Author: rwatson
Date: Thu Mar 30 22:00:58 2017
New Revision: 316307
URL: https://svnweb.freebsd.org/changeset/base/316307
Log:
Add system-call argument auditing for ACL-related system calls.
Obtained from: TrustedBSD Project
MFC after: 3 weeks
Sponsored by: DARPA, AFRL
Modified:
head/sys/kern/vfs_acl.c
Modified: head/sys/kern/vfs_acl.c
==============================================================================
--- head/sys/kern/vfs_acl.c Thu Mar 30 21:54:57 2017 (r316306)
+++ head/sys/kern/vfs_acl.c Thu Mar 30 22:00:58 2017 (r316307)
@@ -1,9 +1,14 @@
/*-
- * Copyright (c) 1999-2006 Robert N. M. Watson
+ * Copyright (c) 1999-2006, 2016-2017 Robert N. M. Watson
* All rights reserved.
*
* This software was developed by Robert Watson for the TrustedBSD Project.
*
+ * Portions of this software were developed by BAE Systems, the University of
+ * Cambridge Computer Laboratory, and Memorial University under DARPA/AFRL
+ * contract FA8650-15-C-7558 ("CADETS"), as part of the DARPA Transparent
+ * Computing (TC) research program.
+ *
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
@@ -53,6 +58,7 @@ __FBSDID("$FreeBSD$");
#include <sys/sysent.h>
#include <sys/acl.h>
+#include <security/audit/audit.h>
#include <security/mac/mac_framework.h>
CTASSERT(ACL_MAX_ENTRIES >= OLDACL_MAX_ENTRIES);
@@ -216,6 +222,7 @@ vacl_set_acl(struct thread *td, struct v
struct mount *mp;
int error;
+ AUDIT_ARG_VALUE(type);
inkernelacl = acl_alloc(M_WAITOK);
error = acl_copyin(aclp, inkernelacl, type);
if (error != 0)
@@ -224,6 +231,7 @@ vacl_set_acl(struct thread *td, struct v
if (error != 0)
goto out;
vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
+ AUDIT_ARG_VNODE1(vp);
#ifdef MAC
error = mac_vnode_check_setacl(td->td_ucred, vp, type, inkernelacl);
if (error != 0)
@@ -251,8 +259,10 @@ vacl_get_acl(struct thread *td, struct v
struct acl *inkernelacl;
int error;
+ AUDIT_ARG_VALUE(type);
inkernelacl = acl_alloc(M_WAITOK | M_ZERO);
vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
+ AUDIT_ARG_VNODE1(vp);
#ifdef MAC
error = mac_vnode_check_getacl(td->td_ucred, vp, type);
if (error != 0)
@@ -280,10 +290,12 @@ vacl_delete(struct thread *td, struct vn
struct mount *mp;
int error;
+ AUDIT_ARG_VALUE(type);
error = vn_start_write(vp, &mp, V_WAIT | PCATCH);
if (error != 0)
return (error);
vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
+ AUDIT_ARG_VNODE1(vp);
#ifdef MAC
error = mac_vnode_check_deleteacl(td->td_ucred, vp, type);
if (error != 0)
@@ -300,6 +312,8 @@ out:
/*
* Given a vnode, check whether an ACL is appropriate for it
+ *
+ * XXXRW: No vnode lock held so can't audit vnode state...?
*/
static int
vacl_aclcheck(struct thread *td, struct vnode *vp, acl_type_t type,
@@ -333,7 +347,8 @@ sys___acl_get_file(struct thread *td, st
struct nameidata nd;
int error;
- NDINIT(&nd, LOOKUP, FOLLOW, UIO_USERSPACE, uap->path, td);
+ NDINIT(&nd, LOOKUP, FOLLOW | AUDITVNODE1, UIO_USERSPACE, uap->path,
+ td);
error = namei(&nd);
if (error == 0) {
error = vacl_get_acl(td, nd.ni_vp, uap->type, uap->aclp);
@@ -351,7 +366,8 @@ sys___acl_get_link(struct thread *td, st
struct nameidata nd;
int error;
- NDINIT(&nd, LOOKUP, NOFOLLOW, UIO_USERSPACE, uap->path, td);
+ NDINIT(&nd, LOOKUP, NOFOLLOW | AUDITVNODE1, UIO_USERSPACE, uap->path,
+ td);
error = namei(&nd);
if (error == 0) {
error = vacl_get_acl(td, nd.ni_vp, uap->type, uap->aclp);
@@ -369,7 +385,8 @@ sys___acl_set_file(struct thread *td, st
struct nameidata nd;
int error;
- NDINIT(&nd, LOOKUP, FOLLOW, UIO_USERSPACE, uap->path, td);
+ NDINIT(&nd, LOOKUP, FOLLOW | AUDITVNODE1, UIO_USERSPACE, uap->path,
+ td);
error = namei(&nd);
if (error == 0) {
error = vacl_set_acl(td, nd.ni_vp, uap->type, uap->aclp);
@@ -387,7 +404,8 @@ sys___acl_set_link(struct thread *td, st
struct nameidata nd;
int error;
- NDINIT(&nd, LOOKUP, NOFOLLOW, UIO_USERSPACE, uap->path, td);
+ NDINIT(&nd, LOOKUP, NOFOLLOW | AUDITVNODE1, UIO_USERSPACE, uap->path,
+ td);
error = namei(&nd);
if (error == 0) {
error = vacl_set_acl(td, nd.ni_vp, uap->type, uap->aclp);
@@ -406,6 +424,7 @@ sys___acl_get_fd(struct thread *td, stru
cap_rights_t rights;
int error;
+ AUDIT_ARG_FD(uap->filedes);
error = getvnode(td, uap->filedes,
cap_rights_init(&rights, CAP_ACL_GET), &fp);
if (error == 0) {
@@ -425,6 +444,7 @@ sys___acl_set_fd(struct thread *td, stru
cap_rights_t rights;
int error;
+ AUDIT_ARG_FD(uap->filedes);
error = getvnode(td, uap->filedes,
cap_rights_init(&rights, CAP_ACL_SET), &fp);
if (error == 0) {
@@ -480,6 +500,7 @@ sys___acl_delete_fd(struct thread *td, s
cap_rights_t rights;
int error;
+ AUDIT_ARG_FD(uap->filedes);
error = getvnode(td, uap->filedes,
cap_rights_init(&rights, CAP_ACL_DELETE), &fp);
if (error == 0) {
@@ -535,6 +556,7 @@ sys___acl_aclcheck_fd(struct thread *td,
cap_rights_t rights;
int error;
+ AUDIT_ARG_FD(uap->filedes);
error = getvnode(td, uap->filedes,
cap_rights_init(&rights, CAP_ACL_CHECK), &fp);
if (error == 0) {
_______________________________________________
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
