mac_mls.c (172930) | mac_mls.c (172955) |
---|---|
1/*- 2 * Copyright (c) 1999-2002 Robert N. M. Watson 3 * Copyright (c) 2001-2005 McAfee, Inc. 4 * Copyright (c) 2006 SPARTA, Inc. 5 * All rights reserved. 6 * 7 * This software was developed by Robert Watson for the TrustedBSD Project. 8 * --- 21 unchanged lines hidden (view full) --- 30 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 31 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 32 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 33 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 34 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 35 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 36 * SUCH DAMAGE. 37 * | 1/*- 2 * Copyright (c) 1999-2002 Robert N. M. Watson 3 * Copyright (c) 2001-2005 McAfee, Inc. 4 * Copyright (c) 2006 SPARTA, Inc. 5 * All rights reserved. 6 * 7 * This software was developed by Robert Watson for the TrustedBSD Project. 8 * --- 21 unchanged lines hidden (view full) --- 30 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 31 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 32 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 33 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 34 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 35 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 36 * SUCH DAMAGE. 37 * |
38 * $FreeBSD: head/sys/security/mac_mls/mac_mls.c 172930 2007-10-24 19:04:04Z rwatson $ | 38 * $FreeBSD: head/sys/security/mac_mls/mac_mls.c 172955 2007-10-25 11:31:11Z rwatson $ |
39 */ 40 41/* 42 * Developed by the TrustedBSD Project. 43 * 44 * MLS fixed label mandatory confidentiality policy. 45 */ 46 --- 41 unchanged lines hidden (view full) --- 88#include <security/mac/mac_policy.h> 89#include <security/mac_mls/mac_mls.h> 90 91SYSCTL_DECL(_security_mac); 92 93SYSCTL_NODE(_security_mac, OID_AUTO, mls, CTLFLAG_RW, 0, 94 "TrustedBSD mac_mls policy controls"); 95 | 39 */ 40 41/* 42 * Developed by the TrustedBSD Project. 43 * 44 * MLS fixed label mandatory confidentiality policy. 45 */ 46 --- 41 unchanged lines hidden (view full) --- 88#include <security/mac/mac_policy.h> 89#include <security/mac_mls/mac_mls.h> 90 91SYSCTL_DECL(_security_mac); 92 93SYSCTL_NODE(_security_mac, OID_AUTO, mls, CTLFLAG_RW, 0, 94 "TrustedBSD mac_mls policy controls"); 95 |
96static int mac_mls_label_size = sizeof(struct mac_mls); | 96static int mls_label_size = sizeof(struct mac_mls); |
97SYSCTL_INT(_security_mac_mls, OID_AUTO, label_size, CTLFLAG_RD, | 97SYSCTL_INT(_security_mac_mls, OID_AUTO, label_size, CTLFLAG_RD, |
98 &mac_mls_label_size, 0, "Size of struct mac_mls"); | 98 &mls_label_size, 0, "Size of struct mac_mls"); |
99 | 99 |
100static int mac_mls_enabled = 1; 101SYSCTL_INT(_security_mac_mls, OID_AUTO, enabled, CTLFLAG_RW, 102 &mac_mls_enabled, 0, "Enforce MAC/MLS policy"); 103TUNABLE_INT("security.mac.mls.enabled", &mac_mls_enabled); | 100static int mls_enabled = 1; 101SYSCTL_INT(_security_mac_mls, OID_AUTO, enabled, CTLFLAG_RW, &mls_enabled, 0, 102 "Enforce MAC/MLS policy"); 103TUNABLE_INT("security.mac.mls.enabled", &mls_enabled); |
104 105static int destroyed_not_inited; 106SYSCTL_INT(_security_mac_mls, OID_AUTO, destroyed_not_inited, CTLFLAG_RD, 107 &destroyed_not_inited, 0, "Count of labels destroyed but not inited"); 108 109static int ptys_equal = 0; 110SYSCTL_INT(_security_mac_mls, OID_AUTO, ptys_equal, CTLFLAG_RW, 111 &ptys_equal, 0, "Label pty devices as mls/equal on create"); 112TUNABLE_INT("security.mac.mls.ptys_equal", &ptys_equal); 113 114static int revocation_enabled = 0; 115SYSCTL_INT(_security_mac_mls, OID_AUTO, revocation_enabled, CTLFLAG_RW, 116 &revocation_enabled, 0, "Revoke access to objects on relabel"); 117TUNABLE_INT("security.mac.mls.revocation_enabled", &revocation_enabled); 118 119static int max_compartments = MAC_MLS_MAX_COMPARTMENTS; 120SYSCTL_INT(_security_mac_mls, OID_AUTO, max_compartments, CTLFLAG_RD, 121 &max_compartments, 0, "Maximum compartments the policy supports"); 122 | 104 105static int destroyed_not_inited; 106SYSCTL_INT(_security_mac_mls, OID_AUTO, destroyed_not_inited, CTLFLAG_RD, 107 &destroyed_not_inited, 0, "Count of labels destroyed but not inited"); 108 109static int ptys_equal = 0; 110SYSCTL_INT(_security_mac_mls, OID_AUTO, ptys_equal, CTLFLAG_RW, 111 &ptys_equal, 0, "Label pty devices as mls/equal on create"); 112TUNABLE_INT("security.mac.mls.ptys_equal", &ptys_equal); 113 114static int revocation_enabled = 0; 115SYSCTL_INT(_security_mac_mls, OID_AUTO, revocation_enabled, CTLFLAG_RW, 116 &revocation_enabled, 0, "Revoke access to objects on relabel"); 117TUNABLE_INT("security.mac.mls.revocation_enabled", &revocation_enabled); 118 119static int max_compartments = MAC_MLS_MAX_COMPARTMENTS; 120SYSCTL_INT(_security_mac_mls, OID_AUTO, max_compartments, CTLFLAG_RD, 121 &max_compartments, 0, "Maximum compartments the policy supports"); 122 |
123static int mac_mls_slot; 124#define SLOT(l) ((struct mac_mls *)mac_label_get((l), mac_mls_slot)) 125#define SLOT_SET(l, val) mac_label_set((l), mac_mls_slot, (uintptr_t)(val)) | 123static int mls_slot; 124#define SLOT(l) ((struct mac_mls *)mac_label_get((l), mls_slot)) 125#define SLOT_SET(l, val) mac_label_set((l), mls_slot, (uintptr_t)(val)) |
126 127static uma_zone_t zone_mls; 128 129static __inline int 130mls_bit_set_empty(u_char *set) { 131 int i; 132 133 for (i = 0; i < MAC_MLS_MAX_COMPARTMENTS >> 3; i++) --- 5 unchanged lines hidden (view full) --- 139static struct mac_mls * 140mls_alloc(int flag) 141{ 142 143 return (uma_zalloc(zone_mls, flag | M_ZERO)); 144} 145 146static void | 126 127static uma_zone_t zone_mls; 128 129static __inline int 130mls_bit_set_empty(u_char *set) { 131 int i; 132 133 for (i = 0; i < MAC_MLS_MAX_COMPARTMENTS >> 3; i++) --- 5 unchanged lines hidden (view full) --- 139static struct mac_mls * 140mls_alloc(int flag) 141{ 142 143 return (uma_zalloc(zone_mls, flag | M_ZERO)); 144} 145 146static void |
147mls_free(struct mac_mls *mac_mls) | 147mls_free(struct mac_mls *mm) |
148{ 149 | 148{ 149 |
150 if (mac_mls != NULL) 151 uma_zfree(zone_mls, mac_mls); | 150 if (mm != NULL) 151 uma_zfree(zone_mls, mm); |
152 else 153 atomic_add_int(&destroyed_not_inited, 1); 154} 155 156static int | 152 else 153 atomic_add_int(&destroyed_not_inited, 1); 154} 155 156static int |
157mls_atmostflags(struct mac_mls *mac_mls, int flags) | 157mls_atmostflags(struct mac_mls *mm, int flags) |
158{ 159 | 158{ 159 |
160 if ((mac_mls->mm_flags & flags) != mac_mls->mm_flags) | 160 if ((mm->mm_flags & flags) != mm->mm_flags) |
161 return (EINVAL); 162 return (0); 163} 164 165static int | 161 return (EINVAL); 162 return (0); 163} 164 165static int |
166mac_mls_dominate_element(struct mac_mls_element *a, 167 struct mac_mls_element *b) | 166mls_dominate_element(struct mac_mls_element *a, struct mac_mls_element *b) |
168{ 169 int bit; 170 171 switch (a->mme_type) { 172 case MAC_MLS_TYPE_EQUAL: 173 case MAC_MLS_TYPE_HIGH: 174 return (1); 175 176 case MAC_MLS_TYPE_LOW: 177 switch (b->mme_type) { 178 case MAC_MLS_TYPE_LEVEL: 179 case MAC_MLS_TYPE_HIGH: 180 return (0); 181 182 case MAC_MLS_TYPE_EQUAL: 183 case MAC_MLS_TYPE_LOW: 184 return (1); 185 186 default: | 167{ 168 int bit; 169 170 switch (a->mme_type) { 171 case MAC_MLS_TYPE_EQUAL: 172 case MAC_MLS_TYPE_HIGH: 173 return (1); 174 175 case MAC_MLS_TYPE_LOW: 176 switch (b->mme_type) { 177 case MAC_MLS_TYPE_LEVEL: 178 case MAC_MLS_TYPE_HIGH: 179 return (0); 180 181 case MAC_MLS_TYPE_EQUAL: 182 case MAC_MLS_TYPE_LOW: 183 return (1); 184 185 default: |
187 panic("mac_mls_dominate_element: b->mme_type invalid"); | 186 panic("mls_dominate_element: b->mme_type invalid"); |
188 } 189 190 case MAC_MLS_TYPE_LEVEL: 191 switch (b->mme_type) { 192 case MAC_MLS_TYPE_EQUAL: 193 case MAC_MLS_TYPE_LOW: 194 return (1); 195 --- 4 unchanged lines hidden (view full) --- 200 for (bit = 1; bit <= MAC_MLS_MAX_COMPARTMENTS; bit++) 201 if (!MAC_MLS_BIT_TEST(bit, 202 a->mme_compartments) && 203 MAC_MLS_BIT_TEST(bit, b->mme_compartments)) 204 return (0); 205 return (a->mme_level >= b->mme_level); 206 207 default: | 187 } 188 189 case MAC_MLS_TYPE_LEVEL: 190 switch (b->mme_type) { 191 case MAC_MLS_TYPE_EQUAL: 192 case MAC_MLS_TYPE_LOW: 193 return (1); 194 --- 4 unchanged lines hidden (view full) --- 199 for (bit = 1; bit <= MAC_MLS_MAX_COMPARTMENTS; bit++) 200 if (!MAC_MLS_BIT_TEST(bit, 201 a->mme_compartments) && 202 MAC_MLS_BIT_TEST(bit, b->mme_compartments)) 203 return (0); 204 return (a->mme_level >= b->mme_level); 205 206 default: |
208 panic("mac_mls_dominate_element: b->mme_type invalid"); | 207 panic("mls_dominate_element: b->mme_type invalid"); |
209 } 210 211 default: | 208 } 209 210 default: |
212 panic("mac_mls_dominate_element: a->mme_type invalid"); | 211 panic("mls_dominate_element: a->mme_type invalid"); |
213 } 214 215 return (0); 216} 217 218static int | 212 } 213 214 return (0); 215} 216 217static int |
219mac_mls_range_in_range(struct mac_mls *rangea, struct mac_mls *rangeb) | 218mls_range_in_range(struct mac_mls *rangea, struct mac_mls *rangeb) |
220{ 221 | 219{ 220 |
222 return (mac_mls_dominate_element(&rangeb->mm_rangehigh, | 221 return (mls_dominate_element(&rangeb->mm_rangehigh, |
223 &rangea->mm_rangehigh) && | 222 &rangea->mm_rangehigh) && |
224 mac_mls_dominate_element(&rangea->mm_rangelow, | 223 mls_dominate_element(&rangea->mm_rangelow, |
225 &rangeb->mm_rangelow)); 226} 227 228static int | 224 &rangeb->mm_rangelow)); 225} 226 227static int |
229mac_mls_effective_in_range(struct mac_mls *effective, struct mac_mls *range) | 228mls_effective_in_range(struct mac_mls *effective, struct mac_mls *range) |
230{ 231 232 KASSERT((effective->mm_flags & MAC_MLS_FLAG_EFFECTIVE) != 0, | 229{ 230 231 KASSERT((effective->mm_flags & MAC_MLS_FLAG_EFFECTIVE) != 0, |
233 ("mac_mls_effective_in_range: a not effective")); | 232 ("mls_effective_in_range: a not effective")); |
234 KASSERT((range->mm_flags & MAC_MLS_FLAG_RANGE) != 0, | 233 KASSERT((range->mm_flags & MAC_MLS_FLAG_RANGE) != 0, |
235 ("mac_mls_effective_in_range: b not range")); | 234 ("mls_effective_in_range: b not range")); |
236 | 235 |
237 return (mac_mls_dominate_element(&range->mm_rangehigh, | 236 return (mls_dominate_element(&range->mm_rangehigh, |
238 &effective->mm_effective) && | 237 &effective->mm_effective) && |
239 mac_mls_dominate_element(&effective->mm_effective, | 238 mls_dominate_element(&effective->mm_effective, |
240 &range->mm_rangelow)); 241 242 return (1); 243} 244 245static int | 239 &range->mm_rangelow)); 240 241 return (1); 242} 243 244static int |
246mac_mls_dominate_effective(struct mac_mls *a, struct mac_mls *b) | 245mls_dominate_effective(struct mac_mls *a, struct mac_mls *b) |
247{ 248 KASSERT((a->mm_flags & MAC_MLS_FLAG_EFFECTIVE) != 0, | 246{ 247 KASSERT((a->mm_flags & MAC_MLS_FLAG_EFFECTIVE) != 0, |
249 ("mac_mls_dominate_effective: a not effective")); | 248 ("mls_dominate_effective: a not effective")); |
250 KASSERT((b->mm_flags & MAC_MLS_FLAG_EFFECTIVE) != 0, | 249 KASSERT((b->mm_flags & MAC_MLS_FLAG_EFFECTIVE) != 0, |
251 ("mac_mls_dominate_effective: b not effective")); | 250 ("mls_dominate_effective: b not effective")); |
252 | 251 |
253 return (mac_mls_dominate_element(&a->mm_effective, &b->mm_effective)); | 252 return (mls_dominate_element(&a->mm_effective, &b->mm_effective)); |
254} 255 256static int | 253} 254 255static int |
257mac_mls_equal_element(struct mac_mls_element *a, struct mac_mls_element *b) | 256mls_equal_element(struct mac_mls_element *a, struct mac_mls_element *b) |
258{ 259 260 if (a->mme_type == MAC_MLS_TYPE_EQUAL || 261 b->mme_type == MAC_MLS_TYPE_EQUAL) 262 return (1); 263 264 return (a->mme_type == b->mme_type && a->mme_level == b->mme_level); 265} 266 267static int | 257{ 258 259 if (a->mme_type == MAC_MLS_TYPE_EQUAL || 260 b->mme_type == MAC_MLS_TYPE_EQUAL) 261 return (1); 262 263 return (a->mme_type == b->mme_type && a->mme_level == b->mme_level); 264} 265 266static int |
268mac_mls_equal_effective(struct mac_mls *a, struct mac_mls *b) | 267mls_equal_effective(struct mac_mls *a, struct mac_mls *b) |
269{ 270 271 KASSERT((a->mm_flags & MAC_MLS_FLAG_EFFECTIVE) != 0, | 268{ 269 270 KASSERT((a->mm_flags & MAC_MLS_FLAG_EFFECTIVE) != 0, |
272 ("mac_mls_equal_effective: a not effective")); | 271 ("mls_equal_effective: a not effective")); |
273 KASSERT((b->mm_flags & MAC_MLS_FLAG_EFFECTIVE) != 0, | 272 KASSERT((b->mm_flags & MAC_MLS_FLAG_EFFECTIVE) != 0, |
274 ("mac_mls_equal_effective: b not effective")); | 273 ("mls_equal_effective: b not effective")); |
275 | 274 |
276 return (mac_mls_equal_element(&a->mm_effective, &b->mm_effective)); | 275 return (mls_equal_element(&a->mm_effective, &b->mm_effective)); |
277} 278 279static int | 276} 277 278static int |
280mac_mls_contains_equal(struct mac_mls *mac_mls) | 279mls_contains_equal(struct mac_mls *mm) |
281{ 282 | 280{ 281 |
283 if (mac_mls->mm_flags & MAC_MLS_FLAG_EFFECTIVE) 284 if (mac_mls->mm_effective.mme_type == MAC_MLS_TYPE_EQUAL) | 282 if (mm->mm_flags & MAC_MLS_FLAG_EFFECTIVE) 283 if (mm->mm_effective.mme_type == MAC_MLS_TYPE_EQUAL) |
285 return (1); 286 | 284 return (1); 285 |
287 if (mac_mls->mm_flags & MAC_MLS_FLAG_RANGE) { 288 if (mac_mls->mm_rangelow.mme_type == MAC_MLS_TYPE_EQUAL) | 286 if (mm->mm_flags & MAC_MLS_FLAG_RANGE) { 287 if (mm->mm_rangelow.mme_type == MAC_MLS_TYPE_EQUAL) |
289 return (1); | 288 return (1); |
290 if (mac_mls->mm_rangehigh.mme_type == MAC_MLS_TYPE_EQUAL) | 289 if (mm->mm_rangehigh.mme_type == MAC_MLS_TYPE_EQUAL) |
291 return (1); 292 } 293 294 return (0); 295} 296 297static int | 290 return (1); 291 } 292 293 return (0); 294} 295 296static int |
298mac_mls_subject_privileged(struct mac_mls *mac_mls) | 297mls_subject_privileged(struct mac_mls *mm) |
299{ 300 | 298{ 299 |
301 KASSERT((mac_mls->mm_flags & MAC_MLS_FLAGS_BOTH) == 302 MAC_MLS_FLAGS_BOTH, 303 ("mac_mls_subject_privileged: subject doesn't have both labels")); | 300 KASSERT((mm->mm_flags & MAC_MLS_FLAGS_BOTH) == MAC_MLS_FLAGS_BOTH, 301 ("mls_subject_privileged: subject doesn't have both labels")); |
304 305 /* If the effective is EQUAL, it's ok. */ | 302 303 /* If the effective is EQUAL, it's ok. */ |
306 if (mac_mls->mm_effective.mme_type == MAC_MLS_TYPE_EQUAL) | 304 if (mm->mm_effective.mme_type == MAC_MLS_TYPE_EQUAL) |
307 return (0); 308 309 /* If either range endpoint is EQUAL, it's ok. */ | 305 return (0); 306 307 /* If either range endpoint is EQUAL, it's ok. */ |
310 if (mac_mls->mm_rangelow.mme_type == MAC_MLS_TYPE_EQUAL || 311 mac_mls->mm_rangehigh.mme_type == MAC_MLS_TYPE_EQUAL) | 308 if (mm->mm_rangelow.mme_type == MAC_MLS_TYPE_EQUAL || 309 mm->mm_rangehigh.mme_type == MAC_MLS_TYPE_EQUAL) |
312 return (0); 313 314 /* If the range is low-high, it's ok. */ | 310 return (0); 311 312 /* If the range is low-high, it's ok. */ |
315 if (mac_mls->mm_rangelow.mme_type == MAC_MLS_TYPE_LOW && 316 mac_mls->mm_rangehigh.mme_type == MAC_MLS_TYPE_HIGH) | 313 if (mm->mm_rangelow.mme_type == MAC_MLS_TYPE_LOW && 314 mm->mm_rangehigh.mme_type == MAC_MLS_TYPE_HIGH) |
317 return (0); 318 319 /* It's not ok. */ 320 return (EPERM); 321} 322 323static int | 315 return (0); 316 317 /* It's not ok. */ 318 return (EPERM); 319} 320 321static int |
324mac_mls_valid(struct mac_mls *mac_mls) | 322mls_valid(struct mac_mls *mm) |
325{ 326 | 323{ 324 |
327 if (mac_mls->mm_flags & MAC_MLS_FLAG_EFFECTIVE) { 328 switch (mac_mls->mm_effective.mme_type) { | 325 if (mm->mm_flags & MAC_MLS_FLAG_EFFECTIVE) { 326 switch (mm->mm_effective.mme_type) { |
329 case MAC_MLS_TYPE_LEVEL: 330 break; 331 332 case MAC_MLS_TYPE_EQUAL: 333 case MAC_MLS_TYPE_HIGH: 334 case MAC_MLS_TYPE_LOW: | 327 case MAC_MLS_TYPE_LEVEL: 328 break; 329 330 case MAC_MLS_TYPE_EQUAL: 331 case MAC_MLS_TYPE_HIGH: 332 case MAC_MLS_TYPE_LOW: |
335 if (mac_mls->mm_effective.mme_level != 0 || | 333 if (mm->mm_effective.mme_level != 0 || |
336 !MAC_MLS_BIT_SET_EMPTY( | 334 !MAC_MLS_BIT_SET_EMPTY( |
337 mac_mls->mm_effective.mme_compartments)) | 335 mm->mm_effective.mme_compartments)) |
338 return (EINVAL); 339 break; 340 341 default: 342 return (EINVAL); 343 } 344 } else { | 336 return (EINVAL); 337 break; 338 339 default: 340 return (EINVAL); 341 } 342 } else { |
345 if (mac_mls->mm_effective.mme_type != MAC_MLS_TYPE_UNDEF) | 343 if (mm->mm_effective.mme_type != MAC_MLS_TYPE_UNDEF) |
346 return (EINVAL); 347 } 348 | 344 return (EINVAL); 345 } 346 |
349 if (mac_mls->mm_flags & MAC_MLS_FLAG_RANGE) { 350 switch (mac_mls->mm_rangelow.mme_type) { | 347 if (mm->mm_flags & MAC_MLS_FLAG_RANGE) { 348 switch (mm->mm_rangelow.mme_type) { |
351 case MAC_MLS_TYPE_LEVEL: 352 break; 353 354 case MAC_MLS_TYPE_EQUAL: 355 case MAC_MLS_TYPE_HIGH: 356 case MAC_MLS_TYPE_LOW: | 349 case MAC_MLS_TYPE_LEVEL: 350 break; 351 352 case MAC_MLS_TYPE_EQUAL: 353 case MAC_MLS_TYPE_HIGH: 354 case MAC_MLS_TYPE_LOW: |
357 if (mac_mls->mm_rangelow.mme_level != 0 || | 355 if (mm->mm_rangelow.mme_level != 0 || |
358 !MAC_MLS_BIT_SET_EMPTY( | 356 !MAC_MLS_BIT_SET_EMPTY( |
359 mac_mls->mm_rangelow.mme_compartments)) | 357 mm->mm_rangelow.mme_compartments)) |
360 return (EINVAL); 361 break; 362 363 default: 364 return (EINVAL); 365 } 366 | 358 return (EINVAL); 359 break; 360 361 default: 362 return (EINVAL); 363 } 364 |
367 switch (mac_mls->mm_rangehigh.mme_type) { | 365 switch (mm->mm_rangehigh.mme_type) { |
368 case MAC_MLS_TYPE_LEVEL: 369 break; 370 371 case MAC_MLS_TYPE_EQUAL: 372 case MAC_MLS_TYPE_HIGH: 373 case MAC_MLS_TYPE_LOW: | 366 case MAC_MLS_TYPE_LEVEL: 367 break; 368 369 case MAC_MLS_TYPE_EQUAL: 370 case MAC_MLS_TYPE_HIGH: 371 case MAC_MLS_TYPE_LOW: |
374 if (mac_mls->mm_rangehigh.mme_level != 0 || | 372 if (mm->mm_rangehigh.mme_level != 0 || |
375 !MAC_MLS_BIT_SET_EMPTY( | 373 !MAC_MLS_BIT_SET_EMPTY( |
376 mac_mls->mm_rangehigh.mme_compartments)) | 374 mm->mm_rangehigh.mme_compartments)) |
377 return (EINVAL); 378 break; 379 380 default: 381 return (EINVAL); 382 } | 375 return (EINVAL); 376 break; 377 378 default: 379 return (EINVAL); 380 } |
383 if (!mac_mls_dominate_element(&mac_mls->mm_rangehigh, 384 &mac_mls->mm_rangelow)) | 381 if (!mls_dominate_element(&mm->mm_rangehigh, 382 &mm->mm_rangelow)) |
385 return (EINVAL); 386 } else { | 383 return (EINVAL); 384 } else { |
387 if (mac_mls->mm_rangelow.mme_type != MAC_MLS_TYPE_UNDEF || 388 mac_mls->mm_rangehigh.mme_type != MAC_MLS_TYPE_UNDEF) | 385 if (mm->mm_rangelow.mme_type != MAC_MLS_TYPE_UNDEF || 386 mm->mm_rangehigh.mme_type != MAC_MLS_TYPE_UNDEF) |
389 return (EINVAL); 390 } 391 392 return (0); 393} 394 395static void | 387 return (EINVAL); 388 } 389 390 return (0); 391} 392 393static void |
396mac_mls_set_range(struct mac_mls *mac_mls, u_short typelow, 397 u_short levellow, u_char *compartmentslow, u_short typehigh, 398 u_short levelhigh, u_char *compartmentshigh) | 394mls_set_range(struct mac_mls *mm, u_short typelow, u_short levellow, 395 u_char *compartmentslow, u_short typehigh, u_short levelhigh, 396 u_char *compartmentshigh) |
399{ 400 | 397{ 398 |
401 mac_mls->mm_rangelow.mme_type = typelow; 402 mac_mls->mm_rangelow.mme_level = levellow; | 399 mm->mm_rangelow.mme_type = typelow; 400 mm->mm_rangelow.mme_level = levellow; |
403 if (compartmentslow != NULL) | 401 if (compartmentslow != NULL) |
404 memcpy(mac_mls->mm_rangelow.mme_compartments, | 402 memcpy(mm->mm_rangelow.mme_compartments, |
405 compartmentslow, | 403 compartmentslow, |
406 sizeof(mac_mls->mm_rangelow.mme_compartments)); 407 mac_mls->mm_rangehigh.mme_type = typehigh; 408 mac_mls->mm_rangehigh.mme_level = levelhigh; | 404 sizeof(mm->mm_rangelow.mme_compartments)); 405 mm->mm_rangehigh.mme_type = typehigh; 406 mm->mm_rangehigh.mme_level = levelhigh; |
