Add a mac_inpcb_check_visible implementation to all MAC policies

that handle mac_socket_check_visible.

Reviewed by:	rwatson
MFC after:	3 months (set timer; decide then)

1 files changed, 19 insertions, 0 deletions

diff --git a/sys/security/mac_mls/mac_mls.c b/sys/security/mac_mls/mac_mls.c
index 597628f..af8d276 100644
--- a/sys/security/mac_mls/mac_mls.c
+++ b/sys/security/mac_mls/mac_mls.c
@@ -1033,6 +1033,24 @@ mls_inpcb_check_deliver(struct inpcb *inp, struct label *inplabel,
 	return (mls_equal_effective(p, i) ? 0 : EACCES);
 }
 
+static int
+mls_inpcb_check_visible(struct ucred *cred, struct inpcb *inp,
+    struct label *inplabel)
+{
+	struct mac_mls *subj, *obj;
+
+	if (!mls_enabled)
+		return (0);
+
+	subj = SLOT(cred->cr_label);
+	obj = SLOT(inplabel);
+
+	if (!mls_dominate_effective(subj, obj))
+		return (ENOENT);
+
+	return (0);
+}
+
 static void
 mls_inpcb_create(struct socket *so, struct label *solabel, struct inpcb *inp,
     struct label *inplabel)
@@ -2923,6 +2941,7 @@ static struct mac_policy_ops mls_ops =
 	.mpo_ifnet_relabel = mls_ifnet_relabel,
 
 	.mpo_inpcb_check_deliver = mls_inpcb_check_deliver,
+	.mpo_inpcb_check_visible = mls_inpcb_check_visible,
 	.mpo_inpcb_create = mls_inpcb_create,
 	.mpo_inpcb_create_mbuf = mls_inpcb_create_mbuf,
 	.mpo_inpcb_destroy_label = mls_destroy_label,