mac_lomac.c revision 184413
1/*-
2 * Copyright (c) 1999-2002, 2007-2008 Robert N. M. Watson
3 * Copyright (c) 2001-2005 Networks Associates Technology, Inc.
4 * Copyright (c) 2006 SPARTA, Inc.
5 * All rights reserved.
6 *
7 * This software was developed by Robert Watson for the TrustedBSD Project.
8 *
9 * This software was developed for the FreeBSD Project in part by NAI Labs,
10 * the Security Research Division of Network Associates, Inc. under
11 * DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA
12 * CHATS research program.
13 *
14 * This software was enhanced by SPARTA ISSO under SPAWAR contract
15 * N66001-04-C-6019 ("SEFOS").
16 *
17 * Redistribution and use in source and binary forms, with or without
18 * modification, are permitted provided that the following conditions
19 * are met:
20 * 1. Redistributions of source code must retain the above copyright
21 *    notice, this list of conditions and the following disclaimer.
22 * 2. Redistributions in binary form must reproduce the above copyright
23 *    notice, this list of conditions and the following disclaimer in the
24 *    documentation and/or other materials provided with the distribution.
25 *
26 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
27 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
28 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
29 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
30 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
31 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
32 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
33 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
34 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
35 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
36 * SUCH DAMAGE.
37 *
38 * $FreeBSD: head/sys/security/mac_lomac/mac_lomac.c 184413 2008-10-28 13:44:11Z trasz $
39 */
40
41/*
42 * Developed by the TrustedBSD Project.
43 *
44 * Low-watermark floating label mandatory integrity policy.
45 */
46
47#include <sys/types.h>
48#include <sys/param.h>
49#include <sys/acl.h>
50#include <sys/conf.h>
51#include <sys/extattr.h>
52#include <sys/kernel.h>
53#include <sys/malloc.h>
54#include <sys/mman.h>
55#include <sys/mount.h>
56#include <sys/priv.h>
57#include <sys/proc.h>
58#include <sys/sbuf.h>
59#include <sys/systm.h>
60#include <sys/sysproto.h>
61#include <sys/sysent.h>
62#include <sys/systm.h>
63#include <sys/vnode.h>
64#include <sys/file.h>
65#include <sys/socket.h>
66#include <sys/socketvar.h>
67#include <sys/sx.h>
68#include <sys/pipe.h>
69#include <sys/sysctl.h>
70#include <sys/syslog.h>
71
72#include <fs/devfs/devfs.h>
73
74#include <net/bpfdesc.h>
75#include <net/if.h>
76#include <net/if_types.h>
77#include <net/if_var.h>
78
79#include <netinet/in.h>
80#include <netinet/in_pcb.h>
81#include <netinet/ip_var.h>
82
83#include <vm/vm.h>
84
85#include <security/mac/mac_policy.h>
86#include <security/mac/mac_framework.h>
87#include <security/mac_lomac/mac_lomac.h>
88
89struct mac_lomac_proc {
90	struct mac_lomac mac_lomac;
91	struct mtx mtx;
92};
93
94SYSCTL_DECL(_security_mac);
95
96SYSCTL_NODE(_security_mac, OID_AUTO, lomac, CTLFLAG_RW, 0,
97    "TrustedBSD mac_lomac policy controls");
98
99static int	lomac_label_size = sizeof(struct mac_lomac);
100SYSCTL_INT(_security_mac_lomac, OID_AUTO, label_size, CTLFLAG_RD,
101    &lomac_label_size, 0, "Size of struct mac_lomac");
102
103static int	lomac_enabled = 1;
104SYSCTL_INT(_security_mac_lomac, OID_AUTO, enabled, CTLFLAG_RW,
105    &lomac_enabled, 0, "Enforce MAC/LOMAC policy");
106TUNABLE_INT("security.mac.lomac.enabled", &lomac_enabled);
107
108static int	destroyed_not_inited;
109SYSCTL_INT(_security_mac_lomac, OID_AUTO, destroyed_not_inited, CTLFLAG_RD,
110    &destroyed_not_inited, 0, "Count of labels destroyed but not inited");
111
112static int	trust_all_interfaces = 0;
113SYSCTL_INT(_security_mac_lomac, OID_AUTO, trust_all_interfaces, CTLFLAG_RD,
114    &trust_all_interfaces, 0, "Consider all interfaces 'trusted' by MAC/LOMAC");
115TUNABLE_INT("security.mac.lomac.trust_all_interfaces", &trust_all_interfaces);
116
117static char	trusted_interfaces[128];
118SYSCTL_STRING(_security_mac_lomac, OID_AUTO, trusted_interfaces, CTLFLAG_RD,
119    trusted_interfaces, 0, "Interfaces considered 'trusted' by MAC/LOMAC");
120TUNABLE_STR("security.mac.lomac.trusted_interfaces", trusted_interfaces,
121    sizeof(trusted_interfaces));
122
123static int	ptys_equal = 0;
124SYSCTL_INT(_security_mac_lomac, OID_AUTO, ptys_equal, CTLFLAG_RW,
125    &ptys_equal, 0, "Label pty devices as lomac/equal on create");
126TUNABLE_INT("security.mac.lomac.ptys_equal", &ptys_equal);
127
128static int	revocation_enabled = 1;
129SYSCTL_INT(_security_mac_lomac, OID_AUTO, revocation_enabled, CTLFLAG_RW,
130    &revocation_enabled, 0, "Revoke access to objects on relabel");
131TUNABLE_INT("security.mac.lomac.revocation_enabled", &revocation_enabled);
132
133static int	lomac_slot;
134#define	SLOT(l)	((struct mac_lomac *)mac_label_get((l), lomac_slot))
135#define	SLOT_SET(l, val) mac_label_set((l), lomac_slot, (uintptr_t)(val))
136#define	PSLOT(l) ((struct mac_lomac_proc *)				\
137    mac_label_get((l), lomac_slot))
138#define	PSLOT_SET(l, val) mac_label_set((l), lomac_slot, (uintptr_t)(val))
139
140MALLOC_DEFINE(M_LOMAC, "mac_lomac_label", "MAC/LOMAC labels");
141
142static struct mac_lomac *
143lomac_alloc(int flag)
144{
145	struct mac_lomac *ml;
146
147	ml = malloc(sizeof(*ml), M_LOMAC, M_ZERO | flag);
148
149	return (ml);
150}
151
152static void
153lomac_free(struct mac_lomac *ml)
154{
155
156	if (ml != NULL)
157		free(ml, M_LOMAC);
158	else
159		atomic_add_int(&destroyed_not_inited, 1);
160}
161
162static int
163lomac_atmostflags(struct mac_lomac *ml, int flags)
164{
165
166	if ((ml->ml_flags & flags) != ml->ml_flags)
167		return (EINVAL);
168	return (0);
169}
170
171static int
172lomac_dominate_element(struct mac_lomac_element *a,
173    struct mac_lomac_element *b)
174{
175
176	switch (a->mle_type) {
177	case MAC_LOMAC_TYPE_EQUAL:
178	case MAC_LOMAC_TYPE_HIGH:
179		return (1);
180
181	case MAC_LOMAC_TYPE_LOW:
182		switch (b->mle_type) {
183		case MAC_LOMAC_TYPE_GRADE:
184		case MAC_LOMAC_TYPE_HIGH:
185			return (0);
186
187		case MAC_LOMAC_TYPE_EQUAL:
188		case MAC_LOMAC_TYPE_LOW:
189			return (1);
190
191		default:
192			panic("lomac_dominate_element: b->mle_type invalid");
193		}
194
195	case MAC_LOMAC_TYPE_GRADE:
196		switch (b->mle_type) {
197		case MAC_LOMAC_TYPE_EQUAL:
198		case MAC_LOMAC_TYPE_LOW:
199			return (1);
200
201		case MAC_LOMAC_TYPE_HIGH:
202			return (0);
203
204		case MAC_LOMAC_TYPE_GRADE:
205			return (a->mle_grade >= b->mle_grade);
206
207		default:
208			panic("lomac_dominate_element: b->mle_type invalid");
209		}
210
211	default:
212		panic("lomac_dominate_element: a->mle_type invalid");
213	}
214}
215
216static int
217lomac_range_in_range(struct mac_lomac *rangea, struct mac_lomac *rangeb)
218{
219
220	return (lomac_dominate_element(&rangeb->ml_rangehigh,
221	    &rangea->ml_rangehigh) &&
222	    lomac_dominate_element(&rangea->ml_rangelow,
223	    &rangeb->ml_rangelow));
224}
225
226static int
227lomac_single_in_range(struct mac_lomac *single, struct mac_lomac *range)
228{
229
230	KASSERT((single->ml_flags & MAC_LOMAC_FLAG_SINGLE) != 0,
231	    ("lomac_single_in_range: a not single"));
232	KASSERT((range->ml_flags & MAC_LOMAC_FLAG_RANGE) != 0,
233	    ("lomac_single_in_range: b not range"));
234
235	return (lomac_dominate_element(&range->ml_rangehigh,
236	    &single->ml_single) && lomac_dominate_element(&single->ml_single,
237	    &range->ml_rangelow));
238}
239
240static int
241lomac_auxsingle_in_range(struct mac_lomac *single, struct mac_lomac *range)
242{
243
244	KASSERT((single->ml_flags & MAC_LOMAC_FLAG_AUX) != 0,
245	    ("lomac_single_in_range: a not auxsingle"));
246	KASSERT((range->ml_flags & MAC_LOMAC_FLAG_RANGE) != 0,
247	    ("lomac_single_in_range: b not range"));
248
249	return (lomac_dominate_element(&range->ml_rangehigh,
250	    &single->ml_auxsingle) &&
251	    lomac_dominate_element(&single->ml_auxsingle,
252	    &range->ml_rangelow));
253}
254
255static int
256lomac_dominate_single(struct mac_lomac *a, struct mac_lomac *b)
257{
258	KASSERT((a->ml_flags & MAC_LOMAC_FLAG_SINGLE) != 0,
259	    ("lomac_dominate_single: a not single"));
260	KASSERT((b->ml_flags & MAC_LOMAC_FLAG_SINGLE) != 0,
261	    ("lomac_dominate_single: b not single"));
262
263	return (lomac_dominate_element(&a->ml_single, &b->ml_single));
264}
265
266static int
267lomac_subject_dominate(struct mac_lomac *a, struct mac_lomac *b)
268{
269	KASSERT((~a->ml_flags &
270	    (MAC_LOMAC_FLAG_SINGLE | MAC_LOMAC_FLAG_RANGE)) == 0,
271	    ("lomac_dominate_single: a not subject"));
272	KASSERT((b->ml_flags & MAC_LOMAC_FLAG_SINGLE) != 0,
273	    ("lomac_dominate_single: b not single"));
274
275	return (lomac_dominate_element(&a->ml_rangehigh, &b->ml_single));
276}
277
278static int
279lomac_equal_element(struct mac_lomac_element *a, struct mac_lomac_element *b)
280{
281
282	if (a->mle_type == MAC_LOMAC_TYPE_EQUAL ||
283	    b->mle_type == MAC_LOMAC_TYPE_EQUAL)
284		return (1);
285
286	return (a->mle_type == b->mle_type && a->mle_grade == b->mle_grade);
287}
288
289static int
290lomac_equal_single(struct mac_lomac *a, struct mac_lomac *b)
291{
292
293	KASSERT((a->ml_flags & MAC_LOMAC_FLAG_SINGLE) != 0,
294	    ("lomac_equal_single: a not single"));
295	KASSERT((b->ml_flags & MAC_LOMAC_FLAG_SINGLE) != 0,
296	    ("lomac_equal_single: b not single"));
297
298	return (lomac_equal_element(&a->ml_single, &b->ml_single));
299}
300
301static int
302lomac_contains_equal(struct mac_lomac *ml)
303{
304
305	if (ml->ml_flags & MAC_LOMAC_FLAG_SINGLE)
306		if (ml->ml_single.mle_type == MAC_LOMAC_TYPE_EQUAL)
307			return (1);
308	if (ml->ml_flags & MAC_LOMAC_FLAG_AUX)
309		if (ml->ml_auxsingle.mle_type == MAC_LOMAC_TYPE_EQUAL)
310			return (1);
311
312	if (ml->ml_flags & MAC_LOMAC_FLAG_RANGE) {
313		if (ml->ml_rangelow.mle_type == MAC_LOMAC_TYPE_EQUAL)
314			return (1);
315		if (ml->ml_rangehigh.mle_type == MAC_LOMAC_TYPE_EQUAL)
316			return (1);
317	}
318
319	return (0);
320}
321
322static int
323lomac_subject_privileged(struct mac_lomac *ml)
324{
325
326	KASSERT((ml->ml_flags & MAC_LOMAC_FLAGS_BOTH) ==
327	    MAC_LOMAC_FLAGS_BOTH,
328	    ("lomac_subject_privileged: subject doesn't have both labels"));
329
330	/* If the single is EQUAL, it's ok. */
331	if (ml->ml_single.mle_type == MAC_LOMAC_TYPE_EQUAL)
332		return (0);
333
334	/* If either range endpoint is EQUAL, it's ok. */
335	if (ml->ml_rangelow.mle_type == MAC_LOMAC_TYPE_EQUAL ||
336	    ml->ml_rangehigh.mle_type == MAC_LOMAC_TYPE_EQUAL)
337		return (0);
338
339	/* If the range is low-high, it's ok. */
340	if (ml->ml_rangelow.mle_type == MAC_LOMAC_TYPE_LOW &&
341	    ml->ml_rangehigh.mle_type == MAC_LOMAC_TYPE_HIGH)
342		return (0);
343
344	/* It's not ok. */
345	return (EPERM);
346}
347
348static int
349lomac_high_single(struct mac_lomac *ml)
350{
351
