xref: /freebsd/sys/security/mac/mac_policy.h (revision c4f6a2a9e1b1879b618c436ab4f56ff75c73a0f5)
1 /*-
2  * Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson
3  * Copyright (c) 2001, 2002 Networks Associates Technology, Inc.
4  * All rights reserved.
5  *
6  * This software was developed by Robert Watson for the TrustedBSD Project.
7  *
8  * This software was developed for the FreeBSD Project in part by NAI Labs,
9  * the Security Research Division of Network Associates, Inc. under
10  * DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA
11  * CHATS research program.
12  *
13  * Redistribution and use in source and binary forms, with or without
14  * modification, are permitted provided that the following conditions
15  * are met:
16  * 1. Redistributions of source code must retain the above copyright
17  *    notice, this list of conditions and the following disclaimer.
18  * 2. Redistributions in binary form must reproduce the above copyright
19  *    notice, this list of conditions and the following disclaimer in the
20  *    documentation and/or other materials provided with the distribution.
21  * 3. The names of the authors may not be used to endorse or promote
22  *    products derived from this software without specific prior written
23  *    permission.
24  *
25  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
26  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
27  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
28  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
29  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
30  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
31  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
32  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
33  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
34  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
35  * SUCH DAMAGE.
36  *
37  * $FreeBSD$
38  */
39 /*
40  * Kernel interface for MAC policy modules.
41  */
42 #ifndef _SYS_MAC_POLICY_H
43 #define _SYS_MAC_POLICY_H
44 
45 /*-
46  * Pluggable access control policy definition structure.
47  *
48  * List of operations that are performed as part of the implementation
49  * of a MAC policy.  Policy implementors declare operations with a
50  * mac_policy_ops structure, and using the MAC_POLICY_SET() macro.
51  * If an entry point is not declared, then then the policy will be ignored
52  * during evaluation of that event or check.
53  *
54  * Operations are sorted first by general class of operation, then
55  * alphabetically.
56  */
57 struct mac_policy_conf;
58 struct mac_policy_ops {
59 	/*
60 	 * Policy module operations.
61 	 */
62 	void	(*mpo_destroy)(struct mac_policy_conf *mpc);
63 	void	(*mpo_init)(struct mac_policy_conf *mpc);
64 
65 	/*
66 	 * General policy-directed security system call so that policies
67 	 * may implement new services without reserving explicit
68 	 * system call numbers.
69 	 */
70 	int	(*mpo_syscall)(struct thread *td, int call, void *arg);
71 
72 	/*
73 	 * Label operations.
74 	 */
75 	void	(*mpo_init_bpfdesc)(struct bpf_d *, struct label *label);
76 	void	(*mpo_init_cred)(struct ucred *, struct label *label);
77 	void	(*mpo_init_devfsdirent)(struct devfs_dirent *,
78 		    struct label *label);
79 	void	(*mpo_init_ifnet)(struct ifnet *, struct label *label);
80 	void	(*mpo_init_ipq)(struct ipq *ipq, struct label *label);
81 	int	(*mpo_init_mbuf)(struct mbuf *, int how, struct label *label);
82 	void	(*mpo_init_mount)(struct mount *, struct label *mntlabel,
83 		    struct label *fslabel);
84 	void	(*mpo_init_socket)(struct socket *so, struct label *label,
85 		    struct label *peerlabel);
86 	void	(*mpo_init_pipe)(struct pipe *pipe, struct label *label);
87 	void	(*mpo_init_temp)(struct label *label);
88 	void	(*mpo_init_vnode)(struct vnode *, struct label *label);
89 	void	(*mpo_destroy_bpfdesc)(struct bpf_d *, struct label *label);
90 	void	(*mpo_destroy_cred)(struct ucred *, struct label *label);
91 	void	(*mpo_destroy_devfsdirent)(struct devfs_dirent *de,
92 		    struct label *label);
93 	void	(*mpo_destroy_ifnet)(struct ifnet *, struct label *label);
94 	void	(*mpo_destroy_ipq)(struct ipq *ipq, struct label *label);
95 	void	(*mpo_destroy_mbuf)(struct mbuf *, struct label *label);
96 	void	(*mpo_destroy_mount)(struct mount *, struct label *mntlabel,
97 		    struct label *fslabel);
98 	void	(*mpo_destroy_socket)(struct socket *so, struct label *label,
99 		    struct label *peerlabel);
100 	void	(*mpo_destroy_pipe)(struct pipe *pipe, struct label *label);
101 	void	(*mpo_destroy_temp)(struct label *label);
102 	void	(*mpo_destroy_vnode)(struct vnode *, struct label *label);
103 	int	(*mpo_externalize)(struct label *label, struct mac *extmac);
104 	int	(*mpo_internalize)(struct label *label, struct mac *extmac);
105 
106 	/*
107 	 * Labeling event operations: file system objects, and things that
108 	 * look a lot like file system objects.
