Remove dm_root entry from struct devfs_mount. It's never set, and is

unused.  Replace it with a dm_mount back-pointer to the struct mount
that the devfs_mount is associated with.  Export that pointer to MAC
Framework entry points, where all current policies don't use the
pointer.  This permits the SEBSD port of SELinux's FLASK/TE to compile
out-of-the-box on 5.0-CURRENT with full file system labeling support.

Approved by:	re (murray)
Obtained from:	TrustedBSD Project
Sponsored by:	DARPA, Network Associates Laboratories

10 files changed, 104 insertions, 83 deletions

diff --git a/sys/security/mac/mac_framework.c b/sys/security/mac/mac_framework.c
index 10fe51d..257d131 100644
--- a/sys/security/mac/mac_framework.c
+++ b/sys/security/mac/mac_framework.c
@@ -1196,10 +1196,12 @@ mac_create_cred(struct ucred *parent_cred, struct ucred *child_cred)
 }
 
 void
-mac_update_devfsdirent(struct devfs_dirent *de, struct vnode *vp)
+mac_update_devfsdirent(struct mount *mp, struct devfs_dirent *de,
+    struct vnode *vp)
 {
 
-	MAC_PERFORM(update_devfsdirent, de, &de->de_label, vp, &vp->v_label);
+	MAC_PERFORM(update_devfsdirent, mp, de, &de->de_label, vp,
+	    &vp->v_label);
 }
 
 void
@@ -2801,27 +2803,27 @@ mac_ioctl_ifnet_set(struct ucred *cred, struct ifreq *ifr,
 }
 
 void
-mac_create_devfs_device(dev_t dev, struct devfs_dirent *de)
+mac_create_devfs_device(struct mount *mp, dev_t dev, struct devfs_dirent *de)
 {
 
-	MAC_PERFORM(create_devfs_device, dev, de, &de->de_label);
+	MAC_PERFORM(create_devfs_device, mp, dev, de, &de->de_label);
 }
 
 void
-mac_create_devfs_symlink(struct ucred *cred, struct devfs_dirent *dd,
-    struct devfs_dirent *de)
+mac_create_devfs_symlink(struct ucred *cred, struct mount *mp,
+    struct devfs_dirent *dd, struct devfs_dirent *de)
 {
 
-	MAC_PERFORM(create_devfs_symlink, cred, dd, &dd->de_label, de,
+	MAC_PERFORM(create_devfs_symlink, cred, mp, dd, &dd->de_label, de,
 	    &de->de_label);
 }
 
 void
-mac_create_devfs_directory(char *dirname, int dirnamelen,
+mac_create_devfs_directory(struct mount *mp, char *dirname, int dirnamelen,
     struct devfs_dirent *de)
 {
 
-	MAC_PERFORM(create_devfs_directory, dirname, dirnamelen, de,
+	MAC_PERFORM(create_devfs_directory, mp, dirname, dirnamelen, de,
 	    &de->de_label);
 }
 
diff --git a/sys/security/mac/mac_framework.h b/sys/security/mac/mac_framework.h
index b03a172..18399f7 100644
--- a/sys/security/mac/mac_framework.h
+++ b/sys/security/mac/mac_framework.h
@@ -171,18 +171,20 @@ void	mac_associate_vnode_devfs(struct mount *mp, struct devfs_dirent *de,
 	    struct vnode *vp);
 int	mac_associate_vnode_extattr(struct mount *mp, struct vnode *vp);
 void	mac_associate_vnode_singlelabel(struct mount *mp, struct vnode *vp);
-void	mac_create_devfs_device(dev_t dev, struct devfs_dirent *de);
-void	mac_create_devfs_directory(char *dirname, int dirnamelen,
-	    struct devfs_dirent *de);
-void	mac_create_devfs_symlink(struct ucred *cred, struct devfs_dirent *dd,
+void	mac_create_devfs_device(struct mount *mp, dev_t dev,
 	    struct devfs_dirent *de);
+void	mac_create_devfs_directory(struct mount *mp, char *dirname,
+	    int dirnamelen, struct devfs_dirent *de);
+void	mac_create_devfs_symlink(struct ucred *cred, struct mount *mp,
+	    struct devfs_dirent *dd, struct devfs_dirent *de);
 int	mac_create_vnode_extattr(struct ucred *cred, struct mount *mp,
 	    struct vnode *dvp, struct vnode *vp, struct componentname *cnp);
 void	mac_create_mount(struct ucred *cred, struct mount *mp);
 void	mac_create_root_mount(struct ucred *cred, struct mount *mp);
 void	mac_relabel_vnode(struct ucred *cred, struct vnode *vp,
 	    struct label *newlabel);
-void	mac_update_devfsdirent(struct devfs_dirent *de, struct vnode *vp);
+void	mac_update_devfsdirent(struct mount *mp, struct devfs_dirent *de,
+	    struct vnode *vp);
 