352	KASSERT((ml->ml_flags & MAC_LOMAC_FLAG_SINGLE) != 0,
353	    ("lomac_high_single: mac_lomac not single"));
354
355	return (ml->ml_single.mle_type == MAC_LOMAC_TYPE_HIGH);
356}
357
358static int
359lomac_valid(struct mac_lomac *ml)
360{
361
362	if (ml->ml_flags & MAC_LOMAC_FLAG_SINGLE) {
363		switch (ml->ml_single.mle_type) {
364		case MAC_LOMAC_TYPE_GRADE:
365		case MAC_LOMAC_TYPE_EQUAL:
366		case MAC_LOMAC_TYPE_HIGH:
367		case MAC_LOMAC_TYPE_LOW:
368			break;
369
370		default:
371			return (EINVAL);
372		}
373	} else {
374		if (ml->ml_single.mle_type != MAC_LOMAC_TYPE_UNDEF)
375			return (EINVAL);
376	}
377
378	if (ml->ml_flags & MAC_LOMAC_FLAG_AUX) {
379		switch (ml->ml_auxsingle.mle_type) {
380		case MAC_LOMAC_TYPE_GRADE:
381		case MAC_LOMAC_TYPE_EQUAL:
382		case MAC_LOMAC_TYPE_HIGH:
383		case MAC_LOMAC_TYPE_LOW:
384			break;
385
386		default:
387			return (EINVAL);
388		}
389	} else {
390		if (ml->ml_auxsingle.mle_type != MAC_LOMAC_TYPE_UNDEF)
391			return (EINVAL);
392	}
393
394	if (ml->ml_flags & MAC_LOMAC_FLAG_RANGE) {
395		switch (ml->ml_rangelow.mle_type) {
396		case MAC_LOMAC_TYPE_GRADE:
397		case MAC_LOMAC_TYPE_EQUAL:
398		case MAC_LOMAC_TYPE_HIGH:
399		case MAC_LOMAC_TYPE_LOW:
400			break;
401
402		default:
403			return (EINVAL);
404		}
405
406		switch (ml->ml_rangehigh.mle_type) {
407		case MAC_LOMAC_TYPE_GRADE:
408		case MAC_LOMAC_TYPE_EQUAL:
409		case MAC_LOMAC_TYPE_HIGH:
410		case MAC_LOMAC_TYPE_LOW:
411			break;
412
413		default:
414			return (EINVAL);
415		}
416		if (!lomac_dominate_element(&ml->ml_rangehigh,
417		    &ml->ml_rangelow))
418			return (EINVAL);
419	} else {
420		if (ml->ml_rangelow.mle_type != MAC_LOMAC_TYPE_UNDEF ||
421		    ml->ml_rangehigh.mle_type != MAC_LOMAC_TYPE_UNDEF)
422			return (EINVAL);
423	}
424
425	return (0);
426}
427
428static void
429lomac_set_range(struct mac_lomac *ml, u_short typelow, u_short gradelow,
430    u_short typehigh, u_short gradehigh)
431{
432
433	ml->ml_rangelow.mle_type = typelow;
434	ml->ml_rangelow.mle_grade = gradelow;
435	ml->ml_rangehigh.mle_type = typehigh;
436	ml->ml_rangehigh.mle_grade = gradehigh;
437	ml->ml_flags |= MAC_LOMAC_FLAG_RANGE;
438}
439
440static void
441lomac_set_single(struct mac_lomac *ml, u_short type, u_short grade)
442{
443
444	ml->ml_single.mle_type = type;
445	ml->ml_single.mle_grade = grade;
446	ml->ml_flags |= MAC_LOMAC_FLAG_SINGLE;
447}
448
449static void
450lomac_copy_range(struct mac_lomac *labelfrom, struct mac_lomac *labelto)
451{
452
453	KASSERT((labelfrom->ml_flags & MAC_LOMAC_FLAG_RANGE) != 0,
454	    ("lomac_copy_range: labelfrom not range"));
455
456	labelto->ml_rangelow = labelfrom->ml_rangelow;
457	labelto->ml_rangehigh = labelfrom->ml_rangehigh;
458	labelto->ml_flags |= MAC_LOMAC_FLAG_RANGE;
459}
460
461static void
462lomac_copy_single(struct mac_lomac *labelfrom, struct mac_lomac *labelto)
463{
464
465	KASSERT((labelfrom->ml_flags & MAC_LOMAC_FLAG_SINGLE) != 0,
466	    ("lomac_copy_single: labelfrom not single"));
467
468	labelto->ml_single = labelfrom->ml_single;
469	labelto->ml_flags |= MAC_LOMAC_FLAG_SINGLE;
470}
471
472static void
473lomac_copy_auxsingle(struct mac_lomac *labelfrom, struct mac_lomac *labelto)
474{
475
476	KASSERT((labelfrom->ml_flags & MAC_LOMAC_FLAG_AUX) != 0,
477	    ("lomac_copy_auxsingle: labelfrom not auxsingle"));
478
479	labelto->ml_auxsingle = labelfrom->ml_auxsingle;
480	labelto->ml_flags |= MAC_LOMAC_FLAG_AUX;
481}
482
483static void
484lomac_copy(struct mac_lomac *source, struct mac_lomac *dest)
485{
486
487	if (source->ml_flags & MAC_LOMAC_FLAG_SINGLE)
488		lomac_copy_single(source, dest);
489	if (source->ml_flags & MAC_LOMAC_FLAG_AUX)
490		lomac_copy_auxsingle(source, dest);
491	if (source->ml_flags & MAC_LOMAC_FLAG_RANGE)
492		lomac_copy_range(source, dest);
493}
494
495static int	lomac_to_string(struct sbuf *sb, struct mac_lomac *ml);
496
497static int
498maybe_demote(struct mac_lomac *subjlabel, struct mac_lomac *objlabel,
499    const char *actionname, const char *objname, struct vnode *vp)
500{
501	struct sbuf subjlabel_sb, subjtext_sb, objlabel_sb;
502	char *subjlabeltext, *objlabeltext, *subjtext;
503	struct mac_lomac cached_subjlabel;
504	struct mac_lomac_proc *subj;
505	struct vattr va;
506	struct proc *p;
507	pid_t pgid;
508
509	subj = PSLOT(curthread->td_proc->p_label);
510
511	p = curthread->td_proc;
512	mtx_lock(&subj->mtx);
513        if (subj->mac_lomac.ml_flags & MAC_LOMAC_FLAG_UPDATE) {
514		/*
515		 * Check to see if the pending demotion would be more or less
516		 * severe than this one, and keep the more severe.  This can
517		 * only happen for a multi-threaded application.
518		 */
519		if (lomac_dominate_single(objlabel, &subj->mac_lomac)) {
520			mtx_unlock(&subj->mtx);
521			return (0);
522		}
523	}
524	bzero(&subj->mac_lomac, sizeof(subj->mac_lomac));
525	/*
526	 * Always demote the single label.
527	 */
528	lomac_copy_single(objlabel, &subj->mac_lomac);
529	/*
530	 * Start with the original range, then minimize each side of the
531	 * range to the point of not dominating the object.  The high side
532	 * will always be demoted, of course.
533	 */
534	lomac_copy_range(subjlabel, &subj->mac_lomac);
535	if (!lomac_dominate_element(&objlabel->ml_single,
536	    &subj->mac_lomac.ml_rangelow))
537		subj->mac_lomac.ml_rangelow = objlabel->ml_single;
538	subj->mac_lomac.ml_rangehigh = objlabel->ml_single;
539	subj->mac_lomac.ml_flags |= MAC_LOMAC_FLAG_UPDATE;
540	thread_lock(curthread);
541	curthread->td_flags |= TDF_ASTPENDING | TDF_MACPEND;
542	thread_unlock(curthread);
543
544	/*
545	 * Avoid memory allocation while holding a mutex; cache the label.
546	 */
547	lomac_copy_single(&subj->mac_lomac, &cached_subjlabel);
548	mtx_unlock(&subj->mtx);
549
550	sbuf_new(&subjlabel_sb, NULL, 0, SBUF_AUTOEXTEND);
551	lomac_to_string(&subjlabel_sb, subjlabel);
552	sbuf_finish(&subjlabel_sb);
553	subjlabeltext = sbuf_data(&subjlabel_sb);
554
555	sbuf_new(&subjtext_sb, NULL, 0, SBUF_AUTOEXTEND);
556	lomac_to_string(&subjtext_sb, &subj->mac_lomac);
557	sbuf_finish(&subjtext_sb);
558	subjtext = sbuf_data(&subjtext_sb);
559
560	sbuf_new(&objlabel_sb, NULL, 0, SBUF_AUTOEXTEND);
561	lomac_to_string(&objlabel_sb, objlabel);
562	sbuf_finish(&objlabel_sb);
563	objlabeltext = sbuf_data(&objlabel_sb);
564
565	pgid = p->p_pgrp->pg_id;		/* XXX could be stale? */
566	if (vp != NULL && VOP_GETATTR(vp, &va, curthread->td_ucred) == 0) {
567		log(LOG_INFO, "LOMAC: level-%s subject p%dg%du%d:%s demoted to"
568		    " level %s after %s a level-%s %s (inode=%ld, "
569		    "mountpount=%s)\n",
570		    subjlabeltext, p->p_pid, pgid, curthread->td_ucred->cr_uid,
571		    p->p_comm, subjtext, actionname, objlabeltext, objname,
572		    va.va_fileid, vp->v_mount->mnt_stat.f_mntonname);
573	} else {
574		log(LOG_INFO, "LOMAC: level-%s subject p%dg%du%d:%s demoted to"
575		    " level %s after %s a level-%s %s\n",
576		    subjlabeltext, p->p_pid, pgid, curthread->td_ucred->cr_uid,
577		    p->p_comm, subjtext, actionname, objlabeltext, objname);
578	}
579
580	sbuf_delete(&subjlabel_sb);
581	sbuf_delete(&subjtext_sb);
582	sbuf_delete(&objlabel_sb);
583
584	return (0);
585}
586
587/*
588 * Relabel "to" to "from" only if "from" is a valid label (contains at least
589 * a single), as for a relabel operation which may or may not involve a
590 * relevant label.
591 */
592static void
593try_relabel(struct mac_lomac *from, struct mac_lomac *to)
594{
595
596	if (from->ml_flags & MAC_LOMAC_FLAG_SINGLE) {
597		bzero(to, sizeof(*to));
598		lomac_copy(from, to);
599	}
600}
601
602/*
603 * Policy module operations.
604 */
605static void
606lomac_init(struct mac_policy_conf *conf)
607{
608
609}
610
611/*
612 * Label operations.
613 */
614static void
615lomac_init_label(struct label *label)
616{
617
618	SLOT_SET(label, lomac_alloc(M_WAITOK));
619}
620
621static int
622lomac_init_label_waitcheck(struct label *label, int flag)
623{
624
625	SLOT_SET(label, lomac_alloc(flag));
626	if (SLOT(label) == NULL)
627		return (ENOMEM);
628
629	return (0);
630}
631
632static void
633lomac_destroy_label(struct label *label)
634{
635
636	lomac_free(SLOT(label));
637	SLOT_SET(label, NULL);
638}
639
640static int
641lomac_element_to_string(struct sbuf *sb, struct mac_lomac_element *element)
642{
643
644	switch (element->mle_type) {
645	case MAC_LOMAC_TYPE_HIGH:
646		return (sbuf_printf(sb, "high"));
647
648	case MAC_LOMAC_TYPE_LOW:
649		return (sbuf_printf(sb, "low"));
650
651	case MAC_LOMAC_TYPE_EQUAL:
652		return (sbuf_printf(sb, "equal"));
653
654	case MAC_LOMAC_TYPE_GRADE:
655		return (sbuf_printf(sb, "%d", element->mle_grade));
656
657	default:
658		panic("lomac_element_to_string: invalid type (%d)",
659		    element->mle_type);
660	}
661}
662
663static int
664lomac_to_string(struct sbuf *sb, struct mac_lomac *ml)
665{
666
667	if (ml->ml_flags & MAC_LOMAC_FLAG_SINGLE) {
668		if (lomac_element_to_string(sb, &ml->ml_single) == -1)
669			return (EINVAL);
670	}
671
672	if (ml->ml_flags & MAC_LOMAC_FLAG_AUX) {
673		if (sbuf_putc(sb, '[') == -1)
674			return (EINVAL);
675
676		if (lomac_element_to_string(sb, &ml->ml_auxsingle) == -1)
677			return (EINVAL);
678
679		if (sbuf_putc(sb, ']') == -1)
680			return (EINVAL);
681	}
682
683	if (ml->ml_flags & MAC_LOMAC_FLAG_RANGE) {
684		if (sbuf_putc(sb, '(') == -1)
685			return (EINVAL);
686
687		if (lomac_element_to_string(sb, &ml->ml_rangelow) == -1)
688			return (EINVAL);
689
690		if (sbuf_putc(sb, '-') == -1)
691			return (EINVAL);
692
693		if (lomac_element_to_string(sb, &ml->ml_rangehigh) == -1)
694			return (EINVAL);
695
696		if (sbuf_putc(sb, ')') == -1)
697			return (EINVAL);
698	}
699
700	return (0);
701}
702
703static int
704lomac_externalize_label(struct label *label, char *element_name,
705    struct sbuf *sb, int *claimed)
706{
707	struct mac_lomac *ml;
708
709	if (strcmp(MAC_LOMAC_LABEL_NAME, element_name) != 0)
710		return (0);
711
712	(*claimed)++;
713
714	ml = SLOT(label);
715
716	return (lomac_to_string(sb, ml));
717}
718
719static int
720lomac_parse_element(struct mac_lomac_element *element, char *string)
721{
722
723	if (strcmp(string, "high") == 0 || strcmp(string, "hi") == 0) {
724		element->mle_type = MAC_LOMAC_TYPE_HIGH;
725		element->mle_grade = MAC_LOMAC_TYPE_UNDEF;
726	} else if (strcmp(string, "low") == 0 || strcmp(string, "lo") == 0) {
727		element->mle_type = MAC_LOMAC_TYPE_LOW;
728		element->mle_grade = MAC_LOMAC_TYPE_UNDEF;
729	} else if (strcmp(string, "equal") == 0 ||
730	    strcmp(string, "eq") == 0) {
731		element->mle_type = MAC_LOMAC_TYPE_EQUAL;
732		element->mle_grade = MAC_LOMAC_TYPE_UNDEF;
733	} else {
734		char *p0, *p1;
735		int d;
736
737		p0 = string;
738		d = strtol(p0, &p1, 10);
739
740		if (d < 0 || d > 65535)
741			return (EINVAL);
742		element->mle_type = MAC_LOMAC_TYPE_GRADE;
743		element->mle_grade = d;
744
745		if (p1 == p0 || *p1 != '\0')
746			return (EINVAL);
747	}
748
749	return (0);
750}
751
752/*
753 * Note: destructively consumes the string, make a local copy before calling
754 * if that's a problem.
