2 * Copyright (c) 1999-2002 Robert N. M. Watson
3 * Copyright (c) 2001-2005 McAfee, Inc.
6 * This software was developed by Robert Watson for the TrustedBSD Project.
8 * This software was developed for the FreeBSD Project in part by McAfee
9 * Research, the Security Research Division of McAfee, Inc. under
10 * DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA
11 * CHATS research program.
13 * Redistribution and use in source and binary forms, with or without
14 * modification, are permitted provided that the following conditions
16 * 1. Redistributions of source code must retain the above copyright
17 * notice, this list of conditions and the following disclaimer.
18 * 2. Redistributions in binary form must reproduce the above copyright
19 * notice, this list of conditions and the following disclaimer in the
20 * documentation and/or other materials provided with the distribution.
22 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
23 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
26 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
38 * Developed by the TrustedBSD Project.
40 * MLS fixed label mandatory confidentiality policy.
43 #include <sys/types.h>
44 #include <sys/param.h>
47 #include <sys/extattr.h>
48 #include <sys/kernel.h>
51 #include <sys/malloc.h>
52 #include <sys/mount.h>
55 #include <sys/systm.h>
56 #include <sys/sysproto.h>
57 #include <sys/sysent.h>
58 #include <sys/systm.h>
59 #include <sys/vnode.h>
61 #include <sys/socket.h>
62 #include <sys/socketvar.h>
65 #include <sys/sysctl.h>
70 #include <fs/devfs/devfs.h>
72 #include <net/bpfdesc.h>
74 #include <net/if_types.h>
75 #include <net/if_var.h>
77 #include <netinet/in.h>
78 #include <netinet/in_pcb.h>
79 #include <netinet/ip_var.h>
84 #include <security/mac/mac_policy.h>
85 #include <security/mac_mls/mac_mls.h>
87 SYSCTL_DECL(_security_mac);
89 SYSCTL_NODE(_security_mac, OID_AUTO, mls, CTLFLAG_RW, 0,
90 "TrustedBSD mac_mls policy controls");
92 static int mls_label_size = sizeof(struct mac_mls);
93 SYSCTL_INT(_security_mac_mls, OID_AUTO, label_size, CTLFLAG_RD,
94 &mls_label_size, 0, "Size of struct mac_mls");
96 static int mls_enabled = 1;
97 SYSCTL_INT(_security_mac_mls, OID_AUTO, enabled, CTLFLAG_RW, &mls_enabled, 0,
98 "Enforce MAC/MLS policy");
99 TUNABLE_INT("security.mac.mls.enabled", &mls_enabled);
101 static int destroyed_not_inited;
102 SYSCTL_INT(_security_mac_mls, OID_AUTO, destroyed_not_inited, CTLFLAG_RD,
103 &destroyed_not_inited, 0, "Count of labels destroyed but not inited");
105 static int ptys_equal = 0;
106 SYSCTL_INT(_security_mac_mls, OID_AUTO, ptys_equal, CTLFLAG_RW,
107 &ptys_equal, 0, "Label pty devices as mls/equal on create");
108 TUNABLE_INT("security.mac.mls.ptys_equal", &ptys_equal);
110 static int revocation_enabled = 0;
111 SYSCTL_INT(_security_mac_mls, OID_AUTO, revocation_enabled, CTLFLAG_RW,
112 &revocation_enabled, 0, "Revoke access to objects on relabel");
113 TUNABLE_INT("security.mac.mls.revocation_enabled", &revocation_enabled);
115 static int max_compartments = MAC_MLS_MAX_COMPARTMENTS;
116 SYSCTL_INT(_security_mac_mls, OID_AUTO, max_compartments, CTLFLAG_RD,
117 &max_compartments, 0, "Maximum compartments the policy supports");
120 #define SLOT(l) ((struct mac_mls *)mac_label_get((l), mls_slot))
121 #define SLOT_SET(l, val) mac_label_set((l), mls_slot, (uintptr_t)(val))
123 static uma_zone_t zone_mls;
126 mls_bit_set_empty(u_char *set) {
129 for (i = 0; i < MAC_MLS_MAX_COMPARTMENTS >> 3; i++)
135 static struct mac_mls *
139 return (uma_zalloc(zone_mls, flag | M_ZERO));
143 mls_free(struct mac_mls *mm)
147 uma_zfree(zone_mls, mm);
149 atomic_add_int(&destroyed_not_inited, 1);
153 mls_atmostflags(struct mac_mls *mm, int flags)
156 if ((mm->mm_flags & flags) != mm->mm_flags)
162 mls_dominate_element(struct mac_mls_element *a, struct mac_mls_element *b)
166 switch (a->mme_type) {
167 case MAC_MLS_TYPE_EQUAL:
168 case MAC_MLS_TYPE_HIGH:
171 case MAC_MLS_TYPE_LOW:
172 switch (b->mme_type) {
173 case MAC_MLS_TYPE_LEVEL:
174 case MAC_MLS_TYPE_HIGH:
177 case MAC_MLS_TYPE_EQUAL:
178 case MAC_MLS_TYPE_LOW:
182 panic("mls_dominate_element: b->mme_type invalid");
185 case MAC_MLS_TYPE_LEVEL:
186 switch (b->mme_type) {
187 case MAC_MLS_TYPE_EQUAL:
188 case MAC_MLS_TYPE_LOW:
191 case MAC_MLS_TYPE_HIGH:
194 case MAC_MLS_TYPE_LEVEL:
195 for (bit = 1; bit <= MAC_MLS_MAX_COMPARTMENTS; bit++)
196 if (!MAC_MLS_BIT_TEST(bit,
197 a->mme_compartments) &&
198 MAC_MLS_BIT_TEST(bit, b->mme_compartments))
200 return (a->mme_level >= b->mme_level);
203 panic("mls_dominate_element: b->mme_type invalid");
207 panic("mls_dominate_element: a->mme_type invalid");
214 mls_range_in_range(struct mac_mls *rangea, struct mac_mls *rangeb)
217 return (mls_dominate_element(&rangeb->mm_rangehigh,
218 &rangea->mm_rangehigh) &&
219 mls_dominate_element(&rangea->mm_rangelow,
220 &rangeb->mm_rangelow));
224 mls_effective_in_range(struct mac_mls *effective, struct mac_mls *range)
227 KASSERT((effective->mm_flags & MAC_MLS_FLAG_EFFECTIVE) != 0,
228 ("mls_effective_in_range: a not effective"));
229 KASSERT((range->mm_flags & MAC_MLS_FLAG_RANGE) != 0,
230 ("mls_effective_in_range: b not range"));
232 return (mls_dominate_element(&range->mm_rangehigh,
233 &effective->mm_effective) &&
234 mls_dominate_element(&effective->mm_effective,
235 &range->mm_rangelow));
241 mls_dominate_effective(struct mac_mls *a, struct mac_mls *b)
243 KASSERT((a->mm_flags & MAC_MLS_FLAG_EFFECTIVE) != 0,
244 ("mls_dominate_effective: a not effective"));
245 KASSERT((b->mm_flags & MAC_MLS_FLAG_EFFECTIVE) != 0,
246 ("mls_dominate_effective: b not effective"));
248 return (mls_dominate_element(&a->mm_effective, &b->mm_effective));
252 mls_equal_element(struct mac_mls_element *a, struct mac_mls_element *b)
255 if (a->mme_type == MAC_MLS_TYPE_EQUAL ||
256 b->mme_type == MAC_MLS_TYPE_EQUAL)
259 return (a->mme_type == b->mme_type && a->mme_level == b->mme_level);
263 mls_equal_effective(struct mac_mls *a, struct mac_mls *b)
266 KASSERT((a->mm_flags & MAC_MLS_FLAG_EFFECTIVE) != 0,
267 ("mls_equal_effective: a not effective"));
268 KASSERT((b->mm_flags & MAC_MLS_FLAG_EFFECTIVE) != 0,
269 ("mls_equal_effective: b not effective"));
271 return (mls_equal_element(&a->mm_effective, &b->mm_effective));
275 mls_contains_equal(struct mac_mls *mm)
278 if (mm->mm_flags & MAC_MLS_FLAG_EFFECTIVE)
279 if (mm->mm_effective.mme_type == MAC_MLS_TYPE_EQUAL)
282 if (mm->mm_flags & MAC_MLS_FLAG_RANGE) {
283 if (mm->mm_rangelow.mme_type == MAC_MLS_TYPE_EQUAL)
285 if (mm->mm_rangehigh.mme_type == MAC_MLS_TYPE_EQUAL)
293 mls_subject_privileged(struct mac_mls *mm)
296 KASSERT((mm->mm_flags & MAC_MLS_FLAGS_BOTH) == MAC_MLS_FLAGS_BOTH,
297 ("mls_subject_privileged: subject doesn't have both labels"));
299 /* If the effective is EQUAL, it's ok. */
300 if (mm->mm_effective.mme_type == MAC_MLS_TYPE_EQUAL)
303 /* If either range endpoint is EQUAL, it's ok. */
304 if (mm->mm_rangelow.mme_type == MAC_MLS_TYPE_EQUAL ||
305 mm->mm_rangehigh.mme_type == MAC_MLS_TYPE_EQUAL)
308 /* If the range is low-high, it's ok. */
309 if (mm->mm_rangelow.mme_type == MAC_MLS_TYPE_LOW &&
310 mm->mm_rangehigh.mme_type == MAC_MLS_TYPE_HIGH)
318 mls_valid(struct mac_mls *mm)
321 if (mm->mm_flags & MAC_MLS_FLAG_EFFECTIVE) {
322 switch (mm->mm_effective.mme_type) {
323 case MAC_MLS_TYPE_LEVEL:
326 case MAC_MLS_TYPE_EQUAL:
327 case MAC_MLS_TYPE_HIGH:
328 case MAC_MLS_TYPE_LOW:
329 if (mm->mm_effective.mme_level != 0 ||
330 !MAC_MLS_BIT_SET_EMPTY(
331 mm->mm_effective.mme_compartments))
