2 * Copyright (c) 1999-2002, 2007-2011 Robert N. M. Watson
3 * Copyright (c) 2001-2005 McAfee, Inc.
4 * Copyright (c) 2006 SPARTA, Inc.
7 * This software was developed by Robert Watson for the TrustedBSD Project.
9 * This software was developed for the FreeBSD Project in part by McAfee
10 * Research, the Security Research Division of McAfee, Inc. under
11 * DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA
12 * CHATS research program.
14 * This software was enhanced by SPARTA ISSO under SPAWAR contract
15 * N66001-04-C-6019 ("SEFOS").
17 * This software was developed at the University of Cambridge Computer
18 * Laboratory with support from a grant from Google, Inc.
20 * Redistribution and use in source and binary forms, with or without
21 * modification, are permitted provided that the following conditions
23 * 1. Redistributions of source code must retain the above copyright
24 * notice, this list of conditions and the following disclaimer.
25 * 2. Redistributions in binary form must reproduce the above copyright
26 * notice, this list of conditions and the following disclaimer in the
27 * documentation and/or other materials provided with the distribution.
29 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
30 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
31 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
32 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
33 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
34 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
35 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
36 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
37 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
38 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
45 * Developed by the TrustedBSD Project.
47 * MLS fixed label mandatory confidentiality policy.
50 #include <sys/types.h>
51 #include <sys/param.h>
54 #include <sys/extattr.h>
55 #include <sys/kernel.h>
58 #include <sys/malloc.h>
59 #include <sys/mount.h>
62 #include <sys/systm.h>
63 #include <sys/sysproto.h>
64 #include <sys/sysent.h>
65 #include <sys/systm.h>
66 #include <sys/vnode.h>
68 #include <sys/socket.h>
69 #include <sys/socketvar.h>
72 #include <sys/sysctl.h>
77 #include <fs/devfs/devfs.h>
79 #include <net/bpfdesc.h>
81 #include <net/if_types.h>
82 #include <net/if_var.h>
84 #include <netinet/in.h>
85 #include <netinet/in_pcb.h>
86 #include <netinet/ip_var.h>
91 #include <security/mac/mac_policy.h>
92 #include <security/mac_mls/mac_mls.h>
94 SYSCTL_DECL(_security_mac);
96 SYSCTL_NODE(_security_mac, OID_AUTO, mls, CTLFLAG_RW, 0,
97 "TrustedBSD mac_mls policy controls");
99 static int mls_label_size = sizeof(struct mac_mls);
100 SYSCTL_INT(_security_mac_mls, OID_AUTO, label_size, CTLFLAG_RD,
101 &mls_label_size, 0, "Size of struct mac_mls");
103 static int mls_enabled = 1;
104 SYSCTL_INT(_security_mac_mls, OID_AUTO, enabled, CTLFLAG_RW, &mls_enabled, 0,
105 "Enforce MAC/MLS policy");
106 TUNABLE_INT("security.mac.mls.enabled", &mls_enabled);
108 static int destroyed_not_inited;
109 SYSCTL_INT(_security_mac_mls, OID_AUTO, destroyed_not_inited, CTLFLAG_RD,
110 &destroyed_not_inited, 0, "Count of labels destroyed but not inited");
112 static int ptys_equal = 0;
113 SYSCTL_INT(_security_mac_mls, OID_AUTO, ptys_equal, CTLFLAG_RW,
114 &ptys_equal, 0, "Label pty devices as mls/equal on create");
115 TUNABLE_INT("security.mac.mls.ptys_equal", &ptys_equal);
117 static int revocation_enabled = 0;
118 SYSCTL_INT(_security_mac_mls, OID_AUTO, revocation_enabled, CTLFLAG_RW,
119 &revocation_enabled, 0, "Revoke access to objects on relabel");
120 TUNABLE_INT("security.mac.mls.revocation_enabled", &revocation_enabled);
122 static int max_compartments = MAC_MLS_MAX_COMPARTMENTS;
123 SYSCTL_INT(_security_mac_mls, OID_AUTO, max_compartments, CTLFLAG_RD,
124 &max_compartments, 0, "Maximum compartments the policy supports");
127 #define SLOT(l) ((struct mac_mls *)mac_label_get((l), mls_slot))
128 #define SLOT_SET(l, val) mac_label_set((l), mls_slot, (uintptr_t)(val))
130 static uma_zone_t zone_mls;
133 mls_bit_set_empty(u_char *set) {
136 for (i = 0; i < MAC_MLS_MAX_COMPARTMENTS >> 3; i++)
142 static struct mac_mls *
146 return (uma_zalloc(zone_mls, flag | M_ZERO));
150 mls_free(struct mac_mls *mm)
154 uma_zfree(zone_mls, mm);
156 atomic_add_int(&destroyed_not_inited, 1);
160 mls_atmostflags(struct mac_mls *mm, int flags)
163 if ((mm->mm_flags & flags) != mm->mm_flags)
169 mls_dominate_element(struct mac_mls_element *a, struct mac_mls_element *b)
173 switch (a->mme_type) {
174 case MAC_MLS_TYPE_EQUAL:
175 case MAC_MLS_TYPE_HIGH:
178 case MAC_MLS_TYPE_LOW:
179 switch (b->mme_type) {
180 case MAC_MLS_TYPE_LEVEL:
181 case MAC_MLS_TYPE_HIGH:
184 case MAC_MLS_TYPE_EQUAL:
185 case MAC_MLS_TYPE_LOW:
189 panic("mls_dominate_element: b->mme_type invalid");
192 case MAC_MLS_TYPE_LEVEL:
193 switch (b->mme_type) {
194 case MAC_MLS_TYPE_EQUAL:
195 case MAC_MLS_TYPE_LOW:
198 case MAC_MLS_TYPE_HIGH:
201 case MAC_MLS_TYPE_LEVEL:
202 for (bit = 1; bit <= MAC_MLS_MAX_COMPARTMENTS; bit++)
203 if (!MAC_MLS_BIT_TEST(bit,
204 a->mme_compartments) &&
205 MAC_MLS_BIT_TEST(bit, b->mme_compartments))
207 return (a->mme_level >= b->mme_level);
210 panic("mls_dominate_element: b->mme_type invalid");
214 panic("mls_dominate_element: a->mme_type invalid");
221 mls_range_in_range(struct mac_mls *rangea, struct mac_mls *rangeb)
224 return (mls_dominate_element(&rangeb->mm_rangehigh,
225 &rangea->mm_rangehigh) &&
226 mls_dominate_element(&rangea->mm_rangelow,
227 &rangeb->mm_rangelow));
231 mls_effective_in_range(struct mac_mls *effective, struct mac_mls *range)
234 KASSERT((effective->mm_flags & MAC_MLS_FLAG_EFFECTIVE) != 0,
235 ("mls_effective_in_range: a not effective"));
236 KASSERT((range->mm_flags & MAC_MLS_FLAG_RANGE) != 0,
237 ("mls_effective_in_range: b not range"));
239 return (mls_dominate_element(&range->mm_rangehigh,
240 &effective->mm_effective) &&
241 mls_dominate_element(&effective->mm_effective,
242 &range->mm_rangelow));
248 mls_dominate_effective(struct mac_mls *a, struct mac_mls *b)
250 KASSERT((a->mm_flags & MAC_MLS_FLAG_EFFECTIVE) != 0,
251 ("mls_dominate_effective: a not effective"));
252 KASSERT((b->mm_flags & MAC_MLS_FLAG_EFFECTIVE) != 0,
253 ("mls_dominate_effective: b not effective"));
255 return (mls_dominate_element(&a->mm_effective, &b->mm_effective));
259 mls_equal_element(struct mac_mls_element *a, struct mac_mls_element *b)
262 if (a->mme_type == MAC_MLS_TYPE_EQUAL ||
263 b->mme_type == MAC_MLS_TYPE_EQUAL)
266 return (a->mme_type == b->mme_type && a->mme_level == b->mme_level);
270 mls_equal_effective(struct mac_mls *a, struct mac_mls *b)
273 KASSERT((a->mm_flags & MAC_MLS_FLAG_EFFECTIVE) != 0,
274 ("mls_equal_effective: a not effective"));
275 KASSERT((b->mm_flags & MAC_MLS_FLAG_EFFECTIVE) != 0,
276 ("mls_equal_effective: b not effective"));
278 return (mls_equal_element(&a->mm_effective, &b->mm_effective));
282 mls_contains_equal(struct mac_mls *mm)
285 if (mm->mm_flags & MAC_MLS_FLAG_EFFECTIVE)
286 if (mm->mm_effective.mme_type == MAC_MLS_TYPE_EQUAL)
289 if (mm->mm_flags & MAC_MLS_FLAG_RANGE) {
290 if (mm->mm_rangelow.mme_type == MAC_MLS_TYPE_EQUAL)
292 if (mm->mm_rangehigh.mme_type == MAC_MLS_TYPE_EQUAL)
300 mls_subject_privileged(struct mac_mls *mm)
303 KASSERT((mm->mm_flags & MAC_MLS_FLAGS_BOTH) == MAC_MLS_FLAGS_BOTH,
304 ("mls_subject_privileged: subject doesn't have both labels"));
306 /* If the effective is EQUAL, it's ok. */
307 if (mm->mm_effective.mme_type == MAC_MLS_TYPE_EQUAL)
310 /* If either range endpoint is EQUAL, it's ok. */
311 if (mm->mm_rangelow.mme_type == MAC_MLS_TYPE_EQUAL ||
312 mm->mm_rangehigh.mme_type == MAC_MLS_TYPE_EQUAL)
315 /* If the range is low-high, it's ok. */
316 if (mm->mm_rangelow.mme_type == MAC_MLS_TYPE_LOW &&
317 mm->mm_rangehigh.mme_type == MAC_MLS_TYPE_HIGH)
325 mls_valid(struct mac_mls *mm)
328 if (mm->mm_flags & MAC_MLS_FLAG_EFFECTIVE) {
329 switch (mm->mm_effective.mme_type) {
330 case MAC_MLS_TYPE_LEVEL:
333 case MAC_MLS_TYPE_EQUAL:
334 case MAC_MLS_TYPE_HIGH:
335 case MAC_MLS_TYPE_LOW:
336 if (mm->mm_effective.mme_level != 0 ||
337 !MAC_MLS_BIT_SET_EMPTY(
338 mm->mm_effective.mme_compartments))
346 if (mm->mm_effective.mme_type != MAC_MLS_TYPE_UNDEF)
350 if (mm->mm_flags & MAC_MLS_FLAG_RANGE) {
351 switch (mm->mm_rangelow.mme_type) {
352 case MAC_MLS_TYPE_LEVEL:
355 case MAC_MLS_TYPE_EQUAL:
356 case MAC_MLS_TYPE_HIGH:
357 case MAC_MLS_TYPE_LOW:
358 if (mm->mm_rangelow.mme_level != 0 ||
359 !MAC_MLS_BIT_SET_EMPTY(
360 mm->mm_rangelow.mme_compartments))
368 switch (mm->mm_rangehigh.mme_type) {
369 case MAC_MLS_TYPE_LEVEL:
372 case MAC_MLS_TYPE_EQUAL:
373 case MAC_MLS_TYPE_HIGH:
374 case MAC_MLS_TYPE_LOW:
375 if (mm->mm_rangehigh.mme_level != 0 ||
376 !MAC_MLS_BIT_SET_EMPTY(
377 mm->mm_rangehigh.mme_compartments))
384 if (!mls_dominate_element(&mm->mm_rangehigh,
388 if (mm->mm_rangelow.mme_type != MAC_MLS_TYPE_UNDEF ||
389 mm->mm_rangehigh.mme_type != MAC_MLS_TYPE_UNDEF)
397 mls_set_range(struct mac_mls *mm, u_short typelow, u_short levellow,
398 u_char *compartmentslow, u_short typehigh, u_short levelhigh,
399 u_char *compartmentshigh)
402 mm->mm_rangelow.mme_type = typelow;
403 mm->mm_rangelow.mme_level = levellow;
404 if (compartmentslow != NULL)
405 memcpy(mm->mm_rangelow.mme_compartments, compartmentslow,
406 sizeof(mm->mm_rangelow.mme_compartments));
407 mm->mm_rangehigh.mme_type = typehigh;
408 mm->mm_rangehigh.mme_level = levelhigh;
409 if (compartmentshigh != NULL)
410 memcpy(mm->mm_rangehigh.mme_compartments, compartmentshigh,
411 sizeof(mm->mm_rangehigh.mme_compartments));
412 mm->mm_flags |= MAC_MLS_FLAG_RANGE;
416 mls_set_effective(struct mac_mls *mm, u_short type, u_short level,
417 u_char *compartments)
420 mm->mm_effective.mme_type = type;
421 mm->mm_effective.mme_level = level;
422 if (compartments != NULL)
423 memcpy(mm->mm_effective.mme_compartments, compartments,
424 sizeof(mm->mm_effective.mme_compartments));
425 mm->mm_flags |= MAC_MLS_FLAG_EFFECTIVE;
429 mls_copy_range(struct mac_mls *labelfrom, struct mac_mls *labelto)
432 KASSERT((labelfrom->mm_flags & MAC_MLS_FLAG_RANGE) != 0,
433 ("mls_copy_range: labelfrom not range"));
435 labelto->mm_rangelow = labelfrom->mm_rangelow;
436 labelto->mm_rangehigh = labelfrom->mm_rangehigh;
437 labelto->mm_flags |= MAC_MLS_FLAG_RANGE;
441 mls_copy_effective(struct mac_mls *labelfrom, struct mac_mls *labelto)
444 KASSERT((labelfrom->mm_flags & MAC_MLS_FLAG_EFFECTIVE) != 0,
445 ("mls_copy_effective: labelfrom not effective"));
447 labelto->mm_effective = labelfrom->mm_effective;
448 labelto->mm_flags |= MAC_MLS_FLAG_EFFECTIVE;
452 mls_copy(struct mac_mls *source, struct mac_mls *dest)
455 if (source->mm_flags & MAC_MLS_FLAG_EFFECTIVE)
456 mls_copy_effective(source, dest);
457 if (source->mm_flags & MAC_MLS_FLAG_RANGE)
458 mls_copy_range(source, dest);
462 * Policy module operations.
