Home | History | Annotate | Line # | Download | only in overlay
secmodel_overlay.c revision 1.3.8.1 
      1 /* $NetBSD: secmodel_overlay.c,v 1.3.8.1 2008/06/03 20:47:42 skrll Exp $ */
      2 /*-
      3  * Copyright (c) 2006 Elad Efrat <elad (at) NetBSD.org>
      4  * All rights reserved.
      5  *
      6  * Redistribution and use in source and binary forms, with or without
      7  * modification, are permitted provided that the following conditions
      8  * are met:
      9  * 1. Redistributions of source code must retain the above copyright
     10  *    notice, this list of conditions and the following disclaimer.
     11  * 2. Redistributions in binary form must reproduce the above copyright
     12  *    notice, this list of conditions and the following disclaimer in the
     13  *    documentation and/or other materials provided with the distribution.
     14  * 3. All advertising materials mentioning features or use of this software
     15  *    must display the following acknowledgement:
     16  *      This product includes software developed by Elad Efrat.
     17  * 4. The name of the author may not be used to endorse or promote products
     18  *    derived from this software without specific prior written permission.
     19  *
     20  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
     21  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
     22  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
     23  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
     24  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
     25  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
     26  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
     27  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
     28  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
     29  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     30  */
     31 
     32 #include <sys/cdefs.h>
     33 __KERNEL_RCSID(0, "$NetBSD: secmodel_overlay.c,v 1.3.8.1 2008/06/03 20:47:42 skrll Exp $");
     34 
     35 #include <sys/types.h>
     36 #include <sys/param.h>
     37 #include <sys/kauth.h>
     38 
     39 #include <sys/sysctl.h>
     40 
     41 #include <secmodel/secmodel.h>
     42 #include <secmodel/overlay/overlay.h>
     43 
     44 #include <secmodel/bsd44/bsd44.h>
     45 #include <secmodel/bsd44/suser.h>
     46 #include <secmodel/bsd44/securelevel.h>
     47 
     48 /*
     49  * Fall-back settings.
     50  */
     51 #define	OVERLAY_ISCOPE_GENERIC	"org.netbsd.kauth.overlay.generic"
     52 #define	OVERLAY_ISCOPE_SYSTEM	"org.netbsd.kauth.overlay.system"
     53 #define	OVERLAY_ISCOPE_PROCESS	"org.netbsd.kauth.overlay.process"
     54 #define	OVERLAY_ISCOPE_NETWORK	"org.netbsd.kauth.overlay.network"
     55 #define	OVERLAY_ISCOPE_MACHDEP	"org.netbsd.kauth.overlay.machdep"
     56 #define	OVERLAY_ISCOPE_DEVICE	"org.netbsd.kauth.overlay.device"
     57 
     58 static kauth_scope_t secmodel_overlay_iscope_generic;
     59 static kauth_scope_t secmodel_overlay_iscope_system;
     60 static kauth_scope_t secmodel_overlay_iscope_process;
     61 static kauth_scope_t secmodel_overlay_iscope_network;
     62 static kauth_scope_t secmodel_overlay_iscope_machdep;
     63 static kauth_scope_t secmodel_overlay_iscope_device;
     64 
     65 extern int secmodel_bsd44_curtain;
     66 
     67 /*
     68  * Initialize the overlay security model.
     69  */
     70 void
     71 secmodel_overlay_init(void)
     72 {
     73 	/*
     74 	 * Register internal fall-back scopes.
     75 	 */
     76 	secmodel_overlay_iscope_generic = kauth_register_scope(
     77 	    OVERLAY_ISCOPE_GENERIC, NULL, NULL);
     78 	secmodel_overlay_iscope_system = kauth_register_scope(
     79 	    OVERLAY_ISCOPE_SYSTEM, NULL, NULL);
     80 	secmodel_overlay_iscope_process = kauth_register_scope(
     81 	    OVERLAY_ISCOPE_PROCESS, NULL, NULL);
     82 	secmodel_overlay_iscope_network = kauth_register_scope(
     83 	    OVERLAY_ISCOPE_NETWORK, NULL, NULL);
     84 	secmodel_overlay_iscope_machdep = kauth_register_scope(
     85 	    OVERLAY_ISCOPE_MACHDEP, NULL, NULL);
     86 	secmodel_overlay_iscope_device = kauth_register_scope(
     87 	    OVERLAY_ISCOPE_DEVICE, NULL, NULL);
     88 
     89 	/*
     90 	 * Register fall-back listeners, from bsd44, to each internal
     91 	 * fall-back scope.
