secmodel_extensions.c revision 1.3.2.2
1 1.3.2.2 yamt /* $NetBSD: secmodel_extensions.c,v 1.3.2.2 2012/04/17 00:08:50 yamt Exp $ */ 2 1.3.2.2 yamt /*- 3 1.3.2.2 yamt * Copyright (c) 2011 Elad Efrat <elad (at) NetBSD.org> 4 1.3.2.2 yamt * All rights reserved. 5 1.3.2.2 yamt * 6 1.3.2.2 yamt * Redistribution and use in source and binary forms, with or without 7 1.3.2.2 yamt * modification, are permitted provided that the following conditions 8 1.3.2.2 yamt * are met: 9 1.3.2.2 yamt * 1. Redistributions of source code must retain the above copyright 10 1.3.2.2 yamt * notice, this list of conditions and the following disclaimer. 11 1.3.2.2 yamt * 2. Redistributions in binary form must reproduce the above copyright 12 1.3.2.2 yamt * notice, this list of conditions and the following disclaimer in the 13 1.3.2.2 yamt * documentation and/or other materials provided with the distribution. 14 1.3.2.2 yamt * 3. The name of the author may not be used to endorse or promote products 15 1.3.2.2 yamt * derived from this software without specific prior written permission. 16 1.3.2.2 yamt * 17 1.3.2.2 yamt * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 18 1.3.2.2 yamt * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 19 1.3.2.2 yamt * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 20 1.3.2.2 yamt * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 21 1.3.2.2 yamt * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 22 1.3.2.2 yamt * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 23 1.3.2.2 yamt * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 24 1.3.2.2 yamt * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 25 1.3.2.2 yamt * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 26 1.3.2.2 yamt * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 27 1.3.2.2 yamt */ 28 1.3.2.2 yamt 29 1.3.2.2 yamt #include <sys/cdefs.h> 30 1.3.2.2 yamt __KERNEL_RCSID(0, "$NetBSD: secmodel_extensions.c,v 1.3.2.2 2012/04/17 00:08:50 yamt Exp $"); 31 1.3.2.2 yamt 32 1.3.2.2 yamt #include <sys/types.h> 33 1.3.2.2 yamt #include <sys/param.h> 34 1.3.2.2 yamt #include <sys/kauth.h> 35 1.3.2.2 yamt 36 1.3.2.2 yamt #include <sys/mount.h> 37 1.3.2.2 yamt #include <sys/vnode.h> 38 1.3.2.2 yamt #include <sys/socketvar.h> 39 1.3.2.2 yamt #include <sys/sysctl.h> 40 1.3.2.2 yamt #include <sys/proc.h> 41 1.3.2.2 yamt #include <sys/module.h> 42 1.3.2.2 yamt 43 1.3.2.2 yamt #include <secmodel/secmodel.h> 44 1.3.2.2 yamt #include <secmodel/extensions/extensions.h> 45 1.3.2.2 yamt 46 1.3.2.2 yamt MODULE(MODULE_CLASS_SECMODEL, extensions, NULL); 47 1.3.2.2 yamt 48 1.3.2.2 yamt static int dovfsusermount; 49 1.3.2.2 yamt static int curtain; 50 1.3.2.2 yamt static int user_set_cpu_affinity; 51 1.3.2.2 yamt 52 1.3.2.2 yamt static