Cross Reference: /freebsd-10.3-release/sys/security/mac/mac_policy.h

Deleted Added

sdiff udiff text old ( 122875 ) new ( 123173 )

full compact

mac_policy.h (122875)	mac_policy.h (123173)
1/- 2 Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson 3 * Copyright (c) 2001, 2002, 2003 Networks Associates Technology, Inc. 4 * All rights reserved. 5 * 6 * This software was developed by Robert Watson for the TrustedBSD Project. 7 * 8 * This software was developed for the FreeBSD Project in part by Network 9 * Associates Laboratories, the Security Research Division of Network 10 * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), 11 * as part of the DARPA CHATS research program. 12 * 13 * Redistribution and use in source and binary forms, with or without 14 * modification, are permitted provided that the following conditions 15 * are met: 16 * 1. Redistributions of source code must retain the above copyright 17 * notice, this list of conditions and the following disclaimer. 18 * 2. Redistributions in binary form must reproduce the above copyright 19 * notice, this list of conditions and the following disclaimer in the 20 * documentation and/or other materials provided with the distribution. 21 * 22 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 23 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 24 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 25 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 26 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 27 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 28 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 29 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 30 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 31 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 32 * SUCH DAMAGE. 33 *	1/- 2 Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson 3 * Copyright (c) 2001, 2002, 2003 Networks Associates Technology, Inc. 4 * All rights reserved. 5 * 6 * This software was developed by Robert Watson for the TrustedBSD Project. 7 * 8 * This software was developed for the FreeBSD Project in part by Network 9 * Associates Laboratories, the Security Research Division of Network 10 * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), 11 * as part of the DARPA CHATS research program. 12 * 13 * Redistribution and use in source and binary forms, with or without 14 * modification, are permitted provided that the following conditions 15 * are met: 16 * 1. Redistributions of source code must retain the above copyright 17 * notice, this list of conditions and the following disclaimer. 18 * 2. Redistributions in binary form must reproduce the above copyright 19 * notice, this list of conditions and the following disclaimer in the 20 * documentation and/or other materials provided with the distribution. 21 * 22 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 23 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 24 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 25 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 26 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 27 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 28 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 29 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 30 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 31 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 32 * SUCH DAMAGE. 33 *
34 * $FreeBSD: head/sys/security/mac/mac_policy.h 122875 2003-11-18 00:39:07Z rwatson $	34 * $FreeBSD: head/sys/security/mac/mac_policy.h 123173 2003-12-06 21:48:03Z rwatson $
35 / 36/ 37 * Kernel interface for MAC policy modules. 38 / 39#ifndef _SYS_MAC_POLICY_H 40#define _SYS_MAC_POLICY_H 41 42/- 43 * Pluggable access control policy definition structure. 44 * 45 * List of operations that are performed as part of the implementation 46 * of a MAC policy. Policy implementors declare operations with a 47 * mac_policy_ops structure, and using the MAC_POLICY_SET() macro. 48 * If an entry point is not declared, then then the policy will be ignored 49 * during evaluation of that event or check. 50 * 51 * Operations are sorted first by general class of operation, then 52 * alphabetically. 53 / 54struct acl; 55struct componentname; 56struct devfs_dirent; 57struct inpcb; 58struct ipq; 59struct label; 60struct mac_policy_conf; 61struct mbuf; 62struct mount; 63struct pipe; 64struct sbuf; 65struct socket; 66struct ucred; 67struct uio; 68struct vnode; 69struct mac_policy_ops { 70 / 71 * Policy module operations. 72 / 73 void (mpo_destroy)(struct mac_policy_conf mpc); 74 void (mpo_init)(struct mac_policy_conf mpc); 75 76 / 77 * General policy-directed security system call so that policies 78 * may implement new services without reserving explicit 79 * system call numbers. 80 / 81 int (mpo_syscall)(struct thread td, int call, void arg); 82 83 /* 84 * Label operations. 