109 	 */
110 	void	(*mpo_create_devfs_device)(dev_t dev, struct devfs_dirent *de,
111 		    struct label *label);
112 	void	(*mpo_create_devfs_directory)(char *dirname, int dirnamelen,
113 		    struct devfs_dirent *de, struct label *label);
114 	void	(*mpo_create_devfs_vnode)(struct devfs_dirent *de,
115 		    struct label *direntlabel, struct vnode *vp,
116 		    struct label *vnodelabel);
117 	void	(*mpo_create_vnode)(struct ucred *cred, struct vnode *parent,
118 		    struct label *parentlabel, struct vnode *child,
119 		    struct label *childlabel);
120 	void	(*mpo_create_mount)(struct ucred *cred, struct mount *mp,
121 		    struct label *mntlabel, struct label *fslabel);
122 	void	(*mpo_create_root_mount)(struct ucred *cred, struct mount *mp,
123 		    struct label *mountlabel, struct label *fslabel);
124 	void	(*mpo_relabel_vnode)(struct ucred *cred, struct vnode *vp,
125 		    struct label *vnodelabel, struct label *label);
126 	int	(*mpo_stdcreatevnode_ea)(struct vnode *vp,
127 		    struct label *vnodelabel);
128 	void	(*mpo_update_devfsdirent)(struct devfs_dirent *devfs_dirent,
129 		    struct label *direntlabel, struct vnode *vp,
130 		    struct label *vnodelabel);
131 	void	(*mpo_update_procfsvnode)(struct vnode *vp,
132 		    struct label *vnodelabel, struct ucred *cred);
133 	int	(*mpo_update_vnode_from_extattr)(struct vnode *vp,
134 		    struct label *vnodelabel, struct mount *mp,
135 		    struct label *fslabel);
136 	int	(*mpo_update_vnode_from_externalized)(struct vnode *vp,
137 		    struct label *vnodelabel, struct mac *mac);
138 	void	(*mpo_update_vnode_from_mount)(struct vnode *vp,
139 		    struct label *vnodelabel, struct mount *mp,
140 		    struct label *fslabel);
141 
142 	/*
143 	 * Labeling event operations: IPC objects.
144 	 */
145 	void	(*mpo_create_mbuf_from_socket)(struct socket *so,
146 		    struct label *socketlabel, struct mbuf *m,
147 		    struct label *mbuflabel);
148 	void	(*mpo_create_socket)(struct ucred *cred, struct socket *so,
149 		    struct label *socketlabel);
150 	void	(*mpo_create_socket_from_socket)(struct socket *oldsocket,
151 		    struct label *oldsocketlabel, struct socket *newsocket,
152 		    struct label *newsocketlabel);
153 	void	(*mpo_relabel_socket)(struct ucred *cred, struct socket *so,
154 		    struct label *oldlabel, struct label *newlabel);
155 	void	(*mpo_relabel_pipe)(struct ucred *cred, struct pipe *pipe,
156 		    struct label *oldlabel, struct label *newlabel);
157 	void	(*mpo_set_socket_peer_from_mbuf)(struct mbuf *mbuf,
158 		    struct label *mbuflabel, struct socket *so,
159 		    struct label *socketpeerlabel);
160 	void	(*mpo_set_socket_peer_from_socket)(struct socket *oldsocket,
161 		    struct label *oldsocketlabel, struct socket *newsocket,
162 		    struct label *newsocketpeerlabel);
163 	void	(*mpo_create_pipe)(struct ucred *cred, struct pipe *pipe,
164 		    struct label *pipelabel);
165 
166 	/*
167 	 * Labeling event operations: network objects.