kauth_listener_t l_system, l_process, l_network; 53 1.3.2.2 yamt 54 1.3.2.2 yamt static secmodel_t extensions_sm; 55 1.3.2.2 yamt static struct sysctllog *extensions_sysctl_log; 56 1.3.2.2 yamt 57 1.3.2.2 yamt static void secmodel_extensions_init(void); 58 1.3.2.2 yamt static void secmodel_extensions_start(void); 59 1.3.2.2 yamt static void secmodel_extensions_stop(void); 60 1.3.2.2 yamt 61 1.3.2.2 yamt static void sysctl_security_extensions_setup(struct sysctllog **); 62 1.3.2.2 yamt static int sysctl_extensions_user_handler(SYSCTLFN_PROTO); 63 1.3.2.2 yamt static int sysctl_extensions_curtain_handler(SYSCTLFN_PROTO); 64 1.3.2.2 yamt static bool is_securelevel_above(int); 65 1.3.2.2 yamt 66 1.3.2.2 yamt static int secmodel_extensions_system_cb(kauth_cred_t, kauth_action_t, 67 1.3.2.2 yamt void *, void *, void *, void *, void *); 68 1.3.2.2 yamt static int secmodel_extensions_process_cb(kauth_cred_t, kauth_action_t, 69 1.3.2.2 yamt void *, void *, void *, void *, void *); 70 1.3.2.2 yamt static int secmodel_extensions_network_cb(kauth_cred_t, kauth_action_t, 71 1.3.2.2 yamt void *, void *, void *, void *, void *); 72 1.3.2.2 yamt 73 1.3.2.2 yamt static void 74 1.3.2.2 yamt sysctl_security_extensions_setup(struct sysctllog **clog) 75 1.3.2.2 yamt { 76 1.3.2.2 yamt const struct sysctlnode *rnode; 77 1.3.2.2 yamt 78 1.3.2.2 yamt sysctl_createv(clog, 0, NULL, &rnode, 79 1.3.2.2 yamt CTLFLAG_PERMANENT, 80 1.3.2.2 yamt CTLTYPE_NODE, "security", NULL, 81 1.3.2.2 yamt NULL, 0, NULL, 0, 82 1.3.2.2 yamt CTL_SECURITY, CTL_EOL); 83 1.3.2.2 yamt 84 1.3.2.2 yamt sysctl_createv(clog, 0, &rnode, &rnode, 85 1.3.2.2 yamt CTLFLAG_PERMANENT, 86 1.3.2.2 yamt CTLTYPE_NODE, "models", NULL, 87 1.3.2.2 yamt NULL, 0, NULL, 0, 88 1.3.2.2 yamt CTL_CREATE, CTL_EOL); 89 1.3.2.2 yamt 90 1.3.2.2 yamt sysctl_createv(clog, 0, &rnode, &rnode, 91 1.3.2.2 yamt CTLFLAG_PERMANENT, 92 1.3.2.2 yamt CTLTYPE_NODE, "extensions", NULL, 93 1.3.2.2 yamt NULL, 0, NULL, 0, 94 1.3.2.2 yamt CTL_CREATE, CTL_EOL); 95 1.3.2.2 yamt 96 1.3.2.2 yamt sysctl_createv(clog, 0, &rnode, NULL, 97 1.3.2.2 yamt CTLFLAG_PERMANENT, 98 1.3.2.2 yamt CTLTYPE_STRING, "name", NULL, 99 1.3.2.2 yamt NULL, 0, __UNCONST(SECMODEL_EXTENSIONS_NAME), 0, 100 1.3.2.2 yamt CTL_CREATE, CTL_EOL); 101 1.3.2.2 yamt 102 1.3.2.2 yamt sysctl_createv(clog, 0, &rnode, NULL, 103 1.3.2.2 yamt CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 104 1.3.2.2 yamt CTLTYPE_INT, "usermount", 105 1.3.2.2 yamt SYSCTL_DESCR("Whether unprivileged users may mount " 106 1.3.2.2 yamt "filesystems"), 107 1.3.2.2 yamt sysctl_extensions_user_handler, 0, &dovfsusermount, 0, 108 1.3.2.2 yamt CTL_CREATE, CTL_EOL); 109 1.3.2.2 yamt 110 1.3.2.2 yamt sysctl_createv(clog, 0, &rnode, NULL, 111 1.3.2.2 yamt CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 