mac_stub.c revision 164034
1/*-
2 * Copyright (c) 1999-2002 Robert N. M. Watson
3 * Copyright (c) 2001-2005 McAfee, Inc.
4 * Copyright (c) 2005 SPARTA, Inc.
5 * All rights reserved.
6 *
7 * This software was developed by Robert Watson for the TrustedBSD Project.
8 *
9 * This software was developed for the FreeBSD Project in part by McAfee
10 * Research, the Security Research Division of McAfee, Inc. under
11 * DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA
12 * CHATS research program.
13 *
14 * This software was enhanced by SPARTA ISSO under SPAWAR contract
15 * N66001-04-C-6019 ("SEFOS").
16 *
17 * Redistribution and use in source and binary forms, with or without
18 * modification, are permitted provided that the following conditions
19 * are met:
20 * 1. Redistributions of source code must retain the above copyright
21 *    notice, this list of conditions and the following disclaimer.
22 * 2. Redistributions in binary form must reproduce the above copyright
23 *    notice, this list of conditions and the following disclaimer in the
24 *    documentation and/or other materials provided with the distribution.
25 *
26 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
27 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
28 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
29 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
30 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
31 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
32 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
33 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
34 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
35 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
36 * SUCH DAMAGE.
37 *
38 * $FreeBSD: head/sys/security/mac_stub/mac_stub.c 164034 2006-11-06 13:45:45Z rwatson $
39 */
40
41/*
42 * Developed by the TrustedBSD Project.
43 *
44 * Stub module that implements a NOOP for most (if not all) MAC Framework
45 * policy entry points.
46 */
47
48#include <sys/types.h>
49#include <sys/param.h>
50#include <sys/acl.h>
51#include <sys/conf.h>
52#include <sys/extattr.h>
53#include <sys/kernel.h>
54#include <sys/mac.h>
55#include <sys/mount.h>
56#include <sys/proc.h>
57#include <sys/systm.h>
58#include <sys/sysproto.h>
59#include <sys/sysent.h>
60#include <sys/vnode.h>
61#include <sys/file.h>
62#include <sys/socket.h>
63#include <sys/socketvar.h>
64#include <sys/pipe.h>
65#include <sys/sx.h>
66#include <sys/sysctl.h>
67#include <sys/msg.h>
68#include <sys/sem.h>
69#include <sys/shm.h>
70
71#include <posix4/ksem.h>
72
73#include <fs/devfs/devfs.h>
74
75#include <net/bpfdesc.h>
76#include <net/if.h>
77#include <net/if_types.h>
78#include <net/if_var.h>
79
80#include <netinet/in.h>
81#include <netinet/in_pcb.h>
82#include <netinet/ip_var.h>
83
84#include <vm/vm.h>
85
86#include <sys/mac_policy.h>
87
88SYSCTL_DECL(_security_mac);
89
90SYSCTL_NODE(_security_mac, OID_AUTO, stub, CTLFLAG_RW, 0,
91    "TrustedBSD mac_stub policy controls");
92
93static int	stub_enabled = 1;
94SYSCTL_INT(_security_mac_stub, OID_AUTO, enabled, CTLFLAG_RW,
95    &stub_enabled, 0, "Enforce mac_stub policy");
96
97/*
98 * Policy module operations.
99 */
100static void
101stub_destroy(struct mac_policy_conf *conf)
102{
103
104}
105
106static void
107stub_init(struct mac_policy_conf *conf)
108{
109
110}
111
112static int
113stub_syscall(struct thread *td, int call, void *arg)
114{
115
116	return (0);
117}
118
119/*
120 * Label operations.
121 */
122static void
123stub_init_label(struct label *label)
124{
125
126}
127
128static int
129stub_init_label_waitcheck(struct label *label, int flag)
130{
131
132	return (0);
133}
134
135static void
136stub_destroy_label(struct label *label)
137{
138
139}
140
141static void
142stub_copy_label(struct label *src, struct label *dest)
143{
144
145}
146
147static int
148stub_externalize_label(struct label *label, char *element_name,
149    struct sbuf *sb, int *claimed)
150{
151
152	return (0);
153}
154
155static int
156stub_internalize_label(struct label *label, char *element_name,
157    char *element_data, int *claimed)
158{
159
160	return (0);
161}
162
163/*
164 * Labeling event operations: file system objects, and things that look
165 * a lot like file system objects.
166 */
167static void
168stub_associate_vnode_devfs(struct mount *mp, struct label *fslabel,
169    struct devfs_dirent *de, struct label *delabel, struct vnode *vp,
170    struct label *vlabel)
171{
172
173}
174
175static int
176stub_associate_vnode_extattr(struct mount *mp, struct label *fslabel,
177    struct vnode *vp, struct label *vlabel)
178{
179
180	return (0);
181}
182
183static void
184stub_associate_vnode_singlelabel(struct mount *mp,
185    struct label *fslabel, struct vnode *vp, struct label *vlabel)
186{
187
188}
189
190static void
191stub_create_devfs_device(struct ucred *cred, struct mount *mp,
192    struct cdev *dev, struct devfs_dirent *devfs_dirent, struct label *label)
193{
194
195}
196
197static void
198stub_create_devfs_directory(struct mount *mp, char *dirname,
199    int dirnamelen, struct devfs_dirent *devfs_dirent, struct label *label)
200{
201
202}
203
204static void
205stub_create_devfs_symlink(struct ucred *cred, struct mount *mp,
206    struct devfs_dirent *dd, struct label *ddlabel, struct devfs_dirent *de,
207    struct label *delabel)
208{
209
210}
211
212static int
213stub_create_vnode_extattr(struct ucred *cred, struct mount *mp,
214    struct label *fslabel, struct vnode *dvp, struct label *dlabel,
215    struct vnode *vp, struct label *vlabel, struct componentname *cnp)
216{
217
218	return (0);
219}
220
221static void
222stub_create_mount(struct ucred *cred, struct mount *mp,
223    struct label *mntlabel, struct label *fslabel)
224{
225
226}
227
228static void
229stub_relabel_vnode(struct ucred *cred, struct vnode *vp,
230    struct label *vnodelabel, struct label *label)
231{
232
233}
234
235static int
236stub_setlabel_vnode_extattr(struct ucred *cred, struct vnode *vp,
237    struct label *vlabel, struct label *intlabel)
238{
239
240	return (0);
241}
242
243static void
244stub_update_devfsdirent(struct mount *mp,
245    struct devfs_dirent *devfs_dirent, struct label *direntlabel,
246    struct vnode *vp, struct label *vnodelabel)
247{
248
249}
250
251/*
252 * Labeling event operations: IPC object.
