Loading...
--- xnu/xnu-12377.101.15/security/mac_process.c
+++ xnu/xnu-1228/security/mac_process.c
@@ -1,8 +1,8 @@
/*
- * Copyright (c) 2007-2010 Apple Inc. All rights reserved.
+ * Copyright (c) 2007 Apple Inc. All rights reserved.
*
* @APPLE_OSREFERENCE_LICENSE_HEADER_START@
- *
+ *
* This file contains Original Code and/or Modifications of Original Code
* as defined in and that are subject to the Apple Public Source License
* Version 2.0 (the 'License'). You may not use this file except in
@@ -11,10 +11,10 @@
* unlawful or unlicensed copies of an Apple operating system, or to
* circumvent, violate, or enable the circumvention or violation of, any
* terms of an Apple operating system software license agreement.
- *
+ *
* Please obtain a copy of the License at
* http://www.opensource.apple.com/apsl/ and read it before using this file.
- *
+ *
* The Original Code and all software distributed under the License are
* distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
* EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
@@ -22,7 +22,7 @@
* FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
* Please see the License for the specific language governing rights and
* limitations under the License.
- *
+ *
* @APPLE_OSREFERENCE_LICENSE_HEADER_END@
*/
@@ -72,23 +72,10 @@
#include <sys/proc_internal.h>
#include <sys/kauth.h>
#include <sys/imgact.h>
-#include <sys/reason.h>
-#include <sys/vnode_internal.h>
-#include <mach/mach_types.h>
-#include <kern/task.h>
-#include <kern/zalloc.h>
-
-#include <os/hash.h>
#include <security/mac_internal.h>
-#include <security/mac_mach_internal.h>
-
-#include <bsd/security/audit/audit.h>
-
-#include <os/log.h>
-#include <kern/cs_blobs.h>
-#include <sys/spawn.h>
-#include <sys/spawn_internal.h>
+
+#include <bsd/bsm/audit_kernel.h>
struct label *
mac_cred_label_alloc(void)
@@ -96,11 +83,10 @@
struct label *label;
label = mac_labelzone_alloc(MAC_WAITOK);
- if (label == NULL) {
- return NULL;
- }
+ if (label == NULL)
+ return (NULL);
MAC_PERFORM(cred_label_init, label);
- return label;
+ return (label);
}
void
@@ -110,51 +96,12 @@
}
void
-mac_cred_label_seal(struct ucred *cred)
-{
-#if DEVELOPMENT || DEBUG
- struct label **seal = (struct label **)-1;
-
- zalloc_ro_update_field(ZONE_ID_MAC_LABEL, cred->cr_label, l_owner, &seal);
-#else
- (void)cred;
-#endif
-}
-
-void
mac_cred_label_free(struct label *label)
{
-#if DEVELOPMENT || DEBUG
- struct label **seal = (struct label **)-1;
-
- if (label->l_owner == seal) {
- seal = NULL;
- zalloc_ro_update_field(ZONE_ID_MAC_LABEL, label, l_owner, &seal);
- }
-#endif
-
MAC_PERFORM(cred_label_destroy, label);
mac_labelzone_free(label);
}
-struct label *
-mac_cred_label(struct ucred *cred)
-{
- return cred->cr_label;
-}
-
-bool
-mac_cred_label_is_equal(const struct label *a, const struct label *b)
-{
- return memcmp(a->l_perpolicy, b->l_perpolicy, sizeof(a->l_perpolicy)) == 0;
-}
-
-uint32_t
-mac_cred_label_hash_update(const struct label *a, uint32_t hash)
-{
- return os_hash_jenkins_update(a->l_perpolicy, sizeof(a->l_perpolicy), hash);
-}
-
int
mac_cred_label_externalize_audit(struct proc *p, struct mac *mac)
{
@@ -163,19 +110,19 @@
cr = kauth_cred_proc_ref(p);
- error = MAC_EXTERNALIZE_AUDIT(cred, mac_cred_label(cr),
+ error = MAC_EXTERNALIZE_AUDIT(cred, cr->cr_label,
mac->m_string, mac->m_buflen);
kauth_cred_unref(&cr);
- return error;
+ return (error);
}
void
mac_cred_label_destroy(kauth_cred_t cred)
{
- struct label *label = mac_cred_label(cred);
+
+ mac_cred_label_free(cred->cr_label);
cred->cr_label = NULL;
- mac_cred_label_free(label);
}
int
@@ -186,7 +133,7 @@
error = MAC_EXTERNALIZE(cred, label, elements, outbuf, outbuflen);
- return error;
+ return (error);
}
int
@@ -196,7 +143,7 @@
error = MAC_INTERNALIZE(cred, label, string);
- return error;
+ return (error);
}
/*
@@ -210,7 +157,7 @@
{
MAC_PERFORM(cred_label_associate_fork, cred, proc);
}
-
+
/*
* Initialize MAC label for the first kernel process, from which other
* kernel processes and threads are spawned.
