1/*-
2 * Copyright (c) 1999-2002, 2007-2008 Robert N. M. Watson
3 * Copyright (c) 2001-2005 Networks Associates Technology, Inc.
4 * Copyright (c) 2005-2006 SPARTA, Inc.
5 * All rights reserved.
6 *
7 * This software was developed by Robert Watson for the TrustedBSD Project.
8 *
9 * This software was developed for the FreeBSD Project in part by Network
10 * Associates Laboratories, the Security Research Division of Network
11 * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"),
12 * as part of the DARPA CHATS research program.
13 *
14 * This software was enhanced by SPARTA ISSO under SPAWAR contract
15 * N66001-04-C-6019 ("SEFOS").
16 *
17 * Redistribution and use in source and binary forms, with or without
18 * modification, are permitted provided that the following conditions
19 * are met:
20 * 1. Redistributions of source code must retain the above copyright
21 * notice, this list of conditions and the following disclaimer.
22 * 2. Redistributions in binary form must reproduce the above copyright
23 * notice, this list of conditions and the following disclaimer in the
24 * documentation and/or other materials provided with the distribution.
25 *
26 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
27 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
28 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
29 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
30 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
31 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
32 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
33 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
34 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
35 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
36 * SUCH DAMAGE.
37 *
| 1/*-
2 * Copyright (c) 1999-2002, 2007-2008 Robert N. M. Watson
3 * Copyright (c) 2001-2005 Networks Associates Technology, Inc.
4 * Copyright (c) 2005-2006 SPARTA, Inc.
5 * All rights reserved.
6 *
7 * This software was developed by Robert Watson for the TrustedBSD Project.
8 *
9 * This software was developed for the FreeBSD Project in part by Network
10 * Associates Laboratories, the Security Research Division of Network
11 * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"),
12 * as part of the DARPA CHATS research program.
13 *
14 * This software was enhanced by SPARTA ISSO under SPAWAR contract
15 * N66001-04-C-6019 ("SEFOS").
16 *
17 * Redistribution and use in source and binary forms, with or without
18 * modification, are permitted provided that the following conditions
19 * are met:
20 * 1. Redistributions of source code must retain the above copyright
21 * notice, this list of conditions and the following disclaimer.
22 * 2. Redistributions in binary form must reproduce the above copyright
23 * notice, this list of conditions and the following disclaimer in the
24 * documentation and/or other materials provided with the distribution.
25 *
26 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
27 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
28 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
29 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
30 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
31 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
32 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
33 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
34 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
35 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
36 * SUCH DAMAGE.
37 *
|
38 * $FreeBSD: head/sys/security/mac/mac_framework.h 184407 2008-10-28 11:33:06Z rwatson $
| 38 * $FreeBSD: head/sys/security/mac/mac_framework.h 184412 2008-10-28 12:49:07Z rwatson $
|
39 */
40
41/*
42 * Kernel interface for Mandatory Access Control -- how kernel services
43 * interact with the TrustedBSD MAC Framework.
44 */
45
46#ifndef _SECURITY_MAC_MAC_FRAMEWORK_H_
47#define _SECURITY_MAC_MAC_FRAMEWORK_H_
48
49#ifndef _KERNEL
50#error "no user-serviceable parts inside"
51#endif
52
53struct auditinfo;
54struct auditinfo_addr;
55struct bpf_d;
56struct cdev;
57struct componentname;
58struct devfs_dirent;
59struct ifnet;
60struct ifreq;
61struct image_params;
62struct inpcb;
63struct ip6q;
64struct ipq;
65struct ksem;
66struct label;
67struct m_tag;
68struct mac;
69struct mbuf;
70struct mount;
71struct msg;
72struct msqid_kernel;
73struct proc;
74struct semid_kernel;
75struct shmfd;
76struct shmid_kernel;
77struct sockaddr;
78struct socket;
79struct sysctl_oid;
80struct sysctl_req;
81struct pipepair;
82struct thread;
83struct timespec;
84struct ucred;
85struct uio;
86struct vattr;
87struct vnode;
88struct vop_setlabel_args;
89
90#include <sys/acl.h> /* XXX acl_type_t */
91
92/*
93 * Entry points to the TrustedBSD MAC Framework from the remainder of the
94 * kernel: entry points are named based on a principle object type and an
95 * action relating to it. They are sorted alphabetically first by object
96 * type and then action. In some situations, the principle object type is
97 * obvious, and in other cases, less so as multiple objects may be inolved
98 * in the operation.