168 	 */
169 	void	(*mpo_create_bpfdesc)(struct ucred *cred, struct bpf_d *bpf_d,
170 		    struct label *bpflabel);
171 	void	(*mpo_create_ifnet)(struct ifnet *ifnet,
172 		    struct label *ifnetlabel);
173 	void	(*mpo_create_ipq)(struct mbuf *fragment,
174 		    struct label *fragmentlabel, struct ipq *ipq,
175 		    struct label *ipqlabel);
176 	void	(*mpo_create_datagram_from_ipq)
177 		    (struct ipq *ipq, struct label *ipqlabel,
178 		    struct mbuf *datagram, struct label *datagramlabel);
179 	void	(*mpo_create_fragment)(struct mbuf *datagram,
180 		    struct label *datagramlabel, struct mbuf *fragment,
181 		    struct label *fragmentlabel);
182 	void	(*mpo_create_mbuf_from_mbuf)(struct mbuf *oldmbuf,
183 		    struct label *oldlabel, struct mbuf *newmbuf,
184 		    struct label *newlabel);
185 	void	(*mpo_create_mbuf_linklayer)(struct ifnet *ifnet,
186 		    struct label *ifnetlabel, struct mbuf *mbuf,
187 		    struct label *mbuflabel);
188 	void	(*mpo_create_mbuf_from_bpfdesc)(struct bpf_d *bpf_d,
189 		    struct label *bpflabel, struct mbuf *mbuf,
190 		    struct label *mbuflabel);
191 	void	(*mpo_create_mbuf_from_ifnet)(struct ifnet *ifnet,
192 		    struct label *ifnetlabel, struct mbuf *mbuf,
193 		    struct label *mbuflabel);
194 	void	(*mpo_create_mbuf_multicast_encap)(struct mbuf *oldmbuf,
195 		    struct label *oldmbuflabel, struct ifnet *ifnet,
196 		    struct label *ifnetlabel, struct mbuf *newmbuf,
197 		    struct label *newmbuflabel);
198 	void	(*mpo_create_mbuf_netlayer)(struct mbuf *oldmbuf,
199 		    struct label *oldmbuflabel, struct mbuf *newmbuf,
200 		    struct label *newmbuflabel);
201 	int	(*mpo_fragment_match)(struct mbuf *fragment,
202 		    struct label *fragmentlabel, struct ipq *ipq,
203 		    struct label *ipqlabel);
204 	void	(*mpo_relabel_ifnet)(struct ucred *cred, struct ifnet *ifnet,
205 		    struct label *ifnetlabel, struct label *newlabel);
206 	void	(*mpo_update_ipq)(struct mbuf *fragment,
207 		    struct label *fragmentlabel, struct ipq *ipq,
208 		    struct label *ipqlabel);
209 
210 	/*
211 	 * Labeling event operations: processes.
212 	 */
213 	void	(*mpo_create_cred)(struct ucred *parent_cred,
214 		    struct ucred *child_cred);
215 	void	(*mpo_execve_transition)(struct ucred *old, struct ucred *new,
216 		    struct vnode *vp, struct label *vnodelabel);
217 	int	(*mpo_execve_will_transition)(struct ucred *old,
218 		    struct vnode *vp, struct label *vnodelabel);
219 	void	(*mpo_create_proc0)(struct ucred *cred);
220 	void	(*mpo_create_proc1)(struct ucred *cred);
221 	void	(*mpo_relabel_cred)(struct ucred *cred,
222 		    struct label *newlabel);
223 
224 	/*
225 	 * Access control checks.