755 */
756static int
757lomac_parse(struct mac_lomac *ml, char *string)
758{
759	char *range, *rangeend, *rangehigh, *rangelow, *single, *auxsingle,
760	    *auxsingleend;
761	int error;
762
763	/* Do we have a range? */
764	single = string;
765	range = index(string, '(');
766	if (range == single)
767		single = NULL;
768	auxsingle = index(string, '[');
769	if (auxsingle == single)
770		single = NULL;
771	if (range != NULL && auxsingle != NULL)
772		return (EINVAL);
773	rangelow = rangehigh = NULL;
774	if (range != NULL) {
775		/* Nul terminate the end of the single string. */
776		*range = '\0';
777		range++;
778		rangelow = range;
779		rangehigh = index(rangelow, '-');
780		if (rangehigh == NULL)
781			return (EINVAL);
782		rangehigh++;
783		if (*rangelow == '\0' || *rangehigh == '\0')
784			return (EINVAL);
785		rangeend = index(rangehigh, ')');
786		if (rangeend == NULL)
787			return (EINVAL);
788		if (*(rangeend + 1) != '\0')
789			return (EINVAL);
790		/* Nul terminate the ends of the ranges. */
791		*(rangehigh - 1) = '\0';
792		*rangeend = '\0';
793	}
794	KASSERT((rangelow != NULL && rangehigh != NULL) ||
795	    (rangelow == NULL && rangehigh == NULL),
796	    ("lomac_internalize_label: range mismatch"));
797	if (auxsingle != NULL) {
798		/* Nul terminate the end of the single string. */
799		*auxsingle = '\0';
800		auxsingle++;
801		auxsingleend = index(auxsingle, ']');
802		if (auxsingleend == NULL)
803			return (EINVAL);
804		if (*(auxsingleend + 1) != '\0')
805			return (EINVAL);
806		/* Nul terminate the end of the auxsingle. */
807		*auxsingleend = '\0';
808	}
809
810	bzero(ml, sizeof(*ml));
811	if (single != NULL) {
812		error = lomac_parse_element(&ml->ml_single, single);
813		if (error)
814			return (error);
815		ml->ml_flags |= MAC_LOMAC_FLAG_SINGLE;
816	}
817
818	if (auxsingle != NULL) {
819		error = lomac_parse_element(&ml->ml_auxsingle, auxsingle);
820		if (error)
821			return (error);
822		ml->ml_flags |= MAC_LOMAC_FLAG_AUX;
823	}
824
825	if (rangelow != NULL) {
826		error = lomac_parse_element(&ml->ml_rangelow, rangelow);
827		if (error)
828			return (error);
829		error = lomac_parse_element(&ml->ml_rangehigh, rangehigh);
830		if (error)
831			return (error);
832		ml->ml_flags |= MAC_LOMAC_FLAG_RANGE;
833	}
834
835	error = lomac_valid(ml);
836	if (error)
837		return (error);
838
839	return (0);
840}
841
842static int
843lomac_internalize_label(struct label *label, char *element_name,
844    char *element_data, int *claimed)
845{
846	struct mac_lomac *ml, ml_temp;
847	int error;
848
849	if (strcmp(MAC_LOMAC_LABEL_NAME, element_name) != 0)
850		return (0);
851
852	(*claimed)++;
853
854	error = lomac_parse(&ml_temp, element_data);
855	if (error)
856		return (error);
857
858	ml = SLOT(label);
859	*ml = ml_temp;
860
861	return (0);
862}
863
864static void
865lomac_copy_label(struct label *src, struct label *dest)
866{
867
868	*SLOT(dest) = *SLOT(src);
869}
870
871/*
872 * Object-specific entry point implementations are sorted alphabetically by
873 * object type name and then by operation.
874 */
875static int
876lomac_bpfdesc_check_receive(struct bpf_d *d, struct label *dlabel,
877    struct ifnet *ifp, struct label *ifplabel)
878{
879	struct mac_lomac *a, *b;
880
881	if (!lomac_enabled)
882		return (0);
883
884	a = SLOT(dlabel);
885	b = SLOT(ifplabel);
886
887	if (lomac_equal_single(a, b))
888		return (0);
889	return (EACCES);
890}
891
892static void
893lomac_bpfdesc_create(struct ucred *cred, struct bpf_d *d,
894    struct label *dlabel)
895{
896	struct mac_lomac *source, *dest;
897
898	source = SLOT(cred->cr_label);
899	dest = SLOT(dlabel);
900
901	lomac_copy_single(source, dest);
902}
903
904static void
905lomac_bpfdesc_create_mbuf(struct bpf_d *d, struct label *dlabel,
906    struct mbuf *m, struct label *mlabel)
907{
908	struct mac_lomac *source, *dest;
909
910	source = SLOT(dlabel);
911	dest = SLOT(mlabel);
912
913	lomac_copy_single(source, dest);
914}
915
916static int
917lomac_cred_check_relabel(struct ucred *cred, struct label *newlabel)
918{
919	struct mac_lomac *subj, *new;
920	int error;
921
922	subj = SLOT(cred->cr_label);
923	new = SLOT(newlabel);
924
925	/*
926	 * If there is a LOMAC label update for the credential, it may be an
927	 * update of the single, range, or both.
928	 */
929	error = lomac_atmostflags(new, MAC_LOMAC_FLAGS_BOTH);
930	if (error)
931		return (error);
932
933	/*
934	 * If the LOMAC label is to be changed, authorize as appropriate.
935	 */
936	if (new->ml_flags & MAC_LOMAC_FLAGS_BOTH) {
937		/*
938		 * Fill in the missing parts from the previous label.
939		 */
940		if ((new->ml_flags & MAC_LOMAC_FLAG_SINGLE) == 0)
941			lomac_copy_single(subj, new);
942		if ((new->ml_flags & MAC_LOMAC_FLAG_RANGE) == 0)
943			lomac_copy_range(subj, new);
944
945		/*
946		 * To change the LOMAC range on a credential, the new range
947		 * label must be in the current range.
948		 */
949		if (!lomac_range_in_range(new, subj))
950			return (EPERM);
951
952		/*
953		 * To change the LOMAC single label on a credential, the new
954		 * single label must be in the new range.  Implicitly from
955		 * the previous check, the new single is in the old range.
956		 */
957		if (!lomac_single_in_range(new, new))
958			return (EPERM);
959
960		/*
961		 * To have EQUAL in any component of the new credential LOMAC
962		 * label, the subject must already have EQUAL in their label.
963		 */
964		if (lomac_contains_equal(new)) {
965			error = lomac_subject_privileged(subj);
966			if (error)
967				return (error);
968		}
969
970		/*
971		 * XXXMAC: Additional consistency tests regarding the single
972		 * and range of the new label might be performed here.
973		 */
974	}
975
976	return (0);
977}
978
979static int
980lomac_cred_check_visible(struct ucred *cr1, struct ucred *cr2)
981{
982	struct mac_lomac *subj, *obj;
983
984	if (!lomac_enabled)
985		return (0);
986
987	subj = SLOT(cr1->cr_label);
988	obj = SLOT(cr2->cr_label);
989
990	/* XXX: range */
991	if (!lomac_dominate_single(obj, subj))
992		return (ESRCH);
993
994	return (0);
995}
996
997static void
998lomac_cred_create_init(struct ucred *cred)
999{
1000	struct mac_lomac *dest;
1001
1002	dest = SLOT(cred->cr_label);
1003
1004	lomac_set_single(dest, MAC_LOMAC_TYPE_HIGH, 0);
1005	lomac_set_range(dest, MAC_LOMAC_TYPE_LOW, 0, MAC_LOMAC_TYPE_HIGH, 0);
1006}
1007
1008static void
1009lomac_cred_create_swapper(struct ucred *cred)
1010{
1011	struct mac_lomac *dest;
1012
1013	dest = SLOT(cred->cr_label);
1014
1015	lomac_set_single(dest, MAC_LOMAC_TYPE_EQUAL, 0);
1016	lomac_set_range(dest, MAC_LOMAC_TYPE_LOW, 0, MAC_LOMAC_TYPE_HIGH, 0);
1017}
1018
1019static void
1020lomac_cred_relabel(struct ucred *cred, struct label *newlabel)
1021{
1022	struct mac_lomac *source, *dest;
1023
1024	source = SLOT(newlabel);
1025	dest = SLOT(cred->cr_label);
1026
1027	try_relabel(source, dest);
1028}
1029
1030static void
1031lomac_devfs_create_device(struct ucred *cred, struct mount *mp,
1032    struct cdev *dev, struct devfs_dirent *de, struct label *delabel)
1033{
1034	struct mac_lomac *ml;
1035	int lomac_type;
1036
1037	ml = SLOT(delabel);
1038	if (strcmp(dev->si_name, "null") == 0 ||
1039	    strcmp(dev->si_name, "zero") == 0 ||
1040	    strcmp(dev->si_name, "random") == 0 ||
1041	    strncmp(dev->si_name, "fd/", strlen("fd/")) == 0 ||
1042	    strncmp(dev->si_name, "ttyv", strlen("ttyv")) == 0)
1043		lomac_type = MAC_LOMAC_TYPE_EQUAL;
1044	else if (ptys_equal &&
1045	    (strncmp(dev->si_name, "ttyp", strlen("ttyp")) == 0 ||
1046	    strncmp(dev->si_name, "ptyp", strlen("ptyp")) == 0))
1047		lomac_type = MAC_LOMAC_TYPE_EQUAL;
1048	else
1049		lomac_type = MAC_LOMAC_TYPE_HIGH;
1050	lomac_set_single(ml, lomac_type, 0);
1051}
1052
1053static void
1054lomac_devfs_create_directory(struct mount *mp, char *dirname, int dirnamelen,
1055    struct devfs_dirent *de, struct label *delabel)
1056{
1057	struct mac_lomac *ml;
1058
1059	ml = SLOT(delabel);
1060	lomac_set_single(ml, MAC_LOMAC_TYPE_HIGH, 0);
1061}
1062
1063static void
1064lomac_devfs_create_symlink(struct ucred *cred, struct mount *mp,
1065    struct devfs_dirent *dd, struct label *ddlabel, struct devfs_dirent *de,
1066    struct label *delabel)
1067{
1068	struct mac_lomac *source, *dest;
1069
1070	source = SLOT(cred->cr_label);
1071	dest = SLOT(delabel);
1072
1073	lomac_copy_single(source, dest);
1074}
1075
1076static void
1077lomac_devfs_update(struct mount *mp, struct devfs_dirent *de,
1078    struct label *delabel, struct vnode *vp, struct label *vplabel)
1079{
1080	struct mac_lomac *source, *dest;
1081
1082	source = SLOT(vplabel);
1083	dest = SLOT(delabel);
1084
1085	lomac_copy(source, dest);
1086}
1087
1088static void
1089lomac_devfs_vnode_associate(struct mount *mp, struct label *mplabel,
1090    struct devfs_dirent *de, struct label *delabel, struct vnode *vp,
1091    struct label *vplabel)
1092{
1093	struct mac_lomac *source, *dest;
1094
1095	source = SLOT(delabel);
1096	dest = SLOT(vplabel);
1097
1098	lomac_copy_single(source, dest);
1099}
1100
1101static int
1102lomac_ifnet_check_relabel(struct ucred *cred, struct ifnet *ifp,
1103    struct label *ifplabel, struct label *newlabel)
1104{
1105	struct mac_lomac *subj, *new;
1106	int error;
1107
1108	subj = SLOT(cred->cr_label);
1109	new = SLOT(newlabel);
1110
1111	/*
1112	 * If there is a LOMAC label update for the interface, it may be an
1113	 * update of the single, range, or both.
1114	 */
1115	error = lomac_atmostflags(new, MAC_LOMAC_FLAGS_BOTH);
1116	if (error)
1117		return (error);
1118
1119	/*
1120	 * Relabling network interfaces requires LOMAC privilege.
1121	 */
1122	error = lomac_subject_privileged(subj);
1123	if (error)
1124		return (error);
1125
1126	/*
1127	 * If the LOMAC label is to be changed, authorize as appropriate.
1128	 */
1129	if (new->ml_flags & MAC_LOMAC_FLAGS_BOTH) {
1130		/*
1131		 * Fill in the missing parts from the previous label.
1132		 */
1133		if ((new->ml_flags & MAC_LOMAC_FLAG_SINGLE) == 0)
1134			lomac_copy_single(subj, new);
1135		if ((new->ml_flags & MAC_LOMAC_FLAG_RANGE) == 0)
1136			lomac_copy_range(subj, new);
1137
1138		/*
1139		 * Rely on the traditional superuser status for the LOMAC
1140		 * interface relabel requirements.  XXXMAC: This will go
1141		 * away.
1142		 *
1143		 * XXXRW: This is also redundant to a higher layer check.
