1 .\" Copyright (c) 2001, 2004 Networks Associates Technology, Inc.
2 .\" All rights reserved.
4 .\" This software was developed for the FreeBSD Project by Chris
5 .\" Costello at Safeport Network Services and NAI Labs, the Security
6 .\" Research Division of Network Associates, Inc. under DARPA/SPAWAR
7 .\" contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA CHATS
10 .\" Redistribution and use in source and binary forms, with or without
11 .\" modification, are permitted provided that the following conditions
13 .\" 1. Redistributions of source code must retain the above copyright
14 .\" notice, this list of conditions and the following disclaimer.
15 .\" 2. Redistributions in binary form must reproduce the above copyright
16 .\" notice, this list of conditions and the following disclaimer in the
17 .\" documentation and/or other materials provided with the distribution.
19 .\" THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND
20 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22 .\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
23 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
43 .Nd get the label of a file, socket, socket peer or process
49 .Fn mac_get_file "const char *path" "mac_t label"
51 .Fn mac_get_link "const char *path" "mac_t label"
53 .Fn mac_get_fd "int fd" "mac_t label"
55 .Fn mac_get_peer "int fd" "mac_t label"
57 .Fn mac_get_pid "pid_t pid" "mac_t label"
59 .Fn mac_get_proc "mac_t label"
63 system call returns the label associated with a file specified by
67 function is the same as
69 except that it does not follow symlinks.
73 system call returns the label associated with an object referenced by
74 the specified file descriptor.
75 Note that in the case of a file system socket, the label returned will
76 be the socket label, which may be different from the label of the
77 on-disk node acting as a rendezvous for the socket.
80 system call returns the label associated with the remote endpoint of
81 a socket; the exact semantics of this call will depend on the protocol
82 domain, communications type, and endpoint; typically this label will
83 be cached when a connection-oriented protocol instance is first set up,
84 and is undefined for datagram protocols.
90 system calls return the process label associated with an arbitrary
91 process ID, or the current process.
93 Label storage for use with these calls must first be allocated and
97 When an application is done using a label, the memory may be returned
106 or MAC read access to the file
109 The requested label operation is not valid for the object referenced by
111 .It Bq Er ENAMETOOLONG
112 The pathname pointed to by
116 or a component of the pathname exceeds
123 Insufficient memory is available
124 to allocate a new MAC label structure.
140 POSIX.1e is described in IEEE POSIX.1e draft 17.
141 Discussion of the draft
142 continues on the cross-platform POSIX.1e implementation mailing list.
143 To join this list, see the
145 POSIX.1e implementation page
146 for more information.
148 Support for Mandatory Access Control was introduced in