2 * Copyright (c) 1999-2002, 2007-2011 Robert N. M. Watson
3 * Copyright (c) 2001-2005 McAfee, Inc.
4 * Copyright (c) 2006 SPARTA, Inc.
7 * This software was developed by Robert Watson for the TrustedBSD Project.
9 * This software was developed for the FreeBSD Project in part by McAfee
10 * Research, the Security Research Division of McAfee, Inc. under
11 * DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA
12 * CHATS research program.
14 * This software was enhanced by SPARTA ISSO under SPAWAR contract
15 * N66001-04-C-6019 ("SEFOS").
17 * This software was developed at the University of Cambridge Computer
18 * Laboratory with support from a grant from Google, Inc.
20 * Redistribution and use in source and binary forms, with or without
21 * modification, are permitted provided that the following conditions
23 * 1. Redistributions of source code must retain the above copyright
24 * notice, this list of conditions and the following disclaimer.
25 * 2. Redistributions in binary form must reproduce the above copyright
26 * notice, this list of conditions and the following disclaimer in the
27 * documentation and/or other materials provided with the distribution.
29 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
30 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
31 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
32 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
33 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
34 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
35 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
36 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
37 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
38 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
45 * Developed by the TrustedBSD Project.
47 * MLS fixed label mandatory confidentiality policy.
50 #include <sys/types.h>
51 #include <sys/param.h>
54 #include <sys/extattr.h>
55 #include <sys/kernel.h>
58 #include <sys/malloc.h>
59 #include <sys/mount.h>
62 #include <sys/systm.h>
63 #include <sys/sysproto.h>
64 #include <sys/sysent.h>
65 #include <sys/systm.h>
66 #include <sys/vnode.h>
68 #include <sys/socket.h>
69 #include <sys/socketvar.h>
72 #include <sys/sysctl.h>
77 #include <fs/devfs/devfs.h>
79 #include <net/bpfdesc.h>
81 #include <net/if_types.h>
82 #include <net/if_var.h>
84 #include <netinet/in.h>
85 #include <netinet/in_pcb.h>
86 #include <netinet/ip_var.h>
91 #include <security/mac/mac_policy.h>
92 #include <security/mac_mls/mac_mls.h>
94 SYSCTL_DECL(_security_mac);
96 static SYSCTL_NODE(_security_mac, OID_AUTO, mls, CTLFLAG_RW, 0,
97 "TrustedBSD mac_mls policy controls");
99 static int mls_label_size = sizeof(struct mac_mls);
100 SYSCTL_INT(_security_mac_mls, OID_AUTO, label_size, CTLFLAG_RD,
101 &mls_label_size, 0, "Size of struct mac_mls");
103 static int mls_enabled = 1;
104 SYSCTL_INT(_security_mac_mls, OID_AUTO, enabled, CTLFLAG_RW, &mls_enabled, 0,
105 "Enforce MAC/MLS policy");
106 TUNABLE_INT("security.mac.mls.enabled", &mls_enabled);
108 static int destroyed_not_inited;
109 SYSCTL_INT(_security_mac_mls, OID_AUTO, destroyed_not_inited, CTLFLAG_RD,
110 &destroyed_not_inited, 0, "Count of labels destroyed but not inited");
112 static int ptys_equal = 0;
113 SYSCTL_INT(_security_mac_mls, OID_AUTO, ptys_equal, CTLFLAG_RW,
114 &ptys_equal, 0, "Label pty devices as mls/equal on create");
115 TUNABLE_INT("security.mac.mls.ptys_equal", &ptys_equal);
117 static int revocation_enabled = 0;
118 SYSCTL_INT(_security_mac_mls, OID_AUTO, revocation_enabled, CTLFLAG_RW,
119 &revocation_enabled, 0, "Revoke access to objects on relabel");
120 TUNABLE_INT("security.mac.mls.revocation_enabled", &revocation_enabled);
122 static int max_compartments = MAC_MLS_MAX_COMPARTMENTS;
123 SYSCTL_INT(_security_mac_mls, OID_AUTO, max_compartments, CTLFLAG_RD,
124 &max_compartments, 0, "Maximum compartments the policy supports");
127 #define SLOT(l) ((struct mac_mls *)mac_label_get((l), mls_slot))
128 #define SLOT_SET(l, val) mac_label_set((l), mls_slot, (uintptr_t)(val))
130 static uma_zone_t zone_mls;
133 mls_bit_set_empty(u_char *set) {
136 for (i = 0; i < MAC_MLS_MAX_COMPARTMENTS >> 3; i++)
142 static struct mac_mls *
146 return (uma_zalloc(zone_mls, flag | M_ZERO));
150 mls_free(struct mac_mls *mm)
154 uma_zfree(zone_mls, mm);
156 atomic_add_int(&destroyed_not_inited, 1);
160 mls_atmostflags(struct mac_mls *mm, int flags)
163 if ((mm->mm_flags & flags) != mm->mm_flags)
169 mls_dominate_element(struct mac_mls_element *a, struct mac_mls_element *b)
173 switch (a->mme_type) {
174 case MAC_MLS_TYPE_EQUAL:
175 case MAC_MLS_TYPE_HIGH:
178 case MAC_MLS_TYPE_LOW:
179 switch (b->mme_type) {
180 case MAC_MLS_TYPE_LEVEL:
181 case MAC_MLS_TYPE_HIGH:
184 case MAC_MLS_TYPE_EQUAL:
185 case MAC_MLS_TYPE_LOW:
189 panic("mls_dominate_element: b->mme_type invalid");
192 case MAC_MLS_TYPE_LEVEL:
193 switch (b->mme_type) {
194 case MAC_MLS_TYPE_EQUAL:
195 case MAC_MLS_TYPE_LOW:
198 case MAC_MLS_TYPE_HIGH:
201 case MAC_MLS_TYPE_LEVEL:
202 for (bit = 1; bit <= MAC_MLS_MAX_COMPARTMENTS; bit++)
203 if (!MAC_MLS_BIT_TEST(bit,
204 a->mme_compartments) &&
205 MAC_MLS_BIT_TEST(bit, b->mme_compartments))
207 return (a->mme_level >= b->mme_level);
210 panic("mls_dominate_element: b->mme_type invalid");
214 panic("mls_dominate_element: a->mme_type invalid");
221 mls_range_in_range(struct mac_mls *rangea, struct mac_mls *rangeb)
224 return (mls_dominate_element(&rangeb->mm_rangehigh,
225 &rangea->mm_rangehigh) &&
226 mls_dominate_element(&rangea->mm_rangelow,
227 &rangeb->mm_rangelow));
231 mls_effective_in_range(struct mac_mls *effective, struct mac_mls *range)
234 KASSERT((effective->mm_flags & MAC_MLS_FLAG_EFFECTIVE) != 0,
235 ("mls_effective_in_range: a not effective"));
236 KASSERT((range->mm_flags & MAC_MLS_FLAG_RANGE) != 0,
237 ("mls_effective_in_range: b not range"));
239 return (mls_dominate_element(&range->mm_rangehigh,
240 &effective->mm_effective) &&
241 mls_dominate_element(&effective->mm_effective,
242 &range->mm_rangelow));
248 mls_dominate_effective(struct mac_mls *a, struct mac_mls *b)
250 KASSERT((a->mm_flags & MAC_MLS_FLAG_EFFECTIVE) != 0,
251 ("mls_dominate_effective: a not effective"));
252 KASSERT((b->mm_flags & MAC_MLS_FLAG_EFFECTIVE) != 0,
253 ("mls_dominate_effective: b not effective"));
255 return (mls_dominate_element(&a->mm_effective, &b->mm_effective));
259 mls_equal_element(struct mac_mls_element *a, struct mac_mls_element *b)
262 if (a->mme_type == MAC_MLS_TYPE_EQUAL ||
263 b->mme_type == MAC_MLS_TYPE_EQUAL)
266 return (a->mme_type == b->mme_type && a->mme_level == b->mme_level);
270 mls_equal_effective(struct mac_mls *a, struct mac_mls *b)
273 KASSERT((a->mm_flags & MAC_MLS_FLAG_EFFECTIVE) != 0,
274 ("mls_equal_effective: a not effective"));
275 KASSERT((b->mm_flags & MAC_MLS_FLAG_EFFECTIVE) != 0,
276 ("mls_equal_effective: b not effective"));
278 return (mls_equal_element(&a->mm_effective, &b->mm_effective));
282 mls_contains_equal(struct mac_mls *mm)
285 if (mm->mm_flags & MAC_MLS_FLAG_EFFECTIVE)
286 if (mm->mm_effective.mme_type == MAC_MLS_TYPE_EQUAL)
289 if (mm->mm_flags & MAC_MLS_FLAG_RANGE) {
290 if (mm->mm_rangelow.mme_type == MAC_MLS_TYPE_EQUAL)
292 if (mm->mm_rangehigh.mme_type == MAC_MLS_TYPE_EQUAL)
300 mls_subject_privileged(struct mac_mls *mm)
303 KASSERT((mm->mm_flags & MAC_MLS_FLAGS_BOTH) == MAC_MLS_FLAGS_BOTH,
304 ("mls_subject_privileged: subject doesn't have both labels"));
306 /* If the effective is EQUAL, it's ok. */
307 if (mm->mm_effective.mme_type == MAC_MLS_TYPE_EQUAL)
310 /* If either range endpoint is EQUAL, it's ok. */
311 if (mm->mm_rangelow.mme_type == MAC_MLS_TYPE_EQUAL ||
312 mm->mm_rangehigh.mme_type == MAC_MLS_TYPE_EQUAL)
315 /* If the range is low-high, it's ok. */
316 if (mm->mm_rangelow.mme_type == MAC_MLS_TYPE_LOW &&
317 mm->mm_rangehigh.mme_type == MAC_MLS_TYPE_HIGH)
325 mls_valid(struct mac_mls *mm)
328 if (mm->mm_flags & MAC_MLS_FLAG_EFFECTIVE) {
329 switch (mm->mm_effective.mme_type) {
330 case MAC_MLS_TYPE_LEVEL:
333 case MAC_MLS_TYPE_EQUAL:
334 case MAC_MLS_TYPE_HIGH:
335 case MAC_MLS_TYPE_LOW:
336 if (mm->mm_effective.mme_level != 0 ||
337 !MAC_MLS_BIT_SET_EMPTY(
338 mm->mm_effective.mme_compartments))
346 if (mm->mm_effective.mme_type != MAC_MLS_TYPE_UNDEF)
350 if (mm->mm_flags & MAC_MLS_FLAG_RANGE) {
351 switch (mm->mm_rangelow.mme_type) {
352 case MAC_MLS_TYPE_LEVEL:
355 case MAC_MLS_TYPE_EQUAL:
356 case MAC_MLS_TYPE_HIGH:
357 case MAC_MLS_TYPE_LOW:
358 if (mm->mm_rangelow.mme_level != 0 ||
359 !MAC_MLS_BIT_SET_EMPTY(
360 mm->mm_rangelow.mme_compartments))
368 switch (mm->mm_rangehigh.mme_type) {
369 case MAC_MLS_TYPE_LEVEL:
372 case MAC_MLS_TYPE_EQUAL:
373 case MAC_MLS_TYPE_HIGH:
374 case MAC_MLS_TYPE_LOW:
375 if (mm->mm_rangehigh.mme_level != 0 ||
376 !MAC_MLS_BIT_SET_EMPTY(
377 mm->mm_rangehigh.mme_compartments))
384 if (!mls_dominate_element(&mm->mm_rangehigh,
388 if (mm->mm_rangelow.mme_type != MAC_MLS_TYPE_UNDEF ||
389 mm->mm_rangehigh.mme_type != MAC_MLS_TYPE_UNDEF)
397 mls_set_range(struct mac_mls *mm, u_short typelow, u_short levellow,
398 u_char *compartmentslow, u_short typehigh, u_short levelhigh,
399 u_char *compartmentshigh)
402 mm->mm_rangelow.mme_type = typelow;
403 mm->mm_rangelow.mme_level = levellow;
404 if (compartmentslow != NULL)
405 memcpy(mm->mm_rangelow.mme_compartments, compartmentslow,
406 sizeof(mm->mm_rangelow.mme_compartments));
407 mm->mm_rangehigh.mme_type = typehigh;
408 mm->mm_rangehigh.mme_level = levelhigh;
409 if (compartmentshigh != NULL)
410 memcpy(mm->mm_rangehigh.mme_compartments, compartmentshigh,
411 sizeof(mm->mm_rangehigh.mme_compartments));
412 mm->mm_flags |= MAC_MLS_FLAG_RANGE;
416 mls_set_effective(struct mac_mls *mm, u_short type, u_short level,
417 u_char *compartments)
420 mm->mm_effective.mme_type = type;
421 mm->mm_effective.mme_level = level;
422 if (compartments != NULL)
423 memcpy(mm->mm_effective.mme_compartments, compartments,
424 sizeof(mm->mm_effective.mme_compartments));
425 mm->mm_flags |= MAC_MLS_FLAG_EFFECTIVE;
429 mls_copy_range(struct mac_mls *labelfrom, struct mac_mls *labelto)
432 KASSERT((labelfrom->mm_flags & MAC_MLS_FLAG_RANGE) != 0,
433 ("mls_copy_range: labelfrom not range"));
435 labelto->mm_rangelow = labelfrom->mm_rangelow;
436 labelto->mm_rangehigh = labelfrom->mm_rangehigh;
437 labelto->mm_flags |= MAC_MLS_FLAG_RANGE;
441 mls_copy_effective(struct mac_mls *labelfrom, struct mac_mls *labelto)
444 KASSERT((labelfrom->mm_flags & MAC_MLS_FLAG_EFFECTIVE) != 0,
445 ("mls_copy_effective: labelfrom not effective"));
447 labelto->mm_effective = labelfrom->mm_effective;
448 labelto->mm_flags |= MAC_MLS_FLAG_EFFECTIVE;
452 mls_copy(struct mac_mls *source, struct mac_mls *dest)
455 if (source->mm_flags & MAC_MLS_FLAG_EFFECTIVE)
456 mls_copy_effective(source, dest);
457 if (source->mm_flags & MAC_MLS_FLAG_RANGE)
458 mls_copy_range(source, dest);
462 * Policy module operations.
