mac_pipe.c revision 105598
1100894Srwatson/*- 2100894Srwatson * Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson 3100894Srwatson * Copyright (c) 2001 Ilmar S. Habibulin 4100894Srwatson * Copyright (c) 2001, 2002 Networks Associates Technology, Inc. 5100894Srwatson * All rights reserved. 6100894Srwatson * 7100894Srwatson * This software was developed by Robert Watson and Ilmar Habibulin for the 8100894Srwatson * TrustedBSD Project. 9100894Srwatson * 10100894Srwatson * This software was developed for the FreeBSD Project in part by NAI Labs, 11100894Srwatson * the Security Research Division of Network Associates, Inc. under 12100894Srwatson * DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA 13100894Srwatson * CHATS research program. 14100894Srwatson * 15100894Srwatson * Redistribution and use in source and binary forms, with or without 16100894Srwatson * modification, are permitted provided that the following conditions 17100894Srwatson * are met: 18100894Srwatson * 1. Redistributions of source code must retain the above copyright 19100894Srwatson * notice, this list of conditions and the following disclaimer. 20100894Srwatson * 2. Redistributions in binary form must reproduce the above copyright 21100894Srwatson * notice, this list of conditions and the following disclaimer in the 22100894Srwatson * documentation and/or other materials provided with the distribution. 23100894Srwatson * 3. The names of the authors may not be used to endorse or promote 24100894Srwatson * products derived from this software without specific prior written 25100894Srwatson * permission. 26100894Srwatson * 27100894Srwatson * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 28100894Srwatson * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 29100894Srwatson * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 30100894Srwatson * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 31100894Srwatson * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 32100894Srwatson * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 33100894Srwatson * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 34100894Srwatson * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 35100894Srwatson * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 36100894Srwatson * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 37100894Srwatson * SUCH DAMAGE. 38100894Srwatson * 39100894Srwatson * $FreeBSD: head/sys/security/mac/mac_pipe.c 105598 2002-10-21 02:51:56Z brooks $ 40100894Srwatson */ 41100894Srwatson/* 42100894Srwatson * Developed by the TrustedBSD Project. 43100894Srwatson * 44100894Srwatson * Framework for extensible kernel access control. Kernel and userland 45100894Srwatson * interface to the framework, policy registration and composition. 46100894Srwatson */ 47100894Srwatson 48100894Srwatson#include "opt_mac.h" 49104300Sphk#include "opt_devfs.h" 50101173Srwatson 51100894Srwatson#include <sys/param.h> 52100979Srwatson#include <sys/extattr.h> 53100979Srwatson#include <sys/kernel.h> 54100979Srwatson#include <sys/lock.h> 55102949Sbde#include <sys/malloc.h> 56100979Srwatson#include <sys/mutex.h> 57100979Srwatson#include <sys/mac.h> 58101712Srwatson#include <sys/module.h> 59100979Srwatson#include <sys/proc.h> 60100979Srwatson#include <sys/systm.h> 61100894Srwatson#include <sys/sysproto.h> 62100894Srwatson#include <sys/sysent.h> 63100979Srwatson#include <sys/vnode.h> 64100979Srwatson#include <sys/mount.h> 65100979Srwatson#include <sys/file.h> 66100979Srwatson#include <sys/namei.h> 67100979Srwatson#include <sys/socket.h> 68100979Srwatson#include <sys/pipe.h> 69100979Srwatson#include <sys/socketvar.h> 70100979Srwatson#include <sys/sysctl.h> 71100894Srwatson 72100979Srwatson#include <vm/vm.h> 73100979Srwatson#include <vm/pmap.h> 74100979Srwatson#include <vm/vm_map.h> 75100979Srwatson#include <vm/vm_object.h> 76100979Srwatson 77100979Srwatson#include <sys/mac_policy.h> 78100979Srwatson 79100979Srwatson#include <fs/devfs/devfs.h> 80100979Srwatson 81100979Srwatson#include <net/bpfdesc.h> 82100979Srwatson#include <net/if.h> 83100979Srwatson#include <net/if_var.h> 84100979Srwatson 85100979Srwatson#include <netinet/in.h> 86100979Srwatson#include <netinet/ip_var.h> 87100979Srwatson 88100979Srwatson#ifdef MAC 89100979Srwatson 90101712Srwatson/* 91101712Srwatson * Declare that the kernel provides MAC support, version 1. This permits 92101712Srwatson * modules to refuse to be loaded if the necessary support isn't present, 93101712Srwatson * even if it's pre-boot. 94101712Srwatson */ 95101712SrwatsonMODULE_VERSION(kernel_mac_support, 1); 96101712Srwatson 97100979SrwatsonSYSCTL_DECL(_security); 98100979Srwatson 99100979SrwatsonSYSCTL_NODE(_security, OID_AUTO, mac, CTLFLAG_RW, 0, 100100979Srwatson "TrustedBSD MAC policy controls"); 101104517Srwatson 102100979Srwatson#if MAC_MAX_POLICIES > 32 103100979Srwatson#error "MAC_MAX_POLICIES too large" 104100979Srwatson#endif 105105497Srwatson 106100979Srwatsonstatic unsigned int mac_max_policies = MAC_MAX_POLICIES; 107100979Srwatsonstatic unsigned int mac_policy_offsets_free = (1 << MAC_MAX_POLICIES) - 1; 108100979SrwatsonSYSCTL_UINT(_security_mac, OID_AUTO, max_policies, CTLFLAG_RD, 109100979Srwatson &mac_max_policies, 0, ""); 110100979Srwatson 111100979Srwatsonstatic int mac_late = 0; 112100979Srwatson 113100979Srwatsonstatic int mac_enforce_fs = 1; 114100979SrwatsonSYSCTL_INT(_security_mac, OID_AUTO, enforce_fs, CTLFLAG_RW, 115100979Srwatson &mac_enforce_fs, 0, "Enforce MAC policy on file system objects"); 116100979SrwatsonTUNABLE_INT("security.mac.enforce_fs", &mac_enforce_fs); 117100979Srwatson 118100979Srwatsonstatic int mac_enforce_network = 1; 119100979SrwatsonSYSCTL_INT(_security_mac, OID_AUTO, enforce_network, CTLFLAG_RW, 120100979Srwatson &mac_enforce_network, 0, "Enforce MAC policy on network packets"); 121100979SrwatsonTUNABLE_INT("security.mac.enforce_network", &mac_enforce_network); 122100979Srwatson 123103513Srwatsonstatic int mac_enforce_pipe = 1; 124103513SrwatsonSYSCTL_INT(_security_mac, OID_AUTO, enforce_pipe, CTLFLAG_RW, 125103513Srwatson &mac_enforce_pipe, 0, "Enforce MAC policy on pipe operations"); 126104236SrwatsonTUNABLE_INT("security.mac.enforce_pipe", &mac_enforce_pipe); 127103513Srwatson 128100979Srwatsonstatic int mac_enforce_process = 1; 129100979SrwatsonSYSCTL_INT(_security_mac, OID_AUTO, enforce_process, CTLFLAG_RW, 130100979Srwatson &mac_enforce_process, 0, "Enforce MAC policy on inter-process operations"); 131100979SrwatsonTUNABLE_INT("security.mac.enforce_process", &mac_enforce_process); 132100979Srwatson 133100979Srwatsonstatic int mac_enforce_socket = 1; 134100979SrwatsonSYSCTL_INT(_security_mac, OID_AUTO, enforce_socket, CTLFLAG_RW, 135100979Srwatson &mac_enforce_socket, 0, "Enforce MAC policy on socket operations"); 136100979SrwatsonTUNABLE_INT("security.mac.enforce_socket", &mac_enforce_socket); 137100979Srwatson 138103514Srwatsonstatic int mac_enforce_vm = 1; 139103514SrwatsonSYSCTL_INT(_security_mac, OID_AUTO, enforce_vm, CTLFLAG_RW, 140103514Srwatson &mac_enforce_vm, 0, "Enforce MAC policy on vm operations"); 141104236SrwatsonTUNABLE_INT("security.mac.enforce_vm", &mac_enforce_vm); 142103514Srwatson 143100979Srwatsonstatic int mac_label_size = sizeof(struct mac); 144100979SrwatsonSYSCTL_INT(_security_mac, OID_AUTO, label_size, CTLFLAG_RD, 145100979Srwatson &mac_label_size, 0, "Pre-compiled MAC label size"); 146100979Srwatson 147100979Srwatsonstatic int mac_cache_fslabel_in_vnode = 1; 148100979SrwatsonSYSCTL_INT(_security_mac, OID_AUTO, cache_fslabel_in_vnode, CTLFLAG_RW, 149100979Srwatson &mac_cache_fslabel_in_vnode, 0, "Cache mount fslabel in vnode"); 150100979SrwatsonTUNABLE_INT("security.mac.cache_fslabel_in_vnode", 151100979Srwatson &mac_cache_fslabel_in_vnode); 152100979Srwatson 153100979Srwatsonstatic int mac_vnode_label_cache_hits = 0; 154100979SrwatsonSYSCTL_INT(_security_mac, OID_AUTO, vnode_label_cache_hits, CTLFLAG_RD, 155100979Srwatson &mac_vnode_label_cache_hits, 0, "Cache hits on vnode labels"); 156100979Srwatsonstatic int mac_vnode_label_cache_misses = 0; 157100979SrwatsonSYSCTL_INT(_security_mac, OID_AUTO, vnode_label_cache_misses, CTLFLAG_RD, 158100979Srwatson &mac_vnode_label_cache_misses, 0, "Cache misses on vnode labels"); 159103136Srwatson 160103136Srwatsonstatic int mac_mmap_revocation = 1; 161103136SrwatsonSYSCTL_INT(_security_mac, OID_AUTO, mmap_revocation, CTLFLAG_RW, 162103136Srwatson &mac_mmap_revocation, 0, "Revoke mmap access to files on subject " 163103136Srwatson "relabel"); 164101892Srwatsonstatic int mac_mmap_revocation_via_cow = 0; 165100979SrwatsonSYSCTL_INT(_security_mac, OID_AUTO, mmap_revocation_via_cow, CTLFLAG_RW, 166100979Srwatson &mac_mmap_revocation_via_cow, 0, "Revoke mmap access to files via " 167100979Srwatson "copy-on-write semantics, or by removing all write access"); 168100979Srwatson 169101988Srwatson#ifdef MAC_DEBUG 170104268SrwatsonSYSCTL_NODE(_security_mac, OID_AUTO, debug, CTLFLAG_RW, 0, 171104268Srwatson "TrustedBSD MAC debug info"); 172104268Srwatson 173104268Srwatsonstatic int mac_debug_label_fallback = 0; 174104268SrwatsonSYSCTL_INT(_security_mac_debug, OID_AUTO, label_fallback, CTLFLAG_RW, 175104268Srwatson &mac_debug_label_fallback, 0, "Filesystems should fall back to fs label" 176104268Srwatson "when label is corrupted."); 177104268SrwatsonTUNABLE_INT("security.mac.debug_label_fallback", 178104268Srwatson &mac_debug_label_fallback); 179104268Srwatson 180104517SrwatsonSYSCTL_NODE(_security_mac_debug, OID_AUTO, counters, CTLFLAG_RW, 0, 181104517Srwatson "TrustedBSD MAC object counters"); 182104517Srwatson 183100979Srwatsonstatic unsigned int nmacmbufs, nmaccreds, nmacifnets, nmacbpfdescs, 184100979Srwatson nmacsockets, nmacmounts, nmactemp, nmacvnodes, nmacdevfsdirents, 185100979Srwatson nmacipqs, nmacpipes; 186104517Srwatson 187104517SrwatsonSYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, mbufs, CTLFLAG_RD, 188100979Srwatson &nmacmbufs, 0, "number of mbufs in use"); 189104517SrwatsonSYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, creds, CTLFLAG_RD, 190100979Srwatson &nmaccreds, 0, "number of ucreds in use"); 191104517SrwatsonSYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, ifnets, CTLFLAG_RD, 192100979Srwatson &nmacifnets, 0, "number of ifnets in use"); 193104517SrwatsonSYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, ipqs, CTLFLAG_RD, 194100979Srwatson &nmacipqs, 0, "number of ipqs in use"); 195104517SrwatsonSYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, bpfdescs, CTLFLAG_RD, 196100979Srwatson &nmacbpfdescs, 0, "number of bpfdescs in use"); 197104517SrwatsonSYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, sockets, CTLFLAG_RD, 198100979Srwatson &nmacsockets, 0, "number of sockets in use"); 199104517SrwatsonSYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, pipes, CTLFLAG_RD, 200100979Srwatson &nmacpipes, 0, "number of pipes in use"); 201104517SrwatsonSYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, mounts, CTLFLAG_RD, 202100979Srwatson &nmacmounts, 0, "number of mounts in use"); 203104517SrwatsonSYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, temp, CTLFLAG_RD, 204100979Srwatson &nmactemp, 0, "number of temporary labels in use"); 205104517SrwatsonSYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, vnodes, CTLFLAG_RD, 206100979Srwatson &nmacvnodes, 0, "number of vnodes in use"); 207104517SrwatsonSYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, devfsdirents, CTLFLAG_RD, 208100979Srwatson &nmacdevfsdirents, 0, "number of devfs dirents inuse"); 209101988Srwatson#endif 210100979Srwatson 211100979Srwatsonstatic int error_select(int error1, int error2); 212100979Srwatsonstatic int mac_externalize(struct label *label, struct mac *mac); 213100979Srwatsonstatic int mac_policy_register(struct mac_policy_conf *mpc); 214100979Srwatsonstatic int mac_policy_unregister(struct mac_policy_conf *mpc); 215100979Srwatson 216100979Srwatsonstatic int mac_stdcreatevnode_ea(struct vnode *vp); 217104546Srwatsonstatic void mac_check_vnode_mmap_downgrade(struct ucred *cred, 218104546Srwatson struct vnode *vp, int *prot); 219100979Srwatsonstatic void mac_cred_mmapped_drop_perms_recurse(struct thread *td, 220100979Srwatson struct ucred *cred, struct vm_map *map); 221100979Srwatson 222104541Srwatsonstatic void mac_destroy_socket_label(struct label *label); 223104541Srwatson 224100979SrwatsonMALLOC_DEFINE(M_MACOPVEC, "macopvec", "MAC policy operation vector"); 225100979SrwatsonMALLOC_DEFINE(M_MACPIPELABEL, "macpipelabel", "MAC labels for pipes"); 226100979Srwatson 227100979Srwatson/* 228100979Srwatson * mac_policy_list_lock protects the consistency of 'mac_policy_list', 229100979Srwatson * the linked list of attached policy modules. Read-only consumers of 230100979Srwatson * the list must acquire a shared lock for the duration of their use; 231100979Srwatson * writers must acquire an exclusive lock. Note that for compound 232100979Srwatson * operations, locks should be held for the entire compound operation, 233100979Srwatson * and that this is not yet done for relabel requests. 234100979Srwatson */ 235100979Srwatsonstatic struct mtx mac_policy_list_lock; 236100979Srwatsonstatic LIST_HEAD(, mac_policy_conf) mac_policy_list; 237100979Srwatsonstatic int mac_policy_list_busy; 238100979Srwatson#define MAC_POLICY_LIST_LOCKINIT() mtx_init(&mac_policy_list_lock, \ 239100979Srwatson "mac_policy_list_lock", NULL, MTX_DEF); 240100979Srwatson#define MAC_POLICY_LIST_LOCK() mtx_lock(&mac_policy_list_lock); 241100979Srwatson#define MAC_POLICY_LIST_UNLOCK() mtx_unlock(&mac_policy_list_lock); 242100979Srwatson 243100979Srwatson#define MAC_POLICY_LIST_BUSY() do { \ 244100979Srwatson MAC_POLICY_LIST_LOCK(); \ 245100979Srwatson mac_policy_list_busy++; \ 246100979Srwatson MAC_POLICY_LIST_UNLOCK(); \ 247100979Srwatson} while (0) 248100979Srwatson 249100979Srwatson#define MAC_POLICY_LIST_UNBUSY() do { \ 250100979Srwatson MAC_POLICY_LIST_LOCK(); \ 251100979Srwatson mac_policy_list_busy--; \ 252100979Srwatson if (mac_policy_list_busy < 0) \ 253100979Srwatson panic("Extra mac_policy_list_busy--"); \ 254100979Srwatson MAC_POLICY_LIST_UNLOCK(); \ 255100979Srwatson} while (0) 256100979Srwatson 257100979Srwatson/* 258100979Srwatson * MAC_CHECK performs the designated check by walking the policy 259100979Srwatson * module list and checking with each as to how it feels about the 260100979Srwatson * request. Note that it returns its value via 'error' in the scope 261100979Srwatson * of the caller. 262100979Srwatson */ 263100979Srwatson#define MAC_CHECK(check, args...) do { \ 264100979Srwatson struct mac_policy_conf *mpc; \ 265100979Srwatson \ 266100979Srwatson error = 0; \ 267100979Srwatson MAC_POLICY_LIST_BUSY(); \ 268100979Srwatson LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { \ 269100979Srwatson if (mpc->mpc_ops->mpo_ ## check != NULL) \ 270100979Srwatson error = error_select( \ 271100979Srwatson mpc->mpc_ops->mpo_ ## check (args), \ 272100979Srwatson error); \ 273100979Srwatson } \ 274100979Srwatson MAC_POLICY_LIST_UNBUSY(); \ 275100979Srwatson} while (0) 276100979Srwatson 277100979Srwatson/* 278100979Srwatson * MAC_BOOLEAN performs the designated boolean composition by walking 279100979Srwatson * the module list, invoking each instance of the operation, and 280100979Srwatson * combining the results using the passed C operator. Note that it 281100979Srwatson * returns its value via 'result' in the scope of the caller, which 282100979Srwatson * should be initialized by the caller in a meaningful way to get 283100979Srwatson * a meaningful result. 284100979Srwatson */ 285100979Srwatson#define MAC_BOOLEAN(operation, composition, args...) do { \ 286100979Srwatson struct mac_policy_conf *mpc; \ 287100979Srwatson \ 288100979Srwatson MAC_POLICY_LIST_BUSY(); \ 289100979Srwatson LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { \ 290100979Srwatson if (mpc->mpc_ops->mpo_ ## operation != NULL) \ 291100979Srwatson result = result composition \ 292100979Srwatson mpc->mpc_ops->mpo_ ## operation (args); \ 293100979Srwatson } \ 294100979Srwatson MAC_POLICY_LIST_UNBUSY(); \ 295100979Srwatson} while (0) 296100979Srwatson 297100979Srwatson/* 298100979Srwatson * MAC_PERFORM performs the designated operation by walking the policy 299100979Srwatson * module list and invoking that operation for each policy. 300100979Srwatson */ 301100979Srwatson#define MAC_PERFORM(operation, args...) do { \ 302100979Srwatson struct mac_policy_conf *mpc; \ 303100979Srwatson \ 304100979Srwatson MAC_POLICY_LIST_BUSY(); \ 305100979Srwatson LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { \ 306100979Srwatson if (mpc->mpc_ops->mpo_ ## operation != NULL) \ 307100979Srwatson mpc->mpc_ops->mpo_ ## operation (args); \ 308100979Srwatson } \ 309100979Srwatson MAC_POLICY_LIST_UNBUSY(); \ 310100979Srwatson} while (0) 311100979Srwatson 312100979Srwatson/* 313100979Srwatson * Initialize the MAC subsystem, including appropriate SMP locks. 314100979Srwatson */ 315100979Srwatsonstatic void 316100979Srwatsonmac_init(void) 317100979Srwatson{ 318100979Srwatson 319100979Srwatson LIST_INIT(&mac_policy_list); 320100979Srwatson MAC_POLICY_LIST_LOCKINIT(); 321100979Srwatson} 322100979Srwatson 323100979Srwatson/* 324100979Srwatson * For the purposes of modules that want to know if they were loaded 325100979Srwatson * "early", set the mac_late flag once we've processed modules either 326100979Srwatson * linked into the kernel, or loaded before the kernel startup. 