mac_cred.c revision 103136
1100894Srwatson/*- 2100894Srwatson * Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson 3100894Srwatson * Copyright (c) 2001 Ilmar S. Habibulin 4100894Srwatson * Copyright (c) 2001, 2002 Networks Associates Technology, Inc. 5100894Srwatson * All rights reserved. 6100894Srwatson * 7100894Srwatson * This software was developed by Robert Watson and Ilmar Habibulin for the 8100894Srwatson * TrustedBSD Project. 9100894Srwatson * 10100894Srwatson * This software was developed for the FreeBSD Project in part by NAI Labs, 11100894Srwatson * the Security Research Division of Network Associates, Inc. under 12100894Srwatson * DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA 13100894Srwatson * CHATS research program. 14100894Srwatson * 15100894Srwatson * Redistribution and use in source and binary forms, with or without 16100894Srwatson * modification, are permitted provided that the following conditions 17100894Srwatson * are met: 18100894Srwatson * 1. Redistributions of source code must retain the above copyright 19100894Srwatson * notice, this list of conditions and the following disclaimer. 20100894Srwatson * 2. Redistributions in binary form must reproduce the above copyright 21100894Srwatson * notice, this list of conditions and the following disclaimer in the 22100894Srwatson * documentation and/or other materials provided with the distribution. 23100894Srwatson * 3. The names of the authors may not be used to endorse or promote 24100894Srwatson * products derived from this software without specific prior written 25100894Srwatson * permission. 26100894Srwatson * 27100894Srwatson * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 28100894Srwatson * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 29100894Srwatson * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 30100894Srwatson * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 31100894Srwatson * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 32100894Srwatson * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 33100894Srwatson * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 34100894Srwatson * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 35100894Srwatson * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 36100894Srwatson * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 37100894Srwatson * SUCH DAMAGE. 38100894Srwatson * 39100894Srwatson * $FreeBSD: head/sys/security/mac/mac_process.c 103136 2002-09-09 17:12:24Z rwatson $ 40100894Srwatson */ 41100894Srwatson/* 42100894Srwatson * Developed by the TrustedBSD Project. 43100894Srwatson * 44100894Srwatson * Framework for extensible kernel access control. Kernel and userland 45100894Srwatson * interface to the framework, policy registration and composition. 46100894Srwatson */ 47100894Srwatson 48100894Srwatson#include "opt_mac.h" 49101173Srwatson 50100894Srwatson#include <sys/param.h> 51100979Srwatson#include <sys/extattr.h> 52100979Srwatson#include <sys/kernel.h> 53100979Srwatson#include <sys/lock.h> 54102949Sbde#include <sys/malloc.h> 55100979Srwatson#include <sys/mutex.h> 56100979Srwatson#include <sys/mac.h> 57101712Srwatson#include <sys/module.h> 58100979Srwatson#include <sys/proc.h> 59100979Srwatson#include <sys/systm.h> 60100894Srwatson#include <sys/sysproto.h> 61100894Srwatson#include <sys/sysent.h> 62100979Srwatson#include <sys/vnode.h> 63100979Srwatson#include <sys/mount.h> 64100979Srwatson#include <sys/file.h> 65100979Srwatson#include <sys/namei.h> 66100979Srwatson#include <sys/socket.h> 67100979Srwatson#include <sys/pipe.h> 68100979Srwatson#include <sys/socketvar.h> 69100979Srwatson#include <sys/sysctl.h> 70100894Srwatson 71100979Srwatson#include <vm/vm.h> 72100979Srwatson#include <vm/pmap.h> 73100979Srwatson#include <vm/vm_map.h> 74100979Srwatson#include <vm/vm_object.h> 75100979Srwatson 76100979Srwatson#include <sys/mac_policy.h> 77100979Srwatson 78100979Srwatson#include <fs/devfs/devfs.h> 79100979Srwatson 80100979Srwatson#include <net/bpfdesc.h> 81100979Srwatson#include <net/if.h> 82100979Srwatson#include <net/if_var.h> 83100979Srwatson 84100979Srwatson#include <netinet/in.h> 85100979Srwatson#include <netinet/ip_var.h> 86100979Srwatson 87100979Srwatson#ifdef MAC 88100979Srwatson 89101712Srwatson/* 90101712Srwatson * Declare that the kernel provides MAC support, version 1. This permits 91101712Srwatson * modules to refuse to be loaded if the necessary support isn't present, 92101712Srwatson * even if it's pre-boot. 93101712Srwatson */ 94101712SrwatsonMODULE_VERSION(kernel_mac_support, 1); 95101712Srwatson 96100979SrwatsonSYSCTL_DECL(_security); 97100979Srwatson 98100979SrwatsonSYSCTL_NODE(_security, OID_AUTO, mac, CTLFLAG_RW, 0, 99100979Srwatson "TrustedBSD MAC policy controls"); 100100979SrwatsonSYSCTL_NODE(_security_mac, OID_AUTO, debug, CTLFLAG_RW, 0, 101100979Srwatson "TrustedBSD MAC debug info"); 102100979Srwatson 103100979Srwatsonstatic int mac_debug_label_fallback = 0; 104100979SrwatsonSYSCTL_INT(_security_mac_debug, OID_AUTO, label_fallback, CTLFLAG_RW, 105100979Srwatson &mac_debug_label_fallback, 0, "Filesystems should fall back to fs label" 106100979Srwatson "when label is corrupted."); 107100979SrwatsonTUNABLE_INT("security.mac.debug_label_fallback", 108100979Srwatson &mac_debug_label_fallback); 109100979Srwatson 110100979Srwatson#ifndef MAC_MAX_POLICIES 111100979Srwatson#define MAC_MAX_POLICIES 8 112100979Srwatson#endif 113100979Srwatson#if MAC_MAX_POLICIES > 32 114100979Srwatson#error "MAC_MAX_POLICIES too large" 115100979Srwatson#endif 116100979Srwatsonstatic unsigned int mac_max_policies = MAC_MAX_POLICIES; 117100979Srwatsonstatic unsigned int mac_policy_offsets_free = (1 << MAC_MAX_POLICIES) - 1; 118100979SrwatsonSYSCTL_UINT(_security_mac, OID_AUTO, max_policies, CTLFLAG_RD, 119100979Srwatson &mac_max_policies, 0, ""); 120100979Srwatson 121100979Srwatsonstatic int mac_late = 0; 122100979Srwatson 123100979Srwatsonstatic int mac_enforce_fs = 1; 124100979SrwatsonSYSCTL_INT(_security_mac, OID_AUTO, enforce_fs, CTLFLAG_RW, 125100979Srwatson &mac_enforce_fs, 0, "Enforce MAC policy on file system objects"); 126100979SrwatsonTUNABLE_INT("security.mac.enforce_fs", &mac_enforce_fs); 127100979Srwatson 128100979Srwatsonstatic int mac_enforce_network = 1; 129100979SrwatsonSYSCTL_INT(_security_mac, OID_AUTO, enforce_network, CTLFLAG_RW, 130100979Srwatson &mac_enforce_network, 0, "Enforce MAC policy on network packets"); 131100979SrwatsonTUNABLE_INT("security.mac.enforce_network", &mac_enforce_network); 132100979Srwatson 133100979Srwatsonstatic int mac_enforce_process = 1; 134100979SrwatsonSYSCTL_INT(_security_mac, OID_AUTO, enforce_process, CTLFLAG_RW, 135100979Srwatson &mac_enforce_process, 0, "Enforce MAC policy on inter-process operations"); 136100979SrwatsonTUNABLE_INT("security.mac.enforce_process", &mac_enforce_process); 137100979Srwatson 138100979Srwatsonstatic int mac_enforce_socket = 1; 139100979SrwatsonSYSCTL_INT(_security_mac, OID_AUTO, enforce_socket, CTLFLAG_RW, 140100979Srwatson &mac_enforce_socket, 0, "Enforce MAC policy on socket operations"); 141100979SrwatsonTUNABLE_INT("security.mac.enforce_socket", &mac_enforce_socket); 142100979Srwatson 143100979Srwatsonstatic int mac_enforce_pipe = 1; 144100979SrwatsonSYSCTL_INT(_security_mac, OID_AUTO, enforce_pipe, CTLFLAG_RW, 145100979Srwatson &mac_enforce_pipe, 0, "Enforce MAC policy on pipe operations"); 146100979Srwatson 147100979Srwatsonstatic int mac_label_size = sizeof(struct mac); 148100979SrwatsonSYSCTL_INT(_security_mac, OID_AUTO, label_size, CTLFLAG_RD, 149100979Srwatson &mac_label_size, 0, "Pre-compiled MAC label size"); 150100979Srwatson 151100979Srwatsonstatic int mac_cache_fslabel_in_vnode = 1; 152100979SrwatsonSYSCTL_INT(_security_mac, OID_AUTO, cache_fslabel_in_vnode, CTLFLAG_RW, 153100979Srwatson &mac_cache_fslabel_in_vnode, 0, "Cache mount fslabel in vnode"); 154100979SrwatsonTUNABLE_INT("security.mac.cache_fslabel_in_vnode", 155100979Srwatson &mac_cache_fslabel_in_vnode); 156100979Srwatson 157100979Srwatsonstatic int mac_vnode_label_cache_hits = 0; 158100979SrwatsonSYSCTL_INT(_security_mac, OID_AUTO, vnode_label_cache_hits, CTLFLAG_RD, 159100979Srwatson &mac_vnode_label_cache_hits, 0, "Cache hits on vnode labels"); 160100979Srwatsonstatic int mac_vnode_label_cache_misses = 0; 161100979SrwatsonSYSCTL_INT(_security_mac, OID_AUTO, vnode_label_cache_misses, CTLFLAG_RD, 162100979Srwatson &mac_vnode_label_cache_misses, 0, "Cache misses on vnode labels"); 163103136Srwatson 164103136Srwatsonstatic int mac_mmap_revocation = 1; 165103136SrwatsonSYSCTL_INT(_security_mac, OID_AUTO, mmap_revocation, CTLFLAG_RW, 166103136Srwatson &mac_mmap_revocation, 0, "Revoke mmap access to files on subject " 167103136Srwatson "relabel"); 168101892Srwatsonstatic int mac_mmap_revocation_via_cow = 0; 169100979SrwatsonSYSCTL_INT(_security_mac, OID_AUTO, mmap_revocation_via_cow, CTLFLAG_RW, 170100979Srwatson &mac_mmap_revocation_via_cow, 0, "Revoke mmap access to files via " 171100979Srwatson "copy-on-write semantics, or by removing all write access"); 172100979Srwatson 173101988Srwatson#ifdef MAC_DEBUG 174100979Srwatsonstatic unsigned int nmacmbufs, nmaccreds, nmacifnets, nmacbpfdescs, 175100979Srwatson nmacsockets, nmacmounts, nmactemp, nmacvnodes, nmacdevfsdirents, 176100979Srwatson nmacipqs, nmacpipes; 177100979SrwatsonSYSCTL_UINT(_security_mac_debug, OID_AUTO, mbufs, CTLFLAG_RD, 178100979Srwatson &nmacmbufs, 0, "number of mbufs in use"); 179100979SrwatsonSYSCTL_UINT(_security_mac_debug, OID_AUTO, creds, CTLFLAG_RD, 180100979Srwatson &nmaccreds, 0, "number of ucreds in use"); 181100979SrwatsonSYSCTL_UINT(_security_mac_debug, OID_AUTO, ifnets, CTLFLAG_RD, 182100979Srwatson &nmacifnets, 0, "number of ifnets in use"); 183100979SrwatsonSYSCTL_UINT(_security_mac_debug, OID_AUTO, ipqs, CTLFLAG_RD, 184100979Srwatson &nmacipqs, 0, "number of ipqs in use"); 185100979SrwatsonSYSCTL_UINT(_security_mac_debug, OID_AUTO, bpfdescs, CTLFLAG_RD, 186100979Srwatson &nmacbpfdescs, 0, "number of bpfdescs in use"); 187100979SrwatsonSYSCTL_UINT(_security_mac_debug, OID_AUTO, sockets, CTLFLAG_RD, 188100979Srwatson &nmacsockets, 0, "number of sockets in use"); 189100979SrwatsonSYSCTL_UINT(_security_mac_debug, OID_AUTO, pipes, CTLFLAG_RD, 190100979Srwatson &nmacpipes, 0, "number of pipes in use"); 191100979SrwatsonSYSCTL_UINT(_security_mac_debug, OID_AUTO, mounts, CTLFLAG_RD, 192100979Srwatson &nmacmounts, 0, "number of mounts in use"); 193100979SrwatsonSYSCTL_UINT(_security_mac_debug, OID_AUTO, temp, CTLFLAG_RD, 194100979Srwatson &nmactemp, 0, "number of temporary labels in use"); 195100979SrwatsonSYSCTL_UINT(_security_mac_debug, OID_AUTO, vnodes, CTLFLAG_RD, 196100979Srwatson &nmacvnodes, 0, "number of vnodes in use"); 197100979SrwatsonSYSCTL_UINT(_security_mac_debug, OID_AUTO, devfsdirents, CTLFLAG_RD, 198100979Srwatson &nmacdevfsdirents, 0, "number of devfs dirents inuse"); 199101988Srwatson#endif 200100979Srwatson 201100979Srwatsonstatic int error_select(int error1, int error2); 202100979Srwatsonstatic int mac_externalize(struct label *label, struct mac *mac); 203100979Srwatsonstatic int mac_policy_register(struct mac_policy_conf *mpc); 204100979Srwatsonstatic int mac_policy_unregister(struct mac_policy_conf *mpc); 205100979Srwatson 206100979Srwatsonstatic int mac_stdcreatevnode_ea(struct vnode *vp); 207100979Srwatsonstatic void mac_cred_mmapped_drop_perms(struct thread *td, 208100979Srwatson struct ucred *cred); 209100979Srwatsonstatic void mac_cred_mmapped_drop_perms_recurse(struct thread *td, 210100979Srwatson struct ucred *cred, struct vm_map *map); 211100979Srwatson 212100979SrwatsonMALLOC_DEFINE(M_MACOPVEC, "macopvec", "MAC policy operation vector"); 213100979SrwatsonMALLOC_DEFINE(M_MACPIPELABEL, "macpipelabel", "MAC labels for pipes"); 214100979Srwatson 215100979Srwatson/* 216100979Srwatson * mac_policy_list_lock protects the consistency of 'mac_policy_list', 217100979Srwatson * the linked list of attached policy modules. Read-only consumers of 218100979Srwatson * the list must acquire a shared lock for the duration of their use; 219100979Srwatson * writers must acquire an exclusive lock. Note that for compound 220100979Srwatson * operations, locks should be held for the entire compound operation, 221100979Srwatson * and that this is not yet done for relabel requests. 222100979Srwatson */ 223100979Srwatsonstatic struct mtx mac_policy_list_lock; 224100979Srwatsonstatic LIST_HEAD(, mac_policy_conf) mac_policy_list; 225100979Srwatsonstatic int mac_policy_list_busy; 226100979Srwatson#define MAC_POLICY_LIST_LOCKINIT() mtx_init(&mac_policy_list_lock, \ 227100979Srwatson "mac_policy_list_lock", NULL, MTX_DEF); 228100979Srwatson#define MAC_POLICY_LIST_LOCK() mtx_lock(&mac_policy_list_lock); 229100979Srwatson#define MAC_POLICY_LIST_UNLOCK() mtx_unlock(&mac_policy_list_lock); 230100979Srwatson 231100979Srwatson#define MAC_POLICY_LIST_BUSY() do { \ 232100979Srwatson MAC_POLICY_LIST_LOCK(); \ 233100979Srwatson mac_policy_list_busy++; \ 234100979Srwatson MAC_POLICY_LIST_UNLOCK(); \ 235100979Srwatson} while (0) 236100979Srwatson 237100979Srwatson#define MAC_POLICY_LIST_UNBUSY() do { \ 238100979Srwatson MAC_POLICY_LIST_LOCK(); \ 239100979Srwatson mac_policy_list_busy--; \ 240100979Srwatson if (mac_policy_list_busy < 0) \ 241100979Srwatson panic("Extra mac_policy_list_busy--"); \ 242100979Srwatson MAC_POLICY_LIST_UNLOCK(); \ 243100979Srwatson} while (0) 244100979Srwatson 245100979Srwatson/* 246100979Srwatson * MAC_CHECK performs the designated check by walking the policy 247100979Srwatson * module list and checking with each as to how it feels about the 248100979Srwatson * request. Note that it returns its value via 'error' in the scope 249100979Srwatson * of the caller. 250100979Srwatson */ 251100979Srwatson#define MAC_CHECK(check, args...) do { \ 252100979Srwatson struct mac_policy_conf *mpc; \ 253100979Srwatson \ 254100979Srwatson error = 0; \ 255100979Srwatson MAC_POLICY_LIST_BUSY(); \ 256100979Srwatson LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { \ 257100979Srwatson if (mpc->mpc_ops->mpo_ ## check != NULL) \ 258100979Srwatson error = error_select( \ 259100979Srwatson mpc->mpc_ops->mpo_ ## check (args), \ 260100979Srwatson error); \ 261100979Srwatson } \ 262100979Srwatson MAC_POLICY_LIST_UNBUSY(); \ 263100979Srwatson} while (0) 264100979Srwatson 265100979Srwatson/* 266100979Srwatson * MAC_BOOLEAN performs the designated boolean composition by walking 267100979Srwatson * the module list, invoking each instance of the operation, and 268100979Srwatson * combining the results using the passed C operator. Note that it 269100979Srwatson * returns its value via 'result' in the scope of the caller, which 270100979Srwatson * should be initialized by the caller in a meaningful way to get 271100979Srwatson * a meaningful result. 272100979Srwatson */ 273100979Srwatson#define MAC_BOOLEAN(operation, composition, args...) do { \ 274100979Srwatson struct mac_policy_conf *mpc; \ 275100979Srwatson \ 276100979Srwatson MAC_POLICY_LIST_BUSY(); \ 277100979Srwatson LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { \ 278100979Srwatson if (mpc->mpc_ops->mpo_ ## operation != NULL) \ 279100979Srwatson result = result composition \ 280100979Srwatson mpc->mpc_ops->mpo_ ## operation (args); \ 281100979Srwatson } \ 282100979Srwatson MAC_POLICY_LIST_UNBUSY(); \ 283100979Srwatson} while (0) 284100979Srwatson 285100979Srwatson/* 286100979Srwatson * MAC_PERFORM performs the designated operation by walking the policy 287100979Srwatson * module list and invoking that operation for each policy. 288100979Srwatson */ 289100979Srwatson#define MAC_PERFORM(operation, args...) do { \ 290100979Srwatson struct mac_policy_conf *mpc; \ 291100979Srwatson \ 292100979Srwatson MAC_POLICY_LIST_BUSY(); \ 293100979Srwatson LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { \ 294100979Srwatson if (mpc->mpc_ops->mpo_ ## operation != NULL) \ 295100979Srwatson mpc->mpc_ops->mpo_ ## operation (args); \ 296100979Srwatson } \ 297100979Srwatson MAC_POLICY_LIST_UNBUSY(); \ 298100979Srwatson} while (0) 299100979Srwatson 300100979Srwatson/* 301100979Srwatson * Initialize the MAC subsystem, including appropriate SMP locks. 302100979Srwatson */ 303100979Srwatsonstatic void 304100979Srwatsonmac_init(void) 305100979Srwatson{ 306100979Srwatson 307100979Srwatson LIST_INIT(&mac_policy_list); 308100979Srwatson MAC_POLICY_LIST_LOCKINIT(); 309100979Srwatson} 310100979Srwatson 311100979Srwatson/* 312100979Srwatson * For the purposes of modules that want to know if they were loaded 313100979Srwatson * "early", set the mac_late flag once we've processed modules either 314100979Srwatson * linked into the kernel, or loaded before the kernel startup. 