1 /* 2 * Copyright (c) 2007-2012 Apple Inc. All rights reserved. 3 * 4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ 5 * 6 * This file contains Original Code and/or Modifications of Original Code 7 * as defined in and that are subject to the Apple Public Source License 8 * Version 2.0 (the 'License'). You may not use this file except in 9 * compliance with the License. The rights granted to you under the License 10 * may not be used to create, or enable the creation or redistribution of, 11 * unlawful or unlicensed copies of an Apple operating system, or to 12 * circumvent, violate, or enable the circumvention or violation of, any 13 * terms of an Apple operating system software license agreement. 14 * 15 * Please obtain a copy of the License at 16 * http://www.opensource.apple.com/apsl/ and read it before using this file. 17 * 18 * The Original Code and all software distributed under the License are 19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER 20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, 21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, 22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. 23 * Please see the License for the specific language governing rights and 24 * limitations under the License. 25 * 26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ 27 */ 28 /*- 29 * Copyright (c) 1999-2002 Robert N. M. Watson 30 * Copyright (c) 2001 Ilmar S. Habibulin 31 * Copyright (c) 2001-2005 Networks Associates Technology, Inc. 32 * Copyright (c) 2005 SPARTA, Inc. 33 * All rights reserved. 34 * 35 * This software was developed by Robert Watson and Ilmar Habibulin for the 36 * TrustedBSD Project. 37 * 38 * This software was developed for the FreeBSD Project in part by McAfee 39 * Research, the Technology Research Division of Network Associates, Inc. 40 * under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the 41 * DARPA CHATS research program. 42 * 43 * This software was enhanced by SPARTA ISSO under SPAWAR contract 44 * N66001-04-C-6019 ("SEFOS"). 45 * 46 * Redistribution and use in source and binary forms, with or without 47 * modification, are permitted provided that the following conditions 48 * are met: 49 * 1. Redistributions of source code must retain the above copyright 50 * notice, this list of conditions and the following disclaimer. 51 * 2. Redistributions in binary form must reproduce the above copyright 52 * notice, this list of conditions and the following disclaimer in the 53 * documentation and/or other materials provided with the distribution. 54 * 55 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 56 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 57 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 58 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 59 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 60 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 61 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 62 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 63 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 64 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 65 * SUCH DAMAGE. 66 */ 67 68 #include <sys/cdefs.h> 69 70 #include <sys/param.h> 71 #include <sys/kernel.h> 72 #include <sys/lock.h> 73 #include <sys/malloc.h> 74 #include <sys/sbuf.h> 75 #include <sys/systm.h> 76 #include <sys/mount.h> 77 #include <sys/file.h> 78 #include <sys/namei.h> 79 #include <sys/protosw.h> 80 #include <sys/socket.h> 81 #include <sys/socketvar.h> 82 #include <sys/sysctl.h> 83 #include <sys/kpi_socket.h> 84 85 #include <security/mac_internal.h> 86 87 int 88 mac_socket_check_accept(kauth_cred_t cred, struct socket *so) 89 { 90 int error; 91 92 #if SECURITY_MAC_CHECK_ENFORCE 93 /* 21167099 - only check if we allow write */ 94 if (!mac_socket_enforce) { 95 return 0; 96 } 97 #endif 98 99 MAC_CHECK(socket_check_accept, cred, 100 (socket_t)so, NULL); 101 return error; 102 } 103 104 #if CONFIG_MACF_SOCKET_SUBSET 105 int 106 mac_socket_check_accepted(kauth_cred_t cred, struct socket *so) 107 { 108 struct sockaddr *sockaddr; 109 int error; 110 111 #if SECURITY_MAC_CHECK_ENFORCE 112 /* 21167099 - only check if we allow write */ 113 if (!mac_socket_enforce) { 114 return 0; 115 } 116 #endif 117 118 if (sock_getaddr((socket_t)so, &sockaddr, 1) != 0) { 119 error = ECONNABORTED; 120 } else { 121 MAC_CHECK(socket_check_accepted, cred, 122 (socket_t)so, NULL, sockaddr); 123 sock_freeaddr(sockaddr); 124 } 125 return error; 126 } 127 #endif 128 129 int 130 mac_socket_check_bind(kauth_cred_t ucred, struct socket *so, 131 struct sockaddr *sockaddr) 132 { 133 int error; 134 135 #if SECURITY_MAC_CHECK_ENFORCE 136 /* 21167099 - only check if we allow write */ 137 if (!mac_socket_enforce) { 138 return 0; 139 } 140 #endif 141 142 MAC_CHECK(socket_check_bind, ucred, 143 (socket_t)so, NULL, sockaddr); 144 return error; 145 } 146 147 int 148 mac_socket_check_connect(kauth_cred_t cred, struct socket *so, 149 struct sockaddr *sockaddr) 150 { 151 int error; 152 153 #if SECURITY_MAC_CHECK_ENFORCE 154 /* 21167099 - only check if we allow write */ 155 if (!mac_socket_enforce) { 156 return 0; 157 } 158 #endif 159 160 MAC_CHECK(socket_check_connect, cred, 161 (socket_t)so, NULL, 162 sockaddr); 163 return error; 164 } 165 166 int 167 mac_socket_check_create(kauth_cred_t cred, int domain, int type, int protocol) 168 { 169 int error; 170 171 #if SECURITY_MAC_CHECK_ENFORCE 172 /* 21167099 - only check if we allow write */ 173 if (!mac_socket_enforce) { 174 return 0; 175 } 176 #endif 177 178 MAC_CHECK(socket_check_create, cred, domain, type, protocol); 179 return error; 180 } 181 182 int 183 mac_socket_check_ioctl(kauth_cred_t cred, struct socket *so, u_long cmd) 184 { 185 int error; 186 187 #if SECURITY_MAC_CHECK_ENFORCE 188 /* 21167099 - only check if we allow write */ 189 if (!mac_socket_enforce) { 190 return 0; 191 } 192 #endif 193 194 MAC_CHECK(socket_check_ioctl, cred, 195 (socket_t)so, cmd, NULL); 196 return error; 197 } 198 199 int 200 mac_socket_check_stat(kauth_cred_t cred, struct socket *so) 201 { 202 int error; 203 204 #if SECURITY_MAC_CHECK_ENFORCE 205 /* 21167099 - only check if we allow write */ 206 if (!mac_socket_enforce) { 207 return 0; 208 } 209 #endif 210 211 MAC_CHECK(socket_check_stat, cred, 212 (socket_t)so, NULL); 213 return error; 214 } 215 216 int 217 mac_socket_check_listen(kauth_cred_t cred, struct socket *so) 218 { 219 int error; 220 221 #if SECURITY_MAC_CHECK_ENFORCE 222 /* 21167099 - only check if we allow write */ 223 if (!mac_socket_enforce) { 224 return 0; 225 } 226 #endif 227 228 MAC_CHECK(socket_check_listen, cred, 229 (socket_t)so, NULL); 230 return error; 231 } 232 233 int 234 mac_socket_check_receive(kauth_cred_t cred, struct socket *so) 235 { 236 int error; 237 238 #if SECURITY_MAC_CHECK_ENFORCE 239 /* 21167099 - only check if we allow write */ 240 if (!mac_socket_enforce) { 241 return 0; 242 } 243 #endif 244 245 MAC_CHECK(socket_check_receive, cred, 246 (socket_t)so, NULL); 247 return error; 248 } 249 250 int 251 mac_socket_check_received(kauth_cred_t cred, struct socket *so, struct sockaddr *saddr) 252 { 253 int error; 254 255 #if SECURITY_MAC_CHECK_ENFORCE 256 /* 21167099 - only check if we allow write */ 257 if (!mac_socket_enforce) { 258 return 0; 259 } 260 #endif 261 262 MAC_CHECK(socket_check_received, cred, 263 so, NULL, saddr); 264 return error; 265 } 266 267 int 268 mac_socket_check_send(kauth_cred_t cred, struct socket *so, 269 struct sockaddr *sockaddr) 270 { 271 int error; 272 273 #if SECURITY_MAC_CHECK_ENFORCE 274 /* 21167099 - only check if we allow write */ 275 if (!mac_socket_enforce) { 276 return 0; 277 } 278 #endif 279 280 MAC_CHECK(socket_check_send, cred, 281 (socket_t)so, NULL, sockaddr); 282 return error; 283 } 284 285 int 286 mac_socket_check_setsockopt(kauth_cred_t cred, struct socket *so, 287 struct sockopt *sopt) 288 { 289 int error; 290 291 #if SECURITY_MAC_CHECK_ENFORCE 292 /* 21167099 - only check if we allow write */ 293 if (!mac_socket_enforce) { 294 return 0; 295 } 296 #endif 297 298 MAC_CHECK(socket_check_setsockopt, cred, 299 (socket_t)so, NULL, sopt); 300 return error; 301 } 302 303 int 304 mac_socket_check_getsockopt(kauth_cred_t cred, struct socket *so, 305 struct sockopt *sopt) 306 { 307 int error; 308 309 #if SECURITY_MAC_CHECK_ENFORCE 310 /* 21167099 - only check if we allow write */ 311 if (!mac_socket_enforce) { 312 return 0; 313 } 314 #endif 315 316 MAC_CHECK(socket_check_getsockopt, cred, 317 (socket_t)so, NULL, sopt); 318 return error; 319 } 320