1 /*- 2 * Copyright (c) 1999-2002, 2007-2011 Robert N. M. Watson 3 * Copyright (c) 2001-2005 McAfee, Inc. 4 * Copyright (c) 2005-2006 SPARTA, Inc. 5 * Copyright (c) 2008 Apple Inc. 6 * All rights reserved. 7 * 8 * This software was developed by Robert Watson for the TrustedBSD Project. 9 * 10 * This software was developed for the FreeBSD Project in part by McAfee 11 * Research, the Security Research Division of McAfee, Inc. under 12 * DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA 13 * CHATS research program. 14 * 15 * This software was enhanced by SPARTA ISSO under SPAWAR contract 16 * N66001-04-C-6019 ("SEFOS"). 17 * 18 * This software was developed at the University of Cambridge Computer 19 * Laboratory with support from a grant from Google, Inc. 20 * 21 * Redistribution and use in source and binary forms, with or without 22 * modification, are permitted provided that the following conditions 23 * are met: 24 * 1. Redistributions of source code must retain the above copyright 25 * notice, this list of conditions and the following disclaimer. 26 * 2. Redistributions in binary form must reproduce the above copyright 27 * notice, this list of conditions and the following disclaimer in the 28 * documentation and/or other materials provided with the distribution. 29 * 30 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 31 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 32 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 33 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 34 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 35 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 36 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 37 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 38 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 39 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 40 * SUCH DAMAGE. 41 */ 42 43 /* 44 * Developed by the TrustedBSD Project. 45 * 46 * Stub module that implements a NOOP for most (if not all) MAC Framework 47 * policy entry points. 48 */ 49 50 #include <sys/types.h> 51 #include <sys/param.h> 52 #include <sys/acl.h> 53 #include <sys/conf.h> 54 #include <sys/extattr.h> 55 #include <sys/jail.h> 56 #include <sys/kdb.h> 57 #include <sys/kernel.h> 58 #include <sys/ksem.h> 59 #include <sys/mount.h> 60 #include <sys/proc.h> 61 #include <sys/systm.h> 62 #include <sys/sysproto.h> 63 #include <sys/sysent.h> 64 #include <sys/vnode.h> 65 #include <sys/file.h> 66 #include <sys/socket.h> 67 #include <sys/socketvar.h> 68 #include <sys/pipe.h> 69 #include <sys/sx.h> 70 #include <sys/sysctl.h> 71 #include <sys/msg.h> 72 #include <sys/sem.h> 73 #include <sys/shm.h> 74 75 #include <ddb/ddb.h> 76 77 #include <fs/devfs/devfs.h> 78 79 #include <net/bpfdesc.h> 80 #include <net/if.h> 81 #include <net/if_types.h> 82 #include <net/if_var.h> 83 84 #include <netinet/in.h> 85 #include <netinet/in_pcb.h> 86 #include <netinet/ip_var.h> 87 88 #include <vm/vm.h> 89 90 #include <security/mac/mac_policy.h> 91 92 static SYSCTL_NODE(_security_mac, OID_AUTO, stub, 93 CTLFLAG_RW | CTLFLAG_MPSAFE, 0, 94 "TrustedBSD mac_stub policy controls"); 95 96 static int stub_enabled = 1; 97 SYSCTL_INT(_security_mac_stub, OID_AUTO, enabled, CTLFLAG_RW, 98 &stub_enabled, 0, "Enforce mac_stub policy"); 99 100 /* 101 * Policy module operations. 102 */ 103 static void 104 stub_destroy(struct mac_policy_conf *conf) 105 { 106 107 } 108 109 static void 110 stub_init(struct mac_policy_conf *conf) 111 { 112 113 } 114 115 static int 116 stub_syscall(struct thread *td, int call, void *arg) 117 { 118 119 return (0); 120 } 121 122 /* 123 * Label operations. 124 */ 125 static void 126 stub_init_label(struct label *label) 127 { 128 129 } 130 131 static int 132 stub_init_label_waitcheck(struct label *label, int flag) 133 { 134 135 return (0); 136 } 137 138 static void 139 stub_destroy_label(struct label *label) 140 { 141 142 } 143 144 static void 145 stub_copy_label(struct label *src, struct label *dest) 146 { 147 148 } 149 150 static int 151 stub_externalize_label(struct label *label, char *element_name, 152 struct sbuf *sb, int *claimed) 153 { 154 155 return (0); 156 } 157 158 static int 159 stub_internalize_label(struct label *label, char *element_name, 160 char *element_data, int *claimed) 161 { 162 163 return (0); 164 } 165 166 /* 167 * Object-specific entry point imeplementations are sorted alphabetically by 168 * object type name and then by operation. 169 */ 170 static int 171 stub_bpfdesc_check_receive(struct bpf_d *d, struct label *dlabel, 172 struct ifnet *ifp, struct label *ifplabel) 173 { 174 175 return (0); 176 } 177 178 static void 179 stub_bpfdesc_create(struct ucred *cred, struct bpf_d *d, 180 struct label *dlabel) 181 { 182 183 } 184 185 static void 186 stub_bpfdesc_create_mbuf(struct bpf_d *d, struct label *dlabel, 187 struct mbuf *m, struct label *mlabel) 188 { 189 190 } 191 192 static void 193 stub_cred_associate_nfsd(struct ucred *cred) 194 { 195 196 } 197 198 static int 199 stub_cred_check_relabel(struct ucred *cred, struct label *newlabel) 200 { 201 202 return (0); 203 } 204 205 static int 206 stub_cred_check_setaudit(struct ucred *cred, struct auditinfo *ai) 207 { 208 209 return (0); 210 } 211 212 static int 213 stub_cred_check_setaudit_addr(struct ucred *cred, struct auditinfo_addr *aia) 214 { 215 216 return (0); 217 } 218 219 static int 220 stub_cred_check_setauid(struct ucred *cred, uid_t auid) 221 { 222 223 return (0); 224 } 225 226 static void 227 stub_cred_setcred_enter(void) 228 { 229 } 230 231 static int 232 stub_cred_check_setcred(u_int flags, const struct ucred *old_cred, 233 struct ucred *new_cred) 234 { 235 return (0); 236 } 237 238 static void 239 stub_cred_setcred_exit(void) 240 { 241 } 242 243 static int 244 stub_cred_check_setegid(struct ucred *cred, gid_t egid) 245 { 246 247 return (0); 248 } 249 250 static int 251 stub_cred_check_seteuid(struct ucred *cred, uid_t euid) 252 { 253 254 return (0); 255 } 256 257 static int 258 stub_cred_check_setgid(struct ucred *cred, gid_t gid) 259 { 260 261 return (0); 262 } 263 264 static int 265 stub_cred_check_setgroups(struct ucred *cred, int ngroups, 266 gid_t *gidset) 267 { 268 269 return (0); 270 } 271 272 static int 273 stub_cred_check_setregid(struct ucred *cred, gid_t rgid, gid_t egid) 274 { 275 276 return (0); 277 } 278 279 static int 280 stub_cred_check_setresgid(struct ucred *cred, gid_t rgid, gid_t egid, 281 gid_t