327100979Srwatson */ 328100979Srwatsonstatic void 329100979Srwatsonmac_late_init(void) 330100979Srwatson{ 331100979Srwatson 332100979Srwatson mac_late = 1; 333100979Srwatson} 334100979Srwatson 335100979Srwatson/* 336100979Srwatson * Allow MAC policy modules to register during boot, etc. 337100979Srwatson */ 338100894Srwatsonint 339100979Srwatsonmac_policy_modevent(module_t mod, int type, void *data) 340100979Srwatson{ 341100979Srwatson struct mac_policy_conf *mpc; 342100979Srwatson int error; 343100979Srwatson 344100979Srwatson error = 0; 345100979Srwatson mpc = (struct mac_policy_conf *) data; 346100979Srwatson 347100979Srwatson switch (type) { 348100979Srwatson case MOD_LOAD: 349100979Srwatson if (mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_NOTLATE && 350100979Srwatson mac_late) { 351100979Srwatson printf("mac_policy_modevent: can't load %s policy " 352100979Srwatson "after booting\n", mpc->mpc_name); 353100979Srwatson error = EBUSY; 354100979Srwatson break; 355100979Srwatson } 356100979Srwatson error = mac_policy_register(mpc); 357100979Srwatson break; 358100979Srwatson case MOD_UNLOAD: 359100979Srwatson /* Don't unregister the module if it was never registered. */ 360100979Srwatson if ((mpc->mpc_runtime_flags & MPC_RUNTIME_FLAG_REGISTERED) 361100979Srwatson != 0) 362100979Srwatson error = mac_policy_unregister(mpc); 363100979Srwatson else 364100979Srwatson error = 0; 365100979Srwatson break; 366100979Srwatson default: 367100979Srwatson break; 368100979Srwatson } 369100979Srwatson 370100979Srwatson return (error); 371100979Srwatson} 372100979Srwatson 373100979Srwatsonstatic int 374100979Srwatsonmac_policy_register(struct mac_policy_conf *mpc) 375100979Srwatson{ 376100979Srwatson struct mac_policy_conf *tmpc; 377100979Srwatson struct mac_policy_op_entry *mpe; 378100979Srwatson int slot; 379100979Srwatson 380103570Srwatson MALLOC(mpc->mpc_ops, struct mac_policy_ops *, sizeof(*mpc->mpc_ops), 381103570Srwatson M_MACOPVEC, M_WAITOK | M_ZERO); 382100979Srwatson for (mpe = mpc->mpc_entries; mpe->mpe_constant != MAC_OP_LAST; mpe++) { 383100979Srwatson switch (mpe->mpe_constant) { 384100979Srwatson case MAC_OP_LAST: 385100979Srwatson /* 386100979Srwatson * Doesn't actually happen, but this allows checking 387100979Srwatson * that all enumerated values are handled. 388100979Srwatson */ 389100979Srwatson break; 390100979Srwatson case MAC_DESTROY: 391100979Srwatson mpc->mpc_ops->mpo_destroy = 392100979Srwatson mpe->mpe_function; 393100979Srwatson break; 394100979Srwatson case MAC_INIT: 395100979Srwatson mpc->mpc_ops->mpo_init = 396100979Srwatson mpe->mpe_function; 397100979Srwatson break; 398102123Srwatson case MAC_SYSCALL: 399102123Srwatson mpc->mpc_ops->mpo_syscall = 400102123Srwatson mpe->mpe_function; 401102123Srwatson break; 402104514Srwatson case MAC_INIT_BPFDESC_LABEL: 403104514Srwatson mpc->mpc_ops->mpo_init_bpfdesc_label = 404100979Srwatson mpe->mpe_function; 405100979Srwatson break; 406104514Srwatson case MAC_INIT_CRED_LABEL: 407104514Srwatson mpc->mpc_ops->mpo_init_cred_label = 408100979Srwatson mpe->mpe_function; 409100979Srwatson break; 410104514Srwatson case MAC_INIT_DEVFSDIRENT_LABEL: 411104514Srwatson mpc->mpc_ops->mpo_init_devfsdirent_label = 412100979Srwatson mpe->mpe_function; 413100979Srwatson break; 414104514Srwatson case MAC_INIT_IFNET_LABEL: 415104514Srwatson mpc->mpc_ops->mpo_init_ifnet_label = 416100979Srwatson mpe->mpe_function; 417100979Srwatson break; 418104514Srwatson case MAC_INIT_IPQ_LABEL: 419104514Srwatson mpc->mpc_ops->mpo_init_ipq_label = 420100979Srwatson mpe->mpe_function; 421100979Srwatson break; 422104514Srwatson case MAC_INIT_MBUF_LABEL: 423104514Srwatson mpc->mpc_ops->mpo_init_mbuf_label = 424100979Srwatson mpe->mpe_function; 425100979Srwatson break; 426104514Srwatson case MAC_INIT_MOUNT_LABEL: 427104514Srwatson mpc->mpc_ops->mpo_init_mount_label = 428100979Srwatson mpe->mpe_function; 429100979Srwatson break; 430104514Srwatson case MAC_INIT_MOUNT_FS_LABEL: 431104514Srwatson mpc->mpc_ops->mpo_init_mount_fs_label = 432100979Srwatson mpe->mpe_function; 433100979Srwatson break; 434104514Srwatson case MAC_INIT_PIPE_LABEL: 435104514Srwatson mpc->mpc_ops->mpo_init_pipe_label = 436100979Srwatson mpe->mpe_function; 437100979Srwatson break; 438104514Srwatson case MAC_INIT_SOCKET_LABEL: 439104514Srwatson mpc->mpc_ops->mpo_init_socket_label = 440100979Srwatson mpe->mpe_function; 441100979Srwatson break; 442104514Srwatson case MAC_INIT_SOCKET_PEER_LABEL: 443104514Srwatson mpc->mpc_ops->mpo_init_socket_peer_label = 444100979Srwatson mpe->mpe_function; 445100979Srwatson break; 446104514Srwatson case MAC_INIT_TEMP_LABEL: 447104514Srwatson mpc->mpc_ops->mpo_init_temp_label = 448100979Srwatson mpe->mpe_function; 449100979Srwatson break; 450104514Srwatson case MAC_INIT_VNODE_LABEL: 451104514Srwatson mpc->mpc_ops->mpo_init_vnode_label = 452100979Srwatson mpe->mpe_function; 453100979Srwatson break; 454104514Srwatson case MAC_DESTROY_BPFDESC_LABEL: 455104514Srwatson mpc->mpc_ops->mpo_destroy_bpfdesc_label = 456100979Srwatson mpe->mpe_function; 457100979Srwatson break; 458104514Srwatson case MAC_DESTROY_CRED_LABEL: 459104514Srwatson mpc->mpc_ops->mpo_destroy_cred_label = 460100979Srwatson mpe->mpe_function; 461100979Srwatson break; 462104514Srwatson case MAC_DESTROY_DEVFSDIRENT_LABEL: 463104514Srwatson mpc->mpc_ops->mpo_destroy_devfsdirent_label = 464100979Srwatson mpe->mpe_function; 465100979Srwatson break; 466104514Srwatson case MAC_DESTROY_IFNET_LABEL: 467104514Srwatson mpc->mpc_ops->mpo_destroy_ifnet_label = 468100979Srwatson mpe->mpe_function; 469100979Srwatson break; 470104514Srwatson case MAC_DESTROY_IPQ_LABEL: 471104514Srwatson mpc->mpc_ops->mpo_destroy_ipq_label = 472100979Srwatson mpe->mpe_function; 473100979Srwatson break; 474104514Srwatson case MAC_DESTROY_MBUF_LABEL: 475104514Srwatson mpc->mpc_ops->mpo_destroy_mbuf_label = 476100979Srwatson mpe->mpe_function; 477100979Srwatson break; 478104514Srwatson case MAC_DESTROY_MOUNT_LABEL: 479104514Srwatson mpc->mpc_ops->mpo_destroy_mount_label = 480100979Srwatson mpe->mpe_function; 481100979Srwatson break; 482104514Srwatson case MAC_DESTROY_MOUNT_FS_LABEL: 483104514Srwatson mpc->mpc_ops->mpo_destroy_mount_fs_label = 484100979Srwatson mpe->mpe_function; 485100979Srwatson break; 486104514Srwatson case MAC_DESTROY_PIPE_LABEL: 487104514Srwatson mpc->mpc_ops->mpo_destroy_pipe_label = 488100979Srwatson mpe->mpe_function; 489100979Srwatson break; 490104514Srwatson case MAC_DESTROY_SOCKET_LABEL: 491104514Srwatson mpc->mpc_ops->mpo_destroy_socket_label = 492104514Srwatson mpe->mpe_function; 493104514Srwatson break; 494104514Srwatson case MAC_DESTROY_SOCKET_PEER_LABEL: 495104514Srwatson mpc->mpc_ops->mpo_destroy_socket_peer_label = 496104514Srwatson mpe->mpe_function; 497104514Srwatson break; 498104514Srwatson case MAC_DESTROY_TEMP_LABEL: 499104514Srwatson mpc->mpc_ops->mpo_destroy_temp_label = 500104514Srwatson mpe->mpe_function; 501104514Srwatson break; 502104514Srwatson case MAC_DESTROY_VNODE_LABEL: 503104514Srwatson mpc->mpc_ops->mpo_destroy_vnode_label = 504104514Srwatson mpe->mpe_function; 505104514Srwatson break; 506100979Srwatson case MAC_EXTERNALIZE: 507100979Srwatson mpc->mpc_ops->mpo_externalize = 508100979Srwatson mpe->mpe_function; 509100979Srwatson break; 510100979Srwatson case MAC_INTERNALIZE: 511100979Srwatson mpc->mpc_ops->mpo_internalize = 512100979Srwatson mpe->mpe_function; 513100979Srwatson break; 514100979Srwatson case MAC_CREATE_DEVFS_DEVICE: 515100979Srwatson mpc->mpc_ops->mpo_create_devfs_device = 516100979Srwatson mpe->mpe_function; 517100979Srwatson break; 518100979Srwatson case MAC_CREATE_DEVFS_DIRECTORY: 519100979Srwatson mpc->mpc_ops->mpo_create_devfs_directory = 520100979Srwatson mpe->mpe_function; 521100979Srwatson break; 522104533Srwatson case MAC_CREATE_DEVFS_SYMLINK: 523104533Srwatson mpc->mpc_ops->mpo_create_devfs_symlink = 524104533Srwatson mpe->mpe_function; 525104533Srwatson break; 526100979Srwatson case MAC_CREATE_DEVFS_VNODE: 527100979Srwatson mpc->mpc_ops->mpo_create_devfs_vnode = 528100979Srwatson mpe->mpe_function; 529100979Srwatson break; 530100979Srwatson case MAC_STDCREATEVNODE_EA: 531100979Srwatson mpc->mpc_ops->mpo_stdcreatevnode_ea = 532100979Srwatson mpe->mpe_function; 533100979Srwatson break; 534100979Srwatson case MAC_CREATE_VNODE: 535100979Srwatson mpc->mpc_ops->mpo_create_vnode = 536100979Srwatson mpe->mpe_function; 537100979Srwatson break; 538100979Srwatson case MAC_CREATE_MOUNT: 539100979Srwatson mpc->mpc_ops->mpo_create_mount = 540100979Srwatson mpe->mpe_function; 541100979Srwatson break; 542100979Srwatson case MAC_CREATE_ROOT_MOUNT: 543100979Srwatson mpc->mpc_ops->mpo_create_root_mount = 544100979Srwatson mpe->mpe_function; 545100979Srwatson break; 546100979Srwatson case MAC_RELABEL_VNODE: 547100979Srwatson mpc->mpc_ops->mpo_relabel_vnode = 548100979Srwatson mpe->mpe_function; 549100979Srwatson break; 550100979Srwatson case MAC_UPDATE_DEVFSDIRENT: 551100979Srwatson mpc->mpc_ops->mpo_update_devfsdirent = 552100979Srwatson mpe->mpe_function; 553100979Srwatson break; 554100979Srwatson case MAC_UPDATE_PROCFSVNODE: 555100979Srwatson mpc->mpc_ops->mpo_update_procfsvnode = 556100979Srwatson mpe->mpe_function; 557100979Srwatson break; 558100979Srwatson case MAC_UPDATE_VNODE_FROM_EXTATTR: 559100979Srwatson mpc->mpc_ops->mpo_update_vnode_from_extattr = 560100979Srwatson mpe->mpe_function; 561100979Srwatson break; 562100979Srwatson case MAC_UPDATE_VNODE_FROM_EXTERNALIZED: 563100979Srwatson mpc->mpc_ops->mpo_update_vnode_from_externalized = 564100979Srwatson mpe->mpe_function; 565100979Srwatson break; 566100979Srwatson case MAC_UPDATE_VNODE_FROM_MOUNT: 567100979Srwatson mpc->mpc_ops->mpo_update_vnode_from_mount = 568100979Srwatson mpe->mpe_function; 569100979Srwatson break; 570100979Srwatson case MAC_CREATE_MBUF_FROM_SOCKET: 571100979Srwatson mpc->mpc_ops->mpo_create_mbuf_from_socket = 572100979Srwatson mpe->mpe_function; 573100979Srwatson break; 574100979Srwatson case MAC_CREATE_PIPE: 575100979Srwatson mpc->mpc_ops->mpo_create_pipe = 576100979Srwatson mpe->mpe_function; 577100979Srwatson break; 578100979Srwatson case MAC_CREATE_SOCKET: 579100979Srwatson mpc->mpc_ops->mpo_create_socket = 580100979Srwatson mpe->mpe_function; 581100979Srwatson break; 582100979Srwatson case MAC_CREATE_SOCKET_FROM_SOCKET: 583100979Srwatson mpc->mpc_ops->mpo_create_socket_from_socket = 584100979Srwatson mpe->mpe_function; 585100979Srwatson break; 586100979Srwatson case MAC_RELABEL_PIPE: 587100979Srwatson mpc->mpc_ops->mpo_relabel_pipe = 588100979Srwatson mpe->mpe_function; 589100979Srwatson break; 590100979Srwatson case MAC_RELABEL_SOCKET: 591100979Srwatson mpc->mpc_ops->mpo_relabel_socket = 592100979Srwatson mpe->mpe_function; 593100979Srwatson break; 594100979Srwatson case MAC_SET_SOCKET_PEER_FROM_MBUF: 595100979Srwatson mpc->mpc_ops->mpo_set_socket_peer_from_mbuf = 596100979Srwatson mpe->mpe_function; 597100979Srwatson break; 598100979Srwatson case MAC_SET_SOCKET_PEER_FROM_SOCKET: 599100979Srwatson mpc->mpc_ops->mpo_set_socket_peer_from_socket = 600100979Srwatson mpe->mpe_function; 601100979Srwatson break; 602100979Srwatson case MAC_CREATE_BPFDESC: 603100979Srwatson mpc->mpc_ops->mpo_create_bpfdesc = 604100979Srwatson mpe->mpe_function; 605100979Srwatson break; 606100979Srwatson case MAC_CREATE_DATAGRAM_FROM_IPQ: 607100979Srwatson mpc->mpc_ops->mpo_create_datagram_from_ipq = 608100979Srwatson mpe->mpe_function; 609100979Srwatson break; 610100979Srwatson case MAC_CREATE_FRAGMENT: 611100979Srwatson mpc->mpc_ops->mpo_create_fragment = 612100979Srwatson mpe->mpe_function; 613100979Srwatson break; 614100979Srwatson case MAC_CREATE_IFNET: 615100979Srwatson mpc->mpc_ops->mpo_create_ifnet = 616100979Srwatson mpe->mpe_function; 617100979Srwatson break; 618100979Srwatson case MAC_CREATE_IPQ: 619100979Srwatson mpc->mpc_ops->mpo_create_ipq = 620100979Srwatson mpe->mpe_function; 621100979Srwatson break; 622100979Srwatson case MAC_CREATE_MBUF_FROM_MBUF: 623100979Srwatson mpc->mpc_ops->mpo_create_mbuf_from_mbuf = 624100979Srwatson mpe->mpe_function; 625100979Srwatson break; 626100979Srwatson case MAC_CREATE_MBUF_LINKLAYER: 627100979Srwatson mpc->mpc_ops->mpo_create_mbuf_linklayer = 628100979Srwatson mpe->mpe_function; 629100979Srwatson break; 630100979Srwatson case MAC_CREATE_MBUF_FROM_BPFDESC: 631100979Srwatson mpc->mpc_ops->mpo_create_mbuf_from_bpfdesc = 632100979Srwatson mpe->mpe_function; 633100979Srwatson break; 634100979Srwatson case MAC_CREATE_MBUF_FROM_IFNET: 635100979Srwatson mpc->mpc_ops->mpo_create_mbuf_from_ifnet = 636100979Srwatson mpe->mpe_function; 637100979Srwatson break; 638100979Srwatson case MAC_CREATE_MBUF_MULTICAST_ENCAP: 639100979Srwatson mpc->mpc_ops->mpo_create_mbuf_multicast_encap = 640100979Srwatson mpe->mpe_function; 641100979Srwatson break; 642100979Srwatson case MAC_CREATE_MBUF_NETLAYER: 643100979Srwatson mpc->mpc_ops->mpo_create_mbuf_netlayer = 644100979Srwatson mpe->mpe_function; 645100979Srwatson break; 646100979Srwatson case MAC_FRAGMENT_MATCH: 647100979Srwatson mpc->mpc_ops->mpo_fragment_match = 648100979Srwatson mpe->mpe_function; 649100979Srwatson break; 650100979Srwatson case MAC_RELABEL_IFNET: 651100979Srwatson mpc->mpc_ops->mpo_relabel_ifnet = 652100979Srwatson mpe->mpe_function; 653100979Srwatson break; 654100979Srwatson case MAC_UPDATE_IPQ: 655100979Srwatson mpc->mpc_ops->mpo_update_ipq = 656100979Srwatson mpe->mpe_function; 657100979Srwatson break; 658100979Srwatson case MAC_CREATE_CRED: 659100979Srwatson mpc->mpc_ops->mpo_create_cred = 660100979Srwatson mpe->mpe_function; 661100979Srwatson break; 662100979Srwatson case MAC_EXECVE_TRANSITION: 663100979Srwatson mpc->mpc_ops->mpo_execve_transition = 664100979Srwatson mpe->mpe_function; 665100979Srwatson break; 666100979Srwatson case MAC_EXECVE_WILL_TRANSITION: 667100979Srwatson mpc->mpc_ops->mpo_execve_will_transition = 668100979Srwatson mpe->mpe_function; 669100979Srwatson break; 670100979Srwatson case MAC_CREATE_PROC0: 671104518Srwatson mpc->mpc_ops->mpo_create_proc0 = 672104518Srwatson mpe->mpe_function; 673100979Srwatson break; 674100979Srwatson case MAC_CREATE_PROC1: 675104518Srwatson mpc->mpc_ops->mpo_create_proc1 = 676104518Srwatson mpe->mpe_function; 677100979Srwatson break; 678100979Srwatson case MAC_RELABEL_CRED: 679100979Srwatson mpc->mpc_ops->mpo_relabel_cred = 680100979Srwatson mpe->mpe_function; 681100979Srwatson break; 682104338Srwatson case MAC_THREAD_USERRET: 683104338Srwatson mpc->mpc_ops->mpo_thread_userret = 684104338Srwatson mpe->mpe_function; 685104338Srwatson break; 686100979Srwatson case MAC_CHECK_BPFDESC_RECEIVE: 687100979Srwatson mpc->mpc_ops->mpo_check_bpfdesc_receive = 688100979Srwatson mpe->mpe_function; 689100979Srwatson break; 690100979Srwatson case MAC_CHECK_CRED_RELABEL: 691100979Srwatson mpc->mpc_ops->mpo_check_cred_relabel = 692100979Srwatson mpe->mpe_function; 693100979Srwatson break; 694100979Srwatson case MAC_CHECK_CRED_VISIBLE: 695100979Srwatson mpc->mpc_ops->mpo_check_cred_visible = 696100979Srwatson mpe->mpe_function; 697100979Srwatson break; 698100979Srwatson case MAC_CHECK_IFNET_RELABEL: 699100979Srwatson mpc->mpc_ops->mpo_check_ifnet_relabel = 700100979Srwatson mpe->mpe_function; 701100979Srwatson break; 702100979Srwatson case MAC_CHECK_IFNET_TRANSMIT: 703100979Srwatson mpc->mpc_ops->mpo_check_ifnet_transmit = 704100979Srwatson mpe->mpe_function; 705100979Srwatson break; 706100979Srwatson case MAC_CHECK_MOUNT_STAT: 707100979Srwatson mpc->mpc_ops->mpo_check_mount_stat = 708100979Srwatson mpe->mpe_function; 709100979Srwatson break; 710100979Srwatson case MAC_CHECK_PIPE_IOCTL: 711100979Srwatson mpc->mpc_ops->mpo_check_pipe_ioctl = 712100979Srwatson mpe->mpe_function; 713100979Srwatson break; 714102115Srwatson case MAC_CHECK_PIPE_POLL: 715102115Srwatson mpc->mpc_ops->mpo_check_pipe_poll = 716100979Srwatson mpe->mpe_function; 717100979Srwatson break; 718102115Srwatson case MAC_CHECK_PIPE_READ: 719102115Srwatson mpc->mpc_ops->mpo_check_pipe_read = 720102115Srwatson mpe->mpe_function; 721102115Srwatson break; 722100979Srwatson case MAC_CHECK_PIPE_RELABEL: 723100979Srwatson mpc->mpc_ops->mpo_check_pipe_relabel = 724100979Srwatson mpe->mpe_function; 725100979Srwatson break; 726102115Srwatson case MAC_CHECK_PIPE_STAT: 727102115Srwatson mpc->mpc_ops->mpo_check_pipe_stat = 728102115Srwatson mpe->mpe_function; 729102115Srwatson break; 730102115Srwatson case MAC_CHECK_PIPE_WRITE: 731102115Srwatson mpc->mpc_ops->mpo_check_pipe_write = 732102115Srwatson mpe->mpe_function; 733102115Srwatson break; 734100979Srwatson case MAC_CHECK_PROC_DEBUG: 735100979Srwatson mpc->mpc_ops->mpo_check_proc_debug = 736100979Srwatson mpe->mpe_function; 737100979Srwatson break; 738100979Srwatson case MAC_CHECK_PROC_SCHED: 739100979Srwatson mpc->mpc_ops->mpo_check_proc_sched = 740100979Srwatson mpe->mpe_function; 741100979Srwatson break; 742100979Srwatson case MAC_CHECK_PROC_SIGNAL: 743100979Srwatson mpc->mpc_ops->mpo_check_proc_signal = 744100979Srwatson mpe->mpe_function; 745100979Srwatson break; 746100979Srwatson case MAC_CHECK_SOCKET_BIND: 747100979Srwatson mpc->mpc_ops->mpo_check_socket_bind = 748100979Srwatson mpe->mpe_function; 749100979Srwatson break; 750100979Srwatson case MAC_CHECK_SOCKET_CONNECT: 751100979Srwatson mpc->mpc_ops->mpo_check_socket_connect = 752100979Srwatson mpe->mpe_function; 753100979Srwatson break; 754101933Srwatson case MAC_CHECK_SOCKET_DELIVER: 755101933Srwatson mpc->mpc_ops->mpo_check_socket_deliver = 756101933Srwatson mpe->mpe_function; 757101933Srwatson break; 758100979Srwatson case MAC_CHECK_SOCKET_LISTEN: 759100979Srwatson mpc->mpc_ops->mpo_check_socket_listen = 760100979Srwatson mpe->mpe_function; 761100979Srwatson break; 762104571Srwatson case MAC_CHECK_SOCKET_RECEIVE: 763104571Srwatson mpc->mpc_ops->mpo_check_socket_receive = 764104571Srwatson mpe->mpe_function; 765104571Srwatson break; 766100979Srwatson case MAC_CHECK_SOCKET_RELABEL: 767100979Srwatson mpc->mpc_ops->mpo_check_socket_relabel = 768100979Srwatson mpe->mpe_function; 769100979Srwatson break; 770104571Srwatson case MAC_CHECK_SOCKET_SEND: 771104571Srwatson mpc->mpc_ops->mpo_check_socket_send = 772104571Srwatson mpe->mpe_function; 773104571Srwatson break; 774100979Srwatson case MAC_CHECK_SOCKET_VISIBLE: 775100979Srwatson mpc->mpc_ops->mpo_check_socket_visible = 776100979Srwatson mpe->mpe_function; 777100979Srwatson break; 778100979Srwatson case MAC_CHECK_VNODE_ACCESS: 779100979Srwatson mpc->mpc_ops->mpo_check_vnode_access = 780100979Srwatson mpe->mpe_function; 781100979Srwatson break; 782100979Srwatson