2 * Copyright (c) 1999-2002 Robert N. M. Watson
3 * Copyright (c) 2001-2005 Networks Associates Technology, Inc.
4 * Copyright (c) 2005-2006 SPARTA, Inc.
7 * This software was developed by Robert Watson for the TrustedBSD Project.
9 * This software was developed for the FreeBSD Project in part by Network
10 * Associates Laboratories, the Security Research Division of Network
11 * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"),
12 * as part of the DARPA CHATS research program.
14 * This software was enhanced by SPARTA ISSO under SPAWAR contract
15 * N66001-04-C-6019 ("SEFOS").
17 * Redistribution and use in source and binary forms, with or without
18 * modification, are permitted provided that the following conditions
20 * 1. Redistributions of source code must retain the above copyright
21 * notice, this list of conditions and the following disclaimer.
22 * 2. Redistributions in binary form must reproduce the above copyright
23 * notice, this list of conditions and the following disclaimer in the
24 * documentation and/or other materials provided with the distribution.
26 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
27 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
28 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
29 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
30 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
31 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
32 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
33 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
34 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
35 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
42 * Kernel interface for Mandatory Access Control -- how kernel services
43 * interact with the TrustedBSD MAC Framework.
46 #ifndef _SECURITY_MAC_MAC_FRAMEWORK_H_
47 #define _SECURITY_MAC_MAC_FRAMEWORK_H_
50 #error "no user-serviceable parts inside"
54 struct auditinfo_addr;
86 struct vop_setlabel_args;
88 #include <sys/acl.h> /* XXX acl_type_t */
91 * Kernel functions to manage and evaluate labels.
93 void mac_init_bpfdesc(struct bpf_d *);
94 void mac_init_cred(struct ucred *);
95 void mac_init_devfs(struct devfs_dirent *);
96 void mac_init_ifnet(struct ifnet *);
97 int mac_init_inpcb(struct inpcb *, int);
98 void mac_init_sysv_msgmsg(struct msg *);
99 void mac_init_sysv_msgqueue(struct msqid_kernel *);
100 void mac_init_sysv_sem(struct semid_kernel *);
101 void mac_init_sysv_shm(struct shmid_kernel *);
102 int mac_init_ipq(struct ipq *, int);
103 int mac_init_socket(struct socket *, int);
104 void mac_init_pipe(struct pipepair *);
105 void mac_init_posix_sem(struct ksem *);
106 int mac_init_mbuf(struct mbuf *, int);
107 int mac_init_mbuf_tag(struct m_tag *, int);
108 void mac_init_mount(struct mount *);
109 void mac_init_proc(struct proc *);
110 void mac_init_vnode(struct vnode *);
111 void mac_copy_mbuf(struct mbuf *, struct mbuf *);
112 void mac_copy_mbuf_tag(struct m_tag *, struct m_tag *);
113 void mac_copy_vnode_label(struct label *, struct label *);
114 void mac_destroy_bpfdesc(struct bpf_d *);
115 void mac_destroy_cred(struct ucred *);
116 void mac_destroy_devfs(struct devfs_dirent *);
117 void mac_destroy_ifnet(struct ifnet *);
118 void mac_destroy_inpcb(struct inpcb *);
119 void mac_destroy_sysv_msgmsg(struct msg *);
120 void mac_destroy_sysv_msgqueue(struct msqid_kernel *);
121 void mac_destroy_sysv_sem(struct semid_kernel *);
122 void mac_destroy_sysv_shm(struct shmid_kernel *);
123 void mac_destroy_ipq(struct ipq *);
124 void mac_destroy_socket(struct socket *);
125 void mac_destroy_pipe(struct pipepair *);
126 void mac_destroy_posix_sem(struct ksem *);
127 void mac_destroy_proc(struct proc *);
128 void mac_destroy_mbuf_tag(struct m_tag *);
129 void mac_destroy_mount(struct mount *);
130 void mac_destroy_vnode(struct vnode *);
132 struct label *mac_cred_label_alloc(void);
133 void mac_cred_label_free(struct label *);
134 struct label *mac_vnode_label_alloc(void);
135 void mac_vnode_label_free(struct label *);
138 * Labeling event operations: file system objects, and things that look a lot
139 * like file system objects.
