1 /*- 2 * Copyright (c) 1999, 2000, 2001, 2002 Robert N. M. Watson 3 * Copyright (c) 2001, 2002 Networks Associates Technology, Inc. 4 * All rights reserved. 5 * 6 * This software was developed by Robert Watson for the TrustedBSD Project. 7 * 8 * This software was developed for the FreeBSD Project in part by Network 9 * Associates Laboratories, the Security Research Division of Network 10 * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), 11 * as part of the DARPA CHATS research program. 12 * 13 * Redistribution and use in source and binary forms, with or without 14 * modification, are permitted provided that the following conditions 15 * are met: 16 * 1. Redistributions of source code must retain the above copyright 17 * notice, this list of conditions and the following disclaimer. 18 * 2. Redistributions in binary form must reproduce the above copyright 19 * notice, this list of conditions and the following disclaimer in the 20 * documentation and/or other materials provided with the distribution. 21 * 22 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 23 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 24 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 25 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 26 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 27 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 28 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 29 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 30 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 31 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 32 * SUCH DAMAGE. 33 * 34 * $FreeBSD$ 35 */ 36 37 /* 38 * Developed by the TrustedBSD Project. 39 * Generic mandatory access module that does nothing. 40 */ 41 42 #include <sys/types.h> 43 #include <sys/param.h> 44 #include <sys/acl.h> 45 #include <sys/conf.h> 46 #include <sys/extattr.h> 47 #include <sys/kernel.h> 48 #include <sys/mac.h> 49 #include <sys/mount.h> 50 #include <sys/proc.h> 51 #include <sys/systm.h> 52 #include <sys/sysproto.h> 53 #include <sys/sysent.h> 54 #include <sys/vnode.h> 55 #include <sys/file.h> 56 #include <sys/socket.h> 57 #include <sys/socketvar.h> 58 #include <sys/sysctl.h> 59 60 #include <fs/devfs/devfs.h> 61 62 #include <net/bpfdesc.h> 63 #include <net/if.h> 64 #include <net/if_types.h> 65 #include <net/if_var.h> 66 67 #include <vm/vm.h> 68 69 #include <sys/mac_policy.h> 70 71 SYSCTL_DECL(_security_mac); 72 73 SYSCTL_NODE(_security_mac, OID_AUTO, test, CTLFLAG_RW, 0, 74 "TrustedBSD mac_test policy controls"); 75 76 static int mac_test_enabled = 0; 77 SYSCTL_INT(_security_mac_test, OID_AUTO, enabled, CTLFLAG_RW, 78 &mac_test_enabled, 0, "Enforce test policy"); 79 80 #define BPFMAGIC 0xfe1ad1b6 81 #define DEVFSMAGIC 0x9ee79c32 82 #define IFNETMAGIC 0xc218b120 83 #define IPQMAGIC 0x206188ef 84 #define MBUFMAGIC 0xbbefa5bb 85 #define MOUNTMAGIC 0xc7c46e47 86 #define SOCKETMAGIC 0x9199c6cd 87 #define PIPEMAGIC 0xdc6c9919 88 #define CREDMAGIC 0x9a5a4987 89 #define VNODEMAGIC 0x1a67a45c 90 #define EXMAGIC 0x849ba1fd 91 92 #define SLOT(x) LABEL_TO_SLOT((x), test_slot).l_long 93 static int test_slot; 94 SYSCTL_INT(_security_mac_test, OID_AUTO, slot, CTLFLAG_RD, 95 &test_slot, 0, "Slot allocated by framework"); 96 97 static int init_count_bpfdesc; 98 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_bpfdesc, CTLFLAG_RD, 99 &init_count_bpfdesc, 0, "bpfdesc init calls"); 100 static int init_count_cred; 101 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_cred, CTLFLAG_RD, 102 &init_count_cred, 0, "cred init calls"); 103 static int init_count_devfsdirent; 104 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_devfsdirent, CTLFLAG_RD, 105 &init_count_devfsdirent, 0, "devfsdirent init calls"); 106 static int init_count_ifnet; 107 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_ifnet, CTLFLAG_RD, 108 &init_count_ifnet, 0, "ifnet init calls"); 109 static int init_count_ipq; 110 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_ipq, CTLFLAG_RD, 111 &init_count_ipq, 0, "ipq init calls"); 112 static int init_count_mbuf; 113 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_mbuf, CTLFLAG_RD, 114 &init_count_mbuf, 0, "mbuf init calls"); 115 static int init_count_mount; 116 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_mount, CTLFLAG_RD, 117 &init_count_mount, 0, "mount init calls"); 118 static int init_count_mount_fslabel; 119 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_mount_fslabel, CTLFLAG_RD, 120 &init_count_mount_fslabel, 0, "mount_fslabel init calls"); 121 static int init_count_socket; 122 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_socket, CTLFLAG_RD, 123 &init_count_socket, 0, "socket init calls"); 124 static int init_count_socket_peerlabel; 125 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_socket_peerlabel, 126 CTLFLAG_RD, &init_count_socket_peerlabel, 0, 127 "socket_peerlabel