ugidfw_system.c revision 106648 
1/*-
2 * Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson
3 * Copyright (c) 2001, 2002 Networks Associates Technology, Inc.
4 * All rights reserved.
5 *
6 * This software was developed by Robert Watson for the TrustedBSD Project.
7 *
8 * This software was developed for the FreeBSD Project in part by Network
9 * Associates Laboratories, the Security Research Division of Network
10 * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"),
11 * as part of the DARPA CHATS research program.
12 *
13 * Redistribution and use in source and binary forms, with or without
14 * modification, are permitted provided that the following conditions
15 * are met:
16 * 1. Redistributions of source code must retain the above copyright
17 *    notice, this list of conditions and the following disclaimer.
18 * 2. Redistributions in binary form must reproduce the above copyright
19 *    notice, this list of conditions and the following disclaimer in the
20 *    documentation and/or other materials provided with the distribution.
21 *
22 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
23 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
26 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32 * SUCH DAMAGE.
33 *
34 * $FreeBSD: head/sys/security/mac_bsdextended/mac_bsdextended.c 106648 2002-11-08 18:04:36Z rwatson $
35 */
36/*
37 * Developed by the TrustedBSD Project.
38 * "BSD Extended" MAC policy, allowing the administrator to impose
39 * mandatory rules regarding users and some system objects.
40 *
41 * XXX: Much locking support required here.
42 */
43
44#include <sys/types.h>
45#include <sys/param.h>
46#include <sys/acl.h>
47#include <sys/conf.h>
48#include <sys/kernel.h>
49#include <sys/mac.h>
50#include <sys/malloc.h>
51#include <sys/mount.h>
52#include <sys/proc.h>
53#include <sys/systm.h>
54#include <sys/sysproto.h>
55#include <sys/sysent.h>
56#include <sys/vnode.h>
57#include <sys/file.h>
58#include <sys/socket.h>
59#include <sys/socketvar.h>
60#include <sys/sysctl.h>
61
62#include <net/bpfdesc.h>
63#include <net/if.h>
64#include <net/if_types.h>
65#include <net/if_var.h>
66
67#include <vm/vm.h>
68
69#include <sys/mac_policy.h>
70
71#include <security/mac_bsdextended/mac_bsdextended.h>
72
73SYSCTL_DECL(_security_mac);
74
75SYSCTL_NODE(_security_mac, OID_AUTO, bsdextended, CTLFLAG_RW, 0,
76    "TrustedBSD extended BSD MAC policy controls");
77
78static int	mac_bsdextended_enabled = 1;
79SYSCTL_INT(_security_mac_bsdextended, OID_AUTO, enabled, CTLFLAG_RW,
80    &mac_bsdextended_enabled, 0, "Enforce extended BSD policy");
81TUNABLE_INT("security.mac.bsdextended.enabled", &mac_bsdextended_enabled);
82
83MALLOC_DEFINE(M_MACBSDEXTENDED, "mac_bsdextended", "BSD Extended MAC rule");
84
85#define	MAC_BSDEXTENDED_MAXRULES	250
86static struct mac_bsdextended_rule *rules[MAC_BSDEXTENDED_MAXRULES];
87static int rule_count = 0;
88static int rule_slots = 0;
89
90SYSCTL_INT(_security_mac_bsdextended, OID_AUTO, rule_count, CTLFLAG_RD,
91    &rule_count, 0, "Number of defined rules\n");
92SYSCTL_INT(_security_mac_bsdextended, OID_AUTO, rule_slots, CTLFLAG_RD,
93    &rule_slots, 0, "Number of used rule slots\n");
94
95static int mac_bsdextended_debugging;
96SYSCTL_INT(_security_mac_bsdextended, OID_AUTO, debugging, CTLFLAG_RW,
97    &mac_bsdextended_debugging, 0, "Enable debugging on failure");
98
99static int
