Cross Reference: /freebsd-11.0-release/sys/security/mac/mac_framework.h

Deleted Added

sdiff udiff text old ( 122527 ) new ( 122807 )

full compact

mac_framework.h (122527)	mac_framework.h (122807)
1/- 2 Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson 3 * Copyright (c) 2001, 2002, 2003 Networks Associates Technology, Inc. 4 * All rights reserved. 5 * 6 * This software was developed by Robert Watson for the TrustedBSD Project. 7 * 8 * This software was developed for the FreeBSD Project in part by Network 9 * Associates Laboratories, the Security Research Division of Network 10 * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), 11 * as part of the DARPA CHATS research program. 12 * 13 * Redistribution and use in source and binary forms, with or without 14 * modification, are permitted provided that the following conditions 15 * are met: 16 * 1. Redistributions of source code must retain the above copyright 17 * notice, this list of conditions and the following disclaimer. 18 * 2. Redistributions in binary form must reproduce the above copyright 19 * notice, this list of conditions and the following disclaimer in the 20 * documentation and/or other materials provided with the distribution. 21 * 22 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 23 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 24 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 25 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 26 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 27 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 28 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 29 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 30 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 31 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 32 * SUCH DAMAGE. 33 *	1/- 2 Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson 3 * Copyright (c) 2001, 2002, 2003 Networks Associates Technology, Inc. 4 * All rights reserved. 5 * 6 * This software was developed by Robert Watson for the TrustedBSD Project. 7 * 8 * This software was developed for the FreeBSD Project in part by Network 9 * Associates Laboratories, the Security Research Division of Network 10 * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), 11 * as part of the DARPA CHATS research program. 12 * 13 * Redistribution and use in source and binary forms, with or without 14 * modification, are permitted provided that the following conditions 15 * are met: 16 * 1. Redistributions of source code must retain the above copyright 17 * notice, this list of conditions and the following disclaimer. 18 * 2. Redistributions in binary form must reproduce the above copyright 19 * notice, this list of conditions and the following disclaimer in the 20 * documentation and/or other materials provided with the distribution. 21 * 22 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 23 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 24 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 25 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 26 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 27 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 28 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 29 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 30 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 31 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 32 * SUCH DAMAGE. 33 *
34 * $FreeBSD: head/sys/security/mac/mac_framework.h 122527 2003-11-12 03:33:43Z rwatson $	34 * $FreeBSD: head/sys/security/mac/mac_framework.h 122807 2003-11-16 18:25:20Z rwatson $