@@ -218,6 +165,7 @@
void
mac_cred_label_associate_kernel(kauth_cred_t cred)
{
+
MAC_PERFORM(cred_label_associate_kernel, cred);
}
@@ -228,6 +176,7 @@
void
mac_cred_label_associate_user(kauth_cred_t cred)
{
+
MAC_PERFORM(cred_label_associate_user, cred);
}
@@ -239,47 +188,66 @@
void
mac_cred_label_associate(struct ucred *parent_cred, struct ucred *child_cred)
{
+
MAC_PERFORM(cred_label_associate, parent_cred, child_cred);
}
int
mac_execve_enter(user_addr_t mac_p, struct image_params *imgp)
{
- if (mac_p == USER_ADDR_NULL) {
- return 0;
+ struct user_mac mac;
+ struct label *execlabel;
+ char *buffer;
+ int error;
+ size_t ulen;
+
+ if (mac_p == USER_ADDR_NULL)
+ return (0);
+
+ if (IS_64BIT_PROCESS(current_proc())) {
+ error = copyin(mac_p, &mac, sizeof(mac));
+ } else {
+ struct mac mac32;
+ error = copyin(mac_p, &mac32, sizeof(mac32));
+ mac.m_buflen = mac32.m_buflen;
+ mac.m_string = CAST_USER_ADDR_T(mac32.m_string);
}
-
- return mac_do_set(current_proc(), mac_p,
- ^(char *input, __unused size_t len) {
- struct label *execlabel;
- int error;
-
- execlabel = mac_cred_label_alloc();
- if ((error = mac_cred_label_internalize(execlabel, input))) {
- mac_cred_label_free(execlabel);
- execlabel = NULL;
- }
-
- imgp->ip_execlabelp = execlabel;
- return error;
- });
+ if (error)
+ return (error);
+
+ error = mac_check_structmac_consistent(&mac);
+ if (error)
+ return (error);
+
+ execlabel = mac_cred_label_alloc();
+ MALLOC(buffer, char *, mac.m_buflen, M_MACTEMP, M_WAITOK);
+ error = copyinstr(CAST_USER_ADDR_T(mac.m_string), buffer, mac.m_buflen, &ulen);
+ if (error)
+ goto out;
+ AUDIT_ARG(mac_string, buffer);
+
+ error = mac_cred_label_internalize(execlabel, buffer);
+out:
+ if (error) {
+ mac_cred_label_free(execlabel);
+ execlabel = NULL;
+ }
+ imgp->ip_execlabelp = execlabel;
+ FREE(buffer, M_MACTEMP);
+ return (error);
}
/*
* When the subject's label changes, it may require revocation of privilege
* to mapped objects. This can't be done on-the-fly later with a unified
* buffer cache.
- *
- * XXX: CRF_MAC_ENFORCE should be in a kauth_cred_t field, rather
- * XXX: than a posix_cred_t field.
*/
void
mac_cred_label_update(kauth_cred_t cred, struct label *newlabel)
{
- posix_cred_t pcred = posix_cred_get(cred);
/* force label to be part of "matching" for credential */
- pcred->cr_flags |= CRF_MAC_ENFORCE;
+ cred->cr_flags |= CRF_MAC_ENFORCE;
/* inform the policies of the update */
MAC_PERFORM(cred_label_update, cred, newlabel);
@@ -290,16 +258,12 @@
{
int error;
-#if SECURITY_MAC_CHECK_ENFORCE
- /* 21167099 - only check if we allow write */
- if (!mac_proc_enforce) {
- return 0;
- }
-#endif
+ if (!mac_proc_enforce)
+ return (0);
MAC_CHECK(cred_check_label_update, cred, newlabel);
- return error;
+ return (error);
}
int
@@ -307,718 +271,272 @@
{
int error;
-#if SECURITY_MAC_CHECK_ENFORCE
- /* 21167099 - only check if we allow write */
- if (!mac_proc_enforce) {
- return 0;
- }
-#endif
+
+
+ if (!mac_proc_enforce)
+ return (0);
+
+
MAC_CHECK(cred_check_visible, u1, u2);
- return error;
-}
-
-int
-mac_proc_check_debug(proc_ident_t tracing_ident, kauth_cred_t tracing_cred, proc_ident_t traced_ident)
-{
- int error;
- bool enforce;
- proc_t tracingp;
-
-#if SECURITY_MAC_CHECK_ENFORCE
- /* 21167099 - only check if we allow write */
- if (!mac_proc_enforce) {
- return 0;
- }
-#endif
- /*
- * Once all mac hooks adopt proc_ident_t, finding proc_t and releasing
- * it below should go to mac_proc_check_enforce().
