xref: /freebsd/sys/security/mac_biba/mac_biba.c (revision 6c6c03be2ddb04c54e455122799923deaefa4114)
1 /*-
2  * Copyright (c) 1999-2002, 2007-2008 Robert N. M. Watson
3  * Copyright (c) 2001-2005 McAfee, Inc.
4  * Copyright (c) 2006 SPARTA, Inc.
5  * All rights reserved.
6  *
7  * This software was developed by Robert Watson for the TrustedBSD Project.
8  *
9  * This software was developed for the FreeBSD Project in part by McAfee
10  * Research, the Security Research Division of McAfee, Inc. under
11  * DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA
12  * CHATS research program.
13  *
14  * This software was enhanced by SPARTA ISSO under SPAWAR contract
15  * N66001-04-C-6019 ("SEFOS").
16  *
17  * Redistribution and use in source and binary forms, with or without
18  * modification, are permitted provided that the following conditions
19  * are met:
20  * 1. Redistributions of source code must retain the above copyright
21  *    notice, this list of conditions and the following disclaimer.
22  * 2. Redistributions in binary form must reproduce the above copyright
23  *    notice, this list of conditions and the following disclaimer in the
24  *    documentation and/or other materials provided with the distribution.
25  *
26  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
27  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
28  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
29  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
30  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
31  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
32  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
33  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
34  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
35  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
36  * SUCH DAMAGE.
37  *
38  * $FreeBSD$
39  */
40 
41 /*
42  * Developed by the TrustedBSD Project.
43  *
44  * Biba fixed label mandatory integrity policy.
45  */
46 
47 #include <sys/param.h>
48 #include <sys/conf.h>
49 #include <sys/extattr.h>
50 #include <sys/kernel.h>
51 #include <sys/ksem.h>
52 #include <sys/malloc.h>
53 #include <sys/mman.h>
54 #include <sys/mount.h>
55 #include <sys/priv.h>
56 #include <sys/proc.h>
57 #include <sys/sbuf.h>
58 #include <sys/systm.h>
59 #include <sys/sysproto.h>
60 #include <sys/sysent.h>
61 #include <sys/systm.h>
62 #include <sys/vnode.h>
63 #include <sys/file.h>
64 #include <sys/socket.h>
65 #include <sys/socketvar.h>
66 #include <sys/pipe.h>
67 #include <sys/sx.h>
68 #include <sys/sysctl.h>
69 #include <sys/msg.h>
70 #include <sys/sem.h>
71 #include <sys/shm.h>
72 
73 #include <fs/devfs/devfs.h>
74 
75 #include <net/bpfdesc.h>
76 #include <net/if.h>
77 #include <net/if_types.h>
78 #include <net/if_var.h>
79 
80 #include <netinet/in.h>
81 #include <netinet/in_pcb.h>
82 #include <netinet/ip_var.h>
83 
84 #include <vm/uma.h>
85 #include <vm/vm.h>
86 
87 #include <security/mac/mac_policy.h>
88 #include <security/mac_biba/mac_biba.h>
89 
90 SYSCTL_DECL(_security_mac);
91 
92 SYSCTL_NODE(_security_mac, OID_AUTO, biba, CTLFLAG_RW, 0,
93     "TrustedBSD mac_biba policy controls");
94 
95 static int	biba_label_size = sizeof(struct mac_biba);
96 SYSCTL_INT(_security_mac_biba, OID_AUTO, label_size, CTLFLAG_RD,
97     &biba_label_size, 0, "Size of struct mac_biba");
98 
99 static int	biba_enabled = 1;
100 SYSCTL_INT(_security_mac_biba, OID_AUTO, enabled, CTLFLAG_RW, &biba_enabled,
101     0, "Enforce MAC/Biba policy");
102 TUNABLE_INT("security.mac.biba.enabled", &biba_enabled);
103 
104 static int	destroyed_not_inited;
105 SYSCTL_INT(_security_mac_biba, OID_AUTO, destroyed_not_inited, CTLFLAG_RD,
106     &destroyed_not_inited, 0, "Count of labels destroyed but not inited");
107 
108 static int	trust_all_interfaces = 0;
109 SYSCTL_INT(_security_mac_biba, OID_AUTO, trust_all_interfaces, CTLFLAG_RD,
110     &trust_all_interfaces, 0, "Consider all interfaces 'trusted' by MAC/Biba");
111 TUNABLE_INT("security.mac.biba.trust_all_interfaces", &trust_all_interfaces);
112 
113 static char	trusted_interfaces[128];
114 SYSCTL_STRING(_security_mac_biba, OID_AUTO, trusted_interfaces, CTLFLAG_RD,
115     trusted_interfaces, 0, "Interfaces considered 'trusted' by MAC/Biba");
116 TUNABLE_STR("security.mac.biba.trusted_interfaces", trusted_interfaces,
117     sizeof(trusted_interfaces));
118 
119 static int	max_compartments = MAC_BIBA_MAX_COMPARTMENTS;
120 SYSCTL_INT(_security_mac_biba, OID_AUTO, max_compartments, CTLFLAG_RD,
121     &max_compartments, 0, "Maximum supported compartments");
122 
123 static int	ptys_equal = 0;
124 SYSCTL_INT(_security_mac_biba, OID_AUTO, ptys_equal, CTLFLAG_RW, &ptys_equal,
125     0, "Label pty devices as biba/equal on create");
126 TUNABLE_INT("security.mac.biba.ptys_equal", &ptys_equal);
127 
128 static int	interfaces_equal;
129 SYSCTL_INT(_security_mac_biba, OID_AUTO, interfaces_equal, CTLFLAG_RW,
130     &interfaces_equal, 0, "Label network interfaces as biba/equal on create");
131 TUNABLE_INT("security.mac.biba.interfaces_equal", &interfaces_equal);
132 
133 static int	revocation_enabled = 0;
134 SYSCTL_INT(_security_mac_biba, OID_AUTO, revocation_enabled, CTLFLAG_RW,
135     &revocation_enabled, 0, "Revoke access to objects on relabel");
136 TUNABLE_INT("security.mac.biba.revocation_enabled", &revocation_enabled);
137 
138 static int	biba_slot;
139 #define	SLOT(l)	((struct mac_biba *)mac_label_get((l), biba_slot))
140 #define	SLOT_SET(l, val) mac_label_set((l), biba_slot, (uintptr_t)(val))
141 
142 static uma_zone_t	zone_biba;
143 
144 static __inline int
145 biba_bit_set_empty(u_char *set) {
146 	int i;
147 
148 	for (i = 0; i < MAC_BIBA_MAX_COMPARTMENTS >> 3; i++)
149 		if (set[i] != 0)
150 			return (0);
151 	return (1);
152 }
153 
154 static struct mac_biba *
155 biba_alloc(int flag)
156 {
157 
158 	return (uma_zalloc(zone_biba, flag | M_ZERO));
159 }
160 
161 static void
162 biba_free(struct mac_biba *mb)
163 {
164 
165 	if (mb != NULL)
166 		uma_zfree(zone_biba, mb);
167 	else
168 		atomic_add_int(&destroyed_not_inited, 1);
169 }
170 
171 static int
172 biba_atmostflags(struct mac_biba *mb, int flags)
173 {
174 
175 	if ((mb->mb_flags & flags) != mb->mb_flags)
176 		return (EINVAL);
177 	return (0);
178 }
179 
180 static int
181 biba_dominate_element(struct mac_biba_element *a, struct mac_biba_element *b)
182 {
183 	int bit;
184 
185 	switch (a->mbe_type) {
186 	case MAC_BIBA_TYPE_EQUAL:
187 	case MAC_BIBA_TYPE_HIGH:
188 		return (1);
189 
190 	case MAC_BIBA_TYPE_LOW:
191 		switch (b->mbe_type) {
192 		case MAC_BIBA_TYPE_GRADE:
193 		case MAC_BIBA_TYPE_HIGH:
194 			return (0);
195 
196 		case MAC_BIBA_TYPE_EQUAL:
197 		case MAC_BIBA_TYPE_LOW:
198 			return (1);
199 
200 		default:
201 			panic("biba_dominate_element: b->mbe_type invalid");
202 		}
203 
204 	case MAC_BIBA_TYPE_GRADE:
205 		switch (b->mbe_type) {
206 		case MAC_BIBA_TYPE_EQUAL:
207 		case MAC_BIBA_TYPE_LOW:
208 			return (1);
209 
210 		case MAC_BIBA_TYPE_HIGH:
211 			return (0);
212 
213 		case MAC_BIBA_TYPE_GRADE:
214 			for (bit = 1; bit <= MAC_BIBA_MAX_COMPARTMENTS; bit++)
215 				if (!MAC_BIBA_BIT_TEST(bit,
216 				    a->mbe_compartments) &&
217 				    MAC_BIBA_BIT_TEST(bit, b->mbe_compartments))
218 					return (0);
219 			return (a->mbe_grade >= b->mbe_grade);
220 
221 		default:
222 			panic("biba_dominate_element: b->mbe_type invalid");
223 		}
224 
225 	default:
226 		panic("biba_dominate_element: a->mbe_type invalid");
227 	}
228 
229 	return (0);
230 }
231 
232 static int
233 biba_subject_dominate_high(struct mac_biba *mb)
234 {
235 	struct mac_biba_element *element;
236 
237 	KASSERT((mb->mb_flags & MAC_BIBA_FLAG_EFFECTIVE) != 0,
238 	    ("biba_effective_in_range: mb not effective"));
239 	element = &mb->mb_effective;
240 
241 	return (element->mbe_type == MAC_BIBA_TYPE_EQUAL ||
242 	    element->mbe_type == MAC_BIBA_TYPE_HIGH);
243 }
244 
245 static int
246 biba_range_in_range(struct mac_biba *rangea, struct mac_biba *rangeb)
247 {
248 
249 	return (biba_dominate_element(&rangeb->mb_rangehigh,
250 	    &rangea->mb_rangehigh) &&
251 	    biba_dominate_element(&rangea->mb_rangelow,
252 	    &rangeb->mb_rangelow));
253 }
254 
255 static int
256 biba_effective_in_range(struct mac_biba *effective, struct mac_biba *range)
257 {
258 
259 	KASSERT((effective->mb_flags & MAC_BIBA_FLAG_EFFECTIVE) != 0,
260 	    ("biba_effective_in_range: a not effective"));
261 	KASSERT((range->mb_flags & MAC_BIBA_FLAG_RANGE) != 0,
262 	    ("biba_effective_in_range: b not range"));
263 
264 	return (biba_dominate_element(&range->mb_rangehigh,
265 	    &effective->mb_effective) &&
266 	    biba_dominate_element(&effective->mb_effective,
267 	    &range->mb_rangelow));
268 
269 	return (1);
270 }
271 
272 static int
273 biba_dominate_effective(struct mac_biba *a, struct mac_biba *b)
274 {
275 	KASSERT((a->mb_flags & MAC_BIBA_FLAG_EFFECTIVE) != 0,
276 	    ("biba_dominate_effective: a not effective"));
277 	KASSERT((b->mb_flags & MAC_BIBA_FLAG_EFFECTIVE) != 0,
278 	    ("biba_dominate_effective: b not effective"));
279 
280 	return (biba_dominate_element(&a->mb_effective, &b->mb_effective));
281 }
282 
283 static int
284 biba_equal_element(struct mac_biba_element *a, struct mac_biba_element *b)
285 {
286 
287 	if (a->mbe_type == MAC_BIBA_TYPE_EQUAL ||
288 	    b->mbe_type == MAC_BIBA_TYPE_EQUAL)
289 		return (1);
290 
291 	return (a->mbe_type == b->mbe_type && a->mbe_grade == b->mbe_grade);
292 }
293 
294 static int
295 biba_equal_effective(struct mac_biba *a, struct mac_biba *b)
296 {
297 
298 	KASSERT((a->mb_flags & MAC_BIBA_FLAG_EFFECTIVE) != 0,
299 	    ("biba_equal_effective: a not effective"));
300 	KASSERT((b->mb_flags & MAC_BIBA_FLAG_EFFECTIVE) != 0,
301 	    ("biba_equal_effective: b not effective"));
302 
303 	return (biba_equal_element(&a->mb_effective, &b->mb_effective));
304 }
305 
306 static int
307 biba_contains_equal(struct mac_biba *mb)
308 {
309 
310 	if (mb->mb_flags & MAC_BIBA_FLAG_EFFECTIVE) {
311 		if (mb->mb_effective.mbe_type == MAC_BIBA_TYPE_EQUAL)
312 			return (1);
313 	}
314 
315 	if (mb->mb_flags & MAC_BIBA_FLAG_RANGE) {
316 		if (mb->mb_rangelow.mbe_type == MAC_BIBA_TYPE_EQUAL)
317 			return (1);
318 		if (mb->mb_rangehigh.mbe_type == MAC_BIBA_TYPE_EQUAL)
319 			return (1);
320 	}
321 
322 	return (0);
323 }
324 
325 static int
326 biba_subject_privileged(struct mac_biba *mb)
327 {
328 
329 	KASSERT((mb->mb_flags & MAC_BIBA_FLAGS_BOTH) == MAC_BIBA_FLAGS_BOTH,
330 	    ("biba_subject_privileged: subject doesn't have both labels"));
331 
332 	/* If the effective is EQUAL, it's ok. */
333 	if (mb->mb_effective.mbe_type == MAC_BIBA_TYPE_EQUAL)
334 		return (0);
335 
336 	/* If either range endpoint is EQUAL, it's ok. */
337 	if (mb->mb_rangelow.mbe_type == MAC_BIBA_TYPE_EQUAL ||
338 	    mb->mb_rangehigh.mbe_type == MAC_BIBA_TYPE_EQUAL)
339 		return (0);
340 
341 	/* If the range is low-high, it's ok. */
342 	if (mb->mb_rangelow.mbe_type == MAC_BIBA_TYPE_LOW &&
343 	    mb->mb_rangehigh.mbe_type == MAC_BIBA_TYPE_HIGH)
344 		return (0);
345 
346 	/* It's not ok. */
347 	return (EPERM);
348 }
349 
350 static int
351 biba_high_effective(struct mac_biba *mb)
352 {
353 
354 	KASSERT((mb->mb_flags & MAC_BIBA_FLAG_EFFECTIVE) != 0,
355 	    ("biba_equal_effective: mb not effective"));
356 
357 	return (mb->mb_effective.mbe_type == MAC_BIBA_TYPE_HIGH);
358 }
359 
360 static int
361 biba_valid(struct mac_biba *mb)
362 {
363 
364 	if (mb->mb_flags & MAC_BIBA_FLAG_EFFECTIVE) {
365 		switch (mb->mb_effective.mbe_type) {
366 		case MAC_BIBA_TYPE_GRADE:
367 			break;
368 
369 		case MAC_BIBA_TYPE_EQUAL:
370 		case MAC_BIBA_TYPE_HIGH:
371 		case MAC_BIBA_TYPE_LOW:
372 			if (mb->mb_effective.mbe_grade != 0 ||
373 			    !MAC_BIBA_BIT_SET_EMPTY(
374 			    mb->mb_effective.mbe_compartments))
375 				return (EINVAL);
376 			break;
377 
378 		default:
379 			return (EINVAL);
380 		}
381 	} else {
382 		if (mb->mb_effective.mbe_type != MAC_BIBA_TYPE_UNDEF)
383 			return (EINVAL);
384 	}
385 
386 	if (mb->mb_flags & MAC_BIBA_FLAG_RANGE) {
387 		switch (mb->mb_rangelow.mbe_type) {
388 		case MAC_BIBA_TYPE_GRADE:
389 			break;
390 
391 		case MAC_BIBA_TYPE_EQUAL:
392 		case MAC_BIBA_TYPE_HIGH:
393 		case MAC_BIBA_TYPE_LOW:
394 			if (mb->mb_rangelow.mbe_grade != 0 ||
395 			    !MAC_BIBA_BIT_SET_EMPTY(
396 			    mb->mb_rangelow.mbe_compartments))
397 				return (EINVAL);
398 			break;
399 
400 		default:
401 			return (EINVAL);
402 		}
403 
404 		switch (mb->mb_rangehigh.mbe_type) {
405 		case MAC_BIBA_TYPE_GRADE:
406 			break;
407 
408 		case MAC_BIBA_TYPE_EQUAL:
409 		case MAC_BIBA_TYPE_HIGH:
410 		case MAC_BIBA_TYPE_LOW:
411 			if (mb->mb_rangehigh.mbe_grade != 0 ||
412 			    !MAC_BIBA_BIT_SET_EMPTY(
413 			    mb->mb_rangehigh.mbe_compartments))
414 				return (EINVAL);
415 			break;
416 
417 		default:
418 			return (EINVAL);
419 		}
420 		if (!biba_dominate_element(&mb->mb_rangehigh,
421 		    &mb->mb_rangelow))
422 			return (EINVAL);
423 	} else {
424 		if (mb->mb_rangelow.mbe_type != MAC_BIBA_TYPE_UNDEF ||
425 		    mb->mb_rangehigh.mbe_type != MAC_BIBA_TYPE_UNDEF)
426 			return (EINVAL);
427 	}
428 
429 	return (0);
430 }
431 
432 static void
433 biba_set_range(struct mac_biba *mb, u_short typelow, u_short gradelow,
434     u_char *compartmentslow, u_short typehigh, u_short gradehigh,
435     u_char *compartmentshigh)
436 {
437 
438 	mb->mb_rangelow.mbe_type = typelow;
439 	mb->mb_rangelow.mbe_grade = gradelow;
440 	if (compartmentslow != NULL)
441 		memcpy(mb->mb_rangelow.mbe_compartments, compartmentslow,
442 		    sizeof(mb->mb_rangelow.mbe_compartments));
443 	mb->mb_rangehigh.mbe_type = typehigh;
444 	mb->mb_rangehigh.mbe_grade = gradehigh;
445 	if (compartmentshigh != NULL)
446 		memcpy(mb->mb_rangehigh.mbe_compartments, compartmentshigh,
447 		    sizeof(mb->mb_rangehigh.mbe_compartments));
448 	mb->mb_flags |= MAC_BIBA_FLAG_RANGE;
449 }
450 
451 static void
452 biba_set_effective(struct mac_biba *mb, u_short type, u_short grade,
453     u_char *compartments)
454 {
455 
456 	mb->mb_effective.mbe_type = type;
457 	mb->mb_effective.mbe_grade = grade;
458 	if (compartments != NULL)
459 		memcpy(mb->mb_effective.mbe_compartments, compartments,
460 		    sizeof(mb->mb_effective.mbe_compartments));
461 	mb->mb_flags |= MAC_BIBA_FLAG_EFFECTIVE;
462 }
463 
464 static void
465 biba_copy_range(struct mac_biba *labelfrom, struct mac_biba *labelto)
466 {
467 
468 	KASSERT((labelfrom->mb_flags & MAC_BIBA_FLAG_RANGE) != 0,
469 	    ("biba_copy_range: labelfrom not range"));
470 
471 	labelto->mb_rangelow = labelfrom->mb_rangelow;
472 	labelto->mb_rangehigh = labelfrom->mb_rangehigh;
473 	labelto->mb_flags |= MAC_BIBA_FLAG_RANGE;
474 }
475 
476 static void
477 biba_copy_effective(struct mac_biba *labelfrom, struct mac_biba *labelto)
478 {
479 
480 	KASSERT((labelfrom->mb_flags & MAC_BIBA_FLAG_EFFECTIVE) != 0,
481 	    ("biba_copy_effective: labelfrom not effective"));
482 
483 	labelto->mb_effective = labelfrom->mb_effective;
484 	labelto->mb_flags |= MAC_BIBA_FLAG_EFFECTIVE;
485 }
486 
487 static void
488 biba_copy(struct mac_biba *source, struct mac_biba *dest)
489 {
490 
491 	if (source->mb_flags & MAC_BIBA_FLAG_EFFECTIVE)
492 		biba_copy_effective(source, dest);
493 	if (source->mb_flags & MAC_BIBA_FLAG_RANGE)
494 		biba_copy_range(source, dest);
495 }
496 
497 /*
498  * Policy module operations.
