secmodel_keylock.c revision 1.2.2.2
1 1.2.2.2 yamt /* $NetBSD: secmodel_keylock.c,v 1.2.2.2 2009/08/19 18:48:31 yamt Exp $ */ 2 1.2.2.2 yamt /*- 3 1.2.2.2 yamt * Copyright (c) 2009 Marc Balmer <marc (at) msys.ch> 4 1.2.2.2 yamt * Copyright (c) 2006 Elad Efrat <elad (at) NetBSD.org> 5 1.2.2.2 yamt * All rights reserved. 6 1.2.2.2 yamt * 7 1.2.2.2 yamt * Redistribution and use in source and binary forms, with or without 8 1.2.2.2 yamt * modification, are permitted provided that the following conditions 9 1.2.2.2 yamt * are met: 10 1.2.2.2 yamt * 1. Redistributions of source code must retain the above copyright 11 1.2.2.2 yamt * notice, this list of conditions and the following disclaimer. 12 1.2.2.2 yamt * 2. Redistributions in binary form must reproduce the above copyright 13 1.2.2.2 yamt * notice, this list of conditions and the following disclaimer in the 14 1.2.2.2 yamt * documentation and/or other materials provided with the distribution. 15 1.2.2.2 yamt * 3. The name of the author may not be used to endorse or promote products 16 1.2.2.2 yamt * derived from this software without specific prior written permission. 17 1.2.2.2 yamt * 18 1.2.2.2 yamt * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 19 1.2.2.2 yamt * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 20 1.2.2.2 yamt * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 21 1.2.2.2 yamt * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 22 1.2.2.2 yamt * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 23 1.2.2.2 yamt * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 24 1.2.2.2 yamt * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 25 1.2.2.2 yamt * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 26 1.2.2.2 yamt * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 27 1.2.2.2 yamt * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 28 1.2.2.2 yamt */ 29 1.2.2.2 yamt 30 1.2.2.2 yamt /* 31 1.2.2.2 yamt * This file contains kauth(9) listeners needed to implement an experimental 32 1.2.2.2 yamt * keylock based security scheme. 33 1.2.2.2 yamt * 34 1.2.2.2 yamt * The position of the keylock is a system-global indication on what 35 1.2.2.2 yamt * operations are allowed or not. It affects all users, including root. 36 1.2.2.2 yamt * 37 1.2.2.2 yamt * Rules: 38 1.2.2.2 yamt * 39 1.2.2.2 yamt * - If the number of possible keylock positions is 0, assume there is no 40 1.2.2.2 yamt * keylock present, do not dissallow any action, i.e. do nothing 41 1.2.2.2 yamt * 42 1.2.2.2 yamt * - If the number of possible keylock positions is greater than 0, but the 43 1.2.2.2 yamt * current lock position is 0, assume tampering with the lock and forbid 44 1.2.2.2 yamt * all actions. 