xref: /freebsd/sys/security/mac/mac_framework.c (revision f7b951a8e064b154af60890761a52cdfcaf5761e)
17bc82500SRobert Watson /*-
27bc82500SRobert Watson  * Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson
37bc82500SRobert Watson  * Copyright (c) 2001 Ilmar S. Habibulin
47bc82500SRobert Watson  * Copyright (c) 2001, 2002 Networks Associates Technology, Inc.
57bc82500SRobert Watson  * All rights reserved.
67bc82500SRobert Watson  *
77bc82500SRobert Watson  * This software was developed by Robert Watson and Ilmar Habibulin for the
87bc82500SRobert Watson  * TrustedBSD Project.
97bc82500SRobert Watson  *
107bc82500SRobert Watson  * This software was developed for the FreeBSD Project in part by NAI Labs,
117bc82500SRobert Watson  * the Security Research Division of Network Associates, Inc. under
127bc82500SRobert Watson  * DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA
137bc82500SRobert Watson  * CHATS research program.
147bc82500SRobert Watson  *
157bc82500SRobert Watson  * Redistribution and use in source and binary forms, with or without
167bc82500SRobert Watson  * modification, are permitted provided that the following conditions
177bc82500SRobert Watson  * are met:
187bc82500SRobert Watson  * 1. Redistributions of source code must retain the above copyright
197bc82500SRobert Watson  *    notice, this list of conditions and the following disclaimer.
207bc82500SRobert Watson  * 2. Redistributions in binary form must reproduce the above copyright
217bc82500SRobert Watson  *    notice, this list of conditions and the following disclaimer in the
227bc82500SRobert Watson  *    documentation and/or other materials provided with the distribution.
237bc82500SRobert Watson  * 3. The names of the authors may not be used to endorse or promote
247bc82500SRobert Watson  *    products derived from this software without specific prior written
257bc82500SRobert Watson  *    permission.
267bc82500SRobert Watson  *
277bc82500SRobert Watson  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
287bc82500SRobert Watson  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
297bc82500SRobert Watson  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
307bc82500SRobert Watson  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
317bc82500SRobert Watson  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
327bc82500SRobert Watson  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
337bc82500SRobert Watson  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
347bc82500SRobert Watson  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
357bc82500SRobert Watson  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
367bc82500SRobert Watson  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
377bc82500SRobert Watson  * SUCH DAMAGE.
387bc82500SRobert Watson  *
397bc82500SRobert Watson  * $FreeBSD$
407bc82500SRobert Watson  */
417bc82500SRobert Watson /*
427bc82500SRobert Watson  * Developed by the TrustedBSD Project.
437bc82500SRobert Watson  *
447bc82500SRobert Watson  * Framework for extensible kernel access control.  Kernel and userland
457bc82500SRobert Watson  * interface to the framework, policy registration and composition.
467bc82500SRobert Watson  */
477bc82500SRobert Watson 
487bc82500SRobert Watson #include "opt_mac.h"
49328048bcSPoul-Henning Kamp #include "opt_devfs.h"
50f9d0d524SRobert Watson 
517bc82500SRobert Watson #include <sys/param.h>
5295fab37eSRobert Watson #include <sys/extattr.h>
5395fab37eSRobert Watson #include <sys/kernel.h>
5495fab37eSRobert Watson #include <sys/lock.h>
55b656366bSBruce Evans #include <sys/malloc.h>
5695fab37eSRobert Watson #include <sys/mutex.h>
5795fab37eSRobert Watson #include <sys/mac.h>
587ba28492SRobert Watson #include <sys/module.h>
5995fab37eSRobert Watson #include <sys/proc.h>
6095fab37eSRobert Watson #include <sys/systm.h>
617bc82500SRobert Watson #include <sys/sysproto.h>
627bc82500SRobert Watson #include <sys/sysent.h>
6395fab37eSRobert Watson #include <sys/vnode.h>
6495fab37eSRobert Watson #include <sys/mount.h>
6595fab37eSRobert Watson #include <sys/file.h>
6695fab37eSRobert Watson #include <sys/namei.h>
6795fab37eSRobert Watson #include <sys/socket.h>
6895fab37eSRobert Watson #include <sys/pipe.h>
6995fab37eSRobert Watson #include <sys/socketvar.h>
7095fab37eSRobert Watson #include <sys/sysctl.h>
7195fab37eSRobert Watson 
7295fab37eSRobert Watson #include <vm/vm.h>
7395fab37eSRobert Watson #include <vm/pmap.h>
7495fab37eSRobert Watson #include <vm/vm_map.h>
7595fab37eSRobert Watson #include <vm/vm_object.h>
7695fab37eSRobert Watson 
7795fab37eSRobert Watson #include <sys/mac_policy.h>
7895fab37eSRobert Watson 
7995fab37eSRobert Watson #include <fs/devfs/devfs.h>
8095fab37eSRobert Watson 
8195fab37eSRobert Watson #include <net/bpfdesc.h>
8295fab37eSRobert Watson #include <net/if.h>
8395fab37eSRobert Watson #include <net/if_var.h>
8495fab37eSRobert Watson 
8595fab37eSRobert Watson #include <netinet/in.h>
8695fab37eSRobert Watson #include <netinet/ip_var.h>
8795fab37eSRobert Watson 
8895fab37eSRobert Watson #ifdef MAC
8995fab37eSRobert Watson 
907ba28492SRobert Watson /*
917ba28492SRobert Watson  * Declare that the kernel provides MAC support, version 1.  This permits
927ba28492SRobert Watson  * modules to refuse to be loaded if the necessary support isn't present,
937ba28492SRobert Watson  * even if it's pre-boot.
947ba28492SRobert Watson  */
957ba28492SRobert Watson MODULE_VERSION(kernel_mac_support, 1);
967ba28492SRobert Watson 
9795fab37eSRobert Watson SYSCTL_DECL(_security);
9895fab37eSRobert Watson 
9995fab37eSRobert Watson SYSCTL_NODE(_security, OID_AUTO, mac, CTLFLAG_RW, 0,
10095fab37eSRobert Watson     "TrustedBSD MAC policy controls");
101b2f0927aSRobert Watson 
10295fab37eSRobert Watson #if MAC_MAX_POLICIES > 32
10395fab37eSRobert Watson #error "MAC_MAX_POLICIES too large"
10495fab37eSRobert Watson #endif
105a13c67daSRobert Watson 
10695fab37eSRobert Watson static unsigned int mac_max_policies = MAC_MAX_POLICIES;
10795fab37eSRobert Watson static unsigned int mac_policy_offsets_free = (1 << MAC_MAX_POLICIES) - 1;
10895fab37eSRobert Watson SYSCTL_UINT(_security_mac, OID_AUTO, max_policies, CTLFLAG_RD,
10995fab37eSRobert Watson     &mac_max_policies, 0, "");
11095fab37eSRobert Watson 
11195fab37eSRobert Watson static int	mac_late = 0;
11295fab37eSRobert Watson 
11395fab37eSRobert Watson static int	mac_enforce_fs = 1;
11495fab37eSRobert Watson SYSCTL_INT(_security_mac, OID_AUTO, enforce_fs, CTLFLAG_RW,
11595fab37eSRobert Watson     &mac_enforce_fs, 0, "Enforce MAC policy on file system objects");
11695fab37eSRobert Watson TUNABLE_INT("security.mac.enforce_fs", &mac_enforce_fs);
11795fab37eSRobert Watson 
11895fab37eSRobert Watson static int	mac_enforce_network = 1;
11995fab37eSRobert Watson SYSCTL_INT(_security_mac, OID_AUTO, enforce_network, CTLFLAG_RW,
12095fab37eSRobert Watson     &mac_enforce_network, 0, "Enforce MAC policy on network packets");
12195fab37eSRobert Watson TUNABLE_INT("security.mac.enforce_network", &mac_enforce_network);
12295fab37eSRobert Watson 
123b88c98f6SRobert Watson static int	mac_enforce_pipe = 1;
124b88c98f6SRobert Watson SYSCTL_INT(_security_mac, OID_AUTO, enforce_pipe, CTLFLAG_RW,
125b88c98f6SRobert Watson     &mac_enforce_pipe, 0, "Enforce MAC policy on pipe operations");
126c031391bSRobert Watson TUNABLE_INT("security.mac.enforce_pipe", &mac_enforce_pipe);
127b88c98f6SRobert Watson 
12895fab37eSRobert Watson static int	mac_enforce_process = 1;
12995fab37eSRobert Watson SYSCTL_INT(_security_mac, OID_AUTO, enforce_process, CTLFLAG_RW,
13095fab37eSRobert Watson     &mac_enforce_process, 0, "Enforce MAC policy on inter-process operations");
13195fab37eSRobert Watson TUNABLE_INT("security.mac.enforce_process", &mac_enforce_process);
13295fab37eSRobert Watson 
13395fab37eSRobert Watson static int	mac_enforce_socket = 1;
13495fab37eSRobert Watson SYSCTL_INT(_security_mac, OID_AUTO, enforce_socket, CTLFLAG_RW,
13595fab37eSRobert Watson     &mac_enforce_socket, 0, "Enforce MAC policy on socket operations");
13695fab37eSRobert Watson TUNABLE_INT("security.mac.enforce_socket", &mac_enforce_socket);
13795fab37eSRobert Watson 
138ca7850c3SRobert Watson static int     mac_enforce_vm = 1;
139ca7850c3SRobert Watson SYSCTL_INT(_security_mac, OID_AUTO, enforce_vm, CTLFLAG_RW,
140ca7850c3SRobert Watson     &mac_enforce_vm, 0, "Enforce MAC policy on vm operations");
141c031391bSRobert Watson TUNABLE_INT("security.mac.enforce_vm", &mac_enforce_vm);
142ca7850c3SRobert Watson 
14395fab37eSRobert Watson static int	mac_label_size = sizeof(struct mac);
14495fab37eSRobert Watson SYSCTL_INT(_security_mac, OID_AUTO, label_size, CTLFLAG_RD,
14595fab37eSRobert Watson     &mac_label_size, 0, "Pre-compiled MAC label size");
14695fab37eSRobert Watson 
14795fab37eSRobert Watson static int	mac_cache_fslabel_in_vnode = 1;
14895fab37eSRobert Watson SYSCTL_INT(_security_mac, OID_AUTO, cache_fslabel_in_vnode, CTLFLAG_RW,
14995fab37eSRobert Watson     &mac_cache_fslabel_in_vnode, 0, "Cache mount fslabel in vnode");
15095fab37eSRobert Watson TUNABLE_INT("security.mac.cache_fslabel_in_vnode",
15195fab37eSRobert Watson     &mac_cache_fslabel_in_vnode);
15295fab37eSRobert Watson 
15395fab37eSRobert Watson static int	mac_vnode_label_cache_hits = 0;
15495fab37eSRobert Watson SYSCTL_INT(_security_mac, OID_AUTO, vnode_label_cache_hits, CTLFLAG_RD,
15595fab37eSRobert Watson     &mac_vnode_label_cache_hits, 0, "Cache hits on vnode labels");
15695fab37eSRobert Watson static int	mac_vnode_label_cache_misses = 0;
15795fab37eSRobert Watson SYSCTL_INT(_security_mac, OID_AUTO, vnode_label_cache_misses, CTLFLAG_RD,
15895fab37eSRobert Watson     &mac_vnode_label_cache_misses, 0, "Cache misses on vnode labels");
159c0f39905SRobert Watson 
160c0f39905SRobert Watson static int	mac_mmap_revocation = 1;
161c0f39905SRobert Watson SYSCTL_INT(_security_mac, OID_AUTO, mmap_revocation, CTLFLAG_RW,
162c0f39905SRobert Watson     &mac_mmap_revocation, 0, "Revoke mmap access to files on subject "
163c0f39905SRobert Watson     "relabel");
16499fa64f8SRobert Watson static int	mac_mmap_revocation_via_cow = 0;
16595fab37eSRobert Watson SYSCTL_INT(_security_mac, OID_AUTO, mmap_revocation_via_cow, CTLFLAG_RW,
16695fab37eSRobert Watson     &mac_mmap_revocation_via_cow, 0, "Revoke mmap access to files via "
16795fab37eSRobert Watson     "copy-on-write semantics, or by removing all write access");
16895fab37eSRobert Watson 
169f050add5SRobert Watson #ifdef MAC_DEBUG
1706be0c25eSRobert Watson SYSCTL_NODE(_security_mac, OID_AUTO, debug, CTLFLAG_RW, 0,
1716be0c25eSRobert Watson     "TrustedBSD MAC debug info");
1726be0c25eSRobert Watson 
1736be0c25eSRobert Watson static int	mac_debug_label_fallback = 0;
1746be0c25eSRobert Watson SYSCTL_INT(_security_mac_debug, OID_AUTO, label_fallback, CTLFLAG_RW,
1756be0c25eSRobert Watson     &mac_debug_label_fallback, 0, "Filesystems should fall back to fs label"
1766be0c25eSRobert Watson     "when label is corrupted.");
1776be0c25eSRobert Watson TUNABLE_INT("security.mac.debug_label_fallback",
1786be0c25eSRobert Watson     &mac_debug_label_fallback);
1796be0c25eSRobert Watson 
180b2f0927aSRobert Watson SYSCTL_NODE(_security_mac_debug, OID_AUTO, counters, CTLFLAG_RW, 0,
181b2f0927aSRobert Watson     "TrustedBSD MAC object counters");
182b2f0927aSRobert Watson 
18395fab37eSRobert Watson static unsigned int nmacmbufs, nmaccreds, nmacifnets, nmacbpfdescs,
18495fab37eSRobert Watson     nmacsockets, nmacmounts, nmactemp, nmacvnodes, nmacdevfsdirents,
18595fab37eSRobert Watson     nmacipqs, nmacpipes;
186b2f0927aSRobert Watson 
187b2f0927aSRobert Watson SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, mbufs, CTLFLAG_RD,
18895fab37eSRobert Watson     &nmacmbufs, 0, "number of mbufs in use");
189b2f0927aSRobert Watson SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, creds, CTLFLAG_RD,
19095fab37eSRobert Watson     &nmaccreds, 0, "number of ucreds in use");
191b2f0927aSRobert Watson SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, ifnets, CTLFLAG_RD,
19295fab37eSRobert Watson     &nmacifnets, 0, "number of ifnets in use");
193b2f0927aSRobert Watson SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, ipqs, CTLFLAG_RD,
19495fab37eSRobert Watson     &nmacipqs, 0, "number of ipqs in use");
195b2f0927aSRobert Watson SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, bpfdescs, CTLFLAG_RD,
19695fab37eSRobert Watson     &nmacbpfdescs, 0, "number of bpfdescs in use");
197b2f0927aSRobert Watson SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, sockets, CTLFLAG_RD,
19895fab37eSRobert Watson     &nmacsockets, 0, "number of sockets in use");
199b2f0927aSRobert Watson SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, pipes, CTLFLAG_RD,
20095fab37eSRobert Watson     &nmacpipes, 0, "number of pipes in use");
201b2f0927aSRobert Watson SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, mounts, CTLFLAG_RD,
20295fab37eSRobert Watson     &nmacmounts, 0, "number of mounts in use");
203b2f0927aSRobert Watson SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, temp, CTLFLAG_RD,
20495fab37eSRobert Watson     &nmactemp, 0, "number of temporary labels in use");
205b2f0927aSRobert Watson SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, vnodes, CTLFLAG_RD,
20695fab37eSRobert Watson     &nmacvnodes, 0, "number of vnodes in use");
207b2f0927aSRobert Watson SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, devfsdirents, CTLFLAG_RD,
20895fab37eSRobert Watson     &nmacdevfsdirents, 0, "number of devfs dirents inuse");
209f050add5SRobert Watson #endif
21095fab37eSRobert Watson 
21195fab37eSRobert Watson static int	error_select(int error1, int error2);
212f7b951a8SRobert Watson static int	mac_externalize_vnode_oldmac(struct label *label,
213f7b951a8SRobert Watson 		    struct oldmac *extmac);
21495fab37eSRobert Watson static int	mac_policy_register(struct mac_policy_conf *mpc);
21595fab37eSRobert Watson static int	mac_policy_unregister(struct mac_policy_conf *mpc);
21695fab37eSRobert Watson 
21795fab37eSRobert Watson static int	mac_stdcreatevnode_ea(struct vnode *vp);
218e183f80eSRobert Watson static void	mac_check_vnode_mmap_downgrade(struct ucred *cred,
219e183f80eSRobert Watson 		    struct vnode *vp, int *prot);
22095fab37eSRobert Watson static void	mac_cred_mmapped_drop_perms_recurse(struct thread *td,
22195fab37eSRobert Watson 		    struct ucred *cred, struct vm_map *map);
22295fab37eSRobert Watson 
22383985c26SRobert Watson static void	mac_destroy_socket_label(struct label *label);
22483985c26SRobert Watson 
22595fab37eSRobert Watson MALLOC_DEFINE(M_MACOPVEC, "macopvec", "MAC policy operation vector");
22695fab37eSRobert Watson MALLOC_DEFINE(M_MACPIPELABEL, "macpipelabel", "MAC labels for pipes");
227f7b951a8SRobert Watson MALLOC_DEFINE(M_MACTEMP, "mactemp", "MAC temporary label storage");
22895fab37eSRobert Watson 
22995fab37eSRobert Watson /*
23095fab37eSRobert Watson  * mac_policy_list_lock protects the consistency of 'mac_policy_list',
23195fab37eSRobert Watson  * the linked list of attached policy modules.  Read-only consumers of
23295fab37eSRobert Watson  * the list must acquire a shared lock for the duration of their use;
23395fab37eSRobert Watson  * writers must acquire an exclusive lock.  Note that for compound
23495fab37eSRobert Watson  * operations, locks should be held for the entire compound operation,
23595fab37eSRobert Watson  * and that this is not yet done for relabel requests.
23695fab37eSRobert Watson  */
23795fab37eSRobert Watson static struct mtx mac_policy_list_lock;
23895fab37eSRobert Watson static LIST_HEAD(, mac_policy_conf) mac_policy_list;
23995fab37eSRobert Watson static int mac_policy_list_busy;
24095fab37eSRobert Watson #define	MAC_POLICY_LIST_LOCKINIT()	mtx_init(&mac_policy_list_lock,	\
24195fab37eSRobert Watson 	"mac_policy_list_lock", NULL, MTX_DEF);
24295fab37eSRobert Watson #define	MAC_POLICY_LIST_LOCK()	mtx_lock(&mac_policy_list_lock);
24395fab37eSRobert Watson #define	MAC_POLICY_LIST_UNLOCK()	mtx_unlock(&mac_policy_list_lock);
24495fab37eSRobert Watson 
24595fab37eSRobert Watson #define	MAC_POLICY_LIST_BUSY() do {					\
24695fab37eSRobert Watson 	MAC_POLICY_LIST_LOCK();						\
24795fab37eSRobert Watson 	mac_policy_list_busy++;						\
24895fab37eSRobert Watson 	MAC_POLICY_LIST_UNLOCK();					\
24995fab37eSRobert Watson } while (0)
25095fab37eSRobert Watson 
25195fab37eSRobert Watson #define	MAC_POLICY_LIST_UNBUSY() do {					\
25295fab37eSRobert Watson 	MAC_POLICY_LIST_LOCK();						\
25395fab37eSRobert Watson 	mac_policy_list_busy--;						\
25495fab37eSRobert Watson 	if (mac_policy_list_busy < 0)					\
25595fab37eSRobert Watson 		panic("Extra mac_policy_list_busy--");			\
25695fab37eSRobert Watson 	MAC_POLICY_LIST_UNLOCK();					\
25795fab37eSRobert Watson } while (0)
25895fab37eSRobert Watson 
25995fab37eSRobert Watson /*
26095fab37eSRobert Watson  * MAC_CHECK performs the designated check by walking the policy
26195fab37eSRobert Watson  * module list and checking with each as to how it feels about the
26295fab37eSRobert Watson  * request.  Note that it returns its value via 'error' in the scope
26395fab37eSRobert Watson  * of the caller.
26495fab37eSRobert Watson  */
26595fab37eSRobert Watson #define	MAC_CHECK(check, args...) do {					\
26695fab37eSRobert Watson 	struct mac_policy_conf *mpc;					\
26795fab37eSRobert Watson 									\
26895fab37eSRobert Watson 	error = 0;							\
26995fab37eSRobert Watson 	MAC_POLICY_LIST_BUSY();						\
27095fab37eSRobert Watson 	LIST_FOREACH(mpc, &mac_policy_list, mpc_list) {			\
27195fab37eSRobert Watson 		if (mpc->mpc_ops->mpo_ ## check != NULL)		\
27295fab37eSRobert Watson 			error = error_select(				\
27395fab37eSRobert Watson 			    mpc->mpc_ops->mpo_ ## check (args),		\
27495fab37eSRobert Watson 			    error);					\
27595fab37eSRobert Watson 	}								\
27695fab37eSRobert Watson 	MAC_POLICY_LIST_UNBUSY();					\
27795fab37eSRobert Watson } while (0)
27895fab37eSRobert Watson 
27995fab37eSRobert Watson /*
28095fab37eSRobert Watson  * MAC_BOOLEAN performs the designated boolean composition by walking
28195fab37eSRobert Watson  * the module list, invoking each instance of the operation, and
28295fab37eSRobert Watson  * combining the results using the passed C operator.  Note that it
28395fab37eSRobert Watson  * returns its value via 'result' in the scope of the caller, which
28495fab37eSRobert Watson  * should be initialized by the caller in a meaningful way to get
28595fab37eSRobert Watson  * a meaningful result.
28695fab37eSRobert Watson  */
28795fab37eSRobert Watson #define	MAC_BOOLEAN(operation, composition, args...) do {		\
28895fab37eSRobert Watson 	struct mac_policy_conf *mpc;					\
28995fab37eSRobert Watson 									\
29095fab37eSRobert Watson 	MAC_POLICY_LIST_BUSY();						\
29195fab37eSRobert Watson 	LIST_FOREACH(mpc, &mac_policy_list, mpc_list) {			\
29295fab37eSRobert Watson 		if (mpc->mpc_ops->mpo_ ## operation != NULL)		\
29395fab37eSRobert Watson 			result = result composition			\
29495fab37eSRobert Watson 			    mpc->mpc_ops->mpo_ ## operation (args);	\
29595fab37eSRobert Watson 	}								\
29695fab37eSRobert Watson 	MAC_POLICY_LIST_UNBUSY();					\
29795fab37eSRobert Watson } while (0)
29895fab37eSRobert Watson 
299f7b951a8SRobert Watson #define	MAC_EXTERNALIZE(type, label, elementlist, outbuf, 		\
300f7b951a8SRobert Watson     outbuflen) do {							\
301f7b951a8SRobert Watson 	char *curptr, *curptr_start, *element_name, *element_temp;	\
302f7b951a8SRobert Watson 	size_t left, left_start, len;					\
303f7b951a8SRobert Watson 	int claimed, first, first_start, ignorenotfound;		\
304f7b951a8SRobert Watson 									\
305f7b951a8SRobert Watson 	error = 0;							\
306f7b951a8SRobert Watson 	element_temp = elementlist;					\
307f7b951a8SRobert Watson 	curptr = outbuf;						\
308f7b951a8SRobert Watson 	curptr[0] = '\0';						\
309f7b951a8SRobert Watson 	left = outbuflen;						\
310f7b951a8SRobert Watson 	first = 1;							\
311f7b951a8SRobert Watson 	while ((element_name = strsep(&element_temp, ",")) != NULL) {	\
312f7b951a8SRobert Watson 		curptr_start = curptr;					\
313f7b951a8SRobert Watson 		left_start = left;					\
314f7b951a8SRobert Watson 		first_start = first;					\
315f7b951a8SRobert Watson 		if (element_name[0] == '?') {				\
316f7b951a8SRobert Watson 			element_name++;					\
317f7b951a8SRobert Watson 			ignorenotfound = 1;				\
318f7b951a8SRobert Watson 		} else							\
319f7b951a8SRobert Watson 			ignorenotfound = 0;				\
320f7b951a8SRobert Watson 		claimed = 0;						\
321f7b951a8SRobert Watson 		if (first) {						\
322f7b951a8SRobert Watson 			len = snprintf(curptr, left, "%s/",		\
323f7b951a8SRobert Watson 			    element_name);				\
324f7b951a8SRobert Watson 			first = 0;					\
325f7b951a8SRobert Watson 		} else							\
326f7b951a8SRobert Watson 			len = snprintf(curptr, left, ",%s/",		\
327f7b951a8SRobert Watson 			    element_name);				\
328f7b951a8SRobert Watson 		if (len >= left) {					\
329f7b951a8SRobert Watson 			error = EINVAL;		/* XXXMAC: E2BIG */	\
330f7b951a8SRobert Watson 			break;						\
331f7b951a8SRobert Watson 		}							\
332f7b951a8SRobert Watson 		curptr += len;						\
333f7b951a8SRobert Watson 		left -= len;						\
334f7b951a8SRobert Watson 									\
335f7b951a8SRobert Watson 		MAC_CHECK(externalize_ ## type, label, element_name,	\
336f7b951a8SRobert Watson 		    curptr, left, &len, &claimed);			\
337f7b951a8SRobert Watson 		if (error)						\
338f7b951a8SRobert Watson 			break;						\
339f7b951a8SRobert Watson 		if (claimed == 1) {					\
340f7b951a8SRobert Watson 			if (len >= outbuflen) {				\
341f7b951a8SRobert Watson 				error = EINVAL;	/* XXXMAC: E2BIG */	\
342f7b951a8SRobert Watson 				break;					\
343f7b951a8SRobert Watson 			}						\
344f7b951a8SRobert Watson 			curptr += len;					\
345f7b951a8SRobert Watson 			left -= len;					\
346f7b951a8SRobert Watson 		} else if (claimed == 0 && ignorenotfound) {		\
347f7b951a8SRobert Watson 			/*						\
348f7b951a8SRobert Watson 			 * Revert addition of the label element		\
349f7b951a8SRobert Watson 			 * name.					\
350f7b951a8SRobert Watson 			 */						\
351f7b951a8SRobert Watson 			curptr = curptr_start;				\
352f7b951a8SRobert Watson 			*curptr = '\0';					\
353f7b951a8SRobert Watson 			left = left_start;				\
354f7b951a8SRobert Watson 			first = first_start;				\
355f7b951a8SRobert Watson 		} else {						\
356f7b951a8SRobert Watson 			error = EINVAL;		/* XXXMAC: ENOLABEL */	\
357f7b951a8SRobert Watson 			break;						\
358f7b951a8SRobert Watson 		}							\
359f7b951a8SRobert Watson 	}								\
360f7b951a8SRobert Watson } while (0)
361f7b951a8SRobert Watson 
362f7b951a8SRobert Watson #define	MAC_INTERNALIZE(type, label, instring) do {			\
363f7b951a8SRobert Watson 	char *element, *element_name, *element_data;			\
364f7b951a8SRobert Watson 	int claimed;							\
365f7b951a8SRobert Watson 									\
366f7b951a8SRobert Watson 	error = 0;							\
367f7b951a8SRobert Watson 	element = instring;						\
368f7b951a8SRobert Watson 	while ((element_name = strsep(&element, ",")) != NULL) {	\
369f7b951a8SRobert Watson 		element_data = element_name;				\
370f7b951a8SRobert Watson 		element_name = strsep(&element_data, "/");		\
371f7b951a8SRobert Watson 		if (element_data == NULL) {				\
372f7b951a8SRobert Watson 			error = EINVAL;					\
373f7b951a8SRobert Watson 			break;						\
374f7b951a8SRobert Watson 		}							\
375f7b951a8SRobert Watson 		claimed = 0;						\
376f7b951a8SRobert Watson 		MAC_CHECK(internalize_ ## type, label, element_name,	\
377f7b951a8SRobert Watson 		    element_data, &claimed);				\
378f7b951a8SRobert Watson 		if (error)						\
379f7b951a8SRobert Watson 			break;						\
380f7b951a8SRobert Watson 		if (claimed != 1) {					\
381f7b951a8SRobert Watson 			/* XXXMAC: Another error here? */		\
382f7b951a8SRobert Watson 			error = EINVAL;					\
383f7b951a8SRobert Watson 			break;						\
384f7b951a8SRobert Watson 		}							\
385f7b951a8SRobert Watson 	}								\
386f7b951a8SRobert Watson } while (0)
387f7b951a8SRobert Watson 
38895fab37eSRobert Watson /*
38995fab37eSRobert Watson  * MAC_PERFORM performs the designated operation by walking the policy
39095fab37eSRobert Watson  * module list and invoking that operation for each policy.
39195fab37eSRobert Watson  */
39295fab37eSRobert Watson #define	MAC_PERFORM(operation, args...) do {				\
39395fab37eSRobert Watson 	struct mac_policy_conf *mpc;					\
39495fab37eSRobert Watson 									\
39595fab37eSRobert Watson 	MAC_POLICY_LIST_BUSY();						\
39695fab37eSRobert Watson 	LIST_FOREACH(mpc, &mac_policy_list, mpc_list) {			\
39795fab37eSRobert Watson 		if (mpc->mpc_ops->mpo_ ## operation != NULL)		\
39895fab37eSRobert Watson 			mpc->mpc_ops->mpo_ ## operation (args);		\
39995fab37eSRobert Watson 	}								\
40095fab37eSRobert Watson 	MAC_POLICY_LIST_UNBUSY();					\
40195fab37eSRobert Watson } while (0)
40295fab37eSRobert Watson 
40395fab37eSRobert Watson /*
40495fab37eSRobert Watson  * Initialize the MAC subsystem, including appropriate SMP locks.
40595fab37eSRobert Watson  */
40695fab37eSRobert Watson static void
40795fab37eSRobert Watson mac_init(void)
40895fab37eSRobert Watson {
40995fab37eSRobert Watson 
41095fab37eSRobert Watson 	LIST_INIT(&mac_policy_list);
41195fab37eSRobert Watson 	MAC_POLICY_LIST_LOCKINIT();
41295fab37eSRobert Watson }
41395fab37eSRobert Watson 
41495fab37eSRobert Watson /*
41595fab37eSRobert Watson  * For the purposes of modules that want to know if they were loaded
41695fab37eSRobert Watson  * "early", set the mac_late flag once we've processed modules either
41795fab37eSRobert Watson  * linked into the kernel, or loaded before the kernel startup.
41895fab37eSRobert Watson  */
41995fab37eSRobert Watson static void
42095fab37eSRobert Watson mac_late_init(void)
42195fab37eSRobert Watson {
42295fab37eSRobert Watson 
42395fab37eSRobert Watson 	mac_late = 1;
42495fab37eSRobert Watson }
42595fab37eSRobert Watson 
42695fab37eSRobert Watson /*
42795fab37eSRobert Watson  * Allow MAC policy modules to register during boot, etc.
42895fab37eSRobert Watson  */
42995fab37eSRobert Watson int
43095fab37eSRobert Watson mac_policy_modevent(module_t mod, int type, void *data)
43195fab37eSRobert Watson {
43295fab37eSRobert Watson 	struct mac_policy_conf *mpc;
43395fab37eSRobert Watson 	int error;
43495fab37eSRobert Watson 
43595fab37eSRobert Watson 	error = 0;
43695fab37eSRobert Watson 	mpc = (struct mac_policy_conf *) data;
43795fab37eSRobert Watson 
43895fab37eSRobert Watson 	switch (type) {
43995fab37eSRobert Watson 	case MOD_LOAD:
44095fab37eSRobert Watson 		if (mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_NOTLATE &&
44195fab37eSRobert Watson 		    mac_late) {
44295fab37eSRobert Watson 			printf("mac_policy_modevent: can't load %s policy "
44395fab37eSRobert Watson 			    "after booting\n", mpc->mpc_name);
44495fab37eSRobert Watson 			error = EBUSY;
44595fab37eSRobert Watson 			break;
44695fab37eSRobert Watson 		}
44795fab37eSRobert Watson 		error = mac_policy_register(mpc);
44895fab37eSRobert Watson 		break;
44995fab37eSRobert Watson 	case MOD_UNLOAD:
45095fab37eSRobert Watson 		/* Don't unregister the module if it was never registered. */
45195fab37eSRobert Watson 		if ((mpc->mpc_runtime_flags & MPC_RUNTIME_FLAG_REGISTERED)
45295fab37eSRobert Watson 		    != 0)
45395fab37eSRobert Watson 			error = mac_policy_unregister(mpc);
45495fab37eSRobert Watson 		else
45595fab37eSRobert Watson 			error = 0;
45695fab37eSRobert Watson 		break;
45795fab37eSRobert Watson 	default:
45895fab37eSRobert Watson 		break;
45995fab37eSRobert Watson 	}
46095fab37eSRobert Watson 
46195fab37eSRobert Watson 	return (error);
46295fab37eSRobert Watson }
46395fab37eSRobert Watson 
46495fab37eSRobert Watson static int
46595fab37eSRobert Watson mac_policy_register(struct mac_policy_conf *mpc)
46695fab37eSRobert Watson {
46795fab37eSRobert Watson 	struct mac_policy_conf *tmpc;
46895fab37eSRobert Watson 	struct mac_policy_op_entry *mpe;
46995fab37eSRobert Watson 	int slot;
47095fab37eSRobert Watson 
471cc51a2b5SRobert Watson 	MALLOC(mpc->mpc_ops, struct mac_policy_ops *, sizeof(*mpc->mpc_ops),
472cc51a2b5SRobert Watson 	    M_MACOPVEC, M_WAITOK | M_ZERO);
47395fab37eSRobert Watson 	for (mpe = mpc->mpc_entries; mpe->mpe_constant != MAC_OP_LAST; mpe++) {
47495fab37eSRobert Watson 		switch (mpe->mpe_constant) {
47595fab37eSRobert Watson 		case MAC_OP_LAST:
47695fab37eSRobert Watson 			/*
47795fab37eSRobert Watson 			 * Doesn't actually happen, but this allows checking
47895fab37eSRobert Watson 			 * that all enumerated values are handled.
