mac_stub.c revision 122875
1/*- 2 * Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson 3 * Copyright (c) 2001, 2002, 2003 Networks Associates Technology, Inc. 4 * All rights reserved. 5 * 6 * This software was developed by Robert Watson for the TrustedBSD Project. 7 * 8 * This software was developed for the FreeBSD Project in part by Network 9 * Associates Laboratories, the Security Research Division of Network 10 * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), 11 * as part of the DARPA CHATS research program. 12 * 13 * Redistribution and use in source and binary forms, with or without 14 * modification, are permitted provided that the following conditions 15 * are met: 16 * 1. Redistributions of source code must retain the above copyright 17 * notice, this list of conditions and the following disclaimer. 18 * 2. Redistributions in binary form must reproduce the above copyright 19 * notice, this list of conditions and the following disclaimer in the 20 * documentation and/or other materials provided with the distribution. 21 * 22 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 23 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 24 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 25 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 26 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 27 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 28 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 29 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 30 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 31 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 32 * SUCH DAMAGE. 33 * 34 * $FreeBSD: head/sys/security/mac_stub/mac_stub.c 122875 2003-11-18 00:39:07Z rwatson $ 35 */ 36 37/* 38 * Developed by the TrustedBSD Project. 39 * 40 * Stub module that implements a NOOP for most (if not all) MAC Framework 41 * policy entry points. 42 */ 43 44#include <sys/types.h> 45#include <sys/param.h> 46#include <sys/acl.h> 47#include <sys/conf.h> 48#include <sys/extattr.h> 49#include <sys/kernel.h> 50#include <sys/mac.h> 51#include <sys/mount.h> 52#include <sys/proc.h> 53#include <sys/systm.h> 54#include <sys/sysproto.h> 55#include <sys/sysent.h> 56#include <sys/vnode.h> 57#include <sys/file.h> 58#include <sys/socket.h> 59#include <sys/socketvar.h> 60#include <sys/pipe.h> 61#include <sys/sysctl.h> 62 63#include <fs/devfs/devfs.h> 64 65#include <net/bpfdesc.h> 66#include <net/if.h> 67#include <net/if_types.h> 68#include <net/if_var.h> 69 70#include <netinet/in.h> 71#include <netinet/in_pcb.h> 72#include <netinet/ip_var.h> 73 74#include <vm/vm.h> 75 76#include <sys/mac_policy.h> 77 78SYSCTL_DECL(_security_mac); 79 80SYSCTL_NODE(_security_mac, OID_AUTO, stub, CTLFLAG_RW, 0, 81 "TrustedBSD mac_stub policy controls"); 82 83static int stub_enabled = 1; 84SYSCTL_INT(_security_mac_stub, OID_AUTO, enabled, CTLFLAG_RW, 85 &stub_enabled, 0, "Enforce mac_stub policy"); 86 87/* 88 * Policy module operations. 89 */ 90static void 91stub_destroy(struct mac_policy_conf *conf) 92{ 93 94} 95 96static void 97stub_init(struct mac_policy_conf *conf) 98{ 99 100} 101 102static int 103stub_syscall(struct thread *td, int call, void *arg) 104{ 105 106 return (0); 107} 108 109/* 110 * Label operations. 111 */ 112static void 113stub_init_label(struct label *label) 114{ 115 116} 117 118static int 119stub_init_label_waitcheck(struct label *label, int flag) 120{ 121 122 return (0); 123} 124 125static void 126stub_destroy_label(struct label *label) 127{ 128 129} 130 131static void 132stub_copy_label(struct label *src, struct label *dest) 133{ 134 135} 136 137static int 138stub_externalize_label(struct label *label, char *element_name, 139 struct sbuf *sb, int *claimed) 140{ 141 142 return (0); 143} 144 145static int 146stub_internalize_label(struct label *label, char *element_name, 147 char *element_data, int *claimed) 148{ 149 150 return (0); 151} 152 153/* 154 * Labeling event operations: file system objects, and things that look 155 * a lot like file system objects. 