mac_vfs.c revision 119184 
1/*-
2 * Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson
3 * Copyright (c) 2001 Ilmar S. Habibulin
4 * Copyright (c) 2001, 2002, 2003 Networks Associates Technology, Inc.
5 * All rights reserved.
6 *
7 * This software was developed by Robert Watson and Ilmar Habibulin for the
8 * TrustedBSD Project.
9 *
10 * This software was developed for the FreeBSD Project in part by Network
11 * Associates Laboratories, the Security Research Division of Network
12 * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"),
13 * as part of the DARPA CHATS research program.
14 *
15 * Redistribution and use in source and binary forms, with or without
16 * modification, are permitted provided that the following conditions
17 * are met:
18 * 1. Redistributions of source code must retain the above copyright
19 *    notice, this list of conditions and the following disclaimer.
20 * 2. Redistributions in binary form must reproduce the above copyright
21 *    notice, this list of conditions and the following disclaimer in the
22 *    documentation and/or other materials provided with the distribution.
23 *
24 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
25 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
26 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
27 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
28 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
29 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
30 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
31 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
32 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
33 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34 * SUCH DAMAGE.
35 */
36
37/*
38 * Framework for extensible kernel access control.  Kernel and userland
39 * interface to the framework, policy registration and composition.
40 */
41
42#include <sys/cdefs.h>
43__FBSDID("$FreeBSD: head/sys/security/mac/mac_vfs.c 119184 2003-08-20 19:16:49Z rwatson $");
44
45#include "opt_mac.h"
46#include "opt_devfs.h"
47
48#include <sys/param.h>
49#include <sys/condvar.h>
50#include <sys/extattr.h>
51#include <sys/imgact.h>
52#include <sys/kernel.h>
53#include <sys/lock.h>
54#include <sys/malloc.h>
55#include <sys/mutex.h>
56#include <sys/mac.h>
57#include <sys/module.h>
58#include <sys/proc.h>
59#include <sys/sbuf.h>
60#include <sys/systm.h>
61#include <sys/sysproto.h>
62#include <sys/sysent.h>
63#include <sys/vnode.h>
64#include <sys/mount.h>
65#include <sys/file.h>
66#include <sys/namei.h>
67#include <sys/socket.h>
68#include <sys/pipe.h>
69#include <sys/socketvar.h>
70#include <sys/sysctl.h>
71
72#include <vm/vm.h>
73#include <vm/pmap.h>
74#include <vm/vm_map.h>
75#include <vm/vm_object.h>
76
77#include <sys/mac_policy.h>
78
79#include <fs/devfs/devfs.h>
80
81#include <net/bpfdesc.h>
82#include <net/if.h>
83#include <net/if_var.h>
84
85#include <netinet/in.h>
86#include <netinet/ip_var.h>
87
88#ifdef MAC
89
90/*
91 * Declare that the kernel provides MAC support, version 1.  This permits
92 * modules to refuse to be loaded if the necessary support isn't present,
93 * even if it's pre-boot.
94 */
95MODULE_VERSION(kernel_mac_support, 1);
96
97SYSCTL_DECL(_security);
98
99SYSCTL_NODE(_security, OID_AUTO, mac, CTLFLAG_RW, 0,
100    "TrustedBSD MAC policy controls");
101
102#if MAC_MAX_SLOTS > 32
103#error "MAC_MAX_SLOTS too large"
104#endif
105
106static unsigned int mac_max_slots = MAC_MAX_SLOTS;
107static unsigned int mac_slot_offsets_free = (1 << MAC_MAX_SLOTS) - 1;
108SYSCTL_UINT(_security_mac, OID_AUTO, max_slots, CTLFLAG_RD,
109    &mac_max_slots, 0, "");
110
111/*
112 * Has the kernel started generating labeled objects yet?  All read/write
113 * access to this variable is serialized during the boot process.  Following
114 * the end of serialization, we don't update this flag; no locking.
115 */
116static int	mac_late = 0;
117
118/*
119 * Warn about EA transactions only the first time they happen.
120 * Weak coherency, no locking.
121 */
122static int	ea_warn_once = 0;
123
124/*
125 * Flag to indicate whether or not we should allocate label storage for
126 * new mbufs.  Since most dynamic policies we currently work with don't
127 * rely on mbuf labeling, try to avoid paying the cost of mtag allocation
128 * unless specifically notified of interest.  One result of this is
129 * that if a dynamically loaded policy requests mbuf labels, it must
130 * be able to deal with a NULL label being returned on any mbufs that
131 * were already in flight when the policy was loaded.  Since the policy
132 * already has to deal with uninitialized labels, this probably won't
133 * be a problem.  Note: currently no locking.  Will this be a problem?
134 */
135#ifndef MAC_ALWAYS_LABEL_MBUF
136static int	mac_labelmbufs = 0;
137#endif
138
139static int	mac_enforce_fs = 1;
140SYSCTL_INT(_security_mac, OID_AUTO, enforce_fs, CTLFLAG_RW,
141    &mac_enforce_fs, 0, "Enforce MAC policy on file system objects");
142TUNABLE_INT("security.mac.enforce_fs", &mac_enforce_fs);
143
144static int	mac_enforce_kld = 1;
145SYSCTL_INT(_security_mac, OID_AUTO, enforce_kld, CTLFLAG_RW,
146    &mac_enforce_kld, 0, "Enforce MAC policy on kld operations");
147TUNABLE_INT("security.mac.enforce_kld", &mac_enforce_kld);
148
149static int	mac_enforce_network = 1;
150SYSCTL_INT(_security_mac, OID_AUTO, enforce_network, CTLFLAG_RW,
151    &mac_enforce_network, 0, "Enforce MAC policy on network packets");
152TUNABLE_INT("security.mac.enforce_network", &mac_enforce_network);
153
154static int	mac_enforce_pipe = 1;
155SYSCTL_INT(_security_mac, OID_AUTO, enforce_pipe, CTLFLAG_RW,
156    &mac_enforce_pipe, 0, "Enforce MAC policy on pipe operations");
157TUNABLE_INT("security.mac.enforce_pipe", &mac_enforce_pipe);
158
159static int	mac_enforce_process = 1;
160SYSCTL_INT(_security_mac, OID_AUTO, enforce_process, CTLFLAG_RW,
161    &mac_enforce_process, 0, "Enforce MAC policy on inter-process operations");
162TUNABLE_INT("security.mac.enforce_process", &mac_enforce_process);
163
164static int	mac_enforce_socket = 1;
165SYSCTL_INT(_security_mac, OID_AUTO, enforce_socket, CTLFLAG_RW,
166    &mac_enforce_socket, 0, "Enforce MAC policy on socket operations");
167TUNABLE_INT("security.mac.enforce_socket", &mac_enforce_socket);
168
169static int	mac_enforce_system = 1;
170SYSCTL_INT(_security_mac, OID_AUTO, enforce_system, CTLFLAG_RW,
171    &mac_enforce_system, 0, "Enforce MAC policy on system operations");
172TUNABLE_INT("security.mac.enforce_system", &mac_enforce_system);
173
174static int	mac_enforce_vm = 1;
175SYSCTL_INT(_security_mac, OID_AUTO, enforce_vm, CTLFLAG_RW,
176    &mac_enforce_vm, 0, "Enforce MAC policy on vm operations");
177TUNABLE_INT("security.mac.enforce_vm", &mac_enforce_vm);
178
179static int	mac_mmap_revocation = 1;
180SYSCTL_INT(_security_mac, OID_AUTO, mmap_revocation, CTLFLAG_RW,
181    &mac_mmap_revocation, 0, "Revoke mmap access to files on subject "
182    "relabel");
183static int	mac_mmap_revocation_via_cow = 0;
184SYSCTL_INT(_security_mac, OID_AUTO, mmap_revocation_via_cow, CTLFLAG_RW,
185    &mac_mmap_revocation_via_cow, 0, "Revoke mmap access to files via "
186    "copy-on-write semantics, or by removing all write access");
187
188#ifdef MAC_DEBUG
189SYSCTL_NODE(_security_mac, OID_AUTO, debug, CTLFLAG_RW, 0,
190    "TrustedBSD MAC debug info");
191
192static int	mac_debug_label_fallback = 0;
193SYSCTL_INT(_security_mac_debug, OID_AUTO, label_fallback, CTLFLAG_RW,
194    &mac_debug_label_fallback, 0, "Filesystems should fall back to fs label"
195    "when label is corrupted.");
196TUNABLE_INT("security.mac.debug_label_fallback",
197    &mac_debug_label_fallback);
198
199SYSCTL_NODE(_security_mac_debug, OID_AUTO, counters, CTLFLAG_RW, 0,
200    "TrustedBSD MAC object counters");
201
202static unsigned int nmacmbufs, nmaccreds, nmacifnets, nmacbpfdescs,
203    nmacsockets, nmacmounts, nmactemp, nmacvnodes, nmacdevfsdirents,
204    nmacipqs, nmacpipes, nmacprocs;
205
206#define	MAC_DEBUG_COUNTER_INC(x)	atomic_add_int(x, 1);
207#define	MAC_DEBUG_COUNTER_DEC(x)	atomic_subtract_int(x, 1);
208
209SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, mbufs, CTLFLAG_RD,
210    &nmacmbufs, 0, "number of mbufs in use");
211SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, creds, CTLFLAG_RD,
212    &nmaccreds, 0, "number of ucreds in use");
213SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, ifnets, CTLFLAG_RD,
214    &nmacifnets, 0, "number of ifnets in use");
215SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, ipqs, CTLFLAG_RD,
216    &nmacipqs, 0, "number of ipqs in use");
217SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, bpfdescs, CTLFLAG_RD,
218    &nmacbpfdescs, 0, "number of bpfdescs in use");
219SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, sockets, CTLFLAG_RD,
220    &nmacsockets, 0, "number of sockets in use");
221SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, pipes, CTLFLAG_RD,
222    &nmacpipes, 0, "number of pipes in use");
223SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, procs, CTLFLAG_RD,
224    &nmacprocs, 0, "number of procs in use");
225SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, mounts, CTLFLAG_RD,
226    &nmacmounts, 0, "number of mounts in use");
227SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, temp, CTLFLAG_RD,
228    &nmactemp, 0, "number of temporary labels in use");
229SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, vnodes, CTLFLAG_RD,
230    &nmacvnodes, 0, "number of vnodes in use");
231SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, devfsdirents, CTLFLAG_RD,
232    &nmacdevfsdirents, 0, "number of devfs dirents inuse");
233#else
234#define	MAC_DEBUG_COUNTER_INC(x)
235#define	MAC_DEBUG_COUNTER_DEC(x)
236#endif
237
238static int	error_select(int error1, int error2);
239static int	mac_policy_register(struct mac_policy_conf *mpc);
240static int	mac_policy_unregister(struct mac_policy_conf *mpc);
241
242static void	mac_check_vnode_mmap_downgrade(struct ucred *cred,
243		    struct vnode *vp, int *prot);
244static void	mac_cred_mmapped_drop_perms_recurse(struct thread *td,
245		    struct ucred *cred, struct vm_map *map);
246
247static void	mac_destroy_socket_label(struct label *label);
248
249static int	mac_setlabel_vnode_extattr(struct ucred *cred,
250		    struct vnode *vp, struct label *intlabel);
251
252MALLOC_DEFINE(M_MACPIPELABEL, "macpipelabel", "MAC labels for pipes");
253MALLOC_DEFINE(M_MACTEMP, "mactemp", "MAC temporary label storage");
254
255/*
256 * mac_static_policy_list holds a list of policy modules that are not
257 * loaded while the system is "live", and cannot be unloaded.  These
258 * policies can be invoked without holding the busy count.
259 *
260 * mac_policy_list stores the list of dynamic policies.  A busy count is
261 * maintained for the list, stored in mac_policy_busy.  The busy count
262 * is protected by mac_policy_mtx; the list may be modified only
263 * while the busy count is 0, requiring that the lock be held to
264 * prevent new references to the list from being acquired.  For almost
265 * all operations, incrementing the busy count is sufficient to
266 * guarantee consistency, as the list cannot be modified while the
267 * busy count is elevated.  For a few special operations involving a
268 * change to the list of active policies, the mtx itself must be held.
269 * A condition variable, mac_policy_cv, is used to signal potential
270 * exclusive consumers that they should try to acquire the lock if a
271 * first attempt at exclusive access fails.
272 */
273static struct mtx mac_policy_mtx;
274static struct cv mac_policy_cv;
275static int mac_policy_count;
276static LIST_HEAD(, mac_policy_conf) mac_policy_list;
277static LIST_HEAD(, mac_policy_conf) mac_static_policy_list;
278
279/*
280 * We manually invoke WITNESS_WARN() to allow Witness to generate
281 * warnings even if we don't end up ever triggering the wait at
282 * run-time.  The consumer of the exclusive interface must not hold
283 * any locks (other than potentially Giant) since we may sleep for
284 * long (potentially indefinite) periods of time waiting for the
285 * framework to become quiescent so that a policy list change may
286 * be made.
287 */
288static __inline void
289mac_policy_grab_exclusive(void)
290{
291	WITNESS_WARN(WARN_GIANTOK | WARN_SLEEPOK, NULL,
292 	    "mac_policy_grab_exclusive() at %s:%d", __FILE__, __LINE__);
293	mtx_lock(&mac_policy_mtx);
294	while (mac_policy_count != 0)
295		cv_wait(&mac_policy_cv, &mac_policy_mtx);
296}
297
298static __inline void
299mac_policy_assert_exclusive(void)
300{
301	mtx_assert(&mac_policy_mtx, MA_OWNED);
302	KASSERT(mac_policy_count == 0,
303	    ("mac_policy_assert_exclusive(): not exclusive"));
304}
305
306static __inline void
307mac_policy_release_exclusive(void)
308{
309
310	KASSERT(mac_policy_count == 0,
311	    ("mac_policy_release_exclusive(): not exclusive"));
312	mtx_unlock(&mac_policy_mtx);
313	cv_signal(&mac_policy_cv);
314}
315
316static __inline void
317mac_policy_list_busy(void)
318{
319	mtx_lock(&mac_policy_mtx);
320	mac_policy_count++;
321	mtx_unlock(&mac_policy_mtx);
322}
323
324static __inline int
325mac_policy_list_conditional_busy(void)
326{
327	int ret;
328
329	mtx_lock(&mac_policy_mtx);
330	if (!LIST_EMPTY(&mac_policy_list)) {
331		mac_policy_count++;
332		ret = 1;
333	} else
334		ret = 0;
335	mtx_unlock(&mac_policy_mtx);
336	return (ret);
337}
338
339static __inline void
340mac_policy_list_unbusy(void)
341{
342	mtx_lock(&mac_policy_mtx);
343	mac_policy_count--;
344	KASSERT(mac_policy_count >= 0, ("MAC_POLICY_LIST_LOCK"));
345	if (mac_policy_count == 0)
346		cv_signal(&mac_policy_cv);
347	mtx_unlock(&mac_policy_mtx);
348}
349
350/*
351 * MAC_CHECK performs the designated check by walking the policy
352 * module list and checking with each as to how it feels about the
353 * request.  Note that it returns its value via 'error' in the scope
354 * of the caller.
