secmodel_securelevel.c revision 1.3
1 /* $NetBSD: secmodel_securelevel.c,v 1.3 2007/11/25 00:35:28 elad Exp $ */ 2 /*- 3 * Copyright (c) 2006 Elad Efrat <elad (at) NetBSD.org> 4 * All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 1. Redistributions of source code must retain the above copyright 10 * notice, this list of conditions and the following disclaimer. 11 * 2. Redistributions in binary form must reproduce the above copyright 12 * notice, this list of conditions and the following disclaimer in the 13 * documentation and/or other materials provided with the distribution. 14 * 3. The name of the author may not be used to endorse or promote products 15 * derived from this software without specific prior written permission. 16 * 17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 18 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 19 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 20 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 21 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 22 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 23 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 24 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 25 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 26 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 27 */ 28 29 /* 30 * This file contains kauth(9) listeners needed to implement the traditional 31 * NetBSD securelevel. 32 * 33 * The securelevel is a system-global indication on what operations are 34 * allowed or not. It affects all users, including root. 35 */ 36 37 #include <sys/cdefs.h> 38 __KERNEL_RCSID(0, "$NetBSD: secmodel_securelevel.c,v 1.3 2007/11/25 00:35:28 elad Exp $"); 39 40 #ifdef _KERNEL_OPT 41 #include "opt_insecure.h" 42 #endif /* _KERNEL_OPT */ 43 44 #include <sys/types.h> 45 #include <sys/param.h> 46 #include <sys/kauth.h> 47 48 #include <sys/conf.h> 49 #include <sys/mount.h> 50 #include <sys/sysctl.h> 51 #include <sys/vnode.h> 52 53 #include <miscfs/specfs/specdev.h> 54 55 #include <secmodel/securelevel/securelevel.h> 56 57 static int securelevel; 58 59 static kauth_listener_t l_system, l_process, l_network, l_machdep, l_device; 60 61 /* 62 * sysctl helper routine for securelevel. ensures that the value 63 * only rises unless the caller has pid 1 (assumed to be init). 64 */ 65 int 66 secmodel_securelevel_sysctl(SYSCTLFN_ARGS) 67 { 68 int newsecurelevel, error; 69 struct sysctlnode node; 70 71 newsecurelevel = securelevel; 72 node = *rnode; 73 node.sysctl_data = &newsecurelevel; 74 error = sysctl_lookup(SYSCTLFN_CALL(&node)); 75 if (error || newp == NULL) 76 return (error); 77 78 if (newsecurelevel < securelevel && l && l->l_proc->p_pid != 1) 79 return (EPERM); 80 81 securelevel = newsecurelevel; 82 83 return (error); 84 } 85 86 void 87 secmodel_securelevel_init(void) 88 { 89 #ifdef INSECURE 90 securelevel = -1; 91 #else 92 securelevel = 0; 93 #endif /* INSECURE */ 94 } 95 96 SYSCTL_SETUP(sysctl_security_securelevel_setup, 97 "sysctl security securelevel setup") 98 { 99 /* 100 * For compatibility, we create a kern.securelevel variable. 