1 /*- 2 * Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson 3 * Copyright (c) 2001, 2002 Networks Associates Technology, Inc. 4 * All rights reserved. 5 * 6 * This software was developed by Robert Watson for the TrustedBSD Project. 7 * 8 * This software was developed for the FreeBSD Project in part by NAI Labs, 9 * the Security Research Division of Network Associates, Inc. under 10 * DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA 11 * CHATS research program. 12 * 13 * Redistribution and use in source and binary forms, with or without 14 * modification, are permitted provided that the following conditions 15 * are met: 16 * 1. Redistributions of source code must retain the above copyright 17 * notice, this list of conditions and the following disclaimer. 18 * 2. Redistributions in binary form must reproduce the above copyright 19 * notice, this list of conditions and the following disclaimer in the 20 * documentation and/or other materials provided with the distribution. 21 * 3. The names of the authors may not be used to endorse or promote 22 * products derived from this software without specific prior written 23 * permission. 24 * 25 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 26 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 27 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 28 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 29 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 30 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 31 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 32 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 33 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 34 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 35 * SUCH DAMAGE. 36 * 37 * $FreeBSD$ 38 */ 39 40 /* 41 * Developed by the TrustedBSD Project. 42 * Generic mandatory access module that does nothing. 43 */ 44 45 #include <sys/types.h> 46 #include <sys/param.h> 47 #include <sys/acl.h> 48 #include <sys/conf.h> 49 #include <sys/kernel.h> 50 #include <sys/mac.h> 51 #include <sys/mount.h> 52 #include <sys/proc.h> 53 #include <sys/systm.h> 54 #include <sys/sysproto.h> 55 #include <sys/sysent.h> 56 #include <sys/vnode.h> 57 #include <sys/file.h> 58 #include <sys/socket.h> 59 #include <sys/socketvar.h> 60 #include <sys/sysctl.h> 61 62 #include <fs/devfs/devfs.h> 63 64 #include <net/bpfdesc.h> 65 #include <net/if.h> 66 #include <net/if_types.h> 67 #include <net/if_var.h> 68 69 #include <vm/vm.h> 70 71 #include <sys/mac_policy.h> 72 73 SYSCTL_DECL(_security_mac); 74 75 SYSCTL_NODE(_security_mac, OID_AUTO, test, CTLFLAG_RW, 0, 76 "TrustedBSD mac_test policy controls"); 77 78 static int mac_test_enabled = 0; 79 SYSCTL_INT(_security_mac_test, OID_AUTO, enabled, CTLFLAG_RW, 80 &mac_test_enabled, 0, "Enforce test policy"); 81 82 #define BPFMAGIC 0xfe1ad1b6 83 #define DEVFSMAGIC 0x9ee79c32 84 #define IFNETMAGIC 0xc218b120 85 #define IPQMAGIC 0x206188ef 86 #define MBUFMAGIC 0xbbefa5bb 87 #define MOUNTMAGIC 0xc7c46e47 88 #define SOCKETMAGIC 0x9199c6cd 89 #define PIPEMAGIC 0xdc6c9919 90 #define CREDMAGIC 0x9a5a4987 91 #define VNODEMAGIC 0x1a67a45c 92 #define EXMAGIC 0x849ba1fd 93 94 #define SLOT(x) LABEL_TO_SLOT((x), test_slot).l_long 95 static int test_slot; 96 SYSCTL_INT(_security_mac_test, OID_AUTO, slot, CTLFLAG_RD, 97 &test_slot, 0, "Slot allocated by framework"); 98 99 static int init_count_bpfdesc; 100 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_bpfdesc, CTLFLAG_RD, 101 &init_count_bpfdesc, 0, "bpfdesc init calls"); 102 static int init_count_cred; 103 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_cred, CTLFLAG_RD, 104 &init_count_cred, 0, "cred init calls"); 105 static int init_count_devfsdirent; 106 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_devfsdirent, CTLFLAG_RD, 107 &init_count_devfsdirent, 0, "devfsdirent init calls"); 108 static int init_count_ifnet; 109 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_ifnet, CTLFLAG_RD, 110 &init_count_ifnet, 0, "ifnet init calls"); 111 static int init_count_ipq; 112 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_ipq, CTLFLAG_RD, 113 &init_count_ipq, 0, "ipq init calls"); 114 static int init_count_mbuf; 115 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_mbuf, CTLFLAG_RD, 116 &init_count_mbuf, 0, "mbuf init calls"); 117 static int init_count_mount; 118 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_mount, CTLFLAG_RD, 119 &init_count_mount, 0, "mount init calls"); 120 static int init_count_mount_fslabel; 121 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_mount_fslabel, CTLFLAG_RD, 122 &init_count_mount_fslabel, 0, "mount_fslabel init calls"); 123 static int init_count_socket; 124 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_socket, CTLFLAG_RD, 125 &init_count_socket, 0, "socket init calls"); 126 static int init_count_socket_peerlabel; 127 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_socket_peerlabel, 128 CTLFLAG_RD, &init_count_socket_peerlabel, 0, 129 "socket_peerlabel init calls"); 130 static int init_count_pipe; 131 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_pipe, CTLFLAG_RD, 