diff options
author | rwatson <rwatson@FreeBSD.org> | 2007-10-25 11:31:11 +0000 |
---|---|---|
committer | rwatson <rwatson@FreeBSD.org> | 2007-10-25 11:31:11 +0000 |
commit | 2fd98af619b989e0cb105bb5b81e41d895fd8e20 (patch) | |
tree | 61b4f64bfe3a4b94291e8d7bf90db127671545c7 /sys/security/mac_biba | |
parent | 9d167f82e426b3c6481ebd3bcdba5afbae063a7d (diff) | |
download | FreeBSD-src-2fd98af619b989e0cb105bb5b81e41d895fd8e20.zip FreeBSD-src-2fd98af619b989e0cb105bb5b81e41d895fd8e20.tar.gz |
Consistently name functions for mac_<policy> as <policy>_whatever rather
than mac_<policy>_whatever, as this shortens the names and makes the code
a bit easier to read.
When dealing with label structures, name variables 'mb', 'ml', 'mm rather
than the longer 'mac_biba', 'mac_lomac', and 'mac_mls', likewise making
the code a little easier to read.
Obtained from: TrustedBSD Project
Diffstat (limited to 'sys/security/mac_biba')
-rw-r--r-- | sys/security/mac_biba/mac_biba.c | 1462 |
1 files changed, 726 insertions, 736 deletions
diff --git a/sys/security/mac_biba/mac_biba.c b/sys/security/mac_biba/mac_biba.c index 2b66972..80c81ec 100644 --- a/sys/security/mac_biba/mac_biba.c +++ b/sys/security/mac_biba/mac_biba.c @@ -92,14 +92,14 @@ SYSCTL_DECL(_security_mac); SYSCTL_NODE(_security_mac, OID_AUTO, biba, CTLFLAG_RW, 0, "TrustedBSD mac_biba policy controls"); -static int mac_biba_label_size = sizeof(struct mac_biba); +static int biba_label_size = sizeof(struct mac_biba); SYSCTL_INT(_security_mac_biba, OID_AUTO, label_size, CTLFLAG_RD, - &mac_biba_label_size, 0, "Size of struct mac_biba"); + &biba_label_size, 0, "Size of struct mac_biba"); -static int mac_biba_enabled = 1; -SYSCTL_INT(_security_mac_biba, OID_AUTO, enabled, CTLFLAG_RW, - &mac_biba_enabled, 0, "Enforce MAC/Biba policy"); -TUNABLE_INT("security.mac.biba.enabled", &mac_biba_enabled); +static int biba_enabled = 1; +SYSCTL_INT(_security_mac_biba, OID_AUTO, enabled, CTLFLAG_RW, &biba_enabled, + 0, "Enforce MAC/Biba policy"); +TUNABLE_INT("security.mac.biba.enabled", &biba_enabled); static int destroyed_not_inited; SYSCTL_INT(_security_mac_biba, OID_AUTO, destroyed_not_inited, CTLFLAG_RD, @@ -135,9 +135,9 @@ SYSCTL_INT(_security_mac_biba, OID_AUTO, revocation_enabled, CTLFLAG_RW, &revocation_enabled, 0, "Revoke access to objects on relabel"); TUNABLE_INT("security.mac.biba.revocation_enabled", &revocation_enabled); -static int mac_biba_slot; -#define SLOT(l) ((struct mac_biba *)mac_label_get((l), mac_biba_slot)) -#define SLOT_SET(l, val) mac_label_set((l), mac_biba_slot, (uintptr_t)(val)) +static int biba_slot; +#define SLOT(l) ((struct mac_biba *)mac_label_get((l), biba_slot)) +#define SLOT_SET(l, val) mac_label_set((l), biba_slot, (uintptr_t)(val)) static uma_zone_t zone_biba; @@ -159,27 +159,26 @@ biba_alloc(int flag) } static void -biba_free(struct mac_biba *mac_biba) +biba_free(struct mac_biba *mb) { - if (mac_biba != NULL) - uma_zfree(zone_biba, mac_biba); + if (mb != NULL) + uma_zfree(zone_biba, mb); else atomic_add_int(&destroyed_not_inited, 1); } static int -biba_atmostflags(struct mac_biba *mac_biba, int flags) +biba_atmostflags(struct mac_biba *mb, int flags) { - if ((mac_biba->mb_flags & flags) != mac_biba->mb_flags) + if ((mb->mb_flags & flags) != mb->mb_flags) return (EINVAL); return (0); } static int -mac_biba_dominate_element(struct mac_biba_element *a, - struct mac_biba_element *b) +biba_dominate_element(struct mac_biba_element *a, struct mac_biba_element *b) { int bit; @@ -199,7 +198,7 @@ mac_biba_dominate_element(struct mac_biba_element *a, return (1); default: - panic("mac_biba_dominate_element: b->mbe_type invalid"); + panic("biba_dominate_element: b->mbe_type invalid"); } case MAC_BIBA_TYPE_GRADE: @@ -220,70 +219,69 @@ mac_biba_dominate_element(struct mac_biba_element *a, return (a->mbe_grade >= b->mbe_grade); default: - panic("mac_biba_dominate_element: b->mbe_type invalid"); + panic("biba_dominate_element: b->mbe_type invalid"); } default: - panic("mac_biba_dominate_element: a->mbe_type invalid"); + panic("biba_dominate_element: a->mbe_type invalid"); } return (0); } static int -mac_biba_subject_dominate_high(struct mac_biba *mac_biba) +biba_subject_dominate_high(struct mac_biba *mb) { struct mac_biba_element *element; - KASSERT((mac_biba->mb_flags & MAC_BIBA_FLAG_EFFECTIVE) != 0, - ("mac_biba_effective_in_range: mac_biba not effective")); - element = &mac_biba->mb_effective; + KASSERT((mb->mb_flags & MAC_BIBA_FLAG_EFFECTIVE) != 0, + ("biba_effective_in_range: mb not effective")); + element = &mb->mb_effective; return (element->mbe_type == MAC_BIBA_TYPE_EQUAL || element->mbe_type == MAC_BIBA_TYPE_HIGH); } static int -mac_biba_range_in_range(struct mac_biba *rangea, struct mac_biba *rangeb) +biba_range_in_range(struct mac_biba *rangea, struct mac_biba *rangeb) { - return (mac_biba_dominate_element(&rangeb->mb_rangehigh, + return (biba_dominate_element(&rangeb->mb_rangehigh, &rangea->mb_rangehigh) && - mac_biba_dominate_element(&rangea->mb_rangelow, + biba_dominate_element(&rangea->mb_rangelow, &rangeb->mb_rangelow)); } static int -mac_biba_effective_in_range(struct mac_biba *effective, - struct mac_biba *range) +biba_effective_in_range(struct mac_biba *effective, struct mac_biba *range) { KASSERT((effective->mb_flags & MAC_BIBA_FLAG_EFFECTIVE) != 0, - ("mac_biba_effective_in_range: a not effective")); + ("biba_effective_in_range: a not effective")); KASSERT((range->mb_flags & MAC_BIBA_FLAG_RANGE) != 0, - ("mac_biba_effective_in_range: b not range")); + ("biba_effective_in_range: b not range")); - return (mac_biba_dominate_element(&range->mb_rangehigh, + return (biba_dominate_element(&range->mb_rangehigh, &effective->mb_effective) && - mac_biba_dominate_element(&effective->mb_effective, + biba_dominate_element(&effective->mb_effective, &range->mb_rangelow)); return (1); } static int -mac_biba_dominate_effective(struct mac_biba *a, struct mac_biba *b) +biba_dominate_effective(struct mac_biba *a, struct mac_biba *b) { KASSERT((a->mb_flags & MAC_BIBA_FLAG_EFFECTIVE) != 0, - ("mac_biba_dominate_effective: a not effective")); + ("biba_dominate_effective: a not effective")); KASSERT((b->mb_flags & MAC_BIBA_FLAG_EFFECTIVE) != 0, - ("mac_biba_dominate_effective: b not effective")); + ("biba_dominate_effective: b not effective")); - return (mac_biba_dominate_element(&a->mb_effective, &b->mb_effective)); + return (biba_dominate_element(&a->mb_effective, &b->mb_effective)); } static int -mac_biba_equal_element(struct mac_biba_element *a, struct mac_biba_element *b) +biba_equal_element(struct mac_biba_element *a, struct mac_biba_element *b) { if (a->mbe_type == MAC_BIBA_TYPE_EQUAL || @@ -294,29 +292,30 @@ mac_biba_equal_element(struct mac_biba_element *a, struct mac_biba_element *b) } static int -mac_biba_equal_effective(struct mac_biba *a, struct mac_biba *b) +biba_equal_effective(struct mac_biba *a, struct mac_biba *b) { KASSERT((a->mb_flags & MAC_BIBA_FLAG_EFFECTIVE) != 0, - ("mac_biba_equal_effective: a not effective")); + ("biba_equal_effective: a not effective")); KASSERT((b->mb_flags & MAC_BIBA_FLAG_EFFECTIVE) != 0, - ("mac_biba_equal_effective: b not effective")); + ("biba_equal_effective: b not effective")); - return (mac_biba_equal_element(&a->mb_effective, &b->mb_effective)); + return (biba_equal_element(&a->mb_effective, &b->mb_effective)); } static int -mac_biba_contains_equal(struct mac_biba *mac_biba) +biba_contains_equal(struct mac_biba *mb) { - if (mac_biba->mb_flags & MAC_BIBA_FLAG_EFFECTIVE) - if (mac_biba->mb_effective.mbe_type == MAC_BIBA_TYPE_EQUAL) + if (mb->mb_flags & MAC_BIBA_FLAG_EFFECTIVE) { + if (mb->mb_effective.mbe_type == MAC_BIBA_TYPE_EQUAL) return (1); + } - if (mac_biba->mb_flags & MAC_BIBA_FLAG_RANGE) { - if (mac_biba->mb_rangelow.mbe_type == MAC_BIBA_TYPE_EQUAL) + if (mb->mb_flags & MAC_BIBA_FLAG_RANGE) { + if (mb->mb_rangelow.mbe_type == MAC_BIBA_TYPE_EQUAL) return (1); - if (mac_biba->mb_rangehigh.mbe_type == MAC_BIBA_TYPE_EQUAL) + if (mb->mb_rangehigh.mbe_type == MAC_BIBA_TYPE_EQUAL) return (1); } @@ -324,25 +323,24 @@ mac_biba_contains_equal(struct mac_biba *mac_biba) } static int -mac_biba_subject_privileged(struct mac_biba *mac_biba) +biba_subject_privileged(struct mac_biba *mb) { - KASSERT((mac_biba->mb_flags & MAC_BIBA_FLAGS_BOTH) == - MAC_BIBA_FLAGS_BOTH, - ("mac_biba_subject_privileged: subject doesn't have both labels")); + KASSERT((mb->mb_flags & MAC_BIBA_FLAGS_BOTH) == MAC_BIBA_FLAGS_BOTH, + ("biba_subject_privileged: subject doesn't have both labels")); /* If the effective is EQUAL, it's ok. */ - if (mac_biba->mb_effective.mbe_type == MAC_BIBA_TYPE_EQUAL) + if (mb->mb_effective.mbe_type == MAC_BIBA_TYPE_EQUAL) return (0); /* If either range endpoint is EQUAL, it's ok. */ - if (mac_biba->mb_rangelow.mbe_type == MAC_BIBA_TYPE_EQUAL || - mac_biba->mb_rangehigh.mbe_type == MAC_BIBA_TYPE_EQUAL) + if (mb->mb_rangelow.mbe_type == MAC_BIBA_TYPE_EQUAL || + mb->mb_rangehigh.mbe_type == MAC_BIBA_TYPE_EQUAL) return (0); /* If the range is low-high, it's ok. */ - if (mac_biba->mb_rangelow.mbe_type == MAC_BIBA_TYPE_LOW && - mac_biba->mb_rangehigh.mbe_type == MAC_BIBA_TYPE_HIGH) + if (mb->mb_rangelow.mbe_type == MAC_BIBA_TYPE_LOW && + mb->mb_rangehigh.mbe_type == MAC_BIBA_TYPE_HIGH) return (0); /* It's not ok. */ @@ -350,30 +348,30 @@ mac_biba_subject_privileged(struct mac_biba *mac_biba) } static int -mac_biba_high_effective(struct mac_biba *mac_biba) +biba_high_effective(struct mac_biba *mb) { - KASSERT((mac_biba->mb_flags & MAC_BIBA_FLAG_EFFECTIVE) != 0, - ("mac_biba_equal_effective: mac_biba not effective")); + KASSERT((mb->mb_flags & MAC_BIBA_FLAG_EFFECTIVE) != 0, + ("biba_equal_effective: mb not effective")); - return (mac_biba->mb_effective.mbe_type == MAC_BIBA_TYPE_HIGH); + return (mb->mb_effective.mbe_type == MAC_BIBA_TYPE_HIGH); } static int -mac_biba_valid(struct mac_biba *mac_biba) +biba_valid(struct mac_biba *mb) { - if (mac_biba->mb_flags & MAC_BIBA_FLAG_EFFECTIVE) { - switch (mac_biba->mb_effective.mbe_type) { + if (mb->mb_flags & MAC_BIBA_FLAG_EFFECTIVE) { + switch (mb->mb_effective.mbe_type) { case MAC_BIBA_TYPE_GRADE: break; case MAC_BIBA_TYPE_EQUAL: case MAC_BIBA_TYPE_HIGH: case MAC_BIBA_TYPE_LOW: - if (mac_biba->mb_effective.mbe_grade != 0 || + if (mb->mb_effective.mbe_grade != 0 || !MAC_BIBA_BIT_SET_EMPTY( - mac_biba->mb_effective.mbe_compartments)) + mb->mb_effective.mbe_compartments)) return (EINVAL); break; @@ -381,21 +379,21 @@ mac_biba_valid(struct mac_biba *mac_biba) return (EINVAL); } } else { - if (mac_biba->mb_effective.mbe_type != MAC_BIBA_TYPE_UNDEF) + if (mb->mb_effective.mbe_type != MAC_BIBA_TYPE_UNDEF) return (EINVAL); } - if (mac_biba->mb_flags & MAC_BIBA_FLAG_RANGE) { - switch (mac_biba->mb_rangelow.mbe_type) { + if (mb->mb_flags & MAC_BIBA_FLAG_RANGE) { + switch (mb->mb_rangelow.mbe_type) { case MAC_BIBA_TYPE_GRADE: break; case MAC_BIBA_TYPE_EQUAL: case MAC_BIBA_TYPE_HIGH: case MAC_BIBA_TYPE_LOW: - if (mac_biba->mb_rangelow.mbe_grade != 0 || + if (mb->mb_rangelow.mbe_grade != 0 || !MAC_BIBA_BIT_SET_EMPTY( - mac_biba->mb_rangelow.mbe_compartments)) + mb->mb_rangelow.mbe_compartments)) return (EINVAL); break; @@ -403,28 +401,28 @@ mac_biba_valid(struct mac_biba *mac_biba) return (EINVAL); } - switch (mac_biba->mb_rangehigh.mbe_type) { + switch (mb->mb_rangehigh.mbe_type) { case MAC_BIBA_TYPE_GRADE: break; case MAC_BIBA_TYPE_EQUAL: case MAC_BIBA_TYPE_HIGH: case MAC_BIBA_TYPE_LOW: - if (mac_biba->mb_rangehigh.mbe_grade != 0 || + if (mb->mb_rangehigh.mbe_grade != 0 || !MAC_BIBA_BIT_SET_EMPTY( - mac_biba->mb_rangehigh.mbe_compartments)) + mb->mb_rangehigh.mbe_compartments)) return (EINVAL); break; default: return (EINVAL); } - if (!mac_biba_dominate_element(&mac_biba->mb_rangehigh, - &mac_biba->mb_rangelow)) + if (!biba_dominate_element(&mb->mb_rangehigh, + &mb->mb_rangelow)) return (EINVAL); } else { - if (mac_biba->mb_rangelow.mbe_type != MAC_BIBA_TYPE_UNDEF || - mac_biba->mb_rangehigh.mbe_type != MAC_BIBA_TYPE_UNDEF) + if (mb->mb_rangelow.mbe_type != MAC_BIBA_TYPE_UNDEF || + mb->mb_rangehigh.mbe_type != MAC_BIBA_TYPE_UNDEF) return (EINVAL); } @@ -432,45 +430,43 @@ mac_biba_valid(struct mac_biba *mac_biba) } static void -mac_biba_set_range(struct mac_biba *mac_biba, u_short typelow, - u_short gradelow, u_char *compartmentslow, u_short typehigh, - u_short gradehigh, u_char *compartmentshigh) +biba_set_range(struct mac_biba *mb, u_short typelow, u_short gradelow, + u_char *compartmentslow, u_short typehigh, u_short gradehigh, + u_char *compartmentshigh) { - mac_biba->mb_rangelow.mbe_type = typelow; - mac_biba->mb_rangelow.mbe_grade = gradelow; + mb->mb_rangelow.mbe_type = typelow; + mb->mb_rangelow.mbe_grade = gradelow; if (compartmentslow != NULL) - memcpy(mac_biba->mb_rangelow.mbe_compartments, - compartmentslow, - sizeof(mac_biba->mb_rangelow.mbe_compartments)); - mac_biba->mb_rangehigh.mbe_type = typehigh; - mac_biba->mb_rangehigh.mbe_grade = gradehigh; + memcpy(mb->mb_rangelow.mbe_compartments, compartmentslow, + sizeof(mb->mb_rangelow.mbe_compartments)); + mb->mb_rangehigh.mbe_type = typehigh; + mb->mb_rangehigh.mbe_grade = gradehigh; if (compartmentshigh != NULL) - memcpy(mac_biba->mb_rangehigh.mbe_compartments, - compartmentshigh, - sizeof(mac_biba->mb_rangehigh.mbe_compartments)); - mac_biba->mb_flags |= MAC_BIBA_FLAG_RANGE; + memcpy(mb->mb_rangehigh.mbe_compartments, compartmentshigh, + sizeof(mb->mb_rangehigh.mbe_compartments)); + mb->mb_flags |= MAC_BIBA_FLAG_RANGE; } static void -mac_biba_set_effective(struct mac_biba *mac_biba, u_short type, u_short grade, +biba_set_effective(struct mac_biba *mb, u_short type, u_short grade, u_char *compartments) { - mac_biba->mb_effective.mbe_type = type; - mac_biba->mb_effective.mbe_grade = grade; + mb->mb_effective.mbe_type = type; + mb->mb_effective.mbe_grade = grade; if (compartments != NULL) - memcpy(mac_biba->mb_effective.mbe_compartments, compartments, - sizeof(mac_biba->mb_effective.mbe_compartments)); - mac_biba->mb_flags |= MAC_BIBA_FLAG_EFFECTIVE; + memcpy(mb->mb_effective.mbe_compartments, compartments, + sizeof(mb->mb_effective.mbe_compartments)); + mb->mb_flags |= MAC_BIBA_FLAG_EFFECTIVE; } static void -mac_biba_copy_range(struct mac_biba *labelfrom, struct mac_biba *labelto) +biba_copy_range(struct mac_biba *labelfrom, struct mac_biba *labelto) { KASSERT((labelfrom->mb_flags & MAC_BIBA_FLAG_RANGE) != 0, - ("mac_biba_copy_range: labelfrom not range")); + ("biba_copy_range: labelfrom not range")); labelto->mb_rangelow = labelfrom->mb_rangelow; labelto->mb_rangehigh = labelfrom->mb_rangehigh; @@ -478,31 +474,31 @@ mac_biba_copy_range(struct mac_biba *labelfrom, struct mac_biba *labelto) } static void -mac_biba_copy_effective(struct mac_biba *labelfrom, struct mac_biba *labelto) +biba_copy_effective(struct mac_biba *labelfrom, struct mac_biba *labelto) { KASSERT((labelfrom->mb_flags & MAC_BIBA_FLAG_EFFECTIVE) != 0, - ("mac_biba_copy_effective: labelfrom not effective")); + ("biba_copy_effective: labelfrom not effective")); labelto->mb_effective = labelfrom->mb_effective; labelto->mb_flags |= MAC_BIBA_FLAG_EFFECTIVE; } static void -mac_biba_copy(struct mac_biba *source, struct mac_biba *dest) +biba_copy(struct mac_biba *source, struct mac_biba *dest) { if (source->mb_flags & MAC_BIBA_FLAG_EFFECTIVE) - mac_biba_copy_effective(source, dest); + biba_copy_effective(source, dest); if (source->mb_flags & MAC_BIBA_FLAG_RANGE) - mac_biba_copy_range(source, dest); + biba_copy_range(source, dest); } /* * Policy module operations. */ static void -mac_biba_init(struct mac_policy_conf *conf) +biba_init(struct mac_policy_conf *conf) { zone_biba = uma_zcreate("mac_biba", sizeof(struct mac_biba), NULL, @@ -513,14 +509,14 @@ mac_biba_init(struct mac_policy_conf *conf) * Label operations. */ static void -mac_biba_init_label(struct label *label) +biba_init_label(struct label *label) { SLOT_SET(label, biba_alloc(M_WAITOK)); } static int -mac_biba_init_label_waitcheck(struct label *label, int flag) +biba_init_label_waitcheck(struct label *label, int flag) { SLOT_SET(label, biba_alloc(flag)); @@ -531,7 +527,7 @@ mac_biba_init_label_waitcheck(struct label *label, int flag) } static void -mac_biba_destroy_label(struct label *label) +biba_destroy_label(struct label *label) { biba_free(SLOT(label)); @@ -539,12 +535,12 @@ mac_biba_destroy_label(struct label *label) } /* - * mac_biba_element_to_string() accepts an sbuf and Biba element. It - * converts the Biba element to a string and stores the result in the - * sbuf; if there isn't space in the sbuf, -1 is returned. + * biba_element_to_string() accepts an sbuf and Biba element. It converts + * the Biba element to a string and stores the result in the sbuf; if there + * isn't space in the sbuf, -1 is returned. */ static int -mac_biba_element_to_string(struct sbuf *sb, struct mac_biba_element *element) +biba_element_to_string(struct sbuf *sb, struct mac_biba_element *element) { int i, first; @@ -580,41 +576,38 @@ mac_biba_element_to_string(struct sbuf *sb, struct mac_biba_element *element) return (0); default: - panic("mac_biba_element_to_string: invalid type (%d)", + panic("biba_element_to_string: invalid type (%d)", element->mbe_type); } } /* - * mac_biba_to_string() converts a Biba label to a string, and places - * the results in the passed sbuf. It returns 0 on success, or EINVAL - * if there isn't room in the sbuf. Note: the sbuf will be modified - * even in a failure case, so the caller may need to revert the sbuf - * by restoring the offset if that's undesired. + * biba_to_string() converts a Biba label to a string, and places the results + * in the passed sbuf. It returns 0 on success, or EINVAL if there isn't + * room in the sbuf. Note: the sbuf will be modified even in a failure case, + * so the caller may need to revert the sbuf by restoring the offset if + * that's undesired. */ static int -mac_biba_to_string(struct sbuf *sb, struct mac_biba *mac_biba) +biba_to_string(struct sbuf *sb, struct mac_biba *mb) { - if (mac_biba->mb_flags & MAC_BIBA_FLAG_EFFECTIVE) { - if (mac_biba_element_to_string(sb, &mac_biba->mb_effective) - == -1) + if (mb->mb_flags & MAC_BIBA_FLAG_EFFECTIVE) { + if (biba_element_to_string(sb, &mb->mb_effective) == -1) return (EINVAL); } - if (mac_biba->mb_flags & MAC_BIBA_FLAG_RANGE) { + if (mb->mb_flags & MAC_BIBA_FLAG_RANGE) { if (sbuf_putc(sb, '(') == -1) return (EINVAL); - if (mac_biba_element_to_string(sb, &mac_biba->mb_rangelow) - == -1) + if (biba_element_to_string(sb, &mb->mb_rangelow) == -1) return (EINVAL); if (sbuf_putc(sb, '-') == -1) return (EINVAL); - if (mac_biba_element_to_string(sb, &mac_biba->mb_rangehigh) - == -1) + if (biba_element_to_string(sb, &mb->mb_rangehigh) == -1) return (EINVAL); if (sbuf_putc(sb, ')') == -1) @@ -625,22 +618,22 @@ mac_biba_to_string(struct sbuf *sb, struct mac_biba *mac_biba) } static int -mac_biba_externalize_label(struct label *label, char *element_name, +biba_externalize_label(struct label *label, char *element_name, struct sbuf *sb, int *claimed) { - struct mac_biba *mac_biba; + struct mac_biba *mb; if (strcmp(MAC_BIBA_LABEL_NAME, element_name) != 0) return (0); (*claimed)++; - mac_biba = SLOT(label); - return (mac_biba_to_string(sb, mac_biba)); + mb = SLOT(label); + return (biba_to_string(sb, mb)); } static int -mac_biba_parse_element(struct mac_biba_element *element, char *string) +biba_parse_element(struct mac_biba_element *element, char *string) { char *compartment, *end, *grade; int value; @@ -699,7 +692,7 @@ mac_biba_parse_element(struct mac_biba_element *element, char *string) * calling if that's a problem. */ static int -mac_biba_parse(struct mac_biba *mac_biba, char *string) +biba_parse(struct mac_biba *mb, char *string) { char *rangehigh, *rangelow, *effective; int error; @@ -724,29 +717,27 @@ mac_biba_parse(struct mac_biba *mac_biba, char *string) KASSERT((rangelow != NULL && rangehigh != NULL) || (rangelow == NULL && rangehigh == NULL), - ("mac_biba_parse: range mismatch")); + ("biba_parse: range mismatch")); - bzero(mac_biba, sizeof(*mac_biba)); + bzero(mb, sizeof(*mb)); if (effective != NULL) { - error = mac_biba_parse_element(&mac_biba->mb_effective, effective); + error = biba_parse_element(&mb->mb_effective, effective); if (error) return (error); - mac_biba->mb_flags |= MAC_BIBA_FLAG_EFFECTIVE; + mb->mb_flags |= MAC_BIBA_FLAG_EFFECTIVE; } if (rangelow != NULL) { - error = mac_biba_parse_element(&mac_biba->mb_rangelow, - rangelow); + error = biba_parse_element(&mb->mb_rangelow, rangelow); if (error) return (error); - error = mac_biba_parse_element(&mac_biba->mb_rangehigh, - rangehigh); + error = biba_parse_element(&mb->mb_rangehigh, rangehigh); if (error) return (error); - mac_biba->mb_flags |= MAC_BIBA_FLAG_RANGE; + mb->mb_flags |= MAC_BIBA_FLAG_RANGE; } - error = mac_biba_valid(mac_biba); + error = biba_valid(mb); if (error) return (error); @@ -754,10 +745,10 @@ mac_biba_parse(struct mac_biba *mac_biba, char *string) } static int -mac_biba_internalize_label(struct label *label, char *element_name, +biba_internalize_label(struct label *label, char *element_name, char *element_data, int *claimed) { - struct mac_biba *mac_biba, mac_biba_temp; + struct mac_biba *mb, mb_temp; int error; if (strcmp(MAC_BIBA_LABEL_NAME, element_name) != 0) @@ -765,35 +756,35 @@ mac_biba_internalize_label(struct label *label, char *element_name, (*claimed)++; - error = mac_biba_parse(&mac_biba_temp, element_data); + error = biba_parse(&mb_temp, element_data); if (error) return (error); - mac_biba = SLOT(label); - *mac_biba = mac_biba_temp; + mb = SLOT(label); + *mb = mb_temp; return (0); } static void -mac_biba_copy_label(struct label *src, struct label *dest) +biba_copy_label(struct label *src, struct label *dest) { *SLOT(dest) = *SLOT(src); } /* - * Labeling event operations: file system objects, and things that look - * a lot like file system objects. + * Labeling event operations: file system objects, and things that look a lot + * like file system objects. */ static void -mac_biba_devfs_create_device(struct ucred *cred, struct mount *mp, +biba_devfs_create_device(struct ucred *cred, struct mount *mp, struct cdev *dev, struct devfs_dirent *de, struct label *delabel) { - struct mac_biba *mac_biba; + struct mac_biba *mb; int biba_type; - mac_biba = SLOT(delabel); + mb = SLOT(delabel); if (strcmp(dev->si_name, "null") == 0 || strcmp(dev->si_name, "zero") == 0 || strcmp(dev->si_name, "random") == 0 || @@ -805,21 +796,22 @@ mac_biba_devfs_create_device(struct ucred *cred, struct mount *mp, biba_type = MAC_BIBA_TYPE_EQUAL; else biba_type = MAC_BIBA_TYPE_HIGH; - mac_biba_set_effective(mac_biba, biba_type, 0, NULL); + biba_set_effective(mb, biba_type, 0, NULL); } static void -mac_biba_devfs_create_directory(struct mount *mp, char *dirname, - int dirnamelen, struct devfs_dirent *de, struct label *delabel) +biba_devfs_create_directory(struct mount *mp, char *dirname, int dirnamelen, + struct devfs_dirent *de, struct label *delabel) { - struct mac_biba *mac_biba; + struct mac_biba *mb; + + mb = SLOT(delabel); - mac_biba = SLOT(delabel); - mac_biba_set_effective(mac_biba, MAC_BIBA_TYPE_HIGH, 0, NULL); + biba_set_effective(mb, MAC_BIBA_TYPE_HIGH, 0, NULL); } static void -mac_biba_devfs_create_symlink(struct ucred *cred, struct mount *mp, +biba_devfs_create_symlink(struct ucred *cred, struct mount *mp, struct devfs_dirent *dd, struct label *ddlabel, struct devfs_dirent *de, struct label *delabel) { @@ -828,22 +820,23 @@ mac_biba_devfs_create_symlink(struct ucred *cred, struct mount *mp, source = SLOT(cred->cr_label); dest = SLOT(delabel); - mac_biba_copy_effective(source, dest); + biba_copy_effective(source, dest); } static void -mac_biba_mount_create(struct ucred *cred, struct mount *mp, +biba_mount_create(struct ucred *cred, struct mount *mp, struct label *mplabel) { struct mac_biba *source, *dest; source = SLOT(cred->cr_label); dest = SLOT(mplabel); - mac_biba_copy_effective(source, dest); + + biba_copy_effective(source, dest); } static void -mac_biba_vnode_relabel(struct ucred *cred, struct vnode *vp, +biba_vnode_relabel(struct ucred *cred, struct vnode *vp, struct label *vplabel, struct label *newlabel) { struct mac_biba *source, *dest; @@ -851,11 +844,11 @@ mac_biba_vnode_relabel(struct ucred *cred, struct vnode *vp, source = SLOT(newlabel); dest = SLOT(vplabel); - mac_biba_copy(source, dest); + biba_copy(source, dest); } static void -mac_biba_devfs_update(struct mount *mp, struct devfs_dirent *de, +biba_devfs_update(struct mount *mp, struct devfs_dirent *de, struct label *delabel, struct vnode *vp, struct label *vplabel) { struct mac_biba *source, *dest; @@ -863,11 +856,11 @@ mac_biba_devfs_update(struct mount *mp, struct devfs_dirent *de, source = SLOT(vplabel); dest = SLOT(delabel); - mac_biba_copy(source, dest); + biba_copy(source, dest); } static void -mac_biba_devfs_vnode_associate(struct mount *mp, struct label *mntlabel, +biba_devfs_vnode_associate(struct mount *mp, struct label *mntlabel, struct devfs_dirent *de, struct label *delabel, struct vnode *vp, struct label *vplabel) { @@ -876,103 +869,104 @@ mac_biba_devfs_vnode_associate(struct mount *mp, struct label *mntlabel, source = SLOT(delabel); dest = SLOT(vplabel); - mac_biba_copy_effective(source, dest); + biba_copy_effective(source, dest); } static int -mac_biba_vnode_associate_extattr(struct mount *mp, struct label *mplabel, +biba_vnode_associate_extattr(struct mount *mp, struct label *mplabel, struct vnode *vp, struct label *vplabel) { - struct mac_biba temp, *source, *dest; + struct mac_biba mb_temp, *source, *dest; int buflen, error; source = SLOT(mplabel); dest = SLOT(vplabel); - buflen = sizeof(temp); - bzero(&temp, buflen); + buflen = sizeof(mb_temp); + bzero(&mb_temp, buflen); error = vn_extattr_get(vp, IO_NODELOCKED, MAC_BIBA_EXTATTR_NAMESPACE, - MAC_BIBA_EXTATTR_NAME, &buflen, (char *) &temp, curthread); + MAC_BIBA_EXTATTR_NAME, &buflen, (char *) &mb_temp, curthread); if (error == ENOATTR || error == EOPNOTSUPP) { /* Fall back to the mntlabel. */ - mac_biba_copy_effective(source, dest); + biba_copy_effective(source, dest); return (0); } else if (error) return (error); - if (buflen != sizeof(temp)) { - printf("mac_biba_vnode_associate_extattr: bad size %d\n", + if (buflen != sizeof(mb_temp)) { + printf("biba_vnode_associate_extattr: bad size %d\n", buflen); return (EPERM); } - if (mac_biba_valid(&temp) != 0) { - printf("mac_biba_vnode_associate_extattr: invalid\n"); + if (biba_valid(&mb_temp) != 0) { + printf("biba_vnode_associate_extattr: invalid\n"); return (EPERM); } - if ((temp.mb_flags & MAC_BIBA_FLAGS_BOTH) != MAC_BIBA_FLAG_EFFECTIVE) { - printf("mac_biba_vnode_associate_extattr: not effective\n"); + if ((mb_temp.mb_flags & MAC_BIBA_FLAGS_BOTH) != + MAC_BIBA_FLAG_EFFECTIVE) { + printf("biba_vnode_associate_extattr: not effective\n"); return (EPERM); } - mac_biba_copy_effective(&temp, dest); + biba_copy_effective(&mb_temp, dest); return (0); } static void -mac_biba_vnode_associate_singlelabel(struct mount *mp, - struct label *mplabel, struct vnode *vp, struct label *vplabel) +biba_vnode_associate_singlelabel(struct mount *mp, struct label *mplabel, + struct vnode *vp, struct label *vplabel) { struct mac_biba *source, *dest; source = SLOT(mplabel); dest = SLOT(vplabel); - mac_biba_copy_effective(source, dest); + biba_copy_effective(source, dest); } static int -mac_biba_vnode_create_extattr(struct ucred *cred, struct mount *mp, +biba_vnode_create_extattr(struct ucred *cred, struct mount *mp, struct label *mplabel, struct vnode *dvp, struct label *dvplabel, struct vnode *vp, struct label *vplabel, struct componentname *cnp) { - struct mac_biba *source, *dest, temp; + struct mac_biba *source, *dest, mb_temp; size_t buflen; int error; - buflen = sizeof(temp); - bzero(&temp, buflen); + buflen = sizeof(mb_temp); + bzero(&mb_temp, buflen); source = SLOT(cred->cr_label); dest = SLOT(vplabel); - mac_biba_copy_effective(source, &temp); + biba_copy_effective(source, &mb_temp); error = vn_extattr_set(vp, IO_NODELOCKED, MAC_BIBA_EXTATTR_NAMESPACE, - MAC_BIBA_EXTATTR_NAME, buflen, (char *) &temp, curthread); + MAC_BIBA_EXTATTR_NAME, buflen, (char *) &mb_temp, curthread); if (error == 0) - mac_biba_copy_effective(source, dest); + biba_copy_effective(source, dest); return (error); } static int -mac_biba_vnode_setlabel_extattr(struct ucred *cred, struct vnode *vp, +biba_vnode_setlabel_extattr(struct ucred *cred, struct vnode *vp, struct label *vplabel, struct label *intlabel) { - struct mac_biba *source, temp; + struct mac_biba *source, mb_temp; size_t buflen; int error; - buflen = sizeof(temp); - bzero(&temp, buflen); + buflen = sizeof(mb_temp); + bzero(&mb_temp, buflen); source = SLOT(intlabel); if ((source->mb_flags & MAC_BIBA_FLAG_EFFECTIVE) == 0) return (0); - mac_biba_copy_effective(source, &temp); + biba_copy_effective(source, &mb_temp); error = vn_extattr_set(vp, IO_NODELOCKED, MAC_BIBA_EXTATTR_NAMESPACE, - MAC_BIBA_EXTATTR_NAME, buflen, (char *) &temp, curthread); + MAC_BIBA_EXTATTR_NAME, buflen, (char *) &mb_temp, curthread); return (error); } @@ -980,7 +974,7 @@ mac_biba_vnode_setlabel_extattr(struct ucred *cred, struct vnode *vp, * Labeling event operations: IPC object. */ static void -mac_biba_inpcb_create(struct socket *so, struct label *solabel, +biba_inpcb_create(struct socket *so, struct label *solabel, struct inpcb *inp, struct label *inplabel) { struct mac_biba *source, *dest; @@ -988,11 +982,11 @@ mac_biba_inpcb_create(struct socket *so, struct label *solabel, source = SLOT(solabel); dest = SLOT(inplabel); - mac_biba_copy_effective(source, dest); + biba_copy_effective(source, dest); } static void -mac_biba_socket_create_mbuf(struct socket *so, struct label *solabel, +biba_socket_create_mbuf(struct socket *so, struct label *solabel, struct mbuf *m, struct label *mlabel) { struct mac_biba *source, *dest; @@ -1000,11 +994,11 @@ mac_biba_socket_create_mbuf(struct socket *so, struct label *solabel, source = SLOT(solabel); dest = SLOT(mlabel); - mac_biba_copy_effective(source, dest); + biba_copy_effective(source, dest); } static void -mac_biba_socket_create(struct ucred *cred, struct socket *so, +biba_socket_create(struct ucred *cred, struct socket *so, struct label *solabel) { struct mac_biba *source, *dest; @@ -1012,11 +1006,11 @@ mac_biba_socket_create(struct ucred *cred, struct socket *so, source = SLOT(cred->cr_label); dest = SLOT(solabel); - mac_biba_copy_effective(source, dest); + biba_copy_effective(source, dest); } static void -mac_biba_pipe_create(struct ucred *cred, struct pipepair *pp, +biba_pipe_create(struct ucred *cred, struct pipepair *pp, struct label *pplabel) { struct mac_biba *source, *dest; @@ -1024,11 +1018,11 @@ mac_biba_pipe_create(struct ucred *cred, struct pipepair *pp, source = SLOT(cred->cr_label); dest = SLOT(pplabel); - mac_biba_copy_effective(source, dest); + biba_copy_effective(source, dest); } static void -mac_biba_posixsem_create(struct ucred *cred, struct ksem *ks, +biba_posixsem_create(struct ucred *cred, struct ksem *ks, struct label *kslabel) { struct mac_biba *source, *dest; @@ -1036,11 +1030,11 @@ mac_biba_posixsem_create(struct ucred *cred, struct ksem *ks, source = SLOT(cred->cr_label); dest = SLOT(kslabel); - mac_biba_copy_effective(source, dest); + biba_copy_effective(source, dest); } static void -mac_biba_socket_newconn(struct socket *oldso, struct label *oldsolabel, +biba_socket_newconn(struct socket *oldso, struct label *oldsolabel, struct socket *newso, struct label *newsolabel) { struct mac_biba *source, *dest; @@ -1048,11 +1042,11 @@ mac_biba_socket_newconn(struct socket *oldso, struct label *oldsolabel, source = SLOT(oldsolabel); dest = SLOT(newsolabel); - mac_biba_copy_effective(source, dest); + biba_copy_effective(source, dest); } static void -mac_biba_socket_relabel(struct ucred *cred, struct socket *so, +biba_socket_relabel(struct ucred *cred, struct socket *so, struct label *solabel, struct label *newlabel) { struct mac_biba *source, *dest; @@ -1060,11 +1054,11 @@ mac_biba_socket_relabel(struct ucred *cred, struct socket *so, source = SLOT(newlabel); dest = SLOT(solabel); - mac_biba_copy(source, dest); + biba_copy(source, dest); } static void -mac_biba_pipe_relabel(struct ucred *cred, struct pipepair *pp, +biba_pipe_relabel(struct ucred *cred, struct pipepair *pp, struct label *pplabel, struct label *newlabel) { struct mac_biba *source, *dest; @@ -1072,11 +1066,11 @@ mac_biba_pipe_relabel(struct ucred *cred, struct pipepair *pp, source = SLOT(newlabel); dest = SLOT(pplabel); - mac_biba_copy(source, dest); + biba_copy(source, dest); } static void -mac_biba_socketpeer_set_from_mbuf(struct mbuf *m, struct label *mlabel, +biba_socketpeer_set_from_mbuf(struct mbuf *m, struct label *mlabel, struct socket *so, struct label *sopeerlabel) { struct mac_biba *source, *dest; @@ -1084,14 +1078,14 @@ mac_biba_socketpeer_set_from_mbuf(struct mbuf *m, struct label *mlabel, source = SLOT(mlabel); dest = SLOT(sopeerlabel); - mac_biba_copy_effective(source, dest); + biba_copy_effective(source, dest); } /* * Labeling event operations: System V IPC objects. */ static void -mac_biba_sysvmsg_create(struct ucred *cred, struct msqid_kernel *msqkptr, +biba_sysvmsg_create(struct ucred *cred, struct msqid_kernel *msqkptr, struct label *msqlabel, struct msg *msgptr, struct label *msglabel) { struct mac_biba *source, *dest; @@ -1100,23 +1094,23 @@ mac_biba_sysvmsg_create(struct ucred *cred, struct msqid_kernel *msqkptr, source = SLOT(cred->cr_label); dest = SLOT(msglabel); - mac_biba_copy_effective(source, dest); + biba_copy_effective(source, dest); } static void -mac_biba_sysvmsq_create(struct ucred *cred, - struct msqid_kernel *msqkptr, struct label *msqlabel) +biba_sysvmsq_create(struct ucred *cred, struct msqid_kernel *msqkptr, + struct label *msqlabel) { struct mac_biba *source, *dest; source = SLOT(cred->cr_label); dest = SLOT(msqlabel); - mac_biba_copy_effective(source, dest); + biba_copy_effective(source, dest); } static void -mac_biba_sysvsem_create(struct ucred *cred, struct semid_kernel *semakptr, +biba_sysvsem_create(struct ucred *cred, struct semid_kernel *semakptr, struct label *semalabel) { struct mac_biba *source, *dest; @@ -1124,11 +1118,11 @@ mac_biba_sysvsem_create(struct ucred *cred, struct semid_kernel *semakptr, source = SLOT(cred->cr_label); dest = SLOT(semalabel); - mac_biba_copy_effective(source, dest); + biba_copy_effective(source, dest); } static void -mac_biba_sysvshm_create(struct ucred *cred, struct shmid_kernel *shmsegptr, +biba_sysvshm_create(struct ucred *cred, struct shmid_kernel *shmsegptr, struct label *shmlabel) { struct mac_biba *source, *dest; @@ -1136,14 +1130,14 @@ mac_biba_sysvshm_create(struct ucred *cred, struct shmid_kernel *shmsegptr, source = SLOT(cred->cr_label); dest = SLOT(shmlabel); - mac_biba_copy_effective(source, dest); + biba_copy_effective(source, dest); } /* * Labeling event operations: network objects. */ static void -mac_biba_socketpeer_set_from_socket(struct socket *oldso, +biba_socketpeer_set_from_socket(struct socket *oldso, struct label *oldsolabel, struct socket *newso, struct label *newsopeerlabel) { @@ -1152,11 +1146,11 @@ mac_biba_socketpeer_set_from_socket(struct socket *oldso, source = SLOT(oldsolabel); dest = SLOT(newsopeerlabel); - mac_biba_copy_effective(source, dest); + biba_copy_effective(source, dest); } static void -mac_biba_bpfdesc_create(struct ucred *cred, struct bpf_d *d, +biba_bpfdesc_create(struct ucred *cred, struct bpf_d *d, struct label *dlabel) { struct mac_biba *source, *dest; @@ -1164,11 +1158,11 @@ mac_biba_bpfdesc_create(struct ucred *cred, struct bpf_d *d, source = SLOT(cred->cr_label); dest = SLOT(dlabel); - mac_biba_copy_effective(source, dest); + biba_copy_effective(source, dest); } static void -mac_biba_ifnet_create(struct ifnet *ifp, struct label *ifplabel) +biba_ifnet_create(struct ifnet *ifp, struct label *ifplabel) { char tifname[IFNAMSIZ], *p, *q; char tiflist[sizeof(trusted_interfaces)]; @@ -1220,12 +1214,12 @@ mac_biba_ifnet_create(struct ifnet *ifp, struct label *ifplabel) } } set: - mac_biba_set_effective(dest, type, 0, NULL); - mac_biba_set_range(dest, type, 0, NULL, type, 0, NULL); + biba_set_effective(dest, type, 0, NULL); + biba_set_range(dest, type, 0, NULL, type, 0, NULL); } static void -mac_biba_ipq_create(struct mbuf *m, struct label *mlabel, struct ipq *ipq, +biba_ipq_create(struct mbuf *m, struct label *mlabel, struct ipq *ipq, struct label *ipqlabel) { struct mac_biba *source, *dest; @@ -1233,12 +1227,12 @@ mac_biba_ipq_create(struct mbuf *m, struct label *mlabel, struct ipq *ipq, source = SLOT(mlabel); dest = SLOT(ipqlabel); - mac_biba_copy_effective(source, dest); + biba_copy_effective(source, dest); } static void -mac_biba_ipq_reassemble(struct ipq *ipq, struct label *ipqlabel, - struct mbuf *m, struct label *mlabel) +biba_ipq_reassemble(struct ipq *ipq, struct label *ipqlabel, struct mbuf *m, + struct label *mlabel) { struct mac_biba *source, *dest; @@ -1246,11 +1240,11 @@ mac_biba_ipq_reassemble(struct ipq *ipq, struct label *ipqlabel, dest = SLOT(mlabel); /* Just use the head, since we require them all to match. */ - mac_biba_copy_effective(source, dest); + biba_copy_effective(source, dest); } static void -mac_biba_netinet_fragment(struct mbuf *m, struct label *mlabel, +biba_netinet_fragment(struct mbuf *m, struct label *mlabel, struct mbuf *frag, struct label *fraglabel) { struct mac_biba *source, *dest; @@ -1258,11 +1252,11 @@ mac_biba_netinet_fragment(struct mbuf *m, struct label *mlabel, source = SLOT(mlabel); dest = SLOT(fraglabel); - mac_biba_copy_effective(source, dest); + biba_copy_effective(source, dest); } static void -mac_biba_inpcb_create_mbuf(struct inpcb *inp, struct label *inplabel, +biba_inpcb_create_mbuf(struct inpcb *inp, struct label *inplabel, struct mbuf *m, struct label *mlabel) { struct mac_biba *source, *dest; @@ -1270,22 +1264,22 @@ mac_biba_inpcb_create_mbuf(struct inpcb *inp, struct label *inplabel, source = SLOT(inplabel); dest = SLOT(mlabel); - mac_biba_copy_effective(source, dest); + biba_copy_effective(source, dest); } static void -mac_biba_create_mbuf_linklayer(struct ifnet *ifp, struct label *ifplabel, +biba_create_mbuf_linklayer(struct ifnet *ifp, struct label *ifplabel, struct mbuf *m, struct label *mlabel) { struct mac_biba *dest; dest = SLOT(mlabel); - mac_biba_set_effective(dest, MAC_BIBA_TYPE_EQUAL, 0, NULL); + biba_set_effective(dest, MAC_BIBA_TYPE_EQUAL, 0, NULL); } static void -mac_biba_bpfdesc_create_mbuf(struct bpf_d *d, struct label *dlabel, +biba_bpfdesc_create_mbuf(struct bpf_d *d, struct label *dlabel, struct mbuf *m, struct label *mlabel) { struct mac_biba *source, *dest; @@ -1293,11 +1287,11 @@ mac_biba_bpfdesc_create_mbuf(struct bpf_d *d, struct label *dlabel, source = SLOT(dlabel); dest = SLOT(mlabel); - mac_biba_copy_effective(source, dest); + biba_copy_effective(source, dest); } static void -mac_biba_ifnet_create_mbuf(struct ifnet *ifp, struct label *ifplabel, +biba_ifnet_create_mbuf(struct ifnet *ifp, struct label *ifplabel, struct mbuf *m, struct label *mlabel) { struct mac_biba *source, *dest; @@ -1305,11 +1299,11 @@ mac_biba_ifnet_create_mbuf(struct ifnet *ifp, struct label *ifplabel, source = SLOT(ifplabel); dest = SLOT(mlabel); - mac_biba_copy_effective(source, dest); + biba_copy_effective(source, dest); } static void -mac_biba_mbuf_create_multicast_encap(struct mbuf *m, struct label *mlabel, +biba_mbuf_create_multicast_encap(struct mbuf *m, struct label *mlabel, struct ifnet *ifp, struct label *ifplabel, struct mbuf *mnew, struct label *mnewlabel) { @@ -1318,11 +1312,11 @@ mac_biba_mbuf_create_multicast_encap(struct mbuf *m, struct label *mlabel, source = SLOT(mlabel); dest = SLOT(mnewlabel); - mac_biba_copy_effective(source, dest); + biba_copy_effective(source, dest); } static void -mac_biba_mbuf_create_netlayer(struct mbuf *m, struct label *mlabel, +biba_mbuf_create_netlayer(struct mbuf *m, struct label *mlabel, struct mbuf *newm, struct label *mnewlabel) { struct mac_biba *source, *dest; @@ -1330,11 +1324,11 @@ mac_biba_mbuf_create_netlayer(struct mbuf *m, struct label *mlabel, source = SLOT(mlabel); dest = SLOT(mnewlabel); - mac_biba_copy_effective(source, dest); + biba_copy_effective(source, dest); } static int -mac_biba_ipq_match(struct mbuf *m, struct label *mlabel, struct ipq *ipq, +biba_ipq_match(struct mbuf *m, struct label *mlabel, struct ipq *ipq, struct label *ipqlabel) { struct mac_biba *a, *b; @@ -1342,11 +1336,11 @@ mac_biba_ipq_match(struct mbuf *m, struct label *mlabel, struct ipq *ipq, a = SLOT(ipqlabel); b = SLOT(mlabel); - return (mac_biba_equal_effective(a, b)); + return (biba_equal_effective(a, b)); } static void -mac_biba_ifnet_relabel(struct ucred *cred, struct ifnet *ifp, +biba_ifnet_relabel(struct ucred *cred, struct ifnet *ifp, struct label *ifplabel, struct label *newlabel) { struct mac_biba *source, *dest; @@ -1354,11 +1348,11 @@ mac_biba_ifnet_relabel(struct ucred *cred, struct ifnet *ifp, source = SLOT(newlabel); dest = SLOT(ifplabel); - mac_biba_copy(source, dest); + biba_copy(source, dest); } static void -mac_biba_ipq_update(struct mbuf *m, struct label *mlabel, struct ipq *ipq, +biba_ipq_update(struct mbuf *m, struct label *mlabel, struct ipq *ipq, struct label *ipqlabel) { @@ -1366,7 +1360,7 @@ mac_biba_ipq_update(struct mbuf *m, struct label *mlabel, struct ipq *ipq, } static void -mac_biba_inpcb_sosetlabel(struct socket *so, struct label *solabel, +biba_inpcb_sosetlabel(struct socket *so, struct label *solabel, struct inpcb *inp, struct label *inplabel) { struct mac_biba *source, *dest; @@ -1374,84 +1368,84 @@ mac_biba_inpcb_sosetlabel(struct socket *so, struct label *solabel, source = SLOT(solabel); dest = SLOT(inplabel); - mac_biba_copy(source, dest); + biba_copy(source, dest); } static void -mac_biba_mbuf_create_from_firewall(struct mbuf *m, struct label *label) +biba_mbuf_create_from_firewall(struct mbuf *m, struct label *label) { struct mac_biba *dest; dest = SLOT(label); /* XXX: where is the label for the firewall really comming from? */ - mac_biba_set_effective(dest, MAC_BIBA_TYPE_EQUAL, 0, NULL); + biba_set_effective(dest, MAC_BIBA_TYPE_EQUAL, 0, NULL); } /* * Labeling event operations: processes. */ static void -mac_biba_proc_create_swapper(struct ucred *cred) +biba_proc_create_swapper(struct ucred *cred) { struct mac_biba *dest; dest = SLOT(cred->cr_label); - mac_biba_set_effective(dest, MAC_BIBA_TYPE_EQUAL, 0, NULL); - mac_biba_set_range(dest, MAC_BIBA_TYPE_LOW, 0, NULL, - MAC_BIBA_TYPE_HIGH, 0, NULL); + biba_set_effective(dest, MAC_BIBA_TYPE_EQUAL, 0, NULL); + biba_set_range(dest, MAC_BIBA_TYPE_LOW, 0, NULL, MAC_BIBA_TYPE_HIGH, + 0, NULL); } static void -mac_biba_proc_create_init(struct ucred *cred) +biba_proc_create_init(struct ucred *cred) { struct mac_biba *dest; dest = SLOT(cred->cr_label); - mac_biba_set_effective(dest, MAC_BIBA_TYPE_HIGH, 0, NULL); - mac_biba_set_range(dest, MAC_BIBA_TYPE_LOW, 0, NULL, - MAC_BIBA_TYPE_HIGH, 0, NULL); + biba_set_effective(dest, MAC_BIBA_TYPE_HIGH, 0, NULL); + biba_set_range(dest, MAC_BIBA_TYPE_LOW, 0, NULL, MAC_BIBA_TYPE_HIGH, + 0, NULL); } static void -mac_biba_cred_relabel(struct ucred *cred, struct label *newlabel) +biba_cred_relabel(struct ucred *cred, struct label *newlabel) { struct mac_biba *source, *dest; source = SLOT(newlabel); dest = SLOT(cred->cr_label); - mac_biba_copy(source, dest); + biba_copy(source, dest); } /* * Label cleanup/flush operations */ static void -mac_biba_sysvmsg_cleanup(struct label *msglabel) +biba_sysvmsg_cleanup(struct label *msglabel) { bzero(SLOT(msglabel), sizeof(struct mac_biba)); } static void -mac_biba_sysvmsq_cleanup(struct label *msqlabel) +biba_sysvmsq_cleanup(struct label *msqlabel) { bzero(SLOT(msqlabel), sizeof(struct mac_biba)); } static void -mac_biba_sysvsem_cleanup(struct label *semalabel) +biba_sysvsem_cleanup(struct label *semalabel) { bzero(SLOT(semalabel), sizeof(struct mac_biba)); } static void -mac_biba_sysvshm_cleanup(struct label *shmlabel) +biba_sysvshm_cleanup(struct label *shmlabel) { bzero(SLOT(shmlabel), sizeof(struct mac_biba)); } @@ -1460,24 +1454,24 @@ mac_biba_sysvshm_cleanup(struct label *shmlabel) * Access control checks. */ static int -mac_biba_bpfdesc_check_receive(struct bpf_d *d, struct label *dlabel, +biba_bpfdesc_check_receive(struct bpf_d *d, struct label *dlabel, struct ifnet *ifp, struct label *ifplabel) { struct mac_biba *a, *b; - if (!mac_biba_enabled) + if (!biba_enabled) return (0); a = SLOT(dlabel); b = SLOT(ifplabel); - if (mac_biba_equal_effective(a, b)) + if (biba_equal_effective(a, b)) return (0); return (EACCES); } static int -mac_biba_cred_check_relabel(struct ucred *cred, struct label *newlabel) +biba_cred_check_relabel(struct ucred *cred, struct label *newlabel) { struct mac_biba *subj, *new; int error; @@ -1504,7 +1498,7 @@ mac_biba_cred_check_relabel(struct ucred *cred, struct label *newlabel) */ if ((new->mb_flags & MAC_BIBA_FLAGS_BOTH) == MAC_BIBA_FLAGS_BOTH && - !mac_biba_effective_in_range(new, new)) + !biba_effective_in_range(new, new)) return (EINVAL); /* @@ -1512,24 +1506,23 @@ mac_biba_cred_check_relabel(struct ucred *cred, struct label *newlabel) * new effective label must be in the current range. */ if (new->mb_flags & MAC_BIBA_FLAG_EFFECTIVE && - !mac_biba_effective_in_range(new, subj)) + !biba_effective_in_range(new, subj)) return (EPERM); /* - * To change the Biba range on a credential, the new - * range label must be in the current range. + * To change the Biba range on a credential, the new range + * label must be in the current range. */ if (new->mb_flags & MAC_BIBA_FLAG_RANGE && - !mac_biba_range_in_range(new, subj)) + !biba_range_in_range(new, subj)) return (EPERM); /* - * To have EQUAL in any component of the new credential - * Biba label, the subject must already have EQUAL in - * their label. + * To have EQUAL in any component of the new credential Biba + * label, the subject must already have EQUAL in their label. */ - if (mac_biba_contains_equal(new)) { - error = mac_biba_subject_privileged(subj); + if (biba_contains_equal(new)) { + error = biba_subject_privileged(subj); if (error) return (error); } @@ -1539,25 +1532,25 @@ mac_biba_cred_check_relabel(struct ucred *cred, struct label *newlabel) } static int -mac_biba_cred_check_visible(struct ucred *u1, struct ucred *u2) +biba_cred_check_visible(struct ucred *u1, struct ucred *u2) { struct mac_biba *subj, *obj; - if (!mac_biba_enabled) + if (!biba_enabled) return (0); subj = SLOT(u1->cr_label); obj = SLOT(u2->cr_label); /* XXX: range */ - if (!mac_biba_dominate_effective(obj, subj)) + if (!biba_dominate_effective(obj, subj)) return (ESRCH); return (0); } static int -mac_biba_ifnet_check_relabel(struct ucred *cred, struct ifnet *ifp, +biba_ifnet_check_relabel(struct ucred *cred, struct ifnet *ifp, struct label *ifplabel, struct label *newlabel) { struct mac_biba *subj, *new; @@ -1567,8 +1560,8 @@ mac_biba_ifnet_check_relabel(struct ucred *cred, struct ifnet *ifp, new = SLOT(newlabel); /* - * If there is a Biba label update for the interface, it may - * be an update of the effective, range, or both. + * If there is a Biba label update for the interface, it may be an + * update of the effective, range, or both. */ error = biba_atmostflags(new, MAC_BIBA_FLAGS_BOTH); if (error) @@ -1577,7 +1570,7 @@ mac_biba_ifnet_check_relabel(struct ucred *cred, struct ifnet *ifp, /* * Relabling network interfaces requires Biba privilege. */ - error = mac_biba_subject_privileged(subj); + error = biba_subject_privileged(subj); if (error) return (error); @@ -1585,133 +1578,132 @@ mac_biba_ifnet_check_relabel(struct ucred *cred, struct ifnet *ifp, } static int -mac_biba_ifnet_check_transmit(struct ifnet *ifp, struct label *ifplabel, +biba_ifnet_check_transmit(struct ifnet *ifp, struct label *ifplabel, struct mbuf *m, struct label *mlabel) { struct mac_biba *p, *i; - if (!mac_biba_enabled) + if (!biba_enabled) return (0); p = SLOT(mlabel); i = SLOT(ifplabel); - return (mac_biba_effective_in_range(p, i) ? 0 : EACCES); + return (biba_effective_in_range(p, i) ? 0 : EACCES); } static int -mac_biba_inpcb_check_deliver(struct inpcb *inp, struct label *inplabel, +biba_inpcb_check_deliver(struct inpcb *inp, struct label *inplabel, struct mbuf *m, struct label *mlabel) { struct mac_biba *p, *i; - if (!mac_biba_enabled) + if (!biba_enabled) return (0); p = SLOT(mlabel); i = SLOT(inplabel); - return (mac_biba_equal_effective(p, i) ? 0 : EACCES); + return (biba_equal_effective(p, i) ? 0 : EACCES); } static int -mac_biba_sysvmsq_check_msgrcv(struct ucred *cred, struct msg *msgptr, +biba_sysvmsq_check_msgrcv(struct ucred *cred, struct msg *msgptr, struct label *msglabel) { struct mac_biba *subj, *obj; - if (!mac_biba_enabled) + if (!biba_enabled) return (0); subj = SLOT(cred->cr_label); obj = SLOT(msglabel); - if (!mac_biba_dominate_effective(obj, subj)) + if (!biba_dominate_effective(obj, subj)) return (EACCES); return (0); } static int -mac_biba_sysvmsq_check_msgrmid(struct ucred *cred, struct msg *msgptr, +biba_sysvmsq_check_msgrmid(struct ucred *cred, struct msg *msgptr, struct label *msglabel) { struct mac_biba *subj, *obj; - if (!mac_biba_enabled) + if (!biba_enabled) return (0); subj = SLOT(cred->cr_label); obj = SLOT(msglabel); - if (!mac_biba_dominate_effective(subj, obj)) + if (!biba_dominate_effective(subj, obj)) return (EACCES); return (0); } static int -mac_biba_sysvmsq_check_msqget(struct ucred *cred, - struct msqid_kernel *msqkptr, struct label *msqklabel) +biba_sysvmsq_check_msqget(struct ucred *cred, struct msqid_kernel *msqkptr, + struct label *msqklabel) { struct mac_biba *subj, *obj; - if (!mac_biba_enabled) + if (!biba_enabled) return (0); subj = SLOT(cred->cr_label); obj = SLOT(msqklabel); - if (!mac_biba_dominate_effective(obj, subj)) + if (!biba_dominate_effective(obj, subj)) return (EACCES); return (0); } static int -mac_biba_sysvmsq_check_msqsnd(struct ucred *cred, - struct msqid_kernel *msqkptr, struct label *msqklabel) +biba_sysvmsq_check_msqsnd(struct ucred *cred, struct msqid_kernel *msqkptr, + struct label *msqklabel) { struct mac_biba *subj, *obj; - if (!mac_biba_enabled) + if (!biba_enabled) return (0); subj = SLOT(cred->cr_label); obj = SLOT(msqklabel); - if (!mac_biba_dominate_effective(subj, obj)) + if (!biba_dominate_effective(subj, obj)) return (EACCES); return (0); } static int -mac_biba_sysvmsq_check_msqrcv(struct ucred *cred, - struct msqid_kernel *msqkptr, struct label *msqklabel) +biba_sysvmsq_check_msqrcv(struct ucred *cred, struct msqid_kernel *msqkptr, + struct label *msqklabel) { struct mac_biba *subj, *obj; - if (!mac_biba_enabled) + if (!biba_enabled) return (0); subj = SLOT(cred->cr_label); obj = SLOT(msqklabel); - if (!mac_biba_dominate_effective(obj, subj)) + if (!biba_dominate_effective(obj, subj)) return (EACCES); return (0); } - static int -mac_biba_sysvmsq_check_msqctl(struct ucred *cred, - struct msqid_kernel *msqkptr, struct label *msqklabel, int cmd) +biba_sysvmsq_check_msqctl(struct ucred *cred, struct msqid_kernel *msqkptr, + struct label *msqklabel, int cmd) { struct mac_biba *subj, *obj; - if (!mac_biba_enabled) + if (!biba_enabled) return (0); subj = SLOT(cred->cr_label); @@ -1720,12 +1712,12 @@ mac_biba_sysvmsq_check_msqctl(struct ucred *cred, switch(cmd) { case IPC_RMID: case IPC_SET: - if (!mac_biba_dominate_effective(subj, obj)) + if (!biba_dominate_effective(subj, obj)) return (EACCES); break; case IPC_STAT: - if (!mac_biba_dominate_effective(obj, subj)) + if (!biba_dominate_effective(obj, subj)) return (EACCES); break; @@ -1737,12 +1729,12 @@ mac_biba_sysvmsq_check_msqctl(struct ucred *cred, } static int -mac_biba_sysvsem_check_semctl(struct ucred *cred, - struct semid_kernel *semakptr, struct label *semaklabel, int cmd) +biba_sysvsem_check_semctl(struct ucred *cred, struct semid_kernel *semakptr, + struct label *semaklabel, int cmd) { struct mac_biba *subj, *obj; - if (!mac_biba_enabled) + if (!biba_enabled) return (0); subj = SLOT(cred->cr_label); @@ -1753,7 +1745,7 @@ mac_biba_sysvsem_check_semctl(struct ucred *cred, case IPC_SET: case SETVAL: case SETALL: - if (!mac_biba_dominate_effective(subj, obj)) + if (!biba_dominate_effective(subj, obj)) return (EACCES); break; @@ -1763,7 +1755,7 @@ mac_biba_sysvsem_check_semctl(struct ucred *cred, case GETNCNT: case GETZCNT: case GETALL: - if (!mac_biba_dominate_effective(obj, subj)) + if (!biba_dominate_effective(obj, subj)) return (EACCES); break; @@ -1775,64 +1767,62 @@ mac_biba_sysvsem_check_semctl(struct ucred *cred, } static int -mac_biba_sysvsem_check_semget(struct ucred *cred, - struct semid_kernel *semakptr, struct label *semaklabel) +biba_sysvsem_check_semget(struct ucred *cred, struct semid_kernel *semakptr, + struct label *semaklabel) { struct mac_biba *subj, *obj; - if (!mac_biba_enabled) + if (!biba_enabled) return (0); subj = SLOT(cred->cr_label); obj = SLOT(semaklabel); - if (!mac_biba_dominate_effective(obj, subj)) + if (!biba_dominate_effective(obj, subj)) return (EACCES); return (0); } - static int -mac_biba_sysvsem_check_semop(struct ucred *cred, - struct semid_kernel *semakptr, struct label *semaklabel, - size_t accesstype) +biba_sysvsem_check_semop(struct ucred *cred, struct semid_kernel *semakptr, + struct label *semaklabel, size_t accesstype) { struct mac_biba *subj, *obj; - if (!mac_biba_enabled) + if (!biba_enabled) return (0); subj = SLOT(cred->cr_label); obj = SLOT(semaklabel); if (accesstype & SEM_R) - if (!mac_biba_dominate_effective(obj, subj)) + if (!biba_dominate_effective(obj, subj)) return (EACCES); if (accesstype & SEM_A) - if (!mac_biba_dominate_effective(subj, obj)) + if (!biba_dominate_effective(subj, obj)) return (EACCES); return (0); } static