tsolextension.c revision 1295
1295N/A * Copyright (c) 2004, 2012, Oracle and/or its affiliates. All rights reserved. 0N/A * Permission is hereby granted, free of charge, to any person obtaining a 919N/A * copy of this software and associated documentation files (the "Software"), 919N/A * to deal in the Software without restriction, including without limitation 919N/A * the rights to use, copy, modify, merge, publish, distribute, sublicense, 919N/A * and/or sell copies of the Software, and to permit persons to whom the 919N/A * Software is furnished to do so, subject to the following conditions: 919N/A * The above copyright notice and this permission notice (including the next 919N/A * paragraph) shall be included in all copies or substantial portions of the 919N/A * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 919N/A * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 919N/A * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL 919N/A * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 919N/A * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING 919N/A * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER 919N/A * DEALINGS IN THE SOFTWARE. 1088N/A * Key to lookup devPrivate data in various structures 606N/A/* XACE hook callbacks */ 0N/A * Initialize the extension. Main entry point for this loadable 799N/A /* DAC support can be added in future */ 0N/A ErrorF(
"TsolExtensionInit: AddExtension failed for X Trusted Extensions\n");
606N/A /* Allocate storage in devPrivates */ 1088N/A ErrorF(
"TsolExtensionInit: Cannot allocate client private.\n");
1088N/A ErrorF(
"TsolExtensionInit: Cannot allocate pixmap private.\n");
1088N/A ErrorF(
"TsolExtensionInit: Cannot allocate window private.\n");
1088N/A ErrorF(
"TsolExtensionInit: Cannot allocate property private.\n");
1088N/A ErrorF(
"TsolExtensionInit: Cannot allocate selection private.\n");
1088N/A ErrorF(
"TsolExtensionInit: Cannot allocate device private.\n");
679N/A /* Initialize the client info for server itself */ 606N/A /* Initialize security hooks */ 0N/A /* Save original Proc vectors */ 877N/A * Handle other resource types. 1088N/A * In RANDR extension, usual window policy is 877N/A * enforced before checking for RREventType. 679N/A /* fall through to reset the SL */ 679N/A /* All others handled in SelectionAccess handler */ 0N/A /* Got a new connection */ 36N/A /* Audit disconnect */ 0N/A * Individual routines 606N/A * Set PolyInstantiation Info. 0N/A * Normally a get(prop) will 0N/A * get the prop. that has match sl, uid of the client. Setting 0N/A * enabled to true will get only the prop. corresponding to 0N/A * sl, uid specified instead of that of client. This is used 799N/A /* Requires win_mac_write privilege */ 0N/A /* first see if property already exists */ 0N/A /* property does not exist */ 799N/A /* Requires win_mac_write privilege */ 168N/A /* Initialize property created internally by server */ 0N/A /* first see if property already exists */ 0N/A /* property does not exist */ 799N/A /* Requires win_mac_write privilege */ 168N/A /* Initialize property created internally by server */ 799N/A /* Requires win_mac_write privilege */ 0N/A /* generate the notify event for windows */ 799N/A /* set Screen Stripe Size */ 799N/A /* Requires win_dac_write privilege */ 0N/A /* Valid window check */ 0N/A /* Transfer the client info to reply rec */ 0N/A /* Valid window check */ 0N/A /* Transfer the client info to reply rec */ 0N/A /* allocate temp storage for labels */ 0N/A /* fill the fields as per request mask */ 0N/A /* first see if property already exists */ 679N/A break;
/* match found */ 679N/A break;
/* match found */ 679N/A /* property does not exist, use window's attributes */ 0N/A /* allocate temp storage for labels */ 0N/A /* fill the fields as per request mask */ 0N/A /* allocate temp storage for labels */ 0N/A /* fill the fields as per request mask */ 606N/A * Session type single-level? This is set by the 470N/A /* window should not be root but child of root */ 311N/A /* window should not be root but child of root */ 0N/A * Force kbd & ptr ungrab. This will cause 0N/A * screen to lock even when kbd/ptr grabbed by 0N/A * Turn on window's Trusted bit 0N/A /* window should not be root but child of root */ 0N/A /* Turn on Trusted bit of the window */ 0N/A * Turn off window's Trusted bit 0N/A /* window should not be root but child of root */ 0N/A * Break keyboard & ptr grabs of clients other than 0N/A * the requesting client. 0N/A * Called from ProcMakeTPWindow. 0N/A * Trusted Network interface module. Uses tsix API 0N/A /* Get client attributes from the socket */ 639N/A " for %s, getpeerucred failed: %s\n",
0N/A /* Extract individual fields from the cred structure */ 639N/A get the real process name out of /proc in the future 0N/A /* Set privileges */ 0N/A * For remote hosts, the uid is determined during access control 0N/A /* Set Trusted Path for local clients */ 311N/A /* Set reasonable defaults for remote clients */ 36N/A /* Use NI_NUMERICHOST to avoid DNS lookup */ 36N/A /* setup audit context */ 36N/A /* decode into msg */ 36N/A /* do the authentication */ 36N/A return ((
char *)0);
/* ((struct authdes_cred *) NULL); */ 36N/A /* Retrieve uid from SecureRPC */ 36N/A ErrorF(
"Unable to authenticate Secure RPC client");
196N/A * For multilevel desktop, limit connections to the trusted path 606N/A * i.e. global zone until a user logs in and the trusted stripe 196N/A * is in place. Unlabeled connections are rejected. 0N/A * Workstation Owner set, client must be within label 0N/A * range or have trusted path 461N/A /* Allow root from global zone */ 461N/A * Access check based on uid. Check if 461N/A * roles or other uids have been added by 36N/A /* Audit the connection */ 606N/A/* int count = rec->count; */ 799N/A "TsolCheckSendAccess(%s, %s) = %s\n",
799N/A#
endif /* !NO_TSOL_DEBUG_MESSAGES */ 679N/A * Special processing for selection agent. This is how 679N/A * we know who to redirect privileged ConvertSelection requests. 679N/A * This is also used to fake the onwership of GetSelectionOwner requests. 679N/A * The callback function is only called if at least one matching selection exists. 679N/A * If it has no tsol attributes then we know it is the only match so we don't need to 679N/A * check for polyinstantiation. Just initialize it and return. 679N/A /* for poly-selections, search from the beginning to see if sl,uid match */ 679N/A * Doesn't match yet; we'll get called again 679N/A * After it gets created. 679N/A /* Assign the sl & uid */ 679N/A /* for poly-selections, search from the beginning to see if sl,uid match */ 679N/A * Doesn't match yet; we'll get called again 679N/A * After it gets created. 679N/A * Selection Agent processing. Override the owner 679N/A "policy not implemented for CheckSelectionAccess(%s, %s, %s, %s) = %s\n",
639N/A#
endif /* !NO_TSOL_DEBUG_MESSAGES */ 1088N/A /* If current property is not accessible, move on to 679N/A * next one for ListProperty 679N/A /* Handle polyinstantiated property */ 679N/A /* search for a matching (sl, uid) pair */ 679N/A break;
/* match found */ 679N/A "TsolCheckPropertyAccess(%s, 0x%x, %s, %s) = %s\n",
679N/A#
endif /* !NO_TSOL_DEBUG_MESSAGES */ 0N/A * Return TRUE if host is cipso