secmodel_securelevel.c revision 1.1.2.2
1 1.1.2.2 bouyer /* $NetBSD: secmodel_securelevel.c,v 1.1.2.2 2007/11/22 15:38:36 bouyer Exp $ */ 2 1.1.2.2 bouyer /*- 3 1.1.2.2 bouyer * Copyright (c) 2006 Elad Efrat <elad (at) NetBSD.org> 4 1.1.2.2 bouyer * All rights reserved. 5 1.1.2.2 bouyer * 6 1.1.2.2 bouyer * Redistribution and use in source and binary forms, with or without 7 1.1.2.2 bouyer * modification, are permitted provided that the following conditions 8 1.1.2.2 bouyer * are met: 9 1.1.2.2 bouyer * 1. Redistributions of source code must retain the above copyright 10 1.1.2.2 bouyer * notice, this list of conditions and the following disclaimer. 11 1.1.2.2 bouyer * 2. Redistributions in binary form must reproduce the above copyright 12 1.1.2.2 bouyer * notice, this list of conditions and the following disclaimer in the 13 1.1.2.2 bouyer * documentation and/or other materials provided with the distribution. 14 1.1.2.2 bouyer * 3. The name of the author may not be used to endorse or promote products 15 1.1.2.2 bouyer * derived from this software without specific prior written permission. 16 1.1.2.2 bouyer * 17 1.1.2.2 bouyer * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 18 1.1.2.2 bouyer * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 19 1.1.2.2 bouyer * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 20 1.1.2.2 bouyer * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 21 1.1.2.2 bouyer * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 22 1.1.2.2 bouyer * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 23 1.1.2.2 bouyer * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 24 1.1.2.2 bouyer * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 25 1.1.2.2 bouyer * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 26 1.1.2.2 bouyer * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 27 1.1.2.2 bouyer */ 28 1.1.2.2 bouyer 29 1.1.2.2 bouyer /* 30 1.1.2.2 bouyer * This file contains kauth(9) listeners needed to implement the traditional 31 1.1.2.2 bouyer * NetBSD securelevel. 32 1.1.2.2 bouyer * 33 1.1.2.2 bouyer * The securelevel is a system-global indication on what operations are 34 1.1.2.2 bouyer * allowed or not. It affects all users, including root. 35 1.1.2.2 bouyer */ 36 1.1.2.2 bouyer 37 1.1.2.2 bouyer #include <sys/cdefs.h> 38 1.1.2.2 bouyer __KERNEL_RCSID(0, "$NetBSD: secmodel_securelevel.c,v 1.1.2.2 2007/11/22 15:38:36 bouyer Exp $"); 39 1.1.2.2 bouyer 40 1.1.2.2 bouyer #ifdef _KERNEL_OPT 41 1.1.2.2 bouyer #include "opt_insecure.h" 42 1.1.2.2 bouyer #endif /* _KERNEL_OPT */ 43 1.1.2.2 bouyer 44 1.1.2.2 bouyer #include <sys/types.h> 45 1.1.2.2 bouyer #include <sys/param.h> 46 1.1.2.2 bouyer #include <sys/kauth.h> 47 1.1.2.2 bouyer 48 1.1.2.2 bouyer #include <sys/conf.h> 49 1.1.2.2 bouyer #include <sys/mount.h> 50 1.1.2.2 bouyer #include <sys/sysctl.h> 51 1.1.2.2 bouyer #include <sys/vnode.h> 52 1.1.2.2 bouyer 53 1.1.2.2 bouyer #include <miscfs/specfs/specdev.h> 54 1.1.2.2 bouyer 55 1.1.2.2 bouyer #include <secmodel/securelevel/securelevel.h> 56 1.1.2.2 bouyer 57 1.1.2.2 bouyer static int securelevel; 58 1.1.2.2 bouyer 59 1.1.2.2 bouyer static kauth_listener_t l_system, l_process, l_network, l_machdep, l_device; 60 1.1.2.2 bouyer 61 1.1.2.2 bouyer /* 62 1.1.2.2 bouyer * sysctl helper routine for securelevel. ensures that the value 63 1.1.2.2 bouyer * only rises unless the caller has pid 1 (assumed to be init). 64 1.1.2.2 bouyer */ 65 1.1.2.2 bouyer int 66 1.1.2.2 bouyer secmodel_securelevel_sysctl(SYSCTLFN_ARGS) 67 1.1.2.2 bouyer { 68 1.1.2.2 bouyer int newsecurelevel, error; 69 1.1.2.2 bouyer struct sysctlnode node; 70 1.1.2.2 bouyer 71 1.1.2.2 bouyer newsecurelevel = securelevel; 72 1.1.2.2 bouyer node = *rnode; 73 1.1.2.2 bouyer node.sysctl_data = &newsecurelevel; 74 1.1.2.2 bouyer error = sysctl_lookup(SYSCTLFN_CALL(&node)); 75 1.1.2.2 bouyer if (error || newp == NULL) 76 1.1.2.2 bouyer return (error); 77 1.1.2.2 bouyer 78 1.1.2.2 bouyer if (newsecurelevel < securelevel && l && l->l_proc->p_pid != 1) 79 1.1.2.2 bouyer return (EPERM); 80 1.1.2.2 bouyer 81 1.1.2.2 bouyer securelevel = newsecurelevel; 82 1.1.2.2 bouyer 83 1.1.2.2 bouyer return (error); 84 1.1.2.2 bouyer } 85 1.1.2.2 bouyer 86 1.1.2.2 bouyer void 87 1.1.2.2 bouyer secmodel_securelevel_init(void) 88 1.1.2.2 bouyer { 89 1.1.2.2 bouyer #ifdef INSECURE 90 1.1.2.2 bouyer securelevel = -1; 91 1.1.2.2 bouyer #else 92 1.1.2.2 bouyer securelevel = 0; 93 1.1.2.2 bouyer #endif /* INSECURE */ 94 1.1.2.2 bouyer } 95 1.1.2.2 bouyer 96 1.1.2.2 bouyer SYSCTL_SETUP(sysctl_security_securelevel_setup, 97 1.1.2.2 bouyer "sysctl security securelevel setup") 98 1.1.2.2 bouyer { 99 1.1.2.2 bouyer /* 100 1.1.2.2 bouyer * For compatibility, we create a kern.securelevel variable. 101 1.1.2.2 bouyer */ 102 1.1.2.2 bouyer sysctl_createv(clog, 0, NULL, NULL, 103 1.1.2.2 bouyer CTLFLAG_PERMANENT, 104 1.1.2.2 bouyer CTLTYPE_NODE, "kern", NULL, 105 1.1.2.2 bouyer NULL, 0, NULL, 0, 106 1.1.2.2 bouyer CTL_KERN, CTL_EOL); 107 1.1.2.2 bouyer 108 1.1.2.2 bouyer sysctl_createv(clog, 0, NULL, NULL, 109 1.1.2.2 bouyer CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 110 1.1.2.2 bouyer CTLTYPE_INT, "securelevel", 111 1.1.2.2 bouyer SYSCTL_DESCR("System security level"), 112 1.1.2.2 bouyer secmodel_securelevel_sysctl, 0, NULL, 0, 113 1.1.2.2 