Introduce two related changes to the TrustedBSD MAC Framework:

(1) Abstract interpreter vnode labeling in execve(2) and mac_execve(2)
    so that the general exec code isn't aware of the details of
    allocating, copying, and freeing labels, rather, simply passes in
    a void pointer to start and stop functions that will be used by
    the framework.  This change will be MFC'd.

(2) Introduce a new flags field to the MAC_POLICY_SET(9) interface
    allowing policies to declare which types of objects require label
    allocation, initialization, and destruction, and define a set of
    flags covering various supported object types (MPC_OBJECT_PROC,
    MPC_OBJECT_VNODE, MPC_OBJECT_INPCB, ...).  This change reduces the
    overhead of compiling the MAC Framework into the kernel if policies
    aren't loaded, or if policies require labels on only a small number
    or even no object types.  Each time a policy is loaded or unloaded,
    we recalculate a mask of labeled object types across all policies
    present in the system.  Eliminate MAC_ALWAYS_LABEL_MBUF option as it
    is no longer required.

MFC after:	1 week ((1) only)
Reviewed by:	csjp
Obtained from:	TrustedBSD Project
Sponsored by:	Apple, Inc.

1 files changed, 28 insertions, 0 deletions

diff --git a/sys/security/mac/mac_syscalls.c b/sys/security/mac/mac_syscalls.c
index 701b019..5cff185 100644
--- a/sys/security/mac/mac_syscalls.c
+++ b/sys/security/mac/mac_syscalls.c
@@ -3,6 +3,7 @@
  * Copyright (c) 2001 Ilmar S. Habibulin
  * Copyright (c) 2001-2005 Networks Associates Technology, Inc.
  * Copyright (c) 2005-2006 SPARTA, Inc.
+ * Copyright (c) 2008 Apple Inc.
  * All rights reserved.
  *
  * This software was developed by Robert Watson and Ilmar Habibulin for the
@@ -160,6 +161,9 @@ __mac_set_proc(struct thread *td, struct __mac_set_proc_args *uap)
 	char *buffer;
 	int error;
 
+	if (!(mac_labeled & MPC_OBJECT_CRED))
+		return (EINVAL);
+
 	error = copyin(uap->mac_p, &mac, sizeof(mac));
 	if (error)
 		return (error);
@@ -253,6 +257,8 @@ __mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap)
 	switch (fp->f_type) {
 	case DTYPE_FIFO:
 	case DTYPE_VNODE:
+		if (!(mac_labeled & MPC_OBJECT_VNODE))
+			return (EINVAL);
 		vp = fp->f_vnode;
 		intlabel = mac_vnode_label_alloc();
 		vfslocked = VFS_LOCK_GIANT(vp->v_mount);
@@ -266,6 +272,8 @@ __mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap)
 		break;
 
 	case DTYPE_PIPE:
+		if (!(mac_labeled & MPC_OBJECT_PIPE))
+			return (EINVAL);
 		pipe = fp->f_data;
 		intlabel = mac_pipe_label_alloc();
 		PIPE_LOCK(pipe);
@@ -277,6 +285,8 @@ __mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap)
 		break;
 
 	case DTYPE_SOCKET:
+		if (!(mac_labeled & MPC_OBJECT_SOCKET))
+			return (EINVAL);
 		so = fp->f_data;
 		intlabel = mac_socket_label_alloc(M_WAITOK);
 		SOCK_LOCK(so);
@@ -309,6 +319,9 @@ __mac_get_file(struct thread *td, struct __mac_get_file_args *uap)
 	struct mac mac;
 	int vfslocked, error;
 
+	if (!(mac_labeled & MPC_OBJECT_VNODE))
+		return (EINVAL);
+
 	error = copyin(uap->mac_p, &mac, sizeof(mac));
 	if (error)
 		return (error);
@@ -359,6 +372,9 @@ __mac_get_link(struct thread *td, struct __mac_get_link_args *uap)
 	struct mac mac;
 	int vfslocked, error;
 
+	if (!(mac_labeled & MPC_OBJECT_VNODE))
+		return (EINVAL);
+
 	error = copyin(uap->mac_p, &mac, sizeof(mac));
 	if (error)
 		return (error);
@@ -435,6 +451,8 @@ __mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap)
 	switch (fp->f_type) {
 	case DTYPE_FIFO:
 	case DTYPE_VNODE:
+		if (!(mac_labeled & MPC_OBJECT_VNODE))
+			return (EINVAL);
 		intlabel = mac_vnode_label_alloc();
 		error = mac_vnode_internalize_label(intlabel, buffer);
 		if (error) {
@@ -458,6 +476,8 @@ __mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap)
 		break;
 
 	case DTYPE_PIPE:
+		if (!(mac_labeled & MPC_OBJECT_PIPE))
+			return (EINVAL);
 		intlabel = mac_pipe_label_alloc();
 		error = mac_pipe_internalize_label(intlabel, buffer);
 		if (error == 0) {
@@ -471,6 +491,8 @@ __mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap)
 		break;
 
 	case DTYPE_SOCKET:
+		if (!(mac_labeled & MPC_OBJECT_SOCKET))
+			return (EINVAL);
 		intlabel = mac_socket_label_alloc(M_WAITOK);
 		error = mac_socket_internalize_label(intlabel, buffer);
 		if (error == 0) {
@@ -500,6 +522,9 @@ __mac_set_file(struct thread *td, struct __mac_set_file_args *uap)
 	char *buffer;
 	int vfslocked, error;
 
+	if (!(mac_labeled & MPC_OBJECT_VNODE))
+		return (EINVAL);
+
 	error = copyin(uap->mac_p, &mac, sizeof(mac));
 	if (error)
 		return (error);
@@ -551,6 +576,9 @@ __mac_set_link(struct thread *td, struct __mac_set_link_args *uap)
 	char *buffer;
 	int vfslocked, error;
 
+	if (!(mac_labeled & MPC_OBJECT_VNODE))
+		return (EINVAL);
+
 	error = copyin(uap->mac_p, &mac, sizeof(mac));
 	if (error)
 		return (error);