315100979Srwatson */ 316100979Srwatsonstatic void 317100979Srwatsonmac_late_init(void) 318100979Srwatson{ 319100979Srwatson 320100979Srwatson mac_late = 1; 321100979Srwatson} 322100979Srwatson 323100979Srwatson/* 324100979Srwatson * Allow MAC policy modules to register during boot, etc. 325100979Srwatson */ 326100894Srwatsonint 327100979Srwatsonmac_policy_modevent(module_t mod, int type, void *data) 328100979Srwatson{ 329100979Srwatson struct mac_policy_conf *mpc; 330100979Srwatson int error; 331100979Srwatson 332100979Srwatson error = 0; 333100979Srwatson mpc = (struct mac_policy_conf *) data; 334100979Srwatson 335100979Srwatson switch (type) { 336100979Srwatson case MOD_LOAD: 337100979Srwatson if (mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_NOTLATE && 338100979Srwatson mac_late) { 339100979Srwatson printf("mac_policy_modevent: can't load %s policy " 340100979Srwatson "after booting\n", mpc->mpc_name); 341100979Srwatson error = EBUSY; 342100979Srwatson break; 343100979Srwatson } 344100979Srwatson error = mac_policy_register(mpc); 345100979Srwatson break; 346100979Srwatson case MOD_UNLOAD: 347100979Srwatson /* Don't unregister the module if it was never registered. */ 348100979Srwatson if ((mpc->mpc_runtime_flags & MPC_RUNTIME_FLAG_REGISTERED) 349100979Srwatson != 0) 350100979Srwatson error = mac_policy_unregister(mpc); 351100979Srwatson else 352100979Srwatson error = 0; 353100979Srwatson break; 354100979Srwatson default: 355100979Srwatson break; 356100979Srwatson } 357100979Srwatson 358100979Srwatson return (error); 359100979Srwatson} 360100979Srwatson 361100979Srwatsonstatic int 362100979Srwatsonmac_policy_register(struct mac_policy_conf *mpc) 363100979Srwatson{ 364100979Srwatson struct mac_policy_conf *tmpc; 365100979Srwatson struct mac_policy_ops *ops; 366100979Srwatson struct mac_policy_op_entry *mpe; 367100979Srwatson int slot; 368100979Srwatson 369100979Srwatson MALLOC(mpc->mpc_ops, struct mac_policy_ops *, sizeof(*ops), M_MACOPVEC, 370100979Srwatson M_WAITOK | M_ZERO); 371100979Srwatson for (mpe = mpc->mpc_entries; mpe->mpe_constant != MAC_OP_LAST; mpe++) { 372100979Srwatson switch (mpe->mpe_constant) { 373100979Srwatson case MAC_OP_LAST: 374100979Srwatson /* 375100979Srwatson * Doesn't actually happen, but this allows checking 376100979Srwatson * that all enumerated values are handled. 377100979Srwatson */ 378100979Srwatson break; 379100979Srwatson case MAC_DESTROY: 380100979Srwatson mpc->mpc_ops->mpo_destroy = 381100979Srwatson mpe->mpe_function; 382100979Srwatson break; 383100979Srwatson case MAC_INIT: 384100979Srwatson mpc->mpc_ops->mpo_init = 385100979Srwatson mpe->mpe_function; 386100979Srwatson break; 387102123Srwatson case MAC_SYSCALL: 388102123Srwatson mpc->mpc_ops->mpo_syscall = 389102123Srwatson mpe->mpe_function; 390102123Srwatson break; 391100979Srwatson case MAC_INIT_BPFDESC: 392100979Srwatson mpc->mpc_ops->mpo_init_bpfdesc = 393100979Srwatson mpe->mpe_function; 394100979Srwatson break; 395100979Srwatson case MAC_INIT_CRED: 396100979Srwatson mpc->mpc_ops->mpo_init_cred = 397100979Srwatson mpe->mpe_function; 398100979Srwatson break; 399100979Srwatson case MAC_INIT_DEVFSDIRENT: 400100979Srwatson mpc->mpc_ops->mpo_init_devfsdirent = 401100979Srwatson mpe->mpe_function; 402100979Srwatson break; 403100979Srwatson case MAC_INIT_IFNET: 404100979Srwatson mpc->mpc_ops->mpo_init_ifnet = 405100979Srwatson mpe->mpe_function; 406100979Srwatson break; 407100979Srwatson case MAC_INIT_IPQ: 408100979Srwatson mpc->mpc_ops->mpo_init_ipq = 409100979Srwatson mpe->mpe_function; 410100979Srwatson break; 411100979Srwatson case MAC_INIT_MBUF: 412100979Srwatson mpc->mpc_ops->mpo_init_mbuf = 413100979Srwatson mpe->mpe_function; 414100979Srwatson break; 415100979Srwatson case MAC_INIT_MOUNT: 416100979Srwatson mpc->mpc_ops->mpo_init_mount = 417100979Srwatson mpe->mpe_function; 418100979Srwatson break; 419100979Srwatson case MAC_INIT_PIPE: 420100979Srwatson mpc->mpc_ops->mpo_init_pipe = 421100979Srwatson mpe->mpe_function; 422100979Srwatson break; 423100979Srwatson case MAC_INIT_SOCKET: 424100979Srwatson mpc->mpc_ops->mpo_init_socket = 425100979Srwatson mpe->mpe_function; 426100979Srwatson break; 427100979Srwatson case MAC_INIT_TEMP: 428100979Srwatson mpc->mpc_ops->mpo_init_temp = 429100979Srwatson mpe->mpe_function; 430100979Srwatson break; 431100979Srwatson case MAC_INIT_VNODE: 432100979Srwatson mpc->mpc_ops->mpo_init_vnode = 433100979Srwatson mpe->mpe_function; 434100979Srwatson break; 435100979Srwatson case MAC_DESTROY_BPFDESC: 436100979Srwatson mpc->mpc_ops->mpo_destroy_bpfdesc = 437100979Srwatson mpe->mpe_function; 438100979Srwatson break; 439100979Srwatson case MAC_DESTROY_CRED: 440100979Srwatson mpc->mpc_ops->mpo_destroy_cred = 441100979Srwatson mpe->mpe_function; 442100979Srwatson break; 443100979Srwatson case MAC_DESTROY_DEVFSDIRENT: 444100979Srwatson mpc->mpc_ops->mpo_destroy_devfsdirent = 445100979Srwatson mpe->mpe_function; 446100979Srwatson break; 447100979Srwatson case MAC_DESTROY_IFNET: 448100979Srwatson mpc->mpc_ops->mpo_destroy_ifnet = 449100979Srwatson mpe->mpe_function; 450100979Srwatson break; 451100979Srwatson case MAC_DESTROY_IPQ: 452100979Srwatson mpc->mpc_ops->mpo_destroy_ipq = 453100979Srwatson mpe->mpe_function; 454100979Srwatson break; 455100979Srwatson case MAC_DESTROY_MBUF: 456100979Srwatson mpc->mpc_ops->mpo_destroy_mbuf = 457100979Srwatson mpe->mpe_function; 458100979Srwatson break; 459100979Srwatson case MAC_DESTROY_MOUNT: 460100979Srwatson mpc->mpc_ops->mpo_destroy_mount = 461100979Srwatson mpe->mpe_function; 462100979Srwatson break; 463100979Srwatson case MAC_DESTROY_PIPE: 464100979Srwatson mpc->mpc_ops->mpo_destroy_pipe = 465100979Srwatson mpe->mpe_function; 466100979Srwatson break; 467100979Srwatson case MAC_DESTROY_SOCKET: 468100979Srwatson mpc->mpc_ops->mpo_destroy_socket = 469100979Srwatson mpe->mpe_function; 470100979Srwatson break; 471100979Srwatson case MAC_DESTROY_TEMP: 472100979Srwatson mpc->mpc_ops->mpo_destroy_temp = 473100979Srwatson mpe->mpe_function; 474100979Srwatson break; 475100979Srwatson case MAC_DESTROY_VNODE: 476100979Srwatson mpc->mpc_ops->mpo_destroy_vnode = 477100979Srwatson mpe->mpe_function; 478100979Srwatson break; 479100979Srwatson case MAC_EXTERNALIZE: 480100979Srwatson mpc->mpc_ops->mpo_externalize = 481100979Srwatson mpe->mpe_function; 482100979Srwatson break; 483100979Srwatson case MAC_INTERNALIZE: 484100979Srwatson mpc->mpc_ops->mpo_internalize = 485100979Srwatson mpe->mpe_function; 486100979Srwatson break; 487100979Srwatson case MAC_CREATE_DEVFS_DEVICE: 488100979Srwatson mpc->mpc_ops->mpo_create_devfs_device = 489100979Srwatson mpe->mpe_function; 490100979Srwatson break; 491100979Srwatson case MAC_CREATE_DEVFS_DIRECTORY: 492100979Srwatson mpc->mpc_ops->mpo_create_devfs_directory = 493100979Srwatson mpe->mpe_function; 494100979Srwatson break; 495100979Srwatson case MAC_CREATE_DEVFS_VNODE: 496100979Srwatson mpc->mpc_ops->mpo_create_devfs_vnode = 497100979Srwatson mpe->mpe_function; 498100979Srwatson break; 499100979Srwatson case MAC_STDCREATEVNODE_EA: 500100979Srwatson mpc->mpc_ops->mpo_stdcreatevnode_ea = 501100979Srwatson mpe->mpe_function; 502100979Srwatson break; 503100979Srwatson case MAC_CREATE_VNODE: 504100979Srwatson mpc->mpc_ops->mpo_create_vnode = 505100979Srwatson mpe->mpe_function; 506100979Srwatson break; 507100979Srwatson case MAC_CREATE_MOUNT: 508100979Srwatson mpc->mpc_ops->mpo_create_mount = 509100979Srwatson mpe->mpe_function; 510100979Srwatson break; 511100979Srwatson case MAC_CREATE_ROOT_MOUNT: 512100979Srwatson mpc->mpc_ops->mpo_create_root_mount = 513100979Srwatson mpe->mpe_function; 514100979Srwatson break; 515100979Srwatson case MAC_RELABEL_VNODE: 516100979Srwatson mpc->mpc_ops->mpo_relabel_vnode = 517100979Srwatson mpe->mpe_function; 518100979Srwatson break; 519100979Srwatson case MAC_UPDATE_DEVFSDIRENT: 520100979Srwatson mpc->mpc_ops->mpo_update_devfsdirent = 521100979Srwatson mpe->mpe_function; 522100979Srwatson break; 523100979Srwatson case MAC_UPDATE_PROCFSVNODE: 524100979Srwatson mpc->mpc_ops->mpo_update_procfsvnode = 525100979Srwatson mpe->mpe_function; 526100979Srwatson break; 527100979Srwatson case MAC_UPDATE_VNODE_FROM_EXTATTR: 528100979Srwatson mpc->mpc_ops->mpo_update_vnode_from_extattr = 529100979Srwatson mpe->mpe_function; 530100979Srwatson break; 531100979Srwatson case MAC_UPDATE_VNODE_FROM_EXTERNALIZED: 532100979Srwatson mpc->mpc_ops->mpo_update_vnode_from_externalized = 533100979Srwatson mpe->mpe_function; 534100979Srwatson break; 535100979Srwatson case MAC_UPDATE_VNODE_FROM_MOUNT: 536100979Srwatson mpc->mpc_ops->mpo_update_vnode_from_mount = 537100979Srwatson mpe->mpe_function; 538100979Srwatson break; 539100979Srwatson case MAC_CREATE_MBUF_FROM_SOCKET: 540100979Srwatson mpc->mpc_ops->mpo_create_mbuf_from_socket = 541100979Srwatson mpe->mpe_function; 542100979Srwatson break; 543100979Srwatson case MAC_CREATE_PIPE: 544100979Srwatson mpc->mpc_ops->mpo_create_pipe = 545100979Srwatson mpe->mpe_function; 546100979Srwatson break; 547100979Srwatson case MAC_CREATE_SOCKET: 548100979Srwatson mpc->mpc_ops->mpo_create_socket = 549100979Srwatson mpe->mpe_function; 550100979Srwatson break; 551100979Srwatson case MAC_CREATE_SOCKET_FROM_SOCKET: 552100979Srwatson mpc->mpc_ops->mpo_create_socket_from_socket = 553100979Srwatson mpe->mpe_function; 554100979Srwatson break; 555100979Srwatson case MAC_RELABEL_PIPE: 556100979Srwatson mpc->mpc_ops->mpo_relabel_pipe = 557100979Srwatson mpe->mpe_function; 558100979Srwatson break; 559100979Srwatson case MAC_RELABEL_SOCKET: 560100979Srwatson mpc->mpc_ops->mpo_relabel_socket = 561100979Srwatson mpe->mpe_function; 562100979Srwatson break; 563100979Srwatson case MAC_SET_SOCKET_PEER_FROM_MBUF: 564100979Srwatson mpc->mpc_ops->mpo_set_socket_peer_from_mbuf = 565100979Srwatson mpe->mpe_function; 566100979Srwatson break; 567100979Srwatson case MAC_SET_SOCKET_PEER_FROM_SOCKET: 568100979Srwatson mpc->mpc_ops->mpo_set_socket_peer_from_socket = 569100979Srwatson mpe->mpe_function; 570100979Srwatson break; 571100979Srwatson case MAC_CREATE_BPFDESC: 572100979Srwatson mpc->mpc_ops->mpo_create_bpfdesc = 573100979Srwatson mpe->mpe_function; 574100979Srwatson break; 575100979Srwatson case MAC_CREATE_DATAGRAM_FROM_IPQ: 576100979Srwatson mpc->mpc_ops->mpo_create_datagram_from_ipq = 577100979Srwatson mpe->mpe_function; 578100979Srwatson break; 579100979Srwatson case MAC_CREATE_FRAGMENT: 580100979Srwatson mpc->mpc_ops->mpo_create_fragment = 581100979Srwatson mpe->mpe_function; 582100979Srwatson break; 583100979Srwatson case MAC_CREATE_IFNET: 584100979Srwatson mpc->mpc_ops->mpo_create_ifnet = 585100979Srwatson mpe->mpe_function; 586100979Srwatson break; 587100979Srwatson case MAC_CREATE_IPQ: 588100979Srwatson mpc->mpc_ops->mpo_create_ipq = 589100979Srwatson mpe->mpe_function; 590100979Srwatson break; 591100979Srwatson case MAC_CREATE_MBUF_FROM_MBUF: 592100979Srwatson mpc->mpc_ops->mpo_create_mbuf_from_mbuf = 593100979Srwatson mpe->mpe_function; 594100979Srwatson break; 595100979Srwatson case MAC_CREATE_MBUF_LINKLAYER: 596100979Srwatson mpc->mpc_ops->mpo_create_mbuf_linklayer = 597100979Srwatson mpe->mpe_function; 598100979Srwatson break; 599100979Srwatson case MAC_CREATE_MBUF_FROM_BPFDESC: 600100979Srwatson mpc->mpc_ops->mpo_create_mbuf_from_bpfdesc = 601100979Srwatson mpe->mpe_function; 602100979Srwatson break; 603100979Srwatson case MAC_CREATE_MBUF_FROM_IFNET: 604100979Srwatson mpc->mpc_ops->mpo_create_mbuf_from_ifnet = 605100979Srwatson mpe->mpe_function; 606100979Srwatson break; 607100979Srwatson case MAC_CREATE_MBUF_MULTICAST_ENCAP: 608100979Srwatson mpc->mpc_ops->mpo_create_mbuf_multicast_encap = 609100979Srwatson mpe->mpe_function; 610100979Srwatson break; 611100979Srwatson case MAC_CREATE_MBUF_NETLAYER: 612100979Srwatson mpc->mpc_ops->mpo_create_mbuf_netlayer = 613100979Srwatson mpe->mpe_function; 614100979Srwatson break; 615100979Srwatson case MAC_FRAGMENT_MATCH: 616100979Srwatson mpc->mpc_ops->mpo_fragment_match = 617100979Srwatson mpe->mpe_function; 618100979Srwatson break; 619100979Srwatson case MAC_RELABEL_IFNET: 620100979Srwatson mpc->mpc_ops->mpo_relabel_ifnet = 621100979Srwatson mpe->mpe_function; 622100979Srwatson break; 623100979Srwatson case MAC_UPDATE_IPQ: 624100979Srwatson mpc->mpc_ops->mpo_update_ipq = 625100979Srwatson mpe->mpe_function; 626100979Srwatson break; 627100979Srwatson case MAC_CREATE_CRED: 628100979Srwatson mpc->mpc_ops->mpo_create_cred = 629100979Srwatson mpe->mpe_function; 630100979Srwatson break; 631100979Srwatson case MAC_EXECVE_TRANSITION: 632100979Srwatson mpc->mpc_ops->mpo_execve_transition = 633100979Srwatson mpe->mpe_function; 634100979Srwatson break; 635100979Srwatson case MAC_EXECVE_WILL_TRANSITION: 636100979Srwatson mpc->mpc_ops->mpo_execve_will_transition = 637100979Srwatson mpe->mpe_function; 638100979Srwatson break; 639100979Srwatson case MAC_CREATE_PROC0: 640100979Srwatson mpc->mpc_ops->mpo_create_proc0 = mpe->mpe_function; 641100979Srwatson break; 642100979Srwatson case MAC_CREATE_PROC1: 643100979Srwatson mpc->mpc_ops->mpo_create_proc1 = mpe->mpe_function; 644100979Srwatson break; 645100979Srwatson case MAC_RELABEL_CRED: 646100979Srwatson mpc->mpc_ops->mpo_relabel_cred = 647100979Srwatson mpe->mpe_function; 648100979Srwatson break; 649100979Srwatson case MAC_CHECK_BPFDESC_RECEIVE: 650100979Srwatson mpc->mpc_ops->mpo_check_bpfdesc_receive = 651100979Srwatson mpe->mpe_function; 652100979Srwatson break; 653100979Srwatson case MAC_CHECK_CRED_RELABEL: 654100979Srwatson mpc->mpc_ops->mpo_check_cred_relabel = 655100979Srwatson mpe->mpe_function; 656100979Srwatson break; 657100979Srwatson case MAC_CHECK_CRED_VISIBLE: 658100979Srwatson mpc->mpc_ops->mpo_check_cred_visible = 659100979Srwatson mpe->mpe_function; 660100979Srwatson break; 661100979Srwatson case MAC_CHECK_IFNET_RELABEL: 662100979Srwatson mpc->mpc_ops->mpo_check_ifnet_relabel = 663100979Srwatson mpe->mpe_function; 664100979Srwatson break; 665100979Srwatson case MAC_CHECK_IFNET_TRANSMIT: 666100979Srwatson mpc->mpc_ops->mpo_check_ifnet_transmit = 667100979Srwatson mpe->mpe_function; 668100979Srwatson break; 669100979Srwatson case MAC_CHECK_MOUNT_STAT: 670100979Srwatson mpc->mpc_ops->mpo_check_mount_stat = 671100979Srwatson mpe->mpe_function; 672100979Srwatson break; 673100979Srwatson case MAC_CHECK_PIPE_IOCTL: 674100979Srwatson mpc->mpc_ops->mpo_check_pipe_ioctl = 675100979Srwatson mpe->mpe_function; 676100979Srwatson break; 677102115Srwatson case MAC_CHECK_PIPE_POLL: 678102115Srwatson mpc->mpc_ops->mpo_check_pipe_poll = 679100979Srwatson mpe->mpe_function; 680100979Srwatson break; 681102115Srwatson case MAC_CHECK_PIPE_READ: 682102115Srwatson mpc->mpc_ops->mpo_check_pipe_read = 683102115Srwatson mpe->mpe_function; 684102115Srwatson break; 685100979Srwatson case MAC_CHECK_PIPE_RELABEL: 686100979Srwatson mpc->mpc_ops->mpo_check_pipe_relabel = 687100979Srwatson mpe->mpe_function; 688100979Srwatson break; 689102115Srwatson case MAC_CHECK_PIPE_STAT: 690102115Srwatson mpc->mpc_ops->mpo_check_pipe_stat = 691102115Srwatson mpe->mpe_function; 692102115Srwatson break; 693102115Srwatson case MAC_CHECK_PIPE_WRITE: 694102115Srwatson mpc->mpc_ops->mpo_check_pipe_write = 695102115Srwatson mpe->mpe_function; 696102115Srwatson break; 697100979Srwatson case MAC_CHECK_PROC_DEBUG: 698100979Srwatson mpc->mpc_ops->mpo_check_proc_debug = 699100979Srwatson mpe->mpe_function; 700100979Srwatson break; 701100979Srwatson case MAC_CHECK_PROC_SCHED: 702100979Srwatson mpc->mpc_ops->mpo_check_proc_sched = 703100979Srwatson mpe->mpe_function; 704100979Srwatson break; 705100979Srwatson case MAC_CHECK_PROC_SIGNAL: 706100979Srwatson mpc->mpc_ops->mpo_check_proc_signal = 707100979Srwatson mpe->mpe_function; 708100979Srwatson break; 709100979Srwatson case MAC_CHECK_SOCKET_BIND: 710100979Srwatson mpc->mpc_ops->mpo_check_socket_bind = 711100979Srwatson mpe->mpe_function; 712100979Srwatson break; 713100979Srwatson case MAC_CHECK_SOCKET_CONNECT: 714100979Srwatson mpc->mpc_ops->mpo_check_socket_connect = 715100979Srwatson mpe->mpe_function; 716100979Srwatson break; 717101933Srwatson case MAC_CHECK_SOCKET_DELIVER: 718101933Srwatson mpc->mpc_ops->mpo_check_socket_deliver = 719101933Srwatson mpe->mpe_function; 720101933Srwatson break; 721100979Srwatson case MAC_CHECK_SOCKET_LISTEN: 722100979Srwatson mpc->mpc_ops->mpo_check_socket_listen = 723100979Srwatson mpe->mpe_function; 724100979Srwatson break; 725100979Srwatson case MAC_CHECK_SOCKET_RELABEL: 726100979Srwatson mpc->mpc_ops->mpo_check_socket_relabel = 727100979Srwatson mpe->mpe_function; 728100979Srwatson break; 729100979Srwatson case MAC_CHECK_SOCKET_VISIBLE: 730100979Srwatson mpc->mpc_ops->mpo_check_socket_visible = 731100979Srwatson mpe->mpe_function; 732100979Srwatson break; 733100979Srwatson case MAC_CHECK_VNODE_ACCESS: 734100979Srwatson mpc->mpc_ops->mpo_check_vnode_access = 735100979Srwatson mpe->mpe_function; 736100979Srwatson break; 737100979Srwatson case MAC_CHECK_VNODE_CHDIR: 738100979Srwatson mpc->mpc_ops->mpo_check_vnode_chdir = 739100979Srwatson mpe->mpe_function; 740100979Srwatson break; 741100979Srwatson case MAC_CHECK_VNODE_CHROOT: 742100979Srwatson mpc->mpc_ops->mpo_check_vnode_chroot = 743100979Srwatson mpe->mpe_function; 744100979Srwatson break; 745100979Srwatson case MAC_CHECK_VNODE_CREATE: 746100979Srwatson mpc->mpc_ops->mpo_check_vnode_create = 747100979Srwatson mpe->mpe_function; 748100979Srwatson break; 749100979Srwatson case MAC_CHECK_VNODE_DELETE: 750100979Srwatson mpc->mpc_ops->mpo_check_vnode_delete = 751100979Srwatson mpe->mpe_function; 752100979Srwatson break; 753100979Srwatson case MAC_CHECK_VNODE_DELETEACL: 754100979Srwatson mpc->mpc_ops->mpo_check_vnode_deleteacl = 755100979Srwatson mpe->mpe_function; 756100979Srwatson break; 757100979Srwatson case MAC_CHECK_VNODE_EXEC: 758100979Srwatson mpc->mpc_ops->mpo_check_vnode_exec = 759100979Srwatson mpe->mpe_function; 760100979Srwatson break; 761100979Srwatson case MAC_CHECK_VNODE_GETACL: 762100979Srwatson mpc->mpc_ops->mpo_check_vnode_getacl = 763100979Srwatson mpe->mpe_function; 764100979Srwatson break; 765100979Srwatson case MAC_CHECK_VNODE_GETEXTATTR: 766100979Srwatson mpc->mpc_ops->mpo_check_vnode_getextattr = 767100979Srwatson mpe->mpe_function; 768100979Srwatson break; 769100979Srwatson case MAC_CHECK_VNODE_LOOKUP: 770100979Srwatson mpc->mpc_ops->mpo_check_vnode_lookup = 771100979Srwatson mpe->mpe_function; 772100979Srwatson break; 773100979Srwatson case MAC_CHECK_VNODE_MMAP_PERMS: 774100979Srwatson mpc->mpc_ops->mpo_check_vnode_mmap_perms = 775100979Srwatson mpe->mpe_function; 776100979Srwatson break; 777100979Srwatson case MAC_CHECK_VNODE_OPEN: 778100979Srwatson mpc->mpc_ops->mpo_check_vnode_open = 779100979Srwatson mpe->mpe_function; 780100979Srwatson break; 781102112Srwatson case MAC_CHECK_VNODE_POLL: 782102112Srwatson mpc->mpc_ops->mpo_check_vnode_poll = 783102112Srwatson mpe->mpe_function; 784102112Srwatson break; 785102112Srwatson case MAC_CHECK_VNODE_READ: 786102112Srwatson mpc->mpc_ops->mpo_check_vnode_read = 787102112Srwatson mpe->mpe_function; 788102112Srwatson break; 789100979Srwatson case MAC_CHECK_VNODE_READDIR: 790100979Srwatson mpc->mpc_ops->mpo_check_vnode_readdir = 791100979Srwatson mpe->mpe_function; 792100979Srwatson break; 793100979Srwatson case MAC_CHECK_VNODE_READLINK: 794100979Srwatson mpc->mpc_ops->mpo_check_vnode_readlink = 795100979Srwatson mpe->mpe_function; 796100979Srwatson break; 797100979Srwatson case MAC_CHECK_VNODE_RELABEL: 798100979Srwatson mpc->mpc_ops->mpo_check_vnode_relabel = 799100979Srwatson mpe->mpe_function; 800100979Srwatson break; 801100979Srwatson case MAC_CHECK_VNODE_RENAME_FROM: 802100979Srwatson mpc->mpc_ops->mpo_check_vnode_rename_from = 803100979Srwatson mpe->mpe_function; 804100979Srwatson break; 805100979Srwatson case MAC_CHECK_VNODE_RENAME_TO: 806100979Srwatson mpc->mpc_ops->mpo_check_vnode_rename_to = 807100979Srwatson mpe->mpe_function; 808100979Srwatson break; 809100979Srwatson case MAC_CHECK_VNODE_REVOKE: 810100979Srwatson mpc->mpc_ops->mpo_check_vnode_revoke = 811100979Srwatson mpe->mpe_function; 812100979Srwatson break; 813100979Srwatson case MAC_CHECK_VNODE_SETACL: 814100979Srwatson mpc->mpc_ops->mpo_check_vnode_setacl = 815100979Srwatson mpe->mpe_function; 816100979Srwatson break; 817100979Srwatson case MAC_CHECK_VNODE_SETEXTATTR: 818100979Srwatson mpc->mpc_ops->mpo_check_vnode_setextattr = 819100979Srwatson mpe->mpe_function; 820100979Srwatson break; 821100979Srwatson case MAC_CHECK_VNODE_SETFLAGS: 822100979Srwatson mpc->mpc_ops->mpo_check_vnode_setflags = 823100979Srwatson mpe->mpe_function; 824100979Srwatson break; 825100979Srwatson case MAC_CHECK_VNODE_SETMODE: 826100979Srwatson mpc->mpc_ops->mpo_check_vnode_setmode = 827100979Srwatson mpe->mpe_function; 828100979Srwatson break; 829100979Srwatson case MAC_CHECK_VNODE_SETOWNER: 830100979Srwatson mpc->mpc_ops->mpo_check_vnode_setowner = 831100979Srwatson mpe->mpe_function; 832100979Srwatson break; 833100979Srwatson case MAC_CHECK_VNODE_SETUTIMES: 834100979Srwatson mpc->mpc_ops->mpo_check_vnode_setutimes = 835100979Srwatson mpe->mpe_function; 836100979Srwatson break; 837100979Srwatson case MAC_CHECK_VNODE_STAT: 838100979Srwatson mpc->mpc_ops->mpo_check_vnode_stat = 839100979Srwatson mpe->mpe_function; 840100979Srwatson break; 841102112Srwatson case MAC_CHECK_VNODE_WRITE: 842102112Srwatson mpc->mpc_ops->mpo_check_vnode_write = 843102112Srwatson mpe->mpe_function; 844102112Srwatson break; 845100979Srwatson/* 846100979Srwatson default: 847100979Srwatson printf("MAC policy `%s': unknown operation %d\n", 848100979Srwatson mpc->mpc_name, mpe->mpe_constant); 849100979Srwatson return (EINVAL); 850100979Srwatson*/ 851100979Srwatson } 852100979Srwatson } 853100979Srwatson MAC_POLICY_LIST_LOCK(); 854100979Srwatson if (mac_policy_list_busy > 0) { 855100979Srwatson MAC_POLICY_LIST_UNLOCK(); 856100979Srwatson FREE(mpc->mpc_ops, M_MACOPVEC); 857100979Srwatson mpc->mpc_ops = NULL; 858100979Srwatson return (EBUSY); 859100979Srwatson } 860100979Srwatson LIST_FOREACH(tmpc, &mac_policy_list, mpc_list) { 861100979Srwatson if (strcmp(tmpc->mpc_name, mpc->mpc_name) == 0) { 862100979Srwatson MAC_POLICY_LIST_UNLOCK(); 863100979Srwatson FREE(mpc->mpc_ops, M_MACOPVEC); 864100979Srwatson mpc->mpc_ops = NULL; 865100979Srwatson return (EEXIST); 866100979Srwatson } 867100979Srwatson } 868100979Srwatson if (mpc->mpc_field_off != NULL) { 869100979Srwatson slot = ffs(mac_policy_offsets_free); 870100979Srwatson if (slot == 0) { 871100979Srwatson MAC_POLICY_LIST_UNLOCK(); 872100979Srwatson FREE(mpc->mpc_ops, M_MACOPVEC); 873100979Srwatson mpc->mpc_ops = NULL; 874100979Srwatson return (ENOMEM); 875100979Srwatson } 876100979Srwatson slot--; 877100979Srwatson mac_policy_offsets_free &= ~(1 << slot); 878100979Srwatson *mpc->mpc_field_off = slot; 879100979Srwatson } 880100979Srwatson mpc->mpc_runtime_flags |= MPC_RUNTIME_FLAG_REGISTERED; 881100979Srwatson LIST_INSERT_HEAD(&mac_policy_list, mpc, mpc_list); 882100979Srwatson 883100979Srwatson /* Per-policy initialization. */ 884100979Srwatson if (mpc->mpc_ops->mpo_init != NULL) 885100979Srwatson (*(mpc->mpc_ops->mpo_init))(mpc); 886100979Srwatson MAC_POLICY_LIST_UNLOCK(); 887100979Srwatson 888100979Srwatson printf("Security policy loaded: %s (%s)\n", mpc->mpc_fullname, 889100979Srwatson mpc->mpc_name); 890100979Srwatson 891100979Srwatson return (0); 892100979Srwatson} 893100979Srwatson 894100979Srwatsonstatic int 895100979Srwatsonmac_policy_unregister(struct mac_policy_conf *mpc) 896100979Srwatson{ 897100979Srwatson 898100979Srwatson#if 0 899100979Srwatson /* 900100979Srwatson * Don't allow unloading modules with private data. 901100979Srwatson */ 902100979Srwatson if (mpc->mpc_field_off != NULL) 903100979Srwatson return (EBUSY); 904100979Srwatson#endif 905100979Srwatson if ((mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_UNLOADOK) == 0) 906100979Srwatson return (EBUSY); 907100979Srwatson MAC_POLICY_LIST_LOCK(); 908100979Srwatson if (mac_policy_list_busy > 0) { 909100979Srwatson MAC_POLICY_LIST_UNLOCK(); 910100979Srwatson return (EBUSY); 911100979Srwatson } 912100979Srwatson if (mpc->mpc_ops->mpo_destroy != NULL) 913100979Srwatson (*(mpc->mpc_ops->mpo_destroy))(mpc); 914100979Srwatson 915100979Srwatson LIST_REMOVE(mpc, mpc_list); 916100979Srwatson MAC_POLICY_LIST_UNLOCK(); 917100979Srwatson 918100979Srwatson FREE(mpc->mpc_ops, M_MACOPVEC); 919100979Srwatson mpc->mpc_ops = NULL; 920100979Srwatson 921100979Srwatson printf("Security policy unload: %s (%s)\n", mpc->mpc_fullname, 922100979Srwatson mpc->mpc_name); 923100979Srwatson 924100979Srwatson return (0); 925100979Srwatson} 926100979Srwatson 927100979Srwatson/* 928100979Srwatson * Define an error value precedence, and given two arguments, selects the 929100979Srwatson * value with the higher precedence. 930100979Srwatson */ 931100979Srwatsonstatic int 932100979Srwatsonerror_select(int error1, int error2) 933100979Srwatson{ 934100979Srwatson 935100979Srwatson /* Certain decision-making errors take top priority. */ 936100979Srwatson if (error1 == EDEADLK || error2 == EDEADLK) 937100979Srwatson return (EDEADLK); 938100979Srwatson 939100979Srwatson /* Invalid arguments should be reported where possible. */ 940100979Srwatson if (error1 == EINVAL || error2 == EINVAL) 941100979Srwatson return (EINVAL); 942100979Srwatson 943100979Srwatson /* Precedence goes to "visibility", with both process and file. */ 944100979Srwatson if (error1 == ESRCH || error2 == ESRCH) 945100979Srwatson return (ESRCH); 946100979Srwatson 947100979Srwatson if (error1 == ENOENT || error2 == ENOENT) 948100979Srwatson return (ENOENT); 949100979Srwatson 950100979Srwatson /* Precedence goes to DAC/MAC protections. */ 951100979Srwatson if (error1 == EACCES || error2 == EACCES) 952100979Srwatson return (EACCES); 953100979Srwatson 954100979Srwatson /* Precedence goes to privilege. */ 955100979Srwatson if (error1 == EPERM || error2 == EPERM) 956100979Srwatson return (EPERM); 957100979Srwatson 958100979Srwatson /* Precedence goes to error over success; otherwise, arbitrary. */ 959100979Srwatson if (error1 != 0) 960100979Srwatson return (error1); 961100979Srwatson return (error2); 962100979Srwatson} 963100979Srwatson 964100979Srwatsonvoid 965100979Srwatsonmac_update_devfsdirent(struct devfs_dirent *de, struct vnode *vp) 966100979Srwatson{ 967100979Srwatson 968100979Srwatson MAC_PERFORM(update_devfsdirent, de, &de->de_label, vp, &vp->v_label); 969100979Srwatson} 970100979Srwatson 971100979Srwatsonvoid 972100979Srwatsonmac_update_procfsvnode(struct vnode *vp, struct ucred *cred) 973100979Srwatson{ 974100979Srwatson 975100979Srwatson MAC_PERFORM(update_procfsvnode, vp, &vp->v_label, cred); 976100979Srwatson} 977100979Srwatson 978100979Srwatson/* 979100979Srwatson * Support callout for policies that manage their own externalization 980100979Srwatson * using extended attributes. 981100979Srwatson */ 982100979Srwatsonstatic int 983100979Srwatsonmac_update_vnode_from_extattr(struct vnode *vp, struct mount *mp) 984100979Srwatson{ 985100979Srwatson int error; 986100979Srwatson 987100979Srwatson MAC_CHECK(update_vnode_from_extattr, vp, &vp->v_label, mp, 988100979Srwatson &mp->mnt_fslabel); 989100979Srwatson 990100979Srwatson return (error); 991100979Srwatson} 992100979Srwatson 993100979Srwatson/* 994100979Srwatson * Given an externalized mac label, internalize it and stamp it on a 995100979Srwatson * vnode. 996100979Srwatson */ 997100979Srwatsonstatic int 998100979Srwatsonmac_update_vnode_from_externalized(struct vnode *vp, struct mac *extmac) 999100979Srwatson{ 1000100979Srwatson int error; 1001100979Srwatson 1002100979Srwatson MAC_CHECK(update_vnode_from_externalized, vp, &vp->v_label, extmac); 1003100979Srwatson 1004100979Srwatson return (error); 1005100979Srwatson} 1006100979Srwatson 1007100979Srwatson/* 1008100979Srwatson * Call out to individual policies to update the label in a vnode from 1009100979Srwatson * the mountpoint. 1010100979Srwatson */ 1011100979Srwatsonvoid 1012100979Srwatsonmac_update_vnode_from_mount(struct vnode *vp, struct mount *mp) 1013100979Srwatson{ 1014100979Srwatson 1015100979Srwatson MAC_PERFORM(update_vnode_from_mount, vp, &vp->v_label, mp, 1016100979Srwatson &mp->mnt_fslabel); 1017100979Srwatson 1018101308Sjeff ASSERT_VOP_LOCKED(vp, "mac_update_vnode_from_mount"); 1019100979Srwatson if (mac_cache_fslabel_in_vnode) 1020101308Sjeff vp->v_vflag |= VV_CACHEDLABEL; 1021100979Srwatson} 1022100979Srwatson 1023100979Srwatson/* 1024100979Srwatson * Implementation of VOP_REFRESHLABEL() that relies on extended attributes 1025100979Srwatson * to store label data. Can be referenced by filesystems supporting 1026100979Srwatson * extended attributes. 1027100979Srwatson */ 1028100979Srwatsonint 1029100979Srwatsonvop_stdrefreshlabel_ea(struct vop_refreshlabel_args *ap) 1030100979Srwatson{ 1031100979Srwatson struct vnode *vp = ap->a_vp; 1032100979Srwatson struct mac extmac; 1033100979Srwatson int buflen, error; 1034100979Srwatson 1035100979Srwatson ASSERT_VOP_LOCKED(vp, "vop_stdrefreshlabel_ea"); 1036100979Srwatson 1037100979Srwatson /* 1038100979Srwatson * Call out to external policies first. Order doesn't really 1039100979Srwatson * matter, as long as failure of one assures failure of all. 1040100979Srwatson */ 1041100979Srwatson error = mac_update_vnode_from_extattr(vp, vp->v_mount); 1042100979Srwatson if (error) 1043100979Srwatson return (error); 1044100979Srwatson 1045100979Srwatson buflen = sizeof(extmac); 1046100979Srwatson error = vn_extattr_get(vp, IO_NODELOCKED, 1047100979Srwatson FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME, &buflen, 1048100979Srwatson (char *)&extmac, curthread); 1049100979Srwatson switch (error) { 1050100979Srwatson case 0: 1051100979Srwatson /* Got it */ 1052100979Srwatson break; 1053100979Srwatson 1054100979Srwatson case ENOATTR: 1055100979Srwatson /* 1056100979Srwatson * Use the label from the mount point. 1057100979Srwatson */ 1058100979Srwatson mac_update_vnode_from_mount(vp, vp->v_mount); 1059100979Srwatson return (0); 1060100979Srwatson 1061100979Srwatson case EOPNOTSUPP: 1062100979Srwatson default: 1063100979Srwatson /* Fail horribly. */ 1064100979Srwatson return (error); 1065100979Srwatson } 1066100979Srwatson 1067100979Srwatson if (buflen != sizeof(extmac)) 1068100979Srwatson error = EPERM; /* Fail very closed. */ 1069100979Srwatson if (error == 0) 1070100979Srwatson error = mac_update_vnode_from_externalized(vp, &extmac); 1071100979Srwatson if (error == 0) 1072101308Sjeff vp->v_vflag |= VV_CACHEDLABEL; 1073100979Srwatson else { 1074100979Srwatson struct vattr va; 1075100979Srwatson 1076100979Srwatson printf("Corrupted label on %s", 1077100979Srwatson vp->v_mount->mnt_stat.f_mntonname); 1078100979Srwatson if (VOP_GETATTR(vp, &va, curthread->td_ucred, curthread) == 0) 1079100979Srwatson printf(" inum %ld", va.va_fileid); 1080100979Srwatson if (mac_debug_label_fallback) { 1081100979Srwatson printf(", falling back.\n"); 1082100979Srwatson mac_update_vnode_from_mount(vp, vp->v_mount); 1083100979Srwatson error = 0; 1084100979Srwatson } else { 1085100979Srwatson printf(".\n"); 1086100979Srwatson error = EPERM; 1087100979Srwatson } 1088100979Srwatson } 1089100979Srwatson 1090100979Srwatson return (error); 1091100979Srwatson} 1092100979Srwatson 1093100979Srwatson/* 1094100979Srwatson * Make sure the vnode label is up-to-date. If EOPNOTSUPP, then we handle 1095100979Srwatson * the labeling activity outselves. Filesystems should be careful not 1096100979Srwatson * to change their minds regarding whether they support vop_refreshlabel() 1097100979Srwatson * for a vnode or not. Don't cache the vnode here, allow the file 1098100979Srwatson * system code to determine if it's safe to cache. If we update from 1099100979Srwatson * the mount, don't cache since a change to the mount label should affect 1100100979Srwatson * all vnodes. 1101100979Srwatson */ 1102100979Srwatsonstatic int 1103100979Srwatsonvn_refreshlabel(struct vnode *vp, struct ucred *cred) 1104100979Srwatson{ 1105100979Srwatson int error; 1106100979Srwatson 1107100979Srwatson ASSERT_VOP_LOCKED(vp, "vn_refreshlabel"); 1108100979Srwatson 1109100979Srwatson if (vp->v_mount == NULL) { 1110100979Srwatson/* 1111100979Srwatson Eventually, we probably want to special-case refreshing 1112100979Srwatson of deadfs vnodes, and if there's a lock-free race somewhere, 1113100979Srwatson that case might be handled here. 1114100979Srwatson 1115100979Srwatson mac_update_vnode_deadfs(vp); 1116100979Srwatson return (0); 1117100979Srwatson */ 1118100979Srwatson /* printf("vn_refreshlabel: null v_mount\n"); */ 1119100979Srwatson if (vp->v_tag != VT_NON) 1120100979Srwatson printf( 1121100979Srwatson "vn_refreshlabel: null v_mount with non-VT_NON\n"); 1122100979Srwatson return (EBADF); 1123100979Srwatson } 1124100979Srwatson 1125101308Sjeff if (vp->v_vflag & VV_CACHEDLABEL) { 1126100979Srwatson mac_vnode_label_cache_hits++; 1127100979Srwatson return (0); 1128100979Srwatson } else 1129100979Srwatson mac_vnode_label_cache_misses++; 1130100979Srwatson 1131100979Srwatson if ((vp->v_mount->mnt_flag & MNT_MULTILABEL) == 0) { 1132100979Srwatson mac_update_vnode_from_mount(vp, vp->v_mount); 1133100979Srwatson return (0); 1134100979Srwatson } 1135100979Srwatson 1136100979Srwatson error = VOP_REFRESHLABEL(vp, cred, curthread); 1137100979Srwatson switch (error) { 1138100979Srwatson case EOPNOTSUPP: 1139100979Srwatson /* 1140100979Srwatson * If labels are not supported on this vnode, fall back to 1141100979Srwatson * the label in the mount and propagate it to the vnode. 