bouyer CTL_KERN, KERN_SECURELVL, CTL_EOL); 114 1.1.2.2 bouyer } 115 1.1.2.2 bouyer 116 1.1.2.2 bouyer void 117 1.1.2.2 bouyer secmodel_securelevel_start(void) 118 1.1.2.2 bouyer { 119 1.1.2.2 bouyer l_system = kauth_listen_scope(KAUTH_SCOPE_SYSTEM, 120 1.1.2.2 bouyer secmodel_securelevel_system_cb, NULL); 121 1.1.2.2 bouyer l_process = kauth_listen_scope(KAUTH_SCOPE_PROCESS, 122 1.1.2.2 bouyer secmodel_securelevel_process_cb, NULL); 123 1.1.2.2 bouyer l_network = kauth_listen_scope(KAUTH_SCOPE_NETWORK, 124 1.1.2.2 bouyer secmodel_securelevel_network_cb, NULL); 125 1.1.2.2 bouyer l_machdep = kauth_listen_scope(KAUTH_SCOPE_MACHDEP, 126 1.1.2.2 bouyer secmodel_securelevel_machdep_cb, NULL); 127 1.1.2.2 bouyer l_device = kauth_listen_scope(KAUTH_SCOPE_DEVICE, 128 1.1.2.2 bouyer secmodel_securelevel_device_cb, NULL); 129 1.1.2.2 bouyer } 130 1.1.2.2 bouyer 131 1.1.2.2 bouyer #if defined(_LKM) 132 1.1.2.2 bouyer void 133 1.1.2.2 bouyer secmodel_securelevel_stop(void) 134 1.1.2.2 bouyer { 135 1.1.2.2 bouyer kauth_unlisten_scope(l_system); 136 1.1.2.2 bouyer kauth_unlisten_scope(l_process); 137 1.1.2.2 bouyer kauth_unlisten_scope(l_network); 138 1.1.2.2 bouyer kauth_unlisten_scope(l_machdep); 139 1.1.2.2 bouyer kauth_unlisten_scope(l_device); 140 1.1.2.2 bouyer } 141 1.1.2.2 bouyer #endif /* _LKM */ 142 1.1.2.2 bouyer 143 1.1.2.2 bouyer /* 144 1.1.2.2 bouyer * kauth(9) listener 145 1.1.2.2 bouyer * 146 1.1.2.2 bouyer * Security model: Traditional NetBSD 147 1.1.2.2 bouyer * Scope: System 148 1.1.2.2 bouyer * Responsibility: Securelevel 149 1.1.2.2 bouyer */ 150 1.1.2.2 bouyer int 151 1.1.2.2 bouyer secmodel_securelevel_system_cb(kauth_cred_t cred, 152 1.1.2.2 bouyer kauth_action_t action, void *cookie, void *arg0, void *arg1, 153 1.1.2.2 bouyer void *arg2, void *arg3) 154 1.1.2.2 bouyer { 155 1.1.2.2 bouyer int result; 156 1.1.2.2 bouyer enum kauth_system_req req; 157 1.1.2.2 bouyer 158 1.1.2.2 bouyer result = KAUTH_RESULT_DENY; 159 1.1.2.2 bouyer req = (enum kauth_system_req)arg0; 160 1.1.2.2 bouyer 161 1.1.2.2 bouyer switch (action) { 162 1.1.2.2 bouyer case KAUTH_SYSTEM_CHSYSFLAGS: 163 1.1.2.2 bouyer if (securelevel < 1) 164 1.1.2.2 bouyer result = KAUTH_RESULT_ALLOW; 165 1.1.2.2 bouyer break; 166 1.1.2.2 bouyer 167 1.1.2.2 bouyer case KAUTH_SYSTEM_TIME: 168 1.1.2.2 bouyer switch (req) { 169 1.1.2.2 bouyer case KAUTH_REQ_SYSTEM_TIME_BACKWARDS: 170 1.1.2.2 bouyer if (securelevel < 2) 171 1.1.2.2 bouyer result = KAUTH_RESULT_ALLOW; 172 1.1.2.2 bouyer break; 173 1.1.2.2 bouyer 174 1.1.2.2 bouyer case KAUTH_REQ_SYSTEM_TIME_RTCOFFSET: 175 1.1.2.2 bouyer if (securelevel < 1) 176 1.1.2.2 bouyer result = KAUTH_RESULT_ALLOW; 177 