summaryrefslogtreecommitdiff
path: root/sys/secmodel
diff options
context:
space:
mode:
authorelad <elad@NetBSD.org>2006-09-08 20:58:56 +0000
committerelad <elad@NetBSD.org>2006-09-08 20:58:56 +0000
commit5f7169ccb1d349e91f3fbefef9c51d04dc8a863e (patch)
tree7dfff2b4847465c80f0c0d22709814e36ca3be28 /sys/secmodel
parent296c01bb4f6b164a05c3169ef898255d9c18e1a4 (diff)
First take at security model abstraction.
- Add a few scopes to the kernel: system, network, and machdep. - Add a few more actions/sub-actions (requests), and start using them as opposed to the KAUTH_GENERIC_ISSUSER place-holders. - Introduce a basic set of listeners that implement our "traditional" security model, called "bsd44". This is the default (and only) model we have at the moment. - Update all relevant documentation. - Add some code and docs to help folks who want to actually use this stuff: * There's a sample overlay model, sitting on-top of "bsd44", for fast experimenting with tweaking just a subset of an existing model. This is pretty cool because it's *really* straightforward to do stuff you had to use ugly hacks for until now... * And of course, documentation describing how to do the above for quick reference, including code samples. All of these changes were tested for regressions using a Python-based testsuite that will be (I hope) available soon via pkgsrc. Information about the tests, and how to write new ones, can be found on: http://kauth.linbsd.org/kauthwiki NOTE FOR DEVELOPERS: *PLEASE* don't add any code that does any of the following: - Uses a KAUTH_GENERIC_ISSUSER kauth(9) request, - Checks 'securelevel' directly, - Checks a uid/gid directly. (or if you feel you have to, contact me first) This is still work in progress; It's far from being done, but now it'll be a lot easier. Relevant mailing list threads: http://mail-index.netbsd.org/tech-security/2006/01/25/0011.html http://mail-index.netbsd.org/tech-security/2006/03/24/0001.html http://mail-index.netbsd.org/tech-security/2006/04/18/0000.html http://mail-index.netbsd.org/tech-security/2006/05/15/0000.html http://mail-index.netbsd.org/tech-security/2006/08/01/0000.html http://mail-index.netbsd.org/tech-security/2006/08/25/0000.html Many thanks to YAMAMOTO Takashi, Matt Thomas, and Christos Zoulas for help stablizing kauth(9). Full credit for the regression tests, making sure these changes didn't break anything, goes to Matt Fleming and Jaime Fournier. Happy birthday Randi! :)
Diffstat (limited to 'sys/secmodel')
-rw-r--r--sys/secmodel/bsd44/bsd44.h38
-rw-r--r--sys/secmodel/bsd44/files.bsd449
-rw-r--r--sys/secmodel/bsd44/secmodel_bsd44.c101
-rw-r--r--sys/secmodel/bsd44/secmodel_bsd44_logic.c52
-rw-r--r--sys/secmodel/bsd44/secmodel_bsd44_securelevel.c422
-rw-r--r--sys/secmodel/bsd44/secmodel_bsd44_suser.c397
-rw-r--r--sys/secmodel/bsd44/securelevel.h49
-rw-r--r--sys/secmodel/bsd44/suser.h50
-rw-r--r--sys/secmodel/files.secmodel11
-rw-r--r--sys/secmodel/overlay/files.overlay5
-rw-r--r--sys/secmodel/overlay/overlay.h49
-rw-r--r--sys/secmodel/overlay/secmodel_overlay.c306
-rw-r--r--sys/secmodel/secmodel.h37
13 files changed, 1526 insertions, 0 deletions
diff --git a/sys/secmodel/bsd44/bsd44.h b/sys/secmodel/bsd44/bsd44.h
new file mode 100644
index 00000000000..40a3f92147a
--- /dev/null
+++ b/sys/secmodel/bsd44/bsd44.h
@@ -0,0 +1,38 @@
+/* $NetBSD: bsd44.h,v 1.1 2006/09/08 20:58:57 elad Exp $ */
+/*-
+ * Copyright (c) 2006 Elad Efrat <elad@NetBSD.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ * must display the following acknowledgement:
+ * This product includes software developed by Elad Efrat.
+ * 4. The name of the author may not be used to endorse or promote products
+ * derived from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef _SECMODEL_BSD44_BSD44_H_
+#define _SECMODEL_BSD44_BSD44_H_
+
+void secmodel_bsd44_init(void);
+void secmodel_bsd44_start(void);
+
+#endif /* !_SECMODEL_BSD44_BSD44_H_ */
diff --git a/sys/secmodel/bsd44/files.bsd44 b/sys/secmodel/bsd44/files.bsd44
new file mode 100644
index 00000000000..3896b843921
--- /dev/null
+++ b/sys/secmodel/bsd44/files.bsd44
@@ -0,0 +1,9 @@
+# $NetBSD: files.bsd44,v 1.1 2006/09/08 20:58:57 elad Exp $
+
+defflag secmodel_bsd44_logic
+defflag secmodel_bsd44 : secmodel_bsd44_logic
+
+file secmodel/bsd44/secmodel_bsd44.c secmodel_bsd44
+file secmodel/bsd44/secmodel_bsd44_logic.c secmodel_bsd44_logic
+file secmodel/bsd44/secmodel_bsd44_suser.c secmodel_bsd44_logic
+file secmodel/bsd44/secmodel_bsd44_securelevel.c secmodel_bsd44_logic
diff --git a/sys/secmodel/bsd44/secmodel_bsd44.c b/sys/secmodel/bsd44/secmodel_bsd44.c
new file mode 100644
index 00000000000..a2d3d4759db
--- /dev/null
+++ b/sys/secmodel/bsd44/secmodel_bsd44.c
@@ -0,0 +1,101 @@
+/* $NetBSD: secmodel_bsd44.c,v 1.1 2006/09/08 20:58:57 elad Exp $ */
+/*-
+ * Copyright (c) 2006 Elad Efrat <elad@NetBSD.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ * must display the following acknowledgement:
+ * This product includes software developed by Elad Efrat.