1142100979Srwatson * There should probably be some sort of policy/flag/decision 1143100979Srwatson * about doing this. 1144100979Srwatson */ 1145100979Srwatson mac_update_vnode_from_mount(vp, vp->v_mount); 1146100979Srwatson error = 0; 1147100979Srwatson default: 1148100979Srwatson return (error); 1149100979Srwatson } 1150100979Srwatson} 1151100979Srwatson 1152100979Srwatson/* 1153100979Srwatson * Helper function for file systems using the vop_std*_ea() calls. This 1154100979Srwatson * function must be called after EA service is available for the vnode, 1155100979Srwatson * but before it's hooked up to the namespace so that the node persists 1156100979Srwatson * if there's a crash, or before it can be accessed. On successful 1157100979Srwatson * commit of the label to disk (etc), do cache the label. 1158100979Srwatson */ 1159100979Srwatsonint 1160100979Srwatsonvop_stdcreatevnode_ea(struct vnode *dvp, struct vnode *tvp, struct ucred *cred) 1161100979Srwatson{ 1162100979Srwatson struct mac extmac; 1163100979Srwatson int error; 1164100979Srwatson 1165101308Sjeff ASSERT_VOP_LOCKED(tvp, "vop_stdcreatevnode_ea"); 1166100979Srwatson if ((dvp->v_mount->mnt_flag & MNT_MULTILABEL) == 0) { 1167100979Srwatson mac_update_vnode_from_mount(tvp, tvp->v_mount); 1168100979Srwatson } else { 1169100979Srwatson error = vn_refreshlabel(dvp, cred); 1170100979Srwatson if (error) 1171100979Srwatson return (error); 1172100979Srwatson 1173100979Srwatson /* 1174100979Srwatson * Stick the label in the vnode. Then try to write to 1175100979Srwatson * disk. If we fail, return a failure to abort the 1176100979Srwatson * create operation. Really, this failure shouldn't 1177100979Srwatson * happen except in fairly unusual circumstances (out 1178100979Srwatson * of disk, etc). 1179100979Srwatson */ 1180100979Srwatson mac_create_vnode(cred, dvp, tvp); 1181100979Srwatson 1182100979Srwatson error = mac_stdcreatevnode_ea(tvp); 1183100979Srwatson if (error) 1184100979Srwatson return (error); 1185100979Srwatson 1186100979Srwatson /* 1187100979Srwatson * XXX: Eventually this will go away and all policies will 1188100979Srwatson * directly manage their extended attributes. 1189100979Srwatson */ 1190100979Srwatson error = mac_externalize(&tvp->v_label, &extmac); 1191100979Srwatson if (error) 1192100979Srwatson return (error); 1193100979Srwatson 1194100979Srwatson error = vn_extattr_set(tvp, IO_NODELOCKED, 1195100979Srwatson FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME, 1196100979Srwatson sizeof(extmac), (char *)&extmac, curthread); 1197100979Srwatson if (error == 0) 1198101308Sjeff tvp->v_vflag |= VV_CACHEDLABEL; 1199100979Srwatson else { 1200100979Srwatson#if 0 1201100979Srwatson /* 1202100979Srwatson * In theory, we could have fall-back behavior here. 1203100979Srwatson * It would probably be incorrect. 1204100979Srwatson */ 1205100979Srwatson#endif 1206100979Srwatson return (error); 1207100979Srwatson } 1208100979Srwatson } 1209100979Srwatson 1210100979Srwatson return (0); 1211100979Srwatson} 1212100979Srwatson 1213100979Srwatsonvoid 1214100979Srwatsonmac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp) 1215100979Srwatson{ 1216100979Srwatson int error; 1217100979Srwatson 1218100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_execve_transition"); 1219100979Srwatson 1220100979Srwatson error = vn_refreshlabel(vp, old); 1221100979Srwatson if (error) { 1222100979Srwatson printf("mac_execve_transition: vn_refreshlabel returned %d\n", 1223100979Srwatson error); 1224100979Srwatson printf("mac_execve_transition: using old vnode label\n"); 1225100979Srwatson } 1226100979Srwatson 1227100979Srwatson MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label); 1228100979Srwatson} 1229100979Srwatson 1230100979Srwatsonint 1231100979Srwatsonmac_execve_will_transition(struct ucred *old, struct vnode *vp) 1232100979Srwatson{ 1233100979Srwatson int error, result; 1234100979Srwatson 1235100979Srwatson error = vn_refreshlabel(vp, old); 1236100979Srwatson if (error) 1237100979Srwatson return (error); 1238100979Srwatson 1239100979Srwatson result = 0; 1240100979Srwatson MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label); 1241100979Srwatson 1242100979Srwatson return (result); 1243100979Srwatson} 1244100979Srwatson 1245100979Srwatsonstatic void 1246100979Srwatsonmac_init_label(struct label *label) 1247100979Srwatson{ 1248100979Srwatson 1249100979Srwatson bzero(label, sizeof(*label)); 1250100979Srwatson label->l_flags = MAC_FLAG_INITIALIZED; 1251100979Srwatson} 1252100979Srwatson 1253100979Srwatsonstatic void 1254100979Srwatsonmac_init_structmac(struct mac *mac) 1255100979Srwatson{ 1256100979Srwatson 1257100979Srwatson bzero(mac, sizeof(*mac)); 1258100979Srwatson mac->m_macflags = MAC_FLAG_INITIALIZED; 1259100979Srwatson} 1260100979Srwatson 1261100979Srwatsonstatic void 1262100979Srwatsonmac_destroy_label(struct label *label) 1263100979Srwatson{ 1264100979Srwatson 1265100979Srwatson KASSERT(label->l_flags & MAC_FLAG_INITIALIZED, 1266100979Srwatson ("destroying uninitialized label")); 1267100979Srwatson 1268100979Srwatson bzero(label, sizeof(*label)); 1269100979Srwatson /* implicit: label->l_flags &= ~MAC_FLAG_INITIALIZED; */ 1270100979Srwatson} 1271100979Srwatson 1272100979Srwatsonint 1273100979Srwatsonmac_init_mbuf(struct mbuf *m, int how) 1274100979Srwatson{ 1275100979Srwatson KASSERT(m->m_flags & M_PKTHDR, ("mac_init_mbuf on non-header mbuf")); 1276100979Srwatson 1277100979Srwatson /* "how" is one of M_(TRY|DONT)WAIT */ 1278100979Srwatson mac_init_label(&m->m_pkthdr.label); 1279100979Srwatson MAC_PERFORM(init_mbuf, m, how, &m->m_pkthdr.label); 1280101988Srwatson#ifdef MAC_DEBUG 1281100979Srwatson atomic_add_int(&nmacmbufs, 1); 1282101988Srwatson#endif 1283100979Srwatson return (0); 1284100979Srwatson} 1285100979Srwatson 1286100979Srwatsonvoid 1287100979Srwatsonmac_destroy_mbuf(struct mbuf *m) 1288100979Srwatson{ 1289100979Srwatson 1290100979Srwatson MAC_PERFORM(destroy_mbuf, m, &m->m_pkthdr.label); 1291100979Srwatson mac_destroy_label(&m->m_pkthdr.label); 1292101988Srwatson#ifdef MAC_DEBUG 1293100979Srwatson atomic_subtract_int(&nmacmbufs, 1); 1294101988Srwatson#endif 1295100979Srwatson} 1296100979Srwatson 1297100979Srwatsonvoid 1298100979Srwatsonmac_init_cred(struct ucred *cr) 1299100979Srwatson{ 1300100979Srwatson 1301100979Srwatson mac_init_label(&cr->cr_label); 1302100979Srwatson MAC_PERFORM(init_cred, cr, &cr->cr_label); 1303101988Srwatson#ifdef MAC_DEBUG 1304100979Srwatson atomic_add_int(&nmaccreds, 1); 1305101988Srwatson#endif 1306100979Srwatson} 1307100979Srwatson 1308100979Srwatsonvoid 1309100979Srwatsonmac_destroy_cred(struct ucred *cr) 1310100979Srwatson{ 1311100979Srwatson 1312100979Srwatson MAC_PERFORM(destroy_cred, cr, &cr->cr_label); 1313100979Srwatson mac_destroy_label(&cr->cr_label); 1314101988Srwatson#ifdef MAC_DEBUG 1315100979Srwatson atomic_subtract_int(&nmaccreds, 1); 1316101988Srwatson#endif 1317100979Srwatson} 1318100979Srwatson 1319100979Srwatsonvoid 1320100979Srwatsonmac_init_ifnet(struct ifnet *ifp) 1321100979Srwatson{ 1322100979Srwatson 1323100979Srwatson mac_init_label(&ifp->if_label); 1324100979Srwatson MAC_PERFORM(init_ifnet, ifp, &ifp->if_label); 1325101988Srwatson#ifdef MAC_DEBUG 1326100979Srwatson atomic_add_int(&nmacifnets, 1); 1327101988Srwatson#endif 1328100979Srwatson} 1329100979Srwatson 1330100979Srwatsonvoid 1331100979Srwatsonmac_destroy_ifnet(struct ifnet *ifp) 1332100979Srwatson{ 1333100979Srwatson 1334100979Srwatson MAC_PERFORM(destroy_ifnet, ifp, &ifp->if_label); 1335100979Srwatson mac_destroy_label(&ifp->if_label); 1336101988Srwatson#ifdef MAC_DEBUG 1337100979Srwatson atomic_subtract_int(&nmacifnets, 1); 1338101988Srwatson#endif 1339100979Srwatson} 1340100979Srwatson 1341100979Srwatsonvoid 1342100979Srwatsonmac_init_ipq(struct ipq *ipq) 1343100979Srwatson{ 1344100979Srwatson 1345100979Srwatson mac_init_label(&ipq->ipq_label); 1346100979Srwatson MAC_PERFORM(init_ipq, ipq, &ipq->ipq_label); 1347101988Srwatson#ifdef MAC_DEBUG 1348100979Srwatson atomic_add_int(&nmacipqs, 1); 1349101988Srwatson#endif 1350100979Srwatson} 1351100979Srwatson 1352100979Srwatsonvoid 1353100979Srwatsonmac_destroy_ipq(struct ipq *ipq) 1354100979Srwatson{ 1355100979Srwatson 1356100979Srwatson MAC_PERFORM(destroy_ipq, ipq, &ipq->ipq_label); 1357100979Srwatson mac_destroy_label(&ipq->ipq_label); 1358101988Srwatson#ifdef MAC_DEBUG 1359100979Srwatson atomic_subtract_int(&nmacipqs, 1); 1360101988Srwatson#endif 1361100979Srwatson} 1362100979Srwatson 1363100979Srwatsonvoid 1364100979Srwatsonmac_init_socket(struct socket *socket) 1365100979Srwatson{ 1366100979Srwatson 1367100979Srwatson mac_init_label(&socket->so_label); 1368100979Srwatson mac_init_label(&socket->so_peerlabel); 1369100979Srwatson MAC_PERFORM(init_socket, socket, &socket->so_label, 1370100979Srwatson &socket->so_peerlabel); 1371101988Srwatson#ifdef MAC_DEBUG 1372100979Srwatson atomic_add_int(&nmacsockets, 1); 1373101988Srwatson#endif 1374100979Srwatson} 1375100979Srwatson 1376100979Srwatsonvoid 1377100979Srwatsonmac_destroy_socket(struct socket *socket) 1378100979Srwatson{ 1379100979Srwatson 1380100979Srwatson MAC_PERFORM(destroy_socket, socket, &socket->so_label, 1381100979Srwatson &socket->so_peerlabel); 1382100979Srwatson mac_destroy_label(&socket->so_label); 1383100979Srwatson mac_destroy_label(&socket->so_peerlabel); 1384101988Srwatson#ifdef MAC_DEBUG 1385100979Srwatson atomic_subtract_int(&nmacsockets, 1); 1386101988Srwatson#endif 1387100979Srwatson} 1388100979Srwatson 1389100979Srwatsonvoid 1390100979Srwatsonmac_init_pipe(struct pipe *pipe) 1391100979Srwatson{ 1392100979Srwatson struct label *label; 1393100979Srwatson 1394100979Srwatson label = malloc(sizeof(struct label), M_MACPIPELABEL, M_ZERO|M_WAITOK); 1395100979Srwatson mac_init_label(label); 1396100979Srwatson pipe->pipe_label = label; 1397100979Srwatson pipe->pipe_peer->pipe_label = label; 1398100979Srwatson MAC_PERFORM(init_pipe, pipe, pipe->pipe_label); 1399101988Srwatson#ifdef MAC_DEBUG 1400100979Srwatson atomic_add_int(&nmacpipes, 1); 1401101988Srwatson#endif 1402100979Srwatson} 1403100979Srwatson 1404100979Srwatsonvoid 1405100979Srwatsonmac_destroy_pipe(struct pipe *pipe) 1406100979Srwatson{ 1407100979Srwatson 1408100979Srwatson MAC_PERFORM(destroy_pipe, pipe, pipe->pipe_label); 1409100979Srwatson mac_destroy_label(pipe->pipe_label); 1410100979Srwatson free(pipe->pipe_label, M_MACPIPELABEL); 1411101988Srwatson#ifdef MAC_DEBUG 1412100979Srwatson atomic_subtract_int(&nmacpipes, 1); 1413101988Srwatson#endif 1414100979Srwatson} 1415100979Srwatson 1416100979Srwatsonvoid 1417100979Srwatsonmac_init_bpfdesc(struct bpf_d *bpf_d) 1418100979Srwatson{ 1419100979Srwatson 1420100979Srwatson mac_init_label(&bpf_d->bd_label); 1421100979Srwatson MAC_PERFORM(init_bpfdesc, bpf_d, &bpf_d->bd_label); 1422101988Srwatson#ifdef MAC_DEBUG 1423100979Srwatson atomic_add_int(&nmacbpfdescs, 1); 1424101988Srwatson#endif 1425100979Srwatson} 1426100979Srwatson 1427100979Srwatsonvoid 1428100979Srwatsonmac_destroy_bpfdesc(struct bpf_d *bpf_d) 1429100979Srwatson{ 1430100979Srwatson 1431100979Srwatson MAC_PERFORM(destroy_bpfdesc, bpf_d, &bpf_d->bd_label); 1432100979Srwatson mac_destroy_label(&bpf_d->bd_label); 1433101988Srwatson#ifdef MAC_DEBUG 1434100979Srwatson atomic_subtract_int(&nmacbpfdescs, 1); 1435101988Srwatson#endif 1436100979Srwatson} 1437100979Srwatson 1438100979Srwatsonvoid 1439100979Srwatsonmac_init_mount(struct mount *mp) 1440100979Srwatson{ 1441100979Srwatson 1442100979Srwatson mac_init_label(&mp->mnt_mntlabel); 1443100979Srwatson mac_init_label(&mp->mnt_fslabel); 1444100979Srwatson MAC_PERFORM(init_mount, mp, &mp->mnt_mntlabel, &mp->mnt_fslabel); 1445101988Srwatson#ifdef MAC_DEBUG 1446100979Srwatson atomic_add_int(&nmacmounts, 1); 1447101988Srwatson#endif 1448100979Srwatson} 1449100979Srwatson 1450100979Srwatsonvoid 1451100979Srwatsonmac_destroy_mount(struct mount *mp) 1452100979Srwatson{ 1453100979Srwatson 1454100979Srwatson MAC_PERFORM(destroy_mount, mp, &mp->mnt_mntlabel, &mp->mnt_fslabel); 1455100979Srwatson mac_destroy_label(&mp->mnt_fslabel); 1456100979Srwatson mac_destroy_label(&mp->mnt_mntlabel); 1457101988Srwatson#ifdef MAC_DEBUG 1458100979Srwatson atomic_subtract_int(&nmacmounts, 1); 1459101988Srwatson#endif 1460100979Srwatson} 1461100979Srwatson 1462100979Srwatsonstatic void 1463100979Srwatsonmac_init_temp(struct label *label) 1464100979Srwatson{ 1465100979Srwatson 1466100979Srwatson mac_init_label(label); 1467100979Srwatson MAC_PERFORM(init_temp, label); 1468101988Srwatson#ifdef MAC_DEBUG 1469100979Srwatson atomic_add_int(&nmactemp, 1); 1470101988Srwatson#endif 1471100979Srwatson} 1472100979Srwatson 1473100979Srwatsonstatic void 1474100979Srwatsonmac_destroy_temp(struct label *label) 1475100979Srwatson{ 1476100979Srwatson 1477100979Srwatson MAC_PERFORM(destroy_temp, label); 1478100979Srwatson mac_destroy_label(label); 1479101988Srwatson#ifdef MAC_DEBUG 1480100979Srwatson atomic_subtract_int(&nmactemp, 1); 1481101988Srwatson#endif 1482100979Srwatson} 1483100979Srwatson 1484100979Srwatsonvoid 1485100979Srwatsonmac_init_vnode(struct vnode *vp) 1486100979Srwatson{ 1487100979Srwatson 1488100979Srwatson mac_init_label(&vp->v_label); 1489100979Srwatson MAC_PERFORM(init_vnode, vp, &vp->v_label); 1490101988Srwatson#ifdef MAC_DEBUG 1491100979Srwatson atomic_add_int(&nmacvnodes, 1); 1492101988Srwatson#endif 1493100979Srwatson} 1494100979Srwatson 1495100979Srwatsonvoid 1496100979Srwatsonmac_destroy_vnode(struct vnode *vp) 1497100979Srwatson{ 1498100979Srwatson 1499100979Srwatson MAC_PERFORM(destroy_vnode, vp, &vp->v_label); 1500100979Srwatson mac_destroy_label(&vp->v_label); 1501101988Srwatson#ifdef MAC_DEBUG 1502100979Srwatson atomic_subtract_int(&nmacvnodes, 1); 1503101988Srwatson#endif 1504100979Srwatson} 1505100979Srwatson 1506100979Srwatsonvoid 1507100979Srwatsonmac_init_devfsdirent(struct devfs_dirent *de) 1508100979Srwatson{ 1509100979Srwatson 1510100979Srwatson mac_init_label(&de->de_label); 1511100979Srwatson MAC_PERFORM(init_devfsdirent, de, &de->de_label); 1512101988Srwatson#ifdef MAC_DEBUG 1513100979Srwatson atomic_add_int(&nmacdevfsdirents, 1); 1514101988Srwatson#endif 1515100979Srwatson} 1516100979Srwatson 1517100979Srwatsonvoid 1518100979Srwatsonmac_destroy_devfsdirent(struct devfs_dirent *de) 1519100979Srwatson{ 1520100979Srwatson 1521100979Srwatson MAC_PERFORM(destroy_devfsdirent, de, &de->de_label); 1522100979Srwatson mac_destroy_label(&de->de_label); 1523101988Srwatson#ifdef MAC_DEBUG 1524100979Srwatson atomic_subtract_int(&nmacdevfsdirents, 1); 1525101988Srwatson#endif 1526100979Srwatson} 1527100979Srwatson 1528100979Srwatsonstatic int 1529100979Srwatsonmac_externalize(struct label *label, struct mac *mac) 1530100979Srwatson{ 1531100979Srwatson int error; 1532100979Srwatson 1533100979Srwatson mac_init_structmac(mac); 1534100979Srwatson MAC_CHECK(externalize, label, mac); 1535100979Srwatson 1536100979Srwatson return (error); 1537100979Srwatson} 1538100979Srwatson 1539100979Srwatsonstatic int 1540100979Srwatsonmac_internalize(struct label *label, struct mac *mac) 1541100979Srwatson{ 1542100979Srwatson int error; 1543100979Srwatson 1544100979Srwatson mac_init_temp(label); 1545100979Srwatson MAC_CHECK(internalize, label, mac); 1546100979Srwatson if (error) 1547100979Srwatson mac_destroy_temp(label); 1548100979Srwatson 1549100979Srwatson return (error); 1550100979Srwatson} 1551100979Srwatson 1552100979Srwatson/* 1553100979Srwatson * Initialize MAC label for the first kernel process, from which other 1554100979Srwatson * kernel processes and threads are spawned. 1555100979Srwatson */ 1556100979Srwatsonvoid 1557100979Srwatsonmac_create_proc0(struct ucred *cred) 1558100979Srwatson{ 1559100979Srwatson 1560100979Srwatson MAC_PERFORM(create_proc0, cred); 1561100979Srwatson} 1562100979Srwatson 1563100979Srwatson/* 1564100979Srwatson * Initialize MAC label for the first userland process, from which other 1565100979Srwatson * userland processes and threads are spawned. 