1.1.2.2 bouyer break; 178 1.1.2.2 bouyer 179 1.1.2.2 bouyer default: 180 1.1.2.2 bouyer result = KAUTH_RESULT_DEFER; 181 1.1.2.2 bouyer break; 182 1.1.2.2 bouyer } 183 1.1.2.2 bouyer break; 184 1.1.2.2 bouyer 185 1.1.2.2 bouyer case KAUTH_SYSTEM_LKM: 186 1.1.2.2 bouyer if (securelevel < 1) 187 1.1.2.2 bouyer result = KAUTH_RESULT_ALLOW; 188 1.1.2.2 bouyer break; 189 1.1.2.2 bouyer 190 1.1.2.2 bouyer case KAUTH_SYSTEM_MOUNT: 191 1.1.2.2 bouyer switch (req) { 192 1.1.2.2 bouyer case KAUTH_REQ_SYSTEM_MOUNT_NEW: 193 1.1.2.2 bouyer if (securelevel > 1) 194 1.1.2.2 bouyer break; 195 1.1.2.2 bouyer 196 1.1.2.2 bouyer result = KAUTH_RESULT_ALLOW; 197 1.1.2.2 bouyer break; 198 1.1.2.2 bouyer 199 1.1.2.2 bouyer case KAUTH_REQ_SYSTEM_MOUNT_UPDATE: 200 1.1.2.2 bouyer if (securelevel > 1) { 201 1.1.2.2 bouyer struct mount *mp = arg1; 202 1.1.2.2 bouyer u_long flags = (u_long)arg2; 203 1.1.2.2 bouyer 204 1.1.2.2 bouyer /* Can only degrade from read/write to read-only. */ 205 1.1.2.2 bouyer if (flags != (mp->mnt_flag | MNT_RDONLY | MNT_RELOAD | 206 1.1.2.2 bouyer MNT_FORCE | MNT_UPDATE)) 207 1.1.2.2 bouyer break; 208 1.1.2.2 bouyer } 209 1.1.2.2 bouyer 210 1.1.2.2 bouyer result = KAUTH_RESULT_ALLOW; 211 1.1.2.2 bouyer 212 1.1.2.2 bouyer break; 213 1.1.2.2 bouyer 214 1.1.2.2 bouyer default: 215 1.1.2.2 bouyer result = KAUTH_RESULT_DEFER; 216 1.1.2.2 bouyer break; 217 1.1.2.2 bouyer } 218 1.1.2.2 bouyer 219 1.1.2.2 bouyer break; 220 1.1.2.2 bouyer 221 1.1.2.2 bouyer case KAUTH_SYSTEM_SYSCTL: 222 1.1.2.2 bouyer switch (req) { 223 1.1.2.2 bouyer case KAUTH_REQ_SYSTEM_SYSCTL_ADD: 224 1.1.2.2 bouyer case KAUTH_REQ_SYSTEM_SYSCTL_DELETE: 225 1.1.2.2 bouyer case KAUTH_REQ_SYSTEM_SYSCTL_DESC: 226 1.1.2.2 bouyer if (securelevel < 1) 227 1.1.2.2 bouyer result = KAUTH_RESULT_ALLOW; 228 1.1.2.2 bouyer break; 229 1.1.2.2 bouyer 230 1.1.2.2 bouyer default: 231 1.1.2.2 bouyer result = KAUTH_RESULT_DEFER; 232 1.1.2.2 bouyer break; 233 1.1.2.2 bouyer } 234 1.1.2.2 bouyer break; 235 1.1.2.2 bouyer 236 1.1.2.2 bouyer case KAUTH_SYSTEM_SETIDCORE: 237 1.1.2.2 bouyer if (securelevel < 1) 238 1.1.2.2 bouyer result = KAUTH_RESULT_ALLOW; 239 1.1.2.2 bouyer break; 240 1.1.2.2 bouyer 241 1.1.2.2 bouyer case KAUTH_SYSTEM_DEBUG: 242 1.1.2.2 bouyer switch (req) { 243 1.1.2.2 bouyer case KAUTH_REQ_SYSTEM_DEBUG_IPKDB: 244 1.1.2.2 bouyer if (securelevel < 1) 245 1.1.2.2 bouyer result = KAUTH_RESULT_ALLOW; 246 1.1.2.2 bouyer break; 247 1.1.2.2 bouyer 248 1.1.2.2 bouyer default: 249 1.1.2.2 bouyer result = KAUTH_RESULT_DEFER; 250 1.1.2.2 bouyer break; 251 1.1.2.2 bouyer } 252 1.1.2.2 bouyer break; 253 1.1.2.2 bouyer 254 1.1.2.2 bouyer default: 255 1.1.2.2 bouyer