mac_process.c revision 101308
1100894Srwatson/*- 2100894Srwatson * Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson 3100894Srwatson * Copyright (c) 2001 Ilmar S. Habibulin 4100894Srwatson * Copyright (c) 2001, 2002 Networks Associates Technology, Inc. 5100894Srwatson * All rights reserved. 6100894Srwatson * 7100894Srwatson * This software was developed by Robert Watson and Ilmar Habibulin for the 8100894Srwatson * TrustedBSD Project. 9100894Srwatson * 10100894Srwatson * This software was developed for the FreeBSD Project in part by NAI Labs, 11100894Srwatson * the Security Research Division of Network Associates, Inc. under 12100894Srwatson * DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA 13100894Srwatson * CHATS research program. 14100894Srwatson * 15100894Srwatson * Redistribution and use in source and binary forms, with or without 16100894Srwatson * modification, are permitted provided that the following conditions 17100894Srwatson * are met: 18100894Srwatson * 1. Redistributions of source code must retain the above copyright 19100894Srwatson * notice, this list of conditions and the following disclaimer. 20100894Srwatson * 2. Redistributions in binary form must reproduce the above copyright 21100894Srwatson * notice, this list of conditions and the following disclaimer in the 22100894Srwatson * documentation and/or other materials provided with the distribution. 23100894Srwatson * 3. The names of the authors may not be used to endorse or promote 24100894Srwatson * products derived from this software without specific prior written 25100894Srwatson * permission. 26100894Srwatson * 27100894Srwatson * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 28100894Srwatson * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 29100894Srwatson * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 30100894Srwatson * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 31100894Srwatson * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 32100894Srwatson * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 33100894Srwatson * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 34100894Srwatson * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 35100894Srwatson * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 36100894Srwatson * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 37100894Srwatson * SUCH DAMAGE. 38100894Srwatson * 39100894Srwatson * $FreeBSD: head/sys/security/mac/mac_process.c 101308 2002-08-04 10:29:36Z jeff $ 40100894Srwatson */ 41100894Srwatson/* 42100894Srwatson * Developed by the TrustedBSD Project. 43100894Srwatson * 44100894Srwatson * Framework for extensible kernel access control. Kernel and userland 45100894Srwatson * interface to the framework, policy registration and composition. 46100894Srwatson */ 47100894Srwatson 48100894Srwatson#include "opt_mac.h" 49101173Srwatson 50100894Srwatson#include <sys/param.h> 51100979Srwatson#include <sys/extattr.h> 52100979Srwatson#include <sys/kernel.h> 53100979Srwatson#include <sys/lock.h> 54100979Srwatson#include <sys/mutex.h> 55100979Srwatson#include <sys/sx.h> 56100979Srwatson#include <sys/mac.h> 57100979Srwatson#include <sys/proc.h> 58100979Srwatson#include <sys/systm.h> 59100894Srwatson#include <sys/sysproto.h> 60100894Srwatson#include <sys/sysent.h> 61100979Srwatson#include <sys/vnode.h> 62100979Srwatson#include <sys/mount.h> 63100979Srwatson#include <sys/file.h> 64100979Srwatson#include <sys/namei.h> 65100979Srwatson#include <sys/socket.h> 66100979Srwatson#include <sys/pipe.h> 67100979Srwatson#include <sys/socketvar.h> 68100979Srwatson#include <sys/sx.h> 69100979Srwatson#include <sys/sysctl.h> 70100894Srwatson 71100979Srwatson#include <vm/vm.h> 72100979Srwatson#include <vm/pmap.h> 73100979Srwatson#include <vm/vm_map.h> 74100979Srwatson#include <vm/vm_object.h> 75100979Srwatson 76100979Srwatson#include <sys/mac_policy.h> 77100979Srwatson 78100979Srwatson#include <fs/devfs/devfs.h> 79100979Srwatson 80100979Srwatson#include <net/bpf.h> 81100979Srwatson#include <net/bpfdesc.h> 82100979Srwatson#include <net/if.h> 83100979Srwatson#include <net/if_var.h> 84100979Srwatson 85100979Srwatson#include <netinet/in.h> 86100979Srwatson#include <netinet/ip_var.h> 87100979Srwatson 88100979Srwatson#ifdef MAC 89100979Srwatson 90100979SrwatsonSYSCTL_DECL(_security); 91100979Srwatson 92100979SrwatsonSYSCTL_NODE(_security, OID_AUTO, mac, CTLFLAG_RW, 0, 93100979Srwatson "TrustedBSD MAC policy controls"); 94100979SrwatsonSYSCTL_NODE(_security_mac, OID_AUTO, debug, CTLFLAG_RW, 0, 95100979Srwatson "TrustedBSD MAC debug info"); 96100979Srwatson 97100979Srwatsonstatic int mac_debug_label_fallback = 0; 98100979SrwatsonSYSCTL_INT(_security_mac_debug, OID_AUTO, label_fallback, CTLFLAG_RW, 99100979Srwatson &mac_debug_label_fallback, 0, "Filesystems should fall back to fs label" 100100979Srwatson "when label is corrupted."); 101100979SrwatsonTUNABLE_INT("security.mac.debug_label_fallback", 102100979Srwatson &mac_debug_label_fallback); 103100979Srwatson 104100979Srwatson#ifndef MAC_MAX_POLICIES 105100979Srwatson#define MAC_MAX_POLICIES 8 106100979Srwatson#endif 107100979Srwatson#if MAC_MAX_POLICIES > 32 108100979Srwatson#error "MAC_MAX_POLICIES too large" 109100979Srwatson#endif 110100979Srwatsonstatic unsigned int mac_max_policies = MAC_MAX_POLICIES; 111100979Srwatsonstatic unsigned int mac_policy_offsets_free = (1 << MAC_MAX_POLICIES) - 1; 112100979SrwatsonSYSCTL_UINT(_security_mac, OID_AUTO, max_policies, CTLFLAG_RD, 113100979Srwatson &mac_max_policies, 0, ""); 114100979Srwatson 115100979Srwatsonstatic int mac_late = 0; 116100979Srwatson 117100979Srwatsonstatic int mac_enforce_fs = 1; 118100979SrwatsonSYSCTL_INT(_security_mac, OID_AUTO, enforce_fs, CTLFLAG_RW, 119100979Srwatson &mac_enforce_fs, 0, "Enforce MAC policy on file system objects"); 120100979SrwatsonTUNABLE_INT("security.mac.enforce_fs", &mac_enforce_fs); 121100979Srwatson 122100979Srwatsonstatic int mac_enforce_network = 1; 123100979SrwatsonSYSCTL_INT(_security_mac, OID_AUTO, enforce_network, CTLFLAG_RW, 124100979Srwatson &mac_enforce_network, 0, "Enforce MAC policy on network packets"); 125100979SrwatsonTUNABLE_INT("security.mac.enforce_network", &mac_enforce_network); 126100979Srwatson 127100979Srwatsonstatic int mac_enforce_process = 1; 128100979SrwatsonSYSCTL_INT(_security_mac, OID_AUTO, enforce_process, CTLFLAG_RW, 129100979Srwatson &mac_enforce_process, 0, "Enforce MAC policy on inter-process operations"); 130100979SrwatsonTUNABLE_INT("security.mac.enforce_process", &mac_enforce_process); 131100979Srwatson 132100979Srwatsonstatic int mac_enforce_socket = 1; 133100979SrwatsonSYSCTL_INT(_security_mac, OID_AUTO, enforce_socket, CTLFLAG_RW, 134100979Srwatson &mac_enforce_socket, 0, "Enforce MAC policy on socket operations"); 135100979SrwatsonTUNABLE_INT("security.mac.enforce_socket", &mac_enforce_socket); 136100979Srwatson 137100979Srwatsonstatic int mac_enforce_pipe = 1; 138100979SrwatsonSYSCTL_INT(_security_mac, OID_AUTO, enforce_pipe, CTLFLAG_RW, 139100979Srwatson &mac_enforce_pipe, 0, "Enforce MAC policy on pipe operations"); 140100979Srwatson 141100979Srwatsonstatic int mac_label_size = sizeof(struct mac); 142100979SrwatsonSYSCTL_INT(_security_mac, OID_AUTO, label_size, CTLFLAG_RD, 143100979Srwatson &mac_label_size, 0, "Pre-compiled MAC label size"); 144100979Srwatson 145100979Srwatsonstatic int mac_cache_fslabel_in_vnode = 1; 146100979SrwatsonSYSCTL_INT(_security_mac, OID_AUTO, cache_fslabel_in_vnode, CTLFLAG_RW, 147100979Srwatson &mac_cache_fslabel_in_vnode, 0, "Cache mount fslabel in vnode"); 148100979SrwatsonTUNABLE_INT("security.mac.cache_fslabel_in_vnode", 149100979Srwatson &mac_cache_fslabel_in_vnode); 150100979Srwatson 151100979Srwatsonstatic int mac_vnode_label_cache_hits = 0; 152100979SrwatsonSYSCTL_INT(_security_mac, OID_AUTO, vnode_label_cache_hits, CTLFLAG_RD, 153100979Srwatson &mac_vnode_label_cache_hits, 0, "Cache hits on vnode labels"); 154100979Srwatsonstatic int mac_vnode_label_cache_misses = 0; 155100979SrwatsonSYSCTL_INT(_security_mac, OID_AUTO, vnode_label_cache_misses, CTLFLAG_RD, 156100979Srwatson &mac_vnode_label_cache_misses, 0, "Cache misses on vnode labels"); 157100979Srwatsonstatic int mac_mmap_revocation_via_cow = 1; 158100979SrwatsonSYSCTL_INT(_security_mac, OID_AUTO, mmap_revocation_via_cow, CTLFLAG_RW, 159100979Srwatson &mac_mmap_revocation_via_cow, 0, "Revoke mmap access to files via " 160100979Srwatson "copy-on-write semantics, or by removing all write access"); 161100979Srwatson 162100979Srwatsonstatic unsigned int nmacmbufs, nmaccreds, nmacifnets, nmacbpfdescs, 163100979Srwatson nmacsockets, nmacmounts, nmactemp, nmacvnodes, nmacdevfsdirents, 164100979Srwatson nmacipqs, nmacpipes; 165100979SrwatsonSYSCTL_UINT(_security_mac_debug, OID_AUTO, mbufs, CTLFLAG_RD, 166100979Srwatson &nmacmbufs, 0, "number of mbufs in use"); 167100979SrwatsonSYSCTL_UINT(_security_mac_debug, OID_AUTO, creds, CTLFLAG_RD, 168100979Srwatson &nmaccreds, 0, "number of ucreds in use"); 169100979SrwatsonSYSCTL_UINT(_security_mac_debug, OID_AUTO, ifnets, CTLFLAG_RD, 170100979Srwatson &nmacifnets, 0, "number of ifnets in use"); 171100979SrwatsonSYSCTL_UINT(_security_mac_debug, OID_AUTO, ipqs, CTLFLAG_RD, 172100979Srwatson &nmacipqs, 0, "number of ipqs in use"); 173100979SrwatsonSYSCTL_UINT(_security_mac_debug, OID_AUTO, bpfdescs, CTLFLAG_RD, 174100979Srwatson &nmacbpfdescs, 0, "number of bpfdescs in use"); 175100979SrwatsonSYSCTL_UINT(_security_mac_debug, OID_AUTO, sockets, CTLFLAG_RD, 176100979Srwatson &nmacsockets, 0, "number of sockets in use"); 177100979SrwatsonSYSCTL_UINT(_security_mac_debug, OID_AUTO, pipes, CTLFLAG_RD, 178100979Srwatson &nmacpipes, 0, "number of pipes in use"); 179100979SrwatsonSYSCTL_UINT(_security_mac_debug, OID_AUTO, mounts, CTLFLAG_RD, 180100979Srwatson &nmacmounts, 0, "number of mounts in use"); 181100979SrwatsonSYSCTL_UINT(_security_mac_debug, OID_AUTO, temp, CTLFLAG_RD, 182100979Srwatson &nmactemp, 0, "number of temporary labels in use"); 183100979SrwatsonSYSCTL_UINT(_security_mac_debug, OID_AUTO, vnodes, CTLFLAG_RD, 184100979Srwatson &nmacvnodes, 0, "number of vnodes in use"); 185100979SrwatsonSYSCTL_UINT(_security_mac_debug, OID_AUTO, devfsdirents, CTLFLAG_RD, 186100979Srwatson &nmacdevfsdirents, 0, "number of devfs dirents inuse"); 187100979Srwatson 188100979Srwatsonstatic int error_select(int error1, int error2); 189100979Srwatsonstatic int mac_externalize(struct label *label, struct mac *mac); 190100979Srwatsonstatic int mac_policy_register(struct mac_policy_conf *mpc); 191100979Srwatsonstatic int mac_policy_unregister(struct mac_policy_conf *mpc); 192100979Srwatson 193100979Srwatsonstatic int mac_stdcreatevnode_ea(struct vnode *vp); 194100979Srwatsonstatic void mac_cred_mmapped_drop_perms(struct thread *td, 195100979Srwatson struct ucred *cred); 196100979Srwatsonstatic void mac_cred_mmapped_drop_perms_recurse(struct thread *td, 197100979Srwatson struct ucred *cred, struct vm_map *map); 198100979Srwatson 199100979SrwatsonMALLOC_DEFINE(M_MACOPVEC, "macopvec", "MAC policy operation vector"); 200100979SrwatsonMALLOC_DEFINE(M_MACPIPELABEL, "macpipelabel", "MAC labels for pipes"); 201100979Srwatson 202100979Srwatson/* 203100979Srwatson * mac_policy_list_lock protects the consistency of 'mac_policy_list', 204100979Srwatson * the linked list of attached policy modules. Read-only consumers of 205100979Srwatson * the list must acquire a shared lock for the duration of their use; 206100979Srwatson * writers must acquire an exclusive lock. Note that for compound 207100979Srwatson * operations, locks should be held for the entire compound operation, 208100979Srwatson * and that this is not yet done for relabel requests. 209100979Srwatson */ 210100979Srwatsonstatic struct mtx mac_policy_list_lock; 211100979Srwatsonstatic LIST_HEAD(, mac_policy_conf) mac_policy_list; 212100979Srwatsonstatic int mac_policy_list_busy; 213100979Srwatson#define MAC_POLICY_LIST_LOCKINIT() mtx_init(&mac_policy_list_lock, \ 214100979Srwatson "mac_policy_list_lock", NULL, MTX_DEF); 215100979Srwatson#define MAC_POLICY_LIST_LOCK() mtx_lock(&mac_policy_list_lock); 216100979Srwatson#define MAC_POLICY_LIST_UNLOCK() mtx_unlock(&mac_policy_list_lock); 217100979Srwatson 218100979Srwatson#define MAC_POLICY_LIST_BUSY() do { \ 219100979Srwatson MAC_POLICY_LIST_LOCK(); \ 220100979Srwatson mac_policy_list_busy++; \ 221100979Srwatson MAC_POLICY_LIST_UNLOCK(); \ 222100979Srwatson} while (0) 223100979Srwatson 224100979Srwatson#define MAC_POLICY_LIST_UNBUSY() do { \ 225100979Srwatson MAC_POLICY_LIST_LOCK(); \ 226100979Srwatson mac_policy_list_busy--; \ 227100979Srwatson if (mac_policy_list_busy < 0) \ 228100979Srwatson panic("Extra mac_policy_list_busy--"); \ 229100979Srwatson MAC_POLICY_LIST_UNLOCK(); \ 230100979Srwatson} while (0) 231100979Srwatson 232100979Srwatson/* 233100979Srwatson * MAC_CHECK performs the designated check by walking the policy 234100979Srwatson * module list and checking with each as to how it feels about the 235100979Srwatson * request. Note that it returns its value via 'error' in the scope 236100979Srwatson * of the caller. 237100979Srwatson */ 238100979Srwatson#define MAC_CHECK(check, args...) do { \ 239100979Srwatson struct mac_policy_conf *mpc; \ 240100979Srwatson \ 241100979Srwatson error = 0; \ 242100979Srwatson MAC_POLICY_LIST_BUSY(); \ 243100979Srwatson LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { \ 244100979Srwatson if (mpc->mpc_ops->mpo_ ## check != NULL) \ 245100979Srwatson error = error_select( \ 246100979Srwatson mpc->mpc_ops->mpo_ ## check (args), \ 247100979Srwatson error); \ 248100979Srwatson } \ 249100979Srwatson MAC_POLICY_LIST_UNBUSY(); \ 250100979Srwatson} while (0) 251100979Srwatson 252100979Srwatson/* 253100979Srwatson * MAC_BOOLEAN performs the designated boolean composition by walking 254100979Srwatson * the module list, invoking each instance of the operation, and 255100979Srwatson * combining the results using the passed C operator. Note that it 256100979Srwatson * returns its value via 'result' in the scope of the caller, which 257100979Srwatson * should be initialized by the caller in a meaningful way to get 258100979Srwatson * a meaningful result. 259100979Srwatson */ 260100979Srwatson#define MAC_BOOLEAN(operation, composition, args...) do { \ 261100979Srwatson struct mac_policy_conf *mpc; \ 262100979Srwatson \ 263100979Srwatson MAC_POLICY_LIST_BUSY(); \ 264100979Srwatson LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { \ 265100979Srwatson if (mpc->mpc_ops->mpo_ ## operation != NULL) \ 266100979Srwatson result = result composition \ 267100979Srwatson mpc->mpc_ops->mpo_ ## operation (args); \ 268100979Srwatson } \ 269100979Srwatson MAC_POLICY_LIST_UNBUSY(); \ 270100979Srwatson} while (0) 271100979Srwatson 272100979Srwatson/* 273100979Srwatson * MAC_PERFORM performs the designated operation by walking the policy 274100979Srwatson * module list and invoking that operation for each policy. 275100979Srwatson */ 276100979Srwatson#define MAC_PERFORM(operation, args...) do { \ 277100979Srwatson struct mac_policy_conf *mpc; \ 278100979Srwatson \ 279100979Srwatson MAC_POLICY_LIST_BUSY(); \ 280100979Srwatson LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { \ 281100979Srwatson if (mpc->mpc_ops->mpo_ ## operation != NULL) \ 282100979Srwatson mpc->mpc_ops->mpo_ ## operation (args); \ 283100979Srwatson } \ 284100979Srwatson MAC_POLICY_LIST_UNBUSY(); \ 285100979Srwatson} while (0) 286100979Srwatson 287100979Srwatson/* 288100979Srwatson * Initialize the MAC subsystem, including appropriate SMP locks. 