141 void mac_associate_vnode_devfs(struct mount *mp, struct devfs_dirent *de,
143 int mac_associate_vnode_extattr(struct mount *mp, struct vnode *vp);
144 void mac_associate_vnode_singlelabel(struct mount *mp, struct vnode *vp);
145 void mac_create_devfs_device(struct ucred *cred, struct mount *mp,
146 struct cdev *dev, struct devfs_dirent *de);
147 void mac_create_devfs_directory(struct mount *mp, char *dirname,
148 int dirnamelen, struct devfs_dirent *de);
149 void mac_create_devfs_symlink(struct ucred *cred, struct mount *mp,
150 struct devfs_dirent *dd, struct devfs_dirent *de);
151 int mac_create_vnode_extattr(struct ucred *cred, struct mount *mp,
152 struct vnode *dvp, struct vnode *vp, struct componentname *cnp);
153 void mac_create_mount(struct ucred *cred, struct mount *mp);
154 void mac_relabel_vnode(struct ucred *cred, struct vnode *vp,
155 struct label *newlabel);
156 void mac_update_devfs(struct mount *mp, struct devfs_dirent *de,
160 * Labeling event operations: IPC objects.
162 void mac_create_mbuf_from_socket(struct socket *so, struct mbuf *m);
163 void mac_create_socket(struct ucred *cred, struct socket *so);
164 void mac_create_socket_from_socket(struct socket *oldso,
165 struct socket *newso);
166 void mac_set_socket_peer_from_mbuf(struct mbuf *m, struct socket *so);
167 void mac_set_socket_peer_from_socket(struct socket *oldso,
168 struct socket *newso);
169 void mac_create_pipe(struct ucred *cred, struct pipepair *pp);
172 * Labeling event operations: System V IPC primitives
174 void mac_create_sysv_msgmsg(struct ucred *cred,
175 struct msqid_kernel *msqkptr, struct msg *msgptr);
176 void mac_create_sysv_msgqueue(struct ucred *cred,
177 struct msqid_kernel *msqkptr);
178 void mac_create_sysv_sem(struct ucred *cred,
179 struct semid_kernel *semakptr);
180 void mac_create_sysv_shm(struct ucred *cred,
181 struct shmid_kernel *shmsegptr);
184 * Labeling event operations: POSIX (global/inter-process) semaphores.
186 void mac_create_posix_sem(struct ucred *cred, struct ksem *ks);
189 * Labeling event operations: network objects.
191 void mac_create_bpfdesc(struct ucred *cred, struct bpf_d *d);
192 void mac_create_ifnet(struct ifnet *ifp);
193 void mac_create_inpcb_from_socket(struct socket *so, struct inpcb *inp);
194 void mac_create_ipq(struct mbuf *m, struct ipq *q);
195 void mac_create_datagram_from_ipq(struct ipq *q, struct mbuf *m);
196 void mac_create_fragment(struct mbuf *m, struct mbuf *frag);
197 void mac_create_mbuf_from_inpcb(struct inpcb *inp, struct mbuf *m);
198 void mac_create_mbuf_linklayer(struct ifnet *ifp, struct mbuf *m);
199 void mac_create_mbuf_from_bpfdesc(struct bpf_d *d, struct mbuf *m);
200 void mac_create_mbuf_from_ifnet(struct ifnet *ifp, struct mbuf *m);
201 void mac_create_mbuf_multicast_encap(struct mbuf *m, struct ifnet *ifp,
203 void mac_create_mbuf_netlayer(struct mbuf *m, struct mbuf *mnew);
204 int mac_fragment_match(struct mbuf *m, struct ipq *q);
205 void mac_reflect_mbuf_icmp(struct mbuf *m);
206 void mac_reflect_mbuf_tcp(struct mbuf *m);
207 void mac_update_ipq(struct mbuf *m, struct ipq *q);
208 void mac_inpcb_sosetlabel(struct socket *so, struct inpcb *inp);
209 void mac_create_mbuf_from_firewall(struct mbuf *m);
210 void mac_destroy_syncache(struct label **l);
211 int mac_init_syncache(struct label **l);
212 void mac_init_syncache_from_inpcb(struct label *l, struct inpcb *inp);
213 void mac_create_mbuf_from_syncache(struct label *l, struct mbuf *m);
216 * Labeling event operations: processes.