465 mls_init(struct mac_policy_conf *conf)
468 zone_mls = uma_zcreate("mac_mls", sizeof(struct mac_mls), NULL,
469 NULL, NULL, NULL, UMA_ALIGN_PTR, 0);
476 mls_init_label(struct label *label)
479 SLOT_SET(label, mls_alloc(M_WAITOK));
483 mls_init_label_waitcheck(struct label *label, int flag)
486 SLOT_SET(label, mls_alloc(flag));
487 if (SLOT(label) == NULL)
494 mls_destroy_label(struct label *label)
497 mls_free(SLOT(label));
498 SLOT_SET(label, NULL);
502 * mls_element_to_string() accepts an sbuf and MLS element. It converts the
503 * MLS element to a string and stores the result in the sbuf; if there isn't
504 * space in the sbuf, -1 is returned.
507 mls_element_to_string(struct sbuf *sb, struct mac_mls_element *element)
511 switch (element->mme_type) {
512 case MAC_MLS_TYPE_HIGH:
513 return (sbuf_printf(sb, "high"));
515 case MAC_MLS_TYPE_LOW:
516 return (sbuf_printf(sb, "low"));
518 case MAC_MLS_TYPE_EQUAL:
519 return (sbuf_printf(sb, "equal"));
521 case MAC_MLS_TYPE_LEVEL:
522 if (sbuf_printf(sb, "%d", element->mme_level) == -1)
526 for (i = 1; i <= MAC_MLS_MAX_COMPARTMENTS; i++) {
527 if (MAC_MLS_BIT_TEST(i, element->mme_compartments)) {
529 if (sbuf_putc(sb, ':') == -1)
531 if (sbuf_printf(sb, "%d", i) == -1)
535 if (sbuf_printf(sb, "+%d", i) == -1)
543 panic("mls_element_to_string: invalid type (%d)",
549 * mls_to_string() converts an MLS label to a string, and places the results
550 * in the passed sbuf. It returns 0 on success, or EINVAL if there isn't
551 * room in the sbuf. Note: the sbuf will be modified even in a failure case,
552 * so the caller may need to revert the sbuf by restoring the offset if
556 mls_to_string(struct sbuf *sb, struct mac_mls *mm)
559 if (mm->mm_flags & MAC_MLS_FLAG_EFFECTIVE) {
560 if (mls_element_to_string(sb, &mm->mm_effective) == -1)
564 if (mm->mm_flags & MAC_MLS_FLAG_RANGE) {
565 if (sbuf_putc(sb, '(') == -1)
568 if (mls_element_to_string(sb, &mm->mm_rangelow) == -1)
571 if (sbuf_putc(sb, '-') == -1)
574 if (mls_element_to_string(sb, &mm->mm_rangehigh) == -1)
577 if (sbuf_putc(sb, ')') == -1)
585 mls_externalize_label(struct label *label, char *element_name,
586 struct sbuf *sb, int *claimed)
590 if (strcmp(MAC_MLS_LABEL_NAME, element_name) != 0)
597 return (mls_to_string(sb, mm));
601 mls_parse_element(struct mac_mls_element *element, char *string)
603 char *compartment, *end, *level;
606 if (strcmp(string, "high") == 0 || strcmp(string, "hi") == 0) {
607 element->mme_type = MAC_MLS_TYPE_HIGH;
608 element->mme_level = MAC_MLS_TYPE_UNDEF;
609 } else if (strcmp(string, "low") == 0 || strcmp(string, "lo") == 0) {
610 element->mme_type = MAC_MLS_TYPE_LOW;
611 element->mme_level = MAC_MLS_TYPE_UNDEF;
612 } else if (strcmp(string, "equal") == 0 ||
613 strcmp(string, "eq") == 0) {
614 element->mme_type = MAC_MLS_TYPE_EQUAL;
615 element->mme_level = MAC_MLS_TYPE_UNDEF;
617 element->mme_type = MAC_MLS_TYPE_LEVEL;
620 * Numeric level piece of the element.
622 level = strsep(&string, ":");
623 value = strtol(level, &end, 10);
624 if (end == level || *end != '\0')
626 if (value < 0 || value > 65535)
628 element->mme_level = value;
631 * Optional compartment piece of the element. If none are
632 * included, we assume that the label has no compartments.
639 while ((compartment = strsep(&string, "+")) != NULL) {
640 value = strtol(compartment, &end, 10);
641 if (compartment == end || *end != '\0')
643 if (value < 1 || value > MAC_MLS_MAX_COMPARTMENTS)
645 MAC_MLS_BIT_SET(value, element->mme_compartments);
653 * Note: destructively consumes the string, make a local copy before calling
654 * if that's a problem.
657 mls_parse(struct mac_mls *mm, char *string)
659 char *rangehigh, *rangelow, *effective;
662 effective = strsep(&string, "(");
663 if (*effective == '\0')
666 if (string != NULL) {
667 rangelow = strsep(&string, "-");
670 rangehigh = strsep(&string, ")");
680 KASSERT((rangelow != NULL && rangehigh != NULL) ||
681 (rangelow == NULL && rangehigh == NULL),
682 ("mls_parse: range mismatch"));
684 bzero(mm, sizeof(*mm));
685 if (effective != NULL) {
686 error = mls_parse_element(&mm->mm_effective, effective);
689 mm->mm_flags |= MAC_MLS_FLAG_EFFECTIVE;
692 if (rangelow != NULL) {
693 error = mls_parse_element(&mm->mm_rangelow, rangelow);
696 error = mls_parse_element(&mm->mm_rangehigh, rangehigh);
699 mm->mm_flags |= MAC_MLS_FLAG_RANGE;
702 error = mls_valid(mm);
710 mls_internalize_label(struct label *label, char *element_name,
711 char *element_data, int *claimed)
713 struct mac_mls *mm, mm_temp;
716 if (strcmp(MAC_MLS_LABEL_NAME, element_name) != 0)
721 error = mls_parse(&mm_temp, element_data);
732 mls_copy_label(struct label *src, struct label *dest)
735 *SLOT(dest) = *SLOT(src);
739 * Object-specific entry point implementations are sorted alphabetically by
740 * object type name and then by operation.
743 mls_bpfdesc_check_receive(struct bpf_d *d, struct label *dlabel,
744 struct ifnet *ifp, struct label *ifplabel)
746 struct mac_mls *a, *b;
754 if (mls_equal_effective(a, b))
760 mls_bpfdesc_create(struct ucred *cred, struct bpf_d *d, struct label *dlabel)
762 struct mac_mls *source, *dest;
764 source = SLOT(cred->cr_label);
767 mls_copy_effective(source, dest);
771 mls_bpfdesc_create_mbuf(struct bpf_d *d, struct label *dlabel,
772 struct mbuf *m, struct label *mlabel)
774 struct mac_mls *source, *dest;
776 source = SLOT(dlabel);
779 mls_copy_effective(source, dest);
783 mls_cred_associate_nfsd(struct ucred *cred)
785 struct mac_mls *label;
787 label = SLOT(cred->cr_label);
788 mls_set_effective(label, MAC_MLS_TYPE_LOW, 0, NULL);
789 mls_set_range(label, MAC_MLS_TYPE_LOW, 0, NULL, MAC_MLS_TYPE_HIGH, 0,
794 mls_cred_check_relabel(struct ucred *cred, struct label *newlabel)
796 struct mac_mls *subj, *new;
799 subj = SLOT(cred->cr_label);
800 new = SLOT(newlabel);
803 * If there is an MLS label update for the credential, it may be an
804 * update of effective, range, or both.
806 error = mls_atmostflags(new, MAC_MLS_FLAGS_BOTH);
811 * If the MLS label is to be changed, authorize as appropriate.