132 &init_count_pipe, 0, "pipe init calls"); 133 static int init_count_vnode; 134 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_vnode, CTLFLAG_RD, 135 &init_count_vnode, 0, "vnode init calls"); 136 137 static int destroy_count_bpfdesc; 138 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_bpfdesc, CTLFLAG_RD, 139 &destroy_count_bpfdesc, 0, "bpfdesc destroy calls"); 140 static int destroy_count_cred; 141 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_cred, CTLFLAG_RD, 142 &destroy_count_cred, 0, "cred destroy calls"); 143 static int destroy_count_devfsdirent; 144 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_devfsdirent, CTLFLAG_RD, 145 &destroy_count_devfsdirent, 0, "devfsdirent destroy calls"); 146 static int destroy_count_ifnet; 147 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_ifnet, CTLFLAG_RD, 148 &destroy_count_ifnet, 0, "ifnet destroy calls"); 149 static int destroy_count_ipq; 150 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_ipq, CTLFLAG_RD, 151 &destroy_count_ipq, 0, "ipq destroy calls"); 152 static int destroy_count_mbuf; 153 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_mbuf, CTLFLAG_RD, 154 &destroy_count_mbuf, 0, "mbuf destroy calls"); 155 static int destroy_count_mount; 156 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_mount, CTLFLAG_RD, 157 &destroy_count_mount, 0, "mount destroy calls"); 158 static int destroy_count_mount_fslabel; 159 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_mount_fslabel, 160 CTLFLAG_RD, &destroy_count_mount_fslabel, 0, 161 "mount_fslabel destroy calls"); 162 static int destroy_count_socket; 163 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_socket, CTLFLAG_RD, 164 &destroy_count_socket, 0, "socket destroy calls"); 165 static int destroy_count_socket_peerlabel; 166 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_socket_peerlabel, 167 CTLFLAG_RD, &destroy_count_socket_peerlabel, 0, 168 "socket_peerlabel destroy calls"); 169 static int destroy_count_pipe; 170 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_pipe, CTLFLAG_RD, 171 &destroy_count_pipe, 0, "pipe destroy calls"); 172 static int destroy_count_vnode; 173 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_vnode, CTLFLAG_RD, 174 &destroy_count_vnode, 0, "vnode destroy calls"); 175 176 static int externalize_count; 177 SYSCTL_INT(_security_mac_test, OID_AUTO, externalize_count, CTLFLAG_RD, 178 &externalize_count, 0, "Subject/object externalize calls"); 179 static int internalize_count; 180 SYSCTL_INT(_security_mac_test, OID_AUTO, internalize_count, CTLFLAG_RD, 181 &internalize_count, 0, "Subject/object internalize calls"); 182 183 /* 184 * Policy module operations. 185 */ 186 static void 187 mac_test_destroy(struct mac_policy_conf *conf) 188 { 189 190 } 191 192 static void 193 mac_test_init(struct mac_policy_conf *conf) 194 { 195 196 } 197 198 static int 199 mac_test_syscall(struct thread *td, int call, void *arg) 200 { 201 202 return (0); 203 } 204 205 /* 206 * Label operations. 207 */ 208 static void 209 mac_test_init_bpfdesc_label(struct label *label) 210 { 211 212 SLOT(label) = BPFMAGIC; 213 atomic_add_int(&init_count_bpfdesc, 1); 214 } 215 216 static void 217 mac_test_init_cred_label(struct label *label) 218 { 219 220 SLOT(label) = CREDMAGIC; 221 atomic_add_int(&init_count_cred, 1); 222 } 223 224 static void 225 mac_test_init_devfsdirent_label(struct label *label) 226 { 227 228 SLOT(label) = DEVFSMAGIC; 229 atomic_add_int(&init_count_devfsdirent, 1); 230 } 231 232 static void 233 mac_test_init_ifnet_label(struct label *label) 234 { 235 236 SLOT(label) = IFNETMAGIC; 237 atomic_add_int(&init_count_ifnet, 1); 238 } 239 240 static void 241 mac_test_init_ipq_label(struct label *label) 242 { 243 244 SLOT(label) = IPQMAGIC; 245 atomic_add_int(&init_count_ipq, 1); 246 } 247 248 static int 249 mac_test_init_mbuf_label(struct label *label, int flag) 250 { 251 252 SLOT(label) = MBUFMAGIC; 253 atomic_add_int(&init_count_mbuf, 1); 254 return (0); 255 } 256 257 static void 258 mac_test_init_mount_label(struct label *label) 259 { 260 261 SLOT(label) = MOUNTMAGIC; 262 atomic_add_int(&init_count_mount, 1); 263 } 264 265 static void 266 mac_test_init_mount_fs_label(struct label *label) 267 { 268 269 SLOT(label) = MOUNTMAGIC; 270 atomic_add_int(&init_count_mount_fslabel, 1); 271 } 272 273 static int 274 mac_test_init_socket_label(struct label *label, int flag) 275 { 276 277 SLOT(label) = SOCKETMAGIC; 278 atomic_add_int(&init_count_socket, 1); 279 return (0); 280 } 281 282 static int 283 mac_test_init_socket_peer_label(struct label *label, int flag) 284 { 285 286 SLOT(label) = SOCKETMAGIC; 287 atomic_add_int(&init_count_socket_peerlabel, 1); 288 return (0); 289 } 290 291 static void 292 mac_test_init_pipe_label(struct label *label) 293 { 294 295 SLOT(label) = PIPEMAGIC; 296 atomic_add_int(&init_count_pipe, 1); 297 } 298 299 static void 300 mac_test_init_vnode_label(struct label *label) 301 { 302 303 SLOT(label) = VNODEMAGIC; 304 atomic_add_int(&init_count_vnode, 1); 305 } 306 307 static void 308 mac_test_destroy_bpfdesc_label(struct label *label) 309 { 310 311 