xref: /freebsd/sys/security/mac/mac_policy.h (revision babe9a2bb37a1c0a1e87cbe5c3ce5fd40c70d990)
1ddcdf265SRobert Watson /*-
2f6a41092SRobert Watson  * Copyright (c) 1999-2002 Robert N. M. Watson
37f53207bSRobert Watson  * Copyright (c) 2001-2005 Networks Associates Technology, Inc.
4ddcdf265SRobert Watson  * All rights reserved.
5ddcdf265SRobert Watson  *
6ddcdf265SRobert Watson  * This software was developed by Robert Watson for the TrustedBSD Project.
7ddcdf265SRobert Watson  *
86201265bSRobert Watson  * This software was developed for the FreeBSD Project in part by Network
96201265bSRobert Watson  * Associates Laboratories, the Security Research Division of Network
106201265bSRobert Watson  * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"),
116201265bSRobert Watson  * as part of the DARPA CHATS research program.
12ddcdf265SRobert Watson  *
13ddcdf265SRobert Watson  * Redistribution and use in source and binary forms, with or without
14ddcdf265SRobert Watson  * modification, are permitted provided that the following conditions
15ddcdf265SRobert Watson  * are met:
16ddcdf265SRobert Watson  * 1. Redistributions of source code must retain the above copyright
17ddcdf265SRobert Watson  *    notice, this list of conditions and the following disclaimer.
18ddcdf265SRobert Watson  * 2. Redistributions in binary form must reproduce the above copyright
19ddcdf265SRobert Watson  *    notice, this list of conditions and the following disclaimer in the
20ddcdf265SRobert Watson  *    documentation and/or other materials provided with the distribution.
21ddcdf265SRobert Watson  *
22ddcdf265SRobert Watson  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
23ddcdf265SRobert Watson  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24ddcdf265SRobert Watson  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25ddcdf265SRobert Watson  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
26ddcdf265SRobert Watson  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27ddcdf265SRobert Watson  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28ddcdf265SRobert Watson  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29ddcdf265SRobert Watson  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30ddcdf265SRobert Watson  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31ddcdf265SRobert Watson  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32ddcdf265SRobert Watson  * SUCH DAMAGE.
33ddcdf265SRobert Watson  *
34ddcdf265SRobert Watson  * $FreeBSD$
35ddcdf265SRobert Watson  */
36ddcdf265SRobert Watson /*
37ddcdf265SRobert Watson  * Kernel interface for MAC policy modules.
38ddcdf265SRobert Watson  */
3902ebd2bcSRobert Watson #ifndef _SYS_MAC_POLICY_H_
4002ebd2bcSRobert Watson #define _SYS_MAC_POLICY_H_
41ddcdf265SRobert Watson 
42ddcdf265SRobert Watson /*-
43ddcdf265SRobert Watson  * Pluggable access control policy definition structure.
44ddcdf265SRobert Watson  *
45ddcdf265SRobert Watson  * List of operations that are performed as part of the implementation
46ddcdf265SRobert Watson  * of a MAC policy.  Policy implementors declare operations with a
47ddcdf265SRobert Watson  * mac_policy_ops structure, and using the MAC_POLICY_SET() macro.
48ddcdf265SRobert Watson  * If an entry point is not declared, then then the policy will be ignored
49ddcdf265SRobert Watson  * during evaluation of that event or check.
50ddcdf265SRobert Watson  *
51ddcdf265SRobert Watson  * Operations are sorted first by general class of operation, then
52ddcdf265SRobert Watson  * alphabetically.
53ddcdf265SRobert Watson  */
5416fd30bdSRobert Watson struct acl;
55f47cb886SRobert Watson struct bpf_d;
5616fd30bdSRobert Watson struct componentname;
5716fd30bdSRobert Watson struct devfs_dirent;
58f47cb886SRobert Watson struct ifnet;
59f47cb886SRobert Watson struct image_params;
60a557af22SRobert Watson struct inpcb;
6116fd30bdSRobert Watson struct ipq;
6216fd30bdSRobert Watson struct label;
63ddcdf265SRobert Watson struct mac_policy_conf;
6416fd30bdSRobert Watson struct mbuf;
6516fd30bdSRobert Watson struct mount;
6642726d8aSRobert Watson struct msqid_kernel;
674795b82cSRobert Watson struct pipepair;
68f97e834bSRobert Watson struct proc;
69f51e5803SRobert Watson struct sbuf;
7042726d8aSRobert Watson struct semid_kernel;
7142726d8aSRobert Watson struct shmid_kernel;
72f97e834bSRobert Watson struct sockaddr;
7316fd30bdSRobert Watson struct socket;
7463dba32bSPawel Jakub Dawidek struct sysctl_oid;
7563dba32bSPawel Jakub Dawidek struct sysctl_req;
76f97e834bSRobert Watson struct thread;
7716fd30bdSRobert Watson struct ucred;
7816fd30bdSRobert Watson struct uio;
79f47cb886SRobert Watson struct vattr;
8016fd30bdSRobert Watson struct vnode;
81ddcdf265SRobert Watson struct mac_policy_ops {
82ddcdf265SRobert Watson 	/*
83ddcdf265SRobert Watson 	 * Policy module operations.
84ddcdf265SRobert Watson 	 */
85ddcdf265SRobert Watson 	void	(*mpo_destroy)(struct mac_policy_conf *mpc);
86ddcdf265SRobert Watson 	void	(*mpo_init)(struct mac_policy_conf *mpc);
87ddcdf265SRobert Watson 
88ddcdf265SRobert Watson 	/*
893459e1d2SRobert Watson 	 * General policy-directed security system call so that policies may
903459e1d2SRobert Watson 	 * implement new services without reserving explicit system call
913459e1d2SRobert Watson 	 * numbers.
9227f2eac7SRobert Watson 	 */
9327f2eac7SRobert Watson 	int	(*mpo_syscall)(struct thread *td, int call, void *arg);
9427f2eac7SRobert Watson 
9527f2eac7SRobert Watson 	/*
963459e1d2SRobert Watson 	 * Label operations.  Initialize label storage, destroy label
973459e1d2SRobert Watson 	 * storage, recycle for re-use without init/destroy, copy a label to
983459e1d2SRobert Watson 	 * initialized storage, and externalize/internalize from/to
993459e1d2SRobert Watson 	 * initialized storage.