sgid) 282 { 283 284 return (0); 285 } 286 287 static int 288 stub_cred_check_setresuid(struct ucred *cred, uid_t ruid, uid_t euid, 289 uid_t suid) 290 { 291 292 return (0); 293 } 294 295 static int 296 stub_cred_check_setreuid(struct ucred *cred, uid_t ruid, uid_t euid) 297 { 298 299 return (0); 300 } 301 302 static int 303 stub_cred_check_setuid(struct ucred *cred, uid_t uid) 304 { 305 306 return (0); 307 } 308 309 static int 310 stub_cred_check_visible(struct ucred *cr1, struct ucred *cr2) 311 { 312 313 return (0); 314 } 315 316 static void 317 stub_cred_create_init(struct ucred *cred) 318 { 319 320 } 321 322 static void 323 stub_cred_create_kproc0(struct ucred *cred) 324 { 325 326 } 327 328 static void 329 stub_cred_relabel(struct ucred *cred, struct label *newlabel) 330 { 331 332 } 333 334 static int 335 stub_ddb_command_exec(struct db_command *cmd, db_expr_t addr, bool have_addr, 336 db_expr_t count, char *modif) 337 { 338 339 return (0); 340 } 341 342 static int 343 stub_ddb_command_register(struct db_command_table *table, 344 struct db_command *cmd) 345 { 346 347 return (0); 348 } 349 350 static void 351 stub_devfs_create_device(struct ucred *cred, struct mount *mp, 352 struct cdev *dev, struct devfs_dirent *de, struct label *delabel) 353 { 354 355 } 356 357 static void 358 stub_devfs_create_directory(struct mount *mp, char *dirname, 359 int dirnamelen, struct devfs_dirent *de, struct label *delabel) 360 { 361 362 } 363 364 static void 365 stub_devfs_create_symlink(struct ucred *cred, struct mount *mp, 366 struct devfs_dirent *dd, struct label *ddlabel, struct devfs_dirent *de, 367 struct label *delabel) 368 { 369 370 } 371 372 static void 373 stub_devfs_update(struct mount *mp, struct devfs_dirent *de, 374 struct label *delabel, struct vnode *vp, struct label *vplabel) 375 { 376 377 } 378 379 static void 380 stub_devfs_vnode_associate(struct mount *mp, struct label *mplabel, 381 struct devfs_dirent *de, struct label *delabel, struct vnode *vp, 382 struct label *vplabel) 383 { 384 385 } 386 387 static int 388 stub_ifnet_check_relabel(struct ucred *cred, struct ifnet *ifp, 389 struct label *ifplabel, struct label *newlabel) 390 { 391 392 return (0); 393 } 394 395 static int 396 stub_ifnet_check_transmit(struct ifnet *ifp, struct label *ifplabel, 397 struct mbuf *m, struct label *mlabel) 398 { 399 400 return (0); 401 } 402 403 static void 404 stub_ifnet_create(struct ifnet *ifp, struct label *ifplabel) 405 { 406 407 } 408 409 static void 410 stub_ifnet_create_mbuf(struct ifnet *ifp, struct label *ifplabel, 411 struct mbuf *m, struct label *mlabel) 412 { 413 414 } 415 416 static void 417 stub_ifnet_relabel(struct ucred *cred, struct ifnet *ifp, 418 struct label *ifplabel, struct label *newlabel) 419 { 420 421 } 422 423 static int 424 stub_inpcb_check_deliver(struct inpcb *inp, struct label *inplabel, 425 struct mbuf *m, struct label *mlabel) 426 { 427 428 return (0); 429 } 430 431 static void 432 stub_inpcb_create(struct socket *so, struct label *solabel, 433 struct inpcb *inp, struct label *inplabel) 434 { 435 436 } 437 438 static void 439 stub_inpcb_create_mbuf(struct inpcb *inp, struct label *inplabel, 440 struct mbuf *m, struct label *mlabel) 441 { 442 443 } 444 445 static void 446 stub_inpcb_sosetlabel(struct socket *so, struct label *solabel, 447 struct inpcb *inp, struct label *inplabel) 448 { 449 450 SOCK_LOCK_ASSERT(so); 451 452 } 453 454 static void 455 stub_ip6q_create(struct mbuf *m, struct label *mlabel, struct ip6q *q6, 456 struct label *q6label) 457 { 458 459 } 460 461 static int 462 stub_ip6q_match(struct mbuf *m, struct label *mlabel, struct ip6q *q6, 463 struct label *q6label) 464 { 465 466 return (1); 467 } 468 469 static void 470 stub_ip6q_reassemble(struct ip6q *q6, struct label *q6label, struct mbuf *m, 471 struct label *mlabel) 472 { 473 474 } 475 476 static void 477 stub_ip6q_update(struct mbuf *m, struct label *mlabel, struct ip6q *q6, 478 struct label *q6label) 479 { 480 481 } 482 483 static void 484 stub_ipq_create(struct mbuf *m, struct label *mlabel, struct ipq *q, 485 struct label *qlabel) 486 { 487 488 } 489 490 static int 491 stub_ipq_match(struct mbuf *m, struct label *mlabel, struct ipq *q, 492 struct label *qlabel) 493 { 494 495 return (1); 496 } 497 498 static void 499 stub_ipq_reassemble(struct ipq *q, struct label *qlabel, struct mbuf *m, 500 struct label *mlabel) 501 { 502 503 } 504 505 static void 506 stub_ipq_update(struct mbuf *m, struct label *mlabel, struct ipq *q, 507 struct label *qlabel) 508 { 509 510 } 511 512 static int 513 stub_kdb_check_backend(struct kdb_dbbe *be) 514 { 515 516 return (0); 517 } 518 519 static int 520 stub_kenv_check_dump(struct ucred *cred) 521 { 522 523 return (0); 524 } 525 526 static int 527 stub_kenv_check_get(struct ucred *cred, char *name) 528 { 529 530 return (0); 531 } 532 533 static int 534 stub_kenv_check_set(struct ucred *cred, char *name, char *value) 535 { 536 537 return (0); 538 } 539 540 static int 541 stub_kenv_check_unset(struct ucred *cred, char *name) 542 { 543 544 return (0); 545 } 546 547 static int 548 stub_kld_check_load(struct ucred *cred, struct vnode *vp, 549 struct label *vplabel) 550 { 551 552 return (0); 553 } 554 555 static int 556 stub_kld_check_stat(struct ucred *cred) 557 { 558 559 return (0); 560 } 561 562 static int 563 stub_mount_check_stat(struct ucred *cred, struct mount *mp, 564 struct label *mplabel) 565 { 566 567 return (0); 568 } 569 570 static void 571 stub_mount_create(struct ucred *cred, struct mount *mp, 572 struct label *mplabel) 573 { 574 575 } 576 577 static void 578 stub_netinet_arp_send(struct ifnet *ifp, struct label *iflpabel, 579 struct mbuf *m, struct label *mlabel) 580 { 581 582 } 583 584 static void 585 stub_netinet_firewall_reply(struct mbuf *mrecv, struct label *mrecvlabel, 586 struct mbuf *msend, struct label *msendlabel) 587 { 588 589 } 590 591 static void 592 stub_netinet_firewall_send(struct mbuf *m, struct label *mlabel) 593 { 594 595 } 596 597 static void 598 stub_netinet_fragment(struct mbuf *m, struct label *mlabel, struct mbuf *frag, 599 struct label *fraglabel) 600 { 601 602 } 603 604 static void 605 stub_netinet_icmp_reply(struct mbuf *mrecv, struct label *mrecvlabel, 606 struct mbuf *msend, struct label *msendlabel) 607 { 608 609 } 610 611 static void 612 stub_netinet_icmp_replyinplace(struct mbuf *m, struct label *mlabel) 613 { 614 615 } 616 617 static void 618 