PERFORCE change 108416 for review
Todd Miller
millert at FreeBSD.org
Wed Oct 25 12:33:12 PDT 2006
http://perforce.freebsd.org/chv.cgi?CH=108416
Change 108416 by millert at millert_macbook on 2006/10/25 19:24:34
Change ikm_sender from struct ipc_labelh * to task_t. This
allows us to report the correct sender in the avc audit
logs for MiG-based permissions. To do this, we now pass a
struct proc * to mpo_port_check_method.
This change may be reverted in the future but is very useful
for debugging.
Affected files ...
.. //depot/projects/trustedbsd/sedarwin8/darwin/xnu/osfmk/ipc/ipc_kmsg.c#3 edit
.. //depot/projects/trustedbsd/sedarwin8/darwin/xnu/osfmk/ipc/ipc_kmsg.h#2 edit
.. //depot/projects/trustedbsd/sedarwin8/darwin/xnu/osfmk/ipc/ipc_mqueue.c#3 edit
.. //depot/projects/trustedbsd/sedarwin8/darwin/xnu/osfmk/ipc/mach_msg.c#5 edit
.. //depot/projects/trustedbsd/sedarwin8/darwin/xnu/security/mac_mach_internal.h#8 edit
.. //depot/projects/trustedbsd/sedarwin8/darwin/xnu/security/mac_policy.h#16 edit
.. //depot/projects/trustedbsd/sedarwin8/darwin/xnu/security/mac_port.c#7 edit
.. //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/sedarwin/avc/avc.c#3 edit
.. //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/sedarwin/avc/avc.h#2 edit
.. //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/sedarwin/sebsd.c#25 edit
.. //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/sedarwin/sebsd.h#5 edit
.. //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/sedarwin/ss/mach_av.c#6 edit
Differences ...
==== //depot/projects/trustedbsd/sedarwin8/darwin/xnu/osfmk/ipc/ipc_kmsg.c#3 (text+ko) ====
@@ -294,9 +294,10 @@
ipc_port_t port;
#ifdef MAC
- if (kmsg->ikm_sender != NULL){
- labelh_release (kmsg->ikm_sender);
- kmsg->ikm_sender = NULL;
+ if (kmsg->ikm_sender != NULL) {
+ labelh_release(kmsg->ikm_sender->label);
+ task_deallocate(kmsg->ikm_sender);
+ kmsg->ikm_sender = NULL;
}
#endif
@@ -663,8 +664,9 @@
#ifdef MAC
if (kmsg->ikm_sender != NULL) {
- labelh_release (kmsg->ikm_sender);
- kmsg->ikm_sender = NULL;
+ labelh_release(kmsg->ikm_sender->label);
+ task_deallocate(kmsg->ikm_sender);
+ kmsg->ikm_sender = NULL;
}
#endif
}
@@ -769,13 +771,13 @@
#endif
#ifdef MAC
- task_t cur = current_thread()->task;
- if (cur)
- {
- labelh_reference (cur->label);
- kmsg->ikm_sender = cur->label;
- }
- else
+ /* XXX - why do we zero sender labels here instead of in mach_msg()? */
+ task_t cur = current_task();
+ if (cur) {
+ task_reference(cur);
+ labelh_reference(cur->label);
+ kmsg->ikm_sender = cur;
+ } else
trailer->msgh_labels.sender = 0;
#else
trailer->msgh_labels.sender = 0;
@@ -869,7 +871,7 @@
trailer->msgh_labels.sender = 0;
#ifdef MAC
- kmsg->ikm_sender = (ipc_labelh_t)NULL;
+ kmsg->ikm_sender = NULL;
#endif
*kmsgp = kmsg;
return MACH_MSG_SUCCESS;
==== //depot/projects/trustedbsd/sedarwin8/darwin/xnu/osfmk/ipc/ipc_kmsg.h#2 (text+ko) ====
@@ -94,7 +94,7 @@
struct ipc_kmsg *ikm_prev;
ipc_port_t ikm_prealloc; /* port we were preallocated from */
