41 */
42
43/*
44 * Developed by the TrustedBSD Project.
45 *
46 * "BSD Extended" MAC policy, allowing the administrator to impose mandatory
47 * firewall-like rules regarding users and file system objects.
48 */
49
50#include <sys/param.h>
51#include <sys/acl.h>
52#include <sys/kernel.h>
53#include <sys/jail.h>
54#include <sys/lock.h>
55#include <sys/malloc.h>
56#include <sys/module.h>
57#include <sys/mount.h>
58#include <sys/mutex.h>
59#include <sys/priv.h>
60#include <sys/systm.h>
61#include <sys/vnode.h>
62#include <sys/sysctl.h>
63#include <sys/syslog.h>
64
65#include <security/mac/mac_policy.h>
66#include <security/mac_bsdextended/mac_bsdextended.h>
67
68static struct mtx ugidfw_mtx;
69
70SYSCTL_DECL(_security_mac);
71
72SYSCTL_NODE(_security_mac, OID_AUTO, bsdextended, CTLFLAG_RW, 0,
73 "TrustedBSD extended BSD MAC policy controls");
74
75static int ugidfw_enabled = 1;
76SYSCTL_INT(_security_mac_bsdextended, OID_AUTO, enabled, CTLFLAG_RW,
77 &ugidfw_enabled, 0, "Enforce extended BSD policy");
78TUNABLE_INT("security.mac.bsdextended.enabled", &ugidfw_enabled);
79
80MALLOC_DEFINE(M_MACBSDEXTENDED, "mac_bsdextended", "BSD Extended MAC rule");
81
82#define MAC_BSDEXTENDED_MAXRULES 250
83static struct mac_bsdextended_rule *rules[MAC_BSDEXTENDED_MAXRULES];
84static int rule_count = 0;
85static int rule_slots = 0;
86static int rule_version = MB_VERSION;
87
88SYSCTL_INT(_security_mac_bsdextended, OID_AUTO, rule_count, CTLFLAG_RD,
89 &rule_count, 0, "Number of defined rules\n");
90SYSCTL_INT(_security_mac_bsdextended, OID_AUTO, rule_slots, CTLFLAG_RD,
91 &rule_slots, 0, "Number of used rule slots\n");
92SYSCTL_INT(_security_mac_bsdextended, OID_AUTO, rule_version, CTLFLAG_RD,
93 &rule_version, 0, "Version number for API\n");
94
95/*
96 * This is just used for logging purposes, eventually we would like to log
97 * much more then failed requests.
98 */
99static int ugidfw_logging;
100SYSCTL_INT(_security_mac_bsdextended, OID_AUTO, logging, CTLFLAG_RW,
101 &ugidfw_logging, 0, "Log failed authorization requests");
102
103/*
104 * This tunable is here for compatibility. It will allow the user to switch
105 * between the new mode (first rule matches) and the old functionality (all
106 * rules match).
107 */
108static int ugidfw_firstmatch_enabled;
109SYSCTL_INT(_security_mac_bsdextended, OID_AUTO, firstmatch_enabled,
110 CTLFLAG_RW, &ugidfw_firstmatch_enabled, 1,
111 "Disable/enable match first rule functionality");
112
113static int
114ugidfw_rule_valid(struct mac_bsdextended_rule *rule)
115{
116
117 if ((rule->mbr_subject.mbs_flags | MBS_ALL_FLAGS) != MBS_ALL_FLAGS)
118 return (EINVAL);
119 if ((rule->mbr_subject.mbs_neg | MBS_ALL_FLAGS) != MBS_ALL_FLAGS)
120 return (EINVAL);
121 if ((rule->mbr_object.mbo_flags | MBO_ALL_FLAGS) != MBO_ALL_FLAGS)
122 return (EINVAL);
123 if ((rule->mbr_object.mbo_neg | MBO_ALL_FLAGS) != MBO_ALL_FLAGS)
124 return (EINVAL);
125 if ((rule->mbr_object.mbo_neg | MBO_TYPE_DEFINED) &&
126 (rule->mbr_object.mbo_type | MBO_ALL_TYPE) != MBO_ALL_TYPE)
127 return (EINVAL);
128 if ((rule->mbr_mode | MBI_ALLPERM) != MBI_ALLPERM)
129 return (EINVAL);
130 return (0);
131}
132
133static int
134sysctl_rule(SYSCTL_HANDLER_ARGS)
135{
136 struct mac_bsdextended_rule temprule, *ruleptr;
137 u_int namelen;
138 int error, index, *name;
139
140 error = 0;
141 name = (int *)arg1;
142 namelen = arg2;
143 if (namelen != 1)
144 return (EINVAL);
145 index = name[0];
146 if (index >= MAC_BSDEXTENDED_MAXRULES)
147 return (ENOENT);
148
149 ruleptr = NULL;
150 if (req->newptr && req->newlen != 0) {
151 error = SYSCTL_IN(req, &temprule, sizeof(temprule));
152 if (error)
153 return (error);
154 MALLOC(ruleptr, struct mac_bsdextended_rule *,
155 sizeof(*ruleptr), M_MACBSDEXTENDED, M_WAITOK | M_ZERO);
156 }
157
158 mtx_lock(&ugidfw_mtx);
159 if (req->oldptr) {
160 if (index < 0 || index > rule_slots + 1) {
161 error = ENOENT;
162 goto out;
163 }
164 if (rules[index] == NULL) {
165 error = ENOENT;
166 goto out;
167 }
168 temprule = *rules[index];
169 }
170 if (req->newptr && req->newlen == 0) {
171 KASSERT(ruleptr == NULL, ("sysctl_rule: ruleptr != NULL"));
172 ruleptr = rules[index];
173 if (ruleptr == NULL) {
174 error = ENOENT;
175 goto out;
176 }
177 rule_count--;
178 rules[index] = NULL;
179 } else if (req->newptr) {
180 error = ugidfw_rule_valid(&temprule);
181 if (error)
182 goto out;
183 if (rules[index] == NULL) {
184 *ruleptr = temprule;
185 rules[index] = ruleptr;
186 ruleptr = NULL;
187 if (index + 1 > rule_slots)
188 rule_slots = index + 1;
189 rule_count++;
190 } else
191 *rules[index] = temprule;
192 }
193out:
194 mtx_unlock(&ugidfw_mtx);
195 if (ruleptr != NULL)
196 FREE(ruleptr, M_MACBSDEXTENDED);
197 if (req->oldptr && error == 0)
198 error = SYSCTL_OUT(req, &temprule, sizeof(temprule));
199 return (error);
200}
201
202SYSCTL_NODE(_security_mac_bsdextended, OID_AUTO, rules, CTLFLAG_RW,
203 sysctl_rule, "BSD extended MAC rules");
204
205static void
206ugidfw_init(struct mac_policy_conf *mpc)
207{
208
209 mtx_init(&ugidfw_mtx, "mac_bsdextended lock", NULL, MTX_DEF);
210}
211
212static void
213ugidfw_destroy(struct mac_policy_conf *mpc)
214{
215
216 mtx_destroy(&ugidfw_mtx);
217}
218
219static int
220ugidfw_rulecheck(struct mac_bsdextended_rule *rule,
221 struct ucred *cred, struct vnode *vp, struct vattr *vap, int acc_mode)
222{
223 int match;
224 int i;
225
226 /*
227 * Is there a subject match?