100ddcdf265SRobert Watson 	 */
10196adb909SRobert Watson 	void	(*mpo_init_bpfdesc_label)(struct label *label);
10296adb909SRobert Watson 	void	(*mpo_init_cred_label)(struct label *label);
10396adb909SRobert Watson 	void	(*mpo_init_devfsdirent_label)(struct label *label);
10496adb909SRobert Watson 	void	(*mpo_init_ifnet_label)(struct label *label);
105a557af22SRobert Watson 	int	(*mpo_init_inpcb_label)(struct label *label, int flag);
10642726d8aSRobert Watson 	void	(*mpo_init_sysv_msgmsg_label)(struct label *label);
10742726d8aSRobert Watson 	void	(*mpo_init_sysv_msgqueue_label)(struct label *label);
10842726d8aSRobert Watson 	void	(*mpo_init_sysv_sema_label)(struct label *label);
10942726d8aSRobert Watson 	void	(*mpo_init_sysv_shm_label)(struct label *label);
1105e7ce478SRobert Watson 	int	(*mpo_init_ipq_label)(struct label *label, int flag);
11196adb909SRobert Watson 	int	(*mpo_init_mbuf_label)(struct label *label, int flag);
11296adb909SRobert Watson 	void	(*mpo_init_mount_label)(struct label *label);
11396adb909SRobert Watson 	void	(*mpo_init_mount_fs_label)(struct label *label);
11483985c26SRobert Watson 	int	(*mpo_init_socket_label)(struct label *label, int flag);
11583985c26SRobert Watson 	int	(*mpo_init_socket_peer_label)(struct label *label, int flag);
11696adb909SRobert Watson 	void	(*mpo_init_pipe_label)(struct label *label);
1172555374cSRobert Watson 	void	(*mpo_init_proc_label)(struct label *label);
11896adb909SRobert Watson 	void	(*mpo_init_vnode_label)(struct label *label);
11996adb909SRobert Watson 	void	(*mpo_destroy_bpfdesc_label)(struct label *label);
12096adb909SRobert Watson 	void	(*mpo_destroy_cred_label)(struct label *label);
12196adb909SRobert Watson 	void	(*mpo_destroy_devfsdirent_label)(struct label *label);
12296adb909SRobert Watson 	void	(*mpo_destroy_ifnet_label)(struct label *label);
123a557af22SRobert Watson 	void	(*mpo_destroy_inpcb_label)(struct label *label);
12442726d8aSRobert Watson 	void	(*mpo_destroy_sysv_msgmsg_label)(struct label *label);
12542726d8aSRobert Watson 	void	(*mpo_destroy_sysv_msgqueue_label)(struct label *label);
12642726d8aSRobert Watson 	void	(*mpo_destroy_sysv_sema_label)(struct label *label);
12742726d8aSRobert Watson 	void	(*mpo_destroy_sysv_shm_label)(struct label *label);
12896adb909SRobert Watson 	void	(*mpo_destroy_ipq_label)(struct label *label);
12996adb909SRobert Watson 	void	(*mpo_destroy_mbuf_label)(struct label *label);
13096adb909SRobert Watson 	void	(*mpo_destroy_mount_label)(struct label *label);
13196adb909SRobert Watson 	void	(*mpo_destroy_mount_fs_label)(struct label *label);
13296adb909SRobert Watson 	void	(*mpo_destroy_socket_label)(struct label *label);
13396adb909SRobert Watson 	void	(*mpo_destroy_socket_peer_label)(struct label *label);
13496adb909SRobert Watson 	void	(*mpo_destroy_pipe_label)(struct label *label);
1352555374cSRobert Watson 	void	(*mpo_destroy_proc_label)(struct label *label);
13696adb909SRobert Watson 	void	(*mpo_destroy_vnode_label)(struct label *label);
13742726d8aSRobert Watson 	void	(*mpo_cleanup_sysv_msgmsg)(struct label *msglabel);
13842726d8aSRobert Watson 	void	(*mpo_cleanup_sysv_msgqueue)(struct label *msqlabel);
13942726d8aSRobert Watson 	void	(*mpo_cleanup_sysv_sema)(struct label *semalabel);
14042726d8aSRobert Watson 	void	(*mpo_cleanup_sysv_shm)(struct label *shmlabel);
14156d9e932SRobert Watson 	void	(*mpo_copy_cred_label)(struct label *src,
14256d9e932SRobert Watson 		    struct label *dest);
1432220907bSRobert Watson 	void	(*mpo_copy_ifnet_label)(struct label *src,
1442220907bSRobert Watson 		    struct label *dest);
145225bff6fSRobert Watson 	void	(*mpo_copy_mbuf_label)(struct label *src,
146225bff6fSRobert Watson 		    struct label *dest);
147475b9d0aSRobert Watson 	void	(*mpo_copy_pipe_label)(struct label *src,
148475b9d0aSRobert Watson 		    struct label *dest);
149b0323ea3SRobert Watson 	void	(*mpo_copy_socket_label)(struct label *src,
150b0323ea3SRobert Watson 		    struct label *dest);
151475b9d0aSRobert Watson 	void	(*mpo_copy_vnode_label)(struct label *src,
152475b9d0aSRobert Watson 		    struct label *dest);
153475b9d0aSRobert Watson 	int	(*mpo_externalize_cred_label)(struct label *label,
154f51e5803SRobert Watson 		    char *element_name, struct sbuf *sb, int *claimed);
155475b9d0aSRobert Watson 	int	(*mpo_externalize_ifnet_label)(struct label *label,
156f51e5803SRobert Watson 		    char *element_name, struct sbuf *sb, int *claimed);
157475b9d0aSRobert Watson 	int	(*mpo_externalize_pipe_label)(struct label *label,
158f51e5803SRobert Watson 		    char *element_name, struct sbuf *sb, int *claimed);
159475b9d0aSRobert Watson 	int	(*mpo_externalize_socket_label)(struct label *label,
160f51e5803SRobert Watson 		    char *element_name, struct sbuf *sb, int *claimed);
161475b9d0aSRobert Watson 	int	(*mpo_externalize_socket_peer_label)(struct label *label,
162f51e5803SRobert Watson 		    char *element_name, struct sbuf *sb, int *claimed);
163475b9d0aSRobert Watson 	int	(*mpo_externalize_vnode_label)(struct label *label,
164f51e5803SRobert Watson 		    char *element_name, struct sbuf *sb, int *claimed);
165475b9d0aSRobert Watson 	int	(*mpo_internalize_cred_label)(struct label *label,
166475b9d0aSRobert Watson 		    char *element_name, char *element_data, int *claimed);
167475b9d0aSRobert Watson 	int	(*mpo_internalize_ifnet_label)(struct label *label,
168475b9d0aSRobert Watson 		    char *element_name, char *element_data, int *claimed);
169475b9d0aSRobert Watson 	int	(*mpo_internalize_pipe_label)(struct label *label,
170475b9d0aSRobert Watson 		    char *element_name, char *element_data, int *claimed);
171475b9d0aSRobert Watson 	int	(*mpo_internalize_socket_label)(struct label *label,
172475b9d0aSRobert Watson 		    char *element_name, char *element_data, int *claimed);
173475b9d0aSRobert Watson 	int	(*mpo_internalize_vnode_label)(struct label *label,
174475b9d0aSRobert Watson 		    char *element_name, char *element_data, int *claimed);
175ddcdf265SRobert Watson 
176ddcdf265SRobert Watson 	/*
177ddcdf265SRobert Watson 	 * Labeling event operations: file system objects, and things that
178ddcdf265SRobert Watson 	 * look a lot like file system objects.
