module/os/freebsd/spl/spl_policy.c

   1 /*
   2  * Copyright (c) 2007 Pawel Jakub Dawidek <pjd@FreeBSD.org>
   3  * All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  * 1. Redistributions of source code must retain the above copyright
   9  *    notice, this list of conditions and the following disclaimer.
  10  * 2. Redistributions in binary form must reproduce the above copyright
  11  *    notice, this list of conditions and the following disclaimer in the
  12  *    documentation and/or other materials provided with the distribution.
  13  *
  14  * THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND
  15  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  16  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  17  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
  18  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  19  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  20  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  21  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  22  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  23  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  24  * SUCH DAMAGE.
  25  */
  26
  27 #include <sys/types.h>
  28 #include <sys/param.h>
  29 #include <sys/priv.h>
  30 #include <sys/vnode.h>
  31 #include <sys/mntent.h>
  32 #include <sys/mount.h>
  33 #include <sys/stat.h>
  34 #include <sys/jail.h>
  35 #include <sys/policy.h>
  36 #include <sys/zfs_vfsops.h>
  37 #include <sys/zfs_znode.h>
  38
  39
  40 int
  41 secpolicy_nfs(cred_t *cr)
  42 {
  43
  44         return (priv_check_cred(cr, PRIV_NFS_DAEMON));
  45 }
  46
  47 int
  48 secpolicy_zfs(cred_t *cr)
  49 {
  50
  51         return (priv_check_cred(cr, PRIV_VFS_MOUNT));
  52 }
  53
  54 int
  55 secpolicy_zfs_proc(cred_t *cr, proc_t *proc)
  56 {
  57
  58         return (priv_check_cred(cr, PRIV_VFS_MOUNT));
  59 }
  60
  61 int
  62 secpolicy_sys_config(cred_t *cr, int checkonly __unused)
  63 {
  64
  65         return (priv_check_cred(cr, PRIV_ZFS_POOL_CONFIG));
  66 }
  67
  68 int
  69 secpolicy_zinject(cred_t *cr)
  70 {
  71
  72         return (priv_check_cred(cr, PRIV_ZFS_INJECT));
  73 }
  74
  75 int
  76 secpolicy_fs_unmount(cred_t *cr, struct mount *vfsp __unused)
  77 {
  78
  79         return (priv_check_cred(cr, PRIV_VFS_UNMOUNT));
  80 }
  81
  82 int
  83 secpolicy_fs_owner(struct mount *mp, cred_t *cr)
  84 {
  85
  86         if (zfs_super_owner) {
  87                 if (cr->cr_uid == mp->mnt_cred->cr_uid &&
  88                     cr->cr_prison == mp->mnt_cred->cr_prison) {
  89                         return (0);
  90                 }
  91         }
  92         return (EPERM);
  93 }
  94
  95 /*
  96  * This check is done in kern_link(), so we could just return 0 here.
