xref: /freebsd/sys/security/mac_test/mac_test.c (revision 1e413cf93298b5b97441a21d9a50fdcd0ee9945e)
1 /*-
2  * Copyright (c) 1999-2002, 2007 Robert N. M. Watson
3  * Copyright (c) 2001-2005 McAfee, Inc.
4  * Copyright (c) 2006 SPARTA, Inc.
5  * All rights reserved.
6  *
7  * This software was developed by Robert Watson for the TrustedBSD Project.
8  *
9  * This software was developed for the FreeBSD Project in part by McAfee
10  * Research, the Security Research Division of McAfee, Inc. under
11  * DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA
12  * CHATS research program.
13  *
14  * This software was enhanced by SPARTA ISSO under SPAWAR contract
15  * N66001-04-C-6019 ("SEFOS").
16  *
17  * Redistribution and use in source and binary forms, with or without
18  * modification, are permitted provided that the following conditions
19  * are met:
20  * 1. Redistributions of source code must retain the above copyright
21  *    notice, this list of conditions and the following disclaimer.
22  * 2. Redistributions in binary form must reproduce the above copyright
23  *    notice, this list of conditions and the following disclaimer in the
24  *    documentation and/or other materials provided with the distribution.
25  *
26  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
27  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
28  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
29  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
30  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
31  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
32  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
33  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
34  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
35  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
36  * SUCH DAMAGE.
37  *
38  * $FreeBSD$
39  */
40 
41 /*
42  * Developed by the TrustedBSD Project.
43  *
44  * MAC Test policy - tests MAC Framework labeling by assigning object class
45  * magic numbers to each label and validates that each time an object label
46  * is passed into the policy, it has a consistent object type, catching
47  * incorrectly passed labels, labels passed after free, etc.
48  */
49 
50 #include <sys/param.h>
51 #include <sys/acl.h>
52 #include <sys/kdb.h>
53 #include <sys/kernel.h>
54 #include <sys/ksem.h>
55 #include <sys/malloc.h>
56 #include <sys/module.h>
57 #include <sys/mount.h>
58 #include <sys/msg.h>
59 #include <sys/proc.h>
60 #include <sys/vnode.h>
61 #include <sys/sem.h>
62 #include <sys/shm.h>
63 #include <sys/socket.h>
64 #include <sys/socketvar.h>
65 #include <sys/sx.h>
66 #include <sys/sysctl.h>
67 
68 #include <fs/devfs/devfs.h>
69 
70 #include <net/bpfdesc.h>
71 #include <net/if.h>
72 #include <net/if_types.h>
73 #include <net/if_var.h>
74 
75 #include <security/mac/mac_policy.h>
76 
77 SYSCTL_DECL(_security_mac);
78 
79 SYSCTL_NODE(_security_mac, OID_AUTO, test, CTLFLAG_RW, 0,
80     "TrustedBSD mac_test policy controls");
81 
82 #define	MAGIC_BPF	0xfe1ad1b6
83 #define	MAGIC_DEVFS	0x9ee79c32
84 #define	MAGIC_IFNET	0xc218b120
85 #define	MAGIC_INPCB	0x4440f7bb
86 #define	MAGIC_IPQ	0x206188ef
87 #define	MAGIC_MBUF	0xbbefa5bb
88 #define	MAGIC_MOUNT	0xc7c46e47
89 #define	MAGIC_SOCKET	0x9199c6cd
90 #define	MAGIC_SYNCACHE	0x7fb838a8
91 #define	MAGIC_SYSV_MSG	0x8bbba61e
92 #define	MAGIC_SYSV_MSQ	0xea672391
93 #define	MAGIC_SYSV_SEM	0x896e8a0b
94 #define	MAGIC_SYSV_SHM	0x76119ab0
95 #define	MAGIC_PIPE	0xdc6c9919
96 #define	MAGIC_POSIX_SEM	0x78ae980c
97 #define	MAGIC_POSIX_SHM	0x4e853fc9
98 #define	MAGIC_PROC	0x3b4be98f
99 #define	MAGIC_CRED	0x9a5a4987
100 #define	MAGIC_VNODE	0x1a67a45c
101 #define	MAGIC_FREE	0x849ba1fd
102 
103 #define	SLOT(x)	mac_label_get((x), test_slot)
104 #define	SLOT_SET(x, v)	mac_label_set((x), test_slot, (v))
105 
106 static int	test_slot;
107 SYSCTL_INT(_security_mac_test, OID_AUTO, slot, CTLFLAG_RD,
108     &test_slot, 0, "Slot allocated by framework");
109 
110 SYSCTL_NODE(_security_mac_test, OID_AUTO, counter, CTLFLAG_RW, 0,
111     "TrustedBSD mac_test counters controls");
112 
113 #define	COUNTER_DECL(variable)						\
114 	static int counter_##variable;					\
115 	SYSCTL_INT(_security_mac_test_counter, OID_AUTO, variable,	\
116 	CTLFLAG_RD, &counter_##variable, 0, #variable)
117 
118 #define	COUNTER_INC(variable)	atomic_add_int(&counter_##variable, 1)
119 
120 #ifdef KDB
121 #define	DEBUGGER(func, string)	kdb_enter(KDB_WHY_MAC, (string))
122 #else
123 #define	DEBUGGER(func, string)	printf("mac_test: %s: %s\n", (func), (string))
124 #endif
125 
126 #define	LABEL_CHECK(label, magic) do {					\
127 	if (label != NULL) {						\
128 		KASSERT(SLOT(label) == magic ||	SLOT(label) == 0,	\
129 		    ("%s: bad %s label", __func__, #magic));		\
130 	}								\
131 } while (0)
132 
133 #define	LABEL_DESTROY(label, magic) do {				\
134 	if (SLOT(label) == magic || SLOT(label) == 0) {			\
135 		SLOT_SET(label, MAGIC_FREE);				\
136 	} else if (SLOT(label) == MAGIC_FREE) {				\
137 		DEBUGGER("%s: dup destroy", __func__);			\
138 	} else {							\
139 		DEBUGGER("%s: corrupted label", __func__);		\
140 	}								\
141 } while (0)
142 
143 #define	LABEL_INIT(label, magic) do {					\
144 	SLOT_SET(label, magic);						\
145 } while (0)
146 
147 #define	LABEL_NOTFREE(label) do {					\
148 	KASSERT(SLOT(label) != MAGIC_FREE,				\
149 	    ("%s: destroyed label", __func__));				\
150 } while (0)
151 
152 /*
153  * Object-specific entry point implementations are sorted alphabetically by
154  * object type name and then by operation.
155  */
156 COUNTER_DECL(bpfdesc_check_receive);
157 static int
158 test_bpfdesc_check_receive(struct bpf_d *d, struct label *dlabel,
159     struct ifnet *ifp, struct label *ifplabel)
160 {
161 
162 	LABEL_CHECK(dlabel, MAGIC_BPF);
163 	LABEL_CHECK(ifplabel, MAGIC_IFNET);
164 	COUNTER_INC(bpfdesc_check_receive);
165 
166 	return (0);
167 }
168 
169 COUNTER_DECL(bpfdesc_create);
170 static void
171 test_bpfdesc_create(struct ucred *cred, struct bpf_d *d,
172     struct label *dlabel)
173 {
174 
175 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
176 	LABEL_CHECK(dlabel, MAGIC_BPF);
177 	COUNTER_INC(bpfdesc_create);
178 }
179 
180 COUNTER_DECL(bpfdesc_create_mbuf);
181 static void
182 test_bpfdesc_create_mbuf(struct bpf_d *d, struct label *dlabel,
183     struct mbuf *m, struct label *mlabel)
184 {
185 
186 	LABEL_CHECK(dlabel, MAGIC_BPF);
187 	LABEL_CHECK(mlabel, MAGIC_MBUF);
188 	COUNTER_INC(bpfdesc_create_mbuf);
189 }
190 
191 COUNTER_DECL(bpfdesc_destroy_label);
192 static void
193 test_bpfdesc_destroy_label(struct label *label)
194 {
195 
196 	LABEL_DESTROY(label, MAGIC_BPF);
197 	COUNTER_INC(bpfdesc_destroy_label);
198 }
199 
200 COUNTER_DECL(bpfdesc_init_label);
201 static void
202 test_bpfdesc_init_label(struct label *label)
203 {
204 
205 	LABEL_INIT(label, MAGIC_BPF);
206 	COUNTER_INC(bpfdesc_init_label);
207 }
208 
209 COUNTER_DECL(cred_check_relabel);
210 static int
211 test_cred_check_relabel(struct ucred *cred, struct label *newlabel)
212 {
213 
214 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
215 	LABEL_CHECK(newlabel, MAGIC_CRED);
216 	COUNTER_INC(cred_check_relabel);
217 
218 	return (0);
219 }
220 
221 COUNTER_DECL(cred_check_visible);
222 static int
223 test_cred_check_visible(struct ucred *u1, struct ucred *u2)
224 {
225 
226 	LABEL_CHECK(u1->cr_label, MAGIC_CRED);
227 	LABEL_CHECK(u2->cr_label, MAGIC_CRED);
228 	COUNTER_INC(cred_check_visible);
229 
230 	return (0);
231 }
232 
233 COUNTER_DECL(cred_copy_label);
234 static void
235 test_cred_copy_label(struct label *src, struct label *dest)
236 {
237 
238 	LABEL_CHECK(src, MAGIC_CRED);
239 	LABEL_CHECK(dest, MAGIC_CRED);
240 	COUNTER_INC(cred_copy_label);
241 }
242 
243 COUNTER_DECL(cred_destroy_label);
244 static void
245 test_cred_destroy_label(struct label *label)
246 {
247 
248 	LABEL_DESTROY(label, MAGIC_CRED);
249 	COUNTER_INC(cred_destroy_label);
250 }
251 
252 COUNTER_DECL(cred_externalize_label);
253 static int
254 test_cred_externalize_label(struct label *label, char *element_name,
255     struct sbuf *sb, int *claimed)
256 {
257 
258 	LABEL_CHECK(label, MAGIC_CRED);
259 	COUNTER_INC(cred_externalize_label);
260 
261 	return (0);
262 }
263 
264 COUNTER_DECL(cred_init_label);
265 static void
266 test_cred_init_label(struct label *label)
267 {
268 
269 	LABEL_INIT(label, MAGIC_CRED);
270 	COUNTER_INC(cred_init_label);
271 }
272 
273 COUNTER_DECL(cred_internalize_label);
274 static int
275 test_cred_internalize_label(struct label *label, char *element_name,
276     char *element_data, int *claimed)
277 {
278 
279 	LABEL_CHECK(label, MAGIC_CRED);
280 	COUNTER_INC(cred_internalize_label);
281 
282 	return (0);
283 }
284 
285 COUNTER_DECL(cred_relabel);
286 static void
287 test_cred_relabel(struct ucred *cred, struct label *newlabel)
288 {
289 
290 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
291 	LABEL_CHECK(newlabel, MAGIC_CRED);
292 	COUNTER_INC(cred_relabel);
293 }
294 
295 COUNTER_DECL(devfs_create_device);
296 static void
297 test_devfs_create_device(struct ucred *cred, struct mount *mp,
298     struct cdev *dev, struct devfs_dirent *de, struct label *delabel)
299 {
300 
301 	if (cred != NULL)
302 		LABEL_CHECK(cred->cr_label, MAGIC_CRED);
303 	LABEL_CHECK(delabel, MAGIC_DEVFS);
304 	COUNTER_INC(devfs_create_device);
305 }
306 
307 COUNTER_DECL(devfs_create_directory);
308 static void
309 test_devfs_create_directory(struct mount *mp, char *dirname,
310     int dirnamelen, struct devfs_dirent *de, struct label *delabel)
311 {
312 
313 	LABEL_CHECK(delabel, MAGIC_DEVFS);
314 	COUNTER_INC(devfs_create_directory);
315 }
316 
317 COUNTER_DECL(devfs_create_symlink);
318 static void
319 test_devfs_create_symlink(struct ucred *cred, struct mount *mp,
320     struct devfs_dirent *dd, struct label *ddlabel, struct devfs_dirent *de,