100mac_bsdextended_rule_valid(struct mac_bsdextended_rule *rule)
101{
102
103	if ((rule->mbr_subject.mbi_flags | MBI_BITS) != MBI_BITS)
104		return (EINVAL);
105
106	if ((rule->mbr_object.mbi_flags | MBI_BITS) != MBI_BITS)
107		return (EINVAL);
108
109	if ((rule->mbr_mode | VALLPERM) != VALLPERM)
110		return (EINVAL);
111
112	return (0);
113}
114
115static int
116sysctl_rule(SYSCTL_HANDLER_ARGS)
117{
118	struct mac_bsdextended_rule temprule, *ruleptr;
119	u_int namelen;
120	int error, index, *name;
121
122	name = (int *)arg1;
123	namelen = arg2;
124
125	/* printf("bsdextended sysctl handler (namelen %d)\n", namelen); */
126
127	if (namelen != 1)
128		return (EINVAL);
129
130	index = name[0];
131	if (index < 0 || index > rule_slots + 1)
132		return (ENOENT);
133	if (rule_slots >= MAC_BSDEXTENDED_MAXRULES)
134		return (ENOENT);
135
136	if (req->oldptr) {
137		if (rules[index] == NULL)
138			return (ENOENT);
139
140		error = SYSCTL_OUT(req, rules[index], sizeof(*rules[index]));
141		if (error)
142			return (error);
143	}
144
145	if (req->newptr) {
146		if (req->newlen == 0) {
147			/* printf("deletion\n"); */
148			ruleptr = rules[index];
149			if (ruleptr == NULL)
150				return (ENOENT);
151			rule_count--;
152			rules[index] = NULL;
153			FREE(ruleptr, M_MACBSDEXTENDED);
154			return(0);
155		}
156		error = SYSCTL_IN(req, &temprule, sizeof(temprule));
157		if (error)
158			return (error);
159
160		error = mac_bsdextended_rule_valid(&temprule);
161		if (error)
162			return (error);
163
164		if (rules[index] == NULL) {
165			/* printf("addition\n"); */
166			MALLOC(ruleptr, struct mac_bsdextended_rule *,
167			    sizeof(*ruleptr), M_MACBSDEXTENDED, M_WAITOK |
168			    M_ZERO);
169			*ruleptr = temprule;
170			rules[index] = ruleptr;
171			if (index+1 > rule_slots)
172				rule_slots = index+1;
173			rule_count++;
174		} else {
175			/* printf("replacement\n"); */
176			*rules[index] = temprule;
177		}
178	}
179
180	return (0);
181}
182
183SYSCTL_NODE(_security_mac_bsdextended, OID_AUTO, rules,
184    CTLFLAG_RW, sysctl_rule, "BSD extended MAC rules");
185
186static void
187mac_bsdextended_init(struct mac_policy_conf *mpc)
188{
189
190	/* Initialize ruleset lock. */
191	/* Register dynamic sysctl's for rules. */
192}
193
194static void
195mac_bsdextended_destroy(struct mac_policy_conf *mpc)
196{
197
198	/* Tear down sysctls. */
199	/* Destroy ruleset lock. */
200}
201
202static int
203mac_bsdextended_rulecheck(struct mac_bsdextended_rule *rule,
204    struct ucred *cred, uid_t object_uid, gid_t object_gid, int acc_mode)
205{
206	int match;
207
208	/*
209	 * Is there a subject match?
210	 */
211	if (rule->mbr_subject.mbi_flags & MBI_UID_DEFINED) {
212		match =  (rule->mbr_subject.mbi_uid == cred->cr_uid ||
213		    rule->mbr_subject.mbi_uid == cred->cr_ruid ||
214		    rule->mbr_subject.mbi_uid == cred->cr_svuid);
215
216		if (rule->mbr_subject.mbi_flags & MBI_NEGATED)
217			match = !match;
218
219		if (!match)
220			return (0);
221	}
222
223	if (rule->mbr_subject.mbi_flags & MBI_GID_DEFINED) {
224		match = (groupmember(rule->mbr_subject.mbi_gid, cred) ||
225		    rule->mbr_subject.mbi_gid == cred->cr_rgid ||
226		    rule->mbr_subject.mbi_gid == cred->cr_svgid);
227
228		if (rule->mbr_subject.mbi_flags & MBI_NEGATED)
229			match = !match;
230
231		if (!match)
232			return (0);
233	}
234
235	/*
236	 * Is there an object match?