85 / 86 void (mpo_init_bpfdesc_label)(struct label label); 87 void (mpo_init_cred_label)(struct label label); 88 void (mpo_init_devfsdirent_label)(struct label label); 89 void (mpo_init_ifnet_label)(struct label label); 90 int (mpo_init_inpcb_label)(struct label label, int flag); 91 int (mpo_init_ipq_label)(struct label label, int flag); 92 int (mpo_init_mbuf_label)(struct label label, int flag); 93 void (mpo_init_mount_label)(struct label label); 94 void (mpo_init_mount_fs_label)(struct label label); 95 int (mpo_init_socket_label)(struct label label, int flag); 96 int (mpo_init_socket_peer_label)(struct label label, int flag); 97 void (mpo_init_pipe_label)(struct label label); 98 void (mpo_init_proc_label)(struct label label); 99 void (mpo_init_vnode_label)(struct label label); 100* void (mpo_destroy_bpfdesc_label)(struct label label); 101 void (mpo_destroy_cred_label)(struct label label); 102 void (mpo_destroy_devfsdirent_label)(struct label label); 103 void (mpo_destroy_ifnet_label)(struct label label); 104 void (mpo_destroy_inpcb_label)(struct label label); 105 void (mpo_destroy_ipq_label)(struct label label); 106 void (mpo_destroy_mbuf_label)(struct label label); 107 void (mpo_destroy_mount_label)(struct label label); 108 void (mpo_destroy_mount_fs_label)(struct label label); 109 void (mpo_destroy_socket_label)(struct label label); 110 void (mpo_destroy_socket_peer_label)(struct label label); 111 void (mpo_destroy_pipe_label)(struct label label); 112 void (mpo_destroy_proc_label)(struct label label); 113 void (mpo_destroy_vnode_label)(struct label label);	35 / 36/ 37 * Kernel interface for MAC policy modules. 38 / 39#ifndef _SYS_MAC_POLICY_H 40#define _SYS_MAC_POLICY_H 41 42/- 43 * Pluggable access control policy definition structure. 44 * 45 * List of operations that are performed as part of the implementation 46 * of a MAC policy. Policy implementors declare operations with a 47 * mac_policy_ops structure, and using the MAC_POLICY_SET() macro. 48 * If an entry point is not declared, then then the policy will be ignored 49 * during evaluation of that event or check. 50 * 51 * Operations are sorted first by general class of operation, then 52 * alphabetically. 53 / 54struct acl; 55struct componentname; 56struct devfs_dirent; 57struct inpcb; 58struct ipq; 59struct label; 60struct mac_policy_conf; 61struct mbuf; 62struct mount; 63struct pipe; 64struct sbuf; 65struct socket; 66struct ucred; 67struct uio; 68struct vnode; 69struct mac_policy_ops { 70 / 71 * Policy module operations. 72 / 73 void (mpo_destroy)(struct mac_policy_conf mpc); 74 void (mpo_init)(struct mac_policy_conf mpc); 75 76 / 77 * General policy-directed security system call so that policies 78 * may implement new services without reserving explicit 79 * system call numbers. 80 / 81 int (mpo_syscall)(struct thread td, int call, void arg); 82 83 /* 84 * Label operations. 85 / 86 void (mpo_init_bpfdesc_label)(struct label label); 87 void (mpo_init_cred_label)(struct label label); 88 void (mpo_init_devfsdirent_label)(struct label label); 89 void (mpo_init_ifnet_label)(struct label label); 90 int (mpo_init_inpcb_label)(struct label label, int flag); 91 int (mpo_init_ipq_label)(struct label label, int flag); 92 int (mpo_init_mbuf_label)(struct label label, int flag); 93 void (mpo_init_mount_label)(struct label label); 94 void (mpo_init_mount_fs_label)(struct label label); 95 int (mpo_init_socket_label)(struct label label, int flag); 96 int (mpo_init_socket_peer_label)(struct label label, int flag); 97 void (mpo_init_pipe_label)(struct label label); 98 void (mpo_init_proc_label)(struct label label); 99 void (mpo_init_vnode_label)(struct label label); 100* void (mpo_destroy_bpfdesc_label)(struct label label); 101 void (mpo_destroy_cred_label)(struct label label); 102 void (mpo_destroy_devfsdirent_label)(struct label label); 103 void (mpo_destroy_ifnet_label)(struct label label); 104 void (mpo_destroy_inpcb_label)(struct label label); 105 void (mpo_destroy_ipq_label)(struct label label); 106 void (mpo_destroy_mbuf_label)(struct label label); 107 void (mpo_destroy_mount_label)(struct label label); 108 void (mpo_destroy_mount_fs_label)(struct label label); 109 void (mpo_destroy_socket_label)(struct label label); 110 void (mpo_destroy_socket_peer_label)(struct label label); 111 void (mpo_destroy_pipe_label)(struct label label); 112 void (mpo_destroy_proc_label)(struct label label); 113 void (mpo_destroy_vnode_label)(struct label label);
	114 void (mpo_copy_cred_label)(struct label src, 115 struct label *dest);
114 void (mpo_copy_mbuf_label)(struct label src, 115 struct label dest); 116* void (mpo_copy_pipe_label)(struct label src, 117 struct label dest); 118* void (mpo_copy_socket_label)(struct label src, 119 struct label dest); 120* void (mpo_copy_vnode_label)(struct label src, 121 struct label dest); 122* int (mpo_externalize_cred_label)(struct label label, 123 char element_name, struct sbuf sb, int claimed); 124* int (mpo_externalize_ifnet_label)(struct label label, 125 char element_name, struct sbuf sb, int claimed); 126* int (mpo_externalize_pipe_label)(struct label label, 127 char element_name, struct sbuf sb, int claimed); 128* int (mpo_externalize_socket_label)(struct label label, 129 char element_name, struct sbuf sb, int claimed); 130* int (mpo_externalize_socket_peer_label)(struct label label, 131 char element_name, struct sbuf sb, int claimed); 132* int (mpo_externalize_vnode_label)(struct label label, 133 char element_name, struct sbuf sb, int claimed); 134* int (mpo_internalize_cred_label)(struct label label, 135 char element_name, char element_data, int claimed); 136* int (mpo_internalize_ifnet_label)(struct label label, 137 char element_name, char element_data, int claimed); 138* int (mpo_internalize_pipe_label)(struct label label, 139 char element_name, char element_data, int claimed); 140* int (mpo_internalize_socket_label)(struct label label, 141 char element_name, char element_data, int claimed); 142* int (mpo_internalize_vnode_label)(struct label label, 143 char element_name, char element_data, int claimed); 144* 145 /* 146 * Labeling event operations: file system objects, and things that 147 * look a lot like file system objects. 