45 1.2.2.2 yamt * 46 1.2.2.2 yamt * - If the lock is in the lowest position, assume the system is locked and 47 1.2.2.2 yamt * forbid most actions. 48 1.2.2.2 yamt * 49 1.2.2.2 yamt * - If the lock is in the highest position, assume the system to be open and 50 1.2.2.2 yamt * forbid nothing. 51 1.2.2.2 yamt * 52 1.2.2.2 yamt * - If the security.models.keylock.order sysctl is set to a value != 0, 53 1.2.2.2 yamt * reverse this order. 54 1.2.2.2 yamt */ 55 1.2.2.2 yamt 56 1.2.2.2 yamt #include <sys/cdefs.h> 57 1.2.2.2 yamt __KERNEL_RCSID(0, "$NetBSD: secmodel_keylock.c,v 1.2.2.2 2009/08/19 18:48:31 yamt Exp $"); 58 1.2.2.2 yamt 59 1.2.2.2 yamt #include <sys/types.h> 60 1.2.2.2 yamt #include <sys/param.h> 61 1.2.2.2 yamt #include <sys/kauth.h> 62 1.2.2.2 yamt 63 1.2.2.2 yamt #include <sys/conf.h> 64 1.2.2.2 yamt #include <sys/mount.h> 65 1.2.2.2 yamt #include <sys/sysctl.h> 66 1.2.2.2 yamt #include <sys/vnode.h> 67 1.2.2.2 yamt 68 1.2.2.2 yamt #include <dev/keylock.h> 69 1.2.2.2 yamt 70 1.2.2.2 yamt #include <miscfs/specfs/specdev.h> 71 1.2.2.2 yamt 72 1.2.2.2 yamt #include <secmodel/keylock/keylock.h> 73 1.2.2.2 yamt 74 1.2.2.2 yamt static kauth_listener_t l_system, l_process, l_network, l_machdep, l_device; 75 1.2.2.2 yamt 76 1.2.2.2 yamt SYSCTL_SETUP(sysctl_security_keylock_setup, 77 1.2.2.2 yamt "sysctl security keylock setup") 78 1.2.2.2 yamt { 79 1.2.2.2 yamt const struct sysctlnode *rnode; 80 1.2.2.2 yamt 81 1.2.2.2 yamt sysctl_createv(clog, 0, NULL, &rnode, 82 1.2.2.2 yamt CTLFLAG_PERMANENT, 83 1.2.2.2 yamt CTLTYPE_NODE, "security", NULL, 84 1.2.2.2 yamt NULL, 0, NULL, 0, 85 1.2.2.2 yamt CTL_SECURITY, CTL_EOL); 86 1.2.2.2 yamt 87 1.2.2.2 yamt sysctl_createv(clog, 0, &rnode, &rnode, 88 1.2.2.2 yamt CTLFLAG_PERMANENT, 89 1.2.2.2 yamt CTLTYPE_NODE, "models", NULL, 90 1.2.2.2 yamt NULL, 0, NULL, 0, 91 1.2.2.2 yamt CTL_CREATE, CTL_EOL); 92 1.2.2.2 yamt 93 1.2.2.2 yamt sysctl_createv(clog, 0, &rnode, &rnode, 94 1.2.2.2 yamt CTLFLAG_PERMANENT, 95 1.2.2.2 yamt CTLTYPE_NODE, "keylock", 96 1.2.2.2 yamt SYSCTL_DESCR("Keylock security model"), 97 1.2.2.2 yamt NULL, 0, NULL, 0, 98 1.2.2.2 yamt CTL_CREATE, CTL_EOL); 99 1.2.2.2 yamt 100 1.2.2.2 yamt sysctl_createv(clog, 0, &rnode, NULL, 101 1.2.2.2 yamt CTLFLAG_PERMANENT, 102 1.2.2.2 yamt CTLTYPE_STRING, "name", NULL, 103 1.2.2.2 yamt NULL, 0, __UNCONST("Keylock"), 0, 104 1.2.2.2 yamt CTL_CREATE, CTL_EOL); 105 1.2.2.2 yamt } 106 1.2.2.2 yamt 107 1.2.2.2 yamt void 108 1.2.2.2 yamt secmodel_keylock_init(void) 