112 1.3.2.2 yamt CTLTYPE_INT, "curtain", 113 1.3.2.2 yamt SYSCTL_DESCR("Curtain information about objects to "\ 114 1.3.2.2 yamt "users not owning them."), 115 1.3.2.2 yamt sysctl_extensions_curtain_handler, 0, &curtain, 0, 116 1.3.2.2 yamt CTL_CREATE, CTL_EOL); 117 1.3.2.2 yamt 118 1.3.2.2 yamt sysctl_createv(clog, 0, &rnode, NULL, 119 1.3.2.2 yamt CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 120 1.3.2.2 yamt CTLTYPE_INT, "user_set_cpu_affinity", 121 1.3.2.2 yamt SYSCTL_DESCR("Whether unprivileged users may control "\ 122 1.3.2.2 yamt "CPU affinity."), 123 1.3.2.2 yamt sysctl_extensions_user_handler, 0, 124 1.3.2.2 yamt &user_set_cpu_affinity, 0, 125 1.3.2.2 yamt CTL_CREATE, CTL_EOL); 126 1.3.2.2 yamt 127 1.3.2.2 yamt /* Compatibility: vfs.generic.usermount */ 128 1.3.2.2 yamt sysctl_createv(clog, 0, NULL, NULL, 129 1.3.2.2 yamt CTLFLAG_PERMANENT, 130 1.3.2.2 yamt CTLTYPE_NODE, "vfs", NULL, 131 1.3.2.2 yamt NULL, 0, NULL, 0, 132 1.3.2.2 yamt CTL_VFS, CTL_EOL); 133 1.3.2.2 yamt 134 1.3.2.2 yamt sysctl_createv(clog, 0, NULL, NULL, 135 1.3.2.2 yamt CTLFLAG_PERMANENT, 136 1.3.2.2 yamt CTLTYPE_NODE, "generic", 137 1.3.2.2 yamt SYSCTL_DESCR("Non-specific vfs related information"), 138 1.3.2.2 yamt NULL, 0, NULL, 0, 139 1.3.2.2 yamt CTL_VFS, VFS_GENERIC, CTL_EOL); 140 1.3.2.2 yamt 141 1.3.2.2 yamt sysctl_createv(clog, 0, NULL, NULL, 142 1.3.2.2 yamt CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 143 1.3.2.2 yamt CTLTYPE_INT, "usermount", 144 1.3.2.2 yamt SYSCTL_DESCR("Whether unprivileged users may mount " 145 1.3.2.2 yamt "filesystems"), 146 1.3.2.2 yamt sysctl_extensions_user_handler, 0, &dovfsusermount, 0, 147 1.3.2.2 yamt CTL_VFS, VFS_GENERIC, VFS_USERMOUNT, CTL_EOL); 148 1.3.2.2 yamt 149 1.3.2.2 yamt /* Compatibility: security.curtain */ 150 1.3.2.2 yamt sysctl_createv(clog, 0, NULL, &rnode, 151 1.3.2.2 yamt CTLFLAG_PERMANENT, 152 1.3.2.2 yamt CTLTYPE_NODE, "security", NULL, 153 1.3.2.2 yamt NULL, 0, NULL, 0, 154 1.3.2.2 yamt CTL_SECURITY, CTL_EOL); 155 1.3.2.2 yamt 156 1.3.2.2 yamt sysctl_createv(clog, 0, &rnode, NULL, 157 1.3.2.2 yamt CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 158 1.3.2.2 yamt CTLTYPE_INT, "curtain", 159 1.3.2.2 yamt SYSCTL_DESCR("Curtain information about objects to "\ 160 1.3.2.2 yamt "users not owning them."), 161 1.3.2.2 yamt sysctl_extensions_curtain_handler, 0, &curtain, 0, 162 1.3.2.2 yamt CTL_CREATE, CTL_EOL); 163 1.3.2.2 yamt } 164 1.3.2.2 yamt 165 1.3.2.2 yamt static int 166 1.3.2.2 yamt sysctl_extensions_curtain_handler(SYSCTLFN_ARGS) 167 1.3.2.2 yamt { 168 1.3.2.2 yamt struct sysctlnode node; 169 1.3.2.2 yamt int val, error; 170 1.3.2.2 yamt 171 1.3.2.2 yamt val = *(int *)rnode->sysctl_data; 172 1.3.2.2 yamt 173 1.3.2.2 yamt node = *rnode; 174 1.3.2.2 yamt node.sysctl_data = &val; 175 1.3.2.2 yamt 176 1.3.2.2 yamt error = sysctl_lookup(SYSCTLFN_CALL(&node)); 177 1.3.2.2 yamt if (error || newp == NULL) 178 1.3.2.2 yamt return error; 179 1.3.2.2 yamt 180 1.3.2.2 yamt /* shortcut */ 181 1.3.2.2 yamt if (val == *(int *)rnode->sysctl_data) 182 1.3.2.2 yamt return 0; 183 1.3.2.2 yamt 184 1.3.2.2 yamt /* curtain cannot be disabled when securelevel is above 0 */ 185 1.3.2.2 yamt if (val == 0 && is_securelevel_above(0)) { 186 1.3.2.2 yamt return EPERM; 187 1.3.2.2 yamt } 188 1.3.2.2 yamt 189 1.3.2.2 yamt *(int *)rnode->sysctl_data = val; 190 1.3.2.2 yamt return 0; 191 1.3.2.2 yamt } 192 1.3.2.2 yamt 193 1.3.2.2 yamt /* 194 1.3.2.2 yamt * Generic sysctl extensions handler for user mount and set CPU affinity 195 1.3.2.2 yamt * rights. Checks the following conditions: 196 1.3.2.2 yamt * - setting value to 0 is always permitted (decrease user rights) 197 1.3.2.2 yamt * - setting value != 0 is not permitted when securelevel is above 0 (increase 198 1.3.2.2 yamt * user rights). 199 1.3.2.2 yamt */ 200 1.3.2.2 yamt static int 201 1.3.2.2 yamt sysctl_extensions_user_handler(SYSCTLFN_ARGS) 202 1.3.2.2 yamt { 203 1.3.2.2 yamt struct sysctlnode node; 204 1.3.2.2 yamt int val, error; 205 1.3.2.2 yamt 206 1.3.2.2 yamt val = *(int *)rnode->sysctl_data; 207 1.3.2.2 yamt 208 1.3.2.2 yamt node = *rnode; 209 1.3.2.2 yamt node.sysctl_data = &val; 210 1.3.2.2 yamt 211 1.3.2.2 yamt error = sysctl_lookup(SYSCTLFN_CALL(&node)); 212 1.3.2.2 yamt if (error || newp == NULL) 213 1.3.2.2 yamt return error; 214 1.3.2.2 yamt 215 1.3.2.2 yamt /* shortcut */ 216 1.3.2.2 yamt if (val == *(int *)rnode->sysctl_data) 217 1.3.2.2 yamt return 0; 218 1.3.2.2 yamt 219 1.3.2.2 yamt /* we cannot grant more rights to users when securelevel is above 0 */ 220 1.3.2.2 yamt if (val != 0 && is_securelevel_above(0)) { 221 1.3.2.2 yamt return EPERM; 222 1.3.2.2 yamt } 223 1.3.2.2 yamt 224 1.3.2.2 yamt *(int *)rnode->sysctl_data = val; 225 1.3.2.2 yamt return 0; 226 1.3.2.2 yamt } 227 1.3.2.2 yamt 228 1.3.2.2 yamt /* 229 1.3.2.2 yamt * Query secmodel_securelevel(9) to know whether securelevel is strictly 230 1.3.2.2 yamt * above 'level' or not. 231 1.3.2.2 yamt * Returns true if it is, false otherwise (when securelevel is absent or 232 1.3.2.2 yamt * securelevel is at or below 'level'). 233 1.3.2.2 yamt */ 234 1.3.2.2 yamt static bool 235 1.3.2.2 yamt is_securelevel_above(int level) 236 1.3.2.2 yamt { 237 1.3.2.2 yamt bool above; 238 1.3.2.2 yamt int error; 239 1.3.2.2 yamt 240 1.3.2.2 yamt error = secmodel_eval("org.netbsd.secmodel.securelevel", 241 1.3.2.2 yamt "is-securelevel-above", KAUTH_ARG(level), &above); 242 1.3.2.2 yamt if (error == 0 && above) 243 1.3.2.2 yamt return true; 244 1.3.2.2 yamt else 