409 if (compartmentshigh != NULL) | 407 if (compartmentshigh != NULL) |
410 memcpy(mac_mls->mm_rangehigh.mme_compartments, | 408 memcpy(mm->mm_rangehigh.mme_compartments, |
411 compartmentshigh, | 409 compartmentshigh, |
412 sizeof(mac_mls->mm_rangehigh.mme_compartments)); 413 mac_mls->mm_flags |= MAC_MLS_FLAG_RANGE; | 410 sizeof(mm->mm_rangehigh.mme_compartments)); 411 mm->mm_flags |= MAC_MLS_FLAG_RANGE; |
414} 415 416static void | 412} 413 414static void |
417mac_mls_set_effective(struct mac_mls *mac_mls, u_short type, u_short level, | 415mls_set_effective(struct mac_mls *mm, u_short type, u_short level, |
418 u_char *compartments) 419{ 420 | 416 u_char *compartments) 417{ 418 |
421 mac_mls->mm_effective.mme_type = type; 422 mac_mls->mm_effective.mme_level = level; | 419 mm->mm_effective.mme_type = type; 420 mm->mm_effective.mme_level = level; |
423 if (compartments != NULL) | 421 if (compartments != NULL) |
424 memcpy(mac_mls->mm_effective.mme_compartments, compartments, 425 sizeof(mac_mls->mm_effective.mme_compartments)); 426 mac_mls->mm_flags |= MAC_MLS_FLAG_EFFECTIVE; | 422 memcpy(mm->mm_effective.mme_compartments, compartments, 423 sizeof(mm->mm_effective.mme_compartments)); 424 mm->mm_flags |= MAC_MLS_FLAG_EFFECTIVE; |
427} 428 429static void | 425} 426 427static void |
430mac_mls_copy_range(struct mac_mls *labelfrom, struct mac_mls *labelto) | 428mls_copy_range(struct mac_mls *labelfrom, struct mac_mls *labelto) |
431{ 432 433 KASSERT((labelfrom->mm_flags & MAC_MLS_FLAG_RANGE) != 0, | 429{ 430 431 KASSERT((labelfrom->mm_flags & MAC_MLS_FLAG_RANGE) != 0, |
434 ("mac_mls_copy_range: labelfrom not range")); | 432 ("mls_copy_range: labelfrom not range")); |
435 436 labelto->mm_rangelow = labelfrom->mm_rangelow; 437 labelto->mm_rangehigh = labelfrom->mm_rangehigh; 438 labelto->mm_flags |= MAC_MLS_FLAG_RANGE; 439} 440 441static void | 433 434 labelto->mm_rangelow = labelfrom->mm_rangelow; 435 labelto->mm_rangehigh = labelfrom->mm_rangehigh; 436 labelto->mm_flags |= MAC_MLS_FLAG_RANGE; 437} 438 439static void |
442mac_mls_copy_effective(struct mac_mls *labelfrom, struct mac_mls *labelto) | 440mls_copy_effective(struct mac_mls *labelfrom, struct mac_mls *labelto) |
443{ 444 445 KASSERT((labelfrom->mm_flags & MAC_MLS_FLAG_EFFECTIVE) != 0, | 441{ 442 443 KASSERT((labelfrom->mm_flags & MAC_MLS_FLAG_EFFECTIVE) != 0, |
446 ("mac_mls_copy_effective: labelfrom not effective")); | 444 ("mls_copy_effective: labelfrom not effective")); |
447 448 labelto->mm_effective = labelfrom->mm_effective; 449 labelto->mm_flags |= MAC_MLS_FLAG_EFFECTIVE; 450} 451 452static void | 445 446 labelto->mm_effective = labelfrom->mm_effective; 447 labelto->mm_flags |= MAC_MLS_FLAG_EFFECTIVE; 448} 449 450static void |
453mac_mls_copy(struct mac_mls *source, struct mac_mls *dest) | 451mls_copy(struct mac_mls *source, struct mac_mls *dest) |
454{ 455 456 if (source->mm_flags & MAC_MLS_FLAG_EFFECTIVE) | 452{ 453 454 if (source->mm_flags & MAC_MLS_FLAG_EFFECTIVE) |
457 mac_mls_copy_effective(source, dest); | 455 mls_copy_effective(source, dest); |
458 if (source->mm_flags & MAC_MLS_FLAG_RANGE) | 456 if (source->mm_flags & MAC_MLS_FLAG_RANGE) |
459 mac_mls_copy_range(source, dest); | 457 mls_copy_range(source, dest); |
460} 461 462/* 463 * Policy module operations. 464 */ 465static void | 458} 459 460/* 461 * Policy module operations. 462 */ 463static void |
466mac_mls_init(struct mac_policy_conf *conf) | 464mls_init(struct mac_policy_conf *conf) |
467{ 468 469 zone_mls = uma_zcreate("mac_mls", sizeof(struct mac_mls), NULL, 470 NULL, NULL, NULL, UMA_ALIGN_PTR, 0); 471} 472 473/* 474 * Label operations. 475 */ 476static void | 465{ 466 467 zone_mls = uma_zcreate("mac_mls", sizeof(struct mac_mls), NULL, 468 NULL, NULL, NULL, UMA_ALIGN_PTR, 0); 469} 470 471/* 472 * Label operations. 473 */ 474static void |
477mac_mls_init_label(struct label *label) | 475mls_init_label(struct label *label) |
478{ 479 480 SLOT_SET(label, mls_alloc(M_WAITOK)); 481} 482 483static int | 476{ 477 478 SLOT_SET(label, mls_alloc(M_WAITOK)); 479} 480 481static int |
484mac_mls_init_label_waitcheck(struct label *label, int flag) | 482mls_init_label_waitcheck(struct label *label, int flag) |
485{ 486 487 SLOT_SET(label, mls_alloc(flag)); 488 if (SLOT(label) == NULL) 489 return (ENOMEM); 490 491 return (0); 492} 493 494static void | 483{ 484 485 SLOT_SET(label, mls_alloc(flag)); 486 if (SLOT(label) == NULL) 487 return (ENOMEM); 488 489 return (0); 490} 491 492static void |
495mac_mls_destroy_label(struct label *label) | 493mls_destroy_label(struct label *label) |
496{ 497 498 mls_free(SLOT(label)); 499 SLOT_SET(label, NULL); 500} 501 502/* | 494{ 495 496 mls_free(SLOT(label)); 497 SLOT_SET(label, NULL); 498} 499 500/* |
503 * mac_mls_element_to_string() accepts an sbuf and MLS element. It 504 * converts the MLS element to a string and stores the result in the 505 * sbuf; if there isn't space in the sbuf, -1 is returned. | 501 * mls_element_to_string() accepts an sbuf and MLS element. It converts the 502 * MLS element to a string and stores the result in the sbuf; if there isn't 503 * space in the sbuf, -1 is returned. |
506 */ 507static int | 504 */ 505static int |
508mac_mls_element_to_string(struct sbuf *sb, struct mac_mls_element *element) | 506mls_element_to_string(struct sbuf *sb, struct mac_mls_element *element) |
509{ 510 int i, first; 511 512 switch (element->mme_type) { 513 case MAC_MLS_TYPE_HIGH: 514 return (sbuf_printf(sb, "high")); 515 516 case MAC_MLS_TYPE_LOW: --- 19 unchanged lines hidden (view full) --- 536 if (sbuf_printf(sb, "+%d", i) == -1) 537 return (-1); 538 } 539 } 540 } 541 return (0); 542 543 default: | 507{ 508 int i, first; 509 510 switch (element->mme_type) { 511 case MAC_MLS_TYPE_HIGH: 512 return (sbuf_printf(sb, "high")); 513 514 case MAC_MLS_TYPE_LOW: --- 19 unchanged lines hidden (view full) --- 534 if (sbuf_printf(sb, "+%d", i) == -1) 535 return (-1); 536 } 537 } 538 } 539 return (0); 540 541 default: |
544 panic("mac_mls_element_to_string: invalid type (%d)", | 542 panic("mls_element_to_string: invalid type (%d)", |
545 element->mme_type); 546 } 547} 548 549/* | 543 element->mme_type); 544 } 545} 546 547/* |
550 * mac_mls_to_string() converts an MLS label to a string, and places 551 * the results in the passed sbuf. It returns 0 on success, or EINVAL 552 * if there isn't room in the sbuf. Note: the sbuf will be modified 553 * even in a failure case, so the caller may need to revert the sbuf 554 * by restoring the offset if that's undesired. | 548 * mls_to_string() converts an MLS label to a string, and places the results 549 * in the passed sbuf. It returns 0 on success, or EINVAL if there isn't 550 * room in the sbuf. Note: the sbuf will be modified even in a failure case, 551 * so the caller may need to revert the sbuf by restoring the offset if 552 * that's undesired. |
555 */ 556static int | 553 */ 554static int |
557mac_mls_to_string(struct sbuf *sb, struct mac_mls *mac_mls) | 555mls_to_string(struct sbuf *sb, struct mac_mls *mm) |
558{ 559 | 556{ 557 |
560 if (mac_mls->mm_flags & MAC_MLS_FLAG_EFFECTIVE) { 561 if (mac_mls_element_to_string(sb, &mac_mls->mm_effective) 562 == -1) | 558 if (mm->mm_flags & MAC_MLS_FLAG_EFFECTIVE) { 559 if (mls_element_to_string(sb, &mm->mm_effective) == -1) |
563 return (EINVAL); 564 } 565 | 560 return (EINVAL); 561 } 562 |
566 if (mac_mls->mm_flags & MAC_MLS_FLAG_RANGE) { | 563 if (mm->mm_flags & MAC_MLS_FLAG_RANGE) { |
567 if (sbuf_putc(sb, '(') == -1) 568 return (EINVAL); 569 | 564 if (sbuf_putc(sb, '(') == -1) 565 return (EINVAL); 566 |
570 if (mac_mls_element_to_string(sb, &mac_mls->mm_rangelow) 571 == -1) | 567 if (mls_element_to_string(sb, &mm->mm_rangelow) == -1) |
572 return (EINVAL); 573 574 if (sbuf_putc(sb, '-') == -1) 575 return (EINVAL); 576 | 568 return (EINVAL); 569 570 if (sbuf_putc(sb, '-') == -1) 571 return (EINVAL); 572 |
577 if (mac_mls_element_to_string(sb, &mac_mls->mm_rangehigh) 578 == -1) | 573 if (mls_element_to_string(sb, &mm->mm_rangehigh) == -1) |
579 return (EINVAL); 580 581 if (sbuf_putc(sb, ')') == -1) 582 return (EINVAL); 583 } 584 585 return (0); 586} 587 588static int | 574 return (EINVAL); 575 576 if (sbuf_putc(sb, ')') == -1) 577 return (EINVAL); 578 } 579 580 return (0); 581} 582 583static int |
589mac_mls_externalize_label(struct label *label, char *element_name, | 584mls_externalize_label(struct label *label, char *element_name, |
590 struct sbuf *sb, int *claimed) 591{ | 585 struct sbuf *sb, int *claimed) 586{ |
592 struct mac_mls *mac_mls; | 587 struct mac_mls *mm; |
593 594 if (strcmp(MAC_MLS_LABEL_NAME, element_name) != 0) 595 return (0); 596 597 (*claimed)++; 598 | 588 589 if (strcmp(MAC_MLS_LABEL_NAME, element_name) != 0) 590 return (0); 591 592 (*claimed)++; 593 |
599 mac_mls = SLOT(label); | 594 mm = SLOT(label); |
600 | 595 |
601 return (mac_mls_to_string(sb, mac_mls)); | 596 return (mls_to_string(sb, mm)); |
602} 603 604static int | 597} 598 599static int |
605mac_mls_parse_element(struct mac_mls_element *element, char *string) | 600mls_parse_element(struct mac_mls_element *element, char *string) |
606{ 607 char *compartment, *end, *level; 608 int value; 609 | 601{ 602 char *compartment, *end, *level; 603 int value; 604 |
610 if (strcmp(string, "high") == 0 || 611 strcmp(string, "hi") == 0) { | 605 if (strcmp(string, "high") == 0 || strcmp(string, "hi") == 0) { |
612 element->mme_type = MAC_MLS_TYPE_HIGH; 613 element->mme_level = MAC_MLS_TYPE_UNDEF; | 606 element->mme_type = MAC_MLS_TYPE_HIGH; 607 element->mme_level = MAC_MLS_TYPE_UNDEF; |
614 } else if (strcmp(string, "low") == 0 || 615 strcmp(string, "lo") == 0) { | 608 } else if (strcmp(string, "low") == 0 || strcmp(string, "lo") == 0) { |
616 element->mme_type = MAC_MLS_TYPE_LOW; 617 element->mme_level = MAC_MLS_TYPE_UNDEF; 618 } else if (strcmp(string, "equal") == 0 || 619 strcmp(string, "eq") == 0) { 620 element->mme_type = MAC_MLS_TYPE_EQUAL; 621 element->mme_level = MAC_MLS_TYPE_UNDEF; 622 } else { 623 element->mme_type = MAC_MLS_TYPE_LEVEL; --- 5 unchanged lines hidden (view full) --- 629 value = strtol(level, &end, 10); 630 if (end == level || *end != '\0') 631 return (EINVAL); 632 if (value < 0 || value > 65535) 633 return (EINVAL); 634 element->mme_level = value; 635 636 /* | 609 element->mme_type = MAC_MLS_TYPE_LOW; 610 element->mme_level = MAC_MLS_TYPE_UNDEF; 611 } else if (strcmp(string, "equal") == 0 || 612 strcmp(string, "eq") == 0) { 613 element->mme_type = MAC_MLS_TYPE_EQUAL; 614 element->mme_level = MAC_MLS_TYPE_UNDEF; 615 } else { 616 element->mme_type = MAC_MLS_TYPE_LEVEL; --- 5 unchanged lines hidden (view full) --- 622 value = strtol(level, &end, 10); 623 if (end == level || *end != '\0') 624 return (EINVAL); 625 if (value < 0 || value > 65535) 626 return (EINVAL); 627 element->mme_level = value; 628 629 /* |
637 * Optional compartment piece of the element. If none 638 * are included, we assume that the label has no 639 * compartments. | 630 * Optional compartment piece of the element. If none are 631 * included, we assume that the label has no compartments. |
640 */ 641 if (string == NULL) 642 return (0); 643 if (*string == '\0') 644 return (0); 645 646 while ((compartment = strsep(&string, "+")) != NULL) { 647 value = strtol(compartment, &end, 10); --- 4 unchanged lines hidden (view full) --- 652 MAC_MLS_BIT_SET(value, element->mme_compartments); 653 } 654 } 655 656 return (0); 657} 658 659/* | 632 */ 633 if (string == NULL) 634 return (0); 635 if (*string == '\0') 636 return (0); 637 638 while ((compartment = strsep(&string, "+")) != NULL) { 639 value = strtol(compartment, &end, 10); --- 4 unchanged lines hidden (view full) --- 644 MAC_MLS_BIT_SET(value, element->mme_compartments); 645 } 646 } 647 648 return (0); 649} 650 651/* |
660 * Note: destructively consumes the string, make a local copy before 661 * calling if that's a problem. | 652 * Note: destructively consumes the string, make a local copy before calling 653 * if that's a problem. |
662 */ 663static int | 654 */ 655static int |
664mac_mls_parse(struct mac_mls *mac_mls, char *string) | 656mls_parse(struct mac_mls *mm, char *string) |
665{ 666 char *rangehigh, *rangelow, *effective; 667 int error; 668 669 effective = strsep(&string, "("); 670 if (*effective == '\0') 671 effective = NULL; 672 --- 8 unchanged lines hidden (view full) --- 681 return (EINVAL); 682 } else { 683 rangelow = NULL; 684 rangehigh = NULL; 685 } 686 687 KASSERT((rangelow != NULL && rangehigh != NULL) || 688 (rangelow == NULL && rangehigh == NULL), | 657{ 658 char *rangehigh, *rangelow, *effective; 659 int error; 660 661 effective = strsep(&string, "("); 662 if (*effective == '\0') 663 effective = NULL; 664 --- 8 unchanged lines hidden (view full) --- 673 return (EINVAL); 674 } else { 675 rangelow = NULL; 676 rangehigh = NULL; 677 } 678 679 KASSERT((rangelow != NULL && rangehigh != NULL) || 680 (rangelow == NULL && rangehigh == NULL), |
689 ("mac_mls_parse: range mismatch")); | 681 ("mls_parse: range mismatch")); |
690 | 682 |
691 bzero(mac_mls, sizeof(*mac_mls)); | 683 bzero(mm, sizeof(*mm)); |
692 if (effective != NULL) { | 684 if (effective != NULL) { |
693 error = mac_mls_parse_element(&mac_mls->mm_effective, effective); | 685 error = mls_parse_element(&mm->mm_effective, effective); |
694 if (error) 695 return (error); | 686 if (error) 687 return (error); |
696 mac_mls->mm_flags |= MAC_MLS_FLAG_EFFECTIVE; | 688 mm->mm_flags |= MAC_MLS_FLAG_EFFECTIVE; |
697 } 698 699 if (rangelow != NULL) { | 689 } 690 691 if (rangelow != NULL) { |
700 error = mac_mls_parse_element(&mac_mls->mm_rangelow, | 692 error = mls_parse_element(&mm->mm_rangelow, |
701 rangelow); 702 if (error) 703 return (error); | 693 rangelow); 694 if (error) 695 return (error); |
704 error = mac_mls_parse_element(&mac_mls->mm_rangehigh, | 696 error = mls_parse_element(&mm->mm_rangehigh, |
705 rangehigh); 706 if (error) 707 return (error); | 697 rangehigh); 698 if (error) 699 return (error); |
708 mac_mls->mm_flags |= MAC_MLS_FLAG_RANGE; | 700 mm->mm_flags |= MAC_MLS_FLAG_RANGE; |
709 } 710 | 701 } 702 |
711 error = mac_mls_valid(mac_mls); | 703 error = mls_valid(mm); |
712 if (error) 713 return (error); 714 715 return (0); 716} 717 718static int | 704 if (error) 705 return (error); 706 707 return (0); 708} 709 710static int |
719mac_mls_internalize_label(struct label *label, char *element_name, | 711mls_internalize_label(struct label *label, char *element_name, |
720 char *element_data, int *claimed) 721{ | 712 char *element_data, int *claimed) 713{ |
722 struct mac_mls *mac_mls, mac_mls_temp; | 714 struct mac_mls *mm, mm_temp; |
723 int error; 724 725 if (strcmp(MAC_MLS_LABEL_NAME, element_name) != 0) 726 return (0); 727 728 (*claimed)++; 729 | 715 int error; 716 717 if (strcmp(MAC_MLS_LABEL_NAME, element_name) != 0) 718 return (0); 719 720 (*claimed)++; 721 |
730 error = mac_mls_parse(&mac_mls_temp, element_data); | 722 error = mls_parse(&mm_temp, element_data); |
731 if (error) 732 return (error); 733 | 723 if (error) 724 return (error); 725 |
734 mac_mls = SLOT(label); 735 *mac_mls = mac_mls_temp; | 726 mm = SLOT(label); 727 *mm = mm_temp; |
736 737 return (0); 738} 739 740static void | 728 729 return (0); 730} 731 732static void |
741mac_mls_copy_label(struct label *src, struct label *dest) | 733mls_copy_label(struct label *src, struct label *dest) |
742{ 743 744 *SLOT(dest) = *SLOT(src); 745} 746 747/* | 734{ 735 736 *SLOT(dest) = *SLOT(src); 737} 738 739/* |
748 * Labeling event operations: file system objects, and things that look 749 * a lot like file system objects. | 740 * Labeling event operations: file system objects, and things that look a lot 741 * like file system objects. |
750 */ 751static void | 742 */ 743static void |
752mac_mls_devfs_create_device(struct ucred *cred, struct mount *mp, | 744mls_devfs_create_device(struct ucred *cred, struct mount *mp, |
753 struct cdev *dev, struct devfs_dirent *de, struct label *delabel) 754{ | 745 struct cdev *dev, struct devfs_dirent *de, struct label *delabel) 746{ |
755 struct mac_mls *mac_mls; | 747 struct mac_mls *mm; |
756 int mls_type; 757 | 748 int mls_type; 749 |
758 mac_mls = SLOT(delabel); | 750 mm = SLOT(delabel); |
759 if (strcmp(dev->si_name, "null") == 0 || 760 strcmp(dev->si_name, "zero") == 0 || 761 strcmp(dev->si_name, "random") == 0 || 762 strncmp(dev->si_name, "fd/", strlen("fd/")) == 0) 763 mls_type = MAC_MLS_TYPE_EQUAL; 764 else if (strcmp(dev->si_name, "kmem") == 0 || 765 strcmp(dev->si_name, "mem") == 0) 766 mls_type = MAC_MLS_TYPE_HIGH; 767 else if (ptys_equal && 768 (strncmp(dev->si_name, "ttyp", strlen("ttyp")) == 0 || 769 strncmp(dev->si_name, "ptyp", strlen("ptyp")) == 0)) 770 mls_type = MAC_MLS_TYPE_EQUAL; 771 else 772 mls_type = MAC_MLS_TYPE_LOW; | 751 if (strcmp(dev->si_name, "null") == 0 || 752 strcmp(dev->si_name, "zero") == 0 || 753 strcmp(dev->si_name, "random") == 0 || 754 strncmp(dev->si_name, "fd/", strlen("fd/")) == 0) 755 mls_type = MAC_MLS_TYPE_EQUAL; 756 else if (strcmp(dev->si_name, "kmem") == 0 || 757 strcmp(dev->si_name, "mem") == 0) 758 mls_type = MAC_MLS_TYPE_HIGH; 759 else if (ptys_equal && 760 (strncmp(dev->si_name, "ttyp", strlen("ttyp")) == 0 || 761 strncmp(dev->si_name, "ptyp", strlen("ptyp")) == 0)) 762 mls_type = MAC_MLS_TYPE_EQUAL; 763 else 764 mls_type = MAC_MLS_TYPE_LOW; |
773 mac_mls_set_effective(mac_mls, mls_type, 0, NULL); | 765 mls_set_effective(mm, mls_type, 0, NULL); |
774} 775 776static void | 766} 767 768static void |
777mac_mls_devfs_create_directory(struct mount *mp, char *dirname, 778 int dirnamelen, struct devfs_dirent *de, struct label *delabel) | 769mls_devfs_create_directory(struct mount *mp, char *dirname, int dirnamelen, 770 struct devfs_dirent *de, struct label *delabel) |
779{ | 771{ |
780 struct mac_mls *mac_mls; | 772 struct mac_mls *mm; |
781 | 773 |
782 mac_mls = SLOT(delabel); 783 mac_mls_set_effective(mac_mls, MAC_MLS_TYPE_LOW, 0, NULL); | 774 mm = SLOT(delabel); 775 mls_set_effective(mm, MAC_MLS_TYPE_LOW, 0, NULL); |
784} 785 786static void | 776} 777 778static void |
787mac_mls_devfs_create_symlink(struct ucred *cred, struct mount *mp, | 779mls_devfs_create_symlink(struct ucred *cred, struct mount *mp, |
788 struct devfs_dirent *dd, struct label *ddlabel, struct devfs_dirent *de, 789 struct label *delabel) 790{ 791 struct mac_mls *source, *dest; 792 793 source = SLOT(cred->cr_label); 794 dest = SLOT(delabel); 795 | 780 struct devfs_dirent *dd, struct label *ddlabel, struct devfs_dirent *de, 781 struct label *delabel) 782{ 783 struct mac_mls *source, *dest; 784 785 source = SLOT(cred->cr_label); 786 dest = SLOT(delabel); 787 |
796 mac_mls_copy_effective(source, dest); | 788 mls_copy_effective(source, dest); |
797} 798 799static void | 789} 790 791static void |
800mac_mls_mount_create(struct ucred *cred, struct mount *mp, 801 struct label *mplabel) | 792mls_mount_create(struct ucred *cred, struct mount *mp, struct label *mplabel) |
802{ 803 struct mac_mls *source, *dest; 804 805 source = SLOT(cred->cr_label); 806 dest = SLOT(mplabel); | 793{ 794 struct mac_mls *source, *dest; 795 796 source = SLOT(cred->cr_label); 797 dest = SLOT(mplabel); |
807 mac_mls_copy_effective(source, dest); | 798 799 mls_copy_effective(source, dest); |
808} 809 810static void | 800} 801 802static void |
811mac_mls_vnode_relabel(struct ucred *cred, struct vnode *vp, | 803mls_vnode_relabel(struct ucred *cred, struct vnode *vp, |
812 struct label *vplabel, struct label *label) 813{ 814 struct mac_mls *source, *dest; 815 816 source = SLOT(label); 817 dest = SLOT(vplabel); 818 | 804 struct label *vplabel, struct label *label) 805{ 806 struct mac_mls *source, *dest; 807 808 source = SLOT(label); 809 dest = SLOT(vplabel); 810 |