init calls"); 128 static int init_count_pipe; 129 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_pipe, CTLFLAG_RD, 130 &init_count_pipe, 0, "pipe init calls"); 131 static int init_count_vnode; 132 SYSCTL_INT(_security_mac_test, OID_AUTO, init_count_vnode, CTLFLAG_RD, 133 &init_count_vnode, 0, "vnode init calls"); 134 135 static int destroy_count_bpfdesc; 136 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_bpfdesc, CTLFLAG_RD, 137 &destroy_count_bpfdesc, 0, "bpfdesc destroy calls"); 138 static int destroy_count_cred; 139 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_cred, CTLFLAG_RD, 140 &destroy_count_cred, 0, "cred destroy calls"); 141 static int destroy_count_devfsdirent; 142 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_devfsdirent, CTLFLAG_RD, 143 &destroy_count_devfsdirent, 0, "devfsdirent destroy calls"); 144 static int destroy_count_ifnet; 145 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_ifnet, CTLFLAG_RD, 146 &destroy_count_ifnet, 0, "ifnet destroy calls"); 147 static int destroy_count_ipq; 148 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_ipq, CTLFLAG_RD, 149 &destroy_count_ipq, 0, "ipq destroy calls"); 150 static int destroy_count_mbuf; 151 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_mbuf, CTLFLAG_RD, 152 &destroy_count_mbuf, 0, "mbuf destroy calls"); 153 static int destroy_count_mount; 154 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_mount, CTLFLAG_RD, 155 &destroy_count_mount, 0, "mount destroy calls"); 156 static int destroy_count_mount_fslabel; 157 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_mount_fslabel, 158 CTLFLAG_RD, &destroy_count_mount_fslabel, 0, 159 "mount_fslabel destroy calls"); 160 static int destroy_count_socket; 161 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_socket, CTLFLAG_RD, 162 &destroy_count_socket, 0, "socket destroy calls"); 163 static int destroy_count_socket_peerlabel; 164 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_socket_peerlabel, 165 CTLFLAG_RD, &destroy_count_socket_peerlabel, 0, 166 "socket_peerlabel destroy calls"); 167 static int destroy_count_pipe; 168 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_pipe, CTLFLAG_RD, 169 &destroy_count_pipe, 0, "pipe destroy calls"); 170 static int destroy_count_vnode; 171 SYSCTL_INT(_security_mac_test, OID_AUTO, destroy_count_vnode, CTLFLAG_RD, 172 &destroy_count_vnode, 0, "vnode destroy calls"); 173 174 static int externalize_count; 175 SYSCTL_INT(_security_mac_test, OID_AUTO, externalize_count, CTLFLAG_RD, 176 &externalize_count, 0, "Subject/object externalize calls"); 177 static int internalize_count; 178 SYSCTL_INT(_security_mac_test, OID_AUTO, internalize_count, CTLFLAG_RD, 179 &internalize_count, 0, "Subject/object internalize calls"); 180 181 /* 182 * Policy module operations. 183 */ 184 static void 185 mac_test_destroy(struct mac_policy_conf *conf) 186 { 187 188 } 189 190 static void 191 mac_test_init(struct mac_policy_conf *conf) 192 { 193 194 } 195 196 static int 197 mac_test_syscall(struct thread *td, int call, void *arg) 198 { 199 200 return (0); 201 } 202 203 /* 204 * Label operations. 205 */ 206 static void 207 mac_test_init_bpfdesc_label(struct label *label) 208 { 209 210 SLOT(label) = BPFMAGIC; 211 atomic_add_int(&init_count_bpfdesc, 1); 212 } 213 214 static void 215 mac_test_init_cred_label(struct label *label) 216 { 217 218 SLOT(label) = CREDMAGIC; 219 atomic_add_int(&init_count_cred, 1); 220 } 221 222 static void 223 mac_test_init_devfsdirent_label(struct label *label) 224 { 225 226 SLOT(label) = DEVFSMAGIC; 227 atomic_add_int(&init_count_devfsdirent, 1); 228 } 229 230 static void 231 mac_test_init_ifnet_label(struct label *label) 232 { 233 234 SLOT(label) = IFNETMAGIC; 235 atomic_add_int(&init_count_ifnet, 1); 236 } 237 238 static void 239 mac_test_init_ipq_label(struct label *label) 240 { 241 242 SLOT(label) = IPQMAGIC; 243 atomic_add_int(&init_count_ipq, 1); 244 } 245 246 static int 247 mac_test_init_mbuf_label(struct label *label, int flag) 248 { 249 250 SLOT(label) = MBUFMAGIC; 251 atomic_add_int(&init_count_mbuf, 1); 252 return (0); 253 } 254 255 static void 256 mac_test_init_mount_label(struct label *label) 257 { 258 259 SLOT(label) = MOUNTMAGIC; 260 atomic_add_int(&init_count_mount, 1); 261 } 262 263 static void 264 mac_test_init_mount_fs_label(struct label *label) 265 { 266 267 SLOT(label) = MOUNTMAGIC; 268 atomic_add_int(&init_count_mount_fslabel, 1); 269 } 270 271 static int 272 mac_test_init_socket_label(struct label *label, int flag) 273 { 274 275 SLOT(label) = SOCKETMAGIC; 276 atomic_add_int(&init_count_socket, 1); 277 return (0); 278 } 279 280 static int 281 mac_test_init_socket_peer_label(struct label *label, int flag) 282 { 283 284 SLOT(label) = SOCKETMAGIC; 285 atomic_add_int(&init_count_socket_peerlabel, 1); 286 return (0); 287 } 288 289 static void 290 mac_test_init_pipe_label(struct label *label) 