security/mac/mac_vfs.c

86 static int	mac_vnode_setlabel_extattr(struct ucred *cred,
279 mac_vnode_create_extattr(struct ucred *cred, struct mount *mp,
287 	error = VOP_OPENEXTATTR(vp, cred, curthread);
297 	MAC_POLICY_CHECK(vnode_create_extattr, cred, mp, mp->mnt_label, dvp,
313 mac_vnode_setlabel_extattr(struct ucred *cred, struct vnode *vp,
320 	error = VOP_OPENEXTATTR(vp, cred, curthread);
330 	MAC_POLICY_CHECK(vnode_setlabel_extattr, cred, vp, vp->v_label,
376 mac_vnode_check_access(struct ucred *cred, struct vnode *vp, accmode_t accmode)
382 	MAC_POLICY_CHECK(vnode_check_access, cred, vp, vp->v_label, accmode);
383 	MAC_CHECK_PROBE3(vnode_check_access, error, cred, vp, accmode);
392 mac_vnode_check_chdir(struct ucred *cred, struct vnode *dvp)
398 	MAC_POLICY_CHECK(vnode_check_chdir, cred, dvp, dvp->v_label);
399 	MAC_CHECK_PROBE2(vnode_check_chdir, error, cred, dvp);
408 mac_vnode_check_chroot(struct ucred *cred, struct vnode *dvp)
414 	MAC_POLICY_CHECK(vnode_check_chroot, cred, dvp, dvp->v_label);
415 	MAC_CHECK_PROBE2(vnode_check_chroot, error, cred, dvp);
424 mac_vnode_check_create(struct ucred *cred, struct vnode *dvp,
431 	MAC_POLICY_CHECK(vnode_check_create, cred, dvp, dvp->v_label, cnp,
433 	MAC_CHECK_PROBE4(vnode_check_create, error, cred, dvp, cnp, vap);
442 mac_vnode_check_deleteacl(struct ucred *cred, struct vnode *vp,
449 	MAC_POLICY_CHECK(vnode_check_deleteacl, cred, vp, vp->v_label, type);
450 	MAC_CHECK_PROBE3(vnode_check_deleteacl, error, cred, vp, type);
459 mac_vnode_check_deleteextattr(struct ucred *cred, struct vnode *vp,
466 	MAC_POLICY_CHECK(vnode_check_deleteextattr, cred, vp, vp->v_label,
468 	MAC_CHECK_PROBE4(vnode_check_deleteextattr, error, cred, vp,
478 mac_vnode_check_exec(struct ucred *cred, struct vnode *vp,
485 	MAC_POLICY_CHECK(vnode_check_exec, cred, vp, vp->v_label, imgp,
487 	MAC_CHECK_PROBE3(vnode_check_exec, error, cred, vp, imgp);
496 mac_vnode_check_getacl(struct ucred *cred, struct vnode *vp, acl_type_t type)
502 	MAC_POLICY_CHECK(vnode_check_getacl, cred, vp, vp->v_label, type);
503 	MAC_CHECK_PROBE3(vnode_check_getacl, error, cred, vp, type);
512 mac_vnode_check_getextattr(struct ucred *cred, struct vnode *vp,
519 	MAC_POLICY_CHECK(vnode_check_getextattr, cred, vp, vp->v_label,
521 	MAC_CHECK_PROBE4(vnode_check_getextattr, error, cred, vp,
531 mac_vnode_check_link(struct ucred *cred, struct vnode *dvp,
539 	MAC_POLICY_CHECK(vnode_check_link, cred, dvp, dvp->v_label, vp,
541 	MAC_CHECK_PROBE4(vnode_check_link, error, cred, dvp, vp, cnp);
550 mac_vnode_check_listextattr(struct ucred *cred, struct vnode *vp,
557 	MAC_POLICY_CHECK(vnode_check_listextattr, cred, vp, vp->v_label,
559 	MAC_CHECK_PROBE3(vnode_check_listextattr, error, cred, vp,
569 mac_vnode_check_lookup(struct ucred *cred, struct vnode *dvp,
576 	MAC_POLICY_CHECK(vnode_check_lookup, cred, dvp, dvp->v_label, cnp);
577 	MAC_CHECK_PROBE3(vnode_check_lookup, error, cred, dvp, cnp);
586 mac_vnode_check_mmap(struct ucred *cred, struct vnode *vp, int prot,
593 	MAC_POLICY_CHECK(vnode_check_mmap, cred, vp, vp->v_label, prot, flags);
594 	MAC_CHECK_PROBE4(vnode_check_mmap, error, cred, vp, prot, flags);
600 mac_vnode_check_mmap_downgrade(struct ucred *cred, struct vnode *vp,
607 	MAC_POLICY_PERFORM(vnode_check_mmap_downgrade, cred, vp, vp->v_label,
617 mac_vnode_check_mprotect(struct ucred *cred, struct vnode *vp, int prot)
623 	MAC_POLICY_CHECK(vnode_check_mprotect, cred, vp, vp->v_label, prot);
624 	MAC_CHECK_PROBE3(vnode_check_mprotect, error, cred, vp, prot);
633 mac_vnode_check_open(struct ucred *cred, struct vnode *vp, accmode_t accmode)
639 	MAC_POLICY_CHECK(vnode_check_open, cred, vp, vp->v_label, accmode);
640 	MAC_CHECK_PROBE3(vnode_check_open, error, cred, vp, accmode);
