1 /*- 2 * Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson 3 * Copyright (c) 2001, 2002 Networks Associates Technology, Inc. 4 * All rights reserved. 5 * 6 * This software was developed by Robert Watson for the TrustedBSD Project. 7 * 8 * This software was developed for the FreeBSD Project in part by Network 9 * Associates Laboratories, the Security Research Division of Network 10 * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), 11 * as part of the DARPA CHATS research program. 12 * 13 * Redistribution and use in source and binary forms, with or without 14 * modification, are permitted provided that the following conditions 15 * are met: 16 * 1. Redistributions of source code must retain the above copyright 17 * notice, this list of conditions and the following disclaimer. 18 * 2. Redistributions in binary form must reproduce the above copyright 19 * notice, this list of conditions and the following disclaimer in the 20 * documentation and/or other materials provided with the distribution. 21 * 22 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 23 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 24 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 25 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 26 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 27 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 28 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 29 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 30 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 31 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 32 * SUCH DAMAGE. 33 * 34 * $FreeBSD$ 35 */ 36 37 /* 38 * Developed by the TrustedBSD Project. 39 * Generic mandatory access module that does nothing. 40 */ 41 42 #include <sys/types.h> 43 #include <sys/param.h> 44 #include <sys/acl.h> 45 #include <sys/conf.h> 46 #include <sys/extattr.h> 47 #include <sys/kernel.h> 48 #include <sys/mac.h> 49 #include <sys/mount.h> 50 #include <sys/proc.h> 51 #include <sys/systm.h> 52 #include <sys/sysproto.h> 53 #include <sys/sysent.h> 54 #include <sys/vnode.h> 55 #include <sys/file.h> 56 #include <sys/socket.h> 57 #include <sys/socketvar.h> 58 #include <sys/sysctl.h> 59 60 #include <fs/devfs/devfs.h> 61 62 #include <net/bpfdesc.h> 63 #include <net/if.h> 64 #include <net/if_types.h> 65 #include <net/if_var.h> 66 67 #include <vm/vm.h> 68 69 #include <sys/mac_policy.h> 70 71 SYSCTL_DECL(_security_mac); 72 73 SYSCTL_NODE(_security_mac, OID_AUTO, test, CTLFLAG_RW, 0, 74 "TrustedBSD mac_test policy controls"); 75 76 static int mac_test_enabled = 0; 77 SYSCTL_INT(_security_mac_test, OID_AUTO, enabled, CTLFLAG_RW, 78 &mac_test_enabled, 0, "Enforce test policy"); 79 80 #define BPFMAGIC 0xfe1ad1b6 81 #define DEVFSMAGIC 0x9ee79c32 82 #define IFNETMAGIC 0xc218b120 83 #define IPQMAGIC 0x206188ef 84 #define MBUFMAGIC 0xbbefa5bb 85 #define MOUNTMAGIC 0xc7c46e47 86 #define SOCKETMAGIC 0x9199c6cd 87 #define PIPEMAGIC 0xdc6c9919 88 #define CREDMAGIC 0x9a5a4987 89 #define VNODEMAGIC 0x1a67a45c 90 #define EXMAGIC 0x849ba1fd 91 92 #define SLOT(x) LABEL_TO_SLOT((x), test_slot).l_long 93 static int test_slot; 94 SYSCTL_INT(_security_mac_test, OID_AUTO, slot, CTLFLAG_RD, 95 &test_slot, 0, "Slot allocated by framework"); 96 97 static int init_count_bpfdesc; 98 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_bpfdesc, CTLFLAG_RD, 99 &init_count_bpfdesc, 0, "bpfdesc init calls"); 100 static int init_count_cred; 101 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_cred, CTLFLAG_RD, 102 &init_count_cred, 0, "cred init calls"); 103 static int init_count_devfsdirent; 104 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_devfsdirent, CTLFLAG_RD, 105 &init_count_devfsdirent, 0, "devfsdirent init calls"); 106 static int init_count_ifnet; 107 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_ifnet, CTLFLAG_RD, 108 &init_count_ifnet, 0, "ifnet init calls"); 109 static int init_count_ipq; 110 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_ipq, CTLFLAG_RD, 111 &init_count_ipq, 0, "ipq init calls"); 112 static int init_count_mbuf; 113 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_mbuf, CTLFLAG_RD, 114 &init_count_mbuf, 0, "mbuf init calls"); 115 static int init_count_mount; 116 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_mount, CTLFLAG_RD, 117 &init_count_mount, 0, "mount init calls"); 118 static int init_count_mount_fslabel; 119 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_mount_fslabel, CTLFLAG_RD, 120 &init_count_mount_fslabel, 0, "mount_fslabel init calls"); 121 static int init_count_socket; 122 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_socket, CTLFLAG_RD, 123 &init_count_socket, 0, "socket init calls"); 124 static int init_count_socket_peerlabel; 125 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_socket_peerlabel, 126 CTLFLAG_RD, &init_count_socket_peerlabel, 