339 if (mm->mm_effective.mme_type != MAC_MLS_TYPE_UNDEF)
343 if (mm->mm_flags & MAC_MLS_FLAG_RANGE) {
344 switch (mm->mm_rangelow.mme_type) {
345 case MAC_MLS_TYPE_LEVEL:
348 case MAC_MLS_TYPE_EQUAL:
349 case MAC_MLS_TYPE_HIGH:
350 case MAC_MLS_TYPE_LOW:
351 if (mm->mm_rangelow.mme_level != 0 ||
352 !MAC_MLS_BIT_SET_EMPTY(
353 mm->mm_rangelow.mme_compartments))
361 switch (mm->mm_rangehigh.mme_type) {
362 case MAC_MLS_TYPE_LEVEL:
365 case MAC_MLS_TYPE_EQUAL:
366 case MAC_MLS_TYPE_HIGH:
367 case MAC_MLS_TYPE_LOW:
368 if (mm->mm_rangehigh.mme_level != 0 ||
369 !MAC_MLS_BIT_SET_EMPTY(
370 mm->mm_rangehigh.mme_compartments))
377 if (!mls_dominate_element(&mm->mm_rangehigh,
381 if (mm->mm_rangelow.mme_type != MAC_MLS_TYPE_UNDEF ||
382 mm->mm_rangehigh.mme_type != MAC_MLS_TYPE_UNDEF)
390 mls_set_range(struct mac_mls *mm, u_short typelow, u_short levellow,
391 u_char *compartmentslow, u_short typehigh, u_short levelhigh,
392 u_char *compartmentshigh)
395 mm->mm_rangelow.mme_type = typelow;
396 mm->mm_rangelow.mme_level = levellow;
397 if (compartmentslow != NULL)
398 memcpy(mm->mm_rangelow.mme_compartments, compartmentslow,
399 sizeof(mm->mm_rangelow.mme_compartments));
400 mm->mm_rangehigh.mme_type = typehigh;
401 mm->mm_rangehigh.mme_level = levelhigh;
402 if (compartmentshigh != NULL)
403 memcpy(mm->mm_rangehigh.mme_compartments, compartmentshigh,
404 sizeof(mm->mm_rangehigh.mme_compartments));
405 mm->mm_flags |= MAC_MLS_FLAG_RANGE;
409 mls_set_effective(struct mac_mls *mm, u_short type, u_short level,
410 u_char *compartments)
413 mm->mm_effective.mme_type = type;
414 mm->mm_effective.mme_level = level;
415 if (compartments != NULL)
416 memcpy(mm->mm_effective.mme_compartments, compartments,
417 sizeof(mm->mm_effective.mme_compartments));
418 mm->mm_flags |= MAC_MLS_FLAG_EFFECTIVE;
422 mls_copy_range(struct mac_mls *labelfrom, struct mac_mls *labelto)
425 KASSERT((labelfrom->mm_flags & MAC_MLS_FLAG_RANGE) != 0,
426 ("mls_copy_range: labelfrom not range"));
428 labelto->mm_rangelow = labelfrom->mm_rangelow;
429 labelto->mm_rangehigh = labelfrom->mm_rangehigh;
430 labelto->mm_flags |= MAC_MLS_FLAG_RANGE;
434 mls_copy_effective(struct mac_mls *labelfrom, struct mac_mls *labelto)
437 KASSERT((labelfrom->mm_flags & MAC_MLS_FLAG_EFFECTIVE) != 0,
438 ("mls_copy_effective: labelfrom not effective"));
440 labelto->mm_effective = labelfrom->mm_effective;
441 labelto->mm_flags |= MAC_MLS_FLAG_EFFECTIVE;
445 mls_copy(struct mac_mls *source, struct mac_mls *dest)
448 if (source->mm_flags & MAC_MLS_FLAG_EFFECTIVE)
449 mls_copy_effective(source, dest);
450 if (source->mm_flags & MAC_MLS_FLAG_RANGE)
451 mls_copy_range(source, dest);
455 * Policy module operations.
458 mls_init(struct mac_policy_conf *conf)
461 zone_mls = uma_zcreate("mac_mls", sizeof(struct mac_mls), NULL,
462 NULL, NULL, NULL, UMA_ALIGN_PTR, 0);
469 mls_init_label(struct label *label)
472 SLOT_SET(label, mls_alloc(M_WAITOK));
476 mls_init_label_waitcheck(struct label *label, int flag)
479 SLOT_SET(label, mls_alloc(flag));
480 if (SLOT(label) == NULL)
487 mls_destroy_label(struct label *label)
490 mls_free(SLOT(label));
491 SLOT_SET(label, NULL);
495 * mls_element_to_string() accepts an sbuf and MLS element. It converts the
496 * MLS element to a string and stores the result in the sbuf; if there isn't
497 * space in the sbuf, -1 is returned.
500 mls_element_to_string(struct sbuf *sb, struct mac_mls_element *element)
504 switch (element->mme_type) {
505 case MAC_MLS_TYPE_HIGH:
506 return (sbuf_printf(sb, "high"));
508 case MAC_MLS_TYPE_LOW:
509 return (sbuf_printf(sb, "low"));
511 case MAC_MLS_TYPE_EQUAL:
512 return (sbuf_printf(sb, "equal"));
514 case MAC_MLS_TYPE_LEVEL:
515 if (sbuf_printf(sb, "%d", element->mme_level) == -1)
519 for (i = 1; i <= MAC_MLS_MAX_COMPARTMENTS; i++) {
520 if (MAC_MLS_BIT_TEST(i, element->mme_compartments)) {
522 if (sbuf_putc(sb, ':') == -1)
524 if (sbuf_printf(sb, "%d", i) == -1)
528 if (sbuf_printf(sb, "+%d", i) == -1)
536 panic("mls_element_to_string: invalid type (%d)",
542 * mls_to_string() converts an MLS label to a string, and places the results
543 * in the passed sbuf. It returns 0 on success, or EINVAL if there isn't
544 * room in the sbuf. Note: the sbuf will be modified even in a failure case,
545 * so the caller may need to revert the sbuf by restoring the offset if
549 mls_to_string(struct sbuf *sb, struct mac_mls *mm)
552 if (mm->mm_flags & MAC_MLS_FLAG_EFFECTIVE) {
553 if (mls_element_to_string(sb, &mm->mm_effective) == -1)
557 if (mm->mm_flags & MAC_MLS_FLAG_RANGE) {
558 if (sbuf_putc(sb, '(') == -1)
561 if (mls_element_to_string(sb, &mm->mm_rangelow) == -1)
564 if (sbuf_putc(sb, '-') == -1)
567 if (mls_element_to_string(sb, &mm->mm_rangehigh) == -1)
570 if (sbuf_putc(sb, ')') == -1)
578 mls_externalize_label(struct label *label, char *element_name,
579 struct sbuf *sb, int *claimed)
583 if (strcmp(MAC_MLS_LABEL_NAME, element_name) != 0)
590 return (mls_to_string(sb, mm));
594 mls_parse_element(struct mac_mls_element *element, char *string)
596 char *compartment, *end, *level;
599 if (strcmp(string, "high") == 0 || strcmp(string, "hi") == 0) {
600 element->mme_type = MAC_MLS_TYPE_HIGH;
601 element->mme_level = MAC_MLS_TYPE_UNDEF;
602 } else if (strcmp(string, "low") == 0 || strcmp(string, "lo") == 0) {
603 element->mme_type = MAC_MLS_TYPE_LOW;
604 element->mme_level = MAC_MLS_TYPE_UNDEF;
605 } else if (strcmp(string, "equal") == 0 ||
606 strcmp(string, "eq") == 0) {
607 element->mme_type = MAC_MLS_TYPE_EQUAL;
608 element->mme_level = MAC_MLS_TYPE_UNDEF;
610 element->mme_type = MAC_MLS_TYPE_LEVEL;
613 * Numeric level piece of the element.
615 level = strsep(&string, ":");
616 value = strtol(level, &end, 10);
617 if (end == level || *end != '\0')
619 if (value < 0 || value > 65535)
621 element->mme_level = value;
624 * Optional compartment piece of the element. If none are
625 * included, we assume that the label has no compartments.
632 while ((compartment = strsep(&string, "+")) != NULL) {
633 value = strtol(compartment, &end, 10);
634 if (compartment == end || *end != '\0')
636 if (value < 1 || value > MAC_MLS_MAX_COMPARTMENTS)
638 MAC_MLS_BIT_SET(value, element->mme_compartments);
646 * Note: destructively consumes the string, make a local copy before calling
647 * if that's a problem.
650 mls_parse(struct mac_mls *mm, char *string)
652 char *rangehigh, *rangelow, *effective;
655 effective = strsep(&string, "(");
656 if (*effective == '\0')
659 if (string != NULL) {
660 rangelow = strsep(&string, "-");
663 rangehigh = strsep(&string, ")");
673 KASSERT((rangelow != NULL && rangehigh != NULL) ||
674 (rangelow == NULL && rangehigh == NULL),
675 ("mls_parse: range mismatch"));
677 bzero(mm, sizeof(*mm));
678 if (effective != NULL) {
679 error = mls_parse_element(&mm->mm_effective, effective);
682 mm->mm_flags |= MAC_MLS_FLAG_EFFECTIVE;
685 if (rangelow != NULL) {
686 error = mls_parse_element(&mm->mm_rangelow, rangelow);
689 error = mls_parse_element(&mm->mm_rangehigh, rangehigh);
692 mm->mm_flags |= MAC_MLS_FLAG_RANGE;
695 error = mls_valid(mm);
703 mls_internalize_label(struct label *label, char *element_name,
704 char *element_data, int *claimed)
706 struct mac_mls *mm, mm_temp;
709 if (strcmp(MAC_MLS_LABEL_NAME, element_name) != 0)
714 error = mls_parse(&mm_temp, element_data);
725 mls_copy_label(struct label *src, struct label *dest)
728 *SLOT(dest) = *SLOT(src);
732 * Labeling event operations: file system objects, and things that look a lot
733 * like file system objects.
