mac_stub.c revision 119211
1/*- 2 * Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson 3 * Copyright (c) 2001, 2002, 2003 Networks Associates Technology, Inc. 4 * All rights reserved. 5 * 6 * This software was developed by Robert Watson for the TrustedBSD Project. 7 * 8 * This software was developed for the FreeBSD Project in part by Network 9 * Associates Laboratories, the Security Research Division of Network 10 * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), 11 * as part of the DARPA CHATS research program. 12 * 13 * Redistribution and use in source and binary forms, with or without 14 * modification, are permitted provided that the following conditions 15 * are met: 16 * 1. Redistributions of source code must retain the above copyright 17 * notice, this list of conditions and the following disclaimer. 18 * 2. Redistributions in binary form must reproduce the above copyright 19 * notice, this list of conditions and the following disclaimer in the 20 * documentation and/or other materials provided with the distribution. 21 * 22 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 23 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 24 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 25 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 26 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 27 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 28 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 29 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 30 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 31 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 32 * SUCH DAMAGE. 33 * 34 * $FreeBSD: head/sys/security/mac_stub/mac_stub.c 119211 2003-08-21 16:22:52Z rwatson $ 35 */ 36 37/* 38 * Developed by the TrustedBSD Project. 39 * 40 * Stub module that implements a NOOP for most (if not all) MAC Framework 41 * policy entry points. 42 */ 43 44#include <sys/types.h> 45#include <sys/param.h> 46#include <sys/acl.h> 47#include <sys/conf.h> 48#include <sys/extattr.h> 49#include <sys/kernel.h> 50#include <sys/mac.h> 51#include <sys/mount.h> 52#include <sys/proc.h> 53#include <sys/systm.h> 54#include <sys/sysproto.h> 55#include <sys/sysent.h> 56#include <sys/vnode.h> 57#include <sys/file.h> 58#include <sys/socket.h> 59#include <sys/socketvar.h> 60#include <sys/pipe.h> 61#include <sys/sysctl.h> 62 63#include <fs/devfs/devfs.h> 64 65#include <net/bpfdesc.h> 66#include <net/if.h> 67#include <net/if_types.h> 68#include <net/if_var.h> 69 70#include <netinet/in.h> 71#include <netinet/ip_var.h> 72 73#include <vm/vm.h> 74 75#include <sys/mac_policy.h> 76 77SYSCTL_DECL(_security_mac); 78 79SYSCTL_NODE(_security_mac, OID_AUTO, stub, CTLFLAG_RW, 0, 80 "TrustedBSD mac_stub policy controls"); 81 82static int stub_enabled = 1; 83SYSCTL_INT(_security_mac_stub, OID_AUTO, enabled, CTLFLAG_RW, 84 &stub_enabled, 0, "Enforce mac_stub policy"); 85 86/* 87 * Policy module operations. 88 */ 89static void 90stub_destroy(struct mac_policy_conf *conf) 91{ 92 93} 94 95static void 96stub_init(struct mac_policy_conf *conf) 97{ 98 99} 100 101static int 102stub_syscall(struct thread *td, int call, void *arg) 103{ 104 105 return (0); 106} 107 108/* 109 * Label operations. 