237	 */
238	if (rule->mbr_object.mbi_flags & MBI_UID_DEFINED) {
239		match = (rule->mbr_object.mbi_uid == object_uid);
240
241		if (rule->mbr_object.mbi_flags & MBI_NEGATED)
242			match = !match;
243
244		if (!match)
245			return (0);
246	}
247
248	if (rule->mbr_object.mbi_flags & MBI_GID_DEFINED) {
249		match = (rule->mbr_object.mbi_gid == object_gid);
250
251		if (rule->mbr_object.mbi_flags & MBI_NEGATED)
252			match = !match;
253
254		if (!match)
255			return (0);
256	}
257
258	/*
259	 * Is the access permitted?
260	 */
261	if ((rule->mbr_mode & acc_mode) != acc_mode) {
262		if (mac_bsdextended_debugging)
263			printf("mac_bsdextended: %d:%d request %d on %d:%d"
264			    " fails\n", cred->cr_ruid, cred->cr_rgid,
265			    acc_mode, object_uid, object_gid);
266		return (EACCES);
267	}
268
269	return (0);
270}
271
272static int
273mac_bsdextended_check(struct ucred *cred, uid_t object_uid, gid_t object_gid,
274    int acc_mode)
275{
276	int error, i;
277
278	for (i = 0; i < rule_slots; i++) {
279		if (rules[i] == NULL)
280			continue;
281
282		error = mac_bsdextended_rulecheck(rules[i], cred, object_uid,
283		    object_gid, acc_mode);
284		if (error)
285			return (error);
286	}
287
288	return (0);
289}
290
291static int
292mac_bsdextended_check_vnode_access(struct ucred *cred, struct vnode *vp,
293    struct label *label, int acc_mode)
294{
295	struct vattr vap;
296	int error;
297
298	if (!mac_bsdextended_enabled)
299		return (0);
300
301	error = VOP_GETATTR(vp, &vap, cred, curthread);
302	if (error)
303		return (error);
304	return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, acc_mode));
305}
306
307static int
308mac_bsdextended_check_vnode_chdir(struct ucred *cred, struct vnode *dvp,
309    struct label *dlabel)
310{
311	struct vattr vap;
312	int error;
313
314	if (!mac_bsdextended_enabled)
315		return (0);
316
317	error = VOP_GETATTR(dvp, &vap, cred, curthread);
318	if (error)
319		return (error);
320	return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VEXEC));
321}
322
323static int
324mac_bsdextended_check_vnode_chroot(struct ucred *cred, struct vnode *dvp,
325    struct label *dlabel)
326{
327	struct vattr vap;
328	int error;
329
330	if (!mac_bsdextended_enabled)
331		return (0);
332
333	error = VOP_GETATTR(dvp, &vap, cred, curthread);
334	if (error)
335		return (error);
336	return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VEXEC));
337}
338
339static int
340mac_bsdextended_check_create_vnode(struct ucred *cred, struct vnode *dvp,
341    struct label *dlabel, struct componentname *cnp, struct vattr *vap)
342{
343	struct vattr dvap;
344	int error;
345
346	if (!mac_bsdextended_enabled)
347		return (0);
348
349	error = VOP_GETATTR(dvp, &dvap, cred, curthread);
350	if (error)
351		return (error);
352	return (mac_bsdextended_check(cred, dvap.va_uid, dvap.va_gid, VWRITE));
353}
354
355static int
356mac_bsdextended_check_vnode_delete(struct ucred *cred, struct vnode *dvp,
357    struct label *dlabel, struct vnode *vp, struct label *label,
358    struct componentname *cnp)
359{
360	struct vattr vap;
361	int error;
362
363	if (!mac_bsdextended_enabled)
364		return (0);
365
366	error = VOP_GETATTR(dvp, &vap, cred, curthread);
367	if (error)
368		return (error);
369	error = mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VWRITE);
370	if (error)
371		return (error);
372
373	error = VOP_GETATTR(vp, &vap, cred, curthread);
374	if (error)
375		return (error);
376	return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VWRITE));
377}
378
379static int