253 */
254static void
255stub_create_mbuf_from_socket(struct socket *so, struct label *socketlabel,
256    struct mbuf *m, struct label *mbuflabel)
257{
258
259}
260
261static void
262stub_create_socket(struct ucred *cred, struct socket *socket,
263    struct label *socketlabel)
264{
265
266}
267
268static void
269stub_create_pipe(struct ucred *cred, struct pipepair *pp,
270    struct label *pipelabel)
271{
272
273}
274
275static void
276stub_create_posix_sem(struct ucred *cred, struct ksem *ksemptr,
277    struct label *ks_label)
278{
279
280}
281
282static void
283stub_create_socket_from_socket(struct socket *oldsocket,
284    struct label *oldsocketlabel, struct socket *newsocket,
285    struct label *newsocketlabel)
286{
287
288}
289
290static void
291stub_relabel_socket(struct ucred *cred, struct socket *socket,
292    struct label *socketlabel, struct label *newlabel)
293{
294
295}
296
297static void
298stub_relabel_pipe(struct ucred *cred, struct pipepair *pp,
299    struct label *pipelabel, struct label *newlabel)
300{
301
302}
303
304static void
305stub_set_socket_peer_from_mbuf(struct mbuf *mbuf, struct label *mbuflabel,
306    struct socket *socket, struct label *socketpeerlabel)
307{
308
309}
310
311static void
312stub_set_socket_peer_from_socket(struct socket *oldsocket,
313    struct label *oldsocketlabel, struct socket *newsocket,
314    struct label *newsocketpeerlabel)
315{
316
317}
318
319/*
320 * Labeling event operations: network objects.
321 */
322static void
323stub_create_bpfdesc(struct ucred *cred, struct bpf_d *bpf_d,
324    struct label *bpflabel)
325{
326
327}
328
329static void
330stub_create_datagram_from_ipq(struct ipq *ipq, struct label *ipqlabel,
331    struct mbuf *datagram, struct label *datagramlabel)
332{
333
334}
335
336static void
337stub_create_fragment(struct mbuf *datagram, struct label *datagramlabel,
338    struct mbuf *fragment, struct label *fragmentlabel)
339{
340
341}
342
343static void
344stub_create_ifnet(struct ifnet *ifnet, struct label *ifnetlabel)
345{
346
347}
348
349static void
350stub_create_inpcb_from_socket(struct socket *so, struct label *solabel,
351    struct inpcb *inp, struct label *inplabel)
352{
353
354}
355
356static void
357stub_create_sysv_msgmsg(struct ucred *cred, struct msqid_kernel *msqkptr,
358    struct label *msqlabel, struct msg *msgptr, struct label *msglabel)
359{
360
361}
362
363static void
364stub_create_sysv_msgqueue(struct ucred *cred, struct msqid_kernel *msqkptr,
365    struct label *msqlabel)
366{
367
368}
369
370static void
371stub_create_sysv_sem(struct ucred *cred, struct semid_kernel *semakptr,
372    struct label *semalabel)
373{
374
375}
376
377static void
378stub_create_sysv_shm(struct ucred *cred, struct shmid_kernel *shmsegptr,
379    struct label *shmalabel)
380{
381
382}
383
384static void
385stub_create_ipq(struct mbuf *fragment, struct label *fragmentlabel,
386    struct ipq *ipq, struct label *ipqlabel)
387{
388
389}
390
391static void
392stub_create_mbuf_from_inpcb(struct inpcb *inp, struct label *inplabel,
393    struct mbuf *m, struct label *mlabel)
394{
395
396}
397
398static void
399stub_create_mbuf_linklayer(struct ifnet *ifnet, struct label *ifnetlabel,
400    struct mbuf *mbuf, struct label *mbuflabel)
401{
402
403}
404
405static void
406stub_create_mbuf_from_bpfdesc(struct bpf_d *bpf_d, struct label *bpflabel,
407    struct mbuf *mbuf, struct label *mbuflabel)
408{
409
410}
411
412static void
413stub_create_mbuf_from_ifnet(struct ifnet *ifnet, struct label *ifnetlabel,
414    struct mbuf *m, struct label *mbuflabel)
415{
416
417}
418
419static void
420stub_create_mbuf_multicast_encap(struct mbuf *oldmbuf,
421    struct label *oldmbuflabel, struct ifnet *ifnet, struct label *ifnetlabel,
422    struct mbuf *newmbuf, struct label *newmbuflabel)
423{
424
425}
426
427static void
428stub_create_mbuf_netlayer(struct mbuf *oldmbuf,
429    struct label *oldmbuflabel, struct mbuf *newmbuf, struct label *newmbuflabel)
430{
431
432}
433
434static int
435stub_fragment_match(struct mbuf *fragment, struct label *fragmentlabel,
436    struct ipq *ipq, struct label *ipqlabel)
437{
438
439	return (1);
440}
441
442static void
443stub_reflect_mbuf_icmp(struct mbuf *m, struct label *mlabel)
444{
445
446}
447
448static void
449stub_reflect_mbuf_tcp(struct mbuf *m, struct label *mlabel)
450{
451
452}
453
454static void
455stub_relabel_ifnet(struct ucred *cred, struct ifnet *ifnet,
456    struct label *ifnetlabel, struct label *newlabel)
457{
458
459}
460
461static void
462stub_update_ipq(struct mbuf *fragment, struct label *fragmentlabel,
463    struct ipq *ipq, struct label *ipqlabel)
464{
465
466}
467
468static void
469stub_inpcb_sosetlabel(struct socket *so, struct label *solabel,
470    struct inpcb *inp, struct label *inplabel)
471{
472
473}
474
475/*
476 * Labeling event operations: processes.
