Integrate mac_check_socket_send() and mac_check_socket_receive()

checks from the MAC tree: allow policies to perform access control
for the ability of a process to send and receive data via a socket.
At some point, we might also pass in additional address information
if an explicit address is requested on send.

Obtained from:	TrustedBSD Project
Sponsored by:	DARPA, Network Associates Laboratories

1 files changed, 34 insertions, 0 deletions

diff --git a/sys/kern/kern_mac.c b/sys/kern/kern_mac.c
index bed8a95..eca63c3 100644
--- a/sys/kern/kern_mac.c
+++ b/sys/kern/kern_mac.c
@@ -761,10 +761,18 @@ mac_policy_register(struct mac_policy_conf *mpc)
 			mpc->mpc_ops->mpo_check_socket_listen =
 			    mpe->mpe_function;
 			break;
+		case MAC_CHECK_SOCKET_RECEIVE:
+			mpc->mpc_ops->mpo_check_socket_receive =
+			    mpe->mpe_function;
+			break;
 		case MAC_CHECK_SOCKET_RELABEL:
 			mpc->mpc_ops->mpo_check_socket_relabel =
 			    mpe->mpe_function;
 			break;
+		case MAC_CHECK_SOCKET_SEND:
+			mpc->mpc_ops->mpo_check_socket_send =
+			    mpe->mpe_function;
+			break;
 		case MAC_CHECK_SOCKET_VISIBLE:
 			mpc->mpc_ops->mpo_check_socket_visible =
 			    mpe->mpe_function;
@@ -2961,6 +2969,19 @@ mac_check_socket_listen(struct ucred *cred, struct socket *socket)
 	return (error);
 }
 
+int
+mac_check_socket_receive(struct ucred *cred, struct socket *so)
+{
+	int error;
+
+	if (!mac_enforce_socket)
+		return (0);
+
+	MAC_CHECK(check_socket_receive, cred, so, &so->so_label);
+
+	return (error);
+}
+
 static int
 mac_check_socket_relabel(struct ucred *cred, struct socket *socket,
     struct label *newlabel)
@@ -2974,6 +2995,19 @@ mac_check_socket_relabel(struct ucred *cred, struct socket *socket,
 }
 
 int
+mac_check_socket_send(struct ucred *cred, struct socket *so)
+{
+	int error;
+
+	if (!mac_enforce_socket)
+		return (0);
+
+	MAC_CHECK(check_socket_send, cred, so, &so->so_label);
+
+	return (error);
+}
+
+int
 mac_check_socket_visible(struct ucred *cred, struct socket *socket)
 {
 	int error;