380mac_bsdextended_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp,
381    struct label *label, acl_type_t type)
382{
383	struct vattr vap;
384	int error;
385
386	if (!mac_bsdextended_enabled)
387		return (0);
388
389	error = VOP_GETATTR(vp, &vap, cred, curthread);
390	if (error)
391		return (error);
392	return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VADMIN));
393}
394
395static int
396mac_bsdextended_check_vnode_exec(struct ucred *cred, struct vnode *vp,
397    struct label *label, struct image_params *imgp,
398    struct label *execlabel)
399{
400	struct vattr vap;
401	int error;
402
403	if (!mac_bsdextended_enabled)
404		return (0);
405
406	error = VOP_GETATTR(vp, &vap, cred, curthread);
407	if (error)
408		return (error);
409	return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid,
410	    VREAD|VEXEC));
411}
412
413static int
414mac_bsdextended_check_vnode_getacl(struct ucred *cred, struct vnode *vp,
415    struct label *label, acl_type_t type)
416{
417	struct vattr vap;
418	int error;
419
420	if (!mac_bsdextended_enabled)
421		return (0);
422
423	error = VOP_GETATTR(vp, &vap, cred, curthread);
424	if (error)
425		return (error);
426	return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VSTAT));
427}
428
429static int
430mac_bsdextended_check_vnode_getextattr(struct ucred *cred, struct vnode *vp,
431    struct label *label, int attrnamespace, const char *name, struct uio *uio)
432{
433	struct vattr vap;
434	int error;
435
436	if (!mac_bsdextended_enabled)
437		return (0);
438
439	error = VOP_GETATTR(vp, &vap, cred, curthread);
440	if (error)
441		return (error);
442	return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VREAD));
443}
444
445static int
446mac_bsdextended_check_vnode_link(struct ucred *cred, struct vnode *dvp,
447    struct label *dlabel, struct vnode *vp, struct label *label,
448    struct componentname *cnp)
449{
450	struct vattr vap;
451	int error;
452
453	if (!mac_bsdextended_enabled)
454		return (0);
455
456	error = VOP_GETATTR(dvp, &vap, cred, curthread);
457	if (error)
458		return (error);
459	error = mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VWRITE);
460	if (error)
461		return (error);
462
463	error = VOP_GETATTR(vp, &vap, cred, curthread);
464	if (error)
465		return (error);
466	error = mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VWRITE);
467	if (error)
468		return (error);
469	return (0);
470}
471
472static int
473mac_bsdextended_check_vnode_lookup(struct ucred *cred, struct vnode *dvp,
474    struct label *dlabel, struct componentname *cnp)
475{
476	struct vattr vap;
477	int error;
478
479	if (!mac_bsdextended_enabled)
480		return (0);
481
482	error = VOP_GETATTR(dvp, &vap, cred, curthread);
483	if (error)
484		return (error);
485	return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VEXEC));
486}
487
488static int
489mac_bsdextended_check_vnode_open(struct ucred *cred, struct vnode *vp,
490    struct label *filelabel, int acc_mode)
491{
492	struct vattr vap;
493	int error;
494
495	if (!mac_bsdextended_enabled)
496		return (0);
497
498	error = VOP_GETATTR(vp, &vap, cred, curthread);
499	if (error)
500		return (error);
501	return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, acc_mode));
502}
503
504static int
505mac_bsdextended_check_vnode_readdir(struct ucred *cred, struct vnode *dvp,
506    struct label *dlabel)
507{
508	struct vattr vap;
509	int error;
510
511	if (!mac_bsdextended_enabled)
512		return (0);
513
514	error = VOP_GETATTR(dvp, &vap, cred, curthread);
515	if (error)
516		return (error);
517	return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VREAD));
