mac_policy.h revision 107698
10Sduke/*- 211857Sdholmes * Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson 30Sduke * Copyright (c) 2001, 2002 Networks Associates Technology, Inc. 40Sduke * All rights reserved. 50Sduke * 60Sduke * This software was developed by Robert Watson for the TrustedBSD Project. 70Sduke * 80Sduke * This software was developed for the FreeBSD Project in part by Network 90Sduke * Associates Laboratories, the Security Research Division of Network 100Sduke * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), 110Sduke * as part of the DARPA CHATS research program. 120Sduke * 130Sduke * Redistribution and use in source and binary forms, with or without 140Sduke * modification, are permitted provided that the following conditions 150Sduke * are met: 160Sduke * 1. Redistributions of source code must retain the above copyright 170Sduke * notice, this list of conditions and the following disclaimer. 180Sduke * 2. Redistributions in binary form must reproduce the above copyright 191472Strims * notice, this list of conditions and the following disclaimer in the 201472Strims * documentation and/or other materials provided with the distribution. 211472Strims * 220Sduke * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 230Sduke * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 240Sduke * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 251879Sstefank * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 268413Spliden * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 278413Spliden * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 288413Spliden * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 291879Sstefank * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 3011857Sdholmes * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 311879Sstefank * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 321879Sstefank * SUCH DAMAGE. 336402Sgoetz * 346683Sgoetz * $FreeBSD: head/sys/security/mac/mac_policy.h 107698 2002-12-09 03:44:28Z rwatson $ 351879Sstefank */ 361879Sstefank/* 370Sduke * Kernel interface for MAC policy modules. 380Sduke */ 390Sduke#ifndef _SYS_MAC_POLICY_H 400Sduke#define _SYS_MAC_POLICY_H 410Sduke 420Sduke/*- 430Sduke * Pluggable access control policy definition structure. 440Sduke * 450Sduke * List of operations that are performed as part of the implementation 460Sduke * of a MAC policy. Policy implementors declare operations with a 470Sduke * mac_policy_ops structure, and using the MAC_POLICY_SET() macro. 480Sduke * If an entry point is not declared, then then the policy will be ignored 490Sduke * during evaluation of that event or check. 500Sduke * 510Sduke * Operations are sorted first by general class of operation, then 520Sduke * alphabetically. 530Sduke */ 540Sdukestruct mac_policy_conf; 550Sdukestruct mac_policy_ops { 560Sduke /* 570Sduke * Policy module operations. 580Sduke */ 590Sduke void (*mpo_destroy)(struct mac_policy_conf *mpc); 600Sduke void (*mpo_init)(struct mac_policy_conf *mpc); 610Sduke 620Sduke /* 630Sduke * General policy-directed security system call so that policies 640Sduke * may implement new services without reserving explicit 650Sduke * system call numbers. 660Sduke */ 670Sduke int (*mpo_syscall)(struct thread *td, int call, void *arg); 680Sduke 690Sduke /* 700Sduke * Label operations. 