35 / 36/ 37 * Userland/kernel interface for Mandatory Access Control. 38 * 39 * The POSIX.1e implementation page may be reached at: 40 * http://www.trustedbsd.org/ 41 / 42#ifndef _SYS_MAC_H 43#define _SYS_MAC_H 44 45#include <sys/_label.h> 46 47#ifndef _POSIX_MAC 48#define _POSIX_MAC 49#endif 50 51/ 52 * MAC framework-related constants and limits. 53 / 54#define MAC_MAX_POLICY_NAME 32 55#define MAC_MAX_LABEL_ELEMENT_NAME 32 56#define MAC_MAX_LABEL_ELEMENT_DATA 4096 57#define MAC_MAX_LABEL_BUF_LEN 8192 58 59struct mac { 60 size_t m_buflen; 61 char m_string; 62}; 63 64typedef struct mac mac_t; 65 66#ifndef _KERNEL 67 68/ 69 * Location of the userland MAC framework configuration file. mac.conf 70 * binds policy names to shared libraries that understand those policies, 71 * as well as setting defaults for MAC-aware applications. 72 / 73#define MAC_CONFFILE "/etc/mac.conf" 74 75/ 76 * Extended non-POSIX.1e interfaces that offer additional services 77 * available from the userland and kernel MAC frameworks. 78 / 79__BEGIN_DECLS 80int mac_execve(char fname, char argv, char envv, mac_t _label); 81int mac_free(mac_t _label); 82int mac_from_text(mac_t _label, const char _text); 83int mac_get_fd(int _fd, mac_t _label); 84int mac_get_file(const char _path, mac_t _label); 85int mac_get_link(const char _path, mac_t _label); 86int mac_get_pid(pid_t _pid, mac_t _label); 87int mac_get_proc(mac_t _label); 88int mac_is_present(const char _policyname); 89int mac_prepare(mac_t _label, const char _elements); 90int mac_prepare_file_label(mac_t _label); 91int mac_prepare_ifnet_label(mac_t _label); 92int mac_prepare_process_label(mac_t _label); 93int mac_prepare_type(mac_t _label, const char _type); 94int mac_set_fd(int _fildes, const mac_t _label); 95int mac_set_file(const char _path, mac_t _label); 96int mac_set_link(const char _path, mac_t _label); 97int mac_set_proc(const mac_t _label); 98int mac_syscall(const char _policyname, int _call, void _arg); 99int mac_to_text(mac_t mac, char *_text); 100__END_DECLS 101* 102#else /* _KERNEL / 103* 104/* 105 * Kernel functions to manage and evaluate labels. 106 / 107struct bpf_d; 108struct componentname; 109struct devfs_dirent; 110struct ifnet; 111struct ifreq; 112struct image_params; 113struct ipq; 114struct m_tag; 115struct mbuf; 116struct mount; 117struct proc; 118struct sockaddr; 119struct socket; 120struct pipe; 121struct thread; 122struct timespec; 123struct ucred; 124struct uio; 125struct vattr; 126struct vnode; 127* 128#include <sys/acl.h> /* XXX acl_type_t / 129* 130struct vop_setlabel_args; 131 132/* 133 * Label operations. 134 / 135void mac_init_bpfdesc(struct bpf_d ); 136void mac_init_cred(struct ucred ); 137void mac_init_devfsdirent(struct devfs_dirent ); 138void mac_init_ifnet(struct ifnet ); 139int mac_init_ipq(struct ipq , int flag); 140int mac_init_socket(struct socket , int flag); 141void mac_init_pipe(struct pipe ); 142int mac_init_mbuf(struct mbuf mbuf, int flag); 143int mac_init_mbuf_tag(struct m_tag , int flag); 144void mac_init_mount(struct mount ); 145void mac_init_proc(struct proc ); 146void mac_init_vnode(struct vnode ); 147void mac_copy_mbuf_tag(struct m_tag , struct m_tag ); 148void mac_copy_vnode_label(struct label , struct label label); 149void mac_destroy_bpfdesc(struct bpf_d ); 150void mac_destroy_cred(struct ucred ); 151void mac_destroy_devfsdirent(struct devfs_dirent ); 152void mac_destroy_ifnet(struct ifnet ); 153void mac_destroy_ipq(struct ipq ); 154void mac_destroy_socket(struct socket ); 155void mac_destroy_pipe(struct pipe ); 156void mac_destroy_proc(struct proc ); 157void mac_destroy_mbuf_tag(struct m_tag ); 158void mac_destroy_mount(struct mount ); 159void mac_destroy_vnode(struct vnode ); 160 161struct label mac_cred_label_alloc(void); 162void mac_cred_label_free(struct label label); 163struct label mac_vnode_label_alloc(void); 164void mac_vnode_label_free(struct label label); 165 166/* 167 * Labeling event operations: file system objects, and things that 168 * look a lot like file system objects. 