From owner-svn-src-head@freebsd.org Thu Mar 30 22:00:59 2017 Return-Path: Delivered-To: svn-src-head@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id B910AD256D7; Thu, 30 Mar 2017 22:00:59 +0000 (UTC) (envelope-from rwatson@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 7B65FD6; Thu, 30 Mar 2017 22:00:59 +0000 (UTC) (envelope-from rwatson@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id v2UM0wpT091818; Thu, 30 Mar 2017 22:00:58 GMT (envelope-from rwatson@FreeBSD.org) Received: (from rwatson@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id v2UM0wLr091817; Thu, 30 Mar 2017 22:00:58 GMT (envelope-from rwatson@FreeBSD.org) Message-Id: <201703302200.v2UM0wLr091817@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: rwatson set sender to rwatson@FreeBSD.org using -f From: Robert Watson Date: Thu, 30 Mar 2017 22:00:58 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r316307 - head/sys/kern X-SVN-Group: head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-head@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: SVN commit messages for the src tree for head/-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 30 Mar 2017 22:00:59 -0000 Author: rwatson Date: Thu Mar 30 22:00:58 2017 New Revision: 316307 URL: https://svnweb.freebsd.org/changeset/base/316307 Log: Add system-call argument auditing for ACL-related system calls. Obtained from: TrustedBSD Project MFC after: 3 weeks Sponsored by: DARPA, AFRL Modified: head/sys/kern/vfs_acl.c Modified: head/sys/kern/vfs_acl.c ============================================================================== --- head/sys/kern/vfs_acl.c Thu Mar 30 21:54:57 2017 (r316306) +++ head/sys/kern/vfs_acl.c Thu Mar 30 22:00:58 2017 (r316307) @@ -1,9 +1,14 @@ /*- - * Copyright (c) 1999-2006 Robert N. M. Watson + * Copyright (c) 1999-2006, 2016-2017 Robert N. M. Watson * All rights reserved. * * This software was developed by Robert Watson for the TrustedBSD Project. * + * Portions of this software were developed by BAE Systems, the University of + * Cambridge Computer Laboratory, and Memorial University under DARPA/AFRL + * contract FA8650-15-C-7558 ("CADETS"), as part of the DARPA Transparent + * Computing (TC) research program. + * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: @@ -53,6 +58,7 @@ __FBSDID("$FreeBSD$"); #include #include +#include #include CTASSERT(ACL_MAX_ENTRIES >= OLDACL_MAX_ENTRIES); @@ -216,6 +222,7 @@ vacl_set_acl(struct thread *td, struct v struct mount *mp; int error; + AUDIT_ARG_VALUE(type); inkernelacl = acl_alloc(M_WAITOK); error = acl_copyin(aclp, inkernelacl, type); if (error != 0) @@ -224,6 +231,7 @@ vacl_set_acl(struct thread *td, struct v if (error != 0) goto out; vn_lock(vp, LK_EXCLUSIVE | LK_RETRY); + AUDIT_ARG_VNODE1(vp); #ifdef MAC error = mac_vnode_check_setacl(td->td_ucred, vp, type, inkernelacl); if (error != 0) @@ -251,8 +259,10 @@ vacl_get_acl(struct thread *td, struct v struct acl *inkernelacl; int error; + AUDIT_ARG_VALUE(type); inkernelacl = acl_alloc(M_WAITOK | M_ZERO); vn_lock(vp, LK_EXCLUSIVE | LK_RETRY); + AUDIT_ARG_VNODE1(vp); #ifdef MAC error = mac_vnode_check_getacl(td->td_ucred, vp, type); if (error != 0) @@ -280,10 +290,12 @@ vacl_delete(struct thread *td, struct vn struct mount *mp; int error; + AUDIT_ARG_VALUE(type); error = vn_start_write(vp, &mp, V_WAIT | PCATCH); if (error != 0) return (error); vn_lock(vp, LK_EXCLUSIVE | LK_RETRY); + AUDIT_ARG_VNODE1(vp); #ifdef MAC error = mac_vnode_check_deleteacl(td->td_ucred, vp, type); if (error != 0) @@ -300,6 +312,8 @@ out: /* * Given a vnode, check whether an ACL is appropriate for it + * + * XXXRW: No vnode lock held so can't audit vnode state...? */ static int vacl_aclcheck(struct thread *td, struct vnode *vp, acl_type_t type, @@ -333,7 +347,8 @@ sys___acl_get_file(struct thread *td, st struct nameidata nd; int error; - NDINIT(&nd, LOOKUP, FOLLOW, UIO_USERSPACE, uap->path, td); + NDINIT(&nd, LOOKUP, FOLLOW | AUDITVNODE1, UIO_USERSPACE, uap->path, + td); error = namei(&nd); if (error == 0) { error = vacl_get_acl(td, nd.ni_vp, uap->type, uap->aclp); @@ -351,7 +366,8 @@ sys___acl_get_link(struct thread *td, st struct nameidata nd; int error; - NDINIT(&nd, LOOKUP, NOFOLLOW, UIO_USERSPACE, uap->path, td); + NDINIT(&nd, LOOKUP, NOFOLLOW | AUDITVNODE1, UIO_USERSPACE, uap->path, + td); error = namei(&nd); if (error == 0) { error = vacl_get_acl(td, nd.ni_vp, uap->type, uap->aclp); @@ -369,7 +385,8 @@ sys___acl_set_file(struct thread *td, st struct nameidata nd; int error; - NDINIT(&nd, LOOKUP, FOLLOW, UIO_USERSPACE, uap->path, td); + NDINIT(&nd, LOOKUP, FOLLOW | AUDITVNODE1, UIO_USERSPACE, uap->path, + td); error = namei(&nd); if (error == 0) { error = vacl_set_acl(td, nd.ni_vp, uap->type, uap->aclp); @@ -387,7 +404,8 @@ sys___acl_set_link(struct thread *td, st struct nameidata nd; int error; - NDINIT(&nd, LOOKUP, NOFOLLOW, UIO_USERSPACE, uap->path, td); + NDINIT(&nd, LOOKUP, NOFOLLOW | AUDITVNODE1, UIO_USERSPACE, uap->path, + td); error = namei(&nd); if (error == 0) { error = vacl_set_acl(td, nd.ni_vp, uap->type, uap->aclp); @@ -406,6 +424,7 @@ sys___acl_get_fd(struct thread *td, stru cap_rights_t rights; int error; + AUDIT_ARG_FD(uap->filedes); error = getvnode(td, uap->filedes, cap_rights_init(&rights, CAP_ACL_GET), &fp); if (error == 0) { @@ -425,6 +444,7 @@ sys___acl_set_fd(struct thread *td, stru cap_rights_t rights; int error; + AUDIT_ARG_FD(uap->filedes); error = getvnode(td, uap->filedes, cap_rights_init(&rights, CAP_ACL_SET), &fp); if (error == 0) { @@ -480,6 +500,7 @@ sys___acl_delete_fd(struct thread *td, s cap_rights_t rights; int error; + AUDIT_ARG_FD(uap->filedes); error = getvnode(td, uap->filedes, cap_rights_init(&rights, CAP_ACL_DELETE), &fp); if (error == 0) { @@ -535,6 +556,7 @@ sys___acl_aclcheck_fd(struct thread *td, cap_rights_t rights; int error; + AUDIT_ARG_FD(uap->filedes); error = getvnode(td, uap->filedes, cap_rights_init(&rights, CAP_ACL_CHECK), &fp); if (error == 0) {