179ddcdf265SRobert Watson 	 */
180763bbd2fSRobert Watson 	void	(*mpo_associate_vnode_devfs)(struct mount *mp,
181763bbd2fSRobert Watson 		    struct label *fslabel, struct devfs_dirent *de,
182763bbd2fSRobert Watson 		    struct label *delabel, struct vnode *vp,
183763bbd2fSRobert Watson 		    struct label *vlabel);
184763bbd2fSRobert Watson 	int	(*mpo_associate_vnode_extattr)(struct mount *mp,
185763bbd2fSRobert Watson 		    struct label *fslabel, struct vnode *vp,
186763bbd2fSRobert Watson 		    struct label *vlabel);
187763bbd2fSRobert Watson 	void	(*mpo_associate_vnode_singlelabel)(struct mount *mp,
188763bbd2fSRobert Watson 		    struct label *fslabel, struct vnode *vp,
189763bbd2fSRobert Watson 		    struct label *vlabel);
19089c9c53dSPoul-Henning Kamp 	void	(*mpo_create_devfs_device)(struct mount *mp, struct cdev *dev,
191ddcdf265SRobert Watson 		    struct devfs_dirent *de, struct label *label);
192990b4b2dSRobert Watson 	void	(*mpo_create_devfs_directory)(struct mount *mp, char *dirname,
193990b4b2dSRobert Watson 		    int dirnamelen, struct devfs_dirent *de,
194990b4b2dSRobert Watson 		    struct label *label);
19574e62b1bSRobert Watson 	void	(*mpo_create_devfs_symlink)(struct ucred *cred,
196990b4b2dSRobert Watson 		    struct mount *mp, struct devfs_dirent *dd,
197990b4b2dSRobert Watson 		    struct label *ddlabel, struct devfs_dirent *de,
198990b4b2dSRobert Watson 		    struct label *delabel);
199763bbd2fSRobert Watson 	int	(*mpo_create_vnode_extattr)(struct ucred *cred,
200763bbd2fSRobert Watson 		    struct mount *mp, struct label *fslabel,
201763bbd2fSRobert Watson 		    struct vnode *dvp, struct label *dlabel,
202763bbd2fSRobert Watson 		    struct vnode *vp, struct label *vlabel,
203763bbd2fSRobert Watson 		    struct componentname *cnp);
204ddcdf265SRobert Watson 	void	(*mpo_create_mount)(struct ucred *cred, struct mount *mp,
205ddcdf265SRobert Watson 		    struct label *mntlabel, struct label *fslabel);
206ddcdf265SRobert Watson 	void	(*mpo_create_root_mount)(struct ucred *cred, struct mount *mp,
207ddcdf265SRobert Watson 		    struct label *mountlabel, struct label *fslabel);
208ddcdf265SRobert Watson 	void	(*mpo_relabel_vnode)(struct ucred *cred, struct vnode *vp,
209ddcdf265SRobert Watson 		    struct label *vnodelabel, struct label *label);
210763bbd2fSRobert Watson 	int	(*mpo_setlabel_vnode_extattr)(struct ucred *cred,
211763bbd2fSRobert Watson 		    struct vnode *vp, struct label *vlabel,
212763bbd2fSRobert Watson 		    struct label *intlabel);
213990b4b2dSRobert Watson 	void	(*mpo_update_devfsdirent)(struct mount *mp,
214990b4b2dSRobert Watson 		    struct devfs_dirent *devfs_dirent,
215ddcdf265SRobert Watson 		    struct label *direntlabel, struct vnode *vp,
216ddcdf265SRobert Watson 		    struct label *vnodelabel);
217ddcdf265SRobert Watson 
218ddcdf265SRobert Watson 	/*
219ddcdf265SRobert Watson 	 * Labeling event operations: IPC objects.
220ddcdf265SRobert Watson 	 */
221ddcdf265SRobert Watson 	void	(*mpo_create_mbuf_from_socket)(struct socket *so,
222ddcdf265SRobert Watson 		    struct label *socketlabel, struct mbuf *m,
223ddcdf265SRobert Watson 		    struct label *mbuflabel);
224ddcdf265SRobert Watson 	void	(*mpo_create_socket)(struct ucred *cred, struct socket *so,
225ddcdf265SRobert Watson 		    struct label *socketlabel);
226ddcdf265SRobert Watson 	void	(*mpo_create_socket_from_socket)(struct socket *oldsocket,
227ddcdf265SRobert Watson 		    struct label *oldsocketlabel, struct socket *newsocket,
228ddcdf265SRobert Watson 		    struct label *newsocketlabel);
229ddcdf265SRobert Watson 	void	(*mpo_relabel_socket)(struct ucred *cred, struct socket *so,
230ddcdf265SRobert Watson 		    struct label *oldlabel, struct label *newlabel);
2314795b82cSRobert Watson 	void	(*mpo_relabel_pipe)(struct ucred *cred, struct pipepair *pp,
232ddcdf265SRobert Watson 		    struct label *oldlabel, struct label *newlabel);
233ddcdf265SRobert Watson 	void	(*mpo_set_socket_peer_from_mbuf)(struct mbuf *mbuf,
234ddcdf265SRobert Watson 		    struct label *mbuflabel, struct socket *so,
235ddcdf265SRobert Watson 		    struct label *socketpeerlabel);
236ddcdf265SRobert Watson 	void	(*mpo_set_socket_peer_from_socket)(struct socket *oldsocket,
237ddcdf265SRobert Watson 		    struct label *oldsocketlabel, struct socket *newsocket,
238ddcdf265SRobert Watson 		    struct label *newsocketpeerlabel);
2394795b82cSRobert Watson 	void	(*mpo_create_pipe)(struct ucred *cred, struct pipepair *pp,
240ddcdf265SRobert Watson 		    struct label *pipelabel);
241ddcdf265SRobert Watson 
242ddcdf265SRobert Watson 	/*
24342726d8aSRobert Watson 	 * Labeling event operations: System V IPC primitives.