291 { 292 293 SLOT(label) = PIPEMAGIC; 294 atomic_add_int(&init_count_pipe, 1); 295 } 296 297 static void 298 mac_test_init_vnode_label(struct label *label) 299 { 300 301 SLOT(label) = VNODEMAGIC; 302 atomic_add_int(&init_count_vnode, 1); 303 } 304 305 static void 306 mac_test_destroy_bpfdesc_label(struct label *label) 307 { 308 309 if (SLOT(label) == BPFMAGIC || SLOT(label) == 0) { 310 atomic_add_int(&destroy_count_bpfdesc, 1); 311 SLOT(label) = EXMAGIC; 312 } else if (SLOT(label) == EXMAGIC) { 313 Debugger("mac_test_destroy_bpfdesc: dup destroy"); 314 } else { 315 Debugger("mac_test_destroy_bpfdesc: corrupted label"); 316 } 317 } 318 319 static void 320 mac_test_destroy_cred_label(struct label *label) 321 { 322 323 if (SLOT(label) == CREDMAGIC || SLOT(label) == 0) { 324 atomic_add_int(&destroy_count_cred, 1); 325 SLOT(label) = EXMAGIC; 326 } else if (SLOT(label) == EXMAGIC) { 327 Debugger("mac_test_destroy_cred: dup destroy"); 328 } else { 329 Debugger("mac_test_destroy_cred: corrupted label"); 330 } 331 } 332 333 static void 334 mac_test_destroy_devfsdirent_label(struct label *label) 335 { 336 337 if (SLOT(label) == DEVFSMAGIC || SLOT(label) == 0) { 338 atomic_add_int(&destroy_count_devfsdirent, 1); 339 SLOT(label) = EXMAGIC; 340 } else if (SLOT(label) == EXMAGIC) { 341 Debugger("mac_test_destroy_devfsdirent: dup destroy"); 342 } else { 343 Debugger("mac_test_destroy_devfsdirent: corrupted label"); 344 } 345 } 346 347 static void 348 mac_test_destroy_ifnet_label(struct label *label) 349 { 350 351 if (SLOT(label) == IFNETMAGIC || SLOT(label) == 0) { 352 atomic_add_int(&destroy_count_ifnet, 1); 353 SLOT(label) = EXMAGIC; 354 } else if (SLOT(label) == EXMAGIC) { 355 Debugger("mac_test_destroy_ifnet: dup destroy"); 356 } else { 357 Debugger("mac_test_destroy_ifnet: corrupted label"); 358 } 359 } 360 361 static void 362 mac_test_destroy_ipq_label(struct label *label) 363 { 364 365 if (SLOT(label) == IPQMAGIC || SLOT(label) == 0) { 366 atomic_add_int(&destroy_count_ipq, 1); 367 SLOT(label) = EXMAGIC; 368 } else if (SLOT(label) == EXMAGIC) { 369 Debugger("mac_test_destroy_ipq: dup destroy"); 370 } else { 371 Debugger("mac_test_destroy_ipq: corrupted label"); 372 } 373 } 374 375 static void 376 mac_test_destroy_mbuf_label(struct label *label) 377 { 378 379 if (SLOT(label) == MBUFMAGIC || SLOT(label) == 0) { 380 atomic_add_int(&destroy_count_mbuf, 1); 381 SLOT(label) = EXMAGIC; 382 } else if (SLOT(label) == EXMAGIC) { 383 Debugger("mac_test_destroy_mbuf: dup destroy"); 384 } else { 385 Debugger("mac_test_destroy_mbuf: corrupted label"); 386 } 387 } 388 389 static void 390 mac_test_destroy_mount_label(struct label *label) 391 { 392 393 if ((SLOT(label) == MOUNTMAGIC || SLOT(label) == 0)) { 394 atomic_add_int(&destroy_count_mount, 1); 395 SLOT(label) = EXMAGIC; 396 } else if (SLOT(label) == EXMAGIC) { 397 Debugger("mac_test_destroy_mount: dup destroy"); 398 } else { 399 Debugger("mac_test_destroy_mount: corrupted label"); 400 } 401 } 402 403 static void 404 mac_test_destroy_mount_fs_label(struct label *label) 405 { 406 407 if ((SLOT(label) == MOUNTMAGIC || SLOT(label) == 0)) { 408 atomic_add_int(&destroy_count_mount_fslabel, 1); 409 SLOT(label) = EXMAGIC; 410 } else if (SLOT(label) == EXMAGIC) { 411 Debugger("mac_test_destroy_mount_fslabel: dup destroy"); 412 } else { 413 Debugger("mac_test_destroy_mount_fslabel: corrupted label"); 414 } 415 } 416 417 static void 418 mac_test_destroy_socket_label(struct label *label) 419 { 420 421 if ((SLOT(label) == SOCKETMAGIC || SLOT(label) == 0)) { 422 atomic_add_int(&destroy_count_socket, 1); 423 SLOT(label) = EXMAGIC; 424 } else if (SLOT(label) == EXMAGIC) { 425 Debugger("mac_test_destroy_socket: dup destroy"); 426 } else { 427 Debugger("mac_test_destroy_socket: corrupted label"); 428 } 429 } 430 431 static void 432 mac_test_destroy_socket_peer_label(struct label *label) 433 { 434 435 if ((SLOT(label) == SOCKETMAGIC || SLOT(label) == 0)) { 436 atomic_add_int(&destroy_count_socket_peerlabel, 1); 437 SLOT(label) = EXMAGIC; 438 } else if (SLOT(label) == EXMAGIC) { 439 Debugger("mac_test_destroy_socket_peerlabel: dup destroy"); 440 } else { 441 Debugger("mac_test_destroy_socket_peerlabel: corrupted label"); 442 } 443 } 444 445 static void 446 mac_test_destroy_pipe_label(struct label *label) 447 { 448 449 if ((SLOT(label) == PIPEMAGIC || SLOT(label) == 0)) { 450 atomic_add_int(&destroy_count_pipe, 1); 451 SLOT(label) = EXMAGIC; 452 } else if (SLOT(label) == EXMAGIC) { 453 Debugger("mac_test_destroy_pipe: dup destroy"); 454 } else { 455 Debugger("mac_test_destroy_pipe: corrupted label"); 456 } 457 } 458 459 static void 460 mac_test_destroy_vnode_label(struct label *label) 461 { 462 463 if (SLOT(label) == VNODEMAGIC || SLOT(label) == 0) { 464 atomic_add_int(&destroy_count_vnode, 1); 465 SLOT(label) = EXMAGIC; 466 } else if (SLOT(label) == EXMAGIC) { 467 Debugger("mac_test_destroy_vnode: dup destroy"); 468 } else { 469 Debugger("mac_test_destroy_vnode: corrupted label"); 470 } 471 } 472 473 static int 474 mac_test_externalize_label(struct label *label, char *element_name, 475 char *element_data, size_t size, size_t *len, int *claimed) 476 { 477 478 atomic_add_int(&externalize_count, 1); 479 480 return (0); 481 } 482 483 static int 484 mac_test_internalize_label(struct label *label, char *element_name, 485 char *element_data, int *claimed) 486 { 487 488 atomic_add_int(&internalize_count, 1); 489 490 return (0); 491 } 492 493 /* 494 * Labeling event operations: file system objects, and things that look 495 * a lot like file system objects. 