148 / 149* void (mpo_associate_vnode_devfs)(struct mount mp, 150 struct label fslabel, struct devfs_dirent de, 151 struct label delabel, struct vnode vp, 152 struct label vlabel); 153* int (mpo_associate_vnode_extattr)(struct mount mp, 154 struct label fslabel, struct vnode vp, 155 struct label vlabel); 156* void (mpo_associate_vnode_singlelabel)(struct mount mp, 157 struct label fslabel, struct vnode vp, 158 struct label vlabel); 159* void (mpo_create_devfs_device)(struct mount mp, dev_t dev, 160 struct devfs_dirent de, struct label label); 161 void (mpo_create_devfs_directory)(struct mount mp, char dirname, 162* int dirnamelen, struct devfs_dirent de, 163* struct label label); 164* void (mpo_create_devfs_symlink)(struct ucred cred, 165 struct mount mp, struct devfs_dirent dd, 166 struct label ddlabel, struct devfs_dirent de, 167 struct label delabel); 168* int (mpo_create_vnode_extattr)(struct ucred cred, 169 struct mount mp, struct label fslabel, 170 struct vnode dvp, struct label dlabel, 171 struct vnode vp, struct label vlabel, 172 struct componentname cnp); 173* void (mpo_create_mount)(struct ucred cred, struct mount mp, 174* struct label mntlabel, struct label fslabel); 175 void (mpo_create_root_mount)(struct ucred cred, struct mount mp, 176* struct label mountlabel, struct label fslabel); 177 void (mpo_relabel_vnode)(struct ucred cred, struct vnode vp, 178* struct label vnodelabel, struct label label); 179 int (mpo_setlabel_vnode_extattr)(struct ucred cred, 180 struct vnode vp, struct label vlabel, 181 struct label intlabel); 182* void (mpo_update_devfsdirent)(struct mount mp, 183 struct devfs_dirent devfs_dirent, 184* struct label direntlabel, struct vnode vp, 185 struct label vnodelabel); 186* 187 /* 188 * Labeling event operations: IPC objects. 189 / 190* void (mpo_create_mbuf_from_socket)(struct socket so, 191 struct label socketlabel, struct mbuf m, 192 struct label mbuflabel); 193* void (mpo_create_socket)(struct ucred cred, struct socket so, 194* struct label socketlabel); 195* void (mpo_create_socket_from_socket)(struct socket oldsocket, 196 struct label oldsocketlabel, struct socket newsocket, 197 struct label newsocketlabel); 198* void (mpo_relabel_socket)(struct ucred cred, struct socket so, 199* struct label oldlabel, struct label newlabel); 200 void (mpo_relabel_pipe)(struct ucred cred, struct pipe pipe, 201* struct label oldlabel, struct label newlabel); 202 void (mpo_set_socket_peer_from_mbuf)(struct mbuf mbuf, 203 struct label mbuflabel, struct socket so, 204 struct label socketpeerlabel); 205* void (mpo_set_socket_peer_from_socket)(struct socket oldsocket, 206 struct label oldsocketlabel, struct socket newsocket, 207 struct label newsocketpeerlabel); 208* void (mpo_create_pipe)(struct ucred cred, struct pipe pipe, 209* struct label pipelabel); 210* 211 /* 212 * Labeling event operations: network objects. 213 / 214* void (mpo_create_bpfdesc)(struct ucred cred, struct bpf_d bpf_d, 215* struct label bpflabel); 216* void (mpo_create_ifnet)(struct ifnet ifnet, 217 struct label ifnetlabel); 218* void (mpo_create_inpcb_from_socket)(struct socket so, 219 struct label solabel, struct inpcb inp, 220 struct label inplabel); 221* void (mpo_create_ipq)(struct mbuf fragment, 222 struct label fragmentlabel, struct ipq ipq, 223 struct label ipqlabel); 224* void (mpo_create_datagram_from_ipq) 225* (struct ipq ipq, struct label ipqlabel, 226 struct mbuf datagram, struct label datagramlabel); 227 void (mpo_create_fragment)(struct mbuf datagram, 228 struct label datagramlabel, struct mbuf fragment, 229 struct label fragmentlabel); 230* void (mpo_create_mbuf_from_mbuf)(struct mbuf oldmbuf, 231 struct label oldlabel, struct mbuf newmbuf, 232 struct label newlabel); 233* void (mpo_create_mbuf_linklayer)(struct ifnet ifnet, 234 struct label ifnetlabel, struct mbuf mbuf, 235 struct label mbuflabel); 236* void (mpo_create_mbuf_from_bpfdesc)(struct bpf_d bpf_d, 237 struct label bpflabel, struct mbuf mbuf, 238 struct label mbuflabel); 239* void (mpo_create_mbuf_from_ifnet)(struct ifnet ifnet, 240 struct label ifnetlabel, struct mbuf mbuf, 241 struct label mbuflabel); 242* void (mpo_create_mbuf_multicast_encap)(struct mbuf oldmbuf, 243 struct label oldmbuflabel, struct ifnet ifnet, 244 struct label ifnetlabel, struct mbuf newmbuf, 245 struct label newmbuflabel); 246* void (mpo_create_mbuf_netlayer)(struct mbuf oldmbuf, 247 struct label oldmbuflabel, struct mbuf newmbuf, 248 struct label newmbuflabel); 249* int (mpo_fragment_match)(struct mbuf fragment, 250 struct label fragmentlabel, struct ipq ipq, 251 struct label ipqlabel); 252* void (mpo_reflect_mbuf_icmp)(struct mbuf m, 253 struct label mlabel); 254* void (mpo_reflect_mbuf_tcp)(struct mbuf m, struct label mlabel); 255* void (mpo_relabel_ifnet)(struct ucred cred, struct ifnet ifnet, 256* struct label ifnetlabel, struct label newlabel); 257 void (mpo_update_ipq)(struct mbuf fragment, 258 struct label fragmentlabel, struct ipq ipq, 259 struct label ipqlabel); 260* void (mpo_inpcb_sosetlabel)(struct socket so, 261 struct label label, struct inpcb inp, 262 struct label inplabel); 263* 264 /* 265 * Labeling event operations: processes. 