813 if (new->mm_flags & MAC_MLS_FLAGS_BOTH) {
815 * If the change request modifies both the MLS label
816 * effective and range, check that the new effective will be
819 if ((new->mm_flags & MAC_MLS_FLAGS_BOTH) ==
820 MAC_MLS_FLAGS_BOTH && !mls_effective_in_range(new, new))
824 * To change the MLS effective label on a credential, the new
825 * effective label must be in the current range.
827 if (new->mm_flags & MAC_MLS_FLAG_EFFECTIVE &&
828 !mls_effective_in_range(new, subj))
832 * To change the MLS range label on a credential, the new
833 * range must be in the current range.
835 if (new->mm_flags & MAC_MLS_FLAG_RANGE &&
836 !mls_range_in_range(new, subj))
840 * To have EQUAL in any component of the new credential MLS
841 * label, the subject must already have EQUAL in their label.
843 if (mls_contains_equal(new)) {
844 error = mls_subject_privileged(subj);
854 mls_cred_check_visible(struct ucred *cr1, struct ucred *cr2)
856 struct mac_mls *subj, *obj;
861 subj = SLOT(cr1->cr_label);
862 obj = SLOT(cr2->cr_label);
865 if (!mls_dominate_effective(subj, obj))
872 mls_cred_create_init(struct ucred *cred)
874 struct mac_mls *dest;
876 dest = SLOT(cred->cr_label);
878 mls_set_effective(dest, MAC_MLS_TYPE_LOW, 0, NULL);
879 mls_set_range(dest, MAC_MLS_TYPE_LOW, 0, NULL, MAC_MLS_TYPE_HIGH, 0,
884 mls_cred_create_swapper(struct ucred *cred)
886 struct mac_mls *dest;
888 dest = SLOT(cred->cr_label);
890 mls_set_effective(dest, MAC_MLS_TYPE_EQUAL, 0, NULL);
891 mls_set_range(dest, MAC_MLS_TYPE_LOW, 0, NULL, MAC_MLS_TYPE_HIGH, 0,
896 mls_cred_relabel(struct ucred *cred, struct label *newlabel)
898 struct mac_mls *source, *dest;
900 source = SLOT(newlabel);
901 dest = SLOT(cred->cr_label);
903 mls_copy(source, dest);
907 mls_devfs_create_device(struct ucred *cred, struct mount *mp,
908 struct cdev *dev, struct devfs_dirent *de, struct label *delabel)
914 if (strcmp(dev->si_name, "null") == 0 ||
915 strcmp(dev->si_name, "zero") == 0 ||
916 strcmp(dev->si_name, "random") == 0 ||
917 strncmp(dev->si_name, "fd/", strlen("fd/")) == 0)
918 mls_type = MAC_MLS_TYPE_EQUAL;
919 else if (strcmp(dev->si_name, "kmem") == 0 ||
920 strcmp(dev->si_name, "mem") == 0)
921 mls_type = MAC_MLS_TYPE_HIGH;
922 else if (ptys_equal &&
923 (strncmp(dev->si_name, "ttyp", strlen("ttyp")) == 0 ||
924 strncmp(dev->si_name, "pts/", strlen("pts/")) == 0 ||
925 strncmp(dev->si_name, "ptyp", strlen("ptyp")) == 0))
926 mls_type = MAC_MLS_TYPE_EQUAL;
928 mls_type = MAC_MLS_TYPE_LOW;
929 mls_set_effective(mm, mls_type, 0, NULL);
933 mls_devfs_create_directory(struct mount *mp, char *dirname, int dirnamelen,
934 struct devfs_dirent *de, struct label *delabel)
939 mls_set_effective(mm, MAC_MLS_TYPE_LOW, 0, NULL);
943 mls_devfs_create_symlink(struct ucred *cred, struct mount *mp,
944 struct devfs_dirent *dd, struct label *ddlabel, struct devfs_dirent *de,
945 struct label *delabel)
947 struct mac_mls *source, *dest;
949 source = SLOT(cred->cr_label);
950 dest = SLOT(delabel);
952 mls_copy_effective(source, dest);
956 mls_devfs_update(struct mount *mp, struct devfs_dirent *de,
957 struct label *delabel, struct vnode *vp, struct label *vplabel)
959 struct mac_mls *source, *dest;
961 source = SLOT(vplabel);
962 dest = SLOT(delabel);
964 mls_copy_effective(source, dest);
968 mls_devfs_vnode_associate(struct mount *mp, struct label *mplabel,
969 struct devfs_dirent *de, struct label *delabel, struct vnode *vp,
970 struct label *vplabel)
972 struct mac_mls *source, *dest;
974 source = SLOT(delabel);
975 dest = SLOT(vplabel);
977 mls_copy_effective(source, dest);
981 mls_ifnet_check_relabel(struct ucred *cred, struct ifnet *ifp,
982 struct label *ifplabel, struct label *newlabel)
984 struct mac_mls *subj, *new;
987 subj = SLOT(cred->cr_label);
988 new = SLOT(newlabel);
991 * If there is an MLS label update for the interface, it may be an
992 * update of effective, range, or both.
994 error = mls_atmostflags(new, MAC_MLS_FLAGS_BOTH);
999 * Relabeling network interfaces requires MLS privilege.
1001 return (mls_subject_privileged(subj));
1005 mls_ifnet_check_transmit(struct ifnet *ifp, struct label *ifplabel,
1006 struct mbuf *m, struct label *mlabel)
1008 struct mac_mls *p, *i;
1016 return (mls_effective_in_range(p, i) ? 0 : EACCES);
1020 mls_ifnet_create(struct ifnet *ifp, struct label *ifplabel)
1022 struct mac_mls *dest;
1025 dest = SLOT(ifplabel);
1027 if (ifp->if_type == IFT_LOOP)
1028 type = MAC_MLS_TYPE_EQUAL;
1030 type = MAC_MLS_TYPE_LOW;
1032 mls_set_effective(dest, type, 0, NULL);
1033 mls_set_range(dest, type, 0, NULL, type, 0, NULL);
1037 mls_ifnet_create_mbuf(struct ifnet *ifp, struct label *ifplabel,
1038 struct mbuf *m, struct label *mlabel)
1040 struct mac_mls *source, *dest;
1042 source = SLOT(ifplabel);
1043 dest = SLOT(mlabel);
1045 mls_copy_effective(source, dest);
1049 mls_ifnet_relabel(struct ucred *cred, struct ifnet *ifp,
1050 struct label *ifplabel, struct label *newlabel)
1052 struct mac_mls *source, *dest;
1054 source = SLOT(newlabel);
1055 dest = SLOT(ifplabel);
1057 mls_copy(source, dest);
1061 mls_inpcb_check_deliver(struct inpcb *inp, struct label *inplabel,
1062 struct mbuf *m, struct label *mlabel)
1064 struct mac_mls *p, *i;
1072 return (mls_equal_effective(p, i) ? 0 : EACCES);
1076 mls_inpcb_check_visible(struct ucred *cred, struct inpcb *inp,
1077 struct label *inplabel)
1079 struct mac_mls *subj, *obj;
1084 subj = SLOT(cred->cr_label);
1085 obj = SLOT(inplabel);
1087 if (!mls_dominate_effective(subj, obj))
1094 mls_inpcb_create(struct socket *so, struct label *solabel, struct inpcb *inp,
1095 struct label *inplabel)
1097 struct mac_mls *source, *dest;
1099 source = SLOT(solabel);
1100 dest = SLOT(inplabel);
1102 mls_copy_effective(source, dest);
1106 mls_inpcb_create_mbuf(struct inpcb *inp, struct label *inplabel,
1107 struct mbuf *m, struct label *mlabel)
1109 struct mac_mls *source, *dest;
1111 source = SLOT(inplabel);
1112 dest = SLOT(mlabel);
1114 mls_copy_effective(source, dest);
1118 mls_inpcb_sosetlabel(struct socket *so, struct label *solabel,
1119 struct inpcb *inp, struct label *inplabel)
1121 struct mac_mls *source, *dest;
1123 SOCK_LOCK_ASSERT(so);
1125 source = SLOT(solabel);
1126 dest = SLOT(inplabel);
1128 mls_copy(source, dest);
1132 mls_ip6q_create(struct mbuf *m, struct label *mlabel, struct ip6q *q6,
1133 struct label *q6label)
1135 struct mac_mls *source, *dest;
1137 source = SLOT(mlabel);
1138 dest = SLOT(q6label);
1140 mls_copy_effective(source, dest);
1144 mls_ip6q_match(struct mbuf *m, struct label *mlabel, struct ip6q *q6,
1145 struct label *q6label)
1147 struct mac_mls *a, *b;
1152 return (mls_equal_effective(a, b));
1156 mls_ip6q_reassemble(struct ip6q *q6, struct label *q6label, struct mbuf *m,
1157 struct label *mlabel)
1159 struct mac_mls *source, *dest;
1161 source = SLOT(q6label);
1162 dest = SLOT(mlabel);
1164 /* Just use the head, since we require them all to match. */
1165 mls_copy_effective(source, dest);
1169 mls_ip6q_update(struct mbuf *m, struct label *mlabel, struct ip6q *q6,
1170 struct label *q6label)
1173 /* NOOP: we only accept matching labels, so no need to update */
1177 mls_ipq_create(struct mbuf *m, struct label *mlabel, struct ipq *q,
1178 struct label *qlabel)
1180 struct mac_mls *source, *dest;
1182 source = SLOT(mlabel);
1183 dest = SLOT(qlabel);
1185 mls_copy_effective(source, dest);
1189 mls_ipq_match(struct mbuf *m, struct label *mlabel, struct ipq *q,
1190 struct label *qlabel)
1192 struct mac_mls *a, *b;
1197 return (mls_equal_effective(a, b));
1201 mls_ipq_reassemble(struct ipq *q, struct label *qlabel, struct mbuf *m,
1202 struct label *mlabel)
1204 struct mac_mls *source, *dest;
1206 source = SLOT(qlabel);
1207 dest = SLOT(mlabel);
1209 /* Just use the head, since we require them all to match. */
1210 mls_copy_effective(source, dest);
1214 mls_ipq_update(struct mbuf *m, struct label *mlabel, struct ipq *q,
1215 struct label *qlabel)
1218 /* NOOP: we only accept matching labels, so no need to update */
1222 mls_mount_check_stat(struct ucred *cred, struct mount *mp,
1223 struct label *mntlabel)
1225 struct mac_mls *subj, *obj;
1230 subj = SLOT(cred->cr_label);
1231 obj = SLOT(mntlabel);
1233 if (!mls_dominate_effective(subj, obj))
1240 mls_mount_create(struct ucred *cred, struct mount *mp, struct label *mplabel)
1242 struct mac_mls *source, *dest;
1244 source = SLOT(cred->cr_label);
1245 dest = SLOT(mplabel);
1247 mls_copy_effective(source, dest);
1251 mls_netatalk_aarp_send(struct ifnet *ifp, struct label *ifplabel,
1252 struct mbuf *m, struct label *mlabel)
1254 struct mac_mls *dest;
1256 dest = SLOT(mlabel);
1258 mls_set_effective(dest, MAC_MLS_TYPE_EQUAL, 0, NULL);
1262 mls_netinet_arp_send(struct ifnet *ifp, struct label *ifplabel,
1263 struct mbuf *m, struct label *mlabel)
1265 struct mac_mls *dest;
1267 dest = SLOT(mlabel);
1269 mls_set_effective(dest, MAC_MLS_TYPE_EQUAL, 0, NULL);
1273 mls_netinet_firewall_reply(struct mbuf *mrecv, struct label *mrecvlabel,
1274 struct mbuf *msend, struct label *msendlabel)
1276 struct mac_mls *source, *dest;
1278 source = SLOT(mrecvlabel);
1279 dest = SLOT(msendlabel);