245 1.3.2.2 yamt return false; 246 1.3.2.2 yamt } 247 1.3.2.2 yamt 248 1.3.2.2 yamt static void 249 1.3.2.2 yamt secmodel_extensions_init(void) 250 1.3.2.2 yamt { 251 1.3.2.2 yamt 252 1.3.2.2 yamt curtain = 0; 253 1.3.2.2 yamt user_set_cpu_affinity = 0; 254 1.3.2.2 yamt } 255 1.3.2.2 yamt 256 1.3.2.2 yamt static void 257 1.3.2.2 yamt secmodel_extensions_start(void) 258 1.3.2.2 yamt { 259 1.3.2.2 yamt 260 1.3.2.2 yamt l_system = kauth_listen_scope(KAUTH_SCOPE_SYSTEM, 261 1.3.2.2 yamt secmodel_extensions_system_cb, NULL); 262 1.3.2.2 yamt l_process = kauth_listen_scope(KAUTH_SCOPE_PROCESS, 263 1.3.2.2 yamt secmodel_extensions_process_cb, NULL); 264 1.3.2.2 yamt l_network = kauth_listen_scope(KAUTH_SCOPE_NETWORK, 265 1.3.2.2 yamt secmodel_extensions_network_cb, NULL); 266 1.3.2.2 yamt } 267 1.3.2.2 yamt 268 1.3.2.2 yamt static void 269 1.3.2.2 yamt secmodel_extensions_stop(void) 270 1.3.2.2 yamt { 271 1.3.2.2 yamt 272 1.3.2.2 yamt kauth_unlisten_scope(l_system); 273 1.3.2.2 yamt kauth_unlisten_scope(l_process); 274 1.3.2.2 yamt kauth_unlisten_scope(l_network); 275 1.3.2.2 yamt } 276 1.3.2.2 yamt 277 1.3.2.2 yamt static int 278 1.3.2.2 yamt extensions_modcmd(modcmd_t cmd, void *arg) 279 1.3.2.2 yamt { 280 1.3.2.2 yamt int error = 0; 281 1.3.2.2 yamt 282 1.3.2.2 yamt switch (cmd) { 283 1.3.2.2 yamt case MODULE_CMD_INIT: 284 1.3.2.2 yamt error = secmodel_register(&extensions_sm, 285 1.3.2.2 yamt SECMODEL_EXTENSIONS_ID, SECMODEL_EXTENSIONS_NAME, 286 1.3.2.2 yamt NULL, NULL, NULL); 287 1.3.2.2 yamt if (error != 0) 288 1.3.2.2 yamt printf("extensions_modcmd::init: secmodel_register " 289 1.3.2.2 yamt "returned %d\n", error); 290 1.3.2.2 yamt 291 1.3.2.2 yamt secmodel_extensions_init(); 292 1.3.2.2 yamt secmodel_extensions_start(); 293 1.3.2.2 yamt sysctl_security_extensions_setup(&extensions_sysctl_log); 294 1.3.2.2 yamt break; 295 1.3.2.2 yamt 296 1.3.2.2 yamt case MODULE_CMD_FINI: 297 1.3.2.2 yamt sysctl_teardown(&extensions_sysctl_log); 298 1.3.2.2 yamt secmodel_extensions_stop(); 299 1.3.2.2 yamt 300 1.3.2.2 yamt error = secmodel_deregister(extensions_sm); 301 1.3.2.2 yamt if (error != 0) 302 1.3.2.2 yamt printf("extensions_modcmd::fini: secmodel_deregister " 303 1.3.2.2 yamt "returned %d\n", error); 304 1.3.2.2 yamt 305 1.3.2.2 yamt break; 306 1.3.2.2 yamt 307 1.3.2.2 yamt case MODULE_CMD_AUTOUNLOAD: 308 1.3.2.2 yamt error = EPERM; 309 1.3.2.2 yamt break; 310 1.3.2.2 yamt 311 1.3.2.2 yamt default: 312 1.3.2.2 yamt error = ENOTTY; 313 1.3.2.2 yamt break; 314 1.3.2.2 yamt } 315 1.3.2.2 yamt 316 1.3.2.2 yamt return (error); 317 1.3.2.2 yamt } 318 1.3.2.2 yamt 319 1.3.2.2 yamt static int 320 1.3.2.2 yamt secmodel_extensions_system_cb(kauth_cred_t cred, kauth_action_t action, 321 1.3.2.2 yamt void *cookie, void *arg0, void *arg1, void *arg2, void *arg3) 322 1.3.2.2 yamt { 323 1.3.2.2 yamt vnode_t *vp; 324 1.3.2.2 yamt struct vattr va; 325 1.3.2.2 yamt struct mount *mp; 326 1.3.2.2 yamt u_long flags; 327 1.3.2.2 yamt int result; 328 1.3.2.2 yamt enum kauth_system_req req; 329 1.3.2.2 yamt int error; 330 1.3.2.2 yamt 331 1.3.2.2 yamt req = (enum kauth_system_req)arg0; 332 1.3.2.2 yamt result = KAUTH_RESULT_DEFER; 333 1.3.2.2 yamt 334 1.3.2.2 yamt if (action != KAUTH_SYSTEM_MOUNT || dovfsusermount == 0) 335 1.3.2.2 yamt return result; 336 1.3.2.2 yamt 337 1.3.2.2 yamt switch (req) { 338 1.3.2.2 yamt case KAUTH_REQ_SYSTEM_MOUNT_NEW: 339 1.3.2.2 yamt vp = (vnode_t *)arg1; 340 1.3.2.2 yamt mp = vp->v_mount; 341 1.3.2.2 yamt flags = (u_long)arg2; 342 1.3.2.2 yamt 343 1.3.2.2 yamt /* 344 1.3.2.2 yamt * Ensure that the user owns the directory onto which the 345 1.3.2.2 yamt * mount is attempted. 346 1.3.2.2 yamt */ 347 1.3.2.2 yamt vn_lock(vp, LK_SHARED | LK_RETRY); 348 1.3.2.2 yamt error = VOP_GETATTR(vp, &va, cred); 349 1.3.2.2 yamt VOP_UNLOCK(vp); 350 1.3.2.2 yamt if (error) 351 1.3.2.2 yamt break; 352 1.3.2.2 yamt 353 1.3.2.2 yamt if (va.va_uid != kauth_cred_geteuid(cred)) 354 1.3.2.2 yamt break; 355 1.3.2.2 yamt 356 1.3.2.2 yamt error = usermount_common_policy(mp, flags); 357 1.3.2.2 yamt if (error) 358 1.3.2.2 yamt break; 359 1.3.2.2 yamt 360 1.3.2.2 yamt result = KAUTH_RESULT_ALLOW; 361 1.3.2.2 yamt 362 1.3.2.2 yamt break; 363 1.3.2.2 yamt 364 1.3.2.2 yamt case KAUTH_REQ_SYSTEM_MOUNT_UNMOUNT: 365 1.3.2.2 yamt mp = arg1; 366 1.3.2.2 yamt 367 1.3.2.2 yamt /* Must own the mount. */ 368 1.3.2.2 yamt if (mp->mnt_stat.f_owner == kauth_cred_geteuid(cred)) 369 1.3.2.2 yamt result = KAUTH_RESULT_ALLOW; 370 1.3.2.2 yamt 371 1.3.2.2 yamt break; 372 1.3.2.2 yamt 373 1.3.2.2 yamt case KAUTH_REQ_SYSTEM_MOUNT_UPDATE: 374 1.3.2.2 yamt mp = arg1; 375 1.3.2.2 yamt flags = (u_long)arg2; 376 1.3.2.2 yamt 377 1.3.2.2 yamt /* Must own the mount. */ 378 1.3.2.2 yamt if (mp->mnt_stat.f_owner == kauth_cred_geteuid(cred) && 379 1.3.2.2 yamt usermount_common_policy(mp, flags) == 0) 380 1.3.2.2 yamt result = KAUTH_RESULT_ALLOW; 381 1.3.2.2 yamt 382 1.3.2.2 yamt break; 383 1.3.2.2 yamt 384 1.3.2.2 yamt default: 385 1.3.2.2 yamt break; 386 1.3.2.2 yamt } 387 1.3.2.2 yamt 388 1.3.2.2 yamt return (result); 389 1.3.2.2 yamt } 390 1.3.2.2 yamt 391 1.3.2.2 yamt static int 392 1.3.2.2 yamt secmodel_extensions_process_cb(kauth_cred_t cred, kauth_action_t action, 393 1.3.2.2 yamt void *cookie, void *arg0, void *arg1, void *arg2, void *arg3) 394 1.3.2.2 yamt { 395 1.3.2.2 yamt int result; 396 1.3.2.2 yamt enum kauth_process_req req; 397 1.3.2.2 yamt 398 1.3.2.2 yamt result = KAUTH_RESULT_DEFER; 399 1.3.2.2 yamt req = (enum kauth_process_req)arg1; 400 1.3.2.2 yamt 401 1.3.2.2 