- */
- if ((tracingp = proc_find_ident(tracing_ident)) == PROC_NULL) {
- return ESRCH;
- }
- enforce = mac_proc_check_enforce(tracingp);
- proc_rele(tracingp);
-
- if (!enforce) {
- return 0;
- }
- MAC_CHECK(proc_check_debug, tracing_cred, traced_ident);
-
- return error;
-}
-
-int
-mac_proc_check_dump_core(struct proc *proc)
-{
- int error;
-
-#if SECURITY_MAC_CHECK_ENFORCE
- /* 21167099 - only check if we allow write */
- if (!mac_proc_enforce) {
- return 0;
- }
-#endif
- if (!mac_proc_check_enforce(proc)) {
- return 0;
- }
-
- MAC_CHECK(proc_check_dump_core, proc);
-
- return error;
-}
-
-int
-mac_proc_check_remote_thread_create(struct task *task, int flavor, thread_state_t new_state, mach_msg_type_number_t new_state_count)
-{
- proc_t curp = current_proc();
- proc_t proc;
- int error;
-
-#if SECURITY_MAC_CHECK_ENFORCE
- /* 21167099 - only check if we allow write */
- if (!mac_proc_enforce) {
- return 0;
- }
-#endif
- if (!mac_proc_check_enforce(curp)) {
- return 0;
- }
-
- proc = proc_find(task_pid(task));
- if (proc == PROC_NULL) {
- return ESRCH;
- }
-
- MAC_CHECK(proc_check_remote_thread_create, current_cached_proc_cred(curp),
- proc, flavor, new_state, new_state_count);
- proc_rele(proc);
-
- return error;
-}
-
-void
-mac_proc_notify_service_port_derive(struct mach_service_port_info *sp_info)
-{
- MAC_PERFORM(proc_notify_service_port_derive,
- current_cached_proc_cred(PROC_NULL), sp_info);
+
+ return (error);
+}
+
+/*
+ * called with process locked.
+ */
+void mac_proc_set_enforce(proc_t p, int enforce_flags)
+{
+ p->p_mac_enforce |= enforce_flags;
+}
+
+int
+mac_proc_check_debug(proc_t curp, struct proc *proc)
+{
+ kauth_cred_t cred;
+ int error;
+
+
+
+ if (!mac_proc_enforce ||
+ !mac_proc_check_enforce(curp, MAC_PROC_ENFORCE))
+ return (0);
+
+ cred = kauth_cred_proc_ref(curp);
+ MAC_CHECK(proc_check_debug, cred, proc);
+ kauth_cred_unref(&cred);
+
+ return (error);
}
int
mac_proc_check_fork(proc_t curp)
{
- int error;
-
-#if SECURITY_MAC_CHECK_ENFORCE
- /* 21167099 - only check if we allow write */
- if (!mac_proc_enforce) {
- return 0;
- }
-#endif
- if (!mac_proc_check_enforce(curp)) {
- return 0;
- }
-
- MAC_CHECK(proc_check_fork, current_cached_proc_cred(curp), curp);
-
- return error;
-}
-
-int
-mac_proc_check_get_task(struct ucred *cred, proc_ident_t pident, mach_task_flavor_t flavor)
-{
- int error;
-
- assert(flavor <= TASK_FLAVOR_NAME);
-
- MAC_CHECK(proc_check_get_task_with_flavor, cred, pident, flavor);
-
- return error;
-}
-
-int
-mac_proc_check_expose_task(struct ucred *cred, proc_ident_t pident, mach_task_flavor_t flavor)
-{
- int error;
-
- assert(flavor <= TASK_FLAVOR_NAME);
-
- MAC_CHECK(proc_check_expose_task_with_flavor, cred, pident, flavor);
-
- return error;
-}
-
-int
-mac_proc_check_inherit_ipc_ports(
- struct proc *p,
- struct vnode *cur_vp,
- off_t cur_offset,
- struct vnode *img_vp,
- off_t img_offset,
- struct vnode *scriptvp)
