
533{
534 int error;
535
536#if SECURITY_MAC_CHECK_ENFORCE
537 /* 21167099 - only check if we allow write */
538 if (!mac_socket_enforce)
539 return 0;
540#endif
541
542 MAC_CHECK(socket_check_connect, cred,
543 (socket_t)so, so->so_label,
544 sockaddr);
545 return (error);
546}
547
548int
549mac_socket_check_create(kauth_cred_t cred, int domain, int type, int protocol)
550{
551 int error;
552
553#if SECURITY_MAC_CHECK_ENFORCE
554 /* 21167099 - only check if we allow write */
555 if (!mac_socket_enforce)
556 return 0;
557#endif
558
559 MAC_CHECK(socket_check_create, cred, domain, type, protocol);
560 return (error);
561}
562
563#if CONFIG_MACF_SOCKET && CONFIG_MACF_NET
564int
565mac_socket_check_deliver(struct socket *so, struct mbuf *mbuf)
566{
567 struct label *label;
568 int error;
569
570#if SECURITY_MAC_CHECK_ENFORCE
571 /* 21167099 - only check if we allow write */
572 if (!mac_socket_enforce)
573 return 0;
574#endif
575
576 label = mac_mbuf_to_label(mbuf);
577
578 /* Policy must deal with NULL label (unlabeled mbufs) */
579 MAC_CHECK(socket_check_deliver,
580 (socket_t)so, so->so_label, mbuf, label);
581 return (error);
582}
583#else
584int
585mac_socket_check_deliver(__unused struct socket *so, __unused struct mbuf *mbuf)
586{
587 return (0);
588}
589#endif
590
591int
592mac_socket_check_ioctl(kauth_cred_t cred, struct socket *so,
593 unsigned int cmd)
594{
595 int error;
596
597#if SECURITY_MAC_CHECK_ENFORCE
598 /* 21167099 - only check if we allow write */
599 if (!mac_socket_enforce)
600 return 0;
601#endif
602
603 MAC_CHECK(socket_check_ioctl, cred,
604 (socket_t)so, cmd, so->so_label);
605 return (error);
606}
607
608int
609mac_socket_check_stat(kauth_cred_t cred, struct socket *so)
610{
611 int error;
612
613#if SECURITY_MAC_CHECK_ENFORCE
614 /* 21167099 - only check if we allow write */
615 if (!mac_socket_enforce)
616 return 0;
617#endif
618
619 MAC_CHECK(socket_check_stat, cred,
620 (socket_t)so, so->so_label);
621 return (error);
622}
623
624int
625mac_socket_check_listen(kauth_cred_t cred, struct socket *so)
626{
627 int error;
628
629#if SECURITY_MAC_CHECK_ENFORCE
630 /* 21167099 - only check if we allow write */
631 if (!mac_socket_enforce)
632 return 0;
633#endif
634
635 MAC_CHECK(socket_check_listen, cred,
636 (socket_t)so, so->so_label);
637 return (error);
638}
639
640int
641mac_socket_check_receive(kauth_cred_t cred, struct socket *so)
642{
643 int error;
644
645#if SECURITY_MAC_CHECK_ENFORCE
646 /* 21167099 - only check if we allow write */
647 if (!mac_socket_enforce)
648 return 0;
649#endif
650
651 MAC_CHECK(socket_check_receive, cred,
652 (socket_t)so, so->so_label);
653 return (error);
654}
655
656int
657mac_socket_check_received(kauth_cred_t cred, struct socket *so, struct sockaddr *saddr)
658{
659 int error;
660
661#if SECURITY_MAC_CHECK_ENFORCE
662 /* 21167099 - only check if we allow write */
663 if (!mac_socket_enforce)
664 return 0;
665#endif
666
667 MAC_CHECK(socket_check_received, cred,
668 so, so->so_label, saddr);
669 return (error);
670}
671
672int
673mac_socket_check_send(kauth_cred_t cred, struct socket *so,
674 struct sockaddr *sockaddr)
675{
676 int error;
677
678#if SECURITY_MAC_CHECK_ENFORCE
679 /* 21167099 - only check if we allow write */
680 if (!mac_socket_enforce)
681 return 0;
682#endif
683
684 MAC_CHECK(socket_check_send, cred,
685 (socket_t)so, so->so_label, sockaddr);
686 return (error);
687}
688
689int
690mac_socket_check_setsockopt(kauth_cred_t cred, struct socket *so,
691 struct sockopt *sopt)
692{
693 int error;
694
695#if SECURITY_MAC_CHECK_ENFORCE
696 /* 21167099 - only check if we allow write */
697 if (!mac_socket_enforce)
698 return 0;
699#endif
700
701 MAC_CHECK(socket_check_setsockopt, cred,
702 (socket_t)so, so->so_label, sopt);
703 return (error);
704}
705
706int mac_socket_check_getsockopt(kauth_cred_t cred, struct socket *so,
707 struct sockopt *sopt)
708{
709 int error;
710
711#if SECURITY_MAC_CHECK_ENFORCE
712 /* 21167099 - only check if we allow write */
713 if (!mac_socket_enforce)
714 return 0;
715#endif
716
717 MAC_CHECK(socket_check_getsockopt, cred,
718 (socket_t)so, so->so_label, sopt);
719 return (error);
720}
721