xref: /freebsd/sys/security/mac_bsdextended/mac_bsdextended.c (revision aa2676824259ce13b07efad397ea379e45fd0cf6)
1 /*-
2  * Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson
3  * Copyright (c) 2001, 2002 Networks Associates Technology, Inc.
4  * All rights reserved.
5  *
6  * This software was developed by Robert Watson for the TrustedBSD Project.
7  *
8  * This software was developed for the FreeBSD Project in part by Network
9  * Associates Laboratories, the Security Research Division of Network
10  * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"),
11  * as part of the DARPA CHATS research program.
12  *
13  * Redistribution and use in source and binary forms, with or without
14  * modification, are permitted provided that the following conditions
15  * are met:
16  * 1. Redistributions of source code must retain the above copyright
17  *    notice, this list of conditions and the following disclaimer.
18  * 2. Redistributions in binary form must reproduce the above copyright
19  *    notice, this list of conditions and the following disclaimer in the
20  *    documentation and/or other materials provided with the distribution.
21  *
22  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
26  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32  * SUCH DAMAGE.
33  *
34  * $FreeBSD$
35  */
36 /*
37  * Developed by the TrustedBSD Project.
38  * "BSD Extended" MAC policy, allowing the administrator to impose
39  * mandatory rules regarding users and some system objects.
40  *
41  * XXX: Much locking support required here.
42  */
43 
44 #include <sys/types.h>
45 #include <sys/param.h>
46 #include <sys/acl.h>
47 #include <sys/conf.h>
48 #include <sys/kernel.h>
49 #include <sys/mac.h>
50 #include <sys/malloc.h>
51 #include <sys/mount.h>
52 #include <sys/proc.h>
53 #include <sys/systm.h>
54 #include <sys/sysproto.h>
55 #include <sys/sysent.h>
56 #include <sys/vnode.h>
57 #include <sys/file.h>
58 #include <sys/socket.h>
59 #include <sys/socketvar.h>
60 #include <sys/sysctl.h>
61 
62 #include <net/bpfdesc.h>
63 #include <net/if.h>
64 #include <net/if_types.h>
65 #include <net/if_var.h>
66 
67 #include <vm/vm.h>
68 
69 #include <sys/mac_policy.h>
70 
71 #include <security/mac_bsdextended/mac_bsdextended.h>
72 
73 SYSCTL_DECL(_security_mac);
74 
75 SYSCTL_NODE(_security_mac, OID_AUTO, bsdextended, CTLFLAG_RW, 0,
76     "TrustedBSD extended BSD MAC policy controls");
77 
78 static int	mac_bsdextended_enabled = 1;
79 SYSCTL_INT(_security_mac_bsdextended, OID_AUTO, enabled, CTLFLAG_RW,
80     &mac_bsdextended_enabled, 0, "Enforce extended BSD policy");
81 TUNABLE_INT("security.mac.bsdextended.enabled", &mac_bsdextended_enabled);
82 
83 MALLOC_DEFINE(M_MACBSDEXTENDED, "mac_bsdextended", "BSD Extended MAC rule");
84 
85 #define	MAC_BSDEXTENDED_MAXRULES	250
86 static struct mac_bsdextended_rule *rules[MAC_BSDEXTENDED_MAXRULES];
87 static int rule_count = 0;
88 static int rule_slots = 0;
89 
90 SYSCTL_INT(_security_mac_bsdextended, OID_AUTO, rule_count, CTLFLAG_RD,
91     &rule_count, 0, "Number of defined rules\n");
92 SYSCTL_INT(_security_mac_bsdextended, OID_AUTO, rule_slots, CTLFLAG_RD,
93     &rule_slots, 0, "Number of used rule slots\n");
94 
95 static int mac_bsdextended_debugging;
96 SYSCTL_INT(_security_mac_bsdextended, OID_AUTO, debugging, CTLFLAG_RW,
97     &mac_bsdextended_debugging, 0, "Enable debugging on failure");
98 
99 static int
100 mac_bsdextended_rule_valid(struct mac_bsdextended_rule *rule)
