diff options
| author | rwatson <rwatson@FreeBSD.org> | 2006-10-22 11:52:19 +0000 |
|---|---|---|
| committer | rwatson <rwatson@FreeBSD.org> | 2006-10-22 11:52:19 +0000 |
| commit | 7beaaf5cd2391ef1f8159791b46dbeb83ab0c2fb (patch) | |
| tree | 15bbe7ba3ad64d39db33baa0b88a2dae4206568e | |
| parent | cbcb760109a202fb847f48aa942a8b84b1e85015 (diff) | |
| download | FreeBSD-src-7beaaf5cd2391ef1f8159791b46dbeb83ab0c2fb.zip FreeBSD-src-7beaaf5cd2391ef1f8159791b46dbeb83ab0c2fb.tar.gz | |
Complete break-out of sys/sys/mac.h into sys/security/mac/mac_framework.h
begun with a repo-copy of mac.h to mac_framework.h. sys/mac.h now
contains the userspace and user<->kernel API and definitions, with all
in-kernel interfaces moved to mac_framework.h, which is now included
across most of the kernel instead.
This change is the first step in a larger cleanup and sweep of MAC
Framework interfaces in the kernel, and will not be MFC'd.
Obtained from: TrustedBSD Project
Sponsored by: SPARTA
108 files changed, 204 insertions, 533 deletions
diff --git a/sys/compat/linux/linux_file.c b/sys/compat/linux/linux_file.c index 185ca5c..b696fe1 100644 --- a/sys/compat/linux/linux_file.c +++ b/sys/compat/linux/linux_file.c @@ -40,7 +40,6 @@ __FBSDID("$FreeBSD$"); #include <sys/file.h> #include <sys/filedesc.h> #include <sys/lock.h> -#include <sys/mac.h> #include <sys/malloc.h> #include <sys/mount.h> #include <sys/mutex.h> @@ -52,6 +51,8 @@ __FBSDID("$FreeBSD$"); #include <sys/unistd.h> #include <sys/vnode.h> +#include <security/mac/mac_framework.h> + #include <ufs/ufs/extattr.h> #include <ufs/ufs/quota.h> #include <ufs/ufs/ufsmount.h> diff --git a/sys/compat/linux/linux_getcwd.c b/sys/compat/linux/linux_getcwd.c index 90f40cf..70631ed 100644 --- a/sys/compat/linux/linux_getcwd.c +++ b/sys/compat/linux/linux_getcwd.c @@ -54,7 +54,6 @@ __FBSDID("$FreeBSD$"); #include <sys/mount.h> #include <sys/proc.h> #include <sys/uio.h> -#include <sys/mac.h> #include <sys/malloc.h> #include <sys/dirent.h> #include <ufs/ufs/dir.h> /* XXX only for DIRBLKSIZ */ @@ -68,6 +67,8 @@ __FBSDID("$FreeBSD$"); #endif #include <compat/linux/linux_util.h> +#include <security/mac/mac_framework.h> + static int linux_getcwd_scandir(struct vnode **, struct vnode **, char **, char *, struct thread *); diff --git a/sys/compat/linux/linux_misc.c b/sys/compat/linux/linux_misc.c index 12db81a..fe0b803 100644 --- a/sys/compat/linux/linux_misc.c +++ b/sys/compat/linux/linux_misc.c @@ -43,7 +43,6 @@ __FBSDID("$FreeBSD$"); #include <sys/kernel.h> #include <sys/limits.h> #include <sys/lock.h> -#include <sys/mac.h> #include <sys/malloc.h> #include <sys/mman.h> #include <sys/mount.h> @@ -63,6 +62,8 @@ __FBSDID("$FreeBSD$"); #include <sys/vnode.h> #include <sys/wait.h> +#include <security/mac/mac_framework.h> + #include <vm/vm.h> #include <vm/pmap.h> #include <vm/vm_kern.h> diff --git a/sys/compat/linux/linux_stats.c b/sys/compat/linux/linux_stats.c index 41903fd..09d0904 100644 --- a/sys/compat/linux/linux_stats.c +++ b/sys/compat/linux/linux_stats.c @@ -38,7 +38,6 @@ __FBSDID("$FreeBSD$"); #include <sys/filedesc.h> #include <sys/proc.h> #include <sys/jail.h> -#include <sys/mac.h> #include <sys/malloc.h> #include <sys/mount.h> #include <sys/namei.h> @@ -59,6 +58,8 @@ __FBSDID("$FreeBSD$"); #include <compat/linux/linux_util.h> +#include <security/mac/mac_framework.h> + /* * XXX: This was removed from newstat_copyout(), and almost identical * XXX: code was in stat64_copyout(). findcdev() needs to be replaced diff --git a/sys/compat/svr4/svr4_fcntl.c b/sys/compat/svr4/svr4_fcntl.c index ad74838..ca135f0 100644 --- a/sys/compat/svr4/svr4_fcntl.c +++ b/sys/compat/svr4/svr4_fcntl.c @@ -40,7 +40,6 @@ __FBSDID("$FreeBSD$"); #include <sys/filedesc.h> /*#include <sys/ioctl.h>*/ #include <sys/lock.h> -#include <sys/mac.h> #include <sys/malloc.h> #include <sys/mount.h> #include <sys/mutex.h> @@ -60,6 +59,8 @@ __FBSDID("$FreeBSD$"); #include <compat/svr4/svr4_util.h> #include <compat/svr4/svr4_fcntl.h> +#include <security/mac/mac_framework.h> + static int svr4_to_bsd_flags(int); static u_long svr4_to_bsd_cmd(u_long); static int fd_revoke(struct thread *, int); diff --git a/sys/compat/svr4/svr4_misc.c b/sys/compat/svr4/svr4_misc.c index 6701cf8..9ed5bb3 100644 --- a/sys/compat/svr4/svr4_misc.c +++ b/sys/compat/svr4/svr4_misc.c @@ -45,7 +45,6 @@ __FBSDID("$FreeBSD$"); #include <sys/imgact.h> #include <sys/kernel.h> #include <sys/lock.h> -#include <sys/mac.h> #include <sys/malloc.h> #include <sys/file.h> /* Must come after sys/malloc.h */ #include <sys/mman.h> @@ -83,6 +82,8 @@ __FBSDID("$FreeBSD$"); #include <compat/svr4/svr4_mman.h> #include <compat/svr4/svr4_wait.h> +#include <security/mac/mac_framework.h> + #include <machine/vmparam.h> #include <vm/vm.h> #include <vm/vm_param.h> diff --git a/sys/contrib/pf/net/pf.c b/sys/contrib/pf/net/pf.c index 4cf6834..f2be6e5 100644 --- a/sys/contrib/pf/net/pf.c +++ b/sys/contrib/pf/net/pf.c @@ -79,7 +79,6 @@ #include <sys/kernel.h> #include <sys/time.h> #ifdef __FreeBSD__ -#include <sys/mac.h> #include <sys/sysctl.h> #include <sys/endian.h> #else @@ -132,6 +131,7 @@ #include <machine/in_cksum.h> #include <sys/limits.h> #include <sys/ucred.h> +#include <security/mac/mac_framework.h> extern int ip_optcopy(struct ip *, struct ip *); #endif diff --git a/sys/fs/devfs/devfs_devs.c b/sys/fs/devfs/devfs_devs.c index 96c4798..8e155b8 100644 --- a/sys/fs/devfs/devfs_devs.c +++ b/sys/fs/devfs/devfs_devs.c @@ -37,7 +37,6 @@ #include <sys/kernel.h> #include <sys/limits.h> #include <sys/lock.h> -#include <sys/mac.h> #include <sys/malloc.h> #include <sys/proc.h> #include <sys/sx.h> @@ -49,6 +48,8 @@ #include <fs/devfs/devfs.h> #include <fs/devfs/devfs_int.h> +#include <security/mac/mac_framework.h> + /* * The one true (but secret) list of active devices in the system. * Locked by dev_lock()/devmtx diff --git a/sys/fs/devfs/devfs_vnops.c b/sys/fs/devfs/devfs_vnops.c index b17eb4d..6ae4467 100644 --- a/sys/fs/devfs/devfs_vnops.c +++ b/sys/fs/devfs/devfs_vnops.c @@ -52,7 +52,6 @@ #include <sys/filio.h> #include <sys/kernel.h> #include <sys/lock.h> -#include <sys/mac.h> #include <sys/malloc.h> #include <sys/mount.h> #include <sys/namei.h> @@ -71,6 +70,8 @@ static struct fileops devfs_ops_f; #include <fs/devfs/devfs.h> #include <fs/devfs/devfs_int.h> +#include <security/mac/mac_framework.h> + struct mtx devfs_de_interlock; MTX_SYSINIT(devfs_de_interlock, &devfs_de_interlock, "devfs interlock", MTX_DEF); diff --git a/sys/i386/i386/sys_machdep.c b/sys/i386/i386/sys_machdep.c index f2e90b2..d633736 100644 --- a/sys/i386/i386/sys_machdep.c +++ b/sys/i386/i386/sys_machdep.c @@ -38,7 +38,6 @@ __FBSDID("$FreeBSD$"); #include <sys/param.h> #include <sys/systm.h> #include <sys/lock.h> -#include <sys/mac.h> #include <sys/malloc.h> #include <sys/mutex.h> #include <sys/proc.h> @@ -57,6 +56,7 @@ __FBSDID("$FreeBSD$"); #include <machine/sysarch.h> #include <security/audit/audit.h> +#include <security/mac/mac_framework.h> #include <vm/vm_kern.h> /* for kernel_map */ diff --git a/sys/i386/ibcs2/ibcs2_misc.c b/sys/i386/ibcs2/ibcs2_misc.c index 042505f..164c369 100644 --- a/sys/i386/ibcs2/ibcs2_misc.c +++ b/sys/i386/ibcs2/ibcs2_misc.c @@ -65,7 +65,6 @@ __FBSDID("$FreeBSD$"); #include <sys/imgact.h> #include <sys/kernel.h> #include <sys/lock.h> -#include <sys/mac.h> #include <sys/malloc.h> #include <sys/file.h> /* Must come after sys/malloc.h */ #include <sys/mutex.h> @@ -90,6 +89,8 @@ __FBSDID("$FreeBSD$"); #include <i386/ibcs2/ibcs2_utime.h> #include <i386/ibcs2/ibcs2_xenix.h> +#include <security/mac/mac_framework.h> + int ibcs2_ulimit(td, uap) struct thread *td; diff --git a/sys/kern/init_main.c b/sys/kern/init_main.c index b33e295..1a14dc6 100644 --- a/sys/kern/init_main.c +++ b/sys/kern/init_main.c @@ -55,7 +55,6 @@ __FBSDID("$FreeBSD$"); #include <sys/filedesc.h> #include <sys/ktr.h> #include <sys/lock.h> -#include <sys/mac.h> #include <sys/mount.h> #include <sys/mutex.h> #include <sys/syscallsubr.h> @@ -78,6 +77,7 @@ __FBSDID("$FreeBSD$"); #include <machine/cpu.h> #include <security/audit/audit.h> +#include <security/mac/mac_framework.h> #include <vm/vm.h> #include <vm/vm_param.h> diff --git a/sys/kern/kern_acct.c b/sys/kern/kern_acct.c index a005c5d..ec7289f 100644 --- a/sys/kern/kern_acct.c +++ b/sys/kern/kern_acct.c @@ -53,7 +53,6 @@ __FBSDID("$FreeBSD$"); #include <sys/kernel.h> #include <sys/kthread.h> #include <sys/lock.h> -#include <sys/mac.h> #include <sys/mount.h> #include <sys/mutex.h> #include <sys/namei.h> @@ -68,6 +67,8 @@ __FBSDID("$FreeBSD$"); #include <sys/tty.h> #include <sys/vnode.h> +#include <security/mac/mac_framework.h> + /* * The routines implemented in this file are described in: * Leffler, et al.: The Design and Implementation of the 4.3BSD diff --git a/sys/kern/kern_acl.c b/sys/kern/kern_acl.c index 64ffe5c..5ee9826 100644 --- a/sys/kern/kern_acl.c +++ b/sys/kern/kern_acl.c @@ -41,7 +41,6 @@ __FBSDID("$FreeBSD$"); #include <sys/systm.h> #include <sys/sysproto.h> #include <sys/kernel.h> -#include <sys/mac.h> #include <sys/malloc.h> #include <sys/mount.h> #include <sys/vnode.h> @@ -54,6 +53,8 @@ __FBSDID("$FreeBSD$"); #include <sys/sysent.h> #include <sys/acl.h> +#include <security/mac/mac_framework.h> + #include <vm/uma.h> uma_zone_t acl_zone; diff --git a/sys/kern/kern_alq.c b/sys/kern/kern_alq.c index b6b24de..49aa0ac 100644 --- a/sys/kern/kern_alq.c +++ b/sys/kern/kern_alq.c @@ -34,7 +34,6 @@ __FBSDID("$FreeBSD$"); #include <sys/kernel.h> #include <sys/kthread.h> #include <sys/lock.h> -#include <sys/mac.h> #include <sys/mount.h> #include <sys/mutex.h> #include <sys/namei.h> @@ -46,6 +45,8 @@ __FBSDID("$FreeBSD$"); #include <sys/fcntl.h> #include <sys/eventhandler.h> +#include <security/mac/mac_framework.h> + /* Async. Logging Queue */ struct alq { int aq_entmax; /* Max entries */ diff --git a/sys/kern/kern_environment.c b/sys/kern/kern_environment.c index bd54063..ff26529 100644 --- a/sys/kern/kern_environment.c +++ b/sys/kern/kern_environment.c @@ -44,7 +44,6 @@ __FBSDID("$FreeBSD$"); #include <sys/proc.h> #include <sys/queue.h> #include <sys/lock.h> -#include <sys/mac.h> #include <sys/malloc.h> #include <sys/mutex.h> #include <sys/kernel.h> @@ -54,6 +53,8 @@ __FBSDID("$FreeBSD$"); #include <sys/libkern.h> #include <sys/kenv.h> +#include <security/mac/mac_framework.h> + static MALLOC_DEFINE(M_KENV, "kenv", "kernel environment"); #define KENV_SIZE 512 /* Maximum number of environment strings */ diff --git a/sys/kern/kern_exec.c b/sys/kern/kern_exec.c index 97825cb..be7dbe6 100644 --- a/sys/kern/kern_exec.c +++ b/sys/kern/kern_exec.c @@ -39,7 +39,6 @@ __FBSDID("$FreeBSD$"); #include <sys/sysproto.h> #include <sys/signalvar.h> #include <sys/kernel.h> -#include <sys/mac.h> #include <sys/mount.h> #include <sys/filedesc.h> #include <sys/fcntl.h> @@ -80,6 +79,7 @@ __FBSDID("$FreeBSD$"); #include <machine/reg.h> #include <security/audit/audit.h> +#include <security/mac/mac_framework.h> MALLOC_DEFINE(M_PARGS, "proc-args", "Process arguments"); diff --git a/sys/kern/kern_exit.c b/sys/kern/kern_exit.c index c857413..1e57aae 100644 --- a/sys/kern/kern_exit.c +++ b/sys/kern/kern_exit.c @@ -65,7 +65,6 @@ __FBSDID("$FreeBSD$"); #include <sys/ptrace.h> #include <sys/acct.h> /* for acct_process() function prototype */ #include <sys/filedesc.h> -#include <sys/mac.h> #include <sys/shm.h> #include <sys/sem.h> #ifdef KTRACE @@ -73,6 +72,7 @@ __FBSDID("$FreeBSD$"); #endif #include <security/audit/audit.h> +#include <security/mac/mac_framework.h> #include <vm/vm.h> #include <vm/vm_extern.h> diff --git a/sys/kern/kern_fork.c b/sys/kern/kern_fork.c index c0b30e6..2695252 100644 --- a/sys/kern/kern_fork.c +++ b/sys/kern/kern_fork.c @@ -59,7 +59,6 @@ __FBSDID("$FreeBSD$"); #include <sys/vmmeter.h> #include <sys/vnode.h> #include <sys/acct.h> -#include <sys/mac.h> #include <sys/ktr.h> #include <sys/ktrace.h> #include <sys/unistd.h> @@ -67,6 +66,7 @@ __FBSDID("$FreeBSD$"); #include <sys/signalvar.h> #include <security/audit/audit.h> +#include <security/mac/mac_framework.h> #include <vm/vm.h> #include <vm/pmap.h> diff --git a/sys/kern/kern_jail.c b/sys/kern/kern_jail.c index be4757d..3924388 100644 --- a/sys/kern/kern_jail.c +++ b/sys/kern/kern_jail.c @@ -18,7 +18,6 @@ __FBSDID("$FreeBSD$"); #include <sys/systm.h> #include <sys/errno.h> #include <sys/sysproto.h> -#include <sys/mac.h> #include <sys/malloc.h> #include <sys/proc.h> #include <sys/taskqueue.h> @@ -35,6 +34,8 @@ __FBSDID("$FreeBSD$"); #include <net/if.h> #include <netinet/in.h> +#include <security/mac/mac_framework.h> + MALLOC_DEFINE(M_PRISON, "prison", "Prison structures"); SYSCTL_NODE(_security, OID_AUTO, jail, CTLFLAG_RW, 0, diff --git a/sys/kern/kern_ktrace.c b/sys/kern/kern_ktrace.c index 0277cc3..e79fa7c 100644 --- a/sys/kern/kern_ktrace.c +++ b/sys/kern/kern_ktrace.c @@ -44,7 +44,6 @@ __FBSDID("$FreeBSD$"); #include <sys/kthread.h> #include <sys/lock.h> #include <sys/mutex.h> -#include <sys/mac.h> #include <sys/malloc.h> #include <sys/mount.h> #include <sys/namei.h> @@ -57,6 +56,8 @@ __FBSDID("$FreeBSD$"); #include <sys/syslog.h> #include <sys/sysproto.h> +#include <security/mac/mac_framework.h> + /* * The ktrace facility allows the tracing of certain key events in user space * processes, such as system calls, signal delivery, context switches, and diff --git a/sys/kern/kern_linker.c b/sys/kern/kern_linker.c index 026d5b6..0bdd9f8 100644 --- a/sys/kern/kern_linker.c +++ b/sys/kern/kern_linker.c @@ -41,7 +41,6 @@ __FBSDID("$FreeBSD$"); #include <sys/lock.h> #include <sys/mutex.h> #include <sys/sx.h> -#include <sys/mac.h> #include <sys/module.h> #include <sys/mount.h> #include <sys/linker.h> @@ -52,6 +51,8 @@ __FBSDID("$FreeBSD$"); #include <sys/syscallsubr.h> #include <sys/sysctl.h> +#include <security/mac/mac_framework.h> + #include "linker_if.h" #ifdef HWPMC_HOOKS diff --git a/sys/kern/kern_mac.c b/sys/kern/kern_mac.c index b553c80..8d69dcc 100644 --- a/sys/kern/kern_mac.c +++ b/sys/kern/kern_mac.c @@ -2,7 +2,7 @@ * Copyright (c) 1999-2002 Robert N. M. Watson * Copyright (c) 2001 Ilmar S. Habibulin * Copyright (c) 2001-2005 Networks Associates Technology, Inc. - * Copyright (c) 2005 SPARTA, Inc. + * Copyright (c) 2005-2006 SPARTA, Inc. * All rights reserved. * * This software was developed by Robert Watson and Ilmar Habibulin for the @@ -91,6 +91,7 @@ __FBSDID("$FreeBSD$"); #include <netinet/in.h> #include <netinet/ip_var.h> +#include <security/mac/mac_framework.h> #include <security/mac/mac_internal.h> #ifdef MAC diff --git a/sys/kern/kern_mbuf.c b/sys/kern/kern_mbuf.c index e43d323..0f99924 100644 --- a/sys/kern/kern_mbuf.c +++ b/sys/kern/kern_mbuf.c @@ -32,7 +32,6 @@ __FBSDID("$FreeBSD$"); #include "opt_param.h" #include <sys/param.h> -#include <sys/mac.h> #include <sys/malloc.h> #include <sys/systm.h> #include <sys/mbuf.h> @@ -43,6 +42,8 @@ __FBSDID("$FreeBSD$"); #include <sys/smp.h> #include <sys/sysctl.h> +#include <security/mac/mac_framework.h> + #include <vm/vm.h> #include <vm/vm_page.h> #include <vm/uma.h> diff --git a/sys/kern/kern_prot.c b/sys/kern/kern_prot.c index a42ab93..daa8966 100644 --- a/sys/kern/kern_prot.c +++ b/sys/kern/kern_prot.c @@ -51,7 +51,6 @@ __FBSDID("$FreeBSD$"); #include <sys/kdb.h> #include <sys/kernel.h> #include <sys/lock.h> -#include <sys/mac.h> #include <sys/malloc.h> #include <sys/mutex.h> #include <sys/refcount.h> @@ -67,6 +66,7 @@ __FBSDID("$FreeBSD$"); #include <sys/sysctl.h> #include <security/audit/audit.h> +#include <security/mac/mac_framework.h> static MALLOC_DEFINE(M_CRED, "cred", "credentials"); diff --git a/sys/kern/kern_shutdown.c b/sys/kern/kern_shutdown.c index 3b62ba2..a5bcfa8 100644 --- a/sys/kern/kern_shutdown.c +++ b/sys/kern/kern_shutdown.c @@ -53,7 +53,6 @@ __FBSDID("$FreeBSD$"); #include <sys/kdb.h> #include <sys/kernel.h> #include <sys/kthread.h> -#include <sys/mac.h> #include <sys/malloc.h> #include <sys/mount.h> #include <sys/proc.h> @@ -68,6 +67,8 @@ __FBSDID("$FreeBSD$"); #include <machine/pcb.h> #include <machine/smp.h> +#include <security/mac/mac_framework.h> + #include <vm/vm.h> #include <vm/vm_object.h> #include <vm/vm_page.h> diff --git a/sys/kern/kern_sysctl.c b/sys/kern/kern_sysctl.c index 84a5209..a929291 100644 --- a/sys/kern/kern_sysctl.c +++ b/sys/kern/kern_sysctl.c @@ -45,13 +45,15 @@ __FBSDID("$FreeBSD$"); #include <sys/systm.h> #include <sys/kernel.h> #include <sys/sysctl.h> -#include <sys/mac.h> #include <sys/malloc.h> #include <sys/proc.h> #include <sys/lock.h> #include <sys/mutex.h> #include <sys/sx.h> #include <sys/sysproto.h> + +#include <security/mac/mac_framework.h> + #include <vm/vm.h> #include <vm/vm_extern.h> diff --git a/sys/kern/kern_time.c b/sys/kern/kern_time.c index 0bdde95..479348e 100644 --- a/sys/kern/kern_time.c +++ b/sys/kern/kern_time.c @@ -45,7 +45,6 @@ __FBSDID("$FreeBSD$"); #include <sys/resourcevar.h> #include <sys/signalvar.h> #include <sys/kernel.h> -#include <sys/mac.h> #include <sys/syscallsubr.h> #include <sys/sysctl.h> #include <sys/sysent.h> @@ -57,6 +56,8 @@ __FBSDID("$FreeBSD$"); #include <posix4/posix4.h> +#include <security/mac/mac_framework.h> + #include <vm/vm.h> #include <vm/vm_extern.h> diff --git a/sys/kern/link_elf.c b/sys/kern/link_elf.c index 35e97b8..b78776a 100644 --- a/sys/kern/link_elf.c +++ b/sys/kern/link_elf.c @@ -37,7 +37,6 @@ __FBSDID("$FreeBSD$"); #endif #include <sys/kernel.h> #include <sys/lock.h> -#include <sys/mac.h> #include <sys/malloc.h> #include <sys/mutex.h> #include <sys/mount.h> @@ -49,6 +48,8 @@ __FBSDID("$FreeBSD$"); #include <machine/elf.h> +#include <security/mac/mac_framework.h> + #include <vm/vm.h> #include <vm/vm_param.h> #ifdef SPARSE_MAPPING diff --git a/sys/kern/link_elf_obj.c b/sys/kern/link_elf_obj.c index 8e11038..a926d54 100644 --- a/sys/kern/link_elf_obj.c +++ b/sys/kern/link_elf_obj.c @@ -35,7 +35,6 @@ __FBSDID("$FreeBSD$"); #include <sys/systm.h> #include <sys/kernel.h> #include <sys/lock.h> -#include <sys/mac.h> #include <sys/malloc.h> #include <sys/mutex.h> #include <sys/mount.h> @@ -47,6 +46,8 @@ __FBSDID("$FreeBSD$"); #include <machine/elf.h> +#include <security/mac/mac_framework.h> + #include <vm/vm.h> #include <vm/vm_param.h> #include <vm/vm_object.h> diff --git a/sys/kern/subr_trap.c b/sys/kern/subr_trap.c index d5c03b7..efb6a6e 100644 --- a/sys/kern/subr_trap.c +++ b/sys/kern/subr_trap.c @@ -50,7 +50,6 @@ __FBSDID("$FreeBSD$"); #include <sys/bus.h> #include <sys/kernel.h> #include <sys/lock.h> -#include <sys/mac.h> #include <sys/mutex.h> #include <sys/proc.h> #include <sys/ktr.h> @@ -67,6 +66,8 @@ __FBSDID("$FreeBSD$"); #include <machine/cpu.h> #include <machine/pcb.h> +#include <security/mac/mac_framework.h> + /* * Define the code needed before returning to user mode, for * trap and syscall. diff --git a/sys/kern/sys_pipe.c b/sys/kern/sys_pipe.c index b873a8b..46a4a4f 100644 --- a/sys/kern/sys_pipe.c +++ b/sys/kern/sys_pipe.c @@ -101,7 +101,6 @@ __FBSDID("$FreeBSD$"); #include <sys/filio.h> #include <sys/kernel.h> #include <sys/lock.h> -#include <sys/mac.h> #include <sys/mutex.h> #include <sys/ttycom.h> #include <sys/stat.h> @@ -117,6 +116,8 @@ __FBSDID("$FreeBSD$"); #include <sys/uio.h> #include <sys/event.h> +#include <security/mac/mac_framework.h> + #include <vm/vm.h> #include <vm/vm_param.h> #include <vm/vm_object.h> diff --git a/sys/kern/sys_socket.c b/sys/kern/sys_socket.c index 4d0a1ac..a429911 100644 --- a/sys/kern/sys_socket.c +++ b/sys/kern/sys_socket.c @@ -38,7 +38,6 @@ __FBSDID("$FreeBSD$"); #include <sys/systm.h> #include <sys/file.h> #include <sys/filedesc.h> -#include <sys/mac.h> #include <sys/proc.h> #include <sys/protosw.h> #include <sys/sigio.h> @@ -55,6 +54,8 @@ __FBSDID("$FreeBSD$"); #include <net/if.h> #include <net/route.h> +#include <security/mac/mac_framework.h> + struct fileops socketops = { .fo_read = soo_read, .fo_write = soo_write, diff --git a/sys/kern/sysv_msg.c b/sys/kern/sysv_msg.c index dca24de..464a7e5 100644 --- a/sys/kern/sysv_msg.c +++ b/sys/kern/sysv_msg.c @@ -59,7 +59,6 @@ __FBSDID("$FreeBSD$"); #include <sys/kernel.h> #include <sys/proc.h> #include <sys/lock.h> -#include <sys/mac.h> #include <sys/mutex.h> #include <sys/module.h> #include <sys/msg.h> @@ -70,6 +69,8 @@ __FBSDID("$FreeBSD$"); #include <sys/malloc.h> #include <sys/jail.h> +#include <security/mac/mac_framework.h> + static MALLOC_DEFINE(M_MSG, "msg", "SVID compatible message queues"); static void msginit(void); diff --git a/sys/kern/sysv_sem.c b/sys/kern/sysv_sem.c index 29eaecf..cc9fe67 100644 --- a/sys/kern/sysv_sem.c +++ b/sys/kern/sysv_sem.c @@ -59,7 +59,8 @@ __FBSDID("$FreeBSD$"); #include <sys/uio.h> #include <sys/malloc.h> #include <sys/jail.h> -#include <sys/mac.h> + +#include <security/mac/mac_framework.h> static MALLOC_DEFINE(M_SEM, "sem", "SVID compatible semaphores"); diff --git a/sys/kern/sysv_shm.c b/sys/kern/sysv_shm.c index efcc1f6..2fc2d71 100644 --- a/sys/kern/sysv_shm.c +++ b/sys/kern/sysv_shm.c @@ -84,7 +84,8 @@ __FBSDID("$FreeBSD$"); #include <sys/sysent.h> #include <sys/sysproto.h> #include <sys/jail.h> -#include <sys/mac.h> + +#include <security/mac/mac_framework.h> #include <vm/vm.h> #include <vm/vm_param.h> diff --git a/sys/kern/uipc_mbuf.c b/sys/kern/uipc_mbuf.c index 5b5714f..216ff54 100644 --- a/sys/kern/uipc_mbuf.c +++ b/sys/kern/uipc_mbuf.c @@ -41,7 +41,6 @@ __FBSDID("$FreeBSD$"); #include <sys/kernel.h> #include <sys/limits.h> #include <sys/lock.h> -#include <sys/mac.h> #include <sys/malloc.h> #include <sys/mbuf.h> #include <sys/sysctl.h> @@ -49,6 +48,8 @@ __FBSDID("$FreeBSD$"); #include <sys/protosw.h> #include <sys/uio.h> +#include <security/mac/mac_framework.h> + int max_linkhdr; int max_protohdr; int max_hdr; diff --git a/sys/kern/uipc_mbuf2.c b/sys/kern/uipc_mbuf2.c index 109b3a6..c8363f8 100644 --- a/sys/kern/uipc_mbuf2.c +++ b/sys/kern/uipc_mbuf2.c @@ -71,11 +71,12 @@ __FBSDID("$FreeBSD$"); #include <sys/systm.h> #include <sys/kernel.h> #include <sys/lock.h> -#include <sys/mac.h> #include <sys/malloc.h> #include <sys/mbuf.h> #include <sys/mutex.h> +#include <security/mac/mac_framework.h> + static MALLOC_DEFINE(M_PACKET_TAGS, MBUF_TAG_MEM_NAME, "packet-attached information"); diff --git a/sys/kern/uipc_sem.c b/sys/kern/uipc_sem.c index 9e8b279..8de7d8f 100644 --- a/sys/kern/uipc_sem.c +++ b/sys/kern/uipc_sem.c @@ -54,7 +54,6 @@ __FBSDID("$FreeBSD$"); #include <sys/sysent.h> #include <sys/sysctl.h> #include <sys/time.h> -#include <sys/mac.h> #include <sys/malloc.h> #include <sys/fcntl.h> @@ -63,6 +62,8 @@ __FBSDID("$FreeBSD$"); #include <posix4/semaphore.h> #include <posix4/_semaphore.h> +#include <security/mac/mac_framework.h> + static int sem_count_proc(struct proc *p); static struct ksem *sem_lookup_byname(const char *name); static int sem_create(struct thread *td, const char *name, diff --git a/sys/kern/uipc_socket.c b/sys/kern/uipc_socket.c index 2a27388..341b54c 100644 --- a/sys/kern/uipc_socket.c +++ b/sys/kern/uipc_socket.c @@ -126,6 +126,8 @@ __FBSDID("$FreeBSD$"); #include <sys/uio.h> #include <sys/jail.h> +#include <security/mac/mac_framework.h> + #include <vm/uma.h> #ifdef COMPAT_IA32 diff --git a/sys/kern/uipc_syscalls.c b/sys/kern/uipc_syscalls.c index 23437a3..462bde4 100644 --- a/sys/kern/uipc_syscalls.c +++ b/sys/kern/uipc_syscalls.c @@ -43,7 +43,6 @@ __FBSDID("$FreeBSD$"); #include <sys/systm.h> #include <sys/kernel.h> #include <sys/lock.h> -#include <sys/mac.h> #include <sys/mutex.h> #include <sys/sysproto.h> #include <sys/malloc.h> @@ -68,6 +67,8 @@ __FBSDID("$FreeBSD$"); #include <sys/ktrace.h> #endif +#include <security/mac/mac_framework.h> + #include <vm/vm.h> #include <vm/vm_object.h> #include <vm/vm_page.h> diff --git a/sys/kern/uipc_usrreq.c b/sys/kern/uipc_usrreq.c index 723c132..33a6ec2 100644 --- a/sys/kern/uipc_usrreq.c +++ b/sys/kern/uipc_usrreq.c @@ -64,7 +64,6 @@ __FBSDID("$FreeBSD$"); #include <sys/jail.h> #include <sys/kernel.h> #include <sys/lock.h> -#include <sys/mac.h> #include <sys/mbuf.h> #include <sys/mount.h> #include <sys/mutex.h> @@ -84,6 +83,8 @@ __FBSDID("$FreeBSD$"); #include <sys/unpcb.h> #include <sys/vnode.h> +#include <security/mac/mac_framework.h> + #include <vm/uma.h> static uma_zone_t unp_zone; diff --git a/sys/kern/vfs_acl.c b/sys/kern/vfs_acl.c index 64ffe5c..5ee9826 100644 --- a/sys/kern/vfs_acl.c +++ b/sys/kern/vfs_acl.c @@ -41,7 +41,6 @@ __FBSDID("$FreeBSD$"); #include <sys/systm.h> #include <sys/sysproto.h> #include <sys/kernel.h> -#include <sys/mac.h> #include <sys/malloc.h> #include <sys/mount.h> #include <sys/vnode.h> @@ -54,6 +53,8 @@ __FBSDID("$FreeBSD$"); #include <sys/sysent.h> #include <sys/acl.h> +#include <security/mac/mac_framework.h> + #include <vm/uma.h> uma_zone_t acl_zone; diff --git a/sys/kern/vfs_extattr.c b/sys/kern/vfs_extattr.c index d23f19b..81529f0 100644 --- a/sys/kern/vfs_extattr.c +++ b/sys/kern/vfs_extattr.c @@ -45,7 +45,6 @@ __FBSDID("$FreeBSD$"); #include <sys/bio.h> #include <sys/buf.h> #include <sys/sysent.h> -#include <sys/mac.h> #include <sys/malloc.h> #include <sys/mount.h> #include <sys/mutex.h> @@ -71,6 +70,7 @@ __FBSDID("$FreeBSD$"); #include <machine/stdarg.h> #include <security/audit/audit.h> +#include <security/mac/mac_framework.h> #include <vm/vm.h> #include <vm/vm_object.h> diff --git a/sys/kern/vfs_lookup.c b/sys/kern/vfs_lookup.c index a59b39d..a0cbc83 100644 --- a/sys/kern/vfs_lookup.c +++ b/sys/kern/vfs_lookup.c @@ -45,7 +45,6 @@ __FBSDID("$FreeBSD$"); #include <sys/systm.h> #include <sys/kernel.h> #include <sys/lock.h> -#include <sys/mac.h> #include <sys/mutex.h> #include <sys/namei.h> #include <sys/vnode.h> @@ -59,6 +58,7 @@ __FBSDID("$FreeBSD$"); #endif #include <security/audit/audit.h> +#include <security/mac/mac_framework.h> #include <vm/uma.h> diff --git a/sys/kern/vfs_mount.c b/sys/kern/vfs_mount.c index 0598905..af07f44 100644 --- a/sys/kern/vfs_mount.c +++ b/sys/kern/vfs_mount.c @@ -43,7 +43,6 @@ __FBSDID("$FreeBSD$"); #include <sys/jail.h> #include <sys/kernel.h> #include <sys/libkern.h> -#include <sys/mac.h> #include <sys/malloc.h> #include <sys/mount.h> #include <sys/mutex.h> @@ -65,6 +64,7 @@ __FBSDID("$FreeBSD$"); #include <machine/stdarg.h> #include <security/audit/audit.h> +#include <security/mac/mac_framework.h> #include "opt_rootdevname.h" #include "opt_ddb.h" diff --git a/sys/kern/vfs_subr.c b/sys/kern/vfs_subr.c index 28fbda9..c621743 100644 --- a/sys/kern/vfs_subr.c +++ b/sys/kern/vfs_subr.c @@ -58,7 +58,6 @@ __FBSDID("$FreeBSD$"); #include <sys/kdb.h> #include <sys/kernel.h> #include <sys/kthread.h> -#include <sys/mac.h> #include <sys/malloc.h> #include <sys/mount.h> #include <sys/namei.h> @@ -72,6 +71,8 @@ __FBSDID("$FreeBSD$"); #include <machine/stdarg.h> +#include <security/mac/mac_framework.h> + #include <vm/vm.h> #include <vm/vm_object.h> #include <vm/vm_extern.h> diff --git a/sys/kern/vfs_syscalls.c b/sys/kern/vfs_syscalls.c index d23f19b..81529f0 100644 --- a/sys/kern/vfs_syscalls.c +++ b/sys/kern/vfs_syscalls.c @@ -45,7 +45,6 @@ __FBSDID("$FreeBSD$"); #include <sys/bio.h> #include <sys/buf.h> #include <sys/sysent.h> -#include <sys/mac.h> #include <sys/malloc.h> #include <sys/mount.h> #include <sys/mutex.h> @@ -71,6 +70,7 @@ __FBSDID("$FreeBSD$"); #include <machine/stdarg.h> #include <security/audit/audit.h> +#include <security/mac/mac_framework.h> #include <vm/vm.h> #include <vm/vm_object.h> diff --git a/sys/kern/vfs_vnops.c b/sys/kern/vfs_vnops.c index d71b28b..4a516a7 100644 --- a/sys/kern/vfs_vnops.c +++ b/sys/kern/vfs_vnops.c @@ -48,7 +48,6 @@ __FBSDID("$FreeBSD$"); #include <sys/proc.h> #include <sys/limits.h> #include <sys/lock.h> -#include <sys/mac.h> #include <sys/mount.h> #include <sys/mutex.h> #include <sys/namei.h> @@ -62,6 +61,8 @@ __FBSDID("$FreeBSD$"); #include <sys/syslog.h> #include <sys/unistd.h> +#include <security/mac/mac_framework.h> + static fo_rdwr_t vn_read; static fo_rdwr_t vn_write; static fo_ioctl_t vn_ioctl; diff --git a/sys/net/bpf.c b/sys/net/bpf.c index 12c3052..571d730 100644 --- a/sys/net/bpf.c +++ b/sys/net/bpf.c @@ -45,7 +45,6 @@ #include <sys/systm.h> #include <sys/conf.h> #include <sys/fcntl.h> -#include <sys/mac.h> #include <sys/malloc.h> #include <sys/mbuf.h> #include <sys/time.h> @@ -77,6 +76,8 @@ #include <net80211/ieee80211_freebsd.h> +#include <security/mac/mac_framework.h> + static MALLOC_DEFINE(M_BPF, "BPF", "BPF data"); #if defined(DEV_BPF) || defined(NETGRAPH_BPF) diff --git a/sys/net/bsd_comp.c b/sys/net/bsd_comp.c index 3071fc3..139f772 100644 --- a/sys/net/bsd_comp.c +++ b/sys/net/bsd_comp.c @@ -45,7 +45,6 @@ #include <sys/param.h> #include <sys/systm.h> #include <sys/lock.h> -#include <sys/mac.h> #include <sys/malloc.h> #include <sys/mbuf.h> #include <sys/mutex.h> @@ -55,6 +54,8 @@ #define PACKETPTR struct mbuf * #include <net/ppp_comp.h> +#include <security/mac/mac_framework.h> + /* * PPP "BSD compress" compression * The differences between this compression and the classic BSD LZW diff --git a/sys/net/if.c b/sys/net/if.c index 278b4a8..ba981d4 100644 --- a/sys/net/if.c +++ b/sys/net/if.c @@ -39,7 +39,6 @@ #include <sys/param.h> #include <sys/types.h> #include <sys/conf.h> -#include <sys/mac.h> #include <sys/malloc.h> #include <sys/sbuf.h> #include <sys/bus.h> @@ -82,6 +81,8 @@ #include <netinet/ip_carp.h> #endif +#include <security/mac/mac_framework.h> + SYSCTL_NODE(_net, PF_LINK, link, CTLFLAG_RW, 0, "Link layers"); SYSCTL_NODE(_net_link, 0, generic, CTLFLAG_RW, 0, "Generic link-management"); diff --git a/sys/net/if_atmsubr.c b/sys/net/if_atmsubr.c index d3f7956..bb972b8 100644 --- a/sys/net/if_atmsubr.c +++ b/sys/net/if_atmsubr.c @@ -46,7 +46,6 @@ __FBSDID("$FreeBSD$"); #include <sys/systm.h> #include <sys/kernel.h> #include <sys/module.h> -#include <sys/mac.h> #include <sys/mbuf.h> #include <sys/socket.h> #include <sys/sockio.h> @@ -71,6 +70,8 @@ __FBSDID("$FreeBSD$"); #include <netnatm/natm.h> #endif +#include <security/mac/mac_framework.h> + /* * Netgraph interface functions. * These need not be protected by a lock, because ng_atm nodes are persitent. diff --git a/sys/net/if_ethersubr.c b/sys/net/if_ethersubr.c index 5ba7297..61fa58b 100644 --- a/sys/net/if_ethersubr.c +++ b/sys/net/if_ethersubr.c @@ -41,7 +41,6 @@ #include <sys/param.h> #include <sys/systm.h> #include <sys/kernel.h> -#include <sys/mac.h> #include <sys/malloc.h> #include <sys/module.h> #include <sys/mbuf.h> @@ -97,6 +96,8 @@ extern u_char at_org_code[3]; extern u_char aarp_org_code[3]; #endif /* NETATALK */ +#include <security/mac/mac_framework.h> + /* netgraph node hooks for ng_ether(4) */ void (*ng_ether_input_p)(struct ifnet *ifp, struct mbuf **mp); void (*ng_ether_input_orphan_p)(struct ifnet *ifp, struct mbuf *m); diff --git a/sys/net/if_fddisubr.c b/sys/net/if_fddisubr.c index cc4b1fc..a2fd00b 100644 --- a/sys/net/if_fddisubr.c +++ b/sys/net/if_fddisubr.c @@ -45,7 +45,6 @@ #include <sys/param.h> #include <sys/systm.h> #include <sys/kernel.h> -#include <sys/mac.h> #include <sys/malloc.h> #include <sys/mbuf.h> #include <sys/module.h> @@ -89,6 +88,8 @@ extern u_char at_org_code[ 3 ]; extern u_char aarp_org_code[ 3 ]; #endif /* NETATALK */ +#include <security/mac/mac_framework.h> + static const u_char fddibroadcastaddr[FDDI_ADDR_LEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff }; diff --git a/sys/net/if_fwsubr.c b/sys/net/if_fwsubr.c index 774e206..a39f194 100644 --- a/sys/net/if_fwsubr.c +++ b/sys/net/if_fwsubr.c @@ -37,7 +37,6 @@ #include <sys/param.h> #include <sys/systm.h> #include <sys/kernel.h> -#include <sys/mac.h> #include <sys/malloc.h> #include <sys/mbuf.h> #include <sys/module.h> @@ -62,6 +61,8 @@ #include <netinet6/nd6.h> #endif +#include <security/mac/mac_framework.h> + MALLOC_DEFINE(M_FWCOM, "fw_com", "firewire interface internals"); struct fw_hwaddr firewire_broadcastaddr = { diff --git a/sys/net/if_gif.c b/sys/net/if_gif.c index 3fb8aeb..dfe69bd 100644 --- a/sys/net/if_gif.c +++ b/sys/net/if_gif.c @@ -37,7 +37,6 @@ #include <sys/param.h> #include <sys/systm.h> #include <sys/kernel.h> -#include <sys/mac.h> #include <sys/malloc.h> #include <sys/mbuf.h> #include <sys/module.h> @@ -84,6 +83,8 @@ #include <net/if_bridgevar.h> #include <net/if_gif.h> +#include <security/mac/mac_framework.h> + #define GIFNAME "gif" /* diff --git a/sys/net/if_iso88025subr.c b/sys/net/if_iso88025subr.c index 14c6f98..8dca499 100644 --- a/sys/net/if_iso88025subr.c +++ b/sys/net/if_iso88025subr.c @@ -48,7 +48,6 @@ #include <sys/param.h> #include <sys/systm.h> #include <sys/kernel.h> -#include <sys/mac.h> #include <sys/malloc.h> #include <sys/mbuf.h> #include <sys/module.h> @@ -79,6 +78,8 @@ #include <netipx/ipx_if.h> #endif +#include <security/mac/mac_framework.h> + static const u_char iso88025_broadcastaddr[ISO88025_ADDR_LEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff }; diff --git a/sys/net/if_ppp.c b/sys/net/if_ppp.c index 4d884ef..87f9a41 100644 --- a/sys/net/if_ppp.c +++ b/sys/net/if_ppp.c @@ -88,7 +88,6 @@ #include <sys/param.h> #include <sys/systm.h> #include <sys/proc.h> -#include <sys/mac.h> #include <sys/mbuf.h> #include <sys/socket.h> #include <sys/filio.h> @@ -123,6 +122,8 @@ #include <net/if_ppp.h> #include <net/if_pppvar.h> +#include <security/mac/mac_framework.h> + /* minimise diffs */ #ifndef splsoftnet #define splsoftnet splnet diff --git a/sys/net/if_stf.c b/sys/net/if_stf.c index 3100c95..2f53c44 100644 --- a/sys/net/if_stf.c +++ b/sys/net/if_stf.c @@ -82,7 +82,6 @@ #include <sys/systm.h> #include <sys/socket.h> #include <sys/sockio.h> -#include <sys/mac.h> #include <sys/mbuf.h> #include <sys/errno.h> #include <sys/kernel.h> @@ -117,6 +116,8 @@ #include <net/bpf.h> +#include <security/mac/mac_framework.h> + #define STFNAME "stf" #define STFUNIT 0 diff --git a/sys/net/if_tun.c b/sys/net/if_tun.c index ddf6412..0787669 100644 --- a/sys/net/if_tun.c +++ b/sys/net/if_tun.c @@ -25,7 +25,6 @@ #include <sys/param.h> #include <sys/proc.h> #include <sys/systm.h> -#include <sys/mac.h> #include <sys/mbuf.h> #include <sys/module.h> #include <sys/socket.h> @@ -56,6 +55,8 @@ #include <sys/queue.h> +#include <security/mac/mac_framework.h> + /* * tun_list is protected by global tunmtx. Other mutable fields are * protected by tun->tun_mtx, or by their owning subsystem. tun_dev is diff --git a/sys/netatalk/aarp.c b/sys/netatalk/aarp.c index d835d66..ebadbce 100644 --- a/sys/netatalk/aarp.c +++ b/sys/netatalk/aarp.c @@ -56,7 +56,6 @@ #include <sys/param.h> #include <sys/systm.h> -#include <sys/mac.h> #include <sys/mbuf.h> #include <sys/kernel.h> #include <sys/socket.h> @@ -75,6 +74,8 @@ #include <netatalk/phase2.h> #include <netatalk/at_extern.h> +#include <security/mac/mac_framework.h> + static void aarptfree(struct aarptab *aat); static void at_aarpinput(struct ifnet *ifp, struct mbuf *m); diff --git a/sys/netatalk/ddp_input.c b/sys/netatalk/ddp_input.c index 9ffa10f..5353682 100644 --- a/sys/netatalk/ddp_input.c +++ b/sys/netatalk/ddp_input.c @@ -55,7 +55,6 @@ #include <sys/param.h> #include <sys/kernel.h> #include <sys/lock.h> -#include <sys/mac.h> #include <sys/mbuf.h> #include <sys/signalvar.h> #include <sys/socket.h> @@ -72,6 +71,8 @@ #include <netatalk/ddp_pcb.h> #include <netatalk/at_extern.h> +#include <security/mac/mac_framework.h> + static volatile int ddp_forward = 1; static volatile int ddp_firewall = 0; static struct ddpstat ddpstat; diff --git a/sys/netatalk/ddp_output.c b/sys/netatalk/ddp_output.c index 357d707..c48f043 100644 --- a/sys/netatalk/ddp_output.c +++ b/sys/netatalk/ddp_output.c @@ -27,7 +27,6 @@ #include <sys/param.h> #include <sys/systm.h> -#include <sys/mac.h> #include <sys/mbuf.h> #include <sys/socket.h> #include <sys/socketvar.h> @@ -43,6 +42,8 @@ #include <netatalk/ddp_var.h> #include <netatalk/at_extern.h> +#include <security/mac/mac_framework.h> + int ddp_cksum = 1; int diff --git a/sys/netinet/if_ether.c b/sys/netinet/if_ether.c index ff2f701..61265d4 100644 --- a/sys/netinet/if_ether.c +++ b/sys/netinet/if_ether.c @@ -45,7 +45,6 @@ #include <sys/queue.h> #include <sys/sysctl.h> #include <sys/systm.h> -#include <sys/mac.h> #include <sys/mbuf.h> #include <sys/malloc.h> #include <sys/socket.h> @@ -70,6 +69,8 @@ #include <netinet/ip_carp.h> #endif +#include <security/mac/mac_framework.h> + #define SIN(s) ((struct sockaddr_in *)s) #define SDL(s) ((struct sockaddr_dl *)s) diff --git a/sys/netinet/igmp.c b/sys/netinet/igmp.c index d82727d..ad63218 100644 --- a/sys/netinet/igmp.c +++ b/sys/netinet/igmp.c @@ -49,7 +49,6 @@ #include <sys/param.h> #include <sys/systm.h> -#include <sys/mac.h> #include <sys/malloc.h> #include <sys/mbuf.h> #include <sys/socket.h> @@ -71,6 +70,8 @@ #include <machine/in_cksum.h> +#include <security/mac/mac_framework.h> + static MALLOC_DEFINE(M_IGMP, "igmp", "igmp state"); static struct router_info *find_rti(struct ifnet *ifp); diff --git a/sys/netinet/in_pcb.c b/sys/netinet/in_pcb.c index b117b13..60e7bf0 100644 --- a/sys/netinet/in_pcb.c +++ b/sys/netinet/in_pcb.c @@ -36,7 +36,6 @@ #include <sys/param.h> #include <sys/systm.h> -#include <sys/mac.h> #include <sys/malloc.h> #include <sys/mbuf.h> #include <sys/domain.h> @@ -80,6 +79,8 @@ #include <netipsec/key.h> #endif /* FAST_IPSEC */ +#include <security/mac/mac_framework.h> + /* * These configure the range of local port addresses assigned to * "unspecified" outgoing connections/packets/whatever. diff --git a/sys/netinet/ip_divert.c b/sys/netinet/ip_divert.c index c620e73..d416b0e 100644 --- a/sys/netinet/ip_divert.c +++ b/sys/netinet/ip_divert.c @@ -45,7 +45,6 @@ #include <sys/kernel.h> #include <sys/lock.h> #include <sys/malloc.h> -#include <sys/mac.h> #include <sys/mbuf.h> #include <sys/module.h> #include <sys/kernel.h> @@ -72,6 +71,8 @@ #include <netinet/ip_var.h> #include <netinet/ip_fw.h> +#include <security/mac/mac_framework.h> + /* * Divert sockets */ diff --git a/sys/netinet/ip_fw2.c b/sys/netinet/ip_fw2.c index 2c6b461..9fa652e 100644 --- a/sys/netinet/ip_fw2.c +++ b/sys/netinet/ip_fw2.c @@ -52,7 +52,6 @@ #include <sys/kernel.h> #include <sys/lock.h> #include <sys/jail.h> -#include <sys/mac.h> #include <sys/module.h> #include <sys/proc.h> #include <sys/rwlock.h> @@ -101,6 +100,8 @@ #include <machine/in_cksum.h> /* XXX for in_cksum */ +#include <security/mac/mac_framework.h> + /* * set_disable contains one bit per set value (0..31). * If the bit is set, all rules with the corresponding set diff --git a/sys/netinet/ip_icmp.c b/sys/netinet/ip_icmp.c index b3539a9..3385143 100644 --- a/sys/netinet/ip_icmp.c +++ b/sys/netinet/ip_icmp.c @@ -35,7 +35,6 @@ #include <sys/param.h> #include <sys/systm.h> -#include <sys/mac.h> #include <sys/mbuf.h> #include <sys/protosw.h> #include <sys/socket.h> @@ -73,6 +72,8 @@ #include <machine/in_cksum.h> +#include <security/mac/mac_framework.h> + /* * ICMP routines: error generation, receive packet processing, and * routines to turnaround packets back to the originator, and diff --git a/sys/netinet/ip_input.c b/sys/netinet/ip_input.c index 84768a7..5e682b6 100644 --- a/sys/netinet/ip_input.c +++ b/sys/netinet/ip_input.c @@ -40,7 +40,6 @@ #include <sys/param.h> #include <sys/systm.h> #include <sys/callout.h> -#include <sys/mac.h> #include <sys/mbuf.h> #include <sys/malloc.h> #include <sys/domain.h> @@ -81,6 +80,8 @@ #include <netinet/ip_fw.h> #include <netinet/ip_dummynet.h> +#include <security/mac/mac_framework.h> + int rsvp_on = 0; int ipforwarding = 0; diff --git a/sys/netinet/ip_mroute.c b/sys/netinet/ip_mroute.c index 125a486..a248b72 100644 --- a/sys/netinet/ip_mroute.c +++ b/sys/netinet/ip_mroute.c @@ -65,7 +65,6 @@ #include <sys/param.h> #include <sys/kernel.h> #include <sys/lock.h> -#include <sys/mac.h> #include <sys/malloc.h> #include <sys/mbuf.h> #include <sys/module.h> @@ -98,6 +97,8 @@ #include <netinet/udp.h> #include <machine/in_cksum.h> +#include <security/mac/mac_framework.h> + /* * Control debugging code for rsvp and multicast routing code. * Can only set them with the debugger. diff --git a/sys/netinet/ip_options.c b/sys/netinet/ip_options.c index 39126c8..8986275 100644 --- a/sys/netinet/ip_options.c +++ b/sys/netinet/ip_options.c @@ -36,7 +36,6 @@ #include <sys/param.h> #include <sys/systm.h> -#include <sys/mac.h> #include <sys/mbuf.h> /* #include <sys/malloc.h> */ #include <sys/domain.h> @@ -66,6 +65,8 @@ #include <sys/socketvar.h> +#include <security/mac/mac_framework.h> + static int ip_dosourceroute = 0; SYSCTL_INT(_net_inet_ip, IPCTL_SOURCEROUTE, sourceroute, CTLFLAG_RW, &ip_dosourceroute, 0, "Enable forwarding source routed IP packets"); diff --git a/sys/netinet/ip_output.c b/sys/netinet/ip_output.c index f9c78fd..6e3833e 100644 --- a/sys/netinet/ip_output.c +++ b/sys/netinet/ip_output.c @@ -38,7 +38,6 @@ #include <sys/param.h> #include <sys/systm.h> #include <sys/kernel.h> -#include <sys/mac.h> #include <sys/malloc.h> #include <sys/mbuf.h> #include <sys/protosw.h> @@ -71,6 +70,8 @@ #include <machine/in_cksum.h> +#include <security/mac/mac_framework.h> + static MALLOC_DEFINE(M_IPMOPTS, "ip_moptions", "internet multicast options"); #define print_ip(x, a, y) printf("%s %d.%d.%d.%d%s",\ diff --git a/sys/netinet/raw_ip.c b/sys/netinet/raw_ip.c index 070d32e..837933b 100644 --- a/sys/netinet/raw_ip.c +++ b/sys/netinet/raw_ip.c @@ -38,7 +38,6 @@ #include <sys/jail.h> #include <sys/kernel.h> #include <sys/lock.h> -#include <sys/mac.h> #include <sys/malloc.h> #include <sys/mbuf.h> #include <sys/proc.h> @@ -74,6 +73,8 @@ #include <netinet6/ipsec.h> #endif /*IPSEC*/ +#include <security/mac/mac_framework.h> + struct inpcbhead ripcb; struct inpcbinfo ripcbinfo; diff --git a/sys/netinet/tcp_input.c b/sys/netinet/tcp_input.c index 9508abc..9aef64b 100644 --- a/sys/netinet/tcp_input.c +++ b/sys/netinet/tcp_input.c @@ -41,7 +41,6 @@ #include <sys/param.h> #include <sys/kernel.h> -#include <sys/mac.h> #include <sys/malloc.h> #include <sys/mbuf.h> #include <sys/proc.h> /* for proc0 declaration */ @@ -98,6 +97,8 @@ #include <machine/in_cksum.h> +#include <security/mac/mac_framework.h> + static const int tcprexmtthresh = 3; struct tcpstat tcpstat; diff --git a/sys/netinet/tcp_output.c b/sys/netinet/tcp_output.c index 6833e7e..25402cd 100644 --- a/sys/netinet/tcp_output.c +++ b/sys/netinet/tcp_output.c @@ -42,7 +42,6 @@ #include <sys/domain.h> #include <sys/kernel.h> #include <sys/lock.h> -#include <sys/mac.h> #include <sys/mbuf.h> #include <sys/mutex.h> #include <sys/protosw.h> @@ -85,6 +84,8 @@ #include <machine/in_cksum.h> +#include <security/mac/mac_framework.h> + #ifdef notyet extern struct mbuf *m_copypack(); #endif diff --git a/sys/netinet/tcp_reass.c b/sys/netinet/tcp_reass.c index 9508abc..9aef64b 100644 --- a/sys/netinet/tcp_reass.c +++ b/sys/netinet/tcp_reass.c @@ -41,7 +41,6 @@ #include <sys/param.h> #include <sys/kernel.h> -#include <sys/mac.h> #include <sys/malloc.h> #include <sys/mbuf.h> #include <sys/proc.h> /* for proc0 declaration */ @@ -98,6 +97,8 @@ #include <machine/in_cksum.h> +#include <security/mac/mac_framework.h> + static const int tcprexmtthresh = 3; struct tcpstat tcpstat; diff --git a/sys/netinet/tcp_subr.c b/sys/netinet/tcp_subr.c index af99313..2b4f9bc 100644 --- a/sys/netinet/tcp_subr.c +++ b/sys/netinet/tcp_subr.c @@ -43,7 +43,6 @@ #include <sys/callout.h> #include <sys/kernel.h> #include <sys/sysctl.h> -#include <sys/mac.h> #include <sys/malloc.h> #include <sys/mbuf.h> #ifdef INET6 @@ -113,6 +112,8 @@ #include <machine/in_cksum.h> #include <sys/md5.h> +#include <security/mac/mac_framework.h> + int tcp_mssdflt = TCP_MSS; SYSCTL_INT(_net_inet_tcp, TCPCTL_MSSDFLT, mssdflt, CTLFLAG_RW, &tcp_mssdflt , 0, "Default TCP Maximum Segment Size"); diff --git a/sys/netinet/tcp_syncache.c b/sys/netinet/tcp_syncache.c index 06859d4..e8ca230 100644 --- a/sys/netinet/tcp_syncache.c +++ b/sys/netinet/tcp_syncache.c @@ -44,7 +44,6 @@ #include <sys/lock.h> #include <sys/mutex.h> #include <sys/malloc.h> -#include <sys/mac.h> #include <sys/mbuf.h> #include <sys/md5.h> #include <sys/proc.h> /* for proc0 declaration */ @@ -97,6 +96,8 @@ #include <machine/in_cksum.h> +#include <security/mac/mac_framework.h> + static int tcp_syncookies = 1; SYSCTL_INT(_net_inet_tcp, OID_AUTO, syncookies, CTLFLAG_RW, &tcp_syncookies, 0, diff --git a/sys/netinet/tcp_timewait.c b/sys/netinet/tcp_timewait.c index af99313..2b4f9bc 100644 --- a/sys/netinet/tcp_timewait.c +++ b/sys/netinet/tcp_timewait.c @@ -43,7 +43,6 @@ #include <sys/callout.h> #include <sys/kernel.h> #include <sys/sysctl.h> -#include <sys/mac.h> #include <sys/malloc.h> #include <sys/mbuf.h> #ifdef INET6 @@ -113,6 +112,8 @@ #include <machine/in_cksum.h> #include <sys/md5.h> +#include <security/mac/mac_framework.h> + int tcp_mssdflt = TCP_MSS; SYSCTL_INT(_net_inet_tcp, TCPCTL_MSSDFLT, mssdflt, CTLFLAG_RW, &tcp_mssdflt , 0, "Default TCP Maximum Segment Size"); diff --git a/sys/netinet/udp_usrreq.c b/sys/netinet/udp_usrreq.c index b1911b5..28245875 100644 --- a/sys/netinet/udp_usrreq.c +++ b/sys/netinet/udp_usrreq.c @@ -42,7 +42,6 @@ #include <sys/jail.h> #include <sys/kernel.h> #include <sys/lock.h> -#include <sys/mac.h> #include <sys/malloc.h> #include <sys/mbuf.h> #include <sys/proc.h> @@ -87,6 +86,8 @@ #include <machine/in_cksum.h> +#include <security/mac/mac_framework.h> + /* * UDP protocol implementation. * Per RFC 768, August, 1980. diff --git a/sys/netinet6/nd6.c b/sys/netinet6/nd6.c index c0b5dcd..16a5294 100644 --- a/sys/netinet6/nd6.c +++ b/sys/netinet6/nd6.c @@ -37,7 +37,6 @@ #include <sys/param.h> #include <sys/systm.h> #include <sys/callout.h> -#include <sys/mac.h> #include <sys/malloc.h> #include <sys/mbuf.h> #include <sys/socket.h> @@ -69,6 +68,8 @@ #include <sys/limits.h> +#include <security/mac/mac_framework.h> + #define ND6_SLOWTIMER_INTERVAL (60 * 60) /* 1 hour */ #define ND6_RECALC_REACHTM_INTERVAL (60 * 120) /* 2 hours */ diff --git a/sys/nfsserver/nfs_srvsock.c b/sys/nfsserver/nfs_srvsock.c index ffeb4ef..eba9cfb 100644 --- a/sys/nfsserver/nfs_srvsock.c +++ b/sys/nfsserver/nfs_srvsock.c @@ -45,7 +45,6 @@ __FBSDID("$FreeBSD$"); #include <sys/systm.h> #include <sys/kernel.h> #include <sys/lock.h> -#include <sys/mac.h> #include <sys/malloc.h> #include <sys/mbuf.h> #include <sys/mount.h> @@ -69,6 +68,8 @@ __FBSDID("$FreeBSD$"); #include <nfs/xdr_subs.h> #include <nfsserver/nfsm_subs.h> +#include <security/mac/mac_framework.h> + #define TRUE 1 #define FALSE 0 diff --git a/sys/nfsserver/nfs_syscalls.c b/sys/nfsserver/nfs_syscalls.c index 5b261f1..b74325f 100644 --- a/sys/nfsserver/nfs_syscalls.c +++ b/sys/nfsserver/nfs_syscalls.c @@ -46,7 +46,6 @@ __FBSDID("$FreeBSD$"); #include <sys/file.h> #include <sys/filedesc.h> #include <sys/vnode.h> -#include <sys/mac.h> #include <sys/malloc.h> #include <sys/mount.h> #include <sys/proc.h> @@ -74,6 +73,8 @@ __FBSDID("$FreeBSD$"); #include <nfsserver/nfsm_subs.h> #include <nfsserver/nfsrvcache.h> +#include <security/mac/mac_framework.h> + static MALLOC_DEFINE(M_NFSSVC, "nfsserver_srvsock", "Nfs server structure"); MALLOC_DEFINE(M_NFSRVDESC, "nfsserver_srvdesc", "NFS server socket descriptor"); diff --git a/sys/security/mac/mac_framework.c b/sys/security/mac/mac_framework.c index b553c80..8d69dcc 100644 --- a/sys/security/mac/mac_framework.c +++ b/sys/security/mac/mac_framework.c @@ -2,7 +2,7 @@ * Copyright (c) 1999-2002 Robert N. M. Watson * Copyright (c) 2001 Ilmar S. Habibulin * Copyright (c) 2001-2005 Networks Associates Technology, Inc. - * Copyright (c) 2005 SPARTA, Inc. + * Copyright (c) 2005-2006 SPARTA, Inc. * All rights reserved. * * This software was developed by Robert Watson and Ilmar Habibulin for the @@ -91,6 +91,7 @@ __FBSDID("$FreeBSD$"); #include <netinet/in.h> #include <netinet/ip_var.h> +#include <security/mac/mac_framework.h> #include <security/mac/mac_internal.h> #ifdef MAC diff --git a/sys/security/mac/mac_framework.h b/sys/security/mac/mac_framework.h index 520e767..02d3eb9 100644 --- a/sys/security/mac/mac_framework.h +++ b/sys/security/mac/mac_framework.h @@ -1,7 +1,7 @@ /*- * Copyright (c) 1999-2002 Robert N. M. Watson * Copyright (c) 2001-2005 Networks Associates Technology, Inc. - * Copyright (c) 2005 SPARTA, Inc. + * Copyright (c) 2005-2006 SPARTA, Inc. * All rights reserved. * * This software was developed by Robert Watson for the TrustedBSD Project. @@ -37,91 +37,33 @@ * * $FreeBSD$ */ -/* - * Userland/kernel interface for Mandatory Access Control. - * - * The POSIX.1e implementation page may be reached at: - * http://www.trustedbsd.org/ - */ - -#ifndef _SYS_MAC_H_ -#define _SYS_MAC_H_ - -#include <sys/_label.h> - -#ifndef _POSIX_MAC -#define _POSIX_MAC -#endif /* - * MAC framework-related constants and limits. + * Kernel interface for Mandatory Access Control -- how kernel services + * interact with the TrustedBSD MAC Framework. */ -#define MAC_MAX_POLICY_NAME 32 -#define MAC_MAX_LABEL_ELEMENT_NAME 32 -#define MAC_MAX_LABEL_ELEMENT_DATA 4096 -#define MAC_MAX_LABEL_BUF_LEN 8192 - -struct mac { - size_t m_buflen; - char *m_string; -}; -typedef struct mac *mac_t; +#ifndef _SYS_SECURITY_MAC_MAC_FRAMEWORK_H_ +#define _SYS_SECURITY_MAC_MAC_MAC_FRAMEWORK_H_ #ifndef _KERNEL +#error "no user-serviceable parts inside" +#endif -/* - * Location of the userland MAC framework configuration file. mac.conf - * binds policy names to shared libraries that understand those policies, - * as well as setting defaults for MAC-aware applications. - */ -#define MAC_CONFFILE "/etc/mac.conf" - -/* - * Extended non-POSIX.1e interfaces that offer additional services - * available from the userland and kernel MAC frameworks. - */ -__BEGIN_DECLS -int mac_execve(char *fname, char **argv, char **envv, mac_t _label); -int mac_free(mac_t _label); -int mac_from_text(mac_t *_label, const char *_text); -int mac_get_fd(int _fd, mac_t _label); -int mac_get_file(const char *_path, mac_t _label); -int mac_get_link(const char *_path, mac_t _label); -int mac_get_peer(int _fd, mac_t _label); -int mac_get_pid(pid_t _pid, mac_t _label); -int mac_get_proc(mac_t _label); -int mac_is_present(const char *_policyname); -int mac_prepare(mac_t *_label, const char *_elements); -int mac_prepare_file_label(mac_t *_label); -int mac_prepare_ifnet_label(mac_t *_label); -int mac_prepare_process_label(mac_t *_label); -int mac_prepare_type(mac_t *_label, const char *_type); -int mac_set_fd(int _fildes, const mac_t _label); -int mac_set_file(const char *_path, mac_t _label); -int mac_set_link(const char *_path, mac_t _label); -int mac_set_proc(const mac_t _label); -int mac_syscall(const char *_policyname, int _call, void *_arg); -int mac_to_text(mac_t mac, char **_text); -__END_DECLS - -#else /* _KERNEL */ +#include <sys/_label.h> -/* - * Kernel functions to manage and evaluate labels. - */ struct bpf_d; struct cdev; struct componentname; struct devfs_dirent; struct ifnet; struct ifreq; -struct inpcb; struct image_params; struct inpcb; struct ipq; struct ksem; struct m_tag; +struct mac; struct mbuf; struct mount; struct msg; @@ -140,14 +82,14 @@ struct ucred; struct uio; struct vattr; struct vnode; +struct vop_setlabel_args; #include <sys/acl.h> /* XXX acl_type_t */ -struct vop_setlabel_args; - /* - * Label operations. + * Kernel functions to manage and evaluate labels. */ + void mac_init_bpfdesc(struct bpf_d *); void mac_init_cred(struct ucred *); void mac_init_devfsdirent(struct devfs_dirent *); @@ -472,6 +414,4 @@ void mac_associate_nfsd_label(struct ucred *cred); */ int vop_stdsetlabel_ea(struct vop_setlabel_args *ap); -#endif /* !_KERNEL */ - -#endif /* !_SYS_MAC_H_ */ +#endif /* !_SYS_SECURITY_MAC_MAC_FRAMEWORK_H_ */ diff --git a/sys/security/mac/mac_inet.c b/sys/security/mac/mac_inet.c index 7dafc45..0d35e48 100644 --- a/sys/security/mac/mac_inet.c +++ b/sys/security/mac/mac_inet.c @@ -64,6 +64,7 @@ __FBSDID("$FreeBSD$"); #include <netinet/in_pcb.h> #include <netinet/ip_var.h> +#include <security/mac/mac_framework.h> #include <security/mac/mac_internal.h> static struct label * diff --git a/sys/security/mac/mac_label.c b/sys/security/mac/mac_label.c index f6d92ef..572d598 100644 --- a/sys/security/mac/mac_label.c +++ b/sys/security/mac/mac_label.c @@ -41,6 +41,7 @@ __FBSDID("$FreeBSD$"); #include <vm/uma.h> +#include <security/mac/mac_framework.h> #include <security/mac/mac_internal.h> uma_zone_t zone_label; diff --git a/sys/security/mac/mac_net.c b/sys/security/mac/mac_net.c index d542806..eb602da 100644 --- a/sys/security/mac/mac_net.c +++ b/sys/security/mac/mac_net.c @@ -61,6 +61,7 @@ __FBSDID("$FreeBSD$"); #include <net/if.h> #include <net/if_var.h> +#include <security/mac/mac_framework.h> #include <security/mac/mac_internal.h> /* diff --git a/sys/security/mac/mac_pipe.c b/sys/security/mac/mac_pipe.c index 6a59567..edc03132 100644 --- a/sys/security/mac/mac_pipe.c +++ b/sys/security/mac/mac_pipe.c @@ -49,6 +49,7 @@ __FBSDID("$FreeBSD$"); #include <sys/mac_policy.h> +#include <security/mac/mac_framework.h> #include <security/mac/mac_internal.h> static int mac_enforce_pipe = 1; diff --git a/sys/security/mac/mac_policy.h b/sys/security/mac/mac_policy.h index afd437f..a7e9d834 100644 --- a/sys/security/mac/mac_policy.h +++ b/sys/security/mac/mac_policy.h @@ -55,6 +55,8 @@ * Operations are sorted first by general class of operation, then * alphabetically. */ +#include <sys/acl.h> /* XXX acl_type_t */ + struct acl; struct bpf_d; struct componentname; diff --git a/sys/security/mac/mac_posix_sem.c b/sys/security/mac/mac_posix_sem.c index a71b021..e852779 100644 --- a/sys/security/mac/mac_posix_sem.c +++ b/sys/security/mac/mac_posix_sem.c @@ -47,6 +47,7 @@ __FBSDID("$FreeBSD$"); #include <sys/mac_policy.h> +#include <security/mac/mac_framework.h> #include <security/mac/mac_internal.h> static int mac_enforce_posix_sem = 1; diff --git a/sys/security/mac/mac_process.c b/sys/security/mac/mac_process.c index c3f8eab..c903204 100644 --- a/sys/security/mac/mac_process.c +++ b/sys/security/mac/mac_process.c @@ -64,6 +64,7 @@ __FBSDID("$FreeBSD$"); #include <sys/mac_policy.h> +#include <security/mac/mac_framework.h> #include <security/mac/mac_internal.h> int mac_enforce_process = 1; diff --git a/sys/security/mac/mac_socket.c b/sys/security/mac/mac_socket.c index 21439cd..2766716 100644 --- a/sys/security/mac/mac_socket.c +++ b/sys/security/mac/mac_socket.c @@ -69,6 +69,7 @@ __FBSDID("$FreeBSD$"); #include <netinet/in_pcb.h> #include <netinet/ip_var.h> +#include <security/mac/mac_framework.h> #include <security/mac/mac_internal.h> /* diff --git a/sys/security/mac/mac_syscalls.c b/sys/security/mac/mac_syscalls.c index b553c80..8d69dcc 100644 --- a/sys/security/mac/mac_syscalls.c +++ b/sys/security/mac/mac_syscalls.c @@ -2,7 +2,7 @@ * Copyright (c) 1999-2002 Robert N. M. Watson * Copyright (c) 2001 Ilmar S. Habibulin * Copyright (c) 2001-2005 Networks Associates Technology, Inc. - * Copyright (c) 2005 SPARTA, Inc. + * Copyright (c) 2005-2006 SPARTA, Inc. * All rights reserved. * * This software was developed by Robert Watson and Ilmar Habibulin for the @@ -91,6 +91,7 @@ __FBSDID("$FreeBSD$"); #include <netinet/in.h> #include <netinet/ip_var.h> +#include <security/mac/mac_framework.h> #include <security/mac/mac_internal.h> #ifdef MAC diff --git a/sys/security/mac/mac_system.c b/sys/security/mac/mac_system.c index 6cd6430..eef66e6 100644 --- a/sys/security/mac/mac_system.c +++ b/sys/security/mac/mac_system.c @@ -47,6 +47,7 @@ __FBSDID("$FreeBSD$"); #include <sys/mac_policy.h> +#include <security/mac/mac_framework.h> #include <security/mac/mac_internal.h> static int mac_enforce_kld = 1; diff --git a/sys/security/mac/mac_sysv_msg.c b/sys/security/mac/mac_sysv_msg.c index d7e2629..86ae8a8 100644 --- a/sys/security/mac/mac_sysv_msg.c +++ b/sys/security/mac/mac_sysv_msg.c @@ -51,6 +51,7 @@ __FBSDID("$FreeBSD$"); #include <sys/mac_policy.h> +#include <security/mac/mac_framework.h> #include <security/mac/mac_internal.h> static int mac_enforce_sysv_msg = 1; diff --git a/sys/security/mac/mac_sysv_sem.c b/sys/security/mac/mac_sysv_sem.c index ffe31e1..aae6788 100644 --- a/sys/security/mac/mac_sysv_sem.c +++ b/sys/security/mac/mac_sysv_sem.c @@ -51,6 +51,7 @@ __FBSDID("$FreeBSD$"); #include <sys/mac_policy.h> +#include <security/mac/mac_framework.h> #include <security/mac/mac_internal.h> static int mac_enforce_sysv_sem = 1; diff --git a/sys/security/mac/mac_sysv_shm.c b/sys/security/mac/mac_sysv_shm.c index adbea14..b7c8cfb 100644 --- a/sys/security/mac/mac_sysv_shm.c +++ b/sys/security/mac/mac_sysv_shm.c @@ -51,6 +51,7 @@ __FBSDID("$FreeBSD$"); #include <sys/mac_policy.h> +#include <security/mac/mac_framework.h> #include <security/mac/mac_internal.h> static int mac_enforce_sysv_shm = 1; diff --git a/sys/security/mac/mac_vfs.c b/sys/security/mac/mac_vfs.c index 058dc6c..ef667b1 100644 --- a/sys/security/mac/mac_vfs.c +++ b/sys/security/mac/mac_vfs.c @@ -70,6 +70,7 @@ __FBSDID("$FreeBSD$"); #include <fs/devfs/devfs.h> +#include <security/mac/mac_framework.h> #include <security/mac/mac_internal.h> /* diff --git a/sys/security/mac_lomac/mac_lomac.c b/sys/security/mac_lomac/mac_lomac.c index 8ae03e0..07484d1 100644 --- a/sys/security/mac_lomac/mac_lomac.c +++ b/sys/security/mac_lomac/mac_lomac.c @@ -45,7 +45,6 @@ #include <sys/conf.h> #include <sys/extattr.h> #include <sys/kernel.h> -#include <sys/mac.h> #include <sys/malloc.h> #include <sys/mman.h> #include <sys/mount.h> @@ -79,6 +78,7 @@ #include <sys/mac_policy.h> +#include <security/mac/mac_framework.h> #include <security/mac_lomac/mac_lomac.h> struct mac_lomac_proc { diff --git a/sys/sys/mac.h b/sys/sys/mac.h index 520e767..56ab0a9 100644 --- a/sys/sys/mac.h +++ b/sys/sys/mac.h @@ -1,7 +1,7 @@ /*- * Copyright (c) 1999-2002 Robert N. M. Watson * Copyright (c) 2001-2005 Networks Associates Technology, Inc. - * Copyright (c) 2005 SPARTA, Inc. + * Copyright (c) 2005-2006 SPARTA, Inc. * All rights reserved. * * This software was developed by Robert Watson for the TrustedBSD Project. @@ -38,7 +38,7 @@ * $FreeBSD$ */ /* - * Userland/kernel interface for Mandatory Access Control. + * Userland interface for Mandatory Access Control. * * The POSIX.1e implementation page may be reached at: * http://www.trustedbsd.org/ @@ -105,373 +105,6 @@ int mac_syscall(const char *_policyname, int _call, void *_arg); int mac_to_text(mac_t mac, char **_text); __END_DECLS -#else /* _KERNEL */ - -/* - * Kernel functions to manage and evaluate labels. - */ -struct bpf_d; -struct cdev; -struct componentname; -struct devfs_dirent; -struct ifnet; -struct ifreq; -struct inpcb; -struct image_params; -struct inpcb; -struct ipq; -struct ksem; -struct m_tag; -struct mbuf; -struct mount; -struct msg; -struct msqid_kernel; -struct proc; -struct semid_kernel; -struct shmid_kernel; -struct sockaddr; -struct socket; -struct sysctl_oid; -struct sysctl_req; -struct pipepair; -struct thread; -struct timespec; -struct ucred; -struct uio; -struct vattr; -struct vnode; - -#include <sys/acl.h> /* XXX acl_type_t */ - -struct vop_setlabel_args; - -/* - * Label operations. - */ -void mac_init_bpfdesc(struct bpf_d *); -void mac_init_cred(struct ucred *); -void mac_init_devfsdirent(struct devfs_dirent *); -void mac_init_ifnet(struct ifnet *); -int mac_init_inpcb(struct inpcb *, int flag); -void mac_init_sysv_msgmsg(struct msg *); -void mac_init_sysv_msgqueue(struct msqid_kernel*); -void mac_init_sysv_sem(struct semid_kernel*); -void mac_init_sysv_shm(struct shmid_kernel*); -int mac_init_ipq(struct ipq *, int flag); -int mac_init_socket(struct socket *, int flag); -void mac_init_pipe(struct pipepair *); -void mac_init_posix_sem(struct ksem *); -int mac_init_mbuf(struct mbuf *mbuf, int flag); -int mac_init_mbuf_tag(struct m_tag *, int flag); -void mac_init_mount(struct mount *); -void mac_init_proc(struct proc *); -void mac_init_vnode(struct vnode *); -void mac_copy_mbuf(struct mbuf *m_from, struct mbuf *m_to); -void mac_copy_mbuf_tag(struct m_tag *, struct m_tag *); -void mac_copy_vnode_label(struct label *, struct label *label); -void mac_destroy_bpfdesc(struct bpf_d *); -void mac_destroy_cred(struct ucred *); -void mac_destroy_devfsdirent(struct devfs_dirent *); -void mac_destroy_ifnet(struct ifnet *); -void mac_destroy_inpcb(struct inpcb *); -void mac_destroy_sysv_msgmsg(struct msg *); -void mac_destroy_sysv_msgqueue(struct msqid_kernel *); -void mac_destroy_sysv_sem(struct semid_kernel *); -void mac_destroy_sysv_shm(struct shmid_kernel *); -void mac_destroy_ipq(struct ipq *); -void mac_destroy_socket(struct socket *); -void mac_destroy_pipe(struct pipepair *); -void mac_destroy_posix_sem(struct ksem *); -void mac_destroy_proc(struct proc *); -void mac_destroy_mbuf_tag(struct m_tag *); -void mac_destroy_mount(struct mount *); -void mac_destroy_vnode(struct vnode *); - -struct label *mac_cred_label_alloc(void); -void mac_cred_label_free(struct label *label); -struct label *mac_vnode_label_alloc(void); -void mac_vnode_label_free(struct label *label); - -/* - * Labeling event operations: file system objects, and things that - * look a lot like file system objects. - */ -void mac_associate_vnode_devfs(struct mount *mp, struct devfs_dirent *de, - struct vnode *vp); -int mac_associate_vnode_extattr(struct mount *mp, struct vnode *vp); -void mac_associate_vnode_singlelabel(struct mount *mp, struct vnode *vp); -void mac_create_devfs_device(struct ucred *cred, struct mount *mp, - struct cdev *dev, struct devfs_dirent *de); -void mac_create_devfs_directory(struct mount *mp, char *dirname, - int dirnamelen, struct devfs_dirent *de); -void mac_create_devfs_symlink(struct ucred *cred, struct mount *mp, - struct devfs_dirent *dd, struct devfs_dirent *de); -int mac_create_vnode_extattr(struct ucred *cred, struct mount *mp, - struct vnode *dvp, struct vnode *vp, struct componentname *cnp); -void mac_create_mount(struct ucred *cred, struct mount *mp); -void mac_relabel_vnode(struct ucred *cred, struct vnode *vp, - struct label *newlabel); -void mac_update_devfsdirent(struct mount *mp, struct devfs_dirent *de, - struct vnode *vp); - -/* - * Labeling event operations: IPC objects. - */ -void mac_create_mbuf_from_socket(struct socket *so, struct mbuf *m); -void mac_create_socket(struct ucred *cred, struct socket *socket); -void mac_create_socket_from_socket(struct socket *oldsocket, - struct socket *newsocket); -void mac_set_socket_peer_from_mbuf(struct mbuf *mbuf, - struct socket *socket); -void mac_set_socket_peer_from_socket(struct socket *oldsocket, - struct socket *newsocket); -void mac_create_pipe(struct ucred *cred, struct pipepair *pp); - -/* - * Labeling event operations: System V IPC primitives - */ -void mac_create_sysv_msgmsg(struct ucred *cred, - struct msqid_kernel *msqkptr, struct msg *msgptr); -void mac_create_sysv_msgqueue(struct ucred *cred, - struct msqid_kernel *msqkptr); -void mac_create_sysv_sem(struct ucred *cred, - struct semid_kernel *semakptr); -void mac_create_sysv_shm(struct ucred *cred, - struct shmid_kernel *shmsegptr); - -/* - * Labeling event operations: POSIX (global/inter-process) semaphores. - */ -void mac_create_posix_sem(struct ucred *cred, struct ksem *ksemptr); - - -/* - * Labeling event operations: network objects. - */ -void mac_create_bpfdesc(struct ucred *cred, struct bpf_d *bpf_d); -void mac_create_ifnet(struct ifnet *ifp); -void mac_create_inpcb_from_socket(struct socket *so, struct inpcb *inp); -void mac_create_ipq(struct mbuf *fragment, struct ipq *ipq); -void mac_create_datagram_from_ipq(struct ipq *ipq, struct mbuf *datagram); -void mac_create_fragment(struct mbuf *datagram, struct mbuf *fragment); -void mac_create_mbuf_from_inpcb(struct inpcb *inp, struct mbuf *m); -void mac_create_mbuf_linklayer(struct ifnet *ifnet, struct mbuf *m); -void mac_create_mbuf_from_bpfdesc(struct bpf_d *bpf_d, struct mbuf *m); -void mac_create_mbuf_from_ifnet(struct ifnet *ifnet, struct mbuf *m); -void mac_create_mbuf_multicast_encap(struct mbuf *oldmbuf, - struct ifnet *ifnet, struct mbuf *newmbuf); -void mac_create_mbuf_netlayer(struct mbuf *oldmbuf, struct mbuf *newmbuf); -int mac_fragment_match(struct mbuf *fragment, struct ipq *ipq); -void mac_reflect_mbuf_icmp(struct mbuf *m); -void mac_reflect_mbuf_tcp(struct mbuf *m); -void mac_update_ipq(struct mbuf *fragment, struct ipq *ipq); -void mac_inpcb_sosetlabel(struct socket *so, struct inpcb *inp); - -void mac_create_mbuf_from_firewall(struct mbuf *m); -/* - * Labeling event operations: processes. - */ -void mac_copy_cred(struct ucred *cr1, struct ucred *cr2); -int mac_execve_enter(struct image_params *imgp, struct mac *mac_p); -void mac_execve_exit(struct image_params *imgp); -void mac_execve_transition(struct ucred *old, struct ucred *new, - struct vnode *vp, struct label *interpvnodelabel, - struct image_params *imgp); -int mac_execve_will_transition(struct ucred *old, struct vnode *vp, - struct label *interpvnodelabel, struct image_params *imgp); -void mac_create_proc0(struct ucred *cred); -void mac_create_proc1(struct ucred *cred); -void mac_thread_userret(struct thread *td); - -/* - * Label cleanup operation: This is the inverse complement for the - * mac_create and associate type of hooks. This hook lets the policy - * module(s) perform a cleanup/flushing operation on the label - * associated with the objects, without freeing up the space allocated. - * This hook is useful in cases where it is desirable to remove any - * labeling reference when recycling any object to a pool. This hook - * does not replace the mac_destroy hooks. - */ -void mac_cleanup_sysv_msgmsg(struct msg *msgptr); -void mac_cleanup_sysv_msgqueue(struct msqid_kernel *msqkptr); -void mac_cleanup_sysv_sem(struct semid_kernel *semakptr); -void mac_cleanup_sysv_shm(struct shmid_kernel *shmsegptr); - -/* Access control checks. */ -int mac_check_bpfdesc_receive(struct bpf_d *bpf_d, struct ifnet *ifnet); -int mac_check_cred_visible(struct ucred *u1, struct ucred *u2); -int mac_check_ifnet_transmit(struct ifnet *ifnet, struct mbuf *m); -int mac_check_inpcb_deliver(struct inpcb *inp, struct mbuf *m); -int mac_check_sysv_msgmsq(struct ucred *cred, struct msg *msgptr, - struct msqid_kernel *msqkptr); -int mac_check_sysv_msgrcv(struct ucred *cred, struct msg *msgptr); -int mac_check_sysv_msgrmid(struct ucred *cred, struct msg *msgptr); -int mac_check_sysv_msqget(struct ucred *cred, - struct msqid_kernel *msqkptr); -int mac_check_sysv_msqsnd(struct ucred *cred, - struct msqid_kernel *msqkptr); -int mac_check_sysv_msqrcv(struct ucred *cred, - struct msqid_kernel *msqkptr); -int mac_check_sysv_msqctl(struct ucred *cred, - struct msqid_kernel *msqkptr, int cmd); -int mac_check_sysv_semctl(struct ucred *cred, - struct semid_kernel *semakptr, int cmd); -int mac_check_sysv_semget(struct ucred *cred, - struct semid_kernel *semakptr); -int mac_check_sysv_semop(struct ucred *cred,struct semid_kernel *semakptr, - size_t accesstype); -int mac_check_sysv_shmat(struct ucred *cred, - struct shmid_kernel *shmsegptr, int shmflg); -int mac_check_sysv_shmctl(struct ucred *cred, - struct shmid_kernel *shmsegptr, int cmd); -int mac_check_sysv_shmdt(struct ucred *cred, - struct shmid_kernel *shmsegptr); -int mac_check_sysv_shmget(struct ucred *cred, - struct shmid_kernel *shmsegptr, int shmflg); -int mac_check_kenv_dump(struct ucred *cred); -int mac_check_kenv_get(struct ucred *cred, char *name); -int mac_check_kenv_set(struct ucred *cred, char *name, char *value); -int mac_check_kenv_unset(struct ucred *cred, char *name); -int mac_check_kld_load(struct ucred *cred, struct vnode *vp); -int mac_check_kld_stat(struct ucred *cred); -int mac_check_kld_unload(struct ucred *cred); -int