355 */
356#define	MAC_CHECK(check, args...) do {					\
357	struct mac_policy_conf *mpc;					\
358	int entrycount;							\
359									\
360	error = 0;							\
361	LIST_FOREACH(mpc, &mac_static_policy_list, mpc_list) {		\
362		if (mpc->mpc_ops->mpo_ ## check != NULL)		\
363			error = error_select(				\
364			    mpc->mpc_ops->mpo_ ## check (args),		\
365			    error);					\
366	}								\
367	if ((entrycount = mac_policy_list_conditional_busy()) != 0) {	\
368		LIST_FOREACH(mpc, &mac_policy_list, mpc_list) {		\
369			if (mpc->mpc_ops->mpo_ ## check != NULL)	\
370				error = error_select(			\
371				    mpc->mpc_ops->mpo_ ## check (args),	\
372				    error);				\
373		}							\
374		mac_policy_list_unbusy();				\
375	}								\
376} while (0)
377
378/*
379 * MAC_BOOLEAN performs the designated boolean composition by walking
380 * the module list, invoking each instance of the operation, and
381 * combining the results using the passed C operator.  Note that it
382 * returns its value via 'result' in the scope of the caller, which
383 * should be initialized by the caller in a meaningful way to get
384 * a meaningful result.
385 */
386#define	MAC_BOOLEAN(operation, composition, args...) do {		\
387	struct mac_policy_conf *mpc;					\
388	int entrycount;							\
389									\
390	LIST_FOREACH(mpc, &mac_static_policy_list, mpc_list) {		\
391		if (mpc->mpc_ops->mpo_ ## operation != NULL)		\
392			result = result composition			\
393			    mpc->mpc_ops->mpo_ ## operation (args);	\
394	}								\
395	if ((entrycount = mac_policy_list_conditional_busy()) != 0) {	\
396		LIST_FOREACH(mpc, &mac_policy_list, mpc_list) {		\
397			if (mpc->mpc_ops->mpo_ ## operation != NULL)	\
398				result = result composition		\
399				    mpc->mpc_ops->mpo_ ## operation	\
400				    (args);				\
401		}							\
402		mac_policy_list_unbusy();				\
403	}								\
404} while (0)
405
406#define	MAC_EXTERNALIZE(type, label, elementlist, outbuf, 		\
407    outbuflen) do {							\
408	int claimed, first, ignorenotfound, savedlen;			\
409	char *element_name, *element_temp;				\
410	struct sbuf sb;							\
411									\
412	error = 0;							\
413	first = 1;							\
414	sbuf_new(&sb, outbuf, outbuflen, SBUF_FIXEDLEN);		\
415	element_temp = elementlist;					\
416	while ((element_name = strsep(&element_temp, ",")) != NULL) {	\
417		if (element_name[0] == '?') {				\
418			element_name++;					\
419			ignorenotfound = 1;				\
420		 } else							\
421			ignorenotfound = 0;				\
422		savedlen = sbuf_len(&sb);				\
423		if (first) {						\
424			error = sbuf_printf(&sb, "%s/", element_name);	\
425			first = 0;					\
426		} else							\
427			error = sbuf_printf(&sb, ",%s/", element_name);	\
428		if (error == -1) {					\
429			error = EINVAL;	/* XXX: E2BIG? */		\
430			break;						\
431		}							\
432		claimed = 0;						\
433		MAC_CHECK(externalize_ ## type, label, element_name,	\
434		    &sb, &claimed);					\
435		if (error)						\
436			break;						\
437		if (claimed == 0 && ignorenotfound) {			\
438			/* Revert last label name. */			\
439			sbuf_setpos(&sb, savedlen);			\
440		} else if (claimed != 1) {				\
441			error = EINVAL;	/* XXX: ENOLABEL? */		\
442			break;						\
443		}							\
444	}								\
445	sbuf_finish(&sb);						\
446} while (0)
447
448#define	MAC_INTERNALIZE(type, label, instring) do {			\
449	char *element, *element_name, *element_data;			\
450	int claimed;							\
451									\
452	error = 0;							\
453	element = instring;						\
454	while ((element_name = strsep(&element, ",")) != NULL) {	\
455		element_data = element_name;				\
456		element_name = strsep(&element_data, "/");		\
457		if (element_data == NULL) {				\
458			error = EINVAL;					\
459			break;						\
460		}							\
461		claimed = 0;						\
462		MAC_CHECK(internalize_ ## type, label, element_name,	\
463		    element_data, &claimed);				\
464		if (error)						\
465			break;						\
466		if (claimed != 1) {					\
467			/* XXXMAC: Another error here? */		\
468			error = EINVAL;					\
469			break;						\
470		}							\
471	}								\
472} while (0)
473
474/*
475 * MAC_PERFORM performs the designated operation by walking the policy
476 * module list and invoking that operation for each policy.
477 */
478#define	MAC_PERFORM(operation, args...) do {				\
479	struct mac_policy_conf *mpc;					\
480	int entrycount;							\
481									\
482	LIST_FOREACH(mpc, &mac_static_policy_list, mpc_list) {		\
483		if (mpc->mpc_ops->mpo_ ## operation != NULL)		\
484			mpc->mpc_ops->mpo_ ## operation (args);		\
485	}								\
486	if ((entrycount = mac_policy_list_conditional_busy()) != 0) {	\
487		LIST_FOREACH(mpc, &mac_policy_list, mpc_list) {		\
488			if (mpc->mpc_ops->mpo_ ## operation != NULL)	\
489				mpc->mpc_ops->mpo_ ## operation (args);	\
490		}							\
491		mac_policy_list_unbusy();				\
492	}								\
493} while (0)
494
495/*
496 * Initialize the MAC subsystem, including appropriate SMP locks.
497 */
498static void
499mac_init(void)
500{
501
502	LIST_INIT(&mac_static_policy_list);
503	LIST_INIT(&mac_policy_list);
504
505	mtx_init(&mac_policy_mtx, "mac_policy_mtx", NULL, MTX_DEF);
506	cv_init(&mac_policy_cv, "mac_policy_cv");
507}
508
509/*
510 * For the purposes of modules that want to know if they were loaded
511 * "early", set the mac_late flag once we've processed modules either
512 * linked into the kernel, or loaded before the kernel startup.
513 */
514static void
515mac_late_init(void)
516{
517
518	mac_late = 1;
519}
520
521/*
522 * After the policy list has changed, walk the list to update any global
523 * flags.  Currently, we support only one flag, and it's conditionally
524 * defined; as a result, the entire function is conditional.  Eventually,
525 * the #else case might also iterate across the policies.
526 */
527static void
528mac_policy_updateflags(void)
529{
530#ifndef MAC_ALWAYS_LABEL_MBUF
531	struct mac_policy_conf *tmpc;
532	int labelmbufs;
533
534	mac_policy_assert_exclusive();
535
536	labelmbufs = 0;
537	LIST_FOREACH(tmpc, &mac_static_policy_list, mpc_list) {
538		if (tmpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_LABELMBUFS)
539			labelmbufs++;
540	}
541	LIST_FOREACH(tmpc, &mac_policy_list, mpc_list) {
542		if (tmpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_LABELMBUFS)
543			labelmbufs++;
544	}
545	mac_labelmbufs = (labelmbufs != 0);
546#endif
547}
548
549/*
550 * Allow MAC policy modules to register during boot, etc.
551 */
552int
553mac_policy_modevent(module_t mod, int type, void *data)
554{
555	struct mac_policy_conf *mpc;
556	int error;
557
558	error = 0;
559	mpc = (struct mac_policy_conf *) data;
560
561	switch (type) {
562	case MOD_LOAD:
563		if (mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_NOTLATE &&
564		    mac_late) {
565			printf("mac_policy_modevent: can't load %s policy "
566			    "after booting\n", mpc->mpc_name);
567			error = EBUSY;
568			break;
569		}
570		error = mac_policy_register(mpc);
571		break;
572	case MOD_UNLOAD:
573		/* Don't unregister the module if it was never registered. */
574		if ((mpc->mpc_runtime_flags & MPC_RUNTIME_FLAG_REGISTERED)
575		    != 0)
576			error = mac_policy_unregister(mpc);
577		else
578			error = 0;
579		break;
580	default:
581		break;
582	}
583
584	return (error);
585}
586
587static int
588mac_policy_register(struct mac_policy_conf *mpc)
589{
590	struct mac_policy_conf *tmpc;
591	int error, slot, static_entry;
592
593	error = 0;
594
595	/*
596	 * We don't technically need exclusive access while !mac_late,
597	 * but hold it for assertion consistency.
598	 */
599	mac_policy_grab_exclusive();
600
601	/*
602	 * If the module can potentially be unloaded, or we're loading
603	 * late, we have to stick it in the non-static list and pay
604	 * an extra performance overhead.  Otherwise, we can pay a
605	 * light locking cost and stick it in the static list.
606	 */
607	static_entry = (!mac_late &&
608	    !(mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_UNLOADOK));
609
610	if (static_entry) {
611		LIST_FOREACH(tmpc, &mac_static_policy_list, mpc_list) {
612			if (strcmp(tmpc->mpc_name, mpc->mpc_name) == 0) {
613				error = EEXIST;
614				goto out;
615			}
616		}
617	} else {
618		LIST_FOREACH(tmpc, &mac_policy_list, mpc_list) {
619			if (strcmp(tmpc->mpc_name, mpc->mpc_name) == 0) {
620				error = EEXIST;
621				goto out;
622			}
623		}
624	}
625	if (mpc->mpc_field_off != NULL) {
626		slot = ffs(mac_slot_offsets_free);
627		if (slot == 0) {
628			error = ENOMEM;
629			goto out;
630		}
631		slot--;
632		mac_slot_offsets_free &= ~(1 << slot);
633		*mpc->mpc_field_off = slot;
634	}
635	mpc->mpc_runtime_flags |= MPC_RUNTIME_FLAG_REGISTERED;
636
637	/*
638	 * If we're loading a MAC module after the framework has
639	 * initialized, it has to go into the dynamic list.  If
640	 * we're loading it before we've finished initializing,
641	 * it can go into the static list with weaker locker
642	 * requirements.
643	 */
644	if (static_entry)
645		LIST_INSERT_HEAD(&mac_static_policy_list, mpc, mpc_list);
646	else
647		LIST_INSERT_HEAD(&mac_policy_list, mpc, mpc_list);
648
649	/* Per-policy initialization. */
650	if (mpc->mpc_ops->mpo_init != NULL)
651		(*(mpc->mpc_ops->mpo_init))(mpc);
652	mac_policy_updateflags();
653
654	printf("Security policy loaded: %s (%s)\n", mpc->mpc_fullname,
655	    mpc->mpc_name);
656
657out:
658	mac_policy_release_exclusive();
659	return (error);
660}
661
662static int
663mac_policy_unregister(struct mac_policy_conf *mpc)
664{
665
666	/*
667	 * If we fail the load, we may get a request to unload.  Check
668	 * to see if we did the run-time registration, and if not,
669	 * silently succeed.
670	 */
671	mac_policy_grab_exclusive();
672	if ((mpc->mpc_runtime_flags & MPC_RUNTIME_FLAG_REGISTERED) == 0) {
673		mac_policy_release_exclusive();
674		return (0);
675	}
676#if 0
677	/*
678	 * Don't allow unloading modules with private data.
679	 */
680	if (mpc->mpc_field_off != NULL) {
681		MAC_POLICY_LIST_UNLOCK();
682		return (EBUSY);
683	}
684#endif
685	/*
686	 * Only allow the unload to proceed if the module is unloadable
687	 * by its own definition.
688	 */
689	if ((mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_UNLOADOK) == 0) {
690		mac_policy_release_exclusive();
691		return (EBUSY);
692	}
693	if (mpc->mpc_ops->mpo_destroy != NULL)
694		(*(mpc->mpc_ops->mpo_destroy))(mpc);
695
696	LIST_REMOVE(mpc, mpc_list);
697	mpc->mpc_runtime_flags &= ~MPC_RUNTIME_FLAG_REGISTERED;
698	mac_policy_updateflags();
699
700	mac_policy_release_exclusive();
701
702	printf("Security policy unload: %s (%s)\n", mpc->mpc_fullname,
703	    mpc->mpc_name);
704
705	return (0);
706}
707
708/*
709 * Define an error value precedence, and given two arguments, selects the
710 * value with the higher precedence.
711 */
712static int
713error_select(int error1, int error2)
714{
715
716	/* Certain decision-making errors take top priority. */
717	if (error1 == EDEADLK || error2 == EDEADLK)
718		return (EDEADLK);
719
720	/* Invalid arguments should be reported where possible. */
721	if (error1 == EINVAL || error2 == EINVAL)
722		return (EINVAL);
723
724	/* Precedence goes to "visibility", with both process and file. */
725	if (error1 == ESRCH || error2 == ESRCH)
726		return (ESRCH);
727
728	if (error1 == ENOENT || error2 == ENOENT)
729		return (ENOENT);
730
731	/* Precedence goes to DAC/MAC protections. */
732	if (error1 == EACCES || error2 == EACCES)
733		return (EACCES);
734
735	/* Precedence goes to privilege. */
736	if (error1 == EPERM || error2 == EPERM)
737		return (EPERM);
738
739	/* Precedence goes to error over success; otherwise, arbitrary. */
740	if (error1 != 0)
741		return (error1);
742	return (error2);
743}
744
745static struct label *
746mbuf_to_label(struct mbuf *mbuf)
747{
748	struct m_tag *tag;
749	struct label *label;
750
751	tag = m_tag_find(mbuf, PACKET_TAG_MACLABEL, NULL);
752	label = (struct label *)(tag+1);
753
754	return (label);
755}
756
757static void
758mac_init_label(struct label *label)
759{
760
761	bzero(label, sizeof(*label));
762	label->l_flags = MAC_FLAG_INITIALIZED;
763}
764
765static void
766mac_destroy_label(struct label *label)
767{
768
769	KASSERT(label->l_flags & MAC_FLAG_INITIALIZED,
770	    ("destroying uninitialized label"));
771
772	bzero(label, sizeof(*label));
773	/* implicit: label->l_flags &= ~MAC_FLAG_INITIALIZED; */
774}
775
776void
777mac_init_bpfdesc(struct bpf_d *bpf_d)
778{
779
780	mac_init_label(&bpf_d->bd_label);
781	MAC_PERFORM(init_bpfdesc_label, &bpf_d->bd_label);
782	MAC_DEBUG_COUNTER_INC(&nmacbpfdescs);
783}
784
785static void
786mac_init_cred_label(struct label *label)
787{
788
789	mac_init_label(label);
790	MAC_PERFORM(init_cred_label, label);
791	MAC_DEBUG_COUNTER_INC(&nmaccreds);
792}
793
794void
795mac_init_cred(struct ucred *cred)
796{
797
798	mac_init_cred_label(&cred->cr_label);
799}
800
801void
802mac_init_devfsdirent(struct devfs_dirent *de)
803{
804
805	mac_init_label(&de->de_label);
806	MAC_PERFORM(init_devfsdirent_label, &de->de_label);
807	MAC_DEBUG_COUNTER_INC(&nmacdevfsdirents);
808}
809
810static void
811mac_init_ifnet_label(struct label *label)
812{
813
814	mac_init_label(label);
815	MAC_PERFORM(init_ifnet_label, label);
816	MAC_DEBUG_COUNTER_INC(&nmacifnets);
817}
818
819void
820mac_init_ifnet(struct ifnet *ifp)
821{
822
823	mac_init_ifnet_label(&ifp->if_label);
824}
825
826int
827mac_init_ipq(struct ipq *ipq, int flag)
828{
829	int error;
830
831	mac_init_label(&ipq->ipq_label);
832
833	MAC_CHECK(init_ipq_label, &ipq->ipq_label, flag);
834	if (error) {
835		MAC_PERFORM(destroy_ipq_label, &ipq->ipq_label);
836		mac_destroy_label(&ipq->ipq_label);
837	} else {
838		MAC_DEBUG_COUNTER_INC(&nmacipqs);
839	}
840	return (error);
841}
842
843int
844mac_init_mbuf_tag(struct m_tag *tag, int flag)
845{
846	struct label *label;
847	int error;
848
849	label = (struct label *) (tag + 1);
850	mac_init_label(label);
851
852	MAC_CHECK(init_mbuf_label, label, flag);
853	if (error) {
854		MAC_PERFORM(destroy_mbuf_label, label);
855		mac_destroy_label(label);
856	} else {
857		MAC_DEBUG_COUNTER_INC(&nmacmbufs);
858	}
859	return (error);
860}
861
862int
863mac_init_mbuf(struct mbuf *m, int flag)
864{
865	struct m_tag *tag;
866	int error;
867
868	M_ASSERTPKTHDR(m);
869
870#ifndef MAC_ALWAYS_LABEL_MBUF
871	/*
872	 * If conditionally allocating mbuf labels, don't allocate unless
873	 * they are required.