710Sduke */ 720Sduke void (*mpo_init_bpfdesc_label)(struct label *label); 730Sduke void (*mpo_init_cred_label)(struct label *label); 74806Sysr void (*mpo_init_devfsdirent_label)(struct label *label); 750Sduke void (*mpo_init_ifnet_label)(struct label *label); 760Sduke void (*mpo_init_ipq_label)(struct label *label); 770Sduke int (*mpo_init_mbuf_label)(struct label *label, int flag); 780Sduke void (*mpo_init_mount_label)(struct label *label); 79806Sysr void (*mpo_init_mount_fs_label)(struct label *label); 80806Sysr int (*mpo_init_socket_label)(struct label *label, int flag); 81806Sysr int (*mpo_init_socket_peer_label)(struct label *label, int flag); 827419Skbarrett void (*mpo_init_pipe_label)(struct label *label); 830Sduke void (*mpo_init_proc_label)(struct label *label); 840Sduke void (*mpo_init_vnode_label)(struct label *label); 850Sduke void (*mpo_destroy_bpfdesc_label)(struct label *label); 860Sduke void (*mpo_destroy_cred_label)(struct label *label); 870Sduke void (*mpo_destroy_devfsdirent_label)(struct label *label); 880Sduke void (*mpo_destroy_ifnet_label)(struct label *label); 890Sduke void (*mpo_destroy_ipq_label)(struct label *label); 900Sduke void (*mpo_destroy_mbuf_label)(struct label *label); 910Sduke void (*mpo_destroy_mount_label)(struct label *label); 920Sduke void (*mpo_destroy_mount_fs_label)(struct label *label); 930Sduke void (*mpo_destroy_socket_label)(struct label *label); 940Sduke void (*mpo_destroy_socket_peer_label)(struct label *label); 950Sduke void (*mpo_destroy_pipe_label)(struct label *label); 960Sduke void (*mpo_destroy_proc_label)(struct label *label); 970Sduke void (*mpo_destroy_vnode_label)(struct label *label); 980Sduke void (*mpo_copy_pipe_label)(struct label *src, 990Sduke struct label *dest); 1000Sduke void (*mpo_copy_vnode_label)(struct label *src, 1010Sduke struct label *dest); 1020Sduke int (*mpo_externalize_cred_label)(struct label *label, 1030Sduke char *element_name, char *buffer, size_t buflen, 1049727Sbrutisso size_t *len, int *claimed); 1050Sduke int (*mpo_externalize_ifnet_label)(struct label *label, 1060Sduke char *element_name, char *buffer, size_t buflen, 1070Sduke size_t *len, int *claimed); 1080Sduke int (*mpo_externalize_pipe_label)(struct label *label, 1090Sduke char *element_name, char *buffer, size_t buflen, 1109727Sbrutisso size_t *len, int *claimed); 1110Sduke int (*mpo_externalize_socket_label)(struct label *label, 1120Sduke char *element_name, char *buffer, size_t buflen, 1130Sduke size_t *len, int *claimed); 1140Sduke int (*mpo_externalize_socket_peer_label)(struct label *label, 1150Sduke char *element_name, char *buffer, size_t buflen, 1160Sduke size_t *len, int *claimed); 1170Sduke int (*mpo_externalize_vnode_label)(struct label *label, 1180Sduke char *element_name, char *buffer, size_t buflen, 1190Sduke size_t *len, int *claimed); 1200Sduke int (*mpo_internalize_cred_label)(struct label *label, 1210Sduke char *element_name, char *element_data, int *claimed); 1229727Sbrutisso int (*mpo_internalize_ifnet_label)(struct label *label, 1230Sduke char *element_name, char *element_data, int *claimed); 1240Sduke int (*mpo_internalize_pipe_label)(struct label *label, 1250Sduke char *element_name, char *element_data, int *claimed); 1260Sduke int (*mpo_internalize_socket_label)(struct label *label, 1270Sduke char *element_name, char *element_data, int *claimed); 1289727Sbrutisso int (*mpo_internalize_vnode_label)(struct label *label, 1290Sduke char *element_name, char *element_data, int *claimed); 1300Sduke 1310Sduke /* 1320Sduke * Labeling event operations: file system objects, and things that 1330Sduke * look a lot like file system objects. 