169 / 170void mac_associate_vnode_devfs(struct mount mp, struct devfs_dirent de, 171* struct vnode vp); 172int mac_associate_vnode_extattr(struct mount mp, struct vnode vp); 173void mac_associate_vnode_singlelabel(struct mount mp, struct vnode vp); 174void mac_create_devfs_device(struct mount mp, dev_t dev, 175 struct devfs_dirent de); 176void mac_create_devfs_directory(struct mount mp, char dirname, 177* int dirnamelen, struct devfs_dirent de); 178void mac_create_devfs_symlink(struct ucred cred, struct mount mp, 179* struct devfs_dirent dd, struct devfs_dirent de); 180int mac_create_vnode_extattr(struct ucred cred, struct mount mp, 181 struct vnode dvp, struct vnode vp, struct componentname cnp); 182void mac_create_mount(struct ucred cred, struct mount mp); 183void mac_create_root_mount(struct ucred cred, struct mount mp); 184void mac_relabel_vnode(struct ucred cred, struct vnode vp, 185* struct label newlabel); 186void mac_update_devfsdirent(struct mount mp, struct devfs_dirent de, 187* struct vnode vp); 188* 189/* 190 * Labeling event operations: IPC objects. 191 / 192void mac_create_mbuf_from_socket(struct socket so, struct mbuf m); 193void mac_create_socket(struct ucred cred, struct socket socket); 194void mac_create_socket_from_socket(struct socket oldsocket, 195 struct socket newsocket); 196void mac_set_socket_peer_from_mbuf(struct mbuf mbuf, 197 struct socket socket); 198void mac_set_socket_peer_from_socket(struct socket oldsocket, 199 struct socket newsocket); 200void mac_create_pipe(struct ucred cred, struct pipe pipe); 201* 202/* 203 * Labeling event operations: network objects. 204 / 205void mac_create_bpfdesc(struct ucred cred, struct bpf_d bpf_d); 206void mac_create_ifnet(struct ifnet ifp); 207void mac_create_ipq(struct mbuf fragment, struct ipq ipq); 208void mac_create_datagram_from_ipq(struct ipq ipq, struct mbuf datagram); 209void mac_create_fragment(struct mbuf datagram, struct mbuf fragment); 210void mac_create_mbuf_from_mbuf(struct mbuf oldmbuf, struct mbuf newmbuf); 211void mac_create_mbuf_linklayer(struct ifnet ifnet, struct mbuf m); 212void mac_create_mbuf_from_bpfdesc(struct bpf_d bpf_d, struct mbuf m); 213void mac_create_mbuf_from_ifnet(struct ifnet ifnet, struct mbuf m); 214void mac_create_mbuf_multicast_encap(struct mbuf oldmbuf, 215* struct ifnet ifnet, struct mbuf newmbuf); 216void mac_create_mbuf_netlayer(struct mbuf oldmbuf, struct mbuf newmbuf); 217int mac_fragment_match(struct mbuf fragment, struct ipq ipq); 218void mac_reflect_mbuf_icmp(struct mbuf m); 219void mac_reflect_mbuf_tcp(struct mbuf m); 220void mac_update_ipq(struct mbuf fragment, struct ipq ipq); 221 222/* 223 * Labeling event operations: processes. 224 / 225void mac_create_cred(struct ucred cred_parent, struct ucred cred_child); 226int mac_execve_enter(struct image_params imgp, struct mac mac_p); 227void mac_execve_exit(struct image_params imgp); 228void mac_execve_transition(struct ucred old, struct ucred new, 229 struct vnode vp, struct label interpvnodelabel, 230 struct image_params imgp); 231int mac_execve_will_transition(struct ucred old, struct vnode vp, 232* struct label interpvnodelabel, struct image_params imgp); 233void mac_create_proc0(struct ucred cred); 234void mac_create_proc1(struct ucred cred); 235void mac_thread_userret(struct thread td); 236* 237/* Access control checks. / 238int mac_check_bpfdesc_receive(struct bpf_d bpf_d, struct ifnet ifnet); 239int mac_check_cred_visible(struct ucred u1, struct ucred u2); 240int mac_check_ifnet_transmit(struct ifnet ifnet, struct mbuf m); 241int mac_check_kenv_dump(struct ucred cred); 242int mac_check_kenv_get(struct ucred cred, char name); 243int mac_check_kenv_set(struct ucred cred, char name, char value); 244int mac_check_kenv_unset(struct ucred cred, char name); 245int mac_check_kld_load(struct ucred cred, struct vnode vp); 246int mac_check_kld_stat(struct ucred cred); 247int