+ * 4. The name of the author may not be used to endorse or promote products
+ * derived from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <sys/kauth.h>
+
+#include <sys/sysctl.h>
+
+#include <secmodel/secmodel.h>
+
+#include <secmodel/bsd44/bsd44.h>
+#include <secmodel/bsd44/suser.h>
+#include <secmodel/bsd44/securelevel.h>
+
+SYSCTL_SETUP(sysctl_security_bsd44_setup,
+ "sysctl security bsd44 setup")
+{
+ const struct sysctlnode *rnode;
+
+ sysctl_createv(clog, 0, NULL, &rnode,
+ CTLFLAG_PERMANENT,
+ CTLTYPE_NODE, "security", NULL,
+ NULL, 0, NULL, 0,
+ CTL_CREATE, CTL_EOL);
+
+ sysctl_createv(clog, 0, &rnode, &rnode,
+ CTLFLAG_PERMANENT,
+ CTLTYPE_NODE, "models", NULL,
+ NULL, 0, NULL, 0,
+ CTL_CREATE, CTL_EOL);
+
+ sysctl_createv(clog, 0, &rnode, &rnode,
+ CTLFLAG_PERMANENT,
+ CTLTYPE_NODE, "bsd44",
+ SYSCTL_DESCR("Traditional NetBSD Security model, " \
+ "derived from 4.4BSD"),
+ NULL, 0, NULL, 0,
+ CTL_CREATE, CTL_EOL);
+
+ sysctl_createv(clog, 0, &rnode, NULL,
+ CTLFLAG_PERMANENT,
+ CTLTYPE_STRING, "name", NULL,
+ NULL, 0, __UNCONST("Traditional NetBSD (4.4BSD)"), 0,
+ CTL_CREATE, CTL_EOL);
+
+ sysctl_createv(clog, 0, &rnode, NULL,
+ CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
+ CTLTYPE_INT, "securelevel",
+ SYSCTL_DESCR("System security level"),
+ secmodel_bsd44_sysctl_securelevel, 0, &securelevel, 0,
+ CTL_CREATE, CTL_EOL);
+
+ sysctl_createv(clog, 0, &rnode, NULL,
+ CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
+ CTLTYPE_INT, "curtain",
+ SYSCTL_DESCR("Curtain information about objects to "
+ "users not owning them."),
+ NULL, 0, &secmodel_bsd44_curtain, 0,
+ CTL_CREATE, CTL_EOL);
+}
+
+/*
+ * Start the traditional NetBSD security model.
+ */
+void
+secmodel_start(void)
+{
+ secmodel_bsd44_init();
+
+ secmodel_bsd44_suser_start();
+ secmodel_bsd44_securelevel_start();
+}
diff --git a/sys/secmodel/bsd44/secmodel_bsd44_logic.c b/sys/secmodel/bsd44/secmodel_bsd44_logic.c
new file mode 100644
index 00000000000..3f034c388d7
--- /dev/null
+++ b/sys/secmodel/bsd44/secmodel_bsd44_logic.c
@@ -0,0 +1,52 @@
+/* $NetBSD: secmodel_bsd44_logic.c,v 1.1 2006/09/08 20:58:57 elad Exp $ */
+/*-
+ * Copyright (c) 2006 Elad Efrat <elad@NetBSD.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ * must display the following acknowledgement:
+ * This product includes software developed by Elad Efrat.
+ * 4. The name of the author may not be used to endorse or promote products
+ * derived from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <sys/kauth.h>
+
+#include <sys/sysctl.h>
+
+#include <secmodel/bsd44/bsd44.h>
+#include <secmodel/bsd44/suser.h>
+#include <secmodel/bsd44/securelevel.h>
+
+int secmodel_bsd44_curtain;
+
+/*
+ * Initialize the traditional NetBSD security model.
+ */
+void
+secmodel_bsd44_init(void)
+{
+ secmodel_bsd44_securelevel_init();
+ secmodel_bsd44_curtain = 0;
+}
diff --git a/sys/secmodel/bsd44/secmodel_bsd44_securelevel.c b/sys/secmodel/bsd44/secmodel_bsd44_securelevel.c
new file mode 100644
index 00000000000..75a72f11b3b
--- /dev/null
+++ b/sys/secmodel/bsd44/secmodel_bsd44_securelevel.c
@@ -0,0 +1,422 @@
+/* $NetBSD: secmodel_bsd44_securelevel.c,v 1.1 2006/09/08 20:58:57 elad Exp $ */
+/*-
+ * Copyright (c) 2006 Elad Efrat <elad@NetBSD.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ * must display the following acknowledgement:
+ * This product includes software developed by Elad Efrat.
+ * 4. The name of the author may not be used to endorse or promote products
+ * derived from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/*
+ * This file contains kauth(9) listeners needed to implement the traditional
+ * NetBSD securelevel.
+ *
+ * The securelevel is a system-global indication on what operations are
+ * allowed or not. It affects all users, including root.
+ */
+
+#ifdef _KERNEL_OPT
+#include "opt_insecure.h"
+#endif /* _KERNEL_OPT */
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <sys/kauth.h>
+
+#include <sys/conf.h>
+#include <sys/mount.h>
+#include <sys/sysctl.h>
+#include <sys/vnode.h>
+
+#include <secmodel/bsd44/securelevel.h>
+
+/*
+ * XXX after we remove all securelevel references from the kernel,
+ * XXX this goes static.
+ */
+int securelevel;
+
+/*
+ * sysctl helper routine for securelevel. ensures that the value
+ * only rises unless the caller has pid 1 (assumed to be init).
+ */
+int
+secmodel_bsd44_sysctl_securelevel(SYSCTLFN_ARGS)
+{
+ int newsecurelevel, error;
+ struct sysctlnode node;
+
+ newsecurelevel = securelevel;
+ node = *rnode;
+ node.sysctl_data = &newsecurelevel;
+ error = sysctl_lookup(SYSCTLFN_CALL(&node));
+ if (error || newp == NULL)
+ return (error);
+
+ if (newsecurelevel < securelevel && l && l->l_proc->p_pid != 1)
+ return (EPERM);
+ securelevel = newsecurelevel;
+
+ return (error);
+}
+
+void
+secmodel_bsd44_securelevel_init(void)
+{
+#ifdef INSECURE
+ securelevel = -1;
+#else
+ securelevel = 0;
+#endif /* INSECURE */
+}
+
+SYSCTL_SETUP(sysctl_secmodel_bsd44_securelevel_setup,
+ "sysctl secmodel bsd44 securelevel setup")
+{
+ /*
+ * For compatibility, we create a kern.securelevel variable.
