xref: /freebsd/sys/security/mac_lomac/mac_lomac.c (revision 1e413cf93298b5b97441a21d9a50fdcd0ee9945e)
1 /*-
2  * Copyright (c) 1999-2002, 2007 Robert N. M. Watson
3  * Copyright (c) 2001-2005 Networks Associates Technology, Inc.
4  * Copyright (c) 2006 SPARTA, Inc.
5  * All rights reserved.
6  *
7  * This software was developed by Robert Watson for the TrustedBSD Project.
8  *
9  * This software was developed for the FreeBSD Project in part by NAI Labs,
10  * the Security Research Division of Network Associates, Inc. under
11  * DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA
12  * CHATS research program.
13  *
14  * This software was enhanced by SPARTA ISSO under SPAWAR contract
15  * N66001-04-C-6019 ("SEFOS").
16  *
17  * Redistribution and use in source and binary forms, with or without
18  * modification, are permitted provided that the following conditions
19  * are met:
20  * 1. Redistributions of source code must retain the above copyright
21  *    notice, this list of conditions and the following disclaimer.
22  * 2. Redistributions in binary form must reproduce the above copyright
23  *    notice, this list of conditions and the following disclaimer in the
24  *    documentation and/or other materials provided with the distribution.
25  *
26  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
27  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
28  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
29  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
30  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
31  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
32  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
33  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
34  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
35  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
36  * SUCH DAMAGE.
37  *
38  * $FreeBSD$
39  */
40 
41 /*
42  * Developed by the TrustedBSD Project.
43  *
44  * Low-watermark floating label mandatory integrity policy.
45  */
46 
47 #include <sys/types.h>
48 #include <sys/param.h>
49 #include <sys/acl.h>
50 #include <sys/conf.h>
51 #include <sys/extattr.h>
52 #include <sys/kernel.h>
53 #include <sys/malloc.h>
54 #include <sys/mman.h>
55 #include <sys/mount.h>
56 #include <sys/priv.h>
57 #include <sys/proc.h>
58 #include <sys/sbuf.h>
59 #include <sys/systm.h>
60 #include <sys/sysproto.h>
61 #include <sys/sysent.h>
62 #include <sys/systm.h>
63 #include <sys/vnode.h>
64 #include <sys/file.h>
65 #include <sys/socket.h>
66 #include <sys/socketvar.h>
67 #include <sys/sx.h>
68 #include <sys/pipe.h>
69 #include <sys/sysctl.h>
70 #include <sys/syslog.h>
71 
72 #include <fs/devfs/devfs.h>
73 
74 #include <net/bpfdesc.h>
75 #include <net/if.h>
76 #include <net/if_types.h>
77 #include <net/if_var.h>
78 
79 #include <netinet/in.h>
80 #include <netinet/in_pcb.h>
81 #include <netinet/ip_var.h>
82 
83 #include <vm/vm.h>
84 
85 #include <security/mac/mac_policy.h>
86 #include <security/mac/mac_framework.h>
87 #include <security/mac_lomac/mac_lomac.h>
88 
89 struct mac_lomac_proc {
90 	struct mac_lomac mac_lomac;
91 	struct mtx mtx;
92 };
93 
94 SYSCTL_DECL(_security_mac);
95 
96 SYSCTL_NODE(_security_mac, OID_AUTO, lomac, CTLFLAG_RW, 0,
97     "TrustedBSD mac_lomac policy controls");
98 
99 static int	lomac_label_size = sizeof(struct mac_lomac);
100 SYSCTL_INT(_security_mac_lomac, OID_AUTO, label_size, CTLFLAG_RD,
101     &lomac_label_size, 0, "Size of struct mac_lomac");
102 
103 static int	lomac_enabled = 1;
104 SYSCTL_INT(_security_mac_lomac, OID_AUTO, enabled, CTLFLAG_RW,
105     &lomac_enabled, 0, "Enforce MAC/LOMAC policy");
106 TUNABLE_INT("security.mac.lomac.enabled", &lomac_enabled);
107 
108 static int	destroyed_not_inited;
109 SYSCTL_INT(_security_mac_lomac, OID_AUTO, destroyed_not_inited, CTLFLAG_RD,
110     &destroyed_not_inited, 0, "Count of labels destroyed but not inited");
111 
112 static int	trust_all_interfaces = 0;
113 SYSCTL_INT(_security_mac_lomac, OID_AUTO, trust_all_interfaces, CTLFLAG_RD,
114     &trust_all_interfaces, 0, "Consider all interfaces 'trusted' by MAC/LOMAC");
115 TUNABLE_INT("security.mac.lomac.trust_all_interfaces", &trust_all_interfaces);
116 
117 static char	trusted_interfaces[128];
118 SYSCTL_STRING(_security_mac_lomac, OID_AUTO, trusted_interfaces, CTLFLAG_RD,
119     trusted_interfaces, 0, "Interfaces considered 'trusted' by MAC/LOMAC");
120 TUNABLE_STR("security.mac.lomac.trusted_interfaces", trusted_interfaces,
121     sizeof(trusted_interfaces));
122 
123 static int	ptys_equal = 0;
124 SYSCTL_INT(_security_mac_lomac, OID_AUTO, ptys_equal, CTLFLAG_RW,
125     &ptys_equal, 0, "Label pty devices as lomac/equal on create");
126 TUNABLE_INT("security.mac.lomac.ptys_equal", &ptys_equal);
127 
128 static int	revocation_enabled = 1;
129 SYSCTL_INT(_security_mac_lomac, OID_AUTO, revocation_enabled, CTLFLAG_RW,
130     &revocation_enabled, 0, "Revoke access to objects on relabel");
131 TUNABLE_INT("security.mac.lomac.revocation_enabled", &revocation_enabled);
132 
133 static int	lomac_slot;
134 #define	SLOT(l)	((struct mac_lomac *)mac_label_get((l), lomac_slot))
135 #define	SLOT_SET(l, val) mac_label_set((l), lomac_slot, (uintptr_t)(val))
136 #define	PSLOT(l) ((struct mac_lomac_proc *)				\
137     mac_label_get((l), lomac_slot))
138 #define	PSLOT_SET(l, val) mac_label_set((l), lomac_slot, (uintptr_t)(val))
139 
140 MALLOC_DEFINE(M_LOMAC, "mac_lomac_label", "MAC/LOMAC labels");
141 
142 static struct mac_lomac *
143 lomac_alloc(int flag)
144 {
145 	struct mac_lomac *ml;
146 
147 	ml = malloc(sizeof(*ml), M_LOMAC, M_ZERO | flag);
148 
149 	return (ml);
150 }
151 
152 static void
153 lomac_free(struct mac_lomac *ml)
154 {
155 
156 	if (ml != NULL)
157 		free(ml, M_LOMAC);
158 	else
159 		atomic_add_int(&destroyed_not_inited, 1);
160 }
161 
162 static int
163 lomac_atmostflags(struct mac_lomac *ml, int flags)
164 {
165 
166 	if ((ml->ml_flags & flags) != ml->ml_flags)
167 		return (EINVAL);
168 	return (0);
169 }
170 
171 static int
172 lomac_dominate_element(struct mac_lomac_element *a,
173     struct mac_lomac_element *b)
174 {
175 
176 	switch (a->mle_type) {
177 	case MAC_LOMAC_TYPE_EQUAL:
178 	case MAC_LOMAC_TYPE_HIGH:
179 		return (1);
180 
181 	case MAC_LOMAC_TYPE_LOW:
182 		switch (b->mle_type) {
183 		case MAC_LOMAC_TYPE_GRADE:
184 		case MAC_LOMAC_TYPE_HIGH:
185 			return (0);
186 
187 		case MAC_LOMAC_TYPE_EQUAL:
188 		case MAC_LOMAC_TYPE_LOW:
189 			return (1);
190 
191 		default:
192 			panic("lomac_dominate_element: b->mle_type invalid");
193 		}
194 
195 	case MAC_LOMAC_TYPE_GRADE:
196 		switch (b->mle_type) {
197 		case MAC_LOMAC_TYPE_EQUAL:
198 		case MAC_LOMAC_TYPE_LOW:
199 			return (1);
200 
201 		case MAC_LOMAC_TYPE_HIGH:
202 			return (0);
203 
204 		case MAC_LOMAC_TYPE_GRADE:
205 			return (a->mle_grade >= b->mle_grade);
206 
207 		default:
208 			panic("lomac_dominate_element: b->mle_type invalid");
209 		}
210 
211 	default:
212 		panic("lomac_dominate_element: a->mle_type invalid");
213 	}
214 }
215 
216 static int
217 lomac_range_in_range(struct mac_lomac *rangea, struct mac_lomac *rangeb)
218 {
219 
220 	return (lomac_dominate_element(&rangeb->ml_rangehigh,
221 	    &rangea->ml_rangehigh) &&
222 	    lomac_dominate_element(&rangea->ml_rangelow,
223 	    &rangeb->ml_rangelow));
224 }
225 
226 static int
227 lomac_single_in_range(struct mac_lomac *single, struct mac_lomac *range)
228 {
229 
230 	KASSERT((single->ml_flags & MAC_LOMAC_FLAG_SINGLE) != 0,
231 	    ("lomac_single_in_range: a not single"));
232 	KASSERT((range->ml_flags & MAC_LOMAC_FLAG_RANGE) != 0,
233 	    ("lomac_single_in_range: b not range"));
234 
235 	return (lomac_dominate_element(&range->ml_rangehigh,
236 	    &single->ml_single) && lomac_dominate_element(&single->ml_single,
237 	    &range->ml_rangelow));
238 }
239 
240 static int
241 lomac_auxsingle_in_range(struct mac_lomac *single, struct mac_lomac *range)
242 {
243 
244 	KASSERT((single->ml_flags & MAC_LOMAC_FLAG_AUX) != 0,
245 	    ("lomac_single_in_range: a not auxsingle"));
246 	KASSERT((range->ml_flags & MAC_LOMAC_FLAG_RANGE) != 0,
247 	    ("lomac_single_in_range: b not range"));
248 
249 	return (lomac_dominate_element(&range->ml_rangehigh,
250 	    &single->ml_auxsingle) &&
251 	    lomac_dominate_element(&single->ml_auxsingle,
252 	    &range->ml_rangelow));
253 }
254 
255 static int
256 lomac_dominate_single(struct mac_lomac *a, struct mac_lomac *b)
257 {
258 	KASSERT((a->ml_flags & MAC_LOMAC_FLAG_SINGLE) != 0,
259 	    ("lomac_dominate_single: a not single"));
260 	KASSERT((b->ml_flags & MAC_LOMAC_FLAG_SINGLE) != 0,
261 	    ("lomac_dominate_single: b not single"));
262 
263 	return (lomac_dominate_element(&a->ml_single, &b->ml_single));
264 }
265 
266 static int
267 lomac_subject_dominate(struct mac_lomac *a, struct mac_lomac *b)
268 {
269 	KASSERT((~a->ml_flags &
270 	    (MAC_LOMAC_FLAG_SINGLE | MAC_LOMAC_FLAG_RANGE)) == 0,
271 	    ("lomac_dominate_single: a not subject"));
272 	KASSERT((b->ml_flags & MAC_LOMAC_FLAG_SINGLE) != 0,
273 	    ("lomac_dominate_single: b not single"));
274 
275 	return (lomac_dominate_element(&a->ml_rangehigh, &b->ml_single));
276 }
277 
278 static int
279 lomac_equal_element(struct mac_lomac_element *a, struct mac_lomac_element *b)
280 {
281 
282 	if (a->mle_type == MAC_LOMAC_TYPE_EQUAL ||
283 	    b->mle_type == MAC_LOMAC_TYPE_EQUAL)
284 		return (1);
285 
286 	return (a->mle_type == b->mle_type && a->mle_grade == b->mle_grade);
287 }
288 
289 static int
290 lomac_equal_single(struct mac_lomac *a, struct mac_lomac *b)
291 {
292 
293 	KASSERT((a->ml_flags & MAC_LOMAC_FLAG_SINGLE) != 0,
294 	    ("lomac_equal_single: a not single"));
295 	KASSERT((b->ml_flags & MAC_LOMAC_FLAG_SINGLE) != 0,
296 	    ("lomac_equal_single: b not single"));
297 
298 	return (lomac_equal_element(&a->ml_single, &b->ml_single));
299 }
300 
301 static int
302 lomac_contains_equal(struct mac_lomac *ml)
303 {
304 
305 	if (ml->ml_flags & MAC_LOMAC_FLAG_SINGLE)
306 		if (ml->ml_single.mle_type == MAC_LOMAC_TYPE_EQUAL)
307 			return (1);
308 	if (ml->ml_flags & MAC_LOMAC_FLAG_AUX)
309 		if (ml->ml_auxsingle.mle_type == MAC_LOMAC_TYPE_EQUAL)
310 			return (1);
311 
312 	if (ml->ml_flags & MAC_LOMAC_FLAG_RANGE) {
313 		if (ml->ml_rangelow.mle_type == MAC_LOMAC_TYPE_EQUAL)
314 			return (1);
315 		if (ml->ml_rangehigh.mle_type == MAC_LOMAC_TYPE_EQUAL)
316 			return (1);
317 	}
318 
319 	return (0);
320 }
321 
322 static int
323 lomac_subject_privileged(struct mac_lomac *ml)
324 {
325 
326 	KASSERT((ml->ml_flags & MAC_LOMAC_FLAGS_BOTH) ==
327 	    MAC_LOMAC_FLAGS_BOTH,
328 	    ("lomac_subject_privileged: subject doesn't have both labels"));
329 
330 	/* If the single is EQUAL, it's ok. */
331 	if (ml->ml_single.mle_type == MAC_LOMAC_TYPE_EQUAL)
332 		return (0);
333 
334 	/* If either range endpoint is EQUAL, it's ok. */
335 	if (ml->ml_rangelow.mle_type == MAC_LOMAC_TYPE_EQUAL ||
336 	    ml->ml_rangehigh.mle_type == MAC_LOMAC_TYPE_EQUAL)
337 		return (0);
338 
339 	/* If the range is low-high, it's ok. */
340 	if (ml->ml_rangelow.mle_type == MAC_LOMAC_TYPE_LOW &&
341 	    ml->ml_rangehigh.mle_type == MAC_LOMAC_TYPE_HIGH)
342 		return (0);
343 
344 	/* It's not ok. */
345 	return (EPERM);
346 }
347 
348 static int
349 lomac_high_single(struct mac_lomac *ml)
350 {
351 
352 	KASSERT((ml->ml_flags & MAC_LOMAC_FLAG_SINGLE) != 0,
