mac_process.c revision 104514
1100894Srwatson/*- 2100894Srwatson * Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson 3100894Srwatson * Copyright (c) 2001 Ilmar S. Habibulin 4100894Srwatson * Copyright (c) 2001, 2002 Networks Associates Technology, Inc. 5100894Srwatson * All rights reserved. 6100894Srwatson * 7100894Srwatson * This software was developed by Robert Watson and Ilmar Habibulin for the 8100894Srwatson * TrustedBSD Project. 9100894Srwatson * 10100894Srwatson * This software was developed for the FreeBSD Project in part by NAI Labs, 11100894Srwatson * the Security Research Division of Network Associates, Inc. under 12100894Srwatson * DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA 13100894Srwatson * CHATS research program. 14100894Srwatson * 15100894Srwatson * Redistribution and use in source and binary forms, with or without 16100894Srwatson * modification, are permitted provided that the following conditions 17100894Srwatson * are met: 18100894Srwatson * 1. Redistributions of source code must retain the above copyright 19100894Srwatson * notice, this list of conditions and the following disclaimer. 20100894Srwatson * 2. Redistributions in binary form must reproduce the above copyright 21100894Srwatson * notice, this list of conditions and the following disclaimer in the 22100894Srwatson * documentation and/or other materials provided with the distribution. 23100894Srwatson * 3. The names of the authors may not be used to endorse or promote 24100894Srwatson * products derived from this software without specific prior written 25100894Srwatson * permission. 26100894Srwatson * 27100894Srwatson * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 28100894Srwatson * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 29100894Srwatson * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 30100894Srwatson * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 31100894Srwatson * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 32100894Srwatson * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 33100894Srwatson * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 34100894Srwatson * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 35100894Srwatson * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 36100894Srwatson * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 37100894Srwatson * SUCH DAMAGE. 38100894Srwatson * 39100894Srwatson * $FreeBSD: head/sys/security/mac/mac_process.c 104514 2002-10-05 15:10:00Z rwatson $ 40100894Srwatson */ 41100894Srwatson/* 42100894Srwatson * Developed by the TrustedBSD Project. 43100894Srwatson * 44100894Srwatson * Framework for extensible kernel access control. Kernel and userland 45100894Srwatson * interface to the framework, policy registration and composition. 46100894Srwatson */ 47100894Srwatson 48100894Srwatson#include "opt_mac.h" 49104300Sphk#include "opt_devfs.h" 50101173Srwatson 51100894Srwatson#include <sys/param.h> 52100979Srwatson#include <sys/extattr.h> 53100979Srwatson#include <sys/kernel.h> 54100979Srwatson#include <sys/lock.h> 55102949Sbde#include <sys/malloc.h> 56100979Srwatson#include <sys/mutex.h> 57100979Srwatson#include <sys/mac.h> 58101712Srwatson#include <sys/module.h> 59100979Srwatson#include <sys/proc.h> 60100979Srwatson#include <sys/systm.h> 61100894Srwatson#include <sys/sysproto.h> 62100894Srwatson#include <sys/sysent.h> 63100979Srwatson#include <sys/vnode.h> 64100979Srwatson#include <sys/mount.h> 65100979Srwatson#include <sys/file.h> 66100979Srwatson#include <sys/namei.h> 67100979Srwatson#include <sys/socket.h> 68100979Srwatson#include <sys/pipe.h> 69100979Srwatson#include <sys/socketvar.h> 70100979Srwatson#include <sys/sysctl.h> 71100894Srwatson 72100979Srwatson#include <vm/vm.h> 73100979Srwatson#include <vm/pmap.h> 74100979Srwatson#include <vm/vm_map.h> 75100979Srwatson#include <vm/vm_object.h> 76100979Srwatson 77100979Srwatson#include <sys/mac_policy.h> 78100979Srwatson 79100979Srwatson#include <fs/devfs/devfs.h> 80100979Srwatson 81100979Srwatson#include <net/bpfdesc.h> 82100979Srwatson#include <net/if.h> 83100979Srwatson#include <net/if_var.h> 84100979Srwatson 85100979Srwatson#include <netinet/in.h> 86100979Srwatson#include <netinet/ip_var.h> 87100979Srwatson 88100979Srwatson#ifdef MAC 89100979Srwatson 90101712Srwatson/* 91101712Srwatson * Declare that the kernel provides MAC support, version 1. This permits 92101712Srwatson * modules to refuse to be loaded if the necessary support isn't present, 93101712Srwatson * even if it's pre-boot. 94101712Srwatson */ 95101712SrwatsonMODULE_VERSION(kernel_mac_support, 1); 96101712Srwatson 97100979SrwatsonSYSCTL_DECL(_security); 98100979Srwatson 99100979SrwatsonSYSCTL_NODE(_security, OID_AUTO, mac, CTLFLAG_RW, 0, 100100979Srwatson "TrustedBSD MAC policy controls"); 101100979Srwatson#ifndef MAC_MAX_POLICIES 102100979Srwatson#define MAC_MAX_POLICIES 8 103100979Srwatson#endif 104100979Srwatson#if MAC_MAX_POLICIES > 32 105100979Srwatson#error "MAC_MAX_POLICIES too large" 106100979Srwatson#endif 107100979Srwatsonstatic unsigned int mac_max_policies = MAC_MAX_POLICIES; 108100979Srwatsonstatic unsigned int mac_policy_offsets_free = (1 << MAC_MAX_POLICIES) - 1; 109100979SrwatsonSYSCTL_UINT(_security_mac, OID_AUTO, max_policies, CTLFLAG_RD, 110100979Srwatson &mac_max_policies, 0, ""); 111100979Srwatson 112100979Srwatsonstatic int mac_late = 0; 113100979Srwatson 114100979Srwatsonstatic int mac_enforce_fs = 1; 115100979SrwatsonSYSCTL_INT(_security_mac, OID_AUTO, enforce_fs, CTLFLAG_RW, 116100979Srwatson &mac_enforce_fs, 0, "Enforce MAC policy on file system objects"); 117100979SrwatsonTUNABLE_INT("security.mac.enforce_fs", &mac_enforce_fs); 118100979Srwatson 119100979Srwatsonstatic int mac_enforce_network = 1; 120100979SrwatsonSYSCTL_INT(_security_mac, OID_AUTO, enforce_network, CTLFLAG_RW, 121100979Srwatson &mac_enforce_network, 0, "Enforce MAC policy on network packets"); 122100979SrwatsonTUNABLE_INT("security.mac.enforce_network", &mac_enforce_network); 123100979Srwatson 124103513Srwatsonstatic int mac_enforce_pipe = 1; 125103513SrwatsonSYSCTL_INT(_security_mac, OID_AUTO, enforce_pipe, CTLFLAG_RW, 126103513Srwatson &mac_enforce_pipe, 0, "Enforce MAC policy on pipe operations"); 127104236SrwatsonTUNABLE_INT("security.mac.enforce_pipe", &mac_enforce_pipe); 128103513Srwatson 129100979Srwatsonstatic int mac_enforce_process = 1; 130100979SrwatsonSYSCTL_INT(_security_mac, OID_AUTO, enforce_process, CTLFLAG_RW, 131100979Srwatson &mac_enforce_process, 0, "Enforce MAC policy on inter-process operations"); 132100979SrwatsonTUNABLE_INT("security.mac.enforce_process", &mac_enforce_process); 133100979Srwatson 134100979Srwatsonstatic int mac_enforce_socket = 1; 135100979SrwatsonSYSCTL_INT(_security_mac, OID_AUTO, enforce_socket, CTLFLAG_RW, 136100979Srwatson &mac_enforce_socket, 0, "Enforce MAC policy on socket operations"); 137100979SrwatsonTUNABLE_INT("security.mac.enforce_socket", &mac_enforce_socket); 138100979Srwatson 139103514Srwatsonstatic int mac_enforce_vm = 1; 140103514SrwatsonSYSCTL_INT(_security_mac, OID_AUTO, enforce_vm, CTLFLAG_RW, 141103514Srwatson &mac_enforce_vm, 0, "Enforce MAC policy on vm operations"); 142104236SrwatsonTUNABLE_INT("security.mac.enforce_vm", &mac_enforce_vm); 143103514Srwatson 144100979Srwatsonstatic int mac_label_size = sizeof(struct mac); 145100979SrwatsonSYSCTL_INT(_security_mac, OID_AUTO, label_size, CTLFLAG_RD, 146100979Srwatson &mac_label_size, 0, "Pre-compiled MAC label size"); 147100979Srwatson 148100979Srwatsonstatic int mac_cache_fslabel_in_vnode = 1; 149100979SrwatsonSYSCTL_INT(_security_mac, OID_AUTO, cache_fslabel_in_vnode, CTLFLAG_RW, 150100979Srwatson &mac_cache_fslabel_in_vnode, 0, "Cache mount fslabel in vnode"); 151100979SrwatsonTUNABLE_INT("security.mac.cache_fslabel_in_vnode", 152100979Srwatson &mac_cache_fslabel_in_vnode); 153100979Srwatson 154100979Srwatsonstatic int mac_vnode_label_cache_hits = 0; 155100979SrwatsonSYSCTL_INT(_security_mac, OID_AUTO, vnode_label_cache_hits, CTLFLAG_RD, 156100979Srwatson &mac_vnode_label_cache_hits, 0, "Cache hits on vnode labels"); 157100979Srwatsonstatic int mac_vnode_label_cache_misses = 0; 158100979SrwatsonSYSCTL_INT(_security_mac, OID_AUTO, vnode_label_cache_misses, CTLFLAG_RD, 159100979Srwatson &mac_vnode_label_cache_misses, 0, "Cache misses on vnode labels"); 160103136Srwatson 161103136Srwatsonstatic int mac_mmap_revocation = 1; 162103136SrwatsonSYSCTL_INT(_security_mac, OID_AUTO, mmap_revocation, CTLFLAG_RW, 163103136Srwatson &mac_mmap_revocation, 0, "Revoke mmap access to files on subject " 164103136Srwatson "relabel"); 165101892Srwatsonstatic int mac_mmap_revocation_via_cow = 0; 166100979SrwatsonSYSCTL_INT(_security_mac, OID_AUTO, mmap_revocation_via_cow, CTLFLAG_RW, 167100979Srwatson &mac_mmap_revocation_via_cow, 0, "Revoke mmap access to files via " 168100979Srwatson "copy-on-write semantics, or by removing all write access"); 169100979Srwatson 170101988Srwatson#ifdef MAC_DEBUG 171104268SrwatsonSYSCTL_NODE(_security_mac, OID_AUTO, debug, CTLFLAG_RW, 0, 172104268Srwatson "TrustedBSD MAC debug info"); 173104268Srwatson 174104268Srwatsonstatic int mac_debug_label_fallback = 0; 175104268SrwatsonSYSCTL_INT(_security_mac_debug, OID_AUTO, label_fallback, CTLFLAG_RW, 176104268Srwatson &mac_debug_label_fallback, 0, "Filesystems should fall back to fs label" 177104268Srwatson "when label is corrupted."); 178104268SrwatsonTUNABLE_INT("security.mac.debug_label_fallback", 179104268Srwatson &mac_debug_label_fallback); 180104268Srwatson 181100979Srwatsonstatic unsigned int nmacmbufs, nmaccreds, nmacifnets, nmacbpfdescs, 182100979Srwatson nmacsockets, nmacmounts, nmactemp, nmacvnodes, nmacdevfsdirents, 183100979Srwatson nmacipqs, nmacpipes; 184100979SrwatsonSYSCTL_UINT(_security_mac_debug, OID_AUTO, mbufs, CTLFLAG_RD, 185100979Srwatson &nmacmbufs, 0, "number of mbufs in use"); 186100979SrwatsonSYSCTL_UINT(_security_mac_debug, OID_AUTO, creds, CTLFLAG_RD, 187100979Srwatson &nmaccreds, 0, "number of ucreds in use"); 188100979SrwatsonSYSCTL_UINT(_security_mac_debug, OID_AUTO, ifnets, CTLFLAG_RD, 189100979Srwatson &nmacifnets, 0, "number of ifnets in use"); 190100979SrwatsonSYSCTL_UINT(_security_mac_debug, OID_AUTO, ipqs, CTLFLAG_RD, 191100979Srwatson &nmacipqs, 0, "number of ipqs in use"); 192100979SrwatsonSYSCTL_UINT(_security_mac_debug, OID_AUTO, bpfdescs, CTLFLAG_RD, 193100979Srwatson &nmacbpfdescs, 0, "number of bpfdescs in use"); 194100979SrwatsonSYSCTL_UINT(_security_mac_debug, OID_AUTO, sockets, CTLFLAG_RD, 195100979Srwatson &nmacsockets, 0, "number of sockets in use"); 196100979SrwatsonSYSCTL_UINT(_security_mac_debug, OID_AUTO, pipes, CTLFLAG_RD, 197100979Srwatson &nmacpipes, 0, "number of pipes in use"); 198100979SrwatsonSYSCTL_UINT(_security_mac_debug, OID_AUTO, mounts, CTLFLAG_RD, 199100979Srwatson &nmacmounts, 0, "number of mounts in use"); 200100979SrwatsonSYSCTL_UINT(_security_mac_debug, OID_AUTO, temp, CTLFLAG_RD, 201100979Srwatson &nmactemp, 0, "number of temporary labels in use"); 202100979SrwatsonSYSCTL_UINT(_security_mac_debug, OID_AUTO, vnodes, CTLFLAG_RD, 203100979Srwatson &nmacvnodes, 0, "number of vnodes in use"); 204100979SrwatsonSYSCTL_UINT(_security_mac_debug, OID_AUTO, devfsdirents, CTLFLAG_RD, 205100979Srwatson &nmacdevfsdirents, 0, "number of devfs dirents inuse"); 206101988Srwatson#endif 207100979Srwatson 208100979Srwatsonstatic int error_select(int error1, int error2); 209100979Srwatsonstatic int mac_externalize(struct label *label, struct mac *mac); 210100979Srwatsonstatic int mac_policy_register(struct mac_policy_conf *mpc); 211100979Srwatsonstatic int mac_policy_unregister(struct mac_policy_conf *mpc); 212100979Srwatson 213100979Srwatsonstatic int mac_stdcreatevnode_ea(struct vnode *vp); 214100979Srwatsonstatic void mac_cred_mmapped_drop_perms(struct thread *td, 215100979Srwatson struct ucred *cred); 216100979Srwatsonstatic void mac_cred_mmapped_drop_perms_recurse(struct thread *td, 217100979Srwatson struct ucred *cred, struct vm_map *map); 218100979Srwatson 219100979SrwatsonMALLOC_DEFINE(M_MACOPVEC, "macopvec", "MAC policy operation vector"); 220100979SrwatsonMALLOC_DEFINE(M_MACPIPELABEL, "macpipelabel", "MAC labels for pipes"); 221100979Srwatson 222100979Srwatson/* 223100979Srwatson * mac_policy_list_lock protects the consistency of 'mac_policy_list', 224100979Srwatson * the linked list of attached policy modules. Read-only consumers of 225100979Srwatson * the list must acquire a shared lock for the duration of their use; 226100979Srwatson * writers must acquire an exclusive lock. Note that for compound 227100979Srwatson * operations, locks should be held for the entire compound operation, 228100979Srwatson * and that this is not yet done for relabel requests. 229100979Srwatson */ 230100979Srwatsonstatic struct mtx mac_policy_list_lock; 231100979Srwatsonstatic LIST_HEAD(, mac_policy_conf) mac_policy_list; 232100979Srwatsonstatic int mac_policy_list_busy; 233100979Srwatson#define MAC_POLICY_LIST_LOCKINIT() mtx_init(&mac_policy_list_lock, \ 234100979Srwatson "mac_policy_list_lock", NULL, MTX_DEF); 235100979Srwatson#define MAC_POLICY_LIST_LOCK() mtx_lock(&mac_policy_list_lock); 236100979Srwatson#define MAC_POLICY_LIST_UNLOCK() mtx_unlock(&mac_policy_list_lock); 237100979Srwatson 238100979Srwatson#define MAC_POLICY_LIST_BUSY() do { \ 239100979Srwatson MAC_POLICY_LIST_LOCK(); \ 240100979Srwatson mac_policy_list_busy++; \ 241100979Srwatson MAC_POLICY_LIST_UNLOCK(); \ 242100979Srwatson} while (0) 243100979Srwatson 244100979Srwatson#define MAC_POLICY_LIST_UNBUSY() do { \ 245100979Srwatson MAC_POLICY_LIST_LOCK(); \ 246100979Srwatson mac_policy_list_busy--; \ 247100979Srwatson if (mac_policy_list_busy < 0) \ 248100979Srwatson panic("Extra mac_policy_list_busy--"); \ 249100979Srwatson MAC_POLICY_LIST_UNLOCK(); \ 250100979Srwatson} while (0) 251100979Srwatson 252100979Srwatson/* 253100979Srwatson * MAC_CHECK performs the designated check by walking the policy 254100979Srwatson * module list and checking with each as to how it feels about the 255100979Srwatson * request. Note that it returns its value via 'error' in the scope 256100979Srwatson * of the caller. 257100979Srwatson */ 258100979Srwatson#define MAC_CHECK(check, args...) do { \ 259100979Srwatson struct mac_policy_conf *mpc; \ 260100979Srwatson \ 261100979Srwatson error = 0; \ 262100979Srwatson MAC_POLICY_LIST_BUSY(); \ 263100979Srwatson LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { \ 264100979Srwatson if (mpc->mpc_ops->mpo_ ## check != NULL) \ 265100979Srwatson error = error_select( \ 266100979Srwatson mpc->mpc_ops->mpo_ ## check (args), \ 267100979Srwatson error); \ 268100979Srwatson } \ 269100979Srwatson MAC_POLICY_LIST_UNBUSY(); \ 270100979Srwatson} while (0) 271100979Srwatson 272100979Srwatson/* 273100979Srwatson * MAC_BOOLEAN performs the designated boolean composition by walking 274100979Srwatson * the module list, invoking each instance of the operation, and 275100979Srwatson * combining the results using the passed C operator. Note that it 276100979Srwatson * returns its value via 'result' in the scope of the caller, which 277100979Srwatson * should be initialized by the caller in a meaningful way to get 278100979Srwatson * a meaningful result. 279100979Srwatson */ 280100979Srwatson#define MAC_BOOLEAN(operation, composition, args...) do { \ 281100979Srwatson struct mac_policy_conf *mpc; \ 282100979Srwatson \ 283100979Srwatson MAC_POLICY_LIST_BUSY(); \ 284100979Srwatson LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { \ 285100979Srwatson if (mpc->mpc_ops->mpo_ ## operation != NULL) \ 286100979Srwatson result = result composition \ 287100979Srwatson mpc->mpc_ops->mpo_ ## operation (args); \ 288100979Srwatson } \ 289100979Srwatson MAC_POLICY_LIST_UNBUSY(); \ 290100979Srwatson} while (0) 291100979Srwatson 292100979Srwatson/* 293100979Srwatson * MAC_PERFORM performs the designated operation by walking the policy 294100979Srwatson * module list and invoking that operation for each policy. 295100979Srwatson */ 296100979Srwatson#define MAC_PERFORM(operation, args...) do { \ 297100979Srwatson struct mac_policy_conf *mpc; \ 298100979Srwatson \ 299100979Srwatson MAC_POLICY_LIST_BUSY(); \ 300100979Srwatson LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { \ 301100979Srwatson if (mpc->mpc_ops->mpo_ ## operation != NULL) \ 302100979Srwatson mpc->mpc_ops->mpo_ ## operation (args); \ 303100979Srwatson } \ 304100979Srwatson MAC_POLICY_LIST_UNBUSY(); \ 305100979Srwatson} while (0) 306100979Srwatson 307100979Srwatson/* 308100979Srwatson * Initialize the MAC subsystem, including appropriate SMP locks. 309100979Srwatson */ 310100979Srwatsonstatic void 311100979Srwatsonmac_init(void) 312100979Srwatson{ 313100979Srwatson 314100979Srwatson LIST_INIT(&mac_policy_list); 315100979Srwatson MAC_POLICY_LIST_LOCKINIT(); 316100979Srwatson} 317100979Srwatson 318100979Srwatson/* 319100979Srwatson * For the purposes of modules that want to know if they were loaded 320100979Srwatson * "early", set the mac_late flag once we've processed modules either 321100979Srwatson * linked into the kernel, or loaded before the kernel startup. 