101 {
102 
103 	if ((rule->mbr_subject.mbi_flags | MBI_BITS) != MBI_BITS)
104 		return (EINVAL);
105 
106 	if ((rule->mbr_object.mbi_flags | MBI_BITS) != MBI_BITS)
107 		return (EINVAL);
108 
109 	if ((rule->mbr_mode | VALLPERM) != VALLPERM)
110 		return (EINVAL);
111 
112 	return (0);
113 }
114 
115 static int
116 sysctl_rule(SYSCTL_HANDLER_ARGS)
117 {
118 	struct mac_bsdextended_rule temprule, *ruleptr;
119 	u_int namelen;
120 	int error, index, *name;
121 
122 	name = (int *)arg1;
123 	namelen = arg2;
124 
125 	/* printf("bsdextended sysctl handler (namelen %d)\n", namelen); */
126 
127 	if (namelen != 1)
128 		return (EINVAL);
129 
130 	index = name[0];
131 	if (index < 0 || index > rule_slots + 1)
132 		return (ENOENT);
133 	if (rule_slots >= MAC_BSDEXTENDED_MAXRULES)
134 		return (ENOENT);
135 
136 	if (req->oldptr) {
137 		if (rules[index] == NULL)
138 			return (ENOENT);
139 
140 		error = SYSCTL_OUT(req, rules[index], sizeof(*rules[index]));
141 		if (error)
142 			return (error);
143 	}
144 
145 	if (req->newptr) {
146 		if (req->newlen == 0) {
147 			/* printf("deletion\n"); */
148 			ruleptr = rules[index];
149 			if (ruleptr == NULL)
150 				return (ENOENT);
151 			rule_count--;
152 			rules[index] = NULL;
153 			FREE(ruleptr, M_MACBSDEXTENDED);
154 			return(0);
155 		}
156 		error = SYSCTL_IN(req, &temprule, sizeof(temprule));
157 		if (error)
158 			return (error);
159 
160 		error = mac_bsdextended_rule_valid(&temprule);
161 		if (error)
162 			return (error);
163 
164 		if (rules[index] == NULL) {
165 			/* printf("addition\n"); */
166 			MALLOC(ruleptr, struct mac_bsdextended_rule *,
167 			    sizeof(*ruleptr), M_MACBSDEXTENDED, M_WAITOK |
168 			    M_ZERO);
169 			*ruleptr = temprule;
170 			rules[index] = ruleptr;
171 			if (index+1 > rule_slots)
172 				rule_slots = index+1;
173 			rule_count++;
174 		} else {
175 			/* printf("replacement\n"); */
176 			*rules[index] = temprule;
177 		}
178 	}
179 
180 	return (0);
181 }
182 
183 SYSCTL_NODE(_security_mac_bsdextended, OID_AUTO, rules,
184     CTLFLAG_RW, sysctl_rule, "BSD extended MAC rules");
185 
186 static void
187 mac_bsdextended_init(struct mac_policy_conf *mpc)
188 {
189 
190 	/* Initialize ruleset lock. */
191 	/* Register dynamic sysctl's for rules. */
192 }
193 
194 static void
195 mac_bsdextended_destroy(struct mac_policy_conf *mpc)
196 {
197 
198 	/* Tear down sysctls. */
199 	/* Destroy ruleset lock. */
200 }
201 
202 static int
203 mac_bsdextended_rulecheck(struct mac_bsdextended_rule *rule,
204     struct ucred *cred, uid_t object_uid, gid_t object_gid, int acc_mode)
205 {
206 	int match;
207 
208 	/*
209 	 * Is there a subject match?
210 	 */
211 	if (rule->mbr_subject.mbi_flags & MBI_UID_DEFINED) {
212 		match =  (rule->mbr_subject.mbi_uid == cred->cr_uid ||
213 		    rule->mbr_subject.mbi_uid == cred->cr_ruid ||
214 		    rule->mbr_subject.mbi_uid == cred->cr_svuid);
215 
216 		if (rule->mbr_subject.mbi_flags & MBI_NEGATED)
217 			match = !match;
218 
219 		if (!match)
220 			return (0);
221 	}
222 
223 	if (rule->mbr_subject.mbi_flags & MBI_GID_DEFINED) {
224 		match = (groupmember(rule->mbr_subject.mbi_gid, cred) ||
225 		    rule->mbr_subject.mbi_gid == cred->cr_rgid ||
226 		    rule->mbr_subject.mbi_gid == cred->cr_svgid);
227 
228 		if (rule->mbr_subject.mbi_flags & MBI_NEGATED)
229 			match = !match;
230 
231 		if (!match)
232 			return (0);
233 	}
234 
235 	/*
236 	 * Is there an object match?