 /*
  * Labeling event operations: IPC objects.
diff --git a/sys/security/mac/mac_internal.h b/sys/security/mac/mac_internal.h
index 10fe51d..257d131 100644
--- a/sys/security/mac/mac_internal.h
+++ b/sys/security/mac/mac_internal.h
@@ -1196,10 +1196,12 @@ mac_create_cred(struct ucred *parent_cred, struct ucred *child_cred)
 }
 
 void
-mac_update_devfsdirent(struct devfs_dirent *de, struct vnode *vp)
+mac_update_devfsdirent(struct mount *mp, struct devfs_dirent *de,
+    struct vnode *vp)
 {
 
-	MAC_PERFORM(update_devfsdirent, de, &de->de_label, vp, &vp->v_label);
+	MAC_PERFORM(update_devfsdirent, mp, de, &de->de_label, vp,
+	    &vp->v_label);
 }
 
 void
@@ -2801,27 +2803,27 @@ mac_ioctl_ifnet_set(struct ucred *cred, struct ifreq *ifr,
 }
 
 void
-mac_create_devfs_device(dev_t dev, struct devfs_dirent *de)
+mac_create_devfs_device(struct mount *mp, dev_t dev, struct devfs_dirent *de)
 {
 
-	MAC_PERFORM(create_devfs_device, dev, de, &de->de_label);
+	MAC_PERFORM(create_devfs_device, mp, dev, de, &de->de_label);
 }
 
 void
-mac_create_devfs_symlink(struct ucred *cred, struct devfs_dirent *dd,
-    struct devfs_dirent *de)
+mac_create_devfs_symlink(struct ucred *cred, struct mount *mp,
+    struct devfs_dirent *dd, struct devfs_dirent *de)
 {
 
-	MAC_PERFORM(create_devfs_symlink, cred, dd, &dd->de_label, de,
+	MAC_PERFORM(create_devfs_symlink, cred, mp, dd, &dd->de_label, de,
 	    &de->de_label);
 }
 
 void
-mac_create_devfs_directory(char *dirname, int dirnamelen,
+mac_create_devfs_directory(struct mount *mp, char *dirname, int dirnamelen,
     struct devfs_dirent *de)
 {
 
-	MAC_PERFORM(create_devfs_directory, dirname, dirnamelen, de,
+	MAC_PERFORM(create_devfs_directory, mp, dirname, dirnamelen, de,
 	    &de->de_label);
 }
 
diff --git a/sys/security/mac/mac_net.c b/sys/security/mac/mac_net.c
index 10fe51d..257d131 100644
--- a/sys/security/mac/mac_net.c
+++ b/sys/security/mac/mac_net.c
@@ -1196,10 +1196,12 @@ mac_create_cred(struct ucred *parent_cred, struct ucred *child_cred)
 }
 
 void
-mac_update_devfsdirent(struct devfs_dirent *de, struct vnode *vp)
+mac_update_devfsdirent(struct mount *mp, struct devfs_dirent *de,
+    struct vnode *vp)
 {
 
