mac_framework.h revision 145855
1100978Srwatson/*- 2126097Srwatson * Copyright (c) 1999-2002 Robert N. M. Watson 3145167Srwatson * Copyright (c) 2001-2005 Networks Associates Technology, Inc. 4100978Srwatson * All rights reserved. 5100978Srwatson * 6100978Srwatson * This software was developed by Robert Watson for the TrustedBSD Project. 7100978Srwatson * 8106392Srwatson * This software was developed for the FreeBSD Project in part by Network 9106392Srwatson * Associates Laboratories, the Security Research Division of Network 10106392Srwatson * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), 11106392Srwatson * as part of the DARPA CHATS research program. 12100978Srwatson * 13100978Srwatson * Redistribution and use in source and binary forms, with or without 14100978Srwatson * modification, are permitted provided that the following conditions 15100978Srwatson * are met: 16100978Srwatson * 1. Redistributions of source code must retain the above copyright 17100978Srwatson * notice, this list of conditions and the following disclaimer. 18100978Srwatson * 2. Redistributions in binary form must reproduce the above copyright 19100978Srwatson * notice, this list of conditions and the following disclaimer in the 20100978Srwatson * documentation and/or other materials provided with the distribution. 21100978Srwatson * 22100978Srwatson * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 23100978Srwatson * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 24100978Srwatson * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 25100978Srwatson * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 26100978Srwatson * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 27100978Srwatson * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 28100978Srwatson * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 29100978Srwatson * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 30100978Srwatson * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 31100978Srwatson * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 32100978Srwatson * SUCH DAMAGE. 33100978Srwatson * 34100978Srwatson * $FreeBSD: head/sys/security/mac/mac_framework.h 145855 2005-05-04 10:39:15Z rwatson $ 35100978Srwatson */ 36100978Srwatson/* 37100978Srwatson * Userland/kernel interface for Mandatory Access Control. 38100978Srwatson * 39100978Srwatson * The POSIX.1e implementation page may be reached at: 40100978Srwatson * http://www.trustedbsd.org/ 41100978Srwatson */ 42145167Srwatson 43129096Srwatson#ifndef _SYS_MAC_H_ 44129096Srwatson#define _SYS_MAC_H_ 45100978Srwatson 46101826Srwatson#include <sys/_label.h> 47101826Srwatson 48100978Srwatson#ifndef _POSIX_MAC 49100978Srwatson#define _POSIX_MAC 50100978Srwatson#endif 51100978Srwatson 52100978Srwatson/* 53102123Srwatson * MAC framework-related constants and limits. 54102123Srwatson */ 55105693Srwatson#define MAC_MAX_POLICY_NAME 32 56105693Srwatson#define MAC_MAX_LABEL_ELEMENT_NAME 32 57105693Srwatson#define MAC_MAX_LABEL_ELEMENT_DATA 4096 58105693Srwatson#define MAC_MAX_LABEL_BUF_LEN 8192 59102123Srwatson 60105693Srwatsonstruct mac { 61105693Srwatson size_t m_buflen; 62105693Srwatson char *m_string; 63105693Srwatson}; 64105693Srwatson 65105693Srwatsontypedef struct mac *mac_t; 66105693Srwatson 67105693Srwatson#ifndef _KERNEL 68105693Srwatson 69102123Srwatson/* 70105693Srwatson * Location of the userland MAC framework configuration file. mac.conf 71105693Srwatson * binds policy names to shared libraries that understand those policies, 72105693Srwatson * as well as setting defaults for MAC-aware applications. 