case MAC_CHECK_VNODE_CHDIR: 783100979Srwatson mpc->mpc_ops->mpo_check_vnode_chdir = 784100979Srwatson mpe->mpe_function; 785100979Srwatson break; 786100979Srwatson case MAC_CHECK_VNODE_CHROOT: 787100979Srwatson mpc->mpc_ops->mpo_check_vnode_chroot = 788100979Srwatson mpe->mpe_function; 789100979Srwatson break; 790100979Srwatson case MAC_CHECK_VNODE_CREATE: 791100979Srwatson mpc->mpc_ops->mpo_check_vnode_create = 792100979Srwatson mpe->mpe_function; 793100979Srwatson break; 794100979Srwatson case MAC_CHECK_VNODE_DELETE: 795100979Srwatson mpc->mpc_ops->mpo_check_vnode_delete = 796100979Srwatson mpe->mpe_function; 797100979Srwatson break; 798100979Srwatson case MAC_CHECK_VNODE_DELETEACL: 799100979Srwatson mpc->mpc_ops->mpo_check_vnode_deleteacl = 800100979Srwatson mpe->mpe_function; 801100979Srwatson break; 802100979Srwatson case MAC_CHECK_VNODE_EXEC: 803100979Srwatson mpc->mpc_ops->mpo_check_vnode_exec = 804100979Srwatson mpe->mpe_function; 805100979Srwatson break; 806100979Srwatson case MAC_CHECK_VNODE_GETACL: 807100979Srwatson mpc->mpc_ops->mpo_check_vnode_getacl = 808100979Srwatson mpe->mpe_function; 809100979Srwatson break; 810100979Srwatson case MAC_CHECK_VNODE_GETEXTATTR: 811100979Srwatson mpc->mpc_ops->mpo_check_vnode_getextattr = 812100979Srwatson mpe->mpe_function; 813100979Srwatson break; 814104529Srwatson case MAC_CHECK_VNODE_LINK: 815104529Srwatson mpc->mpc_ops->mpo_check_vnode_link = 816104529Srwatson mpe->mpe_function; 817104529Srwatson break; 818100979Srwatson case MAC_CHECK_VNODE_LOOKUP: 819100979Srwatson mpc->mpc_ops->mpo_check_vnode_lookup = 820100979Srwatson mpe->mpe_function; 821100979Srwatson break; 822104546Srwatson case MAC_CHECK_VNODE_MMAP: 823104546Srwatson mpc->mpc_ops->mpo_check_vnode_mmap = 824100979Srwatson mpe->mpe_function; 825100979Srwatson break; 826104546Srwatson case MAC_CHECK_VNODE_MMAP_DOWNGRADE: 827104546Srwatson mpc->mpc_ops->mpo_check_vnode_mmap_downgrade = 828104546Srwatson mpe->mpe_function; 829104546Srwatson break; 830104546Srwatson case MAC_CHECK_VNODE_MPROTECT: 831104546Srwatson mpc->mpc_ops->mpo_check_vnode_mprotect = 832104546Srwatson mpe->mpe_function; 833104546Srwatson break; 834100979Srwatson case MAC_CHECK_VNODE_OPEN: 835100979Srwatson mpc->mpc_ops->mpo_check_vnode_open = 836100979Srwatson mpe->mpe_function; 837100979Srwatson break; 838102112Srwatson case MAC_CHECK_VNODE_POLL: 839102112Srwatson mpc->mpc_ops->mpo_check_vnode_poll = 840102112Srwatson mpe->mpe_function; 841102112Srwatson break; 842102112Srwatson case MAC_CHECK_VNODE_READ: 843102112Srwatson mpc->mpc_ops->mpo_check_vnode_read = 844102112Srwatson mpe->mpe_function; 845102112Srwatson break; 846100979Srwatson case MAC_CHECK_VNODE_READDIR: 847100979Srwatson mpc->mpc_ops->mpo_check_vnode_readdir = 848100979Srwatson mpe->mpe_function; 849100979Srwatson break; 850100979Srwatson case MAC_CHECK_VNODE_READLINK: 851100979Srwatson mpc->mpc_ops->mpo_check_vnode_readlink = 852100979Srwatson mpe->mpe_function; 853100979Srwatson break; 854100979Srwatson case MAC_CHECK_VNODE_RELABEL: 855100979Srwatson mpc->mpc_ops->mpo_check_vnode_relabel = 856100979Srwatson mpe->mpe_function; 857100979Srwatson break; 858100979Srwatson case MAC_CHECK_VNODE_RENAME_FROM: 859100979Srwatson mpc->mpc_ops->mpo_check_vnode_rename_from = 860100979Srwatson mpe->mpe_function; 861100979Srwatson break; 862100979Srwatson case MAC_CHECK_VNODE_RENAME_TO: 863100979Srwatson mpc->mpc_ops->mpo_check_vnode_rename_to = 864100979Srwatson mpe->mpe_function; 865100979Srwatson break; 866100979Srwatson case MAC_CHECK_VNODE_REVOKE: 867100979Srwatson mpc->mpc_ops->mpo_check_vnode_revoke = 868100979Srwatson mpe->mpe_function; 869100979Srwatson break; 870100979Srwatson case MAC_CHECK_VNODE_SETACL: 871100979Srwatson mpc->mpc_ops->mpo_check_vnode_setacl = 872100979Srwatson mpe->mpe_function; 873100979Srwatson break; 874100979Srwatson case MAC_CHECK_VNODE_SETEXTATTR: 875100979Srwatson mpc->mpc_ops->mpo_check_vnode_setextattr = 876100979Srwatson mpe->mpe_function; 877100979Srwatson break; 878100979Srwatson case MAC_CHECK_VNODE_SETFLAGS: 879100979Srwatson mpc->mpc_ops->mpo_check_vnode_setflags = 880100979Srwatson mpe->mpe_function; 881100979Srwatson break; 882100979Srwatson case MAC_CHECK_VNODE_SETMODE: 883100979Srwatson mpc->mpc_ops->mpo_check_vnode_setmode = 884100979Srwatson mpe->mpe_function; 885100979Srwatson break; 886100979Srwatson case MAC_CHECK_VNODE_SETOWNER: 887100979Srwatson mpc->mpc_ops->mpo_check_vnode_setowner = 888100979Srwatson mpe->mpe_function; 889100979Srwatson break; 890100979Srwatson case MAC_CHECK_VNODE_SETUTIMES: 891100979Srwatson mpc->mpc_ops->mpo_check_vnode_setutimes = 892100979Srwatson mpe->mpe_function; 893100979Srwatson break; 894100979Srwatson case MAC_CHECK_VNODE_STAT: 895100979Srwatson mpc->mpc_ops->mpo_check_vnode_stat = 896100979Srwatson mpe->mpe_function; 897100979Srwatson break; 898102112Srwatson case MAC_CHECK_VNODE_WRITE: 899102112Srwatson mpc->mpc_ops->mpo_check_vnode_write = 900102112Srwatson mpe->mpe_function; 901102112Srwatson break; 902100979Srwatson/* 903100979Srwatson default: 904100979Srwatson printf("MAC policy `%s': unknown operation %d\n", 905100979Srwatson mpc->mpc_name, mpe->mpe_constant); 906100979Srwatson return (EINVAL); 907100979Srwatson*/ 908100979Srwatson } 909100979Srwatson } 910100979Srwatson MAC_POLICY_LIST_LOCK(); 911100979Srwatson if (mac_policy_list_busy > 0) { 912100979Srwatson MAC_POLICY_LIST_UNLOCK(); 913100979Srwatson FREE(mpc->mpc_ops, M_MACOPVEC); 914100979Srwatson mpc->mpc_ops = NULL; 915100979Srwatson return (EBUSY); 916100979Srwatson } 917100979Srwatson LIST_FOREACH(tmpc, &mac_policy_list, mpc_list) { 918100979Srwatson if (strcmp(tmpc->mpc_name, mpc->mpc_name) == 0) { 919100979Srwatson MAC_POLICY_LIST_UNLOCK(); 920100979Srwatson FREE(mpc->mpc_ops, M_MACOPVEC); 921100979Srwatson mpc->mpc_ops = NULL; 922100979Srwatson return (EEXIST); 923100979Srwatson } 924100979Srwatson } 925100979Srwatson if (mpc->mpc_field_off != NULL) { 926100979Srwatson slot = ffs(mac_policy_offsets_free); 927100979Srwatson if (slot == 0) { 928100979Srwatson MAC_POLICY_LIST_UNLOCK(); 929100979Srwatson FREE(mpc->mpc_ops, M_MACOPVEC); 930100979Srwatson mpc->mpc_ops = NULL; 931100979Srwatson return (ENOMEM); 932100979Srwatson } 933100979Srwatson slot--; 934100979Srwatson mac_policy_offsets_free &= ~(1 << slot); 935100979Srwatson *mpc->mpc_field_off = slot; 936100979Srwatson } 937100979Srwatson mpc->mpc_runtime_flags |= MPC_RUNTIME_FLAG_REGISTERED; 938100979Srwatson LIST_INSERT_HEAD(&mac_policy_list, mpc, mpc_list); 939100979Srwatson 940100979Srwatson /* Per-policy initialization. */ 941100979Srwatson if (mpc->mpc_ops->mpo_init != NULL) 942100979Srwatson (*(mpc->mpc_ops->mpo_init))(mpc); 943100979Srwatson MAC_POLICY_LIST_UNLOCK(); 944100979Srwatson 945100979Srwatson printf("Security policy loaded: %s (%s)\n", mpc->mpc_fullname, 946100979Srwatson mpc->mpc_name); 947100979Srwatson 948100979Srwatson return (0); 949100979Srwatson} 950100979Srwatson 951100979Srwatsonstatic int 952100979Srwatsonmac_policy_unregister(struct mac_policy_conf *mpc) 953100979Srwatson{ 954100979Srwatson 955104520Srwatson /* 956104520Srwatson * If we fail the load, we may get a request to unload. Check 957104520Srwatson * to see if we did the run-time registration, and if not, 958104520Srwatson * silently succeed. 959104520Srwatson */ 960104520Srwatson MAC_POLICY_LIST_LOCK(); 961104520Srwatson if ((mpc->mpc_runtime_flags & MPC_RUNTIME_FLAG_REGISTERED) == 0) { 962104520Srwatson MAC_POLICY_LIST_UNLOCK(); 963104520Srwatson return (0); 964104520Srwatson } 965100979Srwatson#if 0 966100979Srwatson /* 967100979Srwatson * Don't allow unloading modules with private data. 968100979Srwatson */ 969104520Srwatson if (mpc->mpc_field_off != NULL) { 970104520Srwatson MAC_POLICY_LIST_UNLOCK(); 971100979Srwatson return (EBUSY); 972104520Srwatson } 973100979Srwatson#endif 974104520Srwatson /* 975104520Srwatson * Only allow the unload to proceed if the module is unloadable 976104520Srwatson * by its own definition. 977104520Srwatson */ 978104520Srwatson if ((mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_UNLOADOK) == 0) { 979104520Srwatson MAC_POLICY_LIST_UNLOCK(); 980100979Srwatson return (EBUSY); 981104520Srwatson } 982104520Srwatson /* 983104520Srwatson * Right now, we EBUSY if the list is in use. In the future, 984104520Srwatson * for reliability reasons, we might want to sleep and wakeup 985104520Srwatson * later to try again. 986104520Srwatson */ 987100979Srwatson if (mac_policy_list_busy > 0) { 988100979Srwatson MAC_POLICY_LIST_UNLOCK(); 989100979Srwatson return (EBUSY); 990100979Srwatson } 991100979Srwatson if (mpc->mpc_ops->mpo_destroy != NULL) 992100979Srwatson (*(mpc->mpc_ops->mpo_destroy))(mpc); 993100979Srwatson 994100979Srwatson LIST_REMOVE(mpc, mpc_list); 995100979Srwatson MAC_POLICY_LIST_UNLOCK(); 996100979Srwatson 997100979Srwatson FREE(mpc->mpc_ops, M_MACOPVEC); 998100979Srwatson mpc->mpc_ops = NULL; 999105474Srwatson mpc->mpc_runtime_flags &= ~MPC_RUNTIME_FLAG_REGISTERED; 1000100979Srwatson 1001100979Srwatson printf("Security policy unload: %s (%s)\n", mpc->mpc_fullname, 1002100979Srwatson mpc->mpc_name); 1003100979Srwatson 1004100979Srwatson return (0); 1005100979Srwatson} 1006100979Srwatson 1007100979Srwatson/* 1008100979Srwatson * Define an error value precedence, and given two arguments, selects the 1009100979Srwatson * value with the higher precedence. 1010100979Srwatson */ 1011100979Srwatsonstatic int 1012100979Srwatsonerror_select(int error1, int error2) 1013100979Srwatson{ 1014100979Srwatson 1015100979Srwatson /* Certain decision-making errors take top priority. */ 1016100979Srwatson if (error1 == EDEADLK || error2 == EDEADLK) 1017100979Srwatson return (EDEADLK); 1018100979Srwatson 1019100979Srwatson /* Invalid arguments should be reported where possible. */ 1020100979Srwatson if (error1 == EINVAL || error2 == EINVAL) 1021100979Srwatson return (EINVAL); 1022100979Srwatson 1023100979Srwatson /* Precedence goes to "visibility", with both process and file. */ 1024100979Srwatson if (error1 == ESRCH || error2 == ESRCH) 1025100979Srwatson return (ESRCH); 1026100979Srwatson 1027100979Srwatson if (error1 == ENOENT || error2 == ENOENT) 1028100979Srwatson return (ENOENT); 1029100979Srwatson 1030100979Srwatson /* Precedence goes to DAC/MAC protections. */ 1031100979Srwatson if (error1 == EACCES || error2 == EACCES) 1032100979Srwatson return (EACCES); 1033100979Srwatson 1034100979Srwatson /* Precedence goes to privilege. */ 1035100979Srwatson if (error1 == EPERM || error2 == EPERM) 1036100979Srwatson return (EPERM); 1037100979Srwatson 1038100979Srwatson /* Precedence goes to error over success; otherwise, arbitrary. */ 1039100979Srwatson if (error1 != 0) 1040100979Srwatson return (error1); 1041100979Srwatson return (error2); 1042100979Srwatson} 1043100979Srwatson 1044104521Srwatsonstatic void 1045104521Srwatsonmac_init_label(struct label *label) 1046104521Srwatson{ 1047104521Srwatson 1048104521Srwatson bzero(label, sizeof(*label)); 1049104521Srwatson label->l_flags = MAC_FLAG_INITIALIZED; 1050104521Srwatson} 1051104521Srwatson 1052104521Srwatsonstatic void 1053104521Srwatsonmac_destroy_label(struct label *label) 1054104521Srwatson{ 1055104521Srwatson 1056104521Srwatson KASSERT(label->l_flags & MAC_FLAG_INITIALIZED, 1057104521Srwatson ("destroying uninitialized label")); 1058104521Srwatson 1059104521Srwatson bzero(label, sizeof(*label)); 1060104521Srwatson /* implicit: label->l_flags &= ~MAC_FLAG_INITIALIZED; */ 1061104521Srwatson} 1062104521Srwatson 1063104521Srwatsonstatic void 1064104521Srwatsonmac_init_structmac(struct mac *mac) 1065104521Srwatson{ 1066104521Srwatson 1067104521Srwatson bzero(mac, sizeof(*mac)); 1068104521Srwatson mac->m_macflags = MAC_FLAG_INITIALIZED; 1069104521Srwatson} 1070104521Srwatson 1071100979Srwatsonvoid 1072104527Srwatsonmac_init_bpfdesc(struct bpf_d *bpf_d) 1073104521Srwatson{ 1074104521Srwatson 1075104527Srwatson mac_init_label(&bpf_d->bd_label); 1076104527Srwatson MAC_PERFORM(init_bpfdesc_label, &bpf_d->bd_label); 1077104521Srwatson#ifdef MAC_DEBUG 1078104527Srwatson atomic_add_int(&nmacbpfdescs, 1); 1079104521Srwatson#endif 1080104521Srwatson} 1081104521Srwatson 1082104521Srwatsonvoid 1083104521Srwatsonmac_init_cred(struct ucred *cr) 1084104521Srwatson{ 1085104521Srwatson 1086104521Srwatson mac_init_label(&cr->cr_label); 1087104521Srwatson MAC_PERFORM(init_cred_label, &cr->cr_label); 1088104521Srwatson#ifdef MAC_DEBUG 1089104521Srwatson atomic_add_int(&nmaccreds, 1); 1090104521Srwatson#endif 1091104521Srwatson} 1092104521Srwatson 1093104521Srwatsonvoid 1094104527Srwatsonmac_init_devfsdirent(struct devfs_dirent *de) 1095104521Srwatson{ 1096104521Srwatson 1097104527Srwatson mac_init_label(&de->de_label); 1098104527Srwatson MAC_PERFORM(init_devfsdirent_label, &de->de_label); 1099104521Srwatson#ifdef MAC_DEBUG 1100104527Srwatson atomic_add_int(&nmacdevfsdirents, 1); 1101104521Srwatson#endif 1102104521Srwatson} 1103104521Srwatson 1104104521Srwatsonvoid 1105104521Srwatsonmac_init_ifnet(struct ifnet *ifp) 1106104521Srwatson{ 1107104521Srwatson 1108104521Srwatson mac_init_label(&ifp->if_label); 1109104521Srwatson MAC_PERFORM(init_ifnet_label, &ifp->if_label); 1110104521Srwatson#ifdef MAC_DEBUG 1111104521Srwatson atomic_add_int(&nmacifnets, 1); 1112104521Srwatson#endif 1113104521Srwatson} 1114104521Srwatson 1115104521Srwatsonvoid 1116104527Srwatsonmac_init_ipq(struct ipq *ipq) 1117104521Srwatson{ 1118104521Srwatson 1119104527Srwatson mac_init_label(&ipq->ipq_label); 1120104527Srwatson MAC_PERFORM(init_ipq_label, &ipq->ipq_label); 1121104521Srwatson#ifdef MAC_DEBUG 1122104527Srwatson atomic_add_int(&nmacipqs, 1); 1123104521Srwatson#endif 1124104521Srwatson} 1125104521Srwatson 1126104527Srwatsonint 1127104527Srwatsonmac_init_mbuf(struct mbuf *m, int flag) 1128104527Srwatson{ 1129104528Srwatson int error; 1130104528Srwatson 1131104527Srwatson KASSERT(m->m_flags & M_PKTHDR, ("mac_init_mbuf on non-header mbuf")); 1132104527Srwatson 1133104527Srwatson mac_init_label(&m->m_pkthdr.label); 1134104527Srwatson 1135104528Srwatson MAC_CHECK(init_mbuf_label, &m->m_pkthdr.label, flag); 1136104528Srwatson if (error) { 1137104528Srwatson MAC_PERFORM(destroy_mbuf_label, &m->m_pkthdr.label); 1138104528Srwatson mac_destroy_label(&m->m_pkthdr.label); 1139104528Srwatson } 1140104528Srwatson 1141104527Srwatson#ifdef MAC_DEBUG 1142104528Srwatson if (error == 0) 1143104528Srwatson atomic_add_int(&nmacmbufs, 1); 1144104527Srwatson#endif 1145104528Srwatson return (error); 1146104527Srwatson} 1147104527Srwatson 1148104521Srwatsonvoid 1149104527Srwatsonmac_init_mount(struct mount *mp) 1150104521Srwatson{ 1151104521Srwatson 1152104527Srwatson mac_init_label(&mp->mnt_mntlabel); 1153104527Srwatson mac_init_label(&mp->mnt_fslabel); 1154104527Srwatson MAC_PERFORM(init_mount_label, &mp->mnt_mntlabel); 1155104527Srwatson MAC_PERFORM(init_mount_fs_label, &mp->mnt_fslabel); 1156104521Srwatson#ifdef MAC_DEBUG 1157104527Srwatson atomic_add_int(&nmacmounts, 1); 1158104521Srwatson#endif 1159104521Srwatson} 1160104521Srwatson 1161104521Srwatsonvoid 1162104527Srwatsonmac_init_pipe(struct pipe *pipe) 1163104521Srwatson{ 1164104527Srwatson struct label *label; 1165104521Srwatson 1166104527Srwatson label = malloc(sizeof(struct label), M_MACPIPELABEL, M_ZERO|M_WAITOK); 1167104527Srwatson mac_init_label(label); 1168104527Srwatson pipe->pipe_label = label; 1169104527Srwatson pipe->pipe_peer->pipe_label = label; 1170104527Srwatson MAC_PERFORM(init_pipe_label, pipe->pipe_label); 1171104521Srwatson#ifdef MAC_DEBUG 1172104527Srwatson atomic_add_int(&nmacpipes, 1); 1173104521Srwatson#endif 1174104521Srwatson} 1175104521Srwatson 1176104541Srwatsonstatic int 1177104541Srwatsonmac_init_socket_label(struct label *label, int flag) 1178104521Srwatson{ 1179104541Srwatson int error; 1180104521Srwatson 1181104541Srwatson mac_init_label(label); 1182104541Srwatson 1183104541Srwatson MAC_CHECK(init_socket_label, label, flag); 1184104541Srwatson if (error) { 1185104541Srwatson MAC_PERFORM(destroy_socket_label, label); 1186104541Srwatson mac_destroy_label(label); 1187104541Srwatson } 1188104541Srwatson 1189104521Srwatson#ifdef MAC_DEBUG 1190104541Srwatson if (error == 0) 1191104541Srwatson atomic_add_int(&nmacsockets, 1); 1192104521Srwatson#endif 1193104541Srwatson 1194104541Srwatson return (error); 1195104521Srwatson} 1196104521Srwatson 1197104541Srwatsonstatic int 1198104541Srwatsonmac_init_socket_peer_label(struct label *label, int flag) 1199104541Srwatson{ 1200104541Srwatson int error; 1201104541Srwatson 1202104541Srwatson mac_init_label(label); 1203104541Srwatson 1204104541Srwatson MAC_CHECK(init_socket_peer_label, label, flag); 1205104541Srwatson if (error) { 1206104541Srwatson MAC_PERFORM(destroy_socket_label, label); 1207104541Srwatson mac_destroy_label(label); 1208104541Srwatson } 1209104541Srwatson 1210104541Srwatson return (error); 1211104541Srwatson} 1212104541Srwatson 1213104541Srwatsonint 1214104541Srwatsonmac_init_socket(struct socket *socket, int flag) 1215104541Srwatson{ 1216104541Srwatson int error; 1217104541Srwatson 1218104541Srwatson error = mac_init_socket_label(&socket->so_label, flag); 1219104541Srwatson if (error) 1220104541Srwatson return (error); 1221104541Srwatson 1222104541Srwatson error = mac_init_socket_peer_label(&socket->so_peerlabel, flag); 1223104541Srwatson if (error) 1224104541Srwatson mac_destroy_socket_label(&socket->so_label); 1225104541Srwatson 1226104541Srwatson return (error); 1227104541Srwatson} 1228104541Srwatson 1229104527Srwatsonstatic void 1230104527Srwatsonmac_init_temp(struct label *label) 1231104521Srwatson{ 1232104521Srwatson 1233104527Srwatson mac_init_label(label); 1234104527Srwatson MAC_PERFORM(init_temp_label, label); 1235104521Srwatson#ifdef MAC_DEBUG 1236104527Srwatson atomic_add_int(&nmactemp, 1); 1237104521Srwatson#endif 1238104521Srwatson} 1239104521Srwatson 1240104521Srwatsonvoid 1241104527Srwatsonmac_init_vnode(struct vnode *vp) 1242104521Srwatson{ 1243104521Srwatson 1244104527Srwatson