secmodel_overlay.c revision 1.3.4.4
1 /* $NetBSD: secmodel_overlay.c,v 1.3.4.4 2007/02/01 08:48:47 ad Exp $ */ 2 /*- 3 * Copyright (c) 2006 Elad Efrat <elad (at) NetBSD.org> 4 * All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 1. Redistributions of source code must retain the above copyright 10 * notice, this list of conditions and the following disclaimer. 11 * 2. Redistributions in binary form must reproduce the above copyright 12 * notice, this list of conditions and the following disclaimer in the 13 * documentation and/or other materials provided with the distribution. 14 * 3. The name of the author may not be used to endorse or promote products 15 * derived from this software without specific prior written permission. 16 * 17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 18 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 19 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 20 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 21 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 22 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 23 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 24 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 25 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 26 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 27 */ 28 29 #include <sys/cdefs.h> 30 __KERNEL_RCSID(0, "$NetBSD: secmodel_overlay.c,v 1.3.4.4 2007/02/01 08:48:47 ad Exp $"); 31 32 #include <sys/types.h> 33 #include <sys/param.h> 34 #include <sys/kauth.h> 35 36 #include <sys/sysctl.h> 37 38 #include <secmodel/secmodel.h> 39 #include <secmodel/overlay/overlay.h> 40 41 #include <secmodel/bsd44/bsd44.h> 42 #include <secmodel/bsd44/suser.h> 43 #include <secmodel/bsd44/securelevel.h> 44 45 /* 46 * Fall-back settings. 47 */ 48 #define OVERLAY_ISCOPE_GENERIC "org.netbsd.kauth.overlay.generic" 49 #define OVERLAY_ISCOPE_SYSTEM "org.netbsd.kauth.overlay.system" 50 #define OVERLAY_ISCOPE_PROCESS "org.netbsd.kauth.overlay.process" 51 #define OVERLAY_ISCOPE_NETWORK "org.netbsd.kauth.overlay.network" 52 #define OVERLAY_ISCOPE_MACHDEP "org.netbsd.kauth.overlay.machdep" 53 #define OVERLAY_ISCOPE_DEVICE "org.netbsd.kauth.overlay.device" 54 55 static kauth_scope_t secmodel_overlay_iscope_generic; 56 static kauth_scope_t secmodel_overlay_iscope_system; 57 static kauth_scope_t secmodel_overlay_iscope_process; 58 static kauth_scope_t secmodel_overlay_iscope_network; 59 static kauth_scope_t secmodel_overlay_iscope_machdep; 60 static kauth_scope_t secmodel_overlay_iscope_device; 61 62 extern int secmodel_bsd44_curtain; 63 64 /* 65 * Initialize the overlay security model. 66 */ 67 void 68 secmodel_overlay_init(void) 69 { 70 /* 71 * Register internal fall-back scopes. 72 */ 73 secmodel_overlay_iscope_generic = kauth_register_scope( 74 OVERLAY_ISCOPE_GENERIC, NULL, NULL); 75 secmodel_overlay_iscope_system = kauth_register_scope( 76 OVERLAY_ISCOPE_SYSTEM, NULL, NULL); 77 secmodel_overlay_iscope_process = kauth_register_scope( 78 OVERLAY_ISCOPE_PROCESS, NULL, NULL); 79 secmodel_overlay_iscope_network = kauth_register_scope( 80 OVERLAY_ISCOPE_NETWORK, NULL, NULL); 81 secmodel_overlay_iscope_machdep = kauth_register_scope( 82 OVERLAY_ISCOPE_MACHDEP, NULL, NULL); 83 secmodel_overlay_iscope_device = kauth_register_scope( 84 OVERLAY_ISCOPE_DEVICE, NULL, NULL); 85 86 /* 87 * Register fall-back listeners, from bsd44, to each internal 88 * fall-back scope. 