From owner-p4-projects@FreeBSD.ORG Mon Oct 20 19:05:37 2003 Return-Path: Delivered-To: p4-projects@freebsd.org Received: by hub.freebsd.org (Postfix, from userid 32767) id 78A4816A4C0; Mon, 20 Oct 2003 19:05:37 -0700 (PDT) Delivered-To: perforce@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 4094C16A4B3 for ; Mon, 20 Oct 2003 19:05:37 -0700 (PDT) Received: from repoman.freebsd.org (repoman.freebsd.org [216.136.204.115]) by mx1.FreeBSD.org (Postfix) with ESMTP id 0931C43F85 for ; Mon, 20 Oct 2003 19:05:36 -0700 (PDT) (envelope-from bb+lists.freebsd.perforce@cyrus.watson.org) Received: from repoman.freebsd.org (localhost [127.0.0.1]) by repoman.freebsd.org (8.12.9/8.12.9) with ESMTP id h9L25ZXJ014876 for ; Mon, 20 Oct 2003 19:05:35 -0700 (PDT) (envelope-from bb+lists.freebsd.perforce@cyrus.watson.org) Received: (from perforce@localhost) by repoman.freebsd.org (8.12.9/8.12.9/Submit) id h9L25ZXe014873 for perforce@freebsd.org; Mon, 20 Oct 2003 19:05:35 -0700 (PDT) (envelope-from bb+lists.freebsd.perforce@cyrus.watson.org) Date: Mon, 20 Oct 2003 19:05:35 -0700 (PDT) Message-Id: <200310210205.h9L25ZXe014873@repoman.freebsd.org> X-Authentication-Warning: repoman.freebsd.org: perforce set sender to bb+lists.freebsd.perforce@cyrus.watson.org using -f From: Robert Watson To: Perforce Change Reviews Subject: PERFORCE change 40057 for review X-BeenThere: p4-projects@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: p4 projects tree changes List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Oct 2003 02:05:38 -0000 http://perforce.freebsd.org/chv.cgi?CH=40057 Change 40057 by rwatson@rwatson_tislabs on 2003/10/20 19:05:22 Move credential/process/vm-related MAC entry points and infrastructure from kern_mac.c to mac_process.c. Split of functionality also still not perfect: had to export mac_enforce_vm since kern_mac relies on it during credential changes due to system calls. Affected files ... .. //depot/projects/trustedbsd/mac/sys/conf/files#91 edit .. //depot/projects/trustedbsd/mac/sys/kern/kern_mac.c#419 edit .. //depot/projects/trustedbsd/mac/sys/security/mac/mac_internal.h#7 edit .. //depot/projects/trustedbsd/mac/sys/security/mac/mac_process.c#2 edit Differences ... ==== //depot/projects/trustedbsd/mac/sys/conf/files#91 (text+ko) ==== @@ -1592,6 +1592,7 @@ security/mac/mac_net.c optional mac security/mac/mac_pipe.c optional mac security/mac/mac_posix_sem.c optional mac +security/mac/mac_process.c optional mac security/mac/mac_system.c optional mac security/mac/mac_sysv_msg.c optional mac security/mac/mac_sysv_sem.c optional mac ==== //depot/projects/trustedbsd/mac/sys/kern/kern_mac.c#419 (text+ko) ==== @@ -130,46 +130,13 @@ int mac_labelmbufs = 0; #endif -int mac_enforce_process = 1; -SYSCTL_INT(_security_mac, OID_AUTO, enforce_process, CTLFLAG_RW, - &mac_enforce_process, 0, "Enforce MAC policy on inter-process operations"); -TUNABLE_INT("security.mac.enforce_process", &mac_enforce_process); - -static int mac_enforce_vm = 1; -SYSCTL_INT(_security_mac, OID_AUTO, enforce_vm, CTLFLAG_RW, - &mac_enforce_vm, 0, "Enforce MAC policy on vm operations"); -TUNABLE_INT("security.mac.enforce_vm", &mac_enforce_vm); - -static int mac_mmap_revocation = 0; -SYSCTL_INT(_security_mac, OID_AUTO, mmap_revocation, CTLFLAG_RW, - &mac_mmap_revocation, 0, "Revoke mmap access to files on subject " - "relabel"); - -static int mac_mmap_revocation_via_cow = 