secmodel_overlay.c revision 1.9
1 /* $NetBSD: secmodel_overlay.c,v 1.9 2008/02/23 23:32:30 elad Exp $ */ 2 /*- 3 * Copyright (c) 2006 Elad Efrat <elad (at) NetBSD.org> 4 * All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 1. Redistributions of source code must retain the above copyright 10 * notice, this list of conditions and the following disclaimer. 11 * 2. Redistributions in binary form must reproduce the above copyright 12 * notice, this list of conditions and the following disclaimer in the 13 * documentation and/or other materials provided with the distribution. 14 * 3. The name of the author may not be used to endorse or promote products 15 * derived from this software without specific prior written permission. 16 * 17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 18 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 19 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 20 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 21 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 22 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 23 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 24 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 25 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 26 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 27 */ 28 29 #include <sys/cdefs.h> 30 __KERNEL_RCSID(0, "$NetBSD: secmodel_overlay.c,v 1.9 2008/02/23 23:32:30 elad Exp $"); 31 32 #include <sys/types.h> 33 #include <sys/param.h> 34 #include <sys/kauth.h> 35 36 #include <sys/sysctl.h> 37 38 #include <secmodel/secmodel.h> 39 #include <secmodel/overlay/overlay.h> 40 41 #include <secmodel/bsd44/bsd44.h> 42 #include <secmodel/bsd44/suser.h> 43 44 #include <secmodel/securelevel/securelevel.h> 45 46 /* 47 * Fall-back settings. 48 */ 49 #define OVERLAY_ISCOPE_GENERIC "org.netbsd.kauth.overlay.generic" 50 #define OVERLAY_ISCOPE_SYSTEM "org.netbsd.kauth.overlay.system" 51 #define OVERLAY_ISCOPE_PROCESS "org.netbsd.kauth.overlay.process" 52 #define OVERLAY_ISCOPE_NETWORK "org.netbsd.kauth.overlay.network" 53 #define OVERLAY_ISCOPE_MACHDEP "org.netbsd.kauth.overlay.machdep" 54 #define OVERLAY_ISCOPE_DEVICE "org.netbsd.kauth.overlay.device" 55 56 static kauth_scope_t secmodel_overlay_iscope_generic; 57 static kauth_scope_t secmodel_overlay_iscope_system; 58 static kauth_scope_t secmodel_overlay_iscope_process; 59 static kauth_scope_t secmodel_overlay_iscope_network; 60 static kauth_scope_t secmodel_overlay_iscope_machdep; 61 static kauth_scope_t secmodel_overlay_iscope_device; 62 63 extern int secmodel_bsd44_curtain; 64 65 /* 66 * Initialize the overlay security model. 67 */ 68 void 69 secmodel_overlay_init(void) 70 { 71 /* 72 * Register internal fall-back scopes. 73 */ 74 secmodel_overlay_iscope_generic = kauth_register_scope( 75 OVERLAY_ISCOPE_GENERIC, NULL, NULL); 76 secmodel_overlay_iscope_system = kauth_register_scope( 77 OVERLAY_ISCOPE_SYSTEM, NULL, NULL); 78 secmodel_overlay_iscope_process = kauth_register_scope( 79 OVERLAY_ISCOPE_PROCESS, NULL, NULL); 80 secmodel_overlay_iscope_network = kauth_register_scope( 81 OVERLAY_ISCOPE_NETWORK, NULL, NULL); 82 secmodel_overlay_iscope_machdep = kauth_register_scope( 83 OVERLAY_ISCOPE_MACHDEP, NULL, NULL); 84 secmodel_overlay_iscope_device = kauth_register_scope( 85 OVERLAY_ISCOPE_DEVICE, NULL, NULL); 86 87 /* 88 * Register fall-back listeners, from bsd44, to each internal 89 * fall-back scope. 