stub_netinet_igmp_send(struct ifnet *ifp, struct label *iflpabel, 619 struct mbuf *m, struct label *mlabel) 620 { 621 622 } 623 624 static void 625 stub_netinet_tcp_reply(struct mbuf *m, struct label *mlabel) 626 { 627 628 } 629 630 static void 631 stub_netinet6_nd6_send(struct ifnet *ifp, struct label *iflpabel, 632 struct mbuf *m, struct label *mlabel) 633 { 634 635 } 636 637 static int 638 stub_pipe_check_ioctl(struct ucred *cred, struct pipepair *pp, 639 struct label *pplabel, unsigned long cmd, void /* caddr_t */ *data) 640 { 641 642 return (0); 643 } 644 645 static int 646 stub_pipe_check_poll(struct ucred *cred, struct pipepair *pp, 647 struct label *pplabel) 648 { 649 650 return (0); 651 } 652 653 static int 654 stub_pipe_check_read(struct ucred *cred, struct pipepair *pp, 655 struct label *pplabel) 656 { 657 658 return (0); 659 } 660 661 static int 662 stub_pipe_check_relabel(struct ucred *cred, struct pipepair *pp, 663 struct label *pplabel, struct label *newlabel) 664 { 665 666 return (0); 667 } 668 669 static int 670 stub_pipe_check_stat(struct ucred *cred, struct pipepair *pp, 671 struct label *pplabel) 672 { 673 674 return (0); 675 } 676 677 static int 678 stub_pipe_check_write(struct ucred *cred, struct pipepair *pp, 679 struct label *pplabel) 680 { 681 682 return (0); 683 } 684 685 static void 686 stub_pipe_create(struct ucred *cred, struct pipepair *pp, 687 struct label *pplabel) 688 { 689 690 } 691 692 static void 693 stub_pipe_relabel(struct ucred *cred, struct pipepair *pp, 694 struct label *pplabel, struct label *newlabel) 695 { 696 697 } 698 699 static int 700 stub_posixsem_check_getvalue(struct ucred *active_cred, struct ucred *file_cred, 701 struct ksem *ks, struct label *kslabel) 702 { 703 704 return (0); 705 } 706 707 static int 708 stub_posixsem_check_open(struct ucred *cred, struct ksem *ks, 709 struct label *kslabel) 710 { 711 712 return (0); 713 } 714 715 static int 716 stub_posixsem_check_post(struct ucred *active_cred, struct ucred *file_cred, 717 struct ksem *ks, struct label *kslabel) 718 { 719 720 return (0); 721 } 722 723 static int 724 stub_posixsem_check_setmode(struct ucred *cred, struct ksem *ks, 725 struct label *kslabel, mode_t mode) 726 { 727 728 return (0); 729 } 730 731 static int 732 stub_posixsem_check_setowner(struct ucred *cred, struct ksem *ks, 733 struct label *kslabel, uid_t uid, gid_t gid) 734 { 735 736 return (0); 737 } 738 739 static int 740 stub_posixsem_check_stat(struct ucred *active_cred, struct ucred *file_cred, 741 struct ksem *ks, struct label *kslabel) 742 { 743 744 return (0); 745 } 746 747 static int 748 stub_posixsem_check_unlink(struct ucred *cred, struct ksem *ks, 749 struct label *kslabel) 750 { 751 752 return (0); 753 } 754 755 static int 756 stub_posixsem_check_wait(struct ucred *active_cred, struct ucred *file_cred, 757 struct ksem *ks, struct label *kslabel) 758 { 759 760 return (0); 761 } 762 763 static void 764 stub_posixsem_create(struct ucred *cred, struct ksem *ks, 765 struct label *kslabel) 766 { 767 768 } 769 770 static int 771 stub_posixshm_check_create(struct ucred *cred, const char *path) 772 { 773 774 return (0); 775 } 776 777 static int 778 stub_posixshm_check_mmap(struct ucred *cred, struct shmfd *shmfd, 779 struct label *shmlabel, int prot, int flags) 780 { 781 782 return (0); 783 } 784 785 static int 786 stub_posixshm_check_open(struct ucred *cred, struct shmfd *shmfd, 787 struct label *shmlabel, accmode_t accmode) 788 { 789 790 return (0); 791 } 792 793 static int 794 stub_posixshm_check_read(struct ucred *active_cred, struct ucred *file_cred, 795 struct shmfd *shm, struct label *shmlabel) 796 { 797 798 return (0); 799 } 800 801 static int 802 stub_posixshm_check_setmode(struct ucred *cred, struct shmfd *shmfd, 803 struct label *shmlabel, mode_t mode) 804 { 805 806 return (0); 807 } 808 809 static int 810 stub_posixshm_check_setowner(struct ucred *cred, struct shmfd *shmfd, 811 struct label *shmlabel, uid_t uid, gid_t gid) 812 { 813 814 return (0); 815 } 816 817 static int 818 stub_posixshm_check_stat(struct ucred *active_cred, struct ucred *file_cred, 819 struct shmfd *shmfd, struct label *shmlabel) 820 { 821 822 return (0); 823 } 824 825 static int 826 stub_posixshm_check_truncate(struct ucred *active_cred, 827 struct ucred *file_cred, struct shmfd *shmfd, struct label *shmlabel) 828 { 829 830 return (0); 831 } 832 833 static int 834 stub_posixshm_check_unlink(struct ucred *cred, struct shmfd *shmfd, 835 struct label *shmlabel) 836 { 837 838 return (0); 839 } 840 841 static int 842 stub_posixshm_check_write(struct ucred *active_cred, struct ucred *file_cred, 843 struct shmfd *shm, struct label *shmlabel) 844 { 845 846 return (0); 847 } 848 849 static void 850 stub_posixshm_create(struct ucred *cred, struct shmfd *shmfd, 851 struct label *shmlabel) 852 { 853 854 } 855 856 static void 857 stub_prison_relabel(struct ucred *cred, struct prison *pr, 858 struct label *prlabel, struct label *newlabel) 859 { 860 861 } 862 863 static int 864 stub_prison_check_relabel(struct ucred *cred, struct prison *pr, 865 struct label *prlabel, struct label *newlabel) 866 { 867 868 return (0); 869 } 870 871 static int 872 stub_prison_check_attach(struct ucred *cred, struct prison *pr, 873 struct label *prlabel) 874 { 875 876 return (0); 877 } 878 879 static int 880 stub_prison_check_create(struct ucred *cred, struct vfsoptlist *opts, int flags) 881 { 882 883 return (0); 884 } 885 886 static int 887 stub_prison_check_get(struct ucred *cred, struct prison *pr, 888 struct label *prlabel, struct vfsoptlist *opts, int flags) 889 { 890 891 return (0); 892 } 893 894 static int 895 stub_prison_check_set(struct ucred *cred, struct prison *pr, 896 struct label *prlabel, struct vfsoptlist *opts, int flags) 897 { 898 899 return (0); 900 } 901 902 static int 903 stub_prison_check_remove(struct ucred *cred, struct prison *pr, 904 struct label *prlabel) 905 { 906 907 return (0); 908 } 909 910 static void 911 stub_prison_created(struct ucred *cred, struct prison *pr, 912 struct label *prlabel) 913 { 914 915 } 916 917 static void 918 stub_prison_cleanup(struct ucred *cred, struct prison *pr) 919 { 920 921 } 922 923 static void 924 stub_prison_attached(struct ucred *cred, struct prison *pr, 925 struct label *prlabel, struct proc *p, struct label *proclabel) 926 { 927 928 } 929 930 static int 931 stub_priv_check(struct ucred *cred, int priv) 932 { 933 934 return (0); 935 } 936 937 