xref: /freebsd/sys/security/mac/mac_vfs.c (revision e7153b2583ec32ced588706fe1996d909b23bc3c) 
1 /*-
2  * Copyright (c) 1999-2002, 2009 Robert N. M. Watson
3  * Copyright (c) 2001 Ilmar S. Habibulin
4  * Copyright (c) 2001-2005 McAfee, Inc.
5  * Copyright (c) 2005-2006 SPARTA, Inc.
6  * Copyright (c) 2008 Apple Inc.
7  * All rights reserved.
8  *
9  * This software was developed by Robert Watson and Ilmar Habibulin for the
10  * TrustedBSD Project.
11  *
12  * This software was developed for the FreeBSD Project in part by McAfee
13  * Research, the Security Research Division of McAfee, Inc. under
14  * DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA
15  * CHATS research program.
16  *
17  * This software was enhanced by SPARTA ISSO under SPAWAR contract
18  * N66001-04-C-6019 ("SEFOS").
19  *
20  * This software was developed at the University of Cambridge Computer
21  * Laboratory with support from a grant from Google, Inc.
22  *
23  * Redistribution and use in source and binary forms, with or without
24  * modification, are permitted provided that the following conditions
25  * are met:
26  * 1. Redistributions of source code must retain the above copyright
27  *    notice, this list of conditions and the following disclaimer.
28  * 2. Redistributions in binary form must reproduce the above copyright
29  *    notice, this list of conditions and the following disclaimer in the
30  *    documentation and/or other materials provided with the distribution.
31  *
32  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
33  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
34  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
35  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
36  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
37  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
38  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
39  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
40  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
41  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
42  * SUCH DAMAGE.
43  */
44 
45 #include <sys/cdefs.h>
46 __FBSDID("$FreeBSD$");
47 
48 #include "opt_kdtrace.h"
49 #include "opt_mac.h"
50 
51 #include <sys/param.h>
52 #include <sys/condvar.h>
53 #include <sys/extattr.h>
54 #include <sys/imgact.h>
55 #include <sys/kernel.h>
56 #include <sys/lock.h>
57 #include <sys/malloc.h>
58 #include <sys/mutex.h>
59 #include <sys/proc.h>
60 #include <sys/sbuf.h>
61 #include <sys/systm.h>
62 #include <sys/vnode.h>
63 #include <sys/mount.h>
64 #include <sys/file.h>
65 #include <sys/namei.h>
66 #include <sys/sdt.h>
67 #include <sys/sysctl.h>
68 
69 #include <vm/vm.h>
70 #include <vm/pmap.h>
71 #include <vm/vm_map.h>
72 #include <vm/vm_object.h>
73 
74 #include <fs/devfs/devfs.h>
75 
76 #include <security/mac/mac_framework.h>
77 #include <security/mac/mac_internal.h>
78 #include <security/mac/mac_policy.h>
79 
80 /*
81  * Warn about EA transactions only the first time they happen.  No locking on
82  * this variable.
83  */
84 static int	ea_warn_once = 0;
85 
86 static int	mac_vnode_setlabel_extattr(struct ucred *cred,
87 		    struct vnode *vp, struct label *intlabel);
88 
89 static struct label *
90 mac_devfs_label_alloc(void)
91 {
92 	struct label *label;
93 
94 	label = mac_labelzone_alloc(M_WAITOK);
95 	MAC_POLICY_PERFORM(devfs_init_label, label);
96 	return (label);
97 }
98 
99 void
100 mac_devfs_init(struct devfs_dirent *de)
101 {
102 
103 	if (mac_labeled & MPC_OBJECT_DEVFS)
104 		de->de_label = mac_devfs_label_alloc();
105 	else
106 		de->de_label = NULL;
107 }
108 
109 static struct label *
110 mac_mount_label_alloc(void)
111 {
112 	struct label *label;
113 