736 mls_create_devfs_device(struct ucred *cred, struct mount *mp,
737 struct cdev *dev, struct devfs_dirent *de, struct label *delabel)
743 if (strcmp(dev->si_name, "null") == 0 ||
744 strcmp(dev->si_name, "zero") == 0 ||
745 strcmp(dev->si_name, "random") == 0 ||
746 strncmp(dev->si_name, "fd/", strlen("fd/")) == 0)
747 mls_type = MAC_MLS_TYPE_EQUAL;
748 else if (strcmp(dev->si_name, "kmem") == 0 ||
749 strcmp(dev->si_name, "mem") == 0)
750 mls_type = MAC_MLS_TYPE_HIGH;
751 else if (ptys_equal &&
752 (strncmp(dev->si_name, "ttyp", strlen("ttyp")) == 0 ||
753 strncmp(dev->si_name, "ptyp", strlen("ptyp")) == 0))
754 mls_type = MAC_MLS_TYPE_EQUAL;
756 mls_type = MAC_MLS_TYPE_LOW;
757 mls_set_effective(mm, mls_type, 0, NULL);
761 mls_create_devfs_directory(struct mount *mp, char *dirname, int dirnamelen,
762 struct devfs_dirent *de, struct label *delabel)
767 mls_set_effective(mm, MAC_MLS_TYPE_LOW, 0, NULL);
771 mls_create_devfs_symlink(struct ucred *cred, struct mount *mp,
772 struct devfs_dirent *dd, struct label *ddlabel, struct devfs_dirent *de,
773 struct label *delabel)
775 struct mac_mls *source, *dest;
777 source = SLOT(cred->cr_label);
778 dest = SLOT(delabel);
780 mls_copy_effective(source, dest);
784 mls_create_mount(struct ucred *cred, struct mount *mp, struct label *mplabel)
786 struct mac_mls *source, *dest;
788 source = SLOT(cred->cr_label);
789 dest = SLOT(mplabel);
791 mls_copy_effective(source, dest);
795 mls_relabel_vnode(struct ucred *cred, struct vnode *vp,
796 struct label *vplabel, struct label *label)
798 struct mac_mls *source, *dest;
800 source = SLOT(label);
801 dest = SLOT(vplabel);
803 mls_copy(source, dest);
807 mls_update_devfs(struct mount *mp, struct devfs_dirent *de,
808 struct label *delabel, struct vnode *vp, struct label *vplabel)
810 struct mac_mls *source, *dest;
812 source = SLOT(vplabel);
813 dest = SLOT(delabel);
815 mls_copy_effective(source, dest);
819 mls_associate_vnode_devfs(struct mount *mp, struct label *mplabel,
820 struct devfs_dirent *de, struct label *delabel, struct vnode *vp,
821 struct label *vplabel)
823 struct mac_mls *source, *dest;
825 source = SLOT(delabel);
826 dest = SLOT(vplabel);
828 mls_copy_effective(source, dest);
832 mls_associate_vnode_extattr(struct mount *mp, struct label *mplabel,
833 struct vnode *vp, struct label *vplabel)
835 struct mac_mls temp, *source, *dest;
838 source = SLOT(mplabel);
839 dest = SLOT(vplabel);
841 buflen = sizeof(temp);
842 bzero(&temp, buflen);
844 error = vn_extattr_get(vp, IO_NODELOCKED, MAC_MLS_EXTATTR_NAMESPACE,
845 MAC_MLS_EXTATTR_NAME, &buflen, (char *) &temp, curthread);
846 if (error == ENOATTR || error == EOPNOTSUPP) {
847 /* Fall back to the mntlabel. */
848 mls_copy_effective(source, dest);
853 if (buflen != sizeof(temp)) {
854 printf("mls_associate_vnode_extattr: bad size %d\n",
858 if (mls_valid(&temp) != 0) {
859 printf("mls_associate_vnode_extattr: invalid\n");
862 if ((temp.mm_flags & MAC_MLS_FLAGS_BOTH) != MAC_MLS_FLAG_EFFECTIVE) {
863 printf("mls_associated_vnode_extattr: not effective\n");
867 mls_copy_effective(&temp, dest);
872 mls_associate_vnode_singlelabel(struct mount *mp, struct label *mplabel,
873 struct vnode *vp, struct label *vplabel)
875 struct mac_mls *source, *dest;
877 source = SLOT(mplabel);
878 dest = SLOT(vplabel);
880 mls_copy_effective(source, dest);
884 mls_create_vnode_extattr(struct ucred *cred, struct mount *mp,
885 struct label *mplabel, struct vnode *dvp, struct label *dvplabel,
886 struct vnode *vp, struct label *vplabel, struct componentname *cnp)
888 struct mac_mls *source, *dest, temp;
892 buflen = sizeof(temp);
893 bzero(&temp, buflen);
895 source = SLOT(cred->cr_label);
896 dest = SLOT(vplabel);
897 mls_copy_effective(source, &temp);
899 error = vn_extattr_set(vp, IO_NODELOCKED, MAC_MLS_EXTATTR_NAMESPACE,
900 MAC_MLS_EXTATTR_NAME, buflen, (char *) &temp, curthread);
902 mls_copy_effective(source, dest);
907 mls_setlabel_vnode_extattr(struct ucred *cred, struct vnode *vp,
908 struct label *vplabel, struct label *intlabel)
910 struct mac_mls *source, temp;
914 buflen = sizeof(temp);
915 bzero(&temp, buflen);
917 source = SLOT(intlabel);
918 if ((source->mm_flags & MAC_MLS_FLAG_EFFECTIVE) == 0)
921 mls_copy_effective(source, &temp);
923 error = vn_extattr_set(vp, IO_NODELOCKED, MAC_MLS_EXTATTR_NAMESPACE,
924 MAC_MLS_EXTATTR_NAME, buflen, (char *) &temp, curthread);
929 * Labeling event operations: IPC object.
932 mls_create_inpcb_from_socket(struct socket *so, struct label *solabel,
933 struct inpcb *inp, struct label *inplabel)
935 struct mac_mls *source, *dest;
937 source = SLOT(solabel);
938 dest = SLOT(inplabel);
940 mls_copy_effective(source, dest);
944 mls_create_mbuf_from_socket(struct socket *so, struct label *solabel,
945 struct mbuf *m, struct label *mlabel)
947 struct mac_mls *source, *dest;
949 source = SLOT(solabel);
952 mls_copy_effective(source, dest);
956 mls_create_socket(struct ucred *cred, struct socket *so,
957 struct label *solabel)
959 struct mac_mls *source, *dest;
961 source = SLOT(cred->cr_label);
962 dest = SLOT(solabel);
964 mls_copy_effective(source, dest);
968 mls_create_pipe(struct ucred *cred, struct pipepair *pp,
969 struct label *pplabel)
971 struct mac_mls *source, *dest;
973 source = SLOT(cred->cr_label);
974 dest = SLOT(pplabel);
976 mls_copy_effective(source, dest);
980 mls_create_posix_sem(struct ucred *cred, struct ksem *ks,
981 struct label *kslabel)
983 struct mac_mls *source, *dest;
985 source = SLOT(cred->cr_label);
986 dest = SLOT(kslabel);
988 mls_copy_effective(source, dest);
992 mls_create_socket_from_socket(struct socket *oldso, struct label *oldsolabel,
993 struct socket *newso, struct label *newsolabel)
995 struct mac_mls *source, *dest;
997 source = SLOT(oldsolabel);
998 dest = SLOT(newsolabel);
1000 mls_copy_effective(source, dest);
1004 mls_relabel_socket(struct ucred *cred, struct socket *so,
1005 struct label *solabel, struct label *newlabel)
1007 struct mac_mls *source, *dest;
1009 source = SLOT(newlabel);
1010 dest = SLOT(solabel);
1012 mls_copy(source, dest);
1016 mls_relabel_pipe(struct ucred *cred, struct pipepair *pp,
1017 struct label *pplabel, struct label *newlabel)
1019 struct mac_mls *source, *dest;
1021 source = SLOT(newlabel);
1022 dest = SLOT(pplabel);
1024 mls_copy(source, dest);
1028 mls_set_socket_peer_from_mbuf(struct mbuf *m, struct label *mlabel,
1029 struct socket *so, struct label *sopeerlabel)
1031 struct mac_mls *source, *dest;
1033 source = SLOT(mlabel);
1034 dest = SLOT(sopeerlabel);
1036 mls_copy_effective(source, dest);
1040 * Labeling event operations: System V IPC objects.
1043 mls_create_sysv_msgmsg(struct ucred *cred, struct msqid_kernel *msqkptr,
1044 struct label *msqlabel, struct msg *msgptr, struct label *msglabel)
1046 struct mac_mls *source, *dest;
1048 /* Ignore the msgq label. */
1049 source = SLOT(cred->cr_label);
1050 dest = SLOT(msglabel);
1052 mls_copy_effective(source, dest);
1056 mls_create_sysv_msgqueue(struct ucred *cred, struct msqid_kernel *msqkptr,
1057 struct label *msqlabel)
1059 struct mac_mls *source, *dest;
1061 source = SLOT(cred->cr_label);
1062 dest = SLOT(msqlabel);
1064 mls_copy_effective(source, dest);
1068 mls_create_sysv_sem(struct ucred *cred, struct semid_kernel *semakptr,
1069 struct label *semalabel)
1071 struct mac_mls *source, *dest;
1073 source = SLOT(cred->cr_label);
1074 dest = SLOT(semalabel);
1076 mls_copy_effective(source, dest);
1080 mls_create_sysv_shm(struct ucred *cred, struct shmid_kernel *shmsegptr,
1081 struct label *shmlabel)
1083 struct mac_mls *source, *dest;
1085 source = SLOT(cred->cr_label);
1086 dest = SLOT(shmlabel);
1088 mls_copy_effective(source, dest);
1092 * Labeling event operations: network objects.