109 1.2.2.2 yamt { 110 1.2.2.2 yamt } 111 1.2.2.2 yamt 112 1.2.2.2 yamt void 113 1.2.2.2 yamt secmodel_keylock_start(void) 114 1.2.2.2 yamt { 115 1.2.2.2 yamt l_system = kauth_listen_scope(KAUTH_SCOPE_SYSTEM, 116 1.2.2.2 yamt secmodel_keylock_system_cb, NULL); 117 1.2.2.2 yamt l_process = kauth_listen_scope(KAUTH_SCOPE_PROCESS, 118 1.2.2.2 yamt secmodel_keylock_process_cb, NULL); 119 1.2.2.2 yamt l_network = kauth_listen_scope(KAUTH_SCOPE_NETWORK, 120 1.2.2.2 yamt secmodel_keylock_network_cb, NULL); 121 1.2.2.2 yamt l_machdep = kauth_listen_scope(KAUTH_SCOPE_MACHDEP, 122 1.2.2.2 yamt secmodel_keylock_machdep_cb, NULL); 123 1.2.2.2 yamt l_device = kauth_listen_scope(KAUTH_SCOPE_DEVICE, 124 1.2.2.2 yamt secmodel_keylock_device_cb, NULL); 125 1.2.2.2 yamt } 126 1.2.2.2 yamt 127 1.2.2.2 yamt void 128 1.2.2.2 yamt secmodel_keylock_stop(void) 129 1.2.2.2 yamt { 130 1.2.2.2 yamt kauth_unlisten_scope(l_system); 131 1.2.2.2 yamt kauth_unlisten_scope(l_process); 132 1.2.2.2 yamt kauth_unlisten_scope(l_network); 133 1.2.2.2 yamt kauth_unlisten_scope(l_machdep); 134 1.2.2.2 yamt kauth_unlisten_scope(l_device); 135 1.2.2.2 yamt } 136 1.2.2.2 yamt 137 1.2.2.2 yamt /* 138 1.2.2.2 yamt * kauth(9) listener 139 1.2.2.2 yamt * 140 1.2.2.2 yamt * Security model: Multi-position keylock 141 1.2.2.2 yamt * Scope: System 142 1.2.2.2 yamt * Responsibility: Keylock 143 1.2.2.2 yamt */ 144 1.2.2.2 yamt int 145 1.2.2.2 yamt secmodel_keylock_system_cb(kauth_cred_t cred, 146 1.2.2.2 yamt kauth_action_t action, void *cookie, void *arg0, void *arg1, 147 1.2.2.2 yamt void *arg2, void *arg3) 148 1.2.2.2 yamt { 149 1.2.2.2 yamt int result; 150 1.2.2.2 yamt enum kauth_system_req req; 151 1.2.2.2 yamt int kstate; 152 1.2.2.2 yamt 153 1.2.2.2 yamt kstate = keylock_state(); 154 1.2.2.2 yamt if (kstate == KEYLOCK_ABSENT) 155 1.2.2.2 yamt return KAUTH_RESULT_DEFER; 156 1.2.2.2 yamt else if (kstate == KEYLOCK_TAMPER) 157 1.2.2.2 yamt return KAUTH_RESULT_DENY; 158 1.2.2.2 yamt 159 1.2.2.2 yamt result = KAUTH_RESULT_DEFER; 160 1.2.2.2 yamt req = (enum kauth_system_req)arg0; 161 1.2.2.2 yamt 162 1.2.2.2 yamt switch (action) { 163 1.2.2.2 yamt case KAUTH_SYSTEM_CHSYSFLAGS: 164 1.2.2.2 yamt if (kstate == KEYLOCK_CLOSE) 165 1.2.2.2 yamt result = KAUTH_RESULT_DENY; 166 1.2.2.2 yamt break; 167 1.2.2.2 yamt 168 1.2.2.2 yamt case KAUTH_SYSTEM_TIME: 169 1.2.2.2 yamt switch (req) { 170 1.2.2.2 yamt case KAUTH_REQ_SYSTEM_TIME_RTCOFFSET: 171 1.2.2.2 yamt if (kstate == KEYLOCK_CLOSE) 172 1.2.2.2 yamt result = KAUTH_RESULT_DENY; 173 1.2.2.2 yamt break; 174 1.2.2.2 yamt 175 1.2.2.2 yamt case