35 */
36/*
37 * Kernel interface for MAC policy modules.
38 */
39#ifndef _SYS_MAC_POLICY_H
40#define _SYS_MAC_POLICY_H
41
42/*-
43 * Pluggable access control policy definition structure.
44 *
45 * List of operations that are performed as part of the implementation
46 * of a MAC policy. Policy implementors declare operations with a
47 * mac_policy_ops structure, and using the MAC_POLICY_SET() macro.
48 * If an entry point is not declared, then then the policy will be ignored
49 * during evaluation of that event or check.
50 *
51 * Operations are sorted first by general class of operation, then
52 * alphabetically.
53 */
54struct acl;
55struct componentname;
56struct devfs_dirent;
57struct ipq;
58struct label;
59struct mac_policy_conf;
60struct mbuf;
61struct mount;
62struct pipe;
63struct sbuf;
64struct socket;
65struct ucred;
66struct uio;
67struct vnode;
68struct mac_policy_ops {
69 /*
70 * Policy module operations.
71 */
72 void (*mpo_destroy)(struct mac_policy_conf *mpc);
73 void (*mpo_init)(struct mac_policy_conf *mpc);
74
75 /*
76 * General policy-directed security system call so that policies
77 * may implement new services without reserving explicit
78 * system call numbers.
79 */
80 int (*mpo_syscall)(struct thread *td, int call, void *arg);
81
82 /*
83 * Label operations.
84 */
85 void (*mpo_init_bpfdesc_label)(struct label *label);
86 void (*mpo_init_cred_label)(struct label *label);
87 void (*mpo_init_devfsdirent_label)(struct label *label);
88 void (*mpo_init_ifnet_label)(struct label *label);
89 int (*mpo_init_ipq_label)(struct label *label, int flag);
90 int (*mpo_init_mbuf_label)(struct label *label, int flag);
91 void (*mpo_init_mount_label)(struct label *label);
92 void (*mpo_init_mount_fs_label)(struct label *label);
93 int (*mpo_init_socket_label)(struct label *label, int flag);
94 int (*mpo_init_socket_peer_label)(struct label *label, int flag);
95 void (*mpo_init_pipe_label)(struct label *label);
96 void (*mpo_init_proc_label)(struct label *label);
97 void (*mpo_init_vnode_label)(struct label *label);
98 void (*mpo_destroy_bpfdesc_label)(struct label *label);
99 void (*mpo_destroy_cred_label)(struct label *label);
100 void (*mpo_destroy_devfsdirent_label)(struct label *label);
101 void (*mpo_destroy_ifnet_label)(struct label *label);
102 void (*mpo_destroy_ipq_label)(struct label *label);
103 void (*mpo_destroy_mbuf_label)(struct label *label);
104 void (*mpo_destroy_mount_label)(struct label *label);
105 void (*mpo_destroy_mount_fs_label)(struct label *label);
106 void (*mpo_destroy_socket_label)(struct label *label);
107 void (*mpo_destroy_socket_peer_label)(struct label *label);
108 void (*mpo_destroy_pipe_label)(struct label *label);
109 void (*mpo_destroy_proc_label)(struct label *label);
110 void (*mpo_destroy_vnode_label)(struct label *label);
111 void (*mpo_copy_mbuf_label)(struct label *src,
112 struct label *dest);
113 void (*mpo_copy_pipe_label)(struct label *src,
114 struct label *dest);
115 void (*mpo_copy_vnode_label)(struct label *src,
116 struct label *dest);
117 int (*mpo_externalize_cred_label)(struct label *label,
118 char *element_name, struct sbuf *sb, int *claimed);
119 int (*mpo_externalize_ifnet_label)(struct label *label,
120 char *element_name, struct sbuf *sb, int *claimed);
121 int (*mpo_externalize_pipe_label)(struct label *label,
122 char *element_name, struct sbuf *sb, int *claimed);
123 int (*mpo_externalize_socket_label)(struct label *label,
124 char *element_name, struct sbuf *sb, int *claimed);
125 int (*mpo_externalize_socket_peer_label)(struct label *label,
126 char *element_name, struct sbuf *sb, int *claimed);
127 int (*mpo_externalize_vnode_label)(struct label *label,
128 char *element_name, struct sbuf *sb, int *claimed);
129 int (*mpo_internalize_cred_label)(struct label *label,
130 char *element_name, char *element_data, int *claimed);
131 int (*mpo_internalize_ifnet_label)(struct label *label,
132 char *element_name, char *element_data, int *claimed);
133 int (*mpo_internalize_pipe_label)(struct label *label,
134 char *element_name, char *element_data, int *claimed);
135 int (*mpo_internalize_socket_label)(struct label *label,
136 char *element_name, char *element_data, int *claimed);
137 int (*mpo_internalize_vnode_label)(struct label *label,
138 char *element_name, char *element_data, int *claimed);
139
140 /*
141 * Labeling event operations: file system objects, and things that
142 * look a lot like file system objects.