321     struct label *delabel)
322 {
323 
324 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
325 	LABEL_CHECK(ddlabel, MAGIC_DEVFS);
326 	LABEL_CHECK(delabel, MAGIC_DEVFS);
327 	COUNTER_INC(devfs_create_symlink);
328 }
329 
330 COUNTER_DECL(devfs_destroy_label);
331 static void
332 test_devfs_destroy_label(struct label *label)
333 {
334 
335 	LABEL_DESTROY(label, MAGIC_DEVFS);
336 	COUNTER_INC(devfs_destroy_label);
337 }
338 
339 COUNTER_DECL(devfs_init_label);
340 static void
341 test_devfs_init_label(struct label *label)
342 {
343 
344 	LABEL_INIT(label, MAGIC_DEVFS);
345 	COUNTER_INC(devfs_init_label);
346 }
347 
348 COUNTER_DECL(devfs_update);
349 static void
350 test_devfs_update(struct mount *mp, struct devfs_dirent *devfs_dirent,
351     struct label *direntlabel, struct vnode *vp, struct label *vplabel)
352 {
353 
354 	LABEL_CHECK(direntlabel, MAGIC_DEVFS);
355 	LABEL_CHECK(vplabel, MAGIC_VNODE);
356 	COUNTER_INC(devfs_update);
357 }
358 
359 COUNTER_DECL(devfs_vnode_associate);
360 static void
361 test_devfs_vnode_associate(struct mount *mp, struct label *mplabel,
362     struct devfs_dirent *de, struct label *delabel, struct vnode *vp,
363     struct label *vplabel)
364 {
365 
366 	LABEL_CHECK(mplabel, MAGIC_MOUNT);
367 	LABEL_CHECK(delabel, MAGIC_DEVFS);
368 	LABEL_CHECK(vplabel, MAGIC_VNODE);
369 	COUNTER_INC(devfs_vnode_associate);
370 }
371 
372 COUNTER_DECL(ifnet_check_relabel);
373 static int
374 test_ifnet_check_relabel(struct ucred *cred, struct ifnet *ifp,
375     struct label *ifplabel, struct label *newlabel)
376 {
377 
378 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
379 	LABEL_CHECK(ifplabel, MAGIC_IFNET);
380 	LABEL_CHECK(newlabel, MAGIC_IFNET);
381 	COUNTER_INC(ifnet_check_relabel);
382 
383 	return (0);
384 }
385 
386 COUNTER_DECL(ifnet_check_transmit);
387 static int
388 test_ifnet_check_transmit(struct ifnet *ifp, struct label *ifplabel,
389     struct mbuf *m, struct label *mlabel)
390 {
391 
392 	LABEL_CHECK(ifplabel, MAGIC_IFNET);
393 	LABEL_CHECK(mlabel, MAGIC_MBUF);
394 	COUNTER_INC(ifnet_check_transmit);
395 
396 	return (0);
397 }
398 
399 COUNTER_DECL(ifnet_copy_label);
400 static void
401 test_ifnet_copy_label(struct label *src, struct label *dest)
402 {
403 
404 	LABEL_CHECK(src, MAGIC_IFNET);
405 	LABEL_CHECK(dest, MAGIC_IFNET);
406 	COUNTER_INC(ifnet_copy_label);
407 }
408 
409 COUNTER_DECL(ifnet_create);
410 static void
411 test_ifnet_create(struct ifnet *ifp, struct label *ifplabel)
412 {
413 
414 	LABEL_CHECK(ifplabel, MAGIC_IFNET);
415 	COUNTER_INC(ifnet_create);
416 }
417 
418 COUNTER_DECL(ifnet_create_mbuf);
419 static void
420 test_ifnet_create_mbuf(struct ifnet *ifp, struct label *ifplabel,
421     struct mbuf *m, struct label *mlabel)
422 {
423 
424 	LABEL_CHECK(ifplabel, MAGIC_IFNET);
425 	LABEL_CHECK(mlabel, MAGIC_MBUF);
426 	COUNTER_INC(ifnet_create_mbuf);
427 }
428 
429 COUNTER_DECL(ifnet_destroy_label);
430 static void
431 test_ifnet_destroy_label(struct label *label)
432 {
433 
434 	LABEL_DESTROY(label, MAGIC_IFNET);
435 	COUNTER_INC(ifnet_destroy_label);
436 }
437 
438 COUNTER_DECL(ifnet_externalize_label);
439 static int
440 test_ifnet_externalize_label(struct label *label, char *element_name,
441     struct sbuf *sb, int *claimed)
442 {
443 
444 	LABEL_CHECK(label, MAGIC_IFNET);
445 	COUNTER_INC(ifnet_externalize_label);
446 
447 	return (0);
448 }
449 
450 COUNTER_DECL(ifnet_init_label);
451 static void
452 test_ifnet_init_label(struct label *label)
453 {
454 
455 	LABEL_INIT(label, MAGIC_IFNET);
456 	COUNTER_INC(ifnet_init_label);
457 }
458 
459 COUNTER_DECL(ifnet_internalize_label);
460 static int
461 test_ifnet_internalize_label(struct label *label, char *element_name,
462     char *element_data, int *claimed)
463 {
464 
465 	LABEL_CHECK(label, MAGIC_IFNET);
466 	COUNTER_INC(ifnet_internalize_label);
467 
468 	return (0);
469 }
470 
471 COUNTER_DECL(ifnet_relabel);
472 static void
473 test_ifnet_relabel(struct ucred *cred, struct ifnet *ifp,
474     struct label *ifplabel, struct label *newlabel)
475 {
476 
477 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
478 	LABEL_CHECK(ifplabel, MAGIC_IFNET);
479 	LABEL_CHECK(newlabel, MAGIC_IFNET);
480 	COUNTER_INC(ifnet_relabel);
481 }
482 
483 COUNTER_DECL(inpcb_check_deliver);
484 static int
485 test_inpcb_check_deliver(struct inpcb *inp, struct label *inplabel,
486     struct mbuf *m, struct label *mlabel)
487 {
488 
489 	LABEL_CHECK(inplabel, MAGIC_INPCB);
490 	LABEL_CHECK(mlabel, MAGIC_MBUF);
491 	COUNTER_INC(inpcb_check_deliver);
492 
493 	return (0);
494 }
495 
496 COUNTER_DECL(inpcb_create);
497 static void
498 test_inpcb_create(struct socket *so, struct label *solabel,
499     struct inpcb *inp, struct label *inplabel)
500 {
501 
502 	LABEL_CHECK(solabel, MAGIC_SOCKET);
503 	LABEL_CHECK(inplabel, MAGIC_INPCB);
504 	COUNTER_INC(inpcb_create);
505 }
506 
507 COUNTER_DECL(inpcb_create_mbuf);
508 static void
509 test_inpcb_create_mbuf(struct inpcb *inp, struct label *inplabel,
510     struct mbuf *m, struct label *mlabel)
511 {
512 
513 	LABEL_CHECK(inplabel, MAGIC_INPCB);
514 	LABEL_CHECK(mlabel, MAGIC_MBUF);
515 	COUNTER_INC(inpcb_create_mbuf);
516 }
517 
518 COUNTER_DECL(inpcb_destroy_label);
519 static void
520 test_inpcb_destroy_label(struct label *label)
521 {
522 
523 	LABEL_DESTROY(label, MAGIC_INPCB);
524 	COUNTER_INC(inpcb_destroy_label);
525 }
526 
527 COUNTER_DECL(inpcb_init_label);
528 static int
529 test_inpcb_init_label(struct label *label, int flag)
530 {
531 
532 	if (flag & M_WAITOK)
533 		WITNESS_WARN(WARN_GIANTOK | WARN_SLEEPOK, NULL,
534 		    "test_inpcb_init_label() at %s:%d", __FILE__,
535 		    __LINE__);
536 
537 	LABEL_INIT(label, MAGIC_INPCB);
538 	COUNTER_INC(inpcb_init_label);
539 	return (0);
540 }
541 
542 COUNTER_DECL(inpcb_sosetlabel);
543 static void
544 test_inpcb_sosetlabel(struct socket *so, struct label *solabel,
545     struct inpcb *inp, struct label *inplabel)
546 {
547 
548 	LABEL_CHECK(solabel, MAGIC_SOCKET);
549 	LABEL_CHECK(inplabel, MAGIC_INPCB);
550 	COUNTER_INC(inpcb_sosetlabel);
551 }
552 
553 COUNTER_DECL(ipq_create);
554 static void
555 test_ipq_create(struct mbuf *fragment, struct label *fragmentlabel,
556     struct ipq *ipq, struct label *ipqlabel)
557 {
558 
559 	LABEL_CHECK(fragmentlabel, MAGIC_MBUF);
560 	LABEL_CHECK(ipqlabel, MAGIC_IPQ);
561 	COUNTER_INC(ipq_create);
562 }
563 
564 COUNTER_DECL(ipq_destroy_label);
565 static void
566 test_ipq_destroy_label(struct label *label)
567 {
568 
569 	LABEL_DESTROY(label, MAGIC_IPQ);
570 	COUNTER_INC(ipq_destroy_label);
571 }
572 
573 COUNTER_DECL(ipq_init_label);
574 static int
575 test_ipq_init_label(struct label *label, int flag)
576 {
577 
578 	if (flag & M_WAITOK)
579 		WITNESS_WARN(WARN_GIANTOK | WARN_SLEEPOK, NULL,
580 		    "test_ipq_init_label() at %s:%d", __FILE__,
581 		    __LINE__);
582 
583 	LABEL_INIT(label, MAGIC_IPQ);
584 	COUNTER_INC(ipq_init_label);
585 	return (0);
586 }
587 
588 COUNTER_DECL(ipq_match);
589 static int
590 test_ipq_match(struct mbuf *fragment, struct label *fragmentlabel,
591     struct ipq *ipq, struct label *ipqlabel)
592 {
593 
594 	LABEL_CHECK(fragmentlabel, MAGIC_MBUF);
595 	LABEL_CHECK(ipqlabel, MAGIC_IPQ);
596 	COUNTER_INC(ipq_match);
597 
598 	return (1);
599 }
600 
601 COUNTER_DECL(ipq_reassemble);
602 static void
603 test_ipq_reassemble(struct ipq *ipq, struct label *ipqlabel, struct mbuf *m,
604    struct label *mlabel)
605 {
606 
607 	LABEL_CHECK(ipqlabel, MAGIC_IPQ);
608 	LABEL_CHECK(mlabel, MAGIC_MBUF);
609 	COUNTER_INC(ipq_reassemble);
610 }
611 
612 COUNTER_DECL(ipq_update);
613 static void
614 test_ipq_update(struct mbuf *m, struct label *mlabel, struct ipq *ipq,
615     struct label *ipqlabel)
616 {
617 
618 	LABEL_CHECK(mlabel, MAGIC_MBUF);
619 	LABEL_CHECK(ipqlabel, MAGIC_IPQ);
620 	COUNTER_INC(ipq_update);
621 }
622 
623 COUNTER_DECL(kenv_check_dump);
624 static int
625 test_kenv_check_dump(struct ucred *cred)
626 {
627 
628 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
629 	COUNTER_INC(kenv_check_dump);
630 
631 	return (0);
632 }
633 
634 COUNTER_DECL(kenv_check_get);
635 static int
636 test_kenv_check_get(struct ucred *cred, char *name)
637 {
638 
639 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
640 	COUNTER_INC(kenv_check_get);
641 
642 	return (0);
643 }
644 
645 COUNTER_DECL(kenv_check_set);
646 static int
647 test_kenv_check_set(struct ucred *cred, char *name, char *value)
648 {
649 
650 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
651 	COUNTER_INC(kenv_check_set);
652 
653 	return (0);
654 }
655 
656 COUNTER_DECL(kenv_check_unset);
657 static int
658 test_kenv_check_unset(struct ucred *cred, char *name)
659 {
660 
661 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
662 	COUNTER_INC(kenv_check_unset);
663 
664 	return (0);
665 }
666 
667 COUNTER_DECL(kld_check_load);
668 static int
669 test_kld_check_load(struct ucred *cred, struct vnode *vp,
670     struct label *label)
671 {
672 
673 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
674 	LABEL_CHECK(label, MAGIC_VNODE);
675 	COUNTER_INC(kld_check_load);
676 
677 	return (0);
678 }
679 
680 COUNTER_DECL(kld_check_stat);
681 static int
682 test_kld_check_stat(struct ucred *cred)
683 {
684 
685 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
686 	COUNTER_INC(kld_check_stat);
687 
688 	return (0);
689 }
690 
691 COUNTER_DECL(mbuf_copy_label);
692 static void
693 test_mbuf_copy_label(struct label *src, struct label *dest)
694 {
695 
696 	LABEL_CHECK(src, MAGIC_MBUF);
697 	LABEL_CHECK(dest, MAGIC_MBUF);
698 	COUNTER_INC(mbuf_copy_label);
699 }
700 
701 COUNTER_DECL(mbuf_destroy_label);
702 static void
703 test_mbuf_destroy_label(struct label *label)
704 {
705 
706 	/*
707 	 * If we're loaded dynamically, there may be mbufs in flight that
708 	 * didn't have label storage allocated for them.  Handle this
709 	 * gracefully.