1144		 */
1145		error = priv_check_cred(cred, PRIV_NET_SETIFMAC, 0);
1146		if (error)
1147			return (EPERM);
1148
1149		/*
1150		 * XXXMAC: Additional consistency tests regarding the single
1151		 * and the range of the new label might be performed here.
1152		 */
1153	}
1154
1155	return (0);
1156}
1157
1158static int
1159lomac_ifnet_check_transmit(struct ifnet *ifp, struct label *ifplabel,
1160    struct mbuf *m, struct label *mlabel)
1161{
1162	struct mac_lomac *p, *i;
1163
1164	if (!lomac_enabled)
1165		return (0);
1166
1167	p = SLOT(mlabel);
1168	i = SLOT(ifplabel);
1169
1170	return (lomac_single_in_range(p, i) ? 0 : EACCES);
1171}
1172
1173static void
1174lomac_ifnet_create(struct ifnet *ifp, struct label *ifplabel)
1175{
1176	char tifname[IFNAMSIZ], *p, *q;
1177	char tiflist[sizeof(trusted_interfaces)];
1178	struct mac_lomac *dest;
1179	int len, grade;
1180
1181	dest = SLOT(ifplabel);
1182
1183	if (ifp->if_type == IFT_LOOP) {
1184		grade = MAC_LOMAC_TYPE_EQUAL;
1185		goto set;
1186	}
1187
1188	if (trust_all_interfaces) {
1189		grade = MAC_LOMAC_TYPE_HIGH;
1190		goto set;
1191	}
1192
1193	grade = MAC_LOMAC_TYPE_LOW;
1194
1195	if (trusted_interfaces[0] == '\0' ||
1196	    !strvalid(trusted_interfaces, sizeof(trusted_interfaces)))
1197		goto set;
1198
1199	bzero(tiflist, sizeof(tiflist));
1200	for (p = trusted_interfaces, q = tiflist; *p != '\0'; p++, q++)
1201		if(*p != ' ' && *p != '\t')
1202			*q = *p;
1203
1204	for (p = q = tiflist;; p++) {
1205		if (*p == ',' || *p == '\0') {
1206			len = p - q;
1207			if (len < IFNAMSIZ) {
1208				bzero(tifname, sizeof(tifname));
1209				bcopy(q, tifname, len);
1210				if (strcmp(tifname, ifp->if_xname) == 0) {
1211					grade = MAC_LOMAC_TYPE_HIGH;
1212					break;
1213				}
1214			}
1215			else {
1216				*p = '\0';
1217				printf("MAC/LOMAC warning: interface name "
1218				    "\"%s\" is too long (must be < %d)\n",
1219				    q, IFNAMSIZ);
1220			}
1221			if (*p == '\0')
1222				break;
1223			q = p + 1;
1224		}
1225	}
1226set:
1227	lomac_set_single(dest, grade, 0);
1228	lomac_set_range(dest, grade, 0, grade, 0);
1229}
1230
1231static void
1232lomac_ifnet_create_mbuf(struct ifnet *ifp, struct label *ifplabel,
1233    struct mbuf *m, struct label *mlabel)
1234{
1235	struct mac_lomac *source, *dest;
1236
1237	source = SLOT(ifplabel);
1238	dest = SLOT(mlabel);
1239
1240	lomac_copy_single(source, dest);
1241}
1242
1243static void
1244lomac_ifnet_relabel(struct ucred *cred, struct ifnet *ifp,
1245    struct label *ifplabel, struct label *newlabel)
1246{
1247	struct mac_lomac *source, *dest;
1248
1249	source = SLOT(newlabel);
1250	dest = SLOT(ifplabel);
1251
1252	try_relabel(source, dest);
1253}
1254
1255static int
1256lomac_inpcb_check_deliver(struct inpcb *inp, struct label *inplabel,
1257    struct mbuf *m, struct label *mlabel)
1258{
1259	struct mac_lomac *p, *i;
1260
1261	if (!lomac_enabled)
1262		return (0);
1263
1264	p = SLOT(mlabel);
1265	i = SLOT(inplabel);
1266
1267	return (lomac_equal_single(p, i) ? 0 : EACCES);
1268}
1269
1270static int
1271lomac_inpcb_check_visible(struct ucred *cred, struct inpcb *inp,
1272    struct label *inplabel)
1273{
1274	struct mac_lomac *subj, *obj;
1275
1276	if (!lomac_enabled)
1277		return (0);
1278
1279	subj = SLOT(cred->cr_label);
1280	obj = SLOT(inplabel);
1281
1282	if (!lomac_dominate_single(obj, subj))
1283		return (ENOENT);
1284
1285	return (0);
1286}
1287
1288static void
1289lomac_inpcb_create(struct socket *so, struct label *solabel,
1290    struct inpcb *inp, struct label *inplabel)
1291{
1292	struct mac_lomac *source, *dest;
1293
1294	source = SLOT(solabel);
1295	dest = SLOT(inplabel);
1296
1297	lomac_copy_single(source, dest);
1298}
1299
1300static void
1301lomac_inpcb_create_mbuf(struct inpcb *inp, struct label *inplabel,
1302    struct mbuf *m, struct label *mlabel)
1303{
1304	struct mac_lomac *source, *dest;
1305
1306	source = SLOT(inplabel);
1307	dest = SLOT(mlabel);
1308
1309	lomac_copy_single(source, dest);
1310}
1311
1312static void
1313lomac_inpcb_sosetlabel(struct socket *so, struct label *solabel,
1314    struct inpcb *inp, struct label *inplabel)
1315{
1316	struct mac_lomac *source, *dest;
1317
1318	source = SLOT(solabel);
1319	dest = SLOT(inplabel);
1320
1321	lomac_copy_single(source, dest);
1322}
1323
1324static void
1325lomac_ip6q_create(struct mbuf *m, struct label *mlabel, struct ip6q *q6,
1326    struct label *q6label)
1327{
1328	struct mac_lomac *source, *dest;
1329
1330	source = SLOT(mlabel);
1331	dest = SLOT(q6label);
1332
1333	lomac_copy_single(source, dest);
1334}
1335
1336static int
1337lomac_ip6q_match(struct mbuf *m, struct label *mlabel, struct ip6q *q6,
1338    struct label *q6label)
1339{
1340	struct mac_lomac *a, *b;
1341
1342	a = SLOT(q6label);
1343	b = SLOT(mlabel);
1344
1345	return (lomac_equal_single(a, b));
1346}
1347
1348static void
1349lomac_ip6q_reassemble(struct ip6q *q6, struct label *q6label, struct mbuf *m,
1350    struct label *mlabel)
1351{
1352	struct mac_lomac *source, *dest;
1353
1354	source = SLOT(q6label);
1355	dest = SLOT(mlabel);
1356
1357	/* Just use the head, since we require them all to match. */
1358	lomac_copy_single(source, dest);
1359}
1360
1361static void
1362lomac_ip6q_update(struct mbuf *m, struct label *mlabel, struct ip6q *q6,
1363    struct label *q6label)
1364{
1365
1366	/* NOOP: we only accept matching labels, so no need to update */
1367}
1368
1369static void
1370lomac_ipq_create(struct mbuf *m, struct label *mlabel, struct ipq *q,
1371    struct label *qlabel)
1372{
1373	struct mac_lomac *source, *dest;
1374
1375	source = SLOT(mlabel);
1376	dest = SLOT(qlabel);
1377
1378	lomac_copy_single(source, dest);
1379}
1380
1381static int
1382lomac_ipq_match(struct mbuf *m, struct label *mlabel, struct ipq *q,
1383    struct label *qlabel)
1384{
1385	struct mac_lomac *a, *b;
1386
1387	a = SLOT(qlabel);
1388	b = SLOT(mlabel);
1389
1390	return (lomac_equal_single(a, b));
1391}
1392
1393static void
1394lomac_ipq_reassemble(struct ipq *q, struct label *qlabel, struct mbuf *m,
1395    struct label *mlabel)
1396{
1397	struct mac_lomac *source, *dest;
1398
1399	source = SLOT(qlabel);
1400	dest = SLOT(mlabel);
1401
1402	/* Just use the head, since we require them all to match. */
1403	lomac_copy_single(source, dest);
1404}
1405
1406static void
1407lomac_ipq_update(struct mbuf *m, struct label *mlabel, struct ipq *q,
1408    struct label *qlabel)
1409{
1410
1411	/* NOOP: we only accept matching labels, so no need to update */
1412}
1413
1414static int
1415lomac_kld_check_load(struct ucred *cred, struct vnode *vp,
1416    struct label *vplabel)
1417{
1418	struct mac_lomac *subj, *obj;
1419
1420	if (!lomac_enabled)
1421		return (0);
1422
1423	subj = SLOT(cred->cr_label);
1424	obj = SLOT(vplabel);
1425
1426	if (lomac_subject_privileged(subj))
1427		return (EPERM);
1428
1429	if (!lomac_high_single(obj))
1430		return (EACCES);
1431
1432	return (0);
1433}
1434
1435static void
1436lomac_mount_create(struct ucred *cred, struct mount *mp,
1437    struct label *mplabel)
1438{
1439	struct mac_lomac *source, *dest;
1440
1441	source = SLOT(cred->cr_label);
1442	dest = SLOT(mplabel);
1443	lomac_copy_single(source, dest);
1444}
1445
1446static void
1447lomac_netatalk_aarp_send(struct ifnet *ifp, struct label *ifplabel,
1448    struct mbuf *m, struct label *mlabel)
1449{
1450	struct mac_lomac *dest;
1451
1452	dest = SLOT(mlabel);
1453
1454	lomac_set_single(dest, MAC_LOMAC_TYPE_EQUAL, 0);
1455}
1456
1457static void
1458lomac_netinet_arp_send(struct ifnet *ifp, struct label *ifplabel,
1459    struct mbuf *m, struct label *mlabel)
1460{
1461	struct mac_lomac *dest;
1462
1463	dest = SLOT(mlabel);
1464
1465	lomac_set_single(dest, MAC_LOMAC_TYPE_EQUAL, 0);
1466}
1467
1468static void
1469lomac_netinet_firewall_reply(struct mbuf *mrecv, struct label *mrecvlabel,
1470    struct mbuf *msend, struct label *msendlabel)
1471{
1472	struct mac_lomac *source, *dest;
1473
1474	source = SLOT(mrecvlabel);
1475	dest = SLOT(msendlabel);
1476
1477	lomac_copy_single(source, dest);
1478}
1479
1480static void
1481lomac_netinet_firewall_send(struct mbuf *m, struct label *mlabel)
1482{
1483	struct mac_lomac *dest;
1484
1485	dest = SLOT(mlabel);
1486
1487	/* XXX: where is the label for the firewall really comming from? */
1488	lomac_set_single(dest, MAC_LOMAC_TYPE_EQUAL, 0);
1489}
1490
1491static void
1492lomac_netinet_fragment(struct mbuf *m, struct label *mlabel,
1493    struct mbuf *frag, struct label *fraglabel)
1494{
1495	struct mac_lomac *source, *dest;
1496
1497	source = SLOT(mlabel);
1498	dest = SLOT(fraglabel);
1499
1500	lomac_copy_single(source, dest);
1501}
1502
1503static void
1504lomac_netinet_icmp_reply(struct mbuf *mrecv, struct label *mrecvlabel,
1505    struct mbuf *msend, struct label *msendlabel)
1506{
1507	struct mac_lomac *source, *dest;
1508
1509	source = SLOT(mrecvlabel);
1510	dest = SLOT(msendlabel);
1511
1512	lomac_copy_single(source, dest);
1513}
1514
1515static void
1516lomac_netinet_igmp_send(struct ifnet *ifp, struct label *ifplabel,
1517    struct mbuf *m, struct label *mlabel)
1518{
1519	struct mac_lomac *dest;
1520
1521	dest = SLOT(mlabel);
1522
1523	lomac_set_single(dest, MAC_LOMAC_TYPE_EQUAL, 0);
1524}
1525
1526static void
1527lomac_netinet6_nd6_send(struct ifnet *ifp, struct label *ifplabel,
1528    struct mbuf *m, struct label *mlabel)
1529{
1530	struct mac_lomac *dest;
1531
1532	dest = SLOT(mlabel);
1533
1534	lomac_set_single(dest, MAC_LOMAC_TYPE_EQUAL, 0);
1535}
1536
1537static int
1538lomac_pipe_check_ioctl(struct ucred *cred, struct pipepair *pp,
1539    struct label *pplabel, unsigned long cmd, void /* caddr_t */ *data)
1540{
1541
1542	if (!lomac_enabled)
1543		return (0);
1544
1545	/* XXX: This will be implemented soon... */
1546
1547	return (0);
1548}
1549
1550static int
1551lomac_pipe_check_read(struct ucred *cred, struct pipepair *pp,
1552    struct label *pplabel)
1553{
1554	struct mac_lomac *subj, *obj;
1555
1556	if (!lomac_enabled)
1557		return (0);
1558
1559	subj = SLOT(cred->cr_label);
1560	obj = SLOT(pplabel);
1561
1562	if (!lomac_dominate_single(obj, subj))
1563		return (maybe_demote(subj, obj, "reading", "pipe", NULL));
1564
1565	return (0);
1566}
1567
1568static int
1569lomac_pipe_check_relabel(struct ucred *cred, struct pipepair *pp,
1570    struct label *pplabel, struct label *newlabel)
1571{
1572	struct mac_lomac *subj, *obj, *new;
1573	int error;
1574
1575	new = SLOT(newlabel);
1576	subj = SLOT(cred->cr_label);
1577	obj = SLOT(pplabel);
1578
1579	/*
1580	 * If there is a LOMAC label update for a pipe, it must be a single
1581	 * update.
1582	 */
1583	error = lomac_atmostflags(new, MAC_LOMAC_FLAG_SINGLE);
1584	if (error)
1585		return (error);
1586
1587	/*
1588	 * To perform a relabel of a pipe (LOMAC label or not), LOMAC must
1589	 * authorize the relabel.
