1 | /* |
2 | * Copyright (c) 2007 Apple Inc. All rights reserved. |
3 | * |
4 | * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ |
5 | * |
6 | * This file contains Original Code and/or Modifications of Original Code |
7 | * as defined in and that are subject to the Apple Public Source License |
8 | * Version 2.0 (the 'License'). You may not use this file except in |
9 | * compliance with the License. The rights granted to you under the License |
10 | * may not be used to create, or enable the creation or redistribution of, |
11 | * unlawful or unlicensed copies of an Apple operating system, or to |
12 | * circumvent, violate, or enable the circumvention or violation of, any |
13 | * terms of an Apple operating system software license agreement. |
14 | * |
15 | * Please obtain a copy of the License at |
16 | * http://www.opensource.apple.com/apsl/ and read it before using this file. |
17 | * |
18 | * The Original Code and all software distributed under the License are |
19 | * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER |
20 | * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, |
21 | * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, |
22 | * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. |
23 | * Please see the License for the specific language governing rights and |
24 | * limitations under the License. |
25 | * |
26 | * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ |
27 | */ |
28 | #include <sys/param.h> |
29 | #include <sys/vnode.h> |
30 | #include <sys/vnode_internal.h> |
31 | #include <sys/kauth.h> |
32 | #include <sys/namei.h> |
33 | #include <sys/mount.h> |
34 | #include <sys/mount_internal.h> |
35 | #include <sys/uio_internal.h> |
36 | #include <sys/xattr.h> |
37 | #include "../bsd/sys/fsevents.h" |
38 | |
39 | #include <security/mac_internal.h> |
40 | |
41 | /* |
42 | * Caller holds I/O reference on vnode |
43 | */ |
44 | int |
45 | vnode_label(struct mount *mp, struct vnode *dvp, struct vnode *vp, |
46 | struct componentname *cnp, int flags, vfs_context_t ctx) |
47 | { |
48 | int error = 0; |
49 | bool exit_fast; |
50 | |
51 | /* fast path checks... */ |
52 | |
53 | /* are we labeling vnodes? If not still notify of create */ |
54 | #if CONFIG_MACF_LAZY_VNODE_LABELS |
55 | exit_fast = true; |
56 | #else |
57 | exit_fast = (mac_label_vnodes == 0); |
58 | #endif |
59 | if (exit_fast) { |
60 | if (flags & VNODE_LABEL_CREATE) { |
61 | error = mac_vnode_notify_create(ctx, |
62 | mp, dvp, vp, cnp); |
63 | } |
64 | return error; |
65 | } |
66 | |
67 | /* if already VL_LABELED */ |
68 | if (vp->v_lflag & VL_LABELED) { |
69 | return 0; |
70 | } |
71 | |
72 | vnode_lock_spin(vp); |
73 | |
74 | /* |
75 | * must revalidate state once we hold the lock |
76 | * since we could have blocked and someone else |
77 | * has since labeled this vnode |
78 | */ |
79 | if (vp->v_lflag & VL_LABELED) { |
80 | vnode_unlock(vp); |
81 | return 0; |
82 | } |
83 | |
84 | if ((vp->v_lflag & VL_LABEL) == 0) { |
85 | vp->v_lflag |= VL_LABEL; |
86 | |
87 | /* Could sleep on disk I/O, drop lock. */ |
88 | vnode_unlock(vp); |
89 | |
90 | if (mac_vnode_label(vp) == NULL) { |
91 | mac_vnode_label_init(vp); |
92 | } |
93 | |
94 | if (flags & VNODE_LABEL_CREATE) { |
95 | error = mac_vnode_notify_create(ctx, |
96 | mp, dvp, vp, cnp); |
97 | } else { |
98 | error = mac_vnode_label_associate(mp, vp, ctx); |
99 | } |
100 | |
101 | vnode_lock_spin(vp); |
102 | |
103 | if ((error == 0) && (vp->v_flag & VNCACHEABLE)) { |
104 | vp->v_lflag |= VL_LABELED; |
105 | } |
106 | vp->v_lflag &= ~VL_LABEL; |
107 | |
108 | if (vp->v_lflag & VL_LABELWAIT) { |
109 | vp->v_lflag &= ~VL_LABELWAIT; |
