1 /*- 2 * Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson 3 * Copyright (c) 2001, 2002 Networks Associates Technology, Inc. 4 * All rights reserved. 5 * 6 * This software was developed by Robert Watson for the TrustedBSD Project. 7 * 8 * This software was developed for the FreeBSD Project in part by Network 9 * Associates Laboratories, the Security Research Division of Network 10 * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), 11 * as part of the DARPA CHATS research program. 12 * 13 * Redistribution and use in source and binary forms, with or without 14 * modification, are permitted provided that the following conditions 15 * are met: 16 * 1. Redistributions of source code must retain the above copyright 17 * notice, this list of conditions and the following disclaimer. 18 * 2. Redistributions in binary form must reproduce the above copyright 19 * notice, this list of conditions and the following disclaimer in the 20 * documentation and/or other materials provided with the distribution. 21 * 22 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 23 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 24 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 25 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 26 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 27 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 28 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 29 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 30 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 31 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 32 * SUCH DAMAGE. 33 * 34 * $FreeBSD$ 35 */ 36 37 /* 38 * Developed by the TrustedBSD Project. 39 * Generic mandatory access module that does nothing. 40 */ 41 42 #include <sys/types.h> 43 #include <sys/param.h> 44 #include <sys/acl.h> 45 #include <sys/conf.h> 46 #include <sys/extattr.h> 47 #include <sys/kernel.h> 48 #include <sys/mac.h> 49 #include <sys/mount.h> 50 #include <sys/proc.h> 51 #include <sys/systm.h> 52 #include <sys/sysproto.h> 53 #include <sys/sysent.h> 54 #include <sys/vnode.h> 55 #include <sys/file.h> 56 #include <sys/socket.h> 57 #include <sys/socketvar.h> 58 #include <sys/sysctl.h> 59 60 #include <fs/devfs/devfs.h> 61 62 #include <net/bpfdesc.h> 63 #include <net/if.h> 64 #include <net/if_types.h> 65 #include <net/if_var.h> 66 67 #include <vm/vm.h> 68 69 #include <sys/mac_policy.h> 70 71 SYSCTL_DECL(_security_mac); 72 73 SYSCTL_NODE(_security_mac, OID_AUTO, test, CTLFLAG_RW, 0, 74 "TrustedBSD mac_test policy controls"); 75 76 static int mac_test_enabled = 1; 77 SYSCTL_INT(_security_mac_test, OID_AUTO, enabled, CTLFLAG_RW, 78 &mac_test_enabled, 0, "Enforce test policy"); 79 80 #define BPFMAGIC 0xfe1ad1b6 81 #define DEVFSMAGIC 0x9ee79c32 82 #define IFNETMAGIC 0xc218b120 83 #define IPQMAGIC 0x206188ef 84 #define MBUFMAGIC 0xbbefa5bb 85 #define MOUNTMAGIC 0xc7c46e47 86 #define SOCKETMAGIC 0x9199c6cd 87 #define PIPEMAGIC 0xdc6c9919 88 #define CREDMAGIC 0x9a5a4987 89 #define VNODEMAGIC 0x1a67a45c 90 #define EXMAGIC 0x849ba1fd 91 92 #define SLOT(x) LABEL_TO_SLOT((x), test_slot).l_long 93 static int test_slot; 94 SYSCTL_INT(_security_mac_test, OID_AUTO, slot, CTLFLAG_RD, 95 &test_slot, 0, "Slot allocated by framework"); 96 97 static int init_count_bpfdesc; 98 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_bpfdesc, CTLFLAG_RD, 99 &init_count_bpfdesc, 0, "bpfdesc init calls"); 100 static int init_count_cred; 101 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_cred, CTLFLAG_RD, 102 &init_count_cred, 0, "cred init calls"); 103 static int init_count_devfsdirent; 104 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_devfsdirent, CTLFLAG_RD, 105 &init_count_devfsdirent, 0, "devfsdirent init calls"); 106 static int init_count_ifnet; 107 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_ifnet, CTLFLAG_RD, 108 &init_count_ifnet, 0, "ifnet init calls"); 109 static int init_count_ipq; 110 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_ipq, CTLFLAG_RD, 111 &init_count_ipq, 0, "ipq init calls"); 112 static int init_count_mbuf; 113 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_mbuf, CTLFLAG_RD, 114 &init_count_mbuf, 0, "mbuf init calls"); 115 static int init_count_mount; 116 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_mount, CTLFLAG_RD, 117 &init_count_mount, 0, "mount init calls"); 118 static int init_count_mount_fslabel; 119 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_mount_fslabel, CTLFLAG_RD, 120 &init_count_mount_fslabel, 0, "mount_fslabel init calls"); 121 static int init_count_socket; 122 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_socket, CTLFLAG_RD, 123 &init_count_socket, 0, "socket init calls"); 124 static int init_count_socket_peerlabel; 125 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_socket_peerlabel, 126 CTLFLAG_RD, &init_count_socket_peerlabel, 0, 