819 mac_mls_copy(source, dest); | 811 mls_copy(source, dest); |
820} 821 822static void | 812} 813 814static void |
823mac_mls_devfs_update(struct mount *mp, struct devfs_dirent *de, | 815mls_devfs_update(struct mount *mp, struct devfs_dirent *de, |
824 struct label *delabel, struct vnode *vp, struct label *vplabel) 825{ 826 struct mac_mls *source, *dest; 827 828 source = SLOT(vplabel); 829 dest = SLOT(delabel); 830 | 816 struct label *delabel, struct vnode *vp, struct label *vplabel) 817{ 818 struct mac_mls *source, *dest; 819 820 source = SLOT(vplabel); 821 dest = SLOT(delabel); 822 |
831 mac_mls_copy_effective(source, dest); | 823 mls_copy_effective(source, dest); |
832} 833 834static void | 824} 825 826static void |
835mac_mls_devfs_vnode_associate(struct mount *mp, struct label *mplabel, | 827mls_devfs_vnode_associate(struct mount *mp, struct label *mplabel, |
836 struct devfs_dirent *de, struct label *delabel, struct vnode *vp, 837 struct label *vplabel) 838{ 839 struct mac_mls *source, *dest; 840 841 source = SLOT(delabel); 842 dest = SLOT(vplabel); 843 | 828 struct devfs_dirent *de, struct label *delabel, struct vnode *vp, 829 struct label *vplabel) 830{ 831 struct mac_mls *source, *dest; 832 833 source = SLOT(delabel); 834 dest = SLOT(vplabel); 835 |
844 mac_mls_copy_effective(source, dest); | 836 mls_copy_effective(source, dest); |
845} 846 847static int | 837} 838 839static int |
848mac_mls_vnode_associate_extattr(struct mount *mp, struct label *mplabel, | 840mls_vnode_associate_extattr(struct mount *mp, struct label *mplabel, |
849 struct vnode *vp, struct label *vplabel) 850{ | 841 struct vnode *vp, struct label *vplabel) 842{ |
851 struct mac_mls temp, *source, *dest; | 843 struct mac_mls mm_temp, *source, *dest; |
852 int buflen, error; 853 854 source = SLOT(mplabel); 855 dest = SLOT(vplabel); 856 | 844 int buflen, error; 845 846 source = SLOT(mplabel); 847 dest = SLOT(vplabel); 848 |
857 buflen = sizeof(temp); 858 bzero(&temp, buflen); | 849 buflen = sizeof(mm_temp); 850 bzero(&mm_temp, buflen); |
859 860 error = vn_extattr_get(vp, IO_NODELOCKED, MAC_MLS_EXTATTR_NAMESPACE, | 851 852 error = vn_extattr_get(vp, IO_NODELOCKED, MAC_MLS_EXTATTR_NAMESPACE, |
861 MAC_MLS_EXTATTR_NAME, &buflen, (char *) &temp, curthread); | 853 MAC_MLS_EXTATTR_NAME, &buflen, (char *) &mm_temp, curthread); |
862 if (error == ENOATTR || error == EOPNOTSUPP) { 863 /* Fall back to the mntlabel. */ | 854 if (error == ENOATTR || error == EOPNOTSUPP) { 855 /* Fall back to the mntlabel. */ |
864 mac_mls_copy_effective(source, dest); | 856 mls_copy_effective(source, dest); |
865 return (0); 866 } else if (error) 867 return (error); 868 | 857 return (0); 858 } else if (error) 859 return (error); 860 |
869 if (buflen != sizeof(temp)) { 870 printf("mac_mls_vnode_associate_extattr: bad size %d\n", 871 buflen); | 861 if (buflen != sizeof(mm_temp)) { 862 printf("mls_vnode_associate_extattr: bad size %d\n", buflen); |
872 return (EPERM); 873 } | 863 return (EPERM); 864 } |
874 if (mac_mls_valid(&temp) != 0) { 875 printf("mac_mls_vnode_associate_extattr: invalid\n"); | 865 if (mls_valid(&mm_temp) != 0) { 866 printf("mls_vnode_associate_extattr: invalid\n"); |
876 return (EPERM); 877 } | 867 return (EPERM); 868 } |
878 if ((temp.mm_flags & MAC_MLS_FLAGS_BOTH) != MAC_MLS_FLAG_EFFECTIVE) { 879 printf("mac_mls_associated_vnode_extattr: not effective\n"); | 869 if ((mm_temp.mm_flags & MAC_MLS_FLAGS_BOTH) != 870 MAC_MLS_FLAG_EFFECTIVE) { 871 printf("mls_associated_vnode_extattr: not effective\n"); |
880 return (EPERM); 881 } 882 | 872 return (EPERM); 873 } 874 |
883 mac_mls_copy_effective(&temp, dest); | 875 mls_copy_effective(&mm_temp, dest); |
884 return (0); 885} 886 887static void | 876 return (0); 877} 878 879static void |
888mac_mls_vnode_associate_singlelabel(struct mount *mp, 889 struct label *mplabel, struct vnode *vp, struct label *vplabel) | 880mls_vnode_associate_singlelabel(struct mount *mp, struct label *mplabel, 881 struct vnode *vp, struct label *vplabel) |
890{ 891 struct mac_mls *source, *dest; 892 893 source = SLOT(mplabel); 894 dest = SLOT(vplabel); 895 | 882{ 883 struct mac_mls *source, *dest; 884 885 source = SLOT(mplabel); 886 dest = SLOT(vplabel); 887 |
896 mac_mls_copy_effective(source, dest); | 888 mls_copy_effective(source, dest); |
897} 898 899static int | 889} 890 891static int |
900mac_mls_vnode_create_extattr(struct ucred *cred, struct mount *mp, | 892mls_vnode_create_extattr(struct ucred *cred, struct mount *mp, |
901 struct label *mplabel, struct vnode *dvp, struct label *dvplabel, 902 struct vnode *vp, struct label *vplabel, struct componentname *cnp) 903{ | 893 struct label *mplabel, struct vnode *dvp, struct label *dvplabel, 894 struct vnode *vp, struct label *vplabel, struct componentname *cnp) 895{ |
904 struct mac_mls *source, *dest, temp; | 896 struct mac_mls *source, *dest, mm_temp; |
905 size_t buflen; 906 int error; 907 | 897 size_t buflen; 898 int error; 899 |
908 buflen = sizeof(temp); 909 bzero(&temp, buflen); | 900 buflen = sizeof(mm_temp); 901 bzero(&mm_temp, buflen); |
910 911 source = SLOT(cred->cr_label); 912 dest = SLOT(vplabel); | 902 903 source = SLOT(cred->cr_label); 904 dest = SLOT(vplabel); |
913 mac_mls_copy_effective(source, &temp); | 905 mls_copy_effective(source, &mm_temp); |
914 915 error = vn_extattr_set(vp, IO_NODELOCKED, MAC_MLS_EXTATTR_NAMESPACE, | 906 907 error = vn_extattr_set(vp, IO_NODELOCKED, MAC_MLS_EXTATTR_NAMESPACE, |
916 MAC_MLS_EXTATTR_NAME, buflen, (char *) &temp, curthread); | 908 MAC_MLS_EXTATTR_NAME, buflen, (char *) &mm_temp, curthread); |
917 if (error == 0) | 909 if (error == 0) |
918 mac_mls_copy_effective(source, dest); | 910 mls_copy_effective(source, dest); |
919 return (error); 920} 921 922static int | 911 return (error); 912} 913 914static int |
923mac_mls_vnode_setlabel_extattr(struct ucred *cred, struct vnode *vp, | 915mls_vnode_setlabel_extattr(struct ucred *cred, struct vnode *vp, |
924 struct label *vplabel, struct label *intlabel) 925{ | 916 struct label *vplabel, struct label *intlabel) 917{ |
926 struct mac_mls *source, temp; | 918 struct mac_mls *source, mm_temp; |
927 size_t buflen; 928 int error; 929 | 919 size_t buflen; 920 int error; 921 |
930 buflen = sizeof(temp); 931 bzero(&temp, buflen); | 922 buflen = sizeof(mm_temp); 923 bzero(&mm_temp, buflen); |
932 933 source = SLOT(intlabel); 934 if ((source->mm_flags & MAC_MLS_FLAG_EFFECTIVE) == 0) 935 return (0); 936 | 924 925 source = SLOT(intlabel); 926 if ((source->mm_flags & MAC_MLS_FLAG_EFFECTIVE) == 0) 927 return (0); 928 |
937 mac_mls_copy_effective(source, &temp); | 929 mls_copy_effective(source, &mm_temp); |
938 939 error = vn_extattr_set(vp, IO_NODELOCKED, MAC_MLS_EXTATTR_NAMESPACE, | 930 931 error = vn_extattr_set(vp, IO_NODELOCKED, MAC_MLS_EXTATTR_NAMESPACE, |
940 MAC_MLS_EXTATTR_NAME, buflen, (char *) &temp, curthread); | 932 MAC_MLS_EXTATTR_NAME, buflen, (char *) &mm_temp, curthread); |
941 return (error); 942} 943 944/* 945 * Labeling event operations: IPC object. 946 */ 947static void | 933 return (error); 934} 935 936/* 937 * Labeling event operations: IPC object. 938 */ 939static void |
948mac_mls_inpcb_create(struct socket *so, struct label *solabel, 949 struct inpcb *inp, struct label *inplabel) | 940mls_inpcb_create(struct socket *so, struct label *solabel, struct inpcb *inp, 941 struct label *inplabel) |
950{ 951 struct mac_mls *source, *dest; 952 953 source = SLOT(solabel); 954 dest = SLOT(inplabel); 955 | 942{ 943 struct mac_mls *source, *dest; 944 945 source = SLOT(solabel); 946 dest = SLOT(inplabel); 947 |
956 mac_mls_copy_effective(source, dest); | 948 mls_copy_effective(source, dest); |
957} 958 959static void | 949} 950 951static void |
960mac_mls_socket_create_mbuf(struct socket *so, struct label *solabel, | 952mls_socket_create_mbuf(struct socket *so, struct label *solabel, |
961 struct mbuf *m, struct label *mlabel) 962{ 963 struct mac_mls *source, *dest; 964 965 source = SLOT(solabel); 966 dest = SLOT(mlabel); 967 | 953 struct mbuf *m, struct label *mlabel) 954{ 955 struct mac_mls *source, *dest; 956 957 source = SLOT(solabel); 958 dest = SLOT(mlabel); 959 |
968 mac_mls_copy_effective(source, dest); | 960 mls_copy_effective(source, dest); |
969} 970 971static void | 961} 962 963static void |
972mac_mls_socket_create(struct ucred *cred, struct socket *so, | 964mls_socket_create(struct ucred *cred, struct socket *so, |
973 struct label *solabel) 974{ 975 struct mac_mls *source, *dest; 976 977 source = SLOT(cred->cr_label); 978 dest = SLOT(solabel); 979 | 965 struct label *solabel) 966{ 967 struct mac_mls *source, *dest; 968 969 source = SLOT(cred->cr_label); 970 dest = SLOT(solabel); 971 |
980 mac_mls_copy_effective(source, dest); | 972 mls_copy_effective(source, dest); |
981} 982 983static void | 973} 974 975static void |
984mac_mls_pipe_create(struct ucred *cred, struct pipepair *pp, | 976mls_pipe_create(struct ucred *cred, struct pipepair *pp, |
985 struct label *pplabel) 986{ 987 struct mac_mls *source, *dest; 988 989 source = SLOT(cred->cr_label); 990 dest = SLOT(pplabel); 991 | 977 struct label *pplabel) 978{ 979 struct mac_mls *source, *dest; 980 981 source = SLOT(cred->cr_label); 982 dest = SLOT(pplabel); 983 |
992 mac_mls_copy_effective(source, dest); | 984 mls_copy_effective(source, dest); |
993} 994 995static void | 985} 986 987static void |
996mac_mls_posixsem_create(struct ucred *cred, struct ksem *ks, | 988mls_posixsem_create(struct ucred *cred, struct ksem *ks, |
997 struct label *kslabel) 998{ 999 struct mac_mls *source, *dest; 1000 1001 source = SLOT(cred->cr_label); 1002 dest = SLOT(kslabel); 1003 | 989 struct label *kslabel) 990{ 991 struct mac_mls *source, *dest; 992 993 source = SLOT(cred->cr_label); 994 dest = SLOT(kslabel); 995 |
1004 mac_mls_copy_effective(source, dest); | 996 mls_copy_effective(source, dest); |
1005} 1006 1007static void | 997} 998 999static void |
1008mac_mls_socket_newconn(struct socket *oldso, struct label *oldsolabel, | 1000mls_socket_newconn(struct socket *oldso, struct label *oldsolabel, |
1009 struct socket *newso, struct label *newsolabel) 1010{ 1011 struct mac_mls *source, *dest; 1012 1013 source = SLOT(oldsolabel); 1014 dest = SLOT(newsolabel); 1015 | 1001 struct socket *newso, struct label *newsolabel) 1002{ 1003 struct mac_mls *source, *dest; 1004 1005 source = SLOT(oldsolabel); 1006 dest = SLOT(newsolabel); 1007 |
1016 mac_mls_copy_effective(source, dest); | 1008 mls_copy_effective(source, dest); |
1017} 1018 1019static void | 1009} 1010 1011static void |
1020mac_mls_socket_relabel(struct ucred *cred, struct socket *so, | 1012mls_socket_relabel(struct ucred *cred, struct socket *so, |
1021 struct label *solabel, struct label *newlabel) 1022{ 1023 struct mac_mls *source, *dest; 1024 1025 source = SLOT(newlabel); 1026 dest = SLOT(solabel); 1027 | 1013 struct label *solabel, struct label *newlabel) 1014{ 1015 struct mac_mls *source, *dest; 1016 1017 source = SLOT(newlabel); 1018 dest = SLOT(solabel); 1019 |
1028 mac_mls_copy(source, dest); | 1020 mls_copy(source, dest); |
1029} 1030 1031static void | 1021} 1022 1023static void |
1032mac_mls_pipe_relabel(struct ucred *cred, struct pipepair *pp, | 1024mls_pipe_relabel(struct ucred *cred, struct pipepair *pp, |
1033 struct label *pplabel, struct label *newlabel) 1034{ 1035 struct mac_mls *source, *dest; 1036 1037 source = SLOT(newlabel); 1038 dest = SLOT(pplabel); 1039 | 1025 struct label *pplabel, struct label *newlabel) 1026{ 1027 struct mac_mls *source, *dest; 1028 1029 source = SLOT(newlabel); 1030 dest = SLOT(pplabel); 1031 |
1040 mac_mls_copy(source, dest); | 1032 mls_copy(source, dest); |
1041} 1042 1043static void | 1033} 1034 1035static void |
1044mac_mls_socketpeer_set_from_mbuf(struct mbuf *m, struct label *mlabel, | 1036mls_socketpeer_set_from_mbuf(struct mbuf *m, struct label *mlabel, |
1045 struct socket *so, struct label *sopeerlabel) 1046{ 1047 struct mac_mls *source, *dest; 1048 1049 source = SLOT(mlabel); 1050 dest = SLOT(sopeerlabel); 1051 | 1037 struct socket *so, struct label *sopeerlabel) 1038{ 1039 struct mac_mls *source, *dest; 1040 1041 source = SLOT(mlabel); 1042 dest = SLOT(sopeerlabel); 1043 |
1052 mac_mls_copy_effective(source, dest); | 1044 mls_copy_effective(source, dest); |
1053} 1054 1055/* 1056 * Labeling event operations: System V IPC objects. 1057 */ 1058static void | 1045} 1046 1047/* 1048 * Labeling event operations: System V IPC objects. 1049 */ 1050static void |
1059mac_mls_sysvmsg_create(struct ucred *cred, struct msqid_kernel *msqkptr, | 1051mls_sysvmsg_create(struct ucred *cred, struct msqid_kernel *msqkptr, |
1060 struct label *msqlabel, struct msg *msgptr, struct label *msglabel) 1061{ 1062 struct mac_mls *source, *dest; 1063 1064 /* Ignore the msgq label. */ 1065 source = SLOT(cred->cr_label); 1066 dest = SLOT(msglabel); 1067 | 1052 struct label *msqlabel, struct msg *msgptr, struct label *msglabel) 1053{ 1054 struct mac_mls *source, *dest; 1055 1056 /* Ignore the msgq label. */ 1057 source = SLOT(cred->cr_label); 1058 dest = SLOT(msglabel); 1059 |
1068 mac_mls_copy_effective(source, dest); | 1060 mls_copy_effective(source, dest); |
1069} 1070 1071static void | 1061} 1062 1063static void |
1072mac_mls_sysvmsq_create(struct ucred *cred, struct msqid_kernel *msqkptr, | 1064mls_sysvmsq_create(struct ucred *cred, struct msqid_kernel *msqkptr, |
1073 struct label *msqlabel) 1074{ 1075 struct mac_mls *source, *dest; 1076 1077 source = SLOT(cred->cr_label); 1078 dest = SLOT(msqlabel); 1079 | 1065 struct label *msqlabel) 1066{ 1067 struct mac_mls *source, *dest; 1068 1069 source = SLOT(cred->cr_label); 1070 dest = SLOT(msqlabel); 1071 |
1080 mac_mls_copy_effective(source, dest); | 1072 mls_copy_effective(source, dest); |
1081} 1082 1083static void | 1073} 1074 1075static void |
1084mac_mls_sysvsem_create(struct ucred *cred, struct semid_kernel *semakptr, | 1076mls_sysvsem_create(struct ucred *cred, struct semid_kernel *semakptr, |
1085 struct label *semalabel) 1086{ 1087 struct mac_mls *source, *dest; 1088 1089 source = SLOT(cred->cr_label); 1090 dest = SLOT(semalabel); 1091 | 1077 struct label *semalabel) 1078{ 1079 struct mac_mls *source, *dest; 1080 1081 source = SLOT(cred->cr_label); 1082 dest = SLOT(semalabel); 1083 |
1092 mac_mls_copy_effective(source, dest); | 1084 mls_copy_effective(source, dest); |
1093} 1094 1095static void | 1085} 1086 1087static void |
1096mac_mls_sysvshm_create(struct ucred *cred, struct shmid_kernel *shmsegptr, | 1088mls_sysvshm_create(struct ucred *cred, struct shmid_kernel *shmsegptr, |
1097 struct label *shmlabel) 1098{ 1099 struct mac_mls *source, *dest; 1100 1101 source = SLOT(cred->cr_label); 1102 dest = SLOT(shmlabel); 1103 | 1089 struct label *shmlabel) 1090{ 1091 struct mac_mls *source, *dest; 1092 1093 source = SLOT(cred->cr_label); 1094 dest = SLOT(shmlabel); 1095 |
1104 mac_mls_copy_effective(source, dest); | 1096 mls_copy_effective(source, dest); |
1105} 1106 1107/* 1108 * Labeling event operations: network objects. 1109 */ 1110static void | 1097} 1098 1099/* 1100 * Labeling event operations: network objects. 1101 */ 1102static void |
1111mac_mls_socketpeer_set_from_socket(struct socket *oldso, | 1103mls_socketpeer_set_from_socket(struct socket *oldso, |
1112 struct label *oldsolabel, struct socket *newso, 1113 struct label *newsopeerlabel) 1114{ 1115 struct mac_mls *source, *dest; 1116 1117 source = SLOT(oldsolabel); 1118 dest = SLOT(newsopeerlabel); 1119 | 1104 struct label *oldsolabel, struct socket *newso, 1105 struct label *newsopeerlabel) 1106{ 1107 struct mac_mls *source, *dest; 1108 1109 source = SLOT(oldsolabel); 1110 dest = SLOT(newsopeerlabel); 1111 |
1120 mac_mls_copy_effective(source, dest); | 1112 mls_copy_effective(source, dest); |
1121} 1122 1123static void | 1113} 1114 1115static void |
1124mac_mls_bpfdesc_create(struct ucred *cred, struct bpf_d *d, 1125 struct label *dlabel) | 1116mls_bpfdesc_create(struct ucred *cred, struct bpf_d *d, struct label *dlabel) |
1126{ 1127 struct mac_mls *source, *dest; 1128 1129 source = SLOT(cred->cr_label); 1130 dest = SLOT(dlabel); 1131 | 1117{ 1118 struct mac_mls *source, *dest; 1119 1120 source = SLOT(cred->cr_label); 1121 dest = SLOT(dlabel); 1122 |
1132 mac_mls_copy_effective(source, dest); | 1123 mls_copy_effective(source, dest); |
1133} 1134 1135static void | 1124} 1125 1126static void |
1136mac_mls_ifnet_create(struct ifnet *ifp, struct label *ifplabel) | 1127mls_ifnet_create(struct ifnet *ifp, struct label *ifplabel) |
1137{ 1138 struct mac_mls *dest; 1139 int type; 1140 1141 dest = SLOT(ifplabel); 1142 1143 if (ifp->if_type == IFT_LOOP) 1144 type = MAC_MLS_TYPE_EQUAL; 1145 else 1146 type = MAC_MLS_TYPE_LOW; 1147 | 1128{ 1129 struct mac_mls *dest; 1130 int type; 1131 1132 dest = SLOT(ifplabel); 1133 1134 if (ifp->if_type == IFT_LOOP) 1135 type = MAC_MLS_TYPE_EQUAL; 1136 else 1137 type = MAC_MLS_TYPE_LOW; 1138 |
1148 mac_mls_set_effective(dest, type, 0, NULL); 1149 mac_mls_set_range(dest, type, 0, NULL, type, 0, NULL); | 1139 mls_set_effective(dest, type, 0, NULL); 1140 mls_set_range(dest, type, 0, NULL, type, 0, NULL); |
1150} 1151 1152static void | 1141} 1142 1143static void |
1153mac_mls_ipq_create(struct mbuf *m, struct label *mlabel, struct ipq *ipq, | 1144mls_ipq_create(struct mbuf *m, struct label *mlabel, struct ipq *ipq, |
1154 struct label *ipqlabel) 1155{ 1156 struct mac_mls *source, *dest; 1157 1158 source = SLOT(mlabel); 1159 dest = SLOT(ipqlabel); 1160 | 1145 struct label *ipqlabel) 1146{ 1147 struct mac_mls *source, *dest; 1148 1149 source = SLOT(mlabel); 1150 dest = SLOT(ipqlabel); 1151 |
1161 mac_mls_copy_effective(source, dest); | 1152 mls_copy_effective(source, dest); |
1162} 1163 1164static void | 1153} 1154 1155static void |
1165mac_mls_ipq_reassemble(struct ipq *ipq, struct label *ipqlabel, 1166 struct mbuf *m, struct label *mlabel) | 1156mls_ipq_reassemble(struct ipq *ipq, struct label *ipqlabel, struct mbuf *m, 1157 struct label *mlabel) |
1167{ 1168 struct mac_mls *source, *dest; 1169 1170 source = SLOT(ipqlabel); 1171 dest = SLOT(mlabel); 1172 1173 /* Just use the head, since we require them all to match. */ | 1158{ 1159 struct mac_mls *source, *dest; 1160 1161 source = SLOT(ipqlabel); 1162 dest = SLOT(mlabel); 1163 1164 /* Just use the head, since we require them all to match. */ |
1174 mac_mls_copy_effective(source, dest); | 1165 mls_copy_effective(source, dest); |
1175} 1176 1177static void | 1166} 1167 1168static void |
1178mac_mls_netinet_fragment(struct mbuf *m, struct label *mlabel, 1179 struct mbuf *frag, struct label *fraglabel) | 1169mls_netinet_fragment(struct mbuf *m, struct label *mlabel, struct mbuf *frag, 1170 struct label *fraglabel) |
1180{ 1181 struct mac_mls *source, *dest; 1182 1183 source = SLOT(mlabel); 1184 dest = SLOT(fraglabel); 1185 | 1171{ 1172 struct mac_mls *source, *dest; 1173 1174 source = SLOT(mlabel); 1175 dest = SLOT(fraglabel); 1176 |
1186 mac_mls_copy_effective(source, dest); | 1177 mls_copy_effective(source, dest); |
1187} 1188 1189static void | 1178} 1179 1180static void |
1190mac_mls_inpcb_create_mbuf(struct inpcb *inp, struct label *inplabel, | 1181mls_inpcb_create_mbuf(struct inpcb *inp, struct label *inplabel, |
1191 struct mbuf *m, struct label *mlabel) 1192{ 1193 struct mac_mls *source, *dest; 1194 1195 source = SLOT(inplabel); 1196 dest = SLOT(mlabel); 1197 | 1182 struct mbuf *m, struct label *mlabel) 1183{ 1184 struct mac_mls *source, *dest; 1185 1186 source = SLOT(inplabel); 1187 dest = SLOT(mlabel); 1188 |