-	MAC_PERFORM(update_devfsdirent, de, &de->de_label, vp, &vp->v_label);
+	MAC_PERFORM(update_devfsdirent, mp, de, &de->de_label, vp,
+	    &vp->v_label);
 }
 
 void
@@ -2801,27 +2803,27 @@ mac_ioctl_ifnet_set(struct ucred *cred, struct ifreq *ifr,
 }
 
 void
-mac_create_devfs_device(dev_t dev, struct devfs_dirent *de)
+mac_create_devfs_device(struct mount *mp, dev_t dev, struct devfs_dirent *de)
 {
 
-	MAC_PERFORM(create_devfs_device, dev, de, &de->de_label);
+	MAC_PERFORM(create_devfs_device, mp, dev, de, &de->de_label);
 }
 
 void
-mac_create_devfs_symlink(struct ucred *cred, struct devfs_dirent *dd,
-    struct devfs_dirent *de)
+mac_create_devfs_symlink(struct ucred *cred, struct mount *mp,
+    struct devfs_dirent *dd, struct devfs_dirent *de)
 {
 
-	MAC_PERFORM(create_devfs_symlink, cred, dd, &dd->de_label, de,
+	MAC_PERFORM(create_devfs_symlink, cred, mp, dd, &dd->de_label, de,
 	    &de->de_label);
 }
 
 void
-mac_create_devfs_directory(char *dirname, int dirnamelen,
+mac_create_devfs_directory(struct mount *mp, char *dirname, int dirnamelen,
     struct devfs_dirent *de)
 {
 
-	MAC_PERFORM(create_devfs_directory, dirname, dirnamelen, de,
+	MAC_PERFORM(create_devfs_directory, mp, dirname, dirnamelen, de,
 	    &de->de_label);
 }
 
diff --git a/sys/security/mac/mac_pipe.c b/sys/security/mac/mac_pipe.c
index 10fe51d..257d131 100644
--- a/sys/security/mac/mac_pipe.c
+++ b/sys/security/mac/mac_pipe.c
@@ -1196,10 +1196,12 @@ mac_create_cred(struct ucred *parent_cred, struct ucred *child_cred)
 }
 
 void
-mac_update_devfsdirent(struct devfs_dirent *de, struct vnode *vp)
+mac_update_devfsdirent(struct mount *mp, struct devfs_dirent *de,
+    struct vnode *vp)
 {
 
-	MAC_PERFORM(update_devfsdirent, de, &de->de_label, vp, &vp->v_label);
+	MAC_PERFORM(update_devfsdirent, mp, de, &de->de_label, vp,
+	    &vp->v_label);
 }
 
 void
@@ -2801,27 +2803,27 @@ mac_ioctl_ifnet_set(struct ucred *cred, struct ifreq *ifr,
 }
 
 void
-mac_create_devfs_device(dev_t dev, struct devfs_dirent *de)
+mac_create_devfs_device(struct mount *mp, dev_t dev, struct devfs_dirent *de)
 {
 
-	MAC_PERFORM(create_devfs_device, dev, de, &de->de_label);
+	MAC_PERFORM(create_devfs_device, mp, dev, de, &de->de_label);
 }
 
 void
-mac_create_devfs_symlink(struct ucred *cred, struct devfs_dirent *dd,
-    struct devfs_dirent *de)
+mac_create_devfs_symlink(struct ucred *cred, struct mount *mp,
+    struct devfs_dirent *dd, struct devfs_dirent *de)
 {
 
-	MAC_PERFORM(create_devfs_symlink, cred, dd, &dd->de_label, de,
+	MAC_PERFORM(create_devfs_symlink, cred, mp, dd, &dd->de_label, de,
 	    &de->de_label);
 }
 
 void
-mac_create_devfs_directory(char *dirname, int dirnamelen,
+mac_create_devfs_directory(struct mount *mp, char *dirname, int dirnamelen,
     struct devfs_dirent *de)
 {
 