499  */
500 static void
501 biba_init(struct mac_policy_conf *conf)
502 {
503 
504 	zone_biba = uma_zcreate("mac_biba", sizeof(struct mac_biba), NULL,
505 	    NULL, NULL, NULL, UMA_ALIGN_PTR, 0);
506 }
507 
508 /*
509  * Label operations.
510  */
511 static void
512 biba_init_label(struct label *label)
513 {
514 
515 	SLOT_SET(label, biba_alloc(M_WAITOK));
516 }
517 
518 static int
519 biba_init_label_waitcheck(struct label *label, int flag)
520 {
521 
522 	SLOT_SET(label, biba_alloc(flag));
523 	if (SLOT(label) == NULL)
524 		return (ENOMEM);
525 
526 	return (0);
527 }
528 
529 static void
530 biba_destroy_label(struct label *label)
531 {
532 
533 	biba_free(SLOT(label));
534 	SLOT_SET(label, NULL);
535 }
536 
537 /*
538  * biba_element_to_string() accepts an sbuf and Biba element.  It converts
539  * the Biba element to a string and stores the result in the sbuf; if there
540  * isn't space in the sbuf, -1 is returned.
541  */
542 static int
543 biba_element_to_string(struct sbuf *sb, struct mac_biba_element *element)
544 {
545 	int i, first;
546 
547 	switch (element->mbe_type) {
548 	case MAC_BIBA_TYPE_HIGH:
549 		return (sbuf_printf(sb, "high"));
550 
551 	case MAC_BIBA_TYPE_LOW:
552 		return (sbuf_printf(sb, "low"));
553 
554 	case MAC_BIBA_TYPE_EQUAL:
555 		return (sbuf_printf(sb, "equal"));
556 
557 	case MAC_BIBA_TYPE_GRADE:
558 		if (sbuf_printf(sb, "%d", element->mbe_grade) == -1)
559 			return (-1);
560 
561 		first = 1;
562 		for (i = 1; i <= MAC_BIBA_MAX_COMPARTMENTS; i++) {
563 			if (MAC_BIBA_BIT_TEST(i, element->mbe_compartments)) {
564 				if (first) {
565 					if (sbuf_putc(sb, ':') == -1)
566 						return (-1);
567 					if (sbuf_printf(sb, "%d", i) == -1)
568 						return (-1);
569 					first = 0;
570 				} else {
571 					if (sbuf_printf(sb, "+%d", i) == -1)
572 						return (-1);
573 				}
574 			}
575 		}
576 		return (0);
577 
578 	default:
579 		panic("biba_element_to_string: invalid type (%d)",
580 		    element->mbe_type);
581 	}
582 }
583 
584 /*
585  * biba_to_string() converts a Biba label to a string, and places the results
586  * in the passed sbuf.  It returns 0 on success, or EINVAL if there isn't
587  * room in the sbuf.  Note: the sbuf will be modified even in a failure case,
588  * so the caller may need to revert the sbuf by restoring the offset if
589  * that's undesired.
590  */
591 static int
592 biba_to_string(struct sbuf *sb, struct mac_biba *mb)
593 {
594 
595 	if (mb->mb_flags & MAC_BIBA_FLAG_EFFECTIVE) {
596 		if (biba_element_to_string(sb, &mb->mb_effective) == -1)
597 			return (EINVAL);
598 	}
599 
600 	if (mb->mb_flags & MAC_BIBA_FLAG_RANGE) {
601 		if (sbuf_putc(sb, '(') == -1)
602 			return (EINVAL);
603 
604 		if (biba_element_to_string(sb, &mb->mb_rangelow) == -1)
605 			return (EINVAL);
606 
607 		if (sbuf_putc(sb, '-') == -1)
608 			return (EINVAL);
609 
610 		if (biba_element_to_string(sb, &mb->mb_rangehigh) == -1)
611 			return (EINVAL);
612 
613 		if (sbuf_putc(sb, ')') == -1)
614 			return (EINVAL);
615 	}
616 
617 	return (0);
618 }
619 
620 static int
621 biba_externalize_label(struct label *label, char *element_name,
622     struct sbuf *sb, int *claimed)
623 {
624 	struct mac_biba *mb;
625 
626 	if (strcmp(MAC_BIBA_LABEL_NAME, element_name) != 0)
627 		return (0);
628 
629 	(*claimed)++;
630 
631 	mb = SLOT(label);
632 	return (biba_to_string(sb, mb));
633 }
634 
635 static int
636 biba_parse_element(struct mac_biba_element *element, char *string)
637 {
638 	char *compartment, *end, *grade;
639 	int value;
640 
641 	if (strcmp(string, "high") == 0 || strcmp(string, "hi") == 0) {
642 		element->mbe_type = MAC_BIBA_TYPE_HIGH;
643 		element->mbe_grade = MAC_BIBA_TYPE_UNDEF;
644 	} else if (strcmp(string, "low") == 0 || strcmp(string, "lo") == 0) {
645 		element->mbe_type = MAC_BIBA_TYPE_LOW;
646 		element->mbe_grade = MAC_BIBA_TYPE_UNDEF;
647 	} else if (strcmp(string, "equal") == 0 ||
648 	    strcmp(string, "eq") == 0) {
649 		element->mbe_type = MAC_BIBA_TYPE_EQUAL;
650 		element->mbe_grade = MAC_BIBA_TYPE_UNDEF;
651 	} else {
652 		element->mbe_type = MAC_BIBA_TYPE_GRADE;
653 
654 		/*
655 		 * Numeric grade piece of the element.
656 		 */
657 		grade = strsep(&string, ":");
658 		value = strtol(grade, &end, 10);
659 		if (end == grade || *end != '\0')
660 			return (EINVAL);
661 		if (value < 0 || value > 65535)
662 			return (EINVAL);
663 		element->mbe_grade = value;
664 
665 		/*
666 		 * Optional compartment piece of the element.  If none are
667 		 * included, we assume that the label has no compartments.
668 		 */
669 		if (string == NULL)
670 			return (0);
671 		if (*string == '\0')
672 			return (0);
673 
674 		while ((compartment = strsep(&string, "+")) != NULL) {
675 			value = strtol(compartment, &end, 10);
676 			if (compartment == end || *end != '\0')
677 				return (EINVAL);
678 			if (value < 1 || value > MAC_BIBA_MAX_COMPARTMENTS)
679 				return (EINVAL);
680 			MAC_BIBA_BIT_SET(value, element->mbe_compartments);
681 		}
682 	}
683 
684 	return (0);
685 }
686 
687 /*
688  * Note: destructively consumes the string, make a local copy before calling
689  * if that's a problem.
690  */
691 static int
692 biba_parse(struct mac_biba *mb, char *string)
693 {
694 	char *rangehigh, *rangelow, *effective;
695 	int error;
696 
697 	effective = strsep(&string, "(");
698 	if (*effective == '\0')
699 		effective = NULL;
700 
701 	if (string != NULL) {
702 		rangelow = strsep(&string, "-");
703 		if (string == NULL)
704 			return (EINVAL);
705 		rangehigh = strsep(&string, ")");
706 		if (string == NULL)
707 			return (EINVAL);
708 		if (*string != '\0')
709 			return (EINVAL);
710 	} else {
711 		rangelow = NULL;
712 		rangehigh = NULL;
713 	}
714 
715 	KASSERT((rangelow != NULL && rangehigh != NULL) ||
716 	    (rangelow == NULL && rangehigh == NULL),
717 	    ("biba_parse: range mismatch"));
718 
719 	bzero(mb, sizeof(*mb));
720 	if (effective != NULL) {
721 		error = biba_parse_element(&mb->mb_effective, effective);
722 		if (error)
723 			return (error);
724 		mb->mb_flags |= MAC_BIBA_FLAG_EFFECTIVE;
725 	}
726 
727 	if (rangelow != NULL) {
728 		error = biba_parse_element(&mb->mb_rangelow, rangelow);
729 		if (error)
730 			return (error);
731 		error = biba_parse_element(&mb->mb_rangehigh, rangehigh);
732 		if (error)
733 			return (error);
734 		mb->mb_flags |= MAC_BIBA_FLAG_RANGE;
735 	}
736 
737 	error = biba_valid(mb);
738 	if (error)
739 		return (error);
740 
741 	return (0);
742 }
743 
744 static int
745 biba_internalize_label(struct label *label, char *element_name,
746     char *element_data, int *claimed)
747 {
748 	struct mac_biba *mb, mb_temp;
749 	int error;
750 
751 	if (strcmp(MAC_BIBA_LABEL_NAME, element_name) != 0)
752 		return (0);
753 
754 	(*claimed)++;
755 
756 	error = biba_parse(&mb_temp, element_data);
757 	if (error)
758 		return (error);
759 
760 	mb = SLOT(label);
761 	*mb = mb_temp;
762 
763 	return (0);
764 }
765 
766 static void
767 biba_copy_label(struct label *src, struct label *dest)
768 {
769 
770 	*SLOT(dest) = *SLOT(src);
771 }
772 
773 /*
774  * Object-specific entry point implementations are sorted alphabetically by
775  * object type name and then by operation.
776  */
777 static int
778 biba_bpfdesc_check_receive(struct bpf_d *d, struct label *dlabel,
779     struct ifnet *ifp, struct label *ifplabel)
780 {
781 	struct mac_biba *a, *b;
782 
783 	if (!biba_enabled)
784 		return (0);
785 
786 	a = SLOT(dlabel);
787 	b = SLOT(ifplabel);
788 
789 	if (biba_equal_effective(a, b))
790 		return (0);
791 	return (EACCES);
792 }
793 
794 static void
795 biba_bpfdesc_create(struct ucred *cred, struct bpf_d *d,
796     struct label *dlabel)
797 {
798 	struct mac_biba *source, *dest;
799 
800 	source = SLOT(cred->cr_label);
801 	dest = SLOT(dlabel);
802 
803 	biba_copy_effective(source, dest);
804 }
805 
806 static void
807 biba_bpfdesc_create_mbuf(struct bpf_d *d, struct label *dlabel,
808     struct mbuf *m, struct label *mlabel)
809 {
810 	struct mac_biba *source, *dest;
811 
812 	source = SLOT(dlabel);
813 	dest = SLOT(mlabel);
814 
815 	biba_copy_effective(source, dest);
816 }
817 
818 static int
819 biba_cred_check_relabel(struct ucred *cred, struct label *newlabel)
820 {
821 	struct mac_biba *subj, *new;
822 	int error;
823 
824 	subj = SLOT(cred->cr_label);
825 	new = SLOT(newlabel);
826 
827 	/*
828 	 * If there is a Biba label update for the credential, it may
829 	 * be an update of the effective, range, or both.
830 	 */
831 	error = biba_atmostflags(new, MAC_BIBA_FLAGS_BOTH);
832 	if (error)
833 		return (error);
834 
835 	/*
836 	 * If the Biba label is to be changed, authorize as appropriate.
837 	 */
838 	if (new->mb_flags & MAC_BIBA_FLAGS_BOTH) {
839 		/*
840 		 * If the change request modifies both the Biba label
841 		 * effective and range, check that the new effective will be
842 		 * in the new range.
843 		 */
844 		if ((new->mb_flags & MAC_BIBA_FLAGS_BOTH) ==
845 		    MAC_BIBA_FLAGS_BOTH &&
846 		    !biba_effective_in_range(new, new))
847 			return (EINVAL);
848 
849 		/*
850 		 * To change the Biba effective label on a credential, the
851 		 * new effective label must be in the current range.
852 		 */
853 		if (new->mb_flags & MAC_BIBA_FLAG_EFFECTIVE &&
854 		    !biba_effective_in_range(new, subj))
855 			return (EPERM);
856 
857 		/*
858 		 * To change the Biba range on a credential, the new range
859 		 * label must be in the current range.
860 		 */
861 		if (new->mb_flags & MAC_BIBA_FLAG_RANGE &&
862 		    !biba_range_in_range(new, subj))
863 			return (EPERM);
864 
865 		/*
866 		 * To have EQUAL in any component of the new credential Biba
867 		 * label, the subject must already have EQUAL in their label.