KAUTH_REQ_SYSTEM_TIME_SYSTEM: { 176 1.2.2.2 yamt struct timespec *ts = arg1; 177 1.2.2.2 yamt struct timespec *delta = arg2; 178 1.2.2.2 yamt 179 1.2.2.2 yamt /* 180 1.2.2.2 yamt * Don't allow the time to be set forward so far it 181 1.2.2.2 yamt * will wrap and become negative, thus allowing an 182 1.2.2.2 yamt * attacker to bypass the next check below. The 183 1.2.2.2 yamt * cutoff is 1 year before rollover occurs, so even 184 1.2.2.2 yamt * if the attacker uses adjtime(2) to move the time 185 1.2.2.2 yamt * past the cutoff, it will take a very long time 186 1.2.2.2 yamt * to get to the wrap point. 187 1.2.2.2 yamt */ 188 1.2.2.2 yamt if (keylock_position() > 1 && 189 1.2.2.2 yamt ((ts->tv_sec > LLONG_MAX - 365*24*60*60) || 190 1.2.2.2 yamt (delta->tv_sec < 0 || delta->tv_nsec < 0))) 191 1.2.2.2 yamt result = KAUTH_RESULT_DENY; 192 1.2.2.2 yamt break; 193 1.2.2.2 yamt } 194 1.2.2.2 yamt default: 195 1.2.2.2 yamt break; 196 1.2.2.2 yamt } 197 1.2.2.2 yamt break; 198 1.2.2.2 yamt 199 1.2.2.2 yamt case KAUTH_SYSTEM_MODULE: 200 1.2.2.2 yamt if (kstate == KEYLOCK_CLOSE) 201 1.2.2.2 yamt result = KAUTH_RESULT_DENY; 202 1.2.2.2 yamt break; 203 1.2.2.2 yamt 204 1.2.2.2 yamt case KAUTH_SYSTEM_MOUNT: 205 1.2.2.2 yamt switch (req) { 206 1.2.2.2 yamt case KAUTH_REQ_SYSTEM_MOUNT_NEW: 207 1.2.2.2 yamt if (kstate == KEYLOCK_CLOSE) 208 1.2.2.2 yamt result = KAUTH_RESULT_DENY; 209 1.2.2.2 yamt 210 1.2.2.2 yamt break; 211 1.2.2.2 yamt 212 1.2.2.2 yamt case KAUTH_REQ_SYSTEM_MOUNT_UPDATE: 213 1.2.2.2 yamt if (kstate == KEYLOCK_CLOSE) { 214 1.2.2.2 yamt struct mount *mp = arg1; 215 1.2.2.2 yamt u_long flags = (u_long)arg2; 216 1.2.2.2 yamt 217 1.2.2.2 yamt /* 218 1.2.2.2 yamt * Can only degrade from read/write to 219 1.2.2.2 yamt * read-only. 220 1.2.2.2 yamt */ 221 1.2.2.2 yamt if (flags != (mp->mnt_flag | MNT_RDONLY | 222 1.2.2.2 yamt MNT_RELOAD | MNT_FORCE | MNT_UPDATE)) 223 1.2.2.2 yamt result = KAUTH_RESULT_DENY; 224 1.2.2.2 yamt } 225 1.2.2.2 yamt break; 226 1.2.2.2 yamt default: 227 1.2.2.2 yamt break; 228 1.2.2.2 yamt } 229 1.2.2.2 yamt 230 1.2.2.2 yamt break; 231 1.2.2.2 yamt 232 1.2.2.2 yamt case KAUTH_SYSTEM_SYSCTL: 233 1.2.2.2 yamt switch (req) { 234 1.2.2.2 yamt case KAUTH_REQ_SYSTEM_SYSCTL_ADD: 235 1.2.2.2 yamt case KAUTH_REQ_SYSTEM_SYSCTL_DELETE: 236 1.2.2.2 yamt case KAUTH_REQ_SYSTEM_SYSCTL_DESC: 237 1.2.2.2 yamt if (kstate == KEYLOCK_CLOSE) 238 1.2.2.2 yamt result = KAUTH_RESULT_DENY; 239 1.2.2.2 yamt break; 240 1.2.2.2 yamt default: 241 1.2.2.2 yamt break; 242 1.2.2.2 yamt } 243 1.2.2.2 yamt break; 244 1.2.2.2 yamt 245 1.2.2.2 yamt case