237 	 */
238 	if (rule->mbr_object.mbi_flags & MBI_UID_DEFINED) {
239 		match = (rule->mbr_object.mbi_uid == object_uid);
240 
241 		if (rule->mbr_object.mbi_flags & MBI_NEGATED)
242 			match = !match;
243 
244 		if (!match)
245 			return (0);
246 	}
247 
248 	if (rule->mbr_object.mbi_flags & MBI_GID_DEFINED) {
249 		match = (rule->mbr_object.mbi_gid == object_gid);
250 
251 		if (rule->mbr_object.mbi_flags & MBI_NEGATED)
252 			match = !match;
253 
254 		if (!match)
255 			return (0);
256 	}
257 
258 	/*
259 	 * Is the access permitted?
260 	 */
261 	if ((rule->mbr_mode & acc_mode) != acc_mode) {
262 		if (mac_bsdextended_debugging)
263 			printf("mac_bsdextended: %d:%d request %d on %d:%d"
264 			    " fails\n", cred->cr_ruid, cred->cr_rgid,
265 			    acc_mode, object_uid, object_gid);
266 		return (EACCES);
267 	}
268 
269 	return (0);
270 }
271 
272 static int
273 mac_bsdextended_check(struct ucred *cred, uid_t object_uid, gid_t object_gid,
274     int acc_mode)
275 {
276 	int error, i;
277 
278 	for (i = 0; i < rule_slots; i++) {
279 		if (rules[i] == NULL)
280 			continue;
281 
282 		error = mac_bsdextended_rulecheck(rules[i], cred, object_uid,
283 		    object_gid, acc_mode);
284 		if (error)
285 			return (error);
286 	}
287 
288 	return (0);
289 }
290 
291 static int
292 mac_bsdextended_check_vnode_access(struct ucred *cred, struct vnode *vp,
293     struct label *label, int acc_mode)
294 {
295 	struct vattr vap;
296 	int error;
297 
298 	if (!mac_bsdextended_enabled)
299 		return (0);
300 
301 	error = VOP_GETATTR(vp, &vap, cred, curthread);
302 	if (error)
303 		return (error);
304 	return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, acc_mode));
305 }
306 
307 static int
308 mac_bsdextended_check_vnode_chdir(struct ucred *cred, struct vnode *dvp,
309     struct label *dlabel)
310 {
311 	struct vattr vap;
312 	int error;
313 
314 	if (!mac_bsdextended_enabled)
315 		return (0);
316 
317 	error = VOP_GETATTR(dvp, &vap, cred, curthread);
318 	if (error)
319 		return (error);
320 	return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VEXEC));
321 }
322 
323 static int
324 mac_bsdextended_check_vnode_chroot(struct ucred *cred, struct vnode *dvp,
325     struct label *dlabel)
326 {
327 	struct vattr vap;
328 	int error;
329 
330 	if (!mac_bsdextended_enabled)
331 		return (0);
332 
333 	error = VOP_GETATTR(dvp, &vap, cred, curthread);
334 	if (error)
335 		return (error);
336 	return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VEXEC));
337 }
338 
339 static int
340 mac_bsdextended_check_create_vnode(struct ucred *cred, struct vnode *dvp,
341     struct label *dlabel, struct componentname *cnp, struct vattr *vap)
342 {
343 	struct vattr dvap;
344 	int error;
345 
346 	if (!mac_bsdextended_enabled)
347 		return (0);
348 
349 	error = VOP_GETATTR(dvp, &dvap, cred, curthread);
350 	if (error)
351 		return (error);
352 	return (mac_bsdextended_check(cred, dvap.va_uid, dvap.va_gid, VWRITE));
353 }
354 
355 static int
356 mac_bsdextended_check_vnode_delete(struct ucred *cred, struct vnode *dvp,
357     struct label *dlabel, struct vnode *vp, struct label *label,
358     struct componentname *cnp)
359 {
360 	struct vattr vap;
361 	int error;
362 
363 	if (!mac_bsdextended_enabled)
364 		return (0);
365 
366 	error = VOP_GETATTR(dvp, &vap, cred, curthread);
367 	if (error)
368 		return (error);
369 	error = mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VWRITE);
370 	if (error)
371 		return (error);
372 
373 	error = VOP_GETATTR(vp, &vap, cred, curthread);
374 	if (error)
375 		return (error);
376 	return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VWRITE));
377 }
378 
379 static int