868 		 */
869 		if (biba_contains_equal(new)) {
870 			error = biba_subject_privileged(subj);
871 			if (error)
872 				return (error);
873 		}
874 	}
875 
876 	return (0);
877 }
878 
879 static int
880 biba_cred_check_visible(struct ucred *u1, struct ucred *u2)
881 {
882 	struct mac_biba *subj, *obj;
883 
884 	if (!biba_enabled)
885 		return (0);
886 
887 	subj = SLOT(u1->cr_label);
888 	obj = SLOT(u2->cr_label);
889 
890 	/* XXX: range */
891 	if (!biba_dominate_effective(obj, subj))
892 		return (ESRCH);
893 
894 	return (0);
895 }
896 
897 static void
898 biba_cred_relabel(struct ucred *cred, struct label *newlabel)
899 {
900 	struct mac_biba *source, *dest;
901 
902 	source = SLOT(newlabel);
903 	dest = SLOT(cred->cr_label);
904 
905 	biba_copy(source, dest);
906 }
907 
908 static void
909 biba_devfs_create_device(struct ucred *cred, struct mount *mp,
910     struct cdev *dev, struct devfs_dirent *de, struct label *delabel)
911 {
912 	struct mac_biba *mb;
913 	int biba_type;
914 
915 	mb = SLOT(delabel);
916 	if (strcmp(dev->si_name, "null") == 0 ||
917 	    strcmp(dev->si_name, "zero") == 0 ||
918 	    strcmp(dev->si_name, "random") == 0 ||
919 	    strncmp(dev->si_name, "fd/", strlen("fd/")) == 0)
920 		biba_type = MAC_BIBA_TYPE_EQUAL;
921 	else if (ptys_equal &&
922 	    (strncmp(dev->si_name, "ttyp", strlen("ttyp")) == 0 ||
923 	    strncmp(dev->si_name, "ptyp", strlen("ptyp")) == 0))
924 		biba_type = MAC_BIBA_TYPE_EQUAL;
925 	else
926 		biba_type = MAC_BIBA_TYPE_HIGH;
927 	biba_set_effective(mb, biba_type, 0, NULL);
928 }
929 
930 static void
931 biba_devfs_create_directory(struct mount *mp, char *dirname, int dirnamelen,
932     struct devfs_dirent *de, struct label *delabel)
933 {
934 	struct mac_biba *mb;
935 
936 	mb = SLOT(delabel);
937 
938 	biba_set_effective(mb, MAC_BIBA_TYPE_HIGH, 0, NULL);
939 }
940 
941 static void
942 biba_devfs_create_symlink(struct ucred *cred, struct mount *mp,
943     struct devfs_dirent *dd, struct label *ddlabel, struct devfs_dirent *de,
944     struct label *delabel)
945 {
946 	struct mac_biba *source, *dest;
947 
948 	source = SLOT(cred->cr_label);
949 	dest = SLOT(delabel);
950 
951 	biba_copy_effective(source, dest);
952 }
953 
954 static void
955 biba_devfs_update(struct mount *mp, struct devfs_dirent *de,
956     struct label *delabel, struct vnode *vp, struct label *vplabel)
957 {
958 	struct mac_biba *source, *dest;
959 
960 	source = SLOT(vplabel);
961 	dest = SLOT(delabel);
962 
963 	biba_copy(source, dest);
964 }
965 
966 static void
967 biba_devfs_vnode_associate(struct mount *mp, struct label *mntlabel,
968     struct devfs_dirent *de, struct label *delabel, struct vnode *vp,
969     struct label *vplabel)
970 {
971 	struct mac_biba *source, *dest;
972 
973 	source = SLOT(delabel);
974 	dest = SLOT(vplabel);
975 
976 	biba_copy_effective(source, dest);
977 }
978 
979 static int
980 biba_ifnet_check_relabel(struct ucred *cred, struct ifnet *ifp,
981     struct label *ifplabel, struct label *newlabel)
982 {
983 	struct mac_biba *subj, *new;
984 	int error;
985 
986 	subj = SLOT(cred->cr_label);
987 	new = SLOT(newlabel);
988 
989 	/*
990 	 * If there is a Biba label update for the interface, it may be an
991 	 * update of the effective, range, or both.
992 	 */
993 	error = biba_atmostflags(new, MAC_BIBA_FLAGS_BOTH);
994 	if (error)
995 		return (error);
996 
997 	/*
998 	 * Relabling network interfaces requires Biba privilege.
999 	 */
1000 	error = biba_subject_privileged(subj);
1001 	if (error)
1002 		return (error);
1003 
1004 	return (0);
1005 }
1006 
1007 static int
1008 biba_ifnet_check_transmit(struct ifnet *ifp, struct label *ifplabel,
1009     struct mbuf *m, struct label *mlabel)
1010 {
1011 	struct mac_biba *p, *i;
1012 
1013 	if (!biba_enabled)
1014 		return (0);
1015 
1016 	p = SLOT(mlabel);
1017 	i = SLOT(ifplabel);
1018 
1019 	return (biba_effective_in_range(p, i) ? 0 : EACCES);
1020 }
1021 
1022 static void
1023 biba_ifnet_create(struct ifnet *ifp, struct label *ifplabel)
1024 {
1025 	char tifname[IFNAMSIZ], *p, *q;
1026 	char tiflist[sizeof(trusted_interfaces)];
1027 	struct mac_biba *dest;
1028 	int len, type;
1029 
1030 	dest = SLOT(ifplabel);
1031 
1032 	if (ifp->if_type == IFT_LOOP || interfaces_equal != 0) {
1033 		type = MAC_BIBA_TYPE_EQUAL;
1034 		goto set;
1035 	}
1036 
1037 	if (trust_all_interfaces) {
1038 		type = MAC_BIBA_TYPE_HIGH;
1039 		goto set;
1040 	}
1041 
1042 	type = MAC_BIBA_TYPE_LOW;
1043 
1044 	if (trusted_interfaces[0] == '\0' ||
1045 	    !strvalid(trusted_interfaces, sizeof(trusted_interfaces)))
1046 		goto set;
1047 
1048 	bzero(tiflist, sizeof(tiflist));
1049 	for (p = trusted_interfaces, q = tiflist; *p != '\0'; p++, q++)
1050 		if(*p != ' ' && *p != '\t')
1051 			*q = *p;
1052 
1053 	for (p = q = tiflist;; p++) {
1054 		if (*p == ',' || *p == '\0') {
1055 			len = p - q;
1056 			if (len < IFNAMSIZ) {
1057 				bzero(tifname, sizeof(tifname));
1058 				bcopy(q, tifname, len);
1059 				if (strcmp(tifname, ifp->if_xname) == 0) {
1060 					type = MAC_BIBA_TYPE_HIGH;
1061 					break;
1062 				}
1063 			} else {
1064 				*p = '\0';
1065 				printf("mac_biba warning: interface name "
1066 				    "\"%s\" is too long (must be < %d)\n",
1067 				    q, IFNAMSIZ);
1068 			}
1069 			if (*p == '\0')
1070 				break;
1071 			q = p + 1;
1072 		}
1073 	}
1074 set:
1075 	biba_set_effective(dest, type, 0, NULL);
1076 	biba_set_range(dest, type, 0, NULL, type, 0, NULL);
1077 }
1078 
1079 static void
1080 biba_ifnet_create_mbuf(struct ifnet *ifp, struct label *ifplabel,
1081     struct mbuf *m, struct label *mlabel)
1082 {
1083 	struct mac_biba *source, *dest;
1084 
1085 	source = SLOT(ifplabel);
1086 	dest = SLOT(mlabel);
1087 
1088 	biba_copy_effective(source, dest);
1089 }
1090 
1091 static void
1092 biba_ifnet_relabel(struct ucred *cred, struct ifnet *ifp,
1093     struct label *ifplabel, struct label *newlabel)
1094 {
1095 	struct mac_biba *source, *dest;
1096 
1097 	source = SLOT(newlabel);
1098 	dest = SLOT(ifplabel);
1099 
1100 	biba_copy(source, dest);
1101 }
1102 
1103 static int
1104 biba_inpcb_check_deliver(struct inpcb *inp, struct label *inplabel,
1105     struct mbuf *m, struct label *mlabel)
1106 {
1107 	struct mac_biba *p, *i;
1108 
1109 	if (!biba_enabled)
1110 		return (0);
1111 
1112 	p = SLOT(mlabel);
1113 	i = SLOT(inplabel);
1114 
1115 	return (biba_equal_effective(p, i) ? 0 : EACCES);
1116 }
1117 
1118 static int
1119 biba_inpcb_check_visible(struct ucred *cred, struct inpcb *inp,
1120     struct label *inplabel)
1121 {
1122 	struct mac_biba *subj, *obj;
1123 
1124 	if (!biba_enabled)
1125 		return (0);
1126 
1127 	subj = SLOT(cred->cr_label);
1128 	obj = SLOT(inplabel);
1129 
1130 	if (!biba_dominate_effective(obj, subj))
1131 		return (ENOENT);
1132 
1133 	return (0);
1134 }
1135 
1136 static void
1137 biba_inpcb_create(struct socket *so, struct label *solabel,
1138     struct inpcb *inp, struct label *inplabel)
1139 {
1140 	struct mac_biba *source, *dest;
1141 
1142 	source = SLOT(solabel);
1143 	dest = SLOT(inplabel);
1144 
1145 	biba_copy_effective(source, dest);
1146 }
1147 
1148 static void
1149 biba_inpcb_create_mbuf(struct inpcb *inp, struct label *inplabel,
1150     struct mbuf *m, struct label *mlabel)
1151 {
1152 	struct mac_biba *source, *dest;
1153 
1154 	source = SLOT(inplabel);
1155 	dest = SLOT(mlabel);
1156 
1157 	biba_copy_effective(source, dest);
1158 }
1159 
1160 static void
1161 biba_inpcb_sosetlabel(struct socket *so, struct label *solabel,
1162     struct inpcb *inp, struct label *inplabel)
1163 {
1164 	struct mac_biba *source, *dest;
1165 
1166 	source = SLOT(solabel);
1167 	dest = SLOT(inplabel);
1168 
1169 	biba_copy(source, dest);
1170 }
1171 
1172 static void
1173 biba_ip6q_create(struct mbuf *m, struct label *mlabel, struct ip6q *q6,
1174     struct label *q6label)
1175 {
1176 	struct mac_biba *source, *dest;
1177 
1178 	source = SLOT(mlabel);
1179 	dest = SLOT(q6label);
1180 
1181 	biba_copy_effective(source, dest);
1182 }
1183 
1184 static int
1185 biba_ip6q_match(struct mbuf *m, struct label *mlabel, struct ip6q *q6,
1186     struct label *q6label)
1187 {
1188 	struct mac_biba *a, *b;
1189 
1190 	a = SLOT(q6label);
1191 	b = SLOT(mlabel);
1192 
1193 	return (biba_equal_effective(a, b));
1194 }
1195 
1196 static void
1197 biba_ip6q_reassemble(struct ip6q *q6, struct label *q6label, struct mbuf *m,
1198     struct label *mlabel)
1199 {
1200 	struct mac_biba *source, *dest;
1201 
1202 	source = SLOT(q6label);
1203 	dest = SLOT(mlabel);
1204 
1205 	/* Just use the head, since we require them all to match. */
1206 	biba_copy_effective(source, dest);
1207 }
1208 
1209 static void
1210 biba_ip6q_update(struct mbuf *m, struct label *mlabel, struct ip6q *q6,
1211     struct label *q6label)
1212 {
1213 
1214 	/* NOOP: we only accept matching labels, so no need to update */
1215 }
1216 
1217 static void
1218 biba_ipq_create(struct mbuf *m, struct label *mlabel, struct ipq *q,
1219     struct label *qlabel)
1220 {
1221 	struct mac_biba *source, *dest;
1222 
1223 	source = SLOT(mlabel);
1224 	dest = SLOT(qlabel);
1225 
1226 	biba_copy_effective(source, dest);
1227 }
1228 
1229 static int
1230 biba_ipq_match(struct mbuf *m, struct label *mlabel, struct ipq *q,
1231     struct label *qlabel)
1232 {
1233 	struct mac_biba *a, *b;
1234 
1235 	a = SLOT(qlabel);
1236 	b = SLOT(mlabel);
1237 
1238 	return (biba_equal_effective(a, b));
1239 }
1240 
1241 static void
1242 biba_ipq_reassemble(struct ipq *q, struct label *qlabel, struct mbuf *m,
1243     struct label *mlabel)
1244 {
1245 	struct mac_biba *source, *dest;
1246 
1247 	source = SLOT(qlabel);
1248 	dest = SLOT(mlabel);
1249 
1250 	/* Just use the head, since we require them all to match. */
1251 	biba_copy_effective(source, dest);
1252 }
1253 
1254 static void
1255 biba_ipq_update(struct mbuf *m, struct label *mlabel, struct ipq *q,
1256     struct label *qlabel)
1257 {
1258 
1259 	/* NOOP: we only accept matching labels, so no need to update */
1260 }
1261 
1262 static int
1263 biba_kld_check_load(struct ucred *cred, struct vnode *vp,
1264     struct label *vplabel)
1265 {
1266 	struct mac_biba *subj, *obj;
1267 	int error;
1268 
1269 	if (!biba_enabled)
1270 		return (0);
1271 
1272 	subj = SLOT(cred->cr_label);
1273 
1274 	error = biba_subject_privileged(subj);
1275 	if (error)
1276 		return (error);
1277 
1278 	obj = SLOT(vplabel);
1279 	if (!biba_high_effective(obj))
1280 		return (EACCES);
1281 
1282 	return (0);
1283 }
1284 
1285 static int
1286 biba_mount_check_stat(struct ucred *cred, struct mount *mp,
1287     struct label *mplabel)
1288 {
1289 	struct mac_biba *subj, *obj;
1290 
1291 	if (!biba_enabled)
1292 		return (0);
1293 
1294 	subj = SLOT(cred->cr_label);
1295 	obj = SLOT(mplabel);
1296 
1297 	if (!biba_dominate_effective(obj, subj))
1298 		return (EACCES);
1299 
1300 	return (0);
1301 }
1302 
1303 static void
1304 biba_mount_create(struct ucred *cred, struct mount *mp,
1305     struct label *mplabel)
1306 {
1307 	struct mac_biba *source, *dest;
1308 
1309 	source = SLOT(cred->cr_label);
1310 	dest = SLOT(mplabel);
1311 
1312 	biba_copy_effective(source, dest);
1313 }
1314 
1315 static void
1316 biba_netatalk_aarp_send(struct ifnet *ifp, struct label *ifplabel,
1317     struct mbuf *m, struct label *mlabel)
1318 {
1319 	struct mac_biba *dest;
1320 
1321 	dest = SLOT(mlabel);
1322 
1323 	biba_set_effective(dest, MAC_BIBA_TYPE_EQUAL, 0, NULL);
1324 }
1325 
1326 static void
1327 biba_netinet_arp_send(struct ifnet *ifp, struct label *ifplabel,
1328     struct mbuf *m, struct label *mlabel)
1329 {
1330 	struct mac_biba *dest;
1331 
1332 	dest = SLOT(mlabel);
1333 
1334 	biba_set_effective(dest, MAC_BIBA_TYPE_EQUAL, 0, NULL);
1335 }
1336 
1337 static void
1338 biba_netinet_firewall_reply(struct mbuf *mrecv, struct label *mrecvlabel,
1339     struct mbuf *msend, struct label *msendlabel)
1340 {
1341 	struct mac_biba *source, *dest;
1342 
1343 	source = SLOT(mrecvlabel);
1344 	dest = SLOT(msendlabel);
1345 
1346 	biba_copy_effective(source, dest);
1347 }
1348 
1349 static void
1350 biba_netinet_firewall_send(struct mbuf *m, struct label *mlabel)
1351 {
1352 	struct mac_biba *dest;
1353 
1354 	dest = SLOT(mlabel);
1355 
1356 	/* XXX: where is the label for the firewall really coming from? */
1357 	biba_set_effective(dest, MAC_BIBA_TYPE_EQUAL, 0, NULL);
1358 }
1359 
1360 static void
1361 biba_netinet_fragment(struct mbuf *m, struct label *mlabel,
1362     struct mbuf *frag, struct label *fraglabel)
1363 {
1364 	struct mac_biba *source, *dest;
1365 
1366 	source = SLOT(mlabel);
1367 	dest = SLOT(fraglabel);
1368 
1369 	biba_copy_effective(source, dest);
1370 }
1371 
1372 static void
1373 biba_netinet_icmp_reply(struct mbuf *mrecv, struct label *mrecvlabel,
1374     struct mbuf *msend, struct label *msendlabel)
1375 {
1376 	struct mac_biba *source, *dest;
1377 
1378 	source = SLOT(mrecvlabel);
1379 	dest = SLOT(msendlabel);
1380 
1381 	biba_copy_effective(source, dest);
1382 }
1383 
1384 static void
1385 biba_netinet_igmp_send(struct ifnet *ifp, struct label *ifplabel,
1386     struct mbuf *m, struct label *mlabel)
1387 {
1388 	struct mac_biba *dest;
1389 
1390 	dest = SLOT(mlabel);
1391 
1392 	biba_set_effective(dest, MAC_BIBA_TYPE_EQUAL, 0, NULL);
1393 }
1394 
1395 static void
1396 biba_netinet6_nd6_send(struct ifnet *ifp, struct label *ifplabel,
1397     struct mbuf *m, struct label *mlabel)
1398 {
1399 	struct mac_biba *dest;
1400 
1401 	dest = SLOT(mlabel);
1402 
1403 	biba_set_effective(dest, MAC_BIBA_TYPE_EQUAL, 0, NULL);
1404 }
1405 
1406 static int
1407 biba_pipe_check_ioctl(struct ucred *cred, struct pipepair *pp,
1408     struct label *pplabel, unsigned long cmd, void /* caddr_t */ *data)
1409 {
1410 
1411 	if(!biba_enabled)
1412 		return (0);
1413 
1414 	/* XXX: This will be implemented soon... */
1415 
1416 	return (0);
1417 }
1418 
1419 static int
1420 biba_pipe_check_poll(struct ucred *cred, struct pipepair *pp,
1421     struct label *pplabel)
1422 {
1423 	struct mac_biba *subj, *obj;
1424 
1425 	if (!biba_enabled)
1426 		return (0);
1427 
1428 	subj = SLOT(cred->cr_label);
1429 	obj = SLOT(pplabel);
1430 
1431 	if (!biba_dominate_effective(obj, subj))
1432 		return (EACCES);
1433 
1434 	return (0);
1435 }
1436 
1437 static int
1438 biba_pipe_check_read(struct ucred *cred, struct pipepair *pp,
1439     struct label *pplabel)
1440 {
1441 	struct mac_biba *subj, *obj;
1442 
1443 	if (!biba_enabled)
1444 		return (0);
1445 
1446 	subj = SLOT(cred->cr_label);
1447 	obj = SLOT(pplabel);
1448 
1449 	if (!biba_dominate_effective(obj, subj))
1450 		return (EACCES);
1451 
1452 	return (0);
1453 }
1454 
1455 static int
1456 biba_pipe_check_relabel(struct ucred *cred, struct pipepair *pp,
1457     struct label *pplabel, struct label *newlabel)
1458 {
1459 	struct mac_biba *subj, *obj, *new;
1460 	int error;
1461 
1462 	new = SLOT(newlabel);
1463 	subj = SLOT(cred->cr_label);
1464 	obj = SLOT(pplabel);
1465 
1466 	/*
1467 	 * If there is a Biba label update for a pipe, it must be a effective
1468 	 * update.
