security/mac/mac_socket.c

148 mac_socket_init(struct socket *so, int flag)
152 		so->so_label = mac_socket_label_alloc(flag);
153 		if (so->so_label == NULL)
155 		so->so_peerlabel = mac_socketpeer_label_alloc(flag);
156 		if (so->so_peerlabel == NULL) {
157 			mac_socket_label_free(so->so_label);
158 			so->so_label = NULL;
162 		so->so_label = NULL;
163 		so->so_peerlabel = NULL;
185 mac_socket_destroy(struct socket *so)
188 	if (so->so_label != NULL) {
189 		mac_socket_label_free(so->so_label);
190 		so->so_label = NULL;
191 		mac_socketpeer_label_free(so->so_peerlabel);
192 		so->so_peerlabel = NULL;
237 mac_socket_create(struct ucred *cred, struct socket *so)
240 	MAC_POLICY_PERFORM_NOSLEEP(socket_create, cred, so, so->so_label);
252 mac_socket_relabel(struct ucred *cred, struct socket *so,
256 	SOCK_LOCK_ASSERT(so);
258 	MAC_POLICY_PERFORM_NOSLEEP(socket_relabel, cred, so, so->so_label,
263 mac_socketpeer_set_from_mbuf(struct mbuf *m, struct socket *so)
272 	MAC_POLICY_PERFORM_NOSLEEP(socketpeer_set_from_mbuf, m, label, so,
273 	    so->so_peerlabel);
288 mac_socket_create_mbuf(struct socket *so, struct mbuf *m)
297 	MAC_POLICY_PERFORM_NOSLEEP(socket_create_mbuf, so, so->so_label, m,
305 mac_socket_check_accept(struct ucred *cred, struct socket *so)
309 	MAC_POLICY_CHECK_NOSLEEP(socket_check_accept, cred, so,
310 	    so->so_label);
311 	MAC_CHECK_PROBE2(socket_check_accept, error, cred, so);
320 mac_socket_check_bind(struct ucred *cred, struct socket *so,
325 	MAC_POLICY_CHECK_NOSLEEP(socket_check_bind, cred, so, so->so_label,
327 	MAC_CHECK_PROBE3(socket_check_bind, error, cred, so, sa);
336 mac_socket_check_connect(struct ucred *cred, struct socket *so,
341 	MAC_POLICY_CHECK_NOSLEEP(socket_check_connect, cred, so,
342 	    so->so_label, sa);
343 	MAC_CHECK_PROBE3(socket_check_connect, error, cred, so, sa);
368 mac_socket_check_deliver(struct socket *so, struct mbuf *m)
378 	MAC_POLICY_CHECK_NOSLEEP(socket_check_deliver, so, so->so_label, m,
380 	MAC_CHECK_PROBE2(socket_check_deliver, error, so, m);
389 mac_socket_check_listen(struct ucred *cred, struct socket *so)
393 	MAC_POLICY_CHECK_NOSLEEP(socket_check_listen, cred, so,
394 	    so->so_label);
395 	MAC_CHECK_PROBE2(socket_check_listen, error, cred, so);
404 mac_socket_check_poll(struct ucred *cred, struct socket *so)
408 	MAC_POLICY_CHECK_NOSLEEP(socket_check_poll, cred, so, so->so_label);
409 	MAC_CHECK_PROBE2(socket_check_poll, error, cred, so);
418 mac_socket_check_receive(struct ucred *cred, struct socket *so)
422 	MAC_POLICY_CHECK_NOSLEEP(socket_check_receive, cred, so,
423 	    so->so_label);
424 	MAC_CHECK_PROBE2(socket_check_receive, error, cred, so);
433 mac_socket_check_relabel(struct ucred *cred, struct socket *so,
438 	SOCK_LOCK_ASSERT(so);
440 	MAC_POLICY_CHECK_NOSLEEP(socket_check_relabel, cred, so,
441 	    so->so_label, newlabel);
442 	MAC_CHECK_PROBE3(socket_check_relabel, error, cred, so, newlabel);
451 mac_socket_check_send(struct ucred *cred, struct socket *so)
455 	MAC_POLICY_CHECK_NOSLEEP(socket_check_send, cred, so, so->so_label);
456 	MAC_CHECK_PROBE2(socket_check_send, error, cred, so);
465 mac_socket_check_stat(struct ucred *cred, struct socket *so)
469 	MAC_POLICY_CHECK_NOSLEEP(socket_check_stat, cred, so, so->so_label);
470 	MAC_CHECK_PROBE2(socket_check_stat, error, cred, so);
479 mac_socket_check_visible(struct ucred *cred, struct socket *so)
483 	MAC_POLICY_CHECK_NOSLEEP(socket_check_visible, cred, so,
484 	    so->so_label);
485 	MAC_CHECK_PROBE2(socket_check_visible, error, cred, so);
491 mac_socket_label_set(struct ucred *cred, struct socket *so,
504 	SOCK_LOCK(so);
505 	error = mac_socket_check_relabel(cred, so, label);
507 		SOCK_UNLOCK(so);
511 	mac_socket_relabel(cred, so, label);
512 	SOCK_UNLOCK(so);
520 	if (so->so_proto->pr_usrreqs->pru_sosetlabel != NULL)
521 		(so->so_proto->pr_usrreqs->pru_sosetlabel)(so);
527 mac_setsockopt_label(struct ucred *cred, struct socket *so, struct mac *mac)
553 	error = mac_socket_label_set(cred, so, intlabel);
560 mac_getsockopt_label(struct ucred *cred, struct socket *so, struct mac *mac)
582 	SOCK_LOCK(so);
583 	mac_socket_copy_label(so->so_label, intlabel);
584 	SOCK_UNLOCK(so);
598 mac_getsockopt_peerlabel(struct ucred *cred, struct socket *so,
621 	SOCK_LOCK(so);
622 	mac_socket_copy_label(so->so_peerlabel, intlabel);
623 	SOCK_UNLOCK(so);