result = KAUTH_RESULT_DEFER; 256 1.1.2.2 bouyer break; 257 1.1.2.2 bouyer } 258 1.1.2.2 bouyer 259 1.1.2.2 bouyer return (result); 260 1.1.2.2 bouyer } 261 1.1.2.2 bouyer 262 1.1.2.2 bouyer /* 263 1.1.2.2 bouyer * kauth(9) listener 264 1.1.2.2 bouyer * 265 1.1.2.2 bouyer * Security model: Traditional NetBSD 266 1.1.2.2 bouyer * Scope: Process 267 1.1.2.2 bouyer * Responsibility: Securelevel 268 1.1.2.2 bouyer */ 269 1.1.2.2 bouyer int 270 1.1.2.2 bouyer secmodel_securelevel_process_cb(kauth_cred_t cred, 271 1.1.2.2 bouyer kauth_action_t action, void *cookie, void *arg0, 272 1.1.2.2 bouyer void *arg1, void *arg2, void *arg3) 273 1.1.2.2 bouyer { 274 1.1.2.2 bouyer struct proc *p; 275 1.1.2.2 bouyer int result; 276 1.1.2.2 bouyer 277 1.1.2.2 bouyer result = KAUTH_RESULT_DENY; 278 1.1.2.2 bouyer p = arg0; 279 1.1.2.2 bouyer 280 1.1.2.2 bouyer switch (action) { 281 1.1.2.2 bouyer case KAUTH_PROCESS_CANPROCFS: { 282 1.1.2.2 bouyer enum kauth_process_req req; 283 1.1.2.2 bouyer 284 1.1.2.2 bouyer req = (enum kauth_process_req)arg2; 285 1.1.2.2 bouyer switch (req) { 286 1.1.2.2 bouyer case KAUTH_REQ_PROCESS_CANPROCFS_READ: 287 1.1.2.2 bouyer result = KAUTH_RESULT_ALLOW; 288 1.1.2.2 bouyer break; 289 1.1.2.2 bouyer 290 1.1.2.2 bouyer case KAUTH_REQ_PROCESS_CANPROCFS_RW: 291 1.1.2.2 bouyer case KAUTH_REQ_PROCESS_CANPROCFS_WRITE: 292 1.1.2.2 bouyer if ((p == initproc) && (securelevel > -1)) 293 1.1.2.2 bouyer result = KAUTH_RESULT_DENY; 294 1.1.2.2 bouyer else 295 1.1.2.2 bouyer result = KAUTH_RESULT_ALLOW; 296 1.1.2.2 bouyer 297 1.1.2.2 bouyer break; 298 1.1.2.2 bouyer default: 299 1.1.2.2 bouyer result = KAUTH_RESULT_DEFER; 300 1.1.2.2 bouyer break; 301 1.1.2.2 bouyer } 302 1.1.2.2 bouyer 303 1.1.2.2 bouyer break; 304 1.1.2.2 bouyer } 305 1.1.2.2 bouyer 306 1.1.2.2 bouyer case KAUTH_PROCESS_CANPTRACE: 307 1.1.2.2 bouyer case KAUTH_PROCESS_CANSYSTRACE: 308 1.1.2.2 bouyer if ((p == initproc) && (securelevel >= 0)) { 309 1.1.2.2 bouyer result = KAUTH_RESULT_DENY; 310 1.1.2.2 bouyer break; 311 1.1.2.2 bouyer } 312 1.1.2.2 bouyer 313 1.1.2.2 bouyer result = KAUTH_RESULT_ALLOW; 314 1.1.2.2 bouyer 315 1.1.2.2 bouyer break; 316 1.1.2.2 bouyer 317 1.1.2.2 bouyer case KAUTH_PROCESS_CORENAME: 318 1.1.2.2 bouyer if (securelevel < 2) 319 1.1.2.2 bouyer result = KAUTH_RESULT_ALLOW; 320 1.1.2.2 bouyer break; 321 1.1.2.2 bouyer 322 1.1.2.2 bouyer default: 323 1.1.2.2 bouyer result = KAUTH_RESULT_DEFER; 324 1.1.2.2 bouyer break; 325 1.1.2.2 bouyer } 326 1.1.2.2 bouyer 327 1.1.2.2 bouyer return (result); 328 1.1.2.2 bouyer } 329 1.1.2.2 bouyer 330 1.1.2.2 bouyer /* 331 1.1.2.2 bouyer * kauth(9) listener 332 1.1.2.2 bouyer * 333 1.1.2.2 