1469 	 */
1470 	error = biba_atmostflags(new, MAC_BIBA_FLAG_EFFECTIVE);
1471 	if (error)
1472 		return (error);
1473 
1474 	/*
1475 	 * To perform a relabel of a pipe (Biba label or not), Biba must
1476 	 * authorize the relabel.
1477 	 */
1478 	if (!biba_effective_in_range(obj, subj))
1479 		return (EPERM);
1480 
1481 	/*
1482 	 * If the Biba label is to be changed, authorize as appropriate.
1483 	 */
1484 	if (new->mb_flags & MAC_BIBA_FLAG_EFFECTIVE) {
1485 		/*
1486 		 * To change the Biba label on a pipe, the new pipe label
1487 		 * must be in the subject range.
1488 		 */
1489 		if (!biba_effective_in_range(new, subj))
1490 			return (EPERM);
1491 
1492 		/*
1493 		 * To change the Biba label on a pipe to be EQUAL, the
1494 		 * subject must have appropriate privilege.
1495 		 */
1496 		if (biba_contains_equal(new)) {
1497 			error = biba_subject_privileged(subj);
1498 			if (error)
1499 				return (error);
1500 		}
1501 	}
1502 
1503 	return (0);
1504 }
1505 
1506 static int
1507 biba_pipe_check_stat(struct ucred *cred, struct pipepair *pp,
1508     struct label *pplabel)
1509 {
1510 	struct mac_biba *subj, *obj;
1511 
1512 	if (!biba_enabled)
1513 		return (0);
1514 
1515 	subj = SLOT(cred->cr_label);
1516 	obj = SLOT(pplabel);
1517 
1518 	if (!biba_dominate_effective(obj, subj))
1519 		return (EACCES);
1520 
1521 	return (0);
1522 }
1523 
1524 static int
1525 biba_pipe_check_write(struct ucred *cred, struct pipepair *pp,
1526     struct label *pplabel)
1527 {
1528 	struct mac_biba *subj, *obj;
1529 
1530 	if (!biba_enabled)
1531 		return (0);
1532 
1533 	subj = SLOT(cred->cr_label);
1534 	obj = SLOT(pplabel);
1535 
1536 	if (!biba_dominate_effective(subj, obj))
1537 		return (EACCES);
1538 
1539 	return (0);
1540 }
1541 
1542 static void
1543 biba_pipe_create(struct ucred *cred, struct pipepair *pp,
1544     struct label *pplabel)
1545 {
1546 	struct mac_biba *source, *dest;
1547 
1548 	source = SLOT(cred->cr_label);
1549 	dest = SLOT(pplabel);
1550 
1551 	biba_copy_effective(source, dest);
1552 }
1553 
1554 static void
1555 biba_pipe_relabel(struct ucred *cred, struct pipepair *pp,
1556     struct label *pplabel, struct label *newlabel)
1557 {
1558 	struct mac_biba *source, *dest;
1559 
1560 	source = SLOT(newlabel);
1561 	dest = SLOT(pplabel);
1562 
1563 	biba_copy(source, dest);
1564 }
1565 
1566 static int
1567 biba_posixsem_check_openunlink(struct ucred *cred, struct ksem *ks,
1568     struct label *kslabel)
1569 {
1570 	struct mac_biba *subj, *obj;
1571 
1572 	if (!biba_enabled)
1573 		return (0);
1574 
1575 	subj = SLOT(cred->cr_label);
1576 	obj = SLOT(kslabel);
1577 
1578 	if (!biba_dominate_effective(subj, obj))
1579 		return (EACCES);
1580 
1581 	return (0);
1582 }
1583 
1584 static int
1585 biba_posixsem_check_write(struct ucred *active_cred, struct ucred *file_cred,
1586     struct ksem *ks, struct label *kslabel)
1587 {
1588 	struct mac_biba *subj, *obj;
1589 
1590 	if (!biba_enabled)
1591 		return (0);
1592 
1593 	subj = SLOT(active_cred->cr_label);
1594 	obj = SLOT(kslabel);
1595 
1596 	if (!biba_dominate_effective(subj, obj))
1597 		return (EACCES);
1598 
1599 	return (0);
1600 }
1601 
1602 static int
1603 biba_posixsem_check_rdonly(struct ucred *active_cred, struct ucred *file_cred,
1604     struct ksem *ks, struct label *kslabel)
1605 {
1606 	struct mac_biba *subj, *obj;
1607 
1608 	if (!biba_enabled)
1609 		return (0);
1610 
1611 	subj = SLOT(active_cred->cr_label);
1612 	obj = SLOT(kslabel);
1613 
1614 	if (!biba_dominate_effective(obj, subj))
1615 		return (EACCES);
1616 
1617 	return (0);
1618 }
1619 
1620 static void
1621 biba_posixsem_create(struct ucred *cred, struct ksem *ks,
1622     struct label *kslabel)
1623 {
1624 	struct mac_biba *source, *dest;
1625 
1626 	source = SLOT(cred->cr_label);
1627 	dest = SLOT(kslabel);
1628 
1629 	biba_copy_effective(source, dest);
1630 }
1631 
1632 /*
1633  * Some system privileges are allowed regardless of integrity grade; others
1634  * are allowed only when running with privilege with respect to the Biba
1635  * policy as they might otherwise allow bypassing of the integrity policy.
1636  */
1637 static int
1638 biba_priv_check(struct ucred *cred, int priv)
1639 {
1640 	struct mac_biba *subj;
1641 	int error;
1642 
1643 	if (!biba_enabled)
1644 		return (0);
1645 
1646 	/*
1647 	 * Exempt only specific privileges from the Biba integrity policy.
1648 	 */
1649 	switch (priv) {
1650 	case PRIV_KTRACE:
1651 	case PRIV_MSGBUF:
1652 
1653 	/*
1654 	 * Allow processes to manipulate basic process audit properties, and
1655 	 * to submit audit records.
1656 	 */
1657 	case PRIV_AUDIT_GETAUDIT:
1658 	case PRIV_AUDIT_SETAUDIT:
1659 	case PRIV_AUDIT_SUBMIT:
1660 
1661 	/*
1662 	 * Allow processes to manipulate their regular UNIX credentials.
1663 	 */
1664 	case PRIV_CRED_SETUID:
1665 	case PRIV_CRED_SETEUID:
1666 	case PRIV_CRED_SETGID:
1667 	case PRIV_CRED_SETEGID:
1668 	case PRIV_CRED_SETGROUPS:
1669 	case PRIV_CRED_SETREUID:
1670 	case PRIV_CRED_SETREGID:
1671 	case PRIV_CRED_SETRESUID:
1672 	case PRIV_CRED_SETRESGID:
1673 
1674 	/*
1675 	 * Allow processes to perform system monitoring.
1676 	 */
1677 	case PRIV_SEEOTHERGIDS:
1678 	case PRIV_SEEOTHERUIDS:
1679 		break;
1680 
1681 	/*
1682 	 * Allow access to general process debugging facilities.  We
1683 	 * separately control debugging based on MAC label.
1684 	 */
1685 	case PRIV_DEBUG_DIFFCRED:
1686 	case PRIV_DEBUG_SUGID:
1687 	case PRIV_DEBUG_UNPRIV:
1688 
1689 	/*
1690 	 * Allow manipulating jails.
1691 	 */
1692 	case PRIV_JAIL_ATTACH:
1693 
1694 	/*
1695 	 * Allow privilege with respect to the Partition policy, but not the
1696 	 * Privs policy.
1697 	 */
1698 	case PRIV_MAC_PARTITION:
1699 
1700 	/*
1701 	 * Allow privilege with respect to process resource limits and login
1702 	 * context.
1703 	 */
1704 	case PRIV_PROC_LIMIT:
1705 	case PRIV_PROC_SETLOGIN:
1706 	case PRIV_PROC_SETRLIMIT:
1707 
1708 	/*
1709 	 * Allow System V and POSIX IPC privileges.
1710 	 */
1711 	case PRIV_IPC_READ:
1712 	case PRIV_IPC_WRITE:
1713 	case PRIV_IPC_ADMIN:
1714 	case PRIV_IPC_MSGSIZE:
1715 	case PRIV_MQ_ADMIN:
1716 
1717 	/*
1718 	 * Allow certain scheduler manipulations -- possibly this should be
1719 	 * controlled by more fine-grained policy, as potentially low
1720 	 * integrity processes can deny CPU to higher integrity ones.
1721 	 */
1722 	case PRIV_SCHED_DIFFCRED:
1723 	case PRIV_SCHED_SETPRIORITY:
1724 	case PRIV_SCHED_RTPRIO:
1725 	case PRIV_SCHED_SETPOLICY:
1726 	case PRIV_SCHED_SET:
1727 	case PRIV_SCHED_SETPARAM:
1728 
1729 	/*
1730 	 * More IPC privileges.
1731 	 */
1732 	case PRIV_SEM_WRITE:
1733 
1734 	/*
1735 	 * Allow signaling privileges subject to integrity policy.
1736 	 */
1737 	case PRIV_SIGNAL_DIFFCRED:
1738 	case PRIV_SIGNAL_SUGID:
1739 
1740 	/*
1741 	 * Allow access to only limited sysctls from lower integrity levels;
1742 	 * piggy-back on the Jail definition.
1743 	 */
1744 	case PRIV_SYSCTL_WRITEJAIL:
1745 
1746 	/*
1747 	 * Allow TTY-based privileges, subject to general device access using
1748 	 * labels on TTY device nodes, but not console privilege.
1749 	 */
1750 	case PRIV_TTY_DRAINWAIT:
1751 	case PRIV_TTY_DTRWAIT:
1752 	case PRIV_TTY_EXCLUSIVE:
1753 	case PRIV_TTY_PRISON:
1754 	case PRIV_TTY_STI:
1755 	case PRIV_TTY_SETA:
1756 
1757 	/*
1758 	 * Grant most VFS privileges, as almost all are in practice bounded
1759 	 * by more specific checks using labels.
1760 	 */
1761 	case PRIV_VFS_READ:
1762 	case PRIV_VFS_WRITE:
1763 	case PRIV_VFS_ADMIN:
1764 	case PRIV_VFS_EXEC:
1765 	case PRIV_VFS_LOOKUP:
1766 	case PRIV_VFS_CHFLAGS_DEV:
1767 	case PRIV_VFS_CHOWN:
1768 	case PRIV_VFS_CHROOT:
1769 	case PRIV_VFS_RETAINSUGID:
1770 	case PRIV_VFS_EXCEEDQUOTA:
1771 	case PRIV_VFS_FCHROOT:
1772 	case PRIV_VFS_FHOPEN:
1773 	case PRIV_VFS_FHSTATFS:
1774 	case PRIV_VFS_GENERATION:
1775 	case PRIV_VFS_GETFH:
1776 	case PRIV_VFS_GETQUOTA:
1777 	case PRIV_VFS_LINK:
1778 	case PRIV_VFS_MOUNT:
1779 	case PRIV_VFS_MOUNT_OWNER:
1780 	case PRIV_VFS_MOUNT_PERM:
1781 	case PRIV_VFS_MOUNT_SUIDDIR:
1782 	case PRIV_VFS_MOUNT_NONUSER:
1783 	case PRIV_VFS_SETGID:
1784 	case PRIV_VFS_STICKYFILE:
1785 	case PRIV_VFS_SYSFLAGS:
1786 	case PRIV_VFS_UNMOUNT:
1787 
1788 	/*
1789 	 * Allow VM privileges; it would be nice if these were subject to
1790 	 * resource limits.
1791 	 */
1792 	case PRIV_VM_MADV_PROTECT:
1793 	case PRIV_VM_MLOCK:
1794 	case PRIV_VM_MUNLOCK:
1795 
1796 	/*
1797 	 * Allow some but not all network privileges.  In general, dont allow
1798 	 * reconfiguring the network stack, just normal use.
1799 	 */
1800 	case PRIV_NETATALK_RESERVEDPORT:
1801 	case PRIV_NETINET_RESERVEDPORT:
1802 	case PRIV_NETINET_RAW:
1803 	case PRIV_NETINET_REUSEPORT:
1804 	case PRIV_NETIPX_RESERVEDPORT:
1805 	case PRIV_NETIPX_RAW:
1806 		break;
1807 
1808 	/*
1809 	 * All remaining system privileges are allow only if the process
1810 	 * holds privilege with respect to the Biba policy.