289100979Srwatson */ 290100979Srwatsonstatic void 291100979Srwatsonmac_init(void) 292100979Srwatson{ 293100979Srwatson 294100979Srwatson LIST_INIT(&mac_policy_list); 295100979Srwatson MAC_POLICY_LIST_LOCKINIT(); 296100979Srwatson} 297100979Srwatson 298100979Srwatson/* 299100979Srwatson * For the purposes of modules that want to know if they were loaded 300100979Srwatson * "early", set the mac_late flag once we've processed modules either 301100979Srwatson * linked into the kernel, or loaded before the kernel startup. 302100979Srwatson */ 303100979Srwatsonstatic void 304100979Srwatsonmac_late_init(void) 305100979Srwatson{ 306100979Srwatson 307100979Srwatson mac_late = 1; 308100979Srwatson} 309100979Srwatson 310100979Srwatson/* 311100979Srwatson * Allow MAC policy modules to register during boot, etc. 312100979Srwatson */ 313100894Srwatsonint 314100979Srwatsonmac_policy_modevent(module_t mod, int type, void *data) 315100979Srwatson{ 316100979Srwatson struct mac_policy_conf *mpc; 317100979Srwatson int error; 318100979Srwatson 319100979Srwatson error = 0; 320100979Srwatson mpc = (struct mac_policy_conf *) data; 321100979Srwatson 322100979Srwatson switch (type) { 323100979Srwatson case MOD_LOAD: 324100979Srwatson if (mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_NOTLATE && 325100979Srwatson mac_late) { 326100979Srwatson printf("mac_policy_modevent: can't load %s policy " 327100979Srwatson "after booting\n", mpc->mpc_name); 328100979Srwatson error = EBUSY; 329100979Srwatson break; 330100979Srwatson } 331100979Srwatson error = mac_policy_register(mpc); 332100979Srwatson break; 333100979Srwatson case MOD_UNLOAD: 334100979Srwatson /* Don't unregister the module if it was never registered. */ 335100979Srwatson if ((mpc->mpc_runtime_flags & MPC_RUNTIME_FLAG_REGISTERED) 336100979Srwatson != 0) 337100979Srwatson error = mac_policy_unregister(mpc); 338100979Srwatson else 339100979Srwatson error = 0; 340100979Srwatson break; 341100979Srwatson default: 342100979Srwatson break; 343100979Srwatson } 344100979Srwatson 345100979Srwatson return (error); 346100979Srwatson} 347100979Srwatson 348100979Srwatsonstatic int 349100979Srwatsonmac_policy_register(struct mac_policy_conf *mpc) 350100979Srwatson{ 351100979Srwatson struct mac_policy_conf *tmpc; 352100979Srwatson struct mac_policy_ops *ops; 353100979Srwatson struct mac_policy_op_entry *mpe; 354100979Srwatson int slot; 355100979Srwatson 356100979Srwatson MALLOC(mpc->mpc_ops, struct mac_policy_ops *, sizeof(*ops), M_MACOPVEC, 357100979Srwatson M_WAITOK | M_ZERO); 358100979Srwatson for (mpe = mpc->mpc_entries; mpe->mpe_constant != MAC_OP_LAST; mpe++) { 359100979Srwatson switch (mpe->mpe_constant) { 360100979Srwatson case MAC_OP_LAST: 361100979Srwatson /* 362100979Srwatson * Doesn't actually happen, but this allows checking 363100979Srwatson * that all enumerated values are handled. 364100979Srwatson */ 365100979Srwatson break; 366100979Srwatson case MAC_DESTROY: 367100979Srwatson mpc->mpc_ops->mpo_destroy = 368100979Srwatson mpe->mpe_function; 369100979Srwatson break; 370100979Srwatson case MAC_INIT: 371100979Srwatson mpc->mpc_ops->mpo_init = 372100979Srwatson mpe->mpe_function; 373100979Srwatson break; 374100979Srwatson case MAC_INIT_BPFDESC: 375100979Srwatson mpc->mpc_ops->mpo_init_bpfdesc = 376100979Srwatson mpe->mpe_function; 377100979Srwatson break; 378100979Srwatson case MAC_INIT_CRED: 379100979Srwatson mpc->mpc_ops->mpo_init_cred = 380100979Srwatson mpe->mpe_function; 381100979Srwatson break; 382100979Srwatson case MAC_INIT_DEVFSDIRENT: 383100979Srwatson mpc->mpc_ops->mpo_init_devfsdirent = 384100979Srwatson mpe->mpe_function; 385100979Srwatson break; 386100979Srwatson case MAC_INIT_IFNET: 387100979Srwatson mpc->mpc_ops->mpo_init_ifnet = 388100979Srwatson mpe->mpe_function; 389100979Srwatson break; 390100979Srwatson case MAC_INIT_IPQ: 391100979Srwatson mpc->mpc_ops->mpo_init_ipq = 392100979Srwatson mpe->mpe_function; 393100979Srwatson break; 394100979Srwatson case MAC_INIT_MBUF: 395100979Srwatson mpc->mpc_ops->mpo_init_mbuf = 396100979Srwatson mpe->mpe_function; 397100979Srwatson break; 398100979Srwatson case MAC_INIT_MOUNT: 399100979Srwatson mpc->mpc_ops->mpo_init_mount = 400100979Srwatson mpe->mpe_function; 401100979Srwatson break; 402100979Srwatson case MAC_INIT_PIPE: 403100979Srwatson mpc->mpc_ops->mpo_init_pipe = 404100979Srwatson mpe->mpe_function; 405100979Srwatson break; 406100979Srwatson case MAC_INIT_SOCKET: 407100979Srwatson mpc->mpc_ops->mpo_init_socket = 408100979Srwatson mpe->mpe_function; 409100979Srwatson break; 410100979Srwatson case MAC_INIT_TEMP: 411100979Srwatson mpc->mpc_ops->mpo_init_temp = 412100979Srwatson mpe->mpe_function; 413100979Srwatson break; 414100979Srwatson case MAC_INIT_VNODE: 415100979Srwatson mpc->mpc_ops->mpo_init_vnode = 416100979Srwatson mpe->mpe_function; 417100979Srwatson break; 418100979Srwatson case MAC_DESTROY_BPFDESC: 419100979Srwatson mpc->mpc_ops->mpo_destroy_bpfdesc = 420100979Srwatson mpe->mpe_function; 421100979Srwatson break; 422100979Srwatson case MAC_DESTROY_CRED: 423100979Srwatson mpc->mpc_ops->mpo_destroy_cred = 424100979Srwatson mpe->mpe_function; 425100979Srwatson break; 426100979Srwatson case MAC_DESTROY_DEVFSDIRENT: 427100979Srwatson mpc->mpc_ops->mpo_destroy_devfsdirent = 428100979Srwatson mpe->mpe_function; 429100979Srwatson break; 430100979Srwatson case MAC_DESTROY_IFNET: 431100979Srwatson mpc->mpc_ops->mpo_destroy_ifnet = 432100979Srwatson mpe->mpe_function; 433100979Srwatson break; 434100979Srwatson case MAC_DESTROY_IPQ: 435100979Srwatson mpc->mpc_ops->mpo_destroy_ipq = 436100979Srwatson mpe->mpe_function; 437100979Srwatson break; 438100979Srwatson case MAC_DESTROY_MBUF: 439100979Srwatson mpc->mpc_ops->mpo_destroy_mbuf = 440100979Srwatson mpe->mpe_function; 441100979Srwatson break; 442100979Srwatson case MAC_DESTROY_MOUNT: 443100979Srwatson mpc->mpc_ops->mpo_destroy_mount = 444100979Srwatson mpe->mpe_function; 445100979Srwatson break; 446100979Srwatson case MAC_DESTROY_PIPE: 447100979Srwatson mpc->mpc_ops->mpo_destroy_pipe = 448100979Srwatson mpe->mpe_function; 449100979Srwatson break; 450100979Srwatson case MAC_DESTROY_SOCKET: 451100979Srwatson mpc->mpc_ops->mpo_destroy_socket = 452100979Srwatson mpe->mpe_function; 453100979Srwatson break; 454100979Srwatson case MAC_DESTROY_TEMP: 455100979Srwatson mpc->mpc_ops->mpo_destroy_temp = 456100979Srwatson mpe->mpe_function; 457100979Srwatson break; 458100979Srwatson case MAC_DESTROY_VNODE: 459100979Srwatson mpc->mpc_ops->mpo_destroy_vnode = 460100979Srwatson mpe->mpe_function; 461100979Srwatson break; 462100979Srwatson case MAC_EXTERNALIZE: 463100979Srwatson mpc->mpc_ops->mpo_externalize = 464100979Srwatson mpe->mpe_function; 465100979Srwatson break; 466100979Srwatson case MAC_INTERNALIZE: 467100979Srwatson mpc->mpc_ops->mpo_internalize = 468100979Srwatson mpe->mpe_function; 469100979Srwatson break; 470100979Srwatson case MAC_CREATE_DEVFS_DEVICE: 471100979Srwatson mpc->mpc_ops->mpo_create_devfs_device = 472100979Srwatson mpe->mpe_function; 473100979Srwatson break; 474100979Srwatson case MAC_CREATE_DEVFS_DIRECTORY: 475100979Srwatson mpc->mpc_ops->mpo_create_devfs_directory = 476100979Srwatson mpe->mpe_function; 477100979Srwatson break; 478100979Srwatson case MAC_CREATE_DEVFS_VNODE: 479100979Srwatson mpc->mpc_ops->mpo_create_devfs_vnode = 480100979Srwatson mpe->mpe_function; 481100979Srwatson break; 482100979Srwatson case MAC_STDCREATEVNODE_EA: 483100979Srwatson mpc->mpc_ops->mpo_stdcreatevnode_ea = 484100979Srwatson mpe->mpe_function; 485100979Srwatson break; 486100979Srwatson case MAC_CREATE_VNODE: 487100979Srwatson mpc->mpc_ops->mpo_create_vnode = 488100979Srwatson mpe->mpe_function; 489100979Srwatson break; 490100979Srwatson case MAC_CREATE_MOUNT: 491100979Srwatson mpc->mpc_ops->mpo_create_mount = 492100979Srwatson mpe->mpe_function; 493100979Srwatson break; 494100979Srwatson case MAC_CREATE_ROOT_MOUNT: 495100979Srwatson mpc->mpc_ops->mpo_create_root_mount = 496100979Srwatson mpe->mpe_function; 497100979Srwatson break; 498100979Srwatson case MAC_RELABEL_VNODE: 499100979Srwatson mpc->mpc_ops->mpo_relabel_vnode = 500100979Srwatson mpe->mpe_function; 501100979Srwatson break; 502100979Srwatson case MAC_UPDATE_DEVFSDIRENT: 503100979Srwatson mpc->mpc_ops->mpo_update_devfsdirent = 504100979Srwatson mpe->mpe_function; 505100979Srwatson break; 506100979Srwatson case MAC_UPDATE_PROCFSVNODE: 507100979Srwatson mpc->mpc_ops->mpo_update_procfsvnode = 508100979Srwatson mpe->mpe_function; 509100979Srwatson break; 510100979Srwatson case MAC_UPDATE_VNODE_FROM_EXTATTR: 511100979Srwatson mpc->mpc_ops->mpo_update_vnode_from_extattr = 512100979Srwatson mpe->mpe_function; 513100979Srwatson break; 514100979Srwatson case MAC_UPDATE_VNODE_FROM_EXTERNALIZED: 515100979Srwatson mpc->mpc_ops->mpo_update_vnode_from_externalized = 516100979Srwatson mpe->mpe_function; 517100979Srwatson break; 518100979Srwatson case MAC_UPDATE_VNODE_FROM_MOUNT: 519100979Srwatson mpc->mpc_ops->mpo_update_vnode_from_mount = 520100979Srwatson mpe->mpe_function; 521100979Srwatson break; 522100979Srwatson case MAC_CREATE_MBUF_FROM_SOCKET: 523100979Srwatson mpc->mpc_ops->mpo_create_mbuf_from_socket = 524100979Srwatson mpe->mpe_function; 525100979Srwatson break; 526100979Srwatson case MAC_CREATE_PIPE: 527100979Srwatson mpc->mpc_ops->mpo_create_pipe = 528100979Srwatson mpe->mpe_function; 529100979Srwatson break; 530100979Srwatson case MAC_CREATE_SOCKET: 531100979Srwatson mpc->mpc_ops->mpo_create_socket = 532100979Srwatson mpe->mpe_function; 533100979Srwatson break; 534100979Srwatson case MAC_CREATE_SOCKET_FROM_SOCKET: 535100979Srwatson mpc->mpc_ops->mpo_create_socket_from_socket = 536100979Srwatson mpe->mpe_function; 537100979Srwatson break; 538100979Srwatson case MAC_RELABEL_PIPE: 539100979Srwatson mpc->mpc_ops->mpo_relabel_pipe = 540100979Srwatson mpe->mpe_function; 541100979Srwatson break; 542100979Srwatson case MAC_RELABEL_SOCKET: 543100979Srwatson mpc->mpc_ops->mpo_relabel_socket = 544100979Srwatson mpe->mpe_function; 545100979Srwatson break; 546100979Srwatson case MAC_SET_SOCKET_PEER_FROM_MBUF: 547100979Srwatson mpc->mpc_ops->mpo_set_socket_peer_from_mbuf = 548100979Srwatson mpe->mpe_function; 549100979Srwatson break; 550100979Srwatson case MAC_SET_SOCKET_PEER_FROM_SOCKET: 551100979Srwatson mpc->mpc_ops->mpo_set_socket_peer_from_socket = 552100979Srwatson mpe->mpe_function; 553100979Srwatson break; 554100979Srwatson case MAC_CREATE_BPFDESC: 555100979Srwatson mpc->mpc_ops->mpo_create_bpfdesc = 556100979Srwatson mpe->mpe_function; 557100979Srwatson break; 558100979Srwatson case MAC_CREATE_DATAGRAM_FROM_IPQ: 559100979Srwatson mpc->mpc_ops->mpo_create_datagram_from_ipq = 560100979Srwatson mpe->mpe_function; 561100979Srwatson break; 562100979Srwatson case MAC_CREATE_FRAGMENT: 563100979Srwatson mpc->mpc_ops->mpo_create_fragment = 564100979Srwatson mpe->mpe_function; 565100979Srwatson break; 566100979Srwatson case MAC_CREATE_IFNET: 567100979Srwatson mpc->mpc_ops->mpo_create_ifnet = 568100979Srwatson mpe->mpe_function; 569100979Srwatson break; 570100979Srwatson case MAC_CREATE_IPQ: 571100979Srwatson mpc->mpc_ops->mpo_create_ipq = 572100979Srwatson mpe->mpe_function; 573100979Srwatson break; 574100979Srwatson case MAC_CREATE_MBUF_FROM_MBUF: 575100979Srwatson mpc->mpc_ops->mpo_create_mbuf_from_mbuf = 576100979Srwatson mpe->mpe_function; 577100979Srwatson break; 578100979Srwatson case MAC_CREATE_MBUF_LINKLAYER: 579100979Srwatson mpc->mpc_ops->mpo_create_mbuf_linklayer = 580100979Srwatson mpe->mpe_function; 581100979Srwatson break; 582100979Srwatson case MAC_CREATE_MBUF_FROM_BPFDESC: 583100979Srwatson mpc->mpc_ops->mpo_create_mbuf_from_bpfdesc = 584100979Srwatson mpe->mpe_function; 585100979Srwatson break; 586100979Srwatson case MAC_CREATE_MBUF_FROM_IFNET: 587100979Srwatson mpc->mpc_ops->mpo_create_mbuf_from_ifnet = 588100979Srwatson mpe->mpe_function; 589100979Srwatson break; 590100979Srwatson case MAC_CREATE_MBUF_MULTICAST_ENCAP: 591100979Srwatson mpc->mpc_ops->mpo_create_mbuf_multicast_encap = 592100979Srwatson mpe->mpe_function; 593100979Srwatson break; 594100979Srwatson case MAC_CREATE_MBUF_NETLAYER: 595100979Srwatson mpc->mpc_ops->mpo_create_mbuf_netlayer = 596100979Srwatson mpe->mpe_function; 597100979Srwatson break; 598100979Srwatson case MAC_FRAGMENT_MATCH: 599100979Srwatson mpc->mpc_ops->mpo_fragment_match = 600100979Srwatson mpe->mpe_function; 601100979Srwatson break; 602100979Srwatson case MAC_RELABEL_IFNET: 603100979Srwatson mpc->mpc_ops->mpo_relabel_ifnet = 604100979Srwatson mpe->mpe_function; 605100979Srwatson break; 606100979Srwatson case MAC_UPDATE_IPQ: 607100979Srwatson mpc->mpc_ops->mpo_update_ipq = 608100979Srwatson mpe->mpe_function; 609100979Srwatson break; 610100979Srwatson case MAC_CREATE_CRED: 611100979Srwatson mpc->mpc_ops->mpo_create_cred = 612100979Srwatson mpe->mpe_function; 613100979Srwatson break; 614100979Srwatson case MAC_EXECVE_TRANSITION: 615100979Srwatson mpc->mpc_ops->mpo_execve_transition = 616100979Srwatson mpe->mpe_function; 617100979Srwatson break; 618100979Srwatson case MAC_EXECVE_WILL_TRANSITION: 619100979Srwatson mpc->mpc_ops->mpo_execve_will_transition = 620100979Srwatson mpe->mpe_function; 621100979Srwatson break; 622100979Srwatson case MAC_CREATE_PROC0: 623100979Srwatson mpc->mpc_ops->mpo_create_proc0 = mpe->mpe_function; 624100979Srwatson break; 625100979Srwatson case MAC_CREATE_PROC1: 626100979Srwatson mpc->mpc_ops->mpo_create_proc1 = mpe->mpe_function; 627100979Srwatson break; 628100979Srwatson case MAC_RELABEL_CRED: 629100979Srwatson mpc->mpc_ops->mpo_relabel_cred = 630100979Srwatson mpe->mpe_function; 631100979Srwatson break; 632100979Srwatson case MAC_CHECK_BPFDESC_RECEIVE: 633100979Srwatson mpc->mpc_ops->mpo_check_bpfdesc_receive = 634100979Srwatson mpe->mpe_function; 635100979Srwatson break; 636100979Srwatson case MAC_CHECK_CRED_RELABEL: 637100979Srwatson mpc->mpc_ops->mpo_check_cred_relabel = 638100979Srwatson mpe->mpe_function; 639100979Srwatson break; 640100979Srwatson case MAC_CHECK_CRED_VISIBLE: 641100979Srwatson mpc->mpc_ops->mpo_check_cred_visible = 642100979Srwatson mpe->mpe_function; 643100979Srwatson break; 644100979Srwatson case MAC_CHECK_IFNET_RELABEL: 645100979Srwatson mpc->mpc_ops->mpo_check_ifnet_relabel = 646100979Srwatson mpe->mpe_function; 647100979Srwatson break; 648100979Srwatson case MAC_CHECK_IFNET_TRANSMIT: 649100979Srwatson mpc->mpc_ops->mpo_check_ifnet_transmit = 650100979Srwatson mpe->mpe_function; 651100979Srwatson break; 652100979Srwatson case MAC_CHECK_MOUNT_STAT: 653100979Srwatson mpc->mpc_ops->mpo_check_mount_stat = 654100979Srwatson mpe->mpe_function; 655100979Srwatson break; 656100979Srwatson case MAC_CHECK_PIPE_IOCTL: 657100979Srwatson mpc->mpc_ops->mpo_check_pipe_ioctl = 658100979Srwatson mpe->mpe_function; 659100979Srwatson break; 660100979Srwatson case MAC_CHECK_PIPE_OP: 661100979Srwatson mpc->mpc_ops->mpo_check_pipe_op = 662100979Srwatson mpe->mpe_function; 663100979Srwatson break; 664100979Srwatson case MAC_CHECK_PIPE_RELABEL: 665100979Srwatson mpc->mpc_ops->mpo_check_pipe_relabel = 666100979Srwatson mpe->mpe_function; 667100979Srwatson break; 668100979Srwatson case MAC_CHECK_PROC_DEBUG: 669100979Srwatson mpc->mpc_ops->mpo_check_proc_debug = 670100979Srwatson mpe->mpe_function; 671100979Srwatson break; 672100979Srwatson case MAC_CHECK_PROC_SCHED: 673100979Srwatson mpc->mpc_ops->mpo_check_proc_sched = 674100979Srwatson mpe->mpe_function; 675100979Srwatson break; 676100979Srwatson case MAC_CHECK_PROC_SIGNAL: 677100979Srwatson mpc->mpc_ops->mpo_check_proc_signal = 678100979Srwatson mpe->mpe_function; 679100979Srwatson break; 680100979Srwatson case MAC_CHECK_SOCKET_BIND: 681100979Srwatson mpc->mpc_ops->mpo_check_socket_bind = 682100979Srwatson mpe->mpe_function; 683100979Srwatson