322100979Srwatson */ 323100979Srwatsonstatic void 324100979Srwatsonmac_late_init(void) 325100979Srwatson{ 326100979Srwatson 327100979Srwatson mac_late = 1; 328100979Srwatson} 329100979Srwatson 330100979Srwatson/* 331100979Srwatson * Allow MAC policy modules to register during boot, etc. 332100979Srwatson */ 333100894Srwatsonint 334100979Srwatsonmac_policy_modevent(module_t mod, int type, void *data) 335100979Srwatson{ 336100979Srwatson struct mac_policy_conf *mpc; 337100979Srwatson int error; 338100979Srwatson 339100979Srwatson error = 0; 340100979Srwatson mpc = (struct mac_policy_conf *) data; 341100979Srwatson 342100979Srwatson switch (type) { 343100979Srwatson case MOD_LOAD: 344100979Srwatson if (mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_NOTLATE && 345100979Srwatson mac_late) { 346100979Srwatson printf("mac_policy_modevent: can't load %s policy " 347100979Srwatson "after booting\n", mpc->mpc_name); 348100979Srwatson error = EBUSY; 349100979Srwatson break; 350100979Srwatson } 351100979Srwatson error = mac_policy_register(mpc); 352100979Srwatson break; 353100979Srwatson case MOD_UNLOAD: 354100979Srwatson /* Don't unregister the module if it was never registered. */ 355100979Srwatson if ((mpc->mpc_runtime_flags & MPC_RUNTIME_FLAG_REGISTERED) 356100979Srwatson != 0) 357100979Srwatson error = mac_policy_unregister(mpc); 358100979Srwatson else 359100979Srwatson error = 0; 360100979Srwatson break; 361100979Srwatson default: 362100979Srwatson break; 363100979Srwatson } 364100979Srwatson 365100979Srwatson return (error); 366100979Srwatson} 367100979Srwatson 368100979Srwatsonstatic int 369100979Srwatsonmac_policy_register(struct mac_policy_conf *mpc) 370100979Srwatson{ 371100979Srwatson struct mac_policy_conf *tmpc; 372100979Srwatson struct mac_policy_op_entry *mpe; 373100979Srwatson int slot; 374100979Srwatson 375103570Srwatson MALLOC(mpc->mpc_ops, struct mac_policy_ops *, sizeof(*mpc->mpc_ops), 376103570Srwatson M_MACOPVEC, M_WAITOK | M_ZERO); 377100979Srwatson for (mpe = mpc->mpc_entries; mpe->mpe_constant != MAC_OP_LAST; mpe++) { 378100979Srwatson switch (mpe->mpe_constant) { 379100979Srwatson case MAC_OP_LAST: 380100979Srwatson /* 381100979Srwatson * Doesn't actually happen, but this allows checking 382100979Srwatson * that all enumerated values are handled. 383100979Srwatson */ 384100979Srwatson break; 385100979Srwatson case MAC_DESTROY: 386100979Srwatson mpc->mpc_ops->mpo_destroy = 387100979Srwatson mpe->mpe_function; 388100979Srwatson break; 389100979Srwatson case MAC_INIT: 390100979Srwatson mpc->mpc_ops->mpo_init = 391100979Srwatson mpe->mpe_function; 392100979Srwatson break; 393102123Srwatson case MAC_SYSCALL: 394102123Srwatson mpc->mpc_ops->mpo_syscall = 395102123Srwatson mpe->mpe_function; 396102123Srwatson break; 397104514Srwatson case MAC_INIT_BPFDESC_LABEL: 398104514Srwatson mpc->mpc_ops->mpo_init_bpfdesc_label = 399100979Srwatson mpe->mpe_function; 400100979Srwatson break; 401104514Srwatson case MAC_INIT_CRED_LABEL: 402104514Srwatson mpc->mpc_ops->mpo_init_cred_label = 403100979Srwatson mpe->mpe_function; 404100979Srwatson break; 405104514Srwatson case MAC_INIT_DEVFSDIRENT_LABEL: 406104514Srwatson mpc->mpc_ops->mpo_init_devfsdirent_label = 407100979Srwatson mpe->mpe_function; 408100979Srwatson break; 409104514Srwatson case MAC_INIT_IFNET_LABEL: 410104514Srwatson mpc->mpc_ops->mpo_init_ifnet_label = 411100979Srwatson mpe->mpe_function; 412100979Srwatson break; 413104514Srwatson case MAC_INIT_IPQ_LABEL: 414104514Srwatson mpc->mpc_ops->mpo_init_ipq_label = 415100979Srwatson mpe->mpe_function; 416100979Srwatson break; 417104514Srwatson case MAC_INIT_MBUF_LABEL: 418104514Srwatson mpc->mpc_ops->mpo_init_mbuf_label = 419100979Srwatson mpe->mpe_function; 420100979Srwatson break; 421104514Srwatson case MAC_INIT_MOUNT_LABEL: 422104514Srwatson mpc->mpc_ops->mpo_init_mount_label = 423100979Srwatson mpe->mpe_function; 424100979Srwatson break; 425104514Srwatson case MAC_INIT_MOUNT_FS_LABEL: 426104514Srwatson mpc->mpc_ops->mpo_init_mount_fs_label = 427100979Srwatson mpe->mpe_function; 428100979Srwatson break; 429104514Srwatson case MAC_INIT_PIPE_LABEL: 430104514Srwatson mpc->mpc_ops->mpo_init_pipe_label = 431100979Srwatson mpe->mpe_function; 432100979Srwatson break; 433104514Srwatson case MAC_INIT_SOCKET_LABEL: 434104514Srwatson mpc->mpc_ops->mpo_init_socket_label = 435100979Srwatson mpe->mpe_function; 436100979Srwatson break; 437104514Srwatson case MAC_INIT_SOCKET_PEER_LABEL: 438104514Srwatson mpc->mpc_ops->mpo_init_socket_peer_label = 439100979Srwatson mpe->mpe_function; 440100979Srwatson break; 441104514Srwatson case MAC_INIT_TEMP_LABEL: 442104514Srwatson mpc->mpc_ops->mpo_init_temp_label = 443100979Srwatson mpe->mpe_function; 444100979Srwatson break; 445104514Srwatson case MAC_INIT_VNODE_LABEL: 446104514Srwatson mpc->mpc_ops->mpo_init_vnode_label = 447100979Srwatson mpe->mpe_function; 448100979Srwatson break; 449104514Srwatson case MAC_DESTROY_BPFDESC_LABEL: 450104514Srwatson mpc->mpc_ops->mpo_destroy_bpfdesc_label = 451100979Srwatson mpe->mpe_function; 452100979Srwatson break; 453104514Srwatson case MAC_DESTROY_CRED_LABEL: 454104514Srwatson mpc->mpc_ops->mpo_destroy_cred_label = 455100979Srwatson mpe->mpe_function; 456100979Srwatson break; 457104514Srwatson case MAC_DESTROY_DEVFSDIRENT_LABEL: 458104514Srwatson mpc->mpc_ops->mpo_destroy_devfsdirent_label = 459100979Srwatson mpe->mpe_function; 460100979Srwatson break; 461104514Srwatson case MAC_DESTROY_IFNET_LABEL: 462104514Srwatson mpc->mpc_ops->mpo_destroy_ifnet_label = 463100979Srwatson mpe->mpe_function; 464100979Srwatson break; 465104514Srwatson case MAC_DESTROY_IPQ_LABEL: 466104514Srwatson mpc->mpc_ops->mpo_destroy_ipq_label = 467100979Srwatson mpe->mpe_function; 468100979Srwatson break; 469104514Srwatson case MAC_DESTROY_MBUF_LABEL: 470104514Srwatson mpc->mpc_ops->mpo_destroy_mbuf_label = 471100979Srwatson mpe->mpe_function; 472100979Srwatson break; 473104514Srwatson case MAC_DESTROY_MOUNT_LABEL: 474104514Srwatson mpc->mpc_ops->mpo_destroy_mount_label = 475100979Srwatson mpe->mpe_function; 476100979Srwatson break; 477104514Srwatson case MAC_DESTROY_MOUNT_FS_LABEL: 478104514Srwatson mpc->mpc_ops->mpo_destroy_mount_fs_label = 479100979Srwatson mpe->mpe_function; 480100979Srwatson break; 481104514Srwatson case MAC_DESTROY_PIPE_LABEL: 482104514Srwatson mpc->mpc_ops->mpo_destroy_pipe_label = 483100979Srwatson mpe->mpe_function; 484100979Srwatson break; 485104514Srwatson case MAC_DESTROY_SOCKET_LABEL: 486104514Srwatson mpc->mpc_ops->mpo_destroy_socket_label = 487104514Srwatson mpe->mpe_function; 488104514Srwatson break; 489104514Srwatson case MAC_DESTROY_SOCKET_PEER_LABEL: 490104514Srwatson mpc->mpc_ops->mpo_destroy_socket_peer_label = 491104514Srwatson mpe->mpe_function; 492104514Srwatson break; 493104514Srwatson case MAC_DESTROY_TEMP_LABEL: 494104514Srwatson mpc->mpc_ops->mpo_destroy_temp_label = 495104514Srwatson mpe->mpe_function; 496104514Srwatson break; 497104514Srwatson case MAC_DESTROY_VNODE_LABEL: 498104514Srwatson mpc->mpc_ops->mpo_destroy_vnode_label = 499104514Srwatson mpe->mpe_function; 500104514Srwatson break; 501100979Srwatson case MAC_EXTERNALIZE: 502100979Srwatson mpc->mpc_ops->mpo_externalize = 503100979Srwatson mpe->mpe_function; 504100979Srwatson break; 505100979Srwatson case MAC_INTERNALIZE: 506100979Srwatson mpc->mpc_ops->mpo_internalize = 507100979Srwatson mpe->mpe_function; 508100979Srwatson break; 509100979Srwatson case MAC_CREATE_DEVFS_DEVICE: 510100979Srwatson mpc->mpc_ops->mpo_create_devfs_device = 511100979Srwatson mpe->mpe_function; 512100979Srwatson break; 513100979Srwatson case MAC_CREATE_DEVFS_DIRECTORY: 514100979Srwatson mpc->mpc_ops->mpo_create_devfs_directory = 515100979Srwatson mpe->mpe_function; 516100979Srwatson break; 517100979Srwatson case MAC_CREATE_DEVFS_VNODE: 518100979Srwatson mpc->mpc_ops->mpo_create_devfs_vnode = 519100979Srwatson mpe->mpe_function; 520100979Srwatson break; 521100979Srwatson case MAC_STDCREATEVNODE_EA: 522100979Srwatson mpc->mpc_ops->mpo_stdcreatevnode_ea = 523100979Srwatson mpe->mpe_function; 524100979Srwatson break; 525100979Srwatson case MAC_CREATE_VNODE: 526100979Srwatson mpc->mpc_ops->mpo_create_vnode = 527100979Srwatson mpe->mpe_function; 528100979Srwatson break; 529100979Srwatson case MAC_CREATE_MOUNT: 530100979Srwatson mpc->mpc_ops->mpo_create_mount = 531100979Srwatson mpe->mpe_function; 532100979Srwatson break; 533100979Srwatson case MAC_CREATE_ROOT_MOUNT: 534100979Srwatson mpc->mpc_ops->mpo_create_root_mount = 535100979Srwatson mpe->mpe_function; 536100979Srwatson break; 537100979Srwatson case MAC_RELABEL_VNODE: 538100979Srwatson mpc->mpc_ops->mpo_relabel_vnode = 539100979Srwatson mpe->mpe_function; 540100979Srwatson break; 541100979Srwatson case MAC_UPDATE_DEVFSDIRENT: 542100979Srwatson mpc->mpc_ops->mpo_update_devfsdirent = 543100979Srwatson mpe->mpe_function; 544100979Srwatson break; 545100979Srwatson case MAC_UPDATE_PROCFSVNODE: 546100979Srwatson mpc->mpc_ops->mpo_update_procfsvnode = 547100979Srwatson mpe->mpe_function; 548100979Srwatson break; 549100979Srwatson case MAC_UPDATE_VNODE_FROM_EXTATTR: 550100979Srwatson mpc->mpc_ops->mpo_update_vnode_from_extattr = 551100979Srwatson mpe->mpe_function; 552100979Srwatson break; 553100979Srwatson case MAC_UPDATE_VNODE_FROM_EXTERNALIZED: 554100979Srwatson mpc->mpc_ops->mpo_update_vnode_from_externalized = 555100979Srwatson mpe->mpe_function; 556100979Srwatson break; 557100979Srwatson case MAC_UPDATE_VNODE_FROM_MOUNT: 558100979Srwatson mpc->mpc_ops->mpo_update_vnode_from_mount = 559100979Srwatson mpe->mpe_function; 560100979Srwatson break; 561100979Srwatson case MAC_CREATE_MBUF_FROM_SOCKET: 562100979Srwatson mpc->mpc_ops->mpo_create_mbuf_from_socket = 563100979Srwatson mpe->mpe_function; 564100979Srwatson break; 565100979Srwatson case MAC_CREATE_PIPE: 566100979Srwatson mpc->mpc_ops->mpo_create_pipe = 567100979Srwatson mpe->mpe_function; 568100979Srwatson break; 569100979Srwatson case MAC_CREATE_SOCKET: 570100979Srwatson mpc->mpc_ops->mpo_create_socket = 571100979Srwatson mpe->mpe_function; 572100979Srwatson break; 573100979Srwatson case MAC_CREATE_SOCKET_FROM_SOCKET: 574100979Srwatson mpc->mpc_ops->mpo_create_socket_from_socket = 575100979Srwatson mpe->mpe_function; 576100979Srwatson break; 577100979Srwatson case MAC_RELABEL_PIPE: 578100979Srwatson mpc->mpc_ops->mpo_relabel_pipe = 579100979Srwatson mpe->mpe_function; 580100979Srwatson break; 581100979Srwatson case MAC_RELABEL_SOCKET: 582100979Srwatson mpc->mpc_ops->mpo_relabel_socket = 583100979Srwatson mpe->mpe_function; 584100979Srwatson break; 585100979Srwatson case MAC_SET_SOCKET_PEER_FROM_MBUF: 586100979Srwatson mpc->mpc_ops->mpo_set_socket_peer_from_mbuf = 587100979Srwatson mpe->mpe_function; 588100979Srwatson break; 589100979Srwatson case MAC_SET_SOCKET_PEER_FROM_SOCKET: 590100979Srwatson mpc->mpc_ops->mpo_set_socket_peer_from_socket = 591100979Srwatson mpe->mpe_function; 592100979Srwatson break; 593100979Srwatson case MAC_CREATE_BPFDESC: 594100979Srwatson mpc->mpc_ops->mpo_create_bpfdesc = 595100979Srwatson mpe->mpe_function; 596100979Srwatson break; 597100979Srwatson case MAC_CREATE_DATAGRAM_FROM_IPQ: 598100979Srwatson mpc->mpc_ops->mpo_create_datagram_from_ipq = 599100979Srwatson mpe->mpe_function; 600100979Srwatson break; 601100979Srwatson case MAC_CREATE_FRAGMENT: 602100979Srwatson mpc->mpc_ops->mpo_create_fragment = 603100979Srwatson mpe->mpe_function; 604100979Srwatson break; 605100979Srwatson case MAC_CREATE_IFNET: 606100979Srwatson mpc->mpc_ops->mpo_create_ifnet = 607100979Srwatson mpe->mpe_function; 608100979Srwatson break; 609100979Srwatson case MAC_CREATE_IPQ: 610100979Srwatson mpc->mpc_ops->mpo_create_ipq = 611100979Srwatson mpe->mpe_function; 612100979Srwatson break; 613100979Srwatson case MAC_CREATE_MBUF_FROM_MBUF: 614100979Srwatson mpc->mpc_ops->mpo_create_mbuf_from_mbuf = 615100979Srwatson mpe->mpe_function; 616100979Srwatson break; 617100979Srwatson case MAC_CREATE_MBUF_LINKLAYER: 618100979Srwatson mpc->mpc_ops->mpo_create_mbuf_linklayer = 619100979Srwatson mpe->mpe_function; 620100979Srwatson break; 621100979Srwatson case MAC_CREATE_MBUF_FROM_BPFDESC: 622100979Srwatson mpc->mpc_ops->mpo_create_mbuf_from_bpfdesc = 623100979Srwatson mpe->mpe_function; 624100979Srwatson break; 625100979Srwatson case MAC_CREATE_MBUF_FROM_IFNET: 626100979Srwatson mpc->mpc_ops->mpo_create_mbuf_from_ifnet = 627100979Srwatson mpe->mpe_function; 628100979Srwatson break; 629100979Srwatson case MAC_CREATE_MBUF_MULTICAST_ENCAP: 630100979Srwatson mpc->mpc_ops->mpo_create_mbuf_multicast_encap = 631100979Srwatson mpe->mpe_function; 632100979Srwatson break; 633100979Srwatson case MAC_CREATE_MBUF_NETLAYER: 634100979Srwatson mpc->mpc_ops->mpo_create_mbuf_netlayer = 635100979Srwatson mpe->mpe_function; 636100979Srwatson break; 637100979Srwatson case MAC_FRAGMENT_MATCH: 638100979Srwatson mpc->mpc_ops->mpo_fragment_match = 639100979Srwatson mpe->mpe_function; 640100979Srwatson break; 641100979Srwatson case MAC_RELABEL_IFNET: 642100979Srwatson mpc->mpc_ops->mpo_relabel_ifnet = 643100979Srwatson mpe->mpe_function; 644100979Srwatson break; 645100979Srwatson case MAC_UPDATE_IPQ: 646100979Srwatson mpc->mpc_ops->mpo_update_ipq = 647100979Srwatson mpe->mpe_function; 648100979Srwatson break; 649100979Srwatson case MAC_CREATE_CRED: 650100979Srwatson mpc->mpc_ops->mpo_create_cred = 651100979Srwatson mpe->mpe_function; 652100979Srwatson break; 653100979Srwatson case MAC_EXECVE_TRANSITION: 654100979Srwatson mpc->mpc_ops->mpo_execve_transition = 655100979Srwatson mpe->mpe_function; 656100979Srwatson break; 657100979Srwatson case MAC_EXECVE_WILL_TRANSITION: 658100979Srwatson mpc->mpc_ops->mpo_execve_will_transition = 659100979Srwatson mpe->mpe_function; 660100979Srwatson break; 661100979Srwatson case MAC_CREATE_PROC0: 662100979Srwatson mpc->mpc_ops->mpo_create_proc0 = mpe->mpe_function; 663100979Srwatson break; 664100979Srwatson case MAC_CREATE_PROC1: 665100979Srwatson mpc->mpc_ops->mpo_create_proc1 = mpe->mpe_function; 666100979Srwatson break; 667100979Srwatson case MAC_RELABEL_CRED: 668100979Srwatson mpc->mpc_ops->mpo_relabel_cred = 669100979Srwatson mpe->mpe_function; 670100979Srwatson break; 671104338Srwatson case MAC_THREAD_USERRET: 672104338Srwatson mpc->mpc_ops->mpo_thread_userret = 673104338Srwatson mpe->mpe_function; 674104338Srwatson break; 675100979Srwatson case MAC_CHECK_BPFDESC_RECEIVE: 676100979Srwatson mpc->mpc_ops->mpo_check_bpfdesc_receive = 677100979Srwatson mpe->mpe_function; 678100979Srwatson break; 679100979Srwatson case MAC_CHECK_CRED_RELABEL: 680100979Srwatson mpc->mpc_ops->mpo_check_cred_relabel = 681100979Srwatson mpe->mpe_function; 682100979Srwatson break; 683100979Srwatson case MAC_CHECK_CRED_VISIBLE: 684100979Srwatson mpc->mpc_ops->mpo_check_cred_visible = 685100979Srwatson mpe->mpe_function; 686100979Srwatson break; 687100979Srwatson case MAC_CHECK_IFNET_RELABEL: 688100979Srwatson mpc->mpc_ops->mpo_check_ifnet_relabel = 689100979Srwatson mpe->mpe_function; 690100979Srwatson break; 691100979Srwatson case MAC_CHECK_IFNET_TRANSMIT: 692100979Srwatson mpc->mpc_ops->mpo_check_ifnet_transmit = 693100979Srwatson mpe->mpe_function; 694100979Srwatson break; 695100979Srwatson case MAC_CHECK_MOUNT_STAT: 696100979Srwatson mpc->mpc_ops->mpo_check_mount_stat = 697100979Srwatson mpe->mpe_function; 698100979Srwatson break; 699100979Srwatson case MAC_CHECK_PIPE_IOCTL: 700100979Srwatson mpc->mpc_ops->mpo_check_pipe_ioctl = 701100979Srwatson mpe->mpe_function; 702100979Srwatson break; 703102115Srwatson case MAC_CHECK_PIPE_POLL: 704102115Srwatson mpc->mpc_ops->mpo_check_pipe_poll = 705100979Srwatson mpe->mpe_function; 706100979Srwatson break; 707102115Srwatson case MAC_CHECK_PIPE_READ: 708102115Srwatson mpc->mpc_ops->mpo_check_pipe_read = 709102115Srwatson mpe->mpe_function; 710102115Srwatson break; 711100979Srwatson case MAC_CHECK_PIPE_RELABEL: 712100979Srwatson mpc->mpc_ops->mpo_check_pipe_relabel = 713100979Srwatson mpe->mpe_function; 714100979Srwatson break; 715102115Srwatson case MAC_CHECK_PIPE_STAT: 716102115Srwatson mpc->mpc_ops->mpo_check_pipe_stat = 717102115Srwatson mpe->mpe_function; 718102115Srwatson break; 719102115Srwatson case MAC_CHECK_PIPE_WRITE: 720102115Srwatson mpc->mpc_ops->mpo_check_pipe_write = 721102115Srwatson mpe->mpe_function; 722102115Srwatson break; 723100979Srwatson case MAC_CHECK_PROC_DEBUG: 724100979Srwatson mpc->mpc_ops->mpo_check_proc_debug = 725100979Srwatson mpe->mpe_function; 726100979Srwatson break; 727100979Srwatson case MAC_CHECK_PROC_SCHED: 728100979Srwatson mpc->mpc_ops->mpo_check_proc_sched = 729100979Srwatson mpe->mpe_function; 730100979Srwatson break; 731100979Srwatson case MAC_CHECK_PROC_SIGNAL: 732100979Srwatson mpc->mpc_ops->mpo_check_proc_signal = 733100979Srwatson mpe->mpe_function; 734100979Srwatson break; 735100979Srwatson case MAC_CHECK_SOCKET_BIND: 736100979Srwatson mpc->mpc_ops->mpo_check_socket_bind = 737100979Srwatson mpe->mpe_function; 738100979Srwatson break; 739100979Srwatson case MAC_CHECK_SOCKET_CONNECT: 740100979Srwatson mpc->mpc_ops->mpo_check_socket_connect = 741100979Srwatson mpe->mpe_function; 742100979Srwatson break; 743101933Srwatson case MAC_CHECK_SOCKET_DELIVER: 744101933Srwatson mpc->mpc_ops->mpo_check_socket_deliver = 745101933Srwatson mpe->mpe_function; 746101933Srwatson break; 747100979Srwatson case MAC_CHECK_SOCKET_LISTEN: 748100979Srwatson mpc->mpc_ops->mpo_check_socket_listen = 749100979Srwatson mpe->mpe_function; 750100979Srwatson break; 751100979Srwatson case MAC_CHECK_SOCKET_RELABEL: 752100979Srwatson mpc->mpc_ops->mpo_check_socket_relabel = 753100979Srwatson mpe->mpe_function; 754100979Srwatson break; 755100979Srwatson case MAC_CHECK_SOCKET_VISIBLE: 756100979Srwatson mpc->mpc_ops->mpo_check_socket_visible = 757100979Srwatson mpe->mpe_function; 758100979Srwatson break; 759100979Srwatson case MAC_CHECK_VNODE_ACCESS: 760100979Srwatson mpc->mpc_ops->mpo_check_vnode_access = 761100979Srwatson mpe->mpe_function; 762100979Srwatson break; 763100979Srwatson case MAC_CHECK_VNODE_CHDIR: 764100979Srwatson mpc->mpc_ops->mpo_check_vnode_chdir = 765100979Srwatson mpe->mpe_function; 766100979Srwatson break; 767100979Srwatson case MAC_CHECK_VNODE_CHROOT: 768100979Srwatson mpc->mpc_ops->mpo_check_vnode_chroot = 769100979Srwatson mpe->mpe_function; 770100979Srwatson break; 771100979Srwatson case MAC_CHECK_VNODE_CREATE: 772100979Srwatson mpc->mpc_ops->mpo_check_vnode_create = 773100979Srwatson mpe->mpe_function; 774100979Srwatson break; 775100979Srwatson case MAC_CHECK_VNODE_DELETE: 776100979Srwatson mpc->mpc_ops->mpo_check_vnode_delete = 777100979Srwatson mpe->mpe_function; 778100979Srwatson break; 779100979Srwatson case MAC_CHECK_VNODE_DELETEACL: 780100979Srwatson mpc->mpc_ops->mpo_check_vnode_deleteacl = 781100979Srwatson mpe->mpe_function; 782100979Srwatson break; 783100979Srwatson case MAC_CHECK_VNODE_EXEC: 784100979Srwatson mpc->mpc_ops->mpo_check_vnode_exec = 785100979Srwatson mpe->mpe_function; 786100979Srwatson break; 787100979Srwatson case MAC_CHECK_VNODE_GETACL: 788100979Srwatson mpc->mpc_ops->mpo_check_vnode_getacl = 789100979Srwatson mpe->mpe_function; 790100979Srwatson break; 791100979Srwatson case MAC_CHECK_VNODE_GETEXTATTR: 792100979Srwatson mpc->mpc_ops->mpo_check_vnode_getextattr = 793100979Srwatson mpe->mpe_function; 794100979Srwatson break; 795100979Srwatson case MAC_CHECK_VNODE_LOOKUP: 796100979Srwatson mpc->mpc_ops->mpo_check_vnode_lookup = 797100979Srwatson mpe->mpe_function; 798100979Srwatson break; 799100979Srwatson case MAC_CHECK_VNODE_MMAP_PERMS: 800100979Srwatson mpc->mpc_ops->mpo_check_vnode_mmap_perms = 801100979Srwatson mpe->mpe_function; 802100979Srwatson break; 803100979Srwatson case MAC_CHECK_VNODE_OPEN: 804100979Srwatson mpc->mpc_ops->mpo_check_vnode_open = 805100979Srwatson mpe->mpe_function; 806100979Srwatson break; 807102112Srwatson case MAC_CHECK_VNODE_POLL: 808102112Srwatson mpc->mpc_ops->mpo_check_vnode_poll = 809102112Srwatson mpe->mpe_function; 810102112Srwatson break; 811102112Srwatson case MAC_CHECK_VNODE_READ: 812102112Srwatson mpc->mpc_ops->mpo_check_vnode_read = 813102112Srwatson mpe->mpe_function; 814102112Srwatson break; 815100979Srwatson case MAC_CHECK_VNODE_READDIR: 816100979Srwatson mpc->mpc_ops->mpo_check_vnode_readdir = 817100979Srwatson mpe->mpe_function; 818100979Srwatson break; 819100979Srwatson case MAC_CHECK_VNODE_READLINK: 820100979Srwatson mpc->mpc_ops->mpo_check_vnode_readlink = 821100979Srwatson mpe->mpe_function; 822100979Srwatson break; 823100979Srwatson case MAC_CHECK_VNODE_RELABEL: 824100979Srwatson mpc->mpc_ops->mpo_check_vnode_relabel = 825100979Srwatson mpe->mpe_function; 826100979Srwatson break; 827100979Srwatson case MAC_CHECK_VNODE_RENAME_FROM: 828100979Srwatson mpc->mpc_ops->mpo_check_vnode_rename_from = 829100979Srwatson mpe->mpe_function; 830100979Srwatson break; 831100979Srwatson case MAC_CHECK_VNODE_RENAME_TO: 832100979Srwatson mpc->mpc_ops->mpo_check_vnode_rename_to = 833100979Srwatson mpe->mpe_function; 834100979Srwatson break; 835100979Srwatson case MAC_CHECK_VNODE_REVOKE: 836100979Srwatson mpc->mpc_ops->mpo_check_vnode_revoke = 837100979Srwatson mpe->mpe_function; 838100979Srwatson break; 839100979Srwatson case MAC_CHECK_VNODE_SETACL: 840100979Srwatson mpc->mpc_ops->mpo_check_vnode_setacl = 841100979Srwatson mpe->mpe_function; 842100979Srwatson break; 843100979Srwatson case MAC_CHECK_VNODE_SETEXTATTR: 844100979Srwatson mpc->mpc_ops->mpo_check_vnode_setextattr = 845100979Srwatson mpe->mpe_function; 846100979Srwatson break; 847100979Srwatson case MAC_CHECK_VNODE_SETFLAGS: 848100979Srwatson mpc->mpc_ops->mpo_check_vnode_setflags = 849100979Srwatson mpe->mpe_function; 850100979Srwatson break; 851100979Srwatson case MAC_CHECK_VNODE_SETMODE: 852100979Srwatson mpc->mpc_ops->mpo_check_vnode_setmode = 853100979Srwatson mpe->mpe_function; 854100979Srwatson break; 855100979Srwatson case MAC_CHECK_VNODE_SETOWNER: 856100979Srwatson mpc->mpc_ops->mpo_check_vnode_setowner = 857100979Srwatson mpe->mpe_function; 858100979Srwatson break; 859100979Srwatson case MAC_CHECK_VNODE_SETUTIMES: 860100979Srwatson mpc->mpc_ops->mpo_check_vnode_setutimes = 861100979Srwatson mpe->mpe_function; 862100979Srwatson break; 863100979Srwatson case MAC_CHECK_VNODE_STAT: 864100979Srwatson mpc->mpc_ops->mpo_check_vnode_stat = 865100979Srwatson mpe->mpe_function; 866100979Srwatson break; 867102112Srwatson case MAC_CHECK_VNODE_WRITE: 868102112Srwatson mpc->mpc_ops->mpo_check_vnode_write = 869102112Srwatson mpe->mpe_function; 870102112Srwatson break; 871100979Srwatson/* 872100979Srwatson default: 873100979Srwatson printf("MAC policy `%s': unknown operation %d\n", 874100979Srwatson mpc->mpc_name, mpe->mpe_constant); 875100979Srwatson return (EINVAL); 876100979Srwatson*/ 877100979Srwatson } 878100979Srwatson } 879100979Srwatson MAC_POLICY_LIST_LOCK(); 880100979Srwatson if (mac_policy_list_busy > 0) { 881100979Srwatson MAC_POLICY_LIST_UNLOCK(); 882100979Srwatson FREE(mpc->mpc_ops, M_MACOPVEC); 883100979Srwatson mpc->mpc_ops = NULL; 884100979Srwatson return (EBUSY); 885100979Srwatson } 886100979Srwatson LIST_FOREACH(tmpc, &mac_policy_list, mpc_list) { 887100979Srwatson if (strcmp(tmpc->mpc_name, mpc->mpc_name) == 0) { 888100979Srwatson MAC_POLICY_LIST_UNLOCK(); 889100979Srwatson FREE(mpc->mpc_ops, M_MACOPVEC); 890100979Srwatson mpc->mpc_ops = NULL; 891100979Srwatson return (EEXIST); 892100979Srwatson } 893100979Srwatson } 894100979Srwatson if (mpc->mpc_field_off != NULL) { 895100979Srwatson slot = ffs(mac_policy_offsets_free); 896100979Srwatson if (slot == 0) { 897100979Srwatson MAC_POLICY_LIST_UNLOCK(); 898100979Srwatson FREE(mpc->mpc_ops, M_MACOPVEC); 899100979Srwatson mpc->mpc_ops = NULL; 900100979Srwatson return (ENOMEM); 901100979Srwatson } 902100979Srwatson slot--; 903100979Srwatson mac_policy_offsets_free &= ~(1 << slot); 904100979Srwatson *mpc->mpc_field_off = slot; 905100979Srwatson } 906100979Srwatson mpc->mpc_runtime_flags |= MPC_RUNTIME_FLAG_REGISTERED; 907100979Srwatson LIST_INSERT_HEAD(&mac_policy_list, mpc, mpc_list); 908100979Srwatson 909100979Srwatson /* Per-policy initialization. */ 910100979Srwatson if (mpc->mpc_ops->mpo_init != NULL) 911100979Srwatson (*(mpc->mpc_ops->mpo_init))(mpc); 912100979Srwatson MAC_POLICY_LIST_UNLOCK(); 913100979Srwatson 914100979Srwatson printf("Security policy loaded: %s (%s)\n", mpc->mpc_fullname, 915100979Srwatson mpc->mpc_name); 916100979Srwatson 917100979Srwatson return (0); 918100979Srwatson} 919100979Srwatson 920100979Srwatsonstatic int 921100979Srwatsonmac_policy_unregister(struct mac_policy_conf *mpc) 922100979Srwatson{ 923100979Srwatson 924100979Srwatson#if 0 925100979Srwatson /* 926100979Srwatson * Don't allow unloading modules with private data. 927100979Srwatson */ 928100979Srwatson if (mpc->mpc_field_off != NULL) 929100979Srwatson return (EBUSY); 930100979Srwatson#endif 931100979Srwatson if ((mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_UNLOADOK) == 0) 932100979Srwatson return (EBUSY); 933100979Srwatson MAC_POLICY_LIST_LOCK(); 934100979Srwatson if (mac_policy_list_busy > 0) { 935100979Srwatson MAC_POLICY_LIST_UNLOCK(); 936100979Srwatson return (EBUSY); 937100979Srwatson } 938100979Srwatson if (mpc->mpc_ops->mpo_destroy != NULL) 939100979Srwatson (*(mpc->mpc_ops->mpo_destroy))(mpc); 940100979Srwatson 941100979Srwatson LIST_REMOVE(mpc, mpc_list); 942100979Srwatson MAC_POLICY_LIST_UNLOCK(); 943100979Srwatson 944100979Srwatson FREE(mpc->mpc_ops, M_MACOPVEC); 945100979Srwatson mpc->mpc_ops = NULL; 946100979Srwatson 947100979Srwatson printf("Security policy unload: %s (%s)\n", mpc->mpc_fullname, 948100979Srwatson mpc->mpc_name); 949100979Srwatson 950100979Srwatson return (0); 951100979Srwatson} 952100979Srwatson 953100979Srwatson/* 954100979Srwatson * Define an error value precedence, and given two arguments, selects the 955100979Srwatson * value with the higher precedence. 956100979Srwatson */ 957100979Srwatsonstatic int 958100979Srwatsonerror_select(int error1, int error2) 959100979Srwatson{ 960100979Srwatson 961100979Srwatson /* Certain decision-making errors take top priority. */ 962100979Srwatson if (error1 == EDEADLK || error2 == EDEADLK) 963100979Srwatson return (EDEADLK); 964100979Srwatson 965100979Srwatson /* Invalid arguments should be reported where possible. */ 966100979Srwatson if (error1 == EINVAL || error2 == EINVAL) 967100979Srwatson return (EINVAL); 968100979Srwatson 969100979Srwatson /* Precedence goes to "visibility", with both process and file. */ 970100979Srwatson if (error1 == ESRCH || error2 == ESRCH) 971100979Srwatson return (ESRCH); 972100979Srwatson 973100979Srwatson if (error1 == ENOENT || error2 == ENOENT) 974100979Srwatson return (ENOENT); 975100979Srwatson 976100979Srwatson /* Precedence goes to DAC/MAC protections. */ 977100979Srwatson if (error1 == EACCES || error2 == EACCES) 978100979Srwatson return (EACCES); 979100979Srwatson 980100979Srwatson /* Precedence goes to privilege. */ 981100979Srwatson if (error1 == EPERM || error2 == EPERM) 982100979Srwatson return (EPERM); 983100979Srwatson 984100979Srwatson /* Precedence goes to error over success; otherwise, arbitrary. */ 985100979Srwatson if (error1 != 0) 986100979Srwatson return (error1); 987100979Srwatson return (error2); 988100979Srwatson} 989100979Srwatson 990100979Srwatsonvoid 991100979Srwatsonmac_update_devfsdirent(struct devfs_dirent *de, struct vnode *vp) 992100979Srwatson{ 993100979Srwatson 994100979Srwatson MAC_PERFORM(update_devfsdirent, de, &de->de_label, vp, &vp->v_label); 995100979Srwatson} 996100979Srwatson 997100979Srwatsonvoid 998100979Srwatsonmac_update_procfsvnode(struct vnode *vp, struct ucred *cred) 999100979Srwatson{ 1000100979Srwatson 1001100979Srwatson MAC_PERFORM(update_procfsvnode, vp, &vp->v_label, cred); 1002100979Srwatson} 1003100979Srwatson 1004100979Srwatson/* 1005100979Srwatson * Support callout for policies that manage their own externalization 1006100979Srwatson * using extended attributes. 1007100979Srwatson */ 1008100979Srwatsonstatic int 1009100979Srwatsonmac_update_vnode_from_extattr(struct vnode *vp, struct mount *mp) 1010100979Srwatson{ 1011100979Srwatson int error; 1012100979Srwatson 1013100979Srwatson MAC_CHECK(update_vnode_from_extattr, vp, &vp->v_label, mp, 1014100979Srwatson &mp->mnt_fslabel); 1015100979Srwatson 1016100979Srwatson return (error); 1017100979Srwatson} 1018100979Srwatson 1019100979Srwatson/* 1020100979Srwatson * Given an externalized mac label, internalize it and stamp it on a 1021100979Srwatson * vnode. 1022100979Srwatson */ 1023100979Srwatsonstatic int 1024100979Srwatsonmac_update_vnode_from_externalized(struct vnode *vp, struct mac *extmac) 1025100979Srwatson{ 1026100979Srwatson int error; 1027100979Srwatson 1028100979Srwatson MAC_CHECK(update_vnode_from_externalized, vp, &vp->v_label, extmac); 1029100979Srwatson 1030100979Srwatson return (error); 1031100979Srwatson} 1032100979Srwatson 1033100979Srwatson/* 1034100979Srwatson * Call out to individual policies to update the label in a vnode from 1035100979Srwatson * the mountpoint. 1036100979Srwatson */ 1037100979Srwatsonvoid 1038100979Srwatsonmac_update_vnode_from_mount(struct vnode *vp, struct mount *mp) 1039100979Srwatson{ 1040100979Srwatson 1041100979Srwatson MAC_PERFORM(update_vnode_from_mount, vp, &vp->v_label, mp, 1042100979Srwatson &mp->mnt_fslabel); 1043100979Srwatson 1044101308Sjeff ASSERT_VOP_LOCKED(vp, "mac_update_vnode_from_mount"); 1045100979Srwatson if (mac_cache_fslabel_in_vnode) 1046101308Sjeff vp->v_vflag |= VV_CACHEDLABEL; 1047100979Srwatson} 1048100979Srwatson 1049100979Srwatson/* 1050100979Srwatson * Implementation of VOP_REFRESHLABEL() that relies on extended attributes 1051100979Srwatson * to store label data. Can be referenced by filesystems supporting 1052100979Srwatson * extended attributes. 1053100979Srwatson */ 1054100979Srwatsonint 1055100979Srwatsonvop_stdrefreshlabel_ea(struct vop_refreshlabel_args *ap) 1056100979Srwatson{ 1057100979Srwatson struct vnode *vp = ap->a_vp; 1058100979Srwatson struct mac extmac; 1059100979Srwatson int buflen, error; 1060100979Srwatson 1061100979Srwatson ASSERT_VOP_LOCKED(vp, "vop_stdrefreshlabel_ea"); 1062100979Srwatson 1063100979Srwatson /* 1064100979Srwatson * Call out to external policies first. Order doesn't really 1065100979Srwatson * matter, as long as failure of one assures failure of all. 1066100979Srwatson */ 1067100979Srwatson error = mac_update_vnode_from_extattr(vp, vp->v_mount); 1068100979Srwatson if (error) 1069100979Srwatson return (error); 1070100979Srwatson 1071100979Srwatson buflen = sizeof(extmac); 1072100979Srwatson error = vn_extattr_get(vp, IO_NODELOCKED, 1073100979Srwatson FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME, &buflen, 1074100979Srwatson (char *)&extmac, curthread); 1075100979Srwatson switch (error) { 1076100979Srwatson case 0: 1077100979Srwatson /* Got it */ 1078100979Srwatson break; 1079100979Srwatson 1080100979Srwatson case ENOATTR: 1081100979Srwatson /* 1082100979Srwatson * Use the label from the mount point. 1083100979Srwatson */ 1084100979Srwatson mac_update_vnode_from_mount(vp, vp->v_mount); 1085100979Srwatson return (0); 1086100979Srwatson 1087100979Srwatson case EOPNOTSUPP: 1088100979Srwatson default: 1089100979Srwatson /* Fail horribly. */ 1090100979Srwatson return (error); 1091100979Srwatson } 1092100979Srwatson 1093100979Srwatson if (buflen != sizeof(extmac)) 1094100979Srwatson error = EPERM; /* Fail very closed. */ 1095100979Srwatson if (error == 0) 1096100979Srwatson error = mac_update_vnode_from_externalized(vp, &extmac); 1097100979Srwatson if (error == 0) 1098101308Sjeff vp->v_vflag |= VV_CACHEDLABEL; 1099100979Srwatson else { 1100100979Srwatson struct vattr va; 1101100979Srwatson 1102100979Srwatson printf("Corrupted label on %s", 1103100979Srwatson vp->v_mount->mnt_stat.f_mntonname); 1104100979Srwatson if (VOP_GETATTR(vp, &va, curthread->td_ucred, curthread) == 0) 1105100979Srwatson printf(" inum %ld", va.va_fileid); 1106104268Srwatson#ifdef MAC_DEBUG 1107100979Srwatson if (mac_debug_label_fallback) { 1108100979Srwatson printf(", falling back.\n"); 1109100979Srwatson mac_update_vnode_from_mount(vp, vp->v_mount); 1110100979Srwatson error = 0; 1111100979Srwatson } else { 1112104268Srwatson#endif 1113100979Srwatson printf(".\n"); 1114100979Srwatson error = EPERM; 1115104268Srwatson#ifdef MAC_DEBUG 1116100979Srwatson } 1117104268Srwatson#endif 1118100979Srwatson } 1119100979Srwatson 1120100979Srwatson return (error); 1121100979Srwatson} 1122100979Srwatson 1123100979Srwatson/* 1124100979Srwatson * Make sure the vnode label is up-to-date. If EOPNOTSUPP, then we handle 1125100979Srwatson * the labeling activity outselves. Filesystems should be careful not 1126100979Srwatson * to change their minds regarding whether they support vop_refreshlabel() 1127100979Srwatson * for a vnode or not. Don't cache the vnode here, allow the file 1128100979Srwatson * system code to determine if it's safe to cache. If we update from 1129100979Srwatson * the mount, don't cache since a change to the mount label should affect 1130100979Srwatson * all vnodes. 1131100979Srwatson */ 1132100979Srwatsonstatic int 1133100979Srwatsonvn_refreshlabel(struct vnode *vp, struct ucred *cred) 1134100979Srwatson{ 1135100979Srwatson int error; 1136100979Srwatson 1137100979Srwatson ASSERT_VOP_LOCKED(vp, "vn_refreshlabel"); 1138100979Srwatson 1139100979Srwatson if (vp->v_mount == NULL) { 1140100979Srwatson/* 1141100979Srwatson Eventually, we probably want to special-case refreshing 1142100979Srwatson of deadfs vnodes, and if there's a lock-free race somewhere, 1143100979Srwatson that case might be handled here. 1144100979Srwatson 1145100979Srwatson mac_update_vnode_deadfs(vp); 1146100979Srwatson return (0); 1147100979Srwatson */ 1148100979Srwatson /* printf("vn_refreshlabel: null v_mount\n"); */ 1149103314Snjl if (vp->v_type != VNON) 1150100979Srwatson printf( 1151103314Snjl "vn_refreshlabel: null v_mount with non-VNON\n"); 1152100979Srwatson return (EBADF); 1153100979Srwatson } 1154100979Srwatson 1155101308Sjeff if (vp->v_vflag & VV_CACHEDLABEL) { 1156100979Srwatson mac_vnode_label_cache_hits++; 1157100979Srwatson return (0); 1158100979Srwatson } else 1159100979Srwatson mac_vnode_label_cache_misses++; 1160100979Srwatson 1161100979Srwatson if ((vp->v_mount->mnt_flag & MNT_MULTILABEL) == 0) { 1162100979Srwatson mac_update_vnode_from_mount(vp, vp->v_mount); 1163100979Srwatson return (0); 1164100979Srwatson } 1165100979Srwatson 1166100979Srwatson error = VOP_REFRESHLABEL(vp, cred, curthread); 1167100979Srwatson switch (error) { 1168100979Srwatson case EOPNOTSUPP: 1169100979Srwatson /* 1170100979Srwatson * If labels are not supported on this vnode, fall back to 1171100979Srwatson * the label in the mount and propagate it to the vnode. 