99 */
100int mac_bpfdesc_check_receive(struct bpf_d *d, struct ifnet *ifp);
101void mac_bpfdesc_create(struct ucred *cred, struct bpf_d *d);
102void mac_bpfdesc_create_mbuf(struct bpf_d *d, struct mbuf *m);
103void mac_bpfdesc_destroy(struct bpf_d *);
104void mac_bpfdesc_init(struct bpf_d *);
105
106void mac_cred_associate_nfsd(struct ucred *cred);
107int mac_cred_check_visible(struct ucred *cr1, struct ucred *cr2);
108void mac_cred_copy(struct ucred *cr1, struct ucred *cr2);
109void mac_cred_create_init(struct ucred *cred);
110void mac_cred_create_swapper(struct ucred *cred);
111void mac_cred_destroy(struct ucred *);
112void mac_cred_init(struct ucred *);
113
114void mac_devfs_create_device(struct ucred *cred, struct mount *mp,
115 struct cdev *dev, struct devfs_dirent *de);
116void mac_devfs_create_directory(struct mount *mp, char *dirname,
117 int dirnamelen, struct devfs_dirent *de);
118void mac_devfs_create_symlink(struct ucred *cred, struct mount *mp,
119 struct devfs_dirent *dd, struct devfs_dirent *de);
120void mac_devfs_destroy(struct devfs_dirent *);
121void mac_devfs_init(struct devfs_dirent *);
122void mac_devfs_update(struct mount *mp, struct devfs_dirent *de,
123 struct vnode *vp);
124void mac_devfs_vnode_associate(struct mount *mp, struct devfs_dirent *de,
125 struct vnode *vp);
126
127int mac_ifnet_check_transmit(struct ifnet *ifp, struct mbuf *m);
128void mac_ifnet_create(struct ifnet *ifp);
129void mac_ifnet_create_mbuf(struct ifnet *ifp, struct mbuf *m);
130void mac_ifnet_destroy(struct ifnet *);
131void mac_ifnet_init(struct ifnet *);
132int mac_ifnet_ioctl_get(struct ucred *cred, struct ifreq *ifr,
133 struct ifnet *ifp);
134int mac_ifnet_ioctl_set(struct ucred *cred, struct ifreq *ifr,
135 struct ifnet *ifp);
136
137int mac_inpcb_check_deliver(struct inpcb *inp, struct mbuf *m);
138int mac_inpcb_check_visible(struct ucred *cred, struct inpcb *inp);
139void mac_inpcb_create(struct socket *so, struct inpcb *inp);
140void mac_inpcb_create_mbuf(struct inpcb *inp, struct mbuf *m);
141void mac_inpcb_destroy(struct inpcb *);
142int mac_inpcb_init(struct inpcb *, int);
143void mac_inpcb_sosetlabel(struct socket *so, struct inpcb *inp);
144
145void mac_ip6q_create(struct mbuf *m, struct ip6q *q6);
146void mac_ip6q_destroy(struct ip6q *q6);
147int mac_ip6q_init(struct ip6q *q6, int);
148int mac_ip6q_match(struct mbuf *m, struct ip6q *q6);
149void mac_ip6q_reassemble(struct ip6q *q6, struct mbuf *m);
150void mac_ip6q_update(struct mbuf *m, struct ip6q *q6);
151
152void mac_ipq_create(struct mbuf *m, struct ipq *q);
153void mac_ipq_destroy(struct ipq *q);
154int mac_ipq_init(struct ipq *q, int);
155int mac_ipq_match(struct mbuf *m, struct ipq *q);
156void mac_ipq_reassemble(struct ipq *q, struct mbuf *m);
157void mac_ipq_update(struct mbuf *m, struct ipq *q);
158
159int mac_kenv_check_dump(struct ucred *cred);
160int mac_kenv_check_get(struct ucred *cred, char *name);
161int mac_kenv_check_set(struct ucred *cred, char *name, char *value);
162int mac_kenv_check_unset(struct ucred *cred, char *name);
163
164int mac_kld_check_load(struct ucred *cred, struct vnode *vp);
165int mac_kld_check_stat(struct ucred *cred);
166
167void mac_mbuf_copy(struct mbuf *, struct mbuf *);
168int mac_mbuf_init(struct mbuf *, int);
169
170void mac_mbuf_tag_copy(struct m_tag *, struct m_tag *);
171void mac_mbuf_tag_destroy(struct m_tag *);
172int mac_mbuf_tag_init(struct m_tag *, int);
173
174int mac_mount_check_stat(struct ucred *cred, struct mount *mp);
175void mac_mount_create(struct ucred *cred, struct mount *mp);
176void mac_mount_destroy(struct mount *);
177void mac_mount_init(struct mount *);
178
179void mac_netatalk_aarp_send(struct ifnet *ifp, struct mbuf *m);
180
181void mac_netinet_arp_send(struct ifnet *ifp, struct mbuf *m);
182void mac_netinet_firewall_reply(struct mbuf *mrecv, struct mbuf *msend);
183void mac_netinet_firewall_send(struct mbuf *m);
184void mac_netinet_fragment(struct mbuf *m, struct mbuf *frag);
185void mac_netinet_icmp_reply(struct mbuf *mrecv, struct mbuf *msend);
186void mac_netinet_icmp_replyinplace(struct mbuf *m);
187void mac_netinet_igmp_send(struct ifnet *ifp, struct mbuf *m);
188void mac_netinet_tcp_reply(struct mbuf *m);
189
190void mac_netinet6_nd6_send(struct ifnet *ifp, struct mbuf *m);
191
192int mac_pipe_check_ioctl(struct ucred *cred, struct pipepair *pp,
193 unsigned long cmd, void *data);
194int mac_pipe_check_poll(struct ucred *cred, struct pipepair *pp);
195int mac_pipe_check_read(struct ucred *cred, struct pipepair *pp);
196int mac_pipe_check_stat(struct ucred *cred, struct pipepair *pp);
197int mac_pipe_check_write(struct ucred *cred, struct pipepair *pp);
198void mac_pipe_create(struct ucred *cred, struct pipepair *pp);
199void mac_pipe_destroy(struct pipepair *);
200void mac_pipe_init(struct pipepair *);
201int mac_pipe_label_set(struct ucred *cred, struct pipepair *pp,
202 struct label *label);
203
204int mac_posixsem_check_getvalue(struct ucred *active_cred,
205 struct ucred *file_cred, struct ksem *ks);
206int mac_posixsem_check_open(struct ucred *cred, struct ksem *ks);