0, 127 "socket_peerlabel init calls"); 128 static int init_count_pipe; 129 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_pipe, CTLFLAG_RD, 130 &init_count_pipe, 0, "pipe init calls"); 131 static int init_count_vnode; 132 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_vnode, CTLFLAG_RD, 133 &init_count_vnode, 0, "vnode init calls"); 134 135 static int destroy_count_bpfdesc; 136 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_bpfdesc, CTLFLAG_RD, 137 &destroy_count_bpfdesc, 0, "bpfdesc destroy calls"); 138 static int destroy_count_cred; 139 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_cred, CTLFLAG_RD, 140 &destroy_count_cred, 0, "cred destroy calls"); 141 static int destroy_count_devfsdirent; 142 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_devfsdirent, CTLFLAG_RD, 143 &destroy_count_devfsdirent, 0, "devfsdirent destroy calls"); 144 static int destroy_count_ifnet; 145 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_ifnet, CTLFLAG_RD, 146 &destroy_count_ifnet, 0, "ifnet destroy calls"); 147 static int destroy_count_ipq; 148 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_ipq, CTLFLAG_RD, 149 &destroy_count_ipq, 0, "ipq destroy calls"); 150 static int destroy_count_mbuf; 151 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_mbuf, CTLFLAG_RD, 152 &destroy_count_mbuf, 0, "mbuf destroy calls"); 153 static int destroy_count_mount; 154 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_mount, CTLFLAG_RD, 155 &destroy_count_mount, 0, "mount destroy calls"); 156 static int destroy_count_mount_fslabel; 157 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_mount_fslabel, 158 CTLFLAG_RD, &destroy_count_mount_fslabel, 0, 159 "mount_fslabel destroy calls"); 160 static int destroy_count_socket; 161 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_socket, CTLFLAG_RD, 162 &destroy_count_socket, 0, "socket destroy calls"); 163 static int destroy_count_socket_peerlabel; 164 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_socket_peerlabel, 165 CTLFLAG_RD, &destroy_count_socket_peerlabel, 0, 166 "socket_peerlabel destroy calls"); 167 static int destroy_count_pipe; 168 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_pipe, CTLFLAG_RD, 169 &destroy_count_pipe, 0, "pipe destroy calls"); 170 static int destroy_count_vnode; 171 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_vnode, CTLFLAG_RD, 172 &destroy_count_vnode, 0, "vnode destroy calls"); 173 174 static int externalize_count; 175 SYSCTL_INT(_security_mac_test, OID_AUTO, externalize_count, CTLFLAG_RD, 176 &externalize_count, 0, "Subject/object externalize calls"); 177 static int internalize_count; 178 SYSCTL_INT(_security_mac_test, OID_AUTO, internalize_count, CTLFLAG_RD, 179 &internalize_count, 0, "Subject/object internalize calls"); 180 181 /* 182 * Policy module operations. 183 */ 184 static void 185 mac_test_destroy(struct mac_policy_conf *conf) 186 { 187 188 } 189 190 static void 191 mac_test_init(struct mac_policy_conf *conf) 192 { 193 194 } 195 196 static int 197 mac_test_syscall(struct thread *td, int call, void *arg) 198 { 199 200 return (0); 201 } 202 203 /* 204 * Label operations. 205 */ 206 static void 207 mac_test_init_bpfdesc_label(struct label *label) 208 { 209 210 SLOT(label) = BPFMAGIC; 211 atomic_add_int(&init_count_bpfdesc, 1); 212 } 213 214 static void 215 mac_test_init_cred_label(struct label *label) 216 { 217 218 SLOT(label) = CREDMAGIC; 219 atomic_add_int(&init_count_cred, 1); 220 } 221 222 static void 223 mac_test_init_devfsdirent_label(struct label *label) 224 { 225 226 SLOT(label) = DEVFSMAGIC; 227 atomic_add_int(&init_count_devfsdirent, 1); 228 } 229 230 static void 231 mac_test_init_ifnet_label(struct label *label) 232 { 233 234 SLOT(label) = IFNETMAGIC; 235 atomic_add_int(&init_count_ifnet, 1); 236 } 237 238 static void 239 mac_test_init_ipq_label(struct label *label) 240 { 241 242 SLOT(label) = IPQMAGIC; 243 atomic_add_int(&init_count_ipq, 1); 244 } 245 246 static int 247 mac_test_init_mbuf_label(struct label *label, int flag) 248 { 249 250 SLOT(label) = MBUFMAGIC; 251 atomic_add_int(&init_count_mbuf, 1); 252 return (0); 253 } 254 255 static void 256 mac_test_init_mount_label(struct label *label) 257 { 258 259 SLOT(label) = MOUNTMAGIC; 260 atomic_add_int(&init_count_mount, 1); 261 } 262 263 static void 264 mac_test_init_mount_fs_label(struct label *label) 265 { 266 267 SLOT(label) = MOUNTMAGIC; 268 atomic_add_int(&init_count_mount_fslabel, 1); 269 } 270 271 static int 272 mac_test_init_socket_label(struct label *label, int flag) 273 { 274 275 SLOT(label) = SOCKETMAGIC; 276 atomic_add_int(&init_count_socket, 1); 277 return (0); 278 } 279 280 static int 281 mac_test_init_socket_peer_label(struct label *label, int flag) 282 { 283 284 SLOT(label) = SOCKETMAGIC; 285 atomic_add_int(&init_count_socket_peerlabel, 1); 286 return (0); 287 } 288 289 