353 	    ("lomac_high_single: mac_lomac not single"));
354 
355 	return (ml->ml_single.mle_type == MAC_LOMAC_TYPE_HIGH);
356 }
357 
358 static int
359 lomac_valid(struct mac_lomac *ml)
360 {
361 
362 	if (ml->ml_flags & MAC_LOMAC_FLAG_SINGLE) {
363 		switch (ml->ml_single.mle_type) {
364 		case MAC_LOMAC_TYPE_GRADE:
365 		case MAC_LOMAC_TYPE_EQUAL:
366 		case MAC_LOMAC_TYPE_HIGH:
367 		case MAC_LOMAC_TYPE_LOW:
368 			break;
369 
370 		default:
371 			return (EINVAL);
372 		}
373 	} else {
374 		if (ml->ml_single.mle_type != MAC_LOMAC_TYPE_UNDEF)
375 			return (EINVAL);
376 	}
377 
378 	if (ml->ml_flags & MAC_LOMAC_FLAG_AUX) {
379 		switch (ml->ml_auxsingle.mle_type) {
380 		case MAC_LOMAC_TYPE_GRADE:
381 		case MAC_LOMAC_TYPE_EQUAL:
382 		case MAC_LOMAC_TYPE_HIGH:
383 		case MAC_LOMAC_TYPE_LOW:
384 			break;
385 
386 		default:
387 			return (EINVAL);
388 		}
389 	} else {
390 		if (ml->ml_auxsingle.mle_type != MAC_LOMAC_TYPE_UNDEF)
391 			return (EINVAL);
392 	}
393 
394 	if (ml->ml_flags & MAC_LOMAC_FLAG_RANGE) {
395 		switch (ml->ml_rangelow.mle_type) {
396 		case MAC_LOMAC_TYPE_GRADE:
397 		case MAC_LOMAC_TYPE_EQUAL:
398 		case MAC_LOMAC_TYPE_HIGH:
399 		case MAC_LOMAC_TYPE_LOW:
400 			break;
401 
402 		default:
403 			return (EINVAL);
404 		}
405 
406 		switch (ml->ml_rangehigh.mle_type) {
407 		case MAC_LOMAC_TYPE_GRADE:
408 		case MAC_LOMAC_TYPE_EQUAL:
409 		case MAC_LOMAC_TYPE_HIGH:
410 		case MAC_LOMAC_TYPE_LOW:
411 			break;
412 
413 		default:
414 			return (EINVAL);
415 		}
416 		if (!lomac_dominate_element(&ml->ml_rangehigh,
417 		    &ml->ml_rangelow))
418 			return (EINVAL);
419 	} else {
420 		if (ml->ml_rangelow.mle_type != MAC_LOMAC_TYPE_UNDEF ||
421 		    ml->ml_rangehigh.mle_type != MAC_LOMAC_TYPE_UNDEF)
422 			return (EINVAL);
423 	}
424 
425 	return (0);
426 }
427 
428 static void
429 lomac_set_range(struct mac_lomac *ml, u_short typelow, u_short gradelow,
430     u_short typehigh, u_short gradehigh)
431 {
432 
433 	ml->ml_rangelow.mle_type = typelow;
434 	ml->ml_rangelow.mle_grade = gradelow;
435 	ml->ml_rangehigh.mle_type = typehigh;
436 	ml->ml_rangehigh.mle_grade = gradehigh;
437 	ml->ml_flags |= MAC_LOMAC_FLAG_RANGE;
438 }
439 
440 static void
441 lomac_set_single(struct mac_lomac *ml, u_short type, u_short grade)
442 {
443 
444 	ml->ml_single.mle_type = type;
445 	ml->ml_single.mle_grade = grade;
446 	ml->ml_flags |= MAC_LOMAC_FLAG_SINGLE;
447 }
448 
449 static void
450 lomac_copy_range(struct mac_lomac *labelfrom, struct mac_lomac *labelto)
451 {
452 
453 	KASSERT((labelfrom->ml_flags & MAC_LOMAC_FLAG_RANGE) != 0,
454 	    ("lomac_copy_range: labelfrom not range"));
455 
456 	labelto->ml_rangelow = labelfrom->ml_rangelow;
457 	labelto->ml_rangehigh = labelfrom->ml_rangehigh;
458 	labelto->ml_flags |= MAC_LOMAC_FLAG_RANGE;
459 }
460 
461 static void
462 lomac_copy_single(struct mac_lomac *labelfrom, struct mac_lomac *labelto)
463 {
464 
465 	KASSERT((labelfrom->ml_flags & MAC_LOMAC_FLAG_SINGLE) != 0,
466 	    ("lomac_copy_single: labelfrom not single"));
467 
468 	labelto->ml_single = labelfrom->ml_single;
469 	labelto->ml_flags |= MAC_LOMAC_FLAG_SINGLE;
470 }
471 
472 static void
473 lomac_copy_auxsingle(struct mac_lomac *labelfrom, struct mac_lomac *labelto)
474 {
475 
476 	KASSERT((labelfrom->ml_flags & MAC_LOMAC_FLAG_AUX) != 0,
477 	    ("lomac_copy_auxsingle: labelfrom not auxsingle"));
478 
479 	labelto->ml_auxsingle = labelfrom->ml_auxsingle;
480 	labelto->ml_flags |= MAC_LOMAC_FLAG_AUX;
481 }
482 
483 static void
484 lomac_copy(struct mac_lomac *source, struct mac_lomac *dest)
485 {
486 
487 	if (source->ml_flags & MAC_LOMAC_FLAG_SINGLE)
488 		lomac_copy_single(source, dest);
489 	if (source->ml_flags & MAC_LOMAC_FLAG_AUX)
490 		lomac_copy_auxsingle(source, dest);
491 	if (source->ml_flags & MAC_LOMAC_FLAG_RANGE)
492 		lomac_copy_range(source, dest);
493 }
494 
495 static int	lomac_to_string(struct sbuf *sb, struct mac_lomac *ml);
496 
497 static int
498 maybe_demote(struct mac_lomac *subjlabel, struct mac_lomac *objlabel,
499     const char *actionname, const char *objname, struct vnode *vp)
500 {
501 	struct sbuf subjlabel_sb, subjtext_sb, objlabel_sb;
502 	char *subjlabeltext, *objlabeltext, *subjtext;
503 	struct mac_lomac cached_subjlabel;
504 	struct mac_lomac_proc *subj;
505 	struct vattr va;
506 	struct proc *p;
507 	pid_t pgid;
508 
509 	subj = PSLOT(curthread->td_proc->p_label);
510 
511 	p = curthread->td_proc;
512 	mtx_lock(&subj->mtx);
513         if (subj->mac_lomac.ml_flags & MAC_LOMAC_FLAG_UPDATE) {
514 		/*
515 		 * Check to see if the pending demotion would be more or less
516 		 * severe than this one, and keep the more severe.  This can
517 		 * only happen for a multi-threaded application.
518 		 */
519 		if (lomac_dominate_single(objlabel, &subj->mac_lomac)) {
520 			mtx_unlock(&subj->mtx);
521 			return (0);
522 		}
523 	}
524 	bzero(&subj->mac_lomac, sizeof(subj->mac_lomac));
525 	/*
526 	 * Always demote the single label.
527 	 */
528 	lomac_copy_single(objlabel, &subj->mac_lomac);
529 	/*
530 	 * Start with the original range, then minimize each side of the
531 	 * range to the point of not dominating the object.  The high side
532 	 * will always be demoted, of course.
533 	 */
534 	lomac_copy_range(subjlabel, &subj->mac_lomac);
535 	if (!lomac_dominate_element(&objlabel->ml_single,
536 	    &subj->mac_lomac.ml_rangelow))
537 		subj->mac_lomac.ml_rangelow = objlabel->ml_single;
538 	subj->mac_lomac.ml_rangehigh = objlabel->ml_single;
539 	subj->mac_lomac.ml_flags |= MAC_LOMAC_FLAG_UPDATE;
540 	thread_lock(curthread);
541 	curthread->td_flags |= TDF_ASTPENDING | TDF_MACPEND;
542 	thread_unlock(curthread);
543 
544 	/*
545 	 * Avoid memory allocation while holding a mutex; cache the label.
546 	 */
547 	lomac_copy_single(&subj->mac_lomac, &cached_subjlabel);
548 	mtx_unlock(&subj->mtx);
549 
550 	sbuf_new(&subjlabel_sb, NULL, 0, SBUF_AUTOEXTEND);
551 	lomac_to_string(&subjlabel_sb, subjlabel);
552 	sbuf_finish(&subjlabel_sb);
553 	subjlabeltext = sbuf_data(&subjlabel_sb);
554 
555 	sbuf_new(&subjtext_sb, NULL, 0, SBUF_AUTOEXTEND);
556 	lomac_to_string(&subjtext_sb, &subj->mac_lomac);
557 	sbuf_finish(&subjtext_sb);
558 	subjtext = sbuf_data(&subjtext_sb);
559 
560 	sbuf_new(&objlabel_sb, NULL, 0, SBUF_AUTOEXTEND);
561 	lomac_to_string(&objlabel_sb, objlabel);
562 	sbuf_finish(&objlabel_sb);
563 	objlabeltext = sbuf_data(&objlabel_sb);
564 
565 	pgid = p->p_pgrp->pg_id;		/* XXX could be stale? */
566 	if (vp != NULL && VOP_GETATTR(vp, &va, curthread->td_ucred,
567 	    curthread) == 0) {
568 		log(LOG_INFO, "LOMAC: level-%s subject p%dg%du%d:%s demoted to"
569 		    " level %s after %s a level-%s %s (inode=%ld, "
570 		    "mountpount=%s)\n",
571 		    subjlabeltext, p->p_pid, pgid, curthread->td_ucred->cr_uid,
572 		    p->p_comm, subjtext, actionname, objlabeltext, objname,
573 		    va.va_fileid, vp->v_mount->mnt_stat.f_mntonname);
574 	} else {
575 		log(LOG_INFO, "LOMAC: level-%s subject p%dg%du%d:%s demoted to"
576 		    " level %s after %s a level-%s %s\n",
577 		    subjlabeltext, p->p_pid, pgid, curthread->td_ucred->cr_uid,
578 		    p->p_comm, subjtext, actionname, objlabeltext, objname);
579 	}
580 
581 	sbuf_delete(&subjlabel_sb);
582 	sbuf_delete(&subjtext_sb);
583 	sbuf_delete(&objlabel_sb);
584 
585 	return (0);
586 }
587 
588 /*
589  * Relabel "to" to "from" only if "from" is a valid label (contains at least
590  * a single), as for a relabel operation which may or may not involve a
591  * relevant label.
592  */
593 static void
594 try_relabel(struct mac_lomac *from, struct mac_lomac *to)
595 {
596 
597 	if (from->ml_flags & MAC_LOMAC_FLAG_SINGLE) {
598 		bzero(to, sizeof(*to));
599 		lomac_copy(from, to);
600 	}
601 }
602 
603 /*
604  * Policy module operations.
605  */
606 static void
607 lomac_init(struct mac_policy_conf *conf)
608 {
609 
610 }
611 
612 /*
613  * Label operations.
614  */
615 static void
616 lomac_init_label(struct label *label)
617 {
618 
619 	SLOT_SET(label, lomac_alloc(M_WAITOK));
620 }
621 
622 static int
623 lomac_init_label_waitcheck(struct label *label, int flag)
624 {
625 
626 	SLOT_SET(label, lomac_alloc(flag));
627 	if (SLOT(label) == NULL)
628 		return (ENOMEM);
629 
630 	return (0);
631 }
632 
633 static void
634 lomac_destroy_label(struct label *label)
635 {
636 
637 	lomac_free(SLOT(label));
638 	SLOT_SET(label, NULL);
639 }
640 
641 static int
642 lomac_element_to_string(struct sbuf *sb, struct mac_lomac_element *element)
643 {
644 
645 	switch (element->mle_type) {
646 	case MAC_LOMAC_TYPE_HIGH:
647 		return (sbuf_printf(sb, "high"));
648 
649 	case MAC_LOMAC_TYPE_LOW:
650 		return (sbuf_printf(sb, "low"));
651 
652 	case MAC_LOMAC_TYPE_EQUAL:
653 		return (sbuf_printf(sb, "equal"));
654 
655 	case MAC_LOMAC_TYPE_GRADE:
656 		return (sbuf_printf(sb, "%d", element->mle_grade));
657 
658 	default:
659 		panic("lomac_element_to_string: invalid type (%d)",
660 		    element->mle_type);
661 	}
662 }
663 
664 static int
665 lomac_to_string(struct sbuf *sb, struct mac_lomac *ml)
666 {
667 
668 	if (ml->ml_flags & MAC_LOMAC_FLAG_SINGLE) {
669 		if (lomac_element_to_string(sb, &ml->ml_single) == -1)
670 			return (EINVAL);
671 	}
672 
673 	if (ml->ml_flags & MAC_LOMAC_FLAG_AUX) {
674 		if (sbuf_putc(sb, '[') == -1)
675 			return (EINVAL);
676 
677 		if (lomac_element_to_string(sb, &ml->ml_auxsingle) == -1)
678 			return (EINVAL);
679 
680 		if (sbuf_putc(sb, ']') == -1)
681 			return (EINVAL);
682 	}
683 
684 	if (ml->ml_flags & MAC_LOMAC_FLAG_RANGE) {
685 		if (sbuf_putc(sb, '(') == -1)
686 			return (EINVAL);
687 
688 		if (lomac_element_to_string(sb, &ml->ml_rangelow) == -1)
689 			return (EINVAL);
690 
691 		if (sbuf_putc(sb, '-') == -1)
692 			return (EINVAL);
693 
694 		if (lomac_element_to_string(sb, &ml->ml_rangehigh) == -1)
695 			return (EINVAL);
696 
697 		if (sbuf_putc(sb, ')') == -1)
698 			return (EINVAL);
699 	}
700 
701 	return (0);
702 }
703 
704 static int
705 lomac_externalize_label(struct label *label, char *element_name,
706     struct sbuf *sb, int *claimed)
707 {
708 	struct mac_lomac *ml;
709 
710 	if (strcmp(MAC_LOMAC_LABEL_NAME, element_name) != 0)
711 		return (0);
712 
713 	(*claimed)++;
714 
715 	ml = SLOT(label);
716 
717 	return (lomac_to_string(sb, ml));
718 }
719 
720 static int
721 lomac_parse_element(struct mac_lomac_element *element, char *string)
722 {
723 
724 	if (strcmp(string, "high") == 0 || strcmp(string, "hi") == 0) {
725 		element->mle_type = MAC_LOMAC_TYPE_HIGH;
726 		element->mle_grade = MAC_LOMAC_TYPE_UNDEF;
727 	} else if (strcmp(string, "low") == 0 || strcmp(string, "lo") == 0) {
728 		element->mle_type = MAC_LOMAC_TYPE_LOW;
729 		element->mle_grade = MAC_LOMAC_TYPE_UNDEF;
730 	} else if (strcmp(string, "equal") == 0 || strcmp(string, "eq") == 0)
731 	    {
732 		element->mle_type = MAC_LOMAC_TYPE_EQUAL;
733 		element->mle_grade = MAC_LOMAC_TYPE_UNDEF;
734 	} else {
735 		char *p0, *p1;
736 		int d;
737 
738 		p0 = string;
739 		d = strtol(p0, &p1, 10);
740 
741 		if (d < 0 || d > 65535)
742 			return (EINVAL);
743 		element->mle_type = MAC_LOMAC_TYPE_GRADE;
744 		element->mle_grade = d;
745 
746 		if (p1 == p0 || *p1 != '\0')
747 			return (EINVAL);
748 	}
749 
750 	return (0);
751 }
752 
753 /*
754  * Note: destructively consumes the string, make a local copy before calling
755  * if that's a problem.