1172100979Srwatson * There should probably be some sort of policy/flag/decision 1173100979Srwatson * about doing this. 1174100979Srwatson */ 1175100979Srwatson mac_update_vnode_from_mount(vp, vp->v_mount); 1176100979Srwatson error = 0; 1177100979Srwatson default: 1178100979Srwatson return (error); 1179100979Srwatson } 1180100979Srwatson} 1181100979Srwatson 1182100979Srwatson/* 1183100979Srwatson * Helper function for file systems using the vop_std*_ea() calls. This 1184100979Srwatson * function must be called after EA service is available for the vnode, 1185100979Srwatson * but before it's hooked up to the namespace so that the node persists 1186100979Srwatson * if there's a crash, or before it can be accessed. On successful 1187100979Srwatson * commit of the label to disk (etc), do cache the label. 1188100979Srwatson */ 1189100979Srwatsonint 1190100979Srwatsonvop_stdcreatevnode_ea(struct vnode *dvp, struct vnode *tvp, struct ucred *cred) 1191100979Srwatson{ 1192100979Srwatson struct mac extmac; 1193100979Srwatson int error; 1194100979Srwatson 1195101308Sjeff ASSERT_VOP_LOCKED(tvp, "vop_stdcreatevnode_ea"); 1196100979Srwatson if ((dvp->v_mount->mnt_flag & MNT_MULTILABEL) == 0) { 1197100979Srwatson mac_update_vnode_from_mount(tvp, tvp->v_mount); 1198100979Srwatson } else { 1199100979Srwatson error = vn_refreshlabel(dvp, cred); 1200100979Srwatson if (error) 1201100979Srwatson return (error); 1202100979Srwatson 1203100979Srwatson /* 1204100979Srwatson * Stick the label in the vnode. Then try to write to 1205100979Srwatson * disk. If we fail, return a failure to abort the 1206100979Srwatson * create operation. Really, this failure shouldn't 1207100979Srwatson * happen except in fairly unusual circumstances (out 1208100979Srwatson * of disk, etc). 1209100979Srwatson */ 1210100979Srwatson mac_create_vnode(cred, dvp, tvp); 1211100979Srwatson 1212100979Srwatson error = mac_stdcreatevnode_ea(tvp); 1213100979Srwatson if (error) 1214100979Srwatson return (error); 1215100979Srwatson 1216100979Srwatson /* 1217100979Srwatson * XXX: Eventually this will go away and all policies will 1218100979Srwatson * directly manage their extended attributes. 1219100979Srwatson */ 1220100979Srwatson error = mac_externalize(&tvp->v_label, &extmac); 1221100979Srwatson if (error) 1222100979Srwatson return (error); 1223100979Srwatson 1224100979Srwatson error = vn_extattr_set(tvp, IO_NODELOCKED, 1225100979Srwatson FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME, 1226100979Srwatson sizeof(extmac), (char *)&extmac, curthread); 1227100979Srwatson if (error == 0) 1228101308Sjeff tvp->v_vflag |= VV_CACHEDLABEL; 1229100979Srwatson else { 1230100979Srwatson#if 0 1231100979Srwatson /* 1232100979Srwatson * In theory, we could have fall-back behavior here. 1233100979Srwatson * It would probably be incorrect. 1234100979Srwatson */ 1235100979Srwatson#endif 1236100979Srwatson return (error); 1237100979Srwatson } 1238100979Srwatson } 1239100979Srwatson 1240100979Srwatson return (0); 1241100979Srwatson} 1242100979Srwatson 1243100979Srwatsonvoid 1244100979Srwatsonmac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp) 1245100979Srwatson{ 1246100979Srwatson int error; 1247100979Srwatson 1248100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_execve_transition"); 1249100979Srwatson 1250100979Srwatson error = vn_refreshlabel(vp, old); 1251100979Srwatson if (error) { 1252100979Srwatson printf("mac_execve_transition: vn_refreshlabel returned %d\n", 1253100979Srwatson error); 1254100979Srwatson printf("mac_execve_transition: using old vnode label\n"); 1255100979Srwatson } 1256100979Srwatson 1257100979Srwatson MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label); 1258100979Srwatson} 1259100979Srwatson 1260100979Srwatsonint 1261100979Srwatsonmac_execve_will_transition(struct ucred *old, struct vnode *vp) 1262100979Srwatson{ 1263100979Srwatson int error, result; 1264100979Srwatson 1265100979Srwatson error = vn_refreshlabel(vp, old); 1266100979Srwatson if (error) 1267100979Srwatson return (error); 1268100979Srwatson 1269100979Srwatson result = 0; 1270100979Srwatson MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label); 1271100979Srwatson 1272100979Srwatson return (result); 1273100979Srwatson} 1274100979Srwatson 1275100979Srwatsonstatic void 1276100979Srwatsonmac_init_label(struct label *label) 1277100979Srwatson{ 1278100979Srwatson 1279100979Srwatson bzero(label, sizeof(*label)); 1280100979Srwatson label->l_flags = MAC_FLAG_INITIALIZED; 1281100979Srwatson} 1282100979Srwatson 1283100979Srwatsonstatic void 1284100979Srwatsonmac_init_structmac(struct mac *mac) 1285100979Srwatson{ 1286100979Srwatson 1287100979Srwatson bzero(mac, sizeof(*mac)); 1288100979Srwatson mac->m_macflags = MAC_FLAG_INITIALIZED; 1289100979Srwatson} 1290100979Srwatson 1291100979Srwatsonstatic void 1292100979Srwatsonmac_destroy_label(struct label *label) 1293100979Srwatson{ 1294100979Srwatson 1295100979Srwatson KASSERT(label->l_flags & MAC_FLAG_INITIALIZED, 1296100979Srwatson ("destroying uninitialized label")); 1297100979Srwatson 1298100979Srwatson bzero(label, sizeof(*label)); 1299100979Srwatson /* implicit: label->l_flags &= ~MAC_FLAG_INITIALIZED; */ 1300100979Srwatson} 1301100979Srwatson 1302100979Srwatsonint 1303100979Srwatsonmac_init_mbuf(struct mbuf *m, int how) 1304100979Srwatson{ 1305100979Srwatson KASSERT(m->m_flags & M_PKTHDR, ("mac_init_mbuf on non-header mbuf")); 1306100979Srwatson 1307100979Srwatson /* "how" is one of M_(TRY|DONT)WAIT */ 1308100979Srwatson mac_init_label(&m->m_pkthdr.label); 1309104514Srwatson MAC_PERFORM(init_mbuf_label, &m->m_pkthdr.label, how); 1310101988Srwatson#ifdef MAC_DEBUG 1311100979Srwatson atomic_add_int(&nmacmbufs, 1); 1312101988Srwatson#endif 1313100979Srwatson return (0); 1314100979Srwatson} 1315100979Srwatson 1316100979Srwatsonvoid 1317100979Srwatsonmac_destroy_mbuf(struct mbuf *m) 1318100979Srwatson{ 1319100979Srwatson 1320104514Srwatson MAC_PERFORM(destroy_mbuf_label, &m->m_pkthdr.label); 1321100979Srwatson mac_destroy_label(&m->m_pkthdr.label); 1322101988Srwatson#ifdef MAC_DEBUG 1323100979Srwatson atomic_subtract_int(&nmacmbufs, 1); 1324101988Srwatson#endif 1325100979Srwatson} 1326100979Srwatson 1327100979Srwatsonvoid 1328100979Srwatsonmac_init_cred(struct ucred *cr) 1329100979Srwatson{ 1330100979Srwatson 1331100979Srwatson mac_init_label(&cr->cr_label); 1332104514Srwatson MAC_PERFORM(init_cred_label, &cr->cr_label); 1333101988Srwatson#ifdef MAC_DEBUG 1334100979Srwatson atomic_add_int(&nmaccreds, 1); 1335101988Srwatson#endif 1336100979Srwatson} 1337100979Srwatson 1338100979Srwatsonvoid 1339100979Srwatsonmac_destroy_cred(struct ucred *cr) 1340100979Srwatson{ 1341100979Srwatson 1342104514Srwatson MAC_PERFORM(destroy_cred_label, &cr->cr_label); 1343100979Srwatson mac_destroy_label(&cr->cr_label); 1344101988Srwatson#ifdef MAC_DEBUG 1345100979Srwatson atomic_subtract_int(&nmaccreds, 1); 1346101988Srwatson#endif 1347100979Srwatson} 1348100979Srwatson 1349100979Srwatsonvoid 1350100979Srwatsonmac_init_ifnet(struct ifnet *ifp) 1351100979Srwatson{ 1352100979Srwatson 1353100979Srwatson mac_init_label(&ifp->if_label); 1354104514Srwatson MAC_PERFORM(init_ifnet_label, &ifp->if_label); 1355101988Srwatson#ifdef MAC_DEBUG 1356100979Srwatson atomic_add_int(&nmacifnets, 1); 1357101988Srwatson#endif 1358100979Srwatson} 1359100979Srwatson 1360100979Srwatsonvoid 1361100979Srwatsonmac_destroy_ifnet(struct ifnet *ifp) 1362100979Srwatson{ 1363100979Srwatson 1364104514Srwatson MAC_PERFORM(destroy_ifnet_label, &ifp->if_label); 1365100979Srwatson mac_destroy_label(&ifp->if_label); 1366101988Srwatson#ifdef MAC_DEBUG 1367100979Srwatson atomic_subtract_int(&nmacifnets, 1); 1368101988Srwatson#endif 1369100979Srwatson} 1370100979Srwatson 1371100979Srwatsonvoid 1372100979Srwatsonmac_init_ipq(struct ipq *ipq) 1373100979Srwatson{ 1374100979Srwatson 1375100979Srwatson mac_init_label(&ipq->ipq_label); 1376104514Srwatson MAC_PERFORM(init_ipq_label, &ipq->ipq_label); 1377101988Srwatson#ifdef MAC_DEBUG 1378100979Srwatson atomic_add_int(&nmacipqs, 1); 1379101988Srwatson#endif 1380100979Srwatson} 1381100979Srwatson 1382100979Srwatsonvoid 1383100979Srwatsonmac_destroy_ipq(struct ipq *ipq) 1384100979Srwatson{ 1385100979Srwatson 1386104514Srwatson MAC_PERFORM(destroy_ipq_label, &ipq->ipq_label); 1387100979Srwatson mac_destroy_label(&ipq->ipq_label); 1388101988Srwatson#ifdef MAC_DEBUG 1389100979Srwatson atomic_subtract_int(&nmacipqs, 1); 1390101988Srwatson#endif 1391100979Srwatson} 1392100979Srwatson 1393100979Srwatsonvoid 1394100979Srwatsonmac_init_socket(struct socket *socket) 1395100979Srwatson{ 1396100979Srwatson 1397100979Srwatson mac_init_label(&socket->so_label); 1398100979Srwatson mac_init_label(&socket->so_peerlabel); 1399104514Srwatson MAC_PERFORM(init_socket_label, &socket->so_label); 1400104514Srwatson MAC_PERFORM(init_socket_peer_label, &socket->so_peerlabel); 1401101988Srwatson#ifdef MAC_DEBUG 1402100979Srwatson atomic_add_int(&nmacsockets, 1); 1403101988Srwatson#endif 1404100979Srwatson} 1405100979Srwatson 1406100979Srwatsonvoid 1407100979Srwatsonmac_destroy_socket(struct socket *socket) 1408100979Srwatson{ 1409100979Srwatson 1410104514Srwatson MAC_PERFORM(destroy_socket_label, &socket->so_label); 1411104514Srwatson MAC_PERFORM(destroy_socket_peer_label, &socket->so_peerlabel); 1412100979Srwatson mac_destroy_label(&socket->so_label); 1413100979Srwatson mac_destroy_label(&socket->so_peerlabel); 1414101988Srwatson#ifdef MAC_DEBUG 1415100979Srwatson atomic_subtract_int(&nmacsockets, 1); 1416101988Srwatson#endif 1417100979Srwatson} 1418100979Srwatson 1419100979Srwatsonvoid 1420100979Srwatsonmac_init_pipe(struct pipe *pipe) 1421100979Srwatson{ 1422100979Srwatson struct label *label; 1423100979Srwatson 1424100979Srwatson label = malloc(sizeof(struct label), M_MACPIPELABEL, M_ZERO|M_WAITOK); 1425100979Srwatson mac_init_label(label); 1426100979Srwatson pipe->pipe_label = label; 1427100979Srwatson pipe->pipe_peer->pipe_label = label; 1428104514Srwatson MAC_PERFORM(init_pipe_label, pipe->pipe_label); 1429101988Srwatson#ifdef MAC_DEBUG 1430100979Srwatson atomic_add_int(&nmacpipes, 1); 1431101988Srwatson#endif 1432100979Srwatson} 1433100979Srwatson 1434100979Srwatsonvoid 1435100979Srwatsonmac_destroy_pipe(struct pipe *pipe) 1436100979Srwatson{ 1437100979Srwatson 1438104514Srwatson MAC_PERFORM(destroy_pipe_label, pipe->pipe_label); 1439100979Srwatson mac_destroy_label(pipe->pipe_label); 1440100979Srwatson free(pipe->pipe_label, M_MACPIPELABEL); 1441101988Srwatson#ifdef MAC_DEBUG 1442100979Srwatson atomic_subtract_int(&nmacpipes, 1); 1443101988Srwatson#endif 1444100979Srwatson} 1445100979Srwatson 1446100979Srwatsonvoid 1447100979Srwatsonmac_init_bpfdesc(struct bpf_d *bpf_d) 1448100979Srwatson{ 1449100979Srwatson 1450100979Srwatson mac_init_label(&bpf_d->bd_label); 1451104514Srwatson MAC_PERFORM(init_bpfdesc_label, &bpf_d->bd_label); 1452101988Srwatson#ifdef MAC_DEBUG 1453100979Srwatson atomic_add_int(&nmacbpfdescs, 1); 1454101988Srwatson#endif 1455100979Srwatson} 1456100979Srwatson 1457100979Srwatsonvoid 1458100979Srwatsonmac_destroy_bpfdesc(struct bpf_d *bpf_d) 1459100979Srwatson{ 1460100979Srwatson 1461104514Srwatson MAC_PERFORM(destroy_bpfdesc_label, &bpf_d->bd_label); 1462100979Srwatson mac_destroy_label(&bpf_d->bd_label); 1463101988Srwatson#ifdef MAC_DEBUG 1464100979Srwatson atomic_subtract_int(&nmacbpfdescs, 1); 1465101988Srwatson#endif 1466100979Srwatson} 1467100979Srwatson 1468100979Srwatsonvoid 1469100979Srwatsonmac_init_mount(struct mount *mp) 1470100979Srwatson{ 1471100979Srwatson 1472100979Srwatson mac_init_label(&mp->mnt_mntlabel); 1473100979Srwatson mac_init_label(&mp->mnt_fslabel); 1474104514Srwatson MAC_PERFORM(init_mount_label, &mp->mnt_mntlabel); 1475104514Srwatson MAC_PERFORM(init_mount_fs_label, &mp->mnt_fslabel); 1476101988Srwatson#ifdef MAC_DEBUG 1477100979Srwatson atomic_add_int(&nmacmounts, 1); 1478101988Srwatson#endif 1479100979Srwatson} 1480100979Srwatson 1481100979Srwatsonvoid 1482100979Srwatsonmac_destroy_mount(struct mount *mp) 1483100979Srwatson{ 1484100979Srwatson 1485104514Srwatson MAC_PERFORM(destroy_mount_label, &mp->mnt_mntlabel); 1486104514Srwatson MAC_PERFORM(destroy_mount_fs_label, &mp->mnt_fslabel); 1487100979Srwatson mac_destroy_label(&mp->mnt_fslabel); 1488100979Srwatson mac_destroy_label(&mp->mnt_mntlabel); 1489101988Srwatson#ifdef MAC_DEBUG 1490100979Srwatson atomic_subtract_int(&nmacmounts, 1); 1491101988Srwatson#endif 1492100979Srwatson} 1493100979Srwatson 1494100979Srwatsonstatic void 1495100979Srwatsonmac_init_temp(struct label *label) 1496100979Srwatson{ 1497100979Srwatson 1498100979Srwatson mac_init_label(label); 1499104514Srwatson MAC_PERFORM(init_temp_label, label); 1500101988Srwatson#ifdef MAC_DEBUG 1501100979Srwatson atomic_add_int(&nmactemp, 1); 1502101988Srwatson#endif 1503100979Srwatson} 1504100979Srwatson 1505100979Srwatsonstatic void 1506100979Srwatsonmac_destroy_temp(struct label *label) 1507100979Srwatson{ 1508100979Srwatson 1509104514Srwatson MAC_PERFORM(destroy_temp_label, label); 1510100979Srwatson mac_destroy_label(label); 1511101988Srwatson#ifdef MAC_DEBUG 1512100979Srwatson atomic_subtract_int(&nmactemp, 1); 1513101988Srwatson#endif 1514100979Srwatson} 1515100979Srwatson 1516100979Srwatsonvoid 1517100979Srwatsonmac_init_vnode(struct vnode *vp) 1518100979Srwatson{ 1519100979Srwatson 1520100979Srwatson mac_init_label(&vp->v_label); 1521104514Srwatson MAC_PERFORM(init_vnode_label, &vp->v_label); 1522101988Srwatson#ifdef MAC_DEBUG 1523100979Srwatson atomic_add_int(&nmacvnodes, 1); 1524101988Srwatson#endif 1525100979Srwatson} 1526100979Srwatson 1527100979Srwatsonvoid 1528100979Srwatsonmac_destroy_vnode(struct vnode *vp) 1529100979Srwatson{ 1530100979Srwatson 1531104514Srwatson MAC_PERFORM(destroy_vnode_label, &vp->v_label); 1532100979Srwatson mac_destroy_label(&vp->v_label); 1533101988Srwatson#ifdef MAC_DEBUG 1534100979Srwatson atomic_subtract_int(&nmacvnodes, 1); 1535101988Srwatson#endif 1536100979Srwatson} 1537100979Srwatson 1538100979Srwatsonvoid 1539100979Srwatsonmac_init_devfsdirent(struct devfs_dirent *de) 1540100979Srwatson{ 1541100979Srwatson 1542100979Srwatson mac_init_label(&de->de_label); 1543104514Srwatson MAC_PERFORM(init_devfsdirent_label, &de->de_label); 1544101988Srwatson#ifdef MAC_DEBUG 1545100979Srwatson atomic_add_int(&nmacdevfsdirents, 1); 1546101988Srwatson#endif 1547100979Srwatson} 1548100979Srwatson 1549100979Srwatsonvoid 1550100979Srwatsonmac_destroy_devfsdirent(struct devfs_dirent *de) 1551100979Srwatson{ 1552100979Srwatson 1553104514Srwatson MAC_PERFORM(destroy_devfsdirent_label, &de->de_label); 1554100979Srwatson mac_destroy_label(&de->de_label); 1555101988Srwatson#ifdef MAC_DEBUG 1556100979Srwatson atomic_subtract_int(&nmacdevfsdirents, 1); 1557101988Srwatson#endif 1558100979Srwatson} 1559100979Srwatson 1560100979Srwatsonstatic int 1561100979Srwatsonmac_externalize(struct label *label, struct mac *mac) 1562100979Srwatson{ 1563100979Srwatson int error; 1564100979Srwatson 1565100979Srwatson mac_init_structmac(mac); 1566100979Srwatson MAC_CHECK(externalize, label, mac); 1567100979Srwatson 1568100979Srwatson return (error); 1569100979Srwatson} 1570100979Srwatson 1571100979Srwatsonstatic int 1572100979Srwatsonmac_internalize(struct label *label, struct mac *mac) 1573100979Srwatson{ 1574100979Srwatson int error; 1575100979Srwatson 1576100979Srwatson mac_init_temp(label); 1577100979Srwatson MAC_CHECK(internalize, label, mac); 1578100979Srwatson if (error) 1579100979Srwatson mac_destroy_temp(label); 1580100979Srwatson 1581100979Srwatson return (error); 1582100979Srwatson} 1583100979Srwatson 1584100979Srwatson/* 1585100979Srwatson * Initialize MAC label for the first kernel process, from which other 1586100979Srwatson * kernel processes and threads are spawned. 1587100979Srwatson */ 1588100979Srwatsonvoid 1589100979Srwatsonmac_create_proc0(struct ucred *cred) 1590100979Srwatson{ 1591100979Srwatson 1592100979Srwatson MAC_PERFORM(create_proc0, cred); 1593100979Srwatson} 1594100979Srwatson 1595100979Srwatson/* 1596100979Srwatson * Initialize MAC label for the first userland process, from which other 1597100979Srwatson * userland processes and threads are spawned. 