break; 684100979Srwatson case MAC_CHECK_SOCKET_CONNECT: 685100979Srwatson mpc->mpc_ops->mpo_check_socket_connect = 686100979Srwatson mpe->mpe_function; 687100979Srwatson break; 688100979Srwatson case MAC_CHECK_SOCKET_LISTEN: 689100979Srwatson mpc->mpc_ops->mpo_check_socket_listen = 690100979Srwatson mpe->mpe_function; 691100979Srwatson break; 692100979Srwatson case MAC_CHECK_SOCKET_RECEIVE: 693100979Srwatson mpc->mpc_ops->mpo_check_socket_receive = 694100979Srwatson mpe->mpe_function; 695100979Srwatson break; 696100979Srwatson case MAC_CHECK_SOCKET_RELABEL: 697100979Srwatson mpc->mpc_ops->mpo_check_socket_relabel = 698100979Srwatson mpe->mpe_function; 699100979Srwatson break; 700100979Srwatson case MAC_CHECK_SOCKET_VISIBLE: 701100979Srwatson mpc->mpc_ops->mpo_check_socket_visible = 702100979Srwatson mpe->mpe_function; 703100979Srwatson break; 704100979Srwatson case MAC_CHECK_VNODE_ACCESS: 705100979Srwatson mpc->mpc_ops->mpo_check_vnode_access = 706100979Srwatson mpe->mpe_function; 707100979Srwatson break; 708100979Srwatson case MAC_CHECK_VNODE_CHDIR: 709100979Srwatson mpc->mpc_ops->mpo_check_vnode_chdir = 710100979Srwatson mpe->mpe_function; 711100979Srwatson break; 712100979Srwatson case MAC_CHECK_VNODE_CHROOT: 713100979Srwatson mpc->mpc_ops->mpo_check_vnode_chroot = 714100979Srwatson mpe->mpe_function; 715100979Srwatson break; 716100979Srwatson case MAC_CHECK_VNODE_CREATE: 717100979Srwatson mpc->mpc_ops->mpo_check_vnode_create = 718100979Srwatson mpe->mpe_function; 719100979Srwatson break; 720100979Srwatson case MAC_CHECK_VNODE_DELETE: 721100979Srwatson mpc->mpc_ops->mpo_check_vnode_delete = 722100979Srwatson mpe->mpe_function; 723100979Srwatson break; 724100979Srwatson case MAC_CHECK_VNODE_DELETEACL: 725100979Srwatson mpc->mpc_ops->mpo_check_vnode_deleteacl = 726100979Srwatson mpe->mpe_function; 727100979Srwatson break; 728100979Srwatson case MAC_CHECK_VNODE_EXEC: 729100979Srwatson mpc->mpc_ops->mpo_check_vnode_exec = 730100979Srwatson mpe->mpe_function; 731100979Srwatson break; 732100979Srwatson case MAC_CHECK_VNODE_GETACL: 733100979Srwatson mpc->mpc_ops->mpo_check_vnode_getacl = 734100979Srwatson mpe->mpe_function; 735100979Srwatson break; 736100979Srwatson case MAC_CHECK_VNODE_GETEXTATTR: 737100979Srwatson mpc->mpc_ops->mpo_check_vnode_getextattr = 738100979Srwatson mpe->mpe_function; 739100979Srwatson break; 740100979Srwatson case MAC_CHECK_VNODE_LOOKUP: 741100979Srwatson mpc->mpc_ops->mpo_check_vnode_lookup = 742100979Srwatson mpe->mpe_function; 743100979Srwatson break; 744100979Srwatson case MAC_CHECK_VNODE_MMAP_PERMS: 745100979Srwatson mpc->mpc_ops->mpo_check_vnode_mmap_perms = 746100979Srwatson mpe->mpe_function; 747100979Srwatson break; 748100979Srwatson case MAC_CHECK_VNODE_OP: 749100979Srwatson mpc->mpc_ops->mpo_check_vnode_op = 750100979Srwatson mpe->mpe_function; 751100979Srwatson break; 752100979Srwatson case MAC_CHECK_VNODE_OPEN: 753100979Srwatson mpc->mpc_ops->mpo_check_vnode_open = 754100979Srwatson mpe->mpe_function; 755100979Srwatson break; 756100979Srwatson case MAC_CHECK_VNODE_READDIR: 757100979Srwatson mpc->mpc_ops->mpo_check_vnode_readdir = 758100979Srwatson mpe->mpe_function; 759100979Srwatson break; 760100979Srwatson case MAC_CHECK_VNODE_READLINK: 761100979Srwatson mpc->mpc_ops->mpo_check_vnode_readlink = 762100979Srwatson mpe->mpe_function; 763100979Srwatson break; 764100979Srwatson case MAC_CHECK_VNODE_RELABEL: 765100979Srwatson mpc->mpc_ops->mpo_check_vnode_relabel = 766100979Srwatson mpe->mpe_function; 767100979Srwatson break; 768100979Srwatson case MAC_CHECK_VNODE_RENAME_FROM: 769100979Srwatson mpc->mpc_ops->mpo_check_vnode_rename_from = 770100979Srwatson mpe->mpe_function; 771100979Srwatson break; 772100979Srwatson case MAC_CHECK_VNODE_RENAME_TO: 773100979Srwatson mpc->mpc_ops->mpo_check_vnode_rename_to = 774100979Srwatson mpe->mpe_function; 775100979Srwatson break; 776100979Srwatson case MAC_CHECK_VNODE_REVOKE: 777100979Srwatson mpc->mpc_ops->mpo_check_vnode_revoke = 778100979Srwatson mpe->mpe_function; 779100979Srwatson break; 780100979Srwatson case MAC_CHECK_VNODE_SETACL: 781100979Srwatson mpc->mpc_ops->mpo_check_vnode_setacl = 782100979Srwatson mpe->mpe_function; 783100979Srwatson break; 784100979Srwatson case MAC_CHECK_VNODE_SETEXTATTR: 785100979Srwatson mpc->mpc_ops->mpo_check_vnode_setextattr = 786100979Srwatson mpe->mpe_function; 787100979Srwatson break; 788100979Srwatson case MAC_CHECK_VNODE_SETFLAGS: 789100979Srwatson mpc->mpc_ops->mpo_check_vnode_setflags = 790100979Srwatson mpe->mpe_function; 791100979Srwatson break; 792100979Srwatson case MAC_CHECK_VNODE_SETMODE: 793100979Srwatson mpc->mpc_ops->mpo_check_vnode_setmode = 794100979Srwatson mpe->mpe_function; 795100979Srwatson break; 796100979Srwatson case MAC_CHECK_VNODE_SETOWNER: 797100979Srwatson mpc->mpc_ops->mpo_check_vnode_setowner = 798100979Srwatson mpe->mpe_function; 799100979Srwatson break; 800100979Srwatson case MAC_CHECK_VNODE_SETUTIMES: 801100979Srwatson mpc->mpc_ops->mpo_check_vnode_setutimes = 802100979Srwatson mpe->mpe_function; 803100979Srwatson break; 804100979Srwatson case MAC_CHECK_VNODE_STAT: 805100979Srwatson mpc->mpc_ops->mpo_check_vnode_stat = 806100979Srwatson mpe->mpe_function; 807100979Srwatson break; 808100979Srwatson/* 809100979Srwatson default: 810100979Srwatson printf("MAC policy `%s': unknown operation %d\n", 811100979Srwatson mpc->mpc_name, mpe->mpe_constant); 812100979Srwatson return (EINVAL); 813100979Srwatson*/ 814100979Srwatson } 815100979Srwatson } 816100979Srwatson MAC_POLICY_LIST_LOCK(); 817100979Srwatson if (mac_policy_list_busy > 0) { 818100979Srwatson MAC_POLICY_LIST_UNLOCK(); 819100979Srwatson FREE(mpc->mpc_ops, M_MACOPVEC); 820100979Srwatson mpc->mpc_ops = NULL; 821100979Srwatson return (EBUSY); 822100979Srwatson } 823100979Srwatson LIST_FOREACH(tmpc, &mac_policy_list, mpc_list) { 824100979Srwatson if (strcmp(tmpc->mpc_name, mpc->mpc_name) == 0) { 825100979Srwatson MAC_POLICY_LIST_UNLOCK(); 826100979Srwatson FREE(mpc->mpc_ops, M_MACOPVEC); 827100979Srwatson mpc->mpc_ops = NULL; 828100979Srwatson return (EEXIST); 829100979Srwatson } 830100979Srwatson } 831100979Srwatson if (mpc->mpc_field_off != NULL) { 832100979Srwatson slot = ffs(mac_policy_offsets_free); 833100979Srwatson if (slot == 0) { 834100979Srwatson MAC_POLICY_LIST_UNLOCK(); 835100979Srwatson FREE(mpc->mpc_ops, M_MACOPVEC); 836100979Srwatson mpc->mpc_ops = NULL; 837100979Srwatson return (ENOMEM); 838100979Srwatson } 839100979Srwatson slot--; 840100979Srwatson mac_policy_offsets_free &= ~(1 << slot); 841100979Srwatson *mpc->mpc_field_off = slot; 842100979Srwatson } 843100979Srwatson mpc->mpc_runtime_flags |= MPC_RUNTIME_FLAG_REGISTERED; 844100979Srwatson LIST_INSERT_HEAD(&mac_policy_list, mpc, mpc_list); 845100979Srwatson 846100979Srwatson /* Per-policy initialization. */ 847100979Srwatson if (mpc->mpc_ops->mpo_init != NULL) 848100979Srwatson (*(mpc->mpc_ops->mpo_init))(mpc); 849100979Srwatson MAC_POLICY_LIST_UNLOCK(); 850100979Srwatson 851100979Srwatson printf("Security policy loaded: %s (%s)\n", mpc->mpc_fullname, 852100979Srwatson mpc->mpc_name); 853100979Srwatson 854100979Srwatson return (0); 855100979Srwatson} 856100979Srwatson 857100979Srwatsonstatic int 858100979Srwatsonmac_policy_unregister(struct mac_policy_conf *mpc) 859100979Srwatson{ 860100979Srwatson 861100979Srwatson#if 0 862100979Srwatson /* 863100979Srwatson * Don't allow unloading modules with private data. 864100979Srwatson */ 865100979Srwatson if (mpc->mpc_field_off != NULL) 866100979Srwatson return (EBUSY); 867100979Srwatson#endif 868100979Srwatson if ((mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_UNLOADOK) == 0) 869100979Srwatson return (EBUSY); 870100979Srwatson MAC_POLICY_LIST_LOCK(); 871100979Srwatson if (mac_policy_list_busy > 0) { 872100979Srwatson MAC_POLICY_LIST_UNLOCK(); 873100979Srwatson return (EBUSY); 874100979Srwatson } 875100979Srwatson if (mpc->mpc_ops->mpo_destroy != NULL) 876100979Srwatson (*(mpc->mpc_ops->mpo_destroy))(mpc); 877100979Srwatson 878100979Srwatson LIST_REMOVE(mpc, mpc_list); 879100979Srwatson MAC_POLICY_LIST_UNLOCK(); 880100979Srwatson 881100979Srwatson FREE(mpc->mpc_ops, M_MACOPVEC); 882100979Srwatson mpc->mpc_ops = NULL; 883100979Srwatson 884100979Srwatson printf("Security policy unload: %s (%s)\n", mpc->mpc_fullname, 885100979Srwatson mpc->mpc_name); 886100979Srwatson 887100979Srwatson return (0); 888100979Srwatson} 889100979Srwatson 890100979Srwatson/* 891100979Srwatson * Define an error value precedence, and given two arguments, selects the 892100979Srwatson * value with the higher precedence. 893100979Srwatson */ 894100979Srwatsonstatic int 895100979Srwatsonerror_select(int error1, int error2) 896100979Srwatson{ 897100979Srwatson 898100979Srwatson /* Certain decision-making errors take top priority. */ 899100979Srwatson if (error1 == EDEADLK || error2 == EDEADLK) 900100979Srwatson return (EDEADLK); 901100979Srwatson 902100979Srwatson /* Invalid arguments should be reported where possible. */ 903100979Srwatson if (error1 == EINVAL || error2 == EINVAL) 904100979Srwatson return (EINVAL); 905100979Srwatson 906100979Srwatson /* Precedence goes to "visibility", with both process and file. */ 907100979Srwatson if (error1 == ESRCH || error2 == ESRCH) 908100979Srwatson return (ESRCH); 909100979Srwatson 910100979Srwatson if (error1 == ENOENT || error2 == ENOENT) 911100979Srwatson return (ENOENT); 912100979Srwatson 913100979Srwatson /* Precedence goes to DAC/MAC protections. */ 914100979Srwatson if (error1 == EACCES || error2 == EACCES) 915100979Srwatson return (EACCES); 916100979Srwatson 917100979Srwatson /* Precedence goes to privilege. */ 918100979Srwatson if (error1 == EPERM || error2 == EPERM) 919100979Srwatson return (EPERM); 920100979Srwatson 921100979Srwatson /* Precedence goes to error over success; otherwise, arbitrary. */ 922100979Srwatson if (error1 != 0) 923100979Srwatson return (error1); 924100979Srwatson return (error2); 925100979Srwatson} 926100979Srwatson 927100979Srwatsonvoid 928100979Srwatsonmac_update_devfsdirent(struct devfs_dirent *de, struct vnode *vp) 929100979Srwatson{ 930100979Srwatson 931100979Srwatson MAC_PERFORM(update_devfsdirent, de, &de->de_label, vp, &vp->v_label); 932100979Srwatson} 933100979Srwatson 934100979Srwatsonvoid 935100979Srwatsonmac_update_procfsvnode(struct vnode *vp, struct ucred *cred) 936100979Srwatson{ 937100979Srwatson 938100979Srwatson MAC_PERFORM(update_procfsvnode, vp, &vp->v_label, cred); 939100979Srwatson} 940100979Srwatson 941100979Srwatson/* 942100979Srwatson * Support callout for policies that manage their own externalization 943100979Srwatson * using extended attributes. 944100979Srwatson */ 945100979Srwatsonstatic int 946100979Srwatsonmac_update_vnode_from_extattr(struct vnode *vp, struct mount *mp) 947100979Srwatson{ 948100979Srwatson int error; 949100979Srwatson 950100979Srwatson MAC_CHECK(update_vnode_from_extattr, vp, &vp->v_label, mp, 951100979Srwatson &mp->mnt_fslabel); 952100979Srwatson 953100979Srwatson return (error); 954100979Srwatson} 955100979Srwatson 956100979Srwatson/* 957100979Srwatson * Given an externalized mac label, internalize it and stamp it on a 958100979Srwatson * vnode. 959100979Srwatson */ 960100979Srwatsonstatic int 961100979Srwatsonmac_update_vnode_from_externalized(struct vnode *vp, struct mac *extmac) 962100979Srwatson{ 963100979Srwatson int error; 964100979Srwatson 965100979Srwatson MAC_CHECK(update_vnode_from_externalized, vp, &vp->v_label, extmac); 966100979Srwatson 967100979Srwatson return (error); 968100979Srwatson} 969100979Srwatson 970100979Srwatson/* 971100979Srwatson * Call out to individual policies to update the label in a vnode from 972100979Srwatson * the mountpoint. 973100979Srwatson */ 974100979Srwatsonvoid 975100979Srwatsonmac_update_vnode_from_mount(struct vnode *vp, struct mount *mp) 976100979Srwatson{ 977100979Srwatson 978100979Srwatson MAC_PERFORM(update_vnode_from_mount, vp, &vp->v_label, mp, 979100979Srwatson &mp->mnt_fslabel); 980100979Srwatson 981101308Sjeff ASSERT_VOP_LOCKED(vp, "mac_update_vnode_from_mount"); 982100979Srwatson if (mac_cache_fslabel_in_vnode) 983101308Sjeff vp->v_vflag |= VV_CACHEDLABEL; 984100979Srwatson} 985100979Srwatson 986100979Srwatson/* 987100979Srwatson * Implementation of VOP_REFRESHLABEL() that relies on extended attributes 988100979Srwatson * to store label data. Can be referenced by filesystems supporting 989100979Srwatson * extended attributes. 990100979Srwatson */ 991100979Srwatsonint 992100979Srwatsonvop_stdrefreshlabel_ea(struct vop_refreshlabel_args *ap) 993100979Srwatson{ 994100979Srwatson struct vnode *vp = ap->a_vp; 995100979Srwatson struct mac extmac; 996100979Srwatson int buflen, error; 997100979Srwatson 998100979Srwatson ASSERT_VOP_LOCKED(vp, "vop_stdrefreshlabel_ea"); 999100979Srwatson 1000100979Srwatson /* 1001100979Srwatson * Call out to external policies first. Order doesn't really 1002100979Srwatson * matter, as long as failure of one assures failure of all. 1003100979Srwatson */ 1004100979Srwatson error = mac_update_vnode_from_extattr(vp, vp->v_mount); 1005100979Srwatson if (error) 1006100979Srwatson return (error); 1007100979Srwatson 1008100979Srwatson buflen = sizeof(extmac); 1009100979Srwatson error = vn_extattr_get(vp, IO_NODELOCKED, 1010100979Srwatson FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME, &buflen, 1011100979Srwatson (char *)&extmac, curthread); 1012100979Srwatson switch (error) { 1013100979Srwatson case 0: 1014100979Srwatson /* Got it */ 1015100979Srwatson break; 1016100979Srwatson 1017100979Srwatson case ENOATTR: 1018100979Srwatson /* 1019100979Srwatson * Use the label from the mount point. 1020100979Srwatson */ 1021100979Srwatson mac_update_vnode_from_mount(vp, vp->v_mount); 1022100979Srwatson return (0); 1023100979Srwatson 1024100979Srwatson case EOPNOTSUPP: 1025100979Srwatson default: 1026100979Srwatson /* Fail horribly. */ 1027100979Srwatson return (error); 1028100979Srwatson } 1029100979Srwatson 1030100979Srwatson if (buflen != sizeof(extmac)) 1031100979Srwatson error = EPERM; /* Fail very closed. */ 1032100979Srwatson if (error == 0) 1033100979Srwatson error = mac_update_vnode_from_externalized(vp, &extmac); 1034100979Srwatson if (error == 0) 1035101308Sjeff vp->v_vflag |= VV_CACHEDLABEL; 1036100979Srwatson else { 1037100979Srwatson struct vattr va; 1038100979Srwatson 1039100979Srwatson printf("Corrupted label on %s", 1040100979Srwatson vp->v_mount->mnt_stat.f_mntonname); 1041100979Srwatson if (VOP_GETATTR(vp, &va, curthread->td_ucred, curthread) == 0) 1042100979Srwatson printf(" inum %ld", va.va_fileid); 1043100979Srwatson if (mac_debug_label_fallback) { 1044100979Srwatson printf(", falling back.\n"); 1045100979Srwatson mac_update_vnode_from_mount(vp, vp->v_mount); 1046100979Srwatson error = 0; 1047100979Srwatson } else { 1048100979Srwatson printf(".\n"); 1049100979Srwatson error = EPERM; 1050100979Srwatson } 1051100979Srwatson } 1052100979Srwatson 1053100979Srwatson return (error); 1054100979Srwatson} 1055100979Srwatson 1056100979Srwatson/* 1057100979Srwatson * Make sure the vnode label is up-to-date. If EOPNOTSUPP, then we handle 1058100979Srwatson * the labeling activity outselves. Filesystems should be careful not 1059100979Srwatson * to change their minds regarding whether they support vop_refreshlabel() 1060100979Srwatson * for a vnode or not. Don't cache the vnode here, allow the file 1061100979Srwatson * system code to determine if it's safe to cache. If we update from 1062100979Srwatson * the mount, don't cache since a change to the mount label should affect 1063100979Srwatson * all vnodes. 