710 	 */
711 	if (label == NULL)
712 		return;
713 
714 	LABEL_DESTROY(label, MAGIC_MBUF);
715 	COUNTER_INC(mbuf_destroy_label);
716 }
717 
718 COUNTER_DECL(mbuf_init_label);
719 static int
720 test_mbuf_init_label(struct label *label, int flag)
721 {
722 
723 	if (flag & M_WAITOK)
724 		WITNESS_WARN(WARN_GIANTOK | WARN_SLEEPOK, NULL,
725 		    "test_mbuf_init_label() at %s:%d", __FILE__,
726 		    __LINE__);
727 
728 	LABEL_INIT(label, MAGIC_MBUF);
729 	COUNTER_INC(mbuf_init_label);
730 	return (0);
731 }
732 
733 COUNTER_DECL(mount_check_stat);
734 static int
735 test_mount_check_stat(struct ucred *cred, struct mount *mp,
736     struct label *mplabel)
737 {
738 
739 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
740 	LABEL_CHECK(mplabel, MAGIC_MOUNT);
741 	COUNTER_INC(mount_check_stat);
742 
743 	return (0);
744 }
745 
746 COUNTER_DECL(mount_create);
747 static void
748 test_mount_create(struct ucred *cred, struct mount *mp,
749     struct label *mplabel)
750 {
751 
752 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
753 	LABEL_CHECK(mplabel, MAGIC_MOUNT);
754 	COUNTER_INC(mount_create);
755 }
756 
757 COUNTER_DECL(mount_destroy_label);
758 static void
759 test_mount_destroy_label(struct label *label)
760 {
761 
762 	LABEL_DESTROY(label, MAGIC_MOUNT);
763 	COUNTER_INC(mount_destroy_label);
764 }
765 
766 COUNTER_DECL(mount_init_label);
767 static void
768 test_mount_init_label(struct label *label)
769 {
770 
771 	LABEL_INIT(label, MAGIC_MOUNT);
772 	COUNTER_INC(mount_init_label);
773 }
774 
775 COUNTER_DECL(netatalk_aarp_send);
776 static void
777 test_netatalk_aarp_send(struct ifnet *ifp, struct label *ifplabel,
778     struct mbuf *m, struct label *mlabel)
779 {
780 
781 	LABEL_CHECK(ifplabel, MAGIC_IFNET);
782 	LABEL_CHECK(mlabel, MAGIC_MBUF);
783 	COUNTER_INC(netatalk_aarp_send);
784 }
785 
786 COUNTER_DECL(netinet_arp_send);
787 static void
788 test_netinet_arp_send(struct ifnet *ifp, struct label *ifplabel,
789     struct mbuf *m, struct label *mlabel)
790 {
791 
792 	LABEL_CHECK(ifplabel, MAGIC_IFNET);
793 	LABEL_CHECK(mlabel, MAGIC_MBUF);
794 	COUNTER_INC(netinet_arp_send);
795 }
796 
797 COUNTER_DECL(netinet_fragment);
798 static void
799 test_netinet_fragment(struct mbuf *m, struct label *mlabel,
800     struct mbuf *frag, struct label *fraglabel)
801 {
802 
803 	LABEL_CHECK(mlabel, MAGIC_MBUF);
804 	LABEL_CHECK(fraglabel, MAGIC_MBUF);
805 	COUNTER_INC(netinet_fragment);
806 }
807 
808 COUNTER_DECL(netinet_icmp_reply);
809 static void
810 test_netinet_icmp_reply(struct mbuf *mrecv, struct label *mrecvlabel,
811     struct mbuf *msend, struct label *msendlabel)
812 {
813 
814 	LABEL_CHECK(mrecvlabel, MAGIC_MBUF);
815 	LABEL_CHECK(msendlabel, MAGIC_MBUF);
816 	COUNTER_INC(netinet_icmp_reply);
817 }
818 
819 COUNTER_DECL(netinet_icmp_replyinplace);
820 static void
821 test_netinet_icmp_replyinplace(struct mbuf *m, struct label *mlabel)
822 {
823 
824 	LABEL_CHECK(mlabel, MAGIC_MBUF);
825 	COUNTER_INC(netinet_icmp_replyinplace);
826 }
827 
828 COUNTER_DECL(netinet_igmp_send);
829 static void
830 test_netinet_igmp_send(struct ifnet *ifp, struct label *ifplabel,
831     struct mbuf *m, struct label *mlabel)
832 {
833 
834 	LABEL_CHECK(ifplabel, MAGIC_IFNET);
835 	LABEL_CHECK(mlabel, MAGIC_MBUF);
836 	COUNTER_INC(netinet_igmp_send);
837 }
838 
839 COUNTER_DECL(netinet_tcp_reply);
840 static void
841 test_netinet_tcp_reply(struct mbuf *m, struct label *mlabel)
842 {
843 
844 	LABEL_CHECK(mlabel, MAGIC_MBUF);
845 	COUNTER_INC(netinet_tcp_reply);
846 }
847 
848 COUNTER_DECL(netinet6_nd6_send);
849 static void
850 test_netinet6_nd6_send(struct ifnet *ifp, struct label *ifplabel,
851     struct mbuf *m, struct label *mlabel)
852 {
853 
854 	LABEL_CHECK(ifplabel, MAGIC_IFNET);
855 	LABEL_CHECK(mlabel, MAGIC_MBUF);
856 	COUNTER_INC(netinet6_nd6_send);
857 }
858 
859 COUNTER_DECL(pipe_check_ioctl);
860 static int
861 test_pipe_check_ioctl(struct ucred *cred, struct pipepair *pp,
862     struct label *pplabel, unsigned long cmd, void /* caddr_t */ *data)
863 {
864 
865 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
866 	LABEL_CHECK(pplabel, MAGIC_PIPE);
867 	COUNTER_INC(pipe_check_ioctl);
868 
869 	return (0);
870 }
871 
872 COUNTER_DECL(pipe_check_poll);
873 static int
874 test_pipe_check_poll(struct ucred *cred, struct pipepair *pp,
875     struct label *pplabel)
876 {
877 
878 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
879 	LABEL_CHECK(pplabel, MAGIC_PIPE);
880 	COUNTER_INC(pipe_check_poll);
881 
882 	return (0);
883 }
884 
885 COUNTER_DECL(pipe_check_read);
886 static int
887 test_pipe_check_read(struct ucred *cred, struct pipepair *pp,
888     struct label *pplabel)
889 {
890 
891 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
892 	LABEL_CHECK(pplabel, MAGIC_PIPE);
893 	COUNTER_INC(pipe_check_read);
894 
895 	return (0);
896 }
897 
898 COUNTER_DECL(pipe_check_relabel);
899 static int
900 test_pipe_check_relabel(struct ucred *cred, struct pipepair *pp,
901     struct label *pplabel, struct label *newlabel)
902 {
903 
904 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
905 	LABEL_CHECK(pplabel, MAGIC_PIPE);
906 	LABEL_CHECK(newlabel, MAGIC_PIPE);
907 	COUNTER_INC(pipe_check_relabel);
908 
909 	return (0);
910 }
911 
912 COUNTER_DECL(pipe_check_stat);
913 static int
914 test_pipe_check_stat(struct ucred *cred, struct pipepair *pp,
915     struct label *pplabel)
916 {
917 
918 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
919 	LABEL_CHECK(pplabel, MAGIC_PIPE);
920 	COUNTER_INC(pipe_check_stat);
921 
922 	return (0);
923 }
924 
925 COUNTER_DECL(pipe_check_write);
926 static int
927 test_pipe_check_write(struct ucred *cred, struct pipepair *pp,
928     struct label *pplabel)
929 {
930 
931 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
932 	LABEL_CHECK(pplabel, MAGIC_PIPE);
933 	COUNTER_INC(pipe_check_write);
934 
935 	return (0);
936 }
937 
938 COUNTER_DECL(pipe_copy_label);
939 static void
940 test_pipe_copy_label(struct label *src, struct label *dest)
941 {
942 
943 	LABEL_CHECK(src, MAGIC_PIPE);
944 	LABEL_CHECK(dest, MAGIC_PIPE);
945 	COUNTER_INC(pipe_copy_label);
946 }
947 
948 COUNTER_DECL(pipe_create);
949 static void
950 test_pipe_create(struct ucred *cred, struct pipepair *pp,
951    struct label *pplabel)
952 {
953 
954 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
955 	LABEL_CHECK(pplabel, MAGIC_PIPE);
956 	COUNTER_INC(pipe_create);
957 }
958 
959 COUNTER_DECL(pipe_destroy_label);
960 static void
961 test_pipe_destroy_label(struct label *label)
962 {
963 
964 	LABEL_DESTROY(label, MAGIC_PIPE);
965 	COUNTER_INC(pipe_destroy_label);
966 }
967 
968 COUNTER_DECL(pipe_externalize_label);
969 static int
970 test_pipe_externalize_label(struct label *label, char *element_name,
971     struct sbuf *sb, int *claimed)
972 {
973 
974 	LABEL_CHECK(label, MAGIC_PIPE);
975 	COUNTER_INC(pipe_externalize_label);
976 
977 	return (0);
978 }
979 
980 COUNTER_DECL(pipe_init_label);
981 static void
982 test_pipe_init_label(struct label *label)
983 {
984 
985 	LABEL_INIT(label, MAGIC_PIPE);
986 	COUNTER_INC(pipe_init_label);
987 }
988 
989 COUNTER_DECL(pipe_internalize_label);
990 static int
991 test_pipe_internalize_label(struct label *label, char *element_name,
992     char *element_data, int *claimed)
993 {
994 
995 	LABEL_CHECK(label, MAGIC_PIPE);
996 	COUNTER_INC(pipe_internalize_label);
997 
998 	return (0);
999 }
1000 
1001 COUNTER_DECL(pipe_relabel);
1002 static void
1003 test_pipe_relabel(struct ucred *cred, struct pipepair *pp,
1004     struct label *pplabel, struct label *newlabel)
1005 {
1006 
1007 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
1008 	LABEL_CHECK(pplabel, MAGIC_PIPE);
1009 	LABEL_CHECK(newlabel, MAGIC_PIPE);
1010 	COUNTER_INC(pipe_relabel);
1011 }
1012 
1013 COUNTER_DECL(posixsem_check_destroy);
1014 static int
1015 test_posixsem_check_destroy(struct ucred *cred, struct ksem *ks,
1016     struct label *kslabel)
1017 {
1018 
1019 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
1020 	LABEL_CHECK(kslabel, MAGIC_POSIX_SEM);
1021 	COUNTER_INC(posixsem_check_destroy);
1022 
1023 	return (0);
1024 }
1025 
1026 COUNTER_DECL(posixsem_check_getvalue);
1027 static int
1028 test_posixsem_check_getvalue(struct ucred *cred, struct ksem *ks,
1029     struct label *kslabel)
1030 {
1031 
1032 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
1033 	LABEL_CHECK(kslabel, MAGIC_POSIX_SEM);
1034 	COUNTER_INC(posixsem_check_getvalue);
1035 
1036 	return (0);
1037 }
1038 
1039 COUNTER_DECL(posixsem_check_open);
1040 static int
1041 test_posixsem_check_open(struct ucred *cred, struct ksem *ks,
1042     struct label *kslabel)
1043 {
1044 
1045 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
1046 	LABEL_CHECK(kslabel, MAGIC_POSIX_SEM);
1047 	COUNTER_INC(posixsem_check_open);
1048 
1049 	return (0);
1050 }
1051 
1052 COUNTER_DECL(posixsem_check_post);
1053 static int
1054 test_posixsem_check_post(struct ucred *cred, struct ksem *ks,
1055     struct label *kslabel)
1056 {
1057 
1058 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
1059 	LABEL_CHECK(kslabel, MAGIC_POSIX_SEM);
1060 	COUNTER_INC(posixsem_check_post);
1061 
1062 	return (0);
1063 }
1064 
1065 COUNTER_DECL(posixsem_check_unlink);
1066 static int
1067 test_posixsem_check_unlink(struct ucred *cred, struct ksem *ks,
1068     struct label *kslabel)
1069 {
1070 
1071 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
1072 	LABEL_CHECK(kslabel, MAGIC_POSIX_SEM);
1073 	COUNTER_INC(posixsem_check_unlink);
1074 
1075 	return (0);
1076 }
1077 
1078 COUNTER_DECL(posixsem_check_wait);
1079 static int
1080 test_posixsem_check_wait(struct ucred *cred, struct ksem *ks,
1081     struct label *kslabel)
1082 {
1083 
1084 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
1085 	LABEL_CHECK(kslabel, MAGIC_POSIX_SEM);
1086 	COUNTER_INC(posixsem_check_wait);
1087 
1088 	return (0);
1089 }
1090 
1091 COUNTER_DECL(posixsem_create);
1092 static void
1093 test_posixsem_create(struct ucred *cred, struct ksem *ks,
1094    struct label *kslabel)
1095 {
1096 
1097 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
1098 	LABEL_CHECK(kslabel, MAGIC_POSIX_SEM);
1099 	COUNTER_INC(posixsem_create);
1100 }
1101 
1102 COUNTER_DECL(posixsem_destroy_label);
1103 static void
1104 test_posixsem_destroy_label(struct label *label)
1105 {
1106 
1107 	LABEL_DESTROY(label, MAGIC_POSIX_SEM);
1108 	COUNTER_INC(posixsem_destroy_label);
1109 }
1110 
1111 COUNTER_DECL(posixsem_init_label);
1112 static void
1113 test_posixsem_init_label(struct label *label)
1114 {
1115 
1116 	LABEL_INIT(label, MAGIC_POSIX_SEM);
1117 	COUNTER_INC(posixsem_init_label);
1118 }
1119 
1120 COUNTER_DECL(posixshm_check_mmap);
1121 static int
1122 test_posixshm_check_mmap(struct ucred *cred, struct shmfd *shmfd,
1123     struct label *shmfdlabel, int prot, int flags)
1124 {
1125 
1126 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
1127 	LABEL_CHECK(shmfdlabel, MAGIC_POSIX_SHM);
1128 	return (0);
1129 }
1130 
1131 COUNTER_DECL(posixshm_check_open);
1132 static int
1133 test_posixshm_check_open(struct ucred *cred, struct shmfd *shmfd,
1134     struct label *shmfdlabel)
1135 {
1136 
1137 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
1138 	LABEL_CHECK(shmfdlabel, MAGIC_POSIX_SHM);
1139 	return (0);
1140 }
1141 
1142 COUNTER_DECL(posixshm_check_stat);
1143 static int
1144 test_posixshm_check_stat(struct ucred *active_cred,
1145     struct ucred *file_cred, struct shmfd *shmfd, struct label *shmfdlabel)
1146 {
1147 
1148 	LABEL_CHECK(active_cred->cr_label, MAGIC_CRED);
1149 	LABEL_CHECK(file_cred->cr_label, MAGIC_CRED);
1150 	LABEL_CHECK(shmfdlabel, MAGIC_POSIX_SHM);