1566100979Srwatson */ 1567100979Srwatsonvoid 1568100979Srwatsonmac_create_proc1(struct ucred *cred) 1569100979Srwatson{ 1570100979Srwatson 1571100979Srwatson MAC_PERFORM(create_proc1, cred); 1572100979Srwatson} 1573100979Srwatson 1574100979Srwatson/* 1575100979Srwatson * When a new process is created, its label must be initialized. Generally, 1576100979Srwatson * this involves inheritence from the parent process, modulo possible 1577100979Srwatson * deltas. This function allows that processing to take place. 1578100979Srwatson */ 1579100979Srwatsonvoid 1580100979Srwatsonmac_create_cred(struct ucred *parent_cred, struct ucred *child_cred) 1581100979Srwatson{ 1582100979Srwatson 1583100979Srwatson MAC_PERFORM(create_cred, parent_cred, child_cred); 1584100979Srwatson} 1585100979Srwatson 1586100979Srwatsonint 1587100979Srwatsonmac_check_vnode_access(struct ucred *cred, struct vnode *vp, int flags) 1588100979Srwatson{ 1589100979Srwatson int error; 1590100979Srwatson 1591100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_access"); 1592100979Srwatson 1593100979Srwatson if (!mac_enforce_fs) 1594100979Srwatson return (0); 1595100979Srwatson 1596100979Srwatson error = vn_refreshlabel(vp, cred); 1597100979Srwatson if (error) 1598100979Srwatson return (error); 1599100979Srwatson 1600100979Srwatson MAC_CHECK(check_vnode_access, cred, vp, &vp->v_label, flags); 1601100979Srwatson return (error); 1602100979Srwatson} 1603100979Srwatson 1604100979Srwatsonint 1605100979Srwatsonmac_check_vnode_chdir(struct ucred *cred, struct vnode *dvp) 1606100979Srwatson{ 1607100979Srwatson int error; 1608100979Srwatson 1609100979Srwatson ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_chdir"); 1610100979Srwatson 1611100979Srwatson if (!mac_enforce_fs) 1612100979Srwatson return (0); 1613100979Srwatson 1614100979Srwatson error = vn_refreshlabel(dvp, cred); 1615100979Srwatson if (error) 1616100979Srwatson return (error); 1617100979Srwatson 1618100979Srwatson MAC_CHECK(check_vnode_chdir, cred, dvp, &dvp->v_label); 1619100979Srwatson return (error); 1620100979Srwatson} 1621100979Srwatson 1622100979Srwatsonint 1623100979Srwatsonmac_check_vnode_chroot(struct ucred *cred, struct vnode *dvp) 1624100979Srwatson{ 1625100979Srwatson int error; 1626100979Srwatson 1627100979Srwatson ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_chroot"); 1628100979Srwatson 1629100979Srwatson if (!mac_enforce_fs) 1630100979Srwatson return (0); 1631100979Srwatson 1632100979Srwatson error = vn_refreshlabel(dvp, cred); 1633100979Srwatson if (error) 1634100979Srwatson return (error); 1635100979Srwatson 1636100979Srwatson MAC_CHECK(check_vnode_chroot, cred, dvp, &dvp->v_label); 1637100979Srwatson return (error); 1638100979Srwatson} 1639100979Srwatson 1640100979Srwatsonint 1641100979Srwatsonmac_check_vnode_create(struct ucred *cred, struct vnode *dvp, 1642100979Srwatson struct componentname *cnp, struct vattr *vap) 1643100979Srwatson{ 1644100979Srwatson int error; 1645100979Srwatson 1646100979Srwatson ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_create"); 1647100979Srwatson 1648100979Srwatson if (!mac_enforce_fs) 1649100979Srwatson return (0); 1650100979Srwatson 1651100979Srwatson error = vn_refreshlabel(dvp, cred); 1652100979Srwatson if (error) 1653100979Srwatson return (error); 1654100979Srwatson 1655100979Srwatson MAC_CHECK(check_vnode_create, cred, dvp, &dvp->v_label, cnp, vap); 1656100979Srwatson return (error); 1657100979Srwatson} 1658100979Srwatson 1659100979Srwatsonint 1660100979Srwatsonmac_check_vnode_delete(struct ucred *cred, struct vnode *dvp, struct vnode *vp, 1661100979Srwatson struct componentname *cnp) 1662100979Srwatson{ 1663100979Srwatson int error; 1664100979Srwatson 1665100979Srwatson ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_delete"); 1666100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_delete"); 1667100979Srwatson 1668100979Srwatson if (!mac_enforce_fs) 1669100979Srwatson return (0); 1670100979Srwatson 1671100979Srwatson error = vn_refreshlabel(dvp, cred); 1672100979Srwatson if (error) 1673100979Srwatson return (error); 1674100979Srwatson error = vn_refreshlabel(vp, cred); 1675100979Srwatson if (error) 1676100979Srwatson return (error); 1677100979Srwatson 1678100979Srwatson MAC_CHECK(check_vnode_delete, cred, dvp, &dvp->v_label, vp, 1679100979Srwatson &vp->v_label, cnp); 1680100979Srwatson return (error); 1681100979Srwatson} 1682100979Srwatson 1683100979Srwatsonint 1684100979Srwatsonmac_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp, 1685100979Srwatson acl_type_t type) 1686100979Srwatson{ 1687100979Srwatson int error; 1688100979Srwatson 1689100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_deleteacl"); 1690100979Srwatson 1691100979Srwatson if (!mac_enforce_fs) 1692100979Srwatson return (0); 1693100979Srwatson 1694100979Srwatson error = vn_refreshlabel(vp, cred); 1695100979Srwatson if (error) 1696100979Srwatson return (error); 1697100979Srwatson 1698100979Srwatson MAC_CHECK(check_vnode_deleteacl, cred, vp, &vp->v_label, type); 1699100979Srwatson return (error); 1700100979Srwatson} 1701100979Srwatson 1702100979Srwatsonint 1703100979Srwatsonmac_check_vnode_exec(struct ucred *cred, struct vnode *vp) 1704100979Srwatson{ 1705100979Srwatson int error; 1706100979Srwatson 1707102102Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_exec"); 1708102102Srwatson 1709100979Srwatson if (!mac_enforce_process && !mac_enforce_fs) 1710100979Srwatson return (0); 1711100979Srwatson 1712100979Srwatson error = vn_refreshlabel(vp, cred); 1713100979Srwatson if (error) 1714100979Srwatson return (error); 1715100979Srwatson MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label); 1716100979Srwatson 1717100979Srwatson return (error); 1718100979Srwatson} 1719100979Srwatson 1720100979Srwatsonint 1721100979Srwatsonmac_check_vnode_getacl(struct ucred *cred, struct vnode *vp, acl_type_t type) 1722100979Srwatson{ 1723100979Srwatson int error; 1724100979Srwatson 1725100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_getacl"); 1726100979Srwatson 1727100979Srwatson if (!mac_enforce_fs) 1728100979Srwatson return (0); 1729100979Srwatson 1730100979Srwatson error = vn_refreshlabel(vp, cred); 1731100979Srwatson if (error) 1732100979Srwatson return (error); 1733100979Srwatson 1734100979Srwatson MAC_CHECK(check_vnode_getacl, cred, vp, &vp->v_label, type); 1735100979Srwatson return (error); 1736100979Srwatson} 1737100979Srwatson 1738100979Srwatsonint 1739100979Srwatsonmac_check_vnode_getextattr(struct ucred *cred, struct vnode *vp, 1740100979Srwatson int attrnamespace, const char *name, struct uio *uio) 1741100979Srwatson{ 1742100979Srwatson int error; 1743100979Srwatson 1744100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_getextattr"); 1745100979Srwatson 1746100979Srwatson if (!mac_enforce_fs) 1747100979Srwatson return (0); 1748100979Srwatson 1749100979Srwatson error = vn_refreshlabel(vp, cred); 1750100979Srwatson if (error) 1751100979Srwatson return (error); 1752100979Srwatson 1753100979Srwatson MAC_CHECK(check_vnode_getextattr, cred, vp, &vp->v_label, 1754100979Srwatson attrnamespace, name, uio); 1755100979Srwatson return (error); 1756100979Srwatson} 1757100979Srwatson 1758100979Srwatsonint 1759100979Srwatsonmac_check_vnode_lookup(struct ucred *cred, struct vnode *dvp, 1760100979Srwatson struct componentname *cnp) 1761100979Srwatson{ 1762100979Srwatson int error; 1763100979Srwatson 1764100979Srwatson ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_lookup"); 1765100979Srwatson 1766100979Srwatson if (!mac_enforce_fs) 1767100979Srwatson return (0); 1768100979Srwatson 1769100979Srwatson error = vn_refreshlabel(dvp, cred); 1770100979Srwatson if (error) 1771100979Srwatson return (error); 1772100979Srwatson 1773100979Srwatson MAC_CHECK(check_vnode_lookup, cred, dvp, &dvp->v_label, cnp); 1774100979Srwatson return (error); 1775100979Srwatson} 1776100979Srwatson 1777100979Srwatsonvm_prot_t 1778100979Srwatsonmac_check_vnode_mmap_prot(struct ucred *cred, struct vnode *vp, int newmapping) 1779100979Srwatson{ 1780100979Srwatson vm_prot_t result = VM_PROT_ALL; 1781100979Srwatson 1782100979Srwatson /* 1783100979Srwatson * This should be some sort of MAC_BITWISE, maybe :) 1784100979Srwatson */ 1785100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_mmap_perms"); 1786100979Srwatson MAC_BOOLEAN(check_vnode_mmap_perms, &, cred, vp, &vp->v_label, 1787100979Srwatson newmapping); 1788100979Srwatson return (result); 1789100979Srwatson} 1790100979Srwatson 1791100979Srwatsonint 1792102112Srwatsonmac_check_vnode_open(struct ucred *cred, struct vnode *vp, mode_t acc_mode) 1793100979Srwatson{ 1794100979Srwatson int error; 1795100979Srwatson 1796102112Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_open"); 1797102112Srwatson 1798100979Srwatson if (!mac_enforce_fs) 1799100979Srwatson return (0); 1800100979Srwatson 1801102112Srwatson error = vn_refreshlabel(vp, cred); 1802102112Srwatson if (error) 1803102112Srwatson return (error); 1804100979Srwatson 1805102112Srwatson MAC_CHECK(check_vnode_open, cred, vp, &vp->v_label, acc_mode); 1806102112Srwatson return (error); 1807102112Srwatson} 1808102112Srwatson 1809102112Srwatsonint 1810102129Srwatsonmac_check_vnode_poll(struct ucred *active_cred, struct ucred *file_cred, 1811102129Srwatson struct vnode *vp) 1812102112Srwatson{ 1813102112Srwatson int error; 1814102112Srwatson 1815102112Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_poll"); 1816102112Srwatson 1817102112Srwatson if (!mac_enforce_fs) 1818102112Srwatson return (0); 1819102112Srwatson 1820102129Srwatson error = vn_refreshlabel(vp, active_cred); 1821100979Srwatson if (error) 1822100979Srwatson return (error); 1823100979Srwatson 1824102129Srwatson MAC_CHECK(check_vnode_poll, active_cred, file_cred, vp, 1825102129Srwatson &vp->v_label); 1826100979Srwatson 1827100979Srwatson return (error); 1828100979Srwatson} 1829100979Srwatson 1830100979Srwatsonint 1831102129Srwatsonmac_check_vnode_read(struct ucred *active_cred, struct ucred *file_cred, 1832102129Srwatson struct vnode *vp) 1833100979Srwatson{ 1834100979Srwatson int error; 1835100979Srwatson 1836102112Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_read"); 1837100979Srwatson 1838100979Srwatson if (!mac_enforce_fs) 1839100979Srwatson return (0); 1840100979Srwatson 1841102129Srwatson error = vn_refreshlabel(vp, active_cred); 1842100979Srwatson if (error) 1843100979Srwatson return (error); 1844100979Srwatson 1845102129Srwatson MAC_CHECK(check_vnode_read, active_cred, file_cred, vp, 1846102129Srwatson &vp->v_label); 1847102112Srwatson 1848100979Srwatson return (error); 1849100979Srwatson} 1850100979Srwatson 1851100979Srwatsonint 1852100979Srwatsonmac_check_vnode_readdir(struct ucred *cred, struct vnode *dvp) 1853100979Srwatson{ 1854100979Srwatson int error; 1855100979Srwatson 1856100979Srwatson ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_readdir"); 1857100979Srwatson 1858100979Srwatson if (!mac_enforce_fs) 1859100979Srwatson return (0); 1860100979Srwatson 1861100979Srwatson error = vn_refreshlabel(dvp, cred); 1862100979Srwatson if (error) 1863100979Srwatson return (error); 1864100979Srwatson 1865100979Srwatson MAC_CHECK(check_vnode_readdir, cred, dvp, &dvp->v_label); 1866100979Srwatson return (error); 1867100979Srwatson} 1868100979Srwatson 1869100979Srwatsonint 1870100979Srwatsonmac_check_vnode_readlink(struct ucred *cred, struct vnode *vp) 1871100979Srwatson{ 1872100979Srwatson int error; 1873100979Srwatson 1874100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_readlink"); 1875100979Srwatson 1876100979Srwatson if (!mac_enforce_fs) 1877100979Srwatson return (0); 1878100979Srwatson 1879100979Srwatson error = vn_refreshlabel(vp, cred); 1880100979Srwatson if (error) 1881100979Srwatson return (error); 1882100979Srwatson 1883100979Srwatson MAC_CHECK(check_vnode_readlink, cred, vp, &vp->v_label); 1884100979Srwatson return (error); 1885100979Srwatson} 1886100979Srwatson 1887100979Srwatsonstatic int 1888100979Srwatsonmac_check_vnode_relabel(struct ucred *cred, struct vnode *vp, 1889100979Srwatson struct label *newlabel) 1890100979Srwatson{ 1891100979Srwatson int error; 1892100979Srwatson 1893100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_relabel"); 1894100979Srwatson 1895100979Srwatson error = vn_refreshlabel(vp, cred); 1896100979Srwatson if (error) 1897100979Srwatson return (error); 1898100979Srwatson 1899100979Srwatson MAC_CHECK(check_vnode_relabel, cred, vp, &vp->v_label, newlabel); 1900100979Srwatson 1901100979Srwatson return (error); 1902100979Srwatson} 1903100979Srwatson 1904100979Srwatsonint 1905100979Srwatsonmac_check_vnode_rename_from(struct ucred *cred, struct vnode *dvp, 1906100979Srwatson struct vnode *vp, struct componentname *cnp) 1907100979Srwatson{ 1908100979Srwatson int error; 1909100979Srwatson 1910100979Srwatson ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_rename_from"); 1911100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_rename_from"); 1912100979Srwatson 1913100979Srwatson if (!mac_enforce_fs) 1914100979Srwatson return (0); 1915100979Srwatson 1916100979Srwatson error = vn_refreshlabel(dvp, cred); 1917100979Srwatson if (error) 1918100979Srwatson return (error); 1919100979Srwatson error = vn_refreshlabel(vp, cred); 1920100979Srwatson if (error) 1921100979Srwatson return (error); 1922100979Srwatson 1923100979Srwatson MAC_CHECK(check_vnode_rename_from, cred, dvp, &dvp->v_label, vp, 1924100979Srwatson &vp->v_label, cnp); 1925100979Srwatson return (error); 1926100979Srwatson} 1927100979Srwatson 1928100979Srwatsonint 1929100979Srwatsonmac_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp, 1930100979Srwatson struct vnode *vp, int samedir, struct componentname *cnp) 1931100979Srwatson{ 1932100979Srwatson int error; 1933100979Srwatson 1934100979Srwatson ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_rename_to"); 1935100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_rename_to"); 1936100979Srwatson 1937100979Srwatson if (!mac_enforce_fs) 1938100979Srwatson return (0); 1939100979Srwatson 1940100979Srwatson error = vn_refreshlabel(dvp, cred); 1941100979Srwatson if (error) 1942100979Srwatson return (error); 1943100979Srwatson if (vp != NULL) { 1944100979Srwatson error = vn_refreshlabel(vp, cred); 1945100979Srwatson if (error) 1946100979Srwatson return (error); 1947100979Srwatson } 1948100979Srwatson MAC_CHECK(check_vnode_rename_to, cred, dvp, &dvp->v_label, vp, 1949100979Srwatson vp != NULL ? &vp->v_label : NULL, samedir, cnp); 1950100979Srwatson return (error); 1951100979Srwatson} 1952100979Srwatson 1953100979Srwatsonint 1954100979Srwatsonmac_check_vnode_revoke(struct ucred *cred, struct vnode *vp) 1955100979Srwatson{ 1956100979Srwatson int error; 1957100979Srwatson 1958100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_revoke"); 1959100979Srwatson 1960100979Srwatson if (!mac_enforce_fs) 1961100979Srwatson return (0); 1962100979Srwatson 1963100979Srwatson error = vn_refreshlabel(vp, cred); 1964100979Srwatson if (error) 1965100979Srwatson return (error); 1966100979Srwatson 1967100979Srwatson MAC_CHECK(check_vnode_revoke, cred, vp, &vp->v_label); 1968100979Srwatson return (error); 1969100979Srwatson} 1970100979Srwatson 1971100979Srwatsonint 1972100979Srwatsonmac_check_vnode_setacl(struct ucred *cred, struct vnode *vp, acl_type_t type, 1973100979Srwatson struct acl *acl) 1974100979Srwatson{ 1975100979Srwatson int error; 1976100979Srwatson 1977100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setacl"); 1978100979Srwatson 1979100979Srwatson if (!mac_enforce_fs) 1980100979Srwatson return (0); 1981100979Srwatson 1982100979Srwatson error = vn_refreshlabel(vp, cred); 1983100979Srwatson if (error) 1984100979Srwatson return (error); 1985100979Srwatson 1986100979Srwatson MAC_CHECK(check_vnode_setacl, cred, vp, &vp->v_label, type, acl); 1987100979Srwatson return (error); 1988100979Srwatson} 1989100979Srwatson 1990100979Srwatsonint 1991100979Srwatsonmac_check_vnode_setextattr(struct ucred *cred, struct vnode *vp, 1992100979Srwatson int attrnamespace, const char *name, struct uio *uio) 1993100979Srwatson{ 1994100979Srwatson int error; 1995100979Srwatson 1996100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setextattr"); 1997100979Srwatson 1998100979Srwatson if (!mac_enforce_fs) 1999100979Srwatson return (0); 2000100979Srwatson 2001100979Srwatson error = vn_refreshlabel(vp, cred); 2002100979Srwatson if (error) 2003100979Srwatson return (error); 2004100979Srwatson 2005100979Srwatson MAC_CHECK(check_vnode_setextattr, cred, vp, &vp->v_label, 2006100979Srwatson attrnamespace, name, uio); 2007100979Srwatson return (error); 2008100979Srwatson} 2009100979Srwatson 2010100979Srwatsonint 2011100979Srwatsonmac_check_vnode_setflags(struct ucred *cred, struct vnode *vp, u_long