1198 mac_mls_copy_effective(source, dest); | 1189 mls_copy_effective(source, dest); |
1199} 1200 1201static void | 1190} 1191 1192static void |
1202mac_mls_create_mbuf_linklayer(struct ifnet *ifp, struct label *ifplabel, | 1193mls_create_mbuf_linklayer(struct ifnet *ifp, struct label *ifplabel, |
1203 struct mbuf *m, struct label *mlabel) 1204{ 1205 struct mac_mls *dest; 1206 1207 dest = SLOT(mlabel); 1208 | 1194 struct mbuf *m, struct label *mlabel) 1195{ 1196 struct mac_mls *dest; 1197 1198 dest = SLOT(mlabel); 1199 |
1209 mac_mls_set_effective(dest, MAC_MLS_TYPE_EQUAL, 0, NULL); | 1200 mls_set_effective(dest, MAC_MLS_TYPE_EQUAL, 0, NULL); |
1210} 1211 1212static void | 1201} 1202 1203static void |
1213mac_mls_bpfdesc_create_mbuf(struct bpf_d *d, struct label *dlabel, | 1204mls_bpfdesc_create_mbuf(struct bpf_d *d, struct label *dlabel, |
1214 struct mbuf *m, struct label *mlabel) 1215{ 1216 struct mac_mls *source, *dest; 1217 1218 source = SLOT(dlabel); 1219 dest = SLOT(mlabel); 1220 | 1205 struct mbuf *m, struct label *mlabel) 1206{ 1207 struct mac_mls *source, *dest; 1208 1209 source = SLOT(dlabel); 1210 dest = SLOT(mlabel); 1211 |
1221 mac_mls_copy_effective(source, dest); | 1212 mls_copy_effective(source, dest); |
1222} 1223 1224static void | 1213} 1214 1215static void |
1225mac_mls_ifnet_create_mbuf(struct ifnet *ifp, struct label *ifplabel, | 1216mls_ifnet_create_mbuf(struct ifnet *ifp, struct label *ifplabel, |
1226 struct mbuf *m, struct label *mlabel) 1227{ 1228 struct mac_mls *source, *dest; 1229 1230 source = SLOT(ifplabel); 1231 dest = SLOT(mlabel); 1232 | 1217 struct mbuf *m, struct label *mlabel) 1218{ 1219 struct mac_mls *source, *dest; 1220 1221 source = SLOT(ifplabel); 1222 dest = SLOT(mlabel); 1223 |
1233 mac_mls_copy_effective(source, dest); | 1224 mls_copy_effective(source, dest); |
1234} 1235 1236static void | 1225} 1226 1227static void |
1237mac_mls_mbuf_create_multicast_encap(struct mbuf *m, struct label *mlabel, | 1228mls_mbuf_create_multicast_encap(struct mbuf *m, struct label *mlabel, |
1238 struct ifnet *ifp, struct label *ifplabel, struct mbuf *mnew, 1239 struct label *mnewlabel) 1240{ 1241 struct mac_mls *source, *dest; 1242 1243 source = SLOT(mlabel); 1244 dest = SLOT(mnewlabel); 1245 | 1229 struct ifnet *ifp, struct label *ifplabel, struct mbuf *mnew, 1230 struct label *mnewlabel) 1231{ 1232 struct mac_mls *source, *dest; 1233 1234 source = SLOT(mlabel); 1235 dest = SLOT(mnewlabel); 1236 |
1246 mac_mls_copy_effective(source, dest); | 1237 mls_copy_effective(source, dest); |
1247} 1248 1249static void | 1238} 1239 1240static void |
1250mac_mls_mbuf_create_netlayer(struct mbuf *m, struct label *mlabel, | 1241mls_mbuf_create_netlayer(struct mbuf *m, struct label *mlabel, |
1251 struct mbuf *mnew, struct label *mnewlabel) 1252{ 1253 struct mac_mls *source, *dest; 1254 1255 source = SLOT(mlabel); 1256 dest = SLOT(mnewlabel); 1257 | 1242 struct mbuf *mnew, struct label *mnewlabel) 1243{ 1244 struct mac_mls *source, *dest; 1245 1246 source = SLOT(mlabel); 1247 dest = SLOT(mnewlabel); 1248 |
1258 mac_mls_copy_effective(source, dest); | 1249 mls_copy_effective(source, dest); |
1259} 1260 1261static int | 1250} 1251 1252static int |
1262mac_mls_ipq_match(struct mbuf *m, struct label *mlabel, struct ipq *ipq, | 1253mls_ipq_match(struct mbuf *m, struct label *mlabel, struct ipq *ipq, |
1263 struct label *ipqlabel) 1264{ 1265 struct mac_mls *a, *b; 1266 1267 a = SLOT(ipqlabel); 1268 b = SLOT(mlabel); 1269 | 1254 struct label *ipqlabel) 1255{ 1256 struct mac_mls *a, *b; 1257 1258 a = SLOT(ipqlabel); 1259 b = SLOT(mlabel); 1260 |
1270 return (mac_mls_equal_effective(a, b)); | 1261 return (mls_equal_effective(a, b)); |
1271} 1272 1273static void | 1262} 1263 1264static void |
1274mac_mls_ifnet_relabel(struct ucred *cred, struct ifnet *ifp, | 1265mls_ifnet_relabel(struct ucred *cred, struct ifnet *ifp, |
1275 struct label *ifplabel, struct label *newlabel) 1276{ 1277 struct mac_mls *source, *dest; 1278 1279 source = SLOT(newlabel); 1280 dest = SLOT(ifplabel); 1281 | 1266 struct label *ifplabel, struct label *newlabel) 1267{ 1268 struct mac_mls *source, *dest; 1269 1270 source = SLOT(newlabel); 1271 dest = SLOT(ifplabel); 1272 |
1282 mac_mls_copy(source, dest); | 1273 mls_copy(source, dest); |
1283} 1284 1285static void | 1274} 1275 1276static void |
1286mac_mls_ipq_update(struct mbuf *m, struct label *mlabel, struct ipq *ipq, | 1277mls_ipq_update(struct mbuf *m, struct label *mlabel, struct ipq *ipq, |
1287 struct label *ipqlabel) 1288{ 1289 1290 /* NOOP: we only accept matching labels, so no need to update */ 1291} 1292 1293static void | 1278 struct label *ipqlabel) 1279{ 1280 1281 /* NOOP: we only accept matching labels, so no need to update */ 1282} 1283 1284static void |
1294mac_mls_inpcb_sosetlabel(struct socket *so, struct label *solabel, | 1285mls_inpcb_sosetlabel(struct socket *so, struct label *solabel, |
1295 struct inpcb *inp, struct label *inplabel) 1296{ 1297 struct mac_mls *source, *dest; 1298 1299 source = SLOT(solabel); 1300 dest = SLOT(inplabel); 1301 | 1286 struct inpcb *inp, struct label *inplabel) 1287{ 1288 struct mac_mls *source, *dest; 1289 1290 source = SLOT(solabel); 1291 dest = SLOT(inplabel); 1292 |
1302 mac_mls_copy(source, dest); | 1293 mls_copy(source, dest); |
1303} 1304 1305static void | 1294} 1295 1296static void |
1306mac_mls_mbuf_create_from_firewall(struct mbuf *m, struct label *mlabel) | 1297mls_mbuf_create_from_firewall(struct mbuf *m, struct label *mlabel) |
1307{ 1308 struct mac_mls *dest; 1309 1310 dest = SLOT(mlabel); 1311 1312 /* XXX: where is the label for the firewall really comming from? */ | 1298{ 1299 struct mac_mls *dest; 1300 1301 dest = SLOT(mlabel); 1302 1303 /* XXX: where is the label for the firewall really comming from? */ |
1313 mac_mls_set_effective(dest, MAC_MLS_TYPE_EQUAL, 0, NULL); | 1304 mls_set_effective(dest, MAC_MLS_TYPE_EQUAL, 0, NULL); |
1314} 1315 1316static void | 1305} 1306 1307static void |
1317mac_mls_init_syncache_from_inpcb(struct label *label, struct inpcb *inp) | 1308mls_init_syncache_from_inpcb(struct label *label, struct inpcb *inp) |
1318{ 1319 struct mac_mls *source, *dest; 1320 1321 source = SLOT(inp->inp_label); 1322 dest = SLOT(label); | 1309{ 1310 struct mac_mls *source, *dest; 1311 1312 source = SLOT(inp->inp_label); 1313 dest = SLOT(label); |
1323 mac_mls_copy_effective(source, dest); | 1314 1315 mls_copy_effective(source, dest); |
1324} 1325 1326static void | 1316} 1317 1318static void |
1327mac_mls_create_mbuf_from_syncache(struct label *sc_label, struct mbuf *m, | 1319mls_create_mbuf_from_syncache(struct label *sc_label, struct mbuf *m, |
1328 struct label *mlabel) 1329{ 1330 struct mac_mls *source, *dest; 1331 1332 source = SLOT(sc_label); 1333 dest = SLOT(mlabel); | 1320 struct label *mlabel) 1321{ 1322 struct mac_mls *source, *dest; 1323 1324 source = SLOT(sc_label); 1325 dest = SLOT(mlabel); |
1334 mac_mls_copy_effective(source, dest); | 1326 1327 mls_copy_effective(source, dest); |
1335} 1336 1337/* 1338 * Labeling event operations: processes. 1339 */ 1340static void | 1328} 1329 1330/* 1331 * Labeling event operations: processes. 1332 */ 1333static void |
1341mac_mls_proc_create_swapper(struct ucred *cred) | 1334mls_proc_create_swapper(struct ucred *cred) |
1342{ 1343 struct mac_mls *dest; 1344 1345 dest = SLOT(cred->cr_label); 1346 | 1335{ 1336 struct mac_mls *dest; 1337 1338 dest = SLOT(cred->cr_label); 1339 |
1347 mac_mls_set_effective(dest, MAC_MLS_TYPE_EQUAL, 0, NULL); 1348 mac_mls_set_range(dest, MAC_MLS_TYPE_LOW, 0, NULL, MAC_MLS_TYPE_HIGH, 1349 0, NULL); | 1340 mls_set_effective(dest, MAC_MLS_TYPE_EQUAL, 0, NULL); 1341 mls_set_range(dest, MAC_MLS_TYPE_LOW, 0, NULL, MAC_MLS_TYPE_HIGH, 0, 1342 NULL); |
1350} 1351 1352static void | 1343} 1344 1345static void |
1353mac_mls_proc_create_init(struct ucred *cred) | 1346mls_proc_create_init(struct ucred *cred) |
1354{ 1355 struct mac_mls *dest; 1356 1357 dest = SLOT(cred->cr_label); 1358 | 1347{ 1348 struct mac_mls *dest; 1349 1350 dest = SLOT(cred->cr_label); 1351 |
1359 mac_mls_set_effective(dest, MAC_MLS_TYPE_LOW, 0, NULL); 1360 mac_mls_set_range(dest, MAC_MLS_TYPE_LOW, 0, NULL, MAC_MLS_TYPE_HIGH, 1361 0, NULL); | 1352 mls_set_effective(dest, MAC_MLS_TYPE_LOW, 0, NULL); 1353 mls_set_range(dest, MAC_MLS_TYPE_LOW, 0, NULL, MAC_MLS_TYPE_HIGH, 0, 1354 NULL); |
1362} 1363 1364static void | 1355} 1356 1357static void |
1365mac_mls_cred_relabel(struct ucred *cred, struct label *newlabel) | 1358mls_cred_relabel(struct ucred *cred, struct label *newlabel) |
1366{ 1367 struct mac_mls *source, *dest; 1368 1369 source = SLOT(newlabel); 1370 dest = SLOT(cred->cr_label); 1371 | 1359{ 1360 struct mac_mls *source, *dest; 1361 1362 source = SLOT(newlabel); 1363 dest = SLOT(cred->cr_label); 1364 |
1372 mac_mls_copy(source, dest); | 1365 mls_copy(source, dest); |
1373} 1374 1375/* 1376 * Label cleanup/flush operations. 1377 */ 1378static void | 1366} 1367 1368/* 1369 * Label cleanup/flush operations. 1370 */ 1371static void |
1379mac_mls_sysvmsg_cleanup(struct label *msglabel) | 1372mls_sysvmsg_cleanup(struct label *msglabel) |
1380{ 1381 1382 bzero(SLOT(msglabel), sizeof(struct mac_mls)); 1383} 1384 1385static void | 1373{ 1374 1375 bzero(SLOT(msglabel), sizeof(struct mac_mls)); 1376} 1377 1378static void |
1386mac_mls_sysvmsq_cleanup(struct label *msqlabel) | 1379mls_sysvmsq_cleanup(struct label *msqlabel) |
1387{ 1388 1389 bzero(SLOT(msqlabel), sizeof(struct mac_mls)); 1390} 1391 1392static void | 1380{ 1381 1382 bzero(SLOT(msqlabel), sizeof(struct mac_mls)); 1383} 1384 1385static void |
1393mac_mls_sysvsem_cleanup(struct label *semalabel) | 1386mls_sysvsem_cleanup(struct label *semalabel) |
1394{ 1395 1396 bzero(SLOT(semalabel), sizeof(struct mac_mls)); 1397} 1398 1399static void | 1387{ 1388 1389 bzero(SLOT(semalabel), sizeof(struct mac_mls)); 1390} 1391 1392static void |
1400mac_mls_sysvshm_cleanup(struct label *shmlabel) | 1393mls_sysvshm_cleanup(struct label *shmlabel) |
1401{ 1402 1403 bzero(SLOT(shmlabel), sizeof(struct mac_mls)); 1404} 1405 1406/* 1407 * Access control checks. 1408 */ 1409static int | 1394{ 1395 1396 bzero(SLOT(shmlabel), sizeof(struct mac_mls)); 1397} 1398 1399/* 1400 * Access control checks. 1401 */ 1402static int |
1410mac_mls_bpfdesc_check_receive(struct bpf_d *d, struct label *dlabel, | 1403mls_bpfdesc_check_receive(struct bpf_d *d, struct label *dlabel, |
1411 struct ifnet *ifp, struct label *ifplabel) 1412{ 1413 struct mac_mls *a, *b; 1414 | 1404 struct ifnet *ifp, struct label *ifplabel) 1405{ 1406 struct mac_mls *a, *b; 1407 |
1415 if (!mac_mls_enabled) | 1408 if (!mls_enabled) |
1416 return (0); 1417 1418 a = SLOT(dlabel); 1419 b = SLOT(ifplabel); 1420 | 1409 return (0); 1410 1411 a = SLOT(dlabel); 1412 b = SLOT(ifplabel); 1413 |
1421 if (mac_mls_equal_effective(a, b)) | 1414 if (mls_equal_effective(a, b)) |
1422 return (0); 1423 return (EACCES); 1424} 1425 1426static int | 1415 return (0); 1416 return (EACCES); 1417} 1418 1419static int |
1427mac_mls_cred_check_relabel(struct ucred *cred, struct label *newlabel) | 1420mls_cred_check_relabel(struct ucred *cred, struct label *newlabel) |
1428{ 1429 struct mac_mls *subj, *new; 1430 int error; 1431 1432 subj = SLOT(cred->cr_label); 1433 new = SLOT(newlabel); 1434 1435 /* | 1421{ 1422 struct mac_mls *subj, *new; 1423 int error; 1424 1425 subj = SLOT(cred->cr_label); 1426 new = SLOT(newlabel); 1427 1428 /* |
1436 * If there is an MLS label update for the credential, it may be 1437 * an update of effective, range, or both. | 1429 * If there is an MLS label update for the credential, it may be an 1430 * update of effective, range, or both. |
1438 */ 1439 error = mls_atmostflags(new, MAC_MLS_FLAGS_BOTH); 1440 if (error) 1441 return (error); 1442 1443 /* 1444 * If the MLS label is to be changed, authorize as appropriate. 1445 */ 1446 if (new->mm_flags & MAC_MLS_FLAGS_BOTH) { 1447 /* | 1431 */ 1432 error = mls_atmostflags(new, MAC_MLS_FLAGS_BOTH); 1433 if (error) 1434 return (error); 1435 1436 /* 1437 * If the MLS label is to be changed, authorize as appropriate. 1438 */ 1439 if (new->mm_flags & MAC_MLS_FLAGS_BOTH) { 1440 /* |
1448 * If the change request modifies both the MLS label effective 1449 * and range, check that the new effective will be in the 1450 * new range. | 1441 * If the change request modifies both the MLS label 1442 * effective and range, check that the new effective will be 1443 * in the new range. |
1451 */ 1452 if ((new->mm_flags & MAC_MLS_FLAGS_BOTH) == | 1444 */ 1445 if ((new->mm_flags & MAC_MLS_FLAGS_BOTH) == |
1453 MAC_MLS_FLAGS_BOTH && 1454 !mac_mls_effective_in_range(new, new)) | 1446 MAC_MLS_FLAGS_BOTH && !mls_effective_in_range(new, new)) |
1455 return (EINVAL); 1456 1457 /* | 1447 return (EINVAL); 1448 1449 /* |
1458 * To change the MLS effective label on a credential, the 1459 * new effective label must be in the current range. | 1450 * To change the MLS effective label on a credential, the new 1451 * effective label must be in the current range. |
1460 */ 1461 if (new->mm_flags & MAC_MLS_FLAG_EFFECTIVE && | 1452 */ 1453 if (new->mm_flags & MAC_MLS_FLAG_EFFECTIVE && |
1462 !mac_mls_effective_in_range(new, subj)) | 1454 !mls_effective_in_range(new, subj)) |
1463 return (EPERM); 1464 1465 /* | 1455 return (EPERM); 1456 1457 /* |
1466 * To change the MLS range label on a credential, the 1467 * new range must be in the current range. | 1458 * To change the MLS range label on a credential, the new 1459 * range must be in the current range. |
1468 */ 1469 if (new->mm_flags & MAC_MLS_FLAG_RANGE && | 1460 */ 1461 if (new->mm_flags & MAC_MLS_FLAG_RANGE && |
1470 !mac_mls_range_in_range(new, subj)) | 1462 !mls_range_in_range(new, subj)) |
1471 return (EPERM); 1472 1473 /* | 1463 return (EPERM); 1464 1465 /* |
1474 * To have EQUAL in any component of the new credential 1475 * MLS label, the subject must already have EQUAL in 1476 * their label. | 1466 * To have EQUAL in any component of the new credential MLS 1467 * label, the subject must already have EQUAL in their label. |
1477 */ | 1468 */ |
1478 if (mac_mls_contains_equal(new)) { 1479 error = mac_mls_subject_privileged(subj); | 1469 if (mls_contains_equal(new)) { 1470 error = mls_subject_privileged(subj); |
1480 if (error) 1481 return (error); 1482 } 1483 } 1484 1485 return (0); 1486} 1487 1488static int | 1471 if (error) 1472 return (error); 1473 } 1474 } 1475 1476 return (0); 1477} 1478 1479static int |
1489mac_mls_cred_check_visible(struct ucred *cr1, struct ucred *cr2) | 1480mls_cred_check_visible(struct ucred *cr1, struct ucred *cr2) |
1490{ 1491 struct mac_mls *subj, *obj; 1492 | 1481{ 1482 struct mac_mls *subj, *obj; 1483 |
1493 if (!mac_mls_enabled) | 1484 if (!mls_enabled) |
1494 return (0); 1495 1496 subj = SLOT(cr1->cr_label); 1497 obj = SLOT(cr2->cr_label); 1498 1499 /* XXX: range */ | 1485 return (0); 1486 1487 subj = SLOT(cr1->cr_label); 1488 obj = SLOT(cr2->cr_label); 1489 1490 /* XXX: range */ |
1500 if (!mac_mls_dominate_effective(subj, obj)) | 1491 if (!mls_dominate_effective(subj, obj)) |
1501 return (ESRCH); 1502 1503 return (0); 1504} 1505 1506static int | 1492 return (ESRCH); 1493 1494 return (0); 1495} 1496 1497static int |
1507mac_mls_ifnet_check_relabel(struct ucred *cred, struct ifnet *ifp, | 1498mls_ifnet_check_relabel(struct ucred *cred, struct ifnet *ifp, |
1508 struct label *ifplabel, struct label *newlabel) 1509{ 1510 struct mac_mls *subj, *new; 1511 int error; 1512 1513 subj = SLOT(cred->cr_label); 1514 new = SLOT(newlabel); 1515 1516 /* | 1499 struct label *ifplabel, struct label *newlabel) 1500{ 1501 struct mac_mls *subj, *new; 1502 int error; 1503 1504 subj = SLOT(cred->cr_label); 1505 new = SLOT(newlabel); 1506 1507 /* |
1517 * If there is an MLS label update for the interface, it may 1518 * be an update of effective, range, or both. | 1508 * If there is an MLS label update for the interface, it may be an 1509 * update of effective, range, or both. |
1519 */ 1520 error = mls_atmostflags(new, MAC_MLS_FLAGS_BOTH); 1521 if (error) 1522 return (error); 1523 1524 /* 1525 * Relabeling network interfaces requires MLS privilege. 1526 */ | 1510 */ 1511 error = mls_atmostflags(new, MAC_MLS_FLAGS_BOTH); 1512 if (error) 1513 return (error); 1514 1515 /* 1516 * Relabeling network interfaces requires MLS privilege. 1517 */ |
1527 error = mac_mls_subject_privileged(subj); | 1518 error = mls_subject_privileged(subj); |
1528 1529 return (0); 1530} 1531 1532static int | 1519 1520 return (0); 1521} 1522 1523static int |
1533mac_mls_ifnet_check_transmit(struct ifnet *ifp, struct label *ifplabel, | 1524mls_ifnet_check_transmit(struct ifnet *ifp, struct label *ifplabel, |
1534 struct mbuf *m, struct label *mlabel) 1535{ 1536 struct mac_mls *p, *i; 1537 | 1525 struct mbuf *m, struct label *mlabel) 1526{ 1527 struct mac_mls *p, *i; 1528 |
1538 if (!mac_mls_enabled) | 1529 if (!mls_enabled) |
1539 return (0); 1540 1541 p = SLOT(mlabel); 1542 i = SLOT(ifplabel); 1543 | 1530 return (0); 1531 1532 p = SLOT(mlabel); 1533 i = SLOT(ifplabel); 1534 |
1544 return (mac_mls_effective_in_range(p, i) ? 0 : EACCES); | 1535 return (mls_effective_in_range(p, i) ? 0 : EACCES); |
1545} 1546 1547static int | 1536} 1537 1538static int |
1548mac_mls_inpcb_check_deliver(struct inpcb *inp, struct label *inplabel, | 1539mls_inpcb_check_deliver(struct inpcb *inp, struct label *inplabel, |
1549 struct mbuf *m, struct label *mlabel) 1550{ 1551 struct mac_mls *p, *i; 1552 | 1540 struct mbuf *m, struct label *mlabel) 1541{ 1542 struct mac_mls *p, *i; 1543 |
1553 if (!mac_mls_enabled) | 1544 if (!mls_enabled) |
1554 return (0); 1555 1556 p = SLOT(mlabel); 1557 i = SLOT(inplabel); 1558 | 1545 return (0); 1546 1547 p = SLOT(mlabel); 1548 i = SLOT(inplabel); 1549 |
1559 return (mac_mls_equal_effective(p, i) ? 0 : EACCES); | 1550 return (mls_equal_effective(p, i) ? 0 : EACCES); |
1560} 1561 1562static int | 1551} 1552 1553static int |
1563mac_mls_sysvmsq_check_msgrcv(struct ucred *cred, struct msg *msgptr, | 1554mls_sysvmsq_check_msgrcv(struct ucred *cred, struct msg *msgptr, |
1564 struct label *msglabel) 1565{ 1566 struct mac_mls *subj, *obj; 1567 | 1555 struct label *msglabel) 1556{ 1557 struct mac_mls *subj, *obj; 1558 |
1568 if (!mac_mls_enabled) | 1559 if (!mls_enabled) |
1569 return (0); 1570 1571 subj = SLOT(cred->cr_label); 1572 obj = SLOT(msglabel); 1573 | 1560 return (0); 1561 1562 subj = SLOT(cred->cr_label); 1563 obj = SLOT(msglabel); 1564 |
1574 if (!mac_mls_dominate_effective(subj, obj)) | 1565 if (!mls_dominate_effective(subj, obj)) |
1575 return (EACCES); 1576 1577 return (0); 1578} 1579 1580static int | 1566 return (EACCES); 1567 1568 return (0); 1569} 1570 1571static int |
1581mac_mls_sysvmsq_check_msgrmid(struct ucred *cred, struct msg *msgptr, | 1572mls_sysvmsq_check_msgrmid(struct ucred *cred, struct msg *msgptr, |
1582 struct label *msglabel) 1583{ 1584 struct mac_mls *subj, *obj; 1585 | 1573 struct label *msglabel) 1574{ 1575 struct mac_mls *subj, *obj; 1576 |
1586 if (!mac_mls_enabled) | 1577 if (!mls_enabled) |
1587 return (0); 1588 1589 subj = SLOT(cred->cr_label); 1590 obj = SLOT(msglabel); 1591 | 1578 return (0); 1579 1580 subj = SLOT(cred->cr_label); 1581 obj = SLOT(msglabel); 1582 |
1592 if (!mac_mls_dominate_effective(obj, subj)) | 1583 if (!mls_dominate_effective(obj, subj)) |
1593 return (EACCES); 1594 1595 return (0); 1596} 1597 1598static int | 1584 return (EACCES); 1585 1586 return (0); 1587} 1588 1589static int |
1599mac_mls_sysvmsq_check_msqget(struct ucred *cred, 1600 struct msqid_kernel *msqkptr, struct label *msqklabel) | 1590mls_sysvmsq_check_msqget(struct ucred *cred, struct msqid_kernel *msqkptr, 1591 struct label *msqklabel) |
