From 1cbfd977fdaf8581569f097b51c4a3d8e386aa0b Mon Sep 17 00:00:00 2001 From: Robert Watson Date: Tue, 22 Oct 2002 15:53:43 +0000 Subject: Introduce MAC_CHECK_VNODE_SWAPON, which permits MAC policies to perform authorization checks during swapon() events; policies might choose to enforce protections based on the credential requesting the swap configuration, the target of the swap operation, or other factors such as internal policy state. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories --- sys/kern/kern_mac.c | 22 ++++++++++++++++++++++ sys/security/mac/mac_framework.c | 22 ++++++++++++++++++++++ sys/security/mac/mac_framework.h | 1 + sys/security/mac/mac_internal.h | 22 ++++++++++++++++++++++ sys/security/mac/mac_net.c | 22 ++++++++++++++++++++++ sys/security/mac/mac_pipe.c | 22 ++++++++++++++++++++++ sys/security/mac/mac_policy.h | 3 +++ sys/security/mac/mac_process.c | 22 ++++++++++++++++++++++ sys/security/mac/mac_syscalls.c | 22 ++++++++++++++++++++++ sys/security/mac/mac_system.c | 22 ++++++++++++++++++++++ sys/security/mac/mac_vfs.c | 22 ++++++++++++++++++++++ sys/sys/mac.h | 1 + sys/sys/mac_policy.h | 3 +++ sys/vm/vm_swap.c | 8 +++++++- 14 files changed, 213 insertions(+), 1 deletion(-) diff --git a/sys/kern/kern_mac.c b/sys/kern/kern_mac.c index f80dfd6ccbab..29e5157e43b2 100644 --- a/sys/kern/kern_mac.c +++ b/sys/kern/kern_mac.c @@ -1026,6 +1026,10 @@ mac_policy_register(struct mac_policy_conf *mpc) mpc->mpc_ops->mpo_check_vnode_stat = mpe->mpe_function; break; + case MAC_CHECK_VNODE_SWAPON: + mpc->mpc_ops->mpo_check_vnode_swapon = + mpe->mpe_function; + break; case MAC_CHECK_VNODE_WRITE: mpc->mpc_ops->mpo_check_vnode_write = mpe->mpe_function; @@ -2603,6 +2607,24 @@ mac_check_vnode_stat(struct ucred *active_cred, struct ucred *file_cred, return (error); } +int +mac_check_vnode_swapon(struct ucred *cred, struct vnode *vp) +{ + int error; + + ASSERT_VOP_LOCKED(vp, "mac_check_vnode_swapon"); + + if (!mac_enforce_fs) + return (0); + + error = vn_refreshlabel(vp, cred); + if (error) + return (error); + + MAC_CHECK(check_vnode_swapon, cred, vp, &vp->v_label); + return (error); +} + int mac_check_vnode_write(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp) diff --git a/sys/security/mac/mac_framework.c b/sys/security/mac/mac_framework.c index f80dfd6ccbab..29e5157e43b2 100644 --- a/sys/security/mac/mac_framework.c +++ b/sys/security/mac/mac_framework.c @@ -1026,6 +1026,10 @@ mac_policy_register(struct mac_policy_conf *mpc) mpc->mpc_ops->mpo_check_vnode_stat = mpe->mpe_function; break; + case MAC_CHECK_VNODE_SWAPON: + mpc->mpc_ops->mpo_check_vnode_swapon = + mpe->mpe_function; + break; case MAC_CHECK_VNODE_WRITE: mpc->mpc_ops->mpo_check_vnode_write = mpe->mpe_function; @@ -2603,6 +2607,24 @@ mac_check_vnode_stat(struct ucred *active_cred, struct ucred *file_cred, return (error); } +int +mac_check_vnode_swapon(struct ucred *cred, struct vnode *vp) +{ + int error; + + ASSERT_VOP_LOCKED(vp, "mac_check_vnode_swapon"); + + if (!mac_enforce_fs) + return (0); + + error = vn_refreshlabel(vp, cred); + if (error) + return (error); + + MAC_CHECK(check_vnode_swapon, cred, vp, &vp->v_label); + return (error); +} + int mac_check_vnode_write(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp) diff --git a/sys/security/mac/mac_framework.h b/sys/security/mac/mac_framework.h index cc4bd262e452..5c094beefca4 100644 --- a/sys/security/mac/mac_framework.h +++ b/sys/security/mac/mac_framework.h @@ -348,6 +348,7 @@ int mac_check_vnode_setutimes(struct ucred *cred, struct vnode *vp, struct timespec atime, struct timespec mtime); int mac_check_vnode_stat(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp); +int mac_check_vnode_swapon(struct ucred *cred, struct vnode *vp); int mac_check_vnode_write(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp); int mac_getsockopt_label_get(struct ucred *cred, struct socket *so, diff --git a/sys/security/mac/mac_internal.h b/sys/security/mac/mac_internal.h index f80dfd6ccbab..29e5157e43b2 100644 --- a/sys/security/mac/mac_internal.h +++ b/sys/security/mac/mac_internal.h @@ -1026,6 +1026,10 @@ mac_policy_register(struct mac_policy_conf *mpc) mpc->mpc_ops->mpo_check_vnode_stat = mpe->mpe_function; break; + case MAC_CHECK_VNODE_SWAPON: + mpc->mpc_ops->mpo_check_vnode_swapon = + mpe->mpe_function; + break; case MAC_CHECK_VNODE_WRITE: mpc->mpc_ops->mpo_check_vnode_write = mpe->mpe_function; @@ -2603,6 +2607,24 @@ mac_check_vnode_stat(struct ucred *active_cred, struct ucred *file_cred, return (error); } +int +mac_check_vnode_swapon(struct ucred *cred, struct vnode *vp) +{ + int error; + + ASSERT_VOP_LOCKED(vp, "mac_check_vnode_swapon"); + + if (!mac_enforce_fs) + return (0); + + error = vn_refreshlabel(vp, cred); + if (error) + return (error); + + MAC_CHECK(check_vnode_swapon, cred, vp, &vp->v_label); + return (error); +} + int mac_check_vnode_write(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp) diff --git a/sys/security/mac/mac_net.c b/sys/security/mac/mac_net.c index f80dfd6ccbab..29e5157e43b2 100644 --- a/sys/security/mac/mac_net.c +++ b/sys/security/mac/mac_net.c @@ -1026,6 +1026,10 @@ mac_policy_register(struct mac_policy_conf *mpc) mpc->mpc_ops->mpo_check_vnode_stat = mpe->mpe_function; break; + case MAC_CHECK_VNODE_SWAPON: + mpc->mpc_ops->mpo_check_vnode_swapon = + mpe->mpe_function; + break; case MAC_CHECK_VNODE_WRITE: mpc->mpc_ops->mpo_check_vnode_write = mpe->mpe_function; @@ -2603,6 +2607,24 @@ mac_check_vnode_stat(struct ucred *active_cred, struct ucred *file_cred, return (error); } +int +mac_check_vnode_swapon(struct ucred *cred, struct vnode *vp) +{ + int error; + + ASSERT_VOP_LOCKED(vp, "mac_check_vnode_swapon"); + + if (!mac_enforce_fs) + return (0); + + error = vn_refreshlabel(vp, cred); + if (error) + return (error); + + MAC_CHECK(check_vnode_swapon, cred, vp, &vp->v_label); + return (error); +} + int mac_check_vnode_write(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp) diff --git a/sys/security/mac/mac_pipe.c b/sys/security/mac/mac_pipe.c index f80dfd6ccbab..29e5157e43b2 100644 --- a/sys/security/mac/mac_pipe.c +++ b/sys/security/mac/mac_pipe.c @@ -1026,6 +1026,10 @@ mac_policy_register(struct mac_policy_conf *mpc) mpc->mpc_ops->mpo_check_vnode_stat = mpe->mpe_function; break; + case MAC_CHECK_VNODE_SWAPON: + mpc->mpc_ops->mpo_check_vnode_swapon = + mpe->mpe_function; + break; case MAC_CHECK_VNODE_WRITE: mpc->mpc_ops->mpo_check_vnode_write = mpe->mpe_function; @@ -2603,6 +2607,24 @@ mac_check_vnode_stat(struct ucred *active_cred, struct ucred *file_cred, return (error); } +int +mac_check_vnode_swapon(struct ucred *cred, struct vnode *vp) +{ + int error; + + ASSERT_VOP_LOCKED(vp, "mac_check_vnode_swapon"); + + if (!mac_enforce_fs) + return (0); + + error = vn_refreshlabel(vp, cred); + if (error) + return (error); + + MAC_CHECK(check_vnode_swapon, cred, vp, &vp->v_label); + return (error); +} + int mac_check_vnode_write(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp) diff --git a/sys/security/mac/mac_policy.h b/sys/security/mac/mac_policy.h index 28ed3a85f2d3..aabc95e3e745 100644 --- a/sys/security/mac/mac_policy.h +++ b/sys/security/mac/mac_policy.h @@ -385,6 +385,8 @@ struct mac_policy_ops { int (*mpo_check_vnode_stat)(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp, struct label *label); + int (*mpo_check_vnode_swapon)(struct ucred *cred, + struct vnode *vp, struct label *label); int (*mpo_check_vnode_write)(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp, struct label *label); @@ -531,6 +533,7 @@ enum mac_op_constant { MAC_CHECK_VNODE_SETOWNER, MAC_CHECK_VNODE_SETUTIMES, MAC_CHECK_VNODE_STAT, + MAC_CHECK_VNODE_SWAPON, MAC_CHECK_VNODE_WRITE, }; diff --git a/sys/security/mac/mac_process.c b/sys/security/mac/mac_process.c index f80dfd6ccbab..29e5157e43b2 100644 --- a/sys/security/mac/mac_process.c +++ b/sys/security/mac/mac_process.c @@ -1026,6 +1026,10 @@ mac_policy_register(struct mac_policy_conf *mpc) mpc->mpc_ops->mpo_check_vnode_stat = mpe->mpe_function; break; + case MAC_CHECK_VNODE_SWAPON: + mpc->mpc_ops->mpo_check_vnode_swapon = + mpe->mpe_function; + break; case MAC_CHECK_VNODE_WRITE: mpc->mpc_ops->mpo_check_vnode_write = mpe->mpe_function; @@ -2603,6 +2607,24 @@ mac_check_vnode_stat(struct ucred *active_cred, struct ucred *file_cred, return (error); } +int +mac_check_vnode_swapon(struct ucred *cred, struct vnode *vp) +{ + int error; + + ASSERT_VOP_LOCKED(vp, "mac_check_vnode_swapon"); + + if (!mac_enforce_fs) + return (0); + + error = vn_refreshlabel(vp, cred); + if (error) + return (error); + + MAC_CHECK(check_vnode_swapon, cred, vp, &vp->v_label); + return (error); +} + int mac_check_vnode_write(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp) diff --git a/sys/security/mac/mac_syscalls.c b/sys/security/mac/mac_syscalls.c index f80dfd6ccbab..29e5157e43b2 100644 --- a/sys/security/mac/mac_syscalls.c +++ b/sys/security/mac/mac_syscalls.c @@ -1026,6 +1026,10 @@ mac_policy_register(struct mac_policy_conf *mpc) mpc->mpc_ops->mpo_check_vnode_stat = mpe->mpe_function; break; + case MAC_CHECK_VNODE_SWAPON: + mpc->mpc_ops->mpo_check_vnode_swapon = + mpe->mpe_function; + break; case MAC_CHECK_VNODE_WRITE: mpc->mpc_ops->mpo_check_vnode_write = mpe->mpe_function; @@ -2603,6 +2607,24 @@ mac_check_vnode_stat(struct ucred *active_cred, struct ucred *file_cred, return (error); } +int +mac_check_vnode_swapon(struct ucred *cred, struct vnode *vp) +{ + int error; + + ASSERT_VOP_LOCKED(vp, "mac_check_vnode_swapon"); + + if (!mac_enforce_fs) + return (0); + + error = vn_refreshlabel(vp, cred); + if (error) + return (error); + + MAC_CHECK(check_vnode_swapon, cred, vp, &vp->v_label); + return (error); +} + int mac_check_vnode_write(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp) diff --git a/sys/security/mac/mac_system.c b/sys/security/mac/mac_system.c index f80dfd6ccbab..29e5157e43b2 100644 --- a/sys/security/mac/mac_system.c +++ b/sys/security/mac/mac_system.c @@ -1026,6 +1026,10 @@ mac_policy_register(struct mac_policy_conf *mpc) mpc->mpc_ops->mpo_check_vnode_stat = mpe->mpe_function; break; + case MAC_CHECK_VNODE_SWAPON: + mpc->mpc_ops->mpo_check_vnode_swapon = + mpe->mpe_function; + break; case MAC_CHECK_VNODE_WRITE: mpc->mpc_ops->mpo_check_vnode_write = mpe->mpe_function; @@ -2603,6 +2607,24 @@ mac_check_vnode_stat(struct