226 	 */
227 	int	(*mpo_check_bpfdesc_receive)(struct bpf_d *bpf_d,
228 		    struct label *bpflabel, struct ifnet *ifnet,
229 		    struct label *ifnetlabel);
230 	int	(*mpo_check_cred_relabel)(struct ucred *cred,
231 		    struct label *newlabel);
232 	int	(*mpo_check_cred_visible)(struct ucred *u1, struct ucred *u2);
233 	int	(*mpo_check_ifnet_relabel)(struct ucred *cred,
234 		    struct ifnet *ifnet, struct label *ifnetlabel,
235 		    struct label *newlabel);
236 	int	(*mpo_check_ifnet_transmit)(struct ifnet *ifnet,
237 		    struct label *ifnetlabel, struct mbuf *m,
238 		    struct label *mbuflabel);
239 	int	(*mpo_check_mount_stat)(struct ucred *cred, struct mount *mp,
240 		    struct label *mntlabel);
241 	int	(*mpo_check_pipe_ioctl)(struct ucred *cred, struct pipe *pipe,
242 		    struct label *pipelabel, unsigned long cmd, void *data);
243 	int	(*mpo_check_pipe_poll)(struct ucred *cred, struct pipe *pipe,
244 		    struct label *pipelabel);
245 	int	(*mpo_check_pipe_read)(struct ucred *cred, struct pipe *pipe,
246 		    struct label *pipelabel);
247 	int	(*mpo_check_pipe_relabel)(struct ucred *cred,
248 		    struct pipe *pipe, struct label *pipelabel,
249 		    struct label *newlabel);
250 	int	(*mpo_check_pipe_stat)(struct ucred *cred, struct pipe *pipe,
251 		    struct label *pipelabel);
252 	int	(*mpo_check_pipe_write)(struct ucred *cred, struct pipe *pipe,
253 		    struct label *pipelabel);
254 	int	(*mpo_check_proc_debug)(struct ucred *cred,
255 		    struct proc *proc);
256 	int	(*mpo_check_proc_sched)(struct ucred *cred,
257 		    struct proc *proc);
258 	int	(*mpo_check_proc_signal)(struct ucred *cred,
259 		    struct proc *proc, int signum);
260 	int	(*mpo_check_socket_bind)(struct ucred *cred,
261 		    struct socket *so, struct label *socketlabel,
262 		    struct sockaddr *sockaddr);
263 	int	(*mpo_check_socket_connect)(struct ucred *cred,
264 		    struct socket *so, struct label *socketlabel,
265 		    struct sockaddr *sockaddr);
266 	int	(*mpo_check_socket_deliver)(struct socket *so,
267 		    struct label *socketlabel, struct mbuf *m,
268 		    struct label *mbuflabel);
269 	int	(*mpo_check_socket_listen)(struct ucred *cred,
270 		    struct socket *so, struct label *socketlabel);
271 	int	(*mpo_check_socket_relabel)(struct ucred *cred,
272 		    struct socket *so, struct label *socketlabel,
273 		    struct label *newlabel);
274 	int	(*mpo_check_socket_visible)(struct ucred *cred,
275 		    struct socket *so, struct label *socketlabel);
276 	int	(*mpo_check_vnode_access)(struct ucred *cred,
277 		    struct vnode *vp, struct label *label, int flags);
278 	int	(*mpo_check_vnode_chdir)(struct ucred *cred,
279 		    struct vnode *dvp, struct label *dlabel);
280 	int	(*mpo_check_vnode_chroot)(struct ucred *cred,
281 		    struct vnode *dvp, struct label *dlabel);