477 */
478static void
479stub_execve_transition(struct ucred *old, struct ucred *new,
480    struct vnode *vp, struct label *vnodelabel,
481    struct label *interpvnodelabel, struct image_params *imgp,
482    struct label *execlabel)
483{
484
485}
486
487static int
488stub_execve_will_transition(struct ucred *old, struct vnode *vp,
489    struct label *vnodelabel, struct label *interpvnodelabel,
490    struct image_params *imgp, struct label *execlabel)
491{
492
493	return (0);
494}
495
496static void
497stub_create_proc0(struct ucred *cred)
498{
499
500}
501
502static void
503stub_create_proc1(struct ucred *cred)
504{
505
506}
507
508static void
509stub_relabel_cred(struct ucred *cred, struct label *newlabel)
510{
511
512}
513
514static void
515stub_thread_userret(struct thread *td)
516{
517
518}
519
520/*
521 * Label cleanup/flush operations
522 */
523static void
524stub_cleanup_sysv_msgmsg(struct label *msglabel)
525{
526
527}
528
529static void
530stub_cleanup_sysv_msgqueue(struct label *msqlabel)
531{
532
533}
534
535static void
536stub_cleanup_sysv_sem(struct label *semalabel)
537{
538
539}
540
541static void
542stub_cleanup_sysv_shm(struct label *shmlabel)
543{
544
545}
546
547/*
548 * Access control checks.
549 */
550static int
551stub_check_bpfdesc_receive(struct bpf_d *bpf_d, struct label *bpflabel,
552    struct ifnet *ifnet, struct label *ifnet_label)
553{
554
555        return (0);
556}
557
558static int
559stub_check_cred_relabel(struct ucred *cred, struct label *newlabel)
560{
561
562	return (0);
563}
564
565static int
566stub_check_cred_visible(struct ucred *u1, struct ucred *u2)
567{
568
569	return (0);
570}
571
572static int
573stub_check_ifnet_relabel(struct ucred *cred, struct ifnet *ifnet,
574    struct label *ifnetlabel, struct label *newlabel)
575{
576
577	return (0);
578}
579
580static int
581stub_check_ifnet_transmit(struct ifnet *ifnet, struct label *ifnetlabel,
582    struct mbuf *m, struct label *mbuflabel)
583{
584
585	return (0);
586}
587
588static int
589stub_check_inpcb_deliver(struct inpcb *inp, struct label *inplabel,
590    struct mbuf *m, struct label *mlabel)
591{
592
593	return (0);
594}
595
596static int
597stub_check_sysv_msgmsq(struct ucred *cred, struct msg *msgptr,
598    struct label *msglabel, struct msqid_kernel *msqkptr,
599    struct label *msqklabel)
600{
601
602	return (0);
603}
604
605static int
606stub_check_sysv_msgrcv(struct ucred *cred, struct msg *msgptr,
607    struct label *msglabel)
608{
609
610	return (0);
611}
612
613
614static int
615stub_check_sysv_msgrmid(struct ucred *cred, struct msg *msgptr,
616    struct label *msglabel)
617{
618
619	return (0);
620}
621
622
623static int
624stub_check_sysv_msqget(struct ucred *cred, struct msqid_kernel *msqkptr,
625    struct label *msqklabel)
626{
627
628	return (0);
629}
630
631
632static int
633stub_check_sysv_msqsnd(struct ucred *cred, struct msqid_kernel *msqkptr,
634    struct label *msqklabel)
635{
636
637	return (0);
638}
639
640static int
641stub_check_sysv_msqrcv(struct ucred *cred, struct msqid_kernel *msqkptr,
642    struct label *msqklabel)
643{
644
645	return (0);
646}
647
648
649static int
650stub_check_sysv_msqctl(struct ucred *cred, struct msqid_kernel *msqkptr,
651    struct label *msqklabel, int cmd)
652{
653
654	return (0);
655}
656
657
658static int
659stub_check_sysv_semctl(struct ucred *cred, struct semid_kernel *semakptr,
660    struct label *semaklabel, int cmd)
661{
662
663	return (0);
664}
665
666static int
667stub_check_sysv_semget(struct ucred *cred, struct semid_kernel *semakptr,
668    struct label *semaklabel)
669{
670
671	return (0);
672}
673
674
675static int
676stub_check_sysv_semop(struct ucred *cred, struct semid_kernel *semakptr,
677    struct label *semaklabel, size_t accesstype)
678{
679
680	return (0);
681}
682
683static int
684stub_check_sysv_shmat(struct ucred *cred, struct shmid_kernel *shmsegptr,
685    struct label *shmseglabel, int shmflg)
686{
687
688	return (0);
689}
690
691static int
692stub_check_sysv_shmctl(struct ucred *cred, struct shmid_kernel *shmsegptr,
693    struct label *shmseglabel, int cmd)
694{
695
696	return (0);
697}
698
699static int
700stub_check_sysv_shmdt(struct ucred *cred, struct shmid_kernel *shmsegptr,
701    struct label *shmseglabel)
702{
703
704	return (0);
705}
706
707
708static int
709stub_check_sysv_shmget(struct ucred *cred, struct shmid_kernel *shmsegptr,
710    struct label *shmseglabel, int shmflg)
711{
712
713	return (0);
714}
715
716static int
717stub_check_kenv_dump(struct ucred *cred)
718{
719
720	return (0);
721}
722
723static int
724stub_check_kenv_get(struct ucred *cred, char *name)
725{
726
727	return (0);
728}
729
730static int
731stub_check_kenv_set(struct ucred *cred, char *name, char *value)
732{
733
734	return (0);
735}
736
737static int
738stub_check_kenv_unset(struct ucred *cred, char *name)
739{
740
741	return (0);