73100978Srwatson */ 74105693Srwatson#define MAC_CONFFILE "/etc/mac.conf" 75100978Srwatson 76100978Srwatson/* 77105693Srwatson * Extended non-POSIX.1e interfaces that offer additional services 78105693Srwatson * available from the userland and kernel MAC frameworks. 79100978Srwatson */ 80120657Srwatson__BEGIN_DECLS 81119546Srwatsonint mac_execve(char *fname, char **argv, char **envv, mac_t _label); 82119546Srwatsonint mac_free(mac_t _label); 83119546Srwatsonint mac_from_text(mac_t *_label, const char *_text); 84119546Srwatsonint mac_get_fd(int _fd, mac_t _label); 85119546Srwatsonint mac_get_file(const char *_path, mac_t _label); 86119546Srwatsonint mac_get_link(const char *_path, mac_t _label); 87122810Srwatsonint mac_get_peer(int _fd, mac_t _label); 88119546Srwatsonint mac_get_pid(pid_t _pid, mac_t _label); 89119546Srwatsonint mac_get_proc(mac_t _label); 90119546Srwatsonint mac_is_present(const char *_policyname); 91119546Srwatsonint mac_prepare(mac_t *_label, const char *_elements); 92119546Srwatsonint mac_prepare_file_label(mac_t *_label); 93119546Srwatsonint mac_prepare_ifnet_label(mac_t *_label); 94119546Srwatsonint mac_prepare_process_label(mac_t *_label); 95119546Srwatsonint mac_prepare_type(mac_t *_label, const char *_type); 96119546Srwatsonint mac_set_fd(int _fildes, const mac_t _label); 97119546Srwatsonint mac_set_file(const char *_path, mac_t _label); 98119546Srwatsonint mac_set_link(const char *_path, mac_t _label); 99119546Srwatsonint mac_set_proc(const mac_t _label); 100119546Srwatsonint mac_syscall(const char *_policyname, int _call, void *_arg); 101119546Srwatsonint mac_to_text(mac_t mac, char **_text); 102120657Srwatson__END_DECLS 103105693Srwatson 104106093Srwatson#else /* _KERNEL */ 105105693Srwatson 106105693Srwatson/* 107100978Srwatson * Kernel functions to manage and evaluate labels. 108100978Srwatson */ 109100978Srwatsonstruct bpf_d; 110130585Sphkstruct cdev; 111100978Srwatsonstruct componentname; 112100978Srwatsonstruct devfs_dirent; 113100978Srwatsonstruct ifnet; 114100978Srwatsonstruct ifreq; 115122875Srwatsonstruct inpcb; 116106468Srwatsonstruct image_params; 117122875Srwatsonstruct inpcb; 118100978Srwatsonstruct ipq; 119145855Srwatsonstruct ksem; 120113487Srwatsonstruct m_tag; 121100978Srwatsonstruct mbuf; 122100978Srwatsonstruct mount; 123137815Srwatsonstruct msg; 124137815Srwatsonstruct msqid_kernel; 125100978Srwatsonstruct proc; 126137815Srwatsonstruct semid_kernel; 127137815Srwatsonstruct shmid_kernel; 128100978Srwatsonstruct sockaddr; 129100978Srwatsonstruct socket; 130126121Spjdstruct sysctl_oid; 131126121Spjdstruct sysctl_req; 132125293Srwatsonstruct pipepair; 133104338Srwatsonstruct thread; 134100978Srwatsonstruct timespec; 135100978Srwatsonstruct ucred; 136100978Srwatsonstruct uio; 137100978Srwatsonstruct vattr; 138100978Srwatsonstruct vnode; 139100978Srwatson 140100978Srwatson#include <sys/acl.h> /* XXX acl_type_t */ 141100978Srwatson 142100978Srwatsonstruct vop_setlabel_args; 143100978Srwatson 144100978Srwatson/* 145100978Srwatson * Label operations. 