int -mac_biba_sysvshm_check_shmat(struct ucred *cred, - struct shmid_kernel *shmsegptr, struct label *shmseglabel, int shmflg) +biba_sysvshm_check_shmat(struct ucred *cred, struct shmid_kernel *shmsegptr, + struct label *shmseglabel, int shmflg) { struct mac_biba *subj, *obj; - if (!mac_biba_enabled) + if (!biba_enabled) return (0); subj = SLOT(cred->cr_label); obj = SLOT(shmseglabel); - if (!mac_biba_dominate_effective(obj, subj)) + if (!biba_dominate_effective(obj, subj)) return (EACCES); if ((shmflg & SHM_RDONLY) == 0) { - if (!mac_biba_dominate_effective(subj, obj)) + if (!biba_dominate_effective(subj, obj)) return (EACCES); } @@ -1840,12 +1830,12 @@ mac_biba_sysvshm_check_shmat(struct ucred *cred, } static int -mac_biba_sysvshm_check_shmctl(struct ucred *cred, - struct shmid_kernel *shmsegptr, struct label *shmseglabel, int cmd) +biba_sysvshm_check_shmctl(struct ucred *cred, struct shmid_kernel *shmsegptr, + struct label *shmseglabel, int cmd) { struct mac_biba *subj, *obj; - if (!mac_biba_enabled) + if (!biba_enabled) return (0); subj = SLOT(cred->cr_label); @@ -1854,13 +1844,13 @@ mac_biba_sysvshm_check_shmctl(struct ucred *cred, switch(cmd) { case IPC_RMID: case IPC_SET: - if (!mac_biba_dominate_effective(subj, obj)) + if (!biba_dominate_effective(subj, obj)) return (EACCES); break; case IPC_STAT: case SHM_STAT: - if (!mac_biba_dominate_effective(obj, subj)) + if (!biba_dominate_effective(obj, subj)) return (EACCES); break; @@ -1872,70 +1862,70 @@ mac_biba_sysvshm_check_shmctl(struct ucred *cred, } static int -mac_biba_sysvshm_check_shmget(struct ucred *cred, - struct shmid_kernel *shmsegptr, struct label *shmseglabel, int shmflg) +biba_sysvshm_check_shmget(struct ucred *cred, struct shmid_kernel *shmsegptr, + struct label *shmseglabel, int shmflg) { struct mac_biba *subj, *obj; - if (!mac_biba_enabled) + if (!biba_enabled) return (0); subj = SLOT(cred->cr_label); obj = SLOT(shmseglabel); - if (!mac_biba_dominate_effective(obj, subj)) + if (!biba_dominate_effective(obj, subj)) return (EACCES); return (0); } static int -mac_biba_kld_check_load(struct ucred *cred, struct vnode *vp, +biba_kld_check_load(struct ucred *cred, struct vnode *vp, struct label *vplabel) { struct mac_biba *subj, *obj; int error; - if (!mac_biba_enabled) + if (!biba_enabled) return (0); subj = SLOT(cred->cr_label); - error = mac_biba_subject_privileged(subj); + error = biba_subject_privileged(subj); if (error) return (error); obj = SLOT(vplabel); - if (!mac_biba_high_effective(obj)) + if (!biba_high_effective(obj)) return (EACCES); return (0); } static int -mac_biba_mount_check_stat(struct ucred *cred, struct mount *mp, +biba_mount_check_stat(struct ucred *cred, struct mount *mp, struct label *mplabel) { struct mac_biba *subj, *obj; - if (!mac_biba_enabled) + if (!biba_enabled) return (0); subj = SLOT(cred->cr_label); obj = SLOT(mplabel); - if (!mac_biba_dominate_effective(obj, subj)) + if (!biba_dominate_effective(obj, subj)) return (EACCES); return (0); } static int -mac_biba_pipe_check_ioctl(struct ucred *cred, struct pipepair *pp, +biba_pipe_check_ioctl(struct ucred *cred, struct pipepair *pp, struct label *pplabel, unsigned long cmd, void /* caddr_t */ *data) { - if(!mac_biba_enabled) + if(!biba_enabled) return (0); /* XXX: This will be implemented soon... */ @@ -1944,43 +1934,43 @@ mac_biba_pipe_check_ioctl(struct ucred *cred, struct pipepair *pp, } static int -mac_biba_pipe_check_poll(struct ucred *cred, struct pipepair *pp, +biba_pipe_check_poll(struct ucred *cred, struct pipepair *pp, struct label *pplabel) { struct mac_biba *subj, *obj; - if (!mac_biba_enabled) + if (!biba_enabled) return (0); subj = SLOT(cred->cr_label); obj = SLOT(pplabel); - if (!mac_biba_dominate_effective(obj, subj)) + if (!biba_dominate_effective(obj, subj)) return (EACCES); return (0); } static int -mac_biba_pipe_check_read(struct ucred *cred, struct pipepair *pp, +biba_pipe_check_read(struct ucred *cred, struct pipepair *pp, struct label *pplabel) { struct mac_biba *subj, *obj; - if (!mac_biba_enabled) + if (!biba_enabled) return (0); subj = SLOT(cred->cr_label); obj = SLOT(pplabel); - if (!mac_biba_dominate_effective(obj, subj)) + if (!biba_dominate_effective(obj, subj)) return (EACCES); return (0); } static int -mac_biba_pipe_check_relabel(struct ucred *cred, struct pipepair *pp, +biba_pipe_check_relabel(struct ucred *cred, struct pipepair *pp, struct label *pplabel, struct label *newlabel) { struct mac_biba *subj, *obj, *new; @@ -1991,8 +1981,8 @@ mac_biba_pipe_check_relabel(struct ucred *cred, struct pipepair *pp, obj = SLOT(pplabel); /* - * If there is a Biba label update for a pipe, it must be a - * effective update. + * If there is a Biba label update for a pipe, it must be a effective + * update. */ error = biba_atmostflags(new, MAC_BIBA_FLAG_EFFECTIVE); if (error) @@ -2002,7 +1992,7 @@ mac_biba_pipe_check_relabel(struct ucred *cred, struct pipepair *pp, * To perform a relabel of a pipe (Biba label or not), Biba must * authorize the relabel. */ - if (!mac_biba_effective_in_range(obj, subj)) + if (!biba_effective_in_range(obj, subj)) return (EPERM); /* @@ -2013,15 +2003,15 @@ mac_biba_pipe_check_relabel(struct ucred *cred, struct pipepair *pp, * To change the Biba label on a pipe, the new pipe label * must be in the subject range. */ - if (!mac_biba_effective_in_range(new, subj)) + if (!biba_effective_in_range(new, subj)) return (EPERM); /* * To change the Biba label on a pipe to be EQUAL, the * subject must have appropriate privilege. */ - if (mac_biba_contains_equal(new)) { - error = mac_biba_subject_privileged(subj); + if (biba_contains_equal(new)) { + error = biba_subject_privileged(subj); if (error) return (error); } @@ -2031,154 +2021,154 @@ mac_biba_pipe_check_relabel(struct ucred *cred, struct pipepair *pp, } static int -mac_biba_pipe_check_stat(struct ucred *cred, struct pipepair *pp, +biba_pipe_check_stat(struct ucred *cred, struct pipepair *pp, struct label *pplabel) { struct mac_biba *subj, *obj; - if (!mac_biba_enabled) + if (!biba_enabled) return (0); subj = SLOT(cred->cr_label); obj = SLOT(pplabel); - if (!mac_biba_dominate_effective(obj, subj)) + if (!biba_dominate_effective(obj, subj)) return (EACCES); return (0); } static int -mac_biba_pipe_check_write(struct ucred *cred, struct pipepair *pp, +biba_pipe_check_write(struct ucred *cred, struct pipepair *pp, struct label *pplabel) { struct mac_biba *subj, *obj; - if (!mac_biba_enabled) + if (!biba_enabled) return (0); subj = SLOT(cred->cr_label); obj = SLOT(pplabel); - if (!mac_biba_dominate_effective(subj, obj)) + if (!biba_dominate_effective(subj, obj)) return (EACCES); return (0); } static int -mac_biba_posixsem_check_write(struct ucred *cred, struct ksem *ks, +biba_posixsem_check_write(struct ucred *cred, struct ksem *ks, struct label *kslabel) { struct mac_biba *subj, *obj; - if (!mac_biba_enabled) + if (!biba_enabled) return (0); subj = SLOT(cred->cr_label); obj = SLOT(kslabel); - if (!mac_biba_dominate_effective(subj, obj)) + if (!biba_dominate_effective(subj, obj)) return (EACCES); return (0); } static int -mac_biba_posixsem_check_rdonly(struct ucred *cred, struct ksem *ks, +biba_posixsem_check_rdonly(struct ucred *cred, struct ksem *ks, struct label *kslabel) { struct mac_biba *subj, *obj; - if (!mac_biba_enabled) + if (!biba_enabled) return (0); subj = SLOT(cred->cr_label); obj = SLOT(kslabel); - if (!mac_biba_dominate_effective(obj, subj)) + if (!biba_dominate_effective(obj, subj)) return (EACCES); return (0); } static int -mac_biba_proc_check_debug(struct ucred *cred, struct proc *p) +biba_proc_check_debug(struct ucred *cred, struct proc *p) { struct mac_biba *subj, *obj; - if (!mac_biba_enabled) + if (!biba_enabled) return (0); subj = SLOT(cred->cr_label); obj = SLOT(p->p_ucred->cr_label); /* XXX: range checks */ - if (!mac_biba_dominate_effective(obj, subj)) + if (!biba_dominate_effective(obj, subj)) return (ESRCH); - if (!mac_biba_dominate_effective(subj, obj)) + if (!biba_dominate_effective(subj, obj)) return (EACCES); return (0); } static int -mac_biba_proc_check_sched(struct ucred *cred, struct proc *p) +biba_proc_check_sched(struct ucred *cred, struct proc *p) { struct mac_biba *subj, *obj; - if (!mac_biba_enabled) + if (!biba_enabled) return (0); subj = SLOT(cred->cr_label); obj = SLOT(p->p_ucred->cr_label); /* XXX: range checks */ - if (!mac_biba_dominate_effective(obj, subj)) + if (!biba_dominate_effective(obj, subj)) return (ESRCH); - if (!mac_biba_dominate_effective(subj, obj)) + if (!biba_dominate_effective(subj, obj)) return (EACCES); return (0); } static int -mac_biba_proc_check_signal(struct ucred *cred, struct proc *p, int signum) +biba_proc_check_signal(struct ucred *cred, struct proc *p, int signum) { struct mac_biba *subj, *obj; - if (!mac_biba_enabled) + if (!biba_enabled) return (0); subj = SLOT(cred->cr_label); obj = SLOT(p->p_ucred->cr_label); /* XXX: range checks */ - if (!mac_biba_dominate_effective(obj, subj)) + if (!biba_dominate_effective(obj, subj)) return (ESRCH); - if (!mac_biba_dominate_effective(subj, obj)) + if (!biba_dominate_effective(subj, obj)) return (EACCES); return (0); } static int -mac_biba_socket_check_deliver(struct socket *so, struct label *solabel, +biba_socket_check_deliver(struct socket *so, struct label *solabel, struct mbuf *m, struct label *mlabel) { struct mac_biba *p, *s; - if (!mac_biba_enabled) + if (!biba_enabled) return (0); p = SLOT(mlabel); s = SLOT(solabel); - return (mac_biba_equal_effective(p, s) ? 0 : EACCES); + return (biba_equal_effective(p, s) ? 0 : EACCES); } static int -mac_biba_socket_check_relabel(struct ucred *cred, struct socket *so, +biba_socket_check_relabel(struct ucred *cred, struct socket *so, struct label *solabel, struct label *newlabel) { struct mac_biba *subj, *obj, *new; @@ -2189,18 +2179,18 @@ mac_biba_socket_check_relabel(struct ucred *cred, struct socket *so, obj = SLOT(solabel); /* - * If there is a Biba label update for the socket, it may be - * an update of effective. + * If there is a Biba label update for the socket, it may be an + * update of effective. */ error = biba_atmostflags(new, MAC_BIBA_FLAG_EFFECTIVE); if (error) return (error); /* - * To relabel a socket, the old socket effective must be in the subject - * range. + * To relabel a socket, the old socket effective must be in the + * subject range. */ - if (!mac_biba_effective_in_range(obj, subj)) + if (!biba_effective_in_range(obj, subj)) return (EPERM); /* @@ -2211,15 +2201,15 @@ mac_biba_socket_check_relabel(struct ucred *cred, struct socket *so, * To relabel a socket, the new socket effective must be in * the subject range. */ - if (!mac_biba_effective_in_range(new, subj)) + if (!biba_effective_in_range(new, subj)) return (EPERM); /* * To change the Biba label on the socket to contain EQUAL, * the subject must have appropriate privilege. */ - if (mac_biba_contains_equal(new)) { - error = mac_biba_subject_privileged(subj); + if (biba_contains_equal(new)) { + error = biba_subject_privileged(subj); if (error) return (error); } @@ -2229,18 +2219,18 @@ mac_biba_socket_check_relabel(struct ucred *cred, struct socket *so, } static int -mac_biba_socket_check_visible(struct ucred *cred, struct socket *so, +biba_socket_check_visible(struct ucred *cred, struct socket *so, struct label *solabel) { struct mac_biba *subj, *obj; - if (!mac_biba_enabled) + if (!biba_enabled) return (0); subj = SLOT(cred->cr_label); obj = SLOT(solabel); - if (!mac_biba_dominate_effective(obj, subj)) + if (!biba_dominate_effective(obj, subj)) return (ENOENT); return (0); @@ -2252,12 +2242,12 @@ mac_biba_socket_check_visible(struct ucred *cred, struct socket *so, * policy as they might otherwise allow bypassing of the integrity policy. */ static int -mac_biba_priv_check(struct ucred *cred, int priv) +biba_priv_check(struct ucred *cred, int priv) { struct mac_biba *subj; int error; - if (!mac_biba_enabled) + if (!biba_enabled) return (0); /* @@ -2428,7 +2418,7 @@ mac_biba_priv_check(struct ucred *cred, int priv) */ default: subj = SLOT(cred->cr_label); - error = mac_biba_subject_privileged(subj); + error = biba_subject_privileged(subj); if (error) return (error); } @@ -2436,18 +2426,18 @@ mac_biba_priv_check(struct ucred *cred, int priv) } static int -mac_biba_system_check_acct(struct ucred *cred, struct vnode *vp, +biba_system_check_acct(struct ucred *cred, struct vnode *vp, struct label *vplabel) { struct mac_biba *subj, *obj; int error; - if (!mac_biba_enabled) + if (!biba_enabled) return (0); subj = SLOT(cred->cr_label); - error = mac_biba_subject_privileged(subj); + error = biba_subject_privileged(subj); if (error) return (error); @@ -2455,25 +2445,25 @@ mac_biba_system_check_acct(struct ucred *cred, struct vnode *vp, return (0); obj = SLOT(vplabel); - if (!mac_biba_high_effective(obj)) + if (!biba_high_effective(obj)) return (EACCES); return (0); } static int -mac_biba_system_check_auditctl(struct ucred *cred, struct vnode *vp, +biba_system_check_auditctl(struct ucred *cred, struct vnode *vp, struct label *vplabel) { struct mac_biba *subj, *obj; int error; - if (!mac_biba_enabled) + if (!biba_enabled) return (0); subj = SLOT(cred->cr_label); - error = mac_biba_subject_privileged(subj); + error = biba_subject_privileged(subj); if (error) return (error); @@ -2481,24 +2471,24 @@ mac_biba_system_check_auditctl(struct ucred *cred, struct vnode *vp, return (0); obj = SLOT(vplabel); - if (!mac_biba_high_effective(obj)) + if (!biba_high_effective(obj)) return (EACCES); return (0); } static int -mac_biba_system_check_auditon(struct ucred *cred, int cmd) +biba_system_check_auditon(struct ucred *cred, int cmd) { struct mac_biba *subj; int error; - if (!mac_biba_enabled) + if (!biba_enabled) return (0); subj = SLOT(cred->cr_label); - error = mac_biba_subject_privileged(subj); + error = biba_subject_privileged(subj); if (error) return (error); @@ -2506,41 +2496,41 @@ mac_biba_system_check_auditon(struct ucred *cred, int cmd) } static int -mac_biba_system_check_swapon(struct ucred *cred, struct vnode *vp, +biba_system_check_swapon(struct ucred *cred, struct vnode *vp, struct label *vplabel) { struct mac_biba *subj, *obj; int error; - if (!mac_biba_enabled) + if (!biba_enabled) return (0); subj = SLOT(cred->cr_label); obj = SLOT(vplabel); - error = mac_biba_subject_privileged(subj); + error = biba_subject_privileged(subj); if (error) return (error); - if (!mac_biba_high_effective(obj)) + if (!biba_high_effective(obj)) return (EACCES); return (0); } static int -mac_biba_system_check_swapoff(struct ucred *cred, struct vnode *vp, +biba_system_check_swapoff(struct ucred *cred, struct vnode *vp, struct label *label) { struct mac_biba *subj; int error; - if (!mac_biba_enabled) + if (!biba_enabled) return (0); subj = SLOT(cred->cr_label); - error = mac_biba_subject_privileged(subj); + error = biba_subject_privileged(subj); if (error) return (error); @@ -2548,26 +2538,26 @@ mac_biba_system_check_swapoff(struct ucred *cred, struct vnode *vp, } static int -mac_biba_system_check_sysctl(struct ucred *cred, struct sysctl_oid *oidp, +biba_system_check_sysctl(struct ucred *cred, struct sysctl_oid *oidp, void *arg1, int arg2, struct sysctl_req *req) { struct mac_biba *subj; int error; - if (!mac_biba_enabled) + if (!biba_enabled) return (0); subj = SLOT(cred->cr_label); /* - * Treat sysctl variables without CTLFLAG_ANYBODY flag as - * biba/high, but also require privilege to change them. + * Treat sysctl variables without CTLFLAG_ANYBODY flag as biba/high, + * but also require privilege to change them. */ if (req->newptr != NULL && (oidp->oid_kind & CTLFLAG_ANYBODY) == 0) { - if (!mac_biba_subject_dominate_high(subj)) + if (!biba_subject_dominate_high(subj)) return (EACCES); - error = mac_biba_subject_privileged(subj); + error = biba_subject_privileged(subj); if (error) return (error); } @@ -2576,97 +2566,97 @@ mac_biba_system_check_sysctl(struct ucred *cred, struct sysctl_oid *oidp, } static int -mac_biba_vnode_check_chdir(struct ucred *cred, struct vnode *dvp, +biba_vnode_check_chdir(struct ucred *cred, struct vnode *dvp, struct label *dvplabel) { struct mac_biba *subj, *obj; - if (!mac_biba_enabled) + if (!biba_enabled) return (0); subj = SLOT(cred->cr_label); obj = SLOT(dvplabel); - if (!mac_biba_dominate_effective(obj, subj)) + if (!biba_dominate_effective(obj, subj)) return (EACCES); return (0); } static int -mac_biba_vnode_check_chroot(struct ucred *cred, struct vnode *dvp, +biba_vnode_check_chroot(struct ucred *cred, struct vnode *dvp, struct label *dvplabel) { struct mac_biba *subj, *obj; - if (!mac_biba_enabled) + if (!biba_enabled) return (0); subj = SLOT(cred->cr_label); obj = SLOT(dvplabel); - if (!mac_biba_dominate_effective(obj, subj)) + if (!biba_dominate_effective(obj, subj)) return (EACCES); return (0); } static int -mac_biba_vnode_check_create(struct ucred *cred, struct vnode *dvp, +biba_vnode_check_create(struct ucred *cred, struct vnode *dvp, struct label *dvplabel, struct componentname *cnp, struct vattr *vap) { struct mac_biba *subj, *obj; - if (!mac_biba_enabled) + if (!biba_enabled) return (0); subj = SLOT(cred->cr_label); obj = SLOT(dvplabel); - if (!mac_biba_dominate_effective(subj, obj)) + if (!biba_dominate_effective(subj, obj)) return (EACCES); return (0); } static int -mac_biba_vnode_check_deleteacl(struct ucred *cred, struct vnode *vp, +biba_vnode_check_deleteacl(struct ucred *cred, struct vnode *vp, struct label *vplabel, acl_type_t type) { struct mac_biba *subj, *obj; - if (!mac_biba_enabled) + if (!biba_enabled) return (0); subj = SLOT(cred->cr_label); obj = SLOT(vplabel); - if (!mac_biba_dominate_effective(subj, obj)) + if (!biba_dominate_effective(subj, obj)) return (EACCES); return (0); } static int -mac_biba_vnode_check_deleteextattr(struct ucred *cred, struct vnode *vp, +biba_vnode_check_deleteextattr(struct ucred *cred, struct vnode *vp, struct label *vplabel, int attrnamespace, const char *name) { struct mac_biba *subj, *obj; - if (!mac_biba_enabled) + if (!biba_enabled) return (0); subj = SLOT(cred->cr_label); obj = SLOT(vplabel); - if (!mac_biba_dominate_effective(subj, obj)) + if (!biba_dominate_effective(subj, obj)) return (EACCES); return (0); } static int -mac_biba_vnode_check_exec(struct ucred *cred, struct vnode *vp, +biba_vnode_check_exec(struct ucred *cred, struct vnode *vp, struct label *vplabel, struct image_params *imgp, struct label *execlabel) { @@ -2676,8 +2666,8 @@ mac_biba_vnode_check_exec(struct ucred *cred, struct vnode *vp, if (execlabel != NULL) { /* * We currently don't permit labels to be changed at - * exec-time as part of Biba, so disallow non-NULL - * Biba label elements in the execlabel. + * exec-time as part of Biba, so disallow non-NULL Biba label + * elements in the execlabel. */ exec = SLOT(execlabel); error = biba_atmostflags(exec, 0); @@ -2685,117 +2675,117 @@ mac_biba_vnode_check_exec(struct ucred *cred, struct vnode *vp, return (error); } - if (!mac_biba_enabled) + if (!biba_enabled) return (0); subj = SLOT(cred->cr_label); obj = SLOT(vplabel); - if (!mac_biba_dominate_effective(obj, subj)) + if (!biba_dominate_effective(obj, subj)) return (EACCES); return (0); } static int -mac_biba_vnode_check_getacl(struct ucred *cred, struct vnode *vp, +biba_vnode_check_getacl(struct ucred *cred, struct vnode *vp, struct label *vplabel, acl_type_t type) { struct mac_biba *subj, *obj; - if (!mac_biba_enabled) + if (!biba_enabled) return (0); subj = SLOT(cred->cr_label); obj = SLOT(vplabel); - if (!mac_biba_dominate_effective(obj, subj)) + if (!biba_dominate_effective(obj, subj)) return (EACCES); return (0); } static int -mac_biba_vnode_check_getextattr(struct ucred *cred, struct vnode *vp, +biba_vnode_check_getextattr(struct ucred *cred, struct vnode *vp, struct label *vplabel, int attrnamespace, const char *name, struct uio *uio) { struct mac_biba *subj, *obj; - if (!mac_biba_enabled) + if (!biba_enabled) return (0); subj = SLOT(cred->cr_label); obj = SLOT(vplabel); - if (!mac_biba_dominate_effective(obj, subj)) + if (!biba_dominate_effective(obj, subj)) return (EACCES); return (0); } static int -mac_biba_vnode_check_link(struct ucred *cred, struct vnode *dvp, +biba_vnode_check_link(struct ucred *cred, struct vnode *dvp, struct label *dvplabel, struct vnode *vp, struct label *vplabel, struct componentname *cnp) { struct mac_biba *subj, *obj; - if (!mac_biba_enabled) + if (!biba_enabled) return (0); subj = SLOT(cred->cr_label); obj = SLOT(dvplabel); - if (!mac_biba_dominate_effective(subj, obj)) + if (!biba_dominate_effective(subj, obj)) return (EACCES); obj = SLOT(vplabel); - if (!mac_biba_dominate_effective(subj, obj)) + if (!biba_dominate_effective(subj, obj)) return (EACCES); return (0); } static int -mac_biba_vnode_check_listextattr(struct ucred *cred, struct vnode *vp, +biba_vnode_check_listextattr(struct ucred *cred, struct vnode *vp, struct label *vplabel, int attrnamespace) { struct mac_biba *subj, *obj; - if (!mac_biba_enabled) + if (!biba_enabled) return (0); subj = SLOT(cred->cr_label); obj = SLOT(vplabel); - if (!mac_biba_dominate_effective(obj, subj)) + if (!biba_dominate_effective(obj, subj)) return (EACCES); return (0); } static int -mac_biba_vnode_check_lookup(struct ucred *cred, struct vnode *dvp, +biba_vnode_check_lookup(struct ucred *cred, struct vnode *dvp, struct label *dvplabel, struct componentname *cnp) { struct mac_biba *subj, *obj; - if (!mac_biba_enabled) + if (!biba_enabled) return (0); subj = SLOT(cred->cr_label); obj = SLOT(dvplabel); - if (!mac_biba_dominate_effective(obj, subj)) + if (!biba_dominate_effective(obj, subj)) return (EACCES); return (0); } static int -mac_biba_vnode_check_mmap(struct ucred *cred, struct vnode *vp, +biba_vnode_check_mmap(struct ucred *cred, struct vnode *vp, struct label *vplabel, int prot, int flags) { struct mac_biba *subj, *obj; @@ -2804,18 +2794,18 @@ mac_biba_vnode_check_mmap(struct ucred *cred, struct vnode *vp, * Rely on the use of open()-time protections to handle * non-revocation cases. */ - if (!mac_biba_enabled || !revocation_enabled) + if (!biba_enabled || !revocation_enabled) return (0); subj = SLOT(cred->cr_label); obj = SLOT(vplabel); if (prot & (VM_PROT_READ | VM_PROT_EXECUTE)) { - if (!mac_biba_dominate_effective(obj, subj)) + if (!biba_dominate_effective(obj, subj)) return (EACCES); } if (((prot & VM_PROT_WRITE) != 0) && ((flags & MAP_SHARED) != 0)) { - if (!mac_biba_dominate_effective(subj, obj)) + if (!biba_dominate_effective(subj, obj)) return (EACCES); } @@ -2823,12 +2813,12 @@ mac_biba_vnode_check_mmap(struct ucred *cred, struct vnode *vp, } static int -mac_biba_vnode_check_open(struct ucred *cred, struct vnode *vp, +biba_vnode_check_open(struct ucred *cred, struct vnode *vp, struct label *vplabel, int acc_mode) { struct mac_biba *subj, *obj; - if (!mac_biba_enabled) + if (!biba_enabled) return (0); subj = SLOT(cred->cr_label); @@ -2836,11 +2826,11 @@ mac_biba_vnode_check_open(struct ucred *cred, struct vnode *vp, /* XXX privilege override for admin? */ if (acc_mode & (VREAD | VEXEC | VSTAT)) { - if (!mac_biba_dominate_effective(obj, subj)) + if (!biba_dominate_effective(obj, subj)) return (EACCES); } if (acc_mode & (VWRITE | VAPPEND | VADMIN)) { - if (!mac_biba_dominate_effective(subj, obj)) + if (!biba_dominate_effective(subj, obj)) return (EACCES); } @@ -2848,79 +2838,79 @@ mac_biba_vnode_check_open(struct ucred *cred, struct vnode *vp, } static int -mac_biba_vnode_check_poll(struct ucred *active_cred, struct ucred *file_cred, +biba_vnode_check_poll(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp, struct label *vplabel) { struct mac_biba *subj, *obj; - if (!mac_biba_enabled || !revocation_enabled) + if (!biba_enabled || !revocation_enabled) return (0); subj = SLOT(active_cred->cr_label); obj = SLOT(vplabel); - if (!mac_biba_dominate_effective(obj, subj)) + if (!biba_dominate_effective(obj, subj)) return (EACCES); return (0); } static int -mac_biba_vnode_check_read(struct ucred *active_cred, struct ucred *file_cred, +biba_vnode_check_read(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp, struct label *vplabel) { struct mac_biba *subj, *obj; - if (!mac_biba_enabled || !revocation_enabled) + if (!biba_enabled || !revocation_enabled) return (0); subj = SLOT(active_cred->cr_label); obj = SLOT(vplabel); - if (!mac_biba_dominate_effective(obj, subj)) + if (!biba_dominate_effective(obj, subj)) return (EACCES); return (0); } static int -mac_biba_vnode_check_readdir(struct ucred *cred, struct vnode *dvp, +biba_vnode_check_readdir(struct ucred *cred, struct vnode *dvp, struct label *dvplabel) { struct mac_biba *subj, *obj; - if (!mac_biba_enabled) + if (!biba_enabled) return (0); subj = SLOT(cred->cr_label); obj = SLOT(dvplabel); - if (!mac_biba_dominate_effective(obj, subj)) + if (!biba_dominate_effective(obj, subj)) return (EACCES); return (0); } static int -mac_biba_vnode_check_readlink(struct ucred *cred, struct vnode *vp, +biba_vnode_check_readlink(struct ucred *cred, struct vnode *vp, struct label *vplabel) { struct mac_biba *subj, *obj; - if (!mac_biba_enabled) + if (!biba_enabled) return (0); subj = SLOT(cred->cr_label); obj = SLOT(vplabel); - if (!mac_biba_dominate_effective(obj, subj)) + if (!biba_dominate_effective(obj, subj)) return (EACCES); return (0); } static int -mac_biba_vnode_check_relabel(struct ucred *cred, struct vnode *vp, +biba_vnode_check_relabel(struct ucred *cred, struct vnode *vp, struct label *vplabel, struct label *newlabel) { struct mac_biba *old, *new, *subj; @@ -2942,7 +2932,7 @@ mac_biba_vnode_check_relabel(struct ucred *cred, struct vnode *vp, * To perform a relabel of the vnode (Biba label or not), Biba must * authorize the relabel. */ - if (!mac_biba_effective_in_range(old, subj)) + if (!biba_effective_in_range(old, subj)) return (EPERM); /* @@ -2953,15 +2943,15 @@ mac_biba_vnode_check_relabel(struct ucred *cred, struct vnode *vp, * To change the Biba label on a vnode, the new vnode label * must be in the subject range. */ - if (!mac_biba_effective_in_range(new, subj)) + if (!biba_effective_in_range(new, subj)) return (EPERM); /* - * To change the Biba label on the vnode to be EQUAL, - * the subject must have appropriate privilege. + * To change the Biba label on the vnode to be EQUAL, the + * subject must have appropriate privilege. */ - if (mac_biba_contains_equal(new)) { - error = mac_biba_subject_privileged(subj); + if (biba_contains_equal(new)) { + error = biba_subject_privileged(subj); if (error) return (error); } @@ -2971,49 +2961,49 @@ mac_biba_vnode_check_relabel(struct ucred *cred, struct vnode *vp, } static int -mac_biba_vnode_check_rename_from(struct ucred *cred, struct vnode *dvp, +biba_vnode_check_rename_from(struct ucred *cred, struct vnode *dvp, struct label *dvplabel, struct vnode *vp, struct label *vplabel, struct componentname *cnp) { struct mac_biba *subj, *obj; - if (!mac_biba_enabled) + if (!biba_enabled) return (0); subj = SLOT(cred->cr_label); obj = SLOT(dvplabel); - if (!mac_biba_dominate_effective(subj, obj)) + if (!biba_dominate_effective(subj, obj)) return (EACCES); obj = SLOT(vplabel); - if (!mac_biba_dominate_effective(subj, obj)) + if (!biba_dominate_effective(subj, obj)) return (EACCES); return (0); } static int -mac_biba_vnode_check_rename_to(struct ucred *cred, struct vnode *dvp, +biba_vnode_check_rename_to(struct ucred *cred, struct vnode *dvp, struct label *dvplabel, struct vnode *vp, struct label *vplabel, int samedir, struct componentname *cnp) { struct mac_biba *subj, *obj; - if (!mac_biba_enabled) + if (!biba_enabled) return (0); subj = SLOT(cred->cr_label); obj = SLOT(dvplabel); - if (!mac_biba_dominate_effective(subj, obj)) + if (!biba_dominate_effective(subj, obj)) return (EACCES); if (vp != NULL) { obj = SLOT(vplabel); - if (!mac_biba_dominate_effective(subj, obj)) + if (!biba_dominate_effective(subj, obj)) return (EACCES); } @@ -3021,55 +3011,55 @@ mac_biba_vnode_check_rename_to(struct ucred *cred, struct vnode *dvp, } static int -mac_biba_vnode_check_revoke(struct ucred *cred, struct vnode *vp, +biba_vnode_check_revoke(struct ucred *cred, struct vnode *vp, struct label *vplabel) { struct mac_biba *subj, *obj; - if (!mac_biba_enabled) + if (!biba_enabled) return (0); subj = SLOT(cred->cr_label); obj = SLOT(vplabel); - if (!mac_biba_dominate_effective(subj, obj)) + if (!biba_dominate_effective(subj, obj)) return (EACCES); return (0); } static int -mac_biba_vnode_check_setacl(struct ucred *cred, struct vnode *vp, +biba_vnode_check_setacl(struct ucred *cred, struct vnode *vp, struct label *vplabel, acl_type_t type, struct acl *acl) { struct mac_biba *subj, *obj; - if (!mac_biba_enabled) + if (!biba_enabled) return (0); subj = SLOT(cred->cr_label); obj = SLOT(vplabel); - if (!mac_biba_dominate_effective(subj, obj)) + if (!biba_dominate_effective(subj, obj)) return (EACCES); return (0); } static int -mac_biba_vnode_check_setextattr(struct ucred *cred, struct vnode *vp, +biba_vnode_check_setextattr(struct ucred *cred, struct vnode *vp, struct label *vplabel, int attrnamespace, const char *name, struct uio *uio) { struct mac_biba *subj, *obj; - if (!mac_biba_enabled) + if (!biba_enabled) return (0); subj = SLOT(cred->cr_label); obj = SLOT(vplabel); - if (!mac_biba_dominate_effective(subj, obj)) + if (!biba_dominate_effective(subj, obj)) return (EACCES); /* XXX: protect the MAC EA in a special way? */ @@ -3078,353 +3068,353 @@ mac_biba_vnode_check_setextattr(struct ucred *cred, struct vnode *vp, } static int -mac_biba_vnode_check_setflags(struct ucred *cred, struct vnode *vp, +biba_vnode_check_setflags(struct ucred *cred, struct vnode *vp, struct label *vplabel, u_long flags) { struct mac_biba *subj, *obj; - if (!mac_biba_enabled) + if (!biba_enabled) return (0); subj = SLOT(cred->cr_label); obj = SLOT(vplabel); - if (!mac_biba_dominate_effective(subj, obj)) + if (!biba_dominate_effective(subj, obj)) return (EACCES); return (0); } static int -mac_biba_vnode_check_setmode(struct ucred *cred, struct vnode *vp, +biba_vnode_check_setmode(struct ucred *cred, struct vnode *vp, struct label *vplabel, mode_t mode) { struct mac_biba *subj, *obj; - if (!mac_biba_enabled) + if (!biba_enabled) return (0); subj = SLOT(cred->cr_label); obj = SLOT(vplabel); - if (!mac_biba_dominate_effective(subj, obj)) + if (!biba_dominate_effective(subj, obj)) return (EACCES); return (0); } static int -mac_biba_vnode_check_setowner(struct ucred *cred, struct vnode *vp, +biba_vnode_check_setowner(struct ucred *cred, struct vnode *vp, struct label *vplabel, uid_t uid, gid_t gid) { struct mac_biba *subj, *obj; - if (!mac_biba_enabled) + if (!biba_enabled) return (0); subj = SLOT(cred->cr_label); obj = SLOT(vplabel); - if (!mac_biba_dominate_effective(subj, obj)) + if (!biba_dominate_effective(subj, obj)) return (EACCES); return (0); } static int -mac_biba_vnode_check_setutimes(struct ucred *cred, struct vnode *vp, +biba_vnode_check_setutimes(struct ucred *cred, struct vnode *vp, struct label *vplabel, struct timespec atime, struct timespec mtime) { struct mac_biba *subj, *obj; - if (!mac_biba_enabled) + if (!biba_enabled) return (0); subj = SLOT(cred->cr_label); obj = SLOT(vplabel); - if (!mac_biba_dominate_effective(subj, obj)) + if (!biba_dominate_effective(subj, obj)) return (EACCES); return (0); } static int -mac_biba_vnode_check_stat(struct ucred *active_cred, struct ucred *file_cred, +biba_vnode_check_stat(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp, struct label *vplabel) { struct mac_biba *subj, *obj; - if (!mac_biba_enabled) + if (!biba_enabled) return (0); subj = SLOT(active_cred->cr_label); obj = SLOT(vplabel); - if (!mac_biba_dominate_effective(obj, subj)) + if (!biba_dominate_effective(obj, subj)) return (EACCES); return (0); } static int -mac_biba_vnode_check_unlink(struct ucred *cred, struct vnode *dvp, +biba_vnode_check_unlink(struct ucred *cred, struct vnode *dvp, struct label *dvplabel, struct vnode *vp, struct label *vplabel, struct componentname *cnp) { struct mac_biba *subj, *obj; - if (!mac_biba_enabled) + if (!biba_enabled) return (0); subj = SLOT(cred->cr_label); obj = SLOT(dvplabel); - if (!mac_biba_dominate_effective(subj, obj)) + if (!biba_dominate_effective(subj, obj)) return (EACCES); obj = SLOT(vplabel); - if (!mac_biba_dominate_effective(subj, obj)) + if (!biba_dominate_effective(subj, obj)) return (EACCES); return (0); } static int -mac_biba_vnode_check_write(struct ucred *active_cred, +biba_vnode_check_write(struct ucred *active_cred, struct ucred *file_cred, struct vnode *vp, struct label *vplabel) { struct mac_biba *subj, *obj; - if (!mac_biba_enabled || !revocation_enabled) + if (!biba_enabled || !revocation_enabled) return (0); subj = SLOT(active_cred->cr_label); obj = SLOT(vplabel); - if (!mac_biba_dominate_effective(subj, obj)) + if (!biba_dominate_effective(subj, obj)) return (EACCES); return (0); } static void -mac_biba_associate_nfsd_label(struct ucred *cred) +biba_associate_nfsd_label(struct ucred *cred) { struct mac_biba *label; label = SLOT(cred->cr_label); - mac_biba_set_effective(label, MAC_BIBA_TYPE_LOW, 0, NULL); - mac_biba_set_range(label, MAC_BIBA_TYPE_LOW, 0, NULL, - MAC_BIBA_TYPE_HIGH, 0, NULL); + biba_set_effective(label, MAC_BIBA_TYPE_LOW, 0, NULL); + biba_set_range(label, MAC_BIBA_TYPE_LOW, 0, NULL, MAC_BIBA_TYPE_HIGH, + 0, NULL); } static void -mac_biba_init_syncache_from_inpcb(struct label *label, struct inpcb *inp) +biba_init_syncache_from_inpcb(struct label *label, struct inpcb *inp) { struct mac_biba *source, *dest; source = SLOT(inp->inp_label); dest = SLOT(label); - mac_biba_copy_effective(source, dest); + biba_copy_effective(source, dest); } static void -mac_biba_create_mbuf_from_syncache(struct label *sc_label, struct mbuf *m, +biba_create_mbuf_from_syncache(struct label *sc_label, struct mbuf *m, struct label *mlabel) { struct mac_biba *source, *dest; source = SLOT(sc_label); dest = SLOT(mlabel); - mac_biba_copy_effective(source, dest); + biba_copy_effective(source, dest); } static struct mac_policy_ops mac_biba_ops = { - .mpo_init = mac_biba_init, - .mpo_bpfdesc_init_label = mac_biba_init_label, - .mpo_cred_init_label = mac_biba_init_label, - .mpo_devfs_init_label = mac_biba_init_label, - .mpo_ifnet_init_label = mac_biba_init_label, - .mpo_inpcb_init_label = mac_biba_init_label_waitcheck, - .mpo_init_syncache_label = mac_biba_init_label_waitcheck, - .mpo_sysvmsg_init_label = mac_biba_init_label, - .mpo_sysvmsq_init_label = mac_biba_init_label, - .mpo_sysvsem_init_label = mac_biba_init_label, - .mpo_sysvshm_init_label = mac_biba_init_label, - .mpo_ipq_init_label = mac_biba_init_label_waitcheck, - .mpo_mbuf_init_label = mac_biba_init_label_waitcheck, - .mpo_mount_init_label = mac_biba_init_label, - .mpo_pipe_init_label = mac_biba_init_label, - .mpo_posixsem_init_label = mac_biba_init_label, - .mpo_socket_init_label = mac_biba_init_label_waitcheck, - .mpo_socketpeer_init_label = mac_biba_init_label_waitcheck, - .mpo_init_syncache_from_inpcb = mac_biba_init_syncache_from_inpcb, - .mpo_vnode_init_label = mac_biba_init_label, - .mpo_bpfdesc_destroy_label = mac_biba_destroy_label, - .mpo_cred_destroy_label = mac_biba_destroy_label, - .mpo_devfs_destroy_label = mac_biba_destroy_label, - .mpo_ifnet_destroy_label = mac_biba_destroy_label, - .mpo_inpcb_destroy_label = mac_biba_destroy_label, - .mpo_destroy_syncache_label = mac_biba_destroy_label, - .mpo_sysvmsg_destroy_label = mac_biba_destroy_label, - .mpo_sysvmsq_destroy_label = mac_biba_destroy_label, - .mpo_sysvsem_destroy_label = mac_biba_destroy_label, - .mpo_sysvshm_destroy_label = mac_biba_destroy_label, - .mpo_ipq_destroy_label = mac_biba_destroy_label, - .mpo_mbuf_destroy_label = mac_biba_destroy_label, - .mpo_mount_destroy_label = mac_biba_destroy_label, - .mpo_pipe_destroy_label = mac_biba_destroy_label, - .mpo_posixsem_destroy_label = mac_biba_destroy_label, - .mpo_socket_destroy_label = mac_biba_destroy_label, - .mpo_socketpeer_destroy_label = mac_biba_destroy_label, - .mpo_vnode_destroy_label = mac_biba_destroy_label, - .mpo_cred_copy_label = mac_biba_copy_label, - .mpo_ifnet_copy_label = mac_biba_copy_label, - .mpo_mbuf_copy_label = mac_biba_copy_label, - .mpo_pipe_copy_label = mac_biba_copy_label, - .mpo_socket_copy_label = mac_biba_copy_label, - .mpo_vnode_copy_label = mac_biba_copy_label, - .mpo_cred_externalize_label = mac_biba_externalize_label, - .mpo_ifnet_externalize_label = mac_biba_externalize_label, - .mpo_pipe_externalize_label = mac_biba_externalize_label, - .mpo_socket_externalize_label = mac_biba_externalize_label, - .mpo_socketpeer_externalize_label = mac_biba_externalize_label, - .mpo_vnode_externalize_label = mac_biba_externalize_label, - .mpo_cred_internalize_label = mac_biba_internalize_label, - .mpo_ifnet_internalize_label = mac_biba_internalize_label, - .mpo_pipe_internalize_label = mac_biba_internalize_label, - .mpo_socket_internalize_label = mac_biba_internalize_label, - .mpo_vnode_internalize_label = mac_biba_internalize_label, - .mpo_devfs_create_device = mac_biba_devfs_create_device, - .mpo_devfs_create_directory = mac_biba_devfs_create_directory, - .mpo_devfs_create_symlink = mac_biba_devfs_create_symlink, - .mpo_mount_create = mac_biba_mount_create, - .mpo_vnode_relabel = mac_biba_vnode_relabel, - .mpo_devfs_update = mac_biba_devfs_update, - .mpo_devfs_vnode_associate = mac_biba_devfs_vnode_associate, - .mpo_vnode_associate_extattr = mac_biba_vnode_associate_extattr, - .mpo_vnode_associate_singlelabel = mac_biba_vnode_associate_singlelabel, - .mpo_vnode_create_extattr = mac_biba_vnode_create_extattr, - .mpo_vnode_setlabel_extattr = mac_biba_vnode_setlabel_extattr, - .mpo_socket_create_mbuf = mac_biba_socket_create_mbuf, - .mpo_create_mbuf_from_syncache = mac_biba_create_mbuf_from_syncache, - .mpo_pipe_create = mac_biba_pipe_create, - .mpo_posixsem_create = mac_biba_posixsem_create, - .mpo_socket_create = mac_biba_socket_create, - .mpo_socket_newconn = mac_biba_socket_newconn, - .mpo_pipe_relabel = mac_biba_pipe_relabel, - .mpo_socket_relabel = mac_biba_socket_relabel, - .mpo_socketpeer_set_from_mbuf = mac_biba_socketpeer_set_from_mbuf, - .mpo_socketpeer_set_from_socket = mac_biba_socketpeer_set_from_socket, - .mpo_bpfdesc_create = mac_biba_bpfdesc_create, - .mpo_ipq_reassemble = mac_biba_ipq_reassemble, - .mpo_netinet_fragment = mac_biba_netinet_fragment, - .mpo_ifnet_create = mac_biba_ifnet_create, - .mpo_inpcb_create = mac_biba_inpcb_create, - .mpo_sysvmsg_create = mac_biba_sysvmsg_create, - .mpo_sysvmsq_create = mac_biba_sysvmsq_create, - .mpo_sysvsem_create = mac_biba_sysvsem_create, - .mpo_sysvshm_create = mac_biba_sysvshm_create, - .mpo_ipq_create = mac_biba_ipq_create, - .mpo_inpcb_create_mbuf = mac_biba_inpcb_create_mbuf, - .mpo_create_mbuf_linklayer = mac_biba_create_mbuf_linklayer, - .mpo_bpfdesc_create_mbuf = mac_biba_bpfdesc_create_mbuf, - .mpo_ifnet_create_mbuf = mac_biba_ifnet_create_mbuf, - .mpo_mbuf_create_multicast_encap = mac_biba_mbuf_create_multicast_encap, - .mpo_mbuf_create_netlayer = mac_biba_mbuf_create_netlayer, - .mpo_ipq_match = mac_biba_ipq_match, - .mpo_ifnet_relabel = mac_biba_ifnet_relabel, - .mpo_ipq_update = mac_biba_ipq_update, - .mpo_inpcb_sosetlabel = mac_biba_inpcb_sosetlabel, - .mpo_proc_create_swapper = mac_biba_proc_create_swapper, - .mpo_proc_create_init = mac_biba_proc_create_init, - .mpo_cred_relabel = mac_biba_cred_relabel, - .mpo_sysvmsg_cleanup = mac_biba_sysvmsg_cleanup, - .mpo_sysvmsq_cleanup = mac_biba_sysvmsq_cleanup, - .mpo_sysvsem_cleanup = mac_biba_sysvsem_cleanup, - .mpo_sysvshm_cleanup = mac_biba_sysvshm_cleanup, - .mpo_bpfdesc_check_receive = mac_biba_bpfdesc_check_receive, - .mpo_cred_check_relabel = mac_biba_cred_check_relabel, - .mpo_cred_check_visible = mac_biba_cred_check_visible, - .mpo_ifnet_check_relabel = mac_biba_ifnet_check_relabel, - .mpo_ifnet_check_transmit = mac_biba_ifnet_check_transmit, - .mpo_inpcb_check_deliver = mac_biba_inpcb_check_deliver, - .mpo_sysvmsq_check_msgrcv = mac_biba_sysvmsq_check_msgrcv, - .mpo_sysvmsq_check_msgrmid = mac_biba_sysvmsq_check_msgrmid, - .mpo_sysvmsq_check_msqget = mac_biba_sysvmsq_check_msqget, - .mpo_sysvmsq_check_msqsnd = mac_biba_sysvmsq_check_msqsnd, - .mpo_sysvmsq_check_msqrcv = mac_biba_sysvmsq_check_msqrcv, - .mpo_sysvmsq_check_msqctl = mac_biba_sysvmsq_check_msqctl, - .mpo_sysvsem_check_semctl = mac_biba_sysvsem_check_semctl, - .mpo_sysvsem_check_semget = mac_biba_sysvsem_check_semget, - .mpo_sysvsem_check_semop = mac_biba_sysvsem_check_semop, - .mpo_sysvshm_check_shmat = mac_biba_sysvshm_check_shmat, - .mpo_sysvshm_check_shmctl = mac_biba_sysvshm_check_shmctl, - .mpo_sysvshm_check_shmget = mac_biba_sysvshm_check_shmget, - .mpo_kld_check_load = mac_biba_kld_check_load, - .mpo_mount_check_stat = mac_biba_mount_check_stat, - .mpo_pipe_check_ioctl = mac_biba_pipe_check_ioctl, - .mpo_pipe_check_poll = mac_biba_pipe_check_poll, - .mpo_pipe_check_read = mac_biba_pipe_check_read, - .mpo_pipe_check_relabel = mac_biba_pipe_check_relabel, - .mpo_pipe_check_stat = mac_biba_pipe_check_stat, - .mpo_pipe_check_write = mac_biba_pipe_check_write, - .mpo_posixsem_check_destroy = mac_biba_posixsem_check_write, - .mpo_posixsem_check_getvalue = mac_biba_posixsem_check_rdonly, - .mpo_posixsem_check_open = mac_biba_posixsem_check_write, - .mpo_posixsem_check_post = mac_biba_posixsem_check_write, - .mpo_posixsem_check_unlink = mac_biba_posixsem_check_write, - .mpo_posixsem_check_wait = mac_biba_posixsem_check_write, - .mpo_proc_check_debug = mac_biba_proc_check_debug, - .mpo_proc_check_sched = mac_biba_proc_check_sched, - .mpo_proc_check_signal = mac_biba_proc_check_signal, - .mpo_socket_check_deliver = mac_biba_socket_check_deliver, - .mpo_socket_check_relabel = mac_biba_socket_check_relabel, - .mpo_socket_check_visible = mac_biba_socket_check_visible, - .mpo_system_check_acct = mac_biba_system_check_acct, - .mpo_system_check_auditctl = mac_biba_system_check_auditctl, - .mpo_system_check_auditon = mac_biba_system_check_auditon, - .mpo_system_check_swapon = mac_biba_system_check_swapon, - .mpo_system_check_swapoff = mac_biba_system_check_swapoff, - .mpo_system_check_sysctl = mac_biba_system_check_sysctl, - .mpo_vnode_check_access = mac_biba_vnode_check_open, - .mpo_vnode_check_chdir = mac_biba_vnode_check_chdir, - .mpo_vnode_check_chroot = mac_biba_vnode_check_chroot, - .mpo_vnode_check_create = mac_biba_vnode_check_create, - .mpo_vnode_check_deleteacl = mac_biba_vnode_check_deleteacl, - .mpo_vnode_check_deleteextattr = mac_biba_vnode_check_deleteextattr, - .mpo_vnode_check_exec = mac_biba_vnode_check_exec, - .mpo_vnode_check_getacl = mac_biba_vnode_check_getacl, - .mpo_vnode_check_getextattr = mac_biba_vnode_check_getextattr, - .mpo_vnode_check_link = mac_biba_vnode_check_link, - .mpo_vnode_check_listextattr = mac_biba_vnode_check_listextattr, - .mpo_vnode_check_lookup = mac_biba_vnode_check_lookup, - .mpo_vnode_check_mmap = mac_biba_vnode_check_mmap, - .mpo_vnode_check_open = mac_biba_vnode_check_open, - .mpo_vnode_check_poll = mac_biba_vnode_check_poll, - .mpo_vnode_check_read = mac_biba_vnode_check_read, - .mpo_vnode_check_readdir = mac_biba_vnode_check_readdir, - .mpo_vnode_check_readlink = mac_biba_vnode_check_readlink, - .mpo_vnode_check_relabel = mac_biba_vnode_check_relabel, - .mpo_vnode_check_rename_from = mac_biba_vnode_check_rename_from, - .mpo_vnode_check_rename_to = mac_biba_vnode_check_rename_to, - .mpo_vnode_check_revoke = mac_biba_vnode_check_revoke, - .mpo_vnode_check_setacl = mac_biba_vnode_check_setacl, - .mpo_vnode_check_setextattr = mac_biba_vnode_check_setextattr, - .mpo_vnode_check_setflags = mac_biba_vnode_check_setflags, - .mpo_vnode_check_setmode = mac_biba_vnode_check_setmode, - .mpo_vnode_check_setowner = mac_biba_vnode_check_setowner, - .mpo_vnode_check_setutimes = mac_biba_vnode_check_setutimes, - .mpo_vnode_check_stat = mac_biba_vnode_check_stat, - .mpo_vnode_check_unlink = mac_biba_vnode_check_unlink, - .mpo_vnode_check_write = mac_biba_vnode_check_write, - .mpo_associate_nfsd_label = mac_biba_associate_nfsd_label, - .mpo_mbuf_create_from_firewall = mac_biba_mbuf_create_from_firewall, - .mpo_priv_check = mac_biba_priv_check, + .mpo_init = biba_init, + .mpo_bpfdesc_init_label = biba_init_label, + .mpo_cred_init_label = biba_init_label, + .mpo_devfs_init_label = biba_init_label, + .mpo_ifnet_init_label = biba_init_label, + .mpo_inpcb_init_label = biba_init_label_waitcheck, + .mpo_init_syncache_label = biba_init_label_waitcheck, + .mpo_sysvmsg_init_label = biba_init_label, + .mpo_sysvmsq_init_label = biba_init_label, + .mpo_sysvsem_init_label = biba_init_label, + .mpo_sysvshm_init_label = biba_init_label, + .mpo_ipq_init_label = biba_init_label_waitcheck, + .mpo_mbuf_init_label = biba_init_label_waitcheck, + .mpo_mount_init_label = biba_init_label, + .mpo_pipe_init_label = biba_init_label, + .mpo_posixsem_init_label = biba_init_label, + .mpo_socket_init_label = biba_init_label_waitcheck, + .mpo_socketpeer_init_label = biba_init_label_waitcheck, + .mpo_init_syncache_from_inpcb = biba_init_syncache_from_inpcb, + .mpo_vnode_init_label = biba_init_label, + .mpo_bpfdesc_destroy_label = biba_destroy_label, + .mpo_cred_destroy_label = biba_destroy_label, + .mpo_devfs_destroy_label = biba_destroy_label, + .mpo_ifnet_destroy_label = biba_destroy_label, + .mpo_inpcb_destroy_label = biba_destroy_label, + .mpo_destroy_syncache_label = biba_destroy_label, + .mpo_sysvmsg_destroy_label = biba_destroy_label, + .mpo_sysvmsq_destroy_label = biba_destroy_label, + .mpo_sysvsem_destroy_label = biba_destroy_label, + .mpo_sysvshm_destroy_label = biba_destroy_label, + .mpo_ipq_destroy_label = biba_destroy_label, + .mpo_mbuf_destroy_label = biba_destroy_label, + .mpo_mount_destroy_label = biba_destroy_label, + .mpo_pipe_destroy_label = biba_destroy_label, + .mpo_posixsem_destroy_label = biba_destroy_label, + .mpo_socket_destroy_label = biba_destroy_label, + .mpo_socketpeer_destroy_label = biba_destroy_label, + .mpo_vnode_destroy_label = biba_destroy_label, + .mpo_cred_copy_label = biba_copy_label, + .mpo_ifnet_copy_label = biba_copy_label, + .mpo_mbuf_copy_label = biba_copy_label, + .mpo_pipe_copy_label = biba_copy_label, + .mpo_socket_copy_label = biba_copy_label, + .mpo_vnode_copy_label = biba_copy_label, + .mpo_cred_externalize_label = biba_externalize_label, + .mpo_ifnet_externalize_label = biba_externalize_label, + .mpo_pipe_externalize_label = biba_externalize_label, + .mpo_socket_externalize_label = biba_externalize_label, + .mpo_socketpeer_externalize_label = biba_externalize_label, + .mpo_vnode_externalize_label = biba_externalize_label, + .mpo_cred_internalize_label = biba_internalize_label, + .mpo_ifnet_internalize_label = biba_internalize_label, + .mpo_pipe_internalize_label = biba_internalize_label, + .mpo_socket_internalize_label = biba_internalize_label, + .mpo_vnode_internalize_label = biba_internalize_label, + .mpo_devfs_create_device = biba_devfs_create_device, + .mpo_devfs_create_directory = biba_devfs_create_directory, + .mpo_devfs_create_symlink = biba_devfs_create_symlink, + .mpo_mount_create = biba_mount_create, + .mpo_vnode_relabel = biba_vnode_relabel, + .mpo_devfs_update = biba_devfs_update, + .mpo_devfs_vnode_associate = biba_devfs_vnode_associate, + .mpo_vnode_associate_extattr = biba_vnode_associate_extattr, + .mpo_vnode_associate_singlelabel = biba_vnode_associate_singlelabel, + .mpo_vnode_create_extattr = biba_vnode_create_extattr, + .mpo_vnode_setlabel_extattr = biba_vnode_setlabel_extattr, + .mpo_socket_create_mbuf = biba_socket_create_mbuf, + .mpo_create_mbuf_from_syncache = biba_create_mbuf_from_syncache, + .mpo_pipe_create = biba_pipe_create, + .mpo_posixsem_create = biba_posixsem_create, + .mpo_socket_create = biba_socket_create, + .mpo_socket_newconn = biba_socket_newconn, + .mpo_pipe_relabel = biba_pipe_relabel, + .mpo_socket_relabel = biba_socket_relabel, + .mpo_socketpeer_set_from_mbuf = biba_socketpeer_set_from_mbuf, + .mpo_socketpeer_set_from_socket = biba_socketpeer_set_from_socket, + .mpo_bpfdesc_create = biba_bpfdesc_create, + .mpo_ipq_reassemble = biba_ipq_reassemble, + .mpo_netinet_fragment = biba_netinet_fragment, + .mpo_ifnet_create = biba_ifnet_create, + .mpo_inpcb_create = biba_inpcb_create, + .mpo_sysvmsg_create = biba_sysvmsg_create, + .mpo_sysvmsq_create = biba_sysvmsq_create, + .mpo_sysvsem_create = biba_sysvsem_create, + .mpo_sysvshm_create = biba_sysvshm_create, + .mpo_ipq_create = biba_ipq_create, + .mpo_inpcb_create_mbuf = biba_inpcb_create_mbuf, + .mpo_create_mbuf_linklayer = biba_create_mbuf_linklayer, + .mpo_bpfdesc_create_mbuf = biba_bpfdesc_create_mbuf, + .mpo_ifnet_create_mbuf = biba_ifnet_create_mbuf, + .mpo_mbuf_create_multicast_encap = biba_mbuf_create_multicast_encap, + .mpo_mbuf_create_netlayer = biba_mbuf_create_netlayer, + .mpo_ipq_match = biba_ipq_match, + .mpo_ifnet_relabel = biba_ifnet_relabel, + .mpo_ipq_update = biba_ipq_update, + .mpo_inpcb_sosetlabel = biba_inpcb_sosetlabel, + .mpo_proc_create_swapper = biba_proc_create_swapper, + .mpo_proc_create_init = biba_proc_create_init, + .mpo_cred_relabel = biba_cred_relabel, + .mpo_sysvmsg_cleanup = biba_sysvmsg_cleanup, + .mpo_sysvmsq_cleanup = biba_sysvmsq_cleanup, + .mpo_sysvsem_cleanup = biba_sysvsem_cleanup, + .mpo_sysvshm_cleanup = biba_sysvshm_cleanup, + .mpo_bpfdesc_check_receive = biba_bpfdesc_check_receive, + .mpo_cred_check_relabel = biba_cred_check_relabel, + .mpo_cred_check_visible = biba_cred_check_visible, + .mpo_ifnet_check_relabel = biba_ifnet_check_relabel, + .mpo_ifnet_check_transmit = biba_ifnet_check_transmit, + .mpo_inpcb_check_deliver = biba_inpcb_check_deliver, + .mpo_sysvmsq_check_msgrcv = biba_sysvmsq_check_msgrcv, + .mpo_sysvmsq_check_msgrmid = biba_sysvmsq_check_msgrmid, + .mpo_sysvmsq_check_msqget = biba_sysvmsq_check_msqget, + .mpo_sysvmsq_check_msqsnd = biba_sysvmsq_check_msqsnd, + .mpo_sysvmsq_check_msqrcv = biba_sysvmsq_check_msqrcv, + .mpo_sysvmsq_check_msqctl = biba_sysvmsq_check_msqctl, + .mpo_sysvsem_check_semctl = biba_sysvsem_check_semctl, + .mpo_sysvsem_check_semget = biba_sysvsem_check_semget, + .mpo_sysvsem_check_semop = biba_sysvsem_check_semop, + .mpo_sysvshm_check_shmat = biba_sysvshm_check_shmat, + .mpo_sysvshm_check_shmctl = biba_sysvshm_check_shmctl, + .mpo_sysvshm_check_shmget = biba_sysvshm_check_shmget, + .mpo_kld_check_load = biba_kld_check_load, + .mpo_mount_check_stat = biba_mount_check_stat, + .mpo_pipe_check_ioctl = biba_pipe_check_ioctl, + .mpo_pipe_check_poll = biba_pipe_check_poll, + .mpo_pipe_check_read = biba_pipe_check_read, + .mpo_pipe_check_relabel = biba_pipe_check_relabel, + .mpo_pipe_check_stat = biba_pipe_check_stat, + .mpo_pipe_check_write = biba_pipe_check_write, + .mpo_posixsem_check_destroy = biba_posixsem_check_write, + .mpo_posixsem_check_getvalue = biba_posixsem_check_rdonly, + .mpo_posixsem_check_open = biba_posixsem_check_write, + .mpo_posixsem_check_post = biba_posixsem_check_write, + .mpo_posixsem_check_unlink = biba_posixsem_check_write, + .mpo_posixsem_check_wait = biba_posixsem_check_write, + .mpo_proc_check_debug = biba_proc_check_debug, + .mpo_proc_check_sched = biba_proc_check_sched, + .mpo_proc_check_signal = biba_proc_check_signal, + .mpo_socket_check_deliver = biba_socket_check_deliver, + .mpo_socket_check_relabel = biba_socket_check_relabel, + .mpo_socket_check_visible = biba_socket_check_visible, + .mpo_system_check_acct = biba_system_check_acct, + .mpo_system_check_auditctl = biba_system_check_auditctl, + .mpo_system_check_auditon = biba_system_check_auditon, + .mpo_system_check_swapon = biba_system_check_swapon, + .mpo_system_check_swapoff = biba_system_check_swapoff, + .mpo_system_check_sysctl = biba_system_check_sysctl, + .mpo_vnode_check_access = biba_vnode_check_open, + .mpo_vnode_check_chdir = biba_vnode_check_chdir, + .mpo_vnode_check_chroot = biba_vnode_check_chroot, + .mpo_vnode_check_create = biba_vnode_check_create, + .mpo_vnode_check_deleteacl = biba_vnode_check_deleteacl, + .mpo_vnode_check_deleteextattr = biba_vnode_check_deleteextattr, + .mpo_vnode_check_exec = biba_vnode_check_exec, + .mpo_vnode_check_getacl = biba_vnode_check_getacl, + .mpo_vnode_check_getextattr = biba_vnode_check_getextattr, + .mpo_vnode_check_link = biba_vnode_check_link, + .mpo_vnode_check_listextattr = biba_vnode_check_listextattr, + .mpo_vnode_check_lookup = biba_vnode_check_lookup, + .mpo_vnode_check_mmap = biba_vnode_check_mmap, + .mpo_vnode_check_open = biba_vnode_check_open, + .mpo_vnode_check_poll = biba_vnode_check_poll, + .mpo_vnode_check_read = biba_vnode_check_read, + .mpo_vnode_check_readdir = biba_vnode_check_readdir, + .mpo_vnode_check_readlink = biba_vnode_check_readlink, + .mpo_vnode_check_relabel = biba_vnode_check_relabel, + .mpo_vnode_check_rename_from = biba_vnode_check_rename_from, + .mpo_vnode_check_rename_to = biba_vnode_check_rename_to, + .mpo_vnode_check_revoke = biba_vnode_check_revoke, + .mpo_vnode_check_setacl = biba_vnode_check_setacl, + .mpo_vnode_check_setextattr = biba_vnode_check_setextattr, + .mpo_vnode_check_setflags = biba_vnode_check_setflags, + .mpo_vnode_check_setmode = biba_vnode_check_setmode, + .mpo_vnode_check_setowner = biba_vnode_check_setowner, + .mpo_vnode_check_setutimes = biba_vnode_check_setutimes, + .mpo_vnode_check_stat = biba_vnode_check_stat, + .mpo_vnode_check_unlink = biba_vnode_check_unlink, + .mpo_vnode_check_write = biba_vnode_check_write, + .mpo_associate_nfsd_label = biba_associate_nfsd_label, + .mpo_mbuf_create_from_firewall = biba_mbuf_create_from_firewall, + .mpo_priv_check = biba_priv_check, }; MAC_POLICY_SET(&mac_biba_ops, mac_biba, "TrustedBSD MAC/Biba", - MPC_LOADTIME_FLAG_NOTLATE | MPC_LOADTIME_FLAG_LABELMBUFS, &mac_biba_slot); + MPC_LOADTIME_FLAG_NOTLATE | MPC_LOADTIME_FLAG_LABELMBUFS, &biba_slot); |