bouyer * Security model: Traditional NetBSD 334 1.1.2.2 bouyer * Scope: Network 335 1.1.2.2 bouyer * Responsibility: Securelevel 336 1.1.2.2 bouyer */ 337 1.1.2.2 bouyer int 338 1.1.2.2 bouyer secmodel_securelevel_network_cb(kauth_cred_t cred, 339 1.1.2.2 bouyer kauth_action_t action, void *cookie, void *arg0, 340 1.1.2.2 bouyer void *arg1, void *arg2, void *arg3) 341 1.1.2.2 bouyer { 342 1.1.2.2 bouyer int result; 343 1.1.2.2 bouyer enum kauth_network_req req; 344 1.1.2.2 bouyer 345 1.1.2.2 bouyer result = KAUTH_RESULT_DENY; 346 1.1.2.2 bouyer req = (enum kauth_network_req)arg0; 347 1.1.2.2 bouyer 348 1.1.2.2 bouyer switch (action) { 349 1.1.2.2 bouyer case KAUTH_NETWORK_FIREWALL: 350 1.1.2.2 bouyer switch (req) { 351 1.1.2.2 bouyer case KAUTH_REQ_NETWORK_FIREWALL_FW: 352 1.1.2.2 bouyer case KAUTH_REQ_NETWORK_FIREWALL_NAT: 353 1.1.2.2 bouyer if (securelevel < 2) 354 1.1.2.2 bouyer result = KAUTH_RESULT_ALLOW; 355 1.1.2.2 bouyer break; 356 1.1.2.2 bouyer 357 1.1.2.2 bouyer default: 358 1.1.2.2 bouyer result = KAUTH_RESULT_DEFER; 359 1.1.2.2 bouyer break; 360 1.1.2.2 bouyer } 361 1.1.2.2 bouyer break; 362 1.1.2.2 bouyer 363 1.1.2.2 bouyer case KAUTH_NETWORK_FORWSRCRT: 364 1.1.2.2 bouyer if (securelevel < 1) 365 1.1.2.2 bouyer result = KAUTH_RESULT_ALLOW; 366 1.1.2.2 bouyer break; 367 1.1.2.2 bouyer 368 1.1.2.2 bouyer default: 369 1.1.2.2 bouyer result = KAUTH_RESULT_DEFER; 370 1.1.2.2 bouyer break; 371 1.1.2.2 bouyer } 372 1.1.2.2 bouyer 373 1.1.2.2 bouyer return (result); 374 1.1.2.2 bouyer } 375 1.1.2.2 bouyer 376 1.1.2.2 bouyer /* 377 1.1.2.2 bouyer * kauth(9) listener 378 1.1.2.2 bouyer * 379 1.1.2.2 bouyer * Security model: Traditional NetBSD 380 1.1.2.2 bouyer * Scope: Machdep 381 1.1.2.2 bouyer * Responsibility: Securelevel 382 1.1.2.2 bouyer */ 383 1.1.2.2 bouyer int 384 1.1.2.2 bouyer secmodel_securelevel_machdep_cb(kauth_cred_t cred, 385 1.1.2.2 bouyer kauth_action_t action, void *cookie, void *arg0, 386 1.1.2.2 bouyer void *arg1, void *arg2, void *arg3) 387 1.1.2.2 bouyer { 388 1.1.2.2 bouyer int result; 389 1.1.2.2 bouyer 390 1.1.2.2 bouyer result = KAUTH_RESULT_DENY; 391 1.1.2.2 bouyer 392 1.1.2.2 bouyer switch (action) { 393 1.1.2.2 bouyer case KAUTH_MACHDEP_IOPERM_SET: 394 1.1.2.2 bouyer case KAUTH_MACHDEP_IOPL: 395 1.1.2.2 bouyer if (securelevel < 1) 396 1.1.2.2 bouyer result = KAUTH_RESULT_ALLOW; 397 1.1.2.2 bouyer break; 398 1.1.2.2 bouyer 399 1.1.2.2 bouyer case KAUTH_MACHDEP_UNMANAGEDMEM: 400 1.1.2.2 bouyer if (securelevel <= 0) 401 1.1.2.2 bouyer result = KAUTH_RESULT_ALLOW; 402 1.1.2.2 bouyer break; 403 1.1.2.2 bouyer 404 1.1.2.2 bouyer default: 405 1.1.2.2 bouyer result = KAUTH_RESULT_DEFER; 406 