mirror/freebsd
1
0
Fork 0
mirror of https://git.FreeBSD.org/src.git synced 2025-01-03 12:35:02 +00:00
Code Issues Releases Activity

Implement sockets support for __mac_get_fd() and __mac_set_fd()

Browse Source 
system calls, and prefer these calls over getsockopt()/setsockopt()
for ABI reasons.  When addressing UNIX domain sockets, these calls
retrieve and modify the socket label, not the label of the
rendezvous vnode.

- Create mac_copy_socket_label() entry point based on
  mac_copy_pipe_label() entry point, intended to copy the socket
  label into temporary storage that doesn't require a socket lock
  to be held (currently Giant).

- Implement mac_copy_socket_label() for various policies.

- Expose socket label allocation, free, internalize, externalize
  entry points as non-static from mac_net.c.

- Use mac_socket_label_set() in __mac_set_fd().

MAC-aware applications may now use mac_get_fd(), mac_set_fd(), and
mac_get_peer() to retrieve and set various socket labels without
directly invoking the getsockopt() interface.

Obtained from:	TrustedBSD Project
Sponsored by:	DARPA, Network Associates Laboratories
This commit is contained in:
Robert Watson 2003-11-16 23:31:45 +00:00
parent b9c29fa9ae
commit b0323ea3aa
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=122820
12 changed files with 124 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
sys/kern/kern_mac.c
View File

@ -701,6 +701,7 @@ __mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap)
struct mac mac;
struct vnode *vp;
struct pipe *pipe;
struct socket *so;
short label_type;
int error;
@ -751,6 +752,19 @@ __mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap)
mac_pipe_label_free(intlabel);
break;
case DTYPE_SOCKET:
so = fp->f_data;
intlabel = mac_socket_label_alloc(M_WAITOK);
mtx_lock(&Giant); /* Sockets */
/* XXX: Socket lock here. */
mac_copy_socket_label(so->so_label, intlabel);
/* XXX: Socket unlock here. */
mtx_unlock(&Giant); /* Sockets */
error = mac_externalize_socket_label(intlabel, elements,
buffer, mac.m_buflen);
mac_socket_label_free(intlabel);
break;
default:
error = EINVAL;
}
@ -881,6 +895,7 @@ __mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap)
{
struct label *intlabel;
struct pipe *pipe;
struct socket *so;
struct file *fp;
struct mount *mp;
struct vnode *vp;
@ -945,6 +960,21 @@ __mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap)
mac_pipe_label_free(intlabel);
break;
case DTYPE_SOCKET:
intlabel = mac_socket_label_alloc(M_WAITOK);
error = mac_internalize_socket_label(intlabel, buffer);
if (error == 0) {
so = fp->f_data;
mtx_lock(&Giant); /* Sockets */
/* XXX: Socket lock here. */
error = mac_socket_label_set(td->td_ucred, so,
intlabel);
/* XXX: Socket unlock here. */
mtx_unlock(&Giant); /* Sockets */
}
mac_socket_label_free(intlabel);
break;
default:
error = EINVAL;
}

30
sys/security/mac/mac_framework.c
View File

@ -701,6 +701,7 @@ __mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap)
struct mac mac;
struct vnode *vp;
struct pipe *pipe;
struct socket *so;
short label_type;
int error;
@ -751,6 +752,19 @@ __mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap)
mac_pipe_label_free(intlabel);
break;
case DTYPE_SOCKET:
so = fp->f_data;
intlabel = mac_socket_label_alloc(M_WAITOK);
mtx_lock(&Giant); /* Sockets */
/* XXX: Socket lock here. */
mac_copy_socket_label(so->so_label, intlabel);
/* XXX: Socket unlock here. */
mtx_unlock(&Giant); /* Sockets */
error = mac_externalize_socket_label(intlabel, elements,
buffer, mac.m_buflen);
mac_socket_label_free(intlabel);
break;
default:
error = EINVAL;
}
@ -881,6 +895,7 @@ __mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap)
{
struct label *intlabel;
struct pipe *pipe;
struct socket *so;
struct file *fp;
struct mount *mp;
struct vnode *vp;
@ -945,6 +960,21 @@ __mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap)
mac_pipe_label_free(intlabel);
break;
case DTYPE_SOCKET:
intlabel = mac_socket_label_alloc(M_WAITOK);
error = mac_internalize_socket_label(intlabel, buffer);
if (error == 0) {
so = fp->f_data;
mtx_lock(&Giant); /* Sockets */
/* XXX: Socket lock here. */
error = mac_socket_label_set(td->td_ucred, so,
intlabel);
/* XXX: Socket unlock here. */
mtx_unlock(&Giant); /* Sockets */
}
mac_socket_label_free(intlabel);
break;
default:
error = EINVAL;
}

