Home | History | Annotate | Line # | Download | only in securelevel
secmodel_securelevel.c revision 1.8.8.1 
      1 /* $NetBSD: secmodel_securelevel.c,v 1.8.8.1 2008/03/29 20:47:03 christos Exp $ */
      2 /*-
      3  * Copyright (c) 2006 Elad Efrat <elad (at) NetBSD.org>
      4  * All rights reserved.
      5  *
      6  * Redistribution and use in source and binary forms, with or without
      7  * modification, are permitted provided that the following conditions
      8  * are met:
      9  * 1. Redistributions of source code must retain the above copyright
     10  *    notice, this list of conditions and the following disclaimer.
     11  * 2. Redistributions in binary form must reproduce the above copyright
     12  *    notice, this list of conditions and the following disclaimer in the
     13  *    documentation and/or other materials provided with the distribution.
     14  * 3. The name of the author may not be used to endorse or promote products
     15  *    derived from this software without specific prior written permission.
     16  *
     17  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
     18  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
     19  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
     20  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
     21  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
     22  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
     23  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
     24  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
     25  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
     26  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     27  */
     28 
     29 /*
     30  * This file contains kauth(9) listeners needed to implement the traditional
     31  * NetBSD securelevel.
     32  *
     33  * The securelevel is a system-global indication on what operations are
     34  * allowed or not. It affects all users, including root.
     35  */
     36 
     37 #include <sys/cdefs.h>
     38 __KERNEL_RCSID(0, "$NetBSD: secmodel_securelevel.c,v 1.8.8.1 2008/03/29 20:47:03 christos Exp $");
     39 
     40 #ifdef _KERNEL_OPT
     41 #include "opt_insecure.h"
     42 #endif /* _KERNEL_OPT */
     43 
     44 #include <sys/types.h>
     45 #include <sys/param.h>
     46 #include <sys/kauth.h>
     47 
     48 #include <sys/conf.h>
     49 #include <sys/mount.h>
     50 #include <sys/sysctl.h>
     51 #include <sys/vnode.h>
     52 
     53 #include <miscfs/specfs/specdev.h>
     54 
     55 #include <secmodel/securelevel/securelevel.h>
     56 
     57 static int securelevel;
     58 
     59 static kauth_listener_t l_system, l_process, l_network, l_machdep, l_device;
     60 
     61 /*
     62  * sysctl helper routine for securelevel. ensures that the value
     63  * only rises unless the caller has pid 1 (assumed to be init).
     64  */
     65 int
     66 secmodel_securelevel_sysctl(SYSCTLFN_ARGS)
     67 {
     68 	int newsecurelevel, error;
     69 	struct sysctlnode node;
     70 
     71 	newsecurelevel = securelevel;
     72 	node = *rnode;
     73 	node.sysctl_data = &newsecurelevel;
     74 	error = sysctl_lookup(SYSCTLFN_CALL(&node));
     75 	if (error || newp == NULL)
     76 		return (error);
     77 
     78 	if (newsecurelevel < securelevel && l && l->l_proc->p_pid != 1)
     79 		return (EPERM);
     80 
     81 	securelevel = newsecurelevel;
     82 
     83 	return (error);
     84 }
     85 
     86 void
     87 secmodel_securelevel_init(void)
     88 {
     89 #ifdef INSECURE
     90 	securelevel = -1;
     91 #else
     92 	securelevel = 0;
     93 #endif /* INSECURE */
     94 }
     95 
     96 SYSCTL_SETUP(sysctl_security_securelevel_setup,
     97     "sysctl security securelevel setup")
     98 {
     99 	/*
    100 	 * For compatibility, we create a kern.securelevel variable.