110 */ 111static void 112stub_init_label(struct label *label) 113{ 114 115} 116 117static int 118stub_init_label_waitcheck(struct label *label, int flag) 119{ 120 121 return (0); 122} 123 124static void 125stub_destroy_label(struct label *label) 126{ 127 128} 129 130static int 131stub_externalize_label(struct label *label, char *element_name, 132 struct sbuf *sb, int *claimed) 133{ 134 135 return (0); 136} 137 138static int 139stub_internalize_label(struct label *label, char *element_name, 140 char *element_data, int *claimed) 141{ 142 143 return (0); 144} 145 146/* 147 * Labeling event operations: file system objects, and things that look 148 * a lot like file system objects. 149 */ 150static void 151stub_associate_vnode_devfs(struct mount *mp, struct label *fslabel, 152 struct devfs_dirent *de, struct label *delabel, struct vnode *vp, 153 struct label *vlabel) 154{ 155 156} 157 158static int 159stub_associate_vnode_extattr(struct mount *mp, struct label *fslabel, 160 struct vnode *vp, struct label *vlabel) 161{ 162 163 return (0); 164} 165 166static void 167stub_associate_vnode_singlelabel(struct mount *mp, 168 struct label *fslabel, struct vnode *vp, struct label *vlabel) 169{ 170 171} 172 173static void 174stub_create_devfs_device(struct mount *mp, dev_t dev, 175 struct devfs_dirent *devfs_dirent, struct label *label) 176{ 177 178} 179 180static void 181stub_create_devfs_directory(struct mount *mp, char *dirname, 182 int dirnamelen, struct devfs_dirent *devfs_dirent, struct label *label) 183{ 184 185} 186 187static void 188stub_create_devfs_symlink(struct ucred *cred, struct mount *mp, 189 struct devfs_dirent *dd, struct label *ddlabel, struct devfs_dirent *de, 190 struct label *delabel) 191{ 192 193} 194 195static int 196stub_create_vnode_extattr(struct ucred *cred, struct mount *mp, 197 struct label *fslabel, struct vnode *dvp, struct label *dlabel, 198 struct vnode *vp, struct label *vlabel, struct componentname *cnp) 199{ 200 201 return (0); 202} 203 204static void 205stub_create_mount(struct ucred *cred, struct mount *mp, 206 struct label *mntlabel, struct label *fslabel) 207{ 208 209} 210 211static void 212stub_create_root_mount(struct ucred *cred, struct mount *mp, 213 struct label *mntlabel, struct label *fslabel) 214{ 215 216} 217 218static void 219stub_relabel_vnode(struct ucred *cred, struct vnode *vp, 220 struct label *vnodelabel, struct label *label) 221{ 222 223} 224 225static int 226stub_setlabel_vnode_extattr(struct ucred *cred, struct vnode *vp, 227 struct label *vlabel, struct label *intlabel) 228{ 229 230 return (0); 231} 232 233static void 234stub_update_devfsdirent(struct mount *mp, 235 struct devfs_dirent *devfs_dirent, struct label *direntlabel, 236 struct vnode *vp, struct label *vnodelabel) 237{ 238 239} 240 241/* 242 * Labeling event operations: IPC object. 243 */ 244static void 245stub_create_mbuf_from_socket(struct socket *so, struct label *socketlabel, 246 struct mbuf *m, struct label *mbuflabel) 247{ 248 249} 250 251static void 252stub_create_socket(struct ucred *cred, struct socket *socket, 253 struct label *socketlabel) 254{ 255 256} 257 258static void 259stub_create_pipe(struct ucred *cred, struct pipe *pipe, 260 struct label *pipelabel) 261{ 262 263} 264 265static void 266stub_create_socket_from_socket(struct socket *oldsocket, 267 struct label *oldsocketlabel, struct socket *newsocket, 268 struct label *newsocketlabel) 269{ 270 271} 272 273static void 274stub_relabel_socket(struct ucred *cred, struct socket *socket, 275 struct label *socketlabel, struct label *newlabel) 276{ 277 278} 279 280static void 281stub_relabel_pipe(struct ucred *cred, struct pipe *pipe, 282 struct label *pipelabel, struct label *newlabel) 283{ 284 285} 286 287static void 288stub_set_socket_peer_from_mbuf(struct mbuf *mbuf, struct label *mbuflabel, 289 struct socket *socket, struct label *socketpeerlabel) 290{ 291 292} 293 294static void 295stub_set_socket_peer_from_socket(struct socket *oldsocket, 296 struct label *oldsocketlabel, struct socket *newsocket, 297 struct label *newsocketpeerlabel) 298{ 299 300} 301 302/* 303 * Labeling event operations: network objects. 