support simple predicates to prefix rules. Allows global policies to be

different for different users.

3 files changed, 125 insertions, 7 deletions

diff --git a/bin/systrace/policy.c b/bin/systrace/policy.c
index c75fb4d6c4d..187be64a906 100644
--- a/bin/systrace/policy.c
+++ b/bin/systrace/policy.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: policy.c,v 1.5 2002/06/04 23:05:26 provos Exp $	*/
+/*	$OpenBSD: policy.c,v 1.6 2002/06/05 20:52:47 provos Exp $	*/
 /*
  * Copyright 2002 Niels Provos <provos@citi.umich.edu>
  * All rights reserved.
@@ -37,6 +37,7 @@
 #include <stdlib.h>
 #include <string.h>
 #include <unistd.h>
+#include <grp.h>
 #include <stdio.h>
 #include <fcntl.h>
 #include <ctype.h>
@@ -87,7 +88,9 @@ SPLAY_GENERATE(polnrtree, policy, nrnode, polnrcompare);
 
 extern int userpolicy;
 
-char policydir[MAXPATHLEN];
+static char policydir[MAXPATHLEN];
+static char *groupnames[NGROUPS_MAX];
+static int ngroups;
 
 void
 systrace_setupdir(void)
@@ -116,9 +119,25 @@ systrace_setupdir(void)
 int
 systrace_initpolicy(char *file)
 {
+	gid_t groups[NGROUPS_MAX];
+	int i;
+
 	SPLAY_INIT(&policyroot);
 	SPLAY_INIT(&polnrroot);
 
+	/* Find out group names for current user */
+	if ((ngroups = getgroups(NGROUPS_MAX, groups)) == -1)
+		err(1, "getgroups");
+
+	for (i = 0; i < ngroups; i++) {
+		struct group *gr;
+
+		if ((gr = getgrgid(groups[i])) == NULL)
+			err(1, "getgrgid(%d)", groups[i]);
+		if ((groupnames[i] = strdup(gr->gr_name)) == NULL)
+			err(1, "strdup(%s)", gr->gr_name);
+	}
+
 	if (userpolicy)
 		systrace_setupdir();
 
@@ -283,6 +302,59 @@ systrace_addpolicy(char *name)
 }
 
 int
+systrace_predicatematch(char *p)
+{
+	extern char *username;
+	int i, res, neg;
+
+	res = 0;
+	neg = 0;
+
+	if (!strncasecmp(p, "user", 4)) {
+		/* Match against user name */
+		p += 4;
+		p += strspn(p, " \t");
+		if (!strncmp(p, "=", 1)) {
+			p += 1;
+			neg = 0;
+		} else if (!strncmp(p, "!=", 2)) {
+			p += 2;
+			neg = 1;
+		} else
+			return (-1);
+		p += strspn(p, " \t");
+
+		res = (!strcmp(p, username));
+	} else if (!strncasecmp(p, "group", 5)) {
+		/* Match against group list */
+		p += 5;
+		p += strspn(p, " \t");
+		if (!strncmp(p, "=", 1)) {
+			p += 1;
+			neg = 0;
+		} else if (!strncmp(p, "!=", 2)) {
+			p += 2;
+			neg = 1;
+		} else
+			return (-1);
+		p += strspn(p, " \t");
+
+		for (i = 0; i < ngroups; i++) {
+			if (!strcmp(p, groupnames[i])) {
+				res = 1;
+				break;
+			}
+		}
+	} else
+		return (-1);
+
+	if (neg)
+		res = !res;
+
+	return (res);
+}
+
+int
 systrace_readpolicy(char *filename)
 {
 	FILE *fp;
@@ -338,6 +410,25 @@ systrace_readpolicy(char *filename)
 			policy->flags |= POLICY_DETACHED;
 			policy = NULL;
 			continue;
+		} else if (!strncasecmp(p, "if", 2)) {
+			int match;
+			char *predicate;
+
+			/* Process predicates */
+			p += 2;
+			p += strspn(p, " \t");
+			predicate = strsep(&p, ",");
+			if (p == NULL)
+				goto error;
+
+			match = systrace_predicatematch(predicate);
+			if (match == -1)
+				goto error;
+			/* If the predicate does not match skip rule */
+			if (!match)
+				continue;
+
+			p += strspn(p, " \t");
 		}
 
 		emulation = strsep(&p, "-");
diff --git a/bin/systrace/systrace.1 b/bin/systrace/systrace.1
index 379e29dfaae..2148effc982 100644
--- a/bin/systrace/systrace.1
+++ b/bin/systrace/systrace.1
@@ -1,4 +1,4 @@
-.\"	$OpenBSD: systrace.1,v 1.10 2002/06/05 18:58:07 provos Exp $
+.\"	$OpenBSD: systrace.1,v 1.11 2002/06/05 20:52:47 provos Exp $
 .\"
 .\" Copyright 2002 Niels Provos <provos@citi.umich.edu>
 .\" All rights reserved.
@@ -79,7 +79,7 @@ knows about.
 .Pp
 .Sh POLICY
 The policy is specified via the following grammar:
-.Bd -literal
+.Bd -literal -offset AAA
 filter = expression "then" action errorcode
 expression = symbol | "not" expression | "(" expression ")" |
 	expression "and" expression | expression "or" expression
@@ -95,7 +95,32 @@ errorcode = /* empty */ | "[" string "]"
 The
 .Va cmd-string
 is an arbitrary string enclosed with quotation marks.
-
+.Pp
+Policy entries can be prefixed with a predicate.
+Predicates have the following format:
+.Bd -literal -offset AAA
+"if" {"user", "group"} {"=", "!="} string ","
+.Ed
+.Pp
+A rule is added to the configured policy only if its predicate
+evaluates to true.
+.Sh EXAMPLES
+An excerpt from a sample 
+.Xr ls 1
+policy might look as follows:
+.Bd -literal -offset AAA
+Policy: /bin/ls, Emulation: native
+[...]
+	native-open: filename eq "$HOME" and oflags sub "ro" then permit
+	native-fchdir: permit
+[...]
+	native-open: filename eq "/tmp" and oflags sub "ro" then permit
+	native-stat: permit
+	native-open: filename match "$HOME/*" and oflags sub "ro" then permit
+	native-open: filename eq "/etc/pwd.db" and oflags sub "ro" then permit
+[...]
+	if group != wheel, native-open: filename eq "/etc" then deny[eperm]
+.Ed
 .Sh FILES
 .Bl -tag -width xHOME/xsystrace -compact
 .It Pa /dev/systrace
diff --git a/bin/systrace/systrace.c b/bin/systrace/systrace.c
index a266ada97e8..1528d336005 100644
--- a/bin/systrace/systrace.c
+++ b/bin/systrace/systrace.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: systrace.c,v 1.12 2002/06/05 20:01:22 provos Exp $	*/
+/*	$OpenBSD: systrace.c,v 1.13 2002/06/05 20:52:47 provos Exp $	*/
 /*
  * Copyright 2002 Niels Provos <provos@citi.umich.edu>
  * All rights reserved.
@@ -398,7 +398,6 @@ main(int argc, char **argv)
 		switch (c) {
 		case 'a':
 			automatic = 1;
-			username = uid_to_name(getuid());
 			break;
 		case 'A':
 			allow = 1;
@@ -429,6 +428,9 @@ main(int argc, char **argv)
 	if (argc == 0)
 		usage();
 
+	/* Username for automatic mode, and policy predicates */
+	username = uid_to_name(getuid());
+
 	/* Determine current working directory for filtering */
 	if (getcwd(cwd, sizeof(cwd)) == NULL)
 		err(1, "getcwd");