380 mac_bsdextended_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp,
381     struct label *label, acl_type_t type)
382 {
383 	struct vattr vap;
384 	int error;
385 
386 	if (!mac_bsdextended_enabled)
387 		return (0);
388 
389 	error = VOP_GETATTR(vp, &vap, cred, curthread);
390 	if (error)
391 		return (error);
392 	return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VADMIN));
393 }
394 
395 static int
396 mac_bsdextended_check_vnode_exec(struct ucred *cred, struct vnode *vp,
397     struct label *label, struct image_params *imgp,
398     struct label *execlabel)
399 {
400 	struct vattr vap;
401 	int error;
402 
403 	if (!mac_bsdextended_enabled)
404 		return (0);
405 
406 	error = VOP_GETATTR(vp, &vap, cred, curthread);
407 	if (error)
408 		return (error);
409 	return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid,
410 	    VREAD|VEXEC));
411 }
412 
413 static int
414 mac_bsdextended_check_vnode_getacl(struct ucred *cred, struct vnode *vp,
415     struct label *label, acl_type_t type)
416 {
417 	struct vattr vap;
418 	int error;
419 
420 	if (!mac_bsdextended_enabled)
421 		return (0);
422 
423 	error = VOP_GETATTR(vp, &vap, cred, curthread);
424 	if (error)
425 		return (error);
426 	return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VSTAT));
427 }
428 
429 static int
430 mac_bsdextended_check_vnode_getextattr(struct ucred *cred, struct vnode *vp,
431     struct label *label, int attrnamespace, const char *name, struct uio *uio)
432 {
433 	struct vattr vap;
434 	int error;
435 
436 	if (!mac_bsdextended_enabled)
437 		return (0);
438 
439 	error = VOP_GETATTR(vp, &vap, cred, curthread);
440 	if (error)
441 		return (error);
442 	return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VREAD));
443 }
444 
445 static int
446 mac_bsdextended_check_vnode_link(struct ucred *cred, struct vnode *dvp,
447     struct label *dlabel, struct vnode *vp, struct label *label,
448     struct componentname *cnp)
449 {
450 	struct vattr vap;
451 	int error;
452 
453 	if (!mac_bsdextended_enabled)
454 		return (0);
455 
456 	error = VOP_GETATTR(dvp, &vap, cred, curthread);
457 	if (error)
458 		return (error);
459 	error = mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VWRITE);
460 	if (error)
461 		return (error);
462 
463 	error = VOP_GETATTR(vp, &vap, cred, curthread);
464 	if (error)
465 		return (error);
466 	error = mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VWRITE);
467 	if (error)
468 		return (error);
469 	return (0);
470 }
471 
472 static int
473 mac_bsdextended_check_vnode_lookup(struct ucred *cred, struct vnode *dvp,
474     struct label *dlabel, struct componentname *cnp)
475 {
476 	struct vattr vap;
477 	int error;
478 
479 	if (!mac_bsdextended_enabled)
480 		return (0);
481 
482 	error = VOP_GETATTR(dvp, &vap, cred, curthread);
483 	if (error)
484 		return (error);
485 	return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VEXEC));
486 }
487 
488 static int
489 mac_bsdextended_check_vnode_open(struct ucred *cred, struct vnode *vp,
490     struct label *filelabel, int acc_mode)
491 {
492 	struct vattr vap;
493 	int error;
494 
495 	if (!mac_bsdextended_enabled)
496 		return (0);
497 
498 	error = VOP_GETATTR(vp, &vap, cred, curthread);
499 	if (error)
500 		return (error);
501 	return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, acc_mode));
502 }
503 
504 static int
505 mac_bsdextended_check_vnode_readdir(struct ucred *cred, struct vnode *dvp,
506     struct label *dlabel)
507 {
508 	struct vattr vap;
509 	int error;
510 
511 	if (!mac_bsdextended_enabled)
512 		return (0);
513 
514 	error = VOP_GETATTR(dvp, &vap, cred, curthread);
515 	if (error)
516 		return (error);