143 */
144 void (*mpo_associate_vnode_devfs)(struct mount *mp,
145 struct label *fslabel, struct devfs_dirent *de,
146 struct label *delabel, struct vnode *vp,
147 struct label *vlabel);
148 int (*mpo_associate_vnode_extattr)(struct mount *mp,
149 struct label *fslabel, struct vnode *vp,
150 struct label *vlabel);
151 void (*mpo_associate_vnode_singlelabel)(struct mount *mp,
152 struct label *fslabel, struct vnode *vp,
153 struct label *vlabel);
154 void (*mpo_create_devfs_device)(struct mount *mp, dev_t dev,
155 struct devfs_dirent *de, struct label *label);
156 void (*mpo_create_devfs_directory)(struct mount *mp, char *dirname,
157 int dirnamelen, struct devfs_dirent *de,
158 struct label *label);
159 void (*mpo_create_devfs_symlink)(struct ucred *cred,
160 struct mount *mp, struct devfs_dirent *dd,
161 struct label *ddlabel, struct devfs_dirent *de,
162 struct label *delabel);
163 int (*mpo_create_vnode_extattr)(struct ucred *cred,
164 struct mount *mp, struct label *fslabel,
165 struct vnode *dvp, struct label *dlabel,
166 struct vnode *vp, struct label *vlabel,
167 struct componentname *cnp);
168 void (*mpo_create_mount)(struct ucred *cred, struct mount *mp,
169 struct label *mntlabel, struct label *fslabel);
170 void (*mpo_create_root_mount)(struct ucred *cred, struct mount *mp,
171 struct label *mountlabel, struct label *fslabel);
172 void (*mpo_relabel_vnode)(struct ucred *cred, struct vnode *vp,
173 struct label *vnodelabel, struct label *label);
174 int (*mpo_setlabel_vnode_extattr)(struct ucred *cred,
175 struct vnode *vp, struct label *vlabel,
176 struct label *intlabel);
177 void (*mpo_update_devfsdirent)(struct mount *mp,
178 struct devfs_dirent *devfs_dirent,
179 struct label *direntlabel, struct vnode *vp,
180 struct label *vnodelabel);
181
182 /*
183 * Labeling event operations: IPC objects.
184 */
185 void (*mpo_create_mbuf_from_socket)(struct socket *so,
186 struct label *socketlabel, struct mbuf *m,
187 struct label *mbuflabel);
188 void (*mpo_create_socket)(struct ucred *cred, struct socket *so,
189 struct label *socketlabel);
190 void (*mpo_create_socket_from_socket)(struct socket *oldsocket,
191 struct label *oldsocketlabel, struct socket *newsocket,
192 struct label *newsocketlabel);
193 void (*mpo_relabel_socket)(struct ucred *cred, struct socket *so,
194 struct label *oldlabel, struct label *newlabel);
195 void (*mpo_relabel_pipe)(struct ucred *cred, struct pipe *pipe,
196 struct label *oldlabel, struct label *newlabel);
197 void (*mpo_set_socket_peer_from_mbuf)(struct mbuf *mbuf,
198 struct label *mbuflabel, struct socket *so,
199 struct label *socketpeerlabel);
200 void (*mpo_set_socket_peer_from_socket)(struct socket *oldsocket,
201 struct label *oldsocketlabel, struct socket *newsocket,
202 struct label *newsocketpeerlabel);
203 void (*mpo_create_pipe)(struct ucred *cred, struct pipe *pipe,
204 struct label *pipelabel);
205
206 /*
207 * Labeling event operations: network objects.
208 */
209 void (*mpo_create_bpfdesc)(struct ucred *cred, struct bpf_d *bpf_d,
210 struct label *bpflabel);
211 void (*mpo_create_ifnet)(struct ifnet *ifnet,
212 struct label *ifnetlabel);
213 void (*mpo_create_ipq)(struct mbuf *fragment,
214 struct label *fragmentlabel, struct ipq *ipq,
215 struct label *ipqlabel);
216 void (*mpo_create_datagram_from_ipq)
217 (struct ipq *ipq, struct label *ipqlabel,
218 struct mbuf *datagram, struct label *datagramlabel);
219 void (*mpo_create_fragment)(struct mbuf *datagram,
220 struct label *datagramlabel, struct mbuf *fragment,
221 struct label *fragmentlabel);
222 void (*mpo_create_mbuf_from_mbuf)(struct mbuf *oldmbuf,
223 struct label *oldlabel, struct mbuf *newmbuf,
224 struct label *newlabel);
225 void (*mpo_create_mbuf_linklayer)(struct ifnet *ifnet,
226 struct label *ifnetlabel, struct mbuf *mbuf,
227 struct label *mbuflabel);
228 void (*mpo_create_mbuf_from_bpfdesc)(struct bpf_d *bpf_d,
229 struct label *bpflabel, struct mbuf *mbuf,
230 struct label *mbuflabel);
231 void (*mpo_create_mbuf_from_ifnet)(struct ifnet *ifnet,
232 struct label *ifnetlabel, struct mbuf *mbuf,
233 struct label *mbuflabel);
234 void (*mpo_create_mbuf_multicast_encap)(struct mbuf *oldmbuf,
235 struct label *oldmbuflabel, struct ifnet *ifnet,
236 struct label *ifnetlabel, struct mbuf *newmbuf,
237 struct label *newmbuflabel);
238 void (*mpo_create_mbuf_netlayer)(struct mbuf *oldmbuf,
239 struct label *oldmbuflabel, struct mbuf *newmbuf,
240 struct label *newmbuflabel);
241 int (*mpo_fragment_match)(struct mbuf *fragment,
242 struct label *fragmentlabel, struct ipq *ipq,
243 struct label *ipqlabel);
| 35 */
36/*
37 * Kernel interface for MAC policy modules.
38 */
39#ifndef _SYS_MAC_POLICY_H
40#define _SYS_MAC_POLICY_H
41
42/*-
43 * Pluggable access control policy definition structure.
44 *
45 * List of operations that are performed as part of the implementation
46 * of a MAC policy. Policy implementors declare operations with a
47 * mac_policy_ops structure, and using the MAC_POLICY_SET() macro.
48 * If an entry point is not declared, then then the policy will be ignored
49 * during evaluation of that event or check.
50 *
51 * Operations are sorted first by general class of operation, then
52 * alphabetically.
53 */
54struct acl;
55struct componentname;
56struct devfs_dirent;
57struct ipq;
58struct label;
59struct mac_policy_conf;
60struct mbuf;
61struct mount;
62struct pipe;
63struct sbuf;
64struct socket;
65struct ucred;
66struct uio;
67struct vnode;
68struct mac_policy_ops {
69 /*
70 * Policy module operations.