24442726d8aSRobert Watson 	 */
24542726d8aSRobert Watson 	void	(*mpo_create_sysv_msgmsg)(struct ucred *cred,
24642726d8aSRobert Watson 		    struct msqid_kernel *msqkptr, struct label *msqlabel,
24742726d8aSRobert Watson 		    struct msg *msgptr, struct label *msglabel);
24842726d8aSRobert Watson 	void	(*mpo_create_sysv_msgqueue)(struct ucred *cred,
24942726d8aSRobert Watson 		    struct msqid_kernel *msqkptr, struct label *msqlabel);
25042726d8aSRobert Watson 	void	(*mpo_create_sysv_sema)(struct ucred *cred,
25142726d8aSRobert Watson 		    struct semid_kernel *semakptr, struct label *semalabel);
25242726d8aSRobert Watson 	void	(*mpo_create_sysv_shm)(struct ucred *cred,
25342726d8aSRobert Watson 		    struct shmid_kernel *shmsegptr, struct label *shmlabel);
25442726d8aSRobert Watson 
25542726d8aSRobert Watson 	/*
256ddcdf265SRobert Watson 	 * Labeling event operations: network objects.
257ddcdf265SRobert Watson 	 */
258ddcdf265SRobert Watson 	void	(*mpo_create_bpfdesc)(struct ucred *cred, struct bpf_d *bpf_d,
259ddcdf265SRobert Watson 		    struct label *bpflabel);
260ddcdf265SRobert Watson 	void	(*mpo_create_ifnet)(struct ifnet *ifnet,
261ddcdf265SRobert Watson 		    struct label *ifnetlabel);
262a557af22SRobert Watson 	void	(*mpo_create_inpcb_from_socket)(struct socket *so,
263a557af22SRobert Watson 		    struct label *solabel, struct inpcb *inp,
264a557af22SRobert Watson 		    struct label *inplabel);
265ddcdf265SRobert Watson 	void	(*mpo_create_ipq)(struct mbuf *fragment,
266ddcdf265SRobert Watson 		    struct label *fragmentlabel, struct ipq *ipq,
267ddcdf265SRobert Watson 		    struct label *ipqlabel);
268ddcdf265SRobert Watson 	void	(*mpo_create_datagram_from_ipq)
269ddcdf265SRobert Watson 		    (struct ipq *ipq, struct label *ipqlabel,
270ddcdf265SRobert Watson 		    struct mbuf *datagram, struct label *datagramlabel);
271ddcdf265SRobert Watson 	void	(*mpo_create_fragment)(struct mbuf *datagram,
272ddcdf265SRobert Watson 		    struct label *datagramlabel, struct mbuf *fragment,
273ddcdf265SRobert Watson 		    struct label *fragmentlabel);
2742d92ec98SRobert Watson 	void	(*mpo_create_mbuf_from_inpcb)(struct inpcb *inp,
2752d92ec98SRobert Watson 		    struct label *inplabel, struct mbuf *m,
2762d92ec98SRobert Watson 		    struct label *mlabel);
277ddcdf265SRobert Watson 	void	(*mpo_create_mbuf_from_mbuf)(struct mbuf *oldmbuf,
278ddcdf265SRobert Watson 		    struct label *oldlabel, struct mbuf *newmbuf,
279ddcdf265SRobert Watson 		    struct label *newlabel);
280ddcdf265SRobert Watson 	void	(*mpo_create_mbuf_linklayer)(struct ifnet *ifnet,
281ddcdf265SRobert Watson 		    struct label *ifnetlabel, struct mbuf *mbuf,
282ddcdf265SRobert Watson 		    struct label *mbuflabel);
283ddcdf265SRobert Watson 	void	(*mpo_create_mbuf_from_bpfdesc)(struct bpf_d *bpf_d,
284ddcdf265SRobert Watson 		    struct label *bpflabel, struct mbuf *mbuf,
285ddcdf265SRobert Watson 		    struct label *mbuflabel);
286ddcdf265SRobert Watson 	void	(*mpo_create_mbuf_from_ifnet)(struct ifnet *ifnet,
287ddcdf265SRobert Watson 		    struct label *ifnetlabel, struct mbuf *mbuf,
288ddcdf265SRobert Watson 		    struct label *mbuflabel);
289ddcdf265SRobert Watson 	void	(*mpo_create_mbuf_multicast_encap)(struct mbuf *oldmbuf,
290ddcdf265SRobert Watson 		    struct label *oldmbuflabel, struct ifnet *ifnet,
291ddcdf265SRobert Watson 		    struct label *ifnetlabel, struct mbuf *newmbuf,
292ddcdf265SRobert Watson 		    struct label *newmbuflabel);
293ddcdf265SRobert Watson 	void	(*mpo_create_mbuf_netlayer)(struct mbuf *oldmbuf,
294ddcdf265SRobert Watson 		    struct label *oldmbuflabel, struct mbuf *newmbuf,
295ddcdf265SRobert Watson 		    struct label *newmbuflabel);
296ddcdf265SRobert Watson 	int	(*mpo_fragment_match)(struct mbuf *fragment,
297ddcdf265SRobert Watson 		    struct label *fragmentlabel, struct ipq *ipq,
298ddcdf265SRobert Watson 		    struct label *ipqlabel);
299eb8c7f99SRobert Watson 	void	(*mpo_reflect_mbuf_icmp)(struct mbuf *m,
300eb8c7f99SRobert Watson 		    struct label *mlabel);
301eb8c7f99SRobert Watson 	void	(*mpo_reflect_mbuf_tcp)(struct mbuf *m, struct label *mlabel);
302ddcdf265SRobert Watson 	void	(*mpo_relabel_ifnet)(struct ucred *cred, struct ifnet *ifnet,
303ddcdf265SRobert Watson 		    struct label *ifnetlabel, struct label *newlabel);
304ddcdf265SRobert Watson 	void	(*mpo_update_ipq)(struct mbuf *fragment,
305ddcdf265SRobert Watson 		    struct label *fragmentlabel, struct ipq *ipq,
306ddcdf265SRobert Watson 		    struct label *ipqlabel);
307a557af22SRobert Watson 	void	(*mpo_inpcb_sosetlabel)(struct socket *so,
308a557af22SRobert Watson 		    struct label *label, struct inpcb *inp,
309a557af22SRobert Watson 		    struct label *inplabel);
310ddcdf265SRobert Watson 
311ddcdf265SRobert Watson 	/*
312ddcdf265SRobert Watson 	 * Labeling event operations: processes.