1064100979Srwatson */ 1065100979Srwatsonstatic int 1066100979Srwatsonvn_refreshlabel(struct vnode *vp, struct ucred *cred) 1067100979Srwatson{ 1068100979Srwatson int error; 1069100979Srwatson 1070100979Srwatson ASSERT_VOP_LOCKED(vp, "vn_refreshlabel"); 1071100979Srwatson 1072100979Srwatson if (vp->v_mount == NULL) { 1073100979Srwatson/* 1074100979Srwatson Eventually, we probably want to special-case refreshing 1075100979Srwatson of deadfs vnodes, and if there's a lock-free race somewhere, 1076100979Srwatson that case might be handled here. 1077100979Srwatson 1078100979Srwatson mac_update_vnode_deadfs(vp); 1079100979Srwatson return (0); 1080100979Srwatson */ 1081100979Srwatson /* printf("vn_refreshlabel: null v_mount\n"); */ 1082100979Srwatson if (vp->v_tag != VT_NON) 1083100979Srwatson printf( 1084100979Srwatson "vn_refreshlabel: null v_mount with non-VT_NON\n"); 1085100979Srwatson return (EBADF); 1086100979Srwatson } 1087100979Srwatson 1088101308Sjeff if (vp->v_vflag & VV_CACHEDLABEL) { 1089100979Srwatson mac_vnode_label_cache_hits++; 1090100979Srwatson return (0); 1091100979Srwatson } else 1092100979Srwatson mac_vnode_label_cache_misses++; 1093100979Srwatson 1094100979Srwatson if ((vp->v_mount->mnt_flag & MNT_MULTILABEL) == 0) { 1095100979Srwatson mac_update_vnode_from_mount(vp, vp->v_mount); 1096100979Srwatson return (0); 1097100979Srwatson } 1098100979Srwatson 1099100979Srwatson error = VOP_REFRESHLABEL(vp, cred, curthread); 1100100979Srwatson switch (error) { 1101100979Srwatson case EOPNOTSUPP: 1102100979Srwatson /* 1103100979Srwatson * If labels are not supported on this vnode, fall back to 1104100979Srwatson * the label in the mount and propagate it to the vnode. 1105100979Srwatson * There should probably be some sort of policy/flag/decision 1106100979Srwatson * about doing this. 1107100979Srwatson */ 1108100979Srwatson mac_update_vnode_from_mount(vp, vp->v_mount); 1109100979Srwatson error = 0; 1110100979Srwatson default: 1111100979Srwatson return (error); 1112100979Srwatson } 1113100979Srwatson} 1114100979Srwatson 1115100979Srwatson/* 1116100979Srwatson * Helper function for file systems using the vop_std*_ea() calls. This 1117100979Srwatson * function must be called after EA service is available for the vnode, 1118100979Srwatson * but before it's hooked up to the namespace so that the node persists 1119100979Srwatson * if there's a crash, or before it can be accessed. On successful 1120100979Srwatson * commit of the label to disk (etc), do cache the label. 1121100979Srwatson */ 1122100979Srwatsonint 1123100979Srwatsonvop_stdcreatevnode_ea(struct vnode *dvp, struct vnode *tvp, struct ucred *cred) 1124100979Srwatson{ 1125100979Srwatson struct mac extmac; 1126100979Srwatson int error; 1127100979Srwatson 1128101308Sjeff ASSERT_VOP_LOCKED(tvp, "vop_stdcreatevnode_ea"); 1129100979Srwatson if ((dvp->v_mount->mnt_flag & MNT_MULTILABEL) == 0) { 1130100979Srwatson mac_update_vnode_from_mount(tvp, tvp->v_mount); 1131100979Srwatson } else { 1132100979Srwatson error = vn_refreshlabel(dvp, cred); 1133100979Srwatson if (error) 1134100979Srwatson return (error); 1135100979Srwatson 1136100979Srwatson /* 1137100979Srwatson * Stick the label in the vnode. Then try to write to 1138100979Srwatson * disk. If we fail, return a failure to abort the 1139100979Srwatson * create operation. Really, this failure shouldn't 1140100979Srwatson * happen except in fairly unusual circumstances (out 1141100979Srwatson * of disk, etc). 1142100979Srwatson */ 1143100979Srwatson mac_create_vnode(cred, dvp, tvp); 1144100979Srwatson 1145100979Srwatson error = mac_stdcreatevnode_ea(tvp); 1146100979Srwatson if (error) 1147100979Srwatson return (error); 1148100979Srwatson 1149100979Srwatson /* 1150100979Srwatson * XXX: Eventually this will go away and all policies will 1151100979Srwatson * directly manage their extended attributes. 1152100979Srwatson */ 1153100979Srwatson error = mac_externalize(&tvp->v_label, &extmac); 1154100979Srwatson if (error) 1155100979Srwatson return (error); 1156100979Srwatson 1157100979Srwatson error = vn_extattr_set(tvp, IO_NODELOCKED, 1158100979Srwatson FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME, 1159100979Srwatson sizeof(extmac), (char *)&extmac, curthread); 1160100979Srwatson if (error == 0) 1161101308Sjeff tvp->v_vflag |= VV_CACHEDLABEL; 1162100979Srwatson else { 1163100979Srwatson#if 0 1164100979Srwatson /* 1165100979Srwatson * In theory, we could have fall-back behavior here. 1166100979Srwatson * It would probably be incorrect. 1167100979Srwatson */ 1168100979Srwatson#endif 1169100979Srwatson return (error); 1170100979Srwatson } 1171100979Srwatson } 1172100979Srwatson 1173100979Srwatson return (0); 1174100979Srwatson} 1175100979Srwatson 1176100979Srwatsonvoid 1177100979Srwatsonmac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp) 1178100979Srwatson{ 1179100979Srwatson int error; 1180100979Srwatson 1181100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_execve_transition"); 1182100979Srwatson 1183100979Srwatson error = vn_refreshlabel(vp, old); 1184100979Srwatson if (error) { 1185100979Srwatson printf("mac_execve_transition: vn_refreshlabel returned %d\n", 1186100979Srwatson error); 1187100979Srwatson printf("mac_execve_transition: using old vnode label\n"); 1188100979Srwatson } 1189100979Srwatson 1190100979Srwatson MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label); 1191100979Srwatson} 1192100979Srwatson 1193100979Srwatsonint 1194100979Srwatsonmac_execve_will_transition(struct ucred *old, struct vnode *vp) 1195100979Srwatson{ 1196100979Srwatson int error, result; 1197100979Srwatson 1198100979Srwatson error = vn_refreshlabel(vp, old); 1199100979Srwatson if (error) 1200100979Srwatson return (error); 1201100979Srwatson 1202100979Srwatson result = 0; 1203100979Srwatson MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label); 1204100979Srwatson 1205100979Srwatson return (result); 1206100979Srwatson} 1207100979Srwatson 1208100979Srwatsonstatic void 1209100979Srwatsonmac_init_label(struct label *label) 1210100979Srwatson{ 1211100979Srwatson 1212100979Srwatson bzero(label, sizeof(*label)); 1213100979Srwatson label->l_flags = MAC_FLAG_INITIALIZED; 1214100979Srwatson} 1215100979Srwatson 1216100979Srwatsonstatic void 1217100979Srwatsonmac_init_structmac(struct mac *mac) 1218100979Srwatson{ 1219100979Srwatson 1220100979Srwatson bzero(mac, sizeof(*mac)); 1221100979Srwatson mac->m_macflags = MAC_FLAG_INITIALIZED; 1222100979Srwatson} 1223100979Srwatson 1224100979Srwatsonstatic void 1225100979Srwatsonmac_destroy_label(struct label *label) 1226100979Srwatson{ 1227100979Srwatson 1228100979Srwatson KASSERT(label->l_flags & MAC_FLAG_INITIALIZED, 1229100979Srwatson ("destroying uninitialized label")); 1230100979Srwatson 1231100979Srwatson bzero(label, sizeof(*label)); 1232100979Srwatson /* implicit: label->l_flags &= ~MAC_FLAG_INITIALIZED; */ 1233100979Srwatson} 1234100979Srwatson 1235100979Srwatsonint 1236100979Srwatsonmac_init_mbuf(struct mbuf *m, int how) 1237100979Srwatson{ 1238100979Srwatson KASSERT(m->m_flags & M_PKTHDR, ("mac_init_mbuf on non-header mbuf")); 1239100979Srwatson 1240100979Srwatson /* "how" is one of M_(TRY|DONT)WAIT */ 1241100979Srwatson mac_init_label(&m->m_pkthdr.label); 1242100979Srwatson MAC_PERFORM(init_mbuf, m, how, &m->m_pkthdr.label); 1243100979Srwatson atomic_add_int(&nmacmbufs, 1); 1244100979Srwatson return (0); 1245100979Srwatson} 1246100979Srwatson 1247100979Srwatsonvoid 1248100979Srwatsonmac_destroy_mbuf(struct mbuf *m) 1249100979Srwatson{ 1250100979Srwatson 1251100979Srwatson MAC_PERFORM(destroy_mbuf, m, &m->m_pkthdr.label); 1252100979Srwatson mac_destroy_label(&m->m_pkthdr.label); 1253100979Srwatson atomic_subtract_int(&nmacmbufs, 1); 1254100979Srwatson} 1255100979Srwatson 1256100979Srwatsonvoid 1257100979Srwatsonmac_init_cred(struct ucred *cr) 1258100979Srwatson{ 1259100979Srwatson 1260100979Srwatson mac_init_label(&cr->cr_label); 1261100979Srwatson MAC_PERFORM(init_cred, cr, &cr->cr_label); 1262100979Srwatson atomic_add_int(&nmaccreds, 1); 1263100979Srwatson} 1264100979Srwatson 1265100979Srwatsonvoid 1266100979Srwatsonmac_destroy_cred(struct ucred *cr) 1267100979Srwatson{ 1268100979Srwatson 1269100979Srwatson MAC_PERFORM(destroy_cred, cr, &cr->cr_label); 1270100979Srwatson mac_destroy_label(&cr->cr_label); 1271100979Srwatson atomic_subtract_int(&nmaccreds, 1); 1272100979Srwatson} 1273100979Srwatson 1274100979Srwatsonvoid 1275100979Srwatsonmac_init_ifnet(struct ifnet *ifp) 1276100979Srwatson{ 1277100979Srwatson 1278100979Srwatson mac_init_label(&ifp->if_label); 1279100979Srwatson MAC_PERFORM(init_ifnet, ifp, &ifp->if_label); 1280100979Srwatson atomic_add_int(&nmacifnets, 1); 1281100979Srwatson} 1282100979Srwatson 1283100979Srwatsonvoid 1284100979Srwatsonmac_destroy_ifnet(struct ifnet *ifp) 1285100979Srwatson{ 1286100979Srwatson 1287100979Srwatson MAC_PERFORM(destroy_ifnet, ifp, &ifp->if_label); 1288100979Srwatson mac_destroy_label(&ifp->if_label); 1289100979Srwatson atomic_subtract_int(&nmacifnets, 1); 1290100979Srwatson} 1291100979Srwatson 1292100979Srwatsonvoid 1293100979Srwatsonmac_init_ipq(struct ipq *ipq) 1294100979Srwatson{ 1295100979Srwatson 1296100979Srwatson mac_init_label(&ipq->ipq_label); 1297100979Srwatson MAC_PERFORM(init_ipq, ipq, &ipq->ipq_label); 1298100979Srwatson atomic_add_int(&nmacipqs, 1); 1299100979Srwatson} 1300100979Srwatson 1301100979Srwatsonvoid 1302100979Srwatsonmac_destroy_ipq(struct ipq *ipq) 1303100979Srwatson{ 1304100979Srwatson 1305100979Srwatson MAC_PERFORM(destroy_ipq, ipq, &ipq->ipq_label); 1306100979Srwatson mac_destroy_label(&ipq->ipq_label); 1307100979Srwatson atomic_subtract_int(&nmacipqs, 1); 1308100979Srwatson} 1309100979Srwatson 1310100979Srwatsonvoid 1311100979Srwatsonmac_init_socket(struct socket *socket) 1312100979Srwatson{ 1313100979Srwatson 1314100979Srwatson mac_init_label(&socket->so_label); 1315100979Srwatson mac_init_label(&socket->so_peerlabel); 1316100979Srwatson MAC_PERFORM(init_socket, socket, &socket->so_label, 1317100979Srwatson &socket->so_peerlabel); 1318100979Srwatson atomic_add_int(&nmacsockets, 1); 1319100979Srwatson} 1320100979Srwatson 1321100979Srwatsonvoid 1322100979Srwatsonmac_destroy_socket(struct socket *socket) 1323100979Srwatson{ 1324100979Srwatson 1325100979Srwatson MAC_PERFORM(destroy_socket, socket, &socket->so_label, 1326100979Srwatson &socket->so_peerlabel); 1327100979Srwatson mac_destroy_label(&socket->so_label); 1328100979Srwatson mac_destroy_label(&socket->so_peerlabel); 1329100979Srwatson atomic_subtract_int(&nmacsockets, 1); 1330100979Srwatson} 1331100979Srwatson 1332100979Srwatsonvoid 1333100979Srwatsonmac_init_pipe(struct pipe *pipe) 1334100979Srwatson{ 1335100979Srwatson struct label *label; 1336100979Srwatson 1337100979Srwatson label = malloc(sizeof(struct label), M_MACPIPELABEL, M_ZERO|M_WAITOK); 1338100979Srwatson mac_init_label(label); 1339100979Srwatson pipe->pipe_label = label; 1340100979Srwatson pipe->pipe_peer->pipe_label = label; 1341100979Srwatson MAC_PERFORM(init_pipe, pipe, pipe->pipe_label); 1342100979Srwatson atomic_add_int(&nmacpipes, 1); 1343100979Srwatson} 1344100979Srwatson 1345100979Srwatsonvoid 1346100979Srwatsonmac_destroy_pipe(struct pipe *pipe) 1347100979Srwatson{ 1348100979Srwatson 1349100979Srwatson MAC_PERFORM(destroy_pipe, pipe, pipe->pipe_label); 1350100979Srwatson mac_destroy_label(pipe->pipe_label); 1351100979Srwatson free(pipe->pipe_label, M_MACPIPELABEL); 1352100979Srwatson atomic_subtract_int(&nmacpipes, 1); 1353100979Srwatson} 1354100979Srwatson 1355100979Srwatsonvoid 1356100979Srwatsonmac_init_bpfdesc(struct bpf_d *bpf_d) 1357100979Srwatson{ 1358100979Srwatson 1359100979Srwatson mac_init_label(&bpf_d->bd_label); 1360100979Srwatson MAC_PERFORM(init_bpfdesc, bpf_d, &bpf_d->bd_label); 1361100979Srwatson atomic_add_int(&nmacbpfdescs, 1); 1362100979Srwatson} 1363100979Srwatson 1364100979Srwatsonvoid 1365100979Srwatsonmac_destroy_bpfdesc(struct bpf_d *bpf_d) 1366100979Srwatson{ 1367100979Srwatson 1368100979Srwatson MAC_PERFORM(destroy_bpfdesc, bpf_d, &bpf_d->bd_label); 1369100979Srwatson mac_destroy_label(&bpf_d->bd_label); 1370100979Srwatson atomic_subtract_int(&nmacbpfdescs, 1); 1371100979Srwatson} 1372100979Srwatson 1373100979Srwatsonvoid 1374100979Srwatsonmac_init_mount(struct mount *mp) 1375100979Srwatson{ 1376100979Srwatson 1377100979Srwatson mac_init_label(&mp->mnt_mntlabel); 1378100979Srwatson mac_init_label(&mp->mnt_fslabel); 1379100979Srwatson MAC_PERFORM(init_mount, mp, &mp->mnt_mntlabel, &mp->mnt_fslabel); 1380100979Srwatson atomic_add_int(&nmacmounts, 1); 1381100979Srwatson} 1382100979Srwatson 1383100979Srwatsonvoid 1384100979Srwatsonmac_destroy_mount(struct mount *mp) 1385100979Srwatson{ 1386100979Srwatson 1387100979Srwatson MAC_PERFORM(destroy_mount, mp, &mp->mnt_mntlabel, &mp->mnt_fslabel); 1388100979Srwatson mac_destroy_label(&mp->mnt_fslabel); 1389100979Srwatson mac_destroy_label(&mp->mnt_mntlabel); 1390100979Srwatson atomic_subtract_int(&nmacmounts, 1); 1391100979Srwatson} 1392100979Srwatson 1393100979Srwatsonstatic void 1394100979Srwatsonmac_init_temp(struct label *label) 1395100979Srwatson{ 1396100979Srwatson 1397100979Srwatson mac_init_label(label); 1398100979Srwatson MAC_PERFORM(init_temp, label); 1399100979Srwatson atomic_add_int(&nmactemp, 1); 1400100979Srwatson} 1401100979Srwatson 1402100979Srwatsonstatic void 1403100979Srwatsonmac_destroy_temp(struct label *label) 1404100979Srwatson{ 1405100979Srwatson 1406100979Srwatson MAC_PERFORM(destroy_temp, label); 1407100979Srwatson mac_destroy_label(label); 1408100979Srwatson atomic_subtract_int(&nmactemp, 1); 1409100979Srwatson} 1410100979Srwatson 1411100979Srwatsonvoid 1412100979Srwatsonmac_init_vnode(struct vnode *vp) 1413100979Srwatson{ 1414100979Srwatson 1415100979Srwatson mac_init_label(&vp->v_label); 1416100979Srwatson MAC_PERFORM(init_vnode, vp, &vp->v_label); 1417100979Srwatson atomic_add_int(&nmacvnodes, 1); 1418100979Srwatson} 1419100979Srwatson 1420100979Srwatsonvoid 1421100979Srwatsonmac_destroy_vnode(struct vnode *vp) 1422100979Srwatson{ 1423100979Srwatson 1424100979Srwatson MAC_PERFORM(destroy_vnode, vp, &vp->v_label); 1425100979Srwatson mac_destroy_label(&vp->v_label); 1426100979Srwatson atomic_subtract_int(&nmacvnodes, 1); 1427100979Srwatson} 1428100979Srwatson 1429100979Srwatsonvoid 1430100979Srwatsonmac_init_devfsdirent(struct devfs_dirent *de) 1431100979Srwatson{ 1432100979Srwatson 1433100979Srwatson mac_init_label(&de->de_label); 1434100979Srwatson MAC_PERFORM(init_devfsdirent, de, &de->de_label); 1435100979Srwatson atomic_add_int(&nmacdevfsdirents, 1); 1436100979Srwatson} 1437100979Srwatson 1438100979Srwatsonvoid 1439100979Srwatsonmac_destroy_devfsdirent(struct devfs_dirent *de) 1440100979Srwatson{ 1441100979Srwatson 1442100979Srwatson MAC_PERFORM(destroy_devfsdirent, de, &de->de_label); 1443100979Srwatson mac_destroy_label(&de->de_label); 1444100979Srwatson atomic_subtract_int(&nmacdevfsdirents, 1); 1445100979Srwatson} 1446100979Srwatson 1447100979Srwatsonstatic int 1448100979Srwatsonmac_externalize(struct label *label, struct mac *mac) 1449100979Srwatson{ 1450100979Srwatson int error; 1451100979Srwatson 1452100979Srwatson mac_init_structmac(mac); 1453100979Srwatson MAC_CHECK(externalize, label, mac); 1454100979Srwatson 1455100979Srwatson return (error); 1456100979Srwatson} 1457100979Srwatson 1458100979Srwatsonstatic int 1459100979Srwatsonmac_internalize(struct label *label, struct mac *mac) 1460100979Srwatson{ 1461100979Srwatson int error; 1462100979Srwatson 1463100979Srwatson mac_init_temp(label); 1464100979Srwatson MAC_CHECK(internalize, label, mac); 1465100979Srwatson if (error) 1466100979Srwatson mac_destroy_temp(label); 1467100979Srwatson 1468100979Srwatson return (error); 1469100979Srwatson} 1470100979Srwatson 1471100979Srwatson/* 1472100979Srwatson * Initialize MAC label for the first kernel process, from which other 1473100979Srwatson * kernel processes and threads are spawned. 