1ddcdf265SRobert Watson /*- 2f6a41092SRobert Watson * Copyright (c) 1999-2002 Robert N. M. Watson 37f53207bSRobert Watson * Copyright (c) 2001-2005 Networks Associates Technology, Inc. 4ddcdf265SRobert Watson * All rights reserved. 5ddcdf265SRobert Watson * 6ddcdf265SRobert Watson * This software was developed by Robert Watson for the TrustedBSD Project. 7ddcdf265SRobert Watson * 86201265bSRobert Watson * This software was developed for the FreeBSD Project in part by Network 96201265bSRobert Watson * Associates Laboratories, the Security Research Division of Network 106201265bSRobert Watson * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), 116201265bSRobert Watson * as part of the DARPA CHATS research program. 12ddcdf265SRobert Watson * 13ddcdf265SRobert Watson * Redistribution and use in source and binary forms, with or without 14ddcdf265SRobert Watson * modification, are permitted provided that the following conditions 15ddcdf265SRobert Watson * are met: 16ddcdf265SRobert Watson * 1. Redistributions of source code must retain the above copyright 17ddcdf265SRobert Watson * notice, this list of conditions and the following disclaimer. 18ddcdf265SRobert Watson * 2. Redistributions in binary form must reproduce the above copyright 19ddcdf265SRobert Watson * notice, this list of conditions and the following disclaimer in the 20ddcdf265SRobert Watson * documentation and/or other materials provided with the distribution. 21ddcdf265SRobert Watson * 22ddcdf265SRobert Watson * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 23ddcdf265SRobert Watson * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 24ddcdf265SRobert Watson * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 25ddcdf265SRobert Watson * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 26ddcdf265SRobert Watson * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 27ddcdf265SRobert Watson * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 28ddcdf265SRobert Watson * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 29ddcdf265SRobert Watson * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 30ddcdf265SRobert Watson * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 31ddcdf265SRobert Watson * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 32ddcdf265SRobert Watson * SUCH DAMAGE. 33ddcdf265SRobert Watson * 34ddcdf265SRobert Watson * $FreeBSD$ 35ddcdf265SRobert Watson */ 36ddcdf265SRobert Watson /* 37ddcdf265SRobert Watson * Kernel interface for MAC policy modules. 38ddcdf265SRobert Watson */ 3902ebd2bcSRobert Watson #ifndef _SYS_MAC_POLICY_H_ 4002ebd2bcSRobert Watson #define _SYS_MAC_POLICY_H_ 41ddcdf265SRobert Watson 42ddcdf265SRobert Watson /*- 43ddcdf265SRobert Watson * Pluggable access control policy definition structure. 44ddcdf265SRobert Watson * 45ddcdf265SRobert Watson * List of operations that are performed as part of the implementation 46ddcdf265SRobert Watson * of a MAC policy. Policy implementors declare operations with a 47ddcdf265SRobert Watson * mac_policy_ops structure, and using the MAC_POLICY_SET() macro. 48ddcdf265SRobert Watson * If an entry point is not declared, then then the policy will be ignored 49ddcdf265SRobert Watson * during evaluation of that event or check. 50ddcdf265SRobert Watson * 51ddcdf265SRobert Watson * Operations are sorted first by general class of operation, then 52ddcdf265SRobert Watson * alphabetically. 53ddcdf265SRobert Watson */ 5416fd30bdSRobert Watson struct acl; 55f47cb886SRobert Watson struct bpf_d; 5616fd30bdSRobert Watson struct componentname; 5716fd30bdSRobert Watson struct devfs_dirent; 58f47cb886SRobert Watson struct ifnet; 59f47cb886SRobert Watson struct image_params; 60a557af22SRobert Watson struct inpcb; 6116fd30bdSRobert Watson struct ipq; 6216fd30bdSRobert Watson struct label; 63ddcdf265SRobert Watson struct mac_policy_conf; 6416fd30bdSRobert Watson struct mbuf; 6516fd30bdSRobert Watson struct mount; 6642726d8aSRobert Watson struct msqid_kernel; 674795b82cSRobert Watson struct pipepair; 68f97e834bSRobert Watson struct proc; 69f51e5803SRobert Watson struct sbuf; 7042726d8aSRobert Watson struct semid_kernel; 7142726d8aSRobert Watson struct shmid_kernel; 72f97e834bSRobert Watson struct sockaddr; 7316fd30bdSRobert Watson struct socket; 7463dba32bSPawel Jakub Dawidek struct sysctl_oid; 7563dba32bSPawel Jakub Dawidek struct sysctl_req; 76f97e834bSRobert Watson struct thread; 7716fd30bdSRobert Watson struct ucred; 7816fd30bdSRobert Watson struct uio; 79f47cb886SRobert Watson struct vattr; 8016fd30bdSRobert Watson struct vnode; 81ddcdf265SRobert Watson struct mac_policy_ops { 82ddcdf265SRobert Watson /* 83ddcdf265SRobert Watson * Policy module operations. 84ddcdf265SRobert Watson */ 85ddcdf265SRobert Watson void (*mpo_destroy)(struct mac_policy_conf *mpc); 86ddcdf265SRobert Watson void (*mpo_init)(struct mac_policy_conf *mpc); 87ddcdf265SRobert Watson 88ddcdf265SRobert Watson /* 893459e1d2SRobert Watson * General policy-directed security system call so that policies may 903459e1d2SRobert Watson * implement new services without reserving explicit system call 913459e1d2SRobert Watson * numbers. 