228 */
229 mtx_assert(&ugidfw_mtx, MA_OWNED);
230 if (rule->mbr_subject.mbs_flags & MBS_UID_DEFINED) {
231 match = ((cred->cr_uid <= rule->mbr_subject.mbs_uid_max &&
232 cred->cr_uid >= rule->mbr_subject.mbs_uid_min) ||
233 (cred->cr_ruid <= rule->mbr_subject.mbs_uid_max &&
234 cred->cr_ruid >= rule->mbr_subject.mbs_uid_min) ||
235 (cred->cr_svuid <= rule->mbr_subject.mbs_uid_max &&
236 cred->cr_svuid >= rule->mbr_subject.mbs_uid_min));
237 if (rule->mbr_subject.mbs_neg & MBS_UID_DEFINED)
238 match = !match;
239 if (!match)
240 return (0);
241 }
242
243 if (rule->mbr_subject.mbs_flags & MBS_GID_DEFINED) {
244 match = ((cred->cr_rgid <= rule->mbr_subject.mbs_gid_max &&
245 cred->cr_rgid >= rule->mbr_subject.mbs_gid_min) ||
246 (cred->cr_svgid <= rule->mbr_subject.mbs_gid_max &&
247 cred->cr_svgid >= rule->mbr_subject.mbs_gid_min));
248 if (!match) {
249 for (i = 0; i < cred->cr_ngroups; i++) {
250 if (cred->cr_groups[i]
251 <= rule->mbr_subject.mbs_gid_max &&
252 cred->cr_groups[i]
253 >= rule->mbr_subject.mbs_gid_min) {
254 match = 1;
255 break;
256 }
257 }
258 }
259 if (rule->mbr_subject.mbs_neg & MBS_GID_DEFINED)
260 match = !match;
261 if (!match)
262 return (0);
263 }
264
265 if (rule->mbr_subject.mbs_flags & MBS_PRISON_DEFINED) {
266 match = (cred->cr_prison != NULL &&
267 cred->cr_prison->pr_id == rule->mbr_subject.mbs_prison);
268 if (rule->mbr_subject.mbs_neg & MBS_PRISON_DEFINED)
269 match = !match;
270 if (!match)
271 return (0);
272 }
273
274 /*
275 * Is there an object match?
276 */
277 if (rule->mbr_object.mbo_flags & MBO_UID_DEFINED) {
278 match = (vap->va_uid <= rule->mbr_object.mbo_uid_max &&
279 vap->va_uid >= rule->mbr_object.mbo_uid_min);
280 if (rule->mbr_object.mbo_neg & MBO_UID_DEFINED)
281 match = !match;
282 if (!match)
283 return (0);
284 }
285
286 if (rule->mbr_object.mbo_flags & MBO_GID_DEFINED) {
287 match = (vap->va_gid <= rule->mbr_object.mbo_gid_max &&
288 vap->va_gid >= rule->mbr_object.mbo_gid_min);
289 if (rule->mbr_object.mbo_neg & MBO_GID_DEFINED)
290 match = !match;
291 if (!match)
292 return (0);
293 }
294
295 if (rule->mbr_object.mbo_flags & MBO_FSID_DEFINED) {
296 match = (bcmp(&(vp->v_mount->mnt_stat.f_fsid),
297 &(rule->mbr_object.mbo_fsid),
298 sizeof(rule->mbr_object.mbo_fsid)) == 0);
299 if (rule->mbr_object.mbo_neg & MBO_FSID_DEFINED)
300 match = !match;
301 if (!match)
302 return (0);
303 }
304
305 if (rule->mbr_object.mbo_flags & MBO_SUID) {
306 match = (vap->va_mode & VSUID);
307 if (rule->mbr_object.mbo_neg & MBO_SUID)
308 match = !match;
309 if (!match)
310 return (0);
311 }
312
313 if (rule->mbr_object.mbo_flags & MBO_SGID) {
314 match = (vap->va_mode & VSGID);
315 if (rule->mbr_object.mbo_neg & MBO_SGID)
316 match = !match;
317 if (!match)
318 return (0);
319 }
320
321 if (rule->mbr_object.mbo_flags & MBO_UID_SUBJECT) {
322 match = (vap->va_uid == cred->cr_uid ||
323 vap->va_uid == cred->cr_ruid ||
324 vap->va_uid == cred->cr_svuid);
325 if (rule->mbr_object.mbo_neg & MBO_UID_SUBJECT)
326 match = !match;
327 if (!match)
328 return (0);
329 }
330
331 if (rule->mbr_object.mbo_flags & MBO_GID_SUBJECT) {
332 match = (groupmember(vap->va_gid, cred) ||
333 vap->va_gid == cred->cr_rgid ||
334 vap->va_gid == cred->cr_svgid);
335 if (rule->mbr_object.mbo_neg & MBO_GID_SUBJECT)
336 match = !match;
337 if (!match)
338 return (0);
339 }
340
341 if (rule->mbr_object.mbo_flags & MBO_TYPE_DEFINED) {
342 switch (vap->va_type) {
343 case VREG:
344 match = (rule->mbr_object.mbo_type & MBO_TYPE_REG);
345 break;
346 case VDIR:
347 match = (rule->mbr_object.mbo_type & MBO_TYPE_DIR);
348 break;
349 case VBLK:
350 match = (rule->mbr_object.mbo_type & MBO_TYPE_BLK);
351 break;
352 case VCHR:
353 match = (rule->mbr_object.mbo_type & MBO_TYPE_CHR);
354 break;
355 case VLNK:
356 match = (rule->mbr_object.mbo_type & MBO_TYPE_LNK);
357 break;
358 case VSOCK:
359 match = (rule->mbr_object.mbo_type & MBO_TYPE_SOCK);
360 break;
361 case VFIFO:
362 match = (rule->mbr_object.mbo_type & MBO_TYPE_FIFO);
363 break;
364 default:
365 match = 0;
366 }
367 if (rule->mbr_object.mbo_neg & MBO_TYPE_DEFINED)
368 match = !match;
369 if (!match)
370 return (0);
371 }
372
373 /*
374 * Is the access permitted?