+ */
+ sysctl_createv(clog, 0, NULL, NULL,
+ CTLFLAG_PERMANENT,
+ CTLTYPE_NODE, "kern", NULL,
+ NULL, 0, NULL, 0,
+ CTL_KERN, CTL_EOL);
+
+ sysctl_createv(clog, 0, NULL, NULL,
+ CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
+ CTLTYPE_INT, "securelevel",
+ SYSCTL_DESCR("System security level"),
+ secmodel_bsd44_sysctl_securelevel, 0, &securelevel, 0,
+ CTL_KERN, KERN_SECURELVL, CTL_EOL);
+}
+
+void
+secmodel_bsd44_securelevel_start(void)
+{
+ kauth_listen_scope(KAUTH_SCOPE_SYSTEM,
+ secmodel_bsd44_securelevel_system_cb, NULL);
+ kauth_listen_scope(KAUTH_SCOPE_PROCESS,
+ secmodel_bsd44_securelevel_process_cb, NULL);
+ kauth_listen_scope(KAUTH_SCOPE_NETWORK,
+ secmodel_bsd44_securelevel_network_cb, NULL);
+ kauth_listen_scope(KAUTH_SCOPE_MACHDEP,
+ secmodel_bsd44_securelevel_machdep_cb, NULL);
+}
+
+/*
+ * kauth(9) listener
+ *
+ * Security model: Traditional NetBSD
+ * Scope: System
+ * Responsibility: Securelevel
+ */
+int
+secmodel_bsd44_securelevel_system_cb(kauth_cred_t cred, kauth_action_t action,
+ void *cookie, void *arg0, void *arg1, void *arg2, void *arg3)
+{
+ int result;
+
+ result = KAUTH_RESULT_DENY;
+
+ switch (action) {
+ case KAUTH_SYSTEM_RAWIO: {
+ u_int rw;
+
+ rw = (u_int)(u_long)arg1;
+
+ switch ((u_long)arg0) {
+ case KAUTH_REQ_SYSTEM_RAWIO_MEMORY: {
+ switch (rw) {
+ case KAUTH_REQ_SYSTEM_RAWIO_READ:
+ result = KAUTH_RESULT_ALLOW;
+ break;
+
+ case KAUTH_REQ_SYSTEM_RAWIO_WRITE:
+ case KAUTH_REQ_SYSTEM_RAWIO_RW:
+ if (securelevel < 1)
+ result = KAUTH_RESULT_ALLOW;
+ break;
+
+ default:
+ result = KAUTH_RESULT_DEFER;
+ break;
+ }
+
+ break;
+ }
+
+ case KAUTH_REQ_SYSTEM_RAWIO_DISK: {
+ struct vnode *vp = arg2;
+ dev_t dev = (dev_t)(u_long)arg3;
+
+ if (vp == NULL || dev == 0)
+ break;
+
+ switch (vp->v_type) {
+ case VCHR: {
+ const struct cdevsw *cdev;
+ struct vnode *bvp;
+
+ switch (rw) {
+ case KAUTH_REQ_SYSTEM_RAWIO_READ:
+ result = KAUTH_RESULT_ALLOW;
+ break;
+
+ case KAUTH_REQ_SYSTEM_RAWIO_WRITE:
+ case KAUTH_REQ_SYSTEM_RAWIO_RW:
+ cdev = cdevsw_lookup(dev);
+ if (cdev == NULL)
+ break;
+
+ if (cdev->d_type == D_DISK &&
+ securelevel > 1)
+ break;
+
+ bvp = NULL;
+ vfinddev(devsw_chr2blk(dev), VBLK, &bvp);
+ if (bvp != NULL) {
+ if (vfs_mountedon(bvp) &&
+ securelevel > 0)
+ break;
+ }
+
+ result = KAUTH_RESULT_ALLOW;
+
+ break;
+
+ default:
+ result = KAUTH_RESULT_DEFER;
+ break;
+ }
+
+ break;
+ }
+
+ case VBLK: {
+ const struct bdevsw *bdev;
+
+ if (vfs_mountedon(vp))
+ break;
+
+ bdev = bdevsw_lookup(dev);
+ if (bdev == NULL)
+ break;
+
+ if (bdev->d_type == D_DISK &&
+ rw != KAUTH_REQ_SYSTEM_RAWIO_READ &&
+ securelevel > 1)
+ break;
+
+ result = KAUTH_RESULT_ALLOW;
+
+ break;
+ }
+
+ default:
+ result = KAUTH_RESULT_DEFER;
+ break;
+ }
+ break;
+ }
+
+ default:
+ result = KAUTH_RESULT_DEFER;
+ break;
+ }
+ break;
+ }
+
+ case KAUTH_SYSTEM_TIME:
+ switch ((u_long)arg0) {
+ case KAUTH_REQ_SYSTEM_TIME_BACKWARDS:
+ if (securelevel < 2)
+ result = KAUTH_RESULT_ALLOW;
+
+ case KAUTH_REQ_SYSTEM_TIME_RTCOFFSET:
+ if (securelevel < 1)
+ result = KAUTH_RESULT_ALLOW;
+ break;
+
+ default:
+ result = KAUTH_RESULT_DEFER;
+ break;
+ }
+ break;
+
+ case KAUTH_SYSTEM_LKM:
+ if (securelevel < 1)
+ result = KAUTH_RESULT_ALLOW;
+ break;
+
+ case KAUTH_SYSTEM_SYSCTL:
+ switch ((u_long)arg0) {
+ case KAUTH_REQ_SYSTEM_SYSCTL_ADD:
+ case KAUTH_REQ_SYSTEM_SYSCTL_DELETE:
+ case KAUTH_REQ_SYSTEM_SYSCTL_DESC:
+ if (securelevel < 1)
+ result = KAUTH_RESULT_ALLOW;
+ break;
+
+ default:
+ result = KAUTH_RESULT_DEFER;
+ break;
+ }
+ break;
+
+ case KAUTH_SYSTEM_SETIDCORE:
+ if (securelevel < 1)
+ result = KAUTH_RESULT_ALLOW;
+ break;
+
+ case KAUTH_SYSTEM_DEBUG:
+ switch ((u_long)arg0) {
+ case KAUTH_REQ_SYSTEM_DEBUG_IPKDB:
+ if (securelevel < 1)
+ result = KAUTH_RESULT_ALLOW;
+ break;
+
+ default:
+ result = KAUTH_RESULT_DEFER;
+ break;
+ }
+ break;
+
+ default:
+ result = KAUTH_RESULT_DEFER;
+ break;
+ }
+
+ return (result);
+}
+
+/*
+ * kauth(9) listener
+ *
+ * Security model: Traditional NetBSD
+ * Scope: Process
+ * Responsibility: Securelevel
+ */
+int
+secmodel_bsd44_securelevel_process_cb(kauth_cred_t cred, kauth_action_t action,
+ void *cookie, void *arg0, void *arg1, void *arg2, void *arg3)
+{
+ int result;
+
+ result = KAUTH_RESULT_DENY;
+
+ switch (action) {
+ case KAUTH_PROCESS_CORENAME:
+ if (securelevel < 2)
+ result = KAUTH_RESULT_ALLOW;
+ break;
+
+ default:
+ result = KAUTH_RESULT_DEFER;
+ break;
+ }
+
+ return (result);
+}
+
+/*
+ * kauth(9) listener
+ *
+ * Security model: Traditional NetBSD
+ * Scope: Network
+ * Responsibility: Securelevel