146100978Srwatson */ 147100978Srwatsonvoid mac_init_bpfdesc(struct bpf_d *); 148100978Srwatsonvoid mac_init_cred(struct ucred *); 149100978Srwatsonvoid mac_init_devfsdirent(struct devfs_dirent *); 150100978Srwatsonvoid mac_init_ifnet(struct ifnet *); 151122875Srwatsonint mac_init_inpcb(struct inpcb *, int flag); 152137815Srwatsonvoid mac_init_sysv_msgmsg(struct msg *); 153137815Srwatsonvoid mac_init_sysv_msgqueue(struct msqid_kernel*); 154137815Srwatsonvoid mac_init_sysv_sema(struct semid_kernel*); 155137815Srwatsonvoid mac_init_sysv_shm(struct shmid_kernel*); 156112675Srwatsonint mac_init_ipq(struct ipq *, int flag); 157104541Srwatsonint mac_init_socket(struct socket *, int flag); 158125293Srwatsonvoid mac_init_pipe(struct pipepair *); 159145855Srwatsonvoid mac_init_posix_sem(struct ksem *); 160113487Srwatsonint mac_init_mbuf(struct mbuf *mbuf, int flag); 161113487Srwatsonint mac_init_mbuf_tag(struct m_tag *, int flag); 162100978Srwatsonvoid mac_init_mount(struct mount *); 163107105Srwatsonvoid mac_init_proc(struct proc *); 164100978Srwatsonvoid mac_init_vnode(struct vnode *); 165113487Srwatsonvoid mac_copy_mbuf_tag(struct m_tag *, struct m_tag *); 166105988Srwatsonvoid mac_copy_vnode_label(struct label *, struct label *label); 167100978Srwatsonvoid mac_destroy_bpfdesc(struct bpf_d *); 168100978Srwatsonvoid mac_destroy_cred(struct ucred *); 169100978Srwatsonvoid mac_destroy_devfsdirent(struct devfs_dirent *); 170100978Srwatsonvoid mac_destroy_ifnet(struct ifnet *); 171122875Srwatsonvoid mac_destroy_inpcb(struct inpcb *); 172137815Srwatsonvoid mac_destroy_sysv_msgmsg(struct msg *); 173137815Srwatsonvoid mac_destroy_sysv_msgqueue(struct msqid_kernel *); 174137815Srwatsonvoid mac_destroy_sysv_sema(struct semid_kernel *); 175137815Srwatsonvoid mac_destroy_sysv_shm(struct shmid_kernel *); 176100978Srwatsonvoid mac_destroy_ipq(struct ipq *); 177100978Srwatsonvoid mac_destroy_socket(struct socket *); 178125293Srwatsonvoid mac_destroy_pipe(struct pipepair *); 179145855Srwatsonvoid mac_destroy_posix_sem(struct ksem *); 180107105Srwatsonvoid mac_destroy_proc(struct proc *); 181113487Srwatsonvoid mac_destroy_mbuf_tag(struct m_tag *); 182100978Srwatsonvoid mac_destroy_mount(struct mount *); 183100978Srwatsonvoid mac_destroy_vnode(struct vnode *); 184100978Srwatson 185122524Srwatsonstruct label *mac_cred_label_alloc(void); 186122524Srwatsonvoid mac_cred_label_free(struct label *label); 187122524Srwatsonstruct label *mac_vnode_label_alloc(void); 188122524Srwatsonvoid mac_vnode_label_free(struct label *label); 189122524Srwatson 190100978Srwatson/* 191100978Srwatson * Labeling event operations: file system objects, and things that 192100978Srwatson * look a lot like file system objects. 193100978Srwatson */ 194105988Srwatsonvoid mac_associate_vnode_devfs(struct mount *mp, struct devfs_dirent *de, 195105988Srwatson struct vnode *vp); 196105988Srwatsonint mac_associate_vnode_extattr(struct mount *mp, struct vnode *vp); 197105988Srwatsonvoid mac_associate_vnode_singlelabel(struct mount *mp, struct vnode *vp); 198130585Sphkvoid mac_create_devfs_device(struct mount *mp, struct cdev *dev, 199100978Srwatson struct devfs_dirent *de); 200107698Srwatsonvoid mac_create_devfs_directory(struct mount *mp, char *dirname, 201107698Srwatson int dirnamelen, struct devfs_dirent *de); 202107698Srwatsonvoid mac_create_devfs_symlink(struct ucred *cred, struct mount *mp, 203107698Srwatson struct devfs_dirent *dd, struct devfs_dirent *de); 204105988Srwatsonint mac_create_vnode_extattr(struct ucred *cred, struct mount *mp, 205105988Srwatson struct vnode *dvp, struct vnode *vp, struct componentname *cnp); 206100978Srwatsonvoid mac_create_mount(struct ucred *cred, struct mount *mp); 207100978Srwatsonvoid mac_create_root_mount(struct ucred *cred, struct mount *mp); 208100978Srwatsonvoid mac_relabel_vnode(struct ucred *cred, struct vnode *vp, 209100978Srwatson struct label *newlabel); 210107698Srwatsonvoid mac_update_devfsdirent(struct mount *mp, struct devfs_dirent *de, 211107698Srwatson struct vnode *vp); 212100978Srwatson 213100978Srwatson/* 214100978Srwatson * Labeling event operations: IPC objects. 