1 /*
2 * Copyright (c) 2007 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28 #include <sys/param.h>
29 #include <sys/vnode.h>
30 #include <sys/vnode_internal.h>
31 #include <sys/kauth.h>
32 #include <sys/namei.h>
33 #include <sys/mount.h>
34 #include <sys/mount_internal.h>
35 #include <sys/uio_internal.h>
36 #include <sys/xattr.h>
37 #include "../bsd/sys/fsevents.h"
38
39 #include <security/mac_internal.h>
40
41 /*
42 * Caller holds I/O reference on vnode
43 */
44 int
vnode_label(struct mount * mp,struct vnode * dvp,struct vnode * vp,struct componentname * cnp,int flags,vfs_context_t ctx)45 vnode_label(struct mount *mp, struct vnode *dvp, struct vnode *vp,
46 struct componentname *cnp, int flags, vfs_context_t ctx)
47 {
48 int error = 0;
49 bool exit_fast;
50
51 /* fast path checks... */
52
53 /* are we labeling vnodes? If not still notify of create */
54 #if CONFIG_MACF_LAZY_VNODE_LABELS
55 exit_fast = true;
56 #else
57 exit_fast = (mac_label_vnodes == 0);
58 #endif
59 if (exit_fast) {
60 if (flags & VNODE_LABEL_CREATE) {
61 error = mac_vnode_notify_create(ctx,
62 mp, dvp, vp, cnp);
63 }
64 return 0;
65 }
66
67 /* if already VL_LABELED */
68 if (vp->v_lflag & VL_LABELED) {
69 return 0;
70 }
71
72 vnode_lock_spin(vp);
73
74 /*
75 * must revalidate state once we hold the lock
76 * since we could have blocked and someone else
77 * has since labeled this vnode
78 */
79 if (vp->v_lflag & VL_LABELED) {
80 vnode_unlock(vp);
81 return 0;
82 }
83
84 if ((vp->v_lflag & VL_LABEL) == 0) {
85 vp->v_lflag |= VL_LABEL;
86
87 /* Could sleep on disk I/O, drop lock. */
88 vnode_unlock(vp);
89
90 if (mac_vnode_label(vp) == NULL) {
91 mac_vnode_label_init(vp);
92 }
93
94 if (flags & VNODE_LABEL_CREATE) {
95 error = mac_vnode_notify_create(ctx,
96 mp, dvp, vp, cnp);
97 } else {
98 error = mac_vnode_label_associate(mp, vp, ctx);
99 }
100
101 vnode_lock_spin(vp);
102
103 if ((error == 0) && (vp->v_flag & VNCACHEABLE)) {
104 vp->v_lflag |= VL_LABELED;
105 }
106 vp->v_lflag &= ~VL_LABEL;
107
108 if (vp->v_lflag & VL_LABELWAIT) {
109 vp->v_lflag &= ~VL_LABELWAIT;
110 wakeup(&vp->v_label);
111 }
112 } else {
113 struct timespec ts;
114
115 ts.tv_sec = 10;
116 ts.tv_nsec = 0;
117
118 while (vp->v_lflag & VL_LABEL) {
119 vp->v_lflag |= VL_LABELWAIT;
120
121 error = msleep(&vp->v_label, &vp->v_lock, PVFS | PDROP,
122 "vnode_label", &ts);
123 vnode_lock_spin(vp);
124
125 if (error == EWOULDBLOCK) {
126 vprint("vnode label timeout", vp);
127 break;
128 }
129 }
130 /* XXX: what should be done if labeling failed (above)? */
131 }
132 vnode_unlock(vp);
133
134 return error;
135 }
136
137
138 /*
139 * Clear the "labeled" flag on a VNODE.
140 * VNODE will have label re-associated upon
141 * next call to lookup().
142 *
143 * Caller verifies vfs_flags(vnode_mount(vp)) & MNT_MULTILABEL
144 * Caller holds vnode lock.
145 */
146 void
vnode_relabel(struct vnode * vp)147 vnode_relabel(struct vnode *vp)
148 {
149 /* Wait for any other labeling to complete. */
150 while (vp->v_lflag & VL_LABEL) {
151 vp->v_lflag |= VL_LABELWAIT;
152 (void)msleep(&vp->v_label, &vp->v_lock, PVFS, "vnode_relabel", 0);
153 }
154
155 /* Clear labeled flag */
156 vp->v_lflag &= ~VL_LABELED;
157
158 return;
159 }
160
161 /*
162 * VFS XATTR helpers.
163 */
164
165 int
mac_vnop_setxattr(struct vnode * vp,const char * name,char * buf,size_t len)166 mac_vnop_setxattr(struct vnode *vp, const char *name, char *buf, size_t len)
167 {
168 vfs_context_t ctx;
169 int options = XATTR_NOSECURITY;
170 uio_stackbuf_t uio_buf[UIO_SIZEOF(1)];
171 uio_t auio;
172 int error;
173
174 if (vfs_isrdonly(vp->v_mount)) {
175 return EROFS;
176 }
177
178 ctx = vfs_context_current();
179 auio = uio_createwithbuffer(1, 0, UIO_SYSSPACE, UIO_WRITE,
180 &uio_buf[0], sizeof(uio_buf));
181 uio_addiov(auio, CAST_USER_ADDR_T(buf), len);
182
183 error = vn_setxattr(vp, name, auio, options, ctx);
184 #if CONFIG_FSE
185 if (error == 0) {
186 add_fsevent(FSE_XATTR_MODIFIED, ctx,
187 FSE_ARG_VNODE, vp,
188 FSE_ARG_DONE);
189 }
190 #endif
191
192 return error;
193 }
194
195 int
mac_vnop_getxattr(struct vnode * vp,const char * name,char * buf,size_t len,size_t * attrlen)196 mac_vnop_getxattr(struct vnode *vp, const char *name, char *buf, size_t len,
197 size_t *attrlen)
198 {
199 vfs_context_t ctx = vfs_context_current();
200 int options = XATTR_NOSECURITY;
201 uio_stackbuf_t uio_buf[UIO_SIZEOF(1)];
202 uio_t auio;
203 int error;
204
205 auio = uio_createwithbuffer(1, 0, UIO_SYSSPACE, UIO_READ,
206 &uio_buf[0], sizeof(uio_buf));
207 uio_addiov(auio, CAST_USER_ADDR_T(buf), len);
208
209 error = vn_getxattr(vp, name, auio, attrlen, options, ctx);
210 *attrlen = len - uio_resid(auio);
211
212 return error;
213 }
214
215 int
mac_vnop_removexattr(struct vnode * vp,const char * name)216 mac_vnop_removexattr(struct vnode *vp, const char *name)
217 {
218 vfs_context_t ctx = vfs_context_current();
219 int options = XATTR_NOSECURITY;
220 int error;
221
222 if (vfs_isrdonly(vp->v_mount)) {
223 return EROFS;
224 }
225
226 error = vn_removexattr(vp, name, options, ctx);
227 #if CONFIG_FSE
228 if (error == 0) {
229 add_fsevent(FSE_XATTR_REMOVED, ctx,
230 FSE_ARG_VNODE, vp,
231 FSE_ARG_DONE);
232 }
233 #endif
234
235 return error;
236 }
237