47995fab37eSRobert Watson 			 */
48095fab37eSRobert Watson 			break;
48195fab37eSRobert Watson 		case MAC_DESTROY:
48295fab37eSRobert Watson 			mpc->mpc_ops->mpo_destroy =
48395fab37eSRobert Watson 			    mpe->mpe_function;
48495fab37eSRobert Watson 			break;
48595fab37eSRobert Watson 		case MAC_INIT:
48695fab37eSRobert Watson 			mpc->mpc_ops->mpo_init =
48795fab37eSRobert Watson 			    mpe->mpe_function;
48895fab37eSRobert Watson 			break;
48927f2eac7SRobert Watson 		case MAC_SYSCALL:
49027f2eac7SRobert Watson 			mpc->mpc_ops->mpo_syscall =
49127f2eac7SRobert Watson 			    mpe->mpe_function;
49227f2eac7SRobert Watson 			break;
49396adb909SRobert Watson 		case MAC_INIT_BPFDESC_LABEL:
49496adb909SRobert Watson 			mpc->mpc_ops->mpo_init_bpfdesc_label =
49595fab37eSRobert Watson 			    mpe->mpe_function;
49695fab37eSRobert Watson 			break;
49796adb909SRobert Watson 		case MAC_INIT_CRED_LABEL:
49896adb909SRobert Watson 			mpc->mpc_ops->mpo_init_cred_label =
49995fab37eSRobert Watson 			    mpe->mpe_function;
50095fab37eSRobert Watson 			break;
50196adb909SRobert Watson 		case MAC_INIT_DEVFSDIRENT_LABEL:
50296adb909SRobert Watson 			mpc->mpc_ops->mpo_init_devfsdirent_label =
50395fab37eSRobert Watson 			    mpe->mpe_function;
50495fab37eSRobert Watson 			break;
50596adb909SRobert Watson 		case MAC_INIT_IFNET_LABEL:
50696adb909SRobert Watson 			mpc->mpc_ops->mpo_init_ifnet_label =
50795fab37eSRobert Watson 			    mpe->mpe_function;
50895fab37eSRobert Watson 			break;
50996adb909SRobert Watson 		case MAC_INIT_IPQ_LABEL:
51096adb909SRobert Watson 			mpc->mpc_ops->mpo_init_ipq_label =
51195fab37eSRobert Watson 			    mpe->mpe_function;
51295fab37eSRobert Watson 			break;
51396adb909SRobert Watson 		case MAC_INIT_MBUF_LABEL:
51496adb909SRobert Watson 			mpc->mpc_ops->mpo_init_mbuf_label =
51595fab37eSRobert Watson 			    mpe->mpe_function;
51695fab37eSRobert Watson 			break;
51796adb909SRobert Watson 		case MAC_INIT_MOUNT_LABEL:
51896adb909SRobert Watson 			mpc->mpc_ops->mpo_init_mount_label =
51995fab37eSRobert Watson 			    mpe->mpe_function;
52095fab37eSRobert Watson 			break;
52196adb909SRobert Watson 		case MAC_INIT_MOUNT_FS_LABEL:
52296adb909SRobert Watson 			mpc->mpc_ops->mpo_init_mount_fs_label =
52395fab37eSRobert Watson 			    mpe->mpe_function;
52495fab37eSRobert Watson 			break;
52596adb909SRobert Watson 		case MAC_INIT_PIPE_LABEL:
52696adb909SRobert Watson 			mpc->mpc_ops->mpo_init_pipe_label =
52795fab37eSRobert Watson 			    mpe->mpe_function;
52895fab37eSRobert Watson 			break;
52996adb909SRobert Watson 		case MAC_INIT_SOCKET_LABEL:
53096adb909SRobert Watson 			mpc->mpc_ops->mpo_init_socket_label =
53195fab37eSRobert Watson 			    mpe->mpe_function;
53295fab37eSRobert Watson 			break;
53396adb909SRobert Watson 		case MAC_INIT_SOCKET_PEER_LABEL:
53496adb909SRobert Watson 			mpc->mpc_ops->mpo_init_socket_peer_label =
53595fab37eSRobert Watson 			    mpe->mpe_function;
53695fab37eSRobert Watson 			break;
53796adb909SRobert Watson 		case MAC_INIT_VNODE_LABEL:
53896adb909SRobert Watson 			mpc->mpc_ops->mpo_init_vnode_label =
53995fab37eSRobert Watson 			    mpe->mpe_function;
54095fab37eSRobert Watson 			break;
54196adb909SRobert Watson 		case MAC_DESTROY_BPFDESC_LABEL:
54296adb909SRobert Watson 			mpc->mpc_ops->mpo_destroy_bpfdesc_label =
54395fab37eSRobert Watson 			    mpe->mpe_function;
54495fab37eSRobert Watson 			break;
54596adb909SRobert Watson 		case MAC_DESTROY_CRED_LABEL:
54696adb909SRobert Watson 			mpc->mpc_ops->mpo_destroy_cred_label =
54795fab37eSRobert Watson 			    mpe->mpe_function;
54895fab37eSRobert Watson 			break;
54996adb909SRobert Watson 		case MAC_DESTROY_DEVFSDIRENT_LABEL:
55096adb909SRobert Watson 			mpc->mpc_ops->mpo_destroy_devfsdirent_label =
55195fab37eSRobert Watson 			    mpe->mpe_function;
55295fab37eSRobert Watson 			break;
55396adb909SRobert Watson 		case MAC_DESTROY_IFNET_LABEL:
55496adb909SRobert Watson 			mpc->mpc_ops->mpo_destroy_ifnet_label =
55595fab37eSRobert Watson 			    mpe->mpe_function;
55695fab37eSRobert Watson 			break;
55796adb909SRobert Watson 		case MAC_DESTROY_IPQ_LABEL:
55896adb909SRobert Watson 			mpc->mpc_ops->mpo_destroy_ipq_label =
55995fab37eSRobert Watson 			    mpe->mpe_function;
56095fab37eSRobert Watson 			break;
56196adb909SRobert Watson 		case MAC_DESTROY_MBUF_LABEL:
56296adb909SRobert Watson 			mpc->mpc_ops->mpo_destroy_mbuf_label =
56395fab37eSRobert Watson 			    mpe->mpe_function;
56495fab37eSRobert Watson 			break;
56596adb909SRobert Watson 		case MAC_DESTROY_MOUNT_LABEL:
56696adb909SRobert Watson 			mpc->mpc_ops->mpo_destroy_mount_label =
56795fab37eSRobert Watson 			    mpe->mpe_function;
56895fab37eSRobert Watson 			break;
56996adb909SRobert Watson 		case MAC_DESTROY_MOUNT_FS_LABEL:
57096adb909SRobert Watson 			mpc->mpc_ops->mpo_destroy_mount_fs_label =
57195fab37eSRobert Watson 			    mpe->mpe_function;
57295fab37eSRobert Watson 			break;
57396adb909SRobert Watson 		case MAC_DESTROY_PIPE_LABEL:
57496adb909SRobert Watson 			mpc->mpc_ops->mpo_destroy_pipe_label =
57596adb909SRobert Watson 			    mpe->mpe_function;
57696adb909SRobert Watson 			break;
57796adb909SRobert Watson 		case MAC_DESTROY_SOCKET_LABEL:
57896adb909SRobert Watson 			mpc->mpc_ops->mpo_destroy_socket_label =
57996adb909SRobert Watson 			    mpe->mpe_function;
58096adb909SRobert Watson 			break;
58196adb909SRobert Watson 		case MAC_DESTROY_SOCKET_PEER_LABEL:
58296adb909SRobert Watson 			mpc->mpc_ops->mpo_destroy_socket_peer_label =
58396adb909SRobert Watson 			    mpe->mpe_function;
58496adb909SRobert Watson 			break;
58596adb909SRobert Watson 		case MAC_DESTROY_VNODE_LABEL:
58696adb909SRobert Watson 			mpc->mpc_ops->mpo_destroy_vnode_label =
58795fab37eSRobert Watson 			    mpe->mpe_function;
58895fab37eSRobert Watson 			break;
589f7b951a8SRobert Watson 		case MAC_COPY_PIPE_LABEL:
590f7b951a8SRobert Watson 			mpc->mpc_ops->mpo_copy_pipe_label =
59195fab37eSRobert Watson 			    mpe->mpe_function;
59295fab37eSRobert Watson 			break;
593f7b951a8SRobert Watson 		case MAC_COPY_VNODE_LABEL:
594f7b951a8SRobert Watson 			mpc->mpc_ops->mpo_copy_vnode_label =
595f7b951a8SRobert Watson 			    mpe->mpe_function;
596f7b951a8SRobert Watson 			break;
597f7b951a8SRobert Watson 		case MAC_EXTERNALIZE_CRED_LABEL:
598f7b951a8SRobert Watson 			mpc->mpc_ops->mpo_externalize_cred_label =
599f7b951a8SRobert Watson 			    mpe->mpe_function;
600f7b951a8SRobert Watson 			break;
601f7b951a8SRobert Watson 		case MAC_EXTERNALIZE_IFNET_LABEL:
602f7b951a8SRobert Watson 			mpc->mpc_ops->mpo_externalize_ifnet_label =
603f7b951a8SRobert Watson 			    mpe->mpe_function;
604f7b951a8SRobert Watson 			break;
605f7b951a8SRobert Watson 		case MAC_EXTERNALIZE_PIPE_LABEL:
606f7b951a8SRobert Watson 			mpc->mpc_ops->mpo_externalize_pipe_label =
607f7b951a8SRobert Watson 			    mpe->mpe_function;
608f7b951a8SRobert Watson 			break;
609f7b951a8SRobert Watson 		case MAC_EXTERNALIZE_SOCKET_LABEL:
610f7b951a8SRobert Watson 			mpc->mpc_ops->mpo_externalize_socket_label =
611f7b951a8SRobert Watson 			    mpe->mpe_function;
612f7b951a8SRobert Watson 			break;
613f7b951a8SRobert Watson 		case MAC_EXTERNALIZE_SOCKET_PEER_LABEL:
614f7b951a8SRobert Watson 			mpc->mpc_ops->mpo_externalize_socket_peer_label =
615f7b951a8SRobert Watson 			    mpe->mpe_function;
616f7b951a8SRobert Watson 			break;
617f7b951a8SRobert Watson 		case MAC_EXTERNALIZE_VNODE_LABEL:
618f7b951a8SRobert Watson 			mpc->mpc_ops->mpo_externalize_vnode_label =
619f7b951a8SRobert Watson 			    mpe->mpe_function;
620f7b951a8SRobert Watson 			break;
621f7b951a8SRobert Watson 		case MAC_EXTERNALIZE_VNODE_OLDMAC:
622f7b951a8SRobert Watson 			mpc->mpc_ops->mpo_externalize_vnode_oldmac =
623f7b951a8SRobert Watson 			    mpe->mpe_function;
624f7b951a8SRobert Watson 			break;
625f7b951a8SRobert Watson 		case MAC_INTERNALIZE_CRED_LABEL:
626f7b951a8SRobert Watson 			mpc->mpc_ops->mpo_internalize_cred_label =
627f7b951a8SRobert Watson 			    mpe->mpe_function;
628f7b951a8SRobert Watson 			break;
629f7b951a8SRobert Watson 		case MAC_INTERNALIZE_IFNET_LABEL:
630f7b951a8SRobert Watson 			mpc->mpc_ops->mpo_internalize_ifnet_label =
631f7b951a8SRobert Watson 			    mpe->mpe_function;
632f7b951a8SRobert Watson 			break;
633f7b951a8SRobert Watson 		case MAC_INTERNALIZE_PIPE_LABEL:
634f7b951a8SRobert Watson 			mpc->mpc_ops->mpo_internalize_pipe_label =
635f7b951a8SRobert Watson 			    mpe->mpe_function;
636f7b951a8SRobert Watson 			break;
637f7b951a8SRobert Watson 		case MAC_INTERNALIZE_SOCKET_LABEL:
638f7b951a8SRobert Watson 			mpc->mpc_ops->mpo_internalize_socket_label =
639f7b951a8SRobert Watson 			    mpe->mpe_function;
640f7b951a8SRobert Watson 			break;
641f7b951a8SRobert Watson 		case MAC_INTERNALIZE_VNODE_LABEL:
642f7b951a8SRobert Watson 			mpc->mpc_ops->mpo_internalize_vnode_label =
64395fab37eSRobert Watson 			    mpe->mpe_function;
64495fab37eSRobert Watson 			break;
64595fab37eSRobert Watson 		case MAC_CREATE_DEVFS_DEVICE:
64695fab37eSRobert Watson 			mpc->mpc_ops->mpo_create_devfs_device =
64795fab37eSRobert Watson 			    mpe->mpe_function;
64895fab37eSRobert Watson 			break;
64995fab37eSRobert Watson 		case MAC_CREATE_DEVFS_DIRECTORY:
65095fab37eSRobert Watson 			mpc->mpc_ops->mpo_create_devfs_directory =
65195fab37eSRobert Watson 			    mpe->mpe_function;
65295fab37eSRobert Watson 			break;
65374e62b1bSRobert Watson 		case MAC_CREATE_DEVFS_SYMLINK:
65474e62b1bSRobert Watson 			mpc->mpc_ops->mpo_create_devfs_symlink =
65574e62b1bSRobert Watson 			    mpe->mpe_function;
65674e62b1bSRobert Watson 			break;
65795fab37eSRobert Watson 		case MAC_CREATE_DEVFS_VNODE:
65895fab37eSRobert Watson 			mpc->mpc_ops->mpo_create_devfs_vnode =
65995fab37eSRobert Watson 			    mpe->mpe_function;
66095fab37eSRobert Watson 			break;
66195fab37eSRobert Watson 		case MAC_STDCREATEVNODE_EA:
66295fab37eSRobert Watson 			mpc->mpc_ops->mpo_stdcreatevnode_ea =
66395fab37eSRobert Watson 			    mpe->mpe_function;
66495fab37eSRobert Watson 			break;
66595fab37eSRobert Watson 		case MAC_CREATE_VNODE:
66695fab37eSRobert Watson 			mpc->mpc_ops->mpo_create_vnode =
66795fab37eSRobert Watson 			    mpe->mpe_function;
66895fab37eSRobert Watson 			break;
66995fab37eSRobert Watson 		case MAC_CREATE_MOUNT:
67095fab37eSRobert Watson 			mpc->mpc_ops->mpo_create_mount =
67195fab37eSRobert Watson 			    mpe->mpe_function;
67295fab37eSRobert Watson 			break;
67395fab37eSRobert Watson 		case MAC_CREATE_ROOT_MOUNT:
67495fab37eSRobert Watson 			mpc->mpc_ops->mpo_create_root_mount =
67595fab37eSRobert Watson 			    mpe->mpe_function;
67695fab37eSRobert Watson 			break;
67795fab37eSRobert Watson 		case MAC_RELABEL_VNODE:
67895fab37eSRobert Watson 			mpc->mpc_ops->mpo_relabel_vnode =
67995fab37eSRobert Watson 			    mpe->mpe_function;
68095fab37eSRobert Watson 			break;
68195fab37eSRobert Watson 		case MAC_UPDATE_DEVFSDIRENT:
68295fab37eSRobert Watson 			mpc->mpc_ops->mpo_update_devfsdirent =
68395fab37eSRobert Watson 			    mpe->mpe_function;
68495fab37eSRobert Watson 			break;
68595fab37eSRobert Watson 		case MAC_UPDATE_PROCFSVNODE:
68695fab37eSRobert Watson 			mpc->mpc_ops->mpo_update_procfsvnode =
68795fab37eSRobert Watson 			    mpe->mpe_function;
68895fab37eSRobert Watson 			break;
68995fab37eSRobert Watson 		case MAC_UPDATE_VNODE_FROM_EXTATTR:
69095fab37eSRobert Watson 			mpc->mpc_ops->mpo_update_vnode_from_extattr =
69195fab37eSRobert Watson 			    mpe->mpe_function;
69295fab37eSRobert Watson 			break;
69395fab37eSRobert Watson 		case MAC_UPDATE_VNODE_FROM_EXTERNALIZED:
69495fab37eSRobert Watson 			mpc->mpc_ops->mpo_update_vnode_from_externalized =
69595fab37eSRobert Watson 			    mpe->mpe_function;
69695fab37eSRobert Watson 			break;
69795fab37eSRobert Watson 		case MAC_UPDATE_VNODE_FROM_MOUNT:
69895fab37eSRobert Watson 			mpc->mpc_ops->mpo_update_vnode_from_mount =
69995fab37eSRobert Watson 			    mpe->mpe_function;
70095fab37eSRobert Watson 			break;
70195fab37eSRobert Watson 		case MAC_CREATE_MBUF_FROM_SOCKET:
70295fab37eSRobert Watson 			mpc->mpc_ops->mpo_create_mbuf_from_socket =
70395fab37eSRobert Watson 			    mpe->mpe_function;
70495fab37eSRobert Watson 			break;
70595fab37eSRobert Watson 		case MAC_CREATE_PIPE:
70695fab37eSRobert Watson 			mpc->mpc_ops->mpo_create_pipe =
70795fab37eSRobert Watson 			    mpe->mpe_function;
70895fab37eSRobert Watson 			break;
70995fab37eSRobert Watson 		case MAC_CREATE_SOCKET:
71095fab37eSRobert Watson 			mpc->mpc_ops->mpo_create_socket =
71195fab37eSRobert Watson 			    mpe->mpe_function;
71295fab37eSRobert Watson 			break;
71395fab37eSRobert Watson 		case MAC_CREATE_SOCKET_FROM_SOCKET:
71495fab37eSRobert Watson 			mpc->mpc_ops->mpo_create_socket_from_socket =
71595fab37eSRobert Watson 			    mpe->mpe_function;
71695fab37eSRobert Watson 			break;
71795fab37eSRobert Watson 		case MAC_RELABEL_PIPE:
71895fab37eSRobert Watson 			mpc->mpc_ops->mpo_relabel_pipe =
71995fab37eSRobert Watson 			    mpe->mpe_function;
72095fab37eSRobert Watson 			break;
72195fab37eSRobert Watson 		case MAC_RELABEL_SOCKET:
72295fab37eSRobert Watson 			mpc->mpc_ops->mpo_relabel_socket =
72395fab37eSRobert Watson 			    mpe->mpe_function;
72495fab37eSRobert Watson 			break;
72595fab37eSRobert Watson 		case MAC_SET_SOCKET_PEER_FROM_MBUF:
72695fab37eSRobert Watson 			mpc->mpc_ops->mpo_set_socket_peer_from_mbuf =
72795fab37eSRobert Watson 			    mpe->mpe_function;
72895fab37eSRobert Watson 			break;
72995fab37eSRobert Watson 		case MAC_SET_SOCKET_PEER_FROM_SOCKET:
73095fab37eSRobert Watson 			mpc->mpc_ops->mpo_set_socket_peer_from_socket =
73195fab37eSRobert Watson 			    mpe->mpe_function;
73295fab37eSRobert Watson 			break;
73395fab37eSRobert Watson 		case MAC_CREATE_BPFDESC:
73495fab37eSRobert Watson 			mpc->mpc_ops->mpo_create_bpfdesc =
73595fab37eSRobert Watson 			    mpe->mpe_function;
73695fab37eSRobert Watson 			break;
73795fab37eSRobert Watson 		case MAC_CREATE_DATAGRAM_FROM_IPQ:
73895fab37eSRobert Watson 			mpc->mpc_ops->mpo_create_datagram_from_ipq =
73995fab37eSRobert Watson 			    mpe->mpe_function;
74095fab37eSRobert Watson 			break;
74195fab37eSRobert Watson 		case MAC_CREATE_FRAGMENT:
74295fab37eSRobert Watson 			mpc->mpc_ops->mpo_create_fragment =
74395fab37eSRobert Watson 			    mpe->mpe_function;
74495fab37eSRobert Watson 			break;
74595fab37eSRobert Watson 		case MAC_CREATE_IFNET:
74695fab37eSRobert Watson 			mpc->mpc_ops->mpo_create_ifnet =
74795fab37eSRobert Watson 			    mpe->mpe_function;
74895fab37eSRobert Watson 			break;
74995fab37eSRobert Watson 		case MAC_CREATE_IPQ:
75095fab37eSRobert Watson 			mpc->mpc_ops->mpo_create_ipq =
75195fab37eSRobert Watson 			    mpe->mpe_function;
75295fab37eSRobert Watson 			break;
75395fab37eSRobert Watson 		case MAC_CREATE_MBUF_FROM_MBUF:
75495fab37eSRobert Watson 			mpc->mpc_ops->mpo_create_mbuf_from_mbuf =
75595fab37eSRobert Watson 			    mpe->mpe_function;
75695fab37eSRobert Watson 			break;
75795fab37eSRobert Watson 		case MAC_CREATE_MBUF_LINKLAYER:
75895fab37eSRobert Watson 			mpc->mpc_ops->mpo_create_mbuf_linklayer =
75995fab37eSRobert Watson 			    mpe->mpe_function;
76095fab37eSRobert Watson 			break;
76195fab37eSRobert Watson 		case MAC_CREATE_MBUF_FROM_BPFDESC:
76295fab37eSRobert Watson 			mpc->mpc_ops->mpo_create_mbuf_from_bpfdesc =
76395fab37eSRobert Watson 			    mpe->mpe_function;
76495fab37eSRobert Watson 			break;
76595fab37eSRobert Watson 		case MAC_CREATE_MBUF_FROM_IFNET:
76695fab37eSRobert Watson 			mpc->mpc_ops->mpo_create_mbuf_from_ifnet =
76795fab37eSRobert Watson 			    mpe->mpe_function;
76895fab37eSRobert Watson 			break;
76995fab37eSRobert Watson 		case MAC_CREATE_MBUF_MULTICAST_ENCAP:
77095fab37eSRobert Watson 			mpc->mpc_ops->mpo_create_mbuf_multicast_encap =
77195fab37eSRobert Watson 			    mpe->mpe_function;
77295fab37eSRobert Watson 			break;
77395fab37eSRobert Watson 		case MAC_CREATE_MBUF_NETLAYER:
77495fab37eSRobert Watson 			mpc->mpc_ops->mpo_create_mbuf_netlayer =
77595fab37eSRobert Watson 			    mpe->mpe_function;
77695fab37eSRobert Watson 			break;
77795fab37eSRobert Watson 		case MAC_FRAGMENT_MATCH:
77895fab37eSRobert Watson 			mpc->mpc_ops->mpo_fragment_match =
77995fab37eSRobert Watson 			    mpe->mpe_function;
78095fab37eSRobert Watson 			break;
78195fab37eSRobert Watson 		case MAC_RELABEL_IFNET:
78295fab37eSRobert Watson 			mpc->mpc_ops->mpo_relabel_ifnet =
78395fab37eSRobert Watson 			    mpe->mpe_function;
78495fab37eSRobert Watson 			break;
78595fab37eSRobert Watson 		case MAC_UPDATE_IPQ:
78695fab37eSRobert Watson 			mpc->mpc_ops->mpo_update_ipq =
78795fab37eSRobert Watson 			    mpe->mpe_function;
78895fab37eSRobert Watson 			break;
78995fab37eSRobert Watson 		case MAC_CREATE_CRED:
79095fab37eSRobert Watson 			mpc->mpc_ops->mpo_create_cred =
79195fab37eSRobert Watson 			    mpe->mpe_function;
79295fab37eSRobert Watson 			break;
79395fab37eSRobert Watson 		case MAC_EXECVE_TRANSITION:
79495fab37eSRobert Watson 			mpc->mpc_ops->mpo_execve_transition =
79595fab37eSRobert Watson 			    mpe->mpe_function;
79695fab37eSRobert Watson 			break;
79795fab37eSRobert Watson 		case MAC_EXECVE_WILL_TRANSITION:
79895fab37eSRobert Watson 			mpc->mpc_ops->mpo_execve_will_transition =
79995fab37eSRobert Watson 			    mpe->mpe_function;
80095fab37eSRobert Watson 			break;
80195fab37eSRobert Watson 		case MAC_CREATE_PROC0:
802226b96fbSRobert Watson 			mpc->mpc_ops->mpo_create_proc0 =
803226b96fbSRobert Watson 			    mpe->mpe_function;
80495fab37eSRobert Watson 			break;
80595fab37eSRobert Watson 		case MAC_CREATE_PROC1:
806226b96fbSRobert Watson 			mpc->mpc_ops->mpo_create_proc1 =
807226b96fbSRobert Watson 			    mpe->mpe_function;
80895fab37eSRobert Watson 			break;
80995fab37eSRobert Watson 		case MAC_RELABEL_CRED:
81095fab37eSRobert Watson 			mpc->mpc_ops->mpo_relabel_cred =
81195fab37eSRobert Watson 			    mpe->mpe_function;
81295fab37eSRobert Watson 			break;
81392dbb82aSRobert Watson 		case MAC_THREAD_USERRET:
81492dbb82aSRobert Watson 			mpc->mpc_ops->mpo_thread_userret =
81592dbb82aSRobert Watson 			    mpe->mpe_function;
81692dbb82aSRobert Watson 			break;
81795fab37eSRobert Watson 		case MAC_CHECK_BPFDESC_RECEIVE:
81895fab37eSRobert Watson 			mpc->mpc_ops->mpo_check_bpfdesc_receive =
81995fab37eSRobert Watson 			    mpe->mpe_function;
82095fab37eSRobert Watson 			break;
82195fab37eSRobert Watson 		case MAC_CHECK_CRED_RELABEL:
82295fab37eSRobert Watson 			mpc->mpc_ops->mpo_check_cred_relabel =
82395fab37eSRobert Watson 			    mpe->mpe_function;
82495fab37eSRobert Watson 			break;
82595fab37eSRobert Watson 		case MAC_CHECK_CRED_VISIBLE:
82695fab37eSRobert Watson 			mpc->mpc_ops->mpo_check_cred_visible =
82795fab37eSRobert Watson 			    mpe->mpe_function;
82895fab37eSRobert Watson 			break;
82995fab37eSRobert Watson 		case MAC_CHECK_IFNET_RELABEL:
83095fab37eSRobert Watson 			mpc->mpc_ops->mpo_check_ifnet_relabel =
83195fab37eSRobert Watson 			    mpe->mpe_function;
83295fab37eSRobert Watson 			break;
83395fab37eSRobert Watson 		case MAC_CHECK_IFNET_TRANSMIT:
83495fab37eSRobert Watson 			mpc->mpc_ops->mpo_check_ifnet_transmit =
83595fab37eSRobert Watson 			    mpe->mpe_function;
83695fab37eSRobert Watson 			break;
83795fab37eSRobert Watson 		case MAC_CHECK_MOUNT_STAT:
83895fab37eSRobert Watson 			mpc->mpc_ops->mpo_check_mount_stat =
83995fab37eSRobert Watson 			    mpe->mpe_function;
84095fab37eSRobert Watson 			break;
84195fab37eSRobert Watson 		case MAC_CHECK_PIPE_IOCTL:
84295fab37eSRobert Watson 			mpc->mpc_ops->mpo_check_pipe_ioctl =
84395fab37eSRobert Watson 			    mpe->mpe_function;
84495fab37eSRobert Watson 			break;
845c024c3eeSRobert Watson 		case MAC_CHECK_PIPE_POLL:
846c024c3eeSRobert Watson 			mpc->mpc_ops->mpo_check_pipe_poll =
847c024c3eeSRobert Watson 			    mpe->mpe_function;
848c024c3eeSRobert Watson 			break;
849c024c3eeSRobert Watson 		case MAC_CHECK_PIPE_READ:
850c024c3eeSRobert Watson 			mpc->mpc_ops->mpo_check_pipe_read =
85195fab37eSRobert Watson 			    mpe->mpe_function;
85295fab37eSRobert Watson 			break;
85395fab37eSRobert Watson 		case MAC_CHECK_PIPE_RELABEL:
85495fab37eSRobert Watson 			mpc->mpc_ops->mpo_check_pipe_relabel =
85595fab37eSRobert Watson 			    mpe->mpe_function;
85695fab37eSRobert Watson 			break;
857c024c3eeSRobert Watson 		case MAC_CHECK_PIPE_STAT:
858c024c3eeSRobert Watson 			mpc->mpc_ops->mpo_check_pipe_stat =
859c024c3eeSRobert Watson 			    mpe->mpe_function;
860c024c3eeSRobert Watson 			break;
861c024c3eeSRobert Watson 		case MAC_CHECK_PIPE_WRITE:
862c024c3eeSRobert Watson 			mpc->mpc_ops->mpo_check_pipe_write =
863c024c3eeSRobert Watson 			    mpe->mpe_function;
864c024c3eeSRobert Watson 			break;
86595fab37eSRobert Watson 		case MAC_CHECK_PROC_DEBUG:
86695fab37eSRobert Watson 			mpc->mpc_ops->mpo_check_proc_debug =
86795fab37eSRobert Watson 			    mpe->mpe_function;
86895fab37eSRobert Watson 			break;
86995fab37eSRobert Watson 		case MAC_CHECK_PROC_SCHED:
87095fab37eSRobert Watson 			mpc->mpc_ops->mpo_check_proc_sched =
87195fab37eSRobert Watson 			    mpe->mpe_function;
87295fab37eSRobert Watson 			break;
87395fab37eSRobert Watson 		case MAC_CHECK_PROC_SIGNAL:
87495fab37eSRobert Watson 			mpc->mpc_ops->mpo_check_proc_signal =
87595fab37eSRobert Watson 			    mpe->mpe_function;
87695fab37eSRobert Watson 			break;
87795fab37eSRobert Watson 		case MAC_CHECK_SOCKET_BIND:
87895fab37eSRobert Watson 			mpc->mpc_ops->mpo_check_socket_bind =
87995fab37eSRobert Watson 			    mpe->mpe_function;
88095fab37eSRobert Watson 			break;
88195fab37eSRobert Watson 		case MAC_CHECK_SOCKET_CONNECT:
88295fab37eSRobert Watson 			mpc->mpc_ops->mpo_check_socket_connect =
88395fab37eSRobert Watson 			    mpe->mpe_function;
88495fab37eSRobert Watson 			break;
885d61198e4SRobert Watson 		case MAC_CHECK_SOCKET_DELIVER:
886d61198e4SRobert Watson 			mpc->mpc_ops->mpo_check_socket_deliver =
88795fab37eSRobert Watson 			    mpe->mpe_function;
88895fab37eSRobert Watson 			break;
889d61198e4SRobert Watson 		case MAC_CHECK_SOCKET_LISTEN:
890d61198e4SRobert Watson 			mpc->mpc_ops->mpo_check_socket_listen =
89195fab37eSRobert Watson 			    mpe->mpe_function;
89295fab37eSRobert Watson 			break;
893b371c939SRobert Watson 		case MAC_CHECK_SOCKET_RECEIVE:
894b371c939SRobert Watson 			mpc->mpc_ops->mpo_check_socket_receive =
895b371c939SRobert Watson 			    mpe->mpe_function;
896b371c939SRobert Watson 			break;
89795fab37eSRobert Watson 		case MAC_CHECK_SOCKET_RELABEL:
89895fab37eSRobert Watson 			mpc->mpc_ops->mpo_check_socket_relabel =
89995fab37eSRobert Watson 			    mpe->mpe_function;
90095fab37eSRobert Watson 			break;
901b371c939SRobert Watson 		case MAC_CHECK_SOCKET_SEND:
902b371c939SRobert Watson 			mpc->mpc_ops->mpo_check_socket_send =
903b371c939SRobert Watson 			    mpe->mpe_function;
904b371c939SRobert Watson 			break;
90595fab37eSRobert Watson 		case MAC_CHECK_SOCKET_VISIBLE:
90695fab37eSRobert Watson 			mpc->mpc_ops->mpo_check_socket_visible =
90795fab37eSRobert Watson 			    mpe->mpe_function;
90895fab37eSRobert Watson 			break;
90995fab37eSRobert Watson 		case MAC_CHECK_VNODE_ACCESS:
91095fab37eSRobert Watson 			mpc->mpc_ops->mpo_check_vnode_access =
91195fab37eSRobert Watson 			    mpe->mpe_function;
91295fab37eSRobert Watson 			break;
91395fab37eSRobert Watson 		case MAC_CHECK_VNODE_CHDIR:
91495fab37eSRobert Watson 			mpc->mpc_ops->mpo_check_vnode_chdir =
91595fab37eSRobert Watson 			    mpe->mpe_function;
91695fab37eSRobert Watson 			break;
91795fab37eSRobert Watson 		case MAC_CHECK_VNODE_CHROOT:
91895fab37eSRobert Watson 			mpc->mpc_ops->mpo_check_vnode_chroot =
91995fab37eSRobert Watson 			    mpe->mpe_function;
92095fab37eSRobert Watson 			break;
92195fab37eSRobert Watson 		case MAC_CHECK_VNODE_CREATE:
92295fab37eSRobert Watson 			mpc->mpc_ops->mpo_check_vnode_create =
92395fab37eSRobert Watson 			    mpe->mpe_function;
92495fab37eSRobert Watson 			break;
92595fab37eSRobert Watson 		case MAC_CHECK_VNODE_DELETE:
92695fab37eSRobert Watson 			mpc->mpc_ops->mpo_check_vnode_delete =
92795fab37eSRobert Watson 			    mpe->mpe_function;
92895fab37eSRobert Watson 			break;
92995fab37eSRobert Watson 		case MAC_CHECK_VNODE_DELETEACL:
93095fab37eSRobert Watson 			mpc->mpc_ops->mpo_check_vnode_deleteacl =
93195fab37eSRobert Watson 			    mpe->mpe_function;
93295fab37eSRobert Watson 			break;
93395fab37eSRobert Watson 		case MAC_CHECK_VNODE_EXEC:
93495fab37eSRobert Watson 			mpc->mpc_ops->mpo_check_vnode_exec =
93595fab37eSRobert Watson 			    mpe->mpe_function;
93695fab37eSRobert Watson 			break;
93795fab37eSRobert Watson 		case MAC_CHECK_VNODE_GETACL:
93895fab37eSRobert Watson 			mpc->mpc_ops->mpo_check_vnode_getacl =
93995fab37eSRobert Watson 			    mpe->mpe_function;
94095fab37eSRobert Watson 			break;
94195fab37eSRobert Watson 		case MAC_CHECK_VNODE_GETEXTATTR:
94295fab37eSRobert Watson 			mpc->mpc_ops->mpo_check_vnode_getextattr =
94395fab37eSRobert Watson 			    mpe->mpe_function;
94495fab37eSRobert Watson 			break;
9450a694196SRobert Watson 		case MAC_CHECK_VNODE_LINK:
9460a694196SRobert Watson 			mpc->mpc_ops->mpo_check_vnode_link =