156 */ 157static void 158stub_associate_vnode_devfs(struct mount *mp, struct label *fslabel, 159 struct devfs_dirent *de, struct label *delabel, struct vnode *vp, 160 struct label *vlabel) 161{ 162 163} 164 165static int 166stub_associate_vnode_extattr(struct mount *mp, struct label *fslabel, 167 struct vnode *vp, struct label *vlabel) 168{ 169 170 return (0); 171} 172 173static void 174stub_associate_vnode_singlelabel(struct mount *mp, 175 struct label *fslabel, struct vnode *vp, struct label *vlabel) 176{ 177 178} 179 180static void 181stub_create_devfs_device(struct mount *mp, dev_t dev, 182 struct devfs_dirent *devfs_dirent, struct label *label) 183{ 184 185} 186 187static void 188stub_create_devfs_directory(struct mount *mp, char *dirname, 189 int dirnamelen, struct devfs_dirent *devfs_dirent, struct label *label) 190{ 191 192} 193 194static void 195stub_create_devfs_symlink(struct ucred *cred, struct mount *mp, 196 struct devfs_dirent *dd, struct label *ddlabel, struct devfs_dirent *de, 197 struct label *delabel) 198{ 199 200} 201 202static int 203stub_create_vnode_extattr(struct ucred *cred, struct mount *mp, 204 struct label *fslabel, struct vnode *dvp, struct label *dlabel, 205 struct vnode *vp, struct label *vlabel, struct componentname *cnp) 206{ 207 208 return (0); 209} 210 211static void 212stub_create_mount(struct ucred *cred, struct mount *mp, 213 struct label *mntlabel, struct label *fslabel) 214{ 215 216} 217 218static void 219stub_create_root_mount(struct ucred *cred, struct mount *mp, 220 struct label *mntlabel, struct label *fslabel) 221{ 222 223} 224 225static void 226stub_relabel_vnode(struct ucred *cred, struct vnode *vp, 227 struct label *vnodelabel, struct label *label) 228{ 229 230} 231 232static int 233stub_setlabel_vnode_extattr(struct ucred *cred, struct vnode *vp, 234 struct label *vlabel, struct label *intlabel) 235{ 236 237 return (0); 238} 239 240static void 241stub_update_devfsdirent(struct mount *mp, 242 struct devfs_dirent *devfs_dirent, struct label *direntlabel, 243 struct vnode *vp, struct label *vnodelabel) 244{ 245 246} 247 248/* 249 * Labeling event operations: IPC object. 250 */ 251static void 252stub_create_mbuf_from_socket(struct socket *so, struct label *socketlabel, 253 struct mbuf *m, struct label *mbuflabel) 254{ 255 256} 257 258static void 259stub_create_socket(struct ucred *cred, struct socket *socket, 260 struct label *socketlabel) 261{ 262 263} 264 265static void 266stub_create_pipe(struct ucred *cred, struct pipe *pipe, 267 struct label *pipelabel) 268{ 269 270} 271 272static void 273stub_create_socket_from_socket(struct socket *oldsocket, 274 struct label *oldsocketlabel, struct socket *newsocket, 275 struct label *newsocketlabel) 276{ 277 278} 279 280static void 281stub_relabel_socket(struct ucred *cred, struct socket *socket, 282 struct label *socketlabel, struct label *newlabel) 283{ 284 285} 286 287static void 288stub_relabel_pipe(struct ucred *cred, struct pipe *pipe, 289 struct label *pipelabel, struct label *newlabel) 290{ 291 292} 293 294static void 295stub_set_socket_peer_from_mbuf(struct mbuf *mbuf, struct label *mbuflabel, 296 struct socket *socket, struct label *socketpeerlabel) 297{ 298 299} 300 301static void 302stub_set_socket_peer_from_socket(struct socket *oldsocket, 303 struct label *oldsocketlabel, struct socket *newsocket, 304 struct label *newsocketpeerlabel) 305{ 306 307} 308 309/* 310 * Labeling event operations: network objects. 