266 */	116 void (mpo_copy_mbuf_label)(struct label src, 117 struct label dest); 118* void (mpo_copy_pipe_label)(struct label src, 119 struct label dest); 120* void (mpo_copy_socket_label)(struct label src, 121 struct label dest); 122* void (mpo_copy_vnode_label)(struct label src, 123 struct label dest); 124* int (mpo_externalize_cred_label)(struct label label, 125 char element_name, struct sbuf sb, int claimed); 126* int (mpo_externalize_ifnet_label)(struct label label, 127 char element_name, struct sbuf sb, int claimed); 128* int (mpo_externalize_pipe_label)(struct label label, 129 char element_name, struct sbuf sb, int claimed); 130* int (mpo_externalize_socket_label)(struct label label, 131 char element_name, struct sbuf sb, int claimed); 132* int (mpo_externalize_socket_peer_label)(struct label label, 133 char element_name, struct sbuf sb, int claimed); 134* int (mpo_externalize_vnode_label)(struct label label, 135 char element_name, struct sbuf sb, int claimed); 136* int (mpo_internalize_cred_label)(struct label label, 137 char element_name, char element_data, int claimed); 138* int (mpo_internalize_ifnet_label)(struct label label, 139 char element_name, char element_data, int claimed); 140* int (mpo_internalize_pipe_label)(struct label label, 141 char element_name, char element_data, int claimed); 142* int (mpo_internalize_socket_label)(struct label label, 143 char element_name, char element_data, int claimed); 144* int (mpo_internalize_vnode_label)(struct label label, 145 char element_name, char element_data, int claimed); 146* 147 /* 148 * Labeling event operations: file system objects, and things that 149 * look a lot like file system objects. 150 / 151* void (mpo_associate_vnode_devfs)(struct mount mp, 152 struct label fslabel, struct devfs_dirent de, 153 struct label delabel, struct vnode vp, 154 struct label vlabel); 155* int (mpo_associate_vnode_extattr)(struct mount mp, 156 struct label fslabel, struct vnode vp, 157 struct label vlabel); 158* void (mpo_associate_vnode_singlelabel)(struct mount mp, 159 struct label fslabel, struct vnode vp, 160 struct label vlabel); 161* void (mpo_create_devfs_device)(struct mount mp, dev_t dev, 162 struct devfs_dirent de, struct label label); 163 void (mpo_create_devfs_directory)(struct mount mp, char dirname, 164* int dirnamelen, struct devfs_dirent de, 165* struct label label); 166* void (mpo_create_devfs_symlink)(struct ucred cred, 167 struct mount mp, struct devfs_dirent dd, 168 struct label ddlabel, struct devfs_dirent de, 169 struct label delabel); 170* int (mpo_create_vnode_extattr)(struct ucred cred, 171 struct mount mp, struct label fslabel, 172 struct vnode dvp, struct label dlabel, 173 struct vnode vp, struct label vlabel, 174 struct componentname cnp); 175* void (mpo_create_mount)(struct ucred cred, struct mount mp, 176* struct label mntlabel, struct label fslabel); 177 void (mpo_create_root_mount)(struct ucred cred, struct mount mp, 178* struct label mountlabel, struct label fslabel); 179 void (mpo_relabel_vnode)(struct ucred cred, struct vnode vp, 180* struct label vnodelabel, struct label label); 181 int (mpo_setlabel_vnode_extattr)(struct ucred cred, 182 struct vnode vp, struct label vlabel, 183 struct label intlabel); 184* void (mpo_update_devfsdirent)(struct mount mp, 185 struct devfs_dirent devfs_dirent, 186* struct label direntlabel, struct vnode vp, 187 struct label vnodelabel); 188* 189 /* 190 * Labeling event operations: IPC objects. 191 / 192* void (mpo_create_mbuf_from_socket)(struct socket so, 193 struct label socketlabel, struct mbuf m, 194 struct label mbuflabel); 195* void (mpo_create_socket)(struct ucred cred, struct socket so, 196* struct label socketlabel); 197* void (mpo_create_socket_from_socket)(struct socket oldsocket, 198 struct label oldsocketlabel, struct socket newsocket, 199 struct label newsocketlabel); 200* void (mpo_relabel_socket)(struct ucred cred, struct socket so, 201* struct label oldlabel, struct label newlabel); 202 void (mpo_relabel_pipe)(struct ucred cred, struct pipe pipe, 203* struct label oldlabel, struct label newlabel); 204 void (mpo_set_socket_peer_from_mbuf)(struct mbuf mbuf, 205 struct label mbuflabel, struct socket so, 206 struct label socketpeerlabel); 207* void (mpo_set_socket_peer_from_socket)(struct socket oldsocket, 208 struct label oldsocketlabel, struct socket newsocket, 209 struct label newsocketpeerlabel); 210* void (mpo_create_pipe)(struct ucred cred, struct pipe pipe, 211* struct label pipelabel); 212* 213 /* 214 * Labeling event operations: network objects. 