9470a694196SRobert Watson 			    mpe->mpe_function;
9480a694196SRobert Watson 			break;
94995fab37eSRobert Watson 		case MAC_CHECK_VNODE_LOOKUP:
95095fab37eSRobert Watson 			mpc->mpc_ops->mpo_check_vnode_lookup =
95195fab37eSRobert Watson 			    mpe->mpe_function;
95295fab37eSRobert Watson 			break;
953e183f80eSRobert Watson 		case MAC_CHECK_VNODE_MMAP:
954e183f80eSRobert Watson 			mpc->mpc_ops->mpo_check_vnode_mmap =
955e183f80eSRobert Watson 			    mpe->mpe_function;
956e183f80eSRobert Watson 			break;
957e183f80eSRobert Watson 		case MAC_CHECK_VNODE_MMAP_DOWNGRADE:
958e183f80eSRobert Watson 			mpc->mpc_ops->mpo_check_vnode_mmap_downgrade =
959e183f80eSRobert Watson 			    mpe->mpe_function;
960e183f80eSRobert Watson 			break;
961e183f80eSRobert Watson 		case MAC_CHECK_VNODE_MPROTECT:
962e183f80eSRobert Watson 			mpc->mpc_ops->mpo_check_vnode_mprotect =
96395fab37eSRobert Watson 			    mpe->mpe_function;
96495fab37eSRobert Watson 			break;
96595fab37eSRobert Watson 		case MAC_CHECK_VNODE_OPEN:
96695fab37eSRobert Watson 			mpc->mpc_ops->mpo_check_vnode_open =
96795fab37eSRobert Watson 			    mpe->mpe_function;
96895fab37eSRobert Watson 			break;
9697f724f8bSRobert Watson 		case MAC_CHECK_VNODE_POLL:
9707f724f8bSRobert Watson 			mpc->mpc_ops->mpo_check_vnode_poll =
9717f724f8bSRobert Watson 			    mpe->mpe_function;
9727f724f8bSRobert Watson 			break;
9737f724f8bSRobert Watson 		case MAC_CHECK_VNODE_READ:
9747f724f8bSRobert Watson 			mpc->mpc_ops->mpo_check_vnode_read =
9757f724f8bSRobert Watson 			    mpe->mpe_function;
9767f724f8bSRobert Watson 			break;
97795fab37eSRobert Watson 		case MAC_CHECK_VNODE_READDIR:
97895fab37eSRobert Watson 			mpc->mpc_ops->mpo_check_vnode_readdir =
97995fab37eSRobert Watson 			    mpe->mpe_function;
98095fab37eSRobert Watson 			break;
98195fab37eSRobert Watson 		case MAC_CHECK_VNODE_READLINK:
98295fab37eSRobert Watson 			mpc->mpc_ops->mpo_check_vnode_readlink =
98395fab37eSRobert Watson 			    mpe->mpe_function;
98495fab37eSRobert Watson 			break;
98595fab37eSRobert Watson 		case MAC_CHECK_VNODE_RELABEL:
98695fab37eSRobert Watson 			mpc->mpc_ops->mpo_check_vnode_relabel =
98795fab37eSRobert Watson 			    mpe->mpe_function;
98895fab37eSRobert Watson 			break;
98995fab37eSRobert Watson 		case MAC_CHECK_VNODE_RENAME_FROM:
99095fab37eSRobert Watson 			mpc->mpc_ops->mpo_check_vnode_rename_from =
99195fab37eSRobert Watson 			    mpe->mpe_function;
99295fab37eSRobert Watson 			break;
99395fab37eSRobert Watson 		case MAC_CHECK_VNODE_RENAME_TO:
99495fab37eSRobert Watson 			mpc->mpc_ops->mpo_check_vnode_rename_to =
99595fab37eSRobert Watson 			    mpe->mpe_function;
99695fab37eSRobert Watson 			break;
99795fab37eSRobert Watson 		case MAC_CHECK_VNODE_REVOKE:
99895fab37eSRobert Watson 			mpc->mpc_ops->mpo_check_vnode_revoke =
99995fab37eSRobert Watson 			    mpe->mpe_function;
100095fab37eSRobert Watson 			break;
100195fab37eSRobert Watson 		case MAC_CHECK_VNODE_SETACL:
100295fab37eSRobert Watson 			mpc->mpc_ops->mpo_check_vnode_setacl =
100395fab37eSRobert Watson 			    mpe->mpe_function;
100495fab37eSRobert Watson 			break;
100595fab37eSRobert Watson 		case MAC_CHECK_VNODE_SETEXTATTR:
100695fab37eSRobert Watson 			mpc->mpc_ops->mpo_check_vnode_setextattr =
100795fab37eSRobert Watson 			    mpe->mpe_function;
100895fab37eSRobert Watson 			break;
100995fab37eSRobert Watson 		case MAC_CHECK_VNODE_SETFLAGS:
101095fab37eSRobert Watson 			mpc->mpc_ops->mpo_check_vnode_setflags =
101195fab37eSRobert Watson 			    mpe->mpe_function;
101295fab37eSRobert Watson 			break;
101395fab37eSRobert Watson 		case MAC_CHECK_VNODE_SETMODE:
101495fab37eSRobert Watson 			mpc->mpc_ops->mpo_check_vnode_setmode =
101595fab37eSRobert Watson 			    mpe->mpe_function;
101695fab37eSRobert Watson 			break;
101795fab37eSRobert Watson 		case MAC_CHECK_VNODE_SETOWNER:
101895fab37eSRobert Watson 			mpc->mpc_ops->mpo_check_vnode_setowner =
101995fab37eSRobert Watson 			    mpe->mpe_function;
102095fab37eSRobert Watson 			break;
102195fab37eSRobert Watson 		case MAC_CHECK_VNODE_SETUTIMES:
102295fab37eSRobert Watson 			mpc->mpc_ops->mpo_check_vnode_setutimes =
102395fab37eSRobert Watson 			    mpe->mpe_function;
102495fab37eSRobert Watson 			break;
102595fab37eSRobert Watson 		case MAC_CHECK_VNODE_STAT:
102695fab37eSRobert Watson 			mpc->mpc_ops->mpo_check_vnode_stat =
102795fab37eSRobert Watson 			    mpe->mpe_function;
102895fab37eSRobert Watson 			break;
10297f724f8bSRobert Watson 		case MAC_CHECK_VNODE_WRITE:
10307f724f8bSRobert Watson 			mpc->mpc_ops->mpo_check_vnode_write =
10317f724f8bSRobert Watson 			    mpe->mpe_function;
10327f724f8bSRobert Watson 			break;
103395fab37eSRobert Watson /*
103495fab37eSRobert Watson 		default:
103595fab37eSRobert Watson 			printf("MAC policy `%s': unknown operation %d\n",
103695fab37eSRobert Watson 			    mpc->mpc_name, mpe->mpe_constant);
103795fab37eSRobert Watson 			return (EINVAL);
103895fab37eSRobert Watson */
103995fab37eSRobert Watson 		}
104095fab37eSRobert Watson 	}
104195fab37eSRobert Watson 	MAC_POLICY_LIST_LOCK();
104295fab37eSRobert Watson 	if (mac_policy_list_busy > 0) {
104395fab37eSRobert Watson 		MAC_POLICY_LIST_UNLOCK();
104495fab37eSRobert Watson 		FREE(mpc->mpc_ops, M_MACOPVEC);
104595fab37eSRobert Watson 		mpc->mpc_ops = NULL;
104695fab37eSRobert Watson 		return (EBUSY);
104795fab37eSRobert Watson 	}
104895fab37eSRobert Watson 	LIST_FOREACH(tmpc, &mac_policy_list, mpc_list) {
104995fab37eSRobert Watson 		if (strcmp(tmpc->mpc_name, mpc->mpc_name) == 0) {
105095fab37eSRobert Watson 			MAC_POLICY_LIST_UNLOCK();
105195fab37eSRobert Watson 			FREE(mpc->mpc_ops, M_MACOPVEC);
105295fab37eSRobert Watson 			mpc->mpc_ops = NULL;
105395fab37eSRobert Watson 			return (EEXIST);
105495fab37eSRobert Watson 		}
105595fab37eSRobert Watson 	}
105695fab37eSRobert Watson 	if (mpc->mpc_field_off != NULL) {
105795fab37eSRobert Watson 		slot = ffs(mac_policy_offsets_free);
105895fab37eSRobert Watson 		if (slot == 0) {
105995fab37eSRobert Watson 			MAC_POLICY_LIST_UNLOCK();
106095fab37eSRobert Watson 			FREE(mpc->mpc_ops, M_MACOPVEC);
106195fab37eSRobert Watson 			mpc->mpc_ops = NULL;
106295fab37eSRobert Watson 			return (ENOMEM);
106395fab37eSRobert Watson 		}
106495fab37eSRobert Watson 		slot--;
106595fab37eSRobert Watson 		mac_policy_offsets_free &= ~(1 << slot);
106695fab37eSRobert Watson 		*mpc->mpc_field_off = slot;
106795fab37eSRobert Watson 	}
106895fab37eSRobert Watson 	mpc->mpc_runtime_flags |= MPC_RUNTIME_FLAG_REGISTERED;
106995fab37eSRobert Watson 	LIST_INSERT_HEAD(&mac_policy_list, mpc, mpc_list);
107095fab37eSRobert Watson 
107195fab37eSRobert Watson 	/* Per-policy initialization. */
107295fab37eSRobert Watson 	if (mpc->mpc_ops->mpo_init != NULL)
107395fab37eSRobert Watson 		(*(mpc->mpc_ops->mpo_init))(mpc);
107495fab37eSRobert Watson 	MAC_POLICY_LIST_UNLOCK();
107595fab37eSRobert Watson 
107695fab37eSRobert Watson 	printf("Security policy loaded: %s (%s)\n", mpc->mpc_fullname,
107795fab37eSRobert Watson 	    mpc->mpc_name);
107895fab37eSRobert Watson 
107995fab37eSRobert Watson 	return (0);
108095fab37eSRobert Watson }
108195fab37eSRobert Watson 
108295fab37eSRobert Watson static int
108395fab37eSRobert Watson mac_policy_unregister(struct mac_policy_conf *mpc)
108495fab37eSRobert Watson {
108595fab37eSRobert Watson 
1086ea599aa0SRobert Watson 	/*
1087ea599aa0SRobert Watson 	 * If we fail the load, we may get a request to unload.  Check
1088ea599aa0SRobert Watson 	 * to see if we did the run-time registration, and if not,
1089ea599aa0SRobert Watson 	 * silently succeed.
1090ea599aa0SRobert Watson 	 */
1091ea599aa0SRobert Watson 	MAC_POLICY_LIST_LOCK();
1092ea599aa0SRobert Watson 	if ((mpc->mpc_runtime_flags & MPC_RUNTIME_FLAG_REGISTERED) == 0) {
1093ea599aa0SRobert Watson 		MAC_POLICY_LIST_UNLOCK();
1094ea599aa0SRobert Watson 		return (0);
1095ea599aa0SRobert Watson 	}
109695fab37eSRobert Watson #if 0
109795fab37eSRobert Watson 	/*
109895fab37eSRobert Watson 	 * Don't allow unloading modules with private data.
109995fab37eSRobert Watson 	 */
1100ea599aa0SRobert Watson 	if (mpc->mpc_field_off != NULL) {
1101ea599aa0SRobert Watson 		MAC_POLICY_LIST_UNLOCK();
110295fab37eSRobert Watson 		return (EBUSY);
1103ea599aa0SRobert Watson 	}
110495fab37eSRobert Watson #endif
1105ea599aa0SRobert Watson 	/*
1106ea599aa0SRobert Watson 	 * Only allow the unload to proceed if the module is unloadable
1107ea599aa0SRobert Watson 	 * by its own definition.
1108ea599aa0SRobert Watson 	 */
1109ea599aa0SRobert Watson 	if ((mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_UNLOADOK) == 0) {
1110ea599aa0SRobert Watson 		MAC_POLICY_LIST_UNLOCK();
111195fab37eSRobert Watson 		return (EBUSY);
1112ea599aa0SRobert Watson 	}
1113ea599aa0SRobert Watson 	/*
1114ea599aa0SRobert Watson 	 * Right now, we EBUSY if the list is in use.  In the future,
1115ea599aa0SRobert Watson 	 * for reliability reasons, we might want to sleep and wakeup
1116ea599aa0SRobert Watson 	 * later to try again.
1117ea599aa0SRobert Watson 	 */
111895fab37eSRobert Watson 	if (mac_policy_list_busy > 0) {
111995fab37eSRobert Watson 		MAC_POLICY_LIST_UNLOCK();
112095fab37eSRobert Watson 		return (EBUSY);
112195fab37eSRobert Watson 	}
112295fab37eSRobert Watson 	if (mpc->mpc_ops->mpo_destroy != NULL)
112395fab37eSRobert Watson 		(*(mpc->mpc_ops->mpo_destroy))(mpc);
112495fab37eSRobert Watson 
112595fab37eSRobert Watson 	LIST_REMOVE(mpc, mpc_list);
112695fab37eSRobert Watson 	MAC_POLICY_LIST_UNLOCK();
112795fab37eSRobert Watson 
112895fab37eSRobert Watson 	FREE(mpc->mpc_ops, M_MACOPVEC);
112995fab37eSRobert Watson 	mpc->mpc_ops = NULL;
11309aeffb2bSRobert Watson 	mpc->mpc_runtime_flags &= ~MPC_RUNTIME_FLAG_REGISTERED;
113195fab37eSRobert Watson 
113295fab37eSRobert Watson 	printf("Security policy unload: %s (%s)\n", mpc->mpc_fullname,
113395fab37eSRobert Watson 	    mpc->mpc_name);
113495fab37eSRobert Watson 
113595fab37eSRobert Watson 	return (0);
113695fab37eSRobert Watson }
113795fab37eSRobert Watson 
113895fab37eSRobert Watson /*
113995fab37eSRobert Watson  * Define an error value precedence, and given two arguments, selects the
114095fab37eSRobert Watson  * value with the higher precedence.
114195fab37eSRobert Watson  */
114295fab37eSRobert Watson static int
114395fab37eSRobert Watson error_select(int error1, int error2)
114495fab37eSRobert Watson {
114595fab37eSRobert Watson 
114695fab37eSRobert Watson 	/* Certain decision-making errors take top priority. */
114795fab37eSRobert Watson 	if (error1 == EDEADLK || error2 == EDEADLK)
114895fab37eSRobert Watson 		return (EDEADLK);
114995fab37eSRobert Watson 
115095fab37eSRobert Watson 	/* Invalid arguments should be reported where possible. */
115195fab37eSRobert Watson 	if (error1 == EINVAL || error2 == EINVAL)
115295fab37eSRobert Watson 		return (EINVAL);
115395fab37eSRobert Watson 
115495fab37eSRobert Watson 	/* Precedence goes to "visibility", with both process and file. */
115595fab37eSRobert Watson 	if (error1 == ESRCH || error2 == ESRCH)
115695fab37eSRobert Watson 		return (ESRCH);
115795fab37eSRobert Watson 
115895fab37eSRobert Watson 	if (error1 == ENOENT || error2 == ENOENT)
115995fab37eSRobert Watson 		return (ENOENT);
116095fab37eSRobert Watson 
116195fab37eSRobert Watson 	/* Precedence goes to DAC/MAC protections. */
116295fab37eSRobert Watson 	if (error1 == EACCES || error2 == EACCES)
116395fab37eSRobert Watson 		return (EACCES);
116495fab37eSRobert Watson 
116595fab37eSRobert Watson 	/* Precedence goes to privilege. */
116695fab37eSRobert Watson 	if (error1 == EPERM || error2 == EPERM)
116795fab37eSRobert Watson 		return (EPERM);
116895fab37eSRobert Watson 
116995fab37eSRobert Watson 	/* Precedence goes to error over success; otherwise, arbitrary. */
117095fab37eSRobert Watson 	if (error1 != 0)
117195fab37eSRobert Watson 		return (error1);
117295fab37eSRobert Watson 	return (error2);
117395fab37eSRobert Watson }
117495fab37eSRobert Watson 
117508bcdc58SRobert Watson static void
117608bcdc58SRobert Watson mac_init_label(struct label *label)
117708bcdc58SRobert Watson {
117808bcdc58SRobert Watson 
117908bcdc58SRobert Watson 	bzero(label, sizeof(*label));
118008bcdc58SRobert Watson 	label->l_flags = MAC_FLAG_INITIALIZED;
118108bcdc58SRobert Watson }
118208bcdc58SRobert Watson 
118308bcdc58SRobert Watson static void
118408bcdc58SRobert Watson mac_destroy_label(struct label *label)
118508bcdc58SRobert Watson {
118608bcdc58SRobert Watson 
118708bcdc58SRobert Watson 	KASSERT(label->l_flags & MAC_FLAG_INITIALIZED,
118808bcdc58SRobert Watson 	    ("destroying uninitialized label"));
118908bcdc58SRobert Watson 
119008bcdc58SRobert Watson 	bzero(label, sizeof(*label));
119108bcdc58SRobert Watson 	/* implicit: label->l_flags &= ~MAC_FLAG_INITIALIZED; */
119208bcdc58SRobert Watson }
119308bcdc58SRobert Watson 
119408bcdc58SRobert Watson void
119587807196SRobert Watson mac_init_bpfdesc(struct bpf_d *bpf_d)
119608bcdc58SRobert Watson {
119708bcdc58SRobert Watson 
119887807196SRobert Watson 	mac_init_label(&bpf_d->bd_label);
119987807196SRobert Watson 	MAC_PERFORM(init_bpfdesc_label, &bpf_d->bd_label);
120008bcdc58SRobert Watson #ifdef MAC_DEBUG
120187807196SRobert Watson 	atomic_add_int(&nmacbpfdescs, 1);
120208bcdc58SRobert Watson #endif
120308bcdc58SRobert Watson }
120408bcdc58SRobert Watson 
1205f7b951a8SRobert Watson static void
1206f7b951a8SRobert Watson mac_init_cred_label(struct label *label)
120708bcdc58SRobert Watson {
120808bcdc58SRobert Watson 
1209f7b951a8SRobert Watson 	mac_init_label(label);
1210f7b951a8SRobert Watson 	MAC_PERFORM(init_cred_label, label);
121108bcdc58SRobert Watson #ifdef MAC_DEBUG
121208bcdc58SRobert Watson 	atomic_add_int(&nmaccreds, 1);
121308bcdc58SRobert Watson #endif
121408bcdc58SRobert Watson }
121508bcdc58SRobert Watson 
121608bcdc58SRobert Watson void
1217f7b951a8SRobert Watson mac_init_cred(struct ucred *cred)
1218f7b951a8SRobert Watson {
1219f7b951a8SRobert Watson 
1220f7b951a8SRobert Watson 	mac_init_cred_label(&cred->cr_label);
1221f7b951a8SRobert Watson }
1222f7b951a8SRobert Watson 
1223f7b951a8SRobert Watson void
122487807196SRobert Watson mac_init_devfsdirent(struct devfs_dirent *de)
122508bcdc58SRobert Watson {
122608bcdc58SRobert Watson 
122787807196SRobert Watson 	mac_init_label(&de->de_label);
122887807196SRobert Watson 	MAC_PERFORM(init_devfsdirent_label, &de->de_label);
122908bcdc58SRobert Watson #ifdef MAC_DEBUG
123087807196SRobert Watson 	atomic_add_int(&nmacdevfsdirents, 1);
123108bcdc58SRobert Watson #endif
123208bcdc58SRobert Watson }
123308bcdc58SRobert Watson 
1234f7b951a8SRobert Watson static void
1235f7b951a8SRobert Watson mac_init_ifnet_label(struct label *label)
1236f7b951a8SRobert Watson {
1237f7b951a8SRobert Watson 
1238f7b951a8SRobert Watson 	mac_init_label(label);
1239f7b951a8SRobert Watson 	MAC_PERFORM(init_ifnet_label, label);
1240f7b951a8SRobert Watson #ifdef MAC_DEBUG
1241f7b951a8SRobert Watson 	atomic_add_int(&nmacifnets, 1);
1242f7b951a8SRobert Watson #endif
1243f7b951a8SRobert Watson }
1244f7b951a8SRobert Watson 
124508bcdc58SRobert Watson void
124608bcdc58SRobert Watson mac_init_ifnet(struct ifnet *ifp)
124708bcdc58SRobert Watson {
124808bcdc58SRobert Watson 
1249f7b951a8SRobert Watson 	mac_init_ifnet_label(&ifp->if_label);
125008bcdc58SRobert Watson }
125108bcdc58SRobert Watson 
125208bcdc58SRobert Watson void
125308bcdc58SRobert Watson mac_init_ipq(struct ipq *ipq)
125408bcdc58SRobert Watson {
125508bcdc58SRobert Watson 
125608bcdc58SRobert Watson 	mac_init_label(&ipq->ipq_label);
125708bcdc58SRobert Watson 	MAC_PERFORM(init_ipq_label, &ipq->ipq_label);
125808bcdc58SRobert Watson #ifdef MAC_DEBUG
125908bcdc58SRobert Watson 	atomic_add_int(&nmacipqs, 1);
126008bcdc58SRobert Watson #endif
126108bcdc58SRobert Watson }
126208bcdc58SRobert Watson 
126387807196SRobert Watson int
126487807196SRobert Watson mac_init_mbuf(struct mbuf *m, int flag)
126508bcdc58SRobert Watson {
126656c15412SRobert Watson 	int error;
126756c15412SRobert Watson 
126887807196SRobert Watson 	KASSERT(m->m_flags & M_PKTHDR, ("mac_init_mbuf on non-header mbuf"));
126908bcdc58SRobert Watson 
127087807196SRobert Watson 	mac_init_label(&m->m_pkthdr.label);
127187807196SRobert Watson 
127256c15412SRobert Watson 	MAC_CHECK(init_mbuf_label, &m->m_pkthdr.label, flag);
127356c15412SRobert Watson 	if (error) {
127456c15412SRobert Watson 		MAC_PERFORM(destroy_mbuf_label, &m->m_pkthdr.label);
127556c15412SRobert Watson 		mac_destroy_label(&m->m_pkthdr.label);
127656c15412SRobert Watson 	}
127756c15412SRobert Watson 
127808bcdc58SRobert Watson #ifdef MAC_DEBUG
127956c15412SRobert Watson 	if (error == 0)
128087807196SRobert Watson 		atomic_add_int(&nmacmbufs, 1);
128108bcdc58SRobert Watson #endif
128256c15412SRobert Watson 	return (error);
128308bcdc58SRobert Watson }
128408bcdc58SRobert Watson 
128508bcdc58SRobert Watson void
128687807196SRobert Watson mac_init_mount(struct mount *mp)
128708bcdc58SRobert Watson {
128808bcdc58SRobert Watson 
128987807196SRobert Watson 	mac_init_label(&mp->mnt_mntlabel);
129087807196SRobert Watson 	mac_init_label(&mp->mnt_fslabel);
129187807196SRobert Watson 	MAC_PERFORM(init_mount_label, &mp->mnt_mntlabel);
129287807196SRobert Watson 	MAC_PERFORM(init_mount_fs_label, &mp->mnt_fslabel);
129308bcdc58SRobert Watson #ifdef MAC_DEBUG
129487807196SRobert Watson 	atomic_add_int(&nmacmounts, 1);
129508bcdc58SRobert Watson #endif
129608bcdc58SRobert Watson }
129708bcdc58SRobert Watson 
1298f7b951a8SRobert Watson static void
1299f7b951a8SRobert Watson mac_init_pipe_label(struct label *label)
1300f7b951a8SRobert Watson {
1301f7b951a8SRobert Watson 
1302f7b951a8SRobert Watson 	mac_init_label(label);
1303f7b951a8SRobert Watson 	MAC_PERFORM(init_pipe_label, label);
1304f7b951a8SRobert Watson #ifdef MAC_DEBUG
1305f7b951a8SRobert Watson 	atomic_add_int(&nmacpipes, 1);
1306f7b951a8SRobert Watson #endif
1307f7b951a8SRobert Watson }
1308f7b951a8SRobert Watson 
130908bcdc58SRobert Watson void
131008bcdc58SRobert Watson mac_init_pipe(struct pipe *pipe)
131108bcdc58SRobert Watson {
131208bcdc58SRobert Watson 	struct label *label;
131308bcdc58SRobert Watson 
131408bcdc58SRobert Watson 	label = malloc(sizeof(struct label), M_MACPIPELABEL, M_ZERO|M_WAITOK);
131508bcdc58SRobert Watson 	pipe->pipe_label = label;
131608bcdc58SRobert Watson 	pipe->pipe_peer->pipe_label = label;
1317f7b951a8SRobert Watson 	mac_init_pipe_label(label);
131808bcdc58SRobert Watson }
131908bcdc58SRobert Watson 
132083985c26SRobert Watson static int
132183985c26SRobert Watson mac_init_socket_label(struct label *label, int flag)
132208bcdc58SRobert Watson {
132383985c26SRobert Watson 	int error;
132408bcdc58SRobert Watson 
132583985c26SRobert Watson 	mac_init_label(label);
132683985c26SRobert Watson 
132783985c26SRobert Watson 	MAC_CHECK(init_socket_label, label, flag);
132883985c26SRobert Watson 	if (error) {
132983985c26SRobert Watson 		MAC_PERFORM(destroy_socket_label, label);
133083985c26SRobert Watson 		mac_destroy_label(label);
133183985c26SRobert Watson 	}
133283985c26SRobert Watson 
133308bcdc58SRobert Watson #ifdef MAC_DEBUG
133483985c26SRobert Watson 	if (error == 0)
133587807196SRobert Watson 		atomic_add_int(&nmacsockets, 1);
133687807196SRobert Watson #endif
133783985c26SRobert Watson 
133883985c26SRobert Watson 	return (error);
133983985c26SRobert Watson }
134083985c26SRobert Watson 
134183985c26SRobert Watson static int
134283985c26SRobert Watson mac_init_socket_peer_label(struct label *label, int flag)
134383985c26SRobert Watson {
134483985c26SRobert Watson 	int error;
134583985c26SRobert Watson 
134683985c26SRobert Watson 	mac_init_label(label);
134783985c26SRobert Watson 
134883985c26SRobert Watson 	MAC_CHECK(init_socket_peer_label, label, flag);
134983985c26SRobert Watson 	if (error) {
135083985c26SRobert Watson 		MAC_PERFORM(destroy_socket_label, label);
135183985c26SRobert Watson 		mac_destroy_label(label);
135283985c26SRobert Watson 	}
135383985c26SRobert Watson 
135483985c26SRobert Watson 	return (error);
135583985c26SRobert Watson }
135683985c26SRobert Watson 
135783985c26SRobert Watson int
135883985c26SRobert Watson mac_init_socket(struct socket *socket, int flag)
135983985c26SRobert Watson {
136083985c26SRobert Watson 	int error;
136183985c26SRobert Watson 
136283985c26SRobert Watson 	error = mac_init_socket_label(&socket->so_label, flag);
136383985c26SRobert Watson 	if (error)
136483985c26SRobert Watson 		return (error);
136583985c26SRobert Watson 
136683985c26SRobert Watson 	error = mac_init_socket_peer_label(&socket->so_peerlabel, flag);
136783985c26SRobert Watson 	if (error)
136883985c26SRobert Watson 		mac_destroy_socket_label(&socket->so_label);
136983985c26SRobert Watson 
137083985c26SRobert Watson 	return (error);
137187807196SRobert Watson }
137287807196SRobert Watson 
137387807196SRobert Watson static void
1374f7b951a8SRobert Watson mac_init_vnode_label(struct label *label)
137587807196SRobert Watson {
137687807196SRobert Watson 
137787807196SRobert Watson 	mac_init_label(label);
1378f7b951a8SRobert Watson 	MAC_PERFORM(init_vnode_label, label);
137987807196SRobert Watson #ifdef MAC_DEBUG
1380f7b951a8SRobert Watson 	atomic_add_int(&nmacvnodes, 1);
138108bcdc58SRobert Watson #endif
138208bcdc58SRobert Watson }
138308bcdc58SRobert Watson 
138408bcdc58SRobert Watson void
138587807196SRobert Watson mac_init_vnode(struct vnode *vp)
138608bcdc58SRobert Watson {
138708bcdc58SRobert Watson 
1388f7b951a8SRobert Watson 	mac_init_vnode_label(&vp->v_label);
138908bcdc58SRobert Watson }
139008bcdc58SRobert Watson 
139108bcdc58SRobert Watson void
139208bcdc58SRobert Watson mac_destroy_bpfdesc(struct bpf_d *bpf_d)
139308bcdc58SRobert Watson {
139408bcdc58SRobert Watson 
139508bcdc58SRobert Watson 	MAC_PERFORM(destroy_bpfdesc_label, &bpf_d->bd_label);
139608bcdc58SRobert Watson 	mac_destroy_label(&bpf_d->bd_label);
139708bcdc58SRobert Watson #ifdef MAC_DEBUG
139808bcdc58SRobert Watson 	atomic_subtract_int(&nmacbpfdescs, 1);
139908bcdc58SRobert Watson #endif
140008bcdc58SRobert Watson }
140108bcdc58SRobert Watson 
1402f7b951a8SRobert Watson static void
1403f7b951a8SRobert Watson mac_destroy_cred_label(struct label *label)
140408bcdc58SRobert Watson {
140508bcdc58SRobert Watson 
1406f7b951a8SRobert Watson 	MAC_PERFORM(destroy_cred_label, label);
1407f7b951a8SRobert Watson 	mac_destroy_label(label);
140808bcdc58SRobert Watson #ifdef MAC_DEBUG
140987807196SRobert Watson 	atomic_subtract_int(&nmaccreds, 1);
141087807196SRobert Watson #endif
141187807196SRobert Watson }
141287807196SRobert Watson 
141387807196SRobert Watson void
1414f7b951a8SRobert Watson mac_destroy_cred(struct ucred *cred)
1415f7b951a8SRobert Watson {
1416f7b951a8SRobert Watson 
1417f7b951a8SRobert Watson 	mac_destroy_cred_label(&cred->cr_label);
1418f7b951a8SRobert Watson }
1419f7b951a8SRobert Watson 
1420f7b951a8SRobert Watson void
142187807196SRobert Watson mac_destroy_devfsdirent(struct devfs_dirent *de)
142287807196SRobert Watson {
142387807196SRobert Watson 
142487807196SRobert Watson 	MAC_PERFORM(destroy_devfsdirent_label, &de->de_label);
142587807196SRobert Watson 	mac_destroy_label(&de->de_label);
142687807196SRobert Watson #ifdef MAC_DEBUG
142787807196SRobert Watson 	atomic_subtract_int(&nmacdevfsdirents, 1);
142887807196SRobert Watson #endif
142987807196SRobert Watson }
143087807196SRobert Watson 
1431f7b951a8SRobert Watson static void
1432f7b951a8SRobert Watson mac_destroy_ifnet_label(struct label *label)
1433f7b951a8SRobert Watson {
1434f7b951a8SRobert Watson 
1435f7b951a8SRobert Watson 	MAC_PERFORM(destroy_ifnet_label, label);
1436f7b951a8SRobert Watson 	mac_destroy_label(label);
1437f7b951a8SRobert Watson #ifdef MAC_DEBUG
1438f7b951a8SRobert Watson 	atomic_subtract_int(&nmacifnets, 1);
1439f7b951a8SRobert Watson #endif
1440f7b951a8SRobert Watson }
1441f7b951a8SRobert Watson 
144287807196SRobert Watson void
144387807196SRobert Watson mac_destroy_ifnet(struct ifnet *ifp)
144487807196SRobert Watson {
144587807196SRobert Watson 
1446f7b951a8SRobert Watson 	mac_destroy_ifnet_label(&ifp->if_label);
144787807196SRobert Watson }
144887807196SRobert Watson 
144987807196SRobert Watson void
145087807196SRobert Watson mac_destroy_ipq(struct ipq *ipq)
145187807196SRobert Watson {
145287807196SRobert Watson 
145387807196SRobert Watson 	MAC_PERFORM(destroy_ipq_label, &ipq->ipq_label);
145487807196SRobert Watson 	mac_destroy_label(&ipq->ipq_label);
145587807196SRobert Watson #ifdef MAC_DEBUG
145687807196SRobert Watson 	atomic_subtract_int(&nmacipqs, 1);
145787807196SRobert Watson #endif
145887807196SRobert Watson }
145987807196SRobert Watson 
146087807196SRobert Watson void
146187807196SRobert Watson mac_destroy_mbuf(struct mbuf *m)
146287807196SRobert Watson {
146387807196SRobert Watson 
146487807196SRobert Watson 	MAC_PERFORM(destroy_mbuf_label, &m->m_pkthdr.label);
146587807196SRobert Watson 	mac_destroy_label(&m->m_pkthdr.label);
146687807196SRobert Watson #ifdef MAC_DEBUG
146787807196SRobert Watson 	atomic_subtract_int(&nmacmbufs, 1);
146808bcdc58SRobert Watson #endif