311 */ 312static void 313stub_create_bpfdesc(struct ucred *cred, struct bpf_d *bpf_d, 314 struct label *bpflabel) 315{ 316 317} 318 319static void 320stub_create_datagram_from_ipq(struct ipq *ipq, struct label *ipqlabel, 321 struct mbuf *datagram, struct label *datagramlabel) 322{ 323 324} 325 326static void 327stub_create_fragment(struct mbuf *datagram, struct label *datagramlabel, 328 struct mbuf *fragment, struct label *fragmentlabel) 329{ 330 331} 332 333static void 334stub_create_ifnet(struct ifnet *ifnet, struct label *ifnetlabel) 335{ 336 337} 338 339static void 340stub_create_inpcb_from_socket(struct socket *so, struct label *solabel, 341 struct inpcb *inp, struct label *inplabel) 342{ 343 344} 345 346static void 347stub_create_ipq(struct mbuf *fragment, struct label *fragmentlabel, 348 struct ipq *ipq, struct label *ipqlabel) 349{ 350 351} 352 353static void 354stub_create_mbuf_from_mbuf(struct mbuf *oldmbuf, 355 struct label *oldmbuflabel, struct mbuf *newmbuf, 356 struct label *newmbuflabel) 357{ 358 359} 360 361static void 362stub_create_mbuf_linklayer(struct ifnet *ifnet, struct label *ifnetlabel, 363 struct mbuf *mbuf, struct label *mbuflabel) 364{ 365 366} 367 368static void 369stub_create_mbuf_from_bpfdesc(struct bpf_d *bpf_d, struct label *bpflabel, 370 struct mbuf *mbuf, struct label *mbuflabel) 371{ 372 373} 374 375static void 376stub_create_mbuf_from_ifnet(struct ifnet *ifnet, struct label *ifnetlabel, 377 struct mbuf *m, struct label *mbuflabel) 378{ 379 380} 381 382static void 383stub_create_mbuf_multicast_encap(struct mbuf *oldmbuf, 384 struct label *oldmbuflabel, struct ifnet *ifnet, struct label *ifnetlabel, 385 struct mbuf *newmbuf, struct label *newmbuflabel) 386{ 387 388} 389 390static void 391stub_create_mbuf_netlayer(struct mbuf *oldmbuf, 392 struct label *oldmbuflabel, struct mbuf *newmbuf, struct label *newmbuflabel) 393{ 394 395} 396 397static int 398stub_fragment_match(struct mbuf *fragment, struct label *fragmentlabel, 399 struct ipq *ipq, struct label *ipqlabel) 400{ 401 402 return (1); 403} 404 405static void 406stub_reflect_mbuf_icmp(struct mbuf *m, struct label *mlabel) 407{ 408 409} 410 411static void 412stub_reflect_mbuf_tcp(struct mbuf *m, struct label *mlabel) 413{ 414 415} 416 417static void 418stub_relabel_ifnet(struct ucred *cred, struct ifnet *ifnet, 419 struct label *ifnetlabel, struct label *newlabel) 420{ 421 422} 423 424static void 425stub_update_ipq(struct mbuf *fragment, struct label *fragmentlabel, 426 struct ipq *ipq, struct label *ipqlabel) 427{ 428 429} 430 431static void 432stub_inpcb_sosetlabel(struct socket *so, struct label *solabel, 433 struct inpcb *inp, struct label *inplabel) 434{ 435 436} 437 438/* 439 * Labeling event operations: processes. 440 */ 441static void 442stub_create_cred(struct ucred *cred_parent, struct ucred *cred_child) 443{ 444 445} 446 447static void 448stub_execve_transition(struct ucred *old, struct ucred *new, 449 struct vnode *vp, struct label *vnodelabel, 450 struct label *interpvnodelabel, struct image_params *imgp, 451 struct label *execlabel) 452{ 453 454} 455 456static int 457stub_execve_will_transition(struct ucred *old, struct vnode *vp, 458 struct label *vnodelabel, struct label *interpvnodelabel, 459 struct image_params *imgp, struct label *execlabel) 460{ 461 462 return (0); 463} 464 465static void 466stub_create_proc0(struct ucred *cred) 467{ 468 469} 470 471static void 472stub_create_proc1(struct ucred *cred) 473{ 474 475} 476 477static void 478stub_relabel_cred(struct ucred *cred, struct label *newlabel) 479{ 480 481} 482 483static void 484stub_thread_userret(struct thread *td) 485{ 486 487} 488 489/* 490 * Access control checks. 