mach_msg_size_t ikm_size;
- struct ipc_labelh *ikm_sender;
+ task_t ikm_sender;
mach_msg_header_t *ikm_header;
};
==== //depot/projects/trustedbsd/sedarwin8/darwin/xnu/osfmk/ipc/ipc_mqueue.c#3 (text+ko) ====
@@ -716,7 +716,7 @@
#ifdef MAC
if (self->ith_kmsg != NULL &&
self->ith_kmsg->ikm_sender != NULL) {
- lh = self->ith_kmsg->ikm_sender;
+ lh = self->ith_kmsg->ikm_sender->label;
task = current_task();
tasklabel_lock(task);
ip_lock(lh->lh_port);
@@ -745,7 +745,7 @@
#ifdef MAC
if (self->ith_kmsg != NULL &&
self->ith_kmsg->ikm_sender != NULL) {
- lh = self->ith_kmsg->ikm_sender;
+ lh = self->ith_kmsg->ikm_sender->label;
task = current_task();
tasklabel_lock(task);
ip_lock(lh->lh_port);
==== //depot/projects/trustedbsd/sedarwin8/darwin/xnu/osfmk/ipc/mach_msg.c#5 (text+ko) ====
@@ -314,7 +314,8 @@
#ifdef MAC
if (kmsg->ikm_sender != NULL &&
IP_VALID(kmsg->ikm_header->msgh_remote_port) &&
- mac_port_check_method(&kmsg->ikm_sender->lh_label,
+ mac_port_check_method(kmsg->ikm_sender,
+ &kmsg->ikm_sender->maclabel,
&((ipc_port_t)kmsg->ikm_header->msgh_remote_port)->ip_label,
kmsg->ikm_header->msgh_id) == 0)
trailer->msgh_ad = 1;
@@ -331,7 +332,7 @@
if (option & MACH_RCV_TRAILER_ELEMENTS (MACH_RCV_TRAILER_LABELS)) {
#ifdef MAC
if (kmsg->ikm_sender != NULL) {
- ipc_labelh_t lh = kmsg->ikm_sender;
+ ipc_labelh_t lh = kmsg->ikm_sender->label;
kern_return_t kr;
ip_lock(lh->lh_port);
==== //depot/projects/trustedbsd/sedarwin8/darwin/xnu/security/mac_mach_internal.h#8 (text+ko) ====
@@ -31,7 +31,7 @@
void mac_task_label_update_internal(struct label *pl, struct task *t);
int mac_port_label_compute(struct label *subj, struct label *obj,
const char *serv, struct label *out);
-int mac_port_check_method(struct label *task, struct label *port, int msgid);
+int mac_port_check_method(task_t task, struct label *sub, struct label *obj, int msgid);
#ifdef MAC
void mac_policy_init(void);
==== //depot/projects/trustedbsd/sedarwin8/darwin/xnu/security/mac_policy.h#16 (text+ko) ====
@@ -2867,6 +2867,7 @@
/**
@brief Compute access control check for a Mach message-based service
+ @param proc Sender's process structure (may be NULL)
@param task Sender's task label
@param port Destination port label
@param msgid Message id
@@ -2884,6 +2885,7 @@
*/
typedef int mpo_port_check_method_t(
+ struct proc *proc,
struct label *task,
struct label *port,
int msgid
==== //depot/projects/trustedbsd/sedarwin8/darwin/xnu/security/mac_port.c#7 (text+ko) ====
@@ -244,11 +244,11 @@
}
int
-mac_port_check_method(struct label *task, struct label *port, int msgid)
+mac_port_check_method(task_t task, struct label *sub, struct label *obj, int msgid)
{
int error;
- MAC_CHECK(port_check_method, task, port, msgid);
+ MAC_CHECK(port_check_method, get_bsdtask_info(task), sub, obj, msgid);
return (error);
}
==== //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/sedarwin/avc/avc.c#3 (text+ko) ====
@@ -653,7 +653,7 @@
u16 tclass, u32 requested,
struct av_decision *avd, int result, struct avc_audit_data *a)
{