1; -SYSCTL_INT(_security_mac, OID_AUTO, mmap_revocation_via_cow, CTLFLAG_RW, - &mac_mmap_revocation_via_cow, 0, "Revoke mmap access to files via " - "copy-on-write semantics, or by removing all write access"); - #ifdef MAC_DEBUG SYSCTL_NODE(_security_mac, OID_AUTO, debug, CTLFLAG_RW, 0, "TrustedBSD MAC debug info"); - -static int mac_debug_label_fallback = 0; -SYSCTL_INT(_security_mac_debug, OID_AUTO, label_fallback, CTLFLAG_RW, - &mac_debug_label_fallback, 0, "Filesystems should fall back to fs label" - "when label is corrupted."); -TUNABLE_INT("security.mac.debug_label_fallback", - &mac_debug_label_fallback); - SYSCTL_NODE(_security_mac_debug, OID_AUTO, counters, CTLFLAG_RW, 0, "TrustedBSD MAC object counters"); -static unsigned int nmaccreds, nmactemp, nmacprocs; - -SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, creds, CTLFLAG_RD, - &nmaccreds, 0, "number of ucreds in use"); -SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, procs, CTLFLAG_RD, - &nmacprocs, 0, "number of procs in use"); +static unsigned int nmactemp; SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, temp, CTLFLAG_RD, &nmactemp, 0, "number of temporary labels in use"); #endif @@ -177,9 +144,6 @@ static int mac_policy_register(struct mac_policy_conf *mpc); static int mac_policy_unregister(struct mac_policy_conf *mpc); -static void mac_cred_mmapped_drop_perms_recurse(struct thread *td, - struct ucred *cred, struct vm_map *map); - MALLOC_DEFINE(M_MACTEMP, "mactemp", "MAC temporary label storage"); /* @@ -575,56 +539,6 @@ /* implicit: label->l_flags &= ~MAC_FLAG_INITIALIZED; */ } -static void -mac_init_cred_label(struct label *label) -{ - - mac_init_label(label); - MAC_PERFORM(init_cred_label, label); - MAC_DEBUG_COUNTER_INC(&nmaccreds); -} - -void -mac_init_cred(struct ucred *cred) -{ - - mac_init_cred_label(&cred->cr_label); -} - -void -mac_init_proc(struct proc *p) -{ - - mac_init_label(&p->p_label); - MAC_PERFORM(init_proc_label, &p->p_label); - MAC_DEBUG_COUNTER_INC(&nmacprocs); -} - -static void -mac_destroy_cred_label(struct label *label) -{ - - MAC_PERFORM(destroy_cred_label, label); - mac_destroy_label(label); - MAC_DEBUG_COUNTER_DEC(&nmaccreds); -} - -void -mac_destroy_cred(struct ucred *cred) -{ - - mac_destroy_cred_label(&cred->cr_label); -} - -void -mac_destroy_proc(struct proc *p) -{ - - MAC_PERFORM(destroy_proc_label, &p->p_label); - mac_destroy_label(&p->p_label); - MAC_DEBUG_COUNTER_DEC(&nmacprocs); -} - int mac_check_structmac_consistent(struct mac *mac) { @@ -636,367 +550,6 @@ return (0); } -static int -mac_externalize_cred_label(struct label *label, char *elements, - char *outbuf, size_t outbuflen, int flags) -{ - int error; - - MAC_EXTERNALIZE(cred_label, label, elements, outbuf, outbuflen); - - return (error); -} - -static int -mac_internalize_cred_label(struct label *label, char *string) -{ - int error; - - MAC_INTERNALIZE(cred_label, label, string); - - return (error); -} - -/* - * Initialize MAC label for the first kernel process, from which other - * kernel processes and threads are spawned. - */ -void -mac_create_proc0(struct ucred *cred) -{ - - MAC_PERFORM(create_proc0, cred); -} - -/* - * Initialize MAC label for the first userland process, from which other - * userland processes and threads are spawned. - */ -void -mac_create_proc1(struct ucred *cred) -{ - - MAC_PERFORM(create_proc1, cred); -} - -void -mac_thread_userret(struct thread *td) -{ - - MAC_PERFORM(thread_userret, td); -} - -/* - * When