static void 290 mac_test_init_pipe_label(struct label *label) 291 { 292 293 SLOT(label) = PIPEMAGIC; 294 atomic_add_int(&init_count_pipe, 1); 295 } 296 297 static void 298 mac_test_init_vnode_label(struct label *label) 299 { 300 301 SLOT(label) = VNODEMAGIC; 302 atomic_add_int(&init_count_vnode, 1); 303 } 304 305 static void 306 mac_test_destroy_bpfdesc_label(struct label *label) 307 { 308 309 if (SLOT(label) == BPFMAGIC || SLOT(label) == 0) { 310 atomic_add_int(&destroy_count_bpfdesc, 1); 311 SLOT(label) = EXMAGIC; 312 } else if (SLOT(label) == EXMAGIC) { 313 Debugger("mac_test_destroy_bpfdesc: dup destroy"); 314 } else { 315 Debugger("mac_test_destroy_bpfdesc: corrupted label"); 316 } 317 } 318 319 static void 320 mac_test_destroy_cred_label(struct label *label) 321 { 322 323 if (SLOT(label) == CREDMAGIC || SLOT(label) == 0) { 324 atomic_add_int(&destroy_count_cred, 1); 325 SLOT(label) = EXMAGIC; 326 } else if (SLOT(label) == EXMAGIC) { 327 Debugger("mac_test_destroy_cred: dup destroy"); 328 } else { 329 Debugger("mac_test_destroy_cred: corrupted label"); 330 } 331 } 332 333 static void 334 mac_test_destroy_devfsdirent_label(struct label *label) 335 { 336 337 if (SLOT(label) == DEVFSMAGIC || SLOT(label) == 0) { 338 atomic_add_int(&destroy_count_devfsdirent, 1); 339 SLOT(label) = EXMAGIC; 340 } else if (SLOT(label) == EXMAGIC) { 341 Debugger("mac_test_destroy_devfsdirent: dup destroy"); 342 } else { 343 Debugger("mac_test_destroy_devfsdirent: corrupted label"); 344 } 345 } 346 347 static void 348 mac_test_destroy_ifnet_label(struct label *label) 349 { 350 351 if (SLOT(label) == IFNETMAGIC || SLOT(label) == 0) { 352 atomic_add_int(&destroy_count_ifnet, 1); 353 SLOT(label) = EXMAGIC; 354 } else if (SLOT(label) == EXMAGIC) { 355 Debugger("mac_test_destroy_ifnet: dup destroy"); 356 } else { 357 Debugger("mac_test_destroy_ifnet: corrupted label"); 358 } 359 } 360 361 static void 362 mac_test_destroy_ipq_label(struct label *label) 363 { 364 365 if (SLOT(label) == IPQMAGIC || SLOT(label) == 0) { 366 atomic_add_int(&destroy_count_ipq, 1); 367 SLOT(label) = EXMAGIC; 368 } else if (SLOT(label) == EXMAGIC) { 369 Debugger("mac_test_destroy_ipq: dup destroy"); 370 } else { 371 Debugger("mac_test_destroy_ipq: corrupted label"); 372 } 373 } 374 375 static void 376 mac_test_destroy_mbuf_label(struct label *label) 377 { 378 379 if (SLOT(label) == MBUFMAGIC || SLOT(label) == 0) { 380 atomic_add_int(&destroy_count_mbuf, 1); 381 SLOT(label) = EXMAGIC; 382 } else if (SLOT(label) == EXMAGIC) { 383 Debugger("mac_test_destroy_mbuf: dup destroy"); 384 } else { 385 Debugger("mac_test_destroy_mbuf: corrupted label"); 386 } 387 } 388 389 static void 390 mac_test_destroy_mount_label(struct label *label) 391 { 392 393 if ((SLOT(label) == MOUNTMAGIC || SLOT(label) == 0)) { 394 atomic_add_int(&destroy_count_mount, 1); 395 SLOT(label) = EXMAGIC; 396 } else if (SLOT(label) == EXMAGIC) { 397 Debugger("mac_test_destroy_mount: dup destroy"); 398 } else { 399 Debugger("mac_test_destroy_mount: corrupted label"); 400 } 401 } 402 403 static void 404 mac_test_destroy_mount_fs_label(struct label *label) 405 { 406 407 if ((SLOT(label) == MOUNTMAGIC || SLOT(label) == 0)) { 408 atomic_add_int(&destroy_count_mount_fslabel, 1); 409 SLOT(label) = EXMAGIC; 410 } else if (SLOT(label) == EXMAGIC) { 411 Debugger("mac_test_destroy_mount_fslabel: dup destroy"); 412 } else { 413 Debugger("mac_test_destroy_mount_fslabel: corrupted label"); 414 } 415 } 416 417 static void 418 mac_test_destroy_socket_label(struct label *label) 419 { 420 421 if ((SLOT(label) == SOCKETMAGIC || SLOT(label) == 0)) { 422 atomic_add_int(&destroy_count_socket, 1); 423 SLOT(label) = EXMAGIC; 424 } else if (SLOT(label) == EXMAGIC) { 425 Debugger("mac_test_destroy_socket: dup destroy"); 426 } else { 427 Debugger("mac_test_destroy_socket: corrupted label"); 428 } 429 } 430 431 static void 432 mac_test_destroy_socket_peer_label(struct label *label) 433 { 434 435 if ((SLOT(label) == SOCKETMAGIC || SLOT(label) == 0)) { 436 atomic_add_int(&destroy_count_socket_peerlabel, 1); 437 SLOT(label) = EXMAGIC; 438 } else if (SLOT(label) == EXMAGIC) { 439 Debugger("mac_test_destroy_socket_peerlabel: dup destroy"); 440 } else { 441 Debugger("mac_test_destroy_socket_peerlabel: corrupted label"); 442 } 443 } 444 445 static void 446 mac_test_destroy_pipe_label(struct label *label) 447 { 448 449 if ((SLOT(label) == PIPEMAGIC || SLOT(label) == 0)) { 450 atomic_add_int(&destroy_count_pipe, 1); 451 SLOT(label) = EXMAGIC; 452 } else if (SLOT(label) == EXMAGIC) { 453 Debugger("mac_test_destroy_pipe: dup destroy"); 454 } else { 455 Debugger("mac_test_destroy_pipe: corrupted label"); 456 } 457 } 458 459 static void 460 mac_test_destroy_vnode_label(struct label *label) 461 { 462 463 if (SLOT(label) == VNODEMAGIC || SLOT(label) == 0) { 464 atomic_add_int(&destroy_count_vnode, 1); 465 SLOT(label) = EXMAGIC; 