517 	return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VREAD));
518 }
519 
520 static int
521 mac_bsdextended_check_vnode_readdlink(struct ucred *cred, struct vnode *vp,
522     struct label *label)
523 {
524 	struct vattr vap;
525 	int error;
526 
527 	if (!mac_bsdextended_enabled)
528 		return (0);
529 
530 	error = VOP_GETATTR(vp, &vap, cred, curthread);
531 	if (error)
532 		return (error);
533 	return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VREAD));
534 }
535 
536 static int
537 mac_bsdextended_check_vnode_rename_from(struct ucred *cred, struct vnode *dvp,
538     struct label *dlabel, struct vnode *vp, struct label *label,
539     struct componentname *cnp)
540 {
541 	struct vattr vap;
542 	int error;
543 
544 	if (!mac_bsdextended_enabled)
545 		return (0);
546 
547 	error = VOP_GETATTR(dvp, &vap, cred, curthread);
548 	if (error)
549 		return (error);
550 	error = mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VWRITE);
551 	if (error)
552 		return (error);
553 	error = VOP_GETATTR(vp, &vap, cred, curthread);
554 	if (error)
555 		return (error);
556 	error = mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VWRITE);
557 
558 	return (error);
559 }
560 
561 static int
562 mac_bsdextended_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp,
563     struct label *dlabel, struct vnode *vp, struct label *label, int samedir,
564     struct componentname *cnp)
565 {
566 	struct vattr vap;
567 	int error;
568 
569 	if (!mac_bsdextended_enabled)
570 		return (0);
571 
572 	error = VOP_GETATTR(dvp, &vap, cred, curthread);
573 	if (error)
574 		return (error);
575 	error = mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VWRITE);
576 	if (error)
577 		return (error);
578 
579 	if (vp != NULL) {
580 		error = VOP_GETATTR(vp, &vap, cred, curthread);
581 		if (error)
582 			return (error);
583 		error = mac_bsdextended_check(cred, vap.va_uid, vap.va_gid,
584 		    VWRITE);
585 	}
586 
587 	return (error);
588 }
589 
590 static int
591 mac_bsdextended_check_vnode_revoke(struct ucred *cred, struct vnode *vp,
592     struct label *label)
593 {
594 	struct vattr vap;
595 	int error;
596 
597 	if (!mac_bsdextended_enabled)
598 		return (0);
599 
600 	error = VOP_GETATTR(vp, &vap, cred, curthread);
601 	if (error)
602 		return (error);
603 	return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VADMIN));
604 }
605 
606 static int
607 mac_bsdextended_check_setacl_vnode(struct ucred *cred, struct vnode *vp,
608     struct label *label, acl_type_t type, struct acl *acl)
609 {
610 	struct vattr vap;
611 	int error;
612 
613 	if (!mac_bsdextended_enabled)
614 		return (0);
615 
616 	error = VOP_GETATTR(vp, &vap, cred, curthread);
617 	if (error)
618 		return (error);
619 	return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VADMIN));
620 }
621 
622 static int
623 mac_bsdextended_check_vnode_setextattr(struct ucred *cred, struct vnode *vp,
624     struct label *label, int attrnamespace, const char *name, struct uio *uio)
625 {
626 	struct vattr vap;
627 	int error;
628 
629 	if (!mac_bsdextended_enabled)
630 		return (0);
631 
632 	error = VOP_GETATTR(vp, &vap, cred, curthread);
633 	if (error)
634 		return (error);
635 	return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VWRITE));
636 }
637 
638 static int
639 mac_bsdextended_check_vnode_setflags(struct ucred *cred, struct vnode *vp,
640     struct label *label, u_long flags)
641 {
642 	struct vattr vap;
643 	int error;
644 
645 	if (!mac_bsdextended_enabled)
646 		return (0);
647 
648 	error = VOP_GETATTR(vp, &vap, cred, curthread);
649 	if (error)
650 		return (error);
651 	return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VADMIN));
652 }
653 
654 static int