1601{ 1602 struct mac_mls *subj, *obj; 1603 | 1592{ 1593 struct mac_mls *subj, *obj; 1594 |
1604 if (!mac_mls_enabled) | 1595 if (!mls_enabled) |
1605 return (0); 1606 1607 subj = SLOT(cred->cr_label); 1608 obj = SLOT(msqklabel); 1609 | 1596 return (0); 1597 1598 subj = SLOT(cred->cr_label); 1599 obj = SLOT(msqklabel); 1600 |
1610 if (!mac_mls_dominate_effective(subj, obj)) | 1601 if (!mls_dominate_effective(subj, obj)) |
1611 return (EACCES); 1612 1613 return (0); 1614} 1615 1616static int | 1602 return (EACCES); 1603 1604 return (0); 1605} 1606 1607static int |
1617mac_mls_sysvmsq_check_msqsnd(struct ucred *cred, 1618 struct msqid_kernel *msqkptr, struct label *msqklabel) | 1608mls_sysvmsq_check_msqsnd(struct ucred *cred, struct msqid_kernel *msqkptr, 1609 struct label *msqklabel) |
1619{ 1620 struct mac_mls *subj, *obj; 1621 | 1610{ 1611 struct mac_mls *subj, *obj; 1612 |
1622 if (!mac_mls_enabled) | 1613 if (!mls_enabled) |
1623 return (0); 1624 1625 subj = SLOT(cred->cr_label); 1626 obj = SLOT(msqklabel); 1627 | 1614 return (0); 1615 1616 subj = SLOT(cred->cr_label); 1617 obj = SLOT(msqklabel); 1618 |
1628 if (!mac_mls_dominate_effective(obj, subj)) | 1619 if (!mls_dominate_effective(obj, subj)) |
1629 return (EACCES); 1630 1631 return (0); 1632} 1633 1634static int | 1620 return (EACCES); 1621 1622 return (0); 1623} 1624 1625static int |
1635mac_mls_sysvmsq_check_msqrcv(struct ucred *cred, 1636 struct msqid_kernel *msqkptr, struct label *msqklabel) | 1626mls_sysvmsq_check_msqrcv(struct ucred *cred, struct msqid_kernel *msqkptr, 1627 struct label *msqklabel) |
1637{ 1638 struct mac_mls *subj, *obj; 1639 | 1628{ 1629 struct mac_mls *subj, *obj; 1630 |
1640 if (!mac_mls_enabled) | 1631 if (!mls_enabled) |
1641 return (0); 1642 1643 subj = SLOT(cred->cr_label); 1644 obj = SLOT(msqklabel); 1645 | 1632 return (0); 1633 1634 subj = SLOT(cred->cr_label); 1635 obj = SLOT(msqklabel); 1636 |
1646 if (!mac_mls_dominate_effective(subj, obj)) | 1637 if (!mls_dominate_effective(subj, obj)) |
1647 return (EACCES); 1648 1649 return (0); 1650} 1651 1652static int | 1638 return (EACCES); 1639 1640 return (0); 1641} 1642 1643static int |
1653mac_mls_sysvmsq_check_msqctl(struct ucred *cred, 1654 struct msqid_kernel *msqkptr, struct label *msqklabel, int cmd) | 1644mls_sysvmsq_check_msqctl(struct ucred *cred, struct msqid_kernel *msqkptr, 1645 struct label *msqklabel, int cmd) |
1655{ 1656 struct mac_mls *subj, *obj; 1657 | 1646{ 1647 struct mac_mls *subj, *obj; 1648 |
1658 if (!mac_mls_enabled) | 1649 if (!mls_enabled) |
1659 return (0); 1660 1661 subj = SLOT(cred->cr_label); 1662 obj = SLOT(msqklabel); 1663 1664 switch(cmd) { 1665 case IPC_RMID: 1666 case IPC_SET: | 1650 return (0); 1651 1652 subj = SLOT(cred->cr_label); 1653 obj = SLOT(msqklabel); 1654 1655 switch(cmd) { 1656 case IPC_RMID: 1657 case IPC_SET: |
1667 if (!mac_mls_dominate_effective(obj, subj)) | 1658 if (!mls_dominate_effective(obj, subj)) |
1668 return (EACCES); 1669 break; 1670 1671 case IPC_STAT: | 1659 return (EACCES); 1660 break; 1661 1662 case IPC_STAT: |
1672 if (!mac_mls_dominate_effective(subj, obj)) | 1663 if (!mls_dominate_effective(subj, obj)) |
1673 return (EACCES); 1674 break; 1675 1676 default: 1677 return (EACCES); 1678 } 1679 1680 return (0); 1681} 1682 1683static int | 1664 return (EACCES); 1665 break; 1666 1667 default: 1668 return (EACCES); 1669 } 1670 1671 return (0); 1672} 1673 1674static int |
1684mac_mls_sysvsem_check_semctl(struct ucred *cred, 1685 struct semid_kernel *semakptr, struct label *semaklabel, int cmd) | 1675mls_sysvsem_check_semctl(struct ucred *cred, struct semid_kernel *semakptr, 1676 struct label *semaklabel, int cmd) |
1686{ 1687 struct mac_mls *subj, *obj; 1688 | 1677{ 1678 struct mac_mls *subj, *obj; 1679 |
1689 if (!mac_mls_enabled) | 1680 if (!mls_enabled) |
1690 return (0); 1691 1692 subj = SLOT(cred->cr_label); 1693 obj = SLOT(semaklabel); 1694 1695 switch(cmd) { 1696 case IPC_RMID: 1697 case IPC_SET: 1698 case SETVAL: 1699 case SETALL: | 1681 return (0); 1682 1683 subj = SLOT(cred->cr_label); 1684 obj = SLOT(semaklabel); 1685 1686 switch(cmd) { 1687 case IPC_RMID: 1688 case IPC_SET: 1689 case SETVAL: 1690 case SETALL: |
1700 if (!mac_mls_dominate_effective(obj, subj)) | 1691 if (!mls_dominate_effective(obj, subj)) |
1701 return (EACCES); 1702 break; 1703 1704 case IPC_STAT: 1705 case GETVAL: 1706 case GETPID: 1707 case GETNCNT: 1708 case GETZCNT: 1709 case GETALL: | 1692 return (EACCES); 1693 break; 1694 1695 case IPC_STAT: 1696 case GETVAL: 1697 case GETPID: 1698 case GETNCNT: 1699 case GETZCNT: 1700 case GETALL: |
1710 if (!mac_mls_dominate_effective(subj, obj)) | 1701 if (!mls_dominate_effective(subj, obj)) |
1711 return (EACCES); 1712 break; 1713 1714 default: 1715 return (EACCES); 1716 } 1717 1718 return (0); 1719} 1720 1721static int | 1702 return (EACCES); 1703 break; 1704 1705 default: 1706 return (EACCES); 1707 } 1708 1709 return (0); 1710} 1711 1712static int |
1722mac_mls_sysvsem_check_semget(struct ucred *cred, 1723 struct semid_kernel *semakptr, struct label *semaklabel) | 1713mls_sysvsem_check_semget(struct ucred *cred, struct semid_kernel *semakptr, 1714 struct label *semaklabel) |
1724{ 1725 struct mac_mls *subj, *obj; 1726 | 1715{ 1716 struct mac_mls *subj, *obj; 1717 |
1727 if (!mac_mls_enabled) | 1718 if (!mls_enabled) |
1728 return (0); 1729 1730 subj = SLOT(cred->cr_label); 1731 obj = SLOT(semaklabel); 1732 | 1719 return (0); 1720 1721 subj = SLOT(cred->cr_label); 1722 obj = SLOT(semaklabel); 1723 |
1733 if (!mac_mls_dominate_effective(subj, obj)) | 1724 if (!mls_dominate_effective(subj, obj)) |
1734 return (EACCES); 1735 1736 return (0); 1737} 1738 1739static int | 1725 return (EACCES); 1726 1727 return (0); 1728} 1729 1730static int |
1740mac_mls_sysvsem_check_semop(struct ucred *cred, 1741 struct semid_kernel *semakptr, struct label *semaklabel, 1742 size_t accesstype) | 1731mls_sysvsem_check_semop(struct ucred *cred, struct semid_kernel *semakptr, 1732 struct label *semaklabel, size_t accesstype) |
1743{ 1744 struct mac_mls *subj, *obj; 1745 | 1733{ 1734 struct mac_mls *subj, *obj; 1735 |
1746 if (!mac_mls_enabled) | 1736 if (!mls_enabled) |
1747 return (0); 1748 1749 subj = SLOT(cred->cr_label); 1750 obj = SLOT(semaklabel); 1751 1752 if( accesstype & SEM_R ) | 1737 return (0); 1738 1739 subj = SLOT(cred->cr_label); 1740 obj = SLOT(semaklabel); 1741 1742 if( accesstype & SEM_R ) |
1753 if (!mac_mls_dominate_effective(subj, obj)) | 1743 if (!mls_dominate_effective(subj, obj)) |
1754 return (EACCES); 1755 1756 if( accesstype & SEM_A ) | 1744 return (EACCES); 1745 1746 if( accesstype & SEM_A ) |
1757 if (!mac_mls_dominate_effective(obj, subj)) | 1747 if (!mls_dominate_effective(obj, subj)) |
1758 return (EACCES); 1759 1760 return (0); 1761} 1762 1763static int | 1748 return (EACCES); 1749 1750 return (0); 1751} 1752 1753static int |
1764mac_mls_sysvshm_check_shmat(struct ucred *cred, 1765 struct shmid_kernel *shmsegptr, struct label *shmseglabel, int shmflg) | 1754mls_sysvshm_check_shmat(struct ucred *cred, struct shmid_kernel *shmsegptr, 1755 struct label *shmseglabel, int shmflg) |
1766{ 1767 struct mac_mls *subj, *obj; 1768 | 1756{ 1757 struct mac_mls *subj, *obj; 1758 |
1769 if (!mac_mls_enabled) | 1759 if (!mls_enabled) |
1770 return (0); 1771 1772 subj = SLOT(cred->cr_label); 1773 obj = SLOT(shmseglabel); 1774 | 1760 return (0); 1761 1762 subj = SLOT(cred->cr_label); 1763 obj = SLOT(shmseglabel); 1764 |
1775 if (!mac_mls_dominate_effective(subj, obj)) | 1765 if (!mls_dominate_effective(subj, obj)) 1766 return (EACCES); 1767 if ((shmflg & SHM_RDONLY) == 0) { 1768 if (!mls_dominate_effective(obj, subj)) |
1776 return (EACCES); | 1769 return (EACCES); |
1777 if ((shmflg & SHM_RDONLY) == 0) 1778 if (!mac_mls_dominate_effective(obj, subj)) 1779 return (EACCES); | 1770 } |
1780 1781 return (0); 1782} 1783 1784static int | 1771 1772 return (0); 1773} 1774 1775static int |
1785mac_mls_sysvshm_check_shmctl(struct ucred *cred, 1786 struct shmid_kernel *shmsegptr, struct label *shmseglabel, int cmd) | 1776mls_sysvshm_check_shmctl(struct ucred *cred, struct shmid_kernel *shmsegptr, 1777 struct label *shmseglabel, int cmd) |
1787{ 1788 struct mac_mls *subj, *obj; 1789 | 1778{ 1779 struct mac_mls *subj, *obj; 1780 |
1790 if (!mac_mls_enabled) | 1781 if (!mls_enabled) |
1791 return (0); 1792 1793 subj = SLOT(cred->cr_label); 1794 obj = SLOT(shmseglabel); 1795 1796 switch(cmd) { 1797 case IPC_RMID: 1798 case IPC_SET: | 1782 return (0); 1783 1784 subj = SLOT(cred->cr_label); 1785 obj = SLOT(shmseglabel); 1786 1787 switch(cmd) { 1788 case IPC_RMID: 1789 case IPC_SET: |
1799 if (!mac_mls_dominate_effective(obj, subj)) | 1790 if (!mls_dominate_effective(obj, subj)) |
1800 return (EACCES); 1801 break; 1802 1803 case IPC_STAT: 1804 case SHM_STAT: | 1791 return (EACCES); 1792 break; 1793 1794 case IPC_STAT: 1795 case SHM_STAT: |
1805 if (!mac_mls_dominate_effective(subj, obj)) | 1796 if (!mls_dominate_effective(subj, obj)) |
1806 return (EACCES); 1807 break; 1808 1809 default: 1810 return (EACCES); 1811 } 1812 1813 return (0); 1814} 1815 1816static int | 1797 return (EACCES); 1798 break; 1799 1800 default: 1801 return (EACCES); 1802 } 1803 1804 return (0); 1805} 1806 1807static int |
1817mac_mls_sysvshm_check_shmget(struct ucred *cred, 1818 struct shmid_kernel *shmsegptr, struct label *shmseglabel, int shmflg) | 1808mls_sysvshm_check_shmget(struct ucred *cred, struct shmid_kernel *shmsegptr, 1809 struct label *shmseglabel, int shmflg) |
1819{ 1820 struct mac_mls *subj, *obj; 1821 | 1810{ 1811 struct mac_mls *subj, *obj; 1812 |
1822 if (!mac_mls_enabled) | 1813 if (!mls_enabled) |
1823 return (0); 1824 1825 subj = SLOT(cred->cr_label); 1826 obj = SLOT(shmseglabel); 1827 | 1814 return (0); 1815 1816 subj = SLOT(cred->cr_label); 1817 obj = SLOT(shmseglabel); 1818 |
1828 if (!mac_mls_dominate_effective(obj, subj)) | 1819 if (!mls_dominate_effective(obj, subj)) |
1829 return (EACCES); 1830 1831 return (0); 1832} 1833 1834static int | 1820 return (EACCES); 1821 1822 return (0); 1823} 1824 1825static int |
1835mac_mls_mount_check_stat(struct ucred *cred, struct mount *mp, | 1826mls_mount_check_stat(struct ucred *cred, struct mount *mp, |
1836 struct label *mntlabel) 1837{ 1838 struct mac_mls *subj, *obj; 1839 | 1827 struct label *mntlabel) 1828{ 1829 struct mac_mls *subj, *obj; 1830 |
1840 if (!mac_mls_enabled) | 1831 if (!mls_enabled) |
1841 return (0); 1842 1843 subj = SLOT(cred->cr_label); 1844 obj = SLOT(mntlabel); 1845 | 1832 return (0); 1833 1834 subj = SLOT(cred->cr_label); 1835 obj = SLOT(mntlabel); 1836 |
1846 if (!mac_mls_dominate_effective(subj, obj)) | 1837 if (!mls_dominate_effective(subj, obj)) |
1847 return (EACCES); 1848 1849 return (0); 1850} 1851 1852static int | 1838 return (EACCES); 1839 1840 return (0); 1841} 1842 1843static int |
1853mac_mls_pipe_check_ioctl(struct ucred *cred, struct pipepair *pp, | 1844mls_pipe_check_ioctl(struct ucred *cred, struct pipepair *pp, |
1854 struct label *pplabel, unsigned long cmd, void /* caddr_t */ *data) 1855{ 1856 | 1845 struct label *pplabel, unsigned long cmd, void /* caddr_t */ *data) 1846{ 1847 |
1857 if(!mac_mls_enabled) | 1848 if (!mls_enabled) |
1858 return (0); 1859 1860 /* XXX: This will be implemented soon... */ 1861 1862 return (0); 1863} 1864 1865static int | 1849 return (0); 1850 1851 /* XXX: This will be implemented soon... */ 1852 1853 return (0); 1854} 1855 1856static int |
1866mac_mls_pipe_check_poll(struct ucred *cred, struct pipepair *pp, | 1857mls_pipe_check_poll(struct ucred *cred, struct pipepair *pp, |
1867 struct label *pplabel) 1868{ 1869 struct mac_mls *subj, *obj; 1870 | 1858 struct label *pplabel) 1859{ 1860 struct mac_mls *subj, *obj; 1861 |
1871 if (!mac_mls_enabled) | 1862 if (!mls_enabled) |
1872 return (0); 1873 1874 subj = SLOT(cred->cr_label); 1875 obj = SLOT(pplabel); 1876 | 1863 return (0); 1864 1865 subj = SLOT(cred->cr_label); 1866 obj = SLOT(pplabel); 1867 |
1877 if (!mac_mls_dominate_effective(subj, obj)) | 1868 if (!mls_dominate_effective(subj, obj)) |
1878 return (EACCES); 1879 1880 return (0); 1881} 1882 1883static int | 1869 return (EACCES); 1870 1871 return (0); 1872} 1873 1874static int |
1884mac_mls_pipe_check_read(struct ucred *cred, struct pipepair *pp, | 1875mls_pipe_check_read(struct ucred *cred, struct pipepair *pp, |
1885 struct label *pplabel) 1886{ 1887 struct mac_mls *subj, *obj; 1888 | 1876 struct label *pplabel) 1877{ 1878 struct mac_mls *subj, *obj; 1879 |
1889 if (!mac_mls_enabled) | 1880 if (!mls_enabled) |
1890 return (0); 1891 1892 subj = SLOT(cred->cr_label); 1893 obj = SLOT(pplabel); 1894 | 1881 return (0); 1882 1883 subj = SLOT(cred->cr_label); 1884 obj = SLOT(pplabel); 1885 |
1895 if (!mac_mls_dominate_effective(subj, obj)) | 1886 if (!mls_dominate_effective(subj, obj)) |
1896 return (EACCES); 1897 1898 return (0); 1899} 1900 1901static int | 1887 return (EACCES); 1888 1889 return (0); 1890} 1891 1892static int |
1902mac_mls_pipe_check_relabel(struct ucred *cred, struct pipepair *pp, | 1893mls_pipe_check_relabel(struct ucred *cred, struct pipepair *pp, |
1903 struct label *pplabel, struct label *newlabel) 1904{ 1905 struct mac_mls *subj, *obj, *new; 1906 int error; 1907 1908 new = SLOT(newlabel); 1909 subj = SLOT(cred->cr_label); 1910 obj = SLOT(pplabel); 1911 1912 /* | 1894 struct label *pplabel, struct label *newlabel) 1895{ 1896 struct mac_mls *subj, *obj, *new; 1897 int error; 1898 1899 new = SLOT(newlabel); 1900 subj = SLOT(cred->cr_label); 1901 obj = SLOT(pplabel); 1902 1903 /* |
1913 * If there is an MLS label update for a pipe, it must be a 1914 * effective update. | 1904 * If there is an MLS label update for a pipe, it must be a effective 1905 * update. |
1915 */ 1916 error = mls_atmostflags(new, MAC_MLS_FLAG_EFFECTIVE); 1917 if (error) 1918 return (error); 1919 1920 /* 1921 * To perform a relabel of a pipe (MLS label or not), MLS must 1922 * authorize the relabel. 1923 */ | 1906 */ 1907 error = mls_atmostflags(new, MAC_MLS_FLAG_EFFECTIVE); 1908 if (error) 1909 return (error); 1910 1911 /* 1912 * To perform a relabel of a pipe (MLS label or not), MLS must 1913 * authorize the relabel. 1914 */ |
1924 if (!mac_mls_effective_in_range(obj, subj)) | 1915 if (!mls_effective_in_range(obj, subj)) |
1925 return (EPERM); 1926 1927 /* 1928 * If the MLS label is to be changed, authorize as appropriate. 1929 */ 1930 if (new->mm_flags & MAC_MLS_FLAG_EFFECTIVE) { 1931 /* | 1916 return (EPERM); 1917 1918 /* 1919 * If the MLS label is to be changed, authorize as appropriate. 1920 */ 1921 if (new->mm_flags & MAC_MLS_FLAG_EFFECTIVE) { 1922 /* |
1932 * To change the MLS label on a pipe, the new pipe label 1933 * must be in the subject range. | 1923 * To change the MLS label on a pipe, the new pipe label must 1924 * be in the subject range. |
1934 */ | 1925 */ |
1935 if (!mac_mls_effective_in_range(new, subj)) | 1926 if (!mls_effective_in_range(new, subj)) |
1936 return (EPERM); 1937 1938 /* | 1927 return (EPERM); 1928 1929 /* |
1939 * To change the MLS label on a pipe to be EQUAL, the 1940 * subject must have appropriate privilege. | 1930 * To change the MLS label on a pipe to be EQUAL, the subject 1931 * must have appropriate privilege. |
1941 */ | 1932 */ |
1942 if (mac_mls_contains_equal(new)) { 1943 error = mac_mls_subject_privileged(subj); | 1933 if (mls_contains_equal(new)) { 1934 error = mls_subject_privileged(subj); |
1944 if (error) 1945 return (error); 1946 } 1947 } 1948 1949 return (0); 1950} 1951 1952static int | 1935 if (error) 1936 return (error); 1937 } 1938 } 1939 1940 return (0); 1941} 1942 1943static int |
1953mac_mls_pipe_check_stat(struct ucred *cred, struct pipepair *pp, | 1944mls_pipe_check_stat(struct ucred *cred, struct pipepair *pp, |
1954 struct label *pplabel) 1955{ 1956 struct mac_mls *subj, *obj; 1957 | 1945 struct label *pplabel) 1946{ 1947 struct mac_mls *subj, *obj; 1948 |
1958 if (!mac_mls_enabled) | 1949 if (!mls_enabled) |
1959 return (0); 1960 1961 subj = SLOT(cred->cr_label); 1962 obj = SLOT(pplabel); 1963 | 1950 return (0); 1951 1952 subj = SLOT(cred->cr_label); 1953 obj = SLOT(pplabel); 1954 |
1964 if (!mac_mls_dominate_effective(subj, obj)) | 1955 if (!mls_dominate_effective(subj, obj)) |
1965 return (EACCES); 1966 1967 return (0); 1968} 1969 1970static int | 1956 return (EACCES); 1957 1958 return (0); 1959} 1960 1961static int |
1971mac_mls_pipe_check_write(struct ucred *cred, struct pipepair *pp, | 1962mls_pipe_check_write(struct ucred *cred, struct pipepair *pp, |
1972 struct label *pplabel) 1973{ 1974 struct mac_mls *subj, *obj; 1975 | 1963 struct label *pplabel) 1964{ 1965 struct mac_mls *subj, *obj; 1966 |
1976 if (!mac_mls_enabled) | 1967 if (!mls_enabled) |
1977 return (0); 1978 1979 subj = SLOT(cred->cr_label); 1980 obj = SLOT(pplabel); 1981 | 1968 return (0); 1969 1970 subj = SLOT(cred->cr_label); 1971 obj = SLOT(pplabel); 1972 |
1982 if (!mac_mls_dominate_effective(obj, subj)) | 1973 if (!mls_dominate_effective(obj, subj)) |
1983 return (EACCES); 1984 1985 return (0); 1986} 1987 1988static int | 1974 return (EACCES); 1975 1976 return (0); 1977} 1978 1979static int |
1989mac_mls_posixsem_check_write(struct ucred *cred, struct ksem *ks, | 1980mls_posixsem_check_write(struct ucred *cred, struct ksem *ks, |
1990 struct label *kslabel) 1991{ 1992 struct mac_mls *subj, *obj; 1993 | 1981 struct label *kslabel) 1982{ 1983 struct mac_mls *subj, *obj; 1984 |
1994 if (!mac_mls_enabled) | 1985 if (!mls_enabled) |
1995 return (0); 1996 1997 subj = SLOT(cred->cr_label); 1998 obj = SLOT(kslabel); 1999 | 1986 return (0); 1987 1988 subj = SLOT(cred->cr_label); 1989 obj = SLOT(kslabel); 1990 |
2000 if (!mac_mls_dominate_effective(obj, subj)) | 1991 if (!mls_dominate_effective(obj, subj)) |
2001 return (EACCES); 2002 2003 return (0); 2004} 2005 2006static int | 1992 return (EACCES); 1993 1994 return (0); 1995} 1996 1997static int |
2007mac_mls_posixsem_check_rdonly(struct ucred *cred, struct ksem *ks, | 1998mls_posixsem_check_rdonly(struct ucred *cred, struct ksem *ks, |
2008 struct label *kslabel) 2009{ 2010 struct mac_mls *subj, *obj; 2011 | 1999 struct label *kslabel) 2000{ 2001 struct mac_mls *subj, *obj; 2002 |
2012 if (!mac_mls_enabled) | 2003 if (!mls_enabled) |
2013 return (0); 2014 2015 subj = SLOT(cred->cr_label); 2016 obj = SLOT(kslabel); 2017 | 2004 return (0); 2005 2006 subj = SLOT(cred->cr_label); 2007 obj = SLOT(kslabel); 2008 |
2018 if (!mac_mls_dominate_effective(subj, obj)) | 2009 if (!mls_dominate_effective(subj, obj)) |
2019 return (EACCES); 2020 2021 return (0); 2022} 2023 2024static int | 2010 return (EACCES); 2011 2012 return (0); 2013} 2014 2015static int |
2025mac_mls_proc_check_debug(struct ucred *cred, struct proc *p) | 2016mls_proc_check_debug(struct ucred *cred, struct proc *p) |
2026{ 2027 struct mac_mls *subj, *obj; 2028 | 2017{ 2018 struct mac_mls *subj, *obj; 2019 |
2029 if (!mac_mls_enabled) | 2020 if (!mls_enabled) |
2030 return (0); 2031 2032 subj = SLOT(cred->cr_label); 2033 obj = SLOT(p->p_ucred->cr_label); 2034 2035 /* XXX: range checks */ | 2021 return (0); 2022 2023 subj = SLOT(cred->cr_label); 2024 obj = SLOT(p->p_ucred->cr_label); 2025 2026 /* XXX: range checks */ |
2036 if (!mac_mls_dominate_effective(subj, obj)) | 2027 if (!mls_dominate_effective(subj, obj)) |
2037 return (ESRCH); | 2028 return (ESRCH); |
2038 if (!mac_mls_dominate_effective(obj, subj)) | 2029 if (!mls_dominate_effective(obj, subj)) |