215 / 216* void (mpo_create_bpfdesc)(struct ucred cred, struct bpf_d bpf_d, 217* struct label bpflabel); 218* void (mpo_create_ifnet)(struct ifnet ifnet, 219 struct label ifnetlabel); 220* void (mpo_create_inpcb_from_socket)(struct socket so, 221 struct label solabel, struct inpcb inp, 222 struct label inplabel); 223* void (mpo_create_ipq)(struct mbuf fragment, 224 struct label fragmentlabel, struct ipq ipq, 225 struct label ipqlabel); 226* void (mpo_create_datagram_from_ipq) 227* (struct ipq ipq, struct label ipqlabel, 228 struct mbuf datagram, struct label datagramlabel); 229 void (mpo_create_fragment)(struct mbuf datagram, 230 struct label datagramlabel, struct mbuf fragment, 231 struct label fragmentlabel); 232* void (mpo_create_mbuf_from_mbuf)(struct mbuf oldmbuf, 233 struct label oldlabel, struct mbuf newmbuf, 234 struct label newlabel); 235* void (mpo_create_mbuf_linklayer)(struct ifnet ifnet, 236 struct label ifnetlabel, struct mbuf mbuf, 237 struct label mbuflabel); 238* void (mpo_create_mbuf_from_bpfdesc)(struct bpf_d bpf_d, 239 struct label bpflabel, struct mbuf mbuf, 240 struct label mbuflabel); 241* void (mpo_create_mbuf_from_ifnet)(struct ifnet ifnet, 242 struct label ifnetlabel, struct mbuf mbuf, 243 struct label mbuflabel); 244* void (mpo_create_mbuf_multicast_encap)(struct mbuf oldmbuf, 245 struct label oldmbuflabel, struct ifnet ifnet, 246 struct label ifnetlabel, struct mbuf newmbuf, 247 struct label newmbuflabel); 248* void (mpo_create_mbuf_netlayer)(struct mbuf oldmbuf, 249 struct label oldmbuflabel, struct mbuf newmbuf, 250 struct label newmbuflabel); 251* int (mpo_fragment_match)(struct mbuf fragment, 252 struct label fragmentlabel, struct ipq ipq, 253 struct label ipqlabel); 254* void (mpo_reflect_mbuf_icmp)(struct mbuf m, 255 struct label mlabel); 256* void (mpo_reflect_mbuf_tcp)(struct mbuf m, struct label mlabel); 257* void (mpo_relabel_ifnet)(struct ucred cred, struct ifnet ifnet, 258* struct label ifnetlabel, struct label newlabel); 259 void (mpo_update_ipq)(struct mbuf fragment, 260 struct label fragmentlabel, struct ipq ipq, 261 struct label ipqlabel); 262* void (mpo_inpcb_sosetlabel)(struct socket so, 263 struct label label, struct inpcb inp, 264 struct label inplabel); 265* 266 /* 267 * Labeling event operations: processes. 268 */
267 void (mpo_create_cred)(struct ucred parent_cred, 268 struct ucred *child_cred);
269 void (mpo_execve_transition)(struct ucred old, struct ucred new, 270* struct vnode vp, struct label vnodelabel, 271 struct label interpvnodelabel, 272* struct image_params imgp, struct label execlabel); 273 int (mpo_execve_will_transition)(struct ucred old, 274 struct vnode vp, struct label vnodelabel, 275 struct label interpvnodelabel, 276* struct image_params imgp, struct label execlabel); 277 void (mpo_create_proc0)(struct ucred cred); 278 void (mpo_create_proc1)(struct ucred cred); 279 void (mpo_relabel_cred)(struct ucred cred, 280 struct label newlabel); 281* void (mpo_thread_userret)(struct thread thread); 282 283 /* 284 * Access control checks. 285 / 286* int (mpo_check_bpfdesc_receive)(struct bpf_d bpf_d, 287 struct label bpflabel, struct ifnet ifnet, 288 struct label ifnetlabel); 289* int (mpo_check_cred_relabel)(struct ucred cred, 290 struct label newlabel); 291* int (mpo_check_cred_visible)(struct ucred u1, struct ucred u2); 292* int (mpo_check_ifnet_relabel)(struct ucred cred, 293 struct ifnet ifnet, struct label ifnetlabel, 294 struct label newlabel); 295* int (mpo_check_ifnet_transmit)(struct ifnet ifnet, 296 struct label ifnetlabel, struct mbuf m, 297 struct label mbuflabel); 298* int (mpo_check_inpcb_deliver)(struct inpcb inp, 299 struct label inplabel, struct mbuf m, 300 struct label mlabel); 301* int (mpo_check_kenv_dump)(struct ucred cred); 302 int (mpo_check_kenv_get)(struct ucred cred, char name); 303* int (mpo_check_kenv_set)(struct ucred cred, char name, 304* char value); 305* int (mpo_check_kenv_unset)(struct ucred cred, char name); 306* int (mpo_check_kld_load)(struct ucred cred, struct vnode vp, 307* struct label vlabel); 308* int (mpo_check_kld_stat)(struct ucred cred); 309 int (mpo_check_kld_unload)(struct ucred cred); 310 int (mpo_check_mount_stat)(struct ucred cred, struct mount mp, 311* struct label mntlabel); 312* int (mpo_check_pipe_ioctl)(struct ucred cred, struct pipe pipe, 313* struct label pipelabel, unsigned long cmd, void data); 314 int (mpo_check_pipe_poll)(struct ucred cred, struct pipe pipe, 315* struct label pipelabel); 316* int (mpo_check_pipe_read)(struct ucred cred, struct pipe pipe, 317* struct label pipelabel); 318* int (mpo_check_pipe_relabel)(struct ucred cred, 319 struct pipe pipe, struct label pipelabel, 320 struct label newlabel); 321* int (mpo_check_pipe_stat)(struct ucred cred, struct pipe pipe, 322* struct label pipelabel); 323* int (mpo_check_pipe_write)(struct ucred cred, struct pipe pipe, 324* struct label pipelabel); 325* int (mpo_check_proc_debug)(struct ucred cred, 326 struct proc proc); 327* int (mpo_check_proc_sched)(struct ucred cred, 328 struct proc proc); 329* int (mpo_check_proc_signal)(struct ucred cred, 330 struct proc proc, int signum); 331* int (mpo_check_socket_bind)(struct ucred cred, 332 struct socket so, struct label socketlabel, 333 struct sockaddr sockaddr); 334* int (mpo_check_socket_connect)(struct ucred cred, 335 struct socket so, struct label socketlabel, 336 struct sockaddr sockaddr); 337* int (mpo_check_socket_deliver)(struct socket so, 338 struct label socketlabel, struct mbuf m, 339 struct label mbuflabel); 340* int (mpo_check_socket_listen)(struct ucred cred, 341 struct socket so, struct label socketlabel); 342 int (mpo_check_socket_receive)(struct ucred cred, 343 struct socket so, struct label socketlabel); 344 int (mpo_check_socket_relabel)(struct ucred cred, 345 struct socket so, struct label socketlabel, 346 struct label newlabel); 347* int (mpo_check_socket_send)(struct ucred cred, 348 struct socket so, struct label socketlabel); 349 int (mpo_check_socket_visible)(struct