375 */
376 if ((rule->mbr_mode & acc_mode) != acc_mode) {
377 if (ugidfw_logging)
378 log(LOG_AUTHPRIV, "mac_bsdextended: %d:%d request %d"
379 " on %d:%d failed. \n", cred->cr_ruid,
380 cred->cr_rgid, acc_mode, vap->va_uid,
381 vap->va_gid);
382 return (EACCES);
383 }
384
385 /*
386 * If the rule matched, permits access, and first match is enabled,
387 * return success.
388 */
389 if (ugidfw_firstmatch_enabled)
390 return (EJUSTRETURN);
391 else
392 return (0);
393}
394
395static int
396ugidfw_check(struct ucred *cred, struct vnode *vp, struct vattr *vap,
397 int acc_mode)
398{
399 int error, i;
400
401 /*
402 * XXXRW: More specific privilege selection needed.
403 */
404 if (suser_cred(cred, 0) == 0)
405 return (0);
406
407 /*
408 * Since we do not separately handle append, map append to write.
409 */
410 if (acc_mode & MBI_APPEND) {
411 acc_mode &= ~MBI_APPEND;
412 acc_mode |= MBI_WRITE;
413 }
414 mtx_lock(&ugidfw_mtx);
415 for (i = 0; i < rule_slots; i++) {
416 if (rules[i] == NULL)
417 continue;
418 error = ugidfw_rulecheck(rules[i], cred,
419 vp, vap, acc_mode);
420 if (error == EJUSTRETURN)
421 break;
422 if (error) {
423 mtx_unlock(&ugidfw_mtx);
424 return (error);
425 }
426 }
427 mtx_unlock(&ugidfw_mtx);
428 return (0);
429}
430
431static int
432ugidfw_check_vp(struct ucred *cred, struct vnode *vp, int acc_mode)
433{
434 int error;
435 struct vattr vap;
436
437 if (!ugidfw_enabled)
438 return (0);
439 error = VOP_GETATTR(vp, &vap, cred, curthread);
440 if (error)
441 return (error);
442 return (ugidfw_check(cred, vp, &vap, acc_mode));
443}
444
| 41 */
42
43/*
44 * Developed by the TrustedBSD Project.
45 *
46 * "BSD Extended" MAC policy, allowing the administrator to impose mandatory
47 * firewall-like rules regarding users and file system objects.
48 */
49
50#include <sys/param.h>
51#include <sys/acl.h>
52#include <sys/kernel.h>
53#include <sys/jail.h>
54#include <sys/lock.h>
55#include <sys/malloc.h>
56#include <sys/module.h>
57#include <sys/mount.h>
58#include <sys/mutex.h>
59#include <sys/priv.h>
60#include <sys/systm.h>
61#include <sys/vnode.h>
62#include <sys/sysctl.h>
63#include <sys/syslog.h>
64
65#include <security/mac/mac_policy.h>
66#include <security/mac_bsdextended/mac_bsdextended.h>
67
68static struct mtx ugidfw_mtx;
69
70SYSCTL_DECL(_security_mac);
71
72SYSCTL_NODE(_security_mac, OID_AUTO, bsdextended, CTLFLAG_RW, 0,
73 "TrustedBSD extended BSD MAC policy controls");
74
75static int ugidfw_enabled = 1;
76SYSCTL_INT(_security_mac_bsdextended, OID_AUTO, enabled, CTLFLAG_RW,
77 &ugidfw_enabled, 0, "Enforce extended BSD policy");
78TUNABLE_INT("security.mac.bsdextended.enabled", &ugidfw_enabled);
79
80MALLOC_DEFINE(M_MACBSDEXTENDED, "mac_bsdextended", "BSD Extended MAC rule");
81
82#define MAC_BSDEXTENDED_MAXRULES 250
83static struct mac_bsdextended_rule *rules[MAC_BSDEXTENDED_MAXRULES];
84static int rule_count = 0;
85static int rule_slots = 0;
86static int rule_version = MB_VERSION;
87
88SYSCTL_INT(_security_mac_bsdextended, OID_AUTO, rule_count, CTLFLAG_RD,
89 &rule_count, 0, "Number of defined rules\n");
90SYSCTL_INT(_security_mac_bsdextended, OID_AUTO, rule_slots, CTLFLAG_RD,
91 &rule_slots, 0, "Number of used rule slots\n");
92SYSCTL_INT(_security_mac_bsdextended, OID_AUTO, rule_version, CTLFLAG_RD,
93 &rule_version, 0, "Version number for API\n");
94
95/*
96 * This is just used for logging purposes, eventually we would like to log
97 * much more then failed requests.
98 */
99static int ugidfw_logging;
100SYSCTL_INT(_security_mac_bsdextended, OID_AUTO, logging, CTLFLAG_RW,
101 &ugidfw_logging, 0, "Log failed authorization requests");
102
103/*
104 * This tunable is here for compatibility. It will allow the user to switch
105 * between the new mode (first rule matches) and the old functionality (all
106 * rules match).