655 mac_bsdextended_check_vnode_setmode(struct ucred *cred, struct vnode *vp,
656     struct label *label, mode_t mode)
657 {
658 	struct vattr vap;
659 	int error;
660 
661 	if (!mac_bsdextended_enabled)
662 		return (0);
663 
664 	error = VOP_GETATTR(vp, &vap, cred, curthread);
665 	if (error)
666 		return (error);
667 	return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VADMIN));
668 }
669 
670 static int
671 mac_bsdextended_check_vnode_setowner(struct ucred *cred, struct vnode *vp,
672     struct label *label, uid_t uid, gid_t gid)
673 {
674 	struct vattr vap;
675 	int error;
676 
677 	if (!mac_bsdextended_enabled)
678 		return (0);
679 
680 	error = VOP_GETATTR(vp, &vap, cred, curthread);
681 	if (error)
682 		return (error);
683 	return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VADMIN));
684 }
685 
686 static int
687 mac_bsdextended_check_vnode_setutimes(struct ucred *cred, struct vnode *vp,
688     struct label *label, struct timespec atime, struct timespec utime)
689 {
690 	struct vattr vap;
691 	int error;
692 
693 	if (!mac_bsdextended_enabled)
694 		return (0);
695 
696 	error = VOP_GETATTR(vp, &vap, cred, curthread);
697 	if (error)
698 		return (error);
699 	return (mac_bsdextended_check(cred, vap.va_uid, vap.va_gid, VADMIN));
700 }
701 
702 static int
703 mac_bsdextended_check_vnode_stat(struct ucred *active_cred,
704     struct ucred *file_cred, struct vnode *vp, struct label *label)
705 {
706 	struct vattr vap;
707 	int error;
708 
709 	if (!mac_bsdextended_enabled)
710 		return (0);
711 
712 	error = VOP_GETATTR(vp, &vap, active_cred, curthread);
713 	if (error)
714 		return (error);
715 	return (mac_bsdextended_check(active_cred, vap.va_uid, vap.va_gid,
716 	    VSTAT));
717 }
718 
719 static struct mac_policy_ops mac_bsdextended_ops =
720 {
721 	.mpo_destroy = mac_bsdextended_destroy,
722 	.mpo_init = mac_bsdextended_init,
723 	.mpo_check_vnode_access = mac_bsdextended_check_vnode_access,
724 	.mpo_check_vnode_chdir = mac_bsdextended_check_vnode_chdir,
725 	.mpo_check_vnode_chroot = mac_bsdextended_check_vnode_chroot,
726 	.mpo_check_vnode_create = mac_bsdextended_check_create_vnode,
727 	.mpo_check_vnode_delete = mac_bsdextended_check_vnode_delete,
728 	.mpo_check_vnode_deleteacl = mac_bsdextended_check_vnode_deleteacl,
729 	.mpo_check_vnode_exec = mac_bsdextended_check_vnode_exec,
730 	.mpo_check_vnode_getacl = mac_bsdextended_check_vnode_getacl,
731 	.mpo_check_vnode_getextattr = mac_bsdextended_check_vnode_getextattr,
732 	.mpo_check_vnode_link = mac_bsdextended_check_vnode_link,
733 	.mpo_check_vnode_lookup = mac_bsdextended_check_vnode_lookup,
734 	.mpo_check_vnode_open = mac_bsdextended_check_vnode_open,
735 	.mpo_check_vnode_readdir = mac_bsdextended_check_vnode_readdir,
736 	.mpo_check_vnode_readlink = mac_bsdextended_check_vnode_readdlink,
737 	.mpo_check_vnode_rename_from = mac_bsdextended_check_vnode_rename_from,
738 	.mpo_check_vnode_rename_to = mac_bsdextended_check_vnode_rename_to,
739 	.mpo_check_vnode_revoke = mac_bsdextended_check_vnode_revoke,
740 	.mpo_check_vnode_setacl = mac_bsdextended_check_setacl_vnode,
741 	.mpo_check_vnode_setextattr = mac_bsdextended_check_vnode_setextattr,
742 	.mpo_check_vnode_setflags = mac_bsdextended_check_vnode_setflags,
743 	.mpo_check_vnode_setmode = mac_bsdextended_check_vnode_setmode,
744 	.mpo_check_vnode_setowner = mac_bsdextended_check_vnode_setowner,
745 	.mpo_check_vnode_setutimes = mac_bsdextended_check_vnode_setutimes,
746 	.mpo_check_vnode_stat = mac_bsdextended_check_vnode_stat,
747 };
748 
749 MAC_POLICY_SET(&mac_bsdextended_ops, trustedbsd_mac_bsdextended,
750     "TrustedBSD MAC/BSD Extended", MPC_LOADTIME_FLAG_UNLOADOK, NULL);
751