    101 	 */
    102 	sysctl_createv(clog, 0, NULL, NULL,
    103 		       CTLFLAG_PERMANENT,
    104 		       CTLTYPE_NODE, "kern", NULL,
    105 		       NULL, 0, NULL, 0,
    106 		       CTL_KERN, CTL_EOL);
    107 
    108 	sysctl_createv(clog, 0, NULL, NULL,
    109 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
    110 		       CTLTYPE_INT, "securelevel",
    111 		       SYSCTL_DESCR("System security level"),
    112 		       secmodel_securelevel_sysctl, 0, NULL, 0,
    113 		       CTL_KERN, KERN_SECURELVL, CTL_EOL);
    114 }
    115 
    116 void
    117 secmodel_securelevel_start(void)
    118 {
    119 	l_system = kauth_listen_scope(KAUTH_SCOPE_SYSTEM,
    120 	    secmodel_securelevel_system_cb, NULL);
    121 	l_process = kauth_listen_scope(KAUTH_SCOPE_PROCESS,
    122 	    secmodel_securelevel_process_cb, NULL);
    123 	l_network = kauth_listen_scope(KAUTH_SCOPE_NETWORK,
    124 	    secmodel_securelevel_network_cb, NULL);
    125 	l_machdep = kauth_listen_scope(KAUTH_SCOPE_MACHDEP,
    126 	    secmodel_securelevel_machdep_cb, NULL);
    127 	l_device = kauth_listen_scope(KAUTH_SCOPE_DEVICE,
    128 	    secmodel_securelevel_device_cb, NULL);
    129 }
    130 
    131 #if defined(_LKM)
    132 void
    133 secmodel_securelevel_stop(void)
    134 {
    135 	kauth_unlisten_scope(l_system);
    136 	kauth_unlisten_scope(l_process);
    137 	kauth_unlisten_scope(l_network);
    138 	kauth_unlisten_scope(l_machdep);
    139 	kauth_unlisten_scope(l_device);
    140 }
    141 #endif /* _LKM */
    142 
    143 /*
    144  * kauth(9) listener
    145  *
    146  * Security model: Traditional NetBSD
    147  * Scope: System
    148  * Responsibility: Securelevel
    149  */
    150 int
    151 secmodel_securelevel_system_cb(kauth_cred_t cred,
    152     kauth_action_t action, void *cookie, void *arg0, void *arg1,
    153     void *arg2, void *arg3)
    154 {
    155 	int result;
    156 	enum kauth_system_req req;
    157 
    158 	result = KAUTH_RESULT_DEFER;
    159 	req = (enum kauth_system_req)arg0;
    160 
    161 	switch (action) {
    162 	case KAUTH_SYSTEM_CHSYSFLAGS:
    163 		if (securelevel > 0)
    164 			result = KAUTH_RESULT_DENY;
    165 		break;
    166 
    167 	case KAUTH_SYSTEM_TIME:
    168 		switch (req) {
    169 		case KAUTH_REQ_SYSTEM_TIME_RTCOFFSET:
    170 			if (securelevel > 0)
    171 				result = KAUTH_RESULT_DENY;
    172 			break;
    173 
    174 		case KAUTH_REQ_SYSTEM_TIME_SYSTEM: {
    175 			struct timespec *ts = arg1;
    176 			struct timespec *delta = arg2;
    177 
    178 			/*
    179 			 * Don't allow the time to be set forward so far it
    180 			 * will wrap and become negative, thus allowing an
    181 			 * attacker to bypass the next check below.  The
    182 			 * cutoff is 1 year before rollover occurs, so even
    183 			 * if the attacker uses adjtime(2) to move the time
    184 			 * past the cutoff, it will take a very long time
    185 			 * to get to the wrap point.
    186 			 */
    187 			if (securelevel > 1 &&
    188 			    ((ts->tv_sec > LLONG_MAX - 365*24*60*60) ||
    189 			     (delta->tv_sec < 0 || delta->tv_nsec < 0)))
    190 				result = KAUTH_RESULT_DENY;
    191 			break;
    192 		}
    193 
    194 		default:
    195 			break;
    196 		}
    197 		break;
    198 
    199 	case KAUTH_SYSTEM_LKM:
    200 	case KAUTH_SYSTEM_MODULE:
    201 		if (securelevel > 0)
    202 			result = KAUTH_RESULT_DENY;
    203 		break;
    204 
    205 	case KAUTH_SYSTEM_MOUNT:
    206 		switch (req) {
    207 		case KAUTH_REQ_SYSTEM_MOUNT_NEW:
    208 			if (securelevel > 1)
    209 				result = KAUTH_RESULT_DENY;
    210 
    211 			break;
    212 
    213 		case KAUTH_REQ_SYSTEM_MOUNT_UPDATE:
    214 			if (securelevel > 1) {
    215 				struct mount *mp = arg1;
    216 				u_long flags = (u_long)arg2;
    217 
    218 				/* Can only degrade from read/write to read-only. */