KAUTH_SYSTEM_SETIDCORE: 246 1.2.2.2 yamt if (kstate == KEYLOCK_CLOSE) 247 1.2.2.2 yamt result = KAUTH_RESULT_DENY; 248 1.2.2.2 yamt break; 249 1.2.2.2 yamt 250 1.2.2.2 yamt case KAUTH_SYSTEM_DEBUG: 251 1.2.2.2 yamt switch (req) { 252 1.2.2.2 yamt case KAUTH_REQ_SYSTEM_DEBUG_IPKDB: 253 1.2.2.2 yamt if (kstate == KEYLOCK_CLOSE) 254 1.2.2.2 yamt result = KAUTH_RESULT_DENY; 255 1.2.2.2 yamt break; 256 1.2.2.2 yamt default: 257 1.2.2.2 yamt break; 258 1.2.2.2 yamt } 259 1.2.2.2 yamt break; 260 1.2.2.2 yamt } 261 1.2.2.2 yamt 262 1.2.2.2 yamt return result; 263 1.2.2.2 yamt } 264 1.2.2.2 yamt 265 1.2.2.2 yamt /* 266 1.2.2.2 yamt * kauth(9) listener 267 1.2.2.2 yamt * 268 1.2.2.2 yamt * Security model: Multi-position keylock 269 1.2.2.2 yamt * Scope: Process 270 1.2.2.2 yamt * Responsibility: Keylock 271 1.2.2.2 yamt */ 272 1.2.2.2 yamt int 273 1.2.2.2 yamt secmodel_keylock_process_cb(kauth_cred_t cred, 274 1.2.2.2 yamt kauth_action_t action, void *cookie, void *arg0, 275 1.2.2.2 yamt void *arg1, void *arg2, void *arg3) 276 1.2.2.2 yamt { 277 1.2.2.2 yamt struct proc *p; 278 1.2.2.2 yamt int result, kstate; 279 1.2.2.2 yamt 280 1.2.2.2 yamt kstate = keylock_state(); 281 1.2.2.2 yamt if (kstate == KEYLOCK_ABSENT) 282 1.2.2.2 yamt return KAUTH_RESULT_DEFER; 283 1.2.2.2 yamt else if (kstate == KEYLOCK_TAMPER) 284 1.2.2.2 yamt return KAUTH_RESULT_DENY; 285 1.2.2.2 yamt 286 1.2.2.2 yamt result = KAUTH_RESULT_DEFER; 287 1.2.2.2 yamt p = arg0; 288 1.2.2.2 yamt 289 1.2.2.2 yamt switch (action) { 290 1.2.2.2 yamt case KAUTH_PROCESS_PROCFS: { 291 1.2.2.2 yamt enum kauth_process_req req; 292 1.2.2.2 yamt 293 1.2.2.2 yamt req = (enum kauth_process_req)arg2; 294 1.2.2.2 yamt switch (req) { 295 1.2.2.2 yamt case KAUTH_REQ_PROCESS_PROCFS_READ: 296 1.2.2.2 yamt break; 297 1.2.2.2 yamt 298 1.2.2.2 yamt case KAUTH_REQ_PROCESS_PROCFS_RW: 299 1.2.2.2 yamt case KAUTH_REQ_PROCESS_PROCFS_WRITE: 300 1.2.2.2 yamt if ((p == initproc) && (kstate != KEYLOCK_OPEN)) 301 1.2.2.2 yamt result = KAUTH_RESULT_DENY; 302 1.2.2.2 yamt 303 1.2.2.2 yamt break; 304 1.2.2.2 yamt default: 305 1.2.2.2 yamt break; 306 1.2.2.2 yamt } 307 1.2.2.2 yamt 308 1.2.2.2 yamt break; 309 1.2.2.2 yamt } 310 1.2.2.2 yamt 311 1.2.2.2 yamt case KAUTH_PROCESS_PTRACE: 312 1.2.2.2 yamt if ((p == initproc) && (kstate != KEYLOCK_OPEN)) 313 1.2.2.2 yamt result = KAUTH_RESULT_DENY; 314 1.2.2.2 yamt 315 1.2.2.2 yamt break; 316 1.2.2.2 yamt 317 1.2.2.2 yamt case KAUTH_PROCESS_CORENAME: 318 1.2.2.2 yamt if (kstate == KEYLOCK_CLOSE) 319 1.2.2.2 yamt result = KAUTH_RESULT_DENY; 320 1.2.2.2 yamt break; 321 1.2.2.2 yamt } 322 1.2.2.2 