107 */
108static int ugidfw_firstmatch_enabled;
109SYSCTL_INT(_security_mac_bsdextended, OID_AUTO, firstmatch_enabled,
110 CTLFLAG_RW, &ugidfw_firstmatch_enabled, 1,
111 "Disable/enable match first rule functionality");
112
113static int
114ugidfw_rule_valid(struct mac_bsdextended_rule *rule)
115{
116
117 if ((rule->mbr_subject.mbs_flags | MBS_ALL_FLAGS) != MBS_ALL_FLAGS)
118 return (EINVAL);
119 if ((rule->mbr_subject.mbs_neg | MBS_ALL_FLAGS) != MBS_ALL_FLAGS)
120 return (EINVAL);
121 if ((rule->mbr_object.mbo_flags | MBO_ALL_FLAGS) != MBO_ALL_FLAGS)
122 return (EINVAL);
123 if ((rule->mbr_object.mbo_neg | MBO_ALL_FLAGS) != MBO_ALL_FLAGS)
124 return (EINVAL);
125 if ((rule->mbr_object.mbo_neg | MBO_TYPE_DEFINED) &&
126 (rule->mbr_object.mbo_type | MBO_ALL_TYPE) != MBO_ALL_TYPE)
127 return (EINVAL);
128 if ((rule->mbr_mode | MBI_ALLPERM) != MBI_ALLPERM)
129 return (EINVAL);
130 return (0);
131}
132
133static int
134sysctl_rule(SYSCTL_HANDLER_ARGS)
135{
136 struct mac_bsdextended_rule temprule, *ruleptr;
137 u_int namelen;
138 int error, index, *name;
139
140 error = 0;
141 name = (int *)arg1;
142 namelen = arg2;
143 if (namelen != 1)
144 return (EINVAL);
145 index = name[0];
146 if (index >= MAC_BSDEXTENDED_MAXRULES)
147 return (ENOENT);
148
149 ruleptr = NULL;
150 if (req->newptr && req->newlen != 0) {
151 error = SYSCTL_IN(req, &temprule, sizeof(temprule));
152 if (error)
153 return (error);
154 MALLOC(ruleptr, struct mac_bsdextended_rule *,
155 sizeof(*ruleptr), M_MACBSDEXTENDED, M_WAITOK | M_ZERO);
156 }
157
158 mtx_lock(&ugidfw_mtx);
159 if (req->oldptr) {
160 if (index < 0 || index > rule_slots + 1) {
161 error = ENOENT;
162 goto out;
163 }
164 if (rules[index] == NULL) {
165 error = ENOENT;
166 goto out;
167 }
168 temprule = *rules[index];
169 }
170 if (req->newptr && req->newlen == 0) {
171 KASSERT(ruleptr == NULL, ("sysctl_rule: ruleptr != NULL"));
172 ruleptr = rules[index];
173 if (ruleptr == NULL) {
174 error = ENOENT;
175 goto out;
176 }
177 rule_count--;
178 rules[index] = NULL;
179 } else if (req->newptr) {
180 error = ugidfw_rule_valid(&temprule);
181 if (error)
182 goto out;
183 if (rules[index] == NULL) {
184 *ruleptr = temprule;
185 rules[index] = ruleptr;
186 ruleptr = NULL;
187 if (index + 1 > rule_slots)
188 rule_slots = index + 1;
189 rule_count++;
190 } else
191 *rules[index] = temprule;
192 }
193out:
194 mtx_unlock(&ugidfw_mtx);
195 if (ruleptr != NULL)
196 FREE(ruleptr, M_MACBSDEXTENDED);
197 if (req->oldptr && error == 0)
198 error = SYSCTL_OUT(req, &temprule, sizeof(temprule));
199 return (error);
200}
201
202SYSCTL_NODE(_security_mac_bsdextended, OID_AUTO, rules, CTLFLAG_RW,
203 sysctl_rule, "BSD extended MAC rules");
204
205static void
206ugidfw_init(struct mac_policy_conf *mpc)
207{
208
209 mtx_init(&ugidfw_mtx, "mac_bsdextended lock", NULL, MTX_DEF);
210}
211
212static void
213ugidfw_destroy(struct mac_policy_conf *mpc)
214{
215
216 mtx_destroy(&ugidfw_mtx);
217}
218
219static int
220ugidfw_rulecheck(struct mac_bsdextended_rule *rule,
221 struct ucred *cred, struct vnode *vp, struct vattr *vap, int acc_mode)
222{
223 int match;
224 int i;
225
226 /*
227 * Is there a subject match?
228 */
229 mtx_assert(&ugidfw_mtx, MA_OWNED);
230 if (rule->mbr_subject.mbs_flags & MBS_UID_DEFINED) {
231 match = ((cred->cr_uid <= rule->mbr_subject.mbs_uid_max &&
232 cred->cr_uid >= rule->mbr_subject.mbs_uid_min) ||
233 (cred->cr_ruid <= rule->mbr_subject.mbs_uid_max &&
234 cred->cr_ruid >= rule->mbr_subject.mbs_uid_min) ||
235 (cred->cr_svuid <= rule->mbr_subject.mbs_uid_max &&
236 cred->cr_svuid >= rule->mbr_subject.mbs_uid_min));
237 if (rule->mbr_subject.mbs_neg & MBS_UID_DEFINED)
238 match = !match;
239 if (!match)
240 return (0);
241 }
242
243 if (rule->mbr_subject.mbs_flags & MBS_GID_DEFINED) {
244 match = ((cred->cr_rgid <= rule->mbr_subject.mbs_gid_max &&
245 cred->cr_rgid >= rule->mbr_subject.mbs_gid_min) ||
246 (cred->cr_svgid <= rule->mbr_subject.mbs_gid_max &&
247 cred->cr_svgid >= rule->mbr_subject.mbs_gid_min));
248 if (!match) {
249 for (i = 0; i < cred->cr_ngroups; i++) {
250 if (cred->cr_groups[i]
251 <= rule->mbr_subject.mbs_gid_max &&
252 cred->cr_groups[i]
253 >= rule->mbr_subject.mbs_gid_min) {
254 match = 1;
255 break;
256 }
257 }
258 }
259 if (rule->mbr_subject.mbs_neg & MBS_GID_DEFINED)
260 match = !match;
261 if (!match)
262 return (0);
263 }
264
265 if (rule->mbr_subject.mbs_flags & MBS_PRISON_DEFINED) {
266 match = (cred->cr_prison != NULL &&
267 cred->cr_prison->pr_id == rule->mbr_subject.mbs_prison);
268 if (rule->mbr_subject.mbs_neg & MBS_PRISON_DEFINED)
269 match = !match;
270 if (!match)
271 return (0);
272 }
273
274 /*
275 * Is there an object match?