313ddcdf265SRobert Watson 	 */
314ddcdf265SRobert Watson 	void	(*mpo_execve_transition)(struct ucred *old, struct ucred *new,
315670cb89bSRobert Watson 		    struct vnode *vp, struct label *vnodelabel,
316670cb89bSRobert Watson 		    struct label *interpvnodelabel,
3179fa3506eSRobert Watson 		    struct image_params *imgp, struct label *execlabel);
318ddcdf265SRobert Watson 	int	(*mpo_execve_will_transition)(struct ucred *old,
319670cb89bSRobert Watson 		    struct vnode *vp, struct label *vnodelabel,
320670cb89bSRobert Watson 		    struct label *interpvnodelabel,
3219fa3506eSRobert Watson 		    struct image_params *imgp, struct label *execlabel);
322ddcdf265SRobert Watson 	void	(*mpo_create_proc0)(struct ucred *cred);
323ddcdf265SRobert Watson 	void	(*mpo_create_proc1)(struct ucred *cred);
324ddcdf265SRobert Watson 	void	(*mpo_relabel_cred)(struct ucred *cred,
325ddcdf265SRobert Watson 		    struct label *newlabel);
32692dbb82aSRobert Watson 	void	(*mpo_thread_userret)(struct thread *thread);
327ddcdf265SRobert Watson 
328ddcdf265SRobert Watson 	/*
329ddcdf265SRobert Watson 	 * Access control checks.
330ddcdf265SRobert Watson 	 */
331ddcdf265SRobert Watson 	int	(*mpo_check_bpfdesc_receive)(struct bpf_d *bpf_d,
332ddcdf265SRobert Watson 		    struct label *bpflabel, struct ifnet *ifnet,
333ddcdf265SRobert Watson 		    struct label *ifnetlabel);
334ddcdf265SRobert Watson 	int	(*mpo_check_cred_relabel)(struct ucred *cred,
335ddcdf265SRobert Watson 		    struct label *newlabel);
336ddcdf265SRobert Watson 	int	(*mpo_check_cred_visible)(struct ucred *u1, struct ucred *u2);
337ddcdf265SRobert Watson 	int	(*mpo_check_ifnet_relabel)(struct ucred *cred,
338ddcdf265SRobert Watson 		    struct ifnet *ifnet, struct label *ifnetlabel,
339ddcdf265SRobert Watson 		    struct label *newlabel);
340ddcdf265SRobert Watson 	int	(*mpo_check_ifnet_transmit)(struct ifnet *ifnet,
341ddcdf265SRobert Watson 		    struct label *ifnetlabel, struct mbuf *m,
342ddcdf265SRobert Watson 		    struct label *mbuflabel);
343a557af22SRobert Watson 	int	(*mpo_check_inpcb_deliver)(struct inpcb *inp,
344a557af22SRobert Watson 		    struct label *inplabel, struct mbuf *m,
345a557af22SRobert Watson 		    struct label *mlabel);
34642726d8aSRobert Watson 	int	(*mpo_check_sysv_msgmsq)(struct ucred *cred,
34742726d8aSRobert Watson 		    struct msg *msgptr, struct label *msglabel,
34842726d8aSRobert Watson 		    struct msqid_kernel *msqkptr, struct label *msqklabel);
34942726d8aSRobert Watson 	int	(*mpo_check_sysv_msgrcv)(struct ucred *cred,
35042726d8aSRobert Watson 		    struct msg *msgptr, struct label *msglabel);
35142726d8aSRobert Watson 	int	(*mpo_check_sysv_msgrmid)(struct ucred *cred,
35242726d8aSRobert Watson 		    struct msg *msgptr, struct label *msglabel);
35342726d8aSRobert Watson 	int	(*mpo_check_sysv_msqget)(struct ucred *cred,
35442726d8aSRobert Watson 		    struct msqid_kernel *msqkptr, struct label *msqklabel);
35542726d8aSRobert Watson 	int	(*mpo_check_sysv_msqsnd)(struct ucred *cred,
35642726d8aSRobert Watson 		    struct msqid_kernel *msqkptr, struct label *msqklabel);
35742726d8aSRobert Watson 	int	(*mpo_check_sysv_msqrcv)(struct ucred *cred,
35842726d8aSRobert Watson 		    struct msqid_kernel *msqkptr, struct label *msqklabel);
35942726d8aSRobert Watson 	int	(*mpo_check_sysv_msqctl)(struct ucred *cred,
36042726d8aSRobert Watson 		    struct msqid_kernel *msqkptr, struct label *msqklabel,
36142726d8aSRobert Watson 		    int cmd);
36242726d8aSRobert Watson 	int	(*mpo_check_sysv_semctl)(struct ucred *cred,
36342726d8aSRobert Watson 		    struct semid_kernel *semakptr, struct label *semaklabel,
36442726d8aSRobert Watson 		    int cmd);
36542726d8aSRobert Watson 	int	(*mpo_check_sysv_semget)(struct ucred *cred,
36642726d8aSRobert Watson 		    struct semid_kernel *semakptr, struct label *semaklabel);
36742726d8aSRobert Watson 	int	(*mpo_check_sysv_semop)(struct ucred *cred,
36842726d8aSRobert Watson 		    struct semid_kernel *semakptr, struct label *semaklabel,
36942726d8aSRobert Watson 		    size_t accesstype);
37042726d8aSRobert Watson 	int	(*mpo_check_sysv_shmat)(struct ucred *cred,
37142726d8aSRobert Watson 		    struct shmid_kernel *shmsegptr,
37242726d8aSRobert Watson 		    struct label *shmseglabel, int shmflg);
37342726d8aSRobert Watson 	int	(*mpo_check_sysv_shmctl)(struct ucred *cred,
37442726d8aSRobert Watson 		    struct shmid_kernel *shmsegptr,
37542726d8aSRobert Watson 		    struct label *shmseglabel, int cmd);
37642726d8aSRobert Watson 	int	(*mpo_check_sysv_shmdt)(struct ucred *cred,
37742726d8aSRobert Watson 		    struct shmid_kernel *shmsegptr,
37842726d8aSRobert Watson 		    struct label *shmseglabel);
37942726d8aSRobert Watson 	int	(*mpo_check_sysv_shmget)(struct ucred *cred,
38042726d8aSRobert Watson 		    struct shmid_kernel *shmsegptr,
38142726d8aSRobert Watson 		    struct label *shmseglabel, int shmflg);
382e686e5aeSRobert Watson 	int	(*mpo_check_kenv_dump)(struct ucred *cred);
383e686e5aeSRobert Watson 	int	(*mpo_check_kenv_get)(struct ucred *cred, char *name);
384e686e5aeSRobert Watson 	int	(*mpo_check_kenv_set)(struct ucred *cred, char *name,
385e686e5aeSRobert Watson 		    char *value);
386e686e5aeSRobert Watson 	int	(*mpo_check_kenv_unset)(struct ucred *cred, char *name);