mac_init_label(&vp->v_label); 1245104527Srwatson MAC_PERFORM(init_vnode_label, &vp->v_label); 1246104521Srwatson#ifdef MAC_DEBUG 1247104527Srwatson atomic_add_int(&nmacvnodes, 1); 1248104521Srwatson#endif 1249104521Srwatson} 1250104521Srwatson 1251104521Srwatsonvoid 1252104527Srwatsonmac_destroy_bpfdesc(struct bpf_d *bpf_d) 1253104521Srwatson{ 1254104521Srwatson 1255104527Srwatson MAC_PERFORM(destroy_bpfdesc_label, &bpf_d->bd_label); 1256104527Srwatson mac_destroy_label(&bpf_d->bd_label); 1257104521Srwatson#ifdef MAC_DEBUG 1258104527Srwatson atomic_subtract_int(&nmacbpfdescs, 1); 1259104521Srwatson#endif 1260104521Srwatson} 1261104521Srwatson 1262104521Srwatsonvoid 1263104527Srwatsonmac_destroy_cred(struct ucred *cr) 1264104521Srwatson{ 1265104521Srwatson 1266104527Srwatson MAC_PERFORM(destroy_cred_label, &cr->cr_label); 1267104527Srwatson mac_destroy_label(&cr->cr_label); 1268104521Srwatson#ifdef MAC_DEBUG 1269104527Srwatson atomic_subtract_int(&nmaccreds, 1); 1270104521Srwatson#endif 1271104521Srwatson} 1272104521Srwatson 1273104521Srwatsonvoid 1274104527Srwatsonmac_destroy_devfsdirent(struct devfs_dirent *de) 1275104521Srwatson{ 1276104521Srwatson 1277104527Srwatson MAC_PERFORM(destroy_devfsdirent_label, &de->de_label); 1278104527Srwatson mac_destroy_label(&de->de_label); 1279104521Srwatson#ifdef MAC_DEBUG 1280104527Srwatson atomic_subtract_int(&nmacdevfsdirents, 1); 1281104521Srwatson#endif 1282104521Srwatson} 1283104521Srwatson 1284104521Srwatsonvoid 1285104527Srwatsonmac_destroy_ifnet(struct ifnet *ifp) 1286104521Srwatson{ 1287104521Srwatson 1288104527Srwatson MAC_PERFORM(destroy_ifnet_label, &ifp->if_label); 1289104527Srwatson mac_destroy_label(&ifp->if_label); 1290104521Srwatson#ifdef MAC_DEBUG 1291104527Srwatson atomic_subtract_int(&nmacifnets, 1); 1292104521Srwatson#endif 1293104521Srwatson} 1294104521Srwatson 1295104521Srwatsonvoid 1296104527Srwatsonmac_destroy_ipq(struct ipq *ipq) 1297104521Srwatson{ 1298104521Srwatson 1299104527Srwatson MAC_PERFORM(destroy_ipq_label, &ipq->ipq_label); 1300104527Srwatson mac_destroy_label(&ipq->ipq_label); 1301104521Srwatson#ifdef MAC_DEBUG 1302104527Srwatson atomic_subtract_int(&nmacipqs, 1); 1303104521Srwatson#endif 1304104521Srwatson} 1305104521Srwatson 1306104527Srwatsonvoid 1307104527Srwatsonmac_destroy_mbuf(struct mbuf *m) 1308104521Srwatson{ 1309104521Srwatson 1310104527Srwatson MAC_PERFORM(destroy_mbuf_label, &m->m_pkthdr.label); 1311104527Srwatson mac_destroy_label(&m->m_pkthdr.label); 1312104521Srwatson#ifdef MAC_DEBUG 1313104527Srwatson atomic_subtract_int(&nmacmbufs, 1); 1314104521Srwatson#endif 1315104521Srwatson} 1316104521Srwatson 1317104527Srwatsonvoid 1318104527Srwatsonmac_destroy_mount(struct mount *mp) 1319104521Srwatson{ 1320104521Srwatson 1321104527Srwatson MAC_PERFORM(destroy_mount_label, &mp->mnt_mntlabel); 1322104527Srwatson MAC_PERFORM(destroy_mount_fs_label, &mp->mnt_fslabel); 1323104527Srwatson mac_destroy_label(&mp->mnt_fslabel); 1324104527Srwatson mac_destroy_label(&mp->mnt_mntlabel); 1325104521Srwatson#ifdef MAC_DEBUG 1326104527Srwatson atomic_subtract_int(&nmacmounts, 1); 1327104521Srwatson#endif 1328104521Srwatson} 1329104521Srwatson 1330104521Srwatsonvoid 1331104527Srwatsonmac_destroy_pipe(struct pipe *pipe) 1332104521Srwatson{ 1333104521Srwatson 1334104527Srwatson MAC_PERFORM(destroy_pipe_label, pipe->pipe_label); 1335104527Srwatson mac_destroy_label(pipe->pipe_label); 1336104527Srwatson free(pipe->pipe_label, M_MACPIPELABEL); 1337104521Srwatson#ifdef MAC_DEBUG 1338104527Srwatson atomic_subtract_int(&nmacpipes, 1); 1339104521Srwatson#endif 1340104521Srwatson} 1341104521Srwatson 1342104541Srwatsonstatic void 1343104541Srwatsonmac_destroy_socket_label(struct label *label) 1344104521Srwatson{ 1345104521Srwatson 1346104541Srwatson MAC_PERFORM(destroy_socket_label, label); 1347104541Srwatson mac_destroy_label(label); 1348104521Srwatson#ifdef MAC_DEBUG 1349104527Srwatson atomic_subtract_int(&nmacsockets, 1); 1350104521Srwatson#endif 1351104521Srwatson} 1352104521Srwatson 1353104527Srwatsonstatic void 1354104541Srwatsonmac_destroy_socket_peer_label(struct label *label) 1355104541Srwatson{ 1356104541Srwatson 1357104541Srwatson MAC_PERFORM(destroy_socket_peer_label, label); 1358104541Srwatson mac_destroy_label(label); 1359104541Srwatson} 1360104541Srwatson 1361104541Srwatsonvoid 1362104541Srwatsonmac_destroy_socket(struct socket *socket) 1363104541Srwatson{ 1364104541Srwatson 1365104541Srwatson mac_destroy_socket_label(&socket->so_label); 1366104541Srwatson mac_destroy_socket_peer_label(&socket->so_peerlabel); 1367104541Srwatson} 1368104541Srwatson 1369104541Srwatsonstatic void 1370104527Srwatsonmac_destroy_temp(struct label *label) 1371104521Srwatson{ 1372104521Srwatson 1373104527Srwatson MAC_PERFORM(destroy_temp_label, label); 1374104527Srwatson mac_destroy_label(label); 1375104521Srwatson#ifdef MAC_DEBUG 1376104527Srwatson atomic_subtract_int(&nmactemp, 1); 1377104521Srwatson#endif 1378104521Srwatson} 1379104521Srwatson 1380104521Srwatsonvoid 1381104527Srwatsonmac_destroy_vnode(struct vnode *vp) 1382104521Srwatson{ 1383104521Srwatson 1384104527Srwatson MAC_PERFORM(destroy_vnode_label, &vp->v_label); 1385104527Srwatson mac_destroy_label(&vp->v_label); 1386104521Srwatson#ifdef MAC_DEBUG 1387104527Srwatson atomic_subtract_int(&nmacvnodes, 1); 1388104521Srwatson#endif 1389104521Srwatson} 1390104521Srwatson 1391104522Srwatsonstatic int 1392104522Srwatsonmac_externalize(struct label *label, struct mac *mac) 1393104522Srwatson{ 1394104522Srwatson int error; 1395104522Srwatson 1396104522Srwatson mac_init_structmac(mac); 1397104522Srwatson MAC_CHECK(externalize, label, mac); 1398104522Srwatson 1399104522Srwatson return (error); 1400104522Srwatson} 1401104522Srwatson 1402104522Srwatsonstatic int 1403104522Srwatsonmac_internalize(struct label *label, struct mac *mac) 1404104522Srwatson{ 1405104522Srwatson int error; 1406104522Srwatson 1407104522Srwatson mac_init_temp(label); 1408104522Srwatson MAC_CHECK(internalize, label, mac); 1409104522Srwatson if (error) 1410104522Srwatson mac_destroy_temp(label); 1411104522Srwatson 1412104522Srwatson return (error); 1413104522Srwatson} 1414104522Srwatson 1415104522Srwatson/* 1416104522Srwatson * Initialize MAC label for the first kernel process, from which other 1417104522Srwatson * kernel processes and threads are spawned. 1418104522Srwatson */ 1419104521Srwatsonvoid 1420104522Srwatsonmac_create_proc0(struct ucred *cred) 1421104522Srwatson{ 1422104522Srwatson 1423104522Srwatson MAC_PERFORM(create_proc0, cred); 1424104522Srwatson} 1425104522Srwatson 1426104522Srwatson/* 1427104522Srwatson * Initialize MAC label for the first userland process, from which other 1428104522Srwatson * userland processes and threads are spawned. 1429104522Srwatson */ 1430104522Srwatsonvoid 1431104522Srwatsonmac_create_proc1(struct ucred *cred) 1432104522Srwatson{ 1433104522Srwatson 1434104522Srwatson MAC_PERFORM(create_proc1, cred); 1435104522Srwatson} 1436104522Srwatson 1437104522Srwatsonvoid 1438104522Srwatsonmac_thread_userret(struct thread *td) 1439104522Srwatson{ 1440104522Srwatson 1441104522Srwatson MAC_PERFORM(thread_userret, td); 1442104522Srwatson} 1443104522Srwatson 1444104522Srwatson/* 1445104522Srwatson * When a new process is created, its label must be initialized. Generally, 1446104522Srwatson * this involves inheritence from the parent process, modulo possible 1447104522Srwatson * deltas. This function allows that processing to take place. 1448104522Srwatson */ 1449104522Srwatsonvoid 1450104522Srwatsonmac_create_cred(struct ucred *parent_cred, struct ucred *child_cred) 1451104522Srwatson{ 1452104522Srwatson 1453104522Srwatson MAC_PERFORM(create_cred, parent_cred, child_cred); 1454104522Srwatson} 1455104522Srwatson 1456104522Srwatsonvoid 1457100979Srwatsonmac_update_devfsdirent(struct devfs_dirent *de, struct vnode *vp) 1458100979Srwatson{ 1459100979Srwatson 1460100979Srwatson MAC_PERFORM(update_devfsdirent, de, &de->de_label, vp, &vp->v_label); 1461100979Srwatson} 1462100979Srwatson 1463100979Srwatsonvoid 1464100979Srwatsonmac_update_procfsvnode(struct vnode *vp, struct ucred *cred) 1465100979Srwatson{ 1466100979Srwatson 1467100979Srwatson MAC_PERFORM(update_procfsvnode, vp, &vp->v_label, cred); 1468100979Srwatson} 1469100979Srwatson 1470100979Srwatson/* 1471100979Srwatson * Support callout for policies that manage their own externalization 1472100979Srwatson * using extended attributes. 1473100979Srwatson */ 1474100979Srwatsonstatic int 1475100979Srwatsonmac_update_vnode_from_extattr(struct vnode *vp, struct mount *mp) 1476100979Srwatson{ 1477100979Srwatson int error; 1478100979Srwatson 1479100979Srwatson MAC_CHECK(update_vnode_from_extattr, vp, &vp->v_label, mp, 1480100979Srwatson &mp->mnt_fslabel); 1481100979Srwatson 1482100979Srwatson return (error); 1483100979Srwatson} 1484100979Srwatson 1485100979Srwatson/* 1486100979Srwatson * Given an externalized mac label, internalize it and stamp it on a 1487100979Srwatson * vnode. 1488100979Srwatson */ 1489100979Srwatsonstatic int 1490100979Srwatsonmac_update_vnode_from_externalized(struct vnode *vp, struct mac *extmac) 1491100979Srwatson{ 1492100979Srwatson int error; 1493100979Srwatson 1494100979Srwatson MAC_CHECK(update_vnode_from_externalized, vp, &vp->v_label, extmac); 1495100979Srwatson 1496100979Srwatson return (error); 1497100979Srwatson} 1498100979Srwatson 1499100979Srwatson/* 1500100979Srwatson * Call out to individual policies to update the label in a vnode from 1501100979Srwatson * the mountpoint. 1502100979Srwatson */ 1503100979Srwatsonvoid 1504100979Srwatsonmac_update_vnode_from_mount(struct vnode *vp, struct mount *mp) 1505100979Srwatson{ 1506100979Srwatson 1507100979Srwatson MAC_PERFORM(update_vnode_from_mount, vp, &vp->v_label, mp, 1508100979Srwatson &mp->mnt_fslabel); 1509100979Srwatson 1510101308Sjeff ASSERT_VOP_LOCKED(vp, "mac_update_vnode_from_mount"); 1511100979Srwatson if (mac_cache_fslabel_in_vnode) 1512101308Sjeff vp->v_vflag |= VV_CACHEDLABEL; 1513100979Srwatson} 1514100979Srwatson 1515100979Srwatson/* 1516100979Srwatson * Implementation of VOP_REFRESHLABEL() that relies on extended attributes 1517100979Srwatson * to store label data. Can be referenced by filesystems supporting 1518100979Srwatson * extended attributes. 1519100979Srwatson */ 1520100979Srwatsonint 1521100979Srwatsonvop_stdrefreshlabel_ea(struct vop_refreshlabel_args *ap) 1522100979Srwatson{ 1523100979Srwatson struct vnode *vp = ap->a_vp; 1524100979Srwatson struct mac extmac; 1525100979Srwatson int buflen, error; 1526100979Srwatson 1527100979Srwatson ASSERT_VOP_LOCKED(vp, "vop_stdrefreshlabel_ea"); 1528100979Srwatson 1529100979Srwatson /* 1530100979Srwatson * Call out to external policies first. Order doesn't really 1531100979Srwatson * matter, as long as failure of one assures failure of all. 1532100979Srwatson */ 1533100979Srwatson error = mac_update_vnode_from_extattr(vp, vp->v_mount); 1534100979Srwatson if (error) 1535100979Srwatson return (error); 1536100979Srwatson 1537100979Srwatson buflen = sizeof(extmac); 1538100979Srwatson error = vn_extattr_get(vp, IO_NODELOCKED, 1539100979Srwatson FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME, &buflen, 1540100979Srwatson (char *)&extmac, curthread); 1541100979Srwatson switch (error) { 1542100979Srwatson case 0: 1543100979Srwatson /* Got it */ 1544100979Srwatson break; 1545100979Srwatson 1546100979Srwatson case ENOATTR: 1547100979Srwatson /* 1548100979Srwatson * Use the label from the mount point. 1549100979Srwatson */ 1550100979Srwatson mac_update_vnode_from_mount(vp, vp->v_mount); 1551100979Srwatson return (0); 1552100979Srwatson 1553100979Srwatson case EOPNOTSUPP: 1554100979Srwatson default: 1555100979Srwatson /* Fail horribly. */ 1556100979Srwatson return (error); 1557100979Srwatson } 1558100979Srwatson 1559100979Srwatson if (buflen != sizeof(extmac)) 1560100979Srwatson error = EPERM; /* Fail very closed. */ 1561100979Srwatson if (error == 0) 1562100979Srwatson error = mac_update_vnode_from_externalized(vp, &extmac); 1563100979Srwatson if (error == 0) 1564101308Sjeff vp->v_vflag |= VV_CACHEDLABEL; 1565100979Srwatson else { 1566100979Srwatson struct vattr va; 1567100979Srwatson 1568100979Srwatson printf("Corrupted label on %s", 1569100979Srwatson vp->v_mount->mnt_stat.f_mntonname); 1570100979Srwatson if (VOP_GETATTR(vp, &va, curthread->td_ucred, curthread) == 0) 1571100979Srwatson printf(" inum %ld", va.va_fileid); 1572104268Srwatson#ifdef MAC_DEBUG 1573100979Srwatson if (mac_debug_label_fallback) { 1574100979Srwatson printf(", falling back.\n"); 1575100979Srwatson mac_update_vnode_from_mount(vp, vp->v_mount); 1576100979Srwatson error = 0; 1577100979Srwatson } else { 1578104268Srwatson#endif 1579100979Srwatson printf(".\n"); 1580100979Srwatson error = EPERM; 1581104268Srwatson#ifdef MAC_DEBUG 1582100979Srwatson } 1583104268Srwatson#endif 1584100979Srwatson } 1585100979Srwatson 1586100979Srwatson return (error); 1587100979Srwatson} 1588100979Srwatson 1589100979Srwatson/* 1590100979Srwatson * Make sure the vnode label is up-to-date. If EOPNOTSUPP, then we handle 1591100979Srwatson * the labeling activity outselves. Filesystems should be careful not 1592100979Srwatson * to change their minds regarding whether they support vop_refreshlabel() 1593100979Srwatson * for a vnode or not. Don't cache the vnode here, allow the file 1594100979Srwatson * system code to determine if it's safe to cache. If we update from 1595100979Srwatson * the mount, don't cache since a change to the mount label should affect 1596100979Srwatson * all vnodes. 1597100979Srwatson */ 1598100979Srwatsonstatic int 1599100979Srwatsonvn_refreshlabel(struct vnode *vp, struct ucred *cred) 1600100979Srwatson{ 1601100979Srwatson int error; 1602100979Srwatson 1603100979Srwatson ASSERT_VOP_LOCKED(vp, "vn_refreshlabel"); 1604100979Srwatson 1605100979Srwatson if (vp->v_mount == NULL) { 1606100979Srwatson/* 1607100979Srwatson Eventually, we probably want to special-case refreshing 1608100979Srwatson of deadfs vnodes, and if there's a lock-free race somewhere, 1609100979Srwatson that case might be handled here. 1610100979Srwatson 1611100979Srwatson mac_update_vnode_deadfs(vp); 1612100979Srwatson return (0); 1613100979Srwatson */ 1614100979Srwatson /* printf("vn_refreshlabel: null v_mount\n"); */ 1615103314Snjl if (vp->v_type != VNON) 1616100979Srwatson printf( 1617103314Snjl "vn_refreshlabel: null v_mount with non-VNON\n"); 1618100979Srwatson return (EBADF); 1619100979Srwatson } 1620100979Srwatson 1621101308Sjeff if (vp->v_vflag & VV_CACHEDLABEL) { 1622100979Srwatson mac_vnode_label_cache_hits++; 1623100979Srwatson return (0); 1624100979Srwatson } else 1625100979Srwatson mac_vnode_label_cache_misses++; 1626100979Srwatson 1627100979Srwatson if ((vp->v_mount->mnt_flag & MNT_MULTILABEL) == 0) { 1628100979Srwatson mac_update_vnode_from_mount(vp, vp->v_mount); 1629100979Srwatson return (0); 1630100979Srwatson } 1631100979Srwatson 1632100979Srwatson error = VOP_REFRESHLABEL(vp, cred, curthread); 1633100979Srwatson switch (error) { 1634100979Srwatson case EOPNOTSUPP: 1635100979Srwatson /* 1636100979Srwatson * If labels are not supported on this vnode, fall back to 1637100979Srwatson * the label in the mount and propagate it to the vnode. 1638100979Srwatson * There should probably be some sort of policy/flag/decision 1639100979Srwatson * about doing this. 1640100979Srwatson */ 1641100979Srwatson mac_update_vnode_from_mount(vp, vp->v_mount); 1642100979Srwatson error = 0; 1643100979Srwatson default: 1644100979Srwatson return (error); 1645100979Srwatson } 1646100979Srwatson} 1647100979Srwatson 1648100979Srwatson/* 1649100979Srwatson * Helper function for file systems using the vop_std*_ea() calls. This 1650100979Srwatson * function must be called after EA service is available for the vnode, 1651100979Srwatson * but before it's hooked up to the namespace so that the node persists 1652100979Srwatson * if there's a crash, or before it can be accessed. On successful 1653100979Srwatson * commit of the label to disk (etc), do cache the label. 1654100979Srwatson */ 1655100979Srwatsonint 1656100979Srwatsonvop_stdcreatevnode_ea(struct vnode *dvp, struct vnode *tvp, struct ucred *cred) 1657100979Srwatson{ 1658100979Srwatson struct mac extmac; 1659100979Srwatson int error; 1660100979Srwatson 1661101308Sjeff ASSERT_VOP_LOCKED(tvp, "vop_stdcreatevnode_ea"); 1662100979Srwatson if ((dvp->v_mount->mnt_flag & MNT_MULTILABEL) == 0) { 1663100979Srwatson mac_update_vnode_from_mount(tvp, tvp->v_mount); 1664100979Srwatson } else { 1665100979Srwatson error = vn_refreshlabel(dvp, cred); 1666100979Srwatson if (error) 1667100979Srwatson return (error); 1668100979Srwatson 1669100979Srwatson /* 1670100979Srwatson * Stick the label in the vnode. Then try to write to 1671100979Srwatson * disk. If we fail, return a failure to abort the 1672100979Srwatson * create operation. Really, this failure shouldn't 1673100979Srwatson * happen except in fairly unusual circumstances (out 1674100979Srwatson * of disk, etc). 1675100979Srwatson */ 1676100979Srwatson mac_create_vnode(cred, dvp, tvp); 1677100979Srwatson 1678100979Srwatson error = mac_stdcreatevnode_ea(tvp); 1679100979Srwatson if (error) 1680100979Srwatson return (error); 1681100979Srwatson 1682100979Srwatson /* 1683100979Srwatson * XXX: Eventually this will go away and all policies will 1684100979Srwatson * directly manage their extended attributes. 1685100979Srwatson */ 1686100979Srwatson error = mac_externalize(&tvp->v_label, &extmac); 1687100979Srwatson if (error) 1688100979Srwatson return (error); 1689100979Srwatson 1690100979Srwatson error = vn_extattr_set(tvp, IO_NODELOCKED, 1691100979Srwatson FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME, 1692100979Srwatson sizeof(extmac), (char *)&extmac, curthread); 1693100979Srwatson if (error == 0) 1694101308Sjeff tvp->v_vflag |= VV_CACHEDLABEL; 1695100979Srwatson else { 1696100979Srwatson#if 0 1697100979Srwatson /* 1698100979Srwatson * In theory, we could have fall-back behavior here. 1699100979Srwatson * It would probably be incorrect. 