114 	label = mac_labelzone_alloc(M_WAITOK);
115 	MAC_POLICY_PERFORM(mount_init_label, label);
116 	return (label);
117 }
118 
119 void
120 mac_mount_init(struct mount *mp)
121 {
122 
123 	if (mac_labeled & MPC_OBJECT_MOUNT)
124 		mp->mnt_label = mac_mount_label_alloc();
125 	else
126 		mp->mnt_label = NULL;
127 }
128 
129 struct label *
130 mac_vnode_label_alloc(void)
131 {
132 	struct label *label;
133 
134 	label = mac_labelzone_alloc(M_WAITOK);
135 	MAC_POLICY_PERFORM(vnode_init_label, label);
136 	return (label);
137 }
138 
139 void
140 mac_vnode_init(struct vnode *vp)
141 {
142 
143 	if (mac_labeled & MPC_OBJECT_VNODE)
144 		vp->v_label = mac_vnode_label_alloc();
145 	else
146 		vp->v_label = NULL;
147 }
148 
149 static void
150 mac_devfs_label_free(struct label *label)
151 {
152 
153 	MAC_POLICY_PERFORM_NOSLEEP(devfs_destroy_label, label);
154 	mac_labelzone_free(label);
155 }
156 
157 void
158 mac_devfs_destroy(struct devfs_dirent *de)
159 {
160 
161 	if (de->de_label != NULL) {
162 		mac_devfs_label_free(de->de_label);
163 		de->de_label = NULL;
164 	}
165 }
166 
167 static void
168 mac_mount_label_free(struct label *label)
169 {
170 
171 	MAC_POLICY_PERFORM_NOSLEEP(mount_destroy_label, label);
172 	mac_labelzone_free(label);
173 }
174 
175 void
176 mac_mount_destroy(struct mount *mp)
177 {
178 
179 	if (mp->mnt_label != NULL) {
180 		mac_mount_label_free(mp->mnt_label);
181 		mp->mnt_label = NULL;
182 	}
183 }
184 
185 void
186 mac_vnode_label_free(struct label *label)
187 {
188 
189 	MAC_POLICY_PERFORM_NOSLEEP(vnode_destroy_label, label);
190 	mac_labelzone_free(label);
191 }
192 
193 void
194 mac_vnode_destroy(struct vnode *vp)
195 {
196 
197 	if (vp->v_label != NULL) {
198 		mac_vnode_label_free(vp->v_label);
199 		vp->v_label = NULL;
200 	}
201 }
202 
203 void
204 mac_vnode_copy_label(struct label *src, struct label *dest)
205 {
206 
207 	MAC_POLICY_PERFORM_NOSLEEP(vnode_copy_label, src, dest);
208 }
209 
210 int
211 mac_vnode_externalize_label(struct label *label, char *elements,
212     char *outbuf, size_t outbuflen)
213 {
214 	int error;
215 
216 	MAC_POLICY_EXTERNALIZE(vnode, label, elements, outbuf, outbuflen);
217 
218 	return (error);
219 }
220 
221 int
222 mac_vnode_internalize_label(struct label *label, char *string)
223 {
224 	int error;
225 
226 	MAC_POLICY_INTERNALIZE(vnode, label, string);
227 
228 	return (error);
229 }
230 
231 void
232 mac_devfs_update(struct mount *mp, struct devfs_dirent *de, struct vnode *vp)
233 {
234 
235 	MAC_POLICY_PERFORM_NOSLEEP(devfs_update, mp, de, de->de_label, vp,
236 	    vp->v_label);
237 }
238 
239 void
240 mac_devfs_vnode_associate(struct mount *mp, struct devfs_dirent *de,
241     struct vnode *vp)
242 {
243 
244 	MAC_POLICY_PERFORM_NOSLEEP(devfs_vnode_associate, mp, mp->mnt_label,
245 	    de, de->de_label, vp, vp->v_label);
246 }
247 
248 int
249 mac_vnode_associate_extattr(struct mount *mp, struct vnode *vp)
250 {
251 	int error;
252 
253 	ASSERT_VOP_LOCKED(vp, "mac_vnode_associate_extattr");
254 
255 	MAC_POLICY_CHECK(vnode_associate_extattr, mp, mp->mnt_label, vp,
256 	    vp->v_label);
257 
258 	return (error);
259 }
260 
261 void
262 mac_vnode_associate_singlelabel(struct mount *mp, struct vnode *vp)
263 {
264 
265 	MAC_POLICY_PERFORM_NOSLEEP(vnode_associate_singlelabel, mp,
266 	    mp->mnt_label, vp, vp->v_label);
267 }
268 
269 /*
270  * Functions implementing extended-attribute backed labels for file systems
271  * that support it.
272  *
273  * Where possible, we use EA transactions to make writes to multiple
274  * attributes across difference policies mutually atomic.  We allow work to
275  * continue on file systems not supporting EA transactions, but generate a
276  * printf warning.