     92 	 */
     93 	kauth_listen_scope(OVERLAY_ISCOPE_GENERIC,
     94 	    secmodel_bsd44_suser_generic_cb, NULL);
     95 
     96 	kauth_listen_scope(OVERLAY_ISCOPE_SYSTEM,
     97 	    secmodel_bsd44_suser_system_cb, NULL);
     98 	kauth_listen_scope(OVERLAY_ISCOPE_SYSTEM,
     99 	    secmodel_bsd44_securelevel_system_cb, NULL);
    100 
    101 	kauth_listen_scope(OVERLAY_ISCOPE_PROCESS,
    102 	    secmodel_bsd44_suser_process_cb, NULL);
    103 	kauth_listen_scope(OVERLAY_ISCOPE_PROCESS,
    104 	    secmodel_bsd44_securelevel_process_cb, NULL);
    105 
    106 	kauth_listen_scope(OVERLAY_ISCOPE_NETWORK,
    107 	    secmodel_bsd44_suser_network_cb, NULL);
    108 	kauth_listen_scope(OVERLAY_ISCOPE_NETWORK,
    109 	    secmodel_bsd44_securelevel_network_cb, NULL);
    110 
    111 	kauth_listen_scope(OVERLAY_ISCOPE_MACHDEP,
    112 	    secmodel_bsd44_suser_machdep_cb, NULL);
    113 	kauth_listen_scope(OVERLAY_ISCOPE_MACHDEP,
    114 	    secmodel_bsd44_securelevel_machdep_cb, NULL);
    115 
    116 	kauth_listen_scope(OVERLAY_ISCOPE_DEVICE,
    117 	    secmodel_bsd44_suser_device_cb, NULL);
    118 	kauth_listen_scope(OVERLAY_ISCOPE_DEVICE,
    119 	    secmodel_bsd44_securelevel_device_cb, NULL);
    120 
    121 	secmodel_bsd44_init();
    122 }
    123 
    124 SYSCTL_SETUP(sysctl_security_overlay_setup,
    125     "sysctl security overlay setup")
    126 {
    127 	const struct sysctlnode *rnode;
    128 
    129 	sysctl_createv(clog, 0, NULL, &rnode,
    130 		       CTLFLAG_PERMANENT,
    131 		       CTLTYPE_NODE, "security", NULL,
    132 		       NULL, 0, NULL, 0,
    133 		       CTL_SECURITY, CTL_EOL);
    134 
    135 	sysctl_createv(clog, 0, &rnode, &rnode,
    136 		       CTLFLAG_PERMANENT,
    137 		       CTLTYPE_NODE, "models", NULL,
    138 		       NULL, 0, NULL, 0,
    139 		       CTL_CREATE, CTL_EOL);
    140 
    141 	sysctl_createv(clog, 0, &rnode, &rnode,
    142 		       CTLFLAG_PERMANENT,
    143 		       CTLTYPE_NODE, "overlay",
    144 		       SYSCTL_DESCR("Overlay security model on-top of bsd44, "),
    145 		       NULL, 0, NULL, 0,
    146 		       CTL_CREATE, CTL_EOL);
    147 
    148 	sysctl_createv(clog, 0, &rnode, NULL,
    149 		       CTLFLAG_PERMANENT,
    150 		       CTLTYPE_STRING, "name", NULL,
    151 		       NULL, 0, __UNCONST("Overlay (on-top of bsd44)"), 0,
    152 		       CTL_CREATE, CTL_EOL);
    153 
    154 	sysctl_createv(clog, 0, &rnode, NULL,
    155 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
    156 		       CTLTYPE_INT, "securelevel",
    157 		       SYSCTL_DESCR("System security level"),
    158 		       secmodel_bsd44_sysctl_securelevel, 0, &securelevel, 0,
    159 		       CTL_CREATE, CTL_EOL);
    160 
    161 	sysctl_createv(clog, 0, &rnode, NULL,
    162 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
    163 		       CTLTYPE_INT, "curtain",
    164 		       SYSCTL_DESCR("Curtain information about objects to "
    165 				    "users not owning them."),
    166 		       NULL, 0, &secmodel_bsd44_curtain, 0,
    167 		       CTL_CREATE, CTL_EOL);
    168 }
    169 
    170 /*
    171  * Start the overlay security model.
    172  */
    173 void
    174 secmodel_start(void)
    175 {
    176 	secmodel_overlay_init();
    177 
    178 	kauth_listen_scope(KAUTH_SCOPE_GENERIC,
    179 	    secmodel_overlay_generic_cb, NULL);
    180 	kauth_listen_scope(KAUTH_SCOPE_SYSTEM,
    181 	    secmodel_overlay_system_cb, NULL);
    182 	kauth_listen_scope(KAUTH_SCOPE_PROCESS,
    183 	    secmodel_overlay_process_cb, NULL);
    184 	kauth_listen_scope(KAUTH_SCOPE_NETWORK,
    185 	    secmodel_overlay_network_cb, NULL);
    186 	kauth_listen_scope(KAUTH_SCOPE_MACHDEP,
    187 	    secmodel_overlay_machdep_cb, NULL);
    188 	kauth_listen_scope(KAUTH_SCOPE_DEVICE,
    189 	    secmodel_overlay_device_cb, NULL);
    190 }
    191 
    192 /*
    193  * Overlay listener for the generic scope.
