The branch main has been updated by allanjude:
URL:
https://cgit.FreeBSD.org/src/commit/?id=4e2121c10afc3d9273368eae776fe31d0c68ba6a
commit 4e2121c10afc3d9273368eae776fe31d0c68ba6a
Author: Mitchell Horne <mho...@freebsd.org>
AuthorDate: 2022-07-18 21:25:00 +0000
Commit: Allan Jude <allanj...@freebsd.org>
CommitDate: 2022-07-18 22:06:22 +0000
mac_ddb: add some validation functions
These global objects are easy to validate, so provide the helper
functions to do so and include these commands in the allow lists.
Reviewed by: markj
Sponsored by: Juniper Networks, Inc.
Sponsored by: Klara, Inc.
Differential Revision: https://reviews.freebsd.org/D35372
---
sys/security/mac_ddb/mac_ddb.c | 101 +++++++++++++++++++++++++++++++++++++++++
1 file changed, 101 insertions(+)
diff --git a/sys/security/mac_ddb/mac_ddb.c b/sys/security/mac_ddb/mac_ddb.c
index 8f07a664b7eb..89cba3145945 100644
--- a/sys/security/mac_ddb/mac_ddb.c
+++ b/sys/security/mac_ddb/mac_ddb.c
@@ -29,11 +29,17 @@
*/
#include <sys/param.h>
+#include <sys/jail.h>
#include <sys/kdb.h>
#include <sys/module.h>
+#include <sys/mount.h>
#include <sys/proc.h>
+#include <sys/queue.h>
+#include <sys/rman.h>
#include <sys/sysctl.h>
+#include <net/vnet.h>
+
#include <ddb/ddb.h>
#include <ddb/db_command.h>
@@ -67,6 +73,11 @@ typedef int db_validation_fn_t(db_expr_t addr, bool
have_addr, db_expr_t count,
char *modif);
static db_validation_fn_t db_thread_valid;
+static db_validation_fn_t db_show_ffs_valid;
+static db_validation_fn_t db_show_prison_valid;
+static db_validation_fn_t db_show_proc_valid;
+static db_validation_fn_t db_show_rman_valid;
+static db_validation_fn_t db_show_vnet_valid;
struct cmd_list_item {
const char *name;
@@ -80,7 +91,12 @@ static const struct cmd_list_item command_list[] = {
/* List of ddb(4) 'show' commands which are allowed by this policy. */
static const struct cmd_list_item show_command_list[] = {
+ { "ffs", db_show_ffs_valid },
+ { "prison", db_show_prison_valid },
+ { "proc", db_show_proc_valid },
+ { "rman", db_show_rman_valid },
{ "thread", db_thread_valid },
+ { "vnet", db_show_vnet_valid },
};
static int
@@ -103,6 +119,91 @@ db_thread_valid(db_expr_t addr, bool have_addr, db_expr_t
count, char *modif)
return (EACCES);
}
+static int
+db_show_ffs_valid(db_expr_t addr, bool have_addr, db_expr_t count, char *modif)
+{
+ struct mount *mp;
+
+ /* No addr will show all mounts. */
+ if (!have_addr)
+ return (0);
+
+ TAILQ_FOREACH(mp, &mountlist, mnt_list)
+ if ((void *)mp == (void *)addr)
+ return (0);
+
+ return (EACCES);
+}
+
+static int
+db_show_prison_valid(db_expr_t addr, bool have_addr, db_expr_t count,
+ char *modif)
+{
+ struct prison *pr;
+ int pr_id;
+
+ if (!have_addr || addr == 0)
+ return (0);
+
+ /* prison can match by pointer address or ID. */
+ pr_id = (int)addr;
+ TAILQ_FOREACH(pr, &allprison, pr_list)
+ if (pr->pr_id == pr_id || (void *)pr == (void *)addr)
+ return (0);
+
+ return (EACCES);
+}
+
+static int
+db_show_proc_valid(db_expr_t addr, bool have_addr, db_expr_t count,
+ char *modif)
+{
+ struct proc *p;
+ int i;
+
+ /* Default will show the current proc. */
+ if (!have_addr)
+ return (0);
+
+ for (i = 0; i <= pidhash; i++) {
+ LIST_FOREACH(p, &pidhashtbl[i], p_hash) {
+ if ((void *)p == (void *)addr)
+ return (0);
+ }
+ }
+
+ return (EACCES);
+}
+
+static int
+db_show_rman_valid(db_expr_t addr, bool have_addr, db_expr_t count, char
*modif)
+{
+ struct rman *rm;
+
+ TAILQ_FOREACH(rm, &rman_head, rm_link) {
+ if ((void *)rm == (void *)rm)
+ return (0);
+ }
+
+ return (EACCES);
+}
+
+static int
+db_show_vnet_valid(db_expr_t addr, bool have_addr, db_expr_t count, char
*modif)
+{
+ VNET_ITERATOR_DECL(vnet);
+
+ if (!have_addr)
+ return (0);
+
+ VNET_FOREACH(vnet) {
+ if ((void *)vnet == (void *)addr)
+ return (0);
+ }
+
+ return (EACCES);
+}
+
static int
command_match(struct db_command *cmd, struct cmd_list_item item)
{