465 mls_init(struct mac_policy_conf *conf)
468 zone_mls = uma_zcreate("mac_mls", sizeof(struct mac_mls), NULL,
469 NULL, NULL, NULL, UMA_ALIGN_PTR, 0);
476 mls_init_label(struct label *label)
479 SLOT_SET(label, mls_alloc(M_WAITOK));
483 mls_init_label_waitcheck(struct label *label, int flag)
486 SLOT_SET(label, mls_alloc(flag));
487 if (SLOT(label) == NULL)
494 mls_destroy_label(struct label *label)
497 mls_free(SLOT(label));
498 SLOT_SET(label, NULL);
502 * mls_element_to_string() accepts an sbuf and MLS element. It converts the
503 * MLS element to a string and stores the result in the sbuf; if there isn't
504 * space in the sbuf, -1 is returned.
507 mls_element_to_string(struct sbuf *sb, struct mac_mls_element *element)
511 switch (element->mme_type) {
512 case MAC_MLS_TYPE_HIGH:
513 return (sbuf_printf(sb, "high"));
515 case MAC_MLS_TYPE_LOW:
516 return (sbuf_printf(sb, "low"));
518 case MAC_MLS_TYPE_EQUAL:
519 return (sbuf_printf(sb, "equal"));
521 case MAC_MLS_TYPE_LEVEL:
522 if (sbuf_printf(sb, "%d", element->mme_level) == -1)
526 for (i = 1; i <= MAC_MLS_MAX_COMPARTMENTS; i++) {
527 if (MAC_MLS_BIT_TEST(i, element->mme_compartments)) {
529 if (sbuf_putc(sb, ':') == -1)
531 if (sbuf_printf(sb, "%d", i) == -1)
535 if (sbuf_printf(sb, "+%d", i) == -1)
543 panic("mls_element_to_string: invalid type (%d)",
549 * mls_to_string() converts an MLS label to a string, and places the results
550 * in the passed sbuf. It returns 0 on success, or EINVAL if there isn't
551 * room in the sbuf. Note: the sbuf will be modified even in a failure case,
552 * so the caller may need to revert the sbuf by restoring the offset if
556 mls_to_string(struct sbuf *sb, struct mac_mls *mm)
559 if (mm->mm_flags & MAC_MLS_FLAG_EFFECTIVE) {
560 if (mls_element_to_string(sb, &mm->mm_effective) == -1)
564 if (mm->mm_flags & MAC_MLS_FLAG_RANGE) {
565 if (sbuf_putc(sb, '(') == -1)
568 if (mls_element_to_string(sb, &mm->mm_rangelow) == -1)
571 if (sbuf_putc(sb, '-') == -1)
574 if (mls_element_to_string(sb, &mm->mm_rangehigh) == -1)
577 if (sbuf_putc(sb, ')') == -1)
585 mls_externalize_label(struct label *label, char *element_name,
586 struct sbuf *sb, int *claimed)
590 if (strcmp(MAC_MLS_LABEL_NAME, element_name) != 0)
597 return (mls_to_string(sb, mm));
601 mls_parse_element(struct mac_mls_element *element, char *string)
603 char *compartment, *end, *level;
606 if (strcmp(string, "high") == 0 || strcmp(string, "hi") == 0) {
607 element->mme_type = MAC_MLS_TYPE_HIGH;
608 element->mme_level = MAC_MLS_TYPE_UNDEF;
609 } else if (strcmp(string, "low") == 0 || strcmp(string, "lo") == 0) {
610 element->mme_type = MAC_MLS_TYPE_LOW;
611 element->mme_level = MAC_MLS_TYPE_UNDEF;
612 } else if (strcmp(string, "equal") == 0 ||
613 strcmp(string, "eq") == 0) {
614 element->mme_type = MAC_MLS_TYPE_EQUAL;
615 element->mme_level = MAC_MLS_TYPE_UNDEF;
617 element->mme_type = MAC_MLS_TYPE_LEVEL;
620 * Numeric level piece of the element.
622 level = strsep(&string, ":");
623 value = strtol(level, &end, 10);
624 if (end == level || *end != '\0')
626 if (value < 0 || value > 65535)
628 element->mme_level = value;
631 * Optional compartment piece of the element. If none are
632 * included, we assume that the label has no compartments.
639 while ((compartment = strsep(&string, "+")) != NULL) {
640 value = strtol(compartment, &end, 10);
641 if (compartment == end || *end != '\0')
643 if (value < 1 || value > MAC_MLS_MAX_COMPARTMENTS)
645 MAC_MLS_BIT_SET(value, element->mme_compartments);
653 * Note: destructively consumes the string, make a local copy before calling
654 * if that's a problem.
657 mls_parse(struct mac_mls *mm, char *string)
659 char *rangehigh, *rangelow, *effective;
662 effective = strsep(&string, "(");
663 if (*effective == '\0')
666 if (string != NULL) {
667 rangelow = strsep(&string, "-");
670 rangehigh = strsep(&string, ")");
680 KASSERT((rangelow != NULL && rangehigh != NULL) ||
681 (rangelow == NULL && rangehigh == NULL),
682 ("mls_parse: range mismatch"));
684 bzero(mm, sizeof(*mm));
685 if (effective != NULL) {
686 error = mls_parse_element(&mm->mm_effective, effective);
689 mm->mm_flags |= MAC_MLS_FLAG_EFFECTIVE;
692 if (rangelow != NULL) {
693 error = mls_parse_element(&mm->mm_rangelow, rangelow);
696 error = mls_parse_element(&mm->mm_rangehigh, rangehigh);
699 mm->mm_flags |= MAC_MLS_FLAG_RANGE;
702 error = mls_valid(mm);
710 mls_internalize_label(struct label *label, char *element_name,
711 char *element_data, int *claimed)
713 struct mac_mls *mm, mm_temp;
716 if (strcmp(MAC_MLS_LABEL_NAME, element_name) != 0)
721 error = mls_parse(&mm_temp, element_data);
732 mls_copy_label(struct label *src, struct label *dest)
735 *SLOT(dest) = *SLOT(src);
739 * Object-specific entry point implementations are sorted alphabetically by
740 * object type name and then by operation.
743 mls_bpfdesc_check_receive(struct bpf_d *d, struct label *dlabel,
744 struct ifnet *ifp, struct label *ifplabel)
746 struct mac_mls *a, *b;
754 if (mls_equal_effective(a, b))
760 mls_bpfdesc_create(struct ucred *cred, struct bpf_d *d, struct label *dlabel)
762 struct mac_mls *source, *dest;
764 source = SLOT(cred->cr_label);
767 mls_copy_effective(source, dest);
771 mls_bpfdesc_create_mbuf(struct bpf_d *d, struct label *dlabel,
772 struct mbuf *m, struct label *mlabel)
774 struct mac_mls *source, *dest;
776 source = SLOT(dlabel);
779 mls_copy_effective(source, dest);
783 mls_cred_associate_nfsd(struct ucred *cred)
785 struct mac_mls *label;
787 label = SLOT(cred->cr_label);
788 mls_set_effective(label, MAC_MLS_TYPE_LOW, 0, NULL);
789 mls_set_range(label, MAC_MLS_TYPE_LOW, 0, NULL, MAC_MLS_TYPE_HIGH, 0,
794 mls_cred_check_relabel(struct ucred *cred, struct label *newlabel)
796 struct mac_mls *subj, *new;
799 subj = SLOT(cred->cr_label);
800 new = SLOT(newlabel);
803 * If there is an MLS label update for the credential, it may be an
804 * update of effective, range, or both.
806 error = mls_atmostflags(new, MAC_MLS_FLAGS_BOTH);
811 * If the MLS label is to be changed, authorize as appropriate.
813 if (new->mm_flags & MAC_MLS_FLAGS_BOTH) {
815 * If the change request modifies both the MLS label
816 * effective and range, check that the new effective will be
819 if ((new->mm_flags & MAC_MLS_FLAGS_BOTH) ==
820 MAC_MLS_FLAGS_BOTH && !mls_effective_in_range(new, new))
824 * To change the MLS effective label on a credential, the new
825 * effective label must be in the current range.
