1 /*- 2 * Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson 3 * Copyright (c) 2001, 2002 Networks Associates Technology, Inc. 4 * All rights reserved. 5 * 6 * This software was developed by Robert Watson for the TrustedBSD Project. 7 * 8 * This software was developed for the FreeBSD Project in part by Network 9 * Associates Laboratories, the Security Research Division of Network 10 * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), 11 * as part of the DARPA CHATS research program. 12 * 13 * Redistribution and use in source and binary forms, with or without 14 * modification, are permitted provided that the following conditions 15 * are met: 16 * 1. Redistributions of source code must retain the above copyright 17 * notice, this list of conditions and the following disclaimer. 18 * 2. Redistributions in binary form must reproduce the above copyright 19 * notice, this list of conditions and the following disclaimer in the 20 * documentation and/or other materials provided with the distribution. 21 * 22 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 23 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 24 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 25 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 26 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 27 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 28 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 29 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 30 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 31 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 32 * SUCH DAMAGE. 33 * 34 * $FreeBSD$ 35 */ 36 37 /* 38 * Developed by the TrustedBSD Project. 39 * Generic mandatory access module that does nothing. 40 */ 41 42 #include <sys/types.h> 43 #include <sys/param.h> 44 #include <sys/acl.h> 45 #include <sys/conf.h> 46 #include <sys/extattr.h> 47 #include <sys/kernel.h> 48 #include <sys/mac.h> 49 #include <sys/mount.h> 50 #include <sys/proc.h> 51 #include <sys/systm.h> 52 #include <sys/sysproto.h> 53 #include <sys/sysent.h> 54 #include <sys/vnode.h> 55 #include <sys/file.h> 56 #include <sys/socket.h> 57 #include <sys/socketvar.h> 58 #include <sys/sysctl.h> 59 60 #include <fs/devfs/devfs.h> 61 62 #include <net/bpfdesc.h> 63 #include <net/if.h> 64 #include <net/if_types.h> 65 #include <net/if_var.h> 66 67 #include <vm/vm.h> 68 69 #include <sys/mac_policy.h> 70 71 SYSCTL_DECL(_security_mac); 72 73 SYSCTL_NODE(_security_mac, OID_AUTO, test, CTLFLAG_RW, 0, 74 "TrustedBSD mac_test policy controls"); 75 76 static int mac_test_enabled = 1; 77 SYSCTL_INT(_security_mac_test, OID_AUTO, enabled, CTLFLAG_RW, 78 &mac_test_enabled, 0, "Enforce test policy"); 79 80 #define BPFMAGIC 0xfe1ad1b6 81 #define DEVFSMAGIC 0x9ee79c32 82 #define IFNETMAGIC 0xc218b120 83 #define IPQMAGIC 0x206188ef 84 #define MBUFMAGIC 0xbbefa5bb 85 #define MOUNTMAGIC 0xc7c46e47 86 #define SOCKETMAGIC 0x9199c6cd 87 #define PIPEMAGIC 0xdc6c9919 88 #define PROCMAGIC 0x3b4be98f 89 #define CREDMAGIC 0x9a5a4987 90 #define VNODEMAGIC 0x1a67a45c 91 #define EXMAGIC 0x849ba1fd 92 93 #define SLOT(x) LABEL_TO_SLOT((x), test_slot).l_long 94 static int test_slot; 95 SYSCTL_INT(_security_mac_test, OID_AUTO, slot, CTLFLAG_RD, 96 &test_slot, 0, "Slot allocated by framework"); 97 98 static int init_count_bpfdesc; 99 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_bpfdesc, CTLFLAG_RD, 100 &init_count_bpfdesc, 0, "bpfdesc init calls"); 101 static int init_count_cred; 102 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_cred, CTLFLAG_RD, 103 &init_count_cred, 0, "cred init calls"); 104 static int init_count_devfsdirent; 105 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_devfsdirent, CTLFLAG_RD, 106 &init_count_devfsdirent, 0, "devfsdirent init calls"); 107 static int init_count_ifnet; 108 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_ifnet, CTLFLAG_RD, 109 &init_count_ifnet, 0, "ifnet init calls"); 110 static int init_count_ipq; 111 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_ipq, CTLFLAG_RD, 112 &init_count_ipq, 0, "ipq init calls"); 113 static int init_count_mbuf; 114 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_mbuf, CTLFLAG_RD, 115 &init_count_mbuf, 0, "mbuf init calls"); 116 static int init_count_mount; 117 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_mount, CTLFLAG_RD, 118 &init_count_mount, 0, "mount init calls"); 119 static int init_count_mount_fslabel; 120 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_mount_fslabel, CTLFLAG_RD, 121 &init_count_mount_fslabel, 0, "mount_fslabel init calls"); 122 static int init_count_socket; 123 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_socket, CTLFLAG_RD, 124 &init_count_socket, 0, "socket init calls"); 125 static int init_count_socket_peerlabel; 126 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_socket_peerlabel, 127 CTLFLAG_RD, &init_count_socket_peerlabel, 0, 128 "socket_peerlabel init calls"); 129 static int init_count_pipe; 130 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_pipe, CTLFLAG_RD, 131 &init_count_pipe, 0, "pipe init calls"); 132 static int init_count_proc; 133 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_proc, CTLFLAG_RD, 134 &init_count_proc, 0, "proc init calls"); 135 static int init_count_vnode; 136 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_vnode, CTLFLAG_RD, 