127 "socket_peerlabel init calls"); 128 static int init_count_pipe; 129 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_pipe, CTLFLAG_RD, 130 &init_count_pipe, 0, "pipe init calls"); 131 static int init_count_vnode; 132 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_vnode, CTLFLAG_RD, 133 &init_count_vnode, 0, "vnode init calls"); 134 135 static int destroy_count_bpfdesc; 136 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_bpfdesc, CTLFLAG_RD, 137 &destroy_count_bpfdesc, 0, "bpfdesc destroy calls"); 138 static int destroy_count_cred; 139 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_cred, CTLFLAG_RD, 140 &destroy_count_cred, 0, "cred destroy calls"); 141 static int destroy_count_devfsdirent; 142 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_devfsdirent, CTLFLAG_RD, 143 &destroy_count_devfsdirent, 0, "devfsdirent destroy calls"); 144 static int destroy_count_ifnet; 145 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_ifnet, CTLFLAG_RD, 146 &destroy_count_ifnet, 0, "ifnet destroy calls"); 147 static int destroy_count_ipq; 148 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_ipq, CTLFLAG_RD, 149 &destroy_count_ipq, 0, "ipq destroy calls"); 150 static int destroy_count_mbuf; 151 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_mbuf, CTLFLAG_RD, 152 &destroy_count_mbuf, 0, "mbuf destroy calls"); 153 static int destroy_count_mount; 154 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_mount, CTLFLAG_RD, 155 &destroy_count_mount, 0, "mount destroy calls"); 156 static int destroy_count_mount_fslabel; 157 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_mount_fslabel, 158 CTLFLAG_RD, &destroy_count_mount_fslabel, 0, 159 "mount_fslabel destroy calls"); 160 static int destroy_count_socket; 161 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_socket, CTLFLAG_RD, 162 &destroy_count_socket, 0, "socket destroy calls"); 163 static int destroy_count_socket_peerlabel; 164 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_socket_peerlabel, 165 CTLFLAG_RD, &destroy_count_socket_peerlabel, 0, 166 "socket_peerlabel destroy calls"); 167 static int destroy_count_pipe; 168 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_pipe, CTLFLAG_RD, 169 &destroy_count_pipe, 0, "pipe destroy calls"); 170 static int destroy_count_vnode; 171 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_vnode, CTLFLAG_RD, 172 &destroy_count_vnode, 0, "vnode destroy calls"); 173 174 static int externalize_count; 175 SYSCTL_INT(_security_mac_test, OID_AUTO, externalize_count, CTLFLAG_RD, 176 &externalize_count, 0, "Subject/object externalize calls"); 177 static int internalize_count; 178 SYSCTL_INT(_security_mac_test, OID_AUTO, internalize_count, CTLFLAG_RD, 179 &internalize_count, 0, "Subject/object internalize calls"); 180 181 /* 182 * Policy module operations. 183 */ 184 static void 185 mac_test_destroy(struct mac_policy_conf *conf) 186 { 187 188 } 189 190 static void 191 mac_test_init(struct mac_policy_conf *conf) 192 { 193 194 } 195 196 static int 197 mac_test_syscall(struct thread *td, int call, void *arg) 198 { 199 200 return (0); 201 } 202 203 /* 204 * Label operations. 205 */ 206 static void 207 mac_test_init_bpfdesc_label(struct label *label) 208 { 209 210 SLOT(label) = BPFMAGIC; 211 atomic_add_int(&init_count_bpfdesc, 1); 212 } 213 214 static void 215 mac_test_init_cred_label(struct label *label) 216 { 217 218 SLOT(label) = CREDMAGIC; 219 atomic_add_int(&init_count_cred, 1); 220 } 221 222 static void 223 mac_test_init_devfsdirent_label(struct label *label) 224 { 225 226 SLOT(label) = DEVFSMAGIC; 227 atomic_add_int(&init_count_devfsdirent, 1); 228 } 229 230 static void 231 mac_test_init_ifnet_label(struct label *label) 232 { 233 234 SLOT(label) = IFNETMAGIC; 235 atomic_add_int(&init_count_ifnet, 1); 236 } 237 238 static void 239 mac_test_init_ipq_label(struct label *label) 240 { 241 242 SLOT(label) = IPQMAGIC; 243 atomic_add_int(&init_count_ipq, 1); 244 } 245 246 static int 247 mac_test_init_mbuf_label(struct label *label, int flag) 248 { 249 250 SLOT(label) = MBUFMAGIC; 251 atomic_add_int(&init_count_mbuf, 1); 252 return (0); 253 } 254 255 static void 256 mac_test_init_mount_label(struct label *label) 257 { 258 259 SLOT(label) = MOUNTMAGIC; 260 atomic_add_int(&init_count_mount, 1); 261 } 262 263 static void 264 mac_test_init_mount_fs_label(struct label *label) 265 { 266 267 SLOT(label) = MOUNTMAGIC; 268 atomic_add_int(&init_count_mount_fslabel, 1); 269 } 270 271 static int 272 mac_test_init_socket_label(struct label *label, int flag) 273 { 274 275 SLOT(label) = SOCKETMAGIC; 276 atomic_add_int(&init_count_socket, 1); 277 return (0); 278 } 279 280 static int 281 mac_test_init_socket_peer_label(struct label *label, int flag) 282 { 283 284 SLOT(label) = SOCKETMAGIC; 285 atomic_add_int(&init_count_socket_peerlabel, 1); 286 return (0); 287 } 288 289 static void 290 