mac_priv.c revision 187667
1164032Srwatson/*- 2164032Srwatson * Copyright (c) 2006 nCircle Network Security, Inc. 3164032Srwatson * All rights reserved. 4164032Srwatson * 5164032Srwatson * This software was developed by Robert N. M. Watson for the TrustedBSD 6164032Srwatson * Project under contract to nCircle Network Security, Inc. 7164032Srwatson * 8164032Srwatson * Redistribution and use in source and binary forms, with or without 9164032Srwatson * modification, are permitted provided that the following conditions 10164032Srwatson * are met: 11164032Srwatson * 1. Redistributions of source code must retain the above copyright 12164032Srwatson * notice, this list of conditions and the following disclaimer. 13164032Srwatson * 2. Redistributions in binary form must reproduce the above copyright 14164032Srwatson * notice, this list of conditions and the following disclaimer in the 15164032Srwatson * documentation and/or other materials provided with the distribution. 16164032Srwatson * 17164032Srwatson * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 18164032Srwatson * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 19164032Srwatson * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 20164032Srwatson * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR, NCIRCLE NETWORK SECURITY, 21164032Srwatson * INC., OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 22164032Srwatson * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED 23164032Srwatson * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR 24164032Srwatson * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF 25164032Srwatson * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING 26164032Srwatson * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 27164032Srwatson * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 28164032Srwatson */ 29164032Srwatson 30164032Srwatson/* 31164032Srwatson * MAC checks for system privileges. 32164032Srwatson */ 33164032Srwatson 34187667Srwatson#include "sys/cdefs.h" 35187667Srwatson__FBSDID("$FreeBSD: head/sys/security/mac/mac_priv.c 187667 2009-01-24 13:15:45Z rwatson $"); 36187667Srwatson 37164032Srwatson#include "opt_mac.h" 38164032Srwatson 39164032Srwatson#include <sys/param.h> 40164032Srwatson#include <sys/priv.h> 41164032Srwatson#include <sys/module.h> 42164032Srwatson 43164032Srwatson#include <security/mac/mac_framework.h> 44164032Srwatson#include <security/mac/mac_internal.h> 45165469Srwatson#include <security/mac/mac_policy.h> 46164032Srwatson 47165424Srwatson/* 48165424Srwatson * The MAC Framework interacts with kernel privilege checks in two ways: it 49165424Srwatson * may restrict the granting of privilege to a subject, and it may grant 50165424Srwatson * additional privileges to the subject. Policies may implement none, one, 51165424Srwatson * or both of these entry points. Restriction of privilege by any policy 52165424Srwatson * always overrides granting of privilege by any policy or other privilege 53165424Srwatson * mechanism. See kern_priv.c:priv_check_cred() for details of the 54165424Srwatson * composition. 55165424Srwatson */ 56165424Srwatson 57165424Srwatson/* 58165424Srwatson * Restrict access to a privilege for a credential. Return failure if any 59165424Srwatson * policy denies access. 60165424Srwatson */ 61164032Srwatsonint 62164032Srwatsonmac_priv_check(struct ucred *cred, int priv) 63164032Srwatson{ 64164032Srwatson int error; 65164032Srwatson 66164032Srwatson MAC_CHECK(priv_check, cred, priv); 67164032Srwatson 68164032Srwatson return (error); 69164032Srwatson} 70164032Srwatson 71165424Srwatson/* 72165424Srwatson * Grant access to a privilege for a credential. Return success if any 73165424Srwatson * policy grants access. 74165424Srwatson */ 75164032Srwatsonint 76164032Srwatsonmac_priv_grant(struct ucred *cred, int priv) 77164032Srwatson{ 78164032Srwatson int error; 79164032Srwatson 80164032Srwatson MAC_GRANT(priv_grant, cred, priv); 81164032Srwatson 82164032Srwatson return (error); 83164032Srwatson} 84