New hooks for MAC framework?

[Scott Moore]

Hi all,

Recently, I've been working on a capability-based shell scripting language.
The purpose of the language is to give script writers and consumers
fine-grained control over what resources (files, sockets, etc) a script can
access. As part of this project, we have developed a new capability-based
sandbox that extends the security guarantees provided by the language to
arbitrary executables. The sandbox is implemented as a policy module for
the FreeBSD MAC framework.

To get this to work, we needed to make a few changes to the MAC framework
itself. In particular, we needed to add two new hooks:
mac_vnode_post_lookup and mac_vnode_post_create.

The first hook, mac_vnode_post_lookup, is inside the namei loop and
provides the policy module with the vnodes and labels of both the parent
node and the child, along with the componentname that was just resolved.
The second hook,  mac_vnode_post_create follows the various operations that
invoke mac_vnode_check_create and also provides the parent and child vnodes
along with the componentname.

We need these hooks because our policy module simulates capability
enforcement by propagating derived capabilities as files and directories
are accessed or created. Our initial performance analysis indicates that
these hooks introduce relatively little overhead, but we're working on more
detailed benchmarks.

I am curious if anyone else has implemented similar functionality for a
different project or thinks that these could be useful changes to push
upstream. I've attached the patch from our prototype to this email. Of
course, it needs more substantial testing and additional changes to
integrate it correctly with other subsystems like audit.

On a related note, I'd also like to suggest a possible change to the
interaction between the MAC and DAC enforcement mechanisms in the
filesystem. Currently, vn_setlabel checks with the filesystem DAC before
allowing a label change (by invoking VOP_ACCESS with VADMIN). For our
particular use of the MAC framework this isn't ideal since our labels only
restrict the current process, and this check requires the process creating
the sandbox to have more privileges than it needs. It would be nice if our
policy could use the privilege mechanism to overrule the DAC check in this
function. I haven't worked on a patch to do this yet.

Thanks,
Scott
-------------- next part --------------
A non-text attachment was scrubbed...
Name: hooks.patch
Type: application/octet-stream
Size: 8770 bytes
Desc: not available
URL: <http://lists.freebsd.org/pipermail/freebsd-arch/attachments/20140804/fab03191/attachment.obj>