if (SLOT(label) == BPFMAGIC || SLOT(label) == 0) { 312 atomic_add_int(&destroy_count_bpfdesc, 1); 313 SLOT(label) = EXMAGIC; 314 } else if (SLOT(label) == EXMAGIC) { 315 Debugger("mac_test_destroy_bpfdesc: dup destroy"); 316 } else { 317 Debugger("mac_test_destroy_bpfdesc: corrupted label"); 318 } 319 } 320 321 static void 322 mac_test_destroy_cred_label(struct label *label) 323 { 324 325 if (SLOT(label) == CREDMAGIC || SLOT(label) == 0) { 326 atomic_add_int(&destroy_count_cred, 1); 327 SLOT(label) = EXMAGIC; 328 } else if (SLOT(label) == EXMAGIC) { 329 Debugger("mac_test_destroy_cred: dup destroy"); 330 } else { 331 Debugger("mac_test_destroy_cred: corrupted label"); 332 } 333 } 334 335 static void 336 mac_test_destroy_devfsdirent_label(struct label *label) 337 { 338 339 if (SLOT(label) == DEVFSMAGIC || SLOT(label) == 0) { 340 atomic_add_int(&destroy_count_devfsdirent, 1); 341 SLOT(label) = EXMAGIC; 342 } else if (SLOT(label) == EXMAGIC) { 343 Debugger("mac_test_destroy_devfsdirent: dup destroy"); 344 } else { 345 Debugger("mac_test_destroy_devfsdirent: corrupted label"); 346 } 347 } 348 349 static void 350 mac_test_destroy_ifnet_label(struct label *label) 351 { 352 353 if (SLOT(label) == IFNETMAGIC || SLOT(label) == 0) { 354 atomic_add_int(&destroy_count_ifnet, 1); 355 SLOT(label) = EXMAGIC; 356 } else if (SLOT(label) == EXMAGIC) { 357 Debugger("mac_test_destroy_ifnet: dup destroy"); 358 } else { 359 Debugger("mac_test_destroy_ifnet: corrupted label"); 360 } 361 } 362 363 static void 364 mac_test_destroy_ipq_label(struct label *label) 365 { 366 367 if (SLOT(label) == IPQMAGIC || SLOT(label) == 0) { 368 atomic_add_int(&destroy_count_ipq, 1); 369 SLOT(label) = EXMAGIC; 370 } else if (SLOT(label) == EXMAGIC) { 371 Debugger("mac_test_destroy_ipq: dup destroy"); 372 } else { 373 Debugger("mac_test_destroy_ipq: corrupted label"); 374 } 375 } 376 377 static void 378 mac_test_destroy_mbuf_label(struct label *label) 379 { 380 381 if (SLOT(label) == MBUFMAGIC || SLOT(label) == 0) { 382 atomic_add_int(&destroy_count_mbuf, 1); 383 SLOT(label) = EXMAGIC; 384 } else if (SLOT(label) == EXMAGIC) { 385 Debugger("mac_test_destroy_mbuf: dup destroy"); 386 } else { 387 Debugger("mac_test_destroy_mbuf: corrupted label"); 388 } 389 } 390 391 static void 392 mac_test_destroy_mount_label(struct label *label) 393 { 394 395 if ((SLOT(label) == MOUNTMAGIC || SLOT(label) == 0)) { 396 atomic_add_int(&destroy_count_mount, 1); 397 SLOT(label) = EXMAGIC; 398 } else if (SLOT(label) == EXMAGIC) { 399 Debugger("mac_test_destroy_mount: dup destroy"); 400 } else { 401 Debugger("mac_test_destroy_mount: corrupted label"); 402 } 403 } 404 405 static void 406 mac_test_destroy_mount_fs_label(struct label *label) 407 { 408 409 if ((SLOT(label) == MOUNTMAGIC || SLOT(label) == 0)) { 410 atomic_add_int(&destroy_count_mount_fslabel, 1); 411 SLOT(label) = EXMAGIC; 412 } else if (SLOT(label) == EXMAGIC) { 413 Debugger("mac_test_destroy_mount_fslabel: dup destroy"); 414 } else { 415 Debugger("mac_test_destroy_mount_fslabel: corrupted label"); 416 } 417 } 418 419 static void 420 mac_test_destroy_socket_label(struct label *label) 421 { 422 423 if ((SLOT(label) == SOCKETMAGIC || SLOT(label) == 0)) { 424 atomic_add_int(&destroy_count_socket, 1); 425 SLOT(label) = EXMAGIC; 426 } else if (SLOT(label) == EXMAGIC) { 427 Debugger("mac_test_destroy_socket: dup destroy"); 428 } else { 429 Debugger("mac_test_destroy_socket: corrupted label"); 430 } 431 } 432 433 static void 434 mac_test_destroy_socket_peer_label(struct label *label) 435 { 436 437 if ((SLOT(label) == SOCKETMAGIC || SLOT(label) == 0)) { 438 atomic_add_int(&destroy_count_socket_peerlabel, 1); 439 SLOT(label) = EXMAGIC; 440 } else if (SLOT(label) == EXMAGIC) { 441 Debugger("mac_test_destroy_socket_peerlabel: dup destroy"); 442 } else { 443 Debugger("mac_test_destroy_socket_peerlabel: corrupted label"); 444 } 445 } 446 447 static void 448 mac_test_destroy_pipe_label(struct label *label) 449 { 450 451 if ((SLOT(label) == PIPEMAGIC || SLOT(label) == 0)) { 452 atomic_add_int(&destroy_count_pipe, 1); 453 SLOT(label) = EXMAGIC; 454 } else if (SLOT(label) == EXMAGIC) { 455 Debugger("mac_test_destroy_pipe: dup destroy"); 456 } else { 457 Debugger("mac_test_destroy_pipe: corrupted label"); 458 } 459 } 460 461 static void 462 mac_test_destroy_vnode_label(struct label *label) 463 { 464 465 if (SLOT(label) == VNODEMAGIC || SLOT(label) == 0) { 466 atomic_add_int(&destroy_count_vnode, 1); 467 SLOT(label) = EXMAGIC; 468 } else if (SLOT(label) == EXMAGIC) { 469 Debugger("mac_test_destroy_vnode: dup destroy"); 470 } else { 471 Debugger("mac_test_destroy_vnode: corrupted label"); 472 } 473 } 474 475 static int 476 mac_test_externalize_label(struct label *label, char *element_name, 477 char *element_data, size_t size, size_t *len, int *claimed) 478 { 479 480 atomic_add_int(&externalize_count, 1); 481 482 return (0); 483 } 484 485 static int 486 mac_test_externalize_vnode_oldmac(struct label *label, struct oldmac *extmac) 487 { 488 489 atomic_add_int(&externalize_count, 1); 490 491 return (0); 492 } 493 494 static int 495 mac_test_internalize_label(struct label *label, struct mac *mac, 496 char *element_name, char *element_data, int *claimed) 497 { 498 499 atomic_add_int(&internalize_count, 1); 500 501 return (0); 502 } 503 504 /* 505 * Labeling event operations: file system objects, and things that look 506 * a lot like file system objects. 