137 &init_count_vnode, 0, "vnode init calls"); 138 139 static int destroy_count_bpfdesc; 140 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_bpfdesc, CTLFLAG_RD, 141 &destroy_count_bpfdesc, 0, "bpfdesc destroy calls"); 142 static int destroy_count_cred; 143 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_cred, CTLFLAG_RD, 144 &destroy_count_cred, 0, "cred destroy calls"); 145 static int destroy_count_devfsdirent; 146 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_devfsdirent, CTLFLAG_RD, 147 &destroy_count_devfsdirent, 0, "devfsdirent destroy calls"); 148 static int destroy_count_ifnet; 149 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_ifnet, CTLFLAG_RD, 150 &destroy_count_ifnet, 0, "ifnet destroy calls"); 151 static int destroy_count_ipq; 152 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_ipq, CTLFLAG_RD, 153 &destroy_count_ipq, 0, "ipq destroy calls"); 154 static int destroy_count_mbuf; 155 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_mbuf, CTLFLAG_RD, 156 &destroy_count_mbuf, 0, "mbuf destroy calls"); 157 static int destroy_count_mount; 158 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_mount, CTLFLAG_RD, 159 &destroy_count_mount, 0, "mount destroy calls"); 160 static int destroy_count_mount_fslabel; 161 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_mount_fslabel, 162 CTLFLAG_RD, &destroy_count_mount_fslabel, 0, 163 "mount_fslabel destroy calls"); 164 static int destroy_count_socket; 165 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_socket, CTLFLAG_RD, 166 &destroy_count_socket, 0, "socket destroy calls"); 167 static int destroy_count_socket_peerlabel; 168 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_socket_peerlabel, 169 CTLFLAG_RD, &destroy_count_socket_peerlabel, 0, 170 "socket_peerlabel destroy calls"); 171 static int destroy_count_pipe; 172 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_pipe, CTLFLAG_RD, 173 &destroy_count_pipe, 0, "pipe destroy calls"); 174 static int destroy_count_proc; 175 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_proc, CTLFLAG_RD, 176 &destroy_count_proc, 0, "proc destroy calls"); 177 static int destroy_count_vnode; 178 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_vnode, CTLFLAG_RD, 179 &destroy_count_vnode, 0, "vnode destroy calls"); 180 181 static int externalize_count; 182 SYSCTL_INT(_security_mac_test, OID_AUTO, externalize_count, CTLFLAG_RD, 183 &externalize_count, 0, "Subject/object externalize calls"); 184 static int internalize_count; 185 SYSCTL_INT(_security_mac_test, OID_AUTO, internalize_count, CTLFLAG_RD, 186 &internalize_count, 0, "Subject/object internalize calls"); 187 188 /* 189 * Policy module operations. 190 */ 191 static void 192 mac_test_destroy(struct mac_policy_conf *conf) 193 { 194 195 } 196 197 static void 198 mac_test_init(struct mac_policy_conf *conf) 199 { 200 201 } 202 203 static int 204 mac_test_syscall(struct thread *td, int call, void *arg) 205 { 206 207 return (0); 208 } 209 210 /* 211 * Label operations. 212 */ 213 static void 214 mac_test_init_bpfdesc_label(struct label *label) 215 { 216 217 SLOT(label) = BPFMAGIC; 218 atomic_add_int(&init_count_bpfdesc, 1); 219 } 220 221 static void 222 mac_test_init_cred_label(struct label *label) 223 { 224 225 SLOT(label) = CREDMAGIC; 226 atomic_add_int(&init_count_cred, 1); 227 } 228 229 static void 230 mac_test_init_devfsdirent_label(struct label *label) 231 { 232 233 SLOT(label) = DEVFSMAGIC; 234 atomic_add_int(&init_count_devfsdirent, 1); 235 } 236 237 static void 238 mac_test_init_ifnet_label(struct label *label) 239 { 240 241 SLOT(label) = IFNETMAGIC; 242 atomic_add_int(&init_count_ifnet, 1); 243 } 244 245 static int 246 mac_test_init_ipq_label(struct label *label, int flag) 247 { 248 249 SLOT(label) = IPQMAGIC; 250 atomic_add_int(&init_count_ipq, 1); 251 return (0); 252 } 253 254 static int 255 mac_test_init_mbuf_label(struct label *label, int flag) 256 { 257 258 SLOT(label) = MBUFMAGIC; 259 atomic_add_int(&init_count_mbuf, 1); 260 return (0); 261 } 262 263 static void 264 mac_test_init_mount_label(struct label *label) 265 { 266 267 SLOT(label) = MOUNTMAGIC; 268 atomic_add_int(&init_count_mount, 1); 269 } 270 271 static void 272 mac_test_init_mount_fs_label(struct label *label) 273 { 274 275 SLOT(label) = MOUNTMAGIC; 276 atomic_add_int(&init_count_mount_fslabel, 1); 277 } 278 279 static int 280 mac_test_init_socket_label(struct label *label, int flag) 281 { 282 283 SLOT(label) = SOCKETMAGIC; 284 atomic_add_int(&init_count_socket, 1); 285 return (0); 286 } 287 288 static int 289 mac_test_init_socket_peer_label(struct label *label, int flag) 290 { 291 292 SLOT(label) = SOCKETMAGIC; 293 atomic_add_int(&init_count_socket_peerlabel, 1); 294 return (0); 295 } 296 297 static void 298 mac_test_init_pipe_label(struct label *label) 299 { 300 301 SLOT(label) = PIPEMAGIC; 302 atomic_add_int(&init_count_pipe, 1); 303 } 304 305 static void 306 mac_test_init_proc_label(struct label *label) 307 { 308 309 SLOT(label) = PROCMAGIC; 310 atomic_add_int(&init_count_proc, 1); 311 } 312 313 static void 314 mac_test_init_vnode_label(struct label *label) 315 { 316 317 SLOT(label) = VNODEMAGIC; 318 atomic_add_int(&init_count_vnode, 1); 319 } 320 321 static void 322 mac_test_destroy_bpfdesc_label(struct label *label) 323 { 324 325 if (SLOT(label) == BPFMAGIC || SLOT(label) == 0) { 326 