218 void mac_copy_cred(struct ucred *cr1, struct ucred *cr2);
219 int mac_execve_enter(struct image_params *imgp, struct mac *mac_p);
220 void mac_execve_exit(struct image_params *imgp);
221 void mac_execve_transition(struct ucred *oldcred, struct ucred *newcred,
222 struct vnode *vp, struct label *interpvnodelabel,
223 struct image_params *imgp);
224 int mac_execve_will_transition(struct ucred *cred, struct vnode *vp,
225 struct label *interpvnodelabel, struct image_params *imgp);
226 void mac_create_proc0(struct ucred *cred);
227 void mac_create_proc1(struct ucred *cred);
228 void mac_thread_userret(struct thread *td);
231 * Label cleanup operation: This is the inverse complement for the mac_create
232 * and associate type of hooks. This hook lets the policy module(s) perform a
233 * cleanup/flushing operation on the label associated with the objects,
234 * without freeing up the space allocated. This hook is useful in cases
235 * where it is desirable to remove any labeling reference when recycling any
236 * object to a pool. This hook does not replace the mac_destroy hooks.
238 * XXXRW: These object methods are inconsistent with the life cycles of other
239 * objects, and likely should be revised to be more consistent.
241 void mac_cleanup_sysv_msgmsg(struct msg *msgptr);
242 void mac_cleanup_sysv_msgqueue(struct msqid_kernel *msqkptr);
243 void mac_cleanup_sysv_sem(struct semid_kernel *semakptr);
244 void mac_cleanup_sysv_shm(struct shmid_kernel *shmsegptr);
247 * Access control checks.
249 int mac_check_bpfdesc_receive(struct bpf_d *d, struct ifnet *ifp);
250 int mac_check_cred_visible(struct ucred *cr1, struct ucred *cr2);
251 int mac_check_ifnet_transmit(struct ifnet *ifp, struct mbuf *m);
252 int mac_check_inpcb_deliver(struct inpcb *inp, struct mbuf *m);
253 int mac_check_inpcb_visible(struct ucred *cred, struct inpcb *inp);
254 int mac_check_sysv_msgmsq(struct ucred *cred, struct msg *msgptr,
255 struct msqid_kernel *msqkptr);
256 int mac_check_sysv_msgrcv(struct ucred *cred, struct msg *msgptr);
257 int mac_check_sysv_msgrmid(struct ucred *cred, struct msg *msgptr);
258 int mac_check_sysv_msqget(struct ucred *cred,
259 struct msqid_kernel *msqkptr);
260 int mac_check_sysv_msqsnd(struct ucred *cred,
261 struct msqid_kernel *msqkptr);
262 int mac_check_sysv_msqrcv(struct ucred *cred,
263 struct msqid_kernel *msqkptr);
264 int mac_check_sysv_msqctl(struct ucred *cred,
265 struct msqid_kernel *msqkptr, int cmd);
266 int mac_check_sysv_semctl(struct ucred *cred,
267 struct semid_kernel *semakptr, int cmd);
268 int mac_check_sysv_semget(struct ucred *cred,
269 struct semid_kernel *semakptr);
270 int mac_check_sysv_semop(struct ucred *cred,struct semid_kernel *semakptr,
272 int mac_check_sysv_shmat(struct ucred *cred,
273 struct shmid_kernel *shmsegptr, int shmflg);
274 int mac_check_sysv_shmctl(struct ucred *cred,
275 struct shmid_kernel *shmsegptr, int cmd);
276 int mac_check_sysv_shmdt(struct ucred *cred,
277 struct shmid_kernel *shmsegptr);
278 int mac_check_sysv_shmget(struct ucred *cred,
279 struct shmid_kernel *shmsegptr, int shmflg);
280 int mac_check_kenv_dump(struct ucred *cred);
281 int mac_check_kenv_get(struct ucred *cred, char *name);
282 int mac_check_kenv_set(struct ucred *cred, char *name, char *value);
283 int mac_check_kenv_unset(struct ucred *cred, char *name);
284 int mac_check_kld_load(struct ucred *cred, struct vnode *vp);
285 int mac_check_kld_stat(struct ucred *cred);
286 int mac_check_mount_stat(struct ucred *cred, struct mount *mp);
287 int mac_check_pipe_ioctl(struct ucred *cred, struct pipepair *pp,
288 unsigned long cmd, void *data);
