mac_mls.c (173108) | mac_mls.c (173138) |
---|---|
1/*- 2 * Copyright (c) 1999-2002, 2007 Robert N. M. Watson 3 * Copyright (c) 2001-2005 McAfee, Inc. 4 * Copyright (c) 2006 SPARTA, Inc. 5 * All rights reserved. 6 * 7 * This software was developed by Robert Watson for the TrustedBSD Project. 8 * --- 21 unchanged lines hidden (view full) --- 30 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 31 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 32 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 33 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 34 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 35 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 36 * SUCH DAMAGE. 37 * | 1/*- 2 * Copyright (c) 1999-2002, 2007 Robert N. M. Watson 3 * Copyright (c) 2001-2005 McAfee, Inc. 4 * Copyright (c) 2006 SPARTA, Inc. 5 * All rights reserved. 6 * 7 * This software was developed by Robert Watson for the TrustedBSD Project. 8 * --- 21 unchanged lines hidden (view full) --- 30 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 31 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 32 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 33 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 34 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 35 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 36 * SUCH DAMAGE. 37 * |
38 * $FreeBSD: head/sys/security/mac_mls/mac_mls.c 173108 2007-10-28 17:55:57Z rwatson $ | 38 * $FreeBSD: head/sys/security/mac_mls/mac_mls.c 173138 2007-10-29 13:33:06Z rwatson $ |
39 */ 40 41/* 42 * Developed by the TrustedBSD Project. 43 * 44 * MLS fixed label mandatory confidentiality policy. 45 */ 46 --- 684 unchanged lines hidden (view full) --- 731 732static void 733mls_copy_label(struct label *src, struct label *dest) 734{ 735 736 *SLOT(dest) = *SLOT(src); 737} 738 | 39 */ 40 41/* 42 * Developed by the TrustedBSD Project. 43 * 44 * MLS fixed label mandatory confidentiality policy. 45 */ 46 --- 684 unchanged lines hidden (view full) --- 731 732static void 733mls_copy_label(struct label *src, struct label *dest) 734{ 735 736 *SLOT(dest) = *SLOT(src); 737} 738 |
739 |
|
739/* | 740/* |
740 * Labeling event operations: file system objects, and things that look a lot 741 * like file system objects. | 741 * Object-specific entry point implementations are sorted alphabetically by 742 * object type name and then by operation. |
742 */ | 743 */ |
744static int 745mls_bpfdesc_check_receive(struct bpf_d *d, struct label *dlabel, 746 struct ifnet *ifp, struct label *ifplabel) 747{ 748 struct mac_mls *a, *b; 749 750 if (!mls_enabled) 751 return (0); 752 753 a = SLOT(dlabel); 754 b = SLOT(ifplabel); 755 756 if (mls_equal_effective(a, b)) 757 return (0); 758 return (EACCES); 759} 760 |
|
743static void | 761static void |
762mls_bpfdesc_create(struct ucred *cred, struct bpf_d *d, struct label *dlabel) 763{ 764 struct mac_mls *source, *dest; 765 766 source = SLOT(cred->cr_label); 767 dest = SLOT(dlabel); 768 769 mls_copy_effective(source, dest); 770} 771 772static void 773mls_bpfdesc_create_mbuf(struct bpf_d *d, struct label *dlabel, 774 struct mbuf *m, struct label *mlabel) 775{ 776 struct mac_mls *source, *dest; 777 778 source = SLOT(dlabel); 779 dest = SLOT(mlabel); 780 781 mls_copy_effective(source, dest); 782} 783 784static int 785mls_cred_check_relabel(struct ucred *cred, struct label *newlabel) 786{ 787 struct mac_mls *subj, *new; 788 int error; 789 790 subj = SLOT(cred->cr_label); 791 new = SLOT(newlabel); 792 793 /* 794 * If there is an MLS label update for the credential, it may be an 795 * update of effective, range, or both. 796 */ 797 error = mls_atmostflags(new, MAC_MLS_FLAGS_BOTH); 798 if (error) 799 return (error); 800 801 /* 802 * If the MLS label is to be changed, authorize as appropriate. 803 */ 804 if (new->mm_flags & MAC_MLS_FLAGS_BOTH) { 805 /* 806 * If the change request modifies both the MLS label 807 * effective and range, check that the new effective will be 808 * in the new range. 809 */ 810 if ((new->mm_flags & MAC_MLS_FLAGS_BOTH) == 811 MAC_MLS_FLAGS_BOTH && !mls_effective_in_range(new, new)) 812 return (EINVAL); 813 814 /* 815 * To change the MLS effective label on a credential, the new 816 * effective label must be in the current range. 817 */ 818 if (new->mm_flags & MAC_MLS_FLAG_EFFECTIVE && 819 !mls_effective_in_range(new, subj)) 820 return (EPERM); 821 822 /* 823 * To change the MLS range label on a credential, the new 824 * range must be in the current range. 825 */ 826 if (new->mm_flags & MAC_MLS_FLAG_RANGE && 827 !mls_range_in_range(new, subj)) 828 return (EPERM); 829 830 /* 831 * To have EQUAL in any component of the new credential MLS 832 * label, the subject must already have EQUAL in their label. 833 */ 834 if (mls_contains_equal(new)) { 835 error = mls_subject_privileged(subj); 836 if (error) 837 return (error); 838 } 839 } 840 841 return (0); 842} 843 844static int 845mls_cred_check_visible(struct ucred *cr1, struct ucred *cr2) 846{ 847 struct mac_mls *subj, *obj; 848 849 if (!mls_enabled) 850 return (0); 851 852 subj = SLOT(cr1->cr_label); 853 obj = SLOT(cr2->cr_label); 854 855 /* XXX: range */ 856 if (!mls_dominate_effective(subj, obj)) 857 return (ESRCH); 858 859 return (0); 860} 861 862static void 863mls_cred_relabel(struct ucred *cred, struct label *newlabel) 864{ 865 struct mac_mls *source, *dest; 866 867 source = SLOT(newlabel); 868 dest = SLOT(cred->cr_label); 869 870 mls_copy(source, dest); 871} 872 873static void |
|
744mls_devfs_create_device(struct ucred *cred, struct mount *mp, 745 struct cdev *dev, struct devfs_dirent *de, struct label *delabel) 746{ 747 struct mac_mls *mm; 748 int mls_type; 749 750 mm = SLOT(delabel); 751 if (strcmp(dev->si_name, "null") == 0 || --- 32 unchanged lines hidden (view full) --- 784 785 source = SLOT(cred->cr_label); 786 dest = SLOT(delabel); 787 788 mls_copy_effective(source, dest); 789} 790 791static void | 874mls_devfs_create_device(struct ucred *cred, struct mount *mp, 875 struct cdev *dev, struct devfs_dirent *de, struct label *delabel) 876{ 877 struct mac_mls *mm; 878 int mls_type; 879 880 mm = SLOT(delabel); 881 if (strcmp(dev->si_name, "null") == 0 || --- 32 unchanged lines hidden (view full) --- 914 915 source = SLOT(cred->cr_label); 916 dest = SLOT(delabel); 917 918 mls_copy_effective(source, dest); 919} 920 921static void |
792mls_mount_create(struct ucred *cred, struct mount *mp, struct label *mplabel) 793{ 794 struct mac_mls *source, *dest; 795 796 source = SLOT(cred->cr_label); 797 dest = SLOT(mplabel); 798 799 mls_copy_effective(source, dest); 800} 801 802static void 803mls_vnode_relabel(struct ucred *cred, struct vnode *vp, 804 struct label *vplabel, struct label *label) 805{ 806 struct mac_mls *source, *dest; 807 808 source = SLOT(label); 809 dest = SLOT(vplabel); 810 811 mls_copy(source, dest); 812} 813 814static void | |
815mls_devfs_update(struct mount *mp, struct devfs_dirent *de, 816 struct label *delabel, struct vnode *vp, struct label *vplabel) 817{ 818 struct mac_mls *source, *dest; 819 820 source = SLOT(vplabel); 821 dest = SLOT(delabel); 822 --- 9 unchanged lines hidden (view full) --- 832 833 source = SLOT(delabel); 834 dest = SLOT(vplabel); 835 836 mls_copy_effective(source, dest); 837} 838 839static int | 922mls_devfs_update(struct mount *mp, struct devfs_dirent *de, 923 struct label *delabel, struct vnode *vp, struct label *vplabel) 924{ 925 struct mac_mls *source, *dest; 926 927 source = SLOT(vplabel); 928 dest = SLOT(delabel); 929 --- 9 unchanged lines hidden (view full) --- 939 940 source = SLOT(delabel); 941 dest = SLOT(vplabel); 942 943 mls_copy_effective(source, dest); 944} 945 946static int |
840mls_vnode_associate_extattr(struct mount *mp, struct label *mplabel, 841 struct vnode *vp, struct label *vplabel) | 947mls_ifnet_check_relabel(struct ucred *cred, struct ifnet *ifp, 948 struct label *ifplabel, struct label *newlabel) |
842{ | 949{ |
843 struct mac_mls mm_temp, *source, *dest; 844 int buflen, error; | 950 struct mac_mls *subj, *new; 951 int error; |
845 | 952 |
846 source = SLOT(mplabel); 847 dest = SLOT(vplabel); | 953 subj = SLOT(cred->cr_label); 954 new = SLOT(newlabel); |
848 | 955 |
849 buflen = sizeof(mm_temp); 850 bzero(&mm_temp, buflen); 851 852 error = vn_extattr_get(vp, IO_NODELOCKED, MAC_MLS_EXTATTR_NAMESPACE, 853 MAC_MLS_EXTATTR_NAME, &buflen, (char *) &mm_temp, curthread); 854 if (error == ENOATTR || error == EOPNOTSUPP) { 855 /* Fall back to the mntlabel. */ 856 mls_copy_effective(source, dest); 857 return (0); 858 } else if (error) | 956 /* 957 * If there is an MLS label update for the interface, it may be an 958 * update of effective, range, or both. 959 */ 960 error = mls_atmostflags(new, MAC_MLS_FLAGS_BOTH); 961 if (error) |
859 return (error); 860 | 962 return (error); 963 |
861 if (buflen != sizeof(mm_temp)) { 862 printf("mls_vnode_associate_extattr: bad size %d\n", buflen); 863 return (EPERM); 864 } 865 if (mls_valid(&mm_temp) != 0) { 866 printf("mls_vnode_associate_extattr: invalid\n"); 867 return (EPERM); 868 } 869 if ((mm_temp.mm_flags & MAC_MLS_FLAGS_BOTH) != 870 MAC_MLS_FLAG_EFFECTIVE) { 871 printf("mls_associated_vnode_extattr: not effective\n"); 872 return (EPERM); 873 } | 964 /* 965 * Relabeling network interfaces requires MLS privilege. 966 */ 967 error = mls_subject_privileged(subj); |
874 | 968 |
875 mls_copy_effective(&mm_temp, dest); | |
876 return (0); 877} 878 | 969 return (0); 970} 971 |
879static void 880mls_vnode_associate_singlelabel(struct mount *mp, struct label *mplabel, 881 struct vnode *vp, struct label *vplabel) 882{ 883 struct mac_mls *source, *dest; 884 885 source = SLOT(mplabel); 886 dest = SLOT(vplabel); 887 888 mls_copy_effective(source, dest); 889} 890 | |
891static int | 972static int |
892mls_vnode_create_extattr(struct ucred *cred, struct mount *mp, 893 struct label *mplabel, struct vnode *dvp, struct label *dvplabel, 894 struct vnode *vp, struct label *vplabel, struct componentname *cnp) | 973mls_ifnet_check_transmit(struct ifnet *ifp, struct label *ifplabel, 974 struct mbuf *m, struct label *mlabel) |
895{ | 975{ |
896 struct mac_mls *source, *dest, mm_temp; 897 size_t buflen; 898 int error; | 976 struct mac_mls *p, *i; |