304 */ 305static void 306stub_create_bpfdesc(struct ucred *cred, struct bpf_d *bpf_d, 307 struct label *bpflabel) 308{ 309 310} 311 312static void 313stub_create_datagram_from_ipq(struct ipq *ipq, struct label *ipqlabel, 314 struct mbuf *datagram, struct label *datagramlabel) 315{ 316 317} 318 319static void 320stub_create_fragment(struct mbuf *datagram, struct label *datagramlabel, 321 struct mbuf *fragment, struct label *fragmentlabel) 322{ 323 324} 325 326static void 327stub_create_ifnet(struct ifnet *ifnet, struct label *ifnetlabel) 328{ 329 330} 331 332static void 333stub_create_ipq(struct mbuf *fragment, struct label *fragmentlabel, 334 struct ipq *ipq, struct label *ipqlabel) 335{ 336 337} 338 339static void 340stub_create_mbuf_from_mbuf(struct mbuf *oldmbuf, 341 struct label *oldmbuflabel, struct mbuf *newmbuf, 342 struct label *newmbuflabel) 343{ 344 345} 346 347static void 348stub_create_mbuf_linklayer(struct ifnet *ifnet, struct label *ifnetlabel, 349 struct mbuf *mbuf, struct label *mbuflabel) 350{ 351 352} 353 354static void 355stub_create_mbuf_from_bpfdesc(struct bpf_d *bpf_d, struct label *bpflabel, 356 struct mbuf *mbuf, struct label *mbuflabel) 357{ 358 359} 360 361static void 362stub_create_mbuf_from_ifnet(struct ifnet *ifnet, struct label *ifnetlabel, 363 struct mbuf *m, struct label *mbuflabel) 364{ 365 366} 367 368static void 369stub_create_mbuf_multicast_encap(struct mbuf *oldmbuf, 370 struct label *oldmbuflabel, struct ifnet *ifnet, struct label *ifnetlabel, 371 struct mbuf *newmbuf, struct label *newmbuflabel) 372{ 373 374} 375 376static void 377stub_create_mbuf_netlayer(struct mbuf *oldmbuf, 378 struct label *oldmbuflabel, struct mbuf *newmbuf, struct label *newmbuflabel) 379{ 380 381} 382 383static int 384stub_fragment_match(struct mbuf *fragment, struct label *fragmentlabel, 385 struct ipq *ipq, struct label *ipqlabel) 386{ 387 388 return (1); 389} 390 391static void 392stub_relabel_ifnet(struct ucred *cred, struct ifnet *ifnet, 393 struct label *ifnetlabel, struct label *newlabel) 394{ 395 396} 397 398static void 399stub_update_ipq(struct mbuf *fragment, struct label *fragmentlabel, 400 struct ipq *ipq, struct label *ipqlabel) 401{ 402 403} 404 405/* 406 * Labeling event operations: processes. 407 */ 408static void 409stub_create_cred(struct ucred *cred_parent, struct ucred *cred_child) 410{ 411 412} 413 414static void 415stub_execve_transition(struct ucred *old, struct ucred *new, 416 struct vnode *vp, struct label *vnodelabel, 417 struct label *interpvnodelabel, struct image_params *imgp, 418 struct label *execlabel) 419{ 420 421} 422 423static int 424stub_execve_will_transition(struct ucred *old, struct vnode *vp, 425 struct label *vnodelabel, struct label *interpvnodelabel, 426 struct image_params *imgp, struct label *execlabel) 427{ 428 429 return (0); 430} 431 432static void 433stub_create_proc0(struct ucred *cred) 434{ 435 436} 437 438static void 439stub_create_proc1(struct ucred *cred) 440{ 441 442} 443 444static void 445stub_relabel_cred(struct ucred *cred, struct label *newlabel) 446{ 447 448} 449 450static void 451stub_thread_userret(struct thread *td) 452{ 453 454} 455 456/* 457 * Access control checks. 