mac_check_kld_unload(struct ucred cred); 248int mac_check_mount_stat(struct ucred cred, struct mount mp); 249int mac_check_pipe_ioctl(struct ucred cred, struct pipe pipe, 250* unsigned long cmd, void data); 251int mac_check_pipe_poll(struct ucred cred, struct pipe pipe); 252int mac_check_pipe_read(struct ucred cred, struct pipe pipe); 253int mac_check_pipe_stat(struct ucred cred, struct pipe pipe); 254int mac_check_pipe_write(struct ucred cred, struct pipe pipe); 255int mac_check_proc_debug(struct ucred cred, struct proc proc); 256int mac_check_proc_sched(struct ucred cred, struct proc proc); 257int mac_check_proc_signal(struct ucred cred, struct proc proc, 258* int signum); 259int mac_check_socket_bind(struct ucred cred, struct socket so, 260 struct sockaddr sockaddr); 261int mac_check_socket_connect(struct ucred cred, struct socket so, 262* struct sockaddr sockaddr); 263int mac_check_socket_deliver(struct socket so, struct mbuf m); 264int mac_check_socket_listen(struct ucred cred, struct socket so); 265int mac_check_socket_receive(struct ucred cred, struct socket so); 266int mac_check_socket_send(struct ucred cred, struct socket so); 267int mac_check_socket_visible(struct ucred cred, struct socket so); 268int mac_check_sysarch_ioperm(struct ucred cred); 269int mac_check_system_acct(struct ucred cred, struct vnode vp); 270int mac_check_system_nfsd(struct ucred cred); 271int mac_check_system_reboot(struct ucred cred, int howto); 272int mac_check_system_settime(struct ucred cred); 273int mac_check_system_swapon(struct ucred cred, struct vnode vp); 274int mac_check_system_swapoff(struct ucred cred, struct vnode vp); 275int mac_check_system_sysctl(struct ucred cred, int name, 276* u_int namelen, void old, size_t oldlenp, int inkernel, 277 void new, size_t newlen); 278int mac_check_vnode_access(struct ucred cred, struct vnode vp, 279* int acc_mode); 280int mac_check_vnode_chdir(struct ucred cred, struct vnode dvp); 281int mac_check_vnode_chroot(struct ucred cred, struct vnode dvp); 282int mac_check_vnode_create(struct ucred cred, struct vnode dvp, 283 struct componentname cnp, struct vattr vap); 284int mac_check_vnode_delete(struct ucred cred, struct vnode dvp, 285 struct vnode vp, struct componentname cnp); 286int mac_check_vnode_deleteacl(struct ucred cred, struct vnode vp, 287 acl_type_t type); 288int mac_check_vnode_deleteextattr(struct ucred cred, struct vnode vp, 289 int attrnamespace, const char name); 290int mac_check_vnode_exec(struct ucred cred, struct vnode vp, 291* struct image_params imgp); 292int mac_check_vnode_getacl(struct ucred cred, struct vnode vp, 293* acl_type_t type); 294int mac_check_vnode_getextattr(struct ucred cred, struct vnode vp, 295 int attrnamespace, const char name, struct uio uio); 296int mac_check_vnode_link(struct ucred cred, struct vnode dvp, 297 struct vnode vp, struct componentname cnp); 298int mac_check_vnode_listextattr(struct ucred cred, struct vnode vp, 299 int attrnamespace); 300int mac_check_vnode_lookup(struct ucred cred, struct vnode dvp, 301 struct componentname cnp); 302int mac_check_vnode_mmap(struct ucred cred, struct vnode vp, 303* int prot); 304int mac_check_vnode_mprotect(struct ucred cred, struct vnode vp, 305 int prot); 306int mac_check_vnode_open(struct ucred cred, struct vnode vp, 307 int acc_mode); 308int mac_check_vnode_poll(struct ucred active_cred, 309* struct ucred file_cred, struct vnode vp); 310int mac_check_vnode_read(struct ucred active_cred, 311* struct ucred file_cred, struct vnode vp); 312int mac_check_vnode_readdir(struct ucred cred, struct vnode vp); 313int mac_check_vnode_readlink(struct ucred cred, struct vnode vp); 314int mac_check_vnode_rename_from(struct ucred cred, struct vnode dvp, 315 struct vnode vp, struct componentname cnp); 316int mac_check_vnode_rename_to(struct ucred cred, struct vnode dvp, 317 struct