  97  */
  98 extern int hardlink_check_uid;
  99 int
 100 secpolicy_basic_link(vnode_t *vp, cred_t *cr)
 101 {
 102
 103         if (!hardlink_check_uid)
 104                 return (0);
 105         if (secpolicy_fs_owner(vp->v_mount, cr) == 0)
 106                 return (0);
 107         return (priv_check_cred(cr, PRIV_VFS_LINK));
 108 }
 109
 110 int
 111 secpolicy_vnode_stky_modify(cred_t *cr)
 112 {
 113
 114         return (EPERM);
 115 }
 116
 117 int
 118 secpolicy_vnode_remove(vnode_t *vp, cred_t *cr)
 119 {
 120
 121         if (secpolicy_fs_owner(vp->v_mount, cr) == 0)
 122                 return (0);
 123         return (priv_check_cred(cr, PRIV_VFS_ADMIN));
 124 }
 125
 126 int
 127 secpolicy_vnode_access(cred_t *cr, vnode_t *vp, uid_t owner, accmode_t accmode)
 128 {
 129
 130         if (secpolicy_fs_owner(vp->v_mount, cr) == 0)
 131                 return (0);
 132
 133         if ((accmode & VREAD) && priv_check_cred(cr, PRIV_VFS_READ) != 0)
 134                 return (EACCES);
 135         if ((accmode & VWRITE) &&
 136             priv_check_cred(cr, PRIV_VFS_WRITE) != 0) {
 137                 return (EACCES);
 138         }
 139         if (accmode & VEXEC) {
 140                 if (vp->v_type == VDIR) {
 141                         if (priv_check_cred(cr, PRIV_VFS_LOOKUP) != 0)
 142                                 return (EACCES);
 143                 } else {
 144                         if (priv_check_cred(cr, PRIV_VFS_EXEC) != 0)
 145                                 return (EACCES);
 146                 }
 147         }
 148         return (0);
 149 }
 150
 151 /*
 152  * Like secpolicy_vnode_access() but we get the actual wanted mode and the
 153  * current mode of the file, not the missing bits.
 154  */
 155 int
 156 secpolicy_vnode_access2(cred_t *cr, vnode_t *vp, uid_t owner,
 157     accmode_t curmode, accmode_t wantmode)
 158 {
 159         accmode_t mode;
 160
 161         mode = ~curmode & wantmode;
 162
 163         if (mode == 0)
 164                 return (0);
 165
 166         return (secpolicy_vnode_access(cr, vp, owner, mode));
 167 }
 168
 169 int
 170 secpolicy_vnode_any_access(cred_t *cr, vnode_t *vp, uid_t owner)
 171 {
 172         static int privs[] = {
 173             PRIV_VFS_ADMIN,
 174             PRIV_VFS_READ,
 175             PRIV_VFS_WRITE,
 176             PRIV_VFS_EXEC,
 177             PRIV_VFS_LOOKUP
 178         };
 179         int i;
 180
 181         if (secpolicy_fs_owner(vp->v_mount, cr) == 0)
 182                 return (0);
 183
 184         /* Same as secpolicy_vnode_setdac */
 185         if (owner == cr->cr_uid)
 186                 return (0);
 187
 188         for (i = 0; i < sizeof (privs)/sizeof (int); i++) {
 189                 int priv;
 190
 191                 switch (priv = privs[i]) {
 192                 case PRIV_VFS_EXEC:
 193                         if (vp->v_type == VDIR)
 194                                 continue;
 195                         break;
 196                 case PRIV_VFS_LOOKUP:
 197                         if (vp->v_type != VDIR)
 198                                 continue;
 199                         break;
 200                 }
 201                 if (priv_check_cred(cr, priv) == 0)
 202                         return (0);
 203         }
 204         return (EPERM);
 205 }
 206
 207 int
 208 secpolicy_vnode_setdac(vnode_t *vp, cred_t *cr, uid_t owner)
 209 {
 210
 211         if (owner == cr->cr_uid)
 212                 return (0);
 213         if (secpolicy_fs_owner(vp->v_mount, cr) == 0)
 214                 return (0);
 215         return (priv_check_cred(cr, PRIV_VFS_ADMIN));
 216 }
 217
 218 int
 219 secpolicy_vnode_setattr(cred_t *cr, vnode_t *vp, struct vattr *vap,
 220     const struct vattr *ovap, int flags,
 221     int unlocked_access(void *, int, cred_t *), void *node)
 222 {
 223         int mask = vap->va_mask;
 224         int error;
 225
 226         if (mask & AT_SIZE) {
 227                 if (vp->v_type == VDIR)
 228                         return (EISDIR);
 229                 error = unlocked_access(node, VWRITE, cr);
 230                 if (error)
 231                         return (error);
 232         }
 233         if (mask & AT_MODE) {
 234                 /*
 235                  * If not the owner of the file then check privilege
 236                  * for two things: the privilege to set the mode at all
 237                  * and, if we're setting setuid, we also need permissions
 238                  * to add the set-uid bit, if we're not the owner.