874	 */
875	if (!mac_labelmbufs)
876		return (0);
877#endif
878	tag = m_tag_get(PACKET_TAG_MACLABEL, sizeof(struct label),
879	    flag);
880	if (tag == NULL)
881		return (ENOMEM);
882	error = mac_init_mbuf_tag(tag, flag);
883	if (error) {
884		m_tag_free(tag);
885		return (error);
886	}
887	m_tag_prepend(m, tag);
888	return (0);
889}
890
891void
892mac_init_mount(struct mount *mp)
893{
894
895	mac_init_label(&mp->mnt_mntlabel);
896	mac_init_label(&mp->mnt_fslabel);
897	MAC_PERFORM(init_mount_label, &mp->mnt_mntlabel);
898	MAC_PERFORM(init_mount_fs_label, &mp->mnt_fslabel);
899	MAC_DEBUG_COUNTER_INC(&nmacmounts);
900}
901
902static void
903mac_init_pipe_label(struct label *label)
904{
905
906	mac_init_label(label);
907	MAC_PERFORM(init_pipe_label, label);
908	MAC_DEBUG_COUNTER_INC(&nmacpipes);
909}
910
911void
912mac_init_pipe(struct pipe *pipe)
913{
914	struct label *label;
915
916	label = malloc(sizeof(struct label), M_MACPIPELABEL, M_ZERO|M_WAITOK);
917	pipe->pipe_label = label;
918	pipe->pipe_peer->pipe_label = label;
919	mac_init_pipe_label(label);
920}
921
922void
923mac_init_proc(struct proc *p)
924{
925
926	mac_init_label(&p->p_label);
927	MAC_PERFORM(init_proc_label, &p->p_label);
928	MAC_DEBUG_COUNTER_INC(&nmacprocs);
929}
930
931static int
932mac_init_socket_label(struct label *label, int flag)
933{
934	int error;
935
936	mac_init_label(label);
937
938	MAC_CHECK(init_socket_label, label, flag);
939	if (error) {
940		MAC_PERFORM(destroy_socket_label, label);
941		mac_destroy_label(label);
942	} else {
943		MAC_DEBUG_COUNTER_INC(&nmacsockets);
944	}
945
946	return (error);
947}
948
949static int
950mac_init_socket_peer_label(struct label *label, int flag)
951{
952	int error;
953
954	mac_init_label(label);
955
956	MAC_CHECK(init_socket_peer_label, label, flag);
957	if (error) {
958		MAC_PERFORM(destroy_socket_label, label);
959		mac_destroy_label(label);
960	}
961
962	return (error);
963}
964
965int
966mac_init_socket(struct socket *socket, int flag)
967{
968	int error;
969
970	error = mac_init_socket_label(&socket->so_label, flag);
971	if (error)
972		return (error);
973
974	error = mac_init_socket_peer_label(&socket->so_peerlabel, flag);
975	if (error)
976		mac_destroy_socket_label(&socket->so_label);
977
978	return (error);
979}
980
981void
982mac_init_vnode_label(struct label *label)
983{
984
985	mac_init_label(label);
986	MAC_PERFORM(init_vnode_label, label);
987	MAC_DEBUG_COUNTER_INC(&nmacvnodes);
988}
989
990void
991mac_init_vnode(struct vnode *vp)
992{
993
994	mac_init_vnode_label(&vp->v_label);
995}
996
997void
998mac_destroy_bpfdesc(struct bpf_d *bpf_d)
999{
1000
1001	MAC_PERFORM(destroy_bpfdesc_label, &bpf_d->bd_label);
1002	mac_destroy_label(&bpf_d->bd_label);
1003	MAC_DEBUG_COUNTER_DEC(&nmacbpfdescs);
1004}
1005
1006static void
1007mac_destroy_cred_label(struct label *label)
1008{
1009
1010	MAC_PERFORM(destroy_cred_label, label);
1011	mac_destroy_label(label);
1012	MAC_DEBUG_COUNTER_DEC(&nmaccreds);
1013}
1014
1015void
1016mac_destroy_cred(struct ucred *cred)
1017{
1018
1019	mac_destroy_cred_label(&cred->cr_label);
1020}
1021
1022void
1023mac_destroy_devfsdirent(struct devfs_dirent *de)
1024{
1025
1026	MAC_PERFORM(destroy_devfsdirent_label, &de->de_label);
1027	mac_destroy_label(&de->de_label);
1028	MAC_DEBUG_COUNTER_DEC(&nmacdevfsdirents);
1029}
1030
1031static void
1032mac_destroy_ifnet_label(struct label *label)
1033{
1034
1035	MAC_PERFORM(destroy_ifnet_label, label);
1036	mac_destroy_label(label);
1037	MAC_DEBUG_COUNTER_DEC(&nmacifnets);
1038}
1039
1040void
1041mac_destroy_ifnet(struct ifnet *ifp)
1042{
1043
1044	mac_destroy_ifnet_label(&ifp->if_label);
1045}
1046
1047void
1048mac_destroy_ipq(struct ipq *ipq)
1049{
1050
1051	MAC_PERFORM(destroy_ipq_label, &ipq->ipq_label);
1052	mac_destroy_label(&ipq->ipq_label);
1053	MAC_DEBUG_COUNTER_DEC(&nmacipqs);
1054}
1055
1056void
1057mac_destroy_mbuf_tag(struct m_tag *tag)
1058{
1059	struct label *label;
1060
1061	label = (struct label *)(tag+1);
1062
1063	MAC_PERFORM(destroy_mbuf_label, label);
1064	mac_destroy_label(label);
1065	MAC_DEBUG_COUNTER_DEC(&nmacmbufs);
1066}
1067
1068void
1069mac_destroy_mount(struct mount *mp)
1070{
1071
1072	MAC_PERFORM(destroy_mount_label, &mp->mnt_mntlabel);
1073	MAC_PERFORM(destroy_mount_fs_label, &mp->mnt_fslabel);
1074	mac_destroy_label(&mp->mnt_fslabel);
1075	mac_destroy_label(&mp->mnt_mntlabel);
1076	MAC_DEBUG_COUNTER_DEC(&nmacmounts);
1077}
1078
1079static void
1080mac_destroy_pipe_label(struct label *label)
1081{
1082
1083	MAC_PERFORM(destroy_pipe_label, label);
1084	mac_destroy_label(label);
1085	MAC_DEBUG_COUNTER_DEC(&nmacpipes);
1086}
1087
1088void
1089mac_destroy_pipe(struct pipe *pipe)
1090{
1091
1092	mac_destroy_pipe_label(pipe->pipe_label);
1093	free(pipe->pipe_label, M_MACPIPELABEL);
1094}
1095
1096void
1097mac_destroy_proc(struct proc *p)
1098{
1099
1100	MAC_PERFORM(destroy_proc_label, &p->p_label);
1101	mac_destroy_label(&p->p_label);
1102	MAC_DEBUG_COUNTER_DEC(&nmacprocs);
1103}
1104
1105static void
1106mac_destroy_socket_label(struct label *label)
1107{
1108
1109	MAC_PERFORM(destroy_socket_label, label);
1110	mac_destroy_label(label);
1111	MAC_DEBUG_COUNTER_DEC(&nmacsockets);
1112}
1113
1114static void
1115mac_destroy_socket_peer_label(struct label *label)
1116{
1117
1118	MAC_PERFORM(destroy_socket_peer_label, label);
1119	mac_destroy_label(label);
1120}
1121
1122void
1123mac_destroy_socket(struct socket *socket)
1124{
1125
1126	mac_destroy_socket_label(&socket->so_label);
1127	mac_destroy_socket_peer_label(&socket->so_peerlabel);
1128}
1129
1130void
1131mac_destroy_vnode_label(struct label *label)
1132{
1133
1134	MAC_PERFORM(destroy_vnode_label, label);
1135	mac_destroy_label(label);
1136	MAC_DEBUG_COUNTER_DEC(&nmacvnodes);
1137}
1138
1139void
1140mac_destroy_vnode(struct vnode *vp)
1141{
1142
1143	mac_destroy_vnode_label(&vp->v_label);
1144}
1145
1146void
1147mac_copy_mbuf_tag(struct m_tag *src, struct m_tag *dest)
1148{
1149	struct label *src_label, *dest_label;
1150
1151	src_label = (struct label *)(src+1);
1152	dest_label = (struct label *)(dest+1);
1153
1154	/*
1155	 * mac_init_mbuf_tag() is called on the target tag in
1156	 * m_tag_copy(), so we don't need to call it here.
1157	 */
1158	MAC_PERFORM(copy_mbuf_label, src_label, dest_label);
1159}
1160
1161static void
1162mac_copy_pipe_label(struct label *src, struct label *dest)
1163{
1164
1165	MAC_PERFORM(copy_pipe_label, src, dest);
1166}
1167
1168void
1169mac_copy_vnode_label(struct label *src, struct label *dest)
1170{
1171
1172	MAC_PERFORM(copy_vnode_label, src, dest);
1173}
1174
1175static int
1176mac_check_structmac_consistent(struct mac *mac)
1177{
1178
1179	if (mac->m_buflen > MAC_MAX_LABEL_BUF_LEN)
1180		return (EINVAL);
1181
1182	return (0);
1183}
1184
1185static int
1186mac_externalize_cred_label(struct label *label, char *elements,
1187    char *outbuf, size_t outbuflen, int flags)
1188{
1189	int error;
1190
1191	MAC_EXTERNALIZE(cred_label, label, elements, outbuf, outbuflen);
1192
1193	return (error);
1194}
1195
1196static int
1197mac_externalize_ifnet_label(struct label *label, char *elements,
1198    char *outbuf, size_t outbuflen, int flags)
1199{
1200	int error;
1201
1202	MAC_EXTERNALIZE(ifnet_label, label, elements, outbuf, outbuflen);
1203
1204	return (error);
1205}
1206
1207static int
1208mac_externalize_pipe_label(struct label *label, char *elements,
1209    char *outbuf, size_t outbuflen, int flags)
1210{
1211	int error;
1212
1213	MAC_EXTERNALIZE(pipe_label, label, elements, outbuf, outbuflen);
1214
1215	return (error);
1216}
1217
1218static int
1219mac_externalize_socket_label(struct label *label, char *elements,
1220    char *outbuf, size_t outbuflen, int flags)
1221{
1222	int error;
1223
1224	MAC_EXTERNALIZE(socket_label, label, elements, outbuf, outbuflen);
1225
1226	return (error);
1227}
1228
1229static int
1230mac_externalize_socket_peer_label(struct label *label, char *elements,
1231    char *outbuf, size_t outbuflen, int flags)
1232{
1233	int error;
1234
1235	MAC_EXTERNALIZE(socket_peer_label, label, elements, outbuf, outbuflen);
1236
1237	return (error);
1238}
1239
1240static int
1241mac_externalize_vnode_label(struct label *label, char *elements,
1242    char *outbuf, size_t outbuflen, int flags)
1243{
1244	int error;
1245
1246	MAC_EXTERNALIZE(vnode_label, label, elements, outbuf, outbuflen);
1247
1248	return (error);
1249}
1250
1251static int
1252mac_internalize_cred_label(struct label *label, char *string)
1253{
1254	int error;
1255
1256	MAC_INTERNALIZE(cred_label, label, string);
1257
1258	return (error);
1259}
1260
1261static int
1262mac_internalize_ifnet_label(struct label *label, char *string)
1263{
1264	int error;
1265
1266	MAC_INTERNALIZE(ifnet_label, label, string);
1267
1268	return (error);
1269}
1270
1271static int
1272mac_internalize_pipe_label(struct label *label, char *string)
1273{
1274	int error;
1275
1276	MAC_INTERNALIZE(pipe_label, label, string);
1277
1278	return (error);
1279}
1280
1281static int
1282mac_internalize_socket_label(struct label *label, char *string)
1283{
1284	int error;
1285
1286	MAC_INTERNALIZE(socket_label, label, string);
1287
1288	return (error);
1289}
1290
1291static int
1292mac_internalize_vnode_label(struct label *label, char *string)
1293{
1294	int error;
1295
1296	MAC_INTERNALIZE(vnode_label, label, string);
1297
1298	return (error);
1299}
1300
1301/*
1302 * Initialize MAC label for the first kernel process, from which other
1303 * kernel processes and threads are spawned.
1304 */
1305void
1306mac_create_proc0(struct ucred *cred)
1307{
1308
1309	MAC_PERFORM(create_proc0, cred);
1310}
1311
1312/*
1313 * Initialize MAC label for the first userland process, from which other
1314 * userland processes and threads are spawned.
1315 */
1316void
1317mac_create_proc1(struct ucred *cred)
1318{
1319
1320	MAC_PERFORM(create_proc1, cred);
1321}
1322
1323void
1324mac_thread_userret(struct thread *td)
1325{
1326
1327	MAC_PERFORM(thread_userret, td);
1328}
1329
1330/*
1331 * When a new process is created, its label must be initialized.  Generally,
1332 * this involves inheritence from the parent process, modulo possible
1333 * deltas.  This function allows that processing to take place.