827 if (new->mm_flags & MAC_MLS_FLAG_EFFECTIVE &&
828 !mls_effective_in_range(new, subj))
832 * To change the MLS range label on a credential, the new
833 * range must be in the current range.
835 if (new->mm_flags & MAC_MLS_FLAG_RANGE &&
836 !mls_range_in_range(new, subj))
840 * To have EQUAL in any component of the new credential MLS
841 * label, the subject must already have EQUAL in their label.
843 if (mls_contains_equal(new)) {
844 error = mls_subject_privileged(subj);
854 mls_cred_check_visible(struct ucred *cr1, struct ucred *cr2)
856 struct mac_mls *subj, *obj;
861 subj = SLOT(cr1->cr_label);
862 obj = SLOT(cr2->cr_label);
865 if (!mls_dominate_effective(subj, obj))
872 mls_cred_create_init(struct ucred *cred)
874 struct mac_mls *dest;
876 dest = SLOT(cred->cr_label);
878 mls_set_effective(dest, MAC_MLS_TYPE_LOW, 0, NULL);
879 mls_set_range(dest, MAC_MLS_TYPE_LOW, 0, NULL, MAC_MLS_TYPE_HIGH, 0,
884 mls_cred_create_swapper(struct ucred *cred)
886 struct mac_mls *dest;
888 dest = SLOT(cred->cr_label);
890 mls_set_effective(dest, MAC_MLS_TYPE_EQUAL, 0, NULL);
891 mls_set_range(dest, MAC_MLS_TYPE_LOW, 0, NULL, MAC_MLS_TYPE_HIGH, 0,
896 mls_cred_relabel(struct ucred *cred, struct label *newlabel)
898 struct mac_mls *source, *dest;
900 source = SLOT(newlabel);
901 dest = SLOT(cred->cr_label);
903 mls_copy(source, dest);
907 mls_devfs_create_device(struct ucred *cred, struct mount *mp,
908 struct cdev *dev, struct devfs_dirent *de, struct label *delabel)
916 if (strcmp(dn, "null") == 0 ||
917 strcmp(dn, "zero") == 0 ||
918 strcmp(dn, "random") == 0 ||
919 strncmp(dn, "fd/", strlen("fd/")) == 0)
920 mls_type = MAC_MLS_TYPE_EQUAL;
921 else if (strcmp(dn, "kmem") == 0 ||
922 strcmp(dn, "mem") == 0)
923 mls_type = MAC_MLS_TYPE_HIGH;
924 else if (ptys_equal &&
925 (strncmp(dn, "ttyp", strlen("ttyp")) == 0 ||
926 strncmp(dn, "pts/", strlen("pts/")) == 0 ||
927 strncmp(dn, "ptyp", strlen("ptyp")) == 0))
928 mls_type = MAC_MLS_TYPE_EQUAL;
930 mls_type = MAC_MLS_TYPE_LOW;
931 mls_set_effective(mm, mls_type, 0, NULL);
935 mls_devfs_create_directory(struct mount *mp, char *dirname, int dirnamelen,
936 struct devfs_dirent *de, struct label *delabel)
941 mls_set_effective(mm, MAC_MLS_TYPE_LOW, 0, NULL);
945 mls_devfs_create_symlink(struct ucred *cred, struct mount *mp,
946 struct devfs_dirent *dd, struct label *ddlabel, struct devfs_dirent *de,
947 struct label *delabel)
949 struct mac_mls *source, *dest;
951 source = SLOT(cred->cr_label);
952 dest = SLOT(delabel);
954 mls_copy_effective(source, dest);
958 mls_devfs_update(struct mount *mp, struct devfs_dirent *de,
959 struct label *delabel, struct vnode *vp, struct label *vplabel)
961 struct mac_mls *source, *dest;
963 source = SLOT(vplabel);
964 dest = SLOT(delabel);
966 mls_copy_effective(source, dest);
970 mls_devfs_vnode_associate(struct mount *mp, struct label *mplabel,
971 struct devfs_dirent *de, struct label *delabel, struct vnode *vp,
972 struct label *vplabel)
974 struct mac_mls *source, *dest;
976 source = SLOT(delabel);
977 dest = SLOT(vplabel);
979 mls_copy_effective(source, dest);
983 mls_ifnet_check_relabel(struct ucred *cred, struct ifnet *ifp,
984 struct label *ifplabel, struct label *newlabel)
986 struct mac_mls *subj, *new;
989 subj = SLOT(cred->cr_label);
990 new = SLOT(newlabel);
993 * If there is an MLS label update for the interface, it may be an
994 * update of effective, range, or both.
996 error = mls_atmostflags(new, MAC_MLS_FLAGS_BOTH);
1001 * Relabeling network interfaces requires MLS privilege.
1003 return (mls_subject_privileged(subj));
1007 mls_ifnet_check_transmit(struct ifnet *ifp, struct label *ifplabel,
1008 struct mbuf *m, struct label *mlabel)
1010 struct mac_mls *p, *i;
1018 return (mls_effective_in_range(p, i) ? 0 : EACCES);
1022 mls_ifnet_create(struct ifnet *ifp, struct label *ifplabel)
1024 struct mac_mls *dest;
1027 dest = SLOT(ifplabel);
1029 if (ifp->if_type == IFT_LOOP)
1030 type = MAC_MLS_TYPE_EQUAL;
1032 type = MAC_MLS_TYPE_LOW;
1034 mls_set_effective(dest, type, 0, NULL);
1035 mls_set_range(dest, type, 0, NULL, type, 0, NULL);
1039 mls_ifnet_create_mbuf(struct ifnet *ifp, struct label *ifplabel,
1040 struct mbuf *m, struct label *mlabel)
1042 struct mac_mls *source, *dest;
1044 source = SLOT(ifplabel);
1045 dest = SLOT(mlabel);
1047 mls_copy_effective(source, dest);
1051 mls_ifnet_relabel(struct ucred *cred, struct ifnet *ifp,
1052 struct label *ifplabel, struct label *newlabel)
1054 struct mac_mls *source, *dest;
1056 source = SLOT(newlabel);
1057 dest = SLOT(ifplabel);
1059 mls_copy(source, dest);
1063 mls_inpcb_check_deliver(struct inpcb *inp, struct label *inplabel,
1064 struct mbuf *m, struct label *mlabel)
1066 struct mac_mls *p, *i;
1074 return (mls_equal_effective(p, i) ? 0 : EACCES);
1078 mls_inpcb_check_visible(struct ucred *cred, struct inpcb *inp,
1079 struct label *inplabel)
1081 struct mac_mls *subj, *obj;
1086 subj = SLOT(cred->cr_label);
1087 obj = SLOT(inplabel);
1089 if (!mls_dominate_effective(subj, obj))
1096 mls_inpcb_create(struct socket *so, struct label *solabel, struct inpcb *inp,
1097 struct label *inplabel)
1099 struct mac_mls *source, *dest;
1101 source = SLOT(solabel);
1102 dest = SLOT(inplabel);
1104 mls_copy_effective(source, dest);
1108 mls_inpcb_create_mbuf(struct inpcb *inp, struct label *inplabel,
1109 struct mbuf *m, struct label *mlabel)
1111 struct mac_mls *source, *dest;
1113 source = SLOT(inplabel);
1114 dest = SLOT(mlabel);
1116 mls_copy_effective(source, dest);
1120 mls_inpcb_sosetlabel(struct socket *so, struct label *solabel,
1121 struct inpcb *inp, struct label *inplabel)
1123 struct mac_mls *source, *dest;
1125 SOCK_LOCK_ASSERT(so);
1127 source = SLOT(solabel);
1128 dest = SLOT(inplabel);
1130 mls_copy(source, dest);
1134 mls_ip6q_create(struct mbuf *m, struct label *mlabel, struct ip6q *q6,
1135 struct label *q6label)
1137 struct mac_mls *source, *dest;
1139 source = SLOT(mlabel);
1140 dest = SLOT(q6label);
1142 mls_copy_effective(source, dest);
1146 mls_ip6q_match(struct mbuf *m, struct label *mlabel, struct ip6q *q6,
1147 struct label *q6label)
1149 struct mac_mls *a, *b;
1154 return (mls_equal_effective(a, b));
1158 mls_ip6q_reassemble(struct ip6q *q6, struct label *q6label, struct mbuf *m,
1159 struct label *mlabel)
1161 struct mac_mls *source, *dest;
1163 source = SLOT(q6label);
1164 dest = SLOT(mlabel);
1166 /* Just use the head, since we require them all to match. */
1167 mls_copy_effective(source, dest);
1171 mls_ip6q_update(struct mbuf *m, struct label *mlabel, struct ip6q *q6,
1172 struct label *q6label)
1175 /* NOOP: we only accept matching labels, so no need to update */
1179 mls_ipq_create(struct mbuf *m, struct label *mlabel, struct ipq *q,
1180 struct label *qlabel)
1182 struct mac_mls *source, *dest;
1184 source = SLOT(mlabel);
1185 dest = SLOT(qlabel);
1187 mls_copy_effective(source, dest);
1191 mls_ipq_match(struct mbuf *m, struct label *mlabel, struct ipq *q,
1192 struct label *qlabel)
1194 struct mac_mls *a, *b;
1199 return (mls_equal_effective(a, b));
1203 mls_ipq_reassemble(struct ipq *q, struct label *qlabel, struct mbuf *m,
1204 struct label *mlabel)
1206 struct mac_mls *source, *dest;
1208 source = SLOT(qlabel);
1209 dest = SLOT(mlabel);
1211 /* Just use the head, since we require them all to match. */
1212 mls_copy_effective(source, dest);
1216 mls_ipq_update(struct mbuf *m, struct label *mlabel, struct ipq *q,
1217 struct label *qlabel)
1220 /* NOOP: we only accept matching labels, so no need to update */
1224 mls_mount_check_stat(struct ucred *cred, struct mount *mp,
1225 struct label *mntlabel)
1227 struct mac_mls *subj, *obj;
1232 subj = SLOT(cred->cr_label);
1233 obj = SLOT(mntlabel);
1235 if (!mls_dominate_effective(subj, obj))
1242 mls_mount_create(struct ucred *cred, struct mount *mp, struct label *mplabel)
1244 struct mac_mls *source, *dest;
1246 source = SLOT(cred->cr_label);
1247 dest = SLOT(mplabel);
1249 mls_copy_effective(source, dest);
1253 mls_netatalk_aarp_send(struct ifnet *ifp, struct label *ifplabel,
1254 struct mbuf *m, struct label *mlabel)
1256 struct mac_mls *dest;
1258 dest = SLOT(mlabel);
1260 mls_set_effective(dest, MAC_MLS_TYPE_EQUAL, 0, NULL);
1264 mls_netinet_arp_send(struct ifnet *ifp, struct label *ifplabel,
1265 struct mbuf *m, struct label *mlabel)
1267 struct mac_mls *dest;
1269 dest = SLOT(mlabel);
1271 mls_set_effective(dest, MAC_MLS_TYPE_EQUAL, 0, NULL);
1275 mls_netinet_firewall_reply(struct mbuf *mrecv, struct label *mrecvlabel,
1276 struct mbuf *msend, struct label *msendlabel)
1278 struct mac_mls *source, *dest;
1280 source = SLOT(mrecvlabel);
1281 dest = SLOT(msendlabel);
1283 mls_copy_effective(source, dest);
1287 mls_netinet_firewall_send(struct mbuf *m, struct label *mlabel)
1289 struct mac_mls *dest;
1291 dest = SLOT(mlabel);
1293 /* XXX: where is the label for the firewall really comming from? */
1294 mls_set_effective(dest, MAC_MLS_TYPE_EQUAL, 0, NULL);
1298 mls_netinet_fragment(struct mbuf *m, struct label *mlabel, struct mbuf *frag,
1299 struct label *fraglabel)
1301 struct mac_mls *source, *dest;
1303 source = SLOT(mlabel);
1304 dest = SLOT(fraglabel);
1306 mls_copy_effective(source, dest);