ucred *active_cred, struct ucred *file_cred, return (error); } +int +mac_check_vnode_swapon(struct ucred *cred, struct vnode *vp) +{ + int error; + + ASSERT_VOP_LOCKED(vp, "mac_check_vnode_swapon"); + + if (!mac_enforce_fs) + return (0); + + error = vn_refreshlabel(vp, cred); + if (error) + return (error); + + MAC_CHECK(check_vnode_swapon, cred, vp, &vp->v_label); + return (error); +} + int mac_check_vnode_write(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp) diff --git a/sys/security/mac/mac_vfs.c b/sys/security/mac/mac_vfs.c index f80dfd6ccbab..29e5157e43b2 100644 --- a/sys/security/mac/mac_vfs.c +++ b/sys/security/mac/mac_vfs.c @@ -1026,6 +1026,10 @@ mac_policy_register(struct mac_policy_conf *mpc) mpc->mpc_ops->mpo_check_vnode_stat = mpe->mpe_function; break; + case MAC_CHECK_VNODE_SWAPON: + mpc->mpc_ops->mpo_check_vnode_swapon = + mpe->mpe_function; + break; case MAC_CHECK_VNODE_WRITE: mpc->mpc_ops->mpo_check_vnode_write = mpe->mpe_function; @@ -2603,6 +2607,24 @@ mac_check_vnode_stat(struct ucred *active_cred, struct ucred *file_cred, return (error); } +int +mac_check_vnode_swapon(struct ucred *cred, struct vnode *vp) +{ + int error; + + ASSERT_VOP_LOCKED(vp, "mac_check_vnode_swapon"); + + if (!mac_enforce_fs) + return (0); + + error = vn_refreshlabel(vp, cred); + if (error) + return (error); + + MAC_CHECK(check_vnode_swapon, cred, vp, &vp->v_label); + return (error); +} + int mac_check_vnode_write(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp) diff --git a/sys/sys/mac.h b/sys/sys/mac.h index cc4bd262e452..5c094beefca4 100644 --- a/sys/sys/mac.h +++ b/sys/sys/mac.h @@ -348,6 +348,7 @@ int mac_check_vnode_setutimes(struct ucred *cred, struct vnode *vp, struct timespec atime, struct timespec mtime); int mac_check_vnode_stat(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp); +int mac_check_vnode_swapon(struct ucred *cred, struct vnode *vp); int mac_check_vnode_write(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp); int mac_getsockopt_label_get(struct ucred *cred, struct socket *so, diff --git a/sys/sys/mac_policy.h b/sys/sys/mac_policy.h index 28ed3a85f2d3..aabc95e3e745 100644 --- a/sys/sys/mac_policy.h +++ b/sys/sys/mac_policy.h @@ -385,6 +385,8 @@ struct mac_policy_ops { int (*mpo_check_vnode_stat)(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp, struct label *label); + int (*mpo_check_vnode_swapon)(struct ucred *cred, + struct vnode *vp, struct label *label); int (*mpo_check_vnode_write)(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp, struct label *label); @@ -531,6 +533,7 @@ enum mac_op_constant { MAC_CHECK_VNODE_SETOWNER, MAC_CHECK_VNODE_SETUTIMES, MAC_CHECK_VNODE_STAT, + MAC_CHECK_VNODE_SWAPON, MAC_CHECK_VNODE_WRITE, }; diff --git a/sys/vm/vm_swap.c b/sys/vm/vm_swap.c index 6d16e38b35de..f9355a3b1ebc 100644 --- a/sys/vm/vm_swap.c +++ b/sys/vm/vm_swap.c @@ -34,6 +34,7 @@ * $FreeBSD$ */ +#include "opt_mac.h" #include "opt_swap.h" #include @@ -52,6 +53,7 @@ #include #include #include +#include #include #include #include @@ -287,7 +289,11 @@ swaponvp(td, vp, dev, nblks) return EINVAL; found: (void) vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); - error = VOP_OPEN(vp, FREAD | FWRITE, td->td_ucred, td); +#ifdef MAC + error = mac_check_vnode_swapon(td->td_ucred, vp); + if (error == 0) +#endif + error = VOP_OPEN(vp, FREAD | FWRITE, td->td_ucred, td); (void) VOP_UNLOCK(vp, 0, td); if (error) return (error); -- cgit v1.2.3