-{
- int error;
-
- MAC_CHECK(proc_check_inherit_ipc_ports, p, cur_vp, cur_offset, img_vp, img_offset, scriptvp);
-
- return error;
-}
-
-int
-mac_proc_check_iopolicysys(struct proc *p, kauth_cred_t cred, int cmd, int type, int scope, int policy)
-{
- int error;
-
-#if SECURITY_MAC_CHECK_ENFORCE
- /* 21167099 - only check if we allow write */
- if (!mac_system_enforce) {
- return 0;
- }
-#endif
-
- MAC_CHECK(proc_check_iopolicysys, p, cred, cmd, type, scope, policy);
-
- return error;
-}
-
-/*
- * The type of maxprot in proc_check_map_anon must be equivalent to vm_prot_t
- * (defined in <mach/vm_prot.h>). mac_policy.h does not include any header
- * files, so cannot use the typedef itself.
- */
-int
-mac_proc_check_map_anon(proc_t proc, kauth_cred_t cred, user_addr_t u_addr,
- user_size_t u_size, int prot, int flags, int *maxprot)
-{
- int error;
-
-#if SECURITY_MAC_CHECK_ENFORCE
- /* 21167099 - only check if we allow write */
- if (!mac_vm_enforce) {
- return 0;
- }
-#endif
- if (!mac_proc_check_enforce(proc)) {
- return 0;
- }
-
- MAC_CHECK(proc_check_map_anon, proc, cred, u_addr, u_size, prot, flags, maxprot);
-
- return error;
-}
-
-
-int
-mac_proc_check_memorystatus_control(proc_t proc, uint32_t command, pid_t pid)
-{
- int error;
-
-#if SECURITY_MAC_CHECK_ENFORCE
- /* 21167099 - only check if we allow write */
- if (!mac_proc_enforce) {
- return 0;
- }
-#endif
- if (!mac_proc_check_enforce(proc)) {
- return 0;
- }
-
- MAC_CHECK(proc_check_memorystatus_control, current_cached_proc_cred(proc),
- command, pid);
-
- return error;
+ kauth_cred_t cred;
+ int error;
+
+ if (!mac_proc_enforce ||
+ !mac_proc_check_enforce(curp, MAC_PROC_ENFORCE))
+ return (0);
+
+ cred = kauth_cred_proc_ref(curp);
+ MAC_CHECK(proc_check_fork, cred, curp);
+ kauth_cred_unref(&cred);
+
+ return (error);
+}
+
+int
+mac_proc_check_get_task_name(struct ucred *cred, struct proc *p)
+{
+ int error;
+
+ MAC_CHECK(proc_check_get_task_name, cred, p);
+
+ return (error);
+}
+
+int
+mac_proc_check_get_task(struct ucred *cred, struct proc *p)
+{
+ int error;
+
+ MAC_CHECK(proc_check_get_task, cred, p);
+
+ return (error);
}
int
mac_proc_check_mprotect(proc_t proc,
user_addr_t addr, user_size_t size, int prot)
{
- int error;
-
-#if SECURITY_MAC_CHECK_ENFORCE
- /* 21167099 - only check if we allow write */
- if (!mac_vm_enforce) {
- return 0;
- }
-#endif
- if (!mac_proc_check_enforce(proc)) {
- return 0;
- }
-
- MAC_CHECK(proc_check_mprotect, current_cached_proc_cred(proc),
- proc, addr, size, prot);
-
- return error;
-}
-
-int
-mac_proc_check_run_cs_invalid(proc_t proc)
-{
- int error;
-
-#if SECURITY_MAC_CHECK_ENFORCE
- /* 21167099 - only check if we allow write */
- if (!mac_vm_enforce) {
- return 0;
- }
-#endif
-
- MAC_CHECK(proc_check_run_cs_invalid, proc);
-
- return error;
-}
-
-void
-mac_proc_notify_cs_invalidated(proc_t proc)
-{
- MAC_PERFORM(proc_notify_cs_invalidated, proc);