71 */
72 void (*mpo_destroy)(struct mac_policy_conf *mpc);
73 void (*mpo_init)(struct mac_policy_conf *mpc);
74
75 /*
76 * General policy-directed security system call so that policies
77 * may implement new services without reserving explicit
78 * system call numbers.
79 */
80 int (*mpo_syscall)(struct thread *td, int call, void *arg);
81
82 /*
83 * Label operations.
84 */
85 void (*mpo_init_bpfdesc_label)(struct label *label);
86 void (*mpo_init_cred_label)(struct label *label);
87 void (*mpo_init_devfsdirent_label)(struct label *label);
88 void (*mpo_init_ifnet_label)(struct label *label);
89 int (*mpo_init_ipq_label)(struct label *label, int flag);
90 int (*mpo_init_mbuf_label)(struct label *label, int flag);
91 void (*mpo_init_mount_label)(struct label *label);
92 void (*mpo_init_mount_fs_label)(struct label *label);
93 int (*mpo_init_socket_label)(struct label *label, int flag);
94 int (*mpo_init_socket_peer_label)(struct label *label, int flag);
95 void (*mpo_init_pipe_label)(struct label *label);
96 void (*mpo_init_proc_label)(struct label *label);
97 void (*mpo_init_vnode_label)(struct label *label);
98 void (*mpo_destroy_bpfdesc_label)(struct label *label);
99 void (*mpo_destroy_cred_label)(struct label *label);
100 void (*mpo_destroy_devfsdirent_label)(struct label *label);
101 void (*mpo_destroy_ifnet_label)(struct label *label);
102 void (*mpo_destroy_ipq_label)(struct label *label);
103 void (*mpo_destroy_mbuf_label)(struct label *label);
104 void (*mpo_destroy_mount_label)(struct label *label);
105 void (*mpo_destroy_mount_fs_label)(struct label *label);
106 void (*mpo_destroy_socket_label)(struct label *label);
107 void (*mpo_destroy_socket_peer_label)(struct label *label);
108 void (*mpo_destroy_pipe_label)(struct label *label);
109 void (*mpo_destroy_proc_label)(struct label *label);
110 void (*mpo_destroy_vnode_label)(struct label *label);
111 void (*mpo_copy_mbuf_label)(struct label *src,
112 struct label *dest);
113 void (*mpo_copy_pipe_label)(struct label *src,
114 struct label *dest);
115 void (*mpo_copy_vnode_label)(struct label *src,
116 struct label *dest);
117 int (*mpo_externalize_cred_label)(struct label *label,
118 char *element_name, struct sbuf *sb, int *claimed);
119 int (*mpo_externalize_ifnet_label)(struct label *label,
120 char *element_name, struct sbuf *sb, int *claimed);
121 int (*mpo_externalize_pipe_label)(struct label *label,
122 char *element_name, struct sbuf *sb, int *claimed);
123 int (*mpo_externalize_socket_label)(struct label *label,
124 char *element_name, struct sbuf *sb, int *claimed);
125 int (*mpo_externalize_socket_peer_label)(struct label *label,
126 char *element_name, struct sbuf *sb, int *claimed);
127 int (*mpo_externalize_vnode_label)(struct label *label,
128 char *element_name, struct sbuf *sb, int *claimed);
129 int (*mpo_internalize_cred_label)(struct label *label,
130 char *element_name, char *element_data, int *claimed);
131 int (*mpo_internalize_ifnet_label)(struct label *label,
132 char *element_name, char *element_data, int *claimed);
133 int (*mpo_internalize_pipe_label)(struct label *label,
134 char *element_name, char *element_data, int *claimed);
135 int (*mpo_internalize_socket_label)(struct label *label,
136 char *element_name, char *element_data, int *claimed);
137 int (*mpo_internalize_vnode_label)(struct label *label,
138 char *element_name, char *element_data, int *claimed);
139
140 /*
141 * Labeling event operations: file system objects, and things that
142 * look a lot like file system objects.
143 */
144 void (*mpo_associate_vnode_devfs)(struct mount *mp,
145 struct label *fslabel, struct devfs_dirent *de,
146 struct label *delabel, struct vnode *vp,
147 struct label *vlabel);
148 int (*mpo_associate_vnode_extattr)(struct mount *mp,
149 struct label *fslabel, struct vnode *vp,
150 struct label *vlabel);
151 void (*mpo_associate_vnode_singlelabel)(struct mount *mp,
152 struct label *fslabel, struct vnode *vp,
153 struct label *vlabel);
154 void (*mpo_create_devfs_device)(struct mount *mp, dev_t dev,
155 struct devfs_dirent *de, struct label *label);
156 void (*mpo_create_devfs_directory)(struct mount *mp, char *dirname,
157 int dirnamelen, struct devfs_dirent *de,
158 struct label *label);
159 void (*mpo_create_devfs_symlink)(struct ucred *cred,
160 struct mount *mp, struct devfs_dirent *dd,
161 struct label *ddlabel, struct devfs_dirent *de,
162 struct label *delabel);
163 int (*mpo_create_vnode_extattr)(struct ucred *cred,
164 struct mount *mp, struct label *fslabel,
165 struct vnode *dvp, struct label *dlabel,
166 struct vnode *vp, struct label *vlabel,
167 struct componentname *cnp);
168 void (*mpo_create_mount)(struct ucred *cred, struct mount *mp,
169 struct label *mntlabel, struct label *fslabel);
170 void (*mpo_create_root_mount)(struct ucred *cred, struct mount *mp,
171 struct label *mountlabel, struct label *fslabel);
172 void (*mpo_relabel_vnode)(struct ucred *cred, struct vnode *vp,
173 struct label *vnodelabel, struct label *label);
174 int (*mpo_setlabel_vnode_extattr)(struct ucred *cred,
175 struct vnode *vp, struct label *vlabel,
176 struct label *intlabel);
177 void (*mpo_update_devfsdirent)(struct mount *mp,
178 struct devfs_dirent *devfs_dirent,
179 struct label *direntlabel, struct vnode *vp,
180 struct label *vnodelabel);
181
182 /*
183 * Labeling event operations: IPC objects.