1474100979Srwatson */ 1475100979Srwatsonvoid 1476100979Srwatsonmac_create_proc0(struct ucred *cred) 1477100979Srwatson{ 1478100979Srwatson 1479100979Srwatson MAC_PERFORM(create_proc0, cred); 1480100979Srwatson} 1481100979Srwatson 1482100979Srwatson/* 1483100979Srwatson * Initialize MAC label for the first userland process, from which other 1484100979Srwatson * userland processes and threads are spawned. 1485100979Srwatson */ 1486100979Srwatsonvoid 1487100979Srwatsonmac_create_proc1(struct ucred *cred) 1488100979Srwatson{ 1489100979Srwatson 1490100979Srwatson MAC_PERFORM(create_proc1, cred); 1491100979Srwatson} 1492100979Srwatson 1493100979Srwatson/* 1494100979Srwatson * When a new process is created, its label must be initialized. Generally, 1495100979Srwatson * this involves inheritence from the parent process, modulo possible 1496100979Srwatson * deltas. This function allows that processing to take place. 1497100979Srwatson */ 1498100979Srwatsonvoid 1499100979Srwatsonmac_create_cred(struct ucred *parent_cred, struct ucred *child_cred) 1500100979Srwatson{ 1501100979Srwatson 1502100979Srwatson MAC_PERFORM(create_cred, parent_cred, child_cred); 1503100979Srwatson} 1504100979Srwatson 1505100979Srwatsonint 1506100979Srwatsonmac_check_vnode_access(struct ucred *cred, struct vnode *vp, int flags) 1507100979Srwatson{ 1508100979Srwatson int error; 1509100979Srwatson 1510100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_access"); 1511100979Srwatson 1512100979Srwatson if (!mac_enforce_fs) 1513100979Srwatson return (0); 1514100979Srwatson 1515100979Srwatson error = vn_refreshlabel(vp, cred); 1516100979Srwatson if (error) 1517100979Srwatson return (error); 1518100979Srwatson 1519100979Srwatson MAC_CHECK(check_vnode_access, cred, vp, &vp->v_label, flags); 1520100979Srwatson return (error); 1521100979Srwatson} 1522100979Srwatson 1523100979Srwatsonint 1524100979Srwatsonmac_check_vnode_chdir(struct ucred *cred, struct vnode *dvp) 1525100979Srwatson{ 1526100979Srwatson int error; 1527100979Srwatson 1528100979Srwatson ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_chdir"); 1529100979Srwatson 1530100979Srwatson if (!mac_enforce_fs) 1531100979Srwatson return (0); 1532100979Srwatson 1533100979Srwatson error = vn_refreshlabel(dvp, cred); 1534100979Srwatson if (error) 1535100979Srwatson return (error); 1536100979Srwatson 1537100979Srwatson MAC_CHECK(check_vnode_chdir, cred, dvp, &dvp->v_label); 1538100979Srwatson return (error); 1539100979Srwatson} 1540100979Srwatson 1541100979Srwatsonint 1542100979Srwatsonmac_check_vnode_chroot(struct ucred *cred, struct vnode *dvp) 1543100979Srwatson{ 1544100979Srwatson int error; 1545100979Srwatson 1546100979Srwatson ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_chroot"); 1547100979Srwatson 1548100979Srwatson if (!mac_enforce_fs) 1549100979Srwatson return (0); 1550100979Srwatson 1551100979Srwatson error = vn_refreshlabel(dvp, cred); 1552100979Srwatson if (error) 1553100979Srwatson return (error); 1554100979Srwatson 1555100979Srwatson MAC_CHECK(check_vnode_chroot, cred, dvp, &dvp->v_label); 1556100979Srwatson return (error); 1557100979Srwatson} 1558100979Srwatson 1559100979Srwatsonint 1560100979Srwatsonmac_check_vnode_create(struct ucred *cred, struct vnode *dvp, 1561100979Srwatson struct componentname *cnp, struct vattr *vap) 1562100979Srwatson{ 1563100979Srwatson int error; 1564100979Srwatson 1565100979Srwatson ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_create"); 1566100979Srwatson 1567100979Srwatson if (!mac_enforce_fs) 1568100979Srwatson return (0); 1569100979Srwatson 1570100979Srwatson error = vn_refreshlabel(dvp, cred); 1571100979Srwatson if (error) 1572100979Srwatson return (error); 1573100979Srwatson 1574100979Srwatson MAC_CHECK(check_vnode_create, cred, dvp, &dvp->v_label, cnp, vap); 1575100979Srwatson return (error); 1576100979Srwatson} 1577100979Srwatson 1578100979Srwatsonint 1579100979Srwatsonmac_check_vnode_delete(struct ucred *cred, struct vnode *dvp, struct vnode *vp, 1580100979Srwatson struct componentname *cnp) 1581100979Srwatson{ 1582100979Srwatson int error; 1583100979Srwatson 1584100979Srwatson ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_delete"); 1585100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_delete"); 1586100979Srwatson 1587100979Srwatson if (!mac_enforce_fs) 1588100979Srwatson return (0); 1589100979Srwatson 1590100979Srwatson error = vn_refreshlabel(dvp, cred); 1591100979Srwatson if (error) 1592100979Srwatson return (error); 1593100979Srwatson error = vn_refreshlabel(vp, cred); 1594100979Srwatson if (error) 1595100979Srwatson return (error); 1596100979Srwatson 1597100979Srwatson MAC_CHECK(check_vnode_delete, cred, dvp, &dvp->v_label, vp, 1598100979Srwatson &vp->v_label, cnp); 1599100979Srwatson return (error); 1600100979Srwatson} 1601100979Srwatson 1602100979Srwatsonint 1603100979Srwatsonmac_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp, 1604100979Srwatson acl_type_t type) 1605100979Srwatson{ 1606100979Srwatson int error; 1607100979Srwatson 1608100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_deleteacl"); 1609100979Srwatson 1610100979Srwatson if (!mac_enforce_fs) 1611100979Srwatson return (0); 1612100979Srwatson 1613100979Srwatson error = vn_refreshlabel(vp, cred); 1614100979Srwatson if (error) 1615100979Srwatson return (error); 1616100979Srwatson 1617100979Srwatson MAC_CHECK(check_vnode_deleteacl, cred, vp, &vp->v_label, type); 1618100979Srwatson return (error); 1619100979Srwatson} 1620100979Srwatson 1621100979Srwatsonint 1622100979Srwatsonmac_check_vnode_exec(struct ucred *cred, struct vnode *vp) 1623100979Srwatson{ 1624100979Srwatson int error; 1625100979Srwatson 1626100979Srwatson if (!mac_enforce_process && !mac_enforce_fs) 1627100979Srwatson return (0); 1628100979Srwatson 1629100979Srwatson error = vn_refreshlabel(vp, cred); 1630100979Srwatson if (error) 1631100979Srwatson return (error); 1632100979Srwatson MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label); 1633100979Srwatson 1634100979Srwatson return (error); 1635100979Srwatson} 1636100979Srwatson 1637100979Srwatsonint 1638100979Srwatsonmac_check_vnode_getacl(struct ucred *cred, struct vnode *vp, acl_type_t type) 1639100979Srwatson{ 1640100979Srwatson int error; 1641100979Srwatson 1642100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_getacl"); 1643100979Srwatson 1644100979Srwatson if (!mac_enforce_fs) 1645100979Srwatson return (0); 1646100979Srwatson 1647100979Srwatson error = vn_refreshlabel(vp, cred); 1648100979Srwatson if (error) 1649100979Srwatson return (error); 1650100979Srwatson 1651100979Srwatson MAC_CHECK(check_vnode_getacl, cred, vp, &vp->v_label, type); 1652100979Srwatson return (error); 1653100979Srwatson} 1654100979Srwatson 1655100979Srwatsonint 1656100979Srwatsonmac_check_vnode_getextattr(struct ucred *cred, struct vnode *vp, 1657100979Srwatson int attrnamespace, const char *name, struct uio *uio) 1658100979Srwatson{ 1659100979Srwatson int error; 1660100979Srwatson 1661100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_getextattr"); 1662100979Srwatson 1663100979Srwatson if (!mac_enforce_fs) 1664100979Srwatson return (0); 1665100979Srwatson 1666100979Srwatson error = vn_refreshlabel(vp, cred); 1667100979Srwatson if (error) 1668100979Srwatson return (error); 1669100979Srwatson 1670100979Srwatson MAC_CHECK(check_vnode_getextattr, cred, vp, &vp->v_label, 1671100979Srwatson attrnamespace, name, uio); 1672100979Srwatson return (error); 1673100979Srwatson} 1674100979Srwatson 1675100979Srwatsonint 1676100979Srwatsonmac_check_vnode_lookup(struct ucred *cred, struct vnode *dvp, 1677100979Srwatson struct componentname *cnp) 1678100979Srwatson{ 1679100979Srwatson int error; 1680100979Srwatson 1681100979Srwatson ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_lookup"); 1682100979Srwatson 1683100979Srwatson if (!mac_enforce_fs) 1684100979Srwatson return (0); 1685100979Srwatson 1686100979Srwatson error = vn_refreshlabel(dvp, cred); 1687100979Srwatson if (error) 1688100979Srwatson return (error); 1689100979Srwatson 1690100979Srwatson MAC_CHECK(check_vnode_lookup, cred, dvp, &dvp->v_label, cnp); 1691100979Srwatson return (error); 1692100979Srwatson} 1693100979Srwatson 1694100979Srwatsonvm_prot_t 1695100979Srwatsonmac_check_vnode_mmap_prot(struct ucred *cred, struct vnode *vp, int newmapping) 1696100979Srwatson{ 1697100979Srwatson vm_prot_t result = VM_PROT_ALL; 1698100979Srwatson 1699100979Srwatson /* 1700100979Srwatson * This should be some sort of MAC_BITWISE, maybe :) 1701100979Srwatson */ 1702100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_mmap_perms"); 1703100979Srwatson MAC_BOOLEAN(check_vnode_mmap_perms, &, cred, vp, &vp->v_label, 1704100979Srwatson newmapping); 1705100979Srwatson return (result); 1706100979Srwatson} 1707100979Srwatson 1708100979Srwatsonint 1709100979Srwatsonmac_check_vnode_op(struct ucred *cred, struct vnode *vp, int op) 1710100979Srwatson{ 1711100979Srwatson int error; 1712100979Srwatson 1713100979Srwatson if (!mac_enforce_fs) 1714100979Srwatson return (0); 1715100979Srwatson 1716100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_op"); 1717100979Srwatson 1718100979Srwatson error = vn_refreshlabel(vp, cred); 1719100979Srwatson if (error) 1720100979Srwatson return (error); 1721100979Srwatson 1722100979Srwatson MAC_CHECK(check_vnode_op, cred, vp, &vp->v_label, op); 1723100979Srwatson 1724100979Srwatson return (error); 1725100979Srwatson} 1726100979Srwatson 1727100979Srwatsonint 1728100979Srwatsonmac_check_vnode_open(struct ucred *cred, struct vnode *vp, mode_t acc_mode) 1729100979Srwatson{ 1730100979Srwatson int error; 1731100979Srwatson 1732100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_open"); 1733100979Srwatson 1734100979Srwatson if (!mac_enforce_fs) 1735100979Srwatson return (0); 1736100979Srwatson 1737100979Srwatson error = vn_refreshlabel(vp, cred); 1738100979Srwatson if (error) 1739100979Srwatson return (error); 1740100979Srwatson 1741100979Srwatson MAC_CHECK(check_vnode_open, cred, vp, &vp->v_label, acc_mode); 1742100979Srwatson return (error); 1743100979Srwatson} 1744100979Srwatson 1745100979Srwatsonint 1746100979Srwatsonmac_check_vnode_readdir(struct ucred *cred, struct vnode *dvp) 1747100979Srwatson{ 1748100979Srwatson int error; 1749100979Srwatson 1750100979Srwatson ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_readdir"); 1751100979Srwatson 1752100979Srwatson if (!mac_enforce_fs) 1753100979Srwatson return (0); 1754100979Srwatson 1755100979Srwatson error = vn_refreshlabel(dvp, cred); 1756100979Srwatson if (error) 1757100979Srwatson return (error); 1758100979Srwatson 1759100979Srwatson MAC_CHECK(check_vnode_readdir, cred, dvp, &dvp->v_label); 1760100979Srwatson return (error); 1761100979Srwatson} 1762100979Srwatson 1763100979Srwatsonint 1764100979Srwatsonmac_check_vnode_readlink(struct ucred *cred, struct vnode *vp) 1765100979Srwatson{ 1766100979Srwatson int error; 1767100979Srwatson 1768100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_readlink"); 1769100979Srwatson 1770100979Srwatson if (!mac_enforce_fs) 1771100979Srwatson return (0); 1772100979Srwatson 1773100979Srwatson error = vn_refreshlabel(vp, cred); 1774100979Srwatson if (error) 1775100979Srwatson return (error); 1776100979Srwatson 1777100979Srwatson MAC_CHECK(check_vnode_readlink, cred, vp, &vp->v_label); 1778100979Srwatson return (error); 1779100979Srwatson} 1780100979Srwatson 1781100979Srwatsonstatic int 1782100979Srwatsonmac_check_vnode_relabel(struct ucred *cred, struct vnode *vp, 1783100979Srwatson struct label *newlabel) 1784100979Srwatson{ 1785100979Srwatson int error; 1786100979Srwatson 1787100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_relabel"); 1788100979Srwatson 1789100979Srwatson error = vn_refreshlabel(vp, cred); 1790100979Srwatson if (error) 1791100979Srwatson return (error); 1792100979Srwatson 1793100979Srwatson MAC_CHECK(check_vnode_relabel, cred, vp, &vp->v_label, newlabel); 1794100979Srwatson 1795100979Srwatson return (error); 1796100979Srwatson} 1797100979Srwatson 1798100979Srwatsonint 1799100979Srwatsonmac_check_vnode_rename_from(struct ucred *cred, struct vnode *dvp, 1800100979Srwatson struct vnode *vp, struct componentname *cnp) 1801100979Srwatson{ 1802100979Srwatson int error; 1803100979Srwatson 1804100979Srwatson ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_rename_from"); 1805100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_rename_from"); 1806100979Srwatson 1807100979Srwatson if (!mac_enforce_fs) 1808100979Srwatson return (0); 1809100979Srwatson 1810100979Srwatson error = vn_refreshlabel(dvp, cred); 1811100979Srwatson if (error) 1812100979Srwatson return (error); 1813100979Srwatson error = vn_refreshlabel(vp, cred); 1814100979Srwatson if (error) 1815100979Srwatson return (error); 1816100979Srwatson 1817100979Srwatson MAC_CHECK(check_vnode_rename_from, cred, dvp, &dvp->v_label, vp, 1818100979Srwatson &vp->v_label, cnp); 1819100979Srwatson return (error); 1820100979Srwatson} 1821100979Srwatson 1822100979Srwatsonint 1823100979Srwatsonmac_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp, 1824100979Srwatson struct vnode *vp, int samedir, struct componentname *cnp) 1825100979Srwatson{ 1826100979Srwatson int error; 1827100979Srwatson 1828100979Srwatson ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_rename_to"); 1829100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_rename_to"); 1830100979Srwatson 1831100979Srwatson if (!mac_enforce_fs) 1832100979Srwatson return (0); 1833100979Srwatson 1834100979Srwatson error = vn_refreshlabel(dvp, cred); 1835100979Srwatson if (error) 1836100979Srwatson return (error); 1837100979Srwatson if (vp != NULL) { 1838100979Srwatson error = vn_refreshlabel(vp, cred); 1839100979Srwatson if (error) 1840100979Srwatson return (error); 1841100979Srwatson } 1842100979Srwatson MAC_CHECK(check_vnode_rename_to, cred, dvp, &dvp->v_label, vp, 1843100979Srwatson vp != NULL ? &vp->v_label : NULL, samedir, cnp); 1844100979Srwatson return (error); 1845100979Srwatson} 1846100979Srwatson 1847100979Srwatsonint 1848100979Srwatsonmac_check_vnode_revoke(struct ucred *cred, struct vnode *vp) 1849100979Srwatson{ 1850100979Srwatson int error; 1851100979Srwatson 1852100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_revoke"); 1853100979Srwatson 1854100979Srwatson if (!mac_enforce_fs) 1855100979Srwatson return (0); 1856100979Srwatson 1857100979Srwatson error = vn_refreshlabel(vp, cred); 1858100979Srwatson if (error) 1859100979Srwatson return (error); 1860100979Srwatson 1861100979Srwatson MAC_CHECK(check_vnode_revoke, cred, vp, &vp->v_label); 1862100979Srwatson return (error); 1863100979Srwatson} 1864100979Srwatson 1865100979Srwatsonint 1866100979Srwatsonmac_check_vnode_setacl(struct ucred *cred, struct vnode *vp, acl_type_t type, 1867100979Srwatson struct acl *acl) 1868100979Srwatson{ 1869100979Srwatson int error; 1870100979Srwatson 1871100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setacl"); 1872100979Srwatson 1873100979Srwatson if (!mac_enforce_fs) 1874100979Srwatson return (0); 1875100979Srwatson 1876100979Srwatson error = vn_refreshlabel(vp, cred); 1877100979Srwatson if (error) 1878100979Srwatson return (error); 1879100979Srwatson 1880100979Srwatson MAC_CHECK(check_vnode_setacl, cred, vp, &vp->v_label, type, acl); 1881100979Srwatson return (error); 1882100979Srwatson} 1883100979Srwatson 1884100979Srwatsonint 1885100979Srwatsonmac_check_vnode_setextattr(struct