1310 mls_netinet_icmp_reply(struct mbuf *mrecv, struct label *mrecvlabel,
1311 struct mbuf *msend, struct label *msendlabel)
1313 struct mac_mls *source, *dest;
1315 source = SLOT(mrecvlabel);
1316 dest = SLOT(msendlabel);
1318 mls_copy_effective(source, dest);
1322 mls_netinet_igmp_send(struct ifnet *ifp, struct label *ifplabel,
1323 struct mbuf *m, struct label *mlabel)
1325 struct mac_mls *dest;
1327 dest = SLOT(mlabel);
1329 mls_set_effective(dest, MAC_MLS_TYPE_EQUAL, 0, NULL);
1333 mls_netinet6_nd6_send(struct ifnet *ifp, struct label *ifplabel,
1334 struct mbuf *m, struct label *mlabel)
1336 struct mac_mls *dest;
1338 dest = SLOT(mlabel);
1340 mls_set_effective(dest, MAC_MLS_TYPE_EQUAL, 0, NULL);
1344 mls_pipe_check_ioctl(struct ucred *cred, struct pipepair *pp,
1345 struct label *pplabel, unsigned long cmd, void /* caddr_t */ *data)
1351 /* XXX: This will be implemented soon... */
1357 mls_pipe_check_poll(struct ucred *cred, struct pipepair *pp,
1358 struct label *pplabel)
1360 struct mac_mls *subj, *obj;
1365 subj = SLOT(cred->cr_label);
1366 obj = SLOT(pplabel);
1368 if (!mls_dominate_effective(subj, obj))
1375 mls_pipe_check_read(struct ucred *cred, struct pipepair *pp,
1376 struct label *pplabel)
1378 struct mac_mls *subj, *obj;
1383 subj = SLOT(cred->cr_label);
1384 obj = SLOT(pplabel);
1386 if (!mls_dominate_effective(subj, obj))
1393 mls_pipe_check_relabel(struct ucred *cred, struct pipepair *pp,
1394 struct label *pplabel, struct label *newlabel)
1396 struct mac_mls *subj, *obj, *new;
1399 new = SLOT(newlabel);
1400 subj = SLOT(cred->cr_label);
1401 obj = SLOT(pplabel);
1404 * If there is an MLS label update for a pipe, it must be a effective
1407 error = mls_atmostflags(new, MAC_MLS_FLAG_EFFECTIVE);
1412 * To perform a relabel of a pipe (MLS label or not), MLS must
1413 * authorize the relabel.
1415 if (!mls_effective_in_range(obj, subj))
1419 * If the MLS label is to be changed, authorize as appropriate.
1421 if (new->mm_flags & MAC_MLS_FLAG_EFFECTIVE) {
1423 * To change the MLS label on a pipe, the new pipe label must
1424 * be in the subject range.
1426 if (!mls_effective_in_range(new, subj))
1430 * To change the MLS label on a pipe to be EQUAL, the subject
1431 * must have appropriate privilege.
1433 if (mls_contains_equal(new)) {
1434 error = mls_subject_privileged(subj);
1444 mls_pipe_check_stat(struct ucred *cred, struct pipepair *pp,
1445 struct label *pplabel)
1447 struct mac_mls *subj, *obj;
1452 subj = SLOT(cred->cr_label);
1453 obj = SLOT(pplabel);
1455 if (!mls_dominate_effective(subj, obj))
1462 mls_pipe_check_write(struct ucred *cred, struct pipepair *pp,
1463 struct label *pplabel)
1465 struct mac_mls *subj, *obj;
1470 subj = SLOT(cred->cr_label);
1471 obj = SLOT(pplabel);
1473 if (!mls_dominate_effective(obj, subj))
1480 mls_pipe_create(struct ucred *cred, struct pipepair *pp,
1481 struct label *pplabel)
1483 struct mac_mls *source, *dest;
1485 source = SLOT(cred->cr_label);
1486 dest = SLOT(pplabel);
1488 mls_copy_effective(source, dest);
1492 mls_pipe_relabel(struct ucred *cred, struct pipepair *pp,
1493 struct label *pplabel, struct label *newlabel)
1495 struct mac_mls *source, *dest;
1497 source = SLOT(newlabel);
1498 dest = SLOT(pplabel);
1500 mls_copy(source, dest);
1504 mls_posixsem_check_openunlink(struct ucred *cred, struct ksem *ks,
1505 struct label *kslabel)
1507 struct mac_mls *subj, *obj;
1512 subj = SLOT(cred->cr_label);
1513 obj = SLOT(kslabel);
1515 if (!mls_dominate_effective(obj, subj))
1522 mls_posixsem_check_rdonly(struct ucred *active_cred, struct ucred *file_cred,
1523 struct ksem *ks, struct label *kslabel)
1525 struct mac_mls *subj, *obj;
1530 subj = SLOT(active_cred->cr_label);
1531 obj = SLOT(kslabel);
1533 if (!mls_dominate_effective(subj, obj))
1540 mls_posixsem_check_setmode(struct ucred *cred, struct ksem *ks,
1541 struct label *shmlabel, mode_t mode)
1543 struct mac_mls *subj, *obj;
1548 subj = SLOT(cred->cr_label);
1549 obj = SLOT(shmlabel);
1551 if (!mls_dominate_effective(obj, subj))
1558 mls_posixsem_check_setowner(struct ucred *cred, struct ksem *ks,
1559 struct label *shmlabel, uid_t uid, gid_t gid)
1561 struct mac_mls *subj, *obj;
1566 subj = SLOT(cred->cr_label);
1567 obj = SLOT(shmlabel);
1569 if (!mls_dominate_effective(obj, subj))
1576 mls_posixsem_check_write(struct ucred *active_cred, struct ucred *file_cred,
1577 struct ksem *ks, struct label *kslabel)
1579 struct mac_mls *subj, *obj;
1584 subj = SLOT(active_cred->cr_label);
1585 obj = SLOT(kslabel);
1587 if (!mls_dominate_effective(obj, subj))
1594 mls_posixsem_create(struct ucred *cred, struct ksem *ks,
1595 struct label *kslabel)
1597 struct mac_mls *source, *dest;
1599 source = SLOT(cred->cr_label);
1600 dest = SLOT(kslabel);
1602 mls_copy_effective(source, dest);
1606 mls_posixshm_check_mmap(struct ucred *cred, struct shmfd *shmfd,
1607 struct label *shmlabel, int prot, int flags)
1609 struct mac_mls *subj, *obj;
1614 subj = SLOT(cred->cr_label);
1615 obj = SLOT(shmlabel);
1617 if (prot & (VM_PROT_READ | VM_PROT_EXECUTE)) {
1618 if (!mls_dominate_effective(subj, obj))
1621 if (((prot & VM_PROT_WRITE) != 0) && ((flags & MAP_SHARED) != 0)) {
1622 if (!mls_dominate_effective(obj, subj))
1630 mls_posixshm_check_open(struct ucred *cred, struct shmfd *shmfd,
1631 struct label *shmlabel, accmode_t accmode)
1633 struct mac_mls *subj, *obj;
1638 subj = SLOT(cred->cr_label);
1639 obj = SLOT(shmlabel);
1641 if (accmode & (VREAD | VEXEC | VSTAT_PERMS)) {
1642 if (!mls_dominate_effective(subj, obj))
1645 if (accmode & VMODIFY_PERMS) {
1646 if (!mls_dominate_effective(obj, subj))
1654 mls_posixshm_check_read(struct ucred *active_cred, struct ucred *file_cred,
1655 struct shmfd *shm, struct label *shmlabel)
1657 struct mac_mls *subj, *obj;
1659 if (!mls_enabled || !revocation_enabled)
1662 subj = SLOT(active_cred->cr_label);
1663 obj = SLOT(shmlabel);
1665 if (!mls_dominate_effective(subj, obj))
1672 mls_posixshm_check_setmode(struct ucred *cred, struct shmfd *shmfd,
1673 struct label *shmlabel, mode_t mode)
1675 struct mac_mls *subj, *obj;
1680 subj = SLOT(cred->cr_label);
1681 obj = SLOT(shmlabel);
1683 if (!mls_dominate_effective(obj, subj))
1690 mls_posixshm_check_setowner(struct ucred *cred, struct shmfd *shmfd,
1691 struct label *shmlabel, uid_t uid, gid_t gid)
1693 struct mac_mls *subj, *obj;
1698 subj = SLOT(cred->cr_label);
1699 obj = SLOT(shmlabel);
1701 if (!mls_dominate_effective(obj, subj))
1708 mls_posixshm_check_stat(struct ucred *active_cred, struct ucred *file_cred,
1709 struct shmfd *shmfd, struct label *shmlabel)
1711 struct mac_mls *subj, *obj;
1716 subj = SLOT(active_cred->cr_label);
1717 obj = SLOT(shmlabel);
1719 if (!mls_dominate_effective(subj, obj))
1726 mls_posixshm_check_truncate(struct ucred *active_cred,
1727 struct ucred *file_cred, struct shmfd *shmfd, struct label *shmlabel)
1729 struct mac_mls *subj, *obj;
1734 subj = SLOT(active_cred->cr_label);
1735 obj = SLOT(shmlabel);
1737 if (!mls_dominate_effective(obj, subj))
1744 mls_posixshm_check_unlink(struct ucred *cred, struct shmfd *shmfd,
1745 struct label *shmlabel)
1747 struct mac_mls *subj, *obj;
1752 subj = SLOT(cred->cr_label);
1753 obj = SLOT(shmlabel);
1755 if (!mls_dominate_effective(obj, subj))
1762 mls_posixshm_check_write(struct ucred *active_cred, struct ucred *file_cred,
1763 struct shmfd *shm, struct label *shmlabel)
1765 struct mac_mls *subj, *obj;
1767 if (!mls_enabled || !revocation_enabled)
1770 subj = SLOT(active_cred->cr_label);
1771 obj = SLOT(shmlabel);
1773 if (!mls_dominate_effective(subj, obj))
1780 mls_posixshm_create(struct ucred *cred, struct shmfd *shmfd,
1781 struct label *shmlabel)
1783 struct mac_mls *source, *dest;
1785 source = SLOT(cred->cr_label);
1786 dest = SLOT(shmlabel);
1788 mls_copy_effective(source, dest);
1792 mls_proc_check_debug(struct ucred *cred, struct proc *p)
1794 struct mac_mls *subj, *obj;
1799 subj = SLOT(cred->cr_label);
1800 obj = SLOT(p->p_ucred->cr_label);
1802 /* XXX: range checks */
1803 if (!mls_dominate_effective(subj, obj))
1805 if (!mls_dominate_effective(obj, subj))
1812 mls_proc_check_sched(struct ucred *cred, struct proc *p)
1814 struct mac_mls *subj, *obj;
1819 subj = SLOT(cred->cr_label);
1820 obj = SLOT(p->p_ucred->cr_label);
1822 /* XXX: range checks */
1823 if (!mls_dominate_effective(subj, obj))
1825 if (!mls_dominate_effective(obj, subj))
1832 mls_proc_check_signal(struct ucred *cred, struct proc *p, int signum)
1834 struct mac_mls *subj, *obj;
1839 subj = SLOT(cred->cr_label);
1840 obj = SLOT(p->p_ucred->cr_label);
1842 /* XXX: range checks */
1843 if (!mls_dominate_effective(subj, obj))
1845 if (!mls_dominate_effective(obj, subj))
1852 mls_socket_check_deliver(struct socket *so, struct label *solabel,
1853 struct mbuf *m, struct label *mlabel)
1855 struct mac_mls *p, *s;
1865 error = mls_equal_effective(p, s) ? 0 : EACCES;
1872 mls_socket_check_relabel(struct ucred *cred, struct socket *so,
1873 struct label *solabel, struct label *newlabel)
1875 struct mac_mls *subj, *obj, *new;
1878 SOCK_LOCK_ASSERT(so);
1880 new = SLOT(newlabel);
1881 subj = SLOT(cred->cr_label);
1882 obj = SLOT(solabel);
1885 * If there is an MLS label update for the socket, it may be an
1886 * update of effective.