101 */ 102 sysctl_createv(clog, 0, NULL, NULL, 103 CTLFLAG_PERMANENT, 104 CTLTYPE_NODE, "kern", NULL, 105 NULL, 0, NULL, 0, 106 CTL_KERN, CTL_EOL); 107 108 sysctl_createv(clog, 0, NULL, NULL, 109 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 110 CTLTYPE_INT, "securelevel", 111 SYSCTL_DESCR("System security level"), 112 secmodel_securelevel_sysctl, 0, NULL, 0, 113 CTL_KERN, KERN_SECURELVL, CTL_EOL); 114 } 115 116 void 117 secmodel_securelevel_start(void) 118 { 119 l_system = kauth_listen_scope(KAUTH_SCOPE_SYSTEM, 120 secmodel_securelevel_system_cb, NULL); 121 l_process = kauth_listen_scope(KAUTH_SCOPE_PROCESS, 122 secmodel_securelevel_process_cb, NULL); 123 l_network = kauth_listen_scope(KAUTH_SCOPE_NETWORK, 124 secmodel_securelevel_network_cb, NULL); 125 l_machdep = kauth_listen_scope(KAUTH_SCOPE_MACHDEP, 126 secmodel_securelevel_machdep_cb, NULL); 127 l_device = kauth_listen_scope(KAUTH_SCOPE_DEVICE, 128 secmodel_securelevel_device_cb, NULL); 129 } 130 131 #if defined(_LKM) 132 void 133 secmodel_securelevel_stop(void) 134 { 135 kauth_unlisten_scope(l_system); 136 kauth_unlisten_scope(l_process); 137 kauth_unlisten_scope(l_network); 138 kauth_unlisten_scope(l_machdep); 139 kauth_unlisten_scope(l_device); 140 } 141 #endif /* _LKM */ 142 143 /* 144 * kauth(9) listener 145 * 146 * Security model: Traditional NetBSD 147 * Scope: System 148 * Responsibility: Securelevel 149 */ 150 int 151 secmodel_securelevel_system_cb(kauth_cred_t cred, 152 kauth_action_t action, void *cookie, void *arg0, void *arg1, 153 void *arg2, void *arg3) 154 { 155 int result; 156 enum kauth_system_req req; 157 158 result = KAUTH_RESULT_DEFER; 159 req = (enum kauth_system_req)arg0; 160 161 switch (action) { 162 case KAUTH_SYSTEM_CHSYSFLAGS: 163 if (securelevel > 0) 164 result = KAUTH_RESULT_DENY; 165 break; 166 167 case KAUTH_SYSTEM_TIME: 168 switch (req) { 169 case KAUTH_REQ_SYSTEM_TIME_BACKWARDS: 170 if (securelevel > 1) 171 result = KAUTH_RESULT_DENY; 172 break; 173 174 case KAUTH_REQ_SYSTEM_TIME_RTCOFFSET: 175 if (securelevel > 0) 176 result = KAUTH_RESULT_DENY; 177 break; 178 179 case KAUTH_REQ_SYSTEM_TIME_SYSTEM: { 180 struct timespec *ts = arg1; 181 struct timeval *delta = arg2; 182 183 /* 184 * Don't allow the time to be set forward so far it will wrap 185 * and become negative, thus allowing an attacker to bypass 186 * the next check below. The cutoff is 1 year before rollover 187 * occurs, so even if the attacker uses adjtime(2) to move 188 * the time past the cutoff, it will take a very long time 189 * to get to the wrap point. 190 * 191 * XXX: we check against INT_MAX since on 64-bit 192 * platforms, sizeof(int) != sizeof(long) and 193 * time_t is 32 bits even when atv.tv_sec is 64 bits. 194 */ 195 if (securelevel > 1 && 196 ((ts->tv_sec > INT_MAX - 365*24*60*60) || 197 (delta->tv_sec < 0 || delta->tv_usec < 0))) 198 result = KAUTH_RESULT_DENY; 199 200 break; 201 } 202 203 default: 204 break; 205 } 206 break; 207 208 case KAUTH_SYSTEM_LKM: 209 if (securelevel > 0) 210 result = KAUTH_RESULT_DENY; 211 break; 212 213 case KAUTH_SYSTEM_MOUNT: 214 switch (req) { 215 case KAUTH_REQ_SYSTEM_MOUNT_NEW: 216 if (securelevel > 1) 217 result = KAUTH_RESULT_DENY; 218 219 break; 220 221 case KAUTH_REQ_SYSTEM_MOUNT_UPDATE: 222 if (securelevel > 1) { 223 struct mount *mp = arg1; 224 u_long flags = (u_long)arg2; 225 226 /* Can only degrade from read/write to read-only. */ 227 if (flags != (mp->mnt_flag | MNT_RDONLY | MNT_RELOAD | 228 MNT_FORCE | MNT_UPDATE)) 229 result = KAUTH_RESULT_DENY; 230 } 231 232 break; 233 234 default: 235 break; 236 } 237 238 break; 239 240 case KAUTH_SYSTEM_SYSCTL: 241 switch (req) { 242 case KAUTH_REQ_SYSTEM_SYSCTL_ADD: 243 case KAUTH_REQ_SYSTEM_SYSCTL_DELETE: 244 case KAUTH_REQ_SYSTEM_SYSCTL_DESC: 245 if (securelevel > 0) 246 result = KAUTH_RESULT_DENY; 247 break; 248 249 default: 250 break; 251 } 252 break; 253 254 case KAUTH_SYSTEM_SETIDCORE: 255 if (securelevel > 0) 256 result = KAUTH_RESULT_DENY; 257 break; 258 259 case KAUTH_SYSTEM_DEBUG: 260 switch (req) { 261 case KAUTH_REQ_SYSTEM_DEBUG_IPKDB: 262 if (securelevel > 0) 263 result = KAUTH_RESULT_DENY; 264 break; 265 266 default: 267 break; 268 } 269 break; 270 } 271 272 return (result); 273 } 274 275 /* 276 * kauth(9) listener 277 * 278 * Security model: Traditional NetBSD 279 * Scope: Process 280 * Responsibility: Securelevel 281 */ 282 int 283 secmodel_securelevel_process_cb(kauth_cred_t cred, 284 kauth_action_t action, void *cookie, void *arg0, 285 void *arg1, void *arg2, void *arg3) 286 { 287 struct proc *p; 288 int result; 289 290 result = KAUTH_RESULT_DEFER; 291 p = arg0; 292 293 switch (action) { 294 case KAUTH_PROCESS_CANPROCFS: { 295 enum kauth_process_req req; 296 297 req = (enum kauth_process_req)arg2; 298 switch (req) { 299 case KAUTH_REQ_PROCESS_CANPROCFS_READ: 300 break; 301 302 case KAUTH_REQ_PROCESS_CANPROCFS_RW: 303 case KAUTH_REQ_PROCESS_CANPROCFS_WRITE: 304 if ((p == initproc) && (securelevel > -1)) 305 result = KAUTH_RESULT_DENY; 306 307 break; 308 309 default: 310 break; 311 } 312 313 break; 314 } 315 316 case KAUTH_PROCESS_CANPTRACE: 317 case KAUTH_PROCESS_CANSYSTRACE: 318 if ((p == initproc) && (securelevel >= 0)) 319 result = KAUTH_RESULT_DENY; 320 321 break; 322 323 case KAUTH_PROCESS_CORENAME: 324 if (securelevel > 1) 325 result = KAUTH_RESULT_DENY; 326 break; 327 } 328 329 return (result); 330 } 331 332 /* 333 * kauth(9) listener 334 * 335 * Security model: Traditional NetBSD 336 * Scope: Network 337 * Responsibility: Securelevel 338 */ 339 int 340 secmodel_securelevel_network_cb(kauth_cred_t cred, 341 kauth_action_t action, void *cookie, void *arg0, 342 void *arg1, void *arg2, void *arg3) 343 { 344 int result; 345 enum kauth_network_req req; 346 347 result = KAUTH_RESULT_DEFER; 348 req = (enum kauth_network_req)arg0; 349 350 switch (action) { 351 case KAUTH_NETWORK_FIREWALL: 352 switch (req) { 353 case KAUTH_REQ_NETWORK_FIREWALL_FW: 354 case KAUTH_REQ_NETWORK_FIREWALL_NAT: 355 if (securelevel > 1) 356 result = KAUTH_RESULT_DENY; 357 break; 358 359 default: 360 break; 361 } 362 break; 363 364 case KAUTH_NETWORK_FORWSRCRT: 365 if (securelevel > 0) 366 result = KAUTH_RESULT_DENY; 367 break; 368 } 369 370 return (result); 371 } 372 373 /* 374 * kauth(9) listener 375 * 376 * Security model: Traditional NetBSD 377 * Scope: Machdep 378 * Responsibility: Securelevel 379 */ 380 int 381 secmodel_securelevel_machdep_cb(kauth_cred_t cred, 382 kauth_action_t action, void *cookie, void *arg0, 383 void *arg1, void *arg2, void *arg3) 384 { 385 int result; 386 387 result = KAUTH_RESULT_DEFER; 388 389 switch (action) { 390 case KAUTH_MACHDEP_IOPERM_SET: 391 case KAUTH_MACHDEP_IOPL: 392 if (securelevel > 0) 393 result = KAUTH_RESULT_DENY; 394 break; 395 396 case KAUTH_MACHDEP_UNMANAGEDMEM: 397 if (securelevel > 0) 398 result = KAUTH_RESULT_DENY; 399 break; 400 } 401 402 return (result); 403 } 404 405 /* 406 * kauth(9) listener 407 * 408 * Security model: Traditional NetBSD 409 * Scope: Device 410 * Responsibility: Securelevel 411 */ 412 int 413 secmodel_securelevel_device_cb(kauth_cred_t cred, 414 kauth_action_t action, void *cookie, void *arg0, 415 void *arg1, void *arg2, void *arg3) 416 { 417 int result; 418 419 result = KAUTH_RESULT_DEFER; 420 421 switch (action) { 422 case KAUTH_DEVICE_RAWIO_SPEC: { 423 struct vnode *vp, *bvp; 424 enum kauth_device_req req; 425 dev_t dev; 426 int d_type; 427 428 req = (enum kauth_device_req)arg0; 429 vp = arg1; 430 431 KASSERT(vp != NULL); 432 433 dev = vp->v_un.vu_specinfo->si_rdev; 434 d_type = D_OTHER; 435 bvp = NULL; 436 437 /* Handle /dev/mem and /dev/kmem. */ 438 if ((vp->v_type == VCHR) && iskmemdev(dev)) { 439 switch (req) { 440 case KAUTH_REQ_DEVICE_RAWIO_SPEC_READ: 441 break; 442 443 case KAUTH_REQ_DEVICE_RAWIO_SPEC_WRITE: 444 case KAUTH_REQ_DEVICE_RAWIO_SPEC_RW: 445 if (securelevel > 0) 446 result = KAUTH_RESULT_DENY; 447 break; 448 } 449 450 break; 451 } 452 453 switch (req) { 454 case KAUTH_REQ_DEVICE_RAWIO_SPEC_READ: 455 break; 456 457 case KAUTH_REQ_DEVICE_RAWIO_SPEC_WRITE: 458 case KAUTH_REQ_DEVICE_RAWIO_SPEC_RW: 459 switch (vp->v_type) { 460 case VCHR: { 461 const struct cdevsw *cdev; 462 463 cdev = cdevsw_lookup(dev); 464 if (cdev != NULL) { 465 dev_t blkdev; 466 467 blkdev = devsw_chr2blk(dev); 468 if (blkdev != NODEV) { 469 vfinddev(blkdev, VBLK, &bvp); 470 if (bvp != NULL) 471 d_type = (cdev->d_flag 472 & D_TYPEMASK); 473 } 474 } 475 476 break; 477 } 478 case VBLK: { 479 const struct bdevsw *bdev; 480 481 bdev = bdevsw_lookup(dev); 482 if (bdev != NULL) 483 d_type = (bdev->d_flag & D_TYPEMASK); 484 485 bvp = vp; 486 487 break; 488 } 489 490 default: 491 break; 492 } 493 494 if (d_type != D_DISK) 495 break; 496 497 /* 498 * XXX: This is bogus. We should be failing the request 499 * XXX: not only if this specific slice is mounted, but 500 * XXX: if it's on a disk with any other mounted slice. 501 */ 502 if (vfs_mountedon(bvp) && (securelevel > 0)) 503 break; 504 505 if (securelevel > 1) 506 result = KAUTH_RESULT_DENY; 507 508 break; 509 } 510 511 break; 512 } 513 514 case KAUTH_DEVICE_RAWIO_PASSTHRU: 515 if (securelevel > 0) { 516 u_long bits; 517 518 bits = (u_long)arg0; 519 520 KASSERT(bits != 0); 521 KASSERT((bits & ~KAUTH_REQ_DEVICE_RAWIO_PASSTHRU_ALL) == 0); 522 523 if (bits & ~KAUTH_REQ_DEVICE_RAWIO_PASSTHRU_READCONF) 524 result = KAUTH_RESULT_DENY; 525 } 526 527 break; 528 } 529 530 return (result); 531 } 532
Indexes created Mon Sep 22 21:09:42 GMT 2025