277  */
278 int
279 mac_vnode_create_extattr(struct ucred *cred, struct mount *mp,
280     struct vnode *dvp, struct vnode *vp, struct componentname *cnp)
281 {
282 	int error;
283 
284 	ASSERT_VOP_LOCKED(dvp, "mac_vnode_create_extattr");
285 	ASSERT_VOP_LOCKED(vp, "mac_vnode_create_extattr");
286 
287 	error = VOP_OPENEXTATTR(vp, cred, curthread);
288 	if (error == EOPNOTSUPP) {
289 		if (ea_warn_once == 0) {
290 			printf("Warning: transactions not supported "
291 			    "in EA write.\n");
292 			ea_warn_once = 1;
293 		}
294 	} else if (error)
295 		return (error);
296 
297 	MAC_POLICY_CHECK(vnode_create_extattr, cred, mp, mp->mnt_label, dvp,
298 	    dvp->v_label, vp, vp->v_label, cnp);
299 
300 	if (error) {
301 		VOP_CLOSEEXTATTR(vp, 0, NOCRED, curthread);
302 		return (error);
303 	}
304 
305 	error = VOP_CLOSEEXTATTR(vp, 1, NOCRED, curthread);
306 	if (error == EOPNOTSUPP)
307 		error = 0;
308 
309 	return (error);
310 }
311 
312 static int
313 mac_vnode_setlabel_extattr(struct ucred *cred, struct vnode *vp,
314     struct label *intlabel)
315 {
316 	int error;
317 
318 	ASSERT_VOP_LOCKED(vp, "mac_vnode_setlabel_extattr");
319 
320 	error = VOP_OPENEXTATTR(vp, cred, curthread);
321 	if (error == EOPNOTSUPP) {
322 		if (ea_warn_once == 0) {
323 			printf("Warning: transactions not supported "
324 			    "in EA write.\n");
325 			ea_warn_once = 1;
326 		}
327 	} else if (error)
328 		return (error);
329 
330 	MAC_POLICY_CHECK(vnode_setlabel_extattr, cred, vp, vp->v_label,
331 	    intlabel);
332 
333 	if (error) {
334 		VOP_CLOSEEXTATTR(vp, 0, NOCRED, curthread);
335 		return (error);
336 	}
337 
338 	error = VOP_CLOSEEXTATTR(vp, 1, NOCRED, curthread);
339 	if (error == EOPNOTSUPP)
340 		error = 0;
341 
342 	return (error);
343 }
344 
345 void
346 mac_vnode_execve_transition(struct ucred *old, struct ucred *new,
347     struct vnode *vp, struct label *interpvplabel, struct image_params *imgp)
348 {
349 
350 	ASSERT_VOP_LOCKED(vp, "mac_vnode_execve_transition");
351 
352 	MAC_POLICY_PERFORM(vnode_execve_transition, old, new, vp,
353 	    vp->v_label, interpvplabel, imgp, imgp->execlabel);
354 }
355 
356 int
357 mac_vnode_execve_will_transition(struct ucred *old, struct vnode *vp,
358     struct label *interpvplabel, struct image_params *imgp)
359 {
360 	int result;
361 
362 	ASSERT_VOP_LOCKED(vp, "mac_vnode_execve_will_transition");
363 
364 	result = 0;
365 	/* No sleeping since the process lock will be held by the caller. */
366 	MAC_POLICY_BOOLEAN_NOSLEEP(vnode_execve_will_transition, ||, old, vp,
367 	    vp->v_label, interpvplabel, imgp, imgp->execlabel);
368 
369 	return (result);
370 }
371 
372 MAC_CHECK_PROBE_DEFINE3(vnode_check_access, "struct ucred *",
373     "struct vnode *", "accmode_t");
374 
375 int
376 mac_vnode_check_access(struct ucred *cred, struct vnode *vp, accmode_t accmode)
377 {
378 	int error;
379 
380 	ASSERT_VOP_LOCKED(vp, "mac_vnode_check_access");
381 
382 	MAC_POLICY_CHECK(vnode_check_access, cred, vp, vp->v_label, accmode);
383 	MAC_CHECK_PROBE3(vnode_check_access, error, cred, vp, accmode);
384 
385 	return (error);
386 }
387 
388 MAC_CHECK_PROBE_DEFINE2(vnode_check_chdir, "struct ucred *",
389     "struct vnode *");
390 
391 int
392 mac_vnode_check_chdir(struct ucred *cred, struct vnode *dvp)
393 {
394 	int error;
395 
396 	ASSERT_VOP_LOCKED(dvp, "mac_vnode_check_chdir");
397 
398 	MAC_POLICY_CHECK(vnode_check_chdir, cred, dvp, dvp->v_label);
399 	MAC_CHECK_PROBE2(vnode_check_chdir, error, cred, dvp);
400 
401 	return (error);
402 }
403 
404 MAC_CHECK_PROBE_DEFINE2(vnode_check_chroot, "struct ucred *",
405     "struct vnode *");
406 
407 int
408 mac_vnode_check_chroot(struct ucred *cred, struct vnode *dvp)
409 {
410 	int error;
411 
412 	ASSERT_VOP_LOCKED(dvp, "mac_vnode_check_chroot");
413 