1598100979Srwatson */ 1599100979Srwatsonvoid 1600100979Srwatsonmac_create_proc1(struct ucred *cred) 1601100979Srwatson{ 1602100979Srwatson 1603100979Srwatson MAC_PERFORM(create_proc1, cred); 1604100979Srwatson} 1605100979Srwatson 1606104338Srwatsonvoid 1607104338Srwatsonmac_thread_userret(struct thread *td) 1608104338Srwatson{ 1609104338Srwatson 1610104338Srwatson MAC_PERFORM(thread_userret, td); 1611104338Srwatson} 1612104338Srwatson 1613100979Srwatson/* 1614100979Srwatson * When a new process is created, its label must be initialized. Generally, 1615100979Srwatson * this involves inheritence from the parent process, modulo possible 1616100979Srwatson * deltas. This function allows that processing to take place. 1617100979Srwatson */ 1618100979Srwatsonvoid 1619100979Srwatsonmac_create_cred(struct ucred *parent_cred, struct ucred *child_cred) 1620100979Srwatson{ 1621100979Srwatson 1622100979Srwatson MAC_PERFORM(create_cred, parent_cred, child_cred); 1623100979Srwatson} 1624100979Srwatson 1625100979Srwatsonint 1626100979Srwatsonmac_check_vnode_access(struct ucred *cred, struct vnode *vp, int flags) 1627100979Srwatson{ 1628100979Srwatson int error; 1629100979Srwatson 1630100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_access"); 1631100979Srwatson 1632100979Srwatson if (!mac_enforce_fs) 1633100979Srwatson return (0); 1634100979Srwatson 1635100979Srwatson error = vn_refreshlabel(vp, cred); 1636100979Srwatson if (error) 1637100979Srwatson return (error); 1638100979Srwatson 1639100979Srwatson MAC_CHECK(check_vnode_access, cred, vp, &vp->v_label, flags); 1640100979Srwatson return (error); 1641100979Srwatson} 1642100979Srwatson 1643100979Srwatsonint 1644100979Srwatsonmac_check_vnode_chdir(struct ucred *cred, struct vnode *dvp) 1645100979Srwatson{ 1646100979Srwatson int error; 1647100979Srwatson 1648100979Srwatson ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_chdir"); 1649100979Srwatson 1650100979Srwatson if (!mac_enforce_fs) 1651100979Srwatson return (0); 1652100979Srwatson 1653100979Srwatson error = vn_refreshlabel(dvp, cred); 1654100979Srwatson if (error) 1655100979Srwatson return (error); 1656100979Srwatson 1657100979Srwatson MAC_CHECK(check_vnode_chdir, cred, dvp, &dvp->v_label); 1658100979Srwatson return (error); 1659100979Srwatson} 1660100979Srwatson 1661100979Srwatsonint 1662100979Srwatsonmac_check_vnode_chroot(struct ucred *cred, struct vnode *dvp) 1663100979Srwatson{ 1664100979Srwatson int error; 1665100979Srwatson 1666100979Srwatson ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_chroot"); 1667100979Srwatson 1668100979Srwatson if (!mac_enforce_fs) 1669100979Srwatson return (0); 1670100979Srwatson 1671100979Srwatson error = vn_refreshlabel(dvp, cred); 1672100979Srwatson if (error) 1673100979Srwatson return (error); 1674100979Srwatson 1675100979Srwatson MAC_CHECK(check_vnode_chroot, cred, dvp, &dvp->v_label); 1676100979Srwatson return (error); 1677100979Srwatson} 1678100979Srwatson 1679100979Srwatsonint 1680100979Srwatsonmac_check_vnode_create(struct ucred *cred, struct vnode *dvp, 1681100979Srwatson struct componentname *cnp, struct vattr *vap) 1682100979Srwatson{ 1683100979Srwatson int error; 1684100979Srwatson 1685100979Srwatson ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_create"); 1686100979Srwatson 1687100979Srwatson if (!mac_enforce_fs) 1688100979Srwatson return (0); 1689100979Srwatson 1690100979Srwatson error = vn_refreshlabel(dvp, cred); 1691100979Srwatson if (error) 1692100979Srwatson return (error); 1693100979Srwatson 1694100979Srwatson MAC_CHECK(check_vnode_create, cred, dvp, &dvp->v_label, cnp, vap); 1695100979Srwatson return (error); 1696100979Srwatson} 1697100979Srwatson 1698100979Srwatsonint 1699100979Srwatsonmac_check_vnode_delete(struct ucred *cred, struct vnode *dvp, struct vnode *vp, 1700100979Srwatson struct componentname *cnp) 1701100979Srwatson{ 1702100979Srwatson int error; 1703100979Srwatson 1704100979Srwatson ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_delete"); 1705100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_delete"); 1706100979Srwatson 1707100979Srwatson if (!mac_enforce_fs) 1708100979Srwatson return (0); 1709100979Srwatson 1710100979Srwatson error = vn_refreshlabel(dvp, cred); 1711100979Srwatson if (error) 1712100979Srwatson return (error); 1713100979Srwatson error = vn_refreshlabel(vp, cred); 1714100979Srwatson if (error) 1715100979Srwatson return (error); 1716100979Srwatson 1717100979Srwatson MAC_CHECK(check_vnode_delete, cred, dvp, &dvp->v_label, vp, 1718100979Srwatson &vp->v_label, cnp); 1719100979Srwatson return (error); 1720100979Srwatson} 1721100979Srwatson 1722100979Srwatsonint 1723100979Srwatsonmac_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp, 1724100979Srwatson acl_type_t type) 1725100979Srwatson{ 1726100979Srwatson int error; 1727100979Srwatson 1728100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_deleteacl"); 1729100979Srwatson 1730100979Srwatson if (!mac_enforce_fs) 1731100979Srwatson return (0); 1732100979Srwatson 1733100979Srwatson error = vn_refreshlabel(vp, cred); 1734100979Srwatson if (error) 1735100979Srwatson return (error); 1736100979Srwatson 1737100979Srwatson MAC_CHECK(check_vnode_deleteacl, cred, vp, &vp->v_label, type); 1738100979Srwatson return (error); 1739100979Srwatson} 1740100979Srwatson 1741100979Srwatsonint 1742100979Srwatsonmac_check_vnode_exec(struct ucred *cred, struct vnode *vp) 1743100979Srwatson{ 1744100979Srwatson int error; 1745100979Srwatson 1746102102Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_exec"); 1747102102Srwatson 1748100979Srwatson if (!mac_enforce_process && !mac_enforce_fs) 1749100979Srwatson return (0); 1750100979Srwatson 1751100979Srwatson error = vn_refreshlabel(vp, cred); 1752100979Srwatson if (error) 1753100979Srwatson return (error); 1754100979Srwatson MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label); 1755100979Srwatson 1756100979Srwatson return (error); 1757100979Srwatson} 1758100979Srwatson 1759100979Srwatsonint 1760100979Srwatsonmac_check_vnode_getacl(struct ucred *cred, struct vnode *vp, acl_type_t type) 1761100979Srwatson{ 1762100979Srwatson int error; 1763100979Srwatson 1764100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_getacl"); 1765100979Srwatson 1766100979Srwatson if (!mac_enforce_fs) 1767100979Srwatson return (0); 1768100979Srwatson 1769100979Srwatson error = vn_refreshlabel(vp, cred); 1770100979Srwatson if (error) 1771100979Srwatson return (error); 1772100979Srwatson 1773100979Srwatson MAC_CHECK(check_vnode_getacl, cred, vp, &vp->v_label, type); 1774100979Srwatson return (error); 1775100979Srwatson} 1776100979Srwatson 1777100979Srwatsonint 1778100979Srwatsonmac_check_vnode_getextattr(struct ucred *cred, struct vnode *vp, 1779100979Srwatson int attrnamespace, const char *name, struct uio *uio) 1780100979Srwatson{ 1781100979Srwatson int error; 1782100979Srwatson 1783100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_getextattr"); 1784100979Srwatson 1785100979Srwatson if (!mac_enforce_fs) 1786100979Srwatson return (0); 1787100979Srwatson 1788100979Srwatson error = vn_refreshlabel(vp, cred); 1789100979Srwatson if (error) 1790100979Srwatson return (error); 1791100979Srwatson 1792100979Srwatson MAC_CHECK(check_vnode_getextattr, cred, vp, &vp->v_label, 1793100979Srwatson attrnamespace, name, uio); 1794100979Srwatson return (error); 1795100979Srwatson} 1796100979Srwatson 1797100979Srwatsonint 1798100979Srwatsonmac_check_vnode_lookup(struct ucred *cred, struct vnode *dvp, 1799100979Srwatson struct componentname *cnp) 1800100979Srwatson{ 1801100979Srwatson int error; 1802100979Srwatson 1803100979Srwatson ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_lookup"); 1804100979Srwatson 1805100979Srwatson if (!mac_enforce_fs) 1806100979Srwatson return (0); 1807100979Srwatson 1808100979Srwatson error = vn_refreshlabel(dvp, cred); 1809100979Srwatson if (error) 1810100979Srwatson return (error); 1811100979Srwatson 1812100979Srwatson MAC_CHECK(check_vnode_lookup, cred, dvp, &dvp->v_label, cnp); 1813100979Srwatson return (error); 1814100979Srwatson} 1815100979Srwatson 1816100979Srwatsonvm_prot_t 1817100979Srwatsonmac_check_vnode_mmap_prot(struct ucred *cred, struct vnode *vp, int newmapping) 1818100979Srwatson{ 1819100979Srwatson vm_prot_t result = VM_PROT_ALL; 1820100979Srwatson 1821103514Srwatson if (!mac_enforce_vm) 1822103514Srwatson return (result); 1823103514Srwatson 1824100979Srwatson /* 1825100979Srwatson * This should be some sort of MAC_BITWISE, maybe :) 1826100979Srwatson */ 1827100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_mmap_perms"); 1828100979Srwatson MAC_BOOLEAN(check_vnode_mmap_perms, &, cred, vp, &vp->v_label, 1829100979Srwatson newmapping); 1830100979Srwatson return (result); 1831100979Srwatson} 1832100979Srwatson 1833100979Srwatsonint 1834102112Srwatsonmac_check_vnode_open(struct ucred *cred, struct vnode *vp, mode_t acc_mode) 1835100979Srwatson{ 1836100979Srwatson int error; 1837100979Srwatson 1838102112Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_open"); 1839102112Srwatson 1840100979Srwatson if (!mac_enforce_fs) 1841100979Srwatson return (0); 1842100979Srwatson 1843102112Srwatson error = vn_refreshlabel(vp, cred); 1844102112Srwatson if (error) 1845102112Srwatson return (error); 1846100979Srwatson 1847102112Srwatson MAC_CHECK(check_vnode_open, cred, vp, &vp->v_label, acc_mode); 1848102112Srwatson return (error); 1849102112Srwatson} 1850102112Srwatson 1851102112Srwatsonint 1852102129Srwatsonmac_check_vnode_poll(struct ucred *active_cred, struct ucred *file_cred, 1853102129Srwatson struct vnode *vp) 1854102112Srwatson{ 1855102112Srwatson int error; 1856102112Srwatson 1857102112Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_poll"); 1858102112Srwatson 1859102112Srwatson if (!mac_enforce_fs) 1860102112Srwatson return (0); 1861102112Srwatson 1862102129Srwatson error = vn_refreshlabel(vp, active_cred); 1863100979Srwatson if (error) 1864100979Srwatson return (error); 1865100979Srwatson 1866102129Srwatson MAC_CHECK(check_vnode_poll, active_cred, file_cred, vp, 1867102129Srwatson &vp->v_label); 1868100979Srwatson 1869100979Srwatson return (error); 1870100979Srwatson} 1871100979Srwatson 1872100979Srwatsonint 1873102129Srwatsonmac_check_vnode_read(struct ucred *active_cred, struct ucred *file_cred, 1874102129Srwatson struct vnode *vp) 1875100979Srwatson{ 1876100979Srwatson int error; 1877100979Srwatson 1878102112Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_read"); 1879100979Srwatson 1880100979Srwatson if (!mac_enforce_fs) 1881100979Srwatson return (0); 1882100979Srwatson 1883102129Srwatson error = vn_refreshlabel(vp, active_cred); 1884100979Srwatson if (error) 1885100979Srwatson return (error); 1886100979Srwatson 1887102129Srwatson MAC_CHECK(check_vnode_read, active_cred, file_cred, vp, 1888102129Srwatson &vp->v_label); 1889102112Srwatson 1890100979Srwatson return (error); 1891100979Srwatson} 1892100979Srwatson 1893100979Srwatsonint 1894100979Srwatsonmac_check_vnode_readdir(struct ucred *cred, struct vnode *dvp) 1895100979Srwatson{ 1896100979Srwatson int error; 1897100979Srwatson 1898100979Srwatson ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_readdir"); 1899100979Srwatson 1900100979Srwatson if (!mac_enforce_fs) 1901100979Srwatson return (0); 1902100979Srwatson 1903100979Srwatson error = vn_refreshlabel(dvp, cred); 1904100979Srwatson if (error) 1905100979Srwatson return (error); 1906100979Srwatson 1907100979Srwatson MAC_CHECK(check_vnode_readdir, cred, dvp, &dvp->v_label); 1908100979Srwatson return (error); 1909100979Srwatson} 1910100979Srwatson 1911100979Srwatsonint 1912100979Srwatsonmac_check_vnode_readlink(struct ucred *cred, struct vnode *vp) 1913100979Srwatson{ 1914100979Srwatson int error; 1915100979Srwatson 1916100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_readlink"); 1917100979Srwatson 1918100979Srwatson if (!mac_enforce_fs) 1919100979Srwatson return (0); 1920100979Srwatson 1921100979Srwatson error = vn_refreshlabel(vp, cred); 1922100979Srwatson if (error) 1923100979Srwatson return (error); 1924100979Srwatson 1925100979Srwatson MAC_CHECK(check_vnode_readlink, cred, vp, &vp->v_label); 1926100979Srwatson return (error); 1927100979Srwatson} 1928100979Srwatson 1929100979Srwatsonstatic int 1930100979Srwatsonmac_check_vnode_relabel(struct ucred *cred, struct vnode *vp, 1931100979Srwatson struct label *newlabel) 1932100979Srwatson{ 1933100979Srwatson int error; 1934100979Srwatson 1935100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_relabel"); 1936100979Srwatson 1937100979Srwatson error = vn_refreshlabel(vp, cred); 1938100979Srwatson if (error) 1939100979Srwatson return (error); 1940100979Srwatson 1941100979Srwatson MAC_CHECK(check_vnode_relabel, cred, vp, &vp->v_label, newlabel); 1942100979Srwatson 1943100979Srwatson return (error); 1944100979Srwatson} 1945100979Srwatson 1946100979Srwatsonint 1947100979Srwatsonmac_check_vnode_rename_from(struct ucred *cred, struct vnode *dvp, 1948100979Srwatson struct vnode *vp, struct componentname *cnp) 1949100979Srwatson{ 1950100979Srwatson int error; 1951100979Srwatson 1952100979Srwatson ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_rename_from"); 1953100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_rename_from"); 1954100979Srwatson 1955100979Srwatson if (!mac_enforce_fs) 1956100979Srwatson return (0); 1957100979Srwatson 1958100979Srwatson error = vn_refreshlabel(dvp, cred); 1959100979Srwatson if (error) 1960100979Srwatson return (error); 1961100979Srwatson error = vn_refreshlabel(vp, cred); 1962100979Srwatson if (error) 1963100979Srwatson return (error); 1964100979Srwatson 1965100979Srwatson MAC_CHECK(check_vnode_rename_from, cred, dvp, &dvp->v_label, vp, 1966100979Srwatson &vp->v_label, cnp); 1967100979Srwatson return (error); 1968100979Srwatson} 1969100979Srwatson 1970100979Srwatsonint 1971100979Srwatsonmac_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp, 1972100979Srwatson struct vnode *vp, int samedir, struct componentname *cnp) 1973100979Srwatson{ 1974100979Srwatson int error; 1975100979Srwatson 1976100979Srwatson ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_rename_to"); 1977100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_rename_to"); 1978100979Srwatson 1979100979Srwatson if (!mac_enforce_fs) 1980100979Srwatson return (0); 1981100979Srwatson 1982100979Srwatson error = vn_refreshlabel(dvp, cred); 1983100979Srwatson if (error) 1984100979Srwatson return (error); 1985100979Srwatson if (vp != NULL) { 1986100979Srwatson error = vn_refreshlabel(vp, cred); 1987100979Srwatson if (error) 1988100979Srwatson return (error); 1989100979Srwatson } 1990100979Srwatson MAC_CHECK(check_vnode_rename_to, cred, dvp, &dvp->v_label, vp, 1991100979Srwatson vp != NULL ? &vp->v_label : NULL, samedir, cnp); 1992100979Srwatson return (error); 1993100979Srwatson} 1994100979Srwatson 1995100979Srwatsonint 1996100979Srwatsonmac_check_vnode_revoke(struct ucred *cred, struct vnode *vp) 1997100979Srwatson{ 1998100979Srwatson int error; 1999100979Srwatson 2000100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_revoke"); 2001100979Srwatson 2002100979Srwatson if (!mac_enforce_fs) 2003100979Srwatson return (0); 2004100979Srwatson 2005100979Srwatson error = vn_refreshlabel(vp, cred); 2006100979Srwatson if (error) 2007100979Srwatson return (error); 2008100979Srwatson 2009100979Srwatson MAC_CHECK(check_vnode_revoke, cred, vp, &vp->v_label); 2010100979Srwatson return (error); 2011100979Srwatson} 2012100979Srwatson 2013100979Srwatsonint 2014100979Srwatsonmac_check_vnode_setacl(struct ucred *cred, struct vnode *vp, acl_type_t type, 2015100979Srwatson struct acl *acl) 2016100979Srwatson{ 2017100979Srwatson int error; 2018100979Srwatson 2019100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setacl"); 2020100979Srwatson 2021100979Srwatson if (!mac_enforce_fs) 2022100979Srwatson return (0); 2023100979Srwatson 2024100979Srwatson error = vn_refreshlabel(vp, cred); 2025100979Srwatson if (error) 2026100979Srwatson return (error); 2027100979Srwatson 2028100979Srwatson MAC_CHECK(check_vnode_setacl, cred, vp, &vp->v_label, type, acl); 2029100979Srwatson return (error); 2030100979Srwatson} 2031100979Srwatson 2032100979Srwatsonint 2033100979Srwatsonmac_check_vnode_setextattr(struct ucred *cred, struct vnode *vp, 2034100979Srwatson int attrnamespace, const char *name, struct uio *uio) 2035100979Srwatson{ 2036100979Srwatson int error; 2037100979Srwatson 2038100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setextattr"); 2039100979Srwatson 2040100979Srwatson if (!mac_enforce_fs) 2041100979Srwatson return (0); 2042100979Srwatson 2043100979Srwatson error = vn_refreshlabel(vp, cred); 2044100979Srwatson if (error) 2045100979Srwatson return (error); 2046100979Srwatson 2047100979Srwatson MAC_CHECK(check_vnode_setextattr, cred, vp, &vp->v_label, 2048100979Srwatson attrnamespace, name, uio); 2049100979Srwatson return (error); 2050100979Srwatson} 2051100979Srwatson 