1 /*- 2 * Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson 3 * Copyright (c) 2001, 2002 Networks Associates Technology, Inc. 4 * All rights reserved. 5 * 6 * This software was developed by Robert Watson for the TrustedBSD Project. 7 * 8 * This software was developed for the FreeBSD Project in part by NAI Labs, 9 * the Security Research Division of Network Associates, Inc. under 10 * DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA 11 * CHATS research program. 12 * 13 * Redistribution and use in source and binary forms, with or without 14 * modification, are permitted provided that the following conditions 15 * are met: 16 * 1. Redistributions of source code must retain the above copyright 17 * notice, this list of conditions and the following disclaimer. 18 * 2. Redistributions in binary form must reproduce the above copyright 19 * notice, this list of conditions and the following disclaimer in the 20 * documentation and/or other materials provided with the distribution. 21 * 3. The names of the authors may not be used to endorse or promote 22 * products derived from this software without specific prior written 23 * permission. 24 * 25 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 26 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 27 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 28 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 29 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 30 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 31 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 32 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 33 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 34 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 35 * SUCH DAMAGE. 36 * 37 * $FreeBSD$ 38 */ 39 40 /* 41 * Developed by the TrustedBSD Project. 42 * Generic mandatory access module that does nothing. 43 */ 44 45 #include <sys/types.h> 46 #include <sys/param.h> 47 #include <sys/acl.h> 48 #include <sys/conf.h> 49 #include <sys/kernel.h> 50 #include <sys/mac.h> 51 #include <sys/mount.h> 52 #include <sys/proc.h> 53 #include <sys/systm.h> 54 #include <sys/sysproto.h> 55 #include <sys/sysent.h> 56 #include <sys/vnode.h> 57 #include <sys/file.h> 58 #include <sys/socket.h> 59 #include <sys/socketvar.h> 60 #include <sys/sysctl.h> 61 62 #include <fs/devfs/devfs.h> 63 64 #include <net/bpfdesc.h> 65 #include <net/if.h> 66 #include <net/if_types.h> 67 #include <net/if_var.h> 68 69 #include <vm/vm.h> 70 71 #include <sys/mac_policy.h> 72 73 SYSCTL_DECL(_security_mac); 74 75 SYSCTL_NODE(_security_mac, OID_AUTO, test, CTLFLAG_RW, 0, 76 "TrustedBSD mac_test policy controls"); 77 78 static int mac_test_enabled = 0; 79 SYSCTL_INT(_security_mac_test, OID_AUTO, enabled, CTLFLAG_RW, 80 &mac_test_enabled, 0, "Enforce test policy"); 81 82 #define BPFMAGIC 0xfe1ad1b6 83 #define DEVFSMAGIC 0x9ee79c32 84 #define IFNETMAGIC 0xc218b120 85 #define IPQMAGIC 0x206188ef 86 #define MBUFMAGIC 0xbbefa5bb 87 #define MOUNTMAGIC 0xc7c46e47 88 #define SOCKETMAGIC 0x9199c6cd 89 #define PIPEMAGIC 0xdc6c9919 90 #define CREDMAGIC 0x9a5a4987 91 #define TEMPMAGIC 0x70336678 92 #define VNODEMAGIC 0x1a67a45c 93 #define EXMAGIC 0x849ba1fd 94 95 #define SLOT(x) LABEL_TO_SLOT((x), test_slot).l_long 96 static int test_slot; 97 SYSCTL_INT(_security_mac_test, OID_AUTO, slot, CTLFLAG_RD, 98 &test_slot, 0, "Slot allocated by framework"); 99 100 static int init_count_bpfdesc; 101 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_bpfdesc, CTLFLAG_RD, 102 &init_count_bpfdesc, 0, "bpfdesc init calls"); 103 static int init_count_cred; 104 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_cred, CTLFLAG_RD, 105 &init_count_cred, 0, "cred init calls"); 106 static int init_count_devfsdirent; 107 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_devfsdirent, CTLFLAG_RD, 108 &init_count_devfsdirent, 0, "devfsdirent init calls"); 109 static int init_count_ifnet; 110 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_ifnet, CTLFLAG_RD, 111 &init_count_ifnet, 0, "ifnet init calls"); 112 static int init_count_ipq; 113 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_ipq, CTLFLAG_RD, 114 &init_count_ipq, 0, "ipq init calls"); 115 static int init_count_mbuf; 116 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_mbuf, CTLFLAG_RD, 117 &init_count_mbuf, 0, "mbuf init calls"); 118 static int init_count_mount; 119 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_mount, CTLFLAG_RD, 120 &init_count_mount, 0, "mount init calls"); 121 static int init_count_socket; 122 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_socket, CTLFLAG_RD, 123 &init_count_socket, 0, "socket init calls"); 124 static int init_count_pipe; 125 