496 */ 497 static void 498 mac_test_associate_vnode_devfs(struct mount *mp, struct label *fslabel, 499 struct devfs_dirent *de, struct label *delabel, struct vnode *vp, 500 struct label *vlabel) 501 { 502 503 } 504 505 static int 506 mac_test_associate_vnode_extattr(struct mount *mp, struct label *fslabel, 507 struct vnode *vp, struct label *vlabel) 508 { 509 510 return (0); 511 } 512 513 static void 514 mac_test_associate_vnode_singlelabel(struct mount *mp, 515 struct label *fslabel, struct vnode *vp, struct label *vlabel) 516 { 517 518 } 519 520 static void 521 mac_test_create_devfs_device(dev_t dev, struct devfs_dirent *devfs_dirent, 522 struct label *label) 523 { 524 525 } 526 527 static void 528 mac_test_create_devfs_directory(char *dirname, int dirnamelen, 529 struct devfs_dirent *devfs_dirent, struct label *label) 530 { 531 532 } 533 534 static void 535 mac_test_create_devfs_symlink(struct ucred *cred, struct devfs_dirent *dd, 536 struct label *ddlabel, struct devfs_dirent *de, struct label *delabel) 537 { 538 539 } 540 541 static void 542 mac_test_create_devfs_vnode(struct devfs_dirent *devfs_dirent, 543 struct label *direntlabel, struct vnode *vp, struct label *vnodelabel) 544 { 545 546 } 547 548 static int 549 mac_test_create_vnode_extattr(struct ucred *cred, struct mount *mp, 550 struct label *fslabel, struct vnode *dvp, struct label *dlabel, 551 struct vnode *vp, struct label *vlabel, struct componentname *cnp) 552 { 553 554 return (0); 555 } 556 557 static void 558 mac_test_create_mount(struct ucred *cred, struct mount *mp, 559 struct label *mntlabel, struct label *fslabel) 560 { 561 562 } 563 564 static void 565 mac_test_create_root_mount(struct ucred *cred, struct mount *mp, 566 struct label *mntlabel, struct label *fslabel) 567 { 568 569 } 570 571 static void 572 mac_test_relabel_vnode(struct ucred *cred, struct vnode *vp, 573 struct label *vnodelabel, struct label *label) 574 { 575 576 } 577 578 static int 579 mac_test_setlabel_vnode_extattr(struct ucred *cred, struct vnode *vp, 580 struct label *vlabel, struct label *intlabel) 581 { 582 583 return (0); 584 } 585 586 static void 587 mac_test_update_devfsdirent(struct devfs_dirent *devfs_dirent, 588 struct label *direntlabel, struct vnode *vp, struct label *vnodelabel) 589 { 590 591 } 592 593 /* 594 * Labeling event operations: IPC object. 595 */ 596 static void 597 mac_test_create_mbuf_from_socket(struct socket *so, struct label *socketlabel, 598 struct mbuf *m, struct label *mbuflabel) 599 { 600 601 } 602 603 static void 604 mac_test_create_socket(struct ucred *cred, struct socket *socket, 605 struct label *socketlabel) 606 { 607 608 } 609 610 static void 611 mac_test_create_pipe(struct ucred *cred, struct pipe *pipe, 612 struct label *pipelabel) 613 { 614 615 } 616 617 static void 618 mac_test_create_socket_from_socket(struct socket *oldsocket, 619 struct label *oldsocketlabel, struct socket *newsocket, 620 struct label *newsocketlabel) 621 { 622 623 } 624 625 static void 626 mac_test_relabel_socket(struct ucred *cred, struct socket *socket, 627 struct label *socketlabel, struct label *newlabel) 628 { 629 630 } 631 632 static void 633 mac_test_relabel_pipe(struct ucred *cred, struct pipe *pipe, 634 struct label *pipelabel, struct label *newlabel) 635 { 636 637 } 638 639 static void 640 mac_test_set_socket_peer_from_mbuf(struct mbuf *mbuf, struct label *mbuflabel, 641 struct socket *socket, struct label *socketpeerlabel) 642 { 643 644 } 645 646 /* 647 * Labeling event operations: network objects. 