9227f2eac7SRobert Watson */ 9327f2eac7SRobert Watson int (*mpo_syscall)(struct thread *td, int call, void *arg); 9427f2eac7SRobert Watson 9527f2eac7SRobert Watson /* 963459e1d2SRobert Watson * Label operations. Initialize label storage, destroy label 973459e1d2SRobert Watson * storage, recycle for re-use without init/destroy, copy a label to 983459e1d2SRobert Watson * initialized storage, and externalize/internalize from/to 993459e1d2SRobert Watson * initialized storage. 100ddcdf265SRobert Watson */ 10196adb909SRobert Watson void (*mpo_init_bpfdesc_label)(struct label *label); 10296adb909SRobert Watson void (*mpo_init_cred_label)(struct label *label); 10396adb909SRobert Watson void (*mpo_init_devfsdirent_label)(struct label *label); 10496adb909SRobert Watson void (*mpo_init_ifnet_label)(struct label *label); 105a557af22SRobert Watson int (*mpo_init_inpcb_label)(struct label *label, int flag); 10642726d8aSRobert Watson void (*mpo_init_sysv_msgmsg_label)(struct label *label); 10742726d8aSRobert Watson void (*mpo_init_sysv_msgqueue_label)(struct label *label); 10842726d8aSRobert Watson void (*mpo_init_sysv_sema_label)(struct label *label); 10942726d8aSRobert Watson void (*mpo_init_sysv_shm_label)(struct label *label); 1105e7ce478SRobert Watson int (*mpo_init_ipq_label)(struct label *label, int flag); 11196adb909SRobert Watson int (*mpo_init_mbuf_label)(struct label *label, int flag); 11296adb909SRobert Watson void (*mpo_init_mount_label)(struct label *label); 11396adb909SRobert Watson void (*mpo_init_mount_fs_label)(struct label *label); 11483985c26SRobert Watson int (*mpo_init_socket_label)(struct label *label, int flag); 11583985c26SRobert Watson int (*mpo_init_socket_peer_label)(struct label *label, int flag); 11696adb909SRobert Watson void (*mpo_init_pipe_label)(struct label *label); 1172555374cSRobert Watson void (*mpo_init_proc_label)(struct label *label); 11896adb909SRobert Watson void (*mpo_init_vnode_label)(struct label *label); 11996adb909SRobert Watson void (*mpo_destroy_bpfdesc_label)(struct label *label); 12096adb909SRobert Watson void (*mpo_destroy_cred_label)(struct label *label); 12196adb909SRobert Watson void (*mpo_destroy_devfsdirent_label)(struct label *label); 12296adb909SRobert Watson void (*mpo_destroy_ifnet_label)(struct label *label); 123a557af22SRobert Watson void (*mpo_destroy_inpcb_label)(struct label *label); 12442726d8aSRobert Watson void (*mpo_destroy_sysv_msgmsg_label)(struct label *label); 12542726d8aSRobert Watson void (*mpo_destroy_sysv_msgqueue_label)(struct label *label); 12642726d8aSRobert Watson void (*mpo_destroy_sysv_sema_label)(struct label *label); 12742726d8aSRobert Watson void (*mpo_destroy_sysv_shm_label)(struct label *label); 12896adb909SRobert Watson void (*mpo_destroy_ipq_label)(struct label *label); 12996adb909SRobert Watson void (*mpo_destroy_mbuf_label)(struct label *label); 13096adb909SRobert Watson void (*mpo_destroy_mount_label)(struct label *label); 13196adb909SRobert Watson void (*mpo_destroy_mount_fs_label)(struct label *label); 13296adb909SRobert Watson void (*mpo_destroy_socket_label)(struct label *label); 13396adb909SRobert Watson void (*mpo_destroy_socket_peer_label)(struct label *label); 13496adb909SRobert Watson void (*mpo_destroy_pipe_label)(struct label *label); 1352555374cSRobert Watson void (*mpo_destroy_proc_label)(struct label *label); 13696adb909SRobert Watson void (*mpo_destroy_vnode_label)(struct label *label); 13742726d8aSRobert Watson void (*mpo_cleanup_sysv_msgmsg)(struct label *msglabel); 13842726d8aSRobert Watson void (*mpo_cleanup_sysv_msgqueue)(struct label *msqlabel); 13942726d8aSRobert Watson void (*mpo_cleanup_sysv_sema)(struct label *semalabel); 14042726d8aSRobert Watson void (*mpo_cleanup_sysv_shm)(struct label *shmlabel); 14156d9e932SRobert Watson void (*mpo_copy_cred_label)(struct label *src, 14256d9e932SRobert Watson struct label *dest); 1432220907bSRobert Watson void (*mpo_copy_ifnet_label)(struct label *src, 1442220907bSRobert Watson struct label *dest); 145225bff6fSRobert Watson void (*mpo_copy_mbuf_label)(struct label *src, 146225bff6fSRobert Watson struct label *dest); 147475b9d0aSRobert Watson void (*mpo_copy_pipe_label)(struct label *src, 148475b9d0aSRobert Watson struct label *dest); 149b0323ea3SRobert Watson void (*mpo_copy_socket_label)(struct label *src, 150b0323ea3SRobert Watson struct label *dest); 151475b9d0aSRobert Watson void (*mpo_copy_vnode_label)(struct label *src, 152475b9d0aSRobert Watson struct label *dest); 153475b9d0aSRobert Watson int (*mpo_externalize_cred_label)(struct label *label, 154f51e5803SRobert Watson char *element_name, struct sbuf *sb, int *claimed); 155475b9d0aSRobert Watson int (*mpo_externalize_ifnet_label)(struct label *label, 156f51e5803SRobert Watson char *element_name, struct sbuf *sb, int *claimed); 157475b9d0aSRobert Watson int (*mpo_externalize_pipe_label)(struct label *label, 158f51e5803SRobert Watson char *element_name, struct sbuf *sb, int *claimed); 159475b9d0aSRobert Watson int (*mpo_externalize_socket_label)(struct label *label, 160f51e5803SRobert Watson char *element_name, struct sbuf *sb, int *claimed); 161475b9d0aSRobert Watson int (*mpo_externalize_socket_peer_label)(struct label *label, 162f51e5803SRobert Watson char *element_name, struct sbuf *sb, int *claimed); 163475b9d0aSRobert Watson int (*mpo_externalize_vnode_label)(struct label *label, 164f51e5803SRobert Watson char *element_name, struct sbuf *sb, int *claimed); 165475b9d0aSRobert Watson int (*mpo_internalize_cred_label)(struct label *label, 166475b9d0aSRobert Watson char *element_name, char *element_data, int *claimed); 167475b9d0aSRobert Watson int (*mpo_internalize_ifnet_label)(struct label *label, 168475b9d0aSRobert Watson char *element_name, char *element_data, int *claimed); 169475b9d0aSRobert Watson int (*mpo_internalize_pipe_label)(struct label *label, 170475b9d0aSRobert Watson char *element_name, char *element_data, int *claimed); 171475b9d0aSRobert Watson int (*mpo_internalize_socket_label)(struct label *label, 172475b9d0aSRobert Watson char *element_name, char *element_data, int *claimed); 173475b9d0aSRobert Watson int (*mpo_internalize_vnode_label)(struct label *label, 174475b9d0aSRobert Watson char *element_name, char *element_data, int *claimed); 175ddcdf265SRobert Watson 176ddcdf265SRobert Watson /* 177ddcdf265SRobert Watson * Labeling event operations: file system objects, and things that 178ddcdf265SRobert Watson * look a lot like file system objects. 179ddcdf265SRobert Watson */ 180763bbd2fSRobert Watson void (*mpo_associate_vnode_devfs)(struct mount *mp, 181763bbd2fSRobert Watson struct label *fslabel, struct devfs_dirent *de, 182763bbd2fSRobert Watson struct label *delabel, struct vnode *vp, 183763bbd2fSRobert Watson struct label *vlabel); 184763bbd2fSRobert Watson int (*mpo_associate_vnode_extattr)(struct mount *mp, 185763bbd2fSRobert Watson struct label *fslabel, struct vnode *vp, 186763bbd2fSRobert Watson struct label *vlabel); 187763bbd2fSRobert Watson void (*mpo_associate_vnode_singlelabel)(struct mount *mp, 188763bbd2fSRobert Watson struct label *fslabel, struct vnode *vp, 189763bbd2fSRobert Watson struct label *vlabel); 19089c9c53dSPoul-Henning Kamp void (*mpo_create_devfs_device)(struct mount *mp, struct cdev *dev, 191ddcdf265SRobert Watson struct devfs_dirent *de, struct label *label); 192990b4b2dSRobert Watson void (*mpo_create_devfs_directory)(struct mount *mp, char *dirname, 193990b4b2dSRobert Watson int dirnamelen, struct devfs_dirent *de, 194990b4b2dSRobert Watson struct label *label); 19574e62b1bSRobert Watson void (*mpo_create_devfs_symlink)(struct ucred *cred, 196990b4b2dSRobert Watson struct mount *mp, struct devfs_dirent *dd, 197990b4b2dSRobert Watson struct label *ddlabel, struct devfs_dirent *de, 198990b4b2dSRobert Watson struct label *delabel); 199763bbd2fSRobert Watson int (*mpo_create_vnode_extattr)(struct ucred *cred, 200763bbd2fSRobert Watson struct mount *mp, struct label *fslabel, 201763bbd2fSRobert Watson struct vnode *dvp, struct label *dlabel, 202763bbd2fSRobert Watson struct vnode *vp, struct label *vlabel, 203763bbd2fSRobert Watson struct componentname *cnp); 204ddcdf265SRobert Watson void (*mpo_create_mount)(struct ucred *cred, struct mount *mp, 205ddcdf265SRobert Watson struct label *mntlabel, struct label *fslabel); 206ddcdf265SRobert Watson void (*mpo_create_root_mount)(struct ucred *cred, struct mount *mp, 207ddcdf265SRobert Watson struct label *mountlabel, struct label *fslabel); 208ddcdf265SRobert Watson void (*mpo_relabel_vnode)(struct ucred *cred, struct vnode *vp, 209ddcdf265SRobert Watson struct label *vnodelabel, struct label *label); 210763bbd2fSRobert Watson int (*mpo_setlabel_vnode_extattr)(struct ucred *cred, 211763bbd2fSRobert Watson struct vnode *vp, struct label *vlabel, 212763bbd2fSRobert Watson struct label *intlabel); 213990b4b2dSRobert Watson void (*mpo_update_devfsdirent)(struct mount *mp, 214990b4b2dSRobert Watson struct devfs_dirent *devfs_dirent, 215ddcdf265SRobert Watson struct label *direntlabel, struct vnode *vp, 216ddcdf265SRobert Watson struct label *vnodelabel); 217ddcdf265SRobert Watson 218ddcdf265SRobert Watson /* 219ddcdf265SRobert Watson * Labeling event operations: IPC objects. 220ddcdf265SRobert Watson */ 221ddcdf265SRobert Watson void (*mpo_create_mbuf_from_socket)(struct socket *so, 222ddcdf265SRobert Watson struct label *socketlabel, struct mbuf *m, 223ddcdf265SRobert Watson struct label *mbuflabel); 224ddcdf265SRobert Watson void (*mpo_create_socket)(struct ucred *cred, struct socket *so, 225ddcdf265SRobert Watson struct label *socketlabel); 226ddcdf265SRobert Watson void (*mpo_create_socket_from_socket)(struct socket *oldsocket, 227ddcdf265SRobert Watson struct label *oldsocketlabel, struct socket *newsocket, 228ddcdf265SRobert Watson struct label *newsocketlabel); 229ddcdf265SRobert Watson void (*mpo_relabel_socket)(struct ucred *cred, struct socket *so, 230ddcdf265SRobert Watson struct label *oldlabel, struct label *newlabel); 2314795b82cSRobert Watson void (*mpo_relabel_pipe)(struct ucred *cred, struct pipepair *pp, 232ddcdf265SRobert Watson struct label *oldlabel, struct label *newlabel); 233ddcdf265SRobert Watson void (*mpo_set_socket_peer_from_mbuf)(struct mbuf *mbuf, 234ddcdf265SRobert Watson struct label *mbuflabel, struct socket *so, 235ddcdf265SRobert Watson struct label *socketpeerlabel); 236ddcdf265SRobert Watson void (*mpo_set_socket_peer_from_socket)(struct socket *oldsocket, 237ddcdf265SRobert Watson struct label *oldsocketlabel, struct socket *newsocket, 238ddcdf265SRobert Watson struct label *newsocketpeerlabel); 2394795b82cSRobert Watson void (*mpo_create_pipe)(struct ucred *cred, struct pipepair *pp, 240ddcdf265SRobert Watson struct label *pipelabel); 241ddcdf265SRobert Watson 242ddcdf265SRobert Watson /* 24342726d8aSRobert Watson * Labeling event operations: System V IPC primitives. 24442726d8aSRobert Watson */ 24542726d8aSRobert Watson void (*mpo_create_sysv_msgmsg)(struct ucred *cred, 24642726d8aSRobert Watson struct msqid_kernel *msqkptr, struct label *msqlabel, 24742726d8aSRobert Watson struct msg *msgptr, struct label *msglabel); 24842726d8aSRobert Watson void (*mpo_create_sysv_msgqueue)(struct ucred *cred, 24942726d8aSRobert Watson struct msqid_kernel *msqkptr, struct label *msqlabel); 25042726d8aSRobert Watson void (*mpo_create_sysv_sema)(struct ucred *cred, 25142726d8aSRobert Watson struct semid_kernel *semakptr, struct label *semalabel); 25242726d8aSRobert Watson void (*mpo_create_sysv_shm)(struct ucred *cred, 25342726d8aSRobert Watson struct shmid_kernel *shmsegptr, struct label *shmlabel); 25442726d8aSRobert Watson 25542726d8aSRobert Watson /* 256ddcdf265SRobert Watson * Labeling event operations: network objects. 257ddcdf265SRobert Watson */ 258ddcdf265SRobert Watson void (*mpo_create_bpfdesc)(struct ucred *cred, struct bpf_d *bpf_d, 259ddcdf265SRobert Watson struct label *bpflabel); 260ddcdf265SRobert Watson void (*mpo_create_ifnet)(struct ifnet *ifnet, 261ddcdf265SRobert Watson struct label *ifnetlabel); 262a557af22SRobert Watson void (*mpo_create_inpcb_from_socket)(struct socket *so, 263a557af22SRobert Watson struct label *solabel, struct inpcb *inp, 264a557af22SRobert Watson struct label *inplabel); 265ddcdf265SRobert Watson void (*mpo_create_ipq)(struct mbuf *fragment, 266ddcdf265SRobert Watson struct label *fragmentlabel, struct ipq *ipq, 267ddcdf265SRobert Watson struct label *ipqlabel); 268ddcdf265SRobert Watson void (*mpo_create_datagram_from_ipq) 269ddcdf265SRobert Watson (struct ipq *ipq, struct label *ipqlabel, 270ddcdf265SRobert Watson struct mbuf *datagram, struct label *datagramlabel); 271ddcdf265SRobert Watson void (*mpo_create_fragment)(struct mbuf *datagram, 272ddcdf265SRobert Watson struct label *datagramlabel, struct mbuf *fragment, 273ddcdf265SRobert Watson struct label *fragmentlabel); 2742d92ec98SRobert Watson void (*mpo_create_mbuf_from_inpcb)(struct inpcb *inp, 2752d92ec98SRobert Watson struct label *inplabel, struct mbuf *m, 2762d92ec98SRobert Watson struct label *mlabel); 277ddcdf265SRobert Watson void (*mpo_create_mbuf_from_mbuf)(struct mbuf *oldmbuf, 278ddcdf265SRobert Watson struct label *oldlabel, struct mbuf *newmbuf, 279ddcdf265SRobert Watson struct label *newlabel); 280ddcdf265SRobert Watson void (*mpo_create_mbuf_linklayer)(struct ifnet *ifnet, 281ddcdf265SRobert Watson struct label *ifnetlabel, struct mbuf *mbuf, 282ddcdf265SRobert Watson struct label *mbuflabel); 283ddcdf265SRobert Watson void (*mpo_create_mbuf_from_bpfdesc)(struct bpf_d *bpf_d, 284ddcdf265SRobert Watson struct label *bpflabel, struct mbuf *mbuf, 285ddcdf265SRobert Watson struct label *mbuflabel); 286ddcdf265SRobert Watson void (*mpo_create_mbuf_from_ifnet)(struct ifnet *ifnet, 287ddcdf265SRobert Watson struct label *ifnetlabel, struct mbuf *mbuf, 288ddcdf265SRobert Watson struct label *mbuflabel); 289ddcdf265SRobert Watson void (*mpo_create_mbuf_multicast_encap)(struct mbuf *oldmbuf, 290ddcdf265SRobert Watson struct label *oldmbuflabel, struct ifnet *ifnet, 291ddcdf265SRobert Watson struct label *ifnetlabel, struct mbuf *newmbuf, 292ddcdf265SRobert Watson struct label *newmbuflabel); 293ddcdf265SRobert Watson void (*mpo_create_mbuf_netlayer)(struct mbuf *oldmbuf, 294ddcdf265SRobert Watson struct label *oldmbuflabel, struct mbuf *newmbuf, 295ddcdf265SRobert Watson struct label *newmbuflabel); 296ddcdf265SRobert Watson int (*mpo_fragment_match)(struct mbuf *fragment, 297ddcdf265SRobert Watson struct label *fragmentlabel, struct ipq *ipq, 298ddcdf265SRobert Watson struct label *ipqlabel); 299eb8c7f99SRobert Watson void (*mpo_reflect_mbuf_icmp)(struct mbuf *m, 300eb8c7f99SRobert Watson struct label *mlabel); 301eb8c7f99SRobert Watson void (*mpo_reflect_mbuf_tcp)(struct mbuf *m, struct label *mlabel); 302ddcdf265SRobert Watson void (*mpo_relabel_ifnet)(struct ucred *cred, struct ifnet *ifnet, 303ddcdf265SRobert Watson struct label *ifnetlabel, struct label *newlabel); 304ddcdf265SRobert Watson void (*mpo_update_ipq)(struct mbuf *fragment, 305ddcdf265SRobert Watson struct label *fragmentlabel, struct ipq *ipq, 306ddcdf265SRobert Watson struct label *ipqlabel); 307a557af22SRobert Watson void (*mpo_inpcb_sosetlabel)(struct socket *so, 308a557af22SRobert Watson struct label *label, struct inpcb *inp, 309a557af22SRobert Watson struct label *inplabel); 310ddcdf265SRobert Watson 311ddcdf265SRobert Watson /* 312ddcdf265SRobert Watson * Labeling event operations: processes. 