atomic_add_int(&destroy_count_bpfdesc, 1); 327 SLOT(label) = EXMAGIC; 328 } else if (SLOT(label) == EXMAGIC) { 329 Debugger("mac_test_destroy_bpfdesc: dup destroy"); 330 } else { 331 Debugger("mac_test_destroy_bpfdesc: corrupted label"); 332 } 333 } 334 335 static void 336 mac_test_destroy_cred_label(struct label *label) 337 { 338 339 if (SLOT(label) == CREDMAGIC || SLOT(label) == 0) { 340 atomic_add_int(&destroy_count_cred, 1); 341 SLOT(label) = EXMAGIC; 342 } else if (SLOT(label) == EXMAGIC) { 343 Debugger("mac_test_destroy_cred: dup destroy"); 344 } else { 345 Debugger("mac_test_destroy_cred: corrupted label"); 346 } 347 } 348 349 static void 350 mac_test_destroy_devfsdirent_label(struct label *label) 351 { 352 353 if (SLOT(label) == DEVFSMAGIC || SLOT(label) == 0) { 354 atomic_add_int(&destroy_count_devfsdirent, 1); 355 SLOT(label) = EXMAGIC; 356 } else if (SLOT(label) == EXMAGIC) { 357 Debugger("mac_test_destroy_devfsdirent: dup destroy"); 358 } else { 359 Debugger("mac_test_destroy_devfsdirent: corrupted label"); 360 } 361 } 362 363 static void 364 mac_test_destroy_ifnet_label(struct label *label) 365 { 366 367 if (SLOT(label) == IFNETMAGIC || SLOT(label) == 0) { 368 atomic_add_int(&destroy_count_ifnet, 1); 369 SLOT(label) = EXMAGIC; 370 } else if (SLOT(label) == EXMAGIC) { 371 Debugger("mac_test_destroy_ifnet: dup destroy"); 372 } else { 373 Debugger("mac_test_destroy_ifnet: corrupted label"); 374 } 375 } 376 377 static void 378 mac_test_destroy_ipq_label(struct label *label) 379 { 380 381 if (SLOT(label) == IPQMAGIC || SLOT(label) == 0) { 382 atomic_add_int(&destroy_count_ipq, 1); 383 SLOT(label) = EXMAGIC; 384 } else if (SLOT(label) == EXMAGIC) { 385 Debugger("mac_test_destroy_ipq: dup destroy"); 386 } else { 387 Debugger("mac_test_destroy_ipq: corrupted label"); 388 } 389 } 390 391 static void 392 mac_test_destroy_mbuf_label(struct label *label) 393 { 394 395 if (SLOT(label) == MBUFMAGIC || SLOT(label) == 0) { 396 atomic_add_int(&destroy_count_mbuf, 1); 397 SLOT(label) = EXMAGIC; 398 } else if (SLOT(label) == EXMAGIC) { 399 Debugger("mac_test_destroy_mbuf: dup destroy"); 400 } else { 401 Debugger("mac_test_destroy_mbuf: corrupted label"); 402 } 403 } 404 405 static void 406 mac_test_destroy_mount_label(struct label *label) 407 { 408 409 if ((SLOT(label) == MOUNTMAGIC || SLOT(label) == 0)) { 410 atomic_add_int(&destroy_count_mount, 1); 411 SLOT(label) = EXMAGIC; 412 } else if (SLOT(label) == EXMAGIC) { 413 Debugger("mac_test_destroy_mount: dup destroy"); 414 } else { 415 Debugger("mac_test_destroy_mount: corrupted label"); 416 } 417 } 418 419 static void 420 mac_test_destroy_mount_fs_label(struct label *label) 421 { 422 423 if ((SLOT(label) == MOUNTMAGIC || SLOT(label) == 0)) { 424 atomic_add_int(&destroy_count_mount_fslabel, 1); 425 SLOT(label) = EXMAGIC; 426 } else if (SLOT(label) == EXMAGIC) { 427 Debugger("mac_test_destroy_mount_fslabel: dup destroy"); 428 } else { 429 Debugger("mac_test_destroy_mount_fslabel: corrupted label"); 430 } 431 } 432 433 static void 434 mac_test_destroy_socket_label(struct label *label) 435 { 436 437 if ((SLOT(label) == SOCKETMAGIC || SLOT(label) == 0)) { 438 atomic_add_int(&destroy_count_socket, 1); 439 SLOT(label) = EXMAGIC; 440 } else if (SLOT(label) == EXMAGIC) { 441 Debugger("mac_test_destroy_socket: dup destroy"); 442 } else { 443 Debugger("mac_test_destroy_socket: corrupted label"); 444 } 445 } 446 447 static void 448 mac_test_destroy_socket_peer_label(struct label *label) 449 { 450 451 if ((SLOT(label) == SOCKETMAGIC || SLOT(label) == 0)) { 452 atomic_add_int(&destroy_count_socket_peerlabel, 1); 453 SLOT(label) = EXMAGIC; 454 } else if (SLOT(label) == EXMAGIC) { 455 Debugger("mac_test_destroy_socket_peerlabel: dup destroy"); 456 } else { 457 Debugger("mac_test_destroy_socket_peerlabel: corrupted label"); 458 } 459 } 460 461 static void 462 mac_test_destroy_pipe_label(struct label *label) 463 { 464 465 if ((SLOT(label) == PIPEMAGIC || SLOT(label) == 0)) { 466 atomic_add_int(&destroy_count_pipe, 1); 467 SLOT(label) = EXMAGIC; 468 } else if (SLOT(label) == EXMAGIC) { 469 Debugger("mac_test_destroy_pipe: dup destroy"); 470 } else { 471 Debugger("mac_test_destroy_pipe: corrupted label"); 472 } 473 } 474 475 static void 476 mac_test_destroy_proc_label(struct label *label) 477 { 478 479 if ((SLOT(label) == PROCMAGIC || SLOT(label) == 0)) { 480 atomic_add_int(&destroy_count_proc, 1); 481 SLOT(label) = EXMAGIC; 482 } else if (SLOT(label) == EXMAGIC) { 483 Debugger("mac_test_destroy_proc: dup destroy"); 484 } else { 485 Debugger("mac_test_destroy_proc: corrupted label"); 486 } 487 } 488 489 static void 490 mac_test_destroy_vnode_label(struct label *label) 491 { 492 493 if (SLOT(label) == VNODEMAGIC || SLOT(label) == 0) { 494 atomic_add_int(&destroy_count_vnode, 1); 495 SLOT(label) = EXMAGIC; 496 } else if (SLOT(label) == EXMAGIC) { 497 Debugger("mac_test_destroy_vnode: dup destroy"); 498 } else { 499 Debugger("mac_test_destroy_vnode: corrupted label"); 500 } 501 } 502 503 static int 504 mac_test_externalize_label(struct label *label, char *element_name, 505 char *element_data, size_t size, size_t *len, int *claimed) 506 { 507 508 atomic_add_int(&externalize_count, 1); 509 510 return (0); 511 } 512 513 static int 514 mac_test_internalize_label(struct label *label, char *element_name, 515 char *element_data, int *claimed) 516 { 517 518 atomic_add_int(&internalize_count, 1); 519 520 return (0); 521 } 522 523 /* 524 * Labeling event operations: file system objects, and things that look 525 * a lot like file system objects. 