secmodel_overlay.c revision 1.10
1 /* $NetBSD: secmodel_overlay.c,v 1.10 2009/10/02 18:50:13 elad Exp $ */ 2 /*- 3 * Copyright (c) 2006 Elad Efrat <elad (at) NetBSD.org> 4 * All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 1. Redistributions of source code must retain the above copyright 10 * notice, this list of conditions and the following disclaimer. 11 * 2. Redistributions in binary form must reproduce the above copyright 12 * notice, this list of conditions and the following disclaimer in the 13 * documentation and/or other materials provided with the distribution. 14 * 3. The name of the author may not be used to endorse or promote products 15 * derived from this software without specific prior written permission. 16 * 17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 18 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 19 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 20 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 21 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 22 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 23 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 24 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 25 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 26 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 27 */ 28 29 #include <sys/cdefs.h> 30 __KERNEL_RCSID(0, "$NetBSD: secmodel_overlay.c,v 1.10 2009/10/02 18:50:13 elad Exp $"); 31 32 #include <sys/types.h> 33 #include <sys/param.h> 34 #include <sys/kauth.h> 35 #include <sys/module.h> 36 37 #include <sys/sysctl.h> 38 39 #include <secmodel/overlay/overlay.h> 40 41 #include <secmodel/bsd44/bsd44.h> 42 #include <secmodel/suser/suser.h> 43 #include <secmodel/securelevel/securelevel.h> 44 45 MODULE(MODULE_CLASS_SECMODEL, secmodel_overlay, "secmodel_bsd44"); 46 47 /* 48 * Fall-back settings. 49 */ 50 #define OVERLAY_ISCOPE_GENERIC "org.netbsd.kauth.overlay.generic" 51 #define OVERLAY_ISCOPE_SYSTEM "org.netbsd.kauth.overlay.system" 52 #define OVERLAY_ISCOPE_PROCESS "org.netbsd.kauth.overlay.process" 53 #define OVERLAY_ISCOPE_NETWORK "org.netbsd.kauth.overlay.network" 54 #define OVERLAY_ISCOPE_MACHDEP "org.netbsd.kauth.overlay.machdep" 55 #define OVERLAY_ISCOPE_DEVICE "org.netbsd.kauth.overlay.device" 56 #define OVERLAY_ISCOPE_VNODE "org.netbsd.kauth.overlay.vnode" 57 58 static kauth_scope_t secmodel_overlay_iscope_generic; 59 static kauth_scope_t secmodel_overlay_iscope_system; 60 static kauth_scope_t secmodel_overlay_iscope_process; 61 static kauth_scope_t secmodel_overlay_iscope_network; 62 static kauth_scope_t secmodel_overlay_iscope_machdep; 63 static kauth_scope_t secmodel_overlay_iscope_device; 64 static kauth_scope_t secmodel_overlay_iscope_vnode; 65 66 static kauth_listener_t l_generic, l_system, l_process, l_network, l_machdep, 67 l_device, l_vnode; 68 69 static struct sysctllog *sysctl_overlay_log; 70 71 /* 72 * Initialize the overlay security model. 73 */ 74 void 75 secmodel_overlay_init(void) 76 { 77 /* 78 * Register internal fall-back scopes. 79 */ 80 secmodel_overlay_iscope_generic = kauth_register_scope( 81 OVERLAY_ISCOPE_GENERIC, NULL, NULL); 82 secmodel_overlay_iscope_system = kauth_register_scope( 83 OVERLAY_ISCOPE_SYSTEM, NULL, NULL); 84 secmodel_overlay_iscope_process = kauth_register_scope( 85 OVERLAY_ISCOPE_PROCESS, NULL, NULL); 86 secmodel_overlay_iscope_network = kauth_register_scope( 87 OVERLAY_ISCOPE_NETWORK, NULL, NULL); 88 secmodel_overlay_iscope_machdep = kauth_register_scope( 89 OVERLAY_ISCOPE_MACHDEP, NULL, NULL); 90 secmodel_overlay_iscope_device = kauth_register_scope( 91 OVERLAY_ISCOPE_DEVICE, NULL, NULL); 92 secmodel_overlay_iscope_vnode = kauth_register_scope( 93 OVERLAY_ISCOPE_VNODE, NULL, NULL); 94 95 /* 96 * Register fall-back listeners, from suser and securelevel, to each 97 * internal scope. 