vnode vp, int samedir, struct componentname cnp); 318int mac_check_vnode_revoke(struct ucred cred, struct vnode vp); 319int mac_check_vnode_setacl(struct ucred cred, struct vnode vp, 320 acl_type_t type, struct acl acl); 321int mac_check_vnode_setextattr(struct ucred cred, struct vnode vp, 322* int attrnamespace, const char name, struct uio uio); 323int mac_check_vnode_setflags(struct ucred cred, struct vnode vp, 324 u_long flags); 325int mac_check_vnode_setmode(struct ucred cred, struct vnode vp, 326 mode_t mode); 327int mac_check_vnode_setowner(struct ucred cred, struct vnode vp, 328 uid_t uid, gid_t gid); 329int mac_check_vnode_setutimes(struct ucred cred, struct vnode vp, 330 struct timespec atime, struct timespec mtime); 331int mac_check_vnode_stat(struct ucred active_cred, 332* struct ucred file_cred, struct vnode vp); 333int mac_check_vnode_write(struct ucred active_cred, 334* struct ucred file_cred, struct vnode vp);	35 / 36/ 37 * Userland/kernel interface for Mandatory Access Control. 38 * 39 * The POSIX.1e implementation page may be reached at: 40 * http://www.trustedbsd.org/ 41 / 42#ifndef _SYS_MAC_H 43#define _SYS_MAC_H 44 45#include <sys/_label.h> 46 47#ifndef _POSIX_MAC 48#define _POSIX_MAC 49#endif 50 51/ 52 * MAC framework-related constants and limits. 53 / 54#define MAC_MAX_POLICY_NAME 32 55#define MAC_MAX_LABEL_ELEMENT_NAME 32 56#define MAC_MAX_LABEL_ELEMENT_DATA 4096 57#define MAC_MAX_LABEL_BUF_LEN 8192 58 59struct mac { 60 size_t m_buflen; 61 char m_string; 62}; 63 64typedef struct mac mac_t; 65 66#ifndef _KERNEL 67 68/ 69 * Location of the userland MAC framework configuration file. mac.conf 70 * binds policy names to shared libraries that understand those policies, 71 * as well as setting defaults for MAC-aware applications. 72 / 73#define MAC_CONFFILE "/etc/mac.conf" 74 75/ 76 * Extended non-POSIX.1e interfaces that offer additional services 77 * available from the userland and kernel MAC frameworks. 78 / 79__BEGIN_DECLS 80int mac_execve(char fname, char argv, char envv, mac_t _label); 81int mac_free(mac_t _label); 82int mac_from_text(mac_t _label, const char _text); 83int mac_get_fd(int _fd, mac_t _label); 84int mac_get_file(const char _path, mac_t _label); 85int mac_get_link(const char _path, mac_t _label); 86int mac_get_pid(pid_t _pid, mac_t _label); 87int mac_get_proc(mac_t _label); 88int mac_is_present(const char _policyname); 89int mac_prepare(mac_t _label, const char _elements); 90int mac_prepare_file_label(mac_t _label); 91int mac_prepare_ifnet_label(mac_t _label); 92int mac_prepare_process_label(mac_t _label); 93int mac_prepare_type(mac_t _label, const char _type); 94int mac_set_fd(int _fildes, const mac_t _label); 95int mac_set_file(const char _path, mac_t _label); 96int mac_set_link(const char _path, mac_t _label); 97int mac_set_proc(const mac_t _label); 98int mac_syscall(const char _policyname, int _call, void _arg); 99int mac_to_text(mac_t mac, char *_text); 100__END_DECLS 101* 102#else /* _KERNEL / 103* 104/* 105 * Kernel functions to manage and evaluate labels. 106 / 107struct bpf_d; 108struct componentname; 109struct devfs_dirent; 110struct ifnet; 111struct ifreq; 112struct image_params; 113struct ipq; 114struct m_tag; 115struct mbuf; 116struct mount; 117struct proc; 118struct sockaddr; 119struct socket; 120struct pipe; 121struct thread; 122struct timespec; 123struct ucred; 124struct uio; 125struct vattr; 126struct vnode; 127* 128#include <sys/acl.h> /* XXX acl_type_t / 129* 130struct vop_setlabel_args; 131 132/* 133 * Label operations. 