276 */
277 if (rule->mbr_object.mbo_flags & MBO_UID_DEFINED) {
278 match = (vap->va_uid <= rule->mbr_object.mbo_uid_max &&
279 vap->va_uid >= rule->mbr_object.mbo_uid_min);
280 if (rule->mbr_object.mbo_neg & MBO_UID_DEFINED)
281 match = !match;
282 if (!match)
283 return (0);
284 }
285
286 if (rule->mbr_object.mbo_flags & MBO_GID_DEFINED) {
287 match = (vap->va_gid <= rule->mbr_object.mbo_gid_max &&
288 vap->va_gid >= rule->mbr_object.mbo_gid_min);
289 if (rule->mbr_object.mbo_neg & MBO_GID_DEFINED)
290 match = !match;
291 if (!match)
292 return (0);
293 }
294
295 if (rule->mbr_object.mbo_flags & MBO_FSID_DEFINED) {
296 match = (bcmp(&(vp->v_mount->mnt_stat.f_fsid),
297 &(rule->mbr_object.mbo_fsid),
298 sizeof(rule->mbr_object.mbo_fsid)) == 0);
299 if (rule->mbr_object.mbo_neg & MBO_FSID_DEFINED)
300 match = !match;
301 if (!match)
302 return (0);
303 }
304
305 if (rule->mbr_object.mbo_flags & MBO_SUID) {
306 match = (vap->va_mode & VSUID);
307 if (rule->mbr_object.mbo_neg & MBO_SUID)
308 match = !match;
309 if (!match)
310 return (0);
311 }
312
313 if (rule->mbr_object.mbo_flags & MBO_SGID) {
314 match = (vap->va_mode & VSGID);
315 if (rule->mbr_object.mbo_neg & MBO_SGID)
316 match = !match;
317 if (!match)
318 return (0);
319 }
320
321 if (rule->mbr_object.mbo_flags & MBO_UID_SUBJECT) {
322 match = (vap->va_uid == cred->cr_uid ||
323 vap->va_uid == cred->cr_ruid ||
324 vap->va_uid == cred->cr_svuid);
325 if (rule->mbr_object.mbo_neg & MBO_UID_SUBJECT)
326 match = !match;
327 if (!match)
328 return (0);
329 }
330
331 if (rule->mbr_object.mbo_flags & MBO_GID_SUBJECT) {
332 match = (groupmember(vap->va_gid, cred) ||
333 vap->va_gid == cred->cr_rgid ||
334 vap->va_gid == cred->cr_svgid);
335 if (rule->mbr_object.mbo_neg & MBO_GID_SUBJECT)
336 match = !match;
337 if (!match)
338 return (0);
339 }
340
341 if (rule->mbr_object.mbo_flags & MBO_TYPE_DEFINED) {
342 switch (vap->va_type) {
343 case VREG:
344 match = (rule->mbr_object.mbo_type & MBO_TYPE_REG);
345 break;
346 case VDIR:
347 match = (rule->mbr_object.mbo_type & MBO_TYPE_DIR);
348 break;
349 case VBLK:
350 match = (rule->mbr_object.mbo_type & MBO_TYPE_BLK);
351 break;
352 case VCHR:
353 match = (rule->mbr_object.mbo_type & MBO_TYPE_CHR);
354 break;
355 case VLNK:
356 match = (rule->mbr_object.mbo_type & MBO_TYPE_LNK);
357 break;
358 case VSOCK:
359 match = (rule->mbr_object.mbo_type & MBO_TYPE_SOCK);
360 break;
361 case VFIFO:
362 match = (rule->mbr_object.mbo_type & MBO_TYPE_FIFO);
363 break;
364 default:
365 match = 0;
366 }
367 if (rule->mbr_object.mbo_neg & MBO_TYPE_DEFINED)
368 match = !match;
369 if (!match)
370 return (0);
371 }
372
373 /*
374 * Is the access permitted?
375 */
376 if ((rule->mbr_mode & acc_mode) != acc_mode) {
377 if (ugidfw_logging)
378 log(LOG_AUTHPRIV, "mac_bsdextended: %d:%d request %d"
379 " on %d:%d failed. \n", cred->cr_ruid,
380 cred->cr_rgid, acc_mode, vap->va_uid,
381 vap->va_gid);
382 return (EACCES);
383 }
384
385 /*
386 * If the rule matched, permits access, and first match is enabled,
387 * return success.
388 */
389 if (ugidfw_firstmatch_enabled)
390 return (EJUSTRETURN);
391 else
392 return (0);
393}
394
395static int
396ugidfw_check(struct ucred *cred, struct vnode *vp, struct vattr *vap,
397 int acc_mode)
398{
399 int error, i;
400
401 /*
402 * XXXRW: More specific privilege selection needed.
403 */
404 if (suser_cred(cred, 0) == 0)
405 return (0);
406
407 /*
408 * Since we do not separately handle append, map append to write.
409 */
410 if (acc_mode & MBI_APPEND) {
411 acc_mode &= ~MBI_APPEND;
412 acc_mode |= MBI_WRITE;
413 }
414 mtx_lock(&ugidfw_mtx);
415 for (i = 0; i < rule_slots; i++) {
416 if (rules[i] == NULL)
417 continue;
418 error = ugidfw_rulecheck(rules[i], cred,
419 vp, vap, acc_mode);
420 if (error == EJUSTRETURN)
421 break;
422 if (error) {
423 mtx_unlock(&ugidfw_mtx);
424 return (error);
425 }
426 }
427 mtx_unlock(&ugidfw_mtx);
428 return (0);
429}
430
431static int
432ugidfw_check_vp(struct ucred *cred, struct vnode *vp, int acc_mode)
433{
434 int error;
435 struct vattr vap;
436
437 if (!ugidfw_enabled)
438 return (0);
439 error = VOP_GETATTR(vp, &vap, cred, curthread);
440 if (error)
441 return (error);
442 return (ugidfw_check(cred, vp, &vap, acc_mode));
443}
444
|
445static int
446ugidfw_system_check_acct(struct ucred *cred, struct vnode *vp,
447 struct label *vplabel)
448{
449
450 return (ugidfw_check_vp(cred, vp, MBI_WRITE));
451}
452
453static int
454ugidfw_system_check_auditctl(struct ucred *cred, struct vnode *vp,
455 struct label *vplabel)
456{
457
458 return (ugidfw_check_vp(cred, vp, MBI_WRITE));
459}
460
461static int
462ugidfw_system_check_swapoff(struct ucred *cred, struct vnode *vp,
463 struct label *vplabel)
464{
465
466 return (ugidfw_check_vp(cred, vp, MBI_WRITE));
467}
468
469static int
470ugidfw_system_check_swapon(struct ucred *cred, struct vnode *vp,
471 struct label *vplabel)
472{
473
474 return (ugidfw_check_vp(cred, vp, MBI_WRITE));
475}
476
477static int
478ugidfw_vnode_check_access(struct ucred *cred, struct vnode *vp,
479 struct label *vplabel, int acc_mode)
480{
481
482 return (ugidfw_check_vp(cred, vp, acc_mode));
483}
484
485static int
486ugidfw_vnode_check_chdir(struct ucred *cred, struct vnode *dvp,
487 struct label *dvplabel)
488{
489
490 return (ugidfw_check_vp(cred, dvp, MBI_EXEC));
491}
492
493static int
494ugidfw_vnode_check_chroot(struct ucred *cred, struct vnode *dvp,