184 */
185 void (*mpo_create_mbuf_from_socket)(struct socket *so,
186 struct label *socketlabel, struct mbuf *m,
187 struct label *mbuflabel);
188 void (*mpo_create_socket)(struct ucred *cred, struct socket *so,
189 struct label *socketlabel);
190 void (*mpo_create_socket_from_socket)(struct socket *oldsocket,
191 struct label *oldsocketlabel, struct socket *newsocket,
192 struct label *newsocketlabel);
193 void (*mpo_relabel_socket)(struct ucred *cred, struct socket *so,
194 struct label *oldlabel, struct label *newlabel);
195 void (*mpo_relabel_pipe)(struct ucred *cred, struct pipe *pipe,
196 struct label *oldlabel, struct label *newlabel);
197 void (*mpo_set_socket_peer_from_mbuf)(struct mbuf *mbuf,
198 struct label *mbuflabel, struct socket *so,
199 struct label *socketpeerlabel);
200 void (*mpo_set_socket_peer_from_socket)(struct socket *oldsocket,
201 struct label *oldsocketlabel, struct socket *newsocket,
202 struct label *newsocketpeerlabel);
203 void (*mpo_create_pipe)(struct ucred *cred, struct pipe *pipe,
204 struct label *pipelabel);
205
206 /*
207 * Labeling event operations: network objects.
208 */
209 void (*mpo_create_bpfdesc)(struct ucred *cred, struct bpf_d *bpf_d,
210 struct label *bpflabel);
211 void (*mpo_create_ifnet)(struct ifnet *ifnet,
212 struct label *ifnetlabel);
213 void (*mpo_create_ipq)(struct mbuf *fragment,
214 struct label *fragmentlabel, struct ipq *ipq,
215 struct label *ipqlabel);
216 void (*mpo_create_datagram_from_ipq)
217 (struct ipq *ipq, struct label *ipqlabel,
218 struct mbuf *datagram, struct label *datagramlabel);
219 void (*mpo_create_fragment)(struct mbuf *datagram,
220 struct label *datagramlabel, struct mbuf *fragment,
221 struct label *fragmentlabel);
222 void (*mpo_create_mbuf_from_mbuf)(struct mbuf *oldmbuf,
223 struct label *oldlabel, struct mbuf *newmbuf,
224 struct label *newlabel);
225 void (*mpo_create_mbuf_linklayer)(struct ifnet *ifnet,
226 struct label *ifnetlabel, struct mbuf *mbuf,
227 struct label *mbuflabel);
228 void (*mpo_create_mbuf_from_bpfdesc)(struct bpf_d *bpf_d,
229 struct label *bpflabel, struct mbuf *mbuf,
230 struct label *mbuflabel);
231 void (*mpo_create_mbuf_from_ifnet)(struct ifnet *ifnet,
232 struct label *ifnetlabel, struct mbuf *mbuf,
233 struct label *mbuflabel);
234 void (*mpo_create_mbuf_multicast_encap)(struct mbuf *oldmbuf,
235 struct label *oldmbuflabel, struct ifnet *ifnet,
236 struct label *ifnetlabel, struct mbuf *newmbuf,
237 struct label *newmbuflabel);
238 void (*mpo_create_mbuf_netlayer)(struct mbuf *oldmbuf,
239 struct label *oldmbuflabel, struct mbuf *newmbuf,
240 struct label *newmbuflabel);
241 int (*mpo_fragment_match)(struct mbuf *fragment,
242 struct label *fragmentlabel, struct ipq *ipq,
243 struct label *ipqlabel);
|
244 void (*mpo_relabel_ifnet)(struct ucred *cred, struct ifnet *ifnet,
245 struct label *ifnetlabel, struct label *newlabel);
246 void (*mpo_update_ipq)(struct mbuf *fragment,
247 struct label *fragmentlabel, struct ipq *ipq,
248 struct label *ipqlabel);
249
250 /*
251 * Labeling event operations: processes.
252 */
253 void (*mpo_create_cred)(struct ucred *parent_cred,
254 struct ucred *child_cred);
255 void (*mpo_execve_transition)(struct ucred *old, struct ucred *new,
256 struct vnode *vp, struct label *vnodelabel,
257 struct label *interpvnodelabel,
258 struct image_params *imgp, struct label *execlabel);
259 int (*mpo_execve_will_transition)(struct ucred *old,
260 struct vnode *vp, struct label *vnodelabel,
261 struct label *interpvnodelabel,
262 struct image_params *imgp, struct label *execlabel);
263 void (*mpo_create_proc0)(struct ucred *cred);
264 void (*mpo_create_proc1)(struct ucred *cred);
265 void (*mpo_relabel_cred)(struct ucred *cred,
266 struct label *newlabel);
267 void (*mpo_thread_userret)(struct thread *thread);
268
269 /*
270 * Access control checks.