1281 mls_copy_effective(source, dest);
1285 mls_netinet_firewall_send(struct mbuf *m, struct label *mlabel)
1287 struct mac_mls *dest;
1289 dest = SLOT(mlabel);
1291 /* XXX: where is the label for the firewall really comming from? */
1292 mls_set_effective(dest, MAC_MLS_TYPE_EQUAL, 0, NULL);
1296 mls_netinet_fragment(struct mbuf *m, struct label *mlabel, struct mbuf *frag,
1297 struct label *fraglabel)
1299 struct mac_mls *source, *dest;
1301 source = SLOT(mlabel);
1302 dest = SLOT(fraglabel);
1304 mls_copy_effective(source, dest);
1308 mls_netinet_icmp_reply(struct mbuf *mrecv, struct label *mrecvlabel,
1309 struct mbuf *msend, struct label *msendlabel)
1311 struct mac_mls *source, *dest;
1313 source = SLOT(mrecvlabel);
1314 dest = SLOT(msendlabel);
1316 mls_copy_effective(source, dest);
1320 mls_netinet_igmp_send(struct ifnet *ifp, struct label *ifplabel,
1321 struct mbuf *m, struct label *mlabel)
1323 struct mac_mls *dest;
1325 dest = SLOT(mlabel);
1327 mls_set_effective(dest, MAC_MLS_TYPE_EQUAL, 0, NULL);
1331 mls_netinet6_nd6_send(struct ifnet *ifp, struct label *ifplabel,
1332 struct mbuf *m, struct label *mlabel)
1334 struct mac_mls *dest;
1336 dest = SLOT(mlabel);
1338 mls_set_effective(dest, MAC_MLS_TYPE_EQUAL, 0, NULL);
1342 mls_pipe_check_ioctl(struct ucred *cred, struct pipepair *pp,
1343 struct label *pplabel, unsigned long cmd, void /* caddr_t */ *data)
1349 /* XXX: This will be implemented soon... */
1355 mls_pipe_check_poll(struct ucred *cred, struct pipepair *pp,
1356 struct label *pplabel)
1358 struct mac_mls *subj, *obj;
1363 subj = SLOT(cred->cr_label);
1364 obj = SLOT(pplabel);
1366 if (!mls_dominate_effective(subj, obj))
1373 mls_pipe_check_read(struct ucred *cred, struct pipepair *pp,
1374 struct label *pplabel)
1376 struct mac_mls *subj, *obj;
1381 subj = SLOT(cred->cr_label);
1382 obj = SLOT(pplabel);
1384 if (!mls_dominate_effective(subj, obj))
1391 mls_pipe_check_relabel(struct ucred *cred, struct pipepair *pp,
1392 struct label *pplabel, struct label *newlabel)
1394 struct mac_mls *subj, *obj, *new;
1397 new = SLOT(newlabel);
1398 subj = SLOT(cred->cr_label);
1399 obj = SLOT(pplabel);
1402 * If there is an MLS label update for a pipe, it must be a effective
1405 error = mls_atmostflags(new, MAC_MLS_FLAG_EFFECTIVE);
1410 * To perform a relabel of a pipe (MLS label or not), MLS must
1411 * authorize the relabel.
1413 if (!mls_effective_in_range(obj, subj))
1417 * If the MLS label is to be changed, authorize as appropriate.
1419 if (new->mm_flags & MAC_MLS_FLAG_EFFECTIVE) {
1421 * To change the MLS label on a pipe, the new pipe label must
1422 * be in the subject range.
1424 if (!mls_effective_in_range(new, subj))
1428 * To change the MLS label on a pipe to be EQUAL, the subject
1429 * must have appropriate privilege.
1431 if (mls_contains_equal(new)) {
1432 error = mls_subject_privileged(subj);
1442 mls_pipe_check_stat(struct ucred *cred, struct pipepair *pp,
1443 struct label *pplabel)
1445 struct mac_mls *subj, *obj;
1450 subj = SLOT(cred->cr_label);
1451 obj = SLOT(pplabel);
1453 if (!mls_dominate_effective(subj, obj))
1460 mls_pipe_check_write(struct ucred *cred, struct pipepair *pp,
1461 struct label *pplabel)
1463 struct mac_mls *subj, *obj;
1468 subj = SLOT(cred->cr_label);
1469 obj = SLOT(pplabel);
1471 if (!mls_dominate_effective(obj, subj))
1478 mls_pipe_create(struct ucred *cred, struct pipepair *pp,
1479 struct label *pplabel)
1481 struct mac_mls *source, *dest;
1483 source = SLOT(cred->cr_label);
1484 dest = SLOT(pplabel);
1486 mls_copy_effective(source, dest);
1490 mls_pipe_relabel(struct ucred *cred, struct pipepair *pp,
1491 struct label *pplabel, struct label *newlabel)
1493 struct mac_mls *source, *dest;
1495 source = SLOT(newlabel);
1496 dest = SLOT(pplabel);
1498 mls_copy(source, dest);
1502 mls_posixsem_check_openunlink(struct ucred *cred, struct ksem *ks,
1503 struct label *kslabel)
1505 struct mac_mls *subj, *obj;
1510 subj = SLOT(cred->cr_label);
1511 obj = SLOT(kslabel);
1513 if (!mls_dominate_effective(obj, subj))
1520 mls_posixsem_check_rdonly(struct ucred *active_cred, struct ucred *file_cred,
1521 struct ksem *ks, struct label *kslabel)
1523 struct mac_mls *subj, *obj;
1528 subj = SLOT(active_cred->cr_label);
1529 obj = SLOT(kslabel);
1531 if (!mls_dominate_effective(subj, obj))
1538 mls_posixsem_check_setmode(struct ucred *cred, struct ksem *ks,
1539 struct label *shmlabel, mode_t mode)
1541 struct mac_mls *subj, *obj;
1546 subj = SLOT(cred->cr_label);
1547 obj = SLOT(shmlabel);
1549 if (!mls_dominate_effective(obj, subj))
1556 mls_posixsem_check_setowner(struct ucred *cred, struct ksem *ks,
1557 struct label *shmlabel, uid_t uid, gid_t gid)
1559 struct mac_mls *subj, *obj;
1564 subj = SLOT(cred->cr_label);
1565 obj = SLOT(shmlabel);
1567 if (!mls_dominate_effective(obj, subj))
1574 mls_posixsem_check_write(struct ucred *active_cred, struct ucred *file_cred,
1575 struct ksem *ks, struct label *kslabel)
1577 struct mac_mls *subj, *obj;
1582 subj = SLOT(active_cred->cr_label);
1583 obj = SLOT(kslabel);
1585 if (!mls_dominate_effective(obj, subj))
1592 mls_posixsem_create(struct ucred *cred, struct ksem *ks,
1593 struct label *kslabel)
1595 struct mac_mls *source, *dest;
1597 source = SLOT(cred->cr_label);
1598 dest = SLOT(kslabel);
1600 mls_copy_effective(source, dest);
1604 mls_posixshm_check_mmap(struct ucred *cred, struct shmfd *shmfd,
1605 struct label *shmlabel, int prot, int flags)
1607 struct mac_mls *subj, *obj;
1612 subj = SLOT(cred->cr_label);
1613 obj = SLOT(shmlabel);
1615 if (prot & (VM_PROT_READ | VM_PROT_EXECUTE)) {
1616 if (!mls_dominate_effective(subj, obj))
1619 if (((prot & VM_PROT_WRITE) != 0) && ((flags & MAP_SHARED) != 0)) {
1620 if (!mls_dominate_effective(obj, subj))
1628 mls_posixshm_check_open(struct ucred *cred, struct shmfd *shmfd,
1629 struct label *shmlabel, accmode_t accmode)
1631 struct mac_mls *subj, *obj;
1636 subj = SLOT(cred->cr_label);
1637 obj = SLOT(shmlabel);
1639 if (accmode & (VREAD | VEXEC | VSTAT_PERMS)) {
1640 if (!mls_dominate_effective(subj, obj))
1643 if (accmode & VMODIFY_PERMS) {
1644 if (!mls_dominate_effective(obj, subj))
1652 mls_posixshm_check_setmode(struct ucred *cred, struct shmfd *shmfd,
1653 struct label *shmlabel, mode_t mode)
1655 struct mac_mls *subj, *obj;
1660 subj = SLOT(cred->cr_label);
1661 obj = SLOT(shmlabel);
1663 if (!mls_dominate_effective(obj, subj))
1670 mls_posixshm_check_setowner(struct ucred *cred, struct shmfd *shmfd,
1671 struct label *shmlabel, uid_t uid, gid_t gid)
1673 struct mac_mls *subj, *obj;
1678 subj = SLOT(cred->cr_label);
1679 obj = SLOT(shmlabel);
1681 if (!mls_dominate_effective(obj, subj))
1688 mls_posixshm_check_stat(struct ucred *active_cred, struct ucred *file_cred,
1689 struct shmfd *shmfd, struct label *shmlabel)
1691 struct mac_mls *subj, *obj;
1696 subj = SLOT(active_cred->cr_label);
1697 obj = SLOT(shmlabel);
1699 if (!mls_dominate_effective(subj, obj))
1706 mls_posixshm_check_truncate(struct ucred *active_cred,
1707 struct ucred *file_cred, struct shmfd *shmfd, struct label *shmlabel)
1709 struct mac_mls *subj, *obj;
1714 subj = SLOT(active_cred->cr_label);
1715 obj = SLOT(shmlabel);
1717 if (!mls_dominate_effective(obj, subj))
1724 mls_posixshm_check_unlink(struct ucred *cred, struct shmfd *shmfd,
1725 struct label *shmlabel)
1727 struct mac_mls *subj, *obj;
1732 subj = SLOT(cred->cr_label);
1733 obj = SLOT(shmlabel);
1735 if (!mls_dominate_effective(obj, subj))
1742 mls_posixshm_create(struct ucred *cred, struct shmfd *shmfd,
1743 struct label *shmlabel)
1745 struct mac_mls *source, *dest;
1747 source = SLOT(cred->cr_label);
1748 dest = SLOT(shmlabel);
1750 mls_copy_effective(source, dest);
1754 mls_proc_check_debug(struct ucred *cred, struct proc *p)
1756 struct mac_mls *subj, *obj;
1761 subj = SLOT(cred->cr_label);
1762 obj = SLOT(p->p_ucred->cr_label);
1764 /* XXX: range checks */
1765 if (!mls_dominate_effective(subj, obj))
1767 if (!mls_dominate_effective(obj, subj))
1774 mls_proc_check_sched(struct ucred *cred, struct proc *p)
1776 struct mac_mls *subj, *obj;
1781 subj = SLOT(cred->cr_label);
1782 obj = SLOT(p->p_ucred->cr_label);
1784 /* XXX: range checks */
1785 if (!mls_dominate_effective(subj, obj))
1787 if (!mls_dominate_effective(obj, subj))
1794 mls_proc_check_signal(struct ucred *cred, struct proc *p, int signum)
1796 struct mac_mls *subj, *obj;
1801 subj = SLOT(cred->cr_label);
1802 obj = SLOT(p->p_ucred->cr_label);
1804 /* XXX: range checks */
1805 if (!mls_dominate_effective(subj, obj))
1807 if (!mls_dominate_effective(obj, subj))
1814 mls_socket_check_deliver(struct socket *so, struct label *solabel,
1815 struct mbuf *m, struct label *mlabel)
1817 struct mac_mls *p, *s;
1827 error = mls_equal_effective(p, s) ? 0 : EACCES;
1834 mls_socket_check_relabel(struct ucred *cred, struct socket *so,
1835 struct label *solabel, struct label *newlabel)
1837 struct mac_mls *subj, *obj, *new;
1840 SOCK_LOCK_ASSERT(so);
1842 new = SLOT(newlabel);
1843 subj = SLOT(cred->cr_label);
1844 obj = SLOT(solabel);
1847 * If there is an MLS label update for the socket, it may be an
1848 * update of effective.