466 } else if (SLOT(label) == EXMAGIC) { 467 Debugger("mac_test_destroy_vnode: dup destroy"); 468 } else { 469 Debugger("mac_test_destroy_vnode: corrupted label"); 470 } 471 } 472 473 static int 474 mac_test_externalize_label(struct label *label, char *element_name, 475 char *element_data, size_t size, size_t *len, int *claimed) 476 { 477 478 atomic_add_int(&externalize_count, 1); 479 480 return (0); 481 } 482 483 static int 484 mac_test_internalize_label(struct label *label, char *element_name, 485 char *element_data, int *claimed) 486 { 487 488 atomic_add_int(&internalize_count, 1); 489 490 return (0); 491 } 492 493 /* 494 * Labeling event operations: file system objects, and things that look 495 * a lot like file system objects. 496 */ 497 static void 498 mac_test_associate_vnode_devfs(struct mount *mp, struct label *fslabel, 499 struct devfs_dirent *de, struct label *delabel, struct vnode *vp, 500 struct label *vlabel) 501 { 502 503 } 504 505 static int 506 mac_test_associate_vnode_extattr(struct mount *mp, struct label *fslabel, 507 struct vnode *vp, struct label *vlabel) 508 { 509 510 return (0); 511 } 512 513 static void 514 mac_test_associate_vnode_singlelabel(struct mount *mp, 515 struct label *fslabel, struct vnode *vp, struct label *vlabel) 516 { 517 518 } 519 520 static void 521 mac_test_create_devfs_device(dev_t dev, struct devfs_dirent *devfs_dirent, 522 struct label *label) 523 { 524 525 } 526 527 static void 528 mac_test_create_devfs_directory(char *dirname, int dirnamelen, 529 struct devfs_dirent *devfs_dirent, struct label *label) 530 { 531 532 } 533 534 static void 535 mac_test_create_devfs_symlink(struct ucred *cred, struct devfs_dirent *dd, 536 struct label *ddlabel, struct devfs_dirent *de, struct label *delabel) 537 { 538 539 } 540 541 static void 542 mac_test_create_devfs_vnode(struct devfs_dirent *devfs_dirent, 543 struct label *direntlabel, struct vnode *vp, struct label *vnodelabel) 544 { 545 546 } 547 548 static int 549 mac_test_create_vnode_extattr(struct ucred *cred, struct mount *mp, 550 struct label *fslabel, struct vnode *dvp, struct label *dlabel, 551 struct vnode *vp, struct label *vlabel, struct componentname *cnp) 552 { 553 554 return (0); 555 } 556 557 static void 558 mac_test_create_mount(struct ucred *cred, struct mount *mp, 559 struct label *mntlabel, struct label *fslabel) 560 { 561 562 } 563 564 static void 565 mac_test_create_root_mount(struct ucred *cred, struct mount *mp, 566 struct label *mntlabel, struct label *fslabel) 567 { 568 569 } 570 571 static void 572 mac_test_relabel_vnode(struct ucred *cred, struct vnode *vp, 573 struct label *vnodelabel, struct label *label) 574 { 575 576 } 577 578 static int 579 mac_test_setlabel_vnode_extattr(struct ucred *cred, struct vnode *vp, 580 struct label *vlabel, struct label *intlabel) 581 { 582 583 return (0); 584 } 585 586 static void 587 mac_test_update_devfsdirent(struct devfs_dirent *devfs_dirent, 588 struct label *direntlabel, struct vnode *vp, struct label *vnodelabel) 589 { 590 591 } 592 593 /* 594 * Labeling event operations: IPC object. 595 */ 596 static void 597 mac_test_create_mbuf_from_socket(struct socket *so, struct label *socketlabel, 598 struct mbuf *m, struct label *mbuflabel) 599 { 600 601 } 602 603 static void 604 mac_test_create_socket(struct ucred *cred, struct socket *socket, 605 struct label *socketlabel) 606 { 607 608 } 609 610 static void 611 mac_test_create_pipe(struct ucred *cred, struct pipe *pipe, 612 struct label *pipelabel) 613 { 614 615 } 616 617 static void 618 mac_test_create_socket_from_socket(struct socket *oldsocket, 619 struct label *oldsocketlabel, struct socket *newsocket, 620 struct label *newsocketlabel) 621 { 622 623 } 624 625 static void 626 mac_test_relabel_socket(struct ucred *cred, struct socket *socket, 627 struct label *socketlabel, struct label *newlabel) 628 { 629 630 } 631 632 static void 633 mac_test_relabel_pipe(struct ucred *cred, struct pipe *pipe, 634 struct label *pipelabel, struct label *newlabel) 635 { 636 637 } 638 639 static void 640 mac_test_set_socket_peer_from_mbuf(struct mbuf *mbuf, struct label *mbuflabel, 641 struct socket *socket, struct label *socketpeerlabel) 642 { 643 644 } 645 646 /* 647 * Labeling event operations: network objects. 