ucred cred, 350 struct socket so, struct label socketlabel); 351 int (mpo_check_sysarch_ioperm)(struct ucred cred); 352 int (mpo_check_system_acct)(struct ucred cred, 353 struct vnode vp, struct label vlabel); 354 int (mpo_check_system_nfsd)(struct ucred cred); 355 int (mpo_check_system_reboot)(struct ucred cred, int howto); 356 int (mpo_check_system_settime)(struct ucred cred); 357 int (mpo_check_system_swapon)(struct ucred cred, 358 struct vnode vp, struct label label); 359 int (mpo_check_system_swapoff)(struct ucred cred, 360 struct vnode vp, struct label label); 361 int (mpo_check_system_sysctl)(struct ucred cred, int name, 362* u_int namelen, void old, size_t oldlenp, int inkernel, 363 void new, size_t newlen); 364* int (mpo_check_vnode_access)(struct ucred cred, 365 struct vnode vp, struct label label, int acc_mode); 366 int (mpo_check_vnode_chdir)(struct ucred cred, 367 struct vnode dvp, struct label dlabel); 368 int (mpo_check_vnode_chroot)(struct ucred cred, 369 struct vnode dvp, struct label dlabel); 370 int (mpo_check_vnode_create)(struct ucred cred, 371 struct vnode dvp, struct label dlabel, 372 struct componentname cnp, struct vattr vap); 373 int (mpo_check_vnode_delete)(struct ucred cred, 374 struct vnode dvp, struct label dlabel, 375 struct vnode vp, struct label label, 376 struct componentname cnp); 377* int (mpo_check_vnode_deleteacl)(struct ucred cred, 378 struct vnode vp, struct label label, acl_type_t type); 379 int (mpo_check_vnode_deleteextattr)(struct ucred cred, 380 struct vnode vp, struct label label, int attrnamespace, 381 const char name); 382* int (mpo_check_vnode_exec)(struct ucred cred, struct vnode vp, 383* struct label label, struct image_params imgp, 384 struct label execlabel); 385* int (mpo_check_vnode_getacl)(struct ucred cred, 386 struct vnode vp, struct label label, acl_type_t type); 387 int (mpo_check_vnode_getextattr)(struct ucred cred, 388 struct vnode vp, struct label label, int attrnamespace, 389 const char name, struct uio uio); 390 int (mpo_check_vnode_link)(struct ucred cred, struct vnode dvp, 391* struct label dlabel, struct vnode vp, 392 struct label label, struct componentname cnp); 393 int (mpo_check_vnode_listextattr)(struct ucred cred, 394 struct vnode vp, struct label label, int attrnamespace); 395 int (mpo_check_vnode_lookup)(struct ucred cred, 396 struct vnode dvp, struct label dlabel, 397 struct componentname cnp); 398* int (mpo_check_vnode_mmap)(struct ucred cred, struct vnode vp, 399* struct label label, int prot); 400* void (mpo_check_vnode_mmap_downgrade)(struct ucred cred, 401 struct vnode vp, struct label label, int prot); 402* int (mpo_check_vnode_mprotect)(struct ucred cred, 403 struct vnode vp, struct label label, int prot); 404 int (mpo_check_vnode_open)(struct ucred cred, struct vnode vp, 405* struct label label, int acc_mode); 406* int (mpo_check_vnode_poll)(struct ucred active_cred, 407 struct ucred file_cred, struct vnode vp, 408 struct label label); 409* int (mpo_check_vnode_read)(struct ucred active_cred, 410 struct ucred file_cred, struct vnode vp, 411 struct label label); 412* int (mpo_check_vnode_readdir)(struct ucred cred, 413 struct vnode dvp, struct label dlabel); 414 int (mpo_check_vnode_readlink)(struct ucred cred, 415 struct vnode vp, struct label label); 416 int (mpo_check_vnode_relabel)(struct ucred cred, 417 struct vnode vp, struct label vnodelabel, 418 struct label newlabel); 419* int (mpo_check_vnode_rename_from)(struct ucred cred, 420 struct vnode dvp, struct label dlabel, struct vnode vp, 421* struct label label, struct componentname cnp); 422 int (mpo_check_vnode_rename_to)(struct ucred cred, 423 struct vnode dvp, struct label dlabel, struct vnode vp, 424* struct label label, int samedir, 425* struct componentname cnp); 426* int (mpo_check_vnode_revoke)(struct ucred cred, 427 struct vnode vp, struct label label); 428 int (mpo_check_vnode_setacl)(struct ucred cred, 429 struct vnode vp, struct label label, acl_type_t type, 430 struct acl acl); 431* int (mpo_check_vnode_setextattr)(struct ucred cred, 432 struct vnode vp, struct label label, int attrnamespace, 433 const char name, struct uio uio); 434 int (mpo_check_vnode_setflags)(struct ucred cred, 435 struct vnode vp, struct label label, u_long flags); 436 int (mpo_check_vnode_setmode)(struct ucred cred, 437 struct vnode vp, struct label label, mode_t mode); 438 int (mpo_check_vnode_setowner)(struct ucred cred, 439 struct vnode vp, struct label label, uid_t uid, 440 gid_t gid); 441 int (mpo_check_vnode_setutimes)(struct ucred cred, 442 struct vnode vp, struct label label, 443 struct timespec atime, struct timespec mtime); 444 int (mpo_check_vnode_stat)(struct ucred active_cred, 445 struct ucred file_cred, struct vnode vp, 446 struct label label); 447* int (mpo_check_vnode_write)(struct ucred active_cred, 448 struct ucred file_cred, struct vnode vp, 449 struct label label); 450}; 451* 452struct mac_policy_conf { 453 char mpc_name; / policy name / 454* char mpc_fullname; / policy full name / 455* struct mac_policy_ops mpc_ops; / policy operations / 456* int mpc_loadtime_flags; /* flags / 457* int mpc_field_off; / security field / 458* int mpc_runtime_flags; /* flags / 459* LIST_ENTRY(mac_policy_conf) mpc_list; /* global list / 460}; 461* 462/* Flags for the mpc_loadtime_flags field. / 463#define MPC_LOADTIME_FLAG_NOTLATE 0x00000001 464#define