1850 error = mls_atmostflags(new, MAC_MLS_FLAG_EFFECTIVE);
1855 * To relabel a socket, the old socket effective must be in the
1858 if (!mls_effective_in_range(obj, subj))
1862 * If the MLS label is to be changed, authorize as appropriate.
1864 if (new->mm_flags & MAC_MLS_FLAG_EFFECTIVE) {
1866 * To relabel a socket, the new socket effective must be in
1867 * the subject range.
1869 if (!mls_effective_in_range(new, subj))
1873 * To change the MLS label on the socket to contain EQUAL,
1874 * the subject must have appropriate privilege.
1876 if (mls_contains_equal(new)) {
1877 error = mls_subject_privileged(subj);
1887 mls_socket_check_visible(struct ucred *cred, struct socket *so,
1888 struct label *solabel)
1890 struct mac_mls *subj, *obj;
1895 subj = SLOT(cred->cr_label);
1896 obj = SLOT(solabel);
1899 if (!mls_dominate_effective(subj, obj)) {
1909 mls_socket_create(struct ucred *cred, struct socket *so,
1910 struct label *solabel)
1912 struct mac_mls *source, *dest;
1914 source = SLOT(cred->cr_label);
1915 dest = SLOT(solabel);
1917 mls_copy_effective(source, dest);
1921 mls_socket_create_mbuf(struct socket *so, struct label *solabel,
1922 struct mbuf *m, struct label *mlabel)
1924 struct mac_mls *source, *dest;
1926 source = SLOT(solabel);
1927 dest = SLOT(mlabel);
1930 mls_copy_effective(source, dest);
1935 mls_socket_newconn(struct socket *oldso, struct label *oldsolabel,
1936 struct socket *newso, struct label *newsolabel)
1938 struct mac_mls source, *dest;
1941 source = *SLOT(oldsolabel);
1944 dest = SLOT(newsolabel);
1947 mls_copy_effective(&source, dest);
1952 mls_socket_relabel(struct ucred *cred, struct socket *so,
1953 struct label *solabel, struct label *newlabel)
1955 struct mac_mls *source, *dest;
1957 SOCK_LOCK_ASSERT(so);
1959 source = SLOT(newlabel);
1960 dest = SLOT(solabel);
1962 mls_copy(source, dest);
1966 mls_socketpeer_set_from_mbuf(struct mbuf *m, struct label *mlabel,
1967 struct socket *so, struct label *sopeerlabel)
1969 struct mac_mls *source, *dest;
1971 source = SLOT(mlabel);
1972 dest = SLOT(sopeerlabel);
1975 mls_copy_effective(source, dest);
1980 mls_socketpeer_set_from_socket(struct socket *oldso,
1981 struct label *oldsolabel, struct socket *newso,
1982 struct label *newsopeerlabel)
1984 struct mac_mls source, *dest;
1987 source = *SLOT(oldsolabel);
1990 dest = SLOT(newsopeerlabel);
1993 mls_copy_effective(&source, dest);
1998 mls_syncache_create(struct label *label, struct inpcb *inp)
2000 struct mac_mls *source, *dest;
2002 source = SLOT(inp->inp_label);
2005 mls_copy_effective(source, dest);
2009 mls_syncache_create_mbuf(struct label *sc_label, struct mbuf *m,
2010 struct label *mlabel)
2012 struct mac_mls *source, *dest;
2014 source = SLOT(sc_label);
2015 dest = SLOT(mlabel);
2017 mls_copy_effective(source, dest);
2021 mls_system_check_acct(struct ucred *cred, struct vnode *vp,
2022 struct label *vplabel)
2024 struct mac_mls *subj, *obj;
2029 subj = SLOT(cred->cr_label);
2030 obj = SLOT(vplabel);
2032 if (!mls_dominate_effective(obj, subj) ||
2033 !mls_dominate_effective(subj, obj))
2040 mls_system_check_auditctl(struct ucred *cred, struct vnode *vp,
2041 struct label *vplabel)
2043 struct mac_mls *subj, *obj;
2048 subj = SLOT(cred->cr_label);
2049 obj = SLOT(vplabel);
2051 if (!mls_dominate_effective(obj, subj) ||
2052 !mls_dominate_effective(subj, obj))
2059 mls_system_check_swapon(struct ucred *cred, struct vnode *vp,
2060 struct label *vplabel)
2062 struct mac_mls *subj, *obj;
2067 subj = SLOT(cred->cr_label);
2068 obj = SLOT(vplabel);
2070 if (!mls_dominate_effective(obj, subj) ||
2071 !mls_dominate_effective(subj, obj))
2078 mls_sysvmsg_cleanup(struct label *msglabel)
2081 bzero(SLOT(msglabel), sizeof(struct mac_mls));
2085 mls_sysvmsg_create(struct ucred *cred, struct msqid_kernel *msqkptr,
2086 struct label *msqlabel, struct msg *msgptr, struct label *msglabel)
2088 struct mac_mls *source, *dest;
2090 /* Ignore the msgq label. */
2091 source = SLOT(cred->cr_label);
2092 dest = SLOT(msglabel);
2094 mls_copy_effective(source, dest);
2098 mls_sysvmsq_check_msgrcv(struct ucred *cred, struct msg *msgptr,
2099 struct label *msglabel)
2101 struct mac_mls *subj, *obj;
2106 subj = SLOT(cred->cr_label);
2107 obj = SLOT(msglabel);
2109 if (!mls_dominate_effective(subj, obj))
2116 mls_sysvmsq_check_msgrmid(struct ucred *cred, struct msg *msgptr,
2117 struct label *msglabel)
2119 struct mac_mls *subj, *obj;
2124 subj = SLOT(cred->cr_label);
2125 obj = SLOT(msglabel);
2127 if (!mls_dominate_effective(obj, subj))
2134 mls_sysvmsq_check_msqget(struct ucred *cred, struct msqid_kernel *msqkptr,
2135 struct label *msqklabel)
2137 struct mac_mls *subj, *obj;
2142 subj = SLOT(cred->cr_label);
2143 obj = SLOT(msqklabel);
2145 if (!mls_dominate_effective(subj, obj))
2152 mls_sysvmsq_check_msqsnd(struct ucred *cred, struct msqid_kernel *msqkptr,
2153 struct label *msqklabel)
2155 struct mac_mls *subj, *obj;
2160 subj = SLOT(cred->cr_label);
2161 obj = SLOT(msqklabel);
2163 if (!mls_dominate_effective(obj, subj))
2170 mls_sysvmsq_check_msqrcv(struct ucred *cred, struct msqid_kernel *msqkptr,
2171 struct label *msqklabel)
2173 struct mac_mls *subj, *obj;
2178 subj = SLOT(cred->cr_label);
2179 obj = SLOT(msqklabel);
2181 if (!mls_dominate_effective(subj, obj))
2188 mls_sysvmsq_check_msqctl(struct ucred *cred, struct msqid_kernel *msqkptr,
2189 struct label *msqklabel, int cmd)
2191 struct mac_mls *subj, *obj;
2196 subj = SLOT(cred->cr_label);
2197 obj = SLOT(msqklabel);
2202 if (!mls_dominate_effective(obj, subj))
2207 if (!mls_dominate_effective(subj, obj))
2219 mls_sysvmsq_cleanup(struct label *msqlabel)
2222 bzero(SLOT(msqlabel), sizeof(struct mac_mls));
2226 mls_sysvmsq_create(struct ucred *cred, struct msqid_kernel *msqkptr,
2227 struct label *msqlabel)
2229 struct mac_mls *source, *dest;
2231 source = SLOT(cred->cr_label);
2232 dest = SLOT(msqlabel);
2234 mls_copy_effective(source, dest);
2238 mls_sysvsem_check_semctl(struct ucred *cred, struct semid_kernel *semakptr,
2239 struct label *semaklabel, int cmd)
2241 struct mac_mls *subj, *obj;
2246 subj = SLOT(cred->cr_label);
2247 obj = SLOT(semaklabel);
2254 if (!mls_dominate_effective(obj, subj))
2264 if (!mls_dominate_effective(subj, obj))
2276 mls_sysvsem_check_semget(struct ucred *cred, struct semid_kernel *semakptr,
2277 struct label *semaklabel)
2279 struct mac_mls *subj, *obj;
2284 subj = SLOT(cred->cr_label);
2285 obj = SLOT(semaklabel);
2287 if (!mls_dominate_effective(subj, obj))
2294 mls_sysvsem_check_semop(struct ucred *cred, struct semid_kernel *semakptr,
2295 struct label *semaklabel, size_t accesstype)
2297 struct mac_mls *subj, *obj;
2302 subj = SLOT(cred->cr_label);
2303 obj = SLOT(semaklabel);
2305 if( accesstype & SEM_R )
2306 if (!mls_dominate_effective(subj, obj))
2309 if( accesstype & SEM_A )
2310 if (!mls_dominate_effective(obj, subj))
2317 mls_sysvsem_cleanup(struct label *semalabel)
2320 bzero(SLOT(semalabel), sizeof(struct mac_mls));
2324 mls_sysvsem_create(struct ucred *cred, struct semid_kernel *semakptr,
2325 struct label *semalabel)
2327 struct mac_mls *source, *dest;
2329 source = SLOT(cred->cr_label);
2330 dest = SLOT(semalabel);
2332 mls_copy_effective(source, dest);
2336 mls_sysvshm_check_shmat(struct ucred *cred, struct shmid_kernel *shmsegptr,
2337 struct label *shmseglabel, int shmflg)
2339 struct mac_mls *subj, *obj;
2344 subj = SLOT(cred->cr_label);
2345 obj = SLOT(shmseglabel);
2347 if (!mls_dominate_effective(subj, obj))
2349 if ((shmflg & SHM_RDONLY) == 0) {
2350 if (!mls_dominate_effective(obj, subj))
2358 mls_sysvshm_check_shmctl(struct ucred *cred, struct shmid_kernel *shmsegptr,
2359 struct label *shmseglabel, int cmd)
2361 struct mac_mls *subj, *obj;
2366 subj = SLOT(cred->cr_label);
2367 obj = SLOT(shmseglabel);
