1 /* $NetBSD: secmodel_bsd44.c,v 1.12 2009/05/03 21:25:44 elad Exp $ */ 2 /*- 3 * Copyright (c) 2006 Elad Efrat <elad@NetBSD.org> 4 * All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 1. Redistributions of source code must retain the above copyright 10 * notice, this list of conditions and the following disclaimer. 11 * 2. Redistributions in binary form must reproduce the above copyright 12 * notice, this list of conditions and the following disclaimer in the 13 * documentation and/or other materials provided with the distribution. 14 * 3. The name of the author may not be used to endorse or promote products 15 * derived from this software without specific prior written permission. 16 * 17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 18 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 19 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 20 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 21 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 22 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 23 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 24 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 25 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 26 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 27 */ 28 29 #include <sys/cdefs.h> 30 __KERNEL_RCSID(0, "$NetBSD: secmodel_bsd44.c,v 1.12 2009/05/03 21:25:44 elad Exp $"); 31 32 #include <sys/types.h> 33 #include <sys/param.h> 34 #include <sys/kauth.h> 35 36 #include <sys/sysctl.h> 37 #include <sys/mount.h> 38 39 #include <secmodel/secmodel.h> 40 41 #include <secmodel/bsd44/bsd44.h> 42 #include <secmodel/bsd44/suser.h> 43 #include <secmodel/securelevel/securelevel.h> 44 45 SYSCTL_SETUP(sysctl_security_bsd44_setup, 46 "sysctl security bsd44 setup") 47 { 48 const struct sysctlnode *rnode; 49 50 sysctl_createv(clog, 0, NULL, &rnode, 51 CTLFLAG_PERMANENT, 52 CTLTYPE_NODE, "security", NULL, 53 NULL, 0, NULL, 0, 54 CTL_SECURITY, CTL_EOL); 55 56 sysctl_createv(clog, 0, &rnode, NULL, 57 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 58 CTLTYPE_INT, "curtain", NULL, 59 NULL, 0, &secmodel_bsd44_curtain, 0, 60 CTL_CREATE, CTL_EOL); 61 62 sysctl_createv(clog, 0, &rnode, &rnode, 63 CTLFLAG_PERMANENT, 64 CTLTYPE_NODE, "models", NULL, 65 NULL, 0, NULL, 0, 66 CTL_CREATE, CTL_EOL); 67 68 sysctl_createv(clog, 0, &rnode, &rnode, 69 CTLFLAG_PERMANENT, 70 CTLTYPE_NODE, "bsd44", 71 SYSCTL_DESCR("Traditional NetBSD Security model, " \ 72 "derived from 4.4BSD"), 73 NULL, 0, NULL, 0, 74 CTL_CREATE, CTL_EOL); 75 76 sysctl_createv(clog, 0, &rnode, NULL, 77 CTLFLAG_PERMANENT, 78 CTLTYPE_STRING, "name", NULL, 79 NULL, 0, __UNCONST("Traditional NetBSD (4.4BSD)"), 0, 80 CTL_CREATE, CTL_EOL); 81 82 sysctl_createv(clog, 0, &rnode, NULL, 83 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 84 CTLTYPE_INT, "securelevel", 85 SYSCTL_DESCR("System security level"), 86 secmodel_securelevel_sysctl, 0, NULL, 0, 87 CTL_CREATE, CTL_EOL); 88 89 sysctl_createv(clog, 0, &rnode, NULL, 90 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 91 CTLTYPE_INT, "curtain", 92 SYSCTL_DESCR("Curtain information about objects to " 93 "users not owning them."), 94 NULL, 0, &secmodel_bsd44_curtain, 0, 95 CTL_CREATE, CTL_EOL); 96 97 sysctl_createv(clog, 0, &rnode, NULL, 98 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 99 CTLTYPE_INT, "usermount", 100 SYSCTL_DESCR("Whether unprivileged users may mount " 101 "filesystems"), 102 NULL, 0, &dovfsusermount, 0, 103 CTL_CREATE, CTL_EOL); 104 105 106 /* 107 * For compatibility, create the "dovfsusermount" variable in its 108 * original location. 109 */ 110 sysctl_createv(clog, 0, NULL, NULL, 111 CTLFLAG_PERMANENT, 112 CTLTYPE_NODE, "vfs", NULL, 113 NULL, 0, NULL, 0, 114 CTL_VFS, CTL_EOL); 115 sysctl_createv(clog, 0, NULL, NULL, 116 CTLFLAG_PERMANENT, 117 CTLTYPE_NODE, "generic", 118 SYSCTL_DESCR("Non-specific vfs related information"), 119 NULL, 0, NULL, 0, 120 CTL_VFS, VFS_GENERIC, CTL_EOL); 121 sysctl_createv(clog, 0, NULL, NULL, 122 CTLFLAG_PERMANENT|CTLFLAG_READWRITE, 123 CTLTYPE_INT, "usermount", 124 SYSCTL_DESCR("Whether unprivileged users may mount " 125 "filesystems"), 126 NULL, 0, &dovfsusermount, 0, 127 CTL_VFS, VFS_GENERIC, VFS_USERMOUNT, CTL_EOL); 128 } 129 130 void 131 secmodel_bsd44_start(void) 132 { 133 secmodel_bsd44_init(); 134 135 secmodel_bsd44_suser_start(); 136 secmodel_securelevel_start(); 137 138 secmodel_register(); 139 } 140 141 #if defined(_LKM) 142 void 143 secmodel_bsd44_stop(void) 144 { 145 secmodel_bsd44_suser_stop(); 146 secmodel_securelevel_stop(); 147 148 secmodel_deregister(); 149 } 150 #endif /* _LKM */ 151 152 #if !defined(_LKM) 153 void 154 secmodel_start(void) 155 { 156 secmodel_bsd44_start(); 157 } 158 #endif /* !_LKM */ 159 160 161