flags) 2012100979Srwatson{ 2013100979Srwatson int error; 2014100979Srwatson 2015100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setflags"); 2016100979Srwatson 2017100979Srwatson if (!mac_enforce_fs) 2018100979Srwatson return (0); 2019100979Srwatson 2020100979Srwatson error = vn_refreshlabel(vp, cred); 2021100979Srwatson if (error) 2022100979Srwatson return (error); 2023100979Srwatson 2024100979Srwatson MAC_CHECK(check_vnode_setflags, cred, vp, &vp->v_label, flags); 2025100979Srwatson return (error); 2026100979Srwatson} 2027100979Srwatson 2028100979Srwatsonint 2029100979Srwatsonmac_check_vnode_setmode(struct ucred *cred, struct vnode *vp, mode_t mode) 2030100979Srwatson{ 2031100979Srwatson int error; 2032100979Srwatson 2033100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setmode"); 2034100979Srwatson 2035100979Srwatson if (!mac_enforce_fs) 2036100979Srwatson return (0); 2037100979Srwatson 2038100979Srwatson error = vn_refreshlabel(vp, cred); 2039100979Srwatson if (error) 2040100979Srwatson return (error); 2041100979Srwatson 2042100979Srwatson MAC_CHECK(check_vnode_setmode, cred, vp, &vp->v_label, mode); 2043100979Srwatson return (error); 2044100979Srwatson} 2045100979Srwatson 2046100979Srwatsonint 2047100979Srwatsonmac_check_vnode_setowner(struct ucred *cred, struct vnode *vp, uid_t uid, 2048100979Srwatson gid_t gid) 2049100979Srwatson{ 2050100979Srwatson int error; 2051100979Srwatson 2052100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setowner"); 2053100979Srwatson 2054100979Srwatson if (!mac_enforce_fs) 2055100979Srwatson return (0); 2056100979Srwatson 2057100979Srwatson error = vn_refreshlabel(vp, cred); 2058100979Srwatson if (error) 2059100979Srwatson return (error); 2060100979Srwatson 2061100979Srwatson MAC_CHECK(check_vnode_setowner, cred, vp, &vp->v_label, uid, gid); 2062100979Srwatson return (error); 2063100979Srwatson} 2064100979Srwatson 2065100979Srwatsonint 2066100979Srwatsonmac_check_vnode_setutimes(struct ucred *cred, struct vnode *vp, 2067100979Srwatson struct timespec atime, struct timespec mtime) 2068100979Srwatson{ 2069100979Srwatson int error; 2070100979Srwatson 2071100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setutimes"); 2072100979Srwatson 2073100979Srwatson if (!mac_enforce_fs) 2074100979Srwatson return (0); 2075100979Srwatson 2076100979Srwatson error = vn_refreshlabel(vp, cred); 2077100979Srwatson if (error) 2078100979Srwatson return (error); 2079100979Srwatson 2080100979Srwatson MAC_CHECK(check_vnode_setutimes, cred, vp, &vp->v_label, atime, 2081100979Srwatson mtime); 2082100979Srwatson return (error); 2083100979Srwatson} 2084100979Srwatson 2085100979Srwatsonint 2086102129Srwatsonmac_check_vnode_stat(struct ucred *active_cred, struct ucred *file_cred, 2087102129Srwatson struct vnode *vp) 2088100979Srwatson{ 2089100979Srwatson int error; 2090100979Srwatson 2091100979Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_stat"); 2092100979Srwatson 2093100979Srwatson if (!mac_enforce_fs) 2094100979Srwatson return (0); 2095100979Srwatson 2096102129Srwatson error = vn_refreshlabel(vp, active_cred); 2097100979Srwatson if (error) 2098100979Srwatson return (error); 2099100979Srwatson 2100102129Srwatson MAC_CHECK(check_vnode_stat, active_cred, file_cred, vp, 2101102129Srwatson &vp->v_label); 2102100979Srwatson return (error); 2103100979Srwatson} 2104100979Srwatson 2105102112Srwatsonint 2106102129Srwatsonmac_check_vnode_write(struct ucred *active_cred, struct ucred *file_cred, 2107102129Srwatson struct vnode *vp) 2108102112Srwatson{ 2109102112Srwatson int error; 2110102112Srwatson 2111102112Srwatson ASSERT_VOP_LOCKED(vp, "mac_check_vnode_write"); 2112102112Srwatson 2113102112Srwatson if (!mac_enforce_fs) 2114102112Srwatson return (0); 2115102112Srwatson 2116102129Srwatson error = vn_refreshlabel(vp, active_cred); 2117102112Srwatson if (error) 2118102112Srwatson return (error); 2119102112Srwatson 2120102129Srwatson MAC_CHECK(check_vnode_write, active_cred, file_cred, vp, 2121102129Srwatson &vp->v_label); 2122102112Srwatson 2123102112Srwatson return (error); 2124102112Srwatson} 2125102112Srwatson 2126100979Srwatson/* 2127100979Srwatson * When relabeling a process, call out to the policies for the maximum 2128100979Srwatson * permission allowed for each object type we know about in its 2129100979Srwatson * memory space, and revoke access (in the least surprising ways we 2130100979Srwatson * know) when necessary. The process lock is not held here. 2131100979Srwatson */ 2132100979Srwatsonstatic void 2133100979Srwatsonmac_cred_mmapped_drop_perms(struct thread *td, struct ucred *cred) 2134100979Srwatson{ 2135100979Srwatson 2136100979Srwatson /* XXX freeze all other threads */ 2137100979Srwatson mac_cred_mmapped_drop_perms_recurse(td, cred, 2138100979Srwatson &td->td_proc->p_vmspace->vm_map); 2139100979Srwatson /* XXX allow other threads to continue */ 2140100979Srwatson} 2141100979Srwatson 2142100979Srwatsonstatic __inline const char * 2143100979Srwatsonprot2str(vm_prot_t prot) 2144100979Srwatson{ 2145100979Srwatson 2146100979Srwatson switch (prot & VM_PROT_ALL) { 2147100979Srwatson case VM_PROT_READ: 2148100979Srwatson return ("r--"); 2149100979Srwatson case VM_PROT_READ | VM_PROT_WRITE: 2150100979Srwatson return ("rw-"); 2151100979Srwatson case VM_PROT_READ | VM_PROT_EXECUTE: 2152100979Srwatson return ("r-x"); 2153100979Srwatson case VM_PROT_READ | VM_PROT_WRITE | VM_PROT_EXECUTE: 2154100979Srwatson return ("rwx"); 2155100979Srwatson case VM_PROT_WRITE: 2156100979Srwatson return ("-w-"); 2157100979Srwatson case VM_PROT_EXECUTE: 2158100979Srwatson return ("--x"); 2159100979Srwatson case VM_PROT_WRITE | VM_PROT_EXECUTE: 2160100979Srwatson return ("-wx"); 2161100979Srwatson default: 2162100979Srwatson return ("---"); 2163100979Srwatson } 2164100979Srwatson} 2165100979Srwatson 2166100979Srwatsonstatic void 2167100979Srwatsonmac_cred_mmapped_drop_perms_recurse(struct thread *td, struct ucred *cred, 2168100979Srwatson struct vm_map *map) 2169100979Srwatson{ 2170100979Srwatson struct vm_map_entry *vme; 2171100979Srwatson vm_prot_t result, revokeperms; 2172100979Srwatson vm_object_t object; 2173100979Srwatson vm_ooffset_t offset; 2174100979Srwatson struct vnode *vp; 2175100979Srwatson 2176103136Srwatson if (!mac_mmap_revocation) 2177103136Srwatson return; 2178103136Srwatson 2179100979Srwatson vm_map_lock_read(map); 2180100979Srwatson for (vme = map->header.next; vme != &map->header; vme = vme->next) { 2181100979Srwatson if (vme->eflags & MAP_ENTRY_IS_SUB_MAP) { 2182100979Srwatson mac_cred_mmapped_drop_perms_recurse(td, cred, 2183100979Srwatson vme->object.sub_map); 2184100979Srwatson continue; 2185100979Srwatson } 2186100979Srwatson /* 2187100979Srwatson * Skip over entries that obviously are not shared. 2188100979Srwatson */ 2189100979Srwatson if (vme->eflags & (MAP_ENTRY_COW | MAP_ENTRY_NOSYNC) || 2190100979Srwatson !vme->max_protection) 2191100979Srwatson continue; 2192100979Srwatson /* 2193100979Srwatson * Drill down to the deepest backing object. 2194100979Srwatson */ 2195100979Srwatson offset = vme->offset; 2196100979Srwatson object = vme->object.vm_object; 2197100979Srwatson if (object == NULL) 2198100979Srwatson continue; 2199100979Srwatson while (object->backing_object != NULL) { 2200100979Srwatson object = object->backing_object; 2201100979Srwatson offset += object->backing_object_offset; 2202100979Srwatson } 2203100979Srwatson /* 2204100979Srwatson * At the moment, vm_maps and objects aren't considered 2205100979Srwatson * by the MAC system, so only things with backing by a 2206100979Srwatson * normal object (read: vnodes) are checked. 2207100979Srwatson */ 2208100979Srwatson if (object->type != OBJT_VNODE) 2209100979Srwatson continue; 2210100979Srwatson vp = (struct vnode *)object->handle; 2211100979Srwatson vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); 2212100979Srwatson result = mac_check_vnode_mmap_prot(cred, vp, 0); 2213100979Srwatson VOP_UNLOCK(vp, 0, td); 2214100979Srwatson /* 2215100979Srwatson * Find out what maximum protection we may be allowing 2216100979Srwatson * now but a policy needs to get removed. 2217100979Srwatson */ 2218100979Srwatson revokeperms = vme->max_protection & ~result; 2219100979Srwatson if (!revokeperms) 2220100979Srwatson continue; 2221102949Sbde printf("pid %ld: revoking %s perms from %#lx:%ld " 2222102949Sbde "(max %s/cur %s)\n", (long)td->td_proc->p_pid, 2223102949Sbde prot2str(revokeperms), (u_long)vme->start, 2224102949Sbde (long)(vme->end - vme->start), 2225100979Srwatson prot2str(vme->max_protection), prot2str(vme->protection)); 2226100979Srwatson vm_map_lock_upgrade(map); 2227100979Srwatson /* 2228100979Srwatson * This is the really simple case: if a map has more 2229100979Srwatson * max_protection than is allowed, but it's not being 2230100979Srwatson * actually used (that is, the current protection is 2231100979Srwatson * still allowed), we can just wipe it out and do 2232100979Srwatson * nothing more. 2233100979Srwatson */ 2234100979Srwatson if ((vme->protection & revokeperms) == 0) { 2235100979Srwatson vme->max_protection -= revokeperms; 2236100979Srwatson } else { 2237100979Srwatson if (revokeperms & VM_PROT_WRITE) { 2238100979Srwatson /* 2239100979Srwatson * In the more complicated case, flush out all 2240100979Srwatson * pending changes to the object then turn it 2241100979Srwatson * copy-on-write. 2242100979Srwatson */ 2243100979Srwatson vm_object_reference(object); 2244100979Srwatson vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); 2245100979Srwatson vm_object_page_clean(object, 2246100979Srwatson OFF_TO_IDX(offset), 2247100979Srwatson OFF_TO_IDX(offset + vme->end - vme->start + 2248100979Srwatson PAGE_MASK), 2249100979Srwatson OBJPC_SYNC); 2250100979Srwatson VOP_UNLOCK(vp, 0, td); 2251100979Srwatson vm_object_deallocate(object); 2252100979Srwatson /* 2253100979Srwatson * Why bother if there's no read permissions 2254100979Srwatson * anymore? For the rest, we need to leave 2255100979Srwatson * the write permissions on for COW, or 2256100979Srwatson * remove them entirely if configured to. 2257100979Srwatson */ 2258100979Srwatson if (!mac_mmap_revocation_via_cow) { 2259100979Srwatson vme->max_protection &= ~VM_PROT_WRITE; 2260100979Srwatson vme->protection &= ~VM_PROT_WRITE; 2261100979Srwatson } if ((revokeperms & VM_PROT_READ) == 0) 2262100979Srwatson vme->eflags |= MAP_ENTRY_COW | 2263100979Srwatson MAP_ENTRY_NEEDS_COPY; 2264100979Srwatson } 2265100979Srwatson if (revokeperms & VM_PROT_EXECUTE) { 2266100979Srwatson vme->max_protection &= ~VM_PROT_EXECUTE; 2267100979Srwatson vme->protection &= ~VM_PROT_EXECUTE; 2268100979Srwatson } 2269100979Srwatson if (revokeperms & VM_PROT_READ) { 2270100979Srwatson vme->max_protection = 0; 2271100979Srwatson vme->protection = 0; 2272100979Srwatson } 2273100979Srwatson pmap_protect(map->pmap, vme->start, vme->end, 2274100979Srwatson vme->protection & ~revokeperms); 2275100979Srwatson vm_map_simplify_entry(map, vme); 2276100979Srwatson } 2277100979Srwatson vm_map_lock_downgrade(map); 2278100979Srwatson } 2279100979Srwatson vm_map_unlock_read(map); 2280100979Srwatson} 2281100979Srwatson 2282100979Srwatson/* 2283100979Srwatson * When the subject's label changes, it may require revocation of privilege 2284100979Srwatson * to mapped objects. This can't be done on-the-fly later with a unified 2285100979Srwatson * buffer cache. 2286100979Srwatson */ 2287100979Srwatsonstatic void 2288100979Srwatsonmac_relabel_cred(struct ucred *cred, struct label *newlabel) 2289100979Srwatson{ 2290100979Srwatson 2291100979Srwatson MAC_PERFORM(relabel_cred, cred, newlabel); 2292100979Srwatson} 2293100979Srwatson 2294100979Srwatsonvoid 2295100979Srwatsonmac_relabel_vnode(struct ucred *cred, struct vnode *vp, struct label *newlabel) 2296100979Srwatson{ 2297100979Srwatson 2298100979Srwatson MAC_PERFORM(relabel_vnode, cred, vp, &vp->v_label, newlabel); 2299100979Srwatson} 2300100979Srwatson 2301100979Srwatsonvoid 2302100979Srwatsonmac_create_ifnet(struct ifnet *ifnet) 2303100979Srwatson{ 2304100979Srwatson 2305100979Srwatson MAC_PERFORM(create_ifnet, ifnet, &ifnet->if_label); 2306100979Srwatson} 2307100979Srwatson 2308100979Srwatsonvoid 2309100979Srwatsonmac_create_bpfdesc(struct ucred *cred, struct bpf_d *bpf_d) 2310100979Srwatson{ 2311100979Srwatson 2312100979Srwatson MAC_PERFORM(create_bpfdesc, cred, bpf_d, &bpf_d->bd_label); 2313100979Srwatson} 2314100979Srwatson 2315100979Srwatsonvoid 2316100979Srwatsonmac_create_socket(struct ucred *cred, struct socket *socket) 2317100979Srwatson{ 2318100979Srwatson 2319100979Srwatson MAC_PERFORM(create_socket, cred, socket, &socket->so_label); 2320100979Srwatson} 2321100979Srwatson 2322100979Srwatsonvoid 2323100979Srwatsonmac_create_pipe(struct ucred *cred, struct pipe *pipe) 2324100979Srwatson{ 2325100979Srwatson 2326100979Srwatson MAC_PERFORM(create_pipe, cred, pipe, pipe->pipe_label); 2327100979Srwatson} 2328100979Srwatson 2329100979Srwatsonvoid 2330100979Srwatsonmac_create_socket_from_socket(struct socket *oldsocket, 2331100979Srwatson struct socket *newsocket) 2332100979Srwatson{ 2333100979Srwatson 2334100979Srwatson MAC_PERFORM(create_socket_from_socket, oldsocket, &oldsocket->so_label, 2335100979Srwatson newsocket, &newsocket->so_label); 2336100979Srwatson} 2337100979Srwatson 2338100979Srwatsonstatic void 2339100979Srwatsonmac_relabel_socket(struct ucred *cred, struct socket *socket, 2340100979Srwatson struct label *newlabel) 2341100979Srwatson{ 2342100979Srwatson 2343100979Srwatson MAC_PERFORM(relabel_socket, cred, socket, &socket->so_label, newlabel); 2344100979Srwatson} 2345100979Srwatson 2346100979Srwatsonstatic void 2347100979Srwatsonmac_relabel_pipe(struct ucred *cred, struct pipe *pipe, struct label *newlabel) 2348100979Srwatson{ 2349100979Srwatson 2350100979Srwatson MAC_PERFORM(relabel_pipe, cred, pipe, pipe->pipe_label, newlabel); 2351100979Srwatson} 2352100979Srwatson 2353100979Srwatsonvoid 2354100979Srwatsonmac_set_socket_peer_from_mbuf(struct mbuf *mbuf, struct socket *socket) 2355100979Srwatson{ 2356100979Srwatson 2357100979Srwatson MAC_PERFORM(set_socket_peer_from_mbuf, mbuf, &mbuf->m_pkthdr.label, 2358100979Srwatson socket, &socket->so_peerlabel); 2359100979Srwatson} 2360100979Srwatson 2361100979Srwatsonvoid 2362100979Srwatsonmac_set_socket_peer_from_socket(struct socket *oldsocket, 2363100979Srwatson struct socket *newsocket) 2364100979Srwatson{ 2365100979Srwatson 2366100979Srwatson MAC_PERFORM(set_socket_peer_from_socket, oldsocket, 2367100979Srwatson &oldsocket->so_label, newsocket, &newsocket->so_peerlabel); 2368100979Srwatson} 2369100979Srwatson 2370100979Srwatsonvoid 2371100979Srwatsonmac_create_datagram_from_ipq(struct ipq *ipq, struct mbuf *datagram) 2372100979Srwatson{ 2373100979Srwatson 2374100979Srwatson MAC_PERFORM(create_datagram_from_ipq, ipq, &ipq->ipq_label, 2375100979Srwatson datagram, &datagram->m_pkthdr.label); 2376100979Srwatson} 2377100979Srwatson 2378100979Srwatsonvoid 2379100979Srwatsonmac_create_fragment(struct mbuf *datagram, struct mbuf *fragment) 2380100979Srwatson{ 2381100979Srwatson 2382100979Srwatson MAC_PERFORM(create_fragment, datagram, &datagram->m_pkthdr.label, 2383100979Srwatson fragment, &fragment->m_pkthdr.label); 2384100979Srwatson} 2385100979Srwatson 2386100979Srwatsonvoid 2387100979Srwatsonmac_create_ipq(struct mbuf *fragment, struct ipq *ipq) 2388100979Srwatson{ 2389100979Srwatson 2390100979Srwatson MAC_PERFORM(create_ipq, fragment, &fragment->m_pkthdr.label, ipq, 2391100979Srwatson &ipq->ipq_label); 2392100979Srwatson} 2393100979Srwatson 2394100979Srwatsonvoid 2395100979Srwatsonmac_create_mbuf_from_mbuf(struct mbuf *oldmbuf, struct mbuf *newmbuf) 2396100979Srwatson{ 2397100979Srwatson 2398100979Srwatson MAC_PERFORM(create_mbuf_from_mbuf, oldmbuf, &oldmbuf->m_pkthdr.label, 2399100979Srwatson newmbuf, &newmbuf->m_pkthdr.label); 2400100979Srwatson} 2401100979Srwatson 2402100979Srwatsonvoid 2403100979Srwatsonmac_create_mbuf_from_bpfdesc(struct bpf_d *bpf_d, struct mbuf *mbuf) 2404100979Srwatson{ 2405100979Srwatson 2406100979Srwatson MAC_PERFORM(create_mbuf_from_bpfdesc, bpf_d, &bpf_d->bd_label, mbuf, 2407100979Srwatson &mbuf->m_pkthdr.label); 2408100979Srwatson} 2409100979Srwatson 2410100979Srwatsonvoid 2411100979Srwatsonmac_create_mbuf_linklayer(struct ifnet *ifnet, struct mbuf *mbuf) 2412100979Srwatson{ 2413100979Srwatson 2414100979Srwatson MAC_PERFORM(create_mbuf_linklayer, ifnet, &ifnet->if_label, mbuf, 2415100979Srwatson &mbuf->m_pkthdr.label); 2416100979Srwatson} 2417100979Srwatson 2418100979Srwatsonvoid 2419100979Srwatsonmac_create_mbuf_from_ifnet(struct