mac_policy.h revision 175164
1/*- 2 * Copyright (c) 1999-2002, 2007 Robert N. M. Watson 3 * Copyright (c) 2001-2005 Networks Associates Technology, Inc. 4 * Copyright (c) 2005-2006 SPARTA, Inc. 5 * All rights reserved. 6 * 7 * This software was developed by Robert Watson for the TrustedBSD Project. 8 * 9 * This software was developed for the FreeBSD Project in part by Network 10 * Associates Laboratories, the Security Research Division of Network 11 * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), 12 * as part of the DARPA CHATS research program. 13 * 14 * This software was enhanced by SPARTA ISSO under SPAWAR contract 15 * N66001-04-C-6019 ("SEFOS"). 16 * 17 * Redistribution and use in source and binary forms, with or without 18 * modification, are permitted provided that the following conditions 19 * are met: 20 * 1. Redistributions of source code must retain the above copyright 21 * notice, this list of conditions and the following disclaimer. 22 * 2. Redistributions in binary form must reproduce the above copyright 23 * notice, this list of conditions and the following disclaimer in the 24 * documentation and/or other materials provided with the distribution. 25 * 26 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 27 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 28 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 29 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 30 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 31 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 32 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 33 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 34 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 35 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 36 * SUCH DAMAGE. 37 * 38 * $FreeBSD: head/sys/security/mac/mac_policy.h 175164 2008-01-08 21:58:16Z jhb $ 39 */ 40/* 41 * Kernel interface for MAC policy modules. 42 */ 43#ifndef _SYS_SECURITY_MAC_MAC_POLICY_H_ 44#define _SYS_SECURITY_MAC_MAC_POLICY_H_ 45 46#ifndef _KERNEL 47#error "no user-serviceable parts inside" 48#endif 49 50/*- 51 * Pluggable access control policy definition structure. 52 * 53 * List of operations that are performed as part of the implementation of a 54 * MAC policy. Policy implementors declare operations with a mac_policy_ops 55 * structure, and using the MAC_POLICY_SET() macro. If an entry point is not 56 * declared, then then the policy will be ignored during evaluation of that 57 * event or check. 58 * 59 * Operations are sorted first by general class of operation, then 60 * alphabetically. 61 */ 62#include <sys/acl.h> /* XXX acl_type_t */ 63 64struct acl; 65struct auditinfo; 66struct auditinfo_addr; 67struct bpf_d; 68struct cdev; 69struct componentname; 70struct devfs_dirent; 71struct ifnet; 72struct image_params; 73struct inpcb; 74struct ipq; 75struct ksem; 76struct label; 77struct mac_policy_conf; 78struct mbuf; 79struct mount; 80struct msg; 81struct msqid_kernel; 82struct pipepair; 83struct proc; 84struct sbuf; 85struct semid_kernel; 86struct shmfd; 87struct shmid_kernel; 88struct sockaddr; 89struct socket; 90struct sysctl_oid; 91struct sysctl_req; 92struct thread; 93struct ucred; 94struct uio; 95struct vattr; 96struct vnode; 97 98/* 99 * Policy module operations. 100 */ 101typedef void (*mpo_destroy_t)(struct mac_policy_conf *mpc); 102typedef void (*mpo_init_t)(struct mac_policy_conf *mpc); 103 104/* 105 * General policy-directed security system call so that policies may 106 * implement new services without reserving explicit system call numbers. 107 */ 108typedef int (*mpo_syscall_t)(struct thread *td, int call, void *arg); 109 110/* 111 * Place-holder function pointers for ABI-compatibility purposes. 112 */ 113typedef void (*mpo_placeholder_t)(void); 114 115/* 116 * Operations sorted alphabetically by primary object type and then method. 117 */ 118typedef int (*mpo_bpfdesc_check_receive_t)(struct bpf_d *d, 119 struct label *dlabel, struct ifnet *ifp, 120 struct label *ifplabel); 121typedef void (*mpo_bpfdesc_create_t)(struct ucred *cred, 122 struct bpf_d *d, struct label *dlabel); 123typedef void (*mpo_bpfdesc_create_mbuf_t)(struct bpf_d *d, 124 struct label *dlabel, struct mbuf *m, 125 struct label *mlabel); 126typedef void (*mpo_bpfdesc_destroy_label_t)(struct label *label); 127typedef void (*mpo_bpfdesc_init_label_t)(struct label *label); 128 129typedef int (*mpo_cred_check_relabel_t)(struct ucred *cred, 130 struct label *newlabel); 131typedef int (*mpo_cred_check_visible_t)(struct ucred *cr1, 132 struct ucred *cr2); 133typedef void (*mpo_cred_copy_label_t)(struct label *src, 134 struct label *dest); 135typedef void (*mpo_cred_destroy_label_t)(struct label *label); 136typedef int (*mpo_cred_externalize_label_t)(struct label *label, 137 char *element_name, struct sbuf *sb, int *claimed); 138typedef void (*mpo_cred_init_label_t)(struct label *label); 139typedef int (*mpo_cred_internalize_label_t)(struct label *label, 140 char *element_name, char *element_data, int *claimed); 141typedef void (*mpo_cred_relabel_t)(struct ucred *cred, 142 struct label *newlabel); 143 144typedef void (*mpo_devfs_create_device_t)(struct ucred *cred, 145 struct mount *mp, struct cdev *dev, 146 struct devfs_dirent *de, struct label *delabel); 147typedef void (*mpo_devfs_create_directory_t)(struct mount *mp, 148 char *dirname, int dirnamelen, struct devfs_dirent *de, 149 struct label *delabel); 150typedef void (*mpo_devfs_create_symlink_t)(struct ucred *cred, 151 struct mount *mp, struct devfs_dirent *dd, 152 struct label *ddlabel, struct devfs_dirent *de, 153 struct label *delabel); 154typedef void (*mpo_devfs_destroy_label_t)(struct label *label); 