ucred *cred, struct vnode *vp, 1886100979Srwatson int attrnamespace, const char *name, struct uio *uio) 1887100979Srwatson{ 1888100979Srwatson int error; 1889100979Srwatson 1890100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setextattr"); 1891100979Srwatson 1892100979Srwatson if (!mac_enforce_fs) 1893100979Srwatson return (0); 1894100979Srwatson 1895100979Srwatson error = vn_refreshlabel(vp, cred); 1896100979Srwatson if (error) 1897100979Srwatson return (error); 1898100979Srwatson 1899100979Srwatson MAC_CHECK(check_vnode_setextattr, cred, vp, &vp->v_label, 1900100979Srwatson attrnamespace, name, uio); 1901100979Srwatson return (error); 1902100979Srwatson} 1903100979Srwatson 1904100979Srwatsonint 1905100979Srwatsonmac_check_vnode_setflags(struct ucred *cred, struct vnode *vp, u_long flags) 1906100979Srwatson{ 1907100979Srwatson int error; 1908100979Srwatson 1909100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setflags"); 1910100979Srwatson 1911100979Srwatson if (!mac_enforce_fs) 1912100979Srwatson return (0); 1913100979Srwatson 1914100979Srwatson error = vn_refreshlabel(vp, cred); 1915100979Srwatson if (error) 1916100979Srwatson return (error); 1917100979Srwatson 1918100979Srwatson MAC_CHECK(check_vnode_setflags, cred, vp, &vp->v_label, flags); 1919100979Srwatson return (error); 1920100979Srwatson} 1921100979Srwatson 1922100979Srwatsonint 1923100979Srwatsonmac_check_vnode_setmode(struct ucred *cred, struct vnode *vp, mode_t mode) 1924100979Srwatson{ 1925100979Srwatson int error; 1926100979Srwatson 1927100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setmode"); 1928100979Srwatson 1929100979Srwatson if (!mac_enforce_fs) 1930100979Srwatson return (0); 1931100979Srwatson 1932100979Srwatson error = vn_refreshlabel(vp, cred); 1933100979Srwatson if (error) 1934100979Srwatson return (error); 1935100979Srwatson 1936100979Srwatson MAC_CHECK(check_vnode_setmode, cred, vp, &vp->v_label, mode); 1937100979Srwatson return (error); 1938100979Srwatson} 1939100979Srwatson 1940100979Srwatsonint 1941100979Srwatsonmac_check_vnode_setowner(struct ucred *cred, struct vnode *vp, uid_t uid, 1942100979Srwatson gid_t gid) 1943100979Srwatson{ 1944100979Srwatson int error; 1945100979Srwatson 1946100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setowner"); 1947100979Srwatson 1948100979Srwatson if (!mac_enforce_fs) 1949100979Srwatson return (0); 1950100979Srwatson 1951100979Srwatson error = vn_refreshlabel(vp, cred); 1952100979Srwatson if (error) 1953100979Srwatson return (error); 1954100979Srwatson 1955100979Srwatson MAC_CHECK(check_vnode_setowner, cred, vp, &vp->v_label, uid, gid); 1956100979Srwatson return (error); 1957100979Srwatson} 1958100979Srwatson 1959100979Srwatsonint 1960100979Srwatsonmac_check_vnode_setutimes(struct ucred *cred, struct vnode *vp, 1961100979Srwatson struct timespec atime, struct timespec mtime) 1962100979Srwatson{ 1963100979Srwatson int error; 1964100979Srwatson 1965100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setutimes"); 1966100979Srwatson 1967100979Srwatson if (!mac_enforce_fs) 1968100979Srwatson return (0); 1969100979Srwatson 1970100979Srwatson error = vn_refreshlabel(vp, cred); 1971100979Srwatson if (error) 1972100979Srwatson return (error); 1973100979Srwatson 1974100979Srwatson MAC_CHECK(check_vnode_setutimes, cred, vp, &vp->v_label, atime, 1975100979Srwatson mtime); 1976100979Srwatson return (error); 1977100979Srwatson} 1978100979Srwatson 1979100979Srwatsonint 1980100979Srwatsonmac_check_vnode_stat(struct ucred *cred, struct vnode *vp) 1981100979Srwatson{ 1982100979Srwatson int error; 1983100979Srwatson 1984100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_stat"); 1985100979Srwatson 1986100979Srwatson if (!mac_enforce_fs) 1987100979Srwatson return (0); 1988100979Srwatson 1989100979Srwatson error = vn_refreshlabel(vp, cred); 1990100979Srwatson if (error) 1991100979Srwatson return (error); 1992100979Srwatson 1993100979Srwatson MAC_CHECK(check_vnode_stat, cred, vp, &vp->v_label); 1994100979Srwatson return (error); 1995100979Srwatson} 1996100979Srwatson 1997100979Srwatson/* 1998100979Srwatson * When relabeling a process, call out to the policies for the maximum 1999100979Srwatson * permission allowed for each object type we know about in its 2000100979Srwatson * memory space, and revoke access (in the least surprising ways we 2001100979Srwatson * know) when necessary. The process lock is not held here. 2002100979Srwatson */ 2003100979Srwatsonstatic void 2004100979Srwatsonmac_cred_mmapped_drop_perms(struct thread *td, struct ucred *cred) 2005100979Srwatson{ 2006100979Srwatson 2007100979Srwatson /* XXX freeze all other threads */ 2008100979Srwatson mtx_lock(&Giant); 2009100979Srwatson mac_cred_mmapped_drop_perms_recurse(td, cred, 2010100979Srwatson &td->td_proc->p_vmspace->vm_map); 2011100979Srwatson mtx_unlock(&Giant); 2012100979Srwatson /* XXX allow other threads to continue */ 2013100979Srwatson} 2014100979Srwatson 2015100979Srwatsonstatic __inline const char * 2016100979Srwatsonprot2str(vm_prot_t prot) 2017100979Srwatson{ 2018100979Srwatson 2019100979Srwatson switch (prot & VM_PROT_ALL) { 2020100979Srwatson case VM_PROT_READ: 2021100979Srwatson return ("r--"); 2022100979Srwatson case VM_PROT_READ | VM_PROT_WRITE: 2023100979Srwatson return ("rw-"); 2024100979Srwatson case VM_PROT_READ | VM_PROT_EXECUTE: 2025100979Srwatson return ("r-x"); 2026100979Srwatson case VM_PROT_READ | VM_PROT_WRITE | VM_PROT_EXECUTE: 2027100979Srwatson return ("rwx"); 2028100979Srwatson case VM_PROT_WRITE: 2029100979Srwatson return ("-w-"); 2030100979Srwatson case VM_PROT_EXECUTE: 2031100979Srwatson return ("--x"); 2032100979Srwatson case VM_PROT_WRITE | VM_PROT_EXECUTE: 2033100979Srwatson return ("-wx"); 2034100979Srwatson default: 2035100979Srwatson return ("---"); 2036100979Srwatson } 2037100979Srwatson} 2038100979Srwatson 2039100979Srwatsonstatic void 2040100979Srwatsonmac_cred_mmapped_drop_perms_recurse(struct thread *td, struct ucred *cred, 2041100979Srwatson struct vm_map *map) 2042100979Srwatson{ 2043100979Srwatson struct vm_map_entry *vme; 2044100979Srwatson vm_prot_t result, revokeperms; 2045100979Srwatson vm_object_t object; 2046100979Srwatson vm_ooffset_t offset; 2047100979Srwatson struct vnode *vp; 2048100979Srwatson 2049100979Srwatson vm_map_lock_read(map); 2050100979Srwatson for (vme = map->header.next; vme != &map->header; vme = vme->next) { 2051100979Srwatson if (vme->eflags & MAP_ENTRY_IS_SUB_MAP) { 2052100979Srwatson mac_cred_mmapped_drop_perms_recurse(td, cred, 2053100979Srwatson vme->object.sub_map); 2054100979Srwatson continue; 2055100979Srwatson } 2056100979Srwatson /* 2057100979Srwatson * Skip over entries that obviously are not shared. 2058100979Srwatson */ 2059100979Srwatson if (vme->eflags & (MAP_ENTRY_COW | MAP_ENTRY_NOSYNC) || 2060100979Srwatson !vme->max_protection) 2061100979Srwatson continue; 2062100979Srwatson /* 2063100979Srwatson * Drill down to the deepest backing object. 2064100979Srwatson */ 2065100979Srwatson offset = vme->offset; 2066100979Srwatson object = vme->object.vm_object; 2067100979Srwatson if (object == NULL) 2068100979Srwatson continue; 2069100979Srwatson while (object->backing_object != NULL) { 2070100979Srwatson object = object->backing_object; 2071100979Srwatson offset += object->backing_object_offset; 2072100979Srwatson } 2073100979Srwatson /* 2074100979Srwatson * At the moment, vm_maps and objects aren't considered 2075100979Srwatson * by the MAC system, so only things with backing by a 2076100979Srwatson * normal object (read: vnodes) are checked. 2077100979Srwatson */ 2078100979Srwatson if (object->type != OBJT_VNODE) 2079100979Srwatson continue; 2080100979Srwatson vp = (struct vnode *)object->handle; 2081100979Srwatson vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); 2082100979Srwatson result = mac_check_vnode_mmap_prot(cred, vp, 0); 2083100979Srwatson VOP_UNLOCK(vp, 0, td); 2084100979Srwatson /* 2085100979Srwatson * Find out what maximum protection we may be allowing 2086100979Srwatson * now but a policy needs to get removed. 2087100979Srwatson */ 2088100979Srwatson revokeperms = vme->max_protection & ~result; 2089100979Srwatson if (!revokeperms) 2090100979Srwatson continue; 2091100979Srwatson printf("pid %d: revoking %s perms from %#lx:%d " 2092100979Srwatson "(max %s/cur %s)\n", td->td_proc->p_pid, 2093100979Srwatson prot2str(revokeperms), vme->start, vme->end - vme->start, 2094100979Srwatson prot2str(vme->max_protection), prot2str(vme->protection)); 2095100979Srwatson vm_map_lock_upgrade(map); 2096100979Srwatson /* 2097100979Srwatson * This is the really simple case: if a map has more 2098100979Srwatson * max_protection than is allowed, but it's not being 2099100979Srwatson * actually used (that is, the current protection is 2100100979Srwatson * still allowed), we can just wipe it out and do 2101100979Srwatson * nothing more. 2102100979Srwatson */ 2103100979Srwatson if ((vme->protection & revokeperms) == 0) { 2104100979Srwatson vme->max_protection -= revokeperms; 2105100979Srwatson } else { 2106100979Srwatson if (revokeperms & VM_PROT_WRITE) { 2107100979Srwatson /* 2108100979Srwatson * In the more complicated case, flush out all 2109100979Srwatson * pending changes to the object then turn it 2110100979Srwatson * copy-on-write. 2111100979Srwatson */ 2112100979Srwatson vm_object_reference(object); 2113100979Srwatson vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); 2114100979Srwatson vm_object_page_clean(object, 2115100979Srwatson OFF_TO_IDX(offset), 2116100979Srwatson OFF_TO_IDX(offset + vme->end - vme->start + 2117100979Srwatson PAGE_MASK), 2118100979Srwatson OBJPC_SYNC); 2119100979Srwatson VOP_UNLOCK(vp, 0, td); 2120100979Srwatson vm_object_deallocate(object); 2121100979Srwatson /* 2122100979Srwatson * Why bother if there's no read permissions 2123100979Srwatson * anymore? For the rest, we need to leave 2124100979Srwatson * the write permissions on for COW, or 2125100979Srwatson * remove them entirely if configured to. 2126100979Srwatson */ 2127100979Srwatson if (!mac_mmap_revocation_via_cow) { 2128100979Srwatson vme->max_protection &= ~VM_PROT_WRITE; 2129100979Srwatson vme->protection &= ~VM_PROT_WRITE; 2130100979Srwatson } if ((revokeperms & VM_PROT_READ) == 0) 2131100979Srwatson vme->eflags |= MAP_ENTRY_COW | 2132100979Srwatson MAP_ENTRY_NEEDS_COPY; 2133100979Srwatson } 2134100979Srwatson if (revokeperms & VM_PROT_EXECUTE) { 2135100979Srwatson vme->max_protection &= ~VM_PROT_EXECUTE; 2136100979Srwatson vme->protection &= ~VM_PROT_EXECUTE; 2137100979Srwatson } 2138100979Srwatson if (revokeperms & VM_PROT_READ) { 2139100979Srwatson vme->max_protection = 0; 2140100979Srwatson vme->protection = 0; 2141100979Srwatson } 2142100979Srwatson pmap_protect(map->pmap, vme->start, vme->end, 2143100979Srwatson vme->protection & ~revokeperms); 2144100979Srwatson vm_map_simplify_entry(map, vme); 2145100979Srwatson } 2146100979Srwatson vm_map_lock_downgrade(map); 2147100979Srwatson } 2148100979Srwatson vm_map_unlock_read(map); 2149100979Srwatson} 2150100979Srwatson 2151100979Srwatson/* 2152100979Srwatson * When the subject's label changes, it may require revocation of privilege 2153100979Srwatson * to mapped objects. This can't be done on-the-fly later with a unified 2154100979Srwatson * buffer cache. 2155100979Srwatson */ 2156100979Srwatsonstatic void 2157100979Srwatsonmac_relabel_cred(struct ucred *cred, struct label *newlabel) 2158100979Srwatson{ 2159100979Srwatson 2160100979Srwatson MAC_PERFORM(relabel_cred, cred, newlabel); 2161100979Srwatson mac_cred_mmapped_drop_perms(curthread, cred); 2162100979Srwatson} 2163100979Srwatson 2164100979Srwatsonvoid 2165100979Srwatsonmac_relabel_vnode(struct ucred *cred, struct vnode *vp, struct label *newlabel) 2166100979Srwatson{ 2167100979Srwatson 2168100979Srwatson MAC_PERFORM(relabel_vnode, cred, vp, &vp->v_label, newlabel); 2169100979Srwatson} 2170100979Srwatson 2171100979Srwatsonvoid 2172100979Srwatsonmac_create_ifnet(struct ifnet *ifnet) 2173100979Srwatson{ 2174100979Srwatson 2175100979Srwatson MAC_PERFORM(create_ifnet, ifnet, &ifnet->if_label); 2176100979Srwatson} 2177100979Srwatson 2178100979Srwatsonvoid 2179100979Srwatsonmac_create_bpfdesc(struct ucred *cred, struct bpf_d *bpf_d) 2180100979Srwatson{ 2181100979Srwatson 2182100979Srwatson MAC_PERFORM(create_bpfdesc, cred, bpf_d, &bpf_d->bd_label); 2183100979Srwatson} 2184100979Srwatson 2185100979Srwatsonvoid 2186100979Srwatsonmac_create_socket(struct ucred *cred, struct socket *socket) 2187100979Srwatson{ 2188100979Srwatson 2189100979Srwatson MAC_PERFORM(create_socket, cred, socket, &socket->so_label); 2190100979Srwatson} 2191100979Srwatson 2192100979Srwatsonvoid 2193100979Srwatsonmac_create_pipe(struct ucred *cred, struct pipe *pipe) 2194100979Srwatson{ 2195100979Srwatson 2196100979Srwatson MAC_PERFORM(create_pipe, cred, pipe, pipe->pipe_label); 2197100979Srwatson} 2198100979Srwatson 2199100979Srwatsonvoid 2200100979Srwatsonmac_create_socket_from_socket(struct socket *oldsocket, 2201100979Srwatson struct socket *newsocket) 2202100979Srwatson{ 2203100979Srwatson 2204100979Srwatson MAC_PERFORM(create_socket_from_socket, oldsocket, &oldsocket->so_label, 2205100979Srwatson newsocket, &newsocket->so_label); 2206100979Srwatson} 2207100979Srwatson 2208100979Srwatsonstatic void 2209100979Srwatsonmac_relabel_socket(struct ucred *cred, struct socket *socket, 2210100979Srwatson struct label *newlabel) 2211100979Srwatson{ 2212100979Srwatson 2213100979Srwatson MAC_PERFORM(relabel_socket, cred, socket, &socket->so_label, newlabel); 2214100979Srwatson} 2215100979Srwatson 2216100979Srwatsonstatic void 2217100979Srwatsonmac_relabel_pipe(struct ucred *cred, struct pipe *pipe, struct label *newlabel) 2218100979Srwatson{ 2219100979Srwatson 2220100979Srwatson MAC_PERFORM(relabel_pipe, cred, pipe, pipe->pipe_label, newlabel); 2221100979Srwatson} 2222100979Srwatson 2223100979Srwatsonvoid 2224100979Srwatsonmac_set_socket_peer_from_mbuf(struct mbuf *mbuf, struct socket *socket) 2225100979Srwatson{ 2226100979Srwatson 2227100979Srwatson MAC_PERFORM(set_socket_peer_from_mbuf, mbuf, &mbuf->m_pkthdr.label, 2228100979Srwatson socket, &socket->so_peerlabel); 2229100979Srwatson} 2230100979Srwatson 2231100979Srwatsonvoid 2232100979Srwatsonmac_set_socket_peer_from_socket(struct socket *oldsocket, 2233100979Srwatson struct socket *newsocket) 2234100979Srwatson{ 2235100979Srwatson 2236100979Srwatson MAC_PERFORM(set_socket_peer_from_socket, oldsocket, 2237100979Srwatson &oldsocket->so_label, newsocket, &newsocket->so_peerlabel); 2238100979Srwatson} 2239100979Srwatson 2240100979Srwatsonvoid 2241100979Srwatsonmac_create_datagram_from_ipq(struct ipq *ipq, struct mbuf *datagram) 2242100979Srwatson{ 2243100979Srwatson 2244100979Srwatson MAC_PERFORM(create_datagram_from_ipq, ipq, &ipq->ipq_label, 2245100979Srwatson datagram, &datagram->m_pkthdr.label); 2246100979Srwatson} 2247100979Srwatson 2248100979Srwatsonvoid 2249100979Srwatsonmac_create_fragment(struct mbuf *datagram, struct mbuf *fragment) 2250100979Srwatson{ 2251100979Srwatson 2252100979Srwatson MAC_PERFORM(create_fragment, datagram, &datagram->m_pkthdr.label, 2253100979Srwatson fragment, &fragment->m_pkthdr.label); 2254100979Srwatson} 2255100979Srwatson 2256100979Srwatsonvoid 2257100979Srwatsonmac_create_ipq(struct mbuf *fragment, struct ipq *ipq) 2258100979Srwatson{ 2259100979Srwatson 2260100979Srwatson MAC_PERFORM(create_ipq, fragment, &fragment->m_pkthdr.label, ipq, 2261100979Srwatson &ipq->ipq_label); 2262100979Srwatson} 2263100979Srwatson 2264100979Srwatsonvoid 2265100979Srwatsonmac_create_mbuf_from_mbuf(struct mbuf *oldmbuf, struct mbuf *newmbuf) 