 239                  * In the specific case of creating a set-uid root
 240                  * file, we need even more permissions.
 241                  */
 242                 error = secpolicy_vnode_setdac(vp, cr, ovap->va_uid);
 243                 if (error)
 244                         return (error);
 245                 error = secpolicy_setid_setsticky_clear(vp, vap, ovap, cr);
 246                 if (error)
 247                         return (error);
 248         } else {
 249                 vap->va_mode = ovap->va_mode;
 250         }
 251         if (mask & (AT_UID | AT_GID)) {
 252                 error = secpolicy_vnode_setdac(vp, cr, ovap->va_uid);
 253                 if (error)
 254                         return (error);
 255
 256                 /*
 257                  * To change the owner of a file, or change the group of
 258                  * a file to a group of which we are not a member, the
 259                  * caller must have privilege.
 260                  */
 261                 if (((mask & AT_UID) && vap->va_uid != ovap->va_uid) ||
 262                     ((mask & AT_GID) && vap->va_gid != ovap->va_gid &&
 263                     !groupmember(vap->va_gid, cr))) {
 264                         if (secpolicy_fs_owner(vp->v_mount, cr) != 0) {
 265                                 error = priv_check_cred(cr, PRIV_VFS_CHOWN);
 266                                 if (error)
 267                                         return (error);
 268                         }
 269                 }
 270
 271                 if (((mask & AT_UID) && vap->va_uid != ovap->va_uid) ||
 272                     ((mask & AT_GID) && vap->va_gid != ovap->va_gid)) {
 273                         secpolicy_setid_clear(vap, vp, cr);
 274                 }
 275         }
 276         if (mask & (AT_ATIME | AT_MTIME)) {
 277                 /*
 278                  * From utimes(2):
 279                  * If times is NULL, ... The caller must be the owner of
 280                  * the file, have permission to write the file, or be the
 281                  * super-user.
 282                  * If times is non-NULL, ... The caller must be the owner of
 283                  * the file or be the super-user.
 284                  */
 285                 error = secpolicy_vnode_setdac(vp, cr, ovap->va_uid);
 286                 if (error && (vap->va_vaflags & VA_UTIMES_NULL))
 287                         error = unlocked_access(node, VWRITE, cr);
 288                 if (error)
 289                         return (error);
 290         }
 291         return (0);
 292 }
 293
 294 int
 295 secpolicy_vnode_create_gid(cred_t *cr)
 296 {
 297
 298         return (EPERM);
 299 }
 300
 301 int
 302 secpolicy_vnode_setids_setgids(vnode_t *vp, cred_t *cr, gid_t gid)
 303 {
 304
 305         if (groupmember(gid, cr))
 306                 return (0);
 307         if (secpolicy_fs_owner(vp->v_mount, cr) == 0)
 308                 return (0);
 309         return (priv_check_cred(cr, PRIV_VFS_SETGID));
 310 }
 311
 312 int
 313 secpolicy_vnode_setid_retain(znode_t *zp, cred_t *cr,
 314     boolean_t issuidroot __unused)
 315 {
 316
 317         if (secpolicy_fs_owner(ZTOV(zp)->v_mount, cr) == 0)
 318                 return (0);
 319         return (priv_check_cred(cr, PRIV_VFS_RETAINSUGID));
 320 }
 321
 322 void
 323 secpolicy_setid_clear(struct vattr *vap, vnode_t *vp, cred_t *cr)
 324 {
 325
 326         if (secpolicy_fs_owner(vp->v_mount, cr) == 0)
 327                 return;
 328
 329         if ((vap->va_mode & (S_ISUID | S_ISGID)) != 0) {
 330                 if (priv_check_cred(cr, PRIV_VFS_RETAINSUGID)) {
 331                         vap->va_mask |= AT_MODE;
 332                         vap->va_mode &= ~(S_ISUID|S_ISGID);
 333                 }
 334         }
 335 }
 336
 337 int
 338 secpolicy_setid_setsticky_clear(vnode_t *vp, struct vattr *vap,
 339     const struct vattr *ovap, cred_t *cr)
 340 {
 341         int error;
 342
 343         if (secpolicy_fs_owner(vp->v_mount, cr) == 0)
 344                 return (0);
 345
 346         /*
 347          * Privileged processes may set the sticky bit on non-directories,
 348          * as well as set the setgid bit on a file with a group that the process
 349          * is not a member of. Both of these are allowed in jail(8).