215100978Srwatson */ 216100978Srwatsonvoid mac_create_mbuf_from_socket(struct socket *so, struct mbuf *m); 217100978Srwatsonvoid mac_create_socket(struct ucred *cred, struct socket *socket); 218100978Srwatsonvoid mac_create_socket_from_socket(struct socket *oldsocket, 219100978Srwatson struct socket *newsocket); 220100978Srwatsonvoid mac_set_socket_peer_from_mbuf(struct mbuf *mbuf, 221100978Srwatson struct socket *socket); 222100978Srwatsonvoid mac_set_socket_peer_from_socket(struct socket *oldsocket, 223100978Srwatson struct socket *newsocket); 224125293Srwatsonvoid mac_create_pipe(struct ucred *cred, struct pipepair *pp); 225100978Srwatson 226100978Srwatson/* 227137815Srwatson * Labeling event operations: System V IPC primitives 228137815Srwatson */ 229137815Srwatsonvoid mac_create_sysv_msgmsg(struct ucred *cred, 230137815Srwatson struct msqid_kernel *msqkptr, struct msg *msgptr); 231137815Srwatsonvoid mac_create_sysv_msgqueue(struct ucred *cred, 232137815Srwatson struct msqid_kernel *msqkptr); 233137815Srwatsonvoid mac_create_sysv_sema(struct ucred *cred, 234137815Srwatson struct semid_kernel *semakptr); 235137815Srwatsonvoid mac_create_sysv_shm(struct ucred *cred, 236137815Srwatson struct shmid_kernel *shmsegptr); 237137815Srwatson 238137815Srwatson/* 239145855Srwatson * Labeling event operations: POSIX (global/inter-process) semaphores. 240145855Srwatson */ 241145855Srwatsonvoid mac_create_posix_sem(struct ucred *cred, struct ksem *ksemptr); 242145855Srwatson 243145855Srwatson 244145855Srwatson/* 245100978Srwatson * Labeling event operations: network objects. 246100978Srwatson */ 247100978Srwatsonvoid mac_create_bpfdesc(struct ucred *cred, struct bpf_d *bpf_d); 248100978Srwatsonvoid mac_create_ifnet(struct ifnet *ifp); 249122875Srwatsonvoid mac_create_inpcb_from_socket(struct socket *so, struct inpcb *inp); 250100978Srwatsonvoid mac_create_ipq(struct mbuf *fragment, struct ipq *ipq); 251100978Srwatsonvoid mac_create_datagram_from_ipq(struct ipq *ipq, struct mbuf *datagram); 252100978Srwatsonvoid mac_create_fragment(struct mbuf *datagram, struct mbuf *fragment); 253123607Srwatsonvoid mac_create_mbuf_from_inpcb(struct inpcb *inp, struct mbuf *m); 254100978Srwatsonvoid mac_create_mbuf_from_mbuf(struct mbuf *oldmbuf, struct mbuf *newmbuf); 255100978Srwatsonvoid mac_create_mbuf_linklayer(struct ifnet *ifnet, struct mbuf *m); 256100978Srwatsonvoid mac_create_mbuf_from_bpfdesc(struct bpf_d *bpf_d, struct mbuf *m); 257100978Srwatsonvoid mac_create_mbuf_from_ifnet(struct ifnet *ifnet, struct mbuf *m); 258100978Srwatsonvoid mac_create_mbuf_multicast_encap(struct mbuf *oldmbuf, 259100978Srwatson struct ifnet *ifnet, struct mbuf *newmbuf); 260100978Srwatsonvoid mac_create_mbuf_netlayer(struct mbuf *oldmbuf, struct mbuf *newmbuf); 261100978Srwatsonint mac_fragment_match(struct mbuf *fragment, struct ipq *ipq); 262119244Srwatsonvoid mac_reflect_mbuf_icmp(struct mbuf *m); 263119244Srwatsonvoid mac_reflect_mbuf_tcp(struct mbuf *m); 264100978Srwatsonvoid mac_update_ipq(struct mbuf *fragment, struct ipq *ipq); 265122875Srwatsonvoid mac_inpcb_sosetlabel(struct socket *so, struct inpcb *inp); 266100978Srwatson 267100978Srwatson/* 268100978Srwatson * Labeling event operations: processes. 