387a3df768bSRobert Watson 	int	(*mpo_check_kld_load)(struct ucred *cred, struct vnode *vp,
388a3df768bSRobert Watson 		    struct label *vlabel);
389a3df768bSRobert Watson 	int	(*mpo_check_kld_stat)(struct ucred *cred);
390a3df768bSRobert Watson 	int	(*mpo_check_kld_unload)(struct ucred *cred);
391ddcdf265SRobert Watson 	int	(*mpo_check_mount_stat)(struct ucred *cred, struct mount *mp,
392ddcdf265SRobert Watson 		    struct label *mntlabel);
3934795b82cSRobert Watson 	int	(*mpo_check_pipe_ioctl)(struct ucred *cred,
3944795b82cSRobert Watson 		    struct pipepair *pp, struct label *pipelabel,
3954795b82cSRobert Watson 		    unsigned long cmd, void *data);
3964795b82cSRobert Watson 	int	(*mpo_check_pipe_poll)(struct ucred *cred,
3974795b82cSRobert Watson 		    struct pipepair *pp, struct label *pipelabel);
3984795b82cSRobert Watson 	int	(*mpo_check_pipe_read)(struct ucred *cred,
3994795b82cSRobert Watson 		    struct pipepair *pp, struct label *pipelabel);
400ddcdf265SRobert Watson 	int	(*mpo_check_pipe_relabel)(struct ucred *cred,
4014795b82cSRobert Watson 		    struct pipepair *pp, struct label *pipelabel,
402ddcdf265SRobert Watson 		    struct label *newlabel);
4034795b82cSRobert Watson 	int	(*mpo_check_pipe_stat)(struct ucred *cred,
4044795b82cSRobert Watson 		    struct pipepair *pp, struct label *pipelabel);
4054795b82cSRobert Watson 	int	(*mpo_check_pipe_write)(struct ucred *cred,
4064795b82cSRobert Watson 		    struct pipepair *pp, struct label *pipelabel);
407ddcdf265SRobert Watson 	int	(*mpo_check_proc_debug)(struct ucred *cred,
408ddcdf265SRobert Watson 		    struct proc *proc);
409ddcdf265SRobert Watson 	int	(*mpo_check_proc_sched)(struct ucred *cred,
410ddcdf265SRobert Watson 		    struct proc *proc);
411030a28b3SRobert Watson 	int	(*mpo_check_proc_setuid)(struct ucred *cred, uid_t uid);
412030a28b3SRobert Watson 	int	(*mpo_check_proc_seteuid)(struct ucred *cred, uid_t euid);
413030a28b3SRobert Watson 	int	(*mpo_check_proc_setgid)(struct ucred *cred, gid_t gid);
414030a28b3SRobert Watson 	int	(*mpo_check_proc_setegid)(struct ucred *cred, gid_t egid);
415030a28b3SRobert Watson 	int	(*mpo_check_proc_setgroups)(struct ucred *cred, int ngroups,
416030a28b3SRobert Watson 		    gid_t *gidset);
417030a28b3SRobert Watson 	int	(*mpo_check_proc_setreuid)(struct ucred *cred, uid_t ruid,
418030a28b3SRobert Watson 		    uid_t euid);
419030a28b3SRobert Watson 	int	(*mpo_check_proc_setregid)(struct ucred *cred, gid_t rgid,
420030a28b3SRobert Watson 		    gid_t egid);
421030a28b3SRobert Watson 	int	(*mpo_check_proc_setresuid)(struct ucred *cred, uid_t ruid,
422030a28b3SRobert Watson 		    uid_t euid, uid_t suid);
423030a28b3SRobert Watson 	int	(*mpo_check_proc_setresgid)(struct ucred *cred, gid_t rgid,
424030a28b3SRobert Watson 		    gid_t egid, gid_t sgid);
425ddcdf265SRobert Watson 	int	(*mpo_check_proc_signal)(struct ucred *cred,
426ddcdf265SRobert Watson 		    struct proc *proc, int signum);
427babe9a2bSRobert Watson 	int	(*mpo_check_proc_wait)(struct ucred *cred,
428babe9a2bSRobert Watson 		    struct proc *proc);
4297f53207bSRobert Watson 	int	(*mpo_check_socket_accept)(struct ucred *cred,
4307f53207bSRobert Watson 		    struct socket *so, struct label *socketlabel);
431ddcdf265SRobert Watson 	int	(*mpo_check_socket_bind)(struct ucred *cred,
432ddcdf265SRobert Watson 		    struct socket *so, struct label *socketlabel,
433ddcdf265SRobert Watson 		    struct sockaddr *sockaddr);
434ddcdf265SRobert Watson 	int	(*mpo_check_socket_connect)(struct ucred *cred,
435ddcdf265SRobert Watson 		    struct socket *so, struct label *socketlabel,
436ddcdf265SRobert Watson 		    struct sockaddr *sockaddr);
437fb95b5d3SRobert Watson 	int	(*mpo_check_socket_deliver)(struct socket *so,
438ddcdf265SRobert Watson 		    struct label *socketlabel, struct mbuf *m,
439ddcdf265SRobert Watson 		    struct label *mbuflabel);
440fb95b5d3SRobert Watson 	int	(*mpo_check_socket_listen)(struct ucred *cred,
441fb95b5d3SRobert Watson 		    struct socket *so, struct label *socketlabel);
4427f53207bSRobert Watson 	int	(*mpo_check_socket_poll)(struct ucred *cred,
4437f53207bSRobert Watson 		    struct socket *so, struct label *socketlabel);
444b371c939SRobert Watson 	int	(*mpo_check_socket_receive)(struct ucred *cred,
445b371c939SRobert Watson 		    struct socket *so, struct label *socketlabel);
446ddcdf265SRobert Watson 	int	(*mpo_check_socket_relabel)(struct ucred *cred,
447ddcdf265SRobert Watson 		    struct socket *so, struct label *socketlabel,
448ddcdf265SRobert Watson 		    struct label *newlabel);
449b371c939SRobert Watson 	int	(*mpo_check_socket_send)(struct ucred *cred,
450b371c939SRobert Watson 		    struct socket *so, struct label *socketlabel);
4517f53207bSRobert Watson 	int	(*mpo_check_socket_stat)(struct ucred *cred,
4527f53207bSRobert Watson 		    struct socket *so, struct label *socketlabel);
453ddcdf265SRobert Watson 	int	(*mpo_check_socket_visible)(struct ucred *cred,
454ddcdf265SRobert Watson 		    struct socket *so, struct label *socketlabel);
45592835789SRobert Watson 	int	(*mpo_check_sysarch_ioperm)(struct ucred *cred);
456e5e820fdSRobert Watson 	int	(*mpo_check_system_acct)(struct ucred *cred,
457e5e820fdSRobert Watson 		    struct vnode *vp, struct label *vlabel);