98 */ 99 kauth_listen_scope(OVERLAY_ISCOPE_GENERIC, 100 secmodel_suser_generic_cb, NULL); 101 102 kauth_listen_scope(OVERLAY_ISCOPE_SYSTEM, 103 secmodel_suser_system_cb, NULL); 104 kauth_listen_scope(OVERLAY_ISCOPE_SYSTEM, 105 secmodel_securelevel_system_cb, NULL); 106 107 kauth_listen_scope(OVERLAY_ISCOPE_PROCESS, 108 secmodel_suser_process_cb, NULL); 109 kauth_listen_scope(OVERLAY_ISCOPE_PROCESS, 110 secmodel_securelevel_process_cb, NULL); 111 112 kauth_listen_scope(OVERLAY_ISCOPE_NETWORK, 113 secmodel_suser_network_cb, NULL); 114 kauth_listen_scope(OVERLAY_ISCOPE_NETWORK, 115 secmodel_securelevel_network_cb, NULL); 116 117 kauth_listen_scope(OVERLAY_ISCOPE_MACHDEP, 118 secmodel_suser_machdep_cb, NULL); 119 kauth_listen_scope(OVERLAY_ISCOPE_MACHDEP, 120 secmodel_securelevel_machdep_cb, NULL); 121 122 kauth_listen_scope(OVERLAY_ISCOPE_DEVICE, 123 secmodel_suser_device_cb, NULL); 124 kauth_listen_scope(OVERLAY_ISCOPE_DEVICE, 125 secmodel_securelevel_device_cb, NULL); 126 127 secmodel_bsd44_init(); 128 } 129 130 void 131 sysctl_security_overlay_setup(struct sysctllog **clog) 132 { 133 const struct sysctlnode *rnode; 134 135 sysctl_createv(clog, 0, NULL, &rnode, 136 CTLFLAG_PERMANENT, 137 CTLTYPE_NODE, "security", NULL, 138 NULL, 0, NULL, 0, 139 CTL_SECURITY, CTL_EOL); 140 141 sysctl_createv(clog, 0, &rnode, &rnode, 142 CTLFLAG_PERMANENT, 143 CTLTYPE_NODE, "models", NULL, 144 NULL, 0, NULL, 0, 145 CTL_CREATE, CTL_EOL); 146 147 sysctl_createv(clog, 0, &rnode, &rnode, 148 CTLFLAG_PERMANENT, 149 CTLTYPE_NODE, "overlay", 150 SYSCTL_DESCR("Overlay security model on-top of bsd44, "), 151 NULL, 0, NULL, 0, 152 CTL_CREATE, CTL_EOL); 153 154 sysctl_createv(clog, 0, &rnode, NULL, 155 CTLFLAG_PERMANENT, 156 CTLTYPE_STRING, "name", NULL, 157 NULL, 0, __UNCONST("Overlay (on-top of bsd44)"), 0, 158 CTL_CREATE, CTL_EOL); 159 } 160 161 /* 162 * Start the overlay security model. 163 */ 164 void 165 secmodel_overlay_start(void) 166 { 167 l_generic = kauth_listen_scope(KAUTH_SCOPE_GENERIC, 168 secmodel_overlay_generic_cb, NULL); 169 l_system = kauth_listen_scope(KAUTH_SCOPE_SYSTEM, 170 secmodel_overlay_system_cb, NULL); 171 l_process = kauth_listen_scope(KAUTH_SCOPE_PROCESS, 172 secmodel_overlay_process_cb, NULL); 173 l_network = kauth_listen_scope(KAUTH_SCOPE_NETWORK, 174 secmodel_overlay_network_cb, NULL); 175 l_machdep = kauth_listen_scope(KAUTH_SCOPE_MACHDEP, 176 secmodel_overlay_machdep_cb, NULL); 177 l_device = kauth_listen_scope(KAUTH_SCOPE_DEVICE, 178 secmodel_overlay_device_cb, NULL); 179 l_vnode = kauth_listen_scope(KAUTH_SCOPE_VNODE, 180 secmodel_overlay_vnode_cb, NULL); 181 182 /* secmodel_register(); */ 183 } 184 185 /* 186 * Stop the overlay security model. 187 */ 188 void 189 secmodel_overlay_stop(void) 190 { 191 kauth_unlisten_scope(l_generic); 192 kauth_unlisten_scope(l_system); 193 kauth_unlisten_scope(l_process); 194 kauth_unlisten_scope(l_network); 195 kauth_unlisten_scope(l_machdep); 196 kauth_unlisten_scope(l_device); 197 kauth_unlisten_scope(l_vnode); 198 } 199 200 static int 201 secmodel_overlay_modcmd(modcmd_t cmd, void *arg) 202 { 203 int error = 0; 204 205 switch (cmd) { 206 case MODULE_CMD_INIT: 207 secmodel_overlay_init(); 208 secmodel_bsd44_stop(); 209 secmodel_overlay_start(); 210 sysctl_security_overlay_setup(&sysctl_overlay_log); 211 break; 212 213 case MODULE_CMD_FINI: 214 sysctl_teardown(&sysctl_overlay_log); 215 secmodel_overlay_stop(); 216 break; 217 218 case MODULE_CMD_AUTOUNLOAD: 219 error = EPERM; 220 break; 221 222 default: 223 error = ENOTTY; 224 break; 225 } 226 227 return error; 228 } 229 230 /* 231 * Overlay listener for the generic scope. 