2039 return (EACCES); 2040 2041 return (0); 2042} 2043 2044static int | 2030 return (EACCES); 2031 2032 return (0); 2033} 2034 2035static int |
2045mac_mls_proc_check_sched(struct ucred *cred, struct proc *p) | 2036mls_proc_check_sched(struct ucred *cred, struct proc *p) |
2046{ 2047 struct mac_mls *subj, *obj; 2048 | 2037{ 2038 struct mac_mls *subj, *obj; 2039 |
2049 if (!mac_mls_enabled) | 2040 if (!mls_enabled) |
2050 return (0); 2051 2052 subj = SLOT(cred->cr_label); 2053 obj = SLOT(p->p_ucred->cr_label); 2054 2055 /* XXX: range checks */ | 2041 return (0); 2042 2043 subj = SLOT(cred->cr_label); 2044 obj = SLOT(p->p_ucred->cr_label); 2045 2046 /* XXX: range checks */ |
2056 if (!mac_mls_dominate_effective(subj, obj)) | 2047 if (!mls_dominate_effective(subj, obj)) |
2057 return (ESRCH); | 2048 return (ESRCH); |
2058 if (!mac_mls_dominate_effective(obj, subj)) | 2049 if (!mls_dominate_effective(obj, subj)) |
2059 return (EACCES); 2060 2061 return (0); 2062} 2063 2064static int | 2050 return (EACCES); 2051 2052 return (0); 2053} 2054 2055static int |
2065mac_mls_proc_check_signal(struct ucred *cred, struct proc *p, int signum) | 2056mls_proc_check_signal(struct ucred *cred, struct proc *p, int signum) |
2066{ 2067 struct mac_mls *subj, *obj; 2068 | 2057{ 2058 struct mac_mls *subj, *obj; 2059 |
2069 if (!mac_mls_enabled) | 2060 if (!mls_enabled) |
2070 return (0); 2071 2072 subj = SLOT(cred->cr_label); 2073 obj = SLOT(p->p_ucred->cr_label); 2074 2075 /* XXX: range checks */ | 2061 return (0); 2062 2063 subj = SLOT(cred->cr_label); 2064 obj = SLOT(p->p_ucred->cr_label); 2065 2066 /* XXX: range checks */ |
2076 if (!mac_mls_dominate_effective(subj, obj)) | 2067 if (!mls_dominate_effective(subj, obj)) |
2077 return (ESRCH); | 2068 return (ESRCH); |
2078 if (!mac_mls_dominate_effective(obj, subj)) | 2069 if (!mls_dominate_effective(obj, subj)) |
2079 return (EACCES); 2080 2081 return (0); 2082} 2083 2084static int | 2070 return (EACCES); 2071 2072 return (0); 2073} 2074 2075static int |
2085mac_mls_socket_check_deliver(struct socket *so, struct label *solabel, | 2076mls_socket_check_deliver(struct socket *so, struct label *solabel, |
2086 struct mbuf *m, struct label *mlabel) 2087{ 2088 struct mac_mls *p, *s; 2089 | 2077 struct mbuf *m, struct label *mlabel) 2078{ 2079 struct mac_mls *p, *s; 2080 |
2090 if (!mac_mls_enabled) | 2081 if (!mls_enabled) |
2091 return (0); 2092 2093 p = SLOT(mlabel); 2094 s = SLOT(solabel); 2095 | 2082 return (0); 2083 2084 p = SLOT(mlabel); 2085 s = SLOT(solabel); 2086 |
2096 return (mac_mls_equal_effective(p, s) ? 0 : EACCES); | 2087 return (mls_equal_effective(p, s) ? 0 : EACCES); |
2097} 2098 2099static int | 2088} 2089 2090static int |
2100mac_mls_socket_check_relabel(struct ucred *cred, struct socket *so, | 2091mls_socket_check_relabel(struct ucred *cred, struct socket *so, |
2101 struct label *solabel, struct label *newlabel) 2102{ 2103 struct mac_mls *subj, *obj, *new; 2104 int error; 2105 2106 new = SLOT(newlabel); 2107 subj = SLOT(cred->cr_label); 2108 obj = SLOT(solabel); 2109 2110 /* | 2092 struct label *solabel, struct label *newlabel) 2093{ 2094 struct mac_mls *subj, *obj, *new; 2095 int error; 2096 2097 new = SLOT(newlabel); 2098 subj = SLOT(cred->cr_label); 2099 obj = SLOT(solabel); 2100 2101 /* |
2111 * If there is an MLS label update for the socket, it may be 2112 * an update of effective. | 2102 * If there is an MLS label update for the socket, it may be an 2103 * update of effective. |
2113 */ 2114 error = mls_atmostflags(new, MAC_MLS_FLAG_EFFECTIVE); 2115 if (error) 2116 return (error); 2117 2118 /* | 2104 */ 2105 error = mls_atmostflags(new, MAC_MLS_FLAG_EFFECTIVE); 2106 if (error) 2107 return (error); 2108 2109 /* |
2119 * To relabel a socket, the old socket effective must be in the subject 2120 * range. | 2110 * To relabel a socket, the old socket effective must be in the 2111 * subject range. |
2121 */ | 2112 */ |
2122 if (!mac_mls_effective_in_range(obj, subj)) | 2113 if (!mls_effective_in_range(obj, subj)) |
2123 return (EPERM); 2124 2125 /* 2126 * If the MLS label is to be changed, authorize as appropriate. 2127 */ 2128 if (new->mm_flags & MAC_MLS_FLAG_EFFECTIVE) { 2129 /* 2130 * To relabel a socket, the new socket effective must be in 2131 * the subject range. 2132 */ | 2114 return (EPERM); 2115 2116 /* 2117 * If the MLS label is to be changed, authorize as appropriate. 2118 */ 2119 if (new->mm_flags & MAC_MLS_FLAG_EFFECTIVE) { 2120 /* 2121 * To relabel a socket, the new socket effective must be in 2122 * the subject range. 2123 */ |
2133 if (!mac_mls_effective_in_range(new, subj)) | 2124 if (!mls_effective_in_range(new, subj)) |
2134 return (EPERM); 2135 2136 /* 2137 * To change the MLS label on the socket to contain EQUAL, 2138 * the subject must have appropriate privilege. 2139 */ | 2125 return (EPERM); 2126 2127 /* 2128 * To change the MLS label on the socket to contain EQUAL, 2129 * the subject must have appropriate privilege. 2130 */ |
2140 if (mac_mls_contains_equal(new)) { 2141 error = mac_mls_subject_privileged(subj); | 2131 if (mls_contains_equal(new)) { 2132 error = mls_subject_privileged(subj); |
2142 if (error) 2143 return (error); 2144 } 2145 } 2146 2147 return (0); 2148} 2149 2150static int | 2133 if (error) 2134 return (error); 2135 } 2136 } 2137 2138 return (0); 2139} 2140 2141static int |
2151mac_mls_socket_check_visible(struct ucred *cred, struct socket *so, | 2142mls_socket_check_visible(struct ucred *cred, struct socket *so, |
2152 struct label *solabel) 2153{ 2154 struct mac_mls *subj, *obj; 2155 | 2143 struct label *solabel) 2144{ 2145 struct mac_mls *subj, *obj; 2146 |
2156 if (!mac_mls_enabled) | 2147 if (!mls_enabled) |
2157 return (0); 2158 2159 subj = SLOT(cred->cr_label); 2160 obj = SLOT(solabel); 2161 | 2148 return (0); 2149 2150 subj = SLOT(cred->cr_label); 2151 obj = SLOT(solabel); 2152 |
2162 if (!mac_mls_dominate_effective(subj, obj)) | 2153 if (!mls_dominate_effective(subj, obj)) |
2163 return (ENOENT); 2164 2165 return (0); 2166} 2167 2168static int | 2154 return (ENOENT); 2155 2156 return (0); 2157} 2158 2159static int |
2169mac_mls_system_check_acct(struct ucred *cred, struct vnode *vp, | 2160mls_system_check_acct(struct ucred *cred, struct vnode *vp, |
2170 struct label *vplabel) 2171{ 2172 struct mac_mls *subj, *obj; 2173 | 2161 struct label *vplabel) 2162{ 2163 struct mac_mls *subj, *obj; 2164 |
2174 if (!mac_mls_enabled) | 2165 if (!mls_enabled) |
2175 return (0); 2176 2177 subj = SLOT(cred->cr_label); 2178 obj = SLOT(vplabel); 2179 | 2166 return (0); 2167 2168 subj = SLOT(cred->cr_label); 2169 obj = SLOT(vplabel); 2170 |
2180 if (!mac_mls_dominate_effective(obj, subj) || 2181 !mac_mls_dominate_effective(subj, obj)) | 2171 if (!mls_dominate_effective(obj, subj) || 2172 !mls_dominate_effective(subj, obj)) |
2182 return (EACCES); 2183 2184 return (0); 2185} 2186 2187static int | 2173 return (EACCES); 2174 2175 return (0); 2176} 2177 2178static int |
2188mac_mls_system_check_auditctl(struct ucred *cred, struct vnode *vp, | 2179mls_system_check_auditctl(struct ucred *cred, struct vnode *vp, |
2189 struct label *vplabel) 2190{ 2191 struct mac_mls *subj, *obj; 2192 | 2180 struct label *vplabel) 2181{ 2182 struct mac_mls *subj, *obj; 2183 |
2193 if (!mac_mls_enabled) | 2184 if (!mls_enabled) |
2194 return (0); 2195 2196 subj = SLOT(cred->cr_label); 2197 obj = SLOT(vplabel); 2198 | 2185 return (0); 2186 2187 subj = SLOT(cred->cr_label); 2188 obj = SLOT(vplabel); 2189 |
2199 if (!mac_mls_dominate_effective(obj, subj) || 2200 !mac_mls_dominate_effective(subj, obj)) | 2190 if (!mls_dominate_effective(obj, subj) || 2191 !mls_dominate_effective(subj, obj)) |
2201 return (EACCES); 2202 2203 return (0); 2204} 2205 2206static int | 2192 return (EACCES); 2193 2194 return (0); 2195} 2196 2197static int |
2207mac_mls_system_check_swapon(struct ucred *cred, struct vnode *vp, | 2198mls_system_check_swapon(struct ucred *cred, struct vnode *vp, |
2208 struct label *vplabel) 2209{ 2210 struct mac_mls *subj, *obj; 2211 | 2199 struct label *vplabel) 2200{ 2201 struct mac_mls *subj, *obj; 2202 |
2212 if (!mac_mls_enabled) | 2203 if (!mls_enabled) |
2213 return (0); 2214 2215 subj = SLOT(cred->cr_label); 2216 obj = SLOT(vplabel); 2217 | 2204 return (0); 2205 2206 subj = SLOT(cred->cr_label); 2207 obj = SLOT(vplabel); 2208 |
2218 if (!mac_mls_dominate_effective(obj, subj) || 2219 !mac_mls_dominate_effective(subj, obj)) | 2209 if (!mls_dominate_effective(obj, subj) || 2210 !mls_dominate_effective(subj, obj)) |
2220 return (EACCES); 2221 2222 return (0); 2223} 2224 2225static int | 2211 return (EACCES); 2212 2213 return (0); 2214} 2215 2216static int |
2226mac_mls_vnode_check_chdir(struct ucred *cred, struct vnode *dvp, | 2217mls_vnode_check_chdir(struct ucred *cred, struct vnode *dvp, |
2227 struct label *dvplabel) 2228{ 2229 struct mac_mls *subj, *obj; 2230 | 2218 struct label *dvplabel) 2219{ 2220 struct mac_mls *subj, *obj; 2221 |
2231 if (!mac_mls_enabled) | 2222 if (!mls_enabled) |
2232 return (0); 2233 2234 subj = SLOT(cred->cr_label); 2235 obj = SLOT(dvplabel); 2236 | 2223 return (0); 2224 2225 subj = SLOT(cred->cr_label); 2226 obj = SLOT(dvplabel); 2227 |
2237 if (!mac_mls_dominate_effective(subj, obj)) | 2228 if (!mls_dominate_effective(subj, obj)) |
2238 return (EACCES); 2239 2240 return (0); 2241} 2242 2243static int | 2229 return (EACCES); 2230 2231 return (0); 2232} 2233 2234static int |
2244mac_mls_vnode_check_chroot(struct ucred *cred, struct vnode *dvp, | 2235mls_vnode_check_chroot(struct ucred *cred, struct vnode *dvp, |
2245 struct label *dvplabel) 2246{ 2247 struct mac_mls *subj, *obj; 2248 | 2236 struct label *dvplabel) 2237{ 2238 struct mac_mls *subj, *obj; 2239 |
2249 if (!mac_mls_enabled) | 2240 if (!mls_enabled) |
2250 return (0); 2251 2252 subj = SLOT(cred->cr_label); 2253 obj = SLOT(dvplabel); 2254 | 2241 return (0); 2242 2243 subj = SLOT(cred->cr_label); 2244 obj = SLOT(dvplabel); 2245 |
2255 if (!mac_mls_dominate_effective(subj, obj)) | 2246 if (!mls_dominate_effective(subj, obj)) |
2256 return (EACCES); 2257 2258 return (0); 2259} 2260 2261static int | 2247 return (EACCES); 2248 2249 return (0); 2250} 2251 2252static int |
2262mac_mls_vnode_check_create(struct ucred *cred, struct vnode *dvp, | 2253mls_vnode_check_create(struct ucred *cred, struct vnode *dvp, |
2263 struct label *dvplabel, struct componentname *cnp, struct vattr *vap) 2264{ 2265 struct mac_mls *subj, *obj; 2266 | 2254 struct label *dvplabel, struct componentname *cnp, struct vattr *vap) 2255{ 2256 struct mac_mls *subj, *obj; 2257 |
2267 if (!mac_mls_enabled) | 2258 if (!mls_enabled) |
2268 return (0); 2269 2270 subj = SLOT(cred->cr_label); 2271 obj = SLOT(dvplabel); 2272 | 2259 return (0); 2260 2261 subj = SLOT(cred->cr_label); 2262 obj = SLOT(dvplabel); 2263 |
2273 if (!mac_mls_dominate_effective(obj, subj)) | 2264 if (!mls_dominate_effective(obj, subj)) |
2274 return (EACCES); 2275 2276 return (0); 2277} 2278 2279static int | 2265 return (EACCES); 2266 2267 return (0); 2268} 2269 2270static int |
2280mac_mls_vnode_check_deleteacl(struct ucred *cred, struct vnode *vp, | 2271mls_vnode_check_deleteacl(struct ucred *cred, struct vnode *vp, |
2281 struct label *vplabel, acl_type_t type) 2282{ 2283 struct mac_mls *subj, *obj; 2284 | 2272 struct label *vplabel, acl_type_t type) 2273{ 2274 struct mac_mls *subj, *obj; 2275 |
2285 if (!mac_mls_enabled) | 2276 if (!mls_enabled) |
2286 return (0); 2287 2288 subj = SLOT(cred->cr_label); 2289 obj = SLOT(vplabel); 2290 | 2277 return (0); 2278 2279 subj = SLOT(cred->cr_label); 2280 obj = SLOT(vplabel); 2281 |
2291 if (!mac_mls_dominate_effective(obj, subj)) | 2282 if (!mls_dominate_effective(obj, subj)) |
2292 return (EACCES); 2293 2294 return (0); 2295} 2296 2297static int | 2283 return (EACCES); 2284 2285 return (0); 2286} 2287 2288static int |
2298mac_mls_vnode_check_deleteextattr(struct ucred *cred, struct vnode *vp, | 2289mls_vnode_check_deleteextattr(struct ucred *cred, struct vnode *vp, |
2299 struct label *vplabel, int attrnamespace, const char *name) 2300{ 2301 struct mac_mls *subj, *obj; 2302 | 2290 struct label *vplabel, int attrnamespace, const char *name) 2291{ 2292 struct mac_mls *subj, *obj; 2293 |
2303 if (!mac_mls_enabled) | 2294 if (!mls_enabled) |
2304 return (0); 2305 2306 subj = SLOT(cred->cr_label); 2307 obj = SLOT(vplabel); 2308 | 2295 return (0); 2296 2297 subj = SLOT(cred->cr_label); 2298 obj = SLOT(vplabel); 2299 |
2309 if (!mac_mls_dominate_effective(obj, subj)) | 2300 if (!mls_dominate_effective(obj, subj)) |
2310 return (EACCES); 2311 2312 return (0); 2313} 2314 2315static int | 2301 return (EACCES); 2302 2303 return (0); 2304} 2305 2306static int |
2316mac_mls_vnode_check_exec(struct ucred *cred, struct vnode *vp, | 2307mls_vnode_check_exec(struct ucred *cred, struct vnode *vp, |
2317 struct label *vplabel, struct image_params *imgp, 2318 struct label *execlabel) 2319{ 2320 struct mac_mls *subj, *obj, *exec; 2321 int error; 2322 2323 if (execlabel != NULL) { 2324 /* 2325 * We currently don't permit labels to be changed at | 2308 struct label *vplabel, struct image_params *imgp, 2309 struct label *execlabel) 2310{ 2311 struct mac_mls *subj, *obj, *exec; 2312 int error; 2313 2314 if (execlabel != NULL) { 2315 /* 2316 * We currently don't permit labels to be changed at |
2326 * exec-time as part of MLS, so disallow non-NULL 2327 * MLS label elements in the execlabel. | 2317 * exec-time as part of MLS, so disallow non-NULL MLS label 2318 * elements in the execlabel. |
2328 */ 2329 exec = SLOT(execlabel); 2330 error = mls_atmostflags(exec, 0); 2331 if (error) 2332 return (error); 2333 } 2334 | 2319 */ 2320 exec = SLOT(execlabel); 2321 error = mls_atmostflags(exec, 0); 2322 if (error) 2323 return (error); 2324 } 2325 |
2335 if (!mac_mls_enabled) | 2326 if (!mls_enabled) |
2336 return (0); 2337 2338 subj = SLOT(cred->cr_label); 2339 obj = SLOT(vplabel); 2340 | 2327 return (0); 2328 2329 subj = SLOT(cred->cr_label); 2330 obj = SLOT(vplabel); 2331 |
2341 if (!mac_mls_dominate_effective(subj, obj)) | 2332 if (!mls_dominate_effective(subj, obj)) |
2342 return (EACCES); 2343 2344 return (0); 2345} 2346 2347static int | 2333 return (EACCES); 2334 2335 return (0); 2336} 2337 2338static int |
2348mac_mls_vnode_check_getacl(struct ucred *cred, struct vnode *vp, | 2339mls_vnode_check_getacl(struct ucred *cred, struct vnode *vp, |
2349 struct label *vplabel, acl_type_t type) 2350{ 2351 struct mac_mls *subj, *obj; 2352 | 2340 struct label *vplabel, acl_type_t type) 2341{ 2342 struct mac_mls *subj, *obj; 2343 |
2353 if (!mac_mls_enabled) | 2344 if (!mls_enabled) |
2354 return (0); 2355 2356 subj = SLOT(cred->cr_label); 2357 obj = SLOT(vplabel); 2358 | 2345 return (0); 2346 2347 subj = SLOT(cred->cr_label); 2348 obj = SLOT(vplabel); 2349 |
2359 if (!mac_mls_dominate_effective(subj, obj)) | 2350 if (!mls_dominate_effective(subj, obj)) |
2360 return (EACCES); 2361 2362 return (0); 2363} 2364 2365static int | 2351 return (EACCES); 2352 2353 return (0); 2354} 2355 2356static int |
2366mac_mls_vnode_check_getextattr(struct ucred *cred, struct vnode *vp, | 2357mls_vnode_check_getextattr(struct ucred *cred, struct vnode *vp, |
2367 struct label *vplabel, int attrnamespace, const char *name, 2368 struct uio *uio) 2369{ 2370 struct mac_mls *subj, *obj; 2371 | 2358 struct label *vplabel, int attrnamespace, const char *name, 2359 struct uio *uio) 2360{ 2361 struct mac_mls *subj, *obj; 2362 |
2372 if (!mac_mls_enabled) | 2363 if (!mls_enabled) |
2373 return (0); 2374 2375 subj = SLOT(cred->cr_label); 2376 obj = SLOT(vplabel); 2377 | 2364 return (0); 2365 2366 subj = SLOT(cred->cr_label); 2367 obj = SLOT(vplabel); 2368 |
2378 if (!mac_mls_dominate_effective(subj, obj)) | 2369 if (!mls_dominate_effective(subj, obj)) |
2379 return (EACCES); 2380 2381 return (0); 2382} 2383 2384static int | 2370 return (EACCES); 2371 2372 return (0); 2373} 2374 2375static int |
2385mac_mls_vnode_check_link(struct ucred *cred, struct vnode *dvp, | 2376mls_vnode_check_link(struct ucred *cred, struct vnode *dvp, |
2386 struct label *dvplabel, struct vnode *vp, struct label *vplabel, 2387 struct componentname *cnp) 2388{ 2389 struct mac_mls *subj, *obj; 2390 | 2377 struct label *dvplabel, struct vnode *vp, struct label *vplabel, 2378 struct componentname *cnp) 2379{ 2380 struct mac_mls *subj, *obj; 2381 |
2391 if (!mac_mls_enabled) | 2382 if (!mls_enabled) |
2392 return (0); 2393 2394 subj = SLOT(cred->cr_label); 2395 obj = SLOT(dvplabel); 2396 | 2383 return (0); 2384 2385 subj = SLOT(cred->cr_label); 2386 obj = SLOT(dvplabel); 2387 |
2397 if (!mac_mls_dominate_effective(obj, subj)) | 2388 if (!mls_dominate_effective(obj, subj)) |
2398 return (EACCES); 2399 2400 obj = SLOT(vplabel); | 2389 return (EACCES); 2390 2391 obj = SLOT(vplabel); |
2401 if (!mac_mls_dominate_effective(obj, subj)) | 2392 if (!mls_dominate_effective(obj, subj)) |
2402 return (EACCES); 2403 2404 return (0); 2405} 2406 2407static int | 2393 return (EACCES); 2394 2395 return (0); 2396} 2397 2398static int |
2408mac_mls_vnode_check_listextattr(struct ucred *cred, struct vnode *vp, | 2399mls_vnode_check_listextattr(struct ucred *cred, struct vnode *vp, |
2409 struct label *vplabel, int attrnamespace) 2410{ 2411 2412 struct mac_mls *subj, *obj; 2413 | 2400 struct label *vplabel, int attrnamespace) 2401{ 2402 2403 struct mac_mls *subj, *obj; 2404 |
2414 if (!mac_mls_enabled) | 2405 if (!mls_enabled) |
2415 return (0); 2416 2417 subj = SLOT(cred->cr_label); 2418 obj = SLOT(vplabel); 2419 | 2406 return (0); 2407 2408 subj = SLOT(cred->cr_label); 2409 obj = SLOT(vplabel); 2410 |
2420 if (!mac_mls_dominate_effective(subj, obj)) | 2411 if (!mls_dominate_effective(subj, obj)) |
2421 return (EACCES); 2422 2423 return (0); 2424} 2425 2426static int | 2412 return (EACCES); 2413 2414 return (0); 2415} 2416 2417static int |
2427mac_mls_vnode_check_lookup(struct ucred *cred, struct vnode *dvp, | 2418mls_vnode_check_lookup(struct ucred *cred, struct vnode *dvp, |
2428 struct label *dvplabel, struct componentname *cnp) 2429{ 2430 struct mac_mls *subj, *obj; 2431 | 2419 struct label *dvplabel, struct componentname *cnp) 2420{ 2421 struct mac_mls *subj, *obj; 2422 |
2432 if (!mac_mls_enabled) | 2423 if (!mls_enabled) |
2433 return (0); 2434 2435 subj = SLOT(cred->cr_label); 2436 obj = SLOT(dvplabel); 2437 | 2424 return (0); 2425 2426 subj = SLOT(cred->cr_label); 2427 obj = SLOT(dvplabel); 2428 |
2438 if (!mac_mls_dominate_effective(subj, obj)) | 2429 if (!mls_dominate_effective(subj, obj)) |
2439 return (EACCES); 2440 2441 return (0); 2442} 2443 2444static int | 2430 return (EACCES); 2431 2432 return (0); 2433} 2434 2435static int |
2445mac_mls_vnode_check_mmap(struct ucred *cred, struct vnode *vp, | 2436mls_vnode_check_mmap(struct ucred *cred, struct vnode *vp, |
2446 struct label *vplabel, int prot, int flags) 2447{ 2448 struct mac_mls *subj, *obj; 2449 2450 /* 2451 * Rely on the use of open()-time protections to handle 2452 * non-revocation cases. 2453 */ | 2437 struct label *vplabel, int prot, int flags) 2438{ 2439 struct mac_mls *subj, *obj; 2440 2441 /* 2442 * Rely on the use of open()-time protections to handle 2443 * non-revocation cases. 2444 */ |
2454 if (!mac_mls_enabled || !revocation_enabled) | 2445 if (!mls_enabled || !revocation_enabled) |
2455 return (0); 2456 2457 subj = SLOT(cred->cr_label); 2458 obj = SLOT(vplabel); 2459 2460 if (prot & (VM_PROT_READ | VM_PROT_EXECUTE)) { | 2446 return (0); 2447 2448 subj = SLOT(cred->cr_label); 2449 obj = SLOT(vplabel); 2450 2451 if (prot & (VM_PROT_READ | VM_PROT_EXECUTE)) { |
2461 if (!mac_mls_dominate_effective(subj, obj)) | 2452 if (!mls_dominate_effective(subj, obj)) |