207int mac_posixsem_check_post(struct ucred *active_cred,
208 struct ucred *file_cred, struct ksem *ks);
209int mac_posixsem_check_stat(struct ucred *active_cred,
210 struct ucred *file_cred, struct ksem *ks);
211int mac_posixsem_check_unlink(struct ucred *cred, struct ksem *ks);
212int mac_posixsem_check_wait(struct ucred *active_cred,
213 struct ucred *file_cred, struct ksem *ks);
214void mac_posixsem_create(struct ucred *cred, struct ksem *ks);
215void mac_posixsem_destroy(struct ksem *);
216void mac_posixsem_init(struct ksem *);
217
218int mac_posixshm_check_mmap(struct ucred *cred, struct shmfd *shmfd,
219 int prot, int flags);
220int mac_posixshm_check_open(struct ucred *cred, struct shmfd *shmfd);
221int mac_posixshm_check_stat(struct ucred *active_cred,
222 struct ucred *file_cred, struct shmfd *shmfd);
223int mac_posixshm_check_truncate(struct ucred *active_cred,
224 struct ucred *file_cred, struct shmfd *shmfd);
225int mac_posixshm_check_unlink(struct ucred *cred, struct shmfd *shmfd);
226void mac_posixshm_create(struct ucred *cred, struct shmfd *shmfd);
227void mac_posixshm_destroy(struct shmfd *);
228void mac_posixshm_init(struct shmfd *);
229
230int mac_priv_check(struct ucred *cred, int priv);
231int mac_priv_grant(struct ucred *cred, int priv);
232
233int mac_proc_check_debug(struct ucred *cred, struct proc *p);
234int mac_proc_check_sched(struct ucred *cred, struct proc *p);
235int mac_proc_check_setaudit(struct ucred *cred, struct auditinfo *ai);
236int mac_proc_check_setaudit_addr(struct ucred *cred,
237 struct auditinfo_addr *aia);
238int mac_proc_check_setauid(struct ucred *cred, uid_t auid);
239int mac_proc_check_setegid(struct proc *p, struct ucred *cred,
240 gid_t egid);
241int mac_proc_check_seteuid(struct proc *p, struct ucred *cred,
242 uid_t euid);
243int mac_proc_check_setgid(struct proc *p, struct ucred *cred,
244 gid_t gid);
245int mac_proc_check_setgroups(struct proc *p, struct ucred *cred,
246 int ngroups, gid_t *gidset);
247int mac_proc_check_setregid(struct proc *p, struct ucred *cred,
248 gid_t rgid, gid_t egid);
249int mac_proc_check_setresgid(struct proc *p, struct ucred *cred,
250 gid_t rgid, gid_t egid, gid_t sgid);
251int mac_proc_check_setresuid(struct proc *p, struct ucred *cred,
252 uid_t ruid, uid_t euid, uid_t suid);
253int mac_proc_check_setreuid(struct proc *p, struct ucred *cred,
254 uid_t ruid, uid_t euid);
255int mac_proc_check_setuid(struct proc *p, struct ucred *cred,
256 uid_t uid);
257int mac_proc_check_signal(struct ucred *cred, struct proc *p,
258 int signum);
259int mac_proc_check_wait(struct ucred *cred, struct proc *p);
260void mac_proc_destroy(struct proc *);
261void mac_proc_init(struct proc *);
| 39 */
40
41/*
42 * Kernel interface for Mandatory Access Control -- how kernel services
43 * interact with the TrustedBSD MAC Framework.
44 */
45
46#ifndef _SECURITY_MAC_MAC_FRAMEWORK_H_
47#define _SECURITY_MAC_MAC_FRAMEWORK_H_
48
49#ifndef _KERNEL
50#error "no user-serviceable parts inside"
51#endif
52
53struct auditinfo;
54struct auditinfo_addr;
55struct bpf_d;
56struct cdev;
57struct componentname;
58struct devfs_dirent;
59struct ifnet;
60struct ifreq;
61struct image_params;
62struct inpcb;
63struct ip6q;
64struct ipq;
65struct ksem;
66struct label;
67struct m_tag;
68struct mac;
69struct mbuf;
70struct mount;
71struct msg;
72struct msqid_kernel;
73struct proc;
74struct semid_kernel;
75struct shmfd;
76struct shmid_kernel;
77struct sockaddr;
78struct socket;
79struct sysctl_oid;
80struct sysctl_req;
81struct pipepair;
82struct thread;
83struct timespec;
84struct ucred;
85struct uio;
86struct vattr;
87struct vnode;
88struct vop_setlabel_args;
89
90#include <sys/acl.h> /* XXX acl_type_t */
91
92/*
93 * Entry points to the TrustedBSD MAC Framework from the remainder of the
94 * kernel: entry points are named based on a principle object type and an
95 * action relating to it. They are sorted alphabetically first by object
96 * type and then action. In some situations, the principle object type is
97 * obvious, and in other cases, less so as multiple objects may be inolved
98 * in the operation.
99 */
100int mac_bpfdesc_check_receive(struct bpf_d *d, struct ifnet *ifp);
101void mac_bpfdesc_create(struct ucred *cred, struct bpf_d *d);
102void mac_bpfdesc_create_mbuf(struct bpf_d *d, struct mbuf *m);
103void mac_bpfdesc_destroy(struct bpf_d *);
104void mac_bpfdesc_init(struct bpf_d *);
105
106void mac_cred_associate_nfsd(struct ucred *cred);
107int mac_cred_check_visible(struct ucred *cr1, struct ucred *cr2);
108void mac_cred_copy(struct ucred *cr1, struct ucred *cr2);
109void mac_cred_create_init(struct ucred *cred);
110void mac_cred_create_swapper(struct ucred *cred);
111void mac_cred_destroy(struct ucred *);
112void mac_cred_init(struct ucred *);
113
114void mac_devfs_create_device(struct ucred *cred, struct mount *mp,
115 struct cdev *dev, struct devfs_dirent *de);
116void mac_devfs_create_directory(struct mount *mp, char *dirname,
117 int dirnamelen, struct devfs_dirent *de);
118void mac_devfs_create_symlink(struct ucred *cred, struct mount *mp,