1811 	 */
1812 	default:
1813 		subj = SLOT(cred->cr_label);
1814 		error = biba_subject_privileged(subj);
1815 		if (error)
1816 			return (error);
1817 	}
1818 	return (0);
1819 }
1820 
1821 static void
1822 biba_proc_associate_nfsd(struct ucred *cred)
1823 {
1824 	struct mac_biba *label;
1825 
1826 	label = SLOT(cred->cr_label);
1827 	biba_set_effective(label, MAC_BIBA_TYPE_LOW, 0, NULL);
1828 	biba_set_range(label, MAC_BIBA_TYPE_LOW, 0, NULL, MAC_BIBA_TYPE_HIGH,
1829 	    0, NULL);
1830 }
1831 
1832 static int
1833 biba_proc_check_debug(struct ucred *cred, struct proc *p)
1834 {
1835 	struct mac_biba *subj, *obj;
1836 
1837 	if (!biba_enabled)
1838 		return (0);
1839 
1840 	subj = SLOT(cred->cr_label);
1841 	obj = SLOT(p->p_ucred->cr_label);
1842 
1843 	/* XXX: range checks */
1844 	if (!biba_dominate_effective(obj, subj))
1845 		return (ESRCH);
1846 	if (!biba_dominate_effective(subj, obj))
1847 		return (EACCES);
1848 
1849 	return (0);
1850 }
1851 
1852 static int
1853 biba_proc_check_sched(struct ucred *cred, struct proc *p)
1854 {
1855 	struct mac_biba *subj, *obj;
1856 
1857 	if (!biba_enabled)
1858 		return (0);
1859 
1860 	subj = SLOT(cred->cr_label);
1861 	obj = SLOT(p->p_ucred->cr_label);
1862 
1863 	/* XXX: range checks */
1864 	if (!biba_dominate_effective(obj, subj))
1865 		return (ESRCH);
1866 	if (!biba_dominate_effective(subj, obj))
1867 		return (EACCES);
1868 
1869 	return (0);
1870 }
1871 
1872 static int
1873 biba_proc_check_signal(struct ucred *cred, struct proc *p, int signum)
1874 {
1875 	struct mac_biba *subj, *obj;
1876 
1877 	if (!biba_enabled)
1878 		return (0);
1879 
1880 	subj = SLOT(cred->cr_label);
1881 	obj = SLOT(p->p_ucred->cr_label);
1882 
1883 	/* XXX: range checks */
1884 	if (!biba_dominate_effective(obj, subj))
1885 		return (ESRCH);
1886 	if (!biba_dominate_effective(subj, obj))
1887 		return (EACCES);
1888 
1889 	return (0);
1890 }
1891 
1892 static int
1893 biba_socket_check_deliver(struct socket *so, struct label *solabel,
1894     struct mbuf *m, struct label *mlabel)
1895 {
1896 	struct mac_biba *p, *s;
1897 
1898 	if (!biba_enabled)
1899 		return (0);
1900 
1901 	p = SLOT(mlabel);
1902 	s = SLOT(solabel);
1903 
1904 	return (biba_equal_effective(p, s) ? 0 : EACCES);
1905 }
1906 
1907 static void
1908 biba_proc_create_init(struct ucred *cred)
1909 {
1910 	struct mac_biba *dest;
1911 
1912 	dest = SLOT(cred->cr_label);
1913 
1914 	biba_set_effective(dest, MAC_BIBA_TYPE_HIGH, 0, NULL);
1915 	biba_set_range(dest, MAC_BIBA_TYPE_LOW, 0, NULL, MAC_BIBA_TYPE_HIGH,
1916 	    0, NULL);
1917 }
1918 
1919 static void
1920 biba_proc_create_swapper(struct ucred *cred)
1921 {
1922 	struct mac_biba *dest;
1923 
1924 	dest = SLOT(cred->cr_label);
1925 
1926 	biba_set_effective(dest, MAC_BIBA_TYPE_EQUAL, 0, NULL);
1927 	biba_set_range(dest, MAC_BIBA_TYPE_LOW, 0, NULL, MAC_BIBA_TYPE_HIGH,
1928 	    0, NULL);
1929 }
1930 
1931 static int
1932 biba_socket_check_relabel(struct ucred *cred, struct socket *so,
1933     struct label *solabel, struct label *newlabel)
1934 {
1935 	struct mac_biba *subj, *obj, *new;
1936 	int error;
1937 
1938 	new = SLOT(newlabel);
1939 	subj = SLOT(cred->cr_label);
1940 	obj = SLOT(solabel);
1941 
1942 	/*
1943 	 * If there is a Biba label update for the socket, it may be an
1944 	 * update of effective.
1945 	 */
1946 	error = biba_atmostflags(new, MAC_BIBA_FLAG_EFFECTIVE);
1947 	if (error)
1948 		return (error);
1949 
1950 	/*
1951 	 * To relabel a socket, the old socket effective must be in the
1952 	 * subject range.
1953 	 */
1954 	if (!biba_effective_in_range(obj, subj))
1955 		return (EPERM);
1956 
1957 	/*
1958 	 * If the Biba label is to be changed, authorize as appropriate.
1959 	 */
1960 	if (new->mb_flags & MAC_BIBA_FLAG_EFFECTIVE) {
1961 		/*
1962 		 * To relabel a socket, the new socket effective must be in
1963 		 * the subject range.
1964 		 */
1965 		if (!biba_effective_in_range(new, subj))
1966 			return (EPERM);
1967 
1968 		/*
1969 		 * To change the Biba label on the socket to contain EQUAL,
1970 		 * the subject must have appropriate privilege.
1971 		 */
1972 		if (biba_contains_equal(new)) {
1973 			error = biba_subject_privileged(subj);
1974 			if (error)
1975 				return (error);
1976 		}
1977 	}
1978 
1979 	return (0);
1980 }
1981 
1982 static int
1983 biba_socket_check_visible(struct ucred *cred, struct socket *so,
1984     struct label *solabel)
1985 {
1986 	struct mac_biba *subj, *obj;
1987 
1988 	if (!biba_enabled)
1989 		return (0);
1990 
1991 	subj = SLOT(cred->cr_label);
1992 	obj = SLOT(solabel);
1993 
1994 	if (!biba_dominate_effective(obj, subj))
1995 		return (ENOENT);
1996 
1997 	return (0);
1998 }
1999 
2000 static void
2001 biba_socket_create(struct ucred *cred, struct socket *so,
2002     struct label *solabel)
2003 {
2004 	struct mac_biba *source, *dest;
2005 
2006 	source = SLOT(cred->cr_label);
2007 	dest = SLOT(solabel);
2008 
2009 	biba_copy_effective(source, dest);
2010 }
2011 
2012 static void
2013 biba_socket_create_mbuf(struct socket *so, struct label *solabel,
2014     struct mbuf *m, struct label *mlabel)
2015 {
2016 	struct mac_biba *source, *dest;
2017 
2018 	source = SLOT(solabel);
2019 	dest = SLOT(mlabel);
2020 
2021 	biba_copy_effective(source, dest);
2022 }
2023 
2024 static void
2025 biba_socket_newconn(struct socket *oldso, struct label *oldsolabel,
2026     struct socket *newso, struct label *newsolabel)
2027 {
2028 	struct mac_biba *source, *dest;
2029 
2030 	source = SLOT(oldsolabel);
2031 	dest = SLOT(newsolabel);
2032 
2033 	biba_copy_effective(source, dest);
2034 }
2035 
2036 static void
2037 biba_socket_relabel(struct ucred *cred, struct socket *so,
2038     struct label *solabel, struct label *newlabel)
2039 {
2040 	struct mac_biba *source, *dest;
2041 
2042 	source = SLOT(newlabel);
2043 	dest = SLOT(solabel);
2044 
2045 	biba_copy(source, dest);
2046 }
2047 
2048 static void
2049 biba_socketpeer_set_from_mbuf(struct mbuf *m, struct label *mlabel,
2050     struct socket *so, struct label *sopeerlabel)
2051 {
2052 	struct mac_biba *source, *dest;
2053 
2054 	source = SLOT(mlabel);
2055 	dest = SLOT(sopeerlabel);
2056 
2057 	biba_copy_effective(source, dest);
2058 }
2059 
2060 static void
2061 biba_socketpeer_set_from_socket(struct socket *oldso,
2062     struct label *oldsolabel, struct socket *newso,
2063     struct label *newsopeerlabel)
2064 {
2065 	struct mac_biba *source, *dest;
2066 
2067 	source = SLOT(oldsolabel);
2068 	dest = SLOT(newsopeerlabel);
2069 
2070 	biba_copy_effective(source, dest);
2071 }
2072 
2073 static void
2074 biba_syncache_create(struct label *label, struct inpcb *inp)
2075 {
2076 	struct mac_biba *source, *dest;
2077 
2078 	source = SLOT(inp->inp_label);
2079 	dest = SLOT(label);
2080 	biba_copy_effective(source, dest);
2081 }
2082 
2083 static void
2084 biba_syncache_create_mbuf(struct label *sc_label, struct mbuf *m,
2085     struct label *mlabel)
2086 {
2087 	struct mac_biba *source, *dest;
2088 
2089 	source = SLOT(sc_label);
2090 	dest = SLOT(mlabel);
2091 	biba_copy_effective(source, dest);
2092 }
2093 
2094 static int
2095 biba_system_check_acct(struct ucred *cred, struct vnode *vp,
2096     struct label *vplabel)
2097 {
2098 	struct mac_biba *subj, *obj;
2099 	int error;
2100 
2101 	if (!biba_enabled)
2102 		return (0);
2103 
2104 	subj = SLOT(cred->cr_label);
2105 
2106 	error = biba_subject_privileged(subj);
2107 	if (error)
2108 		return (error);
2109 
2110 	if (vplabel == NULL)
2111 		return (0);
2112 
2113 	obj = SLOT(vplabel);
2114 	if (!biba_high_effective(obj))
2115 		return (EACCES);
2116 
2117 	return (0);
2118 }
2119 
2120 static int
2121 biba_system_check_auditctl(struct ucred *cred, struct vnode *vp,
2122     struct label *vplabel)
2123 {
2124 	struct mac_biba *subj, *obj;
2125 	int error;
2126 
2127 	if (!biba_enabled)
2128 		return (0);
2129 
2130 	subj = SLOT(cred->cr_label);
2131 
2132 	error = biba_subject_privileged(subj);
2133 	if (error)
2134 		return (error);
2135 
2136 	if (vplabel == NULL)
2137 		return (0);
2138 
2139 	obj = SLOT(vplabel);
2140 	if (!biba_high_effective(obj))
2141 		return (EACCES);
2142 
2143 	return (0);
2144 }
2145 
2146 static int
2147 biba_system_check_auditon(struct ucred *cred, int cmd)
2148 {
2149 	struct mac_biba *subj;
2150 	int error;
2151 
2152 	if (!biba_enabled)
2153 		return (0);
2154 
2155 	subj = SLOT(cred->cr_label);
2156 
2157 	error = biba_subject_privileged(subj);
2158 	if (error)
2159 		return (error);
2160 
2161 	return (0);
2162 }
2163 
2164 static int
2165 biba_system_check_swapoff(struct ucred *cred, struct vnode *vp,
2166     struct label *label)
2167 {
2168 	struct mac_biba *subj;
2169 	int error;
2170 
2171 	if (!biba_enabled)
2172 		return (0);
2173 
2174 	subj = SLOT(cred->cr_label);
2175 
2176 	error = biba_subject_privileged(subj);
2177 	if (error)
2178 		return (error);
2179 
2180 	return (0);
2181 }
2182 
2183 static int
2184 biba_system_check_swapon(struct ucred *cred, struct vnode *vp,
2185     struct label *vplabel)
2186 {
2187 	struct mac_biba *subj, *obj;
2188 	int error;
2189 
2190 	if (!biba_enabled)
2191 		return (0);
2192 
2193 	subj = SLOT(cred->cr_label);
2194 	obj = SLOT(vplabel);
2195 
2196 	error = biba_subject_privileged(subj);
2197 	if (error)
2198 		return (error);
2199 
2200 	if (!biba_high_effective(obj))
2201 		return (EACCES);
2202 
2203 	return (0);
2204 }
2205 
2206 static int
2207 biba_system_check_sysctl(struct ucred *cred, struct sysctl_oid *oidp,
2208     void *arg1, int arg2, struct sysctl_req *req)
2209 {
2210 	struct mac_biba *subj;
2211 	int error;
2212 
2213 	if (!biba_enabled)
2214 		return (0);
2215 
2216 	subj = SLOT(cred->cr_label);
2217 
2218 	/*
2219 	 * Treat sysctl variables without CTLFLAG_ANYBODY flag as biba/high,
2220 	 * but also require privilege to change them.