155typedef void (*mpo_devfs_init_label_t)(struct label *label); 156typedef void (*mpo_devfs_update_t)(struct mount *mp, 157 struct devfs_dirent *de, struct label *delabel, 158 struct vnode *vp, struct label *vplabel); 159typedef void (*mpo_devfs_vnode_associate_t)(struct mount *mp, 160 struct label *mplabel, struct devfs_dirent *de, 161 struct label *delabel, struct vnode *vp, 162 struct label *vplabel); 163 164typedef int (*mpo_ifnet_check_relabel_t)(struct ucred *cred, 165 struct ifnet *ifp, struct label *ifplabel, 166 struct label *newlabel); 167typedef int (*mpo_ifnet_check_transmit_t)(struct ifnet *ifp, 168 struct label *ifplabel, struct mbuf *m, 169 struct label *mlabel); 170typedef void (*mpo_ifnet_copy_label_t)(struct label *src, 171 struct label *dest); 172typedef void (*mpo_ifnet_create_t)(struct ifnet *ifp, 173 struct label *ifplabel); 174typedef void (*mpo_ifnet_create_mbuf_t)(struct ifnet *ifp, 175 struct label *ifplabel, struct mbuf *m, 176 struct label *mlabel); 177typedef void (*mpo_ifnet_destroy_label_t)(struct label *label); 178typedef int (*mpo_ifnet_externalize_label_t)(struct label *label, 179 char *element_name, struct sbuf *sb, int *claimed); 180typedef void (*mpo_ifnet_init_label_t)(struct label *label); 181typedef int (*mpo_ifnet_internalize_label_t)(struct label *label, 182 char *element_name, char *element_data, int *claimed); 183typedef void (*mpo_ifnet_relabel_t)(struct ucred *cred, struct ifnet *ifp, 184 struct label *ifplabel, struct label *newlabel); 185 186typedef int (*mpo_inpcb_check_deliver_t)(struct inpcb *inp, 187 struct label *inplabel, struct mbuf *m, 188 struct label *mlabel); 189typedef void (*mpo_inpcb_create_t)(struct socket *so, 190 struct label *solabel, struct inpcb *inp, 191 struct label *inplabel); 192typedef void (*mpo_inpcb_create_mbuf_t)(struct inpcb *inp, 193 struct label *inplabel, struct mbuf *m, 194 struct label *mlabel); 195typedef void (*mpo_inpcb_destroy_label_t)(struct label *label); 196typedef int (*mpo_inpcb_init_label_t)(struct label *label, int flag); 197typedef void (*mpo_inpcb_sosetlabel_t)(struct socket *so, 198 struct label *label, struct inpcb *inp, 199 struct label *inplabel); 200 201typedef void (*mpo_ipq_create_t)(struct mbuf *m, struct label *mlabel, 202 struct ipq *ipq, struct label *ipqlabel); 203typedef void (*mpo_ipq_destroy_label_t)(struct label *label); 204typedef int (*mpo_ipq_init_label_t)(struct label *label, int flag); 205typedef int (*mpo_ipq_match_t)(struct mbuf *m, struct label *mlabel, 206 struct ipq *ipq, struct label *ipqlabel); 207typedef void (*mpo_ipq_reassemble)(struct ipq *ipq, 208 struct label *ipqlabel, struct mbuf *m, 209 struct label *mlabel); 210typedef void (*mpo_ipq_update_t)(struct mbuf *m, struct label *mlabel, 211 struct ipq *ipq, struct label *ipqlabel); 212 213typedef int (*mpo_kenv_check_dump_t)(struct ucred *cred); 214typedef int (*mpo_kenv_check_get_t)(struct ucred *cred, char *name); 215typedef int (*mpo_kenv_check_set_t)(struct ucred *cred, char *name, 216 char *value); 217typedef int (*mpo_kenv_check_unset_t)(struct ucred *cred, char *name); 218 219typedef int (*mpo_kld_check_load_t)(struct ucred *cred, struct vnode *vp, 220 struct label *vplabel); 221typedef int (*mpo_kld_check_stat_t)(struct ucred *cred); 222 223typedef void (*mpo_mbuf_copy_label_t)(struct label *src, 224 struct label *dest); 225typedef void (*mpo_mbuf_destroy_label_t)(struct label *label); 226typedef int (*mpo_mbuf_init_label_t)(struct label *label, int flag); 227 228typedef int (*mpo_mount_check_stat_t)(struct ucred *cred, 229 struct mount *mp, struct label *mplabel); 230typedef void (*mpo_mount_create_t)(struct ucred *cred, struct mount *mp, 231 struct label *mplabel); 232typedef void (*mpo_mount_destroy_label_t)(struct label *label); 233typedef void (*mpo_mount_init_label_t)(struct label *label); 234 235typedef void (*mpo_netatalk_aarp_send_t)(struct ifnet *ifp, 236 struct label *ifplabel, struct mbuf *m, 237 struct label *mlabel); 238 239typedef void (*mpo_netinet_arp_send_t)(struct ifnet *ifp, 240 struct label *ifplabel, struct mbuf *m, 241 struct label *mlabel); 242typedef void (*mpo_netinet_firewall_reply_t)(struct mbuf *mrecv, 243 struct label *mrecvlabel, struct mbuf *msend, 244 struct label *msendlabel); 245typedef void (*mpo_netinet_firewall_send_t)(struct mbuf *m, 246 struct label *mlabel); 247typedef void (*mpo_netinet_fragment_t)(struct mbuf *m, 248 struct label *mlabel, struct mbuf *frag, 249 struct label *fraglabel); 250typedef void (*mpo_netinet_icmp_reply_t)(struct mbuf *mrecv, 251 struct label *mrecvlabel, struct mbuf *msend, 252 struct label *msendlabel); 253typedef void (*mpo_netinet_icmp_replyinplace_t)(struct mbuf *m, 254 struct label *mlabel); 255typedef void (*mpo_netinet_igmp_send_t)(struct ifnet *ifp, 256 struct label *ifplabel, struct mbuf *m, 257 struct label *mlabel); 258typedef void (*mpo_netinet_tcp_reply_t)(struct mbuf *m, 259 struct label *mlabel); 260 261typedef void (*mpo_netinet6_nd6_send_t)(struct ifnet *ifp, 262 struct label *ifplabel, struct mbuf *m, 263 struct label *mlabel); 264 265typedef int (*mpo_pipe_check_ioctl_t)(struct ucred *cred, 266 struct pipepair *pp, struct label *pplabel, 267 unsigned long cmd, void *data); 268typedef int (*mpo_pipe_check_poll_t)(struct ucred *cred, 269 struct pipepair *pp, struct label *pplabel); 270typedef int (*mpo_pipe_check_read_t)(struct ucred *cred, 271 struct pipepair *pp, struct label *pplabel); 272typedef int (*mpo_pipe_check_relabel_t)(struct ucred *cred, 273 struct pipepair *pp, struct label *pplabel, 274 struct label *newlabel); 275typedef int (*mpo_pipe_check_stat_t)(struct ucred *cred, 276 struct pipepair *pp, struct label *pplabel); 