526 */ 527 static void 528 mac_test_associate_vnode_devfs(struct mount *mp, struct label *fslabel, 529 struct devfs_dirent *de, struct label *delabel, struct vnode *vp, 530 struct label *vlabel) 531 { 532 533 } 534 535 static int 536 mac_test_associate_vnode_extattr(struct mount *mp, struct label *fslabel, 537 struct vnode *vp, struct label *vlabel) 538 { 539 540 return (0); 541 } 542 543 static void 544 mac_test_associate_vnode_singlelabel(struct mount *mp, 545 struct label *fslabel, struct vnode *vp, struct label *vlabel) 546 { 547 548 } 549 550 static void 551 mac_test_create_devfs_device(struct mount *mp, dev_t dev, 552 struct devfs_dirent *devfs_dirent, struct label *label) 553 { 554 555 } 556 557 static void 558 mac_test_create_devfs_directory(struct mount *mp, char *dirname, 559 int dirnamelen, struct devfs_dirent *devfs_dirent, struct label *label) 560 { 561 562 } 563 564 static void 565 mac_test_create_devfs_symlink(struct ucred *cred, struct mount *mp, 566 struct devfs_dirent *dd, struct label *ddlabel, struct devfs_dirent *de, 567 struct label *delabel) 568 { 569 570 } 571 572 static int 573 mac_test_create_vnode_extattr(struct ucred *cred, struct mount *mp, 574 struct label *fslabel, struct vnode *dvp, struct label *dlabel, 575 struct vnode *vp, struct label *vlabel, struct componentname *cnp) 576 { 577 578 return (0); 579 } 580 581 static void 582 mac_test_create_mount(struct ucred *cred, struct mount *mp, 583 struct label *mntlabel, struct label *fslabel) 584 { 585 586 } 587 588 static void 589 mac_test_create_root_mount(struct ucred *cred, struct mount *mp, 590 struct label *mntlabel, struct label *fslabel) 591 { 592 593 } 594 595 static void 596 mac_test_relabel_vnode(struct ucred *cred, struct vnode *vp, 597 struct label *vnodelabel, struct label *label) 598 { 599 600 } 601 602 static int 603 mac_test_setlabel_vnode_extattr(struct ucred *cred, struct vnode *vp, 604 struct label *vlabel, struct label *intlabel) 605 { 606 607 return (0); 608 } 609 610 static void 611 mac_test_update_devfsdirent(struct mount *mp, 612 struct devfs_dirent *devfs_dirent, struct label *direntlabel, 613 struct vnode *vp, struct label *vnodelabel) 614 { 615 616 } 617 618 /* 619 * Labeling event operations: IPC object. 620 */ 621 static void 622 mac_test_create_mbuf_from_socket(struct socket *so, struct label *socketlabel, 623 struct mbuf *m, struct label *mbuflabel) 624 { 625 626 } 627 628 static void 629 mac_test_create_socket(struct ucred *cred, struct socket *socket, 630 struct label *socketlabel) 631 { 632 633 } 634 635 static void 636 mac_test_create_pipe(struct ucred *cred, struct pipe *pipe, 637 struct label *pipelabel) 638 { 639 640 } 641 642 static void 643 mac_test_create_socket_from_socket(struct socket *oldsocket, 644 struct label *oldsocketlabel, struct socket *newsocket, 645 struct label *newsocketlabel) 646 { 647 648 } 649 650 static void 651 mac_test_relabel_socket(struct ucred *cred, struct socket *socket, 652 struct label *socketlabel, struct label *newlabel) 653 { 654 655 } 656 657 static void 658 mac_test_relabel_pipe(struct ucred *cred, struct pipe *pipe, 659 struct label *pipelabel, struct label *newlabel) 660 { 661 662 } 663 664 static void 665 mac_test_set_socket_peer_from_mbuf(struct mbuf *mbuf, struct label *mbuflabel, 666 struct socket *socket, struct label *socketpeerlabel) 667 { 668 669 } 670 671 /* 672 * Labeling event operations: network objects. 673 */ 674 static void 675 mac_test_set_socket_peer_from_socket(struct socket *oldsocket, 676 struct label *oldsocketlabel, struct socket *newsocket, 677 struct label *newsocketpeerlabel) 678 { 679 680 } 681 682 static void 683 mac_test_create_bpfdesc(struct ucred *cred, struct bpf_d *bpf_d, 684 struct label *bpflabel) 685 { 686 687 } 688 689 static void 690 mac_test_create_datagram_from_ipq(struct ipq *ipq, struct label *ipqlabel, 691 struct mbuf *datagram, struct label *datagramlabel) 692 { 693 694 } 695 696 static void 697 mac_test_create_fragment(struct mbuf *datagram, struct label *datagramlabel, 698 struct mbuf *fragment, struct label *fragmentlabel) 699 { 700 701 } 702 703 static void 704 mac_test_create_ifnet(struct ifnet *ifnet, struct label *ifnetlabel) 705 { 706 707 } 708 709 static void 710 mac_test_create_ipq(struct mbuf *fragment, struct label *fragmentlabel, 711 struct ipq *ipq, struct label *ipqlabel) 712 { 713 714 } 715 716 static void 717 mac_test_create_mbuf_from_mbuf(struct mbuf *oldmbuf, 718 struct label *oldmbuflabel, struct mbuf *newmbuf, 719 struct label *newmbuflabel) 720 { 721 722 } 723 724 static void 725 mac_test_create_mbuf_linklayer(struct ifnet *ifnet, struct label *ifnetlabel, 726 struct mbuf *mbuf, struct label *mbuflabel) 727 { 728 729 } 730 731 static void 732 mac_test_create_mbuf_from_bpfdesc(struct bpf_d *bpf_d, struct label *bpflabel, 733 struct mbuf *mbuf, struct label *mbuflabel) 734 { 735 736 } 737 738 static void 739 mac_test_create_mbuf_from_ifnet(struct ifnet *ifnet, struct label *ifnetlabel, 740 struct mbuf *m, struct label *mbuflabel) 741 { 742 743 } 744 745 static void 746 mac_test_create_mbuf_multicast_encap(struct mbuf *oldmbuf, 747 struct label *oldmbuflabel, struct ifnet *ifnet, struct label *ifnetlabel, 748 struct mbuf *newmbuf, struct label *newmbuflabel) 749 { 750 751 } 752 753 static void 754 mac_test_create_mbuf_netlayer(struct mbuf *oldmbuf, 755 struct label *oldmbuflabel, struct mbuf *newmbuf, 756 struct label *newmbuflabel) 757 { 758 759 } 760 761 static int 762 mac_test_fragment_match(struct mbuf *fragment, struct label *fragmentlabel, 763 struct ipq *ipq, struct label *ipqlabel) 764 { 765 766 return (1); 767 } 768 769 static void 770 mac_test_relabel_ifnet(struct ucred *cred, struct ifnet *ifnet, 771 struct label *ifnetlabel, struct label *newlabel) 772 { 773 774 } 775 776 static void 777 mac_test_update_ipq(struct mbuf *fragment, struct label *fragmentlabel, 778 struct ipq *ipq, struct label *ipqlabel) 779 { 780 781 } 782 783 /* 784 * Labeling event operations: processes. 785 */ 786 static void 787 mac_test_create_cred(struct ucred *cred_parent, struct ucred *cred_child) 788 { 789 790 } 791 792 static void 793 mac_test_execve_transition(struct ucred *old, struct ucred *new, 794 struct vnode *vp, struct label *filelabel, 795 struct label *interpvnodelabel, struct image_params *imgp, 796 struct label *execlabel) 797 { 798 799 } 800 801 static int 802 mac_test_execve_will_transition(struct ucred *old, struct vnode *vp, 803 struct label *filelabel, struct label *interpvnodelabel, 804 struct image_params *imgp, struct label *execlabel) 805 { 806 807 return (0); 808 } 809 810 static void 811 mac_test_create_proc0(struct ucred *cred) 812 { 813 814 } 815 816 static void 817 mac_test_create_proc1(struct ucred *cred) 818 { 819 820 } 821 822 static void 823 mac_test_relabel_cred(struct ucred *cred, struct label *newlabel) 824 { 825 826 } 827 828 static void 829 mac_test_thread_userret(struct thread *td) 830 { 831 832 } 833 834 /* 835 * Access control checks. 836 */ 837 static int 838 mac_test_check_bpfdesc_receive(struct bpf_d *bpf_d, struct label *bpflabel, 839 struct ifnet *ifnet, struct label *ifnetlabel) 840 { 841 842 return (0); 843 } 844 845 static int 846 mac_test_check_cred_relabel(struct ucred *cred, struct label *newlabel) 847 { 848 849 return (0); 850 } 851 852 static int 853 mac_test_check_cred_visible(struct ucred *u1, struct ucred *u2) 854 { 855 856 return (0); 857 } 858 859 static int 860 mac_test_check_ifnet_relabel(struct ucred *cred, struct ifnet *ifnet, 861 struct label *ifnetlabel, struct label *newlabel) 862 { 863 864 return (0); 865 } 866 867 static int 868 mac_test_check_ifnet_transmit(struct ifnet *ifnet, struct label *ifnetlabel, 869 struct mbuf *m, struct label *mbuflabel) 870 { 871 872 return (0); 873 } 874 875 static int 876 mac_test_check_kenv_dump(struct ucred *cred) 877 { 878 879 return (0); 880 } 881 882 static int 883 mac_test_check_kenv_get(struct ucred *cred, char *name) 884 { 885 886 return (0); 887 } 888 889 static int 890 mac_test_check_kenv_set(struct ucred *cred, char *name, char *value) 891 { 892 893 return (0); 894 } 895 896 static int 897 mac_test_check_kenv_unset(struct ucred *cred, char *name) 898 { 899 900 return (0); 901 } 902 903 static int 904 mac_test_check_kld_load(struct ucred *cred, struct vnode *vp, 905 struct label *label) 906 { 907 908 return (0); 909 } 910 911 static int 912 mac_test_check_kld_stat(struct ucred *cred) 913 { 914 915 return (0); 916 } 917 918 static int 919 mac_test_check_kld_unload(struct ucred *cred) 920 { 921 922 return (0); 923 } 924 925 static int 926 mac_test_check_mount_stat(struct ucred *cred, struct mount *mp, 927 struct label *mntlabel) 928 { 929 930 return (0); 931 } 932 933 static int 934 mac_test_check_pipe_ioctl(struct ucred *cred, struct pipe *pipe, 935 struct label *pipelabel, unsigned long cmd, void /* caddr_t */ *data) 936 { 937 938 return (0); 939 } 940 941 static int 942 mac_test_check_pipe_poll(struct ucred *cred, struct pipe *pipe, 943 struct label *pipelabel) 944 { 945 946 return (0); 947 } 948 949 static int 950 mac_test_check_pipe_read(struct ucred *cred, struct pipe *pipe, 951 struct label *pipelabel) 952 { 953 954 return (0); 955 } 956 957 static int 958 mac_test_check_pipe_relabel(struct ucred *cred, struct pipe *pipe, 959 struct label *pipelabel, struct label *newlabel) 960 { 961 962 return (0); 963 } 964 965 static int 966 mac_test_check_pipe_stat(struct ucred *cred, struct pipe *pipe, 967 struct label *pipelabel) 968 { 969 970 return (0); 971 } 972 973 static int 974 mac_test_check_pipe_write(struct ucred *cred, struct pipe *pipe, 975 struct label *pipelabel) 976 { 977 978 return (0); 979 } 980 981 static int 982 mac_test_check_proc_debug(struct ucred *cred, struct proc *proc) 983 { 984 985 return (0); 986 } 987 988 static int 989 mac_test_check_proc_sched(struct ucred *cred, struct proc *proc) 990 { 991 992 return (0); 993 } 994 995 static int 996 mac_test_check_proc_signal(struct ucred *cred, struct proc *proc, int signum) 997 { 998 999 return (0); 1000 } 1001 1002 static int 1003 mac_test_check_socket_bind(struct ucred *cred, struct socket *socket, 1004 struct label *socketlabel, struct sockaddr *sockaddr) 1005 { 1006 1007 return (0); 1008 } 1009 1010 static int 1011 mac_test_check_socket_connect(struct ucred *cred, struct socket *socket, 1012 struct label *socketlabel, struct sockaddr *sockaddr) 1013 { 1014 1015 return (0); 1016 } 1017 1018 static int 1019 mac_test_check_socket_deliver(struct socket *socket, struct label *socketlabel, 