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_pipe, CTLFLAG_RD, 126 &init_count_pipe, 0, "pipe init calls"); 127 static int init_count_temp; 128 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_temp, CTLFLAG_RD, 129 &init_count_temp, 0, "temp init calls"); 130 static int init_count_vnode; 131 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_vnode, CTLFLAG_RD, 132 &init_count_vnode, 0, "vnode init calls"); 133 134 static int destroy_count_bpfdesc; 135 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_bpfdesc, CTLFLAG_RD, 136 &destroy_count_bpfdesc, 0, "bpfdesc destroy calls"); 137 static int destroy_count_cred; 138 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_cred, CTLFLAG_RD, 139 &destroy_count_cred, 0, "cred destroy calls"); 140 static int destroy_count_devfsdirent; 141 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_devfsdirent, CTLFLAG_RD, 142 &destroy_count_devfsdirent, 0, "devfsdirent destroy calls"); 143 static int destroy_count_ifnet; 144 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_ifnet, CTLFLAG_RD, 145 &destroy_count_ifnet, 0, "ifnet destroy calls"); 146 static int destroy_count_ipq; 147 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_ipq, CTLFLAG_RD, 148 &destroy_count_ipq, 0, "ipq destroy calls"); 149 static int destroy_count_mbuf; 150 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_mbuf, CTLFLAG_RD, 151 &destroy_count_mbuf, 0, "mbuf destroy calls"); 152 static int destroy_count_mount; 153 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_mount, CTLFLAG_RD, 154 &destroy_count_mount, 0, "mount destroy calls"); 155 static int destroy_count_socket; 156 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_socket, CTLFLAG_RD, 157 &destroy_count_socket, 0, "socket destroy calls"); 158 static int destroy_count_pipe; 159 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_pipe, CTLFLAG_RD, 160 &destroy_count_pipe, 0, "pipe destroy calls"); 161 static int destroy_count_temp; 162 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_temp, CTLFLAG_RD, 163 &destroy_count_temp, 0, "temp destroy calls"); 164 static int destroy_count_vnode; 165 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_vnode, CTLFLAG_RD, 166 &destroy_count_vnode, 0, "vnode destroy calls"); 167 168 static int externalize_count; 169 SYSCTL_INT(_security_mac_test, OID_AUTO, externalize_count, CTLFLAG_RD, 170 &externalize_count, 0, "Subject/object externalize calls"); 171 static int internalize_count; 172 SYSCTL_INT(_security_mac_test, OID_AUTO, internalize_count, CTLFLAG_RD, 173 &internalize_count, 0, "Subject/object internalize calls"); 174 175 /* 176 * Policy module operations. 177 */ 178 static void 179 mac_test_destroy(struct mac_policy_conf *conf) 180 { 181 182 } 183 184 static void 185 mac_test_init(struct mac_policy_conf *conf) 186 { 187 188 } 189 190 static int 191 mac_test_syscall(struct thread *td, int call, void *arg) 192 { 193 194 return (0); 195 } 196 197 /* 198 * Label operations. 199 */ 200 static void 201 mac_test_init_bpfdesc(struct bpf_d *bpf_d, struct label *label) 202 { 203 204 SLOT(label) = BPFMAGIC; 205 atomic_add_int(&init_count_bpfdesc, 1); 206 } 207 208 static void 209 mac_test_init_cred(struct ucred *ucred, struct label *label) 210 { 211 212 SLOT(label) = CREDMAGIC; 213 atomic_add_int(&init_count_cred, 1); 214 } 215 216 static void 217 mac_test_init_devfsdirent(struct devfs_dirent *devfs_dirent, 218 struct label *label) 219 { 220 221 SLOT(label) = DEVFSMAGIC; 222 atomic_add_int(&init_count_devfsdirent, 1); 223 } 224 225 static void 226 mac_test_init_ifnet(struct ifnet *ifnet, struct label *label) 227 { 228 229 SLOT(label) = IFNETMAGIC; 230 atomic_add_int(&init_count_ifnet, 1); 231 } 232 233 static void 234 mac_test_init_ipq(struct ipq *ipq, struct label *label) 235 { 236 237 SLOT(label) = IPQMAGIC; 238 atomic_add_int(&init_count_ipq, 1); 239 } 240 241 static int 242 mac_test_init_mbuf(struct mbuf *mbuf, int how, struct label *label) 243 { 244 245 SLOT(label) = MBUFMAGIC; 246 atomic_add_int(&init_count_mbuf, 1); 247 return (0); 248 } 249 250 static void 251 mac_test_init_mount(struct mount *mount, struct label *mntlabel, 252 struct label *fslabel) 253 { 254 255 SLOT(mntlabel) = MOUNTMAGIC; 256 SLOT(fslabel) = MOUNTMAGIC; 257 atomic_add_int(&init_count_mount, 1); 258 } 259 260 static void 261 mac_test_init_socket(struct socket *socket, struct label *label, 262 struct label *peerlabel) 263 { 264 265 SLOT(label) = SOCKETMAGIC; 266 SLOT(peerlabel) = SOCKETMAGIC; 267 atomic_add_int(&init_count_socket, 1); 268 } 269 270 static void 271 mac_test_init_pipe(struct pipe *pipe, struct label *label) 272 { 273 274 SLOT(label) = PIPEMAGIC; 275 atomic_add_int(&init_count_pipe, 1); 276 } 277 278 static void 279 mac_test_init_temp(struct label *label) 280 { 281 282 SLOT(label) = TEMPMAGIC; 283 atomic_add_int(&init_count_temp, 1); 284 } 285 286 static void 287 mac_test_init_vnode(struct vnode *vp, struct label *label) 288 { 289 290 SLOT(label) = VNODEMAGIC; 291 atomic_add_int(&init_count_vnode, 1); 292 } 293 294 static void 295 mac_test_destroy_bpfdesc(struct bpf_d *bpf_d, struct label *label) 296 { 297 298 if (SLOT(label) == BPFMAGIC || SLOT(label) == 0) { 299 atomic_add_int(&destroy_count_bpfdesc, 1); 300 SLOT(label) = EXMAGIC; 301 } else if (SLOT(label) == EXMAGIC) { 302 Debugger("mac_test_destroy_bpfdesc: dup destroy"); 303 } else { 304 Debugger("mac_test_destroy_bpfdesc: corrupted label"); 305 } 306 } 307 308 static void 309 mac_test_destroy_cred(struct ucred *ucred, struct label *label) 310 { 311 312 if (SLOT(label) == CREDMAGIC || SLOT(label) == 0) { 313 atomic_add_int(&destroy_count_cred, 1); 314 SLOT(label) = EXMAGIC; 315 } else if (SLOT(label) == EXMAGIC) { 316 Debugger("mac_test_destroy_cred: dup destroy"); 317 } else { 318 Debugger("mac_test_destroy_cred: corrupted label"); 319 } 320 } 321 322 static void 323 mac_test_destroy_devfsdirent(struct devfs_dirent *devfs_dirent, 324 struct label *label) 325 { 326 327 if (SLOT(label) == DEVFSMAGIC || SLOT(label) == 0) { 328 atomic_add_int(&destroy_count_devfsdirent, 1); 329 SLOT(label) = EXMAGIC; 330 } else if (SLOT(label) == EXMAGIC) { 331 Debugger("mac_test_destroy_devfsdirent: dup destroy"); 332 } else { 333 Debugger("mac_test_destroy_devfsdirent: corrupted label"); 334 } 335 } 336 337 static void 338 mac_test_destroy_ifnet(struct ifnet *ifnet, struct label *label) 339 { 340 341 if (SLOT(label) == IFNETMAGIC || SLOT(label) == 0) { 342 atomic_add_int(&destroy_count_ifnet, 1); 343 SLOT(label) = EXMAGIC; 344 } else if (SLOT(label) == EXMAGIC) { 345 Debugger("mac_test_destroy_ifnet: dup destroy"); 346 } else { 347 Debugger("mac_test_destroy_ifnet: corrupted label"); 348 } 349 } 350 351 static void 352 mac_test_destroy_ipq(struct ipq *ipq, struct label *label) 353 { 354 355 if (SLOT(label) == IPQMAGIC || SLOT(label) == 0) { 356 atomic_add_int(&destroy_count_ipq, 1); 357 SLOT(label) = EXMAGIC; 358 } else if (SLOT(label) == EXMAGIC) { 359 Debugger("mac_test_destroy_ipq: dup destroy"); 360 } else { 361 Debugger("mac_test_destroy_ipq: corrupted label"); 362 } 363 } 364 365 static void 366 mac_test_destroy_mbuf(struct mbuf *mbuf, struct label *label) 367 { 368 369 if (SLOT(label) == MBUFMAGIC || SLOT(label) == 0) { 370 atomic_add_int(&destroy_count_mbuf, 1); 371 SLOT(label) = EXMAGIC; 372 } else if (SLOT(label) == EXMAGIC) { 373 Debugger("mac_test_destroy_mbuf: dup destroy"); 374 } else { 375 Debugger("mac_test_destroy_mbuf: corrupted label"); 376 } 377 } 378 379 static void 380 mac_test_destroy_mount(struct mount *mount, struct label *mntlabel, 381 struct label *fslabel) 382 { 383 384 if ((SLOT(mntlabel) == MOUNTMAGIC || SLOT(mntlabel) == 0) && 385 (SLOT(fslabel) == MOUNTMAGIC || SLOT(fslabel) == 0)) { 386 atomic_add_int(&destroy_count_mount, 1); 387 SLOT(mntlabel) = EXMAGIC; 388 SLOT(fslabel) = EXMAGIC; 389 } else if (SLOT(mntlabel) == EXMAGIC || SLOT(fslabel) == EXMAGIC) { 390 Debugger("mac_test_destroy_mount: dup destroy"); 391 } else { 392 Debugger("mac_test_destroy_mount: corrupted label"); 393 } 394 } 395 396 static void 397 mac_test_destroy_socket(struct socket *socket, struct label *label, 398 struct label *peerlabel) 399 { 400 401 if ((SLOT(label) == SOCKETMAGIC || SLOT(label) == 0) && 402 (SLOT(peerlabel) == SOCKETMAGIC || SLOT(peerlabel) == 0)) { 403 atomic_add_int(&destroy_count_socket, 1); 404 SLOT(label) = EXMAGIC; 405 SLOT(peerlabel) = EXMAGIC; 406 } else if (SLOT(label) == EXMAGIC || SLOT(peerlabel) == EXMAGIC) { 407 Debugger("mac_test_destroy_socket: dup destroy"); 408 } else { 409 Debugger("mac_test_destroy_socket: corrupted label"); 410 } 411 } 412 static void 413 mac_test_destroy_pipe(struct pipe *pipe, struct label *label) 414 { 415 416 if ((SLOT(label) == PIPEMAGIC || SLOT(label) == 0)) { 417 atomic_add_int(&destroy_count_pipe, 1); 418 SLOT(label) = EXMAGIC; 419 } else if (SLOT(label) == EXMAGIC) { 420 Debugger("mac_test_destroy_pipe: dup destroy"); 421 } else { 422 Debugger("mac_test_destroy_pipe: corrupted label"); 423 } 424 } 425 426 static void 427 mac_test_destroy_temp(struct label *label) 428 { 429 430 if (SLOT(label) == TEMPMAGIC || SLOT(label) == 0) { 431 atomic_add_int(&destroy_count_temp, 1); 432 SLOT(label) = EXMAGIC; 433 } else if (SLOT(label) == EXMAGIC) { 434 Debugger("mac_test_destroy_temp: dup destroy"); 435 } else { 436 Debugger("mac_test_destroy_temp: corrupted label"); 437 } 438 } 439 440 static void 441 mac_test_destroy_vnode(struct vnode *vp, struct label *label) 442 { 443 444 if (SLOT(label) == VNODEMAGIC || SLOT(label) == 0) { 445 atomic_add_int(&destroy_count_vnode, 1); 446 SLOT(label) = EXMAGIC; 447 } else if (SLOT(label) == EXMAGIC) { 448 Debugger("mac_test_destroy_vnode: dup destroy"); 449 } else { 450 Debugger("mac_test_destroy_vnode: corrupted label"); 451 } 452 } 453 454 static int 455 mac_test_externalize(struct label *label, struct mac *extmac) 456 { 457 458 atomic_add_int(&externalize_count, 1); 459 460 return (0); 461 } 462 463 static int 464 mac_test_internalize(struct label *label, struct mac *extmac) 465 { 466 467 atomic_add_int(&internalize_count, 1); 468 469 return (0); 470 } 471 472 /* 473 * Labeling event operations: file system objects, and things that look 474 * a lot like file system objects. 475 */ 476 static void 477 mac_test_create_devfs_device(dev_t dev, struct devfs_dirent *devfs_dirent, 478 struct label *label) 479 { 480 481 } 482 483 static void 484 mac_test_create_devfs_directory(char *dirname, int dirnamelen, 485 struct devfs_dirent *devfs_dirent, struct label *label) 486 { 487 488 } 489 490 static void 491 mac_test_create_devfs_vnode(struct devfs_dirent *devfs_dirent, 492 struct label *direntlabel, struct vnode *vp, struct label *vnodelabel) 493 { 494 495 } 496 497 static void 498 mac_test_create_vnode(struct ucred *cred, struct vnode *parent, 499 struct label *parentlabel, struct vnode *child, struct label *childlabel) 500 { 501 502 } 503 504 static void 505 mac_test_create_mount(struct ucred *cred, struct mount *mp, 506 struct label *mntlabel, struct label *fslabel) 507 { 508 509 } 510 511 static void 512 mac_test_create_root_mount(struct ucred *cred, struct mount *mp, 513 struct label *mntlabel, struct label *fslabel) 514 { 515 516 } 517 518 static void 519 mac_test_relabel_vnode(struct ucred *cred, struct vnode *vp, 520 struct label *vnodelabel, struct label *label) 521 { 522 523 } 524 525 static void 526 mac_test_update_devfsdirent(struct devfs_dirent *devfs_dirent, 527 struct vnode *vp) 528 { 529 530 } 531 532 static void 533 mac_test_update_procfsvnode(struct vnode *vp, struct label *vnodelabel, 534 struct ucred *cred) 535 { 536 537 } 538 539 static int 540 mac_test_update_vnode_from_externalized(struct vnode *vp, 541 struct label *vnodelabel, struct mac *extmac) 542 { 543 544 return (0); 545 } 546 547 static void 548 mac_test_update_vnode_from_mount(struct vnode *vp, struct label *vnodelabel, 549 struct mount *mp, struct label *fslabel) 550 { 551 552 } 553 554 /* 555 * Labeling event operations: IPC object. 556 */ 557 static void 558 mac_test_create_mbuf_from_socket(struct socket *so, struct label *socketlabel, 559 struct mbuf *m, struct label *mbuflabel) 560 { 561 562 } 563 564 static void 565 mac_test_create_socket(struct ucred *cred, struct socket *socket, 566 struct label *socketlabel) 567 { 568 569 } 570 571 static void 572 mac_test_create_pipe(struct ucred *cred, struct pipe *pipe, 573 struct label *pipelabel) 574 { 575 576 } 577 578 static void 579 mac_test_create_socket_from_socket(struct socket *oldsocket, 580 struct label *oldsocketlabel, struct socket *newsocket, 581 struct label *newsocketlabel) 582 { 583 584 } 585 586 static void 587 mac_test_relabel_socket(struct ucred *cred, struct socket *socket, 588 struct label *socketlabel, struct label *newlabel) 589 { 590 591 } 592 593 static void 594 mac_test_relabel_pipe(struct ucred *cred, struct pipe *pipe, 595 struct label *pipelabel, struct label *newlabel) 596 { 597 598 } 599 600 static void 601 mac_test_set_socket_peer_from_mbuf(struct mbuf *mbuf, struct label *mbuflabel, 602 struct socket *socket, struct label *socketpeerlabel) 603 { 604 605 } 606 607 /* 608 * Labeling event operations: network objects. 609 */ 610 static void 611 mac_test_set_socket_peer_from_socket(struct socket *oldsocket, 612 struct label *oldsocketlabel, struct socket *newsocket, 613 struct label *newsocketpeerlabel) 614 { 615 616 } 617 618 static void 619 mac_test_create_bpfdesc(struct ucred *cred, struct bpf_d *bpf_d, 620 struct label *bpflabel) 621 { 622 623 } 624 625 static void 626 mac_test_create_datagram_from_ipq(struct ipq *ipq, struct label *ipqlabel, 627 struct mbuf *datagram, struct label *datagramlabel) 628 { 629 630 } 631 632 static void 633 mac_test_create_fragment(struct mbuf *datagram, struct label *datagramlabel, 634 struct mbuf *fragment, struct label *fragmentlabel) 635 { 636 637 } 638 639 static void 640 mac_test_create_ifnet(struct ifnet *ifnet, struct label *ifnetlabel) 641 { 642 643 } 644 645 static void 646 mac_test_create_ipq(struct mbuf *fragment, struct label *fragmentlabel, 647 struct ipq *ipq, struct label *ipqlabel) 648 { 649 650 } 651 652 static void 653 mac_test_create_mbuf_from_mbuf(struct mbuf *oldmbuf, 654 struct label *oldmbuflabel, struct mbuf *newmbuf, 655 struct label *newmbuflabel) 656 { 657 658 } 659 660 static void 661 mac_test_create_mbuf_linklayer(struct ifnet *ifnet, struct label *ifnetlabel, 662 struct mbuf *mbuf, struct label *mbuflabel) 663 { 664 665 } 666 667 static void 668 mac_test_create_mbuf_from_bpfdesc(struct bpf_d *bpf_d, struct label *bpflabel, 669 struct mbuf *mbuf, struct label *mbuflabel) 670 { 671 672 } 673 674 static void 675 mac_test_create_mbuf_from_ifnet(struct ifnet *ifnet, struct label *ifnetlabel, 676 struct mbuf *m, struct label *mbuflabel) 677 { 678 679 } 680 681 static void 682 mac_test_create_mbuf_multicast_encap(struct mbuf *oldmbuf, 683 struct label *oldmbuflabel, struct ifnet *ifnet, struct label *ifnetlabel, 684 struct mbuf *newmbuf, struct label *newmbuflabel) 685 { 686 687 } 688 689 static void 690 mac_test_create_mbuf_netlayer(struct mbuf *oldmbuf, 691 struct label *oldmbuflabel, struct mbuf *newmbuf, 692 struct label *newmbuflabel) 693 { 694 695 } 696 697 static int 698 mac_test_fragment_match(struct mbuf *fragment, struct label *fragmentlabel, 699 struct ipq *ipq, struct label *ipqlabel) 700 { 701 702 return (1); 703 } 704 705 static void 706 mac_test_relabel_ifnet(struct ucred *cred, struct ifnet *ifnet, 707 struct label *ifnetlabel, struct label *newlabel) 708 { 709 710 } 711 712 static void 713 mac_test_update_ipq(struct mbuf *fragment, struct label *fragmentlabel, 714 struct ipq *ipq, struct label *ipqlabel) 715 { 716 717 } 718 719 /* 720 * Labeling event operations: processes. 721 */ 722 static void 723 mac_test_create_cred(struct ucred *cred_parent, struct ucred *cred_child) 724 { 725 726 } 727 728 static void 729 mac_test_execve_transition(struct ucred *old, struct ucred *new, 730 struct vnode *vp, struct label *filelabel) 731 { 732 733 } 734 735 static int 736 mac_test_execve_will_transition(struct ucred *old, struct vnode *vp, 737 struct label *filelabel) 738 { 739 740 return (0); 741 } 742 743 static void 744 mac_test_create_proc0(struct ucred *cred) 745 { 746 747 } 748 749 static void 750 mac_test_create_proc1(struct ucred *cred) 751 { 752 753 } 754 755 static void 756 mac_test_relabel_cred(struct ucred *cred, struct label *newlabel) 757 { 758 759 } 760 761 /* 762 * Access control checks. 763 */ 764 static int 765 mac_test_check_bpfdesc_receive(struct bpf_d *bpf_d, struct label *bpflabel, 766 struct ifnet *ifnet, struct label *ifnetlabel) 767 { 768 769 return (0); 770 } 771 772 static int 773 mac_test_check_cred_relabel(struct ucred *cred, struct label *newlabel) 774 { 775 776 return (0); 777 } 778 779 static int 780 mac_test_check_cred_visible(struct ucred *u1, struct ucred *u2) 781 { 782 783 return (0); 784 } 785 786 static int 787 mac_test_check_ifnet_relabel(struct ucred *cred, struct ifnet *ifnet, 788 struct label *ifnetlabel, struct label *newlabel) 789 { 790 791 return (0); 792 } 793 794 static int 795 mac_test_check_ifnet_transmit(struct ifnet *ifnet, struct label *ifnetlabel, 796 struct mbuf *m, struct label *mbuflabel) 797 { 798 799 return (0); 800 } 801 802 static int 803 mac_test_check_mount_stat(struct ucred *cred, struct mount *mp, 804 struct label *mntlabel) 805 { 806 807 return (0); 808 } 809 810 static int 811 mac_test_check_pipe_ioctl(struct ucred *cred, struct pipe *pipe, 812 struct label *pipelabel, unsigned long cmd, void /* caddr_t */ *data) 813 { 814 815 return (0); 816 } 817 818 static int 819 mac_test_check_pipe_poll(struct ucred *cred, struct pipe *pipe, 820 struct label *pipelabel) 821 { 822 823 return (0); 824 } 825 826 static int 827 mac_test_check_pipe_read(struct ucred *cred, struct pipe *pipe, 828 struct label *pipelabel) 829 { 830 831 return (0); 832 } 833 834 static int 835 mac_test_check_pipe_relabel(struct ucred *cred, struct pipe *pipe, 836 struct label *pipelabel, struct label *newlabel) 837 { 838 839 return (0); 840 } 841 842 static int 843 mac_test_check_pipe_stat(struct ucred *cred, struct pipe *pipe, 844 struct label *pipelabel) 845 { 846 847 return (0); 848 } 849 850 static int 851 mac_test_check_pipe_write(struct ucred *cred, struct pipe *pipe, 852 struct label *pipelabel) 853 { 854 855 return (0); 856 } 857 858 static int 859 mac_test_check_proc_debug(struct ucred *cred, struct proc *proc) 860 { 861 862 return (0); 863 } 864 865 static int 866 mac_test_check_proc_sched(struct ucred *cred, struct proc *proc) 867 { 868 869 return (0); 870 } 871 872 static int 873 mac_test_check_proc_signal(struct ucred *cred, struct proc *proc) 874 { 875 876 return (0); 877 } 878 879 static int 880 mac_test_check_socket_bind(struct ucred *cred, struct socket *socket, 881 struct label *socketlabel, struct sockaddr *sockaddr) 882 { 883 884 return (0); 885 } 886 887 static int 888 mac_test_check_socket_connect(struct