756  */
757 static int
758 lomac_parse(struct mac_lomac *ml, char *string)
759 {
760 	char *range, *rangeend, *rangehigh, *rangelow, *single, *auxsingle,
761 	    *auxsingleend;
762 	int error;
763 
764 	/* Do we have a range? */
765 	single = string;
766 	range = index(string, '(');
767 	if (range == single)
768 		single = NULL;
769 	auxsingle = index(string, '[');
770 	if (auxsingle == single)
771 		single = NULL;
772 	if (range != NULL && auxsingle != NULL)
773 		return (EINVAL);
774 	rangelow = rangehigh = NULL;
775 	if (range != NULL) {
776 		/* Nul terminate the end of the single string. */
777 		*range = '\0';
778 		range++;
779 		rangelow = range;
780 		rangehigh = index(rangelow, '-');
781 		if (rangehigh == NULL)
782 			return (EINVAL);
783 		rangehigh++;
784 		if (*rangelow == '\0' || *rangehigh == '\0')
785 			return (EINVAL);
786 		rangeend = index(rangehigh, ')');
787 		if (rangeend == NULL)
788 			return (EINVAL);
789 		if (*(rangeend + 1) != '\0')
790 			return (EINVAL);
791 		/* Nul terminate the ends of the ranges. */
792 		*(rangehigh - 1) = '\0';
793 		*rangeend = '\0';
794 	}
795 	KASSERT((rangelow != NULL && rangehigh != NULL) ||
796 	    (rangelow == NULL && rangehigh == NULL),
797 	    ("lomac_internalize_label: range mismatch"));
798 	if (auxsingle != NULL) {
799 		/* Nul terminate the end of the single string. */
800 		*auxsingle = '\0';
801 		auxsingle++;
802 		auxsingleend = index(auxsingle, ']');
803 		if (auxsingleend == NULL)
804 			return (EINVAL);
805 		if (*(auxsingleend + 1) != '\0')
806 			return (EINVAL);
807 		/* Nul terminate the end of the auxsingle. */
808 		*auxsingleend = '\0';
809 	}
810 
811 	bzero(ml, sizeof(*ml));
812 	if (single != NULL) {
813 		error = lomac_parse_element(&ml->ml_single, single);
814 		if (error)
815 			return (error);
816 		ml->ml_flags |= MAC_LOMAC_FLAG_SINGLE;
817 	}
818 
819 	if (auxsingle != NULL) {
820 		error = lomac_parse_element(&ml->ml_auxsingle,
821 		    auxsingle);
822 		if (error)
823 			return (error);
824 		ml->ml_flags |= MAC_LOMAC_FLAG_AUX;
825 	}
826 
827 	if (rangelow != NULL) {
828 		error = lomac_parse_element(&ml->ml_rangelow, rangelow);
829 		if (error)
830 			return (error);
831 		error = lomac_parse_element(&ml->ml_rangehigh, rangehigh);
832 		if (error)
833 			return (error);
834 		ml->ml_flags |= MAC_LOMAC_FLAG_RANGE;
835 	}
836 
837 	error = lomac_valid(ml);
838 	if (error)
839 		return (error);
840 
841 	return (0);
842 }
843 
844 static int
845 lomac_internalize_label(struct label *label, char *element_name,
846     char *element_data, int *claimed)
847 {
848 	struct mac_lomac *ml, ml_temp;
849 	int error;
850 
851 	if (strcmp(MAC_LOMAC_LABEL_NAME, element_name) != 0)
852 		return (0);
853 
854 	(*claimed)++;
855 
856 	error = lomac_parse(&ml_temp, element_data);
857 	if (error)
858 		return (error);
859 
860 	ml = SLOT(label);
861 	*ml = ml_temp;
862 
863 	return (0);
864 }
865 
866 static void
867 lomac_copy_label(struct label *src, struct label *dest)
868 {
869 
870 	*SLOT(dest) = *SLOT(src);
871 }
872 
873 /*
874  * Object-specific entry point implementations are sorted alphabetically by
875  * object type name and then by operation.
876  */
877 static int
878 lomac_bpfdesc_check_receive(struct bpf_d *d, struct label *dlabel,
879     struct ifnet *ifp, struct label *ifplabel)
880 {
881 	struct mac_lomac *a, *b;
882 
883 	if (!lomac_enabled)
884 		return (0);
885 
886 	a = SLOT(dlabel);
887 	b = SLOT(ifplabel);
888 
889 	if (lomac_equal_single(a, b))
890 		return (0);
891 	return (EACCES);
892 }
893 
894 static void
895 lomac_bpfdesc_create(struct ucred *cred, struct bpf_d *d,
896     struct label *dlabel)
897 {
898 	struct mac_lomac *source, *dest;
899 
900 	source = SLOT(cred->cr_label);
901 	dest = SLOT(dlabel);
902 
903 	lomac_copy_single(source, dest);
904 }
905 
906 static void
907 lomac_bpfdesc_create_mbuf(struct bpf_d *d, struct label *dlabel,
908     struct mbuf *m, struct label *mlabel)
909 {
910 	struct mac_lomac *source, *dest;
911 
912 	source = SLOT(dlabel);
913 	dest = SLOT(mlabel);
914 
915 	lomac_copy_single(source, dest);
916 }
917 
918 static int
919 lomac_cred_check_relabel(struct ucred *cred, struct label *newlabel)
920 {
921 	struct mac_lomac *subj, *new;
922 	int error;
923 
924 	subj = SLOT(cred->cr_label);
925 	new = SLOT(newlabel);
926 
927 	/*
928 	 * If there is a LOMAC label update for the credential, it may be an
929 	 * update of the single, range, or both.
930 	 */
931 	error = lomac_atmostflags(new, MAC_LOMAC_FLAGS_BOTH);
932 	if (error)
933 		return (error);
934 
935 	/*
936 	 * If the LOMAC label is to be changed, authorize as appropriate.
937 	 */
938 	if (new->ml_flags & MAC_LOMAC_FLAGS_BOTH) {
939 		/*
940 		 * Fill in the missing parts from the previous label.
941 		 */
942 		if ((new->ml_flags & MAC_LOMAC_FLAG_SINGLE) == 0)
943 			lomac_copy_single(subj, new);
944 		if ((new->ml_flags & MAC_LOMAC_FLAG_RANGE) == 0)
945 			lomac_copy_range(subj, new);
946 
947 		/*
948 		 * To change the LOMAC range on a credential, the new range
949 		 * label must be in the current range.
950 		 */
951 		if (!lomac_range_in_range(new, subj))
952 			return (EPERM);
953 
954 		/*
955 		 * To change the LOMAC single label on a credential, the new
956 		 * single label must be in the new range.  Implicitly from
957 		 * the previous check, the new single is in the old range.
958 		 */
959 		if (!lomac_single_in_range(new, new))
960 			return (EPERM);
961 
962 		/*
963 		 * To have EQUAL in any component of the new credential LOMAC
964 		 * label, the subject must already have EQUAL in their label.
965 		 */
966 		if (lomac_contains_equal(new)) {
967 			error = lomac_subject_privileged(subj);
968 			if (error)
969 				return (error);
970 		}
971 
972 		/*
973 		 * XXXMAC: Additional consistency tests regarding the single
974 		 * and range of the new label might be performed here.
975 		 */
976 	}
977 
978 	return (0);
979 }
980 
981 static int
982 lomac_cred_check_visible(struct ucred *cr1, struct ucred *cr2)
983 {
984 	struct mac_lomac *subj, *obj;
985 
986 	if (!lomac_enabled)
987 		return (0);
988 
989 	subj = SLOT(cr1->cr_label);
990 	obj = SLOT(cr2->cr_label);
991 
992 	/* XXX: range */
993 	if (!lomac_dominate_single(obj, subj))
994 		return (ESRCH);
995 
996 	return (0);
997 }
998 static void
999 lomac_cred_relabel(struct ucred *cred, struct label *newlabel)
1000 {
1001 	struct mac_lomac *source, *dest;
1002 
1003 	source = SLOT(newlabel);
1004 	dest = SLOT(cred->cr_label);
1005 
1006 	try_relabel(source, dest);
1007 }
1008 
1009 static void
1010 lomac_devfs_create_device(struct ucred *cred, struct mount *mp,
1011     struct cdev *dev, struct devfs_dirent *de, struct label *delabel)
1012 {
1013 	struct mac_lomac *ml;
1014 	int lomac_type;
1015 
1016 	ml = SLOT(delabel);
1017 	if (strcmp(dev->si_name, "null") == 0 ||
1018 	    strcmp(dev->si_name, "zero") == 0 ||
1019 	    strcmp(dev->si_name, "random") == 0 ||
1020 	    strncmp(dev->si_name, "fd/", strlen("fd/")) == 0 ||
1021 	    strncmp(dev->si_name, "ttyv", strlen("ttyv")) == 0)
1022 		lomac_type = MAC_LOMAC_TYPE_EQUAL;
1023 	else if (ptys_equal &&
1024 	    (strncmp(dev->si_name, "ttyp", strlen("ttyp")) == 0 ||
1025 	    strncmp(dev->si_name, "ptyp", strlen("ptyp")) == 0))
1026 		lomac_type = MAC_LOMAC_TYPE_EQUAL;
1027 	else
1028 		lomac_type = MAC_LOMAC_TYPE_HIGH;
1029 	lomac_set_single(ml, lomac_type, 0);
1030 }
1031 
1032 static void
1033 lomac_devfs_create_directory(struct mount *mp, char *dirname, int dirnamelen,
1034     struct devfs_dirent *de, struct label *delabel)
1035 {
1036 	struct mac_lomac *ml;
1037 
1038 	ml = SLOT(delabel);
1039 	lomac_set_single(ml, MAC_LOMAC_TYPE_HIGH, 0);
1040 }
1041 
1042 static void
1043 lomac_devfs_create_symlink(struct ucred *cred, struct mount *mp,
1044     struct devfs_dirent *dd, struct label *ddlabel, struct devfs_dirent *de,
1045     struct label *delabel)
1046 {
1047 	struct mac_lomac *source, *dest;
1048 
1049 	source = SLOT(cred->cr_label);
1050 	dest = SLOT(delabel);
1051 
1052 	lomac_copy_single(source, dest);
1053 }
1054 
1055 static void
1056 lomac_devfs_update(struct mount *mp, struct devfs_dirent *de,
1057     struct label *delabel, struct vnode *vp, struct label *vplabel)
1058 {
1059 	struct mac_lomac *source, *dest;
1060 
1061 	source = SLOT(vplabel);
1062 	dest = SLOT(delabel);
1063 
1064 	lomac_copy(source, dest);
1065 }
1066 
1067 static void
1068 lomac_devfs_vnode_associate(struct mount *mp, struct label *mplabel,
1069     struct devfs_dirent *de, struct label *delabel, struct vnode *vp,
1070     struct label *vplabel)
1071 {
1072 	struct mac_lomac *source, *dest;
1073 
1074 	source = SLOT(delabel);
1075 	dest = SLOT(vplabel);
1076 
1077 	lomac_copy_single(source, dest);
1078 }
1079 
1080 static int
1081 lomac_ifnet_check_relabel(struct ucred *cred, struct ifnet *ifp,
1082     struct label *ifplabel, struct label *newlabel)
1083 {
1084 	struct mac_lomac *subj, *new;
1085 	int error;
1086 
1087 	subj = SLOT(cred->cr_label);
1088 	new = SLOT(newlabel);
1089 
1090 	/*
1091 	 * If there is a LOMAC label update for the interface, it may be an
1092 	 * update of the single, range, or both.
1093 	 */
1094 	error = lomac_atmostflags(new, MAC_LOMAC_FLAGS_BOTH);
1095 	if (error)
1096 		return (error);
1097 
1098 	/*
1099 	 * Relabling network interfaces requires LOMAC privilege.
1100 	 */
1101 	error = lomac_subject_privileged(subj);
1102 	if (error)
1103 		return (error);
1104 
1105 	/*
1106 	 * If the LOMAC label is to be changed, authorize as appropriate.
1107 	 */
1108 	if (new->ml_flags & MAC_LOMAC_FLAGS_BOTH) {
1109 		/*
1110 		 * Fill in the missing parts from the previous label.
1111 		 */
1112 		if ((new->ml_flags & MAC_LOMAC_FLAG_SINGLE) == 0)
1113 			lomac_copy_single(subj, new);
1114 		if ((new->ml_flags & MAC_LOMAC_FLAG_RANGE) == 0)
1115 			lomac_copy_range(subj, new);
1116 
1117 		/*
1118 		 * Rely on the traditional superuser status for the LOMAC
1119 		 * interface relabel requirements.  XXXMAC: This will go
1120 		 * away.