495 struct label *dvplabel)
496{
497
498 return (ugidfw_check_vp(cred, dvp, MBI_EXEC));
499}
500
501static int
502ugidfw_check_create_vnode(struct ucred *cred, struct vnode *dvp,
503 struct label *dvplabel, struct componentname *cnp, struct vattr *vap)
504{
505
506 return (ugidfw_check_vp(cred, dvp, MBI_WRITE));
507}
508
509static int
510ugidfw_vnode_check_deleteacl(struct ucred *cred, struct vnode *vp,
511 struct label *vplabel, acl_type_t type)
512{
513
514 return (ugidfw_check_vp(cred, vp, MBI_ADMIN));
515}
516
517static int
518ugidfw_vnode_check_deleteextattr(struct ucred *cred, struct vnode *vp,
519 struct label *vplabel, int attrnamespace, const char *name)
520{
521
522 return (ugidfw_check_vp(cred, vp, MBI_WRITE));
523}
524
525static int
526ugidfw_vnode_check_exec(struct ucred *cred, struct vnode *vp,
527 struct label *vplabel, struct image_params *imgp,
528 struct label *execlabel)
529{
530
531 return (ugidfw_check_vp(cred, vp, MBI_READ|MBI_EXEC));
532}
533
534static int
535ugidfw_vnode_check_getacl(struct ucred *cred, struct vnode *vp,
536 struct label *vplabel, acl_type_t type)
537{
538
539 return (ugidfw_check_vp(cred, vp, MBI_STAT));
540}
541
542static int
543ugidfw_vnode_check_getextattr(struct ucred *cred, struct vnode *vp,
544 struct label *vplabel, int attrnamespace, const char *name,
545 struct uio *uio)
546{
547
548 return (ugidfw_check_vp(cred, vp, MBI_READ));
549}
550
551static int
552ugidfw_vnode_check_link(struct ucred *cred, struct vnode *dvp,
553 struct label *dvplabel, struct vnode *vp, struct label *label,
554 struct componentname *cnp)
555{
556 int error;
557
558 error = ugidfw_check_vp(cred, dvp, MBI_WRITE);
559 if (error)
560 return (error);
561 error = ugidfw_check_vp(cred, vp, MBI_WRITE);
562 if (error)
563 return (error);
564 return (0);
565}
566
567static int
568ugidfw_vnode_check_listextattr(struct ucred *cred, struct vnode *vp,
569 struct label *vplabel, int attrnamespace)
570{
571
572 return (ugidfw_check_vp(cred, vp, MBI_READ));
573}
574
575static int
576ugidfw_vnode_check_lookup(struct ucred *cred, struct vnode *dvp,
577 struct label *dvplabel, struct componentname *cnp)
578{
579
580 return (ugidfw_check_vp(cred, dvp, MBI_EXEC));
581}
582
583static int
584ugidfw_vnode_check_open(struct ucred *cred, struct vnode *vp,
585 struct label *vplabel, int acc_mode)
586{
587
588 return (ugidfw_check_vp(cred, vp, acc_mode));
589}
590
591static int
592ugidfw_vnode_check_readdir(struct ucred *cred, struct vnode *dvp,
593 struct label *dvplabel)
594{
595
596 return (ugidfw_check_vp(cred, dvp, MBI_READ));
597}
598
599static int
600ugidfw_vnode_check_readdlink(struct ucred *cred, struct vnode *vp,
601 struct label *vplabel)
602{
603
604 return (ugidfw_check_vp(cred, vp, MBI_READ));
605}
606
607static int
608ugidfw_vnode_check_rename_from(struct ucred *cred, struct vnode *dvp,
609 struct label *dvplabel, struct vnode *vp, struct label *vplabel,
610 struct componentname *cnp)
611{
612 int error;
613
614 error = ugidfw_check_vp(cred, dvp, MBI_WRITE);
615 if (error)
616 return (error);
617 return (ugidfw_check_vp(cred, vp, MBI_WRITE));
618}
619
620static int
621ugidfw_vnode_check_rename_to(struct ucred *cred, struct vnode *dvp,
622 struct label *dvplabel, struct vnode *vp, struct label *vplabel,
623 int samedir, struct componentname *cnp)
624{
625 int error;
626
627 error = ugidfw_check_vp(cred, dvp, MBI_WRITE);
628 if (error)
629 return (error);
630 if (vp != NULL)
631 error = ugidfw_check_vp(cred, vp, MBI_WRITE);
632 return (error);
633}
634
635static int
636ugidfw_vnode_check_revoke(struct ucred *cred, struct vnode *vp,
637 struct label *vplabel)
638{
639
640 return (ugidfw_check_vp(cred, vp, MBI_ADMIN));
641}
642
643static int
644ugidfw_check_setacl_vnode(struct ucred *cred, struct vnode *vp,
645 struct label *vplabel, acl_type_t type, struct acl *acl)
646{
647
648 return (ugidfw_check_vp(cred, vp, MBI_ADMIN));
649}
650
651static int
652ugidfw_vnode_check_setextattr(struct ucred *cred, struct vnode *vp,
653 struct label *vplabel, int attrnamespace, const char *name,
654 struct uio *uio)
655{
656
657 return (ugidfw_check_vp(cred, vp, MBI_WRITE));
658}
659
660static int
661ugidfw_vnode_check_setflags(struct ucred *cred, struct vnode *vp,
662 struct label *vplabel, u_long flags)
663{
664
665 return (ugidfw_check_vp(cred, vp, MBI_ADMIN));
666}
667
668static int
669ugidfw_vnode_check_setmode(struct ucred *cred, struct vnode *vp,
670 struct label *vplabel, mode_t mode)
671{
672
673 return (ugidfw_check_vp(cred, vp, MBI_ADMIN));
674}
675
676static int
677ugidfw_vnode_check_setowner(struct ucred *cred, struct vnode *vp,
678 struct label *vplabel, uid_t uid, gid_t gid)
679{
680
681 return (ugidfw_check_vp(cred, vp, MBI_ADMIN));
682}
683
684static int
685ugidfw_vnode_check_setutimes(struct ucred *cred, struct vnode *vp,
686 struct label *vplabel, struct timespec atime, struct timespec utime)
687{
688
689 return (ugidfw_check_vp(cred, vp, MBI_ADMIN));
690}
691
692static int
693ugidfw_vnode_check_stat(struct ucred *active_cred,
694 struct ucred *file_cred, struct vnode *vp, struct label *vplabel)
695{
696
697 return (ugidfw_check_vp(active_cred, vp, MBI_STAT));
698}
699
700static int
701ugidfw_vnode_check_unlink(struct ucred *cred, struct vnode *dvp,
702 struct label *dvplabel, struct vnode *vp, struct label *vplabel,
703 struct componentname *cnp)
704{
705 int error;
706
707 error = ugidfw_check_vp(cred, dvp, MBI_WRITE);