1151 	return (0);
1152 }
1153 
1154 COUNTER_DECL(posixshm_check_truncate);
1155 static int
1156 test_posixshm_check_truncate(struct ucred *active_cred,
1157     struct ucred *file_cred, struct shmfd *shmfd, struct label *shmfdlabel)
1158 {
1159 
1160 	LABEL_CHECK(active_cred->cr_label, MAGIC_CRED);
1161 	LABEL_CHECK(file_cred->cr_label, MAGIC_CRED);
1162 	LABEL_CHECK(shmfdlabel, MAGIC_POSIX_SHM);
1163 	return (0);
1164 }
1165 
1166 COUNTER_DECL(posixshm_check_unlink);
1167 static int
1168 test_posixshm_check_unlink(struct ucred *cred, struct shmfd *shmfd,
1169     struct label *shmfdlabel)
1170 {
1171 
1172 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
1173 	LABEL_CHECK(shmfdlabel, MAGIC_POSIX_SHM);
1174 	return (0);
1175 }
1176 
1177 COUNTER_DECL(posixshm_create);
1178 static void
1179 test_posixshm_create(struct ucred *cred, struct shmfd *shmfd,
1180    struct label *shmfdlabel)
1181 {
1182 
1183 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
1184 	LABEL_CHECK(shmfdlabel, MAGIC_POSIX_SHM);
1185 	COUNTER_INC(posixshm_create);
1186 }
1187 
1188 COUNTER_DECL(posixshm_destroy_label);
1189 static void
1190 test_posixshm_destroy_label(struct label *label)
1191 {
1192 
1193 	LABEL_DESTROY(label, MAGIC_POSIX_SHM);
1194 	COUNTER_INC(posixshm_destroy_label);
1195 }
1196 
1197 COUNTER_DECL(posixshm_init_label);
1198 static void
1199 test_posixshm_init_label(struct label *label)
1200 {
1201 
1202 	LABEL_INIT(label, MAGIC_POSIX_SHM);
1203 	COUNTER_INC(posixshm_init_label);
1204 }
1205 
1206 COUNTER_DECL(proc_check_debug);
1207 static int
1208 test_proc_check_debug(struct ucred *cred, struct proc *p)
1209 {
1210 
1211 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
1212 	LABEL_CHECK(p->p_ucred->cr_label, MAGIC_CRED);
1213 	COUNTER_INC(proc_check_debug);
1214 
1215 	return (0);
1216 }
1217 
1218 COUNTER_DECL(proc_check_sched);
1219 static int
1220 test_proc_check_sched(struct ucred *cred, struct proc *p)
1221 {
1222 
1223 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
1224 	LABEL_CHECK(p->p_ucred->cr_label, MAGIC_CRED);
1225 	COUNTER_INC(proc_check_sched);
1226 
1227 	return (0);
1228 }
1229 
1230 COUNTER_DECL(proc_check_signal);
1231 static int
1232 test_proc_check_signal(struct ucred *cred, struct proc *p, int signum)
1233 {
1234 
1235 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
1236 	LABEL_CHECK(p->p_ucred->cr_label, MAGIC_CRED);
1237 	COUNTER_INC(proc_check_signal);
1238 
1239 	return (0);
1240 }
1241 
1242 COUNTER_DECL(proc_check_setaudit);
1243 static int
1244 test_proc_check_setaudit(struct ucred *cred, struct auditinfo *ai)
1245 {
1246 
1247 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
1248 	COUNTER_INC(proc_check_setaudit);
1249 
1250 	return (0);
1251 }
1252 
1253 COUNTER_DECL(proc_check_setaudit_addr);
1254 static int
1255 test_proc_check_setaudit_addr(struct ucred *cred,
1256     struct auditinfo_addr *aia)
1257 {
1258 
1259 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
1260 	COUNTER_INC(proc_check_setaudit_addr);
1261 
1262 	return (0);
1263 }
1264 
1265 COUNTER_DECL(proc_check_setauid);
1266 static int
1267 test_proc_check_setauid(struct ucred *cred, uid_t auid)
1268 {
1269 
1270 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
1271 	COUNTER_INC(proc_check_setauid);
1272 
1273 	return (0);
1274 }
1275 
1276 COUNTER_DECL(proc_check_setegid);
1277 static int
1278 test_proc_check_setegid(struct ucred *cred, gid_t egid)
1279 {
1280 
1281 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
1282 	COUNTER_INC(proc_check_setegid);
1283 
1284 	return (0);
1285 }
1286 
1287 COUNTER_DECL(proc_check_euid);
1288 static int
1289 test_proc_check_seteuid(struct ucred *cred, uid_t euid)
1290 {
1291 
1292 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
1293 	COUNTER_INC(proc_check_euid);
1294 
1295 	return (0);
1296 }
1297 
1298 COUNTER_DECL(proc_check_setregid);
1299 static int
1300 test_proc_check_setregid(struct ucred *cred, gid_t rgid, gid_t egid)
1301 {
1302 
1303 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
1304 	COUNTER_INC(proc_check_setregid);
1305 
1306 	return (0);
1307 }
1308 
1309 COUNTER_DECL(proc_check_setreuid);
1310 static int
1311 test_proc_check_setreuid(struct ucred *cred, uid_t ruid, uid_t euid)
1312 {
1313 
1314 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
1315 	COUNTER_INC(proc_check_setreuid);
1316 
1317 	return (0);
1318 }
1319 
1320 COUNTER_DECL(proc_check_setgid);
1321 static int
1322 test_proc_check_setgid(struct ucred *cred, gid_t gid)
1323 {
1324 
1325 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
1326 	COUNTER_INC(proc_check_setgid);
1327 
1328 	return (0);
1329 }
1330 
1331 COUNTER_DECL(proc_check_setgroups);
1332 static int
1333 test_proc_check_setgroups(struct ucred *cred, int ngroups,
1334 	gid_t *gidset)
1335 {
1336 
1337 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
1338 	COUNTER_INC(proc_check_setgroups);
1339 
1340 	return (0);
1341 }
1342 
1343 COUNTER_DECL(proc_check_setresgid);
1344 static int
1345 test_proc_check_setresgid(struct ucred *cred, gid_t rgid, gid_t egid,
1346 	gid_t sgid)
1347 {
1348 
1349 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
1350 	COUNTER_INC(proc_check_setresgid);
1351 
1352 	return (0);
1353 }
1354 
1355 COUNTER_DECL(proc_check_setresuid);
1356 static int
1357 test_proc_check_setresuid(struct ucred *cred, uid_t ruid, uid_t euid,
1358 	uid_t suid)
1359 {
1360 
1361 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
1362 	COUNTER_INC(proc_check_setresuid);
1363 
1364 	return (0);
1365 }
1366 
1367 COUNTER_DECL(proc_check_setuid);
1368 static int
1369 test_proc_check_setuid(struct ucred *cred, uid_t uid)
1370 {
1371 
1372 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
1373 	COUNTER_INC(proc_check_setuid);
1374 
1375 	return (0);
1376 }
1377 
1378 COUNTER_DECL(proc_check_wait);
1379 static int
1380 test_proc_check_wait(struct ucred *cred, struct proc *p)
1381 {
1382 
1383 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
1384 	LABEL_CHECK(p->p_ucred->cr_label, MAGIC_CRED);
1385 	COUNTER_INC(proc_check_wait);
1386 
1387 	return (0);
1388 }
1389 
1390 COUNTER_DECL(proc_create_init);
1391 static void
1392 test_proc_create_init(struct ucred *cred)
1393 {
1394 
1395 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
1396 	COUNTER_INC(proc_create_init);
1397 }
1398 
1399 COUNTER_DECL(proc_create_swapper);
1400 static void
1401 test_proc_create_swapper(struct ucred *cred)
1402 {
1403 
1404 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
1405 	COUNTER_INC(proc_create_swapper);
1406 }
1407 
1408 COUNTER_DECL(proc_destroy_label);
1409 static void
1410 test_proc_destroy_label(struct label *label)
1411 {
1412 
1413 	LABEL_DESTROY(label, MAGIC_PROC);
1414 	COUNTER_INC(proc_destroy_label);
1415 }
1416 
1417 COUNTER_DECL(proc_init_label);
1418 static void
1419 test_proc_init_label(struct label *label)
1420 {
1421 
1422 	LABEL_INIT(label, MAGIC_PROC);
1423 	COUNTER_INC(proc_init_label);
1424 }
1425 
1426 COUNTER_DECL(socket_check_accept);
1427 static int
1428 test_socket_check_accept(struct ucred *cred, struct socket *so,
1429     struct label *solabel)
1430 {
1431 
1432 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
1433 	LABEL_CHECK(solabel, MAGIC_SOCKET);
1434 	COUNTER_INC(socket_check_accept);
1435 
1436 	return (0);
1437 }
1438 
1439 COUNTER_DECL(socket_check_bind);
1440 static int
1441 test_socket_check_bind(struct ucred *cred, struct socket *so,
1442     struct label *solabel, struct sockaddr *sa)
1443 {
1444 
1445 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
1446 	LABEL_CHECK(solabel, MAGIC_SOCKET);
1447 	COUNTER_INC(socket_check_bind);
1448 
1449 	return (0);
1450 }
1451 
1452 COUNTER_DECL(socket_check_connect);
1453 static int
1454 test_socket_check_connect(struct ucred *cred, struct socket *so,
1455     struct label *solabel, struct sockaddr *sa)
1456 {
1457 
1458 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
1459 	LABEL_CHECK(solabel, MAGIC_SOCKET);
1460 	COUNTER_INC(socket_check_connect);
1461 
1462 	return (0);
1463 }
1464 
1465 COUNTER_DECL(socket_check_deliver);
1466 static int
1467 test_socket_check_deliver(struct socket *so, struct label *solabel,
1468     struct mbuf *m, struct label *mlabel)
1469 {
1470 
1471 	LABEL_CHECK(solabel, MAGIC_SOCKET);
1472 	LABEL_CHECK(mlabel, MAGIC_MBUF);
1473 	COUNTER_INC(socket_check_deliver);
1474 
1475 	return (0);
1476 }
1477 
1478 COUNTER_DECL(socket_check_listen);
1479 static int
1480 test_socket_check_listen(struct ucred *cred, struct socket *so,
1481     struct label *solabel)
1482 {
1483 
1484 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
1485 	LABEL_CHECK(solabel, MAGIC_SOCKET);
1486 	COUNTER_INC(socket_check_listen);
1487 
1488 	return (0);
1489 }
1490 
1491 COUNTER_DECL(socket_check_poll);
1492 static int
1493 test_socket_check_poll(struct ucred *cred, struct socket *so,
1494     struct label *solabel)
1495 {
1496 
1497 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
1498 	LABEL_CHECK(solabel, MAGIC_SOCKET);
1499 	COUNTER_INC(socket_check_poll);
1500 
1501 	return (0);
1502 }
1503 
1504 COUNTER_DECL(socket_check_receive);
1505 static int
1506 test_socket_check_receive(struct ucred *cred, struct socket *so,
1507     struct label *solabel)
1508 {
1509 
1510 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
1511 	LABEL_CHECK(solabel, MAGIC_SOCKET);
1512 	COUNTER_INC(socket_check_receive);
1513 
1514 	return (0);
1515 }
1516 
1517 COUNTER_DECL(socket_check_relabel);
1518 static int
1519 test_socket_check_relabel(struct ucred *cred, struct socket *so,
1520     struct label *solabel, struct label *newlabel)
1521 {
1522 
1523 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
1524 	LABEL_CHECK(solabel, MAGIC_SOCKET);
1525 	LABEL_CHECK(newlabel, MAGIC_SOCKET);
1526 	COUNTER_INC(socket_check_relabel);
1527 
1528 	return (0);
1529 }
1530 
1531 COUNTER_DECL(socket_check_send);
1532 static int
1533 test_socket_check_send(struct ucred *cred, struct socket *so,
1534     struct label *solabel)
1535 {
1536 
1537 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
1538 	LABEL_CHECK(solabel, MAGIC_SOCKET);
1539 	COUNTER_INC(socket_check_send);
1540 
1541 	return (0);
1542 }
1543 
1544 COUNTER_DECL(socket_check_stat);
1545 static int
1546 test_socket_check_stat(struct ucred *cred, struct socket *so,
1547     struct label *solabel)
1548 {
1549 
1550 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
1551 	LABEL_CHECK(solabel, MAGIC_SOCKET);
1552 	COUNTER_INC(socket_check_stat);
1553 
1554 	return (0);
1555 }
1556 
1557 COUNTER_DECL(socket_check_visible);
1558 static int
1559 test_socket_check_visible(struct ucred *cred, struct socket *so,
1560     struct label *solabel)
1561 {
1562 
1563 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
1564 	LABEL_CHECK(solabel, MAGIC_SOCKET);
1565 	COUNTER_INC(socket_check_visible);
1566 
1567 	return (0);
1568 }
1569 
1570 COUNTER_DECL(socket_copy_label);
1571 static void
1572 test_socket_copy_label(struct label *src, struct label *dest)
1573 {
1574 
1575 	LABEL_CHECK(src, MAGIC_SOCKET);
1576 	LABEL_CHECK(dest, MAGIC_SOCKET);
1577 	COUNTER_INC(socket_copy_label);
1578 }
1579 
1580 COUNTER_DECL(socket_create);
1581 static void
1582 test_socket_create(struct ucred *cred, struct socket *so,
1583     struct label *solabel)
1584 {
1585 
1586 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
1587 	LABEL_CHECK(solabel, MAGIC_SOCKET);
1588 	COUNTER_INC(socket_create);
1589 }
1590 
1591 COUNTER_DECL(socket_create_mbuf);
1592 static void
1593 test_socket_create_mbuf(struct socket *so, struct label *socketlabel,
1594     struct mbuf *m, struct label *mlabel)
1595 {
1596 