6
sys/security/mac/mac_internal.h
View File

@ -109,6 +109,8 @@ int mac_allocate_slot(void);
*/
struct label *mac_pipe_label_alloc(void);
void mac_pipe_label_free(struct label *label);
struct label *mac_socket_label_alloc(int flag);
void mac_socket_label_free(struct label *label);
int mac_check_cred_relabel(struct ucred *cred, struct label *newlabel);
int mac_externalize_cred_label(struct label *label, char *elements,
@ -123,6 +125,10 @@ int mac_internalize_pipe_label(struct label *label, char *string);
int mac_socket_label_set(struct ucred *cred, struct socket *so,
struct label *label);
void mac_copy_socket_label(struct label *src, struct label *dest);
int mac_externalize_socket_label(struct label *label, char *elements,
char *outbuf, size_t outbuflen);
int mac_internalize_socket_label(struct label *label, char *string);
int mac_externalize_vnode_label(struct label *label, char *elements,
char *outbuf, size_t outbuflen);

18
sys/security/mac/mac_net.c
View File

@ -91,9 +91,6 @@ SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, sockets, CTLFLAG_RD,
&nmacsockets, 0, "number of sockets in use");
#endif
static void mac_socket_label_free(struct label *label);
static struct label *
mbuf_to_label(struct mbuf *mbuf)
{
@ -220,7 +217,7 @@ mac_init_mbuf(struct mbuf *m, int flag)
return (0);
}
static struct label *
struct label *
mac_socket_label_alloc(int flag)
{
struct label *label;
@ -339,7 +336,7 @@ mac_destroy_mbuf_tag(struct m_tag *tag)
MAC_DEBUG_COUNTER_DEC(&nmacmbufs);
}
static void
void
mac_socket_label_free(struct label *label)
{
@ -382,6 +379,13 @@ mac_copy_mbuf_tag(struct m_tag *src, struct m_tag *dest)
MAC_PERFORM(copy_mbuf_label, src_label, dest_label);
}
void
mac_copy_socket_label(struct label *src, struct label *dest)
{
MAC_PERFORM(copy_socket_label, src, dest);
}
static int
mac_externalize_ifnet_label(struct label *label, char *elements,
char *outbuf, size_t outbuflen)
@ -393,7 +397,7 @@ mac_externalize_ifnet_label(struct label *label, char *elements,
return (error);
}
static int
int
mac_externalize_socket_label(struct label *label, char *elements,
char *outbuf, size_t outbuflen)
{
@ -425,7 +429,7 @@ mac_internalize_ifnet_label(struct label *label, char *string)
return (error);
}
static int
int
mac_internalize_socket_label(struct label *label, char *string)
{
int error;

2
sys/security/mac/mac_policy.h
View File

@ -112,6 +112,8 @@ struct mac_policy_ops {
struct label *dest);
void (*mpo_copy_pipe_label)(struct label *src,
struct label *dest);
void (*mpo_copy_socket_label)(struct label *src,
struct label *dest);
void (*mpo_copy_vnode_label)(struct label *src,
struct label *dest);
int (*mpo_externalize_cred_label)(struct label *label,

30
sys/security/mac/mac_syscalls.c
View File

@ -701,6 +701,7 @@ __mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap)
struct mac mac;
struct vnode *vp;
struct pipe *pipe;
struct socket *so;
short label_type;
int error;
@ -751,6 +752,19 @@ __mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap)
mac_pipe_label_free(intlabel);
break;
case DTYPE_SOCKET:
so = fp->f_data;
intlabel = mac_socket_label_alloc(M_WAITOK);
mtx_lock(&Giant); /* Sockets */
/* XXX: Socket lock here. */
mac_copy_socket_label(so->so_label, intlabel);
/* XXX: Socket unlock here. */
mtx_unlock(&Giant); /* Sockets */
error = mac_externalize_socket_label(intlabel, elements,
buffer, mac.m_buflen);
mac_socket_label_free(intlabel);
break;
default:
error = EINVAL;
}
@ -881,6 +895,7 @@ __mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap)
{
struct label *intlabel;
struct pipe *pipe;
struct socket *so;
struct file *fp;
struct mount *mp;
struct vnode *vp;
@ -945,6 +960,21 @@ __mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap)
mac_pipe_label_free(intlabel);
break;
case DTYPE_SOCKET:
intlabel = mac_socket_label_alloc(M_WAITOK);
error = mac_internalize_socket_label(intlabel, buffer);
if (error == 0) {
so = fp->f_data;
mtx_lock(&Giant); /* Sockets */
/* XXX: Socket lock here. */
error = mac_socket_label_set(td->td_ucred, so,
intlabel);
/* XXX: Socket unlock here. */
mtx_unlock(&Giant); /* Sockets */
}
mac_socket_label_free(intlabel);
break;
default:
error = EINVAL;
}