458 */ 459static int 460stub_check_bpfdesc_receive(struct bpf_d *bpf_d, struct label *bpflabel, 461 struct ifnet *ifnet, struct label *ifnet_label) 462{ 463 464 return (0); 465} 466 467static int 468stub_check_cred_relabel(struct ucred *cred, struct label *newlabel) 469{ 470 471 return (0); 472} 473 474static int 475stub_check_cred_visible(struct ucred *u1, struct ucred *u2) 476{ 477 478 return (0); 479} 480 481static int 482stub_check_ifnet_relabel(struct ucred *cred, struct ifnet *ifnet, 483 struct label *ifnetlabel, struct label *newlabel) 484{ 485 486 return (0); 487} 488 489static int 490stub_check_ifnet_transmit(struct ifnet *ifnet, struct label *ifnetlabel, 491 struct mbuf *m, struct label *mbuflabel) 492{ 493 494 return (0); 495} 496 497static int 498stub_check_kenv_dump(struct ucred *cred) 499{ 500 501 return (0); 502} 503 504static int 505stub_check_kenv_get(struct ucred *cred, char *name) 506{ 507 508 return (0); 509} 510 511static int 512stub_check_kenv_set(struct ucred *cred, char *name, char *value) 513{ 514 515 return (0); 516} 517 518static int 519stub_check_kenv_unset(struct ucred *cred, char *name) 520{ 521 522 return (0); 523} 524 525static int 526stub_check_kld_load(struct ucred *cred, struct vnode *vp, 527 struct label *vlabel) 528{ 529 530 return (0); 531} 532 533static int 534stub_check_kld_stat(struct ucred *cred) 535{ 536 537 return (0); 538} 539 540static int 541stub_check_kld_unload(struct ucred *cred) 542{ 543 544 return (0); 545} 546 547static int 548stub_check_mount_stat(struct ucred *cred, struct mount *mp, 549 struct label *mntlabel) 550{ 551 552 return (0); 553} 554 555static int 556stub_check_pipe_ioctl(struct ucred *cred, struct pipe *pipe, 557 struct label *pipelabel, unsigned long cmd, void /* caddr_t */ *data) 558{ 559 560 return (0); 561} 562 563static int 564stub_check_pipe_poll(struct ucred *cred, struct pipe *pipe, 565 struct label *pipelabel) 566{ 567 568 return (0); 569} 570 571static int 572stub_check_pipe_read(struct ucred *cred, struct pipe *pipe, 573 struct label *pipelabel) 574{ 575 576 return (0); 577} 578 579static int 580stub_check_pipe_relabel(struct ucred *cred, struct pipe *pipe, 581 struct label *pipelabel, struct label *newlabel) 582{ 583 584 return (0); 585} 586 587static int 588stub_check_pipe_stat(struct ucred *cred, struct pipe *pipe, 589 struct label *pipelabel) 590{ 591 592 return (0); 593} 594 595static int 596stub_check_pipe_write(struct ucred *cred, struct pipe *pipe, 597 struct label *pipelabel) 598{ 599 600 return (0); 601} 602 603static int 604stub_check_proc_debug(struct ucred *cred, struct proc *proc) 605{ 606 607 return (0); 608} 609 610static int 611stub_check_proc_sched(struct ucred *cred, struct proc *proc) 612{ 613 614 return (0); 615} 616 617static int 618stub_check_proc_signal(struct ucred *cred, struct proc *proc, int signum) 619{ 620 621 return (0); 622} 623 624static int 625stub_check_socket_bind(struct ucred *cred, struct socket *socket, 626 struct label *socketlabel, struct sockaddr *sockaddr) 627{ 628 629 return (0); 630} 631 632static int 633stub_check_socket_connect(struct ucred *cred, struct socket *socket, 634 struct label *socketlabel, struct sockaddr *sockaddr) 635{ 636 637 return (0); 638} 639 640static int 641stub_check_socket_deliver(struct socket *so, struct label *socketlabel, 642 struct mbuf *m, struct label *mbuflabel) 643{ 644 645 return (0); 646} 647 648static int 649stub_check_socket_listen(struct ucred *cred, struct socket *so, 650 struct label *socketlabel) 651{ 652 653 return (0); 654} 655 656static int 657stub_check_socket_relabel(struct ucred *cred, struct socket *socket, 658 struct label *socketlabel, struct label *newlabel) 659{ 660 661 return (0); 662} 663 664static int 665stub_check_socket_visible(struct ucred *cred, struct socket *socket, 666 struct label *socketlabel) 667{ 668 669 return (0); 670} 671 672static int 673stub_check_sysarch_ioperm(struct ucred *cred) 674{ 675 676 return (0); 677} 678 679static int 680stub_check_system_acct(struct ucred *cred, struct vnode *vp, 681 struct label *vlabel) 682{ 683 684 return (0); 685} 686 687static int 688stub_check_system_reboot(struct ucred *cred, int how) 689{ 690 691 return (0); 692} 693 694static int 695stub_check_system_settime(struct ucred *cred) 696{ 697 698 return (0); 699} 700 701static int 702stub_check_system_swapon(struct ucred *cred, struct vnode *vp, 703 struct label *label) 704{ 705 706 return (0); 707} 708 709static int 710stub_check_system_swapoff(struct ucred *cred, struct vnode *vp, 711 struct label *label) 712{ 713 714 return (0); 715} 716 717static int 718stub_check_system_sysctl(struct ucred *cred, int *name, u_int namelen, 719 void *old, size_t *oldlenp, int inkernel, void *new, size_t newlen) 720{ 721 722 return (0); 723} 724 725static int 726stub_check_vnode_access(struct ucred *cred, struct vnode *vp, 727 struct label *label, int acc_mode) 728{ 729 730 return (0); 731} 732 733static int 734stub_check_vnode_chdir(struct ucred *cred, struct vnode *dvp, 735 struct label *dlabel) 736{ 737 738 return (0); 739} 740 741static int 742stub_check_vnode_chroot(struct ucred *cred, struct vnode *dvp, 743 struct label *dlabel) 744{ 745 746 return (0); 747} 748 749static int 750stub_check_vnode_create(struct ucred *cred, struct vnode *dvp, 751 struct label *dlabel, struct componentname *cnp, struct vattr *vap) 752{ 753 754 return (0); 755} 756 757static int 758stub_check_vnode_delete(struct ucred *cred, struct vnode *dvp, 759 struct label *dlabel, struct vnode *vp, struct label *label, 760 struct componentname *cnp) 761{ 762 763 return (0); 764} 765 766static int 767stub_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp, 768 struct label *label, acl_type_t type) 769{ 770 771 return (0); 772} 773 774static int 775stub_check_vnode_exec(struct ucred *cred, struct vnode *vp, 776 struct label *label, struct image_params *imgp, 777 struct label *execlabel) 778{ 779 780 return (0); 781} 782 783static int 784stub_check_vnode_getacl(struct ucred *cred, struct vnode *vp, 785 struct label *label, acl_type_t type) 786{ 787 788 return (0); 789} 790 791static int 792stub_check_vnode_getextattr(struct ucred *cred, struct vnode *vp, 793 struct label *label, int attrnamespace, const char *name, struct uio *uio) 794{ 795 796 return (0); 797} 798 799static int 800stub_check_vnode_link(struct ucred *cred, struct vnode *dvp, 801 struct label *dlabel, struct vnode *vp, struct label *label, 802 struct componentname *cnp) 803{ 804 805 return (0); 806} 807 808static int 809stub_check_vnode_lookup(struct ucred *cred, struct vnode *dvp, 810 struct label *dlabel, struct componentname *cnp) 811{ 812 813 return (0); 814} 815 816static int 817stub_check_vnode_mmap(struct ucred *cred, struct vnode *vp, 818 struct label *label, int prot) 819{ 820 821 return (0); 822} 823 824static int 825stub_check_vnode_mprotect(struct ucred *cred, struct vnode *vp, 826 struct label *label, int prot) 827{ 828 829 return (0); 830} 831 832static int 833stub_check_vnode_open(struct ucred *cred, struct vnode *vp, 834 struct label *filelabel, int acc_mode) 835{ 836 837 return (0); 838} 839 840static int 841stub_check_vnode_poll(struct ucred *active_cred, struct ucred *file_cred, 842 struct vnode *vp, struct