1597 	LABEL_CHECK(socketlabel, MAGIC_SOCKET);
1598 	LABEL_CHECK(mlabel, MAGIC_MBUF);
1599 	COUNTER_INC(socket_create_mbuf);
1600 }
1601 
1602 COUNTER_DECL(socket_destroy_label);
1603 static void
1604 test_socket_destroy_label(struct label *label)
1605 {
1606 
1607 	LABEL_DESTROY(label, MAGIC_SOCKET);
1608 	COUNTER_INC(socket_destroy_label);
1609 }
1610 
1611 COUNTER_DECL(socket_externalize_label);
1612 static int
1613 test_socket_externalize_label(struct label *label, char *element_name,
1614     struct sbuf *sb, int *claimed)
1615 {
1616 
1617 	LABEL_CHECK(label, MAGIC_SOCKET);
1618 	COUNTER_INC(socket_externalize_label);
1619 
1620 	return (0);
1621 }
1622 
1623 COUNTER_DECL(socket_init_label);
1624 static int
1625 test_socket_init_label(struct label *label, int flag)
1626 {
1627 
1628 	if (flag & M_WAITOK)
1629 		WITNESS_WARN(WARN_GIANTOK | WARN_SLEEPOK, NULL,
1630 		    "test_socket_init_label() at %s:%d", __FILE__,
1631 		    __LINE__);
1632 
1633 	LABEL_INIT(label, MAGIC_SOCKET);
1634 	COUNTER_INC(socket_init_label);
1635 	return (0);
1636 }
1637 
1638 COUNTER_DECL(socket_internalize_label);
1639 static int
1640 test_socket_internalize_label(struct label *label, char *element_name,
1641     char *element_data, int *claimed)
1642 {
1643 
1644 	LABEL_CHECK(label, MAGIC_SOCKET);
1645 	COUNTER_INC(socket_internalize_label);
1646 
1647 	return (0);
1648 }
1649 
1650 COUNTER_DECL(socket_newconn);
1651 static void
1652 test_socket_newconn(struct socket *oldso, struct label *oldsolabel,
1653     struct socket *newso, struct label *newsolabel)
1654 {
1655 
1656 	LABEL_CHECK(oldsolabel, MAGIC_SOCKET);
1657 	LABEL_CHECK(newsolabel, MAGIC_SOCKET);
1658 	COUNTER_INC(socket_newconn);
1659 }
1660 
1661 COUNTER_DECL(socket_relabel);
1662 static void
1663 test_socket_relabel(struct ucred *cred, struct socket *so,
1664     struct label *solabel, struct label *newlabel)
1665 {
1666 
1667 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
1668 	LABEL_CHECK(solabel, MAGIC_SOCKET);
1669 	LABEL_CHECK(newlabel, MAGIC_SOCKET);
1670 	COUNTER_INC(socket_relabel);
1671 }
1672 
1673 COUNTER_DECL(socketpeer_destroy_label);
1674 static void
1675 test_socketpeer_destroy_label(struct label *label)
1676 {
1677 
1678 	LABEL_DESTROY(label, MAGIC_SOCKET);
1679 	COUNTER_INC(socketpeer_destroy_label);
1680 }
1681 
1682 COUNTER_DECL(socketpeer_externalize_label);
1683 static int
1684 test_socketpeer_externalize_label(struct label *label, char *element_name,
1685     struct sbuf *sb, int *claimed)
1686 {
1687 
1688 	LABEL_CHECK(label, MAGIC_SOCKET);
1689 	COUNTER_INC(socketpeer_externalize_label);
1690 
1691 	return (0);
1692 }
1693 
1694 COUNTER_DECL(socketpeer_init_label);
1695 static int
1696 test_socketpeer_init_label(struct label *label, int flag)
1697 {
1698 
1699 	if (flag & M_WAITOK)
1700 		WITNESS_WARN(WARN_GIANTOK | WARN_SLEEPOK, NULL,
1701 		    "test_socketpeer_init_label() at %s:%d", __FILE__,
1702 		    __LINE__);
1703 
1704 	LABEL_INIT(label, MAGIC_SOCKET);
1705 	COUNTER_INC(socketpeer_init_label);
1706 	return (0);
1707 }
1708 
1709 COUNTER_DECL(socketpeer_set_from_mbuf);
1710 static void
1711 test_socketpeer_set_from_mbuf(struct mbuf *m, struct label *mlabel,
1712     struct socket *socket, struct label *socketpeerlabel)
1713 {
1714 
1715 	LABEL_CHECK(mlabel, MAGIC_MBUF);
1716 	LABEL_CHECK(socketpeerlabel, MAGIC_SOCKET);
1717 	COUNTER_INC(socketpeer_set_from_mbuf);
1718 }
1719 
1720 COUNTER_DECL(socketpeer_set_from_socket);
1721 static void
1722 test_socketpeer_set_from_socket(struct socket *oldso,
1723     struct label *oldsolabel, struct socket *newso,
1724     struct label *newsopeerlabel)
1725 {
1726 
1727 	LABEL_CHECK(oldsolabel, MAGIC_SOCKET);
1728 	LABEL_CHECK(newsopeerlabel, MAGIC_SOCKET);
1729 	COUNTER_INC(socketpeer_set_from_socket);
1730 }
1731 
1732 COUNTER_DECL(syncache_create);
1733 static void
1734 test_syncache_create(struct label *label, struct inpcb *inp)
1735 {
1736 
1737 	LABEL_CHECK(label, MAGIC_SYNCACHE);
1738 	COUNTER_INC(syncache_create);
1739 }
1740 
1741 COUNTER_DECL(syncache_create_mbuf);
1742 static void
1743 test_syncache_create_mbuf(struct label *sc_label, struct mbuf *m,
1744     struct label *mlabel)
1745 {
1746 
1747 	LABEL_CHECK(sc_label, MAGIC_SYNCACHE);
1748 	LABEL_CHECK(mlabel, MAGIC_MBUF);
1749 	COUNTER_INC(syncache_create_mbuf);
1750 }
1751 
1752 COUNTER_DECL(syncache_destroy_label);
1753 static void
1754 test_syncache_destroy_label(struct label *label)
1755 {
1756 
1757 	LABEL_DESTROY(label, MAGIC_SYNCACHE);
1758 	COUNTER_INC(syncache_destroy_label);
1759 }
1760 
1761 COUNTER_DECL(syncache_init_label);
1762 static int
1763 test_syncache_init_label(struct label *label, int flag)
1764 {
1765 
1766 	if (flag & M_WAITOK)
1767 		WITNESS_WARN(WARN_GIANTOK | WARN_SLEEPOK, NULL,
1768 		    "test_syncache_init_label() at %s:%d", __FILE__,
1769 		    __LINE__);
1770 	LABEL_INIT(label, MAGIC_SYNCACHE);
1771 	COUNTER_INC(syncache_init_label);
1772 	return (0);
1773 }
1774 
1775 COUNTER_DECL(system_check_acct);
1776 static int
1777 test_system_check_acct(struct ucred *cred, struct vnode *vp,
1778     struct label *vplabel)
1779 {
1780 
1781 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
1782 	LABEL_CHECK(vplabel, MAGIC_VNODE);
1783 	COUNTER_INC(system_check_acct);
1784 
1785 	return (0);
1786 }
1787 
1788 COUNTER_DECL(system_check_audit);
1789 static int
1790 test_system_check_audit(struct ucred *cred, void *record, int length)
1791 {
1792 
1793 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
1794 	COUNTER_INC(system_check_audit);
1795 
1796 	return (0);
1797 }
1798 
1799 COUNTER_DECL(system_check_auditctl);
1800 static int
1801 test_system_check_auditctl(struct ucred *cred, struct vnode *vp,
1802     struct label *vplabel)
1803 {
1804 
1805 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
1806 	LABEL_CHECK(vplabel, MAGIC_VNODE);
1807 	COUNTER_INC(system_check_auditctl);
1808 
1809 	return (0);
1810 }
1811 
1812 COUNTER_DECL(system_check_auditon);
1813 static int
1814 test_system_check_auditon(struct ucred *cred, int cmd)
1815 {
1816 
1817 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
1818 	COUNTER_INC(system_check_auditon);
1819 
1820 	return (0);
1821 }
1822 
1823 COUNTER_DECL(system_check_reboot);
1824 static int
1825 test_system_check_reboot(struct ucred *cred, int how)
1826 {
1827 
1828 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
1829 	COUNTER_INC(system_check_reboot);
1830 
1831 	return (0);
1832 }
1833 
1834 COUNTER_DECL(system_check_swapoff);
1835 static int
1836 test_system_check_swapoff(struct ucred *cred, struct vnode *vp,
1837     struct label *vplabel)
1838 {
1839 
1840 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
1841 	LABEL_CHECK(vplabel, MAGIC_VNODE);
1842 	COUNTER_INC(system_check_swapoff);
1843 
1844 	return (0);
1845 }
1846 
1847 COUNTER_DECL(system_check_swapon);
1848 static int
1849 test_system_check_swapon(struct ucred *cred, struct vnode *vp,
1850     struct label *vplabel)
1851 {
1852 
1853 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
1854 	LABEL_CHECK(vplabel, MAGIC_VNODE);
1855 	COUNTER_INC(system_check_swapon);
1856 
1857 	return (0);
1858 }
1859 
1860 COUNTER_DECL(system_check_sysctl);
1861 static int
1862 test_system_check_sysctl(struct ucred *cred, struct sysctl_oid *oidp,
1863     void *arg1, int arg2, struct sysctl_req *req)
1864 {
1865 
1866 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
1867 	COUNTER_INC(system_check_sysctl);
1868 
1869 	return (0);
1870 }
1871 
1872 COUNTER_DECL(sysvmsg_cleanup);
1873 static void
1874 test_sysvmsg_cleanup(struct label *msglabel)
1875 {
1876 
1877 	LABEL_CHECK(msglabel, MAGIC_SYSV_MSG);
1878 	COUNTER_INC(sysvmsg_cleanup);
1879 }
1880 
1881 COUNTER_DECL(sysvmsg_create);
1882 static void
1883 test_sysvmsg_create(struct ucred *cred, struct msqid_kernel *msqkptr,
1884     struct label *msqlabel, struct msg *msgptr, struct label *msglabel)
1885 {
1886 
1887 	LABEL_CHECK(msglabel, MAGIC_SYSV_MSG);
1888 	LABEL_CHECK(msqlabel, MAGIC_SYSV_MSQ);
1889 	COUNTER_INC(sysvmsg_create);
1890 }
1891 
1892 COUNTER_DECL(sysvmsg_destroy_label);
1893 static void
1894 test_sysvmsg_destroy_label(struct label *label)
1895 {
1896 
1897 	LABEL_DESTROY(label, MAGIC_SYSV_MSG);
1898 	COUNTER_INC(sysvmsg_destroy_label);
1899 }
1900 
1901 COUNTER_DECL(sysvmsg_init_label);
1902 static void
1903 test_sysvmsg_init_label(struct label *label)
1904 {
1905 	LABEL_INIT(label, MAGIC_SYSV_MSG);
1906 	COUNTER_INC(sysvmsg_init_label);
1907 }
1908 
1909 COUNTER_DECL(sysvmsq_check_msgmsq);
1910 static int
1911 test_sysvmsq_check_msgmsq(struct ucred *cred, struct msg *msgptr,
1912     struct label *msglabel, struct msqid_kernel *msqkptr,
1913     struct label *msqklabel)
1914 {
1915 
1916 	LABEL_CHECK(msqklabel, MAGIC_SYSV_MSQ);
1917 	LABEL_CHECK(msglabel, MAGIC_SYSV_MSG);
1918 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
1919 	COUNTER_INC(sysvmsq_check_msgmsq);
1920 
1921   	return (0);
1922 }
1923 
1924 COUNTER_DECL(sysvmsq_check_msgrcv);
1925 static int
1926 test_sysvmsq_check_msgrcv(struct ucred *cred, struct msg *msgptr,
1927     struct label *msglabel)
1928 {
1929 
1930 	LABEL_CHECK(msglabel, MAGIC_SYSV_MSG);
1931 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
1932 	COUNTER_INC(sysvmsq_check_msgrcv);
1933 
1934 	return (0);
1935 }
1936 
1937 COUNTER_DECL(sysvmsq_check_msgrmid);
1938 static int
1939 test_sysvmsq_check_msgrmid(struct ucred *cred, struct msg *msgptr,
1940     struct label *msglabel)
1941 {
1942 
1943 	LABEL_CHECK(msglabel, MAGIC_SYSV_MSG);
1944 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
1945 	COUNTER_INC(sysvmsq_check_msgrmid);
1946 
1947 	return (0);
1948 }
1949 
1950 COUNTER_DECL(sysvmsq_check_msqget);
1951 static int
1952 test_sysvmsq_check_msqget(struct ucred *cred,
1953     struct msqid_kernel *msqkptr, struct label *msqklabel)
1954 {
1955 
1956 	LABEL_CHECK(msqklabel, MAGIC_SYSV_MSQ);
1957 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
1958 	COUNTER_INC(sysvmsq_check_msqget);
1959 
1960 	return (0);
1961 }
1962 
1963 COUNTER_DECL(sysvmsq_check_msqsnd);
1964 static int
1965 test_sysvmsq_check_msqsnd(struct ucred *cred,
1966     struct msqid_kernel *msqkptr, struct label *msqklabel)
1967 {
1968 
1969 	LABEL_CHECK(msqklabel, MAGIC_SYSV_MSQ);
1970 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
1971 	COUNTER_INC(sysvmsq_check_msqsnd);
1972 
1973 	return (0);
1974 }
1975 
1976 COUNTER_DECL(sysvmsq_check_msqrcv);
1977 static int
1978 test_sysvmsq_check_msqrcv(struct ucred *cred,
1979     struct msqid_kernel *msqkptr, struct label *msqklabel)
1980 {
1981 
1982 	LABEL_CHECK(msqklabel, MAGIC_SYSV_MSQ);
1983 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
1984 	COUNTER_INC(sysvmsq_check_msqrcv);
1985 
1986 	return (0);
1987 }
1988 
1989 COUNTER_DECL(sysvmsq_check_msqctl);
1990 static int
1991 test_sysvmsq_check_msqctl(struct ucred *cred,
1992     struct msqid_kernel *msqkptr, struct label *msqklabel, int cmd)
1993 {
1994 
1995 	LABEL_CHECK(msqklabel, MAGIC_SYSV_MSQ);
1996 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
1997 	COUNTER_INC(sysvmsq_check_msqctl);
1998 
1999 	return (0);
2000 }
2001 
2002 COUNTER_DECL(sysvmsq_cleanup);
2003 static void
2004 test_sysvmsq_cleanup(struct label *msqlabel)
2005 {
2006 
2007 	LABEL_CHECK(msqlabel, MAGIC_SYSV_MSQ);
2008 	COUNTER_INC(sysvmsq_cleanup);
2009 }
2010 
2011 COUNTER_DECL(sysvmsq_create);
2012 static void
2013 test_sysvmsq_create(struct ucred *cred,
2014     struct msqid_kernel *msqkptr, struct label *msqlabel)
2015 {
2016 
2017 	LABEL_CHECK(msqlabel, MAGIC_SYSV_MSQ);
2018 	COUNTER_INC(sysvmsq_create);
2019 }
2020 
2021 COUNTER_DECL(sysvmsq_destroy_label);