1334 */
1335void
1336mac_create_cred(struct ucred *parent_cred, struct ucred *child_cred)
1337{
1338
1339	MAC_PERFORM(create_cred, parent_cred, child_cred);
1340}
1341
1342void
1343mac_update_devfsdirent(struct mount *mp, struct devfs_dirent *de,
1344    struct vnode *vp)
1345{
1346
1347	MAC_PERFORM(update_devfsdirent, mp, de, &de->de_label, vp,
1348	    &vp->v_label);
1349}
1350
1351void
1352mac_associate_vnode_devfs(struct mount *mp, struct devfs_dirent *de,
1353    struct vnode *vp)
1354{
1355
1356	MAC_PERFORM(associate_vnode_devfs, mp, &mp->mnt_fslabel, de,
1357	    &de->de_label, vp, &vp->v_label);
1358}
1359
1360int
1361mac_associate_vnode_extattr(struct mount *mp, struct vnode *vp)
1362{
1363	int error;
1364
1365	ASSERT_VOP_LOCKED(vp, "mac_associate_vnode_extattr");
1366
1367	MAC_CHECK(associate_vnode_extattr, mp, &mp->mnt_fslabel, vp,
1368	    &vp->v_label);
1369
1370	return (error);
1371}
1372
1373void
1374mac_associate_vnode_singlelabel(struct mount *mp, struct vnode *vp)
1375{
1376
1377	MAC_PERFORM(associate_vnode_singlelabel, mp, &mp->mnt_fslabel, vp,
1378	    &vp->v_label);
1379}
1380
1381int
1382mac_create_vnode_extattr(struct ucred *cred, struct mount *mp,
1383    struct vnode *dvp, struct vnode *vp, struct componentname *cnp)
1384{
1385	int error;
1386
1387	ASSERT_VOP_LOCKED(dvp, "mac_create_vnode_extattr");
1388	ASSERT_VOP_LOCKED(vp, "mac_create_vnode_extattr");
1389
1390	error = VOP_OPENEXTATTR(vp, cred, curthread);
1391	if (error == EOPNOTSUPP) {
1392		/* XXX: Optionally abort if transactions not supported. */
1393		if (ea_warn_once == 0) {
1394			printf("Warning: transactions not supported "
1395			    "in EA write.\n");
1396			ea_warn_once = 1;
1397		}
1398	} else if (error)
1399		return (error);
1400
1401	MAC_CHECK(create_vnode_extattr, cred, mp, &mp->mnt_fslabel,
1402	    dvp, &dvp->v_label, vp, &vp->v_label, cnp);
1403
1404	if (error) {
1405		VOP_CLOSEEXTATTR(vp, 0, NOCRED, curthread);
1406		return (error);
1407	}
1408
1409	error = VOP_CLOSEEXTATTR(vp, 1, NOCRED, curthread);
1410
1411	if (error == EOPNOTSUPP)
1412		error = 0;				/* XXX */
1413
1414	return (error);
1415}
1416
1417static int
1418mac_setlabel_vnode_extattr(struct ucred *cred, struct vnode *vp,
1419    struct label *intlabel)
1420{
1421	int error;
1422
1423	ASSERT_VOP_LOCKED(vp, "mac_setlabel_vnode_extattr");
1424
1425	error = VOP_OPENEXTATTR(vp, cred, curthread);
1426	if (error == EOPNOTSUPP) {
1427		/* XXX: Optionally abort if transactions not supported. */
1428		if (ea_warn_once == 0) {
1429			printf("Warning: transactions not supported "
1430			    "in EA write.\n");
1431			ea_warn_once = 1;
1432		}
1433	} else if (error)
1434		return (error);
1435
1436	MAC_CHECK(setlabel_vnode_extattr, cred, vp, &vp->v_label, intlabel);
1437
1438	if (error) {
1439		VOP_CLOSEEXTATTR(vp, 0, NOCRED, curthread);
1440		return (error);
1441	}
1442
1443	error = VOP_CLOSEEXTATTR(vp, 1, NOCRED, curthread);
1444
1445	if (error == EOPNOTSUPP)
1446		error = 0;				/* XXX */
1447
1448	return (error);
1449}
1450
1451int
1452mac_execve_enter(struct image_params *imgp, struct mac *mac_p,
1453    struct label *execlabelstorage)
1454{
1455	struct mac mac;
1456	char *buffer;
1457	int error;
1458
1459	if (mac_p == NULL)
1460		return (0);
1461
1462	error = copyin(mac_p, &mac, sizeof(mac));
1463	if (error)
1464		return (error);
1465
1466	error = mac_check_structmac_consistent(&mac);
1467	if (error)
1468		return (error);
1469
1470	buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK);
1471	error = copyinstr(mac.m_string, buffer, mac.m_buflen, NULL);
1472	if (error) {
1473		free(buffer, M_MACTEMP);
1474		return (error);
1475	}
1476
1477	mac_init_cred_label(execlabelstorage);
1478	error = mac_internalize_cred_label(execlabelstorage, buffer);
1479	free(buffer, M_MACTEMP);
1480	if (error) {
1481		mac_destroy_cred_label(execlabelstorage);
1482		return (error);
1483	}
1484	imgp->execlabel = execlabelstorage;
1485	return (0);
1486}
1487
1488void
1489mac_execve_exit(struct image_params *imgp)
1490{
1491	if (imgp->execlabel != NULL)
1492		mac_destroy_cred_label(imgp->execlabel);
1493}
1494
1495void
1496mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp,
1497    struct label *interpvnodelabel, struct image_params *imgp)
1498{
1499
1500	ASSERT_VOP_LOCKED(vp, "mac_execve_transition");
1501
1502	if (!mac_enforce_process && !mac_enforce_fs)
1503		return;
1504
1505	MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label,
1506	    interpvnodelabel, imgp, imgp->execlabel);
1507}
1508
1509int
1510mac_execve_will_transition(struct ucred *old, struct vnode *vp,
1511    struct label *interpvnodelabel, struct image_params *imgp)
1512{
1513	int result;
1514
1515	ASSERT_VOP_LOCKED(vp, "mac_execve_will_transition");
1516
1517	if (!mac_enforce_process && !mac_enforce_fs)
1518		return (0);
1519
1520	result = 0;
1521	MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label,
1522	    interpvnodelabel, imgp, imgp->execlabel);
1523
1524	return (result);
1525}
1526
1527int
1528mac_check_vnode_access(struct ucred *cred, struct vnode *vp, int acc_mode)
1529{
1530	int error;
1531
1532	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_access");
1533
1534	if (!mac_enforce_fs)
1535		return (0);
1536
1537	MAC_CHECK(check_vnode_access, cred, vp, &vp->v_label, acc_mode);
1538	return (error);
1539}
1540
1541int
1542mac_check_vnode_chdir(struct ucred *cred, struct vnode *dvp)
1543{
1544	int error;
1545
1546	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_chdir");
1547
1548	if (!mac_enforce_fs)
1549		return (0);
1550
1551	MAC_CHECK(check_vnode_chdir, cred, dvp, &dvp->v_label);
1552	return (error);
1553}
1554
1555int
1556mac_check_vnode_chroot(struct ucred *cred, struct vnode *dvp)
1557{
1558	int error;
1559
1560	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_chroot");
1561
1562	if (!mac_enforce_fs)
1563		return (0);
1564
1565	MAC_CHECK(check_vnode_chroot, cred, dvp, &dvp->v_label);
1566	return (error);
1567}
1568
1569int
1570mac_check_vnode_create(struct ucred *cred, struct vnode *dvp,
1571    struct componentname *cnp, struct vattr *vap)
1572{
1573	int error;
1574
1575	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_create");
1576
1577	if (!mac_enforce_fs)
1578		return (0);
1579
1580	MAC_CHECK(check_vnode_create, cred, dvp, &dvp->v_label, cnp, vap);
1581	return (error);
1582}
1583
1584int
1585mac_check_vnode_delete(struct ucred *cred, struct vnode *dvp, struct vnode *vp,
1586    struct componentname *cnp)
1587{
1588	int error;
1589
1590	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_delete");
1591	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_delete");
1592
1593	if (!mac_enforce_fs)
1594		return (0);
1595
1596	MAC_CHECK(check_vnode_delete, cred, dvp, &dvp->v_label, vp,
1597	    &vp->v_label, cnp);
1598	return (error);
1599}
1600
1601int
1602mac_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp,
1603    acl_type_t type)
1604{
1605	int error;
1606
1607	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_deleteacl");
1608
1609	if (!mac_enforce_fs)
1610		return (0);
1611
1612	MAC_CHECK(check_vnode_deleteacl, cred, vp, &vp->v_label, type);
1613	return (error);
1614}
1615
1616int
1617mac_check_vnode_exec(struct ucred *cred, struct vnode *vp,
1618    struct image_params *imgp)
1619{
1620	int error;
1621
1622	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_exec");
1623
1624	if (!mac_enforce_process && !mac_enforce_fs)
1625		return (0);
1626
1627	MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label, imgp,
1628	    imgp->execlabel);
1629
1630	return (error);
1631}
1632
1633int
1634mac_check_vnode_getacl(struct ucred *cred, struct vnode *vp, acl_type_t type)
1635{
1636	int error;
1637
1638	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_getacl");
1639
1640	if (!mac_enforce_fs)
1641		return (0);
1642
1643	MAC_CHECK(check_vnode_getacl, cred, vp, &vp->v_label, type);
1644	return (error);
1645}
1646
1647int
1648mac_check_vnode_getextattr(struct ucred *cred, struct vnode *vp,
1649    int attrnamespace, const char *name, struct uio *uio)
1650{
1651	int error;
1652
1653	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_getextattr");
1654
1655	if (!mac_enforce_fs)
1656		return (0);
1657
1658	MAC_CHECK(check_vnode_getextattr, cred, vp, &vp->v_label,
1659	    attrnamespace, name, uio);
1660	return (error);
1661}
1662
1663int
1664mac_check_vnode_link(struct ucred *cred, struct vnode *dvp,
1665    struct vnode *vp, struct componentname *cnp)
1666{
1667	int error;
1668
1669	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_link");
1670	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_link");
1671
1672	if (!mac_enforce_fs)
1673		return (0);
1674
1675	MAC_CHECK(check_vnode_link, cred, dvp, &dvp->v_label, vp,
1676	    &vp->v_label, cnp);
1677	return (error);
1678}
1679
1680int
1681mac_check_vnode_lookup(struct ucred *cred, struct vnode *dvp,
1682    struct componentname *cnp)
1683{
1684	int error;
1685
1686	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_lookup");
1687
1688	if (!mac_enforce_fs)
1689		return (0);
1690
1691	MAC_CHECK(check_vnode_lookup, cred, dvp, &dvp->v_label, cnp);
1692	return (error);
1693}
1694
1695int
1696mac_check_vnode_mmap(struct ucred *cred, struct vnode *vp, int prot)
1697{
1698	int error;
1699
1700	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_mmap");
1701
1702	if (!mac_enforce_fs || !mac_enforce_vm)
1703		return (0);
1704
1705	MAC_CHECK(check_vnode_mmap, cred, vp, &vp->v_label, prot);
1706	return (error);
1707}
1708
1709void
1710mac_check_vnode_mmap_downgrade(struct ucred *cred, struct vnode *vp, int *prot)
1711{
1712	int result = *prot;
1713
1714	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_mmap_downgrade");
1715
1716	if (!mac_enforce_fs || !mac_enforce_vm)
1717		return;
1718
1719	MAC_PERFORM(check_vnode_mmap_downgrade, cred, vp, &vp->v_label,
1720	    &result);
1721
1722	*prot = result;
1723}
1724
1725int
1726mac_check_vnode_mprotect(struct ucred *cred, struct vnode *vp, int prot)
1727{
1728	int error;
1729
1730	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_mprotect");
1731
1732	if (!mac_enforce_fs || !mac_enforce_vm)
1733		return (0);
1734
1735	MAC_CHECK(check_vnode_mprotect, cred, vp, &vp->v_label, prot);
1736	return (error);
1737}
1738
1739int
1740mac_check_vnode_open(struct ucred *cred, struct vnode *vp, int acc_mode)
1741{
1742	int error;
1743
1744	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_open");
1745
1746	if (!mac_enforce_fs)
1747		return (0);
1748
1749	MAC_CHECK(check_vnode_open, cred, vp, &vp->v_label, acc_mode);
1750	return (error);
1751}
1752
1753int
1754mac_check_vnode_poll(struct ucred *active_cred, struct ucred *file_cred,
1755    struct vnode *vp)
1756{
1757	int error;
1758
1759	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_poll");
1760
1761	if (!mac_enforce_fs)
1762		return (0);
1763
1764	MAC_CHECK(check_vnode_poll, active_cred, file_cred, vp,
1765	    &vp->v_label);
1766
1767	return (error);
1768}
1769
1770int
1771mac_check_vnode_read(struct ucred *active_cred, struct ucred *file_cred,
1772    struct vnode *vp)
1773{
1774	int error;
1775
1776	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_read");
1777
1778	if (!mac_enforce_fs)
1779		return (0);
1780
1781	MAC_CHECK(check_vnode_read, active_cred, file_cred, vp,
1782	    &vp->v_label);
1783
1784	return (error);
1785}
1786
1787int
1788mac_check_vnode_readdir(struct ucred *cred, struct vnode *dvp)
1789{
1790	int error;
1791
1792	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_readdir");
1793
1794	if (!mac_enforce_fs)
1795		return (0);
1796
1797	MAC_CHECK(check_vnode_readdir, cred, dvp, &dvp->v_label);
1798	return (error);
1799}
1800
1801int
1802mac_check_vnode_readlink(struct ucred *cred, struct vnode *vp)
1803{
1804	int error;
1805
1806	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_readlink");
1807
1808	if (!mac_enforce_fs)
1809		return (0);
1810
1811	MAC_CHECK(check_vnode_readlink, cred, vp, &vp->v_label);
1812	return (error);
1813}
1814
1815static int
1816mac_check_vnode_relabel(struct ucred *cred, struct vnode *vp,
1817    struct label *newlabel)
1818{
1819	int error;
1820
1821	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_relabel");
1822
1823	MAC_CHECK(check_vnode_relabel, cred, vp, &vp->v_label, newlabel);
1824
1825	return (error);
1826}
1827
1828int
1829mac_check_vnode_rename_from(struct ucred *cred, struct vnode *dvp,
1830    struct vnode *vp, struct componentname *cnp)
1831{
1832	int error;
1833
1834	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_rename_from");
1835	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_rename_from");
1836
1837	if (!mac_enforce_fs)
1838		return (0);
1839
1840	MAC_CHECK(check_vnode_rename_from, cred, dvp, &dvp->v_label, vp,
1841	    &vp->v_label, cnp);
1842	return (error);
1843}
1844
1845int
1846mac_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp,
1847    struct vnode *vp, int samedir, struct componentname *cnp)
1848{
1849	int error;
1850
1851	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_rename_to");
1852	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_rename_to");
1853
1854	if (!mac_enforce_fs)
1855		return (0);
1856
1857	MAC_CHECK(check_vnode_rename_to, cred, dvp, &dvp->v_label, vp,
1858	    vp != NULL ? &vp->v_label : NULL, samedir, cnp);
1859	return (error);
1860}
1861
1862int
1863mac_check_vnode_revoke(struct ucred *cred, struct vnode *vp)
1864{
1865	int error;
1866
1867	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_revoke");
1868
1869	if (!mac_enforce_fs)
1870		return (0);
1871
1872	MAC_CHECK(check_vnode_revoke, cred, vp, &vp->v_label);
1873	return (error);
1874}
1875
1876int
1877mac_check_vnode_setacl(struct ucred *cred, struct vnode *vp, acl_type_t type,
1878    struct acl *acl)
1879{
1880	int error;
1881
1882	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setacl");
1883
1884	if (!mac_enforce_fs)
1885		return (0);
1886
1887	MAC_CHECK(check_vnode_setacl, cred, vp, &vp->v_label, type, acl);
1888	return (error);
1889}
1890
1891int
1892mac_check_vnode_setextattr(struct ucred *cred, struct vnode *vp,
1893    int attrnamespace, const char *name, struct uio *uio)
1894{
1895	int error;
1896
1897	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setextattr");
1898
1899	if (!mac_enforce_fs)
1900		return (0);
1901
1902	MAC_CHECK(check_vnode_setextattr, cred, vp, &vp->v_label,
1903	    attrnamespace, name, uio);
1904	return (error);
1905}
1906
1907int
1908mac_check_vnode_setflags(struct ucred *cred, struct vnode *vp, u_long flags)
1909{
1910	int error;
1911
1912	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setflags");
1913
1914	if (!mac_enforce_fs)
1915		return (0);
1916
1917	MAC_CHECK(check_vnode_setflags, cred, vp, &vp->v_label, flags);
1918	return (error);
1919}
1920
1921int
1922mac_check_vnode_setmode(struct ucred *cred, struct vnode *vp, mode_t mode)
1923{
1924	int error;
1925
1926	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setmode");
1927
1928	if (!mac_enforce_fs)
1929		return (0);
1930
1931	MAC_CHECK(check_vnode_setmode, cred, vp, &vp->v_label, mode);
1932	return (error);
1933}
1934
1935int
1936mac_check_vnode_setowner(struct ucred *cred, struct vnode *vp, uid_t uid,
1937    gid_t gid)
1938{
1939	int error;
1940
1941	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setowner");
1942
1943	if (!mac_enforce_fs)
1944		return (0);
1945
1946	MAC_CHECK(check_vnode_setowner, cred, vp, &vp->v_label, uid, gid);
1947	return (error);
1948}
1949
1950int
1951mac_check_vnode_setutimes(struct ucred *cred, struct vnode *vp,
1952    struct timespec atime, struct timespec mtime)
1953{
1954	int error;
1955
1956	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setutimes");
1957
1958	if (!mac_enforce_fs)
1959		return (0);
1960
1961	MAC_CHECK(check_vnode_setutimes, cred, vp, &vp->v_label, atime,
1962	    mtime);
1963	return (error);
1964}
1965
1966int
1967mac_check_vnode_stat(struct ucred *active_cred, struct ucred *file_cred,
1968    struct vnode *vp)
1969{
1970	int error;
1971
1972	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_stat");
1973
1974	if (!mac_enforce_fs)
1975		return (0);
1976
1977	MAC_CHECK(check_vnode_stat, active_cred, file_cred, vp,
1978	    &vp->v_label);
1979	return (error);
1980}
1981
1982int
1983mac_check_vnode_write(struct ucred *active_cred, struct ucred *file_cred,
1984    struct vnode *vp)
1985{
1986	int error;
1987
1988	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_write");
1989
1990	if (!mac_enforce_fs)
1991		return (0);
1992
1993	MAC_CHECK(check_vnode_write, active_cred, file_cred, vp,
1994	    &vp->v_label);
1995
1996	return (error);
1997}
1998
1999/*
2000 * When relabeling a process, call out to the policies for the maximum
2001 * permission allowed for each object type we know about in its
2002 * memory space, and revoke access (in the least surprising ways we
2003 * know) when necessary.  The process lock is not held here.