mac_check_mount_stat(struct ucred *cred, struct mount *mp); -int mac_check_pipe_ioctl(struct ucred *cred, struct pipepair *pp, - unsigned long cmd, void *data); -int mac_check_pipe_poll(struct ucred *cred, struct pipepair *pp); -int mac_check_pipe_read(struct ucred *cred, struct pipepair *pp); -int mac_check_pipe_stat(struct ucred *cred, struct pipepair *pp); -int mac_check_pipe_write(struct ucred *cred, struct pipepair *pp); -int mac_check_posix_sem_destroy(struct ucred *cred, struct ksem *ksemptr); -int mac_check_posix_sem_getvalue(struct ucred *cred,struct ksem *ksemptr); -int mac_check_posix_sem_open(struct ucred *cred, struct ksem *ksemptr); -int mac_check_posix_sem_post(struct ucred *cred, struct ksem *ksemptr); -int mac_check_posix_sem_unlink(struct ucred *cred, struct ksem *ksemptr); -int mac_check_posix_sem_wait(struct ucred *cred, struct ksem *ksemptr); -int mac_check_proc_debug(struct ucred *cred, struct proc *proc); -int mac_check_proc_sched(struct ucred *cred, struct proc *proc); -int mac_check_proc_setuid(struct proc *proc, struct ucred *cred, - uid_t uid); -int mac_check_proc_seteuid(struct proc *proc, struct ucred *cred, - uid_t euid); -int mac_check_proc_setgid(struct proc *proc, struct ucred *cred, - gid_t gid); -int mac_check_proc_setegid(struct proc *proc, struct ucred *cred, - gid_t egid); -int mac_check_proc_setgroups(struct proc *proc, struct ucred *cred, - int ngroups, gid_t *gidset); -int mac_check_proc_setreuid(struct proc *proc, struct ucred *cred, - uid_t ruid, uid_t euid); -int mac_check_proc_setregid(struct proc *proc, struct ucred *cred, - gid_t rgid, gid_t egid); -int mac_check_proc_setresuid(struct proc *proc, struct ucred *cred, - uid_t ruid, uid_t euid, uid_t suid); -int mac_check_proc_setresgid(struct proc *proc, struct ucred *cred, - gid_t rgid, gid_t egid, gid_t sgid); -int mac_check_proc_signal(struct ucred *cred, struct proc *proc, - int signum); -int mac_check_proc_wait(struct ucred *cred, struct proc *proc); -int mac_check_socket_accept(struct ucred *cred, struct socket *so); -int mac_check_socket_bind(struct ucred *cred, struct socket *so, - struct sockaddr *sockaddr); -int mac_check_socket_connect(struct ucred *cred, struct socket *so, - struct sockaddr *sockaddr); -int mac_check_socket_create(struct ucred *cred, int domain, int type, - int protocol); -int mac_check_socket_deliver(struct socket *so, struct mbuf *m); -int mac_check_socket_listen(struct ucred *cred, struct socket *so); -int mac_check_socket_poll(struct ucred *cred, struct socket *so); -int mac_check_socket_receive(struct ucred *cred, struct socket *so); -int mac_check_socket_send(struct ucred *cred, struct socket *so); -int mac_check_socket_stat(struct ucred *cred, struct socket *so); -int mac_check_socket_visible(struct ucred *cred, struct socket *so); -int mac_check_sysarch_ioperm(struct ucred *cred); -int mac_check_system_acct(struct ucred *cred, struct vnode *vp); -int mac_check_system_nfsd(struct ucred *cred); -int mac_check_system_reboot(struct ucred *cred, int howto); -int mac_check_system_settime(struct ucred *cred); -int mac_check_system_swapon(struct ucred *cred, struct vnode *vp); -int mac_check_system_swapoff(struct ucred *cred, struct vnode *vp); -int mac_check_system_sysctl(struct ucred *cred, struct sysctl_oid *oidp, - void *arg1, int arg2, struct sysctl_req *req); -int mac_check_vnode_access(struct ucred *cred, struct vnode *vp, - int acc_mode); -int mac_check_vnode_chdir(struct ucred *cred, struct vnode *dvp); -int mac_check_vnode_chroot(struct ucred *cred, struct vnode *dvp); -int mac_check_vnode_create(struct ucred *cred, struct vnode *dvp, - struct componentname *cnp, struct vattr *vap); -int mac_check_vnode_delete(struct ucred *cred, struct vnode *dvp, - struct vnode *vp, struct componentname *cnp); -int mac_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp, - acl_type_t type); -int mac_check_vnode_deleteextattr(struct ucred *cred, struct vnode *vp, - int attrnamespace, const char *name); -int mac_check_vnode_exec(struct ucred *cred, struct vnode *vp, - struct image_params *imgp); -int mac_check_vnode_getacl(struct ucred *cred, struct vnode *vp, - acl_type_t type); -int mac_check_vnode_getextattr(struct ucred *cred, struct vnode *vp, - int attrnamespace, const char *name, struct uio *uio); -int mac_check_vnode_link(struct ucred *cred, struct vnode *dvp, - struct vnode *vp, struct componentname *cnp); -int mac_check_vnode_listextattr(struct ucred *cred, struct vnode *vp, - int attrnamespace); -int mac_check_vnode_lookup(struct ucred *cred, struct vnode *dvp, - struct componentname *cnp); -int mac_check_vnode_mmap(struct ucred *cred, struct vnode *vp, - int prot, int flags); -int mac_check_vnode_mprotect(struct ucred *cred, struct vnode *vp, - int prot); -int mac_check_vnode_open(struct ucred *cred, struct vnode *vp, - int acc_mode); -int mac_check_vnode_poll(struct ucred *active_cred, - struct ucred *file_cred, struct vnode *vp); -int mac_check_vnode_read(struct ucred *active_cred, - struct ucred *file_cred, struct vnode *vp); -int mac_check_vnode_readdir(struct ucred *cred, struct vnode *vp); -int mac_check_vnode_readlink(struct ucred *cred, struct vnode *vp); -int mac_check_vnode_rename_from(struct ucred *cred, struct vnode *dvp, - struct vnode *vp, struct componentname *cnp); -int mac_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp, - struct vnode *vp, int samedir, struct componentname *cnp); -int mac_check_vnode_revoke(struct ucred *cred, struct vnode *vp); -int mac_check_vnode_setacl(struct ucred *cred, struct vnode *vp, - acl_type_t type, struct acl *acl); -int mac_check_vnode_setextattr(struct ucred *cred, struct vnode *vp, - int attrnamespace, const char *name, struct uio *uio); -int mac_check_vnode_setflags(struct ucred *cred, struct vnode *vp, - u_long flags); -int mac_check_vnode_setmode(struct ucred *cred, struct vnode *vp, - mode_t mode); -int mac_check_vnode_setowner(struct ucred *cred, struct vnode *vp, - uid_t uid, gid_t gid); -int mac_check_vnode_setutimes(struct ucred *cred, struct vnode *vp, - struct timespec atime, struct timespec mtime); -int mac_check_vnode_stat(struct ucred *active_cred, - struct ucred *file_cred, struct vnode *vp); -int mac_check_vnode_write(struct ucred *active_cred, - struct ucred *file_cred, struct vnode *vp); -int mac_getsockopt_label(struct ucred *cred, struct socket *so, - struct mac *extmac); -int mac_getsockopt_peerlabel(struct ucred *cred, struct socket *so, - struct mac *extmac); -int mac_ioctl_ifnet_get(struct ucred *cred, struct ifreq *ifr, - struct ifnet *ifnet); -int mac_ioctl_ifnet_set(struct ucred *cred, struct ifreq *ifr, - struct ifnet *ifnet); -int mac_setsockopt_label(struct ucred *cred, struct socket *so, - struct mac *extmac); -int mac_pipe_label_set(struct ucred *cred, struct pipepair *pp, - struct label *label); -void mac_cred_mmapped_drop_perms(struct thread *td, struct ucred *cred); -void mac_associate_nfsd_label(struct ucred *cred); - -/* - * Calls to help various file systems implement labeling functionality - * using their existing EA implementation. - */ -int vop_stdsetlabel_ea(struct vop_setlabel_args *ap); - #endif /* !_KERNEL */ #endif /* !_SYS_MAC_H_ */ diff --git a/sys/sys/mac_policy.h b/sys/sys/mac_policy.h index afd437f..a7e9d834 100644 --- a/sys/sys/mac_policy.h +++ b/sys/sys/mac_policy.h @@ -55,6 +55,8 @@ * Operations are sorted first by general class of operation, then * alphabetically. */ +#include <sys/acl.h> /* XXX acl_type_t */ + struct acl; struct bpf_d; struct componentname; diff --git a/sys/ufs/ffs/ffs_vfsops.c b/sys/ufs/ffs/ffs_vfsops.c index 87bfd9f..05df838 100644 --- a/sys/ufs/ffs/ffs_vfsops.c +++ b/sys/ufs/ffs/ffs_vfsops.c @@ -42,7 +42,6 @@ __FBSDID("$FreeBSD$"); #include <sys/namei.h> #include <sys/proc.h> #include <sys/kernel.h> -#include <sys/mac.h> #include <sys/vnode.h> #include <sys/mount.h> #include <sys/bio.h> @@ -52,6 +51,8 @@ __FBSDID("$FreeBSD$"); #include <sys/malloc.h> #include <sys/mutex.h> +#include <security/mac/mac_framework.h> + #include <ufs/ufs/extattr.h> #include <ufs/ufs/quota.h> #include <ufs/ufs/ufsmount.h> diff --git a/sys/ufs/ufs/ufs_vnops.c b/sys/ufs/ufs/ufs_vnops.c index 687dc70..1495937 100644 --- a/sys/ufs/ufs/ufs_vnops.c +++ b/sys/ufs/ufs/ufs_vnops.c @@ -60,11 +60,12 @@ __FBSDID("$FreeBSD$"); #include <sys/lockf.h> #include <sys/conf.h> #include <sys/acl.h> -#include <sys/mac.h> #include <sys/jail.h> #include <machine/mutex.h> +#include <security/mac/mac_framework.h> + #include <sys/file.h> /* XXX */ #include <vm/vm.h> diff --git a/sys/vm/swap_pager.c b/sys/vm/swap_pager.c index 4e4e4db..ce775f8 100644 --- a/sys/vm/swap_pager.c +++ b/sys/vm/swap_pager.c @@ -85,7 +85,6 @@ __FBSDID("$FreeBSD$"); #include <sys/mount.h> #include <sys/namei.h> #include <sys/vnode.h> -#include <sys/mac.h> #include <sys/malloc.h> #include <sys/sysctl.h> #include <sys/sysproto.h> @@ -94,6 +93,8 @@ __FBSDID("$FreeBSD$"); #include <sys/sx.h> #include <sys/vmmeter.h> +#include <security/mac/mac_framework.h> + #include <vm/vm.h> #include <vm/pmap.h> #include <vm/vm_map.h> diff --git a/sys/vm/vm_mmap.c b/sys/vm/vm_mmap.c index 244877e..933080e 100644 --- a/sys/vm/vm_mmap.c +++ b/sys/vm/vm_mmap.c @@ -60,7 +60,6 @@ __FBSDID("$FreeBSD$"); #include <sys/vnode.h> #include <sys/fcntl.h> #include <sys/file.h> -#include <sys/mac.h> #include <sys/mman.h> #include <sys/mount.h> #include <sys/conf.h> @@ -68,6 +67,8 @@ __FBSDID("$FreeBSD$"); #include <sys/vmmeter.h> #include <sys/sysctl.h> +#include <security/mac/mac_framework.h> + #include <vm/vm.h> #include <vm/vm_param.h> #include <vm/pmap.h> |