+ kauth_cred_t cred;
+ int error;
+
+ if (!mac_vm_enforce ||
+ !mac_proc_check_enforce(proc, MAC_VM_ENFORCE))
+ return (0);
+
+ cred = kauth_cred_proc_ref(proc);
+ MAC_CHECK(proc_check_mprotect, cred, proc, addr, size, prot);
+ kauth_cred_unref(&cred);
+
+ return (error);
}
int
mac_proc_check_sched(proc_t curp, struct proc *proc)
{
- int error;
-
-#if SECURITY_MAC_CHECK_ENFORCE
- /* 21167099 - only check if we allow write */
- if (!mac_proc_enforce) {
- return 0;
- }
-#endif
- if (!mac_proc_check_enforce(curp)) {
- return 0;
- }
-
- MAC_CHECK(proc_check_sched, current_cached_proc_cred(curp), proc);
-
- return error;
-}
-
-int
-mac_proc_check_signal(proc_t curp, proc_ident_t instigator, proc_ident_t target, int signum)
-{
- int error;
-
-#if SECURITY_MAC_CHECK_ENFORCE
- /* 21167099 - only check if we allow write */
- if (!mac_proc_enforce) {
- return 0;
- }
-#endif
- if (!mac_proc_check_enforce(curp)) {
- return 0;
- }
-
- /* Check policy without holding any proc refs */
- MAC_CHECK(proc_check_signal, current_cached_proc_cred(curp), instigator, target, signum);
- return error;
-}
-
-int
-mac_proc_check_syscall_unix(proc_t curp, int scnum)
-{
- int error;
-
-#if SECURITY_MAC_CHECK_ENFORCE
- /* 21167099 - only check if we allow write */
- if (!mac_proc_enforce) {
- return 0;
- }
-#endif
- if (!mac_proc_check_enforce(curp)) {
- return 0;
- }
-
- MAC_CHECK(proc_check_syscall_unix, curp, scnum);
-
- return error;
+ kauth_cred_t cred;
+ int error;
+
+
+
+ if (!mac_proc_enforce ||
+ !mac_proc_check_enforce(curp, MAC_PROC_ENFORCE))
+ return (0);
+
+ cred = kauth_cred_proc_ref(curp);
+ MAC_CHECK(proc_check_sched, cred, proc);
+ kauth_cred_unref(&cred);
+
+ return (error);
+}
+
+int
+mac_proc_check_signal(proc_t curp, struct proc *proc, int signum)
+{
+ kauth_cred_t cred;
+ int error;
+
+
+
+ if (!mac_proc_enforce ||
+ !mac_proc_check_enforce(curp, MAC_PROC_ENFORCE))
+ return (0);
+
+ cred = kauth_cred_proc_ref(curp);
+ MAC_CHECK(proc_check_signal, cred, proc, signum);
+ kauth_cred_unref(&cred);
+
+ return (error);
}
int
mac_proc_check_wait(proc_t curp, struct proc *proc)
{
- int error;
-
-#if SECURITY_MAC_CHECK_ENFORCE
- /* 21167099 - only check if we allow write */
- if (!mac_proc_enforce) {
- return 0;
- }
-#endif
- if (!mac_proc_check_enforce(curp)) {
- return 0;
- }
-
- MAC_CHECK(proc_check_wait, current_cached_proc_cred(curp), proc);
-
- return error;
-}
-
-void
-mac_proc_notify_exit(struct proc *proc)
-{
- MAC_PERFORM(proc_notify_exit, proc);
-}
-
-int
-mac_proc_check_suspend_resume(proc_t proc, int sr)
-{
- proc_t curp = current_proc();
- int error;
-
-#if SECURITY_MAC_CHECK_ENFORCE
- /* 21167099 - only check if we allow write */
- if (!mac_proc_enforce) {
- return 0;
- }
-#endif
- if (!mac_proc_check_enforce(curp)) {
- return 0;
- }
-
- MAC_CHECK(proc_check_suspend_resume, current_cached_proc_cred(curp),
- proc, sr);
-
- return error;
-}
-
-int