2266100979Srwatson{ 2267100979Srwatson 2268100979Srwatson MAC_PERFORM(create_mbuf_from_mbuf, oldmbuf, &oldmbuf->m_pkthdr.label, 2269100979Srwatson newmbuf, &newmbuf->m_pkthdr.label); 2270100979Srwatson} 2271100979Srwatson 2272100979Srwatsonvoid 2273100979Srwatsonmac_create_mbuf_from_bpfdesc(struct bpf_d *bpf_d, struct mbuf *mbuf) 2274100979Srwatson{ 2275100979Srwatson 2276100979Srwatson MAC_PERFORM(create_mbuf_from_bpfdesc, bpf_d, &bpf_d->bd_label, mbuf, 2277100979Srwatson &mbuf->m_pkthdr.label); 2278100979Srwatson} 2279100979Srwatson 2280100979Srwatsonvoid 2281100979Srwatsonmac_create_mbuf_linklayer(struct ifnet *ifnet, struct mbuf *mbuf) 2282100979Srwatson{ 2283100979Srwatson 2284100979Srwatson MAC_PERFORM(create_mbuf_linklayer, ifnet, &ifnet->if_label, mbuf, 2285100979Srwatson &mbuf->m_pkthdr.label); 2286100979Srwatson} 2287100979Srwatson 2288100979Srwatsonvoid 2289100979Srwatsonmac_create_mbuf_from_ifnet(struct ifnet *ifnet, struct mbuf *mbuf) 2290100979Srwatson{ 2291100979Srwatson 2292100979Srwatson MAC_PERFORM(create_mbuf_from_ifnet, ifnet, &ifnet->if_label, mbuf, 2293100979Srwatson &mbuf->m_pkthdr.label); 2294100979Srwatson} 2295100979Srwatson 2296100979Srwatsonvoid 2297100979Srwatsonmac_create_mbuf_multicast_encap(struct mbuf *oldmbuf, struct ifnet *ifnet, 2298100979Srwatson struct mbuf *newmbuf) 2299100979Srwatson{ 2300100979Srwatson 2301100979Srwatson MAC_PERFORM(create_mbuf_multicast_encap, oldmbuf, 2302100979Srwatson &oldmbuf->m_pkthdr.label, ifnet, &ifnet->if_label, newmbuf, 2303100979Srwatson &newmbuf->m_pkthdr.label); 2304100979Srwatson} 2305100979Srwatson 2306100979Srwatsonvoid 2307100979Srwatsonmac_create_mbuf_netlayer(struct mbuf *oldmbuf, struct mbuf *newmbuf) 2308100979Srwatson{ 2309100979Srwatson 2310100979Srwatson MAC_PERFORM(create_mbuf_netlayer, oldmbuf, &oldmbuf->m_pkthdr.label, 2311100979Srwatson newmbuf, &newmbuf->m_pkthdr.label); 2312100979Srwatson} 2313100979Srwatson 2314100979Srwatsonint 2315100979Srwatsonmac_fragment_match(struct mbuf *fragment, struct ipq *ipq) 2316100979Srwatson{ 2317100979Srwatson int result; 2318100979Srwatson 2319100979Srwatson result = 1; 2320100979Srwatson MAC_BOOLEAN(fragment_match, &&, fragment, &fragment->m_pkthdr.label, 2321100979Srwatson ipq, &ipq->ipq_label); 2322100979Srwatson 2323100979Srwatson return (result); 2324100979Srwatson} 2325100979Srwatson 2326100979Srwatsonvoid 2327100979Srwatsonmac_update_ipq(struct mbuf *fragment, struct ipq *ipq) 2328100979Srwatson{ 2329100979Srwatson 2330100979Srwatson MAC_PERFORM(update_ipq, fragment, &fragment->m_pkthdr.label, ipq, 2331100979Srwatson &ipq->ipq_label); 2332100979Srwatson} 2333100979Srwatson 2334100979Srwatsonvoid 2335100979Srwatsonmac_create_mbuf_from_socket(struct socket *socket, struct mbuf *mbuf) 2336100979Srwatson{ 2337100979Srwatson 2338100979Srwatson MAC_PERFORM(create_mbuf_from_socket, socket, &socket->so_label, mbuf, 2339100979Srwatson &mbuf->m_pkthdr.label); 2340100979Srwatson} 2341100979Srwatson 2342100979Srwatsonvoid 2343100979Srwatsonmac_create_mount(struct ucred *cred, struct mount *mp) 2344100979Srwatson{ 2345100979Srwatson 2346100979Srwatson MAC_PERFORM(create_mount, cred, mp, &mp->mnt_mntlabel, 2347100979Srwatson &mp->mnt_fslabel); 2348100979Srwatson} 2349100979Srwatson 2350100979Srwatsonvoid 2351100979Srwatsonmac_create_root_mount(struct ucred *cred, struct mount *mp) 2352100979Srwatson{ 2353100979Srwatson 2354100979Srwatson MAC_PERFORM(create_root_mount, cred, mp, &mp->mnt_mntlabel, 2355100979Srwatson &mp->mnt_fslabel); 2356100979Srwatson} 2357100979Srwatson 2358100979Srwatsonint 2359100979Srwatsonmac_check_bpfdesc_receive(struct bpf_d *bpf_d, struct ifnet *ifnet) 2360100979Srwatson{ 2361100979Srwatson int error; 2362100979Srwatson 2363100979Srwatson if (!mac_enforce_network) 2364100979Srwatson return (0); 2365100979Srwatson 2366100979Srwatson MAC_CHECK(check_bpfdesc_receive, bpf_d, &bpf_d->bd_label, ifnet, 2367100979Srwatson &ifnet->if_label); 2368100979Srwatson 2369100979Srwatson return (error); 2370100979Srwatson} 2371100979Srwatson 2372100979Srwatsonstatic int 2373100979Srwatsonmac_check_cred_relabel(struct ucred *cred, struct label *newlabel) 2374100979Srwatson{ 2375100979Srwatson int error; 2376100979Srwatson 2377100979Srwatson MAC_CHECK(check_cred_relabel, cred, newlabel); 2378100979Srwatson 2379100979Srwatson return (error); 2380100979Srwatson} 2381100979Srwatson 2382100979Srwatsonint 2383100979Srwatsonmac_check_cred_visible(struct ucred *u1, struct ucred *u2) 2384100979Srwatson{ 2385100979Srwatson int error; 2386100979Srwatson 2387100979Srwatson if (!mac_enforce_process) 2388100979Srwatson return (0); 2389100979Srwatson 2390100979Srwatson MAC_CHECK(check_cred_visible, u1, u2); 2391100979Srwatson 2392100979Srwatson return (error); 2393100979Srwatson} 2394100979Srwatson 2395100979Srwatsonint 2396100979Srwatsonmac_check_ifnet_transmit(struct ifnet *ifnet, struct mbuf *mbuf) 2397100979Srwatson{ 2398100979Srwatson int error; 2399100979Srwatson 2400100979Srwatson if (!mac_enforce_network) 2401100979Srwatson return (0); 2402100979Srwatson 2403100979Srwatson KASSERT(mbuf->m_flags & M_PKTHDR, ("packet has no pkthdr")); 2404100979Srwatson if (!(mbuf->m_pkthdr.label.l_flags & MAC_FLAG_INITIALIZED)) 2405100979Srwatson printf("%s%d: not initialized\n", ifnet->if_name, 2406100979Srwatson ifnet->if_unit); 2407100979Srwatson 2408100979Srwatson MAC_CHECK(check_ifnet_transmit, ifnet, &ifnet->if_label, mbuf, 2409100979Srwatson &mbuf->m_pkthdr.label); 2410100979Srwatson 2411100979Srwatson return (error); 2412100979Srwatson} 2413100979Srwatson 2414100979Srwatsonint 2415100979Srwatsonmac_check_mount_stat(struct ucred *cred, struct mount *mount) 2416100979Srwatson{ 2417100979Srwatson int error; 2418100979Srwatson 2419100979Srwatson if (!mac_enforce_fs) 2420100979Srwatson return (0); 2421100979Srwatson 2422100979Srwatson MAC_CHECK(check_mount_stat, cred, mount, &mount->mnt_mntlabel); 2423100979Srwatson 2424100979Srwatson return (error); 2425100979Srwatson} 2426100979Srwatson 2427100979Srwatsonint 2428100979Srwatsonmac_check_pipe_ioctl(struct ucred *cred, struct pipe *pipe, unsigned long cmd, 2429100979Srwatson void *data) 2430100979Srwatson{ 2431100979Srwatson int error; 2432100979Srwatson 2433100979Srwatson MAC_CHECK(check_pipe_ioctl, cred, pipe, pipe->pipe_label, cmd, data); 2434100979Srwatson 2435100979Srwatson return (error); 2436100979Srwatson} 2437100979Srwatson 2438100979Srwatsonint 2439100979Srwatsonmac_check_pipe_op(struct ucred *cred, struct pipe *pipe, int op) 2440100979Srwatson{ 2441100979Srwatson int error; 2442100979Srwatson 2443100979Srwatson MAC_CHECK(check_pipe_op, cred, pipe, pipe->pipe_label, op); 2444100979Srwatson 2445100979Srwatson return (error); 2446100979Srwatson} 2447100979Srwatson 2448100979Srwatsonstatic int 2449100979Srwatsonmac_check_pipe_relabel(struct ucred *cred, struct pipe *pipe, 2450100979Srwatson struct label *newlabel) 2451100979Srwatson{ 2452100979Srwatson int error; 2453100979Srwatson 2454100979Srwatson MAC_CHECK(check_pipe_relabel, cred, pipe, pipe->pipe_label, newlabel); 2455100979Srwatson 2456100979Srwatson return (error); 2457100979Srwatson} 2458100979Srwatson 2459100979Srwatsonint 2460100979Srwatsonmac_check_proc_debug(struct ucred *cred, struct proc *proc) 2461100979Srwatson{ 2462100979Srwatson int error; 2463100979Srwatson 2464100979Srwatson if (!mac_enforce_process) 2465100979Srwatson return (0); 2466100979Srwatson 2467100979Srwatson MAC_CHECK(check_proc_debug, cred, proc); 2468100979Srwatson 2469100979Srwatson return (error); 2470100979Srwatson} 2471100979Srwatson 2472100979Srwatsonint 2473100979Srwatsonmac_check_proc_sched(struct ucred *cred, struct proc *proc) 2474100979Srwatson{ 2475100979Srwatson int error; 2476100979Srwatson 2477100979Srwatson if (!mac_enforce_process) 2478100979Srwatson return (0); 2479100979Srwatson 2480100979Srwatson MAC_CHECK(check_proc_sched, cred, proc); 2481100979Srwatson 2482100979Srwatson return (error); 2483100979Srwatson} 2484100979Srwatson 2485100979Srwatsonint 2486100979Srwatsonmac_check_proc_signal(struct ucred *cred, struct proc *proc, int signum) 2487100979Srwatson{ 2488100979Srwatson int error; 2489100979Srwatson 2490100979Srwatson if (!mac_enforce_process) 2491100979Srwatson return (0); 2492100979Srwatson 2493100979Srwatson MAC_CHECK(check_proc_signal, cred, proc, signum); 2494100979Srwatson 2495100979Srwatson return (error); 2496100979Srwatson} 2497100979Srwatson 2498100979Srwatsonint 2499100979Srwatsonmac_check_socket_bind(struct ucred *ucred, struct socket *socket, 2500100979Srwatson struct sockaddr *sockaddr) 2501100979Srwatson{ 2502100979Srwatson int error; 2503100979Srwatson 2504100979Srwatson if (!mac_enforce_socket) 2505100979Srwatson return (0); 2506100979Srwatson 2507100979Srwatson MAC_CHECK(check_socket_bind, ucred, socket, &socket->so_label, 2508100979Srwatson sockaddr); 2509100979Srwatson 2510100979Srwatson return (error); 2511100979Srwatson} 2512100979Srwatson 2513100979Srwatsonint 2514100979Srwatsonmac_check_socket_connect(struct ucred *cred, struct socket *socket, 2515100979Srwatson struct sockaddr *sockaddr) 2516100979Srwatson{ 2517100979Srwatson int error; 2518100979Srwatson 2519100979Srwatson if (!mac_enforce_socket) 2520100979Srwatson return (0); 2521100979Srwatson 2522100979Srwatson MAC_CHECK(check_socket_connect, cred, socket, &socket->so_label, 2523100979Srwatson sockaddr); 2524100979Srwatson 2525100979Srwatson return (error); 2526100979Srwatson} 2527100979Srwatson 2528100979Srwatsonint 2529100979Srwatsonmac_check_socket_listen(struct ucred *cred, struct socket *socket) 2530100979Srwatson{ 2531100979Srwatson int error; 2532100979Srwatson 2533100979Srwatson if (!mac_enforce_socket) 2534100979Srwatson return (0); 2535100979Srwatson 2536100979Srwatson MAC_CHECK(check_socket_listen, cred, socket, &socket->so_label); 2537100979Srwatson return (error); 2538100979Srwatson} 2539100979Srwatson 2540100979Srwatsonint 2541100979Srwatsonmac_check_socket_receive(struct socket *socket, struct mbuf *mbuf) 2542100979Srwatson{ 2543100979Srwatson int error; 2544100979Srwatson 2545100979Srwatson if (!mac_enforce_socket) 2546100979Srwatson return (0); 2547100979Srwatson 2548100979Srwatson MAC_CHECK(check_socket_receive, socket, &socket->so_label, mbuf, 2549100979Srwatson &mbuf->m_pkthdr.label); 2550100979Srwatson 2551100979Srwatson return (error); 2552100979Srwatson} 2553100979Srwatson 2554100979Srwatsonstatic int 2555100979Srwatsonmac_check_socket_relabel(struct ucred *cred, struct socket *socket, 2556100979Srwatson struct label *newlabel) 2557100979Srwatson{ 2558100979Srwatson int error; 2559100979Srwatson 2560100979Srwatson MAC_CHECK(check_socket_relabel, cred, socket, &socket->so_label, 2561100979Srwatson newlabel); 2562100979Srwatson 2563100979Srwatson return (error); 2564100979Srwatson} 2565100979Srwatson 2566100979Srwatsonint 2567100979Srwatsonmac_check_socket_visible(struct ucred *cred, struct socket *socket) 2568100979Srwatson{ 2569100979Srwatson int error; 2570100979Srwatson 2571100979Srwatson if (!mac_enforce_socket) 2572100979Srwatson return (0); 2573100979Srwatson 2574100979Srwatson MAC_CHECK(check_socket_visible, cred, socket, &socket->so_label); 2575100979Srwatson 2576100979Srwatson return (error); 2577100979Srwatson} 2578100979Srwatson 2579100979Srwatsonint 2580100979Srwatsonmac_ioctl_ifnet_get(struct ucred *cred, struct ifreq *ifr, 2581100979Srwatson struct ifnet *ifnet) 2582100979Srwatson{ 2583100979Srwatson struct mac label; 2584100979Srwatson int error; 2585100979Srwatson 2586100979Srwatson error = mac_externalize(&ifnet->if_label, &label); 2587100979Srwatson if (error) 2588100979Srwatson return (error); 2589100979Srwatson 2590100979Srwatson return (copyout(&label, ifr->ifr_ifru.ifru_data, sizeof(label))); 2591100979Srwatson} 2592100979Srwatson 2593100979Srwatsonint 2594100979Srwatsonmac_ioctl_ifnet_set(struct ucred *cred, struct ifreq *ifr, 2595100979Srwatson struct ifnet *ifnet) 2596100979Srwatson{ 2597100979Srwatson struct mac newlabel; 2598100979Srwatson struct label intlabel; 2599100979Srwatson int error; 2600100979Srwatson 2601100979Srwatson error = copyin(ifr->ifr_ifru.ifru_data, &newlabel, sizeof(newlabel)); 2602100979Srwatson if (error) 2603100979Srwatson return (error); 2604100979Srwatson 2605100979Srwatson error = mac_internalize(&intlabel, &newlabel); 2606100979Srwatson if (error) 2607100979Srwatson return (error); 2608100979Srwatson 2609100979Srwatson /* 2610100979Srwatson * XXX: Note that this is a redundant privilege check, since 2611100979Srwatson * policies impose this check themselves if required by the 2612100979Srwatson * policy. Eventually, this should go away. 2613100979Srwatson */ 2614100979Srwatson error = suser_cred(cred, 0); 2615100979Srwatson if (error) 2616100979Srwatson goto out; 2617100979Srwatson 2618100979Srwatson MAC_CHECK(check_ifnet_relabel, cred, ifnet, &ifnet->if_label, 2619100979Srwatson &intlabel); 2620100979Srwatson if (error) 2621100979Srwatson goto out; 2622100979Srwatson 2623100979Srwatson MAC_PERFORM(relabel_ifnet, cred, ifnet, &ifnet->if_label, &intlabel); 2624100979Srwatson 2625100979Srwatsonout: 2626100979Srwatson mac_destroy_temp(&intlabel); 2627100979Srwatson return (error); 2628100979Srwatson} 2629100979Srwatson 2630100979Srwatsonvoid 2631100979Srwatsonmac_create_devfs_vnode(struct devfs_dirent *de, struct vnode *vp) 2632100979Srwatson{ 2633100979Srwatson 2634100979Srwatson MAC_PERFORM(create_devfs_vnode, de, &de->de_label, vp, &vp->v_label); 2635100979Srwatson} 2636100979Srwatson 2637100979Srwatsonvoid 2638100979Srwatsonmac_create_devfs_device(dev_t dev, struct devfs_dirent *de) 2639100979Srwatson{ 2640100979Srwatson 2641100979Srwatson MAC_PERFORM(create_devfs_device, dev, de, &de->de_label); 2642100979Srwatson} 2643100979Srwatson 2644100979Srwatsonstatic int 2645100979Srwatsonmac_stdcreatevnode_ea(struct vnode *vp) 2646100979Srwatson{ 2647100979Srwatson int error; 2648100979Srwatson 2649100979Srwatson MAC_CHECK(stdcreatevnode_ea, vp, &vp->v_label); 2650100979Srwatson 2651100979Srwatson return (error); 2652100979Srwatson} 2653100979Srwatson 2654100979Srwatsonvoid 2655100979Srwatsonmac_create_devfs_directory(char *dirname, int dirnamelen, 2656100979Srwatson struct devfs_dirent *de) 2657100979Srwatson{ 2658100979Srwatson 2659100979Srwatson MAC_PERFORM(create_devfs_directory, dirname, dirnamelen, de, 2660100979Srwatson &de->de_label); 2661100979Srwatson} 2662100979Srwatson 2663100979Srwatson/* 2664100979Srwatson * When a new vnode is created, this call will initialize its label. 