yamt switch (action) { 402 1.3.2.2 yamt case KAUTH_PROCESS_CANSEE: 403 1.3.2.2 yamt switch (req) { 404 1.3.2.2 yamt case KAUTH_REQ_PROCESS_CANSEE_ARGS: 405 1.3.2.2 yamt case KAUTH_REQ_PROCESS_CANSEE_ENTRY: 406 1.3.2.2 yamt case KAUTH_REQ_PROCESS_CANSEE_OPENFILES: 407 1.3.2.2 yamt if (curtain != 0) { 408 1.3.2.2 yamt struct proc *p = arg0; 409 1.3.2.2 yamt 410 1.3.2.2 yamt /* 411 1.3.2.2 yamt * Only process' owner and root can see 412 1.3.2.2 yamt * through curtain 413 1.3.2.2 yamt */ 414 1.3.2.2 yamt if (!kauth_cred_uidmatch(cred, p->p_cred)) { 415 1.3.2.2 yamt int error; 416 1.3.2.2 yamt bool isroot = false; 417 1.3.2.2 yamt 418 1.3.2.2 yamt error = secmodel_eval( 419 1.3.2.2 yamt "org.netbsd.secmodel.suser", 420 1.3.2.2 yamt "is-root", cred, &isroot); 421 1.3.2.2 yamt if (error == 0 && !isroot) 422 1.3.2.2 yamt result = KAUTH_RESULT_DENY; 423 1.3.2.2 yamt } 424 1.3.2.2 yamt } 425 1.3.2.2 yamt 426 1.3.2.2 yamt break; 427 1.3.2.2 yamt 428 1.3.2.2 yamt default: 429 1.3.2.2 yamt break; 430 1.3.2.2 yamt } 431 1.3.2.2 yamt 432 1.3.2.2 yamt break; 433 1.3.2.2 yamt 434 1.3.2.2 yamt case KAUTH_PROCESS_SCHEDULER_SETAFFINITY: 435 1.3.2.2 yamt if (user_set_cpu_affinity != 0) { 436 1.3.2.2 yamt struct proc *p = arg0; 437 1.3.2.2 yamt 438 1.3.2.2 yamt if (kauth_cred_uidmatch(cred, p->p_cred)) 439 1.3.2.2 yamt result = KAUTH_RESULT_ALLOW; 440 1.3.2.2 yamt } 441 1.3.2.2 yamt break; 442 1.3.2.2 yamt 443 1.3.2.2 yamt default: 444 1.3.2.2 yamt break; 445 1.3.2.2 yamt } 446 1.3.2.2 yamt 447 1.3.2.2 yamt return (result); 448 1.3.2.2 yamt } 449 1.3.2.2 yamt 450 1.3.2.2 yamt static int 451 1.3.2.2 yamt secmodel_extensions_network_cb(kauth_cred_t cred, kauth_action_t action, 452 1.3.2.2 yamt void *cookie, void *arg0, void *arg1, void *arg2, void *arg3) 453 1.3.2.2 yamt { 454 1.3.2.2 yamt int result; 455 1.3.2.2 yamt enum kauth_network_req req; 456 1.3.2.2 yamt 457 1.3.2.2 yamt result = KAUTH_RESULT_DEFER; 458 1.3.2.2 yamt req = (enum kauth_network_req)arg0; 459 1.3.2.2 yamt 460 1.3.2.2 yamt if (action != KAUTH_NETWORK_SOCKET || 461 1.3.2.2 yamt req != KAUTH_REQ_NETWORK_SOCKET_CANSEE) 462 1.3.2.2 yamt return result; 463 1.3.2.2 yamt 464 1.3.2.2 yamt if (curtain != 0) { 465 1.3.2.2 yamt struct socket *so = (struct socket *)arg1; 466 1.3.2.2 yamt 467 1.3.2.2 yamt if (!kauth_cred_uidmatch(cred, so->so_cred)) { 468 1.3.2.2 yamt int error; 469 1.3.2.2 yamt bool isroot = false; 470 1.3.2.2 yamt 471 1.3.2.2 yamt error = secmodel_eval("org.netbsd.secmodel.suser", 472 1.3.2.2 yamt "is-root", cred, &isroot); 473 1.3.2.2 yamt if (error == 0 && !isroot) 474 1.3.2.2 yamt result = KAUTH_RESULT_DENY; 475 1.3.2.2 yamt } 476 1.3.2.2 yamt } 477 1.3.2.2 yamt 478 1.3.2.2 yamt return (result); 479 1.3.2.2 yamt } 480
Indexes created Wed Oct 01 07:09:59 GMT 2025