899 | 977 |
900 buflen = sizeof(mm_temp); 901 bzero(&mm_temp, buflen); 902 903 source = SLOT(cred->cr_label); 904 dest = SLOT(vplabel); 905 mls_copy_effective(source, &mm_temp); 906 907 error = vn_extattr_set(vp, IO_NODELOCKED, MAC_MLS_EXTATTR_NAMESPACE, 908 MAC_MLS_EXTATTR_NAME, buflen, (char *) &mm_temp, curthread); 909 if (error == 0) 910 mls_copy_effective(source, dest); 911 return (error); 912} 913 914static int 915mls_vnode_setlabel_extattr(struct ucred *cred, struct vnode *vp, 916 struct label *vplabel, struct label *intlabel) 917{ 918 struct mac_mls *source, mm_temp; 919 size_t buflen; 920 int error; 921 922 buflen = sizeof(mm_temp); 923 bzero(&mm_temp, buflen); 924 925 source = SLOT(intlabel); 926 if ((source->mm_flags & MAC_MLS_FLAG_EFFECTIVE) == 0) | 978 if (!mls_enabled) |
927 return (0); 928 | 979 return (0); 980 |
929 mls_copy_effective(source, &mm_temp); | 981 p = SLOT(mlabel); 982 i = SLOT(ifplabel); |
930 | 983 |
931 error = vn_extattr_set(vp, IO_NODELOCKED, MAC_MLS_EXTATTR_NAMESPACE, 932 MAC_MLS_EXTATTR_NAME, buflen, (char *) &mm_temp, curthread); 933 return (error); | 984 return (mls_effective_in_range(p, i) ? 0 : EACCES); |
934} 935 | 985} 986 |
936/* 937 * Labeling event operations: IPC object. 938 */ | |
939static void | 987static void |
940mls_inpcb_create(struct socket *so, struct label *solabel, struct inpcb *inp, 941 struct label *inplabel) | 988mls_ifnet_create(struct ifnet *ifp, struct label *ifplabel) |
942{ | 989{ |
943 struct mac_mls *source, *dest; | 990 struct mac_mls *dest; 991 int type; |
944 | 992 |
945 source = SLOT(solabel); 946 dest = SLOT(inplabel); | 993 dest = SLOT(ifplabel); |
947 | 994 |
948 mls_copy_effective(source, dest); | 995 if (ifp->if_type == IFT_LOOP) 996 type = MAC_MLS_TYPE_EQUAL; 997 else 998 type = MAC_MLS_TYPE_LOW; 999 1000 mls_set_effective(dest, type, 0, NULL); 1001 mls_set_range(dest, type, 0, NULL, type, 0, NULL); |
949} 950 951static void | 1002} 1003 1004static void |
952mls_socket_create_mbuf(struct socket *so, struct label *solabel, | 1005mls_ifnet_create_mbuf(struct ifnet *ifp, struct label *ifplabel, |
953 struct mbuf *m, struct label *mlabel) 954{ 955 struct mac_mls *source, *dest; 956 | 1006 struct mbuf *m, struct label *mlabel) 1007{ 1008 struct mac_mls *source, *dest; 1009 |
957 source = SLOT(solabel); | 1010 source = SLOT(ifplabel); |
958 dest = SLOT(mlabel); 959 960 mls_copy_effective(source, dest); 961} 962 963static void | 1011 dest = SLOT(mlabel); 1012 1013 mls_copy_effective(source, dest); 1014} 1015 1016static void |
964mls_socket_create(struct ucred *cred, struct socket *so, 965 struct label *solabel) | 1017mls_ifnet_relabel(struct ucred *cred, struct ifnet *ifp, 1018 struct label *ifplabel, struct label *newlabel) |
966{ 967 struct mac_mls *source, *dest; 968 | 1019{ 1020 struct mac_mls *source, *dest; 1021 |
969 source = SLOT(cred->cr_label); 970 dest = SLOT(solabel); | 1022 source = SLOT(newlabel); 1023 dest = SLOT(ifplabel); |
971 | 1024 |
972 mls_copy_effective(source, dest); | 1025 mls_copy(source, dest); |
973} 974 | 1026} 1027 |
975static void 976mls_pipe_create(struct ucred *cred, struct pipepair *pp, 977 struct label *pplabel) | 1028static int 1029mls_inpcb_check_deliver(struct inpcb *inp, struct label *inplabel, 1030 struct mbuf *m, struct label *mlabel) |
978{ | 1031{ |
979 struct mac_mls *source, *dest; | 1032 struct mac_mls *p, *i; |
980 | 1033 |
981 source = SLOT(cred->cr_label); 982 dest = SLOT(pplabel); | 1034 if (!mls_enabled) 1035 return (0); |
983 | 1036 |
984 mls_copy_effective(source, dest); | 1037 p = SLOT(mlabel); 1038 i = SLOT(inplabel); 1039 1040 return (mls_equal_effective(p, i) ? 0 : EACCES); |
985} 986 987static void | 1041} 1042 1043static void |
988mls_posixsem_create(struct ucred *cred, struct ksem *ks, 989 struct label *kslabel) | 1044mls_inpcb_create(struct socket *so, struct label *solabel, struct inpcb *inp, 1045 struct label *inplabel) |
990{ 991 struct mac_mls *source, *dest; 992 | 1046{ 1047 struct mac_mls *source, *dest; 1048 |
993 source = SLOT(cred->cr_label); 994 dest = SLOT(kslabel); | 1049 source = SLOT(solabel); 1050 dest = SLOT(inplabel); |
995 996 mls_copy_effective(source, dest); 997} 998 999static void | 1051 1052 mls_copy_effective(source, dest); 1053} 1054 1055static void |
1000mls_socket_newconn(struct socket *oldso, struct label *oldsolabel, 1001 struct socket *newso, struct label *newsolabel) | 1056mls_inpcb_create_mbuf(struct inpcb *inp, struct label *inplabel, 1057 struct mbuf *m, struct label *mlabel) |
1002{ 1003 struct mac_mls *source, *dest; 1004 | 1058{ 1059 struct mac_mls *source, *dest; 1060 |
1005 source = SLOT(oldsolabel); 1006 dest = SLOT(newsolabel); | 1061 source = SLOT(inplabel); 1062 dest = SLOT(mlabel); |
1007 1008 mls_copy_effective(source, dest); 1009} 1010 1011static void | 1063 1064 mls_copy_effective(source, dest); 1065} 1066 1067static void |
1012mls_socket_relabel(struct ucred *cred, struct socket *so, 1013 struct label *solabel, struct label *newlabel) | 1068mls_inpcb_sosetlabel(struct socket *so, struct label *solabel, 1069 struct inpcb *inp, struct label *inplabel) |
1014{ 1015 struct mac_mls *source, *dest; 1016 | 1070{ 1071 struct mac_mls *source, *dest; 1072 |
1017 source = SLOT(newlabel); 1018 dest = SLOT(solabel); | 1073 source = SLOT(solabel); 1074 dest = SLOT(inplabel); |
1019 1020 mls_copy(source, dest); 1021} 1022 1023static void | 1075 1076 mls_copy(source, dest); 1077} 1078 1079static void |
1024mls_pipe_relabel(struct ucred *cred, struct pipepair *pp, 1025 struct label *pplabel, struct label *newlabel) | 1080mls_ipq_create(struct mbuf *m, struct label *mlabel, struct ipq *ipq, 1081 struct label *ipqlabel) |
1026{ 1027 struct mac_mls *source, *dest; 1028 | 1082{ 1083 struct mac_mls *source, *dest; 1084 |
1029 source = SLOT(newlabel); 1030 dest = SLOT(pplabel); 1031 1032 mls_copy(source, dest); 1033} 1034 1035static void 1036mls_socketpeer_set_from_mbuf(struct mbuf *m, struct label *mlabel, 1037 struct socket *so, struct label *sopeerlabel) 1038{ 1039 struct mac_mls *source, *dest; 1040 | |
1041 source = SLOT(mlabel); | 1085 source = SLOT(mlabel); |
1042 dest = SLOT(sopeerlabel); | 1086 dest = SLOT(ipqlabel); |
1043 1044 mls_copy_effective(source, dest); 1045} 1046 | 1087 1088 mls_copy_effective(source, dest); 1089} 1090 |
1047/* 1048 * Labeling event operations: System V IPC objects. 1049 */ 1050static void 1051mls_sysvmsg_create(struct ucred *cred, struct msqid_kernel *msqkptr, 1052 struct label *msqlabel, struct msg *msgptr, struct label *msglabel) | 1091static int 1092mls_ipq_match(struct mbuf *m, struct label *mlabel, struct ipq *ipq, 1093 struct label *ipqlabel) |
1053{ | 1094{ |
1054 struct mac_mls *source, *dest; | 1095 struct mac_mls *a, *b; |
1055 | 1096 |
1056 /* Ignore the msgq label. */ 1057 source = SLOT(cred->cr_label); 1058 dest = SLOT(msglabel); | 1097 a = SLOT(ipqlabel); 1098 b = SLOT(mlabel); |
1059 | 1099 |
1060 mls_copy_effective(source, dest); | 1100 return (mls_equal_effective(a, b)); |
1061} 1062 1063static void | 1101} 1102 1103static void |
1064mls_sysvmsq_create(struct ucred *cred, struct msqid_kernel *msqkptr, 1065 struct label *msqlabel) | 1104mls_ipq_reassemble(struct ipq *ipq, struct label *ipqlabel, struct mbuf *m, 1105 struct label *mlabel) |
1066{ 1067 struct mac_mls *source, *dest; 1068 | 1106{ 1107 struct mac_mls *source, *dest; 1108 |
1069 source = SLOT(cred->cr_label); 1070 dest = SLOT(msqlabel); | 1109 source = SLOT(ipqlabel); 1110 dest = SLOT(mlabel); |
1071 | 1111 |
1112 /* Just use the head, since we require them all to match. */ |
|
1072 mls_copy_effective(source, dest); 1073} 1074 1075static void | 1113 mls_copy_effective(source, dest); 1114} 1115 1116static void |
1076mls_sysvsem_create(struct ucred *cred, struct semid_kernel *semakptr, 1077 struct label *semalabel) | 1117mls_ipq_update(struct mbuf *m, struct label *mlabel, struct ipq *ipq, 1118 struct label *ipqlabel) |
1078{ | 1119{ |
1079 struct mac_mls *source, *dest; | |
1080 | 1120 |
1081 source = SLOT(cred->cr_label); 1082 dest = SLOT(semalabel); 1083 1084 mls_copy_effective(source, dest); | 1121 /* NOOP: we only accept matching labels, so no need to update */ |
1085} 1086 | 1122} 1123 |
1087static void 1088mls_sysvshm_create(struct ucred *cred, struct shmid_kernel *shmsegptr, 1089 struct label *shmlabel) | 1124static int 1125mls_mount_check_stat(struct ucred *cred, struct mount *mp, 1126 struct label *mntlabel) |
1090{ | 1127{ |
1091 struct mac_mls *source, *dest; | 1128 struct mac_mls *subj, *obj; |
1092 | 1129 |
1093 source = SLOT(cred->cr_label); 1094 dest = SLOT(shmlabel); | 1130 if (!mls_enabled) 1131 return (0); |
1095 | 1132 |
1096 mls_copy_effective(source, dest); | 1133 subj = SLOT(cred->cr_label); 1134 obj = SLOT(mntlabel); 1135 1136 if (!mls_dominate_effective(subj, obj)) 1137 return (EACCES); 1138 1139 return (0); |
1097} 1098 | 1140} 1141 |
1099/* 1100 * Labeling event operations: network objects. 1101 */ | |
1102static void | 1142static void |
1103mls_socketpeer_set_from_socket(struct socket *oldso, 1104 struct label *oldsolabel, struct socket *newso, 1105 struct label *newsopeerlabel) | 1143mls_mount_create(struct ucred *cred, struct mount *mp, struct label *mplabel) |
1106{ 1107 struct mac_mls *source, *dest; 1108 | 1144{ 1145 struct mac_mls *source, *dest; 1146 |
1109 source = SLOT(oldsolabel); 1110 dest = SLOT(newsopeerlabel); | 1147 source = SLOT(cred->cr_label); 1148 dest = SLOT(mplabel); |
1111 1112 mls_copy_effective(source, dest); 1113} 1114 1115static void | 1149 1150 mls_copy_effective(source, dest); 1151} 1152 1153static void |
1116mls_bpfdesc_create(struct ucred *cred, struct bpf_d *d, struct label *dlabel) | 1154mls_netatalk_aarp_send(struct ifnet *ifp, struct label *ifplabel, 1155 struct mbuf *m, struct label *mlabel) |
1117{ | 1156{ |
1118 struct mac_mls *source, *dest; | 1157 struct mac_mls *dest; |
1119 | 1158 |
1120 source = SLOT(cred->cr_label); 1121 dest = SLOT(dlabel); | 1159 dest = SLOT(mlabel); |
1122 | 1160 |
1123 mls_copy_effective(source, dest); | 1161 mls_set_effective(dest, MAC_MLS_TYPE_EQUAL, 0, NULL); |
1124} 1125 1126static void | 1162} 1163 1164static void |