2052100979Srwatsonint 2053100979Srwatsonmac_check_vnode_setflags(struct ucred *cred, struct vnode *vp, u_long flags) 2054100979Srwatson{ 2055100979Srwatson int error; 2056100979Srwatson 2057100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setflags"); 2058100979Srwatson 2059100979Srwatson if (!mac_enforce_fs) 2060100979Srwatson return (0); 2061100979Srwatson 2062100979Srwatson error = vn_refreshlabel(vp, cred); 2063100979Srwatson if (error) 2064100979Srwatson return (error); 2065100979Srwatson 2066100979Srwatson MAC_CHECK(check_vnode_setflags, cred, vp, &vp->v_label, flags); 2067100979Srwatson return (error); 2068100979Srwatson} 2069100979Srwatson 2070100979Srwatsonint 2071100979Srwatsonmac_check_vnode_setmode(struct ucred *cred, struct vnode *vp, mode_t mode) 2072100979Srwatson{ 2073100979Srwatson int error; 2074100979Srwatson 2075100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setmode"); 2076100979Srwatson 2077100979Srwatson if (!mac_enforce_fs) 2078100979Srwatson return (0); 2079100979Srwatson 2080100979Srwatson error = vn_refreshlabel(vp, cred); 2081100979Srwatson if (error) 2082100979Srwatson return (error); 2083100979Srwatson 2084100979Srwatson MAC_CHECK(check_vnode_setmode, cred, vp, &vp->v_label, mode); 2085100979Srwatson return (error); 2086100979Srwatson} 2087100979Srwatson 2088100979Srwatsonint 2089100979Srwatsonmac_check_vnode_setowner(struct ucred *cred, struct vnode *vp, uid_t uid, 2090100979Srwatson gid_t gid) 2091100979Srwatson{ 2092100979Srwatson int error; 2093100979Srwatson 2094100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setowner"); 2095100979Srwatson 2096100979Srwatson if (!mac_enforce_fs) 2097100979Srwatson return (0); 2098100979Srwatson 2099100979Srwatson error = vn_refreshlabel(vp, cred); 2100100979Srwatson if (error) 2101100979Srwatson return (error); 2102100979Srwatson 2103100979Srwatson MAC_CHECK(check_vnode_setowner, cred, vp, &vp->v_label, uid, gid); 2104100979Srwatson return (error); 2105100979Srwatson} 2106100979Srwatson 2107100979Srwatsonint 2108100979Srwatsonmac_check_vnode_setutimes(struct ucred *cred, struct vnode *vp, 2109100979Srwatson struct timespec atime, struct timespec mtime) 2110100979Srwatson{ 2111100979Srwatson int error; 2112100979Srwatson 2113100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setutimes"); 2114100979Srwatson 2115100979Srwatson if (!mac_enforce_fs) 2116100979Srwatson return (0); 2117100979Srwatson 2118100979Srwatson error = vn_refreshlabel(vp, cred); 2119100979Srwatson if (error) 2120100979Srwatson return (error); 2121100979Srwatson 2122100979Srwatson MAC_CHECK(check_vnode_setutimes, cred, vp, &vp->v_label, atime, 2123100979Srwatson mtime); 2124100979Srwatson return (error); 2125100979Srwatson} 2126100979Srwatson 2127100979Srwatsonint 2128102129Srwatsonmac_check_vnode_stat(struct ucred *active_cred, struct ucred *file_cred, 2129102129Srwatson struct vnode *vp) 2130100979Srwatson{ 2131100979Srwatson int error; 2132100979Srwatson 2133100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_stat"); 2134100979Srwatson 2135100979Srwatson if (!mac_enforce_fs) 2136100979Srwatson return (0); 2137100979Srwatson 2138102129Srwatson error = vn_refreshlabel(vp, active_cred); 2139100979Srwatson if (error) 2140100979Srwatson return (error); 2141100979Srwatson 2142102129Srwatson MAC_CHECK(check_vnode_stat, active_cred, file_cred, vp, 2143102129Srwatson &vp->v_label); 2144100979Srwatson return (error); 2145100979Srwatson} 2146100979Srwatson 2147102112Srwatsonint 2148102129Srwatsonmac_check_vnode_write(struct ucred *active_cred, struct ucred *file_cred, 2149102129Srwatson struct vnode *vp) 2150102112Srwatson{ 2151102112Srwatson int error; 2152102112Srwatson 2153102112Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_write"); 2154102112Srwatson 2155102112Srwatson if (!mac_enforce_fs) 2156102112Srwatson return (0); 2157102112Srwatson 2158102129Srwatson error = vn_refreshlabel(vp, active_cred); 2159102112Srwatson if (error) 2160102112Srwatson return (error); 2161102112Srwatson 2162102129Srwatson MAC_CHECK(check_vnode_write, active_cred, file_cred, vp, 2163102129Srwatson &vp->v_label); 2164102112Srwatson 2165102112Srwatson return (error); 2166102112Srwatson} 2167102112Srwatson 2168100979Srwatson/* 2169100979Srwatson * When relabeling a process, call out to the policies for the maximum 2170100979Srwatson * permission allowed for each object type we know about in its 2171100979Srwatson * memory space, and revoke access (in the least surprising ways we 2172100979Srwatson * know) when necessary. The process lock is not held here. 2173100979Srwatson */ 2174100979Srwatsonstatic void 2175100979Srwatsonmac_cred_mmapped_drop_perms(struct thread *td, struct ucred *cred) 2176100979Srwatson{ 2177100979Srwatson 2178100979Srwatson /* XXX freeze all other threads */ 2179100979Srwatson mac_cred_mmapped_drop_perms_recurse(td, cred, 2180100979Srwatson &td->td_proc->p_vmspace->vm_map); 2181100979Srwatson /* XXX allow other threads to continue */ 2182100979Srwatson} 2183100979Srwatson 2184100979Srwatsonstatic __inline const char * 2185100979Srwatsonprot2str(vm_prot_t prot) 2186100979Srwatson{ 2187100979Srwatson 2188100979Srwatson switch (prot & VM_PROT_ALL) { 2189100979Srwatson case VM_PROT_READ: 2190100979Srwatson return ("r--"); 2191100979Srwatson case VM_PROT_READ | VM_PROT_WRITE: 2192100979Srwatson return ("rw-"); 2193100979Srwatson case VM_PROT_READ | VM_PROT_EXECUTE: 2194100979Srwatson return ("r-x"); 2195100979Srwatson case VM_PROT_READ | VM_PROT_WRITE | VM_PROT_EXECUTE: 2196100979Srwatson return ("rwx"); 2197100979Srwatson case VM_PROT_WRITE: 2198100979Srwatson return ("-w-"); 2199100979Srwatson case VM_PROT_EXECUTE: 2200100979Srwatson return ("--x"); 2201100979Srwatson case VM_PROT_WRITE | VM_PROT_EXECUTE: 2202100979Srwatson return ("-wx"); 2203100979Srwatson default: 2204100979Srwatson return ("---"); 2205100979Srwatson } 2206100979Srwatson} 2207100979Srwatson 2208100979Srwatsonstatic void 2209100979Srwatsonmac_cred_mmapped_drop_perms_recurse(struct thread *td, struct ucred *cred, 2210100979Srwatson struct vm_map *map) 2211100979Srwatson{ 2212100979Srwatson struct vm_map_entry *vme; 2213100979Srwatson vm_prot_t result, revokeperms; 2214100979Srwatson vm_object_t object; 2215100979Srwatson vm_ooffset_t offset; 2216100979Srwatson struct vnode *vp; 2217100979Srwatson 2218103136Srwatson if (!mac_mmap_revocation) 2219103136Srwatson return; 2220103136Srwatson 2221100979Srwatson vm_map_lock_read(map); 2222100979Srwatson for (vme = map->header.next; vme != &map->header; vme = vme->next) { 2223100979Srwatson if (vme->eflags & MAP_ENTRY_IS_SUB_MAP) { 2224100979Srwatson mac_cred_mmapped_drop_perms_recurse(td, cred, 2225100979Srwatson vme->object.sub_map); 2226100979Srwatson continue; 2227100979Srwatson } 2228100979Srwatson /* 2229100979Srwatson * Skip over entries that obviously are not shared. 2230100979Srwatson */ 2231100979Srwatson if (vme->eflags & (MAP_ENTRY_COW | MAP_ENTRY_NOSYNC) || 2232100979Srwatson !vme->max_protection) 2233100979Srwatson continue; 2234100979Srwatson /* 2235100979Srwatson * Drill down to the deepest backing object. 2236100979Srwatson */ 2237100979Srwatson offset = vme->offset; 2238100979Srwatson object = vme->object.vm_object; 2239100979Srwatson if (object == NULL) 2240100979Srwatson continue; 2241100979Srwatson while (object->backing_object != NULL) { 2242100979Srwatson object = object->backing_object; 2243100979Srwatson offset += object->backing_object_offset; 2244100979Srwatson } 2245100979Srwatson /* 2246100979Srwatson * At the moment, vm_maps and objects aren't considered 2247100979Srwatson * by the MAC system, so only things with backing by a 2248100979Srwatson * normal object (read: vnodes) are checked. 2249100979Srwatson */ 2250100979Srwatson if (object->type != OBJT_VNODE) 2251100979Srwatson continue; 2252100979Srwatson vp = (struct vnode *)object->handle; 2253100979Srwatson vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); 2254100979Srwatson result = mac_check_vnode_mmap_prot(cred, vp, 0); 2255100979Srwatson VOP_UNLOCK(vp, 0, td); 2256100979Srwatson /* 2257100979Srwatson * Find out what maximum protection we may be allowing 2258100979Srwatson * now but a policy needs to get removed. 2259100979Srwatson */ 2260100979Srwatson revokeperms = vme->max_protection & ~result; 2261100979Srwatson if (!revokeperms) 2262100979Srwatson continue; 2263102949Sbde printf("pid %ld: revoking %s perms from %#lx:%ld " 2264102949Sbde "(max %s/cur %s)\n", (long)td->td_proc->p_pid, 2265102949Sbde prot2str(revokeperms), (u_long)vme->start, 2266102949Sbde (long)(vme->end - vme->start), 2267100979Srwatson prot2str(vme->max_protection), prot2str(vme->protection)); 2268100979Srwatson vm_map_lock_upgrade(map); 2269100979Srwatson /* 2270100979Srwatson * This is the really simple case: if a map has more 2271100979Srwatson * max_protection than is allowed, but it's not being 2272100979Srwatson * actually used (that is, the current protection is 2273100979Srwatson * still allowed), we can just wipe it out and do 2274100979Srwatson * nothing more. 2275100979Srwatson */ 2276100979Srwatson if ((vme->protection & revokeperms) == 0) { 2277100979Srwatson vme->max_protection -= revokeperms; 2278100979Srwatson } else { 2279100979Srwatson if (revokeperms & VM_PROT_WRITE) { 2280100979Srwatson /* 2281100979Srwatson * In the more complicated case, flush out all 2282100979Srwatson * pending changes to the object then turn it 2283100979Srwatson * copy-on-write. 2284100979Srwatson */ 2285100979Srwatson vm_object_reference(object); 2286100979Srwatson vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); 2287100979Srwatson vm_object_page_clean(object, 2288100979Srwatson OFF_TO_IDX(offset), 2289100979Srwatson OFF_TO_IDX(offset + vme->end - vme->start + 2290100979Srwatson PAGE_MASK), 2291100979Srwatson OBJPC_SYNC); 2292100979Srwatson VOP_UNLOCK(vp, 0, td); 2293100979Srwatson vm_object_deallocate(object); 2294100979Srwatson /* 2295100979Srwatson * Why bother if there's no read permissions 2296100979Srwatson * anymore? For the rest, we need to leave 2297100979Srwatson * the write permissions on for COW, or 2298100979Srwatson * remove them entirely if configured to. 2299100979Srwatson */ 2300100979Srwatson if (!mac_mmap_revocation_via_cow) { 2301100979Srwatson vme->max_protection &= ~VM_PROT_WRITE; 2302100979Srwatson vme->protection &= ~VM_PROT_WRITE; 2303100979Srwatson } if ((revokeperms & VM_PROT_READ) == 0) 2304100979Srwatson vme->eflags |= MAP_ENTRY_COW | 2305100979Srwatson MAP_ENTRY_NEEDS_COPY; 2306100979Srwatson } 2307100979Srwatson if (revokeperms & VM_PROT_EXECUTE) { 2308100979Srwatson vme->max_protection &= ~VM_PROT_EXECUTE; 2309100979Srwatson vme->protection &= ~VM_PROT_EXECUTE; 2310100979Srwatson } 2311100979Srwatson if (revokeperms & VM_PROT_READ) { 2312100979Srwatson vme->max_protection = 0; 2313100979Srwatson vme->protection = 0; 2314100979Srwatson } 2315100979Srwatson pmap_protect(map->pmap, vme->start, vme->end, 2316100979Srwatson vme->protection & ~revokeperms); 2317100979Srwatson vm_map_simplify_entry(map, vme); 2318100979Srwatson } 2319100979Srwatson vm_map_lock_downgrade(map); 2320100979Srwatson } 2321100979Srwatson vm_map_unlock_read(map); 2322100979Srwatson} 2323100979Srwatson 2324100979Srwatson/* 2325100979Srwatson * When the subject's label changes, it may require revocation of privilege 2326100979Srwatson * to mapped objects. This can't be done on-the-fly later with a unified 2327100979Srwatson * buffer cache. 2328100979Srwatson */ 2329100979Srwatsonstatic void 2330100979Srwatsonmac_relabel_cred(struct ucred *cred, struct label *newlabel) 2331100979Srwatson{ 2332100979Srwatson 2333100979Srwatson MAC_PERFORM(relabel_cred, cred, newlabel); 2334100979Srwatson} 2335100979Srwatson 2336100979Srwatsonvoid 2337100979Srwatsonmac_relabel_vnode(struct ucred *cred, struct vnode *vp, struct label *newlabel) 2338100979Srwatson{ 2339100979Srwatson 2340100979Srwatson MAC_PERFORM(relabel_vnode, cred, vp, &vp->v_label, newlabel); 2341100979Srwatson} 2342100979Srwatson 2343100979Srwatsonvoid 2344100979Srwatsonmac_create_ifnet(struct ifnet *ifnet) 2345100979Srwatson{ 2346100979Srwatson 2347100979Srwatson MAC_PERFORM(create_ifnet, ifnet, &ifnet->if_label); 2348100979Srwatson} 2349100979Srwatson 2350100979Srwatsonvoid 2351100979Srwatsonmac_create_bpfdesc(struct ucred *cred, struct bpf_d *bpf_d) 2352100979Srwatson{ 2353100979Srwatson 2354100979Srwatson MAC_PERFORM(create_bpfdesc, cred, bpf_d, &bpf_d->bd_label); 2355100979Srwatson} 2356100979Srwatson 2357100979Srwatsonvoid 2358100979Srwatsonmac_create_socket(struct ucred *cred, struct socket *socket) 2359100979Srwatson{ 2360100979Srwatson 2361100979Srwatson MAC_PERFORM(create_socket, cred, socket, &socket->so_label); 2362100979Srwatson} 2363100979Srwatson 2364100979Srwatsonvoid 2365100979Srwatsonmac_create_pipe(struct ucred *cred, struct pipe *pipe) 2366100979Srwatson{ 2367100979Srwatson 2368100979Srwatson MAC_PERFORM(create_pipe, cred, pipe, pipe->pipe_label); 2369100979Srwatson} 2370100979Srwatson 2371100979Srwatsonvoid 2372100979Srwatsonmac_create_socket_from_socket(struct socket *oldsocket, 2373100979Srwatson struct socket *newsocket) 2374100979Srwatson{ 2375100979Srwatson 2376100979Srwatson MAC_PERFORM(create_socket_from_socket, oldsocket, &oldsocket->so_label, 2377100979Srwatson newsocket, &newsocket->so_label); 2378100979Srwatson} 2379100979Srwatson 2380100979Srwatsonstatic void 2381100979Srwatsonmac_relabel_socket(struct ucred *cred, struct socket *socket, 2382100979Srwatson struct label *newlabel) 2383100979Srwatson{ 2384100979Srwatson 2385100979Srwatson MAC_PERFORM(relabel_socket, cred, socket, &socket->so_label, newlabel); 2386100979Srwatson} 2387100979Srwatson 2388100979Srwatsonstatic void 2389100979Srwatsonmac_relabel_pipe(struct ucred *cred, struct pipe *pipe, struct label *newlabel) 2390100979Srwatson{ 2391100979Srwatson 2392100979Srwatson MAC_PERFORM(relabel_pipe, cred, pipe, pipe->pipe_label, newlabel); 2393100979Srwatson} 2394100979Srwatson 2395100979Srwatsonvoid 2396100979Srwatsonmac_set_socket_peer_from_mbuf(struct mbuf *mbuf, struct socket *socket) 2397100979Srwatson{ 2398100979Srwatson 2399100979Srwatson MAC_PERFORM(set_socket_peer_from_mbuf, mbuf, &mbuf->m_pkthdr.label, 2400100979Srwatson socket, &socket->so_peerlabel); 2401100979Srwatson} 2402100979Srwatson 2403100979Srwatsonvoid 2404100979Srwatsonmac_set_socket_peer_from_socket(struct socket *oldsocket, 2405100979Srwatson struct socket *newsocket) 2406100979Srwatson{ 2407100979Srwatson 2408100979Srwatson MAC_PERFORM(set_socket_peer_from_socket, oldsocket, 2409100979Srwatson &oldsocket->so_label, newsocket, &newsocket->so_peerlabel); 2410100979Srwatson} 2411100979Srwatson 2412100979Srwatsonvoid 2413100979Srwatsonmac_create_datagram_from_ipq(struct ipq *ipq, struct mbuf *datagram) 2414100979Srwatson{ 2415100979Srwatson 2416100979Srwatson MAC_PERFORM(create_datagram_from_ipq, ipq, &ipq->ipq_label, 2417100979Srwatson datagram, &datagram->m_pkthdr.label); 2418100979Srwatson} 2419100979Srwatson 2420100979Srwatsonvoid 2421100979Srwatsonmac_create_fragment(struct mbuf *datagram, struct mbuf *fragment) 2422100979Srwatson{ 2423100979Srwatson 2424100979Srwatson MAC_PERFORM(create_fragment, datagram, &datagram->m_pkthdr.label, 2425100979Srwatson fragment, &fragment->m_pkthdr.label); 2426100979Srwatson} 2427100979Srwatson 2428100979Srwatsonvoid 2429100979Srwatsonmac_create_ipq(struct mbuf *fragment, struct ipq *ipq) 2430100979Srwatson{ 2431100979Srwatson 2432100979Srwatson MAC_PERFORM(create_ipq, fragment, &fragment->m_pkthdr.label, ipq, 2433100979Srwatson &ipq->ipq_label); 2434100979Srwatson} 2435100979Srwatson 2436100979Srwatsonvoid 2437100979Srwatsonmac_create_mbuf_from_mbuf(struct mbuf *oldmbuf, struct mbuf *newmbuf) 2438100979Srwatson{ 2439100979Srwatson 2440100979Srwatson MAC_PERFORM(create_mbuf_from_mbuf, oldmbuf, &oldmbuf->m_pkthdr.label, 2441100979Srwatson newmbuf, &newmbuf->m_pkthdr.label); 2442100979Srwatson} 2443100979Srwatson 2444100979Srwatsonvoid 2445100979Srwatsonmac_create_mbuf_from_bpfdesc(struct bpf_d *bpf_d, struct mbuf *mbuf) 2446100979Srwatson{ 2447100979Srwatson 2448100979Srwatson MAC_PERFORM(create_mbuf_from_bpfdesc, bpf_d, &bpf_d->bd_label, mbuf, 2449100979Srwatson &mbuf->m_pkthdr.label); 2450100979Srwatson} 2451100979Srwatson 2452100979Srwatsonvoid 2453100979Srwatsonmac_create_mbuf_linklayer(struct ifnet *ifnet, struct mbuf *mbuf) 2454100979Srwatson{ 2455100979Srwatson 2456100979Srwatson MAC_PERFORM(create_mbuf_linklayer, ifnet, &ifnet->if_label, mbuf, 2457100979Srwatson &mbuf->m_pkthdr.label); 2458100979Srwatson} 2459100979Srwatson 2460100979Srwatsonvoid 2461100979Srwatsonmac_create_mbuf_from_ifnet(struct ifnet *ifnet, struct mbuf *mbuf) 2462100979Srwatson{ 2463100979Srwatson 2464100979Srwatson MAC_PERFORM(create_mbuf_from_ifnet, ifnet, &ifnet->if_label, mbuf, 2465100979Srwatson &mbuf->m_pkthdr.label); 2466100979Srwatson} 2467100979Srwatson 2468100979Srwatsonvoid 2469100979Srwatsonmac_create_mbuf_multicast_encap(struct