    219 				if (flags != (mp->mnt_flag | MNT_RDONLY | MNT_RELOAD |
    220 				    MNT_FORCE | MNT_UPDATE))
    221 					result = KAUTH_RESULT_DENY;
    222 			}
    223 
    224 			break;
    225 
    226 		default:
    227 			break;
    228 		}
    229 
    230 		break;
    231 
    232 	case KAUTH_SYSTEM_SYSCTL:
    233 		switch (req) {
    234 		case KAUTH_REQ_SYSTEM_SYSCTL_ADD:
    235 		case KAUTH_REQ_SYSTEM_SYSCTL_DELETE:
    236 		case KAUTH_REQ_SYSTEM_SYSCTL_DESC:
    237 			if (securelevel > 0)
    238 				result = KAUTH_RESULT_DENY;
    239 			break;
    240 
    241 		default:
    242 			break;
    243 		}
    244 		break;
    245 
    246 	case KAUTH_SYSTEM_SETIDCORE:
    247 		if (securelevel > 0)
    248 			result = KAUTH_RESULT_DENY;
    249 		break;
    250 
    251 	case KAUTH_SYSTEM_DEBUG:
    252 		switch (req) {
    253 		case KAUTH_REQ_SYSTEM_DEBUG_IPKDB:
    254 			if (securelevel > 0)
    255 				result = KAUTH_RESULT_DENY;
    256 			break;
    257 
    258 		default:
    259 			break;
    260 		}
    261 		break;
    262 	}
    263 
    264 	return (result);
    265 }
    266 
    267 /*
    268  * kauth(9) listener
    269  *
    270  * Security model: Traditional NetBSD
    271  * Scope: Process
    272  * Responsibility: Securelevel
    273  */
    274 int
    275 secmodel_securelevel_process_cb(kauth_cred_t cred,
    276     kauth_action_t action, void *cookie, void *arg0,
    277     void *arg1, void *arg2, void *arg3)
    278 {
    279 	struct proc *p;
    280 	int result;
    281 
    282 	result = KAUTH_RESULT_DEFER;
    283 	p = arg0;
    284 
    285 	switch (action) {
    286 	case KAUTH_PROCESS_PROCFS: {
    287 		enum kauth_process_req req;
    288 
    289 		req = (enum kauth_process_req)arg2;
    290 		switch (req) {
    291 		case KAUTH_REQ_PROCESS_PROCFS_READ:
    292 			break;
    293 
    294 		case KAUTH_REQ_PROCESS_PROCFS_RW:
    295 		case KAUTH_REQ_PROCESS_PROCFS_WRITE:
    296 			if ((p == initproc) && (securelevel > -1))
    297 				result = KAUTH_RESULT_DENY;
    298 
    299 			break;
    300 
    301 		default:
    302 			break;
    303 		}
    304 
    305 		break;
    306 		}
    307 
    308 	case KAUTH_PROCESS_PTRACE:
    309 		if ((p == initproc) && (securelevel >= 0))
    310 			result = KAUTH_RESULT_DENY;
    311 
    312 		break;
    313 
    314 	case KAUTH_PROCESS_CORENAME:
    315 		if (securelevel > 1)
    316 			result = KAUTH_RESULT_DENY;
    317 		break;
    318 	}
    319 
    320 	return (result);
    321 }
    322 
    323 /*
    324  * kauth(9) listener
    325  *
    326  * Security model: Traditional NetBSD
    327  * Scope: Network
    328  * Responsibility: Securelevel
    329  */
    330 int
    331 secmodel_securelevel_network_cb(kauth_cred_t cred,
    332     kauth_action_t action, void *cookie, void *arg0,
    333     void *arg1, void *arg2, void *arg3)
    334 {
    335 	int result;
    336 	enum kauth_network_req req;
    337 
    338 	result = KAUTH_RESULT_DEFER;
    339 	req = (enum kauth_network_req)arg0;
    340 
    341 	switch (action) {
    342 	case KAUTH_NETWORK_FIREWALL:
    343 		switch (req) {
    344 		case KAUTH_REQ_NETWORK_FIREWALL_FW:
    345 		case KAUTH_REQ_NETWORK_FIREWALL_NAT:
    346 			if (securelevel > 1)
    347 				result = KAUTH_RESULT_DENY;
    348 			break;
    349 
    350 		default:
    351 			break;
    352 		}
    353 		break;
    354 
    355 	case KAUTH_NETWORK_FORWSRCRT:
    356 		if (securelevel > 0)
    357 			result = KAUTH_RESULT_DENY;
    358 		break;
    359 	}
    360 
    361 	return (result);
    362 }
    363 
    364 /*
    365  * kauth(9) listener
    366  *
    367  * Security model: Traditional NetBSD
    368  * Scope: Machdep
    369  * Responsibility: Securelevel
    370  */
    371 int
    372 secmodel_securelevel_machdep_cb(kauth_cred_t cred,
    373     kauth_action_t action, void *cookie, void *arg0,