277typedef int (*mpo_pipe_check_write_t)(struct ucred *cred, 278 struct pipepair *pp, struct label *pplabel); 279typedef void (*mpo_pipe_copy_label_t)(struct label *src, 280 struct label *dest); 281typedef void (*mpo_pipe_create_t)(struct ucred *cred, struct pipepair *pp, 282 struct label *pplabel); 283typedef void (*mpo_pipe_destroy_label_t)(struct label *label); 284typedef int (*mpo_pipe_externalize_label_t)(struct label *label, 285 char *element_name, struct sbuf *sb, int *claimed); 286typedef void (*mpo_pipe_init_label_t)(struct label *label); 287typedef int (*mpo_pipe_internalize_label_t)(struct label *label, 288 char *element_name, char *element_data, int *claimed); 289typedef void (*mpo_pipe_relabel_t)(struct ucred *cred, struct pipepair *pp, 290 struct label *oldlabel, struct label *newlabel); 291 292typedef int (*mpo_posixsem_check_destroy_t)(struct ucred *cred, 293 struct ksem *ks, struct label *kslabel); 294typedef int (*mpo_posixsem_check_getvalue_t)(struct ucred *cred, 295 struct ksem *ks, struct label *kslabel); 296typedef int (*mpo_posixsem_check_open_t)(struct ucred *cred, 297 struct ksem *ks, struct label *kslabel); 298typedef int (*mpo_posixsem_check_post_t)(struct ucred *cred, 299 struct ksem *ks, struct label *kslabel); 300typedef int (*mpo_posixsem_check_unlink_t)(struct ucred *cred, 301 struct ksem *ks, struct label *kslabel); 302typedef int (*mpo_posixsem_check_wait_t)(struct ucred *cred, 303 struct ksem *ks, struct label *kslabel); 304typedef void (*mpo_posixsem_create_t)(struct ucred *cred, 305 struct ksem *ks, struct label *kslabel); 306typedef void (*mpo_posixsem_destroy_label_t)(struct label *label); 307typedef void (*mpo_posixsem_init_label_t)(struct label *label); 308 309typedef int (*mpo_posixshm_check_mmap_t)(struct ucred *cred, 310 struct shmfd *shmfd, struct label *shmlabel, int prot, 311 int flags); 312typedef int (*mpo_posixshm_check_open_t)(struct ucred *cred, 313 struct shmfd *shmfd, struct label *shmlabel); 314typedef int (*mpo_posixshm_check_stat_t)(struct ucred *active_cred, 315 struct ucred *file_cred, struct shmfd *shmfd, 316 struct label *shmlabel); 317typedef int (*mpo_posixshm_check_truncate_t)(struct ucred *active_cred, 318 struct ucred *file_cred, struct shmfd *shmfd, 319 struct label *shmlabel); 320typedef int (*mpo_posixshm_check_unlink_t)(struct ucred *cred, 321 struct shmfd *shmfd, struct label *shmlabel); 322typedef void (*mpo_posixshm_create_t)(struct ucred *cred, 323 struct shmfd *shmfd, struct label *shmlabel); 324typedef void (*mpo_posixshm_destroy_label_t)(struct label *label); 325typedef void (*mpo_posixshm_init_label_t)(struct label *label); 326 327typedef int (*mpo_priv_check_t)(struct ucred *cred, int priv); 328typedef int (*mpo_priv_grant_t)(struct ucred *cred, int priv); 329 330typedef void (*mpo_proc_associate_nfsd_t)(struct ucred *cred); 331typedef int (*mpo_proc_check_debug_t)(struct ucred *cred, 332 struct proc *p); 333typedef int (*mpo_proc_check_sched_t)(struct ucred *cred, 334 struct proc *p); 335typedef int (*mpo_proc_check_setaudit_t)(struct ucred *cred, 336 struct auditinfo *ai); 337typedef int (*mpo_proc_check_setaudit_addr_t)(struct ucred *cred, 338 struct auditinfo_addr *aia); 339typedef int (*mpo_proc_check_setauid_t)(struct ucred *cred, uid_t auid); 340typedef int (*mpo_proc_check_setegid_t)(struct ucred *cred, gid_t egid); 341typedef int (*mpo_proc_check_seteuid_t)(struct ucred *cred, uid_t euid); 342typedef int (*mpo_proc_check_setgid_t)(struct ucred *cred, gid_t gid); 343typedef int (*mpo_proc_check_setgroups_t)(struct ucred *cred, int ngroups, 344 gid_t *gidset); 345typedef int (*mpo_proc_check_setregid_t)(struct ucred *cred, gid_t rgid, 346 gid_t egid); 347typedef int (*mpo_proc_check_setresgid_t)(struct ucred *cred, gid_t rgid, 348 gid_t egid, gid_t sgid); 349typedef int (*mpo_proc_check_setresuid_t)(struct ucred *cred, uid_t ruid, 350 uid_t euid, uid_t suid); 351typedef int (*mpo_proc_check_setreuid_t)(struct ucred *cred, uid_t ruid, 352 uid_t euid); 353typedef int (*mpo_proc_check_setuid_t)(struct ucred *cred, uid_t uid); 354typedef int (*mpo_proc_check_signal_t)(struct ucred *cred, 355 struct proc *proc, int signum); 356typedef int (*mpo_proc_check_wait_t)(struct ucred *cred, 357 struct proc *proc); 358typedef void (*mpo_proc_create_init_t)(struct ucred *cred); 359typedef void (*mpo_proc_create_swapper_t)(struct ucred *cred); 360typedef void (*mpo_proc_destroy_label_t)(struct label *label); 361typedef void (*mpo_proc_init_label_t)(struct label *label); 362 363typedef int (*mpo_socket_check_accept_t)(struct ucred *cred, 364 struct socket *so, struct label *solabel); 365typedef int (*mpo_socket_check_bind_t)(struct ucred *cred, 366 struct socket *so, struct label *solabel, 367 struct sockaddr *sa); 368typedef int (*mpo_socket_check_connect_t)(struct ucred *cred, 369 struct socket *so, struct label *solabel, 370 struct sockaddr *sa); 371typedef int (*mpo_socket_check_create_t)(struct ucred *cred, int domain, 372 int type, int protocol); 373typedef int (*mpo_socket_check_deliver_t)(struct socket *so, 374 struct label *solabel, struct mbuf *m, 375 struct label *mlabel); 376typedef int (*mpo_socket_check_listen_t)(struct ucred *cred, 377 struct socket *so, struct label *solabel); 378typedef int (*mpo_socket_check_poll_t)(struct ucred *cred, 379 struct socket *so, struct label *solabel); 380typedef int (*mpo_socket_check_receive_t)(struct ucred *cred, 381 struct socket *so, struct label *solabel); 382typedef int (*mpo_socket_check_relabel_t)(struct ucred *cred, 383 struct socket *so, struct label *solabel, 384 struct label *newlabel); 385typedef int (*mpo_socket_check_send_t)(struct ucred *cred, 386 struct socket *so, struct label *solabel); 387typedef int (*mpo_socket_check_stat_t)(struct ucred *cred, 388 struct socket *so, struct label *solabel); 389typedef int (*mpo_socket_check_visible_t)(struct ucred *cred, 390 struct socket *so, struct label *solabel); 391typedef void (*mpo_socket_copy_label_t)(struct label *src, 392 struct label *dest); 393typedef void (*mpo_socket_create_t)(struct ucred *cred, struct socket *so, 394 struct label *solabel); 395typedef void (*mpo_socket_create_mbuf_t)(struct socket *so, 396 struct label *solabel, struct mbuf *m, 397 struct label *mlabel); 398typedef void (*mpo_socket_destroy_label_t)(struct label *label); 399typedef int (*mpo_socket_externalize_label_t)(struct label *label, 400 char *element_name, struct sbuf *sb, int *claimed); 401typedef int (*mpo_socket_init_label_t)(struct label *label, int flag); 402typedef int (*mpo_socket_internalize_label_t)(struct label *label, 403 char *element_name, char *element_data, int *claimed); 404typedef void (*mpo_socket_newconn_t)(struct socket *oldso, 405 struct label *oldsolabel, struct socket *newso, 406 struct label *newsolabel); 407typedef void (*mpo_socket_relabel_t)(struct ucred *cred, struct socket *so, 408 struct label *oldlabel, struct label *newlabel); 409 410typedef void (*mpo_socketpeer_destroy_label_t)(struct label *label); 411typedef int (*mpo_socketpeer_externalize_label_t)(struct label *label, 412 char *element_name, struct sbuf *sb, int *claimed); 413typedef int (*mpo_socketpeer_init_label_t)(struct label *label, 414 int flag); 415typedef void (*mpo_socketpeer_set_from_mbuf_t)(struct mbuf *m, 416 struct label *mlabel, struct socket *so, 417 struct label *sopeerlabel); 418typedef void (*mpo_socketpeer_set_from_socket_t)(struct socket *oldso, 419 struct label *oldsolabel, struct socket *newso, 420 struct label *newsopeerlabel); 421 422typedef void (*mpo_syncache_create_t)(struct label *label, 423 struct inpcb *inp); 424typedef void (*mpo_syncache_create_mbuf_t)(struct label *sc_label, 425 struct mbuf *m, struct label *mlabel); 426typedef void (*mpo_syncache_destroy_label_t)(struct label *label); 427typedef int (*mpo_syncache_init_label_t)(struct label *label, int flag); 428 429typedef int (*mpo_system_check_acct_t)(struct ucred *cred, 430 struct vnode *vp, struct label *vplabel); 431typedef int (*mpo_system_check_audit_t)(struct ucred *cred, void *record, 432 int length); 433typedef int (*mpo_system_check_auditctl_t)(struct ucred *cred, 434 struct vnode *vp, struct label *vplabel); 435typedef int (*mpo_system_check_auditon_t)(struct ucred *cred, int cmd); 436typedef int (*mpo_system_check_reboot_t)(struct ucred *cred, int howto); 437typedef int (*mpo_system_check_swapon_t)(struct ucred *cred, 438 struct vnode *vp, struct label *vplabel); 439typedef int (*mpo_system_check_swapoff_t)(struct ucred *cred, 440 struct vnode *vp, struct label *vplabel); 441typedef int (*mpo_system_check_sysctl_t)(struct ucred *cred, 442 struct sysctl_oid *oidp, void *arg1, int arg2, 443 struct sysctl_req *req); 444 445typedef void (*mpo_sysvmsg_cleanup_t)(struct label *msglabel); 446typedef void (*mpo_sysvmsg_create_t)(struct ucred *cred, 447 struct msqid_kernel *msqkptr, struct label *msqlabel, 448 struct msg *msgptr, struct label *msglabel); 449typedef void (*mpo_sysvmsg_destroy_label_t)(struct label *label); 450typedef void (*mpo_sysvmsg_init_label_t)(struct label *label); 451 452typedef int (*mpo_sysvmsq_check_msgmsq_t)(struct ucred *cred, 453 struct msg *msgptr, struct label *msglabel, 454 struct msqid_kernel *msqkptr, struct label *msqklabel); 455typedef int (*mpo_sysvmsq_check_msgrcv_t)(struct ucred *cred, 456 struct msg *msgptr, struct label *msglabel); 457typedef int (*mpo_sysvmsq_check_msgrmid_t)(struct ucred *cred, 458 struct msg *msgptr, struct label *msglabel); 459typedef int (*mpo_sysvmsq_check_msqget_t)(struct ucred *cred, 460 struct msqid_kernel *msqkptr, struct label *msqklabel); 461typedef int (*mpo_sysvmsq_check_msqctl_t)(struct ucred *cred, 462 struct msqid_kernel *msqkptr, struct label *msqklabel, 463 int cmd); 464typedef int (*mpo_sysvmsq_check_msqrcv_t)(struct ucred *cred, 465 struct msqid_kernel *msqkptr, struct label *msqklabel); 466typedef int (*mpo_sysvmsq_check_msqsnd_t)(struct ucred *cred, 467 struct msqid_kernel *msqkptr, struct label *msqklabel); 468typedef void (*mpo_sysvmsq_cleanup_t)(struct label *msqlabel); 469typedef void (*mpo_sysvmsq_create_t)(struct ucred *cred, 470 struct msqid_kernel *msqkptr, struct label *msqlabel); 471typedef void (*mpo_sysvmsq_destroy_label_t)(struct label *label); 472typedef void (*mpo_sysvmsq_init_label_t)(struct label *label); 473 474typedef int (*mpo_sysvsem_check_semctl_t)(struct ucred *cred, 475 struct semid_kernel *semakptr, struct label *semaklabel, 476 int cmd); 477typedef int (*mpo_sysvsem_check_semget_t)(struct ucred *cred, 478 struct semid_kernel *semakptr, struct label *semaklabel); 479typedef int (*mpo_sysvsem_check_semop_t)(struct ucred *cred, 480 struct semid_kernel *semakptr, struct label *semaklabel, 481 size_t accesstype); 482typedef void (*mpo_sysvsem_cleanup_t)(struct label *semalabel); 483typedef void (*mpo_sysvsem_create_t)(struct ucred *cred, 484 struct semid_kernel *semakptr, struct label *semalabel); 485typedef void (*mpo_sysvsem_destroy_label_t)(struct label *label); 486typedef void (*mpo_sysvsem_init_label_t)(struct label *label); 487 488typedef int (*mpo_sysvshm_check_shmat_t)(struct ucred *cred, 489 struct shmid_kernel *shmsegptr, 490 struct label *shmseglabel, int shmflg); 491typedef int (*mpo_sysvshm_check_shmctl_t)(struct ucred *cred, 492 struct shmid_kernel *shmsegptr, 493 struct label *shmseglabel, int cmd); 494typedef int (*mpo_sysvshm_check_shmdt_t)(struct ucred *cred, 495 struct shmid_kernel *shmsegptr, 496 struct label *shmseglabel); 497typedef int (*mpo_sysvshm_check_shmget_t)(struct ucred *cred, 498 struct shmid_kernel *shmsegptr, 499 struct label *shmseglabel, int shmflg); 500typedef void (*mpo_sysvshm_cleanup_t)(struct label *shmlabel); 501typedef void (*mpo_sysvshm_create_t)(struct ucred *cred, 502 struct shmid_kernel *shmsegptr, struct label *shmlabel); 503typedef void (*mpo_sysvshm_destroy_label_t)(struct label *label); 504typedef void (*mpo_sysvshm_init_label_t)(struct label *label); 505 506typedef void (*mpo_thread_userret_t)(struct thread *thread); 507 508typedef int (*mpo_vnode_associate_extattr_t)(struct mount *mp, 509 struct label *mplabel, struct vnode *vp, 510 struct label *vplabel); 511typedef void (*mpo_vnode_associate_singlelabel_t)(struct mount *mp, 512 struct label *mplabel, struct vnode *vp, 513 struct label *vplabel); 514typedef int (*mpo_vnode_check_access_t)(struct ucred *cred, 515 struct vnode *vp, struct label *vplabel, int acc_mode); 516typedef int (*mpo_vnode_check_chdir_t)(struct ucred *cred, 517 struct vnode *dvp, struct label *dvplabel); 518typedef int (*mpo_vnode_check_chroot_t)(struct ucred *cred, 519 struct vnode *dvp, struct label *dvplabel); 520typedef int (*mpo_vnode_check_create_t)(struct ucred *cred, 521 struct vnode *dvp, struct label *dvplabel, 522 struct componentname *cnp, struct vattr *vap); 523typedef int (*mpo_vnode_check_deleteacl_t)(struct ucred *cred, 524 struct vnode *vp, struct label *vplabel, 525 acl_type_t type); 526typedef int (*mpo_vnode_check_deleteextattr_t)(struct ucred *cred, 527 struct vnode *vp, struct label *vplabel, 528 int attrnamespace, const char *name); 529typedef int (*mpo_vnode_check_exec_t)(struct ucred *cred, 530 struct vnode *vp, struct label *vplabel, 531 struct image_params *imgp, struct label *execlabel); 532typedef int (*mpo_vnode_check_getacl_t)(struct ucred *cred, 533 struct vnode *vp, struct label *vplabel, 534 acl_type_t type); 535typedef int (*mpo_vnode_check_getextattr_t)(struct ucred *cred, 536 struct vnode *vp, struct label *vplabel, 537 int attrnamespace, const char *name, struct uio *uio); 538typedef int (*mpo_vnode_check_link_t)(struct ucred *cred, 539 struct vnode *dvp, struct label *dvplabel, 540 struct vnode *vp, struct label *vplabel, 541 struct componentname *cnp); 542typedef int (*mpo_vnode_check_listextattr_t)(struct ucred *cred, 543 struct vnode *vp, struct label *vplabel, 544 int attrnamespace); 545typedef int (*mpo_vnode_check_lookup_t)(struct ucred *cred, 546 struct vnode *dvp, struct label *dvplabel, 547 struct componentname *cnp); 548typedef int (*mpo_vnode_check_mmap_t)(struct ucred *cred, 549 struct vnode *vp, struct label *label, int prot, 550 int flags); 551typedef void (*mpo_vnode_check_mmap_downgrade_t)(struct ucred *cred, 552 struct vnode *vp, struct label *vplabel, int *prot); 553typedef int (*mpo_vnode_check_mprotect_t)(struct ucred *cred, 554 struct vnode *vp, struct label *vplabel, int prot); 555typedef int (*mpo_vnode_check_open_t)(struct ucred *cred, 556 struct vnode *vp, struct label *vplabel, int acc_mode); 557typedef int (*mpo_vnode_check_poll_t)(struct ucred *active_cred, 558 struct ucred *file_cred, struct vnode *vp, 559 struct label *vplabel); 560typedef int (*mpo_vnode_check_read_t)(struct ucred *active_cred, 561 struct ucred *file_cred, struct vnode *vp, 562 struct label *vplabel); 563typedef int (*mpo_vnode_check_readdir_t)(struct ucred *cred, 564 struct vnode *dvp, struct label *dvplabel); 565typedef int (*mpo_vnode_check_readlink_t)(struct ucred *cred, 566 struct vnode *vp, struct label *vplabel); 567typedef int (*mpo_vnode_check_relabel_t)(struct ucred *cred, 568 struct vnode *vp, struct label *vplabel, 569 struct label *newlabel); 570typedef int (*mpo_vnode_check_rename_from_t)(struct ucred *cred, 571 struct vnode *dvp, struct label *dvplabel, 572 struct vnode *vp, struct label *vplabel, 573 struct componentname *cnp); 574typedef int (*mpo_vnode_check_rename_to_t)(struct ucred *cred, 575 struct vnode *dvp, struct label *dvplabel, 576 struct vnode *vp, struct label *vplabel, int samedir, 577 struct componentname *cnp); 578typedef int (*mpo_vnode_check_revoke_t)(struct ucred *cred, 579 struct vnode *vp, struct label *vplabel); 580typedef int (*mpo_vnode_check_setacl_t)(struct ucred *cred, 581 struct vnode *vp, struct label *vplabel, acl_type_t type, 582 struct acl *acl); 583typedef int (*mpo_vnode_check_setextattr_t)(struct ucred *cred, 584 struct vnode *vp, struct label *vplabel, 585 int attrnamespace, const char *name, struct uio *uio); 586typedef int (*mpo_vnode_check_setflags_t)(struct ucred *cred, 587 struct vnode *vp, struct label *vplabel, u_long flags); 588typedef int (*mpo_vnode_check_setmode_t)(struct ucred *cred, 589 struct vnode *vp, struct label *vplabel, mode_t mode); 590typedef int (*mpo_vnode_check_setowner_t)(struct ucred *cred, 591 struct vnode *vp, struct label *vplabel, uid_t uid, 592 gid_t gid); 593typedef int (*mpo_vnode_check_setutimes_t)(struct ucred *cred, 594 struct vnode *vp, struct label *vplabel, 595 struct timespec atime, struct timespec mtime); 596typedef int (*mpo_vnode_check_stat_t)(struct ucred *active_cred, 597 struct ucred *file_cred, struct vnode *vp, 598 struct label *vplabel); 599typedef int (*mpo_vnode_check_unlink_t)(struct ucred *cred, 600 struct vnode *dvp, struct label *dvplabel, 601 struct vnode *vp, struct label *vplabel, 602 struct componentname *cnp); 603typedef int (*mpo_vnode_check_write_t)(struct ucred *active_cred, 604 struct ucred *file_cred, struct vnode *vp, 605 struct label *vplabel); 606typedef void (*mpo_vnode_copy_label_t)(struct label *src, 607 