119 struct devfs_dirent *dd, struct devfs_dirent *de);
120void mac_devfs_destroy(struct devfs_dirent *);
121void mac_devfs_init(struct devfs_dirent *);
122void mac_devfs_update(struct mount *mp, struct devfs_dirent *de,
123 struct vnode *vp);
124void mac_devfs_vnode_associate(struct mount *mp, struct devfs_dirent *de,
125 struct vnode *vp);
126
127int mac_ifnet_check_transmit(struct ifnet *ifp, struct mbuf *m);
128void mac_ifnet_create(struct ifnet *ifp);
129void mac_ifnet_create_mbuf(struct ifnet *ifp, struct mbuf *m);
130void mac_ifnet_destroy(struct ifnet *);
131void mac_ifnet_init(struct ifnet *);
132int mac_ifnet_ioctl_get(struct ucred *cred, struct ifreq *ifr,
133 struct ifnet *ifp);
134int mac_ifnet_ioctl_set(struct ucred *cred, struct ifreq *ifr,
135 struct ifnet *ifp);
136
137int mac_inpcb_check_deliver(struct inpcb *inp, struct mbuf *m);
138int mac_inpcb_check_visible(struct ucred *cred, struct inpcb *inp);
139void mac_inpcb_create(struct socket *so, struct inpcb *inp);
140void mac_inpcb_create_mbuf(struct inpcb *inp, struct mbuf *m);
141void mac_inpcb_destroy(struct inpcb *);
142int mac_inpcb_init(struct inpcb *, int);
143void mac_inpcb_sosetlabel(struct socket *so, struct inpcb *inp);
144
145void mac_ip6q_create(struct mbuf *m, struct ip6q *q6);
146void mac_ip6q_destroy(struct ip6q *q6);
147int mac_ip6q_init(struct ip6q *q6, int);
148int mac_ip6q_match(struct mbuf *m, struct ip6q *q6);
149void mac_ip6q_reassemble(struct ip6q *q6, struct mbuf *m);
150void mac_ip6q_update(struct mbuf *m, struct ip6q *q6);
151
152void mac_ipq_create(struct mbuf *m, struct ipq *q);
153void mac_ipq_destroy(struct ipq *q);
154int mac_ipq_init(struct ipq *q, int);
155int mac_ipq_match(struct mbuf *m, struct ipq *q);
156void mac_ipq_reassemble(struct ipq *q, struct mbuf *m);
157void mac_ipq_update(struct mbuf *m, struct ipq *q);
158
159int mac_kenv_check_dump(struct ucred *cred);
160int mac_kenv_check_get(struct ucred *cred, char *name);
161int mac_kenv_check_set(struct ucred *cred, char *name, char *value);
162int mac_kenv_check_unset(struct ucred *cred, char *name);
163
164int mac_kld_check_load(struct ucred *cred, struct vnode *vp);
165int mac_kld_check_stat(struct ucred *cred);
166
167void mac_mbuf_copy(struct mbuf *, struct mbuf *);
168int mac_mbuf_init(struct mbuf *, int);
169
170void mac_mbuf_tag_copy(struct m_tag *, struct m_tag *);
171void mac_mbuf_tag_destroy(struct m_tag *);
172int mac_mbuf_tag_init(struct m_tag *, int);
173
174int mac_mount_check_stat(struct ucred *cred, struct mount *mp);
175void mac_mount_create(struct ucred *cred, struct mount *mp);
176void mac_mount_destroy(struct mount *);
177void mac_mount_init(struct mount *);
178
179void mac_netatalk_aarp_send(struct ifnet *ifp, struct mbuf *m);
180
181void mac_netinet_arp_send(struct ifnet *ifp, struct mbuf *m);
182void mac_netinet_firewall_reply(struct mbuf *mrecv, struct mbuf *msend);
183void mac_netinet_firewall_send(struct mbuf *m);
184void mac_netinet_fragment(struct mbuf *m, struct mbuf *frag);
185void mac_netinet_icmp_reply(struct mbuf *mrecv, struct mbuf *msend);
186void mac_netinet_icmp_replyinplace(struct mbuf *m);
187void mac_netinet_igmp_send(struct ifnet *ifp, struct mbuf *m);
188void mac_netinet_tcp_reply(struct mbuf *m);
189
190void mac_netinet6_nd6_send(struct ifnet *ifp, struct mbuf *m);
191
192int mac_pipe_check_ioctl(struct ucred *cred, struct pipepair *pp,
193 unsigned long cmd, void *data);
194int mac_pipe_check_poll(struct ucred *cred, struct pipepair *pp);
195int mac_pipe_check_read(struct ucred *cred, struct pipepair *pp);
196int mac_pipe_check_stat(struct ucred *cred, struct pipepair *pp);
197int mac_pipe_check_write(struct ucred *cred, struct pipepair *pp);
198void mac_pipe_create(struct ucred *cred, struct pipepair *pp);
199void mac_pipe_destroy(struct pipepair *);
200void mac_pipe_init(struct pipepair *);
201int mac_pipe_label_set(struct ucred *cred, struct pipepair *pp,
202 struct label *label);
203
204int mac_posixsem_check_getvalue(struct ucred *active_cred,
205 struct ucred *file_cred, struct ksem *ks);
206int mac_posixsem_check_open(struct ucred *cred, struct ksem *ks);
207int mac_posixsem_check_post(struct ucred *active_cred,
208 struct ucred *file_cred, struct ksem *ks);
209int mac_posixsem_check_stat(struct ucred *active_cred,
210 struct ucred *file_cred, struct ksem *ks);
211int mac_posixsem_check_unlink(struct ucred *cred, struct ksem *ks);
212int mac_posixsem_check_wait(struct ucred *active_cred,
213 struct ucred *file_cred, struct ksem *ks);
214void mac_posixsem_create(struct ucred *cred, struct ksem *ks);
215void mac_posixsem_destroy(struct ksem *);
216void mac_posixsem_init(struct ksem *);
217
218int mac_posixshm_check_mmap(struct ucred *cred, struct shmfd *shmfd,
219 int prot, int flags);
220int mac_posixshm_check_open(struct ucred *cred, struct shmfd *shmfd);
221int mac_posixshm_check_stat(struct ucred *active_cred,
222 struct ucred *file_cred, struct shmfd *shmfd);
223int mac_posixshm_check_truncate(struct ucred *active_cred,
224 struct ucred *file_cred, struct shmfd *shmfd);