2004 */
2005void
2006mac_cred_mmapped_drop_perms(struct thread *td, struct ucred *cred)
2007{
2008
2009	/* XXX freeze all other threads */
2010	mac_cred_mmapped_drop_perms_recurse(td, cred,
2011	    &td->td_proc->p_vmspace->vm_map);
2012	/* XXX allow other threads to continue */
2013}
2014
2015static __inline const char *
2016prot2str(vm_prot_t prot)
2017{
2018
2019	switch (prot & VM_PROT_ALL) {
2020	case VM_PROT_READ:
2021		return ("r--");
2022	case VM_PROT_READ | VM_PROT_WRITE:
2023		return ("rw-");
2024	case VM_PROT_READ | VM_PROT_EXECUTE:
2025		return ("r-x");
2026	case VM_PROT_READ | VM_PROT_WRITE | VM_PROT_EXECUTE:
2027		return ("rwx");
2028	case VM_PROT_WRITE:
2029		return ("-w-");
2030	case VM_PROT_EXECUTE:
2031		return ("--x");
2032	case VM_PROT_WRITE | VM_PROT_EXECUTE:
2033		return ("-wx");
2034	default:
2035		return ("---");
2036	}
2037}
2038
2039static void
2040mac_cred_mmapped_drop_perms_recurse(struct thread *td, struct ucred *cred,
2041    struct vm_map *map)
2042{
2043	struct vm_map_entry *vme;
2044	int result;
2045	vm_prot_t revokeperms;
2046	vm_object_t object;
2047	vm_ooffset_t offset;
2048	struct vnode *vp;
2049
2050	if (!mac_mmap_revocation)
2051		return;
2052
2053	vm_map_lock_read(map);
2054	for (vme = map->header.next; vme != &map->header; vme = vme->next) {
2055		if (vme->eflags & MAP_ENTRY_IS_SUB_MAP) {
2056			mac_cred_mmapped_drop_perms_recurse(td, cred,
2057			    vme->object.sub_map);
2058			continue;
2059		}
2060		/*
2061		 * Skip over entries that obviously are not shared.
2062		 */
2063		if (vme->eflags & (MAP_ENTRY_COW | MAP_ENTRY_NOSYNC) ||
2064		    !vme->max_protection)
2065			continue;
2066		/*
2067		 * Drill down to the deepest backing object.
2068		 */
2069		offset = vme->offset;
2070		object = vme->object.vm_object;
2071		if (object == NULL)
2072			continue;
2073		while (object->backing_object != NULL) {
2074			object = object->backing_object;
2075			offset += object->backing_object_offset;
2076		}
2077		/*
2078		 * At the moment, vm_maps and objects aren't considered
2079		 * by the MAC system, so only things with backing by a
2080		 * normal object (read: vnodes) are checked.
2081		 */
2082		if (object->type != OBJT_VNODE)
2083			continue;
2084		vp = (struct vnode *)object->handle;
2085		vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td);
2086		result = vme->max_protection;
2087		mac_check_vnode_mmap_downgrade(cred, vp, &result);
2088		VOP_UNLOCK(vp, 0, td);
2089		/*
2090		 * Find out what maximum protection we may be allowing
2091		 * now but a policy needs to get removed.
2092		 */
2093		revokeperms = vme->max_protection & ~result;
2094		if (!revokeperms)
2095			continue;
2096		printf("pid %ld: revoking %s perms from %#lx:%ld "
2097		    "(max %s/cur %s)\n", (long)td->td_proc->p_pid,
2098		    prot2str(revokeperms), (u_long)vme->start,
2099		    (long)(vme->end - vme->start),
2100		    prot2str(vme->max_protection), prot2str(vme->protection));
2101		vm_map_lock_upgrade(map);
2102		/*
2103		 * This is the really simple case: if a map has more
2104		 * max_protection than is allowed, but it's not being
2105		 * actually used (that is, the current protection is
2106		 * still allowed), we can just wipe it out and do
2107		 * nothing more.
2108		 */
2109		if ((vme->protection & revokeperms) == 0) {
2110			vme->max_protection -= revokeperms;
2111		} else {
2112			if (revokeperms & VM_PROT_WRITE) {
2113				/*
2114				 * In the more complicated case, flush out all
2115				 * pending changes to the object then turn it
2116				 * copy-on-write.
2117				 */
2118				vm_object_reference(object);
2119				vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td);
2120				VM_OBJECT_LOCK(object);
2121				vm_object_page_clean(object,
2122				    OFF_TO_IDX(offset),
2123				    OFF_TO_IDX(offset + vme->end - vme->start +
2124					PAGE_MASK),
2125				    OBJPC_SYNC);
2126				VM_OBJECT_UNLOCK(object);
2127				VOP_UNLOCK(vp, 0, td);
2128				vm_object_deallocate(object);
2129				/*
2130				 * Why bother if there's no read permissions
2131				 * anymore?  For the rest, we need to leave
2132				 * the write permissions on for COW, or
2133				 * remove them entirely if configured to.
2134				 */
2135				if (!mac_mmap_revocation_via_cow) {
2136					vme->max_protection &= ~VM_PROT_WRITE;
2137					vme->protection &= ~VM_PROT_WRITE;
2138				} if ((revokeperms & VM_PROT_READ) == 0)
2139					vme->eflags |= MAP_ENTRY_COW |
2140					    MAP_ENTRY_NEEDS_COPY;
2141			}
2142			if (revokeperms & VM_PROT_EXECUTE) {
2143				vme->max_protection &= ~VM_PROT_EXECUTE;
2144				vme->protection &= ~VM_PROT_EXECUTE;
2145			}
2146			if (revokeperms & VM_PROT_READ) {
2147				vme->max_protection = 0;
2148				vme->protection = 0;
2149			}
2150			pmap_protect(map->pmap, vme->start, vme->end,
2151			    vme->protection & ~revokeperms);
2152			vm_map_simplify_entry(map, vme);
2153		}
2154		vm_map_lock_downgrade(map);
2155	}
2156	vm_map_unlock_read(map);
2157}
2158
2159/*
2160 * When the subject's label changes, it may require revocation of privilege
2161 * to mapped objects.  This can't be done on-the-fly later with a unified
2162 * buffer cache.
2163 */
2164static void
2165mac_relabel_cred(struct ucred *cred, struct label *newlabel)
2166{
2167
2168	MAC_PERFORM(relabel_cred, cred, newlabel);
2169}
2170
2171void
2172mac_relabel_vnode(struct ucred *cred, struct vnode *vp, struct label *newlabel)
2173{
2174
2175	MAC_PERFORM(relabel_vnode, cred, vp, &vp->v_label, newlabel);
2176}
2177
2178void
2179mac_create_ifnet(struct ifnet *ifnet)
2180{
2181
2182	MAC_PERFORM(create_ifnet, ifnet, &ifnet->if_label);
2183}
2184
2185void
2186mac_create_bpfdesc(struct ucred *cred, struct bpf_d *bpf_d)
2187{
2188
2189	MAC_PERFORM(create_bpfdesc, cred, bpf_d, &bpf_d->bd_label);
2190}
2191
2192void
2193mac_create_socket(struct ucred *cred, struct socket *socket)
2194{
2195
2196	MAC_PERFORM(create_socket, cred, socket, &socket->so_label);
2197}
2198
2199void
2200mac_create_pipe(struct ucred *cred, struct pipe *pipe)
2201{
2202
2203	MAC_PERFORM(create_pipe, cred, pipe, pipe->pipe_label);
2204}
2205
2206void
2207mac_create_socket_from_socket(struct socket *oldsocket,
2208    struct socket *newsocket)
2209{
2210
2211	MAC_PERFORM(create_socket_from_socket, oldsocket, &oldsocket->so_label,
2212	    newsocket, &newsocket->so_label);
2213}
2214
2215static void
2216mac_relabel_socket(struct ucred *cred, struct socket *socket,
2217    struct label *newlabel)
2218{
2219
2220	MAC_PERFORM(relabel_socket, cred, socket, &socket->so_label, newlabel);
2221}
2222
2223static void
2224mac_relabel_pipe(struct ucred *cred, struct pipe *pipe, struct label *newlabel)
2225{
2226
2227	MAC_PERFORM(relabel_pipe, cred, pipe, pipe->pipe_label, newlabel);
2228}
2229
2230void
2231mac_set_socket_peer_from_mbuf(struct mbuf *mbuf, struct socket *socket)
2232{
2233	struct label *label;
2234
2235	label = mbuf_to_label(mbuf);
2236
2237	MAC_PERFORM(set_socket_peer_from_mbuf, mbuf, label, socket,
2238	    &socket->so_peerlabel);
2239}
2240
2241void
2242mac_set_socket_peer_from_socket(struct socket *oldsocket,
2243    struct socket *newsocket)
2244{
2245
2246	MAC_PERFORM(set_socket_peer_from_socket, oldsocket,
2247	    &oldsocket->so_label, newsocket, &newsocket->so_peerlabel);
2248}
2249
2250void
2251mac_create_datagram_from_ipq(struct ipq *ipq, struct mbuf *datagram)
2252{
2253	struct label *label;
2254
2255	label = mbuf_to_label(datagram);
2256
2257	MAC_PERFORM(create_datagram_from_ipq, ipq, &ipq->ipq_label,
2258	    datagram, label);
2259}
2260
2261void
2262mac_create_fragment(struct mbuf *datagram, struct mbuf *fragment)
2263{
2264	struct label *datagramlabel, *fragmentlabel;
2265
2266	datagramlabel = mbuf_to_label(datagram);
2267	fragmentlabel = mbuf_to_label(fragment);
2268
2269	MAC_PERFORM(create_fragment, datagram, datagramlabel, fragment,
2270	    fragmentlabel);
2271}
2272
2273void
2274mac_create_ipq(struct mbuf *fragment, struct ipq *ipq)
2275{
2276	struct label *label;
2277
2278	label = mbuf_to_label(fragment);
2279
2280	MAC_PERFORM(create_ipq, fragment, label, ipq, &ipq->ipq_label);
2281}
2282
2283void
2284mac_create_mbuf_from_mbuf(struct mbuf *oldmbuf, struct mbuf *newmbuf)
2285{
2286	struct label *oldmbuflabel, *newmbuflabel;
2287
2288	oldmbuflabel = mbuf_to_label(oldmbuf);
2289	newmbuflabel = mbuf_to_label(newmbuf);
2290
2291	MAC_PERFORM(create_mbuf_from_mbuf, oldmbuf, oldmbuflabel, newmbuf,
2292	    newmbuflabel);
2293}
2294
2295void
2296mac_create_mbuf_from_bpfdesc(struct bpf_d *bpf_d, struct mbuf *mbuf)
2297{
2298	struct label *label;
2299
2300	label = mbuf_to_label(mbuf);
2301
2302	MAC_PERFORM(create_mbuf_from_bpfdesc, bpf_d, &bpf_d->bd_label, mbuf,
2303	    label);
2304}
2305
2306void
2307mac_create_mbuf_linklayer(struct ifnet *ifnet, struct mbuf *mbuf)
2308{
2309	struct label *label;
2310
2311	label = mbuf_to_label(mbuf);
2312
2313	MAC_PERFORM(create_mbuf_linklayer, ifnet, &ifnet->if_label, mbuf,
2314	    label);
2315}
2316
2317void
2318mac_create_mbuf_from_ifnet(struct ifnet *ifnet, struct mbuf *mbuf)
2319{
2320	struct label *label;
2321
2322	label = mbuf_to_label(mbuf);
2323
2324	MAC_PERFORM(create_mbuf_from_ifnet, ifnet, &ifnet->if_label, mbuf,
2325	    label);
2326}
2327
2328void
2329mac_create_mbuf_multicast_encap(struct mbuf *oldmbuf, struct ifnet *ifnet,
2330    struct mbuf *newmbuf)
2331{
2332	struct label *oldmbuflabel, *newmbuflabel;
2333
2334	oldmbuflabel = mbuf_to_label(oldmbuf);
2335	newmbuflabel = mbuf_to_label(newmbuf);
2336
2337	MAC_PERFORM(create_mbuf_multicast_encap, oldmbuf, oldmbuflabel,
2338	    ifnet, &ifnet->if_label, newmbuf, newmbuflabel);
2339}
2340
2341void
2342mac_create_mbuf_netlayer(struct mbuf *oldmbuf, struct mbuf *newmbuf)
2343{
2344	struct label *oldmbuflabel, *newmbuflabel;
2345
2346	oldmbuflabel = mbuf_to_label(oldmbuf);
2347	newmbuflabel = mbuf_to_label(newmbuf);
2348
2349	MAC_PERFORM(create_mbuf_netlayer, oldmbuf, oldmbuflabel, newmbuf,
2350	    newmbuflabel);
2351}
2352
2353int
2354mac_fragment_match(struct mbuf *fragment, struct ipq *ipq)
2355{
2356	struct label *label;
2357	int result;
2358
2359	label = mbuf_to_label(fragment);
2360
2361	result = 1;
2362	MAC_BOOLEAN(fragment_match, &&, fragment, label, ipq,
2363	    &ipq->ipq_label);
2364
2365	return (result);
2366}
2367
2368void
2369mac_update_ipq(struct mbuf *fragment, struct ipq *ipq)
2370{
2371	struct label *label;
2372
2373	label = mbuf_to_label(fragment);
2374
2375	MAC_PERFORM(update_ipq, fragment, label, ipq, &ipq->ipq_label);
2376}
2377
2378void
2379mac_create_mbuf_from_socket(struct socket *socket, struct mbuf *mbuf)
2380{
2381	struct label *label;
2382
2383	label = mbuf_to_label(mbuf);
2384