134 / 135void mac_init_bpfdesc(struct bpf_d ); 136void mac_init_cred(struct ucred ); 137void mac_init_devfsdirent(struct devfs_dirent ); 138void mac_init_ifnet(struct ifnet ); 139int mac_init_ipq(struct ipq , int flag); 140int mac_init_socket(struct socket , int flag); 141void mac_init_pipe(struct pipe ); 142int mac_init_mbuf(struct mbuf mbuf, int flag); 143int mac_init_mbuf_tag(struct m_tag , int flag); 144void mac_init_mount(struct mount ); 145void mac_init_proc(struct proc ); 146void mac_init_vnode(struct vnode ); 147void mac_copy_mbuf_tag(struct m_tag , struct m_tag ); 148void mac_copy_vnode_label(struct label , struct label label); 149void mac_destroy_bpfdesc(struct bpf_d ); 150void mac_destroy_cred(struct ucred ); 151void mac_destroy_devfsdirent(struct devfs_dirent ); 152void mac_destroy_ifnet(struct ifnet ); 153void mac_destroy_ipq(struct ipq ); 154void mac_destroy_socket(struct socket ); 155void mac_destroy_pipe(struct pipe ); 156void mac_destroy_proc(struct proc ); 157void mac_destroy_mbuf_tag(struct m_tag ); 158void mac_destroy_mount(struct mount ); 159void mac_destroy_vnode(struct vnode ); 160 161struct label mac_cred_label_alloc(void); 162void mac_cred_label_free(struct label label); 163struct label mac_vnode_label_alloc(void); 164void mac_vnode_label_free(struct label label); 165 166/* 167 * Labeling event operations: file system objects, and things that 168 * look a lot like file system objects. 169 / 170void mac_associate_vnode_devfs(struct mount mp, struct devfs_dirent de, 171* struct vnode vp); 172int mac_associate_vnode_extattr(struct mount mp, struct vnode vp); 173void mac_associate_vnode_singlelabel(struct mount mp, struct vnode vp); 174void mac_create_devfs_device(struct mount mp, dev_t dev, 175 struct devfs_dirent de); 176void mac_create_devfs_directory(struct mount mp, char dirname, 177* int dirnamelen, struct devfs_dirent de); 178void mac_create_devfs_symlink(struct ucred cred, struct mount mp, 179* struct devfs_dirent dd, struct devfs_dirent de); 180int mac_create_vnode_extattr(struct ucred cred, struct mount mp, 181 struct vnode dvp, struct vnode vp, struct componentname cnp); 182void mac_create_mount(struct ucred cred, struct mount mp); 183void mac_create_root_mount(struct ucred cred, struct mount mp); 184void mac_relabel_vnode(struct ucred cred, struct vnode vp, 185* struct label newlabel); 186void mac_update_devfsdirent(struct mount mp, struct devfs_dirent de, 187* struct vnode vp); 188* 189/* 190 * Labeling event operations: IPC objects. 191 / 192void mac_create_mbuf_from_socket(struct socket so, struct mbuf m); 193void mac_create_socket(struct ucred cred, struct socket socket); 194void mac_create_socket_from_socket(struct socket oldsocket, 195 struct socket newsocket); 196void mac_set_socket_peer_from_mbuf(struct mbuf mbuf, 197 struct socket socket); 198void mac_set_socket_peer_from_socket(struct socket oldsocket, 199 struct socket newsocket); 200void mac_create_pipe(struct ucred cred, struct pipe pipe); 201* 202/* 203 * Labeling event operations: network objects. 204 / 205void mac_create_bpfdesc(struct ucred cred, struct bpf_d bpf_d); 206void mac_create_ifnet(struct ifnet ifp); 207void mac_create_ipq(struct mbuf fragment, struct ipq ipq); 208void mac_create_datagram_from_ipq(struct ipq ipq, struct mbuf datagram); 209void mac_create_fragment(struct mbuf datagram, struct mbuf fragment); 210void mac_create_mbuf_from_mbuf(struct mbuf oldmbuf, struct mbuf newmbuf); 211void mac_create_mbuf_linklayer(struct ifnet ifnet, struct mbuf m); 212void mac_create_mbuf_from_bpfdesc(struct bpf_d bpf_d, struct mbuf m); 213void mac_create_mbuf_from_ifnet(struct ifnet ifnet, struct mbuf m); 214void mac_create_mbuf_multicast_encap(struct mbuf oldmbuf, 215* struct ifnet ifnet, struct mbuf newmbuf); 216void mac_create_mbuf_netlayer(struct mbuf oldmbuf, struct mbuf newmbuf); 217int mac_fragment_match(struct mbuf fragment, struct ipq ipq); 218void mac_reflect_mbuf_icmp(struct mbuf m); 219void mac_reflect_mbuf_tcp(struct mbuf m); 220void mac_update_ipq(struct mbuf fragment, struct ipq ipq); 221 222/* 223 * Labeling event operations: processes. 