146908bcdc58SRobert Watson }
147008bcdc58SRobert Watson 
147108bcdc58SRobert Watson void
147208bcdc58SRobert Watson mac_destroy_mount(struct mount *mp)
147308bcdc58SRobert Watson {
147408bcdc58SRobert Watson 
147508bcdc58SRobert Watson 	MAC_PERFORM(destroy_mount_label, &mp->mnt_mntlabel);
147608bcdc58SRobert Watson 	MAC_PERFORM(destroy_mount_fs_label, &mp->mnt_fslabel);
147708bcdc58SRobert Watson 	mac_destroy_label(&mp->mnt_fslabel);
147808bcdc58SRobert Watson 	mac_destroy_label(&mp->mnt_mntlabel);
147908bcdc58SRobert Watson #ifdef MAC_DEBUG
148008bcdc58SRobert Watson 	atomic_subtract_int(&nmacmounts, 1);
148108bcdc58SRobert Watson #endif
148208bcdc58SRobert Watson }
148308bcdc58SRobert Watson 
1484f7b951a8SRobert Watson static void
1485f7b951a8SRobert Watson mac_destroy_pipe_label(struct label *label)
1486f7b951a8SRobert Watson {
1487f7b951a8SRobert Watson 
1488f7b951a8SRobert Watson 	MAC_PERFORM(destroy_pipe_label, label);
1489f7b951a8SRobert Watson 	mac_destroy_label(label);
1490f7b951a8SRobert Watson #ifdef MAC_DEBUG
1491f7b951a8SRobert Watson 	atomic_subtract_int(&nmacpipes, 1);
1492f7b951a8SRobert Watson #endif
1493f7b951a8SRobert Watson }
1494f7b951a8SRobert Watson 
149587807196SRobert Watson void
149687807196SRobert Watson mac_destroy_pipe(struct pipe *pipe)
149708bcdc58SRobert Watson {
149808bcdc58SRobert Watson 
1499f7b951a8SRobert Watson 	mac_destroy_pipe_label(pipe->pipe_label);
150087807196SRobert Watson 	free(pipe->pipe_label, M_MACPIPELABEL);
150187807196SRobert Watson }
150287807196SRobert Watson 
150383985c26SRobert Watson static void
150483985c26SRobert Watson mac_destroy_socket_label(struct label *label)
150583985c26SRobert Watson {
150683985c26SRobert Watson 
150783985c26SRobert Watson 	MAC_PERFORM(destroy_socket_label, label);
150883985c26SRobert Watson 	mac_destroy_label(label);
150983985c26SRobert Watson #ifdef MAC_DEBUG
151083985c26SRobert Watson 	atomic_subtract_int(&nmacsockets, 1);
151183985c26SRobert Watson #endif
151283985c26SRobert Watson }
151383985c26SRobert Watson 
151483985c26SRobert Watson static void
151583985c26SRobert Watson mac_destroy_socket_peer_label(struct label *label)
151683985c26SRobert Watson {
151783985c26SRobert Watson 
151883985c26SRobert Watson 	MAC_PERFORM(destroy_socket_peer_label, label);
151983985c26SRobert Watson 	mac_destroy_label(label);
152083985c26SRobert Watson }
152183985c26SRobert Watson 
152287807196SRobert Watson void
152387807196SRobert Watson mac_destroy_socket(struct socket *socket)
152487807196SRobert Watson {
152587807196SRobert Watson 
152683985c26SRobert Watson 	mac_destroy_socket_label(&socket->so_label);
152783985c26SRobert Watson 	mac_destroy_socket_peer_label(&socket->so_peerlabel);
152808bcdc58SRobert Watson }
152908bcdc58SRobert Watson 
153008bcdc58SRobert Watson static void
1531f7b951a8SRobert Watson mac_destroy_vnode_label(struct label *label)
153208bcdc58SRobert Watson {
153308bcdc58SRobert Watson 
1534f7b951a8SRobert Watson 	MAC_PERFORM(destroy_vnode_label, label);
153508bcdc58SRobert Watson 	mac_destroy_label(label);
153608bcdc58SRobert Watson #ifdef MAC_DEBUG
1537f7b951a8SRobert Watson 	atomic_subtract_int(&nmacvnodes, 1);
153808bcdc58SRobert Watson #endif
153908bcdc58SRobert Watson }
154008bcdc58SRobert Watson 
154108bcdc58SRobert Watson void
154208bcdc58SRobert Watson mac_destroy_vnode(struct vnode *vp)
154308bcdc58SRobert Watson {
154408bcdc58SRobert Watson 
1545f7b951a8SRobert Watson 	mac_destroy_vnode_label(&vp->v_label);
1546f7b951a8SRobert Watson }
1547f7b951a8SRobert Watson 
1548f7b951a8SRobert Watson static void
1549f7b951a8SRobert Watson mac_copy_pipe_label(struct label *src, struct label *dest)
1550f7b951a8SRobert Watson {
1551f7b951a8SRobert Watson 
1552f7b951a8SRobert Watson 	MAC_PERFORM(copy_pipe_label, src, dest);
1553f7b951a8SRobert Watson }
1554f7b951a8SRobert Watson 
1555f7b951a8SRobert Watson static void
1556f7b951a8SRobert Watson mac_copy_vnode_label(struct label *src, struct label *dest)
1557f7b951a8SRobert Watson {
1558f7b951a8SRobert Watson 
1559f7b951a8SRobert Watson 	MAC_PERFORM(copy_vnode_label, src, dest);
156008bcdc58SRobert Watson }
156108bcdc58SRobert Watson 
156269bbb5b1SRobert Watson static int
1563f7b951a8SRobert Watson mac_check_structmac_consistent(struct mac *mac)
1564f7b951a8SRobert Watson {
1565f7b951a8SRobert Watson 
1566f7b951a8SRobert Watson 	if (mac->m_buflen > MAC_MAX_LABEL_BUF_LEN)
1567f7b951a8SRobert Watson 		return (EINVAL);
1568f7b951a8SRobert Watson 
1569f7b951a8SRobert Watson 	return (0);
1570f7b951a8SRobert Watson }
1571f7b951a8SRobert Watson 
1572f7b951a8SRobert Watson static int
1573f7b951a8SRobert Watson mac_externalize_cred_label(struct label *label, char *elements,
1574f7b951a8SRobert Watson     char *outbuf, size_t outbuflen, int flags)
157569bbb5b1SRobert Watson {
157669bbb5b1SRobert Watson 	int error;
157769bbb5b1SRobert Watson 
1578f7b951a8SRobert Watson 	MAC_EXTERNALIZE(cred_label, label, elements, outbuf, outbuflen);
157969bbb5b1SRobert Watson 
158069bbb5b1SRobert Watson 	return (error);
158169bbb5b1SRobert Watson }
158269bbb5b1SRobert Watson 
158369bbb5b1SRobert Watson static int
1584f7b951a8SRobert Watson mac_externalize_ifnet_label(struct label *label, char *elements,
1585f7b951a8SRobert Watson     char *outbuf, size_t outbuflen, int flags)
158669bbb5b1SRobert Watson {
158769bbb5b1SRobert Watson 	int error;
158869bbb5b1SRobert Watson 
1589f7b951a8SRobert Watson 	MAC_EXTERNALIZE(ifnet_label, label, elements, outbuf, outbuflen);
1590f7b951a8SRobert Watson 
1591f7b951a8SRobert Watson 	return (error);
1592f7b951a8SRobert Watson }
1593f7b951a8SRobert Watson 
1594f7b951a8SRobert Watson static int
1595f7b951a8SRobert Watson mac_externalize_pipe_label(struct label *label, char *elements,
1596f7b951a8SRobert Watson     char *outbuf, size_t outbuflen, int flags)
1597f7b951a8SRobert Watson {
1598f7b951a8SRobert Watson 	int error;
1599f7b951a8SRobert Watson 
1600f7b951a8SRobert Watson 	MAC_EXTERNALIZE(pipe_label, label, elements, outbuf, outbuflen);
1601f7b951a8SRobert Watson 
1602f7b951a8SRobert Watson 	return (error);
1603f7b951a8SRobert Watson }
1604f7b951a8SRobert Watson 
1605f7b951a8SRobert Watson static int
1606f7b951a8SRobert Watson mac_externalize_socket_label(struct label *label, char *elements,
1607f7b951a8SRobert Watson     char *outbuf, size_t outbuflen, int flags)
1608f7b951a8SRobert Watson {
1609f7b951a8SRobert Watson 	int error;
1610f7b951a8SRobert Watson 
1611f7b951a8SRobert Watson 	MAC_EXTERNALIZE(socket_label, label, elements, outbuf, outbuflen);
1612f7b951a8SRobert Watson 
1613f7b951a8SRobert Watson 	return (error);
1614f7b951a8SRobert Watson }
1615f7b951a8SRobert Watson 
1616f7b951a8SRobert Watson static int
1617f7b951a8SRobert Watson mac_externalize_socket_peer_label(struct label *label, char *elements,
1618f7b951a8SRobert Watson     char *outbuf, size_t outbuflen, int flags)
1619f7b951a8SRobert Watson {
1620f7b951a8SRobert Watson 	int error;
1621f7b951a8SRobert Watson 
1622f7b951a8SRobert Watson 	MAC_EXTERNALIZE(socket_peer_label, label, elements, outbuf, outbuflen);
1623f7b951a8SRobert Watson 
1624f7b951a8SRobert Watson 	return (error);
1625f7b951a8SRobert Watson }
1626f7b951a8SRobert Watson 
1627f7b951a8SRobert Watson static int
1628f7b951a8SRobert Watson mac_externalize_vnode_label(struct label *label, char *elements,
1629f7b951a8SRobert Watson     char *outbuf, size_t outbuflen, int flags)
1630f7b951a8SRobert Watson {
1631f7b951a8SRobert Watson 	int error;
1632f7b951a8SRobert Watson 
1633f7b951a8SRobert Watson 	MAC_EXTERNALIZE(vnode_label, label, elements, outbuf, outbuflen);
1634f7b951a8SRobert Watson 
1635f7b951a8SRobert Watson 	return (error);
1636f7b951a8SRobert Watson }
1637f7b951a8SRobert Watson 
1638f7b951a8SRobert Watson static int
1639f7b951a8SRobert Watson mac_externalize_vnode_oldmac(struct label *label, struct oldmac *extmac)
1640f7b951a8SRobert Watson {
1641f7b951a8SRobert Watson 	int error;
1642f7b951a8SRobert Watson 
1643f7b951a8SRobert Watson 	MAC_CHECK(externalize_vnode_oldmac, label, extmac);
1644f7b951a8SRobert Watson 
1645f7b951a8SRobert Watson 	return (error);
1646f7b951a8SRobert Watson }
1647f7b951a8SRobert Watson 
1648f7b951a8SRobert Watson static int
1649f7b951a8SRobert Watson mac_internalize_cred_label(struct label *label, char *string)
1650f7b951a8SRobert Watson {
1651f7b951a8SRobert Watson 	int error;
1652f7b951a8SRobert Watson 
1653f7b951a8SRobert Watson 	MAC_INTERNALIZE(cred_label, label, string);
1654f7b951a8SRobert Watson 
1655f7b951a8SRobert Watson 	return (error);
1656f7b951a8SRobert Watson }
1657f7b951a8SRobert Watson 
1658f7b951a8SRobert Watson static int
1659f7b951a8SRobert Watson mac_internalize_ifnet_label(struct label *label, char *string)
1660f7b951a8SRobert Watson {
1661f7b951a8SRobert Watson 	int error;
1662f7b951a8SRobert Watson 
1663f7b951a8SRobert Watson 	MAC_INTERNALIZE(ifnet_label, label, string);
1664f7b951a8SRobert Watson 
1665f7b951a8SRobert Watson 	return (error);
1666f7b951a8SRobert Watson }
1667f7b951a8SRobert Watson 
1668f7b951a8SRobert Watson static int
1669f7b951a8SRobert Watson mac_internalize_pipe_label(struct label *label, char *string)
1670f7b951a8SRobert Watson {
1671f7b951a8SRobert Watson 	int error;
1672f7b951a8SRobert Watson 
1673f7b951a8SRobert Watson 	MAC_INTERNALIZE(pipe_label, label, string);
1674f7b951a8SRobert Watson 
1675f7b951a8SRobert Watson 	return (error);
1676f7b951a8SRobert Watson }
1677f7b951a8SRobert Watson 
1678f7b951a8SRobert Watson static int
1679f7b951a8SRobert Watson mac_internalize_socket_label(struct label *label, char *string)
1680f7b951a8SRobert Watson {
1681f7b951a8SRobert Watson 	int error;
1682f7b951a8SRobert Watson 
1683f7b951a8SRobert Watson 	MAC_INTERNALIZE(socket_label, label, string);
1684f7b951a8SRobert Watson 
1685f7b951a8SRobert Watson 	return (error);
1686f7b951a8SRobert Watson }
1687f7b951a8SRobert Watson 
1688f7b951a8SRobert Watson static int
1689f7b951a8SRobert Watson mac_internalize_vnode_label(struct label *label, char *string)
1690f7b951a8SRobert Watson {
1691f7b951a8SRobert Watson 	int error;
1692f7b951a8SRobert Watson 
1693f7b951a8SRobert Watson 	MAC_INTERNALIZE(vnode_label, label, string);
169469bbb5b1SRobert Watson 
169569bbb5b1SRobert Watson 	return (error);
169669bbb5b1SRobert Watson }
169769bbb5b1SRobert Watson 
169869bbb5b1SRobert Watson /*
169969bbb5b1SRobert Watson  * Initialize MAC label for the first kernel process, from which other
170069bbb5b1SRobert Watson  * kernel processes and threads are spawned.
170169bbb5b1SRobert Watson  */
170269bbb5b1SRobert Watson void
170369bbb5b1SRobert Watson mac_create_proc0(struct ucred *cred)
170469bbb5b1SRobert Watson {
170569bbb5b1SRobert Watson 
170669bbb5b1SRobert Watson 	MAC_PERFORM(create_proc0, cred);
170769bbb5b1SRobert Watson }
170869bbb5b1SRobert Watson 
170969bbb5b1SRobert Watson /*
171069bbb5b1SRobert Watson  * Initialize MAC label for the first userland process, from which other
171169bbb5b1SRobert Watson  * userland processes and threads are spawned.
171269bbb5b1SRobert Watson  */
171369bbb5b1SRobert Watson void
171469bbb5b1SRobert Watson mac_create_proc1(struct ucred *cred)
171569bbb5b1SRobert Watson {
171669bbb5b1SRobert Watson 
171769bbb5b1SRobert Watson 	MAC_PERFORM(create_proc1, cred);
171869bbb5b1SRobert Watson }
171969bbb5b1SRobert Watson 
172069bbb5b1SRobert Watson void
172169bbb5b1SRobert Watson mac_thread_userret(struct thread *td)
172269bbb5b1SRobert Watson {
172369bbb5b1SRobert Watson 
172469bbb5b1SRobert Watson 	MAC_PERFORM(thread_userret, td);
172569bbb5b1SRobert Watson }
172669bbb5b1SRobert Watson 
172769bbb5b1SRobert Watson /*
172869bbb5b1SRobert Watson  * When a new process is created, its label must be initialized.  Generally,
172969bbb5b1SRobert Watson  * this involves inheritence from the parent process, modulo possible
173069bbb5b1SRobert Watson  * deltas.  This function allows that processing to take place.
173169bbb5b1SRobert Watson  */
173269bbb5b1SRobert Watson void
173369bbb5b1SRobert Watson mac_create_cred(struct ucred *parent_cred, struct ucred *child_cred)
173469bbb5b1SRobert Watson {
173569bbb5b1SRobert Watson 
173669bbb5b1SRobert Watson 	MAC_PERFORM(create_cred, parent_cred, child_cred);
173769bbb5b1SRobert Watson }
173869bbb5b1SRobert Watson 
173995fab37eSRobert Watson void
174095fab37eSRobert Watson mac_update_devfsdirent(struct devfs_dirent *de, struct vnode *vp)
174195fab37eSRobert Watson {
174295fab37eSRobert Watson 
174395fab37eSRobert Watson 	MAC_PERFORM(update_devfsdirent, de, &de->de_label, vp, &vp->v_label);
174495fab37eSRobert Watson }
174595fab37eSRobert Watson 
174695fab37eSRobert Watson void
174795fab37eSRobert Watson mac_update_procfsvnode(struct vnode *vp, struct ucred *cred)
174895fab37eSRobert Watson {
174995fab37eSRobert Watson 
175095fab37eSRobert Watson 	MAC_PERFORM(update_procfsvnode, vp, &vp->v_label, cred);
175195fab37eSRobert Watson }
175295fab37eSRobert Watson 
175395fab37eSRobert Watson /*
175495fab37eSRobert Watson  * Support callout for policies that manage their own externalization
175595fab37eSRobert Watson  * using extended attributes.
175695fab37eSRobert Watson  */
175795fab37eSRobert Watson static int
175895fab37eSRobert Watson mac_update_vnode_from_extattr(struct vnode *vp, struct mount *mp)
175995fab37eSRobert Watson {
176095fab37eSRobert Watson 	int error;
176195fab37eSRobert Watson 
176295fab37eSRobert Watson 	MAC_CHECK(update_vnode_from_extattr, vp, &vp->v_label, mp,
176395fab37eSRobert Watson 	    &mp->mnt_fslabel);
176495fab37eSRobert Watson 
176595fab37eSRobert Watson 	return (error);
176695fab37eSRobert Watson }
176795fab37eSRobert Watson 
176895fab37eSRobert Watson /*
176995fab37eSRobert Watson  * Given an externalized mac label, internalize it and stamp it on a
177095fab37eSRobert Watson  * vnode.
177195fab37eSRobert Watson  */
177295fab37eSRobert Watson static int
1773f7b951a8SRobert Watson mac_update_vnode_from_externalized(struct vnode *vp, struct oldmac *extmac)
177495fab37eSRobert Watson {
177595fab37eSRobert Watson 	int error;
177695fab37eSRobert Watson 
177795fab37eSRobert Watson 	MAC_CHECK(update_vnode_from_externalized, vp, &vp->v_label, extmac);
177895fab37eSRobert Watson 
177995fab37eSRobert Watson 	return (error);
178095fab37eSRobert Watson }
178195fab37eSRobert Watson 
178295fab37eSRobert Watson /*
178395fab37eSRobert Watson  * Call out to individual policies to update the label in a vnode from
178495fab37eSRobert Watson  * the mountpoint.
178595fab37eSRobert Watson  */
178695fab37eSRobert Watson void
178795fab37eSRobert Watson mac_update_vnode_from_mount(struct vnode *vp, struct mount *mp)
178895fab37eSRobert Watson {
178995fab37eSRobert Watson 
179095fab37eSRobert Watson 	MAC_PERFORM(update_vnode_from_mount, vp, &vp->v_label, mp,
179195fab37eSRobert Watson 	    &mp->mnt_fslabel);
179295fab37eSRobert Watson 
1793e6e370a7SJeff Roberson 	ASSERT_VOP_LOCKED(vp, "mac_update_vnode_from_mount");
179495fab37eSRobert Watson 	if (mac_cache_fslabel_in_vnode)
1795e6e370a7SJeff Roberson 		vp->v_vflag |= VV_CACHEDLABEL;
179695fab37eSRobert Watson }
179795fab37eSRobert Watson 
179895fab37eSRobert Watson /*
179995fab37eSRobert Watson  * Implementation of VOP_REFRESHLABEL() that relies on extended attributes
180095fab37eSRobert Watson  * to store label data.  Can be referenced by filesystems supporting
180195fab37eSRobert Watson  * extended attributes.
180295fab37eSRobert Watson  */
180395fab37eSRobert Watson int
180495fab37eSRobert Watson vop_stdrefreshlabel_ea(struct vop_refreshlabel_args *ap)
180595fab37eSRobert Watson {
180695fab37eSRobert Watson 	struct vnode *vp = ap->a_vp;
1807f7b951a8SRobert Watson 	struct oldmac extmac;
180895fab37eSRobert Watson 	int buflen, error;
180995fab37eSRobert Watson 
181095fab37eSRobert Watson 	ASSERT_VOP_LOCKED(vp, "vop_stdrefreshlabel_ea");
181195fab37eSRobert Watson 
181295fab37eSRobert Watson 	/*
181395fab37eSRobert Watson 	 * Call out to external policies first.  Order doesn't really
181495fab37eSRobert Watson 	 * matter, as long as failure of one assures failure of all.
181595fab37eSRobert Watson 	 */
181695fab37eSRobert Watson 	error = mac_update_vnode_from_extattr(vp, vp->v_mount);
181795fab37eSRobert Watson 	if (error)
181895fab37eSRobert Watson 		return (error);
181995fab37eSRobert Watson 
182095fab37eSRobert Watson 	buflen = sizeof(extmac);
182195fab37eSRobert Watson 	error = vn_extattr_get(vp, IO_NODELOCKED,
182295fab37eSRobert Watson 	    FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME, &buflen,
182395fab37eSRobert Watson 	    (char *)&extmac, curthread);
182495fab37eSRobert Watson 	switch (error) {
182595fab37eSRobert Watson 	case 0:
182695fab37eSRobert Watson 		/* Got it */
182795fab37eSRobert Watson 		break;
182895fab37eSRobert Watson 
182995fab37eSRobert Watson 	case ENOATTR:
183095fab37eSRobert Watson 		/*
183195fab37eSRobert Watson 		 * Use the label from the mount point.
183295fab37eSRobert Watson 		 */
183395fab37eSRobert Watson 		mac_update_vnode_from_mount(vp, vp->v_mount);
183495fab37eSRobert Watson 		return (0);
183595fab37eSRobert Watson 
183695fab37eSRobert Watson 	case EOPNOTSUPP:
183795fab37eSRobert Watson 	default:
183895fab37eSRobert Watson 		/* Fail horribly. */
183995fab37eSRobert Watson 		return (error);
184095fab37eSRobert Watson 	}
184195fab37eSRobert Watson 
184295fab37eSRobert Watson 	if (buflen != sizeof(extmac))
184395fab37eSRobert Watson 		error = EPERM;		/* Fail very closed. */
184495fab37eSRobert Watson 	if (error == 0)
184595fab37eSRobert Watson 		error = mac_update_vnode_from_externalized(vp, &extmac);
184695fab37eSRobert Watson 	if (error == 0)
1847e6e370a7SJeff Roberson 		vp->v_vflag |= VV_CACHEDLABEL;
184895fab37eSRobert Watson 	else {
184995fab37eSRobert Watson 		struct vattr va;
185095fab37eSRobert Watson 
185195fab37eSRobert Watson 		printf("Corrupted label on %s",
185295fab37eSRobert Watson 		    vp->v_mount->mnt_stat.f_mntonname);
185395fab37eSRobert Watson 		if (VOP_GETATTR(vp, &va, curthread->td_ucred, curthread) == 0)
185495fab37eSRobert Watson 			printf(" inum %ld", va.va_fileid);
18556be0c25eSRobert Watson #ifdef MAC_DEBUG
185695fab37eSRobert Watson 		if (mac_debug_label_fallback) {
185795fab37eSRobert Watson 			printf(", falling back.\n");
185895fab37eSRobert Watson 			mac_update_vnode_from_mount(vp, vp->v_mount);
185995fab37eSRobert Watson 			error = 0;
186095fab37eSRobert Watson 		} else {
18616be0c25eSRobert Watson #endif
186295fab37eSRobert Watson 			printf(".\n");
186395fab37eSRobert Watson 			error = EPERM;
18646be0c25eSRobert Watson #ifdef MAC_DEBUG
186595fab37eSRobert Watson 		}
18666be0c25eSRobert Watson #endif
186795fab37eSRobert Watson 	}
186895fab37eSRobert Watson 
186995fab37eSRobert Watson 	return (error);
187095fab37eSRobert Watson }
187195fab37eSRobert Watson 
187295fab37eSRobert Watson /*
187395fab37eSRobert Watson  * Make sure the vnode label is up-to-date.  If EOPNOTSUPP, then we handle
187495fab37eSRobert Watson  * the labeling activity outselves.  Filesystems should be careful not
187595fab37eSRobert Watson  * to change their minds regarding whether they support vop_refreshlabel()
187695fab37eSRobert Watson  * for a vnode or not.  Don't cache the vnode here, allow the file
187795fab37eSRobert Watson  * system code to determine if it's safe to cache.  If we update from
187895fab37eSRobert Watson  * the mount, don't cache since a change to the mount label should affect
187995fab37eSRobert Watson  * all vnodes.
188095fab37eSRobert Watson  */
188195fab37eSRobert Watson static int
188295fab37eSRobert Watson vn_refreshlabel(struct vnode *vp, struct ucred *cred)
188395fab37eSRobert Watson {
188495fab37eSRobert Watson 	int error;
188595fab37eSRobert Watson 
188695fab37eSRobert Watson 	ASSERT_VOP_LOCKED(vp, "vn_refreshlabel");
188795fab37eSRobert Watson 
188895fab37eSRobert Watson 	if (vp->v_mount == NULL) {
188995fab37eSRobert Watson /*
189095fab37eSRobert Watson 		Eventually, we probably want to special-case refreshing
189195fab37eSRobert Watson 		of deadfs vnodes, and if there's a lock-free race somewhere,
189295fab37eSRobert Watson 		that case might be handled here.
189395fab37eSRobert Watson 
189495fab37eSRobert Watson 		mac_update_vnode_deadfs(vp);
189595fab37eSRobert Watson 		return (0);
189695fab37eSRobert Watson  */
189795fab37eSRobert Watson 		/* printf("vn_refreshlabel: null v_mount\n"); */
189806be2aaaSNate Lawson 		if (vp->v_type != VNON)
189995fab37eSRobert Watson 			printf(
190006be2aaaSNate Lawson 			    "vn_refreshlabel: null v_mount with non-VNON\n");
190195fab37eSRobert Watson 		return (EBADF);
190295fab37eSRobert Watson 	}
190395fab37eSRobert Watson 
1904e6e370a7SJeff Roberson 	if (vp->v_vflag & VV_CACHEDLABEL) {
190595fab37eSRobert Watson 		mac_vnode_label_cache_hits++;
190695fab37eSRobert Watson 		return (0);
190795fab37eSRobert Watson 	} else
190895fab37eSRobert Watson 		mac_vnode_label_cache_misses++;
190995fab37eSRobert Watson 
191095fab37eSRobert Watson 	if ((vp->v_mount->mnt_flag & MNT_MULTILABEL) == 0) {
191195fab37eSRobert Watson 		mac_update_vnode_from_mount(vp, vp->v_mount);
191295fab37eSRobert Watson 		return (0);
191395fab37eSRobert Watson 	}
191495fab37eSRobert Watson 
191595fab37eSRobert Watson 	error = VOP_REFRESHLABEL(vp, cred, curthread);
191695fab37eSRobert Watson 	switch (error) {
191795fab37eSRobert Watson 	case EOPNOTSUPP:
191895fab37eSRobert Watson 		/*
191995fab37eSRobert Watson 		 * If labels are not supported on this vnode, fall back to
192095fab37eSRobert Watson 		 * the label in the mount and propagate it to the vnode.
192195fab37eSRobert Watson 		 * There should probably be some sort of policy/flag/decision
192295fab37eSRobert Watson 		 * about doing this.
192395fab37eSRobert Watson 		 */
192495fab37eSRobert Watson 		mac_update_vnode_from_mount(vp, vp->v_mount);
192595fab37eSRobert Watson 		error = 0;
192695fab37eSRobert Watson 	default:
192795fab37eSRobert Watson 		return (error);
192895fab37eSRobert Watson 	}
192995fab37eSRobert Watson }
193095fab37eSRobert Watson 
193195fab37eSRobert Watson /*
193295fab37eSRobert Watson  * Helper function for file systems using the vop_std*_ea() calls.  This
193395fab37eSRobert Watson  * function must be called after EA service is available for the vnode,
193495fab37eSRobert Watson  * but before it's hooked up to the namespace so that the node persists
193595fab37eSRobert Watson  * if there's a crash, or before it can be accessed.  On successful
193695fab37eSRobert Watson  * commit of the label to disk (etc), do cache the label.
193795fab37eSRobert Watson  */
193895fab37eSRobert Watson int
193995fab37eSRobert Watson vop_stdcreatevnode_ea(struct vnode *dvp, struct vnode *tvp, struct ucred *cred)
194095fab37eSRobert Watson {
1941f7b951a8SRobert Watson 	struct oldmac extmac;
194295fab37eSRobert Watson 	int error;
194395fab37eSRobert Watson 
1944e6e370a7SJeff Roberson 	ASSERT_VOP_LOCKED(tvp, "vop_stdcreatevnode_ea");
194595fab37eSRobert Watson 	if ((dvp->v_mount->mnt_flag & MNT_MULTILABEL) == 0) {
194695fab37eSRobert Watson 		mac_update_vnode_from_mount(tvp, tvp->v_mount);
194795fab37eSRobert Watson 	} else {
194895fab37eSRobert Watson 		error = vn_refreshlabel(dvp, cred);
194995fab37eSRobert Watson 		if (error)
195095fab37eSRobert Watson 			return (error);
195195fab37eSRobert Watson 
195295fab37eSRobert Watson 		/*
195395fab37eSRobert Watson 		 * Stick the label in the vnode.  Then try to write to
195495fab37eSRobert Watson 		 * disk.  If we fail, return a failure to abort the
195595fab37eSRobert Watson 		 * create operation.  Really, this failure shouldn't
195695fab37eSRobert Watson 		 * happen except in fairly unusual circumstances (out
195795fab37eSRobert Watson 		 * of disk, etc).
195895fab37eSRobert Watson 		 */
195995fab37eSRobert Watson 		mac_create_vnode(cred, dvp, tvp);
196095fab37eSRobert Watson 
196195fab37eSRobert Watson 		error = mac_stdcreatevnode_ea(tvp);
196295fab37eSRobert Watson 		if (error)
196395fab37eSRobert Watson 			return (error);
196495fab37eSRobert Watson 
196595fab37eSRobert Watson 		/*
196695fab37eSRobert Watson 		 * XXX: Eventually this will go away and all policies will
196795fab37eSRobert Watson 		 * directly manage their extended attributes.
196895fab37eSRobert Watson 		 */
1969f7b951a8SRobert Watson 		error = mac_externalize_vnode_oldmac(&tvp->v_label, &extmac);
197095fab37eSRobert Watson 		if (error)
197195fab37eSRobert Watson 			return (error);
197295fab37eSRobert Watson 
197395fab37eSRobert Watson 		error = vn_extattr_set(tvp, IO_NODELOCKED,
197495fab37eSRobert Watson 		    FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME,
197595fab37eSRobert Watson 		    sizeof(extmac), (char *)&extmac, curthread);
197695fab37eSRobert Watson 		if (error == 0)
1977e6e370a7SJeff Roberson 			tvp->v_vflag |= VV_CACHEDLABEL;
197895fab37eSRobert Watson 		else {
197995fab37eSRobert Watson #if 0
198095fab37eSRobert Watson 			/*
198195fab37eSRobert Watson 			 * In theory, we could have fall-back behavior here.
198295fab37eSRobert Watson 			 * It would probably be incorrect.