1020 struct mbuf *m, struct label *mbuflabel) 1021 { 1022 1023 return (0); 1024 } 1025 1026 static int 1027 mac_test_check_socket_listen(struct ucred *cred, struct socket *socket, 1028 struct label *socketlabel) 1029 { 1030 1031 return (0); 1032 } 1033 1034 static int 1035 mac_test_check_socket_visible(struct ucred *cred, struct socket *socket, 1036 struct label *socketlabel) 1037 { 1038 1039 return (0); 1040 } 1041 1042 static int 1043 mac_test_check_socket_relabel(struct ucred *cred, struct socket *socket, 1044 struct label *socketlabel, struct label *newlabel) 1045 { 1046 1047 return (0); 1048 } 1049 1050 static int 1051 mac_test_check_sysarch_ioperm(struct ucred *cred) 1052 { 1053 1054 return (0); 1055 } 1056 1057 static int 1058 mac_test_check_system_acct(struct ucred *cred, struct vnode *vp, 1059 struct label *label) 1060 { 1061 1062 return (0); 1063 } 1064 1065 static int 1066 mac_test_check_system_reboot(struct ucred *cred, int how) 1067 { 1068 1069 return (0); 1070 } 1071 1072 static int 1073 mac_test_check_system_settime(struct ucred *cred) 1074 { 1075 1076 return (0); 1077 } 1078 1079 static int 1080 mac_test_check_system_swapon(struct ucred *cred, struct vnode *vp, 1081 struct label *label) 1082 { 1083 1084 return (0); 1085 } 1086 1087 static int 1088 mac_test_check_system_swapoff(struct ucred *cred, struct vnode *vp, 1089 struct label *label) 1090 { 1091 1092 return (0); 1093 } 1094 1095 static int 1096 mac_test_check_system_sysctl(struct ucred *cred, int *name, u_int namelen, 1097 void *old, size_t *oldlenp, int inkernel, void *new, size_t newlen) 1098 { 1099 1100 return (0); 1101 } 1102 1103 static int 1104 mac_test_check_vnode_access(struct ucred *cred, struct vnode *vp, 1105 struct label *label, int acc_mode) 1106 { 1107 1108 return (0); 1109 } 1110 1111 static int 1112 mac_test_check_vnode_chdir(struct ucred *cred, struct vnode *dvp, 1113 struct label *dlabel) 1114 { 1115 1116 return (0); 1117 } 1118 1119 static int 1120 mac_test_check_vnode_chroot(struct ucred *cred, struct vnode *dvp, 1121 struct label *dlabel) 1122 { 1123 1124 return (0); 1125 } 1126 1127 static int 1128 mac_test_check_vnode_create(struct ucred *cred, struct vnode *dvp, 1129 struct label *dlabel, struct componentname *cnp, struct vattr *vap) 1130 { 1131 1132 return (0); 1133 } 1134 1135 static int 1136 mac_test_check_vnode_delete(struct ucred *cred, struct vnode *dvp, 1137 struct label *dlabel, struct vnode *vp, struct label *label, 1138 struct componentname *cnp) 1139 { 1140 1141 return (0); 1142 } 1143 1144 static int 1145 mac_test_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp, 1146 struct label *label, acl_type_t type) 1147 { 1148 1149 return (0); 1150 } 1151 1152 static int 1153 mac_test_check_vnode_exec(struct ucred *cred, struct vnode *vp, 1154 struct label *label, struct image_params *imgp, 1155 struct label *execlabel) 1156 { 1157 1158 return (0); 1159 } 1160 1161 static int 1162 mac_test_check_vnode_getacl(struct ucred *cred, struct vnode *vp, 1163 struct label *label, acl_type_t type) 1164 { 1165 1166 return (0); 1167 } 1168 1169 static int 1170 mac_test_check_vnode_getextattr(struct ucred *cred, struct vnode *vp, 1171 struct label *label, int attrnamespace, const char *name, struct uio *uio) 1172 { 1173 1174 return (0); 1175 } 1176 1177 static int 1178 mac_test_check_vnode_link(struct ucred *cred, struct vnode *dvp, 1179 struct label *dlabel, struct vnode *vp, struct label *label, 1180 struct componentname *cnp) 1181 { 1182 1183 return (0); 1184 } 1185 1186 static int 1187 mac_test_check_vnode_lookup(struct ucred *cred, struct vnode *dvp, 1188 struct label *dlabel, struct componentname *cnp) 1189 { 1190 1191 return (0); 1192 } 1193 1194 static int 1195 mac_test_check_vnode_mmap(struct ucred *cred, struct vnode *vp, 1196 struct label *label, int prot) 1197 { 1198 1199 return (0); 1200 } 1201 1202 static int 1203 mac_test_check_vnode_mprotect(struct ucred *cred, struct vnode *vp, 1204 struct label *label, int prot) 1205 { 1206 1207 return (0); 1208 } 1209 1210 static int 1211 mac_test_check_vnode_open(struct ucred *cred, struct vnode *vp, 1212 struct label *filelabel, int acc_mode) 1213 { 1214 1215 return (0); 1216 } 1217 1218 static int 1219 mac_test_check_vnode_poll(struct ucred *active_cred, struct ucred *file_cred, 1220 struct vnode *vp, struct label *label) 1221 { 1222 1223 return (0); 1224 } 1225 1226 static int 1227 mac_test_check_vnode_read(struct ucred *active_cred, struct ucred *file_cred, 1228 struct vnode *vp, struct label *label) 1229 { 1230 1231 return (0); 1232 } 1233 1234 static int 1235 mac_test_check_vnode_readdir(struct ucred *cred, struct vnode *dvp, 1236 struct label *dlabel) 1237 { 1238 1239 return (0); 1240 } 1241 1242 static int 1243 mac_test_check_vnode_readlink(struct ucred *cred, struct vnode *vp, 1244 struct label *vnodelabel) 1245 { 1246 1247 return (0); 1248 } 1249 1250 static int 1251 mac_test_check_vnode_relabel(struct ucred *cred, struct vnode *vp, 1252 struct label *vnodelabel, struct label *newlabel) 1253 { 1254 1255 return (0); 1256 } 1257 1258 static int 1259 mac_test_check_vnode_rename_from(struct ucred *cred, struct vnode *dvp, 1260 struct label *dlabel, struct vnode *vp, struct label *label, 1261 struct componentname *cnp) 1262 { 1263 1264 return (0); 1265 } 1266 1267 static int 1268 mac_test_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp, 