 350          */
 351         if (vp->v_type != VDIR && (vap->va_mode & S_ISTXT)) {
 352                 if (priv_check_cred(cr, PRIV_VFS_STICKYFILE))
 353                         return (EFTYPE);
 354         }
 355         /*
 356          * Check for privilege if attempting to set the
 357          * group-id bit.
 358          */
 359         if ((vap->va_mode & S_ISGID) != 0) {
 360                 error = secpolicy_vnode_setids_setgids(vp, cr, ovap->va_gid);
 361                 if (error)
 362                         return (error);
 363         }
 364         /*
 365          * Deny setting setuid if we are not the file owner.
 366          */
 367         if ((vap->va_mode & S_ISUID) && ovap->va_uid != cr->cr_uid) {
 368                 error = priv_check_cred(cr, PRIV_VFS_ADMIN);
 369                 if (error)
 370                         return (error);
 371         }
 372         return (0);
 373 }
 374
 375 int
 376 secpolicy_fs_mount(cred_t *cr, vnode_t *mvp, struct mount *vfsp)
 377 {
 378
 379         return (priv_check_cred(cr, PRIV_VFS_MOUNT));
 380 }
 381
 382 int
 383 secpolicy_vnode_owner(vnode_t *vp, cred_t *cr, uid_t owner)
 384 {
 385
 386         if (owner == cr->cr_uid)
 387                 return (0);
 388         if (secpolicy_fs_owner(vp->v_mount, cr) == 0)
 389                 return (0);
 390
 391         /* XXX: vfs_suser()? */
 392         return (priv_check_cred(cr, PRIV_VFS_MOUNT_OWNER));
 393 }
 394
 395 int
 396 secpolicy_vnode_chown(vnode_t *vp, cred_t *cr, uid_t owner)
 397 {
 398
 399         if (secpolicy_fs_owner(vp->v_mount, cr) == 0)
 400                 return (0);
 401         return (priv_check_cred(cr, PRIV_VFS_CHOWN));
 402 }
 403
 404 void
 405 secpolicy_fs_mount_clearopts(cred_t *cr, struct mount *vfsp)
 406 {
 407
 408         if (priv_check_cred(cr, PRIV_VFS_MOUNT_NONUSER) != 0) {
 409                 MNT_ILOCK(vfsp);
 410                 vfsp->vfs_flag |= VFS_NOSETUID | MNT_USER;
 411                 vfs_clearmntopt(vfsp, MNTOPT_SETUID);
 412                 vfs_setmntopt(vfsp, MNTOPT_NOSETUID, NULL, 0);
 413                 MNT_IUNLOCK(vfsp);
 414         }
 415 }
 416
 417 /*
 418  * Check privileges for setting xvattr attributes
 419  */
 420 int
 421 secpolicy_xvattr(vnode_t *vp, xvattr_t *xvap, uid_t owner, cred_t *cr,
 422     vtype_t vtype)
 423 {
 424
 425         if (secpolicy_fs_owner(vp->v_mount, cr) == 0)
 426                 return (0);
 427         return (priv_check_cred(cr, PRIV_VFS_SYSFLAGS));
 428 }
 429
 430 int
 431 secpolicy_smb(cred_t *cr)
 432 {
 433
 434         return (priv_check_cred(cr, PRIV_NETSMB));
 435 }