    194  */
    195 int
    196 secmodel_overlay_generic_cb(kauth_cred_t cred, kauth_action_t action,
    197     void *cookie, void *arg0, void *arg1, void *arg2, void *arg3)
    198 {
    199 	int result;
    200 
    201 	result = KAUTH_RESULT_DEFER;
    202 
    203 	switch (action) {
    204 	default:
    205 		result = KAUTH_RESULT_DEFER;
    206 		break;
    207 	}
    208 
    209 	if (result == KAUTH_RESULT_DEFER) {
    210 		result = kauth_authorize_action(
    211 		    secmodel_overlay_iscope_generic, cred, action,
    212 		    arg0, arg1, arg2, arg3);
    213 	}
    214 
    215 	return (result);
    216 }
    217 
    218 /*
    219  * Overlay listener for the system scope.
    220  */
    221 int
    222 secmodel_overlay_system_cb(kauth_cred_t cred, kauth_action_t action,
    223     void *cookie, void *arg0, void *arg1, void *arg2, void *arg3)
    224 {
    225 	int result;
    226 
    227 	result = KAUTH_RESULT_DEFER;
    228 
    229 	switch (action) {
    230 	default:
    231 		result = KAUTH_RESULT_DEFER;
    232 		break;
    233 	}
    234 
    235 	if (result == KAUTH_RESULT_DEFER) {
    236 		result = kauth_authorize_action(
    237 		    secmodel_overlay_iscope_system, cred, action,
    238 		    arg0, arg1, arg2, arg3);
    239 	}
    240 
    241 	return (result);
    242 }
    243 
    244 /*
    245  * Overlay listener for the process scope.
    246  */
    247 int
    248 secmodel_overlay_process_cb(kauth_cred_t cred, kauth_action_t action,
    249     void *cookie, void *arg0, void *arg1, void *arg2, void *arg3)
    250 {
    251 	int result;
    252 
    253 	result = KAUTH_RESULT_DEFER;
    254 
    255 	switch (action) {
    256 	default:
    257 		result = KAUTH_RESULT_DEFER;
    258 		break;
    259 	}
    260 
    261 	if (result == KAUTH_RESULT_DEFER) {
    262 		result = kauth_authorize_action(
    263 		    secmodel_overlay_iscope_process, cred, action,
    264 		    arg0, arg1, arg2, arg3);
    265 	}
    266 
    267 	return (result);
    268 }
    269 
    270 /*
    271  * Overlay listener for the network scope.
    272  */
    273 int
    274 secmodel_overlay_network_cb(kauth_cred_t cred, kauth_action_t action,
    275     void *cookie, void *arg0, void *arg1, void *arg2, void *arg3)
    276 {
    277 	int result;
    278 
    279 	result = KAUTH_RESULT_DEFER;
    280 
    281 	switch (action) {
    282 	default:
    283 		result = KAUTH_RESULT_DEFER;
    284 		break;
    285 	}
    286 
    287 	if (result == KAUTH_RESULT_DEFER) {
    288 		result = kauth_authorize_action(
    289 		    secmodel_overlay_iscope_network, cred, action,
    290 		    arg0, arg1, arg2, arg3);
    291 	}
    292 
    293 	return (result);
    294 }
    295 
    296 /*
    297  * Overlay listener for the machdep scope.
    298  */
    299 int
    300 secmodel_overlay_machdep_cb(kauth_cred_t cred, kauth_action_t action,
    301     void *cookie, void *arg0, void *arg1, void *arg2, void *arg3)
    302 {
    303 	int result;
    304 
    305 	result = KAUTH_RESULT_DEFER;
    306 
    307 	switch (action) {
    308 	default:
    309 		result = KAUTH_RESULT_DEFER;
    310 		break;
    311 	}
    312 
    313 	if (result == KAUTH_RESULT_DEFER) {
    314 		result = kauth_authorize_action(
    315 		    secmodel_overlay_iscope_machdep, cred, action,
    316 		    arg0, arg1, arg2, arg3);
    317 	}
    318 
    319 	return (result);
    320 }
    321 
    322 /*
    323  * Overlay listener for the device scope.
    324  */
    325 int
    326 secmodel_overlay_device_cb(kauth_cred_t cred, kauth_action_t action,
    327     void *cookie, void *arg0, void *arg1, void *arg2, void *arg3)
    328 {
    329 	int result;
    330 
    331 	result = KAUTH_RESULT_DEFER;
    332 
    333 	switch (action) {
    334 	default:
    335 		result = KAUTH_RESULT_DEFER;
    336 		break;
    337 	}
    338 
    339 	if (result == KAUTH_RESULT_DEFER) {
    340 		result = kauth_authorize_action(
    341 		    secmodel_overlay_iscope_device, cred, action,
    342 		    arg0, arg1, arg2, arg3);
    343 	}
    344 
    345 	return (result);
    346 }
    347