271 */
272 int (*mpo_check_bpfdesc_receive)(struct bpf_d *bpf_d,
273 struct label *bpflabel, struct ifnet *ifnet,
274 struct label *ifnetlabel);
275 int (*mpo_check_cred_relabel)(struct ucred *cred,
276 struct label *newlabel);
277 int (*mpo_check_cred_visible)(struct ucred *u1, struct ucred *u2);
278 int (*mpo_check_ifnet_relabel)(struct ucred *cred,
279 struct ifnet *ifnet, struct label *ifnetlabel,
280 struct label *newlabel);
281 int (*mpo_check_ifnet_transmit)(struct ifnet *ifnet,
282 struct label *ifnetlabel, struct mbuf *m,
283 struct label *mbuflabel);
284 int (*mpo_check_kenv_dump)(struct ucred *cred);
285 int (*mpo_check_kenv_get)(struct ucred *cred, char *name);
286 int (*mpo_check_kenv_set)(struct ucred *cred, char *name,
287 char *value);
288 int (*mpo_check_kenv_unset)(struct ucred *cred, char *name);
289 int (*mpo_check_kld_load)(struct ucred *cred, struct vnode *vp,
290 struct label *vlabel);
291 int (*mpo_check_kld_stat)(struct ucred *cred);
292 int (*mpo_check_kld_unload)(struct ucred *cred);
293 int (*mpo_check_mount_stat)(struct ucred *cred, struct mount *mp,
294 struct label *mntlabel);
295 int (*mpo_check_pipe_ioctl)(struct ucred *cred, struct pipe *pipe,
296 struct label *pipelabel, unsigned long cmd, void *data);
297 int (*mpo_check_pipe_poll)(struct ucred *cred, struct pipe *pipe,
298 struct label *pipelabel);
299 int (*mpo_check_pipe_read)(struct ucred *cred, struct pipe *pipe,
300 struct label *pipelabel);
301 int (*mpo_check_pipe_relabel)(struct ucred *cred,
302 struct pipe *pipe, struct label *pipelabel,
303 struct label *newlabel);
304 int (*mpo_check_pipe_stat)(struct ucred *cred, struct pipe *pipe,
305 struct label *pipelabel);
306 int (*mpo_check_pipe_write)(struct ucred *cred, struct pipe *pipe,
307 struct label *pipelabel);
308 int (*mpo_check_proc_debug)(struct ucred *cred,
309 struct proc *proc);
310 int (*mpo_check_proc_sched)(struct ucred *cred,
311 struct proc *proc);
312 int (*mpo_check_proc_signal)(struct ucred *cred,
313 struct proc *proc, int signum);
314 int (*mpo_check_socket_bind)(struct ucred *cred,
315 struct socket *so, struct label *socketlabel,
316 struct sockaddr *sockaddr);
317 int (*mpo_check_socket_connect)(struct ucred *cred,
318 struct socket *so, struct label *socketlabel,
319 struct sockaddr *sockaddr);
320 int (*mpo_check_socket_deliver)(struct socket *so,
321 struct label *socketlabel, struct mbuf *m,
322 struct label *mbuflabel);
323 int (*mpo_check_socket_listen)(struct ucred *cred,
324 struct socket *so, struct label *socketlabel);
325 int (*mpo_check_socket_receive)(struct ucred *cred,
326 struct socket *so, struct label *socketlabel);
327 int (*mpo_check_socket_relabel)(struct ucred *cred,
328 struct socket *so, struct label *socketlabel,
329 struct label *newlabel);
330 int (*mpo_check_socket_send)(struct ucred *cred,
331 struct socket *so, struct label *socketlabel);
332 int (*mpo_check_socket_visible)(struct ucred *cred,
333 struct socket *so, struct label *socketlabel);
334 int (*mpo_check_sysarch_ioperm)(struct ucred *cred);
335 int (*mpo_check_system_acct)(struct ucred *cred,
336 struct vnode *vp, struct label *vlabel);
337 int (*mpo_check_system_nfsd)(struct ucred *cred);
338 int (*mpo_check_system_reboot)(struct ucred *cred, int howto);
339 int (*mpo_check_system_settime)(struct ucred *cred);
340 int (*mpo_check_system_swapon)(struct ucred *cred,
341 struct vnode *vp, struct label *label);
342 int (*mpo_check_system_swapoff)(struct ucred *cred,
343 struct vnode *vp, struct label *label);
344 int (*mpo_check_system_sysctl)(struct ucred *cred, int *name,
345 u_int namelen, void *old, size_t *oldlenp, int inkernel,
346 void *new, size_t newlen);
347 int (*mpo_check_vnode_access)(struct ucred *cred,
348 struct vnode *vp, struct label *label, int acc_mode);
349 int (*mpo_check_vnode_chdir)(struct ucred *cred,
350 struct vnode *dvp, struct label *dlabel);
351 int (*mpo_check_vnode_chroot)(struct ucred *cred,
352 struct vnode *dvp, struct label *dlabel);
353 int (*mpo_check_vnode_create)(struct ucred *cred,
354 struct vnode *dvp, struct label *dlabel,
355 struct componentname *cnp, struct vattr *vap);
356 int (*mpo_check_vnode_delete)(struct ucred *cred,
357 struct vnode *dvp, struct label *dlabel,
358 struct vnode *vp, struct label *label,
359 struct componentname *cnp);
360 int (*mpo_check_vnode_deleteacl)(struct ucred *cred,
361 struct vnode *vp, struct label *label, acl_type_t type);
362 int (*mpo_check_vnode_deleteextattr)(struct ucred *cred,
363 struct vnode *vp, struct label *label, int attrnamespace,
364 const char *name);
365 int (*mpo_check_vnode_exec)(struct ucred *cred, struct vnode *vp,
366 struct label *label, struct image_params *imgp,
367 struct label *execlabel);
368 int (*mpo_check_vnode_getacl)(struct ucred *cred,
369 struct vnode *vp, struct label *label, acl_type_t type);
370 int (*mpo_check_vnode_getextattr)(struct ucred *cred,
371 struct vnode *vp, struct label *label, int attrnamespace,
372 const char *name, struct uio *uio);
373 int (*mpo_check_vnode_link)(struct ucred *cred, struct vnode *dvp,
374 struct label *dlabel, struct vnode *vp,
375 struct label *label, struct componentname *cnp);
376 int (*mpo_check_vnode_listextattr)(struct ucred *cred,