742}
743
744static int
745stub_check_kld_load(struct ucred *cred, struct vnode *vp,
746    struct label *vlabel)
747{
748
749	return (0);
750}
751
752static int
753stub_check_kld_stat(struct ucred *cred)
754{
755
756	return (0);
757}
758
759static int
760stub_check_kld_unload(struct ucred *cred)
761{
762
763	return (0);
764}
765
766static int
767stub_check_mount_stat(struct ucred *cred, struct mount *mp,
768    struct label *mntlabel)
769{
770
771	return (0);
772}
773
774static int
775stub_check_pipe_ioctl(struct ucred *cred, struct pipepair *pp,
776    struct label *pipelabel, unsigned long cmd, void /* caddr_t */ *data)
777{
778
779	return (0);
780}
781
782static int
783stub_check_pipe_poll(struct ucred *cred, struct pipepair *pp,
784    struct label *pipelabel)
785{
786
787	return (0);
788}
789
790static int
791stub_check_pipe_read(struct ucred *cred, struct pipepair *pp,
792    struct label *pipelabel)
793{
794
795	return (0);
796}
797
798static int
799stub_check_pipe_relabel(struct ucred *cred, struct pipepair *pp,
800    struct label *pipelabel, struct label *newlabel)
801{
802
803	return (0);
804}
805
806static int
807stub_check_pipe_stat(struct ucred *cred, struct pipepair *pp,
808    struct label *pipelabel)
809{
810
811	return (0);
812}
813
814static int
815stub_check_pipe_write(struct ucred *cred, struct pipepair *pp,
816    struct label *pipelabel)
817{
818
819	return (0);
820}
821
822static int
823stub_check_posix_sem_destroy(struct ucred *cred, struct ksem *ksemptr,
824    struct label *ks_label)
825{
826
827	return (0);
828}
829
830static int
831stub_check_posix_sem_getvalue(struct ucred *cred, struct ksem *ksemptr,
832    struct label *ks_label)
833{
834
835	return (0);
836}
837
838static int
839stub_check_posix_sem_open(struct ucred *cred, struct ksem *ksemptr,
840    struct label *ks_label)
841{
842
843	return (0);
844}
845
846static int
847stub_check_posix_sem_post(struct ucred *cred, struct ksem *ksemptr,
848    struct label *ks_label)
849{
850
851	return (0);
852}
853
854static int
855stub_check_posix_sem_unlink(struct ucred *cred, struct ksem *ksemptr,
856    struct label *ks_label)
857{
858
859	return (0);
860}
861
862static int
863stub_check_posix_sem_wait(struct ucred *cred, struct ksem *ksemptr,
864    struct label *ks_label)
865{
866
867	return (0);
868}
869
870static int
871stub_check_proc_debug(struct ucred *cred, struct proc *proc)
872{
873
874	return (0);
875}
876
877static int
878stub_check_proc_sched(struct ucred *cred, struct proc *proc)
879{
880
881	return (0);
882}
883
884static int
885stub_check_proc_signal(struct ucred *cred, struct proc *proc, int signum)
886{
887
888	return (0);
889}
890
891static int
892stub_check_proc_wait(struct ucred *cred, struct proc *proc)
893{
894
895	return (0);
896}
897
898static int
899stub_check_proc_setuid(struct ucred *cred, uid_t uid)
900{
901
902	return (0);
903}
904
905static int
906stub_check_proc_seteuid(struct ucred *cred, uid_t euid)
907{
908
909	return (0);
910}
911
912static int
913stub_check_proc_setgid(struct ucred *cred, gid_t gid)
914{
915
916	return (0);
917}
918
919static int
920stub_check_proc_setegid(struct ucred *cred, gid_t egid)
921{
922
923	return (0);
924}
925
926static int
927stub_check_proc_setgroups(struct ucred *cred, int ngroups,
928	gid_t *gidset)
929{
930
931	return (0);
932}
933
934static int
935stub_check_proc_setreuid(struct ucred *cred, uid_t ruid, uid_t euid)
936{
937
938	return (0);
939}
940
941static int
942stub_check_proc_setregid(struct ucred *cred, gid_t rgid, gid_t egid)
943{
944
945	return (0);
946}
947
948static int
949stub_check_proc_setresuid(struct ucred *cred, uid_t ruid, uid_t euid,
950	uid_t suid)
951{
952
953	return (0);
954}
955
956static int
957stub_check_proc_setresgid(struct ucred *cred, gid_t rgid, gid_t egid,
958	gid_t sgid)
959{
960
961	return (0);
962}
963
964static int
965stub_check_socket_accept(struct ucred *cred, struct socket *socket,
966    struct label *socketlabel)
967{
968
969	return (0);
970}
971
972static int
973stub_check_socket_bind(struct ucred *cred, struct socket *socket,
974    struct label *socketlabel, struct sockaddr *sockaddr)
975{
976
977	return (0);
978}
979
980static int
981stub_check_socket_connect(struct ucred *cred, struct socket *socket,
982    struct label *socketlabel, struct sockaddr *sockaddr)
983{
984
985	return (0);
986}
987
988static int
989stub_check_socket_create(struct ucred *cred, int domain, int type,
990    int protocol)
991{
992
993	return (0);
994}
995
996static int
997stub_check_socket_deliver(struct socket *so, struct label *socketlabel,
998    struct mbuf *m, struct label *mbuflabel)
999{
1000
1001	return (0);
1002}
1003
1004static int
1005stub_check_socket_listen(struct ucred *cred, struct socket *so,
1006    struct label *socketlabel)
1007{
1008
1009	return (0);
1010}
1011
1012static int
1013stub_check_socket_poll(struct ucred *cred, struct socket *so,