507 */ 508 static void 509 mac_test_create_devfs_device(dev_t dev, struct devfs_dirent *devfs_dirent, 510 struct label *label) 511 { 512 513 } 514 515 static void 516 mac_test_create_devfs_directory(char *dirname, int dirnamelen, 517 struct devfs_dirent *devfs_dirent, struct label *label) 518 { 519 520 } 521 522 static void 523 mac_test_create_devfs_symlink(struct ucred *cred, struct devfs_dirent *dd, 524 struct label *ddlabel, struct devfs_dirent *de, struct label *delabel) 525 { 526 527 } 528 529 static void 530 mac_test_create_devfs_vnode(struct devfs_dirent *devfs_dirent, 531 struct label *direntlabel, struct vnode *vp, struct label *vnodelabel) 532 { 533 534 } 535 536 static void 537 mac_test_create_vnode(struct ucred *cred, struct vnode *parent, 538 struct label *parentlabel, struct vnode *child, struct label *childlabel) 539 { 540 541 } 542 543 static void 544 mac_test_create_mount(struct ucred *cred, struct mount *mp, 545 struct label *mntlabel, struct label *fslabel) 546 { 547 548 } 549 550 static void 551 mac_test_create_root_mount(struct ucred *cred, struct mount *mp, 552 struct label *mntlabel, struct label *fslabel) 553 { 554 555 } 556 557 static void 558 mac_test_relabel_vnode(struct ucred *cred, struct vnode *vp, 559 struct label *vnodelabel, struct label *label) 560 { 561 562 } 563 564 static void 565 mac_test_update_devfsdirent(struct devfs_dirent *devfs_dirent, 566 struct vnode *vp) 567 { 568 569 } 570 571 static void 572 mac_test_update_procfsvnode(struct vnode *vp, struct label *vnodelabel, 573 struct ucred *cred) 574 { 575 576 } 577 578 static int 579 mac_test_update_vnode_from_externalized(struct vnode *vp, 580 struct label *vnodelabel, struct mac *extmac) 581 { 582 583 return (0); 584 } 585 586 static void 587 mac_test_update_vnode_from_mount(struct vnode *vp, struct label *vnodelabel, 588 struct mount *mp, struct label *fslabel) 589 { 590 591 } 592 593 /* 594 * Labeling event operations: IPC object. 595 */ 596 static void 597 mac_test_create_mbuf_from_socket(struct socket *so, struct label *socketlabel, 598 struct mbuf *m, struct label *mbuflabel) 599 { 600 601 } 602 603 static void 604 mac_test_create_socket(struct ucred *cred, struct socket *socket, 605 struct label *socketlabel) 606 { 607 608 } 609 610 static void 611 mac_test_create_pipe(struct ucred *cred, struct pipe *pipe, 612 struct label *pipelabel) 613 { 614 615 } 616 617 static void 618 mac_test_create_socket_from_socket(struct socket *oldsocket, 619 struct label *oldsocketlabel, struct socket *newsocket, 620 struct label *newsocketlabel) 621 { 622 623 } 624 625 static void 626 mac_test_relabel_socket(struct ucred *cred, struct socket *socket, 627 struct label *socketlabel, struct label *newlabel) 628 { 629 630 } 631 632 static void 633 mac_test_relabel_pipe(struct ucred *cred, struct pipe *pipe, 634 struct label *pipelabel, struct label *newlabel) 635 { 636 637 } 638 639 static void 640 mac_test_set_socket_peer_from_mbuf(struct mbuf *mbuf, struct label *mbuflabel, 641 struct socket *socket, struct label *socketpeerlabel) 642 { 643 644 } 645 646 /* 647 * Labeling event operations: network objects. 648 */ 649 static void 650 mac_test_set_socket_peer_from_socket(struct socket *oldsocket, 651 struct label *oldsocketlabel, struct socket *newsocket, 652 struct label *newsocketpeerlabel) 653 { 654 655 } 656 657 static void 658 mac_test_create_bpfdesc(struct ucred *cred, struct bpf_d *bpf_d, 659 struct label *bpflabel) 660 { 661 662 } 663 664 static void 665 mac_test_create_datagram_from_ipq(struct ipq *ipq, struct label *ipqlabel, 666 struct mbuf *datagram, struct label *datagramlabel) 667 { 668 669 } 670 671 static void 672 mac_test_create_fragment(struct mbuf *datagram, struct label *datagramlabel, 673 struct mbuf *fragment, struct label *fragmentlabel) 674 { 675 676 } 677 678 static void 679 mac_test_create_ifnet(struct ifnet *ifnet, struct label *ifnetlabel) 680 { 681 682 } 683 684 static void 685 mac_test_create_ipq(struct mbuf *fragment, struct label *fragmentlabel, 686 struct ipq *ipq, struct label *ipqlabel) 687 { 688 689 } 690 691 static void 692 mac_test_create_mbuf_from_mbuf(struct mbuf *oldmbuf, 693 struct label *oldmbuflabel, struct mbuf *newmbuf, 694 struct label *newmbuflabel) 695 { 696 697 } 698 699 static void 700 mac_test_create_mbuf_linklayer(struct ifnet *ifnet, struct label *ifnetlabel, 701 struct mbuf *mbuf, struct label *mbuflabel) 702 { 703 704 } 705 706 static void 707 mac_test_create_mbuf_from_bpfdesc(struct bpf_d *bpf_d, struct label *bpflabel, 708 struct mbuf *mbuf, struct label *mbuflabel) 709 { 710 711 } 712 713 static void 714 mac_test_create_mbuf_from_ifnet(struct ifnet *ifnet, struct label *ifnetlabel, 715 struct mbuf *m, struct label *mbuflabel) 716 { 717 718 } 719 720 static void 721 mac_test_create_mbuf_multicast_encap(struct mbuf *oldmbuf, 