2221 	 */
2222 	if (req->newptr != NULL && (oidp->oid_kind & CTLFLAG_ANYBODY) == 0) {
2223 		if (!biba_subject_dominate_high(subj))
2224 			return (EACCES);
2225 
2226 		error = biba_subject_privileged(subj);
2227 		if (error)
2228 			return (error);
2229 	}
2230 
2231 	return (0);
2232 }
2233 
2234 static void
2235 biba_sysvmsg_cleanup(struct label *msglabel)
2236 {
2237 
2238 	bzero(SLOT(msglabel), sizeof(struct mac_biba));
2239 }
2240 
2241 static void
2242 biba_sysvmsg_create(struct ucred *cred, struct msqid_kernel *msqkptr,
2243     struct label *msqlabel, struct msg *msgptr, struct label *msglabel)
2244 {
2245 	struct mac_biba *source, *dest;
2246 
2247 	/* Ignore the msgq label */
2248 	source = SLOT(cred->cr_label);
2249 	dest = SLOT(msglabel);
2250 
2251 	biba_copy_effective(source, dest);
2252 }
2253 
2254 static int
2255 biba_sysvmsq_check_msgrcv(struct ucred *cred, struct msg *msgptr,
2256     struct label *msglabel)
2257 {
2258 	struct mac_biba *subj, *obj;
2259 
2260 	if (!biba_enabled)
2261 		return (0);
2262 
2263 	subj = SLOT(cred->cr_label);
2264 	obj = SLOT(msglabel);
2265 
2266 	if (!biba_dominate_effective(obj, subj))
2267 		return (EACCES);
2268 
2269 	return (0);
2270 }
2271 
2272 static int
2273 biba_sysvmsq_check_msgrmid(struct ucred *cred, struct msg *msgptr,
2274     struct label *msglabel)
2275 {
2276 	struct mac_biba *subj, *obj;
2277 
2278 	if (!biba_enabled)
2279 		return (0);
2280 
2281 	subj = SLOT(cred->cr_label);
2282 	obj = SLOT(msglabel);
2283 
2284 	if (!biba_dominate_effective(subj, obj))
2285 		return (EACCES);
2286 
2287 	return (0);
2288 }
2289 
2290 static int
2291 biba_sysvmsq_check_msqget(struct ucred *cred, struct msqid_kernel *msqkptr,
2292     struct label *msqklabel)
2293 {
2294 	struct mac_biba *subj, *obj;
2295 
2296 	if (!biba_enabled)
2297 		return (0);
2298 
2299 	subj = SLOT(cred->cr_label);
2300 	obj = SLOT(msqklabel);
2301 
2302 	if (!biba_dominate_effective(obj, subj))
2303 		return (EACCES);
2304 
2305 	return (0);
2306 }
2307 
2308 static int
2309 biba_sysvmsq_check_msqsnd(struct ucred *cred, struct msqid_kernel *msqkptr,
2310     struct label *msqklabel)
2311 {
2312 	struct mac_biba *subj, *obj;
2313 
2314 	if (!biba_enabled)
2315 		return (0);
2316 
2317 	subj = SLOT(cred->cr_label);
2318 	obj = SLOT(msqklabel);
2319 
2320 	if (!biba_dominate_effective(subj, obj))
2321 		return (EACCES);
2322 
2323 	return (0);
2324 }
2325 
2326 static int
2327 biba_sysvmsq_check_msqrcv(struct ucred *cred, struct msqid_kernel *msqkptr,
2328     struct label *msqklabel)
2329 {
2330 	struct mac_biba *subj, *obj;
2331 
2332 	if (!biba_enabled)
2333 		return (0);
2334 
2335 	subj = SLOT(cred->cr_label);
2336 	obj = SLOT(msqklabel);
2337 
2338 	if (!biba_dominate_effective(obj, subj))
2339 		return (EACCES);
2340 
2341 	return (0);
2342 }
2343 
2344 static int
2345 biba_sysvmsq_check_msqctl(struct ucred *cred, struct msqid_kernel *msqkptr,
2346     struct label *msqklabel, int cmd)
2347 {
2348 	struct mac_biba *subj, *obj;
2349 
2350 	if (!biba_enabled)
2351 		return (0);
2352 
2353 	subj = SLOT(cred->cr_label);
2354 	obj = SLOT(msqklabel);
2355 
2356 	switch(cmd) {
2357 	case IPC_RMID:
2358 	case IPC_SET:
2359 		if (!biba_dominate_effective(subj, obj))
2360 			return (EACCES);
2361 		break;
2362 
2363 	case IPC_STAT:
2364 		if (!biba_dominate_effective(obj, subj))
2365 			return (EACCES);
2366 		break;
2367 
2368 	default:
2369 		return (EACCES);
2370 	}
2371 
2372 	return (0);
2373 }
2374 
2375 static void
2376 biba_sysvmsq_cleanup(struct label *msqlabel)
2377 {
2378 
2379 	bzero(SLOT(msqlabel), sizeof(struct mac_biba));
2380 }
2381 
2382 static void
2383 biba_sysvmsq_create(struct ucred *cred, struct msqid_kernel *msqkptr,
2384     struct label *msqlabel)
2385 {
2386 	struct mac_biba *source, *dest;
2387 
2388 	source = SLOT(cred->cr_label);
2389 	dest = SLOT(msqlabel);
2390 
2391 	biba_copy_effective(source, dest);
2392 }
2393 
2394 static int
2395 biba_sysvsem_check_semctl(struct ucred *cred, struct semid_kernel *semakptr,
2396     struct label *semaklabel, int cmd)
2397 {
2398 	struct mac_biba *subj, *obj;
2399 
2400 	if (!biba_enabled)
2401 		return (0);
2402 
2403 	subj = SLOT(cred->cr_label);
2404 	obj = SLOT(semaklabel);
2405 
2406 	switch(cmd) {
2407 	case IPC_RMID:
2408 	case IPC_SET:
2409 	case SETVAL:
2410 	case SETALL:
2411 		if (!biba_dominate_effective(subj, obj))
2412 			return (EACCES);
2413 		break;
2414 
2415 	case IPC_STAT:
2416 	case GETVAL:
2417 	case GETPID:
2418 	case GETNCNT:
2419 	case GETZCNT:
2420 	case GETALL:
2421 		if (!biba_dominate_effective(obj, subj))
2422 			return (EACCES);
2423 		break;
2424 
2425 	default:
2426 		return (EACCES);
2427 	}
2428 
2429 	return (0);
2430 }
2431 
2432 static int
2433 biba_sysvsem_check_semget(struct ucred *cred, struct semid_kernel *semakptr,
2434     struct label *semaklabel)
2435 {
2436 	struct mac_biba *subj, *obj;
2437 
2438 	if (!biba_enabled)
2439 		return (0);
2440 
2441 	subj = SLOT(cred->cr_label);
2442 	obj = SLOT(semaklabel);
2443 
2444 	if (!biba_dominate_effective(obj, subj))
2445 		return (EACCES);
2446 
2447 	return (0);
2448 }
2449 
2450 static int
2451 biba_sysvsem_check_semop(struct ucred *cred, struct semid_kernel *semakptr,
2452     struct label *semaklabel, size_t accesstype)
2453 {
2454 	struct mac_biba *subj, *obj;
2455 
2456 	if (!biba_enabled)
2457 		return (0);
2458 
2459 	subj = SLOT(cred->cr_label);
2460 	obj = SLOT(semaklabel);
2461 
2462 	if (accesstype & SEM_R)
2463 		if (!biba_dominate_effective(obj, subj))
2464 			return (EACCES);
2465 
2466 	if (accesstype & SEM_A)
2467 		if (!biba_dominate_effective(subj, obj))
2468 			return (EACCES);
2469 
2470 	return (0);
2471 }
2472 
2473 static void
2474 biba_sysvsem_cleanup(struct label *semalabel)
2475 {
2476 
2477 	bzero(SLOT(semalabel), sizeof(struct mac_biba));
2478 }
2479 
2480 static void
2481 biba_sysvsem_create(struct ucred *cred, struct semid_kernel *semakptr,
2482     struct label *semalabel)
2483 {
2484 	struct mac_biba *source, *dest;
2485 
2486 	source = SLOT(cred->cr_label);
2487 	dest = SLOT(semalabel);
2488 
2489 	biba_copy_effective(source, dest);
2490 }
2491 
2492 static int
2493 biba_sysvshm_check_shmat(struct ucred *cred, struct shmid_kernel *shmsegptr,
2494     struct label *shmseglabel, int shmflg)
2495 {
2496 	struct mac_biba *subj, *obj;
2497 
2498 	if (!biba_enabled)
2499 		return (0);
2500 
2501 	subj = SLOT(cred->cr_label);
2502 	obj = SLOT(shmseglabel);
2503 
2504 	if (!biba_dominate_effective(obj, subj))
2505 		return (EACCES);
2506 	if ((shmflg & SHM_RDONLY) == 0) {
2507 		if (!biba_dominate_effective(subj, obj))
2508 			return (EACCES);
2509 	}
2510 
2511 	return (0);
2512 }
2513 
2514 static int
2515 biba_sysvshm_check_shmctl(struct ucred *cred, struct shmid_kernel *shmsegptr,
2516     struct label *shmseglabel, int cmd)
2517 {
2518 	struct mac_biba *subj, *obj;
2519 
2520 	if (!biba_enabled)
2521 		return (0);
2522 
2523 	subj = SLOT(cred->cr_label);
2524 	obj = SLOT(shmseglabel);
2525 
2526 	switch(cmd) {
2527 	case IPC_RMID:
2528 	case IPC_SET:
2529 		if (!biba_dominate_effective(subj, obj))
2530 			return (EACCES);
2531 		break;
2532 
2533 	case IPC_STAT:
2534 	case SHM_STAT:
2535 		if (!biba_dominate_effective(obj, subj))
2536 			return (EACCES);
2537 		break;
2538 
2539 	default:
2540 		return (EACCES);
2541 	}
2542 
2543 	return (0);
2544 }
2545 
2546 static int
2547 biba_sysvshm_check_shmget(struct ucred *cred, struct shmid_kernel *shmsegptr,
2548     struct label *shmseglabel, int shmflg)
2549 {
2550 	struct mac_biba *subj, *obj;
2551 
2552 	if (!biba_enabled)
2553 		return (0);
2554 
2555 	subj = SLOT(cred->cr_label);
2556 	obj = SLOT(shmseglabel);
2557 
2558 	if (!biba_dominate_effective(obj, subj))
2559 		return (EACCES);
2560 
2561 	return (0);
2562 }
2563 
2564 static void
2565 biba_sysvshm_cleanup(struct label *shmlabel)
2566 {
2567 
2568 	bzero(SLOT(shmlabel), sizeof(struct mac_biba));
2569 }
2570 
2571 static void
2572 biba_sysvshm_create(struct ucred *cred, struct shmid_kernel *shmsegptr,
2573     struct label *shmlabel)
2574 {
2575 	struct mac_biba *source, *dest;
2576 
2577 	source = SLOT(cred->cr_label);
2578 	dest = SLOT(shmlabel);
2579 
2580 	biba_copy_effective(source, dest);
2581 }
2582 
2583 static int
2584 biba_vnode_associate_extattr(struct mount *mp, struct label *mplabel,
2585     struct vnode *vp, struct label *vplabel)
2586 {
2587 	struct mac_biba mb_temp, *source, *dest;
2588 	int buflen, error;
2589 
2590 	source = SLOT(mplabel);
2591 	dest = SLOT(vplabel);
2592 
2593 	buflen = sizeof(mb_temp);
2594 	bzero(&mb_temp, buflen);
2595 
2596 	error = vn_extattr_get(vp, IO_NODELOCKED, MAC_BIBA_EXTATTR_NAMESPACE,
2597 	    MAC_BIBA_EXTATTR_NAME, &buflen, (char *) &mb_temp, curthread);
2598 	if (error == ENOATTR || error == EOPNOTSUPP) {
2599 		/* Fall back to the mntlabel. */
2600 		biba_copy_effective(source, dest);
2601 		return (0);
2602 	} else if (error)
2603 		return (error);
2604 
2605 	if (buflen != sizeof(mb_temp)) {
2606 		printf("biba_vnode_associate_extattr: bad size %d\n",
2607 		    buflen);
2608 		return (EPERM);
2609 	}
2610 	if (biba_valid(&mb_temp) != 0) {
2611 		printf("biba_vnode_associate_extattr: invalid\n");
2612 		return (EPERM);
2613 	}
2614 	if ((mb_temp.mb_flags & MAC_BIBA_FLAGS_BOTH) !=
2615 	    MAC_BIBA_FLAG_EFFECTIVE) {
2616 		printf("biba_vnode_associate_extattr: not effective\n");
2617 		return (EPERM);
2618 	}
2619 
2620 	biba_copy_effective(&mb_temp, dest);
2621 	return (0);
2622 }
2623 
2624 static void
2625 biba_vnode_associate_singlelabel(struct mount *mp, struct label *mplabel,
2626     struct vnode *vp, struct label *vplabel)
2627 {
2628 	struct mac_biba *source, *dest;
2629 
2630 	source = SLOT(mplabel);
2631 	dest = SLOT(vplabel);
2632 
2633 	biba_copy_effective(source, dest);
2634 }
2635 
2636 static int
2637 biba_vnode_check_chdir(struct ucred *cred, struct vnode *dvp,
2638     struct label *dvplabel)
2639 {
2640 	struct mac_biba *subj, *obj;
2641 
2642 	if (!biba_enabled)
2643 		return (0);
2644 
2645 	subj = SLOT(cred->cr_label);
2646 	obj = SLOT(dvplabel);
2647 
2648 	if (!biba_dominate_effective(obj, subj))
2649 		return (EACCES);
2650 
2651 	return (0);
2652 }
2653 
2654 static int
2655 biba_vnode_check_chroot(struct ucred *cred, struct vnode *dvp,
2656     struct label *dvplabel)
2657 {
2658 	struct mac_biba *subj, *obj;
2659 
2660 	if (!biba_enabled)
2661 		return (0);
2662 
2663 	subj = SLOT(cred->cr_label);
2664 	obj = SLOT(dvplabel);
2665 
2666 	if (!biba_dominate_effective(obj, subj))
2667 		return (EACCES);
2668 
2669 	return (0);
2670 }
2671 
2672 static int
2673 biba_vnode_check_create(struct ucred *cred, struct vnode *dvp,
2674     struct label *dvplabel, struct componentname *cnp, struct vattr *vap)
2675 {
2676 	struct mac_biba *subj, *obj;
2677 
2678 	if (!biba_enabled)
2679 		return (0);
2680 
2681 	subj = SLOT(cred->cr_label);
2682 	obj = SLOT(dvplabel);
2683 
2684 	if (!biba_dominate_effective(subj, obj))
2685 		return (EACCES);
2686 
2687 	return (0);
2688 }
2689 
2690 static int
2691 biba_vnode_check_deleteacl(struct ucred *cred, struct vnode *vp,
2692     struct label *vplabel, acl_type_t type)
2693 {
2694 	struct mac_biba *subj, *obj;
2695 
2696 	if (!biba_enabled)
2697 		return (0);
2698 
2699 	subj = SLOT(cred->cr_label);
2700 	obj = SLOT(vplabel);
2701 
2702 	if (!biba_dominate_effective(subj, obj))
2703 		return (EACCES);
2704 
2705 	return (0);
2706 }
2707 
2708 static int
2709 biba_vnode_check_deleteextattr(struct ucred *cred, struct vnode *vp,
2710     struct label *vplabel, int attrnamespace, const char *name)
2711 {
2712 	struct mac_biba *subj, *obj;
2713 
2714 	if (!biba_enabled)
2715 		return (0);
2716 
2717 	subj = SLOT(cred->cr_label);
2718 	obj = SLOT(vplabel);
2719 
2720 	if (!biba_dominate_effective(subj, obj))
2721 		return (EACCES);
2722 
2723 	return (0);
2724 }
2725 
2726 static int
2727 biba_vnode_check_exec(struct ucred *cred, struct vnode *vp,
2728     struct label *vplabel, struct image_params *imgp,
2729     struct label *execlabel)
2730 {
2731 	struct mac_biba *subj, *obj, *exec;
2732 	int error;
2733 
2734 	if (execlabel != NULL) {
2735 		/*
2736 		 * We currently don't permit labels to be changed at
2737 		 * exec-time as part of Biba, so disallow non-NULL Biba label
2738 		 * elements in the execlabel.
2739 		 */
2740 		exec = SLOT(execlabel);
2741 		error = biba_atmostflags(exec, 0);
2742 		if (error)
2743 			return (error);
2744 	}
2745 
2746 	if (!biba_enabled)
2747 		return (0);
2748 
2749 	subj = SLOT(cred->cr_label);
2750 	obj = SLOT(vplabel);
2751 
2752 	if (!biba_dominate_effective(obj, subj))
2753 		return (EACCES);
2754 
2755 	return (0);
2756 }
2757 
2758 static int
2759 biba_vnode_check_getacl(struct ucred *cred, struct vnode *vp,
2760     struct label *vplabel, acl_type_t type)
2761 {
2762 	struct mac_biba *subj, *obj;
2763 
2764 	if (!biba_enabled)
2765 		return (0);
2766 
2767 	subj = SLOT(cred->cr_label);
2768 	obj = SLOT(vplabel);
2769 
2770 	if (!biba_dominate_effective(obj, subj))
2771 		return (EACCES);
2772 
2773 	return (0);
2774 }
2775 
2776 static int
2777 biba_vnode_check_getextattr(struct ucred *cred, struct vnode *vp,
2778     struct label *vplabel, int attrnamespace, const char *name,
2779     struct uio *uio)
2780 {
2781 	struct mac_biba *subj, *obj;
2782 
2783 	if (!biba_enabled)
2784 		return (0);
2785 
2786 	subj = SLOT(cred->cr_label);
2787 	obj = SLOT(vplabel);
2788 
2789 	if (!biba_dominate_effective(obj, subj))
2790 		return (EACCES);
2791 
2792 	return (0);
2793 }
2794 
2795 static int
2796 biba_vnode_check_link(struct ucred *cred, struct vnode *dvp,
2797     struct label *dvplabel, struct vnode *vp, struct label *vplabel,
2798     struct componentname *cnp)
2799 {
2800 	struct mac_biba *subj, *obj;
2801 
2802 	if (!biba_enabled)
2803 		return (0);
2804 
2805 	subj = SLOT(cred->cr_label);
2806 	obj = SLOT(dvplabel);
2807 
2808 	if (!biba_dominate_effective(subj, obj))
2809 		return (EACCES);
2810 
2811 	obj = SLOT(vplabel);
2812 
2813 	if (!biba_dominate_effective(subj, obj))
2814 		return (EACCES);
2815 
2816 	return (0);
2817 }
2818 
2819 static int
2820 biba_vnode_check_listextattr(struct ucred *cred, struct vnode *vp,
2821     struct label *vplabel, int attrnamespace)
2822 {
2823 	struct mac_biba *subj, *obj;
2824 
2825 	if (!biba_enabled)
2826 		return (0);
2827 
2828 	subj = SLOT(cred->cr_label);
2829 	obj = SLOT(vplabel);
2830 
2831 	if (!biba_dominate_effective(obj, subj))
2832 		return (EACCES);
2833 
2834 	return (0);
2835 }
2836 
2837 static int
2838 biba_vnode_check_lookup(struct ucred *cred, struct vnode *dvp,
2839     struct label *dvplabel, struct componentname *cnp)
2840 {
2841 	struct mac_biba *subj, *obj;
2842 
2843 	if (!biba_enabled)
2844 		return (0);
2845 
2846 	subj = SLOT(cred->cr_label);
2847 	obj = SLOT(dvplabel);
2848 
2849 	if (!biba_dominate_effective(obj, subj))
2850 		return (EACCES);
2851 
2852 	return (0);
2853 }
2854 
2855 static int
2856 biba_vnode_check_mmap(struct ucred *cred, struct vnode *vp,
2857     struct label *vplabel, int prot, int flags)
2858 {
2859 	struct mac_biba *subj, *obj;
2860 
2861 	/*
2862 	 * Rely on the use of open()-time protections to handle
2863 	 * non-revocation cases.