491 */ 492static int 493stub_check_bpfdesc_receive(struct bpf_d *bpf_d, struct label *bpflabel, 494 struct ifnet *ifnet, struct label *ifnet_label) 495{ 496 497 return (0); 498} 499 500static int 501stub_check_cred_relabel(struct ucred *cred, struct label *newlabel) 502{ 503 504 return (0); 505} 506 507static int 508stub_check_cred_visible(struct ucred *u1, struct ucred *u2) 509{ 510 511 return (0); 512} 513 514static int 515stub_check_ifnet_relabel(struct ucred *cred, struct ifnet *ifnet, 516 struct label *ifnetlabel, struct label *newlabel) 517{ 518 519 return (0); 520} 521 522static int 523stub_check_ifnet_transmit(struct ifnet *ifnet, struct label *ifnetlabel, 524 struct mbuf *m, struct label *mbuflabel) 525{ 526 527 return (0); 528} 529 530static int 531stub_check_inpcb_deliver(struct inpcb *inp, struct label *inplabel, 532 struct mbuf *m, struct label *mlabel) 533{ 534 535 return (0); 536} 537 538static int 539stub_check_kenv_dump(struct ucred *cred) 540{ 541 542 return (0); 543} 544 545static int 546stub_check_kenv_get(struct ucred *cred, char *name) 547{ 548 549 return (0); 550} 551 552static int 553stub_check_kenv_set(struct ucred *cred, char *name, char *value) 554{ 555 556 return (0); 557} 558 559static int 560stub_check_kenv_unset(struct ucred *cred, char *name) 561{ 562 563 return (0); 564} 565 566static int 567stub_check_kld_load(struct ucred *cred, struct vnode *vp, 568 struct label *vlabel) 569{ 570 571 return (0); 572} 573 574static int 575stub_check_kld_stat(struct ucred *cred) 576{ 577 578 return (0); 579} 580 581static int 582stub_check_kld_unload(struct ucred *cred) 583{ 584 585 return (0); 586} 587 588static int 589stub_check_mount_stat(struct ucred *cred, struct mount *mp, 590 struct label *mntlabel) 591{ 592 593 return (0); 594} 595 596static int 597stub_check_pipe_ioctl(struct ucred *cred, struct pipe *pipe, 598 struct label *pipelabel, unsigned long cmd, void /* caddr_t */ *data) 599{ 600 601 return (0); 602} 603 604static int 605stub_check_pipe_poll(struct ucred *cred, struct pipe *pipe, 606 struct label *pipelabel) 607{ 608 609 return (0); 610} 611 612static int 613stub_check_pipe_read(struct ucred *cred, struct pipe *pipe, 614 struct label *pipelabel) 615{ 616 617 return (0); 618} 619 620static int 621stub_check_pipe_relabel(struct ucred *cred, struct pipe *pipe, 622 struct label *pipelabel, struct label *newlabel) 623{ 624 625 return (0); 626} 627 628static int 629stub_check_pipe_stat(struct ucred *cred, struct pipe *pipe, 630 struct label *pipelabel) 631{ 632 633 return (0); 634} 635 636static int 637stub_check_pipe_write(struct ucred *cred, struct pipe *pipe, 638 struct label *pipelabel) 639{ 640 641 return (0); 642} 643 644static int 645stub_check_proc_debug(struct ucred *cred, struct proc *proc) 646{ 647 648 return (0); 649} 650 651static int 652stub_check_proc_sched(struct ucred *cred, struct proc *proc) 653{ 654 655 return (0); 656} 657 658static int 659stub_check_proc_signal(struct ucred *cred, struct proc *proc, int signum) 660{ 661 662 return (0); 663} 664 665static int 666stub_check_socket_bind(struct ucred *cred, struct socket *socket, 667 struct label *socketlabel, struct sockaddr *sockaddr) 668{ 669 670 return (0); 671} 672 673static int 674stub_check_socket_connect(struct ucred *cred, struct socket *socket, 675 struct label *socketlabel, struct sockaddr *sockaddr) 676{ 677 678 return (0); 679} 680 681static int 682stub_check_socket_deliver(struct socket *so, struct label *socketlabel, 683 struct mbuf *m, struct label *mbuflabel) 684{ 685 686 return (0); 687} 688 689static int 690stub_check_socket_listen(struct ucred *cred, struct socket *so, 691 struct label *socketlabel) 692{ 693 694 return (0); 695} 696 697static int 698stub_check_socket_relabel(struct ucred *cred, struct socket *socket, 699 struct label *socketlabel, struct label *newlabel) 700{ 701 702 return (0); 703} 704 705static int 706stub_check_socket_visible(struct ucred *cred, struct socket *socket, 707 struct label *socketlabel) 708{ 709 