1121 		 *
1122 		 * XXXRW: This is also redundant to a higher layer check.
1123 		 */
1124 		error = priv_check_cred(cred, PRIV_NET_SETIFMAC, 0);
1125 		if (error)
1126 			return (EPERM);
1127 
1128 		/*
1129 		 * XXXMAC: Additional consistency tests regarding the single
1130 		 * and the range of the new label might be performed here.
1131 		 */
1132 	}
1133 
1134 	return (0);
1135 }
1136 
1137 static int
1138 lomac_ifnet_check_transmit(struct ifnet *ifp, struct label *ifplabel,
1139     struct mbuf *m, struct label *mlabel)
1140 {
1141 	struct mac_lomac *p, *i;
1142 
1143 	if (!lomac_enabled)
1144 		return (0);
1145 
1146 	p = SLOT(mlabel);
1147 	i = SLOT(ifplabel);
1148 
1149 	return (lomac_single_in_range(p, i) ? 0 : EACCES);
1150 }
1151 
1152 static void
1153 lomac_ifnet_create(struct ifnet *ifp, struct label *ifplabel)
1154 {
1155 	char tifname[IFNAMSIZ], *p, *q;
1156 	char tiflist[sizeof(trusted_interfaces)];
1157 	struct mac_lomac *dest;
1158 	int len, grade;
1159 
1160 	dest = SLOT(ifplabel);
1161 
1162 	if (ifp->if_type == IFT_LOOP) {
1163 		grade = MAC_LOMAC_TYPE_EQUAL;
1164 		goto set;
1165 	}
1166 
1167 	if (trust_all_interfaces) {
1168 		grade = MAC_LOMAC_TYPE_HIGH;
1169 		goto set;
1170 	}
1171 
1172 	grade = MAC_LOMAC_TYPE_LOW;
1173 
1174 	if (trusted_interfaces[0] == '\0' ||
1175 	    !strvalid(trusted_interfaces, sizeof(trusted_interfaces)))
1176 		goto set;
1177 
1178 	bzero(tiflist, sizeof(tiflist));
1179 	for (p = trusted_interfaces, q = tiflist; *p != '\0'; p++, q++)
1180 		if(*p != ' ' && *p != '\t')
1181 			*q = *p;
1182 
1183 	for (p = q = tiflist;; p++) {
1184 		if (*p == ',' || *p == '\0') {
1185 			len = p - q;
1186 			if (len < IFNAMSIZ) {
1187 				bzero(tifname, sizeof(tifname));
1188 				bcopy(q, tifname, len);
1189 				if (strcmp(tifname, ifp->if_xname) == 0) {
1190 					grade = MAC_LOMAC_TYPE_HIGH;
1191 					break;
1192 				}
1193 			}
1194 			else {
1195 				*p = '\0';
1196 				printf("MAC/LOMAC warning: interface name "
1197 				    "\"%s\" is too long (must be < %d)\n",
1198 				    q, IFNAMSIZ);
1199 			}
1200 			if (*p == '\0')
1201 				break;
1202 			q = p + 1;
1203 		}
1204 	}
1205 set:
1206 	lomac_set_single(dest, grade, 0);
1207 	lomac_set_range(dest, grade, 0, grade, 0);
1208 }
1209 
1210 static void
1211 lomac_ifnet_create_mbuf(struct ifnet *ifp, struct label *ifplabel,
1212     struct mbuf *m, struct label *mlabel)
1213 {
1214 	struct mac_lomac *source, *dest;
1215 
1216 	source = SLOT(ifplabel);
1217 	dest = SLOT(mlabel);
1218 
1219 	lomac_copy_single(source, dest);
1220 }
1221 
1222 static void
1223 lomac_ifnet_relabel(struct ucred *cred, struct ifnet *ifp,
1224     struct label *ifplabel, struct label *newlabel)
1225 {
1226 	struct mac_lomac *source, *dest;
1227 
1228 	source = SLOT(newlabel);
1229 	dest = SLOT(ifplabel);
1230 
1231 	try_relabel(source, dest);
1232 }
1233 
1234 static int
1235 lomac_inpcb_check_deliver(struct inpcb *inp, struct label *inplabel,
1236     struct mbuf *m, struct label *mlabel)
1237 {
1238 	struct mac_lomac *p, *i;
1239 
1240 	if (!lomac_enabled)
1241 		return (0);
1242 
1243 	p = SLOT(mlabel);
1244 	i = SLOT(inplabel);
1245 
1246 	return (lomac_equal_single(p, i) ? 0 : EACCES);
1247 }
1248 
1249 static void
1250 lomac_inpcb_create(struct socket *so, struct label *solabel,
1251     struct inpcb *inp, struct label *inplabel)
1252 {
1253 	struct mac_lomac *source, *dest;
1254 
1255 	source = SLOT(solabel);
1256 	dest = SLOT(inplabel);
1257 
1258 	lomac_copy_single(source, dest);
1259 }
1260 
1261 static void
1262 lomac_inpcb_create_mbuf(struct inpcb *inp, struct label *inplabel,
1263     struct mbuf *m, struct label *mlabel)
1264 {
1265 	struct mac_lomac *source, *dest;
1266 
1267 	source = SLOT(inplabel);
1268 	dest = SLOT(mlabel);
1269 
1270 	lomac_copy_single(source, dest);
1271 }
1272 
1273 static void
1274 lomac_inpcb_sosetlabel(struct socket *so, struct label *solabel,
1275     struct inpcb *inp, struct label *inplabel)
1276 {
1277 	struct mac_lomac *source, *dest;
1278 
1279 	source = SLOT(solabel);
1280 	dest = SLOT(inplabel);
1281 
1282 	lomac_copy_single(source, dest);
1283 }
1284 
1285 static void
1286 lomac_ipq_create(struct mbuf *m, struct label *mlabel, struct ipq *ipq,
1287     struct label *ipqlabel)
1288 {
1289 	struct mac_lomac *source, *dest;
1290 
1291 	source = SLOT(mlabel);
1292 	dest = SLOT(ipqlabel);
1293 
1294 	lomac_copy_single(source, dest);
1295 }
1296 
1297 static int
1298 lomac_ipq_match(struct mbuf *m, struct label *mlabel, struct ipq *ipq,
1299     struct label *ipqlabel)
1300 {
1301 	struct mac_lomac *a, *b;
1302 
1303 	a = SLOT(ipqlabel);
1304 	b = SLOT(mlabel);
1305 
1306 	return (lomac_equal_single(a, b));
1307 }
1308 
1309 static void
1310 lomac_ipq_reassemble(struct ipq *ipq, struct label *ipqlabel,
1311     struct mbuf *m, struct label *mlabel)
1312 {
1313 	struct mac_lomac *source, *dest;
1314 
1315 	source = SLOT(ipqlabel);
1316 	dest = SLOT(mlabel);
1317 
1318 	/* Just use the head, since we require them all to match. */
1319 	lomac_copy_single(source, dest);
1320 }
1321 
1322 static void
1323 lomac_ipq_update(struct mbuf *m, struct label *mlabel, struct ipq *ipq,
1324     struct label *ipqlabel)
1325 {
1326 
1327 	/* NOOP: we only accept matching labels, so no need to update */
1328 }
1329 
1330 static int
1331 lomac_kld_check_load(struct ucred *cred, struct vnode *vp,
1332     struct label *vplabel)
1333 {
1334 	struct mac_lomac *subj, *obj;
1335 
1336 	if (!lomac_enabled)
1337 		return (0);
1338 
1339 	subj = SLOT(cred->cr_label);
1340 	obj = SLOT(vplabel);
1341 
1342 	if (lomac_subject_privileged(subj))
1343 		return (EPERM);
1344 
1345 	if (!lomac_high_single(obj))
1346 		return (EACCES);
1347 
1348 	return (0);
1349 }
1350 
1351 static void
1352 lomac_mount_create(struct ucred *cred, struct mount *mp,
1353     struct label *mplabel)
1354 {
1355 	struct mac_lomac *source, *dest;
1356 
1357 	source = SLOT(cred->cr_label);
1358 	dest = SLOT(mplabel);
1359 	lomac_copy_single(source, dest);
1360 }
1361 
1362 static void
1363 lomac_netatalk_aarp_send(struct ifnet *ifp, struct label *ifplabel,
1364     struct mbuf *m, struct label *mlabel)
1365 {
1366 	struct mac_lomac *dest;
1367 
1368 	dest = SLOT(mlabel);
1369 
1370 	lomac_set_single(dest, MAC_LOMAC_TYPE_EQUAL, 0);
1371 }
1372 
1373 static void
1374 lomac_netinet_arp_send(struct ifnet *ifp, struct label *ifplabel,
1375     struct mbuf *m, struct label *mlabel)
1376 {
1377 	struct mac_lomac *dest;
1378 
1379 	dest = SLOT(mlabel);
1380 
1381 	lomac_set_single(dest, MAC_LOMAC_TYPE_EQUAL, 0);
1382 }
1383 
1384 static void
1385 lomac_netinet_firewall_reply(struct mbuf *mrecv, struct label *mrecvlabel,
1386     struct mbuf *msend, struct label *msendlabel)
1387 {
1388 	struct mac_lomac *source, *dest;
1389 
1390 	source = SLOT(mrecvlabel);
1391 	dest = SLOT(msendlabel);
1392 
1393 	lomac_copy_single(source, dest);
1394 }
1395 
1396 static void
1397 lomac_netinet_firewall_send(struct mbuf *m, struct label *mlabel)
1398 {
1399 	struct mac_lomac *dest;
1400 
1401 	dest = SLOT(mlabel);
1402 
1403 	/* XXX: where is the label for the firewall really comming from? */
1404 	lomac_set_single(dest, MAC_LOMAC_TYPE_EQUAL, 0);
1405 }
1406 
1407 static void
1408 lomac_netinet_fragment(struct mbuf *m, struct label *mlabel,
1409     struct mbuf *frag, struct label *fraglabel)
1410 {
1411 	struct mac_lomac *source, *dest;
1412 
1413 	source = SLOT(mlabel);
1414 	dest = SLOT(fraglabel);
1415 
1416 	lomac_copy_single(source, dest);
1417 }
1418 
1419 static void
1420 lomac_netinet_icmp_reply(struct mbuf *mrecv, struct label *mrecvlabel,
1421     struct mbuf *msend, struct label *msendlabel)
1422 {
1423 	struct mac_lomac *source, *dest;
1424 
1425 	source = SLOT(mrecvlabel);
1426 	dest = SLOT(msendlabel);
1427 
1428 	lomac_copy_single(source, dest);
1429 }
1430 
1431 static void
1432 lomac_netinet_igmp_send(struct ifnet *ifp, struct label *ifplabel,
1433     struct mbuf *m, struct label *mlabel)
1434 {
1435 	struct mac_lomac *dest;
1436 
1437 	dest = SLOT(mlabel);
1438 
1439 	lomac_set_single(dest, MAC_LOMAC_TYPE_EQUAL, 0);
1440 }
1441 
1442 static void
1443 lomac_netinet6_nd6_send(struct ifnet *ifp, struct label *ifplabel,
1444     struct mbuf *m, struct label *mlabel)
1445 {
1446 	struct mac_lomac *dest;
1447 
1448 	dest = SLOT(mlabel);
1449 
1450 	lomac_set_single(dest, MAC_LOMAC_TYPE_EQUAL, 0);
1451 }
1452 
1453 static int
1454 lomac_pipe_check_ioctl(struct ucred *cred, struct pipepair *pp,
1455     struct label *pplabel, unsigned long cmd, void /* caddr_t */ *data)
1456 {
1457 
1458 	if (!lomac_enabled)
1459 		return (0);
1460 
1461 	/* XXX: This will be implemented soon... */
1462 
1463 	return (0);
1464 }
1465 
1466 static int
1467 lomac_pipe_check_read(struct ucred *cred, struct pipepair *pp,
1468     struct label *pplabel)
1469 {
1470 	struct mac_lomac *subj, *obj;
1471 
1472 	if (!lomac_enabled)
1473 		return (0);
1474 
1475 	subj = SLOT(cred->cr_label);
1476 	obj = SLOT(pplabel);
1477 
1478 	if (!lomac_dominate_single(obj, subj))
1479 		return (maybe_demote(subj, obj, "reading", "pipe", NULL));
1480 
1481 	return (0);
1482 }
1483 
1484 static int
1485 lomac_pipe_check_relabel(struct ucred *cred, struct pipepair *pp,
1486     struct label *pplabel, struct label *newlabel)
1487 {
1488 	struct mac_lomac *subj, *obj, *new;
1489 	int error;
1490 
1491 	new = SLOT(newlabel);
1492 	subj = SLOT(cred->cr_label);
1493 	obj = SLOT(pplabel);
1494 
1495 	/*
1496 	 * If there is a LOMAC label update for a pipe, it must be a single
1497 	 * update.
1498 	 */
1499 	error = lomac_atmostflags(new, MAC_LOMAC_FLAG_SINGLE);
1500 	if (error)
1501 		return (error);
1502 
1503 	/*
1504 	 * To perform a relabel of a pipe (LOMAC label or not), LOMAC must
1505 	 * authorize the relabel.
1506 	 */
1507 	if (!lomac_single_in_range(obj, subj))
1508 		return (EPERM);
1509 
1510 	/*
1511 	 * If the LOMAC label is to be changed, authorize as appropriate.
1512 	 */
1513 	if (new->ml_flags & MAC_LOMAC_FLAG_SINGLE) {
1514 		/*
1515 		 * To change the LOMAC label on a pipe, the new pipe label
1516 		 * must be in the subject range.
1517 		 */
1518 		if (!lomac_single_in_range(new, subj))
1519 			return (EPERM);
1520 
1521 		/*
1522 		 * To change the LOMAC label on a pipe to be EQUAL, the
1523 		 * subject must have appropriate privilege.