+ */
+int
+secmodel_bsd44_securelevel_network_cb(kauth_cred_t cred, kauth_action_t action,
+ void *cookie, void *arg0, void *arg1, void *arg2, void *arg3)
+{
+ int result;
+
+ result = KAUTH_RESULT_DENY;
+
+ switch (action) {
+ case KAUTH_NETWORK_FIREWALL:
+ switch ((u_long)arg0) {
+ case KAUTH_REQ_NETWORK_FIREWALL_FW:
+ case KAUTH_REQ_NETWORK_FIREWALL_NAT:
+ if (securelevel < 2)
+ result = KAUTH_RESULT_ALLOW;
+ break;
+
+ default:
+ result = KAUTH_RESULT_DEFER;
+ break;
+ }
+ break;
+
+ case KAUTH_NETWORK_FORWSRCRT:
+ if (securelevel < 1)
+ result = KAUTH_RESULT_ALLOW;
+ break;
+
+ default:
+ result = KAUTH_RESULT_DEFER;
+ break;
+ }
+
+ return (result);
+}
+
+/*
+ * kauth(9) listener
+ *
+ * Security model: Traditional NetBSD
+ * Scope: Machdep
+ * Responsibility: Securelevel
+ */
+int
+secmodel_bsd44_securelevel_machdep_cb(kauth_cred_t cred, kauth_action_t action,
+ void *cookie, void *arg0, void *arg1, void *arg2, void *arg3)
+{
+ int result;
+
+ result = KAUTH_RESULT_DENY;
+
+ switch (action) {
+ case KAUTH_MACHDEP_X86:
+ switch ((u_long)arg0) {
+ case KAUTH_REQ_MACHDEP_X86_IOPL:
+ case KAUTH_REQ_MACHDEP_X86_IOPERM:
+ if (securelevel < 2)
+ result = KAUTH_RESULT_ALLOW;
+ break;
+ default:
+ result = KAUTH_RESULT_DEFER;
+ break;
+ }
+
+ break;
+
+ default:
+ result = KAUTH_RESULT_DEFER;
+ break;
+ }
+
+ return (result);
+}
diff --git a/sys/secmodel/bsd44/secmodel_bsd44_suser.c b/sys/secmodel/bsd44/secmodel_bsd44_suser.c
new file mode 100644
index 00000000000..44b9fa1f690
--- /dev/null
+++ b/sys/secmodel/bsd44/secmodel_bsd44_suser.c
@@ -0,0 +1,397 @@
+/* $NetBSD: secmodel_bsd44_suser.c,v 1.1 2006/09/08 20:58:57 elad Exp $ */
+/*-
+ * Copyright (c) 2006 Elad Efrat <elad@NetBSD.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ * must display the following acknowledgement:
+ * This product includes software developed by Elad Efrat.
+ * 4. The name of the author may not be used to endorse or promote products
+ * derived from this software without specific prior written permission.
+ * 5. Use of the code by Wasabi Systems Inc. is hereby prohibited without
+ * written approval from the author.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/*
+ * This file contains kauth(9) listeners needed to implement the traditional
+ * NetBSD superuser access restrictions.
+ *
+ * There are two main resources a request can be issued to: user-owned and
+ * system owned. For the first, traditional Unix access checks are done, as
+ * well as superuser checks. If needed, the request context is examined before
+ * a decision is made. For the latter, usually only superuser checks are done
+ * as normal users are not allowed to access system resources.
+ */
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <sys/kauth.h>
+
+#include <sys/acct.h>
+#include <sys/ktrace.h>
+#include <sys/mount.h>
+#include <sys/socket.h>
+#include <sys/sysctl.h>
+
+#include <net/route.h>
+
+#include <secmodel/bsd44/suser.h>
+
+void
+secmodel_bsd44_suser_start(void)
+{
+ kauth_listen_scope(KAUTH_SCOPE_GENERIC,
+ secmodel_bsd44_suser_generic_cb, NULL);
+ kauth_listen_scope(KAUTH_SCOPE_SYSTEM,
+ secmodel_bsd44_suser_system_cb, NULL);
+ kauth_listen_scope(KAUTH_SCOPE_PROCESS,
+ secmodel_bsd44_suser_process_cb, NULL);
+ kauth_listen_scope(KAUTH_SCOPE_NETWORK,
+ secmodel_bsd44_suser_network_cb, NULL);
+ kauth_listen_scope(KAUTH_SCOPE_MACHDEP,
+ secmodel_bsd44_suser_machdep_cb, NULL);
+}
+
+/*
+ * kauth(9) listener
+ *
+ * Security model: Traditional NetBSD
+ * Scope: Generic
+ * Responsibility: Superuser access
+ */
+int
+secmodel_bsd44_suser_generic_cb(kauth_cred_t cred, kauth_action_t action,
+ void *cookie, void *arg0, void *arg1, void *arg2, void *arg3)
+{
+ boolean_t isroot;
+ int result;
+
+ isroot = (kauth_cred_geteuid(cred) == 0);
+ result = KAUTH_RESULT_DENY;
+
+ switch (action) {
+ case KAUTH_GENERIC_ISSUSER:
+ if (isroot)
+ result = KAUTH_RESULT_ALLOW;
+ break;
+
+ case KAUTH_GENERIC_CANSEE:
+ if (!secmodel_bsd44_curtain)
+ result = KAUTH_RESULT_ALLOW;
+ else if (isroot || kauth_cred_uidmatch(cred, arg0))
+ result = KAUTH_RESULT_ALLOW;
+
+ break;
+
+ default:
+ result = KAUTH_RESULT_DEFER;
+ break;
+ }
+
+ return (result);
+}
+
+/*
+ * kauth(9) listener
+ *
+ * Security model: Traditional NetBSD
+ * Scope: System
+ * Responsibility: Superuser access
+ */
+int
+secmodel_bsd44_suser_system_cb(kauth_cred_t cred, kauth_action_t action,
+ void *cookie, void *arg0, void *arg1, void *arg2, void *arg3)
+{
+ boolean_t isroot;
+ int result;
+
+ isroot = (kauth_cred_geteuid(cred) == 0);
+ result = KAUTH_RESULT_DENY;