648 */ 649 static void 650 mac_test_set_socket_peer_from_socket(struct socket *oldsocket, 651 struct label *oldsocketlabel, struct socket *newsocket, 652 struct label *newsocketpeerlabel) 653 { 654 655 } 656 657 static void 658 mac_test_create_bpfdesc(struct ucred *cred, struct bpf_d *bpf_d, 659 struct label *bpflabel) 660 { 661 662 } 663 664 static void 665 mac_test_create_datagram_from_ipq(struct ipq *ipq, struct label *ipqlabel, 666 struct mbuf *datagram, struct label *datagramlabel) 667 { 668 669 } 670 671 static void 672 mac_test_create_fragment(struct mbuf *datagram, struct label *datagramlabel, 673 struct mbuf *fragment, struct label *fragmentlabel) 674 { 675 676 } 677 678 static void 679 mac_test_create_ifnet(struct ifnet *ifnet, struct label *ifnetlabel) 680 { 681 682 } 683 684 static void 685 mac_test_create_ipq(struct mbuf *fragment, struct label *fragmentlabel, 686 struct ipq *ipq, struct label *ipqlabel) 687 { 688 689 } 690 691 static void 692 mac_test_create_mbuf_from_mbuf(struct mbuf *oldmbuf, 693 struct label *oldmbuflabel, struct mbuf *newmbuf, 694 struct label *newmbuflabel) 695 { 696 697 } 698 699 static void 700 mac_test_create_mbuf_linklayer(struct ifnet *ifnet, struct label *ifnetlabel, 701 struct mbuf *mbuf, struct label *mbuflabel) 702 { 703 704 } 705 706 static void 707 mac_test_create_mbuf_from_bpfdesc(struct bpf_d *bpf_d, struct label *bpflabel, 708 struct mbuf *mbuf, struct label *mbuflabel) 709 { 710 711 } 712 713 static void 714 mac_test_create_mbuf_from_ifnet(struct ifnet *ifnet, struct label *ifnetlabel, 715 struct mbuf *m, struct label *mbuflabel) 716 { 717 718 } 719 720 static void 721 mac_test_create_mbuf_multicast_encap(struct mbuf *oldmbuf, 722 struct label *oldmbuflabel, struct ifnet *ifnet, struct label *ifnetlabel, 723 struct mbuf *newmbuf, struct label *newmbuflabel) 724 { 725 726 } 727 728 static void 729 mac_test_create_mbuf_netlayer(struct mbuf *oldmbuf, 730 struct label *oldmbuflabel, struct mbuf *newmbuf, 731 struct label *newmbuflabel) 732 { 733 734 } 735 736 static int 737 mac_test_fragment_match(struct mbuf *fragment, struct label *fragmentlabel, 738 struct ipq *ipq, struct label *ipqlabel) 739 { 740 741 return (1); 742 } 743 744 static void 745 mac_test_relabel_ifnet(struct ucred *cred, struct ifnet *ifnet, 746 struct label *ifnetlabel, struct label *newlabel) 747 { 748 749 } 750 751 static void 752 mac_test_update_ipq(struct mbuf *fragment, struct label *fragmentlabel, 753 struct ipq *ipq, struct label *ipqlabel) 754 { 755 756 } 757 758 /* 759 * Labeling event operations: processes. 760 */ 761 static void 762 mac_test_create_cred(struct ucred *cred_parent, struct ucred *cred_child) 763 { 764 765 } 766 767 static void 768 mac_test_execve_transition(struct ucred *old, struct ucred *new, 769 struct vnode *vp, struct label *filelabel, 770 struct label *interpvnodelabel, struct image_params *imgp, 771 struct label *execlabel) 772 { 773 774 } 775 776 static int 777 mac_test_execve_will_transition(struct ucred *old, struct vnode *vp, 778 struct label *filelabel, struct label *interpvnodelabel, 779 struct image_params *imgp, struct label *execlabel) 780 { 781 782 return (0); 783 } 784 785 static void 786 mac_test_create_proc0(struct ucred *cred) 787 { 788 789 } 790 791 static void 792 mac_test_create_proc1(struct ucred *cred) 793 { 794 795 } 796 797 static void 798 mac_test_relabel_cred(struct ucred *cred, struct label *newlabel) 799 { 800 801 } 802 803 /* 804 * Access control checks. 805 */ 806 static int 807 mac_test_check_bpfdesc_receive(struct bpf_d *bpf_d, struct label *bpflabel, 808 struct ifnet *ifnet, struct label *ifnetlabel) 809 { 810 811 return (0); 812 } 813 814 static int 815 mac_test_check_cred_relabel(struct ucred *cred, struct label *newlabel) 816 { 817 818 return (0); 819 } 820 821 static int 822 mac_test_check_cred_visible(struct ucred *u1, struct ucred *u2) 823 { 824 825 return (0); 826 } 827 828 static int 829 mac_test_check_ifnet_relabel(struct ucred *cred, struct ifnet *ifnet, 830 struct label *ifnetlabel, struct label *newlabel) 831 { 832 833 return (0); 834 } 835 836 static int 837 mac_test_check_ifnet_transmit(struct ifnet *ifnet, struct label *ifnetlabel, 838 struct mbuf *m, struct label *mbuflabel) 839 { 840 841 return (0); 842 } 843 844 static int 845 mac_test_check_mount_stat(struct ucred *cred, struct mount *mp, 846 struct label *mntlabel) 847 { 848 849 return (0); 850 } 851 852 static int 853 mac_test_check_pipe_ioctl(struct ucred *cred, struct pipe *pipe, 854 struct label *pipelabel, unsigned long cmd, void /* caddr_t */ *data) 855 { 856 857 return (0); 858 } 859 860 static int 861 mac_test_check_pipe_poll(struct ucred *cred, struct pipe *pipe, 862 struct label *pipelabel) 863 { 864 865 return (0); 866 } 867 868 static int 869 mac_test_check_pipe_read(struct ucred *cred, struct pipe *pipe, 870 struct label *pipelabel) 871 { 872 873 return (0); 874 } 875 876 static int 877 mac_test_check_pipe_relabel(struct ucred *cred, struct pipe *pipe, 878 struct label *pipelabel, struct label *newlabel) 879 { 880 881 return (0); 882 } 883 884 static int 885 mac_test_check_pipe_stat(struct ucred *cred, struct pipe *pipe, 886 struct label *pipelabel) 887 { 888 889 return (0); 890 } 891 892 static int 893 mac_test_check_pipe_write(struct ucred *cred, struct pipe *pipe, 894 struct label *pipelabel) 895 { 896 897 return (0); 898 } 899 900 static int 901 mac_test_check_proc_debug(struct ucred *cred, struct proc *proc) 902 { 903 904 return (0); 905 } 906 907 static int 908 mac_test_check_proc_sched(struct ucred *cred, struct proc *proc) 909 { 910 911 return (0); 912 } 913 