377 struct vnode *vp, struct label *label, int attrnamespace);
378 int (*mpo_check_vnode_lookup)(struct ucred *cred,
379 struct vnode *dvp, struct label *dlabel,
380 struct componentname *cnp);
381 int (*mpo_check_vnode_mmap)(struct ucred *cred, struct vnode *vp,
382 struct label *label, int prot);
383 void (*mpo_check_vnode_mmap_downgrade)(struct ucred *cred,
384 struct vnode *vp, struct label *label, int *prot);
385 int (*mpo_check_vnode_mprotect)(struct ucred *cred,
386 struct vnode *vp, struct label *label, int prot);
387 int (*mpo_check_vnode_open)(struct ucred *cred, struct vnode *vp,
388 struct label *label, int acc_mode);
389 int (*mpo_check_vnode_poll)(struct ucred *active_cred,
390 struct ucred *file_cred, struct vnode *vp,
391 struct label *label);
392 int (*mpo_check_vnode_read)(struct ucred *active_cred,
393 struct ucred *file_cred, struct vnode *vp,
394 struct label *label);
395 int (*mpo_check_vnode_readdir)(struct ucred *cred,
396 struct vnode *dvp, struct label *dlabel);
397 int (*mpo_check_vnode_readlink)(struct ucred *cred,
398 struct vnode *vp, struct label *label);
399 int (*mpo_check_vnode_relabel)(struct ucred *cred,
400 struct vnode *vp, struct label *vnodelabel,
401 struct label *newlabel);
402 int (*mpo_check_vnode_rename_from)(struct ucred *cred,
403 struct vnode *dvp, struct label *dlabel, struct vnode *vp,
404 struct label *label, struct componentname *cnp);
405 int (*mpo_check_vnode_rename_to)(struct ucred *cred,
406 struct vnode *dvp, struct label *dlabel, struct vnode *vp,
407 struct label *label, int samedir,
408 struct componentname *cnp);
409 int (*mpo_check_vnode_revoke)(struct ucred *cred,
410 struct vnode *vp, struct label *label);
411 int (*mpo_check_vnode_setacl)(struct ucred *cred,
412 struct vnode *vp, struct label *label, acl_type_t type,
413 struct acl *acl);
414 int (*mpo_check_vnode_setextattr)(struct ucred *cred,
415 struct vnode *vp, struct label *label, int attrnamespace,
416 const char *name, struct uio *uio);
417 int (*mpo_check_vnode_setflags)(struct ucred *cred,
418 struct vnode *vp, struct label *label, u_long flags);
419 int (*mpo_check_vnode_setmode)(struct ucred *cred,
420 struct vnode *vp, struct label *label, mode_t mode);
421 int (*mpo_check_vnode_setowner)(struct ucred *cred,
422 struct vnode *vp, struct label *label, uid_t uid,
423 gid_t gid);
424 int (*mpo_check_vnode_setutimes)(struct ucred *cred,
425 struct vnode *vp, struct label *label,
426 struct timespec atime, struct timespec mtime);
427 int (*mpo_check_vnode_stat)(struct ucred *active_cred,
428 struct ucred *file_cred, struct vnode *vp,
429 struct label *label);
430 int (*mpo_check_vnode_write)(struct ucred *active_cred,
431 struct ucred *file_cred, struct vnode *vp,
432 struct label *label);
433};
434
435struct mac_policy_conf {
436 char *mpc_name; /* policy name */
437 char *mpc_fullname; /* policy full name */
438 struct mac_policy_ops *mpc_ops; /* policy operations */
439 int mpc_loadtime_flags; /* flags */
440 int *mpc_field_off; /* security field */
441 int mpc_runtime_flags; /* flags */
442 LIST_ENTRY(mac_policy_conf) mpc_list; /* global list */
443};
444
445/* Flags for the mpc_loadtime_flags field. */
446#define MPC_LOADTIME_FLAG_NOTLATE 0x00000001
447#define MPC_LOADTIME_FLAG_UNLOADOK 0x00000002
448#define MPC_LOADTIME_FLAG_LABELMBUFS 0x00000004
449
450/* Flags for the mpc_runtime_flags field. */
451#define MPC_RUNTIME_FLAG_REGISTERED 0x00000001
452
453#define MAC_POLICY_SET(mpops, mpname, mpfullname, mpflags, privdata_wanted) \
454 static struct mac_policy_conf mpname##_mac_policy_conf = { \
455 #mpname, \
456 mpfullname, \
457 mpops, \
458 mpflags, \
459 privdata_wanted, \
460 0, \
461 }; \
462 static moduledata_t mpname##_mod = { \
463 #mpname, \
464 mac_policy_modevent, \
465 &mpname##_mac_policy_conf \
466 }; \
467 MODULE_DEPEND(mpname, kernel_mac_support, 1, 1, 1); \
468 DECLARE_MODULE(mpname, mpname##_mod, SI_SUB_MAC_POLICY, \
469 SI_ORDER_MIDDLE)
470
471int mac_policy_modevent(module_t mod, int type, void *data);
472
473#define LABEL_TO_SLOT(l, s) (l)->l_perpolicy[s]
474
475#endif /* !_SYS_MAC_POLICY_H */
| 247 void (*mpo_relabel_ifnet)(struct ucred *cred, struct ifnet *ifnet,
248 struct label *ifnetlabel, struct label *newlabel);
249 void (*mpo_update_ipq)(struct mbuf *fragment,
250 struct label *fragmentlabel, struct ipq *ipq,
251 struct label *ipqlabel);
252
253 /*
254 * Labeling event operations: processes.
255 */
256 void (*mpo_create_cred)(struct ucred *parent_cred,
257 struct ucred *child_cred);
258 void (*mpo_execve_transition)(struct ucred *old, struct ucred *new,
259 struct vnode *vp, struct label *vnodelabel,
260 struct label *interpvnodelabel,
261 struct image_params *imgp, struct label *execlabel);
262 int (*mpo_execve_will_transition)(struct ucred *old,
263 struct vnode *vp, struct label *vnodelabel,
264 struct label *interpvnodelabel,
265 struct image_params *imgp, struct label *execlabel);
266 void (*mpo_create_proc0)(struct ucred *cred);
267 void (*mpo_create_proc1)(struct ucred *cred);
268 void (*mpo_relabel_cred)(struct ucred *cred,
269 struct label *newlabel);
270 void (*mpo_thread_userret)(struct thread *thread);
271
272 /*
273 * Access control checks.