static int 938 stub_priv_grant(struct ucred *cred, int priv) 939 { 940 941 return (EPERM); 942 } 943 944 static int 945 stub_proc_check_debug(struct ucred *cred, struct proc *p) 946 { 947 948 return (0); 949 } 950 951 static int 952 stub_proc_check_sched(struct ucred *cred, struct proc *p) 953 { 954 955 return (0); 956 } 957 958 static int 959 stub_proc_check_signal(struct ucred *cred, struct proc *p, int signum) 960 { 961 962 return (0); 963 } 964 965 static int 966 stub_proc_check_wait(struct ucred *cred, struct proc *p) 967 { 968 969 return (0); 970 } 971 972 static int 973 stub_socket_check_accept(struct ucred *cred, struct socket *so, 974 struct label *solabel) 975 { 976 977 #if 0 978 SOCK_LOCK(so); 979 SOCK_UNLOCK(so); 980 #endif 981 982 return (0); 983 } 984 985 static int 986 stub_socket_check_bind(struct ucred *cred, struct socket *so, 987 struct label *solabel, struct sockaddr *sa) 988 { 989 990 #if 0 991 SOCK_LOCK(so); 992 SOCK_UNLOCK(so); 993 #endif 994 995 return (0); 996 } 997 998 static int 999 stub_socket_check_connect(struct ucred *cred, struct socket *so, 1000 struct label *solabel, struct sockaddr *sa) 1001 { 1002 1003 #if 0 1004 SOCK_LOCK(so); 1005 SOCK_UNLOCK(so); 1006 #endif 1007 1008 return (0); 1009 } 1010 1011 static int 1012 stub_socket_check_create(struct ucred *cred, int domain, int type, int proto) 1013 { 1014 1015 return (0); 1016 } 1017 1018 static int 1019 stub_socket_check_deliver(struct socket *so, struct label *solabel, 1020 struct mbuf *m, struct label *mlabel) 1021 { 1022 1023 #if 0 1024 SOCK_LOCK(so); 1025 SOCK_UNLOCK(so); 1026 #endif 1027 1028 return (0); 1029 } 1030 1031 static int 1032 stub_socket_check_listen(struct ucred *cred, struct socket *so, 1033 struct label *solabel) 1034 { 1035 1036 #if 0 1037 SOCK_LOCK(so); 1038 SOCK_UNLOCK(so); 1039 #endif 1040 1041 return (0); 1042 } 1043 1044 static int 1045 stub_socket_check_poll(struct ucred *cred, struct socket *so, 1046 struct label *solabel) 1047 { 1048 1049 #if 0 1050 SOCK_LOCK(so); 1051 SOCK_UNLOCK(so); 1052 #endif 1053 1054 return (0); 1055 } 1056 1057 static int 1058 stub_socket_check_receive(struct ucred *cred, struct socket *so, 1059 struct label *solabel) 1060 { 1061 1062 #if 0 1063 SOCK_LOCK(so); 1064 SOCK_UNLOCK(so); 1065 #endif 1066 1067 return (0); 1068 } 1069 1070 static int 1071 stub_socket_check_relabel(struct ucred *cred, struct socket *so, 1072 struct label *solabel, struct label *newlabel) 1073 { 1074 1075 SOCK_LOCK_ASSERT(so); 1076 1077 return (0); 1078 } 1079 static int 1080 stub_socket_check_send(struct ucred *cred, struct socket *so, 1081 struct label *solabel) 1082 { 1083 1084 #if 0 1085 SOCK_LOCK(so); 1086 SOCK_UNLOCK(so); 1087 #endif 1088 1089 return (0); 1090 } 1091 1092 static int 1093 stub_socket_check_stat(struct ucred *cred, struct socket *so, 1094 struct label *solabel) 1095 { 1096 1097 #if 0 1098 SOCK_LOCK(so); 1099 SOCK_UNLOCK(so); 1100 #endif 1101 1102 return (0); 1103 } 1104 1105 static int 1106 stub_inpcb_check_visible(struct ucred *cred, struct inpcb *inp, 1107 struct label *inplabel) 1108 { 1109 1110 return (0); 1111 } 1112 1113 static int 1114 stub_socket_check_visible(struct ucred *cred, struct socket *so, 1115 struct label *solabel) 1116 { 1117 1118 #if 0 1119 SOCK_LOCK(so); 1120 SOCK_UNLOCK(so); 1121 #endif 1122 1123 return (0); 1124 } 1125 1126 static void 1127 stub_socket_create(struct ucred *cred, struct socket *so, 1128 struct label *solabel) 1129 { 1130 1131 } 1132 1133 static void 1134 stub_socket_create_mbuf(struct socket *so, struct label *solabel, 1135 struct mbuf *m, struct label *mlabel) 1136 { 1137 1138 #if 0 1139 SOCK_LOCK(so); 1140 SOCK_UNLOCK(so); 1141 #endif 1142 } 1143 1144 static void 1145 stub_socket_newconn(struct socket *oldso, struct label *oldsolabel, 1146 struct socket *newso, struct label *newsolabel) 1147 { 1148 1149 #if 0 1150 SOCK_LOCK(oldso); 1151 SOCK_UNLOCK(oldso); 1152 #endif 1153 #if 0 1154 SOCK_LOCK(newso); 1155 SOCK_UNLOCK(newso); 1156 #endif 1157 } 1158 1159 static void 1160 stub_socket_relabel(struct ucred *cred, struct socket *so, 1161 struct label *solabel, struct label *newlabel) 1162 { 1163 1164 SOCK_LOCK_ASSERT(so); 1165 } 1166 1167 static void 1168 stub_socketpeer_set_from_mbuf(struct mbuf *m, struct label *mlabel, 1169 struct socket *so, struct label *sopeerlabel) 1170 { 1171 1172 #if 0 1173 SOCK_LOCK(so); 1174 SOCK_UNLOCK(so); 1175 #endif 1176 } 1177 1178 static void 1179 stub_socketpeer_set_from_socket(struct socket *oldso, 1180 struct label *oldsolabel, struct socket *newso, 1181 struct label *newsopeerlabel) 1182 { 1183 1184 #if 0 1185 SOCK_LOCK(oldso); 1186 SOCK_UNLOCK(oldso); 1187 #endif 1188 #if 0 1189 SOCK_LOCK(newso); 1190 SOCK_UNLOCK(newso); 1191 #endif 1192 } 1193 1194 static void 1195 stub_syncache_create(struct label *label, struct inpcb *inp) 1196 { 1197 1198 } 1199 1200 static void 1201 stub_syncache_create_mbuf(struct label *sc_label, struct mbuf *m, 1202 struct label *mlabel) 1203 { 1204 1205 } 1206 1207 static int 1208 stub_system_check_acct(struct ucred *cred, struct vnode *vp, 1209 struct label *vplabel) 1210 { 1211 1212 return (0); 1213 } 1214 1215 static int 1216 stub_system_check_audit(struct ucred *cred, void *record, int length) 1217 { 1218 1219 return (0); 1220 } 1221 1222 static int 1223 stub_system_check_auditctl(struct ucred *cred, struct vnode *vp, 1224 struct label *vplabel) 1225 { 1226 1227 return (0); 1228 } 1229 1230 static int 1231 stub_system_check_auditon(struct ucred *cred, int cmd) 1232 { 1233 1234 return (0); 1235 } 1236 1237 static int 1238 stub_system_check_reboot(struct ucred *cred, int how) 1239 { 1240 1241 return (0); 1242 } 1243 1244 static int 1245 stub_system_check_swapoff(struct ucred *cred, struct vnode *vp, 1246 struct label *vplabel) 1247 { 1248 1249 return (0); 1250 } 1251 1252 static int 1253 stub_system_check_swapon(struct ucred *cred, struct vnode *vp, 1254 struct label *vplabel) 1255 { 1256 1257 return (0); 1258 } 1259 1260 static int 1261 stub_system_check_sysctl(struct ucred *cred, struct sysctl_oid *oidp, 1262 void *arg1, int arg2, struct sysctl_req *req) 1263 { 1264 1265 return (0); 1266 } 1267 1268 static void 1269 stub_sysvmsg_cleanup(struct label *msglabel) 1270 { 1271 1272 } 1273 1274 static void 1275 stub_sysvmsg_create(struct ucred *cred, struct msqid_kernel *msqkptr, 1276 struct label *msqlabel, struct msg *msgptr, struct label *msglabel) 1277 { 1278 1279 } 1280 1281 static