914 static int 915 mac_test_check_proc_signal(struct ucred *cred, struct proc *proc, int signum) 916 { 917 918 return (0); 919 } 920 921 static int 922 mac_test_check_socket_bind(struct ucred *cred, struct socket *socket, 923 struct label *socketlabel, struct sockaddr *sockaddr) 924 { 925 926 return (0); 927 } 928 929 static int 930 mac_test_check_socket_connect(struct ucred *cred, struct socket *socket, 931 struct label *socketlabel, struct sockaddr *sockaddr) 932 { 933 934 return (0); 935 } 936 937 static int 938 mac_test_check_socket_deliver(struct socket *socket, struct label *socketlabel, 939 struct mbuf *m, struct label *mbuflabel) 940 { 941 942 return (0); 943 } 944 945 static int 946 mac_test_check_socket_listen(struct ucred *cred, struct socket *socket, 947 struct label *socketlabel) 948 { 949 950 return (0); 951 } 952 953 static int 954 mac_test_check_socket_visible(struct ucred *cred, struct socket *socket, 955 struct label *socketlabel) 956 { 957 958 return (0); 959 } 960 961 static int 962 mac_test_check_socket_relabel(struct ucred *cred, struct socket *socket, 963 struct label *socketlabel, struct label *newlabel) 964 { 965 966 return (0); 967 } 968 969 static int 970 mac_test_check_vnode_access(struct ucred *cred, struct vnode *vp, 971 struct label *label, int acc_mode) 972 { 973 974 return (0); 975 } 976 977 static int 978 mac_test_check_vnode_chdir(struct ucred *cred, struct vnode *dvp, 979 struct label *dlabel) 980 { 981 982 return (0); 983 } 984 985 static int 986 mac_test_check_vnode_chroot(struct ucred *cred, struct vnode *dvp, 987 struct label *dlabel) 988 { 989 990 return (0); 991 } 992 993 static int 994 mac_test_check_vnode_create(struct ucred *cred, struct vnode *dvp, 995 struct label *dlabel, struct componentname *cnp, struct vattr *vap) 996 { 997 998 return (0); 999 } 1000 1001 static int 1002 mac_test_check_vnode_delete(struct ucred *cred, struct vnode *dvp, 1003 struct label *dlabel, struct vnode *vp, struct label *label, 1004 struct componentname *cnp) 1005 { 1006 1007 return (0); 1008 } 1009 1010 static int 1011 mac_test_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp, 1012 struct label *label, acl_type_t type) 1013 { 1014 1015 return (0); 1016 } 1017 1018 static int 1019 mac_test_check_vnode_exec(struct ucred *cred, struct vnode *vp, 1020 struct label *label, struct image_params *imgp, 1021 struct label *execlabel) 1022 { 1023 1024 return (0); 1025 } 1026 1027 static int 1028 mac_test_check_vnode_getacl(struct ucred *cred, struct vnode *vp, 1029 struct label *label, acl_type_t type) 1030 { 1031 1032 return (0); 1033 } 1034 1035 static int 1036 mac_test_check_vnode_getextattr(struct ucred *cred, struct vnode *vp, 1037 struct label *label, int attrnamespace, const char *name, struct uio *uio) 1038 { 1039 1040 return (0); 1041 } 1042 1043 static int 1044 mac_test_check_vnode_link(struct ucred *cred, struct vnode *dvp, 1045 struct label *dlabel, struct vnode *vp, struct label *label, 1046 struct componentname *cnp) 1047 { 1048 1049 return (0); 1050 } 1051 1052 static int 1053 mac_test_check_vnode_lookup(struct ucred *cred, struct vnode *dvp, 1054 struct label *dlabel, struct componentname *cnp) 1055 { 1056 1057 return (0); 1058 } 1059 1060 static int 1061 mac_test_check_vnode_mmap(struct ucred *cred, struct vnode *vp, 1062 struct label *label, int prot) 1063 { 1064 1065 return (0); 1066 } 1067 1068 static int 1069 mac_test_check_vnode_mprotect(struct ucred *cred, struct vnode *vp, 1070 struct label *label, int prot) 1071 { 1072 1073 return (0); 1074 } 1075 1076 static int 1077 mac_test_check_vnode_open(struct ucred *cred, struct vnode *vp, 1078 struct label *filelabel, int acc_mode) 1079 { 1080 1081 return (0); 1082 } 1083 1084 static int 1085 mac_test_check_vnode_poll(struct ucred *active_cred, struct ucred *file_cred, 1086 struct vnode *vp, struct label *label) 1087 { 1088 1089 return (0); 1090 } 1091 1092 static int 1093 mac_test_check_vnode_read(struct ucred *active_cred, struct ucred *file_cred, 1094 struct vnode *vp, struct label *label) 1095 { 1096 1097 return (0); 1098 } 1099 1100 static int 1101 mac_test_check_vnode_readdir(struct ucred *cred, struct vnode *dvp, 1102 struct label *dlabel) 1103 { 1104 1105 return (0); 1106 } 1107 1108 static int 1109 mac_test_check_vnode_readlink(struct ucred *cred, struct vnode *vp, 1110 struct label *vnodelabel) 1111 { 1112 1113 return (0); 1114 } 1115 1116 static int 1117 mac_test_check_vnode_relabel(struct ucred *cred, struct vnode *vp, 1118 struct label *vnodelabel, struct label *newlabel) 1119 { 1120 1121 return (0); 1122 } 1123 1124 static int 1125 mac_test_check_vnode_rename_from(struct ucred *cred, struct vnode *dvp, 1126 struct label *dlabel, struct vnode *vp, struct label *label, 1127 struct componentname *cnp) 1128 { 1129 1130 return (0); 1131 } 1132 1133 static int 1134 mac_test_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp, 