289 int mac_check_pipe_poll(struct ucred *cred, struct pipepair *pp);
290 int mac_check_pipe_read(struct ucred *cred, struct pipepair *pp);
291 int mac_check_pipe_stat(struct ucred *cred, struct pipepair *pp);
292 int mac_check_pipe_write(struct ucred *cred, struct pipepair *pp);
293 int mac_check_posix_sem_destroy(struct ucred *cred, struct ksem *ks);
294 int mac_check_posix_sem_getvalue(struct ucred *cred,struct ksem *ks);
295 int mac_check_posix_sem_open(struct ucred *cred, struct ksem *ks);
296 int mac_check_posix_sem_post(struct ucred *cred, struct ksem *ks);
297 int mac_check_posix_sem_unlink(struct ucred *cred, struct ksem *ks);
298 int mac_check_posix_sem_wait(struct ucred *cred, struct ksem *ks);
299 int mac_check_proc_debug(struct ucred *cred, struct proc *p);
300 int mac_check_proc_sched(struct ucred *cred, struct proc *p);
301 int mac_check_proc_setaudit(struct ucred *cred, struct auditinfo *ai);
302 int mac_check_proc_setaudit_addr(struct ucred *cred,
303 struct auditinfo_addr *aia);
304 int mac_check_proc_setauid(struct ucred *cred, uid_t auid);
305 int mac_check_proc_setuid(struct proc *p, struct ucred *cred,
307 int mac_check_proc_seteuid(struct proc *p, struct ucred *cred,
309 int mac_check_proc_setgid(struct proc *p, struct ucred *cred,
311 int mac_check_proc_setegid(struct proc *p, struct ucred *cred,
313 int mac_check_proc_setgroups(struct proc *p, struct ucred *cred,
314 int ngroups, gid_t *gidset);
315 int mac_check_proc_setreuid(struct proc *p, struct ucred *cred,
316 uid_t ruid, uid_t euid);
317 int mac_check_proc_setregid(struct proc *p, struct ucred *cred,
318 gid_t rgid, gid_t egid);
319 int mac_check_proc_setresuid(struct proc *p, struct ucred *cred,
320 uid_t ruid, uid_t euid, uid_t suid);
321 int mac_check_proc_setresgid(struct proc *p, struct ucred *cred,
322 gid_t rgid, gid_t egid, gid_t sgid);
323 int mac_check_proc_signal(struct ucred *cred, struct proc *p,
325 int mac_check_proc_wait(struct ucred *cred, struct proc *p);
326 int mac_check_socket_accept(struct ucred *cred, struct socket *so);
327 int mac_check_socket_bind(struct ucred *cred, struct socket *so,
328 struct sockaddr *sa);
329 int mac_check_socket_connect(struct ucred *cred, struct socket *so,
330 struct sockaddr *sa);
331 int mac_check_socket_create(struct ucred *cred, int domain, int type,
333 int mac_check_socket_deliver(struct socket *so, struct mbuf *m);
334 int mac_check_socket_listen(struct ucred *cred, struct socket *so);
335 int mac_check_socket_poll(struct ucred *cred, struct socket *so);
336 int mac_check_socket_receive(struct ucred *cred, struct socket *so);
337 int mac_check_socket_send(struct ucred *cred, struct socket *so);
338 int mac_check_socket_stat(struct ucred *cred, struct socket *so);
339 int mac_check_socket_visible(struct ucred *cred, struct socket *so);
340 int mac_check_system_acct(struct ucred *cred, struct vnode *vp);
341 int mac_check_system_audit(struct ucred *cred, void *record, int length);
342 int mac_check_system_auditctl(struct ucred *cred, struct vnode *vp);
343 int mac_check_system_auditon(struct ucred *cred, int cmd);
344 int mac_check_system_reboot(struct ucred *cred, int howto);
345 int mac_check_system_swapon(struct ucred *cred, struct vnode *vp);
346 int mac_check_system_swapoff(struct ucred *cred, struct vnode *vp);
347 int mac_check_system_sysctl(struct ucred *cred, struct sysctl_oid *oidp,
348 void *arg1, int arg2, struct sysctl_req *req);
349 int mac_check_vnode_access(struct ucred *cred, struct vnode *vp,
351 int mac_check_vnode_chdir(struct ucred *cred, struct vnode *dvp);
352 int mac_check_vnode_chroot(struct ucred *cred, struct vnode *dvp);