2864 	 */
2865 	if (!biba_enabled || !revocation_enabled)
2866 		return (0);
2867 
2868 	subj = SLOT(cred->cr_label);
2869 	obj = SLOT(vplabel);
2870 
2871 	if (prot & (VM_PROT_READ | VM_PROT_EXECUTE)) {
2872 		if (!biba_dominate_effective(obj, subj))
2873 			return (EACCES);
2874 	}
2875 	if (((prot & VM_PROT_WRITE) != 0) && ((flags & MAP_SHARED) != 0)) {
2876 		if (!biba_dominate_effective(subj, obj))
2877 			return (EACCES);
2878 	}
2879 
2880 	return (0);
2881 }
2882 
2883 static int
2884 biba_vnode_check_open(struct ucred *cred, struct vnode *vp,
2885     struct label *vplabel, int acc_mode)
2886 {
2887 	struct mac_biba *subj, *obj;
2888 
2889 	if (!biba_enabled)
2890 		return (0);
2891 
2892 	subj = SLOT(cred->cr_label);
2893 	obj = SLOT(vplabel);
2894 
2895 	/* XXX privilege override for admin? */
2896 	if (acc_mode & (VREAD | VEXEC | VSTAT)) {
2897 		if (!biba_dominate_effective(obj, subj))
2898 			return (EACCES);
2899 	}
2900 	if (acc_mode & (VWRITE | VAPPEND | VADMIN)) {
2901 		if (!biba_dominate_effective(subj, obj))
2902 			return (EACCES);
2903 	}
2904 
2905 	return (0);
2906 }
2907 
2908 static int
2909 biba_vnode_check_poll(struct ucred *active_cred, struct ucred *file_cred,
2910     struct vnode *vp, struct label *vplabel)
2911 {
2912 	struct mac_biba *subj, *obj;
2913 
2914 	if (!biba_enabled || !revocation_enabled)
2915 		return (0);
2916 
2917 	subj = SLOT(active_cred->cr_label);
2918 	obj = SLOT(vplabel);
2919 
2920 	if (!biba_dominate_effective(obj, subj))
2921 		return (EACCES);
2922 
2923 	return (0);
2924 }
2925 
2926 static int
2927 biba_vnode_check_read(struct ucred *active_cred, struct ucred *file_cred,
2928     struct vnode *vp, struct label *vplabel)
2929 {
2930 	struct mac_biba *subj, *obj;
2931 
2932 	if (!biba_enabled || !revocation_enabled)
2933 		return (0);
2934 
2935 	subj = SLOT(active_cred->cr_label);
2936 	obj = SLOT(vplabel);
2937 
2938 	if (!biba_dominate_effective(obj, subj))
2939 		return (EACCES);
2940 
2941 	return (0);
2942 }
2943 
2944 static int
2945 biba_vnode_check_readdir(struct ucred *cred, struct vnode *dvp,
2946     struct label *dvplabel)
2947 {
2948 	struct mac_biba *subj, *obj;
2949 
2950 	if (!biba_enabled)
2951 		return (0);
2952 
2953 	subj = SLOT(cred->cr_label);
2954 	obj = SLOT(dvplabel);
2955 
2956 	if (!biba_dominate_effective(obj, subj))
2957 		return (EACCES);
2958 
2959 	return (0);
2960 }
2961 
2962 static int
2963 biba_vnode_check_readlink(struct ucred *cred, struct vnode *vp,
2964     struct label *vplabel)
2965 {
2966 	struct mac_biba *subj, *obj;
2967 
2968 	if (!biba_enabled)
2969 		return (0);
2970 
2971 	subj = SLOT(cred->cr_label);
2972 	obj = SLOT(vplabel);
2973 
2974 	if (!biba_dominate_effective(obj, subj))
2975 		return (EACCES);
2976 
2977 	return (0);
2978 }
2979 
2980 static int
2981 biba_vnode_check_relabel(struct ucred *cred, struct vnode *vp,
2982     struct label *vplabel, struct label *newlabel)
2983 {
2984 	struct mac_biba *old, *new, *subj;
2985 	int error;
2986 
2987 	old = SLOT(vplabel);
2988 	new = SLOT(newlabel);
2989 	subj = SLOT(cred->cr_label);
2990 
2991 	/*
2992 	 * If there is a Biba label update for the vnode, it must be a
2993 	 * effective label.
2994 	 */
2995 	error = biba_atmostflags(new, MAC_BIBA_FLAG_EFFECTIVE);
2996 	if (error)
2997 		return (error);
2998 
2999 	/*
3000 	 * To perform a relabel of the vnode (Biba label or not), Biba must
3001 	 * authorize the relabel.
3002 	 */
3003 	if (!biba_effective_in_range(old, subj))
3004 		return (EPERM);
3005 
3006 	/*
3007 	 * If the Biba label is to be changed, authorize as appropriate.
3008 	 */
3009 	if (new->mb_flags & MAC_BIBA_FLAG_EFFECTIVE) {
3010 		/*
3011 		 * To change the Biba label on a vnode, the new vnode label
3012 		 * must be in the subject range.
3013 		 */
3014 		if (!biba_effective_in_range(new, subj))
3015 			return (EPERM);
3016 
3017 		/*
3018 		 * To change the Biba label on the vnode to be EQUAL, the
3019 		 * subject must have appropriate privilege.
3020 		 */
3021 		if (biba_contains_equal(new)) {
3022 			error = biba_subject_privileged(subj);
3023 			if (error)
3024 				return (error);
3025 		}
3026 	}
3027 
3028 	return (0);
3029 }
3030 
3031 static int
3032 biba_vnode_check_rename_from(struct ucred *cred, struct vnode *dvp,
3033     struct label *dvplabel, struct vnode *vp, struct label *vplabel,
3034     struct componentname *cnp)
3035 {
3036 	struct mac_biba *subj, *obj;
3037 
3038 	if (!biba_enabled)
3039 		return (0);
3040 
3041 	subj = SLOT(cred->cr_label);
3042 	obj = SLOT(dvplabel);
3043 
3044 	if (!biba_dominate_effective(subj, obj))
3045 		return (EACCES);
3046 
3047 	obj = SLOT(vplabel);
3048 
3049 	if (!biba_dominate_effective(subj, obj))
3050 		return (EACCES);
3051 
3052 	return (0);
3053 }
3054 
3055 static int
3056 biba_vnode_check_rename_to(struct ucred *cred, struct vnode *dvp,
3057     struct label *dvplabel, struct vnode *vp, struct label *vplabel,
3058     int samedir, struct componentname *cnp)
3059 {
3060 	struct mac_biba *subj, *obj;
3061 
3062 	if (!biba_enabled)
3063 		return (0);
3064 
3065 	subj = SLOT(cred->cr_label);
3066 	obj = SLOT(dvplabel);
3067 
3068 	if (!biba_dominate_effective(subj, obj))
3069 		return (EACCES);
3070 
3071 	if (vp != NULL) {
3072 		obj = SLOT(vplabel);
3073 
3074 		if (!biba_dominate_effective(subj, obj))
3075 			return (EACCES);
3076 	}
3077 
3078 	return (0);
3079 }
3080 
3081 static int
3082 biba_vnode_check_revoke(struct ucred *cred, struct vnode *vp,
3083     struct label *vplabel)
3084 {
3085 	struct mac_biba *subj, *obj;
3086 
3087 	if (!biba_enabled)
3088 		return (0);
3089 
3090 	subj = SLOT(cred->cr_label);
3091 	obj = SLOT(vplabel);
3092 
3093 	if (!biba_dominate_effective(subj, obj))
3094 		return (EACCES);
3095 
3096 	return (0);
3097 }
3098 
3099 static int
3100 biba_vnode_check_setacl(struct ucred *cred, struct vnode *vp,
3101     struct label *vplabel, acl_type_t type, struct acl *acl)
3102 {
3103 	struct mac_biba *subj, *obj;
3104 
3105 	if (!biba_enabled)
3106 		return (0);
3107 
3108 	subj = SLOT(cred->cr_label);
3109 	obj = SLOT(vplabel);
3110 
3111 	if (!biba_dominate_effective(subj, obj))
3112 		return (EACCES);
3113 
3114 	return (0);
3115 }
3116 
3117 static int
3118 biba_vnode_check_setextattr(struct ucred *cred, struct vnode *vp,
3119     struct label *vplabel, int attrnamespace, const char *name,
3120     struct uio *uio)
3121 {
3122 	struct mac_biba *subj, *obj;
3123 
3124 	if (!biba_enabled)
3125 		return (0);
3126 
3127 	subj = SLOT(cred->cr_label);
3128 	obj = SLOT(vplabel);
3129 
3130 	if (!biba_dominate_effective(subj, obj))
3131 		return (EACCES);
3132 
3133 	/* XXX: protect the MAC EA in a special way? */
3134 
3135 	return (0);
3136 }
3137 
3138 static int
3139 biba_vnode_check_setflags(struct ucred *cred, struct vnode *vp,
3140     struct label *vplabel, u_long flags)
3141 {
3142 	struct mac_biba *subj, *obj;
3143 
3144 	if (!biba_enabled)
3145 		return (0);
3146 
3147 	subj = SLOT(cred->cr_label);
3148 	obj = SLOT(vplabel);
3149 
3150 	if (!biba_dominate_effective(subj, obj))
3151 		return (EACCES);
3152 
3153 	return (0);
3154 }
3155 
3156 static int
3157 biba_vnode_check_setmode(struct ucred *cred, struct vnode *vp,
3158     struct label *vplabel, mode_t mode)
3159 {
3160 	struct mac_biba *subj, *obj;
3161 
3162 	if (!biba_enabled)
3163 		return (0);
3164 
3165 	subj = SLOT(cred->cr_label);
3166 	obj = SLOT(vplabel);
3167 
3168 	if (!biba_dominate_effective(subj, obj))
3169 		return (EACCES);
3170 
3171 	return (0);
3172 }
3173 
3174 static int
3175 biba_vnode_check_setowner(struct ucred *cred, struct vnode *vp,
3176     struct label *vplabel, uid_t uid, gid_t gid)
3177 {
3178 	struct mac_biba *subj, *obj;
3179 
3180 	if (!biba_enabled)
3181 		return (0);
3182 
3183 	subj = SLOT(cred->cr_label);
3184 	obj = SLOT(vplabel);
3185 
3186 	if (!biba_dominate_effective(subj, obj))
3187 		return (EACCES);
3188 
3189 	return (0);
3190 }
3191 
3192 static int
3193 biba_vnode_check_setutimes(struct ucred *cred, struct vnode *vp,
3194     struct label *vplabel, struct timespec atime, struct timespec mtime)
3195 {
3196 	struct mac_biba *subj, *obj;
3197 
3198 	if (!biba_enabled)
3199 		return (0);
3200 
3201 	subj = SLOT(cred->cr_label);
3202 	obj = SLOT(vplabel);
3203 
3204 	if (!biba_dominate_effective(subj, obj))
3205 		return (EACCES);
3206 
3207 	return (0);
3208 }
3209 
3210 static int
3211 biba_vnode_check_stat(struct ucred *active_cred, struct ucred *file_cred,
3212     struct vnode *vp, struct label *vplabel)
3213 {
3214 	struct mac_biba *subj, *obj;
3215 
3216 	if (!biba_enabled)
3217 		return (0);
3218 
3219 	subj = SLOT(active_cred->cr_label);
3220 	obj = SLOT(vplabel);
3221 
3222 	if (!biba_dominate_effective(obj, subj))
3223 		return (EACCES);
3224 
3225 	return (0);
3226 }
3227 
3228 static int
3229 biba_vnode_check_unlink(struct ucred *cred, struct vnode *dvp,
3230     struct label *dvplabel, struct vnode *vp, struct label *vplabel,
3231     struct componentname *cnp)
3232 {
3233 	struct mac_biba *subj, *obj;
3234 
3235 	if (!biba_enabled)
3236 		return (0);
3237 
3238 	subj = SLOT(cred->cr_label);
3239 	obj = SLOT(dvplabel);
3240 
3241 	if (!biba_dominate_effective(subj, obj))
3242 		return (EACCES);
3243 
3244 	obj = SLOT(vplabel);
3245 
3246 	if (!biba_dominate_effective(subj, obj))
3247 		return (EACCES);
3248 
3249 	return (0);
3250 }
3251 
3252 static int
3253 biba_vnode_check_write(struct ucred *active_cred,
3254     struct ucred *file_cred, struct vnode *vp, struct label *vplabel)
3255 {
3256 	struct mac_biba *subj, *obj;
3257 
3258 	if (!biba_enabled || !revocation_enabled)
3259 		return (0);
3260 
3261 	subj = SLOT(active_cred->cr_label);
3262 	obj = SLOT(vplabel);
3263 
3264 	if (!biba_dominate_effective(subj, obj))
3265 		return (EACCES);
3266 
3267 	return (0);
3268 }
3269 
3270 static int
3271 biba_vnode_create_extattr(struct ucred *cred, struct mount *mp,
3272     struct label *mplabel, struct vnode *dvp, struct label *dvplabel,
3273     struct vnode *vp, struct label *vplabel, struct componentname *cnp)
3274 {
3275 	struct mac_biba *source, *dest, mb_temp;
3276 	size_t buflen;
3277 	int error;
3278 
3279 	buflen = sizeof(mb_temp);
3280 	bzero(&mb_temp, buflen);
3281 
3282 	source = SLOT(cred->cr_label);
3283 	dest = SLOT(vplabel);
3284 	biba_copy_effective(source, &mb_temp);
3285 
3286 	error = vn_extattr_set(vp, IO_NODELOCKED, MAC_BIBA_EXTATTR_NAMESPACE,
3287 	    MAC_BIBA_EXTATTR_NAME, buflen, (char *) &mb_temp, curthread);
3288 	if (error == 0)
3289 		biba_copy_effective(source, dest);
3290 	return (error);
3291 }
3292 
3293 static void
3294 biba_vnode_relabel(struct ucred *cred, struct vnode *vp,
3295     struct label *vplabel, struct label *newlabel)
3296 {
3297 	struct mac_biba *source, *dest;
3298 
3299 	source = SLOT(newlabel);
3300 	dest = SLOT(vplabel);
3301 
3302 	biba_copy(source, dest);
3303 }
3304 
3305 static int
3306 biba_vnode_setlabel_extattr(struct ucred *cred, struct vnode *vp,
3307     struct label *vplabel, struct label *intlabel)
3308 {
3309 	struct mac_biba *source, mb_temp;
3310 	size_t buflen;
3311 	int error;
3312 
3313 	buflen = sizeof(mb_temp);
3314 	bzero(&mb_temp, buflen);
3315 
3316 	source = SLOT(intlabel);
3317 	if ((source->mb_flags & MAC_BIBA_FLAG_EFFECTIVE) == 0)
3318 		return (0);
3319 
3320 	biba_copy_effective(source, &mb_temp);
3321 
3322 	error = vn_extattr_set(vp, IO_NODELOCKED, MAC_BIBA_EXTATTR_NAMESPACE,
3323 	    MAC_BIBA_EXTATTR_NAME, buflen, (char *) &mb_temp, curthread);
3324 	return (error);
3325 }
3326 