1.1.2.2 bouyer break; 407 1.1.2.2 bouyer } 408 1.1.2.2 bouyer 409 1.1.2.2 bouyer return (result); 410 1.1.2.2 bouyer } 411 1.1.2.2 bouyer 412 1.1.2.2 bouyer /* 413 1.1.2.2 bouyer * kauth(9) listener 414 1.1.2.2 bouyer * 415 1.1.2.2 bouyer * Security model: Traditional NetBSD 416 1.1.2.2 bouyer * Scope: Device 417 1.1.2.2 bouyer * Responsibility: Securelevel 418 1.1.2.2 bouyer */ 419 1.1.2.2 bouyer int 420 1.1.2.2 bouyer secmodel_securelevel_device_cb(kauth_cred_t cred, 421 1.1.2.2 bouyer kauth_action_t action, void *cookie, void *arg0, 422 1.1.2.2 bouyer void *arg1, void *arg2, void *arg3) 423 1.1.2.2 bouyer { 424 1.1.2.2 bouyer int result; 425 1.1.2.2 bouyer 426 1.1.2.2 bouyer result = KAUTH_RESULT_DENY; 427 1.1.2.2 bouyer 428 1.1.2.2 bouyer switch (action) { 429 1.1.2.2 bouyer case KAUTH_DEVICE_RAWIO_SPEC: { 430 1.1.2.2 bouyer struct vnode *vp, *bvp; 431 1.1.2.2 bouyer enum kauth_device_req req; 432 1.1.2.2 bouyer dev_t dev; 433 1.1.2.2 bouyer int d_type; 434 1.1.2.2 bouyer 435 1.1.2.2 bouyer req = (enum kauth_device_req)arg0; 436 1.1.2.2 bouyer vp = arg1; 437 1.1.2.2 bouyer 438 1.1.2.2 bouyer KASSERT(vp != NULL); 439 1.1.2.2 bouyer 440 1.1.2.2 bouyer dev = vp->v_un.vu_specinfo->si_rdev; 441 1.1.2.2 bouyer d_type = D_OTHER; 442 1.1.2.2 bouyer bvp = NULL; 443 1.1.2.2 bouyer 444 1.1.2.2 bouyer /* Handle /dev/mem and /dev/kmem. */ 445 1.1.2.2 bouyer if ((vp->v_type == VCHR) && iskmemdev(dev)) { 446 1.1.2.2 bouyer switch (req) { 447 1.1.2.2 bouyer case KAUTH_REQ_DEVICE_RAWIO_SPEC_READ: 448 1.1.2.2 bouyer result = KAUTH_RESULT_ALLOW; 449 1.1.2.2 bouyer break; 450 1.1.2.2 bouyer 451 1.1.2.2 bouyer case KAUTH_REQ_DEVICE_RAWIO_SPEC_WRITE: 452 1.1.2.2 bouyer case KAUTH_REQ_DEVICE_RAWIO_SPEC_RW: 453 1.1.2.2 bouyer if (securelevel < 1) 454 1.1.2.2 bouyer result = KAUTH_RESULT_ALLOW; 455 1.1.2.2 bouyer break; 456 1.1.2.2 bouyer 457 1.1.2.2 bouyer default: 458 1.1.2.2 bouyer result = KAUTH_RESULT_DEFER; 459 1.1.2.2 bouyer break; 460 1.1.2.2 bouyer } 461 1.1.2.2 bouyer 462 1.1.2.2 bouyer break; 463 1.1.2.2 bouyer } 464 1.1.2.2 bouyer 465 1.1.2.2 bouyer switch (req) { 466 1.1.2.2 bouyer case KAUTH_REQ_DEVICE_RAWIO_SPEC_READ: 467 1.1.2.2 bouyer result = KAUTH_RESULT_ALLOW; 468 1.1.2.2 bouyer break; 469 1.1.2.2 bouyer 470 1.1.2.2 bouyer case KAUTH_REQ_DEVICE_RAWIO_SPEC_WRITE: 471 1.1.2.2 bouyer case KAUTH_REQ_DEVICE_RAWIO_SPEC_RW: 472 1.1.2.2 bouyer switch (vp->v_type) { 473 1.1.2.2 bouyer case VCHR: { 474 1.1.2.2 bouyer const struct cdevsw *cdev; 475 1.1.2.2 bouyer 476 1.1.2.2 bouyer cdev = cdevsw_lookup(dev); 477 1.1.2.2 bouyer if (cdev != NULL) { 478 1.1.2.2 bouyer dev_t blkdev; 479 1.1.2.2 bouyer 480 1.1.2.2 bouyer blkdev = devsw_chr2blk(dev); 481 1.1.2.2 bouyer if (blkdev != NODEV) { 482 1.1.2.2 bouyer vfinddev(blkdev, VBLK, &bvp); 483 1.1.2.2 bouyer if (bvp != NULL) 484 1.1.2.2 bouyer d_type = (cdev->d_flag 485 1.1.2.2 bouyer & D_TYPEMASK); 486 1.1.2.2 bouyer } 487 1.1.2.2 bouyer } 488 1.1.2.2 bouyer 489 1.1.2.2 bouyer break; 490 1.1.2.2 bouyer } 491 1.1.2.2 bouyer case VBLK: { 492 1.1.2.2 bouyer const struct bdevsw *bdev; 493 1.1.2.2 bouyer 494 1.1.2.2 bouyer bdev = bdevsw_lookup(dev); 495 1.1.2.2 bouyer if (bdev != NULL) 496 1.1.2.2 bouyer d_type = (bdev->d_flag & D_TYPEMASK); 497 1.1.2.2 bouyer 498 1.1.2.2 bouyer bvp = vp; 499 1.1.2.2 bouyer 500 1.1.2.2 bouyer break; 501 1.1.2.2 bouyer } 502 1.1.2.2 bouyer default: 503 1.1.2.2 bouyer result = KAUTH_RESULT_DEFER; 504 1.1.2.2 bouyer break; 505 1.1.2.2 bouyer } 506 1.1.2.2 bouyer 507 1.1.2.2 bouyer if (d_type != D_DISK) { 508 1.1.2.2 bouyer result = KAUTH_RESULT_ALLOW; 509 1.1.2.2 bouyer break; 510 1.1.2.2 bouyer } 511 1.1.2.2 bouyer 512 1.1.2.2 bouyer /* 513 1.1.2.2 bouyer * XXX: This is bogus. We should be failing the request 514 1.1.2.2 bouyer * XXX: not only if this specific slice is mounted, but 515 1.1.2.2 bouyer * XXX: if it's on a disk with any other mounted slice. 516 1.1.2.2 bouyer */ 517 1.1.2.2 bouyer if (vfs_mountedon(bvp) && (securelevel > 0)) 518 1.1.2.2 bouyer break; 519 1.1.2.2 bouyer 520 1.1.2.2 bouyer if (securelevel < 2) 521 1.1.2.2 bouyer result = KAUTH_RESULT_ALLOW; 522 1.1.2.2 bouyer 523 1.1.2.2 bouyer break; 524 1.1.2.2 bouyer 525 1.1.2.2 bouyer default: 526 1.1.2.2 bouyer result = KAUTH_RESULT_DEFER; 527 1.1.2.2 bouyer break; 528 1.1.2.2 bouyer } 529 1.1.2.2 bouyer 530 1.1.2.2 bouyer break; 531 1.1.2.2 bouyer } 532 1.1.2.2 bouyer 533 1.1.2.2 bouyer case KAUTH_DEVICE_RAWIO_PASSTHRU: { 534 1.1.2.2 bouyer if (securelevel > 0) { 535 1.1.2.2 bouyer u_long bits; 536 1.1.2.2 bouyer 537 1.1.2.2 bouyer bits = (u_long)arg0; 538 1.1.2.2 bouyer 539 1.1.2.2 bouyer KASSERT(bits != 0); 540 1.1.2.2 bouyer KASSERT((bits & ~KAUTH_REQ_DEVICE_RAWIO_PASSTHRU_ALL) == 0); 541 1.1.2.2 bouyer 542 1.1.2.2 bouyer if (bits & ~KAUTH_REQ_DEVICE_RAWIO_PASSTHRU_READCONF) 543 1.1.2.2 bouyer result = KAUTH_RESULT_DENY; 544 1.1.2.2 bouyer else 545 1.1.2.2 bouyer result = KAUTH_RESULT_ALLOW; 546 1.1.2.2 bouyer } else 547 1.1.2.2 bouyer result = KAUTH_RESULT_ALLOW; 548 1.1.2.2 bouyer 549 1.1.2.2 bouyer break; 550 1.1.2.2 bouyer } 551 1.1.2.2 bouyer 552 1.1.2.2 bouyer default: 553 1.1.2.2 bouyer result = KAUTH_RESULT_DEFER; 554 1.1.2.2 bouyer break; 555 1.1.2.2 bouyer } 556 1.1.2.2 bouyer 557 1.1.2.2 bouyer return (result); 558 1.1.2.2 bouyer } 559
Indexes created Sat Sep 27 14:09:57 GMT 2025