1127mls_ifnet_create(struct ifnet *ifp, struct label *ifplabel) | 1165mls_netinet_arp_send(struct ifnet *ifp, struct label *ifplabel, 1166 struct mbuf *m, struct label *mlabel) |
1128{ 1129 struct mac_mls *dest; | 1167{ 1168 struct mac_mls *dest; |
1130 int type; | |
1131 | 1169 |
1132 dest = SLOT(ifplabel); | 1170 dest = SLOT(mlabel); |
1133 | 1171 |
1134 if (ifp->if_type == IFT_LOOP) 1135 type = MAC_MLS_TYPE_EQUAL; 1136 else 1137 type = MAC_MLS_TYPE_LOW; 1138 1139 mls_set_effective(dest, type, 0, NULL); 1140 mls_set_range(dest, type, 0, NULL, type, 0, NULL); | 1172 mls_set_effective(dest, MAC_MLS_TYPE_EQUAL, 0, NULL); |
1141} 1142 1143static void | 1173} 1174 1175static void |
1144mls_ipq_create(struct mbuf *m, struct label *mlabel, struct ipq *ipq, 1145 struct label *ipqlabel) | 1176mls_netinet_firewall_reply(struct mbuf *mrecv, struct label *mrecvlabel, 1177 struct mbuf *msend, struct label *msendlabel) |
1146{ 1147 struct mac_mls *source, *dest; 1148 | 1178{ 1179 struct mac_mls *source, *dest; 1180 |
1149 source = SLOT(mlabel); 1150 dest = SLOT(ipqlabel); | 1181 source = SLOT(mrecvlabel); 1182 dest = SLOT(msendlabel); |
1151 1152 mls_copy_effective(source, dest); 1153} 1154 1155static void | 1183 1184 mls_copy_effective(source, dest); 1185} 1186 1187static void |
1156mls_ipq_reassemble(struct ipq *ipq, struct label *ipqlabel, struct mbuf *m, 1157 struct label *mlabel) | 1188mls_netinet_firewall_send(struct mbuf *m, struct label *mlabel) |
1158{ | 1189{ |
1159 struct mac_mls *source, *dest; | 1190 struct mac_mls *dest; |
1160 | 1191 |
1161 source = SLOT(ipqlabel); | |
1162 dest = SLOT(mlabel); 1163 | 1192 dest = SLOT(mlabel); 1193 |
1164 /* Just use the head, since we require them all to match. */ 1165 mls_copy_effective(source, dest); | 1194 /* XXX: where is the label for the firewall really comming from? */ 1195 mls_set_effective(dest, MAC_MLS_TYPE_EQUAL, 0, NULL); |
1166} 1167 1168static void 1169mls_netinet_fragment(struct mbuf *m, struct label *mlabel, struct mbuf *frag, 1170 struct label *fraglabel) 1171{ 1172 struct mac_mls *source, *dest; 1173 1174 source = SLOT(mlabel); 1175 dest = SLOT(fraglabel); 1176 1177 mls_copy_effective(source, dest); 1178} 1179 1180static void | 1196} 1197 1198static void 1199mls_netinet_fragment(struct mbuf *m, struct label *mlabel, struct mbuf *frag, 1200 struct label *fraglabel) 1201{ 1202 struct mac_mls *source, *dest; 1203 1204 source = SLOT(mlabel); 1205 dest = SLOT(fraglabel); 1206 1207 mls_copy_effective(source, dest); 1208} 1209 1210static void |
1181mls_inpcb_create_mbuf(struct inpcb *inp, struct label *inplabel, 1182 struct mbuf *m, struct label *mlabel) | 1211mls_netinet_icmp_reply(struct mbuf *mrecv, struct label *mrecvlabel, 1212 struct mbuf *msend, struct label *msendlabel) |
1183{ 1184 struct mac_mls *source, *dest; 1185 | 1213{ 1214 struct mac_mls *source, *dest; 1215 |
1186 source = SLOT(inplabel); 1187 dest = SLOT(mlabel); | 1216 source = SLOT(mrecvlabel); 1217 dest = SLOT(msendlabel); |
1188 1189 mls_copy_effective(source, dest); 1190} 1191 1192static void | 1218 1219 mls_copy_effective(source, dest); 1220} 1221 1222static void |
1193mls_bpfdesc_create_mbuf(struct bpf_d *d, struct label *dlabel, | 1223mls_netinet_igmp_send(struct ifnet *ifp, struct label *ifplabel, |
1194 struct mbuf *m, struct label *mlabel) 1195{ | 1224 struct mbuf *m, struct label *mlabel) 1225{ |
1196 struct mac_mls *source, *dest; | 1226 struct mac_mls *dest; |
1197 | 1227 |
1198 source = SLOT(dlabel); | |
1199 dest = SLOT(mlabel); 1200 | 1228 dest = SLOT(mlabel); 1229 |
1201 mls_copy_effective(source, dest); | 1230 mls_set_effective(dest, MAC_MLS_TYPE_EQUAL, 0, NULL); |
1202} 1203 1204static void | 1231} 1232 1233static void |
1205mls_ifnet_create_mbuf(struct ifnet *ifp, struct label *ifplabel, | 1234mls_netinet6_nd6_send(struct ifnet *ifp, struct label *ifplabel, |
1206 struct mbuf *m, struct label *mlabel) 1207{ | 1235 struct mbuf *m, struct label *mlabel) 1236{ |
1208 struct mac_mls *source, *dest; | 1237 struct mac_mls *dest; |
1209 | 1238 |
1210 source = SLOT(ifplabel); | |
1211 dest = SLOT(mlabel); 1212 | 1239 dest = SLOT(mlabel); 1240 |
1213 mls_copy_effective(source, dest); | 1241 mls_set_effective(dest, MAC_MLS_TYPE_EQUAL, 0, NULL); |
1214} 1215 1216static int | 1242} 1243 1244static int |
1217mls_ipq_match(struct mbuf *m, struct label *mlabel, struct ipq *ipq, 1218 struct label *ipqlabel) | 1245mls_pipe_check_ioctl(struct ucred *cred, struct pipepair *pp, 1246 struct label *pplabel, unsigned long cmd, void /* caddr_t */ *data) |
1219{ | 1247{ |
1220 struct mac_mls *a, *b; | |
1221 | 1248 |
1222 a = SLOT(ipqlabel); 1223 b = SLOT(mlabel); | 1249 if (!mls_enabled) 1250 return (0); |
1224 | 1251 |
1225 return (mls_equal_effective(a, b)); | 1252 /* XXX: This will be implemented soon... */ 1253 1254 return (0); |
1226} 1227 | 1255} 1256 |
1228static void 1229mls_ifnet_relabel(struct ucred *cred, struct ifnet *ifp, 1230 struct label *ifplabel, struct label *newlabel) | 1257static int 1258mls_pipe_check_poll(struct ucred *cred, struct pipepair *pp, 1259 struct label *pplabel) |
1231{ | 1260{ |
1232 struct mac_mls *source, *dest; | 1261 struct mac_mls *subj, *obj; |
1233 | 1262 |
1234 source = SLOT(newlabel); 1235 dest = SLOT(ifplabel); | 1263 if (!mls_enabled) 1264 return (0); |
1236 | 1265 |
1237 mls_copy(source, dest); 1238} | 1266 subj = SLOT(cred->cr_label); 1267 obj = SLOT(pplabel); |
1239 | 1268 |
1240static void 1241mls_ipq_update(struct mbuf *m, struct label *mlabel, struct ipq *ipq, 1242 struct label *ipqlabel) 1243{ | 1269 if (!mls_dominate_effective(subj, obj)) 1270 return (EACCES); |
1244 | 1271 |
1245 /* NOOP: we only accept matching labels, so no need to update */ | 1272 return (0); |
1246} 1247 | 1273} 1274 |
1248static void 1249mls_inpcb_sosetlabel(struct socket *so, struct label *solabel, 1250 struct inpcb *inp, struct label *inplabel) | 1275static int 1276mls_pipe_check_read(struct ucred *cred, struct pipepair *pp, 1277 struct label *pplabel) |
1251{ | 1278{ |
1252 struct mac_mls *source, *dest; | 1279 struct mac_mls *subj, *obj; |
1253 | 1280 |
1254 source = SLOT(solabel); 1255 dest = SLOT(inplabel); | 1281 if (!mls_enabled) 1282 return (0); |
1256 | 1283 |
1257 mls_copy(source, dest); | 1284 subj = SLOT(cred->cr_label); 1285 obj = SLOT(pplabel); 1286 1287 if (!mls_dominate_effective(subj, obj)) 1288 return (EACCES); 1289 1290 return (0); |
1258} 1259 | 1291} 1292 |
1260static void 1261mls_netatalk_aarp_send(struct ifnet *ifp, struct label *ifplabel, 1262 struct mbuf *m, struct label *mlabel) | 1293static int 1294mls_pipe_check_relabel(struct ucred *cred, struct pipepair *pp, 1295 struct label *pplabel, struct label *newlabel) |
1263{ | 1296{ |
1264 struct mac_mls *dest; | 1297 struct mac_mls *subj, *obj, *new; 1298 int error; |
1265 | 1299 |
1266 dest = SLOT(mlabel); | 1300 new = SLOT(newlabel); 1301 subj = SLOT(cred->cr_label); 1302 obj = SLOT(pplabel); |
1267 | 1303 |
1268 mls_set_effective(dest, MAC_MLS_TYPE_EQUAL, 0, NULL); 1269} | 1304 /* 1305 * If there is an MLS label update for a pipe, it must be a effective 1306 * update. 1307 */ 1308 error = mls_atmostflags(new, MAC_MLS_FLAG_EFFECTIVE); 1309 if (error) 1310 return (error); |
1270 | 1311 |
1271static void 1272mls_netinet_arp_send(struct ifnet *ifp, struct label *ifplabel, 1273 struct mbuf *m, struct label *mlabel) 1274{ 1275 struct mac_mls *dest; | 1312 /* 1313 * To perform a relabel of a pipe (MLS label or not), MLS must 1314 * authorize the relabel. 1315 */ 1316 if (!mls_effective_in_range(obj, subj)) 1317 return (EPERM); |
1276 | 1318 |
1277 dest = SLOT(mlabel); | 1319 /* 1320 * If the MLS label is to be changed, authorize as appropriate. 1321 */ 1322 if (new->mm_flags & MAC_MLS_FLAG_EFFECTIVE) { 1323 /* 1324 * To change the MLS label on a pipe, the new pipe label must 1325 * be in the subject range. 1326 */ 1327 if (!mls_effective_in_range(new, subj)) 1328 return (EPERM); |
1278 | 1329 |
1279 mls_set_effective(dest, MAC_MLS_TYPE_EQUAL, 0, NULL); | 1330 /* 1331 * To change the MLS label on a pipe to be EQUAL, the subject 1332 * must have appropriate privilege. 1333 */ 1334 if (mls_contains_equal(new)) { 1335 error = mls_subject_privileged(subj); 1336 if (error) 1337 return (error); 1338 } 1339 } 1340 1341 return (0); |
1280} 1281 | 1342} 1343 |
1282static void 1283mls_netinet_firewall_reply(struct mbuf *mrecv, struct label *mrecvlabel, 1284 struct mbuf *msend, struct label *msendlabel) | 1344static int 1345mls_pipe_check_stat(struct ucred *cred, struct pipepair *pp, 1346 struct label *pplabel) |
1285{ | 1347{ |
1286 struct mac_mls *source, *dest; | 1348 struct mac_mls *subj, *obj; |
1287 | 1349 |
1288 source = SLOT(mrecvlabel); 1289 dest = SLOT(msendlabel); | 1350 if (!mls_enabled) 1351 return (0); |
1290 | 1352 |
1291 mls_copy_effective(source, dest); | 1353 subj = SLOT(cred->cr_label); 1354 obj = SLOT(pplabel); 1355 1356 if (!mls_dominate_effective(subj, obj)) 1357 return (EACCES); 1358 1359 return (0); |
1292} 1293 | 1360} 1361 |
1294static void 1295mls_netinet_firewall_send(struct mbuf *m, struct label *mlabel) | 1362static int 1363mls_pipe_check_write(struct ucred *cred, struct pipepair *pp, 1364 struct label *pplabel) |
1296{ | 1365{ |
1297 struct mac_mls *dest; | 1366 struct mac_mls *subj, *obj; |
1298 | 1367 |
1299 dest = SLOT(mlabel); | 1368 if (!mls_enabled) 1369 return (0); |
1300 | 1370 |
1301 /* XXX: where is the label for the firewall really comming from? */ 1302 mls_set_effective(dest, MAC_MLS_TYPE_EQUAL, 0, NULL); | 1371 subj = SLOT(cred->cr_label); 1372 obj = SLOT(pplabel); 1373 1374 if (!mls_dominate_effective(obj, subj)) 1375 return (EACCES); 1376 1377 return (0); |
1303} 1304 1305static void | 1378} 1379 1380static void |
1306mls_netinet_icmp_reply(struct mbuf *mrecv, struct label *mrecvlabel, 1307 struct mbuf *msend, struct label *msendlabel) | 1381mls_pipe_create(struct ucred *cred, struct pipepair *pp, 1382 struct label *pplabel) |
1308{ 1309 struct mac_mls *source, *dest; 1310 | 1383{ 1384 struct mac_mls *source, *dest; 1385 |
1311 source = SLOT(mrecvlabel); 1312 dest = SLOT(msendlabel); | 1386 source = SLOT(cred->cr_label); 1387 dest = SLOT(pplabel); |
1313 1314 mls_copy_effective(source, dest); 1315} 1316 1317static void | 1388 1389 mls_copy_effective(source, dest); 1390} 1391 1392static void |