313ddcdf265SRobert Watson */ 314ddcdf265SRobert Watson void (*mpo_execve_transition)(struct ucred *old, struct ucred *new, 315670cb89bSRobert Watson struct vnode *vp, struct label *vnodelabel, 316670cb89bSRobert Watson struct label *interpvnodelabel, 3179fa3506eSRobert Watson struct image_params *imgp, struct label *execlabel); 318ddcdf265SRobert Watson int (*mpo_execve_will_transition)(struct ucred *old, 319670cb89bSRobert Watson struct vnode *vp, struct label *vnodelabel, 320670cb89bSRobert Watson struct label *interpvnodelabel, 3219fa3506eSRobert Watson struct image_params *imgp, struct label *execlabel); 322ddcdf265SRobert Watson void (*mpo_create_proc0)(struct ucred *cred); 323ddcdf265SRobert Watson void (*mpo_create_proc1)(struct ucred *cred); 324ddcdf265SRobert Watson void (*mpo_relabel_cred)(struct ucred *cred, 325ddcdf265SRobert Watson struct label *newlabel); 32692dbb82aSRobert Watson void (*mpo_thread_userret)(struct thread *thread); 327ddcdf265SRobert Watson 328ddcdf265SRobert Watson /* 329ddcdf265SRobert Watson * Access control checks. 330ddcdf265SRobert Watson */ 331ddcdf265SRobert Watson int (*mpo_check_bpfdesc_receive)(struct bpf_d *bpf_d, 332ddcdf265SRobert Watson struct label *bpflabel, struct ifnet *ifnet, 333ddcdf265SRobert Watson struct label *ifnetlabel); 334ddcdf265SRobert Watson int (*mpo_check_cred_relabel)(struct ucred *cred, 335ddcdf265SRobert Watson struct label *newlabel); 336ddcdf265SRobert Watson int (*mpo_check_cred_visible)(struct ucred *u1, struct ucred *u2); 337ddcdf265SRobert Watson int (*mpo_check_ifnet_relabel)(struct ucred *cred, 338ddcdf265SRobert Watson struct ifnet *ifnet, struct label *ifnetlabel, 339ddcdf265SRobert Watson struct label *newlabel); 340ddcdf265SRobert Watson int (*mpo_check_ifnet_transmit)(struct ifnet *ifnet, 341ddcdf265SRobert Watson struct label *ifnetlabel, struct mbuf *m, 342ddcdf265SRobert Watson struct label *mbuflabel); 343a557af22SRobert Watson int (*mpo_check_inpcb_deliver)(struct inpcb *inp, 344a557af22SRobert Watson struct label *inplabel, struct mbuf *m, 345a557af22SRobert Watson struct label *mlabel); 34642726d8aSRobert Watson int (*mpo_check_sysv_msgmsq)(struct ucred *cred, 34742726d8aSRobert Watson struct msg *msgptr, struct label *msglabel, 34842726d8aSRobert Watson struct msqid_kernel *msqkptr, struct label *msqklabel); 34942726d8aSRobert Watson int (*mpo_check_sysv_msgrcv)(struct ucred *cred, 35042726d8aSRobert Watson struct msg *msgptr, struct label *msglabel); 35142726d8aSRobert Watson int (*mpo_check_sysv_msgrmid)(struct ucred *cred, 35242726d8aSRobert Watson struct msg *msgptr, struct label *msglabel); 35342726d8aSRobert Watson int (*mpo_check_sysv_msqget)(struct ucred *cred, 35442726d8aSRobert Watson struct msqid_kernel *msqkptr, struct label *msqklabel); 35542726d8aSRobert Watson int (*mpo_check_sysv_msqsnd)(struct ucred *cred, 35642726d8aSRobert Watson struct msqid_kernel *msqkptr, struct label *msqklabel); 35742726d8aSRobert Watson int (*mpo_check_sysv_msqrcv)(struct ucred *cred, 35842726d8aSRobert Watson struct msqid_kernel *msqkptr, struct label *msqklabel); 35942726d8aSRobert Watson int (*mpo_check_sysv_msqctl)(struct ucred *cred, 36042726d8aSRobert Watson struct msqid_kernel *msqkptr, struct label *msqklabel, 36142726d8aSRobert Watson int cmd); 36242726d8aSRobert Watson int (*mpo_check_sysv_semctl)(struct ucred *cred, 36342726d8aSRobert Watson struct semid_kernel *semakptr, struct label *semaklabel, 36442726d8aSRobert Watson int cmd); 36542726d8aSRobert Watson int (*mpo_check_sysv_semget)(struct ucred *cred, 36642726d8aSRobert Watson struct semid_kernel *semakptr, struct label *semaklabel); 36742726d8aSRobert Watson int (*mpo_check_sysv_semop)(struct ucred *cred, 36842726d8aSRobert Watson struct semid_kernel *semakptr, struct label *semaklabel, 36942726d8aSRobert Watson size_t accesstype); 37042726d8aSRobert Watson int (*mpo_check_sysv_shmat)(struct ucred *cred, 37142726d8aSRobert Watson struct shmid_kernel *shmsegptr, 37242726d8aSRobert Watson struct label *shmseglabel, int shmflg); 37342726d8aSRobert Watson int (*mpo_check_sysv_shmctl)(struct ucred *cred, 37442726d8aSRobert Watson struct shmid_kernel *shmsegptr, 37542726d8aSRobert Watson struct label *shmseglabel, int cmd); 37642726d8aSRobert Watson int (*mpo_check_sysv_shmdt)(struct ucred *cred, 37742726d8aSRobert Watson struct shmid_kernel *shmsegptr, 37842726d8aSRobert Watson struct label *shmseglabel); 37942726d8aSRobert Watson int (*mpo_check_sysv_shmget)(struct ucred *cred, 38042726d8aSRobert Watson struct shmid_kernel *shmsegptr, 38142726d8aSRobert Watson struct label *shmseglabel, int shmflg); 382e686e5aeSRobert Watson int (*mpo_check_kenv_dump)(struct ucred *cred); 383e686e5aeSRobert Watson int (*mpo_check_kenv_get)(struct ucred *cred, char *name); 384e686e5aeSRobert Watson int (*mpo_check_kenv_set)(struct ucred *cred, char *name, 385e686e5aeSRobert Watson char *value); 386e686e5aeSRobert Watson int (*mpo_check_kenv_unset)(struct ucred *cred, char *name); 387a3df768bSRobert Watson int (*mpo_check_kld_load)(struct ucred *cred, struct vnode *vp, 388a3df768bSRobert Watson struct label *vlabel); 389a3df768bSRobert Watson int (*mpo_check_kld_stat)(struct ucred *cred); 390a3df768bSRobert Watson int (*mpo_check_kld_unload)(struct ucred *cred); 391ddcdf265SRobert Watson int (*mpo_check_mount_stat)(struct ucred *cred, struct mount *mp, 392ddcdf265SRobert Watson struct label *mntlabel); 3934795b82cSRobert Watson int (*mpo_check_pipe_ioctl)(struct ucred *cred, 3944795b82cSRobert Watson struct pipepair *pp, struct label *pipelabel, 3954795b82cSRobert Watson unsigned long cmd, void *data); 3964795b82cSRobert Watson int (*mpo_check_pipe_poll)(struct ucred *cred, 3974795b82cSRobert Watson struct pipepair *pp, struct label *pipelabel); 3984795b82cSRobert Watson int (*mpo_check_pipe_read)(struct ucred *cred, 3994795b82cSRobert Watson struct pipepair *pp, struct label *pipelabel); 400ddcdf265SRobert Watson int (*mpo_check_pipe_relabel)(struct ucred *cred, 4014795b82cSRobert Watson struct pipepair *pp, struct label *pipelabel, 402ddcdf265SRobert Watson struct label *newlabel); 4034795b82cSRobert Watson int (*mpo_check_pipe_stat)(struct ucred *cred, 4044795b82cSRobert Watson struct pipepair *pp, struct label *pipelabel); 4054795b82cSRobert Watson int (*mpo_check_pipe_write)(struct ucred *cred, 4064795b82cSRobert Watson struct pipepair *pp, struct label *pipelabel); 407ddcdf265SRobert Watson int (*mpo_check_proc_debug)(struct ucred *cred, 408ddcdf265SRobert Watson struct proc *proc); 409ddcdf265SRobert Watson int (*mpo_check_proc_sched)(struct ucred *cred, 410ddcdf265SRobert Watson struct proc *proc); 411030a28b3SRobert Watson int (*mpo_check_proc_setuid)(struct ucred *cred, uid_t uid); 412030a28b3SRobert Watson int (*mpo_check_proc_seteuid)(struct ucred *cred, uid_t euid); 413030a28b3SRobert Watson int (*mpo_check_proc_setgid)(struct ucred *cred, gid_t gid); 414030a28b3SRobert Watson int (*mpo_check_proc_setegid)(struct ucred *cred, gid_t egid); 415030a28b3SRobert Watson int (*mpo_check_proc_setgroups)(struct ucred *cred, int ngroups, 416030a28b3SRobert Watson gid_t *gidset); 417030a28b3SRobert Watson int (*mpo_check_proc_setreuid)(struct ucred *cred, uid_t ruid, 418030a28b3SRobert Watson uid_t euid); 419030a28b3SRobert Watson int (*mpo_check_proc_setregid)(struct ucred *cred, gid_t rgid, 420030a28b3SRobert Watson gid_t egid); 421030a28b3SRobert Watson int (*mpo_check_proc_setresuid)(struct ucred *cred, uid_t ruid, 422030a28b3SRobert Watson uid_t euid, uid_t suid); 423030a28b3SRobert Watson int (*mpo_check_proc_setresgid)(struct ucred *cred, gid_t rgid, 424030a28b3SRobert Watson gid_t egid, gid_t sgid); 425ddcdf265SRobert Watson int (*mpo_check_proc_signal)(struct ucred *cred, 426ddcdf265SRobert Watson struct proc *proc, int signum); 427babe9a2bSRobert Watson int (*mpo_check_proc_wait)(struct ucred *cred, 428babe9a2bSRobert Watson struct proc *proc); 4297f53207bSRobert Watson int (*mpo_check_socket_accept)(struct ucred *cred, 4307f53207bSRobert Watson struct socket *so, struct label *socketlabel); 431ddcdf265SRobert Watson int (*mpo_check_socket_bind)(struct ucred *cred, 432ddcdf265SRobert Watson struct socket *so, struct label *socketlabel, 433ddcdf265SRobert Watson struct sockaddr *sockaddr); 434ddcdf265SRobert Watson int (*mpo_check_socket_connect)(struct ucred *cred, 435ddcdf265SRobert Watson struct socket *so, struct label *socketlabel, 436ddcdf265SRobert Watson struct sockaddr *sockaddr); 437fb95b5d3SRobert Watson int (*mpo_check_socket_deliver)(struct socket *so, 438ddcdf265SRobert Watson struct label *socketlabel, struct mbuf *m, 439ddcdf265SRobert Watson struct label *mbuflabel); 440fb95b5d3SRobert Watson int (*mpo_check_socket_listen)(struct ucred *cred, 441fb95b5d3SRobert Watson struct socket *so, struct label *socketlabel); 4427f53207bSRobert Watson int (*mpo_check_socket_poll)(struct ucred *cred, 4437f53207bSRobert Watson struct socket *so, struct label *socketlabel); 444b371c939SRobert Watson int (*mpo_check_socket_receive)(struct ucred *cred, 445b371c939SRobert Watson struct socket *so, struct label *socketlabel); 446ddcdf265SRobert Watson int (*mpo_check_socket_relabel)(struct ucred *cred, 447ddcdf265SRobert Watson struct socket *so, struct label *socketlabel, 448ddcdf265SRobert Watson struct label *newlabel); 449b371c939SRobert Watson int (*mpo_check_socket_send)(struct ucred *cred, 450b371c939SRobert Watson struct socket *so, struct label *socketlabel); 4517f53207bSRobert Watson int (*mpo_check_socket_stat)(struct ucred *cred, 4527f53207bSRobert Watson struct socket *so, struct label *socketlabel); 453ddcdf265SRobert Watson int (*mpo_check_socket_visible)(struct ucred *cred, 454ddcdf265SRobert Watson struct socket *so, struct label *socketlabel); 45592835789SRobert Watson int (*mpo_check_sysarch_ioperm)(struct ucred *cred); 456e5e820fdSRobert Watson int (*mpo_check_system_acct)(struct ucred *cred, 457e5e820fdSRobert Watson struct vnode *vp, struct label *vlabel); 458e5e820fdSRobert Watson int (*mpo_check_system_nfsd)(struct ucred *cred); 459a2ecb9b7SRobert Watson int (*mpo_check_system_reboot)(struct ucred *cred, int howto); 4604b8d5f2dSRobert Watson int (*mpo_check_system_settime)(struct ucred *cred); 46103ce2c0cSRobert Watson int (*mpo_check_system_swapon)(struct ucred *cred, 46203ce2c0cSRobert Watson struct vnode *vp, struct label *label); 4631b2c2ab2SRobert Watson int (*mpo_check_system_swapoff)(struct ucred *cred, 4641b2c2ab2SRobert Watson struct vnode *vp, struct label *label); 46563dba32bSPawel Jakub Dawidek int (*mpo_check_system_sysctl)(struct ucred *cred, 46663dba32bSPawel Jakub Dawidek struct sysctl_oid *oidp, void *arg1, int arg2, 46763dba32bSPawel Jakub Dawidek struct sysctl_req *req); 468ddcdf265SRobert Watson int (*mpo_check_vnode_access)(struct ucred *cred, 469b914de36SRobert Watson struct vnode *vp, struct label *label, int acc_mode); 470ddcdf265SRobert Watson int (*mpo_check_vnode_chdir)(struct ucred *cred, 471ddcdf265SRobert Watson struct vnode *dvp, struct label *dlabel); 472ddcdf265SRobert Watson int (*mpo_check_vnode_chroot)(struct ucred *cred, 473ddcdf265SRobert Watson struct vnode *dvp, struct label *dlabel); 474ddcdf265SRobert Watson int (*mpo_check_vnode_create)(struct ucred *cred, 475ddcdf265SRobert Watson struct vnode *dvp, struct label *dlabel, 476ddcdf265SRobert Watson struct componentname *cnp, struct vattr *vap); 477ddcdf265SRobert Watson int (*mpo_check_vnode_delete)(struct ucred *cred, 478ddcdf265SRobert Watson struct vnode *dvp, struct label *dlabel, 4795c8dd342SRobert Watson struct vnode *vp, struct label *label, 4805c8dd342SRobert Watson struct componentname *cnp); 481ddcdf265SRobert Watson int (*mpo_check_vnode_deleteacl)(struct ucred *cred, 482ddcdf265SRobert Watson struct vnode *vp, struct label *label, acl_type_t type); 483c096756cSRobert Watson int (*mpo_check_vnode_deleteextattr)(struct ucred *cred, 484c096756cSRobert Watson struct vnode *vp, struct label *label, int attrnamespace, 485c096756cSRobert Watson const char *name); 486ddcdf265SRobert Watson int (*mpo_check_vnode_exec)(struct ucred *cred, struct vnode *vp, 4879fa3506eSRobert Watson struct label *label, struct image_params *imgp, 4889fa3506eSRobert Watson struct label *execlabel); 489ddcdf265SRobert Watson int (*mpo_check_vnode_getacl)(struct ucred *cred, 490ddcdf265SRobert Watson struct vnode *vp, struct label *label, acl_type_t type); 491ddcdf265SRobert Watson int (*mpo_check_vnode_getextattr)(struct ucred *cred, 492ddcdf265SRobert Watson struct vnode *vp, struct label *label, int attrnamespace, 493ddcdf265SRobert Watson const char *name, struct uio *uio); 4940a694196SRobert Watson int (*mpo_check_vnode_link)(struct ucred *cred, struct vnode *dvp, 4950a694196SRobert Watson struct label *dlabel, struct vnode *vp, 4960a694196SRobert Watson struct label *label, struct componentname *cnp); 497c096756cSRobert Watson int (*mpo_check_vnode_listextattr)(struct ucred *cred, 498c096756cSRobert Watson struct vnode *vp, struct label *label, int attrnamespace); 499ddcdf265SRobert Watson int (*mpo_check_vnode_lookup)(struct ucred *cred, 500ddcdf265SRobert Watson struct vnode *dvp, struct label *dlabel, 501ddcdf265SRobert Watson struct componentname *cnp); 502e183f80eSRobert Watson int (*mpo_check_vnode_mmap)(struct ucred *cred, struct vnode *vp, 503c92163dcSChristian S.J. Peron struct label *label, int prot, int flags); 504e183f80eSRobert Watson void (*mpo_check_vnode_mmap_downgrade)(struct ucred *cred, 505e183f80eSRobert Watson struct vnode *vp, struct label *label, int *prot); 506e183f80eSRobert Watson int (*mpo_check_vnode_mprotect)(struct ucred *cred, 507e183f80eSRobert Watson struct vnode *vp, struct label *label, int prot); 508ddcdf265SRobert Watson int (*mpo_check_vnode_open)(struct ucred *cred, struct vnode *vp, 509b914de36SRobert Watson struct label *label, int acc_mode); 510177142e4SRobert Watson int (*mpo_check_vnode_poll)(struct ucred *active_cred, 511177142e4SRobert Watson struct ucred *file_cred, struct vnode *vp, 5127f724f8bSRobert Watson struct label *label); 513177142e4SRobert Watson int (*mpo_check_vnode_read)(struct ucred *active_cred, 514177142e4SRobert Watson struct ucred *file_cred, struct vnode *vp, 5157f724f8bSRobert Watson struct label *label); 516ddcdf265SRobert Watson int (*mpo_check_vnode_readdir)(struct ucred *cred, 517ddcdf265SRobert Watson struct vnode *dvp, struct label *dlabel); 518ddcdf265SRobert Watson int (*mpo_check_vnode_readlink)(struct ucred *cred, 519ddcdf265SRobert Watson struct vnode *vp, struct label *label); 520ddcdf265SRobert Watson int (*mpo_check_vnode_relabel)(struct ucred *cred, 521ddcdf265SRobert Watson struct vnode *vp, struct label *vnodelabel, 522ddcdf265SRobert Watson struct label *newlabel); 523ddcdf265SRobert Watson int (*mpo_check_vnode_rename_from)(struct ucred *cred, 524ddcdf265SRobert Watson struct