1095 mls_set_socket_peer_from_socket(struct socket *oldso,
1096 struct label *oldsolabel, struct socket *newso,
1097 struct label *newsopeerlabel)
1099 struct mac_mls *source, *dest;
1101 source = SLOT(oldsolabel);
1102 dest = SLOT(newsopeerlabel);
1104 mls_copy_effective(source, dest);
1108 mls_create_bpfdesc(struct ucred *cred, struct bpf_d *d, struct label *dlabel)
1110 struct mac_mls *source, *dest;
1112 source = SLOT(cred->cr_label);
1113 dest = SLOT(dlabel);
1115 mls_copy_effective(source, dest);
1119 mls_create_ifnet(struct ifnet *ifp, struct label *ifplabel)
1121 struct mac_mls *dest;
1124 dest = SLOT(ifplabel);
1126 if (ifp->if_type == IFT_LOOP)
1127 type = MAC_MLS_TYPE_EQUAL;
1129 type = MAC_MLS_TYPE_LOW;
1131 mls_set_effective(dest, type, 0, NULL);
1132 mls_set_range(dest, type, 0, NULL, type, 0, NULL);
1136 mls_create_ipq(struct mbuf *m, struct label *mlabel, struct ipq *q,
1137 struct label *qlabel)
1139 struct mac_mls *source, *dest;
1141 source = SLOT(mlabel);
1142 dest = SLOT(qlabel);
1144 mls_copy_effective(source, dest);
1148 mls_create_datagram_from_ipq(struct ipq *q, struct label *qlabel,
1149 struct mbuf *m, struct label *mlabel)
1151 struct mac_mls *source, *dest;
1153 source = SLOT(qlabel);
1154 dest = SLOT(mlabel);
1156 /* Just use the head, since we require them all to match. */
1157 mls_copy_effective(source, dest);
1161 mls_create_fragment(struct mbuf *m, struct label *mlabel,
1162 struct mbuf *frag, struct label *fraglabel)
1164 struct mac_mls *source, *dest;
1166 source = SLOT(mlabel);
1167 dest = SLOT(fraglabel);
1169 mls_copy_effective(source, dest);
1173 mls_create_mbuf_from_inpcb(struct inpcb *inp, struct label *inplabel,
1174 struct mbuf *m, struct label *mlabel)
1176 struct mac_mls *source, *dest;
1178 source = SLOT(inplabel);
1179 dest = SLOT(mlabel);
1181 mls_copy_effective(source, dest);
1185 mls_create_mbuf_linklayer(struct ifnet *ifp, struct label *ifplabel,
1186 struct mbuf *m, struct label *mlabel)
1188 struct mac_mls *dest;
1190 dest = SLOT(mlabel);
1192 mls_set_effective(dest, MAC_MLS_TYPE_EQUAL, 0, NULL);
1196 mls_create_mbuf_from_bpfdesc(struct bpf_d *d, struct label *dlabel,
1197 struct mbuf *m, struct label *mlabel)
1199 struct mac_mls *source, *dest;
1201 source = SLOT(dlabel);
1202 dest = SLOT(mlabel);
1204 mls_copy_effective(source, dest);
1208 mls_create_mbuf_from_ifnet(struct ifnet *ifp, struct label *ifplabel,
1209 struct mbuf *m, struct label *mlabel)
1211 struct mac_mls *source, *dest;
1213 source = SLOT(ifplabel);
1214 dest = SLOT(mlabel);
1216 mls_copy_effective(source, dest);
1220 mls_create_mbuf_multicast_encap(struct mbuf *m, struct label *mlabel,
1221 struct ifnet *ifp, struct label *ifplabel, struct mbuf *mnew,
1222 struct label *mnewlabel)
1224 struct mac_mls *source, *dest;
1226 source = SLOT(mlabel);
1227 dest = SLOT(mnewlabel);
1229 mls_copy_effective(source, dest);
1233 mls_create_mbuf_netlayer(struct mbuf *m, struct label *mlabel,
1234 struct mbuf *mnew, struct label *mnewlabel)
1236 struct mac_mls *source, *dest;
1238 source = SLOT(mlabel);
1239 dest = SLOT(mnewlabel);
1241 mls_copy_effective(source, dest);
1245 mls_fragment_match(struct mbuf *m, struct label *mlabel, struct ipq *q,
1246 struct label *qlabel)
1248 struct mac_mls *a, *b;
1253 return (mls_equal_effective(a, b));
1257 mls_relabel_ifnet(struct ucred *cred, struct ifnet *ifp,
1258 struct label *ifplabel, struct label *newlabel)
1260 struct mac_mls *source, *dest;
1262 source = SLOT(newlabel);
1263 dest = SLOT(ifplabel);
1265 mls_copy(source, dest);
1269 mls_update_ipq(struct mbuf *m, struct label *mlabel, struct ipq *q,
1270 struct label *qlabel)
1273 /* NOOP: we only accept matching labels, so no need to update */
1277 mls_inpcb_sosetlabel(struct socket *so, struct label *solabel,
1278 struct inpcb *inp, struct label *inplabel)
1280 struct mac_mls *source, *dest;
1282 source = SLOT(solabel);
1283 dest = SLOT(inplabel);
1285 mls_copy(source, dest);
1289 mls_create_mbuf_from_firewall(struct mbuf *m, struct label *mlabel)
1291 struct mac_mls *dest;
1293 dest = SLOT(mlabel);
1295 /* XXX: where is the label for the firewall really comming from? */
1296 mls_set_effective(dest, MAC_MLS_TYPE_EQUAL, 0, NULL);
1300 mls_init_syncache_from_inpcb(struct label *label, struct inpcb *inp)
1302 struct mac_mls *source, *dest;
1304 source = SLOT(inp->inp_label);
1306 mls_copy_effective(source, dest);
1310 mls_create_mbuf_from_syncache(struct label *sc_label, struct mbuf *m,
1311 struct label *mlabel)
1313 struct mac_mls *source, *dest;
1315 source = SLOT(sc_label);
1316 dest = SLOT(mlabel);
1317 mls_copy_effective(source, dest);
1321 * Labeling event operations: processes.
1324 mls_create_proc0(struct ucred *cred)
1326 struct mac_mls *dest;
1328 dest = SLOT(cred->cr_label);
1330 mls_set_effective(dest, MAC_MLS_TYPE_EQUAL, 0, NULL);
1331 mls_set_range(dest, MAC_MLS_TYPE_LOW, 0, NULL, MAC_MLS_TYPE_HIGH, 0,
1336 mls_create_proc1(struct ucred *cred)
1338 struct mac_mls *dest;
1340 dest = SLOT(cred->cr_label);
1342 mls_set_effective(dest, MAC_MLS_TYPE_LOW, 0, NULL);
1343 mls_set_range(dest, MAC_MLS_TYPE_LOW, 0, NULL, MAC_MLS_TYPE_HIGH, 0,
1348 mls_relabel_cred(struct ucred *cred, struct label *newlabel)
1350 struct mac_mls *source, *dest;
1352 source = SLOT(newlabel);
1353 dest = SLOT(cred->cr_label);
1355 mls_copy(source, dest);
1359 * Label cleanup/flush operations.
1362 mls_cleanup_sysv_msgmsg(struct label *msglabel)
1365 bzero(SLOT(msglabel), sizeof(struct mac_mls));
1369 mls_cleanup_sysv_msgqueue(struct label *msqlabel)
1372 bzero(SLOT(msqlabel), sizeof(struct mac_mls));
1376 mls_cleanup_sysv_sem(struct label *semalabel)
1379 bzero(SLOT(semalabel), sizeof(struct mac_mls));
1383 mls_cleanup_sysv_shm(struct label *shmlabel)
1386 bzero(SLOT(shmlabel), sizeof(struct mac_mls));
1390 * Access control checks.
1393 mls_check_bpfdesc_receive(struct bpf_d *d, struct label *dlabel,
1394 struct ifnet *ifp, struct label *ifplabel)
1396 struct mac_mls *a, *b;
1404 if (mls_equal_effective(a, b))
1410 mls_check_cred_relabel(struct ucred *cred, struct label *newlabel)
1412 struct mac_mls *subj, *new;
1415 subj = SLOT(cred->cr_label);
1416 new = SLOT(newlabel);
1419 * If there is an MLS label update for the credential, it may be an
1420 * update of effective, range, or both.
1422 error = mls_atmostflags(new, MAC_MLS_FLAGS_BOTH);
1427 * If the MLS label is to be changed, authorize as appropriate.
1429 if (new->mm_flags & MAC_MLS_FLAGS_BOTH) {
1431 * If the change request modifies both the MLS label
1432 * effective and range, check that the new effective will be
1435 if ((new->mm_flags & MAC_MLS_FLAGS_BOTH) ==
1436 MAC_MLS_FLAGS_BOTH &&
1437 !mls_effective_in_range(new, new))
1441 * To change the MLS effective label on a credential, the new
1442 * effective label must be in the current range.
1444 if (new->mm_flags & MAC_MLS_FLAG_EFFECTIVE &&
1445 !mls_effective_in_range(new, subj))
1449 * To change the MLS range label on a credential, the new
1450 * range must be in the current range.
1452 if (new->mm_flags & MAC_MLS_FLAG_RANGE &&
1453 !mls_range_in_range(new, subj))
1457 * To have EQUAL in any component of the new credential MLS
1458 * label, the subject must already have EQUAL in their label.
1460 if (mls_contains_equal(new)) {
1461 error = mls_subject_privileged(subj);
1471 mls_check_cred_visible(struct ucred *cr1, struct ucred *cr2)
1473 struct mac_mls *subj, *obj;
1478 subj = SLOT(cr1->cr_label);
1479 obj = SLOT(cr2->cr_label);
1482 if (!mls_dominate_effective(subj, obj))
1489 mls_check_ifnet_relabel(struct ucred *cred, struct ifnet *ifp,
1490 struct label *ifplabel, struct label *newlabel)
1492 struct mac_mls *subj, *new;
1495 subj = SLOT(cred->cr_label);
1496 new = SLOT(newlabel);
1499 * If there is an MLS label update for the interface, it may be an
1500 * update of effective, range, or both.