110 | wakeup(chan: &vp->v_label); |
111 | } |
112 | } else { |
113 | struct timespec ts; |
114 | |
115 | ts.tv_sec = 10; |
116 | ts.tv_nsec = 0; |
117 | |
118 | while (vp->v_lflag & VL_LABEL) { |
119 | vp->v_lflag |= VL_LABELWAIT; |
120 | |
121 | error = msleep(chan: &vp->v_label, mtx: &vp->v_lock, PVFS | PDROP, |
122 | wmesg: "vnode_label" , ts: &ts); |
123 | vnode_lock_spin(vp); |
124 | |
125 | if (error == EWOULDBLOCK) { |
126 | vprint(label: "vnode label timeout" , vp); |
127 | break; |
128 | } |
129 | } |
130 | /* XXX: what should be done if labeling failed (above)? */ |
131 | } |
132 | vnode_unlock(vp); |
133 | |
134 | return error; |
135 | } |
136 | |
137 | |
138 | /* |
139 | * Clear the "labeled" flag on a VNODE. |
140 | * VNODE will have label re-associated upon |
141 | * next call to lookup(). |
142 | * |
143 | * Caller verifies vfs_flags(vnode_mount(vp)) & MNT_MULTILABEL |
144 | * Caller holds vnode lock. |
145 | */ |
146 | void |
147 | vnode_relabel(struct vnode *vp) |
148 | { |
149 | /* Wait for any other labeling to complete. */ |
150 | while (vp->v_lflag & VL_LABEL) { |
151 | vp->v_lflag |= VL_LABELWAIT; |
152 | (void)msleep(chan: &vp->v_label, mtx: &vp->v_lock, PVFS, wmesg: "vnode_relabel" , ts: 0); |
153 | } |
154 | |
155 | /* Clear labeled flag */ |
156 | vp->v_lflag &= ~VL_LABELED; |
157 | |
158 | return; |
159 | } |
160 | |
161 | /* |
162 | * VFS XATTR helpers. |
163 | */ |
164 | |
165 | int |
166 | mac_vnop_setxattr(struct vnode *vp, const char *name, char *buf, size_t len) |
167 | { |
168 | vfs_context_t ctx; |
169 | int options = XATTR_NOSECURITY; |
170 | UIO_STACKBUF(uio_buf, 1); |
171 | uio_t auio; |
172 | int error; |
173 | |
174 | if (vfs_isrdonly(mp: vp->v_mount)) { |
175 | return EROFS; |
176 | } |
177 | |
178 | ctx = vfs_context_current(); |
179 | auio = uio_createwithbuffer(a_iovcount: 1, a_offset: 0, a_spacetype: UIO_SYSSPACE, a_iodirection: UIO_WRITE, |
180 | a_buf_p: &uio_buf[0], a_buffer_size: sizeof(uio_buf)); |
181 | uio_addiov(a_uio: auio, CAST_USER_ADDR_T(buf), a_length: len); |
182 | |
183 | error = vn_setxattr(vp, name, auio, options, ctx); |
184 | #if CONFIG_FSE |
185 | if (error == 0) { |
186 | add_fsevent(FSE_XATTR_MODIFIED, ctx, |
187 | FSE_ARG_VNODE, vp, |
188 | FSE_ARG_DONE); |
189 | } |
190 | #endif |
191 | |
192 | return error; |
193 | } |
194 | |
195 | int |
196 | mac_vnop_getxattr(struct vnode *vp, const char *name, char *buf, size_t len, |
197 | size_t *attrlen) |
198 | { |
199 | vfs_context_t ctx = vfs_context_current(); |
200 | int options = XATTR_NOSECURITY; |
201 | UIO_STACKBUF(uio_buf, 1); |
202 | uio_t auio; |
203 | int error; |
204 | |
205 | auio = uio_createwithbuffer(a_iovcount: 1, a_offset: 0, a_spacetype: UIO_SYSSPACE, a_iodirection: UIO_READ, |
206 | a_buf_p: &uio_buf[0], a_buffer_size: sizeof(uio_buf)); |
207 | uio_addiov(a_uio: auio, CAST_USER_ADDR_T(buf), a_length: len); |
208 | |
209 | error = vn_getxattr(vp, name, auio, attrlen, options, ctx); |
210 | *attrlen = len - uio_resid(a_uio: auio); |
211 | |
212 | return error; |
213 | } |
214 | |
215 | int |
216 | mac_vnop_removexattr(struct vnode *vp, const char *name) |
217 | { |
218 | vfs_context_t ctx = vfs_context_current(); |
219 | int options = XATTR_NOSECURITY; |
220 | int error; |
221 | |
222 | if (vfs_isrdonly(mp: vp->v_mount)) { |
223 | return EROFS; |
224 | } |
225 | |
226 | error = vn_removexattr(vp, name, options, ctx); |
227 | #if CONFIG_FSE |
228 | if (error == 0) { |
229 | add_fsevent(FSE_XATTR_REMOVED, ctx, |
230 | FSE_ARG_VNODE, vp, |
231 | FSE_ARG_DONE); |
232 | } |
233 | #endif |
234 | |
235 | return error; |
236 | } |
237 | |