2372 if (!mls_dominate_effective(obj, subj))
2378 if (!mls_dominate_effective(subj, obj))
2390 mls_sysvshm_check_shmget(struct ucred *cred, struct shmid_kernel *shmsegptr,
2391 struct label *shmseglabel, int shmflg)
2393 struct mac_mls *subj, *obj;
2398 subj = SLOT(cred->cr_label);
2399 obj = SLOT(shmseglabel);
2401 if (!mls_dominate_effective(obj, subj))
2408 mls_sysvshm_cleanup(struct label *shmlabel)
2411 bzero(SLOT(shmlabel), sizeof(struct mac_mls));
2415 mls_sysvshm_create(struct ucred *cred, struct shmid_kernel *shmsegptr,
2416 struct label *shmlabel)
2418 struct mac_mls *source, *dest;
2420 source = SLOT(cred->cr_label);
2421 dest = SLOT(shmlabel);
2423 mls_copy_effective(source, dest);
2427 mls_vnode_associate_extattr(struct mount *mp, struct label *mplabel,
2428 struct vnode *vp, struct label *vplabel)
2430 struct mac_mls mm_temp, *source, *dest;
2433 source = SLOT(mplabel);
2434 dest = SLOT(vplabel);
2436 buflen = sizeof(mm_temp);
2437 bzero(&mm_temp, buflen);
2439 error = vn_extattr_get(vp, IO_NODELOCKED, MAC_MLS_EXTATTR_NAMESPACE,
2440 MAC_MLS_EXTATTR_NAME, &buflen, (char *) &mm_temp, curthread);
2441 if (error == ENOATTR || error == EOPNOTSUPP) {
2442 /* Fall back to the mntlabel. */
2443 mls_copy_effective(source, dest);
2448 if (buflen != sizeof(mm_temp)) {
2449 printf("mls_vnode_associate_extattr: bad size %d\n", buflen);
2452 if (mls_valid(&mm_temp) != 0) {
2453 printf("mls_vnode_associate_extattr: invalid\n");
2456 if ((mm_temp.mm_flags & MAC_MLS_FLAGS_BOTH) !=
2457 MAC_MLS_FLAG_EFFECTIVE) {
2458 printf("mls_associated_vnode_extattr: not effective\n");
2462 mls_copy_effective(&mm_temp, dest);
2467 mls_vnode_associate_singlelabel(struct mount *mp, struct label *mplabel,
2468 struct vnode *vp, struct label *vplabel)
2470 struct mac_mls *source, *dest;
2472 source = SLOT(mplabel);
2473 dest = SLOT(vplabel);
2475 mls_copy_effective(source, dest);
2479 mls_vnode_check_chdir(struct ucred *cred, struct vnode *dvp,
2480 struct label *dvplabel)
2482 struct mac_mls *subj, *obj;
2487 subj = SLOT(cred->cr_label);
2488 obj = SLOT(dvplabel);
2490 if (!mls_dominate_effective(subj, obj))
2497 mls_vnode_check_chroot(struct ucred *cred, struct vnode *dvp,
2498 struct label *dvplabel)
2500 struct mac_mls *subj, *obj;
2505 subj = SLOT(cred->cr_label);
2506 obj = SLOT(dvplabel);
2508 if (!mls_dominate_effective(subj, obj))
2515 mls_vnode_check_create(struct ucred *cred, struct vnode *dvp,
2516 struct label *dvplabel, struct componentname *cnp, struct vattr *vap)
2518 struct mac_mls *subj, *obj;
2523 subj = SLOT(cred->cr_label);
2524 obj = SLOT(dvplabel);
2526 if (!mls_dominate_effective(obj, subj))
2533 mls_vnode_check_deleteacl(struct ucred *cred, struct vnode *vp,
2534 struct label *vplabel, acl_type_t type)
2536 struct mac_mls *subj, *obj;
2541 subj = SLOT(cred->cr_label);
2542 obj = SLOT(vplabel);
2544 if (!mls_dominate_effective(obj, subj))
2551 mls_vnode_check_deleteextattr(struct ucred *cred, struct vnode *vp,
2552 struct label *vplabel, int attrnamespace, const char *name)
2554 struct mac_mls *subj, *obj;
2559 subj = SLOT(cred->cr_label);
2560 obj = SLOT(vplabel);
2562 if (!mls_dominate_effective(obj, subj))
2569 mls_vnode_check_exec(struct ucred *cred, struct vnode *vp,
2570 struct label *vplabel, struct image_params *imgp,
2571 struct label *execlabel)
2573 struct mac_mls *subj, *obj, *exec;
2576 if (execlabel != NULL) {
2578 * We currently don't permit labels to be changed at
2579 * exec-time as part of MLS, so disallow non-NULL MLS label
2580 * elements in the execlabel.
2582 exec = SLOT(execlabel);
2583 error = mls_atmostflags(exec, 0);
2591 subj = SLOT(cred->cr_label);
2592 obj = SLOT(vplabel);
2594 if (!mls_dominate_effective(subj, obj))
2601 mls_vnode_check_getacl(struct ucred *cred, struct vnode *vp,
2602 struct label *vplabel, acl_type_t type)
2604 struct mac_mls *subj, *obj;
2609 subj = SLOT(cred->cr_label);
2610 obj = SLOT(vplabel);
2612 if (!mls_dominate_effective(subj, obj))
2619 mls_vnode_check_getextattr(struct ucred *cred, struct vnode *vp,
2620 struct label *vplabel, int attrnamespace, const char *name)
2622 struct mac_mls *subj, *obj;
2627 subj = SLOT(cred->cr_label);
2628 obj = SLOT(vplabel);
2630 if (!mls_dominate_effective(subj, obj))
2637 mls_vnode_check_link(struct ucred *cred, struct vnode *dvp,
2638 struct label *dvplabel, struct vnode *vp, struct label *vplabel,
2639 struct componentname *cnp)
2641 struct mac_mls *subj, *obj;
2646 subj = SLOT(cred->cr_label);
2647 obj = SLOT(dvplabel);
2649 if (!mls_dominate_effective(obj, subj))
2652 obj = SLOT(vplabel);
2653 if (!mls_dominate_effective(obj, subj))
2660 mls_vnode_check_listextattr(struct ucred *cred, struct vnode *vp,
2661 struct label *vplabel, int attrnamespace)
2664 struct mac_mls *subj, *obj;
2669 subj = SLOT(cred->cr_label);
2670 obj = SLOT(vplabel);
2672 if (!mls_dominate_effective(subj, obj))
2679 mls_vnode_check_lookup(struct ucred *cred, struct vnode *dvp,
2680 struct label *dvplabel, struct componentname *cnp)
2682 struct mac_mls *subj, *obj;
2687 subj = SLOT(cred->cr_label);
2688 obj = SLOT(dvplabel);
2690 if (!mls_dominate_effective(subj, obj))
2697 mls_vnode_check_mmap(struct ucred *cred, struct vnode *vp,
2698 struct label *vplabel, int prot, int flags)
2700 struct mac_mls *subj, *obj;
2703 * Rely on the use of open()-time protections to handle
2704 * non-revocation cases.
2706 if (!mls_enabled || !revocation_enabled)
2709 subj = SLOT(cred->cr_label);
2710 obj = SLOT(vplabel);
2712 if (prot & (VM_PROT_READ | VM_PROT_EXECUTE)) {
2713 if (!mls_dominate_effective(subj, obj))
2716 if (((prot & VM_PROT_WRITE) != 0) && ((flags & MAP_SHARED) != 0)) {
2717 if (!mls_dominate_effective(obj, subj))
2725 mls_vnode_check_open(struct ucred *cred, struct vnode *vp,
2726 struct label *vplabel, accmode_t accmode)
2728 struct mac_mls *subj, *obj;
2733 subj = SLOT(cred->cr_label);
2734 obj = SLOT(vplabel);
2736 /* XXX privilege override for admin? */
2737 if (accmode & (VREAD | VEXEC | VSTAT_PERMS)) {
2738 if (!mls_dominate_effective(subj, obj))
2741 if (accmode & VMODIFY_PERMS) {
2742 if (!mls_dominate_effective(obj, subj))
2750 mls_vnode_check_poll(struct ucred *active_cred, struct ucred *file_cred,
2751 struct vnode *vp, struct label *vplabel)
2753 struct mac_mls *subj, *obj;
2755 if (!mls_enabled || !revocation_enabled)
2758 subj = SLOT(active_cred->cr_label);
2759 obj = SLOT(vplabel);
2761 if (!mls_dominate_effective(subj, obj))
2768 mls_vnode_check_read(struct ucred *active_cred, struct ucred *file_cred,
2769 struct vnode *vp, struct label *vplabel)
2771 struct mac_mls *subj, *obj;
2773 if (!mls_enabled || !revocation_enabled)
2776 subj = SLOT(active_cred->cr_label);
2777 obj = SLOT(vplabel);
2779 if (!mls_dominate_effective(subj, obj))
2786 mls_vnode_check_readdir(struct ucred *cred, struct vnode *dvp,
2787 struct label *dvplabel)
2789 struct mac_mls *subj, *obj;
2794 subj = SLOT(cred->cr_label);
2795 obj = SLOT(dvplabel);
2797 if (!mls_dominate_effective(subj, obj))
2804 mls_vnode_check_readlink(struct ucred *cred, struct vnode *vp,
2805 struct label *vplabel)
2807 struct mac_mls *subj, *obj;
2812 subj = SLOT(cred->cr_label);
2813 obj = SLOT(vplabel);
2815 if (!mls_dominate_effective(subj, obj))
2822 mls_vnode_check_relabel(struct ucred *cred, struct vnode *vp,
2823 struct label *vplabel, struct label *newlabel)
2825 struct mac_mls *old, *new, *subj;
2828 old = SLOT(vplabel);
2829 new = SLOT(newlabel);
2830 subj = SLOT(cred->cr_label);
2833 * If there is an MLS label update for the vnode, it must be a
2836 error = mls_atmostflags(new, MAC_MLS_FLAG_EFFECTIVE);
2841 * To perform a relabel of the vnode (MLS label or not), MLS must
2842 * authorize the relabel.
2844 if (!mls_effective_in_range(old, subj))
2848 * If the MLS label is to be changed, authorize as appropriate.