2022 static void
2023 test_sysvmsq_destroy_label(struct label *label)
2024 {
2025 
2026 	LABEL_DESTROY(label, MAGIC_SYSV_MSQ);
2027 	COUNTER_INC(sysvmsq_destroy_label);
2028 }
2029 
2030 COUNTER_DECL(sysvmsq_init_label);
2031 static void
2032 test_sysvmsq_init_label(struct label *label)
2033 {
2034 	LABEL_INIT(label, MAGIC_SYSV_MSQ);
2035 	COUNTER_INC(sysvmsq_init_label);
2036 }
2037 
2038 COUNTER_DECL(sysvsem_check_semctl);
2039 static int
2040 test_sysvsem_check_semctl(struct ucred *cred,
2041     struct semid_kernel *semakptr, struct label *semaklabel, int cmd)
2042 {
2043 
2044 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
2045 	LABEL_CHECK(semaklabel, MAGIC_SYSV_SEM);
2046 	COUNTER_INC(sysvsem_check_semctl);
2047 
2048   	return (0);
2049 }
2050 
2051 COUNTER_DECL(sysvsem_check_semget);
2052 static int
2053 test_sysvsem_check_semget(struct ucred *cred,
2054     struct semid_kernel *semakptr, struct label *semaklabel)
2055 {
2056 
2057 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
2058 	LABEL_CHECK(semaklabel, MAGIC_SYSV_SEM);
2059 	COUNTER_INC(sysvsem_check_semget);
2060 
2061 	return (0);
2062 }
2063 
2064 COUNTER_DECL(sysvsem_check_semop);
2065 static int
2066 test_sysvsem_check_semop(struct ucred *cred,
2067     struct semid_kernel *semakptr, struct label *semaklabel, size_t accesstype)
2068 {
2069 
2070 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
2071 	LABEL_CHECK(semaklabel, MAGIC_SYSV_SEM);
2072 	COUNTER_INC(sysvsem_check_semop);
2073 
2074 	return (0);
2075 }
2076 
2077 COUNTER_DECL(sysvsem_cleanup);
2078 static void
2079 test_sysvsem_cleanup(struct label *semalabel)
2080 {
2081 
2082 	LABEL_CHECK(semalabel, MAGIC_SYSV_SEM);
2083 	COUNTER_INC(sysvsem_cleanup);
2084 }
2085 
2086 COUNTER_DECL(sysvsem_create);
2087 static void
2088 test_sysvsem_create(struct ucred *cred, struct semid_kernel *semakptr,
2089     struct label *semalabel)
2090 {
2091 
2092 	LABEL_CHECK(semalabel, MAGIC_SYSV_SEM);
2093 	COUNTER_INC(sysvsem_create);
2094 }
2095 
2096 COUNTER_DECL(sysvsem_destroy_label);
2097 static void
2098 test_sysvsem_destroy_label(struct label *label)
2099 {
2100 
2101 	LABEL_DESTROY(label, MAGIC_SYSV_SEM);
2102 	COUNTER_INC(sysvsem_destroy_label);
2103 }
2104 
2105 COUNTER_DECL(sysvsem_init_label);
2106 static void
2107 test_sysvsem_init_label(struct label *label)
2108 {
2109 	LABEL_INIT(label, MAGIC_SYSV_SEM);
2110 	COUNTER_INC(sysvsem_init_label);
2111 }
2112 
2113 COUNTER_DECL(sysvshm_check_shmat);
2114 static int
2115 test_sysvshm_check_shmat(struct ucred *cred,
2116     struct shmid_kernel *shmsegptr, struct label *shmseglabel, int shmflg)
2117 {
2118 
2119 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
2120 	LABEL_CHECK(shmseglabel, MAGIC_SYSV_SHM);
2121 	COUNTER_INC(sysvshm_check_shmat);
2122 
2123   	return (0);
2124 }
2125 
2126 COUNTER_DECL(sysvshm_check_shmctl);
2127 static int
2128 test_sysvshm_check_shmctl(struct ucred *cred,
2129     struct shmid_kernel *shmsegptr, struct label *shmseglabel, int cmd)
2130 {
2131 
2132 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
2133 	LABEL_CHECK(shmseglabel, MAGIC_SYSV_SHM);
2134 	COUNTER_INC(sysvshm_check_shmctl);
2135 
2136   	return (0);
2137 }
2138 
2139 COUNTER_DECL(sysvshm_check_shmdt);
2140 static int
2141 test_sysvshm_check_shmdt(struct ucred *cred,
2142     struct shmid_kernel *shmsegptr, struct label *shmseglabel)
2143 {
2144 
2145 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
2146 	LABEL_CHECK(shmseglabel, MAGIC_SYSV_SHM);
2147 	COUNTER_INC(sysvshm_check_shmdt);
2148 
2149 	return (0);
2150 }
2151 
2152 COUNTER_DECL(sysvshm_check_shmget);
2153 static int
2154 test_sysvshm_check_shmget(struct ucred *cred,
2155     struct shmid_kernel *shmsegptr, struct label *shmseglabel, int shmflg)
2156 {
2157 
2158 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
2159 	LABEL_CHECK(shmseglabel, MAGIC_SYSV_SHM);
2160 	COUNTER_INC(sysvshm_check_shmget);
2161 
2162 	return (0);
2163 }
2164 
2165 COUNTER_DECL(sysvshm_cleanup);
2166 static void
2167 test_sysvshm_cleanup(struct label *shmlabel)
2168 {
2169 
2170 	LABEL_CHECK(shmlabel, MAGIC_SYSV_SHM);
2171 	COUNTER_INC(sysvshm_cleanup);
2172 }
2173 
2174 COUNTER_DECL(sysvshm_create);
2175 static void
2176 test_sysvshm_create(struct ucred *cred, struct shmid_kernel *shmsegptr,
2177     struct label *shmlabel)
2178 {
2179 
2180 	LABEL_CHECK(shmlabel, MAGIC_SYSV_SHM);
2181 	COUNTER_INC(sysvshm_create);
2182 }
2183 
2184 COUNTER_DECL(sysvshm_destroy_label);
2185 static void
2186 test_sysvshm_destroy_label(struct label *label)
2187 {
2188 
2189 	LABEL_DESTROY(label, MAGIC_SYSV_SHM);
2190 	COUNTER_INC(sysvshm_destroy_label);
2191 }
2192 
2193 COUNTER_DECL(sysvshm_init_label);
2194 static void
2195 test_sysvshm_init_label(struct label *label)
2196 {
2197 	LABEL_INIT(label, MAGIC_SYSV_SHM);
2198 	COUNTER_INC(sysvshm_init_label);
2199 }
2200 
2201 COUNTER_DECL(thread_userret);
2202 static void
2203 test_thread_userret(struct thread *td)
2204 {
2205 
2206 	COUNTER_INC(thread_userret);
2207 }
2208 
2209 COUNTER_DECL(vnode_associate_extattr);
2210 static int
2211 test_vnode_associate_extattr(struct mount *mp, struct label *mplabel,
2212     struct vnode *vp, struct label *vplabel)
2213 {
2214 
2215 	LABEL_CHECK(mplabel, MAGIC_MOUNT);
2216 	LABEL_CHECK(vplabel, MAGIC_VNODE);
2217 	COUNTER_INC(vnode_associate_extattr);
2218 
2219 	return (0);
2220 }
2221 
2222 COUNTER_DECL(vnode_associate_singlelabel);
2223 static void
2224 test_vnode_associate_singlelabel(struct mount *mp, struct label *mplabel,
2225     struct vnode *vp, struct label *vplabel)
2226 {
2227 
2228 	LABEL_CHECK(mplabel, MAGIC_MOUNT);
2229 	LABEL_CHECK(vplabel, MAGIC_VNODE);
2230 	COUNTER_INC(vnode_associate_singlelabel);
2231 }
2232 
2233 COUNTER_DECL(vnode_check_access);
2234 static int
2235 test_vnode_check_access(struct ucred *cred, struct vnode *vp,
2236     struct label *vplabel, int acc_mode)
2237 {
2238 
2239 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
2240 	LABEL_CHECK(vplabel, MAGIC_VNODE);
2241 	COUNTER_INC(vnode_check_access);
2242 
2243 	return (0);
2244 }
2245 
2246 COUNTER_DECL(vnode_check_chdir);
2247 static int
2248 test_vnode_check_chdir(struct ucred *cred, struct vnode *dvp,
2249     struct label *dvplabel)
2250 {
2251 
2252 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
2253 	LABEL_CHECK(dvplabel, MAGIC_VNODE);
2254 	COUNTER_INC(vnode_check_chdir);
2255 
2256 	return (0);
2257 }
2258 
2259 COUNTER_DECL(vnode_check_chroot);
2260 static int
2261 test_vnode_check_chroot(struct ucred *cred, struct vnode *dvp,
2262     struct label *dvplabel)
2263 {
2264 
2265 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
2266 	LABEL_CHECK(dvplabel, MAGIC_VNODE);
2267 	COUNTER_INC(vnode_check_chroot);
2268 
2269 	return (0);
2270 }
2271 
2272 COUNTER_DECL(vnode_check_create);
2273 static int
2274 test_vnode_check_create(struct ucred *cred, struct vnode *dvp,
2275     struct label *dvplabel, struct componentname *cnp, struct vattr *vap)
2276 {
2277 
2278 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
2279 	LABEL_CHECK(dvplabel, MAGIC_VNODE);
2280 	COUNTER_INC(vnode_check_create);
2281 
2282 	return (0);
2283 }
2284 
2285 COUNTER_DECL(vnode_check_deleteacl);
2286 static int
2287 test_vnode_check_deleteacl(struct ucred *cred, struct vnode *vp,
2288     struct label *vplabel, acl_type_t type)
2289 {
2290 
2291 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
2292 	LABEL_CHECK(vplabel, MAGIC_VNODE);
2293 	COUNTER_INC(vnode_check_deleteacl);
2294 
2295 	return (0);
2296 }
2297 
2298 COUNTER_DECL(vnode_check_deleteextattr);
2299 static int
2300 test_vnode_check_deleteextattr(struct ucred *cred, struct vnode *vp,
2301     struct label *vplabel, int attrnamespace, const char *name)
2302 {
2303 
2304 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
2305 	LABEL_CHECK(vplabel, MAGIC_VNODE);
2306 	COUNTER_INC(vnode_check_deleteextattr);
2307 
2308 	return (0);
2309 }
2310 
2311 COUNTER_DECL(vnode_check_exec);
2312 static int
2313 test_vnode_check_exec(struct ucred *cred, struct vnode *vp,
2314     struct label *vplabel, struct image_params *imgp,
2315     struct label *execlabel)
2316 {
2317 
2318 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
2319 	LABEL_CHECK(vplabel, MAGIC_VNODE);
2320 	LABEL_CHECK(execlabel, MAGIC_CRED);
2321 	COUNTER_INC(vnode_check_exec);
2322 
2323 	return (0);
2324 }
2325 
2326 COUNTER_DECL(vnode_check_getacl);
2327 static int
2328 test_vnode_check_getacl(struct ucred *cred, struct vnode *vp,
2329     struct label *vplabel, acl_type_t type)
2330 {
2331 
2332 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
2333 	LABEL_CHECK(vplabel, MAGIC_VNODE);
2334 	COUNTER_INC(vnode_check_getacl);
2335 
2336 	return (0);
2337 }
2338 
2339 COUNTER_DECL(vnode_check_getextattr);
2340 static int
2341 test_vnode_check_getextattr(struct ucred *cred, struct vnode *vp,
2342     struct label *vplabel, int attrnamespace, const char *name,
2343     struct uio *uio)
2344 {
2345 
2346 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
2347 	LABEL_CHECK(vplabel, MAGIC_VNODE);
2348 	COUNTER_INC(vnode_check_getextattr);
2349 
2350 	return (0);
2351 }
2352 
2353 COUNTER_DECL(vnode_check_link);
2354 static int
2355 test_vnode_check_link(struct ucred *cred, struct vnode *dvp,
2356     struct label *dvplabel, struct vnode *vp, struct label *vplabel,
2357     struct componentname *cnp)
2358 {
2359 
2360 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
2361 	LABEL_CHECK(dvplabel, MAGIC_VNODE);
2362 	LABEL_CHECK(vplabel, MAGIC_VNODE);
2363 	COUNTER_INC(vnode_check_link);
2364 
2365 	return (0);
2366 }
2367 
2368 COUNTER_DECL(vnode_check_listextattr);
2369 static int
2370 test_vnode_check_listextattr(struct ucred *cred, struct vnode *vp,
2371     struct label *vplabel, int attrnamespace)
2372 {
2373 
2374 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
2375 	LABEL_CHECK(vplabel, MAGIC_VNODE);
2376 	COUNTER_INC(vnode_check_listextattr);
2377 
2378 	return (0);
2379 }
2380 
2381 COUNTER_DECL(vnode_check_lookup);
2382 static int
2383 test_vnode_check_lookup(struct ucred *cred, struct vnode *dvp,
2384     struct label *dvplabel, struct componentname *cnp)
2385 {
2386 
2387 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
2388 	LABEL_CHECK(dvplabel, MAGIC_VNODE);
2389 	COUNTER_INC(vnode_check_lookup);
2390 
2391 	return (0);
2392 }
2393 
2394 COUNTER_DECL(vnode_check_mmap);
2395 static int
2396 test_vnode_check_mmap(struct ucred *cred, struct vnode *vp,
2397     struct label *vplabel, int prot, int flags)
2398 {
2399 
2400 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
2401 	LABEL_CHECK(vplabel, MAGIC_VNODE);
2402 	COUNTER_INC(vnode_check_mmap);
2403 
2404 	return (0);
2405 }
2406 
2407 COUNTER_DECL(vnode_check_open);
2408 static int
2409 test_vnode_check_open(struct ucred *cred, struct vnode *vp,
2410     struct label *vplabel, int acc_mode)
2411 {
2412 
2413 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
2414 	LABEL_CHECK(vplabel, MAGIC_VNODE);
2415 	COUNTER_INC(vnode_check_open);
2416 
2417 	return (0);
2418 }
2419 
2420 COUNTER_DECL(vnode_check_poll);
2421 static int
2422 test_vnode_check_poll(struct ucred *active_cred, struct ucred *file_cred,
2423     struct vnode *vp, struct label *vplabel)
2424 {
2425 
2426 	LABEL_CHECK(active_cred->cr_label, MAGIC_CRED);
2427 	if (file_cred != NULL)
2428 		LABEL_CHECK(file_cred->cr_label, MAGIC_CRED);
2429 	LABEL_CHECK(vplabel, MAGIC_VNODE);
2430 	COUNTER_INC(vnode_check_poll);
2431 
2432 	return (0);
2433 }
2434 
2435 COUNTER_DECL(vnode_check_read);
2436 static int
2437 test_vnode_check_read(struct ucred *active_cred, struct ucred *file_cred,