1340Sduke */ 1350Sduke void (*mpo_associate_vnode_devfs)(struct mount *mp, 1360Sduke struct label *fslabel, struct devfs_dirent *de, 1370Sduke struct label *delabel, struct vnode *vp, 1380Sduke struct label *vlabel); 1390Sduke int (*mpo_associate_vnode_extattr)(struct mount *mp, 1400Sduke struct label *fslabel, struct vnode *vp, 1410Sduke struct label *vlabel); 1420Sduke void (*mpo_associate_vnode_singlelabel)(struct mount *mp, 1430Sduke struct label *fslabel, struct vnode *vp, 1440Sduke struct label *vlabel); 1450Sduke void (*mpo_create_devfs_device)(struct mount *mp, dev_t dev, 1460Sduke struct devfs_dirent *de, struct label *label); 1470Sduke void (*mpo_create_devfs_directory)(struct mount *mp, char *dirname, 1480Sduke int dirnamelen, struct devfs_dirent *de, 1490Sduke struct label *label); 1500Sduke void (*mpo_create_devfs_symlink)(struct ucred *cred, 1510Sduke struct mount *mp, struct devfs_dirent *dd, 1520Sduke struct label *ddlabel, struct devfs_dirent *de, 1530Sduke struct label *delabel); 1540Sduke int (*mpo_create_vnode_extattr)(struct ucred *cred, 1550Sduke struct mount *mp, struct label *fslabel, 1560Sduke struct vnode *dvp, struct label *dlabel, 1577311Siignatyev struct vnode *vp, struct label *vlabel, 1580Sduke struct componentname *cnp); 1590Sduke void (*mpo_create_mount)(struct ucred *cred, struct mount *mp, 1600Sduke struct label *mntlabel, struct label *fslabel); 1610Sduke void (*mpo_create_root_mount)(struct ucred *cred, struct mount *mp, 1627311Siignatyev struct label *mountlabel, struct label *fslabel); 1637311Siignatyev void (*mpo_relabel_vnode)(struct ucred *cred, struct vnode *vp, 1647311Siignatyev struct label *vnodelabel, struct label *label); 1657311Siignatyev int (*mpo_setlabel_vnode_extattr)(struct ucred *cred, 1667311Siignatyev struct vnode *vp, struct label *vlabel, 1677311Siignatyev struct label *intlabel); 1680Sduke void (*mpo_update_devfsdirent)(struct mount *mp, 1690Sduke struct devfs_dirent *devfs_dirent, 1700Sduke struct label *direntlabel, struct vnode *vp, 1710Sduke struct label *vnodelabel); 1727311Siignatyev 1730Sduke /* 1740Sduke * Labeling event operations: IPC objects. 1752062Scoleenp */ 1762062Scoleenp void (*mpo_create_mbuf_from_socket)(struct socket *so, 1772062Scoleenp struct label *socketlabel, struct mbuf *m, 1782062Scoleenp struct label *mbuflabel); 1792062Scoleenp void (*mpo_create_socket)(struct ucred *cred, struct socket *so, 1800Sduke struct label *socketlabel); 1817311Siignatyev void (*mpo_create_socket_from_socket)(struct socket *oldsocket, 1827311Siignatyev struct label *oldsocketlabel, struct socket *newsocket, 1837311Siignatyev struct label *newsocketlabel); 1847311Siignatyev void (*mpo_relabel_socket)(struct ucred *cred, struct socket *so, 1857311Siignatyev struct label *oldlabel, struct label *newlabel); 1867311Siignatyev void (*mpo_relabel_pipe)(struct ucred *cred, struct pipe *pipe, 1877311Siignatyev struct label *oldlabel, struct label *newlabel); 1880Sduke void (*mpo_set_socket_peer_from_mbuf)(struct mbuf *mbuf, 1890Sduke struct label *mbuflabel, struct socket *so, 1900Sduke struct label *socketpeerlabel); 1917311Siignatyev void (*mpo_set_socket_peer_from_socket)(struct socket *oldsocket, 1920Sduke struct label *oldsocketlabel, struct socket *newsocket, 1930Sduke struct label *newsocketpeerlabel); 1940Sduke void (*mpo_create_pipe)(struct ucred *cred, struct pipe *pipe, 1950Sduke struct label *pipelabel); 1960Sduke 1970Sduke /* 1980Sduke * Labeling event operations: network objects. 1990Sduke */ 2000Sduke void (*mpo_create_bpfdesc)(struct ucred *cred, struct bpf_d *bpf_d, 2010Sduke struct label *bpflabel); 2020Sduke void (*mpo_create_ifnet)(struct ifnet *ifnet, 2030Sduke struct label *ifnetlabel); 2040Sduke void (*mpo_create_ipq)(struct mbuf *fragment, 2050Sduke struct label *fragmentlabel, struct ipq *ipq, 2060Sduke struct label *ipqlabel); 2070Sduke void (*mpo_create_datagram_from_ipq) 2080Sduke (struct ipq *ipq, struct label *ipqlabel, 2090Sduke struct mbuf *datagram, struct label *datagramlabel); 2108345Srbackman void (*mpo_create_fragment)(struct mbuf *datagram, 2110Sduke struct label *datagramlabel, struct mbuf *fragment, 2120Sduke struct label *fragmentlabel); 2130Sduke void (*mpo_create_mbuf_from_mbuf)(struct mbuf *oldmbuf, 2140Sduke struct label *oldlabel, struct mbuf *newmbuf, 2150Sduke struct label *newlabel); 2160Sduke void (*mpo_create_mbuf_linklayer)(struct ifnet *ifnet, 2170Sduke struct label *ifnetlabel, struct mbuf *mbuf, 2180Sduke struct label *mbuflabel); 2190Sduke void (*mpo_create_mbuf_from_bpfdesc)(struct bpf_d *bpf_d, 2200Sduke struct label *bpflabel, struct mbuf *mbuf, 2210Sduke struct label *mbuflabel); 2220Sduke void (*mpo_create_mbuf_from_ifnet)(struct ifnet *ifnet, 2230Sduke struct label *ifnetlabel, struct mbuf *mbuf, 2240Sduke struct label *mbuflabel); 2250Sduke void (*mpo_create_mbuf_multicast_encap)(struct mbuf *oldmbuf, 2260Sduke struct label *oldmbuflabel, struct ifnet *ifnet, 2270Sduke struct label *ifnetlabel, struct mbuf *newmbuf, 2280Sduke struct label *newmbuflabel); 2290Sduke void (*mpo_create_mbuf_netlayer)(struct mbuf *oldmbuf, 2300Sduke struct label *oldmbuflabel, struct mbuf *newmbuf, 2310Sduke struct label *newmbuflabel); 2320Sduke int (*mpo_fragment_match)(struct mbuf *fragment, 2330Sduke struct label *fragmentlabel, struct ipq *ipq, 2340Sduke struct label *ipqlabel); 2350Sduke void (*mpo_relabel_ifnet)(struct ucred *cred, struct ifnet *ifnet, 2360Sduke struct label *ifnetlabel, struct label *newlabel); 2370Sduke void (*mpo_update_ipq)(struct mbuf *fragment, 2380Sduke struct label *fragmentlabel, struct ipq *ipq, 2390Sduke struct label *ipqlabel); 2400Sduke 2410Sduke /* 2420Sduke * Labeling event operations: processes. 2430Sduke */ 2440Sduke void (*mpo_create_cred)(struct ucred *parent_cred, 2450Sduke struct ucred *child_cred); 2460Sduke void (*mpo_execve_transition)(struct ucred *old, struct ucred *new, 2470Sduke struct vnode *vp, struct label *vnodelabel, 2480Sduke struct label *interpvnodelabel, 2490Sduke struct image_params *imgp, struct label *execlabel); 2500Sduke int (*mpo_execve_will_transition)(struct ucred *old, 2510Sduke struct vnode *vp, struct label *vnodelabel, 2520Sduke struct label *interpvnodelabel, 2530Sduke struct image_params *imgp, struct label *execlabel); 2540Sduke void (*mpo_create_proc0)(struct ucred *cred); 2550Sduke void (*mpo_create_proc1)(struct ucred *cred); 2560Sduke void (*mpo_relabel_cred)(struct ucred *cred, 2570Sduke struct label *newlabel); 2580Sduke void (*mpo_thread_userret)(struct thread *thread); 2590Sduke 2600Sduke /* 2610Sduke * Access control checks. 2620Sduke */ 2630Sduke int (*mpo_check_bpfdesc_receive)(struct bpf_d *bpf_d, 2640Sduke struct label *bpflabel, struct ifnet *ifnet, 2650Sduke struct label *ifnetlabel); 266 int (*mpo_check_cred_relabel)(struct ucred *cred, 267 struct label *newlabel); 268 int (*mpo_check_cred_visible)(struct ucred *u1, struct ucred *u2); 269 int (*mpo_check_ifnet_relabel)(struct ucred *cred, 270 struct ifnet *ifnet, struct label *ifnetlabel, 271 struct label *newlabel); 272 int (*mpo_check_ifnet_transmit)(struct ifnet *ifnet, 273 struct label *ifnetlabel, struct mbuf *m, 274 struct label *mbuflabel); 275 int (*mpo_check_kenv_dump)(struct ucred *cred); 276 int (*mpo_check_kenv_get)(struct ucred *cred, char *name); 277 int (*mpo_check_kenv_set)(struct ucred *cred, char *name, 278 char *value); 279 int (*mpo_check_kenv_unset)(struct ucred *cred, char *name); 280 int (*mpo_check_kld_load)(struct ucred *cred, struct vnode *vp, 281 struct label *vlabel); 282 int (*mpo_check_kld_stat)(struct ucred *cred); 283 int (*mpo_check_kld_unload)(struct ucred *cred); 284 int (*mpo_check_mount_stat)(struct ucred *cred, struct mount *mp, 285 struct label *mntlabel); 286 int (*mpo_check_pipe_ioctl)(struct ucred *cred, struct pipe *pipe, 287 struct label *pipelabel, unsigned long cmd, void *data); 288 int (*mpo_check_pipe_poll)(struct ucred *cred, struct pipe *pipe, 289 struct label *pipelabel); 290 int (*mpo_check_pipe_read)(struct ucred *cred, struct pipe *pipe, 291 struct label *pipelabel); 292 int (*mpo_check_pipe_relabel)(struct ucred *cred, 293 struct pipe *pipe, struct label *pipelabel, 294 struct label *newlabel); 295 int (*mpo_check_pipe_stat)(struct ucred *cred, struct pipe *pipe, 296 struct label *pipelabel); 297 int (*mpo_check_pipe_write)(struct ucred *cred, struct pipe *pipe, 298 struct label *pipelabel); 299 int (*mpo_check_proc_debug)(struct ucred *cred, 300 struct proc *proc); 301 int (*mpo_check_proc_sched)(struct ucred *cred, 302 struct proc *proc); 303 int (*mpo_check_proc_signal)(struct ucred *cred, 304 struct proc *proc, int signum); 305 int (*mpo_check_socket_bind)(struct ucred *cred, 306 struct socket *so, struct label *socketlabel, 307 struct sockaddr *sockaddr); 308 int (*mpo_check_socket_connect)(struct ucred *cred, 309 struct socket *so, struct label *socketlabel, 310 struct sockaddr *sockaddr); 311 int (*mpo_check_socket_deliver)(struct socket *so, 312 struct label *socketlabel, struct mbuf *m, 313 struct label *mbuflabel); 314 int (*mpo_check_socket_listen)(struct ucred *cred, 315 struct socket *so, struct label *socketlabel); 316 int (*mpo_check_socket_receive)(struct ucred *cred, 317 struct socket *so, struct label *socketlabel); 318 int (*mpo_check_socket_relabel)(struct ucred *cred, 319 struct socket *so, struct label *socketlabel, 320 struct label *newlabel); 321 int (*mpo_check_socket_send)(struct ucred *cred, 322 struct socket *so, struct label *socketlabel); 323 int (*mpo_check_socket_visible)(struct ucred *cred, 324 struct socket *so, struct label *socketlabel); 325 int (*mpo_check_system_acct)(struct ucred *cred, 326 struct vnode *vp, struct label *vlabel); 327 int (*mpo_check_system_nfsd)(struct ucred *cred); 328 int (*mpo_check_system_reboot)(struct ucred *cred, int howto); 329 int (*mpo_check_system_settime)(struct ucred *cred); 330 int (*mpo_check_system_swapon)(struct ucred *cred, 331 struct vnode *vp, struct label *label); 332 int (*mpo_check_system_sysctl)(struct ucred *cred, int *name, 333 u_int namelen, void *old, size_t *oldlenp, int inkernel, 334 void *new, size_t newlen); 335 int (*mpo_check_vnode_access)(struct ucred *cred, 336 struct vnode *vp, struct label *label, int acc_mode); 337 int (*mpo_check_vnode_chdir)(struct ucred *cred, 338 struct vnode *dvp, struct label *dlabel); 339 int (*mpo_check_vnode_chroot)(struct ucred *cred, 340 struct vnode *dvp, struct label *dlabel); 341 int (*mpo_check_vnode_create)(struct ucred *cred, 342 struct vnode *dvp, struct label *dlabel, 343 struct componentname *cnp, struct vattr *vap); 344 int (*mpo_check_vnode_delete)(struct ucred *cred, 345 struct vnode *dvp, struct label *dlabel, 346 struct vnode *vp, struct label *label, 347 struct componentname *cnp); 348 int (*mpo_check_vnode_deleteacl)(struct ucred *cred, 349 struct vnode *vp, struct label *label, acl_type_t type); 350 int (*mpo_check_vnode_exec)(struct ucred *cred, struct vnode *vp, 351 struct label *label, struct image_params *imgp, 352 struct label *execlabel); 353 int (*mpo_check_vnode_getacl)(struct ucred *cred, 354 struct vnode *vp, struct label *label, acl_type_t type); 355 int (*mpo_check_vnode_getextattr)(struct ucred *cred, 356 struct vnode *vp, struct label *label, int attrnamespace, 357 const char *name, struct uio *uio); 358 int (*mpo_check_vnode_link)(struct ucred *cred, struct vnode *dvp, 359 struct label *dlabel, struct vnode *vp, 360 struct label *label, struct componentname *cnp); 361 int (*mpo_check_vnode_lookup)(struct ucred *cred, 362 struct vnode *dvp, struct label *dlabel, 363 struct componentname *cnp); 364 int (*mpo_check_vnode_mmap)(struct ucred *cred, struct vnode *vp, 365 struct label *label, int prot); 366 void (*mpo_check_vnode_mmap_downgrade)(struct ucred *cred, 367 struct vnode *vp, struct label *label, int *prot); 368 int (*mpo_check_vnode_mprotect)(struct ucred *cred, 369 struct vnode *vp, struct label *label, int prot); 370 int (*mpo_check_vnode_open)(struct ucred *cred, struct vnode *vp, 371 struct label *label, int acc_mode); 372 int (*mpo_check_vnode_poll)(struct ucred *active_cred, 373 struct ucred *file_cred, struct vnode *vp, 374 struct label *label); 375 int (*mpo_check_vnode_read)(struct ucred *active_cred, 376 struct ucred *file_cred, struct vnode *vp, 377 struct label *label); 378 int (*mpo_check_vnode_readdir)(struct ucred *cred, 379 struct vnode *dvp, struct label *dlabel); 380 int (*mpo_check_vnode_readlink)(struct ucred *cred, 381 struct vnode *vp, struct label *label); 382 int (*mpo_check_vnode_relabel)(struct ucred *cred, 383 struct vnode *vp, struct label *vnodelabel, 384 struct label *newlabel); 385 int (*mpo_check_vnode_rename_from)(struct ucred *cred, 386 struct vnode *dvp, struct label *dlabel, struct vnode *vp, 387 struct label *label, struct componentname *cnp); 388 int (*mpo_check_vnode_rename_to)(struct ucred *cred, 389 struct vnode *dvp, struct label *dlabel, struct vnode *vp, 390 struct label *label, int samedir, 391 struct componentname *cnp); 392 int (*mpo_check_vnode_revoke)(struct ucred *cred, 393 struct vnode *vp, struct label *label); 394 int (*mpo_check_vnode_setacl)(struct ucred *cred, 395 struct vnode *vp, struct label *label, acl_type_t type, 396 struct acl *acl); 397 int (*mpo_check_vnode_setextattr)(struct ucred *cred, 398 struct vnode *vp, struct label *label, int attrnamespace, 399 const char *name, struct uio *uio); 400 int (*mpo_check_vnode_setflags)(struct ucred *cred, 401 struct vnode *vp, struct label *label, u_long flags); 402 int (*mpo_check_vnode_setmode)(struct ucred *cred, 403 struct vnode *vp, struct label *label, mode_t mode); 404 int (*mpo_check_vnode_setowner)(struct ucred *cred, 405 struct vnode *vp, struct label *label, uid_t uid, 406 gid_t gid); 407 int (*mpo_check_vnode_setutimes)(struct ucred *cred, 408 struct vnode *vp, struct label *label, 409 struct timespec atime, struct timespec mtime); 410 int (*mpo_check_vnode_stat)(struct ucred *active_cred, 411 struct ucred *file_cred, struct vnode *vp, 412 struct label *label); 413 int (*mpo_check_vnode_write)(struct ucred *active_cred, 414 struct ucred *file_cred, struct vnode *vp, 415 struct label *label); 416}; 417 418struct mac_policy_conf { 419 char *mpc_name; /* policy name */ 420 char *mpc_fullname; /* policy full name */ 421 struct mac_policy_ops *mpc_ops; /* policy operations */ 422 int mpc_loadtime_flags; /* flags */ 423 int *mpc_field_off; /* security field */ 424 int mpc_runtime_flags; /* flags */ 425 LIST_ENTRY(mac_policy_conf) mpc_list; /* global list */ 426}; 427 428/* Flags for the mpc_loadtime_flags field. */ 429#define MPC_LOADTIME_FLAG_NOTLATE 0x00000001 430#define MPC_LOADTIME_FLAG_UNLOADOK 0x00000002 431 432/* Flags for the mpc_runtime_flags field. */ 433#define MPC_RUNTIME_FLAG_REGISTERED 0x00000001 434 435#define MAC_POLICY_SET(mpops, mpname, mpfullname, mpflags, privdata_wanted) \ 436 static struct mac_policy_conf mpname##_mac_policy_conf = { \ 437 #mpname, \ 438 mpfullname, \ 439 mpops, \ 440 mpflags, \ 441 privdata_wanted, \ 442 0, \ 443 }; \ 444 static moduledata_t mpname##_mod = { \ 445 #mpname, \ 446 mac_policy_modevent, \ 447 &mpname##_mac_policy_conf \ 448 }; \ 449 MODULE_DEPEND(mpname, kernel_mac_support, 1, 1, 1); \ 450 DECLARE_MODULE(mpname, mpname##_mod, SI_SUB_MAC_POLICY, \ 451 SI_ORDER_MIDDLE) 452 453int mac_policy_modevent(module_t mod, int type, void *data); 454 455#define LABEL_TO_SLOT(l, s) (l)->l_perpolicy[s] 456 457#endif /* !_SYS_MAC_POLICY_H */ 458