ifnet *ifnet, struct mbuf *mbuf) 2420100979Srwatson{ 2421100979Srwatson 2422100979Srwatson MAC_PERFORM(create_mbuf_from_ifnet, ifnet, &ifnet->if_label, mbuf, 2423100979Srwatson &mbuf->m_pkthdr.label); 2424100979Srwatson} 2425100979Srwatson 2426100979Srwatsonvoid 2427100979Srwatsonmac_create_mbuf_multicast_encap(struct mbuf *oldmbuf, struct ifnet *ifnet, 2428100979Srwatson struct mbuf *newmbuf) 2429100979Srwatson{ 2430100979Srwatson 2431100979Srwatson MAC_PERFORM(create_mbuf_multicast_encap, oldmbuf, 2432100979Srwatson &oldmbuf->m_pkthdr.label, ifnet, &ifnet->if_label, newmbuf, 2433100979Srwatson &newmbuf->m_pkthdr.label); 2434100979Srwatson} 2435100979Srwatson 2436100979Srwatsonvoid 2437100979Srwatsonmac_create_mbuf_netlayer(struct mbuf *oldmbuf, struct mbuf *newmbuf) 2438100979Srwatson{ 2439100979Srwatson 2440100979Srwatson MAC_PERFORM(create_mbuf_netlayer, oldmbuf, &oldmbuf->m_pkthdr.label, 2441100979Srwatson newmbuf, &newmbuf->m_pkthdr.label); 2442100979Srwatson} 2443100979Srwatson 2444100979Srwatsonint 2445100979Srwatsonmac_fragment_match(struct mbuf *fragment, struct ipq *ipq) 2446100979Srwatson{ 2447100979Srwatson int result; 2448100979Srwatson 2449100979Srwatson result = 1; 2450100979Srwatson MAC_BOOLEAN(fragment_match, &&, fragment, &fragment->m_pkthdr.label, 2451100979Srwatson ipq, &ipq->ipq_label); 2452100979Srwatson 2453100979Srwatson return (result); 2454100979Srwatson} 2455100979Srwatson 2456100979Srwatsonvoid 2457100979Srwatsonmac_update_ipq(struct mbuf *fragment, struct ipq *ipq) 2458100979Srwatson{ 2459100979Srwatson 2460100979Srwatson MAC_PERFORM(update_ipq, fragment, &fragment->m_pkthdr.label, ipq, 2461100979Srwatson &ipq->ipq_label); 2462100979Srwatson} 2463100979Srwatson 2464100979Srwatsonvoid 2465100979Srwatsonmac_create_mbuf_from_socket(struct socket *socket, struct mbuf *mbuf) 2466100979Srwatson{ 2467100979Srwatson 2468100979Srwatson MAC_PERFORM(create_mbuf_from_socket, socket, &socket->so_label, mbuf, 2469100979Srwatson &mbuf->m_pkthdr.label); 2470100979Srwatson} 2471100979Srwatson 2472100979Srwatsonvoid 2473100979Srwatsonmac_create_mount(struct ucred *cred, struct mount *mp) 2474100979Srwatson{ 2475100979Srwatson 2476100979Srwatson MAC_PERFORM(create_mount, cred, mp, &mp->mnt_mntlabel, 2477100979Srwatson &mp->mnt_fslabel); 2478100979Srwatson} 2479100979Srwatson 2480100979Srwatsonvoid 2481100979Srwatsonmac_create_root_mount(struct ucred *cred, struct mount *mp) 2482100979Srwatson{ 2483100979Srwatson 2484100979Srwatson MAC_PERFORM(create_root_mount, cred, mp, &mp->mnt_mntlabel, 2485100979Srwatson &mp->mnt_fslabel); 2486100979Srwatson} 2487100979Srwatson 2488100979Srwatsonint 2489100979Srwatsonmac_check_bpfdesc_receive(struct bpf_d *bpf_d, struct ifnet *ifnet) 2490100979Srwatson{ 2491100979Srwatson int error; 2492100979Srwatson 2493100979Srwatson if (!mac_enforce_network) 2494100979Srwatson return (0); 2495100979Srwatson 2496100979Srwatson MAC_CHECK(check_bpfdesc_receive, bpf_d, &bpf_d->bd_label, ifnet, 2497100979Srwatson &ifnet->if_label); 2498100979Srwatson 2499100979Srwatson return (error); 2500100979Srwatson} 2501100979Srwatson 2502100979Srwatsonstatic int 2503100979Srwatsonmac_check_cred_relabel(struct ucred *cred, struct label *newlabel) 2504100979Srwatson{ 2505100979Srwatson int error; 2506100979Srwatson 2507100979Srwatson MAC_CHECK(check_cred_relabel, cred, newlabel); 2508100979Srwatson 2509100979Srwatson return (error); 2510100979Srwatson} 2511100979Srwatson 2512100979Srwatsonint 2513100979Srwatsonmac_check_cred_visible(struct ucred *u1, struct ucred *u2) 2514100979Srwatson{ 2515100979Srwatson int error; 2516100979Srwatson 2517100979Srwatson if (!mac_enforce_process) 2518100979Srwatson return (0); 2519100979Srwatson 2520100979Srwatson MAC_CHECK(check_cred_visible, u1, u2); 2521100979Srwatson 2522100979Srwatson return (error); 2523100979Srwatson} 2524100979Srwatson 2525100979Srwatsonint 2526100979Srwatsonmac_check_ifnet_transmit(struct ifnet *ifnet, struct mbuf *mbuf) 2527100979Srwatson{ 2528100979Srwatson int error; 2529100979Srwatson 2530100979Srwatson if (!mac_enforce_network) 2531100979Srwatson return (0); 2532100979Srwatson 2533100979Srwatson KASSERT(mbuf->m_flags & M_PKTHDR, ("packet has no pkthdr")); 2534100979Srwatson if (!(mbuf->m_pkthdr.label.l_flags & MAC_FLAG_INITIALIZED)) 2535100979Srwatson printf("%s%d: not initialized\n", ifnet->if_name, 2536100979Srwatson ifnet->if_unit); 2537100979Srwatson 2538100979Srwatson MAC_CHECK(check_ifnet_transmit, ifnet, &ifnet->if_label, mbuf, 2539100979Srwatson &mbuf->m_pkthdr.label); 2540100979Srwatson 2541100979Srwatson return (error); 2542100979Srwatson} 2543100979Srwatson 2544100979Srwatsonint 2545100979Srwatsonmac_check_mount_stat(struct ucred *cred, struct mount *mount) 2546100979Srwatson{ 2547100979Srwatson int error; 2548100979Srwatson 2549100979Srwatson if (!mac_enforce_fs) 2550100979Srwatson return (0); 2551100979Srwatson 2552100979Srwatson MAC_CHECK(check_mount_stat, cred, mount, &mount->mnt_mntlabel); 2553100979Srwatson 2554100979Srwatson return (error); 2555100979Srwatson} 2556100979Srwatson 2557100979Srwatsonint 2558100979Srwatsonmac_check_pipe_ioctl(struct ucred *cred, struct pipe *pipe, unsigned long cmd, 2559100979Srwatson void *data) 2560100979Srwatson{ 2561100979Srwatson int error; 2562100979Srwatson 2563100979Srwatson MAC_CHECK(check_pipe_ioctl, cred, pipe, pipe->pipe_label, cmd, data); 2564100979Srwatson 2565100979Srwatson return (error); 2566100979Srwatson} 2567100979Srwatson 2568100979Srwatsonint 2569102115Srwatsonmac_check_pipe_poll(struct ucred *cred, struct pipe *pipe) 2570100979Srwatson{ 2571100979Srwatson int error; 2572100979Srwatson 2573102115Srwatson MAC_CHECK(check_pipe_poll, cred, pipe, pipe->pipe_label); 2574100979Srwatson 2575100979Srwatson return (error); 2576100979Srwatson} 2577100979Srwatson 2578102115Srwatsonint 2579102115Srwatsonmac_check_pipe_read(struct ucred *cred, struct pipe *pipe) 2580102115Srwatson{ 2581102115Srwatson int error; 2582102115Srwatson 2583102115Srwatson MAC_CHECK(check_pipe_read, cred, pipe, pipe->pipe_label); 2584102115Srwatson 2585102115Srwatson return (error); 2586102115Srwatson} 2587102115Srwatson 2588100979Srwatsonstatic int 2589100979Srwatsonmac_check_pipe_relabel(struct ucred *cred, struct pipe *pipe, 2590100979Srwatson struct label *newlabel) 2591100979Srwatson{ 2592100979Srwatson int error; 2593100979Srwatson 2594100979Srwatson MAC_CHECK(check_pipe_relabel, cred, pipe, pipe->pipe_label, newlabel); 2595100979Srwatson 2596100979Srwatson return (error); 2597100979Srwatson} 2598100979Srwatson 2599100979Srwatsonint 2600102115Srwatsonmac_check_pipe_stat(struct ucred *cred, struct pipe *pipe) 2601102115Srwatson{ 2602102115Srwatson int error; 2603102115Srwatson 2604102115Srwatson MAC_CHECK(check_pipe_stat, cred, pipe, pipe->pipe_label); 2605102115Srwatson 2606102115Srwatson return (error); 2607102115Srwatson} 2608102115Srwatson 2609102115Srwatsonint 2610102115Srwatsonmac_check_pipe_write(struct ucred *cred, struct pipe *pipe) 2611102115Srwatson{ 2612102115Srwatson int error; 2613102115Srwatson 2614102115Srwatson MAC_CHECK(check_pipe_write, cred, pipe, pipe->pipe_label); 2615102115Srwatson 2616102115Srwatson return (error); 2617102115Srwatson} 2618102115Srwatson 2619102115Srwatsonint 2620100979Srwatsonmac_check_proc_debug(struct ucred *cred, struct proc *proc) 2621100979Srwatson{ 2622100979Srwatson int error; 2623100979Srwatson 2624102103Srwatson PROC_LOCK_ASSERT(proc, MA_OWNED); 2625102103Srwatson 2626100979Srwatson if (!mac_enforce_process) 2627100979Srwatson return (0); 2628100979Srwatson 2629100979Srwatson MAC_CHECK(check_proc_debug, cred, proc); 2630100979Srwatson 2631100979Srwatson return (error); 2632100979Srwatson} 2633100979Srwatson 2634100979Srwatsonint 2635100979Srwatsonmac_check_proc_sched(struct ucred *cred, struct proc *proc) 2636100979Srwatson{ 2637100979Srwatson int error; 2638100979Srwatson 2639102103Srwatson PROC_LOCK_ASSERT(proc, MA_OWNED); 2640102103Srwatson 2641100979Srwatson if (!mac_enforce_process) 2642100979Srwatson return (0); 2643100979Srwatson 2644100979Srwatson MAC_CHECK(check_proc_sched, cred, proc); 2645100979Srwatson 2646100979Srwatson return (error); 2647100979Srwatson} 2648100979Srwatson 2649100979Srwatsonint 2650100979Srwatsonmac_check_proc_signal(struct ucred *cred, struct proc *proc, int signum) 2651100979Srwatson{ 2652100979Srwatson int error; 2653100979Srwatson 2654102103Srwatson PROC_LOCK_ASSERT(proc, MA_OWNED); 2655102103Srwatson 2656100979Srwatson if (!mac_enforce_process) 2657100979Srwatson return (0); 2658100979Srwatson 2659100979Srwatson MAC_CHECK(check_proc_signal, cred, proc, signum); 2660100979Srwatson 2661100979Srwatson return (error); 2662100979Srwatson} 2663100979Srwatson 2664100979Srwatsonint 2665100979Srwatsonmac_check_socket_bind(struct ucred *ucred, struct socket *socket, 2666100979Srwatson struct sockaddr *sockaddr) 2667100979Srwatson{ 2668100979Srwatson int error; 2669100979Srwatson 2670100979Srwatson if (!mac_enforce_socket) 2671100979Srwatson return (0); 2672100979Srwatson 2673100979Srwatson MAC_CHECK(check_socket_bind, ucred, socket, &socket->so_label, 2674100979Srwatson sockaddr); 2675100979Srwatson 2676100979Srwatson return (error); 2677100979Srwatson} 2678100979Srwatson 2679100979Srwatsonint 2680100979Srwatsonmac_check_socket_connect(struct ucred *cred, struct socket *socket, 2681100979Srwatson struct sockaddr *sockaddr) 2682100979Srwatson{ 2683100979Srwatson int error; 2684100979Srwatson 2685100979Srwatson if (!mac_enforce_socket) 2686100979Srwatson return (0); 2687100979Srwatson 2688100979Srwatson MAC_CHECK(check_socket_connect, cred, socket, &socket->so_label, 2689100979Srwatson sockaddr); 2690100979Srwatson 2691100979Srwatson return (error); 2692100979Srwatson} 2693100979Srwatson 2694100979Srwatsonint 2695101933Srwatsonmac_check_socket_deliver(struct socket *socket, struct mbuf *mbuf) 2696100979Srwatson{ 2697100979Srwatson int error; 2698100979Srwatson 2699100979Srwatson if (!mac_enforce_socket) 2700100979Srwatson return (0); 2701100979Srwatson 2702101933Srwatson MAC_CHECK(check_socket_deliver, socket, &socket->so_label, mbuf, 2703101933Srwatson &mbuf->m_pkthdr.label); 2704101933Srwatson 2705100979Srwatson return (error); 2706100979Srwatson} 2707100979Srwatson 2708100979Srwatsonint 2709101933Srwatsonmac_check_socket_listen(struct ucred *cred, struct socket *socket) 2710100979Srwatson{ 2711100979Srwatson int error; 2712100979Srwatson 2713100979Srwatson if (!mac_enforce_socket) 2714100979Srwatson return (0); 2715100979Srwatson 2716101933Srwatson MAC_CHECK(check_socket_listen, cred, socket, &socket->so_label); 2717100979Srwatson return (error); 2718100979Srwatson} 2719100979Srwatson 2720100979Srwatsonstatic int 2721100979Srwatsonmac_check_socket_relabel(struct ucred *cred, struct socket *socket, 2722100979Srwatson struct label *newlabel) 2723100979Srwatson{ 2724100979Srwatson int error; 2725100979Srwatson 2726100979Srwatson MAC_CHECK(check_socket_relabel, cred, socket, &socket->so_label, 2727100979Srwatson newlabel); 2728100979Srwatson 2729100979Srwatson return (error); 2730100979Srwatson} 2731100979Srwatson 2732100979Srwatsonint 2733100979Srwatsonmac_check_socket_visible(struct ucred *cred, struct socket *socket) 2734100979Srwatson{ 2735100979Srwatson int error; 2736100979Srwatson 2737100979Srwatson if (!mac_enforce_socket) 2738100979Srwatson return (0); 2739100979Srwatson 2740100979Srwatson MAC_CHECK(check_socket_visible, cred, socket, &socket->so_label); 2741100979Srwatson 2742100979Srwatson return (error); 2743100979Srwatson} 2744100979Srwatson 2745100979Srwatsonint 2746100979Srwatsonmac_ioctl_ifnet_get(struct ucred *cred, struct ifreq *ifr, 2747100979Srwatson struct ifnet *ifnet) 2748100979Srwatson{ 2749100979Srwatson struct mac label; 2750100979Srwatson int error; 2751100979Srwatson 2752100979Srwatson error = mac_externalize(&ifnet->if_label, &label); 2753100979Srwatson if (error) 2754100979Srwatson return (error); 2755100979Srwatson 2756100979Srwatson return (copyout(&label, ifr->ifr_ifru.ifru_data, sizeof(label))); 2757100979Srwatson} 2758100979Srwatson 2759100979Srwatsonint 2760100979Srwatsonmac_ioctl_ifnet_set(struct ucred *cred, struct ifreq *ifr, 2761100979Srwatson struct ifnet *ifnet) 2762100979Srwatson{ 2763100979Srwatson struct mac newlabel; 2764100979Srwatson struct label intlabel; 2765100979Srwatson int error; 2766100979Srwatson 2767100979Srwatson error = copyin(ifr->ifr_ifru.ifru_data, &newlabel, sizeof(newlabel)); 2768100979Srwatson if (error) 2769100979Srwatson return (error); 2770100979Srwatson 2771100979Srwatson error = mac_internalize(&intlabel, &newlabel); 2772100979Srwatson if (error) 2773100979Srwatson return (error); 2774100979Srwatson 2775100979Srwatson /* 2776100979Srwatson * XXX: Note that this is a redundant privilege check, since 2777100979Srwatson * policies impose this check themselves if required by the 2778100979Srwatson * policy. Eventually, this should go away. 2779100979Srwatson */ 2780100979Srwatson error = suser_cred(cred, 0); 2781100979Srwatson if (error) 2782100979Srwatson goto out; 2783100979Srwatson 2784100979Srwatson MAC_CHECK(check_ifnet_relabel, cred, ifnet, &ifnet->if_label, 2785100979Srwatson &intlabel); 2786100979Srwatson if (error) 2787100979Srwatson goto out; 2788100979Srwatson 2789100979Srwatson MAC_PERFORM(relabel_ifnet, cred, ifnet, &ifnet->if_label, &intlabel); 2790100979Srwatson 2791100979Srwatsonout: 2792100979Srwatson mac_destroy_temp(&intlabel); 2793100979Srwatson return (error); 2794100979Srwatson} 2795100979Srwatson 2796100979Srwatsonvoid 2797100979Srwatsonmac_create_devfs_vnode(struct devfs_dirent *de, struct vnode *vp) 2798100979Srwatson{ 2799100979Srwatson 2800100979Srwatson MAC_PERFORM(create_devfs_vnode, de, &de->de_label, vp, &vp->v_label); 2801100979Srwatson} 2802100979Srwatson 2803100979Srwatsonvoid 2804100979Srwatsonmac_create_devfs_device(dev_t dev, struct devfs_dirent *de) 2805100979Srwatson{ 2806100979Srwatson 2807100979Srwatson MAC_PERFORM(create_devfs_device, dev, de, &de->de_label); 2808100979Srwatson} 2809100979Srwatson 2810100979Srwatsonstatic int 2811100979Srwatsonmac_stdcreatevnode_ea(struct vnode *vp) 2812100979Srwatson{ 2813100979Srwatson int error; 2814100979Srwatson 2815100979Srwatson MAC_CHECK(stdcreatevnode_ea, vp, &vp->v_label); 2816100979Srwatson 2817100979Srwatson return (error); 2818100979Srwatson} 2819100979Srwatson 2820100979Srwatsonvoid 2821100979Srwatsonmac_create_devfs_directory(char *dirname, int dirnamelen, 2822100979Srwatson struct devfs_dirent *de) 2823100979Srwatson{ 2824100979Srwatson 2825100979Srwatson MAC_PERFORM(create_devfs_directory, dirname, dirnamelen, de, 2826100979Srwatson &de->de_label); 2827100979Srwatson} 2828100979Srwatson 2829100979Srwatson/* 2830100979Srwatson * When a new vnode is created, this call will initialize its label. 2831100979Srwatson */ 2832100979Srwatsonvoid 2833100979Srwatsonmac_create_vnode(struct ucred *cred, struct vnode *parent, 2834100979Srwatson struct vnode *child) 2835100979Srwatson{ 2836100979Srwatson int error; 2837100979Srwatson 2838100979Srwatson ASSERT_VOP_LOCKED(parent, "mac_create_vnode"); 2839100979Srwatson ASSERT_VOP_LOCKED(child, "mac_create_vnode"); 2840100979Srwatson 2841100979Srwatson error = vn_refreshlabel(parent, cred); 2842100979Srwatson if (error) { 2843100979Srwatson printf("mac_create_vnode: vn_refreshlabel returned %d\n", 2844100979Srwatson error); 2845100979Srwatson printf("mac_create_vnode: using old vnode label\n"); 2846100979Srwatson } 2847100979Srwatson 2848100979Srwatson MAC_PERFORM(create_vnode, cred, parent, &parent->v_label, child, 2849100979Srwatson &child->v_label); 2850100979Srwatson} 2851100979Srwatson 2852100979Srwatsonint 2853100979Srwatsonmac_setsockopt_label_set(struct ucred *cred, struct socket *so, 2854100979Srwatson struct mac *extmac) 2855100979Srwatson{ 2856100979Srwatson struct label intlabel; 2857100979Srwatson int error; 2858100979Srwatson 2859100979Srwatson error = mac_internalize(&intlabel, extmac); 2860100979Srwatson if (error) 2861100979Srwatson return (error); 2862100979Srwatson 2863100979Srwatson mac_check_socket_relabel(cred, so, &intlabel); 2864100979Srwatson if (error) { 2865100979Srwatson mac_destroy_temp(&intlabel); 2866100979Srwatson return (error); 2867100979Srwatson } 2868100979Srwatson 2869100979Srwatson mac_relabel_socket(cred, so, &intlabel); 2870100979Srwatson 2871100979Srwatson mac_destroy_temp(&intlabel); 2872100979Srwatson return (0); 2873100979Srwatson} 2874100979Srwatson 2875100979Srwatsonint 2876100979Srwatsonmac_pipe_label_set(struct ucred *cred, struct pipe *pipe, struct label *label) 2877100979Srwatson{ 2878100979Srwatson int error; 2879100979Srwatson 2880100979Srwatson error = mac_check_pipe_relabel(cred, pipe, label); 2881100979Srwatson if (error) 2882100979Srwatson return (error); 2883100979Srwatson 2884100979Srwatson mac_relabel_pipe(cred, pipe, label); 2885100979Srwatson 2886100979Srwatson return (0); 2887100979Srwatson} 2888100979Srwatson 2889100979Srwatsonint 2890100979Srwatsonmac_getsockopt_label_get(struct ucred *cred, struct socket *so, 2891100979Srwatson struct mac *extmac) 2892100979Srwatson{ 2893100979Srwatson 2894100979Srwatson return (mac_externalize(&so->so_label, extmac)); 2895100979Srwatson} 2896100979Srwatson 2897100979Srwatsonint 2898100979Srwatsonmac_getsockopt_peerlabel_get(struct ucred *cred, struct socket *so, 2899100979Srwatson struct mac *extmac) 2900100979Srwatson{ 2901100979Srwatson 2902100979Srwatson return (mac_externalize(&so->so_peerlabel, extmac)); 2903100979Srwatson} 2904100979Srwatson 2905100979Srwatson/* 2906100979Srwatson * Implementation of VOP_SETLABEL() that relies on extended attributes 2907100979Srwatson * to store label data. Can be referenced by filesystems supporting 2908100979Srwatson * extended attributes. 