1014    struct label *socketlabel)
1015{
1016
1017	return (0);
1018}
1019
1020static int
1021stub_check_socket_receive(struct ucred *cred, struct socket *so,
1022    struct label *socketlabel)
1023{
1024
1025	return (0);
1026}
1027
1028static int
1029stub_check_socket_relabel(struct ucred *cred, struct socket *socket,
1030    struct label *socketlabel, struct label *newlabel)
1031{
1032
1033	return (0);
1034}
1035static int
1036stub_check_socket_send(struct ucred *cred, struct socket *so,
1037    struct label *socketlabel)
1038{
1039
1040	return (0);
1041}
1042
1043static int
1044stub_check_socket_stat(struct ucred *cred, struct socket *so,
1045    struct label *socketlabel)
1046{
1047
1048	return (0);
1049}
1050
1051static int
1052stub_check_socket_visible(struct ucred *cred, struct socket *socket,
1053   struct label *socketlabel)
1054{
1055
1056	return (0);
1057}
1058
1059static int
1060stub_check_sysarch_ioperm(struct ucred *cred)
1061{
1062
1063	return (0);
1064}
1065
1066static int
1067stub_check_system_acct(struct ucred *cred, struct vnode *vp,
1068    struct label *vlabel)
1069{
1070
1071	return (0);
1072}
1073
1074static int
1075stub_check_system_reboot(struct ucred *cred, int how)
1076{
1077
1078	return (0);
1079}
1080
1081static int
1082stub_check_system_settime(struct ucred *cred)
1083{
1084
1085	return (0);
1086}
1087
1088static int
1089stub_check_system_swapon(struct ucred *cred, struct vnode *vp,
1090    struct label *label)
1091{
1092
1093	return (0);
1094}
1095
1096static int
1097stub_check_system_swapoff(struct ucred *cred, struct vnode *vp,
1098    struct label *label)
1099{
1100
1101	return (0);
1102}
1103
1104static int
1105stub_check_system_sysctl(struct ucred *cred, struct sysctl_oid *oidp,
1106    void *arg1, int arg2, struct sysctl_req *req)
1107{
1108
1109	return (0);
1110}
1111
1112static int
1113stub_check_vnode_access(struct ucred *cred, struct vnode *vp,
1114    struct label *label, int acc_mode)
1115{
1116
1117	return (0);
1118}
1119
1120static int
1121stub_check_vnode_chdir(struct ucred *cred, struct vnode *dvp,
1122    struct label *dlabel)
1123{
1124
1125	return (0);
1126}
1127
1128static int
1129stub_check_vnode_chroot(struct ucred *cred, struct vnode *dvp,
1130    struct label *dlabel)
1131{
1132
1133	return (0);
1134}
1135
1136static int
1137stub_check_vnode_create(struct ucred *cred, struct vnode *dvp,
1138    struct label *dlabel, struct componentname *cnp, struct vattr *vap)
1139{
1140
1141	return (0);
1142}
1143
1144static int
1145stub_check_vnode_delete(struct ucred *cred, struct vnode *dvp,
1146    struct label *dlabel, struct vnode *vp, struct label *label,
1147    struct componentname *cnp)
1148{
1149
1150	return (0);
1151}
1152
1153static int
1154stub_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp,
1155    struct label *label, acl_type_t type)
1156{
1157
1158	return (0);
1159}
1160
1161static int
1162stub_check_vnode_deleteextattr(struct ucred *cred, struct vnode *vp,
1163    struct label *label, int attrnamespace, const char *name)
1164{
1165
1166	return (0);
1167}
1168
1169static int
1170stub_check_vnode_exec(struct ucred *cred, struct vnode *vp,
1171    struct label *label, struct image_params *imgp,
1172    struct label *execlabel)
1173{
1174
1175	return (0);
1176}
1177
1178static int
1179stub_check_vnode_getacl(struct ucred *cred, struct vnode *vp,
1180    struct label *label, acl_type_t type)
1181{
1182
1183	return (0);
1184}
1185
1186static int
1187stub_check_vnode_getextattr(struct ucred *cred, struct vnode *vp,
1188    struct label *label, int attrnamespace, const char *name, struct uio *uio)
1189{
1190
1191	return (0);
1192}
1193
1194static int
1195stub_check_vnode_link(struct ucred *cred, struct vnode *dvp,
1196    struct label *dlabel, struct vnode *vp, struct label *label,
1197    struct componentname *cnp)
1198{
1199
1200	return (0);
1201}
1202
1203static int
1204stub_check_vnode_listextattr(struct ucred *cred, struct vnode *vp,
1205    struct label *label, int attrnamespace)
1206{
1207
1208	return (0);
1209}
1210
1211static int
1212stub_check_vnode_lookup(struct ucred *cred, struct vnode *dvp,
1213    struct label *dlabel, struct componentname *cnp)
1214{
1215
1216	return (0);
1217}
1218
1219static int
1220stub_check_vnode_mmap(struct ucred *cred, struct vnode *vp,
1221    struct label *label, int prot, int flags)
1222{
1223
1224	return (0);
1225}
1226
1227static int
1228stub_check_vnode_open(struct ucred *cred, struct vnode *vp,
1229    struct label *filelabel, int acc_mode)
1230{
1231
1232	return (0);
1233}
1234
1235static int
1236stub_check_vnode_poll(struct ucred *active_cred, struct ucred *file_cred,
1237    struct vnode *vp, struct label *label)
1238{
1239
1240	return (0);
1241}
1242
1243static int
1244stub_check_vnode_read(struct ucred *active_cred, struct ucred *file_cred,
1245    struct vnode *vp, struct label *label)