+
+ switch (action) {
+ case KAUTH_SYSTEM_TIME:
+ if (isroot)
+ result = KAUTH_RESULT_ALLOW;
+ break;
+
+ case KAUTH_SYSTEM_SYSCTL:
+ if (isroot)
+ result = KAUTH_RESULT_ALLOW;
+ break;
+
+ case KAUTH_SYSTEM_SWAPCTL:
+ case KAUTH_SYSTEM_ACCOUNTING:
+ case KAUTH_SYSTEM_REBOOT:
+ case KAUTH_SYSTEM_CHROOT:
+ case KAUTH_SYSTEM_FILEHANDLE:
+ case KAUTH_SYSTEM_MKNOD:
+ if (isroot)
+ result = KAUTH_RESULT_ALLOW;
+ break;
+
+ default:
+ result = KAUTH_RESULT_DEFER;
+ break;
+ }
+
+ return (result);
+}
+
+/*
+ * kauth(9) listener
+ *
+ * Security model: Traditional NetBSD
+ * Scope: Process
+ * Responsibility: Superuser access
+ */
+int
+secmodel_bsd44_suser_process_cb(kauth_cred_t cred, kauth_action_t action,
+ void *cookie, void *arg0, void *arg1, void *arg2, void *arg3)
+{
+ struct proc *p;
+ boolean_t isroot;
+ int result;
+
+ isroot = (kauth_cred_geteuid(cred) == 0);
+ result = KAUTH_RESULT_DENY;
+ p = arg0;
+
+ switch (action) {
+ case KAUTH_PROCESS_CANSIGNAL: {
+ int signum;
+
+ signum = (int)(unsigned long)arg1;
+
+ if (isroot || kauth_cred_uidmatch(cred, p->p_cred) ||
+ (signum == SIGCONT && (curproc->p_session == p->p_session)))
+ result = KAUTH_RESULT_ALLOW;
+ break;
+ }
+
+ case KAUTH_PROCESS_CANSEE:
+ if (!secmodel_bsd44_curtain)
+ result = KAUTH_RESULT_ALLOW;
+ else if (isroot || kauth_cred_uidmatch(cred, p->p_cred))
+ result = KAUTH_RESULT_ALLOW;
+ break;
+
+ case KAUTH_PROCESS_RESOURCE:
+ switch ((u_long)arg1) {
+ case KAUTH_REQ_PROCESS_RESOURCE_NICE:
+ if (isroot)
+ result = KAUTH_RESULT_ALLOW;
+ else if ((u_long)arg2 >= p->p_nice)
+ result = KAUTH_RESULT_ALLOW;
+ break;
+
+ case KAUTH_REQ_PROCESS_RESOURCE_RLIMIT:
+ if (isroot)
+ result = KAUTH_RESULT_ALLOW;
+ else {
+ struct rlimit *new_rlimit;
+ u_long which;
+
+ new_rlimit = arg2;
+ which = (u_long)arg3;
+
+ if (new_rlimit->rlim_max <=
+ p->p_rlimit[which].rlim_max)
+ result = KAUTH_RESULT_ALLOW;
+ }
+ break;
+
+ default:
+ result = KAUTH_RESULT_DEFER;
+ break;
+ }
+ break;
+
+ case KAUTH_PROCESS_SETID:
+ if (isroot)
+ result = KAUTH_RESULT_ALLOW;
+ break;
+
+ default:
+ result = KAUTH_RESULT_DEFER;
+ break;
+ }
+
+ return (result);
+}
+
+/*
+ * kauth(9) listener
+ *
+ * Security model: Traditional NetBSD
+ * Scope: Network
+ * Responsibility: Superuser access
+ */
+int
+secmodel_bsd44_suser_network_cb(kauth_cred_t cred, kauth_action_t action,
+ void *cookie, void *arg0, void *arg1, void *arg2, void *arg3)
+{
+ boolean_t isroot;
+ int result;
+
+ isroot = (kauth_cred_geteuid(cred) == 0);
+ result = KAUTH_RESULT_DENY;
+
+ switch (action) {
+ case KAUTH_NETWORK_FIREWALL:
+ switch ((u_long)arg0) {
+ case KAUTH_REQ_NETWORK_FIREWALL_FW:
+ case KAUTH_REQ_NETWORK_FIREWALL_NAT:
+ if (isroot)
+ result = KAUTH_RESULT_ALLOW;
+ break;
+
+ default:
+ result = KAUTH_RESULT_DEFER;
+ break;
+ }
+
+ break;
+
+ case KAUTH_NETWORK_ALTQ:
+ switch ((u_long)arg0) {
+ case KAUTH_REQ_NETWORK_ALTQ_AFMAP:
+ case KAUTH_REQ_NETWORK_ALTQ_BLUE:
+ case KAUTH_REQ_NETWORK_ALTQ_CBQ:
+ case KAUTH_REQ_NETWORK_ALTQ_CDNR:
+ case KAUTH_REQ_NETWORK_ALTQ_CONF:
+ case KAUTH_REQ_NETWORK_ALTQ_FIFOQ:
+ case KAUTH_REQ_NETWORK_ALTQ_HFSC:
+ case KAUTH_REQ_NETWORK_ALTQ_PRIQ:
+ case KAUTH_REQ_NETWORK_ALTQ_RED:
+ case KAUTH_REQ_NETWORK_ALTQ_RIO:
+ case KAUTH_REQ_NETWORK_ALTQ_WFQ:
+ if (isroot)
+ result = KAUTH_RESULT_ALLOW;
+ break;
+
+ default:
+ result = KAUTH_RESULT_DEFER;
+ break;
+ }
+
+ break;
+
+ case KAUTH_NETWORK_SOCKET:
+ switch ((u_long)arg0) {
+ case KAUTH_REQ_NETWORK_SOCKET_RAWSOCK:
+ if (isroot)
+ result = KAUTH_RESULT_ALLOW;
+ break;
+
+ default:
+ result = KAUTH_RESULT_ALLOW;
+ break;
+ }
+
+ break;
+
+ case KAUTH_NETWORK_BIND:
+ switch ((u_long)arg0) {
+ case KAUTH_REQ_NETWORK_BIND_PRIVPORT:
+ if (isroot)
+ result = KAUTH_RESULT_ALLOW;
+ break;
+ default:
+ result = KAUTH_RESULT_ALLOW;
+ break;
+ }
+ break;
+
+ case KAUTH_NETWORK_ROUTE:
+ switch (((struct rt_msghdr *)arg0)->rtm_type) {
+ case RTM_GET:
+ result = KAUTH_RESULT_ALLOW;
+ break;
+
+ default:
+ if (isroot)
+ result = KAUTH_RESULT_ALLOW;
+ break;
+ }
+ break;
+
+ default:
+ result = KAUTH_RESULT_DEFER;
+ break;
+ }
+
+ return (result);
+}
+
+/*
+ * kauth(9) listener
+ *
+ * Security model: Traditional NetBSD
+ * Scope: Machdep
+ * Responsibility: Superuser access
+ */
+int
+secmodel_bsd44_suser_machdep_cb(kauth_cred_t cred, kauth_action_t action,
+ void *cookie, void *arg0, void *arg1, void *arg2, void *arg3)
+{
+ boolean_t isroot;
+ int result;
+
+ isroot = (kauth_cred_geteuid(cred) == 0);
+ result = KAUTH_RESULT_DENY;
+
+ switch (action) {
+ case KAUTH_MACHDEP_X86:
+ switch ((u_long)arg0) {
+ case KAUTH_REQ_MACHDEP_X86_IOPL:
+ case KAUTH_REQ_MACHDEP_X86_IOPERM:
+ case KAUTH_REQ_MACHDEP_X86_MTRR_SET:
+ if (isroot)
+ result = KAUTH_RESULT_ALLOW;
+ break;
+
+ default:
+ result = KAUTH_RESULT_DEFER;
+ break;
+ }
+ break;
+
+ case KAUTH_MACHDEP_X86_64:
+ switch ((u_long)arg0) {
+ case KAUTH_REQ_MACHDEP_X86_64_MTRR_GET:
+ if (isroot)
+ result = KAUTH_RESULT_ALLOW;
+ break;
+
+ default:
+ result = KAUTH_RESULT_DEFER;
+ break;
+ }
+ break;
+
+ default:
+ result = KAUTH_RESULT_DEFER;
+ break;
+ }
+
+ return (result);
+}
diff --git a/sys/secmodel/bsd44/securelevel.h b/sys/secmodel/bsd44/securelevel.h
new file mode 100644
index 00000000000..92d1b1592b7
--- /dev/null
+++ b/sys/secmodel/bsd44/securelevel.h
@@ -0,0 +1,49 @@
+/* $NetBSD: securelevel.h,v 1.1 2006/09/08 20:58:57 elad Exp $ */
+/*-
+ * Copyright (c) 2006 Elad Efrat <elad@NetBSD.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ * must display the following acknowledgement:
+ * This product includes software developed by Elad Efrat.
+ * 4. The name of the author may not be used to endorse or promote products
+ * derived from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef _SECMODEL_BSD44_SECURELEVEL_H_
+#define _SECMODEL_BSD44_SECURELEVEL_H_
+
+int secmodel_bsd44_sysctl_securelevel(SYSCTLFN_PROTO);
+
+void secmodel_bsd44_securelevel_init(void);
+void secmodel_bsd44_securelevel_start(void);
+
+int secmodel_bsd44_securelevel_system_cb(kauth_cred_t, kauth_action_t, void *,
+ void *, void *, void *, void *);
+int secmodel_bsd44_securelevel_process_cb(kauth_cred_t, kauth_action_t, void *,
+ void *, void *, void *, void *);
+int secmodel_bsd44_securelevel_network_cb(kauth_cred_t, kauth_action_t, void *,
+ void *, void *, void *, void *);
+int secmodel_bsd44_securelevel_machdep_cb(kauth_cred_t, kauth_action_t, void *,
+ void *, void *, void *, void *);
+
+#endif /* !_SECMODEL_BSD44_SECURELEVEL_H_ */
diff --git a/sys/secmodel/bsd44/suser.h b/sys/secmodel/bsd44/suser.h
new file mode 100644
index 00000000000..f06f7a079a9
--- /dev/null
+++ b/sys/secmodel/bsd44/suser.h
@@ -0,0 +1,50 @@
+/* $NetBSD: suser.h,v 1.1 2006/09/08 20:58:57 elad Exp $ */
+/*-
+ * Copyright (c) 2006 Elad Efrat <elad@NetBSD.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ * must display the following acknowledgement:
+ * This product includes software developed by Elad Efrat.
+ * 4. The name of the author may not be used to endorse or promote products
+ * derived from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef _SECMODEL_BSD44_SUSER_H_
+#define _SECMODEL_BSD44_SUSER_H_
+
+extern int secmodel_bsd44_curtain;
+
+void secmodel_bsd44_suser_start(void);
+
+int secmodel_bsd44_suser_generic_cb(kauth_cred_t, kauth_action_t, void *,
+ void *, void *, void *, void *);
+int secmodel_bsd44_suser_system_cb(kauth_cred_t, kauth_action_t, void *,
+ void *, void *, void *, void *);
+int secmodel_bsd44_suser_process_cb(kauth_cred_t, kauth_action_t, void *,
+ void *, void *, void *, void *);
+int secmodel_bsd44_suser_network_cb(kauth_cred_t, kauth_action_t, void *,
+ void *, void *, void *, void *);
+int secmodel_bsd44_suser_machdep_cb(kauth_cred_t, kauth_action_t, void *,
+ void *, void *, void *, void *);
+
+#endif /* !_SECMODEL_BSD44_SUSER_H_ */
diff --git a/sys/secmodel/files.secmodel b/sys/secmodel/files.secmodel
new file mode 100644
index 00000000000..c2eaadc0485
--- /dev/null
+++ b/sys/secmodel/files.secmodel
@@ -0,0 +1,11 @@
+# $NetBSD: files.secmodel,v 1.1 2006/09/08 20:58:56 elad Exp $
+
+#
+# Traditional NetBSD (derived from 4.4BSD)
+#
+include "secmodel/bsd44/files.bsd44"
+
+#
+# Sample overlay model on-top of the traditional one
+#
+include "secmodel/overlay/files.overlay"
diff --git a/sys/secmodel/overlay/files.overlay b/sys/secmodel/overlay/files.overlay
new file mode 100644
index 00000000000..6d3b03a42b5
--- /dev/null
+++ b/sys/secmodel/overlay/files.overlay
@@ -0,0 +1,5 @@
+# $NetBSD: files.overlay,v 1.1 2006/09/08 20:58:57 elad Exp $
+
+defflag secmodel_overlay : secmodel_bsd44_logic
+
+file secmodel/overlay/secmodel_overlay.c secmodel_overlay
diff --git a/sys/secmodel/overlay/overlay.h b/sys/secmodel/overlay/overlay.h
new file mode 100644
index 00000000000..f784ef07824
--- /dev/null
+++ b/sys/secmodel/overlay/overlay.h
@@ -0,0 +1,49 @@
+/* $NetBSD: overlay.h,v 1.1 2006/09/08 20:58:57 elad Exp $ */
+/*-
+ * Copyright (c) 2006 Elad Efrat <elad@NetBSD.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ * must display the following acknowledgement:
+ * This product includes software developed by Elad Efrat.