458e5e820fdSRobert Watson 	int	(*mpo_check_system_nfsd)(struct ucred *cred);
459a2ecb9b7SRobert Watson 	int	(*mpo_check_system_reboot)(struct ucred *cred, int howto);
4604b8d5f2dSRobert Watson 	int	(*mpo_check_system_settime)(struct ucred *cred);
46103ce2c0cSRobert Watson 	int	(*mpo_check_system_swapon)(struct ucred *cred,
46203ce2c0cSRobert Watson 		    struct vnode *vp, struct label *label);
4631b2c2ab2SRobert Watson 	int	(*mpo_check_system_swapoff)(struct ucred *cred,
4641b2c2ab2SRobert Watson 		    struct vnode *vp, struct label *label);
46563dba32bSPawel Jakub Dawidek 	int	(*mpo_check_system_sysctl)(struct ucred *cred,
46663dba32bSPawel Jakub Dawidek 		    struct sysctl_oid *oidp, void *arg1, int arg2,
46763dba32bSPawel Jakub Dawidek 		    struct sysctl_req *req);
468ddcdf265SRobert Watson 	int	(*mpo_check_vnode_access)(struct ucred *cred,
469b914de36SRobert Watson 		    struct vnode *vp, struct label *label, int acc_mode);
470ddcdf265SRobert Watson 	int	(*mpo_check_vnode_chdir)(struct ucred *cred,
471ddcdf265SRobert Watson 		    struct vnode *dvp, struct label *dlabel);
472ddcdf265SRobert Watson 	int	(*mpo_check_vnode_chroot)(struct ucred *cred,
473ddcdf265SRobert Watson 		    struct vnode *dvp, struct label *dlabel);
474ddcdf265SRobert Watson 	int	(*mpo_check_vnode_create)(struct ucred *cred,
475ddcdf265SRobert Watson 		    struct vnode *dvp, struct label *dlabel,
476ddcdf265SRobert Watson 		    struct componentname *cnp, struct vattr *vap);
477ddcdf265SRobert Watson 	int	(*mpo_check_vnode_delete)(struct ucred *cred,
478ddcdf265SRobert Watson 		    struct vnode *dvp, struct label *dlabel,
4795c8dd342SRobert Watson 		    struct vnode *vp, struct label *label,
4805c8dd342SRobert Watson 		    struct componentname *cnp);
481ddcdf265SRobert Watson 	int	(*mpo_check_vnode_deleteacl)(struct ucred *cred,
482ddcdf265SRobert Watson 		    struct vnode *vp, struct label *label, acl_type_t type);
483c096756cSRobert Watson 	int	(*mpo_check_vnode_deleteextattr)(struct ucred *cred,
484c096756cSRobert Watson 		    struct vnode *vp, struct label *label, int attrnamespace,
485c096756cSRobert Watson 		    const char *name);
486ddcdf265SRobert Watson 	int	(*mpo_check_vnode_exec)(struct ucred *cred, struct vnode *vp,
4879fa3506eSRobert Watson 		    struct label *label, struct image_params *imgp,
4889fa3506eSRobert Watson 		    struct label *execlabel);
489ddcdf265SRobert Watson 	int	(*mpo_check_vnode_getacl)(struct ucred *cred,
490ddcdf265SRobert Watson 		    struct vnode *vp, struct label *label, acl_type_t type);
491ddcdf265SRobert Watson 	int	(*mpo_check_vnode_getextattr)(struct ucred *cred,
492ddcdf265SRobert Watson 		    struct vnode *vp, struct label *label, int attrnamespace,
493ddcdf265SRobert Watson 		    const char *name, struct uio *uio);
4940a694196SRobert Watson 	int	(*mpo_check_vnode_link)(struct ucred *cred, struct vnode *dvp,
4950a694196SRobert Watson 		    struct label *dlabel, struct vnode *vp,
4960a694196SRobert Watson 		    struct label *label, struct componentname *cnp);
497c096756cSRobert Watson 	int	(*mpo_check_vnode_listextattr)(struct ucred *cred,
498c096756cSRobert Watson 		    struct vnode *vp, struct label *label, int attrnamespace);
499ddcdf265SRobert Watson 	int	(*mpo_check_vnode_lookup)(struct ucred *cred,
500ddcdf265SRobert Watson 		    struct vnode *dvp, struct label *dlabel,
501ddcdf265SRobert Watson 		    struct componentname *cnp);
502e183f80eSRobert Watson 	int	(*mpo_check_vnode_mmap)(struct ucred *cred, struct vnode *vp,
503c92163dcSChristian S.J. Peron 		    struct label *label, int prot, int flags);
504e183f80eSRobert Watson 	void	(*mpo_check_vnode_mmap_downgrade)(struct ucred *cred,
505e183f80eSRobert Watson 		    struct vnode *vp, struct label *label, int *prot);
506e183f80eSRobert Watson 	int	(*mpo_check_vnode_mprotect)(struct ucred *cred,
507e183f80eSRobert Watson 		    struct vnode *vp, struct label *label, int prot);
508ddcdf265SRobert Watson 	int	(*mpo_check_vnode_open)(struct ucred *cred, struct vnode *vp,
509b914de36SRobert Watson 		    struct label *label, int acc_mode);
510177142e4SRobert Watson 	int	(*mpo_check_vnode_poll)(struct ucred *active_cred,
511177142e4SRobert Watson 		    struct ucred *file_cred, struct vnode *vp,
5127f724f8bSRobert Watson 		    struct label *label);
513177142e4SRobert Watson 	int	(*mpo_check_vnode_read)(struct ucred *active_cred,
514177142e4SRobert Watson 		    struct ucred *file_cred, struct vnode *vp,
5157f724f8bSRobert Watson 		    struct label *label);
516ddcdf265SRobert Watson 	int	(*mpo_check_vnode_readdir)(struct ucred *cred,
517ddcdf265SRobert Watson 		    struct vnode *dvp, struct label *dlabel);
518ddcdf265SRobert Watson 	int	(*mpo_check_vnode_readlink)(struct ucred *cred,
519ddcdf265SRobert Watson 		    struct vnode *vp, struct label *label);
520ddcdf265SRobert Watson 	int	(*mpo_check_vnode_relabel)(struct ucred *cred,
521ddcdf265SRobert Watson 		    struct vnode *vp, struct label *vnodelabel,
522ddcdf265SRobert Watson 		    struct label *newlabel);
523ddcdf265SRobert Watson 	int	(*mpo_check_vnode_rename_from)(struct ucred *cred,
524ddcdf265SRobert Watson 		    struct vnode *dvp, struct label *dlabel, struct vnode *vp,