2909100979Srwatson */ 2910100979Srwatsonint 2911100979Srwatsonvop_stdsetlabel_ea(struct vop_setlabel_args *ap) 2912100979Srwatson{ 2913100979Srwatson struct vnode *vp = ap->a_vp; 2914100979Srwatson struct label *intlabel = ap->a_label; 2915100979Srwatson struct mac extmac; 2916100979Srwatson int error; 2917100979Srwatson 2918100979Srwatson ASSERT_VOP_LOCKED(vp, "vop_stdsetlabel_ea"); 2919100979Srwatson 2920100979Srwatson /* 2921100979Srwatson * XXX: Eventually call out to EA check/set calls here. 2922100979Srwatson * Be particularly careful to avoid race conditions, 2923100979Srwatson * consistency problems, and stability problems when 2924100979Srwatson * dealing with multiple EAs. In particular, we require 2925100979Srwatson * the ability to write multiple EAs on the same file in 2926100979Srwatson * a single transaction, which the current EA interface 2927100979Srwatson * does not provide. 2928100979Srwatson */ 2929100979Srwatson 2930100979Srwatson error = mac_externalize(intlabel, &extmac); 2931100979Srwatson if (error) 2932100979Srwatson return (error); 2933100979Srwatson 2934100979Srwatson error = vn_extattr_set(vp, IO_NODELOCKED, 2935100979Srwatson FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME, 2936100979Srwatson sizeof(extmac), (char *)&extmac, curthread); 2937100979Srwatson if (error) 2938100979Srwatson return (error); 2939100979Srwatson 2940100979Srwatson mac_relabel_vnode(ap->a_cred, vp, intlabel); 2941100979Srwatson 2942101308Sjeff vp->v_vflag |= VV_CACHEDLABEL; 2943100979Srwatson 2944100979Srwatson return (0); 2945100979Srwatson} 2946100979Srwatson 2947100979Srwatsonstatic int 2948100979Srwatsonvn_setlabel(struct vnode *vp, struct label *intlabel, struct ucred *cred) 2949100979Srwatson{ 2950100979Srwatson int error; 2951100979Srwatson 2952100979Srwatson if (vp->v_mount == NULL) { 2953100979Srwatson /* printf("vn_setlabel: null v_mount\n"); */ 2954100979Srwatson if (vp->v_tag != VT_NON) 2955100979Srwatson printf("vn_setlabel: null v_mount with non-VT_NON\n"); 2956100979Srwatson return (EBADF); 2957100979Srwatson } 2958100979Srwatson 2959100979Srwatson if ((vp->v_mount->mnt_flag & MNT_MULTILABEL) == 0) 2960100979Srwatson return (EOPNOTSUPP); 2961100979Srwatson 2962100979Srwatson /* 2963100979Srwatson * Multi-phase commit. First check the policies to confirm the 2964100979Srwatson * change is OK. Then commit via the filesystem. Finally, 2965100979Srwatson * update the actual vnode label. Question: maybe the filesystem 2966100979Srwatson * should update the vnode at the end as part of VOP_SETLABEL()? 2967100979Srwatson */ 2968100979Srwatson error = mac_check_vnode_relabel(cred, vp, intlabel); 2969100979Srwatson if (error) 2970100979Srwatson return (error); 2971100979Srwatson 2972100979Srwatson /* 2973100979Srwatson * VADMIN provides the opportunity for the filesystem to make 2974100979Srwatson * decisions about who is and is not able to modify labels 2975100979Srwatson * and protections on files. This might not be right. We can't 2976100979Srwatson * assume VOP_SETLABEL() will do it, because we might implement 2977100979Srwatson * that as part of vop_stdsetlabel_ea(). 2978100979Srwatson */ 2979100979Srwatson error = VOP_ACCESS(vp, VADMIN, cred, curthread); 2980100979Srwatson if (error) 2981100979Srwatson return (error); 2982100979Srwatson 2983100979Srwatson error = VOP_SETLABEL(vp, intlabel, cred, curthread); 2984100979Srwatson if (error) 2985100979Srwatson return (error); 2986100979Srwatson 2987100979Srwatson return (0); 2988100979Srwatson} 2989100979Srwatson 2990100979Srwatson/* 2991100979Srwatson * MPSAFE 2992100979Srwatson */ 2993100979Srwatsonint 2994100894Srwatson__mac_get_proc(struct thread *td, struct __mac_get_proc_args *uap) 2995100894Srwatson{ 2996100979Srwatson struct mac extmac; 2997100979Srwatson int error; 2998100894Srwatson 2999100979Srwatson error = mac_externalize(&td->td_ucred->cr_label, &extmac); 3000100979Srwatson if (error == 0) 3001100979Srwatson error = copyout(&extmac, SCARG(uap, mac_p), sizeof(extmac)); 3002100979Srwatson 3003100979Srwatson return (error); 3004100979Srwatson} 3005100979Srwatson 3006100979Srwatson/* 3007100979Srwatson * MPSAFE 3008100979Srwatson */ 3009100979Srwatsonint 3010100979Srwatson__mac_set_proc(struct thread *td, struct __mac_set_proc_args *uap) 3011100979Srwatson{ 3012100979Srwatson struct ucred *newcred, *oldcred; 3013100979Srwatson struct proc *p; 3014100979Srwatson struct mac extmac; 3015100979Srwatson struct label intlabel; 3016100979Srwatson int error; 3017100979Srwatson 3018100979Srwatson error = copyin(SCARG(uap, mac_p), &extmac, sizeof(extmac)); 3019100979Srwatson if (error) 3020100979Srwatson return (error); 3021100979Srwatson 3022100979Srwatson error = mac_internalize(&intlabel, &extmac); 3023100979Srwatson if (error) 3024100979Srwatson return (error); 3025100979Srwatson 3026100979Srwatson newcred = crget(); 3027100979Srwatson 3028100979Srwatson p = td->td_proc; 3029100979Srwatson PROC_LOCK(p); 3030100979Srwatson oldcred = p->p_ucred; 3031100979Srwatson 3032100979Srwatson error = mac_check_cred_relabel(oldcred, &intlabel); 3033100979Srwatson if (error) { 3034100979Srwatson PROC_UNLOCK(p); 3035100979Srwatson mac_destroy_temp(&intlabel); 3036100979Srwatson crfree(newcred); 3037100979Srwatson return (error); 3038100979Srwatson } 3039100979Srwatson 3040100979Srwatson setsugid(p); 3041100979Srwatson crcopy(newcred, oldcred); 3042100979Srwatson mac_relabel_cred(newcred, &intlabel); 3043102136Srwatson p->p_ucred = newcred; 3044100979Srwatson 3045102136Srwatson /* 3046102136Srwatson * Grab additional reference for use while revoking mmaps, prior 3047102136Srwatson * to releasing the proc lock and sharing the cred. 3048102136Srwatson */ 3049102136Srwatson crhold(newcred); 3050100979Srwatson PROC_UNLOCK(p); 3051102136Srwatson 3052103135Srwatson mtx_lock(&Giant); 3053102136Srwatson mac_cred_mmapped_drop_perms(td, newcred); 3054103135Srwatson mtx_unlock(&Giant); 3055102136Srwatson 3056102136Srwatson crfree(newcred); /* Free revocation reference. */ 3057100979Srwatson crfree(oldcred); 3058100979Srwatson mac_destroy_temp(&intlabel); 3059100979Srwatson return (0); 3060100979Srwatson} 3061100979Srwatson 3062100979Srwatson/* 3063100979Srwatson * MPSAFE 3064100979Srwatson */ 3065100979Srwatsonint 3066100979Srwatson__mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap) 3067100979Srwatson{ 3068100979Srwatson struct file *fp; 3069100979Srwatson struct mac extmac; 3070100979Srwatson struct vnode *vp; 3071100979Srwatson struct pipe *pipe; 3072100979Srwatson int error; 3073100979Srwatson 3074100979Srwatson mtx_lock(&Giant); 3075100979Srwatson 3076100979Srwatson error = fget(td, SCARG(uap, fd), &fp); 3077100979Srwatson if (error) 3078100979Srwatson goto out; 3079100979Srwatson 3080100979Srwatson switch (fp->f_type) { 3081100979Srwatson case DTYPE_FIFO: 3082100979Srwatson case DTYPE_VNODE: 3083100979Srwatson vp = (struct vnode *)fp->f_data; 3084100979Srwatson 3085100979Srwatson vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); 3086100979Srwatson error = vn_refreshlabel(vp, td->td_ucred); 3087100979Srwatson if (error == 0) 3088100979Srwatson error = mac_externalize(&vp->v_label, &extmac); 3089100979Srwatson VOP_UNLOCK(vp, 0, td); 3090100979Srwatson break; 3091100979Srwatson case DTYPE_PIPE: 3092100979Srwatson pipe = (struct pipe *)fp->f_data; 3093100979Srwatson error = mac_externalize(pipe->pipe_label, &extmac); 3094100979Srwatson break; 3095100979Srwatson default: 3096100979Srwatson error = EINVAL; 3097100979Srwatson } 3098100979Srwatson 3099100979Srwatson if (error == 0) 3100100979Srwatson error = copyout(&extmac, SCARG(uap, mac_p), sizeof(extmac)); 3101100979Srwatson 3102100979Srwatson fdrop(fp, td); 3103100979Srwatson 3104100979Srwatsonout: 3105100979Srwatson mtx_unlock(&Giant); 3106100979Srwatson return (error); 3107100979Srwatson} 3108100979Srwatson 3109100979Srwatson/* 3110100979Srwatson * MPSAFE 3111100979Srwatson */ 3112100979Srwatsonint 3113100979Srwatson__mac_get_file(struct thread *td, struct __mac_get_file_args *uap) 3114100979Srwatson{ 3115100979Srwatson struct nameidata nd; 3116100979Srwatson struct mac extmac; 3117100979Srwatson int error; 3118100979Srwatson 3119100979Srwatson mtx_lock(&Giant); 3120100979Srwatson NDINIT(&nd, LOOKUP, LOCKLEAF | FOLLOW, UIO_USERSPACE, 3121100979Srwatson SCARG(uap, path_p), td); 3122100979Srwatson error = namei(&nd); 3123100979Srwatson if (error) 3124100979Srwatson goto out; 3125100979Srwatson 3126100979Srwatson error = vn_refreshlabel(nd.ni_vp, td->td_ucred); 3127100979Srwatson if (error == 0) 3128100979Srwatson error = mac_externalize(&nd.ni_vp->v_label, &extmac); 3129100979Srwatson NDFREE(&nd, 0); 3130100979Srwatson if (error) 3131100979Srwatson goto out; 3132100979Srwatson 3133100979Srwatson error = copyout(&extmac, SCARG(uap, mac_p), sizeof(extmac)); 3134100979Srwatson 3135100979Srwatsonout: 3136100979Srwatson mtx_unlock(&Giant); 3137100979Srwatson return (error); 3138100979Srwatson} 3139100979Srwatson 3140100979Srwatson/* 3141100979Srwatson * MPSAFE 3142100979Srwatson */ 3143100979Srwatsonint 3144100979Srwatson__mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap) 3145100979Srwatson{ 3146100979Srwatson struct file *fp; 3147100979Srwatson struct mac extmac; 3148100979Srwatson struct label intlabel; 3149100979Srwatson struct mount *mp; 3150100979Srwatson struct vnode *vp; 3151100979Srwatson struct pipe *pipe; 3152100979Srwatson int error; 3153100979Srwatson 3154100979Srwatson mtx_lock(&Giant); 3155100979Srwatson error = fget(td, SCARG(uap, fd), &fp); 3156100979Srwatson if (error) 3157100979Srwatson goto out1; 3158100979Srwatson 3159100979Srwatson error = copyin(SCARG(uap, mac_p), &extmac, sizeof(extmac)); 3160100979Srwatson if (error) 3161100979Srwatson goto out2; 3162100979Srwatson 3163100979Srwatson error = mac_internalize(&intlabel, &extmac); 3164100979Srwatson if (error) 3165100979Srwatson goto out2; 3166100979Srwatson 3167100979Srwatson switch (fp->f_type) { 3168100979Srwatson case DTYPE_FIFO: 3169100979Srwatson case DTYPE_VNODE: 3170100979Srwatson vp = (struct vnode *)fp->f_data; 3171100979Srwatson error = vn_start_write(vp, &mp, V_WAIT | PCATCH); 3172100979Srwatson if (error != 0) 3173100979Srwatson break; 3174100979Srwatson 3175100979Srwatson vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); 3176100979Srwatson error = vn_setlabel(vp, &intlabel, td->td_ucred); 3177100979Srwatson VOP_UNLOCK(vp, 0, td); 3178100979Srwatson vn_finished_write(mp); 3179100979Srwatson mac_destroy_temp(&intlabel); 3180100979Srwatson break; 3181100979Srwatson case DTYPE_PIPE: 3182100979Srwatson pipe = (struct pipe *)fp->f_data; 3183100979Srwatson error = mac_pipe_label_set(td->td_ucred, pipe, &intlabel); 3184100979Srwatson break; 3185100979Srwatson default: 3186100979Srwatson error = EINVAL; 3187100979Srwatson } 3188100979Srwatson 3189100979Srwatsonout2: 3190100979Srwatson fdrop(fp, td); 3191100979Srwatsonout1: 3192100979Srwatson mtx_unlock(&Giant); 3193100979Srwatson return (error); 3194100979Srwatson} 3195100979Srwatson 3196100979Srwatson/* 3197100979Srwatson * MPSAFE 3198100979Srwatson */ 3199100979Srwatsonint 3200100979Srwatson__mac_set_file(struct thread *td, struct __mac_set_file_args *uap) 3201100979Srwatson{ 3202100979Srwatson struct nameidata nd; 3203100979Srwatson struct mac extmac; 3204100979Srwatson struct label intlabel; 3205100979Srwatson struct mount *mp; 3206100979Srwatson int error; 3207100979Srwatson 3208100979Srwatson mtx_lock(&Giant); 3209100979Srwatson 3210100979Srwatson error = copyin(SCARG(uap, mac_p), &extmac, sizeof(extmac)); 3211100979Srwatson if (error) 3212100979Srwatson goto out; 3213100979Srwatson 3214100979Srwatson error = mac_internalize(&intlabel, &extmac); 3215100979Srwatson if (error) 3216100979Srwatson goto out; 3217100979Srwatson 3218100979Srwatson NDINIT(&nd, LOOKUP, LOCKLEAF | FOLLOW, UIO_USERSPACE, 3219100979Srwatson SCARG(uap, path_p), td); 3220100979Srwatson error = namei(&nd); 3221100979Srwatson if (error) 3222100979Srwatson goto out2; 3223100979Srwatson error = vn_start_write(nd.ni_vp, &mp, V_WAIT | PCATCH); 3224100979Srwatson if (error) 3225100979Srwatson goto out2; 3226100979Srwatson 3227100979Srwatson error = vn_setlabel(nd.ni_vp, &intlabel, td->td_ucred); 3228100979Srwatson 3229100979Srwatson vn_finished_write(mp); 3230100979Srwatsonout2: 3231100979Srwatson mac_destroy_temp(&intlabel); 3232100979Srwatson NDFREE(&nd, 0); 3233100979Srwatsonout: 3234100979Srwatson mtx_unlock(&Giant); 3235100979Srwatson return (error); 3236100979Srwatson} 3237100979Srwatson 3238102123Srwatsonint 3239102123Srwatsonmac_syscall(struct thread *td, struct mac_syscall_args *uap) 3240102123Srwatson{ 3241102123Srwatson struct mac_policy_conf *mpc; 3242102123Srwatson char target[MAC_MAX_POLICY_NAME]; 3243102123Srwatson int error; 3244102123Srwatson 3245102123Srwatson error = copyinstr(SCARG(uap, policy), target, sizeof(target), NULL); 3246102123Srwatson if (error) 3247102123Srwatson return (error); 3248102123Srwatson 3249102123Srwatson error = ENOSYS; 3250102123Srwatson MAC_POLICY_LIST_BUSY(); 3251102123Srwatson LIST_FOREACH(mpc, &mac_policy_list, mpc_list) { 3252102123Srwatson if (strcmp(mpc->mpc_name, target) == 0 && 3253102123Srwatson mpc->mpc_ops->mpo_syscall != NULL) { 3254102123Srwatson error = mpc->mpc_ops->mpo_syscall(td, 3255102123Srwatson SCARG(uap, call), SCARG(uap, arg)); 3256102123Srwatson goto out; 3257102123Srwatson } 3258102123Srwatson } 3259102123Srwatson 3260102123Srwatsonout: 3261102123Srwatson MAC_POLICY_LIST_UNBUSY(); 3262102123Srwatson return (error); 3263102123Srwatson} 3264102123Srwatson 3265100979SrwatsonSYSINIT(mac, SI_SUB_MAC, SI_ORDER_FIRST, mac_init, NULL); 3266100979SrwatsonSYSINIT(mac_late, SI_SUB_MAC_LATE, SI_ORDER_FIRST, mac_late_init, NULL); 3267100979Srwatson 3268100979Srwatson#else /* !MAC */ 3269100979Srwatson 3270100979Srwatsonint 3271100979Srwatson__mac_get_proc(struct thread *td, struct __mac_get_proc_args *uap) 3272100979Srwatson{ 3273100979Srwatson 3274100894Srwatson return (ENOSYS); 3275100894Srwatson} 3276100894Srwatson 3277100894Srwatsonint 3278100894Srwatson__mac_set_proc(struct thread *td, struct __mac_set_proc_args *uap) 3279100894Srwatson{ 3280100894Srwatson 3281100894Srwatson return (ENOSYS); 3282100894Srwatson} 3283100894Srwatson 3284100894Srwatsonint 3285100894Srwatson__mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap) 3286100894Srwatson{ 3287100894Srwatson 3288100894Srwatson return (ENOSYS); 3289100894Srwatson} 3290100894Srwatson 3291100894Srwatsonint 3292100894Srwatson__mac_get_file(struct thread *td, struct __mac_get_file_args *uap) 3293100894Srwatson{ 3294100894Srwatson 3295100894Srwatson return (ENOSYS); 3296100894Srwatson} 3297100894Srwatson 3298100894Srwatsonint 3299100894Srwatson__mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap) 3300100894Srwatson{ 3301100894Srwatson 3302100894Srwatson return (ENOSYS); 3303100894Srwatson} 3304100894Srwatson 3305100894Srwatsonint 3306100894Srwatson__mac_set_file(struct thread *td, struct __mac_set_file_args *uap) 3307100894Srwatson{ 3308100894Srwatson 3309100894Srwatson return (ENOSYS); 3310100894Srwatson} 3311100979Srwatson 3312102123Srwatsonint 3313102123Srwatsonmac_syscall(struct thread *td, struct mac_syscall_args *uap) 3314102123Srwatson{ 3315102123Srwatson 3316102123Srwatson return (ENOSYS); 3317102123Srwatson} 3318102123Srwatson 3319100979Srwatson#endif /* !MAC */ 3320