708 if (error)
709 return (error);
710 return (ugidfw_check_vp(cred, vp, MBI_WRITE));
711}
712
713static struct mac_policy_ops ugidfw_ops =
714{
715 .mpo_destroy = ugidfw_destroy,
716 .mpo_init = ugidfw_init,
717 .mpo_system_check_acct = ugidfw_system_check_acct,
718 .mpo_system_check_auditctl = ugidfw_system_check_auditctl,
719 .mpo_system_check_swapoff = ugidfw_system_check_swapoff,
720 .mpo_system_check_swapon = ugidfw_system_check_swapon,
721 .mpo_vnode_check_access = ugidfw_vnode_check_access,
722 .mpo_vnode_check_chdir = ugidfw_vnode_check_chdir,
723 .mpo_vnode_check_chroot = ugidfw_vnode_check_chroot,
724 .mpo_vnode_check_create = ugidfw_check_create_vnode,
725 .mpo_vnode_check_deleteacl = ugidfw_vnode_check_deleteacl,
726 .mpo_vnode_check_deleteextattr = ugidfw_vnode_check_deleteextattr,
727 .mpo_vnode_check_exec = ugidfw_vnode_check_exec,
728 .mpo_vnode_check_getacl = ugidfw_vnode_check_getacl,
729 .mpo_vnode_check_getextattr = ugidfw_vnode_check_getextattr,
730 .mpo_vnode_check_link = ugidfw_vnode_check_link,
731 .mpo_vnode_check_listextattr = ugidfw_vnode_check_listextattr,
732 .mpo_vnode_check_lookup = ugidfw_vnode_check_lookup,
733 .mpo_vnode_check_open = ugidfw_vnode_check_open,
734 .mpo_vnode_check_readdir = ugidfw_vnode_check_readdir,
735 .mpo_vnode_check_readlink = ugidfw_vnode_check_readdlink,
736 .mpo_vnode_check_rename_from = ugidfw_vnode_check_rename_from,
737 .mpo_vnode_check_rename_to = ugidfw_vnode_check_rename_to,
738 .mpo_vnode_check_revoke = ugidfw_vnode_check_revoke,
739 .mpo_vnode_check_setacl = ugidfw_check_setacl_vnode,
740 .mpo_vnode_check_setextattr = ugidfw_vnode_check_setextattr,
741 .mpo_vnode_check_setflags = ugidfw_vnode_check_setflags,
742 .mpo_vnode_check_setmode = ugidfw_vnode_check_setmode,
743 .mpo_vnode_check_setowner = ugidfw_vnode_check_setowner,
744 .mpo_vnode_check_setutimes = ugidfw_vnode_check_setutimes,
745 .mpo_vnode_check_stat = ugidfw_vnode_check_stat,
746 .mpo_vnode_check_unlink = ugidfw_vnode_check_unlink,
747};
748
749MAC_POLICY_SET(&ugidfw_ops, mac_bsdextended, "TrustedBSD MAC/BSD Extended",
750 MPC_LOADTIME_FLAG_UNLOADOK, NULL);
| 449static int
450ugidfw_system_check_acct(struct ucred *cred, struct vnode *vp,
451 struct label *vplabel)
452{
453
454 return (ugidfw_check_vp(cred, vp, MBI_WRITE));
455}
456
457static int
458ugidfw_system_check_auditctl(struct ucred *cred, struct vnode *vp,
459 struct label *vplabel)
460{
461
462 return (ugidfw_check_vp(cred, vp, MBI_WRITE));
463}
464
465static int
466ugidfw_system_check_swapoff(struct ucred *cred, struct vnode *vp,
467 struct label *vplabel)
468{
469
470 return (ugidfw_check_vp(cred, vp, MBI_WRITE));
471}
472
473static int
474ugidfw_system_check_swapon(struct ucred *cred, struct vnode *vp,
475 struct label *vplabel)
476{
477
478 return (ugidfw_check_vp(cred, vp, MBI_WRITE));
479}
480
481static int
482ugidfw_vnode_check_access(struct ucred *cred, struct vnode *vp,
483 struct label *vplabel, int acc_mode)
484{
485
486 return (ugidfw_check_vp(cred, vp, acc_mode));
487}
488
489static int
490ugidfw_vnode_check_chdir(struct ucred *cred, struct vnode *dvp,
491 struct label *dvplabel)
492{
493
494 return (ugidfw_check_vp(cred, dvp, MBI_EXEC));
495}
496
497static int
498ugidfw_vnode_check_chroot(struct ucred *cred, struct vnode *dvp,
499 struct label *dvplabel)
500{
501
502 return (ugidfw_check_vp(cred, dvp, MBI_EXEC));
503}
504
505static int
506ugidfw_check_create_vnode(struct ucred *cred, struct vnode *dvp,
507 struct label *dvplabel, struct componentname *cnp, struct vattr *vap)
508{
509
510 return (ugidfw_check_vp(cred, dvp, MBI_WRITE));
511}
512
513static int
514ugidfw_vnode_check_deleteacl(struct ucred *cred, struct vnode *vp,
515 struct label *vplabel, acl_type_t type)
516{
517
518 return (ugidfw_check_vp(cred, vp, MBI_ADMIN));
519}
520
521static int
522ugidfw_vnode_check_deleteextattr(struct ucred *cred, struct vnode *vp,
523 struct label *vplabel, int attrnamespace, const char *name)
524{
525
526 return (ugidfw_check_vp(cred, vp, MBI_WRITE));
527}
528
529static int
530ugidfw_vnode_check_exec(struct ucred *cred, struct vnode *vp,
531 struct label *vplabel, struct image_params *imgp,
532 struct label *execlabel)
533{
534
535 return (ugidfw_check_vp(cred, vp, MBI_READ|MBI_EXEC));
536}
537
538static int
539ugidfw_vnode_check_getacl(struct ucred *cred, struct vnode *vp,
540 struct label *vplabel, acl_type_t type)
541{
542
543 return (ugidfw_check_vp(cred, vp, MBI_STAT));
544}
545
546static int
547ugidfw_vnode_check_getextattr(struct ucred *cred, struct vnode *vp,
548 struct label *vplabel, int attrnamespace, const char *name,
549 struct uio *uio)
550{
551
552 return (ugidfw_check_vp(cred, vp, MBI_READ));
553}
554
555static int
556ugidfw_vnode_check_link(struct ucred *cred, struct vnode *dvp,
557 struct label *dvplabel, struct vnode *vp, struct label *label,
558 struct componentname *cnp)
559{
560 int error;
561
562 error = ugidfw_check_vp(cred, dvp, MBI_WRITE);
563 if (error)
564 return (error);
565 error = ugidfw_check_vp(cred, vp, MBI_WRITE);
566 if (error)
567 return (error);
568 return (0);
569}
570
571static int
572ugidfw_vnode_check_listextattr(struct ucred *cred, struct vnode *vp,
573 struct label *vplabel, int attrnamespace)
574{
575
576 return (ugidfw_check_vp(cred, vp, MBI_READ));
577}
578
579static int
580ugidfw_vnode_check_lookup(struct ucred *cred, struct vnode *dvp,
581 struct label *dvplabel, struct componentname *cnp)