90 */ 91 kauth_listen_scope(OVERLAY_ISCOPE_GENERIC, 92 secmodel_bsd44_suser_generic_cb, NULL); 93 94 kauth_listen_scope(OVERLAY_ISCOPE_SYSTEM, 95 secmodel_bsd44_suser_system_cb, NULL); 96 kauth_listen_scope(OVERLAY_ISCOPE_SYSTEM, 97 secmodel_securelevel_system_cb, NULL); 98 99 kauth_listen_scope(OVERLAY_ISCOPE_PROCESS, 100 secmodel_bsd44_suser_process_cb, NULL); 101 kauth_listen_scope(OVERLAY_ISCOPE_PROCESS, 102 secmodel_securelevel_process_cb, NULL); 103 104 kauth_listen_scope(OVERLAY_ISCOPE_NETWORK, 105 secmodel_bsd44_suser_network_cb, NULL); 106 kauth_listen_scope(OVERLAY_ISCOPE_NETWORK, 107 secmodel_securelevel_network_cb, NULL); 108 109 kauth_listen_scope(OVERLAY_ISCOPE_MACHDEP, 110 secmodel_bsd44_suser_machdep_cb, NULL); 111 kauth_listen_scope(OVERLAY_ISCOPE_MACHDEP, 112 secmodel_securelevel_machdep_cb, NULL); 113 114 kauth_listen_scope(OVERLAY_ISCOPE_DEVICE, 115 secmodel_bsd44_suser_device_cb, NULL); 116 kauth_listen_scope(OVERLAY_ISCOPE_DEVICE, 117 secmodel_securelevel_device_cb, NULL); 118 119 secmodel_bsd44_init(); 120 } 121 122 SYSCTL_SETUP(sysctl_security_overlay_setup, 123 "sysctl security overlay setup") 124 { 125 const struct sysctlnode *rnode; 126 127 sysctl_createv(clog, 0, NULL, &rnode, 128 CTLFLAG_PERMANENT, 129 CTLTYPE_NODE, "security", NULL, 130 NULL, 0, NULL, 0, 131 CTL_SECURITY, CTL_EOL); 132 133 sysctl_createv(clog, 0, &rnode, &rnode, 134 CTLFLAG_PERMANENT, 135 CTLTYPE_NODE, "models", NULL, 136 NULL, 0, NULL, 0, 137 CTL_CREATE, CTL_EOL); 138 139 sysctl_createv(clog, 0, &rnode, &rnode, 140 CTLFLAG_PERMANENT, 141 CTLTYPE_NODE, "overlay", 142 SYSCTL_DESCR("Overlay security model on-top of bsd44, "), 143 NULL, 0, NULL, 0, 144 CTL_CREATE, CTL_EOL); 145 146 sysctl_createv(clog, 0, &rnode, NULL, 147 CTLFLAG_PERMANENT, 148 CTLTYPE_STRING, "name", NULL, 149 NULL, 0, __UNCONST("Overlay (on-top of bsd44)"), 0, 150 CTL_CREATE, CTL_EOL); 151 152 sysctl_createv(clog, 0, &rnode, NULL, 153 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 154 CTLTYPE_INT, "securelevel", 155 SYSCTL_DESCR("System security level"), 156 secmodel_securelevel_sysctl, 0, NULL, 0, 157 CTL_CREATE, CTL_EOL); 158 159 sysctl_createv(clog, 0, &rnode, NULL, 160 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 161 CTLTYPE_INT, "curtain", 162 SYSCTL_DESCR("Curtain information about objects to " 163 "users not owning them."), 164 NULL, 0, &secmodel_bsd44_curtain, 0, 165 CTL_CREATE, CTL_EOL); 166 } 167 168 /* 169 * Start the overlay security model. 170 */ 171 void 172 secmodel_overlay_start(void) 173 { 174 secmodel_overlay_init(); 175 176 kauth_listen_scope(KAUTH_SCOPE_GENERIC, 177 secmodel_overlay_generic_cb, NULL); 178 kauth_listen_scope(KAUTH_SCOPE_SYSTEM, 179 secmodel_overlay_system_cb, NULL); 180 kauth_listen_scope(KAUTH_SCOPE_PROCESS, 181 secmodel_overlay_process_cb, NULL); 182 kauth_listen_scope(KAUTH_SCOPE_NETWORK, 183 secmodel_overlay_network_cb, NULL); 184 kauth_listen_scope(KAUTH_SCOPE_MACHDEP, 185 secmodel_overlay_machdep_cb, NULL); 186 kauth_listen_scope(KAUTH_SCOPE_DEVICE, 187 secmodel_overlay_device_cb, NULL); 188 189 secmodel_register(); 190 } 191 192 void 193 secmodel_start(void) 194 { 195 secmodel_overlay_start(); 196 } 197 198 /* 199 * Overlay listener for the generic scope. 