mac_test_init_pipe_label(struct label *label) 291 { 292 293 SLOT(label) = PIPEMAGIC; 294 atomic_add_int(&init_count_pipe, 1); 295 } 296 297 static void 298 mac_test_init_vnode_label(struct label *label) 299 { 300 301 SLOT(label) = VNODEMAGIC; 302 atomic_add_int(&init_count_vnode, 1); 303 } 304 305 static void 306 mac_test_destroy_bpfdesc_label(struct label *label) 307 { 308 309 if (SLOT(label) == BPFMAGIC || SLOT(label) == 0) { 310 atomic_add_int(&destroy_count_bpfdesc, 1); 311 SLOT(label) = EXMAGIC; 312 } else if (SLOT(label) == EXMAGIC) { 313 Debugger("mac_test_destroy_bpfdesc: dup destroy"); 314 } else { 315 Debugger("mac_test_destroy_bpfdesc: corrupted label"); 316 } 317 } 318 319 static void 320 mac_test_destroy_cred_label(struct label *label) 321 { 322 323 if (SLOT(label) == CREDMAGIC || SLOT(label) == 0) { 324 atomic_add_int(&destroy_count_cred, 1); 325 SLOT(label) = EXMAGIC; 326 } else if (SLOT(label) == EXMAGIC) { 327 Debugger("mac_test_destroy_cred: dup destroy"); 328 } else { 329 Debugger("mac_test_destroy_cred: corrupted label"); 330 } 331 } 332 333 static void 334 mac_test_destroy_devfsdirent_label(struct label *label) 335 { 336 337 if (SLOT(label) == DEVFSMAGIC || SLOT(label) == 0) { 338 atomic_add_int(&destroy_count_devfsdirent, 1); 339 SLOT(label) = EXMAGIC; 340 } else if (SLOT(label) == EXMAGIC) { 341 Debugger("mac_test_destroy_devfsdirent: dup destroy"); 342 } else { 343 Debugger("mac_test_destroy_devfsdirent: corrupted label"); 344 } 345 } 346 347 static void 348 mac_test_destroy_ifnet_label(struct label *label) 349 { 350 351 if (SLOT(label) == IFNETMAGIC || SLOT(label) == 0) { 352 atomic_add_int(&destroy_count_ifnet, 1); 353 SLOT(label) = EXMAGIC; 354 } else if (SLOT(label) == EXMAGIC) { 355 Debugger("mac_test_destroy_ifnet: dup destroy"); 356 } else { 357 Debugger("mac_test_destroy_ifnet: corrupted label"); 358 } 359 } 360 361 static void 362 mac_test_destroy_ipq_label(struct label *label) 363 { 364 365 if (SLOT(label) == IPQMAGIC || SLOT(label) == 0) { 366 atomic_add_int(&destroy_count_ipq, 1); 367 SLOT(label) = EXMAGIC; 368 } else if (SLOT(label) == EXMAGIC) { 369 Debugger("mac_test_destroy_ipq: dup destroy"); 370 } else { 371 Debugger("mac_test_destroy_ipq: corrupted label"); 372 } 373 } 374 375 static void 376 mac_test_destroy_mbuf_label(struct label *label) 377 { 378 379 if (SLOT(label) == MBUFMAGIC || SLOT(label) == 0) { 380 atomic_add_int(&destroy_count_mbuf, 1); 381 SLOT(label) = EXMAGIC; 382 } else if (SLOT(label) == EXMAGIC) { 383 Debugger("mac_test_destroy_mbuf: dup destroy"); 384 } else { 385 Debugger("mac_test_destroy_mbuf: corrupted label"); 386 } 387 } 388 389 static void 390 mac_test_destroy_mount_label(struct label *label) 391 { 392 393 if ((SLOT(label) == MOUNTMAGIC || SLOT(label) == 0)) { 394 atomic_add_int(&destroy_count_mount, 1); 395 SLOT(label) = EXMAGIC; 396 } else if (SLOT(label) == EXMAGIC) { 397 Debugger("mac_test_destroy_mount: dup destroy"); 398 } else { 399 Debugger("mac_test_destroy_mount: corrupted label"); 400 } 401 } 402 403 static void 404 mac_test_destroy_mount_fs_label(struct label *label) 405 { 406 407 if ((SLOT(label) == MOUNTMAGIC || SLOT(label) == 0)) { 408 atomic_add_int(&destroy_count_mount_fslabel, 1); 409 SLOT(label) = EXMAGIC; 410 } else if (SLOT(label) == EXMAGIC) { 411 Debugger("mac_test_destroy_mount_fslabel: dup destroy"); 412 } else { 413 Debugger("mac_test_destroy_mount_fslabel: corrupted label"); 414 } 415 } 416 417 static void 418 mac_test_destroy_socket_label(struct label *label) 419 { 420 421 if ((SLOT(label) == SOCKETMAGIC || SLOT(label) == 0)) { 422 atomic_add_int(&destroy_count_socket, 1); 423 SLOT(label) = EXMAGIC; 424 } else if (SLOT(label) == EXMAGIC) { 425 Debugger("mac_test_destroy_socket: dup destroy"); 426 } else { 427 Debugger("mac_test_destroy_socket: corrupted label"); 428 } 429 } 430 431 static void 432 mac_test_destroy_socket_peer_label(struct label *label) 433 { 434 435 if ((SLOT(label) == SOCKETMAGIC || SLOT(label) == 0)) { 436 atomic_add_int(&destroy_count_socket_peerlabel, 1); 437 SLOT(label) = EXMAGIC; 438 } else if (SLOT(label) == EXMAGIC) { 439 Debugger("mac_test_destroy_socket_peerlabel: dup destroy"); 440 } else { 441 Debugger("mac_test_destroy_socket_peerlabel: corrupted label"); 442 } 443 } 444 445 static void 446 mac_test_destroy_pipe_label(struct label *label) 447 { 448 449 if ((SLOT(label) == PIPEMAGIC || SLOT(label) == 0)) { 450 atomic_add_int(&destroy_count_pipe, 1); 451 SLOT(label) = EXMAGIC; 452 } else if (SLOT(label) == EXMAGIC) { 453 Debugger("mac_test_destroy_pipe: dup destroy"); 454 } else { 455 Debugger("mac_test_destroy_pipe: corrupted label"); 456 } 457 } 458 459 static void 460 mac_test_destroy_vnode_label(struct label *label) 461 { 462 463 if (SLOT(label) == VNODEMAGIC || SLOT(label) == 0) { 464 atomic_add_int(&destroy_count_vnode, 1); 465 SLOT(label) = EXMAGIC; 466 } else if (SLOT(label) == EXMAGIC) { 467 Debugger("mac_test_destroy_vnode: dup destroy"); 468 } else { 469 Debugger("mac_test_destroy_vnode: corrupted label"); 470 } 471 } 472 473 static int 474 mac_test_externalize_label(struct label *label, char *element_name, 475 char *element_data, size_t size, size_t *len, int *claimed) 476 { 477 478 atomic_add_int(&externalize_count, 1); 479 480 return (0); 481 } 482 483 static int 484 mac_test_internalize_label(struct label *label, char *element_name, 485 char *element_data, int *claimed) 486 { 487 488 atomic_add_int(&internalize_count, 1); 489 490 return (0); 491 } 492 493 /* 494 * Labeling event operations: file system objects, and things that look 495 * a lot like file system objects. 