710 return (0); 711} 712 713static int 714stub_check_sysarch_ioperm(struct ucred *cred) 715{ 716 717 return (0); 718} 719 720static int 721stub_check_system_acct(struct ucred *cred, struct vnode *vp, 722 struct label *vlabel) 723{ 724 725 return (0); 726} 727 728static int 729stub_check_system_reboot(struct ucred *cred, int how) 730{ 731 732 return (0); 733} 734 735static int 736stub_check_system_settime(struct ucred *cred) 737{ 738 739 return (0); 740} 741 742static int 743stub_check_system_swapon(struct ucred *cred, struct vnode *vp, 744 struct label *label) 745{ 746 747 return (0); 748} 749 750static int 751stub_check_system_swapoff(struct ucred *cred, struct vnode *vp, 752 struct label *label) 753{ 754 755 return (0); 756} 757 758static int 759stub_check_system_sysctl(struct ucred *cred, int *name, u_int namelen, 760 void *old, size_t *oldlenp, int inkernel, void *new, size_t newlen) 761{ 762 763 return (0); 764} 765 766static int 767stub_check_vnode_access(struct ucred *cred, struct vnode *vp, 768 struct label *label, int acc_mode) 769{ 770 771 return (0); 772} 773 774static int 775stub_check_vnode_chdir(struct ucred *cred, struct vnode *dvp, 776 struct label *dlabel) 777{ 778 779 return (0); 780} 781 782static int 783stub_check_vnode_chroot(struct ucred *cred, struct vnode *dvp, 784 struct label *dlabel) 785{ 786 787 return (0); 788} 789 790static int 791stub_check_vnode_create(struct ucred *cred, struct vnode *dvp, 792 struct label *dlabel, struct componentname *cnp, struct vattr *vap) 793{ 794 795 return (0); 796} 797 798static int 799stub_check_vnode_delete(struct ucred *cred, struct vnode *dvp, 800 struct label *dlabel, struct vnode *vp, struct label *label, 801 struct componentname *cnp) 802{ 803 804 return (0); 805} 806 807static int 808stub_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp, 809 struct label *label, acl_type_t type) 810{ 811 812 return (0); 813} 814 815static int 816stub_check_vnode_deleteextattr(struct ucred *cred, struct vnode *vp, 817 struct label *label, int attrnamespace, const char *name) 818{ 819 820 return (0); 821} 822 823static int 824stub_check_vnode_exec(struct ucred *cred, struct vnode *vp, 825 struct label *label, struct image_params *imgp, 826 struct label *execlabel) 827{ 828 829 return (0); 830} 831 832static int 833stub_check_vnode_getacl(struct ucred *cred, struct vnode *vp, 834 struct label *label, acl_type_t type) 835{ 836 837 return (0); 838} 839 840static int 841stub_check_vnode_getextattr(struct ucred *cred, struct vnode *vp, 842 struct label *label, int attrnamespace, const char *name, struct uio *uio) 843{ 844 845 return (0); 846} 847 848static int 849stub_check_vnode_link(struct ucred *cred, struct vnode *dvp, 850 struct label *dlabel, struct vnode *vp, struct label *label, 851 struct componentname *cnp) 852{ 853 854 return (0); 855} 856 857static int 858stub_check_vnode_listextattr(struct ucred *cred, struct vnode *vp, 859 struct label *label, int attrnamespace) 860{ 861 862 return (0); 863} 864 865static int 866stub_check_vnode_lookup(struct ucred *cred, struct vnode *dvp, 867 struct label *dlabel, struct componentname *cnp) 868{ 869 870 return (0); 871} 872 873static int 874stub_check_vnode_mmap(struct ucred *cred, struct vnode *vp, 875 struct label *label, int prot) 876{ 877 878 return (0); 879} 880 881static int 882stub_check_vnode_mprotect(struct ucred *cred, struct vnode *vp, 883 struct label *label, int prot) 884{ 885 886 return (0); 887} 888 889static int 890stub_check_vnode_open(struct ucred *cred, struct vnode *vp, 891 struct label *filelabel, int acc_mode) 892{ 893 894 return (0); 895} 896 897static int 898stub_check_vnode_poll(struct ucred *active_cred, struct ucred *file_cred, 899 struct vnode *vp, struct label *label) 900{ 901 902 return (0); 903} 904 905static