414 	MAC_POLICY_CHECK(vnode_check_chroot, cred, dvp, dvp->v_label);
415 	MAC_CHECK_PROBE2(vnode_check_chroot, error, cred, dvp);
416 
417 	return (error);
418 }
419 
420 MAC_CHECK_PROBE_DEFINE4(vnode_check_create, "struct ucred *",
421     "struct vnode *", "struct componentname *", "struct vattr *");
422 
423 int
424 mac_vnode_check_create(struct ucred *cred, struct vnode *dvp,
425     struct componentname *cnp, struct vattr *vap)
426 {
427 	int error;
428 
429 	ASSERT_VOP_LOCKED(dvp, "mac_vnode_check_create");
430 
431 	MAC_POLICY_CHECK(vnode_check_create, cred, dvp, dvp->v_label, cnp,
432 	    vap);
433 	MAC_CHECK_PROBE4(vnode_check_create, error, cred, dvp, cnp, vap);
434 
435 	return (error);
436 }
437 
438 MAC_CHECK_PROBE_DEFINE3(vnode_check_deleteacl, "struct ucred *",
439     "struct vnode *", "acl_type_t");
440 
441 int
442 mac_vnode_check_deleteacl(struct ucred *cred, struct vnode *vp,
443     acl_type_t type)
444 {
445 	int error;
446 
447 	ASSERT_VOP_LOCKED(vp, "mac_vnode_check_deleteacl");
448 
449 	MAC_POLICY_CHECK(vnode_check_deleteacl, cred, vp, vp->v_label, type);
450 	MAC_CHECK_PROBE3(vnode_check_deleteacl, error, cred, vp, type);
451 
452 	return (error);
453 }
454 
455 MAC_CHECK_PROBE_DEFINE4(vnode_check_deleteextattr, "struct ucred *",
456     "struct vnode *", "int", "const char *");
457 
458 int
459 mac_vnode_check_deleteextattr(struct ucred *cred, struct vnode *vp,
460     int attrnamespace, const char *name)
461 {
462 	int error;
463 
464 	ASSERT_VOP_LOCKED(vp, "mac_vnode_check_deleteextattr");
465 
466 	MAC_POLICY_CHECK(vnode_check_deleteextattr, cred, vp, vp->v_label,
467 	    attrnamespace, name);
468 	MAC_CHECK_PROBE4(vnode_check_deleteextattr, error, cred, vp,
469 	    attrnamespace, name);
470 
471 	return (error);
472 }
473 
474 MAC_CHECK_PROBE_DEFINE3(vnode_check_exec, "struct ucred *", "struct vnode *",
475     "struct image_params *");
476 
477 int
478 mac_vnode_check_exec(struct ucred *cred, struct vnode *vp,
479     struct image_params *imgp)
480 {
481 	int error;
482 
483 	ASSERT_VOP_LOCKED(vp, "mac_vnode_check_exec");
484 
485 	MAC_POLICY_CHECK(vnode_check_exec, cred, vp, vp->v_label, imgp,
486 	    imgp->execlabel);
487 	MAC_CHECK_PROBE3(vnode_check_exec, error, cred, vp, imgp);
488 
489 	return (error);
490 }
491 
492 MAC_CHECK_PROBE_DEFINE3(vnode_check_getacl, "struct ucred *",
493     "struct vnode *", "acl_type_t");
494 
495 int
496 mac_vnode_check_getacl(struct ucred *cred, struct vnode *vp, acl_type_t type)
497 {
498 	int error;
499 
500 	ASSERT_VOP_LOCKED(vp, "mac_vnode_check_getacl");
501 
502 	MAC_POLICY_CHECK(vnode_check_getacl, cred, vp, vp->v_label, type);
503 	MAC_CHECK_PROBE3(vnode_check_getacl, error, cred, vp, type);
504 
505 	return (error);
506 }
507 
508 MAC_CHECK_PROBE_DEFINE4(vnode_check_getextattr, "struct ucred *",
509     "struct vnode *", "int", "const char *");
510 
511 int
512 mac_vnode_check_getextattr(struct ucred *cred, struct vnode *vp,
513     int attrnamespace, const char *name)
514 {
515 	int error;
516 
517 	ASSERT_VOP_LOCKED(vp, "mac_vnode_check_getextattr");
518 
519 	MAC_POLICY_CHECK(vnode_check_getextattr, cred, vp, vp->v_label,
520 	    attrnamespace, name);
521 	MAC_CHECK_PROBE4(vnode_check_getextattr, error, cred, vp,
522 	    attrnamespace, name);
523 
524 	return (error);
525 }
526 
527 MAC_CHECK_PROBE_DEFINE4(vnode_check_link, "struct ucred *", "struct vnode *",
528     "struct vnode *", "struct componentname *");
529 
530 int
531 mac_vnode_check_link(struct ucred *cred, struct vnode *dvp,
532     struct vnode *vp, struct componentname *cnp)
533 {
534 	int error;
535 
536 	ASSERT_VOP_LOCKED(dvp, "mac_vnode_check_link");
537 	ASSERT_VOP_LOCKED(vp, "mac_vnode_check_link");
538 
539 	MAC_POLICY_CHECK(vnode_check_link, cred, dvp, dvp->v_label, vp,
540 	    vp->v_label, cnp);