2850 if (new->mm_flags & MAC_MLS_FLAG_EFFECTIVE) {
2852 * To change the MLS label on a vnode, the new vnode label
2853 * must be in the subject range.
2855 if (!mls_effective_in_range(new, subj))
2859 * To change the MLS label on the vnode to be EQUAL, the
2860 * subject must have appropriate privilege.
2862 if (mls_contains_equal(new)) {
2863 error = mls_subject_privileged(subj);
2873 mls_vnode_check_rename_from(struct ucred *cred, struct vnode *dvp,
2874 struct label *dvplabel, struct vnode *vp, struct label *vplabel,
2875 struct componentname *cnp)
2877 struct mac_mls *subj, *obj;
2882 subj = SLOT(cred->cr_label);
2883 obj = SLOT(dvplabel);
2885 if (!mls_dominate_effective(obj, subj))
2888 obj = SLOT(vplabel);
2890 if (!mls_dominate_effective(obj, subj))
2897 mls_vnode_check_rename_to(struct ucred *cred, struct vnode *dvp,
2898 struct label *dvplabel, struct vnode *vp, struct label *vplabel,
2899 int samedir, struct componentname *cnp)
2901 struct mac_mls *subj, *obj;
2906 subj = SLOT(cred->cr_label);
2907 obj = SLOT(dvplabel);
2909 if (!mls_dominate_effective(obj, subj))
2913 obj = SLOT(vplabel);
2915 if (!mls_dominate_effective(obj, subj))
2923 mls_vnode_check_revoke(struct ucred *cred, struct vnode *vp,
2924 struct label *vplabel)
2926 struct mac_mls *subj, *obj;
2931 subj = SLOT(cred->cr_label);
2932 obj = SLOT(vplabel);
2934 if (!mls_dominate_effective(obj, subj))
2941 mls_vnode_check_setacl(struct ucred *cred, struct vnode *vp,
2942 struct label *vplabel, acl_type_t type, struct acl *acl)
2944 struct mac_mls *subj, *obj;
2949 subj = SLOT(cred->cr_label);
2950 obj = SLOT(vplabel);
2952 if (!mls_dominate_effective(obj, subj))
2959 mls_vnode_check_setextattr(struct ucred *cred, struct vnode *vp,
2960 struct label *vplabel, int attrnamespace, const char *name)
2962 struct mac_mls *subj, *obj;
2967 subj = SLOT(cred->cr_label);
2968 obj = SLOT(vplabel);
2970 if (!mls_dominate_effective(obj, subj))
2973 /* XXX: protect the MAC EA in a special way? */
2979 mls_vnode_check_setflags(struct ucred *cred, struct vnode *vp,
2980 struct label *vplabel, u_long flags)
2982 struct mac_mls *subj, *obj;
2987 subj = SLOT(cred->cr_label);
2988 obj = SLOT(vplabel);
2990 if (!mls_dominate_effective(obj, subj))
2997 mls_vnode_check_setmode(struct ucred *cred, struct vnode *vp,
2998 struct label *vplabel, mode_t mode)
3000 struct mac_mls *subj, *obj;
3005 subj = SLOT(cred->cr_label);
3006 obj = SLOT(vplabel);
3008 if (!mls_dominate_effective(obj, subj))
3015 mls_vnode_check_setowner(struct ucred *cred, struct vnode *vp,
3016 struct label *vplabel, uid_t uid, gid_t gid)
3018 struct mac_mls *subj, *obj;
3023 subj = SLOT(cred->cr_label);
3024 obj = SLOT(vplabel);
3026 if (!mls_dominate_effective(obj, subj))
3033 mls_vnode_check_setutimes(struct ucred *cred, struct vnode *vp,
3034 struct label *vplabel, struct timespec atime, struct timespec mtime)
3036 struct mac_mls *subj, *obj;
3041 subj = SLOT(cred->cr_label);
3042 obj = SLOT(vplabel);
3044 if (!mls_dominate_effective(obj, subj))
3051 mls_vnode_check_stat(struct ucred *active_cred, struct ucred *file_cred,
3052 struct vnode *vp, struct label *vplabel)
3054 struct mac_mls *subj, *obj;
3059 subj = SLOT(active_cred->cr_label);
3060 obj = SLOT(vplabel);
3062 if (!mls_dominate_effective(subj, obj))
3069 mls_vnode_check_unlink(struct ucred *cred, struct vnode *dvp,
3070 struct label *dvplabel, struct vnode *vp, struct label *vplabel,
3071 struct componentname *cnp)
3073 struct mac_mls *subj, *obj;
3078 subj = SLOT(cred->cr_label);
3079 obj = SLOT(dvplabel);
3081 if (!mls_dominate_effective(obj, subj))
3084 obj = SLOT(vplabel);
3086 if (!mls_dominate_effective(obj, subj))
3093 mls_vnode_check_write(struct ucred *active_cred, struct ucred *file_cred,
3094 struct vnode *vp, struct label *vplabel)
3096 struct mac_mls *subj, *obj;
3098 if (!mls_enabled || !revocation_enabled)
3101 subj = SLOT(active_cred->cr_label);
3102 obj = SLOT(vplabel);
3104 if (!mls_dominate_effective(obj, subj))
3111 mls_vnode_create_extattr(struct ucred *cred, struct mount *mp,
3112 struct label *mplabel, struct vnode *dvp, struct label *dvplabel,
3113 struct vnode *vp, struct label *vplabel, struct componentname *cnp)
3115 struct mac_mls *source, *dest, mm_temp;
3119 buflen = sizeof(mm_temp);
3120 bzero(&mm_temp, buflen);
3122 source = SLOT(cred->cr_label);
3123 dest = SLOT(vplabel);
3124 mls_copy_effective(source, &mm_temp);
3126 error = vn_extattr_set(vp, IO_NODELOCKED, MAC_MLS_EXTATTR_NAMESPACE,
3127 MAC_MLS_EXTATTR_NAME, buflen, (char *) &mm_temp, curthread);
3129 mls_copy_effective(source, dest);
3134 mls_vnode_relabel(struct ucred *cred, struct vnode *vp,
3135 struct label *vplabel, struct label *label)
3137 struct mac_mls *source, *dest;
3139 source = SLOT(label);
3140 dest = SLOT(vplabel);
3142 mls_copy(source, dest);
3146 mls_vnode_setlabel_extattr(struct ucred *cred, struct vnode *vp,
3147 struct label *vplabel, struct label *intlabel)
3149 struct mac_mls *source, mm_temp;
3153 buflen = sizeof(mm_temp);
3154 bzero(&mm_temp, buflen);
3156 source = SLOT(intlabel);
3157 if ((source->mm_flags & MAC_MLS_FLAG_EFFECTIVE) == 0)
3160 mls_copy_effective(source, &mm_temp);
3162 error = vn_extattr_set(vp, IO_NODELOCKED, MAC_MLS_EXTATTR_NAMESPACE,
3163 MAC_MLS_EXTATTR_NAME, buflen, (char *) &mm_temp, curthread);
3167 static struct mac_policy_ops mls_ops =
3169 .mpo_init = mls_init,
3171 .mpo_bpfdesc_check_receive = mls_bpfdesc_check_receive,
3172 .mpo_bpfdesc_create = mls_bpfdesc_create,
3173 .mpo_bpfdesc_create_mbuf = mls_bpfdesc_create_mbuf,
3174 .mpo_bpfdesc_destroy_label = mls_destroy_label,
3175 .mpo_bpfdesc_init_label = mls_init_label,
3177 .mpo_cred_associate_nfsd = mls_cred_associate_nfsd,
3178 .mpo_cred_check_relabel = mls_cred_check_relabel,
3179 .mpo_cred_check_visible = mls_cred_check_visible,
3180 .mpo_cred_copy_label = mls_copy_label,
3181 .mpo_cred_create_init = mls_cred_create_init,
3182 .mpo_cred_create_swapper = mls_cred_create_swapper,
3183 .mpo_cred_destroy_label = mls_destroy_label,
3184 .mpo_cred_externalize_label = mls_externalize_label,
3185 .mpo_cred_init_label = mls_init_label,
3186 .mpo_cred_internalize_label = mls_internalize_label,
3187 .mpo_cred_relabel = mls_cred_relabel,
3189 .mpo_devfs_create_device = mls_devfs_create_device,
3190 .mpo_devfs_create_directory = mls_devfs_create_directory,
3191 .mpo_devfs_create_symlink = mls_devfs_create_symlink,
3192 .mpo_devfs_destroy_label = mls_destroy_label,
3193 .mpo_devfs_init_label = mls_init_label,
3194 .mpo_devfs_update = mls_devfs_update,
3195 .mpo_devfs_vnode_associate = mls_devfs_vnode_associate,
3197 .mpo_ifnet_check_relabel = mls_ifnet_check_relabel,
3198 .mpo_ifnet_check_transmit = mls_ifnet_check_transmit,
3199 .mpo_ifnet_copy_label = mls_copy_label,
3200 .mpo_ifnet_create = mls_ifnet_create,
3201 .mpo_ifnet_create_mbuf = mls_ifnet_create_mbuf,
3202 .mpo_ifnet_destroy_label = mls_destroy_label,
3203 .mpo_ifnet_externalize_label = mls_externalize_label,
3204 .mpo_ifnet_init_label = mls_init_label,
3205 .mpo_ifnet_internalize_label = mls_internalize_label,
3206 .mpo_ifnet_relabel = mls_ifnet_relabel,
3208 .mpo_inpcb_check_deliver = mls_inpcb_check_deliver,
3209 .mpo_inpcb_check_visible = mls_inpcb_check_visible,
3210 .mpo_inpcb_create = mls_inpcb_create,
3211 .mpo_inpcb_create_mbuf = mls_inpcb_create_mbuf,
3212 .mpo_inpcb_destroy_label = mls_destroy_label,
3213 .mpo_inpcb_init_label = mls_init_label_waitcheck,
3214 .mpo_inpcb_sosetlabel = mls_inpcb_sosetlabel,
3216 .mpo_ip6q_create = mls_ip6q_create,
3217 .mpo_ip6q_destroy_label = mls_destroy_label,
3218 .mpo_ip6q_init_label = mls_init_label_waitcheck,
3219 .mpo_ip6q_match = mls_ip6q_match,
3220 .mpo_ip6q_reassemble = mls_ip6q_reassemble,
3221 .mpo_ip6q_update = mls_ip6q_update,
3223 .mpo_ipq_create = mls_ipq_create,
3224 .mpo_ipq_destroy_label = mls_destroy_label,
3225 .mpo_ipq_init_label = mls_init_label_waitcheck,
3226 .mpo_ipq_match = mls_ipq_match,
3227 .mpo_ipq_reassemble = mls_ipq_reassemble,
3228 .mpo_ipq_update = mls_ipq_update,
3230 .mpo_mbuf_copy_label = mls_copy_label,