int 1282 stub_sysvmsq_check_msgmsq(struct ucred *cred, struct msg *msgptr, 1283 struct label *msglabel, struct msqid_kernel *msqkptr, 1284 struct label *msqklabel) 1285 { 1286 1287 return (0); 1288 } 1289 1290 static int 1291 stub_sysvmsq_check_msgrcv(struct ucred *cred, struct msg *msgptr, 1292 struct label *msglabel) 1293 { 1294 1295 return (0); 1296 } 1297 1298 static int 1299 stub_sysvmsq_check_msgrmid(struct ucred *cred, struct msg *msgptr, 1300 struct label *msglabel) 1301 { 1302 1303 return (0); 1304 } 1305 1306 static int 1307 stub_sysvmsq_check_msqget(struct ucred *cred, struct msqid_kernel *msqkptr, 1308 struct label *msqklabel) 1309 { 1310 1311 return (0); 1312 } 1313 1314 static int 1315 stub_sysvmsq_check_msqsnd(struct ucred *cred, struct msqid_kernel *msqkptr, 1316 struct label *msqklabel) 1317 { 1318 1319 return (0); 1320 } 1321 1322 static int 1323 stub_sysvmsq_check_msqrcv(struct ucred *cred, struct msqid_kernel *msqkptr, 1324 struct label *msqklabel) 1325 { 1326 1327 return (0); 1328 } 1329 1330 static int 1331 stub_sysvmsq_check_msqctl(struct ucred *cred, struct msqid_kernel *msqkptr, 1332 struct label *msqklabel, int cmd) 1333 { 1334 1335 return (0); 1336 } 1337 1338 static void 1339 stub_sysvmsq_cleanup(struct label *msqlabel) 1340 { 1341 1342 } 1343 1344 static void 1345 stub_sysvmsq_create(struct ucred *cred, struct msqid_kernel *msqkptr, 1346 struct label *msqlabel) 1347 { 1348 1349 } 1350 1351 static int 1352 stub_sysvsem_check_semctl(struct ucred *cred, struct semid_kernel *semakptr, 1353 struct label *semaklabel, int cmd) 1354 { 1355 1356 return (0); 1357 } 1358 1359 static int 1360 stub_sysvsem_check_semget(struct ucred *cred, struct semid_kernel *semakptr, 1361 struct label *semaklabel) 1362 { 1363 1364 return (0); 1365 } 1366 1367 static int 1368 stub_sysvsem_check_semop(struct ucred *cred, struct semid_kernel *semakptr, 1369 struct label *semaklabel, size_t accesstype) 1370 { 1371 1372 return (0); 1373 } 1374 1375 static void 1376 stub_sysvsem_cleanup(struct label *semalabel) 1377 { 1378 1379 } 1380 1381 static void 1382 stub_sysvsem_create(struct ucred *cred, struct semid_kernel *semakptr, 1383 struct label *semalabel) 1384 { 1385 1386 } 1387 1388 static int 1389 stub_sysvshm_check_shmat(struct ucred *cred, struct shmid_kernel *shmsegptr, 1390 struct label *shmseglabel, int shmflg) 1391 { 1392 1393 return (0); 1394 } 1395 1396 static int 1397 stub_sysvshm_check_shmctl(struct ucred *cred, struct shmid_kernel *shmsegptr, 1398 struct label *shmseglabel, int cmd) 1399 { 1400 1401 return (0); 1402 } 1403 1404 static int 1405 stub_sysvshm_check_shmdt(struct ucred *cred, struct shmid_kernel *shmsegptr, 1406 struct label *shmseglabel) 1407 { 1408 1409 return (0); 1410 } 1411 1412 static int 1413 stub_sysvshm_check_shmget(struct ucred *cred, struct shmid_kernel *shmsegptr, 1414 struct label *shmseglabel, int shmflg) 1415 { 1416 1417 return (0); 1418 } 1419 1420 static void 1421 stub_sysvshm_cleanup(struct label *shmlabel) 1422 { 1423 1424 } 1425 1426 static void 1427 stub_sysvshm_create(struct ucred *cred, struct shmid_kernel *shmsegptr, 1428 struct label *shmalabel) 1429 { 1430 1431 } 1432 1433 static void 1434 stub_thread_userret(struct thread *td) 1435 { 1436 1437 } 1438 1439 static int 1440 stub_vnode_associate_extattr(struct mount *mp, struct label *mplabel, 1441 struct vnode *vp, struct label *vplabel) 1442 { 1443 1444 return (0); 1445 } 1446 1447 static void 1448 stub_vnode_associate_singlelabel(struct mount *mp, struct label *mplabel, 1449 struct vnode *vp, struct label *vplabel) 1450 { 1451 1452 } 1453 1454 static int 1455 stub_vnode_check_access(struct ucred *cred, struct vnode *vp, 1456 struct label *vplabel, accmode_t accmode) 1457 { 1458 1459 return (0); 1460 } 1461 1462 static int 1463 stub_vnode_check_chdir(struct ucred *cred, struct vnode *dvp, 1464 struct label *dvplabel) 1465 { 1466 1467 return (0); 1468 } 1469 1470 static int 1471 stub_vnode_check_chroot(struct ucred *cred, struct vnode *dvp, 1472 struct label *dvplabel) 1473 { 1474 1475 return (0); 1476 } 1477 1478 static int 1479 stub_vnode_check_create(struct ucred *cred, struct vnode *dvp, 1480 struct label *dvplabel, struct componentname *cnp, struct vattr *vap) 1481 { 1482 1483 return (0); 1484 } 1485 1486 static int 1487 stub_vnode_check_deleteacl(struct ucred *cred, struct vnode *vp, 1488 struct label *vplabel, acl_type_t type) 1489 { 1490 1491 return (0); 1492 } 1493 1494 static int 1495 stub_vnode_check_deleteextattr(struct ucred *cred, struct vnode *vp, 1496 struct label *vplabel, int attrnamespace, const char *name) 1497 { 1498 1499 return (0); 1500 } 1501 1502 static int 1503 stub_vnode_check_exec(struct ucred *cred, struct vnode *vp, 1504 struct label *vplabel, struct image_params *imgp, 1505 struct label *execlabel) 1506 { 1507 1508 return (0); 1509 } 1510 1511 static int 1512 stub_vnode_check_getacl(struct ucred *cred, struct vnode *vp, 1513 struct label *vplabel, acl_type_t type) 1514 { 1515 1516 return (0); 1517 } 1518 1519 static int 1520 stub_vnode_check_getextattr(struct ucred *cred, struct vnode *vp, 1521 struct label *vplabel, int attrnamespace, const char *name) 1522 { 1523 1524 return (0); 1525 } 1526 1527 static int 1528 stub_vnode_check_link(struct ucred *cred, struct vnode *dvp, 1529 struct label *dvplabel, struct vnode *vp, struct label *vplabel, 1530 struct componentname *cnp) 1531 { 1532 1533 return (0); 1534 } 1535 1536 static int 1537 stub_vnode_check_listextattr(struct ucred *cred, struct vnode *vp, 1538 struct label *vplabel, int attrnamespace) 1539 { 1540 1541 return (0); 1542 } 1543 1544 static int 1545 stub_vnode_check_lookup(struct ucred *cred, struct vnode *dvp, 1546 struct label *dvplabel, struct componentname *cnp) 1547 { 1548 1549 return (0); 1550 } 1551 1552 static int 1553 stub_vnode_check_mmap(struct ucred *cred, struct vnode *vp, 1554 struct label *vplabel, int prot, int flags) 1555 { 1556 1557 return (0); 1558 } 1559 1560 static void 1561 stub_vnode_check_mmap_downgrade(struct ucred *cred, struct vnode *vp, 1562 struct label *vplabel, int *prot) 1563 { 1564 1565 } 1566 1567 static int 1568 stub_vnode_check_mprotect(struct ucred *cred, struct vnode *vp, 1569 struct label *vplabel, int prot) 1570 { 1571 1572 return (0); 1573 } 1574 1575 static int 1576 stub_vnode_check_open(struct ucred *cred, struct vnode *vp, 1577 struct label *vplabel, accmode_t accmode) 1578 { 1579 1580 return (0); 1581 } 1582 1583 static int 1584 stub_vnode_check_poll(struct ucred *active_cred, struct ucred *file_cred, 1585 struct vnode *vp, struct label *vplabel) 1586 { 1587 1588 return (0); 1589 } 1590 1591 static int 1592 stub_vnode_check_read(struct ucred *active_cred, struct ucred *file_cred, 1593 struct vnode *vp, struct label *vplabel) 1594 { 1595 1596 return (0); 1597 } 1598 1599 static int 1600 stub_vnode_check_readdir(struct ucred *cred, struct vnode *vp, 1601 struct label *dvplabel) 1602 { 1603 1604 return (0); 1605 } 1606 1607 static int 1608 stub_vnode_check_readlink(struct ucred *cred, struct vnode *vp, 1609 struct label *vplabel) 1610 { 1611 1612 return (0); 1613 } 1614 1615 static int 1616 stub_vnode_check_relabel(struct ucred *cred, struct vnode *vp, 1617 struct label *vplabel, struct label *newlabel) 1618 { 1619 1620 return (0); 1621 } 1622 1623 static int 1624 stub_vnode_check_rename_from(struct ucred *cred, struct vnode *dvp, 1625 struct label *dvplabel, struct vnode *vp, struct label *vplabel, 1626 struct componentname *cnp) 1627 { 1628 1629 return (0); 1630 } 1631 1632 static int 1633 stub_vnode_check_rename_to(struct ucred *cred, struct vnode *dvp, 1634 struct label *dvplabel, struct vnode *vp, struct label *vplabel, 1635 int samedir, struct componentname *cnp) 1636 { 1637 1638 return (0); 1639 } 1640 1641 static int 1642 stub_vnode_check_revoke(struct ucred *cred, struct vnode *vp, 1643 struct label *vplabel) 1644 { 1645 1646 return (0); 1647 } 1648 1649 static int 1650 stub_vnode_check_setacl(struct ucred *cred, struct vnode *vp, 1651 struct label *vplabel, acl_type_t type, struct acl *acl) 1652 { 1653 1654 return (0); 1655 } 1656 1657 static int 1658 stub_vnode_check_setextattr(struct ucred *cred, struct vnode *vp, 1659 struct label *vplabel, int attrnamespace, const char *name) 1660 { 1661 1662 return (0); 1663 } 1664 1665 static int 1666 stub_vnode_check_setflags(struct ucred *cred, struct vnode *vp, 1667 struct label *vplabel, u_long flags) 1668 { 1669 1670 return (0); 1671 } 1672 1673 static int 1674 stub_vnode_check_setmode(struct ucred *cred, struct vnode *vp, 1675 struct label *vplabel, mode_t mode) 1676 { 1677 1678 return (0); 1679 } 1680 1681 static int 1682 stub_vnode_check_setowner(struct ucred *cred, struct vnode *vp, 1683 struct label *vplabel, uid_t uid, gid_t gid) 1684 { 1685 1686 return (0); 1687 } 1688 1689 static int 1690 stub_vnode_check_setutimes(struct ucred *cred, struct vnode *vp, 1691 struct label *vplabel, struct timespec atime, struct timespec mtime) 1692 { 1693 1694 return (0); 1695 } 1696 1697 static int 1698 stub_vnode_check_stat(struct ucred *active_cred, struct ucred *file_cred, 1699 struct vnode *vp, struct label *vplabel) 1700 { 1701 1702 return (0); 1703 } 1704 1705 static int 1706 stub_vnode_check_unlink(struct ucred *cred, struct vnode *dvp, 1707 struct label *dvplabel, struct vnode *vp, struct label *vplabel, 1708 struct componentname *cnp) 1709 { 1710 1711 return (0); 1712 } 1713 1714 static int 1715 stub_vnode_check_write(struct ucred *active_cred, struct ucred *file_cred, 1716 struct vnode *vp, struct label *vplabel) 1717 { 1718 1719 return (0); 1720 } 1721 1722 static int 1723 stub_vnode_create_extattr(struct ucred *cred, struct mount *mp, 1724 struct label *mntlabel, struct vnode *dvp, struct label *dvplabel, 1725 struct vnode *vp, struct label *vplabel, struct componentname *cnp) 1726 { 1727 1728 return (0); 1729 } 1730 1731 static void 1732 stub_vnode_execve_transition(struct ucred *old, struct ucred *new, 1733 struct vnode *vp, struct label *vplabel, struct label *interpvplabel, 1734 struct image_params *imgp, struct label *execlabel) 1735 { 1736 1737 } 1738 1739 static int 1740 stub_vnode_execve_will_transition(struct ucred *old, struct vnode *vp, 1741 struct label *vplabel, struct label *interpvplabel, 1742 struct image_params *imgp, struct label *execlabel) 1743 { 1744 1745 return (0); 1746 } 1747 1748 static void 1749 stub_vnode_relabel(struct ucred *cred, struct vnode *vp, 1750 struct label *vplabel, struct label *label) 1751 { 1752 1753 } 1754 1755 static int 1756 stub_vnode_setlabel_extattr(struct ucred *cred, struct vnode *vp, 1757 struct label *vplabel, struct label *intlabel) 1758 { 1759 1760 return (0); 1761 } 1762 1763 /* 1764 * Register functions with MAC Framework policy entry points. 1765 */ 1766 static struct mac_policy_ops stub_ops = 1767 { 1768 .mpo_destroy = stub_destroy, 1769 .mpo_init = stub_init, 1770 .mpo_syscall = stub_syscall, 1771 1772 .mpo_bpfdesc_check_receive = stub_bpfdesc_check_receive, 1773 .mpo_bpfdesc_create = stub_bpfdesc_create, 1774 .mpo_bpfdesc_create_mbuf = stub_bpfdesc_create_mbuf, 1775 .mpo_bpfdesc_destroy_label = stub_destroy_label, 1776 .mpo_bpfdesc_init_label = stub_init_label, 1777 1778 .mpo_cred_associate_nfsd = stub_cred_associate_nfsd, 1779 .mpo_cred_check_relabel = stub_cred_check_relabel, 1780 .mpo_cred_check_setaudit = stub_cred_check_setaudit, 1781 .mpo_cred_check_setaudit_addr = stub_cred_check_setaudit_addr, 1782 .mpo_cred_check_setauid = stub_cred_check_setauid, 1783 .mpo_cred_setcred_enter = stub_cred_setcred_enter, 1784 .mpo_cred_check_setcred = stub_cred_check_setcred, 1785 .mpo_cred_setcred_exit = stub_cred_setcred_exit, 1786 .mpo_cred_check_setegid = stub_cred_check_setegid, 1787 .mpo_cred_check_seteuid = stub_cred_check_seteuid, 1788 .mpo_cred_check_setgid = stub_cred_check_setgid, 1789 .mpo_cred_check_setgroups = stub_cred_check_setgroups, 1790 .mpo_cred_check_setregid = stub_cred_check_setregid, 1791 .mpo_cred_check_setresgid = stub_cred_check_setresgid, 1792 .mpo_cred_check_setresuid = stub_cred_check_setresuid, 1793 .mpo_cred_check_setreuid = stub_cred_check_setreuid, 1794 .mpo_cred_check_setuid = stub_cred_check_setuid, 1795 .mpo_cred_check_visible = stub_cred_check_visible, 1796 .mpo_cred_copy_label = stub_copy_label, 1797 .mpo_cred_create_init = stub_cred_create_init, 1798 .mpo_cred_create_kproc0 = stub_cred_create_kproc0, 1799 .mpo_cred_destroy_label = stub_destroy_label, 1800 .mpo_cred_externalize_label = stub_externalize_label, 1801 .mpo_cred_init_label = stub_init_label, 1802 .mpo_cred_internalize_label = stub_internalize_label, 1803 .mpo_cred_relabel= stub_cred_relabel, 1804 1805 .mpo_ddb_command_exec = stub_ddb_command_exec, 1806 .mpo_ddb_command_register = stub_ddb_command_register, 1807 1808 .mpo_devfs_create_device = stub_devfs_create_device, 1809 .mpo_devfs_create_directory = stub_devfs_create_directory, 1810 .mpo_devfs_create_symlink = stub_devfs_create_symlink, 1811 .mpo_devfs_destroy_label = stub_destroy_label, 1812 .mpo_devfs_init_label = stub_init_label, 1813 .mpo_devfs_update = stub_devfs_update, 1814 .mpo_devfs_vnode_associate = stub_devfs_vnode_associate, 1815 1816 .mpo_ifnet_check_relabel = stub_ifnet_check_relabel, 1817 .mpo_ifnet_check_transmit = stub_ifnet_check_transmit, 1818 .mpo_ifnet_copy_label = stub_copy_label, 1819 .mpo_ifnet_create = stub_ifnet_create, 1820 .mpo_ifnet_create_mbuf = stub_ifnet_create_mbuf, 1821 .mpo_ifnet_destroy_label = stub_destroy_label, 1822 .mpo_ifnet_externalize_label = stub_externalize_label, 1823 .mpo_ifnet_init_label = stub_init_label, 1824 .mpo_ifnet_internalize_label = stub_internalize_label, 1825 .mpo_ifnet_relabel = stub_ifnet_relabel, 1826 1827 .mpo_inpcb_check_deliver = stub_inpcb_check_deliver, 1828 .mpo_inpcb_check_visible = stub_inpcb_check_visible, 1829 .mpo_inpcb_create = stub_inpcb_create, 1830 .mpo_inpcb_create_mbuf = stub_inpcb_create_mbuf, 1831 .mpo_inpcb_destroy_label = stub_destroy_label, 1832 .mpo_inpcb_init_label = stub_init_label_waitcheck, 1833 .mpo_inpcb_sosetlabel = stub_inpcb_sosetlabel, 1834 1835 .mpo_ip6q_create = stub_ip6q_create, 1836 .mpo_ip6q_destroy_label = stub_destroy_label, 1837 .mpo_ip6q_init_label = stub_init_label_waitcheck, 1838 .mpo_ip6q_match = stub_ip6q_match, 1839 .mpo_ip6q_update = stub_ip6q_update, 1840 .mpo_ip6q_reassemble = stub_ip6q_reassemble, 1841 1842 .mpo_ipq_create = stub_ipq_create, 1843 .mpo_ipq_destroy_label = stub_destroy_label, 1844 .mpo_ipq_init_label = stub_init_label_waitcheck, 1845 .mpo_ipq_match = stub_ipq_match, 1846 .mpo_ipq_update = stub_ipq_update, 1847 .mpo_ipq_reassemble = stub_ipq_reassemble, 1848 1849 .mpo_kdb_check_backend = stub_kdb_check_backend, 1850 1851 .mpo_kenv_check_dump = stub_kenv_check_dump, 1852 .mpo_kenv_check_get = stub_kenv_check_get, 1853 .mpo_kenv_check_set = stub_kenv_check_set, 1854 .mpo_kenv_check_unset = stub_kenv_check_unset, 1855 1856 .mpo_kld_check_load = stub_kld_check_load, 1857 .mpo_kld_check_stat = stub_kld_check_stat, 1858 1859 .mpo_mbuf_copy_label = stub_copy_label, 1860 .mpo_mbuf_destroy_label = stub_destroy_label, 1861 .mpo_mbuf_init_label = stub_init_label_waitcheck, 1862 1863 .mpo_mount_check_stat = stub_mount_check_stat, 1864 .mpo_mount_create = stub_mount_create, 1865 .mpo_mount_destroy_label = stub_destroy_label, 1866 .mpo_mount_init_label = stub_init_label, 1867 1868 .mpo_netinet_arp_send = stub_netinet_arp_send, 1869 .mpo_netinet_firewall_reply = stub_netinet_firewall_reply, 1870 .mpo_netinet_firewall_send = stub_netinet_firewall_send, 1871 .mpo_netinet_fragment = stub_netinet_fragment, 1872 .mpo_netinet_icmp_reply = stub_netinet_icmp_reply, 1873 .mpo_netinet_icmp_replyinplace = stub_netinet_icmp_replyinplace, 1874 .mpo_netinet_tcp_reply = stub_netinet_tcp_reply, 1875 .mpo_netinet_igmp_send = stub_netinet_igmp_send, 1876 1877 .mpo_netinet6_nd6_send = stub_netinet6_nd6_send, 1878 1879 .mpo_pipe_check_ioctl = stub_pipe_check_ioctl, 1880 .mpo_pipe_check_poll = stub_pipe_check_poll, 1881 .mpo_pipe_check_read = stub_pipe_check_read, 1882 .mpo_pipe_check_relabel = stub_pipe_check_relabel, 1883 .mpo_pipe_check_stat = stub_pipe_check_stat, 1884 .mpo_pipe_check_write = stub_pipe_check_write, 1885 .mpo_pipe_copy_label = stub_copy_label, 1886 .mpo_pipe_create = stub_pipe_create, 1887 .mpo_pipe_destroy_label = stub_destroy_label, 1888 .mpo_pipe_externalize_label = stub_externalize_label, 1889 .mpo_pipe_init_label = stub_init_label, 1890 .mpo_pipe_internalize_label = stub_internalize_label, 1891 .mpo_pipe_relabel = stub_pipe_relabel, 1892 1893 .mpo_posixsem_check_getvalue = stub_posixsem_check_getvalue, 1894 .mpo_posixsem_check_open = stub_posixsem_check_open, 1895 .mpo_posixsem_check_post = stub_posixsem_check_post, 1896 .mpo_posixsem_check_setmode = stub_posixsem_check_setmode, 1897 .mpo_posixsem_check_setowner = stub_posixsem_check_setowner, 1898 .mpo_posixsem_check_stat = stub_posixsem_check_stat, 1899 .mpo_posixsem_check_unlink = stub_posixsem_check_unlink, 1900 .mpo_posixsem_check_wait = stub_posixsem_check_wait, 1901 .mpo_posixsem_create = stub_posixsem_create, 1902 .mpo_posixsem_destroy_label = stub_destroy_label, 1903 .mpo_posixsem_init_label = stub_init_label, 1904 1905 .mpo_posixshm_check_create = stub_posixshm_check_create, 1906 .mpo_posixshm_check_mmap = stub_posixshm_check_mmap, 1907 .mpo_posixshm_check_open = stub_posixshm_check_open, 1908 .mpo_posixshm_check_read = stub_posixshm_check_read, 1909 .mpo_posixshm_check_setmode = stub_posixshm_check_setmode, 1910 .mpo_posixshm_check_setowner = stub_posixshm_check_setowner, 1911 .mpo_posixshm_check_stat = stub_posixshm_check_stat, 1912 .mpo_posixshm_check_truncate = stub_posixshm_check_truncate, 1913 .mpo_posixshm_check_unlink = stub_posixshm_check_unlink, 1914 .mpo_posixshm_check_write = stub_posixshm_check_write, 1915 .mpo_posixshm_create = stub_posixshm_create, 1916 .mpo_posixshm_destroy_label = stub_destroy_label, 1917 .mpo_posixshm_init_label = stub_init_label, 1918 1919 .mpo_prison_init_label = stub_init_label_waitcheck, 1920 .mpo_prison_destroy_label = stub_destroy_label, 1921 .mpo_prison_copy_label = stub_copy_label, 1922 .mpo_prison_externalize_label = stub_externalize_label, 1923 .mpo_prison_internalize_label = stub_internalize_label, 1924 .mpo_prison_relabel = stub_prison_relabel, 1925 .mpo_prison_check_relabel = stub_prison_check_relabel, 1926 .mpo_prison_check_attach = stub_prison_check_attach, 1927 .mpo_prison_check_create = stub_prison_check_create, 1928 .mpo_prison_check_get = stub_prison_check_get, 1929 .mpo_prison_check_set = stub_prison_check_set, 1930 .mpo_prison_check_remove = stub_prison_check_remove, 1931 .mpo_prison_created = stub_prison_created, 1932 .mpo_prison_cleanup = stub_prison_cleanup, 1933 .mpo_prison_attached = stub_prison_attached, 1934 1935 .mpo_priv_check = stub_priv_check, 1936 .mpo_priv_grant = stub_priv_grant, 1937 1938 .mpo_proc_check_debug = stub_proc_check_debug, 1939 .mpo_proc_check_sched = stub_proc_check_sched, 1940 .mpo_proc_check_signal = stub_proc_check_signal, 1941 .mpo_proc_check_wait = stub_proc_check_wait, 1942 1943 .mpo_socket_check_accept = stub_socket_check_accept, 1944 .mpo_socket_check_bind = stub_socket_check_bind, 1945 .mpo_socket_check_connect = stub_socket_check_connect, 1946 .mpo_socket_check_create = stub_socket_check_create, 