2385	MAC_PERFORM(create_mbuf_from_socket, socket, &socket->so_label, mbuf,
2386	    label);
2387}
2388
2389void
2390mac_create_mount(struct ucred *cred, struct mount *mp)
2391{
2392
2393	MAC_PERFORM(create_mount, cred, mp, &mp->mnt_mntlabel,
2394	    &mp->mnt_fslabel);
2395}
2396
2397void
2398mac_create_root_mount(struct ucred *cred, struct mount *mp)
2399{
2400
2401	MAC_PERFORM(create_root_mount, cred, mp, &mp->mnt_mntlabel,
2402	    &mp->mnt_fslabel);
2403}
2404
2405int
2406mac_check_bpfdesc_receive(struct bpf_d *bpf_d, struct ifnet *ifnet)
2407{
2408	int error;
2409
2410	if (!mac_enforce_network)
2411		return (0);
2412
2413	MAC_CHECK(check_bpfdesc_receive, bpf_d, &bpf_d->bd_label, ifnet,
2414	    &ifnet->if_label);
2415
2416	return (error);
2417}
2418
2419static int
2420mac_check_cred_relabel(struct ucred *cred, struct label *newlabel)
2421{
2422	int error;
2423
2424	MAC_CHECK(check_cred_relabel, cred, newlabel);
2425
2426	return (error);
2427}
2428
2429int
2430mac_check_cred_visible(struct ucred *u1, struct ucred *u2)
2431{
2432	int error;
2433
2434	if (!mac_enforce_process)
2435		return (0);
2436
2437	MAC_CHECK(check_cred_visible, u1, u2);
2438
2439	return (error);
2440}
2441
2442int
2443mac_check_ifnet_transmit(struct ifnet *ifnet, struct mbuf *mbuf)
2444{
2445	struct label *label;
2446	int error;
2447
2448	M_ASSERTPKTHDR(mbuf);
2449
2450	if (!mac_enforce_network)
2451		return (0);
2452
2453	label = mbuf_to_label(mbuf);
2454
2455	MAC_CHECK(check_ifnet_transmit, ifnet, &ifnet->if_label, mbuf,
2456	    label);
2457
2458	return (error);
2459}
2460
2461int
2462mac_check_kenv_dump(struct ucred *cred)
2463{
2464	int error;
2465
2466	if (!mac_enforce_system)
2467		return (0);
2468
2469	MAC_CHECK(check_kenv_dump, cred);
2470
2471	return (error);
2472}
2473
2474int
2475mac_check_kenv_get(struct ucred *cred, char *name)
2476{
2477	int error;
2478
2479	if (!mac_enforce_system)
2480		return (0);
2481
2482	MAC_CHECK(check_kenv_get, cred, name);
2483
2484	return (error);
2485}
2486
2487int
2488mac_check_kenv_set(struct ucred *cred, char *name, char *value)
2489{
2490	int error;
2491
2492	if (!mac_enforce_system)
2493		return (0);
2494
2495	MAC_CHECK(check_kenv_set, cred, name, value);
2496
2497	return (error);
2498}
2499
2500int
2501mac_check_kenv_unset(struct ucred *cred, char *name)
2502{
2503	int error;
2504
2505	if (!mac_enforce_system)
2506		return (0);
2507
2508	MAC_CHECK(check_kenv_unset, cred, name);
2509
2510	return (error);
2511}
2512
2513int
2514mac_check_kld_load(struct ucred *cred, struct vnode *vp)
2515{
2516	int error;
2517
2518	ASSERT_VOP_LOCKED(vp, "mac_check_kld_load");
2519
2520	if (!mac_enforce_kld)
2521		return (0);
2522
2523	MAC_CHECK(check_kld_load, cred, vp, &vp->v_label);
2524
2525	return (error);
2526}
2527
2528int
2529mac_check_kld_stat(struct ucred *cred)
2530{
2531	int error;
2532
2533	if (!mac_enforce_kld)
2534		return (0);
2535
2536	MAC_CHECK(check_kld_stat, cred);
2537
2538	return (error);
2539}
2540
2541int
2542mac_check_kld_unload(struct ucred *cred)
2543{
2544	int error;
2545
2546	if (!mac_enforce_kld)
2547		return (0);
2548
2549	MAC_CHECK(check_kld_unload, cred);
2550
2551	return (error);
2552}
2553
2554int
2555mac_check_mount_stat(struct ucred *cred, struct mount *mount)
2556{
2557	int error;
2558
2559	if (!mac_enforce_fs)
2560		return (0);
2561
2562	MAC_CHECK(check_mount_stat, cred, mount, &mount->mnt_mntlabel);
2563
2564	return (error);
2565}
2566
2567int
2568mac_check_pipe_ioctl(struct ucred *cred, struct pipe *pipe, unsigned long cmd,
2569    void *data)
2570{
2571	int error;
2572
2573	PIPE_LOCK_ASSERT(pipe, MA_OWNED);
2574
2575	if (!mac_enforce_pipe)
2576		return (0);
2577
2578	MAC_CHECK(check_pipe_ioctl, cred, pipe, pipe->pipe_label, cmd, data);
2579
2580	return (error);
2581}
2582
2583int
2584mac_check_pipe_poll(struct ucred *cred, struct pipe *pipe)
2585{
2586	int error;
2587
2588	PIPE_LOCK_ASSERT(pipe, MA_OWNED);
2589
2590	if (!mac_enforce_pipe)
2591		return (0);
2592
2593	MAC_CHECK(check_pipe_poll, cred, pipe, pipe->pipe_label);
2594
2595	return (error);
2596}
2597
2598int
2599mac_check_pipe_read(struct ucred *cred, struct pipe *pipe)
2600{
2601	int error;
2602
2603	PIPE_LOCK_ASSERT(pipe, MA_OWNED);
2604
2605	if (!mac_enforce_pipe)
2606		return (0);
2607
2608	MAC_CHECK(check_pipe_read, cred, pipe, pipe->pipe_label);
2609
2610	return (error);
2611}
2612
2613static int
2614mac_check_pipe_relabel(struct ucred *cred, struct pipe *pipe,
2615    struct label *newlabel)
2616{
2617	int error;
2618
2619	PIPE_LOCK_ASSERT(pipe, MA_OWNED);
2620
2621	if (!mac_enforce_pipe)
2622		return (0);
2623
2624	MAC_CHECK(check_pipe_relabel, cred, pipe, pipe->pipe_label, newlabel);
2625
2626	return (error);
2627}
2628
2629int
2630mac_check_pipe_stat(struct ucred *cred, struct pipe *pipe)
2631{
2632	int error;
2633
2634	PIPE_LOCK_ASSERT(pipe, MA_OWNED);
2635
2636	if (!mac_enforce_pipe)
2637		return (0);
2638
2639	MAC_CHECK(check_pipe_stat, cred, pipe, pipe->pipe_label);
2640
2641	return (error);
2642}
2643
2644int
2645mac_check_pipe_write(struct ucred *cred, struct pipe *pipe)
2646{
2647	int error;
2648
2649	PIPE_LOCK_ASSERT(pipe, MA_OWNED);
2650
2651	if (!mac_enforce_pipe)
2652		return (0);
2653
2654	MAC_CHECK(check_pipe_write, cred, pipe, pipe->pipe_label);
2655
2656	return (error);
2657}
2658
2659int
2660mac_check_proc_debug(struct ucred *cred, struct proc *proc)
2661{
2662	int error;
2663
2664	PROC_LOCK_ASSERT(proc, MA_OWNED);
2665
2666	if (!mac_enforce_process)
2667		return (0);
2668
2669	MAC_CHECK(check_proc_debug, cred, proc);
2670
2671	return (error);
2672}
2673
2674int
2675mac_check_proc_sched(struct ucred *cred, struct proc *proc)
2676{
2677	int error;
2678
2679	PROC_LOCK_ASSERT(proc, MA_OWNED);
2680
2681	if (!mac_enforce_process)
2682		return (0);
2683
2684	MAC_CHECK(check_proc_sched, cred, proc);
2685
2686	return (error);
2687}
2688
2689int
2690mac_check_proc_signal(struct ucred *cred, struct proc *proc, int signum)
2691{
2692	int error;
2693
2694	PROC_LOCK_ASSERT(proc, MA_OWNED);
2695
2696	if (!mac_enforce_process)
2697		return (0);
2698
2699	MAC_CHECK(check_proc_signal, cred, proc, signum);
2700
2701	return (error);
2702}
2703
2704int
2705mac_check_socket_bind(struct ucred *ucred, struct socket *socket,
2706    struct sockaddr *sockaddr)
2707{
2708	int error;
2709
2710	if (!mac_enforce_socket)
2711		return (0);
2712
2713	MAC_CHECK(check_socket_bind, ucred, socket, &socket->so_label,
2714	    sockaddr);
2715
2716	return (error);
2717}
2718
2719int
2720mac_check_socket_connect(struct ucred *cred, struct socket *socket,
2721    struct sockaddr *sockaddr)
2722{
2723	int error;
2724
2725	if (!mac_enforce_socket)
2726		return (0);
2727
2728	MAC_CHECK(check_socket_connect, cred, socket, &socket->so_label,
2729	    sockaddr);
2730
2731	return (error);
2732}
2733
2734int
2735mac_check_socket_deliver(struct socket *socket, struct mbuf *mbuf)
2736{
2737	struct label *label;
2738	int error;
2739
2740	if (!mac_enforce_socket)
2741		return (0);
2742
2743	label = mbuf_to_label(mbuf);
2744
2745	MAC_CHECK(check_socket_deliver, socket, &socket->so_label, mbuf,
2746	    label);
2747
2748	return (error);
2749}
2750
2751int
2752mac_check_socket_listen(struct ucred *cred, struct socket *socket)
2753{
2754	int error;
2755
2756	if (!mac_enforce_socket)
2757		return (0);
2758
2759	MAC_CHECK(check_socket_listen, cred, socket, &socket->so_label);
2760	return (error);
2761}
2762
2763int
2764mac_check_socket_receive(struct ucred *cred, struct socket *so)
2765{
2766	int error;
2767
2768	if (!mac_enforce_socket)
2769		return (0);
2770
2771	MAC_CHECK(check_socket_receive, cred, so, &so->so_label);
2772
2773	return (error);
2774}
2775
2776static int
2777mac_check_socket_relabel(struct ucred *cred, struct socket *socket,
2778    struct label *newlabel)
2779{
2780	int error;
2781
2782	MAC_CHECK(check_socket_relabel, cred, socket, &socket->so_label,
2783	    newlabel);
2784
2785	return (error);
2786}
2787
2788int
2789mac_check_socket_send(struct ucred *cred, struct socket *so)
2790{
2791	int error;
2792
2793	if (!mac_enforce_socket)
2794		return (0);
2795
2796	MAC_CHECK(check_socket_send, cred, so, &so->so_label);
2797
2798	return (error);
2799}
2800
2801int
2802mac_check_socket_visible(struct ucred *cred, struct socket *socket)
2803{
2804	int error;
2805
2806	if (!mac_enforce_socket)
2807		return (0);
2808
2809	MAC_CHECK(check_socket_visible, cred, socket, &socket->so_label);
2810
2811	return (error);
2812}
2813
2814int
2815mac_check_sysarch_ioperm(struct ucred *cred)
2816{
2817	int error;
2818
2819	if (!mac_enforce_system)
2820		return (0);
2821
2822	MAC_CHECK(check_sysarch_ioperm, cred);
2823	return (error);
2824}
2825
2826int
2827mac_check_system_acct(struct ucred *cred, struct vnode *vp)
2828{
2829	int error;
2830
2831	if (vp != NULL) {
2832		ASSERT_VOP_LOCKED(vp, "mac_check_system_acct");
2833	}
2834
2835	if (!mac_enforce_system)
2836		return (0);
2837
2838	MAC_CHECK(check_system_acct, cred, vp,
2839	    vp != NULL ? &vp->v_label : NULL);
2840
2841	return (error);
2842}
2843
2844int
2845mac_check_system_nfsd(struct ucred *cred)
2846{
2847	int error;
2848
2849	if (!mac_enforce_system)
2850		return (0);
2851
2852	MAC_CHECK(check_system_nfsd, cred);
2853
2854	return (error);
2855}
2856
2857int
2858mac_check_system_reboot(struct ucred *cred, int howto)
2859{
2860	int error;
2861
2862	if (!mac_enforce_system)
2863		return (0);
2864
2865	MAC_CHECK(check_system_reboot, cred, howto);
2866
2867	return (error);
2868}
2869
2870int
2871mac_check_system_settime(struct ucred *cred)
2872{
2873	int error;
2874
2875	if (!mac_enforce_system)
2876		return (0);
2877
2878	MAC_CHECK(check_system_settime, cred);
2879
2880	return (error);
2881}
2882
2883int
2884mac_check_system_swapon(struct ucred *cred, struct vnode *vp)
2885{
2886	int error;
2887
2888	ASSERT_VOP_LOCKED(vp, "mac_check_system_swapon");
2889
2890	if (!mac_enforce_system)
2891		return (0);
2892
2893	MAC_CHECK(check_system_swapon, cred, vp, &vp->v_label);
2894	return (error);
2895}
2896
2897int
2898mac_check_system_swapoff(struct ucred *cred, struct vnode *vp)
2899{
2900	int error;
2901
2902	ASSERT_VOP_LOCKED(vp, "mac_check_system_swapoff");
2903
2904	if (!mac_enforce_system)
2905		return (0);
2906
2907	MAC_CHECK(check_system_swapoff, cred, vp, &vp->v_label);
2908	return (error);
2909}
2910
2911int
2912mac_check_system_sysctl(struct ucred *cred, int *name, u_int namelen,
2913    void *old, size_t *oldlenp, int inkernel, void *new, size_t newlen)
2914{
2915	int error;
2916
2917	/*
2918	 * XXXMAC: We're very much like to assert the SYSCTL_LOCK here,
2919	 * but since it's not exported from kern_sysctl.c, we can't.