1590	 */
1591	if (!lomac_single_in_range(obj, subj))
1592		return (EPERM);
1593
1594	/*
1595	 * If the LOMAC label is to be changed, authorize as appropriate.
1596	 */
1597	if (new->ml_flags & MAC_LOMAC_FLAG_SINGLE) {
1598		/*
1599		 * To change the LOMAC label on a pipe, the new pipe label
1600		 * must be in the subject range.
1601		 */
1602		if (!lomac_single_in_range(new, subj))
1603			return (EPERM);
1604
1605		/*
1606		 * To change the LOMAC label on a pipe to be EQUAL, the
1607		 * subject must have appropriate privilege.
1608		 */
1609		if (lomac_contains_equal(new)) {
1610			error = lomac_subject_privileged(subj);
1611			if (error)
1612				return (error);
1613		}
1614	}
1615
1616	return (0);
1617}
1618
1619static int
1620lomac_pipe_check_write(struct ucred *cred, struct pipepair *pp,
1621    struct label *pplabel)
1622{
1623	struct mac_lomac *subj, *obj;
1624
1625	if (!lomac_enabled)
1626		return (0);
1627
1628	subj = SLOT(cred->cr_label);
1629	obj = SLOT(pplabel);
1630
1631	if (!lomac_subject_dominate(subj, obj))
1632		return (EACCES);
1633
1634	return (0);
1635}
1636
1637static void
1638lomac_pipe_create(struct ucred *cred, struct pipepair *pp,
1639    struct label *pplabel)
1640{
1641	struct mac_lomac *source, *dest;
1642
1643	source = SLOT(cred->cr_label);
1644	dest = SLOT(pplabel);
1645
1646	lomac_copy_single(source, dest);
1647}
1648
1649static void
1650lomac_pipe_relabel(struct ucred *cred, struct pipepair *pp,
1651    struct label *pplabel, struct label *newlabel)
1652{
1653	struct mac_lomac *source, *dest;
1654
1655	source = SLOT(newlabel);
1656	dest = SLOT(pplabel);
1657
1658	try_relabel(source, dest);
1659}
1660
1661/*
1662 * Some system privileges are allowed regardless of integrity grade; others
1663 * are allowed only when running with privilege with respect to the LOMAC
1664 * policy as they might otherwise allow bypassing of the integrity policy.
1665 */
1666static int
1667lomac_priv_check(struct ucred *cred, int priv)
1668{
1669	struct mac_lomac *subj;
1670	int error;
1671
1672	if (!lomac_enabled)
1673		return (0);
1674
1675	/*
1676	 * Exempt only specific privileges from the LOMAC integrity policy.
1677	 */
1678	switch (priv) {
1679	case PRIV_KTRACE:
1680	case PRIV_MSGBUF:
1681
1682	/*
1683	 * Allow processes to manipulate basic process audit properties, and
1684	 * to submit audit records.
1685	 */
1686	case PRIV_AUDIT_GETAUDIT:
1687	case PRIV_AUDIT_SETAUDIT:
1688	case PRIV_AUDIT_SUBMIT:
1689
1690	/*
1691	 * Allow processes to manipulate their regular UNIX credentials.
1692	 */
1693	case PRIV_CRED_SETUID:
1694	case PRIV_CRED_SETEUID:
1695	case PRIV_CRED_SETGID:
1696	case PRIV_CRED_SETEGID:
1697	case PRIV_CRED_SETGROUPS:
1698	case PRIV_CRED_SETREUID:
1699	case PRIV_CRED_SETREGID:
1700	case PRIV_CRED_SETRESUID:
1701	case PRIV_CRED_SETRESGID:
1702
1703	/*
1704	 * Allow processes to perform system monitoring.
1705	 */
1706	case PRIV_SEEOTHERGIDS:
1707	case PRIV_SEEOTHERUIDS:
1708		break;
1709
1710	/*
1711	 * Allow access to general process debugging facilities.  We
1712	 * separately control debugging based on MAC label.
1713	 */
1714	case PRIV_DEBUG_DIFFCRED:
1715	case PRIV_DEBUG_SUGID:
1716	case PRIV_DEBUG_UNPRIV:
1717
1718	/*
1719	 * Allow manipulating jails.
1720	 */
1721	case PRIV_JAIL_ATTACH:
1722
1723	/*
1724	 * Allow privilege with respect to the Partition policy, but not the
1725	 * Privs policy.
1726	 */
1727	case PRIV_MAC_PARTITION:
1728
1729	/*
1730	 * Allow privilege with respect to process resource limits and login
1731	 * context.
1732	 */
1733	case PRIV_PROC_LIMIT:
1734	case PRIV_PROC_SETLOGIN:
1735	case PRIV_PROC_SETRLIMIT:
1736
1737	/*
1738	 * Allow System V and POSIX IPC privileges.
1739	 */
1740	case PRIV_IPC_READ:
1741	case PRIV_IPC_WRITE:
1742	case PRIV_IPC_ADMIN:
1743	case PRIV_IPC_MSGSIZE:
1744	case PRIV_MQ_ADMIN:
1745
1746	/*
1747	 * Allow certain scheduler manipulations -- possibly this should be
1748	 * controlled by more fine-grained policy, as potentially low
1749	 * integrity processes can deny CPU to higher integrity ones.
1750	 */
1751	case PRIV_SCHED_DIFFCRED:
1752	case PRIV_SCHED_SETPRIORITY:
1753	case PRIV_SCHED_RTPRIO:
1754	case PRIV_SCHED_SETPOLICY:
1755	case PRIV_SCHED_SET:
1756	case PRIV_SCHED_SETPARAM:
1757
1758	/*
1759	 * More IPC privileges.
1760	 */
1761	case PRIV_SEM_WRITE:
1762
1763	/*
1764	 * Allow signaling privileges subject to integrity policy.
1765	 */
1766	case PRIV_SIGNAL_DIFFCRED:
1767	case PRIV_SIGNAL_SUGID:
1768
1769	/*
1770	 * Allow access to only limited sysctls from lower integrity levels;
1771	 * piggy-back on the Jail definition.
1772	 */
1773	case PRIV_SYSCTL_WRITEJAIL:
1774
1775	/*
1776	 * Allow TTY-based privileges, subject to general device access using
1777	 * labels on TTY device nodes, but not console privilege.
1778	 */
1779	case PRIV_TTY_DRAINWAIT:
1780	case PRIV_TTY_DTRWAIT:
1781	case PRIV_TTY_EXCLUSIVE:
1782	case PRIV_TTY_PRISON:
1783	case PRIV_TTY_STI:
1784	case PRIV_TTY_SETA:
1785
1786	/*
1787	 * Grant most VFS privileges, as almost all are in practice bounded
1788	 * by more specific checks using labels.
1789	 */
1790	case PRIV_VFS_READ:
1791	case PRIV_VFS_WRITE:
1792	case PRIV_VFS_ADMIN:
1793	case PRIV_VFS_EXEC:
1794	case PRIV_VFS_LOOKUP:
1795	case PRIV_VFS_CHFLAGS_DEV:
1796	case PRIV_VFS_CHOWN:
1797	case PRIV_VFS_CHROOT:
1798	case PRIV_VFS_RETAINSUGID:
1799	case PRIV_VFS_EXCEEDQUOTA:
1800	case PRIV_VFS_FCHROOT:
1801	case PRIV_VFS_FHOPEN:
1802	case PRIV_VFS_FHSTATFS:
1803	case PRIV_VFS_GENERATION:
1804	case PRIV_VFS_GETFH:
1805	case PRIV_VFS_GETQUOTA:
1806	case PRIV_VFS_LINK:
1807	case PRIV_VFS_MOUNT:
1808	case PRIV_VFS_MOUNT_OWNER:
1809	case PRIV_VFS_MOUNT_PERM:
1810	case PRIV_VFS_MOUNT_SUIDDIR:
1811	case PRIV_VFS_MOUNT_NONUSER:
1812	case PRIV_VFS_SETGID:
1813	case PRIV_VFS_STICKYFILE:
1814	case PRIV_VFS_SYSFLAGS:
1815	case PRIV_VFS_UNMOUNT:
1816
1817	/*
1818	 * Allow VM privileges; it would be nice if these were subject to
1819	 * resource limits.
1820	 */
1821	case PRIV_VM_MADV_PROTECT:
1822	case PRIV_VM_MLOCK:
1823	case PRIV_VM_MUNLOCK:
1824
1825	/*
1826	 * Allow some but not all network privileges.  In general, dont allow
1827	 * reconfiguring the network stack, just normal use.
1828	 */
1829	case PRIV_NETATALK_RESERVEDPORT:
1830	case PRIV_NETINET_RESERVEDPORT:
1831	case PRIV_NETINET_RAW:
1832	case PRIV_NETINET_REUSEPORT:
1833	case PRIV_NETIPX_RESERVEDPORT:
1834	case PRIV_NETIPX_RAW:
1835		break;
1836
1837	/*
1838	 * All remaining system privileges are allow only if the process
1839	 * holds privilege with respect to the LOMAC policy.
1840	 */
1841	default:
1842		subj = SLOT(cred->cr_label);
1843		error = lomac_subject_privileged(subj);
1844		if (error)
1845			return (error);
1846	}
1847	return (0);
1848}
1849
1850static int
1851lomac_proc_check_debug(struct ucred *cred, struct proc *p)
1852{
1853	struct mac_lomac *subj, *obj;
1854
1855	if (!lomac_enabled)
1856		return (0);
1857
1858	subj = SLOT(cred->cr_label);
1859	obj = SLOT(p->p_ucred->cr_label);
1860
1861	/* XXX: range checks */
1862	if (!lomac_dominate_single(obj, subj))
1863		return (ESRCH);
1864	if (!lomac_subject_dominate(subj, obj))
1865		return (EACCES);
1866
1867	return (0);
1868}
1869
1870static int
1871lomac_proc_check_sched(struct ucred *cred, struct proc *p)
1872{
1873	struct mac_lomac *subj, *obj;
1874
1875	if (!lomac_enabled)
1876		return (0);
1877
1878	subj = SLOT(cred->cr_label);
1879	obj = SLOT(p->p_ucred->cr_label);
1880
1881	/* XXX: range checks */
1882	if (!lomac_dominate_single(obj, subj))
1883		return (ESRCH);
1884	if (!lomac_subject_dominate(subj, obj))
1885		return (EACCES);
1886
1887	return (0);
1888}
1889
1890static int
1891lomac_proc_check_signal(struct ucred *cred, struct proc *p, int signum)
1892{
1893	struct mac_lomac *subj, *obj;
1894
1895	if (!lomac_enabled)
1896		return (0);
1897
1898	subj = SLOT(cred->cr_label);
1899	obj = SLOT(p->p_ucred->cr_label);
1900
1901	/* XXX: range checks */
1902	if (!lomac_dominate_single(obj, subj))
1903		return (ESRCH);
1904	if (!lomac_subject_dominate(subj, obj))
1905		return (EACCES);
1906
1907	return (0);
1908}
1909
1910static void
1911lomac_proc_destroy_label(struct label *label)
1912{
1913
1914	mtx_destroy(&PSLOT(label)->mtx);
1915	free(PSLOT(label), M_LOMAC);
1916	PSLOT_SET(label, NULL);
1917}
1918
1919static void
1920lomac_proc_init_label(struct label *label)
1921{
1922
1923	PSLOT_SET(label, malloc(sizeof(struct mac_lomac_proc), M_LOMAC,
1924	    M_ZERO | M_WAITOK));
1925	mtx_init(&PSLOT(label)->mtx, "MAC/Lomac proc lock", NULL, MTX_DEF);
1926}
1927
1928static int
1929lomac_socket_check_deliver(struct socket *so, struct label *solabel,
1930    struct mbuf *m, struct label *mlabel)
1931{
1932	struct mac_lomac *p, *s;
1933
1934	if (!lomac_enabled)
1935		return (0);
1936
1937	p = SLOT(mlabel);
1938	s = SLOT(solabel);
1939
1940	return (lomac_equal_single(p, s) ? 0 : EACCES);
1941}
1942
1943static int
1944lomac_socket_check_relabel(struct ucred *cred, struct socket *so,
1945    struct label *solabel, struct label *newlabel)
1946{
1947	struct mac_lomac *subj, *obj, *new;
1948	int error;
1949
1950	new = SLOT(newlabel);
1951	subj = SLOT(cred->cr_label);
1952	obj = SLOT(solabel);
1953
1954	/*
1955	 * If there is a LOMAC label update for the socket, it may be an
1956	 * update of single.
1957	 */
1958	error = lomac_atmostflags(new, MAC_LOMAC_FLAG_SINGLE);
1959	if (error)
1960		return (error);
1961
1962	/*
1963	 * To relabel a socket, the old socket single must be in the subject
1964	 * range.
1965	 */
1966	if (!lomac_single_in_range(obj, subj))
1967		return (EPERM);
1968
1969	/*
1970	 * If the LOMAC label is to be changed, authorize as appropriate.
1971	 */
1972	if (new->ml_flags & MAC_LOMAC_FLAG_SINGLE) {
1973		/*
1974		 * To relabel a socket, the new socket single must be in the
1975		 * subject range.
1976		 */
1977		if (!lomac_single_in_range(new, subj))
1978			return (EPERM);
1979
1980		/*
1981		 * To change the LOMAC label on the socket to contain EQUAL,
1982		 * the subject must have appropriate privilege.