a new process is created, its label must be initialized. Generally, - * this involves inheritence from the parent process, modulo possible - * deltas. This function allows that processing to take place. - */ -void -mac_create_cred(struct ucred *parent_cred, struct ucred *child_cred) -{ - - MAC_PERFORM(create_cred, parent_cred, child_cred); -} - -int -mac_execve_enter(struct image_params *imgp, struct mac *mac_p, - struct label *execlabelstorage) -{ - struct mac mac; - char *buffer; - int error; - - if (mac_p == NULL) - return (0); - - error = copyin(mac_p, &mac, sizeof(mac)); - if (error) - return (error); - - error = mac_check_structmac_consistent(&mac); - if (error) - return (error); - - buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK); - error = copyinstr(mac.m_string, buffer, mac.m_buflen, NULL); - if (error) { - free(buffer, M_MACTEMP); - return (error); - } - - mac_init_cred_label(execlabelstorage); - error = mac_internalize_cred_label(execlabelstorage, buffer); - free(buffer, M_MACTEMP); - if (error) { - mac_destroy_cred_label(execlabelstorage); - return (error); - } - imgp->execlabel = execlabelstorage; - return (0); -} - -void -mac_execve_exit(struct image_params *imgp) -{ - if (imgp->execlabel != NULL) - mac_destroy_cred_label(imgp->execlabel); -} - -/* - * When relabeling a process, call out to the policies for the maximum - * permission allowed for each object type we know about in its - * memory space, and revoke access (in the least surprising ways we - * know) when necessary. The process lock is not held here. - */ -void -mac_cred_mmapped_drop_perms(struct thread *td, struct ucred *cred) -{ - - /* XXX freeze all other threads */ - mac_cred_mmapped_drop_perms_recurse(td, cred, - &td->td_proc->p_vmspace->vm_map); - /* XXX allow other threads to continue */ -} - -static __inline const char * -prot2str(vm_prot_t prot) -{ - - switch (prot & VM_PROT_ALL) { - case VM_PROT_READ: - return ("r--"); - case VM_PROT_READ | VM_PROT_WRITE: - return ("rw-"); - case VM_PROT_READ | VM_PROT_EXECUTE: - return ("r-x"); - case VM_PROT_READ | VM_PROT_WRITE | VM_PROT_EXECUTE: - return ("rwx"); - case VM_PROT_WRITE: - return ("-w-"); - case VM_PROT_EXECUTE: - return ("--x"); - case VM_PROT_WRITE | VM_PROT_EXECUTE: - return ("-wx"); - default: - return ("---"); - } -} - -static void -mac_cred_mmapped_drop_perms_recurse(struct thread *td, struct ucred *cred, - struct vm_map *map) -{ - struct vm_map_entry *vme; - int result; - vm_prot_t revokeperms; - vm_object_t object; - vm_ooffset_t offset; - struct vnode *vp; - - if (!mac_mmap_revocation) - return; - - vm_map_lock_read(map); - for (vme = map->header.next; vme != &map->header; vme = vme->next) { - if (vme->eflags & MAP_ENTRY_IS_SUB_MAP) { - mac_cred_mmapped_drop_perms_recurse(td, cred, - vme->object.sub_map); - continue; - } - /* - * Skip over entries that obviously are not shared. - */ - if (vme->eflags & (MAP_ENTRY_COW | MAP_ENTRY_NOSYNC) || - !vme->max_protection) - continue; - /* - * Drill down to the deepest backing object. - */ - offset = vme->offset; - object = vme->object.vm_object; - if (object == NULL) - continue; - while (object->backing_object != NULL) { - object = object->backing_object; - offset += object->backing_object_offset; - } - /* - * At the moment, vm_maps and objects aren't considered - * by the MAC system, so only things with backing by a - * normal object (read: vnodes) are checked. - */ - if (object->type != OBJT_VNODE) - continue; - vp = (struct vnode *)object->handle; - vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); - result = vme->max_protection; - mac_check_vnode_mmap_downgrade(cred, vp, &result); - VOP_UNLOCK(vp, 0, td); - /* - * Find out what maximum protection we may be allowing - * now but a policy needs to get removed. - */ - revokeperms = vme->max_protection & ~result; - if (!revokeperms) - continue; - printf("pid %ld: revoking %s perms from %#lx:%ld " - "(max %s/cur %s)\n", (long)td->td_proc->p_pid, - prot2str(revokeperms), (u_long)vme->start, - (long)(vme->end - vme->start), - prot2str(vme->max_protection), prot2str(vme->protection)); - vm_map_lock_upgrade(map); - /* - * This is the really simple case: if a map has more - * max_protection than is allowed, but it's not being - * actually used (that is, the current protection is - * still allowed), we can just wipe it out and do - * nothing more. - */ - if ((vme->protection & revokeperms) == 0) { - vme->max_protection -= revokeperms; - } else { - if (revokeperms & VM_PROT_WRITE) { - /* - * In the more complicated case, flush out all - * pending changes to the object then turn it - * copy-on-write. - */ - vm_object_reference(object); - vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); - VM_OBJECT_LOCK(object); - vm_object_page_clean(object, - OFF_TO_IDX(offset), - OFF_TO_IDX(offset + vme->end - vme->start + - PAGE_MASK), - OBJPC_SYNC); - VM_OBJECT_UNLOCK(object); - VOP_UNLOCK(vp, 0, td); - vm_object_deallocate(object); - /* - * Why bother if there's no read permissions - * anymore? For the rest, we need to leave - * the write permissions on for COW, or - * remove them entirely if configured to. - */ - if (!mac_mmap_revocation_via_cow) { - vme->max_protection &= ~VM_PROT_WRITE; - vme->protection &= ~VM_PROT_WRITE; - } if ((revokeperms & VM_PROT_READ) == 0) - vme->eflags |= MAP_ENTRY_COW | - MAP_ENTRY_NEEDS_COPY; - } - if (revokeperms & VM_PROT_EXECUTE) { - vme->max_protection &= ~VM_PROT_EXECUTE; - vme->protection &= ~VM_PROT_EXECUTE; - } - if (revokeperms & VM_PROT_READ) { - vme->max_protection = 0; - vme->protection = 0; - } - pmap_protect(map->pmap, vme->start, vme->end, - vme->protection & ~revokeperms); - vm_map_simplify_entry(map, vme); - } - vm_map_lock_downgrade(map); - } - vm_map_unlock_read(map); -} - -/* - * When the subject's label changes, it may require revocation of privilege - * to mapped objects. This can't be done on-the-fly later with a unified - * buffer cache. - */ -static void -mac_relabel_cred(struct ucred *cred, struct label *newlabel) -{ - - MAC_PERFORM(relabel_cred, cred, newlabel); -} - -static int -mac_check_cred_relabel(struct ucred *cred, struct label *newlabel) -{ - int error; - - MAC_CHECK(check_cred_relabel, cred, newlabel); - - return (error); -} - -int -mac_check_cred_visible(struct ucred *u1, struct ucred *u2) -{ - int error; - - if (!mac_enforce_process) - return (0); - - MAC_CHECK(check_cred_visible, u1, u2); - - return (error); -} - -int -mac_check_proc_debug(struct ucred *cred, struct proc *proc) -{ - int error; - - PROC_LOCK_ASSERT(proc, MA_OWNED); - - if (!mac_enforce_process) - return (0); - - MAC_CHECK(check_proc_debug, cred, proc); - - return (error); -} - -int -mac_check_proc_sched(struct ucred *cred, struct proc *proc) -{ - int error; - - PROC_LOCK_ASSERT(proc, MA_OWNED); - - if (!mac_enforce_process) - return (0); - - MAC_CHECK(check_proc_sched, cred, proc); - - return (error); -} - -int -mac_check_proc_signal(struct ucred *cred, struct proc *proc, int signum) -{ - int error; - - PROC_LOCK_ASSERT(proc, MA_OWNED); - - if (!mac_enforce_process) - return (0); - - MAC_CHECK(check_proc_signal, cred, proc, signum); - - return (error); -} - -int -mac_check_proc_wait(struct ucred *cred, struct proc *proc) -{ - int error; - - PROC_LOCK_ASSERT(proc, MA_OWNED); - - if (!mac_enforce_process) - return (0); - - MAC_CHECK(check_proc_wait, cred, proc); - - return (error); -} - int __mac_get_pid(struct thread *td, struct __mac_get_pid_args *uap) { ==== //depot/projects/trustedbsd/mac/sys/security/mac/mac_internal.h#7 (text+ko) ==== @@ -57,6 +57,7 @@ extern int mac_late; extern int mac_enforce_process; extern int mac_enforce_sysv; +extern int mac_enforce_vm; #ifndef MAC_ALWAYS_LABEL_MBUF extern int mac_labelmbufs; #endif @@ -100,6 +101,15 @@ * the namespaces, etc, should work for these, so for now, sort by * object type. */ +int mac_check_cred_relabel(struct ucred *cred, struct label *newlabel); +void mac_destroy_cred_label(struct label *label); +int mac_externalize_cred_label(struct label *label, char *elements, + char *outbuf, size_t outbuflen, int flags); +void mac_init_cred_label(struct label *label); +int mac_internalize_cred_label(struct label *label, char *string); +void mac_relabel_cred(struct ucred *cred, struct label *newlabel); + + void mac_copy_pipe_label(struct label *src, struct label *dest); void mac_destroy_pipe_label(struct label *label); int mac_externalize_pipe_label(struct label *label, char *elements, ==== //depot/projects/trustedbsd/mac/sys/security/mac/mac_process.c#2 (text+ko) ==== @@ -34,39 +34,26 @@ * SUCH DAMAGE. */ -/* - * Framework for extensible kernel access control. Kernel and userland - * interface to the framework, policy registration and composition. - */ - #include __FBSDID("$FreeBSD: src/sys/kern/kern_mac.c,v 1.99 2003/09/29 18:35:17 rwatson Exp $"); #include "opt_mac.h" -#include "opt_devfs.h" #include #include -#include #include #include #include #include #include #include -#include #include #include #include -#include -#include #include #include #include #include -#include -#include -#include #include #include @@ -76,66 +63,14 @@ #include -#include - -#include -#include -#include - -#include -#include - #include -#ifdef MAC - -/* - * Declare that the kernel provides MAC support, version 1. This permits - * modules to refuse to be loaded if the necessary support isn't present, - * even if it's pre-boot. - */ -MODULE_VERSION(kernel_mac_support, 1); - -SYSCTL_NODE(_security, OID_AUTO, mac, CTLFLAG_RW, 0, - "TrustedBSD MAC policy controls"); - -#if MAC_MAX_SLOTS > 32 -#error "MAC_MAX_SLOTS too large" -#endif - -static unsigned int mac_max_slots = MAC_MAX_SLOTS; -static unsigned int mac_slot_offsets_free = (1 << MAC_MAX_SLOTS) - 1; -SYSCTL_UINT(_security_mac, OID_AUTO, max_slots, CTLFLAG_RD, - &mac_max_slots, 0, ""); - -/* - * Has the kernel started generating labeled objects yet? All read/write - * access to this variable is serialized during the boot process. Following - * the end of serialization, we don't update this flag; no locking. - */ -int mac_late = 0; - -/* - * Flag to indicate whether or not we should allocate label storage for - * new mbufs. Since most dynamic policies we currently work with don't - * rely on mbuf labeling, try to avoid paying the cost of