282 	int	(*mpo_check_vnode_create)(struct ucred *cred,
283 		    struct vnode *dvp, struct label *dlabel,
284 		    struct componentname *cnp, struct vattr *vap);
285 	int	(*mpo_check_vnode_delete)(struct ucred *cred,
286 		    struct vnode *dvp, struct label *dlabel,
287 		    struct vnode *vp, void *label, struct componentname *cnp);
288 	int	(*mpo_check_vnode_deleteacl)(struct ucred *cred,
289 		    struct vnode *vp, struct label *label, acl_type_t type);
290 	int	(*mpo_check_vnode_exec)(struct ucred *cred, struct vnode *vp,
291 		    struct label *label);
292 	int	(*mpo_check_vnode_getacl)(struct ucred *cred,
293 		    struct vnode *vp, struct label *label, acl_type_t type);
294 	int	(*mpo_check_vnode_getextattr)(struct ucred *cred,
295 		    struct vnode *vp, struct label *label, int attrnamespace,
296 		    const char *name, struct uio *uio);
297 	int	(*mpo_check_vnode_lookup)(struct ucred *cred,
298 		    struct vnode *dvp, struct label *dlabel,
299 		    struct componentname *cnp);
300 	vm_prot_t	(*mpo_check_vnode_mmap_perms)(struct ucred *cred,
301 		    struct vnode *vp, struct label *label, int newmapping);
302 	int	(*mpo_check_vnode_open)(struct ucred *cred, struct vnode *vp,
303 		    struct label *label, mode_t acc_mode);
304 	int	(*mpo_check_vnode_poll)(struct ucred *active_cred,
305 		    struct ucred *file_cred, struct vnode *vp,
306 		    struct label *label);
307 	int	(*mpo_check_vnode_read)(struct ucred *active_cred,
308 		    struct ucred *file_cred, struct vnode *vp,
309 		    struct label *label);
310 	int	(*mpo_check_vnode_readdir)(struct ucred *cred,
311 		    struct vnode *dvp, struct label *dlabel);
312 	int	(*mpo_check_vnode_readlink)(struct ucred *cred,
313 		    struct vnode *vp, struct label *label);
314 	int	(*mpo_check_vnode_relabel)(struct ucred *cred,
315 		    struct vnode *vp, struct label *vnodelabel,
316 		    struct label *newlabel);
317 	int	(*mpo_check_vnode_rename_from)(struct ucred *cred,
318 		    struct vnode *dvp, struct label *dlabel, struct vnode *vp,
319 		    struct label *label, struct componentname *cnp);
320 	int	(*mpo_check_vnode_rename_to)(struct ucred *cred,
321 		    struct vnode *dvp, struct label *dlabel, struct vnode *vp,
322 		    struct label *label, int samedir,
323 		    struct componentname *cnp);
324 	int	(*mpo_check_vnode_revoke)(struct ucred *cred,
325 		    struct vnode *vp, struct label *label);
326 	int	(*mpo_check_vnode_setacl)(struct ucred *cred,
327 		    struct vnode *vp, struct label *label, acl_type_t type,
328 		    struct acl *acl);
329 	int	(*mpo_check_vnode_setextattr)(struct ucred *cred,
330 		    struct vnode *vp, struct label *label, int attrnamespace,
331 		    const char *name, struct uio *uio);
332 	int	(*mpo_check_vnode_setflags)(struct ucred *cred,
333 		    struct vnode *vp, struct label *label, u_long flags);