1502 error = mls_atmostflags(new, MAC_MLS_FLAGS_BOTH);
1507 * Relabeling network interfaces requires MLS privilege.
1509 return (mls_subject_privileged(subj));
1513 mls_check_ifnet_transmit(struct ifnet *ifp, struct label *ifplabel,
1514 struct mbuf *m, struct label *mlabel)
1516 struct mac_mls *p, *i;
1524 return (mls_effective_in_range(p, i) ? 0 : EACCES);
1528 mls_check_inpcb_deliver(struct inpcb *inp, struct label *inplabel,
1529 struct mbuf *m, struct label *mlabel)
1531 struct mac_mls *p, *i;
1539 return (mls_equal_effective(p, i) ? 0 : EACCES);
1543 mls_check_inpcb_visible(struct ucred *cred, struct inpcb *inp,
1544 struct label *inplabel)
1546 struct mac_mls *subj, *obj;
1551 subj = SLOT(cred->cr_label);
1552 obj = SLOT(inplabel);
1554 if (!mls_dominate_effective(subj, obj))
1561 mls_check_sysv_msgrcv(struct ucred *cred, struct msg *msgptr,
1562 struct label *msglabel)
1564 struct mac_mls *subj, *obj;
1569 subj = SLOT(cred->cr_label);
1570 obj = SLOT(msglabel);
1572 if (!mls_dominate_effective(subj, obj))
1579 mls_check_sysv_msgrmid(struct ucred *cred, struct msg *msgptr,
1580 struct label *msglabel)
1582 struct mac_mls *subj, *obj;
1587 subj = SLOT(cred->cr_label);
1588 obj = SLOT(msglabel);
1590 if (!mls_dominate_effective(obj, subj))
1597 mls_check_sysv_msqget(struct ucred *cred, struct msqid_kernel *msqkptr,
1598 struct label *msqklabel)
1600 struct mac_mls *subj, *obj;
1605 subj = SLOT(cred->cr_label);
1606 obj = SLOT(msqklabel);
1608 if (!mls_dominate_effective(subj, obj))
1615 mls_check_sysv_msqsnd(struct ucred *cred, struct msqid_kernel *msqkptr,
1616 struct label *msqklabel)
1618 struct mac_mls *subj, *obj;
1623 subj = SLOT(cred->cr_label);
1624 obj = SLOT(msqklabel);
1626 if (!mls_dominate_effective(obj, subj))
1633 mls_check_sysv_msqrcv(struct ucred *cred, struct msqid_kernel *msqkptr,
1634 struct label *msqklabel)
1636 struct mac_mls *subj, *obj;
1641 subj = SLOT(cred->cr_label);
1642 obj = SLOT(msqklabel);
1644 if (!mls_dominate_effective(subj, obj))
1651 mls_check_sysv_msqctl(struct ucred *cred, struct msqid_kernel *msqkptr,
1652 struct label *msqklabel, int cmd)
1654 struct mac_mls *subj, *obj;
1659 subj = SLOT(cred->cr_label);
1660 obj = SLOT(msqklabel);
1665 if (!mls_dominate_effective(obj, subj))
1670 if (!mls_dominate_effective(subj, obj))
1682 mls_check_sysv_semctl(struct ucred *cred, struct semid_kernel *semakptr,
1683 struct label *semaklabel, int cmd)
1685 struct mac_mls *subj, *obj;
1690 subj = SLOT(cred->cr_label);
1691 obj = SLOT(semaklabel);
1698 if (!mls_dominate_effective(obj, subj))
1708 if (!mls_dominate_effective(subj, obj))
1720 mls_check_sysv_semget(struct ucred *cred, struct semid_kernel *semakptr,
1721 struct label *semaklabel)
1723 struct mac_mls *subj, *obj;
1728 subj = SLOT(cred->cr_label);
1729 obj = SLOT(semaklabel);
1731 if (!mls_dominate_effective(subj, obj))
1738 mls_check_sysv_semop(struct ucred *cred, struct semid_kernel *semakptr,
1739 struct label *semaklabel, size_t accesstype)
1741 struct mac_mls *subj, *obj;
1746 subj = SLOT(cred->cr_label);
1747 obj = SLOT(semaklabel);
1749 if (accesstype & SEM_R)
1750 if (!mls_dominate_effective(subj, obj))
1753 if (accesstype & SEM_A)
1754 if (!mls_dominate_effective(obj, subj))
1761 mls_check_sysv_shmat(struct ucred *cred, struct shmid_kernel *shmsegptr,
1762 struct label *shmseglabel, int shmflg)
1764 struct mac_mls *subj, *obj;
1769 subj = SLOT(cred->cr_label);
1770 obj = SLOT(shmseglabel);
1772 if (!mls_dominate_effective(subj, obj))
1774 if ((shmflg & SHM_RDONLY) == 0)
1775 if (!mls_dominate_effective(obj, subj))
1782 mls_check_sysv_shmctl(struct ucred *cred, struct shmid_kernel *shmsegptr,
1783 struct label *shmseglabel, int cmd)
1785 struct mac_mls *subj, *obj;
1790 subj = SLOT(cred->cr_label);
1791 obj = SLOT(shmseglabel);
1796 if (!mls_dominate_effective(obj, subj))
1802 if (!mls_dominate_effective(subj, obj))
1814 mls_check_sysv_shmget(struct ucred *cred, struct shmid_kernel *shmsegptr,
1815 struct label *shmseglabel, int shmflg)
1817 struct mac_mls *subj, *obj;
1822 subj = SLOT(cred->cr_label);
1823 obj = SLOT(shmseglabel);
1825 if (!mls_dominate_effective(obj, subj))
1832 mls_check_mount_stat(struct ucred *cred, struct mount *mp,
1833 struct label *mntlabel)
1835 struct mac_mls *subj, *obj;
1840 subj = SLOT(cred->cr_label);
1841 obj = SLOT(mntlabel);
1843 if (!mls_dominate_effective(subj, obj))
1850 mls_check_pipe_ioctl(struct ucred *cred, struct pipepair *pp,
1851 struct label *pplabel, unsigned long cmd, void /* caddr_t */ *data)
1857 /* XXX: This will be implemented soon... */
1863 mls_check_pipe_poll(struct ucred *cred, struct pipepair *pp,
1864 struct label *pplabel)
1866 struct mac_mls *subj, *obj;
1871 subj = SLOT(cred->cr_label);
1872 obj = SLOT(pplabel);
1874 if (!mls_dominate_effective(subj, obj))
1881 mls_check_pipe_read(struct ucred *cred, struct pipepair *pp,
1882 struct label *pplabel)
1884 struct mac_mls *subj, *obj;
1889 subj = SLOT(cred->cr_label);
1890 obj = SLOT(pplabel);
1892 if (!mls_dominate_effective(subj, obj))
1899 mls_check_pipe_relabel(struct ucred *cred, struct pipepair *pp,
1900 struct label *pplabel, struct label *newlabel)
1902 struct mac_mls *subj, *obj, *new;
1905 new = SLOT(newlabel);
1906 subj = SLOT(cred->cr_label);
1907 obj = SLOT(pplabel);
1910 * If there is an MLS label update for a pipe, it must be a effective
1913 error = mls_atmostflags(new, MAC_MLS_FLAG_EFFECTIVE);
1918 * To perform a relabel of a pipe (MLS label or not), MLS must
1919 * authorize the relabel.
1921 if (!mls_effective_in_range(obj, subj))
1925 * If the MLS label is to be changed, authorize as appropriate.
1927 if (new->mm_flags & MAC_MLS_FLAG_EFFECTIVE) {
1929 * To change the MLS label on a pipe, the new pipe label must
1930 * be in the subject range.
1932 if (!mls_effective_in_range(new, subj))
1936 * To change the MLS label on a pipe to be EQUAL, the subject
1937 * must have appropriate privilege.
1939 if (mls_contains_equal(new)) {
1940 error = mls_subject_privileged(subj);
1950 mls_check_pipe_stat(struct ucred *cred, struct pipepair *pp,
1951 struct label *pplabel)
1953 struct mac_mls *subj, *obj;
1958 subj = SLOT(cred->cr_label);
1959 obj = SLOT(pplabel);
1961 if (!mls_dominate_effective(subj, obj))
1968 mls_check_pipe_write(struct ucred *cred, struct pipepair *pp,
1969 struct label *pplabel)
1971 struct mac_mls *subj, *obj;
1976 subj = SLOT(cred->cr_label);
1977 obj = SLOT(pplabel);
1979 if (!mls_dominate_effective(obj, subj))
1986 mls_check_posix_sem_write(struct ucred *cred, struct ksem *ks,
1987 struct label *kslabel)
1989 struct mac_mls *subj, *obj;
1994 subj = SLOT(cred->cr_label);
1995 obj = SLOT(kslabel);
1997 if (!mls_dominate_effective(obj, subj))
2004 mls_check_posix_sem_rdonly(struct ucred *cred, struct ksem *ks,
2005 struct label *kslabel)
2007 struct mac_mls *subj, *obj;
2012 subj = SLOT(cred->cr_label);
2013 obj = SLOT(kslabel);
2015 if (!mls_dominate_effective(subj, obj))
2022 mls_check_proc_debug(struct ucred *cred, struct proc *p)
2024 struct mac_mls *subj, *obj;
2029 subj = SLOT(cred->cr_label);
2030 obj = SLOT(p->p_ucred->cr_label);
2032 /* XXX: range checks */
2033 if (!mls_dominate_effective(subj, obj))
2035 if (!mls_dominate_effective(obj, subj))
2042 mls_check_proc_sched(struct ucred *cred, struct proc *p)
2044 struct mac_mls *subj, *obj;
2049 subj = SLOT(cred->cr_label);
2050 obj = SLOT(p->p_ucred->cr_label);
2052 /* XXX: range checks */
2053 if (!mls_dominate_effective(subj, obj))
2055 if (!mls_dominate_effective(obj, subj))
2062 mls_check_proc_signal(struct ucred *cred, struct proc *p, int signum)
2064 struct mac_mls *subj, *obj;
2069 subj = SLOT(cred->cr_label);
2070 obj = SLOT(p->p_ucred->cr_label);
2072 /* XXX: range checks */
2073 if (!mls_dominate_effective(subj, obj))
2075 if (!mls_dominate_effective(obj, subj))
2082 mls_check_socket_deliver(struct socket *so, struct label *solabel,
2083 struct mbuf *m, struct label *mlabel)
2085 struct mac_mls *p, *s;
2093 return (mls_equal_effective(p, s) ? 0 : EACCES);
2097 mls_check_socket_relabel(struct ucred *cred, struct socket *so,
2098 struct label *solabel, struct label *newlabel)
2100 struct mac_mls *subj, *obj, *new;
2103 new = SLOT(newlabel);
2104 subj = SLOT(cred->cr_label);
2105 obj = SLOT(solabel);
2108 * If there is an MLS label update for the socket, it may be an
2109 * update of effective.