1888 error = mls_atmostflags(new, MAC_MLS_FLAG_EFFECTIVE);
1893 * To relabel a socket, the old socket effective must be in the
1896 if (!mls_effective_in_range(obj, subj))
1900 * If the MLS label is to be changed, authorize as appropriate.
1902 if (new->mm_flags & MAC_MLS_FLAG_EFFECTIVE) {
1904 * To relabel a socket, the new socket effective must be in
1905 * the subject range.
1907 if (!mls_effective_in_range(new, subj))
1911 * To change the MLS label on the socket to contain EQUAL,
1912 * the subject must have appropriate privilege.
1914 if (mls_contains_equal(new)) {
1915 error = mls_subject_privileged(subj);
1925 mls_socket_check_visible(struct ucred *cred, struct socket *so,
1926 struct label *solabel)
1928 struct mac_mls *subj, *obj;
1933 subj = SLOT(cred->cr_label);
1934 obj = SLOT(solabel);
1937 if (!mls_dominate_effective(subj, obj)) {
1947 mls_socket_create(struct ucred *cred, struct socket *so,
1948 struct label *solabel)
1950 struct mac_mls *source, *dest;
1952 source = SLOT(cred->cr_label);
1953 dest = SLOT(solabel);
1955 mls_copy_effective(source, dest);
1959 mls_socket_create_mbuf(struct socket *so, struct label *solabel,
1960 struct mbuf *m, struct label *mlabel)
1962 struct mac_mls *source, *dest;
1964 source = SLOT(solabel);
1965 dest = SLOT(mlabel);
1968 mls_copy_effective(source, dest);
1973 mls_socket_newconn(struct socket *oldso, struct label *oldsolabel,
1974 struct socket *newso, struct label *newsolabel)
1976 struct mac_mls source, *dest;
1979 source = *SLOT(oldsolabel);
1982 dest = SLOT(newsolabel);
1985 mls_copy_effective(&source, dest);
1990 mls_socket_relabel(struct ucred *cred, struct socket *so,
1991 struct label *solabel, struct label *newlabel)
1993 struct mac_mls *source, *dest;
1995 SOCK_LOCK_ASSERT(so);
1997 source = SLOT(newlabel);
1998 dest = SLOT(solabel);
2000 mls_copy(source, dest);
2004 mls_socketpeer_set_from_mbuf(struct mbuf *m, struct label *mlabel,
2005 struct socket *so, struct label *sopeerlabel)
2007 struct mac_mls *source, *dest;
2009 source = SLOT(mlabel);
2010 dest = SLOT(sopeerlabel);
2013 mls_copy_effective(source, dest);
2018 mls_socketpeer_set_from_socket(struct socket *oldso,
2019 struct label *oldsolabel, struct socket *newso,
2020 struct label *newsopeerlabel)
2022 struct mac_mls source, *dest;
2025 source = *SLOT(oldsolabel);
2028 dest = SLOT(newsopeerlabel);
2031 mls_copy_effective(&source, dest);
2036 mls_syncache_create(struct label *label, struct inpcb *inp)
2038 struct mac_mls *source, *dest;
2040 source = SLOT(inp->inp_label);
2043 mls_copy_effective(source, dest);
2047 mls_syncache_create_mbuf(struct label *sc_label, struct mbuf *m,
2048 struct label *mlabel)
2050 struct mac_mls *source, *dest;
2052 source = SLOT(sc_label);
2053 dest = SLOT(mlabel);
2055 mls_copy_effective(source, dest);
2059 mls_system_check_acct(struct ucred *cred, struct vnode *vp,
2060 struct label *vplabel)
2062 struct mac_mls *subj, *obj;
2067 if (vplabel == NULL)
2070 subj = SLOT(cred->cr_label);
2071 obj = SLOT(vplabel);
2073 if (!mls_dominate_effective(obj, subj) ||
2074 !mls_dominate_effective(subj, obj))
2081 mls_system_check_auditctl(struct ucred *cred, struct vnode *vp,
2082 struct label *vplabel)
2084 struct mac_mls *subj, *obj;
2089 subj = SLOT(cred->cr_label);
2090 obj = SLOT(vplabel);
2092 if (!mls_dominate_effective(obj, subj) ||
2093 !mls_dominate_effective(subj, obj))
2100 mls_system_check_swapon(struct ucred *cred, struct vnode *vp,
2101 struct label *vplabel)
2103 struct mac_mls *subj, *obj;
2108 subj = SLOT(cred->cr_label);
2109 obj = SLOT(vplabel);
2111 if (!mls_dominate_effective(obj, subj) ||
2112 !mls_dominate_effective(subj, obj))
2119 mls_sysvmsg_cleanup(struct label *msglabel)
2122 bzero(SLOT(msglabel), sizeof(struct mac_mls));
2126 mls_sysvmsg_create(struct ucred *cred, struct msqid_kernel *msqkptr,
2127 struct label *msqlabel, struct msg *msgptr, struct label *msglabel)
2129 struct mac_mls *source, *dest;
2131 /* Ignore the msgq label. */
2132 source = SLOT(cred->cr_label);
2133 dest = SLOT(msglabel);
2135 mls_copy_effective(source, dest);
2139 mls_sysvmsq_check_msgrcv(struct ucred *cred, struct msg *msgptr,
2140 struct label *msglabel)
2142 struct mac_mls *subj, *obj;
2147 subj = SLOT(cred->cr_label);
2148 obj = SLOT(msglabel);
2150 if (!mls_dominate_effective(subj, obj))
2157 mls_sysvmsq_check_msgrmid(struct ucred *cred, struct msg *msgptr,
2158 struct label *msglabel)
2160 struct mac_mls *subj, *obj;
2165 subj = SLOT(cred->cr_label);
2166 obj = SLOT(msglabel);
2168 if (!mls_dominate_effective(obj, subj))
2175 mls_sysvmsq_check_msqget(struct ucred *cred, struct msqid_kernel *msqkptr,
2176 struct label *msqklabel)
2178 struct mac_mls *subj, *obj;
2183 subj = SLOT(cred->cr_label);
2184 obj = SLOT(msqklabel);
2186 if (!mls_dominate_effective(subj, obj))
2193 mls_sysvmsq_check_msqsnd(struct ucred *cred, struct msqid_kernel *msqkptr,
2194 struct label *msqklabel)
2196 struct mac_mls *subj, *obj;
2201 subj = SLOT(cred->cr_label);
2202 obj = SLOT(msqklabel);
2204 if (!mls_dominate_effective(obj, subj))
2211 mls_sysvmsq_check_msqrcv(struct ucred *cred, struct msqid_kernel *msqkptr,
2212 struct label *msqklabel)
2214 struct mac_mls *subj, *obj;
2219 subj = SLOT(cred->cr_label);
2220 obj = SLOT(msqklabel);
2222 if (!mls_dominate_effective(subj, obj))
2229 mls_sysvmsq_check_msqctl(struct ucred *cred, struct msqid_kernel *msqkptr,
2230 struct label *msqklabel, int cmd)
2232 struct mac_mls *subj, *obj;
2237 subj = SLOT(cred->cr_label);
2238 obj = SLOT(msqklabel);
2243 if (!mls_dominate_effective(obj, subj))
2248 if (!mls_dominate_effective(subj, obj))
2260 mls_sysvmsq_cleanup(struct label *msqlabel)
2263 bzero(SLOT(msqlabel), sizeof(struct mac_mls));
2267 mls_sysvmsq_create(struct ucred *cred, struct msqid_kernel *msqkptr,
2268 struct label *msqlabel)
2270 struct mac_mls *source, *dest;
2272 source = SLOT(cred->cr_label);
2273 dest = SLOT(msqlabel);
2275 mls_copy_effective(source, dest);
2279 mls_sysvsem_check_semctl(struct ucred *cred, struct semid_kernel *semakptr,
2280 struct label *semaklabel, int cmd)
2282 struct mac_mls *subj, *obj;
2287 subj = SLOT(cred->cr_label);
2288 obj = SLOT(semaklabel);
2295 if (!mls_dominate_effective(obj, subj))
2305 if (!mls_dominate_effective(subj, obj))
2317 mls_sysvsem_check_semget(struct ucred *cred, struct semid_kernel *semakptr,
2318 struct label *semaklabel)
2320 struct mac_mls *subj, *obj;
2325 subj = SLOT(cred->cr_label);
2326 obj = SLOT(semaklabel);
2328 if (!mls_dominate_effective(subj, obj))
2335 mls_sysvsem_check_semop(struct ucred *cred, struct semid_kernel *semakptr,
2336 struct label *semaklabel, size_t accesstype)
2338 struct mac_mls *subj, *obj;
2343 subj = SLOT(cred->cr_label);
2344 obj = SLOT(semaklabel);
2346 if( accesstype & SEM_R )
2347 if (!mls_dominate_effective(subj, obj))
2350 if( accesstype & SEM_A )
2351 if (!mls_dominate_effective(obj, subj))
2358 mls_sysvsem_cleanup(struct label *semalabel)
2361 bzero(SLOT(semalabel), sizeof(struct mac_mls));
2365 mls_sysvsem_create(struct ucred *cred, struct semid_kernel *semakptr,
2366 struct label *semalabel)
2368 struct mac_mls *source, *dest;
2370 source = SLOT(cred->cr_label);
2371 dest = SLOT(semalabel);
2373 mls_copy_effective(source, dest);
2377 mls_sysvshm_check_shmat(struct ucred *cred, struct shmid_kernel *shmsegptr,
2378 struct label *shmseglabel, int shmflg)
2380 struct mac_mls *subj, *obj;
2385 subj = SLOT(cred->cr_label);
2386 obj = SLOT(shmseglabel);
2388 if (!mls_dominate_effective(subj, obj))
2390 if ((shmflg & SHM_RDONLY) == 0) {
2391 if (!mls_dominate_effective(obj, subj))
2399 mls_sysvshm_check_shmctl(struct ucred *cred, struct shmid_kernel *shmsegptr,
2400 struct label *shmseglabel, int cmd)
2402 struct mac_mls *subj, *obj;