1524 		 */
1525 		if (lomac_contains_equal(new)) {
1526 			error = lomac_subject_privileged(subj);
1527 			if (error)
1528 				return (error);
1529 		}
1530 	}
1531 
1532 	return (0);
1533 }
1534 
1535 static int
1536 lomac_pipe_check_write(struct ucred *cred, struct pipepair *pp,
1537     struct label *pplabel)
1538 {
1539 	struct mac_lomac *subj, *obj;
1540 
1541 	if (!lomac_enabled)
1542 		return (0);
1543 
1544 	subj = SLOT(cred->cr_label);
1545 	obj = SLOT(pplabel);
1546 
1547 	if (!lomac_subject_dominate(subj, obj))
1548 		return (EACCES);
1549 
1550 	return (0);
1551 }
1552 
1553 static void
1554 lomac_pipe_create(struct ucred *cred, struct pipepair *pp,
1555     struct label *pplabel)
1556 {
1557 	struct mac_lomac *source, *dest;
1558 
1559 	source = SLOT(cred->cr_label);
1560 	dest = SLOT(pplabel);
1561 
1562 	lomac_copy_single(source, dest);
1563 }
1564 
1565 static void
1566 lomac_pipe_relabel(struct ucred *cred, struct pipepair *pp,
1567     struct label *pplabel, struct label *newlabel)
1568 {
1569 	struct mac_lomac *source, *dest;
1570 
1571 	source = SLOT(newlabel);
1572 	dest = SLOT(pplabel);
1573 
1574 	try_relabel(source, dest);
1575 }
1576 
1577 /*
1578  * Some system privileges are allowed regardless of integrity grade; others
1579  * are allowed only when running with privilege with respect to the LOMAC
1580  * policy as they might otherwise allow bypassing of the integrity policy.
1581  */
1582 static int
1583 lomac_priv_check(struct ucred *cred, int priv)
1584 {
1585 	struct mac_lomac *subj;
1586 	int error;
1587 
1588 	if (!lomac_enabled)
1589 		return (0);
1590 
1591 	/*
1592 	 * Exempt only specific privileges from the LOMAC integrity policy.
1593 	 */
1594 	switch (priv) {
1595 	case PRIV_KTRACE:
1596 	case PRIV_MSGBUF:
1597 
1598 	/*
1599 	 * Allow processes to manipulate basic process audit properties, and
1600 	 * to submit audit records.
1601 	 */
1602 	case PRIV_AUDIT_GETAUDIT:
1603 	case PRIV_AUDIT_SETAUDIT:
1604 	case PRIV_AUDIT_SUBMIT:
1605 
1606 	/*
1607 	 * Allow processes to manipulate their regular UNIX credentials.
1608 	 */
1609 	case PRIV_CRED_SETUID:
1610 	case PRIV_CRED_SETEUID:
1611 	case PRIV_CRED_SETGID:
1612 	case PRIV_CRED_SETEGID:
1613 	case PRIV_CRED_SETGROUPS:
1614 	case PRIV_CRED_SETREUID:
1615 	case PRIV_CRED_SETREGID:
1616 	case PRIV_CRED_SETRESUID:
1617 	case PRIV_CRED_SETRESGID:
1618 
1619 	/*
1620 	 * Allow processes to perform system monitoring.
1621 	 */
1622 	case PRIV_SEEOTHERGIDS:
1623 	case PRIV_SEEOTHERUIDS:
1624 		break;
1625 
1626 	/*
1627 	 * Allow access to general process debugging facilities.  We
1628 	 * separately control debugging based on MAC label.
1629 	 */
1630 	case PRIV_DEBUG_DIFFCRED:
1631 	case PRIV_DEBUG_SUGID:
1632 	case PRIV_DEBUG_UNPRIV:
1633 
1634 	/*
1635 	 * Allow manipulating jails.
1636 	 */
1637 	case PRIV_JAIL_ATTACH:
1638 
1639 	/*
1640 	 * Allow privilege with respect to the Partition policy, but not the
1641 	 * Privs policy.
1642 	 */
1643 	case PRIV_MAC_PARTITION:
1644 
1645 	/*
1646 	 * Allow privilege with respect to process resource limits and login
1647 	 * context.
1648 	 */
1649 	case PRIV_PROC_LIMIT:
1650 	case PRIV_PROC_SETLOGIN:
1651 	case PRIV_PROC_SETRLIMIT:
1652 
1653 	/*
1654 	 * Allow System V and POSIX IPC privileges.
1655 	 */
1656 	case PRIV_IPC_READ:
1657 	case PRIV_IPC_WRITE:
1658 	case PRIV_IPC_ADMIN:
1659 	case PRIV_IPC_MSGSIZE:
1660 	case PRIV_MQ_ADMIN:
1661 
1662 	/*
1663 	 * Allow certain scheduler manipulations -- possibly this should be
1664 	 * controlled by more fine-grained policy, as potentially low
1665 	 * integrity processes can deny CPU to higher integrity ones.
1666 	 */
1667 	case PRIV_SCHED_DIFFCRED:
1668 	case PRIV_SCHED_SETPRIORITY:
1669 	case PRIV_SCHED_RTPRIO:
1670 	case PRIV_SCHED_SETPOLICY:
1671 	case PRIV_SCHED_SET:
1672 	case PRIV_SCHED_SETPARAM:
1673 
1674 	/*
1675 	 * More IPC privileges.
1676 	 */
1677 	case PRIV_SEM_WRITE:
1678 
1679 	/*
1680 	 * Allow signaling privileges subject to integrity policy.
1681 	 */
1682 	case PRIV_SIGNAL_DIFFCRED:
1683 	case PRIV_SIGNAL_SUGID:
1684 
1685 	/*
1686 	 * Allow access to only limited sysctls from lower integrity levels;
1687 	 * piggy-back on the Jail definition.
1688 	 */
1689 	case PRIV_SYSCTL_WRITEJAIL:
1690 
1691 	/*
1692 	 * Allow TTY-based privileges, subject to general device access using
1693 	 * labels on TTY device nodes, but not console privilege.
1694 	 */
1695 	case PRIV_TTY_DRAINWAIT:
1696 	case PRIV_TTY_DTRWAIT:
1697 	case PRIV_TTY_EXCLUSIVE:
1698 	case PRIV_TTY_PRISON:
1699 	case PRIV_TTY_STI:
1700 	case PRIV_TTY_SETA:
1701 
1702 	/*
1703 	 * Grant most VFS privileges, as almost all are in practice bounded
1704 	 * by more specific checks using labels.
1705 	 */
1706 	case PRIV_VFS_READ:
1707 	case PRIV_VFS_WRITE:
1708 	case PRIV_VFS_ADMIN:
1709 	case PRIV_VFS_EXEC:
1710 	case PRIV_VFS_LOOKUP:
1711 	case PRIV_VFS_CHFLAGS_DEV:
1712 	case PRIV_VFS_CHOWN:
1713 	case PRIV_VFS_CHROOT:
1714 	case PRIV_VFS_RETAINSUGID:
1715 	case PRIV_VFS_EXCEEDQUOTA:
1716 	case PRIV_VFS_FCHROOT:
1717 	case PRIV_VFS_FHOPEN:
1718 	case PRIV_VFS_FHSTATFS:
1719 	case PRIV_VFS_GENERATION:
1720 	case PRIV_VFS_GETFH:
1721 	case PRIV_VFS_GETQUOTA:
1722 	case PRIV_VFS_LINK:
1723 	case PRIV_VFS_MOUNT:
1724 	case PRIV_VFS_MOUNT_OWNER:
1725 	case PRIV_VFS_MOUNT_PERM:
1726 	case PRIV_VFS_MOUNT_SUIDDIR:
1727 	case PRIV_VFS_MOUNT_NONUSER:
1728 	case PRIV_VFS_SETGID:
1729 	case PRIV_VFS_STICKYFILE:
1730 	case PRIV_VFS_SYSFLAGS:
1731 	case PRIV_VFS_UNMOUNT:
1732 
1733 	/*
1734 	 * Allow VM privileges; it would be nice if these were subject to
1735 	 * resource limits.
1736 	 */
1737 	case PRIV_VM_MADV_PROTECT:
1738 	case PRIV_VM_MLOCK:
1739 	case PRIV_VM_MUNLOCK:
1740 
1741 	/*
1742 	 * Allow some but not all network privileges.  In general, dont allow
1743 	 * reconfiguring the network stack, just normal use.
1744 	 */
1745 	case PRIV_NETATALK_RESERVEDPORT:
1746 	case PRIV_NETINET_RESERVEDPORT:
1747 	case PRIV_NETINET_RAW:
1748 	case PRIV_NETINET_REUSEPORT:
1749 	case PRIV_NETIPX_RESERVEDPORT:
1750 	case PRIV_NETIPX_RAW:
1751 		break;
1752 
1753 	/*
1754 	 * All remaining system privileges are allow only if the process
1755 	 * holds privilege with respect to the LOMAC policy.
1756 	 */
1757 	default:
1758 		subj = SLOT(cred->cr_label);
1759 		error = lomac_subject_privileged(subj);
1760 		if (error)
1761 			return (error);
1762 	}
1763 	return (0);
1764 }
1765 
1766 static int
1767 lomac_proc_check_debug(struct ucred *cred, struct proc *p)
1768 {
1769 	struct mac_lomac *subj, *obj;
1770 
1771 	if (!lomac_enabled)
1772 		return (0);
1773 
1774 	subj = SLOT(cred->cr_label);
1775 	obj = SLOT(p->p_ucred->cr_label);
1776 
1777 	/* XXX: range checks */
1778 	if (!lomac_dominate_single(obj, subj))
1779 		return (ESRCH);
1780 	if (!lomac_subject_dominate(subj, obj))
1781 		return (EACCES);
1782 
1783 	return (0);
1784 }
1785 
1786 static int
1787 lomac_proc_check_sched(struct ucred *cred, struct proc *p)
1788 {
1789 	struct mac_lomac *subj, *obj;
1790 
1791 	if (!lomac_enabled)
1792 		return (0);
1793 
1794 	subj = SLOT(cred->cr_label);
1795 	obj = SLOT(p->p_ucred->cr_label);
1796 
1797 	/* XXX: range checks */
1798 	if (!lomac_dominate_single(obj, subj))
1799 		return (ESRCH);
1800 	if (!lomac_subject_dominate(subj, obj))
1801 		return (EACCES);
1802 
1803 	return (0);
1804 }
1805 
1806 static int
1807 lomac_proc_check_signal(struct ucred *cred, struct proc *p, int signum)
1808 {
1809 	struct mac_lomac *subj, *obj;
1810 
1811 	if (!lomac_enabled)
1812 		return (0);
1813 
1814 	subj = SLOT(cred->cr_label);
1815 	obj = SLOT(p->p_ucred->cr_label);
1816 
1817 	/* XXX: range checks */
1818 	if (!lomac_dominate_single(obj, subj))
1819 		return (ESRCH);
1820 	if (!lomac_subject_dominate(subj, obj))
1821 		return (EACCES);
1822 
1823 	return (0);
1824 }
1825 
1826 static void
1827 lomac_proc_create_init(struct ucred *cred)
1828 {
1829 	struct mac_lomac *dest;
1830 
1831 	dest = SLOT(cred->cr_label);
1832 
1833 	lomac_set_single(dest, MAC_LOMAC_TYPE_HIGH, 0);
1834 	lomac_set_range(dest, MAC_LOMAC_TYPE_LOW, 0, MAC_LOMAC_TYPE_HIGH, 0);
1835 }
1836 
1837 static void
1838 lomac_proc_create_swapper(struct ucred *cred)
1839 {
1840 	struct mac_lomac *dest;
1841 
1842 	dest = SLOT(cred->cr_label);
1843 
1844 	lomac_set_single(dest, MAC_LOMAC_TYPE_EQUAL, 0);
1845 	lomac_set_range(dest, MAC_LOMAC_TYPE_LOW, 0, MAC_LOMAC_TYPE_HIGH, 0);
1846 }
1847 
1848 static void
1849 lomac_proc_destroy_label(struct label *label)
1850 {
1851 
1852 	mtx_destroy(&PSLOT(label)->mtx);
1853 	FREE(PSLOT(label), M_LOMAC);
1854 	PSLOT_SET(label, NULL);
1855 }
1856 
1857 static void
1858 lomac_proc_init_label(struct label *label)
1859 {
1860 
1861 	PSLOT_SET(label, malloc(sizeof(struct mac_lomac_proc), M_LOMAC,
1862 	    M_ZERO | M_WAITOK));
1863 	mtx_init(&PSLOT(label)->mtx, "MAC/Lomac proc lock", NULL, MTX_DEF);
1864 }
1865 
1866 static int
1867 lomac_socket_check_deliver(struct socket *so, struct label *solabel,
1868     struct mbuf *m, struct label *mlabel)
1869 {
1870 	struct mac_lomac *p, *s;
1871 
1872 	if (!lomac_enabled)
1873 		return (0);
1874 
1875 	p = SLOT(mlabel);
1876 	s = SLOT(solabel);
1877 
1878 	return (lomac_equal_single(p, s) ? 0 : EACCES);
1879 }
1880 
1881 static int
1882 lomac_socket_check_relabel(struct ucred *cred, struct socket *so,
1883     struct label *solabel, struct label *newlabel)
1884 {
1885 	struct mac_lomac *subj, *obj, *new;
1886 	int error;
1887 
1888 	new = SLOT(newlabel);
1889 	subj = SLOT(cred->cr_label);
1890 	obj = SLOT(solabel);
1891 
1892 	/*
1893 	 * If there is a LOMAC label update for the socket, it may be an
1894 	 * update of single.
1895 	 */
1896 	error = lomac_atmostflags(new, MAC_LOMAC_FLAG_SINGLE);
1897 	if (error)
1898 		return (error);
1899 
1900 	/*
1901 	 * To relabel a socket, the old socket single must be in the subject
1902 	 * range.
1903 	 */
1904 	if (!lomac_single_in_range(obj, subj))
1905 		return (EPERM);
1906 
1907 	/*
1908 	 * If the LOMAC label is to be changed, authorize as appropriate.
1909 	 */
1910 	if (new->ml_flags & MAC_LOMAC_FLAG_SINGLE) {
1911 		/*
1912 		 * To relabel a socket, the new socket single must be in the
1913 		 * subject range.
1914 		 */
1915 		if (!lomac_single_in_range(new, subj))
1916 			return (EPERM);
1917 
1918 		/*
1919 		 * To change the LOMAC label on the socket to contain EQUAL,
1920 		 * the subject must have appropriate privilege.