2920	 */
2921	if (!mac_enforce_system)
2922		return (0);
2923
2924	MAC_CHECK(check_system_sysctl, cred, name, namelen, old, oldlenp,
2925	    inkernel, new, newlen);
2926
2927	return (error);
2928}
2929
2930int
2931mac_ioctl_ifnet_get(struct ucred *cred, struct ifreq *ifr,
2932    struct ifnet *ifnet)
2933{
2934	char *elements, *buffer;
2935	struct mac mac;
2936	int error;
2937
2938	error = copyin(ifr->ifr_ifru.ifru_data, &mac, sizeof(mac));
2939	if (error)
2940		return (error);
2941
2942	error = mac_check_structmac_consistent(&mac);
2943	if (error)
2944		return (error);
2945
2946	elements = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK);
2947	error = copyinstr(mac.m_string, elements, mac.m_buflen, NULL);
2948	if (error) {
2949		free(elements, M_MACTEMP);
2950		return (error);
2951	}
2952
2953	buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK | M_ZERO);
2954	error = mac_externalize_ifnet_label(&ifnet->if_label, elements,
2955	    buffer, mac.m_buflen, M_WAITOK);
2956	if (error == 0)
2957		error = copyout(buffer, mac.m_string, strlen(buffer)+1);
2958
2959	free(buffer, M_MACTEMP);
2960	free(elements, M_MACTEMP);
2961
2962	return (error);
2963}
2964
2965int
2966mac_ioctl_ifnet_set(struct ucred *cred, struct ifreq *ifr,
2967    struct ifnet *ifnet)
2968{
2969	struct label intlabel;
2970	struct mac mac;
2971	char *buffer;
2972	int error;
2973
2974	error = copyin(ifr->ifr_ifru.ifru_data, &mac, sizeof(mac));
2975	if (error)
2976		return (error);
2977
2978	error = mac_check_structmac_consistent(&mac);
2979	if (error)
2980		return (error);
2981
2982	buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK);
2983	error = copyinstr(mac.m_string, buffer, mac.m_buflen, NULL);
2984	if (error) {
2985		free(buffer, M_MACTEMP);
2986		return (error);
2987	}
2988
2989	mac_init_ifnet_label(&intlabel);
2990	error = mac_internalize_ifnet_label(&intlabel, buffer);
2991	free(buffer, M_MACTEMP);
2992	if (error) {
2993		mac_destroy_ifnet_label(&intlabel);
2994		return (error);
2995	}
2996
2997	/*
2998	 * XXX: Note that this is a redundant privilege check, since
2999	 * policies impose this check themselves if required by the
3000	 * policy.  Eventually, this should go away.
3001	 */
3002	error = suser_cred(cred, 0);
3003	if (error) {
3004		mac_destroy_ifnet_label(&intlabel);
3005		return (error);
3006	}
3007
3008	MAC_CHECK(check_ifnet_relabel, cred, ifnet, &ifnet->if_label,
3009	    &intlabel);
3010	if (error) {
3011		mac_destroy_ifnet_label(&intlabel);
3012		return (error);
3013	}
3014
3015	MAC_PERFORM(relabel_ifnet, cred, ifnet, &ifnet->if_label, &intlabel);
3016
3017	mac_destroy_ifnet_label(&intlabel);
3018	return (0);
3019}
3020
3021void
3022mac_create_devfs_device(struct mount *mp, dev_t dev, struct devfs_dirent *de)
3023{
3024
3025	MAC_PERFORM(create_devfs_device, mp, dev, de, &de->de_label);
3026}
3027
3028void
3029mac_create_devfs_symlink(struct ucred *cred, struct mount *mp,
3030    struct devfs_dirent *dd, struct devfs_dirent *de)
3031{
3032
3033	MAC_PERFORM(create_devfs_symlink, cred, mp, dd, &dd->de_label, de,
3034	    &de->de_label);
3035}
3036
3037void
3038mac_create_devfs_directory(struct mount *mp, char *dirname, int dirnamelen,
3039    struct devfs_dirent *de)
3040{
3041
3042	MAC_PERFORM(create_devfs_directory, mp, dirname, dirnamelen, de,
3043	    &de->de_label);
3044}
3045
3046int
3047mac_setsockopt_label_set(struct ucred *cred, struct socket *so,
3048    struct mac *mac)
3049{
3050	struct label intlabel;
3051	char *buffer;
3052	int error;
3053
3054	error = mac_check_structmac_consistent(mac);
3055	if (error)
3056		return (error);
3057
3058	buffer = malloc(mac->m_buflen, M_MACTEMP, M_WAITOK);
3059	error = copyinstr(mac->m_string, buffer, mac->m_buflen, NULL);
3060	if (error) {
3061		free(buffer, M_MACTEMP);
3062		return (error);
3063	}
3064
3065	mac_init_socket_label(&intlabel, M_WAITOK);
3066	error = mac_internalize_socket_label(&intlabel, buffer);
3067	free(buffer, M_MACTEMP);
3068	if (error) {
3069		mac_destroy_socket_label(&intlabel);
3070		return (error);
3071	}
3072
3073	mac_check_socket_relabel(cred, so, &intlabel);
3074	if (error) {
3075		mac_destroy_socket_label(&intlabel);
3076		return (error);
3077	}
3078
3079	mac_relabel_socket(cred, so, &intlabel);
3080
3081	mac_destroy_socket_label(&intlabel);
3082	return (0);
3083}
3084
3085int
3086mac_pipe_label_set(struct ucred *cred, struct pipe *pipe, struct label *label)
3087{
3088	int error;
3089
3090	PIPE_LOCK_ASSERT(pipe, MA_OWNED);
3091
3092	error = mac_check_pipe_relabel(cred, pipe, label);
3093	if (error)
3094		return (error);
3095
3096	mac_relabel_pipe(cred, pipe, label);
3097
3098	return (0);
3099}
3100
3101int
3102mac_getsockopt_label_get(struct ucred *cred, struct socket *so,
3103    struct mac *mac)
3104{
3105	char *buffer, *elements;
3106	int error;
3107
3108	error = mac_check_structmac_consistent(mac);
3109	if (error)
3110		return (error);
3111
3112	elements = malloc(mac->m_buflen, M_MACTEMP, M_WAITOK);
3113	error = copyinstr(mac->m_string, elements, mac->m_buflen, NULL);
3114	if (error) {
3115		free(elements, M_MACTEMP);
3116		return (error);
3117	}
3118
3119	buffer = malloc(mac->m_buflen, M_MACTEMP, M_WAITOK | M_ZERO);
3120	error = mac_externalize_socket_label(&so->so_label, elements,
3121	    buffer, mac->m_buflen, M_WAITOK);
3122	if (error == 0)
3123		error = copyout(buffer, mac->m_string, strlen(buffer)+1);
3124
3125	free(buffer, M_MACTEMP);
3126	free(elements, M_MACTEMP);
3127
3128	return (error);
3129}
3130
3131int
3132mac_getsockopt_peerlabel_get(struct ucred *cred, struct socket *so,
3133    struct mac *mac)
3134{
3135	char *elements, *buffer;
3136	int error;
3137
3138	error = mac_check_structmac_consistent(mac);
3139	if (error)
3140		return (error);
3141
3142	elements = malloc(mac->m_buflen, M_MACTEMP, M_WAITOK);
3143	error = copyinstr(mac->m_string, elements, mac->m_buflen, NULL);
3144	if (error) {
3145		free(elements, M_MACTEMP);
3146		return (error);
3147	}
3148
3149	buffer = malloc(mac->m_buflen, M_MACTEMP, M_WAITOK | M_ZERO);
3150	error = mac_externalize_socket_peer_label(&so->so_peerlabel,
3151	    elements, buffer, mac->m_buflen, M_WAITOK);
3152	if (error == 0)
3153		error = copyout(buffer, mac->m_string, strlen(buffer)+1);
3154
3155	free(buffer, M_MACTEMP);
3156	free(elements, M_MACTEMP);
3157
3158	return (error);
3159}
3160
3161/*
3162 * Implementation of VOP_SETLABEL() that relies on extended attributes
3163 * to store label data.  Can be referenced by filesystems supporting
3164 * extended attributes.
3165 */
3166int
3167vop_stdsetlabel_ea(struct vop_setlabel_args *ap)
3168{
3169	struct vnode *vp = ap->a_vp;
3170	struct label *intlabel = ap->a_label;
3171	int error;
3172
3173	ASSERT_VOP_LOCKED(vp, "vop_stdsetlabel_ea");
3174
3175	if ((vp->v_mount->mnt_flag & MNT_MULTILABEL) == 0)
3176		return (EOPNOTSUPP);
3177
3178	error = mac_setlabel_vnode_extattr(ap->a_cred, vp, intlabel);
3179	if (error)
3180		return (error);
3181
3182	mac_relabel_vnode(ap->a_cred, vp, intlabel);
3183
3184	return (0);
3185}
3186
3187static int
3188vn_setlabel(struct vnode *vp, struct label *intlabel, struct ucred *cred)
3189{
3190	int error;
3191
3192	if (vp->v_mount == NULL) {
3193		/* printf("vn_setlabel: null v_mount\n"); */
3194		if (vp->v_type != VNON)
3195			printf("vn_setlabel: null v_mount with non-VNON\n");
3196		return (EBADF);
3197	}
3198
3199	if ((vp->v_mount->mnt_flag & MNT_MULTILABEL) == 0)
3200		return (EOPNOTSUPP);
3201
3202	/*
3203	 * Multi-phase commit.  First check the policies to confirm the
3204	 * change is OK.  Then commit via the filesystem.  Finally,
3205	 * update the actual vnode label.  Question: maybe the filesystem
3206	 * should update the vnode at the end as part of VOP_SETLABEL()?
3207	 */
3208	error = mac_check_vnode_relabel(cred, vp, intlabel);
3209	if (error)
3210		return (error);
3211
3212	/*
3213	 * VADMIN provides the opportunity for the filesystem to make
3214	 * decisions about who is and is not able to modify labels
3215	 * and protections on files.  This might not be right.  We can't
3216	 * assume VOP_SETLABEL() will do it, because we might implement
3217	 * that as part of vop_stdsetlabel_ea().
3218	 */
3219	error = VOP_ACCESS(vp, VADMIN, cred, curthread);
3220	if (error)
3221		return (error);
3222
3223	error = VOP_SETLABEL(vp, intlabel, cred, curthread);
3224	if (error)
3225		return (error);
3226
3227	return (0);
3228}
3229
3230int
3231__mac_get_pid(struct thread *td, struct __mac_get_pid_args *uap)
3232{
3233	char *elements, *buffer;
3234	struct mac mac;
3235	struct proc *tproc;
3236	struct ucred *tcred;
3237	int error;
3238
3239	error = copyin(uap->mac_p, &mac, sizeof(mac));
3240	if (error)
3241		return (error);
3242
3243	error = mac_check_structmac_consistent(&mac);
3244	if (error)
3245		return (error);
3246
3247	tproc = pfind(uap->pid);
3248	if (tproc == NULL)
3249		return (ESRCH);
3250
3251	tcred = NULL;				/* Satisfy gcc. */
3252	error = p_cansee(td, tproc);
3253	if (error == 0)
3254		tcred = crhold(tproc->p_ucred);
3255	PROC_UNLOCK(tproc);
3256	if (error)
3257		return (error);
3258
3259	elements = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK);
3260	error = copyinstr(mac.m_string, elements, mac.m_buflen, NULL);
3261	if (error) {
3262		free(elements, M_MACTEMP);
3263		crfree(tcred);
3264		return (error);
3265	}
3266
3267	buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK | M_ZERO);
3268	error = mac_externalize_cred_label(&tcred->cr_label, elements,
3269	    buffer, mac.m_buflen, M_WAITOK);
3270	if (error == 0)
3271		error = copyout(buffer, mac.m_string, strlen(buffer)+1);
3272
3273	free(buffer, M_MACTEMP);
3274	free(elements, M_MACTEMP);
3275	crfree(tcred);
3276	return (error);
3277}
3278
3279/*
3280 * MPSAFE
3281 */
3282int
3283__mac_get_proc(struct thread *td, struct __mac_get_proc_args *uap)
3284{
3285	char *elements, *buffer;
3286	struct mac mac;
3287	int error;
3288
3289	error = copyin(uap->mac_p, &mac, sizeof(mac));
3290	if (error)
3291		return (error);
3292
3293	error = mac_check_structmac_consistent(&mac);
3294	if (error)
3295		return (error);
3296
3297	elements = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK);
3298	error = copyinstr(mac.m_string, elements, mac.m_buflen, NULL);
3299	if (error) {
3300		free(elements, M_MACTEMP);
3301		return (error);
3302	}
3303
3304	buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK | M_ZERO);
3305	error = mac_externalize_cred_label(&td->td_ucred->cr_label,
3306	    elements, buffer, mac.m_buflen, M_WAITOK);
3307	if (error == 0)
3308		error = copyout(buffer, mac.m_string, strlen(buffer)+1);
3309
3310	free(buffer, M_MACTEMP);
3311	free(elements, M_MACTEMP);
3312	return (error);
3313}
3314
3315/*
3316 * MPSAFE
3317 */
3318int
3319__mac_set_proc(struct thread *td, struct __mac_set_proc_args *uap)
3320{
3321	struct ucred *newcred, *oldcred;
3322	struct label intlabel;
3323	struct proc *p;
3324	struct mac mac;
3325	char *buffer;
3326	int error;
3327
3328	error = copyin(uap->mac_p, &mac, sizeof(mac));
3329	if (error)
3330		return (error);
3331
3332	error = mac_check_structmac_consistent(&mac);
3333	if (error)
3334		return (error);
3335
3336	buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK);
3337	error = copyinstr(mac.m_string, buffer, mac.m_buflen, NULL);
3338	if (error) {
3339		free(buffer, M_MACTEMP);
3340		return (error);
3341	}
3342
3343	mac_init_cred_label(&intlabel);
3344	error = mac_internalize_cred_label(&intlabel, buffer);
3345	free(buffer, M_MACTEMP);
3346	if (error) {
3347		mac_destroy_cred_label(&intlabel);
3348		return (error);
3349	}
3350
3351	newcred = crget();
3352
3353	p = td->td_proc;
3354	PROC_LOCK(p);
3355	oldcred = p->p_ucred;
3356
3357	error = mac_check_cred_relabel(oldcred, &intlabel);
3358	if (error) {
3359		PROC_UNLOCK(p);
3360		crfree(newcred);
3361		goto out;
3362	}
3363
3364	setsugid(p);
3365	crcopy(newcred, oldcred);
3366	mac_relabel_cred(newcred, &intlabel);
3367	p->p_ucred = newcred;
3368
3369	/*
3370	 * Grab additional reference for use while revoking mmaps, prior
3371	 * to releasing the proc lock and sharing the cred.