-mac_proc_check_ledger(proc_t curp, proc_t proc, int ledger_op)
-{
- int error = 0;
-
-#if SECURITY_MAC_CHECK_ENFORCE
- /* 21167099 - only check if we allow write */
- if (!mac_proc_enforce) {
- return 0;
- }
-#endif
- if (!mac_proc_check_enforce(curp)) {
- return 0;
- }
-
- MAC_CHECK(proc_check_ledger, current_cached_proc_cred(curp),
- proc, ledger_op);
-
- return error;
-}
-
-int
-mac_proc_check_proc_info(proc_t curp, proc_t target, int callnum, int flavor)
-{
- int error = 0;
-
-#if SECURITY_MAC_CHECK_ENFORCE
- /* 21167099 - only check if we allow write */
- if (!mac_proc_enforce) {
- return 0;
- }
-#endif
- if (!mac_proc_check_enforce(curp)) {
- return 0;
- }
-
- MAC_CHECK(proc_check_proc_info, current_cached_proc_cred(curp),
- target, callnum, flavor);
-
- return error;
-}
-
-int
-mac_proc_check_get_cs_info(proc_t curp, proc_t target, unsigned int op)
-{
- int error = 0;
-
-#if SECURITY_MAC_CHECK_ENFORCE
- /* 21167099 - only check if we allow write */
- if (!mac_proc_enforce) {
- return 0;
- }
-#endif
- if (!mac_proc_check_enforce(curp)) {
- return 0;
- }
-
- MAC_CHECK(proc_check_get_cs_info, current_cached_proc_cred(curp),
- target, op);
-
- return error;
-}
-
-int
-mac_proc_check_set_cs_info(proc_t curp, proc_t target, unsigned int op)
-{
- int error = 0;
-
-#if SECURITY_MAC_CHECK_ENFORCE
- /* 21167099 - only check if we allow write */
- if (!mac_proc_enforce) {
- return 0;
- }
-#endif
- if (!mac_proc_check_enforce(curp)) {
- return 0;
- }
-
- MAC_CHECK(proc_check_set_cs_info, current_cached_proc_cred(curp),
- target, op);
-
- return error;
-}
-
-int
-mac_proc_check_setuid(proc_t curp, kauth_cred_t cred, uid_t uid)
-{
- int error = 0;
-
-#if SECURITY_MAC_CHECK_ENFORCE
- /* 21167099 - only check if we allow write */
- if (!mac_proc_enforce) {
- return 0;
- }
-#endif
- if (!mac_proc_check_enforce(curp)) {
- return 0;
- }
-
- MAC_CHECK(proc_check_setuid, cred, uid);
-
- return error;
-}
-
-int
-mac_proc_check_seteuid(proc_t curp, kauth_cred_t cred, uid_t euid)
-{
- int error = 0;
-
-#if SECURITY_MAC_CHECK_ENFORCE
- /* 21167099 - only check if we allow write */
- if (!mac_proc_enforce) {
- return 0;
- }
-#endif
- if (!mac_proc_check_enforce(curp)) {
- return 0;
- }
-
- MAC_CHECK(proc_check_seteuid, cred, euid);
-
- return error;
-}
-
-int
-mac_proc_check_setreuid(proc_t curp, kauth_cred_t cred, uid_t ruid, uid_t euid)
-{
- int error = 0;
-
-#if SECURITY_MAC_CHECK_ENFORCE
- /* 21167099 - only check if we allow write */
- if (!mac_proc_enforce) {
- return 0;
- }
-#endif
- if (!mac_proc_check_enforce(curp)) {
- return 0;
- }
-
- MAC_CHECK(proc_check_setreuid, cred, ruid, euid);
-
- return error;
-}
-
-int
-mac_proc_check_setgid(proc_t curp, kauth_cred_t cred, gid_t gid)
-{
- int error = 0;
-
-#if SECURITY_MAC_CHECK_ENFORCE
- /* 21167099 - only check if we allow write */
- if (!mac_proc_enforce) {
- return 0;
- }
-#endif
- if (!mac_proc_check_enforce(curp)) {
- return 0;