1269 struct label *dlabel, struct vnode *vp, struct label *label, int samedir, 1270 struct componentname *cnp) 1271 { 1272 1273 return (0); 1274 } 1275 1276 static int 1277 mac_test_check_vnode_revoke(struct ucred *cred, struct vnode *vp, 1278 struct label *label) 1279 { 1280 1281 return (0); 1282 } 1283 1284 static int 1285 mac_test_check_vnode_setacl(struct ucred *cred, struct vnode *vp, 1286 struct label *label, acl_type_t type, struct acl *acl) 1287 { 1288 1289 return (0); 1290 } 1291 1292 static int 1293 mac_test_check_vnode_setextattr(struct ucred *cred, struct vnode *vp, 1294 struct label *label, int attrnamespace, const char *name, struct uio *uio) 1295 { 1296 1297 return (0); 1298 } 1299 1300 static int 1301 mac_test_check_vnode_setflags(struct ucred *cred, struct vnode *vp, 1302 struct label *label, u_long flags) 1303 { 1304 1305 return (0); 1306 } 1307 1308 static int 1309 mac_test_check_vnode_setmode(struct ucred *cred, struct vnode *vp, 1310 struct label *label, mode_t mode) 1311 { 1312 1313 return (0); 1314 } 1315 1316 static int 1317 mac_test_check_vnode_setowner(struct ucred *cred, struct vnode *vp, 1318 struct label *label, uid_t uid, gid_t gid) 1319 { 1320 1321 return (0); 1322 } 1323 1324 static int 1325 mac_test_check_vnode_setutimes(struct ucred *cred, struct vnode *vp, 1326 struct label *label, struct timespec atime, struct timespec mtime) 1327 { 1328 1329 return (0); 1330 } 1331 1332 static int 1333 mac_test_check_vnode_stat(struct ucred *active_cred, struct ucred *file_cred, 1334 struct vnode *vp, struct label *label) 1335 { 1336 1337 return (0); 1338 } 1339 1340 static int 1341 mac_test_check_vnode_write(struct ucred *active_cred, 1342 struct ucred *file_cred, struct vnode *vp, struct label *label) 1343 { 1344 1345 return (0); 1346 } 1347 1348 static struct mac_policy_ops mac_test_ops = 1349 { 1350 .mpo_destroy = mac_test_destroy, 1351 .mpo_init = mac_test_init, 1352 .mpo_syscall = mac_test_syscall, 1353 .mpo_init_bpfdesc_label = mac_test_init_bpfdesc_label, 1354 .mpo_init_cred_label = mac_test_init_cred_label, 1355 .mpo_init_devfsdirent_label = mac_test_init_devfsdirent_label, 1356 .mpo_init_ifnet_label = mac_test_init_ifnet_label, 1357 .mpo_init_ipq_label = mac_test_init_ipq_label, 1358 .mpo_init_mbuf_label = mac_test_init_mbuf_label, 1359 .mpo_init_mount_label = mac_test_init_mount_label, 1360 .mpo_init_mount_fs_label = mac_test_init_mount_fs_label, 1361 .mpo_init_pipe_label = mac_test_init_pipe_label, 1362 .mpo_init_proc_label = mac_test_init_proc_label, 1363 .mpo_init_socket_label = mac_test_init_socket_label, 1364 .mpo_init_socket_peer_label = mac_test_init_socket_peer_label, 1365 .mpo_init_vnode_label = mac_test_init_vnode_label, 1366 .mpo_destroy_bpfdesc_label = mac_test_destroy_bpfdesc_label, 1367 .mpo_destroy_cred_label = mac_test_destroy_cred_label, 1368 .mpo_destroy_devfsdirent_label = mac_test_destroy_devfsdirent_label, 1369 .mpo_destroy_ifnet_label = mac_test_destroy_ifnet_label, 1370 .mpo_destroy_ipq_label = mac_test_destroy_ipq_label, 1371 .mpo_destroy_mbuf_label = mac_test_destroy_mbuf_label, 1372 .mpo_destroy_mount_label = mac_test_destroy_mount_label, 1373 .mpo_destroy_mount_fs_label = mac_test_destroy_mount_fs_label, 1374 .mpo_destroy_pipe_label = mac_test_destroy_pipe_label, 1375 .mpo_destroy_proc_label = mac_test_destroy_proc_label, 1376 .mpo_destroy_socket_label = mac_test_destroy_socket_label, 1377 .mpo_destroy_socket_peer_label = mac_test_destroy_socket_peer_label, 1378 .mpo_destroy_vnode_label = mac_test_destroy_vnode_label, 1379 .mpo_externalize_cred_label = mac_test_externalize_label, 1380 .mpo_externalize_ifnet_label = mac_test_externalize_label, 1381 .mpo_externalize_pipe_label = mac_test_externalize_label, 1382 .mpo_externalize_socket_label = mac_test_externalize_label, 1383 .mpo_externalize_socket_peer_label = mac_test_externalize_label, 1384 .mpo_externalize_vnode_label = mac_test_externalize_label, 1385 .mpo_internalize_cred_label = mac_test_internalize_label, 1386 .mpo_internalize_ifnet_label = mac_test_internalize_label, 1387 .mpo_internalize_pipe_label = mac_test_internalize_label, 1388 .mpo_internalize_socket_label = mac_test_internalize_label, 1389 .mpo_internalize_vnode_label = mac_test_internalize_label, 1390 .mpo_associate_vnode_devfs = mac_test_associate_vnode_devfs, 1391 .mpo_associate_vnode_extattr = mac_test_associate_vnode_extattr, 1392 .mpo_associate_vnode_singlelabel = mac_test_associate_vnode_singlelabel, 1393 .mpo_create_devfs_device = mac_test_create_devfs_device, 1394 .mpo_create_devfs_directory = mac_test_create_devfs_directory, 1395 .mpo_create_devfs_symlink = mac_test_create_devfs_symlink, 1396 .mpo_create_vnode_extattr = mac_test_create_vnode_extattr, 1397 .mpo_create_mount = mac_test_create_mount, 1398 .mpo_create_root_mount = mac_test_create_root_mount, 1399 .mpo_relabel_vnode = mac_test_relabel_vnode, 1400 .mpo_setlabel_vnode_extattr = mac_test_setlabel_vnode_extattr, 1401 .mpo_update_devfsdirent = mac_test_update_devfsdirent, 1402 .mpo_create_mbuf_from_socket = mac_test_create_mbuf_from_socket, 1403 .mpo_create_pipe = mac_test_create_pipe, 1404 .mpo_create_socket = mac_test_create_socket, 1405 .mpo_create_socket_from_socket = mac_test_create_socket_from_socket, 1406 .mpo_relabel_pipe = mac_test_relabel_pipe, 1407 .mpo_relabel_socket = mac_test_relabel_socket, 