yamt return result; 323 1.2.2.2 yamt } 324 1.2.2.2 yamt 325 1.2.2.2 yamt /* 326 1.2.2.2 yamt * kauth(9) listener 327 1.2.2.2 yamt * 328 1.2.2.2 yamt * Security model: Multi-position keylock 329 1.2.2.2 yamt * Scope: Network 330 1.2.2.2 yamt * Responsibility: Keylock 331 1.2.2.2 yamt */ 332 1.2.2.2 yamt int 333 1.2.2.2 yamt secmodel_keylock_network_cb(kauth_cred_t cred, 334 1.2.2.2 yamt kauth_action_t action, void *cookie, void *arg0, 335 1.2.2.2 yamt void *arg1, void *arg2, void *arg3) 336 1.2.2.2 yamt { 337 1.2.2.2 yamt int result, kstate; 338 1.2.2.2 yamt enum kauth_network_req req; 339 1.2.2.2 yamt 340 1.2.2.2 yamt kstate = keylock_state(); 341 1.2.2.2 yamt if (kstate == KEYLOCK_ABSENT) 342 1.2.2.2 yamt return KAUTH_RESULT_DEFER; 343 1.2.2.2 yamt else if (kstate == KEYLOCK_TAMPER) 344 1.2.2.2 yamt return KAUTH_RESULT_DENY; 345 1.2.2.2 yamt 346 1.2.2.2 yamt result = KAUTH_RESULT_DEFER; 347 1.2.2.2 yamt req = (enum kauth_network_req)arg0; 348 1.2.2.2 yamt 349 1.2.2.2 yamt switch (action) { 350 1.2.2.2 yamt case KAUTH_NETWORK_FIREWALL: 351 1.2.2.2 yamt switch (req) { 352 1.2.2.2 yamt case KAUTH_REQ_NETWORK_FIREWALL_FW: 353 1.2.2.2 yamt case KAUTH_REQ_NETWORK_FIREWALL_NAT: 354 1.2.2.2 yamt if (kstate == KEYLOCK_CLOSE) 355 1.2.2.2 yamt result = KAUTH_RESULT_DENY; 356 1.2.2.2 yamt break; 357 1.2.2.2 yamt 358 1.2.2.2 yamt default: 359 1.2.2.2 yamt break; 360 1.2.2.2 yamt } 361 1.2.2.2 yamt break; 362 1.2.2.2 yamt 363 1.2.2.2 yamt case KAUTH_NETWORK_FORWSRCRT: 364 1.2.2.2 yamt if (kstate != KEYLOCK_OPEN) 365 1.2.2.2 yamt result = KAUTH_RESULT_DENY; 366 1.2.2.2 yamt break; 367 1.2.2.2 yamt } 368 1.2.2.2 yamt 369 1.2.2.2 yamt return result; 370 1.2.2.2 yamt } 371 1.2.2.2 yamt 372 1.2.2.2 yamt /* 373 1.2.2.2 yamt * kauth(9) listener 374 1.2.2.2 yamt * 375 1.2.2.2 yamt * Security model: Multi-position keylock 376 1.2.2.2 yamt * Scope: Machdep 377 1.2.2.2 yamt * Responsibility: Keylock 378 1.2.2.2 yamt */ 379 1.2.2.2 yamt int 380 1.2.2.2 yamt secmodel_keylock_machdep_cb(kauth_cred_t cred, 381 1.2.2.2 yamt kauth_action_t action, void *cookie, void *arg0, 382 1.2.2.2 yamt void *arg1, void *arg2, void *arg3) 383 1.2.2.2 yamt { 384 1.2.2.2 yamt int result, kstate; 385 1.2.2.2 yamt 386 1.2.2.2 yamt kstate = keylock_state(); 387 1.2.2.2 yamt if (kstate == KEYLOCK_ABSENT) 388 1.2.2.2 yamt return KAUTH_RESULT_DEFER; 389 1.2.2.2 yamt else if (kstate == KEYLOCK_TAMPER) 390 1.2.2.2 yamt return KAUTH_RESULT_DENY; 391 1.2.2.2 yamt 392 1.2.2.2 yamt result = KAUTH_RESULT_DEFER; 393 1.2.2.2 yamt 394 1.2.2.2 yamt switch (action) { 395 1.2.2.2 yamt case KAUTH_MACHDEP_IOPERM_SET: 