- }
-
- MAC_CHECK(proc_check_setgid, cred, gid);
-
- return error;
-}
-
-int
-mac_proc_check_setegid(proc_t curp, kauth_cred_t cred, gid_t egid)
-{
- int error = 0;
-
-#if SECURITY_MAC_CHECK_ENFORCE
- /* 21167099 - only check if we allow write */
- if (!mac_proc_enforce) {
- return 0;
- }
-#endif
- if (!mac_proc_check_enforce(curp)) {
- return 0;
- }
-
- MAC_CHECK(proc_check_setegid, cred, egid);
-
- return error;
-}
-
-int
-mac_proc_check_setregid(proc_t curp, kauth_cred_t cred, gid_t rgid, gid_t egid)
-{
- int error = 0;
-
-#if SECURITY_MAC_CHECK_ENFORCE
- /* 21167099 - only check if we allow write */
- if (!mac_proc_enforce) {
- return 0;
- }
-#endif
- if (!mac_proc_check_enforce(curp)) {
- return 0;
- }
-
- MAC_CHECK(proc_check_setregid, cred, rgid, egid);
-
- return error;
-}
-
-int
-mac_proc_check_settid(proc_t curp, uid_t uid, gid_t gid)
-{
- int error = 0;
-
-#if SECURITY_MAC_CHECK_ENFORCE
- /* 21167099 - only check if we allow write */
- if (!mac_proc_enforce) {
- return 0;
- }
-#endif
- if (!mac_proc_check_enforce(curp)) {
- return 0;
- }
-
- MAC_CHECK(proc_check_settid, current_cached_proc_cred(curp),
- kauth_cred_get(), uid, gid);
-
- return error;
-}
-
-int
-mac_proc_check_launch_constraints(proc_t curp, struct image_params *imgp, os_reason_t *reasonp)
-{
- char *fatal_failure_desc = NULL;
- size_t fatal_failure_desc_len = 0;
-
- pid_t original_parent_id = proc_original_ppid(curp);
-
- pid_t responsible_pid = curp->p_responsible_pid;
-
- int error = 0;
-
- /* Vnode of the file */
- struct vnode *vp = imgp->ip_vp;
-
- char *vn_path = NULL;
- vm_size_t vn_pathlen = MAXPATHLEN;
-#if SECURITY_MAC_CHECK_ENFORCE
- /* 21167099 - only check if we allow write */
- if (!mac_proc_enforce || !mac_vnode_enforce) {
- return 0;
- }
-#endif
-
- MAC_POLICY_ITERATE({
- mpo_proc_check_launch_constraints_t *hook = mpc->mpc_ops->mpo_proc_check_launch_constraints;
- if (hook == NULL) {
- continue;
- }
-
- size_t spawnattrlen = 0;
- void *spawnattr = exec_spawnattr_getmacpolicyinfo(&imgp->ip_px_smpx, mpc->mpc_name, &spawnattrlen);
- struct _posix_spawnattr *psa = (struct _posix_spawnattr *) imgp->ip_px_sa;
- struct launch_constraint_data lcd;
- lcd.launch_type = CS_LAUNCH_TYPE_NONE;
-
- /* Check to see if psa_launch_type was initalized */
- if (psa != (struct _posix_spawnattr*)NULL) {
- lcd.launch_type = psa->psa_launch_type;
- }
-
- error = mac_error_select(
- hook(curp, original_parent_id, responsible_pid,
- spawnattr, spawnattrlen, &lcd, &fatal_failure_desc, &fatal_failure_desc_len), error);
-
- /*
- * Early exit in case of failure in case we have multiple registered callers.
- * This is to avoid other MACF policies from stomping on each other's failure description
- */
- if (fatal_failure_desc_len) {
- goto policy_fail;
- }
- });
-
-policy_fail:
- if (fatal_failure_desc_len) {
- /*
- * A fatal code signature validation failure occured, formulate a crash
- * reason.