2462 return (EACCES); 2463 } 2464 if (((prot & VM_PROT_WRITE) != 0) && ((flags & MAP_SHARED) != 0)) { | 2453 return (EACCES); 2454 } 2455 if (((prot & VM_PROT_WRITE) != 0) && ((flags & MAP_SHARED) != 0)) { |
2465 if (!mac_mls_dominate_effective(obj, subj)) | 2456 if (!mls_dominate_effective(obj, subj)) |
2466 return (EACCES); 2467 } 2468 2469 return (0); 2470} 2471 2472static int | 2457 return (EACCES); 2458 } 2459 2460 return (0); 2461} 2462 2463static int |
2473mac_mls_vnode_check_open(struct ucred *cred, struct vnode *vp, | 2464mls_vnode_check_open(struct ucred *cred, struct vnode *vp, |
2474 struct label *vplabel, int acc_mode) 2475{ 2476 struct mac_mls *subj, *obj; 2477 | 2465 struct label *vplabel, int acc_mode) 2466{ 2467 struct mac_mls *subj, *obj; 2468 |
2478 if (!mac_mls_enabled) | 2469 if (!mls_enabled) |
2479 return (0); 2480 2481 subj = SLOT(cred->cr_label); 2482 obj = SLOT(vplabel); 2483 2484 /* XXX privilege override for admin? */ 2485 if (acc_mode & (VREAD | VEXEC | VSTAT)) { | 2470 return (0); 2471 2472 subj = SLOT(cred->cr_label); 2473 obj = SLOT(vplabel); 2474 2475 /* XXX privilege override for admin? */ 2476 if (acc_mode & (VREAD | VEXEC | VSTAT)) { |
2486 if (!mac_mls_dominate_effective(subj, obj)) | 2477 if (!mls_dominate_effective(subj, obj)) |
2487 return (EACCES); 2488 } 2489 if (acc_mode & (VWRITE | VAPPEND | VADMIN)) { | 2478 return (EACCES); 2479 } 2480 if (acc_mode & (VWRITE | VAPPEND | VADMIN)) { |
2490 if (!mac_mls_dominate_effective(obj, subj)) | 2481 if (!mls_dominate_effective(obj, subj)) |
2491 return (EACCES); 2492 } 2493 2494 return (0); 2495} 2496 2497static int | 2482 return (EACCES); 2483 } 2484 2485 return (0); 2486} 2487 2488static int |
2498mac_mls_vnode_check_poll(struct ucred *active_cred, struct ucred *file_cred, | 2489mls_vnode_check_poll(struct ucred *active_cred, struct ucred *file_cred, |
2499 struct vnode *vp, struct label *vplabel) 2500{ 2501 struct mac_mls *subj, *obj; 2502 | 2490 struct vnode *vp, struct label *vplabel) 2491{ 2492 struct mac_mls *subj, *obj; 2493 |
2503 if (!mac_mls_enabled || !revocation_enabled) | 2494 if (!mls_enabled || !revocation_enabled) |
2504 return (0); 2505 2506 subj = SLOT(active_cred->cr_label); 2507 obj = SLOT(vplabel); 2508 | 2495 return (0); 2496 2497 subj = SLOT(active_cred->cr_label); 2498 obj = SLOT(vplabel); 2499 |
2509 if (!mac_mls_dominate_effective(subj, obj)) | 2500 if (!mls_dominate_effective(subj, obj)) |
2510 return (EACCES); 2511 2512 return (0); 2513} 2514 2515static int | 2501 return (EACCES); 2502 2503 return (0); 2504} 2505 2506static int |
2516mac_mls_vnode_check_read(struct ucred *active_cred, struct ucred *file_cred, | 2507mls_vnode_check_read(struct ucred *active_cred, struct ucred *file_cred, |
2517 struct vnode *vp, struct label *vplabel) 2518{ 2519 struct mac_mls *subj, *obj; 2520 | 2508 struct vnode *vp, struct label *vplabel) 2509{ 2510 struct mac_mls *subj, *obj; 2511 |
2521 if (!mac_mls_enabled || !revocation_enabled) | 2512 if (!mls_enabled || !revocation_enabled) |
2522 return (0); 2523 2524 subj = SLOT(active_cred->cr_label); 2525 obj = SLOT(vplabel); 2526 | 2513 return (0); 2514 2515 subj = SLOT(active_cred->cr_label); 2516 obj = SLOT(vplabel); 2517 |
2527 if (!mac_mls_dominate_effective(subj, obj)) | 2518 if (!mls_dominate_effective(subj, obj)) |
2528 return (EACCES); 2529 2530 return (0); 2531} 2532 2533static int | 2519 return (EACCES); 2520 2521 return (0); 2522} 2523 2524static int |
2534mac_mls_vnode_check_readdir(struct ucred *cred, struct vnode *dvp, | 2525mls_vnode_check_readdir(struct ucred *cred, struct vnode *dvp, |
2535 struct label *dvplabel) 2536{ 2537 struct mac_mls *subj, *obj; 2538 | 2526 struct label *dvplabel) 2527{ 2528 struct mac_mls *subj, *obj; 2529 |
2539 if (!mac_mls_enabled) | 2530 if (!mls_enabled) |
2540 return (0); 2541 2542 subj = SLOT(cred->cr_label); 2543 obj = SLOT(dvplabel); 2544 | 2531 return (0); 2532 2533 subj = SLOT(cred->cr_label); 2534 obj = SLOT(dvplabel); 2535 |
2545 if (!mac_mls_dominate_effective(subj, obj)) | 2536 if (!mls_dominate_effective(subj, obj)) |
2546 return (EACCES); 2547 2548 return (0); 2549} 2550 2551static int | 2537 return (EACCES); 2538 2539 return (0); 2540} 2541 2542static int |
2552mac_mls_vnode_check_readlink(struct ucred *cred, struct vnode *vp, | 2543mls_vnode_check_readlink(struct ucred *cred, struct vnode *vp, |
2553 struct label *vplabel) 2554{ 2555 struct mac_mls *subj, *obj; 2556 | 2544 struct label *vplabel) 2545{ 2546 struct mac_mls *subj, *obj; 2547 |
2557 if (!mac_mls_enabled) | 2548 if (!mls_enabled) |
2558 return (0); 2559 2560 subj = SLOT(cred->cr_label); 2561 obj = SLOT(vplabel); 2562 | 2549 return (0); 2550 2551 subj = SLOT(cred->cr_label); 2552 obj = SLOT(vplabel); 2553 |
2563 if (!mac_mls_dominate_effective(subj, obj)) | 2554 if (!mls_dominate_effective(subj, obj)) |
2564 return (EACCES); 2565 2566 return (0); 2567} 2568 2569static int | 2555 return (EACCES); 2556 2557 return (0); 2558} 2559 2560static int |
2570mac_mls_vnode_check_relabel(struct ucred *cred, struct vnode *vp, | 2561mls_vnode_check_relabel(struct ucred *cred, struct vnode *vp, |
2571 struct label *vplabel, struct label *newlabel) 2572{ 2573 struct mac_mls *old, *new, *subj; 2574 int error; 2575 2576 old = SLOT(vplabel); 2577 new = SLOT(newlabel); 2578 subj = SLOT(cred->cr_label); --- 5 unchanged lines hidden (view full) --- 2584 error = mls_atmostflags(new, MAC_MLS_FLAG_EFFECTIVE); 2585 if (error) 2586 return (error); 2587 2588 /* 2589 * To perform a relabel of the vnode (MLS label or not), MLS must 2590 * authorize the relabel. 2591 */ | 2562 struct label *vplabel, struct label *newlabel) 2563{ 2564 struct mac_mls *old, *new, *subj; 2565 int error; 2566 2567 old = SLOT(vplabel); 2568 new = SLOT(newlabel); 2569 subj = SLOT(cred->cr_label); --- 5 unchanged lines hidden (view full) --- 2575 error = mls_atmostflags(new, MAC_MLS_FLAG_EFFECTIVE); 2576 if (error) 2577 return (error); 2578 2579 /* 2580 * To perform a relabel of the vnode (MLS label or not), MLS must 2581 * authorize the relabel. 2582 */ |
2592 if (!mac_mls_effective_in_range(old, subj)) | 2583 if (!mls_effective_in_range(old, subj)) |
2593 return (EPERM); 2594 2595 /* 2596 * If the MLS label is to be changed, authorize as appropriate. 2597 */ 2598 if (new->mm_flags & MAC_MLS_FLAG_EFFECTIVE) { 2599 /* 2600 * To change the MLS label on a vnode, the new vnode label 2601 * must be in the subject range. 2602 */ | 2584 return (EPERM); 2585 2586 /* 2587 * If the MLS label is to be changed, authorize as appropriate. 2588 */ 2589 if (new->mm_flags & MAC_MLS_FLAG_EFFECTIVE) { 2590 /* 2591 * To change the MLS label on a vnode, the new vnode label 2592 * must be in the subject range. 2593 */ |
2603 if (!mac_mls_effective_in_range(new, subj)) | 2594 if (!mls_effective_in_range(new, subj)) |
2604 return (EPERM); 2605 2606 /* | 2595 return (EPERM); 2596 2597 /* |
2607 * To change the MLS label on the vnode to be EQUAL, 2608 * the subject must have appropriate privilege. | 2598 * To change the MLS label on the vnode to be EQUAL, the 2599 * subject must have appropriate privilege. |
2609 */ | 2600 */ |
2610 if (mac_mls_contains_equal(new)) { 2611 error = mac_mls_subject_privileged(subj); | 2601 if (mls_contains_equal(new)) { 2602 error = mls_subject_privileged(subj); |
2612 if (error) 2613 return (error); 2614 } 2615 } 2616 2617 return (0); 2618} 2619 2620static int | 2603 if (error) 2604 return (error); 2605 } 2606 } 2607 2608 return (0); 2609} 2610 2611static int |
2621mac_mls_vnode_check_rename_from(struct ucred *cred, struct vnode *dvp, | 2612mls_vnode_check_rename_from(struct ucred *cred, struct vnode *dvp, |
2622 struct label *dvplabel, struct vnode *vp, struct label *vplabel, 2623 struct componentname *cnp) 2624{ 2625 struct mac_mls *subj, *obj; 2626 | 2613 struct label *dvplabel, struct vnode *vp, struct label *vplabel, 2614 struct componentname *cnp) 2615{ 2616 struct mac_mls *subj, *obj; 2617 |
2627 if (!mac_mls_enabled) | 2618 if (!mls_enabled) |
2628 return (0); 2629 2630 subj = SLOT(cred->cr_label); 2631 obj = SLOT(dvplabel); 2632 | 2619 return (0); 2620 2621 subj = SLOT(cred->cr_label); 2622 obj = SLOT(dvplabel); 2623 |
2633 if (!mac_mls_dominate_effective(obj, subj)) | 2624 if (!mls_dominate_effective(obj, subj)) |
2634 return (EACCES); 2635 2636 obj = SLOT(vplabel); 2637 | 2625 return (EACCES); 2626 2627 obj = SLOT(vplabel); 2628 |
2638 if (!mac_mls_dominate_effective(obj, subj)) | 2629 if (!mls_dominate_effective(obj, subj)) |
2639 return (EACCES); 2640 2641 return (0); 2642} 2643 2644static int | 2630 return (EACCES); 2631 2632 return (0); 2633} 2634 2635static int |
2645mac_mls_vnode_check_rename_to(struct ucred *cred, struct vnode *dvp, | 2636mls_vnode_check_rename_to(struct ucred *cred, struct vnode *dvp, |
2646 struct label *dvplabel, struct vnode *vp, struct label *vplabel, 2647 int samedir, struct componentname *cnp) 2648{ 2649 struct mac_mls *subj, *obj; 2650 | 2637 struct label *dvplabel, struct vnode *vp, struct label *vplabel, 2638 int samedir, struct componentname *cnp) 2639{ 2640 struct mac_mls *subj, *obj; 2641 |
2651 if (!mac_mls_enabled) | 2642 if (!mls_enabled) |
2652 return (0); 2653 2654 subj = SLOT(cred->cr_label); 2655 obj = SLOT(dvplabel); 2656 | 2643 return (0); 2644 2645 subj = SLOT(cred->cr_label); 2646 obj = SLOT(dvplabel); 2647 |
2657 if (!mac_mls_dominate_effective(obj, subj)) | 2648 if (!mls_dominate_effective(obj, subj)) |
2658 return (EACCES); 2659 2660 if (vp != NULL) { 2661 obj = SLOT(vplabel); 2662 | 2649 return (EACCES); 2650 2651 if (vp != NULL) { 2652 obj = SLOT(vplabel); 2653 |
2663 if (!mac_mls_dominate_effective(obj, subj)) | 2654 if (!mls_dominate_effective(obj, subj)) |
2664 return (EACCES); 2665 } 2666 2667 return (0); 2668} 2669 2670static int | 2655 return (EACCES); 2656 } 2657 2658 return (0); 2659} 2660 2661static int |
2671mac_mls_vnode_check_revoke(struct ucred *cred, struct vnode *vp, | 2662mls_vnode_check_revoke(struct ucred *cred, struct vnode *vp, |
2672 struct label *vplabel) 2673{ 2674 struct mac_mls *subj, *obj; 2675 | 2663 struct label *vplabel) 2664{ 2665 struct mac_mls *subj, *obj; 2666 |
2676 if (!mac_mls_enabled) | 2667 if (!mls_enabled) |
2677 return (0); 2678 2679 subj = SLOT(cred->cr_label); 2680 obj = SLOT(vplabel); 2681 | 2668 return (0); 2669 2670 subj = SLOT(cred->cr_label); 2671 obj = SLOT(vplabel); 2672 |
2682 if (!mac_mls_dominate_effective(obj, subj)) | 2673 if (!mls_dominate_effective(obj, subj)) |
2683 return (EACCES); 2684 2685 return (0); 2686} 2687 2688static int | 2674 return (EACCES); 2675 2676 return (0); 2677} 2678 2679static int |
2689mac_mls_vnode_check_setacl(struct ucred *cred, struct vnode *vp, | 2680mls_vnode_check_setacl(struct ucred *cred, struct vnode *vp, |
2690 struct label *vplabel, acl_type_t type, struct acl *acl) 2691{ 2692 struct mac_mls *subj, *obj; 2693 | 2681 struct label *vplabel, acl_type_t type, struct acl *acl) 2682{ 2683 struct mac_mls *subj, *obj; 2684 |
2694 if (!mac_mls_enabled) | 2685 if (!mls_enabled) |
2695 return (0); 2696 2697 subj = SLOT(cred->cr_label); 2698 obj = SLOT(vplabel); 2699 | 2686 return (0); 2687 2688 subj = SLOT(cred->cr_label); 2689 obj = SLOT(vplabel); 2690 |
2700 if (!mac_mls_dominate_effective(obj, subj)) | 2691 if (!mls_dominate_effective(obj, subj)) |
2701 return (EACCES); 2702 2703 return (0); 2704} 2705 2706static int | 2692 return (EACCES); 2693 2694 return (0); 2695} 2696 2697static int |
2707mac_mls_vnode_check_setextattr(struct ucred *cred, struct vnode *vp, | 2698mls_vnode_check_setextattr(struct ucred *cred, struct vnode *vp, |
2708 struct label *vplabel, int attrnamespace, const char *name, 2709 struct uio *uio) 2710{ 2711 struct mac_mls *subj, *obj; 2712 | 2699 struct label *vplabel, int attrnamespace, const char *name, 2700 struct uio *uio) 2701{ 2702 struct mac_mls *subj, *obj; 2703 |
2713 if (!mac_mls_enabled) | 2704 if (!mls_enabled) |
2714 return (0); 2715 2716 subj = SLOT(cred->cr_label); 2717 obj = SLOT(vplabel); 2718 | 2705 return (0); 2706 2707 subj = SLOT(cred->cr_label); 2708 obj = SLOT(vplabel); 2709 |
2719 if (!mac_mls_dominate_effective(obj, subj)) | 2710 if (!mls_dominate_effective(obj, subj)) |
2720 return (EACCES); 2721 2722 /* XXX: protect the MAC EA in a special way? */ 2723 2724 return (0); 2725} 2726 2727static int | 2711 return (EACCES); 2712 2713 /* XXX: protect the MAC EA in a special way? */ 2714 2715 return (0); 2716} 2717 2718static int |
2728mac_mls_vnode_check_setflags(struct ucred *cred, struct vnode *vp, | 2719mls_vnode_check_setflags(struct ucred *cred, struct vnode *vp, |
2729 struct label *vplabel, u_long flags) 2730{ 2731 struct mac_mls *subj, *obj; 2732 | 2720 struct label *vplabel, u_long flags) 2721{ 2722 struct mac_mls *subj, *obj; 2723 |
2733 if (!mac_mls_enabled) | 2724 if (!mls_enabled) |
2734 return (0); 2735 2736 subj = SLOT(cred->cr_label); 2737 obj = SLOT(vplabel); 2738 | 2725 return (0); 2726 2727 subj = SLOT(cred->cr_label); 2728 obj = SLOT(vplabel); 2729 |
2739 if (!mac_mls_dominate_effective(obj, subj)) | 2730 if (!mls_dominate_effective(obj, subj)) |
2740 return (EACCES); 2741 2742 return (0); 2743} 2744 2745static int | 2731 return (EACCES); 2732 2733 return (0); 2734} 2735 2736static int |
2746mac_mls_vnode_check_setmode(struct ucred *cred, struct vnode *vp, | 2737mls_vnode_check_setmode(struct ucred *cred, struct vnode *vp, |
2747 struct label *vplabel, mode_t mode) 2748{ 2749 struct mac_mls *subj, *obj; 2750 | 2738 struct label *vplabel, mode_t mode) 2739{ 2740 struct mac_mls *subj, *obj; 2741 |
2751 if (!mac_mls_enabled) | 2742 if (!mls_enabled) |
2752 return (0); 2753 2754 subj = SLOT(cred->cr_label); 2755 obj = SLOT(vplabel); 2756 | 2743 return (0); 2744 2745 subj = SLOT(cred->cr_label); 2746 obj = SLOT(vplabel); 2747 |
2757 if (!mac_mls_dominate_effective(obj, subj)) | 2748 if (!mls_dominate_effective(obj, subj)) |
2758 return (EACCES); 2759 2760 return (0); 2761} 2762 2763static int | 2749 return (EACCES); 2750 2751 return (0); 2752} 2753 2754static int |
2764mac_mls_vnode_check_setowner(struct ucred *cred, struct vnode *vp, | 2755mls_vnode_check_setowner(struct ucred *cred, struct vnode *vp, |
2765 struct label *vplabel, uid_t uid, gid_t gid) 2766{ 2767 struct mac_mls *subj, *obj; 2768 | 2756 struct label *vplabel, uid_t uid, gid_t gid) 2757{ 2758 struct mac_mls *subj, *obj; 2759 |
2769 if (!mac_mls_enabled) | 2760 if (!mls_enabled) |
2770 return (0); 2771 2772 subj = SLOT(cred->cr_label); 2773 obj = SLOT(vplabel); 2774 | 2761 return (0); 2762 2763 subj = SLOT(cred->cr_label); 2764 obj = SLOT(vplabel); 2765 |
2775 if (!mac_mls_dominate_effective(obj, subj)) | 2766 if (!mls_dominate_effective(obj, subj)) |
2776 return (EACCES); 2777 2778 return (0); 2779} 2780 2781static int | 2767 return (EACCES); 2768 2769 return (0); 2770} 2771 2772static int |
2782mac_mls_vnode_check_setutimes(struct ucred *cred, struct vnode *vp, | 2773mls_vnode_check_setutimes(struct ucred *cred, struct vnode *vp, |
2783 struct label *vplabel, struct timespec atime, struct timespec mtime) 2784{ 2785 struct mac_mls *subj, *obj; 2786 | 2774 struct label *vplabel, struct timespec atime, struct timespec mtime) 2775{ 2776 struct mac_mls *subj, *obj; 2777 |
2787 if (!mac_mls_enabled) | 2778 if (!mls_enabled) |
2788 return (0); 2789 2790 subj = SLOT(cred->cr_label); 2791 obj = SLOT(vplabel); 2792 | 2779 return (0); 2780 2781 subj = SLOT(cred->cr_label); 2782 obj = SLOT(vplabel); 2783 |
2793 if (!mac_mls_dominate_effective(obj, subj)) | 2784 if (!mls_dominate_effective(obj, subj)) |
2794 return (EACCES); 2795 2796 return (0); 2797} 2798 2799static int | 2785 return (EACCES); 2786 2787 return (0); 2788} 2789 2790static int |
2800mac_mls_vnode_check_stat(struct ucred *active_cred, struct ucred *file_cred, | 2791mls_vnode_check_stat(struct ucred *active_cred, struct ucred *file_cred, |
2801 struct vnode *vp, struct label *vplabel) 2802{ 2803 struct mac_mls *subj, *obj; 2804 | 2792 struct vnode *vp, struct label *vplabel) 2793{ 2794 struct mac_mls *subj, *obj; 2795 |
2805 if (!mac_mls_enabled) | 2796 if (!mls_enabled) |
2806 return (0); 2807 2808 subj = SLOT(active_cred->cr_label); 2809 obj = SLOT(vplabel); 2810 | 2797 return (0); 2798 2799 subj = SLOT(active_cred->cr_label); 2800 obj = SLOT(vplabel); 2801 |
2811 if (!mac_mls_dominate_effective(subj, obj)) | 2802 if (!mls_dominate_effective(subj, obj)) |
2812 return (EACCES); 2813 2814 return (0); 2815} 2816 2817static int | 2803 return (EACCES); 2804 2805 return (0); 2806} 2807 2808static int |
2818mac_mls_vnode_check_unlink(struct ucred *cred, struct vnode *dvp, | 2809mls_vnode_check_unlink(struct ucred *cred, struct vnode *dvp, |
2819 struct label *dvplabel, struct vnode *vp, struct label *vplabel, 2820 struct componentname *cnp) 2821{ 2822 struct mac_mls *subj, *obj; 2823 | 2810 struct label *dvplabel, struct vnode *vp, struct label *vplabel, 2811 struct componentname *cnp) 2812{ 2813 struct mac_mls *subj, *obj; 2814 |
2824 if (!mac_mls_enabled) | 2815 if (!mls_enabled) |
2825 return (0); 2826 2827 subj = SLOT(cred->cr_label); 2828 obj = SLOT(dvplabel); 2829 | 2816 return (0); 2817 2818 subj = SLOT(cred->cr_label); 2819 obj = SLOT(dvplabel); 2820 |
2830 if (!mac_mls_dominate_effective(obj, subj)) | 2821 if (!mls_dominate_effective(obj, subj)) |
2831 return (EACCES); 2832 2833 obj = SLOT(vplabel); 2834 | 2822 return (EACCES); 2823 2824 obj = SLOT(vplabel); 2825 |
2835 if (!mac_mls_dominate_effective(obj, subj)) | 2826 if (!mls_dominate_effective(obj, subj)) |
2836 return (EACCES); 2837 2838 return (0); 2839} 2840 2841static int | 2827 return (EACCES); 2828 2829 return (0); 2830} 2831 2832static int |
2842mac_mls_vnode_check_write(struct ucred *active_cred, struct ucred *file_cred, | 2833mls_vnode_check_write(struct ucred *active_cred, struct ucred *file_cred, |
2843 struct vnode *vp, struct label *vplabel) 2844{ 2845 struct mac_mls *subj, *obj; 2846 | 2834 struct vnode *vp, struct label *vplabel) 2835{ 2836 struct mac_mls *subj, *obj; 2837 |
2847 if (!mac_mls_enabled || !revocation_enabled) | 2838 if (!mls_enabled || !revocation_enabled) |
2848 return (0); 2849 2850 subj = SLOT(active_cred->cr_label); 2851 obj = SLOT(vplabel); 2852 | 2839 return (0); 2840 2841 subj = SLOT(active_cred->cr_label); 2842 obj = SLOT(vplabel); 2843 |
2853 if (!mac_mls_dominate_effective(obj, subj)) | 2844 if (!mls_dominate_effective(obj, subj)) |
2854 return (EACCES); 2855 2856 return (0); 2857} 2858 2859static void | 2845 return (EACCES); 2846 2847 return (0); 2848} 2849 2850static void |
2860mac_mls_associate_nfsd_label(struct ucred *cred) | 2851mls_associate_nfsd_label(struct ucred *cred) |
2861{ 2862 struct mac_mls *label; 2863 2864 label = SLOT(cred->cr_label); | 2852{ 2853 struct mac_mls *label; 2854 2855 label = SLOT(cred->cr_label); |
2865 mac_mls_set_effective(label, MAC_MLS_TYPE_LOW, 0, NULL); 2866 mac_mls_set_range(label, MAC_MLS_TYPE_LOW, 0, NULL, 2867 MAC_MLS_TYPE_HIGH, 0, NULL); | 2856 mls_set_effective(label, MAC_MLS_TYPE_LOW, 0, NULL); 2857 mls_set_range(label, MAC_MLS_TYPE_LOW, 0, NULL, MAC_MLS_TYPE_HIGH, 0, 2858 NULL); |
2868} 2869 | 2859} 2860 |
2870static struct mac_policy_ops mac_mls_ops = | 2861static struct mac_policy_ops mls_ops = |
2871{ | 2862{ |