2665100979Srwatson */ 2666100979Srwatsonvoid 2667100979Srwatsonmac_create_vnode(struct ucred *cred, struct vnode *parent, 2668100979Srwatson struct vnode *child) 2669100979Srwatson{ 2670100979Srwatson int error; 2671100979Srwatson 2672100979Srwatson ASSERT_VOP_LOCKED(parent, "mac_create_vnode"); 2673100979Srwatson ASSERT_VOP_LOCKED(child, "mac_create_vnode"); 2674100979Srwatson 2675100979Srwatson error = vn_refreshlabel(parent, cred); 2676100979Srwatson if (error) { 2677100979Srwatson printf("mac_create_vnode: vn_refreshlabel returned %d\n", 2678100979Srwatson error); 2679100979Srwatson printf("mac_create_vnode: using old vnode label\n"); 2680100979Srwatson } 2681100979Srwatson 2682100979Srwatson MAC_PERFORM(create_vnode, cred, parent, &parent->v_label, child, 2683100979Srwatson &child->v_label); 2684100979Srwatson} 2685100979Srwatson 2686100979Srwatsonint 2687100979Srwatsonmac_setsockopt_label_set(struct ucred *cred, struct socket *so, 2688100979Srwatson struct mac *extmac) 2689100979Srwatson{ 2690100979Srwatson struct label intlabel; 2691100979Srwatson int error; 2692100979Srwatson 2693100979Srwatson error = mac_internalize(&intlabel, extmac); 2694100979Srwatson if (error) 2695100979Srwatson return (error); 2696100979Srwatson 2697100979Srwatson mac_check_socket_relabel(cred, so, &intlabel); 2698100979Srwatson if (error) { 2699100979Srwatson mac_destroy_temp(&intlabel); 2700100979Srwatson return (error); 2701100979Srwatson } 2702100979Srwatson 2703100979Srwatson mac_relabel_socket(cred, so, &intlabel); 2704100979Srwatson 2705100979Srwatson mac_destroy_temp(&intlabel); 2706100979Srwatson return (0); 2707100979Srwatson} 2708100979Srwatson 2709100979Srwatsonint 2710100979Srwatsonmac_pipe_label_set(struct ucred *cred, struct pipe *pipe, struct label *label) 2711100979Srwatson{ 2712100979Srwatson int error; 2713100979Srwatson 2714100979Srwatson error = mac_check_pipe_relabel(cred, pipe, label); 2715100979Srwatson if (error) 2716100979Srwatson return (error); 2717100979Srwatson 2718100979Srwatson mac_relabel_pipe(cred, pipe, label); 2719100979Srwatson 2720100979Srwatson return (0); 2721100979Srwatson} 2722100979Srwatson 2723100979Srwatsonint 2724100979Srwatsonmac_getsockopt_label_get(struct ucred *cred, struct socket *so, 2725100979Srwatson struct mac *extmac) 2726100979Srwatson{ 2727100979Srwatson 2728100979Srwatson return (mac_externalize(&so->so_label, extmac)); 2729100979Srwatson} 2730100979Srwatson 2731100979Srwatsonint 2732100979Srwatsonmac_getsockopt_peerlabel_get(struct ucred *cred, struct socket *so, 2733100979Srwatson struct mac *extmac) 2734100979Srwatson{ 2735100979Srwatson 2736100979Srwatson return (mac_externalize(&so->so_peerlabel, extmac)); 2737100979Srwatson} 2738100979Srwatson 2739100979Srwatson/* 2740100979Srwatson * Implementation of VOP_SETLABEL() that relies on extended attributes 2741100979Srwatson * to store label data. Can be referenced by filesystems supporting 2742100979Srwatson * extended attributes. 2743100979Srwatson */ 2744100979Srwatsonint 2745100979Srwatsonvop_stdsetlabel_ea(struct vop_setlabel_args *ap) 2746100979Srwatson{ 2747100979Srwatson struct vnode *vp = ap->a_vp; 2748100979Srwatson struct label *intlabel = ap->a_label; 2749100979Srwatson struct mac extmac; 2750100979Srwatson int error; 2751100979Srwatson 2752100979Srwatson ASSERT_VOP_LOCKED(vp, "vop_stdsetlabel_ea"); 2753100979Srwatson 2754100979Srwatson /* 2755100979Srwatson * XXX: Eventually call out to EA check/set calls here. 2756100979Srwatson * Be particularly careful to avoid race conditions, 2757100979Srwatson * consistency problems, and stability problems when 2758100979Srwatson * dealing with multiple EAs. In particular, we require 2759100979Srwatson * the ability to write multiple EAs on the same file in 2760100979Srwatson * a single transaction, which the current EA interface 2761100979Srwatson * does not provide. 2762100979Srwatson */ 2763100979Srwatson 2764100979Srwatson error = mac_externalize(intlabel, &extmac); 2765100979Srwatson if (error) 2766100979Srwatson return (error); 2767100979Srwatson 2768100979Srwatson error = vn_extattr_set(vp, IO_NODELOCKED, 2769100979Srwatson FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME, 2770100979Srwatson sizeof(extmac), (char *)&extmac, curthread); 2771100979Srwatson if (error) 2772100979Srwatson return (error); 2773100979Srwatson 2774100979Srwatson mac_relabel_vnode(ap->a_cred, vp, intlabel); 2775100979Srwatson 2776101308Sjeff vp->v_vflag |= VV_CACHEDLABEL; 2777100979Srwatson 2778100979Srwatson return (0); 2779100979Srwatson} 2780100979Srwatson 2781100979Srwatsonstatic int 2782100979Srwatsonvn_setlabel(struct vnode *vp, struct label *intlabel, struct ucred *cred) 2783100979Srwatson{ 2784100979Srwatson int error; 2785100979Srwatson 2786100979Srwatson if (vp->v_mount == NULL) { 2787100979Srwatson /* printf("vn_setlabel: null v_mount\n"); */ 2788100979Srwatson if (vp->v_tag != VT_NON) 2789100979Srwatson printf("vn_setlabel: null v_mount with non-VT_NON\n"); 2790100979Srwatson return (EBADF); 2791100979Srwatson } 2792100979Srwatson 2793100979Srwatson if ((vp->v_mount->mnt_flag & MNT_MULTILABEL) == 0) 2794100979Srwatson return (EOPNOTSUPP); 2795100979Srwatson 2796100979Srwatson /* 2797100979Srwatson * Multi-phase commit. First check the policies to confirm the 2798100979Srwatson * change is OK. Then commit via the filesystem. Finally, 2799100979Srwatson * update the actual vnode label. Question: maybe the filesystem 2800100979Srwatson * should update the vnode at the end as part of VOP_SETLABEL()? 2801100979Srwatson */ 2802100979Srwatson error = mac_check_vnode_relabel(cred, vp, intlabel); 2803100979Srwatson if (error) 2804100979Srwatson return (error); 2805100979Srwatson 2806100979Srwatson /* 2807100979Srwatson * VADMIN provides the opportunity for the filesystem to make 2808100979Srwatson * decisions about who is and is not able to modify labels 2809100979Srwatson * and protections on files. This might not be right. We can't 2810100979Srwatson * assume VOP_SETLABEL() will do it, because we might implement 2811100979Srwatson * that as part of vop_stdsetlabel_ea(). 2812100979Srwatson */ 2813100979Srwatson error = VOP_ACCESS(vp, VADMIN, cred, curthread); 2814100979Srwatson if (error) 2815100979Srwatson return (error); 2816100979Srwatson 2817100979Srwatson error = VOP_SETLABEL(vp, intlabel, cred, curthread); 2818100979Srwatson if (error) 2819100979Srwatson return (error); 2820100979Srwatson 2821100979Srwatson return (0); 2822100979Srwatson} 2823100979Srwatson 2824100979Srwatson/* 2825100979Srwatson * MPSAFE 2826100979Srwatson */ 2827100979Srwatsonint 2828100894Srwatson__mac_get_proc(struct thread *td, struct __mac_get_proc_args *uap) 2829100894Srwatson{ 2830100979Srwatson struct mac extmac; 2831100979Srwatson int error; 2832100894Srwatson 2833100979Srwatson error = mac_externalize(&td->td_ucred->cr_label, &extmac); 2834100979Srwatson if (error == 0) 2835100979Srwatson error = copyout(&extmac, SCARG(uap, mac_p), sizeof(extmac)); 2836100979Srwatson 2837100979Srwatson return (error); 2838100979Srwatson} 2839100979Srwatson 2840100979Srwatson/* 2841100979Srwatson * MPSAFE 2842100979Srwatson * 2843100979Srwatson * XXX: Needs to be re-written for proc locking. 2844100979Srwatson */ 2845100979Srwatsonint 2846100979Srwatson__mac_set_proc(struct thread *td, struct __mac_set_proc_args *uap) 2847100979Srwatson{ 2848100979Srwatson struct ucred *newcred, *oldcred; 2849100979Srwatson struct proc *p; 2850100979Srwatson struct mac extmac; 2851100979Srwatson struct label intlabel; 2852100979Srwatson int error; 2853100979Srwatson 2854100979Srwatson error = copyin(SCARG(uap, mac_p), &extmac, sizeof(extmac)); 2855100979Srwatson if (error) 2856100979Srwatson return (error); 2857100979Srwatson 2858100979Srwatson error = mac_internalize(&intlabel, &extmac); 2859100979Srwatson if (error) 2860100979Srwatson return (error); 2861100979Srwatson 2862100979Srwatson newcred = crget(); 2863100979Srwatson 2864100979Srwatson p = td->td_proc; 2865100979Srwatson PROC_LOCK(p); 2866100979Srwatson oldcred = p->p_ucred; 2867100979Srwatson 2868100979Srwatson error = mac_check_cred_relabel(oldcred, &intlabel); 2869100979Srwatson if (error) { 2870100979Srwatson PROC_UNLOCK(p); 2871100979Srwatson mac_destroy_temp(&intlabel); 2872100979Srwatson crfree(newcred); 2873100979Srwatson return (error); 2874100979Srwatson } 2875100979Srwatson 2876100979Srwatson setsugid(p); 2877100979Srwatson crcopy(newcred, oldcred); 2878100979Srwatson PROC_UNLOCK(p); 2879100979Srwatson mac_relabel_cred(newcred, &intlabel); 2880100979Srwatson 2881100979Srwatson PROC_LOCK(p); 2882100979Srwatson p->p_ucred = newcred; 2883100979Srwatson PROC_UNLOCK(p); 2884100979Srwatson crfree(oldcred); 2885100979Srwatson mac_destroy_temp(&intlabel); 2886100979Srwatson return (0); 2887100979Srwatson} 2888100979Srwatson 2889100979Srwatson/* 2890100979Srwatson * MPSAFE 2891100979Srwatson */ 2892100979Srwatsonint 2893100979Srwatson__mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap) 2894100979Srwatson{ 2895100979Srwatson struct file *fp; 2896100979Srwatson struct mac extmac; 2897100979Srwatson struct vnode *vp; 2898100979Srwatson struct pipe *pipe; 2899100979Srwatson int error; 2900100979Srwatson 2901100979Srwatson mtx_lock(&Giant); 2902100979Srwatson 2903100979Srwatson error = fget(td, SCARG(uap, fd), &fp); 2904100979Srwatson if (error) 2905100979Srwatson goto out; 2906100979Srwatson 2907100979Srwatson switch (fp->f_type) { 2908100979Srwatson case DTYPE_FIFO: 2909100979Srwatson case DTYPE_VNODE: 2910100979Srwatson vp = (struct vnode *)fp->f_data; 2911100979Srwatson 2912100979Srwatson vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); 2913100979Srwatson error = vn_refreshlabel(vp, td->td_ucred); 2914100979Srwatson if (error == 0) 2915100979Srwatson error = mac_externalize(&vp->v_label, &extmac); 2916100979Srwatson VOP_UNLOCK(vp, 0, td); 2917100979Srwatson break; 2918100979Srwatson case DTYPE_PIPE: 2919100979Srwatson pipe = (struct pipe *)fp->f_data; 2920100979Srwatson error = mac_externalize(pipe->pipe_label, &extmac); 2921100979Srwatson break; 2922100979Srwatson default: 2923100979Srwatson error = EINVAL; 2924100979Srwatson } 2925100979Srwatson 2926100979Srwatson if (error == 0) 2927100979Srwatson error = copyout(&extmac, SCARG(uap, mac_p), sizeof(extmac)); 2928100979Srwatson 2929100979Srwatson fdrop(fp, td); 2930100979Srwatson 2931100979Srwatsonout: 2932100979Srwatson mtx_unlock(&Giant); 2933100979Srwatson return (error); 2934100979Srwatson} 2935100979Srwatson 2936100979Srwatson/* 2937100979Srwatson * MPSAFE 2938100979Srwatson */ 2939100979Srwatsonint 2940100979Srwatson__mac_get_file(struct thread *td, struct __mac_get_file_args *uap) 2941100979Srwatson{ 2942100979Srwatson struct nameidata nd; 2943100979Srwatson struct mac extmac; 2944100979Srwatson int error; 2945100979Srwatson 2946100979Srwatson mtx_lock(&Giant); 2947100979Srwatson NDINIT(&nd, LOOKUP, LOCKLEAF | FOLLOW, UIO_USERSPACE, 2948100979Srwatson SCARG(uap, path_p), td); 2949100979Srwatson error = namei(&nd); 2950100979Srwatson if (error) 2951100979Srwatson goto out; 2952100979Srwatson 2953100979Srwatson error = vn_refreshlabel(nd.ni_vp, td->td_ucred); 2954100979Srwatson if (error == 0) 2955100979Srwatson error = mac_externalize(&nd.ni_vp->v_label, &extmac); 2956100979Srwatson NDFREE(&nd, 0); 2957100979Srwatson if (error) 2958100979Srwatson goto out; 2959100979Srwatson 2960100979Srwatson error = copyout(&extmac, SCARG(uap, mac_p), sizeof(extmac)); 2961100979Srwatson 2962100979Srwatsonout: 2963100979Srwatson mtx_unlock(&Giant); 2964100979Srwatson return (error); 2965100979Srwatson} 2966100979Srwatson 2967100979Srwatson/* 2968100979Srwatson * MPSAFE 2969100979Srwatson */ 2970100979Srwatsonint 2971100979Srwatson__mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap) 2972100979Srwatson{ 2973100979Srwatson struct file *fp; 2974100979Srwatson struct mac extmac; 2975100979Srwatson struct label intlabel; 2976100979Srwatson struct mount *mp; 2977100979Srwatson struct vnode *vp; 2978100979Srwatson struct pipe *pipe; 2979100979Srwatson int error; 2980100979Srwatson 2981100979Srwatson mtx_lock(&Giant); 2982100979Srwatson error = fget(td, SCARG(uap, fd), &fp); 2983100979Srwatson if (error) 2984100979Srwatson goto out1; 2985100979Srwatson 2986100979Srwatson error = copyin(SCARG(uap, mac_p), &extmac, sizeof(extmac)); 2987100979Srwatson if (error) 2988100979Srwatson goto out2; 2989100979Srwatson 2990100979Srwatson error = mac_internalize(&intlabel, &extmac); 2991100979Srwatson if (error) 2992100979Srwatson goto out2; 2993100979Srwatson 2994100979Srwatson switch (fp->f_type) { 2995100979Srwatson case DTYPE_FIFO: 2996100979Srwatson case DTYPE_VNODE: 2997100979Srwatson vp = (struct vnode *)fp->f_data; 2998100979Srwatson error = vn_start_write(vp, &mp, V_WAIT | PCATCH); 2999100979Srwatson if (error != 0) 3000100979Srwatson break; 3001100979Srwatson 3002100979Srwatson vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); 3003100979Srwatson error = vn_setlabel(vp, &intlabel, td->td_ucred); 3004100979Srwatson VOP_UNLOCK(vp, 0, td); 3005100979Srwatson vn_finished_write(mp); 3006100979Srwatson mac_destroy_temp(&intlabel); 3007100979Srwatson break; 3008100979Srwatson case DTYPE_PIPE: 3009100979Srwatson pipe = (struct pipe *)fp->f_data; 3010100979Srwatson error = mac_pipe_label_set(td->td_ucred, pipe, &intlabel); 3011100979Srwatson break; 3012100979Srwatson default: 3013100979Srwatson error = EINVAL; 3014100979Srwatson } 3015100979Srwatson 3016100979Srwatsonout2: 3017100979Srwatson fdrop(fp, td); 3018100979Srwatsonout1: 3019100979Srwatson mtx_unlock(&Giant); 3020100979Srwatson return (error); 3021100979Srwatson} 3022100979Srwatson 3023100979Srwatson/* 3024100979Srwatson * MPSAFE 3025100979Srwatson */ 3026100979Srwatsonint 3027100979Srwatson__mac_set_file(struct thread *td, struct __mac_set_file_args *uap) 3028100979Srwatson{ 3029100979Srwatson struct nameidata nd; 3030100979Srwatson struct mac extmac; 3031100979Srwatson struct label intlabel; 3032100979Srwatson struct mount *mp; 3033100979Srwatson int error; 3034100979Srwatson 3035100979Srwatson mtx_lock(&Giant); 3036100979Srwatson 3037100979Srwatson error = copyin(SCARG(uap, mac_p), &extmac, sizeof(extmac)); 3038100979Srwatson if (error) 3039100979Srwatson goto out; 3040100979Srwatson 3041100979Srwatson error = mac_internalize(&intlabel, &extmac); 3042100979Srwatson if (error) 3043100979Srwatson goto out; 3044100979Srwatson 3045100979Srwatson NDINIT(&nd, LOOKUP, LOCKLEAF | FOLLOW, UIO_USERSPACE, 3046100979Srwatson SCARG(uap, path_p), td); 3047100979Srwatson error = namei(&nd); 3048100979Srwatson if (error) 3049100979Srwatson goto out2; 3050100979Srwatson error = vn_start_write(nd.ni_vp, &mp, V_WAIT | PCATCH); 3051100979Srwatson if (error) 3052100979Srwatson goto out2; 3053100979Srwatson 3054100979Srwatson error = vn_setlabel(nd.ni_vp, &intlabel, td->td_ucred); 3055100979Srwatson 3056100979Srwatson vn_finished_write(mp); 3057100979Srwatsonout2: 3058100979Srwatson mac_destroy_temp(&intlabel); 3059100979Srwatson NDFREE(&nd, 0); 3060100979Srwatsonout: 3061100979Srwatson mtx_unlock(&Giant); 3062100979Srwatson return (error); 3063100979Srwatson} 3064100979Srwatson 3065100979SrwatsonSYSINIT(mac, SI_SUB_MAC, SI_ORDER_FIRST, mac_init, NULL); 3066100979SrwatsonSYSINIT(mac_late, SI_SUB_MAC_LATE, SI_ORDER_FIRST, mac_late_init, NULL); 3067100979Srwatson 3068100979Srwatson#else /* !MAC */ 3069100979Srwatson 3070100979Srwatsonint 3071100979Srwatson__mac_get_proc(struct thread *td, struct __mac_get_proc_args *uap) 3072100979Srwatson{ 3073100979Srwatson 3074100894Srwatson return (ENOSYS); 3075100894Srwatson} 3076100894Srwatson 3077100894Srwatsonint 3078100894Srwatson__mac_set_proc(struct thread *td, struct __mac_set_proc_args *uap) 3079100894Srwatson{ 3080100894Srwatson 3081100894Srwatson return (ENOSYS); 3082100894Srwatson} 3083100894Srwatson 3084100894Srwatsonint 3085100894Srwatson__mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap) 3086100894Srwatson{ 3087100894Srwatson 3088100894Srwatson return (ENOSYS); 3089100894Srwatson} 3090100894Srwatson 3091100894Srwatsonint 3092100894Srwatson__mac_get_file(struct thread *td, struct __mac_get_file_args *uap) 3093100894Srwatson{ 3094100894Srwatson 3095100894Srwatson return (ENOSYS); 3096100894Srwatson} 3097100894Srwatson 3098100894Srwatsonint 3099100894Srwatson__mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap) 3100100894Srwatson{ 3101100894Srwatson 3102100894Srwatson return (ENOSYS); 3103100894Srwatson} 3104100894Srwatson 3105100894Srwatsonint 3106100894Srwatson__mac_set_file(struct thread *td, struct __mac_set_file_args *uap) 3107100894Srwatson{ 3108100894Srwatson 3109100894Srwatson return (ENOSYS); 3110100894Srwatson} 3111100979Srwatson 3112100979Srwatson#endif /* !MAC */ 3113