198395fab37eSRobert Watson 			 */
198495fab37eSRobert Watson #endif
198595fab37eSRobert Watson 			return (error);
198695fab37eSRobert Watson 		}
198795fab37eSRobert Watson 	}
198895fab37eSRobert Watson 
198995fab37eSRobert Watson 	return (0);
199095fab37eSRobert Watson }
199195fab37eSRobert Watson 
199295fab37eSRobert Watson void
199395fab37eSRobert Watson mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp)
199495fab37eSRobert Watson {
199595fab37eSRobert Watson 	int error;
199695fab37eSRobert Watson 
199795fab37eSRobert Watson 	ASSERT_VOP_LOCKED(vp, "mac_execve_transition");
199895fab37eSRobert Watson 
199995fab37eSRobert Watson 	error = vn_refreshlabel(vp, old);
200095fab37eSRobert Watson 	if (error) {
200195fab37eSRobert Watson 		printf("mac_execve_transition: vn_refreshlabel returned %d\n",
200295fab37eSRobert Watson 		    error);
200395fab37eSRobert Watson 		printf("mac_execve_transition: using old vnode label\n");
200495fab37eSRobert Watson 	}
200595fab37eSRobert Watson 
200695fab37eSRobert Watson 	MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label);
200795fab37eSRobert Watson }
200895fab37eSRobert Watson 
200995fab37eSRobert Watson int
201095fab37eSRobert Watson mac_execve_will_transition(struct ucred *old, struct vnode *vp)
201195fab37eSRobert Watson {
201295fab37eSRobert Watson 	int error, result;
201395fab37eSRobert Watson 
201495fab37eSRobert Watson 	error = vn_refreshlabel(vp, old);
201595fab37eSRobert Watson 	if (error)
201695fab37eSRobert Watson 		return (error);
201795fab37eSRobert Watson 
201895fab37eSRobert Watson 	result = 0;
201995fab37eSRobert Watson 	MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label);
202095fab37eSRobert Watson 
202195fab37eSRobert Watson 	return (result);
202295fab37eSRobert Watson }
202395fab37eSRobert Watson 
202495fab37eSRobert Watson int
202595fab37eSRobert Watson mac_check_vnode_access(struct ucred *cred, struct vnode *vp, int flags)
202695fab37eSRobert Watson {
202795fab37eSRobert Watson 	int error;
202895fab37eSRobert Watson 
202995fab37eSRobert Watson 	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_access");
203095fab37eSRobert Watson 
203195fab37eSRobert Watson 	if (!mac_enforce_fs)
203295fab37eSRobert Watson 		return (0);
203395fab37eSRobert Watson 
203495fab37eSRobert Watson 	error = vn_refreshlabel(vp, cred);
203595fab37eSRobert Watson 	if (error)
203695fab37eSRobert Watson 		return (error);
203795fab37eSRobert Watson 
203895fab37eSRobert Watson 	MAC_CHECK(check_vnode_access, cred, vp, &vp->v_label, flags);
203995fab37eSRobert Watson 	return (error);
204095fab37eSRobert Watson }
204195fab37eSRobert Watson 
204295fab37eSRobert Watson int
204395fab37eSRobert Watson mac_check_vnode_chdir(struct ucred *cred, struct vnode *dvp)
204495fab37eSRobert Watson {
204595fab37eSRobert Watson 	int error;
204695fab37eSRobert Watson 
204795fab37eSRobert Watson 	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_chdir");
204895fab37eSRobert Watson 
204995fab37eSRobert Watson 	if (!mac_enforce_fs)
205095fab37eSRobert Watson 		return (0);
205195fab37eSRobert Watson 
205295fab37eSRobert Watson 	error = vn_refreshlabel(dvp, cred);
205395fab37eSRobert Watson 	if (error)
205495fab37eSRobert Watson 		return (error);
205595fab37eSRobert Watson 
205695fab37eSRobert Watson 	MAC_CHECK(check_vnode_chdir, cred, dvp, &dvp->v_label);
205795fab37eSRobert Watson 	return (error);
205895fab37eSRobert Watson }
205995fab37eSRobert Watson 
206095fab37eSRobert Watson int
206195fab37eSRobert Watson mac_check_vnode_chroot(struct ucred *cred, struct vnode *dvp)
206295fab37eSRobert Watson {
206395fab37eSRobert Watson 	int error;
206495fab37eSRobert Watson 
206595fab37eSRobert Watson 	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_chroot");
206695fab37eSRobert Watson 
206795fab37eSRobert Watson 	if (!mac_enforce_fs)
206895fab37eSRobert Watson 		return (0);
206995fab37eSRobert Watson 
207095fab37eSRobert Watson 	error = vn_refreshlabel(dvp, cred);
207195fab37eSRobert Watson 	if (error)
207295fab37eSRobert Watson 		return (error);
207395fab37eSRobert Watson 
207495fab37eSRobert Watson 	MAC_CHECK(check_vnode_chroot, cred, dvp, &dvp->v_label);
207595fab37eSRobert Watson 	return (error);
207695fab37eSRobert Watson }
207795fab37eSRobert Watson 
207895fab37eSRobert Watson int
207995fab37eSRobert Watson mac_check_vnode_create(struct ucred *cred, struct vnode *dvp,
208095fab37eSRobert Watson     struct componentname *cnp, struct vattr *vap)
208195fab37eSRobert Watson {
208295fab37eSRobert Watson 	int error;
208395fab37eSRobert Watson 
208495fab37eSRobert Watson 	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_create");
208595fab37eSRobert Watson 
208695fab37eSRobert Watson 	if (!mac_enforce_fs)
208795fab37eSRobert Watson 		return (0);
208895fab37eSRobert Watson 
208995fab37eSRobert Watson 	error = vn_refreshlabel(dvp, cred);
209095fab37eSRobert Watson 	if (error)
209195fab37eSRobert Watson 		return (error);
209295fab37eSRobert Watson 
209395fab37eSRobert Watson 	MAC_CHECK(check_vnode_create, cred, dvp, &dvp->v_label, cnp, vap);
209495fab37eSRobert Watson 	return (error);
209595fab37eSRobert Watson }
209695fab37eSRobert Watson 
209795fab37eSRobert Watson int
209895fab37eSRobert Watson mac_check_vnode_delete(struct ucred *cred, struct vnode *dvp, struct vnode *vp,
209995fab37eSRobert Watson     struct componentname *cnp)
210095fab37eSRobert Watson {
210195fab37eSRobert Watson 	int error;
210295fab37eSRobert Watson 
210395fab37eSRobert Watson 	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_delete");
210495fab37eSRobert Watson 	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_delete");
210595fab37eSRobert Watson 
210695fab37eSRobert Watson 	if (!mac_enforce_fs)
210795fab37eSRobert Watson 		return (0);
210895fab37eSRobert Watson 
210995fab37eSRobert Watson 	error = vn_refreshlabel(dvp, cred);
211095fab37eSRobert Watson 	if (error)
211195fab37eSRobert Watson 		return (error);
211295fab37eSRobert Watson 	error = vn_refreshlabel(vp, cred);
211395fab37eSRobert Watson 	if (error)
211495fab37eSRobert Watson 		return (error);
211595fab37eSRobert Watson 
211695fab37eSRobert Watson 	MAC_CHECK(check_vnode_delete, cred, dvp, &dvp->v_label, vp,
211795fab37eSRobert Watson 	    &vp->v_label, cnp);
211895fab37eSRobert Watson 	return (error);
211995fab37eSRobert Watson }
212095fab37eSRobert Watson 
212195fab37eSRobert Watson int
212295fab37eSRobert Watson mac_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp,
212395fab37eSRobert Watson     acl_type_t type)
212495fab37eSRobert Watson {
212595fab37eSRobert Watson 	int error;
212695fab37eSRobert Watson 
212795fab37eSRobert Watson 	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_deleteacl");
212895fab37eSRobert Watson 
212995fab37eSRobert Watson 	if (!mac_enforce_fs)
213095fab37eSRobert Watson 		return (0);
213195fab37eSRobert Watson 
213295fab37eSRobert Watson 	error = vn_refreshlabel(vp, cred);
213395fab37eSRobert Watson 	if (error)
213495fab37eSRobert Watson 		return (error);
213595fab37eSRobert Watson 
213695fab37eSRobert Watson 	MAC_CHECK(check_vnode_deleteacl, cred, vp, &vp->v_label, type);
213795fab37eSRobert Watson 	return (error);
213895fab37eSRobert Watson }
213995fab37eSRobert Watson 
214095fab37eSRobert Watson int
214195fab37eSRobert Watson mac_check_vnode_exec(struct ucred *cred, struct vnode *vp)
214295fab37eSRobert Watson {
214395fab37eSRobert Watson 	int error;
214495fab37eSRobert Watson 
2145851704bbSRobert Watson 	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_exec");
2146851704bbSRobert Watson 
214795fab37eSRobert Watson 	if (!mac_enforce_process && !mac_enforce_fs)
214895fab37eSRobert Watson 		return (0);
214995fab37eSRobert Watson 
215095fab37eSRobert Watson 	error = vn_refreshlabel(vp, cred);
215195fab37eSRobert Watson 	if (error)
215295fab37eSRobert Watson 		return (error);
215395fab37eSRobert Watson 	MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label);
215495fab37eSRobert Watson 
215595fab37eSRobert Watson 	return (error);
215695fab37eSRobert Watson }
215795fab37eSRobert Watson 
215895fab37eSRobert Watson int
215995fab37eSRobert Watson mac_check_vnode_getacl(struct ucred *cred, struct vnode *vp, acl_type_t type)
216095fab37eSRobert Watson {
216195fab37eSRobert Watson 	int error;
216295fab37eSRobert Watson 
216395fab37eSRobert Watson 	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_getacl");
216495fab37eSRobert Watson 
216595fab37eSRobert Watson 	if (!mac_enforce_fs)
216695fab37eSRobert Watson 		return (0);
216795fab37eSRobert Watson 
216895fab37eSRobert Watson 	error = vn_refreshlabel(vp, cred);
216995fab37eSRobert Watson 	if (error)
217095fab37eSRobert Watson 		return (error);
217195fab37eSRobert Watson 
217295fab37eSRobert Watson 	MAC_CHECK(check_vnode_getacl, cred, vp, &vp->v_label, type);
217395fab37eSRobert Watson 	return (error);
217495fab37eSRobert Watson }
217595fab37eSRobert Watson 
217695fab37eSRobert Watson int
217795fab37eSRobert Watson mac_check_vnode_getextattr(struct ucred *cred, struct vnode *vp,
217895fab37eSRobert Watson     int attrnamespace, const char *name, struct uio *uio)
217995fab37eSRobert Watson {
218095fab37eSRobert Watson 	int error;
218195fab37eSRobert Watson 
218295fab37eSRobert Watson 	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_getextattr");
218395fab37eSRobert Watson 
218495fab37eSRobert Watson 	if (!mac_enforce_fs)
218595fab37eSRobert Watson 		return (0);
218695fab37eSRobert Watson 
218795fab37eSRobert Watson 	error = vn_refreshlabel(vp, cred);
218895fab37eSRobert Watson 	if (error)
218995fab37eSRobert Watson 		return (error);
219095fab37eSRobert Watson 
219195fab37eSRobert Watson 	MAC_CHECK(check_vnode_getextattr, cred, vp, &vp->v_label,
219295fab37eSRobert Watson 	    attrnamespace, name, uio);
219395fab37eSRobert Watson 	return (error);
219495fab37eSRobert Watson }
219595fab37eSRobert Watson 
219695fab37eSRobert Watson int
21970a694196SRobert Watson mac_check_vnode_link(struct ucred *cred, struct vnode *dvp,
21980a694196SRobert Watson     struct vnode *vp, struct componentname *cnp)
21990a694196SRobert Watson {
22000a694196SRobert Watson 	int error;
22010a694196SRobert Watson 
22020a694196SRobert Watson 	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_link");
22030a694196SRobert Watson 	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_link");
22040a694196SRobert Watson 
22050a694196SRobert Watson 	if (!mac_enforce_fs)
22060a694196SRobert Watson 		return (0);
22070a694196SRobert Watson 
22080a694196SRobert Watson 	error = vn_refreshlabel(dvp, cred);
22090a694196SRobert Watson 	if (error)
22100a694196SRobert Watson 		return (error);
22110a694196SRobert Watson 
22120a694196SRobert Watson 	error = vn_refreshlabel(vp, cred);
22130a694196SRobert Watson 	if (error)
22140a694196SRobert Watson 		return (error);
22150a694196SRobert Watson 
22160a694196SRobert Watson 	MAC_CHECK(check_vnode_link, cred, dvp, &dvp->v_label, vp,
22170a694196SRobert Watson 	    &vp->v_label, cnp);
22180a694196SRobert Watson 	return (error);
22190a694196SRobert Watson }
22200a694196SRobert Watson 
22210a694196SRobert Watson int
222295fab37eSRobert Watson mac_check_vnode_lookup(struct ucred *cred, struct vnode *dvp,
222395fab37eSRobert Watson     struct componentname *cnp)
222495fab37eSRobert Watson {
222595fab37eSRobert Watson 	int error;
222695fab37eSRobert Watson 
222795fab37eSRobert Watson 	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_lookup");
222895fab37eSRobert Watson 
222995fab37eSRobert Watson 	if (!mac_enforce_fs)
223095fab37eSRobert Watson 		return (0);
223195fab37eSRobert Watson 
223295fab37eSRobert Watson 	error = vn_refreshlabel(dvp, cred);
223395fab37eSRobert Watson 	if (error)
223495fab37eSRobert Watson 		return (error);
223595fab37eSRobert Watson 
223695fab37eSRobert Watson 	MAC_CHECK(check_vnode_lookup, cred, dvp, &dvp->v_label, cnp);
223795fab37eSRobert Watson 	return (error);
223895fab37eSRobert Watson }
223995fab37eSRobert Watson 
2240e183f80eSRobert Watson int
2241e183f80eSRobert Watson mac_check_vnode_mmap(struct ucred *cred, struct vnode *vp, int prot)
224295fab37eSRobert Watson {
2243e183f80eSRobert Watson 	int error;
224495fab37eSRobert Watson 
2245e183f80eSRobert Watson 	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_mmap");
2246ca7850c3SRobert Watson 
2247e183f80eSRobert Watson 	if (!mac_enforce_fs || !mac_enforce_vm)
2248e183f80eSRobert Watson 		return (0);
2249e183f80eSRobert Watson 
2250e183f80eSRobert Watson 	error = vn_refreshlabel(vp, cred);
2251e183f80eSRobert Watson 	if (error)
2252e183f80eSRobert Watson 		return (error);
2253e183f80eSRobert Watson 
2254e183f80eSRobert Watson 	MAC_CHECK(check_vnode_mmap, cred, vp, &vp->v_label, prot);
2255e183f80eSRobert Watson 	return (error);
2256e183f80eSRobert Watson }
2257e183f80eSRobert Watson 
2258e183f80eSRobert Watson void
2259e183f80eSRobert Watson mac_check_vnode_mmap_downgrade(struct ucred *cred, struct vnode *vp, int *prot)
2260e183f80eSRobert Watson {
2261e183f80eSRobert Watson 	int result = *prot;
2262e183f80eSRobert Watson 
2263e183f80eSRobert Watson 	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_mmap_downgrade");
2264e183f80eSRobert Watson 
2265e183f80eSRobert Watson 	if (!mac_enforce_fs || !mac_enforce_vm)
2266e183f80eSRobert Watson 		return;
2267e183f80eSRobert Watson 
2268e183f80eSRobert Watson 	MAC_PERFORM(check_vnode_mmap_downgrade, cred, vp, &vp->v_label,
2269e183f80eSRobert Watson 	    &result);
2270e183f80eSRobert Watson 
2271e183f80eSRobert Watson 	*prot = result;
2272e183f80eSRobert Watson }
2273e183f80eSRobert Watson 
2274e183f80eSRobert Watson int
2275e183f80eSRobert Watson mac_check_vnode_mprotect(struct ucred *cred, struct vnode *vp, int prot)
2276e183f80eSRobert Watson {
2277e183f80eSRobert Watson 	int error;
2278e183f80eSRobert Watson 
2279e183f80eSRobert Watson 	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_mprotect");
2280e183f80eSRobert Watson 
2281e183f80eSRobert Watson 	if (!mac_enforce_fs || !mac_enforce_vm)
2282e183f80eSRobert Watson 		return (0);
2283e183f80eSRobert Watson 
2284e183f80eSRobert Watson 	error = vn_refreshlabel(vp, cred);
2285e183f80eSRobert Watson 	if (error)
2286e183f80eSRobert Watson 		return (error);
2287e183f80eSRobert Watson 
2288e183f80eSRobert Watson 	MAC_CHECK(check_vnode_mprotect, cred, vp, &vp->v_label, prot);
2289e183f80eSRobert Watson 	return (error);
229095fab37eSRobert Watson }
229195fab37eSRobert Watson 
229295fab37eSRobert Watson int
229395fab37eSRobert Watson mac_check_vnode_open(struct ucred *cred, struct vnode *vp, mode_t acc_mode)
229495fab37eSRobert Watson {
229595fab37eSRobert Watson 	int error;
229695fab37eSRobert Watson 
229795fab37eSRobert Watson 	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_open");
229895fab37eSRobert Watson 
229995fab37eSRobert Watson 	if (!mac_enforce_fs)
230095fab37eSRobert Watson 		return (0);
230195fab37eSRobert Watson 
230295fab37eSRobert Watson 	error = vn_refreshlabel(vp, cred);
230395fab37eSRobert Watson 	if (error)
230495fab37eSRobert Watson 		return (error);
230595fab37eSRobert Watson 
230695fab37eSRobert Watson 	MAC_CHECK(check_vnode_open, cred, vp, &vp->v_label, acc_mode);
230795fab37eSRobert Watson 	return (error);
230895fab37eSRobert Watson }
230995fab37eSRobert Watson 
231095fab37eSRobert Watson int
2311177142e4SRobert Watson mac_check_vnode_poll(struct ucred *active_cred, struct ucred *file_cred,
2312177142e4SRobert Watson     struct vnode *vp)
23137f724f8bSRobert Watson {
23147f724f8bSRobert Watson 	int error;
23157f724f8bSRobert Watson 
23167f724f8bSRobert Watson 	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_poll");
23177f724f8bSRobert Watson 
23187f724f8bSRobert Watson 	if (!mac_enforce_fs)
23197f724f8bSRobert Watson 		return (0);
23207f724f8bSRobert Watson 
2321177142e4SRobert Watson 	error = vn_refreshlabel(vp, active_cred);
23227f724f8bSRobert Watson 	if (error)
23237f724f8bSRobert Watson 		return (error);
23247f724f8bSRobert Watson 
2325177142e4SRobert Watson 	MAC_CHECK(check_vnode_poll, active_cred, file_cred, vp,
2326177142e4SRobert Watson 	    &vp->v_label);
23277f724f8bSRobert Watson 
23287f724f8bSRobert Watson 	return (error);
23297f724f8bSRobert Watson }
23307f724f8bSRobert Watson 
23317f724f8bSRobert Watson int
2332177142e4SRobert Watson mac_check_vnode_read(struct ucred *active_cred, struct ucred *file_cred,
2333177142e4SRobert Watson     struct vnode *vp)
23347f724f8bSRobert Watson {
23357f724f8bSRobert Watson 	int error;
23367f724f8bSRobert Watson 
23377f724f8bSRobert Watson 	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_read");
23387f724f8bSRobert Watson 
23397f724f8bSRobert Watson 	if (!mac_enforce_fs)
23407f724f8bSRobert Watson 		return (0);
23417f724f8bSRobert Watson 
2342177142e4SRobert Watson 	error = vn_refreshlabel(vp, active_cred);
23437f724f8bSRobert Watson 	if (error)
23447f724f8bSRobert Watson 		return (error);
23457f724f8bSRobert Watson 
2346177142e4SRobert Watson 	MAC_CHECK(check_vnode_read, active_cred, file_cred, vp,
2347177142e4SRobert Watson 	    &vp->v_label);
23487f724f8bSRobert Watson 
23497f724f8bSRobert Watson 	return (error);
23507f724f8bSRobert Watson }
23517f724f8bSRobert Watson 
23527f724f8bSRobert Watson int
235395fab37eSRobert Watson mac_check_vnode_readdir(struct ucred *cred, struct vnode *dvp)
235495fab37eSRobert Watson {
235595fab37eSRobert Watson 	int error;
235695fab37eSRobert Watson 
235795fab37eSRobert Watson 	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_readdir");
235895fab37eSRobert Watson 
235995fab37eSRobert Watson 	if (!mac_enforce_fs)
236095fab37eSRobert Watson 		return (0);
236195fab37eSRobert Watson 
236295fab37eSRobert Watson 	error = vn_refreshlabel(dvp, cred);
236395fab37eSRobert Watson 	if (error)
236495fab37eSRobert Watson 		return (error);
236595fab37eSRobert Watson 
236695fab37eSRobert Watson 	MAC_CHECK(check_vnode_readdir, cred, dvp, &dvp->v_label);
236795fab37eSRobert Watson 	return (error);
236895fab37eSRobert Watson }
236995fab37eSRobert Watson 
237095fab37eSRobert Watson int
237195fab37eSRobert Watson mac_check_vnode_readlink(struct ucred *cred, struct vnode *vp)
237295fab37eSRobert Watson {
237395fab37eSRobert Watson 	int error;
237495fab37eSRobert Watson 
237595fab37eSRobert Watson 	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_readlink");
237695fab37eSRobert Watson 
237795fab37eSRobert Watson 	if (!mac_enforce_fs)
237895fab37eSRobert Watson 		return (0);
237995fab37eSRobert Watson 
238095fab37eSRobert Watson 	error = vn_refreshlabel(vp, cred);
238195fab37eSRobert Watson 	if (error)
238295fab37eSRobert Watson 		return (error);
238395fab37eSRobert Watson 
238495fab37eSRobert Watson 	MAC_CHECK(check_vnode_readlink, cred, vp, &vp->v_label);
238595fab37eSRobert Watson 	return (error);
238695fab37eSRobert Watson }
238795fab37eSRobert Watson 
238895fab37eSRobert Watson static int
238995fab37eSRobert Watson mac_check_vnode_relabel(struct ucred *cred, struct vnode *vp,
239095fab37eSRobert Watson     struct label *newlabel)
239195fab37eSRobert Watson {
239295fab37eSRobert Watson 	int error;
239395fab37eSRobert Watson 
239495fab37eSRobert Watson 	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_relabel");
239595fab37eSRobert Watson 
239695fab37eSRobert Watson 	error = vn_refreshlabel(vp, cred);
239795fab37eSRobert Watson 	if (error)
239895fab37eSRobert Watson 		return (error);
239995fab37eSRobert Watson 
240095fab37eSRobert Watson 	MAC_CHECK(check_vnode_relabel, cred, vp, &vp->v_label, newlabel);
240195fab37eSRobert Watson 
240295fab37eSRobert Watson 	return (error);
240395fab37eSRobert Watson }
240495fab37eSRobert Watson 
240595fab37eSRobert Watson int
240695fab37eSRobert Watson mac_check_vnode_rename_from(struct ucred *cred, struct vnode *dvp,
240795fab37eSRobert Watson     struct vnode *vp, struct componentname *cnp)
240895fab37eSRobert Watson {
240995fab37eSRobert Watson 	int error;
241095fab37eSRobert Watson 
241195fab37eSRobert Watson 	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_rename_from");
241295fab37eSRobert Watson 	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_rename_from");
241395fab37eSRobert Watson 
241495fab37eSRobert Watson 	if (!mac_enforce_fs)
241595fab37eSRobert Watson 		return (0);
241695fab37eSRobert Watson 
241795fab37eSRobert Watson 	error = vn_refreshlabel(dvp, cred);
241895fab37eSRobert Watson 	if (error)
241995fab37eSRobert Watson 		return (error);
242095fab37eSRobert Watson 	error = vn_refreshlabel(vp, cred);
242195fab37eSRobert Watson 	if (error)
242295fab37eSRobert Watson 		return (error);
242395fab37eSRobert Watson 
242495fab37eSRobert Watson 	MAC_CHECK(check_vnode_rename_from, cred, dvp, &dvp->v_label, vp,
242595fab37eSRobert Watson 	    &vp->v_label, cnp);
242695fab37eSRobert Watson 	return (error);
242795fab37eSRobert Watson }
242895fab37eSRobert Watson 
242995fab37eSRobert Watson int
243095fab37eSRobert Watson mac_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp,
243195fab37eSRobert Watson     struct vnode *vp, int samedir, struct componentname *cnp)
243295fab37eSRobert Watson {
243395fab37eSRobert Watson 	int error;
243495fab37eSRobert Watson 
243595fab37eSRobert Watson 	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_rename_to");
243695fab37eSRobert Watson 	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_rename_to");
243795fab37eSRobert Watson 
243895fab37eSRobert Watson 	if (!mac_enforce_fs)
243995fab37eSRobert Watson 		return (0);
244095fab37eSRobert Watson 
244195fab37eSRobert Watson 	error = vn_refreshlabel(dvp, cred);
244295fab37eSRobert Watson 	if (error)
244395fab37eSRobert Watson 		return (error);
244495fab37eSRobert Watson 	if (vp != NULL) {
244595fab37eSRobert Watson 		error = vn_refreshlabel(vp, cred);
244695fab37eSRobert Watson 		if (error)
244795fab37eSRobert Watson 			return (error);
244895fab37eSRobert Watson 	}
244995fab37eSRobert Watson 	MAC_CHECK(check_vnode_rename_to, cred, dvp, &dvp->v_label, vp,
245095fab37eSRobert Watson 	    vp != NULL ? &vp->v_label : NULL, samedir, cnp);
245195fab37eSRobert Watson 	return (error);
245295fab37eSRobert Watson }
245395fab37eSRobert Watson 
245495fab37eSRobert Watson int
245595fab37eSRobert Watson mac_check_vnode_revoke(struct ucred *cred, struct vnode *vp)
245695fab37eSRobert Watson {
245795fab37eSRobert Watson 	int error;
245895fab37eSRobert Watson 
245995fab37eSRobert Watson 	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_revoke");
246095fab37eSRobert Watson 
246195fab37eSRobert Watson 	if (!mac_enforce_fs)
246295fab37eSRobert Watson 		return (0);
246395fab37eSRobert Watson 
246495fab37eSRobert Watson 	error = vn_refreshlabel(vp, cred);
246595fab37eSRobert Watson 	if (error)
246695fab37eSRobert Watson 		return (error);
246795fab37eSRobert Watson 
246895fab37eSRobert Watson 	MAC_CHECK(check_vnode_revoke, cred, vp, &vp->v_label);
246995fab37eSRobert Watson 	return (error);
247095fab37eSRobert Watson }
247195fab37eSRobert Watson 
247295fab37eSRobert Watson int
247395fab37eSRobert Watson mac_check_vnode_setacl(struct ucred *cred, struct vnode *vp, acl_type_t type,
247495fab37eSRobert Watson     struct acl *acl)
247595fab37eSRobert Watson {
247695fab37eSRobert Watson 	int error;
247795fab37eSRobert Watson 
247895fab37eSRobert Watson 	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setacl");
247995fab37eSRobert Watson 
248095fab37eSRobert Watson 	if (!mac_enforce_fs)
248195fab37eSRobert Watson 		return (0);
248295fab37eSRobert Watson 
248395fab37eSRobert Watson 	error = vn_refreshlabel(vp, cred);
248495fab37eSRobert Watson 	if (error)
248595fab37eSRobert Watson 		return (error);
248695fab37eSRobert Watson 
248795fab37eSRobert Watson 	MAC_CHECK(check_vnode_setacl, cred, vp, &vp->v_label, type, acl);
248895fab37eSRobert Watson 	return (error);
248995fab37eSRobert Watson }
249095fab37eSRobert Watson 
249195fab37eSRobert Watson int
249295fab37eSRobert Watson mac_check_vnode_setextattr(struct ucred *cred, struct vnode *vp,
249395fab37eSRobert Watson     int attrnamespace, const char *name, struct uio *uio)
249495fab37eSRobert Watson {
249595fab37eSRobert Watson 	int error;
249695fab37eSRobert Watson 
249795fab37eSRobert Watson 	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setextattr");
249895fab37eSRobert Watson 
249995fab37eSRobert Watson 	if (!mac_enforce_fs)
250095fab37eSRobert Watson 		return (0);
250195fab37eSRobert Watson 
250295fab37eSRobert Watson 	error = vn_refreshlabel(vp, cred);
250395fab37eSRobert Watson 	if (error)
250495fab37eSRobert Watson 		return (error);
250595fab37eSRobert Watson 
250695fab37eSRobert Watson 	MAC_CHECK(check_vnode_setextattr, cred, vp, &vp->v_label,
250795fab37eSRobert Watson 	    attrnamespace, name, uio);
250895fab37eSRobert Watson 	return (error);
250995fab37eSRobert Watson }
251095fab37eSRobert Watson 
251195fab37eSRobert Watson int
251295fab37eSRobert Watson mac_check_vnode_setflags(struct ucred *cred, struct vnode *vp, u_long flags)
251395fab37eSRobert Watson {
251495fab37eSRobert Watson 	int error;
251595fab37eSRobert Watson 
251695fab37eSRobert Watson 	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setflags");
251795fab37eSRobert Watson 
251895fab37eSRobert Watson 	if (!mac_enforce_fs)
251995fab37eSRobert Watson 		return (0);
252095fab37eSRobert Watson 
252195fab37eSRobert Watson 	error = vn_refreshlabel(vp, cred);
252295fab37eSRobert Watson 	if (error)
252395fab37eSRobert Watson 		return (error);
252495fab37eSRobert Watson 
252595fab37eSRobert Watson 	MAC_CHECK(check_vnode_setflags, cred, vp, &vp->v_label, flags);
252695fab37eSRobert Watson 	return (error);
252795fab37eSRobert Watson }
252895fab37eSRobert Watson 
252995fab37eSRobert Watson int
253095fab37eSRobert Watson mac_check_vnode_setmode(struct ucred *cred, struct vnode *vp, mode_t mode)
253195fab37eSRobert Watson {
253295fab37eSRobert Watson 	int error;
253395fab37eSRobert Watson 
253495fab37eSRobert Watson 	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setmode");
253595fab37eSRobert Watson 
253695fab37eSRobert Watson 	if (!mac_enforce_fs)
253795fab37eSRobert Watson 		return (0);
253895fab37eSRobert Watson 
253995fab37eSRobert Watson 	error = vn_refreshlabel(vp, cred);
254095fab37eSRobert Watson 	if (error)
254195fab37eSRobert Watson 		return (error);
254295fab37eSRobert Watson 
254395fab37eSRobert Watson 	MAC_CHECK(check_vnode_setmode, cred, vp, &vp->v_label, mode);
254495fab37eSRobert Watson 	return (error);
254595fab37eSRobert Watson }
254695fab37eSRobert Watson 
254795fab37eSRobert Watson int
254895fab37eSRobert Watson mac_check_vnode_setowner(struct ucred *cred, struct vnode *vp, uid_t uid,
254995fab37eSRobert Watson     gid_t gid)
255095fab37eSRobert Watson {
255195fab37eSRobert Watson 	int error;
255295fab37eSRobert Watson 
255395fab37eSRobert Watson 	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setowner");
255495fab37eSRobert Watson 
255595fab37eSRobert Watson 	if (!mac_enforce_fs)
255695fab37eSRobert Watson 		return (0);
255795fab37eSRobert Watson 
255895fab37eSRobert Watson 	error = vn_refreshlabel(vp, cred);
255995fab37eSRobert Watson 	if (error)
256095fab37eSRobert Watson 		return (error);
256195fab37eSRobert Watson 
256295fab37eSRobert Watson 	MAC_CHECK(check_vnode_setowner, cred, vp, &vp->v_label, uid, gid);
256395fab37eSRobert Watson 	return (error);
256495fab37eSRobert Watson }
256595fab37eSRobert Watson 
256695fab37eSRobert Watson int
256795fab37eSRobert Watson mac_check_vnode_setutimes(struct ucred *cred, struct vnode *vp,
256895fab37eSRobert Watson     struct timespec atime, struct timespec mtime)
256995fab37eSRobert Watson {
257095fab37eSRobert Watson 	int error;
257195fab37eSRobert Watson 
257295fab37eSRobert Watson 	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setutimes");
257395fab37eSRobert Watson 
257495fab37eSRobert Watson 	if (!mac_enforce_fs)
257595fab37eSRobert Watson 		return (0);
257695fab37eSRobert Watson 
257795fab37eSRobert Watson 	error = vn_refreshlabel(vp, cred);
257895fab37eSRobert Watson 	if (error)
257995fab37eSRobert Watson 		return (error);
258095fab37eSRobert Watson 
258195fab37eSRobert Watson 	MAC_CHECK(check_vnode_setutimes, cred, vp, &vp->v_label, atime,
258295fab37eSRobert Watson 	    mtime);
258395fab37eSRobert Watson 	return (error);
258495fab37eSRobert Watson }
258595fab37eSRobert Watson 
258695fab37eSRobert Watson int
2587177142e4SRobert Watson mac_check_vnode_stat(struct ucred *active_cred, struct ucred *file_cred,
2588177142e4SRobert Watson     struct vnode *vp)
258995fab37eSRobert Watson {
259095fab37eSRobert Watson 	int error;
259195fab37eSRobert Watson 
259295fab37eSRobert Watson 	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_stat");
259395fab37eSRobert Watson 
259495fab37eSRobert Watson 	if (!mac_enforce_fs)
259595fab37eSRobert Watson 		return (0);
259695fab37eSRobert Watson 
2597177142e4SRobert Watson 	error = vn_refreshlabel(vp, active_cred);
259895fab37eSRobert Watson 	if (error)
259995fab37eSRobert Watson 		return (error);
260095fab37eSRobert Watson 
2601177142e4SRobert Watson 	MAC_CHECK(check_vnode_stat, active_cred, file_cred, vp,
2602177142e4SRobert Watson 	    &vp->v_label);
260395fab37eSRobert Watson 	return (error);
260495fab37eSRobert Watson }
260595fab37eSRobert Watson 
26067f724f8bSRobert Watson int
2607177142e4SRobert Watson mac_check_vnode_write(struct ucred *active_cred, struct ucred *file_cred,
2608177142e4SRobert Watson     struct vnode *vp)
26097f724f8bSRobert Watson {
26107f724f8bSRobert Watson 	int error;
26117f724f8bSRobert Watson 
26127f724f8bSRobert Watson 	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_write");
26137f724f8bSRobert Watson 
26147f724f8bSRobert Watson 	if (!mac_enforce_fs)
26157f724f8bSRobert Watson 		return (0);
26167f724f8bSRobert Watson 
2617177142e4SRobert Watson 	error = vn_refreshlabel(vp, active_cred);
26187f724f8bSRobert Watson 	if (error)
26197f724f8bSRobert Watson 		return (error);
26207f724f8bSRobert Watson 
2621177142e4SRobert Watson 	MAC_CHECK(check_vnode_write, active_cred, file_cred, vp,
2622177142e4SRobert Watson 	    &vp->v_label);
26237f724f8bSRobert Watson 
26247f724f8bSRobert Watson 	return (error);
26257f724f8bSRobert Watson }
26267f724f8bSRobert Watson 
262795fab37eSRobert Watson /*
262895fab37eSRobert Watson  * When relabeling a process, call out to the policies for the maximum
262995fab37eSRobert Watson  * permission allowed for each object type we know about in its
263095fab37eSRobert Watson  * memory space, and revoke access (in the least surprising ways we
263195fab37eSRobert Watson  * know) when necessary.  The process lock is not held here.
263295fab37eSRobert Watson  */
263395fab37eSRobert Watson static void
263495fab37eSRobert Watson mac_cred_mmapped_drop_perms(struct thread *td, struct ucred *cred)
263595fab37eSRobert Watson {
263695fab37eSRobert Watson 
263795fab37eSRobert Watson 	/* XXX freeze all other threads */
263895fab37eSRobert Watson 	mac_cred_mmapped_drop_perms_recurse(td, cred,
263995fab37eSRobert Watson 	    &td->td_proc->p_vmspace->vm_map);
264095fab37eSRobert Watson 	/* XXX allow other threads to continue */
264195fab37eSRobert Watson }
264295fab37eSRobert Watson 
264395fab37eSRobert Watson static __inline const char *
264495fab37eSRobert Watson prot2str(vm_prot_t prot)
264595fab37eSRobert Watson {
264695fab37eSRobert Watson 
264795fab37eSRobert Watson 	switch (prot & VM_PROT_ALL) {
264895fab37eSRobert Watson 	case VM_PROT_READ:
264995fab37eSRobert Watson 		return ("r--");
265095fab37eSRobert Watson 	case VM_PROT_READ | VM_PROT_WRITE:
265195fab37eSRobert Watson 		return ("rw-");
265295fab37eSRobert Watson 	case VM_PROT_READ | VM_PROT_EXECUTE:
265395fab37eSRobert Watson 		return ("r-x");
265495fab37eSRobert Watson 	case VM_PROT_READ | VM_PROT_WRITE | VM_PROT_EXECUTE:
265595fab37eSRobert Watson 		return ("rwx");
265695fab37eSRobert Watson 	case VM_PROT_WRITE:
265795fab37eSRobert Watson 		return ("-w-");
265895fab37eSRobert Watson 	case VM_PROT_EXECUTE:
265995fab37eSRobert Watson 		return ("--x");
266095fab37eSRobert Watson 	case VM_PROT_WRITE | VM_PROT_EXECUTE:
266195fab37eSRobert Watson 		return ("-wx");
266295fab37eSRobert Watson 	default:
266395fab37eSRobert Watson 		return ("---");
266495fab37eSRobert Watson 	}
266595fab37eSRobert Watson }
266695fab37eSRobert Watson 
266795fab37eSRobert Watson static void
266895fab37eSRobert Watson mac_cred_mmapped_drop_perms_recurse(struct thread *td, struct ucred *cred,
266995fab37eSRobert Watson     struct vm_map *map)
267095fab37eSRobert Watson {
267195fab37eSRobert Watson 	struct vm_map_entry *vme;
2672e183f80eSRobert Watson 	int result;
2673e183f80eSRobert Watson 	vm_prot_t revokeperms;
267495fab37eSRobert Watson 	vm_object_t object;
267595fab37eSRobert Watson 	vm_ooffset_t offset;
267695fab37eSRobert Watson 	struct vnode *vp;
267795fab37eSRobert Watson 
2678c0f39905SRobert Watson 	if (!mac_mmap_revocation)
2679c0f39905SRobert Watson 		return;
2680c0f39905SRobert Watson 
268195fab37eSRobert Watson 	vm_map_lock_read(map);
268295fab37eSRobert Watson 	for (vme = map->header.next; vme != &map->header; vme = vme->next) {
268395fab37eSRobert Watson 		if (vme->eflags & MAP_ENTRY_IS_SUB_MAP) {
268495fab37eSRobert Watson 			mac_cred_mmapped_drop_perms_recurse(td, cred,
268595fab37eSRobert Watson 			    vme->object.sub_map);
268695fab37eSRobert Watson 			continue;
268795fab37eSRobert Watson 		}
268895fab37eSRobert Watson 		/*
268995fab37eSRobert Watson 		 * Skip over entries that obviously are not shared.