518}
519
520static int
521mac_bsdextended_check_vnode_readdlink(struct ucred *cred, struct vnode *vp,
522    struct label *label)
523{
524	struct vattr vap;
525	int error;
526
527	if (!mac_bsdextended_enabled)
528		return (0);
529
530	error = VOP_GETATTR(vp, &vap, cred, curthread);
531	if (error)
532		return (error);
533	return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VREAD));
534}
535
536static int
537mac_bsdextended_check_vnode_rename_from(struct ucred *cred, struct vnode *dvp,
538    struct label *dlabel, struct vnode *vp, struct label *label,
539    struct componentname *cnp)
540{
541	struct vattr vap;
542	int error;
543
544	if (!mac_bsdextended_enabled)
545		return (0);
546
547	error = VOP_GETATTR(dvp, &vap, cred, curthread);
548	if (error)
549		return (error);
550	error = mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VWRITE);
551	if (error)
552		return (error);
553	error = VOP_GETATTR(vp, &vap, cred, curthread);
554	if (error)
555		return (error);
556	error = mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VWRITE);
557
558	return (error);
559}
560
561static int
562mac_bsdextended_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp,
563    struct label *dlabel, struct vnode *vp, struct label *label, int samedir,
564    struct componentname *cnp)
565{
566	struct vattr vap;
567	int error;
568
569	if (!mac_bsdextended_enabled)
570		return (0);
571
572	error = VOP_GETATTR(dvp, &vap, cred, curthread);
573	if (error)
574		return (error);
575	error = mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VWRITE);
576	if (error)
577		return (error);
578
579	if (vp != NULL) {
580		error = VOP_GETATTR(vp, &vap, cred, curthread);
581		if (error)
582			return (error);
583		error = mac_bsdextended_check(cred, vap.va_uid, vap.va_gid,
584		    VWRITE);
585	}
586
587	return (error);
588}
589
590static int
591mac_bsdextended_check_vnode_revoke(struct ucred *cred, struct vnode *vp,
592    struct label *label)
593{
594	struct vattr vap;
595	int error;
596
597	if (!mac_bsdextended_enabled)
598		return (0);
599
600	error = VOP_GETATTR(vp, &vap, cred, curthread);
601	if (error)
602		return (error);
603	return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VADMIN));
604}
605
606static int
607mac_bsdextended_check_setacl_vnode(struct ucred *cred, struct vnode *vp,
608    struct label *label, acl_type_t type, struct acl *acl)
609{
610	struct vattr vap;
611	int error;
612
613	if (!mac_bsdextended_enabled)
614		return (0);
615
616	error = VOP_GETATTR(vp, &vap, cred, curthread);
617	if (error)
618		return (error);
619	return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VADMIN));
620}
621
622static int
623mac_bsdextended_check_vnode_setextattr(struct ucred *cred, struct vnode *vp,
624    struct label *label, int attrnamespace, const char *name, struct uio *uio)
625{
626	struct vattr vap;
627	int error;
628
629	if (!mac_bsdextended_enabled)
630		return (0);
631
632	error = VOP_GETATTR(vp, &vap, cred, curthread);
633	if (error)
634		return (error);
635	return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VWRITE));
636}
637
638static int
639mac_bsdextended_check_vnode_setflags(struct ucred *cred, struct vnode *vp,
640    struct label *label, u_long flags)
641{
642	struct vattr vap;
643	int error;
644
645	if (!mac_bsdextended_enabled)
646		return (0);
647
648	error = VOP_GETATTR(vp, &vap, cred, curthread);
649	if (error)
650		return (error);
651	return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VADMIN));
652}
653
654static int