525ddcdf265SRobert Watson 		    struct label *label, struct componentname *cnp);
526ddcdf265SRobert Watson 	int	(*mpo_check_vnode_rename_to)(struct ucred *cred,
527ddcdf265SRobert Watson 		    struct vnode *dvp, struct label *dlabel, struct vnode *vp,
528ddcdf265SRobert Watson 		    struct label *label, int samedir,
529ddcdf265SRobert Watson 		    struct componentname *cnp);
530ddcdf265SRobert Watson 	int	(*mpo_check_vnode_revoke)(struct ucred *cred,
531ddcdf265SRobert Watson 		    struct vnode *vp, struct label *label);
532ddcdf265SRobert Watson 	int	(*mpo_check_vnode_setacl)(struct ucred *cred,
533ddcdf265SRobert Watson 		    struct vnode *vp, struct label *label, acl_type_t type,
534ddcdf265SRobert Watson 		    struct acl *acl);
535ddcdf265SRobert Watson 	int	(*mpo_check_vnode_setextattr)(struct ucred *cred,
536ddcdf265SRobert Watson 		    struct vnode *vp, struct label *label, int attrnamespace,
537ddcdf265SRobert Watson 		    const char *name, struct uio *uio);
538ddcdf265SRobert Watson 	int	(*mpo_check_vnode_setflags)(struct ucred *cred,
539ddcdf265SRobert Watson 		    struct vnode *vp, struct label *label, u_long flags);
540ddcdf265SRobert Watson 	int	(*mpo_check_vnode_setmode)(struct ucred *cred,
541ddcdf265SRobert Watson 		    struct vnode *vp, struct label *label, mode_t mode);
542ddcdf265SRobert Watson 	int	(*mpo_check_vnode_setowner)(struct ucred *cred,
543ddcdf265SRobert Watson 		    struct vnode *vp, struct label *label, uid_t uid,
544ddcdf265SRobert Watson 		    gid_t gid);
545ddcdf265SRobert Watson 	int	(*mpo_check_vnode_setutimes)(struct ucred *cred,
546ddcdf265SRobert Watson 		    struct vnode *vp, struct label *label,
547ddcdf265SRobert Watson 		    struct timespec atime, struct timespec mtime);
548177142e4SRobert Watson 	int	(*mpo_check_vnode_stat)(struct ucred *active_cred,
549177142e4SRobert Watson 		    struct ucred *file_cred, struct vnode *vp,
550ddcdf265SRobert Watson 		    struct label *label);
551177142e4SRobert Watson 	int	(*mpo_check_vnode_write)(struct ucred *active_cred,
552177142e4SRobert Watson 		    struct ucred *file_cred, struct vnode *vp,
5537f724f8bSRobert Watson 		    struct label *label);
554ddcdf265SRobert Watson };
555ddcdf265SRobert Watson 
5563459e1d2SRobert Watson /*
5573459e1d2SRobert Watson  * struct mac_policy_conf is the registration structure for policies, and is
5583459e1d2SRobert Watson  * provided to the MAC Framework using MAC_POLICY_SET() to invoke a SYSINIT
5593459e1d2SRobert Watson  * to register the policy.  In general, the fields are immutable, with the
5603459e1d2SRobert Watson  * exception of the "security field", run-time flags, and policy list entry,
5613459e1d2SRobert Watson  * which are managed by the MAC Framework.  Be careful when modifying this
5623459e1d2SRobert Watson  * structure, as its layout is statically compiled into all policies.
5633459e1d2SRobert Watson  */
564ddcdf265SRobert Watson struct mac_policy_conf {
565ddcdf265SRobert Watson 	char				*mpc_name;	/* policy name */
566ddcdf265SRobert Watson 	char				*mpc_fullname;	/* policy full name */
567ddcdf265SRobert Watson 	struct mac_policy_ops		*mpc_ops;	/* policy operations */
568ddcdf265SRobert Watson 	int				 mpc_loadtime_flags;	/* flags */
569ddcdf265SRobert Watson 	int				*mpc_field_off; /* security field */
570ddcdf265SRobert Watson 	int				 mpc_runtime_flags; /* flags */
571ddcdf265SRobert Watson 	LIST_ENTRY(mac_policy_conf)	 mpc_list;	/* global list */
572ddcdf265SRobert Watson };
573ddcdf265SRobert Watson 
574ddcdf265SRobert Watson /* Flags for the mpc_loadtime_flags field. */
575ddcdf265SRobert Watson #define	MPC_LOADTIME_FLAG_NOTLATE	0x00000001
576ddcdf265SRobert Watson #define	MPC_LOADTIME_FLAG_UNLOADOK	0x00000002
577225bff6fSRobert Watson #define	MPC_LOADTIME_FLAG_LABELMBUFS	0x00000004
578ddcdf265SRobert Watson 
579ddcdf265SRobert Watson /* Flags for the mpc_runtime_flags field. */
580ddcdf265SRobert Watson #define	MPC_RUNTIME_FLAG_REGISTERED	0x00000001
581ddcdf265SRobert Watson 
5825c8dd342SRobert Watson #define	MAC_POLICY_SET(mpops, mpname, mpfullname, mpflags, privdata_wanted) \
583ddcdf265SRobert Watson 	static struct mac_policy_conf mpname##_mac_policy_conf = {	\
584ddcdf265SRobert Watson 		#mpname,						\
585ddcdf265SRobert Watson 		mpfullname,						\
5865c8dd342SRobert Watson 		mpops,							\
587ddcdf265SRobert Watson 		mpflags,						\
588ddcdf265SRobert Watson 		privdata_wanted,					\
589ddcdf265SRobert Watson 		0,							\
590ddcdf265SRobert Watson 	};								\
591ddcdf265SRobert Watson 	static moduledata_t mpname##_mod = {				\
592ddcdf265SRobert Watson 		#mpname,						\
593ddcdf265SRobert Watson 		mac_policy_modevent,					\
594ddcdf265SRobert Watson 		&mpname##_mac_policy_conf				\
595ddcdf265SRobert Watson 	};								\
596af8d7cbeSRobert Watson 	MODULE_DEPEND(mpname, kernel_mac_support, 2, 2, 2);		\
597ddcdf265SRobert Watson 	DECLARE_MODULE(mpname, mpname##_mod, SI_SUB_MAC_POLICY,		\
598ddcdf265SRobert Watson 	    SI_ORDER_MIDDLE)
599ddcdf265SRobert Watson 
600ddcdf265SRobert Watson int	mac_policy_modevent(module_t mod, int type, void *data);
601ddcdf265SRobert Watson 
602ddcdf265SRobert Watson #define	LABEL_TO_SLOT(l, s)	(l)->l_perpolicy[s]
603ddcdf265SRobert Watson 
60402ebd2bcSRobert Watson #endif /* !_SYS_MAC_POLICY_H_ */
605