-	MAC_PERFORM(create_devfs_directory, dirname, dirnamelen, de,
+	MAC_PERFORM(create_devfs_directory, mp, dirname, dirnamelen, de,
 	    &de->de_label);
 }
 
diff --git a/sys/security/mac/mac_policy.h b/sys/security/mac/mac_policy.h
index 454e6c6..825e45c 100644
--- a/sys/security/mac/mac_policy.h
+++ b/sys/security/mac/mac_policy.h
@@ -142,13 +142,15 @@ struct mac_policy_ops {
 	void	(*mpo_associate_vnode_singlelabel)(struct mount *mp,
 		    struct label *fslabel, struct vnode *vp,
 		    struct label *vlabel);
-	void	(*mpo_create_devfs_device)(dev_t dev, struct devfs_dirent *de,
-		    struct label *label);
-	void	(*mpo_create_devfs_directory)(char *dirname, int dirnamelen,
+	void	(*mpo_create_devfs_device)(struct mount *mp, dev_t dev,
 		    struct devfs_dirent *de, struct label *label);
+	void	(*mpo_create_devfs_directory)(struct mount *mp, char *dirname,
+		    int dirnamelen, struct devfs_dirent *de,
+		    struct label *label);
 	void	(*mpo_create_devfs_symlink)(struct ucred *cred,
-		    struct devfs_dirent *dd, struct label *ddlabel,
-		    struct devfs_dirent *de, struct label *delabel);
+		    struct mount *mp, struct devfs_dirent *dd,
+		    struct label *ddlabel, struct devfs_dirent *de,
+		    struct label *delabel);
 	int	(*mpo_create_vnode_extattr)(struct ucred *cred,
 		    struct mount *mp, struct label *fslabel,
 		    struct vnode *dvp, struct label *dlabel,
@@ -163,7 +165,8 @@ struct mac_policy_ops {
 	int	(*mpo_setlabel_vnode_extattr)(struct ucred *cred,
 		    struct vnode *vp, struct label *vlabel,
 		    struct label *intlabel);
-	void	(*mpo_update_devfsdirent)(struct devfs_dirent *devfs_dirent,
+	void	(*mpo_update_devfsdirent)(struct mount *mp,
+		    struct devfs_dirent *devfs_dirent,
 		    struct label *direntlabel, struct vnode *vp,
 		    struct label *vnodelabel);
 
diff --git a/sys/security/mac/mac_process.c b/sys/security/mac/mac_process.c
index 10fe51d..257d131 100644
--- a/sys/security/mac/mac_process.c
+++ b/sys/security/mac/mac_process.c
@@ -1196,10 +1196,12 @@ mac_create_cred(struct ucred *parent_cred, struct ucred *child_cred)
 }
 
 void
-mac_update_devfsdirent(struct devfs_dirent *de, struct vnode *vp)
+mac_update_devfsdirent(struct mount *mp, struct devfs_dirent *de,
+    struct vnode *vp)
 {
 
-	MAC_PERFORM(update_devfsdirent, de, &de->de_label, vp, &vp->v_label);
+	MAC_PERFORM(update_devfsdirent, mp, de, &de->de_label, vp,
+	    &vp->v_label);
 }
 
 void
@@ -2801,27 +2803,27 @@ mac_ioctl_ifnet_set(struct ucred *cred, struct ifreq *ifr,
 }
 
 void
-mac_create_devfs_device(dev_t dev, struct devfs_dirent *de)
+mac_create_devfs_device(struct mount *mp, dev_t dev, struct devfs_dirent *de)
 {
 
-	MAC_PERFORM(create_devfs_device, dev, de, &de->de_label);
+	MAC_PERFORM(create_devfs_device, mp, dev, de, &de->de_label);
 }
 
 void
-mac_create_devfs_symlink(struct ucred *cred, struct devfs_dirent *dd,
-    struct devfs_dirent *de)
+mac_create_devfs_symlink(struct ucred *cred, struct mount *mp,
+    struct devfs_dirent *dd, struct devfs_dirent *de)
 {
 