225int mac_posixshm_check_unlink(struct ucred *cred, struct shmfd *shmfd);
226void mac_posixshm_create(struct ucred *cred, struct shmfd *shmfd);
227void mac_posixshm_destroy(struct shmfd *);
228void mac_posixshm_init(struct shmfd *);
229
230int mac_priv_check(struct ucred *cred, int priv);
231int mac_priv_grant(struct ucred *cred, int priv);
232
233int mac_proc_check_debug(struct ucred *cred, struct proc *p);
234int mac_proc_check_sched(struct ucred *cred, struct proc *p);
235int mac_proc_check_setaudit(struct ucred *cred, struct auditinfo *ai);
236int mac_proc_check_setaudit_addr(struct ucred *cred,
237 struct auditinfo_addr *aia);
238int mac_proc_check_setauid(struct ucred *cred, uid_t auid);
239int mac_proc_check_setegid(struct proc *p, struct ucred *cred,
240 gid_t egid);
241int mac_proc_check_seteuid(struct proc *p, struct ucred *cred,
242 uid_t euid);
243int mac_proc_check_setgid(struct proc *p, struct ucred *cred,
244 gid_t gid);
245int mac_proc_check_setgroups(struct proc *p, struct ucred *cred,
246 int ngroups, gid_t *gidset);
247int mac_proc_check_setregid(struct proc *p, struct ucred *cred,
248 gid_t rgid, gid_t egid);
249int mac_proc_check_setresgid(struct proc *p, struct ucred *cred,
250 gid_t rgid, gid_t egid, gid_t sgid);
251int mac_proc_check_setresuid(struct proc *p, struct ucred *cred,
252 uid_t ruid, uid_t euid, uid_t suid);
253int mac_proc_check_setreuid(struct proc *p, struct ucred *cred,
254 uid_t ruid, uid_t euid);
255int mac_proc_check_setuid(struct proc *p, struct ucred *cred,
256 uid_t uid);
257int mac_proc_check_signal(struct ucred *cred, struct proc *p,
258 int signum);
259int mac_proc_check_wait(struct ucred *cred, struct proc *p);
260void mac_proc_destroy(struct proc *);
261void mac_proc_init(struct proc *);
|
| 262void mac_proc_vm_revoke(struct thread *td);
|
262int mac_execve_enter(struct image_params *imgp, struct mac *mac_p);
263void mac_execve_exit(struct image_params *imgp);
264void mac_execve_interpreter_enter(struct vnode *interpvp,
265 struct label **interplabel);
266void mac_execve_interpreter_exit(struct label *interpvplabel);
267
268int mac_socket_check_accept(struct ucred *cred, struct socket *so);
269int mac_socket_check_bind(struct ucred *cred, struct socket *so,
270 struct sockaddr *sa);
271int mac_socket_check_connect(struct ucred *cred, struct socket *so,
272 struct sockaddr *sa);
273int mac_socket_check_create(struct ucred *cred, int domain, int type,
274 int proto);
275int mac_socket_check_deliver(struct socket *so, struct mbuf *m);
276int mac_socket_check_listen(struct ucred *cred, struct socket *so);
277int mac_socket_check_poll(struct ucred *cred, struct socket *so);
278int mac_socket_check_receive(struct ucred *cred, struct socket *so);
279int mac_socket_check_send(struct ucred *cred, struct socket *so);
280int mac_socket_check_stat(struct ucred *cred, struct socket *so);
281int mac_socket_check_visible(struct ucred *cred, struct socket *so);
282void mac_socket_create_mbuf(struct socket *so, struct mbuf *m);
283void mac_socket_create(struct ucred *cred, struct socket *so);
284void mac_socket_destroy(struct socket *);
285int mac_socket_init(struct socket *, int);
286void mac_socket_newconn(struct socket *oldso, struct socket *newso);
287int mac_getsockopt_label(struct ucred *cred, struct socket *so,
288 struct mac *extmac);
289int mac_getsockopt_peerlabel(struct ucred *cred, struct socket *so,
290 struct mac *extmac);
291int mac_setsockopt_label(struct ucred *cred, struct socket *so,
292 struct mac *extmac);
293
294void mac_socketpeer_set_from_mbuf(struct mbuf *m, struct socket *so);
295void mac_socketpeer_set_from_socket(struct socket *oldso,
296 struct socket *newso);
297
298void mac_syncache_create(struct label *l, struct inpcb *inp);
299void mac_syncache_create_mbuf(struct label *l, struct mbuf *m);
300void mac_syncache_destroy(struct label **l);
301int mac_syncache_init(struct label **l);
302
303int mac_system_check_acct(struct ucred *cred, struct vnode *vp);
304int mac_system_check_audit(struct ucred *cred, void *record, int length);
305int mac_system_check_auditctl(struct ucred *cred, struct vnode *vp);
306int mac_system_check_auditon(struct ucred *cred, int cmd);
307int mac_system_check_reboot(struct ucred *cred, int howto);
308int mac_system_check_swapon(struct ucred *cred, struct vnode *vp);
309int mac_system_check_swapoff(struct ucred *cred, struct vnode *vp);
310int mac_system_check_sysctl(struct ucred *cred, struct sysctl_oid *oidp,
311 void *arg1, int arg2, struct sysctl_req *req);
312
313void mac_sysvmsg_cleanup(struct msg *msgptr);
314void mac_sysvmsg_create(struct ucred *cred, struct msqid_kernel *msqkptr,
315 struct msg *msgptr);
316void mac_sysvmsg_destroy(struct msg *);
317void mac_sysvmsg_init(struct msg *);
318
319int mac_sysvmsq_check_msgmsq(struct ucred *cred, struct msg *msgptr,
320 struct msqid_kernel *msqkptr);
321int mac_sysvmsq_check_msgrcv(struct ucred *cred, struct msg *msgptr);
322int mac_sysvmsq_check_msgrmid(struct ucred *cred, struct msg *msgptr);
323int mac_sysvmsq_check_msqctl(struct ucred *cred,