struct label *dest); 608typedef int (*mpo_vnode_create_extattr_t)(struct ucred *cred, 609 struct mount *mp, struct label *mplabel, 610 struct vnode *dvp, struct label *dvplabel, 611 struct vnode *vp, struct label *vplabel, 612 struct componentname *cnp); 613typedef void (*mpo_vnode_destroy_label_t)(struct label *label); 614typedef void (*mpo_vnode_execve_transition_t)(struct ucred *old, 615 struct ucred *new, struct vnode *vp, 616 struct label *vplabel, struct label *interpvplabel, 617 struct image_params *imgp, struct label *execlabel); 618typedef int (*mpo_vnode_execve_will_transition_t)(struct ucred *old, 619 struct vnode *vp, struct label *vplabel, 620 struct label *interpvplabel, struct image_params *imgp, 621 struct label *execlabel); 622typedef int (*mpo_vnode_externalize_label_t)(struct label *label, 623 char *element_name, struct sbuf *sb, int *claimed); 624typedef void (*mpo_vnode_init_label_t)(struct label *label); 625typedef int (*mpo_vnode_internalize_label_t)(struct label *label, 626 char *element_name, char *element_data, int *claimed); 627typedef void (*mpo_vnode_relabel_t)(struct ucred *cred, struct vnode *vp, 628 struct label *vplabel, struct label *label); 629typedef int (*mpo_vnode_setlabel_extattr_t)(struct ucred *cred, 630 struct vnode *vp, struct label *vplabel, 631 struct label *intlabel); 632 633struct mac_policy_ops { 634 /* 635 * Policy module operations. 636 */ 637 mpo_destroy_t mpo_destroy; 638 mpo_init_t mpo_init; 639 640 /* 641 * General policy-directed security system call so that policies may 642 * implement new services without reserving explicit system call 643 * numbers. 644 */ 645 mpo_syscall_t mpo_syscall; 646 647 /* 648 * Label operations. Initialize label storage, destroy label 649 * storage, recycle for re-use without init/destroy, copy a label to 650 * initialized storage, and externalize/internalize from/to 651 * initialized storage. 652 */ 653 mpo_bpfdesc_check_receive_t mpo_bpfdesc_check_receive; 654 mpo_bpfdesc_create_t mpo_bpfdesc_create; 655 mpo_bpfdesc_create_mbuf_t mpo_bpfdesc_create_mbuf; 656 mpo_bpfdesc_destroy_label_t mpo_bpfdesc_destroy_label; 657 mpo_bpfdesc_init_label_t mpo_bpfdesc_init_label; 658 659 mpo_cred_check_relabel_t mpo_cred_check_relabel; 660 mpo_cred_check_visible_t mpo_cred_check_visible; 661 mpo_cred_copy_label_t mpo_cred_copy_label; 662 mpo_cred_destroy_label_t mpo_cred_destroy_label; 663 mpo_cred_externalize_label_t mpo_cred_externalize_label; 664 mpo_cred_init_label_t mpo_cred_init_label; 665 mpo_cred_internalize_label_t mpo_cred_internalize_label; 666 mpo_cred_relabel_t mpo_cred_relabel; 667 668 mpo_devfs_create_device_t mpo_devfs_create_device; 669 mpo_devfs_create_directory_t mpo_devfs_create_directory; 670 mpo_devfs_create_symlink_t mpo_devfs_create_symlink; 671 mpo_devfs_destroy_label_t mpo_devfs_destroy_label; 672 mpo_devfs_init_label_t mpo_devfs_init_label; 673 mpo_devfs_update_t mpo_devfs_update; 674 mpo_devfs_vnode_associate_t mpo_devfs_vnode_associate; 675 676 mpo_ifnet_check_relabel_t mpo_ifnet_check_relabel; 677 mpo_ifnet_check_transmit_t mpo_ifnet_check_transmit; 678 mpo_ifnet_copy_label_t mpo_ifnet_copy_label; 679 mpo_ifnet_create_t mpo_ifnet_create; 680 mpo_ifnet_create_mbuf_t mpo_ifnet_create_mbuf; 681 mpo_ifnet_destroy_label_t mpo_ifnet_destroy_label; 682 mpo_ifnet_externalize_label_t mpo_ifnet_externalize_label; 683 mpo_ifnet_init_label_t mpo_ifnet_init_label; 684 mpo_ifnet_internalize_label_t mpo_ifnet_internalize_label; 685 mpo_ifnet_relabel_t mpo_ifnet_relabel; 686 687 mpo_inpcb_check_deliver_t mpo_inpcb_check_deliver; 688 mpo_inpcb_create_t mpo_inpcb_create; 689 mpo_inpcb_create_mbuf_t mpo_inpcb_create_mbuf; 690 mpo_inpcb_destroy_label_t mpo_inpcb_destroy_label; 691 mpo_inpcb_init_label_t mpo_inpcb_init_label; 692 mpo_inpcb_sosetlabel_t mpo_inpcb_sosetlabel; 693 694 mpo_ipq_create_t mpo_ipq_create; 695 mpo_ipq_destroy_label_t mpo_ipq_destroy_label; 696 mpo_ipq_init_label_t mpo_ipq_init_label; 697 mpo_ipq_match_t mpo_ipq_match; 698 mpo_ipq_reassemble mpo_ipq_reassemble; 699 mpo_ipq_update_t mpo_ipq_update; 700 701 mpo_kenv_check_dump_t mpo_kenv_check_dump; 702 mpo_kenv_check_get_t mpo_kenv_check_get; 703 mpo_kenv_check_set_t mpo_kenv_check_set; 704 mpo_kenv_check_unset_t mpo_kenv_check_unset; 705 706 mpo_kld_check_load_t mpo_kld_check_load; 707 mpo_kld_check_stat_t mpo_kld_check_stat; 708 709 mpo_mbuf_copy_label_t mpo_mbuf_copy_label; 710 mpo_mbuf_destroy_label_t mpo_mbuf_destroy_label; 711 mpo_mbuf_init_label_t mpo_mbuf_init_label; 712 713 mpo_mount_check_stat_t mpo_mount_check_stat; 714 mpo_mount_create_t mpo_mount_create; 715 mpo_mount_destroy_label_t mpo_mount_destroy_label; 716 mpo_mount_init_label_t mpo_mount_init_label; 717 718 mpo_netatalk_aarp_send_t mpo_netatalk_aarp_send; 719 720 mpo_netinet_arp_send_t mpo_netinet_arp_send; 721 mpo_netinet_firewall_reply_t mpo_netinet_firewall_reply; 722 mpo_netinet_firewall_send_t mpo_netinet_firewall_send; 723 mpo_netinet_fragment_t mpo_netinet_fragment; 724 mpo_netinet_icmp_reply_t mpo_netinet_icmp_reply; 725 mpo_netinet_icmp_replyinplace_t mpo_netinet_icmp_replyinplace; 726 mpo_netinet_igmp_send_t mpo_netinet_igmp_send; 727 mpo_netinet_tcp_reply_t mpo_netinet_tcp_reply; 728 729 mpo_netinet6_nd6_send_t mpo_netinet6_nd6_send; 730 731 mpo_pipe_check_ioctl_t mpo_pipe_check_ioctl; 732 mpo_pipe_check_poll_t mpo_pipe_check_poll; 733 mpo_pipe_check_read_t mpo_pipe_check_read; 734 mpo_pipe_check_relabel_t mpo_pipe_check_relabel; 735 mpo_pipe_check_stat_t mpo_pipe_check_stat; 736 mpo_pipe_check_write_t mpo_pipe_check_write; 737 mpo_pipe_copy_label_t mpo_pipe_copy_label; 738 mpo_pipe_create_t mpo_pipe_create; 739 mpo_pipe_destroy_label_t mpo_pipe_destroy_label; 740 