1318mls_netinet_igmp_send(struct ifnet *ifp, struct label *ifplabel, 1319 struct mbuf *m, struct label *mlabel) | 1393mls_pipe_relabel(struct ucred *cred, struct pipepair *pp, 1394 struct label *pplabel, struct label *newlabel) |
1320{ | 1395{ |
1321 struct mac_mls *dest; | 1396 struct mac_mls *source, *dest; |
1322 | 1397 |
1323 dest = SLOT(mlabel); | 1398 source = SLOT(newlabel); 1399 dest = SLOT(pplabel); |
1324 | 1400 |
1325 mls_set_effective(dest, MAC_MLS_TYPE_EQUAL, 0, NULL); | 1401 mls_copy(source, dest); |
1326} 1327 | 1402} 1403 |
1328static void 1329mls_netinet6_nd6_send(struct ifnet *ifp, struct label *ifplabel, 1330 struct mbuf *m, struct label *mlabel) | 1404static int 1405mls_posixsem_check_rdonly(struct ucred *cred, struct ksem *ks, 1406 struct label *kslabel) |
1331{ | 1407{ |
1332 struct mac_mls *dest; | 1408 struct mac_mls *subj, *obj; |
1333 | 1409 |
1334 dest = SLOT(mlabel); | 1410 if (!mls_enabled) 1411 return (0); |
1335 | 1412 |
1336 mls_set_effective(dest, MAC_MLS_TYPE_EQUAL, 0, NULL); 1337} | 1413 subj = SLOT(cred->cr_label); 1414 obj = SLOT(kslabel); |
1338 | 1415 |
1339static void 1340mls_syncache_create(struct label *label, struct inpcb *inp) 1341{ 1342 struct mac_mls *source, *dest; | 1416 if (!mls_dominate_effective(subj, obj)) 1417 return (EACCES); |
1343 | 1418 |
1344 source = SLOT(inp->inp_label); 1345 dest = SLOT(label); 1346 1347 mls_copy_effective(source, dest); | 1419 return (0); |
1348} 1349 | 1420} 1421 |
1350static void 1351mls_syncache_create_mbuf(struct label *sc_label, struct mbuf *m, 1352 struct label *mlabel) | 1422static int 1423mls_posixsem_check_write(struct ucred *cred, struct ksem *ks, 1424 struct label *kslabel) |
1353{ | 1425{ |
1354 struct mac_mls *source, *dest; | 1426 struct mac_mls *subj, *obj; |
1355 | 1427 |
1356 source = SLOT(sc_label); 1357 dest = SLOT(mlabel); | 1428 if (!mls_enabled) 1429 return (0); |
1358 | 1430 |
1359 mls_copy_effective(source, dest); 1360} | 1431 subj = SLOT(cred->cr_label); 1432 obj = SLOT(kslabel); |
1361 | 1433 |
1362/* 1363 * Labeling event operations: processes. 1364 */ 1365static void 1366mls_proc_create_swapper(struct ucred *cred) 1367{ 1368 struct mac_mls *dest; | 1434 if (!mls_dominate_effective(obj, subj)) 1435 return (EACCES); |
1369 | 1436 |
1370 dest = SLOT(cred->cr_label); 1371 1372 mls_set_effective(dest, MAC_MLS_TYPE_EQUAL, 0, NULL); 1373 mls_set_range(dest, MAC_MLS_TYPE_LOW, 0, NULL, MAC_MLS_TYPE_HIGH, 0, 1374 NULL); | 1437 return (0); |
1375} 1376 1377static void | 1438} 1439 1440static void |
1378mls_proc_create_init(struct ucred *cred) | 1441mls_posixsem_create(struct ucred *cred, struct ksem *ks, 1442 struct label *kslabel) |
1379{ | 1443{ |
1380 struct mac_mls *dest; | 1444 struct mac_mls *source, *dest; |
1381 | 1445 |
1382 dest = SLOT(cred->cr_label); | 1446 source = SLOT(cred->cr_label); 1447 dest = SLOT(kslabel); |
1383 | 1448 |
1384 mls_set_effective(dest, MAC_MLS_TYPE_LOW, 0, NULL); 1385 mls_set_range(dest, MAC_MLS_TYPE_LOW, 0, NULL, MAC_MLS_TYPE_HIGH, 0, 1386 NULL); | 1449 mls_copy_effective(source, dest); |
1387} 1388 1389static void 1390mls_proc_associate_nfsd(struct ucred *cred) 1391{ 1392 struct mac_mls *label; 1393 1394 label = SLOT(cred->cr_label); 1395 mls_set_effective(label, MAC_MLS_TYPE_LOW, 0, NULL); 1396 mls_set_range(label, MAC_MLS_TYPE_LOW, 0, NULL, MAC_MLS_TYPE_HIGH, 0, 1397 NULL); 1398} 1399 | 1450} 1451 1452static void 1453mls_proc_associate_nfsd(struct ucred *cred) 1454{ 1455 struct mac_mls *label; 1456 1457 label = SLOT(cred->cr_label); 1458 mls_set_effective(label, MAC_MLS_TYPE_LOW, 0, NULL); 1459 mls_set_range(label, MAC_MLS_TYPE_LOW, 0, NULL, MAC_MLS_TYPE_HIGH, 0, 1460 NULL); 1461} 1462 |
1400static void 1401mls_cred_relabel(struct ucred *cred, struct label *newlabel) | 1463static int 1464mls_proc_check_debug(struct ucred *cred, struct proc *p) |
1402{ | 1465{ |
1403 struct mac_mls *source, *dest; | 1466 struct mac_mls *subj, *obj; |
1404 | 1467 |
1405 source = SLOT(newlabel); 1406 dest = SLOT(cred->cr_label); | 1468 if (!mls_enabled) 1469 return (0); |
1407 | 1470 |
1408 mls_copy(source, dest); | 1471 subj = SLOT(cred->cr_label); 1472 obj = SLOT(p->p_ucred->cr_label); 1473 1474 /* XXX: range checks */ 1475 if (!mls_dominate_effective(subj, obj)) 1476 return (ESRCH); 1477 if (!mls_dominate_effective(obj, subj)) 1478 return (EACCES); 1479 1480 return (0); |
1409} 1410 | 1481} 1482 |
1411/* 1412 * Label cleanup/flush operations. 1413 */ 1414static void 1415mls_sysvmsg_cleanup(struct label *msglabel) | 1483static int 1484mls_proc_check_sched(struct ucred *cred, struct proc *p) |
1416{ | 1485{ |
1486 struct mac_mls *subj, *obj; |
|
1417 | 1487 |
1418 bzero(SLOT(msglabel), sizeof(struct mac_mls)); | 1488 if (!mls_enabled) 1489 return (0); 1490 1491 subj = SLOT(cred->cr_label); 1492 obj = SLOT(p->p_ucred->cr_label); 1493 1494 /* XXX: range checks */ 1495 if (!mls_dominate_effective(subj, obj)) 1496 return (ESRCH); 1497 if (!mls_dominate_effective(obj, subj)) 1498 return (EACCES); 1499 1500 return (0); |
1419} 1420 | 1501} 1502 |
1421static void 1422mls_sysvmsq_cleanup(struct label *msqlabel) | 1503static int 1504mls_proc_check_signal(struct ucred *cred, struct proc *p, int signum) |
1423{ | 1505{ |
1506 struct mac_mls *subj, *obj; |
|
1424 | 1507 |
1425 bzero(SLOT(msqlabel), sizeof(struct mac_mls)); | 1508 if (!mls_enabled) 1509 return (0); 1510 1511 subj = SLOT(cred->cr_label); 1512 obj = SLOT(p->p_ucred->cr_label); 1513 1514 /* XXX: range checks */ 1515 if (!mls_dominate_effective(subj, obj)) 1516 return (ESRCH); 1517 if (!mls_dominate_effective(obj, subj)) 1518 return (EACCES); 1519 1520 return (0); |
1426} 1427 1428static void | 1521} 1522 1523static void |
1429mls_sysvsem_cleanup(struct label *semalabel) | 1524mls_proc_create_init(struct ucred *cred) |
1430{ | 1525{ |
1526 struct mac_mls *dest; |
|
1431 | 1527 |
1432 bzero(SLOT(semalabel), sizeof(struct mac_mls)); | 1528 dest = SLOT(cred->cr_label); 1529 1530 mls_set_effective(dest, MAC_MLS_TYPE_LOW, 0, NULL); 1531 mls_set_range(dest, MAC_MLS_TYPE_LOW, 0, NULL, MAC_MLS_TYPE_HIGH, 0, 1532 NULL); |
1433} 1434 1435static void | 1533} 1534 1535static void |
1436mls_sysvshm_cleanup(struct label *shmlabel) | 1536mls_proc_create_swapper(struct ucred *cred) |
1437{ | 1537{ |
1538 struct mac_mls *dest; |
|
1438 | 1539 |
1439 bzero(SLOT(shmlabel), sizeof(struct mac_mls)); | 1540 dest = SLOT(cred->cr_label); 1541 1542 mls_set_effective(dest, MAC_MLS_TYPE_EQUAL, 0, NULL); 1543 mls_set_range(dest, MAC_MLS_TYPE_LOW, 0, NULL, MAC_MLS_TYPE_HIGH, 0, 1544 NULL); |
1440} 1441 | 1545} 1546 |
1442/* 1443 * Access control checks. 1444 */ | |
1445static int | 1547static int |
1446mls_bpfdesc_check_receive(struct bpf_d *d, struct label *dlabel, 1447 struct ifnet *ifp, struct label *ifplabel) | 1548mls_socket_check_deliver(struct socket *so, struct label *solabel, 1549 struct mbuf *m, struct label *mlabel) |
1448{ | 1550{ |
1449 struct mac_mls *a, *b; | 1551 struct mac_mls *p, *s; |
1450 1451 if (!mls_enabled) 1452 return (0); 1453 | 1552 1553 if (!mls_enabled) 1554 return (0); 1555 |
1454 a = SLOT(dlabel); 1455 b = SLOT(ifplabel); | 1556 p = SLOT(mlabel); 1557 s = SLOT(solabel); |
1456 | 1558 |
1457 if (mls_equal_effective(a, b)) 1458 return (0); 1459 return (EACCES); | 1559 return (mls_equal_effective(p, s) ? 0 : EACCES); |
1460} 1461 1462static int | 1560} 1561 1562static int |
1463mls_cred_check_relabel(struct ucred *cred, struct label *newlabel) | 1563mls_socket_check_relabel(struct ucred *cred, struct socket *so, 1564 struct label *solabel, struct label *newlabel) |
1464{ | 1565{ |
1465 struct mac_mls *subj, *new; | 1566 struct mac_mls *subj, *obj, *new; |
1466 int error; 1467 | 1567 int error; 1568 |
1468 subj = SLOT(cred->cr_label); | |
1469 new = SLOT(newlabel); | 1569 new = SLOT(newlabel); |
1570 subj = SLOT(cred->cr_label); 1571 obj = SLOT(solabel); |
|
1470 1471 /* | 1572 1573 /* |
1472 * If there is an MLS label update for the credential, it may be an 1473 * update of effective, range, or both. | 1574 * If there is an MLS label update for the socket, it may be an 1575 * update of effective. |
1474 */ | 1576 */ |
1475 error = mls_atmostflags(new, MAC_MLS_FLAGS_BOTH); | 1577 error = mls_atmostflags(new, MAC_MLS_FLAG_EFFECTIVE); |
1476 if (error) 1477 return (error); 1478 1479 /* | 1578 if (error) 1579 return (error); 1580 1581 /* |
1582 * To relabel a socket, the old socket effective must be in the 1583 * subject range. 1584 */ 1585 if (!mls_effective_in_range(obj, subj)) 1586 return (EPERM); 1587 1588 /* |
|
1480 * If the MLS label is to be changed, authorize as appropriate. 1481 */ | 1589 * If the MLS label is to be changed, authorize as appropriate. 1590 */ |
1482 if (new->mm_flags & MAC_MLS_FLAGS_BOTH) { | 1591 if (new->mm_flags & MAC_MLS_FLAG_EFFECTIVE) { |
1483 /* | 1592 /* |
1484 * If the change request modifies both the MLS label 1485 * effective and range, check that the new effective will be 1486 * in the new range. | 1593 * To relabel a socket, the new socket effective must be in 1594 * the subject range. |
1487 */ | 1595 */ |
1488 if ((new->mm_flags & MAC_MLS_FLAGS_BOTH) == 1489 MAC_MLS_FLAGS_BOTH && !mls_effective_in_range(new, new)) 1490 return (EINVAL); 1491 1492 /* 1493 * To change the MLS effective label on a credential, the new 1494 * effective label must be in the current range. 1495 */ 1496 if (new->mm_flags & MAC_MLS_FLAG_EFFECTIVE && 1497 !mls_effective_in_range(new, subj)) | 1596 if (!mls_effective_in_range(new, subj)) |
1498 return (EPERM); 1499 1500 /* | 1597 return (EPERM); 1598 1599 /* |
1501 * To change the MLS range label on a credential, the new 1502 * range must be in the current range. | 1600 * To change the MLS label on the socket to contain EQUAL, 1601 * the subject must have appropriate privilege. |
1503 */ | 1602 */ |
1504 if (new->mm_flags & MAC_MLS_FLAG_RANGE && 1505 !mls_range_in_range(new, subj)) 1506 return (EPERM); 1507 1508 /* 1509 * To have EQUAL in any component of the new credential MLS 1510 * label, the subject must already have EQUAL in their label. 1511 */ | |