2872 .mpo_init = mac_mls_init, 2873 .mpo_bpfdesc_init_label = mac_mls_init_label, 2874 .mpo_cred_init_label = mac_mls_init_label, 2875 .mpo_devfs_init_label = mac_mls_init_label, 2876 .mpo_ifnet_init_label = mac_mls_init_label, 2877 .mpo_inpcb_init_label = mac_mls_init_label_waitcheck, 2878 .mpo_init_syncache_label = mac_mls_init_label_waitcheck, 2879 .mpo_sysvmsg_init_label = mac_mls_init_label, 2880 .mpo_sysvmsq_init_label = mac_mls_init_label, 2881 .mpo_sysvsem_init_label = mac_mls_init_label, 2882 .mpo_sysvshm_init_label = mac_mls_init_label, 2883 .mpo_ipq_init_label = mac_mls_init_label_waitcheck, 2884 .mpo_mbuf_init_label = mac_mls_init_label_waitcheck, 2885 .mpo_mount_init_label = mac_mls_init_label, 2886 .mpo_pipe_init_label = mac_mls_init_label, 2887 .mpo_posixsem_init_label = mac_mls_init_label, 2888 .mpo_socket_init_label = mac_mls_init_label_waitcheck, 2889 .mpo_socketpeer_init_label = mac_mls_init_label_waitcheck, 2890 .mpo_vnode_init_label = mac_mls_init_label, 2891 .mpo_bpfdesc_destroy_label = mac_mls_destroy_label, 2892 .mpo_cred_destroy_label = mac_mls_destroy_label, 2893 .mpo_devfs_destroy_label = mac_mls_destroy_label, 2894 .mpo_ifnet_destroy_label = mac_mls_destroy_label, 2895 .mpo_inpcb_destroy_label = mac_mls_destroy_label, 2896 .mpo_destroy_syncache_label = mac_mls_destroy_label, 2897 .mpo_sysvmsg_destroy_label = mac_mls_destroy_label, 2898 .mpo_sysvmsq_destroy_label = mac_mls_destroy_label, 2899 .mpo_sysvsem_destroy_label = mac_mls_destroy_label, 2900 .mpo_sysvshm_destroy_label = mac_mls_destroy_label, 2901 .mpo_ipq_destroy_label = mac_mls_destroy_label, 2902 .mpo_mbuf_destroy_label = mac_mls_destroy_label, 2903 .mpo_mount_destroy_label = mac_mls_destroy_label, 2904 .mpo_pipe_destroy_label = mac_mls_destroy_label, 2905 .mpo_posixsem_destroy_label = mac_mls_destroy_label, 2906 .mpo_socket_destroy_label = mac_mls_destroy_label, 2907 .mpo_socketpeer_destroy_label = mac_mls_destroy_label, 2908 .mpo_vnode_destroy_label = mac_mls_destroy_label, 2909 .mpo_cred_copy_label = mac_mls_copy_label, 2910 .mpo_ifnet_copy_label = mac_mls_copy_label, 2911 .mpo_mbuf_copy_label = mac_mls_copy_label, 2912 .mpo_pipe_copy_label = mac_mls_copy_label, 2913 .mpo_socket_copy_label = mac_mls_copy_label, 2914 .mpo_vnode_copy_label = mac_mls_copy_label, 2915 .mpo_cred_externalize_label = mac_mls_externalize_label, 2916 .mpo_ifnet_externalize_label = mac_mls_externalize_label, 2917 .mpo_pipe_externalize_label = mac_mls_externalize_label, 2918 .mpo_socket_externalize_label = mac_mls_externalize_label, 2919 .mpo_socketpeer_externalize_label = mac_mls_externalize_label, 2920 .mpo_vnode_externalize_label = mac_mls_externalize_label, 2921 .mpo_cred_internalize_label = mac_mls_internalize_label, 2922 .mpo_ifnet_internalize_label = mac_mls_internalize_label, 2923 .mpo_pipe_internalize_label = mac_mls_internalize_label, 2924 .mpo_socket_internalize_label = mac_mls_internalize_label, 2925 .mpo_vnode_internalize_label = mac_mls_internalize_label, 2926 .mpo_devfs_create_device = mac_mls_devfs_create_device, 2927 .mpo_devfs_create_directory = mac_mls_devfs_create_directory, 2928 .mpo_devfs_create_symlink = mac_mls_devfs_create_symlink, 2929 .mpo_mount_create = mac_mls_mount_create, 2930 .mpo_vnode_relabel = mac_mls_vnode_relabel, 2931 .mpo_devfs_update = mac_mls_devfs_update, 2932 .mpo_devfs_vnode_associate = mac_mls_devfs_vnode_associate, 2933 .mpo_vnode_associate_extattr = mac_mls_vnode_associate_extattr, 2934 .mpo_vnode_associate_singlelabel = mac_mls_vnode_associate_singlelabel, 2935 .mpo_vnode_create_extattr = mac_mls_vnode_create_extattr, 2936 .mpo_vnode_setlabel_extattr = mac_mls_vnode_setlabel_extattr, 2937 .mpo_socket_create_mbuf = mac_mls_socket_create_mbuf, 2938 .mpo_create_mbuf_from_syncache = mac_mls_create_mbuf_from_syncache, 2939 .mpo_pipe_create = mac_mls_pipe_create, 2940 .mpo_posixsem_create = mac_mls_posixsem_create, 2941 .mpo_socket_create = mac_mls_socket_create, 2942 .mpo_socket_newconn = mac_mls_socket_newconn, 2943 .mpo_pipe_relabel = mac_mls_pipe_relabel, 2944 .mpo_socket_relabel = mac_mls_socket_relabel, 2945 .mpo_socketpeer_set_from_mbuf = mac_mls_socketpeer_set_from_mbuf, 2946 .mpo_socketpeer_set_from_socket = mac_mls_socketpeer_set_from_socket, 2947 .mpo_bpfdesc_create = mac_mls_bpfdesc_create, 2948 .mpo_ipq_reassemble = mac_mls_ipq_reassemble, 2949 .mpo_netinet_fragment = mac_mls_netinet_fragment, 2950 .mpo_ifnet_create = mac_mls_ifnet_create, 2951 .mpo_inpcb_create = mac_mls_inpcb_create, 2952 .mpo_init_syncache_from_inpcb = mac_mls_init_syncache_from_inpcb, 2953 .mpo_ipq_create = mac_mls_ipq_create, 2954 .mpo_sysvmsg_create = mac_mls_sysvmsg_create, 2955 .mpo_sysvmsq_create = mac_mls_sysvmsq_create, 2956 .mpo_sysvsem_create = mac_mls_sysvsem_create, 2957 .mpo_sysvshm_create = mac_mls_sysvshm_create, 2958 .mpo_inpcb_create_mbuf = mac_mls_inpcb_create_mbuf, 2959 .mpo_create_mbuf_linklayer = mac_mls_create_mbuf_linklayer, 2960 .mpo_bpfdesc_create_mbuf = mac_mls_bpfdesc_create_mbuf, 2961 .mpo_ifnet_create_mbuf = mac_mls_ifnet_create_mbuf, 2962 .mpo_mbuf_create_multicast_encap = mac_mls_mbuf_create_multicast_encap, 2963 .mpo_mbuf_create_netlayer = mac_mls_mbuf_create_netlayer, 2964 .mpo_ipq_match = mac_mls_ipq_match, 2965 .mpo_ifnet_relabel = mac_mls_ifnet_relabel, 2966 .mpo_ipq_update = mac_mls_ipq_update, 2967 .mpo_inpcb_sosetlabel = mac_mls_inpcb_sosetlabel, 2968 .mpo_proc_create_swapper = mac_mls_proc_create_swapper, 2969 .mpo_proc_create_init = mac_mls_proc_create_init, 2970 .mpo_cred_relabel = mac_mls_cred_relabel, 2971 .mpo_sysvmsg_cleanup = mac_mls_sysvmsg_cleanup, 2972 .mpo_sysvmsq_cleanup = mac_mls_sysvmsq_cleanup, 2973 .mpo_sysvsem_cleanup = mac_mls_sysvsem_cleanup, 2974 .mpo_sysvshm_cleanup = mac_mls_sysvshm_cleanup, 2975 .mpo_bpfdesc_check_receive = mac_mls_bpfdesc_check_receive, 2976 .mpo_cred_check_relabel = mac_mls_cred_check_relabel, 2977 .mpo_cred_check_visible = mac_mls_cred_check_visible, 2978 .mpo_ifnet_check_relabel = mac_mls_ifnet_check_relabel, 2979 .mpo_ifnet_check_transmit = mac_mls_ifnet_check_transmit, 2980 .mpo_inpcb_check_deliver = mac_mls_inpcb_check_deliver, 2981 .mpo_sysvmsq_check_msgrcv = mac_mls_sysvmsq_check_msgrcv, 2982 .mpo_sysvmsq_check_msgrmid = mac_mls_sysvmsq_check_msgrmid, 2983 .mpo_sysvmsq_check_msqget = mac_mls_sysvmsq_check_msqget, 2984 .mpo_sysvmsq_check_msqsnd = mac_mls_sysvmsq_check_msqsnd, 2985 .mpo_sysvmsq_check_msqrcv = mac_mls_sysvmsq_check_msqrcv, 2986 .mpo_sysvmsq_check_msqctl = mac_mls_sysvmsq_check_msqctl, 2987 .mpo_sysvsem_check_semctl = mac_mls_sysvsem_check_semctl, 2988 .mpo_sysvsem_check_semget = mac_mls_sysvsem_check_semget, 2989 .mpo_sysvsem_check_semop = mac_mls_sysvsem_check_semop, 2990 .mpo_sysvshm_check_shmat = mac_mls_sysvshm_check_shmat, 2991 .mpo_sysvshm_check_shmctl = mac_mls_sysvshm_check_shmctl, 2992 .mpo_sysvshm_check_shmget = mac_mls_sysvshm_check_shmget, 2993 .mpo_mount_check_stat = mac_mls_mount_check_stat, 2994 .mpo_pipe_check_ioctl = mac_mls_pipe_check_ioctl, 2995 .mpo_pipe_check_poll = mac_mls_pipe_check_poll, 2996 .mpo_pipe_check_read = mac_mls_pipe_check_read, 2997 .mpo_pipe_check_relabel = mac_mls_pipe_check_relabel, 2998 .mpo_pipe_check_stat = mac_mls_pipe_check_stat, 2999 .mpo_pipe_check_write = mac_mls_pipe_check_write, 3000 .mpo_posixsem_check_destroy = mac_mls_posixsem_check_write, 3001 .mpo_posixsem_check_getvalue = mac_mls_posixsem_check_rdonly, 3002 .mpo_posixsem_check_open = mac_mls_posixsem_check_write, 3003 .mpo_posixsem_check_post = mac_mls_posixsem_check_write, 3004 .mpo_posixsem_check_unlink = mac_mls_posixsem_check_write, 3005 .mpo_posixsem_check_wait = mac_mls_posixsem_check_write, 3006 .mpo_proc_check_debug = mac_mls_proc_check_debug, 3007 .mpo_proc_check_sched = mac_mls_proc_check_sched, 3008 .mpo_proc_check_signal = mac_mls_proc_check_signal, 3009 .mpo_socket_check_deliver = mac_mls_socket_check_deliver, 3010 .mpo_socket_check_relabel = mac_mls_socket_check_relabel, 3011 .mpo_socket_check_visible = mac_mls_socket_check_visible, 3012 .mpo_system_check_acct = mac_mls_system_check_acct, 3013 .mpo_system_check_auditctl = mac_mls_system_check_auditctl, 3014 .mpo_system_check_swapon = mac_mls_system_check_swapon, 3015 .mpo_vnode_check_access = mac_mls_vnode_check_open, 3016 .mpo_vnode_check_chdir = mac_mls_vnode_check_chdir, 3017 .mpo_vnode_check_chroot = mac_mls_vnode_check_chroot, 3018 .mpo_vnode_check_create = mac_mls_vnode_check_create, 3019 .mpo_vnode_check_deleteacl = mac_mls_vnode_check_deleteacl, 3020 .mpo_vnode_check_deleteextattr = mac_mls_vnode_check_deleteextattr, 3021 .mpo_vnode_check_exec = mac_mls_vnode_check_exec, 3022 .mpo_vnode_check_getacl = mac_mls_vnode_check_getacl, 3023 .mpo_vnode_check_getextattr = mac_mls_vnode_check_getextattr, 3024 .mpo_vnode_check_link = mac_mls_vnode_check_link, 3025 .mpo_vnode_check_listextattr = mac_mls_vnode_check_listextattr, 3026 .mpo_vnode_check_lookup = mac_mls_vnode_check_lookup, 3027 .mpo_vnode_check_mmap = mac_mls_vnode_check_mmap, 3028 .mpo_vnode_check_open = mac_mls_vnode_check_open, 3029 .mpo_vnode_check_poll = mac_mls_vnode_check_poll, 3030 .mpo_vnode_check_read = mac_mls_vnode_check_read, 3031 .mpo_vnode_check_readdir = mac_mls_vnode_check_readdir, 3032 .mpo_vnode_check_readlink = mac_mls_vnode_check_readlink, 3033 .mpo_vnode_check_relabel = mac_mls_vnode_check_relabel, 3034 .mpo_vnode_check_rename_from = mac_mls_vnode_check_rename_from, 3035 .mpo_vnode_check_rename_to = mac_mls_vnode_check_rename_to, 3036 .mpo_vnode_check_revoke = mac_mls_vnode_check_revoke, 3037 .mpo_vnode_check_setacl = mac_mls_vnode_check_setacl, 3038 .mpo_vnode_check_setextattr = mac_mls_vnode_check_setextattr, 3039 .mpo_vnode_check_setflags = mac_mls_vnode_check_setflags, 3040 .mpo_vnode_check_setmode = mac_mls_vnode_check_setmode, 3041 .mpo_vnode_check_setowner = mac_mls_vnode_check_setowner, 3042 .mpo_vnode_check_setutimes = mac_mls_vnode_check_setutimes, 3043 .mpo_vnode_check_stat = mac_mls_vnode_check_stat, 3044 .mpo_vnode_check_unlink = mac_mls_vnode_check_unlink, 3045 .mpo_vnode_check_write = mac_mls_vnode_check_write, 3046 .mpo_associate_nfsd_label = mac_mls_associate_nfsd_label, 3047 .mpo_mbuf_create_from_firewall = mac_mls_mbuf_create_from_firewall, | 2863 .mpo_init = mls_init, 2864 .mpo_bpfdesc_init_label = mls_init_label, 2865 .mpo_cred_init_label = mls_init_label, 2866 .mpo_devfs_init_label = mls_init_label, 2867 .mpo_ifnet_init_label = mls_init_label, 2868 .mpo_inpcb_init_label = mls_init_label_waitcheck, 2869 .mpo_init_syncache_label = mls_init_label_waitcheck, 2870 .mpo_sysvmsg_init_label = mls_init_label, 2871 .mpo_sysvmsq_init_label = mls_init_label, 2872 .mpo_sysvsem_init_label = mls_init_label, 2873 .mpo_sysvshm_init_label = mls_init_label, 2874 .mpo_ipq_init_label = mls_init_label_waitcheck, 2875 .mpo_mbuf_init_label = mls_init_label_waitcheck, 2876 .mpo_mount_init_label = mls_init_label, 2877 .mpo_pipe_init_label = mls_init_label, 2878 .mpo_posixsem_init_label = mls_init_label, 2879 .mpo_socket_init_label = mls_init_label_waitcheck, 2880 .mpo_socketpeer_init_label = mls_init_label_waitcheck, 2881 .mpo_vnode_init_label = mls_init_label, 2882 .mpo_bpfdesc_destroy_label = mls_destroy_label, 2883 .mpo_cred_destroy_label = mls_destroy_label, 2884 .mpo_devfs_destroy_label = mls_destroy_label, 2885 .mpo_ifnet_destroy_label = mls_destroy_label, 2886 .mpo_inpcb_destroy_label = mls_destroy_label, 2887 .mpo_destroy_syncache_label = mls_destroy_label, 2888 .mpo_sysvmsg_destroy_label = mls_destroy_label, 2889 .mpo_sysvmsq_destroy_label = mls_destroy_label, 2890 .mpo_sysvsem_destroy_label = mls_destroy_label, 2891 .mpo_sysvshm_destroy_label = mls_destroy_label, 2892 .mpo_ipq_destroy_label = mls_destroy_label, 2893 .mpo_mbuf_destroy_label = mls_destroy_label, 2894 .mpo_mount_destroy_label = mls_destroy_label, 2895 .mpo_pipe_destroy_label = mls_destroy_label, 2896 .mpo_posixsem_destroy_label = mls_destroy_label, 2897 .mpo_socket_destroy_label = mls_destroy_label, 2898 .mpo_socketpeer_destroy_label = mls_destroy_label, 2899 .mpo_vnode_destroy_label = mls_destroy_label, 2900 .mpo_cred_copy_label = mls_copy_label, 2901 .mpo_ifnet_copy_label = mls_copy_label, 2902 .mpo_mbuf_copy_label = mls_copy_label, 2903 .mpo_pipe_copy_label = mls_copy_label, 2904 .mpo_socket_copy_label = mls_copy_label, 2905 .mpo_vnode_copy_label = mls_copy_label, 2906 .mpo_cred_externalize_label = mls_externalize_label, 2907 .mpo_ifnet_externalize_label = mls_externalize_label, 2908 .mpo_pipe_externalize_label = mls_externalize_label, 2909 .mpo_socket_externalize_label = mls_externalize_label, 2910 .mpo_socketpeer_externalize_label = mls_externalize_label, 2911 .mpo_vnode_externalize_label = mls_externalize_label, 2912 .mpo_cred_internalize_label = mls_internalize_label, 2913 .mpo_ifnet_internalize_label = mls_internalize_label, 2914 .mpo_pipe_internalize_label = mls_internalize_label, 2915 .mpo_socket_internalize_label = mls_internalize_label, 2916 .mpo_vnode_internalize_label = mls_internalize_label, 2917 .mpo_devfs_create_device = mls_devfs_create_device, 2918 .mpo_devfs_create_directory = mls_devfs_create_directory, 2919 .mpo_devfs_create_symlink = mls_devfs_create_symlink, 2920 .mpo_mount_create = mls_mount_create, 2921 .mpo_vnode_relabel = mls_vnode_relabel, 2922 .mpo_devfs_update = mls_devfs_update, 2923 .mpo_devfs_vnode_associate = mls_devfs_vnode_associate, 2924 .mpo_vnode_associate_extattr = mls_vnode_associate_extattr, 2925 .mpo_vnode_associate_singlelabel = mls_vnode_associate_singlelabel, 2926 .mpo_vnode_create_extattr = mls_vnode_create_extattr, 2927 .mpo_vnode_setlabel_extattr = mls_vnode_setlabel_extattr, 2928 .mpo_socket_create_mbuf = mls_socket_create_mbuf, 2929 .mpo_create_mbuf_from_syncache = mls_create_mbuf_from_syncache, 2930 .mpo_pipe_create = mls_pipe_create, 2931 .mpo_posixsem_create = mls_posixsem_create, 2932 .mpo_socket_create = mls_socket_create, 2933 .mpo_socket_newconn = mls_socket_newconn, 2934 .mpo_pipe_relabel = mls_pipe_relabel, 2935 .mpo_socket_relabel = mls_socket_relabel, 2936 .mpo_socketpeer_set_from_mbuf = mls_socketpeer_set_from_mbuf, 2937 .mpo_socketpeer_set_from_socket = mls_socketpeer_set_from_socket, 2938 .mpo_bpfdesc_create = mls_bpfdesc_create, 2939 .mpo_ipq_reassemble = mls_ipq_reassemble, 2940 .mpo_netinet_fragment = mls_netinet_fragment, 2941 .mpo_ifnet_create = mls_ifnet_create, 2942 .mpo_inpcb_create = mls_inpcb_create, 2943 .mpo_init_syncache_from_inpcb = mls_init_syncache_from_inpcb, 2944 .mpo_ipq_create = mls_ipq_create, 2945 .mpo_sysvmsg_create = mls_sysvmsg_create, 2946 .mpo_sysvmsq_create = mls_sysvmsq_create, 2947 .mpo_sysvsem_create = mls_sysvsem_create, 2948 .mpo_sysvshm_create = mls_sysvshm_create, 2949 .mpo_inpcb_create_mbuf = mls_inpcb_create_mbuf, 2950 .mpo_create_mbuf_linklayer = mls_create_mbuf_linklayer, 2951 .mpo_bpfdesc_create_mbuf = mls_bpfdesc_create_mbuf, 2952 .mpo_ifnet_create_mbuf = mls_ifnet_create_mbuf, 2953 .mpo_mbuf_create_multicast_encap = mls_mbuf_create_multicast_encap, 2954 .mpo_mbuf_create_netlayer = mls_mbuf_create_netlayer, 2955 .mpo_ipq_match = mls_ipq_match, 2956 .mpo_ifnet_relabel = mls_ifnet_relabel, 2957 .mpo_ipq_update = mls_ipq_update, 2958 .mpo_inpcb_sosetlabel = mls_inpcb_sosetlabel, 2959 .mpo_proc_create_swapper = mls_proc_create_swapper, 2960 .mpo_proc_create_init = mls_proc_create_init, 2961 .mpo_cred_relabel = mls_cred_relabel, 2962 .mpo_sysvmsg_cleanup = mls_sysvmsg_cleanup, 2963 .mpo_sysvmsq_cleanup = mls_sysvmsq_cleanup, 2964 .mpo_sysvsem_cleanup = mls_sysvsem_cleanup, 2965 .mpo_sysvshm_cleanup = mls_sysvshm_cleanup, 2966 .mpo_bpfdesc_check_receive = mls_bpfdesc_check_receive, 2967 .mpo_cred_check_relabel = mls_cred_check_relabel, 2968 .mpo_cred_check_visible = mls_cred_check_visible, 2969 .mpo_ifnet_check_relabel = mls_ifnet_check_relabel, 2970 .mpo_ifnet_check_transmit = mls_ifnet_check_transmit, 2971 .mpo_inpcb_check_deliver = mls_inpcb_check_deliver, 2972 .mpo_sysvmsq_check_msgrcv = mls_sysvmsq_check_msgrcv, 2973 .mpo_sysvmsq_check_msgrmid = mls_sysvmsq_check_msgrmid, 2974 .mpo_sysvmsq_check_msqget = mls_sysvmsq_check_msqget, 2975 .mpo_sysvmsq_check_msqsnd = mls_sysvmsq_check_msqsnd, 2976 .mpo_sysvmsq_check_msqrcv = mls_sysvmsq_check_msqrcv, 2977 .mpo_sysvmsq_check_msqctl = mls_sysvmsq_check_msqctl, 2978 .mpo_sysvsem_check_semctl = mls_sysvsem_check_semctl, 2979 .mpo_sysvsem_check_semget = mls_sysvsem_check_semget, 2980 .mpo_sysvsem_check_semop = mls_sysvsem_check_semop, 2981 .mpo_sysvshm_check_shmat = mls_sysvshm_check_shmat, 2982 .mpo_sysvshm_check_shmctl = mls_sysvshm_check_shmctl, 2983 .mpo_sysvshm_check_shmget = mls_sysvshm_check_shmget, 2984 .mpo_mount_check_stat = mls_mount_check_stat, 2985 .mpo_pipe_check_ioctl = mls_pipe_check_ioctl, 2986 .mpo_pipe_check_poll = mls_pipe_check_poll, 2987 .mpo_pipe_check_read = mls_pipe_check_read, 2988 .mpo_pipe_check_relabel = mls_pipe_check_relabel, 2989 .mpo_pipe_check_stat = mls_pipe_check_stat, 2990 .mpo_pipe_check_write = mls_pipe_check_write, 2991 .mpo_posixsem_check_destroy = mls_posixsem_check_write, 2992 .mpo_posixsem_check_getvalue = mls_posixsem_check_rdonly, 2993 .mpo_posixsem_check_open = mls_posixsem_check_write, 2994 .mpo_posixsem_check_post = mls_posixsem_check_write, 2995 .mpo_posixsem_check_unlink = mls_posixsem_check_write, 2996 .mpo_posixsem_check_wait = mls_posixsem_check_write, 2997 .mpo_proc_check_debug = mls_proc_check_debug, 2998 .mpo_proc_check_sched = mls_proc_check_sched, 2999 .mpo_proc_check_signal = mls_proc_check_signal, 3000 .mpo_socket_check_deliver = mls_socket_check_deliver, 3001 .mpo_socket_check_relabel = mls_socket_check_relabel, 3002 .mpo_socket_check_visible = mls_socket_check_visible, 3003 .mpo_system_check_acct = mls_system_check_acct, 3004 .mpo_system_check_auditctl = mls_system_check_auditctl, 3005 .mpo_system_check_swapon = mls_system_check_swapon, 3006 .mpo_vnode_check_access = mls_vnode_check_open, 3007 .mpo_vnode_check_chdir = mls_vnode_check_chdir, 3008 .mpo_vnode_check_chroot = mls_vnode_check_chroot, 3009 .mpo_vnode_check_create = mls_vnode_check_create, 3010 .mpo_vnode_check_deleteacl = mls_vnode_check_deleteacl, 3011 .mpo_vnode_check_deleteextattr = mls_vnode_check_deleteextattr, 3012 .mpo_vnode_check_exec = mls_vnode_check_exec, 3013 .mpo_vnode_check_getacl = mls_vnode_check_getacl, 3014 .mpo_vnode_check_getextattr = mls_vnode_check_getextattr, 3015 .mpo_vnode_check_link = mls_vnode_check_link, 3016 .mpo_vnode_check_listextattr = mls_vnode_check_listextattr, 3017 .mpo_vnode_check_lookup = mls_vnode_check_lookup, 3018 .mpo_vnode_check_mmap = mls_vnode_check_mmap, 3019 .mpo_vnode_check_open = mls_vnode_check_open, 3020 .mpo_vnode_check_poll = mls_vnode_check_poll, 3021 .mpo_vnode_check_read = mls_vnode_check_read, 3022 .mpo_vnode_check_readdir = mls_vnode_check_readdir, 3023 .mpo_vnode_check_readlink = mls_vnode_check_readlink, 3024 .mpo_vnode_check_relabel = mls_vnode_check_relabel, 3025 .mpo_vnode_check_rename_from = mls_vnode_check_rename_from, 3026 .mpo_vnode_check_rename_to = mls_vnode_check_rename_to, 3027 .mpo_vnode_check_revoke = mls_vnode_check_revoke, 3028 .mpo_vnode_check_setacl = mls_vnode_check_setacl, 3029 .mpo_vnode_check_setextattr = mls_vnode_check_setextattr, 3030 .mpo_vnode_check_setflags = mls_vnode_check_setflags, 3031 .mpo_vnode_check_setmode = mls_vnode_check_setmode, 3032 .mpo_vnode_check_setowner = mls_vnode_check_setowner, 3033 .mpo_vnode_check_setutimes = mls_vnode_check_setutimes, 3034 .mpo_vnode_check_stat = mls_vnode_check_stat, 3035 .mpo_vnode_check_unlink = mls_vnode_check_unlink, 3036 .mpo_vnode_check_write = mls_vnode_check_write, 3037 .mpo_associate_nfsd_label = mls_associate_nfsd_label, 3038 .mpo_mbuf_create_from_firewall = mls_mbuf_create_from_firewall, |
3048}; 3049 | 3039}; 3040 |
3050MAC_POLICY_SET(&mac_mls_ops, mac_mls, "TrustedBSD MAC/MLS", 3051 MPC_LOADTIME_FLAG_NOTLATE | MPC_LOADTIME_FLAG_LABELMBUFS, &mac_mls_slot); | 3041MAC_POLICY_SET(&mls_ops, mac_mls, "TrustedBSD MAC/MLS", 3042 MPC_LOADTIME_FLAG_NOTLATE | MPC_LOADTIME_FLAG_LABELMBUFS, &mls_slot); |