MPC_LOADTIME_FLAG_UNLOADOK 0x00000002 465#define MPC_LOADTIME_FLAG_LABELMBUFS 0x00000004 466* 467/* Flags for the mpc_runtime_flags field. / 468#define MPC_RUNTIME_FLAG_REGISTERED 0x00000001 469* 470#define MAC_POLICY_SET(mpops, mpname, mpfullname, mpflags, privdata_wanted) \ 471 static struct mac_policy_conf mpname##_mac_policy_conf = { \ 472 #mpname, \ 473 mpfullname, \ 474 mpops, \ 475 mpflags, \ 476 privdata_wanted, \ 477 0, \ 478 }; \ 479 static moduledata_t mpname##_mod = { \ 480 #mpname, \ 481 mac_policy_modevent, \ 482 &mpname##_mac_policy_conf \ 483 }; \ 484 MODULE_DEPEND(mpname, kernel_mac_support, 1, 1, 1); \ 485 DECLARE_MODULE(mpname, mpname##_mod, SI_SUB_MAC_POLICY, \ 486 SI_ORDER_MIDDLE) 487 488int mac_policy_modevent(module_t mod, int type, void data); 489* 490#define LABEL_TO_SLOT(l, s) (l)->l_perpolicy[s] 491 492#endif /* !_SYS_MAC_POLICY_H */	269 void (mpo_execve_transition)(struct ucred old, struct ucred new, 270* struct vnode vp, struct label vnodelabel, 271 struct label interpvnodelabel, 272* struct image_params imgp, struct label execlabel); 273 int (mpo_execve_will_transition)(struct ucred old, 274 struct vnode vp, struct label vnodelabel, 275 struct label interpvnodelabel, 276* struct image_params imgp, struct label execlabel); 277 void (mpo_create_proc0)(struct ucred cred); 278 void (mpo_create_proc1)(struct ucred cred); 279 void (mpo_relabel_cred)(struct ucred cred, 280 struct label newlabel); 281* void (mpo_thread_userret)(struct thread thread); 282 283 /* 284 * Access control checks. 285 / 286* int (mpo_check_bpfdesc_receive)(struct bpf_d bpf_d, 287 struct label bpflabel, struct ifnet ifnet, 288 struct label ifnetlabel); 289* int (mpo_check_cred_relabel)(struct ucred cred, 290 struct label newlabel); 291* int (mpo_check_cred_visible)(struct ucred u1, struct ucred u2); 292* int (mpo_check_ifnet_relabel)(struct ucred cred, 293 struct ifnet ifnet, struct label ifnetlabel, 294 struct label newlabel); 295* int (mpo_check_ifnet_transmit)(struct ifnet ifnet, 296 struct label ifnetlabel, struct mbuf m, 297 struct label mbuflabel); 298* int (mpo_check_inpcb_deliver)(struct inpcb inp, 299 struct label inplabel, struct mbuf m, 300 struct label mlabel); 301* int (mpo_check_kenv_dump)(struct ucred cred); 302 int (mpo_check_kenv_get)(struct ucred cred, char name); 303* int (mpo_check_kenv_set)(struct ucred cred, char name, 304* char value); 305* int (mpo_check_kenv_unset)(struct ucred cred, char name); 306* int (mpo_check_kld_load)(struct ucred cred, struct vnode vp, 307* struct label vlabel); 308* int (mpo_check_kld_stat)(struct ucred cred); 309 int (mpo_check_kld_unload)(struct ucred cred); 310 int (mpo_check_mount_stat)(struct ucred cred, struct mount mp, 311* struct label mntlabel); 312* int (mpo_check_pipe_ioctl)(struct ucred cred, struct pipe pipe, 313* struct label pipelabel, unsigned long cmd, void data); 314 int (mpo_check_pipe_poll)(struct ucred cred, struct pipe pipe, 315* struct label pipelabel); 316* int (mpo_check_pipe_read)(struct ucred cred, struct pipe pipe, 317* struct label pipelabel); 318* int (mpo_check_pipe_relabel)(struct ucred cred, 319 struct pipe pipe, struct label pipelabel, 320 struct label newlabel); 321* int (mpo_check_pipe_stat)(struct ucred cred, struct pipe pipe, 322* struct label pipelabel); 323* int (mpo_check_pipe_write)(struct ucred cred, struct pipe pipe, 324* struct label pipelabel); 325* int (mpo_check_proc_debug)(struct ucred cred, 326 struct proc proc); 327* int (mpo_check_proc_sched)(struct ucred cred, 328 struct proc proc); 329* int (mpo_check_proc_signal)(struct ucred cred, 330 struct proc proc, int signum); 331* int (mpo_check_socket_bind)(struct ucred cred, 332 struct socket so, struct label socketlabel, 333 struct sockaddr sockaddr); 334* int (mpo_check_socket_connect)(struct ucred cred, 335 struct socket so, struct label socketlabel, 336 struct sockaddr sockaddr); 337* int (mpo_check_socket_deliver)(struct socket so, 338 struct label socketlabel, struct mbuf m, 339 struct label mbuflabel); 340* int (mpo_check_socket_listen)(struct ucred cred, 341 struct socket so, struct label socketlabel); 342 int (mpo_check_socket_receive)(struct ucred cred, 343 struct socket so, struct label socketlabel); 344 int (mpo_check_socket_relabel)(struct ucred cred, 345 struct socket so, struct label socketlabel, 346 struct label newlabel); 347* int (mpo_check_socket_send)(struct ucred cred, 348 struct socket so, struct label socketlabel); 349 int (mpo_check_socket_visible)(struct ucred cred, 350 struct socket so, struct label socketlabel); 351 int (mpo_check_sysarch_ioperm)(struct ucred cred); 352 int (mpo_check_system_acct)(struct ucred cred, 353 struct vnode vp, struct label vlabel); 354 int (mpo_check_system_nfsd)(struct ucred cred); 355 int (mpo_check_system_reboot)(struct ucred cred, int howto); 356 int (mpo_check_system_settime)(struct ucred cred); 357 int (mpo_check_system_swapon)(struct ucred cred, 358 struct vnode vp, struct label label); 359 int (mpo_check_system_swapoff)(struct ucred cred, 360 struct vnode vp, struct label label); 361 int (mpo_check_system_sysctl)(struct ucred cred, int name, 362* u_int namelen, void old, size_t oldlenp, int inkernel, 363 void new, size_t newlen); 364* int (mpo_check_vnode_access)(struct ucred cred, 365 struct vnode vp, struct label label, int acc_mode); 366 int (mpo_check_vnode_chdir)(struct