1246{
1247
1248	return (0);
1249}
1250
1251static int
1252stub_check_vnode_readdir(struct ucred *cred, struct vnode *vp,
1253    struct label *dlabel)
1254{
1255
1256	return (0);
1257}
1258
1259static int
1260stub_check_vnode_readlink(struct ucred *cred, struct vnode *vp,
1261    struct label *vnodelabel)
1262{
1263
1264	return (0);
1265}
1266
1267static int
1268stub_check_vnode_relabel(struct ucred *cred, struct vnode *vp,
1269    struct label *vnodelabel, struct label *newlabel)
1270{
1271
1272	return (0);
1273}
1274
1275static int
1276stub_check_vnode_rename_from(struct ucred *cred, struct vnode *dvp,
1277    struct label *dlabel, struct vnode *vp, struct label *label,
1278    struct componentname *cnp)
1279{
1280
1281	return (0);
1282}
1283
1284static int
1285stub_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp,
1286    struct label *dlabel, struct vnode *vp, struct label *label, int samedir,
1287    struct componentname *cnp)
1288{
1289
1290	return (0);
1291}
1292
1293static int
1294stub_check_vnode_revoke(struct ucred *cred, struct vnode *vp,
1295    struct label *label)
1296{
1297
1298	return (0);
1299}
1300
1301static int
1302stub_check_vnode_setacl(struct ucred *cred, struct vnode *vp,
1303    struct label *label, acl_type_t type, struct acl *acl)
1304{
1305
1306	return (0);
1307}
1308
1309static int
1310stub_check_vnode_setextattr(struct ucred *cred, struct vnode *vp,
1311    struct label *label, int attrnamespace, const char *name, struct uio *uio)
1312{
1313
1314	return (0);
1315}
1316
1317static int
1318stub_check_vnode_setflags(struct ucred *cred, struct vnode *vp,
1319    struct label *label, u_long flags)
1320{
1321
1322	return (0);
1323}
1324
1325static int
1326stub_check_vnode_setmode(struct ucred *cred, struct vnode *vp,
1327    struct label *label, mode_t mode)
1328{
1329
1330	return (0);
1331}
1332
1333static int
1334stub_check_vnode_setowner(struct ucred *cred, struct vnode *vp,
1335    struct label *label, uid_t uid, gid_t gid)
1336{
1337
1338	return (0);
1339}
1340
1341static int
1342stub_check_vnode_setutimes(struct ucred *cred, struct vnode *vp,
1343    struct label *label, struct timespec atime, struct timespec mtime)
1344{
1345
1346	return (0);
1347}
1348
1349static int
1350stub_check_vnode_stat(struct ucred *active_cred, struct ucred *file_cred,
1351    struct vnode *vp, struct label *label)
1352{
1353
1354	return (0);
1355}
1356
1357static int
1358stub_check_vnode_write(struct ucred *active_cred,
1359    struct ucred *file_cred, struct vnode *vp, struct label *label)
1360{
1361
1362	return (0);
1363}
1364
1365static int
1366stub_priv_check(struct ucred *cred, int priv)
1367{
1368
1369	return (0);
1370}
1371
1372static int
1373stub_priv_grant(struct ucred *cred, int priv)
1374{
1375
1376	return (EPERM);
1377}
1378
1379static struct mac_policy_ops mac_stub_ops =
1380{
1381	.mpo_destroy = stub_destroy,
1382	.mpo_init = stub_init,
1383	.mpo_syscall = stub_syscall,
1384	.mpo_init_bpfdesc_label = stub_init_label,
1385	.mpo_init_cred_label = stub_init_label,
1386	.mpo_init_devfsdirent_label = stub_init_label,
1387	.mpo_init_ifnet_label = stub_init_label,
1388	.mpo_init_inpcb_label = stub_init_label_waitcheck,
1389	.mpo_init_sysv_msgmsg_label = stub_init_label,
1390	.mpo_init_sysv_msgqueue_label = stub_init_label,
1391	.mpo_init_sysv_sem_label = stub_init_label,
1392	.mpo_init_sysv_shm_label = stub_init_label,
1393	.mpo_init_ipq_label = stub_init_label_waitcheck,
1394	.mpo_init_mbuf_label = stub_init_label_waitcheck,
1395	.mpo_init_mount_label = stub_init_label,
1396	.mpo_init_mount_fs_label = stub_init_label,
1397	.mpo_init_pipe_label = stub_init_label,
1398	.mpo_init_posix_sem_label = stub_init_label,
1399	.mpo_init_socket_label = stub_init_label_waitcheck,
1400	.mpo_init_socket_peer_label = stub_init_label_waitcheck,
1401	.mpo_init_vnode_label = stub_init_label,
1402	.mpo_destroy_bpfdesc_label = stub_destroy_label,
1403	.mpo_destroy_cred_label = stub_destroy_label,
1404	.mpo_destroy_devfsdirent_label = stub_destroy_label,
1405	.mpo_destroy_ifnet_label = stub_destroy_label,
1406	.mpo_destroy_inpcb_label = stub_destroy_label,
1407	.mpo_destroy_sysv_msgmsg_label = stub_destroy_label,
1408	.mpo_destroy_sysv_msgqueue_label = stub_destroy_label,
1409	.mpo_destroy_sysv_sem_label = stub_destroy_label,
1410	.mpo_destroy_sysv_shm_label = stub_destroy_label,
1411	.mpo_destroy_ipq_label = stub_destroy_label,
1412	.mpo_destroy_mbuf_label = stub_destroy_label,
1413	.mpo_destroy_mount_label = stub_destroy_label,
1414	.mpo_destroy_mount_fs_label = stub_destroy_label,
1415	.mpo_destroy_pipe_label = stub_destroy_label,
1416	.mpo_destroy_posix_sem_label = stub_destroy_label,
1417	.mpo_destroy_socket_label = stub_destroy_label,
1418	.mpo_destroy_socket_peer_label = stub_destroy_label,
1419	.mpo_destroy_vnode_label = stub_destroy_label,
1420	.mpo_copy_cred_label = stub_copy_label,