269100978Srwatson */ 270123173Srwatsonvoid mac_copy_cred(struct ucred *cr1, struct ucred *cr2); 271122524Srwatsonint mac_execve_enter(struct image_params *imgp, struct mac *mac_p); 272106468Srwatsonvoid mac_execve_exit(struct image_params *imgp); 273100978Srwatsonvoid mac_execve_transition(struct ucred *old, struct ucred *new, 274106468Srwatson struct vnode *vp, struct label *interpvnodelabel, 275106468Srwatson struct image_params *imgp); 276106468Srwatsonint mac_execve_will_transition(struct ucred *old, struct vnode *vp, 277106468Srwatson struct label *interpvnodelabel, struct image_params *imgp); 278100978Srwatsonvoid mac_create_proc0(struct ucred *cred); 279100978Srwatsonvoid mac_create_proc1(struct ucred *cred); 280104338Srwatsonvoid mac_thread_userret(struct thread *td); 281100978Srwatson 282137815Srwatson/* 283137815Srwatson * Label cleanup operation: This is the inverse complement for the 284137815Srwatson * mac_create and associate type of hooks. This hook lets the policy 285137815Srwatson * module(s) perform a cleanup/flushing operation on the label 286137815Srwatson * associated with the objects, without freeing up the space allocated. 287137815Srwatson * This hook is useful in cases where it is desirable to remove any 288137815Srwatson * labeling reference when recycling any object to a pool. This hook 289137815Srwatson * does not replace the mac_destroy hooks. 290137815Srwatson */ 291137815Srwatsonvoid mac_cleanup_sysv_msgmsg(struct msg *msgptr); 292137815Srwatsonvoid mac_cleanup_sysv_msgqueue(struct msqid_kernel *msqkptr); 293137815Srwatsonvoid mac_cleanup_sysv_sema(struct semid_kernel *semakptr); 294137815Srwatsonvoid mac_cleanup_sysv_shm(struct shmid_kernel *shmsegptr); 295137815Srwatson 296100978Srwatson/* Access control checks. */ 297100978Srwatsonint mac_check_bpfdesc_receive(struct bpf_d *bpf_d, struct ifnet *ifnet); 298100978Srwatsonint mac_check_cred_visible(struct ucred *u1, struct ucred *u2); 299100978Srwatsonint mac_check_ifnet_transmit(struct ifnet *ifnet, struct mbuf *m); 300122875Srwatsonint mac_check_inpcb_deliver(struct inpcb *inp, struct mbuf *m); 301137815Srwatsonint mac_check_sysv_msgmsq(struct ucred *cred, struct msg *msgptr, 302137815Srwatson struct msqid_kernel *msqkptr); 303137815Srwatsonint mac_check_sysv_msgrcv(struct ucred *cred, struct msg *msgptr); 304137815Srwatsonint mac_check_sysv_msgrmid(struct ucred *cred, struct msg *msgptr); 305137815Srwatsonint mac_check_sysv_msqget(struct ucred *cred, 306137815Srwatson struct msqid_kernel *msqkptr); 307137815Srwatsonint mac_check_sysv_msqsnd(struct ucred *cred, 308137815Srwatson struct msqid_kernel *msqkptr); 309137815Srwatsonint mac_check_sysv_msqrcv(struct ucred *cred, 310137815Srwatson struct msqid_kernel *msqkptr); 311137815Srwatsonint mac_check_sysv_msqctl(struct ucred *cred, 312137815Srwatson struct msqid_kernel *msqkptr, int cmd); 313137815Srwatsonint mac_check_sysv_semctl(struct ucred *cred, 314137815Srwatson struct semid_kernel *semakptr, int cmd); 315137815Srwatsonint mac_check_sysv_semget(struct ucred *cred, 316137815Srwatson struct semid_kernel *semakptr); 317137815Srwatsonint mac_check_sysv_semop(struct ucred *cred,struct