1700100979Srwatson */ 1701100979Srwatson#endif 1702100979Srwatson return (error); 1703100979Srwatson } 1704100979Srwatson } 1705100979Srwatson 1706100979Srwatson return (0); 1707100979Srwatson} 1708100979Srwatson 1709100979Srwatsonvoid 1710100979Srwatsonmac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp) 1711100979Srwatson{ 1712100979Srwatson int error; 1713100979Srwatson 1714100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_execve_transition"); 1715100979Srwatson 1716100979Srwatson error = vn_refreshlabel(vp, old); 1717100979Srwatson if (error) { 1718100979Srwatson printf("mac_execve_transition: vn_refreshlabel returned %d\n", 1719100979Srwatson error); 1720100979Srwatson printf("mac_execve_transition: using old vnode label\n"); 1721100979Srwatson } 1722100979Srwatson 1723100979Srwatson MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label); 1724100979Srwatson} 1725100979Srwatson 1726100979Srwatsonint 1727100979Srwatsonmac_execve_will_transition(struct ucred *old, struct vnode *vp) 1728100979Srwatson{ 1729100979Srwatson int error, result; 1730100979Srwatson 1731100979Srwatson error = vn_refreshlabel(vp, old); 1732100979Srwatson if (error) 1733100979Srwatson return (error); 1734100979Srwatson 1735100979Srwatson result = 0; 1736100979Srwatson MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label); 1737100979Srwatson 1738100979Srwatson return (result); 1739100979Srwatson} 1740100979Srwatson 1741100979Srwatsonint 1742100979Srwatsonmac_check_vnode_access(struct ucred *cred, struct vnode *vp, int flags) 1743100979Srwatson{ 1744100979Srwatson int error; 1745100979Srwatson 1746100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_access"); 1747100979Srwatson 1748100979Srwatson if (!mac_enforce_fs) 1749100979Srwatson return (0); 1750100979Srwatson 1751100979Srwatson error = vn_refreshlabel(vp, cred); 1752100979Srwatson if (error) 1753100979Srwatson return (error); 1754100979Srwatson 1755100979Srwatson MAC_CHECK(check_vnode_access, cred, vp, &vp->v_label, flags); 1756100979Srwatson return (error); 1757100979Srwatson} 1758100979Srwatson 1759100979Srwatsonint 1760100979Srwatsonmac_check_vnode_chdir(struct ucred *cred, struct vnode *dvp) 1761100979Srwatson{ 1762100979Srwatson int error; 1763100979Srwatson 1764100979Srwatson ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_chdir"); 1765100979Srwatson 1766100979Srwatson if (!mac_enforce_fs) 1767100979Srwatson return (0); 1768100979Srwatson 1769100979Srwatson error = vn_refreshlabel(dvp, cred); 1770100979Srwatson if (error) 1771100979Srwatson return (error); 1772100979Srwatson 1773100979Srwatson MAC_CHECK(check_vnode_chdir, cred, dvp, &dvp->v_label); 1774100979Srwatson return (error); 1775100979Srwatson} 1776100979Srwatson 1777100979Srwatsonint 1778100979Srwatsonmac_check_vnode_chroot(struct ucred *cred, struct vnode *dvp) 1779100979Srwatson{ 1780100979Srwatson int error; 1781100979Srwatson 1782100979Srwatson ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_chroot"); 1783100979Srwatson 1784100979Srwatson if (!mac_enforce_fs) 1785100979Srwatson return (0); 1786100979Srwatson 1787100979Srwatson error = vn_refreshlabel(dvp, cred); 1788100979Srwatson if (error) 1789100979Srwatson return (error); 1790100979Srwatson 1791100979Srwatson MAC_CHECK(check_vnode_chroot, cred, dvp, &dvp->v_label); 1792100979Srwatson return (error); 1793100979Srwatson} 1794100979Srwatson 1795100979Srwatsonint 1796100979Srwatsonmac_check_vnode_create(struct ucred *cred, struct vnode *dvp, 1797100979Srwatson struct componentname *cnp, struct vattr *vap) 1798100979Srwatson{ 1799100979Srwatson int error; 1800100979Srwatson 1801100979Srwatson ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_create"); 1802100979Srwatson 1803100979Srwatson if (!mac_enforce_fs) 1804100979Srwatson return (0); 1805100979Srwatson 1806100979Srwatson error = vn_refreshlabel(dvp, cred); 1807100979Srwatson if (error) 1808100979Srwatson return (error); 1809100979Srwatson 1810100979Srwatson MAC_CHECK(check_vnode_create, cred, dvp, &dvp->v_label, cnp, vap); 1811100979Srwatson return (error); 1812100979Srwatson} 1813100979Srwatson 1814100979Srwatsonint 1815100979Srwatsonmac_check_vnode_delete(struct ucred *cred, struct vnode *dvp, struct vnode *vp, 1816100979Srwatson struct componentname *cnp) 1817100979Srwatson{ 1818100979Srwatson int error; 1819100979Srwatson 1820100979Srwatson ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_delete"); 1821100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_delete"); 1822100979Srwatson 1823100979Srwatson if (!mac_enforce_fs) 1824100979Srwatson return (0); 1825100979Srwatson 1826100979Srwatson error = vn_refreshlabel(dvp, cred); 1827100979Srwatson if (error) 1828100979Srwatson return (error); 1829100979Srwatson error = vn_refreshlabel(vp, cred); 1830100979Srwatson if (error) 1831100979Srwatson return (error); 1832100979Srwatson 1833100979Srwatson MAC_CHECK(check_vnode_delete, cred, dvp, &dvp->v_label, vp, 1834100979Srwatson &vp->v_label, cnp); 1835100979Srwatson return (error); 1836100979Srwatson} 1837100979Srwatson 1838100979Srwatsonint 1839100979Srwatsonmac_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp, 1840100979Srwatson acl_type_t type) 1841100979Srwatson{ 1842100979Srwatson int error; 1843100979Srwatson 1844100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_deleteacl"); 1845100979Srwatson 1846100979Srwatson if (!mac_enforce_fs) 1847100979Srwatson return (0); 1848100979Srwatson 1849100979Srwatson error = vn_refreshlabel(vp, cred); 1850100979Srwatson if (error) 1851100979Srwatson return (error); 1852100979Srwatson 1853100979Srwatson MAC_CHECK(check_vnode_deleteacl, cred, vp, &vp->v_label, type); 1854100979Srwatson return (error); 1855100979Srwatson} 1856100979Srwatson 1857100979Srwatsonint 1858100979Srwatsonmac_check_vnode_exec(struct ucred *cred, struct vnode *vp) 1859100979Srwatson{ 1860100979Srwatson int error; 1861100979Srwatson 1862102102Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_exec"); 1863102102Srwatson 1864100979Srwatson if (!mac_enforce_process && !mac_enforce_fs) 1865100979Srwatson return (0); 1866100979Srwatson 1867100979Srwatson error = vn_refreshlabel(vp, cred); 1868100979Srwatson if (error) 1869100979Srwatson return (error); 1870100979Srwatson MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label); 1871100979Srwatson 1872100979Srwatson return (error); 1873100979Srwatson} 1874100979Srwatson 1875100979Srwatsonint 1876100979Srwatsonmac_check_vnode_getacl(struct ucred *cred, struct vnode *vp, acl_type_t type) 1877100979Srwatson{ 1878100979Srwatson int error; 1879100979Srwatson 1880100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_getacl"); 1881100979Srwatson 1882100979Srwatson if (!mac_enforce_fs) 1883100979Srwatson return (0); 1884100979Srwatson 1885100979Srwatson error = vn_refreshlabel(vp, cred); 1886100979Srwatson if (error) 1887100979Srwatson return (error); 1888100979Srwatson 1889100979Srwatson MAC_CHECK(check_vnode_getacl, cred, vp, &vp->v_label, type); 1890100979Srwatson return (error); 1891100979Srwatson} 1892100979Srwatson 1893100979Srwatsonint 1894100979Srwatsonmac_check_vnode_getextattr(struct ucred *cred, struct vnode *vp, 1895100979Srwatson int attrnamespace, const char *name, struct uio *uio) 1896100979Srwatson{ 1897100979Srwatson int error; 1898100979Srwatson 1899100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_getextattr"); 1900100979Srwatson 1901100979Srwatson if (!mac_enforce_fs) 1902100979Srwatson return (0); 1903100979Srwatson 1904100979Srwatson error = vn_refreshlabel(vp, cred); 1905100979Srwatson if (error) 1906100979Srwatson return (error); 1907100979Srwatson 1908100979Srwatson MAC_CHECK(check_vnode_getextattr, cred, vp, &vp->v_label, 1909100979Srwatson attrnamespace, name, uio); 1910100979Srwatson return (error); 1911100979Srwatson} 1912100979Srwatson 1913100979Srwatsonint 1914104529Srwatsonmac_check_vnode_link(struct ucred *cred, struct vnode *dvp, 1915104529Srwatson struct vnode *vp, struct componentname *cnp) 1916104529Srwatson{ 1917104529Srwatson 1918104529Srwatson int error; 1919104529Srwatson 1920104529Srwatson ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_link"); 1921104529Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_link"); 1922104529Srwatson 1923104529Srwatson if (!mac_enforce_fs) 1924104529Srwatson return (0); 1925104529Srwatson 1926104529Srwatson error = vn_refreshlabel(dvp, cred); 1927104529Srwatson if (error) 1928104529Srwatson return (error); 1929104529Srwatson 1930104529Srwatson error = vn_refreshlabel(vp, cred); 1931104529Srwatson if (error) 1932104529Srwatson return (error); 1933104529Srwatson 1934104529Srwatson MAC_CHECK(check_vnode_link, cred, dvp, &dvp->v_label, vp, 1935104529Srwatson &vp->v_label, cnp); 1936104529Srwatson return (error); 1937104529Srwatson} 1938104529Srwatson 1939104529Srwatsonint 1940100979Srwatsonmac_check_vnode_lookup(struct ucred *cred, struct vnode *dvp, 1941100979Srwatson struct componentname *cnp) 1942100979Srwatson{ 1943100979Srwatson int error; 1944100979Srwatson 1945100979Srwatson ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_lookup"); 1946100979Srwatson 1947100979Srwatson if (!mac_enforce_fs) 1948100979Srwatson return (0); 1949100979Srwatson 1950100979Srwatson error = vn_refreshlabel(dvp, cred); 1951100979Srwatson if (error) 1952100979Srwatson return (error); 1953100979Srwatson 1954100979Srwatson MAC_CHECK(check_vnode_lookup, cred, dvp, &dvp->v_label, cnp); 1955100979Srwatson return (error); 1956100979Srwatson} 1957100979Srwatson 1958104546Srwatsonint 1959104546Srwatsonmac_check_vnode_mmap(struct ucred *cred, struct vnode *vp, int prot) 1960100979Srwatson{ 1961104546Srwatson int error; 1962100979Srwatson 1963104546Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_mmap"); 1964103514Srwatson 1965104546Srwatson if (!mac_enforce_fs || !mac_enforce_vm) 1966104546Srwatson return (0); 1967104546Srwatson 1968104546Srwatson error = vn_refreshlabel(vp, cred); 1969104546Srwatson if (error) 1970104546Srwatson return (error); 1971104546Srwatson 1972104546Srwatson MAC_CHECK(check_vnode_mmap, cred, vp, &vp->v_label, prot); 1973104546Srwatson return (error); 1974100979Srwatson} 1975100979Srwatson 1976104546Srwatsonvoid 1977104546Srwatsonmac_check_vnode_mmap_downgrade(struct ucred *cred, struct vnode *vp, int *prot) 1978104546Srwatson{ 1979104546Srwatson int result = *prot; 1980104546Srwatson 1981104546Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_mmap_downgrade"); 1982104546Srwatson 1983104546Srwatson if (!mac_enforce_fs || !mac_enforce_vm) 1984104546Srwatson return; 1985104546Srwatson 1986104546Srwatson MAC_PERFORM(check_vnode_mmap_downgrade, cred, vp, &vp->v_label, 1987104546Srwatson &result); 1988104546Srwatson 1989104546Srwatson *prot = result; 1990104546Srwatson} 1991104546Srwatson 1992100979Srwatsonint 1993104546Srwatsonmac_check_vnode_mprotect(struct ucred *cred, struct vnode *vp, int prot) 1994104546Srwatson{ 1995104546Srwatson int error; 1996104546Srwatson 1997104546Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_mprotect"); 1998104546Srwatson 1999104546Srwatson if (!mac_enforce_fs || !mac_enforce_vm) 2000104546Srwatson return (0); 2001104546Srwatson 2002104546Srwatson error = vn_refreshlabel(vp, cred); 2003104546Srwatson if (error) 2004104546Srwatson return (error); 2005104546Srwatson 2006104546Srwatson MAC_CHECK(check_vnode_mprotect, cred, vp, &vp->v_label, prot); 2007104546Srwatson return (error); 2008104546Srwatson} 2009104546Srwatson 2010104546Srwatsonint 2011102112Srwatsonmac_check_vnode_open(struct ucred *cred, struct vnode *vp, mode_t acc_mode) 2012100979Srwatson{ 2013100979Srwatson int error; 2014100979Srwatson 2015102112Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_open"); 2016102112Srwatson 2017100979Srwatson if (!mac_enforce_fs) 2018100979Srwatson return (0); 2019100979Srwatson 2020102112Srwatson error = vn_refreshlabel(vp, cred); 2021102112Srwatson if (error) 2022102112Srwatson return (error); 2023100979Srwatson 2024102112Srwatson MAC_CHECK(check_vnode_open, cred, vp, &vp->v_label, acc_mode); 2025102112Srwatson return (error); 2026102112Srwatson} 2027102112Srwatson 2028102112Srwatsonint 2029102129Srwatsonmac_check_vnode_poll(struct ucred *active_cred, struct ucred *file_cred, 2030102129Srwatson struct vnode *vp) 2031102112Srwatson{ 2032102112Srwatson int error; 2033102112Srwatson 2034102112Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_poll"); 2035102112Srwatson 2036102112Srwatson if (!mac_enforce_fs) 2037102112Srwatson return (0); 2038102112Srwatson 2039102129Srwatson error = vn_refreshlabel(vp, active_cred); 2040100979Srwatson if (error) 2041100979Srwatson return (error); 2042100979Srwatson 2043102129Srwatson MAC_CHECK(check_vnode_poll, active_cred, file_cred, vp, 2044102129Srwatson &vp->v_label); 2045100979Srwatson 2046100979Srwatson return (error); 2047100979Srwatson} 2048100979Srwatson 2049100979Srwatsonint 2050102129Srwatsonmac_check_vnode_read(struct ucred *active_cred, struct ucred *file_cred, 2051102129Srwatson struct vnode *vp) 2052100979Srwatson{ 2053100979Srwatson int error; 2054100979Srwatson 2055102112Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_read"); 2056100979Srwatson 2057100979Srwatson if (!mac_enforce_fs) 2058100979Srwatson return (0); 2059100979Srwatson 2060102129Srwatson error = vn_refreshlabel(vp, active_cred); 2061100979Srwatson if (error) 2062100979Srwatson return (error); 2063100979Srwatson 2064102129Srwatson MAC_CHECK(check_vnode_read, active_cred, file_cred, vp, 2065102129Srwatson &vp->v_label); 2066102112Srwatson 2067100979Srwatson return (error); 2068100979Srwatson} 2069100979Srwatson 2070100979Srwatsonint 2071100979Srwatsonmac_check_vnode_readdir(struct ucred *cred, struct vnode *dvp) 2072100979Srwatson{ 2073100979Srwatson int error; 2074100979Srwatson 2075100979Srwatson ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_readdir"); 2076100979Srwatson 2077100979Srwatson if (!mac_enforce_fs) 2078100979Srwatson return (0); 2079100979Srwatson 2080100979Srwatson error = vn_refreshlabel(dvp, cred); 2081100979Srwatson if (error) 2082100979Srwatson return (error); 2083100979Srwatson 2084100979Srwatson MAC_CHECK(check_vnode_readdir, cred, dvp, &dvp->v_label); 2085100979Srwatson return (error); 2086100979Srwatson} 2087100979Srwatson 2088100979Srwatsonint 2089100979Srwatsonmac_check_vnode_readlink(struct ucred *cred, struct vnode *vp) 2090100979Srwatson{ 2091100979Srwatson int error; 2092100979Srwatson 2093100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_readlink"); 2094100979Srwatson 2095100979Srwatson if (!mac_enforce_fs) 2096100979Srwatson return (0); 2097100979Srwatson 2098100979Srwatson error = vn_refreshlabel(vp, cred); 2099100979Srwatson if (error) 2100100979Srwatson return (error); 2101100979Srwatson 2102100979Srwatson MAC_CHECK(check_vnode_readlink, cred, vp, &vp->v_label); 2103100979Srwatson return (error); 2104100979Srwatson} 2105100979Srwatson 2106100979Srwatsonstatic int 2107100979Srwatsonmac_check_vnode_relabel(struct ucred *cred, struct vnode *vp, 2108100979Srwatson struct label *newlabel) 2109100979Srwatson{ 2110100979Srwatson int error; 2111100979Srwatson 2112100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_relabel"); 2113100979Srwatson 2114100979Srwatson error = vn_refreshlabel(vp, cred); 2115100979Srwatson if (error) 2116100979Srwatson return (error); 2117100979Srwatson 2118100979Srwatson MAC_CHECK(check_vnode_relabel, cred, vp, &vp->v_label, newlabel); 2119100979Srwatson 2120100979Srwatson return (error); 2121100979Srwatson} 2122100979Srwatson 2123100979Srwatsonint 2124100979Srwatsonmac_check_vnode_rename_from(struct ucred *cred, struct vnode *dvp, 2125100979Srwatson struct vnode *vp, struct componentname *cnp) 2126100979Srwatson{ 2127100979Srwatson int error; 2128100979Srwatson 2129100979Srwatson ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_rename_from"); 2130100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_rename_from"); 2131100979Srwatson 2132100979Srwatson if (!mac_enforce_fs) 2133100979Srwatson return (0); 2134100979Srwatson 2135100979Srwatson error = vn_refreshlabel(dvp, cred); 2136100979Srwatson if (error) 2137100979Srwatson return (error); 2138100979Srwatson error = vn_refreshlabel(vp, cred); 2139100979Srwatson if (error) 2140100979Srwatson return (error); 2141100979Srwatson 2142100979Srwatson MAC_CHECK(check_vnode_rename_from, cred, dvp, &dvp->v_label, vp, 2143100979Srwatson &vp->v_label, cnp); 2144100979Srwatson return (error); 2145100979Srwatson} 2146100979Srwatson 2147100979Srwatsonint 2148100979Srwatsonmac_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp, 2149100979Srwatson struct vnode *vp, int samedir, struct componentname *cnp) 2150100979Srwatson{ 2151100979Srwatson int error; 2152100979Srwatson 2153100979Srwatson ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_rename_to"); 2154100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_rename_to"); 2155100979Srwatson 2156100979Srwatson if (!mac_enforce_fs) 2157100979Srwatson return (0); 2158100979Srwatson 2159100979Srwatson error = vn_refreshlabel(dvp, cred); 2160100979Srwatson if (error) 2161100979Srwatson return (error); 2162100979Srwatson if (vp != NULL) { 2163100979Srwatson error = vn_refreshlabel(vp, cred); 2164100979Srwatson if (error) 2165100979Srwatson return (error); 2166100979Srwatson } 2167100979Srwatson MAC_CHECK(check_vnode_rename_to, cred, dvp, &dvp->v_label, vp, 2168100979Srwatson vp != NULL ? &vp->v_label : NULL, samedir, cnp); 2169100979Srwatson return (error); 2170100979Srwatson} 2171100979Srwatson 2172100979Srwatsonint 2173100979Srwatsonmac_check_vnode_revoke(struct ucred *cred, struct vnode *vp) 2174100979Srwatson{ 2175100979Srwatson int error; 2176100979Srwatson 2177100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_revoke"); 2178100979Srwatson 2179100979Srwatson if (!mac_enforce_fs) 2180100979Srwatson return (0); 2181100979Srwatson 2182100979Srwatson