89 */ 90 kauth_listen_scope(OVERLAY_ISCOPE_GENERIC, 91 secmodel_bsd44_suser_generic_cb, NULL); 92 93 kauth_listen_scope(OVERLAY_ISCOPE_SYSTEM, 94 secmodel_bsd44_suser_system_cb, NULL); 95 kauth_listen_scope(OVERLAY_ISCOPE_SYSTEM, 96 secmodel_bsd44_securelevel_system_cb, NULL); 97 98 kauth_listen_scope(OVERLAY_ISCOPE_PROCESS, 99 secmodel_bsd44_suser_process_cb, NULL); 100 kauth_listen_scope(OVERLAY_ISCOPE_PROCESS, 101 secmodel_bsd44_securelevel_process_cb, NULL); 102 103 kauth_listen_scope(OVERLAY_ISCOPE_NETWORK, 104 secmodel_bsd44_suser_network_cb, NULL); 105 kauth_listen_scope(OVERLAY_ISCOPE_NETWORK, 106 secmodel_bsd44_securelevel_network_cb, NULL); 107 108 kauth_listen_scope(OVERLAY_ISCOPE_MACHDEP, 109 secmodel_bsd44_suser_machdep_cb, NULL); 110 kauth_listen_scope(OVERLAY_ISCOPE_MACHDEP, 111 secmodel_bsd44_securelevel_machdep_cb, NULL); 112 113 kauth_listen_scope(OVERLAY_ISCOPE_DEVICE, 114 secmodel_bsd44_suser_device_cb, NULL); 115 kauth_listen_scope(OVERLAY_ISCOPE_DEVICE, 116 secmodel_bsd44_securelevel_device_cb, NULL); 117 118 secmodel_bsd44_init(); 119 } 120 121 SYSCTL_SETUP(sysctl_security_overlay_setup, 122 "sysctl security overlay setup") 123 { 124 const struct sysctlnode *rnode; 125 126 sysctl_createv(clog, 0, NULL, &rnode, 127 CTLFLAG_PERMANENT, 128 CTLTYPE_NODE, "security", NULL, 129 NULL, 0, NULL, 0, 130 CTL_SECURITY, CTL_EOL); 131 132 sysctl_createv(clog, 0, &rnode, &rnode, 133 CTLFLAG_PERMANENT, 134 CTLTYPE_NODE, "models", NULL, 135 NULL, 0, NULL, 0, 136 CTL_CREATE, CTL_EOL); 137 138 sysctl_createv(clog, 0, &rnode, &rnode, 139 CTLFLAG_PERMANENT, 140 CTLTYPE_NODE, "overlay", 141 SYSCTL_DESCR("Overlay security model on-top of bsd44, "), 142 NULL, 0, NULL, 0, 143 CTL_CREATE, CTL_EOL); 144 145 sysctl_createv(clog, 0, &rnode, NULL, 146 CTLFLAG_PERMANENT, 147 CTLTYPE_STRING, "name", NULL, 148 NULL, 0, __UNCONST("Overlay (on-top of bsd44)"), 0, 149 CTL_CREATE, CTL_EOL); 150 151 sysctl_createv(clog, 0, &rnode, NULL, 152 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 153 CTLTYPE_INT, "securelevel", 154 SYSCTL_DESCR("System security level"), 155 secmodel_bsd44_sysctl_securelevel, 0, NULL, 0, 156 CTL_CREATE, CTL_EOL); 157 158 sysctl_createv(clog, 0, &rnode, NULL, 159 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 160 CTLTYPE_INT, "curtain", 161 SYSCTL_DESCR("Curtain information about objects to " 162 "users not owning them."), 163 NULL, 0, &secmodel_bsd44_curtain, 0, 164 CTL_CREATE, CTL_EOL); 165 } 166 167 /* 168 * Start the overlay security model. 169 */ 170 void 171 secmodel_overlay_start(void) 172 { 173 secmodel_overlay_init(); 174 175 kauth_listen_scope(KAUTH_SCOPE_GENERIC, 176 secmodel_overlay_generic_cb, NULL); 177 kauth_listen_scope(KAUTH_SCOPE_SYSTEM, 178 secmodel_overlay_system_cb, NULL); 179 kauth_listen_scope(KAUTH_SCOPE_PROCESS, 180 secmodel_overlay_process_cb, NULL); 181 kauth_listen_scope(KAUTH_SCOPE_NETWORK, 182 secmodel_overlay_network_cb, NULL); 183 kauth_listen_scope(KAUTH_SCOPE_MACHDEP, 184 secmodel_overlay_machdep_cb, NULL); 185 kauth_listen_scope(KAUTH_SCOPE_DEVICE, 186 secmodel_overlay_device_cb, NULL); 187 188 secmodel_register(); 189 } 190 191 void 192 secmodel_start(void) 193 { 194 secmodel_overlay_start(); 195 } 196 197 /* 198 * Overlay listener for the generic scope. 