541 	MAC_CHECK_PROBE4(vnode_check_link, error, cred, dvp, vp, cnp);
542 
543 	return (error);
544 }
545 
546 MAC_CHECK_PROBE_DEFINE3(vnode_check_listextattr, "struct ucred *",
547     "struct vnode *", "int");
548 
549 int
550 mac_vnode_check_listextattr(struct ucred *cred, struct vnode *vp,
551     int attrnamespace)
552 {
553 	int error;
554 
555 	ASSERT_VOP_LOCKED(vp, "mac_vnode_check_listextattr");
556 
557 	MAC_POLICY_CHECK(vnode_check_listextattr, cred, vp, vp->v_label,
558 	    attrnamespace);
559 	MAC_CHECK_PROBE3(vnode_check_listextattr, error, cred, vp,
560 	    attrnamespace);
561 
562 	return (error);
563 }
564 
565 MAC_CHECK_PROBE_DEFINE3(vnode_check_lookup, "struct ucred *",
566     "struct vnode *", "struct componentname *");
567 
568 int
569 mac_vnode_check_lookup(struct ucred *cred, struct vnode *dvp,
570     struct componentname *cnp)
571 {
572 	int error;
573 
574 	ASSERT_VOP_LOCKED(dvp, "mac_vnode_check_lookup");
575 
576 	MAC_POLICY_CHECK(vnode_check_lookup, cred, dvp, dvp->v_label, cnp);
577 	MAC_CHECK_PROBE3(vnode_check_lookup, error, cred, dvp, cnp);
578 
579 	return (error);
580 }
581 
582 MAC_CHECK_PROBE_DEFINE4(vnode_check_mmap, "struct ucred *", "struct vnode *",
583     "int", "int");
584 
585 int
586 mac_vnode_check_mmap(struct ucred *cred, struct vnode *vp, int prot,
587     int flags)
588 {
589 	int error;
590 
591 	ASSERT_VOP_LOCKED(vp, "mac_vnode_check_mmap");
592 
593 	MAC_POLICY_CHECK(vnode_check_mmap, cred, vp, vp->v_label, prot, flags);
594 	MAC_CHECK_PROBE4(vnode_check_mmap, error, cred, vp, prot, flags);
595 
596 	return (error);
597 }
598 
599 void
600 mac_vnode_check_mmap_downgrade(struct ucred *cred, struct vnode *vp,
601     int *prot)
602 {
603 	int result = *prot;
604 
605 	ASSERT_VOP_LOCKED(vp, "mac_vnode_check_mmap_downgrade");
606 
607 	MAC_POLICY_PERFORM(vnode_check_mmap_downgrade, cred, vp, vp->v_label,
608 	    &result);
609 
610 	*prot = result;
611 }
612 
613 MAC_CHECK_PROBE_DEFINE3(vnode_check_mprotect, "struct ucred *",
614     "struct vnode *", "int");
615 
616 int
617 mac_vnode_check_mprotect(struct ucred *cred, struct vnode *vp, int prot)
618 {
619 	int error;
620 
621 	ASSERT_VOP_LOCKED(vp, "mac_vnode_check_mprotect");
622 
623 	MAC_POLICY_CHECK(vnode_check_mprotect, cred, vp, vp->v_label, prot);
624 	MAC_CHECK_PROBE3(vnode_check_mprotect, error, cred, vp, prot);
625 
626 	return (error);
627 }
628 
629 MAC_CHECK_PROBE_DEFINE3(vnode_check_open, "struct ucred *", "struct vnode *",
630     "accmode_t");
631 
632 int
633 mac_vnode_check_open(struct ucred *cred, struct vnode *vp, accmode_t accmode)
634 {
635 	int error;
636 
637 	ASSERT_VOP_LOCKED(vp, "mac_vnode_check_open");
638 
639 	MAC_POLICY_CHECK(vnode_check_open, cred, vp, vp->v_label, accmode);
640 	return (error);
641 }
642 
643 MAC_CHECK_PROBE_DEFINE3(vnode_check_poll, "struct ucred *", "struct ucred *",
644     "struct vnode *");
645 
646 int
647 mac_vnode_check_poll(struct ucred *active_cred, struct ucred *file_cred,
648     struct vnode *vp)
649 {
650 	int error;
651 
652 	ASSERT_VOP_LOCKED(vp, "mac_vnode_check_poll");
653 
654 	MAC_POLICY_CHECK(vnode_check_poll, active_cred, file_cred, vp,
655 	    vp->v_label);
656 	MAC_CHECK_PROBE3(vnode_check_poll, error, active_cred, file_cred,
657 	    vp);
658 
659 	return (error);
660 }
661 
662 MAC_CHECK_PROBE_DEFINE3(vnode_check_read, "struct ucred *", "struct ucred *",
663     "struct vnode *");
664 
665 int
666 mac_vnode_check_read(struct ucred *active_cred, struct ucred *file_cred,
667     struct vnode *vp)
668 {
669 	int error;
670 
671 	ASSERT_VOP_LOCKED(vp, "mac_vnode_check_read");
672 
673 	MAC_POLICY_CHECK(vnode_check_read, active_cred, file_cred, vp,
674 	    vp->v_label);
675 	MAC_CHECK_PROBE3(vnode_check_read, error, active_cred, file_cred,
676 	    vp);
677 
678 	return (error);
679 }
680 