496 */ 497 static void 498 mac_test_associate_vnode_devfs(struct mount *mp, struct label *fslabel, 499 struct devfs_dirent *de, struct label *delabel, struct vnode *vp, 500 struct label *vlabel) 501 { 502 503 } 504 505 static int 506 mac_test_associate_vnode_extattr(struct mount *mp, struct label *fslabel, 507 struct vnode *vp, struct label *vlabel) 508 { 509 510 return (0); 511 } 512 513 static void 514 mac_test_associate_vnode_singlelabel(struct mount *mp, 515 struct label *fslabel, struct vnode *vp, struct label *vlabel) 516 { 517 518 } 519 520 static void 521 mac_test_create_devfs_device(struct mount *mp, dev_t dev, 522 struct devfs_dirent *devfs_dirent, struct label *label) 523 { 524 525 } 526 527 static void 528 mac_test_create_devfs_directory(struct mount *mp, char *dirname, 529 int dirnamelen, struct devfs_dirent *devfs_dirent, struct label *label) 530 { 531 532 } 533 534 static void 535 mac_test_create_devfs_symlink(struct ucred *cred, struct mount *mp, 536 struct devfs_dirent *dd, struct label *ddlabel, struct devfs_dirent *de, 537 struct label *delabel) 538 { 539 540 } 541 542 static int 543 mac_test_create_vnode_extattr(struct ucred *cred, struct mount *mp, 544 struct label *fslabel, struct vnode *dvp, struct label *dlabel, 545 struct vnode *vp, struct label *vlabel, struct componentname *cnp) 546 { 547 548 return (0); 549 } 550 551 static void 552 mac_test_create_mount(struct ucred *cred, struct mount *mp, 553 struct label *mntlabel, struct label *fslabel) 554 { 555 556 } 557 558 static void 559 mac_test_create_root_mount(struct ucred *cred, struct mount *mp, 560 struct label *mntlabel, struct label *fslabel) 561 { 562 563 } 564 565 static void 566 mac_test_relabel_vnode(struct ucred *cred, struct vnode *vp, 567 struct label *vnodelabel, struct label *label) 568 { 569 570 } 571 572 static int 573 mac_test_setlabel_vnode_extattr(struct ucred *cred, struct vnode *vp, 574 struct label *vlabel, struct label *intlabel) 575 { 576 577 return (0); 578 } 579 580 static void 581 mac_test_update_devfsdirent(struct mount *mp, 582 struct devfs_dirent *devfs_dirent, struct label *direntlabel, 583 struct vnode *vp, struct label *vnodelabel) 584 { 585 586 } 587 588 /* 589 * Labeling event operations: IPC object. 590 */ 591 static void 592 mac_test_create_mbuf_from_socket(struct socket *so, struct label *socketlabel, 593 struct mbuf *m, struct label *mbuflabel) 594 { 595 596 } 597 598 static void 599 mac_test_create_socket(struct ucred *cred, struct socket *socket, 600 struct label *socketlabel) 601 { 602 603 } 604 605 static void 606 mac_test_create_pipe(struct ucred *cred, struct pipe *pipe, 607 struct label *pipelabel) 608 { 609 610 } 611 612 static void 613 mac_test_create_socket_from_socket(struct socket *oldsocket, 614 struct label *oldsocketlabel, struct socket *newsocket, 615 struct label *newsocketlabel) 616 { 617 618 } 619 620 static void 621 mac_test_relabel_socket(struct ucred *cred, struct socket *socket, 622 struct label *socketlabel, struct label *newlabel) 623 { 624 625 } 626 627 static void 628 mac_test_relabel_pipe(struct ucred *cred, struct pipe *pipe, 629 struct label *pipelabel, struct label *newlabel) 630 { 631 632 } 633 634 static void 635 mac_test_set_socket_peer_from_mbuf(struct mbuf *mbuf, struct label *mbuflabel, 636 struct socket *socket, struct label *socketpeerlabel) 637 { 638 639 } 640 641 /* 642 * Labeling event operations: network objects. 643 */ 644 static void 645 mac_test_set_socket_peer_from_socket(struct socket *oldsocket, 646 struct label *oldsocketlabel, struct socket *newsocket, 647 struct label *newsocketpeerlabel) 648 { 649 650 } 651 652 static void 653 mac_test_create_bpfdesc(struct ucred *cred, struct bpf_d *bpf_d, 654 struct label *bpflabel) 655 { 656 657 } 658 659 static void 660 mac_test_create_datagram_from_ipq(struct ipq *ipq, struct label *ipqlabel, 661 struct mbuf *datagram, struct label *datagramlabel) 662 { 663 664 } 665 666 static void 667 mac_test_create_fragment(struct mbuf *datagram, struct label *datagramlabel, 668 struct mbuf *fragment, struct label *fragmentlabel) 669 { 670 671 } 672 673 static void 674 mac_test_create_ifnet(struct ifnet *ifnet, struct label *ifnetlabel) 675 { 676 677 } 678 679 static void 680 mac_test_create_ipq(struct mbuf *fragment, struct label *fragmentlabel, 681 struct ipq *ipq, struct label *ipqlabel) 682 { 683 684 } 685 686 static void 687 mac_test_create_mbuf_from_mbuf(struct mbuf *oldmbuf, 688 struct label *oldmbuflabel, struct mbuf *newmbuf, 689 struct label *newmbuflabel) 690 { 691 692 } 693 694 static void 695 mac_test_create_mbuf_linklayer(struct ifnet *ifnet, struct label *ifnetlabel, 696 struct mbuf *mbuf, struct label *mbuflabel) 697 { 698 699 } 700 701 static void 702 mac_test_create_mbuf_from_bpfdesc(struct bpf_d *bpf_d, struct label *bpflabel, 703 struct mbuf *mbuf, struct label *mbuflabel) 704 { 705 706 } 707 708 static void 709 mac_test_create_mbuf_from_ifnet(struct ifnet *ifnet, struct label *ifnetlabel, 710 struct mbuf *m, struct label *mbuflabel) 711 { 712 713 } 714 715 static void 716 mac_test_create_mbuf_multicast_encap(struct mbuf *oldmbuf, 717 struct label *oldmbuflabel, struct ifnet *ifnet, struct label *ifnetlabel, 718 struct mbuf *newmbuf, struct label *newmbuflabel) 719 { 720 721 } 722 723 static void 724 mac_test_create_mbuf_netlayer(struct mbuf *oldmbuf, 725 struct label *oldmbuflabel, struct mbuf *newmbuf, 726 struct label *newmbuflabel) 727 { 728 729 } 730 731 static int 732 mac_test_fragment_match(struct mbuf *fragment, struct label *fragmentlabel, 733 struct ipq *ipq, struct label *ipqlabel) 734 { 735 736 return (1); 737 } 738 739 static void 740 mac_test_relabel_ifnet(struct ucred *cred, struct ifnet *ifnet, 741 struct label *ifnetlabel, struct label *newlabel) 742 { 743 744 } 745 746 static void 747 mac_test_update_ipq(struct mbuf *fragment, struct label *fragmentlabel, 748 struct ipq *ipq, struct label *ipqlabel) 749 { 750 751 } 752 753 /* 754 * Labeling event operations: processes. 755 */ 756 static void 757 mac_test_create_cred(struct ucred *cred_parent, struct ucred *cred_child) 758 { 759 760 } 761 762 static void 763 mac_test_execve_transition(struct ucred *old, struct ucred *new, 764 struct vnode *vp, struct label *filelabel, 765 struct label *interpvnodelabel, struct image_params *imgp, 766 struct label *execlabel) 767 { 768 769 } 770 771 static int 772 mac_test_execve_will_transition(struct ucred *old, struct vnode *vp, 773 struct label *filelabel, struct label *interpvnodelabel, 774 struct image_params *imgp, struct label *execlabel) 775 { 776 777 return (0); 778 } 779 780 static void 781 mac_test_create_proc0(struct ucred *cred) 782 { 783 784 } 785 786 static void 787 mac_test_create_proc1(struct ucred *cred) 788 { 789 790 } 791 792 static void 793 mac_test_relabel_cred(struct ucred *cred, struct label *newlabel) 794 { 795 796 } 797 798 /* 799 * Access control checks. 800 */ 801 static int 802 mac_test_check_bpfdesc_receive(struct bpf_d *bpf_d, struct label *bpflabel, 803 struct ifnet *ifnet, struct label *ifnetlabel) 804 { 805 806 return (0); 807 } 808 809 static int 810 mac_test_check_cred_relabel(struct ucred *cred, struct label *newlabel) 811 { 812 813 return (0); 814 } 815 816 static int 817 mac_test_check_cred_visible(struct ucred *u1, struct ucred *u2) 818 { 819 820 return (0); 821 } 822 823 static int 824 mac_test_check_ifnet_relabel(struct ucred *cred, struct ifnet *ifnet, 825 struct label *ifnetlabel, struct label *newlabel) 826 { 827 828 return (0); 829 } 830 831 static int 832 mac_test_check_ifnet_transmit(struct ifnet *ifnet, struct label *ifnetlabel, 833 struct mbuf *m, struct label *mbuflabel) 834 { 835 836 return (0); 837 } 838 839 static int 840 mac_test_check_mount_stat(struct ucred *cred, struct mount *mp, 841 struct label *mntlabel) 842 { 843 844 return (0); 845 } 846 847 static int 848 mac_test_check_pipe_ioctl(struct ucred *cred, struct pipe *pipe, 849 struct label *pipelabel, unsigned long cmd, void /* caddr_t */ *data) 850 { 851 852 return (0); 853 } 854 855 static int 856 mac_test_check_pipe_poll(struct ucred *cred, struct pipe *pipe, 857 struct label *pipelabel) 858 { 859 860 return (0); 861 } 862 863 static int 864 mac_test_check_pipe_read(struct ucred *cred, struct pipe *pipe, 865 struct label *pipelabel) 866 { 867 868 return (0); 869 } 870 871 static int 872 mac_test_check_pipe_relabel(struct ucred *cred, struct pipe *pipe, 873 struct label *pipelabel, struct label *newlabel) 874 { 875 876 return (0); 877 } 878 879 static int 880 mac_test_check_pipe_stat(struct ucred *cred, struct pipe *pipe, 881 struct label *pipelabel) 882 { 883 884 return (0); 885 } 886 887 static int 888 mac_test_check_pipe_write(struct ucred *cred, struct pipe *pipe, 889 struct label *pipelabel) 890 { 891 892 return (0); 893 } 894 895 static int 896 mac_test_check_proc_debug(struct ucred *cred, struct proc *proc) 897 { 898 899 return (0); 900 } 901 902 static int 903 mac_test_check_proc_sched(struct ucred *cred, struct proc *proc) 904 { 905 906 return (0); 907 } 