582{
583
584 return (ugidfw_check_vp(cred, dvp, MBI_EXEC));
585}
586
587static int
588ugidfw_vnode_check_open(struct ucred *cred, struct vnode *vp,
589 struct label *vplabel, int acc_mode)
590{
591
592 return (ugidfw_check_vp(cred, vp, acc_mode));
593}
594
595static int
596ugidfw_vnode_check_readdir(struct ucred *cred, struct vnode *dvp,
597 struct label *dvplabel)
598{
599
600 return (ugidfw_check_vp(cred, dvp, MBI_READ));
601}
602
603static int
604ugidfw_vnode_check_readdlink(struct ucred *cred, struct vnode *vp,
605 struct label *vplabel)
606{
607
608 return (ugidfw_check_vp(cred, vp, MBI_READ));
609}
610
611static int
612ugidfw_vnode_check_rename_from(struct ucred *cred, struct vnode *dvp,
613 struct label *dvplabel, struct vnode *vp, struct label *vplabel,
614 struct componentname *cnp)
615{
616 int error;
617
618 error = ugidfw_check_vp(cred, dvp, MBI_WRITE);
619 if (error)
620 return (error);
621 return (ugidfw_check_vp(cred, vp, MBI_WRITE));
622}
623
624static int
625ugidfw_vnode_check_rename_to(struct ucred *cred, struct vnode *dvp,
626 struct label *dvplabel, struct vnode *vp, struct label *vplabel,
627 int samedir, struct componentname *cnp)
628{
629 int error;
630
631 error = ugidfw_check_vp(cred, dvp, MBI_WRITE);
632 if (error)
633 return (error);
634 if (vp != NULL)
635 error = ugidfw_check_vp(cred, vp, MBI_WRITE);
636 return (error);
637}
638
639static int
640ugidfw_vnode_check_revoke(struct ucred *cred, struct vnode *vp,
641 struct label *vplabel)
642{
643
644 return (ugidfw_check_vp(cred, vp, MBI_ADMIN));
645}
646
647static int
648ugidfw_check_setacl_vnode(struct ucred *cred, struct vnode *vp,
649 struct label *vplabel, acl_type_t type, struct acl *acl)
650{
651
652 return (ugidfw_check_vp(cred, vp, MBI_ADMIN));
653}
654
655static int
656ugidfw_vnode_check_setextattr(struct ucred *cred, struct vnode *vp,
657 struct label *vplabel, int attrnamespace, const char *name,
658 struct uio *uio)
659{
660
661 return (ugidfw_check_vp(cred, vp, MBI_WRITE));
662}
663
664static int
665ugidfw_vnode_check_setflags(struct ucred *cred, struct vnode *vp,
666 struct label *vplabel, u_long flags)
667{
668
669 return (ugidfw_check_vp(cred, vp, MBI_ADMIN));
670}
671
672static int
673ugidfw_vnode_check_setmode(struct ucred *cred, struct vnode *vp,
674 struct label *vplabel, mode_t mode)
675{
676
677 return (ugidfw_check_vp(cred, vp, MBI_ADMIN));
678}
679
680static int
681ugidfw_vnode_check_setowner(struct ucred *cred, struct vnode *vp,
682 struct label *vplabel, uid_t uid, gid_t gid)
683{
684
685 return (ugidfw_check_vp(cred, vp, MBI_ADMIN));
686}
687
688static int
689ugidfw_vnode_check_setutimes(struct ucred *cred, struct vnode *vp,
690 struct label *vplabel, struct timespec atime, struct timespec utime)
691{
692
693 return (ugidfw_check_vp(cred, vp, MBI_ADMIN));
694}
695
696static int
697ugidfw_vnode_check_stat(struct ucred *active_cred,
698 struct ucred *file_cred, struct vnode *vp, struct label *vplabel)
699{
700
701 return (ugidfw_check_vp(active_cred, vp, MBI_STAT));
702}
703
704static int
705ugidfw_vnode_check_unlink(struct ucred *cred, struct vnode *dvp,
706 struct label *dvplabel, struct vnode *vp, struct label *vplabel,
707 struct componentname *cnp)
708{
709 int error;
710
711 error = ugidfw_check_vp(cred, dvp, MBI_WRITE);
712 if (error)
713 return (error);
714 return (ugidfw_check_vp(cred, vp, MBI_WRITE));
715}
716
717static struct mac_policy_ops ugidfw_ops =
718{
719 .mpo_destroy = ugidfw_destroy,
720 .mpo_init = ugidfw_init,
721 .mpo_system_check_acct = ugidfw_system_check_acct,
722 .mpo_system_check_auditctl = ugidfw_system_check_auditctl,
723 .mpo_system_check_swapoff = ugidfw_system_check_swapoff,
724 .mpo_system_check_swapon = ugidfw_system_check_swapon,
725 .mpo_vnode_check_access = ugidfw_vnode_check_access,
726 .mpo_vnode_check_chdir = ugidfw_vnode_check_chdir,
727 .mpo_vnode_check_chroot = ugidfw_vnode_check_chroot,
728 .mpo_vnode_check_create = ugidfw_check_create_vnode,
729 .mpo_vnode_check_deleteacl = ugidfw_vnode_check_deleteacl,
730 .mpo_vnode_check_deleteextattr = ugidfw_vnode_check_deleteextattr,
731 .mpo_vnode_check_exec = ugidfw_vnode_check_exec,
732 .mpo_vnode_check_getacl = ugidfw_vnode_check_getacl,
733 .mpo_vnode_check_getextattr = ugidfw_vnode_check_getextattr,
734 .mpo_vnode_check_link = ugidfw_vnode_check_link,
735 .mpo_vnode_check_listextattr = ugidfw_vnode_check_listextattr,
736 .mpo_vnode_check_lookup = ugidfw_vnode_check_lookup,
737 .mpo_vnode_check_open = ugidfw_vnode_check_open,
738 .mpo_vnode_check_readdir = ugidfw_vnode_check_readdir,
739 .mpo_vnode_check_readlink = ugidfw_vnode_check_readdlink,
740 .mpo_vnode_check_rename_from = ugidfw_vnode_check_rename_from,
741 .mpo_vnode_check_rename_to = ugidfw_vnode_check_rename_to,
742 .mpo_vnode_check_revoke = ugidfw_vnode_check_revoke,
743 .mpo_vnode_check_setacl = ugidfw_check_setacl_vnode,
744 .mpo_vnode_check_setextattr = ugidfw_vnode_check_setextattr,
745 .mpo_vnode_check_setflags = ugidfw_vnode_check_setflags,
746 .mpo_vnode_check_setmode = ugidfw_vnode_check_setmode,
747 .mpo_vnode_check_setowner = ugidfw_vnode_check_setowner,
748 .mpo_vnode_check_setutimes = ugidfw_vnode_check_setutimes,
749 .mpo_vnode_check_stat = ugidfw_vnode_check_stat,
750 .mpo_vnode_check_unlink = ugidfw_vnode_check_unlink,
751};
752
753MAC_POLICY_SET(&ugidfw_ops, mac_bsdextended, "TrustedBSD MAC/BSD Extended",
754 MPC_LOADTIME_FLAG_UNLOADOK, NULL);
|