269095fab37eSRobert Watson 		 */
269195fab37eSRobert Watson 		if (vme->eflags & (MAP_ENTRY_COW | MAP_ENTRY_NOSYNC) ||
269295fab37eSRobert Watson 		    !vme->max_protection)
269395fab37eSRobert Watson 			continue;
269495fab37eSRobert Watson 		/*
269595fab37eSRobert Watson 		 * Drill down to the deepest backing object.
269695fab37eSRobert Watson 		 */
269795fab37eSRobert Watson 		offset = vme->offset;
269895fab37eSRobert Watson 		object = vme->object.vm_object;
269995fab37eSRobert Watson 		if (object == NULL)
270095fab37eSRobert Watson 			continue;
270195fab37eSRobert Watson 		while (object->backing_object != NULL) {
270295fab37eSRobert Watson 			object = object->backing_object;
270395fab37eSRobert Watson 			offset += object->backing_object_offset;
270495fab37eSRobert Watson 		}
270595fab37eSRobert Watson 		/*
270695fab37eSRobert Watson 		 * At the moment, vm_maps and objects aren't considered
270795fab37eSRobert Watson 		 * by the MAC system, so only things with backing by a
270895fab37eSRobert Watson 		 * normal object (read: vnodes) are checked.
270995fab37eSRobert Watson 		 */
271095fab37eSRobert Watson 		if (object->type != OBJT_VNODE)
271195fab37eSRobert Watson 			continue;
271295fab37eSRobert Watson 		vp = (struct vnode *)object->handle;
271395fab37eSRobert Watson 		vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td);
2714e183f80eSRobert Watson 		result = vme->max_protection;
2715e183f80eSRobert Watson 		mac_check_vnode_mmap_downgrade(cred, vp, &result);
271695fab37eSRobert Watson 		VOP_UNLOCK(vp, 0, td);
271795fab37eSRobert Watson 		/*
271895fab37eSRobert Watson 		 * Find out what maximum protection we may be allowing
271995fab37eSRobert Watson 		 * now but a policy needs to get removed.
272095fab37eSRobert Watson 		 */
272195fab37eSRobert Watson 		revokeperms = vme->max_protection & ~result;
272295fab37eSRobert Watson 		if (!revokeperms)
272395fab37eSRobert Watson 			continue;
2724b656366bSBruce Evans 		printf("pid %ld: revoking %s perms from %#lx:%ld "
2725b656366bSBruce Evans 		    "(max %s/cur %s)\n", (long)td->td_proc->p_pid,
2726b656366bSBruce Evans 		    prot2str(revokeperms), (u_long)vme->start,
2727b656366bSBruce Evans 		    (long)(vme->end - vme->start),
272895fab37eSRobert Watson 		    prot2str(vme->max_protection), prot2str(vme->protection));
272995fab37eSRobert Watson 		vm_map_lock_upgrade(map);
273095fab37eSRobert Watson 		/*
273195fab37eSRobert Watson 		 * This is the really simple case: if a map has more
273295fab37eSRobert Watson 		 * max_protection than is allowed, but it's not being
273395fab37eSRobert Watson 		 * actually used (that is, the current protection is
273495fab37eSRobert Watson 		 * still allowed), we can just wipe it out and do
273595fab37eSRobert Watson 		 * nothing more.
273695fab37eSRobert Watson 		 */
273795fab37eSRobert Watson 		if ((vme->protection & revokeperms) == 0) {
273895fab37eSRobert Watson 			vme->max_protection -= revokeperms;
273995fab37eSRobert Watson 		} else {
274095fab37eSRobert Watson 			if (revokeperms & VM_PROT_WRITE) {
274195fab37eSRobert Watson 				/*
274295fab37eSRobert Watson 				 * In the more complicated case, flush out all
274395fab37eSRobert Watson 				 * pending changes to the object then turn it
274495fab37eSRobert Watson 				 * copy-on-write.
274595fab37eSRobert Watson 				 */
274695fab37eSRobert Watson 				vm_object_reference(object);
274795fab37eSRobert Watson 				vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td);
274895fab37eSRobert Watson 				vm_object_page_clean(object,
274995fab37eSRobert Watson 				    OFF_TO_IDX(offset),
275095fab37eSRobert Watson 				    OFF_TO_IDX(offset + vme->end - vme->start +
275195fab37eSRobert Watson 					PAGE_MASK),
275295fab37eSRobert Watson 				    OBJPC_SYNC);
275395fab37eSRobert Watson 				VOP_UNLOCK(vp, 0, td);
275495fab37eSRobert Watson 				vm_object_deallocate(object);
275595fab37eSRobert Watson 				/*
275695fab37eSRobert Watson 				 * Why bother if there's no read permissions
275795fab37eSRobert Watson 				 * anymore?  For the rest, we need to leave
275895fab37eSRobert Watson 				 * the write permissions on for COW, or
275995fab37eSRobert Watson 				 * remove them entirely if configured to.
276095fab37eSRobert Watson 				 */
276195fab37eSRobert Watson 				if (!mac_mmap_revocation_via_cow) {
276295fab37eSRobert Watson 					vme->max_protection &= ~VM_PROT_WRITE;
276395fab37eSRobert Watson 					vme->protection &= ~VM_PROT_WRITE;
276495fab37eSRobert Watson 				} if ((revokeperms & VM_PROT_READ) == 0)
276595fab37eSRobert Watson 					vme->eflags |= MAP_ENTRY_COW |
276695fab37eSRobert Watson 					    MAP_ENTRY_NEEDS_COPY;
276795fab37eSRobert Watson 			}
276895fab37eSRobert Watson 			if (revokeperms & VM_PROT_EXECUTE) {
276995fab37eSRobert Watson 				vme->max_protection &= ~VM_PROT_EXECUTE;
277095fab37eSRobert Watson 				vme->protection &= ~VM_PROT_EXECUTE;
277195fab37eSRobert Watson 			}
277295fab37eSRobert Watson 			if (revokeperms & VM_PROT_READ) {
277395fab37eSRobert Watson 				vme->max_protection = 0;
277495fab37eSRobert Watson 				vme->protection = 0;
277595fab37eSRobert Watson 			}
277695fab37eSRobert Watson 			pmap_protect(map->pmap, vme->start, vme->end,
277795fab37eSRobert Watson 			    vme->protection & ~revokeperms);
277895fab37eSRobert Watson 			vm_map_simplify_entry(map, vme);
277995fab37eSRobert Watson 		}
278095fab37eSRobert Watson 		vm_map_lock_downgrade(map);
278195fab37eSRobert Watson 	}
278295fab37eSRobert Watson 	vm_map_unlock_read(map);
278395fab37eSRobert Watson }
278495fab37eSRobert Watson 
278595fab37eSRobert Watson /*
278695fab37eSRobert Watson  * When the subject's label changes, it may require revocation of privilege
278795fab37eSRobert Watson  * to mapped objects.  This can't be done on-the-fly later with a unified
278895fab37eSRobert Watson  * buffer cache.
278995fab37eSRobert Watson  */
279095fab37eSRobert Watson static void
279195fab37eSRobert Watson mac_relabel_cred(struct ucred *cred, struct label *newlabel)
279295fab37eSRobert Watson {
279395fab37eSRobert Watson 
279495fab37eSRobert Watson 	MAC_PERFORM(relabel_cred, cred, newlabel);
279595fab37eSRobert Watson }
279695fab37eSRobert Watson 
279795fab37eSRobert Watson void
279895fab37eSRobert Watson mac_relabel_vnode(struct ucred *cred, struct vnode *vp, struct label *newlabel)
279995fab37eSRobert Watson {
280095fab37eSRobert Watson 
280195fab37eSRobert Watson 	MAC_PERFORM(relabel_vnode, cred, vp, &vp->v_label, newlabel);
280295fab37eSRobert Watson }
280395fab37eSRobert Watson 
280495fab37eSRobert Watson void
280595fab37eSRobert Watson mac_create_ifnet(struct ifnet *ifnet)
280695fab37eSRobert Watson {
280795fab37eSRobert Watson 
280895fab37eSRobert Watson 	MAC_PERFORM(create_ifnet, ifnet, &ifnet->if_label);
280995fab37eSRobert Watson }
281095fab37eSRobert Watson 
281195fab37eSRobert Watson void
281295fab37eSRobert Watson mac_create_bpfdesc(struct ucred *cred, struct bpf_d *bpf_d)
281395fab37eSRobert Watson {
281495fab37eSRobert Watson 
281595fab37eSRobert Watson 	MAC_PERFORM(create_bpfdesc, cred, bpf_d, &bpf_d->bd_label);
281695fab37eSRobert Watson }
281795fab37eSRobert Watson 
281895fab37eSRobert Watson void
281995fab37eSRobert Watson mac_create_socket(struct ucred *cred, struct socket *socket)
282095fab37eSRobert Watson {
282195fab37eSRobert Watson 
282295fab37eSRobert Watson 	MAC_PERFORM(create_socket, cred, socket, &socket->so_label);
282395fab37eSRobert Watson }
282495fab37eSRobert Watson 
282595fab37eSRobert Watson void
282695fab37eSRobert Watson mac_create_pipe(struct ucred *cred, struct pipe *pipe)
282795fab37eSRobert Watson {
282895fab37eSRobert Watson 
282995fab37eSRobert Watson 	MAC_PERFORM(create_pipe, cred, pipe, pipe->pipe_label);
283095fab37eSRobert Watson }
283195fab37eSRobert Watson 
283295fab37eSRobert Watson void
283395fab37eSRobert Watson mac_create_socket_from_socket(struct socket *oldsocket,
283495fab37eSRobert Watson     struct socket *newsocket)
283595fab37eSRobert Watson {
283695fab37eSRobert Watson 
283795fab37eSRobert Watson 	MAC_PERFORM(create_socket_from_socket, oldsocket, &oldsocket->so_label,
283895fab37eSRobert Watson 	    newsocket, &newsocket->so_label);
283995fab37eSRobert Watson }
284095fab37eSRobert Watson 
284195fab37eSRobert Watson static void
284295fab37eSRobert Watson mac_relabel_socket(struct ucred *cred, struct socket *socket,
284395fab37eSRobert Watson     struct label *newlabel)
284495fab37eSRobert Watson {
284595fab37eSRobert Watson 
284695fab37eSRobert Watson 	MAC_PERFORM(relabel_socket, cred, socket, &socket->so_label, newlabel);
284795fab37eSRobert Watson }
284895fab37eSRobert Watson 
284995fab37eSRobert Watson static void
285095fab37eSRobert Watson mac_relabel_pipe(struct ucred *cred, struct pipe *pipe, struct label *newlabel)
285195fab37eSRobert Watson {
285295fab37eSRobert Watson 
285395fab37eSRobert Watson 	MAC_PERFORM(relabel_pipe, cred, pipe, pipe->pipe_label, newlabel);
285495fab37eSRobert Watson }
285595fab37eSRobert Watson 
285695fab37eSRobert Watson void
285795fab37eSRobert Watson mac_set_socket_peer_from_mbuf(struct mbuf *mbuf, struct socket *socket)
285895fab37eSRobert Watson {
285995fab37eSRobert Watson 
286095fab37eSRobert Watson 	MAC_PERFORM(set_socket_peer_from_mbuf, mbuf, &mbuf->m_pkthdr.label,
286195fab37eSRobert Watson 	    socket, &socket->so_peerlabel);
286295fab37eSRobert Watson }
286395fab37eSRobert Watson 
286495fab37eSRobert Watson void
286595fab37eSRobert Watson mac_set_socket_peer_from_socket(struct socket *oldsocket,
286695fab37eSRobert Watson     struct socket *newsocket)
286795fab37eSRobert Watson {
286895fab37eSRobert Watson 
286995fab37eSRobert Watson 	MAC_PERFORM(set_socket_peer_from_socket, oldsocket,
287095fab37eSRobert Watson 	    &oldsocket->so_label, newsocket, &newsocket->so_peerlabel);
287195fab37eSRobert Watson }
287295fab37eSRobert Watson 
287395fab37eSRobert Watson void
287495fab37eSRobert Watson mac_create_datagram_from_ipq(struct ipq *ipq, struct mbuf *datagram)
287595fab37eSRobert Watson {
287695fab37eSRobert Watson 
287795fab37eSRobert Watson 	MAC_PERFORM(create_datagram_from_ipq, ipq, &ipq->ipq_label,
287895fab37eSRobert Watson 	    datagram, &datagram->m_pkthdr.label);
287995fab37eSRobert Watson }
288095fab37eSRobert Watson 
288195fab37eSRobert Watson void
288295fab37eSRobert Watson mac_create_fragment(struct mbuf *datagram, struct mbuf *fragment)
288395fab37eSRobert Watson {
288495fab37eSRobert Watson 
288595fab37eSRobert Watson 	MAC_PERFORM(create_fragment, datagram, &datagram->m_pkthdr.label,
288695fab37eSRobert Watson 	    fragment, &fragment->m_pkthdr.label);
288795fab37eSRobert Watson }
288895fab37eSRobert Watson 
288995fab37eSRobert Watson void
289095fab37eSRobert Watson mac_create_ipq(struct mbuf *fragment, struct ipq *ipq)
289195fab37eSRobert Watson {
289295fab37eSRobert Watson 
289395fab37eSRobert Watson 	MAC_PERFORM(create_ipq, fragment, &fragment->m_pkthdr.label, ipq,
289495fab37eSRobert Watson 	    &ipq->ipq_label);
289595fab37eSRobert Watson }
289695fab37eSRobert Watson 
289795fab37eSRobert Watson void
289895fab37eSRobert Watson mac_create_mbuf_from_mbuf(struct mbuf *oldmbuf, struct mbuf *newmbuf)
289995fab37eSRobert Watson {
290095fab37eSRobert Watson 
290195fab37eSRobert Watson 	MAC_PERFORM(create_mbuf_from_mbuf, oldmbuf, &oldmbuf->m_pkthdr.label,
290295fab37eSRobert Watson 	    newmbuf, &newmbuf->m_pkthdr.label);
290395fab37eSRobert Watson }
290495fab37eSRobert Watson 
290595fab37eSRobert Watson void
290695fab37eSRobert Watson mac_create_mbuf_from_bpfdesc(struct bpf_d *bpf_d, struct mbuf *mbuf)
290795fab37eSRobert Watson {
290895fab37eSRobert Watson 
290995fab37eSRobert Watson 	MAC_PERFORM(create_mbuf_from_bpfdesc, bpf_d, &bpf_d->bd_label, mbuf,
291095fab37eSRobert Watson 	    &mbuf->m_pkthdr.label);
291195fab37eSRobert Watson }
291295fab37eSRobert Watson 
291395fab37eSRobert Watson void
291495fab37eSRobert Watson mac_create_mbuf_linklayer(struct ifnet *ifnet, struct mbuf *mbuf)
291595fab37eSRobert Watson {
291695fab37eSRobert Watson 
291795fab37eSRobert Watson 	MAC_PERFORM(create_mbuf_linklayer, ifnet, &ifnet->if_label, mbuf,
291895fab37eSRobert Watson 	    &mbuf->m_pkthdr.label);
291995fab37eSRobert Watson }
292095fab37eSRobert Watson 
292195fab37eSRobert Watson void
292295fab37eSRobert Watson mac_create_mbuf_from_ifnet(struct ifnet *ifnet, struct mbuf *mbuf)
292395fab37eSRobert Watson {
292495fab37eSRobert Watson 
292595fab37eSRobert Watson 	MAC_PERFORM(create_mbuf_from_ifnet, ifnet, &ifnet->if_label, mbuf,
292695fab37eSRobert Watson 	    &mbuf->m_pkthdr.label);
292795fab37eSRobert Watson }
292895fab37eSRobert Watson 
292995fab37eSRobert Watson void
293095fab37eSRobert Watson mac_create_mbuf_multicast_encap(struct mbuf *oldmbuf, struct ifnet *ifnet,
293195fab37eSRobert Watson     struct mbuf *newmbuf)
293295fab37eSRobert Watson {
293395fab37eSRobert Watson 
293495fab37eSRobert Watson 	MAC_PERFORM(create_mbuf_multicast_encap, oldmbuf,
293595fab37eSRobert Watson 	    &oldmbuf->m_pkthdr.label, ifnet, &ifnet->if_label, newmbuf,
293695fab37eSRobert Watson 	    &newmbuf->m_pkthdr.label);
293795fab37eSRobert Watson }
293895fab37eSRobert Watson 
293995fab37eSRobert Watson void
294095fab37eSRobert Watson mac_create_mbuf_netlayer(struct mbuf *oldmbuf, struct mbuf *newmbuf)
294195fab37eSRobert Watson {
294295fab37eSRobert Watson 
294395fab37eSRobert Watson 	MAC_PERFORM(create_mbuf_netlayer, oldmbuf, &oldmbuf->m_pkthdr.label,
294495fab37eSRobert Watson 	    newmbuf, &newmbuf->m_pkthdr.label);
294595fab37eSRobert Watson }
294695fab37eSRobert Watson 
294795fab37eSRobert Watson int
294895fab37eSRobert Watson mac_fragment_match(struct mbuf *fragment, struct ipq *ipq)
294995fab37eSRobert Watson {
295095fab37eSRobert Watson 	int result;
295195fab37eSRobert Watson 
295295fab37eSRobert Watson 	result = 1;
295395fab37eSRobert Watson 	MAC_BOOLEAN(fragment_match, &&, fragment, &fragment->m_pkthdr.label,
295495fab37eSRobert Watson 	    ipq, &ipq->ipq_label);
295595fab37eSRobert Watson 
295695fab37eSRobert Watson 	return (result);
295795fab37eSRobert Watson }
295895fab37eSRobert Watson 
295995fab37eSRobert Watson void
296095fab37eSRobert Watson mac_update_ipq(struct mbuf *fragment, struct ipq *ipq)
296195fab37eSRobert Watson {
296295fab37eSRobert Watson 
296395fab37eSRobert Watson 	MAC_PERFORM(update_ipq, fragment, &fragment->m_pkthdr.label, ipq,
296495fab37eSRobert Watson 	    &ipq->ipq_label);
296595fab37eSRobert Watson }
296695fab37eSRobert Watson 
296795fab37eSRobert Watson void
296895fab37eSRobert Watson mac_create_mbuf_from_socket(struct socket *socket, struct mbuf *mbuf)
296995fab37eSRobert Watson {
297095fab37eSRobert Watson 
297195fab37eSRobert Watson 	MAC_PERFORM(create_mbuf_from_socket, socket, &socket->so_label, mbuf,
297295fab37eSRobert Watson 	    &mbuf->m_pkthdr.label);
297395fab37eSRobert Watson }
297495fab37eSRobert Watson 
297595fab37eSRobert Watson void
297695fab37eSRobert Watson mac_create_mount(struct ucred *cred, struct mount *mp)
297795fab37eSRobert Watson {
297895fab37eSRobert Watson 
297995fab37eSRobert Watson 	MAC_PERFORM(create_mount, cred, mp, &mp->mnt_mntlabel,
298095fab37eSRobert Watson 	    &mp->mnt_fslabel);
298195fab37eSRobert Watson }
298295fab37eSRobert Watson 
298395fab37eSRobert Watson void
298495fab37eSRobert Watson mac_create_root_mount(struct ucred *cred, struct mount *mp)
298595fab37eSRobert Watson {
298695fab37eSRobert Watson 
298795fab37eSRobert Watson 	MAC_PERFORM(create_root_mount, cred, mp, &mp->mnt_mntlabel,
298895fab37eSRobert Watson 	    &mp->mnt_fslabel);
298995fab37eSRobert Watson }
299095fab37eSRobert Watson 
299195fab37eSRobert Watson int
299295fab37eSRobert Watson mac_check_bpfdesc_receive(struct bpf_d *bpf_d, struct ifnet *ifnet)
299395fab37eSRobert Watson {
299495fab37eSRobert Watson 	int error;
299595fab37eSRobert Watson 
299695fab37eSRobert Watson 	if (!mac_enforce_network)
299795fab37eSRobert Watson 		return (0);
299895fab37eSRobert Watson 
299995fab37eSRobert Watson 	MAC_CHECK(check_bpfdesc_receive, bpf_d, &bpf_d->bd_label, ifnet,
300095fab37eSRobert Watson 	    &ifnet->if_label);
300195fab37eSRobert Watson 
300295fab37eSRobert Watson 	return (error);
300395fab37eSRobert Watson }
300495fab37eSRobert Watson 
300595fab37eSRobert Watson static int
300695fab37eSRobert Watson mac_check_cred_relabel(struct ucred *cred, struct label *newlabel)
300795fab37eSRobert Watson {
300895fab37eSRobert Watson 	int error;
300995fab37eSRobert Watson 
301095fab37eSRobert Watson 	MAC_CHECK(check_cred_relabel, cred, newlabel);
301195fab37eSRobert Watson 
301295fab37eSRobert Watson 	return (error);
301395fab37eSRobert Watson }
301495fab37eSRobert Watson 
301595fab37eSRobert Watson int
301695fab37eSRobert Watson mac_check_cred_visible(struct ucred *u1, struct ucred *u2)
301795fab37eSRobert Watson {
301895fab37eSRobert Watson 	int error;
301995fab37eSRobert Watson 
302095fab37eSRobert Watson 	if (!mac_enforce_process)
302195fab37eSRobert Watson 		return (0);
302295fab37eSRobert Watson 
302395fab37eSRobert Watson 	MAC_CHECK(check_cred_visible, u1, u2);
302495fab37eSRobert Watson 
302595fab37eSRobert Watson 	return (error);
302695fab37eSRobert Watson }
302795fab37eSRobert Watson 
302895fab37eSRobert Watson int
302995fab37eSRobert Watson mac_check_ifnet_transmit(struct ifnet *ifnet, struct mbuf *mbuf)
303095fab37eSRobert Watson {
303195fab37eSRobert Watson 	int error;
303295fab37eSRobert Watson 
303395fab37eSRobert Watson 	if (!mac_enforce_network)
303495fab37eSRobert Watson 		return (0);
303595fab37eSRobert Watson 
303695fab37eSRobert Watson 	KASSERT(mbuf->m_flags & M_PKTHDR, ("packet has no pkthdr"));
303795fab37eSRobert Watson 	if (!(mbuf->m_pkthdr.label.l_flags & MAC_FLAG_INITIALIZED))
303829e1b85fSBrooks Davis 		if_printf(ifnet, "not initialized\n");
303995fab37eSRobert Watson 
304095fab37eSRobert Watson 	MAC_CHECK(check_ifnet_transmit, ifnet, &ifnet->if_label, mbuf,
304195fab37eSRobert Watson 	    &mbuf->m_pkthdr.label);
304295fab37eSRobert Watson 
304395fab37eSRobert Watson 	return (error);
304495fab37eSRobert Watson }
304595fab37eSRobert Watson 
304695fab37eSRobert Watson int
304795fab37eSRobert Watson mac_check_mount_stat(struct ucred *cred, struct mount *mount)
304895fab37eSRobert Watson {
304995fab37eSRobert Watson 	int error;
305095fab37eSRobert Watson 
305195fab37eSRobert Watson 	if (!mac_enforce_fs)
305295fab37eSRobert Watson 		return (0);
305395fab37eSRobert Watson 
305495fab37eSRobert Watson 	MAC_CHECK(check_mount_stat, cred, mount, &mount->mnt_mntlabel);
305595fab37eSRobert Watson 
305695fab37eSRobert Watson 	return (error);
305795fab37eSRobert Watson }
305895fab37eSRobert Watson 
305995fab37eSRobert Watson int
306095fab37eSRobert Watson mac_check_pipe_ioctl(struct ucred *cred, struct pipe *pipe, unsigned long cmd,
306195fab37eSRobert Watson     void *data)
306295fab37eSRobert Watson {
306395fab37eSRobert Watson 	int error;
306495fab37eSRobert Watson 
30651aa37f53SRobert Watson 	PIPE_LOCK_ASSERT(pipe, MA_OWNED);
30661aa37f53SRobert Watson 
30671aa37f53SRobert Watson 	if (!mac_enforce_pipe)
30681aa37f53SRobert Watson 		return (0);
30691aa37f53SRobert Watson 
307095fab37eSRobert Watson 	MAC_CHECK(check_pipe_ioctl, cred, pipe, pipe->pipe_label, cmd, data);
307195fab37eSRobert Watson 
307295fab37eSRobert Watson 	return (error);
307395fab37eSRobert Watson }
307495fab37eSRobert Watson 
307595fab37eSRobert Watson int
3076c024c3eeSRobert Watson mac_check_pipe_poll(struct ucred *cred, struct pipe *pipe)
307795fab37eSRobert Watson {
307895fab37eSRobert Watson 	int error;
307995fab37eSRobert Watson 
30801aa37f53SRobert Watson 	PIPE_LOCK_ASSERT(pipe, MA_OWNED);
30811aa37f53SRobert Watson 
30821aa37f53SRobert Watson 	if (!mac_enforce_pipe)
30831aa37f53SRobert Watson 		return (0);
30841aa37f53SRobert Watson 
3085c024c3eeSRobert Watson 	MAC_CHECK(check_pipe_poll, cred, pipe, pipe->pipe_label);
3086c024c3eeSRobert Watson 
3087c024c3eeSRobert Watson 	return (error);
3088c024c3eeSRobert Watson }
3089c024c3eeSRobert Watson 
3090c024c3eeSRobert Watson int
3091c024c3eeSRobert Watson mac_check_pipe_read(struct ucred *cred, struct pipe *pipe)
3092c024c3eeSRobert Watson {
3093c024c3eeSRobert Watson 	int error;
3094c024c3eeSRobert Watson 
30951aa37f53SRobert Watson 	PIPE_LOCK_ASSERT(pipe, MA_OWNED);
30961aa37f53SRobert Watson 
30971aa37f53SRobert Watson 	if (!mac_enforce_pipe)
30981aa37f53SRobert Watson 		return (0);
30991aa37f53SRobert Watson 
3100c024c3eeSRobert Watson 	MAC_CHECK(check_pipe_read, cred, pipe, pipe->pipe_label);
310195fab37eSRobert Watson 
310295fab37eSRobert Watson 	return (error);
310395fab37eSRobert Watson }
310495fab37eSRobert Watson 
310595fab37eSRobert Watson static int
310695fab37eSRobert Watson mac_check_pipe_relabel(struct ucred *cred, struct pipe *pipe,
310795fab37eSRobert Watson     struct label *newlabel)
310895fab37eSRobert Watson {
310995fab37eSRobert Watson 	int error;
311095fab37eSRobert Watson 
31111aa37f53SRobert Watson 	PIPE_LOCK_ASSERT(pipe, MA_OWNED);
31121aa37f53SRobert Watson 
31131aa37f53SRobert Watson 	if (!mac_enforce_pipe)
31141aa37f53SRobert Watson 		return (0);
31151aa37f53SRobert Watson 
311695fab37eSRobert Watson 	MAC_CHECK(check_pipe_relabel, cred, pipe, pipe->pipe_label, newlabel);
311795fab37eSRobert Watson 
311895fab37eSRobert Watson 	return (error);
311995fab37eSRobert Watson }
312095fab37eSRobert Watson 
312195fab37eSRobert Watson int
3122c024c3eeSRobert Watson mac_check_pipe_stat(struct ucred *cred, struct pipe *pipe)
3123c024c3eeSRobert Watson {
3124c024c3eeSRobert Watson 	int error;
3125c024c3eeSRobert Watson 
31261aa37f53SRobert Watson 	PIPE_LOCK_ASSERT(pipe, MA_OWNED);
31271aa37f53SRobert Watson 
31281aa37f53SRobert Watson 	if (!mac_enforce_pipe)
31291aa37f53SRobert Watson 		return (0);
31301aa37f53SRobert Watson 
3131c024c3eeSRobert Watson 	MAC_CHECK(check_pipe_stat, cred, pipe, pipe->pipe_label);
3132c024c3eeSRobert Watson 
3133c024c3eeSRobert Watson 	return (error);
3134c024c3eeSRobert Watson }
3135c024c3eeSRobert Watson 
3136c024c3eeSRobert Watson int
3137c024c3eeSRobert Watson mac_check_pipe_write(struct ucred *cred, struct pipe *pipe)
3138c024c3eeSRobert Watson {
3139c024c3eeSRobert Watson 	int error;
3140c024c3eeSRobert Watson 
31411aa37f53SRobert Watson 	PIPE_LOCK_ASSERT(pipe, MA_OWNED);
31421aa37f53SRobert Watson 
31431aa37f53SRobert Watson 	if (!mac_enforce_pipe)
31441aa37f53SRobert Watson 		return (0);
31451aa37f53SRobert Watson 
3146c024c3eeSRobert Watson 	MAC_CHECK(check_pipe_write, cred, pipe, pipe->pipe_label);
3147c024c3eeSRobert Watson 
3148c024c3eeSRobert Watson 	return (error);
3149c024c3eeSRobert Watson }
3150c024c3eeSRobert Watson 
3151c024c3eeSRobert Watson int
315295fab37eSRobert Watson mac_check_proc_debug(struct ucred *cred, struct proc *proc)
315395fab37eSRobert Watson {
315495fab37eSRobert Watson 	int error;
315595fab37eSRobert Watson 
3156b12baf55SRobert Watson 	PROC_LOCK_ASSERT(proc, MA_OWNED);
3157b12baf55SRobert Watson 
315895fab37eSRobert Watson 	if (!mac_enforce_process)
315995fab37eSRobert Watson 		return (0);
316095fab37eSRobert Watson 
316195fab37eSRobert Watson 	MAC_CHECK(check_proc_debug, cred, proc);
316295fab37eSRobert Watson 
316395fab37eSRobert Watson 	return (error);
316495fab37eSRobert Watson }
316595fab37eSRobert Watson 
316695fab37eSRobert Watson int
316795fab37eSRobert Watson mac_check_proc_sched(struct ucred *cred, struct proc *proc)
316895fab37eSRobert Watson {
316995fab37eSRobert Watson 	int error;
317095fab37eSRobert Watson 
3171b12baf55SRobert Watson 	PROC_LOCK_ASSERT(proc, MA_OWNED);
3172b12baf55SRobert Watson 
317395fab37eSRobert Watson 	if (!mac_enforce_process)
317495fab37eSRobert Watson 		return (0);
317595fab37eSRobert Watson 
317695fab37eSRobert Watson 	MAC_CHECK(check_proc_sched, cred, proc);
317795fab37eSRobert Watson 
317895fab37eSRobert Watson 	return (error);
317995fab37eSRobert Watson }
318095fab37eSRobert Watson 
318195fab37eSRobert Watson int
318295fab37eSRobert Watson mac_check_proc_signal(struct ucred *cred, struct proc *proc, int signum)
318395fab37eSRobert Watson {
318495fab37eSRobert Watson 	int error;
318595fab37eSRobert Watson 
3186b12baf55SRobert Watson 	PROC_LOCK_ASSERT(proc, MA_OWNED);
3187b12baf55SRobert Watson 
318895fab37eSRobert Watson 	if (!mac_enforce_process)
318995fab37eSRobert Watson 		return (0);
319095fab37eSRobert Watson 
319195fab37eSRobert Watson 	MAC_CHECK(check_proc_signal, cred, proc, signum);
319295fab37eSRobert Watson 
319395fab37eSRobert Watson 	return (error);
319495fab37eSRobert Watson }
319595fab37eSRobert Watson 
319695fab37eSRobert Watson int
319795fab37eSRobert Watson mac_check_socket_bind(struct ucred *ucred, struct socket *socket,
319895fab37eSRobert Watson     struct sockaddr *sockaddr)
319995fab37eSRobert Watson {
320095fab37eSRobert Watson 	int error;
320195fab37eSRobert Watson 
320295fab37eSRobert Watson 	if (!mac_enforce_socket)
320395fab37eSRobert Watson 		return (0);
320495fab37eSRobert Watson 
320595fab37eSRobert Watson 	MAC_CHECK(check_socket_bind, ucred, socket, &socket->so_label,
320695fab37eSRobert Watson 	    sockaddr);
320795fab37eSRobert Watson 
320895fab37eSRobert Watson 	return (error);
320995fab37eSRobert Watson }
321095fab37eSRobert Watson 
321195fab37eSRobert Watson int
321295fab37eSRobert Watson mac_check_socket_connect(struct ucred *cred, struct socket *socket,
321395fab37eSRobert Watson     struct sockaddr *sockaddr)
321495fab37eSRobert Watson {
321595fab37eSRobert Watson 	int error;
321695fab37eSRobert Watson 
321795fab37eSRobert Watson 	if (!mac_enforce_socket)
321895fab37eSRobert Watson 		return (0);
321995fab37eSRobert Watson 
322095fab37eSRobert Watson 	MAC_CHECK(check_socket_connect, cred, socket, &socket->so_label,
322195fab37eSRobert Watson 	    sockaddr);
322295fab37eSRobert Watson 
322395fab37eSRobert Watson 	return (error);
322495fab37eSRobert Watson }
322595fab37eSRobert Watson 
322695fab37eSRobert Watson int
3227d61198e4SRobert Watson mac_check_socket_deliver(struct socket *socket, struct mbuf *mbuf)
3228d61198e4SRobert Watson {
3229d61198e4SRobert Watson 	int error;
3230d61198e4SRobert Watson 
3231d61198e4SRobert Watson 	if (!mac_enforce_socket)
3232d61198e4SRobert Watson 		return (0);
3233d61198e4SRobert Watson 
3234d61198e4SRobert Watson 	MAC_CHECK(check_socket_deliver, socket, &socket->so_label, mbuf,
3235d61198e4SRobert Watson 	    &mbuf->m_pkthdr.label);
3236d61198e4SRobert Watson 
3237d61198e4SRobert Watson 	return (error);
3238d61198e4SRobert Watson }
3239d61198e4SRobert Watson 
3240d61198e4SRobert Watson int
324195fab37eSRobert Watson mac_check_socket_listen(struct ucred *cred, struct socket *socket)
324295fab37eSRobert Watson {
324395fab37eSRobert Watson 	int error;
324495fab37eSRobert Watson 
324595fab37eSRobert Watson 	if (!mac_enforce_socket)
324695fab37eSRobert Watson 		return (0);
324795fab37eSRobert Watson 
324895fab37eSRobert Watson 	MAC_CHECK(check_socket_listen, cred, socket, &socket->so_label);
324995fab37eSRobert Watson 	return (error);
325095fab37eSRobert Watson }
325195fab37eSRobert Watson 
3252b371c939SRobert Watson int
3253b371c939SRobert Watson mac_check_socket_receive(struct ucred *cred, struct socket *so)
3254b371c939SRobert Watson {
3255b371c939SRobert Watson 	int error;
3256b371c939SRobert Watson 
3257b371c939SRobert Watson 	if (!mac_enforce_socket)
3258b371c939SRobert Watson 		return (0);
3259b371c939SRobert Watson 
3260b371c939SRobert Watson 	MAC_CHECK(check_socket_receive, cred, so, &so->so_label);
3261b371c939SRobert Watson 
3262b371c939SRobert Watson 	return (error);
3263b371c939SRobert Watson }
3264b371c939SRobert Watson 
326595fab37eSRobert Watson static int
326695fab37eSRobert Watson mac_check_socket_relabel(struct ucred *cred, struct socket *socket,
326795fab37eSRobert Watson     struct label *newlabel)
326895fab37eSRobert Watson {
326995fab37eSRobert Watson 	int error;
327095fab37eSRobert Watson 
327195fab37eSRobert Watson 	MAC_CHECK(check_socket_relabel, cred, socket, &socket->so_label,
327295fab37eSRobert Watson 	    newlabel);
327395fab37eSRobert Watson 
327495fab37eSRobert Watson 	return (error);
327595fab37eSRobert Watson }
327695fab37eSRobert Watson 
327795fab37eSRobert Watson int
3278b371c939SRobert Watson mac_check_socket_send(struct ucred *cred, struct socket *so)
3279b371c939SRobert Watson {
3280b371c939SRobert Watson 	int error;
3281b371c939SRobert Watson 
3282b371c939SRobert Watson 	if (!mac_enforce_socket)
3283b371c939SRobert Watson 		return (0);
3284b371c939SRobert Watson 
3285b371c939SRobert Watson 	MAC_CHECK(check_socket_send, cred, so, &so->so_label);
3286b371c939SRobert Watson 
3287b371c939SRobert Watson 	return (error);
3288b371c939SRobert Watson }
3289b371c939SRobert Watson 
3290b371c939SRobert Watson int
329195fab37eSRobert Watson mac_check_socket_visible(struct ucred *cred, struct socket *socket)
329295fab37eSRobert Watson {
329395fab37eSRobert Watson 	int error;
329495fab37eSRobert Watson 
329595fab37eSRobert Watson 	if (!mac_enforce_socket)
329695fab37eSRobert Watson 		return (0);
329795fab37eSRobert Watson 
329895fab37eSRobert Watson 	MAC_CHECK(check_socket_visible, cred, socket, &socket->so_label);
329995fab37eSRobert Watson 
330095fab37eSRobert Watson 	return (error);
330195fab37eSRobert Watson }
330295fab37eSRobert Watson 
330395fab37eSRobert Watson int
330495fab37eSRobert Watson mac_ioctl_ifnet_get(struct ucred *cred, struct ifreq *ifr,
330595fab37eSRobert Watson     struct ifnet *ifnet)
330695fab37eSRobert Watson {
3307f7b951a8SRobert Watson 	char *elements, *buffer;
3308f7b951a8SRobert Watson 	struct mac mac;
330995fab37eSRobert Watson 	int error;
331095fab37eSRobert Watson 
3311f7b951a8SRobert Watson 	error = copyin(ifr->ifr_ifru.ifru_data, &mac, sizeof(mac));
331295fab37eSRobert Watson 	if (error)
331395fab37eSRobert Watson 		return (error);
331495fab37eSRobert Watson 
3315f7b951a8SRobert Watson 	error = mac_check_structmac_consistent(&mac);
3316f7b951a8SRobert Watson 	if (error)
3317f7b951a8SRobert Watson 		return (error);
3318f7b951a8SRobert Watson 
3319f7b951a8SRobert Watson 	elements = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK);
3320f7b951a8SRobert Watson 
3321f7b951a8SRobert Watson 	error = copyinstr(mac.m_string, elements, mac.m_buflen, NULL);
3322f7b951a8SRobert Watson 	if (error) {
3323f7b951a8SRobert Watson 		free(elements, M_MACTEMP);
3324f7b951a8SRobert Watson 		return (error);
3325f7b951a8SRobert Watson 	}
3326f7b951a8SRobert Watson 
3327f7b951a8SRobert Watson 	buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK | M_ZERO);
3328f7b951a8SRobert Watson 
3329f7b951a8SRobert Watson 	error = mac_externalize_ifnet_label(&ifnet->if_label, elements,
3330f7b951a8SRobert Watson 	    buffer, mac.m_buflen, M_WAITOK);
3331f7b951a8SRobert Watson 	if (error == 0)
3332f7b951a8SRobert Watson 		error = copyout(buffer, mac.m_string, strlen(buffer)+1);
3333f7b951a8SRobert Watson 
3334f7b951a8SRobert Watson 	free(buffer, M_MACTEMP);
3335f7b951a8SRobert Watson 	free(elements, M_MACTEMP);
3336f7b951a8SRobert Watson 
3337f7b951a8SRobert Watson 	return (error);
333895fab37eSRobert Watson }
333995fab37eSRobert Watson 
334095fab37eSRobert Watson int
334195fab37eSRobert Watson mac_ioctl_ifnet_set(struct ucred *cred, struct ifreq *ifr,
334295fab37eSRobert Watson     struct ifnet *ifnet)
334395fab37eSRobert Watson {
334495fab37eSRobert Watson 	struct label intlabel;
3345f7b951a8SRobert Watson 	struct mac mac;
3346f7b951a8SRobert Watson 	char *buffer;
334795fab37eSRobert Watson 	int error;
334895fab37eSRobert Watson 
3349f7b951a8SRobert Watson 	error = copyin(ifr->ifr_ifru.ifru_data, &mac, sizeof(mac));
335095fab37eSRobert Watson 	if (error)
335195fab37eSRobert Watson 		return (error);
335295fab37eSRobert Watson 
3353f7b951a8SRobert Watson 	error = mac_check_structmac_consistent(&mac);
335495fab37eSRobert Watson 	if (error)
335595fab37eSRobert Watson 		return (error);
335695fab37eSRobert Watson 
3357f7b951a8SRobert Watson 	buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK);
3358f7b951a8SRobert Watson 
3359f7b951a8SRobert Watson 	error = copyinstr(mac.m_string, buffer, mac.m_buflen, NULL);
3360f7b951a8SRobert Watson 	if (error) {
3361f7b951a8SRobert Watson 		free(buffer, M_MACTEMP);
3362f7b951a8SRobert Watson 		return (error);
3363f7b951a8SRobert Watson 	}
3364f7b951a8SRobert Watson 
3365f7b951a8SRobert Watson 	mac_init_ifnet_label(&intlabel);
3366f7b951a8SRobert Watson 	error = mac_internalize_ifnet_label(&intlabel, buffer);
3367f7b951a8SRobert Watson 	free(buffer, M_MACTEMP);
3368f7b951a8SRobert Watson 	if (error) {
3369f7b951a8SRobert Watson 		mac_destroy_ifnet_label(&intlabel);
3370f7b951a8SRobert Watson 		return (error);
3371f7b951a8SRobert Watson 	}
3372f7b951a8SRobert Watson 
337395fab37eSRobert Watson 	/*
337495fab37eSRobert Watson 	 * XXX: Note that this is a redundant privilege check, since
337595fab37eSRobert Watson 	 * policies impose this check themselves if required by the
337695fab37eSRobert Watson 	 * policy.  Eventually, this should go away.