    374     void *arg1, void *arg2, void *arg3)
    375 {
    376         int result;
    377 
    378         result = KAUTH_RESULT_DEFER;
    379 
    380         switch (action) {
    381 	case KAUTH_MACHDEP_IOPERM_SET:
    382 	case KAUTH_MACHDEP_IOPL:
    383 		if (securelevel > 0)
    384 			result = KAUTH_RESULT_DENY;
    385 		break;
    386 
    387 	case KAUTH_MACHDEP_UNMANAGEDMEM:
    388 		if (securelevel > 0)
    389 			result = KAUTH_RESULT_DENY;
    390 		break;
    391 	}
    392 
    393 	return (result);
    394 }
    395 
    396 /*
    397  * kauth(9) listener
    398  *
    399  * Security model: Traditional NetBSD
    400  * Scope: Device
    401  * Responsibility: Securelevel
    402  */
    403 int
    404 secmodel_securelevel_device_cb(kauth_cred_t cred,
    405     kauth_action_t action, void *cookie, void *arg0,
    406     void *arg1, void *arg2, void *arg3)
    407 {
    408 	int result;
    409 
    410 	result = KAUTH_RESULT_DEFER;
    411 
    412 	switch (action) {
    413 	case KAUTH_DEVICE_RAWIO_SPEC: {
    414 		struct vnode *vp, *bvp;
    415 		enum kauth_device_req req;
    416 		dev_t dev;
    417 		int d_type;
    418 
    419 		req = (enum kauth_device_req)arg0;
    420 		vp = arg1;
    421 
    422 		KASSERT(vp != NULL);
    423 
    424 		dev = vp->v_rdev;
    425 		d_type = D_OTHER;
    426 		bvp = NULL;
    427 
    428 		/* Handle /dev/mem and /dev/kmem. */
    429 		if ((vp->v_type == VCHR) && iskmemdev(dev)) {
    430 			switch (req) {
    431 			case KAUTH_REQ_DEVICE_RAWIO_SPEC_READ:
    432 				break;
    433 
    434 			case KAUTH_REQ_DEVICE_RAWIO_SPEC_WRITE:
    435 			case KAUTH_REQ_DEVICE_RAWIO_SPEC_RW:
    436 				if (securelevel > 0)
    437 					result = KAUTH_RESULT_DENY;
    438 				break;
    439 			}
    440 
    441 			break;
    442 		}
    443 
    444 		switch (req) {
    445 		case KAUTH_REQ_DEVICE_RAWIO_SPEC_READ:
    446 			break;
    447 
    448 		case KAUTH_REQ_DEVICE_RAWIO_SPEC_WRITE:
    449 		case KAUTH_REQ_DEVICE_RAWIO_SPEC_RW:
    450 			switch (vp->v_type) {
    451 			case VCHR: {
    452 				const struct cdevsw *cdev;
    453 
    454 				cdev = cdevsw_lookup(dev);
    455 				if (cdev != NULL) {
    456 					dev_t blkdev;
    457 
    458 					blkdev = devsw_chr2blk(dev);
    459 					if (blkdev != NODEV) {
    460 						vfinddev(blkdev, VBLK, &bvp);
    461 						if (bvp != NULL)
    462 							d_type = (cdev->d_flag
    463 							    & D_TYPEMASK);
    464 					}
    465 				}
    466 
    467 				break;
    468 				}
    469 			case VBLK: {
    470 				const struct bdevsw *bdev;
    471 
    472 				bdev = bdevsw_lookup(dev);
    473 				if (bdev != NULL)
    474 					d_type = (bdev->d_flag & D_TYPEMASK);
    475 
    476 				bvp = vp;
    477 
    478 				break;
    479 				}
    480 
    481 			default:
    482 				break;
    483 			}
    484 
    485 			if (d_type != D_DISK)
    486 				break;
    487 
    488 			/*
    489 			 * XXX: This is bogus. We should be failing the request
    490 			 * XXX: not only if this specific slice is mounted, but
    491 			 * XXX: if it's on a disk with any other mounted slice.
    492 			 */
    493 			if (vfs_mountedon(bvp) && (securelevel > 0))
    494 				break;
    495 
    496 			if (securelevel > 1)
    497 				result = KAUTH_RESULT_DENY;
    498 
    499 			break;
    500 		}
    501 
    502 		break;
    503 		}
    504 
    505 	case KAUTH_DEVICE_RAWIO_PASSTHRU:
    506 		if (securelevel > 0) {
    507 			u_long bits;
    508 
    509 			bits = (u_long)arg0;
    510 
    511 			KASSERT(bits != 0);
    512 			KASSERT((bits & ~KAUTH_REQ_DEVICE_RAWIO_PASSTHRU_ALL) == 0);
    513 
    514 			if (bits & ~KAUTH_REQ_DEVICE_RAWIO_PASSTHRU_READCONF)
    515 				result = KAUTH_RESULT_DENY;
    516 		}
    517 
    518 		break;
    519 	}
    520 
    521 	return (result);
    522 }
    523