+ * 4. The name of the author may not be used to endorse or promote products
+ * derived from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef _SECMODEL_OVERLAY_OVERLAY_H_
+#define _SECMODEL_OVERLAY_OVERLAY_H_
+
+void secmodel_overlay_init(void);
+void secmodel_overlay_start(void);
+
+int secmodel_overlay_generic_cb(kauth_cred_t, kauth_action_t, void *,
+ void *, void *, void *, void *);
+int secmodel_overlay_system_cb(kauth_cred_t, kauth_action_t, void *,
+ void *, void *, void *, void *);
+int secmodel_overlay_process_cb(kauth_cred_t, kauth_action_t, void *,
+ void *, void *, void *, void *);
+int secmodel_overlay_network_cb(kauth_cred_t, kauth_action_t, void *,
+ void *, void *, void *, void *);
+int secmodel_overlay_machdep_cb(kauth_cred_t, kauth_action_t, void *,
+ void *, void *, void *, void *);
+
+#endif /* !_SECMODEL_OVERLAY_OVERLAY_H_ */
diff --git a/sys/secmodel/overlay/secmodel_overlay.c b/sys/secmodel/overlay/secmodel_overlay.c
new file mode 100644
index 00000000000..8a227bef1d6
--- /dev/null
+++ b/sys/secmodel/overlay/secmodel_overlay.c
@@ -0,0 +1,306 @@
+/* $NetBSD: secmodel_overlay.c,v 1.1 2006/09/08 20:58:57 elad Exp $ */
+/*-
+ * Copyright (c) 2006 Elad Efrat <elad@NetBSD.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ * must display the following acknowledgement:
+ * This product includes software developed by Elad Efrat.
+ * 4. The name of the author may not be used to endorse or promote products
+ * derived from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <sys/kauth.h>
+
+#include <sys/sysctl.h>
+
+#include <secmodel/secmodel.h>
+#include <secmodel/overlay/overlay.h>
+
+#include <secmodel/bsd44/bsd44.h>
+#include <secmodel/bsd44/suser.h>
+#include <secmodel/bsd44/securelevel.h>
+
+/*
+ * Fall-back settings.
+ */
+#define OVERLAY_ISCOPE_GENERIC "org.netbsd.kauth.overlay.generic"
+#define OVERLAY_ISCOPE_SYSTEM "org.netbsd.kauth.overlay.system"
+#define OVERLAY_ISCOPE_PROCESS "org.netbsd.kauth.overlay.process"
+#define OVERLAY_ISCOPE_NETWORK "org.netbsd.kauth.overlay.network"
+#define OVERLAY_ISCOPE_MACHDEP "org.netbsd.kauth.overlay.machdep"
+
+static kauth_scope_t secmodel_overlay_iscope_generic;
+static kauth_scope_t secmodel_overlay_iscope_system;
+static kauth_scope_t secmodel_overlay_iscope_process;
+static kauth_scope_t secmodel_overlay_iscope_network;
+static kauth_scope_t secmodel_overlay_iscope_machdep;
+
+extern int secmodel_bsd44_curtain;
+
+/*
+ * Initialize the overlay security model.
+ */
+void
+secmodel_overlay_init(void)
+{
+ /*
+ * Register internal fall-back scopes.
+ */
+ secmodel_overlay_iscope_generic = kauth_register_scope(
+ OVERLAY_ISCOPE_GENERIC, NULL, NULL);
+ secmodel_overlay_iscope_system = kauth_register_scope(
+ OVERLAY_ISCOPE_SYSTEM, NULL, NULL);
+ secmodel_overlay_iscope_process = kauth_register_scope(
+ OVERLAY_ISCOPE_PROCESS, NULL, NULL);
+ secmodel_overlay_iscope_network = kauth_register_scope(
+ OVERLAY_ISCOPE_NETWORK, NULL, NULL);
+ secmodel_overlay_iscope_machdep = kauth_register_scope(
+ OVERLAY_ISCOPE_MACHDEP, NULL, NULL);
+
+ /*
+ * Register fall-back listeners, from bsd44, to each internal
+ * fall-back scope.
+ */
+ kauth_listen_scope(OVERLAY_ISCOPE_GENERIC,
+ secmodel_bsd44_suser_generic_cb, NULL);
+
+ kauth_listen_scope(OVERLAY_ISCOPE_SYSTEM,
+ secmodel_bsd44_suser_system_cb, NULL);
+ kauth_listen_scope(OVERLAY_ISCOPE_SYSTEM,
+ secmodel_bsd44_securelevel_system_cb, NULL);
+
+ kauth_listen_scope(OVERLAY_ISCOPE_PROCESS,
+ secmodel_bsd44_suser_process_cb, NULL);
+ kauth_listen_scope(OVERLAY_ISCOPE_PROCESS,
+ secmodel_bsd44_securelevel_process_cb, NULL);
+
+ kauth_listen_scope(OVERLAY_ISCOPE_NETWORK,
+ secmodel_bsd44_suser_network_cb, NULL);
+ kauth_listen_scope(OVERLAY_ISCOPE_NETWORK,
+ secmodel_bsd44_securelevel_network_cb, NULL);
+
+ kauth_listen_scope(OVERLAY_ISCOPE_MACHDEP,
+ secmodel_bsd44_suser_machdep_cb, NULL);
+ kauth_listen_scope(OVERLAY_ISCOPE_MACHDEP,
+ secmodel_bsd44_securelevel_machdep_cb, NULL);
+
+ secmodel_bsd44_init();
+}
+
+SYSCTL_SETUP(sysctl_security_overlay_setup,
+ "sysctl security overlay setup")
+{
+ const struct sysctlnode *rnode;
+
+ sysctl_createv(clog, 0, NULL, &rnode,
+ CTLFLAG_PERMANENT,
+ CTLTYPE_NODE, "security", NULL,
+ NULL, 0, NULL, 0,
+ CTL_CREATE, CTL_EOL);
+
+ sysctl_createv(clog, 0, &rnode, &rnode,
+ CTLFLAG_PERMANENT,
+ CTLTYPE_NODE, "models", NULL,
+ NULL, 0, NULL, 0,
+ CTL_CREATE, CTL_EOL);
+
+ sysctl_createv(clog, 0, &rnode, &rnode,
+ CTLFLAG_PERMANENT,
+ CTLTYPE_NODE, "overlay",
+ SYSCTL_DESCR("Overlay security model on-top of bsd44, "),
+ NULL, 0, NULL, 0,
+ CTL_CREATE, CTL_EOL);
+
+ sysctl_createv(clog, 0, &rnode, NULL,
+ CTLFLAG_PERMANENT,
+ CTLTYPE_STRING, "name", NULL,
+ NULL, 0, __UNCONST("Overlay (on-top of bsd44)"), 0,
+ CTL_CREATE, CTL_EOL);
+
+ sysctl_createv(clog, 0, &rnode, NULL,
+ CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
+ CTLTYPE_INT, "securelevel",
+ SYSCTL_DESCR("System security level"),
+ secmodel_bsd44_sysctl_securelevel, 0, &securelevel, 0,
+ CTL_CREATE, CTL_EOL);
+
+ sysctl_createv(clog, 0, &rnode, NULL,
+ CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
+ CTLTYPE_INT, "curtain",
+ SYSCTL_DESCR("Curtain information about objects to "
+ "users not owning them."),
+ NULL, 0, &secmodel_bsd44_curtain, 0,
+ CTL_CREATE, CTL_EOL);
+}
+
+/*
+ * Start the overlay security model.