3231 .mpo_mbuf_destroy_label = mls_destroy_label,
3232 .mpo_mbuf_init_label = mls_init_label_waitcheck,
3234 .mpo_mount_check_stat = mls_mount_check_stat,
3235 .mpo_mount_create = mls_mount_create,
3236 .mpo_mount_destroy_label = mls_destroy_label,
3237 .mpo_mount_init_label = mls_init_label,
3239 .mpo_netatalk_aarp_send = mls_netatalk_aarp_send,
3241 .mpo_netinet_arp_send = mls_netinet_arp_send,
3242 .mpo_netinet_firewall_reply = mls_netinet_firewall_reply,
3243 .mpo_netinet_firewall_send = mls_netinet_firewall_send,
3244 .mpo_netinet_fragment = mls_netinet_fragment,
3245 .mpo_netinet_icmp_reply = mls_netinet_icmp_reply,
3246 .mpo_netinet_igmp_send = mls_netinet_igmp_send,
3248 .mpo_netinet6_nd6_send = mls_netinet6_nd6_send,
3250 .mpo_pipe_check_ioctl = mls_pipe_check_ioctl,
3251 .mpo_pipe_check_poll = mls_pipe_check_poll,
3252 .mpo_pipe_check_read = mls_pipe_check_read,
3253 .mpo_pipe_check_relabel = mls_pipe_check_relabel,
3254 .mpo_pipe_check_stat = mls_pipe_check_stat,
3255 .mpo_pipe_check_write = mls_pipe_check_write,
3256 .mpo_pipe_copy_label = mls_copy_label,
3257 .mpo_pipe_create = mls_pipe_create,
3258 .mpo_pipe_destroy_label = mls_destroy_label,
3259 .mpo_pipe_externalize_label = mls_externalize_label,
3260 .mpo_pipe_init_label = mls_init_label,
3261 .mpo_pipe_internalize_label = mls_internalize_label,
3262 .mpo_pipe_relabel = mls_pipe_relabel,
3264 .mpo_posixsem_check_getvalue = mls_posixsem_check_rdonly,
3265 .mpo_posixsem_check_open = mls_posixsem_check_openunlink,
3266 .mpo_posixsem_check_post = mls_posixsem_check_write,
3267 .mpo_posixsem_check_setmode = mls_posixsem_check_setmode,
3268 .mpo_posixsem_check_setowner = mls_posixsem_check_setowner,
3269 .mpo_posixsem_check_stat = mls_posixsem_check_rdonly,
3270 .mpo_posixsem_check_unlink = mls_posixsem_check_openunlink,
3271 .mpo_posixsem_check_wait = mls_posixsem_check_write,
3272 .mpo_posixsem_create = mls_posixsem_create,
3273 .mpo_posixsem_destroy_label = mls_destroy_label,
3274 .mpo_posixsem_init_label = mls_init_label,
3276 .mpo_posixshm_check_mmap = mls_posixshm_check_mmap,
3277 .mpo_posixshm_check_open = mls_posixshm_check_open,
3278 .mpo_posixshm_check_setmode = mls_posixshm_check_setmode,
3279 .mpo_posixshm_check_setowner = mls_posixshm_check_setowner,
3280 .mpo_posixshm_check_stat = mls_posixshm_check_stat,
3281 .mpo_posixshm_check_truncate = mls_posixshm_check_truncate,
3282 .mpo_posixshm_check_unlink = mls_posixshm_check_unlink,
3283 .mpo_posixshm_create = mls_posixshm_create,
3284 .mpo_posixshm_destroy_label = mls_destroy_label,
3285 .mpo_posixshm_init_label = mls_init_label,
3287 .mpo_proc_check_debug = mls_proc_check_debug,
3288 .mpo_proc_check_sched = mls_proc_check_sched,
3289 .mpo_proc_check_signal = mls_proc_check_signal,
3291 .mpo_socket_check_deliver = mls_socket_check_deliver,
3292 .mpo_socket_check_relabel = mls_socket_check_relabel,
3293 .mpo_socket_check_visible = mls_socket_check_visible,
3294 .mpo_socket_copy_label = mls_copy_label,
3295 .mpo_socket_create = mls_socket_create,
3296 .mpo_socket_create_mbuf = mls_socket_create_mbuf,
3297 .mpo_socket_destroy_label = mls_destroy_label,
3298 .mpo_socket_externalize_label = mls_externalize_label,
3299 .mpo_socket_init_label = mls_init_label_waitcheck,
3300 .mpo_socket_internalize_label = mls_internalize_label,
3301 .mpo_socket_newconn = mls_socket_newconn,
3302 .mpo_socket_relabel = mls_socket_relabel,
3304 .mpo_socketpeer_destroy_label = mls_destroy_label,
3305 .mpo_socketpeer_externalize_label = mls_externalize_label,
3306 .mpo_socketpeer_init_label = mls_init_label_waitcheck,
3307 .mpo_socketpeer_set_from_mbuf = mls_socketpeer_set_from_mbuf,
3308 .mpo_socketpeer_set_from_socket = mls_socketpeer_set_from_socket,
3310 .mpo_syncache_create = mls_syncache_create,
3311 .mpo_syncache_create_mbuf = mls_syncache_create_mbuf,
3312 .mpo_syncache_destroy_label = mls_destroy_label,
3313 .mpo_syncache_init_label = mls_init_label_waitcheck,
3315 .mpo_sysvmsg_cleanup = mls_sysvmsg_cleanup,
3316 .mpo_sysvmsg_create = mls_sysvmsg_create,
3317 .mpo_sysvmsg_destroy_label = mls_destroy_label,
3318 .mpo_sysvmsg_init_label = mls_init_label,
3320 .mpo_sysvmsq_check_msgrcv = mls_sysvmsq_check_msgrcv,
3321 .mpo_sysvmsq_check_msgrmid = mls_sysvmsq_check_msgrmid,
3322 .mpo_sysvmsq_check_msqget = mls_sysvmsq_check_msqget,
3323 .mpo_sysvmsq_check_msqsnd = mls_sysvmsq_check_msqsnd,
3324 .mpo_sysvmsq_check_msqrcv = mls_sysvmsq_check_msqrcv,
3325 .mpo_sysvmsq_check_msqctl = mls_sysvmsq_check_msqctl,
3326 .mpo_sysvmsq_cleanup = mls_sysvmsq_cleanup,
3327 .mpo_sysvmsq_destroy_label = mls_destroy_label,
3328 .mpo_sysvmsq_init_label = mls_init_label,
3329 .mpo_sysvmsq_create = mls_sysvmsq_create,
3331 .mpo_sysvsem_check_semctl = mls_sysvsem_check_semctl,
3332 .mpo_sysvsem_check_semget = mls_sysvsem_check_semget,
3333 .mpo_sysvsem_check_semop = mls_sysvsem_check_semop,
3334 .mpo_sysvsem_cleanup = mls_sysvsem_cleanup,
3335 .mpo_sysvsem_create = mls_sysvsem_create,
3336 .mpo_sysvsem_destroy_label = mls_destroy_label,
3337 .mpo_sysvsem_init_label = mls_init_label,
3339 .mpo_sysvshm_check_shmat = mls_sysvshm_check_shmat,
3340 .mpo_sysvshm_check_shmctl = mls_sysvshm_check_shmctl,
3341 .mpo_sysvshm_check_shmget = mls_sysvshm_check_shmget,
3342 .mpo_sysvshm_cleanup = mls_sysvshm_cleanup,
3343 .mpo_sysvshm_create = mls_sysvshm_create,
3344 .mpo_sysvshm_destroy_label = mls_destroy_label,
3345 .mpo_sysvshm_init_label = mls_init_label,
3348 .mpo_system_check_acct = mls_system_check_acct,
3349 .mpo_system_check_auditctl = mls_system_check_auditctl,
3350 .mpo_system_check_swapon = mls_system_check_swapon,
3352 .mpo_vnode_associate_extattr = mls_vnode_associate_extattr,
3353 .mpo_vnode_associate_singlelabel = mls_vnode_associate_singlelabel,
3354 .mpo_vnode_check_access = mls_vnode_check_open,
3355 .mpo_vnode_check_chdir = mls_vnode_check_chdir,
3356 .mpo_vnode_check_chroot = mls_vnode_check_chroot,
3357 .mpo_vnode_check_create = mls_vnode_check_create,
3358 .mpo_vnode_check_deleteacl = mls_vnode_check_deleteacl,
3359 .mpo_vnode_check_deleteextattr = mls_vnode_check_deleteextattr,
3360 .mpo_vnode_check_exec = mls_vnode_check_exec,
3361 .mpo_vnode_check_getacl = mls_vnode_check_getacl,
3362 .mpo_vnode_check_getextattr = mls_vnode_check_getextattr,
3363 .mpo_vnode_check_link = mls_vnode_check_link,
3364 .mpo_vnode_check_listextattr = mls_vnode_check_listextattr,
3365 .mpo_vnode_check_lookup = mls_vnode_check_lookup,
3366 .mpo_vnode_check_mmap = mls_vnode_check_mmap,
3367 .mpo_vnode_check_open = mls_vnode_check_open,
3368 .mpo_vnode_check_poll = mls_vnode_check_poll,
3369 .mpo_vnode_check_read = mls_vnode_check_read,
3370 .mpo_vnode_check_readdir = mls_vnode_check_readdir,
3371 .mpo_vnode_check_readlink = mls_vnode_check_readlink,
3372 .mpo_vnode_check_relabel = mls_vnode_check_relabel,
3373 .mpo_vnode_check_rename_from = mls_vnode_check_rename_from,
3374 .mpo_vnode_check_rename_to = mls_vnode_check_rename_to,
3375 .mpo_vnode_check_revoke = mls_vnode_check_revoke,
3376 .mpo_vnode_check_setacl = mls_vnode_check_setacl,
3377 .mpo_vnode_check_setextattr = mls_vnode_check_setextattr,
3378 .mpo_vnode_check_setflags = mls_vnode_check_setflags,
3379 .mpo_vnode_check_setmode = mls_vnode_check_setmode,
3380 .mpo_vnode_check_setowner = mls_vnode_check_setowner,
3381 .mpo_vnode_check_setutimes = mls_vnode_check_setutimes,
3382 .mpo_vnode_check_stat = mls_vnode_check_stat,
3383 .mpo_vnode_check_unlink = mls_vnode_check_unlink,
3384 .mpo_vnode_check_write = mls_vnode_check_write,
3385 .mpo_vnode_copy_label = mls_copy_label,
3386 .mpo_vnode_create_extattr = mls_vnode_create_extattr,
3387 .mpo_vnode_destroy_label = mls_destroy_label,
3388 .mpo_vnode_externalize_label = mls_externalize_label,
3389 .mpo_vnode_init_label = mls_init_label,
3390 .mpo_vnode_internalize_label = mls_internalize_label,
3391 .mpo_vnode_relabel = mls_vnode_relabel,
3392 .mpo_vnode_setlabel_extattr = mls_vnode_setlabel_extattr,
3395 MAC_POLICY_SET(&mls_ops, mac_mls, "TrustedBSD MAC/MLS",
3396 MPC_LOADTIME_FLAG_NOTLATE, &mls_slot);