1921 		 */
1922 		if (lomac_contains_equal(new)) {
1923 			error = lomac_subject_privileged(subj);
1924 			if (error)
1925 				return (error);
1926 		}
1927 	}
1928 
1929 	return (0);
1930 }
1931 
1932 static int
1933 lomac_socket_check_visible(struct ucred *cred, struct socket *so,
1934     struct label *solabel)
1935 {
1936 	struct mac_lomac *subj, *obj;
1937 
1938 	if (!lomac_enabled)
1939 		return (0);
1940 
1941 	subj = SLOT(cred->cr_label);
1942 	obj = SLOT(solabel);
1943 
1944 	if (!lomac_dominate_single(obj, subj))
1945 		return (ENOENT);
1946 
1947 	return (0);
1948 }
1949 
1950 static void
1951 lomac_socket_create(struct ucred *cred, struct socket *so,
1952     struct label *solabel)
1953 {
1954 	struct mac_lomac *source, *dest;
1955 
1956 	source = SLOT(cred->cr_label);
1957 	dest = SLOT(solabel);
1958 
1959 	lomac_copy_single(source, dest);
1960 }
1961 
1962 static void
1963 lomac_socket_create_mbuf(struct socket *so, struct label *solabel,
1964     struct mbuf *m, struct label *mlabel)
1965 {
1966 	struct mac_lomac *source, *dest;
1967 
1968 	source = SLOT(solabel);
1969 	dest = SLOT(mlabel);
1970 
1971 	lomac_copy_single(source, dest);
1972 }
1973 
1974 static void
1975 lomac_socket_newconn(struct socket *oldso, struct label *oldsolabel,
1976     struct socket *newso, struct label *newsolabel)
1977 {
1978 	struct mac_lomac *source, *dest;
1979 
1980 	source = SLOT(oldsolabel);
1981 	dest = SLOT(newsolabel);
1982 
1983 	lomac_copy_single(source, dest);
1984 }
1985 
1986 static void
1987 lomac_socket_relabel(struct ucred *cred, struct socket *so,
1988     struct label *solabel, struct label *newlabel)
1989 {
1990 	struct mac_lomac *source, *dest;
1991 
1992 	source = SLOT(newlabel);
1993 	dest = SLOT(solabel);
1994 
1995 	try_relabel(source, dest);
1996 }
1997 
1998 static void
1999 lomac_socketpeer_set_from_mbuf(struct mbuf *m, struct label *mlabel,
2000     struct socket *so, struct label *sopeerlabel)
2001 {
2002 	struct mac_lomac *source, *dest;
2003 
2004 	source = SLOT(mlabel);
2005 	dest = SLOT(sopeerlabel);
2006 
2007 	lomac_copy_single(source, dest);
2008 }
2009 
2010 static void
2011 lomac_socketpeer_set_from_socket(struct socket *oldso,
2012     struct label *oldsolabel, struct socket *newso,
2013     struct label *newsopeerlabel)
2014 {
2015 	struct mac_lomac *source, *dest;
2016 
2017 	source = SLOT(oldsolabel);
2018 	dest = SLOT(newsopeerlabel);
2019 
2020 	lomac_copy_single(source, dest);
2021 }
2022 
2023 static void
2024 lomac_syncache_create(struct label *label, struct inpcb *inp)
2025 {
2026 	struct mac_lomac *source, *dest;
2027 
2028 	source = SLOT(inp->inp_label);
2029 	dest = SLOT(label);
2030 	lomac_copy(source, dest);
2031 }
2032 
2033 static void
2034 lomac_syncache_create_mbuf(struct label *sc_label, struct mbuf *m,
2035     struct label *mlabel)
2036 {
2037 	struct mac_lomac *source, *dest;
2038 
2039 	source = SLOT(sc_label);
2040 	dest = SLOT(mlabel);
2041 	lomac_copy(source, dest);
2042 }
2043 
2044 static int
2045 lomac_system_check_acct(struct ucred *cred, struct vnode *vp,
2046     struct label *vplabel)
2047 {
2048 	struct mac_lomac *subj, *obj;
2049 
2050 	if (!lomac_enabled)
2051 		return (0);
2052 
2053 	subj = SLOT(cred->cr_label);
2054 	obj = SLOT(vplabel);
2055 
2056 	if (lomac_subject_privileged(subj))
2057 		return (EPERM);
2058 
2059 	if (!lomac_high_single(obj))
2060 		return (EACCES);
2061 
2062 	return (0);
2063 }
2064 
2065 static int
2066 lomac_system_check_auditctl(struct ucred *cred, struct vnode *vp,
2067     struct label *vplabel)
2068 {
2069 	struct mac_lomac *subj, *obj;
2070 
2071 	if (!lomac_enabled)
2072 		return (0);
2073 
2074 	subj = SLOT(cred->cr_label);
2075 	obj = SLOT(vplabel);
2076 
2077 	if (lomac_subject_privileged(subj))
2078 		return (EPERM);
2079 
2080 	if (!lomac_high_single(obj))
2081 		return (EACCES);
2082 
2083 	return (0);
2084 }
2085 
2086 static int
2087 lomac_system_check_swapoff(struct ucred *cred, struct vnode *vp,
2088     struct label *vplabel)
2089 {
2090 	struct mac_lomac *subj;
2091 
2092 	if (!lomac_enabled)
2093 		return (0);
2094 
2095 	subj = SLOT(cred->cr_label);
2096 
2097 	if (lomac_subject_privileged(subj))
2098 		return (EPERM);
2099 
2100 	return (0);
2101 }
2102 
2103 static int
2104 lomac_system_check_swapon(struct ucred *cred, struct vnode *vp,
2105     struct label *vplabel)
2106 {
2107 	struct mac_lomac *subj, *obj;
2108 
2109 	if (!lomac_enabled)
2110 		return (0);
2111 
2112 	subj = SLOT(cred->cr_label);
2113 	obj = SLOT(vplabel);
2114 
2115 	if (lomac_subject_privileged(subj))
2116 		return (EPERM);
2117 
2118 	if (!lomac_high_single(obj))
2119 		return (EACCES);
2120 
2121 	return (0);
2122 }
2123 
2124 static int
2125 lomac_system_check_sysctl(struct ucred *cred, struct sysctl_oid *oidp,
2126     void *arg1, int arg2, struct sysctl_req *req)
2127 {
2128 	struct mac_lomac *subj;
2129 
2130 	if (!lomac_enabled)
2131 		return (0);
2132 
2133 	subj = SLOT(cred->cr_label);
2134 
2135 	/*
2136 	 * Treat sysctl variables without CTLFLAG_ANYBODY flag as lomac/high,
2137 	 * but also require privilege to change them.
2138 	 */
2139 	if (req->newptr != NULL && (oidp->oid_kind & CTLFLAG_ANYBODY) == 0) {
2140 #ifdef notdef
2141 		if (!lomac_subject_dominate_high(subj))
2142 			return (EACCES);
2143 #endif
2144 
2145 		if (lomac_subject_privileged(subj))
2146 			return (EPERM);
2147 	}
2148 
2149 	return (0);
2150 }
2151 
2152 static void
2153 lomac_thread_userret(struct thread *td)
2154 {
2155 	struct proc *p = td->td_proc;
2156 	struct mac_lomac_proc *subj = PSLOT(p->p_label);
2157 	struct ucred *newcred, *oldcred;
2158 	int dodrop;
2159 
2160 	mtx_lock(&subj->mtx);
2161 	if (subj->mac_lomac.ml_flags & MAC_LOMAC_FLAG_UPDATE) {
2162 		dodrop = 0;
2163 		mtx_unlock(&subj->mtx);
2164 		newcred = crget();
2165 		/*
2166 		 * Prevent a lock order reversal in
2167 		 * mac_cred_mmapped_drop_perms; ideally, the other user of
2168 		 * subj->mtx wouldn't be holding Giant.
2169 		 */
2170 		mtx_lock(&Giant);
2171 		PROC_LOCK(p);
2172 		mtx_lock(&subj->mtx);
2173 		/*
2174 		 * Check if we lost the race while allocating the cred.
2175 		 */
2176 		if ((subj->mac_lomac.ml_flags & MAC_LOMAC_FLAG_UPDATE) == 0) {
2177 			crfree(newcred);
2178 			goto out;
2179 		}
2180 		oldcred = p->p_ucred;
2181 		crcopy(newcred, oldcred);
2182 		crhold(newcred);
2183 		lomac_copy(&subj->mac_lomac, SLOT(newcred->cr_label));
2184 		p->p_ucred = newcred;
2185 		crfree(oldcred);
2186 		dodrop = 1;
2187 	out:
2188 		mtx_unlock(&subj->mtx);
2189 		PROC_UNLOCK(p);
2190 		if (dodrop)
2191 			mac_cred_mmapped_drop_perms(curthread, newcred);
2192 		mtx_unlock(&Giant);
2193 	} else {
2194 		mtx_unlock(&subj->mtx);
2195 	}
2196 }
2197 
2198 static int
2199 lomac_vnode_associate_extattr(struct mount *mp, struct label *mplabel,
2200     struct vnode *vp, struct label *vplabel)
2201 {
2202 	struct mac_lomac ml_temp, *source, *dest;
2203 	int buflen, error;
2204 
2205 	source = SLOT(mplabel);
2206 	dest = SLOT(vplabel);
2207 
2208 	buflen = sizeof(ml_temp);
2209 	bzero(&ml_temp, buflen);
2210 
2211 	error = vn_extattr_get(vp, IO_NODELOCKED, MAC_LOMAC_EXTATTR_NAMESPACE,
2212 	    MAC_LOMAC_EXTATTR_NAME, &buflen, (char *)&ml_temp, curthread);
2213 	if (error == ENOATTR || error == EOPNOTSUPP) {
2214 		/* Fall back to the mntlabel. */
2215 		lomac_copy_single(source, dest);
2216 		return (0);
2217 	} else if (error)
2218 		return (error);
2219 
2220 	if (buflen != sizeof(ml_temp)) {
2221 		if (buflen != sizeof(ml_temp) - sizeof(ml_temp.ml_auxsingle)) {
2222 			printf("lomac_vnode_associate_extattr: bad size %d\n",
2223 			    buflen);
2224 			return (EPERM);
2225 		}
2226 		bzero(&ml_temp.ml_auxsingle, sizeof(ml_temp.ml_auxsingle));
2227 		buflen = sizeof(ml_temp);
2228 		(void)vn_extattr_set(vp, IO_NODELOCKED,
2229 		    MAC_LOMAC_EXTATTR_NAMESPACE, MAC_LOMAC_EXTATTR_NAME,
2230 		    buflen, (char *)&ml_temp, curthread);
2231 	}
2232 	if (lomac_valid(&ml_temp) != 0) {
2233 		printf("lomac_vnode_associate_extattr: invalid\n");
2234 		return (EPERM);
2235 	}
2236 	if ((ml_temp.ml_flags & MAC_LOMAC_FLAGS_BOTH) !=
2237 	    MAC_LOMAC_FLAG_SINGLE) {
2238 		printf("lomac_vnode_associate_extattr: not single\n");
2239 		return (EPERM);
2240 	}
2241 
2242 	lomac_copy_single(&ml_temp, dest);
2243 	return (0);
2244 }
2245 
2246 static void
2247 lomac_vnode_associate_singlelabel(struct mount *mp, struct label *mplabel,
2248     struct vnode *vp, struct label *vplabel)
2249 {
2250 	struct mac_lomac *source, *dest;
2251 
2252 	source = SLOT(mplabel);
2253 	dest = SLOT(vplabel);
2254 
2255 	lomac_copy_single(source, dest);
2256 }
2257 
2258 static int
2259 lomac_vnode_check_create(struct ucred *cred, struct vnode *dvp,
2260     struct label *dvplabel, struct componentname *cnp, struct vattr *vap)
2261 {
2262 	struct mac_lomac *subj, *obj;
2263 
2264 	if (!lomac_enabled)
2265 		return (0);
2266 
2267 	subj = SLOT(cred->cr_label);
2268 	obj = SLOT(dvplabel);
2269 
2270 	if (!lomac_subject_dominate(subj, obj))
2271 		return (EACCES);
2272 	if (obj->ml_flags & MAC_LOMAC_FLAG_AUX &&
2273 	    !lomac_dominate_element(&subj->ml_single, &obj->ml_auxsingle))
2274 		return (EACCES);
2275 
2276 	return (0);
2277 }
2278 
2279 static int
2280 lomac_vnode_check_deleteacl(struct ucred *cred, struct vnode *vp,
2281     struct label *vplabel, acl_type_t type)
2282 {
2283 	struct mac_lomac *subj, *obj;
2284 
2285 	if (!lomac_enabled)
2286 		return (0);
2287 
2288 	subj = SLOT(cred->cr_label);
2289 	obj = SLOT(vplabel);
2290 
2291 	if (!lomac_subject_dominate(subj, obj))
2292 		return (EACCES);
2293 
2294 	return (0);
2295 }
2296 
2297 static int
2298 lomac_vnode_check_link(struct ucred *cred, struct vnode *dvp,
2299     struct label *dvplabel, struct vnode *vp, struct label *vplabel,
2300     struct componentname *cnp)
2301 {
2302 	struct mac_lomac *subj, *obj;
2303 
2304 	if (!lomac_enabled)
2305 		return (0);
2306 
2307 	subj = SLOT(cred->cr_label);
2308 	obj = SLOT(dvplabel);
2309 
2310 	if (!lomac_subject_dominate(subj, obj))
2311 		return (EACCES);
2312 
2313 	obj = SLOT(vplabel);
2314 
2315 	if (!lomac_subject_dominate(subj, obj))
2316 		return (EACCES);
2317 
2318 	return (0);
2319 }
2320 
2321 static int
2322 lomac_vnode_check_mmap(struct ucred *cred, struct vnode *vp,
2323     struct label *vplabel, int prot, int flags)
2324 {
2325 	struct mac_lomac *subj, *obj;
2326 
2327 	/*
2328 	 * Rely on the use of open()-time protections to handle
2329 	 * non-revocation cases.