681 MAC_CHECK_PROBE_DEFINE2(vnode_check_readdir, "struct ucred *",
682     "struct vnode *");
683 
684 int
685 mac_vnode_check_readdir(struct ucred *cred, struct vnode *dvp)
686 {
687 	int error;
688 
689 	ASSERT_VOP_LOCKED(dvp, "mac_vnode_check_readdir");
690 
691 	MAC_POLICY_CHECK(vnode_check_readdir, cred, dvp, dvp->v_label);
692 	MAC_CHECK_PROBE2(vnode_check_readdir, error, cred, dvp);
693 
694 	return (error);
695 }
696 
697 MAC_CHECK_PROBE_DEFINE2(vnode_check_readlink, "struct ucred *",
698     "struct vnode *");
699 
700 int
701 mac_vnode_check_readlink(struct ucred *cred, struct vnode *vp)
702 {
703 	int error;
704 
705 	ASSERT_VOP_LOCKED(vp, "mac_vnode_check_readlink");
706 
707 	MAC_POLICY_CHECK(vnode_check_readlink, cred, vp, vp->v_label);
708 	MAC_CHECK_PROBE2(vnode_check_readlink, error, cred, vp);
709 
710 	return (error);
711 }
712 
713 MAC_CHECK_PROBE_DEFINE3(vnode_check_relabel, "struct ucred *",
714     "struct vnode *", "struct label *");
715 
716 static int
717 mac_vnode_check_relabel(struct ucred *cred, struct vnode *vp,
718     struct label *newlabel)
719 {
720 	int error;
721 
722 	ASSERT_VOP_LOCKED(vp, "mac_vnode_check_relabel");
723 
724 	MAC_POLICY_CHECK(vnode_check_relabel, cred, vp, vp->v_label, newlabel);
725 	MAC_CHECK_PROBE3(vnode_check_relabel, error, cred, vp, newlabel);
726 
727 	return (error);
728 }
729 
730 MAC_CHECK_PROBE_DEFINE4(vnode_check_rename_from, "struct ucred *",
731     "struct vnode *", "struct vnode *", "struct componentname *");
732 
733 int
734 mac_vnode_check_rename_from(struct ucred *cred, struct vnode *dvp,
735     struct vnode *vp, struct componentname *cnp)
736 {
737 	int error;
738 
739 	ASSERT_VOP_LOCKED(dvp, "mac_vnode_check_rename_from");
740 	ASSERT_VOP_LOCKED(vp, "mac_vnode_check_rename_from");
741 
742 	MAC_POLICY_CHECK(vnode_check_rename_from, cred, dvp, dvp->v_label, vp,
743 	    vp->v_label, cnp);
744 	MAC_CHECK_PROBE4(vnode_check_rename_from, error, cred, dvp, vp, cnp);
745 
746 	return (error);
747 }
748 
749 MAC_CHECK_PROBE_DEFINE4(vnode_check_rename_to, "struct ucred *",
750     "struct vnode *", "struct vnode *", "struct componentname *");
751 
752 int
753 mac_vnode_check_rename_to(struct ucred *cred, struct vnode *dvp,
754     struct vnode *vp, int samedir, struct componentname *cnp)
755 {
756 	int error;
757 
758 	ASSERT_VOP_LOCKED(dvp, "mac_vnode_check_rename_to");
759 	ASSERT_VOP_LOCKED(vp, "mac_vnode_check_rename_to");
760 
761 	MAC_POLICY_CHECK(vnode_check_rename_to, cred, dvp, dvp->v_label, vp,
762 	    vp != NULL ? vp->v_label : NULL, samedir, cnp);
763 	MAC_CHECK_PROBE4(vnode_check_rename_to, error, cred, dvp, vp, cnp);
764 	return (error);
765 }
766 
767 MAC_CHECK_PROBE_DEFINE2(vnode_check_revoke, "struct ucred *",
768     "struct vnode *");
769 
770 int
771 mac_vnode_check_revoke(struct ucred *cred, struct vnode *vp)
772 {
773 	int error;
774 
775 	ASSERT_VOP_LOCKED(vp, "mac_vnode_check_revoke");
776 
777 	MAC_POLICY_CHECK(vnode_check_revoke, cred, vp, vp->v_label);
778 	MAC_CHECK_PROBE2(vnode_check_revoke, error, cred, vp);
779 
780 	return (error);
781 }
782 
783 MAC_CHECK_PROBE_DEFINE4(vnode_check_setacl, "struct ucred *",
784     "struct vnode *", "acl_tpe_t", "struct acl *");
785 
786 int
787 mac_vnode_check_setacl(struct ucred *cred, struct vnode *vp, acl_type_t type,
788     struct acl *acl)
789 {
790 	int error;
791 
792 	ASSERT_VOP_LOCKED(vp, "mac_vnode_check_setacl");
793 
794 	MAC_POLICY_CHECK(vnode_check_setacl, cred, vp, vp->v_label, type, acl);
795 	MAC_CHECK_PROBE4(vnode_check_setacl, error, cred, vp, type, acl);
796 
797 	return (error);
798 }
799 
800 MAC_CHECK_PROBE_DEFINE4(vnode_check_setextattr, "struct ucred *",
801     "struct vnode *", "int", "const char *");
802 
803 int
804 mac_vnode_check_setextattr(struct ucred *cred, struct vnode *vp,