ucred *cred, struct socket *socket, 889 struct label *socketlabel, struct sockaddr *sockaddr) 890 { 891 892 return (0); 893 } 894 895 static int 896 mac_test_check_socket_deliver(struct socket *socket, struct label *socketlabel, 897 struct mbuf *m, struct label *mbuflabel) 898 { 899 900 return (0); 901 } 902 903 static int 904 mac_test_check_socket_listen(struct ucred *cred, struct socket *socket, 905 struct label *socketlabel, struct sockaddr *sockaddr) 906 { 907 908 return (0); 909 } 910 911 static int 912 mac_test_check_socket_visible(struct ucred *cred, struct socket *socket, 913 struct label *socketlabel) 914 { 915 916 return (0); 917 } 918 919 static int 920 mac_test_check_socket_relabel(struct ucred *cred, struct socket *socket, 921 struct label *socketlabel, struct label *newlabel) 922 { 923 924 return (0); 925 } 926 927 static int 928 mac_test_check_vnode_access(struct ucred *cred, struct vnode *vp, 929 struct label *label, mode_t flags) 930 { 931 932 return (0); 933 } 934 935 static int 936 mac_test_check_vnode_chdir(struct ucred *cred, struct vnode *dvp, 937 struct label *dlabel) 938 { 939 940 return (0); 941 } 942 943 static int 944 mac_test_check_vnode_chroot(struct ucred *cred, struct vnode *dvp, 945 struct label *dlabel) 946 { 947 948 return (0); 949 } 950 951 static int 952 mac_test_check_vnode_create(struct ucred *cred, struct vnode *dvp, 953 struct label *dlabel, struct componentname *cnp, struct vattr *vap) 954 { 955 956 return (0); 957 } 958 959 static int 960 mac_test_check_vnode_delete(struct ucred *cred, struct vnode *dvp, 961 struct label *dlabel, struct vnode *vp, struct label *label, 962 struct componentname *cnp) 963 { 964 965 return (0); 966 } 967 968 static int 969 mac_test_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp, 970 struct label *label, acl_type_t type) 971 { 972 973 return (0); 974 } 975 976 static int 977 mac_test_check_vnode_exec(struct ucred *cred, struct vnode *vp, 978 struct label *label) 979 { 980 981 return (0); 982 } 983 984 static int 985 mac_test_check_vnode_getacl(struct ucred *cred, struct vnode *vp, 986 struct label *label, acl_type_t type) 987 { 988 989 return (0); 990 } 991 992 static int 993 mac_test_check_vnode_getextattr(struct ucred *cred, struct vnode *vp, 994 struct label *label, int attrnamespace, const char *name, struct uio *uio) 995 { 996 997 return (0); 998 } 999 1000 static int 1001 mac_test_check_vnode_lookup(struct ucred *cred, struct vnode *dvp, 1002 struct label *dlabel, struct componentname *cnp) 1003 { 1004 1005 return (0); 1006 } 1007 1008 static int 1009 mac_test_check_vnode_open(struct ucred *cred, struct vnode *vp, 1010 struct label *filelabel, mode_t acc_mode) 1011 { 1012 1013 return (0); 1014 } 1015 1016 static int 1017 mac_test_check_vnode_poll(struct ucred *active_cred, struct ucred *file_cred, 1018 struct vnode *vp, struct label *label) 1019 { 1020 1021 return (0); 1022 } 1023 1024 static int 1025 mac_test_check_vnode_read(struct ucred *active_cred, struct ucred *file_cred, 1026 struct vnode *vp, struct label *label) 1027 { 1028 1029 return (0); 1030 } 1031 1032 static int 1033 mac_test_check_vnode_readdir(struct ucred *cred, struct vnode *dvp, 1034 struct label *dlabel) 1035 { 1036 1037 return (0); 1038 } 1039 1040 static int 1041 mac_test_check_vnode_readlink(struct ucred *cred, struct vnode *vp, 1042 struct label *vnodelabel) 1043 { 1044 1045 return (0); 1046 } 1047 1048 static int 1049 mac_test_check_vnode_relabel(struct ucred *cred, struct vnode *vp, 1050 struct label *vnodelabel, struct label *newlabel) 1051 { 1052 1053 return (0); 1054 } 1055 1056 static int 1057 mac_test_check_vnode_rename_from(struct ucred *cred, struct vnode *dvp, 1058 struct label *dlabel, struct vnode *vp, struct label *label, 1059 struct componentname *cnp) 1060 { 1061 1062 return (0); 1063 } 1064 1065 static int 1066 mac_test_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp, 1067 struct label *dlabel, struct vnode *vp, struct label *label, int samedir, 1068 struct componentname *cnp) 1069 { 1070 1071 return (0); 1072 } 1073 1074 static int 1075 mac_test_check_vnode_revoke(struct ucred *cred, struct vnode *vp, 1076 struct label *label) 1077 { 1078 1079 return (0); 1080 } 1081 1082 static int 1083 mac_test_check_vnode_setacl(struct ucred *cred, struct vnode *vp, 1084 struct label *label, acl_type_t type, struct acl *acl) 1085 { 1086 1087 return (0); 1088 } 1089 1090 static int 1091 mac_test_check_vnode_setextattr(struct ucred *cred, struct vnode *vp, 1092 struct label *label, int attrnamespace, const char *name, struct uio *uio) 1093 { 1094 1095 return (0); 1096 } 1097 1098 static int 1099 mac_test_check_vnode_setflags(struct ucred *cred, struct vnode *vp, 1100 struct label *label, u_long