1512 if (mls_contains_equal(new)) { 1513 error = mls_subject_privileged(subj); 1514 if (error) 1515 return (error); 1516 } 1517 } 1518 1519 return (0); 1520} 1521 1522static int | 1603 if (mls_contains_equal(new)) { 1604 error = mls_subject_privileged(subj); 1605 if (error) 1606 return (error); 1607 } 1608 } 1609 1610 return (0); 1611} 1612 1613static int |
1523mls_cred_check_visible(struct ucred *cr1, struct ucred *cr2) | 1614mls_socket_check_visible(struct ucred *cred, struct socket *so, 1615 struct label *solabel) |
1524{ 1525 struct mac_mls *subj, *obj; 1526 1527 if (!mls_enabled) 1528 return (0); 1529 | 1616{ 1617 struct mac_mls *subj, *obj; 1618 1619 if (!mls_enabled) 1620 return (0); 1621 |
1530 subj = SLOT(cr1->cr_label); 1531 obj = SLOT(cr2->cr_label); | 1622 subj = SLOT(cred->cr_label); 1623 obj = SLOT(solabel); |
1532 | 1624 |
1533 /* XXX: range */ | |
1534 if (!mls_dominate_effective(subj, obj)) | 1625 if (!mls_dominate_effective(subj, obj)) |
1535 return (ESRCH); | 1626 return (ENOENT); |
1536 1537 return (0); 1538} 1539 | 1627 1628 return (0); 1629} 1630 |
1631static void 1632mls_socket_create(struct ucred *cred, struct socket *so, 1633 struct label *solabel) 1634{ 1635 struct mac_mls *source, *dest; 1636 1637 source = SLOT(cred->cr_label); 1638 dest = SLOT(solabel); 1639 1640 mls_copy_effective(source, dest); 1641} 1642 1643static void 1644mls_socket_create_mbuf(struct socket *so, struct label *solabel, 1645 struct mbuf *m, struct label *mlabel) 1646{ 1647 struct mac_mls *source, *dest; 1648 1649 source = SLOT(solabel); 1650 dest = SLOT(mlabel); 1651 1652 mls_copy_effective(source, dest); 1653} 1654 1655static void 1656mls_socket_newconn(struct socket *oldso, struct label *oldsolabel, 1657 struct socket *newso, struct label *newsolabel) 1658{ 1659 struct mac_mls *source, *dest; 1660 1661 source = SLOT(oldsolabel); 1662 dest = SLOT(newsolabel); 1663 1664 mls_copy_effective(source, dest); 1665} 1666 1667static void 1668mls_socket_relabel(struct ucred *cred, struct socket *so, 1669 struct label *solabel, struct label *newlabel) 1670{ 1671 struct mac_mls *source, *dest; 1672 1673 source = SLOT(newlabel); 1674 dest = SLOT(solabel); 1675 1676 mls_copy(source, dest); 1677} 1678 1679static void 1680mls_socketpeer_set_from_mbuf(struct mbuf *m, struct label *mlabel, 1681 struct socket *so, struct label *sopeerlabel) 1682{ 1683 struct mac_mls *source, *dest; 1684 1685 source = SLOT(mlabel); 1686 dest = SLOT(sopeerlabel); 1687 1688 mls_copy_effective(source, dest); 1689} 1690 1691static void 1692mls_socketpeer_set_from_socket(struct socket *oldso, 1693 struct label *oldsolabel, struct socket *newso, 1694 struct label *newsopeerlabel) 1695{ 1696 struct mac_mls *source, *dest; 1697 1698 source = SLOT(oldsolabel); 1699 dest = SLOT(newsopeerlabel); 1700 1701 mls_copy_effective(source, dest); 1702} 1703 1704static void 1705mls_syncache_create(struct label *label, struct inpcb *inp) 1706{ 1707 struct mac_mls *source, *dest; 1708 1709 source = SLOT(inp->inp_label); 1710 dest = SLOT(label); 1711 1712 mls_copy_effective(source, dest); 1713} 1714 1715static void 1716mls_syncache_create_mbuf(struct label *sc_label, struct mbuf *m, 1717 struct label *mlabel) 1718{ 1719 struct mac_mls *source, *dest; 1720 1721 source = SLOT(sc_label); 1722 dest = SLOT(mlabel); 1723 1724 mls_copy_effective(source, dest); 1725} 1726 |
|
1540static int | 1727static int |
1541mls_ifnet_check_relabel(struct ucred *cred, struct ifnet *ifp, 1542 struct label *ifplabel, struct label *newlabel) | 1728mls_system_check_acct(struct ucred *cred, struct vnode *vp, 1729 struct label *vplabel) |
1543{ | 1730{ |
1544 struct mac_mls *subj, *new; 1545 int error; | 1731 struct mac_mls *subj, *obj; |
1546 | 1732 |
1733 if (!mls_enabled) 1734 return (0); 1735 |
|
1547 subj = SLOT(cred->cr_label); | 1736 subj = SLOT(cred->cr_label); |
1548 new = SLOT(newlabel); | 1737 obj = SLOT(vplabel); |
1549 | 1738 |
1550 /* 1551 * If there is an MLS label update for the interface, it may be an 1552 * update of effective, range, or both. 1553 */ 1554 error = mls_atmostflags(new, MAC_MLS_FLAGS_BOTH); 1555 if (error) 1556 return (error); | 1739 if (!mls_dominate_effective(obj, subj) || 1740 !mls_dominate_effective(subj, obj)) 1741 return (EACCES); |
1557 | 1742 |
1558 /* 1559 * Relabeling network interfaces requires MLS privilege. 1560 */ 1561 error = mls_subject_privileged(subj); 1562 | |
1563 return (0); 1564} 1565 1566static int | 1743 return (0); 1744} 1745 1746static int |
1567mls_ifnet_check_transmit(struct ifnet *ifp, struct label *ifplabel, 1568 struct mbuf *m, struct label *mlabel) | 1747mls_system_check_auditctl(struct ucred *cred, struct vnode *vp, 1748 struct label *vplabel) |
1569{ | 1749{ |
1570 struct mac_mls *p, *i; | 1750 struct mac_mls *subj, *obj; |
1571 1572 if (!mls_enabled) 1573 return (0); 1574 | 1751 1752 if (!mls_enabled) 1753 return (0); 1754 |
1575 p = SLOT(mlabel); 1576 i = SLOT(ifplabel); | 1755 subj = SLOT(cred->cr_label); 1756 obj = SLOT(vplabel); |
1577 | 1757 |
1578 return (mls_effective_in_range(p, i) ? 0 : EACCES); | 1758 if (!mls_dominate_effective(obj, subj) || 1759 !mls_dominate_effective(subj, obj)) 1760 return (EACCES); 1761 1762 return (0); |
1579} 1580 1581static int | 1763} 1764 1765static int |
1582mls_inpcb_check_deliver(struct inpcb *inp, struct label *inplabel, 1583 struct mbuf *m, struct label *mlabel) | 1766mls_system_check_swapon(struct ucred *cred, struct vnode *vp, 1767 struct label *vplabel) |
1584{ | 1768{ |
1585 struct mac_mls *p, *i; | 1769 struct mac_mls *subj, *obj; |
1586 1587 if (!mls_enabled) 1588 return (0); 1589 | 1770 1771 if (!mls_enabled) 1772 return (0); 1773 |
1590 p = SLOT(mlabel); 1591 i = SLOT(inplabel); | 1774 subj = SLOT(cred->cr_label); 1775 obj = SLOT(vplabel); |
1592 | 1776 |
1593 return (mls_equal_effective(p, i) ? 0 : EACCES); | 1777 if (!mls_dominate_effective(obj, subj) || 1778 !mls_dominate_effective(subj, obj)) 1779 return (EACCES); 1780 1781 return (0); |
1594} 1595 | 1782} 1783 |
1784static void 1785mls_sysvmsg_cleanup(struct label *msglabel) 1786{ 1787 1788 bzero(SLOT(msglabel), sizeof(struct mac_mls)); 1789} 1790 1791static void 1792mls_sysvmsg_create(struct ucred *cred, struct msqid_kernel *msqkptr, 1793 struct label *msqlabel, struct msg *msgptr, struct label *msglabel) 1794{ 1795 struct mac_mls *source, *dest; 1796 1797 /* Ignore the msgq label. */ 1798 source = SLOT(cred->cr_label); 1799 dest = SLOT(msglabel); 1800 1801 mls_copy_effective(source, dest); 1802} 1803 |
|
1596static int 1597mls_sysvmsq_check_msgrcv(struct ucred *cred, struct msg *msgptr, 1598 struct label *msglabel) 1599{ 1600 struct mac_mls *subj, *obj; 1601 1602 if (!mls_enabled) 1603 return (0); --- 105 unchanged lines hidden (view full) --- 1709 1710 default: 1711 return (EACCES); 1712 } 1713 1714 return (0); 1715} 1716 | 1804static int 1805mls_sysvmsq_check_msgrcv(struct ucred *cred, struct msg *msgptr, 1806 struct label *msglabel) 1807{ 1808 struct mac_mls *subj, *obj; 1809 1810 if (!mls_enabled) 1811 return (0); --- 105 unchanged lines hidden (view full) --- 1917 1918 default: 1919 return (EACCES); 1920 } 1921 1922 return (0); 1923} 1924 |
1925static void 1926mls_sysvmsq_cleanup(struct label *msqlabel) 1927{ 1928 1929 bzero(SLOT(msqlabel), sizeof(struct mac_mls)); 1930} 1931 1932static void 1933mls_sysvmsq_create(struct ucred *cred, struct msqid_kernel *msqkptr, 1934 struct label *msqlabel) 1935{ 1936 struct mac_mls *source, *dest; 1937 1938 source = SLOT(cred->cr_label); 1939 dest = SLOT(msqlabel); 1940 1941 mls_copy_effective(source, dest); 1942} 1943 |
|
1717static int 1718mls_sysvsem_check_semctl(struct ucred *cred, struct semid_kernel *semakptr, 1719 struct label *semaklabel, int cmd) 1720{ 1721 struct mac_mls *subj, *obj; 1722 1723 if (!mls_enabled) 1724 return (0); --- 63 unchanged lines hidden (view full) --- 1788 1789 if( accesstype & SEM_A ) 1790 if (!mls_dominate_effective(obj, subj)) 1791 return (EACCES); 1792 1793 return (0); 1794} 1795 | 1944static int 1945mls_sysvsem_check_semctl(struct ucred *cred, struct semid_kernel *semakptr, 1946 struct label *semaklabel, int cmd) 1947{ 1948 struct mac_mls *subj, *obj; 1949 1950 if (!mls_enabled) 1951 return (0); --- 63 unchanged lines hidden (view full) --- 2015 2016 if( accesstype & SEM_A ) 2017 if (!mls_dominate_effective(obj, subj)) 2018 return (EACCES); 2019 2020 return (0); 2021} 2022 |
2023static void 2024mls_sysvsem_cleanup(struct label *semalabel) 2025{ 2026 2027 bzero(SLOT(semalabel), sizeof(struct mac_mls)); 2028} 2029 2030static void 2031mls_sysvsem_create(struct ucred *cred, struct semid_kernel *semakptr, 2032 struct label *semalabel) 2033{ 2034 struct mac_mls *source, *dest; 2035 2036 source = SLOT(cred->cr_label); 2037 dest = SLOT(semalabel); 2038 2039 mls_copy_effective(source, dest); 2040} 2041 |
|
1796static int 1797mls_sysvshm_check_shmat(struct ucred *cred, struct shmid_kernel *shmsegptr, 1798 struct label *shmseglabel, int shmflg) 1799{ 1800 struct mac_mls *subj, *obj; 1801 1802 if (!mls_enabled) 1803 return (0); --- 56 unchanged lines hidden (view full) --- 1860 obj = SLOT(shmseglabel); 1861 1862 if (!mls_dominate_effective(obj, subj)) 1863 return (EACCES); 1864 1865 return (0); 1866} 1867 | 2042static int 2043mls_sysvshm_check_shmat(struct ucred *cred, struct shmid_kernel *shmsegptr, 2044 struct label *shmseglabel, int shmflg) 2045{ 2046 struct mac_mls *subj, *obj; 2047 2048 if (!mls_enabled) 2049 return (0); --- 56 unchanged lines hidden (view full) --- 2106 obj = SLOT(shmseglabel); 2107 2108 if (!mls_dominate_effective(obj, subj)) 2109 return (EACCES); 2110 2111 return (0); 2112} 2113 |
1868static int 1869mls_mount_check_stat(struct ucred *cred, struct mount *mp, 1870 struct label *mntlabel) | 2114static void 2115mls_sysvshm_cleanup(struct label *shmlabel) |
1871{ | 2116{ |
1872 struct mac_mls *subj, *obj; | |
1873 | 2117 |
1874 if (!mls_enabled) 1875 return (0); 1876 1877 subj = SLOT(cred->cr_label); 1878 obj = SLOT(mntlabel); 1879 1880 if (!mls_dominate_effective(subj, obj)) 1881 return (EACCES); 1882 1883 return (0); | 2118 bzero(SLOT(shmlabel), sizeof(struct mac_mls)); |
1884} 1885 | 2119} 2120 |
1886static int 1887mls_pipe_check_ioctl(struct ucred *cred, struct pipepair *pp, 1888 struct label *pplabel, unsigned long cmd, void /* caddr_t */ *data) | 2121static void 2122mls_sysvshm_create(struct ucred *cred, struct shmid_kernel *shmsegptr, 2123 struct label *shmlabel) |