337795fab37eSRobert Watson 	 */
337895fab37eSRobert Watson 	error = suser_cred(cred, 0);
3379f7b951a8SRobert Watson 	if (error) {
3380f7b951a8SRobert Watson 		mac_destroy_ifnet_label(&intlabel);
3381f7b951a8SRobert Watson 		return (error);
3382f7b951a8SRobert Watson 	}
338395fab37eSRobert Watson 
338495fab37eSRobert Watson 	MAC_CHECK(check_ifnet_relabel, cred, ifnet, &ifnet->if_label,
338595fab37eSRobert Watson 	    &intlabel);
3386f7b951a8SRobert Watson 	if (error) {
3387f7b951a8SRobert Watson 		mac_destroy_ifnet_label(&intlabel);
3388f7b951a8SRobert Watson 		return (error);
3389f7b951a8SRobert Watson 	}
339095fab37eSRobert Watson 
339195fab37eSRobert Watson 	MAC_PERFORM(relabel_ifnet, cred, ifnet, &ifnet->if_label, &intlabel);
339295fab37eSRobert Watson 
3393f7b951a8SRobert Watson 	mac_destroy_ifnet_label(&intlabel);
3394f7b951a8SRobert Watson 	return (0);
339595fab37eSRobert Watson }
339695fab37eSRobert Watson 
339795fab37eSRobert Watson void
339895fab37eSRobert Watson mac_create_devfs_vnode(struct devfs_dirent *de, struct vnode *vp)
339995fab37eSRobert Watson {
340095fab37eSRobert Watson 
340195fab37eSRobert Watson 	MAC_PERFORM(create_devfs_vnode, de, &de->de_label, vp, &vp->v_label);
340295fab37eSRobert Watson }
340395fab37eSRobert Watson 
340495fab37eSRobert Watson void
340595fab37eSRobert Watson mac_create_devfs_device(dev_t dev, struct devfs_dirent *de)
340695fab37eSRobert Watson {
340795fab37eSRobert Watson 
340895fab37eSRobert Watson 	MAC_PERFORM(create_devfs_device, dev, de, &de->de_label);
340995fab37eSRobert Watson }
341095fab37eSRobert Watson 
341174e62b1bSRobert Watson void
341274e62b1bSRobert Watson mac_create_devfs_symlink(struct ucred *cred, struct devfs_dirent *dd,
341374e62b1bSRobert Watson     struct devfs_dirent *de)
341474e62b1bSRobert Watson {
341574e62b1bSRobert Watson 
341674e62b1bSRobert Watson 	MAC_PERFORM(create_devfs_symlink, cred, dd, &dd->de_label, de,
341774e62b1bSRobert Watson 	    &de->de_label);
341874e62b1bSRobert Watson }
341974e62b1bSRobert Watson 
342095fab37eSRobert Watson static int
342195fab37eSRobert Watson mac_stdcreatevnode_ea(struct vnode *vp)
342295fab37eSRobert Watson {
342395fab37eSRobert Watson 	int error;
342495fab37eSRobert Watson 
342595fab37eSRobert Watson 	MAC_CHECK(stdcreatevnode_ea, vp, &vp->v_label);
342695fab37eSRobert Watson 
342795fab37eSRobert Watson 	return (error);
342895fab37eSRobert Watson }
342995fab37eSRobert Watson 
343095fab37eSRobert Watson void
343195fab37eSRobert Watson mac_create_devfs_directory(char *dirname, int dirnamelen,
343295fab37eSRobert Watson     struct devfs_dirent *de)
343395fab37eSRobert Watson {
343495fab37eSRobert Watson 
343595fab37eSRobert Watson 	MAC_PERFORM(create_devfs_directory, dirname, dirnamelen, de,
343695fab37eSRobert Watson 	    &de->de_label);
343795fab37eSRobert Watson }
343895fab37eSRobert Watson 
343995fab37eSRobert Watson /*
344095fab37eSRobert Watson  * When a new vnode is created, this call will initialize its label.
344195fab37eSRobert Watson  */
344295fab37eSRobert Watson void
344395fab37eSRobert Watson mac_create_vnode(struct ucred *cred, struct vnode *parent,
344495fab37eSRobert Watson     struct vnode *child)
344595fab37eSRobert Watson {
344695fab37eSRobert Watson 	int error;
344795fab37eSRobert Watson 
344895fab37eSRobert Watson 	ASSERT_VOP_LOCKED(parent, "mac_create_vnode");
344995fab37eSRobert Watson 	ASSERT_VOP_LOCKED(child, "mac_create_vnode");
345095fab37eSRobert Watson 
345195fab37eSRobert Watson 	error = vn_refreshlabel(parent, cred);
345295fab37eSRobert Watson 	if (error) {
345395fab37eSRobert Watson 		printf("mac_create_vnode: vn_refreshlabel returned %d\n",
345495fab37eSRobert Watson 		    error);
345595fab37eSRobert Watson 		printf("mac_create_vnode: using old vnode label\n");
345695fab37eSRobert Watson 	}
345795fab37eSRobert Watson 
345895fab37eSRobert Watson 	MAC_PERFORM(create_vnode, cred, parent, &parent->v_label, child,
345995fab37eSRobert Watson 	    &child->v_label);
346095fab37eSRobert Watson }
346195fab37eSRobert Watson 
346295fab37eSRobert Watson int
346395fab37eSRobert Watson mac_setsockopt_label_set(struct ucred *cred, struct socket *so,
3464f7b951a8SRobert Watson     struct mac *mac)
346595fab37eSRobert Watson {
346695fab37eSRobert Watson 	struct label intlabel;
3467f7b951a8SRobert Watson 	char *buffer;
346895fab37eSRobert Watson 	int error;
346995fab37eSRobert Watson 
3470f7b951a8SRobert Watson 	error = mac_check_structmac_consistent(mac);
347195fab37eSRobert Watson 	if (error)
347295fab37eSRobert Watson 		return (error);
347395fab37eSRobert Watson 
3474f7b951a8SRobert Watson 	buffer = malloc(mac->m_buflen, M_MACTEMP, M_WAITOK);
3475f7b951a8SRobert Watson 
3476f7b951a8SRobert Watson 	error = copyinstr(mac->m_string, buffer, mac->m_buflen, NULL);
3477f7b951a8SRobert Watson 	if (error) {
3478f7b951a8SRobert Watson 		free(buffer, M_MACTEMP);
3479f7b951a8SRobert Watson 		return (error);
3480f7b951a8SRobert Watson 	}
3481f7b951a8SRobert Watson 
3482f7b951a8SRobert Watson 	mac_init_socket_label(&intlabel, M_WAITOK);
3483f7b951a8SRobert Watson 	error = mac_internalize_socket_label(&intlabel, buffer);
3484f7b951a8SRobert Watson 	free(buffer, M_MACTEMP);
3485f7b951a8SRobert Watson 	if (error) {
3486f7b951a8SRobert Watson 		mac_destroy_socket_label(&intlabel);
3487f7b951a8SRobert Watson 		return (error);
3488f7b951a8SRobert Watson 	}
3489f7b951a8SRobert Watson 
349095fab37eSRobert Watson 	mac_check_socket_relabel(cred, so, &intlabel);
349195fab37eSRobert Watson 	if (error) {
3492f7b951a8SRobert Watson 		mac_destroy_socket_label(&intlabel);
349395fab37eSRobert Watson 		return (error);
349495fab37eSRobert Watson 	}
349595fab37eSRobert Watson 
349695fab37eSRobert Watson 	mac_relabel_socket(cred, so, &intlabel);
349795fab37eSRobert Watson 
3498f7b951a8SRobert Watson 	mac_destroy_socket_label(&intlabel);
349995fab37eSRobert Watson 	return (0);
350095fab37eSRobert Watson }
350195fab37eSRobert Watson 
350295fab37eSRobert Watson int
350395fab37eSRobert Watson mac_pipe_label_set(struct ucred *cred, struct pipe *pipe, struct label *label)
350495fab37eSRobert Watson {
350595fab37eSRobert Watson 	int error;
350695fab37eSRobert Watson 
35071aa37f53SRobert Watson 	PIPE_LOCK_ASSERT(pipe, MA_OWNED);
35081aa37f53SRobert Watson 
350995fab37eSRobert Watson 	error = mac_check_pipe_relabel(cred, pipe, label);
351095fab37eSRobert Watson 	if (error)
351195fab37eSRobert Watson 		return (error);
351295fab37eSRobert Watson 
351395fab37eSRobert Watson 	mac_relabel_pipe(cred, pipe, label);
351495fab37eSRobert Watson 
351595fab37eSRobert Watson 	return (0);
351695fab37eSRobert Watson }
351795fab37eSRobert Watson 
351895fab37eSRobert Watson int
351995fab37eSRobert Watson mac_getsockopt_label_get(struct ucred *cred, struct socket *so,
3520f7b951a8SRobert Watson     struct mac *mac)
352195fab37eSRobert Watson {
3522f7b951a8SRobert Watson 	char *buffer, *elements;
3523f7b951a8SRobert Watson 	int error;
352495fab37eSRobert Watson 
3525f7b951a8SRobert Watson 	error = mac_check_structmac_consistent(mac);
3526f7b951a8SRobert Watson 	if (error)
3527f7b951a8SRobert Watson 		return (error);
3528f7b951a8SRobert Watson 
3529f7b951a8SRobert Watson 	elements = malloc(mac->m_buflen, M_MACTEMP, M_WAITOK);
3530f7b951a8SRobert Watson 
3531f7b951a8SRobert Watson 	error = copyinstr(mac->m_string, elements, mac->m_buflen, NULL);
3532f7b951a8SRobert Watson 	if (error) {
3533f7b951a8SRobert Watson 		free(elements, M_MACTEMP);
3534f7b951a8SRobert Watson 		return (error);
3535f7b951a8SRobert Watson 	}
3536f7b951a8SRobert Watson 
3537f7b951a8SRobert Watson 	buffer = malloc(mac->m_buflen, M_MACTEMP, M_WAITOK | M_ZERO);
3538f7b951a8SRobert Watson 
3539f7b951a8SRobert Watson 	error = mac_externalize_socket_label(&so->so_label, elements,
3540f7b951a8SRobert Watson 	    buffer, mac->m_buflen, M_WAITOK);
3541f7b951a8SRobert Watson 	if (error == 0)
3542f7b951a8SRobert Watson 		error = copyout(buffer, mac->m_string, strlen(buffer)+1);
3543f7b951a8SRobert Watson 
3544f7b951a8SRobert Watson 	free(buffer, M_MACTEMP);
3545f7b951a8SRobert Watson 	free(elements, M_MACTEMP);
3546f7b951a8SRobert Watson 
3547f7b951a8SRobert Watson 	return (error);
354895fab37eSRobert Watson }
354995fab37eSRobert Watson 
355095fab37eSRobert Watson int
355195fab37eSRobert Watson mac_getsockopt_peerlabel_get(struct ucred *cred, struct socket *so,
3552f7b951a8SRobert Watson     struct mac *mac)
355395fab37eSRobert Watson {
3554f7b951a8SRobert Watson 	char *elements, *buffer;
3555f7b951a8SRobert Watson 	int error;
355695fab37eSRobert Watson 
3557f7b951a8SRobert Watson 	error = mac_check_structmac_consistent(mac);
3558f7b951a8SRobert Watson 	if (error)
3559f7b951a8SRobert Watson 		return (error);
3560f7b951a8SRobert Watson 
3561f7b951a8SRobert Watson 	elements = malloc(mac->m_buflen, M_MACTEMP, M_WAITOK);
3562f7b951a8SRobert Watson 
3563f7b951a8SRobert Watson 	error = copyinstr(mac->m_string, elements, mac->m_buflen, NULL);
3564f7b951a8SRobert Watson 	if (error) {
3565f7b951a8SRobert Watson 		free(elements, M_MACTEMP);
3566f7b951a8SRobert Watson 		return (error);
3567f7b951a8SRobert Watson 	}
3568f7b951a8SRobert Watson 
3569f7b951a8SRobert Watson 	buffer = malloc(mac->m_buflen, M_MACTEMP, M_WAITOK | M_ZERO);
3570f7b951a8SRobert Watson 
3571f7b951a8SRobert Watson 	error = mac_externalize_socket_peer_label(&so->so_peerlabel,
3572f7b951a8SRobert Watson 	    elements, buffer, mac->m_buflen, M_WAITOK);
3573f7b951a8SRobert Watson 	if (error == 0)
3574f7b951a8SRobert Watson 		error = copyout(buffer, mac->m_string, strlen(buffer)+1);
3575f7b951a8SRobert Watson 
3576f7b951a8SRobert Watson 	free(buffer, M_MACTEMP);
3577f7b951a8SRobert Watson 	free(elements, M_MACTEMP);
3578f7b951a8SRobert Watson 
3579f7b951a8SRobert Watson 	return (error);
358095fab37eSRobert Watson }
358195fab37eSRobert Watson 
358295fab37eSRobert Watson /*
358395fab37eSRobert Watson  * Implementation of VOP_SETLABEL() that relies on extended attributes
358495fab37eSRobert Watson  * to store label data.  Can be referenced by filesystems supporting
358595fab37eSRobert Watson  * extended attributes.
358695fab37eSRobert Watson  */
358795fab37eSRobert Watson int
358895fab37eSRobert Watson vop_stdsetlabel_ea(struct vop_setlabel_args *ap)
358995fab37eSRobert Watson {
359095fab37eSRobert Watson 	struct vnode *vp = ap->a_vp;
359195fab37eSRobert Watson 	struct label *intlabel = ap->a_label;
3592f7b951a8SRobert Watson 	struct oldmac extmac;
359395fab37eSRobert Watson 	int error;
359495fab37eSRobert Watson 
359595fab37eSRobert Watson 	ASSERT_VOP_LOCKED(vp, "vop_stdsetlabel_ea");
359695fab37eSRobert Watson 
359795fab37eSRobert Watson 	/*
359895fab37eSRobert Watson 	 * XXX: Eventually call out to EA check/set calls here.
359995fab37eSRobert Watson 	 * Be particularly careful to avoid race conditions,
360095fab37eSRobert Watson 	 * consistency problems, and stability problems when
360195fab37eSRobert Watson 	 * dealing with multiple EAs.  In particular, we require
360295fab37eSRobert Watson 	 * the ability to write multiple EAs on the same file in
360395fab37eSRobert Watson 	 * a single transaction, which the current EA interface
360495fab37eSRobert Watson 	 * does not provide.
360595fab37eSRobert Watson 	 */
360695fab37eSRobert Watson 
3607f7b951a8SRobert Watson 	error = mac_externalize_vnode_oldmac(intlabel, &extmac);
360895fab37eSRobert Watson 	if (error)
360995fab37eSRobert Watson 		return (error);
361095fab37eSRobert Watson 
361195fab37eSRobert Watson 	error = vn_extattr_set(vp, IO_NODELOCKED,
361295fab37eSRobert Watson 	    FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME,
361395fab37eSRobert Watson 	    sizeof(extmac), (char *)&extmac, curthread);
361495fab37eSRobert Watson 	if (error)
361595fab37eSRobert Watson 		return (error);
361695fab37eSRobert Watson 
361795fab37eSRobert Watson 	mac_relabel_vnode(ap->a_cred, vp, intlabel);
361895fab37eSRobert Watson 
3619e6e370a7SJeff Roberson 	vp->v_vflag |= VV_CACHEDLABEL;
362095fab37eSRobert Watson 
362195fab37eSRobert Watson 	return (0);
362295fab37eSRobert Watson }
362395fab37eSRobert Watson 
362495fab37eSRobert Watson static int
362595fab37eSRobert Watson vn_setlabel(struct vnode *vp, struct label *intlabel, struct ucred *cred)
362695fab37eSRobert Watson {
362795fab37eSRobert Watson 	int error;
362895fab37eSRobert Watson 
362995fab37eSRobert Watson 	if (vp->v_mount == NULL) {
363095fab37eSRobert Watson 		/* printf("vn_setlabel: null v_mount\n"); */
363106be2aaaSNate Lawson 		if (vp->v_type != VNON)
363206be2aaaSNate Lawson 			printf("vn_setlabel: null v_mount with non-VNON\n");
363395fab37eSRobert Watson 		return (EBADF);
363495fab37eSRobert Watson 	}
363595fab37eSRobert Watson 
363695fab37eSRobert Watson 	if ((vp->v_mount->mnt_flag & MNT_MULTILABEL) == 0)
363795fab37eSRobert Watson 		return (EOPNOTSUPP);
363895fab37eSRobert Watson 
363995fab37eSRobert Watson 	/*
364095fab37eSRobert Watson 	 * Multi-phase commit.  First check the policies to confirm the
364195fab37eSRobert Watson 	 * change is OK.  Then commit via the filesystem.  Finally,
364295fab37eSRobert Watson 	 * update the actual vnode label.  Question: maybe the filesystem
364395fab37eSRobert Watson 	 * should update the vnode at the end as part of VOP_SETLABEL()?
364495fab37eSRobert Watson 	 */
364595fab37eSRobert Watson 	error = mac_check_vnode_relabel(cred, vp, intlabel);
364695fab37eSRobert Watson 	if (error)
364795fab37eSRobert Watson 		return (error);
364895fab37eSRobert Watson 
364995fab37eSRobert Watson 	/*
365095fab37eSRobert Watson 	 * VADMIN provides the opportunity for the filesystem to make
365195fab37eSRobert Watson 	 * decisions about who is and is not able to modify labels
365295fab37eSRobert Watson 	 * and protections on files.  This might not be right.  We can't
365395fab37eSRobert Watson 	 * assume VOP_SETLABEL() will do it, because we might implement
365495fab37eSRobert Watson 	 * that as part of vop_stdsetlabel_ea().
365595fab37eSRobert Watson 	 */
365695fab37eSRobert Watson 	error = VOP_ACCESS(vp, VADMIN, cred, curthread);
365795fab37eSRobert Watson 	if (error)
365895fab37eSRobert Watson 		return (error);
365995fab37eSRobert Watson 
366095fab37eSRobert Watson 	error = VOP_SETLABEL(vp, intlabel, cred, curthread);
366195fab37eSRobert Watson 	if (error)
366295fab37eSRobert Watson 		return (error);
366395fab37eSRobert Watson 
366495fab37eSRobert Watson 	return (0);
366595fab37eSRobert Watson }
366695fab37eSRobert Watson 
3667f7b951a8SRobert Watson int
3668f7b951a8SRobert Watson __mac_get_pid(struct thread *td, struct __mac_get_pid_args *uap)
3669f7b951a8SRobert Watson {
3670f7b951a8SRobert Watson 	char *elements, *buffer;
3671f7b951a8SRobert Watson 	struct mac mac;
3672f7b951a8SRobert Watson 	struct proc *tproc;
3673f7b951a8SRobert Watson 	struct ucred *tcred;
3674f7b951a8SRobert Watson 	int error;
3675f7b951a8SRobert Watson 
3676f7b951a8SRobert Watson 	error = copyin(SCARG(uap, mac_p), &mac, sizeof(mac));
3677f7b951a8SRobert Watson 	if (error)
3678f7b951a8SRobert Watson 		return (error);
3679f7b951a8SRobert Watson 
3680f7b951a8SRobert Watson 	error = mac_check_structmac_consistent(&mac);
3681f7b951a8SRobert Watson 	if (error)
3682f7b951a8SRobert Watson 		return (error);
3683f7b951a8SRobert Watson 
3684f7b951a8SRobert Watson 	tproc = pfind(uap->pid);
3685f7b951a8SRobert Watson 	if (tproc == NULL)
3686f7b951a8SRobert Watson 		return (ESRCH);
3687f7b951a8SRobert Watson 
3688f7b951a8SRobert Watson 	tcred = NULL;				/* Satisfy gcc. */
3689f7b951a8SRobert Watson 	error = p_cansee(td, tproc);
3690f7b951a8SRobert Watson 	if (error == 0)
3691f7b951a8SRobert Watson 		tcred = crhold(tproc->p_ucred);
3692f7b951a8SRobert Watson 	PROC_UNLOCK(tproc);
3693f7b951a8SRobert Watson 	if (error)
3694f7b951a8SRobert Watson 		return (error);
3695f7b951a8SRobert Watson 
3696f7b951a8SRobert Watson 	elements = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK);
3697f7b951a8SRobert Watson 
3698f7b951a8SRobert Watson 	error = copyinstr(mac.m_string, elements, mac.m_buflen, NULL);
3699f7b951a8SRobert Watson 	if (error) {
3700f7b951a8SRobert Watson 		free(elements, M_MACTEMP);
3701f7b951a8SRobert Watson 		crfree(tcred);
3702f7b951a8SRobert Watson 		return (error);
3703f7b951a8SRobert Watson 	}
3704f7b951a8SRobert Watson 
3705f7b951a8SRobert Watson 	buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK | M_ZERO);
3706f7b951a8SRobert Watson 
3707f7b951a8SRobert Watson 	error = mac_externalize_cred_label(&tcred->cr_label, elements,
3708f7b951a8SRobert Watson 	    buffer, mac.m_buflen, M_WAITOK);
3709f7b951a8SRobert Watson 	if (error == 0)
3710f7b951a8SRobert Watson 		error = copyout(buffer, mac.m_string, strlen(buffer)+1);
3711f7b951a8SRobert Watson 
3712f7b951a8SRobert Watson 	free(buffer, M_MACTEMP);
3713f7b951a8SRobert Watson 	free(elements, M_MACTEMP);
3714f7b951a8SRobert Watson 	crfree(tcred);
3715f7b951a8SRobert Watson 	return (error);
3716f7b951a8SRobert Watson }
3717f7b951a8SRobert Watson 
371895fab37eSRobert Watson /*
371995fab37eSRobert Watson  * MPSAFE
372095fab37eSRobert Watson  */
372195fab37eSRobert Watson int
372295fab37eSRobert Watson __mac_get_proc(struct thread *td, struct __mac_get_proc_args *uap)
372395fab37eSRobert Watson {
3724f7b951a8SRobert Watson 	char *elements, *buffer;
3725f7b951a8SRobert Watson 	struct mac mac;
372695fab37eSRobert Watson 	int error;
372795fab37eSRobert Watson 
3728f7b951a8SRobert Watson 	error = copyin(uap->mac_p, &mac, sizeof(mac));
3729f7b951a8SRobert Watson 	if (error)
3730f7b951a8SRobert Watson 		return (error);
373195fab37eSRobert Watson 
3732f7b951a8SRobert Watson 	error = mac_check_structmac_consistent(&mac);
3733f7b951a8SRobert Watson 	if (error)
3734f7b951a8SRobert Watson 		return (error);
3735f7b951a8SRobert Watson 
3736f7b951a8SRobert Watson 	elements = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK);
3737f7b951a8SRobert Watson 
3738f7b951a8SRobert Watson 	error = copyinstr(mac.m_string, elements, mac.m_buflen, NULL);
3739f7b951a8SRobert Watson 	if (error) {
3740f7b951a8SRobert Watson 		free(elements, M_MACTEMP);
3741f7b951a8SRobert Watson 		return (error);
3742f7b951a8SRobert Watson 	}
3743f7b951a8SRobert Watson 
3744f7b951a8SRobert Watson 	buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK | M_ZERO);
3745f7b951a8SRobert Watson 
3746f7b951a8SRobert Watson 	error = mac_externalize_cred_label(&td->td_ucred->cr_label,
3747f7b951a8SRobert Watson 	    elements, buffer, mac.m_buflen, M_WAITOK);
3748f7b951a8SRobert Watson 	if (error == 0)
3749f7b951a8SRobert Watson 		error = copyout(buffer, mac.m_string, strlen(buffer)+1);
3750f7b951a8SRobert Watson 
3751f7b951a8SRobert Watson 	free(buffer, M_MACTEMP);
3752f7b951a8SRobert Watson 	free(elements, M_MACTEMP);
375395fab37eSRobert Watson 	return (error);
375495fab37eSRobert Watson }
375595fab37eSRobert Watson 
375695fab37eSRobert Watson /*
375795fab37eSRobert Watson  * MPSAFE
375895fab37eSRobert Watson  */
375995fab37eSRobert Watson int
376095fab37eSRobert Watson __mac_set_proc(struct thread *td, struct __mac_set_proc_args *uap)
376195fab37eSRobert Watson {
376295fab37eSRobert Watson 	struct ucred *newcred, *oldcred;
376395fab37eSRobert Watson 	struct label intlabel;
3764f7b951a8SRobert Watson 	struct proc *p;
3765f7b951a8SRobert Watson 	struct mac mac;
3766f7b951a8SRobert Watson 	char *buffer;
376795fab37eSRobert Watson 	int error;
376895fab37eSRobert Watson 
3769f7b951a8SRobert Watson 	error = copyin(uap->mac_p, &mac, sizeof(mac));
377095fab37eSRobert Watson 	if (error)
377195fab37eSRobert Watson 		return (error);
377295fab37eSRobert Watson 
3773f7b951a8SRobert Watson 	error = mac_check_structmac_consistent(&mac);
377495fab37eSRobert Watson 	if (error)
377595fab37eSRobert Watson 		return (error);
377695fab37eSRobert Watson 
3777f7b951a8SRobert Watson 	buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK);
3778f7b951a8SRobert Watson 
3779f7b951a8SRobert Watson 	error = copyinstr(mac.m_string, buffer, mac.m_buflen, NULL);
3780f7b951a8SRobert Watson 	if (error) {
3781f7b951a8SRobert Watson 		free(buffer, M_MACTEMP);
3782f7b951a8SRobert Watson 		return (error);
3783f7b951a8SRobert Watson 	}
3784f7b951a8SRobert Watson 
3785f7b951a8SRobert Watson 	mac_init_cred_label(&intlabel);
3786f7b951a8SRobert Watson 	error = mac_internalize_cred_label(&intlabel, buffer);
3787f7b951a8SRobert Watson 	free(buffer, M_MACTEMP);
3788f7b951a8SRobert Watson 	if (error) {
3789f7b951a8SRobert Watson 		mac_destroy_cred_label(&intlabel);
3790f7b951a8SRobert Watson 		return (error);
3791f7b951a8SRobert Watson 	}
3792f7b951a8SRobert Watson 
379395fab37eSRobert Watson 	newcred = crget();
379495fab37eSRobert Watson 
379595fab37eSRobert Watson 	p = td->td_proc;
379695fab37eSRobert Watson 	PROC_LOCK(p);
379795fab37eSRobert Watson 	oldcred = p->p_ucred;
379895fab37eSRobert Watson 
379995fab37eSRobert Watson 	error = mac_check_cred_relabel(oldcred, &intlabel);
380095fab37eSRobert Watson 	if (error) {
380195fab37eSRobert Watson 		PROC_UNLOCK(p);
380295fab37eSRobert Watson 		crfree(newcred);
3803f7b951a8SRobert Watson 		goto out;
380495fab37eSRobert Watson 	}
380595fab37eSRobert Watson 
380695fab37eSRobert Watson 	setsugid(p);
380795fab37eSRobert Watson 	crcopy(newcred, oldcred);
380895fab37eSRobert Watson 	mac_relabel_cred(newcred, &intlabel);
380995fab37eSRobert Watson 	p->p_ucred = newcred;
3810e5cb5e37SRobert Watson 
3811e5cb5e37SRobert Watson 	/*
3812e5cb5e37SRobert Watson 	 * Grab additional reference for use while revoking mmaps, prior
3813e5cb5e37SRobert Watson 	 * to releasing the proc lock and sharing the cred.