+ */
+void
+secmodel_start(void)
+{
+ secmodel_overlay_init();
+
+ kauth_listen_scope(KAUTH_SCOPE_GENERIC,
+ secmodel_overlay_generic_cb, NULL);
+ kauth_listen_scope(KAUTH_SCOPE_SYSTEM,
+ secmodel_overlay_system_cb, NULL);
+ kauth_listen_scope(KAUTH_SCOPE_PROCESS,
+ secmodel_overlay_process_cb, NULL);
+ kauth_listen_scope(KAUTH_SCOPE_NETWORK,
+ secmodel_overlay_network_cb, NULL);
+ kauth_listen_scope(KAUTH_SCOPE_MACHDEP,
+ secmodel_overlay_machdep_cb, NULL);
+}
+
+/*
+ * Overlay listener for the generic scope.
+ */
+int
+secmodel_overlay_generic_cb(kauth_cred_t cred, kauth_action_t action,
+ void *cookie, void *arg0, void *arg1, void *arg2, void *arg3)
+{
+ int result;
+
+ result = KAUTH_RESULT_DEFER;
+
+ switch (action) {
+ default:
+ result = KAUTH_RESULT_DEFER;
+ break;
+ }
+
+ if (result == KAUTH_RESULT_DEFER) {
+ result = kauth_authorize_action(
+ secmodel_overlay_iscope_generic, cred, action,
+ arg0, arg1, arg2, arg3);
+ }
+
+ return (result);
+}
+
+/*
+ * Overlay listener for the system scope.
+ */
+int
+secmodel_overlay_system_cb(kauth_cred_t cred, kauth_action_t action,
+ void *cookie, void *arg0, void *arg1, void *arg2, void *arg3)
+{
+ int result;
+
+ result = KAUTH_RESULT_DEFER;
+
+ switch (action) {
+ default:
+ result = KAUTH_RESULT_DEFER;
+ break;
+ }
+
+ if (result == KAUTH_RESULT_DEFER) {
+ result = kauth_authorize_action(
+ secmodel_overlay_iscope_system, cred, action,
+ arg0, arg1, arg2, arg3);
+ }
+
+ return (result);
+}
+
+/*
+ * Overlay listener for the process scope.
+ */
+int
+secmodel_overlay_process_cb(kauth_cred_t cred, kauth_action_t action,
+ void *cookie, void *arg0, void *arg1, void *arg2, void *arg3)
+{
+ int result;
+
+ result = KAUTH_RESULT_DEFER;
+
+ switch (action) {
+ default:
+ result = KAUTH_RESULT_DEFER;
+ break;
+ }
+
+ if (result == KAUTH_RESULT_DEFER) {
+ result = kauth_authorize_action(
+ secmodel_overlay_iscope_process, cred, action,
+ arg0, arg1, arg2, arg3);
+ }
+
+ return (result);
+}
+
+/*
+ * Overlay listener for the network scope.
+ */
+int
+secmodel_overlay_network_cb(kauth_cred_t cred, kauth_action_t action,
+ void *cookie, void *arg0, void *arg1, void *arg2, void *arg3)
+{
+ int result;
+
+ result = KAUTH_RESULT_DEFER;
+
+ switch (action) {
+ default:
+ result = KAUTH_RESULT_DEFER;
+ break;
+ }
+
+ if (result == KAUTH_RESULT_DEFER) {
+ result = kauth_authorize_action(
+ secmodel_overlay_iscope_network, cred, action,
+ arg0, arg1, arg2, arg3);
+ }
+
+ return (result);
+}
+
+/*
+ * Overlay listener for the machdep scope.
+ */
+int
+secmodel_overlay_machdep_cb(kauth_cred_t cred, kauth_action_t action,
+ void *cookie, void *arg0, void *arg1, void *arg2, void *arg3)
+{
+ int result;
+
+ result = KAUTH_RESULT_DEFER;
+
+ switch (action) {
+ default:
+ result = KAUTH_RESULT_DEFER;
+ break;
+ }
+
+ if (result == KAUTH_RESULT_DEFER) {
+ result = kauth_authorize_action(
+ secmodel_overlay_iscope_machdep, cred, action,
+ arg0, arg1, arg2, arg3);
+ }
+
+ return (result);
+}
diff --git a/sys/secmodel/secmodel.h b/sys/secmodel/secmodel.h
new file mode 100644
index 00000000000..3cfb3d5d253
--- /dev/null
+++ b/sys/secmodel/secmodel.h
@@ -0,0 +1,37 @@
+/* $NetBSD: secmodel.h,v 1.1 2006/09/08 20:58:56 elad Exp $ */
+/*-
+ * Copyright (c) 2006 Elad Efrat <elad@NetBSD.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ * must display the following acknowledgement:
+ * This product includes software developed by Elad Efrat.
+ * 4. The name of the author may not be used to endorse or promote products
+ * derived from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef _SECMODEL_SECMODEL_H_
+#define _SECMODEL_SECMODEL_H_
+
+void secmodel_start(void);
+
+#endif /* !_SECMODEL_SECMODEL_H_ */