805     int attrnamespace, const char *name)
806 {
807 	int error;
808 
809 	ASSERT_VOP_LOCKED(vp, "mac_vnode_check_setextattr");
810 
811 	MAC_POLICY_CHECK(vnode_check_setextattr, cred, vp, vp->v_label,
812 	    attrnamespace, name);
813 	MAC_CHECK_PROBE4(vnode_check_setextattr, error, cred, vp,
814 	    attrnamespace, name);
815 
816 	return (error);
817 }
818 
819 MAC_CHECK_PROBE_DEFINE3(vnode_check_setflags, "struct ucred *",
820     "struct vnode *", "u_long");
821 
822 int
823 mac_vnode_check_setflags(struct ucred *cred, struct vnode *vp, u_long flags)
824 {
825 	int error;
826 
827 	ASSERT_VOP_LOCKED(vp, "mac_vnode_check_setflags");
828 
829 	MAC_POLICY_CHECK(vnode_check_setflags, cred, vp, vp->v_label, flags);
830 	MAC_CHECK_PROBE3(vnode_check_setflags, error, cred, vp, flags);
831 
832 	return (error);
833 }
834 
835 MAC_CHECK_PROBE_DEFINE3(vnode_check_setmode, "struct ucred *",
836     "struct vnode *", "mode_t");
837 
838 int
839 mac_vnode_check_setmode(struct ucred *cred, struct vnode *vp, mode_t mode)
840 {
841 	int error;
842 
843 	ASSERT_VOP_LOCKED(vp, "mac_vnode_check_setmode");
844 
845 	MAC_POLICY_CHECK(vnode_check_setmode, cred, vp, vp->v_label, mode);
846 	MAC_CHECK_PROBE3(vnode_check_setmode, error, cred, vp, mode);
847 
848 	return (error);
849 }
850 
851 MAC_CHECK_PROBE_DEFINE4(vnode_check_setowner, "struct ucred *",
852     "struct vnode *", "uid_t", "gid_t");
853 
854 int
855 mac_vnode_check_setowner(struct ucred *cred, struct vnode *vp, uid_t uid,
856     gid_t gid)
857 {
858 	int error;
859 
860 	ASSERT_VOP_LOCKED(vp, "mac_vnode_check_setowner");
861 
862 	MAC_POLICY_CHECK(vnode_check_setowner, cred, vp, vp->v_label, uid, gid);
863 	MAC_CHECK_PROBE4(vnode_check_setowner, error, cred, vp, uid, gid);
864 
865 	return (error);
866 }
867 
868 MAC_CHECK_PROBE_DEFINE4(vnode_check_setutimes, "struct ucred *",
869     "struct vnode *", "struct timespec *", "struct timespec *");
870 
871 int
872 mac_vnode_check_setutimes(struct ucred *cred, struct vnode *vp,
873     struct timespec atime, struct timespec mtime)
874 {
875 	int error;
876 
877 	ASSERT_VOP_LOCKED(vp, "mac_vnode_check_setutimes");
878 
879 	MAC_POLICY_CHECK(vnode_check_setutimes, cred, vp, vp->v_label, atime,
880 	    mtime);
881 	MAC_CHECK_PROBE4(vnode_check_setutimes, error, cred, vp, &atime,
882 	    &mtime);
883 
884 	return (error);
885 }
886 
887 MAC_CHECK_PROBE_DEFINE3(vnode_check_stat, "struct ucred *", "struct ucred *",
888     "struct vnode *");
889 
890 int
891 mac_vnode_check_stat(struct ucred *active_cred, struct ucred *file_cred,
892     struct vnode *vp)
893 {
894 	int error;
895 
896 	ASSERT_VOP_LOCKED(vp, "mac_vnode_check_stat");
897 
898 	MAC_POLICY_CHECK(vnode_check_stat, active_cred, file_cred, vp,
899 	    vp->v_label);
900 	MAC_CHECK_PROBE3(vnode_check_stat, error, active_cred, file_cred,
901 	    vp);
902 
903 	return (error);
904 }
905 
906 MAC_CHECK_PROBE_DEFINE4(vnode_check_unlink, "struct ucred *",
907     "struct vnode *", "struct vnode *", "struct componentname *");
908 
909 int
910 mac_vnode_check_unlink(struct ucred *cred, struct vnode *dvp,
911     struct vnode *vp, struct componentname *cnp)
912 {
913 	int error;
914 
915 	ASSERT_VOP_LOCKED(dvp, "mac_vnode_check_unlink");
916 	ASSERT_VOP_LOCKED(vp, "mac_vnode_check_unlink");
917 
918 	MAC_POLICY_CHECK(vnode_check_unlink, cred, dvp, dvp->v_label, vp,
919 	    vp->v_label, cnp);
920 	MAC_CHECK_PROBE4(vnode_check_unlink, error, cred, dvp, vp, cnp);
921 
922 	return (error);
923 }
924 
925 MAC_CHECK_PROBE_DEFINE3(vnode_check_write, "struct ucred *",
926     "struct ucred *", "struct vnode *");
927 
928 int
929 mac_vnode_check_write(struct ucred *active_cred, struct ucred *file_cred,
930     struct vnode *vp)
931 {
932 	int error;
933 
934 	ASSERT_VOP_LOCKED(vp, "mac_vnode_check_write");
935 