353 int mac_check_vnode_create(struct ucred *cred, struct vnode *dvp,
354 struct componentname *cnp, struct vattr *vap);
355 int mac_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp,
357 int mac_check_vnode_deleteextattr(struct ucred *cred, struct vnode *vp,
358 int attrnamespace, const char *name);
359 int mac_check_vnode_exec(struct ucred *cred, struct vnode *vp,
360 struct image_params *imgp);
361 int mac_check_vnode_getacl(struct ucred *cred, struct vnode *vp,
363 int mac_check_vnode_getextattr(struct ucred *cred, struct vnode *vp,
364 int attrnamespace, const char *name, struct uio *uio);
365 int mac_check_vnode_link(struct ucred *cred, struct vnode *dvp,
366 struct vnode *vp, struct componentname *cnp);
367 int mac_check_vnode_listextattr(struct ucred *cred, struct vnode *vp,
369 int mac_check_vnode_lookup(struct ucred *cred, struct vnode *dvp,
370 struct componentname *cnp);
371 int mac_check_vnode_mmap(struct ucred *cred, struct vnode *vp, int prot,
373 int mac_check_vnode_mprotect(struct ucred *cred, struct vnode *vp,
375 int mac_check_vnode_open(struct ucred *cred, struct vnode *vp,
377 int mac_check_vnode_poll(struct ucred *active_cred,
378 struct ucred *file_cred, struct vnode *vp);
379 int mac_check_vnode_read(struct ucred *active_cred,
380 struct ucred *file_cred, struct vnode *vp);
381 int mac_check_vnode_readdir(struct ucred *cred, struct vnode *vp);
382 int mac_check_vnode_readlink(struct ucred *cred, struct vnode *vp);
383 int mac_check_vnode_rename_from(struct ucred *cred, struct vnode *dvp,
384 struct vnode *vp, struct componentname *cnp);
385 int mac_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp,
386 struct vnode *vp, int samedir, struct componentname *cnp);
387 int mac_check_vnode_revoke(struct ucred *cred, struct vnode *vp);
388 int mac_check_vnode_setacl(struct ucred *cred, struct vnode *vp,
389 acl_type_t type, struct acl *acl);
390 int mac_check_vnode_setextattr(struct ucred *cred, struct vnode *vp,
391 int attrnamespace, const char *name, struct uio *uio);
392 int mac_check_vnode_setflags(struct ucred *cred, struct vnode *vp,
394 int mac_check_vnode_setmode(struct ucred *cred, struct vnode *vp,
396 int mac_check_vnode_setowner(struct ucred *cred, struct vnode *vp,
397 uid_t uid, gid_t gid);
398 int mac_check_vnode_setutimes(struct ucred *cred, struct vnode *vp,
399 struct timespec atime, struct timespec mtime);
400 int mac_check_vnode_stat(struct ucred *active_cred,
401 struct ucred *file_cred, struct vnode *vp);
402 int mac_check_vnode_unlink(struct ucred *cred, struct vnode *dvp,
403 struct vnode *vp, struct componentname *cnp);
404 int mac_check_vnode_write(struct ucred *active_cred,
405 struct ucred *file_cred, struct vnode *vp);
406 int mac_getsockopt_label(struct ucred *cred, struct socket *so,
408 int mac_getsockopt_peerlabel(struct ucred *cred, struct socket *so,
410 int mac_ioctl_ifnet_get(struct ucred *cred, struct ifreq *ifr,
412 int mac_ioctl_ifnet_set(struct ucred *cred, struct ifreq *ifr,
414 int mac_setsockopt_label(struct ucred *cred, struct socket *so,
416 int mac_pipe_label_set(struct ucred *cred, struct pipepair *pp,
417 struct label *label);
418 void mac_cred_mmapped_drop_perms(struct thread *td, struct ucred *cred);
419 void mac_associate_nfsd_label(struct ucred *cred);
420 int mac_priv_check(struct ucred *cred, int priv);
421 int mac_priv_grant(struct ucred *cred, int priv);
424 * Calls to help various file systems implement labeling functionality using
425 * their existing EA implementation.
427 int vop_stdsetlabel_ea(struct vop_setlabel_args *ap);
429 #endif /* !_SECURITY_MAC_MAC_FRAMEWORK_H_ */