274 */
275 int (*mpo_check_bpfdesc_receive)(struct bpf_d *bpf_d,
276 struct label *bpflabel, struct ifnet *ifnet,
277 struct label *ifnetlabel);
278 int (*mpo_check_cred_relabel)(struct ucred *cred,
279 struct label *newlabel);
280 int (*mpo_check_cred_visible)(struct ucred *u1, struct ucred *u2);
281 int (*mpo_check_ifnet_relabel)(struct ucred *cred,
282 struct ifnet *ifnet, struct label *ifnetlabel,
283 struct label *newlabel);
284 int (*mpo_check_ifnet_transmit)(struct ifnet *ifnet,
285 struct label *ifnetlabel, struct mbuf *m,
286 struct label *mbuflabel);
287 int (*mpo_check_kenv_dump)(struct ucred *cred);
288 int (*mpo_check_kenv_get)(struct ucred *cred, char *name);
289 int (*mpo_check_kenv_set)(struct ucred *cred, char *name,
290 char *value);
291 int (*mpo_check_kenv_unset)(struct ucred *cred, char *name);
292 int (*mpo_check_kld_load)(struct ucred *cred, struct vnode *vp,
293 struct label *vlabel);
294 int (*mpo_check_kld_stat)(struct ucred *cred);
295 int (*mpo_check_kld_unload)(struct ucred *cred);
296 int (*mpo_check_mount_stat)(struct ucred *cred, struct mount *mp,
297 struct label *mntlabel);
298 int (*mpo_check_pipe_ioctl)(struct ucred *cred, struct pipe *pipe,
299 struct label *pipelabel, unsigned long cmd, void *data);
300 int (*mpo_check_pipe_poll)(struct ucred *cred, struct pipe *pipe,
301 struct label *pipelabel);
302 int (*mpo_check_pipe_read)(struct ucred *cred, struct pipe *pipe,
303 struct label *pipelabel);
304 int (*mpo_check_pipe_relabel)(struct ucred *cred,
305 struct pipe *pipe, struct label *pipelabel,
306 struct label *newlabel);
307 int (*mpo_check_pipe_stat)(struct ucred *cred, struct pipe *pipe,
308 struct label *pipelabel);
309 int (*mpo_check_pipe_write)(struct ucred *cred, struct pipe *pipe,
310 struct label *pipelabel);
311 int (*mpo_check_proc_debug)(struct ucred *cred,
312 struct proc *proc);
313 int (*mpo_check_proc_sched)(struct ucred *cred,
314 struct proc *proc);
315 int (*mpo_check_proc_signal)(struct ucred *cred,
316 struct proc *proc, int signum);
317 int (*mpo_check_socket_bind)(struct ucred *cred,
318 struct socket *so, struct label *socketlabel,
319 struct sockaddr *sockaddr);
320 int (*mpo_check_socket_connect)(struct ucred *cred,
321 struct socket *so, struct label *socketlabel,
322 struct sockaddr *sockaddr);
323 int (*mpo_check_socket_deliver)(struct socket *so,
324 struct label *socketlabel, struct mbuf *m,
325 struct label *mbuflabel);
326 int (*mpo_check_socket_listen)(struct ucred *cred,
327 struct socket *so, struct label *socketlabel);
328 int (*mpo_check_socket_receive)(struct ucred *cred,
329 struct socket *so, struct label *socketlabel);
330 int (*mpo_check_socket_relabel)(struct ucred *cred,
331 struct socket *so, struct label *socketlabel,
332 struct label *newlabel);
333 int (*mpo_check_socket_send)(struct ucred *cred,
334 struct socket *so, struct label *socketlabel);
335 int (*mpo_check_socket_visible)(struct ucred *cred,
336 struct socket *so, struct label *socketlabel);
337 int (*mpo_check_sysarch_ioperm)(struct ucred *cred);
338 int (*mpo_check_system_acct)(struct ucred *cred,
339 struct vnode *vp, struct label *vlabel);
340 int (*mpo_check_system_nfsd)(struct ucred *cred);
341 int (*mpo_check_system_reboot)(struct ucred *cred, int howto);
342 int (*mpo_check_system_settime)(struct ucred *cred);
343 int (*mpo_check_system_swapon)(struct ucred *cred,
344 struct vnode *vp, struct label *label);
345 int (*mpo_check_system_swapoff)(struct ucred *cred,
346 struct vnode *vp, struct label *label);
347 int (*mpo_check_system_sysctl)(struct ucred *cred, int *name,
348 u_int namelen, void *old, size_t *oldlenp, int inkernel,
349 void *new, size_t newlen);
350 int (*mpo_check_vnode_access)(struct ucred *cred,
351 struct vnode *vp, struct label *label, int acc_mode);
352 int (*mpo_check_vnode_chdir)(struct ucred *cred,
353 struct vnode *dvp, struct label *dlabel);
354 int (*mpo_check_vnode_chroot)(struct ucred *cred,
355 struct vnode *dvp, struct label *dlabel);
356 int (*mpo_check_vnode_create)(struct ucred *cred,
357 struct vnode *dvp, struct label *dlabel,
358 struct componentname *cnp, struct vattr *vap);
359 int (*mpo_check_vnode_delete)(struct ucred *cred,
360 struct vnode *dvp, struct label *dlabel,
361 struct vnode *vp, struct label *label,
362 struct componentname *cnp);
363 int (*mpo_check_vnode_deleteacl)(struct ucred *cred,
364 struct vnode *vp, struct label *label, acl_type_t type);
365 int (*mpo_check_vnode_deleteextattr)(struct ucred *cred,
366 struct vnode *vp, struct label *label, int attrnamespace,
367 const char *name);
368 int (*mpo_check_vnode_exec)(struct ucred *cred, struct vnode *vp,