1421	.mpo_copy_ifnet_label = stub_copy_label,
1422	.mpo_copy_mbuf_label = stub_copy_label,
1423	.mpo_copy_pipe_label = stub_copy_label,
1424	.mpo_copy_socket_label = stub_copy_label,
1425	.mpo_copy_vnode_label = stub_copy_label,
1426	.mpo_externalize_cred_label = stub_externalize_label,
1427	.mpo_externalize_ifnet_label = stub_externalize_label,
1428	.mpo_externalize_pipe_label = stub_externalize_label,
1429	.mpo_externalize_socket_label = stub_externalize_label,
1430	.mpo_externalize_socket_peer_label = stub_externalize_label,
1431	.mpo_externalize_vnode_label = stub_externalize_label,
1432	.mpo_internalize_cred_label = stub_internalize_label,
1433	.mpo_internalize_ifnet_label = stub_internalize_label,
1434	.mpo_internalize_pipe_label = stub_internalize_label,
1435	.mpo_internalize_socket_label = stub_internalize_label,
1436	.mpo_internalize_vnode_label = stub_internalize_label,
1437	.mpo_associate_vnode_devfs = stub_associate_vnode_devfs,
1438	.mpo_associate_vnode_extattr = stub_associate_vnode_extattr,
1439	.mpo_associate_vnode_singlelabel = stub_associate_vnode_singlelabel,
1440	.mpo_create_devfs_device = stub_create_devfs_device,
1441	.mpo_create_devfs_directory = stub_create_devfs_directory,
1442	.mpo_create_devfs_symlink = stub_create_devfs_symlink,
1443	.mpo_create_sysv_msgmsg = stub_create_sysv_msgmsg,
1444	.mpo_create_sysv_msgqueue = stub_create_sysv_msgqueue,
1445	.mpo_create_sysv_sem = stub_create_sysv_sem,
1446	.mpo_create_sysv_shm = stub_create_sysv_shm,
1447	.mpo_create_vnode_extattr = stub_create_vnode_extattr,
1448	.mpo_create_mount = stub_create_mount,
1449	.mpo_relabel_vnode = stub_relabel_vnode,
1450	.mpo_setlabel_vnode_extattr = stub_setlabel_vnode_extattr,
1451	.mpo_update_devfsdirent = stub_update_devfsdirent,
1452	.mpo_create_mbuf_from_socket = stub_create_mbuf_from_socket,
1453	.mpo_create_pipe = stub_create_pipe,
1454	.mpo_create_posix_sem = stub_create_posix_sem,
1455	.mpo_create_socket = stub_create_socket,
1456	.mpo_create_socket_from_socket = stub_create_socket_from_socket,
1457	.mpo_relabel_pipe = stub_relabel_pipe,
1458	.mpo_relabel_socket = stub_relabel_socket,
1459	.mpo_set_socket_peer_from_mbuf = stub_set_socket_peer_from_mbuf,
1460	.mpo_set_socket_peer_from_socket = stub_set_socket_peer_from_socket,
1461	.mpo_create_bpfdesc = stub_create_bpfdesc,
1462	.mpo_create_ifnet = stub_create_ifnet,
1463	.mpo_create_inpcb_from_socket = stub_create_inpcb_from_socket,
1464	.mpo_create_ipq = stub_create_ipq,
1465	.mpo_create_datagram_from_ipq = stub_create_datagram_from_ipq,
1466	.mpo_create_fragment = stub_create_fragment,
1467	.mpo_create_mbuf_from_inpcb = stub_create_mbuf_from_inpcb,
1468	.mpo_create_mbuf_linklayer = stub_create_mbuf_linklayer,
1469	.mpo_create_mbuf_from_bpfdesc = stub_create_mbuf_from_bpfdesc,
1470	.mpo_create_mbuf_from_ifnet = stub_create_mbuf_from_ifnet,
1471	.mpo_create_mbuf_multicast_encap = stub_create_mbuf_multicast_encap,
1472	.mpo_create_mbuf_netlayer = stub_create_mbuf_netlayer,
1473	.mpo_fragment_match = stub_fragment_match,
1474	.mpo_reflect_mbuf_icmp = stub_reflect_mbuf_icmp,
1475	.mpo_reflect_mbuf_tcp = stub_reflect_mbuf_tcp,
1476	.mpo_relabel_ifnet = stub_relabel_ifnet,
1477	.mpo_update_ipq = stub_update_ipq,
1478	.mpo_inpcb_sosetlabel = stub_inpcb_sosetlabel,
1479	.mpo_execve_transition = stub_execve_transition,
1480	.mpo_execve_will_transition = stub_execve_will_transition,
1481	.mpo_create_proc0 = stub_create_proc0,
1482	.mpo_create_proc1 = stub_create_proc1,
1483	.mpo_relabel_cred = stub_relabel_cred,
1484	.mpo_thread_userret = stub_thread_userret,
1485	.mpo_cleanup_sysv_msgmsg = stub_cleanup_sysv_msgmsg,
1486	.mpo_cleanup_sysv_msgqueue = stub_cleanup_sysv_msgqueue,
1487	.mpo_cleanup_sysv_sem = stub_cleanup_sysv_sem,
1488	.mpo_cleanup_sysv_shm = stub_cleanup_sysv_shm,
1489	.mpo_check_bpfdesc_receive = stub_check_bpfdesc_receive,
1490	.mpo_check_cred_relabel = stub_check_cred_relabel,
1491	.mpo_check_cred_visible = stub_check_cred_visible,
1492	.mpo_check_ifnet_relabel = stub_check_ifnet_relabel,
1493	.mpo_check_ifnet_transmit = stub_check_ifnet_transmit,
1494	.mpo_check_inpcb_deliver = stub_check_inpcb_deliver,
1495	.mpo_check_sysv_msgmsq = stub_check_sysv_msgmsq,
1496	.mpo_check_sysv_msgrcv = stub_check_sysv_msgrcv,
1497	.mpo_check_sysv_msgrmid = stub_check_sysv_msgrmid,
1498	.mpo_check_sysv_msqget = stub_check_sysv_msqget,
1499	.mpo_check_sysv_msqsnd = stub_check_sysv_msqsnd,
1500	.mpo_check_sysv_msqrcv = stub_check_sysv_msqrcv,
1501	.mpo_check_sysv_msqctl = stub_check_sysv_msqctl,
1502	.mpo_check_sysv_semctl = stub_check_sysv_semctl,
1503	.mpo_check_sysv_semget = stub_check_sysv_semget,
1504	.mpo_check_sysv_semop = stub_check_sysv_semop,
1505	.mpo_check_sysv_shmat = stub_check_sysv_shmat,
1506	.mpo_check_sysv_shmctl = stub_check_sysv_shmctl,
1507	.mpo_check_sysv_shmdt = stub_check_sysv_shmdt,
1508	.mpo_check_sysv_shmget = stub_check_sysv_shmget,