mbuf *oldmbuf, struct ifnet *ifnet, 2470100979Srwatson struct mbuf *newmbuf) 2471100979Srwatson{ 2472100979Srwatson 2473100979Srwatson MAC_PERFORM(create_mbuf_multicast_encap, oldmbuf, 2474100979Srwatson &oldmbuf->m_pkthdr.label, ifnet, &ifnet->if_label, newmbuf, 2475100979Srwatson &newmbuf->m_pkthdr.label); 2476100979Srwatson} 2477100979Srwatson 2478100979Srwatsonvoid 2479100979Srwatsonmac_create_mbuf_netlayer(struct mbuf *oldmbuf, struct mbuf *newmbuf) 2480100979Srwatson{ 2481100979Srwatson 2482100979Srwatson MAC_PERFORM(create_mbuf_netlayer, oldmbuf, &oldmbuf->m_pkthdr.label, 2483100979Srwatson newmbuf, &newmbuf->m_pkthdr.label); 2484100979Srwatson} 2485100979Srwatson 2486100979Srwatsonint 2487100979Srwatsonmac_fragment_match(struct mbuf *fragment, struct ipq *ipq) 2488100979Srwatson{ 2489100979Srwatson int result; 2490100979Srwatson 2491100979Srwatson result = 1; 2492100979Srwatson MAC_BOOLEAN(fragment_match, &&, fragment, &fragment->m_pkthdr.label, 2493100979Srwatson ipq, &ipq->ipq_label); 2494100979Srwatson 2495100979Srwatson return (result); 2496100979Srwatson} 2497100979Srwatson 2498100979Srwatsonvoid 2499100979Srwatsonmac_update_ipq(struct mbuf *fragment, struct ipq *ipq) 2500100979Srwatson{ 2501100979Srwatson 2502100979Srwatson MAC_PERFORM(update_ipq, fragment, &fragment->m_pkthdr.label, ipq, 2503100979Srwatson &ipq->ipq_label); 2504100979Srwatson} 2505100979Srwatson 2506100979Srwatsonvoid 2507100979Srwatsonmac_create_mbuf_from_socket(struct socket *socket, struct mbuf *mbuf) 2508100979Srwatson{ 2509100979Srwatson 2510100979Srwatson MAC_PERFORM(create_mbuf_from_socket, socket, &socket->so_label, mbuf, 2511100979Srwatson &mbuf->m_pkthdr.label); 2512100979Srwatson} 2513100979Srwatson 2514100979Srwatsonvoid 2515100979Srwatsonmac_create_mount(struct ucred *cred, struct mount *mp) 2516100979Srwatson{ 2517100979Srwatson 2518100979Srwatson MAC_PERFORM(create_mount, cred, mp, &mp->mnt_mntlabel, 2519100979Srwatson &mp->mnt_fslabel); 2520100979Srwatson} 2521100979Srwatson 2522100979Srwatsonvoid 2523100979Srwatsonmac_create_root_mount(struct ucred *cred, struct mount *mp) 2524100979Srwatson{ 2525100979Srwatson 2526100979Srwatson MAC_PERFORM(create_root_mount, cred, mp, &mp->mnt_mntlabel, 2527100979Srwatson &mp->mnt_fslabel); 2528100979Srwatson} 2529100979Srwatson 2530100979Srwatsonint 2531100979Srwatsonmac_check_bpfdesc_receive(struct bpf_d *bpf_d, struct ifnet *ifnet) 2532100979Srwatson{ 2533100979Srwatson int error; 2534100979Srwatson 2535100979Srwatson if (!mac_enforce_network) 2536100979Srwatson return (0); 2537100979Srwatson 2538100979Srwatson MAC_CHECK(check_bpfdesc_receive, bpf_d, &bpf_d->bd_label, ifnet, 2539100979Srwatson &ifnet->if_label); 2540100979Srwatson 2541100979Srwatson return (error); 2542100979Srwatson} 2543100979Srwatson 2544100979Srwatsonstatic int 2545100979Srwatsonmac_check_cred_relabel(struct ucred *cred, struct label *newlabel) 2546100979Srwatson{ 2547100979Srwatson int error; 2548100979Srwatson 2549100979Srwatson MAC_CHECK(check_cred_relabel, cred, newlabel); 2550100979Srwatson 2551100979Srwatson return (error); 2552100979Srwatson} 2553100979Srwatson 2554100979Srwatsonint 2555100979Srwatsonmac_check_cred_visible(struct ucred *u1, struct ucred *u2) 2556100979Srwatson{ 2557100979Srwatson int error; 2558100979Srwatson 2559100979Srwatson if (!mac_enforce_process) 2560100979Srwatson return (0); 2561100979Srwatson 2562100979Srwatson MAC_CHECK(check_cred_visible, u1, u2); 2563100979Srwatson 2564100979Srwatson return (error); 2565100979Srwatson} 2566100979Srwatson 2567100979Srwatsonint 2568100979Srwatsonmac_check_ifnet_transmit(struct ifnet *ifnet, struct mbuf *mbuf) 2569100979Srwatson{ 2570100979Srwatson int error; 2571100979Srwatson 2572100979Srwatson if (!mac_enforce_network) 2573100979Srwatson return (0); 2574100979Srwatson 2575100979Srwatson KASSERT(mbuf->m_flags & M_PKTHDR, ("packet has no pkthdr")); 2576100979Srwatson if (!(mbuf->m_pkthdr.label.l_flags & MAC_FLAG_INITIALIZED)) 2577100979Srwatson printf("%s%d: not initialized\n", ifnet->if_name, 2578100979Srwatson ifnet->if_unit); 2579100979Srwatson 2580100979Srwatson MAC_CHECK(check_ifnet_transmit, ifnet, &ifnet->if_label, mbuf, 2581100979Srwatson &mbuf->m_pkthdr.label); 2582100979Srwatson 2583100979Srwatson return (error); 2584100979Srwatson} 2585100979Srwatson 2586100979Srwatsonint 2587100979Srwatsonmac_check_mount_stat(struct ucred *cred, struct mount *mount) 2588100979Srwatson{ 2589100979Srwatson int error; 2590100979Srwatson 2591100979Srwatson if (!mac_enforce_fs) 2592100979Srwatson return (0); 2593100979Srwatson 2594100979Srwatson MAC_CHECK(check_mount_stat, cred, mount, &mount->mnt_mntlabel); 2595100979Srwatson 2596100979Srwatson return (error); 2597100979Srwatson} 2598100979Srwatson 2599100979Srwatsonint 2600100979Srwatsonmac_check_pipe_ioctl(struct ucred *cred, struct pipe *pipe, unsigned long cmd, 2601100979Srwatson void *data) 2602100979Srwatson{ 2603100979Srwatson int error; 2604100979Srwatson 2605104269Srwatson PIPE_LOCK_ASSERT(pipe, MA_OWNED); 2606104269Srwatson 2607104269Srwatson if (!mac_enforce_pipe) 2608104269Srwatson return (0); 2609104269Srwatson 2610100979Srwatson MAC_CHECK(check_pipe_ioctl, cred, pipe, pipe->pipe_label, cmd, data); 2611100979Srwatson 2612100979Srwatson return (error); 2613100979Srwatson} 2614100979Srwatson 2615100979Srwatsonint 2616102115Srwatsonmac_check_pipe_poll(struct ucred *cred, struct pipe *pipe) 2617100979Srwatson{ 2618100979Srwatson int error; 2619100979Srwatson 2620104269Srwatson PIPE_LOCK_ASSERT(pipe, MA_OWNED); 2621104269Srwatson 2622104269Srwatson if (!mac_enforce_pipe) 2623104269Srwatson return (0); 2624104269Srwatson 2625102115Srwatson MAC_CHECK(check_pipe_poll, cred, pipe, pipe->pipe_label); 2626100979Srwatson 2627100979Srwatson return (error); 2628100979Srwatson} 2629100979Srwatson 2630102115Srwatsonint 2631102115Srwatsonmac_check_pipe_read(struct ucred *cred, struct pipe *pipe) 2632102115Srwatson{ 2633102115Srwatson int error; 2634102115Srwatson 2635104269Srwatson PIPE_LOCK_ASSERT(pipe, MA_OWNED); 2636104269Srwatson 2637104269Srwatson if (!mac_enforce_pipe) 2638104269Srwatson return (0); 2639104269Srwatson 2640102115Srwatson MAC_CHECK(check_pipe_read, cred, pipe, pipe->pipe_label); 2641102115Srwatson 2642102115Srwatson return (error); 2643102115Srwatson} 2644102115Srwatson 2645100979Srwatsonstatic int 2646100979Srwatsonmac_check_pipe_relabel(struct ucred *cred, struct pipe *pipe, 2647100979Srwatson struct label *newlabel) 2648100979Srwatson{ 2649100979Srwatson int error; 2650100979Srwatson 2651104269Srwatson PIPE_LOCK_ASSERT(pipe, MA_OWNED); 2652104269Srwatson 2653104269Srwatson if (!mac_enforce_pipe) 2654104269Srwatson return (0); 2655104269Srwatson 2656100979Srwatson MAC_CHECK(check_pipe_relabel, cred, pipe, pipe->pipe_label, newlabel); 2657100979Srwatson 2658100979Srwatson return (error); 2659100979Srwatson} 2660100979Srwatson 2661100979Srwatsonint 2662102115Srwatsonmac_check_pipe_stat(struct ucred *cred, struct pipe *pipe) 2663102115Srwatson{ 2664102115Srwatson int error; 2665102115Srwatson 2666104269Srwatson PIPE_LOCK_ASSERT(pipe, MA_OWNED); 2667104269Srwatson 2668104269Srwatson if (!mac_enforce_pipe) 2669104269Srwatson return (0); 2670104269Srwatson 2671102115Srwatson MAC_CHECK(check_pipe_stat, cred, pipe, pipe->pipe_label); 2672102115Srwatson 2673102115Srwatson return (error); 2674102115Srwatson} 2675102115Srwatson 2676102115Srwatsonint 2677102115Srwatsonmac_check_pipe_write(struct ucred *cred, struct pipe *pipe) 2678102115Srwatson{ 2679102115Srwatson int error; 2680102115Srwatson 2681104269Srwatson PIPE_LOCK_ASSERT(pipe, MA_OWNED); 2682104269Srwatson 2683104269Srwatson if (!mac_enforce_pipe) 2684104269Srwatson return (0); 2685104269Srwatson 2686102115Srwatson MAC_CHECK(check_pipe_write, cred, pipe, pipe->pipe_label); 2687102115Srwatson 2688102115Srwatson return (error); 2689102115Srwatson} 2690102115Srwatson 2691102115Srwatsonint 2692100979Srwatsonmac_check_proc_debug(struct ucred *cred, struct proc *proc) 2693100979Srwatson{ 2694100979Srwatson int error; 2695100979Srwatson 2696102103Srwatson PROC_LOCK_ASSERT(proc, MA_OWNED); 2697102103Srwatson 2698100979Srwatson if (!mac_enforce_process) 2699100979Srwatson return (0); 2700100979Srwatson 2701100979Srwatson MAC_CHECK(check_proc_debug, cred, proc); 2702100979Srwatson 2703100979Srwatson return (error); 2704100979Srwatson} 2705100979Srwatson 2706100979Srwatsonint 2707100979Srwatsonmac_check_proc_sched(struct ucred *cred, struct proc *proc) 2708100979Srwatson{ 2709100979Srwatson int error; 2710100979Srwatson 2711102103Srwatson PROC_LOCK_ASSERT(proc, MA_OWNED); 2712102103Srwatson 2713100979Srwatson if (!mac_enforce_process) 2714100979Srwatson return (0); 2715100979Srwatson 2716100979Srwatson MAC_CHECK(check_proc_sched, cred, proc); 2717100979Srwatson 2718100979Srwatson return (error); 2719100979Srwatson} 2720100979Srwatson 2721100979Srwatsonint 2722100979Srwatsonmac_check_proc_signal(struct ucred *cred, struct proc *proc, int signum) 2723100979Srwatson{ 2724100979Srwatson int error; 2725100979Srwatson 2726102103Srwatson PROC_LOCK_ASSERT(proc, MA_OWNED); 2727102103Srwatson 2728100979Srwatson if (!mac_enforce_process) 2729100979Srwatson return (0); 2730100979Srwatson 2731100979Srwatson MAC_CHECK(check_proc_signal, cred, proc, signum); 2732100979Srwatson 2733100979Srwatson return (error); 2734100979Srwatson} 2735100979Srwatson 2736100979Srwatsonint 2737100979Srwatsonmac_check_socket_bind(struct ucred *ucred, struct socket *socket, 2738100979Srwatson struct sockaddr *sockaddr) 2739100979Srwatson{ 2740100979Srwatson int error; 2741100979Srwatson 2742100979Srwatson if (!mac_enforce_socket) 2743100979Srwatson return (0); 2744100979Srwatson 2745100979Srwatson MAC_CHECK(check_socket_bind, ucred, socket, &socket->so_label, 2746100979Srwatson sockaddr); 2747100979Srwatson 2748100979Srwatson return (error); 2749100979Srwatson} 2750100979Srwatson 2751100979Srwatsonint 2752100979Srwatsonmac_check_socket_connect(struct ucred *cred, struct socket *socket, 2753100979Srwatson struct sockaddr *sockaddr) 2754100979Srwatson{ 2755100979Srwatson int error; 2756100979Srwatson 2757100979Srwatson if (!mac_enforce_socket) 2758100979Srwatson return (0); 2759100979Srwatson 2760100979Srwatson MAC_CHECK(check_socket_connect, cred, socket, &socket->so_label, 2761100979Srwatson sockaddr); 2762100979Srwatson 2763100979Srwatson return (error); 2764100979Srwatson} 2765100979Srwatson 2766100979Srwatsonint 2767101933Srwatsonmac_check_socket_deliver(struct socket *socket, struct mbuf *mbuf) 2768100979Srwatson{ 2769100979Srwatson int error; 2770100979Srwatson 2771100979Srwatson if (!mac_enforce_socket) 2772100979Srwatson return (0); 2773100979Srwatson 2774101933Srwatson MAC_CHECK(check_socket_deliver, socket, &socket->so_label, mbuf, 2775101933Srwatson &mbuf->m_pkthdr.label); 2776101933Srwatson 2777100979Srwatson return (error); 2778100979Srwatson} 2779100979Srwatson 2780100979Srwatsonint 2781101933Srwatsonmac_check_socket_listen(struct ucred *cred, struct socket *socket) 2782100979Srwatson{ 2783100979Srwatson int error; 2784100979Srwatson 2785100979Srwatson if (!mac_enforce_socket) 2786100979Srwatson return (0); 2787100979Srwatson 2788101933Srwatson MAC_CHECK(check_socket_listen, cred, socket, &socket->so_label); 2789100979Srwatson return (error); 2790100979Srwatson} 2791100979Srwatson 2792100979Srwatsonstatic int 2793100979Srwatsonmac_check_socket_relabel(struct ucred *cred, struct socket *socket, 2794100979Srwatson struct label *newlabel) 2795100979Srwatson{ 2796100979Srwatson int error; 2797100979Srwatson 2798100979Srwatson MAC_CHECK(check_socket_relabel, cred, socket, &socket->so_label, 2799100979Srwatson newlabel); 2800100979Srwatson 2801100979Srwatson return (error); 2802100979Srwatson} 2803100979Srwatson 2804100979Srwatsonint 2805100979Srwatsonmac_check_socket_visible(struct ucred *cred, struct socket *socket) 2806100979Srwatson{ 2807100979Srwatson int error; 2808100979Srwatson 2809100979Srwatson if (!mac_enforce_socket) 2810100979Srwatson return (0); 2811100979Srwatson 2812100979Srwatson MAC_CHECK(check_socket_visible, cred, socket, &socket->so_label); 2813100979Srwatson 2814100979Srwatson return (error); 2815100979Srwatson} 2816100979Srwatson 2817100979Srwatsonint 2818100979Srwatsonmac_ioctl_ifnet_get(struct ucred *cred, struct ifreq *ifr, 2819100979Srwatson struct ifnet *ifnet) 2820100979Srwatson{ 2821100979Srwatson struct mac label; 2822100979Srwatson int error; 2823100979Srwatson 2824100979Srwatson error = mac_externalize(&ifnet->if_label, &label); 2825100979Srwatson if (error) 2826100979Srwatson return (error); 2827100979Srwatson 2828100979Srwatson return (copyout(&label, ifr->ifr_ifru.ifru_data, sizeof(label))); 2829100979Srwatson} 2830100979Srwatson 2831100979Srwatsonint 2832100979Srwatsonmac_ioctl_ifnet_set(struct ucred *cred, struct ifreq *ifr, 2833100979Srwatson struct ifnet *ifnet) 2834100979Srwatson{ 2835100979Srwatson struct mac newlabel; 2836100979Srwatson struct label intlabel; 2837100979Srwatson int error; 2838100979Srwatson 2839100979Srwatson error = copyin(ifr->ifr_ifru.ifru_data, &newlabel, sizeof(newlabel)); 2840100979Srwatson if (error) 2841100979Srwatson return (error); 2842100979Srwatson 2843100979Srwatson error = mac_internalize(&intlabel, &newlabel); 2844100979Srwatson if (error) 2845100979Srwatson return (error); 2846100979Srwatson 2847100979Srwatson /* 2848100979Srwatson * XXX: Note that this is a redundant privilege check, since 2849100979Srwatson * policies impose this check themselves if required by the 2850100979Srwatson * policy. Eventually, this should go away. 2851100979Srwatson */ 2852100979Srwatson error = suser_cred(cred, 0); 2853100979Srwatson if (error) 2854100979Srwatson goto out; 2855100979Srwatson 2856100979Srwatson MAC_CHECK(check_ifnet_relabel, cred, ifnet, &ifnet->if_label, 2857100979Srwatson &intlabel); 2858100979Srwatson if (error) 2859100979Srwatson goto out; 2860100979Srwatson 2861100979Srwatson MAC_PERFORM(relabel_ifnet, cred, ifnet, &ifnet->if_label, &intlabel); 2862100979Srwatson 2863100979Srwatsonout: 2864100979Srwatson mac_destroy_temp(&intlabel); 2865100979Srwatson return (error); 2866100979Srwatson} 2867100979Srwatson 2868100979Srwatsonvoid 2869100979Srwatsonmac_create_devfs_vnode(struct devfs_dirent *de, struct vnode *vp) 2870100979Srwatson{ 2871100979Srwatson 2872100979Srwatson MAC_PERFORM(create_devfs_vnode, de, &de->de_label, vp, &vp->v_label); 2873100979Srwatson} 2874100979Srwatson 2875100979Srwatsonvoid 2876100979Srwatsonmac_create_devfs_device(dev_t dev, struct devfs_dirent *de) 2877100979Srwatson{ 2878100979Srwatson 2879100979Srwatson MAC_PERFORM(create_devfs_device, dev, de, &de->de_label); 2880100979Srwatson} 2881100979Srwatson 2882100979Srwatsonstatic int 2883100979Srwatsonmac_stdcreatevnode_ea(struct vnode *vp) 2884100979Srwatson{ 2885100979Srwatson int error; 2886100979Srwatson 2887100979Srwatson MAC_CHECK(stdcreatevnode_ea, vp, &vp->v_label); 2888100979Srwatson 2889100979Srwatson return (error); 2890100979Srwatson} 2891100979Srwatson 2892100979Srwatsonvoid 2893100979Srwatsonmac_create_devfs_directory(char *dirname, int dirnamelen, 2894100979Srwatson struct devfs_dirent *de) 2895100979Srwatson{ 2896100979Srwatson 2897100979Srwatson MAC_PERFORM(create_devfs_directory, dirname, dirnamelen, de, 2898100979Srwatson &de->de_label); 2899100979Srwatson} 2900100979Srwatson 2901100979Srwatson/* 2902100979Srwatson * When a new vnode is created, this call will initialize its label. 