3372	 */
3373	crhold(newcred);
3374	PROC_UNLOCK(p);
3375
3376	if (mac_enforce_vm) {
3377		mtx_lock(&Giant);
3378		mac_cred_mmapped_drop_perms(td, newcred);
3379		mtx_unlock(&Giant);
3380	}
3381
3382	crfree(newcred);	/* Free revocation reference. */
3383	crfree(oldcred);
3384
3385out:
3386	mac_destroy_cred_label(&intlabel);
3387	return (error);
3388}
3389
3390/*
3391 * MPSAFE
3392 */
3393int
3394__mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap)
3395{
3396	char *elements, *buffer;
3397	struct label intlabel;
3398	struct file *fp;
3399	struct mac mac;
3400	struct vnode *vp;
3401	struct pipe *pipe;
3402	short label_type;
3403	int error;
3404
3405	error = copyin(uap->mac_p, &mac, sizeof(mac));
3406	if (error)
3407		return (error);
3408
3409	error = mac_check_structmac_consistent(&mac);
3410	if (error)
3411		return (error);
3412
3413	elements = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK);
3414	error = copyinstr(mac.m_string, elements, mac.m_buflen, NULL);
3415	if (error) {
3416		free(elements, M_MACTEMP);
3417		return (error);
3418	}
3419
3420	buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK | M_ZERO);
3421	mtx_lock(&Giant);				/* VFS */
3422	error = fget(td, uap->fd, &fp);
3423	if (error)
3424		goto out;
3425
3426	label_type = fp->f_type;
3427	switch (fp->f_type) {
3428	case DTYPE_FIFO:
3429	case DTYPE_VNODE:
3430		vp = fp->f_vnode;
3431
3432		mac_init_vnode_label(&intlabel);
3433
3434		vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td);
3435		mac_copy_vnode_label(&vp->v_label, &intlabel);
3436		VOP_UNLOCK(vp, 0, td);
3437
3438		break;
3439	case DTYPE_PIPE:
3440		pipe = fp->f_data;
3441
3442		mac_init_pipe_label(&intlabel);
3443
3444		PIPE_LOCK(pipe);
3445		mac_copy_pipe_label(pipe->pipe_label, &intlabel);
3446		PIPE_UNLOCK(pipe);
3447		break;
3448	default:
3449		error = EINVAL;
3450		fdrop(fp, td);
3451		goto out;
3452	}
3453	fdrop(fp, td);
3454
3455	switch (label_type) {
3456	case DTYPE_FIFO:
3457	case DTYPE_VNODE:
3458		if (error == 0)
3459			error = mac_externalize_vnode_label(&intlabel,
3460			    elements, buffer, mac.m_buflen, M_WAITOK);
3461		mac_destroy_vnode_label(&intlabel);
3462		break;
3463	case DTYPE_PIPE:
3464		error = mac_externalize_pipe_label(&intlabel, elements,
3465		    buffer, mac.m_buflen, M_WAITOK);
3466		mac_destroy_pipe_label(&intlabel);
3467		break;
3468	default:
3469		panic("__mac_get_fd: corrupted label_type");
3470	}
3471
3472	if (error == 0)
3473		error = copyout(buffer, mac.m_string, strlen(buffer)+1);
3474
3475out:
3476	mtx_unlock(&Giant);				/* VFS */
3477	free(buffer, M_MACTEMP);
3478	free(elements, M_MACTEMP);
3479
3480	return (error);
3481}
3482
3483/*
3484 * MPSAFE
3485 */
3486int
3487__mac_get_file(struct thread *td, struct __mac_get_file_args *uap)
3488{
3489	char *elements, *buffer;
3490	struct nameidata nd;
3491	struct label intlabel;
3492	struct mac mac;
3493	int error;
3494
3495	error = copyin(uap->mac_p, &mac, sizeof(mac));
3496	if (error)
3497		return (error);
3498
3499	error = mac_check_structmac_consistent(&mac);
3500	if (error)
3501		return (error);
3502
3503	elements = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK);
3504	error = copyinstr(mac.m_string, elements, mac.m_buflen, NULL);
3505	if (error) {
3506		free(elements, M_MACTEMP);
3507		return (error);
3508	}
3509
3510	buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK | M_ZERO);
3511	mtx_lock(&Giant);				/* VFS */
3512	NDINIT(&nd, LOOKUP, LOCKLEAF | FOLLOW, UIO_USERSPACE, uap->path_p,
3513	    td);
3514	error = namei(&nd);
3515	if (error)
3516		goto out;
3517
3518	mac_init_vnode_label(&intlabel);
3519	mac_copy_vnode_label(&nd.ni_vp->v_label, &intlabel);
3520	error = mac_externalize_vnode_label(&intlabel, elements, buffer,
3521	    mac.m_buflen, M_WAITOK);
3522
3523	NDFREE(&nd, 0);
3524	mac_destroy_vnode_label(&intlabel);
3525
3526	if (error == 0)
3527		error = copyout(buffer, mac.m_string, strlen(buffer)+1);
3528
3529out:
3530	mtx_unlock(&Giant);				/* VFS */
3531
3532	free(buffer, M_MACTEMP);
3533	free(elements, M_MACTEMP);
3534
3535	return (error);
3536}
3537
3538/*
3539 * MPSAFE
3540 */
3541int
3542__mac_get_link(struct thread *td, struct __mac_get_link_args *uap)
3543{
3544	char *elements, *buffer;
3545	struct nameidata nd;
3546	struct label intlabel;
3547	struct mac mac;
3548	int error;
3549
3550	error = copyin(uap->mac_p, &mac, sizeof(mac));
3551	if (error)
3552		return (error);
3553
3554	error = mac_check_structmac_consistent(&mac);
3555	if (error)
3556		return (error);
3557
3558	elements = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK);
3559	error = copyinstr(mac.m_string, elements, mac.m_buflen, NULL);
3560	if (error) {
3561		free(elements, M_MACTEMP);
3562		return (error);
3563	}
3564
3565	buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK | M_ZERO);
3566	mtx_lock(&Giant);				/* VFS */
3567	NDINIT(&nd, LOOKUP, LOCKLEAF | NOFOLLOW, UIO_USERSPACE, uap->path_p,
3568	    td);
3569	error = namei(&nd);
3570	if (error)
3571		goto out;
3572
3573	mac_init_vnode_label(&intlabel);
3574	mac_copy_vnode_label(&nd.ni_vp->v_label, &intlabel);
3575	error = mac_externalize_vnode_label(&intlabel, elements, buffer,
3576	    mac.m_buflen, M_WAITOK);
3577	NDFREE(&nd, 0);
3578	mac_destroy_vnode_label(&intlabel);
3579
3580	if (error == 0)
3581		error = copyout(buffer, mac.m_string, strlen(buffer)+1);
3582
3583out:
3584	mtx_unlock(&Giant);				/* VFS */
3585
3586	free(buffer, M_MACTEMP);
3587	free(elements, M_MACTEMP);
3588
3589	return (error);
3590}
3591
3592/*
3593 * MPSAFE
3594 */
3595int
3596__mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap)
3597{
3598	struct label intlabel;
3599	struct pipe *pipe;
3600	struct file *fp;
3601	struct mount *mp;
3602	struct vnode *vp;
3603	struct mac mac;
3604	char *buffer;
3605	int error;
3606
3607	error = copyin(uap->mac_p, &mac, sizeof(mac));
3608	if (error)
3609		return (error);
3610
3611	error = mac_check_structmac_consistent(&mac);
3612	if (error)
3613		return (error);
3614
3615	buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK);
3616	error = copyinstr(mac.m_string, buffer, mac.m_buflen, NULL);
3617	if (error) {
3618		free(buffer, M_MACTEMP);
3619		return (error);
3620	}
3621
3622	mtx_lock(&Giant);				/* VFS */
3623
3624	error = fget(td, uap->fd, &fp);
3625	if (error)
3626		goto out;
3627
3628	switch (fp->f_type) {
3629	case DTYPE_FIFO:
3630	case DTYPE_VNODE:
3631		mac_init_vnode_label(&intlabel);
3632		error = mac_internalize_vnode_label(&intlabel, buffer);
3633		if (error) {
3634			mac_destroy_vnode_label(&intlabel);
3635			break;
3636		}
3637
3638		vp = fp->f_vnode;
3639		error = vn_start_write(vp, &mp, V_WAIT | PCATCH);
3640		if (error != 0) {
3641			mac_destroy_vnode_label(&intlabel);
3642			break;
3643		}
3644
3645		vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td);
3646		error = vn_setlabel(vp, &intlabel, td->td_ucred);
3647		VOP_UNLOCK(vp, 0, td);
3648		vn_finished_write(mp);
3649
3650		mac_destroy_vnode_label(&intlabel);
3651		break;
3652
3653	case DTYPE_PIPE:
3654		mac_init_pipe_label(&intlabel);
3655		error = mac_internalize_pipe_label(&intlabel, buffer);
3656		if (error == 0) {
3657			pipe = fp->f_data;
3658			PIPE_LOCK(pipe);
3659			error = mac_pipe_label_set(td->td_ucred, pipe,
3660			    &intlabel);
3661			PIPE_UNLOCK(pipe);
3662		}
3663
3664		mac_destroy_pipe_label(&intlabel);
3665		break;
3666
3667	default:
3668		error = EINVAL;
3669	}
3670
3671	fdrop(fp, td);
3672out:
3673	mtx_unlock(&Giant);				/* VFS */
3674
3675	free(buffer, M_MACTEMP);
3676
3677	return (error);
3678}
3679
3680/*
3681 * MPSAFE
3682 */
3683int
3684__mac_set_file(struct thread *td, struct __mac_set_file_args *uap)
3685{
3686	struct label intlabel;
3687	struct nameidata nd;
3688	struct mount *mp;
3689	struct mac mac;
3690	char *buffer;
3691	int error;
3692
3693	error = copyin(uap->mac_p, &mac, sizeof(mac));
3694	if (error)
3695		return (error);
3696
3697	error = mac_check_structmac_consistent(&mac);
3698	if (error)
3699		return (error);
3700
3701	buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK);
3702	error = copyinstr(mac.m_string, buffer, mac.m_buflen, NULL);
3703	if (error) {
3704		free(buffer, M_MACTEMP);
3705		return (error);
3706	}
3707
3708	mac_init_vnode_label(&intlabel);
3709	error = mac_internalize_vnode_label(&intlabel, buffer);
3710	free(buffer, M_MACTEMP);
3711	if (error) {
3712		mac_destroy_vnode_label(&intlabel);
3713		return (error);
3714	}
3715
3716	mtx_lock(&Giant);				/* VFS */
3717
3718	NDINIT(&nd, LOOKUP, LOCKLEAF | FOLLOW, UIO_USERSPACE, uap->path_p,
3719	    td);
3720	error = namei(&nd);
3721	if (error == 0) {
3722		error = vn_start_write(nd.ni_vp, &mp, V_WAIT | PCATCH);
3723		if (error == 0)
3724			error = vn_setlabel(nd.ni_vp, &intlabel,
3725			    td->td_ucred);
3726		vn_finished_write(mp);
3727	}
3728
3729	NDFREE(&nd, 0);
3730	mtx_unlock(&Giant);				/* VFS */
3731	mac_destroy_vnode_label(&intlabel);
3732
3733	return (error);
3734}
3735
3736/*
3737 * MPSAFE
3738 */
3739int
3740__mac_set_link(struct thread *td, struct __mac_set_link_args *uap)
3741{
3742	struct label intlabel;
3743	struct nameidata nd;
3744	struct mount *mp;
3745	struct mac mac;
3746	char *buffer;
3747	int error;
3748
3749	error = copyin(uap->mac_p, &mac, sizeof(mac));
3750	if (error)
3751		return (error);
3752
3753	error = mac_check_structmac_consistent(&mac);
3754	if (error)
3755		return (error);
3756
3757	buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK);
3758	error = copyinstr(mac.m_string, buffer, mac.m_buflen, NULL);
3759	if (error) {
3760		free(buffer, M_MACTEMP);
3761		return (error);
3762	}
3763
3764	mac_init_vnode_label(&intlabel);
3765	error = mac_internalize_vnode_label(&intlabel, buffer);
3766	free(buffer, M_MACTEMP);
3767	if (error) {
3768		mac_destroy_vnode_label(&intlabel);
3769		return (error);
3770	}
3771
3772	mtx_lock(&Giant);				/* VFS */
3773
3774	NDINIT(&nd, LOOKUP, LOCKLEAF | NOFOLLOW, UIO_USERSPACE, uap->path_p,
3775	    td);
3776	error = namei(&nd);
3777	if (error == 0) {
3778		error = vn_start_write(nd.ni_vp, &mp, V_WAIT | PCATCH);
3779		if (error == 0)
3780			error = vn_setlabel(nd.ni_vp, &intlabel,
3781			    td->td_ucred);
3782		vn_finished_write(mp);
3783	}
3784
3785	NDFREE(&nd, 0);
3786	mtx_unlock(&Giant);				/* VFS */
3787	mac_destroy_vnode_label(&intlabel);
3788
3789	return (error);
3790}
3791
3792/*
3793 * MPSAFE
3794 */
3795int
3796mac_syscall(struct thread *td, struct mac_syscall_args *uap)
3797{
3798	struct mac_policy_conf *mpc;
3799	char target[MAC_MAX_POLICY_NAME];
3800	int entrycount, error;
3801
3802	error = copyinstr(uap->policy, target, sizeof(target), NULL);
3803	if (error)
3804		return (error);
3805
3806	error = ENOSYS;
3807	LIST_FOREACH(mpc, &mac_policy_list, mpc_list) {
3808		if (strcmp(mpc->mpc_name, target) == 0 &&
3809		    mpc->mpc_ops->mpo_syscall != NULL) {
3810			error = mpc->mpc_ops->mpo_syscall(td,
3811			    uap->call, uap->arg);
3812			goto out;
3813		}
3814	}
3815
3816	if ((entrycount = mac_policy_list_conditional_busy()) != 0) {
3817		LIST_FOREACH(mpc, &mac_policy_list, mpc_list) {
3818			if (strcmp(mpc->mpc_name, target) == 0 &&
3819			    mpc->mpc_ops->mpo_syscall != NULL) {
3820				error = mpc->mpc_ops->mpo_syscall(td,
3821				    uap->call, uap->arg);
3822				break;
3823			}
3824		}
3825		mac_policy_list_unbusy();
3826	}
3827out:
3828	return (error);
3829}
3830
3831SYSINIT(mac, SI_SUB_MAC, SI_ORDER_FIRST, mac_init, NULL);
3832SYSINIT(mac_late, SI_SUB_MAC_LATE, SI_ORDER_FIRST, mac_late_init, NULL);
3833
3834#else /* !MAC */
3835
3836int
3837__mac_get_pid(struct thread *td, struct __mac_get_pid_args *uap)
3838{
3839
3840	return (ENOSYS);
3841}
3842
3843int
3844__mac_get_proc(struct thread *td, struct __mac_get_proc_args *uap)
3845{
3846
3847	return (ENOSYS);
3848}
3849
3850int
3851__mac_set_proc(struct thread *td, struct __mac_set_proc_args *uap)
3852{
3853
3854	return (ENOSYS);
3855}
3856
3857int
3858__mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap)
3859{
3860
3861	return (ENOSYS);
3862}
3863
3864int
3865__mac_get_file(struct thread *td, struct __mac_get_file_args *uap)
3866{
3867
3868	return (ENOSYS);
3869}
3870
3871int
3872__mac_get_link(struct thread *td, struct __mac_get_link_args *uap)
3873{
3874
3875	return (ENOSYS);
3876}
3877
3878int
3879__mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap)
3880{
3881
3882	return (ENOSYS);
3883}
3884
3885int
3886__mac_set_file(struct thread *td, struct __mac_set_file_args *uap)
3887{
3888
3889	return (ENOSYS);
3890}
3891
3892int
3893__mac_set_link(struct thread *td, struct __mac_set_link_args *uap)
3894{
3895
3896	return (ENOSYS);
3897}
3898
3899int
3900mac_syscall(struct thread *td, struct mac_syscall_args *uap)
3901{
3902
3903	return (ENOSYS);
3904}
3905
3906#endif
3907