2407 subj = SLOT(cred->cr_label);
2408 obj = SLOT(shmseglabel);
2413 if (!mls_dominate_effective(obj, subj))
2419 if (!mls_dominate_effective(subj, obj))
2431 mls_sysvshm_check_shmget(struct ucred *cred, struct shmid_kernel *shmsegptr,
2432 struct label *shmseglabel, int shmflg)
2434 struct mac_mls *subj, *obj;
2439 subj = SLOT(cred->cr_label);
2440 obj = SLOT(shmseglabel);
2442 if (!mls_dominate_effective(obj, subj))
2449 mls_sysvshm_cleanup(struct label *shmlabel)
2452 bzero(SLOT(shmlabel), sizeof(struct mac_mls));
2456 mls_sysvshm_create(struct ucred *cred, struct shmid_kernel *shmsegptr,
2457 struct label *shmlabel)
2459 struct mac_mls *source, *dest;
2461 source = SLOT(cred->cr_label);
2462 dest = SLOT(shmlabel);
2464 mls_copy_effective(source, dest);
2468 mls_vnode_associate_extattr(struct mount *mp, struct label *mplabel,
2469 struct vnode *vp, struct label *vplabel)
2471 struct mac_mls mm_temp, *source, *dest;
2474 source = SLOT(mplabel);
2475 dest = SLOT(vplabel);
2477 buflen = sizeof(mm_temp);
2478 bzero(&mm_temp, buflen);
2480 error = vn_extattr_get(vp, IO_NODELOCKED, MAC_MLS_EXTATTR_NAMESPACE,
2481 MAC_MLS_EXTATTR_NAME, &buflen, (char *) &mm_temp, curthread);
2482 if (error == ENOATTR || error == EOPNOTSUPP) {
2483 /* Fall back to the mntlabel. */
2484 mls_copy_effective(source, dest);
2489 if (buflen != sizeof(mm_temp)) {
2490 printf("mls_vnode_associate_extattr: bad size %d\n", buflen);
2493 if (mls_valid(&mm_temp) != 0) {
2494 printf("mls_vnode_associate_extattr: invalid\n");
2497 if ((mm_temp.mm_flags & MAC_MLS_FLAGS_BOTH) !=
2498 MAC_MLS_FLAG_EFFECTIVE) {
2499 printf("mls_associated_vnode_extattr: not effective\n");
2503 mls_copy_effective(&mm_temp, dest);
2508 mls_vnode_associate_singlelabel(struct mount *mp, struct label *mplabel,
2509 struct vnode *vp, struct label *vplabel)
2511 struct mac_mls *source, *dest;
2513 source = SLOT(mplabel);
2514 dest = SLOT(vplabel);
2516 mls_copy_effective(source, dest);
2520 mls_vnode_check_chdir(struct ucred *cred, struct vnode *dvp,
2521 struct label *dvplabel)
2523 struct mac_mls *subj, *obj;
2528 subj = SLOT(cred->cr_label);
2529 obj = SLOT(dvplabel);
2531 if (!mls_dominate_effective(subj, obj))
2538 mls_vnode_check_chroot(struct ucred *cred, struct vnode *dvp,
2539 struct label *dvplabel)
2541 struct mac_mls *subj, *obj;
2546 subj = SLOT(cred->cr_label);
2547 obj = SLOT(dvplabel);
2549 if (!mls_dominate_effective(subj, obj))
2556 mls_vnode_check_create(struct ucred *cred, struct vnode *dvp,
2557 struct label *dvplabel, struct componentname *cnp, struct vattr *vap)
2559 struct mac_mls *subj, *obj;
2564 subj = SLOT(cred->cr_label);
2565 obj = SLOT(dvplabel);
2567 if (!mls_dominate_effective(obj, subj))
2574 mls_vnode_check_deleteacl(struct ucred *cred, struct vnode *vp,
2575 struct label *vplabel, acl_type_t type)
2577 struct mac_mls *subj, *obj;
2582 subj = SLOT(cred->cr_label);
2583 obj = SLOT(vplabel);
2585 if (!mls_dominate_effective(obj, subj))
2592 mls_vnode_check_deleteextattr(struct ucred *cred, struct vnode *vp,
2593 struct label *vplabel, int attrnamespace, const char *name)
2595 struct mac_mls *subj, *obj;
2600 subj = SLOT(cred->cr_label);
2601 obj = SLOT(vplabel);
2603 if (!mls_dominate_effective(obj, subj))
2610 mls_vnode_check_exec(struct ucred *cred, struct vnode *vp,
2611 struct label *vplabel, struct image_params *imgp,
2612 struct label *execlabel)
2614 struct mac_mls *subj, *obj, *exec;
2617 if (execlabel != NULL) {
2619 * We currently don't permit labels to be changed at
2620 * exec-time as part of MLS, so disallow non-NULL MLS label
2621 * elements in the execlabel.
2623 exec = SLOT(execlabel);
2624 error = mls_atmostflags(exec, 0);
2632 subj = SLOT(cred->cr_label);
2633 obj = SLOT(vplabel);
2635 if (!mls_dominate_effective(subj, obj))
2642 mls_vnode_check_getacl(struct ucred *cred, struct vnode *vp,
2643 struct label *vplabel, acl_type_t type)
2645 struct mac_mls *subj, *obj;
2650 subj = SLOT(cred->cr_label);
2651 obj = SLOT(vplabel);
2653 if (!mls_dominate_effective(subj, obj))
2660 mls_vnode_check_getextattr(struct ucred *cred, struct vnode *vp,
2661 struct label *vplabel, int attrnamespace, const char *name)
2663 struct mac_mls *subj, *obj;
2668 subj = SLOT(cred->cr_label);
2669 obj = SLOT(vplabel);
2671 if (!mls_dominate_effective(subj, obj))
2678 mls_vnode_check_link(struct ucred *cred, struct vnode *dvp,
2679 struct label *dvplabel, struct vnode *vp, struct label *vplabel,
2680 struct componentname *cnp)
2682 struct mac_mls *subj, *obj;
2687 subj = SLOT(cred->cr_label);
2688 obj = SLOT(dvplabel);
2690 if (!mls_dominate_effective(obj, subj))
2693 obj = SLOT(vplabel);
2694 if (!mls_dominate_effective(obj, subj))
2701 mls_vnode_check_listextattr(struct ucred *cred, struct vnode *vp,
2702 struct label *vplabel, int attrnamespace)
2705 struct mac_mls *subj, *obj;
2710 subj = SLOT(cred->cr_label);
2711 obj = SLOT(vplabel);
2713 if (!mls_dominate_effective(subj, obj))
2720 mls_vnode_check_lookup(struct ucred *cred, struct vnode *dvp,
2721 struct label *dvplabel, struct componentname *cnp)
2723 struct mac_mls *subj, *obj;
2728 subj = SLOT(cred->cr_label);
2729 obj = SLOT(dvplabel);
2731 if (!mls_dominate_effective(subj, obj))
2738 mls_vnode_check_mmap(struct ucred *cred, struct vnode *vp,
2739 struct label *vplabel, int prot, int flags)
2741 struct mac_mls *subj, *obj;
2744 * Rely on the use of open()-time protections to handle
2745 * non-revocation cases.
2747 if (!mls_enabled || !revocation_enabled)
2750 subj = SLOT(cred->cr_label);
2751 obj = SLOT(vplabel);
2753 if (prot & (VM_PROT_READ | VM_PROT_EXECUTE)) {
2754 if (!mls_dominate_effective(subj, obj))
2757 if (((prot & VM_PROT_WRITE) != 0) && ((flags & MAP_SHARED) != 0)) {
2758 if (!mls_dominate_effective(obj, subj))
2766 mls_vnode_check_open(struct ucred *cred, struct vnode *vp,
2767 struct label *vplabel, accmode_t accmode)
2769 struct mac_mls *subj, *obj;
2774 subj = SLOT(cred->cr_label);
2775 obj = SLOT(vplabel);
2777 /* XXX privilege override for admin? */
2778 if (accmode & (VREAD | VEXEC | VSTAT_PERMS)) {
2779 if (!mls_dominate_effective(subj, obj))
2782 if (accmode & VMODIFY_PERMS) {
2783 if (!mls_dominate_effective(obj, subj))
2791 mls_vnode_check_poll(struct ucred *active_cred, struct ucred *file_cred,
2792 struct vnode *vp, struct label *vplabel)
2794 struct mac_mls *subj, *obj;
2796 if (!mls_enabled || !revocation_enabled)
2799 subj = SLOT(active_cred->cr_label);
2800 obj = SLOT(vplabel);
2802 if (!mls_dominate_effective(subj, obj))
2809 mls_vnode_check_read(struct ucred *active_cred, struct ucred *file_cred,
2810 struct vnode *vp, struct label *vplabel)
2812 struct mac_mls *subj, *obj;
2814 if (!mls_enabled || !revocation_enabled)
2817 subj = SLOT(active_cred->cr_label);
2818 obj = SLOT(vplabel);
2820 if (!mls_dominate_effective(subj, obj))
2827 mls_vnode_check_readdir(struct ucred *cred, struct vnode *dvp,
2828 struct label *dvplabel)
2830 struct mac_mls *subj, *obj;
2835 subj = SLOT(cred->cr_label);
2836 obj = SLOT(dvplabel);
2838 if (!mls_dominate_effective(subj, obj))
2845 mls_vnode_check_readlink(struct ucred *cred, struct vnode *vp,
2846 struct label *vplabel)
2848 struct mac_mls *subj, *obj;
2853 subj = SLOT(cred->cr_label);
2854 obj = SLOT(vplabel);
2856 if (!mls_dominate_effective(subj, obj))
2863 mls_vnode_check_relabel(struct ucred *cred, struct vnode *vp,
2864 struct label *vplabel, struct label *newlabel)
2866 struct mac_mls *old, *new, *subj;
2869 old = SLOT(vplabel);
2870 new = SLOT(newlabel);
2871 subj = SLOT(cred->cr_label);
2874 * If there is an MLS label update for the vnode, it must be a
2877 error = mls_atmostflags(new, MAC_MLS_FLAG_EFFECTIVE);
2882 * To perform a relabel of the vnode (MLS label or not), MLS must
2883 * authorize the relabel.