2903100979Srwatson */ 2904100979Srwatsonvoid 2905100979Srwatsonmac_create_vnode(struct ucred *cred, struct vnode *parent, 2906100979Srwatson struct vnode *child) 2907100979Srwatson{ 2908100979Srwatson int error; 2909100979Srwatson 2910100979Srwatson ASSERT_VOP_LOCKED(parent, "mac_create_vnode"); 2911100979Srwatson ASSERT_VOP_LOCKED(child, "mac_create_vnode"); 2912100979Srwatson 2913100979Srwatson error = vn_refreshlabel(parent, cred); 2914100979Srwatson if (error) { 2915100979Srwatson printf("mac_create_vnode: vn_refreshlabel returned %d\n", 2916100979Srwatson error); 2917100979Srwatson printf("mac_create_vnode: using old vnode label\n"); 2918100979Srwatson } 2919100979Srwatson 2920100979Srwatson MAC_PERFORM(create_vnode, cred, parent, &parent->v_label, child, 2921100979Srwatson &child->v_label); 2922100979Srwatson} 2923100979Srwatson 2924100979Srwatsonint 2925100979Srwatsonmac_setsockopt_label_set(struct ucred *cred, struct socket *so, 2926100979Srwatson struct mac *extmac) 2927100979Srwatson{ 2928100979Srwatson struct label intlabel; 2929100979Srwatson int error; 2930100979Srwatson 2931100979Srwatson error = mac_internalize(&intlabel, extmac); 2932100979Srwatson if (error) 2933100979Srwatson return (error); 2934100979Srwatson 2935100979Srwatson mac_check_socket_relabel(cred, so, &intlabel); 2936100979Srwatson if (error) { 2937100979Srwatson mac_destroy_temp(&intlabel); 2938100979Srwatson return (error); 2939100979Srwatson } 2940100979Srwatson 2941100979Srwatson mac_relabel_socket(cred, so, &intlabel); 2942100979Srwatson 2943100979Srwatson mac_destroy_temp(&intlabel); 2944100979Srwatson return (0); 2945100979Srwatson} 2946100979Srwatson 2947100979Srwatsonint 2948100979Srwatsonmac_pipe_label_set(struct ucred *cred, struct pipe *pipe, struct label *label) 2949100979Srwatson{ 2950100979Srwatson int error; 2951100979Srwatson 2952104269Srwatson PIPE_LOCK_ASSERT(pipe, MA_OWNED); 2953104269Srwatson 2954100979Srwatson error = mac_check_pipe_relabel(cred, pipe, label); 2955100979Srwatson if (error) 2956100979Srwatson return (error); 2957100979Srwatson 2958100979Srwatson mac_relabel_pipe(cred, pipe, label); 2959100979Srwatson 2960100979Srwatson return (0); 2961100979Srwatson} 2962100979Srwatson 2963100979Srwatsonint 2964100979Srwatsonmac_getsockopt_label_get(struct ucred *cred, struct socket *so, 2965100979Srwatson struct mac *extmac) 2966100979Srwatson{ 2967100979Srwatson 2968100979Srwatson return (mac_externalize(&so->so_label, extmac)); 2969100979Srwatson} 2970100979Srwatson 2971100979Srwatsonint 2972100979Srwatsonmac_getsockopt_peerlabel_get(struct ucred *cred, struct socket *so, 2973100979Srwatson struct mac *extmac) 2974100979Srwatson{ 2975100979Srwatson 2976100979Srwatson return (mac_externalize(&so->so_peerlabel, extmac)); 2977100979Srwatson} 2978100979Srwatson 2979100979Srwatson/* 2980100979Srwatson * Implementation of VOP_SETLABEL() that relies on extended attributes 2981100979Srwatson * to store label data. Can be referenced by filesystems supporting 2982100979Srwatson * extended attributes. 2983100979Srwatson */ 2984100979Srwatsonint 2985100979Srwatsonvop_stdsetlabel_ea(struct vop_setlabel_args *ap) 2986100979Srwatson{ 2987100979Srwatson struct vnode *vp = ap->a_vp; 2988100979Srwatson struct label *intlabel = ap->a_label; 2989100979Srwatson struct mac extmac; 2990100979Srwatson int error; 2991100979Srwatson 2992100979Srwatson ASSERT_VOP_LOCKED(vp, "vop_stdsetlabel_ea"); 2993100979Srwatson 2994100979Srwatson /* 2995100979Srwatson * XXX: Eventually call out to EA check/set calls here. 2996100979Srwatson * Be particularly careful to avoid race conditions, 2997100979Srwatson * consistency problems, and stability problems when 2998100979Srwatson * dealing with multiple EAs. In particular, we require 2999100979Srwatson * the ability to write multiple EAs on the same file in 3000100979Srwatson * a single transaction, which the current EA interface 3001100979Srwatson * does not provide. 3002100979Srwatson */ 3003100979Srwatson 3004100979Srwatson error = mac_externalize(intlabel, &extmac); 3005100979Srwatson if (error) 3006100979Srwatson return (error); 3007100979Srwatson 3008100979Srwatson error = vn_extattr_set(vp, IO_NODELOCKED, 3009100979Srwatson FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME, 3010100979Srwatson sizeof(extmac), (char *)&extmac, curthread); 3011100979Srwatson if (error) 3012100979Srwatson return (error); 3013100979Srwatson 3014100979Srwatson mac_relabel_vnode(ap->a_cred, vp, intlabel); 3015100979Srwatson 3016101308Sjeff vp->v_vflag |= VV_CACHEDLABEL; 3017100979Srwatson 3018100979Srwatson return (0); 3019100979Srwatson} 3020100979Srwatson 3021100979Srwatsonstatic int 3022100979Srwatsonvn_setlabel(struct vnode *vp, struct label *intlabel, struct ucred *cred) 3023100979Srwatson{ 3024100979Srwatson int error; 3025100979Srwatson 3026100979Srwatson if (vp->v_mount == NULL) { 3027100979Srwatson /* printf("vn_setlabel: null v_mount\n"); */ 3028103314Snjl if (vp->v_type != VNON) 3029103314Snjl printf("vn_setlabel: null v_mount with non-VNON\n"); 3030100979Srwatson return (EBADF); 3031100979Srwatson } 3032100979Srwatson 3033100979Srwatson if ((vp->v_mount->mnt_flag & MNT_MULTILABEL) == 0) 3034100979Srwatson return (EOPNOTSUPP); 3035100979Srwatson 3036100979Srwatson /* 3037100979Srwatson * Multi-phase commit. First check the policies to confirm the 3038100979Srwatson * change is OK. Then commit via the filesystem. Finally, 3039100979Srwatson * update the actual vnode label. Question: maybe the filesystem 3040100979Srwatson * should update the vnode at the end as part of VOP_SETLABEL()? 3041100979Srwatson */ 3042100979Srwatson error = mac_check_vnode_relabel(cred, vp, intlabel); 3043100979Srwatson if (error) 3044100979Srwatson return (error); 3045100979Srwatson 3046100979Srwatson /* 3047100979Srwatson * VADMIN provides the opportunity for the filesystem to make 3048100979Srwatson * decisions about who is and is not able to modify labels 3049100979Srwatson * and protections on files. This might not be right. We can't 3050100979Srwatson * assume VOP_SETLABEL() will do it, because we might implement 3051100979Srwatson * that as part of vop_stdsetlabel_ea(). 3052100979Srwatson */ 3053100979Srwatson error = VOP_ACCESS(vp, VADMIN, cred, curthread); 3054100979Srwatson if (error) 3055100979Srwatson return (error); 3056100979Srwatson 3057100979Srwatson error = VOP_SETLABEL(vp, intlabel, cred, curthread); 3058100979Srwatson if (error) 3059100979Srwatson return (error); 3060100979Srwatson 3061100979Srwatson return (0); 3062100979Srwatson} 3063100979Srwatson 3064100979Srwatson/* 3065100979Srwatson * MPSAFE 3066100979Srwatson */ 3067100979Srwatsonint 3068100894Srwatson__mac_get_proc(struct thread *td, struct __mac_get_proc_args *uap) 3069100894Srwatson{ 3070100979Srwatson struct mac extmac; 3071100979Srwatson int error; 3072100894Srwatson 3073100979Srwatson error = mac_externalize(&td->td_ucred->cr_label, &extmac); 3074100979Srwatson if (error == 0) 3075100979Srwatson error = copyout(&extmac, SCARG(uap, mac_p), sizeof(extmac)); 3076100979Srwatson 3077100979Srwatson return (error); 3078100979Srwatson} 3079100979Srwatson 3080100979Srwatson/* 3081100979Srwatson * MPSAFE 3082100979Srwatson */ 3083100979Srwatsonint 3084100979Srwatson__mac_set_proc(struct thread *td, struct __mac_set_proc_args *uap) 3085100979Srwatson{ 3086100979Srwatson struct ucred *newcred, *oldcred; 3087100979Srwatson struct proc *p; 3088100979Srwatson struct mac extmac; 3089100979Srwatson struct label intlabel; 3090100979Srwatson int error; 3091100979Srwatson 3092100979Srwatson error = copyin(SCARG(uap, mac_p), &extmac, sizeof(extmac)); 3093100979Srwatson if (error) 3094100979Srwatson return (error); 3095100979Srwatson 3096100979Srwatson error = mac_internalize(&intlabel, &extmac); 3097100979Srwatson if (error) 3098100979Srwatson return (error); 3099100979Srwatson 3100100979Srwatson newcred = crget(); 3101100979Srwatson 3102100979Srwatson p = td->td_proc; 3103100979Srwatson PROC_LOCK(p); 3104100979Srwatson oldcred = p->p_ucred; 3105100979Srwatson 3106100979Srwatson error = mac_check_cred_relabel(oldcred, &intlabel); 3107100979Srwatson if (error) { 3108100979Srwatson PROC_UNLOCK(p); 3109100979Srwatson mac_destroy_temp(&intlabel); 3110100979Srwatson crfree(newcred); 3111100979Srwatson return (error); 3112100979Srwatson } 3113100979Srwatson 3114100979Srwatson setsugid(p); 3115100979Srwatson crcopy(newcred, oldcred); 3116100979Srwatson mac_relabel_cred(newcred, &intlabel); 3117102136Srwatson p->p_ucred = newcred; 3118100979Srwatson 3119102136Srwatson /* 3120102136Srwatson * Grab additional reference for use while revoking mmaps, prior 3121102136Srwatson * to releasing the proc lock and sharing the cred. 3122102136Srwatson */ 3123102136Srwatson crhold(newcred); 3124100979Srwatson PROC_UNLOCK(p); 3125102136Srwatson 3126103135Srwatson mtx_lock(&Giant); 3127102136Srwatson mac_cred_mmapped_drop_perms(td, newcred); 3128103135Srwatson mtx_unlock(&Giant); 3129102136Srwatson 3130102136Srwatson crfree(newcred); /* Free revocation reference. */ 3131100979Srwatson crfree(oldcred); 3132100979Srwatson mac_destroy_temp(&intlabel); 3133100979Srwatson return (0); 3134100979Srwatson} 3135100979Srwatson 3136100979Srwatson/* 3137100979Srwatson * MPSAFE 3138100979Srwatson */ 3139100979Srwatsonint 3140100979Srwatson__mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap) 3141100979Srwatson{ 3142100979Srwatson struct file *fp; 3143100979Srwatson struct mac extmac; 3144100979Srwatson struct vnode *vp; 3145100979Srwatson struct pipe *pipe; 3146100979Srwatson int error; 3147100979Srwatson 3148100979Srwatson mtx_lock(&Giant); 3149100979Srwatson 3150100979Srwatson error = fget(td, SCARG(uap, fd), &fp); 3151100979Srwatson if (error) 3152100979Srwatson goto out; 3153100979Srwatson 3154100979Srwatson switch (fp->f_type) { 3155100979Srwatson case DTYPE_FIFO: 3156100979Srwatson case DTYPE_VNODE: 3157100979Srwatson vp = (struct vnode *)fp->f_data; 3158100979Srwatson 3159100979Srwatson vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); 3160100979Srwatson error = vn_refreshlabel(vp, td->td_ucred); 3161100979Srwatson if (error == 0) 3162100979Srwatson error = mac_externalize(&vp->v_label, &extmac); 3163100979Srwatson VOP_UNLOCK(vp, 0, td); 3164100979Srwatson break; 3165100979Srwatson case DTYPE_PIPE: 3166100979Srwatson pipe = (struct pipe *)fp->f_data; 3167100979Srwatson error = mac_externalize(pipe->pipe_label, &extmac); 3168100979Srwatson break; 3169100979Srwatson default: 3170100979Srwatson error = EINVAL; 3171100979Srwatson } 3172100979Srwatson 3173100979Srwatson if (error == 0) 3174100979Srwatson error = copyout(&extmac, SCARG(uap, mac_p), sizeof(extmac)); 3175100979Srwatson 3176100979Srwatson fdrop(fp, td); 3177100979Srwatson 3178100979Srwatsonout: 3179100979Srwatson mtx_unlock(&Giant); 3180100979Srwatson return (error); 3181100979Srwatson} 3182100979Srwatson 3183100979Srwatson/* 3184100979Srwatson * MPSAFE 3185100979Srwatson */ 3186100979Srwatsonint 3187100979Srwatson__mac_get_file(struct thread *td, struct __mac_get_file_args *uap) 3188100979Srwatson{ 3189100979Srwatson struct nameidata nd; 3190100979Srwatson struct mac extmac; 3191100979Srwatson int error; 3192100979Srwatson 3193100979Srwatson mtx_lock(&Giant); 3194100979Srwatson NDINIT(&nd, LOOKUP, LOCKLEAF | FOLLOW, UIO_USERSPACE, 3195100979Srwatson SCARG(uap, path_p), td); 3196100979Srwatson error = namei(&nd); 3197100979Srwatson if (error) 3198100979Srwatson goto out; 3199100979Srwatson 3200100979Srwatson error = vn_refreshlabel(nd.ni_vp, td->td_ucred); 3201100979Srwatson if (error == 0) 3202100979Srwatson error = mac_externalize(&nd.ni_vp->v_label, &extmac); 3203100979Srwatson NDFREE(&nd, 0); 3204100979Srwatson if (error) 3205100979Srwatson goto out; 3206100979Srwatson 3207100979Srwatson error = copyout(&extmac, SCARG(uap, mac_p), sizeof(extmac)); 3208100979Srwatson 3209100979Srwatsonout: 3210100979Srwatson mtx_unlock(&Giant); 3211100979Srwatson return (error); 3212100979Srwatson} 3213100979Srwatson 3214100979Srwatson/* 3215100979Srwatson * MPSAFE 3216100979Srwatson */ 3217100979Srwatsonint 3218100979Srwatson__mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap) 3219100979Srwatson{ 3220100979Srwatson struct file *fp; 3221100979Srwatson struct mac extmac; 3222100979Srwatson struct label intlabel; 3223100979Srwatson struct mount *mp; 3224100979Srwatson struct vnode *vp; 3225100979Srwatson struct pipe *pipe; 3226100979Srwatson int error; 3227100979Srwatson 3228100979Srwatson mtx_lock(&Giant); 3229100979Srwatson error = fget(td, SCARG(uap, fd), &fp); 3230100979Srwatson if (error) 3231100979Srwatson goto out1; 3232100979Srwatson 3233100979Srwatson error = copyin(SCARG(uap, mac_p), &extmac, sizeof(extmac)); 3234100979Srwatson if (error) 3235100979Srwatson goto out2; 3236100979Srwatson 3237100979Srwatson error = mac_internalize(&intlabel, &extmac); 3238100979Srwatson if (error) 3239100979Srwatson goto out2; 3240100979Srwatson 3241100979Srwatson switch (fp->f_type) { 3242100979Srwatson case DTYPE_FIFO: 3243100979Srwatson case DTYPE_VNODE: 3244100979Srwatson vp = (struct vnode *)fp->f_data; 3245100979Srwatson error = vn_start_write(vp, &mp, V_WAIT | PCATCH); 3246100979Srwatson if (error != 0) 3247100979Srwatson break; 3248100979Srwatson 3249100979Srwatson vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); 3250100979Srwatson error = vn_setlabel(vp, &intlabel, td->td_ucred); 3251100979Srwatson VOP_UNLOCK(vp, 0, td); 3252100979Srwatson vn_finished_write(mp); 3253100979Srwatson mac_destroy_temp(&intlabel); 3254100979Srwatson break; 3255100979Srwatson case DTYPE_PIPE: 3256100979Srwatson pipe = (struct pipe *)fp->f_data; 3257104269Srwatson PIPE_LOCK(pipe); 3258100979Srwatson error = mac_pipe_label_set(td->td_ucred, pipe, &intlabel); 3259104269Srwatson PIPE_UNLOCK(pipe); 3260100979Srwatson break; 3261100979Srwatson default: 3262100979Srwatson error = EINVAL; 3263100979Srwatson } 3264100979Srwatson 3265100979Srwatsonout2: 3266100979Srwatson fdrop(fp, td); 3267100979Srwatsonout1: 3268100979Srwatson mtx_unlock(&Giant); 3269100979Srwatson return (error); 3270100979Srwatson} 3271100979Srwatson 3272100979Srwatson/* 3273100979Srwatson * MPSAFE 3274100979Srwatson */ 3275100979Srwatsonint 3276100979Srwatson__mac_set_file(struct thread *td, struct __mac_set_file_args *uap) 3277100979Srwatson{ 3278100979Srwatson struct nameidata nd; 3279100979Srwatson struct mac extmac; 3280100979Srwatson struct label intlabel; 3281100979Srwatson struct mount *mp; 3282100979Srwatson int error; 3283100979Srwatson 3284100979Srwatson mtx_lock(&Giant); 3285100979Srwatson 3286100979Srwatson error = copyin(SCARG(uap, mac_p), &extmac, sizeof(extmac)); 3287100979Srwatson if (error) 3288100979Srwatson goto out; 3289100979Srwatson 3290100979Srwatson error = mac_internalize(&intlabel, &extmac); 3291100979Srwatson if (error) 3292100979Srwatson goto out; 3293100979Srwatson 3294100979Srwatson NDINIT(&nd, LOOKUP, LOCKLEAF | FOLLOW, UIO_USERSPACE, 3295100979Srwatson SCARG(uap, path_p), td); 3296100979Srwatson error = namei(&nd); 3297100979Srwatson if (error) 3298100979Srwatson goto out2; 3299100979Srwatson error = vn_start_write(nd.ni_vp, &mp, V_WAIT | PCATCH); 3300100979Srwatson if (error) 3301100979Srwatson goto out2; 3302100979Srwatson 3303100979Srwatson error = vn_setlabel(nd.ni_vp, &intlabel, td->td_ucred); 3304100979Srwatson 3305100979Srwatson vn_finished_write(mp); 3306100979Srwatsonout2: 3307100979Srwatson mac_destroy_temp(&intlabel); 3308100979Srwatson NDFREE(&nd, 0); 3309100979Srwatsonout: 3310100979Srwatson mtx_unlock(&Giant); 3311100979Srwatson return (error); 3312100979Srwatson} 3313100979Srwatson 3314102123Srwatsonint 3315102123Srwatsonmac_syscall(struct thread *td, struct mac_syscall_args *uap) 3316102123Srwatson{ 3317102123Srwatson struct mac_policy_conf *mpc; 3318102123Srwatson char target[MAC_MAX_POLICY_NAME]; 3319102123Srwatson int error; 3320102123Srwatson 3321102123Srwatson error = copyinstr(SCARG(uap, policy), target, sizeof(target), NULL); 3322102123Srwatson if (error) 3323102123Srwatson return (error); 3324102123Srwatson 3325102123Srwatson error = ENOSYS; 3326102123Srwatson MAC_POLICY_LIST_BUSY(); 3327102123Srwatson LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { 3328102123Srwatson if (strcmp(mpc->mpc_name, target) == 0 && 3329102123Srwatson mpc->mpc_ops->mpo_syscall != NULL) { 3330102123Srwatson error = mpc->mpc_ops->mpo_syscall(td, 3331102123Srwatson SCARG(uap, call), SCARG(uap, arg)); 3332102123Srwatson goto out; 3333102123Srwatson } 3334102123Srwatson } 3335102123Srwatson 3336102123Srwatsonout: 3337102123Srwatson MAC_POLICY_LIST_UNBUSY(); 3338102123Srwatson return (error); 3339102123Srwatson} 3340102123Srwatson 3341100979SrwatsonSYSINIT(mac, SI_SUB_MAC, SI_ORDER_FIRST, mac_init, NULL); 3342100979SrwatsonSYSINIT(mac_late, SI_SUB_MAC_LATE, SI_ORDER_FIRST, mac_late_init, NULL); 3343100979Srwatson 3344100979Srwatson#else /* !MAC */ 3345100979Srwatson 3346100979Srwatsonint 3347100979Srwatson__mac_get_proc(struct thread *td, struct __mac_get_proc_args *uap) 3348100979Srwatson{ 3349100979Srwatson 3350100894Srwatson return (ENOSYS); 3351100894Srwatson} 3352100894Srwatson 3353100894Srwatsonint 3354100894Srwatson__mac_set_proc(struct thread *td, struct __mac_set_proc_args *uap) 3355100894Srwatson{ 3356100894Srwatson 3357100894Srwatson return (ENOSYS); 3358100894Srwatson} 3359100894Srwatson 3360100894Srwatsonint 3361100894Srwatson__mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap) 3362100894Srwatson{ 3363100894Srwatson 3364100894Srwatson return (ENOSYS); 3365100894Srwatson} 3366100894Srwatson 3367100894Srwatsonint 3368100894Srwatson__mac_get_file(struct thread *td, struct __mac_get_file_args *uap) 3369100894Srwatson{ 3370100894Srwatson 3371100894Srwatson return (ENOSYS); 3372100894Srwatson} 3373100894Srwatson 3374100894Srwatsonint 3375100894Srwatson__mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap) 3376100894Srwatson{ 3377100894Srwatson 3378100894Srwatson return (ENOSYS); 3379100894Srwatson} 3380100894Srwatson 3381100894Srwatsonint 3382100894Srwatson__mac_set_file(struct thread *td, struct __mac_set_file_args *uap) 3383100894Srwatson{ 3384100894Srwatson 3385100894Srwatson return (ENOSYS); 3386100894Srwatson} 3387100979Srwatson 3388102123Srwatsonint 3389102123Srwatsonmac_syscall(struct thread *td, struct mac_syscall_args *uap) 3390102123Srwatson{ 3391102123Srwatson 3392102123Srwatson return (ENOSYS); 3393102123Srwatson} 3394102123Srwatson 3395100979Srwatson#endif /* !MAC */ 3396