396 1.2.2.2 yamt case KAUTH_MACHDEP_IOPL: 397 1.2.2.2 yamt if (kstate != KEYLOCK_OPEN) 398 1.2.2.2 yamt result = KAUTH_RESULT_DENY; 399 1.2.2.2 yamt break; 400 1.2.2.2 yamt 401 1.2.2.2 yamt case KAUTH_MACHDEP_UNMANAGEDMEM: 402 1.2.2.2 yamt if (kstate != KEYLOCK_OPEN) 403 1.2.2.2 yamt result = KAUTH_RESULT_DENY; 404 1.2.2.2 yamt break; 405 1.2.2.2 yamt } 406 1.2.2.2 yamt 407 1.2.2.2 yamt return result; 408 1.2.2.2 yamt } 409 1.2.2.2 yamt 410 1.2.2.2 yamt /* 411 1.2.2.2 yamt * kauth(9) listener 412 1.2.2.2 yamt * 413 1.2.2.2 yamt * Security model: Multi-position keylock 414 1.2.2.2 yamt * Scope: Device 415 1.2.2.2 yamt * Responsibility: Keylock 416 1.2.2.2 yamt */ 417 1.2.2.2 yamt int 418 1.2.2.2 yamt secmodel_keylock_device_cb(kauth_cred_t cred, 419 1.2.2.2 yamt kauth_action_t action, void *cookie, void *arg0, 420 1.2.2.2 yamt void *arg1, void *arg2, void *arg3) 421 1.2.2.2 yamt { 422 1.2.2.2 yamt int result, kstate; 423 1.2.2.2 yamt 424 1.2.2.2 yamt kstate = keylock_state(); 425 1.2.2.2 yamt if (kstate == KEYLOCK_ABSENT) 426 1.2.2.2 yamt return KAUTH_RESULT_DEFER; 427 1.2.2.2 yamt else if (kstate == KEYLOCK_TAMPER) 428 1.2.2.2 yamt return KAUTH_RESULT_DENY; 429 1.2.2.2 yamt 430 1.2.2.2 yamt result = KAUTH_RESULT_DEFER; 431 1.2.2.2 yamt 432 1.2.2.2 yamt switch (action) { 433 1.2.2.2 yamt case KAUTH_DEVICE_RAWIO_SPEC: { 434 1.2.2.2 yamt struct vnode *vp, *bvp; 435 1.2.2.2 yamt enum kauth_device_req req; 436 1.2.2.2 yamt dev_t dev; 437 1.2.2.2 yamt int d_type; 438 1.2.2.2 yamt 439 1.2.2.2 yamt req = (enum kauth_device_req)arg0; 440 1.2.2.2 yamt vp = arg1; 441 1.2.2.2 yamt 442 1.2.2.2 yamt KASSERT(vp != NULL); 443 1.2.2.2 yamt 444 1.2.2.2 yamt dev = vp->v_rdev; 445 1.2.2.2 yamt d_type = D_OTHER; 446 1.2.2.2 yamt bvp = NULL; 447 1.2.2.2 yamt 448 1.2.2.2 yamt /* Handle /dev/mem and /dev/kmem. */ 449 1.2.2.2 yamt if ((vp->v_type == VCHR) && iskmemdev(dev)) { 450 1.2.2.2 yamt switch (req) { 451 1.2.2.2 yamt case KAUTH_REQ_DEVICE_RAWIO_SPEC_READ: 452 1.2.2.2 yamt break; 453 1.2.2.2 yamt 454 1.2.2.2 yamt case KAUTH_REQ_DEVICE_RAWIO_SPEC_WRITE: 455 1.2.2.2 yamt case KAUTH_REQ_DEVICE_RAWIO_SPEC_RW: 456 1.2.2.2 yamt if (kstate != KEYLOCK_OPEN) 457 1.2.2.2 yamt result = KAUTH_RESULT_DENY; 458 1.2.2.2 yamt break; 459 1.2.2.2 yamt default: 460 1.2.2.2 yamt break; 461 1.2.2.2 yamt } 462 1.2.2.2 yamt break; 463 1.2.2.2 yamt } 464 1.2.2.2 yamt 465 1.2.2.2 yamt switch (req) { 466 1.2.2.2 yamt case KAUTH_REQ_DEVICE_RAWIO_SPEC_READ: 467 1.2.2.2 yamt break; 468 1.2.2.2 yamt 469 1.2.2.2 yamt case KAUTH_REQ_DEVICE_RAWIO_SPEC_WRITE: 470 1.2.2.2 yamt case