1889{ | 2124{ |
2125 struct mac_mls *source, *dest; |
|
1890 | 2126 |
1891 if (!mls_enabled) 1892 return (0); | 2127 source = SLOT(cred->cr_label); 2128 dest = SLOT(shmlabel); |
1893 | 2129 |
1894 /* XXX: This will be implemented soon... */ 1895 1896 return (0); | 2130 mls_copy_effective(source, dest); |
1897} 1898 1899static int | 2131} 2132 2133static int |
1900mls_pipe_check_poll(struct ucred *cred, struct pipepair *pp, 1901 struct label *pplabel) | 2134mls_vnode_associate_extattr(struct mount *mp, struct label *mplabel, 2135 struct vnode *vp, struct label *vplabel) |
1902{ | 2136{ |
1903 struct mac_mls *subj, *obj; | 2137 struct mac_mls mm_temp, *source, *dest; 2138 int buflen, error; |
1904 | 2139 |
1905 if (!mls_enabled) 1906 return (0); | 2140 source = SLOT(mplabel); 2141 dest = SLOT(vplabel); |
1907 | 2142 |
1908 subj = SLOT(cred->cr_label); 1909 obj = SLOT(pplabel); | 2143 buflen = sizeof(mm_temp); 2144 bzero(&mm_temp, buflen); |
1910 | 2145 |
1911 if (!mls_dominate_effective(subj, obj)) 1912 return (EACCES); 1913 1914 return (0); 1915} 1916 1917static int 1918mls_pipe_check_read(struct ucred *cred, struct pipepair *pp, 1919 struct label *pplabel) 1920{ 1921 struct mac_mls *subj, *obj; 1922 1923 if (!mls_enabled) | 2146 error = vn_extattr_get(vp, IO_NODELOCKED, MAC_MLS_EXTATTR_NAMESPACE, 2147 MAC_MLS_EXTATTR_NAME, &buflen, (char *) &mm_temp, curthread); 2148 if (error == ENOATTR || error == EOPNOTSUPP) { 2149 /* Fall back to the mntlabel. */ 2150 mls_copy_effective(source, dest); |
1924 return (0); | 2151 return (0); |
1925 1926 subj = SLOT(cred->cr_label); 1927 obj = SLOT(pplabel); 1928 1929 if (!mls_dominate_effective(subj, obj)) 1930 return (EACCES); 1931 1932 return (0); 1933} 1934 1935static int 1936mls_pipe_check_relabel(struct ucred *cred, struct pipepair *pp, 1937 struct label *pplabel, struct label *newlabel) 1938{ 1939 struct mac_mls *subj, *obj, *new; 1940 int error; 1941 1942 new = SLOT(newlabel); 1943 subj = SLOT(cred->cr_label); 1944 obj = SLOT(pplabel); 1945 1946 /* 1947 * If there is an MLS label update for a pipe, it must be a effective 1948 * update. 1949 */ 1950 error = mls_atmostflags(new, MAC_MLS_FLAG_EFFECTIVE); 1951 if (error) | 2152 } else if (error) |
1952 return (error); 1953 | 2153 return (error); 2154 |
1954 /* 1955 * To perform a relabel of a pipe (MLS label or not), MLS must 1956 * authorize the relabel. 1957 */ 1958 if (!mls_effective_in_range(obj, subj)) | 2155 if (buflen != sizeof(mm_temp)) { 2156 printf("mls_vnode_associate_extattr: bad size %d\n", buflen); |
1959 return (EPERM); | 2157 return (EPERM); |
1960 1961 /* 1962 * If the MLS label is to be changed, authorize as appropriate. 1963 */ 1964 if (new->mm_flags & MAC_MLS_FLAG_EFFECTIVE) { 1965 /* 1966 * To change the MLS label on a pipe, the new pipe label must 1967 * be in the subject range. 1968 */ 1969 if (!mls_effective_in_range(new, subj)) 1970 return (EPERM); 1971 1972 /* 1973 * To change the MLS label on a pipe to be EQUAL, the subject 1974 * must have appropriate privilege. 1975 */ 1976 if (mls_contains_equal(new)) { 1977 error = mls_subject_privileged(subj); 1978 if (error) 1979 return (error); 1980 } | |
1981 } | 2158 } |
1982 1983 return (0); 1984} 1985 1986static int 1987mls_pipe_check_stat(struct ucred *cred, struct pipepair *pp, 1988 struct label *pplabel) 1989{ 1990 struct mac_mls *subj, *obj; 1991 1992 if (!mls_enabled) 1993 return (0); 1994 1995 subj = SLOT(cred->cr_label); 1996 obj = SLOT(pplabel); 1997 1998 if (!mls_dominate_effective(subj, obj)) 1999 return (EACCES); 2000 2001 return (0); 2002} 2003 2004static int 2005mls_pipe_check_write(struct ucred *cred, struct pipepair *pp, 2006 struct label *pplabel) 2007{ 2008 struct mac_mls *subj, *obj; 2009 2010 if (!mls_enabled) 2011 return (0); 2012 2013 subj = SLOT(cred->cr_label); 2014 obj = SLOT(pplabel); 2015 2016 if (!mls_dominate_effective(obj, subj)) 2017 return (EACCES); 2018 2019 return (0); 2020} 2021 2022static int 2023mls_posixsem_check_write(struct ucred *cred, struct ksem *ks, 2024 struct label *kslabel) 2025{ 2026 struct mac_mls *subj, *obj; 2027 2028 if (!mls_enabled) 2029 return (0); 2030 2031 subj = SLOT(cred->cr_label); 2032 obj = SLOT(kslabel); 2033 2034 if (!mls_dominate_effective(obj, subj)) 2035 return (EACCES); 2036 2037 return (0); 2038} 2039 2040static int 2041mls_posixsem_check_rdonly(struct ucred *cred, struct ksem *ks, 2042 struct label *kslabel) 2043{ 2044 struct mac_mls *subj, *obj; 2045 2046 if (!mls_enabled) 2047 return (0); 2048 2049 subj = SLOT(cred->cr_label); 2050 obj = SLOT(kslabel); 2051 2052 if (!mls_dominate_effective(subj, obj)) 2053 return (EACCES); 2054 2055 return (0); 2056} 2057 2058static int 2059mls_proc_check_debug(struct ucred *cred, struct proc *p) 2060{ 2061 struct mac_mls *subj, *obj; 2062 2063 if (!mls_enabled) 2064 return (0); 2065 2066 subj = SLOT(cred->cr_label); 2067 obj = SLOT(p->p_ucred->cr_label); 2068 2069 /* XXX: range checks */ 2070 if (!mls_dominate_effective(subj, obj)) 2071 return (ESRCH); 2072 if (!mls_dominate_effective(obj, subj)) 2073 return (EACCES); 2074 2075 return (0); 2076} 2077 2078static int 2079mls_proc_check_sched(struct ucred *cred, struct proc *p) 2080{ 2081 struct mac_mls *subj, *obj; 2082 2083 if (!mls_enabled) 2084 return (0); 2085 2086 subj = SLOT(cred->cr_label); 2087 obj = SLOT(p->p_ucred->cr_label); 2088 2089 /* XXX: range checks */ 2090 if (!mls_dominate_effective(subj, obj)) 2091 return (ESRCH); 2092 if (!mls_dominate_effective(obj, subj)) 2093 return (EACCES); 2094 2095 return (0); 2096} 2097 2098static int 2099mls_proc_check_signal(struct ucred *cred, struct proc *p, int signum) 2100{ 2101 struct mac_mls *subj, *obj; 2102 2103 if (!mls_enabled) 2104 return (0); 2105 2106 subj = SLOT(cred->cr_label); 2107 obj = SLOT(p->p_ucred->cr_label); 2108 2109 /* XXX: range checks */ 2110 if (!mls_dominate_effective(subj, obj)) 2111 return (ESRCH); 2112 if (!mls_dominate_effective(obj, subj)) 2113 return (EACCES); 2114 2115 return (0); 2116} 2117 2118static int 2119mls_socket_check_deliver(struct socket *so, struct label *solabel, 2120 struct mbuf *m, struct label *mlabel) 2121{ 2122 struct mac_mls *p, *s; 2123 2124 if (!mls_enabled) 2125 return (0); 2126 2127 p = SLOT(mlabel); 2128 s = SLOT(solabel); 2129 2130 return (mls_equal_effective(p, s) ? 0 : EACCES); 2131} 2132 2133static int 2134mls_socket_check_relabel(struct ucred *cred, struct socket *so, 2135 struct label *solabel, struct label *newlabel) 2136{ 2137 struct mac_mls *subj, *obj, *new; 2138 int error; 2139 2140 new = SLOT(newlabel); 2141 subj = SLOT(cred->cr_label); 2142 obj = SLOT(solabel); 2143 2144 /* 2145 * If there is an MLS label update for the socket, it may be an 2146 * update of effective. 2147 */ 2148 error = mls_atmostflags(new, MAC_MLS_FLAG_EFFECTIVE); 2149 if (error) 2150 return (error); 2151 2152 /* 2153 * To relabel a socket, the old socket effective must be in the 2154 * subject range. 2155 */ 2156 if (!mls_effective_in_range(obj, subj)) | 2159 if (mls_valid(&mm_temp) != 0) { 2160 printf("mls_vnode_associate_extattr: invalid\n"); |
2157 return (EPERM); | 2161 return (EPERM); |
2158 2159 /* 2160 * If the MLS label is to be changed, authorize as appropriate. 2161 */ 2162 if (new->mm_flags & MAC_MLS_FLAG_EFFECTIVE) { 2163 /* 2164 * To relabel a socket, the new socket effective must be in 2165 * the subject range. 2166 */ 2167 if (!mls_effective_in_range(new, subj)) 2168 return (EPERM); 2169 2170 /* 2171 * To change the MLS label on the socket to contain EQUAL, 2172 * the subject must have appropriate privilege. 2173 */ 2174 if (mls_contains_equal(new)) { 2175 error = mls_subject_privileged(subj); 2176 if (error) 2177 return (error); 2178 } | |
2179 } | 2162 } |
2163 if ((mm_temp.mm_flags & MAC_MLS_FLAGS_BOTH) != 2164 MAC_MLS_FLAG_EFFECTIVE) { 2165 printf("mls_associated_vnode_extattr: not effective\n"); 2166 return (EPERM); 2167 } |
|
2180 | 2168 |
2169 mls_copy_effective(&mm_temp, dest); |
|
2181 return (0); 2182} 2183 | 2170 return (0); 2171} 2172 |
2184static int 2185mls_socket_check_visible(struct ucred *cred, struct socket *so, 2186 struct label *solabel) | 2173static void 2174mls_vnode_associate_singlelabel(struct mount *mp, struct label *mplabel, 2175 struct vnode *vp, struct label *vplabel) |
2187{ | 2176{ |
2188 struct mac_mls *subj, *obj; | 2177 struct mac_mls *source, *dest; |
2189 | 2178 |
2190 if (!mls_enabled) 2191 return (0); | 2179 source = SLOT(mplabel); 2180 dest = SLOT(vplabel); |
2192 | 2181 |
2193 subj = SLOT(cred->cr_label); 2194 obj = SLOT(solabel); 2195 2196 if (!mls_dominate_effective(subj, obj)) 2197 return (ENOENT); 2198 2199 return (0); | 2182 mls_copy_effective(source, dest); |
2200} 2201 2202static int | 2183} 2184 2185static int |
2203mls_system_check_acct(struct ucred *cred, struct vnode *vp, 2204 struct label *vplabel) 2205{ 2206 struct mac_mls *subj, *obj; 2207 2208 if (!mls_enabled) 2209 return (0); 2210 2211 subj = SLOT(cred->cr_label); 2212 obj = SLOT(vplabel); 2213 2214 if (!mls_dominate_effective(obj, subj) || 2215 !mls_dominate_effective(subj, obj)) 2216 return (EACCES); 2217 2218 return (0); 2219} 2220 2221static int 2222mls_system_check_auditctl(struct ucred *cred, struct vnode *vp, 2223 struct label *vplabel) 2224{ 2225 struct mac_mls *subj, *obj; 2226 2227 if (!mls_enabled) 2228 return (0); 2229 2230 subj = SLOT(cred->cr_label); 2231 obj = SLOT(vplabel); 2232 2233 if (!mls_dominate_effective(obj, subj) || 2234 !mls_dominate_effective(subj, obj)) 2235 return (EACCES); 2236 2237 return (0); 2238} 2239 2240static int 2241mls_system_check_swapon(struct ucred *cred, struct vnode *vp, 2242 struct label *vplabel) 2243{ 2244 struct mac_mls *subj, *obj; 2245 2246 if (!mls_enabled) 2247 return (0); 2248 2249 subj = SLOT(cred->cr_label); 2250 obj = SLOT(vplabel); 2251 2252 if (!mls_dominate_effective(obj, subj) || 2253 !mls_dominate_effective(subj, obj)) 2254 return (EACCES); 2255 2256 return (0); 2257} 2258 2259static int | |