int 906stub_check_vnode_read(struct ucred *active_cred, struct ucred *file_cred, 907 struct vnode *vp, struct label *label) 908{ 909 910 return (0); 911} 912 913static int 914stub_check_vnode_readdir(struct ucred *cred, struct vnode *vp, 915 struct label *dlabel) 916{ 917 918 return (0); 919} 920 921static int 922stub_check_vnode_readlink(struct ucred *cred, struct vnode *vp, 923 struct label *vnodelabel) 924{ 925 926 return (0); 927} 928 929static int 930stub_check_vnode_relabel(struct ucred *cred, struct vnode *vp, 931 struct label *vnodelabel, struct label *newlabel) 932{ 933 934 return (0); 935} 936 937static int 938stub_check_vnode_rename_from(struct ucred *cred, struct vnode *dvp, 939 struct label *dlabel, struct vnode *vp, struct label *label, 940 struct componentname *cnp) 941{ 942 943 return (0); 944} 945 946static int 947stub_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp, 948 struct label *dlabel, struct vnode *vp, struct label *label, int samedir, 949 struct componentname *cnp) 950{ 951 952 return (0); 953} 954 955static int 956stub_check_vnode_revoke(struct ucred *cred, struct vnode *vp, 957 struct label *label) 958{ 959 960 return (0); 961} 962 963static int 964stub_check_vnode_setacl(struct ucred *cred, struct vnode *vp, 965 struct label *label, acl_type_t type, struct acl *acl) 966{ 967 968 return (0); 969} 970 971static int 972stub_check_vnode_setextattr(struct ucred *cred, struct vnode *vp, 973 struct label *label, int attrnamespace, const char *name, struct uio *uio) 974{ 975 976 return (0); 977} 978 979static int 980stub_check_vnode_setflags(struct ucred *cred, struct vnode *vp, 981 struct label *label, u_long flags) 982{ 983 984 return (0); 985} 986 987static int 988stub_check_vnode_setmode(struct ucred *cred, struct vnode *vp, 989 struct label *label, mode_t mode) 990{ 991 992 return (0); 993} 994 995static int 996stub_check_vnode_setowner(struct ucred *cred, struct vnode *vp, 997 struct label *label, uid_t uid, gid_t gid) 998{ 999 1000 return (0); 1001} 1002 1003static int 1004stub_check_vnode_setutimes(struct ucred *cred, struct vnode *vp, 1005 struct label *label, struct timespec atime, struct timespec mtime) 1006{ 1007 1008 return (0); 1009} 1010 1011static int 1012stub_check_vnode_stat(struct ucred *active_cred, struct ucred *file_cred, 1013 struct vnode *vp, struct label *label) 1014{ 1015 1016 return (0); 1017} 1018 1019static int 1020stub_check_vnode_write(struct ucred *active_cred, 1021 struct ucred *file_cred, struct vnode *vp, struct label *label) 1022{ 1023 1024 return (0); 1025} 1026 1027static struct mac_policy_ops mac_stub_ops = 1028{ 1029 .mpo_destroy = stub_destroy, 1030 .mpo_init = stub_init, 1031 .mpo_syscall = stub_syscall, 1032 .mpo_init_bpfdesc_label = stub_init_label, 1033 .mpo_init_cred_label = stub_init_label, 1034 .mpo_init_devfsdirent_label = stub_init_label, 1035 .mpo_init_ifnet_label = stub_init_label, 1036 .mpo_init_inpcb_label = stub_init_label_waitcheck, 1037 .mpo_init_ipq_label = stub_init_label_waitcheck, 1038 .mpo_init_mbuf_label = stub_init_label_waitcheck, 1039 .mpo_init_mount_label = stub_init_label, 1040 .mpo_init_mount_fs_label = stub_init_label, 1041 .mpo_init_pipe_label = stub_init_label, 1042 .mpo_init_socket_label = stub_init_label_waitcheck, 1043 .mpo_init_socket_peer_label = stub_init_label_waitcheck, 1044 .mpo_init_vnode_label = stub_init_label, 1045 .mpo_destroy_bpfdesc_label = stub_destroy_label, 1046 .mpo_destroy_cred_label = stub_destroy_label, 1047 .mpo_destroy_devfsdirent_label = stub_destroy_label, 1048 .mpo_destroy_ifnet_label = stub_destroy_label, 1049 .mpo_destroy_inpcb_label = stub_destroy_label, 1050 .mpo_destroy_ipq_label = stub_destroy_label, 1051 .mpo_destroy_mbuf_label = stub_destroy_label, 1052 .mpo_destroy_mount_label = stub_destroy_label, 