324 struct msqid_kernel *msqkptr, int cmd);
325int mac_sysvmsq_check_msqget(struct ucred *cred,
326 struct msqid_kernel *msqkptr);
327int mac_sysvmsq_check_msqrcv(struct ucred *cred,
328 struct msqid_kernel *msqkptr);
329int mac_sysvmsq_check_msqsnd(struct ucred *cred,
330 struct msqid_kernel *msqkptr);
331void mac_sysvmsq_cleanup(struct msqid_kernel *msqkptr);
332void mac_sysvmsq_create(struct ucred *cred, struct msqid_kernel *msqkptr);
333void mac_sysvmsq_destroy(struct msqid_kernel *);
334void mac_sysvmsq_init(struct msqid_kernel *);
335
336int mac_sysvsem_check_semctl(struct ucred *cred,
337 struct semid_kernel *semakptr, int cmd);
338int mac_sysvsem_check_semget(struct ucred *cred,
339 struct semid_kernel *semakptr);
340int mac_sysvsem_check_semop(struct ucred *cred,
341 struct semid_kernel *semakptr, size_t accesstype);
342void mac_sysvsem_cleanup(struct semid_kernel *semakptr);
343void mac_sysvsem_create(struct ucred *cred,
344 struct semid_kernel *semakptr);
345void mac_sysvsem_destroy(struct semid_kernel *);
346void mac_sysvsem_init(struct semid_kernel *);
347
348int mac_sysvshm_check_shmat(struct ucred *cred,
349 struct shmid_kernel *shmsegptr, int shmflg);
350int mac_sysvshm_check_shmctl(struct ucred *cred,
351 struct shmid_kernel *shmsegptr, int cmd);
352int mac_sysvshm_check_shmdt(struct ucred *cred,
353 struct shmid_kernel *shmsegptr);
354int mac_sysvshm_check_shmget(struct ucred *cred,
355 struct shmid_kernel *shmsegptr, int shmflg);
356void mac_sysvshm_cleanup(struct shmid_kernel *shmsegptr);
357void mac_sysvshm_create(struct ucred *cred,
358 struct shmid_kernel *shmsegptr);
359void mac_sysvshm_destroy(struct shmid_kernel *);
360void mac_sysvshm_init(struct shmid_kernel *);
361
362void mac_thread_userret(struct thread *td);
363
364int mac_vnode_associate_extattr(struct mount *mp, struct vnode *vp);
365void mac_vnode_associate_singlelabel(struct mount *mp, struct vnode *vp);
366int mac_vnode_check_access(struct ucred *cred, struct vnode *vp,
367 int acc_mode);
368int mac_vnode_check_chdir(struct ucred *cred, struct vnode *dvp);
369int mac_vnode_check_chroot(struct ucred *cred, struct vnode *dvp);
370int mac_vnode_check_create(struct ucred *cred, struct vnode *dvp,
371 struct componentname *cnp, struct vattr *vap);
372int mac_vnode_check_deleteacl(struct ucred *cred, struct vnode *vp,
373 acl_type_t type);
374int mac_vnode_check_deleteextattr(struct ucred *cred, struct vnode *vp,
375 int attrnamespace, const char *name);
376int mac_vnode_check_exec(struct ucred *cred, struct vnode *vp,
377 struct image_params *imgp);
378int mac_vnode_check_getacl(struct ucred *cred, struct vnode *vp,
379 acl_type_t type);
380int mac_vnode_check_getextattr(struct ucred *cred, struct vnode *vp,
381 int attrnamespace, const char *name, struct uio *uio);
382int mac_vnode_check_link(struct ucred *cred, struct vnode *dvp,
383 struct vnode *vp, struct componentname *cnp);
384int mac_vnode_check_listextattr(struct ucred *cred, struct vnode *vp,
385 int attrnamespace);
386int mac_vnode_check_lookup(struct ucred *cred, struct vnode *dvp,
387 struct componentname *cnp);
388int mac_vnode_check_mmap(struct ucred *cred, struct vnode *vp, int prot,
389 int flags);
390int mac_vnode_check_mprotect(struct ucred *cred, struct vnode *vp,
391 int prot);
392int mac_vnode_check_open(struct ucred *cred, struct vnode *vp,
393 int acc_mode);
394int mac_vnode_check_poll(struct ucred *active_cred,
395 struct ucred *file_cred, struct vnode *vp);
396int mac_vnode_check_read(struct ucred *active_cred,
397 struct ucred *file_cred, struct vnode *vp);
398int mac_vnode_check_readdir(struct ucred *cred, struct vnode *vp);
399int mac_vnode_check_readlink(struct ucred *cred, struct vnode *vp);
400int mac_vnode_check_rename_from(struct ucred *cred, struct vnode *dvp,
401 struct vnode *vp, struct componentname *cnp);
402int mac_vnode_check_rename_to(struct ucred *cred, struct vnode *dvp,
403 struct vnode *vp, int samedir, struct componentname *cnp);
404int mac_vnode_check_revoke(struct ucred *cred, struct vnode *vp);
405int mac_vnode_check_setacl(struct ucred *cred, struct vnode *vp,
406 acl_type_t type, struct acl *acl);
407int mac_vnode_check_setextattr(struct ucred *cred, struct vnode *vp,
408 int attrnamespace, const char *name, struct uio *uio);
409int mac_vnode_check_setflags(struct ucred *cred, struct vnode *vp,
410 u_long flags);
411int mac_vnode_check_setmode(struct ucred *cred, struct vnode *vp,
412 mode_t mode);
413int mac_vnode_check_setowner(struct ucred *cred, struct vnode *vp,
414 uid_t uid, gid_t gid);
415int mac_vnode_check_setutimes(struct ucred *cred, struct vnode *vp,
416 struct timespec atime, struct timespec mtime);
417int mac_vnode_check_stat(struct ucred *active_cred,
418 struct ucred *file_cred, struct vnode *vp);
419int mac_vnode_check_unlink(struct ucred *cred, struct vnode *dvp,
420 struct vnode *vp, struct componentname *cnp);
421int mac_vnode_check_write(struct ucred *active_cred,
422 struct ucred *file_cred, struct vnode *vp);
423void mac_vnode_copy_label(struct label *, struct label *);