error = vn_refreshlabel(vp, cred); 2183100979Srwatson if (error) 2184100979Srwatson return (error); 2185100979Srwatson 2186100979Srwatson MAC_CHECK(check_vnode_revoke, cred, vp, &vp->v_label); 2187100979Srwatson return (error); 2188100979Srwatson} 2189100979Srwatson 2190100979Srwatsonint 2191100979Srwatsonmac_check_vnode_setacl(struct ucred *cred, struct vnode *vp, acl_type_t type, 2192100979Srwatson struct acl *acl) 2193100979Srwatson{ 2194100979Srwatson int error; 2195100979Srwatson 2196100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setacl"); 2197100979Srwatson 2198100979Srwatson if (!mac_enforce_fs) 2199100979Srwatson return (0); 2200100979Srwatson 2201100979Srwatson error = vn_refreshlabel(vp, cred); 2202100979Srwatson if (error) 2203100979Srwatson return (error); 2204100979Srwatson 2205100979Srwatson MAC_CHECK(check_vnode_setacl, cred, vp, &vp->v_label, type, acl); 2206100979Srwatson return (error); 2207100979Srwatson} 2208100979Srwatson 2209100979Srwatsonint 2210100979Srwatsonmac_check_vnode_setextattr(struct ucred *cred, struct vnode *vp, 2211100979Srwatson int attrnamespace, const char *name, struct uio *uio) 2212100979Srwatson{ 2213100979Srwatson int error; 2214100979Srwatson 2215100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setextattr"); 2216100979Srwatson 2217100979Srwatson if (!mac_enforce_fs) 2218100979Srwatson return (0); 2219100979Srwatson 2220100979Srwatson error = vn_refreshlabel(vp, cred); 2221100979Srwatson if (error) 2222100979Srwatson return (error); 2223100979Srwatson 2224100979Srwatson MAC_CHECK(check_vnode_setextattr, cred, vp, &vp->v_label, 2225100979Srwatson attrnamespace, name, uio); 2226100979Srwatson return (error); 2227100979Srwatson} 2228100979Srwatson 2229100979Srwatsonint 2230100979Srwatsonmac_check_vnode_setflags(struct ucred *cred, struct vnode *vp, u_long flags) 2231100979Srwatson{ 2232100979Srwatson int error; 2233100979Srwatson 2234100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setflags"); 2235100979Srwatson 2236100979Srwatson if (!mac_enforce_fs) 2237100979Srwatson return (0); 2238100979Srwatson 2239100979Srwatson error = vn_refreshlabel(vp, cred); 2240100979Srwatson if (error) 2241100979Srwatson return (error); 2242100979Srwatson 2243100979Srwatson MAC_CHECK(check_vnode_setflags, cred, vp, &vp->v_label, flags); 2244100979Srwatson return (error); 2245100979Srwatson} 2246100979Srwatson 2247100979Srwatsonint 2248100979Srwatsonmac_check_vnode_setmode(struct ucred *cred, struct vnode *vp, mode_t mode) 2249100979Srwatson{ 2250100979Srwatson int error; 2251100979Srwatson 2252100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setmode"); 2253100979Srwatson 2254100979Srwatson if (!mac_enforce_fs) 2255100979Srwatson return (0); 2256100979Srwatson 2257100979Srwatson error = vn_refreshlabel(vp, cred); 2258100979Srwatson if (error) 2259100979Srwatson return (error); 2260100979Srwatson 2261100979Srwatson MAC_CHECK(check_vnode_setmode, cred, vp, &vp->v_label, mode); 2262100979Srwatson return (error); 2263100979Srwatson} 2264100979Srwatson 2265100979Srwatsonint 2266100979Srwatsonmac_check_vnode_setowner(struct ucred *cred, struct vnode *vp, uid_t uid, 2267100979Srwatson gid_t gid) 2268100979Srwatson{ 2269100979Srwatson int error; 2270100979Srwatson 2271100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setowner"); 2272100979Srwatson 2273100979Srwatson if (!mac_enforce_fs) 2274100979Srwatson return (0); 2275100979Srwatson 2276100979Srwatson error = vn_refreshlabel(vp, cred); 2277100979Srwatson if (error) 2278100979Srwatson return (error); 2279100979Srwatson 2280100979Srwatson MAC_CHECK(check_vnode_setowner, cred, vp, &vp->v_label, uid, gid); 2281100979Srwatson return (error); 2282100979Srwatson} 2283100979Srwatson 2284100979Srwatsonint 2285100979Srwatsonmac_check_vnode_setutimes(struct ucred *cred, struct vnode *vp, 2286100979Srwatson struct timespec atime, struct timespec mtime) 2287100979Srwatson{ 2288100979Srwatson int error; 2289100979Srwatson 2290100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setutimes"); 2291100979Srwatson 2292100979Srwatson if (!mac_enforce_fs) 2293100979Srwatson return (0); 2294100979Srwatson 2295100979Srwatson error = vn_refreshlabel(vp, cred); 2296100979Srwatson if (error) 2297100979Srwatson return (error); 2298100979Srwatson 2299100979Srwatson MAC_CHECK(check_vnode_setutimes, cred, vp, &vp->v_label, atime, 2300100979Srwatson mtime); 2301100979Srwatson return (error); 2302100979Srwatson} 2303100979Srwatson 2304100979Srwatsonint 2305102129Srwatsonmac_check_vnode_stat(struct ucred *active_cred, struct ucred *file_cred, 2306102129Srwatson struct vnode *vp) 2307100979Srwatson{ 2308100979Srwatson int error; 2309100979Srwatson 2310100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_stat"); 2311100979Srwatson 2312100979Srwatson if (!mac_enforce_fs) 2313100979Srwatson return (0); 2314100979Srwatson 2315102129Srwatson error = vn_refreshlabel(vp, active_cred); 2316100979Srwatson if (error) 2317100979Srwatson return (error); 2318100979Srwatson 2319102129Srwatson MAC_CHECK(check_vnode_stat, active_cred, file_cred, vp, 2320102129Srwatson &vp->v_label); 2321100979Srwatson return (error); 2322100979Srwatson} 2323100979Srwatson 2324102112Srwatsonint 2325102129Srwatsonmac_check_vnode_write(struct ucred *active_cred, struct ucred *file_cred, 2326102129Srwatson struct vnode *vp) 2327102112Srwatson{ 2328102112Srwatson int error; 2329102112Srwatson 2330102112Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_write"); 2331102112Srwatson 2332102112Srwatson if (!mac_enforce_fs) 2333102112Srwatson return (0); 2334102112Srwatson 2335102129Srwatson error = vn_refreshlabel(vp, active_cred); 2336102112Srwatson if (error) 2337102112Srwatson return (error); 2338102112Srwatson 2339102129Srwatson MAC_CHECK(check_vnode_write, active_cred, file_cred, vp, 2340102129Srwatson &vp->v_label); 2341102112Srwatson 2342102112Srwatson return (error); 2343102112Srwatson} 2344102112Srwatson 2345100979Srwatson/* 2346100979Srwatson * When relabeling a process, call out to the policies for the maximum 2347100979Srwatson * permission allowed for each object type we know about in its 2348100979Srwatson * memory space, and revoke access (in the least surprising ways we 2349100979Srwatson * know) when necessary. The process lock is not held here. 2350100979Srwatson */ 2351100979Srwatsonstatic void 2352100979Srwatsonmac_cred_mmapped_drop_perms(struct thread *td, struct ucred *cred) 2353100979Srwatson{ 2354100979Srwatson 2355100979Srwatson /* XXX freeze all other threads */ 2356100979Srwatson mac_cred_mmapped_drop_perms_recurse(td, cred, 2357100979Srwatson &td->td_proc->p_vmspace->vm_map); 2358100979Srwatson /* XXX allow other threads to continue */ 2359100979Srwatson} 2360100979Srwatson 2361100979Srwatsonstatic __inline const char * 2362100979Srwatsonprot2str(vm_prot_t prot) 2363100979Srwatson{ 2364100979Srwatson 2365100979Srwatson switch (prot & VM_PROT_ALL) { 2366100979Srwatson case VM_PROT_READ: 2367100979Srwatson return ("r--"); 2368100979Srwatson case VM_PROT_READ | VM_PROT_WRITE: 2369100979Srwatson return ("rw-"); 2370100979Srwatson case VM_PROT_READ | VM_PROT_EXECUTE: 2371100979Srwatson return ("r-x"); 2372100979Srwatson case VM_PROT_READ | VM_PROT_WRITE | VM_PROT_EXECUTE: 2373100979Srwatson return ("rwx"); 2374100979Srwatson case VM_PROT_WRITE: 2375100979Srwatson return ("-w-"); 2376100979Srwatson case VM_PROT_EXECUTE: 2377100979Srwatson return ("--x"); 2378100979Srwatson case VM_PROT_WRITE | VM_PROT_EXECUTE: 2379100979Srwatson return ("-wx"); 2380100979Srwatson default: 2381100979Srwatson return ("---"); 2382100979Srwatson } 2383100979Srwatson} 2384100979Srwatson 2385100979Srwatsonstatic void 2386100979Srwatsonmac_cred_mmapped_drop_perms_recurse(struct thread *td, struct ucred *cred, 2387100979Srwatson struct vm_map *map) 2388100979Srwatson{ 2389100979Srwatson struct vm_map_entry *vme; 2390104546Srwatson int result; 2391104546Srwatson vm_prot_t revokeperms; 2392100979Srwatson vm_object_t object; 2393100979Srwatson vm_ooffset_t offset; 2394100979Srwatson struct vnode *vp; 2395100979Srwatson 2396103136Srwatson if (!mac_mmap_revocation) 2397103136Srwatson return; 2398103136Srwatson 2399100979Srwatson vm_map_lock_read(map); 2400100979Srwatson for (vme = map->header.next; vme != &map->header; vme = vme->next) { 2401100979Srwatson if (vme->eflags & MAP_ENTRY_IS_SUB_MAP) { 2402100979Srwatson mac_cred_mmapped_drop_perms_recurse(td, cred, 2403100979Srwatson vme->object.sub_map); 2404100979Srwatson continue; 2405100979Srwatson } 2406100979Srwatson /* 2407100979Srwatson * Skip over entries that obviously are not shared. 2408100979Srwatson */ 2409100979Srwatson if (vme->eflags & (MAP_ENTRY_COW | MAP_ENTRY_NOSYNC) || 2410100979Srwatson !vme->max_protection) 2411100979Srwatson continue; 2412100979Srwatson /* 2413100979Srwatson * Drill down to the deepest backing object. 2414100979Srwatson */ 2415100979Srwatson offset = vme->offset; 2416100979Srwatson object = vme->object.vm_object; 2417100979Srwatson if (object == NULL) 2418100979Srwatson continue; 2419100979Srwatson while (object->backing_object != NULL) { 2420100979Srwatson object = object->backing_object; 2421100979Srwatson offset += object->backing_object_offset; 2422100979Srwatson } 2423100979Srwatson /* 2424100979Srwatson * At the moment, vm_maps and objects aren't considered 2425100979Srwatson * by the MAC system, so only things with backing by a 2426100979Srwatson * normal object (read: vnodes) are checked. 2427100979Srwatson */ 2428100979Srwatson if (object->type != OBJT_VNODE) 2429100979Srwatson continue; 2430100979Srwatson vp = (struct vnode *)object->handle; 2431100979Srwatson vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); 2432104546Srwatson result = vme->max_protection; 2433104546Srwatson mac_check_vnode_mmap_downgrade(cred, vp, &result); 2434100979Srwatson VOP_UNLOCK(vp, 0, td); 2435100979Srwatson /* 2436100979Srwatson * Find out what maximum protection we may be allowing 2437100979Srwatson * now but a policy needs to get removed. 2438100979Srwatson */ 2439100979Srwatson revokeperms = vme->max_protection & ~result; 2440100979Srwatson if (!revokeperms) 2441100979Srwatson continue; 2442102949Sbde printf("pid %ld: revoking %s perms from %#lx:%ld " 2443102949Sbde "(max %s/cur %s)\n", (long)td->td_proc->p_pid, 2444102949Sbde prot2str(revokeperms), (u_long)vme->start, 2445102949Sbde (long)(vme->end - vme->start), 2446100979Srwatson prot2str(vme->max_protection), prot2str(vme->protection)); 2447100979Srwatson vm_map_lock_upgrade(map); 2448100979Srwatson /* 2449100979Srwatson * This is the really simple case: if a map has more 2450100979Srwatson * max_protection than is allowed, but it's not being 2451100979Srwatson * actually used (that is, the current protection is 2452100979Srwatson * still allowed), we can just wipe it out and do 2453100979Srwatson * nothing more. 2454100979Srwatson */ 2455100979Srwatson if ((vme->protection & revokeperms) == 0) { 2456100979Srwatson vme->max_protection -= revokeperms; 2457100979Srwatson } else { 2458100979Srwatson if (revokeperms & VM_PROT_WRITE) { 2459100979Srwatson /* 2460100979Srwatson * In the more complicated case, flush out all 2461100979Srwatson * pending changes to the object then turn it 2462100979Srwatson * copy-on-write. 2463100979Srwatson */ 2464100979Srwatson vm_object_reference(object); 2465100979Srwatson vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); 2466100979Srwatson vm_object_page_clean(object, 2467100979Srwatson OFF_TO_IDX(offset), 2468100979Srwatson OFF_TO_IDX(offset + vme->end - vme->start + 2469100979Srwatson PAGE_MASK), 2470100979Srwatson OBJPC_SYNC); 2471100979Srwatson VOP_UNLOCK(vp, 0, td); 2472100979Srwatson vm_object_deallocate(object); 2473100979Srwatson /* 2474100979Srwatson * Why bother if there's no read permissions 2475100979Srwatson * anymore? For the rest, we need to leave 2476100979Srwatson * the write permissions on for COW, or 2477100979Srwatson * remove them entirely if configured to. 2478100979Srwatson */ 2479100979Srwatson if (!mac_mmap_revocation_via_cow) { 2480100979Srwatson vme->max_protection &= ~VM_PROT_WRITE; 2481100979Srwatson vme->protection &= ~VM_PROT_WRITE; 2482100979Srwatson } if ((revokeperms & VM_PROT_READ) == 0) 2483100979Srwatson vme->eflags |= MAP_ENTRY_COW | 2484100979Srwatson MAP_ENTRY_NEEDS_COPY; 2485100979Srwatson } 2486100979Srwatson if (revokeperms & VM_PROT_EXECUTE) { 2487100979Srwatson vme->max_protection &= ~VM_PROT_EXECUTE; 2488100979Srwatson vme->protection &= ~VM_PROT_EXECUTE; 2489100979Srwatson } 2490100979Srwatson if (revokeperms & VM_PROT_READ) { 2491100979Srwatson vme->max_protection = 0; 2492100979Srwatson vme->protection = 0; 2493100979Srwatson } 2494100979Srwatson pmap_protect(map->pmap, vme->start, vme->end, 2495100979Srwatson vme->protection & ~revokeperms); 2496100979Srwatson vm_map_simplify_entry(map, vme); 2497100979Srwatson } 2498100979Srwatson vm_map_lock_downgrade(map); 2499100979Srwatson } 2500100979Srwatson vm_map_unlock_read(map); 2501100979Srwatson} 2502100979Srwatson 2503100979Srwatson/* 2504100979Srwatson * When the subject's label changes, it may require revocation of privilege 2505100979Srwatson * to mapped objects. This can't be done on-the-fly later with a unified 2506100979Srwatson * buffer cache. 2507100979Srwatson */ 2508100979Srwatsonstatic void 2509100979Srwatsonmac_relabel_cred(struct ucred *cred, struct label *newlabel) 2510100979Srwatson{ 2511100979Srwatson 2512100979Srwatson MAC_PERFORM(relabel_cred, cred, newlabel); 2513100979Srwatson} 2514100979Srwatson 2515100979Srwatsonvoid 2516100979Srwatsonmac_relabel_vnode(struct ucred *cred, struct vnode *vp, struct label *newlabel) 2517100979Srwatson{ 2518100979Srwatson 2519100979Srwatson MAC_PERFORM(relabel_vnode, cred, vp, &vp->v_label, newlabel); 2520100979Srwatson} 2521100979Srwatson 2522100979Srwatsonvoid 2523100979Srwatsonmac_create_ifnet(struct ifnet *ifnet) 2524100979Srwatson{ 2525100979Srwatson 2526100979Srwatson MAC_PERFORM(create_ifnet, ifnet, &ifnet->if_label); 2527100979Srwatson} 2528100979Srwatson 2529100979Srwatsonvoid 2530100979Srwatsonmac_create_bpfdesc(struct ucred *cred, struct bpf_d *bpf_d) 2531100979Srwatson{ 2532100979Srwatson 2533100979Srwatson MAC_PERFORM(create_bpfdesc, cred, bpf_d, &bpf_d->bd_label); 2534100979Srwatson} 2535100979Srwatson 2536100979Srwatsonvoid 2537100979Srwatsonmac_create_socket(struct ucred *cred, struct socket *socket) 2538100979Srwatson{ 2539100979Srwatson 2540100979Srwatson MAC_PERFORM(create_socket, cred, socket, &socket->so_label); 2541100979Srwatson} 2542100979Srwatson 2543100979Srwatsonvoid 2544100979Srwatsonmac_create_pipe(struct ucred *cred, struct pipe *pipe) 2545100979Srwatson{ 2546100979Srwatson 2547100979Srwatson MAC_PERFORM(create_pipe, cred, pipe, pipe->pipe_label); 2548100979Srwatson} 2549100979Srwatson 2550100979Srwatsonvoid 2551100979Srwatsonmac_create_socket_from_socket(struct socket *oldsocket, 2552100979Srwatson struct socket *newsocket) 2553100979Srwatson{ 2554100979Srwatson 2555100979Srwatson MAC_PERFORM(create_socket_from_socket, oldsocket, &oldsocket->so_label, 2556100979Srwatson newsocket, &newsocket->so_label); 2557100979Srwatson} 2558100979Srwatson 2559100979Srwatsonstatic void 2560100979Srwatsonmac_relabel_socket(struct ucred *cred, struct socket *socket, 2561100979Srwatson struct label *newlabel) 2562100979Srwatson{ 2563100979Srwatson 2564100979Srwatson MAC_PERFORM(relabel_socket, cred, socket, &socket->so_label, newlabel); 2565100979Srwatson} 2566100979Srwatson 2567100979Srwatsonstatic void 2568100979Srwatsonmac_relabel_pipe(struct ucred *cred, struct pipe *pipe, struct label *newlabel) 2569100979Srwatson{ 2570100979Srwatson 2571100979Srwatson MAC_PERFORM(relabel_pipe, cred, pipe, pipe->pipe_label, newlabel); 2572100979Srwatson} 2573100979Srwatson 2574100979Srwatsonvoid 2575100979Srwatsonmac_set_socket_peer_from_mbuf(struct mbuf *mbuf, struct socket *socket) 2576100979Srwatson{ 2577100979Srwatson 2578100979Srwatson MAC_PERFORM(set_socket_peer_from_mbuf, mbuf, &mbuf->m_pkthdr.label, 2579100979Srwatson socket, &socket->so_peerlabel); 2580100979Srwatson} 2581100979Srwatson 2582100979Srwatsonvoid 2583100979Srwatsonmac_set_socket_peer_from_socket(struct socket *oldsocket, 2584100979Srwatson struct socket *newsocket) 2585100979Srwatson{ 2586100979Srwatson 2587100979Srwatson MAC_PERFORM(set_socket_peer_from_socket, oldsocket, 2588100979Srwatson &oldsocket->so_label, newsocket, &newsocket->so_peerlabel); 2589100979Srwatson} 2590100979Srwatson 2591100979Srwatsonvoid 2592100979Srwatsonmac_create_datagram_from_ipq(struct ipq *ipq, struct mbuf *datagram) 2593100979Srwatson{ 2594100979Srwatson 2595100979Srwatson MAC_PERFORM(create_datagram_from_ipq, ipq, &ipq->ipq_label, 2596100979Srwatson datagram, &datagram->m_pkthdr.label); 2597100979Srwatson} 2598100979Srwatson 2599100979Srwatsonvoid 2600100979Srwatsonmac_create_fragment(struct mbuf *datagram, struct mbuf *fragment) 2601100979Srwatson{ 2602100979Srwatson 2603100979Srwatson MAC_PERFORM(create_fragment, datagram, &datagram->m_pkthdr.label, 2604100979Srwatson fragment, &fragment->m_pkthdr.label); 2605100979Srwatson} 2606100979Srwatson 2607100979Srwatsonvoid 2608100979Srwatsonmac_create_ipq(struct mbuf *fragment, struct ipq *ipq) 2609100979Srwatson{ 2610100979Srwatson 2611100979Srwatson MAC_PERFORM(create_ipq, fragment, &fragment->m_pkthdr.label, ipq, 2612100979Srwatson &ipq->ipq_label); 2613100979Srwatson} 2614100979Srwatson 2615100979Srwatsonvoid 2616100979Srwatsonmac_create_mbuf_from_mbuf(struct mbuf *oldmbuf, struct mbuf *newmbuf) 2617100979Srwatson{ 2618100979Srwatson 2619100979Srwatson MAC_PERFORM(create_mbuf_from_mbuf, oldmbuf, &oldmbuf->m_pkthdr.label, 2620100979Srwatson newmbuf, &newmbuf->m_pkthdr.label); 2621100979Srwatson} 2622100979Srwatson 2623100979Srwatsonvoid 2624100979Srwatsonmac_create_mbuf_from_bpfdesc(struct bpf_d *bpf_d, struct mbuf *mbuf) 2625100979Srwatson{ 2626100979Srwatson 2627100979Srwatson