1
sys/security/mac_biba/mac_biba.c
View File

@ -2635,6 +2635,7 @@ static struct mac_policy_ops mac_biba_ops =
.mpo_destroy_vnode_label = mac_biba_destroy_label,
.mpo_copy_mbuf_label = mac_biba_copy_label,
.mpo_copy_pipe_label = mac_biba_copy_label,
.mpo_copy_socket_label = mac_biba_copy_label,
.mpo_copy_vnode_label = mac_biba_copy_label,
.mpo_externalize_cred_label = mac_biba_externalize_label,
.mpo_externalize_ifnet_label = mac_biba_externalize_label,

1
sys/security/mac_lomac/mac_lomac.c
View File

@ -2615,6 +2615,7 @@ static struct mac_policy_ops mac_lomac_ops =
.mpo_destroy_vnode_label = mac_lomac_destroy_label,
.mpo_copy_mbuf_label = mac_lomac_copy_label,
.mpo_copy_pipe_label = mac_lomac_copy_label,
.mpo_copy_socket_label = mac_lomac_copy_label,
.mpo_copy_vnode_label = mac_lomac_copy_label,
.mpo_externalize_cred_label = mac_lomac_externalize_label,
.mpo_externalize_ifnet_label = mac_lomac_externalize_label,

1
sys/security/mac_mls/mac_mls.c
View File

@ -2407,6 +2407,7 @@ static struct mac_policy_ops mac_mls_ops =
.mpo_destroy_vnode_label = mac_mls_destroy_label,
.mpo_copy_mbuf_label = mac_mls_copy_label,
.mpo_copy_pipe_label = mac_mls_copy_label,
.mpo_copy_socket_label = mac_mls_copy_label,
.mpo_copy_vnode_label = mac_mls_copy_label,
.mpo_externalize_cred_label = mac_mls_externalize_label,
.mpo_externalize_ifnet_label = mac_mls_externalize_label,

1
sys/security/mac_stub/mac_stub.c
View File

@ -1032,6 +1032,7 @@ static struct mac_policy_ops mac_stub_ops =
.mpo_destroy_vnode_label = stub_destroy_label,
.mpo_copy_mbuf_label = stub_copy_label,
.mpo_copy_pipe_label = stub_copy_label,
.mpo_copy_socket_label = stub_copy_label,
.mpo_copy_vnode_label = stub_copy_label,
.mpo_externalize_cred_label = stub_externalize_label,
.mpo_externalize_ifnet_label = stub_externalize_label,

9
sys/security/mac_test/mac_test.c
View File

@ -569,6 +569,14 @@ mac_test_copy_pipe_label(struct label *src, struct label *dest)
ASSERT_PIPE_LABEL(dest);
}
static void
mac_test_copy_socket_label(struct label *src, struct label *dest)
{
ASSERT_SOCKET_LABEL(src);
ASSERT_SOCKET_LABEL(dest);
}
static void
mac_test_copy_vnode_label(struct label *src, struct label *dest)
{
@ -1805,6 +1813,7 @@ static struct mac_policy_ops mac_test_ops =
.mpo_destroy_vnode_label = mac_test_destroy_vnode_label,
.mpo_copy_mbuf_label = mac_test_copy_mbuf_label,
.mpo_copy_pipe_label = mac_test_copy_pipe_label,
.mpo_copy_socket_label = mac_test_copy_socket_label,
.mpo_copy_vnode_label = mac_test_copy_vnode_label,
.mpo_externalize_cred_label = mac_test_externalize_label,
.mpo_externalize_ifnet_label = mac_test_externalize_label,

2
sys/sys/mac_policy.h
View File

@ -112,6 +112,8 @@ struct mac_policy_ops {
struct label *dest);
void (*mpo_copy_pipe_label)(struct label *src,
struct label *dest);
void (*mpo_copy_socket_label)(struct label *src,
struct label *dest);
void (*mpo_copy_vnode_label)(struct label *src,
struct label *dest);
int (*mpo_externalize_cred_label)(struct label *label,