label *label) 843{ 844 845 return (0); 846} 847 848static int 849stub_check_vnode_read(struct ucred *active_cred, struct ucred *file_cred, 850 struct vnode *vp, struct label *label) 851{ 852 853 return (0); 854} 855 856static int 857stub_check_vnode_readdir(struct ucred *cred, struct vnode *vp, 858 struct label *dlabel) 859{ 860 861 return (0); 862} 863 864static int 865stub_check_vnode_readlink(struct ucred *cred, struct vnode *vp, 866 struct label *vnodelabel) 867{ 868 869 return (0); 870} 871 872static int 873stub_check_vnode_relabel(struct ucred *cred, struct vnode *vp, 874 struct label *vnodelabel, struct label *newlabel) 875{ 876 877 return (0); 878} 879 880static int 881stub_check_vnode_rename_from(struct ucred *cred, struct vnode *dvp, 882 struct label *dlabel, struct vnode *vp, struct label *label, 883 struct componentname *cnp) 884{ 885 886 return (0); 887} 888 889static int 890stub_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp, 891 struct label *dlabel, struct vnode *vp, struct label *label, int samedir, 892 struct componentname *cnp) 893{ 894 895 return (0); 896} 897 898static int 899stub_check_vnode_revoke(struct ucred *cred, struct vnode *vp, 900 struct label *label) 901{ 902 903 return (0); 904} 905 906static int 907stub_check_vnode_setacl(struct ucred *cred, struct vnode *vp, 908 struct label *label, acl_type_t type, struct acl *acl) 909{ 910 911 return (0); 912} 913 914static int 915stub_check_vnode_setextattr(struct ucred *cred, struct vnode *vp, 916 struct label *label, int attrnamespace, const char *name, struct uio *uio) 917{ 918 919 return (0); 920} 921 922static int 923stub_check_vnode_setflags(struct ucred *cred, struct vnode *vp, 924 struct label *label, u_long flags) 925{ 926 927 return (0); 928} 929 930static int 931stub_check_vnode_setmode(struct ucred *cred, struct vnode *vp, 932 struct label *label, mode_t mode) 933{ 934 935 return (0); 936} 937 938static int 939stub_check_vnode_setowner(struct ucred *cred, struct vnode *vp, 940 struct label *label, uid_t uid, gid_t gid) 941{ 942 943 return (0); 944} 945 946static int 947stub_check_vnode_setutimes(struct ucred *cred, struct vnode *vp, 948 struct label *label, struct timespec atime, struct timespec mtime) 949{ 950 951 return (0); 952} 953 954static int 955stub_check_vnode_stat(struct ucred *active_cred, struct ucred *file_cred, 956 struct vnode *vp, struct label *label) 957{ 958 959 return (0); 960} 961 962static int 963stub_check_vnode_write(struct ucred *active_cred, 964 struct ucred *file_cred, struct vnode *vp, struct label *label) 965{ 966 967 return (0); 968} 969 970static struct mac_policy_ops mac_stub_ops = 971{ 972 .mpo_destroy = stub_destroy, 973 .mpo_init = stub_init, 974 .mpo_syscall = stub_syscall, 975 .mpo_init_bpfdesc_label = stub_init_label, 976 .mpo_init_cred_label = stub_init_label, 977 .mpo_init_devfsdirent_label = stub_init_label, 978 .mpo_init_ifnet_label = stub_init_label, 979 .mpo_init_ipq_label = stub_init_label_waitcheck, 980 .mpo_init_mbuf_label = stub_init_label_waitcheck, 981 .mpo_init_mount_label = stub_init_label, 982 .mpo_init_mount_fs_label = stub_init_label, 983 .mpo_init_pipe_label = stub_init_label, 984 .mpo_init_socket_label = stub_init_label_waitcheck, 985 .mpo_init_socket_peer_label = stub_init_label_waitcheck, 986 .mpo_init_vnode_label = stub_init_label, 987 .mpo_destroy_bpfdesc_label = stub_destroy_label, 988 .mpo_destroy_cred_label = stub_destroy_label, 989 .mpo_destroy_devfsdirent_label = stub_destroy_label, 990 .mpo_destroy_ifnet_label = stub_destroy_label, 991 .mpo_destroy_ipq_label = stub_destroy_label, 992 .mpo_destroy_mbuf_label = stub_destroy_label, 993 .mpo_destroy_mount_label = stub_destroy_label, 994 .mpo_destroy_mount_fs_label = stub_destroy_label, 995 .mpo_destroy_pipe_label = stub_destroy_label, 996 .mpo_destroy_socket_label = stub_destroy_label, 997 .mpo_destroy_socket_peer_label = stub_destroy_label, 998 .mpo_destroy_vnode_label = stub_destroy_label, 999 .mpo_externalize_cred_label = stub_externalize_label, 1000 .mpo_externalize_ifnet_label = stub_externalize_label, 1001 .mpo_externalize_pipe_label = stub_externalize_label, 1002 .mpo_externalize_socket_label = stub_externalize_label, 1003 .mpo_externalize_socket_peer_label = stub_externalize_label, 1004 .mpo_externalize_vnode_label = stub_externalize_label, 1005 .mpo_internalize_cred_label = stub_internalize_label, 1006 .mpo_internalize_ifnet_label = stub_internalize_label, 1007 .mpo_internalize_pipe_label = stub_internalize_label, 1008 .mpo_internalize_socket_label = stub_internalize_label, 1009 .mpo_internalize_vnode_label = stub_internalize_label, 1010 .mpo_associate_vnode_devfs = stub_associate_vnode_devfs, 1011 .mpo_associate_vnode_extattr = stub_associate_vnode_extattr, 1012 .mpo_associate_vnode_singlelabel = stub_associate_vnode_singlelabel, 1013 .mpo_create_devfs_device = stub_create_devfs_device, 1014 .mpo_create_devfs_directory = stub_create_devfs_directory, 1015 .mpo_create_devfs_symlink = stub_create_devfs_symlink, 1016 .mpo_create_vnode_extattr = stub_create_vnode_extattr, 1017 .mpo_create_mount = stub_create_mount, 1018 .mpo_create_root_mount = stub_create_root_mount, 1019 .mpo_relabel_vnode = stub_relabel_vnode, 1020 .mpo_setlabel_vnode_extattr = stub_setlabel_vnode_extattr, 1021 .mpo_update_devfsdirent = stub_update_devfsdirent, 1022 .mpo_create_mbuf_from_socket = stub_create_mbuf_from_socket, 1023 .mpo_create_pipe = stub_create_pipe, 1024 .mpo_create_socket = stub_create_socket, 1025 .mpo_create_socket_from_socket = stub_create_socket_from_socket, 1026 .mpo_relabel_pipe = stub_relabel_pipe, 1027 .mpo_relabel_socket = stub_relabel_socket, 1028 .mpo_set_socket_peer_from_mbuf = stub_set_socket_peer_from_mbuf, 1029 .mpo_set_socket_peer_from_socket = stub_set_socket_peer_from_socket, 1030 .mpo_create_bpfdesc = stub_create_bpfdesc, 1031 .mpo_create_ifnet = stub_create_ifnet, 1032 .mpo_create_ipq = stub_create_ipq, 1033 .mpo_create_datagram_from_ipq = stub_create_datagram_from_ipq, 1034 .mpo_create_fragment = stub_create_fragment, 1035 .mpo_create_ipq = stub_create_ipq, 1036 .mpo_create_mbuf_from_mbuf = stub_create_mbuf_from_mbuf, 1037 .mpo_create_mbuf_linklayer = stub_create_mbuf_linklayer, 1038 .mpo_create_mbuf_from_bpfdesc = stub_create_mbuf_from_bpfdesc, 1039 .mpo_create_mbuf_from_ifnet = stub_create_mbuf_from_ifnet, 1040 .mpo_create_mbuf_multicast_encap = stub_create_mbuf_multicast_encap, 1041 .mpo_create_mbuf_netlayer = stub_create_mbuf_netlayer, 1042 .mpo_fragment_match = stub_fragment_match, 1043 .mpo_relabel_ifnet = stub_relabel_ifnet, 1044 .mpo_update_ipq = stub_update_ipq, 1045 .mpo_create_cred = stub_create_cred, 1046 .mpo_execve_transition = stub_execve_transition, 1047 .mpo_execve_will_transition = stub_execve_will_transition, 1048 .mpo_create_proc0 = stub_create_proc0, 1049 .mpo_create_proc1 = stub_create_proc1, 1050 .mpo_relabel_cred = stub_relabel_cred, 1051 .mpo_thread_userret = stub_thread_userret, 1052 .mpo_check_bpfdesc_receive = stub_check_bpfdesc_receive, 1053 .mpo_check_cred_relabel = stub_check_cred_relabel, 1054 .mpo_check_cred_visible = stub_check_cred_visible, 1055 .mpo_check_ifnet_relabel = stub_check_ifnet_relabel, 1056 .mpo_check_ifnet_transmit = stub_check_ifnet_transmit, 1057 .mpo_check_kenv_dump = stub_check_kenv_dump, 1058 .mpo_check_kenv_get = stub_check_kenv_get, 1059 .mpo_check_kenv_set = stub_check_kenv_set, 1060 .mpo_check_kenv_unset = stub_check_kenv_unset, 1061 .mpo_check_kld_load = stub_check_kld_load, 1062 .mpo_check_kld_stat = stub_check_kld_stat, 1063 .mpo_check_kld_unload = stub_check_kld_unload, 1064 .mpo_check_mount_stat = stub_check_mount_stat, 1065 .mpo_check_pipe_ioctl = stub_check_pipe_ioctl, 1066 .mpo_check_pipe_poll = stub_check_pipe_poll, 1067 .mpo_check_pipe_read = stub_check_pipe_read, 1068 .mpo_check_pipe_relabel = stub_check_pipe_relabel, 1069 .mpo_check_pipe_stat = stub_check_pipe_stat, 1070 .mpo_check_pipe_write = stub_check_pipe_write, 1071 .mpo_check_proc_debug = stub_check_proc_debug, 1072 .mpo_check_proc_sched = stub_check_proc_sched, 1073 .mpo_check_proc_signal = stub_check_proc_signal, 1074 .mpo_check_socket_bind = stub_check_socket_bind, 1075 .mpo_check_socket_connect = stub_check_socket_connect, 1076 .mpo_check_socket_deliver = stub_check_socket_deliver, 1077 .mpo_check_socket_listen = stub_check_socket_listen, 1078 .mpo_check_socket_relabel = stub_check_socket_relabel, 1079 .mpo_check_socket_visible = stub_check_socket_visible, 1080 .mpo_check_sysarch_ioperm = stub_check_sysarch_ioperm, 1081 .mpo_check_system_acct = stub_check_system_acct, 1082 .mpo_check_system_reboot = stub_check_system_reboot, 1083 .mpo_check_system_settime = stub_check_system_settime, 1084 .mpo_check_system_swapon = stub_check_system_swapon, 1085 .mpo_check_system_swapoff = stub_check_system_swapoff, 1086 .mpo_check_system_sysctl = stub_check_system_sysctl, 1087 .mpo_check_vnode_access = stub_check_vnode_access, 1088 .mpo_check_vnode_chdir = stub_check_vnode_chdir, 1089 .mpo_check_vnode_chroot = stub_check_vnode_chroot, 1090 .mpo_check_vnode_create = stub_check_vnode_create, 1091 .mpo_check_vnode_delete = stub_check_vnode_delete, 1092 .mpo_check_vnode_deleteacl = stub_check_vnode_deleteacl, 1093 .mpo_check_vnode_exec = stub_check_vnode_exec, 1094 .mpo_check_vnode_getacl = stub_check_vnode_getacl, 1095 .mpo_check_vnode_getextattr = stub_check_vnode_getextattr, 1096 .mpo_check_vnode_link = stub_check_vnode_link, 1097 .mpo_check_vnode_lookup = stub_check_vnode_lookup, 1098 .mpo_check_vnode_mmap = stub_check_vnode_mmap, 1099 .mpo_check_vnode_mprotect = stub_check_vnode_mprotect, 1100 .mpo_check_vnode_open = stub_check_vnode_open, 1101 .mpo_check_vnode_poll = stub_check_vnode_poll, 1102 .mpo_check_vnode_read = stub_check_vnode_read, 1103 .mpo_check_vnode_readdir = stub_check_vnode_readdir, 1104 .mpo_check_vnode_readlink = stub_check_vnode_readlink, 1105 .mpo_check_vnode_relabel = stub_check_vnode_relabel, 1106 .mpo_check_vnode_rename_from = stub_check_vnode_rename_from, 1107 .mpo_check_vnode_rename_to = stub_check_vnode_rename_to, 1108 .mpo_check_vnode_revoke = stub_check_vnode_revoke, 1109 .mpo_check_vnode_setacl = stub_check_vnode_setacl, 1110 .mpo_check_vnode_setextattr = stub_check_vnode_setextattr, 1111 .mpo_check_vnode_setflags = stub_check_vnode_setflags, 1112 .mpo_check_vnode_setmode = stub_check_vnode_setmode, 1113 .mpo_check_vnode_setowner = stub_check_vnode_setowner, 1114 .mpo_check_vnode_setutimes = stub_check_vnode_setutimes, 1115 .mpo_check_vnode_stat = stub_check_vnode_stat, 1116 .mpo_check_vnode_write = stub_check_vnode_write, 1117}; 1118 1119MAC_POLICY_SET(&mac_stub_ops, mac_stub, "TrustedBSD MAC/Stub", 1120 MPC_LOADTIME_FLAG_UNLOADOK, NULL); 1121