1983		 */
1984		if (lomac_contains_equal(new)) {
1985			error = lomac_subject_privileged(subj);
1986			if (error)
1987				return (error);
1988		}
1989	}
1990
1991	return (0);
1992}
1993
1994static int
1995lomac_socket_check_visible(struct ucred *cred, struct socket *so,
1996    struct label *solabel)
1997{
1998	struct mac_lomac *subj, *obj;
1999
2000	if (!lomac_enabled)
2001		return (0);
2002
2003	subj = SLOT(cred->cr_label);
2004	obj = SLOT(solabel);
2005
2006	if (!lomac_dominate_single(obj, subj))
2007		return (ENOENT);
2008
2009	return (0);
2010}
2011
2012static void
2013lomac_socket_create(struct ucred *cred, struct socket *so,
2014    struct label *solabel)
2015{
2016	struct mac_lomac *source, *dest;
2017
2018	source = SLOT(cred->cr_label);
2019	dest = SLOT(solabel);
2020
2021	lomac_copy_single(source, dest);
2022}
2023
2024static void
2025lomac_socket_create_mbuf(struct socket *so, struct label *solabel,
2026    struct mbuf *m, struct label *mlabel)
2027{
2028	struct mac_lomac *source, *dest;
2029
2030	source = SLOT(solabel);
2031	dest = SLOT(mlabel);
2032
2033	lomac_copy_single(source, dest);
2034}
2035
2036static void
2037lomac_socket_newconn(struct socket *oldso, struct label *oldsolabel,
2038    struct socket *newso, struct label *newsolabel)
2039{
2040	struct mac_lomac *source, *dest;
2041
2042	source = SLOT(oldsolabel);
2043	dest = SLOT(newsolabel);
2044
2045	lomac_copy_single(source, dest);
2046}
2047
2048static void
2049lomac_socket_relabel(struct ucred *cred, struct socket *so,
2050    struct label *solabel, struct label *newlabel)
2051{
2052	struct mac_lomac *source, *dest;
2053
2054	source = SLOT(newlabel);
2055	dest = SLOT(solabel);
2056
2057	try_relabel(source, dest);
2058}
2059
2060static void
2061lomac_socketpeer_set_from_mbuf(struct mbuf *m, struct label *mlabel,
2062    struct socket *so, struct label *sopeerlabel)
2063{
2064	struct mac_lomac *source, *dest;
2065
2066	source = SLOT(mlabel);
2067	dest = SLOT(sopeerlabel);
2068
2069	lomac_copy_single(source, dest);
2070}
2071
2072static void
2073lomac_socketpeer_set_from_socket(struct socket *oldso,
2074    struct label *oldsolabel, struct socket *newso,
2075    struct label *newsopeerlabel)
2076{
2077	struct mac_lomac *source, *dest;
2078
2079	source = SLOT(oldsolabel);
2080	dest = SLOT(newsopeerlabel);
2081
2082	lomac_copy_single(source, dest);
2083}
2084
2085static void
2086lomac_syncache_create(struct label *label, struct inpcb *inp)
2087{
2088	struct mac_lomac *source, *dest;
2089
2090	source = SLOT(inp->inp_label);
2091	dest = SLOT(label);
2092	lomac_copy(source, dest);
2093}
2094
2095static void
2096lomac_syncache_create_mbuf(struct label *sc_label, struct mbuf *m,
2097    struct label *mlabel)
2098{
2099	struct mac_lomac *source, *dest;
2100
2101	source = SLOT(sc_label);
2102	dest = SLOT(mlabel);
2103	lomac_copy(source, dest);
2104}
2105
2106static int
2107lomac_system_check_acct(struct ucred *cred, struct vnode *vp,
2108    struct label *vplabel)
2109{
2110	struct mac_lomac *subj, *obj;
2111
2112	if (!lomac_enabled)
2113		return (0);
2114
2115	subj = SLOT(cred->cr_label);
2116	obj = SLOT(vplabel);
2117
2118	if (lomac_subject_privileged(subj))
2119		return (EPERM);
2120
2121	if (!lomac_high_single(obj))
2122		return (EACCES);
2123
2124	return (0);
2125}
2126
2127static int
2128lomac_system_check_auditctl(struct ucred *cred, struct vnode *vp,
2129    struct label *vplabel)
2130{
2131	struct mac_lomac *subj, *obj;
2132
2133	if (!lomac_enabled)
2134		return (0);
2135
2136	subj = SLOT(cred->cr_label);
2137	obj = SLOT(vplabel);
2138
2139	if (lomac_subject_privileged(subj))
2140		return (EPERM);
2141
2142	if (!lomac_high_single(obj))
2143		return (EACCES);
2144
2145	return (0);
2146}
2147
2148static int
2149lomac_system_check_swapoff(struct ucred *cred, struct vnode *vp,
2150    struct label *vplabel)
2151{
2152	struct mac_lomac *subj;
2153
2154	if (!lomac_enabled)
2155		return (0);
2156
2157	subj = SLOT(cred->cr_label);
2158
2159	if (lomac_subject_privileged(subj))
2160		return (EPERM);
2161
2162	return (0);
2163}
2164
2165static int
2166lomac_system_check_swapon(struct ucred *cred, struct vnode *vp,
2167    struct label *vplabel)
2168{
2169	struct mac_lomac *subj, *obj;
2170
2171	if (!lomac_enabled)
2172		return (0);
2173
2174	subj = SLOT(cred->cr_label);
2175	obj = SLOT(vplabel);
2176
2177	if (lomac_subject_privileged(subj))
2178		return (EPERM);
2179
2180	if (!lomac_high_single(obj))
2181		return (EACCES);
2182
2183	return (0);
2184}
2185
2186static int
2187lomac_system_check_sysctl(struct ucred *cred, struct sysctl_oid *oidp,
2188    void *arg1, int arg2, struct sysctl_req *req)
2189{
2190	struct mac_lomac *subj;
2191
2192	if (!lomac_enabled)
2193		return (0);
2194
2195	subj = SLOT(cred->cr_label);
2196
2197	/*
2198	 * Treat sysctl variables without CTLFLAG_ANYBODY flag as lomac/high,
2199	 * but also require privilege to change them.
2200	 */
2201	if (req->newptr != NULL && (oidp->oid_kind & CTLFLAG_ANYBODY) == 0) {
2202#ifdef notdef
2203		if (!lomac_subject_dominate_high(subj))
2204			return (EACCES);
2205#endif
2206
2207		if (lomac_subject_privileged(subj))
2208			return (EPERM);
2209	}
2210
2211	return (0);
2212}
2213
2214static void
2215lomac_thread_userret(struct thread *td)
2216{
2217	struct proc *p = td->td_proc;
2218	struct mac_lomac_proc *subj = PSLOT(p->p_label);
2219	struct ucred *newcred, *oldcred;
2220	int dodrop;
2221
2222	mtx_lock(&subj->mtx);
2223	if (subj->mac_lomac.ml_flags & MAC_LOMAC_FLAG_UPDATE) {
2224		dodrop = 0;
2225		mtx_unlock(&subj->mtx);
2226		newcred = crget();
2227		/*
2228		 * Prevent a lock order reversal in mac_proc_vm_revoke;
2229		 * ideally, the other user of subj->mtx wouldn't be holding
2230		 * Giant.
2231		 */
2232		mtx_lock(&Giant);
2233		PROC_LOCK(p);
2234		mtx_lock(&subj->mtx);
2235		/*
2236		 * Check if we lost the race while allocating the cred.
2237		 */
2238		if ((subj->mac_lomac.ml_flags & MAC_LOMAC_FLAG_UPDATE) == 0) {
2239			crfree(newcred);
2240			goto out;
2241		}
2242		oldcred = p->p_ucred;
2243		crcopy(newcred, oldcred);
2244		crhold(newcred);
2245		lomac_copy(&subj->mac_lomac, SLOT(newcred->cr_label));
2246		p->p_ucred = newcred;
2247		crfree(oldcred);
2248		dodrop = 1;
2249	out:
2250		mtx_unlock(&subj->mtx);
2251		PROC_UNLOCK(p);
2252		if (dodrop)
2253			mac_proc_vm_revoke(curthread);
2254		mtx_unlock(&Giant);
2255	} else {
2256		mtx_unlock(&subj->mtx);
2257	}
2258}
2259
2260static int
2261lomac_vnode_associate_extattr(struct mount *mp, struct label *mplabel,
2262    struct vnode *vp, struct label *vplabel)
2263{
2264	struct mac_lomac ml_temp, *source, *dest;
2265	int buflen, error;
2266
2267	source = SLOT(mplabel);
2268	dest = SLOT(vplabel);
2269
2270	buflen = sizeof(ml_temp);
2271	bzero(&ml_temp, buflen);
2272
2273	error = vn_extattr_get(vp, IO_NODELOCKED, MAC_LOMAC_EXTATTR_NAMESPACE,
2274	    MAC_LOMAC_EXTATTR_NAME, &buflen, (char *)&ml_temp, curthread);
2275	if (error == ENOATTR || error == EOPNOTSUPP) {
2276		/* Fall back to the mntlabel. */
2277		lomac_copy_single(source, dest);
2278		return (0);
2279	} else if (error)
2280		return (error);
2281
2282	if (buflen != sizeof(ml_temp)) {
2283		if (buflen != sizeof(ml_temp) - sizeof(ml_temp.ml_auxsingle)) {
2284			printf("lomac_vnode_associate_extattr: bad size %d\n",
2285			    buflen);
2286			return (EPERM);
2287		}
2288		bzero(&ml_temp.ml_auxsingle, sizeof(ml_temp.ml_auxsingle));
2289		buflen = sizeof(ml_temp);
2290		(void)vn_extattr_set(vp, IO_NODELOCKED,
2291		    MAC_LOMAC_EXTATTR_NAMESPACE, MAC_LOMAC_EXTATTR_NAME,
2292		    buflen, (char *)&ml_temp, curthread);
2293	}
2294	if (lomac_valid(&ml_temp) != 0) {
2295		printf("lomac_vnode_associate_extattr: invalid\n");
2296		return (EPERM);
2297	}
2298	if ((ml_temp.ml_flags & MAC_LOMAC_FLAGS_BOTH) !=
2299	    MAC_LOMAC_FLAG_SINGLE) {
2300		printf("lomac_vnode_associate_extattr: not single\n");
2301		return (EPERM);
2302	}
2303
2304	lomac_copy_single(&ml_temp, dest);
2305	return (0);
2306}
2307
2308static void
2309lomac_vnode_associate_singlelabel(struct mount *mp, struct label *mplabel,
2310    struct vnode *vp, struct label *vplabel)
2311{
2312	struct mac_lomac *source, *dest;
2313
2314	source = SLOT(mplabel);
2315	dest = SLOT(vplabel);
2316
2317	lomac_copy_single(source, dest);
2318}
2319
2320static int
2321lomac_vnode_check_create(struct ucred *cred, struct vnode *dvp,
2322    struct label *dvplabel, struct componentname *cnp, struct vattr *vap)
2323{
2324	struct mac_lomac *subj, *obj;
2325
2326	if (!lomac_enabled)
2327		return (0);
2328
2329	subj = SLOT(cred->cr_label);
2330	obj = SLOT(dvplabel);
2331
2332	if (!lomac_subject_dominate(subj, obj))
2333		return (EACCES);
2334	if (obj->ml_flags & MAC_LOMAC_FLAG_AUX &&
2335	    !lomac_dominate_element(&subj->ml_single, &obj->ml_auxsingle))
2336		return (EACCES);
2337
2338	return (0);
2339}
2340
2341static int
2342lomac_vnode_check_deleteacl(struct ucred *cred, struct vnode *vp,
2343    struct label *vplabel, acl_type_t type)
2344{
2345	struct mac_lomac *subj, *obj;
2346
2347	if (!lomac_enabled)
2348		return (0);
2349
2350	subj = SLOT(cred->cr_label);
2351	obj = SLOT(vplabel);
2352
2353	if (!lomac_subject_dominate(subj, obj))
2354		return (EACCES);
2355
2356	return (0);
2357}
2358
2359static int
2360lomac_vnode_check_link(struct ucred *cred, struct vnode *dvp,
2361    struct label *dvplabel, struct vnode *vp, struct label *vplabel,
2362    struct componentname *cnp)
2363{
2364	struct mac_lomac *subj, *obj;
2365
2366	if (!lomac_enabled)
2367		return (0);
2368
2369	subj = SLOT(cred->cr_label);
2370	obj = SLOT(dvplabel);
2371
2372	if (!lomac_subject_dominate(subj, obj))
2373		return (EACCES);
2374
2375	obj = SLOT(vplabel);
2376
2377	if (!lomac_subject_dominate(subj, obj))
2378		return (EACCES);
2379
2380	return (0);
2381}
2382
2383static int
2384lomac_vnode_check_mmap(struct ucred *cred, struct vnode *vp,
2385    struct label *vplabel, int prot, int flags)
2386{
2387	struct mac_lomac *subj, *obj;
2388
2389	/*
2390	 * Rely on the use of open()-time protections to handle
2391	 * non-revocation cases.
2392	 */
2393	if (!lomac_enabled)
2394		return (0);
2395
2396	subj = SLOT(cred->cr_label);
2397	obj = SLOT(vplabel);
2398
2399	if (((prot & VM_PROT_WRITE) != 0) && ((flags & MAP_SHARED) != 0)) {
2400		if (!lomac_subject_dominate(subj, obj))
2401			return (EACCES);
2402	}
2403	if (prot & (VM_PROT_READ | VM_PROT_EXECUTE)) {
2404		if (!lomac_dominate_single(obj, subj))
2405			return (maybe_demote(subj, obj, "mapping", "file", vp));
2406	}
2407
2408	return (0);
2409}
2410
2411static void
2412lomac_vnode_check_mmap_downgrade(struct ucred *cred, struct vnode *vp,
2413    struct label *vplabel, /* XXX vm_prot_t */ int *prot)
2414{
2415	struct mac_lomac *subj, *obj;
2416
2417	/*
2418	 * Rely on the use of open()-time protections to handle
2419	 * non-revocation cases.