3327 static struct mac_policy_ops mac_biba_ops =
3328 {
3329 	.mpo_init = biba_init,
3330 
3331 	.mpo_bpfdesc_check_receive = biba_bpfdesc_check_receive,
3332 	.mpo_bpfdesc_create = biba_bpfdesc_create,
3333 	.mpo_bpfdesc_create_mbuf = biba_bpfdesc_create_mbuf,
3334 	.mpo_bpfdesc_destroy_label = biba_destroy_label,
3335 	.mpo_bpfdesc_init_label = biba_init_label,
3336 
3337 	.mpo_cred_check_relabel = biba_cred_check_relabel,
3338 	.mpo_cred_check_visible = biba_cred_check_visible,
3339 	.mpo_cred_copy_label = biba_copy_label,
3340 	.mpo_cred_destroy_label = biba_destroy_label,
3341 	.mpo_cred_externalize_label = biba_externalize_label,
3342 	.mpo_cred_init_label = biba_init_label,
3343 	.mpo_cred_internalize_label = biba_internalize_label,
3344 	.mpo_cred_relabel = biba_cred_relabel,
3345 
3346 	.mpo_devfs_create_device = biba_devfs_create_device,
3347 	.mpo_devfs_create_directory = biba_devfs_create_directory,
3348 	.mpo_devfs_create_symlink = biba_devfs_create_symlink,
3349 	.mpo_devfs_destroy_label = biba_destroy_label,
3350 	.mpo_devfs_init_label = biba_init_label,
3351 	.mpo_devfs_update = biba_devfs_update,
3352 	.mpo_devfs_vnode_associate = biba_devfs_vnode_associate,
3353 
3354 	.mpo_ifnet_check_relabel = biba_ifnet_check_relabel,
3355 	.mpo_ifnet_check_transmit = biba_ifnet_check_transmit,
3356 	.mpo_ifnet_copy_label = biba_copy_label,
3357 	.mpo_ifnet_create = biba_ifnet_create,
3358 	.mpo_ifnet_create_mbuf = biba_ifnet_create_mbuf,
3359 	.mpo_ifnet_destroy_label = biba_destroy_label,
3360 	.mpo_ifnet_externalize_label = biba_externalize_label,
3361 	.mpo_ifnet_init_label = biba_init_label,
3362 	.mpo_ifnet_internalize_label = biba_internalize_label,
3363 	.mpo_ifnet_relabel = biba_ifnet_relabel,
3364 
3365 	.mpo_inpcb_check_deliver = biba_inpcb_check_deliver,
3366 	.mpo_inpcb_check_visible = biba_inpcb_check_visible,
3367 	.mpo_inpcb_create = biba_inpcb_create,
3368 	.mpo_inpcb_create_mbuf = biba_inpcb_create_mbuf,
3369 	.mpo_inpcb_destroy_label = biba_destroy_label,
3370 	.mpo_inpcb_init_label = biba_init_label_waitcheck,
3371 	.mpo_inpcb_sosetlabel = biba_inpcb_sosetlabel,
3372 
3373 	.mpo_ip6q_create = biba_ip6q_create,
3374 	.mpo_ip6q_destroy_label = biba_destroy_label,
3375 	.mpo_ip6q_init_label = biba_init_label_waitcheck,
3376 	.mpo_ip6q_match = biba_ip6q_match,
3377 	.mpo_ip6q_reassemble = biba_ip6q_reassemble,
3378 	.mpo_ip6q_update = biba_ip6q_update,
3379 
3380 	.mpo_ipq_create = biba_ipq_create,
3381 	.mpo_ipq_destroy_label = biba_destroy_label,
3382 	.mpo_ipq_init_label = biba_init_label_waitcheck,
3383 	.mpo_ipq_match = biba_ipq_match,
3384 	.mpo_ipq_reassemble = biba_ipq_reassemble,
3385 	.mpo_ipq_update = biba_ipq_update,
3386 
3387 	.mpo_kld_check_load = biba_kld_check_load,
3388 
3389 	.mpo_mbuf_copy_label = biba_copy_label,
3390 	.mpo_mbuf_destroy_label = biba_destroy_label,
3391 	.mpo_mbuf_init_label = biba_init_label_waitcheck,
3392 
3393 	.mpo_mount_check_stat = biba_mount_check_stat,
3394 	.mpo_mount_create = biba_mount_create,
3395 	.mpo_mount_destroy_label = biba_destroy_label,
3396 	.mpo_mount_init_label = biba_init_label,
3397 
3398 	.mpo_netatalk_aarp_send = biba_netatalk_aarp_send,
3399 
3400 	.mpo_netinet_arp_send = biba_netinet_arp_send,
3401 	.mpo_netinet_firewall_reply = biba_netinet_firewall_reply,
3402 	.mpo_netinet_firewall_send = biba_netinet_firewall_send,
3403 	.mpo_netinet_fragment = biba_netinet_fragment,
3404 	.mpo_netinet_icmp_reply = biba_netinet_icmp_reply,
3405 	.mpo_netinet_igmp_send = biba_netinet_igmp_send,
3406 
3407 	.mpo_netinet6_nd6_send = biba_netinet6_nd6_send,
3408 
3409 	.mpo_pipe_check_ioctl = biba_pipe_check_ioctl,
3410 	.mpo_pipe_check_poll = biba_pipe_check_poll,
3411 	.mpo_pipe_check_read = biba_pipe_check_read,
3412 	.mpo_pipe_check_relabel = biba_pipe_check_relabel,
3413 	.mpo_pipe_check_stat = biba_pipe_check_stat,
3414 	.mpo_pipe_check_write = biba_pipe_check_write,
3415 	.mpo_pipe_copy_label = biba_copy_label,
3416 	.mpo_pipe_create = biba_pipe_create,
3417 	.mpo_pipe_destroy_label = biba_destroy_label,
3418 	.mpo_pipe_externalize_label = biba_externalize_label,
3419 	.mpo_pipe_init_label = biba_init_label,
3420 	.mpo_pipe_internalize_label = biba_internalize_label,
3421 	.mpo_pipe_relabel = biba_pipe_relabel,
3422 
3423 	.mpo_posixsem_check_getvalue = biba_posixsem_check_rdonly,
3424 	.mpo_posixsem_check_open = biba_posixsem_check_openunlink,
3425 	.mpo_posixsem_check_post = biba_posixsem_check_write,
3426 	.mpo_posixsem_check_stat = biba_posixsem_check_rdonly,
3427 	.mpo_posixsem_check_unlink = biba_posixsem_check_openunlink,
3428 	.mpo_posixsem_check_wait = biba_posixsem_check_write,
3429 	.mpo_posixsem_create = biba_posixsem_create,
3430 	.mpo_posixsem_destroy_label = biba_destroy_label,
3431 	.mpo_posixsem_init_label = biba_init_label,
3432 
3433 	.mpo_priv_check = biba_priv_check,
3434 
3435 	.mpo_proc_associate_nfsd = biba_proc_associate_nfsd,
3436 	.mpo_proc_check_debug = biba_proc_check_debug,
3437 	.mpo_proc_check_sched = biba_proc_check_sched,
3438 	.mpo_proc_check_signal = biba_proc_check_signal,
3439 	.mpo_proc_create_init = biba_proc_create_init,
3440 	.mpo_proc_create_swapper = biba_proc_create_swapper,
3441 
3442 	.mpo_socket_check_deliver = biba_socket_check_deliver,
3443 	.mpo_socket_check_relabel = biba_socket_check_relabel,
3444 	.mpo_socket_check_visible = biba_socket_check_visible,
3445 	.mpo_socket_copy_label = biba_copy_label,
3446 	.mpo_socket_create = biba_socket_create,
3447 	.mpo_socket_create_mbuf = biba_socket_create_mbuf,
3448 	.mpo_socket_destroy_label = biba_destroy_label,
3449 	.mpo_socket_externalize_label = biba_externalize_label,
3450 	.mpo_socket_init_label = biba_init_label_waitcheck,
3451 	.mpo_socket_internalize_label = biba_internalize_label,
3452 	.mpo_socket_newconn = biba_socket_newconn,
3453 	.mpo_socket_relabel = biba_socket_relabel,
3454 
3455 	.mpo_socketpeer_destroy_label = biba_destroy_label,
3456 	.mpo_socketpeer_externalize_label = biba_externalize_label,
3457 	.mpo_socketpeer_init_label = biba_init_label_waitcheck,
3458 	.mpo_socketpeer_set_from_mbuf = biba_socketpeer_set_from_mbuf,
3459 	.mpo_socketpeer_set_from_socket = biba_socketpeer_set_from_socket,
3460 
3461 	.mpo_syncache_create = biba_syncache_create,
3462 	.mpo_syncache_create_mbuf = biba_syncache_create_mbuf,
3463 	.mpo_syncache_destroy_label = biba_destroy_label,
3464 	.mpo_syncache_init_label = biba_init_label_waitcheck,
3465 
3466 	.mpo_system_check_acct = biba_system_check_acct,
3467 	.mpo_system_check_auditctl = biba_system_check_auditctl,
3468 	.mpo_system_check_auditon = biba_system_check_auditon,
3469 	.mpo_system_check_swapoff = biba_system_check_swapoff,
3470 	.mpo_system_check_swapon = biba_system_check_swapon,
3471 	.mpo_system_check_sysctl = biba_system_check_sysctl,
3472 
3473 	.mpo_sysvmsg_cleanup = biba_sysvmsg_cleanup,
3474 	.mpo_sysvmsg_create = biba_sysvmsg_create,
3475 	.mpo_sysvmsg_destroy_label = biba_destroy_label,
3476 	.mpo_sysvmsg_init_label = biba_init_label,
3477 
3478 	.mpo_sysvmsq_check_msgrcv = biba_sysvmsq_check_msgrcv,
3479 	.mpo_sysvmsq_check_msgrmid = biba_sysvmsq_check_msgrmid,
3480 	.mpo_sysvmsq_check_msqget = biba_sysvmsq_check_msqget,
3481 	.mpo_sysvmsq_check_msqsnd = biba_sysvmsq_check_msqsnd,
3482 	.mpo_sysvmsq_check_msqrcv = biba_sysvmsq_check_msqrcv,
3483 	.mpo_sysvmsq_check_msqctl = biba_sysvmsq_check_msqctl,
3484 	.mpo_sysvmsq_cleanup = biba_sysvmsq_cleanup,
3485 	.mpo_sysvmsq_create = biba_sysvmsq_create,
3486 	.mpo_sysvmsq_destroy_label = biba_destroy_label,
3487 	.mpo_sysvmsq_init_label = biba_init_label,
3488 
3489 	.mpo_sysvsem_check_semctl = biba_sysvsem_check_semctl,
3490 	.mpo_sysvsem_check_semget = biba_sysvsem_check_semget,
3491 	.mpo_sysvsem_check_semop = biba_sysvsem_check_semop,
3492 	.mpo_sysvsem_cleanup = biba_sysvsem_cleanup,
3493 	.mpo_sysvsem_create = biba_sysvsem_create,
3494 	.mpo_sysvsem_destroy_label = biba_destroy_label,
3495 	.mpo_sysvsem_init_label = biba_init_label,
3496 
3497 	.mpo_sysvshm_check_shmat = biba_sysvshm_check_shmat,
3498 	.mpo_sysvshm_check_shmctl = biba_sysvshm_check_shmctl,
3499 	.mpo_sysvshm_check_shmget = biba_sysvshm_check_shmget,
3500 	.mpo_sysvshm_cleanup = biba_sysvshm_cleanup,
3501 	.mpo_sysvshm_create = biba_sysvshm_create,
3502 	.mpo_sysvshm_destroy_label = biba_destroy_label,
3503 	.mpo_sysvshm_init_label = biba_init_label,
3504 
3505 	.mpo_vnode_associate_extattr = biba_vnode_associate_extattr,
3506 	.mpo_vnode_associate_singlelabel = biba_vnode_associate_singlelabel,
3507 	.mpo_vnode_check_access = biba_vnode_check_open,
3508 	.mpo_vnode_check_chdir = biba_vnode_check_chdir,
3509 	.mpo_vnode_check_chroot = biba_vnode_check_chroot,
3510 	.mpo_vnode_check_create = biba_vnode_check_create,
3511 	.mpo_vnode_check_deleteacl = biba_vnode_check_deleteacl,
3512 	.mpo_vnode_check_deleteextattr = biba_vnode_check_deleteextattr,
3513 	.mpo_vnode_check_exec = biba_vnode_check_exec,
3514 	.mpo_vnode_check_getacl = biba_vnode_check_getacl,
3515 	.mpo_vnode_check_getextattr = biba_vnode_check_getextattr,
3516 	.mpo_vnode_check_link = biba_vnode_check_link,
3517 	.mpo_vnode_check_listextattr = biba_vnode_check_listextattr,
3518 	.mpo_vnode_check_lookup = biba_vnode_check_lookup,
3519 	.mpo_vnode_check_mmap = biba_vnode_check_mmap,
3520 	.mpo_vnode_check_open = biba_vnode_check_open,
3521 	.mpo_vnode_check_poll = biba_vnode_check_poll,
3522 	.mpo_vnode_check_read = biba_vnode_check_read,
3523 	.mpo_vnode_check_readdir = biba_vnode_check_readdir,
3524 	.mpo_vnode_check_readlink = biba_vnode_check_readlink,
3525 	.mpo_vnode_check_relabel = biba_vnode_check_relabel,
3526 	.mpo_vnode_check_rename_from = biba_vnode_check_rename_from,
3527 	.mpo_vnode_check_rename_to = biba_vnode_check_rename_to,
3528 	.mpo_vnode_check_revoke = biba_vnode_check_revoke,
3529 	.mpo_vnode_check_setacl = biba_vnode_check_setacl,
3530 	.mpo_vnode_check_setextattr = biba_vnode_check_setextattr,
3531 	.mpo_vnode_check_setflags = biba_vnode_check_setflags,
3532 	.mpo_vnode_check_setmode = biba_vnode_check_setmode,
3533 	.mpo_vnode_check_setowner = biba_vnode_check_setowner,
3534 	.mpo_vnode_check_setutimes = biba_vnode_check_setutimes,
3535 	.mpo_vnode_check_stat = biba_vnode_check_stat,
3536 	.mpo_vnode_check_unlink = biba_vnode_check_unlink,
3537 	.mpo_vnode_check_write = biba_vnode_check_write,
3538 	.mpo_vnode_create_extattr = biba_vnode_create_extattr,
3539 	.mpo_vnode_copy_label = biba_copy_label,
3540 	.mpo_vnode_destroy_label = biba_destroy_label,
3541 	.mpo_vnode_externalize_label = biba_externalize_label,
3542 	.mpo_vnode_init_label = biba_init_label,
3543 	.mpo_vnode_internalize_label = biba_internalize_label,
3544 	.mpo_vnode_relabel = biba_vnode_relabel,
3545 	.mpo_vnode_setlabel_extattr = biba_vnode_setlabel_extattr,
3546 };
3547 
3548 #define	BIBA_OBJECTS	(MPC_OBJECT_CRED |				\
3549 			 /* MPC_OBJECT_PROC | */			\
3550 			 MPC_OBJECT_VNODE |				\
3551 			 MPC_OBJECT_INPCB |				\
3552 			 MPC_OBJECT_SOCKET |				\
3553 			 MPC_OBJECT_DEVFS |				\
3554 			 MPC_OBJECT_MBUF |				\
3555 			 MPC_OBJECT_IPQ |				\
3556 			 MPC_OBJECT_IFNET |				\
3557 			 MPC_OBJECT_BPFDESC |				\
3558 			 MPC_OBJECT_PIPE |				\
3559 			 MPC_OBJECT_MOUNT |				\
3560 			 MPC_OBJECT_POSIXSEM |				\
3561 			 /* MPC_OBJECT_POSIXSHM | */			\
3562 			 MPC_OBJECT_SYSVMSG |				\
3563 			 MPC_OBJECT_SYSVMSQ |				\
3564 			 MPC_OBJECT_SYSVSEM |				\
3565 			 MPC_OBJECT_SYSVSHM |				\
3566 			 MPC_OBJECT_SYNCACHE)
3567 
3568 MAC_POLICY_SET(&mac_biba_ops, mac_biba, "TrustedBSD MAC/Biba",
3569     MPC_LOADTIME_FLAG_NOTLATE, &biba_slot, BIBA_OBJECTS);
3570