mpo_pipe_externalize_label_t mpo_pipe_externalize_label; 741 mpo_pipe_init_label_t mpo_pipe_init_label; 742 mpo_pipe_internalize_label_t mpo_pipe_internalize_label; 743 mpo_pipe_relabel_t mpo_pipe_relabel; 744 745 mpo_posixsem_check_destroy_t mpo_posixsem_check_destroy; 746 mpo_posixsem_check_getvalue_t mpo_posixsem_check_getvalue; 747 mpo_posixsem_check_open_t mpo_posixsem_check_open; 748 mpo_posixsem_check_post_t mpo_posixsem_check_post; 749 mpo_posixsem_check_unlink_t mpo_posixsem_check_unlink; 750 mpo_posixsem_check_wait_t mpo_posixsem_check_wait; 751 mpo_posixsem_create_t mpo_posixsem_create; 752 mpo_posixsem_destroy_label_t mpo_posixsem_destroy_label; 753 mpo_posixsem_init_label_t mpo_posixsem_init_label; 754 755 mpo_posixshm_check_mmap_t mpo_posixshm_check_mmap; 756 mpo_posixshm_check_open_t mpo_posixshm_check_open; 757 mpo_posixshm_check_stat_t mpo_posixshm_check_stat; 758 mpo_posixshm_check_truncate_t mpo_posixshm_check_truncate; 759 mpo_posixshm_check_unlink_t mpo_posixshm_check_unlink; 760 mpo_posixshm_create_t mpo_posixshm_create; 761 mpo_posixshm_destroy_label_t mpo_posixshm_destroy_label; 762 mpo_posixshm_init_label_t mpo_posixshm_init_label; 763 764 mpo_priv_check_t mpo_priv_check; 765 mpo_priv_grant_t mpo_priv_grant; 766 767 mpo_proc_associate_nfsd_t mpo_proc_associate_nfsd; 768 mpo_proc_check_debug_t mpo_proc_check_debug; 769 mpo_proc_check_sched_t mpo_proc_check_sched; 770 mpo_proc_check_setaudit_t mpo_proc_check_setaudit; 771 mpo_proc_check_setaudit_addr_t mpo_proc_check_setaudit_addr; 772 mpo_proc_check_setauid_t mpo_proc_check_setauid; 773 mpo_proc_check_setuid_t mpo_proc_check_setuid; 774 mpo_proc_check_seteuid_t mpo_proc_check_seteuid; 775 mpo_proc_check_setgid_t mpo_proc_check_setgid; 776 mpo_proc_check_setegid_t mpo_proc_check_setegid; 777 mpo_proc_check_setgroups_t mpo_proc_check_setgroups; 778 mpo_proc_check_setreuid_t mpo_proc_check_setreuid; 779 mpo_proc_check_setregid_t mpo_proc_check_setregid; 780 mpo_proc_check_setresuid_t mpo_proc_check_setresuid; 781 mpo_proc_check_setresgid_t mpo_proc_check_setresgid; 782 mpo_proc_check_signal_t mpo_proc_check_signal; 783 mpo_proc_check_wait_t mpo_proc_check_wait; 784 mpo_proc_create_swapper_t mpo_proc_create_swapper; 785 mpo_proc_create_init_t mpo_proc_create_init; 786 mpo_proc_destroy_label_t mpo_proc_destroy_label; 787 mpo_proc_init_label_t mpo_proc_init_label; 788 789 mpo_socket_check_accept_t mpo_socket_check_accept; 790 mpo_socket_check_bind_t mpo_socket_check_bind; 791 mpo_socket_check_connect_t mpo_socket_check_connect; 792 mpo_socket_check_create_t mpo_socket_check_create; 793 mpo_socket_check_deliver_t mpo_socket_check_deliver; 794 mpo_socket_check_listen_t mpo_socket_check_listen; 795 mpo_socket_check_poll_t mpo_socket_check_poll; 796 mpo_socket_check_receive_t mpo_socket_check_receive; 797 mpo_socket_check_relabel_t mpo_socket_check_relabel; 798 mpo_socket_check_send_t mpo_socket_check_send; 799 mpo_socket_check_stat_t mpo_socket_check_stat; 800 mpo_socket_check_visible_t mpo_socket_check_visible; 801 mpo_socket_copy_label_t mpo_socket_copy_label; 802 mpo_socket_create_t mpo_socket_create; 803 mpo_socket_create_mbuf_t mpo_socket_create_mbuf; 804 mpo_socket_destroy_label_t mpo_socket_destroy_label; 805 mpo_socket_externalize_label_t mpo_socket_externalize_label; 806 mpo_socket_init_label_t mpo_socket_init_label; 807 mpo_socket_internalize_label_t mpo_socket_internalize_label; 808 mpo_socket_newconn_t mpo_socket_newconn; 809 mpo_socket_relabel_t mpo_socket_relabel; 810 811 mpo_socketpeer_destroy_label_t mpo_socketpeer_destroy_label; 812 mpo_socketpeer_externalize_label_t mpo_socketpeer_externalize_label; 813 mpo_socketpeer_init_label_t mpo_socketpeer_init_label; 814 mpo_socketpeer_set_from_mbuf_t mpo_socketpeer_set_from_mbuf; 815 mpo_socketpeer_set_from_socket_t mpo_socketpeer_set_from_socket; 816 817 mpo_syncache_init_label_t mpo_syncache_init_label; 818 mpo_syncache_destroy_label_t mpo_syncache_destroy_label; 819 mpo_syncache_create_t mpo_syncache_create; 820 mpo_syncache_create_mbuf_t mpo_syncache_create_mbuf; 821 822 mpo_system_check_acct_t mpo_system_check_acct; 823 mpo_system_check_audit_t mpo_system_check_audit; 824 mpo_system_check_auditctl_t mpo_system_check_auditctl; 825 mpo_system_check_auditon_t mpo_system_check_auditon; 826 mpo_system_check_reboot_t mpo_system_check_reboot; 827 mpo_system_check_swapon_t mpo_system_check_swapon; 828 mpo_system_check_swapoff_t mpo_system_check_swapoff; 829 mpo_system_check_sysctl_t mpo_system_check_sysctl; 830 831 mpo_sysvmsg_cleanup_t mpo_sysvmsg_cleanup; 832 mpo_sysvmsg_create_t mpo_sysvmsg_create; 833 mpo_sysvmsg_destroy_label_t mpo_sysvmsg_destroy_label; 834 mpo_sysvmsg_init_label_t mpo_sysvmsg_init_label; 835 836 mpo_sysvmsq_check_msgmsq_t mpo_sysvmsq_check_msgmsq; 837 mpo_sysvmsq_check_msgrcv_t mpo_sysvmsq_check_msgrcv; 838 mpo_sysvmsq_check_msgrmid_t mpo_sysvmsq_check_msgrmid; 839 mpo_sysvmsq_check_msqctl_t mpo_sysvmsq_check_msqctl; 840 mpo_sysvmsq_check_msqget_t mpo_sysvmsq_check_msqget; 841 mpo_sysvmsq_check_msqrcv_t mpo_sysvmsq_check_msqrcv; 842 mpo_sysvmsq_check_msqsnd_t mpo_sysvmsq_check_msqsnd; 843 mpo_sysvmsq_cleanup_t mpo_sysvmsq_cleanup; 844 mpo_sysvmsq_create_t mpo_sysvmsq_create; 845 mpo_sysvmsq_destroy_label_t mpo_sysvmsq_destroy_label; 846 mpo_sysvmsq_init_label_t mpo_sysvmsq_init_label; 847 848 mpo_sysvsem_check_semctl_t mpo_sysvsem_check_semctl; 849 mpo_sysvsem_check_semget_t mpo_sysvsem_check_semget; 850 mpo_sysvsem_check_semop_t mpo_sysvsem_check_semop; 851 mpo_sysvsem_cleanup_t mpo_sysvsem_cleanup; 852 mpo_sysvsem_create_t mpo_sysvsem_create; 853 mpo_sysvsem_destroy_label_t mpo_sysvsem_destroy_label; 854 mpo_sysvsem_init_label_t mpo_sysvsem_init_label; 