-	MAC_PERFORM(create_devfs_symlink, cred, dd, &dd->de_label, de,
+	MAC_PERFORM(create_devfs_symlink, cred, mp, dd, &dd->de_label, de,
 	    &de->de_label);
 }
 
 void
-mac_create_devfs_directory(char *dirname, int dirnamelen,
+mac_create_devfs_directory(struct mount *mp, char *dirname, int dirnamelen,
     struct devfs_dirent *de)
 {
 
-	MAC_PERFORM(create_devfs_directory, dirname, dirnamelen, de,
+	MAC_PERFORM(create_devfs_directory, mp, dirname, dirnamelen, de,
 	    &de->de_label);
 }
 
diff --git a/sys/security/mac/mac_syscalls.c b/sys/security/mac/mac_syscalls.c
index 10fe51d..257d131 100644
--- a/sys/security/mac/mac_syscalls.c
+++ b/sys/security/mac/mac_syscalls.c
@@ -1196,10 +1196,12 @@ mac_create_cred(struct ucred *parent_cred, struct ucred *child_cred)
 }
 
 void
-mac_update_devfsdirent(struct devfs_dirent *de, struct vnode *vp)
+mac_update_devfsdirent(struct mount *mp, struct devfs_dirent *de,
+    struct vnode *vp)
 {
 
-	MAC_PERFORM(update_devfsdirent, de, &de->de_label, vp, &vp->v_label);
+	MAC_PERFORM(update_devfsdirent, mp, de, &de->de_label, vp,
+	    &vp->v_label);
 }
 
 void
@@ -2801,27 +2803,27 @@ mac_ioctl_ifnet_set(struct ucred *cred, struct ifreq *ifr,
 }
 
 void
-mac_create_devfs_device(dev_t dev, struct devfs_dirent *de)
+mac_create_devfs_device(struct mount *mp, dev_t dev, struct devfs_dirent *de)
 {
 
-	MAC_PERFORM(create_devfs_device, dev, de, &de->de_label);
+	MAC_PERFORM(create_devfs_device, mp, dev, de, &de->de_label);
 }
 
 void
-mac_create_devfs_symlink(struct ucred *cred, struct devfs_dirent *dd,
-    struct devfs_dirent *de)
+mac_create_devfs_symlink(struct ucred *cred, struct mount *mp,
+    struct devfs_dirent *dd, struct devfs_dirent *de)
 {
 
-	MAC_PERFORM(create_devfs_symlink, cred, dd, &dd->de_label, de,
+	MAC_PERFORM(create_devfs_symlink, cred, mp, dd, &dd->de_label, de,
 	    &de->de_label);
 }
 
 void
-mac_create_devfs_directory(char *dirname, int dirnamelen,
+mac_create_devfs_directory(struct mount *mp, char *dirname, int dirnamelen,
     struct devfs_dirent *de)
 {
 
-	MAC_PERFORM(create_devfs_directory, dirname, dirnamelen, de,
+	MAC_PERFORM(create_devfs_directory, mp, dirname, dirnamelen, de,
 	    &de->de_label);
 }
 
diff --git a/sys/security/mac/mac_system.c b/sys/security/mac/mac_system.c
index 10fe51d..257d131 100644
--- a/sys/security/mac/mac_system.c
+++ b/sys/security/mac/mac_system.c
@@ -1196,10 +1196,12 @@ mac_create_cred(struct ucred *parent_cred, struct ucred *child_cred)
 }
 
 void
-mac_update_devfsdirent(struct devfs_dirent *de, struct vnode *vp)
+mac_update_devfsdirent(struct mount *mp, struct devfs_dirent *de,
+    struct vnode *vp)
 {
 