KAUTH_REQ_DEVICE_RAWIO_SPEC_RW: 471 1.2.2.2 yamt switch (vp->v_type) { 472 1.2.2.2 yamt case VCHR: { 473 1.2.2.2 yamt const struct cdevsw *cdev; 474 1.2.2.2 yamt 475 1.2.2.2 yamt cdev = cdevsw_lookup(dev); 476 1.2.2.2 yamt if (cdev != NULL) { 477 1.2.2.2 yamt dev_t blkdev; 478 1.2.2.2 yamt 479 1.2.2.2 yamt blkdev = devsw_chr2blk(dev); 480 1.2.2.2 yamt if (blkdev != NODEV) { 481 1.2.2.2 yamt vfinddev(blkdev, VBLK, &bvp); 482 1.2.2.2 yamt if (bvp != NULL) 483 1.2.2.2 yamt d_type = (cdev->d_flag 484 1.2.2.2 yamt & D_TYPEMASK); 485 1.2.2.2 yamt } 486 1.2.2.2 yamt } 487 1.2.2.2 yamt 488 1.2.2.2 yamt break; 489 1.2.2.2 yamt } 490 1.2.2.2 yamt case VBLK: { 491 1.2.2.2 yamt const struct bdevsw *bdev; 492 1.2.2.2 yamt 493 1.2.2.2 yamt bdev = bdevsw_lookup(dev); 494 1.2.2.2 yamt if (bdev != NULL) 495 1.2.2.2 yamt d_type = (bdev->d_flag & D_TYPEMASK); 496 1.2.2.2 yamt 497 1.2.2.2 yamt bvp = vp; 498 1.2.2.2 yamt 499 1.2.2.2 yamt break; 500 1.2.2.2 yamt } 501 1.2.2.2 yamt default: 502 1.2.2.2 yamt break; 503 1.2.2.2 yamt } 504 1.2.2.2 yamt 505 1.2.2.2 yamt if (d_type != D_DISK) 506 1.2.2.2 yamt break; 507 1.2.2.2 yamt 508 1.2.2.2 yamt /* 509 1.2.2.2 yamt * XXX: This is bogus. We should be failing the request 510 1.2.2.2 yamt * XXX: not only if this specific slice is mounted, but 511 1.2.2.2 yamt * XXX: if it's on a disk with any other mounted slice. 512 1.2.2.2 yamt */ 513 1.2.2.2 yamt if (vfs_mountedon(bvp) && (kstate != KEYLOCK_OPEN)) 514 1.2.2.2 yamt break; 515 1.2.2.2 yamt 516 1.2.2.2 yamt if (kstate == KEYLOCK_CLOSE) 517 1.2.2.2 yamt result = KAUTH_RESULT_DENY; 518 1.2.2.2 yamt 519 1.2.2.2 yamt break; 520 1.2.2.2 yamt default: 521 1.2.2.2 yamt break; 522 1.2.2.2 yamt } 523 1.2.2.2 yamt break; 524 1.2.2.2 yamt } 525 1.2.2.2 yamt 526 1.2.2.2 yamt case KAUTH_DEVICE_RAWIO_PASSTHRU: 527 1.2.2.2 yamt if (kstate != KEYLOCK_OPEN) { 528 1.2.2.2 yamt u_long bits; 529 1.2.2.2 yamt 530 1.2.2.2 yamt bits = (u_long)arg0; 531 1.2.2.2 yamt 532 1.2.2.2 yamt KASSERT(bits != 0); 533 1.2.2.2 yamt KASSERT((bits & ~KAUTH_REQ_DEVICE_RAWIO_PASSTHRU_ALL) 534 1.2.2.2 yamt == 0); 535 1.2.2.2 yamt 536 1.2.2.2 yamt if (bits & ~KAUTH_REQ_DEVICE_RAWIO_PASSTHRU_READCONF) 537 1.2.2.2 yamt result = KAUTH_RESULT_DENY; 538 1.2.2.2 yamt } 539 1.2.2.2 yamt break; 540 1.2.2.2 yamt 541 1.2.2.2 yamt case KAUTH_DEVICE_GPIO_PINSET: 542 1.2.2.2 yamt if (kstate != KEYLOCK_OPEN) 543 1.2.2.2 yamt result = KAUTH_RESULT_DENY; 544 1.2.2.2 yamt break; 545 1.2.2.2 yamt default: 546 1.2.2.2 yamt break; 547 1.2.2.2 yamt } 548 1.2.2.2 yamt return result; 549 1.2.2.2 yamt } 550
Indexes created Thu Oct 02 14:10:14 GMT 2025