2885 if (!mls_effective_in_range(old, subj))
2889 * If the MLS label is to be changed, authorize as appropriate.
2891 if (new->mm_flags & MAC_MLS_FLAG_EFFECTIVE) {
2893 * To change the MLS label on a vnode, the new vnode label
2894 * must be in the subject range.
2896 if (!mls_effective_in_range(new, subj))
2900 * To change the MLS label on the vnode to be EQUAL, the
2901 * subject must have appropriate privilege.
2903 if (mls_contains_equal(new)) {
2904 error = mls_subject_privileged(subj);
2914 mls_vnode_check_rename_from(struct ucred *cred, struct vnode *dvp,
2915 struct label *dvplabel, struct vnode *vp, struct label *vplabel,
2916 struct componentname *cnp)
2918 struct mac_mls *subj, *obj;
2923 subj = SLOT(cred->cr_label);
2924 obj = SLOT(dvplabel);
2926 if (!mls_dominate_effective(obj, subj))
2929 obj = SLOT(vplabel);
2931 if (!mls_dominate_effective(obj, subj))
2938 mls_vnode_check_rename_to(struct ucred *cred, struct vnode *dvp,
2939 struct label *dvplabel, struct vnode *vp, struct label *vplabel,
2940 int samedir, struct componentname *cnp)
2942 struct mac_mls *subj, *obj;
2947 subj = SLOT(cred->cr_label);
2948 obj = SLOT(dvplabel);
2950 if (!mls_dominate_effective(obj, subj))
2954 obj = SLOT(vplabel);
2956 if (!mls_dominate_effective(obj, subj))
2964 mls_vnode_check_revoke(struct ucred *cred, struct vnode *vp,
2965 struct label *vplabel)
2967 struct mac_mls *subj, *obj;
2972 subj = SLOT(cred->cr_label);
2973 obj = SLOT(vplabel);
2975 if (!mls_dominate_effective(obj, subj))
2982 mls_vnode_check_setacl(struct ucred *cred, struct vnode *vp,
2983 struct label *vplabel, acl_type_t type, struct acl *acl)
2985 struct mac_mls *subj, *obj;
2990 subj = SLOT(cred->cr_label);
2991 obj = SLOT(vplabel);
2993 if (!mls_dominate_effective(obj, subj))
3000 mls_vnode_check_setextattr(struct ucred *cred, struct vnode *vp,
3001 struct label *vplabel, int attrnamespace, const char *name)
3003 struct mac_mls *subj, *obj;
3008 subj = SLOT(cred->cr_label);
3009 obj = SLOT(vplabel);
3011 if (!mls_dominate_effective(obj, subj))
3014 /* XXX: protect the MAC EA in a special way? */
3020 mls_vnode_check_setflags(struct ucred *cred, struct vnode *vp,
3021 struct label *vplabel, u_long flags)
3023 struct mac_mls *subj, *obj;
3028 subj = SLOT(cred->cr_label);
3029 obj = SLOT(vplabel);
3031 if (!mls_dominate_effective(obj, subj))
3038 mls_vnode_check_setmode(struct ucred *cred, struct vnode *vp,
3039 struct label *vplabel, mode_t mode)
3041 struct mac_mls *subj, *obj;
3046 subj = SLOT(cred->cr_label);
3047 obj = SLOT(vplabel);
3049 if (!mls_dominate_effective(obj, subj))
3056 mls_vnode_check_setowner(struct ucred *cred, struct vnode *vp,
3057 struct label *vplabel, uid_t uid, gid_t gid)
3059 struct mac_mls *subj, *obj;
3064 subj = SLOT(cred->cr_label);
3065 obj = SLOT(vplabel);
3067 if (!mls_dominate_effective(obj, subj))
3074 mls_vnode_check_setutimes(struct ucred *cred, struct vnode *vp,
3075 struct label *vplabel, struct timespec atime, struct timespec mtime)
3077 struct mac_mls *subj, *obj;
3082 subj = SLOT(cred->cr_label);
3083 obj = SLOT(vplabel);
3085 if (!mls_dominate_effective(obj, subj))
3092 mls_vnode_check_stat(struct ucred *active_cred, struct ucred *file_cred,
3093 struct vnode *vp, struct label *vplabel)
3095 struct mac_mls *subj, *obj;
3100 subj = SLOT(active_cred->cr_label);
3101 obj = SLOT(vplabel);
3103 if (!mls_dominate_effective(subj, obj))
3110 mls_vnode_check_unlink(struct ucred *cred, struct vnode *dvp,
3111 struct label *dvplabel, struct vnode *vp, struct label *vplabel,
3112 struct componentname *cnp)
3114 struct mac_mls *subj, *obj;
3119 subj = SLOT(cred->cr_label);
3120 obj = SLOT(dvplabel);
3122 if (!mls_dominate_effective(obj, subj))
3125 obj = SLOT(vplabel);
3127 if (!mls_dominate_effective(obj, subj))
3134 mls_vnode_check_write(struct ucred *active_cred, struct ucred *file_cred,
3135 struct vnode *vp, struct label *vplabel)
3137 struct mac_mls *subj, *obj;
3139 if (!mls_enabled || !revocation_enabled)
3142 subj = SLOT(active_cred->cr_label);
3143 obj = SLOT(vplabel);
3145 if (!mls_dominate_effective(obj, subj))
3152 mls_vnode_create_extattr(struct ucred *cred, struct mount *mp,
3153 struct label *mplabel, struct vnode *dvp, struct label *dvplabel,
3154 struct vnode *vp, struct label *vplabel, struct componentname *cnp)
3156 struct mac_mls *source, *dest, mm_temp;
3160 buflen = sizeof(mm_temp);
3161 bzero(&mm_temp, buflen);
3163 source = SLOT(cred->cr_label);
3164 dest = SLOT(vplabel);
3165 mls_copy_effective(source, &mm_temp);
3167 error = vn_extattr_set(vp, IO_NODELOCKED, MAC_MLS_EXTATTR_NAMESPACE,
3168 MAC_MLS_EXTATTR_NAME, buflen, (char *) &mm_temp, curthread);
3170 mls_copy_effective(source, dest);
3175 mls_vnode_relabel(struct ucred *cred, struct vnode *vp,
3176 struct label *vplabel, struct label *label)
3178 struct mac_mls *source, *dest;
3180 source = SLOT(label);
3181 dest = SLOT(vplabel);
3183 mls_copy(source, dest);
3187 mls_vnode_setlabel_extattr(struct ucred *cred, struct vnode *vp,
3188 struct label *vplabel, struct label *intlabel)
3190 struct mac_mls *source, mm_temp;
3194 buflen = sizeof(mm_temp);
3195 bzero(&mm_temp, buflen);
3197 source = SLOT(intlabel);
3198 if ((source->mm_flags & MAC_MLS_FLAG_EFFECTIVE) == 0)
3201 mls_copy_effective(source, &mm_temp);
3203 error = vn_extattr_set(vp, IO_NODELOCKED, MAC_MLS_EXTATTR_NAMESPACE,
3204 MAC_MLS_EXTATTR_NAME, buflen, (char *) &mm_temp, curthread);
3208 static struct mac_policy_ops mls_ops =
3210 .mpo_init = mls_init,
3212 .mpo_bpfdesc_check_receive = mls_bpfdesc_check_receive,
3213 .mpo_bpfdesc_create = mls_bpfdesc_create,
3214 .mpo_bpfdesc_create_mbuf = mls_bpfdesc_create_mbuf,
3215 .mpo_bpfdesc_destroy_label = mls_destroy_label,
3216 .mpo_bpfdesc_init_label = mls_init_label,
3218 .mpo_cred_associate_nfsd = mls_cred_associate_nfsd,
3219 .mpo_cred_check_relabel = mls_cred_check_relabel,
3220 .mpo_cred_check_visible = mls_cred_check_visible,
3221 .mpo_cred_copy_label = mls_copy_label,
3222 .mpo_cred_create_init = mls_cred_create_init,
3223 .mpo_cred_create_swapper = mls_cred_create_swapper,
3224 .mpo_cred_destroy_label = mls_destroy_label,
3225 .mpo_cred_externalize_label = mls_externalize_label,
3226 .mpo_cred_init_label = mls_init_label,
3227 .mpo_cred_internalize_label = mls_internalize_label,
3228 .mpo_cred_relabel = mls_cred_relabel,
3230 .mpo_devfs_create_device = mls_devfs_create_device,
3231 .mpo_devfs_create_directory = mls_devfs_create_directory,
3232 .mpo_devfs_create_symlink = mls_devfs_create_symlink,
3233 .mpo_devfs_destroy_label = mls_destroy_label,
3234 .mpo_devfs_init_label = mls_init_label,
3235 .mpo_devfs_update = mls_devfs_update,
3236 .mpo_devfs_vnode_associate = mls_devfs_vnode_associate,
3238 .mpo_ifnet_check_relabel = mls_ifnet_check_relabel,
3239 .mpo_ifnet_check_transmit = mls_ifnet_check_transmit,
3240 .mpo_ifnet_copy_label = mls_copy_label,
3241 .mpo_ifnet_create = mls_ifnet_create,
3242 .mpo_ifnet_create_mbuf = mls_ifnet_create_mbuf,
3243 .mpo_ifnet_destroy_label = mls_destroy_label,
3244 .mpo_ifnet_externalize_label = mls_externalize_label,
3245 .mpo_ifnet_init_label = mls_init_label,
3246 .mpo_ifnet_internalize_label = mls_internalize_label,
3247 .mpo_ifnet_relabel = mls_ifnet_relabel,
3249 .mpo_inpcb_check_deliver = mls_inpcb_check_deliver,
3250 .mpo_inpcb_check_visible = mls_inpcb_check_visible,
3251 .mpo_inpcb_create = mls_inpcb_create,
3252 .mpo_inpcb_create_mbuf = mls_inpcb_create_mbuf,
3253 .mpo_inpcb_destroy_label = mls_destroy_label,
3254 .mpo_inpcb_init_label = mls_init_label_waitcheck,
3255 .mpo_inpcb_sosetlabel = mls_inpcb_sosetlabel,
3257 .mpo_ip6q_create = mls_ip6q_create,
3258 .mpo_ip6q_destroy_label = mls_destroy_label,
3259 .mpo_ip6q_init_label = mls_init_label_waitcheck,
3260 .mpo_ip6q_match = mls_ip6q_match,
3261 .mpo_ip6q_reassemble = mls_ip6q_reassemble,
3262 .mpo_ip6q_update = mls_ip6q_update,
3264 .mpo_ipq_create = mls_ipq_create,
3265 .mpo_ipq_destroy_label = mls_destroy_label,
3266 .mpo_ipq_init_label = mls_init_label_waitcheck,
3267 .mpo_ipq_match = mls_ipq_match,
3268 .mpo_ipq_reassemble = mls_ipq_reassemble,
3269 .mpo_ipq_update = mls_ipq_update,
3271 .mpo_mbuf_copy_label = mls_copy_label,