1135 struct label *dlabel, struct vnode *vp, struct label *label, int samedir, 1136 struct componentname *cnp) 1137 { 1138 1139 return (0); 1140 } 1141 1142 static int 1143 mac_test_check_vnode_revoke(struct ucred *cred, struct vnode *vp, 1144 struct label *label) 1145 { 1146 1147 return (0); 1148 } 1149 1150 static int 1151 mac_test_check_vnode_setacl(struct ucred *cred, struct vnode *vp, 1152 struct label *label, acl_type_t type, struct acl *acl) 1153 { 1154 1155 return (0); 1156 } 1157 1158 static int 1159 mac_test_check_vnode_setextattr(struct ucred *cred, struct vnode *vp, 1160 struct label *label, int attrnamespace, const char *name, struct uio *uio) 1161 { 1162 1163 return (0); 1164 } 1165 1166 static int 1167 mac_test_check_vnode_setflags(struct ucred *cred, struct vnode *vp, 1168 struct label *label, u_long flags) 1169 { 1170 1171 return (0); 1172 } 1173 1174 static int 1175 mac_test_check_vnode_setmode(struct ucred *cred, struct vnode *vp, 1176 struct label *label, mode_t mode) 1177 { 1178 1179 return (0); 1180 } 1181 1182 static int 1183 mac_test_check_vnode_setowner(struct ucred *cred, struct vnode *vp, 1184 struct label *label, uid_t uid, gid_t gid) 1185 { 1186 1187 return (0); 1188 } 1189 1190 static int 1191 mac_test_check_vnode_setutimes(struct ucred *cred, struct vnode *vp, 1192 struct label *label, struct timespec atime, struct timespec mtime) 1193 { 1194 1195 return (0); 1196 } 1197 1198 static int 1199 mac_test_check_vnode_stat(struct ucred *active_cred, struct ucred *file_cred, 1200 struct vnode *vp, struct label *label) 1201 { 1202 1203 return (0); 1204 } 1205 1206 static int 1207 mac_test_check_vnode_write(struct ucred *active_cred, 1208 struct ucred *file_cred, struct vnode *vp, struct label *label) 1209 { 1210 1211 return (0); 1212 } 1213 1214 static struct mac_policy_ops mac_test_ops = 1215 { 1216 .mpo_destroy = mac_test_destroy, 1217 .mpo_init = mac_test_init, 1218 .mpo_syscall = mac_test_syscall, 1219 .mpo_init_bpfdesc_label = mac_test_init_bpfdesc_label, 1220 .mpo_init_cred_label = mac_test_init_cred_label, 1221 .mpo_init_devfsdirent_label = mac_test_init_devfsdirent_label, 1222 .mpo_init_ifnet_label = mac_test_init_ifnet_label, 1223 .mpo_init_ipq_label = mac_test_init_ipq_label, 1224 .mpo_init_mbuf_label = mac_test_init_mbuf_label, 1225 .mpo_init_mount_label = mac_test_init_mount_label, 1226 .mpo_init_mount_fs_label = mac_test_init_mount_fs_label, 1227 .mpo_init_pipe_label = mac_test_init_pipe_label, 1228 .mpo_init_socket_label = mac_test_init_socket_label, 1229 .mpo_init_socket_peer_label = mac_test_init_socket_peer_label, 1230 .mpo_init_vnode_label = mac_test_init_vnode_label, 1231 .mpo_destroy_bpfdesc_label = mac_test_destroy_bpfdesc_label, 1232 .mpo_destroy_cred_label = mac_test_destroy_cred_label, 1233 .mpo_destroy_devfsdirent_label = mac_test_destroy_devfsdirent_label, 1234 .mpo_destroy_ifnet_label = mac_test_destroy_ifnet_label, 1235 .mpo_destroy_ipq_label = mac_test_destroy_ipq_label, 1236 .mpo_destroy_mbuf_label = mac_test_destroy_mbuf_label, 1237 .mpo_destroy_mount_label = mac_test_destroy_mount_label, 1238 .mpo_destroy_mount_fs_label = mac_test_destroy_mount_fs_label, 1239 .mpo_destroy_pipe_label = mac_test_destroy_pipe_label, 1240 .mpo_destroy_socket_label = mac_test_destroy_socket_label, 1241 .mpo_destroy_socket_peer_label = mac_test_destroy_socket_peer_label, 1242 .mpo_destroy_vnode_label = mac_test_destroy_vnode_label, 1243 .mpo_externalize_cred_label = mac_test_externalize_label, 1244 .mpo_externalize_ifnet_label = mac_test_externalize_label, 1245 .mpo_externalize_pipe_label = mac_test_externalize_label, 1246 .mpo_externalize_socket_label = mac_test_externalize_label, 1247 .mpo_externalize_socket_peer_label = mac_test_externalize_label, 1248 .mpo_externalize_vnode_label = mac_test_externalize_label, 1249 .mpo_internalize_cred_label = mac_test_internalize_label, 1250 .mpo_internalize_ifnet_label = mac_test_internalize_label, 1251 .mpo_internalize_pipe_label = mac_test_internalize_label, 1252 .mpo_internalize_socket_label = mac_test_internalize_label, 1253 .mpo_internalize_vnode_label = mac_test_internalize_label, 1254 .mpo_associate_vnode_devfs = mac_test_associate_vnode_devfs, 1255 .mpo_associate_vnode_extattr = mac_test_associate_vnode_extattr, 1256 .mpo_associate_vnode_singlelabel = mac_test_associate_vnode_singlelabel, 1257 .mpo_create_devfs_device = mac_test_create_devfs_device, 1258 .mpo_create_devfs_directory = mac_test_create_devfs_directory, 1259 .mpo_create_devfs_symlink = mac_test_create_devfs_symlink, 1260 .mpo_create_devfs_vnode = mac_test_create_devfs_vnode, 1261 .mpo_create_vnode_extattr = mac_test_create_vnode_extattr, 1262 .mpo_create_mount = mac_test_create_mount, 1263 .mpo_create_root_mount = mac_test_create_root_mount, 1264 .mpo_relabel_vnode = mac_test_relabel_vnode, 1265 .mpo_setlabel_vnode_extattr = mac_test_setlabel_vnode_extattr, 1266 .mpo_update_devfsdirent = mac_test_update_devfsdirent, 1267 .mpo_create_mbuf_from_socket = mac_test_create_mbuf_from_socket, 1268 .mpo_create_pipe = mac_test_create_pipe, 1269 .mpo_create_socket = mac_test_create_socket, 1270 .mpo_create_socket_from_socket = mac_test_create_socket_from_socket, 1271 .mpo_relabel_pipe = mac_test_relabel_pipe, 1272 .mpo_relabel_socket = mac_test_relabel_socket, 1273 .mpo_set_socket_peer_from_mbuf = mac_test_set_socket_peer_from_mbuf, 1274 .mpo_set_socket_peer_from_socket = mac_test_set_socket_peer_from_socket, 1275 .mpo_create_bpfdesc = mac_test_create_bpfdesc, 1276 .mpo_create_ifnet = mac_test_create_ifnet, 1277 .mpo_create_datagram_from_ipq = mac_test_create_datagram_from_ipq, 1278 .mpo_create_fragment = mac_test_create_fragment, 1279 .mpo_create_ipq = mac_test_create_ipq, 1280 .mpo_create_mbuf_from_mbuf = mac_test_create_mbuf_from_mbuf, 1281 .mpo_create_mbuf_linklayer = mac_test_create_mbuf_linklayer, 1282 .mpo_create_mbuf_from_bpfdesc = mac_test_create_mbuf_from_bpfdesc, 1283 .mpo_create_mbuf_from_ifnet = mac_test_create_mbuf_from_ifnet, 1284 .mpo_create_mbuf_multicast_encap = mac_test_create_mbuf_multicast_encap, 1285 .mpo_create_mbuf_netlayer = mac_test_create_mbuf_netlayer, 1286 .mpo_fragment_match = mac_test_fragment_match, 1287 .mpo_relabel_ifnet = mac_test_relabel_ifnet, 1288 .mpo_update_ipq = mac_test_update_ipq, 1289 .mpo_create_cred = mac_test_create_cred, 1290 .mpo_execve_transition = mac_test_execve_transition, 1291 .mpo_execve_will_transition = mac_test_execve_will_transition, 1292 .mpo_create_proc0 = mac_test_create_proc0, 1293 .mpo_create_proc1 = mac_test_create_proc1, 1294 .mpo_relabel_cred = mac_test_relabel_cred, 1295 .mpo_check_bpfdesc_receive = mac_test_check_bpfdesc_receive, 1296 .mpo_check_cred_relabel = mac_test_check_cred_relabel, 1297 .mpo_check_cred_visible = mac_test_check_cred_visible, 1298 .mpo_check_ifnet_relabel = mac_test_check_ifnet_relabel, 1299 .mpo_check_ifnet_transmit = mac_test_check_ifnet_transmit, 1300 .mpo_check_mount_stat = mac_test_check_mount_stat, 1301 .mpo_check_pipe_ioctl = mac_test_check_pipe_ioctl, 1302 .mpo_check_pipe_poll = mac_test_check_pipe_poll, 1303 .mpo_check_pipe_read = mac_test_check_pipe_read, 1304 .mpo_check_pipe_relabel = mac_test_check_pipe_relabel, 1305 .mpo_check_pipe_stat = mac_test_check_pipe_stat, 1306 .mpo_check_pipe_write = mac_test_check_pipe_write, 1307 .mpo_check_proc_debug = mac_test_check_proc_debug, 1308 .mpo_check_proc_sched = mac_test_check_proc_sched, 1309 .mpo_check_proc_signal = mac_test_check_proc_signal, 1310 .mpo_check_socket_bind = mac_test_check_socket_bind, 1311 .mpo_check_socket_connect = mac_test_check_socket_connect, 1312 .mpo_check_socket_deliver = mac_test_check_socket_deliver, 1313 .mpo_check_socket_listen = mac_test_check_socket_listen, 1314 .mpo_check_socket_relabel = mac_test_check_socket_relabel, 1315 .mpo_check_socket_visible = mac_test_check_socket_visible, 1316 .mpo_check_vnode_access = mac_test_check_vnode_access, 1317 .mpo_check_vnode_chdir = mac_test_check_vnode_chdir, 1318 .mpo_check_vnode_chroot = mac_test_check_vnode_chroot, 1319 .mpo_check_vnode_create = mac_test_check_vnode_create, 1320 .mpo_check_vnode_delete = mac_test_check_vnode_delete, 1321 .mpo_check_vnode_deleteacl = mac_test_check_vnode_deleteacl, 1322 .mpo_check_vnode_exec = mac_test_check_vnode_exec, 1323 .mpo_check_vnode_getacl = mac_test_check_vnode_getacl, 1324 .mpo_check_vnode_getextattr = mac_test_check_vnode_getextattr, 1325 .mpo_check_vnode_link = mac_test_check_vnode_link, 1326 .mpo_check_vnode_lookup = mac_test_check_vnode_lookup, 1327 .mpo_check_vnode_mmap = mac_test_check_vnode_mmap, 1328 .mpo_check_vnode_mprotect = mac_test_check_vnode_mprotect, 1329 .mpo_check_vnode_open = mac_test_check_vnode_open, 1330 .mpo_check_vnode_poll = mac_test_check_vnode_poll, 1331 .mpo_check_vnode_read = mac_test_check_vnode_read, 1332 .mpo_check_vnode_readdir = mac_test_check_vnode_readdir, 1333 .mpo_check_vnode_readlink = mac_test_check_vnode_readlink, 1334 .mpo_check_vnode_relabel = mac_test_check_vnode_relabel, 1335 .mpo_check_vnode_rename_from = mac_test_check_vnode_rename_from, 1336 .mpo_check_vnode_rename_to = mac_test_check_vnode_rename_to, 1337 .mpo_check_vnode_revoke = mac_test_check_vnode_revoke, 1338 .mpo_check_vnode_setacl = mac_test_check_vnode_setacl, 1339 .mpo_check_vnode_setextattr = mac_test_check_vnode_setextattr, 1340 .mpo_check_vnode_setflags = mac_test_check_vnode_setflags, 1341 .mpo_check_vnode_setmode = mac_test_check_vnode_setmode, 1342 .mpo_check_vnode_setowner = mac_test_check_vnode_setowner, 1343 .mpo_check_vnode_setutimes = mac_test_check_vnode_setutimes, 1344 .mpo_check_vnode_stat = mac_test_check_vnode_stat, 1345 .mpo_check_vnode_write = mac_test_check_vnode_write, 1346 }; 1347 1348 MAC_POLICY_SET(&mac_test_ops, trustedbsd_mac_test, "TrustedBSD MAC/Test", 1349 MPC_LOADTIME_FLAG_UNLOADOK, &test_slot); 1350