mtag allocation - * unless specifically notified of interest. One result of this is - * that if a dynamically loaded policy requests mbuf labels, it must - * be able to deal with a NULL label being returned on any mbufs that - * were already in flight when the policy was loaded. Since the policy - * already has to deal with uninitialized labels, this probably won't - * be a problem. Note: currently no locking. Will this be a problem? - */ -#ifndef MAC_ALWAYS_LABEL_MBUF -int mac_labelmbufs = 0; -#endif - int mac_enforce_process = 1; SYSCTL_INT(_security_mac, OID_AUTO, enforce_process, CTLFLAG_RW, &mac_enforce_process, 0, "Enforce MAC policy on inter-process operations"); TUNABLE_INT("security.mac.enforce_process", &mac_enforce_process); -static int mac_enforce_vm = 1; +int mac_enforce_vm = 1; SYSCTL_INT(_security_mac, OID_AUTO, enforce_vm, CTLFLAG_RW, &mac_enforce_vm, 0, "Enforce MAC policy on vm operations"); TUNABLE_INT("security.mac.enforce_vm", &mac_enforce_vm); @@ -151,431 +86,17 @@ "copy-on-write semantics, or by removing all write access"); #ifdef MAC_DEBUG -SYSCTL_NODE(_security_mac, OID_AUTO, debug, CTLFLAG_RW, 0, - "TrustedBSD MAC debug info"); - -static int mac_debug_label_fallback = 0; -SYSCTL_INT(_security_mac_debug, OID_AUTO, label_fallback, CTLFLAG_RW, - &mac_debug_label_fallback, 0, "Filesystems should fall back to fs label" - "when label is corrupted."); -TUNABLE_INT("security.mac.debug_label_fallback", - &mac_debug_label_fallback); - -SYSCTL_NODE(_security_mac_debug, OID_AUTO, counters, CTLFLAG_RW, 0, - "TrustedBSD MAC object counters"); - -static unsigned int nmaccreds, nmactemp, nmacprocs; - +static unsigned int nmaccreds, nmacprocs; SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, creds, CTLFLAG_RD, &nmaccreds, 0, "number of ucreds in use"); SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, procs, CTLFLAG_RD, &nmacprocs, 0, "number of procs in use"); -SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, temp, CTLFLAG_RD, - &nmactemp, 0, "number of temporary labels in use"); #endif -static int mac_policy_register(struct mac_policy_conf *mpc); -static int mac_policy_unregister(struct mac_policy_conf *mpc); - static void mac_cred_mmapped_drop_perms_recurse(struct thread *td, struct ucred *cred, struct vm_map *map); -MALLOC_DEFINE(M_MACTEMP, "mactemp", "MAC temporary label storage"); - -/* - * mac_static_policy_list holds a list of policy modules that are not - * loaded while the system is "live", and cannot be unloaded. These - * policies can be invoked without holding the busy count. - * - * mac_policy_list stores the list of dynamic policies. A busy count is - * maintained for the list, stored in mac_policy_busy. The busy count - * is protected by mac_policy_mtx; the list may be modified only - * while the busy count is 0, requiring that the lock be held to - * prevent new references to the list from being acquired. For almost - * all operations, incrementing the busy count is sufficient to - * guarantee consistency, as the list cannot be modified while the - * busy count is elevated. For a few special operations involving a - * change to the list of active policies, the mtx itself must be held. - * A condition variable, mac_policy_cv, is used to signal potential - * exclusive consumers that they should try to acquire the lock if a - * first attempt at exclusive access fails. - */ -#ifndef MAC_STATIC -static struct mtx mac_policy_mtx; -static