1509	.mpo_check_kenv_dump = stub_check_kenv_dump,
1510	.mpo_check_kenv_get = stub_check_kenv_get,
1511	.mpo_check_kenv_set = stub_check_kenv_set,
1512	.mpo_check_kenv_unset = stub_check_kenv_unset,
1513	.mpo_check_kld_load = stub_check_kld_load,
1514	.mpo_check_kld_stat = stub_check_kld_stat,
1515	.mpo_check_kld_unload = stub_check_kld_unload,
1516	.mpo_check_mount_stat = stub_check_mount_stat,
1517	.mpo_check_pipe_ioctl = stub_check_pipe_ioctl,
1518	.mpo_check_pipe_poll = stub_check_pipe_poll,
1519	.mpo_check_pipe_read = stub_check_pipe_read,
1520	.mpo_check_pipe_relabel = stub_check_pipe_relabel,
1521	.mpo_check_pipe_stat = stub_check_pipe_stat,
1522	.mpo_check_pipe_write = stub_check_pipe_write,
1523	.mpo_check_posix_sem_destroy = stub_check_posix_sem_destroy,
1524	.mpo_check_posix_sem_getvalue = stub_check_posix_sem_getvalue,
1525	.mpo_check_posix_sem_open = stub_check_posix_sem_open,
1526	.mpo_check_posix_sem_post = stub_check_posix_sem_post,
1527	.mpo_check_posix_sem_unlink = stub_check_posix_sem_unlink,
1528	.mpo_check_posix_sem_wait = stub_check_posix_sem_wait,
1529	.mpo_check_proc_debug = stub_check_proc_debug,
1530	.mpo_check_proc_sched = stub_check_proc_sched,
1531	.mpo_check_proc_setuid = stub_check_proc_setuid,
1532	.mpo_check_proc_seteuid = stub_check_proc_seteuid,
1533	.mpo_check_proc_setgid = stub_check_proc_setgid,
1534	.mpo_check_proc_setegid = stub_check_proc_setegid,
1535	.mpo_check_proc_setgroups = stub_check_proc_setgroups,
1536	.mpo_check_proc_setreuid = stub_check_proc_setreuid,
1537	.mpo_check_proc_setregid = stub_check_proc_setregid,
1538	.mpo_check_proc_setresuid = stub_check_proc_setresuid,
1539	.mpo_check_proc_setresgid = stub_check_proc_setresgid,
1540	.mpo_check_proc_signal = stub_check_proc_signal,
1541	.mpo_check_proc_wait = stub_check_proc_wait,
1542	.mpo_check_socket_accept = stub_check_socket_accept,
1543	.mpo_check_socket_bind = stub_check_socket_bind,
1544	.mpo_check_socket_connect = stub_check_socket_connect,
1545	.mpo_check_socket_create = stub_check_socket_create,
1546	.mpo_check_socket_deliver = stub_check_socket_deliver,
1547	.mpo_check_socket_listen = stub_check_socket_listen,
1548	.mpo_check_socket_poll = stub_check_socket_poll,
1549	.mpo_check_socket_receive = stub_check_socket_receive,
1550	.mpo_check_socket_relabel = stub_check_socket_relabel,
1551	.mpo_check_socket_send = stub_check_socket_send,
1552	.mpo_check_socket_stat = stub_check_socket_stat,
1553	.mpo_check_socket_visible = stub_check_socket_visible,
1554	.mpo_check_sysarch_ioperm = stub_check_sysarch_ioperm,
1555	.mpo_check_system_acct = stub_check_system_acct,
1556	.mpo_check_system_reboot = stub_check_system_reboot,
1557	.mpo_check_system_settime = stub_check_system_settime,
1558	.mpo_check_system_swapon = stub_check_system_swapon,
1559	.mpo_check_system_swapoff = stub_check_system_swapoff,
1560	.mpo_check_system_sysctl = stub_check_system_sysctl,
1561	.mpo_check_vnode_access = stub_check_vnode_access,
1562	.mpo_check_vnode_chdir = stub_check_vnode_chdir,
1563	.mpo_check_vnode_chroot = stub_check_vnode_chroot,
1564	.mpo_check_vnode_create = stub_check_vnode_create,
1565	.mpo_check_vnode_delete = stub_check_vnode_delete,
1566	.mpo_check_vnode_deleteacl = stub_check_vnode_deleteacl,
1567	.mpo_check_vnode_deleteextattr = stub_check_vnode_deleteextattr,
1568	.mpo_check_vnode_exec = stub_check_vnode_exec,
1569	.mpo_check_vnode_getacl = stub_check_vnode_getacl,
1570	.mpo_check_vnode_getextattr = stub_check_vnode_getextattr,
1571	.mpo_check_vnode_link = stub_check_vnode_link,
1572	.mpo_check_vnode_listextattr = stub_check_vnode_listextattr,
1573	.mpo_check_vnode_lookup = stub_check_vnode_lookup,
1574	.mpo_check_vnode_mmap = stub_check_vnode_mmap,
1575	.mpo_check_vnode_open = stub_check_vnode_open,
1576	.mpo_check_vnode_poll = stub_check_vnode_poll,
1577	.mpo_check_vnode_read = stub_check_vnode_read,
1578	.mpo_check_vnode_readdir = stub_check_vnode_readdir,
1579	.mpo_check_vnode_readlink = stub_check_vnode_readlink,
1580	.mpo_check_vnode_relabel = stub_check_vnode_relabel,
1581	.mpo_check_vnode_rename_from = stub_check_vnode_rename_from,
1582	.mpo_check_vnode_rename_to = stub_check_vnode_rename_to,
1583	.mpo_check_vnode_revoke = stub_check_vnode_revoke,
1584	.mpo_check_vnode_setacl = stub_check_vnode_setacl,
1585	.mpo_check_vnode_setextattr = stub_check_vnode_setextattr,
1586	.mpo_check_vnode_setflags = stub_check_vnode_setflags,
1587	.mpo_check_vnode_setmode = stub_check_vnode_setmode,
1588	.mpo_check_vnode_setowner = stub_check_vnode_setowner,
1589	.mpo_check_vnode_setutimes = stub_check_vnode_setutimes,
1590	.mpo_check_vnode_stat = stub_check_vnode_stat,
1591	.mpo_check_vnode_write = stub_check_vnode_write,
1592	.mpo_priv_check = stub_priv_check,
1593	.mpo_priv_grant = stub_priv_grant,
1594};
1595
1596MAC_POLICY_SET(&mac_stub_ops, mac_stub, "TrustedBSD MAC/Stub",
1597    MPC_LOADTIME_FLAG_UNLOADOK, NULL);
1598