1053 .mpo_destroy_mount_fs_label = stub_destroy_label, 1054 .mpo_destroy_pipe_label = stub_destroy_label, 1055 .mpo_destroy_socket_label = stub_destroy_label, 1056 .mpo_destroy_socket_peer_label = stub_destroy_label, 1057 .mpo_destroy_vnode_label = stub_destroy_label, 1058 .mpo_copy_mbuf_label = stub_copy_label, 1059 .mpo_copy_pipe_label = stub_copy_label, 1060 .mpo_copy_socket_label = stub_copy_label, 1061 .mpo_copy_vnode_label = stub_copy_label, 1062 .mpo_externalize_cred_label = stub_externalize_label, 1063 .mpo_externalize_ifnet_label = stub_externalize_label, 1064 .mpo_externalize_pipe_label = stub_externalize_label, 1065 .mpo_externalize_socket_label = stub_externalize_label, 1066 .mpo_externalize_socket_peer_label = stub_externalize_label, 1067 .mpo_externalize_vnode_label = stub_externalize_label, 1068 .mpo_internalize_cred_label = stub_internalize_label, 1069 .mpo_internalize_ifnet_label = stub_internalize_label, 1070 .mpo_internalize_pipe_label = stub_internalize_label, 1071 .mpo_internalize_socket_label = stub_internalize_label, 1072 .mpo_internalize_vnode_label = stub_internalize_label, 1073 .mpo_associate_vnode_devfs = stub_associate_vnode_devfs, 1074 .mpo_associate_vnode_extattr = stub_associate_vnode_extattr, 1075 .mpo_associate_vnode_singlelabel = stub_associate_vnode_singlelabel, 1076 .mpo_create_devfs_device = stub_create_devfs_device, 1077 .mpo_create_devfs_directory = stub_create_devfs_directory, 1078 .mpo_create_devfs_symlink = stub_create_devfs_symlink, 1079 .mpo_create_vnode_extattr = stub_create_vnode_extattr, 1080 .mpo_create_mount = stub_create_mount, 1081 .mpo_create_root_mount = stub_create_root_mount, 1082 .mpo_relabel_vnode = stub_relabel_vnode, 1083 .mpo_setlabel_vnode_extattr = stub_setlabel_vnode_extattr, 1084 .mpo_update_devfsdirent = stub_update_devfsdirent, 1085 .mpo_create_mbuf_from_socket = stub_create_mbuf_from_socket, 1086 .mpo_create_pipe = stub_create_pipe, 1087 .mpo_create_socket = stub_create_socket, 1088 .mpo_create_socket_from_socket = stub_create_socket_from_socket, 1089 .mpo_relabel_pipe = stub_relabel_pipe, 1090 .mpo_relabel_socket = stub_relabel_socket, 1091 .mpo_set_socket_peer_from_mbuf = stub_set_socket_peer_from_mbuf, 1092 .mpo_set_socket_peer_from_socket = stub_set_socket_peer_from_socket, 1093 .mpo_create_bpfdesc = stub_create_bpfdesc, 1094 .mpo_create_ifnet = stub_create_ifnet, 1095 .mpo_create_inpcb_from_socket = stub_create_inpcb_from_socket, 1096 .mpo_create_ipq = stub_create_ipq, 1097 .mpo_create_datagram_from_ipq = stub_create_datagram_from_ipq, 1098 .mpo_create_fragment = stub_create_fragment, 1099 .mpo_create_ipq = stub_create_ipq, 1100 .mpo_create_mbuf_from_mbuf = stub_create_mbuf_from_mbuf, 1101 .mpo_create_mbuf_linklayer = stub_create_mbuf_linklayer, 1102 .mpo_create_mbuf_from_bpfdesc = stub_create_mbuf_from_bpfdesc, 1103 .mpo_create_mbuf_from_ifnet = stub_create_mbuf_from_ifnet, 1104 .mpo_create_mbuf_multicast_encap = stub_create_mbuf_multicast_encap, 1105 .mpo_create_mbuf_netlayer = stub_create_mbuf_netlayer, 1106 .mpo_fragment_match = stub_fragment_match, 1107 .mpo_reflect_mbuf_icmp = stub_reflect_mbuf_icmp, 1108 .mpo_reflect_mbuf_tcp = stub_reflect_mbuf_tcp, 1109 .mpo_relabel_ifnet = stub_relabel_ifnet, 1110 .mpo_update_ipq = stub_update_ipq, 1111 .mpo_inpcb_sosetlabel = stub_inpcb_sosetlabel, 1112 .mpo_create_cred = stub_create_cred, 1113 .mpo_execve_transition = stub_execve_transition, 1114 .mpo_execve_will_transition = stub_execve_will_transition, 1115 .mpo_create_proc0 = stub_create_proc0, 1116 .mpo_create_proc1 = stub_create_proc1, 1117 .mpo_relabel_cred = stub_relabel_cred, 1118 .mpo_thread_userret = stub_thread_userret, 1119 .mpo_check_bpfdesc_receive = stub_check_bpfdesc_receive, 1120 .mpo_check_cred_relabel = stub_check_cred_relabel, 1121 .mpo_check_cred_visible = stub_check_cred_visible, 1122 .mpo_check_ifnet_relabel = stub_check_ifnet_relabel, 1123 .mpo_check_ifnet_transmit = stub_check_ifnet_transmit, 1124 .mpo_check_inpcb_deliver = stub_check_inpcb_deliver, 1125 .mpo_check_kenv_dump = stub_check_kenv_dump, 1126 .mpo_check_kenv_get = stub_check_kenv_get, 1127 .mpo_check_kenv_set = stub_check_kenv_set, 1128 .mpo_check_kenv_unset = stub_check_kenv_unset, 1129 .mpo_check_kld_load = stub_check_kld_load, 1130 .mpo_check_kld_stat = stub_check_kld_stat, 1131 .mpo_check_kld_unload = stub_check_kld_unload, 1132 .mpo_check_mount_stat = stub_check_mount_stat, 1133 .mpo_check_pipe_ioctl = stub_check_pipe_ioctl, 1134 .mpo_check_pipe_poll = stub_check_pipe_poll, 1135 .mpo_check_pipe_read = stub_check_pipe_read, 1136 .mpo_check_pipe_relabel = stub_check_pipe_relabel, 1137 .mpo_check_pipe_stat = stub_check_pipe_stat, 1138 .mpo_check_pipe_write = stub_check_pipe_write, 1139 .mpo_check_proc_debug = stub_check_proc_debug, 1140 .mpo_check_proc_sched = stub_check_proc_sched, 1141 .mpo_check_proc_signal = stub_check_proc_signal, 1142 .mpo_check_socket_bind = stub_check_socket_bind, 1143 .mpo_check_socket_connect = stub_check_socket_connect, 1144 .mpo_check_socket_deliver = stub_check_socket_deliver, 1145 .mpo_check_socket_listen = stub_check_socket_listen, 1146 .mpo_check_socket_relabel = stub_check_socket_relabel, 1147 .mpo_check_socket_visible = stub_check_socket_visible, 1148 .mpo_check_sysarch_ioperm = stub_check_sysarch_ioperm, 1149 .mpo_check_system_acct = stub_check_system_acct, 1150 .mpo_check_system_reboot = stub_check_system_reboot, 1151 .mpo_check_system_settime = stub_check_system_settime, 1152 .mpo_check_system_swapon = stub_check_system_swapon, 1153 .mpo_check_system_swapoff = stub_check_system_swapoff, 1154 .mpo_check_system_sysctl = stub_check_system_sysctl, 1155 .mpo_check_vnode_access = stub_check_vnode_access, 1156 .mpo_check_vnode_chdir = stub_check_vnode_chdir, 1157 .mpo_check_vnode_chroot = stub_check_vnode_chroot, 1158 .mpo_check_vnode_create = stub_check_vnode_create, 1159 .mpo_check_vnode_delete = stub_check_vnode_delete, 1160 .mpo_check_vnode_deleteacl = stub_check_vnode_deleteacl, 1161 .mpo_check_vnode_deleteextattr = stub_check_vnode_deleteextattr, 1162 .mpo_check_vnode_exec = stub_check_vnode_exec, 1163 .mpo_check_vnode_getacl = stub_check_vnode_getacl, 1164 .mpo_check_vnode_getextattr = stub_check_vnode_getextattr, 1165 .mpo_check_vnode_link = stub_check_vnode_link, 1166 .mpo_check_vnode_listextattr = stub_check_vnode_listextattr, 1167 .mpo_check_vnode_lookup = stub_check_vnode_lookup, 1168 .mpo_check_vnode_mmap = stub_check_vnode_mmap, 1169 .mpo_check_vnode_mprotect = stub_check_vnode_mprotect, 1170 .mpo_check_vnode_open = stub_check_vnode_open, 1171 .mpo_check_vnode_poll = stub_check_vnode_poll, 1172 .mpo_check_vnode_read = stub_check_vnode_read, 1173 .mpo_check_vnode_readdir = stub_check_vnode_readdir, 1174 .mpo_check_vnode_readlink = stub_check_vnode_readlink, 1175 .mpo_check_vnode_relabel = stub_check_vnode_relabel, 1176 .mpo_check_vnode_rename_from = stub_check_vnode_rename_from, 1177 .mpo_check_vnode_rename_to = stub_check_vnode_rename_to, 1178 .mpo_check_vnode_revoke = stub_check_vnode_revoke, 1179 .mpo_check_vnode_setacl = stub_check_vnode_setacl, 1180 .mpo_check_vnode_setextattr = stub_check_vnode_setextattr, 1181 .mpo_check_vnode_setflags = stub_check_vnode_setflags, 1182 .mpo_check_vnode_setmode = stub_check_vnode_setmode, 1183 .mpo_check_vnode_setowner = stub_check_vnode_setowner, 1184 .mpo_check_vnode_setutimes = stub_check_vnode_setutimes, 1185 .mpo_check_vnode_stat = stub_check_vnode_stat, 1186 .mpo_check_vnode_write = stub_check_vnode_write, 1187}; 1188 1189MAC_POLICY_SET(&mac_stub_ops, mac_stub, "TrustedBSD MAC/Stub", 1190 MPC_LOADTIME_FLAG_UNLOADOK, NULL); 1191