2260mls_vnode_check_chdir(struct ucred *cred, struct vnode *dvp, 2261 struct label *dvplabel) 2262{ 2263 struct mac_mls *subj, *obj; 2264 2265 if (!mls_enabled) 2266 return (0); 2267 --- 617 unchanged lines hidden (view full) --- 2885 obj = SLOT(vplabel); 2886 2887 if (!mls_dominate_effective(obj, subj)) 2888 return (EACCES); 2889 2890 return (0); 2891} 2892 | 2186mls_vnode_check_chdir(struct ucred *cred, struct vnode *dvp, 2187 struct label *dvplabel) 2188{ 2189 struct mac_mls *subj, *obj; 2190 2191 if (!mls_enabled) 2192 return (0); 2193 --- 617 unchanged lines hidden (view full) --- 2811 obj = SLOT(vplabel); 2812 2813 if (!mls_dominate_effective(obj, subj)) 2814 return (EACCES); 2815 2816 return (0); 2817} 2818 |
2819static int 2820mls_vnode_create_extattr(struct ucred *cred, struct mount *mp, 2821 struct label *mplabel, struct vnode *dvp, struct label *dvplabel, 2822 struct vnode *vp, struct label *vplabel, struct componentname *cnp) 2823{ 2824 struct mac_mls *source, *dest, mm_temp; 2825 size_t buflen; 2826 int error; 2827 2828 buflen = sizeof(mm_temp); 2829 bzero(&mm_temp, buflen); 2830 2831 source = SLOT(cred->cr_label); 2832 dest = SLOT(vplabel); 2833 mls_copy_effective(source, &mm_temp); 2834 2835 error = vn_extattr_set(vp, IO_NODELOCKED, MAC_MLS_EXTATTR_NAMESPACE, 2836 MAC_MLS_EXTATTR_NAME, buflen, (char *) &mm_temp, curthread); 2837 if (error == 0) 2838 mls_copy_effective(source, dest); 2839 return (error); 2840} 2841 2842static void 2843mls_vnode_relabel(struct ucred *cred, struct vnode *vp, 2844 struct label *vplabel, struct label *label) 2845{ 2846 struct mac_mls *source, *dest; 2847 2848 source = SLOT(label); 2849 dest = SLOT(vplabel); 2850 2851 mls_copy(source, dest); 2852} 2853 2854static int 2855mls_vnode_setlabel_extattr(struct ucred *cred, struct vnode *vp, 2856 struct label *vplabel, struct label *intlabel) 2857{ 2858 struct mac_mls *source, mm_temp; 2859 size_t buflen; 2860 int error; 2861 2862 buflen = sizeof(mm_temp); 2863 bzero(&mm_temp, buflen); 2864 2865 source = SLOT(intlabel); 2866 if ((source->mm_flags & MAC_MLS_FLAG_EFFECTIVE) == 0) 2867 return (0); 2868 2869 mls_copy_effective(source, &mm_temp); 2870 2871 error = vn_extattr_set(vp, IO_NODELOCKED, MAC_MLS_EXTATTR_NAMESPACE, 2872 MAC_MLS_EXTATTR_NAME, buflen, (char *) &mm_temp, curthread); 2873 return (error); 2874} 2875 |
|
2893static struct mac_policy_ops mls_ops = 2894{ 2895 .mpo_init = mls_init, | 2876static struct mac_policy_ops mls_ops = 2877{ 2878 .mpo_init = mls_init, |
2896 .mpo_bpfdesc_init_label = mls_init_label, 2897 .mpo_cred_init_label = mls_init_label, 2898 .mpo_devfs_init_label = mls_init_label, 2899 .mpo_ifnet_init_label = mls_init_label, 2900 .mpo_inpcb_init_label = mls_init_label_waitcheck, 2901 .mpo_syncache_init_label = mls_init_label_waitcheck, 2902 .mpo_sysvmsg_init_label = mls_init_label, 2903 .mpo_sysvmsq_init_label = mls_init_label, 2904 .mpo_sysvsem_init_label = mls_init_label, 2905 .mpo_sysvshm_init_label = mls_init_label, 2906 .mpo_ipq_init_label = mls_init_label_waitcheck, 2907 .mpo_mbuf_init_label = mls_init_label_waitcheck, 2908 .mpo_mount_init_label = mls_init_label, 2909 .mpo_pipe_init_label = mls_init_label, 2910 .mpo_posixsem_init_label = mls_init_label, 2911 .mpo_socket_init_label = mls_init_label_waitcheck, 2912 .mpo_socketpeer_init_label = mls_init_label_waitcheck, 2913 .mpo_vnode_init_label = mls_init_label, | 2879 2880 .mpo_bpfdesc_check_receive = mls_bpfdesc_check_receive, 2881 .mpo_bpfdesc_create = mls_bpfdesc_create, 2882 .mpo_bpfdesc_create_mbuf = mls_bpfdesc_create_mbuf, |
2914 .mpo_bpfdesc_destroy_label = mls_destroy_label, | 2883 .mpo_bpfdesc_destroy_label = mls_destroy_label, |
2915 .mpo_cred_destroy_label = mls_destroy_label, 2916 .mpo_devfs_destroy_label = mls_destroy_label, 2917 .mpo_ifnet_destroy_label = mls_destroy_label, 2918 .mpo_inpcb_destroy_label = mls_destroy_label, 2919 .mpo_syncache_destroy_label = mls_destroy_label, 2920 .mpo_sysvmsg_destroy_label = mls_destroy_label, 2921 .mpo_sysvmsq_destroy_label = mls_destroy_label, 2922 .mpo_sysvsem_destroy_label = mls_destroy_label, 2923 .mpo_sysvshm_destroy_label = mls_destroy_label, 2924 .mpo_ipq_destroy_label = mls_destroy_label, 2925 .mpo_mbuf_destroy_label = mls_destroy_label, 2926 .mpo_mount_destroy_label = mls_destroy_label, 2927 .mpo_pipe_destroy_label = mls_destroy_label, 2928 .mpo_posixsem_destroy_label = mls_destroy_label, 2929 .mpo_socket_destroy_label = mls_destroy_label, 2930 .mpo_socketpeer_destroy_label = mls_destroy_label, 2931 .mpo_vnode_destroy_label = mls_destroy_label, | 2884 .mpo_bpfdesc_init_label = mls_init_label, 2885 2886 .mpo_cred_check_relabel = mls_cred_check_relabel, 2887 .mpo_cred_check_visible = mls_cred_check_visible, |
2932 .mpo_cred_copy_label = mls_copy_label, | 2888 .mpo_cred_copy_label = mls_copy_label, |
2933 .mpo_ifnet_copy_label = mls_copy_label, 2934 .mpo_mbuf_copy_label = mls_copy_label, 2935 .mpo_pipe_copy_label = mls_copy_label, 2936 .mpo_socket_copy_label = mls_copy_label, 2937 .mpo_vnode_copy_label = mls_copy_label, | 2889 .mpo_cred_destroy_label = mls_destroy_label, |
2938 .mpo_cred_externalize_label = mls_externalize_label, | 2890 .mpo_cred_externalize_label = mls_externalize_label, |
2939 .mpo_ifnet_externalize_label = mls_externalize_label, 2940 .mpo_pipe_externalize_label = mls_externalize_label, 2941 .mpo_socket_externalize_label = mls_externalize_label, 2942 .mpo_socketpeer_externalize_label = mls_externalize_label, 2943 .mpo_vnode_externalize_label = mls_externalize_label, | 2891 .mpo_cred_init_label = mls_init_label, |
2944 .mpo_cred_internalize_label = mls_internalize_label, | 2892 .mpo_cred_internalize_label = mls_internalize_label, |
2945 .mpo_ifnet_internalize_label = mls_internalize_label, 2946 .mpo_pipe_internalize_label = mls_internalize_label, 2947 .mpo_socket_internalize_label = mls_internalize_label, 2948 .mpo_vnode_internalize_label = mls_internalize_label, | 2893 .mpo_cred_relabel = mls_cred_relabel, 2894 |
2949 .mpo_devfs_create_device = mls_devfs_create_device, 2950 .mpo_devfs_create_directory = mls_devfs_create_directory, 2951 .mpo_devfs_create_symlink = mls_devfs_create_symlink, | 2895 .mpo_devfs_create_device = mls_devfs_create_device, 2896 .mpo_devfs_create_directory = mls_devfs_create_directory, 2897 .mpo_devfs_create_symlink = mls_devfs_create_symlink, |
2952 .mpo_mount_create = mls_mount_create, 2953 .mpo_vnode_relabel = mls_vnode_relabel, | 2898 .mpo_devfs_destroy_label = mls_destroy_label, 2899 .mpo_devfs_init_label = mls_init_label, |
2954 .mpo_devfs_update = mls_devfs_update, 2955 .mpo_devfs_vnode_associate = mls_devfs_vnode_associate, | 2900 .mpo_devfs_update = mls_devfs_update, 2901 .mpo_devfs_vnode_associate = mls_devfs_vnode_associate, |
2956 .mpo_vnode_associate_extattr = mls_vnode_associate_extattr, 2957 .mpo_vnode_associate_singlelabel = mls_vnode_associate_singlelabel, 2958 .mpo_vnode_create_extattr = mls_vnode_create_extattr, 2959 .mpo_vnode_setlabel_extattr = mls_vnode_setlabel_extattr, 2960 .mpo_socket_create_mbuf = mls_socket_create_mbuf, 2961 .mpo_syncache_create_mbuf = mls_syncache_create_mbuf, 2962 .mpo_pipe_create = mls_pipe_create, 2963 .mpo_posixsem_create = mls_posixsem_create, 2964 .mpo_socket_create = mls_socket_create, 2965 .mpo_socket_newconn = mls_socket_newconn, 2966 .mpo_pipe_relabel = mls_pipe_relabel, 2967 .mpo_socket_relabel = mls_socket_relabel, 2968 .mpo_socketpeer_set_from_mbuf = mls_socketpeer_set_from_mbuf, 2969 .mpo_socketpeer_set_from_socket = mls_socketpeer_set_from_socket, 2970 .mpo_bpfdesc_create = mls_bpfdesc_create, 2971 .mpo_ipq_reassemble = mls_ipq_reassemble, 2972 .mpo_netinet_fragment = mls_netinet_fragment, | 2902 2903 .mpo_ifnet_check_relabel = mls_ifnet_check_relabel, 2904 .mpo_ifnet_check_transmit = mls_ifnet_check_transmit, 2905 .mpo_ifnet_copy_label = mls_copy_label, |
2973 .mpo_ifnet_create = mls_ifnet_create, | 2906 .mpo_ifnet_create = mls_ifnet_create, |
2907 .mpo_ifnet_create_mbuf = mls_ifnet_create_mbuf, 2908 .mpo_ifnet_destroy_label = mls_destroy_label, 2909 .mpo_ifnet_externalize_label = mls_externalize_label, 2910 .mpo_ifnet_init_label = mls_init_label, 2911 .mpo_ifnet_internalize_label = mls_internalize_label, 2912 .mpo_ifnet_relabel = mls_ifnet_relabel, 2913 2914 .mpo_inpcb_check_deliver = mls_inpcb_check_deliver, |
|
2974 .mpo_inpcb_create = mls_inpcb_create, | 2915 .mpo_inpcb_create = mls_inpcb_create, |
2975 .mpo_syncache_create = mls_syncache_create, 2976 .mpo_ipq_create = mls_ipq_create, 2977 .mpo_sysvmsg_create = mls_sysvmsg_create, 2978 .mpo_sysvmsq_create = mls_sysvmsq_create, 2979 .mpo_sysvsem_create = mls_sysvsem_create, 2980 .mpo_sysvshm_create = mls_sysvshm_create, | |
2981 .mpo_inpcb_create_mbuf = mls_inpcb_create_mbuf, | 2916 .mpo_inpcb_create_mbuf = mls_inpcb_create_mbuf, |
2982 .mpo_bpfdesc_create_mbuf = mls_bpfdesc_create_mbuf, 2983 .mpo_ifnet_create_mbuf = mls_ifnet_create_mbuf, | 2917 .mpo_inpcb_destroy_label = mls_destroy_label, 2918 .mpo_inpcb_init_label = mls_init_label_waitcheck, 2919 .mpo_inpcb_sosetlabel = mls_inpcb_sosetlabel, 2920 2921 .mpo_ipq_create = mls_ipq_create, 2922 .mpo_ipq_destroy_label = mls_destroy_label, 2923 .mpo_ipq_init_label = mls_init_label_waitcheck, |
2984 .mpo_ipq_match = mls_ipq_match, | 2924 .mpo_ipq_match = mls_ipq_match, |
2985 .mpo_ifnet_relabel = mls_ifnet_relabel, | 2925 .mpo_ipq_reassemble = mls_ipq_reassemble, |
2986 .mpo_ipq_update = mls_ipq_update, | 2926 .mpo_ipq_update = mls_ipq_update, |
2987 .mpo_inpcb_sosetlabel = mls_inpcb_sosetlabel, 2988 .mpo_proc_create_swapper = mls_proc_create_swapper, 2989 .mpo_proc_create_init = mls_proc_create_init, 2990 .mpo_proc_associate_nfsd = mls_proc_associate_nfsd, 2991 .mpo_cred_relabel = mls_cred_relabel, 2992 .mpo_sysvmsg_cleanup = mls_sysvmsg_cleanup, 2993 .mpo_sysvmsq_cleanup = mls_sysvmsq_cleanup, 2994 .mpo_sysvsem_cleanup = mls_sysvsem_cleanup, 2995 .mpo_sysvshm_cleanup = mls_sysvshm_cleanup, 2996 .mpo_bpfdesc_check_receive = mls_bpfdesc_check_receive, 2997 .mpo_cred_check_relabel = mls_cred_check_relabel, 2998 .mpo_cred_check_visible = mls_cred_check_visible, 2999 .mpo_ifnet_check_relabel = mls_ifnet_check_relabel, 3000 .mpo_ifnet_check_transmit = mls_ifnet_check_transmit, 3001 .mpo_inpcb_check_deliver = mls_inpcb_check_deliver, 3002 .mpo_sysvmsq_check_msgrcv = mls_sysvmsq_check_msgrcv, 3003 .mpo_sysvmsq_check_msgrmid = mls_sysvmsq_check_msgrmid, 3004 .mpo_sysvmsq_check_msqget = mls_sysvmsq_check_msqget, 3005 .mpo_sysvmsq_check_msqsnd = mls_sysvmsq_check_msqsnd, 3006 .mpo_sysvmsq_check_msqrcv = mls_sysvmsq_check_msqrcv, 3007 .mpo_sysvmsq_check_msqctl = mls_sysvmsq_check_msqctl, 3008 .mpo_sysvsem_check_semctl = mls_sysvsem_check_semctl, 3009 .mpo_sysvsem_check_semget = mls_sysvsem_check_semget, 3010 .mpo_sysvsem_check_semop = mls_sysvsem_check_semop, 3011 .mpo_sysvshm_check_shmat = mls_sysvshm_check_shmat, 3012 .mpo_sysvshm_check_shmctl = mls_sysvshm_check_shmctl, 3013 .mpo_sysvshm_check_shmget = mls_sysvshm_check_shmget, | 2927 2928 .mpo_mbuf_copy_label = mls_copy_label, 2929 .mpo_mbuf_destroy_label = mls_destroy_label, 2930 .mpo_mbuf_init_label = mls_init_label_waitcheck, 2931 |