687 mac_vnode_check_readdir(struct ucred *cred, struct vnode *dvp)
693 	MAC_POLICY_CHECK(vnode_check_readdir, cred, dvp, dvp->v_label);
694 	MAC_CHECK_PROBE2(vnode_check_readdir, error, cred, dvp);
703 mac_vnode_check_readlink(struct ucred *cred, struct vnode *vp)
709 	MAC_POLICY_CHECK(vnode_check_readlink, cred, vp, vp->v_label);
710 	MAC_CHECK_PROBE2(vnode_check_readlink, error, cred, vp);
719 mac_vnode_check_relabel(struct ucred *cred, struct vnode *vp,
726 	MAC_POLICY_CHECK(vnode_check_relabel, cred, vp, vp->v_label, newlabel);
727 	MAC_CHECK_PROBE3(vnode_check_relabel, error, cred, vp, newlabel);
736 mac_vnode_check_rename_from(struct ucred *cred, struct vnode *dvp,
744 	MAC_POLICY_CHECK(vnode_check_rename_from, cred, dvp, dvp->v_label, vp,
746 	MAC_CHECK_PROBE4(vnode_check_rename_from, error, cred, dvp, vp, cnp);
755 mac_vnode_check_rename_to(struct ucred *cred, struct vnode *dvp,
763 	MAC_POLICY_CHECK(vnode_check_rename_to, cred, dvp, dvp->v_label, vp,
765 	MAC_CHECK_PROBE4(vnode_check_rename_to, error, cred, dvp, vp, cnp);
773 mac_vnode_check_revoke(struct ucred *cred, struct vnode *vp)
779 	MAC_POLICY_CHECK(vnode_check_revoke, cred, vp, vp->v_label);
780 	MAC_CHECK_PROBE2(vnode_check_revoke, error, cred, vp);
789 mac_vnode_check_setacl(struct ucred *cred, struct vnode *vp, acl_type_t type,
796 	MAC_POLICY_CHECK(vnode_check_setacl, cred, vp, vp->v_label, type, acl);
797 	MAC_CHECK_PROBE4(vnode_check_setacl, error, cred, vp, type, acl);
806 mac_vnode_check_setextattr(struct ucred *cred, struct vnode *vp,
813 	MAC_POLICY_CHECK(vnode_check_setextattr, cred, vp, vp->v_label,
815 	MAC_CHECK_PROBE4(vnode_check_setextattr, error, cred, vp,
825 mac_vnode_check_setflags(struct ucred *cred, struct vnode *vp, u_long flags)
831 	MAC_POLICY_CHECK(vnode_check_setflags, cred, vp, vp->v_label, flags);
832 	MAC_CHECK_PROBE3(vnode_check_setflags, error, cred, vp, flags);
841 mac_vnode_check_setmode(struct ucred *cred, struct vnode *vp, mode_t mode)
847 	MAC_POLICY_CHECK(vnode_check_setmode, cred, vp, vp->v_label, mode);
848 	MAC_CHECK_PROBE3(vnode_check_setmode, error, cred, vp, mode);
857 mac_vnode_check_setowner(struct ucred *cred, struct vnode *vp, uid_t uid,
864 	MAC_POLICY_CHECK(vnode_check_setowner, cred, vp, vp->v_label, uid, gid);
865 	MAC_CHECK_PROBE4(vnode_check_setowner, error, cred, vp, uid, gid);
874 mac_vnode_check_setutimes(struct ucred *cred, struct vnode *vp,
881 	MAC_POLICY_CHECK(vnode_check_setutimes, cred, vp, vp->v_label, atime,
883 	MAC_CHECK_PROBE4(vnode_check_setutimes, error, cred, vp, &atime,
912 mac_vnode_check_unlink(struct ucred *cred, struct vnode *dvp,
920 	MAC_POLICY_CHECK(vnode_check_unlink, cred, dvp, dvp->v_label, vp,
922 	MAC_CHECK_PROBE4(vnode_check_unlink, error, cred, dvp, vp, cnp);
947 mac_vnode_relabel(struct ucred *cred, struct vnode *vp,
951 	MAC_POLICY_PERFORM(vnode_relabel, cred, vp, vp->v_label, newlabel);
955 mac_mount_create(struct ucred *cred, struct mount *mp)
958 	MAC_POLICY_PERFORM(mount_create, cred, mp, mp->mnt_label);
965 mac_mount_check_stat(struct ucred *cred, struct mount *mount)
969 	MAC_POLICY_CHECK_NOSLEEP(mount_check_stat, cred, mount, mount->mnt_label);
970 	MAC_CHECK_PROBE2(mount_check_stat, error, cred, mount);
976 mac_devfs_create_device(struct ucred *cred, struct mount *mp,
980 	MAC_POLICY_PERFORM_NOSLEEP(devfs_create_device, cred, mp, dev, de,
985 mac_devfs_create_symlink(struct ucred *cred, struct mount *mp,
989 	MAC_POLICY_PERFORM_NOSLEEP(devfs_create_symlink, cred, mp, dd,
1029 vn_setlabel(struct vnode *vp, struct label *intlabel, struct ucred *cred)
1051 	error = mac_vnode_check_relabel(cred, vp, intlabel);
1062 	error = VOP_ACCESS(vp, VADMIN, cred, curthread);
1066 	error = VOP_SETLABEL(vp, intlabel, cred, curthread);