2111 error = mls_atmostflags(new, MAC_MLS_FLAG_EFFECTIVE);
2116 * To relabel a socket, the old socket effective must be in the
2119 if (!mls_effective_in_range(obj, subj))
2123 * If the MLS label is to be changed, authorize as appropriate.
2125 if (new->mm_flags & MAC_MLS_FLAG_EFFECTIVE) {
2127 * To relabel a socket, the new socket effective must be in
2128 * the subject range.
2130 if (!mls_effective_in_range(new, subj))
2134 * To change the MLS label on the socket to contain EQUAL,
2135 * the subject must have appropriate privilege.
2137 if (mls_contains_equal(new)) {
2138 error = mls_subject_privileged(subj);
2148 mls_check_socket_visible(struct ucred *cred, struct socket *so,
2149 struct label *solabel)
2151 struct mac_mls *subj, *obj;
2156 subj = SLOT(cred->cr_label);
2157 obj = SLOT(solabel);
2159 if (!mls_dominate_effective(subj, obj))
2166 mls_check_system_acct(struct ucred *cred, struct vnode *vp,
2167 struct label *vplabel)
2169 struct mac_mls *subj, *obj;
2174 subj = SLOT(cred->cr_label);
2175 obj = SLOT(vplabel);
2177 if (!mls_dominate_effective(obj, subj) ||
2178 !mls_dominate_effective(subj, obj))
2185 mls_check_system_auditctl(struct ucred *cred, struct vnode *vp,
2186 struct label *vplabel)
2188 struct mac_mls *subj, *obj;
2193 subj = SLOT(cred->cr_label);
2194 obj = SLOT(vplabel);
2196 if (!mls_dominate_effective(obj, subj) ||
2197 !mls_dominate_effective(subj, obj))
2204 mls_check_system_swapon(struct ucred *cred, struct vnode *vp,
2205 struct label *vplabel)
2207 struct mac_mls *subj, *obj;
2212 subj = SLOT(cred->cr_label);
2213 obj = SLOT(vplabel);
2215 if (!mls_dominate_effective(obj, subj) ||
2216 !mls_dominate_effective(subj, obj))
2223 mls_check_vnode_chdir(struct ucred *cred, struct vnode *dvp,
2224 struct label *dvplabel)
2226 struct mac_mls *subj, *obj;
2231 subj = SLOT(cred->cr_label);
2232 obj = SLOT(dvplabel);
2234 if (!mls_dominate_effective(subj, obj))
2241 mls_check_vnode_chroot(struct ucred *cred, struct vnode *dvp,
2242 struct label *dvplabel)
2244 struct mac_mls *subj, *obj;
2249 subj = SLOT(cred->cr_label);
2250 obj = SLOT(dvplabel);
2252 if (!mls_dominate_effective(subj, obj))
2259 mls_check_vnode_create(struct ucred *cred, struct vnode *dvp,
2260 struct label *dvplabel, struct componentname *cnp, struct vattr *vap)
2262 struct mac_mls *subj, *obj;
2267 subj = SLOT(cred->cr_label);
2268 obj = SLOT(dvplabel);
2270 if (!mls_dominate_effective(obj, subj))
2277 mls_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp,
2278 struct label *vplabel, acl_type_t type)
2280 struct mac_mls *subj, *obj;
2285 subj = SLOT(cred->cr_label);
2286 obj = SLOT(vplabel);
2288 if (!mls_dominate_effective(obj, subj))
2295 mls_check_vnode_deleteextattr(struct ucred *cred, struct vnode *vp,
2296 struct label *vplabel, int attrnamespace, const char *name)
2298 struct mac_mls *subj, *obj;
2303 subj = SLOT(cred->cr_label);
2304 obj = SLOT(vplabel);
2306 if (!mls_dominate_effective(obj, subj))
2313 mls_check_vnode_exec(struct ucred *cred, struct vnode *vp,
2314 struct label *vplabel, struct image_params *imgp,
2315 struct label *execlabel)
2317 struct mac_mls *subj, *obj, *exec;
2320 if (execlabel != NULL) {
2322 * We currently don't permit labels to be changed at
2323 * exec-time as part of MLS, so disallow non-NULL MLS label
2324 * elements in the execlabel.
2326 exec = SLOT(execlabel);
2327 error = mls_atmostflags(exec, 0);
2335 subj = SLOT(cred->cr_label);
2336 obj = SLOT(vplabel);
2338 if (!mls_dominate_effective(subj, obj))
2345 mls_check_vnode_getacl(struct ucred *cred, struct vnode *vp,
2346 struct label *vplabel, acl_type_t type)
2348 struct mac_mls *subj, *obj;
2353 subj = SLOT(cred->cr_label);
2354 obj = SLOT(vplabel);
2356 if (!mls_dominate_effective(subj, obj))
2363 mls_check_vnode_getextattr(struct ucred *cred, struct vnode *vp,
2364 struct label *vplabel, int attrnamespace, const char *name,
2367 struct mac_mls *subj, *obj;
2372 subj = SLOT(cred->cr_label);
2373 obj = SLOT(vplabel);
2375 if (!mls_dominate_effective(subj, obj))
2382 mls_check_vnode_link(struct ucred *cred, struct vnode *dvp,
2383 struct label *dvplabel, struct vnode *vp, struct label *vplabel,
2384 struct componentname *cnp)
2386 struct mac_mls *subj, *obj;
2391 subj = SLOT(cred->cr_label);
2392 obj = SLOT(dvplabel);
2394 if (!mls_dominate_effective(obj, subj))
2397 obj = SLOT(vplabel);
2398 if (!mls_dominate_effective(obj, subj))
2405 mls_check_vnode_listextattr(struct ucred *cred, struct vnode *vp,
2406 struct label *vplabel, int attrnamespace)
2409 struct mac_mls *subj, *obj;
2414 subj = SLOT(cred->cr_label);
2415 obj = SLOT(vplabel);
2417 if (!mls_dominate_effective(subj, obj))
2424 mls_check_vnode_lookup(struct ucred *cred, struct vnode *dvp,
2425 struct label *dvplabel, struct componentname *cnp)
2427 struct mac_mls *subj, *obj;
2432 subj = SLOT(cred->cr_label);
2433 obj = SLOT(dvplabel);
2435 if (!mls_dominate_effective(subj, obj))
2442 mls_check_vnode_mmap(struct ucred *cred, struct vnode *vp,
2443 struct label *vplabel, int prot, int flags)
2445 struct mac_mls *subj, *obj;
2448 * Rely on the use of open()-time protections to handle
2449 * non-revocation cases.
2451 if (!mls_enabled || !revocation_enabled)
2454 subj = SLOT(cred->cr_label);
2455 obj = SLOT(vplabel);
2457 if (prot & (VM_PROT_READ | VM_PROT_EXECUTE)) {
2458 if (!mls_dominate_effective(subj, obj))
2461 if (((prot & VM_PROT_WRITE) != 0) && ((flags & MAP_SHARED) != 0)) {
2462 if (!mls_dominate_effective(obj, subj))
2470 mls_check_vnode_open(struct ucred *cred, struct vnode *vp,
2471 struct label *vplabel, int acc_mode)
2473 struct mac_mls *subj, *obj;
2478 subj = SLOT(cred->cr_label);
2479 obj = SLOT(vplabel);
2481 /* XXX privilege override for admin? */
2482 if (acc_mode & (VREAD | VEXEC | VSTAT)) {
2483 if (!mls_dominate_effective(subj, obj))
2486 if (acc_mode & (VWRITE | VAPPEND | VADMIN)) {
2487 if (!mls_dominate_effective(obj, subj))
2495 mls_check_vnode_poll(struct ucred *active_cred, struct ucred *file_cred,
2496 struct vnode *vp, struct label *vplabel)
2498 struct mac_mls *subj, *obj;
2500 if (!mls_enabled || !revocation_enabled)
2503 subj = SLOT(active_cred->cr_label);
2504 obj = SLOT(vplabel);
2506 if (!mls_dominate_effective(subj, obj))
2513 mls_check_vnode_read(struct ucred *active_cred, struct ucred *file_cred,
2514 struct vnode *vp, struct label *vplabel)
2516 struct mac_mls *subj, *obj;
2518 if (!mls_enabled || !revocation_enabled)
2521 subj = SLOT(active_cred->cr_label);
2522 obj = SLOT(vplabel);
2524 if (!mls_dominate_effective(subj, obj))
2531 mls_check_vnode_readdir(struct ucred *cred, struct vnode *dvp,
2532 struct label *dvplabel)
2534 struct mac_mls *subj, *obj;
2539 subj = SLOT(cred->cr_label);
2540 obj = SLOT(dvplabel);
2542 if (!mls_dominate_effective(subj, obj))
2549 mls_check_vnode_readlink(struct ucred *cred, struct vnode *vp,
2550 struct label *vplabel)
2552 struct mac_mls *subj, *obj;
2557 subj = SLOT(cred->cr_label);
2558 obj = SLOT(vplabel);
2560 if (!mls_dominate_effective(subj, obj))
2567 mls_check_vnode_relabel(struct ucred *cred, struct vnode *vp,
2568 struct label *vplabel, struct label *newlabel)
2570 struct mac_mls *old, *new, *subj;
2573 old = SLOT(vplabel);
2574 new = SLOT(newlabel);
2575 subj = SLOT(cred->cr_label);
2578 * If there is an MLS label update for the vnode, it must be a
2581 error = mls_atmostflags(new, MAC_MLS_FLAG_EFFECTIVE);
2586 * To perform a relabel of the vnode (MLS label or not), MLS must
2587 * authorize the relabel.