flags) 1101 { 1102 1103 return (0); 1104 } 1105 1106 static int 1107 mac_test_check_vnode_setmode(struct ucred *cred, struct vnode *vp, 1108 struct label *label, mode_t mode) 1109 { 1110 1111 return (0); 1112 } 1113 1114 static int 1115 mac_test_check_vnode_setowner(struct ucred *cred, struct vnode *vp, 1116 struct label *label, uid_t uid, gid_t gid) 1117 { 1118 1119 return (0); 1120 } 1121 1122 static int 1123 mac_test_check_vnode_setutimes(struct ucred *cred, struct vnode *vp, 1124 struct label *label, struct timespec atime, struct timespec mtime) 1125 { 1126 1127 return (0); 1128 } 1129 1130 static int 1131 mac_test_check_vnode_stat(struct ucred *active_cred, struct ucred *file_cred, 1132 struct vnode *vp, struct label *label) 1133 { 1134 1135 return (0); 1136 } 1137 1138 static int 1139 mac_test_check_vnode_write(struct ucred *active_cred, 1140 struct ucred *file_cred, struct vnode *vp, struct label *label) 1141 { 1142 1143 return (0); 1144 } 1145 1146 static struct mac_policy_op_entry mac_test_ops[] = 1147 { 1148 { MAC_DESTROY, 1149 (macop_t)mac_test_destroy }, 1150 { MAC_INIT, 1151 (macop_t)mac_test_init }, 1152 { MAC_SYSCALL, 1153 (macop_t)mac_test_syscall }, 1154 { MAC_INIT_BPFDESC, 1155 (macop_t)mac_test_init_bpfdesc }, 1156 { MAC_INIT_CRED, 1157 (macop_t)mac_test_init_cred }, 1158 { MAC_INIT_DEVFSDIRENT, 1159 (macop_t)mac_test_init_devfsdirent }, 1160 { MAC_INIT_IFNET, 1161 (macop_t)mac_test_init_ifnet }, 1162 { MAC_INIT_IPQ, 1163 (macop_t)mac_test_init_ipq }, 1164 { MAC_INIT_MBUF, 1165 (macop_t)mac_test_init_mbuf }, 1166 { MAC_INIT_MOUNT, 1167 (macop_t)mac_test_init_mount }, 1168 { MAC_INIT_PIPE, 1169 (macop_t)mac_test_init_pipe }, 1170 { MAC_INIT_SOCKET, 1171 (macop_t)mac_test_init_socket }, 1172 { MAC_INIT_TEMP, 1173 (macop_t)mac_test_init_temp }, 1174 { MAC_INIT_VNODE, 1175 (macop_t)mac_test_init_vnode }, 1176 { MAC_DESTROY_BPFDESC, 1177 (macop_t)mac_test_destroy_bpfdesc }, 1178 { MAC_DESTROY_CRED, 1179 (macop_t)mac_test_destroy_cred }, 1180 { MAC_DESTROY_DEVFSDIRENT, 1181 (macop_t)mac_test_destroy_devfsdirent }, 1182 { MAC_DESTROY_IFNET, 1183 (macop_t)mac_test_destroy_ifnet }, 1184 { MAC_DESTROY_IPQ, 1185 (macop_t)mac_test_destroy_ipq }, 1186 { MAC_DESTROY_MBUF, 1187 (macop_t)mac_test_destroy_mbuf }, 1188 { MAC_DESTROY_MOUNT, 1189 (macop_t)mac_test_destroy_mount }, 1190 { MAC_DESTROY_PIPE, 1191 (macop_t)mac_test_destroy_pipe }, 1192 { MAC_DESTROY_SOCKET, 1193 (macop_t)mac_test_destroy_socket }, 1194 { MAC_DESTROY_TEMP, 1195 (macop_t)mac_test_destroy_temp }, 1196 { MAC_DESTROY_VNODE, 1197 (macop_t)mac_test_destroy_vnode }, 1198 { MAC_EXTERNALIZE, 1199 (macop_t)mac_test_externalize }, 1200 { MAC_INTERNALIZE, 1201 (macop_t)mac_test_internalize }, 1202 { MAC_CREATE_DEVFS_DEVICE, 1203 (macop_t)mac_test_create_devfs_device }, 1204 { MAC_CREATE_DEVFS_DIRECTORY, 1205 (macop_t)mac_test_create_devfs_directory }, 1206 { MAC_CREATE_DEVFS_VNODE, 1207 (macop_t)mac_test_create_devfs_vnode }, 1208 { MAC_CREATE_VNODE, 1209 (macop_t)mac_test_create_vnode }, 1210 { MAC_CREATE_MOUNT, 1211 (macop_t)mac_test_create_mount }, 1212 { MAC_CREATE_ROOT_MOUNT, 1213 (macop_t)mac_test_create_root_mount }, 1214 { MAC_RELABEL_VNODE, 1215 (macop_t)mac_test_relabel_vnode }, 1216 { MAC_UPDATE_DEVFSDIRENT, 1217 (macop_t)mac_test_update_devfsdirent }, 1218 { MAC_UPDATE_PROCFSVNODE, 1219 (macop_t)mac_test_update_procfsvnode }, 1220 { MAC_UPDATE_VNODE_FROM_EXTERNALIZED, 1221 (macop_t)mac_test_update_vnode_from_externalized }, 1222 { MAC_UPDATE_VNODE_FROM_MOUNT, 1223 (macop_t)mac_test_update_vnode_from_mount }, 1224 { MAC_CREATE_MBUF_FROM_SOCKET, 1225 (macop_t)mac_test_create_mbuf_from_socket }, 1226 { MAC_CREATE_PIPE, 1227 (macop_t)mac_test_create_pipe }, 1228 { MAC_CREATE_SOCKET, 1229 (macop_t)mac_test_create_socket }, 1230 { MAC_CREATE_SOCKET_FROM_SOCKET, 1231 (macop_t)mac_test_create_socket_from_socket }, 1232 { MAC_RELABEL_PIPE, 1233 (macop_t)mac_test_relabel_pipe }, 1234 { MAC_RELABEL_SOCKET, 1235 (macop_t)mac_test_relabel_socket }, 1236 { MAC_SET_SOCKET_PEER_FROM_MBUF, 1237 (macop_t)mac_test_set_socket_peer_from_mbuf }, 1238 { MAC_SET_SOCKET_PEER_FROM_SOCKET, 1239 (macop_t)mac_test_set_socket_peer_from_socket }, 1240 { MAC_CREATE_BPFDESC, 1241 (macop_t)mac_test_create_bpfdesc }, 1242 { MAC_CREATE_IFNET, 1243 (macop_t)mac_test_create_ifnet }, 1244 { MAC_CREATE_DATAGRAM_FROM_IPQ, 1245 (macop_t)mac_test_create_datagram_from_ipq }, 1246 { MAC_CREATE_FRAGMENT, 1247 (macop_t)mac_test_create_fragment }, 1248 { MAC_CREATE_IPQ, 1249 (macop_t)mac_test_create_ipq }, 1250 { MAC_CREATE_MBUF_FROM_MBUF, 1251 (macop_t)mac_test_create_mbuf_from_mbuf }, 1252 { MAC_CREATE_MBUF_LINKLAYER, 1253 (macop_t)mac_test_create_mbuf_linklayer }, 1254 { MAC_CREATE_MBUF_FROM_BPFDESC, 1255 (macop_t)mac_test_create_mbuf_from_bpfdesc }, 1256 { MAC_CREATE_MBUF_FROM_IFNET, 1257 (macop_t)mac_test_create_mbuf_from_ifnet }, 1258 { MAC_CREATE_MBUF_MULTICAST_ENCAP, 1259 (macop_t)mac_test_create_mbuf_multicast_encap }, 1260 { MAC_CREATE_MBUF_NETLAYER, 1261 (macop_t)mac_test_create_mbuf_netlayer }, 1262 { MAC_FRAGMENT_MATCH, 1263 (macop_t)mac_test_fragment_match }, 1264 { MAC_RELABEL_IFNET, 1265 (macop_t)mac_test_relabel_ifnet }, 1266 { MAC_UPDATE_IPQ, 1267 (macop_t)mac_test_update_ipq }, 1268 { MAC_CREATE_CRED, 1269 (macop_t)mac_test_create_cred }, 1270 { MAC_EXECVE_TRANSITION, 1271 (macop_t)mac_test_execve_transition }, 1272 { MAC_EXECVE_WILL_TRANSITION, 1273 (macop_t)mac_test_execve_will_transition }, 1274 { MAC_CREATE_PROC0, 1275 (macop_t)mac_test_create_proc0 }, 1276 { MAC_CREATE_PROC1, 1277 (macop_t)mac_test_create_proc1 }, 1278 { MAC_RELABEL_CRED, 1279 (macop_t)mac_test_relabel_cred }, 1280 { MAC_CHECK_BPFDESC_RECEIVE, 1281 (macop_t)mac_test_check_bpfdesc_receive }, 1282 { MAC_CHECK_CRED_RELABEL, 1283 (macop_t)mac_test_check_cred_relabel }, 1284 { MAC_CHECK_CRED_VISIBLE, 1285 (macop_t)mac_test_check_cred_visible }, 1286 { MAC_CHECK_IFNET_RELABEL, 1287 (macop_t)mac_test_check_ifnet_relabel }, 1288 { MAC_CHECK_IFNET_TRANSMIT, 1289 (macop_t)mac_test_check_ifnet_transmit }, 1290 { MAC_CHECK_MOUNT_STAT, 1291 (macop_t)mac_test_check_mount_stat }, 1292 { MAC_CHECK_PIPE_IOCTL, 1293 (macop_t)mac_test_check_pipe_ioctl }, 1294 { MAC_CHECK_PIPE_POLL, 1295 (macop_t)mac_test_check_pipe_poll }, 1296 { MAC_CHECK_PIPE_READ, 1297 (macop_t)mac_test_check_pipe_read }, 1298 { MAC_CHECK_PIPE_RELABEL, 1299 (macop_t)mac_test_check_pipe_relabel }, 1300 { MAC_CHECK_PIPE_STAT, 1301 (macop_t)mac_test_check_pipe_stat }, 1302 { MAC_CHECK_PIPE_WRITE, 1303 (macop_t)mac_test_check_pipe_write }, 1304 { MAC_CHECK_PROC_DEBUG, 1305 (macop_t)mac_test_check_proc_debug }, 1306 { MAC_CHECK_PROC_SCHED, 1307 (macop_t)mac_test_check_proc_sched }, 1308 { MAC_CHECK_PROC_SIGNAL, 1309 (macop_t)mac_test_check_proc_signal }, 1310 { MAC_CHECK_SOCKET_BIND, 1311 (macop_t)mac_test_check_socket_bind }, 1312 { MAC_CHECK_SOCKET_CONNECT, 1313 (macop_t)mac_test_check_socket_connect }, 1314 { MAC_CHECK_SOCKET_DELIVER, 1315 (macop_t)mac_test_check_socket_deliver }, 1316 { MAC_CHECK_SOCKET_LISTEN, 1317 (macop_t)mac_test_check_socket_listen }, 1318 { MAC_CHECK_SOCKET_RELABEL, 1319 (macop_t)mac_test_check_socket_relabel }, 1320 { MAC_CHECK_SOCKET_VISIBLE, 1321 (macop_t)mac_test_check_socket_visible }, 1322 { MAC_CHECK_VNODE_ACCESS, 1323 (macop_t)mac_test_check_vnode_access }, 1324 { MAC_CHECK_VNODE_CHDIR, 1325 (macop_t)mac_test_check_vnode_chdir }, 1326 { MAC_CHECK_VNODE_CHROOT, 1327 (macop_t)mac_test_check_vnode_chroot }, 1328 { MAC_CHECK_VNODE_CREATE, 1329 (macop_t)mac_test_check_vnode_create }, 1330 { MAC_CHECK_VNODE_DELETE, 1331 (macop_t)mac_test_check_vnode_delete }, 1332 { MAC_CHECK_VNODE_DELETEACL, 1333 (macop_t)mac_test_check_vnode_deleteacl }, 1334 { MAC_CHECK_VNODE_EXEC, 1335 (macop_t)mac_test_check_vnode_exec }, 1336 { MAC_CHECK_VNODE_GETACL, 1337 (macop_t)mac_test_check_vnode_getacl }, 1338 { MAC_CHECK_VNODE_GETEXTATTR, 1339 (macop_t)mac_test_check_vnode_getextattr }, 1340 { MAC_CHECK_VNODE_LOOKUP, 1341 (macop_t)mac_test_check_vnode_lookup }, 1342 { MAC_CHECK_VNODE_OPEN, 1343 (macop_t)mac_test_check_vnode_open }, 1344 { MAC_CHECK_VNODE_POLL, 1345 (macop_t)mac_test_check_vnode_poll }, 1346 { MAC_CHECK_VNODE_READ, 1347 (macop_t)mac_test_check_vnode_read }, 1348 { MAC_CHECK_VNODE_READDIR, 1349 (macop_t)mac_test_check_vnode_readdir }, 1350 { MAC_CHECK_VNODE_READLINK, 1351 (macop_t)mac_test_check_vnode_readlink }, 1352 { MAC_CHECK_VNODE_RELABEL, 1353 (macop_t)mac_test_check_vnode_relabel }, 1354 { MAC_CHECK_VNODE_RENAME_FROM, 1355 (macop_t)mac_test_check_vnode_rename_from }, 1356 { MAC_CHECK_VNODE_RENAME_TO, 1357 (macop_t)mac_test_check_vnode_rename_to }, 1358 { MAC_CHECK_VNODE_REVOKE, 1359 (macop_t)mac_test_check_vnode_revoke }, 1360 { MAC_CHECK_VNODE_SETACL, 1361 (macop_t)mac_test_check_vnode_setacl }, 1362 { MAC_CHECK_VNODE_SETEXTATTR, 1363 (macop_t)mac_test_check_vnode_setextattr }, 1364 { MAC_CHECK_VNODE_SETFLAGS, 1365 (macop_t)mac_test_check_vnode_setflags }, 1366 { MAC_CHECK_VNODE_SETMODE, 1367 (macop_t)mac_test_check_vnode_setmode }, 1368 { MAC_CHECK_VNODE_SETOWNER, 1369 (macop_t)mac_test_check_vnode_setowner }, 1370 { MAC_CHECK_VNODE_SETUTIMES, 1371 (macop_t)mac_test_check_vnode_setutimes }, 1372 { MAC_CHECK_VNODE_STAT, 1373 (macop_t)mac_test_check_vnode_stat }, 1374 { MAC_CHECK_VNODE_WRITE, 1375 (macop_t)mac_test_check_vnode_write }, 1376 { MAC_OP_LAST, NULL } 1377 }; 1378 1379 MAC_POLICY_SET(mac_test_ops, trustedbsd_mac_test, "TrustedBSD MAC/Test", 1380 MPC_LOADTIME_FLAG_UNLOADOK, &test_slot); 1381