232 */ 233 int 234 secmodel_overlay_generic_cb(kauth_cred_t cred, kauth_action_t action, 235 void *cookie, void *arg0, void *arg1, void *arg2, void *arg3) 236 { 237 int result; 238 239 result = KAUTH_RESULT_DEFER; 240 241 switch (action) { 242 default: 243 result = KAUTH_RESULT_DEFER; 244 break; 245 } 246 247 if (result == KAUTH_RESULT_DEFER) { 248 result = kauth_authorize_action( 249 secmodel_overlay_iscope_generic, cred, action, 250 arg0, arg1, arg2, arg3); 251 } 252 253 return (result); 254 } 255 256 /* 257 * Overlay listener for the system scope. 258 */ 259 int 260 secmodel_overlay_system_cb(kauth_cred_t cred, kauth_action_t action, 261 void *cookie, void *arg0, void *arg1, void *arg2, void *arg3) 262 { 263 int result; 264 265 result = KAUTH_RESULT_DEFER; 266 267 switch (action) { 268 default: 269 result = KAUTH_RESULT_DEFER; 270 break; 271 } 272 273 if (result == KAUTH_RESULT_DEFER) { 274 result = kauth_authorize_action( 275 secmodel_overlay_iscope_system, cred, action, 276 arg0, arg1, arg2, arg3); 277 } 278 279 return (result); 280 } 281 282 /* 283 * Overlay listener for the process scope. 284 */ 285 int 286 secmodel_overlay_process_cb(kauth_cred_t cred, kauth_action_t action, 287 void *cookie, void *arg0, void *arg1, void *arg2, void *arg3) 288 { 289 int result; 290 291 result = KAUTH_RESULT_DEFER; 292 293 switch (action) { 294 default: 295 result = KAUTH_RESULT_DEFER; 296 break; 297 } 298 299 if (result == KAUTH_RESULT_DEFER) { 300 result = kauth_authorize_action( 301 secmodel_overlay_iscope_process, cred, action, 302 arg0, arg1, arg2, arg3); 303 } 304 305 return (result); 306 } 307 308 /* 309 * Overlay listener for the network scope. 310 */ 311 int 312 secmodel_overlay_network_cb(kauth_cred_t cred, kauth_action_t action, 313 void *cookie, void *arg0, void *arg1, void *arg2, void *arg3) 314 { 315 int result; 316 317 result = KAUTH_RESULT_DEFER; 318 319 switch (action) { 320 default: 321 result = KAUTH_RESULT_DEFER; 322 break; 323 } 324 325 if (result == KAUTH_RESULT_DEFER) { 326 result = kauth_authorize_action( 327 secmodel_overlay_iscope_network, cred, action, 328 arg0, arg1, arg2, arg3); 329 } 330 331 return (result); 332 } 333 334 /* 335 * Overlay listener for the machdep scope. 336 */ 337 int 338 secmodel_overlay_machdep_cb(kauth_cred_t cred, kauth_action_t action, 339 void *cookie, void *arg0, void *arg1, void *arg2, void *arg3) 340 { 341 int result; 342 343 result = KAUTH_RESULT_DEFER; 344 345 switch (action) { 346 default: 347 result = KAUTH_RESULT_DEFER; 348 break; 349 } 350 351 if (result == KAUTH_RESULT_DEFER) { 352 result = kauth_authorize_action( 353 secmodel_overlay_iscope_machdep, cred, action, 354 arg0, arg1, arg2, arg3); 355 } 356 357 return (result); 358 } 359 360 /* 361 * Overlay listener for the device scope. 362 */ 363 int 364 secmodel_overlay_device_cb(kauth_cred_t cred, kauth_action_t action, 365 void *cookie, void *arg0, void *arg1, void *arg2, void *arg3) 366 { 367 int result; 368 369 result = KAUTH_RESULT_DEFER; 370 371 switch (action) { 372 default: 373 result = KAUTH_RESULT_DEFER; 374 break; 375 } 376 377 if (result == KAUTH_RESULT_DEFER) { 378 result = kauth_authorize_action( 379 secmodel_overlay_iscope_device, cred, action, 380 arg0, arg1, arg2, arg3); 381 } 382 383 return (result); 384 } 385 386 /* 387 * Overlay listener for the vnode scope. 388 */ 389 int 390 secmodel_overlay_vnode_cb(kauth_cred_t cred, kauth_action_t action, 391 void *cookie, void *arg0, void *arg1, void *arg2, void *arg3) 392 { 393 int result; 394 395 result = KAUTH_RESULT_DEFER; 396 397 switch (action) { 398 default: 399 result = KAUTH_RESULT_DEFER; 400 break; 401 } 402 403 if (result == KAUTH_RESULT_DEFER) { 404 result = kauth_authorize_action( 405 secmodel_overlay_iscope_vnode, cred, action, 406 arg0, arg1, arg2, arg3); 407 } 408 409 return (result); 410 } 411
Indexes created Mon Sep 29 18:09:42 GMT 2025