2330 	 */
2331 	if (!lomac_enabled)
2332 		return (0);
2333 
2334 	subj = SLOT(cred->cr_label);
2335 	obj = SLOT(vplabel);
2336 
2337 	if (((prot & VM_PROT_WRITE) != 0) && ((flags & MAP_SHARED) != 0)) {
2338 		if (!lomac_subject_dominate(subj, obj))
2339 			return (EACCES);
2340 	}
2341 	if (prot & (VM_PROT_READ | VM_PROT_EXECUTE)) {
2342 		if (!lomac_dominate_single(obj, subj))
2343 			return (maybe_demote(subj, obj, "mapping", "file", vp));
2344 	}
2345 
2346 	return (0);
2347 }
2348 
2349 static void
2350 lomac_vnode_check_mmap_downgrade(struct ucred *cred, struct vnode *vp,
2351     struct label *vplabel, /* XXX vm_prot_t */ int *prot)
2352 {
2353 	struct mac_lomac *subj, *obj;
2354 
2355 	/*
2356 	 * Rely on the use of open()-time protections to handle
2357 	 * non-revocation cases.
2358 	 */
2359 	if (!lomac_enabled || !revocation_enabled)
2360 		return;
2361 
2362 	subj = SLOT(cred->cr_label);
2363 	obj = SLOT(vplabel);
2364 
2365 	if (!lomac_subject_dominate(subj, obj))
2366 		*prot &= ~VM_PROT_WRITE;
2367 }
2368 
2369 static int
2370 lomac_vnode_check_open(struct ucred *cred, struct vnode *vp,
2371     struct label *vplabel, int acc_mode)
2372 {
2373 	struct mac_lomac *subj, *obj;
2374 
2375 	if (!lomac_enabled)
2376 		return (0);
2377 
2378 	subj = SLOT(cred->cr_label);
2379 	obj = SLOT(vplabel);
2380 
2381 	/* XXX privilege override for admin? */
2382 	if (acc_mode & (VWRITE | VAPPEND | VADMIN)) {
2383 		if (!lomac_subject_dominate(subj, obj))
2384 			return (EACCES);
2385 	}
2386 
2387 	return (0);
2388 }
2389 
2390 static int
2391 lomac_vnode_check_read(struct ucred *active_cred, struct ucred *file_cred,
2392     struct vnode *vp, struct label *vplabel)
2393 {
2394 	struct mac_lomac *subj, *obj;
2395 
2396 	if (!lomac_enabled || !revocation_enabled)
2397 		return (0);
2398 
2399 	subj = SLOT(active_cred->cr_label);
2400 	obj = SLOT(vplabel);
2401 
2402 	if (!lomac_dominate_single(obj, subj))
2403 		return (maybe_demote(subj, obj, "reading", "file", vp));
2404 
2405 	return (0);
2406 }
2407 
2408 static int
2409 lomac_vnode_check_relabel(struct ucred *cred, struct vnode *vp,
2410     struct label *vplabel, struct label *newlabel)
2411 {
2412 	struct mac_lomac *old, *new, *subj;
2413 	int error;
2414 
2415 	old = SLOT(vplabel);
2416 	new = SLOT(newlabel);
2417 	subj = SLOT(cred->cr_label);
2418 
2419 	/*
2420 	 * If there is a LOMAC label update for the vnode, it must be a
2421 	 * single label, with an optional explicit auxiliary single.
2422 	 */
2423 	error = lomac_atmostflags(new,
2424 	    MAC_LOMAC_FLAG_SINGLE | MAC_LOMAC_FLAG_AUX);
2425 	if (error)
2426 		return (error);
2427 
2428 	/*
2429 	 * To perform a relabel of the vnode (LOMAC label or not), LOMAC must
2430 	 * authorize the relabel.
2431 	 */
2432 	if (!lomac_single_in_range(old, subj))
2433 		return (EPERM);
2434 
2435 	/*
2436 	 * If the LOMAC label is to be changed, authorize as appropriate.
2437 	 */
2438 	if (new->ml_flags & MAC_LOMAC_FLAG_SINGLE) {
2439 		/*
2440 		 * To change the LOMAC label on a vnode, the new vnode label
2441 		 * must be in the subject range.
2442 		 */
2443 		if (!lomac_single_in_range(new, subj))
2444 			return (EPERM);
2445 
2446 		/*
2447 		 * To change the LOMAC label on the vnode to be EQUAL, the
2448 		 * subject must have appropriate privilege.
2449 		 */
2450 		if (lomac_contains_equal(new)) {
2451 			error = lomac_subject_privileged(subj);
2452 			if (error)
2453 				return (error);
2454 		}
2455 	}
2456 	if (new->ml_flags & MAC_LOMAC_FLAG_AUX) {
2457 		/*
2458 		 * Fill in the missing parts from the previous label.
2459 		 */
2460 		if ((new->ml_flags & MAC_LOMAC_FLAG_SINGLE) == 0)
2461 			lomac_copy_single(subj, new);
2462 
2463 		/*
2464 		 * To change the auxiliary LOMAC label on a vnode, the new
2465 		 * vnode label must be in the subject range.
2466 		 */
2467 		if (!lomac_auxsingle_in_range(new, subj))
2468 			return (EPERM);
2469 
2470 		/*
2471 		 * To change the auxiliary LOMAC label on the vnode to be
2472 		 * EQUAL, the subject must have appropriate privilege.
2473 		 */
2474 		if (lomac_contains_equal(new)) {
2475 			error = lomac_subject_privileged(subj);
2476 			if (error)
2477 				return (error);
2478 		}
2479 	}
2480 
2481 	return (0);
2482 }
2483 
2484 static int
2485 lomac_vnode_check_rename_from(struct ucred *cred, struct vnode *dvp,
2486     struct label *dvplabel, struct vnode *vp, struct label *vplabel,
2487     struct componentname *cnp)
2488 {
2489 	struct mac_lomac *subj, *obj;
2490 
2491 	if (!lomac_enabled)
2492 		return (0);
2493 
2494 	subj = SLOT(cred->cr_label);
2495 	obj = SLOT(dvplabel);
2496 
2497 	if (!lomac_subject_dominate(subj, obj))
2498 		return (EACCES);
2499 
2500 	obj = SLOT(vplabel);
2501 
2502 	if (!lomac_subject_dominate(subj, obj))
2503 		return (EACCES);
2504 
2505 	return (0);
2506 }
2507 
2508 static int
2509 lomac_vnode_check_rename_to(struct ucred *cred, struct vnode *dvp,
2510     struct label *dvplabel, struct vnode *vp, struct label *vplabel,
2511     int samedir, struct componentname *cnp)
2512 {
2513 	struct mac_lomac *subj, *obj;
2514 
2515 	if (!lomac_enabled)
2516 		return (0);
2517 
2518 	subj = SLOT(cred->cr_label);
2519 	obj = SLOT(dvplabel);
2520 
2521 	if (!lomac_subject_dominate(subj, obj))
2522 		return (EACCES);
2523 
2524 	if (vp != NULL) {
2525 		obj = SLOT(vplabel);
2526 
2527 		if (!lomac_subject_dominate(subj, obj))
2528 			return (EACCES);
2529 	}
2530 
2531 	return (0);
2532 }
2533 
2534 static int
2535 lomac_vnode_check_revoke(struct ucred *cred, struct vnode *vp,
2536     struct label *vplabel)
2537 {
2538 	struct mac_lomac *subj, *obj;
2539 
2540 	if (!lomac_enabled)
2541 		return (0);
2542 
2543 	subj = SLOT(cred->cr_label);
2544 	obj = SLOT(vplabel);
2545 
2546 	if (!lomac_subject_dominate(subj, obj))
2547 		return (EACCES);
2548 
2549 	return (0);
2550 }
2551 
2552 static int
2553 lomac_vnode_check_setacl(struct ucred *cred, struct vnode *vp,
2554     struct label *vplabel, acl_type_t type, struct acl *acl)
2555 {
2556 	struct mac_lomac *subj, *obj;
2557 
2558 	if (!lomac_enabled)
2559 		return (0);
2560 
2561 	subj = SLOT(cred->cr_label);
2562 	obj = SLOT(vplabel);
2563 
2564 	if (!lomac_subject_dominate(subj, obj))
2565 		return (EACCES);
2566 
2567 	return (0);
2568 }
2569 
2570 static int
2571 lomac_vnode_check_setextattr(struct ucred *cred, struct vnode *vp,
2572     struct label *vplabel, int attrnamespace, const char *name,
2573     struct uio *uio)
2574 {
2575 	struct mac_lomac *subj, *obj;
2576 
2577 	if (!lomac_enabled)
2578 		return (0);
2579 
2580 	subj = SLOT(cred->cr_label);
2581 	obj = SLOT(vplabel);
2582 
2583 	if (!lomac_subject_dominate(subj, obj))
2584 		return (EACCES);
2585 
2586 	/* XXX: protect the MAC EA in a special way? */
2587 
2588 	return (0);
2589 }
2590 
2591 static int
2592 lomac_vnode_check_setflags(struct ucred *cred, struct vnode *vp,
2593     struct label *vplabel, u_long flags)
2594 {
2595 	struct mac_lomac *subj, *obj;
2596 
2597 	if (!lomac_enabled)
2598 		return (0);
2599 
2600 	subj = SLOT(cred->cr_label);
2601 	obj = SLOT(vplabel);
2602 
2603 	if (!lomac_subject_dominate(subj, obj))
2604 		return (EACCES);
2605 
2606 	return (0);
2607 }
2608 
2609 static int
2610 lomac_vnode_check_setmode(struct ucred *cred, struct vnode *vp,
2611     struct label *vplabel, mode_t mode)
2612 {
2613 	struct mac_lomac *subj, *obj;
2614 
2615 	if (!lomac_enabled)
2616 		return (0);
2617 
2618 	subj = SLOT(cred->cr_label);
2619 	obj = SLOT(vplabel);
2620 
2621 	if (!lomac_subject_dominate(subj, obj))
2622 		return (EACCES);
2623 
2624 	return (0);
2625 }
2626 
2627 static int
2628 lomac_vnode_check_setowner(struct ucred *cred, struct vnode *vp,
2629     struct label *vplabel, uid_t uid, gid_t gid)
2630 {
2631 	struct mac_lomac *subj, *obj;
2632 
2633 	if (!lomac_enabled)
2634 		return (0);
2635 
2636 	subj = SLOT(cred->cr_label);
2637 	obj = SLOT(vplabel);
2638 
2639 	if (!lomac_subject_dominate(subj, obj))
2640 		return (EACCES);
2641 
2642 	return (0);
2643 }
2644 
2645 static int
2646 lomac_vnode_check_setutimes(struct ucred *cred, struct vnode *vp,
2647     struct label *vplabel, struct timespec atime, struct timespec mtime)
2648 {
2649 	struct mac_lomac *subj, *obj;
2650 
2651 	if (!lomac_enabled)
2652 		return (0);
2653 
2654 	subj = SLOT(cred->cr_label);
2655 	obj = SLOT(vplabel);
2656 
2657 	if (!lomac_subject_dominate(subj, obj))
2658 		return (EACCES);
2659 
2660 	return (0);
2661 }
2662 
2663 static int
2664 lomac_vnode_check_unlink(struct ucred *cred, struct vnode *dvp,
2665     struct label *dvplabel, struct vnode *vp, struct label *vplabel,
2666     struct componentname *cnp)
2667 {
2668 	struct mac_lomac *subj, *obj;
2669 
2670 	if (!lomac_enabled)
2671 		return (0);
2672 
2673 	subj = SLOT(cred->cr_label);
2674 	obj = SLOT(dvplabel);
2675 
2676 	if (!lomac_subject_dominate(subj, obj))
2677 		return (EACCES);
2678 
2679 	obj = SLOT(vplabel);
2680 
2681 	if (!lomac_subject_dominate(subj, obj))
2682 		return (EACCES);
2683 
2684 	return (0);
2685 }
2686 
2687 static int
2688 lomac_vnode_check_write(struct ucred *active_cred,
2689     struct ucred *file_cred, struct vnode *vp, struct label *vplabel)
2690 {
2691 	struct mac_lomac *subj, *obj;
2692 
2693 	if (!lomac_enabled || !revocation_enabled)
2694 		return (0);
2695 
2696 	subj = SLOT(active_cred->cr_label);
2697 	obj = SLOT(vplabel);
2698 
2699 	if (!lomac_subject_dominate(subj, obj))
2700 		return (EACCES);
2701 
2702 	return (0);
2703 }
2704 
2705 static int
2706 lomac_vnode_create_extattr(struct ucred *cred, struct mount *mp,
2707     struct label *mplabel, struct vnode *dvp, struct label *dvplabel,
2708     struct vnode *vp, struct label *vplabel, struct componentname *cnp)
2709 {
2710 	struct mac_lomac *source, *dest, *dir, temp;
2711 	size_t buflen;
2712 	int error;
2713 
2714 	buflen = sizeof(temp);
2715 	bzero(&temp, buflen);
2716 
2717 	source = SLOT(cred->cr_label);
2718 	dest = SLOT(vplabel);
2719 	dir = SLOT(dvplabel);
2720 	if (dir->ml_flags & MAC_LOMAC_FLAG_AUX) {
2721 		lomac_copy_auxsingle(dir, &temp);
2722 		lomac_set_single(&temp, dir->ml_auxsingle.mle_type,
2723 		    dir->ml_auxsingle.mle_grade);
2724 	} else {
2725 		lomac_copy_single(source, &temp);
2726 	}
2727 
2728 	error = vn_extattr_set(vp, IO_NODELOCKED, MAC_LOMAC_EXTATTR_NAMESPACE,
2729 	    MAC_LOMAC_EXTATTR_NAME, buflen, (char *)&temp, curthread);
2730 	if (error == 0)
2731 		lomac_copy(&temp, dest);
2732 	return (error);
2733 }
2734 
2735 static void
2736 lomac_vnode_execve_transition(struct ucred *old, struct ucred *new,
2737     struct vnode *vp, struct label *vplabel, struct label *interpvplabel,
2738     struct image_params *imgp, struct label *execlabel)
2739 {
2740 	struct mac_lomac *source, *dest, *obj, *robj;
2741 
2742 	source = SLOT(old->cr_label);
2743 	dest = SLOT(new->cr_label);
2744 	obj = SLOT(vplabel);
2745 	robj = interpvplabel != NULL ? SLOT(interpvplabel) : obj;
2746 
2747 	lomac_copy(source, dest);
2748 	/*
2749 	 * If there's an auxiliary label on the real object, respect it and
2750 	 * assume that this level should be assumed immediately if a higher
2751 	 * level is currently in place.