648 */ 649 static void 650 mac_test_set_socket_peer_from_socket(struct socket *oldsocket, 651 struct label *oldsocketlabel, struct socket *newsocket, 652 struct label *newsocketpeerlabel) 653 { 654 655 } 656 657 static void 658 mac_test_create_bpfdesc(struct ucred *cred, struct bpf_d *bpf_d, 659 struct label *bpflabel) 660 { 661 662 } 663 664 static void 665 mac_test_create_datagram_from_ipq(struct ipq *ipq, struct label *ipqlabel, 666 struct mbuf *datagram, struct label *datagramlabel) 667 { 668 669 } 670 671 static void 672 mac_test_create_fragment(struct mbuf *datagram, struct label *datagramlabel, 673 struct mbuf *fragment, struct label *fragmentlabel) 674 { 675 676 } 677 678 static void 679 mac_test_create_ifnet(struct ifnet *ifnet, struct label *ifnetlabel) 680 { 681 682 } 683 684 static void 685 mac_test_create_ipq(struct mbuf *fragment, struct label *fragmentlabel, 686 struct ipq *ipq, struct label *ipqlabel) 687 { 688 689 } 690 691 static void 692 mac_test_create_mbuf_from_mbuf(struct mbuf *oldmbuf, 693 struct label *oldmbuflabel, struct mbuf *newmbuf, 694 struct label *newmbuflabel) 695 { 696 697 } 698 699 static void 700 mac_test_create_mbuf_linklayer(struct ifnet *ifnet, struct label *ifnetlabel, 701 struct mbuf *mbuf, struct label *mbuflabel) 702 { 703 704 } 705 706 static void 707 mac_test_create_mbuf_from_bpfdesc(struct bpf_d *bpf_d, struct label *bpflabel, 708 struct mbuf *mbuf, struct label *mbuflabel) 709 { 710 711 } 712 713 static void 714 mac_test_create_mbuf_from_ifnet(struct ifnet *ifnet, struct label *ifnetlabel, 715 struct mbuf *m, struct label *mbuflabel) 716 { 717 718 } 719 720 static void 721 mac_test_create_mbuf_multicast_encap(struct mbuf *oldmbuf, 722 struct label *oldmbuflabel, struct ifnet *ifnet, struct label *ifnetlabel, 723 struct mbuf *newmbuf, struct label *newmbuflabel) 724 { 725 726 } 727 728 static void 729 mac_test_create_mbuf_netlayer(struct mbuf *oldmbuf, 730 struct label *oldmbuflabel, struct mbuf *newmbuf, 731 struct label *newmbuflabel) 732 { 733 734 } 735 736 static int 737 mac_test_fragment_match(struct mbuf *fragment, struct label *fragmentlabel, 738 struct ipq *ipq, struct label *ipqlabel) 739 { 740 741 return (1); 742 } 743 744 static void 745 mac_test_relabel_ifnet(struct ucred *cred, struct ifnet *ifnet, 746 struct label *ifnetlabel, struct label *newlabel) 747 { 748 749 } 750 751 static void 752 mac_test_update_ipq(struct mbuf *fragment, struct label *fragmentlabel, 753 struct ipq *ipq, struct label *ipqlabel) 754 { 755 756 } 757 758 /* 759 * Labeling event operations: processes. 760 */ 761 static void 762 mac_test_create_cred(struct ucred *cred_parent, struct ucred *cred_child) 763 { 764 765 } 766 767 static void 768 mac_test_execve_transition(struct ucred *old, struct ucred *new, 769 struct vnode *vp, struct label *filelabel) 770 { 771 772 } 773 774 static int 775 mac_test_execve_will_transition(struct ucred *old, struct vnode *vp, 776 struct label *filelabel) 777 { 778 779 return (0); 780 } 781 782 static void 783 mac_test_create_proc0(struct ucred *cred) 784 { 785 786 } 787 788 static void 789 mac_test_create_proc1(struct ucred *cred) 790 { 791 792 } 793 794 static void 795 mac_test_relabel_cred(struct ucred *cred, struct label *newlabel) 796 { 797 798 } 799 800 /* 801 * Access control checks. 802 */ 803 static int 804 mac_test_check_bpfdesc_receive(struct bpf_d *bpf_d, struct label *bpflabel, 805 struct ifnet *ifnet, struct label *ifnetlabel) 806 { 807 808 return (0); 809 } 810 811 static int 812 mac_test_check_cred_relabel(struct ucred *cred, struct label *newlabel) 813 { 814 815 return (0); 816 } 817 818 static int 819 mac_test_check_cred_visible(struct ucred *u1, struct ucred *u2) 820 { 821 822 return (0); 823 } 824 825 static int 826 mac_test_check_ifnet_relabel(struct ucred *cred, struct ifnet *ifnet, 827 struct label *ifnetlabel, struct label *newlabel) 828 { 829 830 return (0); 831 } 832 833 static int 834 mac_test_check_ifnet_transmit(struct ifnet *ifnet, struct label *ifnetlabel, 835 struct mbuf *m, struct label *mbuflabel) 836 { 837 838 return (0); 839 } 840 841 static int 842 mac_test_check_mount_stat(struct ucred *cred, struct mount *mp, 843 struct label *mntlabel) 844 { 845 846 return (0); 847 } 848 849 static int 850 mac_test_check_pipe_ioctl(struct ucred *cred, struct pipe *pipe, 851 struct label *pipelabel, unsigned long cmd, void /* caddr_t */ *data) 852 { 853 854 return (0); 855 } 856 857 static int 858 mac_test_check_pipe_poll(struct ucred *cred, struct pipe *pipe, 859 struct label *pipelabel) 860 { 861 862 return (0); 863 } 864 865 static int 866 mac_test_check_pipe_read(struct ucred *cred, struct pipe *pipe, 867 struct label *pipelabel) 868 { 869 870 return (0); 871 } 872 873 static int 874 mac_test_check_pipe_relabel(struct ucred *cred, struct pipe *pipe, 875 struct label *pipelabel, struct label *newlabel) 876 { 877 878 return (0); 879 } 880 881 static int 882 mac_test_check_pipe_stat(struct ucred *cred, struct pipe *pipe, 883 struct label *pipelabel) 884 { 885 886 return (0); 887 } 888 889 static int 890 mac_test_check_pipe_write(struct ucred *cred, struct pipe *pipe, 891 struct label *pipelabel) 892 { 893 894 return (0); 895 } 896 897 static int 898 mac_test_check_proc_debug(struct ucred *cred, struct proc *proc) 899 { 900 901 return (0); 902 } 903 904 static int 905 mac_test_check_proc_sched(struct ucred *cred, struct proc *proc) 906 { 907 908 return (0); 909 } 910 911 static int 912 