655mac_bsdextended_check_vnode_setmode(struct ucred *cred, struct vnode *vp,
656    struct label *label, mode_t mode)
657{
658	struct vattr vap;
659	int error;
660
661	if (!mac_bsdextended_enabled)
662		return (0);
663
664	error = VOP_GETATTR(vp, &vap, cred, curthread);
665	if (error)
666		return (error);
667	return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VADMIN));
668}
669
670static int
671mac_bsdextended_check_vnode_setowner(struct ucred *cred, struct vnode *vp,
672    struct label *label, uid_t uid, gid_t gid)
673{
674	struct vattr vap;
675	int error;
676
677	if (!mac_bsdextended_enabled)
678		return (0);
679
680	error = VOP_GETATTR(vp, &vap, cred, curthread);
681	if (error)
682		return (error);
683	return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VADMIN));
684}
685
686static int
687mac_bsdextended_check_vnode_setutimes(struct ucred *cred, struct vnode *vp,
688    struct label *label, struct timespec atime, struct timespec utime)
689{
690	struct vattr vap;
691	int error;
692
693	if (!mac_bsdextended_enabled)
694		return (0);
695
696	error = VOP_GETATTR(vp, &vap, cred, curthread);
697	if (error)
698		return (error);
699	return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VADMIN));
700}
701
702static int
703mac_bsdextended_check_vnode_stat(struct ucred *active_cred,
704    struct ucred *file_cred, struct vnode *vp, struct label *label)
705{
706	struct vattr vap;
707	int error;
708
709	if (!mac_bsdextended_enabled)
710		return (0);
711
712	error = VOP_GETATTR(vp, &vap, active_cred, curthread);
713	if (error)
714		return (error);
715	return (mac_bsdextended_check(active_cred, vap.va_uid, vap.va_gid,
716	    VSTAT));
717}
718
719static struct mac_policy_ops mac_bsdextended_ops =
720{
721	.mpo_destroy = mac_bsdextended_destroy,
722	.mpo_init = mac_bsdextended_init,
723	.mpo_check_vnode_access = mac_bsdextended_check_vnode_access,
724	.mpo_check_vnode_chdir = mac_bsdextended_check_vnode_chdir,
725	.mpo_check_vnode_chroot = mac_bsdextended_check_vnode_chroot,
726	.mpo_check_vnode_create = mac_bsdextended_check_create_vnode,
727	.mpo_check_vnode_delete = mac_bsdextended_check_vnode_delete,
728	.mpo_check_vnode_deleteacl = mac_bsdextended_check_vnode_deleteacl,
729	.mpo_check_vnode_exec = mac_bsdextended_check_vnode_exec,
730	.mpo_check_vnode_getacl = mac_bsdextended_check_vnode_getacl,
731	.mpo_check_vnode_getextattr = mac_bsdextended_check_vnode_getextattr,
732	.mpo_check_vnode_link = mac_bsdextended_check_vnode_link,
733	.mpo_check_vnode_lookup = mac_bsdextended_check_vnode_lookup,
734	.mpo_check_vnode_open = mac_bsdextended_check_vnode_open,
735	.mpo_check_vnode_readdir = mac_bsdextended_check_vnode_readdir,
736	.mpo_check_vnode_readlink = mac_bsdextended_check_vnode_readdlink,
737	.mpo_check_vnode_rename_from = mac_bsdextended_check_vnode_rename_from,
738	.mpo_check_vnode_rename_to = mac_bsdextended_check_vnode_rename_to,
739	.mpo_check_vnode_revoke = mac_bsdextended_check_vnode_revoke,
740	.mpo_check_vnode_setacl = mac_bsdextended_check_setacl_vnode,
741	.mpo_check_vnode_setextattr = mac_bsdextended_check_vnode_setextattr,
742	.mpo_check_vnode_setflags = mac_bsdextended_check_vnode_setflags,
743	.mpo_check_vnode_setmode = mac_bsdextended_check_vnode_setmode,
744	.mpo_check_vnode_setowner = mac_bsdextended_check_vnode_setowner,
745	.mpo_check_vnode_setutimes = mac_bsdextended_check_vnode_setutimes,
746	.mpo_check_vnode_stat = mac_bsdextended_check_vnode_stat,
747};
748
749MAC_POLICY_SET(&mac_bsdextended_ops, trustedbsd_mac_bsdextended,
750    "TrustedBSD MAC/BSD Extended", MPC_LOADTIME_FLAG_UNLOADOK, NULL);
751