MAC_PERFORM(create_mbuf_from_bpfdesc, bpf_d, &bpf_d->bd_label, mbuf, 2628100979Srwatson &mbuf->m_pkthdr.label); 2629100979Srwatson} 2630100979Srwatson 2631100979Srwatsonvoid 2632100979Srwatsonmac_create_mbuf_linklayer(struct ifnet *ifnet, struct mbuf *mbuf) 2633100979Srwatson{ 2634100979Srwatson 2635100979Srwatson MAC_PERFORM(create_mbuf_linklayer, ifnet, &ifnet->if_label, mbuf, 2636100979Srwatson &mbuf->m_pkthdr.label); 2637100979Srwatson} 2638100979Srwatson 2639100979Srwatsonvoid 2640100979Srwatsonmac_create_mbuf_from_ifnet(struct ifnet *ifnet, struct mbuf *mbuf) 2641100979Srwatson{ 2642100979Srwatson 2643100979Srwatson MAC_PERFORM(create_mbuf_from_ifnet, ifnet, &ifnet->if_label, mbuf, 2644100979Srwatson &mbuf->m_pkthdr.label); 2645100979Srwatson} 2646100979Srwatson 2647100979Srwatsonvoid 2648100979Srwatsonmac_create_mbuf_multicast_encap(struct mbuf *oldmbuf, struct ifnet *ifnet, 2649100979Srwatson struct mbuf *newmbuf) 2650100979Srwatson{ 2651100979Srwatson 2652100979Srwatson MAC_PERFORM(create_mbuf_multicast_encap, oldmbuf, 2653100979Srwatson &oldmbuf->m_pkthdr.label, ifnet, &ifnet->if_label, newmbuf, 2654100979Srwatson &newmbuf->m_pkthdr.label); 2655100979Srwatson} 2656100979Srwatson 2657100979Srwatsonvoid 2658100979Srwatsonmac_create_mbuf_netlayer(struct mbuf *oldmbuf, struct mbuf *newmbuf) 2659100979Srwatson{ 2660100979Srwatson 2661100979Srwatson MAC_PERFORM(create_mbuf_netlayer, oldmbuf, &oldmbuf->m_pkthdr.label, 2662100979Srwatson newmbuf, &newmbuf->m_pkthdr.label); 2663100979Srwatson} 2664100979Srwatson 2665100979Srwatsonint 2666100979Srwatsonmac_fragment_match(struct mbuf *fragment, struct ipq *ipq) 2667100979Srwatson{ 2668100979Srwatson int result; 2669100979Srwatson 2670100979Srwatson result = 1; 2671100979Srwatson MAC_BOOLEAN(fragment_match, &&, fragment, &fragment->m_pkthdr.label, 2672100979Srwatson ipq, &ipq->ipq_label); 2673100979Srwatson 2674100979Srwatson return (result); 2675100979Srwatson} 2676100979Srwatson 2677100979Srwatsonvoid 2678100979Srwatsonmac_update_ipq(struct mbuf *fragment, struct ipq *ipq) 2679100979Srwatson{ 2680100979Srwatson 2681100979Srwatson MAC_PERFORM(update_ipq, fragment, &fragment->m_pkthdr.label, ipq, 2682100979Srwatson &ipq->ipq_label); 2683100979Srwatson} 2684100979Srwatson 2685100979Srwatsonvoid 2686100979Srwatsonmac_create_mbuf_from_socket(struct socket *socket, struct mbuf *mbuf) 2687100979Srwatson{ 2688100979Srwatson 2689100979Srwatson MAC_PERFORM(create_mbuf_from_socket, socket, &socket->so_label, mbuf, 2690100979Srwatson &mbuf->m_pkthdr.label); 2691100979Srwatson} 2692100979Srwatson 2693100979Srwatsonvoid 2694100979Srwatsonmac_create_mount(struct ucred *cred, struct mount *mp) 2695100979Srwatson{ 2696100979Srwatson 2697100979Srwatson MAC_PERFORM(create_mount, cred, mp, &mp->mnt_mntlabel, 2698100979Srwatson &mp->mnt_fslabel); 2699100979Srwatson} 2700100979Srwatson 2701100979Srwatsonvoid 2702100979Srwatsonmac_create_root_mount(struct ucred *cred, struct mount *mp) 2703100979Srwatson{ 2704100979Srwatson 2705100979Srwatson MAC_PERFORM(create_root_mount, cred, mp, &mp->mnt_mntlabel, 2706100979Srwatson &mp->mnt_fslabel); 2707100979Srwatson} 2708100979Srwatson 2709100979Srwatsonint 2710100979Srwatsonmac_check_bpfdesc_receive(struct bpf_d *bpf_d, struct ifnet *ifnet) 2711100979Srwatson{ 2712100979Srwatson int error; 2713100979Srwatson 2714100979Srwatson if (!mac_enforce_network) 2715100979Srwatson return (0); 2716100979Srwatson 2717100979Srwatson MAC_CHECK(check_bpfdesc_receive, bpf_d, &bpf_d->bd_label, ifnet, 2718100979Srwatson &ifnet->if_label); 2719100979Srwatson 2720100979Srwatson return (error); 2721100979Srwatson} 2722100979Srwatson 2723100979Srwatsonstatic int 2724100979Srwatsonmac_check_cred_relabel(struct ucred *cred, struct label *newlabel) 2725100979Srwatson{ 2726100979Srwatson int error; 2727100979Srwatson 2728100979Srwatson MAC_CHECK(check_cred_relabel, cred, newlabel); 2729100979Srwatson 2730100979Srwatson return (error); 2731100979Srwatson} 2732100979Srwatson 2733100979Srwatsonint 2734100979Srwatsonmac_check_cred_visible(struct ucred *u1, struct ucred *u2) 2735100979Srwatson{ 2736100979Srwatson int error; 2737100979Srwatson 2738100979Srwatson if (!mac_enforce_process) 2739100979Srwatson return (0); 2740100979Srwatson 2741100979Srwatson MAC_CHECK(check_cred_visible, u1, u2); 2742100979Srwatson 2743100979Srwatson return (error); 2744100979Srwatson} 2745100979Srwatson 2746100979Srwatsonint 2747100979Srwatsonmac_check_ifnet_transmit(struct ifnet *ifnet, struct mbuf *mbuf) 2748100979Srwatson{ 2749100979Srwatson int error; 2750100979Srwatson 2751100979Srwatson if (!mac_enforce_network) 2752100979Srwatson return (0); 2753100979Srwatson 2754100979Srwatson KASSERT(mbuf->m_flags & M_PKTHDR, ("packet has no pkthdr")); 2755100979Srwatson if (!(mbuf->m_pkthdr.label.l_flags & MAC_FLAG_INITIALIZED)) 2756105598Sbrooks if_printf(ifnet, "not initialized\n"); 2757100979Srwatson 2758100979Srwatson MAC_CHECK(check_ifnet_transmit, ifnet, &ifnet->if_label, mbuf, 2759100979Srwatson &mbuf->m_pkthdr.label); 2760100979Srwatson 2761100979Srwatson return (error); 2762100979Srwatson} 2763100979Srwatson 2764100979Srwatsonint 2765100979Srwatsonmac_check_mount_stat(struct ucred *cred, struct mount *mount) 2766100979Srwatson{ 2767100979Srwatson int error; 2768100979Srwatson 2769100979Srwatson if (!mac_enforce_fs) 2770100979Srwatson return (0); 2771100979Srwatson 2772100979Srwatson MAC_CHECK(check_mount_stat, cred, mount, &mount->mnt_mntlabel); 2773100979Srwatson 2774100979Srwatson return (error); 2775100979Srwatson} 2776100979Srwatson 2777100979Srwatsonint 2778100979Srwatsonmac_check_pipe_ioctl(struct ucred *cred, struct pipe *pipe, unsigned long cmd, 2779100979Srwatson void *data) 2780100979Srwatson{ 2781100979Srwatson int error; 2782100979Srwatson 2783104269Srwatson PIPE_LOCK_ASSERT(pipe, MA_OWNED); 2784104269Srwatson 2785104269Srwatson if (!mac_enforce_pipe) 2786104269Srwatson return (0); 2787104269Srwatson 2788100979Srwatson MAC_CHECK(check_pipe_ioctl, cred, pipe, pipe->pipe_label, cmd, data); 2789100979Srwatson 2790100979Srwatson return (error); 2791100979Srwatson} 2792100979Srwatson 2793100979Srwatsonint 2794102115Srwatsonmac_check_pipe_poll(struct ucred *cred, struct pipe *pipe) 2795100979Srwatson{ 2796100979Srwatson int error; 2797100979Srwatson 2798104269Srwatson PIPE_LOCK_ASSERT(pipe, MA_OWNED); 2799104269Srwatson 2800104269Srwatson if (!mac_enforce_pipe) 2801104269Srwatson return (0); 2802104269Srwatson 2803102115Srwatson MAC_CHECK(check_pipe_poll, cred, pipe, pipe->pipe_label); 2804100979Srwatson 2805100979Srwatson return (error); 2806100979Srwatson} 2807100979Srwatson 2808102115Srwatsonint 2809102115Srwatsonmac_check_pipe_read(struct ucred *cred, struct pipe *pipe) 2810102115Srwatson{ 2811102115Srwatson int error; 2812102115Srwatson 2813104269Srwatson PIPE_LOCK_ASSERT(pipe, MA_OWNED); 2814104269Srwatson 2815104269Srwatson if (!mac_enforce_pipe) 2816104269Srwatson return (0); 2817104269Srwatson 2818102115Srwatson MAC_CHECK(check_pipe_read, cred, pipe, pipe->pipe_label); 2819102115Srwatson 2820102115Srwatson return (error); 2821102115Srwatson} 2822102115Srwatson 2823100979Srwatsonstatic int 2824100979Srwatsonmac_check_pipe_relabel(struct ucred *cred, struct pipe *pipe, 2825100979Srwatson struct label *newlabel) 2826100979Srwatson{ 2827100979Srwatson int error; 2828100979Srwatson 2829104269Srwatson PIPE_LOCK_ASSERT(pipe, MA_OWNED); 2830104269Srwatson 2831104269Srwatson if (!mac_enforce_pipe) 2832104269Srwatson return (0); 2833104269Srwatson 2834100979Srwatson MAC_CHECK(check_pipe_relabel, cred, pipe, pipe->pipe_label, newlabel); 2835100979Srwatson 2836100979Srwatson return (error); 2837100979Srwatson} 2838100979Srwatson 2839100979Srwatsonint 2840102115Srwatsonmac_check_pipe_stat(struct ucred *cred, struct pipe *pipe) 2841102115Srwatson{ 2842102115Srwatson int error; 2843102115Srwatson 2844104269Srwatson PIPE_LOCK_ASSERT(pipe, MA_OWNED); 2845104269Srwatson 2846104269Srwatson if (!mac_enforce_pipe) 2847104269Srwatson return (0); 2848104269Srwatson 2849102115Srwatson MAC_CHECK(check_pipe_stat, cred, pipe, pipe->pipe_label); 2850102115Srwatson 2851102115Srwatson return (error); 2852102115Srwatson} 2853102115Srwatson 2854102115Srwatsonint 2855102115Srwatsonmac_check_pipe_write(struct ucred *cred, struct pipe *pipe) 2856102115Srwatson{ 2857102115Srwatson int error; 2858102115Srwatson 2859104269Srwatson PIPE_LOCK_ASSERT(pipe, MA_OWNED); 2860104269Srwatson 2861104269Srwatson if (!mac_enforce_pipe) 2862104269Srwatson return (0); 2863104269Srwatson 2864102115Srwatson MAC_CHECK(check_pipe_write, cred, pipe, pipe->pipe_label); 2865102115Srwatson 2866102115Srwatson return (error); 2867102115Srwatson} 2868102115Srwatson 2869102115Srwatsonint 2870100979Srwatsonmac_check_proc_debug(struct ucred *cred, struct proc *proc) 2871100979Srwatson{ 2872100979Srwatson int error; 2873100979Srwatson 2874102103Srwatson PROC_LOCK_ASSERT(proc, MA_OWNED); 2875102103Srwatson 2876100979Srwatson if (!mac_enforce_process) 2877100979Srwatson return (0); 2878100979Srwatson 2879100979Srwatson MAC_CHECK(check_proc_debug, cred, proc); 2880100979Srwatson 2881100979Srwatson return (error); 2882100979Srwatson} 2883100979Srwatson 2884100979Srwatsonint 2885100979Srwatsonmac_check_proc_sched(struct ucred *cred, struct proc *proc) 2886100979Srwatson{ 2887100979Srwatson int error; 2888100979Srwatson 2889102103Srwatson PROC_LOCK_ASSERT(proc, MA_OWNED); 2890102103Srwatson 2891100979Srwatson if (!mac_enforce_process) 2892100979Srwatson return (0); 2893100979Srwatson 2894100979Srwatson MAC_CHECK(check_proc_sched, cred, proc); 2895100979Srwatson 2896100979Srwatson return (error); 2897100979Srwatson} 2898100979Srwatson 2899100979Srwatsonint 2900100979Srwatsonmac_check_proc_signal(struct ucred *cred, struct proc *proc, int signum) 2901100979Srwatson{ 2902100979Srwatson int error; 2903100979Srwatson 2904102103Srwatson PROC_LOCK_ASSERT(proc, MA_OWNED); 2905102103Srwatson 2906100979Srwatson if (!mac_enforce_process) 2907100979Srwatson return (0); 2908100979Srwatson 2909100979Srwatson MAC_CHECK(check_proc_signal, cred, proc, signum); 2910100979Srwatson 2911100979Srwatson return (error); 2912100979Srwatson} 2913100979Srwatson 2914100979Srwatsonint 2915100979Srwatsonmac_check_socket_bind(struct ucred *ucred, struct socket *socket, 2916100979Srwatson struct sockaddr *sockaddr) 2917100979Srwatson{ 2918100979Srwatson int error; 2919100979Srwatson 2920100979Srwatson if (!mac_enforce_socket) 2921100979Srwatson return (0); 2922100979Srwatson 2923100979Srwatson MAC_CHECK(check_socket_bind, ucred, socket, &socket->so_label, 2924100979Srwatson sockaddr); 2925100979Srwatson 2926100979Srwatson return (error); 2927100979Srwatson} 2928100979Srwatson 2929100979Srwatsonint 2930100979Srwatsonmac_check_socket_connect(struct ucred *cred, struct socket *socket, 2931100979Srwatson struct sockaddr *sockaddr) 2932100979Srwatson{ 2933100979Srwatson int error; 2934100979Srwatson 2935100979Srwatson if (!mac_enforce_socket) 2936100979Srwatson return (0); 2937100979Srwatson 2938100979Srwatson MAC_CHECK(check_socket_connect, cred, socket, &socket->so_label, 2939100979Srwatson sockaddr); 2940100979Srwatson 2941100979Srwatson return (error); 2942100979Srwatson} 2943100979Srwatson 2944100979Srwatsonint 2945101933Srwatsonmac_check_socket_deliver(struct socket *socket, struct mbuf *mbuf) 2946100979Srwatson{ 2947100979Srwatson int error; 2948100979Srwatson 2949100979Srwatson if (!mac_enforce_socket) 2950100979Srwatson return (0); 2951100979Srwatson 2952101933Srwatson MAC_CHECK(check_socket_deliver, socket, &socket->so_label, mbuf, 2953101933Srwatson &mbuf->m_pkthdr.label); 2954101933Srwatson 2955100979Srwatson return (error); 2956100979Srwatson} 2957100979Srwatson 2958100979Srwatsonint 2959101933Srwatsonmac_check_socket_listen(struct ucred *cred, struct socket *socket) 2960100979Srwatson{ 2961100979Srwatson int error; 2962100979Srwatson 2963100979Srwatson if (!mac_enforce_socket) 2964100979Srwatson return (0); 2965100979Srwatson 2966101933Srwatson MAC_CHECK(check_socket_listen, cred, socket, &socket->so_label); 2967100979Srwatson return (error); 2968100979Srwatson} 2969100979Srwatson 2970104571Srwatsonint 2971104571Srwatsonmac_check_socket_receive(struct ucred *cred, struct socket *so) 2972104571Srwatson{ 2973104571Srwatson int error; 2974104571Srwatson 2975104571Srwatson if (!mac_enforce_socket) 2976104571Srwatson return (0); 2977104571Srwatson 2978104571Srwatson MAC_CHECK(check_socket_receive, cred, so, &so->so_label); 2979104571Srwatson 2980104571Srwatson return (error); 2981104571Srwatson} 2982104571Srwatson 2983100979Srwatsonstatic int 2984100979Srwatsonmac_check_socket_relabel(struct ucred *cred, struct socket *socket, 2985100979Srwatson struct label *newlabel) 2986100979Srwatson{ 2987100979Srwatson int error; 2988100979Srwatson 2989100979Srwatson MAC_CHECK(check_socket_relabel, cred, socket, &socket->so_label, 2990100979Srwatson newlabel); 2991100979Srwatson 2992100979Srwatson return (error); 2993100979Srwatson} 2994100979Srwatson 2995100979Srwatsonint 2996104571Srwatsonmac_check_socket_send(struct ucred *cred, struct socket *so) 2997104571Srwatson{ 2998104571Srwatson int error; 2999104571Srwatson 3000104571Srwatson if (!mac_enforce_socket) 3001104571Srwatson return (0); 3002104571Srwatson 3003104571Srwatson MAC_CHECK(check_socket_send, cred, so, &so->so_label); 3004104571Srwatson 3005104571Srwatson return (error); 3006104571Srwatson} 3007104571Srwatson 3008104571Srwatsonint 3009100979Srwatsonmac_check_socket_visible(struct ucred *cred, struct socket *socket) 3010100979Srwatson{ 3011100979Srwatson int error; 3012100979Srwatson 3013100979Srwatson if (!mac_enforce_socket) 3014100979Srwatson return (0); 3015100979Srwatson 3016100979Srwatson MAC_CHECK(check_socket_visible, cred, socket, &socket->so_label); 3017100979Srwatson 3018100979Srwatson return (error); 3019100979Srwatson} 3020100979Srwatson 3021100979Srwatsonint 3022100979Srwatsonmac_ioctl_ifnet_get(struct ucred *cred, struct ifreq *ifr, 3023100979Srwatson struct ifnet *ifnet) 3024100979Srwatson{ 3025100979Srwatson struct mac label; 3026100979Srwatson int error; 3027100979Srwatson 3028100979Srwatson error = mac_externalize(&ifnet->if_label, &label); 3029100979Srwatson if (error) 3030100979Srwatson return (error); 3031100979Srwatson 3032100979Srwatson return (copyout(&label, ifr->ifr_ifru.ifru_data, sizeof(label))); 3033100979Srwatson} 3034100979Srwatson 3035100979Srwatsonint 3036100979Srwatsonmac_ioctl_ifnet_set(struct ucred *cred, struct ifreq *ifr, 3037100979Srwatson struct ifnet *ifnet) 3038100979Srwatson{ 3039100979Srwatson struct mac newlabel; 3040100979Srwatson struct label intlabel; 3041100979Srwatson int error; 3042100979Srwatson 3043100979Srwatson error = copyin(ifr->ifr_ifru.ifru_data, &newlabel, sizeof(newlabel)); 3044100979Srwatson if (error) 3045100979Srwatson return (error); 3046100979Srwatson 3047100979Srwatson error = mac_internalize(&intlabel, &newlabel); 3048100979Srwatson if (error) 3049100979Srwatson return (error); 3050100979Srwatson 3051100979Srwatson /* 3052100979Srwatson * XXX: Note that this is a redundant privilege check, since 3053100979Srwatson * policies impose this check themselves if required by the 3054100979Srwatson * policy. Eventually, this should go away. 3055100979Srwatson */ 3056100979Srwatson error = suser_cred(cred, 0); 3057100979Srwatson if (error) 3058100979Srwatson goto out; 3059100979Srwatson 3060100979Srwatson MAC_CHECK(check_ifnet_relabel, cred, ifnet, &ifnet->if_label, 3061100979Srwatson &intlabel); 3062100979Srwatson if (error) 3063100979Srwatson goto out; 3064100979Srwatson 3065100979Srwatson MAC_PERFORM(relabel_ifnet, cred, ifnet, &ifnet->if_label, &intlabel); 3066100979Srwatson 3067100979Srwatsonout: 3068100979Srwatson mac_destroy_temp(&intlabel); 3069100979Srwatson return (error); 3070100979Srwatson} 3071100979Srwatson 3072100979Srwatsonvoid 3073100979Srwatsonmac_create_devfs_vnode(struct devfs_dirent *de, struct vnode *vp) 3074100979Srwatson{ 3075100979Srwatson 3076100979Srwatson MAC_PERFORM(create_devfs_vnode, de, &de->de_label, vp, &vp->v_label); 3077100979Srwatson} 3078100979Srwatson 3079100979Srwatsonvoid 3080100979Srwatsonmac_create_devfs_device(dev_t dev, struct devfs_dirent *de) 3081100979Srwatson{ 3082100979Srwatson 3083100979Srwatson MAC_PERFORM(create_devfs_device, dev, de, &de->de_label); 3084100979Srwatson} 3085100979Srwatson 3086104533Srwatsonvoid 3087104533Srwatsonmac_create_devfs_symlink(struct ucred *cred, struct devfs_dirent *dd, 3088104533Srwatson struct devfs_dirent *de) 3089104533Srwatson{ 3090104533Srwatson 3091104533Srwatson MAC_PERFORM(create_devfs_symlink, cred, dd, &dd->de_label, de, 3092104533Srwatson &de->de_label); 3093104533Srwatson} 3094104533Srwatson 3095100979Srwatsonstatic int 3096100979Srwatsonmac_stdcreatevnode_ea(struct vnode *vp) 3097100979Srwatson{ 3098100979Srwatson int error; 3099100979Srwatson 3100100979Srwatson MAC_CHECK(stdcreatevnode_ea, vp, &vp->v_label); 3101100979Srwatson 3102100979Srwatson return (error); 3103100979Srwatson} 3104100979Srwatson 3105100979Srwatsonvoid 3106100979Srwatsonmac_create_devfs_directory(char *dirname, int dirnamelen, 3107100979Srwatson struct devfs_dirent *de) 3108100979Srwatson{ 3109100979Srwatson 3110100979Srwatson MAC_PERFORM(create_devfs_directory, dirname, dirnamelen, de, 3111100979Srwatson &de->de_label); 3112100979Srwatson} 3113100979Srwatson 3114100979Srwatson/* 3115100979Srwatson * When a new vnode is created, this call will initialize its label. 