Date: Thu, 30 Mar 2017 22:00:58 +0000 (UTC) From: Robert Watson <rwatson@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r316307 - head/sys/kern Message-ID: <201703302200.v2UM0wLr091817@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: rwatson Date: Thu Mar 30 22:00:58 2017 New Revision: 316307 URL: https://svnweb.freebsd.org/changeset/base/316307 Log: Add system-call argument auditing for ACL-related system calls. Obtained from: TrustedBSD Project MFC after: 3 weeks Sponsored by: DARPA, AFRL Modified: head/sys/kern/vfs_acl.c Modified: head/sys/kern/vfs_acl.c ============================================================================== --- head/sys/kern/vfs_acl.c Thu Mar 30 21:54:57 2017 (r316306) +++ head/sys/kern/vfs_acl.c Thu Mar 30 22:00:58 2017 (r316307) @@ -1,9 +1,14 @@ /*- - * Copyright (c) 1999-2006 Robert N. M. Watson + * Copyright (c) 1999-2006, 2016-2017 Robert N. M. Watson * All rights reserved. * * This software was developed by Robert Watson for the TrustedBSD Project. * + * Portions of this software were developed by BAE Systems, the University of + * Cambridge Computer Laboratory, and Memorial University under DARPA/AFRL + * contract FA8650-15-C-7558 ("CADETS"), as part of the DARPA Transparent + * Computing (TC) research program. + * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: @@ -53,6 +58,7 @@ __FBSDID("$FreeBSD$"); #include <sys/sysent.h> #include <sys/acl.h> +#include <security/audit/audit.h> #include <security/mac/mac_framework.h> CTASSERT(ACL_MAX_ENTRIES >= OLDACL_MAX_ENTRIES); @@ -216,6 +222,7 @@ vacl_set_acl(struct thread *td, struct v struct mount *mp; int error; + AUDIT_ARG_VALUE(type); inkernelacl = acl_alloc(M_WAITOK); error = acl_copyin(aclp, inkernelacl, type); if (error != 0) @@ -224,6 +231,7 @@ vacl_set_acl(struct thread *td, struct v if (error != 0) goto out; vn_lock(vp, LK_EXCLUSIVE | LK_RETRY); + AUDIT_ARG_VNODE1(vp); #ifdef MAC error = mac_vnode_check_setacl(td->td_ucred, vp, type, inkernelacl); if (error != 0) @@ -251,8 +259,10 @@ vacl_get_acl(struct thread *td, struct v struct acl *inkernelacl; int error; + AUDIT_ARG_VALUE(type); inkernelacl = acl_alloc(M_WAITOK | M_ZERO); vn_lock(vp, LK_EXCLUSIVE | LK_RETRY); + AUDIT_ARG_VNODE1(vp); #ifdef MAC error = mac_vnode_check_getacl(td->td_ucred, vp, type); if (error != 0) @@ -280,10 +290,12 @@ vacl_delete(struct thread *td, struct vn struct mount *mp; int error; + AUDIT_ARG_VALUE(type); error = vn_start_write(vp, &mp, V_WAIT | PCATCH); if (error != 0) return (error); vn_lock(vp, LK_EXCLUSIVE | LK_RETRY); + AUDIT_ARG_VNODE1(vp); #ifdef MAC error = mac_vnode_check_deleteacl(td->td_ucred, vp, type); if (error != 0) @@ -300,6 +312,8 @@ out: /* * Given a vnode, check whether an ACL is appropriate for it + * + * XXXRW: No vnode lock held so can't audit vnode state...? */ static int vacl_aclcheck(struct thread *td, struct vnode *vp, acl_type_t type, @@ -333,7 +347,8 @@ sys___acl_get_file(struct thread *td, st struct nameidata nd; int error; - NDINIT(&nd, LOOKUP, FOLLOW, UIO_USERSPACE, uap->path, td); + NDINIT(&nd, LOOKUP, FOLLOW | AUDITVNODE1, UIO_USERSPACE, uap->path, + td); error = namei(&nd); if (error == 0) { error = vacl_get_acl(td, nd.ni_vp, uap->type, uap->aclp); @@ -351,7 +366,8 @@ sys___acl_get_link(struct thread *td, st struct nameidata nd; int error; - NDINIT(&nd, LOOKUP, NOFOLLOW, UIO_USERSPACE, uap->path, td); + NDINIT(&nd, LOOKUP, NOFOLLOW | AUDITVNODE1, UIO_USERSPACE, uap->path, + td); error = namei(&nd); if (error == 0) { error = vacl_get_acl(td, nd.ni_vp, uap->type, uap->aclp); @@ -369,7 +385,8 @@ sys___acl_set_file(struct thread *td, st struct nameidata nd; int error; - NDINIT(&nd, LOOKUP, FOLLOW, UIO_USERSPACE, uap->path, td); + NDINIT(&nd, LOOKUP, FOLLOW | AUDITVNODE1, UIO_USERSPACE, uap->path, + td); error = namei(&nd); if (error == 0) { error = vacl_set_acl(td, nd.ni_vp, uap->type, uap->aclp); @@ -387,7 +404,8 @@ sys___acl_set_link(struct thread *td, st struct nameidata nd; int error; - NDINIT(&nd, LOOKUP, NOFOLLOW, UIO_USERSPACE, uap->path, td); + NDINIT(&nd, LOOKUP, NOFOLLOW | AUDITVNODE1, UIO_USERSPACE, uap->path, + td); error = namei(&nd); if (error == 0) { error = vacl_set_acl(td, nd.ni_vp, uap->type, uap->aclp); @@ -406,6 +424,7 @@ sys___acl_get_fd(struct thread *td, stru cap_rights_t rights; int error; + AUDIT_ARG_FD(uap->filedes); error = getvnode(td, uap->filedes, cap_rights_init(&rights, CAP_ACL_GET), &fp); if (error == 0) { @@ -425,6 +444,7 @@ sys___acl_set_fd(struct thread *td, stru cap_rights_t rights; int error; + AUDIT_ARG_FD(uap->filedes); error = getvnode(td, uap->filedes, cap_rights_init(&rights, CAP_ACL_SET), &fp); if (error == 0) { @@ -480,6 +500,7 @@ sys___acl_delete_fd(struct thread *td, s cap_rights_t rights; int error; + AUDIT_ARG_FD(uap->filedes); error = getvnode(td, uap->filedes, cap_rights_init(&rights, CAP_ACL_DELETE), &fp); if (error == 0) { @@ -535,6 +556,7 @@ sys___acl_aclcheck_fd(struct thread *td, cap_rights_t rights; int error; + AUDIT_ARG_FD(uap->filedes); error = getvnode(td, uap->filedes, cap_rights_init(&rights, CAP_ACL_CHECK), &fp); if (error == 0) {
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201703302200.v2UM0wLr091817>