2420	 */
2421	if (!lomac_enabled || !revocation_enabled)
2422		return;
2423
2424	subj = SLOT(cred->cr_label);
2425	obj = SLOT(vplabel);
2426
2427	if (!lomac_subject_dominate(subj, obj))
2428		*prot &= ~VM_PROT_WRITE;
2429}
2430
2431static int
2432lomac_vnode_check_open(struct ucred *cred, struct vnode *vp,
2433    struct label *vplabel, accmode_t accmode)
2434{
2435	struct mac_lomac *subj, *obj;
2436
2437	if (!lomac_enabled)
2438		return (0);
2439
2440	subj = SLOT(cred->cr_label);
2441	obj = SLOT(vplabel);
2442
2443	/* XXX privilege override for admin? */
2444	if (accmode & (VWRITE | VAPPEND | VADMIN)) {
2445		if (!lomac_subject_dominate(subj, obj))
2446			return (EACCES);
2447	}
2448
2449	return (0);
2450}
2451
2452static int
2453lomac_vnode_check_read(struct ucred *active_cred, struct ucred *file_cred,
2454    struct vnode *vp, struct label *vplabel)
2455{
2456	struct mac_lomac *subj, *obj;
2457
2458	if (!lomac_enabled || !revocation_enabled)
2459		return (0);
2460
2461	subj = SLOT(active_cred->cr_label);
2462	obj = SLOT(vplabel);
2463
2464	if (!lomac_dominate_single(obj, subj))
2465		return (maybe_demote(subj, obj, "reading", "file", vp));
2466
2467	return (0);
2468}
2469
2470static int
2471lomac_vnode_check_relabel(struct ucred *cred, struct vnode *vp,
2472    struct label *vplabel, struct label *newlabel)
2473{
2474	struct mac_lomac *old, *new, *subj;
2475	int error;
2476
2477	old = SLOT(vplabel);
2478	new = SLOT(newlabel);
2479	subj = SLOT(cred->cr_label);
2480
2481	/*
2482	 * If there is a LOMAC label update for the vnode, it must be a
2483	 * single label, with an optional explicit auxiliary single.
2484	 */
2485	error = lomac_atmostflags(new,
2486	    MAC_LOMAC_FLAG_SINGLE | MAC_LOMAC_FLAG_AUX);
2487	if (error)
2488		return (error);
2489
2490	/*
2491	 * To perform a relabel of the vnode (LOMAC label or not), LOMAC must
2492	 * authorize the relabel.
2493	 */
2494	if (!lomac_single_in_range(old, subj))
2495		return (EPERM);
2496
2497	/*
2498	 * If the LOMAC label is to be changed, authorize as appropriate.
2499	 */
2500	if (new->ml_flags & MAC_LOMAC_FLAG_SINGLE) {
2501		/*
2502		 * To change the LOMAC label on a vnode, the new vnode label
2503		 * must be in the subject range.
2504		 */
2505		if (!lomac_single_in_range(new, subj))
2506			return (EPERM);
2507
2508		/*
2509		 * To change the LOMAC label on the vnode to be EQUAL, the
2510		 * subject must have appropriate privilege.
2511		 */
2512		if (lomac_contains_equal(new)) {
2513			error = lomac_subject_privileged(subj);
2514			if (error)
2515				return (error);
2516		}
2517	}
2518	if (new->ml_flags & MAC_LOMAC_FLAG_AUX) {
2519		/*
2520		 * Fill in the missing parts from the previous label.
2521		 */
2522		if ((new->ml_flags & MAC_LOMAC_FLAG_SINGLE) == 0)
2523			lomac_copy_single(subj, new);
2524
2525		/*
2526		 * To change the auxiliary LOMAC label on a vnode, the new
2527		 * vnode label must be in the subject range.
2528		 */
2529		if (!lomac_auxsingle_in_range(new, subj))
2530			return (EPERM);
2531
2532		/*
2533		 * To change the auxiliary LOMAC label on the vnode to be
2534		 * EQUAL, the subject must have appropriate privilege.
2535		 */
2536		if (lomac_contains_equal(new)) {
2537			error = lomac_subject_privileged(subj);
2538			if (error)
2539				return (error);
2540		}
2541	}
2542
2543	return (0);
2544}
2545
2546static int
2547lomac_vnode_check_rename_from(struct ucred *cred, struct vnode *dvp,
2548    struct label *dvplabel, struct vnode *vp, struct label *vplabel,
2549    struct componentname *cnp)
2550{
2551	struct mac_lomac *subj, *obj;
2552
2553	if (!lomac_enabled)
2554		return (0);
2555
2556	subj = SLOT(cred->cr_label);
2557	obj = SLOT(dvplabel);
2558
2559	if (!lomac_subject_dominate(subj, obj))
2560		return (EACCES);
2561
2562	obj = SLOT(vplabel);
2563
2564	if (!lomac_subject_dominate(subj, obj))
2565		return (EACCES);
2566
2567	return (0);
2568}
2569
2570static int
2571lomac_vnode_check_rename_to(struct ucred *cred, struct vnode *dvp,
2572    struct label *dvplabel, struct vnode *vp, struct label *vplabel,
2573    int samedir, struct componentname *cnp)
2574{
2575	struct mac_lomac *subj, *obj;
2576
2577	if (!lomac_enabled)
2578		return (0);
2579
2580	subj = SLOT(cred->cr_label);
2581	obj = SLOT(dvplabel);
2582
2583	if (!lomac_subject_dominate(subj, obj))
2584		return (EACCES);
2585
2586	if (vp != NULL) {
2587		obj = SLOT(vplabel);
2588
2589		if (!lomac_subject_dominate(subj, obj))
2590			return (EACCES);
2591	}
2592
2593	return (0);
2594}
2595
2596static int
2597lomac_vnode_check_revoke(struct ucred *cred, struct vnode *vp,
2598    struct label *vplabel)
2599{
2600	struct mac_lomac *subj, *obj;
2601
2602	if (!lomac_enabled)
2603		return (0);
2604
2605	subj = SLOT(cred->cr_label);
2606	obj = SLOT(vplabel);
2607
2608	if (!lomac_subject_dominate(subj, obj))
2609		return (EACCES);
2610
2611	return (0);
2612}
2613
2614static int
2615lomac_vnode_check_setacl(struct ucred *cred, struct vnode *vp,
2616    struct label *vplabel, acl_type_t type, struct acl *acl)
2617{
2618	struct mac_lomac *subj, *obj;
2619
2620	if (!lomac_enabled)
2621		return (0);
2622
2623	subj = SLOT(cred->cr_label);
2624	obj = SLOT(vplabel);
2625
2626	if (!lomac_subject_dominate(subj, obj))
2627		return (EACCES);
2628
2629	return (0);
2630}
2631
2632static int
2633lomac_vnode_check_setextattr(struct ucred *cred, struct vnode *vp,
2634    struct label *vplabel, int attrnamespace, const char *name,
2635    struct uio *uio)
2636{
2637	struct mac_lomac *subj, *obj;
2638
2639	if (!lomac_enabled)
2640		return (0);
2641
2642	subj = SLOT(cred->cr_label);
2643	obj = SLOT(vplabel);
2644
2645	if (!lomac_subject_dominate(subj, obj))
2646		return (EACCES);
2647
2648	/* XXX: protect the MAC EA in a special way? */
2649
2650	return (0);
2651}
2652
2653static int
2654lomac_vnode_check_setflags(struct ucred *cred, struct vnode *vp,
2655    struct label *vplabel, u_long flags)
2656{
2657	struct mac_lomac *subj, *obj;
2658
2659	if (!lomac_enabled)
2660		return (0);
2661
2662	subj = SLOT(cred->cr_label);
2663	obj = SLOT(vplabel);
2664
2665	if (!lomac_subject_dominate(subj, obj))
2666		return (EACCES);
2667
2668	return (0);
2669}
2670
2671static int
2672lomac_vnode_check_setmode(struct ucred *cred, struct vnode *vp,
2673    struct label *vplabel, mode_t mode)
2674{
2675	struct mac_lomac *subj, *obj;
2676
2677	if (!lomac_enabled)
2678		return (0);
2679
2680	subj = SLOT(cred->cr_label);
2681	obj = SLOT(vplabel);
2682
2683	if (!lomac_subject_dominate(subj, obj))
2684		return (EACCES);
2685
2686	return (0);
2687}
2688
2689static int
2690lomac_vnode_check_setowner(struct ucred *cred, struct vnode *vp,
2691    struct label *vplabel, uid_t uid, gid_t gid)
2692{
2693	struct mac_lomac *subj, *obj;
2694
2695	if (!lomac_enabled)
2696		return (0);
2697
2698	subj = SLOT(cred->cr_label);
2699	obj = SLOT(vplabel);
2700
2701	if (!lomac_subject_dominate(subj, obj))
2702		return (EACCES);
2703
2704	return (0);
2705}
2706
2707static int
2708lomac_vnode_check_setutimes(struct ucred *cred, struct vnode *vp,
2709    struct label *vplabel, struct timespec atime, struct timespec mtime)
2710{
2711	struct mac_lomac *subj, *obj;
2712
2713	if (!lomac_enabled)
2714		return (0);
2715
2716	subj = SLOT(cred->cr_label);
2717	obj = SLOT(vplabel);
2718
2719	if (!lomac_subject_dominate(subj, obj))
2720		return (EACCES);
2721
2722	return (0);
2723}
2724
2725static int
2726lomac_vnode_check_unlink(struct ucred *cred, struct vnode *dvp,
2727    struct label *dvplabel, struct vnode *vp, struct label *vplabel,
2728    struct componentname *cnp)
2729{
2730	struct mac_lomac *subj, *obj;
2731
2732	if (!lomac_enabled)
2733		return (0);
2734
2735	subj = SLOT(cred->cr_label);
2736	obj = SLOT(dvplabel);
2737
2738	if (!lomac_subject_dominate(subj, obj))
2739		return (EACCES);
2740
2741	obj = SLOT(vplabel);
2742
2743	if (!lomac_subject_dominate(subj, obj))
2744		return (EACCES);
2745
2746	return (0);
2747}
2748
2749static int
2750lomac_vnode_check_write(struct ucred *active_cred,
2751    struct ucred *file_cred, struct vnode *vp, struct label *vplabel)
2752{
2753	struct mac_lomac *subj, *obj;
2754
2755	if (!lomac_enabled || !revocation_enabled)
2756		return (0);
2757
2758	subj = SLOT(active_cred->cr_label);
2759	obj = SLOT(vplabel);
2760
2761	if (!lomac_subject_dominate(subj, obj))
2762		return (EACCES);
2763
2764	return (0);
2765}
2766
2767static int
2768lomac_vnode_create_extattr(struct ucred *cred, struct mount *mp,
2769    struct label *mplabel, struct vnode *dvp, struct label *dvplabel,
2770    struct vnode *vp, struct label *vplabel, struct componentname *cnp)
2771{
2772	struct mac_lomac *source, *dest, *dir, temp;
2773	size_t buflen;
2774	int error;
2775
2776	buflen = sizeof(temp);
2777	bzero(&temp, buflen);
2778
2779	source = SLOT(cred->cr_label);
2780	dest = SLOT(vplabel);
2781	dir = SLOT(dvplabel);
2782	if (dir->ml_flags & MAC_LOMAC_FLAG_AUX) {
2783		lomac_copy_auxsingle(dir, &temp);
2784		lomac_set_single(&temp, dir->ml_auxsingle.mle_type,
2785		    dir->ml_auxsingle.mle_grade);
2786	} else {
2787		lomac_copy_single(source, &temp);
2788	}
2789
2790	error = vn_extattr_set(vp, IO_NODELOCKED, MAC_LOMAC_EXTATTR_NAMESPACE,
2791	    MAC_LOMAC_EXTATTR_NAME, buflen, (char *)&temp, curthread);
2792	if (error == 0)
2793		lomac_copy(&temp, dest);
2794	return (error);
2795}
2796
2797static void
2798lomac_vnode_execve_transition(struct ucred *old, struct ucred *new,
2799    struct vnode *vp, struct label *vplabel, struct label *interpvplabel,
2800    struct image_params *imgp, struct label *execlabel)
2801{
2802	struct mac_lomac *source, *dest, *obj, *robj;
2803
2804	source = SLOT(old->cr_label);
2805	dest = SLOT(new->cr_label);
2806	obj = SLOT(vplabel);
2807	robj = interpvplabel != NULL ? SLOT(interpvplabel) : obj;
2808
2809	lomac_copy(source, dest);
2810	/*
2811	 * If there's an auxiliary label on the real object, respect it and
2812	 * assume that this level should be assumed immediately if a higher
2813	 * level is currently in place.
2814	 */
2815	if (robj->ml_flags & MAC_LOMAC_FLAG_AUX &&
2816	    !lomac_dominate_element(&robj->ml_auxsingle, &dest->ml_single)
2817	    && lomac_auxsingle_in_range(robj, dest))
2818		lomac_set_single(dest, robj->ml_auxsingle.mle_type,
2819		    robj->ml_auxsingle.mle_grade);
2820	/*
2821	 * Restructuring to use the execve transitioning mechanism instead of
2822	 * the normal demotion mechanism here would be difficult, so just
2823	 * copy the label over and perform standard demotion.  This is also
2824	 * non-optimal because it will result in the intermediate label "new"
2825	 * being created and immediately recycled.