- struct proc *tsk = current_proc();
+ struct proc *tsk;
u32 denied, audited;
struct audit_buffer *ab;
@@ -679,10 +679,10 @@
audit_log_format(ab, "avc: %s ", denied ? "denied" : "granted");
avc_dump_av(ab, tclass,audited);
audit_log_format(ab, " for ");
-#ifdef __linux__
if (a && a->tsk)
tsk = a->tsk;
-#endif
+ else
+ tsk = current_proc(); /* XXX, should be set by caller */
if (tsk && tsk->p_pid) {
audit_log_format(ab, " pid=%d comm=", tsk->p_pid);
audit_log_untrustedstring(ab, tsk->p_comm);
@@ -799,6 +799,9 @@
a->u.net.netif);
#endif /* __linux__ */
break;
+ case AVC_AUDIT_DATA_MIG:
+ audit_log_format(ab, " msgid=%d", a->u.ipc_id);
+ break;
}
}
audit_log_format(ab, " ");
==== //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/sedarwin/avc/avc.h#2 (text+ko) ====
@@ -34,7 +34,7 @@
*/
struct avc_entry;
-struct task_struct;
+struct proc;
struct xsocket;
/* Auxiliary data to use in generating the audit record. */
@@ -44,9 +44,8 @@
#define AVC_AUDIT_DATA_NET 2
#define AVC_AUDIT_DATA_CAP 3
#define AVC_AUDIT_DATA_IPC 4
-#ifdef __linux__
- struct task_struct *tsk;
-#endif
+#define AVC_AUDIT_DATA_MIG 5
+ struct proc *tsk;
union {
struct {
struct vnode *vp;
==== //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/sedarwin/sebsd.c#25 (text+ko) ====
@@ -1481,14 +1481,15 @@
}
static int
-sebsd_port_check_method(struct label *subj, struct label *obj, int msgid)
+sebsd_port_check_method(struct proc *p, struct label *subj, struct label *obj,
+ int msgid)
{
struct task_security_struct *tsec, *psec;
psec = SLOT(obj);
tsec = SLOT(subj);
- return (sebsd_ipc_check_method1(tsec->sid,psec->sid, msgid));
+ return (sebsd_ipc_check_method1(p, tsec->sid, psec->sid, msgid));
}
static int
==== //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/sedarwin/sebsd.h#5 (text+ko) ====
@@ -57,6 +57,6 @@
extern int sebsd_syscall(struct proc *p, int call, user_addr_t args);
extern int cred_has_system(struct ucred *cred, u_int32_t perm);
extern int cred_has_security(struct ucred *cred, u_int32_t perm);
-extern int sebsd_ipc_check_method1(int subj, int obj, int msgid);
+extern int sebsd_ipc_check_method1(struct proc *p, int subj, int obj, int msgid);
#endif /* _SYS_SECURITY_SEBSD_H */
==== //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/sedarwin/ss/mach_av.c#6 (text+ko) ====
@@ -154,13 +154,18 @@
int
-sebsd_ipc_check_method1(int subj, int obj, int msgid)
+sebsd_ipc_check_method1(struct proc *p, int subj, int obj, int msgid)
{
struct msgid_classinfo *mcl;
u16 tclass;
u32 perms, cl;
int msgid_norm;
+ struct avc_audit_data ad;
+ AVC_AUDIT_DATA_INIT(&ad, MIG);
+ ad.u.ipc_id = msgid;
+ ad.tsk = p;
+
/*
* Return allowed for messages in an unknown subsystem.
* Instead, we probably should make a check against a
@@ -190,5 +195,5 @@
lck_rw_unlock_shared(migscs_rwlock);
perms = (u32)1 << (msgid_norm - (cl * 8 * sizeof(u32)));
- return avc_has_perm(subj, obj, tclass, perms, NULL);
+ return avc_has_perm(subj, obj, tclass, perms, &ad);
}
More information about the trustedbsd-cvs
mailing list