3014 .mpo_mount_check_stat = mls_mount_check_stat, | 2932 .mpo_mount_check_stat = mls_mount_check_stat, |
2933 .mpo_mount_create = mls_mount_create, 2934 .mpo_mount_destroy_label = mls_destroy_label, 2935 .mpo_mount_init_label = mls_init_label, 2936 2937 .mpo_netatalk_aarp_send = mls_netatalk_aarp_send, 2938 2939 .mpo_netinet_arp_send = mls_netinet_arp_send, 2940 .mpo_netinet_firewall_reply = mls_netinet_firewall_reply, 2941 .mpo_netinet_firewall_send = mls_netinet_firewall_send, 2942 .mpo_netinet_fragment = mls_netinet_fragment, 2943 .mpo_netinet_icmp_reply = mls_netinet_icmp_reply, 2944 .mpo_netinet_igmp_send = mls_netinet_igmp_send, 2945 2946 .mpo_netinet6_nd6_send = mls_netinet6_nd6_send, 2947 |
|
3015 .mpo_pipe_check_ioctl = mls_pipe_check_ioctl, 3016 .mpo_pipe_check_poll = mls_pipe_check_poll, 3017 .mpo_pipe_check_read = mls_pipe_check_read, 3018 .mpo_pipe_check_relabel = mls_pipe_check_relabel, 3019 .mpo_pipe_check_stat = mls_pipe_check_stat, 3020 .mpo_pipe_check_write = mls_pipe_check_write, | 2948 .mpo_pipe_check_ioctl = mls_pipe_check_ioctl, 2949 .mpo_pipe_check_poll = mls_pipe_check_poll, 2950 .mpo_pipe_check_read = mls_pipe_check_read, 2951 .mpo_pipe_check_relabel = mls_pipe_check_relabel, 2952 .mpo_pipe_check_stat = mls_pipe_check_stat, 2953 .mpo_pipe_check_write = mls_pipe_check_write, |
2954 .mpo_pipe_copy_label = mls_copy_label, 2955 .mpo_pipe_create = mls_pipe_create, 2956 .mpo_pipe_destroy_label = mls_destroy_label, 2957 .mpo_pipe_externalize_label = mls_externalize_label, 2958 .mpo_pipe_init_label = mls_init_label, 2959 .mpo_pipe_internalize_label = mls_internalize_label, 2960 .mpo_pipe_relabel = mls_pipe_relabel, 2961 |
|
3021 .mpo_posixsem_check_destroy = mls_posixsem_check_write, 3022 .mpo_posixsem_check_getvalue = mls_posixsem_check_rdonly, 3023 .mpo_posixsem_check_open = mls_posixsem_check_write, 3024 .mpo_posixsem_check_post = mls_posixsem_check_write, 3025 .mpo_posixsem_check_unlink = mls_posixsem_check_write, 3026 .mpo_posixsem_check_wait = mls_posixsem_check_write, | 2962 .mpo_posixsem_check_destroy = mls_posixsem_check_write, 2963 .mpo_posixsem_check_getvalue = mls_posixsem_check_rdonly, 2964 .mpo_posixsem_check_open = mls_posixsem_check_write, 2965 .mpo_posixsem_check_post = mls_posixsem_check_write, 2966 .mpo_posixsem_check_unlink = mls_posixsem_check_write, 2967 .mpo_posixsem_check_wait = mls_posixsem_check_write, |
2968 .mpo_posixsem_create = mls_posixsem_create, 2969 .mpo_posixsem_destroy_label = mls_destroy_label, 2970 .mpo_posixsem_init_label = mls_init_label, 2971 2972 .mpo_proc_associate_nfsd = mls_proc_associate_nfsd, |
|
3027 .mpo_proc_check_debug = mls_proc_check_debug, 3028 .mpo_proc_check_sched = mls_proc_check_sched, 3029 .mpo_proc_check_signal = mls_proc_check_signal, | 2973 .mpo_proc_check_debug = mls_proc_check_debug, 2974 .mpo_proc_check_sched = mls_proc_check_sched, 2975 .mpo_proc_check_signal = mls_proc_check_signal, |
2976 .mpo_proc_create_init = mls_proc_create_init, 2977 .mpo_proc_create_swapper = mls_proc_create_swapper, 2978 |
|
3030 .mpo_socket_check_deliver = mls_socket_check_deliver, 3031 .mpo_socket_check_relabel = mls_socket_check_relabel, 3032 .mpo_socket_check_visible = mls_socket_check_visible, | 2979 .mpo_socket_check_deliver = mls_socket_check_deliver, 2980 .mpo_socket_check_relabel = mls_socket_check_relabel, 2981 .mpo_socket_check_visible = mls_socket_check_visible, |
2982 .mpo_socket_copy_label = mls_copy_label, 2983 .mpo_socket_create = mls_socket_create, 2984 .mpo_socket_create_mbuf = mls_socket_create_mbuf, 2985 .mpo_socket_destroy_label = mls_destroy_label, 2986 .mpo_socket_externalize_label = mls_externalize_label, 2987 .mpo_socket_init_label = mls_init_label_waitcheck, 2988 .mpo_socket_internalize_label = mls_internalize_label, 2989 .mpo_socket_newconn = mls_socket_newconn, 2990 .mpo_socket_relabel = mls_socket_relabel, 2991 2992 .mpo_socketpeer_destroy_label = mls_destroy_label, 2993 .mpo_socketpeer_externalize_label = mls_externalize_label, 2994 .mpo_socketpeer_init_label = mls_init_label_waitcheck, 2995 .mpo_socketpeer_set_from_mbuf = mls_socketpeer_set_from_mbuf, 2996 .mpo_socketpeer_set_from_socket = mls_socketpeer_set_from_socket, 2997 2998 .mpo_syncache_create = mls_syncache_create, 2999 .mpo_syncache_create_mbuf = mls_syncache_create_mbuf, 3000 .mpo_syncache_destroy_label = mls_destroy_label, 3001 .mpo_syncache_init_label = mls_init_label_waitcheck, 3002 3003 .mpo_sysvmsg_cleanup = mls_sysvmsg_cleanup, 3004 .mpo_sysvmsg_create = mls_sysvmsg_create, 3005 .mpo_sysvmsg_destroy_label = mls_destroy_label, 3006 .mpo_sysvmsg_init_label = mls_init_label, 3007 3008 .mpo_sysvmsq_check_msgrcv = mls_sysvmsq_check_msgrcv, 3009 .mpo_sysvmsq_check_msgrmid = mls_sysvmsq_check_msgrmid, 3010 .mpo_sysvmsq_check_msqget = mls_sysvmsq_check_msqget, 3011 .mpo_sysvmsq_check_msqsnd = mls_sysvmsq_check_msqsnd, 3012 .mpo_sysvmsq_check_msqrcv = mls_sysvmsq_check_msqrcv, 3013 .mpo_sysvmsq_check_msqctl = mls_sysvmsq_check_msqctl, 3014 .mpo_sysvmsq_cleanup = mls_sysvmsq_cleanup, 3015 .mpo_sysvmsq_destroy_label = mls_destroy_label, 3016 .mpo_sysvmsq_init_label = mls_init_label, 3017 .mpo_sysvmsq_create = mls_sysvmsq_create, 3018 3019 .mpo_sysvsem_check_semctl = mls_sysvsem_check_semctl, 3020 .mpo_sysvsem_check_semget = mls_sysvsem_check_semget, 3021 .mpo_sysvsem_check_semop = mls_sysvsem_check_semop, 3022 .mpo_sysvsem_cleanup = mls_sysvsem_cleanup, 3023 .mpo_sysvsem_create = mls_sysvsem_create, 3024 .mpo_sysvsem_destroy_label = mls_destroy_label, 3025 .mpo_sysvsem_init_label = mls_init_label, 3026 3027 .mpo_sysvshm_check_shmat = mls_sysvshm_check_shmat, 3028 .mpo_sysvshm_check_shmctl = mls_sysvshm_check_shmctl, 3029 .mpo_sysvshm_check_shmget = mls_sysvshm_check_shmget, 3030 .mpo_sysvshm_cleanup = mls_sysvshm_cleanup, 3031 .mpo_sysvshm_create = mls_sysvshm_create, 3032 .mpo_sysvshm_destroy_label = mls_destroy_label, 3033 .mpo_sysvshm_init_label = mls_init_label, 3034 3035 |
|
3033 .mpo_system_check_acct = mls_system_check_acct, 3034 .mpo_system_check_auditctl = mls_system_check_auditctl, 3035 .mpo_system_check_swapon = mls_system_check_swapon, | 3036 .mpo_system_check_acct = mls_system_check_acct, 3037 .mpo_system_check_auditctl = mls_system_check_auditctl, 3038 .mpo_system_check_swapon = mls_system_check_swapon, |
3039 3040 .mpo_vnode_associate_extattr = mls_vnode_associate_extattr, 3041 .mpo_vnode_associate_singlelabel = mls_vnode_associate_singlelabel, |
|
3036 .mpo_vnode_check_access = mls_vnode_check_open, 3037 .mpo_vnode_check_chdir = mls_vnode_check_chdir, 3038 .mpo_vnode_check_chroot = mls_vnode_check_chroot, 3039 .mpo_vnode_check_create = mls_vnode_check_create, 3040 .mpo_vnode_check_deleteacl = mls_vnode_check_deleteacl, 3041 .mpo_vnode_check_deleteextattr = mls_vnode_check_deleteextattr, 3042 .mpo_vnode_check_exec = mls_vnode_check_exec, 3043 .mpo_vnode_check_getacl = mls_vnode_check_getacl, --- 15 unchanged lines hidden (view full) --- 3059 .mpo_vnode_check_setextattr = mls_vnode_check_setextattr, 3060 .mpo_vnode_check_setflags = mls_vnode_check_setflags, 3061 .mpo_vnode_check_setmode = mls_vnode_check_setmode, 3062 .mpo_vnode_check_setowner = mls_vnode_check_setowner, 3063 .mpo_vnode_check_setutimes = mls_vnode_check_setutimes, 3064 .mpo_vnode_check_stat = mls_vnode_check_stat, 3065 .mpo_vnode_check_unlink = mls_vnode_check_unlink, 3066 .mpo_vnode_check_write = mls_vnode_check_write, | 3042 .mpo_vnode_check_access = mls_vnode_check_open, 3043 .mpo_vnode_check_chdir = mls_vnode_check_chdir, 3044 .mpo_vnode_check_chroot = mls_vnode_check_chroot, 3045 .mpo_vnode_check_create = mls_vnode_check_create, 3046 .mpo_vnode_check_deleteacl = mls_vnode_check_deleteacl, 3047 .mpo_vnode_check_deleteextattr = mls_vnode_check_deleteextattr, 3048 .mpo_vnode_check_exec = mls_vnode_check_exec, 3049 .mpo_vnode_check_getacl = mls_vnode_check_getacl, --- 15 unchanged lines hidden (view full) --- 3065 .mpo_vnode_check_setextattr = mls_vnode_check_setextattr, 3066 .mpo_vnode_check_setflags = mls_vnode_check_setflags, 3067 .mpo_vnode_check_setmode = mls_vnode_check_setmode, 3068 .mpo_vnode_check_setowner = mls_vnode_check_setowner, 3069 .mpo_vnode_check_setutimes = mls_vnode_check_setutimes, 3070 .mpo_vnode_check_stat = mls_vnode_check_stat, 3071 .mpo_vnode_check_unlink = mls_vnode_check_unlink, 3072 .mpo_vnode_check_write = mls_vnode_check_write, |
3067 .mpo_netatalk_aarp_send = mls_netatalk_aarp_send, 3068 .mpo_netinet_arp_send = mls_netinet_arp_send, 3069 .mpo_netinet_firewall_reply = mls_netinet_firewall_reply, 3070 .mpo_netinet_firewall_send = mls_netinet_firewall_send, 3071 .mpo_netinet_icmp_reply = mls_netinet_icmp_reply, 3072 .mpo_netinet_igmp_send = mls_netinet_igmp_send, 3073 .mpo_netinet6_nd6_send = mls_netinet6_nd6_send, | 3073 .mpo_vnode_copy_label = mls_copy_label, 3074 .mpo_vnode_create_extattr = mls_vnode_create_extattr, 3075 .mpo_vnode_destroy_label = mls_destroy_label, 3076 .mpo_vnode_externalize_label = mls_externalize_label, 3077 .mpo_vnode_init_label = mls_init_label, 3078 .mpo_vnode_internalize_label = mls_internalize_label, 3079 .mpo_vnode_relabel = mls_vnode_relabel, 3080 .mpo_vnode_setlabel_extattr = mls_vnode_setlabel_extattr, |
3074}; 3075 3076MAC_POLICY_SET(&mls_ops, mac_mls, "TrustedBSD MAC/MLS", 3077 MPC_LOADTIME_FLAG_NOTLATE | MPC_LOADTIME_FLAG_LABELMBUFS, &mls_slot); | 3081}; 3082 3083MAC_POLICY_SET(&mls_ops, mac_mls, "TrustedBSD MAC/MLS", 3084 MPC_LOADTIME_FLAG_NOTLATE | MPC_LOADTIME_FLAG_LABELMBUFS, &mls_slot); |