2826	 */
2827	if (lomac_enabled && revocation_enabled &&
2828	    !lomac_dominate_single(obj, source))
2829		(void)maybe_demote(source, obj, "executing", "file", vp);
2830}
2831
2832static int
2833lomac_vnode_execve_will_transition(struct ucred *old, struct vnode *vp,
2834    struct label *vplabel, struct label *interpvplabel,
2835    struct image_params *imgp, struct label *execlabel)
2836{
2837	struct mac_lomac *subj, *obj, *robj;
2838
2839	if (!lomac_enabled || !revocation_enabled)
2840		return (0);
2841
2842	subj = SLOT(old->cr_label);
2843	obj = SLOT(vplabel);
2844	robj = interpvplabel != NULL ? SLOT(interpvplabel) : obj;
2845
2846	return ((robj->ml_flags & MAC_LOMAC_FLAG_AUX &&
2847	    !lomac_dominate_element(&robj->ml_auxsingle, &subj->ml_single)
2848	    && lomac_auxsingle_in_range(robj, subj)) ||
2849	    !lomac_dominate_single(obj, subj));
2850}
2851
2852static void
2853lomac_vnode_relabel(struct ucred *cred, struct vnode *vp,
2854    struct label *vplabel, struct label *newlabel)
2855{
2856	struct mac_lomac *source, *dest;
2857
2858	source = SLOT(newlabel);
2859	dest = SLOT(vplabel);
2860
2861	try_relabel(source, dest);
2862}
2863
2864static int
2865lomac_vnode_setlabel_extattr(struct ucred *cred, struct vnode *vp,
2866    struct label *vplabel, struct label *intlabel)
2867{
2868	struct mac_lomac *source, temp;
2869	size_t buflen;
2870	int error;
2871
2872	buflen = sizeof(temp);
2873	bzero(&temp, buflen);
2874
2875	source = SLOT(intlabel);
2876	if ((source->ml_flags & MAC_LOMAC_FLAG_SINGLE) == 0)
2877		return (0);
2878
2879	lomac_copy_single(source, &temp);
2880	error = vn_extattr_set(vp, IO_NODELOCKED, MAC_LOMAC_EXTATTR_NAMESPACE,
2881	    MAC_LOMAC_EXTATTR_NAME, buflen, (char *)&temp, curthread);
2882	return (error);
2883}
2884
2885static struct mac_policy_ops lomac_ops =
2886{
2887	.mpo_init = lomac_init,
2888
2889	.mpo_bpfdesc_check_receive = lomac_bpfdesc_check_receive,
2890	.mpo_bpfdesc_create = lomac_bpfdesc_create,
2891	.mpo_bpfdesc_create_mbuf = lomac_bpfdesc_create_mbuf,
2892	.mpo_bpfdesc_destroy_label = lomac_destroy_label,
2893	.mpo_bpfdesc_init_label = lomac_init_label,
2894
2895	.mpo_cred_check_relabel = lomac_cred_check_relabel,
2896	.mpo_cred_check_visible = lomac_cred_check_visible,
2897	.mpo_cred_copy_label = lomac_copy_label,
2898	.mpo_cred_create_swapper = lomac_cred_create_swapper,
2899	.mpo_cred_create_init = lomac_cred_create_init,
2900	.mpo_cred_destroy_label = lomac_destroy_label,
2901	.mpo_cred_externalize_label = lomac_externalize_label,
2902	.mpo_cred_init_label = lomac_init_label,
2903	.mpo_cred_internalize_label = lomac_internalize_label,
2904	.mpo_cred_relabel = lomac_cred_relabel,
2905
2906	.mpo_devfs_create_device = lomac_devfs_create_device,
2907	.mpo_devfs_create_directory = lomac_devfs_create_directory,
2908	.mpo_devfs_create_symlink = lomac_devfs_create_symlink,
2909	.mpo_devfs_destroy_label = lomac_destroy_label,
2910	.mpo_devfs_init_label = lomac_init_label,
2911	.mpo_devfs_update = lomac_devfs_update,
2912	.mpo_devfs_vnode_associate = lomac_devfs_vnode_associate,
2913
2914	.mpo_ifnet_check_relabel = lomac_ifnet_check_relabel,
2915	.mpo_ifnet_check_transmit = lomac_ifnet_check_transmit,
2916	.mpo_ifnet_copy_label = lomac_copy_label,
2917	.mpo_ifnet_create = lomac_ifnet_create,
2918	.mpo_ifnet_create_mbuf = lomac_ifnet_create_mbuf,
2919	.mpo_ifnet_destroy_label = lomac_destroy_label,
2920	.mpo_ifnet_externalize_label = lomac_externalize_label,
2921	.mpo_ifnet_init_label = lomac_init_label,
2922	.mpo_ifnet_internalize_label = lomac_internalize_label,
2923	.mpo_ifnet_relabel = lomac_ifnet_relabel,
2924
2925	.mpo_syncache_create = lomac_syncache_create,
2926	.mpo_syncache_destroy_label = lomac_destroy_label,
2927	.mpo_syncache_init_label = lomac_init_label_waitcheck,
2928
2929	.mpo_inpcb_check_deliver = lomac_inpcb_check_deliver,
2930	.mpo_inpcb_check_visible = lomac_inpcb_check_visible,
2931	.mpo_inpcb_create = lomac_inpcb_create,
2932	.mpo_inpcb_create_mbuf = lomac_inpcb_create_mbuf,
2933	.mpo_inpcb_destroy_label = lomac_destroy_label,
2934	.mpo_inpcb_init_label = lomac_init_label_waitcheck,
2935	.mpo_inpcb_sosetlabel = lomac_inpcb_sosetlabel,
2936
2937	.mpo_ip6q_create = lomac_ip6q_create,
2938	.mpo_ip6q_destroy_label = lomac_destroy_label,
2939	.mpo_ip6q_init_label = lomac_init_label_waitcheck,
2940	.mpo_ip6q_match = lomac_ip6q_match,
2941	.mpo_ip6q_reassemble = lomac_ip6q_reassemble,
2942	.mpo_ip6q_update = lomac_ip6q_update,
2943
2944	.mpo_ipq_create = lomac_ipq_create,
2945	.mpo_ipq_destroy_label = lomac_destroy_label,
2946	.mpo_ipq_init_label = lomac_init_label_waitcheck,
2947	.mpo_ipq_match = lomac_ipq_match,
2948	.mpo_ipq_reassemble = lomac_ipq_reassemble,
2949	.mpo_ipq_update = lomac_ipq_update,
2950
2951	.mpo_kld_check_load = lomac_kld_check_load,
2952
2953	.mpo_mbuf_copy_label = lomac_copy_label,
2954	.mpo_mbuf_destroy_label = lomac_destroy_label,
2955	.mpo_mbuf_init_label = lomac_init_label_waitcheck,
2956
2957	.mpo_mount_create = lomac_mount_create,
2958	.mpo_mount_destroy_label = lomac_destroy_label,
2959	.mpo_mount_init_label = lomac_init_label,
2960
2961	.mpo_netatalk_aarp_send = lomac_netatalk_aarp_send,
2962
2963	.mpo_netinet_arp_send = lomac_netinet_arp_send,
2964	.mpo_netinet_firewall_reply = lomac_netinet_firewall_reply,
2965	.mpo_netinet_firewall_send = lomac_netinet_firewall_send,
2966	.mpo_netinet_fragment = lomac_netinet_fragment,
2967	.mpo_netinet_icmp_reply = lomac_netinet_icmp_reply,
2968	.mpo_netinet_igmp_send = lomac_netinet_igmp_send,
2969
2970	.mpo_netinet6_nd6_send = lomac_netinet6_nd6_send,
2971
2972	.mpo_pipe_check_ioctl = lomac_pipe_check_ioctl,
2973	.mpo_pipe_check_read = lomac_pipe_check_read,
2974	.mpo_pipe_check_relabel = lomac_pipe_check_relabel,
2975	.mpo_pipe_check_write = lomac_pipe_check_write,
2976	.mpo_pipe_copy_label = lomac_copy_label,
2977	.mpo_pipe_create = lomac_pipe_create,
2978	.mpo_pipe_destroy_label = lomac_destroy_label,
2979	.mpo_pipe_externalize_label = lomac_externalize_label,
2980	.mpo_pipe_init_label = lomac_init_label,
2981	.mpo_pipe_internalize_label = lomac_internalize_label,
2982	.mpo_pipe_relabel = lomac_pipe_relabel,
2983
2984	.mpo_priv_check = lomac_priv_check,
2985
2986	.mpo_proc_check_debug = lomac_proc_check_debug,
2987	.mpo_proc_check_sched = lomac_proc_check_sched,
2988	.mpo_proc_check_signal = lomac_proc_check_signal,
2989	.mpo_proc_destroy_label = lomac_proc_destroy_label,
2990	.mpo_proc_init_label = lomac_proc_init_label,
2991
2992	.mpo_socket_check_deliver = lomac_socket_check_deliver,
2993	.mpo_socket_check_relabel = lomac_socket_check_relabel,
2994	.mpo_socket_check_visible = lomac_socket_check_visible,
2995	.mpo_socket_copy_label = lomac_copy_label,
2996	.mpo_socket_create = lomac_socket_create,
2997	.mpo_socket_create_mbuf = lomac_socket_create_mbuf,
2998	.mpo_socket_destroy_label = lomac_destroy_label,
2999	.mpo_socket_externalize_label = lomac_externalize_label,
3000	.mpo_socket_init_label = lomac_init_label_waitcheck,
3001	.mpo_socket_internalize_label = lomac_internalize_label,
3002	.mpo_socket_newconn = lomac_socket_newconn,
3003	.mpo_socket_relabel = lomac_socket_relabel,
3004
3005	.mpo_socketpeer_destroy_label = lomac_destroy_label,
3006	.mpo_socketpeer_externalize_label = lomac_externalize_label,
3007	.mpo_socketpeer_init_label = lomac_init_label_waitcheck,
3008	.mpo_socketpeer_set_from_mbuf = lomac_socketpeer_set_from_mbuf,
3009	.mpo_socketpeer_set_from_socket = lomac_socketpeer_set_from_socket,
3010
3011	.mpo_syncache_create_mbuf = lomac_syncache_create_mbuf,
3012
3013	.mpo_system_check_acct = lomac_system_check_acct,
3014	.mpo_system_check_auditctl = lomac_system_check_auditctl,
3015	.mpo_system_check_swapoff = lomac_system_check_swapoff,
3016	.mpo_system_check_swapon = lomac_system_check_swapon,
3017	.mpo_system_check_sysctl = lomac_system_check_sysctl,
3018
3019	.mpo_thread_userret = lomac_thread_userret,
3020
3021	.mpo_vnode_associate_extattr = lomac_vnode_associate_extattr,
3022	.mpo_vnode_associate_singlelabel = lomac_vnode_associate_singlelabel,
3023	.mpo_vnode_check_access = lomac_vnode_check_open,
3024	.mpo_vnode_check_create = lomac_vnode_check_create,
3025	.mpo_vnode_check_deleteacl = lomac_vnode_check_deleteacl,
3026	.mpo_vnode_check_link = lomac_vnode_check_link,
3027	.mpo_vnode_check_mmap = lomac_vnode_check_mmap,
3028	.mpo_vnode_check_mmap_downgrade = lomac_vnode_check_mmap_downgrade,
3029	.mpo_vnode_check_open = lomac_vnode_check_open,
3030	.mpo_vnode_check_read = lomac_vnode_check_read,
3031	.mpo_vnode_check_relabel = lomac_vnode_check_relabel,
3032	.mpo_vnode_check_rename_from = lomac_vnode_check_rename_from,
3033	.mpo_vnode_check_rename_to = lomac_vnode_check_rename_to,
3034	.mpo_vnode_check_revoke = lomac_vnode_check_revoke,
3035	.mpo_vnode_check_setacl = lomac_vnode_check_setacl,
3036	.mpo_vnode_check_setextattr = lomac_vnode_check_setextattr,
3037	.mpo_vnode_check_setflags = lomac_vnode_check_setflags,
3038	.mpo_vnode_check_setmode = lomac_vnode_check_setmode,
3039	.mpo_vnode_check_setowner = lomac_vnode_check_setowner,
3040	.mpo_vnode_check_setutimes = lomac_vnode_check_setutimes,
3041	.mpo_vnode_check_unlink = lomac_vnode_check_unlink,
3042	.mpo_vnode_check_write = lomac_vnode_check_write,
3043	.mpo_vnode_copy_label = lomac_copy_label,
3044	.mpo_vnode_create_extattr = lomac_vnode_create_extattr,
3045	.mpo_vnode_destroy_label = lomac_destroy_label,
3046	.mpo_vnode_execve_transition = lomac_vnode_execve_transition,
3047	.mpo_vnode_execve_will_transition = lomac_vnode_execve_will_transition,
3048	.mpo_vnode_externalize_label = lomac_externalize_label,
3049	.mpo_vnode_init_label = lomac_init_label,
3050	.mpo_vnode_internalize_label = lomac_internalize_label,
3051	.mpo_vnode_relabel = lomac_vnode_relabel,
3052	.mpo_vnode_setlabel_extattr = lomac_vnode_setlabel_extattr,
3053};
3054
3055#define	LOMAC_OBJECTS	(MPC_OBJECT_CRED |				\
3056			 /* MPC_OBJECT_PROC | */			\
3057			 MPC_OBJECT_VNODE |				\
3058			 MPC_OBJECT_INPCB |				\
3059			 MPC_OBJECT_SOCKET |				\
3060			 MPC_OBJECT_DEVFS |				\
3061			 MPC_OBJECT_MBUF |				\
3062			 MPC_OBJECT_IPQ |				\
3063			 MPC_OBJECT_IFNET |				\
3064			 MPC_OBJECT_BPFDESC |				\
3065			 MPC_OBJECT_PIPE |				\
3066			 MPC_OBJECT_MOUNT |				\
3067			 /* MPC_OBJECT_POSIXSEM | */			\
3068			 /* MPC_OBJECT_POSIXSHM | */			\
3069			 /* MPC_OBJECT_SYSVMSG | */			\
3070			 /* MPC_OBJECT_SYSVMSQ | */			\
3071			 /* MPC_OBJECT_SYSVSEM | */			\
3072			 /* MPC_OBJECT_SYSVSHM | */			\
3073			 MPC_OBJECT_SYNCACHE)
3074
3075MAC_POLICY_SET(&lomac_ops, mac_lomac, "TrustedBSD MAC/LOMAC",
3076    MPC_LOADTIME_FLAG_NOTLATE, &lomac_slot, LOMAC_OBJECTS);
3077