2589 if (!mls_effective_in_range(old, subj))
2593 * If the MLS label is to be changed, authorize as appropriate.
2595 if (new->mm_flags & MAC_MLS_FLAG_EFFECTIVE) {
2597 * To change the MLS label on a vnode, the new vnode label
2598 * must be in the subject range.
2600 if (!mls_effective_in_range(new, subj))
2604 * To change the MLS label on the vnode to be EQUAL, the
2605 * subject must have appropriate privilege.
2607 if (mls_contains_equal(new)) {
2608 error = mls_subject_privileged(subj);
2618 mls_check_vnode_rename_from(struct ucred *cred, struct vnode *dvp,
2619 struct label *dvplabel, struct vnode *vp, struct label *vplabel,
2620 struct componentname *cnp)
2622 struct mac_mls *subj, *obj;
2627 subj = SLOT(cred->cr_label);
2628 obj = SLOT(dvplabel);
2630 if (!mls_dominate_effective(obj, subj))
2633 obj = SLOT(vplabel);
2635 if (!mls_dominate_effective(obj, subj))
2642 mls_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp,
2643 struct label *dvplabel, struct vnode *vp, struct label *vplabel,
2644 int samedir, struct componentname *cnp)
2646 struct mac_mls *subj, *obj;
2651 subj = SLOT(cred->cr_label);
2652 obj = SLOT(dvplabel);
2654 if (!mls_dominate_effective(obj, subj))
2658 obj = SLOT(vplabel);
2660 if (!mls_dominate_effective(obj, subj))
2668 mls_check_vnode_revoke(struct ucred *cred, struct vnode *vp,
2669 struct label *vplabel)
2671 struct mac_mls *subj, *obj;
2676 subj = SLOT(cred->cr_label);
2677 obj = SLOT(vplabel);
2679 if (!mls_dominate_effective(obj, subj))
2686 mls_check_vnode_setacl(struct ucred *cred, struct vnode *vp,
2687 struct label *vplabel, acl_type_t type, struct acl *acl)
2689 struct mac_mls *subj, *obj;
2694 subj = SLOT(cred->cr_label);
2695 obj = SLOT(vplabel);
2697 if (!mls_dominate_effective(obj, subj))
2704 mls_check_vnode_setextattr(struct ucred *cred, struct vnode *vp,
2705 struct label *vplabel, int attrnamespace, const char *name,
2708 struct mac_mls *subj, *obj;
2713 subj = SLOT(cred->cr_label);
2714 obj = SLOT(vplabel);
2716 if (!mls_dominate_effective(obj, subj))
2719 /* XXX: protect the MAC EA in a special way? */
2725 mls_check_vnode_setflags(struct ucred *cred, struct vnode *vp,
2726 struct label *vplabel, u_long flags)
2728 struct mac_mls *subj, *obj;
2733 subj = SLOT(cred->cr_label);
2734 obj = SLOT(vplabel);
2736 if (!mls_dominate_effective(obj, subj))
2743 mls_check_vnode_setmode(struct ucred *cred, struct vnode *vp,
2744 struct label *vplabel, mode_t mode)
2746 struct mac_mls *subj, *obj;
2751 subj = SLOT(cred->cr_label);
2752 obj = SLOT(vplabel);
2754 if (!mls_dominate_effective(obj, subj))
2761 mls_check_vnode_setowner(struct ucred *cred, struct vnode *vp,
2762 struct label *vplabel, uid_t uid, gid_t gid)
2764 struct mac_mls *subj, *obj;
2769 subj = SLOT(cred->cr_label);
2770 obj = SLOT(vplabel);
2772 if (!mls_dominate_effective(obj, subj))
2779 mls_check_vnode_setutimes(struct ucred *cred, struct vnode *vp,
2780 struct label *vplabel, struct timespec atime, struct timespec mtime)
2782 struct mac_mls *subj, *obj;
2787 subj = SLOT(cred->cr_label);
2788 obj = SLOT(vplabel);
2790 if (!mls_dominate_effective(obj, subj))
2797 mls_check_vnode_stat(struct ucred *active_cred, struct ucred *file_cred,
2798 struct vnode *vp, struct label *vplabel)
2800 struct mac_mls *subj, *obj;
2805 subj = SLOT(active_cred->cr_label);
2806 obj = SLOT(vplabel);
2808 if (!mls_dominate_effective(subj, obj))
2815 mls_check_vnode_unlink(struct ucred *cred, struct vnode *dvp,
2816 struct label *dvplabel, struct vnode *vp, struct label *vplabel,
2817 struct componentname *cnp)
2819 struct mac_mls *subj, *obj;
2824 subj = SLOT(cred->cr_label);
2825 obj = SLOT(dvplabel);
2827 if (!mls_dominate_effective(obj, subj))
2830 obj = SLOT(vplabel);
2832 if (!mls_dominate_effective(obj, subj))
2839 mls_check_vnode_write(struct ucred *active_cred, struct ucred *file_cred,
2840 struct vnode *vp, struct label *vplabel)
2842 struct mac_mls *subj, *obj;
2844 if (!mls_enabled || !revocation_enabled)
2847 subj = SLOT(active_cred->cr_label);
2848 obj = SLOT(vplabel);
2850 if (!mls_dominate_effective(obj, subj))
2857 mls_associate_nfsd_label(struct ucred *cred)
2859 struct mac_mls *label;
2861 label = SLOT(cred->cr_label);
2862 mls_set_effective(label, MAC_MLS_TYPE_LOW, 0, NULL);
2863 mls_set_range(label, MAC_MLS_TYPE_LOW, 0, NULL,
2864 MAC_MLS_TYPE_HIGH, 0, NULL);
2867 static struct mac_policy_ops mls_ops =
2869 .mpo_init = mls_init,
2870 .mpo_init_bpfdesc_label = mls_init_label,
2871 .mpo_init_cred_label = mls_init_label,
2872 .mpo_init_devfs_label = mls_init_label,
2873 .mpo_init_ifnet_label = mls_init_label,
2874 .mpo_init_inpcb_label = mls_init_label_waitcheck,
2875 .mpo_init_syncache_label = mls_init_label_waitcheck,
2876 .mpo_init_sysv_msgmsg_label = mls_init_label,
2877 .mpo_init_sysv_msgqueue_label = mls_init_label,
2878 .mpo_init_sysv_sem_label = mls_init_label,
2879 .mpo_init_sysv_shm_label = mls_init_label,
2880 .mpo_init_ipq_label = mls_init_label_waitcheck,
2881 .mpo_init_mbuf_label = mls_init_label_waitcheck,
2882 .mpo_init_mount_label = mls_init_label,
2883 .mpo_init_pipe_label = mls_init_label,
2884 .mpo_init_posix_sem_label = mls_init_label,
2885 .mpo_init_socket_label = mls_init_label_waitcheck,
2886 .mpo_init_socket_peer_label = mls_init_label_waitcheck,
2887 .mpo_init_vnode_label = mls_init_label,
2888 .mpo_destroy_bpfdesc_label = mls_destroy_label,
2889 .mpo_destroy_cred_label = mls_destroy_label,
2890 .mpo_destroy_devfs_label = mls_destroy_label,
2891 .mpo_destroy_ifnet_label = mls_destroy_label,
2892 .mpo_destroy_inpcb_label = mls_destroy_label,
2893 .mpo_destroy_syncache_label = mls_destroy_label,
2894 .mpo_destroy_sysv_msgmsg_label = mls_destroy_label,
2895 .mpo_destroy_sysv_msgqueue_label = mls_destroy_label,
2896 .mpo_destroy_sysv_sem_label = mls_destroy_label,
2897 .mpo_destroy_sysv_shm_label = mls_destroy_label,
2898 .mpo_destroy_ipq_label = mls_destroy_label,
2899 .mpo_destroy_mbuf_label = mls_destroy_label,
2900 .mpo_destroy_mount_label = mls_destroy_label,
2901 .mpo_destroy_pipe_label = mls_destroy_label,
2902 .mpo_destroy_posix_sem_label = mls_destroy_label,
2903 .mpo_destroy_socket_label = mls_destroy_label,
2904 .mpo_destroy_socket_peer_label = mls_destroy_label,
2905 .mpo_destroy_vnode_label = mls_destroy_label,
2906 .mpo_copy_cred_label = mls_copy_label,
2907 .mpo_copy_ifnet_label = mls_copy_label,
2908 .mpo_copy_mbuf_label = mls_copy_label,
2909 .mpo_copy_pipe_label = mls_copy_label,
2910 .mpo_copy_socket_label = mls_copy_label,
2911 .mpo_copy_vnode_label = mls_copy_label,
2912 .mpo_externalize_cred_label = mls_externalize_label,
2913 .mpo_externalize_ifnet_label = mls_externalize_label,
2914 .mpo_externalize_pipe_label = mls_externalize_label,
2915 .mpo_externalize_socket_label = mls_externalize_label,
2916 .mpo_externalize_socket_peer_label = mls_externalize_label,
2917 .mpo_externalize_vnode_label = mls_externalize_label,
2918 .mpo_internalize_cred_label = mls_internalize_label,
2919 .mpo_internalize_ifnet_label = mls_internalize_label,
2920 .mpo_internalize_pipe_label = mls_internalize_label,