semid_kernel *semakptr, 318137815Srwatson size_t accesstype); 319137815Srwatsonint mac_check_sysv_shmat(struct ucred *cred, 320137815Srwatson struct shmid_kernel *shmsegptr, int shmflg); 321137815Srwatsonint mac_check_sysv_shmctl(struct ucred *cred, 322137815Srwatson struct shmid_kernel *shmsegptr, int cmd); 323137815Srwatsonint mac_check_sysv_shmdt(struct ucred *cred, 324137815Srwatson struct shmid_kernel *shmsegptr); 325137815Srwatsonint mac_check_sysv_shmget(struct ucred *cred, 326137815Srwatson struct shmid_kernel *shmsegptr, int shmflg); 327106308Srwatsonint mac_check_kenv_dump(struct ucred *cred); 328106308Srwatsonint mac_check_kenv_get(struct ucred *cred, char *name); 329106308Srwatsonint mac_check_kenv_set(struct ucred *cred, char *name, char *value); 330106308Srwatsonint mac_check_kenv_unset(struct ucred *cred, char *name); 331107089Srwatsonint mac_check_kld_load(struct ucred *cred, struct vnode *vp); 332107089Srwatsonint mac_check_kld_stat(struct ucred *cred); 333107089Srwatsonint mac_check_kld_unload(struct ucred *cred); 334100978Srwatsonint mac_check_mount_stat(struct ucred *cred, struct mount *mp); 335125293Srwatsonint mac_check_pipe_ioctl(struct ucred *cred, struct pipepair *pp, 336100978Srwatson unsigned long cmd, void *data); 337125293Srwatsonint mac_check_pipe_poll(struct ucred *cred, struct pipepair *pp); 338125293Srwatsonint mac_check_pipe_read(struct ucred *cred, struct pipepair *pp); 339125293Srwatsonint mac_check_pipe_stat(struct ucred *cred, struct pipepair *pp); 340125293Srwatsonint mac_check_pipe_write(struct ucred *cred, struct pipepair *pp); 341145855Srwatsonint mac_check_posix_sem_destroy(struct ucred *cred, struct ksem *ksemptr); 342145855Srwatsonint mac_check_posix_sem_getvalue(struct ucred *cred,struct ksem *ksemptr); 343145855Srwatsonint mac_check_posix_sem_open(struct ucred *cred, struct ksem *ksemptr); 344145855Srwatsonint mac_check_posix_sem_post(struct ucred *cred, struct ksem *ksemptr); 345145855Srwatsonint mac_check_posix_sem_unlink(struct ucred *cred, struct ksem *ksemptr); 346145855Srwatsonint mac_check_posix_sem_wait(struct ucred *cred, struct ksem *ksemptr); 347100978Srwatsonint mac_check_proc_debug(struct ucred *cred, struct proc *proc); 348100978Srwatsonint mac_check_proc_sched(struct ucred *cred, struct proc *proc); 349145147Srwatsonint mac_check_proc_setuid(struct proc *proc, struct ucred *cred, 350145147Srwatson uid_t uid); 351145147Srwatsonint mac_check_proc_seteuid(struct proc *proc, struct ucred *cred, 352145147Srwatson uid_t euid); 353145147Srwatsonint mac_check_proc_setgid(struct proc *proc, struct ucred *cred, 354145147Srwatson gid_t gid); 355145147Srwatsonint mac_check_proc_setegid(struct proc *proc, struct ucred *cred, 356145147Srwatson gid_t egid); 357145147Srwatsonint mac_check_proc_setgroups(struct proc *proc, struct ucred *cred, 358145147Srwatson int ngroups, gid_t *gidset); 359145147Srwatsonint mac_check_proc_setreuid(struct proc *proc, struct ucred *cred, 360145147Srwatson uid_t ruid, uid_t euid); 361145147Srwatsonint mac_check_proc_setregid(struct proc *proc, struct ucred *cred, 362145147Srwatson gid_t rgid, gid_t egid); 363145147Srwatsonint mac_check_proc_setresuid(struct proc *proc, struct ucred *cred, 364145147Srwatson uid_t ruid, uid_t euid, uid_t suid); 365145147Srwatsonint mac_check_proc_setresgid(struct proc *proc, struct ucred *cred, 366145147Srwatson gid_t rgid, gid_t egid, gid_t sgid); 367100978Srwatsonint