mac_test_check_proc_signal(struct ucred *cred, struct proc *proc, int signum) 913 { 914 915 return (0); 916 } 917 918 static int 919 mac_test_check_socket_bind(struct ucred *cred, struct socket *socket, 920 struct label *socketlabel, struct sockaddr *sockaddr) 921 { 922 923 return (0); 924 } 925 926 static int 927 mac_test_check_socket_connect(struct ucred *cred, struct socket *socket, 928 struct label *socketlabel, struct sockaddr *sockaddr) 929 { 930 931 return (0); 932 } 933 934 static int 935 mac_test_check_socket_deliver(struct socket *socket, struct label *socketlabel, 936 struct mbuf *m, struct label *mbuflabel) 937 { 938 939 return (0); 940 } 941 942 static int 943 mac_test_check_socket_listen(struct ucred *cred, struct socket *socket, 944 struct label *socketlabel) 945 { 946 947 return (0); 948 } 949 950 static int 951 mac_test_check_socket_visible(struct ucred *cred, struct socket *socket, 952 struct label *socketlabel) 953 { 954 955 return (0); 956 } 957 958 static int 959 mac_test_check_socket_relabel(struct ucred *cred, struct socket *socket, 960 struct label *socketlabel, struct label *newlabel) 961 { 962 963 return (0); 964 } 965 966 static int 967 mac_test_check_vnode_access(struct ucred *cred, struct vnode *vp, 968 struct label *label, int acc_mode) 969 { 970 971 return (0); 972 } 973 974 static int 975 mac_test_check_vnode_chdir(struct ucred *cred, struct vnode *dvp, 976 struct label *dlabel) 977 { 978 979 return (0); 980 } 981 982 static int 983 mac_test_check_vnode_chroot(struct ucred *cred, struct vnode *dvp, 984 struct label *dlabel) 985 { 986 987 return (0); 988 } 989 990 static int 991 mac_test_check_vnode_create(struct ucred *cred, struct vnode *dvp, 992 struct label *dlabel, struct componentname *cnp, struct vattr *vap) 993 { 994 995 return (0); 996 } 997 998 static int 999 mac_test_check_vnode_delete(struct ucred *cred, struct vnode *dvp, 1000 struct label *dlabel, struct vnode *vp, struct label *label, 1001 struct componentname *cnp) 1002 { 1003 1004 return (0); 1005 } 1006 1007 static int 1008 mac_test_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp, 1009 struct label *label, acl_type_t type) 1010 { 1011 1012 return (0); 1013 } 1014 1015 static int 1016 mac_test_check_vnode_exec(struct ucred *cred, struct vnode *vp, 1017 struct label *label) 1018 { 1019 1020 return (0); 1021 } 1022 1023 static int 1024 mac_test_check_vnode_getacl(struct ucred *cred, struct vnode *vp, 1025 struct label *label, acl_type_t type) 1026 { 1027 1028 return (0); 1029 } 1030 1031 static int 1032 mac_test_check_vnode_getextattr(struct ucred *cred, struct vnode *vp, 1033 struct label *label, int attrnamespace, const char *name, struct uio *uio) 1034 { 1035 1036 return (0); 1037 } 1038 1039 static int 1040 mac_test_check_vnode_link(struct ucred *cred, struct vnode *dvp, 1041 struct label *dlabel, struct vnode *vp, struct label *label, 1042 struct componentname *cnp) 1043 { 1044 1045 return (0); 1046 } 1047 1048 static int 1049 mac_test_check_vnode_lookup(struct ucred *cred, struct vnode *dvp, 1050 struct label *dlabel, struct componentname *cnp) 1051 { 1052 1053 return (0); 1054 } 1055 1056 static int 1057 mac_test_check_vnode_mmap(struct ucred *cred, struct vnode *vp, 1058 struct label *label, int prot) 1059 { 1060 1061 return (0); 1062 } 1063 1064 static int 1065 mac_test_check_vnode_mprotect(struct ucred *cred, struct vnode *vp, 1066 struct label *label, int prot) 1067 { 1068 1069 return (0); 1070 } 1071 1072 static int 1073 mac_test_check_vnode_open(struct ucred *cred, struct vnode *vp, 1074 struct label *filelabel, int acc_mode) 1075 { 1076 1077 return (0); 1078 } 1079 1080 static int 1081 mac_test_check_vnode_poll(struct ucred *active_cred, struct ucred *file_cred, 1082 struct vnode *vp, struct label *label) 1083 { 1084 1085 return (0); 1086 } 1087 1088 static int 1089 mac_test_check_vnode_read(struct ucred *active_cred, struct ucred *file_cred, 1090 struct vnode *vp, struct label *label) 1091 { 1092 1093 return (0); 1094 } 1095 1096 static int 1097 mac_test_check_vnode_readdir(struct ucred *cred, struct vnode *dvp, 1098 struct label *dlabel) 1099 { 1100 1101 return (0); 1102 } 1103 1104 static int 1105 mac_test_check_vnode_readlink(struct ucred *cred, struct vnode *vp, 1106 struct label *vnodelabel) 1107 { 1108 1109 return (0); 1110 } 1111 1112 static int 1113 mac_test_check_vnode_relabel(struct ucred *cred, struct vnode *vp, 1114 struct label *vnodelabel, struct label *newlabel) 1115 { 1116 1117 return (0); 1118 } 1119 1120 static int 1121 mac_test_check_vnode_rename_from(struct ucred *cred, struct vnode *dvp, 1122 struct label *dlabel, struct vnode *vp, struct label *label, 1123 struct componentname *cnp) 1124 { 1125 1126 return (0); 1127 } 1128 1129 static int 1130 mac_test_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp, 1131 struct label *dlabel, struct vnode *vp, struct