722 struct label *oldmbuflabel, struct ifnet *ifnet, struct label *ifnetlabel, 723 struct mbuf *newmbuf, struct label *newmbuflabel) 724 { 725 726 } 727 728 static void 729 mac_test_create_mbuf_netlayer(struct mbuf *oldmbuf, 730 struct label *oldmbuflabel, struct mbuf *newmbuf, 731 struct label *newmbuflabel) 732 { 733 734 } 735 736 static int 737 mac_test_fragment_match(struct mbuf *fragment, struct label *fragmentlabel, 738 struct ipq *ipq, struct label *ipqlabel) 739 { 740 741 return (1); 742 } 743 744 static void 745 mac_test_relabel_ifnet(struct ucred *cred, struct ifnet *ifnet, 746 struct label *ifnetlabel, struct label *newlabel) 747 { 748 749 } 750 751 static void 752 mac_test_update_ipq(struct mbuf *fragment, struct label *fragmentlabel, 753 struct ipq *ipq, struct label *ipqlabel) 754 { 755 756 } 757 758 /* 759 * Labeling event operations: processes. 760 */ 761 static void 762 mac_test_create_cred(struct ucred *cred_parent, struct ucred *cred_child) 763 { 764 765 } 766 767 static void 768 mac_test_execve_transition(struct ucred *old, struct ucred *new, 769 struct vnode *vp, struct label *filelabel) 770 { 771 772 } 773 774 static int 775 mac_test_execve_will_transition(struct ucred *old, struct vnode *vp, 776 struct label *filelabel) 777 { 778 779 return (0); 780 } 781 782 static void 783 mac_test_create_proc0(struct ucred *cred) 784 { 785 786 } 787 788 static void 789 mac_test_create_proc1(struct ucred *cred) 790 { 791 792 } 793 794 static void 795 mac_test_relabel_cred(struct ucred *cred, struct label *newlabel) 796 { 797 798 } 799 800 /* 801 * Access control checks. 802 */ 803 static int 804 mac_test_check_bpfdesc_receive(struct bpf_d *bpf_d, struct label *bpflabel, 805 struct ifnet *ifnet, struct label *ifnetlabel) 806 { 807 808 return (0); 809 } 810 811 static int 812 mac_test_check_cred_relabel(struct ucred *cred, struct label *newlabel) 813 { 814 815 return (0); 816 } 817 818 static int 819 mac_test_check_cred_visible(struct ucred *u1, struct ucred *u2) 820 { 821 822 return (0); 823 } 824 825 static int 826 mac_test_check_ifnet_relabel(struct ucred *cred, struct ifnet *ifnet, 827 struct label *ifnetlabel, struct label *newlabel) 828 { 829 830 return (0); 831 } 832 833 static int 834 mac_test_check_ifnet_transmit(struct ifnet *ifnet, struct label *ifnetlabel, 835 struct mbuf *m, struct label *mbuflabel) 836 { 837 838 return (0); 839 } 840 841 static int 842 mac_test_check_mount_stat(struct ucred *cred, struct mount *mp, 843 struct label *mntlabel) 844 { 845 846 return (0); 847 } 848 849 static int 850 mac_test_check_pipe_ioctl(struct ucred *cred, struct pipe *pipe, 851 struct label *pipelabel, unsigned long cmd, void /* caddr_t */ *data) 852 { 853 854 return (0); 855 } 856 857 static int 858 mac_test_check_pipe_poll(struct ucred *cred, struct pipe *pipe, 859 struct label *pipelabel) 860 { 861 862 return (0); 863 } 864 865 static int 866 mac_test_check_pipe_read(struct ucred *cred, struct pipe *pipe, 867 struct label *pipelabel) 868 { 869 870 return (0); 871 } 872 873 static int 874 mac_test_check_pipe_relabel(struct ucred *cred, struct pipe *pipe, 875 struct label *pipelabel, struct label *newlabel) 876 { 877 878 return (0); 879 } 880 881 static int 882 mac_test_check_pipe_stat(struct ucred *cred, struct pipe *pipe, 883 struct label *pipelabel) 884 { 885 886 return (0); 887 } 888 889 static int 890 mac_test_check_pipe_write(struct ucred *cred, struct pipe *pipe, 891 struct label *pipelabel) 892 { 893 894 return (0); 895 } 896 897 static int 898 mac_test_check_proc_debug(struct ucred *cred, struct proc *proc) 899 { 900 901 return (0); 902 } 903 904 static int 905 mac_test_check_proc_sched(struct ucred *cred, struct proc *proc) 906 { 907 908 return (0); 909 } 910 911 static int 912 mac_test_check_proc_signal(struct ucred *cred, struct proc *proc) 913 { 914 915 return (0); 916 } 917 918 static int 919 mac_test_check_socket_bind(struct ucred *cred, struct socket *socket, 920 struct label *socketlabel, struct sockaddr *sockaddr) 921 { 922 923 return (0); 924 } 925 926 static int 927 mac_test_check_socket_connect(struct ucred *cred, struct socket *socket, 928 struct label *socketlabel, struct sockaddr *sockaddr) 929 { 930 931 return (0); 932 } 933 934 static int 935 mac_test_check_socket_deliver(struct socket *socket, struct label *socketlabel, 936 struct mbuf *m, struct label *mbuflabel) 937 { 938 939 return (0); 940 } 941 942 static int 943 mac_test_check_socket_listen(struct ucred *cred, struct socket *socket, 944 struct label *socketlabel, struct sockaddr *sockaddr) 945 { 946 947 return (0); 948 } 949 950 static int 951 mac_test_check_socket_visible(struct ucred *cred, struct socket *socket, 952 struct label *socketlabel) 953 { 954 955 return (0); 956 } 957 958 static int 959 mac_test_check_socket_relabel(struct ucred *cred, struct socket *socket, 960 struct label *socketlabel, struct label *newlabel) 961 { 962 963 return (0); 964 } 965 966 static int 967 mac_test_check_vnode_access(struct ucred *cred, struct vnode *vp, 968 struct label *label, mode_t flags) 969 { 970 971 return (0); 972 } 973 974 static int 975 