224 / 225void mac_create_cred(struct ucred cred_parent, struct ucred cred_child); 226int mac_execve_enter(struct image_params imgp, struct mac mac_p); 227void mac_execve_exit(struct image_params imgp); 228void mac_execve_transition(struct ucred old, struct ucred new, 229 struct vnode vp, struct label interpvnodelabel, 230 struct image_params imgp); 231int mac_execve_will_transition(struct ucred old, struct vnode vp, 232* struct label interpvnodelabel, struct image_params imgp); 233void mac_create_proc0(struct ucred cred); 234void mac_create_proc1(struct ucred cred); 235void mac_thread_userret(struct thread td); 236* 237/* Access control checks. / 238int mac_check_bpfdesc_receive(struct bpf_d bpf_d, struct ifnet ifnet); 239int mac_check_cred_visible(struct ucred u1, struct ucred u2); 240int mac_check_ifnet_transmit(struct ifnet ifnet, struct mbuf m); 241int mac_check_kenv_dump(struct ucred cred); 242int mac_check_kenv_get(struct ucred cred, char name); 243int mac_check_kenv_set(struct ucred cred, char name, char value); 244int mac_check_kenv_unset(struct ucred cred, char name); 245int mac_check_kld_load(struct ucred cred, struct vnode vp); 246int mac_check_kld_stat(struct ucred cred); 247int mac_check_kld_unload(struct ucred cred); 248int mac_check_mount_stat(struct ucred cred, struct mount mp); 249int mac_check_pipe_ioctl(struct ucred cred, struct pipe pipe, 250* unsigned long cmd, void data); 251int mac_check_pipe_poll(struct ucred cred, struct pipe pipe); 252int mac_check_pipe_read(struct ucred cred, struct pipe pipe); 253int mac_check_pipe_stat(struct ucred cred, struct pipe pipe); 254int mac_check_pipe_write(struct ucred cred, struct pipe pipe); 255int mac_check_proc_debug(struct ucred cred, struct proc proc); 256int mac_check_proc_sched(struct ucred cred, struct proc proc); 257int mac_check_proc_signal(struct ucred cred, struct proc proc, 258* int signum); 259int mac_check_socket_bind(struct ucred cred, struct socket so, 260 struct sockaddr sockaddr); 261int mac_check_socket_connect(struct ucred cred, struct socket so, 262* struct sockaddr sockaddr); 263int mac_check_socket_deliver(struct socket so, struct mbuf m); 264int mac_check_socket_listen(struct ucred cred, struct socket so); 265int mac_check_socket_receive(struct ucred cred, struct socket so); 266int mac_check_socket_send(struct ucred cred, struct socket so); 267int mac_check_socket_visible(struct ucred cred, struct socket so); 268int mac_check_sysarch_ioperm(struct ucred cred); 269int mac_check_system_acct(struct ucred cred, struct vnode vp); 270int mac_check_system_nfsd(struct ucred cred); 271int mac_check_system_reboot(struct ucred cred, int howto); 272int mac_check_system_settime(struct ucred cred); 273int mac_check_system_swapon(struct ucred cred, struct vnode vp); 274int mac_check_system_swapoff(struct ucred cred, struct vnode vp); 275int mac_check_system_sysctl(struct ucred cred, int name, 276* u_int namelen, void old, size_t oldlenp, int inkernel, 277 void new, size_t newlen); 278int mac_check_vnode_access(struct ucred cred, struct vnode vp, 279* int acc_mode); 280int mac_check_vnode_chdir(struct ucred cred, struct vnode dvp); 281int mac_check_vnode_chroot(struct ucred cred, struct vnode dvp); 282int mac_check_vnode_create(struct ucred cred, struct vnode dvp, 283 struct componentname cnp, struct vattr vap); 284int mac_check_vnode_delete(struct ucred cred, struct vnode dvp, 285 struct vnode vp, struct componentname cnp); 286int mac_check_vnode_deleteacl(struct ucred cred, struct vnode vp, 287 acl_type_t type); 288int mac_check_vnode_deleteextattr(struct ucred cred, struct vnode vp, 289 int attrnamespace, const char name); 290int mac_check_vnode_exec(struct ucred cred, struct vnode vp, 291* struct image_params imgp); 292int mac_check_vnode_getacl(struct ucred cred, struct vnode vp, 293* acl_type_t type); 294int mac_check_vnode_getextattr(struct ucred cred, struct