2752 	 */
2753 	if (robj->ml_flags & MAC_LOMAC_FLAG_AUX &&
2754 	    !lomac_dominate_element(&robj->ml_auxsingle, &dest->ml_single)
2755 	    && lomac_auxsingle_in_range(robj, dest))
2756 		lomac_set_single(dest, robj->ml_auxsingle.mle_type,
2757 		    robj->ml_auxsingle.mle_grade);
2758 	/*
2759 	 * Restructuring to use the execve transitioning mechanism instead of
2760 	 * the normal demotion mechanism here would be difficult, so just
2761 	 * copy the label over and perform standard demotion.  This is also
2762 	 * non-optimal because it will result in the intermediate label "new"
2763 	 * being created and immediately recycled.
2764 	 */
2765 	if (lomac_enabled && revocation_enabled &&
2766 	    !lomac_dominate_single(obj, source))
2767 		(void)maybe_demote(source, obj, "executing", "file", vp);
2768 }
2769 
2770 static int
2771 lomac_vnode_execve_will_transition(struct ucred *old, struct vnode *vp,
2772     struct label *vplabel, struct label *interpvplabel,
2773     struct image_params *imgp, struct label *execlabel)
2774 {
2775 	struct mac_lomac *subj, *obj, *robj;
2776 
2777 	if (!lomac_enabled || !revocation_enabled)
2778 		return (0);
2779 
2780 	subj = SLOT(old->cr_label);
2781 	obj = SLOT(vplabel);
2782 	robj = interpvplabel != NULL ? SLOT(interpvplabel) : obj;
2783 
2784 	return ((robj->ml_flags & MAC_LOMAC_FLAG_AUX &&
2785 	    !lomac_dominate_element(&robj->ml_auxsingle, &subj->ml_single)
2786 	    && lomac_auxsingle_in_range(robj, subj)) ||
2787 	    !lomac_dominate_single(obj, subj));
2788 }
2789 
2790 static void
2791 lomac_vnode_relabel(struct ucred *cred, struct vnode *vp,
2792     struct label *vplabel, struct label *newlabel)
2793 {
2794 	struct mac_lomac *source, *dest;
2795 
2796 	source = SLOT(newlabel);
2797 	dest = SLOT(vplabel);
2798 
2799 	try_relabel(source, dest);
2800 }
2801 
2802 static int
2803 lomac_vnode_setlabel_extattr(struct ucred *cred, struct vnode *vp,
2804     struct label *vplabel, struct label *intlabel)
2805 {
2806 	struct mac_lomac *source, temp;
2807 	size_t buflen;
2808 	int error;
2809 
2810 	buflen = sizeof(temp);
2811 	bzero(&temp, buflen);
2812 
2813 	source = SLOT(intlabel);
2814 	if ((source->ml_flags & MAC_LOMAC_FLAG_SINGLE) == 0)
2815 		return (0);
2816 
2817 	lomac_copy_single(source, &temp);
2818 	error = vn_extattr_set(vp, IO_NODELOCKED, MAC_LOMAC_EXTATTR_NAMESPACE,
2819 	    MAC_LOMAC_EXTATTR_NAME, buflen, (char *)&temp, curthread);
2820 	return (error);
2821 }
2822 
2823 static struct mac_policy_ops lomac_ops =
2824 {
2825 	.mpo_init = lomac_init,
2826 
2827 	.mpo_bpfdesc_check_receive = lomac_bpfdesc_check_receive,
2828 	.mpo_bpfdesc_create = lomac_bpfdesc_create,
2829 	.mpo_bpfdesc_create_mbuf = lomac_bpfdesc_create_mbuf,
2830 	.mpo_bpfdesc_destroy_label = lomac_destroy_label,
2831 	.mpo_bpfdesc_init_label = lomac_init_label,
2832 
2833 	.mpo_cred_check_relabel = lomac_cred_check_relabel,
2834 	.mpo_cred_check_visible = lomac_cred_check_visible,
2835 	.mpo_cred_copy_label = lomac_copy_label,
2836 	.mpo_cred_destroy_label = lomac_destroy_label,
2837 	.mpo_cred_externalize_label = lomac_externalize_label,
2838 	.mpo_cred_init_label = lomac_init_label,
2839 	.mpo_cred_internalize_label = lomac_internalize_label,
2840 	.mpo_cred_relabel = lomac_cred_relabel,
2841 
2842 	.mpo_devfs_create_device = lomac_devfs_create_device,
2843 	.mpo_devfs_create_directory = lomac_devfs_create_directory,
2844 	.mpo_devfs_create_symlink = lomac_devfs_create_symlink,
2845 	.mpo_devfs_destroy_label = lomac_destroy_label,
2846 	.mpo_devfs_init_label = lomac_init_label,
2847 	.mpo_devfs_update = lomac_devfs_update,
2848 	.mpo_devfs_vnode_associate = lomac_devfs_vnode_associate,
2849 
2850 	.mpo_ifnet_check_relabel = lomac_ifnet_check_relabel,
2851 	.mpo_ifnet_check_transmit = lomac_ifnet_check_transmit,
2852 	.mpo_ifnet_copy_label = lomac_copy_label,
2853 	.mpo_ifnet_create = lomac_ifnet_create,
2854 	.mpo_ifnet_create_mbuf = lomac_ifnet_create_mbuf,
2855 	.mpo_ifnet_destroy_label = lomac_destroy_label,
2856 	.mpo_ifnet_externalize_label = lomac_externalize_label,
2857 	.mpo_ifnet_init_label = lomac_init_label,
2858 	.mpo_ifnet_internalize_label = lomac_internalize_label,
2859 	.mpo_ifnet_relabel = lomac_ifnet_relabel,
2860 
2861 	.mpo_syncache_create = lomac_syncache_create,
2862 	.mpo_syncache_destroy_label = lomac_destroy_label,
2863 	.mpo_syncache_init_label = lomac_init_label_waitcheck,
2864 
2865 	.mpo_inpcb_check_deliver = lomac_inpcb_check_deliver,
2866 	.mpo_inpcb_create = lomac_inpcb_create,
2867 	.mpo_inpcb_create_mbuf = lomac_inpcb_create_mbuf,
2868 	.mpo_inpcb_destroy_label = lomac_destroy_label,
2869 	.mpo_inpcb_init_label = lomac_init_label_waitcheck,
2870 	.mpo_inpcb_sosetlabel = lomac_inpcb_sosetlabel,
2871 
2872 	.mpo_ipq_create = lomac_ipq_create,
2873 	.mpo_ipq_destroy_label = lomac_destroy_label,
2874 	.mpo_ipq_init_label = lomac_init_label_waitcheck,
2875 	.mpo_ipq_match = lomac_ipq_match,
2876 	.mpo_ipq_reassemble = lomac_ipq_reassemble,
2877 	.mpo_ipq_update = lomac_ipq_update,
2878 
2879 	.mpo_kld_check_load = lomac_kld_check_load,
2880 
2881 	.mpo_mbuf_copy_label = lomac_copy_label,
2882 	.mpo_mbuf_destroy_label = lomac_destroy_label,
2883 	.mpo_mbuf_init_label = lomac_init_label_waitcheck,
2884 
2885 	.mpo_mount_create = lomac_mount_create,
2886 	.mpo_mount_destroy_label = lomac_destroy_label,
2887 	.mpo_mount_init_label = lomac_init_label,
2888 
2889 	.mpo_netatalk_aarp_send = lomac_netatalk_aarp_send,
2890 
2891 	.mpo_netinet_arp_send = lomac_netinet_arp_send,
2892 	.mpo_netinet_firewall_reply = lomac_netinet_firewall_reply,
2893 	.mpo_netinet_firewall_send = lomac_netinet_firewall_send,
2894 	.mpo_netinet_fragment = lomac_netinet_fragment,
2895 	.mpo_netinet_icmp_reply = lomac_netinet_icmp_reply,
2896 	.mpo_netinet_igmp_send = lomac_netinet_igmp_send,
2897 
2898 	.mpo_netinet6_nd6_send = lomac_netinet6_nd6_send,
2899 
2900 	.mpo_pipe_check_ioctl = lomac_pipe_check_ioctl,
2901 	.mpo_pipe_check_read = lomac_pipe_check_read,
2902 	.mpo_pipe_check_relabel = lomac_pipe_check_relabel,
2903 	.mpo_pipe_check_write = lomac_pipe_check_write,
2904 	.mpo_pipe_copy_label = lomac_copy_label,
2905 	.mpo_pipe_create = lomac_pipe_create,
2906 	.mpo_pipe_destroy_label = lomac_destroy_label,
2907 	.mpo_pipe_externalize_label = lomac_externalize_label,
2908 	.mpo_pipe_init_label = lomac_init_label,
2909 	.mpo_pipe_internalize_label = lomac_internalize_label,
2910 	.mpo_pipe_relabel = lomac_pipe_relabel,
2911 
2912 	.mpo_priv_check = lomac_priv_check,
2913 
2914 	.mpo_proc_check_debug = lomac_proc_check_debug,
2915 	.mpo_proc_check_sched = lomac_proc_check_sched,
2916 	.mpo_proc_check_signal = lomac_proc_check_signal,
2917 	.mpo_proc_create_swapper = lomac_proc_create_swapper,
2918 	.mpo_proc_create_init = lomac_proc_create_init,
2919 	.mpo_proc_destroy_label = lomac_proc_destroy_label,
2920 	.mpo_proc_init_label = lomac_proc_init_label,
2921 
2922 	.mpo_socket_check_deliver = lomac_socket_check_deliver,
2923 	.mpo_socket_check_relabel = lomac_socket_check_relabel,
2924 	.mpo_socket_check_visible = lomac_socket_check_visible,
2925 	.mpo_socket_copy_label = lomac_copy_label,
2926 	.mpo_socket_create = lomac_socket_create,
2927 	.mpo_socket_create_mbuf = lomac_socket_create_mbuf,
2928 	.mpo_socket_destroy_label = lomac_destroy_label,
2929 	.mpo_socket_externalize_label = lomac_externalize_label,
2930 	.mpo_socket_init_label = lomac_init_label_waitcheck,
2931 	.mpo_socket_internalize_label = lomac_internalize_label,
2932 	.mpo_socket_newconn = lomac_socket_newconn,
2933 	.mpo_socket_relabel = lomac_socket_relabel,
2934 
2935 	.mpo_socketpeer_destroy_label = lomac_destroy_label,
2936 	.mpo_socketpeer_externalize_label = lomac_externalize_label,
2937 	.mpo_socketpeer_init_label = lomac_init_label_waitcheck,
2938 	.mpo_socketpeer_set_from_mbuf = lomac_socketpeer_set_from_mbuf,
2939 	.mpo_socketpeer_set_from_socket = lomac_socketpeer_set_from_socket,
2940 
2941 	.mpo_syncache_create_mbuf = lomac_syncache_create_mbuf,
2942 
2943 	.mpo_system_check_acct = lomac_system_check_acct,
2944 	.mpo_system_check_auditctl = lomac_system_check_auditctl,
2945 	.mpo_system_check_swapoff = lomac_system_check_swapoff,
2946 	.mpo_system_check_swapon = lomac_system_check_swapon,
2947 	.mpo_system_check_sysctl = lomac_system_check_sysctl,
2948 
2949 	.mpo_thread_userret = lomac_thread_userret,
2950 
2951 	.mpo_vnode_associate_extattr = lomac_vnode_associate_extattr,
2952 	.mpo_vnode_associate_singlelabel = lomac_vnode_associate_singlelabel,
2953 	.mpo_vnode_check_access = lomac_vnode_check_open,
2954 	.mpo_vnode_check_create = lomac_vnode_check_create,
2955 	.mpo_vnode_check_deleteacl = lomac_vnode_check_deleteacl,
2956 	.mpo_vnode_check_link = lomac_vnode_check_link,
2957 	.mpo_vnode_check_mmap = lomac_vnode_check_mmap,
2958 	.mpo_vnode_check_mmap_downgrade = lomac_vnode_check_mmap_downgrade,
2959 	.mpo_vnode_check_open = lomac_vnode_check_open,
2960 	.mpo_vnode_check_read = lomac_vnode_check_read,
2961 	.mpo_vnode_check_relabel = lomac_vnode_check_relabel,
2962 	.mpo_vnode_check_rename_from = lomac_vnode_check_rename_from,
2963 	.mpo_vnode_check_rename_to = lomac_vnode_check_rename_to,
2964 	.mpo_vnode_check_revoke = lomac_vnode_check_revoke,
2965 	.mpo_vnode_check_setacl = lomac_vnode_check_setacl,
2966 	.mpo_vnode_check_setextattr = lomac_vnode_check_setextattr,
2967 	.mpo_vnode_check_setflags = lomac_vnode_check_setflags,
2968 	.mpo_vnode_check_setmode = lomac_vnode_check_setmode,
2969 	.mpo_vnode_check_setowner = lomac_vnode_check_setowner,
2970 	.mpo_vnode_check_setutimes = lomac_vnode_check_setutimes,
2971 	.mpo_vnode_check_unlink = lomac_vnode_check_unlink,
2972 	.mpo_vnode_check_write = lomac_vnode_check_write,
2973 	.mpo_vnode_copy_label = lomac_copy_label,
2974 	.mpo_vnode_create_extattr = lomac_vnode_create_extattr,
2975 	.mpo_vnode_destroy_label = lomac_destroy_label,
2976 	.mpo_vnode_execve_transition = lomac_vnode_execve_transition,
2977 	.mpo_vnode_execve_will_transition = lomac_vnode_execve_will_transition,
2978 	.mpo_vnode_externalize_label = lomac_externalize_label,
2979 	.mpo_vnode_init_label = lomac_init_label,
2980 	.mpo_vnode_internalize_label = lomac_internalize_label,
2981 	.mpo_vnode_relabel = lomac_vnode_relabel,
2982 	.mpo_vnode_setlabel_extattr = lomac_vnode_setlabel_extattr,
2983 };
2984 
2985 MAC_POLICY_SET(&lomac_ops, mac_lomac, "TrustedBSD MAC/LOMAC",
2986     MPC_LOADTIME_FLAG_NOTLATE | MPC_LOADTIME_FLAG_LABELMBUFS, &lomac_slot);
2987