369 struct label *label, struct image_params *imgp,
370 struct label *execlabel);
371 int (*mpo_check_vnode_getacl)(struct ucred *cred,
372 struct vnode *vp, struct label *label, acl_type_t type);
373 int (*mpo_check_vnode_getextattr)(struct ucred *cred,
374 struct vnode *vp, struct label *label, int attrnamespace,
375 const char *name, struct uio *uio);
376 int (*mpo_check_vnode_link)(struct ucred *cred, struct vnode *dvp,
377 struct label *dlabel, struct vnode *vp,
378 struct label *label, struct componentname *cnp);
379 int (*mpo_check_vnode_listextattr)(struct ucred *cred,
380 struct vnode *vp, struct label *label, int attrnamespace);
381 int (*mpo_check_vnode_lookup)(struct ucred *cred,
382 struct vnode *dvp, struct label *dlabel,
383 struct componentname *cnp);
384 int (*mpo_check_vnode_mmap)(struct ucred *cred, struct vnode *vp,
385 struct label *label, int prot);
386 void (*mpo_check_vnode_mmap_downgrade)(struct ucred *cred,
387 struct vnode *vp, struct label *label, int *prot);
388 int (*mpo_check_vnode_mprotect)(struct ucred *cred,
389 struct vnode *vp, struct label *label, int prot);
390 int (*mpo_check_vnode_open)(struct ucred *cred, struct vnode *vp,
391 struct label *label, int acc_mode);
392 int (*mpo_check_vnode_poll)(struct ucred *active_cred,
393 struct ucred *file_cred, struct vnode *vp,
394 struct label *label);
395 int (*mpo_check_vnode_read)(struct ucred *active_cred,
396 struct ucred *file_cred, struct vnode *vp,
397 struct label *label);
398 int (*mpo_check_vnode_readdir)(struct ucred *cred,
399 struct vnode *dvp, struct label *dlabel);
400 int (*mpo_check_vnode_readlink)(struct ucred *cred,
401 struct vnode *vp, struct label *label);
402 int (*mpo_check_vnode_relabel)(struct ucred *cred,
403 struct vnode *vp, struct label *vnodelabel,
404 struct label *newlabel);
405 int (*mpo_check_vnode_rename_from)(struct ucred *cred,
406 struct vnode *dvp, struct label *dlabel, struct vnode *vp,
407 struct label *label, struct componentname *cnp);
408 int (*mpo_check_vnode_rename_to)(struct ucred *cred,
409 struct vnode *dvp, struct label *dlabel, struct vnode *vp,
410 struct label *label, int samedir,
411 struct componentname *cnp);
412 int (*mpo_check_vnode_revoke)(struct ucred *cred,
413 struct vnode *vp, struct label *label);
414 int (*mpo_check_vnode_setacl)(struct ucred *cred,
415 struct vnode *vp, struct label *label, acl_type_t type,
416 struct acl *acl);
417 int (*mpo_check_vnode_setextattr)(struct ucred *cred,
418 struct vnode *vp, struct label *label, int attrnamespace,
419 const char *name, struct uio *uio);
420 int (*mpo_check_vnode_setflags)(struct ucred *cred,
421 struct vnode *vp, struct label *label, u_long flags);
422 int (*mpo_check_vnode_setmode)(struct ucred *cred,
423 struct vnode *vp, struct label *label, mode_t mode);
424 int (*mpo_check_vnode_setowner)(struct ucred *cred,
425 struct vnode *vp, struct label *label, uid_t uid,
426 gid_t gid);
427 int (*mpo_check_vnode_setutimes)(struct ucred *cred,
428 struct vnode *vp, struct label *label,
429 struct timespec atime, struct timespec mtime);
430 int (*mpo_check_vnode_stat)(struct ucred *active_cred,
431 struct ucred *file_cred, struct vnode *vp,
432 struct label *label);
433 int (*mpo_check_vnode_write)(struct ucred *active_cred,
434 struct ucred *file_cred, struct vnode *vp,
435 struct label *label);
436};
437
438struct mac_policy_conf {
439 char *mpc_name; /* policy name */
440 char *mpc_fullname; /* policy full name */
441 struct mac_policy_ops *mpc_ops; /* policy operations */
442 int mpc_loadtime_flags; /* flags */
443 int *mpc_field_off; /* security field */
444 int mpc_runtime_flags; /* flags */
445 LIST_ENTRY(mac_policy_conf) mpc_list; /* global list */
446};
447
448/* Flags for the mpc_loadtime_flags field. */
449#define MPC_LOADTIME_FLAG_NOTLATE 0x00000001
450#define MPC_LOADTIME_FLAG_UNLOADOK 0x00000002
451#define MPC_LOADTIME_FLAG_LABELMBUFS 0x00000004
452
453/* Flags for the mpc_runtime_flags field. */
454#define MPC_RUNTIME_FLAG_REGISTERED 0x00000001
455
456#define MAC_POLICY_SET(mpops, mpname, mpfullname, mpflags, privdata_wanted) \
457 static struct mac_policy_conf mpname##_mac_policy_conf = { \
458 #mpname, \
459 mpfullname, \
460 mpops, \
461 mpflags, \
462 privdata_wanted, \
463 0, \
464 }; \
465 static moduledata_t mpname##_mod = { \
466 #mpname, \
467 mac_policy_modevent, \
468 &mpname##_mac_policy_conf \
469 }; \
470 MODULE_DEPEND(mpname, kernel_mac_support, 1, 1, 1); \
471 DECLARE_MODULE(mpname, mpname##_mod, SI_SUB_MAC_POLICY, \
472 SI_ORDER_MIDDLE)
473
474int mac_policy_modevent(module_t mod, int type, void *data);
475
476#define LABEL_TO_SLOT(l, s) (l)->l_perpolicy[s]
477
478#endif /* !_SYS_MAC_POLICY_H */
|