424void mac_vnode_init(struct vnode *);
425int mac_vnode_create_extattr(struct ucred *cred, struct mount *mp,
426 struct vnode *dvp, struct vnode *vp, struct componentname *cnp);
427void mac_vnode_destroy(struct vnode *);
428void mac_vnode_execve_transition(struct ucred *oldcred,
429 struct ucred *newcred, struct vnode *vp,
430 struct label *interpvplabel, struct image_params *imgp);
431int mac_vnode_execve_will_transition(struct ucred *cred,
432 struct vnode *vp, struct label *interpvplabel,
433 struct image_params *imgp);
434void mac_vnode_relabel(struct ucred *cred, struct vnode *vp,
435 struct label *newlabel);
436
| 263int mac_execve_enter(struct image_params *imgp, struct mac *mac_p);
264void mac_execve_exit(struct image_params *imgp);
265void mac_execve_interpreter_enter(struct vnode *interpvp,
266 struct label **interplabel);
267void mac_execve_interpreter_exit(struct label *interpvplabel);
268
269int mac_socket_check_accept(struct ucred *cred, struct socket *so);
270int mac_socket_check_bind(struct ucred *cred, struct socket *so,
271 struct sockaddr *sa);
272int mac_socket_check_connect(struct ucred *cred, struct socket *so,
273 struct sockaddr *sa);
274int mac_socket_check_create(struct ucred *cred, int domain, int type,
275 int proto);
276int mac_socket_check_deliver(struct socket *so, struct mbuf *m);
277int mac_socket_check_listen(struct ucred *cred, struct socket *so);
278int mac_socket_check_poll(struct ucred *cred, struct socket *so);
279int mac_socket_check_receive(struct ucred *cred, struct socket *so);
280int mac_socket_check_send(struct ucred *cred, struct socket *so);
281int mac_socket_check_stat(struct ucred *cred, struct socket *so);
282int mac_socket_check_visible(struct ucred *cred, struct socket *so);
283void mac_socket_create_mbuf(struct socket *so, struct mbuf *m);
284void mac_socket_create(struct ucred *cred, struct socket *so);
285void mac_socket_destroy(struct socket *);
286int mac_socket_init(struct socket *, int);
287void mac_socket_newconn(struct socket *oldso, struct socket *newso);
288int mac_getsockopt_label(struct ucred *cred, struct socket *so,
289 struct mac *extmac);
290int mac_getsockopt_peerlabel(struct ucred *cred, struct socket *so,
291 struct mac *extmac);
292int mac_setsockopt_label(struct ucred *cred, struct socket *so,
293 struct mac *extmac);
294
295void mac_socketpeer_set_from_mbuf(struct mbuf *m, struct socket *so);
296void mac_socketpeer_set_from_socket(struct socket *oldso,
297 struct socket *newso);
298
299void mac_syncache_create(struct label *l, struct inpcb *inp);
300void mac_syncache_create_mbuf(struct label *l, struct mbuf *m);
301void mac_syncache_destroy(struct label **l);
302int mac_syncache_init(struct label **l);
303
304int mac_system_check_acct(struct ucred *cred, struct vnode *vp);
305int mac_system_check_audit(struct ucred *cred, void *record, int length);
306int mac_system_check_auditctl(struct ucred *cred, struct vnode *vp);
307int mac_system_check_auditon(struct ucred *cred, int cmd);
308int mac_system_check_reboot(struct ucred *cred, int howto);
309int mac_system_check_swapon(struct ucred *cred, struct vnode *vp);
310int mac_system_check_swapoff(struct ucred *cred, struct vnode *vp);
311int mac_system_check_sysctl(struct ucred *cred, struct sysctl_oid *oidp,
312 void *arg1, int arg2, struct sysctl_req *req);
313
314void mac_sysvmsg_cleanup(struct msg *msgptr);
315void mac_sysvmsg_create(struct ucred *cred, struct msqid_kernel *msqkptr,
316 struct msg *msgptr);
317void mac_sysvmsg_destroy(struct msg *);
318void mac_sysvmsg_init(struct msg *);
319
320int mac_sysvmsq_check_msgmsq(struct ucred *cred, struct msg *msgptr,
321 struct msqid_kernel *msqkptr);
322int mac_sysvmsq_check_msgrcv(struct ucred *cred, struct msg *msgptr);
323int mac_sysvmsq_check_msgrmid(struct ucred *cred, struct msg *msgptr);
324int mac_sysvmsq_check_msqctl(struct ucred *cred,
325 struct msqid_kernel *msqkptr, int cmd);
326int mac_sysvmsq_check_msqget(struct ucred *cred,
327 struct msqid_kernel *msqkptr);
328int mac_sysvmsq_check_msqrcv(struct ucred *cred,
329 struct msqid_kernel *msqkptr);
330int mac_sysvmsq_check_msqsnd(struct ucred *cred,
331 struct msqid_kernel *msqkptr);
332void mac_sysvmsq_cleanup(struct msqid_kernel *msqkptr);
333void mac_sysvmsq_create(struct ucred *cred, struct msqid_kernel *msqkptr);
334void mac_sysvmsq_destroy(struct msqid_kernel *);
335void mac_sysvmsq_init(struct msqid_kernel *);
336
337int mac_sysvsem_check_semctl(struct ucred *cred,
338 struct semid_kernel *semakptr, int cmd);
339int mac_sysvsem_check_semget(struct ucred *cred,
340 struct semid_kernel *semakptr);
341int mac_sysvsem_check_semop(struct ucred *cred,
342 struct semid_kernel *semakptr, size_t accesstype);
343void mac_sysvsem_cleanup(struct semid_kernel *semakptr);
344void mac_sysvsem_create(struct ucred *cred,
345 struct semid_kernel *semakptr);
346void mac_sysvsem_destroy(struct semid_kernel *);
347void mac_sysvsem_init(struct semid_kernel *);
348
349int mac_sysvshm_check_shmat(struct ucred *cred,
350 struct shmid_kernel *shmsegptr, int shmflg);