908 909 static int 910 mac_test_check_proc_signal(struct ucred *cred, struct proc *proc, int signum) 911 { 912 913 return (0); 914 } 915 916 static int 917 mac_test_check_socket_bind(struct ucred *cred, struct socket *socket, 918 struct label *socketlabel, struct sockaddr *sockaddr) 919 { 920 921 return (0); 922 } 923 924 static int 925 mac_test_check_socket_connect(struct ucred *cred, struct socket *socket, 926 struct label *socketlabel, struct sockaddr *sockaddr) 927 { 928 929 return (0); 930 } 931 932 static int 933 mac_test_check_socket_deliver(struct socket *socket, struct label *socketlabel, 934 struct mbuf *m, struct label *mbuflabel) 935 { 936 937 return (0); 938 } 939 940 static int 941 mac_test_check_socket_listen(struct ucred *cred, struct socket *socket, 942 struct label *socketlabel) 943 { 944 945 return (0); 946 } 947 948 static int 949 mac_test_check_socket_visible(struct ucred *cred, struct socket *socket, 950 struct label *socketlabel) 951 { 952 953 return (0); 954 } 955 956 static int 957 mac_test_check_socket_relabel(struct ucred *cred, struct socket *socket, 958 struct label *socketlabel, struct label *newlabel) 959 { 960 961 return (0); 962 } 963 964 static int 965 mac_test_check_vnode_access(struct ucred *cred, struct vnode *vp, 966 struct label *label, int acc_mode) 967 { 968 969 return (0); 970 } 971 972 static int 973 mac_test_check_vnode_chdir(struct ucred *cred, struct vnode *dvp, 974 struct label *dlabel) 975 { 976 977 return (0); 978 } 979 980 static int 981 mac_test_check_vnode_chroot(struct ucred *cred, struct vnode *dvp, 982 struct label *dlabel) 983 { 984 985 return (0); 986 } 987 988 static int 989 mac_test_check_vnode_create(struct ucred *cred, struct vnode *dvp, 990 struct label *dlabel, struct componentname *cnp, struct vattr *vap) 991 { 992 993 return (0); 994 } 995 996 static int 997 mac_test_check_vnode_delete(struct ucred *cred, struct vnode *dvp, 998 struct label *dlabel, struct vnode *vp, struct label *label, 999 struct componentname *cnp) 1000 { 1001 1002 return (0); 1003 } 1004 1005 static int 1006 mac_test_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp, 1007 struct label *label, acl_type_t type) 1008 { 1009 1010 return (0); 1011 } 1012 1013 static int 1014 mac_test_check_vnode_exec(struct ucred *cred, struct vnode *vp, 1015 struct label *label, struct image_params *imgp, 1016 struct label *execlabel) 1017 { 1018 1019 return (0); 1020 } 1021 1022 static int 1023 mac_test_check_vnode_getacl(struct ucred *cred, struct vnode *vp, 1024 struct label *label, acl_type_t type) 1025 { 1026 1027 return (0); 1028 } 1029 1030 static int 1031 mac_test_check_vnode_getextattr(struct ucred *cred, struct vnode *vp, 1032 struct label *label, int attrnamespace, const char *name, struct uio *uio) 1033 { 1034 1035 return (0); 1036 } 1037 1038 static int 1039 mac_test_check_vnode_link(struct ucred *cred, struct vnode *dvp, 1040 struct label *dlabel, struct vnode *vp, struct label *label, 1041 struct componentname *cnp) 1042 { 1043 1044 return (0); 1045 } 1046 1047 static int 1048 mac_test_check_vnode_lookup(struct ucred *cred, struct vnode *dvp, 1049 struct label *dlabel, struct componentname *cnp) 1050 { 1051 1052 return (0); 1053 } 1054 1055 static int 1056 mac_test_check_vnode_mmap(struct ucred *cred, struct vnode *vp, 1057 struct label *label, int prot) 1058 { 1059 1060 return (0); 1061 } 1062 1063 static int 1064 mac_test_check_vnode_mprotect(struct ucred *cred, struct vnode *vp, 1065 struct label *label, int prot) 1066 { 1067 1068 return (0); 1069 } 1070 1071 static int 1072 mac_test_check_vnode_open(struct ucred *cred, struct vnode *vp, 1073 struct label *filelabel, int acc_mode) 1074 { 1075 1076 return (0); 1077 } 1078 1079 static int 1080 mac_test_check_vnode_poll(struct ucred *active_cred, struct ucred *file_cred, 1081 struct vnode *vp, struct label *label) 1082 { 1083 1084 return (0); 1085 } 1086 1087 static int 1088 mac_test_check_vnode_read(struct ucred *active_cred, struct ucred *file_cred, 1089 struct vnode *vp, struct label *label) 1090 { 1091 1092 return (0); 1093 } 1094 1095 static int 1096 mac_test_check_vnode_readdir(struct ucred *cred, struct vnode *dvp, 1097 struct label *dlabel) 1098 { 1099 1100 return (0); 1101 } 1102 1103 static int 1104 mac_test_check_vnode_readlink(struct ucred *cred, struct vnode *vp, 1105 struct label *vnodelabel) 1106 { 1107 1108 return (0); 1109 } 1110 1111 static int 1112 mac_test_check_vnode_relabel(struct ucred *cred, struct vnode *vp, 1113 struct label *vnodelabel, struct label *newlabel) 1114 { 1115 1116 return (0); 1117 } 1118 1119 static int 1120 mac_test_check_vnode_rename_from(struct ucred *cred, struct vnode *dvp, 1121 struct label *dlabel, struct vnode *vp, struct label *label, 1122 struct componentname *cnp) 1123 { 1124 1125 return (0); 1126 } 1127 1128 static int 1129 mac_test_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp, 