3116100979Srwatson */ 3117100979Srwatsonvoid 3118100979Srwatsonmac_create_vnode(struct ucred *cred, struct vnode *parent, 3119100979Srwatson struct vnode *child) 3120100979Srwatson{ 3121100979Srwatson int error; 3122100979Srwatson 3123100979Srwatson ASSERT_VOP_LOCKED(parent, "mac_create_vnode"); 3124100979Srwatson ASSERT_VOP_LOCKED(child, "mac_create_vnode"); 3125100979Srwatson 3126100979Srwatson error = vn_refreshlabel(parent, cred); 3127100979Srwatson if (error) { 3128100979Srwatson printf("mac_create_vnode: vn_refreshlabel returned %d\n", 3129100979Srwatson error); 3130100979Srwatson printf("mac_create_vnode: using old vnode label\n"); 3131100979Srwatson } 3132100979Srwatson 3133100979Srwatson MAC_PERFORM(create_vnode, cred, parent, &parent->v_label, child, 3134100979Srwatson &child->v_label); 3135100979Srwatson} 3136100979Srwatson 3137100979Srwatsonint 3138100979Srwatsonmac_setsockopt_label_set(struct ucred *cred, struct socket *so, 3139100979Srwatson struct mac *extmac) 3140100979Srwatson{ 3141100979Srwatson struct label intlabel; 3142100979Srwatson int error; 3143100979Srwatson 3144100979Srwatson error = mac_internalize(&intlabel, extmac); 3145100979Srwatson if (error) 3146100979Srwatson return (error); 3147100979Srwatson 3148100979Srwatson mac_check_socket_relabel(cred, so, &intlabel); 3149100979Srwatson if (error) { 3150100979Srwatson mac_destroy_temp(&intlabel); 3151100979Srwatson return (error); 3152100979Srwatson } 3153100979Srwatson 3154100979Srwatson mac_relabel_socket(cred, so, &intlabel); 3155100979Srwatson 3156100979Srwatson mac_destroy_temp(&intlabel); 3157100979Srwatson return (0); 3158100979Srwatson} 3159100979Srwatson 3160100979Srwatsonint 3161100979Srwatsonmac_pipe_label_set(struct ucred *cred, struct pipe *pipe, struct label *label) 3162100979Srwatson{ 3163100979Srwatson int error; 3164100979Srwatson 3165104269Srwatson PIPE_LOCK_ASSERT(pipe, MA_OWNED); 3166104269Srwatson 3167100979Srwatson error = mac_check_pipe_relabel(cred, pipe, label); 3168100979Srwatson if (error) 3169100979Srwatson return (error); 3170100979Srwatson 3171100979Srwatson mac_relabel_pipe(cred, pipe, label); 3172100979Srwatson 3173100979Srwatson return (0); 3174100979Srwatson} 3175100979Srwatson 3176100979Srwatsonint 3177100979Srwatsonmac_getsockopt_label_get(struct ucred *cred, struct socket *so, 3178100979Srwatson struct mac *extmac) 3179100979Srwatson{ 3180100979Srwatson 3181100979Srwatson return (mac_externalize(&so->so_label, extmac)); 3182100979Srwatson} 3183100979Srwatson 3184100979Srwatsonint 3185100979Srwatsonmac_getsockopt_peerlabel_get(struct ucred *cred, struct socket *so, 3186100979Srwatson struct mac *extmac) 3187100979Srwatson{ 3188100979Srwatson 3189100979Srwatson return (mac_externalize(&so->so_peerlabel, extmac)); 3190100979Srwatson} 3191100979Srwatson 3192100979Srwatson/* 3193100979Srwatson * Implementation of VOP_SETLABEL() that relies on extended attributes 3194100979Srwatson * to store label data. Can be referenced by filesystems supporting 3195100979Srwatson * extended attributes. 3196100979Srwatson */ 3197100979Srwatsonint 3198100979Srwatsonvop_stdsetlabel_ea(struct vop_setlabel_args *ap) 3199100979Srwatson{ 3200100979Srwatson struct vnode *vp = ap->a_vp; 3201100979Srwatson struct label *intlabel = ap->a_label; 3202100979Srwatson struct mac extmac; 3203100979Srwatson int error; 3204100979Srwatson 3205100979Srwatson ASSERT_VOP_LOCKED(vp, "vop_stdsetlabel_ea"); 3206100979Srwatson 3207100979Srwatson /* 3208100979Srwatson * XXX: Eventually call out to EA check/set calls here. 3209100979Srwatson * Be particularly careful to avoid race conditions, 3210100979Srwatson * consistency problems, and stability problems when 3211100979Srwatson * dealing with multiple EAs. In particular, we require 3212100979Srwatson * the ability to write multiple EAs on the same file in 3213100979Srwatson * a single transaction, which the current EA interface 3214100979Srwatson * does not provide. 3215100979Srwatson */ 3216100979Srwatson 3217100979Srwatson error = mac_externalize(intlabel, &extmac); 3218100979Srwatson if (error) 3219100979Srwatson return (error); 3220100979Srwatson 3221100979Srwatson error = vn_extattr_set(vp, IO_NODELOCKED, 3222100979Srwatson FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME, 3223100979Srwatson sizeof(extmac), (char *)&extmac, curthread); 3224100979Srwatson if (error) 3225100979Srwatson return (error); 3226100979Srwatson 3227100979Srwatson mac_relabel_vnode(ap->a_cred, vp, intlabel); 3228100979Srwatson 3229101308Sjeff vp->v_vflag |= VV_CACHEDLABEL; 3230100979Srwatson 3231100979Srwatson return (0); 3232100979Srwatson} 3233100979Srwatson 3234100979Srwatsonstatic int 3235100979Srwatsonvn_setlabel(struct vnode *vp, struct label *intlabel, struct ucred *cred) 3236100979Srwatson{ 3237100979Srwatson int error; 3238100979Srwatson 3239100979Srwatson if (vp->v_mount == NULL) { 3240100979Srwatson /* printf("vn_setlabel: null v_mount\n"); */ 3241103314Snjl if (vp->v_type != VNON) 3242103314Snjl printf("vn_setlabel: null v_mount with non-VNON\n"); 3243100979Srwatson return (EBADF); 3244100979Srwatson } 3245100979Srwatson 3246100979Srwatson if ((vp->v_mount->mnt_flag & MNT_MULTILABEL) == 0) 3247100979Srwatson return (EOPNOTSUPP); 3248100979Srwatson 3249100979Srwatson /* 3250100979Srwatson * Multi-phase commit. First check the policies to confirm the 3251100979Srwatson * change is OK. Then commit via the filesystem. Finally, 3252100979Srwatson * update the actual vnode label. Question: maybe the filesystem 3253100979Srwatson * should update the vnode at the end as part of VOP_SETLABEL()? 3254100979Srwatson */ 3255100979Srwatson error = mac_check_vnode_relabel(cred, vp, intlabel); 3256100979Srwatson if (error) 3257100979Srwatson return (error); 3258100979Srwatson 3259100979Srwatson /* 3260100979Srwatson * VADMIN provides the opportunity for the filesystem to make 3261100979Srwatson * decisions about who is and is not able to modify labels 3262100979Srwatson * and protections on files. This might not be right. We can't 3263100979Srwatson * assume VOP_SETLABEL() will do it, because we might implement 3264100979Srwatson * that as part of vop_stdsetlabel_ea(). 3265100979Srwatson */ 3266100979Srwatson error = VOP_ACCESS(vp, VADMIN, cred, curthread); 3267100979Srwatson if (error) 3268100979Srwatson return (error); 3269100979Srwatson 3270100979Srwatson error = VOP_SETLABEL(vp, intlabel, cred, curthread); 3271100979Srwatson if (error) 3272100979Srwatson return (error); 3273100979Srwatson 3274100979Srwatson return (0); 3275100979Srwatson} 3276100979Srwatson 3277100979Srwatson/* 3278100979Srwatson * MPSAFE 3279100979Srwatson */ 3280100979Srwatsonint 3281100894Srwatson__mac_get_proc(struct thread *td, struct __mac_get_proc_args *uap) 3282100894Srwatson{ 3283100979Srwatson struct mac extmac; 3284100979Srwatson int error; 3285100894Srwatson 3286100979Srwatson error = mac_externalize(&td->td_ucred->cr_label, &extmac); 3287100979Srwatson if (error == 0) 3288100979Srwatson error = copyout(&extmac, SCARG(uap, mac_p), sizeof(extmac)); 3289100979Srwatson 3290100979Srwatson return (error); 3291100979Srwatson} 3292100979Srwatson 3293100979Srwatson/* 3294100979Srwatson * MPSAFE 3295100979Srwatson */ 3296100979Srwatsonint 3297100979Srwatson__mac_set_proc(struct thread *td, struct __mac_set_proc_args *uap) 3298100979Srwatson{ 3299100979Srwatson struct ucred *newcred, *oldcred; 3300100979Srwatson struct proc *p; 3301100979Srwatson struct mac extmac; 3302100979Srwatson struct label intlabel; 3303100979Srwatson int error; 3304100979Srwatson 3305100979Srwatson error = copyin(SCARG(uap, mac_p), &extmac, sizeof(extmac)); 3306100979Srwatson if (error) 3307100979Srwatson return (error); 3308100979Srwatson 3309100979Srwatson error = mac_internalize(&intlabel, &extmac); 3310100979Srwatson if (error) 3311100979Srwatson return (error); 3312100979Srwatson 3313100979Srwatson newcred = crget(); 3314100979Srwatson 3315100979Srwatson p = td->td_proc; 3316100979Srwatson PROC_LOCK(p); 3317100979Srwatson oldcred = p->p_ucred; 3318100979Srwatson 3319100979Srwatson error = mac_check_cred_relabel(oldcred, &intlabel); 3320100979Srwatson if (error) { 3321100979Srwatson PROC_UNLOCK(p); 3322100979Srwatson mac_destroy_temp(&intlabel); 3323100979Srwatson crfree(newcred); 3324100979Srwatson return (error); 3325100979Srwatson } 3326100979Srwatson 3327100979Srwatson setsugid(p); 3328100979Srwatson crcopy(newcred, oldcred); 3329100979Srwatson mac_relabel_cred(newcred, &intlabel); 3330102136Srwatson p->p_ucred = newcred; 3331100979Srwatson 3332102136Srwatson /* 3333102136Srwatson * Grab additional reference for use while revoking mmaps, prior 3334102136Srwatson * to releasing the proc lock and sharing the cred. 3335102136Srwatson */ 3336102136Srwatson crhold(newcred); 3337100979Srwatson PROC_UNLOCK(p); 3338102136Srwatson 3339103135Srwatson mtx_lock(&Giant); 3340102136Srwatson mac_cred_mmapped_drop_perms(td, newcred); 3341103135Srwatson mtx_unlock(&Giant); 3342102136Srwatson 3343102136Srwatson crfree(newcred); /* Free revocation reference. */ 3344100979Srwatson crfree(oldcred); 3345100979Srwatson mac_destroy_temp(&intlabel); 3346100979Srwatson return (0); 3347100979Srwatson} 3348100979Srwatson 3349100979Srwatson/* 3350100979Srwatson * MPSAFE 3351100979Srwatson */ 3352100979Srwatsonint 3353100979Srwatson__mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap) 3354100979Srwatson{ 3355100979Srwatson struct file *fp; 3356100979Srwatson struct mac extmac; 3357100979Srwatson struct vnode *vp; 3358100979Srwatson struct pipe *pipe; 3359100979Srwatson int error; 3360100979Srwatson 3361100979Srwatson mtx_lock(&Giant); 3362100979Srwatson 3363100979Srwatson error = fget(td, SCARG(uap, fd), &fp); 3364100979Srwatson if (error) 3365100979Srwatson goto out; 3366100979Srwatson 3367100979Srwatson switch (fp->f_type) { 3368100979Srwatson case DTYPE_FIFO: 3369100979Srwatson case DTYPE_VNODE: 3370100979Srwatson vp = (struct vnode *)fp->f_data; 3371100979Srwatson 3372100979Srwatson vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); 3373100979Srwatson error = vn_refreshlabel(vp, td->td_ucred); 3374100979Srwatson if (error == 0) 3375100979Srwatson error = mac_externalize(&vp->v_label, &extmac); 3376100979Srwatson VOP_UNLOCK(vp, 0, td); 3377100979Srwatson break; 3378100979Srwatson case DTYPE_PIPE: 3379100979Srwatson pipe = (struct pipe *)fp->f_data; 3380100979Srwatson error = mac_externalize(pipe->pipe_label, &extmac); 3381100979Srwatson break; 3382100979Srwatson default: 3383100979Srwatson error = EINVAL; 3384100979Srwatson } 3385100979Srwatson 3386100979Srwatson if (error == 0) 3387100979Srwatson error = copyout(&extmac, SCARG(uap, mac_p), sizeof(extmac)); 3388100979Srwatson 3389100979Srwatson fdrop(fp, td); 3390100979Srwatson 3391100979Srwatsonout: 3392100979Srwatson mtx_unlock(&Giant); 3393100979Srwatson return (error); 3394100979Srwatson} 3395100979Srwatson 3396100979Srwatson/* 3397100979Srwatson * MPSAFE 3398100979Srwatson */ 3399100979Srwatsonint 3400100979Srwatson__mac_get_file(struct thread *td, struct __mac_get_file_args *uap) 3401100979Srwatson{ 3402100979Srwatson struct nameidata nd; 3403100979Srwatson struct mac extmac; 3404100979Srwatson int error; 3405100979Srwatson 3406100979Srwatson mtx_lock(&Giant); 3407100979Srwatson NDINIT(&nd, LOOKUP, LOCKLEAF | FOLLOW, UIO_USERSPACE, 3408100979Srwatson SCARG(uap, path_p), td); 3409100979Srwatson error = namei(&nd); 3410100979Srwatson if (error) 3411100979Srwatson goto out; 3412100979Srwatson 3413100979Srwatson error = vn_refreshlabel(nd.ni_vp, td->td_ucred); 3414100979Srwatson if (error == 0) 3415100979Srwatson error = mac_externalize(&nd.ni_vp->v_label, &extmac); 3416100979Srwatson NDFREE(&nd, 0); 3417100979Srwatson if (error) 3418100979Srwatson goto out; 3419100979Srwatson 3420100979Srwatson error = copyout(&extmac, SCARG(uap, mac_p), sizeof(extmac)); 3421100979Srwatson 3422100979Srwatsonout: 3423100979Srwatson mtx_unlock(&Giant); 3424100979Srwatson return (error); 3425100979Srwatson} 3426100979Srwatson 3427100979Srwatson/* 3428100979Srwatson * MPSAFE 3429100979Srwatson */ 3430100979Srwatsonint 3431100979Srwatson__mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap) 3432100979Srwatson{ 3433100979Srwatson struct file *fp; 3434100979Srwatson struct mac extmac; 3435100979Srwatson struct label intlabel; 3436100979Srwatson struct mount *mp; 3437100979Srwatson struct vnode *vp; 3438100979Srwatson struct pipe *pipe; 3439100979Srwatson int error; 3440100979Srwatson 3441100979Srwatson mtx_lock(&Giant); 3442100979Srwatson error = fget(td, SCARG(uap, fd), &fp); 3443100979Srwatson if (error) 3444100979Srwatson goto out1; 3445100979Srwatson 3446100979Srwatson error = copyin(SCARG(uap, mac_p), &extmac, sizeof(extmac)); 3447100979Srwatson if (error) 3448100979Srwatson goto out2; 3449100979Srwatson 3450100979Srwatson error = mac_internalize(&intlabel, &extmac); 3451100979Srwatson if (error) 3452100979Srwatson goto out2; 3453100979Srwatson 3454100979Srwatson switch (fp->f_type) { 3455100979Srwatson case DTYPE_FIFO: 3456100979Srwatson case DTYPE_VNODE: 3457100979Srwatson vp = (struct vnode *)fp->f_data; 3458100979Srwatson error = vn_start_write(vp, &mp, V_WAIT | PCATCH); 3459100979Srwatson if (error != 0) 3460100979Srwatson break; 3461100979Srwatson 3462100979Srwatson vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); 3463100979Srwatson error = vn_setlabel(vp, &intlabel, td->td_ucred); 3464100979Srwatson VOP_UNLOCK(vp, 0, td); 3465100979Srwatson vn_finished_write(mp); 3466100979Srwatson mac_destroy_temp(&intlabel); 3467100979Srwatson break; 3468100979Srwatson case DTYPE_PIPE: 3469100979Srwatson pipe = (struct pipe *)fp->f_data; 3470104269Srwatson PIPE_LOCK(pipe); 3471100979Srwatson error = mac_pipe_label_set(td->td_ucred, pipe, &intlabel); 3472104269Srwatson PIPE_UNLOCK(pipe); 3473100979Srwatson break; 3474100979Srwatson default: 3475100979Srwatson error = EINVAL; 3476100979Srwatson } 3477100979Srwatson 3478100979Srwatsonout2: 3479100979Srwatson fdrop(fp, td); 3480100979Srwatsonout1: 3481100979Srwatson mtx_unlock(&Giant); 3482100979Srwatson return (error); 3483100979Srwatson} 3484100979Srwatson 3485100979Srwatson/* 3486100979Srwatson * MPSAFE 3487100979Srwatson */ 3488100979Srwatsonint 3489100979Srwatson__mac_set_file(struct thread *td, struct __mac_set_file_args *uap) 3490100979Srwatson{ 3491100979Srwatson struct nameidata nd; 3492100979Srwatson struct mac extmac; 3493100979Srwatson struct label intlabel; 3494100979Srwatson struct mount *mp; 3495100979Srwatson int error; 3496100979Srwatson 3497100979Srwatson mtx_lock(&Giant); 3498100979Srwatson 3499100979Srwatson error = copyin(SCARG(uap, mac_p), &extmac, sizeof(extmac)); 3500100979Srwatson if (error) 3501100979Srwatson goto out; 3502100979Srwatson 3503100979Srwatson error = mac_internalize(&intlabel, &extmac); 3504100979Srwatson if (error) 3505100979Srwatson goto out; 3506100979Srwatson 3507100979Srwatson NDINIT(&nd, LOOKUP, LOCKLEAF | FOLLOW, UIO_USERSPACE, 3508100979Srwatson SCARG(uap, path_p), td); 3509100979Srwatson error = namei(&nd); 3510100979Srwatson if (error) 3511100979Srwatson goto out2; 3512100979Srwatson error = vn_start_write(nd.ni_vp, &mp, V_WAIT | PCATCH); 3513100979Srwatson if (error) 3514100979Srwatson goto out2; 3515100979Srwatson 3516100979Srwatson error = vn_setlabel(nd.ni_vp, &intlabel, td->td_ucred); 3517100979Srwatson 3518100979Srwatson vn_finished_write(mp); 3519100979Srwatsonout2: 3520100979Srwatson mac_destroy_temp(&intlabel); 3521100979Srwatson NDFREE(&nd, 0); 3522100979Srwatsonout: 3523100979Srwatson mtx_unlock(&Giant); 3524100979Srwatson return (error); 3525100979Srwatson} 3526100979Srwatson 3527102123Srwatsonint 3528102123Srwatsonmac_syscall(struct thread *td, struct mac_syscall_args *uap) 3529102123Srwatson{ 3530102123Srwatson struct mac_policy_conf *mpc; 3531102123Srwatson char target[MAC_MAX_POLICY_NAME]; 3532102123Srwatson int error; 3533102123Srwatson 3534102123Srwatson error = copyinstr(SCARG(uap, policy), target, sizeof(target), NULL); 3535102123Srwatson if (error) 3536102123Srwatson return (error); 3537102123Srwatson 3538102123Srwatson error = ENOSYS; 3539102123Srwatson MAC_POLICY_LIST_BUSY(); 3540102123Srwatson LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { 3541102123Srwatson if (strcmp(mpc->mpc_name, target) == 0 && 3542102123Srwatson mpc->mpc_ops->mpo_syscall != NULL) { 3543102123Srwatson error = mpc->mpc_ops->mpo_syscall(td, 3544102123Srwatson SCARG(uap, call), SCARG(uap, arg)); 3545102123Srwatson goto out; 3546102123Srwatson } 3547102123Srwatson } 3548102123Srwatson 3549102123Srwatsonout: 3550102123Srwatson MAC_POLICY_LIST_UNBUSY(); 3551102123Srwatson return (error); 3552102123Srwatson} 3553102123Srwatson 3554100979SrwatsonSYSINIT(mac, SI_SUB_MAC, SI_ORDER_FIRST, mac_init, NULL); 3555100979SrwatsonSYSINIT(mac_late, SI_SUB_MAC_LATE, SI_ORDER_FIRST, mac_late_init, NULL); 3556100979Srwatson 3557100979Srwatson#else /* !MAC */ 3558100979Srwatson 3559100979Srwatsonint 3560100979Srwatson__mac_get_proc(struct thread *td, struct __mac_get_proc_args *uap) 3561100979Srwatson{ 3562100979Srwatson 3563100894Srwatson return (ENOSYS); 3564100894Srwatson} 3565100894Srwatson 3566100894Srwatsonint 3567100894Srwatson__mac_set_proc(struct thread *td, struct __mac_set_proc_args *uap) 3568100894Srwatson{ 3569100894Srwatson 3570100894Srwatson return (ENOSYS); 3571100894Srwatson} 3572100894Srwatson 3573100894Srwatsonint 3574100894Srwatson__mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap) 3575100894Srwatson{ 3576100894Srwatson 3577100894Srwatson return (ENOSYS); 3578100894Srwatson} 3579100894Srwatson 3580100894Srwatsonint 3581100894Srwatson__mac_get_file(struct thread *td, struct __mac_get_file_args *uap) 3582100894Srwatson{ 3583100894Srwatson 3584100894Srwatson return (ENOSYS); 3585100894Srwatson} 3586100894Srwatson 3587100894Srwatsonint 3588100894Srwatson__mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap) 3589100894Srwatson{ 3590100894Srwatson 3591100894Srwatson return (ENOSYS); 3592100894Srwatson} 3593100894Srwatson 3594100894Srwatsonint 3595100894Srwatson__mac_set_file(struct thread *td, struct __mac_set_file_args *uap) 3596100894Srwatson{ 3597100894Srwatson 3598100894Srwatson return (ENOSYS); 3599100894Srwatson} 3600100979Srwatson 3601102123Srwatsonint 3602102123Srwatsonmac_syscall(struct thread *td, struct mac_syscall_args *uap) 3603102123Srwatson{ 3604102123Srwatson 3605102123Srwatson return (ENOSYS); 3606102123Srwatson} 3607102123Srwatson 3608100979Srwatson#endif /* !MAC */ 3609