200 */ 201 int 202 secmodel_overlay_generic_cb(kauth_cred_t cred, kauth_action_t action, 203 void *cookie, void *arg0, void *arg1, void *arg2, void *arg3) 204 { 205 int result; 206 207 result = KAUTH_RESULT_DEFER; 208 209 switch (action) { 210 default: 211 result = KAUTH_RESULT_DEFER; 212 break; 213 } 214 215 if (result == KAUTH_RESULT_DEFER) { 216 result = kauth_authorize_action( 217 secmodel_overlay_iscope_generic, cred, action, 218 arg0, arg1, arg2, arg3); 219 } 220 221 return (result); 222 } 223 224 /* 225 * Overlay listener for the system scope. 226 */ 227 int 228 secmodel_overlay_system_cb(kauth_cred_t cred, kauth_action_t action, 229 void *cookie, void *arg0, void *arg1, void *arg2, void *arg3) 230 { 231 int result; 232 233 result = KAUTH_RESULT_DEFER; 234 235 switch (action) { 236 default: 237 result = KAUTH_RESULT_DEFER; 238 break; 239 } 240 241 if (result == KAUTH_RESULT_DEFER) { 242 result = kauth_authorize_action( 243 secmodel_overlay_iscope_system, cred, action, 244 arg0, arg1, arg2, arg3); 245 } 246 247 return (result); 248 } 249 250 /* 251 * Overlay listener for the process scope. 252 */ 253 int 254 secmodel_overlay_process_cb(kauth_cred_t cred, kauth_action_t action, 255 void *cookie, void *arg0, void *arg1, void *arg2, void *arg3) 256 { 257 int result; 258 259 result = KAUTH_RESULT_DEFER; 260 261 switch (action) { 262 default: 263 result = KAUTH_RESULT_DEFER; 264 break; 265 } 266 267 if (result == KAUTH_RESULT_DEFER) { 268 result = kauth_authorize_action( 269 secmodel_overlay_iscope_process, cred, action, 270 arg0, arg1, arg2, arg3); 271 } 272 273 return (result); 274 } 275 276 /* 277 * Overlay listener for the network scope. 278 */ 279 int 280 secmodel_overlay_network_cb(kauth_cred_t cred, kauth_action_t action, 281 void *cookie, void *arg0, void *arg1, void *arg2, void *arg3) 282 { 283 int result; 284 285 result = KAUTH_RESULT_DEFER; 286 287 switch (action) { 288 default: 289 result = KAUTH_RESULT_DEFER; 290 break; 291 } 292 293 if (result == KAUTH_RESULT_DEFER) { 294 result = kauth_authorize_action( 295 secmodel_overlay_iscope_network, cred, action, 296 arg0, arg1, arg2, arg3); 297 } 298 299 return (result); 300 } 301 302 /* 303 * Overlay listener for the machdep scope. 304 */ 305 int 306 secmodel_overlay_machdep_cb(kauth_cred_t cred, kauth_action_t action, 307 void *cookie, void *arg0, void *arg1, void *arg2, void *arg3) 308 { 309 int result; 310 311 result = KAUTH_RESULT_DEFER; 312 313 switch (action) { 314 default: 315 result = KAUTH_RESULT_DEFER; 316 break; 317 } 318 319 if (result == KAUTH_RESULT_DEFER) { 320 result = kauth_authorize_action( 321 secmodel_overlay_iscope_machdep, cred, action, 322 arg0, arg1, arg2, arg3); 323 } 324 325 return (result); 326 } 327 328 /* 329 * Overlay listener for the device scope. 330 */ 331 int 332 secmodel_overlay_device_cb(kauth_cred_t cred, kauth_action_t action, 333 void *cookie, void *arg0, void *arg1, void *arg2, void *arg3) 334 { 335 int result; 336 337 result = KAUTH_RESULT_DEFER; 338 339 switch (action) { 340 default: 341 result = KAUTH_RESULT_DEFER; 342 break; 343 } 344 345 if (result == KAUTH_RESULT_DEFER) { 346 result = kauth_authorize_action( 347 secmodel_overlay_iscope_device, cred, action, 348 arg0, arg1, arg2, arg3); 349 } 350 351 return (result); 352 } 353
Indexes created Fri Sep 26 20:09:58 GMT 2025