struct cv mac_policy_cv; -static int mac_policy_count; -#endif -struct mac_policy_list_head mac_policy_list; -struct mac_policy_list_head mac_static_policy_list; - -/* - * We manually invoke WITNESS_WARN() to allow Witness to generate - * warnings even if we don't end up ever triggering the wait at - * run-time. The consumer of the exclusive interface must not hold - * any locks (other than potentially Giant) since we may sleep for - * long (potentially indefinite) periods of time waiting for the - * framework to become quiescent so that a policy list change may - * be made. - */ -void -mac_policy_grab_exclusive(void) -{ - -#ifndef MAC_STATIC - WITNESS_WARN(WARN_GIANTOK | WARN_SLEEPOK, NULL, - "mac_policy_grab_exclusive() at %s:%d", __FILE__, __LINE__); - mtx_lock(&mac_policy_mtx); - while (mac_policy_count != 0) - cv_wait(&mac_policy_cv, &mac_policy_mtx); -#endif -} - -void -mac_policy_assert_exclusive(void) -{ - -#ifndef MAC_STATIC - mtx_assert(&mac_policy_mtx, MA_OWNED); - KASSERT(mac_policy_count == 0, - ("mac_policy_assert_exclusive(): not exclusive")); -#endif -} - -void -mac_policy_release_exclusive(void) -{ - -#ifndef MAC_STATIC - KASSERT(mac_policy_count == 0, - ("mac_policy_release_exclusive(): not exclusive")); - mtx_unlock(&mac_policy_mtx); - cv_signal(&mac_policy_cv); -#endif -} - -void -mac_policy_list_busy(void) -{ - -#ifndef MAC_STATIC - mtx_lock(&mac_policy_mtx); - mac_policy_count++; - mtx_unlock(&mac_policy_mtx); -#endif -} - -int -mac_policy_list_conditional_busy(void) -{ -#ifndef MAC_STATIC - int ret; - - mtx_lock(&mac_policy_mtx); - if (!LIST_EMPTY(&mac_policy_list)) { - mac_policy_count++; - ret = 1; - } else - ret = 0; - mtx_unlock(&mac_policy_mtx); - return (ret); -#else - return (0); -#endif -} - -void -mac_policy_list_unbusy(void) -{ - -#ifndef MAC_STATIC - mtx_lock(&mac_policy_mtx); - mac_policy_count--; - KASSERT(mac_policy_count >= 0, ("MAC_POLICY_LIST_LOCK")); - if (mac_policy_count == 0) - cv_signal(&mac_policy_cv); - mtx_unlock(&mac_policy_mtx); -#endif -} - -/* - * Initialize the MAC subsystem, including appropriate SMP locks. - */ -static void -mac_init(void) -{ - - LIST_INIT(&mac_static_policy_list); - LIST_INIT(&mac_policy_list); - -#ifndef MAC_STATIC - mtx_init(&mac_policy_mtx, "mac_policy_mtx", NULL, MTX_DEF); - cv_init(&mac_policy_cv, "mac_policy_cv"); -#endif -} - -/* - * For the purposes of modules that want to know if they were loaded - * "early", set the mac_late flag once we've processed modules either - * linked into the kernel, or loaded before the kernel startup. - */ -static void -mac_late_init(void) -{ - - mac_late = 1; -} - -/* - * After the policy list has changed, walk the list to update any global - * flags. Currently, we support only one flag, and it's conditionally - * defined; as a result, the entire function is conditional. Eventually, - * the #else case might also iterate across the policies. - */ -static void -mac_policy_updateflags(void) -{ -#ifndef MAC_ALWAYS_LABEL_MBUF - struct mac_policy_conf *tmpc; - int labelmbufs; - - mac_policy_assert_exclusive(); - - labelmbufs = 0; - LIST_FOREACH(tmpc, &mac_static_policy_list, mpc_list) { - if (tmpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_LABELMBUFS) - labelmbufs++; - } - LIST_FOREACH(tmpc, &mac_policy_list, mpc_list) { - if (tmpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_LABELMBUFS) - labelmbufs++; - } - mac_labelmbufs = (labelmbufs != 