2438     struct vnode *vp, struct label *vplabel)
2439 {
2440 
2441 	LABEL_CHECK(active_cred->cr_label, MAGIC_CRED);
2442 	if (file_cred != NULL)
2443 		LABEL_CHECK(file_cred->cr_label, MAGIC_CRED);
2444 	LABEL_CHECK(vplabel, MAGIC_VNODE);
2445 	COUNTER_INC(vnode_check_read);
2446 
2447 	return (0);
2448 }
2449 
2450 COUNTER_DECL(vnode_check_readdir);
2451 static int
2452 test_vnode_check_readdir(struct ucred *cred, struct vnode *dvp,
2453     struct label *dvplabel)
2454 {
2455 
2456 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
2457 	LABEL_CHECK(dvplabel, MAGIC_VNODE);
2458 	COUNTER_INC(vnode_check_readdir);
2459 
2460 	return (0);
2461 }
2462 
2463 COUNTER_DECL(vnode_check_readlink);
2464 static int
2465 test_vnode_check_readlink(struct ucred *cred, struct vnode *vp,
2466     struct label *vplabel)
2467 {
2468 
2469 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
2470 	LABEL_CHECK(vplabel, MAGIC_VNODE);
2471 	COUNTER_INC(vnode_check_readlink);
2472 
2473 	return (0);
2474 }
2475 
2476 COUNTER_DECL(vnode_check_relabel);
2477 static int
2478 test_vnode_check_relabel(struct ucred *cred, struct vnode *vp,
2479     struct label *vplabel, struct label *newlabel)
2480 {
2481 
2482 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
2483 	LABEL_CHECK(vplabel, MAGIC_VNODE);
2484 	LABEL_CHECK(newlabel, MAGIC_VNODE);
2485 	COUNTER_INC(vnode_check_relabel);
2486 
2487 	return (0);
2488 }
2489 
2490 COUNTER_DECL(vnode_check_rename_from);
2491 static int
2492 test_vnode_check_rename_from(struct ucred *cred, struct vnode *dvp,
2493     struct label *dvplabel, struct vnode *vp, struct label *vplabel,
2494     struct componentname *cnp)
2495 {
2496 
2497 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
2498 	LABEL_CHECK(dvplabel, MAGIC_VNODE);
2499 	LABEL_CHECK(vplabel, MAGIC_VNODE);
2500 	COUNTER_INC(vnode_check_rename_from);
2501 
2502 	return (0);
2503 }
2504 
2505 COUNTER_DECL(vnode_check_rename_to);
2506 static int
2507 test_vnode_check_rename_to(struct ucred *cred, struct vnode *dvp,
2508     struct label *dvplabel, struct vnode *vp, struct label *vplabel,
2509     int samedir, struct componentname *cnp)
2510 {
2511 
2512 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
2513 	LABEL_CHECK(dvplabel, MAGIC_VNODE);
2514 	LABEL_CHECK(vplabel, MAGIC_VNODE);
2515 	COUNTER_INC(vnode_check_rename_to);
2516 
2517 	return (0);
2518 }
2519 
2520 COUNTER_DECL(vnode_check_revoke);
2521 static int
2522 test_vnode_check_revoke(struct ucred *cred, struct vnode *vp,
2523     struct label *vplabel)
2524 {
2525 
2526 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
2527 	LABEL_CHECK(vplabel, MAGIC_VNODE);
2528 	COUNTER_INC(vnode_check_revoke);
2529 
2530 	return (0);
2531 }
2532 
2533 COUNTER_DECL(vnode_check_setacl);
2534 static int
2535 test_vnode_check_setacl(struct ucred *cred, struct vnode *vp,
2536     struct label *vplabel, acl_type_t type, struct acl *acl)
2537 {
2538 
2539 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
2540 	LABEL_CHECK(vplabel, MAGIC_VNODE);
2541 	COUNTER_INC(vnode_check_setacl);
2542 
2543 	return (0);
2544 }
2545 
2546 COUNTER_DECL(vnode_check_setextattr);
2547 static int
2548 test_vnode_check_setextattr(struct ucred *cred, struct vnode *vp,
2549     struct label *vplabel, int attrnamespace, const char *name,
2550     struct uio *uio)
2551 {
2552 
2553 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
2554 	LABEL_CHECK(vplabel, MAGIC_VNODE);
2555 	COUNTER_INC(vnode_check_setextattr);
2556 
2557 	return (0);
2558 }
2559 
2560 COUNTER_DECL(vnode_check_setflags);
2561 static int
2562 test_vnode_check_setflags(struct ucred *cred, struct vnode *vp,
2563     struct label *vplabel, u_long flags)
2564 {
2565 
2566 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
2567 	LABEL_CHECK(vplabel, MAGIC_VNODE);
2568 	COUNTER_INC(vnode_check_setflags);
2569 
2570 	return (0);
2571 }
2572 
2573 COUNTER_DECL(vnode_check_setmode);
2574 static int
2575 test_vnode_check_setmode(struct ucred *cred, struct vnode *vp,
2576     struct label *vplabel, mode_t mode)
2577 {
2578 
2579 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
2580 	LABEL_CHECK(vplabel, MAGIC_VNODE);
2581 	COUNTER_INC(vnode_check_setmode);
2582 
2583 	return (0);
2584 }
2585 
2586 COUNTER_DECL(vnode_check_setowner);
2587 static int
2588 test_vnode_check_setowner(struct ucred *cred, struct vnode *vp,
2589     struct label *vplabel, uid_t uid, gid_t gid)
2590 {
2591 
2592 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
2593 	LABEL_CHECK(vplabel, MAGIC_VNODE);
2594 	COUNTER_INC(vnode_check_setowner);
2595 
2596 	return (0);
2597 }
2598 
2599 COUNTER_DECL(vnode_check_setutimes);
2600 static int
2601 test_vnode_check_setutimes(struct ucred *cred, struct vnode *vp,
2602     struct label *vplabel, struct timespec atime, struct timespec mtime)
2603 {
2604 
2605 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
2606 	LABEL_CHECK(vplabel, MAGIC_VNODE);
2607 	COUNTER_INC(vnode_check_setutimes);
2608 
2609 	return (0);
2610 }
2611 
2612 COUNTER_DECL(vnode_check_stat);
2613 static int
2614 test_vnode_check_stat(struct ucred *active_cred, struct ucred *file_cred,
2615     struct vnode *vp, struct label *vplabel)
2616 {
2617 
2618 	LABEL_CHECK(active_cred->cr_label, MAGIC_CRED);
2619 	if (file_cred != NULL)
2620 		LABEL_CHECK(file_cred->cr_label, MAGIC_CRED);
2621 	LABEL_CHECK(vplabel, MAGIC_VNODE);
2622 	COUNTER_INC(vnode_check_stat);
2623 
2624 	return (0);
2625 }
2626 
2627 COUNTER_DECL(vnode_check_unlink);
2628 static int
2629 test_vnode_check_unlink(struct ucred *cred, struct vnode *dvp,
2630     struct label *dvplabel, struct vnode *vp, struct label *vplabel,
2631     struct componentname *cnp)
2632 {
2633 
2634 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
2635 	LABEL_CHECK(dvplabel, MAGIC_VNODE);
2636 	LABEL_CHECK(vplabel, MAGIC_VNODE);
2637 	COUNTER_INC(vnode_check_unlink);
2638 
2639 	return (0);
2640 }
2641 
2642 COUNTER_DECL(vnode_check_write);
2643 static int
2644 test_vnode_check_write(struct ucred *active_cred,
2645     struct ucred *file_cred, struct vnode *vp, struct label *vplabel)
2646 {
2647 
2648 	LABEL_CHECK(active_cred->cr_label, MAGIC_CRED);
2649 	if (file_cred != NULL)
2650 		LABEL_CHECK(file_cred->cr_label, MAGIC_CRED);
2651 	LABEL_CHECK(vplabel, MAGIC_VNODE);
2652 	COUNTER_INC(vnode_check_write);
2653 
2654 	return (0);
2655 }
2656 
2657 COUNTER_DECL(vnode_copy_label);
2658 static void
2659 test_vnode_copy_label(struct label *src, struct label *dest)
2660 {
2661 
2662 	LABEL_CHECK(src, MAGIC_VNODE);
2663 	LABEL_CHECK(dest, MAGIC_VNODE);
2664 	COUNTER_INC(vnode_copy_label);
2665 }
2666 
2667 COUNTER_DECL(vnode_create_extattr);
2668 static int
2669 test_vnode_create_extattr(struct ucred *cred, struct mount *mp,
2670     struct label *mplabel, struct vnode *dvp, struct label *dvplabel,
2671     struct vnode *vp, struct label *vplabel, struct componentname *cnp)
2672 {
2673 
2674 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
2675 	LABEL_CHECK(mplabel, MAGIC_MOUNT);
2676 	LABEL_CHECK(dvplabel, MAGIC_VNODE);
2677 	COUNTER_INC(vnode_create_extattr);
2678 
2679 	return (0);
2680 }
2681 
2682 COUNTER_DECL(vnode_destroy_label);
2683 static void
2684 test_vnode_destroy_label(struct label *label)
2685 {
2686 
2687 	LABEL_DESTROY(label, MAGIC_VNODE);
2688 	COUNTER_INC(vnode_destroy_label);
2689 }
2690 
2691 COUNTER_DECL(vnode_execve_transition);
2692 static void
2693 test_vnode_execve_transition(struct ucred *old, struct ucred *new,
2694     struct vnode *vp, struct label *filelabel,
2695     struct label *interpvplabel, struct image_params *imgp,
2696     struct label *execlabel)
2697 {
2698 
2699 	LABEL_CHECK(old->cr_label, MAGIC_CRED);
2700 	LABEL_CHECK(new->cr_label, MAGIC_CRED);
2701 	LABEL_CHECK(filelabel, MAGIC_VNODE);
2702 	LABEL_CHECK(interpvplabel, MAGIC_VNODE);
2703 	LABEL_CHECK(execlabel, MAGIC_CRED);
2704 	COUNTER_INC(vnode_execve_transition);
2705 }
2706 
2707 COUNTER_DECL(vnode_execve_will_transition);
2708 static int
2709 test_vnode_execve_will_transition(struct ucred *old, struct vnode *vp,
2710     struct label *filelabel, struct label *interpvplabel,
2711     struct image_params *imgp, struct label *execlabel)
2712 {
2713 
2714 	LABEL_CHECK(old->cr_label, MAGIC_CRED);
2715 	LABEL_CHECK(filelabel, MAGIC_VNODE);
2716 	LABEL_CHECK(interpvplabel, MAGIC_VNODE);
2717 	LABEL_CHECK(execlabel, MAGIC_CRED);
2718 	COUNTER_INC(vnode_execve_will_transition);
2719 
2720 	return (0);
2721 }
2722 
2723 COUNTER_DECL(vnode_externalize_label);
2724 static int
2725 test_vnode_externalize_label(struct label *label, char *element_name,
2726     struct sbuf *sb, int *claimed)
2727 {
2728 
2729 	LABEL_CHECK(label, MAGIC_VNODE);
2730 	COUNTER_INC(vnode_externalize_label);
2731 
2732 	return (0);
2733 }
2734 
2735 COUNTER_DECL(vnode_init_label);
2736 static void
2737 test_vnode_init_label(struct label *label)
2738 {
2739 
2740 	LABEL_INIT(label, MAGIC_VNODE);
2741 	COUNTER_INC(vnode_init_label);
2742 }
2743 
2744 COUNTER_DECL(vnode_internalize_label);
2745 static int
2746 test_vnode_internalize_label(struct label *label, char *element_name,
2747     char *element_data, int *claimed)
2748 {
2749 
2750 	LABEL_CHECK(label, MAGIC_VNODE);
2751 	COUNTER_INC(vnode_internalize_label);
2752 
2753 	return (0);
2754 }
2755 
2756 COUNTER_DECL(vnode_relabel);
2757 static void
2758 test_vnode_relabel(struct ucred *cred, struct vnode *vp,
2759     struct label *vplabel, struct label *label)
2760 {
2761 
2762 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
2763 	LABEL_CHECK(vplabel, MAGIC_VNODE);
2764 	LABEL_CHECK(label, MAGIC_VNODE);
2765 	COUNTER_INC(vnode_relabel);
2766 }
2767 
2768 COUNTER_DECL(vnode_setlabel_extattr);
2769 static int
2770 test_vnode_setlabel_extattr(struct ucred *cred, struct vnode *vp,
2771     struct label *vplabel, struct label *intlabel)
2772 {
2773 
2774 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
2775 	LABEL_CHECK(vplabel, MAGIC_VNODE);
2776 	LABEL_CHECK(intlabel, MAGIC_VNODE);
2777 	COUNTER_INC(vnode_setlabel_extattr);
2778 
2779 	return (0);
2780 }
2781 
2782 static struct mac_policy_ops test_ops =
2783 {
2784 	.mpo_bpfdesc_check_receive = test_bpfdesc_check_receive,
2785 	.mpo_bpfdesc_create = test_bpfdesc_create,
2786 	.mpo_bpfdesc_create_mbuf = test_bpfdesc_create_mbuf,
2787 	.mpo_bpfdesc_destroy_label = test_bpfdesc_destroy_label,
2788 	.mpo_bpfdesc_init_label = test_bpfdesc_init_label,
2789 
2790 	.mpo_cred_check_relabel = test_cred_check_relabel,
2791 	.mpo_cred_check_visible = test_cred_check_visible,
2792 	.mpo_cred_copy_label = test_cred_copy_label,
2793 	.mpo_cred_destroy_label = test_cred_destroy_label,
2794 	.mpo_cred_externalize_label = test_cred_externalize_label,
2795 	.mpo_cred_init_label = test_cred_init_label,
2796 	.mpo_cred_internalize_label = test_cred_internalize_label,
2797 	.mpo_cred_relabel = test_cred_relabel,
2798 
2799 	.mpo_devfs_create_device = test_devfs_create_device,
2800 	.mpo_devfs_create_directory = test_devfs_create_directory,
2801 	.mpo_devfs_create_symlink = test_devfs_create_symlink,
2802 	.mpo_devfs_destroy_label = test_devfs_destroy_label,
2803 	.mpo_devfs_init_label = test_devfs_init_label,
2804 	.mpo_devfs_update = test_devfs_update,
2805 	.mpo_devfs_vnode_associate = test_devfs_vnode_associate,
2806 
2807 	.mpo_ifnet_check_relabel = test_ifnet_check_relabel,
2808 	.mpo_ifnet_check_transmit = test_ifnet_check_transmit,
2809 	.mpo_ifnet_copy_label = test_ifnet_copy_label,
2810 	.mpo_ifnet_create = test_ifnet_create,
2811 	.mpo_ifnet_create_mbuf = test_ifnet_create_mbuf,
2812 	.mpo_ifnet_destroy_label = test_ifnet_destroy_label,
2813 	.mpo_ifnet_externalize_label = test_ifnet_externalize_label,