351int mac_sysvshm_check_shmctl(struct ucred *cred,
352 struct shmid_kernel *shmsegptr, int cmd);
353int mac_sysvshm_check_shmdt(struct ucred *cred,
354 struct shmid_kernel *shmsegptr);
355int mac_sysvshm_check_shmget(struct ucred *cred,
356 struct shmid_kernel *shmsegptr, int shmflg);
357void mac_sysvshm_cleanup(struct shmid_kernel *shmsegptr);
358void mac_sysvshm_create(struct ucred *cred,
359 struct shmid_kernel *shmsegptr);
360void mac_sysvshm_destroy(struct shmid_kernel *);
361void mac_sysvshm_init(struct shmid_kernel *);
362
363void mac_thread_userret(struct thread *td);
364
365int mac_vnode_associate_extattr(struct mount *mp, struct vnode *vp);
366void mac_vnode_associate_singlelabel(struct mount *mp, struct vnode *vp);
367int mac_vnode_check_access(struct ucred *cred, struct vnode *vp,
368 int acc_mode);
369int mac_vnode_check_chdir(struct ucred *cred, struct vnode *dvp);
370int mac_vnode_check_chroot(struct ucred *cred, struct vnode *dvp);
371int mac_vnode_check_create(struct ucred *cred, struct vnode *dvp,
372 struct componentname *cnp, struct vattr *vap);
373int mac_vnode_check_deleteacl(struct ucred *cred, struct vnode *vp,
374 acl_type_t type);
375int mac_vnode_check_deleteextattr(struct ucred *cred, struct vnode *vp,
376 int attrnamespace, const char *name);
377int mac_vnode_check_exec(struct ucred *cred, struct vnode *vp,
378 struct image_params *imgp);
379int mac_vnode_check_getacl(struct ucred *cred, struct vnode *vp,
380 acl_type_t type);
381int mac_vnode_check_getextattr(struct ucred *cred, struct vnode *vp,
382 int attrnamespace, const char *name, struct uio *uio);
383int mac_vnode_check_link(struct ucred *cred, struct vnode *dvp,
384 struct vnode *vp, struct componentname *cnp);
385int mac_vnode_check_listextattr(struct ucred *cred, struct vnode *vp,
386 int attrnamespace);
387int mac_vnode_check_lookup(struct ucred *cred, struct vnode *dvp,
388 struct componentname *cnp);
389int mac_vnode_check_mmap(struct ucred *cred, struct vnode *vp, int prot,
390 int flags);
391int mac_vnode_check_mprotect(struct ucred *cred, struct vnode *vp,
392 int prot);
393int mac_vnode_check_open(struct ucred *cred, struct vnode *vp,
394 int acc_mode);
395int mac_vnode_check_poll(struct ucred *active_cred,
396 struct ucred *file_cred, struct vnode *vp);
397int mac_vnode_check_read(struct ucred *active_cred,
398 struct ucred *file_cred, struct vnode *vp);
399int mac_vnode_check_readdir(struct ucred *cred, struct vnode *vp);
400int mac_vnode_check_readlink(struct ucred *cred, struct vnode *vp);
401int mac_vnode_check_rename_from(struct ucred *cred, struct vnode *dvp,
402 struct vnode *vp, struct componentname *cnp);
403int mac_vnode_check_rename_to(struct ucred *cred, struct vnode *dvp,
404 struct vnode *vp, int samedir, struct componentname *cnp);
405int mac_vnode_check_revoke(struct ucred *cred, struct vnode *vp);
406int mac_vnode_check_setacl(struct ucred *cred, struct vnode *vp,
407 acl_type_t type, struct acl *acl);
408int mac_vnode_check_setextattr(struct ucred *cred, struct vnode *vp,
409 int attrnamespace, const char *name, struct uio *uio);
410int mac_vnode_check_setflags(struct ucred *cred, struct vnode *vp,
411 u_long flags);
412int mac_vnode_check_setmode(struct ucred *cred, struct vnode *vp,
413 mode_t mode);
414int mac_vnode_check_setowner(struct ucred *cred, struct vnode *vp,
415 uid_t uid, gid_t gid);
416int mac_vnode_check_setutimes(struct ucred *cred, struct vnode *vp,
417 struct timespec atime, struct timespec mtime);
418int mac_vnode_check_stat(struct ucred *active_cred,
419 struct ucred *file_cred, struct vnode *vp);
420int mac_vnode_check_unlink(struct ucred *cred, struct vnode *dvp,
421 struct vnode *vp, struct componentname *cnp);
422int mac_vnode_check_write(struct ucred *active_cred,
423 struct ucred *file_cred, struct vnode *vp);
424void mac_vnode_copy_label(struct label *, struct label *);
425void mac_vnode_init(struct vnode *);
426int mac_vnode_create_extattr(struct ucred *cred, struct mount *mp,
427 struct vnode *dvp, struct vnode *vp, struct componentname *cnp);
428void mac_vnode_destroy(struct vnode *);
429void mac_vnode_execve_transition(struct ucred *oldcred,
430 struct ucred *newcred, struct vnode *vp,
431 struct label *interpvplabel, struct image_params *imgp);
432int mac_vnode_execve_will_transition(struct ucred *cred,
433 struct vnode *vp, struct label *interpvplabel,
434 struct image_params *imgp);
435void mac_vnode_relabel(struct ucred *cred, struct vnode *vp,
436 struct label *newlabel);
437
|
437void mac_cred_mmapped_drop_perms(struct thread *td, struct ucred *cred);
438
| |
439/*
440 * Calls to help various file systems implement labeling functionality using
441 * their existing EA implementation.
442 */
443int vop_stdsetlabel_ea(struct vop_setlabel_args *ap);
444
445#endif /* !_SECURITY_MAC_MAC_FRAMEWORK_H_ */
| 438/*
439 * Calls to help various file systems implement labeling functionality using
440 * their existing EA implementation.
441 */
442int vop_stdsetlabel_ea(struct vop_setlabel_args *ap);
443
444#endif /* !_SECURITY_MAC_MAC_FRAMEWORK_H_ */
|