0); -#endif -} - -/* - * Allow MAC policy modules to register during boot, etc. - */ -int -mac_policy_modevent(module_t mod, int type, void *data) -{ - struct mac_policy_conf *mpc; - int error; - - error = 0; - mpc = (struct mac_policy_conf *) data; - -#ifdef MAC_STATIC - if (mac_late) { - printf("mac_policy_modevent: MAC_STATIC and late\n"); - return (EBUSY); - } -#endif - - switch (type) { - case MOD_LOAD: - if (mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_NOTLATE && - mac_late) { - printf("mac_policy_modevent: can't load %s policy " - "after booting\n", mpc->mpc_name); - error = EBUSY; - break; - } - error = mac_policy_register(mpc); - break; - case MOD_UNLOAD: - /* Don't unregister the module if it was never registered. */ - if ((mpc->mpc_runtime_flags & MPC_RUNTIME_FLAG_REGISTERED) - != 0) - error = mac_policy_unregister(mpc); - else - error = 0; - break; - default: - break; - } - - return (error); -} - -static int -mac_policy_register(struct mac_policy_conf *mpc) -{ - struct mac_policy_conf *tmpc; - int error, slot, static_entry; - - error = 0; - - /* - * We don't technically need exclusive access while !mac_late, - * but hold it for assertion consistency. - */ - mac_policy_grab_exclusive(); - - /* - * If the module can potentially be unloaded, or we're loading - * late, we have to stick it in the non-static list and pay - * an extra performance overhead. Otherwise, we can pay a - * light locking cost and stick it in the static list. - */ - static_entry = (!mac_late && - !(mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_UNLOADOK)); - - if (static_entry) { - LIST_FOREACH(tmpc, &mac_static_policy_list, mpc_list) { - if (strcmp(tmpc->mpc_name, mpc->mpc_name) == 0) { - error = EEXIST; - goto out; - } - } - } else { - LIST_FOREACH(tmpc, &mac_policy_list, mpc_list) { - if (strcmp(tmpc->mpc_name, mpc->mpc_name) == 0) { - error = EEXIST; - goto out; - } - } - } - if (mpc->mpc_field_off != NULL) { - slot = ffs(mac_slot_offsets_free); - if (slot == 0) { - error = ENOMEM; - goto out; - } - slot--; - mac_slot_offsets_free &= ~(1 << slot); - *mpc->mpc_field_off = slot; - } - mpc->mpc_runtime_flags |= MPC_RUNTIME_FLAG_REGISTERED; - - /* - * If we're loading a MAC module after the framework has - * initialized, it has to go into the dynamic list. If - * we're loading it before we've finished initializing, - * it can go into the static list with weaker locker - * requirements. - */ - if (static_entry) - LIST_INSERT_HEAD(&mac_static_policy_list, mpc, mpc_list); - else - LIST_INSERT_HEAD(&mac_policy_list, mpc, mpc_list); - - /* Per-policy initialization. */ - if (mpc->mpc_ops->mpo_init != NULL) - (*(mpc->mpc_ops->mpo_init))(mpc); - mac_policy_updateflags(); - - printf("Security policy loaded: %s (%s)\n", mpc->mpc_fullname, - mpc->mpc_name); - -out: - mac_policy_release_exclusive(); - return (error); -} - -static int -mac_policy_unregister(struct mac_policy_conf *mpc) -{ - - /* - * If we fail the load, we may get a request to unload. Check - * to see if we did the run-time registration, and if not, - * silently succeed. - */ - mac_policy_grab_exclusive(); - if ((mpc->mpc_runtime_flags & MPC_RUNTIME_FLAG_REGISTERED) == 0) { - mac_policy_release_exclusive(); - return (0); - } -#if 0 - /* - * Don't allow unloading modules with private data. - */ - if (mpc->mpc_field_off != NULL) { - MAC_POLICY_LIST_UNLOCK(); - return (EBUSY); - } >>> TRUNCATED FOR MAIL (1000 lines) <<<