199 */ 200 int 201 secmodel_overlay_generic_cb(kauth_cred_t cred, kauth_action_t action, 202 void *cookie, void *arg0, void *arg1, void *arg2, void *arg3) 203 { 204 int result; 205 206 result = KAUTH_RESULT_DEFER; 207 208 switch (action) { 209 default: 210 result = KAUTH_RESULT_DEFER; 211 break; 212 } 213 214 if (result == KAUTH_RESULT_DEFER) { 215 result = kauth_authorize_action( 216 secmodel_overlay_iscope_generic, cred, action, 217 arg0, arg1, arg2, arg3); 218 } 219 220 return (result); 221 } 222 223 /* 224 * Overlay listener for the system scope. 225 */ 226 int 227 secmodel_overlay_system_cb(kauth_cred_t cred, kauth_action_t action, 228 void *cookie, void *arg0, void *arg1, void *arg2, void *arg3) 229 { 230 int result; 231 232 result = KAUTH_RESULT_DEFER; 233 234 switch (action) { 235 default: 236 result = KAUTH_RESULT_DEFER; 237 break; 238 } 239 240 if (result == KAUTH_RESULT_DEFER) { 241 result = kauth_authorize_action( 242 secmodel_overlay_iscope_system, cred, action, 243 arg0, arg1, arg2, arg3); 244 } 245 246 return (result); 247 } 248 249 /* 250 * Overlay listener for the process scope. 251 */ 252 int 253 secmodel_overlay_process_cb(kauth_cred_t cred, kauth_action_t action, 254 void *cookie, void *arg0, void *arg1, void *arg2, void *arg3) 255 { 256 int result; 257 258 result = KAUTH_RESULT_DEFER; 259 260 switch (action) { 261 default: 262 result = KAUTH_RESULT_DEFER; 263 break; 264 } 265 266 if (result == KAUTH_RESULT_DEFER) { 267 result = kauth_authorize_action( 268 secmodel_overlay_iscope_process, cred, action, 269 arg0, arg1, arg2, arg3); 270 } 271 272 return (result); 273 } 274 275 /* 276 * Overlay listener for the network scope. 277 */ 278 int 279 secmodel_overlay_network_cb(kauth_cred_t cred, kauth_action_t action, 280 void *cookie, void *arg0, void *arg1, void *arg2, void *arg3) 281 { 282 int result; 283 284 result = KAUTH_RESULT_DEFER; 285 286 switch (action) { 287 default: 288 result = KAUTH_RESULT_DEFER; 289 break; 290 } 291 292 if (result == KAUTH_RESULT_DEFER) { 293 result = kauth_authorize_action( 294 secmodel_overlay_iscope_network, cred, action, 295 arg0, arg1, arg2, arg3); 296 } 297 298 return (result); 299 } 300 301 /* 302 * Overlay listener for the machdep scope. 303 */ 304 int 305 secmodel_overlay_machdep_cb(kauth_cred_t cred, kauth_action_t action, 306 void *cookie, void *arg0, void *arg1, void *arg2, void *arg3) 307 { 308 int result; 309 310 result = KAUTH_RESULT_DEFER; 311 312 switch (action) { 313 default: 314 result = KAUTH_RESULT_DEFER; 315 break; 316 } 317 318 if (result == KAUTH_RESULT_DEFER) { 319 result = kauth_authorize_action( 320 secmodel_overlay_iscope_machdep, cred, action, 321 arg0, arg1, arg2, arg3); 322 } 323 324 return (result); 325 } 326 327 /* 328 * Overlay listener for the device scope. 329 */ 330 int 331 secmodel_overlay_device_cb(kauth_cred_t cred, kauth_action_t action, 332 void *cookie, void *arg0, void *arg1, void *arg2, void *arg3) 333 { 334 int result; 335 336 result = KAUTH_RESULT_DEFER; 337 338 switch (action) { 339 default: 340 result = KAUTH_RESULT_DEFER; 341 break; 342 } 343 344 if (result == KAUTH_RESULT_DEFER) { 345 result = kauth_authorize_action( 346 secmodel_overlay_iscope_device, cred, action, 347 arg0, arg1, arg2, arg3); 348 } 349 350 return (result); 351 } 352
Indexes created Mon Oct 20 08:09:54 GMT 2025