1130 struct label *dlabel, struct vnode *vp, struct label *label, int samedir, 1131 struct componentname *cnp) 1132 { 1133 1134 return (0); 1135 } 1136 1137 static int 1138 mac_test_check_vnode_revoke(struct ucred *cred, struct vnode *vp, 1139 struct label *label) 1140 { 1141 1142 return (0); 1143 } 1144 1145 static int 1146 mac_test_check_vnode_setacl(struct ucred *cred, struct vnode *vp, 1147 struct label *label, acl_type_t type, struct acl *acl) 1148 { 1149 1150 return (0); 1151 } 1152 1153 static int 1154 mac_test_check_vnode_setextattr(struct ucred *cred, struct vnode *vp, 1155 struct label *label, int attrnamespace, const char *name, struct uio *uio) 1156 { 1157 1158 return (0); 1159 } 1160 1161 static int 1162 mac_test_check_vnode_setflags(struct ucred *cred, struct vnode *vp, 1163 struct label *label, u_long flags) 1164 { 1165 1166 return (0); 1167 } 1168 1169 static int 1170 mac_test_check_vnode_setmode(struct ucred *cred, struct vnode *vp, 1171 struct label *label, mode_t mode) 1172 { 1173 1174 return (0); 1175 } 1176 1177 static int 1178 mac_test_check_vnode_setowner(struct ucred *cred, struct vnode *vp, 1179 struct label *label, uid_t uid, gid_t gid) 1180 { 1181 1182 return (0); 1183 } 1184 1185 static int 1186 mac_test_check_vnode_setutimes(struct ucred *cred, struct vnode *vp, 1187 struct label *label, struct timespec atime, struct timespec mtime) 1188 { 1189 1190 return (0); 1191 } 1192 1193 static int 1194 mac_test_check_vnode_stat(struct ucred *active_cred, struct ucred *file_cred, 1195 struct vnode *vp, struct label *label) 1196 { 1197 1198 return (0); 1199 } 1200 1201 static int 1202 mac_test_check_vnode_write(struct ucred *active_cred, 1203 struct ucred *file_cred, struct vnode *vp, struct label *label) 1204 { 1205 1206 return (0); 1207 } 1208 1209 static struct mac_policy_ops mac_test_ops = 1210 { 1211 .mpo_destroy = mac_test_destroy, 1212 .mpo_init = mac_test_init, 1213 .mpo_syscall = mac_test_syscall, 1214 .mpo_init_bpfdesc_label = mac_test_init_bpfdesc_label, 1215 .mpo_init_cred_label = mac_test_init_cred_label, 1216 .mpo_init_devfsdirent_label = mac_test_init_devfsdirent_label, 1217 .mpo_init_ifnet_label = mac_test_init_ifnet_label, 1218 .mpo_init_ipq_label = mac_test_init_ipq_label, 1219 .mpo_init_mbuf_label = mac_test_init_mbuf_label, 1220 .mpo_init_mount_label = mac_test_init_mount_label, 1221 .mpo_init_mount_fs_label = mac_test_init_mount_fs_label, 1222 .mpo_init_pipe_label = mac_test_init_pipe_label, 1223 .mpo_init_socket_label = mac_test_init_socket_label, 1224 .mpo_init_socket_peer_label = mac_test_init_socket_peer_label, 1225 .mpo_init_vnode_label = mac_test_init_vnode_label, 1226 .mpo_destroy_bpfdesc_label = mac_test_destroy_bpfdesc_label, 1227 .mpo_destroy_cred_label = mac_test_destroy_cred_label, 1228 .mpo_destroy_devfsdirent_label = mac_test_destroy_devfsdirent_label, 1229 .mpo_destroy_ifnet_label = mac_test_destroy_ifnet_label, 1230 .mpo_destroy_ipq_label = mac_test_destroy_ipq_label, 1231 .mpo_destroy_mbuf_label = mac_test_destroy_mbuf_label, 1232 .mpo_destroy_mount_label = mac_test_destroy_mount_label, 1233 .mpo_destroy_mount_fs_label = mac_test_destroy_mount_fs_label, 1234 .mpo_destroy_pipe_label = mac_test_destroy_pipe_label, 1235 .mpo_destroy_socket_label = mac_test_destroy_socket_label, 1236 .mpo_destroy_socket_peer_label = mac_test_destroy_socket_peer_label, 1237 .mpo_destroy_vnode_label = mac_test_destroy_vnode_label, 1238 .mpo_externalize_cred_label = mac_test_externalize_label, 1239 .mpo_externalize_ifnet_label = mac_test_externalize_label, 1240 .mpo_externalize_pipe_label = mac_test_externalize_label, 1241 .mpo_externalize_socket_label = mac_test_externalize_label, 1242 .mpo_externalize_socket_peer_label = mac_test_externalize_label, 1243 .mpo_externalize_vnode_label = mac_test_externalize_label, 1244 .mpo_internalize_cred_label = mac_test_internalize_label, 1245 .mpo_internalize_ifnet_label = mac_test_internalize_label, 1246 .mpo_internalize_pipe_label = mac_test_internalize_label, 1247 .mpo_internalize_socket_label = mac_test_internalize_label, 1248 .mpo_internalize_vnode_label = mac_test_internalize_label, 1249 .mpo_associate_vnode_devfs = mac_test_associate_vnode_devfs, 1250 .mpo_associate_vnode_extattr = mac_test_associate_vnode_extattr, 1251 .mpo_associate_vnode_singlelabel = mac_test_associate_vnode_singlelabel, 1252 .mpo_create_devfs_device = mac_test_create_devfs_device, 1253 .mpo_create_devfs_directory = mac_test_create_devfs_directory, 1254 .mpo_create_devfs_symlink = mac_test_create_devfs_symlink, 1255 .mpo_create_vnode_extattr = mac_test_create_vnode_extattr, 1256 .mpo_create_mount = mac_test_create_mount, 1257 .mpo_create_root_mount = mac_test_create_root_mount, 1258 .mpo_relabel_vnode = mac_test_relabel_vnode, 1259 .mpo_setlabel_vnode_extattr = mac_test_setlabel_vnode_extattr, 1260 .mpo_update_devfsdirent = mac_test_update_devfsdirent, 1261 .mpo_create_mbuf_from_socket = mac_test_create_mbuf_from_socket, 1262 .mpo_create_pipe = mac_test_create_pipe, 1263 .mpo_create_socket = mac_test_create_socket, 1264 .mpo_create_socket_from_socket = mac_test_create_socket_from_socket, 1265 .mpo_relabel_pipe = mac_test_relabel_pipe, 1266 .mpo_relabel_socket = mac_test_relabel_socket, 1267 .mpo_set_socket_peer_from_mbuf = mac_test_set_socket_peer_from_mbuf, 1268 .mpo_set_socket_peer_from_socket = mac_test_set_socket_peer_from_socket, 1269 .mpo_create_bpfdesc = mac_test_create_bpfdesc, 1270 .mpo_create_ifnet = mac_test_create_ifnet, 1271 .mpo_create_datagram_from_ipq = mac_test_create_datagram_from_ipq, 1272 .mpo_create_fragment = mac_test_create_fragment, 1273 .mpo_create_ipq = mac_test_create_ipq, 1274 .mpo_create_mbuf_from_mbuf = mac_test_create_mbuf_from_mbuf, 1275 .mpo_create_mbuf_linklayer = mac_test_create_mbuf_linklayer, 1276 .mpo_create_mbuf_from_bpfdesc = mac_test_create_mbuf_from_bpfdesc, 1277 .mpo_create_mbuf_from_ifnet = mac_test_create_mbuf_from_ifnet, 1278 .mpo_create_mbuf_multicast_encap = mac_test_create_mbuf_multicast_encap, 1279 .mpo_create_mbuf_netlayer = mac_test_create_mbuf_netlayer, 1280 .mpo_fragment_match = mac_test_fragment_match, 1281 .mpo_relabel_ifnet = mac_test_relabel_ifnet, 1282 .mpo_update_ipq = mac_test_update_ipq, 1283 .mpo_create_cred = mac_test_create_cred, 1284 .mpo_execve_transition = mac_test_execve_transition, 1285 .mpo_execve_will_transition = mac_test_execve_will_transition, 1286 .mpo_create_proc0 = mac_test_create_proc0, 1287 .mpo_create_proc1 = mac_test_create_proc1, 1288 .mpo_relabel_cred = mac_test_relabel_cred, 1289 .mpo_check_bpfdesc_receive = mac_test_check_bpfdesc_receive, 1290 .mpo_check_cred_relabel = mac_test_check_cred_relabel, 1291 .mpo_check_cred_visible = mac_test_check_cred_visible, 1292 .mpo_check_ifnet_relabel = mac_test_check_ifnet_relabel, 1293 .mpo_check_ifnet_transmit = mac_test_check_ifnet_transmit, 1294 .mpo_check_mount_stat = mac_test_check_mount_stat, 1295 .mpo_check_pipe_ioctl = mac_test_check_pipe_ioctl, 1296 .mpo_check_pipe_poll = mac_test_check_pipe_poll, 1297 .mpo_check_pipe_read = mac_test_check_pipe_read, 1298 .mpo_check_pipe_relabel = mac_test_check_pipe_relabel, 1299 .mpo_check_pipe_stat = mac_test_check_pipe_stat, 1300 .mpo_check_pipe_write = mac_test_check_pipe_write, 1301 .mpo_check_proc_debug = mac_test_check_proc_debug, 1302 .mpo_check_proc_sched = mac_test_check_proc_sched, 1303 .mpo_check_proc_signal = mac_test_check_proc_signal, 1304 .mpo_check_socket_bind = mac_test_check_socket_bind, 1305 .mpo_check_socket_connect = mac_test_check_socket_connect, 1306 .mpo_check_socket_deliver = mac_test_check_socket_deliver, 1307 .mpo_check_socket_listen = mac_test_check_socket_listen, 1308 .mpo_check_socket_relabel = mac_test_check_socket_relabel, 1309 .mpo_check_socket_visible = mac_test_check_socket_visible, 1310 .mpo_check_vnode_access = mac_test_check_vnode_access, 1311 .mpo_check_vnode_chdir = mac_test_check_vnode_chdir, 1312 .mpo_check_vnode_chroot = mac_test_check_vnode_chroot, 1313 .mpo_check_vnode_create = mac_test_check_vnode_create, 1314 .mpo_check_vnode_delete = mac_test_check_vnode_delete, 1315 .mpo_check_vnode_deleteacl = mac_test_check_vnode_deleteacl, 1316 .mpo_check_vnode_exec = mac_test_check_vnode_exec, 1317 .mpo_check_vnode_getacl = mac_test_check_vnode_getacl, 1318 .mpo_check_vnode_getextattr = mac_test_check_vnode_getextattr, 1319 .mpo_check_vnode_link = mac_test_check_vnode_link, 1320 .mpo_check_vnode_lookup = mac_test_check_vnode_lookup, 1321 .mpo_check_vnode_mmap = mac_test_check_vnode_mmap, 1322 .mpo_check_vnode_mprotect = mac_test_check_vnode_mprotect, 1323 .mpo_check_vnode_open = mac_test_check_vnode_open, 1324 .mpo_check_vnode_poll = mac_test_check_vnode_poll, 1325 .mpo_check_vnode_read = mac_test_check_vnode_read, 1326 .mpo_check_vnode_readdir = mac_test_check_vnode_readdir, 1327 .mpo_check_vnode_readlink = mac_test_check_vnode_readlink, 1328 .mpo_check_vnode_relabel = mac_test_check_vnode_relabel, 1329 .mpo_check_vnode_rename_from = mac_test_check_vnode_rename_from, 1330 .mpo_check_vnode_rename_to = mac_test_check_vnode_rename_to, 1331 .mpo_check_vnode_revoke = mac_test_check_vnode_revoke, 1332 .mpo_check_vnode_setacl = mac_test_check_vnode_setacl, 1333 .mpo_check_vnode_setextattr = mac_test_check_vnode_setextattr, 1334 .mpo_check_vnode_setflags = mac_test_check_vnode_setflags, 1335 .mpo_check_vnode_setmode = mac_test_check_vnode_setmode, 1336 .mpo_check_vnode_setowner = mac_test_check_vnode_setowner, 1337 .mpo_check_vnode_setutimes = mac_test_check_vnode_setutimes, 1338 .mpo_check_vnode_stat = mac_test_check_vnode_stat, 1339 .mpo_check_vnode_write = mac_test_check_vnode_write, 1340 }; 1341 1342 MAC_POLICY_SET(&mac_test_ops, trustedbsd_mac_test, "TrustedBSD MAC/Test", 1343 MPC_LOADTIME_FLAG_UNLOADOK, &test_slot); 1344