3272 .mpo_mbuf_destroy_label = mls_destroy_label,
3273 .mpo_mbuf_init_label = mls_init_label_waitcheck,
3275 .mpo_mount_check_stat = mls_mount_check_stat,
3276 .mpo_mount_create = mls_mount_create,
3277 .mpo_mount_destroy_label = mls_destroy_label,
3278 .mpo_mount_init_label = mls_init_label,
3280 .mpo_netatalk_aarp_send = mls_netatalk_aarp_send,
3282 .mpo_netinet_arp_send = mls_netinet_arp_send,
3283 .mpo_netinet_firewall_reply = mls_netinet_firewall_reply,
3284 .mpo_netinet_firewall_send = mls_netinet_firewall_send,
3285 .mpo_netinet_fragment = mls_netinet_fragment,
3286 .mpo_netinet_icmp_reply = mls_netinet_icmp_reply,
3287 .mpo_netinet_igmp_send = mls_netinet_igmp_send,
3289 .mpo_netinet6_nd6_send = mls_netinet6_nd6_send,
3291 .mpo_pipe_check_ioctl = mls_pipe_check_ioctl,
3292 .mpo_pipe_check_poll = mls_pipe_check_poll,
3293 .mpo_pipe_check_read = mls_pipe_check_read,
3294 .mpo_pipe_check_relabel = mls_pipe_check_relabel,
3295 .mpo_pipe_check_stat = mls_pipe_check_stat,
3296 .mpo_pipe_check_write = mls_pipe_check_write,
3297 .mpo_pipe_copy_label = mls_copy_label,
3298 .mpo_pipe_create = mls_pipe_create,
3299 .mpo_pipe_destroy_label = mls_destroy_label,
3300 .mpo_pipe_externalize_label = mls_externalize_label,
3301 .mpo_pipe_init_label = mls_init_label,
3302 .mpo_pipe_internalize_label = mls_internalize_label,
3303 .mpo_pipe_relabel = mls_pipe_relabel,
3305 .mpo_posixsem_check_getvalue = mls_posixsem_check_rdonly,
3306 .mpo_posixsem_check_open = mls_posixsem_check_openunlink,
3307 .mpo_posixsem_check_post = mls_posixsem_check_write,
3308 .mpo_posixsem_check_setmode = mls_posixsem_check_setmode,
3309 .mpo_posixsem_check_setowner = mls_posixsem_check_setowner,
3310 .mpo_posixsem_check_stat = mls_posixsem_check_rdonly,
3311 .mpo_posixsem_check_unlink = mls_posixsem_check_openunlink,
3312 .mpo_posixsem_check_wait = mls_posixsem_check_write,
3313 .mpo_posixsem_create = mls_posixsem_create,
3314 .mpo_posixsem_destroy_label = mls_destroy_label,
3315 .mpo_posixsem_init_label = mls_init_label,
3317 .mpo_posixshm_check_mmap = mls_posixshm_check_mmap,
3318 .mpo_posixshm_check_open = mls_posixshm_check_open,
3319 .mpo_posixshm_check_read = mls_posixshm_check_read,
3320 .mpo_posixshm_check_setmode = mls_posixshm_check_setmode,
3321 .mpo_posixshm_check_setowner = mls_posixshm_check_setowner,
3322 .mpo_posixshm_check_stat = mls_posixshm_check_stat,
3323 .mpo_posixshm_check_truncate = mls_posixshm_check_truncate,
3324 .mpo_posixshm_check_unlink = mls_posixshm_check_unlink,
3325 .mpo_posixshm_check_write = mls_posixshm_check_write,
3326 .mpo_posixshm_create = mls_posixshm_create,
3327 .mpo_posixshm_destroy_label = mls_destroy_label,
3328 .mpo_posixshm_init_label = mls_init_label,
3330 .mpo_proc_check_debug = mls_proc_check_debug,
3331 .mpo_proc_check_sched = mls_proc_check_sched,
3332 .mpo_proc_check_signal = mls_proc_check_signal,
3334 .mpo_socket_check_deliver = mls_socket_check_deliver,
3335 .mpo_socket_check_relabel = mls_socket_check_relabel,
3336 .mpo_socket_check_visible = mls_socket_check_visible,
3337 .mpo_socket_copy_label = mls_copy_label,
3338 .mpo_socket_create = mls_socket_create,
3339 .mpo_socket_create_mbuf = mls_socket_create_mbuf,
3340 .mpo_socket_destroy_label = mls_destroy_label,
3341 .mpo_socket_externalize_label = mls_externalize_label,
3342 .mpo_socket_init_label = mls_init_label_waitcheck,
3343 .mpo_socket_internalize_label = mls_internalize_label,
3344 .mpo_socket_newconn = mls_socket_newconn,
3345 .mpo_socket_relabel = mls_socket_relabel,
3347 .mpo_socketpeer_destroy_label = mls_destroy_label,
3348 .mpo_socketpeer_externalize_label = mls_externalize_label,
3349 .mpo_socketpeer_init_label = mls_init_label_waitcheck,
3350 .mpo_socketpeer_set_from_mbuf = mls_socketpeer_set_from_mbuf,
3351 .mpo_socketpeer_set_from_socket = mls_socketpeer_set_from_socket,
3353 .mpo_syncache_create = mls_syncache_create,
3354 .mpo_syncache_create_mbuf = mls_syncache_create_mbuf,
3355 .mpo_syncache_destroy_label = mls_destroy_label,
3356 .mpo_syncache_init_label = mls_init_label_waitcheck,
3358 .mpo_sysvmsg_cleanup = mls_sysvmsg_cleanup,
3359 .mpo_sysvmsg_create = mls_sysvmsg_create,
3360 .mpo_sysvmsg_destroy_label = mls_destroy_label,
3361 .mpo_sysvmsg_init_label = mls_init_label,
3363 .mpo_sysvmsq_check_msgrcv = mls_sysvmsq_check_msgrcv,
3364 .mpo_sysvmsq_check_msgrmid = mls_sysvmsq_check_msgrmid,
3365 .mpo_sysvmsq_check_msqget = mls_sysvmsq_check_msqget,
3366 .mpo_sysvmsq_check_msqsnd = mls_sysvmsq_check_msqsnd,
3367 .mpo_sysvmsq_check_msqrcv = mls_sysvmsq_check_msqrcv,
3368 .mpo_sysvmsq_check_msqctl = mls_sysvmsq_check_msqctl,
3369 .mpo_sysvmsq_cleanup = mls_sysvmsq_cleanup,
3370 .mpo_sysvmsq_destroy_label = mls_destroy_label,
3371 .mpo_sysvmsq_init_label = mls_init_label,
3372 .mpo_sysvmsq_create = mls_sysvmsq_create,
3374 .mpo_sysvsem_check_semctl = mls_sysvsem_check_semctl,
3375 .mpo_sysvsem_check_semget = mls_sysvsem_check_semget,
3376 .mpo_sysvsem_check_semop = mls_sysvsem_check_semop,
3377 .mpo_sysvsem_cleanup = mls_sysvsem_cleanup,
3378 .mpo_sysvsem_create = mls_sysvsem_create,
3379 .mpo_sysvsem_destroy_label = mls_destroy_label,
3380 .mpo_sysvsem_init_label = mls_init_label,
3382 .mpo_sysvshm_check_shmat = mls_sysvshm_check_shmat,
3383 .mpo_sysvshm_check_shmctl = mls_sysvshm_check_shmctl,
3384 .mpo_sysvshm_check_shmget = mls_sysvshm_check_shmget,
3385 .mpo_sysvshm_cleanup = mls_sysvshm_cleanup,
3386 .mpo_sysvshm_create = mls_sysvshm_create,
3387 .mpo_sysvshm_destroy_label = mls_destroy_label,
3388 .mpo_sysvshm_init_label = mls_init_label,
3391 .mpo_system_check_acct = mls_system_check_acct,
3392 .mpo_system_check_auditctl = mls_system_check_auditctl,
3393 .mpo_system_check_swapon = mls_system_check_swapon,
3395 .mpo_vnode_associate_extattr = mls_vnode_associate_extattr,
3396 .mpo_vnode_associate_singlelabel = mls_vnode_associate_singlelabel,
3397 .mpo_vnode_check_access = mls_vnode_check_open,
3398 .mpo_vnode_check_chdir = mls_vnode_check_chdir,
3399 .mpo_vnode_check_chroot = mls_vnode_check_chroot,
3400 .mpo_vnode_check_create = mls_vnode_check_create,
3401 .mpo_vnode_check_deleteacl = mls_vnode_check_deleteacl,
3402 .mpo_vnode_check_deleteextattr = mls_vnode_check_deleteextattr,
3403 .mpo_vnode_check_exec = mls_vnode_check_exec,
3404 .mpo_vnode_check_getacl = mls_vnode_check_getacl,
3405 .mpo_vnode_check_getextattr = mls_vnode_check_getextattr,
3406 .mpo_vnode_check_link = mls_vnode_check_link,
3407 .mpo_vnode_check_listextattr = mls_vnode_check_listextattr,
3408 .mpo_vnode_check_lookup = mls_vnode_check_lookup,
3409 .mpo_vnode_check_mmap = mls_vnode_check_mmap,
3410 .mpo_vnode_check_open = mls_vnode_check_open,
3411 .mpo_vnode_check_poll = mls_vnode_check_poll,
3412 .mpo_vnode_check_read = mls_vnode_check_read,
3413 .mpo_vnode_check_readdir = mls_vnode_check_readdir,
3414 .mpo_vnode_check_readlink = mls_vnode_check_readlink,
3415 .mpo_vnode_check_relabel = mls_vnode_check_relabel,
3416 .mpo_vnode_check_rename_from = mls_vnode_check_rename_from,
3417 .mpo_vnode_check_rename_to = mls_vnode_check_rename_to,
3418 .mpo_vnode_check_revoke = mls_vnode_check_revoke,
3419 .mpo_vnode_check_setacl = mls_vnode_check_setacl,
3420 .mpo_vnode_check_setextattr = mls_vnode_check_setextattr,
3421 .mpo_vnode_check_setflags = mls_vnode_check_setflags,
3422 .mpo_vnode_check_setmode = mls_vnode_check_setmode,
3423 .mpo_vnode_check_setowner = mls_vnode_check_setowner,
3424 .mpo_vnode_check_setutimes = mls_vnode_check_setutimes,
3425 .mpo_vnode_check_stat = mls_vnode_check_stat,
3426 .mpo_vnode_check_unlink = mls_vnode_check_unlink,
3427 .mpo_vnode_check_write = mls_vnode_check_write,
3428 .mpo_vnode_copy_label = mls_copy_label,
3429 .mpo_vnode_create_extattr = mls_vnode_create_extattr,
3430 .mpo_vnode_destroy_label = mls_destroy_label,
3431 .mpo_vnode_externalize_label = mls_externalize_label,
3432 .mpo_vnode_init_label = mls_init_label,
3433 .mpo_vnode_internalize_label = mls_internalize_label,
3434 .mpo_vnode_relabel = mls_vnode_relabel,
3435 .mpo_vnode_setlabel_extattr = mls_vnode_setlabel_extattr,
3438 MAC_POLICY_SET(&mls_ops, mac_mls, "TrustedBSD MAC/MLS",
3439 MPC_LOADTIME_FLAG_NOTLATE, &mls_slot);