3814e5cb5e37SRobert Watson 	 */
3815e5cb5e37SRobert Watson 	crhold(newcred);
381695fab37eSRobert Watson 	PROC_UNLOCK(p);
3817e5cb5e37SRobert Watson 
3818f7b951a8SRobert Watson 	if (mac_enforce_vm) {
381916140035SRobert Watson 		mtx_lock(&Giant);
3820e5cb5e37SRobert Watson 		mac_cred_mmapped_drop_perms(td, newcred);
382116140035SRobert Watson 		mtx_unlock(&Giant);
3822f7b951a8SRobert Watson 	}
3823e5cb5e37SRobert Watson 
3824e5cb5e37SRobert Watson 	crfree(newcred);	/* Free revocation reference. */
382595fab37eSRobert Watson 	crfree(oldcred);
3826f7b951a8SRobert Watson 
3827f7b951a8SRobert Watson out:
3828f7b951a8SRobert Watson 	mac_destroy_cred_label(&intlabel);
3829f7b951a8SRobert Watson 	return (error);
383095fab37eSRobert Watson }
383195fab37eSRobert Watson 
383295fab37eSRobert Watson /*
383395fab37eSRobert Watson  * MPSAFE
383495fab37eSRobert Watson  */
383595fab37eSRobert Watson int
383695fab37eSRobert Watson __mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap)
383795fab37eSRobert Watson {
3838f7b951a8SRobert Watson 	char *elements, *buffer;
3839f7b951a8SRobert Watson 	struct label intlabel;
384095fab37eSRobert Watson 	struct file *fp;
3841f7b951a8SRobert Watson 	struct mac mac;
384295fab37eSRobert Watson 	struct vnode *vp;
384395fab37eSRobert Watson 	struct pipe *pipe;
3844f7b951a8SRobert Watson 	short label_type;
384595fab37eSRobert Watson 	int error;
384695fab37eSRobert Watson 
3847f7b951a8SRobert Watson 	error = copyin(uap->mac_p, &mac, sizeof(mac));
3848f7b951a8SRobert Watson 	if (error)
3849f7b951a8SRobert Watson 		return (error);
385095fab37eSRobert Watson 
3851f7b951a8SRobert Watson 	error = mac_check_structmac_consistent(&mac);
3852f7b951a8SRobert Watson 	if (error)
3853f7b951a8SRobert Watson 		return (error);
3854f7b951a8SRobert Watson 
3855f7b951a8SRobert Watson 	elements = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK);
3856f7b951a8SRobert Watson 
3857f7b951a8SRobert Watson 	error = copyinstr(mac.m_string, elements, mac.m_buflen, NULL);
3858f7b951a8SRobert Watson 	if (error) {
3859f7b951a8SRobert Watson 		free(elements, M_MACTEMP);
3860f7b951a8SRobert Watson 		return (error);
3861f7b951a8SRobert Watson 	}
3862f7b951a8SRobert Watson 
3863f7b951a8SRobert Watson 	buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK | M_ZERO);
3864f7b951a8SRobert Watson 
3865f7b951a8SRobert Watson 	mtx_lock(&Giant);				/* VFS */
386695fab37eSRobert Watson 	error = fget(td, SCARG(uap, fd), &fp);
386795fab37eSRobert Watson 	if (error)
386895fab37eSRobert Watson 		goto out;
386995fab37eSRobert Watson 
3870f7b951a8SRobert Watson 	label_type = fp->f_type;
387195fab37eSRobert Watson 	switch (fp->f_type) {
387295fab37eSRobert Watson 	case DTYPE_FIFO:
387395fab37eSRobert Watson 	case DTYPE_VNODE:
387495fab37eSRobert Watson 		vp = (struct vnode *)fp->f_data;
387595fab37eSRobert Watson 
3876f7b951a8SRobert Watson 		mac_init_vnode_label(&intlabel);
3877f7b951a8SRobert Watson 
387895fab37eSRobert Watson 		vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td);
387995fab37eSRobert Watson 		error = vn_refreshlabel(vp, td->td_ucred);
388095fab37eSRobert Watson 		if (error == 0)
3881f7b951a8SRobert Watson 			mac_copy_vnode_label(&vp->v_label, &intlabel);
388295fab37eSRobert Watson 		VOP_UNLOCK(vp, 0, td);
3883f7b951a8SRobert Watson 
388495fab37eSRobert Watson 		break;
388595fab37eSRobert Watson 	case DTYPE_PIPE:
388695fab37eSRobert Watson 		pipe = (struct pipe *)fp->f_data;
3887f7b951a8SRobert Watson 
3888f7b951a8SRobert Watson 		mac_init_pipe_label(&intlabel);
3889f7b951a8SRobert Watson 
3890f7b951a8SRobert Watson 		PIPE_LOCK(pipe);
3891f7b951a8SRobert Watson 		mac_copy_pipe_label(pipe->pipe_label, &intlabel);
3892f7b951a8SRobert Watson 		PIPE_UNLOCK(pipe);
389395fab37eSRobert Watson 		break;
389495fab37eSRobert Watson 	default:
389595fab37eSRobert Watson 		error = EINVAL;
3896f7b951a8SRobert Watson 		fdrop(fp, td);
3897f7b951a8SRobert Watson 		goto out;
3898f7b951a8SRobert Watson 	}
3899f7b951a8SRobert Watson 	fdrop(fp, td);
3900f7b951a8SRobert Watson 
3901f7b951a8SRobert Watson 	switch (label_type) {
3902f7b951a8SRobert Watson 	case DTYPE_FIFO:
3903f7b951a8SRobert Watson 	case DTYPE_VNODE:
3904f7b951a8SRobert Watson 		if (error == 0)
3905f7b951a8SRobert Watson 			error = mac_externalize_vnode_label(&intlabel,
3906f7b951a8SRobert Watson 			    elements, buffer, mac.m_buflen, M_WAITOK);
3907f7b951a8SRobert Watson 		mac_destroy_vnode_label(&intlabel);
3908f7b951a8SRobert Watson 		break;
3909f7b951a8SRobert Watson 	case DTYPE_PIPE:
3910f7b951a8SRobert Watson 		error = mac_externalize_pipe_label(&intlabel, elements,
3911f7b951a8SRobert Watson 		    buffer, mac.m_buflen, M_WAITOK);
3912f7b951a8SRobert Watson 		mac_destroy_pipe_label(&intlabel);
3913f7b951a8SRobert Watson 		break;
3914f7b951a8SRobert Watson 	default:
3915f7b951a8SRobert Watson 		panic("__mac_get_fd: corrupted label_type");
391695fab37eSRobert Watson 	}
391795fab37eSRobert Watson 
391895fab37eSRobert Watson 	if (error == 0)
3919f7b951a8SRobert Watson 		error = copyout(buffer, mac.m_string, strlen(buffer)+1);
392095fab37eSRobert Watson 
392195fab37eSRobert Watson out:
3922f7b951a8SRobert Watson 	mtx_unlock(&Giant);				/* VFS */
3923f7b951a8SRobert Watson 	free(buffer, M_MACTEMP);
3924f7b951a8SRobert Watson 	free(elements, M_MACTEMP);
3925f7b951a8SRobert Watson 
392695fab37eSRobert Watson 	return (error);
392795fab37eSRobert Watson }
392895fab37eSRobert Watson 
392995fab37eSRobert Watson /*
393095fab37eSRobert Watson  * MPSAFE
393195fab37eSRobert Watson  */
393295fab37eSRobert Watson int
393395fab37eSRobert Watson __mac_get_file(struct thread *td, struct __mac_get_file_args *uap)
393495fab37eSRobert Watson {
3935f7b951a8SRobert Watson 	char *elements, *buffer;
393695fab37eSRobert Watson 	struct nameidata nd;
3937f7b951a8SRobert Watson 	struct label intlabel;
3938f7b951a8SRobert Watson 	struct mac mac;
393995fab37eSRobert Watson 	int error;
394095fab37eSRobert Watson 
3941f7b951a8SRobert Watson 	error = copyin(uap->mac_p, &mac, sizeof(mac));
3942f7b951a8SRobert Watson 	if (error)
3943f7b951a8SRobert Watson 		return (error);
3944f7b951a8SRobert Watson 
3945f7b951a8SRobert Watson 	error = mac_check_structmac_consistent(&mac);
3946f7b951a8SRobert Watson 	if (error)
3947f7b951a8SRobert Watson 		return (error);
3948f7b951a8SRobert Watson 
3949f7b951a8SRobert Watson 	elements = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK);
3950f7b951a8SRobert Watson 
3951f7b951a8SRobert Watson 	error = copyinstr(mac.m_string, elements, mac.m_buflen, NULL);
3952f7b951a8SRobert Watson 	if (error) {
3953f7b951a8SRobert Watson 		free(elements, M_MACTEMP);
3954f7b951a8SRobert Watson 		return (error);
3955f7b951a8SRobert Watson 	}
3956f7b951a8SRobert Watson 
3957f7b951a8SRobert Watson 	buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK | M_ZERO);
3958f7b951a8SRobert Watson 
3959f7b951a8SRobert Watson 	mtx_lock(&Giant);				/* VFS */
3960f7b951a8SRobert Watson 	NDINIT(&nd, LOOKUP, LOCKLEAF | FOLLOW, UIO_USERSPACE, uap->path_p,
3961f7b951a8SRobert Watson 	    td);
396295fab37eSRobert Watson 	error = namei(&nd);
396395fab37eSRobert Watson 	if (error)
396495fab37eSRobert Watson 		goto out;
396595fab37eSRobert Watson 
3966f7b951a8SRobert Watson 	mac_init_vnode_label(&intlabel);
396795fab37eSRobert Watson 	error = vn_refreshlabel(nd.ni_vp, td->td_ucred);
396895fab37eSRobert Watson 	if (error == 0)
3969f7b951a8SRobert Watson 		mac_copy_vnode_label(&nd.ni_vp->v_label, &intlabel);
3970f7b951a8SRobert Watson 	if (error == 0)
3971f7b951a8SRobert Watson 		error = mac_externalize_vnode_label(&intlabel, elements,
3972f7b951a8SRobert Watson 		    buffer, mac.m_buflen, M_WAITOK);
3973f7b951a8SRobert Watson 
397495fab37eSRobert Watson 	NDFREE(&nd, 0);
3975f7b951a8SRobert Watson 	mac_destroy_vnode_label(&intlabel);
3976f7b951a8SRobert Watson 
3977f7b951a8SRobert Watson 	if (error == 0)
3978f7b951a8SRobert Watson 		error = copyout(buffer, mac.m_string, strlen(buffer)+1);
3979f7b951a8SRobert Watson 
3980f7b951a8SRobert Watson out:
3981f7b951a8SRobert Watson 	mtx_unlock(&Giant);				/* VFS */
3982f7b951a8SRobert Watson 
3983f7b951a8SRobert Watson 	free(buffer, M_MACTEMP);
3984f7b951a8SRobert Watson 	free(elements, M_MACTEMP);
3985f7b951a8SRobert Watson 
3986f7b951a8SRobert Watson 	return (error);
3987f7b951a8SRobert Watson }
3988f7b951a8SRobert Watson 
3989f7b951a8SRobert Watson /*
3990f7b951a8SRobert Watson  * MPSAFE
3991f7b951a8SRobert Watson  */
3992f7b951a8SRobert Watson int
3993f7b951a8SRobert Watson __mac_get_link(struct thread *td, struct __mac_get_link_args *uap)
3994f7b951a8SRobert Watson {
3995f7b951a8SRobert Watson 	char *elements, *buffer;
3996f7b951a8SRobert Watson 	struct nameidata nd;
3997f7b951a8SRobert Watson 	struct label intlabel;
3998f7b951a8SRobert Watson 	struct mac mac;
3999f7b951a8SRobert Watson 	int error;
4000f7b951a8SRobert Watson 
4001f7b951a8SRobert Watson 	error = copyin(uap->mac_p, &mac, sizeof(mac));
4002f7b951a8SRobert Watson 	if (error)
4003f7b951a8SRobert Watson 		return (error);
4004f7b951a8SRobert Watson 
4005f7b951a8SRobert Watson 	error = mac_check_structmac_consistent(&mac);
4006f7b951a8SRobert Watson 	if (error)
4007f7b951a8SRobert Watson 		return (error);
4008f7b951a8SRobert Watson 
4009f7b951a8SRobert Watson 	elements = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK);
4010f7b951a8SRobert Watson 
4011f7b951a8SRobert Watson 	error = copyinstr(mac.m_string, elements, mac.m_buflen, NULL);
4012f7b951a8SRobert Watson 	if (error) {
4013f7b951a8SRobert Watson 		free(elements, M_MACTEMP);
4014f7b951a8SRobert Watson 		return (error);
4015f7b951a8SRobert Watson 	}
4016f7b951a8SRobert Watson 
4017f7b951a8SRobert Watson 	buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK | M_ZERO);
4018f7b951a8SRobert Watson 
4019f7b951a8SRobert Watson 	mtx_lock(&Giant);				/* VFS */
4020f7b951a8SRobert Watson 	NDINIT(&nd, LOOKUP, LOCKLEAF | NOFOLLOW, UIO_USERSPACE, uap->path_p,
4021f7b951a8SRobert Watson 	    td);
4022f7b951a8SRobert Watson 	error = namei(&nd);
402395fab37eSRobert Watson 	if (error)
402495fab37eSRobert Watson 		goto out;
402595fab37eSRobert Watson 
4026f7b951a8SRobert Watson 	mac_init_vnode_label(&intlabel);
4027f7b951a8SRobert Watson 	error = vn_refreshlabel(nd.ni_vp, td->td_ucred);
4028f7b951a8SRobert Watson 	if (error == 0)
4029f7b951a8SRobert Watson 		mac_copy_vnode_label(&nd.ni_vp->v_label, &intlabel);
4030f7b951a8SRobert Watson 	if (error == 0)
4031f7b951a8SRobert Watson 		error = mac_externalize_vnode_label(&intlabel, elements,
4032f7b951a8SRobert Watson 		    buffer, mac.m_buflen, M_WAITOK);
4033f7b951a8SRobert Watson 	NDFREE(&nd, 0);
4034f7b951a8SRobert Watson 	mac_destroy_vnode_label(&intlabel);
4035f7b951a8SRobert Watson 
4036f7b951a8SRobert Watson 	if (error == 0)
4037f7b951a8SRobert Watson 		error = copyout(buffer, mac.m_string, strlen(buffer)+1);
403895fab37eSRobert Watson 
403995fab37eSRobert Watson out:
4040f7b951a8SRobert Watson 	mtx_unlock(&Giant);				/* VFS */
4041f7b951a8SRobert Watson 
4042f7b951a8SRobert Watson 	free(buffer, M_MACTEMP);
4043f7b951a8SRobert Watson 	free(elements, M_MACTEMP);
4044f7b951a8SRobert Watson 
404595fab37eSRobert Watson 	return (error);
404695fab37eSRobert Watson }
404795fab37eSRobert Watson 
404895fab37eSRobert Watson /*
404995fab37eSRobert Watson  * MPSAFE
405095fab37eSRobert Watson  */
405195fab37eSRobert Watson int
405295fab37eSRobert Watson __mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap)
405395fab37eSRobert Watson {
405495fab37eSRobert Watson 	struct label intlabel;
4055f7b951a8SRobert Watson 	struct pipe *pipe;
4056f7b951a8SRobert Watson 	struct file *fp;
405795fab37eSRobert Watson 	struct mount *mp;
405895fab37eSRobert Watson 	struct vnode *vp;
4059f7b951a8SRobert Watson 	struct mac mac;
4060f7b951a8SRobert Watson 	char *buffer;
406195fab37eSRobert Watson 	int error;
406295fab37eSRobert Watson 
4063f7b951a8SRobert Watson 	error = copyin(uap->mac_p, &mac, sizeof(mac));
4064f7b951a8SRobert Watson 	if (error)
4065f7b951a8SRobert Watson 		return (error);
4066f7b951a8SRobert Watson 
4067f7b951a8SRobert Watson 	error = mac_check_structmac_consistent(&mac);
4068f7b951a8SRobert Watson 	if (error)
4069f7b951a8SRobert Watson 		return (error);
4070f7b951a8SRobert Watson 
4071f7b951a8SRobert Watson 	buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK);
4072f7b951a8SRobert Watson 
4073f7b951a8SRobert Watson 	error = copyinstr(mac.m_string, buffer, mac.m_buflen, NULL);
4074f7b951a8SRobert Watson 	if (error) {
4075f7b951a8SRobert Watson 		free(buffer, M_MACTEMP);
4076f7b951a8SRobert Watson 		return (error);
4077f7b951a8SRobert Watson 	}
4078f7b951a8SRobert Watson 
4079f7b951a8SRobert Watson 	mtx_lock(&Giant);				/* VFS */
4080f7b951a8SRobert Watson 
408195fab37eSRobert Watson 	error = fget(td, SCARG(uap, fd), &fp);
408295fab37eSRobert Watson 	if (error)
4083f7b951a8SRobert Watson 		goto out;
408495fab37eSRobert Watson 
408595fab37eSRobert Watson 	switch (fp->f_type) {
408695fab37eSRobert Watson 	case DTYPE_FIFO:
408795fab37eSRobert Watson 	case DTYPE_VNODE:
4088f7b951a8SRobert Watson 		mac_init_vnode_label(&intlabel);
4089f7b951a8SRobert Watson 		error = mac_internalize_vnode_label(&intlabel, buffer);
4090f7b951a8SRobert Watson 		if (error) {
4091f7b951a8SRobert Watson 			mac_destroy_vnode_label(&intlabel);
4092f7b951a8SRobert Watson 			break;
4093f7b951a8SRobert Watson 		}
4094f7b951a8SRobert Watson 
409595fab37eSRobert Watson 		vp = (struct vnode *)fp->f_data;
409695fab37eSRobert Watson 		error = vn_start_write(vp, &mp, V_WAIT | PCATCH);
4097f7b951a8SRobert Watson 		if (error != 0) {
4098f7b951a8SRobert Watson 			mac_destroy_vnode_label(&intlabel);
409995fab37eSRobert Watson 			break;
4100f7b951a8SRobert Watson 		}
410195fab37eSRobert Watson 
410295fab37eSRobert Watson 		vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td);
410395fab37eSRobert Watson 		error = vn_setlabel(vp, &intlabel, td->td_ucred);
410495fab37eSRobert Watson 		VOP_UNLOCK(vp, 0, td);
410595fab37eSRobert Watson 		vn_finished_write(mp);
4106f7b951a8SRobert Watson 
4107f7b951a8SRobert Watson 		mac_destroy_vnode_label(&intlabel);
410895fab37eSRobert Watson 		break;
4109f7b951a8SRobert Watson 
411095fab37eSRobert Watson 	case DTYPE_PIPE:
4111f7b951a8SRobert Watson 		mac_init_pipe_label(&intlabel);
4112f7b951a8SRobert Watson 		error = mac_internalize_pipe_label(&intlabel, buffer);
4113f7b951a8SRobert Watson 		if (error == 0) {
411495fab37eSRobert Watson 			pipe = (struct pipe *)fp->f_data;
41151aa37f53SRobert Watson 			PIPE_LOCK(pipe);
4116f7b951a8SRobert Watson 			error = mac_pipe_label_set(td->td_ucred, pipe,
4117f7b951a8SRobert Watson 			    &intlabel);
41181aa37f53SRobert Watson 			PIPE_UNLOCK(pipe);
4119f7b951a8SRobert Watson 		}
4120f7b951a8SRobert Watson 
4121f7b951a8SRobert Watson 		mac_destroy_pipe_label(&intlabel);
412295fab37eSRobert Watson 		break;
4123f7b951a8SRobert Watson 
412495fab37eSRobert Watson 	default:
412595fab37eSRobert Watson 		error = EINVAL;
412695fab37eSRobert Watson 	}
412795fab37eSRobert Watson 
412895fab37eSRobert Watson 	fdrop(fp, td);
4129f7b951a8SRobert Watson out:
4130f7b951a8SRobert Watson 	mtx_unlock(&Giant);				/* VFS */
4131f7b951a8SRobert Watson 
4132f7b951a8SRobert Watson 	free(buffer, M_MACTEMP);
4133f7b951a8SRobert Watson 
413495fab37eSRobert Watson 	return (error);
413595fab37eSRobert Watson }
413695fab37eSRobert Watson 
413795fab37eSRobert Watson /*
413895fab37eSRobert Watson  * MPSAFE
413995fab37eSRobert Watson  */
414095fab37eSRobert Watson int
414195fab37eSRobert Watson __mac_set_file(struct thread *td, struct __mac_set_file_args *uap)
414295fab37eSRobert Watson {
414395fab37eSRobert Watson 	struct label intlabel;
4144f7b951a8SRobert Watson 	struct nameidata nd;
414595fab37eSRobert Watson 	struct mount *mp;
4146f7b951a8SRobert Watson 	struct mac mac;
4147f7b951a8SRobert Watson 	char *buffer;
414895fab37eSRobert Watson 	int error;
414995fab37eSRobert Watson 
4150f7b951a8SRobert Watson 	error = copyin(uap->mac_p, &mac, sizeof(mac));
415195fab37eSRobert Watson 	if (error)
4152f7b951a8SRobert Watson 		return (error);
415395fab37eSRobert Watson 
4154f7b951a8SRobert Watson 	error = mac_check_structmac_consistent(&mac);
415595fab37eSRobert Watson 	if (error)
4156f7b951a8SRobert Watson 		return (error);
415795fab37eSRobert Watson 
4158f7b951a8SRobert Watson 	buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK);
415995fab37eSRobert Watson 
4160f7b951a8SRobert Watson 	error = copyinstr(mac.m_string, buffer, mac.m_buflen, NULL);
4161f7b951a8SRobert Watson 	if (error) {
4162f7b951a8SRobert Watson 		free(buffer, M_MACTEMP);
416395fab37eSRobert Watson 		return (error);
416495fab37eSRobert Watson 	}
416595fab37eSRobert Watson 
4166f7b951a8SRobert Watson 	mac_init_vnode_label(&intlabel);
4167f7b951a8SRobert Watson 	error = mac_internalize_vnode_label(&intlabel, buffer);
4168f7b951a8SRobert Watson 	free(buffer, M_MACTEMP);
4169f7b951a8SRobert Watson 	if (error) {
4170f7b951a8SRobert Watson 		mac_destroy_vnode_label(&intlabel);
4171f7b951a8SRobert Watson 		return (error);
4172f7b951a8SRobert Watson 	}
4173f7b951a8SRobert Watson 
4174f7b951a8SRobert Watson 	mtx_lock(&Giant);				/* VFS */
4175f7b951a8SRobert Watson 
4176f7b951a8SRobert Watson 	NDINIT(&nd, LOOKUP, LOCKLEAF | FOLLOW, UIO_USERSPACE, uap->path_p,
4177f7b951a8SRobert Watson 	    td);
4178f7b951a8SRobert Watson 	error = namei(&nd);
4179f7b951a8SRobert Watson 	if (error == 0) {
4180f7b951a8SRobert Watson 		error = vn_start_write(nd.ni_vp, &mp, V_WAIT | PCATCH);
4181f7b951a8SRobert Watson 		if (error == 0)
4182f7b951a8SRobert Watson 			error = vn_setlabel(nd.ni_vp, &intlabel,
4183f7b951a8SRobert Watson 			    td->td_ucred);
4184f7b951a8SRobert Watson 		vn_finished_write(mp);
4185f7b951a8SRobert Watson 	}
4186f7b951a8SRobert Watson 
4187f7b951a8SRobert Watson 	NDFREE(&nd, 0);
4188f7b951a8SRobert Watson 	mtx_unlock(&Giant);				/* VFS */
4189f7b951a8SRobert Watson 	mac_destroy_vnode_label(&intlabel);
4190f7b951a8SRobert Watson 
4191f7b951a8SRobert Watson 	return (error);
4192f7b951a8SRobert Watson }
4193f7b951a8SRobert Watson 
4194f7b951a8SRobert Watson /*
4195f7b951a8SRobert Watson  * MPSAFE
4196f7b951a8SRobert Watson  */
4197f7b951a8SRobert Watson int
4198f7b951a8SRobert Watson __mac_set_link(struct thread *td, struct __mac_set_link_args *uap)
4199f7b951a8SRobert Watson {
4200f7b951a8SRobert Watson 	struct label intlabel;
4201f7b951a8SRobert Watson 	struct nameidata nd;
4202f7b951a8SRobert Watson 	struct mount *mp;
4203f7b951a8SRobert Watson 	struct mac mac;
4204f7b951a8SRobert Watson 	char *buffer;
4205f7b951a8SRobert Watson 	int error;
4206f7b951a8SRobert Watson 
4207f7b951a8SRobert Watson 	error = copyin(uap->mac_p, &mac, sizeof(mac));
4208f7b951a8SRobert Watson 	if (error)
4209f7b951a8SRobert Watson 		return (error);
4210f7b951a8SRobert Watson 
4211f7b951a8SRobert Watson 	error = mac_check_structmac_consistent(&mac);
4212f7b951a8SRobert Watson 	if (error)
4213f7b951a8SRobert Watson 		return (error);
4214f7b951a8SRobert Watson 
4215f7b951a8SRobert Watson 	buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK);
4216f7b951a8SRobert Watson 
4217f7b951a8SRobert Watson 	error = copyinstr(mac.m_string, buffer, mac.m_buflen, NULL);
4218f7b951a8SRobert Watson 	if (error) {
4219f7b951a8SRobert Watson 		free(buffer, M_MACTEMP);
4220f7b951a8SRobert Watson 		return (error);
4221f7b951a8SRobert Watson 	}
4222f7b951a8SRobert Watson 
4223f7b951a8SRobert Watson 	mac_init_vnode_label(&intlabel);
4224f7b951a8SRobert Watson 	error = mac_internalize_vnode_label(&intlabel, buffer);
4225f7b951a8SRobert Watson 	free(buffer, M_MACTEMP);
4226f7b951a8SRobert Watson 	if (error) {
4227f7b951a8SRobert Watson 		mac_destroy_vnode_label(&intlabel);
4228f7b951a8SRobert Watson 		return (error);
4229f7b951a8SRobert Watson 	}
4230f7b951a8SRobert Watson 
4231f7b951a8SRobert Watson 	mtx_lock(&Giant);				/* VFS */
4232f7b951a8SRobert Watson 
4233f7b951a8SRobert Watson 	NDINIT(&nd, LOOKUP, LOCKLEAF | NOFOLLOW, UIO_USERSPACE, uap->path_p,
4234f7b951a8SRobert Watson 	    td);
4235f7b951a8SRobert Watson 	error = namei(&nd);
4236f7b951a8SRobert Watson 	if (error == 0) {
4237f7b951a8SRobert Watson 		error = vn_start_write(nd.ni_vp, &mp, V_WAIT | PCATCH);
4238f7b951a8SRobert Watson 		if (error == 0)
4239f7b951a8SRobert Watson 			error = vn_setlabel(nd.ni_vp, &intlabel,
4240f7b951a8SRobert Watson 			    td->td_ucred);
4241f7b951a8SRobert Watson 		vn_finished_write(mp);
4242f7b951a8SRobert Watson 	}
4243f7b951a8SRobert Watson 
4244f7b951a8SRobert Watson 	NDFREE(&nd, 0);
4245f7b951a8SRobert Watson 	mtx_unlock(&Giant);				/* VFS */
4246f7b951a8SRobert Watson 	mac_destroy_vnode_label(&intlabel);
4247f7b951a8SRobert Watson 
4248f7b951a8SRobert Watson 	return (error);
4249f7b951a8SRobert Watson }
4250f7b951a8SRobert Watson 
4251f7b951a8SRobert Watson /*
4252f7b951a8SRobert Watson  * MPSAFE
4253f7b951a8SRobert Watson  */
425427f2eac7SRobert Watson int
425527f2eac7SRobert Watson mac_syscall(struct thread *td, struct mac_syscall_args *uap)
425627f2eac7SRobert Watson {
425727f2eac7SRobert Watson 	struct mac_policy_conf *mpc;
425827f2eac7SRobert Watson 	char target[MAC_MAX_POLICY_NAME];
425927f2eac7SRobert Watson 	int error;
426027f2eac7SRobert Watson 
426127f2eac7SRobert Watson 	error = copyinstr(SCARG(uap, policy), target, sizeof(target), NULL);
426227f2eac7SRobert Watson 	if (error)
426327f2eac7SRobert Watson 		return (error);
426427f2eac7SRobert Watson 
426527f2eac7SRobert Watson 	error = ENOSYS;
426627f2eac7SRobert Watson 	MAC_POLICY_LIST_BUSY();
426727f2eac7SRobert Watson 	LIST_FOREACH(mpc, &mac_policy_list, mpc_list) {
426827f2eac7SRobert Watson 		if (strcmp(mpc->mpc_name, target) == 0 &&
426927f2eac7SRobert Watson 		    mpc->mpc_ops->mpo_syscall != NULL) {
427027f2eac7SRobert Watson 			error = mpc->mpc_ops->mpo_syscall(td,
427127f2eac7SRobert Watson 			    SCARG(uap, call), SCARG(uap, arg));
427227f2eac7SRobert Watson 			goto out;
427327f2eac7SRobert Watson 		}
427427f2eac7SRobert Watson 	}
427527f2eac7SRobert Watson 
427627f2eac7SRobert Watson out:
427727f2eac7SRobert Watson 	MAC_POLICY_LIST_UNBUSY();
427827f2eac7SRobert Watson 	return (error);
427927f2eac7SRobert Watson }
428027f2eac7SRobert Watson 
428195fab37eSRobert Watson SYSINIT(mac, SI_SUB_MAC, SI_ORDER_FIRST, mac_init, NULL);
428295fab37eSRobert Watson SYSINIT(mac_late, SI_SUB_MAC_LATE, SI_ORDER_FIRST, mac_late_init, NULL);
428395fab37eSRobert Watson 
428495fab37eSRobert Watson #else /* !MAC */
42857bc82500SRobert Watson 
42867bc82500SRobert Watson int
4287f7b951a8SRobert Watson __mac_get_pid(struct thread *td, struct __mac_get_pid_args *uap)
4288f7b951a8SRobert Watson {
4289f7b951a8SRobert Watson 
4290f7b951a8SRobert Watson 	return (ENOSYS);
4291f7b951a8SRobert Watson }
4292f7b951a8SRobert Watson 
4293f7b951a8SRobert Watson int
42947bc82500SRobert Watson __mac_get_proc(struct thread *td, struct __mac_get_proc_args *uap)
42957bc82500SRobert Watson {
42967bc82500SRobert Watson 
42977bc82500SRobert Watson 	return (ENOSYS);
42987bc82500SRobert Watson }
42997bc82500SRobert Watson 
43007bc82500SRobert Watson int
43017bc82500SRobert Watson __mac_set_proc(struct thread *td, struct __mac_set_proc_args *uap)
43027bc82500SRobert Watson {
43037bc82500SRobert Watson 
43047bc82500SRobert Watson 	return (ENOSYS);
43057bc82500SRobert Watson }
43067bc82500SRobert Watson 
43077bc82500SRobert Watson int
43087bc82500SRobert Watson __mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap)
43097bc82500SRobert Watson {
43107bc82500SRobert Watson 
43117bc82500SRobert Watson 	return (ENOSYS);
43127bc82500SRobert Watson }
43137bc82500SRobert Watson 
43147bc82500SRobert Watson int
43157bc82500SRobert Watson __mac_get_file(struct thread *td, struct __mac_get_file_args *uap)
43167bc82500SRobert Watson {
43177bc82500SRobert Watson 
43187bc82500SRobert Watson 	return (ENOSYS);
43197bc82500SRobert Watson }
43207bc82500SRobert Watson 
43217bc82500SRobert Watson int
4322f7b951a8SRobert Watson __mac_get_link(struct thread *td, struct __mac_get_link_args *uap)
4323f7b951a8SRobert Watson {
4324f7b951a8SRobert Watson 
4325f7b951a8SRobert Watson 	return (ENOSYS);
4326f7b951a8SRobert Watson }
4327f7b951a8SRobert Watson 
4328f7b951a8SRobert Watson int
43297bc82500SRobert Watson __mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap)
43307bc82500SRobert Watson {
43317bc82500SRobert Watson 
43327bc82500SRobert Watson 	return (ENOSYS);
43337bc82500SRobert Watson }
43347bc82500SRobert Watson 
43357bc82500SRobert Watson int
43367bc82500SRobert Watson __mac_set_file(struct thread *td, struct __mac_set_file_args *uap)
43377bc82500SRobert Watson {
43387bc82500SRobert Watson 
43397bc82500SRobert Watson 	return (ENOSYS);
43407bc82500SRobert Watson }
434195fab37eSRobert Watson 
434227f2eac7SRobert Watson int
4343f7b951a8SRobert Watson __mac_set_link(struct thread *td, struct __mac_set_link_args *uap)
4344f7b951a8SRobert Watson {
4345f7b951a8SRobert Watson 
4346f7b951a8SRobert Watson 	return (ENOSYS);
4347f7b951a8SRobert Watson }
4348f7b951a8SRobert Watson 
4349f7b951a8SRobert Watson int
435027f2eac7SRobert Watson mac_syscall(struct thread *td, struct mac_syscall_args *uap)
435127f2eac7SRobert Watson {
435227f2eac7SRobert Watson 
435327f2eac7SRobert Watson 	return (ENOSYS);
435427f2eac7SRobert Watson }
435527f2eac7SRobert Watson 
4356f7b951a8SRobert Watson #endif
4357