334 	int	(*mpo_check_vnode_setmode)(struct ucred *cred,
335 		    struct vnode *vp, struct label *label, mode_t mode);
336 	int	(*mpo_check_vnode_setowner)(struct ucred *cred,
337 		    struct vnode *vp, struct label *label, uid_t uid,
338 		    gid_t gid);
339 	int	(*mpo_check_vnode_setutimes)(struct ucred *cred,
340 		    struct vnode *vp, struct label *label,
341 		    struct timespec atime, struct timespec mtime);
342 	int	(*mpo_check_vnode_stat)(struct ucred *active_cred,
343 		    struct ucred *file_cred, struct vnode *vp,
344 		    struct label *label);
345 	int	(*mpo_check_vnode_write)(struct ucred *active_cred,
346 		    struct ucred *file_cred, struct vnode *vp,
347 		    struct label *label);
348 };
349 
350 typedef const void *macop_t;
351 
352 enum mac_op_constant {
353 	MAC_OP_LAST,
354 	MAC_DESTROY,
355 	MAC_INIT,
356 	MAC_SYSCALL,
357 	MAC_INIT_BPFDESC,
358 	MAC_INIT_CRED,
359 	MAC_INIT_DEVFSDIRENT,
360 	MAC_INIT_IFNET,
361 	MAC_INIT_IPQ,
362 	MAC_INIT_MBUF,
363 	MAC_INIT_MOUNT,
364 	MAC_INIT_PIPE,
365 	MAC_INIT_SOCKET,
366 	MAC_INIT_TEMP,
367 	MAC_INIT_VNODE,
368 	MAC_DESTROY_BPFDESC,
369 	MAC_DESTROY_CRED,
370 	MAC_DESTROY_DEVFSDIRENT,
371 	MAC_DESTROY_IFNET,
372 	MAC_DESTROY_IPQ,
373 	MAC_DESTROY_MBUF,
374 	MAC_DESTROY_MOUNT,
375 	MAC_DESTROY_PIPE,
376 	MAC_DESTROY_SOCKET,
377 	MAC_DESTROY_TEMP,
378 	MAC_DESTROY_VNODE,
379 	MAC_EXTERNALIZE,
380 	MAC_INTERNALIZE,
381 	MAC_CREATE_DEVFS_DEVICE,
382 	MAC_CREATE_DEVFS_DIRECTORY,
383 	MAC_CREATE_DEVFS_VNODE,
384 	MAC_CREATE_VNODE,
385 	MAC_CREATE_MOUNT,
386 	MAC_CREATE_ROOT_MOUNT,
387 	MAC_RELABEL_VNODE,
388 	MAC_STDCREATEVNODE_EA,
389 	MAC_UPDATE_DEVFSDIRENT,
390 	MAC_UPDATE_PROCFSVNODE,
391 	MAC_UPDATE_VNODE_FROM_EXTATTR,
392 	MAC_UPDATE_VNODE_FROM_EXTERNALIZED,
393 	MAC_UPDATE_VNODE_FROM_MOUNT,
394 	MAC_CREATE_MBUF_FROM_SOCKET,
395 	MAC_CREATE_PIPE,
396 	MAC_CREATE_SOCKET,
397 	MAC_CREATE_SOCKET_FROM_SOCKET,
398 	MAC_RELABEL_PIPE,
399 	MAC_RELABEL_SOCKET,
400 	MAC_SET_SOCKET_PEER_FROM_MBUF,
401 	MAC_SET_SOCKET_PEER_FROM_SOCKET,
402 	MAC_CREATE_BPFDESC,
403 	MAC_CREATE_DATAGRAM_FROM_IPQ,
404 	MAC_CREATE_IFNET,
405 	MAC_CREATE_IPQ,
406 	MAC_CREATE_FRAGMENT,
407 	MAC_CREATE_MBUF_FROM_MBUF,
408 	MAC_CREATE_MBUF_LINKLAYER,
409 	MAC_CREATE_MBUF_FROM_BPFDESC,
410 	MAC_CREATE_MBUF_FROM_IFNET,
411 	MAC_CREATE_MBUF_MULTICAST_ENCAP,
412 	MAC_CREATE_MBUF_NETLAYER,
413 	MAC_FRAGMENT_MATCH,
414 	MAC_RELABEL_IFNET,
415 	MAC_UPDATE_IPQ,
416 	MAC_CREATE_CRED,
417 	MAC_EXECVE_TRANSITION,
418 	MAC_EXECVE_WILL_TRANSITION,
419 	MAC_CREATE_PROC0,
420 	MAC_CREATE_PROC1,
421 	MAC_RELABEL_CRED,
422 	MAC_CHECK_BPFDESC_RECEIVE,
423 	MAC_CHECK_CRED_RELABEL,
424 	MAC_CHECK_CRED_VISIBLE,
425 	MAC_CHECK_IFNET_RELABEL,
426 	MAC_CHECK_IFNET_TRANSMIT,
427 	MAC_CHECK_MOUNT_STAT,
428 	MAC_CHECK_PIPE_IOCTL,
429 	MAC_CHECK_PIPE_POLL,
430 	MAC_CHECK_PIPE_READ,
431 	MAC_CHECK_PIPE_RELABEL,