vnode *dvp, struct label *dlabel, struct vnode *vp, 525ddcdf265SRobert Watson struct label *label, struct componentname *cnp); 526ddcdf265SRobert Watson int (*mpo_check_vnode_rename_to)(struct ucred *cred, 527ddcdf265SRobert Watson struct vnode *dvp, struct label *dlabel, struct vnode *vp, 528ddcdf265SRobert Watson struct label *label, int samedir, 529ddcdf265SRobert Watson struct componentname *cnp); 530ddcdf265SRobert Watson int (*mpo_check_vnode_revoke)(struct ucred *cred, 531ddcdf265SRobert Watson struct vnode *vp, struct label *label); 532ddcdf265SRobert Watson int (*mpo_check_vnode_setacl)(struct ucred *cred, 533ddcdf265SRobert Watson struct vnode *vp, struct label *label, acl_type_t type, 534ddcdf265SRobert Watson struct acl *acl); 535ddcdf265SRobert Watson int (*mpo_check_vnode_setextattr)(struct ucred *cred, 536ddcdf265SRobert Watson struct vnode *vp, struct label *label, int attrnamespace, 537ddcdf265SRobert Watson const char *name, struct uio *uio); 538ddcdf265SRobert Watson int (*mpo_check_vnode_setflags)(struct ucred *cred, 539ddcdf265SRobert Watson struct vnode *vp, struct label *label, u_long flags); 540ddcdf265SRobert Watson int (*mpo_check_vnode_setmode)(struct ucred *cred, 541ddcdf265SRobert Watson struct vnode *vp, struct label *label, mode_t mode); 542ddcdf265SRobert Watson int (*mpo_check_vnode_setowner)(struct ucred *cred, 543ddcdf265SRobert Watson struct vnode *vp, struct label *label, uid_t uid, 544ddcdf265SRobert Watson gid_t gid); 545ddcdf265SRobert Watson int (*mpo_check_vnode_setutimes)(struct ucred *cred, 546ddcdf265SRobert Watson struct vnode *vp, struct label *label, 547ddcdf265SRobert Watson struct timespec atime, struct timespec mtime); 548177142e4SRobert Watson int (*mpo_check_vnode_stat)(struct ucred *active_cred, 549177142e4SRobert Watson struct ucred *file_cred, struct vnode *vp, 550ddcdf265SRobert Watson struct label *label); 551177142e4SRobert Watson int (*mpo_check_vnode_write)(struct ucred *active_cred, 552177142e4SRobert Watson struct ucred *file_cred, struct vnode *vp, 5537f724f8bSRobert Watson struct label *label); 554ddcdf265SRobert Watson }; 555ddcdf265SRobert Watson 5563459e1d2SRobert Watson /* 5573459e1d2SRobert Watson * struct mac_policy_conf is the registration structure for policies, and is 5583459e1d2SRobert Watson * provided to the MAC Framework using MAC_POLICY_SET() to invoke a SYSINIT 5593459e1d2SRobert Watson * to register the policy. In general, the fields are immutable, with the 5603459e1d2SRobert Watson * exception of the "security field", run-time flags, and policy list entry, 5613459e1d2SRobert Watson * which are managed by the MAC Framework. Be careful when modifying this 5623459e1d2SRobert Watson * structure, as its layout is statically compiled into all policies. 5633459e1d2SRobert Watson */ 564ddcdf265SRobert Watson struct mac_policy_conf { 565ddcdf265SRobert Watson char *mpc_name; /* policy name */ 566ddcdf265SRobert Watson char *mpc_fullname; /* policy full name */ 567ddcdf265SRobert Watson struct mac_policy_ops *mpc_ops; /* policy operations */ 568ddcdf265SRobert Watson int mpc_loadtime_flags; /* flags */ 569ddcdf265SRobert Watson int *mpc_field_off; /* security field */ 570ddcdf265SRobert Watson int mpc_runtime_flags; /* flags */ 571ddcdf265SRobert Watson LIST_ENTRY(mac_policy_conf) mpc_list; /* global list */ 572ddcdf265SRobert Watson }; 573ddcdf265SRobert Watson 574ddcdf265SRobert Watson /* Flags for the mpc_loadtime_flags field. */ 575ddcdf265SRobert Watson #define MPC_LOADTIME_FLAG_NOTLATE 0x00000001 576ddcdf265SRobert Watson #define MPC_LOADTIME_FLAG_UNLOADOK 0x00000002 577225bff6fSRobert Watson #define MPC_LOADTIME_FLAG_LABELMBUFS 0x00000004 578ddcdf265SRobert Watson 579ddcdf265SRobert Watson /* Flags for the mpc_runtime_flags field. */ 580ddcdf265SRobert Watson #define MPC_RUNTIME_FLAG_REGISTERED 0x00000001 581ddcdf265SRobert Watson 5825c8dd342SRobert Watson #define MAC_POLICY_SET(mpops, mpname, mpfullname, mpflags, privdata_wanted) \ 583ddcdf265SRobert Watson static struct mac_policy_conf mpname##_mac_policy_conf = { \ 584ddcdf265SRobert Watson #mpname, \ 585ddcdf265SRobert Watson mpfullname, \ 5865c8dd342SRobert Watson mpops, \ 587ddcdf265SRobert Watson mpflags, \ 588ddcdf265SRobert Watson privdata_wanted, \ 589ddcdf265SRobert Watson 0, \ 590ddcdf265SRobert Watson }; \ 591ddcdf265SRobert Watson static moduledata_t mpname##_mod = { \ 592ddcdf265SRobert Watson #mpname, \ 593ddcdf265SRobert Watson mac_policy_modevent, \ 594ddcdf265SRobert Watson &mpname##_mac_policy_conf \ 595ddcdf265SRobert Watson }; \ 596af8d7cbeSRobert Watson MODULE_DEPEND(mpname, kernel_mac_support, 2, 2, 2); \ 597ddcdf265SRobert Watson DECLARE_MODULE(mpname, mpname##_mod, SI_SUB_MAC_POLICY, \ 598ddcdf265SRobert Watson SI_ORDER_MIDDLE) 599ddcdf265SRobert Watson 600ddcdf265SRobert Watson int mac_policy_modevent(module_t mod, int type, void *data); 601ddcdf265SRobert Watson 602ddcdf265SRobert Watson #define LABEL_TO_SLOT(l, s) (l)->l_perpolicy[s] 603ddcdf265SRobert Watson 60402ebd2bcSRobert Watson #endif /* !_SYS_MAC_POLICY_H_ */ 605