-	MAC_PERFORM(update_devfsdirent, de, &de->de_label, vp, &vp->v_label);
+	MAC_PERFORM(update_devfsdirent, mp, de, &de->de_label, vp,
+	    &vp->v_label);
 }
 
 void
@@ -2801,27 +2803,27 @@ mac_ioctl_ifnet_set(struct ucred *cred, struct ifreq *ifr,
 }
 
 void
-mac_create_devfs_device(dev_t dev, struct devfs_dirent *de)
+mac_create_devfs_device(struct mount *mp, dev_t dev, struct devfs_dirent *de)
 {
 
-	MAC_PERFORM(create_devfs_device, dev, de, &de->de_label);
+	MAC_PERFORM(create_devfs_device, mp, dev, de, &de->de_label);
 }
 
 void
-mac_create_devfs_symlink(struct ucred *cred, struct devfs_dirent *dd,
-    struct devfs_dirent *de)
+mac_create_devfs_symlink(struct ucred *cred, struct mount *mp,
+    struct devfs_dirent *dd, struct devfs_dirent *de)
 {
 
-	MAC_PERFORM(create_devfs_symlink, cred, dd, &dd->de_label, de,
+	MAC_PERFORM(create_devfs_symlink, cred, mp, dd, &dd->de_label, de,
 	    &de->de_label);
 }
 
 void
-mac_create_devfs_directory(char *dirname, int dirnamelen,
+mac_create_devfs_directory(struct mount *mp, char *dirname, int dirnamelen,
     struct devfs_dirent *de)
 {
 
-	MAC_PERFORM(create_devfs_directory, dirname, dirnamelen, de,
+	MAC_PERFORM(create_devfs_directory, mp, dirname, dirnamelen, de,
 	    &de->de_label);
 }
 
diff --git a/sys/security/mac/mac_vfs.c b/sys/security/mac/mac_vfs.c
index 10fe51d..257d131 100644
--- a/sys/security/mac/mac_vfs.c
+++ b/sys/security/mac/mac_vfs.c
@@ -1196,10 +1196,12 @@ mac_create_cred(struct ucred *parent_cred, struct ucred *child_cred)
 }
 
 void
-mac_update_devfsdirent(struct devfs_dirent *de, struct vnode *vp)
+mac_update_devfsdirent(struct mount *mp, struct devfs_dirent *de,
+    struct vnode *vp)
 {
 
-	MAC_PERFORM(update_devfsdirent, de, &de->de_label, vp, &vp->v_label);
+	MAC_PERFORM(update_devfsdirent, mp, de, &de->de_label, vp,
+	    &vp->v_label);
 }
 
 void
@@ -2801,27 +2803,27 @@ mac_ioctl_ifnet_set(struct ucred *cred, struct ifreq *ifr,
 }
 
 void
-mac_create_devfs_device(dev_t dev, struct devfs_dirent *de)
+mac_create_devfs_device(struct mount *mp, dev_t dev, struct devfs_dirent *de)
 {
 
-	MAC_PERFORM(create_devfs_device, dev, de, &de->de_label);
+	MAC_PERFORM(create_devfs_device, mp, dev, de, &de->de_label);
 }
 
 void
-mac_create_devfs_symlink(struct ucred *cred, struct devfs_dirent *dd,
-    struct devfs_dirent *de)
+mac_create_devfs_symlink(struct ucred *cred, struct mount *mp,
+    struct devfs_dirent *dd, struct devfs_dirent *de)
 {
 
-	MAC_PERFORM(create_devfs_symlink, cred, dd, &dd->de_label, de,
+	MAC_PERFORM(create_devfs_symlink, cred, mp, dd, &dd->de_label, de,
 	    &de->de_label);
 }
 
 void
-mac_create_devfs_directory(char *dirname, int dirnamelen,
+mac_create_devfs_directory(struct mount *mp, char *dirname, int dirnamelen,
     struct devfs_dirent *de)
 {
 
-	MAC_PERFORM(create_devfs_directory, dirname, dirnamelen, de,
+	MAC_PERFORM(create_devfs_directory, mp, dirname, dirnamelen, de,
 	    &de->de_label);
 }