mac_test_check_vnode_chdir(struct ucred *cred, struct vnode *dvp, 976 struct label *dlabel) 977 { 978 979 return (0); 980 } 981 982 static int 983 mac_test_check_vnode_chroot(struct ucred *cred, struct vnode *dvp, 984 struct label *dlabel) 985 { 986 987 return (0); 988 } 989 990 static int 991 mac_test_check_vnode_create(struct ucred *cred, struct vnode *dvp, 992 struct label *dlabel, struct componentname *cnp, struct vattr *vap) 993 { 994 995 return (0); 996 } 997 998 static int 999 mac_test_check_vnode_delete(struct ucred *cred, struct vnode *dvp, 1000 struct label *dlabel, struct vnode *vp, struct label *label, 1001 struct componentname *cnp) 1002 { 1003 1004 return (0); 1005 } 1006 1007 static int 1008 mac_test_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp, 1009 struct label *label, acl_type_t type) 1010 { 1011 1012 return (0); 1013 } 1014 1015 static int 1016 mac_test_check_vnode_exec(struct ucred *cred, struct vnode *vp, 1017 struct label *label) 1018 { 1019 1020 return (0); 1021 } 1022 1023 static int 1024 mac_test_check_vnode_getacl(struct ucred *cred, struct vnode *vp, 1025 struct label *label, acl_type_t type) 1026 { 1027 1028 return (0); 1029 } 1030 1031 static int 1032 mac_test_check_vnode_getextattr(struct ucred *cred, struct vnode *vp, 1033 struct label *label, int attrnamespace, const char *name, struct uio *uio) 1034 { 1035 1036 return (0); 1037 } 1038 1039 static int 1040 mac_test_check_vnode_link(struct ucred *cred, struct vnode *dvp, 1041 struct label *dlabel, struct vnode *vp, struct label *label, 1042 struct componentname *cnp) 1043 { 1044 1045 return (0); 1046 } 1047 1048 static int 1049 mac_test_check_vnode_lookup(struct ucred *cred, struct vnode *dvp, 1050 struct label *dlabel, struct componentname *cnp) 1051 { 1052 1053 return (0); 1054 } 1055 1056 static int 1057 mac_test_check_vnode_mmap(struct ucred *cred, struct vnode *vp, 1058 struct label *label, int prot) 1059 { 1060 1061 return (0); 1062 } 1063 1064 static int 1065 mac_test_check_vnode_mprotect(struct ucred *cred, struct vnode *vp, 1066 struct label *label, int prot) 1067 { 1068 1069 return (0); 1070 } 1071 1072 static int 1073 mac_test_check_vnode_open(struct ucred *cred, struct vnode *vp, 1074 struct label *filelabel, mode_t acc_mode) 1075 { 1076 1077 return (0); 1078 } 1079 1080 static int 1081 mac_test_check_vnode_poll(struct ucred *active_cred, struct ucred *file_cred, 1082 struct vnode *vp, struct label *label) 1083 { 1084 1085 return (0); 1086 } 1087 1088 static int 1089 mac_test_check_vnode_read(struct ucred *active_cred, struct ucred *file_cred, 1090 struct vnode *vp, struct label *label) 1091 { 1092 1093 return (0); 1094 } 1095 1096 static int 1097 mac_test_check_vnode_readdir(struct ucred *cred, struct vnode *dvp, 1098 struct label *dlabel) 1099 { 1100 1101 return (0); 1102 } 1103 1104 static int 1105 mac_test_check_vnode_readlink(struct ucred *cred, struct vnode *vp, 1106 struct label *vnodelabel) 1107 { 1108 1109 return (0); 1110 } 1111 1112 static int 1113 mac_test_check_vnode_relabel(struct ucred *cred, struct vnode *vp, 1114 struct label *vnodelabel, struct label *newlabel) 1115 { 1116 1117 return (0); 1118 } 1119 1120 static int 1121 mac_test_check_vnode_rename_from(struct ucred *cred, struct vnode *dvp, 1122 struct label *dlabel, struct vnode *vp, struct label *label, 1123 struct componentname *cnp) 1124 { 1125 1126 return (0); 1127 } 1128 1129 static int 1130 mac_test_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp, 1131 struct label *dlabel, struct vnode *vp, struct label *label, int samedir, 1132 struct componentname *cnp) 1133 { 1134 1135 return (0); 1136 } 1137 1138 static int 1139 mac_test_check_vnode_revoke(struct ucred *cred, struct vnode *vp, 1140 struct label *label) 1141 { 1142 1143 return (0); 1144 } 1145 1146 static int 1147 mac_test_check_vnode_setacl(struct ucred *cred, struct vnode *vp, 1148 struct label *label, acl_type_t type, struct acl *acl) 1149 { 1150 1151 return (0); 1152 } 1153 1154 static int 1155 mac_test_check_vnode_setextattr(struct ucred *cred, struct vnode *vp, 1156 struct label *label, int attrnamespace, const char *name, struct uio *uio) 1157 { 1158 1159 return (0); 1160 } 1161 1162 static int 1163 mac_test_check_vnode_setflags(struct ucred *cred, struct vnode *vp, 1164 struct label *label, u_long flags) 1165 { 1166 1167 return (0); 1168 } 1169 1170 static int 1171 mac_test_check_vnode_setmode(struct ucred *cred, struct vnode *vp, 1172 struct label *label, mode_t mode) 1173 { 1174 1175 return (0); 1176 } 1177 1178 static int 1179 mac_test_check_vnode_setowner(struct ucred *cred, struct vnode *vp, 1180 struct label *label, uid_t uid, gid_t gid) 1181 { 1182 1183 return (0); 1184 } 1185 1186 static int 1187 mac_test_check_vnode_setutimes(struct ucred *cred, struct vnode *vp, 1188 struct label *label, struct timespec atime, struct timespec mtime) 1189 { 1190 1191 return (0); 1192 } 1193 1194 static int 1195 mac_test_check_vnode_stat(struct ucred *active_cred, struct ucred *file_cred, 1196 struct vnode *vp, struct label *label) 1197 { 1198 1199 return (0); 1200 } 1201 1202 static int 1203 