1408 .mpo_set_socket_peer_from_mbuf = mac_test_set_socket_peer_from_mbuf, 1409 .mpo_set_socket_peer_from_socket = mac_test_set_socket_peer_from_socket, 1410 .mpo_create_bpfdesc = mac_test_create_bpfdesc, 1411 .mpo_create_ifnet = mac_test_create_ifnet, 1412 .mpo_create_datagram_from_ipq = mac_test_create_datagram_from_ipq, 1413 .mpo_create_fragment = mac_test_create_fragment, 1414 .mpo_create_ipq = mac_test_create_ipq, 1415 .mpo_create_mbuf_from_mbuf = mac_test_create_mbuf_from_mbuf, 1416 .mpo_create_mbuf_linklayer = mac_test_create_mbuf_linklayer, 1417 .mpo_create_mbuf_from_bpfdesc = mac_test_create_mbuf_from_bpfdesc, 1418 .mpo_create_mbuf_from_ifnet = mac_test_create_mbuf_from_ifnet, 1419 .mpo_create_mbuf_multicast_encap = mac_test_create_mbuf_multicast_encap, 1420 .mpo_create_mbuf_netlayer = mac_test_create_mbuf_netlayer, 1421 .mpo_fragment_match = mac_test_fragment_match, 1422 .mpo_relabel_ifnet = mac_test_relabel_ifnet, 1423 .mpo_update_ipq = mac_test_update_ipq, 1424 .mpo_create_cred = mac_test_create_cred, 1425 .mpo_execve_transition = mac_test_execve_transition, 1426 .mpo_execve_will_transition = mac_test_execve_will_transition, 1427 .mpo_create_proc0 = mac_test_create_proc0, 1428 .mpo_create_proc1 = mac_test_create_proc1, 1429 .mpo_relabel_cred = mac_test_relabel_cred, 1430 .mpo_thread_userret = mac_test_thread_userret, 1431 .mpo_check_bpfdesc_receive = mac_test_check_bpfdesc_receive, 1432 .mpo_check_cred_relabel = mac_test_check_cred_relabel, 1433 .mpo_check_cred_visible = mac_test_check_cred_visible, 1434 .mpo_check_ifnet_relabel = mac_test_check_ifnet_relabel, 1435 .mpo_check_ifnet_transmit = mac_test_check_ifnet_transmit, 1436 .mpo_check_kenv_dump = mac_test_check_kenv_dump, 1437 .mpo_check_kenv_get = mac_test_check_kenv_get, 1438 .mpo_check_kenv_set = mac_test_check_kenv_set, 1439 .mpo_check_kenv_unset = mac_test_check_kenv_unset, 1440 .mpo_check_kld_load = mac_test_check_kld_load, 1441 .mpo_check_kld_stat = mac_test_check_kld_stat, 1442 .mpo_check_kld_unload = mac_test_check_kld_unload, 1443 .mpo_check_mount_stat = mac_test_check_mount_stat, 1444 .mpo_check_pipe_ioctl = mac_test_check_pipe_ioctl, 1445 .mpo_check_pipe_poll = mac_test_check_pipe_poll, 1446 .mpo_check_pipe_read = mac_test_check_pipe_read, 1447 .mpo_check_pipe_relabel = mac_test_check_pipe_relabel, 1448 .mpo_check_pipe_stat = mac_test_check_pipe_stat, 1449 .mpo_check_pipe_write = mac_test_check_pipe_write, 1450 .mpo_check_proc_debug = mac_test_check_proc_debug, 1451 .mpo_check_proc_sched = mac_test_check_proc_sched, 1452 .mpo_check_proc_signal = mac_test_check_proc_signal, 1453 .mpo_check_socket_bind = mac_test_check_socket_bind, 1454 .mpo_check_socket_connect = mac_test_check_socket_connect, 1455 .mpo_check_socket_deliver = mac_test_check_socket_deliver, 1456 .mpo_check_socket_listen = mac_test_check_socket_listen, 1457 .mpo_check_socket_relabel = mac_test_check_socket_relabel, 1458 .mpo_check_socket_visible = mac_test_check_socket_visible, 1459 .mpo_check_sysarch_ioperm = mac_test_check_sysarch_ioperm, 1460 .mpo_check_system_acct = mac_test_check_system_acct, 1461 .mpo_check_system_reboot = mac_test_check_system_reboot, 1462 .mpo_check_system_settime = mac_test_check_system_settime, 1463 .mpo_check_system_swapon = mac_test_check_system_swapon, 1464 .mpo_check_system_swapoff = mac_test_check_system_swapoff, 1465 .mpo_check_system_sysctl = mac_test_check_system_sysctl, 1466 .mpo_check_vnode_access = mac_test_check_vnode_access, 1467 .mpo_check_vnode_chdir = mac_test_check_vnode_chdir, 1468 .mpo_check_vnode_chroot = mac_test_check_vnode_chroot, 1469 .mpo_check_vnode_create = mac_test_check_vnode_create, 1470 .mpo_check_vnode_delete = mac_test_check_vnode_delete, 1471 .mpo_check_vnode_deleteacl = mac_test_check_vnode_deleteacl, 1472 .mpo_check_vnode_exec = mac_test_check_vnode_exec, 1473 .mpo_check_vnode_getacl = mac_test_check_vnode_getacl, 1474 .mpo_check_vnode_getextattr = mac_test_check_vnode_getextattr, 1475 .mpo_check_vnode_link = mac_test_check_vnode_link, 1476 .mpo_check_vnode_lookup = mac_test_check_vnode_lookup, 1477 .mpo_check_vnode_mmap = mac_test_check_vnode_mmap, 1478 .mpo_check_vnode_mprotect = mac_test_check_vnode_mprotect, 1479 .mpo_check_vnode_open = mac_test_check_vnode_open, 1480 .mpo_check_vnode_poll = mac_test_check_vnode_poll, 1481 .mpo_check_vnode_read = mac_test_check_vnode_read, 1482 .mpo_check_vnode_readdir = mac_test_check_vnode_readdir, 1483 .mpo_check_vnode_readlink = mac_test_check_vnode_readlink, 1484 .mpo_check_vnode_relabel = mac_test_check_vnode_relabel, 1485 .mpo_check_vnode_rename_from = mac_test_check_vnode_rename_from, 1486 .mpo_check_vnode_rename_to = mac_test_check_vnode_rename_to, 1487 .mpo_check_vnode_revoke = mac_test_check_vnode_revoke, 1488 .mpo_check_vnode_setacl = mac_test_check_vnode_setacl, 1489 .mpo_check_vnode_setextattr = mac_test_check_vnode_setextattr, 1490 .mpo_check_vnode_setflags = mac_test_check_vnode_setflags, 1491 .mpo_check_vnode_setmode = mac_test_check_vnode_setmode, 1492 .mpo_check_vnode_setowner = mac_test_check_vnode_setowner, 1493 .mpo_check_vnode_setutimes = mac_test_check_vnode_setutimes, 1494 .mpo_check_vnode_stat = mac_test_check_vnode_stat, 1495 .mpo_check_vnode_write = mac_test_check_vnode_write, 1496 }; 1497 1498 MAC_POLICY_SET(&mac_test_ops, mac_test, "TrustedBSD MAC/Test", 1499 MPC_LOADTIME_FLAG_UNLOADOK, &test_slot); 1500