label *label, int samedir, 1132 struct componentname *cnp) 1133 { 1134 1135 return (0); 1136 } 1137 1138 static int 1139 mac_test_check_vnode_revoke(struct ucred *cred, struct vnode *vp, 1140 struct label *label) 1141 { 1142 1143 return (0); 1144 } 1145 1146 static int 1147 mac_test_check_vnode_setacl(struct ucred *cred, struct vnode *vp, 1148 struct label *label, acl_type_t type, struct acl *acl) 1149 { 1150 1151 return (0); 1152 } 1153 1154 static int 1155 mac_test_check_vnode_setextattr(struct ucred *cred, struct vnode *vp, 1156 struct label *label, int attrnamespace, const char *name, struct uio *uio) 1157 { 1158 1159 return (0); 1160 } 1161 1162 static int 1163 mac_test_check_vnode_setflags(struct ucred *cred, struct vnode *vp, 1164 struct label *label, u_long flags) 1165 { 1166 1167 return (0); 1168 } 1169 1170 static int 1171 mac_test_check_vnode_setmode(struct ucred *cred, struct vnode *vp, 1172 struct label *label, mode_t mode) 1173 { 1174 1175 return (0); 1176 } 1177 1178 static int 1179 mac_test_check_vnode_setowner(struct ucred *cred, struct vnode *vp, 1180 struct label *label, uid_t uid, gid_t gid) 1181 { 1182 1183 return (0); 1184 } 1185 1186 static int 1187 mac_test_check_vnode_setutimes(struct ucred *cred, struct vnode *vp, 1188 struct label *label, struct timespec atime, struct timespec mtime) 1189 { 1190 1191 return (0); 1192 } 1193 1194 static int 1195 mac_test_check_vnode_stat(struct ucred *active_cred, struct ucred *file_cred, 1196 struct vnode *vp, struct label *label) 1197 { 1198 1199 return (0); 1200 } 1201 1202 static int 1203 mac_test_check_vnode_write(struct ucred *active_cred, 1204 struct ucred *file_cred, struct vnode *vp, struct label *label) 1205 { 1206 1207 return (0); 1208 } 1209 1210 static struct mac_policy_ops mac_test_ops = 1211 { 1212 .mpo_destroy = mac_test_destroy, 1213 .mpo_init = mac_test_init, 1214 .mpo_syscall = mac_test_syscall, 1215 .mpo_init_bpfdesc_label = mac_test_init_bpfdesc_label, 1216 .mpo_init_cred_label = mac_test_init_cred_label, 1217 .mpo_init_devfsdirent_label = mac_test_init_devfsdirent_label, 1218 .mpo_init_ifnet_label = mac_test_init_ifnet_label, 1219 .mpo_init_ipq_label = mac_test_init_ipq_label, 1220 .mpo_init_mbuf_label = mac_test_init_mbuf_label, 1221 .mpo_init_mount_label = mac_test_init_mount_label, 1222 .mpo_init_mount_fs_label = mac_test_init_mount_fs_label, 1223 .mpo_init_pipe_label = mac_test_init_pipe_label, 1224 .mpo_init_socket_label = mac_test_init_socket_label, 1225 .mpo_init_socket_peer_label = mac_test_init_socket_peer_label, 1226 .mpo_init_vnode_label = mac_test_init_vnode_label, 1227 .mpo_destroy_bpfdesc_label = mac_test_destroy_bpfdesc_label, 1228 .mpo_destroy_cred_label = mac_test_destroy_cred_label, 1229 .mpo_destroy_devfsdirent_label = mac_test_destroy_devfsdirent_label, 1230 .mpo_destroy_ifnet_label = mac_test_destroy_ifnet_label, 1231 .mpo_destroy_ipq_label = mac_test_destroy_ipq_label, 1232 .mpo_destroy_mbuf_label = mac_test_destroy_mbuf_label, 1233 .mpo_destroy_mount_label = mac_test_destroy_mount_label, 1234 .mpo_destroy_mount_fs_label = mac_test_destroy_mount_fs_label, 1235 .mpo_destroy_pipe_label = mac_test_destroy_pipe_label, 1236 .mpo_destroy_socket_label = mac_test_destroy_socket_label, 1237 .mpo_destroy_socket_peer_label = mac_test_destroy_socket_peer_label, 1238 .mpo_destroy_vnode_label = mac_test_destroy_vnode_label, 1239 .mpo_externalize_cred_label = mac_test_externalize_label, 1240 .mpo_externalize_ifnet_label = mac_test_externalize_label, 1241 .mpo_externalize_pipe_label = mac_test_externalize_label, 1242 .mpo_externalize_socket_label = mac_test_externalize_label, 1243 .mpo_externalize_socket_peer_label = mac_test_externalize_label, 1244 .mpo_externalize_vnode_label = mac_test_externalize_label, 1245 .mpo_internalize_cred_label = mac_test_internalize_label, 1246 .mpo_internalize_ifnet_label = mac_test_internalize_label, 1247 .mpo_internalize_pipe_label = mac_test_internalize_label, 1248 .mpo_internalize_socket_label = mac_test_internalize_label, 1249 .mpo_internalize_vnode_label = mac_test_internalize_label, 1250 .mpo_associate_vnode_devfs = mac_test_associate_vnode_devfs, 1251 .mpo_associate_vnode_extattr = mac_test_associate_vnode_extattr, 1252 .mpo_associate_vnode_singlelabel = mac_test_associate_vnode_singlelabel, 1253 .mpo_create_devfs_device = mac_test_create_devfs_device, 1254 .mpo_create_devfs_directory = mac_test_create_devfs_directory, 1255 .mpo_create_devfs_symlink = mac_test_create_devfs_symlink, 1256 .mpo_create_devfs_vnode = mac_test_create_devfs_vnode, 1257 .mpo_create_vnode_extattr = mac_test_create_vnode_extattr, 1258 .mpo_create_mount = mac_test_create_mount, 1259 .mpo_create_root_mount = mac_test_create_root_mount, 1260 .mpo_relabel_vnode = mac_test_relabel_vnode, 1261 .mpo_setlabel_vnode_extattr = mac_test_setlabel_vnode_extattr, 1262 .mpo_update_devfsdirent = mac_test_update_devfsdirent, 1263 .mpo_create_mbuf_from_socket = mac_test_create_mbuf_from_socket, 1264 .mpo_create_pipe = mac_test_create_pipe, 1265 .mpo_create_socket = mac_test_create_socket, 1266 .mpo_create_socket_from_socket = mac_test_create_socket_from_socket, 1267 .mpo_relabel_pipe = mac_test_relabel_pipe, 1268 .mpo_relabel_socket = mac_test_relabel_socket, 1269 .mpo_set_socket_peer_from_mbuf = mac_test_set_socket_peer_from_mbuf, 1270 .mpo_set_socket_peer_from_socket = mac_test_set_socket_peer_from_socket, 1271 .mpo_create_bpfdesc = mac_test_create_bpfdesc, 1272 .mpo_create_ifnet = mac_test_create_ifnet, 1273 .mpo_create_datagram_from_ipq = mac_test_create_datagram_from_ipq, 1274 .mpo_create_fragment = mac_test_create_fragment, 1275 .mpo_create_ipq = mac_test_create_ipq, 1276 .mpo_create_mbuf_from_mbuf = mac_test_create_mbuf_from_mbuf, 1277 .mpo_create_mbuf_linklayer = mac_test_create_mbuf_linklayer, 1278 .mpo_create_mbuf_from_bpfdesc = mac_test_create_mbuf_from_bpfdesc, 1279 .mpo_create_mbuf_from_ifnet = mac_test_create_mbuf_from_ifnet, 1280 .mpo_create_mbuf_multicast_encap = mac_test_create_mbuf_multicast_encap, 1281 .mpo_create_mbuf_netlayer = mac_test_create_mbuf_netlayer, 1282 .mpo_fragment_match = mac_test_fragment_match, 1283 .mpo_relabel_ifnet = mac_test_relabel_ifnet, 1284 .mpo_update_ipq = mac_test_update_ipq, 1285 .mpo_create_cred = mac_test_create_cred, 1286 .mpo_execve_transition = mac_test_execve_transition, 1287 .mpo_execve_will_transition = mac_test_execve_will_transition, 1288 .mpo_create_proc0 = mac_test_create_proc0, 1289 .mpo_create_proc1 = mac_test_create_proc1, 1290 .mpo_relabel_cred = mac_test_relabel_cred, 1291 .mpo_check_bpfdesc_receive = mac_test_check_bpfdesc_receive, 1292 .mpo_check_cred_relabel = mac_test_check_cred_relabel, 1293 .mpo_check_cred_visible = mac_test_check_cred_visible, 1294 .mpo_check_ifnet_relabel = mac_test_check_ifnet_relabel, 1295 .mpo_check_ifnet_transmit = mac_test_check_ifnet_transmit, 1296 .mpo_check_mount_stat = mac_test_check_mount_stat, 1297 .mpo_check_pipe_ioctl = mac_test_check_pipe_ioctl, 1298 .mpo_check_pipe_poll = mac_test_check_pipe_poll, 1299 .mpo_check_pipe_read = mac_test_check_pipe_read, 1300 .mpo_check_pipe_relabel = mac_test_check_pipe_relabel, 1301 .mpo_check_pipe_stat = mac_test_check_pipe_stat, 1302 .mpo_check_pipe_write = mac_test_check_pipe_write, 1303 .mpo_check_proc_debug = mac_test_check_proc_debug, 1304 .mpo_check_proc_sched = mac_test_check_proc_sched, 1305 .mpo_check_proc_signal = mac_test_check_proc_signal, 1306 .mpo_check_socket_bind = mac_test_check_socket_bind, 1307 .mpo_check_socket_connect = mac_test_check_socket_connect, 1308 .mpo_check_socket_deliver = mac_test_check_socket_deliver, 1309 .mpo_check_socket_listen = mac_test_check_socket_listen, 1310 .mpo_check_socket_relabel = mac_test_check_socket_relabel, 1311 .mpo_check_socket_visible = mac_test_check_socket_visible, 1312 .mpo_check_vnode_access = mac_test_check_vnode_access, 1313 .mpo_check_vnode_chdir = mac_test_check_vnode_chdir, 1314 .mpo_check_vnode_chroot = mac_test_check_vnode_chroot, 1315 .mpo_check_vnode_create = mac_test_check_vnode_create, 1316 .mpo_check_vnode_delete = mac_test_check_vnode_delete, 1317 .mpo_check_vnode_deleteacl = mac_test_check_vnode_deleteacl, 1318 .mpo_check_vnode_exec = mac_test_check_vnode_exec, 1319 .mpo_check_vnode_getacl = mac_test_check_vnode_getacl, 1320 .mpo_check_vnode_getextattr = mac_test_check_vnode_getextattr, 1321 .mpo_check_vnode_link = mac_test_check_vnode_link, 1322 .mpo_check_vnode_lookup = mac_test_check_vnode_lookup, 1323 .mpo_check_vnode_mmap = mac_test_check_vnode_mmap, 1324 .mpo_check_vnode_mprotect = mac_test_check_vnode_mprotect, 1325 .mpo_check_vnode_open = mac_test_check_vnode_open, 1326 .mpo_check_vnode_poll = mac_test_check_vnode_poll, 1327 .mpo_check_vnode_read = mac_test_check_vnode_read, 1328 .mpo_check_vnode_readdir = mac_test_check_vnode_readdir, 1329 .mpo_check_vnode_readlink = mac_test_check_vnode_readlink, 1330 .mpo_check_vnode_relabel = mac_test_check_vnode_relabel, 1331 .mpo_check_vnode_rename_from = mac_test_check_vnode_rename_from, 1332 .mpo_check_vnode_rename_to = mac_test_check_vnode_rename_to, 1333 .mpo_check_vnode_revoke = mac_test_check_vnode_revoke, 1334 .mpo_check_vnode_setacl = mac_test_check_vnode_setacl, 1335 .mpo_check_vnode_setextattr = mac_test_check_vnode_setextattr, 1336 .mpo_check_vnode_setflags = mac_test_check_vnode_setflags, 1337 .mpo_check_vnode_setmode = mac_test_check_vnode_setmode, 1338 .mpo_check_vnode_setowner = mac_test_check_vnode_setowner, 1339 .mpo_check_vnode_setutimes = mac_test_check_vnode_setutimes, 1340 .mpo_check_vnode_stat = mac_test_check_vnode_stat, 1341 .mpo_check_vnode_write = mac_test_check_vnode_write, 1342 }; 1343 1344 MAC_POLICY_SET(&mac_test_ops, trustedbsd_mac_test, "TrustedBSD MAC/Test", 1345 MPC_LOADTIME_FLAG_UNLOADOK, &test_slot); 1346