936 	MAC_POLICY_CHECK(vnode_check_write, active_cred, file_cred, vp,
937 	    vp->v_label);
938 	MAC_CHECK_PROBE3(vnode_check_write, error, active_cred, file_cred,
939 	    vp);
940 
941 	return (error);
942 }
943 
944 void
945 mac_vnode_relabel(struct ucred *cred, struct vnode *vp,
946     struct label *newlabel)
947 {
948 
949 	MAC_POLICY_PERFORM(vnode_relabel, cred, vp, vp->v_label, newlabel);
950 }
951 
952 void
953 mac_mount_create(struct ucred *cred, struct mount *mp)
954 {
955 
956 	MAC_POLICY_PERFORM(mount_create, cred, mp, mp->mnt_label);
957 }
958 
959 MAC_CHECK_PROBE_DEFINE2(mount_check_stat, "struct ucred *",
960     "struct mount *");
961 
962 int
963 mac_mount_check_stat(struct ucred *cred, struct mount *mount)
964 {
965 	int error;
966 
967 	MAC_POLICY_CHECK_NOSLEEP(mount_check_stat, cred, mount, mount->mnt_label);
968 	MAC_CHECK_PROBE2(mount_check_stat, error, cred, mount);
969 
970 	return (error);
971 }
972 
973 void
974 mac_devfs_create_device(struct ucred *cred, struct mount *mp,
975     struct cdev *dev, struct devfs_dirent *de)
976 {
977 
978 	MAC_POLICY_PERFORM_NOSLEEP(devfs_create_device, cred, mp, dev, de,
979 	    de->de_label);
980 }
981 
982 void
983 mac_devfs_create_symlink(struct ucred *cred, struct mount *mp,
984     struct devfs_dirent *dd, struct devfs_dirent *de)
985 {
986 
987 	MAC_POLICY_PERFORM_NOSLEEP(devfs_create_symlink, cred, mp, dd,
988 	    dd->de_label, de, de->de_label);
989 }
990 
991 void
992 mac_devfs_create_directory(struct mount *mp, char *dirname, int dirnamelen,
993     struct devfs_dirent *de)
994 {
995 
996 	MAC_POLICY_PERFORM_NOSLEEP(devfs_create_directory, mp, dirname,
997 	    dirnamelen, de, de->de_label);
998 }
999 
1000 /*
1001  * Implementation of VOP_SETLABEL() that relies on extended attributes to
1002  * store label data.  Can be referenced by filesystems supporting extended
1003  * attributes.
1004  */
1005 int
1006 vop_stdsetlabel_ea(struct vop_setlabel_args *ap)
1007 {
1008 	struct vnode *vp = ap->a_vp;
1009 	struct label *intlabel = ap->a_label;
1010 	int error;
1011 
1012 	ASSERT_VOP_LOCKED(vp, "vop_stdsetlabel_ea");
1013 
1014 	if ((vp->v_mount->mnt_flag & MNT_MULTILABEL) == 0)
1015 		return (EOPNOTSUPP);
1016 
1017 	error = mac_vnode_setlabel_extattr(ap->a_cred, vp, intlabel);
1018 	if (error)
1019 		return (error);
1020 
1021 	mac_vnode_relabel(ap->a_cred, vp, intlabel);
1022 
1023 	return (0);
1024 }
1025 
1026 int
1027 vn_setlabel(struct vnode *vp, struct label *intlabel, struct ucred *cred)
1028 {
1029 	int error;
1030 
1031 	if (vp->v_mount == NULL) {
1032 		/* printf("vn_setlabel: null v_mount\n"); */
1033 		if (vp->v_type != VNON)
1034 			printf("vn_setlabel: null v_mount with non-VNON\n");
1035 		return (EBADF);
1036 	}
1037 
1038 	if ((vp->v_mount->mnt_flag & MNT_MULTILABEL) == 0)
1039 		return (EOPNOTSUPP);
1040 
1041 	/*
1042 	 * Multi-phase commit.  First check the policies to confirm the
1043 	 * change is OK.  Then commit via the filesystem.  Finally, update
1044 	 * the actual vnode label.
1045 	 *
1046 	 * Question: maybe the filesystem should update the vnode at the end
1047 	 * as part of VOP_SETLABEL()?
1048 	 */
1049 	error = mac_vnode_check_relabel(cred, vp, intlabel);
1050 	if (error)
1051 		return (error);
1052 
1053 	/*
1054 	 * VADMIN provides the opportunity for the filesystem to make
1055 	 * decisions about who is and is not able to modify labels and
1056 	 * protections on files.  This might not be right.  We can't assume
1057 	 * VOP_SETLABEL() will do it, because we might implement that as part
1058 	 * of vop_stdsetlabel_ea().
1059 	 */
1060 	error = VOP_ACCESS(vp, VADMIN, cred, curthread);
1061 	if (error)
1062 		return (error);
1063 
1064 	error = VOP_SETLABEL(vp, intlabel, cred, curthread);
1065 	if (error)
1066 		return (error);
1067 
1068 	return (0);
1069 }
1070