855 856 mpo_sysvshm_check_shmat_t mpo_sysvshm_check_shmat; 857 mpo_sysvshm_check_shmctl_t mpo_sysvshm_check_shmctl; 858 mpo_sysvshm_check_shmdt_t mpo_sysvshm_check_shmdt; 859 mpo_sysvshm_check_shmget_t mpo_sysvshm_check_shmget; 860 mpo_sysvshm_cleanup_t mpo_sysvshm_cleanup; 861 mpo_sysvshm_create_t mpo_sysvshm_create; 862 mpo_sysvshm_destroy_label_t mpo_sysvshm_destroy_label; 863 mpo_sysvshm_init_label_t mpo_sysvshm_init_label; 864 865 mpo_thread_userret_t mpo_thread_userret; 866 867 mpo_vnode_check_access_t mpo_vnode_check_access; 868 mpo_vnode_check_chdir_t mpo_vnode_check_chdir; 869 mpo_vnode_check_chroot_t mpo_vnode_check_chroot; 870 mpo_vnode_check_create_t mpo_vnode_check_create; 871 mpo_vnode_check_deleteacl_t mpo_vnode_check_deleteacl; 872 mpo_vnode_check_deleteextattr_t mpo_vnode_check_deleteextattr; 873 mpo_vnode_check_exec_t mpo_vnode_check_exec; 874 mpo_vnode_check_getacl_t mpo_vnode_check_getacl; 875 mpo_vnode_check_getextattr_t mpo_vnode_check_getextattr; 876 mpo_vnode_check_link_t mpo_vnode_check_link; 877 mpo_vnode_check_listextattr_t mpo_vnode_check_listextattr; 878 mpo_vnode_check_lookup_t mpo_vnode_check_lookup; 879 mpo_vnode_check_mmap_t mpo_vnode_check_mmap; 880 mpo_vnode_check_mmap_downgrade_t mpo_vnode_check_mmap_downgrade; 881 mpo_vnode_check_mprotect_t mpo_vnode_check_mprotect; 882 mpo_vnode_check_open_t mpo_vnode_check_open; 883 mpo_vnode_check_poll_t mpo_vnode_check_poll; 884 mpo_vnode_check_read_t mpo_vnode_check_read; 885 mpo_vnode_check_readdir_t mpo_vnode_check_readdir; 886 mpo_vnode_check_readlink_t mpo_vnode_check_readlink; 887 mpo_vnode_check_relabel_t mpo_vnode_check_relabel; 888 mpo_vnode_check_rename_from_t mpo_vnode_check_rename_from; 889 mpo_vnode_check_rename_to_t mpo_vnode_check_rename_to; 890 mpo_vnode_check_revoke_t mpo_vnode_check_revoke; 891 mpo_vnode_check_setacl_t mpo_vnode_check_setacl; 892 mpo_vnode_check_setextattr_t mpo_vnode_check_setextattr; 893 mpo_vnode_check_setflags_t mpo_vnode_check_setflags; 894 mpo_vnode_check_setmode_t mpo_vnode_check_setmode; 895 mpo_vnode_check_setowner_t mpo_vnode_check_setowner; 896 mpo_vnode_check_setutimes_t mpo_vnode_check_setutimes; 897 mpo_vnode_check_stat_t mpo_vnode_check_stat; 898 mpo_vnode_check_unlink_t mpo_vnode_check_unlink; 899 mpo_vnode_check_write_t mpo_vnode_check_write; 900 mpo_vnode_associate_extattr_t mpo_vnode_associate_extattr; 901 mpo_vnode_associate_singlelabel_t mpo_vnode_associate_singlelabel; 902 mpo_vnode_destroy_label_t mpo_vnode_destroy_label; 903 mpo_vnode_copy_label_t mpo_vnode_copy_label; 904 mpo_vnode_create_extattr_t mpo_vnode_create_extattr; 905 mpo_vnode_execve_transition_t mpo_vnode_execve_transition; 906 mpo_vnode_execve_will_transition_t mpo_vnode_execve_will_transition; 907 mpo_vnode_externalize_label_t mpo_vnode_externalize_label; 908 mpo_vnode_init_label_t mpo_vnode_init_label; 909 mpo_vnode_internalize_label_t mpo_vnode_internalize_label; 910 mpo_vnode_relabel_t mpo_vnode_relabel; 911 mpo_vnode_setlabel_extattr_t mpo_vnode_setlabel_extattr; 912}; 913 914/* 915 * struct mac_policy_conf is the registration structure for policies, and is 916 * provided to the MAC Framework using MAC_POLICY_SET() to invoke a SYSINIT 917 * to register the policy. In general, the fields are immutable, with the 918 * exception of the "security field", run-time flags, and policy list entry, 919 * which are managed by the MAC Framework. Be careful when modifying this 920 * structure, as its layout is statically compiled into all policies. 921 */ 922struct mac_policy_conf { 923 char *mpc_name; /* policy name */ 924 char *mpc_fullname; /* policy full name */ 925 struct mac_policy_ops *mpc_ops; /* policy operations */ 926 int mpc_loadtime_flags; /* flags */ 927 int *mpc_field_off; /* security field */ 928 int mpc_runtime_flags; /* flags */ 929 LIST_ENTRY(mac_policy_conf) mpc_list; /* global list */ 930}; 931 932/* Flags for the mpc_loadtime_flags field. */ 933#define MPC_LOADTIME_FLAG_NOTLATE 0x00000001 934#define MPC_LOADTIME_FLAG_UNLOADOK 0x00000002 935#define MPC_LOADTIME_FLAG_LABELMBUFS 0x00000004 936 937/* Flags for the mpc_runtime_flags field. */ 938#define MPC_RUNTIME_FLAG_REGISTERED 0x00000001 939 940/*- 941 * The TrustedBSD MAC Framework has a major version number, MAC_VERSION, 942 * which defines the ABI of the Framework present in the kernel (and depended 943 * on by policy modules compiled against that kernel). Currently, 944 * MAC_POLICY_SET() requires that the kernel and module ABI version numbers 945 * exactly match. The following major versions have been defined to date: 946 * 947 * MAC version FreeBSD versions 948 * 1 5.x 949 * 2 6.x 950 * 3 7.x 951 * 4 8.x 952 */ 953#define MAC_VERSION 4 954 955#define MAC_POLICY_SET(mpops, mpname, mpfullname, mpflags, privdata_wanted) \ 956 static struct mac_policy_conf mpname##_mac_policy_conf = { \ 957 #mpname, \ 958 mpfullname, \ 959 mpops, \ 960 mpflags, \ 961 privdata_wanted, \ 962 0, \ 963 }; \ 964 static moduledata_t mpname##_mod = { \ 965 #mpname, \ 966 mac_policy_modevent, \ 967 &mpname##_mac_policy_conf \ 968 }; \ 969 MODULE_DEPEND(mpname, kernel_mac_support, MAC_VERSION, \ 970 MAC_VERSION, MAC_VERSION); \ 971 DECLARE_MODULE(mpname, mpname##_mod, SI_SUB_MAC_POLICY, \ 972 SI_ORDER_MIDDLE) 973 974int mac_policy_modevent(module_t mod, int type, void *data); 975 976/* 977 * Policy interface to map a struct label pointer to per-policy data. 978 * Typically, policies wrap this in their own accessor macro that casts a 979 * uintptr_t to a policy-specific data type. 980 */ 981intptr_t mac_label_get(struct label *l, int slot); 982void mac_label_set(struct label *l, int slot, intptr_t v); 983 984#endif /* !_SYS_SECURITY_MAC_MAC_POLICY_H_ */ 985