mac_check_proc_signal(struct ucred *cred, struct proc *proc, 368100978Srwatson int signum); 369145234Srwatsonint mac_check_proc_wait(struct ucred *cred, struct proc *proc); 370145167Srwatsonint mac_check_socket_accept(struct ucred *cred, struct socket *so); 371100978Srwatsonint mac_check_socket_bind(struct ucred *cred, struct socket *so, 372100978Srwatson struct sockaddr *sockaddr); 373100978Srwatsonint mac_check_socket_connect(struct ucred *cred, struct socket *so, 374100978Srwatson struct sockaddr *sockaddr); 375101934Srwatsonint mac_check_socket_deliver(struct socket *so, struct mbuf *m); 376100978Srwatsonint mac_check_socket_listen(struct ucred *cred, struct socket *so); 377145167Srwatsonint mac_check_socket_poll(struct ucred *cred, struct socket *so); 378104571Srwatsonint mac_check_socket_receive(struct ucred *cred, struct socket *so); 379104571Srwatsonint mac_check_socket_send(struct ucred *cred, struct socket *so); 380145167Srwatsonint mac_check_socket_stat(struct ucred *cred, struct socket *so); 381100978Srwatsonint mac_check_socket_visible(struct ucred *cred, struct socket *so); 382111939Srwatsonint mac_check_sysarch_ioperm(struct ucred *cred); 383106412Srwatsonint mac_check_system_acct(struct ucred *cred, struct vnode *vp); 384106412Srwatsonint mac_check_system_nfsd(struct ucred *cred); 385106024Srwatsonint mac_check_system_reboot(struct ucred *cred, int howto); 386106369Srwatsonint mac_check_system_settime(struct ucred *cred); 387106023Srwatsonint mac_check_system_swapon(struct ucred *cred, struct vnode *vp); 388111936Srwatsonint mac_check_system_swapoff(struct ucred *cred, struct vnode *vp); 389126121Spjdint mac_check_system_sysctl(struct ucred *cred, struct sysctl_oid *oidp, 390126121Spjd void *arg1, int arg2, struct sysctl_req *req); 391100978Srwatsonint mac_check_vnode_access(struct ucred *cred, struct vnode *vp, 392106212Srwatson int acc_mode); 393100978Srwatsonint mac_check_vnode_chdir(struct ucred *cred, struct vnode *dvp); 394100978Srwatsonint mac_check_vnode_chroot(struct ucred *cred, struct vnode *dvp); 395100978Srwatsonint mac_check_vnode_create(struct ucred *cred, struct vnode *dvp, 396100978Srwatson struct componentname *cnp, struct vattr *vap); 397100978Srwatsonint mac_check_vnode_delete(struct ucred *cred, struct vnode *dvp, 398100978Srwatson struct vnode *vp, struct componentname *cnp); 399100978Srwatsonint mac_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp, 400100978Srwatson acl_type_t type); 401119198Srwatsonint mac_check_vnode_deleteextattr(struct ucred *cred, struct vnode *vp, 402119198Srwatson int attrnamespace, const char *name); 403106468Srwatsonint mac_check_vnode_exec(struct ucred *cred, struct vnode *vp, 404106468Srwatson struct image_params *imgp); 405100978Srwatsonint mac_check_vnode_getacl(struct ucred *cred, struct vnode *vp, 406100978Srwatson acl_type_t type); 407100978Srwatsonint mac_check_vnode_getextattr(struct ucred *cred, struct vnode *vp, 408100978Srwatson int attrnamespace, const char *name, struct uio *uio); 409104529Srwatsonint mac_check_vnode_link(struct ucred *cred, struct vnode *dvp, 410104529Srwatson struct vnode *vp, struct componentname *cnp); 411119198Srwatsonint mac_check_vnode_listextattr(struct ucred *cred, struct vnode *vp, 412119198Srwatson int attrnamespace); 413100978Srwatsonint mac_check_vnode_lookup(struct ucred *cred, struct vnode *dvp, 414100978Srwatson struct componentname *cnp); 