mac_test_check_vnode_write(struct ucred *active_cred, 1204 struct ucred *file_cred, struct vnode *vp, struct label *label) 1205 { 1206 1207 return (0); 1208 } 1209 1210 static struct mac_policy_op_entry mac_test_ops[] = 1211 { 1212 { MAC_DESTROY, 1213 (macop_t)mac_test_destroy }, 1214 { MAC_INIT, 1215 (macop_t)mac_test_init }, 1216 { MAC_SYSCALL, 1217 (macop_t)mac_test_syscall }, 1218 { MAC_INIT_BPFDESC_LABEL, 1219 (macop_t)mac_test_init_bpfdesc_label }, 1220 { MAC_INIT_CRED_LABEL, 1221 (macop_t)mac_test_init_cred_label }, 1222 { MAC_INIT_DEVFSDIRENT_LABEL, 1223 (macop_t)mac_test_init_devfsdirent_label }, 1224 { MAC_INIT_IFNET_LABEL, 1225 (macop_t)mac_test_init_ifnet_label }, 1226 { MAC_INIT_IPQ_LABEL, 1227 (macop_t)mac_test_init_ipq_label }, 1228 { MAC_INIT_MBUF_LABEL, 1229 (macop_t)mac_test_init_mbuf_label }, 1230 { MAC_INIT_MOUNT_LABEL, 1231 (macop_t)mac_test_init_mount_label }, 1232 { MAC_INIT_MOUNT_FS_LABEL, 1233 (macop_t)mac_test_init_mount_fs_label }, 1234 { MAC_INIT_PIPE_LABEL, 1235 (macop_t)mac_test_init_pipe_label }, 1236 { MAC_INIT_SOCKET_LABEL, 1237 (macop_t)mac_test_init_socket_label }, 1238 { MAC_INIT_SOCKET_PEER_LABEL, 1239 (macop_t)mac_test_init_socket_peer_label }, 1240 { MAC_INIT_VNODE_LABEL, 1241 (macop_t)mac_test_init_vnode_label }, 1242 { MAC_DESTROY_BPFDESC_LABEL, 1243 (macop_t)mac_test_destroy_bpfdesc_label }, 1244 { MAC_DESTROY_CRED_LABEL, 1245 (macop_t)mac_test_destroy_cred_label }, 1246 { MAC_DESTROY_DEVFSDIRENT_LABEL, 1247 (macop_t)mac_test_destroy_devfsdirent_label }, 1248 { MAC_DESTROY_IFNET_LABEL, 1249 (macop_t)mac_test_destroy_ifnet_label }, 1250 { MAC_DESTROY_IPQ_LABEL, 1251 (macop_t)mac_test_destroy_ipq_label }, 1252 { MAC_DESTROY_MBUF_LABEL, 1253 (macop_t)mac_test_destroy_mbuf_label }, 1254 { MAC_DESTROY_MOUNT_LABEL, 1255 (macop_t)mac_test_destroy_mount_label }, 1256 { MAC_DESTROY_MOUNT_FS_LABEL, 1257 (macop_t)mac_test_destroy_mount_fs_label }, 1258 { MAC_DESTROY_PIPE_LABEL, 1259 (macop_t)mac_test_destroy_pipe_label }, 1260 { MAC_DESTROY_SOCKET_LABEL, 1261 (macop_t)mac_test_destroy_socket_label }, 1262 { MAC_DESTROY_SOCKET_PEER_LABEL, 1263 (macop_t)mac_test_destroy_socket_peer_label }, 1264 { MAC_DESTROY_VNODE_LABEL, 1265 (macop_t)mac_test_destroy_vnode_label }, 1266 { MAC_EXTERNALIZE_CRED_LABEL, 1267 (macop_t)mac_test_externalize_label }, 1268 { MAC_EXTERNALIZE_IFNET_LABEL, 1269 (macop_t)mac_test_externalize_label }, 1270 { MAC_EXTERNALIZE_PIPE_LABEL, 1271 (macop_t)mac_test_externalize_label }, 1272 { MAC_EXTERNALIZE_SOCKET_LABEL, 1273 (macop_t)mac_test_externalize_label }, 1274 { MAC_EXTERNALIZE_SOCKET_PEER_LABEL, 1275 (macop_t)mac_test_externalize_label }, 1276 { MAC_EXTERNALIZE_VNODE_LABEL, 1277 (macop_t)mac_test_externalize_label }, 1278 { MAC_EXTERNALIZE_VNODE_OLDMAC, 1279 (macop_t)mac_test_externalize_vnode_oldmac }, 1280 { MAC_INTERNALIZE_CRED_LABEL, 1281 (macop_t)mac_test_internalize_label }, 1282 { MAC_INTERNALIZE_IFNET_LABEL, 1283 (macop_t)mac_test_internalize_label }, 1284 { MAC_INTERNALIZE_PIPE_LABEL, 1285 (macop_t)mac_test_internalize_label }, 1286 { MAC_INTERNALIZE_SOCKET_LABEL, 1287 (macop_t)mac_test_internalize_label }, 1288 { MAC_INTERNALIZE_VNODE_LABEL, 1289 (macop_t)mac_test_internalize_label }, 1290 { MAC_CREATE_DEVFS_DEVICE, 1291 (macop_t)mac_test_create_devfs_device }, 1292 { MAC_CREATE_DEVFS_DIRECTORY, 1293 (macop_t)mac_test_create_devfs_directory }, 1294 { MAC_CREATE_DEVFS_SYMLINK, 1295 (macop_t)mac_test_create_devfs_symlink }, 1296 { MAC_CREATE_DEVFS_VNODE, 1297 (macop_t)mac_test_create_devfs_vnode }, 1298 { MAC_CREATE_VNODE, 1299 (macop_t)mac_test_create_vnode }, 1300 { MAC_CREATE_MOUNT, 1301 (macop_t)mac_test_create_mount }, 1302 { MAC_CREATE_ROOT_MOUNT, 1303 (macop_t)mac_test_create_root_mount }, 1304 { MAC_RELABEL_VNODE, 1305 (macop_t)mac_test_relabel_vnode }, 1306 { MAC_UPDATE_DEVFSDIRENT, 1307 (macop_t)mac_test_update_devfsdirent }, 1308 { MAC_UPDATE_PROCFSVNODE, 1309 (macop_t)mac_test_update_procfsvnode }, 1310 { MAC_UPDATE_VNODE_FROM_EXTERNALIZED, 1311 (macop_t)mac_test_update_vnode_from_externalized }, 1312 { MAC_UPDATE_VNODE_FROM_MOUNT, 1313 (macop_t)mac_test_update_vnode_from_mount }, 1314 { MAC_CREATE_MBUF_FROM_SOCKET, 1315 (macop_t)mac_test_create_mbuf_from_socket }, 1316 { MAC_CREATE_PIPE, 1317 (macop_t)mac_test_create_pipe }, 1318 { MAC_CREATE_SOCKET, 1319 (macop_t)mac_test_create_socket }, 1320 { MAC_CREATE_SOCKET_FROM_SOCKET, 1321 (macop_t)mac_test_create_socket_from_socket }, 1322 { MAC_RELABEL_PIPE, 1323 (macop_t)mac_test_relabel_pipe }, 1324 { MAC_RELABEL_SOCKET, 1325 (macop_t)mac_test_relabel_socket }, 1326 { MAC_SET_SOCKET_PEER_FROM_MBUF, 1327 (macop_t)mac_test_set_socket_peer_from_mbuf }, 1328 { MAC_SET_SOCKET_PEER_FROM_SOCKET, 1329 (macop_t)mac_test_set_socket_peer_from_socket }, 1330 { MAC_CREATE_BPFDESC, 1331 (macop_t)mac_test_create_bpfdesc }, 1332 { MAC_CREATE_IFNET, 1333 (macop_t)mac_test_create_ifnet }, 1334 { MAC_CREATE_DATAGRAM_FROM_IPQ, 1335 (macop_t)mac_test_create_datagram_from_ipq }, 1336 { MAC_CREATE_FRAGMENT, 1337 (macop_t)mac_test_create_fragment }, 1338 { MAC_CREATE_IPQ, 1339 (macop_t)mac_test_create_ipq }, 1340 { MAC_CREATE_MBUF_FROM_MBUF, 1341 (macop_t)mac_test_create_mbuf_from_mbuf }, 1342 { MAC_CREATE_MBUF_LINKLAYER, 1343 (macop_t)mac_test_create_mbuf_linklayer }, 1344 { MAC_CREATE_MBUF_FROM_BPFDESC, 1345 (macop_t)mac_test_create_mbuf_from_bpfdesc }, 1346 { MAC_CREATE_MBUF_FROM_IFNET, 1347 (macop_t)mac_test_create_mbuf_from_ifnet }, 1348 { MAC_CREATE_MBUF_MULTICAST_ENCAP, 1349 (macop_t)mac_test_create_mbuf_multicast_encap }, 1350 { MAC_CREATE_MBUF_NETLAYER, 1351 (macop_t)mac_test_create_mbuf_netlayer }, 1352 { MAC_FRAGMENT_MATCH, 1353 (macop_t)mac_test_fragment_match }, 1354 { MAC_RELABEL_IFNET, 1355 (macop_t)mac_test_relabel_ifnet }, 1356 { MAC_UPDATE_IPQ, 1357 (macop_t)mac_test_update_ipq }, 1358 { MAC_CREATE_CRED, 1359 (macop_t)mac_test_create_cred }, 1360 { MAC_EXECVE_TRANSITION, 1361 (macop_t)mac_test_execve_transition }, 1362 { MAC_EXECVE_WILL_TRANSITION, 1363 (macop_t)mac_test_execve_will_transition }, 1364 { MAC_CREATE_PROC0, 1365 (macop_t)mac_test_create_proc0 }, 1366 { MAC_CREATE_PROC1, 1367 (macop_t)mac_test_create_proc1 }, 1368 { MAC_RELABEL_CRED, 1369 (macop_t)mac_test_relabel_cred }, 1370 { MAC_CHECK_BPFDESC_RECEIVE, 1371 (macop_t)mac_test_check_bpfdesc_receive }, 1372 { MAC_CHECK_CRED_RELABEL, 1373 (macop_t)mac_test_check_cred_relabel }, 1374 { MAC_CHECK_CRED_VISIBLE, 1375 (macop_t)mac_test_check_cred_visible }, 1376 { MAC_CHECK_IFNET_RELABEL, 1377 (macop_t)mac_test_check_ifnet_relabel }, 1378 { MAC_CHECK_IFNET_TRANSMIT, 1379 (macop_t)mac_test_check_ifnet_transmit }, 1380 { MAC_CHECK_MOUNT_STAT, 1381 (macop_t)mac_test_check_mount_stat }, 1382 { MAC_CHECK_PIPE_IOCTL, 1383 (macop_t)mac_test_check_pipe_ioctl }, 1384 { MAC_CHECK_PIPE_POLL, 1385 (macop_t)mac_test_check_pipe_poll }, 1386 { MAC_CHECK_PIPE_READ, 1387 (macop_t)mac_test_check_pipe_read }, 1388 { MAC_CHECK_PIPE_RELABEL, 1389 (macop_t)mac_test_check_pipe_relabel }, 1390 { MAC_CHECK_PIPE_STAT, 1391 (macop_t)mac_test_check_pipe_stat }, 1392 { MAC_CHECK_PIPE_WRITE, 1393 (macop_t)mac_test_check_pipe_write }, 1394 { MAC_CHECK_PROC_DEBUG, 1395 (macop_t)mac_test_check_proc_debug }, 1396 { MAC_CHECK_PROC_SCHED, 1397 (macop_t)mac_test_check_proc_sched }, 1398 { MAC_CHECK_PROC_SIGNAL, 1399 (macop_t)mac_test_check_proc_signal }, 1400 { MAC_CHECK_SOCKET_BIND, 1401 (macop_t)mac_test_check_socket_bind }, 1402 { MAC_CHECK_SOCKET_CONNECT, 1403 (macop_t)mac_test_check_socket_connect }, 1404 { MAC_CHECK_SOCKET_DELIVER, 1405 (macop_t)mac_test_check_socket_deliver }, 1406 { MAC_CHECK_SOCKET_LISTEN, 1407 (macop_t)mac_test_check_socket_listen }, 1408 { MAC_CHECK_SOCKET_RELABEL, 1409 (macop_t)mac_test_check_socket_relabel }, 1410 { MAC_CHECK_SOCKET_VISIBLE, 1411 (macop_t)mac_test_check_socket_visible }, 1412 { MAC_CHECK_VNODE_ACCESS, 1413 (macop_t)mac_test_check_vnode_access }, 1414 { MAC_CHECK_VNODE_CHDIR, 1415 (macop_t)mac_test_check_vnode_chdir }, 1416 { MAC_CHECK_VNODE_CHROOT, 1417 (macop_t)mac_test_check_vnode_chroot }, 1418 { MAC_CHECK_VNODE_CREATE, 1419 (macop_t)mac_test_check_vnode_create }, 1420 { MAC_CHECK_VNODE_DELETE, 1421 (macop_t)mac_test_check_vnode_delete }, 1422 { MAC_CHECK_VNODE_DELETEACL, 1423 (macop_t)mac_test_check_vnode_deleteacl }, 1424 { MAC_CHECK_VNODE_EXEC, 1425 (macop_t)mac_test_check_vnode_exec }, 1426 { MAC_CHECK_VNODE_GETACL, 1427 (macop_t)mac_test_check_vnode_getacl }, 1428 { MAC_CHECK_VNODE_GETEXTATTR, 1429 (macop_t)mac_test_check_vnode_getextattr }, 1430 { MAC_CHECK_VNODE_LINK, 1431 (macop_t)mac_test_check_vnode_link }, 1432 { MAC_CHECK_VNODE_LOOKUP, 1433 (macop_t)mac_test_check_vnode_lookup }, 1434 { MAC_CHECK_VNODE_MMAP, 1435 (macop_t)mac_test_check_vnode_mmap }, 1436 { MAC_CHECK_VNODE_MPROTECT, 1437 (macop_t)mac_test_check_vnode_mprotect }, 1438 { MAC_CHECK_VNODE_OPEN, 1439 (macop_t)mac_test_check_vnode_open }, 1440 { MAC_CHECK_VNODE_POLL, 1441 (macop_t)mac_test_check_vnode_poll }, 1442 { MAC_CHECK_VNODE_READ, 1443 (macop_t)mac_test_check_vnode_read }, 1444 { MAC_CHECK_VNODE_READDIR, 1445 (macop_t)mac_test_check_vnode_readdir }, 1446 { MAC_CHECK_VNODE_READLINK, 1447 (macop_t)mac_test_check_vnode_readlink }, 1448 { MAC_CHECK_VNODE_RELABEL, 1449 (macop_t)mac_test_check_vnode_relabel }, 1450 { MAC_CHECK_VNODE_RENAME_FROM, 1451 (macop_t)mac_test_check_vnode_rename_from }, 1452 { MAC_CHECK_VNODE_RENAME_TO, 1453 (macop_t)mac_test_check_vnode_rename_to }, 1454 { MAC_CHECK_VNODE_REVOKE, 1455 (macop_t)mac_test_check_vnode_revoke }, 1456 { MAC_CHECK_VNODE_SETACL, 1457 (macop_t)mac_test_check_vnode_setacl }, 1458 { MAC_CHECK_VNODE_SETEXTATTR, 1459 (macop_t)mac_test_check_vnode_setextattr }, 1460 { MAC_CHECK_VNODE_SETFLAGS, 1461 (macop_t)mac_test_check_vnode_setflags }, 1462 { MAC_CHECK_VNODE_SETMODE, 1463 (macop_t)mac_test_check_vnode_setmode }, 1464 { MAC_CHECK_VNODE_SETOWNER, 1465 (macop_t)mac_test_check_vnode_setowner }, 1466 { MAC_CHECK_VNODE_SETUTIMES, 1467 (macop_t)mac_test_check_vnode_setutimes }, 1468 { MAC_CHECK_VNODE_STAT, 1469 (macop_t)mac_test_check_vnode_stat }, 1470 { MAC_CHECK_VNODE_WRITE, 1471 (macop_t)mac_test_check_vnode_write }, 1472 { MAC_OP_LAST, NULL } 1473 }; 1474 1475 MAC_POLICY_SET(mac_test_ops, trustedbsd_mac_test, "TrustedBSD MAC/Test", 1476 MPC_LOADTIME_FLAG_UNLOADOK, &test_slot); 1477