1947 .mpo_socket_check_deliver = stub_socket_check_deliver, 1948 .mpo_socket_check_listen = stub_socket_check_listen, 1949 .mpo_socket_check_poll = stub_socket_check_poll, 1950 .mpo_socket_check_receive = stub_socket_check_receive, 1951 .mpo_socket_check_relabel = stub_socket_check_relabel, 1952 .mpo_socket_check_send = stub_socket_check_send, 1953 .mpo_socket_check_stat = stub_socket_check_stat, 1954 .mpo_socket_check_visible = stub_socket_check_visible, 1955 .mpo_socket_copy_label = stub_copy_label, 1956 .mpo_socket_create = stub_socket_create, 1957 .mpo_socket_create_mbuf = stub_socket_create_mbuf, 1958 .mpo_socket_destroy_label = stub_destroy_label, 1959 .mpo_socket_externalize_label = stub_externalize_label, 1960 .mpo_socket_init_label = stub_init_label_waitcheck, 1961 .mpo_socket_internalize_label = stub_internalize_label, 1962 .mpo_socket_newconn = stub_socket_newconn, 1963 .mpo_socket_relabel = stub_socket_relabel, 1964 1965 .mpo_socketpeer_destroy_label = stub_destroy_label, 1966 .mpo_socketpeer_externalize_label = stub_externalize_label, 1967 .mpo_socketpeer_init_label = stub_init_label_waitcheck, 1968 .mpo_socketpeer_set_from_mbuf = stub_socketpeer_set_from_mbuf, 1969 .mpo_socketpeer_set_from_socket = stub_socketpeer_set_from_socket, 1970 1971 .mpo_syncache_init_label = stub_init_label_waitcheck, 1972 .mpo_syncache_destroy_label = stub_destroy_label, 1973 .mpo_syncache_create = stub_syncache_create, 1974 .mpo_syncache_create_mbuf= stub_syncache_create_mbuf, 1975 1976 .mpo_sysvmsg_cleanup = stub_sysvmsg_cleanup, 1977 .mpo_sysvmsg_create = stub_sysvmsg_create, 1978 .mpo_sysvmsg_destroy_label = stub_destroy_label, 1979 .mpo_sysvmsg_init_label = stub_init_label, 1980 1981 .mpo_sysvmsq_check_msgmsq = stub_sysvmsq_check_msgmsq, 1982 .mpo_sysvmsq_check_msgrcv = stub_sysvmsq_check_msgrcv, 1983 .mpo_sysvmsq_check_msgrmid = stub_sysvmsq_check_msgrmid, 1984 .mpo_sysvmsq_check_msqget = stub_sysvmsq_check_msqget, 1985 .mpo_sysvmsq_check_msqsnd = stub_sysvmsq_check_msqsnd, 1986 .mpo_sysvmsq_check_msqrcv = stub_sysvmsq_check_msqrcv, 1987 .mpo_sysvmsq_check_msqctl = stub_sysvmsq_check_msqctl, 1988 .mpo_sysvmsq_cleanup = stub_sysvmsq_cleanup, 1989 .mpo_sysvmsq_create = stub_sysvmsq_create, 1990 .mpo_sysvmsq_destroy_label = stub_destroy_label, 1991 .mpo_sysvmsq_init_label = stub_init_label, 1992 1993 .mpo_sysvsem_check_semctl = stub_sysvsem_check_semctl, 1994 .mpo_sysvsem_check_semget = stub_sysvsem_check_semget, 1995 .mpo_sysvsem_check_semop = stub_sysvsem_check_semop, 1996 .mpo_sysvsem_cleanup = stub_sysvsem_cleanup, 1997 .mpo_sysvsem_create = stub_sysvsem_create, 1998 .mpo_sysvsem_destroy_label = stub_destroy_label, 1999 .mpo_sysvsem_init_label = stub_init_label, 2000 2001 .mpo_sysvshm_check_shmat = stub_sysvshm_check_shmat, 2002 .mpo_sysvshm_check_shmctl = stub_sysvshm_check_shmctl, 2003 .mpo_sysvshm_check_shmdt = stub_sysvshm_check_shmdt, 2004 .mpo_sysvshm_check_shmget = stub_sysvshm_check_shmget, 2005 .mpo_sysvshm_cleanup = stub_sysvshm_cleanup, 2006 .mpo_sysvshm_create = stub_sysvshm_create, 2007 .mpo_sysvshm_destroy_label = stub_destroy_label, 2008 .mpo_sysvshm_init_label = stub_init_label, 2009 2010 .mpo_system_check_acct = stub_system_check_acct, 2011 .mpo_system_check_audit = stub_system_check_audit, 2012 .mpo_system_check_auditctl = stub_system_check_auditctl, 2013 .mpo_system_check_auditon = stub_system_check_auditon, 2014 .mpo_system_check_reboot = stub_system_check_reboot, 2015 .mpo_system_check_swapoff = stub_system_check_swapoff, 2016 .mpo_system_check_swapon = stub_system_check_swapon, 2017 .mpo_system_check_sysctl = stub_system_check_sysctl, 2018 2019 .mpo_thread_userret = stub_thread_userret, 2020 2021 .mpo_vnode_associate_extattr = stub_vnode_associate_extattr, 2022 .mpo_vnode_associate_singlelabel = stub_vnode_associate_singlelabel, 2023 .mpo_vnode_check_access = stub_vnode_check_access, 2024 .mpo_vnode_check_chdir = stub_vnode_check_chdir, 2025 .mpo_vnode_check_chroot = stub_vnode_check_chroot, 2026 .mpo_vnode_check_create = stub_vnode_check_create, 2027 .mpo_vnode_check_deleteacl = stub_vnode_check_deleteacl, 2028 .mpo_vnode_check_deleteextattr = stub_vnode_check_deleteextattr, 2029 .mpo_vnode_check_exec = stub_vnode_check_exec, 2030 .mpo_vnode_check_getacl = stub_vnode_check_getacl, 2031 .mpo_vnode_check_getextattr = stub_vnode_check_getextattr, 2032 .mpo_vnode_check_link = stub_vnode_check_link, 2033 .mpo_vnode_check_listextattr = stub_vnode_check_listextattr, 2034 .mpo_vnode_check_lookup = stub_vnode_check_lookup, 2035 .mpo_vnode_check_mmap = stub_vnode_check_mmap, 2036 .mpo_vnode_check_mmap_downgrade = stub_vnode_check_mmap_downgrade, 2037 .mpo_vnode_check_mprotect = stub_vnode_check_mprotect, 2038 .mpo_vnode_check_open = stub_vnode_check_open, 2039 .mpo_vnode_check_poll = stub_vnode_check_poll, 2040 .mpo_vnode_check_read = stub_vnode_check_read, 2041 .mpo_vnode_check_readdir = stub_vnode_check_readdir, 2042 .mpo_vnode_check_readlink = stub_vnode_check_readlink, 2043 .mpo_vnode_check_relabel = stub_vnode_check_relabel, 2044 .mpo_vnode_check_rename_from = stub_vnode_check_rename_from, 2045 .mpo_vnode_check_rename_to = stub_vnode_check_rename_to, 2046 .mpo_vnode_check_revoke = stub_vnode_check_revoke, 2047 .mpo_vnode_check_setacl = stub_vnode_check_setacl, 2048 .mpo_vnode_check_setextattr = stub_vnode_check_setextattr, 2049 .mpo_vnode_check_setflags = stub_vnode_check_setflags, 2050 .mpo_vnode_check_setmode = stub_vnode_check_setmode, 2051 .mpo_vnode_check_setowner = stub_vnode_check_setowner, 2052 .mpo_vnode_check_setutimes = stub_vnode_check_setutimes, 2053 .mpo_vnode_check_stat = stub_vnode_check_stat, 2054 .mpo_vnode_check_unlink = stub_vnode_check_unlink, 2055 .mpo_vnode_check_write = stub_vnode_check_write, 2056 .mpo_vnode_copy_label = stub_copy_label, 2057 .mpo_vnode_create_extattr = stub_vnode_create_extattr, 2058 .mpo_vnode_destroy_label = stub_destroy_label, 2059 .mpo_vnode_execve_transition = stub_vnode_execve_transition, 2060 .mpo_vnode_execve_will_transition = stub_vnode_execve_will_transition, 2061 .mpo_vnode_externalize_label = stub_externalize_label, 2062 .mpo_vnode_init_label = stub_init_label, 2063 .mpo_vnode_internalize_label = stub_internalize_label, 2064 .mpo_vnode_relabel = stub_vnode_relabel, 2065 .mpo_vnode_setlabel_extattr = stub_vnode_setlabel_extattr, 2066 }; 2067 2068 MAC_POLICY_SET(&stub_ops, mac_stub, "TrustedBSD MAC/Stub", 2069 MPC_LOADTIME_FLAG_UNLOADOK, NULL); 2070