432 	MAC_CHECK_PIPE_STAT,
433 	MAC_CHECK_PIPE_WRITE,
434 	MAC_CHECK_PROC_DEBUG,
435 	MAC_CHECK_PROC_SCHED,
436 	MAC_CHECK_PROC_SIGNAL,
437 	MAC_CHECK_SOCKET_BIND,
438 	MAC_CHECK_SOCKET_CONNECT,
439 	MAC_CHECK_SOCKET_DELIVER,
440 	MAC_CHECK_SOCKET_LISTEN,
441 	MAC_CHECK_SOCKET_RELABEL,
442 	MAC_CHECK_SOCKET_VISIBLE,
443 	MAC_CHECK_VNODE_ACCESS,
444 	MAC_CHECK_VNODE_CHDIR,
445 	MAC_CHECK_VNODE_CHROOT,
446 	MAC_CHECK_VNODE_CREATE,
447 	MAC_CHECK_VNODE_DELETE,
448 	MAC_CHECK_VNODE_DELETEACL,
449 	MAC_CHECK_VNODE_EXEC,
450 	MAC_CHECK_VNODE_GETACL,
451 	MAC_CHECK_VNODE_GETEXTATTR,
452 	MAC_CHECK_VNODE_LOOKUP,
453 	MAC_CHECK_VNODE_MMAP_PERMS,
454 	MAC_CHECK_VNODE_OPEN,
455 	MAC_CHECK_VNODE_POLL,
456 	MAC_CHECK_VNODE_READ,
457 	MAC_CHECK_VNODE_READDIR,
458 	MAC_CHECK_VNODE_READLINK,
459 	MAC_CHECK_VNODE_RELABEL,
460 	MAC_CHECK_VNODE_RENAME_FROM,
461 	MAC_CHECK_VNODE_RENAME_TO,
462 	MAC_CHECK_VNODE_REVOKE,
463 	MAC_CHECK_VNODE_SETACL,
464 	MAC_CHECK_VNODE_SETEXTATTR,
465 	MAC_CHECK_VNODE_SETFLAGS,
466 	MAC_CHECK_VNODE_SETMODE,
467 	MAC_CHECK_VNODE_SETOWNER,
468 	MAC_CHECK_VNODE_SETUTIMES,
469 	MAC_CHECK_VNODE_STAT,
470 	MAC_CHECK_VNODE_WRITE,
471 };
472 
473 struct mac_policy_op_entry {
474 	enum mac_op_constant mpe_constant;	/* what this hook implements */
475 	macop_t mpe_function;			/* hook's implementation */
476 };
477 
478 struct mac_policy_conf {
479 	char				*mpc_name;	/* policy name */
480 	char				*mpc_fullname;	/* policy full name */
481 	struct mac_policy_ops		*mpc_ops;	/* policy operations */
482 	struct mac_policy_op_entry	*mpc_entries;	/* ops to fill in */
483 	int				 mpc_loadtime_flags;	/* flags */
484 	int				*mpc_field_off; /* security field */
485 	int				 mpc_runtime_flags; /* flags */
486 	LIST_ENTRY(mac_policy_conf)	 mpc_list;	/* global list */
487 };
488 
489 /* Flags for the mpc_loadtime_flags field. */
490 #define	MPC_LOADTIME_FLAG_NOTLATE	0x00000001
491 #define	MPC_LOADTIME_FLAG_UNLOADOK	0x00000002
492 
493 /* Flags for the mpc_runtime_flags field. */
494 #define	MPC_RUNTIME_FLAG_REGISTERED	0x00000001
495 
496 #define	MAC_POLICY_SET(mpents, mpname, mpfullname, mpflags, privdata_wanted) \
497 	static struct mac_policy_conf mpname##_mac_policy_conf = {	\
498 		#mpname,						\
499 		mpfullname,						\
500 		NULL,							\
501 		mpents,							\
502 		mpflags,						\
503 		privdata_wanted,					\
504 		0,							\
505 	};								\
506 	static moduledata_t mpname##_mod = {				\
507 		#mpname,						\
508 		mac_policy_modevent,					\
509 		&mpname##_mac_policy_conf				\
510 	};								\
511 	MODULE_DEPEND(mpname, kernel_mac_support, 1, 1, 1);		\
512 	DECLARE_MODULE(mpname, mpname##_mod, SI_SUB_MAC_POLICY,		\
513 	    SI_ORDER_MIDDLE)
514 
515 int	mac_policy_modevent(module_t mod, int type, void *data);
516 
517 #define	LABEL_TO_SLOT(l, s)	(l)->l_perpolicy[s]
518 
519 #endif /* !_SYS_MAC_POLICY_H */
520