ucred cred, 367 struct vnode dvp, struct label dlabel); 368 int (mpo_check_vnode_chroot)(struct ucred cred, 369 struct vnode dvp, struct label dlabel); 370 int (mpo_check_vnode_create)(struct ucred cred, 371 struct vnode dvp, struct label dlabel, 372 struct componentname cnp, struct vattr vap); 373 int (mpo_check_vnode_delete)(struct ucred cred, 374 struct vnode dvp, struct label dlabel, 375 struct vnode vp, struct label label, 376 struct componentname cnp); 377* int (mpo_check_vnode_deleteacl)(struct ucred cred, 378 struct vnode vp, struct label label, acl_type_t type); 379 int (mpo_check_vnode_deleteextattr)(struct ucred cred, 380 struct vnode vp, struct label label, int attrnamespace, 381 const char name); 382* int (mpo_check_vnode_exec)(struct ucred cred, struct vnode vp, 383* struct label label, struct image_params imgp, 384 struct label execlabel); 385* int (mpo_check_vnode_getacl)(struct ucred cred, 386 struct vnode vp, struct label label, acl_type_t type); 387 int (mpo_check_vnode_getextattr)(struct ucred cred, 388 struct vnode vp, struct label label, int attrnamespace, 389 const char name, struct uio uio); 390 int (mpo_check_vnode_link)(struct ucred cred, struct vnode dvp, 391* struct label dlabel, struct vnode vp, 392 struct label label, struct componentname cnp); 393 int (mpo_check_vnode_listextattr)(struct ucred cred, 394 struct vnode vp, struct label label, int attrnamespace); 395 int (mpo_check_vnode_lookup)(struct ucred cred, 396 struct vnode dvp, struct label dlabel, 397 struct componentname cnp); 398* int (mpo_check_vnode_mmap)(struct ucred cred, struct vnode vp, 399* struct label label, int prot); 400* void (mpo_check_vnode_mmap_downgrade)(struct ucred cred, 401 struct vnode vp, struct label label, int prot); 402* int (mpo_check_vnode_mprotect)(struct ucred cred, 403 struct vnode vp, struct label label, int prot); 404 int (mpo_check_vnode_open)(struct ucred cred, struct vnode vp, 405* struct label label, int acc_mode); 406* int (mpo_check_vnode_poll)(struct ucred active_cred, 407 struct ucred file_cred, struct vnode vp, 408 struct label label); 409* int (mpo_check_vnode_read)(struct ucred active_cred, 410 struct ucred file_cred, struct vnode vp, 411 struct label label); 412* int (mpo_check_vnode_readdir)(struct ucred cred, 413 struct vnode dvp, struct label dlabel); 414 int (mpo_check_vnode_readlink)(struct ucred cred, 415 struct vnode vp, struct label label); 416 int (mpo_check_vnode_relabel)(struct ucred cred, 417 struct vnode vp, struct label vnodelabel, 418 struct label newlabel); 419* int (mpo_check_vnode_rename_from)(struct ucred cred, 420 struct vnode dvp, struct label dlabel, struct vnode vp, 421* struct label label, struct componentname cnp); 422 int (mpo_check_vnode_rename_to)(struct ucred cred, 423 struct vnode dvp, struct label dlabel, struct vnode vp, 424* struct label label, int samedir, 425* struct componentname cnp); 426* int (mpo_check_vnode_revoke)(struct ucred cred, 427 struct vnode vp, struct label label); 428 int (mpo_check_vnode_setacl)(struct ucred cred, 429 struct vnode vp, struct label label, acl_type_t type, 430 struct acl acl); 431* int (mpo_check_vnode_setextattr)(struct ucred cred, 432 struct vnode vp, struct label label, int attrnamespace, 433 const char name, struct uio uio); 434 int (mpo_check_vnode_setflags)(struct ucred cred, 435 struct vnode vp, struct label label, u_long flags); 436 int (mpo_check_vnode_setmode)(struct ucred cred, 437 struct vnode vp, struct label label, mode_t mode); 438 int (mpo_check_vnode_setowner)(struct ucred cred, 439 struct vnode vp, struct label label, uid_t uid, 440 gid_t gid); 441 int (mpo_check_vnode_setutimes)(struct ucred cred, 442 struct vnode vp, struct label label, 443 struct timespec atime, struct timespec mtime); 444 int (mpo_check_vnode_stat)(struct ucred active_cred, 445 struct ucred file_cred, struct vnode vp, 446 struct label label); 447* int (mpo_check_vnode_write)(struct ucred active_cred, 448 struct ucred file_cred, struct vnode vp, 449 struct label label); 450}; 451* 452struct mac_policy_conf { 453 char mpc_name; / policy name / 454* char mpc_fullname; / policy full name / 455* struct mac_policy_ops mpc_ops; / policy operations / 456* int mpc_loadtime_flags; /* flags / 457* int mpc_field_off; / security field / 458* int mpc_runtime_flags; /* flags / 459* LIST_ENTRY(mac_policy_conf) mpc_list; /* global list / 460}; 461* 462/* Flags for the mpc_loadtime_flags field. / 463#define MPC_LOADTIME_FLAG_NOTLATE 0x00000001 464#define MPC_LOADTIME_FLAG_UNLOADOK 0x00000002 465#define MPC_LOADTIME_FLAG_LABELMBUFS 0x00000004 466* 467/* Flags for the mpc_runtime_flags field. / 468#define MPC_RUNTIME_FLAG_REGISTERED 0x00000001 469* 470#define MAC_POLICY_SET(mpops, mpname, mpfullname, mpflags, privdata_wanted) \ 471 static struct mac_policy_conf mpname##_mac_policy_conf = { \ 472 #mpname, \ 473 mpfullname, \ 474 mpops, \ 475 mpflags, \ 476 privdata_wanted, \ 477 0, \ 478 }; \ 479 static moduledata_t mpname##_mod = { \ 480 #mpname, \ 481 mac_policy_modevent, \ 482 &mpname##_mac_policy_conf \ 483 }; \ 484 MODULE_DEPEND(mpname, kernel_mac_support, 1, 1, 1); \ 485 DECLARE_MODULE(mpname, mpname##_mod, SI_SUB_MAC_POLICY, \ 486 SI_ORDER_MIDDLE) 487 488int mac_policy_modevent(module_t mod, int type, void data); 489* 490#define LABEL_TO_SLOT(l, s) (l)->l_perpolicy[s] 491 492#endif /* !_SYS_MAC_POLICY_H */