415104546Srwatsonint mac_check_vnode_mmap(struct ucred *cred, struct vnode *vp, 416145076Scsjp int prot, int flags); 417104546Srwatsonint mac_check_vnode_mprotect(struct ucred *cred, struct vnode *vp, 418104546Srwatson int prot); 419100978Srwatsonint mac_check_vnode_open(struct ucred *cred, struct vnode *vp, 420106212Srwatson int acc_mode); 421102129Srwatsonint mac_check_vnode_poll(struct ucred *active_cred, 422102129Srwatson struct ucred *file_cred, struct vnode *vp); 423102129Srwatsonint mac_check_vnode_read(struct ucred *active_cred, 424102129Srwatson struct ucred *file_cred, struct vnode *vp); 425100978Srwatsonint mac_check_vnode_readdir(struct ucred *cred, struct vnode *vp); 426100978Srwatsonint mac_check_vnode_readlink(struct ucred *cred, struct vnode *vp); 427100978Srwatsonint mac_check_vnode_rename_from(struct ucred *cred, struct vnode *dvp, 428100978Srwatson struct vnode *vp, struct componentname *cnp); 429100978Srwatsonint mac_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp, 430100978Srwatson struct vnode *vp, int samedir, struct componentname *cnp); 431100978Srwatsonint mac_check_vnode_revoke(struct ucred *cred, struct vnode *vp); 432100978Srwatsonint mac_check_vnode_setacl(struct ucred *cred, struct vnode *vp, 433100978Srwatson acl_type_t type, struct acl *acl); 434100978Srwatsonint mac_check_vnode_setextattr(struct ucred *cred, struct vnode *vp, 435100978Srwatson int attrnamespace, const char *name, struct uio *uio); 436100978Srwatsonint mac_check_vnode_setflags(struct ucred *cred, struct vnode *vp, 437100978Srwatson u_long flags); 438100978Srwatsonint mac_check_vnode_setmode(struct ucred *cred, struct vnode *vp, 439100978Srwatson mode_t mode); 440100978Srwatsonint mac_check_vnode_setowner(struct ucred *cred, struct vnode *vp, 441100978Srwatson uid_t uid, gid_t gid); 442100978Srwatsonint mac_check_vnode_setutimes(struct ucred *cred, struct vnode *vp, 443100978Srwatson struct timespec atime, struct timespec mtime); 444102129Srwatsonint mac_check_vnode_stat(struct ucred *active_cred, 445102129Srwatson struct ucred *file_cred, struct vnode *vp); 446102129Srwatsonint mac_check_vnode_write(struct ucred *active_cred, 447102129Srwatson struct ucred *file_cred, struct vnode *vp); 448122807Srwatsonint mac_getsockopt_label(struct ucred *cred, struct socket *so, 449100978Srwatson struct mac *extmac); 450122807Srwatsonint mac_getsockopt_peerlabel(struct ucred *cred, struct socket *so, 451100978Srwatson struct mac *extmac); 452100978Srwatsonint mac_ioctl_ifnet_get(struct ucred *cred, struct ifreq *ifr, 453100978Srwatson struct ifnet *ifnet); 454100978Srwatsonint mac_ioctl_ifnet_set(struct ucred *cred, struct ifreq *ifr, 455100978Srwatson struct ifnet *ifnet); 456122807Srwatsonint mac_setsockopt_label(struct ucred *cred, struct socket *so, 457100978Srwatson struct mac *extmac); 458125293Srwatsonint mac_pipe_label_set(struct ucred *cred, struct pipepair *pp, 459100978Srwatson struct label *label); 460107271Srwatsonvoid mac_cred_mmapped_drop_perms(struct thread *td, struct ucred *cred); 461100978Srwatson 462100978Srwatson/* 463100978Srwatson * Calls to help various file systems implement labeling functionality 464100978Srwatson * using their existing EA implementation. 465100978Srwatson */ 466100978Srwatsonint vop_stdsetlabel_ea(struct vop_setlabel_args *ap); 467100978Srwatson 468106093Srwatson#endif /* !_KERNEL */ 469100978Srwatson 470129096Srwatson#endif /* !_SYS_MAC_H_ */ 471