2921 .mpo_internalize_socket_label = mls_internalize_label,
2922 .mpo_internalize_vnode_label = mls_internalize_label,
2923 .mpo_create_devfs_device = mls_create_devfs_device,
2924 .mpo_create_devfs_directory = mls_create_devfs_directory,
2925 .mpo_create_devfs_symlink = mls_create_devfs_symlink,
2926 .mpo_create_mount = mls_create_mount,
2927 .mpo_relabel_vnode = mls_relabel_vnode,
2928 .mpo_update_devfs = mls_update_devfs,
2929 .mpo_associate_vnode_devfs = mls_associate_vnode_devfs,
2930 .mpo_associate_vnode_extattr = mls_associate_vnode_extattr,
2931 .mpo_associate_vnode_singlelabel = mls_associate_vnode_singlelabel,
2932 .mpo_create_vnode_extattr = mls_create_vnode_extattr,
2933 .mpo_setlabel_vnode_extattr = mls_setlabel_vnode_extattr,
2934 .mpo_create_mbuf_from_socket = mls_create_mbuf_from_socket,
2935 .mpo_create_mbuf_from_syncache = mls_create_mbuf_from_syncache,
2936 .mpo_create_pipe = mls_create_pipe,
2937 .mpo_create_posix_sem = mls_create_posix_sem,
2938 .mpo_create_socket = mls_create_socket,
2939 .mpo_create_socket_from_socket = mls_create_socket_from_socket,
2940 .mpo_relabel_pipe = mls_relabel_pipe,
2941 .mpo_relabel_socket = mls_relabel_socket,
2942 .mpo_set_socket_peer_from_mbuf = mls_set_socket_peer_from_mbuf,
2943 .mpo_set_socket_peer_from_socket = mls_set_socket_peer_from_socket,
2944 .mpo_create_bpfdesc = mls_create_bpfdesc,
2945 .mpo_create_datagram_from_ipq = mls_create_datagram_from_ipq,
2946 .mpo_create_fragment = mls_create_fragment,
2947 .mpo_create_ifnet = mls_create_ifnet,
2948 .mpo_create_inpcb_from_socket = mls_create_inpcb_from_socket,
2949 .mpo_init_syncache_from_inpcb = mls_init_syncache_from_inpcb,
2950 .mpo_create_ipq = mls_create_ipq,
2951 .mpo_create_sysv_msgmsg = mls_create_sysv_msgmsg,
2952 .mpo_create_sysv_msgqueue = mls_create_sysv_msgqueue,
2953 .mpo_create_sysv_sem = mls_create_sysv_sem,
2954 .mpo_create_sysv_shm = mls_create_sysv_shm,
2955 .mpo_create_mbuf_from_inpcb = mls_create_mbuf_from_inpcb,
2956 .mpo_create_mbuf_linklayer = mls_create_mbuf_linklayer,
2957 .mpo_create_mbuf_from_bpfdesc = mls_create_mbuf_from_bpfdesc,
2958 .mpo_create_mbuf_from_ifnet = mls_create_mbuf_from_ifnet,
2959 .mpo_create_mbuf_multicast_encap = mls_create_mbuf_multicast_encap,
2960 .mpo_create_mbuf_netlayer = mls_create_mbuf_netlayer,
2961 .mpo_fragment_match = mls_fragment_match,
2962 .mpo_relabel_ifnet = mls_relabel_ifnet,
2963 .mpo_update_ipq = mls_update_ipq,
2964 .mpo_inpcb_sosetlabel = mls_inpcb_sosetlabel,
2965 .mpo_create_proc0 = mls_create_proc0,
2966 .mpo_create_proc1 = mls_create_proc1,
2967 .mpo_relabel_cred = mls_relabel_cred,
2968 .mpo_cleanup_sysv_msgmsg = mls_cleanup_sysv_msgmsg,
2969 .mpo_cleanup_sysv_msgqueue = mls_cleanup_sysv_msgqueue,
2970 .mpo_cleanup_sysv_sem = mls_cleanup_sysv_sem,
2971 .mpo_cleanup_sysv_shm = mls_cleanup_sysv_shm,
2972 .mpo_check_bpfdesc_receive = mls_check_bpfdesc_receive,
2973 .mpo_check_cred_relabel = mls_check_cred_relabel,
2974 .mpo_check_cred_visible = mls_check_cred_visible,
2975 .mpo_check_ifnet_relabel = mls_check_ifnet_relabel,
2976 .mpo_check_ifnet_transmit = mls_check_ifnet_transmit,
2977 .mpo_check_inpcb_deliver = mls_check_inpcb_deliver,
2978 .mpo_check_inpcb_visible = mls_check_inpcb_visible,
2979 .mpo_check_sysv_msgrcv = mls_check_sysv_msgrcv,
2980 .mpo_check_sysv_msgrmid = mls_check_sysv_msgrmid,
2981 .mpo_check_sysv_msqget = mls_check_sysv_msqget,
2982 .mpo_check_sysv_msqsnd = mls_check_sysv_msqsnd,
2983 .mpo_check_sysv_msqrcv = mls_check_sysv_msqrcv,
2984 .mpo_check_sysv_msqctl = mls_check_sysv_msqctl,
2985 .mpo_check_sysv_semctl = mls_check_sysv_semctl,
2986 .mpo_check_sysv_semget = mls_check_sysv_semget,
2987 .mpo_check_sysv_semop = mls_check_sysv_semop,
2988 .mpo_check_sysv_shmat = mls_check_sysv_shmat,
2989 .mpo_check_sysv_shmctl = mls_check_sysv_shmctl,
2990 .mpo_check_sysv_shmget = mls_check_sysv_shmget,
2991 .mpo_check_mount_stat = mls_check_mount_stat,
2992 .mpo_check_pipe_ioctl = mls_check_pipe_ioctl,
2993 .mpo_check_pipe_poll = mls_check_pipe_poll,
2994 .mpo_check_pipe_read = mls_check_pipe_read,
2995 .mpo_check_pipe_relabel = mls_check_pipe_relabel,
2996 .mpo_check_pipe_stat = mls_check_pipe_stat,
2997 .mpo_check_pipe_write = mls_check_pipe_write,
2998 .mpo_check_posix_sem_destroy = mls_check_posix_sem_write,
2999 .mpo_check_posix_sem_getvalue = mls_check_posix_sem_rdonly,
3000 .mpo_check_posix_sem_open = mls_check_posix_sem_write,
3001 .mpo_check_posix_sem_post = mls_check_posix_sem_write,
3002 .mpo_check_posix_sem_unlink = mls_check_posix_sem_write,
3003 .mpo_check_posix_sem_wait = mls_check_posix_sem_write,
3004 .mpo_check_proc_debug = mls_check_proc_debug,
3005 .mpo_check_proc_sched = mls_check_proc_sched,
3006 .mpo_check_proc_signal = mls_check_proc_signal,
3007 .mpo_check_socket_deliver = mls_check_socket_deliver,
3008 .mpo_check_socket_relabel = mls_check_socket_relabel,
3009 .mpo_check_socket_visible = mls_check_socket_visible,
3010 .mpo_check_system_acct = mls_check_system_acct,
3011 .mpo_check_system_auditctl = mls_check_system_auditctl,
3012 .mpo_check_system_swapon = mls_check_system_swapon,
3013 .mpo_check_vnode_access = mls_check_vnode_open,
3014 .mpo_check_vnode_chdir = mls_check_vnode_chdir,
3015 .mpo_check_vnode_chroot = mls_check_vnode_chroot,
3016 .mpo_check_vnode_create = mls_check_vnode_create,
3017 .mpo_check_vnode_deleteacl = mls_check_vnode_deleteacl,
3018 .mpo_check_vnode_deleteextattr = mls_check_vnode_deleteextattr,
3019 .mpo_check_vnode_exec = mls_check_vnode_exec,
3020 .mpo_check_vnode_getacl = mls_check_vnode_getacl,
3021 .mpo_check_vnode_getextattr = mls_check_vnode_getextattr,
3022 .mpo_check_vnode_link = mls_check_vnode_link,
3023 .mpo_check_vnode_listextattr = mls_check_vnode_listextattr,
3024 .mpo_check_vnode_lookup = mls_check_vnode_lookup,
3025 .mpo_check_vnode_mmap = mls_check_vnode_mmap,
3026 .mpo_check_vnode_open = mls_check_vnode_open,
3027 .mpo_check_vnode_poll = mls_check_vnode_poll,
3028 .mpo_check_vnode_read = mls_check_vnode_read,
3029 .mpo_check_vnode_readdir = mls_check_vnode_readdir,
3030 .mpo_check_vnode_readlink = mls_check_vnode_readlink,
3031 .mpo_check_vnode_relabel = mls_check_vnode_relabel,
3032 .mpo_check_vnode_rename_from = mls_check_vnode_rename_from,
3033 .mpo_check_vnode_rename_to = mls_check_vnode_rename_to,
3034 .mpo_check_vnode_revoke = mls_check_vnode_revoke,
3035 .mpo_check_vnode_setacl = mls_check_vnode_setacl,
3036 .mpo_check_vnode_setextattr = mls_check_vnode_setextattr,
3037 .mpo_check_vnode_setflags = mls_check_vnode_setflags,
3038 .mpo_check_vnode_setmode = mls_check_vnode_setmode,
3039 .mpo_check_vnode_setowner = mls_check_vnode_setowner,
3040 .mpo_check_vnode_setutimes = mls_check_vnode_setutimes,
3041 .mpo_check_vnode_stat = mls_check_vnode_stat,
3042 .mpo_check_vnode_unlink = mls_check_vnode_unlink,
3043 .mpo_check_vnode_write = mls_check_vnode_write,
3044 .mpo_associate_nfsd_label = mls_associate_nfsd_label,
3045 .mpo_create_mbuf_from_firewall = mls_create_mbuf_from_firewall,
3048 MAC_POLICY_SET(&mls_ops, mac_mls, "TrustedBSD MAC/MLS",
3049 MPC_LOADTIME_FLAG_NOTLATE | MPC_LOADTIME_FLAG_LABELMBUFS, &mls_slot);