2814 	.mpo_ifnet_init_label = test_ifnet_init_label,
2815 	.mpo_ifnet_internalize_label = test_ifnet_internalize_label,
2816 	.mpo_ifnet_relabel = test_ifnet_relabel,
2817 
2818 	.mpo_syncache_destroy_label = test_syncache_destroy_label,
2819 	.mpo_syncache_init_label = test_syncache_init_label,
2820 
2821 	.mpo_sysvmsg_destroy_label = test_sysvmsg_destroy_label,
2822 	.mpo_sysvmsg_init_label = test_sysvmsg_init_label,
2823 
2824 	.mpo_sysvmsq_destroy_label = test_sysvmsq_destroy_label,
2825 	.mpo_sysvmsq_init_label = test_sysvmsq_init_label,
2826 
2827 	.mpo_sysvsem_destroy_label = test_sysvsem_destroy_label,
2828 	.mpo_sysvsem_init_label = test_sysvsem_init_label,
2829 
2830 	.mpo_sysvshm_destroy_label = test_sysvshm_destroy_label,
2831 	.mpo_sysvshm_init_label = test_sysvshm_init_label,
2832 
2833 	.mpo_inpcb_check_deliver = test_inpcb_check_deliver,
2834 	.mpo_inpcb_create = test_inpcb_create,
2835 	.mpo_inpcb_create_mbuf = test_inpcb_create_mbuf,
2836 	.mpo_inpcb_destroy_label = test_inpcb_destroy_label,
2837 	.mpo_inpcb_init_label = test_inpcb_init_label,
2838 	.mpo_inpcb_sosetlabel = test_inpcb_sosetlabel,
2839 
2840 	.mpo_ipq_create = test_ipq_create,
2841 	.mpo_ipq_destroy_label = test_ipq_destroy_label,
2842 	.mpo_ipq_init_label = test_ipq_init_label,
2843 	.mpo_ipq_match = test_ipq_match,
2844 	.mpo_ipq_reassemble = test_ipq_reassemble,
2845 	.mpo_ipq_update = test_ipq_update,
2846 
2847 	.mpo_kenv_check_dump = test_kenv_check_dump,
2848 	.mpo_kenv_check_get = test_kenv_check_get,
2849 	.mpo_kenv_check_set = test_kenv_check_set,
2850 	.mpo_kenv_check_unset = test_kenv_check_unset,
2851 
2852 	.mpo_kld_check_load = test_kld_check_load,
2853 	.mpo_kld_check_stat = test_kld_check_stat,
2854 
2855 	.mpo_mbuf_copy_label = test_mbuf_copy_label,
2856 	.mpo_mbuf_destroy_label = test_mbuf_destroy_label,
2857 	.mpo_mbuf_init_label = test_mbuf_init_label,
2858 
2859 	.mpo_mount_check_stat = test_mount_check_stat,
2860 	.mpo_mount_create = test_mount_create,
2861 	.mpo_mount_destroy_label = test_mount_destroy_label,
2862 	.mpo_mount_init_label = test_mount_init_label,
2863 
2864 	.mpo_netatalk_aarp_send = test_netatalk_aarp_send,
2865 
2866 	.mpo_netinet_arp_send = test_netinet_arp_send,
2867 	.mpo_netinet_fragment = test_netinet_fragment,
2868 	.mpo_netinet_icmp_reply = test_netinet_icmp_reply,
2869 	.mpo_netinet_icmp_replyinplace = test_netinet_icmp_replyinplace,
2870 	.mpo_netinet_igmp_send = test_netinet_igmp_send,
2871 	.mpo_netinet_tcp_reply = test_netinet_tcp_reply,
2872 
2873 	.mpo_netinet6_nd6_send = test_netinet6_nd6_send,
2874 
2875 	.mpo_pipe_check_ioctl = test_pipe_check_ioctl,
2876 	.mpo_pipe_check_poll = test_pipe_check_poll,
2877 	.mpo_pipe_check_read = test_pipe_check_read,
2878 	.mpo_pipe_check_relabel = test_pipe_check_relabel,
2879 	.mpo_pipe_check_stat = test_pipe_check_stat,
2880 	.mpo_pipe_check_write = test_pipe_check_write,
2881 	.mpo_pipe_copy_label = test_pipe_copy_label,
2882 	.mpo_pipe_create = test_pipe_create,
2883 	.mpo_pipe_destroy_label = test_pipe_destroy_label,
2884 	.mpo_pipe_externalize_label = test_pipe_externalize_label,
2885 	.mpo_pipe_init_label = test_pipe_init_label,
2886 	.mpo_pipe_internalize_label = test_pipe_internalize_label,
2887 	.mpo_pipe_relabel = test_pipe_relabel,
2888 
2889 	.mpo_posixsem_check_destroy = test_posixsem_check_destroy,
2890 	.mpo_posixsem_check_getvalue = test_posixsem_check_getvalue,
2891 	.mpo_posixsem_check_open = test_posixsem_check_open,
2892 	.mpo_posixsem_check_post = test_posixsem_check_post,
2893 	.mpo_posixsem_check_unlink = test_posixsem_check_unlink,
2894 	.mpo_posixsem_check_wait = test_posixsem_check_wait,
2895 	.mpo_posixsem_create = test_posixsem_create,
2896 	.mpo_posixsem_destroy_label = test_posixsem_destroy_label,
2897 	.mpo_posixsem_init_label = test_posixsem_init_label,
2898 
2899 	.mpo_posixshm_check_mmap = test_posixshm_check_mmap,
2900 	.mpo_posixshm_check_open = test_posixshm_check_open,
2901 	.mpo_posixshm_check_stat = test_posixshm_check_stat,
2902 	.mpo_posixshm_check_truncate = test_posixshm_check_truncate,
2903 	.mpo_posixshm_check_unlink = test_posixshm_check_unlink,
2904 	.mpo_posixshm_create = test_posixshm_create,
2905 	.mpo_posixshm_destroy_label = test_posixshm_destroy_label,
2906 	.mpo_posixshm_init_label = test_posixshm_init_label,
2907 
2908 	.mpo_proc_check_debug = test_proc_check_debug,
2909 	.mpo_proc_check_sched = test_proc_check_sched,
2910 	.mpo_proc_check_setaudit = test_proc_check_setaudit,
2911 	.mpo_proc_check_setaudit_addr = test_proc_check_setaudit_addr,
2912 	.mpo_proc_check_setauid = test_proc_check_setauid,
2913 	.mpo_proc_check_seteuid = test_proc_check_seteuid,
2914 	.mpo_proc_check_setegid = test_proc_check_setegid,
2915 	.mpo_proc_check_setgid = test_proc_check_setgid,
2916 	.mpo_proc_check_setgroups = test_proc_check_setgroups,
2917 	.mpo_proc_check_setregid = test_proc_check_setregid,
2918 	.mpo_proc_check_setresgid = test_proc_check_setresgid,
2919 	.mpo_proc_check_setresuid = test_proc_check_setresuid,
2920 	.mpo_proc_check_setreuid = test_proc_check_setreuid,
2921 	.mpo_proc_check_setuid = test_proc_check_setuid,
2922 	.mpo_proc_check_signal = test_proc_check_signal,
2923 	.mpo_proc_check_wait = test_proc_check_wait,
2924 	.mpo_proc_create_init = test_proc_create_init,
2925 	.mpo_proc_create_swapper = test_proc_create_swapper,
2926 	.mpo_proc_destroy_label = test_proc_destroy_label,
2927 	.mpo_proc_init_label = test_proc_init_label,
2928 
2929 	.mpo_socket_check_accept = test_socket_check_accept,
2930 	.mpo_socket_check_bind = test_socket_check_bind,
2931 	.mpo_socket_check_connect = test_socket_check_connect,
2932 	.mpo_socket_check_deliver = test_socket_check_deliver,
2933 	.mpo_socket_check_listen = test_socket_check_listen,
2934 	.mpo_socket_check_poll = test_socket_check_poll,
2935 	.mpo_socket_check_receive = test_socket_check_receive,
2936 	.mpo_socket_check_relabel = test_socket_check_relabel,
2937 	.mpo_socket_check_send = test_socket_check_send,
2938 	.mpo_socket_check_stat = test_socket_check_stat,
2939 	.mpo_socket_check_visible = test_socket_check_visible,
2940 	.mpo_socket_copy_label = test_socket_copy_label,
2941 	.mpo_socket_create = test_socket_create,
2942 	.mpo_socket_create_mbuf = test_socket_create_mbuf,
2943 	.mpo_socket_destroy_label = test_socket_destroy_label,
2944 	.mpo_socket_externalize_label = test_socket_externalize_label,
2945 	.mpo_socket_init_label = test_socket_init_label,
2946 	.mpo_socket_internalize_label = test_socket_internalize_label,
2947 	.mpo_socket_newconn = test_socket_newconn,
2948 	.mpo_socket_relabel = test_socket_relabel,
2949 
2950 	.mpo_socketpeer_destroy_label = test_socketpeer_destroy_label,
2951 	.mpo_socketpeer_externalize_label = test_socketpeer_externalize_label,
2952 	.mpo_socketpeer_init_label = test_socketpeer_init_label,
2953 	.mpo_socketpeer_set_from_mbuf = test_socketpeer_set_from_mbuf,
2954 	.mpo_socketpeer_set_from_socket = test_socketpeer_set_from_socket,
2955 
2956 	.mpo_syncache_create = test_syncache_create,
2957 	.mpo_syncache_create_mbuf = test_syncache_create_mbuf,
2958 
2959 	.mpo_system_check_acct = test_system_check_acct,
2960 	.mpo_system_check_audit = test_system_check_audit,
2961 	.mpo_system_check_auditctl = test_system_check_auditctl,
2962 	.mpo_system_check_auditon = test_system_check_auditon,
2963 	.mpo_system_check_reboot = test_system_check_reboot,
2964 	.mpo_system_check_swapoff = test_system_check_swapoff,
2965 	.mpo_system_check_swapon = test_system_check_swapon,
2966 	.mpo_system_check_sysctl = test_system_check_sysctl,
2967 
2968 	.mpo_vnode_check_access = test_vnode_check_access,
2969 	.mpo_sysvmsg_cleanup = test_sysvmsg_cleanup,
2970 	.mpo_sysvmsg_create = test_sysvmsg_create,
2971 
2972 	.mpo_sysvmsq_check_msgmsq = test_sysvmsq_check_msgmsq,
2973 	.mpo_sysvmsq_check_msgrcv = test_sysvmsq_check_msgrcv,
2974 	.mpo_sysvmsq_check_msgrmid = test_sysvmsq_check_msgrmid,
2975 	.mpo_sysvmsq_check_msqget = test_sysvmsq_check_msqget,
2976 	.mpo_sysvmsq_check_msqsnd = test_sysvmsq_check_msqsnd,
2977 	.mpo_sysvmsq_check_msqrcv = test_sysvmsq_check_msqrcv,
2978 	.mpo_sysvmsq_check_msqctl = test_sysvmsq_check_msqctl,
2979 	.mpo_sysvmsq_cleanup = test_sysvmsq_cleanup,
2980 	.mpo_sysvmsq_create = test_sysvmsq_create,
2981 
2982 	.mpo_sysvsem_check_semctl = test_sysvsem_check_semctl,
2983 	.mpo_sysvsem_check_semget = test_sysvsem_check_semget,
2984 	.mpo_sysvsem_check_semop = test_sysvsem_check_semop,
2985 	.mpo_sysvsem_cleanup = test_sysvsem_cleanup,
2986 	.mpo_sysvsem_create = test_sysvsem_create,
2987 
2988 	.mpo_sysvshm_check_shmat = test_sysvshm_check_shmat,
2989 	.mpo_sysvshm_check_shmctl = test_sysvshm_check_shmctl,
2990 	.mpo_sysvshm_check_shmdt = test_sysvshm_check_shmdt,
2991 	.mpo_sysvshm_check_shmget = test_sysvshm_check_shmget,
2992 	.mpo_sysvshm_cleanup = test_sysvshm_cleanup,
2993 	.mpo_sysvshm_create = test_sysvshm_create,
2994 
2995 	.mpo_thread_userret = test_thread_userret,
2996 
2997 	.mpo_vnode_associate_extattr = test_vnode_associate_extattr,
2998 	.mpo_vnode_associate_singlelabel = test_vnode_associate_singlelabel,
2999 	.mpo_vnode_check_chdir = test_vnode_check_chdir,
3000 	.mpo_vnode_check_chroot = test_vnode_check_chroot,
3001 	.mpo_vnode_check_create = test_vnode_check_create,
3002 	.mpo_vnode_check_deleteacl = test_vnode_check_deleteacl,
3003 	.mpo_vnode_check_deleteextattr = test_vnode_check_deleteextattr,
3004 	.mpo_vnode_check_exec = test_vnode_check_exec,
3005 	.mpo_vnode_check_getacl = test_vnode_check_getacl,
3006 	.mpo_vnode_check_getextattr = test_vnode_check_getextattr,
3007 	.mpo_vnode_check_link = test_vnode_check_link,
3008 	.mpo_vnode_check_listextattr = test_vnode_check_listextattr,
3009 	.mpo_vnode_check_lookup = test_vnode_check_lookup,
3010 	.mpo_vnode_check_mmap = test_vnode_check_mmap,
3011 	.mpo_vnode_check_open = test_vnode_check_open,
3012 	.mpo_vnode_check_poll = test_vnode_check_poll,
3013 	.mpo_vnode_check_read = test_vnode_check_read,
3014 	.mpo_vnode_check_readdir = test_vnode_check_readdir,
3015 	.mpo_vnode_check_readlink = test_vnode_check_readlink,
3016 	.mpo_vnode_check_relabel = test_vnode_check_relabel,
3017 	.mpo_vnode_check_rename_from = test_vnode_check_rename_from,
3018 	.mpo_vnode_check_rename_to = test_vnode_check_rename_to,
3019 	.mpo_vnode_check_revoke = test_vnode_check_revoke,
3020 	.mpo_vnode_check_setacl = test_vnode_check_setacl,
3021 	.mpo_vnode_check_setextattr = test_vnode_check_setextattr,
3022 	.mpo_vnode_check_setflags = test_vnode_check_setflags,
3023 	.mpo_vnode_check_setmode = test_vnode_check_setmode,
3024 	.mpo_vnode_check_setowner = test_vnode_check_setowner,
3025 	.mpo_vnode_check_setutimes = test_vnode_check_setutimes,
3026 	.mpo_vnode_check_stat = test_vnode_check_stat,
3027 	.mpo_vnode_check_unlink = test_vnode_check_unlink,
3028 	.mpo_vnode_check_write = test_vnode_check_write,
3029 	.mpo_vnode_copy_label = test_vnode_copy_label,
3030 	.mpo_vnode_create_extattr = test_vnode_create_extattr,
3031 	.mpo_vnode_destroy_label = test_vnode_destroy_label,
3032 	.mpo_vnode_execve_transition = test_vnode_execve_transition,
3033 	.mpo_vnode_execve_will_transition = test_vnode_execve_will_transition,
3034 	.mpo_vnode_externalize_label = test_vnode_externalize_label,
3035 	.mpo_vnode_init_label = test_vnode_init_label,
3036 	.mpo_vnode_internalize_label = test_vnode_internalize_label,
3037 	.mpo_vnode_relabel = test_vnode_relabel,
3038 	.mpo_vnode_setlabel_extattr = test_vnode_setlabel_extattr,
3039 };
3040 
3041 MAC_POLICY_SET(&test_ops, mac_test, "TrustedBSD MAC/Test",
3042     MPC_LOADTIME_FLAG_UNLOADOK | MPC_LOADTIME_FLAG_LABELMBUFS, &test_slot);
3043