- */
-
- char const *path = NULL;
-
- vn_path = zalloc(ZV_NAMEI);
- if (vn_getpath(vp, vn_path, (int*)&vn_pathlen) == 0) {
- path = vn_path;
- } else {
- path = "(get vnode path failed)";
- }
-
- if (error == 0) {
- panic("%s: MAC hook returned no error, but status is claimed to be fatal? "
- "path: '%s', fatal_failure_desc_len: %ld, fatal_failure_desc:\n%s\n",
- __func__, path, fatal_failure_desc_len, fatal_failure_desc);
- }
-
- os_reason_t reason = os_reason_create(OS_REASON_CODESIGNING,
- CODESIGNING_EXIT_REASON_LAUNCH_CONSTRAINT_VIOLATION);
-
- *reasonp = reason;
-
- reason->osr_flags = (OS_REASON_FLAG_GENERATE_CRASH_REPORT |
- OS_REASON_FLAG_CONSISTENT_FAILURE);
-
- if (fatal_failure_desc != NULL) {
- mach_vm_address_t data_addr = 0;
-
- int reason_error = 0;
- int kcdata_error = 0;
-
- if ((reason_error = os_reason_alloc_buffer_noblock(reason,
- kcdata_estimate_required_buffer_size(1,
- (uint32_t)fatal_failure_desc_len))) == 0) {
- if ((kcdata_error = kcdata_get_memory_addr(&reason->osr_kcd_descriptor,
- EXIT_REASON_USER_DESC, (uint32_t)fatal_failure_desc_len,
- &data_addr)) == KERN_SUCCESS) {
- kcdata_memcpy(&reason->osr_kcd_descriptor, (mach_vm_address_t)data_addr,
- fatal_failure_desc, (uint32_t)fatal_failure_desc_len);
- }
- }
- }
- }
-
- if (vn_path) {
- zfree(ZV_NAMEI, vn_path);
- }
-
- if (fatal_failure_desc_len > 0 && fatal_failure_desc != NULL) {
- kfree_data(fatal_failure_desc, fatal_failure_desc_len);
- }
-
- return error;
-}
+ kauth_cred_t cred;
+ int error;
+
+
+
+ if (!mac_proc_enforce ||
+ !mac_proc_check_enforce(curp, MAC_PROC_ENFORCE))
+ return (0);
+
+ cred = kauth_cred_proc_ref(curp);
+ MAC_CHECK(proc_check_wait, cred, proc);
+ kauth_cred_unref(&cred);
+
+ return (error);
+}
+
+#if CONFIG_LCTX
+/*
+ * Login Context
+ */
+
+int
+mac_proc_check_setlcid (struct proc *p0, struct proc *p,
+ pid_t pid, pid_t lcid)
+{
+ int error;
+
+ if (!mac_proc_enforce ||
+ !mac_proc_check_enforce(p0, MAC_PROC_ENFORCE))
+ return (0);
+
+ MAC_CHECK(proc_check_setlcid, p0, p, pid, lcid);
+ return (error);
+}
+
+int
+mac_proc_check_getlcid (struct proc *p0, struct proc *p, pid_t pid)
+{
+ int error;
+
+ if (!mac_proc_enforce ||
+ !mac_proc_check_enforce(p0, MAC_PROC_ENFORCE))
+ return (0);
+
+ MAC_CHECK(proc_check_getlcid, p0, p, pid);
+ return (error);
+}
+
+void
+mac_lctx_notify_create (struct proc *p, struct lctx *l)
+{
+ MAC_PERFORM(lctx_notify_create, p, l);
+}
+
+void
+mac_lctx_notify_join (struct proc *p, struct lctx *l)
+{
+ MAC_PERFORM(lctx_notify_join, p, l);
+}
+
+void
+mac_lctx_notify_leave (struct proc *p, struct lctx *l)
+{
+ MAC_PERFORM(lctx_notify_leave, p, l);
+}
+
+struct label *
+mac_lctx_label_alloc(void)
+{
+ struct label *label;
+
+ label = mac_labelzone_alloc(MAC_WAITOK);
+ if (label == NULL)
+ return (NULL);
+ MAC_PERFORM(lctx_label_init, label);
+ return (label);
+}
+
+void
+mac_lctx_label_free(struct label *label)
+{
+
+ MAC_PERFORM(lctx_label_destroy, label);
+ mac_labelzone_free(label);
+}
+
+int
+mac_lctx_label_externalize(struct label *label, char *elements,
+ char *outbuf, size_t outbuflen)
+{
+ int error;
+
+ error = MAC_EXTERNALIZE(lctx, label, elements, outbuf, outbuflen);
+
+ return (error);
+}
+
+int
+mac_lctx_label_internalize(struct label *label, char *string)
+{
+ int error;
+
+ error = MAC_INTERNALIZE(lctx, label, string);
+
+ return (error);
+}
+
+void
+mac_lctx_label_update(struct lctx *l, struct label *newlabel)
+{
+
+ MAC_PERFORM(lctx_label_update, l, newlabel);
+}
+
+int
+mac_lctx_check_label_update(struct lctx *l, struct label *newlabel)
+{
+ int error;
+
+ MAC_CHECK(lctx_check_label_update, l, newlabel);
+
+ return (error);
+}
+#endif /* LCTX */
+
+
+void
+mac_thread_userret(int code, int error, struct thread *thread)
+{
+
+ if (mac_late)
+ MAC_PERFORM(thread_userret, code, error, thread);
+}