vnode vp, 295 int attrnamespace, const char name, struct uio uio); 296int mac_check_vnode_link(struct ucred cred, struct vnode dvp, 297 struct vnode vp, struct componentname cnp); 298int mac_check_vnode_listextattr(struct ucred cred, struct vnode vp, 299 int attrnamespace); 300int mac_check_vnode_lookup(struct ucred cred, struct vnode dvp, 301 struct componentname cnp); 302int mac_check_vnode_mmap(struct ucred cred, struct vnode vp, 303* int prot); 304int mac_check_vnode_mprotect(struct ucred cred, struct vnode vp, 305 int prot); 306int mac_check_vnode_open(struct ucred cred, struct vnode vp, 307 int acc_mode); 308int mac_check_vnode_poll(struct ucred active_cred, 309* struct ucred file_cred, struct vnode vp); 310int mac_check_vnode_read(struct ucred active_cred, 311* struct ucred file_cred, struct vnode vp); 312int mac_check_vnode_readdir(struct ucred cred, struct vnode vp); 313int mac_check_vnode_readlink(struct ucred cred, struct vnode vp); 314int mac_check_vnode_rename_from(struct ucred cred, struct vnode dvp, 315 struct vnode vp, struct componentname cnp); 316int mac_check_vnode_rename_to(struct ucred cred, struct vnode dvp, 317 struct vnode vp, int samedir, struct componentname cnp); 318int mac_check_vnode_revoke(struct ucred cred, struct vnode vp); 319int mac_check_vnode_setacl(struct ucred cred, struct vnode vp, 320 acl_type_t type, struct acl acl); 321int mac_check_vnode_setextattr(struct ucred cred, struct vnode vp, 322* int attrnamespace, const char name, struct uio uio); 323int mac_check_vnode_setflags(struct ucred cred, struct vnode vp, 324 u_long flags); 325int mac_check_vnode_setmode(struct ucred cred, struct vnode vp, 326 mode_t mode); 327int mac_check_vnode_setowner(struct ucred cred, struct vnode vp, 328 uid_t uid, gid_t gid); 329int mac_check_vnode_setutimes(struct ucred cred, struct vnode vp, 330 struct timespec atime, struct timespec mtime); 331int mac_check_vnode_stat(struct ucred active_cred, 332* struct ucred file_cred, struct vnode vp); 333int mac_check_vnode_write(struct ucred active_cred, 334* struct ucred file_cred, struct vnode vp);
335int mac_getsockopt_label_get(struct ucred cred, struct socket so,	335int mac_getsockopt_label(struct ucred cred, struct socket so,
336 struct mac *extmac);	336 struct mac *extmac);
337int mac_getsockopt_peerlabel_get(struct ucred cred, struct socket so,	337int mac_getsockopt_peerlabel(struct ucred cred, struct socket so,
338 struct mac extmac); 339int mac_ioctl_ifnet_get(struct ucred cred, struct ifreq ifr, 340* struct ifnet ifnet); 341int mac_ioctl_ifnet_set(struct ucred cred, struct ifreq ifr, 342* struct ifnet *ifnet);	338 struct mac extmac); 339int mac_ioctl_ifnet_get(struct ucred cred, struct ifreq ifr, 340* struct ifnet ifnet); 341int mac_ioctl_ifnet_set(struct ucred cred, struct ifreq ifr, 342* struct ifnet *ifnet);
343int mac_setsockopt_label_set(struct ucred cred, struct socket so,	343int mac_setsockopt_label(struct ucred cred, struct socket so,
344 struct mac extmac); 345int mac_pipe_label_set(struct ucred cred, struct pipe pipe, 346* struct label label); 347void mac_cred_mmapped_drop_perms(struct thread td, struct ucred cred); 348* 349/* 350 * Calls to help various file systems implement labeling functionality 351 * using their existing EA implementation. 352 / 353int vop_stdsetlabel_ea(struct vop_setlabel_args ap); 354 355#endif /* !_KERNEL / 356* 357#endif /* !_SYS_MAC_H */	344 struct mac extmac); 345int mac_pipe_label_set(struct ucred cred, struct pipe pipe, 346* struct label label); 347void mac_cred_mmapped_drop_perms(struct thread td, struct ucred cred); 348* 349/* 350 * Calls to help various file systems implement labeling functionality 351 * using their existing EA implementation. 352 / 353int vop_stdsetlabel_ea(struct vop_setlabel_args ap); 354 355#endif /* !_KERNEL / 356* 357#endif /* !_SYS_MAC_H */